config/profiles/code-remote/default.nix

197 lines
6.9 KiB
Nix

{ config, pkgs, lib, inputs, ... }:
# TODO:
# * [x] generate a ssh key if not existing
# * [ ] automatically pull the repo on boot, do i need keys for that?
# * [ ] customize the shit out of vscode
# * [ ] don't ignore PDFs
# * [ ] run the whole thing in a xvfb? should enable drawio and curv
let
domain = "${config.networking.hostName}.${config.networking.domain}";
mkDomain = subname: "${subname}.${domain}";
hostName = config.networking.hostName;
container-name = "code-server-pandoc-papers";
container = config.containers.${container-name}.config;
in {
networking.nat = {
enable = true;
internalInterfaces = ["ve-+"];
externalInterface = "eno1"; # TODO: can i make this automatic?
#enableIPv6 = true;
};
#imports = [
# "/home/pbsds/repos/nixpkgs-trees/containers-mkdir/nixos/modules/virtualisation/nixos-containers.nix"
#];
#disabledModules = [
# "virtualisation/nixos-containers.nix"
#];
# data can be destroyed with `nixos-container destroy code-server-pandoc`
containers.${container-name} = {
autoStart = true;
# container has no network access
privateNetwork = true;
hostAddress = "10.240.100.2";
localAddress = "10.240.100.3";
#forwardPorts = [
# {
# #hostAddress = "127.0.0.1"; # does not exist
# hostPort = 53754;
# containerPort = 53754;
# protocol = "tcp";
# }
#];
#bindMounts."/home" = {
# hostPath = "/var/lib/code-server";
# isReadOnly = false;
#};
config = { config, pkgs, lib, ... }: {
system.stateVersion = "22.11";
#imports = [ <home-manager/nixos> ];
#home-manager.useGlobalPkgs = true; # brrr
#home-manager.useUserPackages = true; # requiredm installs user packages to /etc instead of ~/.nix-profile
#home-manager.users.${config.services.code-server.user} = { pkgs, config, ... }: {
# programs.git.enable = true;
# programs.git.userName = "Noximilien code-server";
# programs.git.userEmail = "theotheo@ntnu.no";
#};
systemd.services.initial-setup = {
enable = true;
wantedBy = [ "code-server.service" ];
before = [ "code-server.service" ];
# TODO: run as the correct user
serviceConfig.User = config.services.code-server.user;
serviceConfig.Group = config.services.code-server.group;
# TODO: make the ssh key comment automatic
script = ''
test -s "$HOME/.ssh/id_ed25519.pub" || {
test -d "$HOME/.ssh" || mkdir -p "$HOME/.ssh"
echo "" | ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -a 100 -C "code-server@code-server-pandoc-${hostName}" -f "$HOME/.ssh/id_ed25519"
echo
}
echo "My pubkey is:"
cat "$HOME/.ssh/id_ed25519.pub"
#${pkgs.curl}/bin/curl "https://github.com/pbsds.keys" | grep "$(cat $HOME/.ssh/id_ed25519.pub | cut -d" " -f-2)"
test -d "$HOME/repo" || (
set -x
cp -a ${inputs.pbsds-papers.outPath} "$HOME/repo"
chmod -R a+w "$HOME/repo"
cd "$HOME/repo/neural-intersection-fields"
ln -s ../.vscode .
)
'';
};
services.code-server = {
enable = true;
host = "0.0.0.0"; # container
port = 53754;
#user = "code-server";
#group = "code.server";
# a nice tool if you don't care about security: https://argon2.online/
hashedPassword = "$argon2i$v=19$m=16,t=2,p=1$MHh5UGNtU1lWR1UySnhIZw$ITg8U7Gq2CXByuOOnrKVUg"; # hunter2
extraArguments = [
"${config.users.users.${config.services.code-server.user}.home}/repo/neural-intersection-fields"
];
package = pkgs.vscode-with-extensions.override {
vscode = pkgs.code-server.overrideAttrs (old: {
# vscode-with-extensions compatibility
# https://github.com/NixOS/nixpkgs/pull/192889
passthru.executableName = "code-server";
passthru.longName = "Visual Studio Code Server";
});
#vscodeExtensions = with (import <nixos-unstable> {}).vscode-extensions; [
vscodeExtensions = with pkgs.vscode-extensions; [
shd101wyy.markdown-preview-enhanced
sanaajani.taskrunnercode
tomoki1207.pdf
] ++ pkgs.vscode-utils.extensionsFromVscodeMarketplace [
{
name = "new-railscasts";
publisher = "carakan";
version = "1.0.68";
sha256 = "sha256-uZCAurvZu7QHjTR6ukmYbsI58GpfTo3shdoX/MH2ElA=";
}
{
name = "theme-railscasts";
publisher = "PaulOlteanu";
version = "4.0.1";
sha256 = "sha256-67RNcMr+hvzn2FvapkHLd8OdEBAz8w4cwsGlu0tbCNY=";
}
{
name = "trailscasts";
publisher = "mksafi";
version = "1.2.3";
sha256 = "sha256-mZ9I1BYf8x3lpl5/2sojk+5GMfhDqRBzs6nFkumlPKg=";
}
{
name = "vscode-theme-railscasts-plus";
publisher = "marlosirapuan";
version = "0.0.6";
sha256 = "sha256-8GyyxDeehFo/lGSmA6dfXZ3DMZ/B632ax+9q3+irjws=";
}
{
name = "theme-railscast-next";
publisher = "edus44";
version = "0.0.2";
sha256 = "sha256-RYk6X4iKoEQlKSVhydnwWQJqt884+HC9DZN2aqIbfNI=";
}
{ # best, but no markdown
name = "railscasts";
publisher = "mrded";
version = "0.0.4";
sha256 = "sha256-vjfoeRW+rmYlzSuEbYJqg41r03zSfbfuNCfAhHYyjDc=";
}
{
name = "beardedtheme";
publisher = "BeardedBear";
version = "7.4.0";
sha256 = "sha256-8FY9my7v7bcfD0LH5AVNGI2dF1qMLnVp2LR/CiP01NQ=";
}
];
};
extraPackages = let
shellnix = import "${inputs.pbsds-papers}/shell.nix" { inherit pkgs; };
in (with pkgs; [ imagemagick ]) # for some reason it isn't passed from shell.nix
++ shellnix.buildInputs
++ shellnix.nativeBuildInputs
++ shellnix.propagatedBuildInputs
++ shellnix.propagatedNativeBuildInputs;
};
networking.firewall = {
enable = true;
allowedTCPPorts = [
config.services.code-server.port
];
};
};
};
services.nginx.virtualHosts.${mkDomain "code-server"} = {
forceSSL = true; # addSSL = true;
enableACME = true; #useACMEHost = acmeDomain;
locations."/" = {
#proxyPass = "http://127.0.0.1:${toString container.services.code-server.port}";
#proxyPass = "http://10.240.100.3:${toString container.services.code-server.port}";
proxyPass = "http://${config.containers.${container-name}.localAddress}:${toString container.services.code-server.port}";
proxyWebsockets = true;
};
};
}