diff options
Diffstat (limited to 'sys')
47 files changed, 1752 insertions, 0 deletions
diff --git a/sys/boot/boot_pictures/gnu.png b/sys/boot/boot_pictures/gnu.png new file mode 100755 index 00000000..d07dee3e --- /dev/null +++ b/sys/boot/boot_pictures/gnu.png Binary files differdiff --git a/sys/boot/boot_pictures/gnulin_emb_1.png b/sys/boot/boot_pictures/gnulin_emb_1.png new file mode 100755 index 00000000..483f2681 --- /dev/null +++ b/sys/boot/boot_pictures/gnulin_emb_1.png Binary files differdiff --git a/sys/boot/boot_pictures/gnulin_emb_2.png b/sys/boot/boot_pictures/gnulin_emb_2.png new file mode 100755 index 00000000..48cd6ad7 --- /dev/null +++ b/sys/boot/boot_pictures/gnulin_emb_2.png Binary files differdiff --git a/sys/boot/default.nix b/sys/boot/default.nix new file mode 100644 index 00000000..9606c7b3 --- /dev/null +++ b/sys/boot/default.nix @@ -0,0 +1,41 @@ +{ + pkgs, + lib, + ... +}: { + boot = { + initrd = { + #compressor = "lz4"; + #compressorArgs = ["-9"]; + kernelModules = ["nvme" "btrfs"]; + }; + + kernelPackages = pkgs.linuxPackages_latest; + + lanzaboote = { + enable = true; + pkiBundle = "/etc/secureboot"; + }; + + loader = { + # Lanzaboote currently replaces the systemd-boot module. + # This setting is usually set to true in configuration.nix + # generated at installation time. So we force it to false + # for now. + systemd-boot.enable = lib.mkForce false; + + grub = { + enable = false; + # theme = pkgs.nixos-grub2-theme; + splashImage = ./boot_pictures/gnu.png; + efiSupport = true; + device = "nodev"; # only for efi + }; + + efi = { + canTouchEfiVariables = true; + efiSysMountPoint = "/boot"; + }; + }; + }; +} diff --git a/sys/default.nix b/sys/default.nix new file mode 100644 index 00000000..e263988f --- /dev/null +++ b/sys/default.nix @@ -0,0 +1,25 @@ +{lib, ...}: { + imports = [ + ./boot + ./disks + ./font + ./hardware + ./impermanence + ./libvirtd + ./locale + ./network + #./nixpkgs already at flake level imported + ./options + ./polkit + ./power + ./svcs + ./secrets + ./sound + ./tempfiles + ./users # the position of this item is fully arbitrary + ]; + # remove all the bloat, which nixos installs by default + environment = { + defaultPackages = lib.mkForce []; + }; +} diff --git a/sys/disks/default.nix b/sys/disks/default.nix new file mode 100644 index 00000000..d238d89a --- /dev/null +++ b/sys/disks/default.nix @@ -0,0 +1,130 @@ +{ + config, + lib, + pkgs, + ... +}: let + cfg = config.soispha.disks; + defaultMountOptions = [ + "compress-force=zstd:15" # This saves disk space, at a performance cost + "noatime" # should have some performance upsides, and I don't use it anyways + "lazytime" # make time changes in memory + ]; +in { + options.soispha.disks = { + enable = lib.mkEnableOption "disk setup with disko"; + disk = lib.mkOption { + type = lib.types.path; + example = lib.literalExpression "/dev/disk/by-uuid/0442cb6d-f13a-4635-b487-fa76189774c5"; + description = lib.mdDoc "The disk used for installing the OS"; + }; + ssd = lib.mkOption { + type = lib.types.bool; + example = lib.literalExpression "true"; + default = false; + description = lib.mdDoc "Enable ssd specific improvements, like trim"; + }; + swap = { + uuid = lib.mkOption { + type = lib.types.str; + example = lib.literalExpression "d1d20ae7-3d8a-44da-86da-677dbbb10c89"; + description = lib.mdDoc "The uuid of the swapfile"; + }; + resumeOffset = lib.mkOption { + type = lib.types.str; + example = lib.literalExpression "134324224"; + description = lib.mdDoc "The resume offset of the swapfile"; + }; + }; + }; + + config = lib.mkIf cfg.enable { + systemd = lib.recursiveUpdate (import ./hibernate.nix {inherit pkgs;}) (import ./fstrim.nix {inherit pkgs lib cfg;}); + + disko.devices = { + disk = { + main = { + device = cfg.disk; + content = { + type = "gpt"; + partitions = { + root = { + size = "100%"; + name = "root"; + content = { + type = "luks"; + name = "nixos"; + extraOpenArgs = ["--allow-discards"]; + content = { + type = "btrfs"; + extraArgs = ["-f" "--label nixos"]; # Override existing partitions + subvolumes = { + "nix" = { + mountpoint = "/nix"; + mountOptions = defaultMountOptions; + }; + "persistent-storage" = { + mountpoint = "/srv"; + mountOptions = defaultMountOptions; + }; + "persistent-storage@snapshots" = { + mountpoint = "/srv/.snapshots"; + mountOptions = defaultMountOptions; + }; + "swap" = { + mountpoint = "/swap"; + mountOptions = defaultMountOptions; + }; + }; + }; + }; + }; + boot = { + type = "EF00"; + size = "512M"; + name = "boot"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + }; + }; + }; + }; + }; + nodev = { + "/" = { + fsType = "tmpfs"; + mountOptions = ["defaults" "size=8G" "mode=755"]; + }; + }; + }; + fileSystems = { + "/srv" = { + neededForBoot = true; + }; + "/swap" = { + neededForBoot = true; + }; + }; + swapDevices = [ + #{ + # device = "/swap/swapfile"; + # priority = 1; # lower than zramSwap, just in case + # # size = 2048; # TODO: can nixos create a btrfs swapfile correctly? + #} + ]; + zramSwap = { + enable = true; + priority = 10; # needs to be higher than hardware-swap + }; + boot = { + kernelParams = [ + "resume_offset=${cfg.swap.resumeOffset}" + "zswap.enabled=0" # zswap and zram are not really compatible + ]; + resumeDevice = "/dev/disk/by-uuid/${cfg.swap.uuid}"; + }; + }; +} diff --git a/sys/disks/fstrim.nix b/sys/disks/fstrim.nix new file mode 100644 index 00000000..6daeb65e --- /dev/null +++ b/sys/disks/fstrim.nix @@ -0,0 +1,42 @@ +{ + pkgs, + lib, + cfg, +}: { + timers.fstrim = lib.mkIf cfg.ssd { + wantedBy = ["timers.target"]; + wants = ["fstrim.service"]; + unitConfig = { + Description = "Discard unused blocks once a week"; + Documentation = "man:fstrim"; + ConditionVirtualization = "!container"; + ConditionPathExists = "!/etc/initrd-release"; + }; + timerConfig = { + OnCalendar = "weekly"; + AccuracySec = "1h"; + Persistent = "true"; + RandomizedDelaySec = "6000"; + }; + }; + services.fstrim = lib.mkIf cfg.ssd { + wantedBy = lib.mkForce []; + unitConfig = { + Description = "Discard unused blocks on filesystems from /etc/fstab"; + Documentation = "man:fstrim(8)"; + ConditionVirtualization = "!container"; + }; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${pkgs.util-linux}/bin/fstrim --listed-in /etc/fstab:/proc/self/mountinfo --verbose --quiet-unsupported"; + PrivateDevices = "no"; + PrivateNetwork = "yes"; + PrivateUsers = "no"; + ProtectKernelTunables = "yes"; + ProtectKernelModules = "yes"; + ProtectControlGroups = "yes"; + MemoryDenyWriteExecute = "yes"; + SystemCallFilter = "@default @file-system @basic-io @system-service"; + }; + }; +} diff --git a/sys/disks/hibernate.nix b/sys/disks/hibernate.nix new file mode 100644 index 00000000..b0aed423 --- /dev/null +++ b/sys/disks/hibernate.nix @@ -0,0 +1,45 @@ +{pkgs}: { + services = { + hibernate-preparation = { + # TODO: check if they work + wantedBy = ["systemd-hibernate.service"]; + unitConfig = { + Description = "Enable swap file and disable zram before hibernate"; + Before = "systemd-hibernate.service"; + }; + serviceConfig = { + Type = "oneshot"; + User = "root"; + ExecStart = "${pkgs.bash}/bin/bash -c \"${pkgs.util-linux}/bin/swapon /swap/swapfile && ${pkgs.util-linux}/bin/swapoff /dev/zram0\""; + }; + }; + hibernate-resume = { + wantedBy = ["systemd-hibernate.service"]; + unitConfig = { + Description = "Disable swap after resuming from hibernation"; + After = "hibernate.target"; + }; + serviceConfig = { + Type = "oneshot"; + User = "root"; + ExecStart = "${pkgs.util-linux}/bin/swapoff /swap/swapfile"; + }; + }; + # swapoff-start = { + # wantedBy = ["multi-user.target"]; + # unitConfig = { + # Description = "Disable hardware swap after booting"; + # }; + # serviceConfig = { + # Type = "oneshot"; + # User = "root"; + # ExecStart = "${pkgs.util-linux}/bin/swapoff /swap/swapfile"; + # }; + # }; + systemd-hibernate.serviceConfig.Environment = "SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1"; + systemd-logind.serviceConfig.Environment = "SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1"; + }; + sleep.extraConfig = '' + HibernateDelaySec=5m + ''; +} diff --git a/sys/font/default.nix b/sys/font/default.nix new file mode 100644 index 00000000..303efcf7 --- /dev/null +++ b/sys/font/default.nix @@ -0,0 +1,21 @@ +{pkgs, ...