Compare commits
25 Commits
cleanup-x1
...
main
73
flake.lock
73
flake.lock
|
|
@ -69,19 +69,6 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"fonts": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1668957008,
|
||||
"narHash": "sha256-er2eUfNSG9qdBh0JvtxtftQjFfTFjRqqD8dnk5nZ1qw=",
|
||||
"path": "/home/h7x4/git/fonts",
|
||||
"type": "path"
|
||||
},
|
||||
"original": {
|
||||
"path": "/home/h7x4/git/fonts",
|
||||
"type": "path"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
|
|
@ -89,11 +76,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1718530513,
|
||||
"narHash": "sha256-BmO8d0r+BVlwWtMLQEYnwmngqdXIuyFzMwvmTcLMee8=",
|
||||
"lastModified": 1726989464,
|
||||
"narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "a1fddf0967c33754271761d91a3d921772b30d0e",
|
||||
"rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -103,26 +90,6 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager-local": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs-unstable"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1719170506,
|
||||
"narHash": "sha256-AROqng7/S3mTByq8DBVR6r0iW1yZH+otJkqOwLHvELE=",
|
||||
"ref": "refs/heads/fix-stalonetrayrc-path",
|
||||
"rev": "0e5656163c2f9ac6e2cc4de3b44beb7a137abbe6",
|
||||
"revCount": 3588,
|
||||
"type": "git",
|
||||
"url": "file:///home/h7x4/git/home-manager"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "file:///home/h7x4/git/home-manager"
|
||||
}
|
||||
},
|
||||
"matrix-synapse-next": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
|
|
@ -191,11 +158,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1719278718,
|
||||
"narHash": "sha256-gWQb4P9CZgKzTn4F4eWMYeUv2AQOXFlcFmFXh2apoyA=",
|
||||
"lastModified": 1728006367,
|
||||
"narHash": "sha256-Bdf5twzinaacnn1JBogvxq0S8Ytm+25mWD2cfJ7fvpo=",
|
||||
"owner": "infinidoge",
|
||||
"repo": "nix-minecraft",
|
||||
"rev": "b6ff85f3b416a700ac35e33c214d7c9f4fe071fa",
|
||||
"rev": "a3a7888df1b87bdababfd9f0b00b574ee4c2e204",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -206,11 +173,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1719145550,
|
||||
"narHash": "sha256-K0i/coxxTEl30tgt4oALaylQfxqbotTSNb1/+g+mKMQ=",
|
||||
"lastModified": 1728193676,
|
||||
"narHash": "sha256-PbDWAIjKJdlVg+qQRhzdSor04bAPApDqIv2DofTyynk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e4509b3a560c87a8d4cb6f9992b8915abf9e36d8",
|
||||
"rev": "ecbc1ca8ffd6aea8372ad16be9ebbb39889e55b6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -221,27 +188,27 @@
|
|||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1719099622,
|
||||
"narHash": "sha256-YzJECAxFt+U5LPYf/pCwW/e1iUd2PF21WITHY9B/BAs=",
|
||||
"lastModified": 1728156290,
|
||||
"narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "5e8e3b89adbd0be63192f6e645e0a54080004924",
|
||||
"rev": "17ae88b569bb15590549ff478bab6494dde4a907",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "release-23.11",
|
||||
"ref": "release-24.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1719254875,
|
||||
"narHash": "sha256-ECni+IkwXjusHsm9Sexdtq8weAq/yUyt1TWIemXt3Ko=",
|
||||
"lastModified": 1728018373,
|
||||
"narHash": "sha256-NOiTvBbRLIOe5F6RbHaAh6++BNjsb149fGZd1T4+KBg=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "2893f56de08021cffd9b6b6dfc70fd9ccd51eb60",
|
||||
"rev": "bc947f541ae55e999ffdb4013441347d83b00feb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -273,9 +240,7 @@
|
|||
"root": {
|
||||
"inputs": {
|
||||
"dotfiles": "dotfiles",
|
||||
"fonts": "fonts",
|
||||
"home-manager": "home-manager",
|
||||
"home-manager-local": "home-manager-local",
|
||||
"matrix-synapse-next": "matrix-synapse-next",
|
||||
"maunium-stickerpicker": "maunium-stickerpicker",
|
||||
"minecraft": "minecraft",
|
||||
|
|
@ -314,11 +279,11 @@
|
|||
"nixpkgs-stable": "nixpkgs-stable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1719268571,
|
||||
"narHash": "sha256-pcUk2Fg5vPXLUEnFI97qaB8hto/IToRfqskFqsjvjb8=",
|
||||
"lastModified": 1728342863,
|
||||
"narHash": "sha256-OeVSBqpigXgX3tuvkO2B3xN1ONSF0iFTbi6et7YhX+M=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "c2ea1186c0cbfa4d06d406ae50f3e4b085ddc9b3",
|
||||
"rev": "84d006846f98b2bfed3796f1ccc8e62faf0c2ae9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
35
flake.nix
35
flake.nix
|
|
@ -1,10 +1,11 @@
|
|||
{
|
||||
inputs = {
|
||||
nixpkgs.url = "nixpkgs/nixos-24.05";
|
||||
nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
|
||||
nixpkgs.url = "nixpkgs/nixos-24.11";
|
||||
# nixpkgs-unstable.url = "nixpkgs/nixpkgs-unstable";
|
||||
nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";
|
||||
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager/release-24.05";
|
||||
url = "github:nix-community/home-manager/release-24.11";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
|
|
@ -87,7 +88,7 @@
|
|||
android_sdk.accept_license = true;
|
||||
segger-jlink.acceptLicense = true;
|
||||
permittedInsecurePackages = [
|
||||
"segger-jlink-qt4-794l"
|
||||
"segger-jlink-qt4-796s"
|
||||
];
|
||||
};
|
||||
|
||||
|
|
@ -97,30 +98,16 @@
|
|||
config.allowUnfree = true;
|
||||
config.segger-jlink.acceptLicense = true;
|
||||
config.permittedInsecurePackages = [
|
||||
"segger-jlink-qt4-794s"
|
||||
"segger-jlink-qt4-796s"
|
||||
];
|
||||
};
|
||||
in [
|
||||
(self: super: {
|
||||
inherit (nonrecursive-unstable-pkgs)
|
||||
atuin
|
||||
wstunnel
|
||||
nrf-udev
|
||||
nrfutil
|
||||
calibre
|
||||
fcitx5-mozc
|
||||
;
|
||||
})
|
||||
|
||||
# https://github.com/NixOS/nixpkgs/pull/251706
|
||||
(self: super: {
|
||||
mozc = self.qt6Packages.callPackage ./package-overrides/mozc.nix { };
|
||||
fcitx5-mozc = self.callPackage ./package-overrides/fcitx5-mozc.nix { };
|
||||
})
|
||||
|
||||
(self: super: {
|
||||
mpv-unwrapped = super.mpv-unwrapped.override {
|
||||
ffmpeg = super.ffmpeg_6-full;
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
|
|
@ -221,7 +208,11 @@
|
|||
"specialArgs"
|
||||
]));
|
||||
in {
|
||||
dosei = nixSys "dosei" { };
|
||||
dosei = nixSys "dosei" {
|
||||
modules = [{
|
||||
home-manager.users.h7x4.home.uid = 1001;
|
||||
}];
|
||||
};
|
||||
kasei = nixSys "kasei" { };
|
||||
europa = nixSys "europa" { };
|
||||
tsuki = nixSys "tsuki" {
|
||||
|
|
|
|||
|
|
@ -10,22 +10,34 @@ in {
|
|||
|
||||
./programs/aria2.nix
|
||||
./programs/atuin.nix
|
||||
./programs/bash.nix
|
||||
./programs/bat.nix
|
||||
./programs/beets.nix
|
||||
./programs/bottom.nix
|
||||
./programs/comma.nix
|
||||
./programs/direnv
|
||||
./programs/eza.nix
|
||||
./programs/fzf.nix
|
||||
./programs/gdb.nix
|
||||
./programs/gh.nix
|
||||
./programs/gh-dash.nix
|
||||
./programs/gh.nix
|
||||
./programs/git
|
||||
./programs/gpg
|
||||
./programs/home-manager.nix
|
||||
./programs/jq.nix
|
||||
./programs/less.nix
|
||||
./programs/man.nix
|
||||
./programs/neovim
|
||||
./programs/nix-index
|
||||
./programs/pandoc.nix
|
||||
