diff --git a/nixosModules/default.nix b/nixosModules/default.nix index 8639e4d5..8525e25b 100644 --- a/nixosModules/default.nix +++ b/nixosModules/default.nix @@ -5,6 +5,9 @@ _: { defaultUsers = import ./default-users; profiles = import ./profiles; distributed-builds = import ./distributedBuilds; + skye-base = import ./skye/base; + skye-server-checks = import ./skye/server-checks; + skye-lastfm-rpc = import ./skye/lastfm-rpc; dn42Wireguard = import ./dn42Wireguard; diff --git a/nixosModules/skye/base/backup.nix b/nixosModules/skye/base/backup.nix new file mode 100644 index 00000000..ff25f862 --- /dev/null +++ b/nixosModules/skye/base/backup.nix @@ -0,0 +1,46 @@ +{ + pkgs, + lib, + config, + ... +}: + +let + hasConfig = builtins.pathExists ../../secrets/restic/${config.networking.hostName}/repo.age; +in +lib.mkIf hasConfig { + age.secrets = { + "restic/env".file = ../../secrets/restic/env.age; + "restic/repo".file = ../../secrets/restic/${config.networking.hostName}/repo.age; + "restic/password".file = ../../secrets/restic/${config.networking.hostName}/password.age; + }; + + services.restic.backups = { + cloud = { + initialize = true; + + repositoryFile = config.age.secrets."restic/repo".path; + environmentFile = config.age.secrets."restic/env".path; + passwordFile = config.age.secrets."restic/password".path; + + paths = [ + "/home/skye/Documents" + "/home/skye/Desktop" + ]; + timerConfig = { + OnBootSec = "1min"; + OnUnitActiveSec = "1h"; + }; + exclude = [ + ".cargo" + "node_modules" + "/home/skye/Documents/Git/*/target" + ]; + pruneOpts = [ + "--keep-daily 7" + "--keep-weekly 5" + "--keep-monthly 12" + ]; + }; + }; +} diff --git a/nixosModules/skye/base/default.nix b/nixosModules/skye/base/default.nix new file mode 100644 index 00000000..17bb8c4b --- /dev/null +++ b/nixosModules/skye/base/default.nix @@ -0,0 +1,62 @@ +{ + pkgs, + config, + lib, + inputs, + hostType, + ... +}: + +{ + imports = [ + ./users.nix + ./packages.nix + ./networking.nix + ./metrics.nix + ./backup.nix + ./${hostType}/default.nix + ]; + + time.timeZone = "America/Detroit"; + i18n.defaultLocale = "en_US.UTF-8"; + i18n.extraLocaleSettings = { + LC_ADDRESS = "en_US.UTF-8"; + LC_IDENTIFICATION = "en_US.UTF-8"; + LC_MEASUREMENT = "en_US.UTF-8"; + LC_MONETARY = "en_US.UTF-8"; + LC_NAME = "en_US.UTF-8"; + LC_NUMERIC = "en_US.UTF-8"; + LC_PAPER = "en_US.UTF-8"; + LC_TELEPHONE = "en_US.UTF-8"; + LC_TIME = "en_US.UTF-8"; + }; + + nix = { + package = pkgs.nix; + settings = { + experimental-features = [ + "nix-command" + "flakes" + ]; + }; + + registry = { + nixpkgs.flake = inputs.nixpkgs; + }; + }; + nixpkgs.config.allowUnfree = true; + + services.openssh = { + enable = true; + settings = { + UseDns = false; + PermitRootLogin = "prohibit-password"; + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + X11Forwarding = false; + AllowGroups = [ "wheel" ]; + }; + }; + + age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; +} diff --git a/nixosModules/skye/base/desktop/default.nix b/nixosModules/skye/base/desktop/default.nix new file mode 100644 index 00000000..8f545154 --- /dev/null +++ b/nixosModules/skye/base/desktop/default.nix @@ -0,0 +1,9 @@ +{ pkgs, ... }: +{ + imports = [ + ./desktop.nix + ./packages.nix + ]; + + boot.kernelPackages = pkgs.linuxPackages_latest; +} diff --git a/nixosModules/skye/base/desktop/desktop.nix b/nixosModules/skye/base/desktop/desktop.nix new file mode 100644 index 00000000..43fd00fd --- /dev/null +++ b/nixosModules/skye/base/desktop/desktop.nix @@ -0,0 +1,40 @@ +{ + lib, + pkgs, + config, + ... +}: +{ + #services.desktopManager.plasma6.enable = true; + #services.displayManager.plasma-login-manager.enable = true; + + # services.xserver.enable = true; + # services.xrdp.enable = true; + # services.xrdp.defaultWindowManager = "niri-session"; + + programs.niri.enable = true; + environment.systemPackages = [ pkgs.xwayland-satellite ]; + + programs.regreet.enable = true; + + programs.kdeconnect.enable = true; + xdg.portal = { + enable = true; + extraPortals = [ pkgs.xdg-desktop-portal-gnome ]; + config.niri = { + default = [ "gnome" "gtk" ]; + }; + }; + + services.printing.enable = true; + + services.