oysteikt/nix-dotfiles
oysteikt
/
nix-dotfiles
2
1
Fork 0
Code Issues Pull Requests Activity
431 Commits 4 Branches 0 Tags 1.7 MiB
Commit Graph

225 Commits

Author SHA1 Message Date
Oystein Kristoffer Tveit 5bb10df9e1
tsuki/borg: partial systemd hardening 
There's still quite a bit to do, but the service fails on a weird option
that I've not been able to pin down. At least this is better than
nothing ¯\_(ツ)_/¯
 2023-10-06 18:27:17 +02:00
Oystein Kristoffer Tveit 450d26cf4b
tsuki/atuin: use socket activation 2023-10-06 18:27:16 +02:00
Oystein Kristoffer Tveit aca2962eec
tsuki/vaultwarden: use socket activation 2023-10-06 18:27:15 +02:00
Oystein Kristoffer Tveit caedfe1810
tsuki/matrix/stickers: use new module and add lots of stickerpacks 2023-10-06 18:27:14 +02:00
Oystein Kristoffer Tveit 6663a8f280
tsuki/atuin: systemd harden 2023-07-28 22:25:50 +02:00
Oystein Kristoffer Tveit dec150ae98
gpg agent: systemwide -> homemanager 2023-07-28 22:23:43 +02:00
Oystein Kristoffer Tveit 5f7eb0c8a5
tsuki/prometheus: add exporters for hedgedoc and gitea 2023-07-28 22:09:43 +02:00
Oystein Kristoffer Tveit d74ed2d045
tsuki/grafana: enable oauth2, misc hardening 2023-07-28 22:05:23 +02:00
Oystein Kristoffer Tveit 816a46603a
tsuki/vaultwarden: systemd harden 2023-07-28 22:05:22 +02:00
Oystein Kristoffer Tveit b5874e2bcd
tsuki/navidrome: init 2023-07-28 22:05:22 +02:00
Oystein Kristoffer Tveit c2026eefeb
tsuki/nginx: small refactor 2023-07-28 22:05:22 +02:00
Oystein Kristoffer Tveit e6605b3a73
common/sshd: socket activate 2023-07-28 22:05:21 +02:00
Oystein Kristoffer Tveit c98a1a0541
tsuki/jupyter: harden security with sops and systemd 2023-07-28 22:00:07 +02:00
Oystein Kristoffer Tveit 4456244f2d
modules: add modules for socket activation 2023-07-28 21:32:13 +02:00
Oystein Kristoffer Tveit f1e8c87acd
tsuki/configuration.nix: remove a few unused imports 2023-07-12 23:43:23 +02:00
Oystein Kristoffer Tveit 1f5832074b
tsuki/taskserver: (unfinished) start setting up taskserver and taskwarrior 2023-07-12 23:42:07 +02:00
Oystein Kristoffer Tveit 6c2bd3f2d5
tsuki/invidious: remove redundant code, add comments 2023-07-12 23:38:41 +02:00
Oystein Kristoffer Tveit 394a932988
tsuki/nginx: misc: 
- Move temporary website into its own file
- Collect all http uris into upstreams
- Convert some upstreams to UNIX sockets, as changed in the last few
  commits
 2023-07-12 23:36:57 +02:00
Oystein Kristoffer Tveit 24a02d386c
tsuki/hedgedoc: misc: 
- Experiment with reducing the number of options in the module
- Use UNIX socket behind nginx
- "Upstream" systemd hardening to module
 2023-07-12 23:34:23 +02:00
Oystein Kristoffer Tveit 5ea58f1b98
tsuki/gitea: use UNIX socket behind gitea 2023-07-12 23:30:39 +02:00
Oystein Kristoffer Tveit fd052eea5a
tsuki/grafana: use UNIX socket behind nginx 2023-07-12 23:27:10 +02:00