./programs/ripgrep.nix
|
||||
./programs/ssh
|
||||
./programs/tealdeer
|
||||
./programs/texlive.nix
|
||||
./programs/thunderbird.nix
|
||||
./programs/tmux.nix
|
||||
./programs/tmux
|
||||
./programs/yt-dlp.nix
|
||||
./programs/zoxide.nix
|
||||
./programs/zsh
|
||||
|
||||
./services/nix-channel-update.nix
|
||||
|
|
@ -33,14 +45,18 @@ in {
|
|||
|
||||
./modules/colors.nix
|
||||
./modules/shellAliases.nix
|
||||
./modules/uidGid.nix
|
||||
] ++ optionals graphics [
|
||||
./config/gtk.nix
|
||||
|
||||
./programs/alacritty.nix
|
||||
./programs/emacs
|
||||
./programs/feh.nix
|
||||
./programs/firefox.nix
|
||||
./programs/mpv.nix
|
||||
./programs/ncmpcpp.nix
|
||||
./programs/newsboat
|
||||
./programs/obs-studio.nix
|
||||
./programs/qutebrowser.nix
|
||||
./programs/rofi.nix
|
||||
./programs/taskwarrior.nix
|
||||
|
|
@ -53,7 +69,10 @@ in {
|
|||
./services/copyq.nix
|
||||
./services/dunst.nix
|
||||
./services/fcitx5.nix
|
||||
./services/gnome-keyring.nix
|
||||
./services/keybase.nix
|
||||
./services/mpd.nix
|
||||
./services/network-manager.nix
|
||||
./services/picom.nix
|
||||
./services/polybar.nix
|
||||
./services/screen-locker.nix
|
||||
|
|
@ -132,51 +151,6 @@ in {
|
|||
|
||||
fonts.fontconfig.enable = mkForce true;
|
||||
|
||||
programs = {
|
||||
home-manager.enable = true;
|
||||
|
||||
bash = {
|
||||
enable = true;
|
||||
historyFile = "${config.xdg.dataHome}/bash_history";
|
||||
historySize = 100000;
|
||||
bashrcExtra = ''
|
||||
source "${config.xdg.configHome}/mutable_env.sh"
|
||||
'';
|
||||
};
|
||||
|
||||
bat.enable = true;
|
||||
bottom = {
|
||||
enable = true;
|
||||
settings.flags.enable_gpu = true;
|
||||
};
|
||||
eza.enable = true;
|
||||
feh.enable = mkIf graphics true;
|
||||
fzf = {
|
||||
enable = true;
|
||||
defaultCommand = "fd --type f";
|
||||
};
|
||||
man = {
|
||||
enable = true;
|
||||
generateCaches = true;
|
||||
};
|
||||
mpv.enable = mkIf graphics true;
|
||||
obs-studio.enable = mkIf graphics true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
includes = [ "mutable_config" ];
|
||||
};
|
||||
texlive = {
|
||||
enable = true;
|
||||
# packageSet = pkgs.texlive.combined.scheme-medium;
|
||||
};
|
||||
zoxide.enable = true;
|
||||
};
|
||||
|
||||
services = {
|
||||
gnome-keyring.enable = mkIf graphics true;
|
||||
network-manager-applet.enable = mkIf graphics true;
|
||||
};
|
||||
|
||||
manual = {
|
||||
html.enable = true;
|
||||
manpages.enable = true;
|
||||
|
|
|
|||
|
|
@ -0,0 +1,13 @@
|
|||
{ lib, ... }:
|
||||
{
|
||||
options.home = {
|
||||
uid = lib.mkOption {
|
||||
default = 1000;
|
||||
type = lib.types.ints.between 0 60000;
|
||||
};
|
||||
gid = lib.mkOption {
|
||||
default = 1000;
|
||||
type = lib.types.ints.between 0 60000;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -5,13 +5,14 @@
|
|||
cloc
|
||||
cyme
|
||||
czkawka
|
||||
delta
|
||||
diskonaut
|
||||
duf
|
||||
duff
|
||||
ffmpeg
|
||||
file
|
||||
glances
|
||||
gpauth
|
||||
gpclient
|
||||
gpg-tui
|
||||
gping
|
||||
graphviz
|
||||
|
|
@ -19,7 +20,6 @@
|
|||
httpie
|
||||
imagemagick
|
||||
kepubify
|
||||
# keybase
|
||||
keymapviz
|
||||
libwebp
|
||||
lnav
|
||||
|
|
@ -39,18 +39,15 @@
|
|||
# nixops
|
||||
nmap
|
||||
ouch
|
||||
pandoc
|
||||
parallel
|
||||
progress
|
||||
pwntools
|
||||
python3
|
||||
rclone
|
||||
ripgrep
|
||||
rsync
|
||||
# sc-im
|
||||
slack-term
|
||||
tea
|
||||
tealdeer
|
||||
terminal-parrot
|
||||
termtosvg
|
||||
toilet
|
||||
|
|
@ -62,7 +59,6 @@
|
|||
waifu2x-converter-cpp
|
||||
wavemon
|
||||
wiki-tui
|
||||
yt-dlp
|
||||
yubico-pam
|
||||
yubikey-agent
|
||||
yubikey-manager
|
||||
|
|
@ -89,8 +85,8 @@
|
|||
geogebra
|
||||
ghidra
|
||||
gimp
|
||||
gnome.gnome-font-viewer
|
||||
gnome.seahorse
|
||||
gnome-font-viewer
|
||||
seahorse
|
||||
google-chrome
|
||||
imhex
|
||||
inkscape
|
||||
|
|
|
|||
|
|
@ -43,9 +43,9 @@
|
|||
duration = 20;
|
||||
};
|
||||
|
||||
live_config_reload = true;
|
||||
general.live_config_reload = true;
|
||||
|
||||
shell = {
|
||||
terminal.shell = {
|
||||
program = "${pkgs.zsh}/bin/zsh";
|
||||
args = [ "--login" ];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,9 +1,7 @@
|
|||
{ config, ... }:
|
||||
let
|
||||
cfg = config.programs.atuin;
|
||||
|
||||
# TODO: retrieve this in a more dynamic and correct manner
|
||||
xdg_runtime_dir = "/run/user/1000";
|
||||
xdg_runtime_dir = "/run/user/${toString config.home.uid}";
|
||||
in
|
||||
{
|
||||
programs.atuin = {
|
||||
|
|
|
|||
|
|
@ -0,0 +1,11 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
programs.bash = {
|
||||
enable = true;
|
||||
historyFile = "${config.xdg.dataHome}/bash_history";
|
||||
historySize = 100000;
|
||||
bashrcExtra = ''
|
||||
source "${config.xdg.configHome}/mutable_env.sh"
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.bat.enable = true;
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.bottom = {
|
||||
enable = true;
|
||||
settings.flags.enable_gpu = true;
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.eza.enable = true;
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{ machineVars, ... }:
|
||||
{
|
||||
programs.feh.enable = !machineVars.headless;
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.fzf = {
|
||||
enable = true;
|
||||
defaultCommand = "fd --type f";
|
||||
};
|
||||
}
|
||||
|
|
@ -48,15 +48,71 @@ in
|
|||
aliases = {
|
||||
aliases = "!git config --get-regexp alias | sed -re 's/alias\\.(\\S*)\\s(.*)$/\\1 = \\2/g'";
|
||||
delete-merged = "!git branch --merged | grep -v '\\*' | xargs -n 1 git branch -d";
|
||||
graph = "log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold green)(%ar)%C(reset) %C(white)%s%C(reset) %C(dim white)- %an%C(reset)%C(bold yellow)%d%C(reset)' --all";
|
||||
graphv = "log --graph --abbrev-commit --decorate --format=format:'%C(bold blue)%h%C(reset) - %C(bold cyan)%aD%C(reset) %C(bold green)(%ar)%C(reset)%C(bold yellow)%d%C(reset)%n'' %C(white)%s%C(reset) %C(dim white)- %an%C(reset)' --all";
|
||||
forcepush = "push --force-with-lease --force-if-includes";
|
||||
authors = "shortlog --summary --numbered --email";
|
||||
si = "switch-interactive";
|
||||
ff = "fixup-fixup";
|
||||
fi = "fixup-interactive";
|
||||
rf = "rebase-fixups";
|
||||
pp = "post-pr";
|
||||
subs = "submodule update --init --recursive";
|
||||
rebase-author = "rebase -i -x \"git commit --amend --reset-author -CHEAD\"";
|
||||
git = "!git";
|
||||
};
|
||||
} // (let
|
||||
c = c: s: "%C(${c})${s}%C(reset)";
|
||||
in {
|
||||
graph = let
|
||||
fmt = lib.concatStringsSep "" [
|
||||
" - "
|
||||
(c "bold blue" "%h")
|
||||
" - "
|
||||
(c "bold green" "(%ar)")
|
||||
" "
|
||||
(c "white" "> %s")
|
||||
" "
|
||||
(c "dim white" "- %an")
|
||||
(c "bold yellow" "%d")
|
||||
];
|
||||
in "log --graph --abbrev-commit --decorate --format=format:'${fmt}' --all";
|
||||
|
||||
graphv = let
|
||||