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + jack.enable = true; + }; +} diff --git a/nixosModules/skye/base/desktop/packages.nix b/nixosModules/skye/base/desktop/packages.nix new file mode 100644 index 00000000..c65f98d2 --- /dev/null +++ b/nixosModules/skye/base/desktop/packages.nix @@ -0,0 +1,47 @@ +{ + lib, + pkgs, + config, + ... +}: +{ + programs.firefox = { + enable = true; + package = pkgs.firefox; + }; + + programs.obs-studio = { + enable = true; + enableVirtualCamera = true; + + package = ( + pkgs.obs-studio.override { + cudaSupport = true; + } + ); + + plugins = with pkgs.obs-studio-plugins; [ + obs-pipewire-audio-capture + obs-vkcapture + ]; + }; + boot.extraModulePackages = with config.boot.kernelPackages; [ + v4l2loopback + ]; + boot.kernelModules = [ "v4l2loopback" ]; + security.polkit.enable = true; + + programs.nix-ld.enable = true; + environment.systemPackages = with pkgs; [ + winetricks + wineWowPackages.stable + gearlever + nfs-utils + cider-2 + betterdiscordctl + discord + android-tools + nautilus + sushi + ]; +} diff --git a/nixosModules/skye/base/metrics.nix b/nixosModules/skye/base/metrics.nix new file mode 100644 index 00000000..d8dca574 --- /dev/null +++ b/nixosModules/skye/base/metrics.nix @@ -0,0 +1,50 @@ +{ + lib, + pkgs, + config, + ... +}: +{ + services.vmagent = { + enable = true; + remoteWrite = { + url = "https://metrics.flyingfox-fir.ts.net/api/v1/write"; + }; + prometheusConfig = { + global.scrape_interval = "15s"; + scrape_configs = [ + { + job_name = "prometheus-node-exporter"; + static_configs = [ + { + targets = [ "http://localhost:9100/metrics" ]; + labels = { + instance = config.networking.hostName; + }; + } + ]; + } + ]; + }; + }; + systemd.services.vmagent = { + serviceConfig.Restart = lib.mkForce "always"; + unitConfig.StartLimitIntervalSec = lib.mkForce 0; + }; + + services.prometheus.exporters.node = { + enable = true; + listenAddress = "127.0.0.1"; + }; + systemd.services.prometheus-node-exporter = { + serviceConfig.Restart = lib.mkForce "always"; + }; + + services.scrutiny.collector = { + enable = true; + settings = { + api.endpoint = "https://scrutiny.flyingfox-fir.ts.net"; + host.id = config.networking.hostName; + }; + }; +} diff --git a/nixosModules/skye/base/misc/tailscale-serve.nix b/nixosModules/skye/base/misc/tailscale-serve.nix new file mode 100644 index 00000000..3fa7c8ab --- /dev/null +++ b/nixosModules/skye/base/misc/tailscale-serve.nix @@ -0,0 +1,54 @@ +{ + config, + lib, + pkgs, + ... +}: + +with lib; + +let + cfg = config.vixens.tailscale-serve; +in +{ + options.vixens.tailscale-serve = mkOption { + default = { }; + type = types.attrsOf ( + types.submodule { + options = { + port = mkOption { type = types.int; }; + targetService = mkOption { type = types.str; }; + tailscaleService = mkOption { type = types.str; }; + }; + } + ); + }; + + config = mkIf (cfg != { }) { + systemd.services = mapAttrs' ( + name: instance: + nameValuePair "tailscale-serve-${name}" { + after = [ + "tailscaled.service" + instance.targetService + ]; + wants = [ + "tailscaled.service" + instance.targetService + ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + + Restart = "on-failure"; + RestartSec = "3s"; + StartLimitIntervalSec = 0; + + ExecStart = "${lib.getExe config.services.tailscale.package} serve --service=svc:${instance.tailscaleService} --bg ${toString instance.port}"; + }; + } + ) cfg; + }; +} diff --git a/nixosModules/skye/base/networking.nix