Oystein Kristoffer Tveit 1f3b5addd3
tsuki/hedgedoc: misc: 
- configure oauth2 (this requires a custom module for now,
    will be resolved in 23.11)
- harden systemd service
- add systemd requires list
- use socket postgres uri
 2023-07-12 02:30:00 +02:00
Oystein Kristoffer Tveit 5250d40457
grub: remove version, attr for 23.05 2023-07-12 02:06:41 +02:00
Oystein Kristoffer Tveit cf42debf37
tsuki/invidious: misc: 
- bind to 127.0.0.1
- depend on postgresql systemd unit
 2023-07-12 02:06:41 +02:00
Oystein Kristoffer Tveit c8db83b925
tsuki/plex: harden systemd unit 2023-07-12 02:06:41 +02:00
Oystein Kristoffer Tveit 20de3c260f
tsuki/postgres: misc: 
- add postgresql backup service
- harden systemd unit
- increase max_connections
 2023-07-12 02:06:40 +02:00
Oystein Kristoffer Tveit 82ea6e9f5a
tsuki: add timed nhk easy news scraper 2023-07-12 02:06:40 +02:00
Oystein Kristoffer Tveit dddc92877c
tsuki/matrix/matrix-appservice-irc: enable lainchan irc bouncer 2023-07-12 02:06:40 +02:00
Oystein Kristoffer Tveit 68b181fc05
tsuki/matrix/mx-puppet-discord: disable temporarily 
This still uses an old version of node that is disabled
in nixpkgs 23.05, disabling for now
 2023-07-12 02:06:39 +02:00
Oystein Kristoffer Tveit 98745298c7
tsuki/matrix/mautrix-facebook: disable 
Got banned one too many times, disabling for now.
 2023-07-12 02:06:39 +02:00
Oystein Kristoffer Tveit 8a42e97014
tsuki/monitoring: misc: 
- Secure grafana better, it had secrets in the nix store
- Set up prometheus exporters for nginx and php-fpm
- Add urls for dashboards
- Disable automatic updates
 2023-07-12 02:06:39 +02:00
Oystein Kristoffer Tveit 25b6f0f3e9
tsuki/vaultwarden: add vaultwarden, password manager 2023-07-12 02:06:38 +02:00
Oystein Kristoffer Tveit 40e95ce030
tsuki/borg: set up borgbackup 2023-07-12 02:06:37 +02:00
Oystein Kristoffer Tveit 0e3a4c35d2
tsuki/atuin: set up atuin server 2023-07-12 02:06:16 +02:00
Oystein Kristoffer Tveit fc0e4f6c52
tsuki/nginx/www: real website dead, add temporary website 2023-07-12 02:04:57 +02:00
Oystein Kristoffer Tveit 949f228c97
tsuki/hydra: put all services below `system-hydra.slice` 2023-07-12 02:04:56 +02:00
Oystein Kristoffer Tveit 7f8d60057d
tsuki/headscale: fix oauth2, and set up tailscale 2023-07-12 02:04:53 +02:00
Oystein Kristoffer Tveit dc14eaa086
sops: add kasei to sops 2023-05-08 02:50:47 +02:00
Oystein Kristoffer Tveit 3267e5f687
tsuki/headscale: start working on oidc login 2023-05-08 02:36:17 +02:00
Oystein Kristoffer Tveit cc03b64376
common: use machinevars to determine whether to use x11 2023-05-08 02:36:15 +02:00
Oystein Kristoffer Tveit 58061df4ab
tsuki: set up nextcloud, without enabling it 2023-05-08 02:36:14 +02:00
Oystein Kristoffer Tveit 32885239c3
tsuki/pgadmin: misc 
- The pgadmin config has grown, and as a result, it has been split from
    the postgres file.