fmt = lib.concatStringsSep "" [
|
||||
(c "bold blue" "%h")
|
||||
" - "
|
||||
(c "bold cyan" "%aD")
|
||||
" "
|
||||
(c "bold green" "(%ar)")
|
||||
(c "bold yellow" "%d")
|
||||
"%n"
|
||||
" "
|
||||
(c "white" "%s")
|
||||
" "
|
||||
(c "dim white" "- %an")
|
||||
];
|
||||
in "log --graph --abbrev-commit --decorate --format=format:'${fmt}' --all";
|
||||
|
||||
l = let
|
||||
fmt = lib.concatStringsSep "%n" (map (x: if builtins.isList x then lib.concatStringsSep " " x else x) [
|
||||
[ (c "bold yellow" "%H") (c "auto" "%d") ]
|
||||
[ (c "bold white" "Author:") (c "bold cyan" "%aN <%aE>") (c "bold green" "(%ah)") ]
|
||||
[ (c "bold white" "Committer:") (c "bold cyan" "%cN <%cE>") (c "bold green" "(%ah)") ]
|
||||
[ (c "bold white" "GPG: (%G?)") (c "bold magenta" "%GF") "-" (c "bold cyan" "%GS") (c "bold blue" "(%GT) ") ]
|
||||
""
|
||||
(c "bold white" "# %s")
|
||||
"%+b"
|
||||
(c "dim yellow" "%+N")
|
||||
]);
|
||||
# sedExpressions = let
|
||||
# colorExpr = "\\x1B\\[([0-9]{1,3}(;[0-9]{1,2};?)?)?[mGK]";
|
||||
# colorEndExpr = "\\x1B\\[m";
|
||||
# colored = x: "${colorExpr}${x}${colorEndExpr}";
|
||||
# in lib.concatMapStringsSep " " (x: "-e '${x}'") [
|
||||
# "s|${colored "GPG: \\(N\\)"} ${colored "F3CDA86CC55A9F10D7A069819F2F7D8250F35146"} - ${colored "h7x4 <h7x4@nani.wtf>"} ${colored "\\(ultimate\\)"}|GPG: h7x4|"
|
||||
# "s|${colored "GPG: \\(N\\)"} ${colored ""} - ${colored ""} ${colored "\\(undefined\\)"}||"
|
||||
# ];
|
||||
in "log --decorate --format=tformat:'${fmt}'";
|
||||
# in "!git log --color=always --format=format:'${fmt}' | sed -E ${sedExpressions} | $PAGER";
|
||||
});
|
||||
|
||||
extraConfig = {
|
||||
core = {
|
||||
|
|
@ -270,6 +326,21 @@ in
|
|||
(builtins.replaceStrings ["hours" "tcommit"] ["minutes" "tmcommit"])
|
||||
];
|
||||
})
|
||||
(pkgs.writeShellApplication {
|
||||
name = "git-fixup-fixup";
|
||||
runtimeInputs = with pkgs; [ cfg.package ];
|
||||
text = lib.fileContents ./scripts/git-fixup-fixup.sh;
|
||||
})
|
||||
(pkgs.writeShellApplication {
|
||||
name = "git-rebase-fixups";
|
||||
runtimeInputs = with pkgs; [ cfg.package gnused ];
|
||||
text = lib.fileContents ./scripts/git-rebase-fixups.sh;
|
||||
})
|
||||
(pkgs.writeShellApplication {
|
||||
name = "git-fixup-interactive";
|
||||
runtimeInputs = with pkgs; [ cfg.package gnused gnugrep fzf ];
|
||||
text = lib.fileContents ./scripts/git-fixup-interactive.sh;
|
||||
})
|
||||
(pkgs.writeShellApplication {
|
||||
name = "git-switch-interactive";
|
||||
runtimeInputs = with pkgs; [ cfg.package fzf gnused coreutils ];
|
||||
|
|
@ -278,6 +349,21 @@ in
|
|||
"SC2001" # (style): See if you can use ${variable//search/replace} instead. (sed invocation)
|
||||
];
|
||||
})
|
||||
((pkgs.writers.writePython3Bin "git-post-pr" {
|
||||
libraries = with pkgs.python3Packages; [
|
||||
tkinter
|
||||
];
|
||||
flakeIgnore = [
|
||||
"E501" # I like long lines grr
|
||||
];
|
||||
} (lib.fileContents ./scripts/git-post-pr.py)).overrideAttrs (_: {
|
||||
postFixup = ''
|
||||
wrapProgram $out/bin/git-post-pr \
|
||||
--prefix PATH : ${lib.makeBinPath [
|
||||
pkgs.github-cli
|
||||
]}
|
||||
'';
|
||||
}))
|
||||
|
||||
pkgs.git-absorb
|
||||
];
|
||||
|
|
|
|||
|
|
@ -0,0 +1,14 @@
|
|||
if [ -n "${1:-}" ]; then
|
||||
TARGET_COMMIT="$1"
|
||||
shift
|
||||
else
|
||||
TARGET_COMMIT="HEAD"
|
||||
fi
|
||||
|
||||
COMMIT_MESSAGE=$(git log -1 --pretty=format:'%s' "$TARGET_COMMIT")
|
||||
|
||||
if [[ $COMMIT_MESSAGE =~ ^fixup!* ]]; then
|
||||
git commit -m "$COMMIT_MESSAGE" "$@"
|
||||
else
|
||||
git commit --fixup "$TARGET_COMMIT" "$@"
|
||||
fi
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
if [ -n "${1:-}" ]; then
|
||||
TARGET_BRANCH="$1"
|
||||
shift
|
||||
else
|
||||
TARGET_BRANCH=$(git remote show origin | sed -n '/HEAD branch/s/.*: //p')
|
||||
fi
|
||||
|
||||
FORK_POINT=$(git merge-base --fork-point "$TARGET_BRANCH")
|
||||
|
||||
COMMITS_SINCE_FORK_POINT=$(git log --format=format:'%s' "$FORK_POINT"..HEAD | grep -v -E '^fixup!')
|
||||
|
||||
RESULT=$(fzf <<<"$COMMITS_SINCE_FORK_POINT")
|
||||
|
||||
if [ "$RESULT" == "" ]; then
|
||||
echo "Doing nothing..."
|
||||
else
|
||||
git commit -m "fixup! $RESULT" "$@"
|
||||
fi
|
||||
|
|
@ -0,0 +1,130 @@
|
|||
import argparse
|
||||
import json
|
||||
import subprocess
|
||||
import tkinter
|
||||
|
||||
# TODO: add support for gitea, and maybe other git hosting options.
|
||||
|
||||
|
||||
def parse_args() -> argparse.Namespace:
|
||||
parser = argparse.ArgumentParser(
|
||||
prog="post-pr",
|
||||
description="Post links to PRs",
|
||||
)
|
||||
|
||||
parser.add_argument("-n", "--no-clipboard", action="store_true", help="do not copy the message to the clipboard")
|
||||
|
||||
pr_id = parser.add_mutually_exclusive_group()
|
||||
pr_id.add_argument("-c", "--current-branch", action="store_true", help="generate post for the PR for the current branch")
|
||||
pr_id.add_argument("-l", "--latest", action="store_true", help="generate post for the latest PR for the current user")
|
||||
pr_id.add_argument("pr_id", nargs="?", default=None, help="generate post for the PR with the given ID")
|
||||
args = parser.parse_args()
|
||||
|
||||
if not any([args.current_branch, args.latest, args.pr_id,]):
|
||||
args.current_branch = True
|
||||
|
||||
return args
|
||||
|
||||
|
||||
def _gh(args: list[str]) -> str:
|
||||
try:
|
||||
return subprocess.check_output(["gh"] + args).decode("utf8")
|
||||
except subprocess.CalledProcessError as e:
|
||||
raise RuntimeError(f"GitHub CLI command failed: 'gh {' '.join(args)}'") from e
|
||||
|
||||
|
||||
def _gh_retcode(args: list[str]) -> int:
|
||||
return subprocess.run(["gh"] + args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode
|
||||
|
||||
|
||||
def ensure_gh_installed():
|
||||
try:
|
||||
if _gh_retcode(["--version"]) != 0:
|
||||
raise RuntimeError("GitHub CLI (gh) is not installed, please install it")
|
||||
except FileNotFoundError:
|
||||
raise RuntimeError("GitHub CLI (gh) is not installed, please install it")
|
||||
|
||||
|
||||
def ensure_gh_authenticated():
|
||||
if _gh_retcode(["auth", "status"]) != 0:
|
||||
raise RuntimeError("Failed to authenticate with GitHub, please run 'gh auth login'")
|
||||
|
||||
|
||||
GH_PR_JSON_FIELDS = ",".join([
|
||||
"additions",
|
||||
"deletions",
|
||||
"state",
|
||||
"title",
|
||||
"url",
|
||||
])
|
||||
|
||||
|
||||
def fetch_pr_data(current_branch: bool, latest: bool, pr_id: str | None) -> dict[str, any]:
|
||||
if pr_id:
|
||||
pr_data = _gh(["pr", "view", pr_id, "--json", GH_PR_JSON_FIELDS])
|
||||
pr_data = json.loads(pr_data)
|
||||
|
||||
elif latest:
|
||||
pr_list = _gh(["pr", "list", "--author", "@me", "--limit", "1", "--json", GH_PR_JSON_FIELDS])
|
||||
pr_list = json.loads(pr_list)
|
||||
|
||||
if len(pr_list) == 0:
|
||||
raise RuntimeError("Failed to find PR, are you sure you have any open PRs?")