b/nixosModules/skye/base/networking.nix new file mode 100644 index 00000000..e59e65a7 --- /dev/null +++ b/nixosModules/skye/base/networking.nix @@ -0,0 +1,17 @@ +{ + pkgs, + lib, + ... +}: + +{ + networking.networkmanager.enable = true; + + services.tailscale = { + enable = true; + }; + + networking.firewall = { + trustedInterfaces = [ "tailscale0" ]; + }; +} diff --git a/nixosModules/skye/base/packages.nix b/nixosModules/skye/base/packages.nix new file mode 100644 index 00000000..b5b9c634 --- /dev/null +++ b/nixosModules/skye/base/packages.nix @@ -0,0 +1,24 @@ +{ + pkgs, + lib, + inputs, + ... +}: + +{ + programs.zsh.enable = true; + + environment.systemPackages = with pkgs; [ + tmux + htop + git + jq + + tcpdump + dig + + vim + nano + helix + ]; +} diff --git a/nixosModules/skye/base/server/checks.nix b/nixosModules/skye/base/server/checks.nix new file mode 100644 index 00000000..aeba185f --- /dev/null +++ b/nixosModules/skye/base/server/checks.nix @@ -0,0 +1,30 @@ +{ + self, + self', + config, + ... +}: +{ + imports = [ self.nixosModules.skye-server-checks ]; + + age.secrets = { + "server-checks-env".file = ../../../secrets/server-checks/${config.networking.hostName}.age; + }; + + serverChecks = [ + { type = "systemd_no_failing_services"; } + { + type = "systemd_service_running"; + value = "tailscaled"; + } + { + type = "systemd_service_running"; + value = "sshd"; + } + ]; + envPath = config.age.secrets."server-checks-env".path; + + environment.systemPackages = [ + self'.packages.skye-server-checks + ]; +} diff --git a/nixosModules/skye/base/server/default.nix b/nixosModules/skye/base/server/default.nix new file mode 100644 index 00000000..90e83660 --- /dev/null +++ b/nixosModules/skye/base/server/default.nix @@ -0,0 +1,6 @@ +{ pkgs, ... }: +{ + imports = [ ./checks.nix ]; + + boot.kernelPackages = pkgs.linuxPackages_6_18; +} diff --git a/nixosModules/skye/base/sshKeys/skye b/nixosModules/skye/base/sshKeys/skye new file mode 100644 index 00000000..56cb66ec --- /dev/null +++ b/nixosModules/skye/base/sshKeys/skye @@ -0,0 +1,4 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICpWoaHA7PBagCZ+oCTT82AjQnKCZw/f6F9ZDcqjqTaR skye@sylveon +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINIlUR+DVEsNGIJxGD0YgkoFSpOZgtyYUkuj+ESUq3oH skye@ninetails +sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIN1J0JMT/yFmtvOpNbUEU3IfqnhDT3iu5fP0soxreaG8AAAABHNzaDo= skye@vixen.lgbt +sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBOFGx63o+9ynaHhe8XY/EIbwig8NKVZYIkLEd+aEvDizDsT6+KrdqYPyMjDPxCTgSdkn6t1paEU4u7qa5hRai3sAAAALdGVybWl1cy5jb20= skye@vixen.lgbt \ No newline at end of file diff --git a/nixosModules/skye/base/users.nix b/nixosModules/skye/base/users.nix new file mode 100644 index 00000000..bf6480ba --- /dev/null +++ b/nixosModules/skye/base/users.nix @@ -0,0 +1,28 @@ +{ + pkgs, + lib, + inputs, + hostType, + ... +}: + +{ + users.users.skye = { + isNormalUser = true; + description = "skye"; + extraGroups = [ + "networkmanager" + "wheel" + "docker" + "dialout" + "i2c" + ]; + openssh.authorizedKeys.keys = (lib.splitString "\n" (lib.readFile sshKeys/skye)); + shell = pkgs.zsh; + }; + + home-manager.extraSpecialArgs = { inherit inputs; }; + home-manager.useGlobalPkgs = true; + home-manager.useUserPackages = true; + home-manager.users.skye = import (inputs.self + "/home/skye/${hostType}.nix"); +} diff --git a/packages/lastfm-rpc/configuration.nix b/nixosModules/skye/lastfm-rpc/default.nix similarity index 100% rename from packages/lastfm-rpc/configuration.nix rename to nixosModules/skye/lastfm-rpc/default.nix diff --git a/packages/skye-server-checks/configuration.nix b/nixosModules/skye/server-checks/default.nix similarity index 100% rename from packages/skye-server-checks/configuration.nix rename to nixosModules/skye/server-checks/default.nix