- Setup OAuth
- Setup uWSGI and forward to nginx via socket
  (This last part is still a little borked, and the service is not
  functioning entirely just yet)
 2023-05-08 02:36:13 +02:00
Oystein Kristoffer Tveit 53dbedef2b
tsuki/hedgedoc: small auth url improvement 2023-05-08 02:36:12 +02:00
Oystein Kristoffer Tveit f8c06f985e
common: update openssh setting API 2023-05-08 02:36:12 +02:00
Oystein Kristoffer Tveit 7cdf122c58
tsuki: set up invidious 2023-05-08 02:36:10 +02:00
Oystein Kristoffer Tveit df3aa7c10e
tsuki: setup oauth2 for pgadmin 
This commit also changes the pgadmin package from `22.11` to `unstable`
 2023-03-17 01:28:33 +01:00
Oystein Kristoffer Tveit 5e2a5a939b
tsuki: move gitea postgres password to sops 2023-03-08 15:59:50 +01:00
Oystein Kristoffer Tveit a82a3f95c0
tsuki: move hardware config to configuration file 2023-03-08 15:26:07 +01:00
Oystein Kristoffer Tveit 7a0fcf7805
tsuki: configure wildcard certs for nginx 2023-03-08 14:54:43 +01:00
Oystein Kristoffer Tveit ebd854a0ae
gitea: set up oauth2 2023-03-08 14:54:42 +01:00
Oystein Kristoffer Tveit dd6c99226e
tsuki: set up hedgedoc 
the dynmap subdomain was also renamed from "dyn" to "map" in this commit
 2023-03-08 14:54:40 +01:00
Oystein Kristoffer Tveit 1d99bbfd46
Set up sops-nix 2023-03-07 23:15:21 +01:00
Oystein Kristoffer Tveit 2ad7b7b2c3
tsuki: remove keycloak 2023-03-07 23:15:20 +01:00
Oystein Kristoffer Tveit 0df70d6c72
tsuki: add well-known autoconfig for thunderbird mail 2023-03-07 23:15:19 +01:00
Oystein Kristoffer Tveit d5ae85092c
tsuki: set up kanidm 2023-03-07 23:15:18 +01:00
Oystein Kristoffer Tveit f41fcce8c6
common: add some more nix options 2023-02-26 04:36:21 +01:00
Oystein Kristoffer Tveit 7c3c830d6e
tsuki: add recommended minecraft jvm flags 2023-02-25 21:15:35 +01:00
Oystein Kristoffer Tveit 5b0dd71b4a
tsuki: add some systemd constraints 
Add some systemd constraints to some fix boottime service failures
 2023-02-25 21:12:38 +01:00
Oystein Kristoffer Tveit a08f6ce28e
tsuki: add `.well-known/matrix/client` 2023-02-25 21:10:39 +01:00
Oystein Kristoffer Tveit 1eefc118bf
tsuki: add postgres to environment 2023-02-25 20:01:57 +01:00
Oystein Kristoffer Tveit 7f416ed5b8
common.nix: fix weird headless-var recursion issue 2023-02-25 18:05:57 +01:00
Oystein Kristoffer Tveit 42938295ac
kasei: misc changes 
- new screen setup
- new network setup
- don't explicitly enable xserver and lightdm
- add nvidia video drivers to x11
 2023-02-25 18:04:55 +01:00
Oystein Kristoffer Tveit 7ee4535963
kasei: enable docker and libvirtd 2023-02-25 18:01:22 +01:00
Oystein Kristoffer Tveit c215f945e9
kasei: move hardware-configuration to main config 2023-02-25 18:01:06 +01:00
Oystein Kristoffer Tveit 6b037127e2
kasei: add temporary logid service 2023-02-25 18:00:02 +01:00
Oystein Kristoffer Tveit 45497aea2b
tsuki: set up proper grafana infrastructure 
- Set up a bunch of exporters
- Download matching dashboard declarations
- Remove influxdb
 2023-01-20 19:55:52 +01:00
Oystein Kristoffer Tveit b772e3eca3
use resolved globally 2023-01-20 19:53:08 +01:00
Oystein Kristoffer Tveit e840a95ebe
tsuki: use matrix-synapse-next module with workers 2023-01-20 19:52:04 +01:00
Oystein Kristoffer Tveit 47d8aa7899
tsuki: add headscale 2023-01-16 17:16:42 +01:00
Oystein Kristoffer Tveit b5030a7c06
tsuki: move grafana config into nondeprecated attrset 2023-01-16 17:16:40 +01:00
Oystein Kristoffer Tveit 3820be9ef9
tsuki: update matrix stickers 2023-01-16 17:16:39 +01:00
Oystein Kristoffer Tveit ef4f5d4dd4
tsuki: reduce amount of gitea backups, and move state dir 2023-01-16 16:11:28 +01:00
Oystein Kristoffer Tveit eaa2e9bd1d
tsuki: update matrix stickers 2023-01-16 16:10:12 +01:00
Oystein Kristoffer Tveit 1b0ed26f15
tsuki: set up minecraft server 2023-01-16 16:06:34 +01:00
Oystein Kristoffer Tveit c78b2a2c26
tsuki: add osuchan service 2023-01-04 14:32:11 +01:00
Oystein Kristoffer Tveit 47f8183490
tsuki: move all datafiles/drives to TrueNAS NFS 2023-01-03 23:01:08 +01:00
Oystein Kristoffer Tveit aea736c2df
tsuki: remove a lot of unused services 
Removed:
- dokuwiki (this was never properly set up)
- libvirt (this is already a virtual machine, double virtualization bad)
- openldap (this will become the responsibility of keycloak)
- openvpn (this will become the responsibility of head/tailscale)
- samba (this is now the responsibility of TrueNAS)
- searx (I never used this)
- gitlab (this has become the responsibility of gitea and hydra)
- syncthing (this was never properly set up)

The nix cache nginx entry is also paused, as it wasn't functional.