|
||||
|
||||
pr_data = pr_list[0]
|
||||
|
||||
elif current_branch:
|
||||
pr_data = _gh(["pr", "view", "--json", GH_PR_JSON_FIELDS])
|
||||
pr_data = json.loads(pr_data)
|
||||
|
||||
return pr_data
|
||||
|
||||
|
||||
def format_message(pr_data: dict[str, any]) -> str:
|
||||
additions = pr_data["additions"]
|
||||
deletions = pr_data["deletions"]
|
||||
|
||||
title = pr_data["title"]
|
||||
pr_url = pr_data["url"]
|
||||
pr_state = pr_data["state"]
|
||||
|
||||
state_html = f"({pr_state.lower()}) " if pr_state != "OPEN" else ""
|
||||
additions_html = f"+{additions}" if additions > 0 else str(additions)
|
||||
deletions_html = f"-{deletions}" if deletions > 0 else str(deletions)
|
||||
|
||||
return f"""{state_html}{pr_url} {title} [diff: {additions_html}/{deletions_html}]"""
|
||||
|
||||
|
||||
def copy_to_clipboard(message: str):
|
||||
r = tkinter.Tk()
|
||||
r.withdraw()
|
||||
r.clipboard_clear()
|
||||
r.clipboard_append(message)
|
||||
r.update()
|
||||
r.destroy()
|
||||
|
||||
|
||||
def main():
|
||||
args = parse_args()
|
||||
|
||||
ensure_gh_installed()
|
||||
ensure_gh_authenticated()
|
||||
|
||||
pr_data = fetch_pr_data(args.current_branch, args.latest, args.pr_id)
|
||||
message = format_message(pr_data)
|
||||
|
||||
print("Message:\n")
|
||||
print(f" {message}\n")
|
||||
|
||||
if not args.no_clipboard:
|
||||
copy_to_clipboard(message)
|
||||
print("Copied to clipboard")
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
try:
|
||||
main()
|
||||
except Exception as e:
|
||||
print(f"Error: {e}")
|
||||
exit(1)
|
||||
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
if [ -n "${1:-}" ]; then
|
||||
TARGET_BRANCH="$1"
|
||||
shift
|
||||
else
|
||||
TARGET_BRANCH=$(git remote show origin | sed -n '/HEAD branch/s/.*: //p')
|
||||
fi
|
||||
|
||||
FORK_POINT=$(git merge-base --fork-point "$TARGET_BRANCH")
|
||||
|
||||
git rebase "$FORK_POINT" --autosquash "$@"
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.home-manager.enable = true;
|
||||
}
|
||||
|
|
@ -0,0 +1,7 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.man = {
|
||||
enable = true;
|
||||
generateCaches = true;
|
||||
};
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{ machineVars, ... }:
|
||||
{
|
||||
programs.mpv.enable = !machineVars.headless;
|
||||
}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{pkgs, ...}:
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
programs.ncmpcpp = {
|
||||
enable = true;
|
||||
|
|
@ -332,11 +332,11 @@
|
|||
window_border_color = "green";
|
||||
active_window_border = "red";
|
||||
|
||||
visualizer_data_source = "/tmp/mpd.fifo";
|
||||
visualizer_data_source = "/run/user/${toString config.home.uid}/mpd/visualizer.fifo";
|
||||
visualizer_output_name = "Visualizer feed";
|
||||
visualizer_in_stereo = "no";
|
||||
visualizer_type = "spectrum"; # spectrum, ellipse, wave_filled, wave
|
||||
visualizer_look = "+█"; # wave | spectrum, ellipse, wave_filled
|
||||
# visualizer_type = "spectrum"; # spectrum, ellipse, wave_filled, wave
|
||||
# visualizer_look = "+█"; # wave | spectrum, ellipse, wave_filled
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -66,25 +66,58 @@
|
|||
}
|
||||
limelight-vim
|
||||
vim-tmux-navigator
|
||||
vim-polyglot
|
||||
lightline-vim
|
||||
vim-better-whitespace
|
||||
{
|
||||
plugin = rainbow;
|
||||
plugin = nvim-treesitter.withAllGrammars;
|
||||
config = ''
|
||||
let g:rainbow_active = 1
|
||||
packadd! nvim-treesitter
|
||||
lua << EOF
|
||||
require'nvim-treesitter.configs'.setup {
|
||||
highlight = {
|
||||
enable = true,
|
||||
},
|
||||
}
|
||||
EOF
|
||||
'';
|
||||
}
|
||||
{
|
||||
plugin = rainbow-delimiters-nvim;
|
||||
config = ''
|
||||
lua << EOF
|
||||
local rainbow_delimiters = require 'rainbow-delimiters'
|
||||
vim.g.rainbow_delimiters = {
|
||||
["highlight"] = {
|
||||
'RainbowDelimiterRed',
|
||||
'RainbowDelimiterYellow',
|
||||
'RainbowDelimiterBlue',
|
||||
'RainbowDelimiterGreen',
|
||||
'RainbowDelimiterViolet',
|
||||
'RainbowDelimiterCyan',
|
||||
},
|
||||
}
|
||||
EOF
|
||||
'';
|
||||
}
|
||||
{
|
||||
plugin = vim-monokai;
|
||||
config = ''
|
||||
colorscheme monokai
|
||||
autocmd ColorScheme * highlight Normal ctermbg=0
|
||||
autocmd ColorScheme * highlight LineNr ctermbg=0
|
||||
autocmd ColorScheme * highlight CursorLineNR ctermbg=0 ctermfg=208
|
||||
autocmd ColorScheme * highlight SignColumn ctermbg=0
|
||||
autocmd ColorScheme * highlight GitGutterAdd ctermbg=0
|
||||
autocmd ColorScheme * highlight GitGutterChange ctermbg=0
|
||||
autocmd ColorScheme * highlight GitGutterDelete ctermbg=0
|
||||
|
||||
autocmd ColorScheme monokai highlight Normal ctermbg=0
|
||||
autocmd ColorScheme monokai highlight LineNr ctermbg=0
|
||||
autocmd ColorScheme monokai highlight CursorLineNR ctermbg=0 ctermfg=208
|
||||
autocmd ColorScheme monokai highlight SignColumn ctermbg=0
|
||||
autocmd ColorScheme monokai highlight GitGutterAdd ctermbg=0
|
||||
autocmd ColorScheme monokai highlight GitGutterChange ctermbg=0
|
||||
autocmd ColorScheme monokai highlight GitGutterDelete ctermbg=0
|
||||
|
||||
autocmd ColorScheme monokai highlight RainbowDelimiterRed { fg = g:terminal_color_9 }
|
||||
autocmd ColorScheme monokai highlight RainbowDelimiterYellow { fg = g:terminal_color_11 }
|
||||
autocmd ColorScheme monokai highlight RainbowDelimiterBlue { fg = g:terminal_color_12 }
|
||||
autocmd ColorScheme monokai highlight RainbowDelimiterGreen { fg = g:terminal_color_10 }
|
||||
autocmd ColorScheme monokai highlight RainbowDelimiterViolet { fg = g:terminal_color_13 }
|
||||
autocmd ColorScheme monokai highlight RainbowDelimiterCyan { fg = g:terminal_color_14 }
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
|
|
|||
|
|
@ -37,6 +37,7 @@ in {
|
|||
(mkSource [ "japanese" "language" ] "https://www.outlier-linguistics.com/blogs/japanese.atom")
|
||||
(mkSource [ "language" ] "https://feeds.feedburner.com/blogspot/Ckyi")
|
||||
(mkSource [ "japanese" "language" "old" ] "http://feeds.feedburner.com/LocalizingJapan")
|
||||
(mkSource [ "japanese" "language" ] "https://wesleycrobertson.wordpress.com/feed/")
|
||||
(mkSource [ "tech" "vim" "old" ] "https://castel.dev/rss.xml")
|
||||
(mkSource [ "tech" "functional-programming" "old" ] "https://skilpat.tumblr.com/rss")
|
||||
(mkSource [ "tech" ] "https://resocoder.com/feed/")
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
{ machineVars, ... }:
|
||||
{
|
||||
programs.obs-studio.enable = !machineVars.headless;
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.pandoc.enable = true;
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.ripgrep.enable = true;
|
||||
}
|
||||
|
|
@ -10,5 +10,11 @@
|
|||
mode = "0444";
|
||||
};
|
||||
|
||||
programs.ssh.includes = [ config.sops.secrets."ssh/secret-config".path ];
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
includes = [
|
||||
config.sops.secrets."ssh/secret-config".path
|
||||
"mutable_config"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,7 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.texlive = {
|
||||
enable = true;
|
||||
# packageSet = pkgs.texlive.combined.scheme-medium;
|
||||
};
|
||||
}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{pkgs, ...}:
|
||||
{ pkgs, lib, ... }:
|
||||
{
|
||||
programs.tmux = {
|
||||
enable = true;
|
||||
|
|
@ -19,7 +19,25 @@
|
|||
tmux-fzf
|
||||
urlview
|
||||
];
|
||||
extraConfig = ''
|
||||
extraConfig = let
|
||||
fileContentsWithoutShebang = script: lib.pipe script [
|
||||
lib.fileContents
|
||||
(lib.splitString "\n")
|
||||
(lib.drop 3) # remove shebang
|
||||
(lib.concatStringsSep "\n")
|
||||
];
|
||||
|
||||
fcitx5-status = (pkgs.writeShellApplication {
|
||||
name = "tmux-fcitx5-status";
|
||||
runtimeInputs = with pkgs; [ dbus ];
|
||||
text = fileContentsWithoutShebang ./scripts/fcitx5-status.sh;
|
||||
});
|
||||
mpd-status = (pkgs.writeShellApplication {
|
||||
name = "tmux-mpd-status";
|
||||
runtimeInputs = with pkgs; [ mpc-cli gawk gnugrep ];
|
||||
text = fileContentsWithoutShebang ./scripts/mpd-status.sh;
|
||||
});
|
||||
in ''
|
||||
# Don't rename windows automatically after rename with ','
|
||||
set-option -g allow-rename off
|
||||
|
||||
|
|
@ -91,8 +109,8 @@
|
|||
### DESIGN CHANGES ###
|
||||
######################
|
||||
|
||||
set-option -g status-left '#{prefix_highlight} #[bg=blue]#[fg=black,bold] ###S #[bg=default] #[fg=green]#(~/.scripts/tmux/fcitx) #[fg=red]%H:%M '
|
||||
set-option -g status-right '#[fg=red]#(~/.scripts/tmux/mpd)'
|
||||
set-option -g status-left '#{prefix_highlight} #[bg=blue]#[fg=black,bold] ###S #[bg=default] #[fg=green]#(${lib.getExe fcitx5-status}) #[fg=red]%H:%M '
|
||||
set-option -g status-right '#[fg=red]#(${lib.getExe mpd-status})'
|
||||
set-window-option -g window-status-current-style fg=magenta
|
||||
set-option -g status-style 'bg=black fg=default'
|
||||
set-option -g default-shell '${pkgs.zsh}/bin/zsh'
|
||||
|
|
@ -0,0 +1,26 @@
|
|||
#!/usr/bin/env nix-shell
|
||||
#!nix-shell -i bash -p dbus
|
||||
|
||||
printState() {
|
||||
STATUS=$(dbus-send --session --print-reply=literal --dest='org.fcitx.Fcitx5' '/controller' 'org.fcitx.Fcitx.Controller1.CurrentInputMethod' | tr -d '[:space:]')
|
||||
|
||||
case $STATUS in
|
||||
keyboard-us)
|
||||
echo 'US'
|
||||
;;
|
||||
keyboard-no)
|
||||
echo 'NO'
|
||||
;;
|
||||
mozc)
|
||||
echo '日本語'
|
||||
;;
|
||||
*)
|
||||
echo "$STATUS?"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
while :; do
|
||||
printState
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -0,0 +1,29 @@
|
|||
#!/usr/bin/env nix-shell
|
||||
#!nix-shell -i sh -p mpc-cli gawk gnugrep
|
||||
|
||||
while true; do
|
||||
MPC_OUTPUT=$(mpc --format '[[%artist% - ]%title%]|[%file%]')
|
||||
|
||||
TITLE=$(head -n 1 <<<"$MPC_OUTPUT")
|
||||
|
||||
if [ ${#TITLE} -gt 60 ]; then
|
||||
TITLE=$(awk '{print substr($0,0,57) "..."}' <<<"$TITLE")
|
||||
fi
|
||||
|
||||
LINE2=$(head -n 2 <<<"$MPC_OUTPUT" | tail -n 1)
|
||||
|
||||
PLAY_STATUS_RAW=$(awk '{print $1}' <<<"$LINE2")
|
||||
|
||||
if [ "$PLAY_STATUS_RAW" == "[playing]" ]; then
|
||||
PLAY_STATUS="▶"
|
||||
elif [ "$PLAY_STATUS_RAW" == "[paused]" ]; then
|
||||
PLAY_STATUS="⏸"
|
||||
else
|
||||
PLAY_STATUS="??"
|
||||
fi
|
||||
|
||||
TIME=$(awk '{print $3}' <<<"$LINE2")
|
||||
|
||||
echo -e "$PLAY_STATUS $TITLE | [$TIME]"
|
||||
sleep 1
|
||||
done
|
||||
|
|
@ -86,7 +86,6 @@ myScratchpads = [ NS "ncmpcpp" spawnNC findNC layoutA
|
|||
where
|
||||
spawnNC = myTerminal ++ " --title ncmpcppScratchpad -e ncmpcpp"
|
||||
spawnTM = myTerminal ++ " --class floatingTerminal -e tmux new-session -A -s f"
|
||||
spawnTW = myTerminal ++ " --class taskWarriorTerminal -e taskwarrior-tui"
|
||||
-- spawnMX = "element"
|
||||
spawnFB = "thunar --class=floatingThunar"
|
||||
spawnEX = "emacs --name=floatingEmacs"
|
||||
|
|
@ -95,7 +94,6 @@ myScratchpads = [ NS "ncmpcpp" spawnNC findNC layoutA
|
|||
|
||||
findNC = title =? "ncmpcppScratchpad"
|
||||
findTM = className =? "floatingTerminal"
|
||||
findTW = className =? "taskWarriorTerminal"
|
||||
findSC = className =? "floatingSchedule"
|
||||
-- findMX = className =? "element"
|
||||
findFB = className =? "floatingThunar"
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.yt-dlp.enable = true;
|
||||
}
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
{ ... }:
|
||||
{
|
||||
programs.zoxide.enable = true;
|
||||
}
|
||||
|
|
@ -3,7 +3,7 @@
|
|||
services.dunst = {
|
||||
enable = true;
|
||||
iconTheme = {
|
||||
package = pkgs.gnome.adwaita-icon-theme;
|
||||
package = pkgs.adwaita-icon-theme;
|
||||
name = "Adwaita";
|
||||
size = "32x32";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
{ machineVars, ... }:
|
||||
{
|
||||
services.gnome-keyring.enable = !machineVars.headless;
|
||||
}
|
||||
|
|
@ -0,0 +1,5 @@
|
|||
{ ... }:
|
||||
{
|
||||
services.keybase.enable = true;
|
||||
services.kbfs.enable = true;
|
||||
}
|
||||
|
|
@ -1,28 +1,141 @@
|
|||
{ config, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.services.mpd;
|
||||
in
|
||||
{
|
||||
services.mpd = rec {
|
||||
services.mpd = {
|
||||
enable = true;
|
||||
musicDirectory = config.xdg.userDirs.music;
|
||||
playlistDirectory = "${musicDirectory}/playlists/MPD";
|
||||
playlistDirectory = "${cfg.musicDirectory}/playlists/MPD";
|
||||
network.startWhenNeeded = true;
|
||||
|
||||
# TODO: make the path specific to the user unit
|
||||
extraConfig = ''
|
||||
audio_output {
|
||||
type "fifo"
|
||||
name "Visualizer feed"
|
||||
path "/tmp/mpd.fifo"
|
||||
format "44100:16:2"
|
||||
}
|
||||
pid_file "/run/user/${toString config.home.uid}/mpd/pid"
|
||||
|
||||
zeroconf_enabled "no"
|
||||
|
||||
replaygain "auto"
|
||||
|
||||
restore_paused "yes"
|
||||
|
||||
auto_update "no"
|
||||
|
||||
audio_output {
|
||||
type "pipewire"
|
||||
name "PipeWire Sound Server"
|
||||
}
|
||||
|
||||
audio_output {
|
||||
type "fifo"
|
||||
name "Visualizer feed"
|
||||
path "/run/user/${toString config.home.uid}/mpd/visualizer.fifo"
|
||||
format "44100:16:2"
|
||||
}
|
||||
|
||||
resampler {
|
||||
plugin "soxr"
|
||||
quality "very high"
|
||||
}
|
||||
|
||||
playlist_plugin {
|
||||
name "cue"
|
||||
enabled "true"
|
||||
}
|
||||
|
||||
playlist_plugin {
|
||||
name "m3u"
|
||||
enabled "true"
|
||||
}
|
||||
|
||||
playlist_plugin {
|
||||
name "extm3u"
|
||||
enabled "true"
|
||||
}
|
||||
|
||||
playlist_plugin {
|
||||
name "flac"
|
||||
enabled "true"
|
||||
}
|
||||
|
||||
playlist_plugin {
|
||||
name "rss"
|
||||
enabled "true"
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
# TODO: disable auto_update and use systemd path to listen for changes
|
||||
# TODO: upstream unix socket support to home-manager
|
||||
|
||||
systemd.user.services.mpd = {
|
||||
Unit = {
|
||||
Documentation = [
|
||||
"man:mpd(1)"
|
||||
"man:mpd.conf(5)"
|
||||
];
|
||||
};
|
||||
Service = {
|
||||
WatchdogSec = 120;
|
||||
|
||||
# for io_uring
|
||||
LimitMEMLOCK = "64M";
|
||||
|
||||
# allow MPD to use real-time priority 40
|
||||
LimitRTPRIO = 40;
|
||||
LimitRTTIME = "infinity";
|
||||
|
||||
PrivateUsers = true;
|
||||
ProtectSystem = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectControlGroups = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.user.paths.mpd-update-library = {
|
||||
Unit = {
|
||||
Description = "Watchdog that updates the mpd library whenever the files are modified";
|
||||
Documentation = [
|
||||
"man:mpd(1)"
|
||||
"man:mpd.conf(5)"
|
||||
];
|
||||
WantedBy = [ "paths.target" ];
|
||||
};
|
||||
Path = {
|
||||
PathChanged = cfg.musicDirectory;
|
||||
Unit = "mpd-update-library.service";
|
||||
TriggerLimitIntervalSec = "1s";
|
||||
TriggerLimitBurst = "1";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.user.services.mpd-update-library = {
|
||||
Unit = {
|
||||
Description = "Watchdog that updates the mpd library whenever the files are modified";
|
||||
Documentation = [
|
||||
"man:mpd(1)"
|
||||
"man:mpd.conf(5)"
|
||||
];
|
||||
};
|
||||
Service = {
|
||||
Type = "oneshot";
|
||||
ExecStart = "${lib.getExe pkgs.mpc-cli} update --wait";
|
||||
|
||||
PrivateUsers = true;
|
||||
ProtectSystem = true;
|
||||
NoNewPrivileges = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectControlGroups = true;
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,4 @@
|
|||
{ machineVars, ... }:
|
||||
{
|
||||
services.network-manager-applet.enable = !machineVars.headless;
|
||||
}
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{ pkgs, lib, config, machineVars, ... }: let
|
||||
{ pkgs, config, machineVars, ... }: let
|
||||
colors = config.colors.defaultColorSet;
|
||||
in {
|
||||
services.polybar = {
|
||||
|
|
@ -11,23 +11,13 @@ in {
|
|||
package = pkgs.polybar.override {
|
||||
githubSupport = true;
|
||||
mpdSupport = true;
|
||||
pulseSupport = true;
|
||||
};
|
||||
|
||||
settings = {
|
||||
"module/tray" = {
|
||||
type = "internal/tray";
|
||||
|
||||
# padding = 4;
|
||||
tray-spacing = "8px";
|
||||
tray-maxsize = "25px";
|
||||
# tray-background = colors.background;
|
||||
};
|
||||
|
||||
"bar/top" = {
|
||||
bottom = false;
|
||||
# monitor =
|
||||
# tray.position = "right";
|
||||
tray.position = "right";
|
||||
|
||||
background = colors.background;
|
||||
foreground = colors.foreground;
|
||||
|
|
@ -51,20 +41,19 @@ in {
|
|||
left = "xmonad";
|
||||
center = "date";
|
||||
right = builtins.concatStringsSep " " [
|
||||
"filesystem"
|
||||
(lib.optionalString (machineVars.wlanInterface != null) "wlan")
|
||||
(lib.optionalString (machineVars.battery != null) "batt")
|
||||
"pulseaudio"
|
||||
"filesystem "
|
||||
(if machineVars.wlanInterface != null then "wlan " else "")
|
||||
(if machineVars.battery != null then "batt " else "")
|
||||
"vol"
|
||||
"mpd"
|
||||
"tray"
|
||||
];
|
||||
};
|
||||
|
||||
# tray = {
|
||||
# padding = 4;
|
||||
# maxsize = 25;
|
||||
# background = colors.background;
|
||||
# };
|
||||
tray = {
|
||||
padding = 4;
|
||||
maxsize = 25;
|
||||
background = colors.background;
|
||||
};
|
||||
};
|
||||
|
||||
"module/xmonad" = {
|
||||
|
|
@ -166,15 +155,15 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
"module/pulseaudio" = {
|
||||
type = "internal/pulseaudio";
|
||||
"module/vol" = {
|
||||
type = "internal/alsa";
|
||||
# format-volume = "<bar-volume>}"
|
||||
# format-volume = "%{A1:bash -c '~/.scripts/get-volume' &:}<bar-volume>%{A}"
|
||||
# format-volume = <label-volume> <bar-volume>
|
||||
|
||||