In this commit and the previous commit, the nginx config for the
minecraft server was also taken down, as the whole host is deleted.
The plan is to set it up again, this time using tsuki.
 2023-01-03 22:52:24 +01:00
Oystein Kristoffer Tveit 3d088d73be
tsuki: add maunium stickerpickers 2023-01-03 22:46:21 +01:00
Oystein Kristoffer Tveit 2e3c8631fe
bi-annual nixos upgrade: `22.05` -> `22.11` 2022-11-26 22:50:17 +01:00
Oystein Kristoffer Tveit f2a89d7c82
grafana: split up configuration + postgres 
- Move `services/grafana.nix` to `services/grafana/default.nix`
- Split up all data collectors into separate files under
  `services/grafana`
- Make grafana use postgres as its database
 2022-11-26 17:16:04 +01:00
Oystein Kristoffer Tveit 850eaa9b1a
Switch to fcitx5 2022-11-20 18:32:03 +01:00
Oystein Kristoffer Tveit 8de5dd5f23
shell: update fixdisplay command 
- add new `position` and `primary` options for fixdisplay
- make command completely lowercase
- initialize global zshrc
 2022-11-20 17:12:27 +01:00
Oystein Kristoffer Tveit af345b38fc
kasei: add special home-manager-testing system config 2022-11-19 16:35:01 +01:00
Oystein Kristoffer Tveit bd7980ad97
kasei: remove wifi drivers (switch to ethernet) 2022-11-19 16:18:25 +01:00
Oystein Kristoffer Tveit 14acc9a389
buildMachines: fix tsuki builder url 2022-11-19 16:16:05 +01:00
Oystein Kristoffer Tveit b3aa6cad81
lib: move lib extensions into its own module argument 2022-11-19 16:14:18 +01:00
Oystein Kristoffer Tveit ec2dd35824
kasei: update fixdisplay command 2022-11-11 21:19:46 +01:00
Oystein Kristoffer Tveit f9280452fb
nginx: fix failing hosts 
- nani.wtf has changed flake structure
- jupyter need websockets
 2022-11-08 14:28:59 +01:00
Oystein Kristoffer Tveit 61a99fae7b
postgres: add backup service, change initial mail 2022-11-08 14:20:33 +01:00
Oystein Kristoffer Tveit b5de57fd01
Add config for jupyter 2022-11-05 22:49:54 +01:00
Oystein Kristoffer Tveit 5d78680e82
Add dirty hack to fix gitea temporarily 2022-11-03 23:16:18 +01:00
Oystein Kristoffer Tveit 4647c562ab
Remove unused nginx.nix, which was renamed in 1881cb0 2022-10-14 00:06:00 +02:00
Oystein Kristoffer Tveit db29ccddca
Tweaked Gitea theme and config 2022-10-14 00:02:19 +02:00
Oystein Kristoffer Tveit bdc8817eef
Added nix builder config for tsuki and isvegg 
- Also updated nix package name
 2022-10-13 23:58:48 +02:00
Oystein Kristoffer Tveit 1881cb0bca
Extended nani.wtf/.well-known with some new stuff 
- Added WKD openpgp key
- Added security.txt
- Added keybase.txt
 2022-10-13 23:42:42 +02:00
Oystein Kristoffer Tveit 1ff35d1c2d
Add trusted matrix servers 2022-10-06 21:30:47 +02:00
Oystein Kristoffer Tveit cf7c367416
Several gitea changes: 
- Add monokai theme
- Set package to unstable
- Set landing page to explore
 2022-10-06 21:27:20 +02:00
Oystein Kristoffer Tveit 591c1b0968
Add yubikey support 2022-09-22 04:08:38 +02:00
Oystein Kristoffer Tveit fe3bdd4949
add 'https' to hydra link for proper website links 2022-09-22 01:58:26 +02:00
Oystein Kristoffer Tveit 2a722dbf73
Use hydra with unstable nix tool 2022-09-22 00:51:00 +02:00
Oystein Kristoffer Tveit 531bd4bab3
Configure nginx to play nice with cloudflare 2022-09-22 00:48:21 +02:00
Oystein Kristoffer Tveit 22419caadd
Several changes: 
- Change secret outputs into home-manager and nixos specific
- Specifiy home-manager module import in flake.