# format-volume-padding = 1
|
||||
# format-muted-padding = 1
|
||||
format-volume = " <label-volume> <bar-volume>";
|
||||
format-volume = "%{T3}%{T-} <label-volume> <bar-volume>";
|
||||
# label-volume =
|
||||
label-volume-foreground = colors.magenta;
|
||||
# format-muted-foreground = "${colors.foreground-alt}";
|
||||
|
|
@ -284,11 +273,9 @@ in {
|
|||
# Default: false
|
||||
fixed-values = true;
|
||||
|
||||
# Margin (number of spaces, pixels, or points) to add before/after each module
|
||||
# Individual side values can be defined using:
|
||||
# module-margin-{left,right}
|
||||
module-margin = "16px";
|
||||
# spacing = "16px";
|
||||
# Spacing (number of spaces, pixels, points) between entries
|
||||
# Default: 2
|
||||
spacing = 4;
|
||||
|
||||
# Default: 90
|
||||
# New in version 3.6.0
|
||||
|
|
|
|||
|
|
@ -22,11 +22,11 @@ in
|
|||
|
||||
# Volume
|
||||
|
||||
"super + {@F7,@F8}" = "${pkgs.alsaUtils}/bin/amixer set Master 2%{-,+}";
|
||||
"super + {@F7,@F8}" = "${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%{-,+}";
|
||||
|
||||
"{XF86AudioLowerVolume,XF86AudioRaiseVolume}" = "${pkgs.alsaUtils}/bin/amixer set Master 2%{-,+}";
|
||||
"{XF86AudioLowerVolume,XF86AudioRaiseVolume}" = "${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 2%{-,+}";
|
||||
|
||||
"XF86AudioMute" = "${pkgs.pulseaudio}/bin/pactl set-sink-mute @DEFAULT_SINK@ toggle";
|
||||
"XF86AudioMute" = "${pkgs.wireplumber}/bin/wpctl set-mute toggle";
|
||||
|
||||
# Music
|
||||
|
||||
|
|
|
|||
|
|
@ -14,6 +14,19 @@
|
|||
exe = if pkg.meta ? mainProgram then pkg.meta.mainProgram else name;
|
||||
in "${pkg}/bin/${exe}";
|
||||
in {
|
||||
sops.secrets."nordicsemi/envvars" = {
|
||||
sopsFile = ../secrets/home.yaml;
|
||||
};
|
||||
|
||||
|
||||
programs.bash.bashrcExtra = ''
|
||||
source "${config.sops.secrets."nordicsemi/envvars".path}"
|
||||
'';
|
||||
|
||||
programs.zsh.envExtra = ''
|
||||
source "${config.sops.secrets."nordicsemi/envvars".path}"
|
||||
'';
|
||||
|
||||
local.shell.aliases = {
|
||||
|
||||
# ░█▀▄░█▀▀░█▀█░█░░░█▀█░█▀▀░█▀▀░█▄█░█▀▀░█▀█░▀█▀░█▀▀
|
||||
|
|
@ -290,6 +303,11 @@ in {
|
|||
view-latex = "${pkgs.texlive.combined.scheme-full}/bin/latexmk -pdf -pvc main.tex";
|
||||
|
||||
reload-tmux = "${p "tmux"} source $HOME/.config/tmux/tmux.conf";
|
||||
|
||||
nordic-vpn = lib.concatStringsSep " | " [
|
||||
"${p "gpauth"} \"$NORDIC_VPN_ENDPOINT\" --gateway --browser default 2>/dev/null"
|
||||
"sudo ${p "gpclient"} connect \"$NORDIC_VPN_ENDPOINT\" --as-gateway --cookie-on-stdin"
|
||||
];
|
||||
};
|
||||
|
||||
# ░█▀▀░█▀▀░█▀█░█▀▀░█▀▄░█▀█░▀█▀░█▀▀░█▀▄
|
||||
|
|
|
|||
|
|
@ -12,9 +12,7 @@ in {
|
|||
./programs/ssh.nix
|
||||
./programs/usbtop.nix
|
||||
|
||||
./services/cups.nix
|
||||
./services/dbus.nix
|
||||
./services/logrotate.nix
|
||||
./services/openssh.nix
|
||||
./services/pcscd.nix
|
||||
./services/pipewire.nix
|
||||
|
|
@ -25,6 +23,8 @@ in {
|
|||
./services/xserver.nix
|
||||
];
|
||||
|
||||
systemd.enableStrictShellChecks = true;
|
||||
|
||||
sops.defaultSopsFile = ./../.. + "/secrets/${config.networking.hostName}.yaml";
|
||||
|
||||
time.timeZone = "Europe/Oslo";
|
||||
|
|
|
|||
|
|
@ -3,7 +3,6 @@
|
|||
sops.secrets."ssh/nix-builders/bob/key" = { sopsFile = ./../../../secrets/common.yaml; };
|
||||
|
||||
nix.buildMachines = [{
|
||||
# Login details configured in ssh module in nix-secrets
|
||||
hostName = "nix-builder-bob";
|
||||
system = "x86_64-linux";
|
||||
speedFactor = 5;
|
||||
|
|
@ -14,8 +13,8 @@
|
|||
"big-paralell"
|
||||
];
|
||||
mandatoryFeatures = [ ];
|
||||
# sshUser = secrets.ssh.users.pvv.normalUser;
|
||||
# sshKey = config.sops.secrets."ssh/nix-builders/bob/key".path;
|
||||
sshUser = "oysteikt";
|
||||
sshKey = config.sops.secrets."ssh/nix-builders/bob/key".path;
|
||||
}];
|
||||
|
||||
programs.ssh = {
|
||||
|
|
|
|||
|
|
@ -1,16 +1,15 @@
|
|||
{ config, secrets, ... }:
|
||||
{ config, ... }:
|
||||
{
|
||||
sops.secrets."ssh/nix-builders/isvegg/key" = { sopsFile = ./../../../secrets/common.yaml; };
|
||||
|
||||
nix.buildMachines = [{
|
||||
# Login details configured in ssh module in nix-secrets
|
||||
hostName = "nix-builder-isvegg";
|
||||
system = "x86_64-linux";
|
||||
speedFactor = 1;
|
||||
maxJobs = 8;
|
||||
supportedFeatures = [ ];
|
||||
mandatoryFeatures = [ ];
|
||||
sshUser = secrets.ssh.users.pvv.normalUser;
|
||||
sshUser = "oysteikt";
|
||||
sshKey = config.sops.secrets."ssh/nix-builders/isvegg/key".path;
|
||||
}];
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, secrets, ... }:
|
||||
{ config, ... }:
|
||||
{
|
||||
# TODO: install public key on tsuki declaratively
|
||||
sops.secrets = {
|
||||
|
|
@ -7,7 +7,6 @@
|
|||
};
|
||||
|
||||
nix.buildMachines = [{
|
||||
# Login details configured in ssh module in nix-secrets
|
||||
hostName = "nix-builder-tsukir";
|
||||
system = "x86_64-linux";
|
||||
speedFactor = 2;
|
||||
|
|
@ -26,7 +25,8 @@
|
|||
extraConfig = ''
|
||||
Host nix-builder-tsukir
|
||||
HostName gingakei.loginto.me
|
||||
Port ${toString secrets.ports.ssh.home-in}
|
||||
Port 45497
|
||||
IdentityFile ${config.sops.secrets."ssh/nix-builders/tsuki/key".path}
|
||||
'';
|
||||
|
||||
# knownHosts.tsukir = {
|
||||
|
|
|
|||
|
|
@ -1,71 +0,0 @@
|
|||
{ config, lib, ... }:
|
||||
{
|
||||
systemd.services = lib.mkIf config.services.printing.enable {
|
||||
cups.serviceConfig = {
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ProtectClock= true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
PrivateDevices = true;
|
||||
NoNewPrivileges = true;
|
||||
# User =
|
||||
AmbientCapabilities = [ "" ];
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DevicePolicy = "closed";
|
||||
KeyringMode = "private";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
PrivateUsers = true;
|
||||
RemoveIPC = true;
|
||||
# RestrictAddressFamilies = [ "" ];
|
||||
RestrictNamespaces=true;
|
||||
RestrictRealtime=true;
|
||||
RestrictSUIDSGID=true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
cups-browsed.serviceConfig = {
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ProtectClock= true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
PrivateDevices = true;
|
||||
NoNewPrivileges = true;
|
||||
# User =
|
||||
AmbientCapabilities = [ "" ];
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DevicePolicy = "closed";
|
||||
KeyringMode = "private";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
PrivateUsers = true;
|
||||
RemoveIPC = true;
|
||||
# RestrictAddressFamilies = [ "" ];
|
||||
RestrictNamespaces=true;
|
||||
RestrictRealtime=true;
|
||||
RestrictSUIDSGID=true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,42 +0,0 @@
|
|||
{ ... }:
|
||||
{
|
||||
# source: https://github.com/logrotate/logrotate/blob/main/examples/logrotate.service
|
||||
systemd.services.logrotate = {
|
||||
documentation = [ "man:logrotate(8)" "man:logrotate.conf(5)" ];
|
||||
unitConfig.RequiresMountsFor = "/var/log";
|
||||
serviceConfig = {
|
||||
Nice = 19;
|
||||
IOSchedulingClass = "best-effort";
|
||||
IOSchedulingPriority = 7;
|
||||
|
||||
ReadWritePaths = [ "/var/log" ];
|
||||
|
||||
AmbientCapabilities = [ "" ];
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DeviceAllow = [ "" ];
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true; # disable for third party rotate scripts
|
||||
PrivateDevices = true;
|
||||
PrivateNetwork = true; # disable for mail delivery
|
||||
PrivateTmp = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true; # disable for userdir logs
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "full";
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true; # disable for creating setgid directories
|
||||
SocketBindDeny = [ "any" ];
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,4 +1,77 @@
|
|||
{ config, ... }:
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
cfg = config.services.printing;
|
||||
in
|
||||
{
|
||||
services.printing.enable = !config.machineVars.headless;
|
||||
# services.printing.enable = !config.machineVars.headless;
|
||||
services.printing.enable = false;
|
||||
|
||||
systemd.services = lib.mkIf cfg.enable {
|
||||
cups.serviceConfig = {
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ProtectClock= true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
PrivateDevices = true;
|
||||
NoNewPrivileges = true;
|
||||
# User =
|
||||
AmbientCapabilities = [ "" ];
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DevicePolicy = "closed";
|
||||
KeyringMode = "private";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
PrivateUsers = true;
|
||||
RemoveIPC = true;
|
||||
# RestrictAddressFamilies = [ "" ];
|
||||
RestrictNamespaces=true;
|
||||
RestrictRealtime=true;
|
||||
RestrictSUIDSGID=true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
cups-browsed.serviceConfig = lib.mkIf cfg.enable {
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ProtectClock= true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
PrivateDevices = true;
|
||||
NoNewPrivileges = true;
|
||||
# User =
|
||||
AmbientCapabilities = [ "" ];
|
||||
CapabilityBoundingSet = [ "" ];
|
||||
DevicePolicy = "closed";
|
||||
KeyringMode = "private";
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
PrivateUsers = true;
|
||||
RemoveIPC = true;
|
||||
# RestrictAddressFamilies = [ "" ];
|
||||
RestrictNamespaces=true;
|
||||
RestrictRealtime=true;
|
||||
RestrictSUIDSGID=true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
UMask = "0077";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, ... }:
|
||||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
|
|
@ -77,14 +77,11 @@
|
|||
fstrim.enable = true;
|
||||
};
|
||||
|
||||
nix.buildMachines = lib.mkForce [ ];
|
||||
|
||||
hardware = {
|
||||
bluetooth.enable = true;
|
||||
enableRedistributableFirmware = true;
|
||||
keyboard.zsa.enable = true;
|
||||
opengl = {
|
||||
enable = true;
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -12,6 +12,8 @@
|
|||
./services/keybase.nix
|
||||
|
||||
./nspawn-containers/arch.nix
|
||||
|
||||
./testconfig.nix
|
||||
];
|
||||
|
||||
system.stateVersion = "22.05";
|
||||
|
|
|
|||
|
|
@ -0,0 +1,6 @@
|
|||
{ ... }:
|
||||
# NOTE: this file is a space where i put new configuration while i'm testing it.
|
||||
# There shouldn't really be anything here, I'm not planning to commit any config here.
|
||||
{
|
||||
|
||||
}
|
||||
|
|
@ -1,16 +1,23 @@
|
|||
{ secrets, ... }:
|
||||
{ config, lib, secrets, ... }:
|
||||
let
|
||||
cfg = config.services.coturn;
|
||||
in
|
||||
{
|
||||
services.coturn = rec {
|
||||
services.coturn = let
|
||||
# certName = config.services.nginx.virtualHosts.${cfg.realm}.useACMEHost;
|
||||
certName = "nani.wtf";
|
||||
certDir = config.security.acme.certs.${certName}.directory;
|
||||
in rec {
|
||||
enable = true;
|
||||
no-cli = true;
|
||||
no-tcp-relay = true;
|
||||
min-port = secrets.ports.matrix.coturn.min;
|
||||
max-port = secrets.ports.matrix.coturn.max;
|
||||
min-port = 46000;
|
||||
max-port = 47000;
|
||||
use-auth-secret = true;
|
||||
static-auth-secret = secrets.keys.matrix.static-auth-secret;
|
||||
realm = "turn.nani.wtf";
|
||||
cert = "${secrets.keys.certificates.server.crt}";
|
||||
pkey = "${secrets.keys.certificates.server.key}";
|
||||
cert = "${certDir}/cert.pem";
|
||||
pkey = "${certDir}/key.pem";
|
||||
extraConfig = ''
|
||||
# for debugging
|
||||
verbose
|
||||
|
|
@ -40,4 +47,19 @@
|
|||
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall = lib.mkIf cfg.enable {
|
||||
interfaces.enp2s0 = let
|
||||
range = [{
|
||||
from = cfg.min-port;
|
||||
to = cfg.max-port;
|
||||
}];
|
||||
in
|
||||
{
|
||||
allowedUDPPortRanges = range;
|
||||
allowedUDPPorts = [ cfg.listening-port ];
|
||||
allowedTCPPortRanges = range;
|
||||
allowedTCPPorts = [ cfg.listening-port ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -25,9 +25,11 @@
|
|||
|
||||
settings = {
|
||||
turn_uris = let
|
||||
inherit (config.services.coturn) realm;
|
||||
p = toString secrets.ports.matrix.default;
|
||||
in ["turn:${realm}:${p}?transport=udp" "turn:${realm}:${p}?transport=tcp"];
|
||||
inherit (config.services.coturn) realm listening-port;
|
||||
in [
|
||||
"turn:${realm}:${toString listening-port}?transport=udp"
|
||||
"turn:${realm}:${toString listening-port}?transport=tcp"
|
||||
];
|
||||
turn_shared_secret = config.services.coturn.static-auth-secret;
|
||||
turn_user_lifetime = "1h";
|
||||
|
||||
|
|
@ -67,7 +69,7 @@
|
|||
user = "matrix-synapse";
|
||||
database = "matrix-synapse";
|
||||
host = "/var/run/postgresql";
|
||||
port = secrets.ports.postgres;
|
||||
port = config.services.postgresql.settings.port;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -92,19 +94,4 @@
|
|||
};
|
||||
|
||||
services.redis.servers."".enable = true;
|
||||
|
||||
networking.firewall = {
|
||||
interfaces.enp2s0 = let
|
||||
range = with config.services.coturn; [ {
|
||||
from = secrets.ports.matrix.coturn.min;
|
||||
to = secrets.ports.matrix.coturn.max;
|
||||
} ];
|
||||
in
|
||||
{
|
||||
allowedUDPPortRanges = range;
|
||||
allowedUDPPorts = [ secrets.ports.matrix.default ];
|
||||
allowedTCPPortRanges = range;
|
||||
allowedTCPPorts = [ secrets.ports.matrix.default ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ pkgs, lib, config, secrets, inputs, ... }:
|
||||
{ config, pkgs, lib, inputs, ... }:
|
||||
{
|
||||
sops.secrets."cloudflare/api-key" = {};
|
||||
|
||||
|
|
@ -37,19 +37,18 @@
|
|||
recommendedZstdSettings = true;
|
||||
|
||||
upstreams = let
|
||||
inherit (secrets) ips ports;
|
||||
srv = config.services;
|
||||
sa = config.local.socketActivation;
|
||||
in {
|
||||
"atuin".servers."unix:${sa.atuin.newSocketAddress}" = { };
|
||||
"dynmap".servers."localhost:${s ports.minecraft.dynmap}" = { };
|
||||
"dynmap".servers."localhost:8123" = { };
|
||||
"grafana".servers."unix:/run/grafana/grafana.sock" = { };
|
||||
"headscale".servers."localhost:${s srv.headscale.port}" = { };
|
||||
"hedgedoc".servers."unix:${srv.hedgedoc.settings.path}" = { };
|
||||
"idrac".servers."${ips.idrac}" = { };
|
||||
"idrac".servers."10.0.0.201" = { };
|
||||
"kanidm".servers."localhost:8300" = { };
|
||||
"osuchan".servers."localhost:${s ports.osuchan}" = { };
|
||||
"plex".servers."localhost:${s ports.plex}" = { };
|
||||
"osuchan".servers."localhost:${s srv.osuchan.port}" = { };
|
||||
"plex".servers."localhost:32400" = { };
|
||||
"vaultwarden".servers."unix:${sa.vaultwarden.newSocketAddress}" = { };