 2022-08-19 14:50:03 +02:00
Oystein Kristoffer Tveit b7d71c1e69
Change kasei nvidia driver 2022-08-19 12:55:26 +02:00
Oystein Kristoffer Tveit 0fc1d15c35
Several changes to Xmonad/Xmobar: 
- Change from xmobar to polybar
- Rename workspaces
- Add some new scratchpads
- Change xmonad.org to xmonad.hs
 2022-08-19 03:49:21 +02:00
Oystein Kristoffer Tveit 8f68ada082
Move home-manager related files into home directory 2022-08-19 01:54:13 +02:00
Oystein Kristoffer Tveit 56a100f0c6
Set up samba 2022-08-19 01:08:22 +02:00
Oystein Kristoffer Tveit 3f7f9ceead
Use unstable nix tool 2022-08-18 23:15:50 +02:00
Oystein Kristoffer Tveit 68c1ee2656 Make project buildable 2022-08-16 03:24:06 +02:00
Oystein Kristoffer Tveit e72231e80a Pull out more host settings to common 2022-08-16 02:09:56 +02:00
Oystein Kristoffer Tveit 26218809a5 Several changes 2022-06-22 20:16:57 +02:00
Oystein Kristoffer Tveit 1dcc822bfd update synapse 2022-06-22 20:09:30 +02:00
Oystein Kristoffer Tveit efcfd09530 misc small changes 
- make vscode linenumbers relative
- add vscode-server
- make gitea backup hourly
- some changes in nginx vhosts
- add disk to tsuki
- update flake lock
 2022-06-21 01:52:34 +02:00
Oystein Kristoffer Tveit 79a995e19e Move colors and machinevars into modules 2022-06-21 01:47:36 +02:00
Oystein Kristoffer Tveit 2eae0e5ebf Upgrade to 22.05 2022-06-12 00:23:10 +02:00
Oystein Kristoffer Tveit 8e3f28bc31 Extract lots of host config to common config 2022-06-12 00:07:40 +02:00
Oystein Kristoffer Tveit 8d5dad65d5 Edit matrix max upload size 2022-06-11 19:56:00 +02:00
Oystein Kristoffer Tveit ade8bdfc2c Set up matrix properly 
- fixed federation
- hooked up bridges:
  - mx-discord-puppet
  - mautrix-facebook
 2022-04-12 03:28:10 +02:00
Oystein Kristoffer Tveit 22a80c873b Fix secrets module 2022-04-03 18:20:50 +02:00
Oystein Kristoffer Tveit 5bc2782cd6 Update kasei hardware config 2022-04-03 18:04:06 +02:00
Oystein Kristoffer Tveit cad1f6abe5 Restructure home management 
- Home config is now imported as a module from the host config
- The configuration takes variables to decide which settings to activate
- Extra fonts were added
- Some packages were added/reactivated
 2022-04-03 18:03:55 +02:00
Oystein Kristoffer Tveit 267e6aeaca Configure searx 2022-03-22 23:06:02 +01:00
Oystein Kristoffer Tveit 235b7c2654 Add website 2022-03-22 23:05:42 +01:00
Oystein Kristoffer Tveit 98a7aaa61a Set up gitea 2022-03-22 17:00:48 +01:00
Oystein Kristoffer Tveit 092271897c Add kasei 2022-03-22 16:36:19 +01:00
Oystein Kristoffer Tveit 1f105ac9d1 Initial commit 2022-03-07 16:01:52 +01:00