|
||||
"wstunnel".servers = let
|
||||
inherit (config.services.wstunnel.servers."ws-tsuki".listen) host port;
|
||||
|
|
@ -61,7 +60,7 @@
|
|||
virtualHosts = let
|
||||
inherit (lib.attrsets) nameValuePair listToAttrs recursiveUpdate;
|
||||
inherit (lib.lists) head drop;
|
||||
inherit (secrets) domains keys;
|
||||
domains = [ "nani.wtf" ];
|
||||
|
||||
cloudflare-origin-pull-ca = builtins.fetchurl {
|
||||
url = "https://developers.cloudflare.com/ssl/static/authenticated_origin_pull_ca.pem";
|
||||
|
|
@ -70,7 +69,7 @@
|
|||
|
||||
# nonCFHost =
|
||||
# subdomains: extraSettings: let
|
||||
# settings = with keys.certificates; {
|
||||
# settings = {
|
||||
# useACMEHost = "nani.wtf";
|
||||
# forceSSL = true;
|
||||
# kTLS = true;
|
||||
|
|
@ -84,7 +83,7 @@
|
|||
|
||||
host =
|
||||
subdomains: extraSettings: let
|
||||
settings = with keys.certificates; {
|
||||
settings = {
|
||||
serverAliases = drop 1 (generateServerAliases domains subdomains);
|
||||
useACMEHost = "nani.wtf";
|
||||
forceSSL = true;
|
||||
|
|
|
|||
|
|
@ -48,32 +48,7 @@ in {
|
|||
requires = [ "postgresql.service" ];
|
||||
};
|
||||
|
||||
systemd.services.postgresql = {
|
||||
serviceConfig = {
|
||||
Restart = "always";
|
||||
RestartSec = 3;
|
||||
ReadWritePaths = [ cfg.dataDir ];
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
ProtectClock = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
# PrivateMounts = true;
|
||||
RestrictSUIDSGID = true;
|
||||
ProtectHostname = true;
|
||||
LockPersonality = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectProc = "invisible";
|
||||
ProtectHome = true;
|
||||
# PrivateNetwork = true;
|
||||
PrivateUsers = true;
|
||||
PrivateTmp = true;
|
||||
UMask = "0077";
|
||||
# RestrictAddressFamilies = [ "AF_UNIX AF_INET AF_INET6" ];
|
||||
SystemCallArchitectures = "native";
|
||||
};
|
||||
};
|
||||
systemd.services.postgresql.serviceConfig.ReadWritePaths = [ cfg.dataDir ];
|
||||
|
||||
environment.systemPackages = [ config.services.postgresql.package ];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -5,26 +5,25 @@
|
|||
enable = true;
|
||||
# openFirewall = true;
|
||||
|
||||
extraConfig = ''
|
||||
workgroup = TSUKI
|
||||
server string = smbnix
|
||||
netbios name = smbnix
|
||||
settings = {
|
||||
global = {
|
||||
"workgroup" = "TSUKI";
|
||||
"server string" = "smbnix";
|
||||
"netbios name" = "smbnix";
|
||||
|
||||
security = user
|
||||
"security" = "user";
|
||||
|
||||
use sendfile = yes
|
||||
min protocol = SMB2
|
||||
smb encrypt = desired
|
||||
"use sendfile" = "yes";
|
||||
"min protocol" = "SMB2";
|
||||
"smb encrypt" = "desired";
|
||||
|
||||
# note: localhost is the ipv6 localhost ::1
|
||||
hosts allow = 100.107.69.8 100.100.65.88
|
||||
hosts deny = 0.0.0.0/0
|
||||
# note: localhost is the ipv6 localhost ::1
|
||||
"hosts allow" = "100.107.69.8 100.100.65.88";
|
||||
"hosts deny" = "0.0.0.0/0";
|
||||
|
||||
guest ok = no
|
||||
map to guest = never
|
||||
'';
|
||||
|
||||
shares = {
|
||||
"guest ok" = "no";
|
||||
"map to guest" = "never";
|
||||
};
|
||||
cirno = {
|
||||
path = "/data/cirno";
|
||||
browseable = "yes";
|
||||
|
|
@ -66,15 +65,4 @@
|
|||
|
||||
networking.firewall.interfaces."tailscale0".allowedTCPPorts = [ 139 445 ];
|
||||
networking.firewall.interfaces."tailscale0".allowedUDPPorts = [ 137 138 ];
|
||||
|
||||
|
||||
systemd.slices.system-samba = {
|
||||
description = "Samba slice";
|
||||
after = [ "system.slice" ];
|
||||
requires = [ "system.slice" ];
|
||||
};
|
||||
|
||||
systemd.services.samba-smbd.serviceConfig.Slice = "system-samba.slice";
|
||||
systemd.services.samba-nmbd.serviceConfig.Slice = "system-samba.slice";
|
||||
systemd.services.samba-winbindd.serviceConfig.Slice = "system-samba.slice";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -21,39 +21,6 @@ in {
|
|||
|
||||
systemd.services.vaultwarden = lib.mkIf cfg.enable {
|
||||
requires = [ "postgresql.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
# Extra hardening
|
||||
CapabilityBoundingSet = "";
|
||||
LockPersonality = true;
|
||||
NoNewPrivileges = true;
|
||||
# MemoryDenyWriteExecute = true;
|
||||
PrivateMounts = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RemoveIPC = true;
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = [
|
||||
"@system-service"
|
||||
"~@privileged"
|
||||
];
|
||||
UMask = "0007";
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = lib.mkIf cfg.enable {
|
||||
|
|
|
|||
|
|
@ -102,9 +102,9 @@ buildBazelPackage {
|
|||
})
|
||||
(fetchurl rec {
|
||||
name = "jawiki";
|
||||
url = "https://dumps.wikimedia.org/${name}/20240620/${name}-20240620-all-titles-in-ns0.gz";
|
||||
url = "https://dumps.wikimedia.org/${name}/20241101/${name}-20241101-all-titles-in-ns0.gz";
|
||||
recursiveHash = true;
|
||||
hash = "sha256-p1LP8mHYknUPEB9u9CLCP1/uUjCVfb/mdpnOPawGcqQ=";
|
||||
hash = "sha256-gyg6aSsbT7wNvlIu5H5Qmi5O2LBIoZU13U+OgZCEmac=";
|
||||
downloadToTemp = true;
|
||||
postFetch = ''
|
||||
mkdir -p "$out"
|
||||
|
|
|
|||
|
|
@ -1,6 +1,8 @@
|
|||
git:
|
||||
nordicsemi-config: ENC[AES256_GCM,data:ziuM41RTsxkiutxjj8Pl5YuoETkxQNWEbGKd2Y99E0kTV9fL67g+YeGjeVFXErraeB/+jBVpjitK3lSHxlpxZLWckZ0G6A7NAFNagY9cORCFlLb+egyKb44xu8vBt4V5eA==,iv:yG06oluENc038cm5A9tpmSQtaGjd6nYDi/FnBd3A8Rk=,tag:ky6bCsYLOZmWObHnJ816Zw==,type:str]
|
||||
nordicsemi-maintenance-repos-config: ENC[AES256_GCM,data:oZ5hgpJj6ENM4S360Zo7SKGbZCDlBZ2NMJ/xRw7MUUvrFcvNSmhSf+WjjJbh+IXr2J82g92guI4Gw/1sOwyfmDfTo0cmKAGY1ZXIjHgSfpdufyl+sGWhpVG+fxmcqQTuiWYkCdLE3Rr+JoTCQ9f8N54uYJHU9X3MeFyrZjaPQA6tFDT8EIq35HifptN1uFEQyKxwaN9iKRyFEI3C9i6mvLYW6XuYYK+oirPgCecaMB3aVZotsMcLnO9C51N2hKKGdkx/JT/jqqAJ4IYUExDNTnBxvgKCrEldaqRGqi9F/3iPVuNSKCUG0uefG3010OhiwnU8WrXblw9jHSHkZ5crIhC2S/y9fzvA+ZuJUctan+GuoIG7VbqdLy0Jz2FXGDs6qNQX6/I0Eud7ajvIHAz+Zp/lVF8U91BwzY2dXLdEKK+KRHtT5gXWXPQHO3HEBlYjxVsMf0V/1WGuUeAQMu46q7YRuRuwuBNVFj2QkRKJo8TX8vXeWrdpzR6qQ4RynioUmI+GLZY=,iv:1wEwje63Ui6aKVq0yNtVsODmWe0kYkBt3pbp/RKqr/s=,tag:Ujhi6tRNphbPtFUL5m8jpw==,type:str]
|
||||
nordicsemi:
|
||||
envvars: ENC[AES256_GCM,data:6vx077unPWt6WRy0oZKC3qpVA8BKigYDdhsZ2rmLYFtzW//01CrRgXX420UB,iv:e2hJuRj4A8ZBGG0j2YINdvM3IXzpCnJK0Sm5AXhOTZM=,tag:9SdpNIFSiLhI073dk3cC5g==,type:str]
|
||||
ssh:
|
||||
secret-config: ""
|
||||
sops:
|
||||
|
|
@ -18,8 +20,8 @@ sops:
|
|||
QllyaVlIVEVrSlJDZzlwdFpoRlg3bmsKYBGLYmsfFu6GuRUPGsS0+vkUv1QzJXZl
|
||||
D9CFcRQw0Xzti0DvDj7cWrCJ32F1eYRp/9LWyG1CEjfoNEKyUJZ2qQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-08-05T07:31:00Z"
|
||||
mac: ENC[AES256_GCM,data:eD+cXSj7xvIY9hyXTwCmV/HJNR1SInXYp0yKCtFTuBzXL5u1nwi0hbN6iHe7xi5otlrddGCwYAIjogAQrE01Y06Y7+ZSdpQNPadz16q4sDa5z71pbzXy/vCZdTlcFL3MMWMhwVmLZtjJO90gQ1iWd1wza12JmbO3KqkFLIuKwnQ=,iv:Qr9k/J+ZU09KruDwrJGaj+5PR0Kv+Gu7zcgDhF/KLOY=,tag:DfspqZZSKTmEOXH2NuVo5Q==,type:str]
|
||||
lastmodified: "2024-10-07T23:05:27Z"
|
||||
mac: ENC[AES256_GCM,data:0EgnvPIiDHfE6YYVISwMdYycXUXRkvJLpi5llNF5HMCUMQNFIPemb4OkPbcZhP0HkZCRQC6pFhTXWMU9NbxpTmDWHV0+pNrlkX4PiRKjCJ7Yqq9dNkJzCfq7091ZYYCH9UrgKIyi6+/6jGANI1sq+QuEyZFVPYMnaeSVo+ntqVE=,iv:pJogp+pCfkDaTGh/Qy+GDcELw35Q4Sa8iMKU4JfGCRk=,tag:JGpN4HymcHpJS47fGx6cjg==,type:str]
|
||||
pgp:
|
||||
- created_at: "2024-07-08T12:27:24Z"
|
||||
enc: |-
|
||||
|
|
|
|||
Loading…
Reference in New Issue