}: let + nerdFont = pkgs.nerdfonts.override { + fonts = [ + "SourceCodePro" + ]; + }; +in { + # TODO: maybe add other fonts? + fonts = { + packages = [ + nerdFont + ]; + fontconfig = { + defaultFonts = { + # serif = ["Vazir"]; + # sansSerif = ["Vazir"]; + monospace = ["SourceCodePro"]; + }; + }; + }; +} diff --git a/sys/hardware/default.nix b/sys/hardware/default.nix new file mode 100644 index 00000000..77d3d3f0 --- /dev/null +++ b/sys/hardware/default.nix @@ -0,0 +1,46 @@ +{ + config, + pkgs, + ... +}: { + hardware = { + keyboard.zsa.enable = false; + onlykey.enable = true; + opengl = { + enable = true; + extraPackages = builtins.attrValues { + inherit + (pkgs) + vaapiVdpau + libvdpau-va-gl + ; + }; + }; + }; + services.udev.extraRules = '' + # Rules for Oryx web flashing and live training + KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev" + KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev" + + # Legacy rules for live training over webusb (Not needed for firmware v21+) + # Rule for all ZSA keyboards + SUBSYSTEM=="usb", ATTR{idVendor}=="3297", GROUP="plugdev" + # Rule for the Moonlander + SUBSYSTEM=="usb", ATTR{idVendor}=="3297", ATTR{idProduct}=="1969", GROUP="plugdev" + # Rule for the Ergodox EZ + SUBSYSTEM=="usb", ATTR{idVendor}=="feed", ATTR{idProduct}=="1307", GROUP="plugdev" + # Rule for the Planck EZ + SUBSYSTEM=="usb", ATTR{idVendor}=="feed", ATTR{idProduct}=="6060", GROUP="plugdev" + + # Wally Flashing rules for the Ergodox EZ + ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", ENV{ID_MM_DEVICE_IGNORE}="1" + ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789A]?", ENV{MTP_NO_PROBE}="1" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789ABCD]?", MODE:="0666" + KERNEL=="ttyACM*", ATTRS{idVendor}=="16c0", ATTRS{idProduct}=="04[789B]?", MODE:="0666" + + # Wally Flashing rules for the Moonlander and Planck EZ + SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", \ + MODE:="0666", \ + SYMLINK+="stm32_dfu" + ''; +} diff --git a/sys/impermanence/default.nix b/sys/impermanence/default.nix new file mode 100644 index 00000000..a9be951a --- /dev/null +++ b/sys/impermanence/default.nix @@ -0,0 +1,52 @@ +{ + config, + lib, + ... +}: let + cfg = config.soispha.impermanence; + networkmanager = + if config.networking.networkmanager.enable + then [ + "/etc/NetworkManager" # store the networkmanager configs + ] + else []; + secureboot = + if config.boot.lanzaboote.enable + then [ + "/etc/secureboot" + ] + else []; + directories = + [ + "/etc/nixos" + "/var/log" + # TODO: the following entries need to be checked + #"/var/lib/bluetooth" + #"/var/lib/nixos" + #"/var/lib/systemd/coredump" + ] + ++ networkmanager + ++ secureboot; +in { + options.soispha.impermanence = { + enable = lib.mkOption { + type = lib.types.bool; + default = true; + description = lib.mdDoc "Disk setup with disko"; + }; + }; + config = lib.mkIf cfg.enable { + # needed for the hm impermanence config + programs.fuse.userAllowOther = true; + + environment.persistence = { + "/srv" = { + hideMounts = true; + inherit directories; + files = [ + "/etc/machine-id" + ]; + }; + }; + }; +} diff --git a/sys/libvirtd/default.nix b/sys/libvirtd/default.nix new file mode 100644 index 00000000..3b9c7d85 --- /dev/null +++ b/sys/libvirtd/default.nix @@ -0,0 +1,27 @@ +{pkgs, ...}: { + virtualisation = { + spiceUSBRedirection.enable = true; # TODO: this allows usb access to any user, which shouldn't be that bad + # cores = 8; + # diskSize = 25000; + # useEFIBoot = true; + # resolution = { + # x = 1920; + # y = 1080; + # }; + # memorySize = 8024; + # sharedDirectories = {}; # TODO: add some + libvirtd = { + enable = true; + qemu = { + package = pkgs.qemu_full; + ovmf = { + enable = true; + packages = [pkgs.OVMFFull.fd]; + }; + }; + }; + }; + users.users.soispha.extraGroups = [ + "libvirtd" # to run libvirt stuff as this user + ]; +} diff --git a/sys/locale/default.nix b/sys/locale/default.nix new file mode 100644 index 00000000..1e7786cc --- /dev/null +++ b/sys/locale/default.nix @@ -0,0 +1,36 @@ +{ + config, + lib, + ... +}: let + cfg = config.soispha.locale; +in { + options.soispha.locale = { + enable = lib.mkEnableOption (lib.mdDoc "locale"); + keyMap = lib.mkOption { + type = lib.types.str; + example = "us"; + default = "dvorak"; + }; + }; + + config = lib.mkIf cfg.enable { + # Set your time zone. + time.timeZone = "Europe/Berlin"; + + # Select internationalisation properties. + i18n = { + defaultLocale = "en_CA.UTF-8"; + extraLocaleSettings = { + LANGUAGE = "en_CA:en_US:en"; + LC_TIME = "en_DK.UTF-8"; + LC_COLLATE = "C.UTF-8"; + }; + }; + + # Layout + console = { + inherit (cfg) keyMap; + }; + }; +} diff --git a/sys/network/default.nix b/sys/network/default.nix new file mode 100644 index 00000000..9c570f3b --- /dev/null +++ b/sys/network/default.nix @@ -0,0 +1,51 @@ +{ + config, + lib, + ... +}: +{ + systemd.network = { + networks = { + "tap0" = { + name = "tap0"; + bridge = [ + "virbr0" + ]; + }; + "enp4s0" = { + name = "enp4s0"; + networkConfig = { + DHCP = "yes"; + DNSOverTLS = "yes"; + DNSSEC = "yes"; + }; + bridge = [ + "virbr0" + ]; + }; + }; + netdevs = { + "tap0" = { + netdevConfig = { + Name = "tap0"; + Kind = "tap"; + }; + tapConfig = { + User = "${config.users.users.soispha.uid}"; + Group = "libvirtd"; + }; + }; + "virbr0" = { + netdevConfig = { + Name = "br0"; + Kind = "bridge"; + }; + }; + }; + }; +} +// lib.mkIf config.networking.networkmanager.enable { + users.users.soispha.extraGroups = [ + "networkmanager" # allows to configure networkmanager as this user + ]; +} diff --git a/sys/nixpkgs/default.nix b/sys/nixpkgs/default.nix new file mode 100644 index 00000000..c37d5582 --- /dev/null +++ b/sys/nixpkgs/default.nix @@ -0,0 +1,20 @@ +{ + lib, + system, + overlays ? [], +}: { + # TODO: inheriting system here is discouraged, localSystem or hostSystem should be inspected + inherit system overlays; + config = { + # TODO: this fails because of the root tempsize, which should be increased + #contentAddressedByDefault = true; + + allowUnfreePredicate = pkg: + builtins.elem (lib.getName pkg) [ + "steam" + "steam-original" + "steam-runtime" + "steam-run" + ]; + }; +} diff --git a/sys/options/default.nix b/sys/options/default.nix new file mode 100644 index 00000000..72ebc4fb --- /dev/null +++ b/sys/options/default.nix @@ -0,0 +1,26 @@ +{ + lib, + config, + ... +}: let + cfg = config.soispha; +in { + options.soispha = { + laptop = { + enable = lib.mkEnableOption "Laptop improvemens"; + backlight = lib.mkOption { + type = lib.types.str; + example = lib.mdDoc "intel_backlight"; + description = lib.mdDoc "Which backlight to query for the screen brightness"; + }; + }; + secrets = { + #enable = lib.mkEnableOption "Secrets through agenix"; + enable = lib.mkOption { + type = lib.types.bool; + default = true; + description = lib.mdDoc "Enable secrets through agenix"; + }; + }; + }; +} diff --git a/sys/polkit/default.nix b/sys/polkit/default.nix new file mode 100644 index 00000000..9de68f35 --- /dev/null +++ b/sys/polkit/default.nix @@ -0,0 +1,3 @@ +{...}: { + security.polkit.enable = true; +} diff --git a/sys/power/default.nix b/sys/power/default.nix new file mode 100644 index 00000000..d20a97f2 --- /dev/null +++ b/sys/power/default.nix @@ -0,0 +1,19 @@ +{...}: { + # see this for reference: https://github.com/NixOS/nixpkgs/issues/211345 + services = { + # conflicts with tlp + power-profiles-daemon.enable = false; + thermald.enable = true; + tlp = { + enable = true; + settings = { + CPU_BOOST_ON_AC = 1; + CPU_BOOST_ON_BAT = 0; + CPU_SCALING_GOVERNOR_ON_AC = "performance"; + CPU_SCALING_GOVERNOR_ON_BAT = "powersave"; + SATA_LINKPWR_ON_AC = "max_performance"; + SATA_LINKPWR_ON_BAT = "min_power"; + }; + }; + }; +} diff --git a/sys/secrets/default.nix b/sys/secrets/default.nix new file mode 100644 index 00000000..d1fc1714 --- /dev/null +++ b/sys/secrets/default.nix @@ -0,0 +1,32 @@ +{ + config, + lib, + ... +}: let + name = config.networking.hostName; +in { + config = lib.mkIf config.soispha.secrets.enable { + age = { + secrets = { + nheko = { + file = ./nheko/conf. + name; + mode = "700"; + owner = "soispha"; + group = "users"; + }; + serverphoneCa = { + file = ./serverphone/ca.key; + mode = "700"; + owner = "serverphone"; + group = "serverphone"; + }; + serverphoneServer = { + file = ./serverphone/server.key; + mode = "700"; + owner = "serverphone"; + group = "serverphone"; + }; + }; + }; + }; +} diff --git a/sys/secrets/nheko/conf.apzu b/sys/secrets/nheko/conf.apzu new file mode 100644 index 00000000..a4f704ea --- /dev/null +++ b/sys/secrets/nheko/conf.apzu @@ -0,0 +1,45 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUVBnV3NkVlZuN0IrdzdZ +UmlXZUF5cmFvd1pzOGFZNlJuRzdFY3pWV25vCjVVNksrYjhPRi9ZTy9DOXA4anY2 +N3AxWXJTT0dZZU0zOEFCSUo2dUZhK0EKLT4gc3NoLWVkMjU1MTkgN0hmRlV3IC9U +UUhPY29BU2tVY2Z3YTJicjVwZjc0dVVRVHd5bzlqS3pKMDlDc1hjM3MKVmRxc3c2 +SkZvdk9nTzhSdkV2OEdrRjFqT3gyOTFZN3BRT1pZb09nQUg1SQotPiBiLWdyZWFz +ZSBsR0txeUoKanFDNm5BCi0tLSBqWCtNdWk2cWh6WDFXRTBsTjBHaXNRdDVlY2ps +dENOeVc1YmZnNEpZVWRrCpj1HsID0+Oi3IoVUCsFVPIxeKsvptv+8T+Zycu8tmfS +gZZm0XHdJHJFh81d75YyHRBhAhuq/Rg5sR5Wdu9UAAo0NqDIlKICFfKmdrbxEj8D +QL/W6TThKeR/rDZNy2E8Y1hRgQz5y1YG91kjoZpUQReNZBugaq5P0n1UiI4YYa2Y +Dp2E0S53pnLfd3f8UyVkli8fxciFCD0l3h+pueRhEalpaJlJAublyMLXO1rPFvw5 +MiqeP77+kcEtXWC3icfPwNdVhQJEIdOHNsUh6CdD37WORZmg8Kwq2vN0cO+xlZt0 +5zRe3pcBFSzqVmVC8BYRfeJPyygEo70kqbqd5JmnC4wcqvwbHyB8JNBspqkVc0Kh ++u2iYGFjtz6hN6wCxssIOxKLhgqmY5mS0qC21stDa3MrH83cAthtTWEf4IIHduHC +qDnmcpD4dJtB5fboxBrgZ4K3TxMPgRx7J+2tqY3wtxZUEonFFH1L7MyEGmJ6cFiU +RV1cbJRwOYH5nesA4nqAP7/d42vB0unbeTrkYOpTaUSa/hOXfycCtqhtHWFB5378 +2I5wvDdZeTzt+FmQO12Qj01Pqy19FbjMmUeQtKfAiBgOSdvdGOKBA7VmFlG1sow2 +vsU09JluQok/cuDEqunun4cHxLlzTJtH9eGAKceXx3trnKz/zyzbWw55G7VQqM7a +snpi0rsikr+7i0/oxAcrMoBOEX6EDShS6Vio6IIz8KNU5zUPQW5tNbbkfMQW1GM7 +rlZScSlk4N2CmR34BwtEUbAEKzPuNZU3zOX/urDd7rN6gjqwTwa8AGH8bCItMWSI +xxzPq00znHsf2hQkLOI40ENrs84/9ZiW4X3lJSPGaT/t1plzjiPUiIb37hSA6rhR +95zo5qzsjhVJqLB5V4S9wkWJ2vN5Yc4CY6hgoRnZz3n4XoxRed/rdXZ5eUQr2kg8 +h07CNpzeCUfx73kzsrFFIkBiNe0pd3ss2UXR8ilKyY2qMjqQc9Ypd0dLFU34nK+J +t8rQShs+288ni6kXu4PgBVzT891LRuwSxzv8lIZGHtUQ7XJFSJaeFBl+jIGo3iP2 +bdxlFuikGkhyvo+H/RFrAsmxHKgVs4y+ccCkMoapyUiVRvHA2X+LK935EEbGdTI/ +wNmUTPNmB3xlnIsrPxjqw4iUCf3OXZGFd1tSGc4C+5+IYryPPX4rln8fEnmYWq8f +mbHwIjri7YOuC/dVmI+fh74M0tqL7qGtTm8j//AYo1U1a0kgOPItiRzJRLX1TZ7M +JnjQbCmyPX17liRAVbeTJGLAorYIHhCXMRSf7TYwBGgOFHGcdQteFYms2eh9asDe +Zt6Zlmk5yJxz1je+ayWFzp7rms/wEkHR3kZ9dKUMtvAtLzusWcLL4A0zuBU9+GpW +thA+tcskvhX+UR8sYLT3d71JjGPqXujdHFpp4kM/RN+vdpdF+tOm0HVIn/ZuVcNV +pvGdAcKddXH9NXrc/5EDfQWfHbUrjgdHdZVo+BcD/4EZ/k7pQ4Q8EP9IXDvYmORU +5buuZsphAs8JFnuAu0FkwOuQQHX1NjVv0XGjwWMJsTDtRpZTfTL1wJmIdolqJRcZ +5EvhzViERXdZaOOXvUzy5N2BeZA/lX8Ls5P9ygOiCfF5rDajfk6CZLqrvJ+czW6m +07lkpfCo1CsxYGQPcNWlVQOnvO9lW7EtErEOcjdt1VcWJEm462O4FiILVm6Ef0Ax +/qDJUPwFd1NjmvW9e+GkHMXHDnADKxNxQU/KJJsLVdUyZVX4BzQ3W86N/kMyyWQd +1kgAzH1Aba1XyjDGyBAwC0ll0jwemqsD1F5Wzsvmm1dHMWev9y8P/jnQ3hsZ2j1c +n91KbPiZSaqK8ARRROzaVwJMGJIqnGAtqlwD/h1dE1cfHly/OxBHoo5VXPX8R9r7 +W31vHWjKrH7ZlZUa095f3X3xxUvhhnlFFhAwXluWc+FO5IlcqWMdfaeZKYORANdR +sB/moDP0n9WDQZrql15gfca+TQZMNcba8bsa9xnnkow+Gnl3LXE8SPTCE/nWK7lr +gXczbdNe7hpj4cK4lpQMlfk4iMeHYj47k8FFBEh0dbkAz9EpZQcRTjwJScybD51S +XhcOtSD1DJsNcl4RlaraDI4LRlfPqkTGbdmWfxaBmxgSupezF3wa9IC7iXmZeCt+ +doPKlB4LGmrr9ZHX0mDEJZtdrLT1x3xR80afZPlHCI4p3bKIgcmIKyxKxDpoKCou +OPpi0J2mtDZRG7M+u4dDJhiTiYPnhWxOmlL3yHGgN09xb2ZlmO6PhH5yL7eqiItS +n/iJA0bOZE/wT19+D5DofKzs2yjGTx4L+W4= +-----END AGE ENCRYPTED FILE----- diff --git a/sys/secrets/nheko/conf.isimud b/sys/secrets/nheko/conf.isimud new file mode 100644 index 00000000..ef6c52b6 --- /dev/null +++ b/sys/secrets/nheko/conf.isimud @@ -0,0 +1,47 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwa0Fvb0p0aU5yRGFCSm5h +d1lNSWc3aWl1NS9FcXpsalVVVGpuZGNRMnlrClVBM2R3aXpSa3pjZFpQbEV0Njcv +QUkySlJRNkV3THBjYUt3RWY3ZWRtaTgKLT4gc3NoLWVkMjU1MTkgN0hmRlV3IHda +dUU2WEwxdjNIZ0R2Wi9rbFQyb1l1TlFBZUJMWlFuMXZNSWZaZFIza2MKVGwyOExv +cW5GK0JsOFVRLzloaVUyQjhvYzR5QnNIc1RTaStISXdnT003ZwotPiBjejctZ3Jl +YXNlIFR9UFRJZyAwTjpdfCBrXlc4TXVnCmlHWTBMOUhPWU4vTzV1ZWFZVTVzTTRC +aitrNHJMQlBrMm85bWhBU29ONHpvSnkvSEFzcnZOTk5Ma1FNM20yVDUKMGF0M25C +UzR5RDdrN3cKLS0tIFNUQk1jU05lSStkQXdYMkttYjY2UVczMi9xZkhZYkdIQWw1 +RkpIOTBvWncKIACBrSaYzKJ84Kjpj57B/WC2vjIvvDAfy3TF1gVEWFOUgYkCpO52 +4sjWpd3JVpdLzsJczS7Ty0HZYBlmz3Qtejf7x6b4xftJSari5WUK6loGtmGKbgJW +lk2LZonpTsnyyALFavanlQKkv1isR9jqWxRe0KZu76zbX/QTUVfHyjV+4m6kleUI +ZJj1mLUKxYdJn2aGyTr4kwTfbLYR8/xxJYGqPUmCrFrLhsr7qy/yBXvPyIfJ+sd/ +ab2/Qz2U8wE8d0JRiwoguFaRTbrIKBzliF84CrbDznJtLQjn02zbc78lzn4n/7MV +3VArXkqw1pICkbrfLl1+own3Mw6ge73tDnSunzgJWBKSOFOrs/b/J1uMMjoiTGWi +THy8+asIFw/zZTmrUnlfmm0gE20nm/HYTJ+428nGrMwdh++LqgocxqX+CNcNTT56 +QhXwR3JuliST8jptRaFo8fzoJUImclSj+o3X2/KORm4fS8u67lcDA6KB/lw6WOie +UE09CVsrkR4X7ACe5Y7PYr0fWYNh1PrYxIabYttQq3aus5SunfkrCX+/+xtbMNsm +FX0TxMintrp3UV4eWEZzsHNz18PaXtyZTFCF4sTmnxjfP7TelZRTHNh/LbKLFrqL +kna9ChqIUiHIEYbugkZsSWUICWMbEGBWQxD4CT6DfGuve4vOgw5FWtqdvHz43f0j +9Agjvab5H+fBvDJTbJiHOFn681Wl219hR4z1plM1eVu+59JIFECVeEePoDrjGy9n +K50HUNs5Vq0p8RFus2BbjTuECmggkzd0P7mZb34bVo6K/89lCny21WeGyhwim8Hr +KKBmpm+hCh7gikBKXP0tnpmt4A5sPg30+YxePgaKCNtUjLLnN4moEGzzAsks1qsJ +GYvzSZv7AmTfyww2cjVm9ZSrlo4EHL5dMPEVBHpy6pcSV6WotkZiDklYPD4g0ZO2 +wgbLU5/YDhve9FOKoP7Y4wocP18O6ffjiPVeCg9XDUmoKq5Y/Ea1d317q973G2hf +YxUD8z9I8+fGlfqmgIjJZx8/0wTFlrCxI1oam6xPDmbSjrdVI+nr/2lfNqy/VOYN +SQMr/Po7DcAwB5SS4ItxYXKYo9FAFyoHAljYhV156l7dveqehZDKaqBzBF+pCefQ +BfiwvYg3by/R9jtMdh6MwfMeF1Z0siJdrPouIKmsuITLexuj85GkzPzSPDa69H2s +iInDepGDX2YvH2BUsUi8QPwoxRXROFwDqaIpA/aaPf224YN7D46TzU+a2HQzlpmV +xWqh/pBEwKdTpbgtdoG9GLrETDD5/2FV9FiQXxQgvV8934nlOAvdwHEJqGMlNIT2 +mlNhZyx49lOfx8BFP+NXb2adUY49Aahkdx4/uB6fN0H/RyNh39R74DCbjvIQUxRV +OUKyWZ2a2wSbZbA6tNmB5sXYtfCUOZLfE8mUwJgUSVrEccQ7UlSlEy9+gZDiHjS+ +OYnTBdRdG2AjPy3mBAdfqooTdzQwT5HNnFskg7Q3wnWRf230yZ6Qr2lBOyBgtnm1 +Hj8fI9VrACfAtYMIWUarBAnnoWHB1pHfoZOui6Zr4jtqlH7lgOAUFx/b60g4SsSF +jAJnRCFyUYbTv53GefabjkDg3WkCiyxrNhr7gS7oONa1qHai/1TQeWPCe9zj9kaR +nMRZQKI1/wmK8szhH7sA+tShtM3ktqkNlIWXuwId3OJ8ne2vcES92NRfyUI8qY39 +atndXRUg47+2MubBZhP1pnLEdxpvdOQVgDIzoNx3mu0mWkSi2K3Dy/Y4mZGVaee/ +K98cPo3S42eKEulsN/iyTWD1nJpaDNp4fWDCDMSK8dy7vSWYcT3htzzR3a4WIlLk +PV3/7l99y/HLjlJmqUwRri1hydRdC74Lk3FSV6gc6snn54WnaLUCVOpCIgHefNVr +zYmUR+4I6zioxp9540zrD8YvrK8YSSs47PtbpDYI8E9O4L7+uy7gujwJtSupZVRc +BP48+5NddK3gpQt4BagYj6CO/vENwDmUiA+kUM9WdQbnV/lmeNPdqm2VjVbxNObZ +5xHlXODOOCVg+LSpFybFT+3A2MNA/jRKGID5Kai0a9c7jY/XIrUdIaCpyVylj2dX +4JDC6AsRb1VXu7FaqhLhOabZZzW+o8m94ZjayWA2BT3IMf5Kd6eq+v9zh5RPlvtu +vcoLBTEsLPZeAyERpaTto431yRqzSKMvDQ6nwpXbdIcHLIvbp+utRoaqtel2JGO4 +PBz21qEI/ACc6sDhyUHHLz+MybEQilTSrBJ+jYSohFfm0DEpG8cThgm6mMSDUMEM +6ehgKHIYdlMa7YIBcIpJBsl8Xs6If2+FA7cbeh6xqbw= +-----END AGE ENCRYPTED FILE----- diff --git a/sys/secrets/nheko/conf.tiamat b/sys/secrets/nheko/conf.tiamat new file mode 100644 index 00000000..51cab7df --- /dev/null +++ b/sys/secrets/nheko/conf.tiamat @@ -0,0 +1,45 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCUDQ4ZUtkcEVTVWpTQ0Zy +Yi9naWRDaDJFYm9GR0k1QVhJR3V2Rmc0a2hNClNxeTQ2YmFHRkxRWnhlc3IrKzJE +eHpWNGFSTEV2WDR0OHNwTEZiMGdxOFEKLT4gc3NoLWVkMjU1MTkgelpFb25nIDFH +M3orVXZFMndGc0hPN1hWY0xyeXJuYmFLVks4bFVqdHFQVEN5eUhNRmcKUWlZdjlH +ZWtrcGlnZ2ZGVHBwNEZrM29CT3c0MERBNm5SVjhMdWxGbEgvbwotPiBULWdyZWFz +ZSBoOGYKdzBOVGpYNVJFdXoxK1dZdU9rdG5jU21UbUp4UjJYZXRoTTJqNnJvCi0t +LSBwZTJaUS9XRVRINmpNVFhxMnkvdGxkVTJaNkZTZG1PUGVZN0F5QmpJWkxrCohN +YfE5W/OxshJPerGCFWpYkFcQhJaz/HEknz13rCqH4yXfp3M7uoHWKfEFi1uzFdZs +H9MnIKS5NN8bLW4xssBaogalqCAigEUDuLPKmep8224Y4h9i+7fWOMBhgHjU322N +7iJCjnHiKT2tM4uv95c9Fa676xHcfZwzaCFDxbasQZmZL3G3U1wDseSK7EHCZ78R +sXqqd54ApUQyAwdSLPFVvX/YlhOIL6MMUWvhmmgHcNRYa71cQcoojleJI28fu53w +6X0qez81+/D8txyCEtF07m7ckCtYTe7oKT+mF5cvT99lHqEJBJzq/PxUIQt2dA2y +AQr09/7LJ5h8RYVG8emwlqzBasvCdLFXwtCNRMQGb5kDJ5CcZKy50SIpYvDdj269 +Ap4Lq/luQIeOMXQudbc+ECToxbrRKy4gcG8oKsvIXytIOszA8x4WjR14zSBTNunx +Z4mOb0zDy1GdKWsgPcyYdiOBIKzEpTLvjCbWYWJunGSPIlsksBvAAP6MsCbV0WQo +brp48ds24jlCjtqW+AdSIvo5+YVdyCEho8Gdw7k134cIhjoC0SU1vmNNzh1swoW0 +yRKG8ql2Tj6myIDcLM/KDozsgu/gNC2ugRwTCDv+gcApZBmKUXN2w0abhI2UMksH +FEw2ITrWDhPE87bXWNua+vdaBa619lg43xoJTGeJHqF5gXEV3blZ5bTvVjT2H7Dy +uBfCk+XQ4G51Dwh5iyjrQyWxCkYS0FJGD6WUTBU0nrxc6d9UERcxVurtPr7I9Tmf +IVdl6jkrjpfVIL/Imo+YgfdG9CvhyEl/x50c4umDsLxEi67v8TE/yEBhY+o5RnKD +EU0NjdHDIgtI9+Fa0KujnkIN6DqJ0V+QHKv7K8yiR8BScIq2YD1LOOApb6pom7+4 +440vZwmo4NgPsPyM/GgGUIyTeR4tU42BPyMTPjKEuN97ZwWZqIFreUl+nyLzViK/ +bGLYcRfVjjHTJPIeZRosYUo0ZMFggXAuslx5trQcb1B4iHvL7k2jjnMRJmyYZX2d +CWohscc+7+1iFNdH++tefcED8T8HCGpM1RxSM31kfpnKnINeBdo9E9ZDmNCElZm+ +nds5fgTm/MLKsuC/t+MecVdfeHTufc/Akh343DMdIMNmZ35xLcpNLmxTJ+iCALS7 +nheIWAFUaTh6GB6IGocSSjQ0RwS0wIftka4QdW+UEtEjnvB0D/CjwDLSO3pUl0mj +44r8fH8IZVcQcnqhuEsFoih/XOlH3N95O0HxXCvUcI13/HaSpUKdJqyAIn8w/jBM +FL/boJVA1zOH5sIY0AD2IMavuS5b/ZgJtPsESrc0LUiL4nztDVdAEtpHUM0OEzb9 +tSAIN888UKTC8MFSIwA+4cXIyCEpxXP3HbSNaar5gp75oG5/BqOu1aF5sC0kKpmn +9C9+z9sLTDigzV1GKlPpUGd9lVOeH2JpAY8ZUyn2gxh7C6IHwwUbWUclEPy2siYd +HcAMneEwXpm6DfJevMi2o0wOdVakcpN+YUNzIgferM/IU5FbgtC8gNBpDCBo2yLe +X7ERSzP177QWwXLIF2WhZeG4Cvszj4tySYsRJhoZPc9jpRjiK/ccOoNo8A1UKbJC +H/836MNskBmmbNoPsS979mLv8ijpRzvjnwbWn+ZlCo3gZAKVM7PcXuTODcWfoAJ4 +2ugEHCAiOobGQtGUp5HOhXYfAK2Wene0a9RmSAT3SgPmx95u1Fy8n+m/PDK2opIe +REpj9UTcoT0+5aHIwp2gqLVpQH2953Prd0qaNfc1t6gQKwDXDDU+b+QmxAaPBwpu +0TEIEYKsx237lX314XSaq+Nt7Ko1OPABR4gkz/ELL4WOKwFbf7oAAV3UiNPwweY8 +R3cpVvQ70y+M2Nnwepxf7wSruo+FDtgsic9vtobdpwBViPC+AG2QbI1hTD3uhslE +KunFtbO08ARcTMeMgZ0BE3XXnrgxdKjXmPEybQiyObFxDGbV1EX/2i1MKArQdQzs +MxCpKOzDi5axr3Qd/W6Y/foMZWfRYgb+0xITHU7haR8QRD80uTbt9TfsqK98H1A1 +UMosMKhkzKG70qdNvTiEh+OqBAIbUL42IKNn4SCiZt7ZCQ6/QqwcCi6ND0w8+dO1 +u8vZdRF+r/3AAPpa3W7BiIiLUmmU8IUI8A/72cCrY6PyrjaomXnpVWlZjQ616i9Q +TU9IwBahMa2j/a4317pv/7ltQQCpCkRs/HweQy5CQS+yFuOcoOVikL0ZHd9XC4YX +QJ/T6R5+OngxkJgoPRtJ +-----END AGE ENCRYPTED FILE----- diff --git a/sys/secrets/secrets.nix b/sys/secrets/secrets.nix new file mode 100644 index 00000000..36757546 --- /dev/null +++ b/sys/secrets/secrets.nix @@ -0,0 +1,15 @@ +let + soispha = "age1mshh4ynzhhzhff25tqwkg4j054g3xwrfznh98ycchludj9wjj48qn2uffn"; + + tiamat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMD87QQIUXdEv3TaNRrI9clD9VgpsuVLFg2CrNGa5lVB"; + apzu = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBivF5b6PyxsR/t+4Qg4IEDXHVXrjmZpslTUNXpvcVbO"; +in { + "nheko/conf.tiamat".publicKeys = [soispha tiamat]; + "nheko/conf.apzu".publicKeys = [soispha apzu]; + + # only here to satisfy the nix evaluation + "nheko/conf.isimud".publicKeys = [soispha]; + + "serverphone/ca.key".publicKeys = [soispha tiamat apzu]; + "serverphone/server.key".publicKeys = [soispha tiamat apzu]; +} diff --git a/sys/secrets/serverphone/ca.key b/sys/secrets/serverphone/ca.key new file mode 100644 index 00000000..d49c5395 --- /dev/null +++ b/sys/secrets/serverphone/ca.key @@ -0,0 +1,19 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyaGJNQkRRVy9MRXZ3b2tJ +Q2R1NUcrYUNGRE5uQkNyUDdkSm5rUWYxaXpjCjduMG1FSG1VamozdnJoVFFZUDYz +T2pyK1k3ekZ4RnFMaDFKdUZPWVNuR3MKLT4gc3NoLWVkMjU1MTkgelpFb25nIEpP +d0xwS3Nia3AwNmppRjZhODdzNXhEcnRsZW5rUzBQcTN6NWhWeTNiQ0EKTkpUZ1Jk +NHE3WVRzVEhpMnJGaVFpdkFBVW5QNThCSUdFSHVQR1RrQUJsZwotPiBzc2gtZWQy +NTUxOSA3SGZGVXcgdjJKUUtlRjE5UFEyR2tBOWhEbHNMVlNSOUMyZ1dkYkhYZWRW +by9QZ2UxTQpVSnhJcFFYay9LSStrSFFJcXJPWUxydXNGbUNXRVpLcHJibjM2TDlw +RnlVCi0+IGNHPjMiSyQtZ3JlYXNlIGcgdWZkbApmY0YzMmhDdzBWT0RKaWlUUmZP +bmRPOExuRVJ3Yk5mMFhYSnhlRENqWXJxK1VWdnBibUxzNWV1NHMyNVNXN054CmR0 +VFAzYUR0RHVaZUpOTlB3USt2TXVDcXdLOGtpZwotLS0gaTliQzBjbjdUYkVidURX +em9wcU04cDhNMHB6KzNBSVMyMmtSRERKS240SQryB70ZEgDQ4eJ/pjIWh6MBEUQr +iAx2i+J+XJu+74bC9DfB5rWpR4/HAdp8EF6wmi05TuEPUpG9brwm/mHi+FB/Drpu +00viGfM3dlCyALz1jB2W/MbruouK85o2L3RWDCgc+eT1gA+u2C7ZxO6iYA3aP4lu +ShDcSHlsKkh9lx4cRsNTua/8N+GQZLciSC7iMDroruxWj1HET9IxeeVN+VSuqcjW +ocX3LU2uU8vP9WT9zT1lbQB5Z0EM7W+ez61SjGpzrpXB2mpmi+SHOIWF3VdG1H8R +18BIyRjKIj5Op+8XD7qAe6nl9SSCnMURH+arc7yjNMgEbzFykfldfug2ibI2G/kW +OxeiEBoSFlC+V8ivS6I= +-----END AGE ENCRYPTED FILE----- diff --git a/sys/secrets/serverphone/server.key b/sys/secrets/serverphone/server.key new file mode 100644 index 00000000..a2720406 --- /dev/null +++ b/sys/secrets/serverphone/server.key @@ -0,0 +1,19 @@ +-----BEGIN AGE ENCRYPTED FILE----- +YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZnBXSzF4K0ljR3B1Rkk1 +M0lSSkVmVlA2Tjcrd0JCRmhHWDY4bzNoYnhjCmsvQjJmYU5vNVh1Umw0dzhCQjNF +WVRhVHpUTUIzRVBxaXhFWHpuenZHN0kKLT4gc3NoLWVkMjU1MTkgelpFb25nIHAz +aG02dkxiNVRreVNadXJjbnc0bXBtSFRSNDhrYjljanUrNldwVFlabXcKU2c2L25r +VlNjeDFENUdQeWllenRGWlRqRW53UU5VNEdCaUZsbHpaL1ZFTQotPiBzc2gtZWQy +NTUxOSA3SGZGVXcgZytvUUhZSXhwQ01mQmtkZmhzdHJUd2tlQS9yYkxCdTBYZ2pJ +UEd4WEF4SQp4WVh2UEJReDVES2tCWlpqQS9aanQzRGRsSTA4S0VXSWZxZ2hoKzZq +YllzCi0+IEc4eC1ncmVhc2UgaGQhIGFydERoaS4gLERUcQprczdDdHhaOXpmN1VU +MDlHNlYzVmMxY09Oa2xzTVN6M0ZyYnpRSzJEMS9nMmlqRVo4Wk1qN1lKZnp0N0RT +UStuCm51L01Rb3ZxNUhEa0c5Z3orYlp0YmlXMkhpeHVJMjNkRFZYWmR3QmV2Zwot +LS0gdWJDeHZvc0xOMU9uUjUyMlRGUnlGSW9PZzVKWWNoa3pWbVM1OE9LdFk2NAo+ +WS82jL1us5iVw+xWVI80luHMs31hxZfQgJDBuFbtpY0nKkM97U7rusl6t8P+s93c +R0IYBEUuz6n33GTeVOLipDqkZftlOOvSZkFneZ766+GpEO01dCjeSW9KViDC1jI/ +721IXq9TQNZw0Ou3Vf5E0nDypsfG0UhEoLCy6QZL9YCIyl5s//kyFFnpQjyaGT/P +pRHGhD0BxZa2ib07WDWzBpsTFtVemwcn9lqAx7DlYV2X3UwCT3qVOVjDuA/j6qUt +8bCDoXs4/dWleHNHzpwRhe+j2W4OWDKp7o0zYqxkUuPpEWXL7+A+B/+/08nAtZQk +ZvJyaZSL5wicIPAjLxrD00z2QcE/ZPyUrXsi0gOovuk= +-----END AGE ENCRYPTED FILE----- diff --git a/sys/sound/default.nix b/sys/sound/default.nix new file mode 100644 index 00000000..318dcb8b --- /dev/null +++ b/sys/sound/default.nix @@ -0,0 +1,23 @@ +{pkgs, ...}: { + # Enable sound with pipewire. + sound.enable = true; + hardware.pulseaudio.enable = false; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + jack.enable = true; + }; + environment.etc.pipewire-pulse-config = { + target = "pipewire/pipewire-pulse.conf.d/pipewire-pulse-config.conf"; + text = '' + # Extra scripts can be started here. Setup in default.pa can be moved in + # a script or in pulse.cmd below + context.exec = [ + { path = "${pkgs.pulseaudio}/bin/pactl" args = "set-sink-volume 0 13%" } + ] + ''; + }; +} diff --git a/sys/svcs/backup/default.nix b/sys/svcs/backup/default.nix new file mode 100644 index 00000000..171f1043 --- /dev/null +++ b/sys/svcs/backup/default.nix @@ -0,0 +1,67 @@ +{ + lib, + sysLib, + pkgs, + config, + ... +}: let + snap-sync-forked = sysLib.writeShellScriptWithLibrary { + name = "snap-sync-forked"; + src = ./snap-sync-forked; + dependencies = with pkgs; [ + bash + btrfs-progs + coreutils + gawk + gnugrep + snapper + util-linux + + # optional: + libnotify + openssh + pv + rsync + sudo + ]; + }; + backup-script = pkgs.writeShellScriptBin "backsnap" '' + ${pkgs.util-linux}/bin/mount --mkdir "/dev/disk/by-uuid/${cfg.backupDiskUuid}" "/run/media/${cfg.backupDiskUuid}"; + ${snap-sync-forked}/bin/snap-sync-forked --UUID "${cfg.backupDiskUuid}" --noconfirm; + ${pkgs.util-linux}/bin/umount "/run/media/${cfg.backupDiskUuid}"; + ''; + cfg = config.soispha.fs.backup; +in { + options.soispha.fs.backup = { + enable = lib.mkEnableOption (lib.mdDoc "backups with snap-sync"); + backupDiskUuid = lib.mkOption { + type = lib.types.str; + example = lib.literalExpression "d1d20ae7-3d8a-44da-86da-677dbbb10c89"; + description = lib.mdDoc "The UUID of the backup disk"; + }; + }; + config = lib.mkIf cfg.enable { + systemd = { + services.backup = { + wantedBy = lib.mkForce []; + unitConfig = { + Description = "Backup the last snapshots of the persitent-storage subvolume."; + }; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${backup-script}/bin/backsnap"; + }; + }; + timers.backup = { + wantedBy = ["timers.target"]; + unitConfig = { + Description = "Backup 15min after boot and every 8 hours"; + }; + timerConfig = { + OnBootSec = "15min"; + OnUnitActiveSec = "8h"; + }; + }; + }; + }; +} diff --git a/sys/svcs/backup/snap-sync-forked b/sys/svcs/backup/snap-sync-forked new file mode 100755 index 00000000..a66f31ae --- /dev/null +++ b/sys/svcs/backup/snap-sync-forked @@ -0,0 +1,529 @@ +#!/usr/bin/env bash +# snap-sync +# https://github.com/wesbarnett/snap-sync +# Copyright (C) 2016-2021 Wes Barnett + +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; either version 2 of the License, or +# (at your option) any later version. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. + +# You should have received a copy of the GNU General Public License along +# with this program; if not, write to the Free Software Foundation, Inc., + +# ------------------------------------------------------------------------- + +# Takes snapshots of each snapper configuration. It then sends the snapshot to +# a location on an external drive. After the initial transfer, it does +# incremental snapshots on later calls. It's important not to delete the +# snapshot created on your system since that will be used to determine the +# difference for the next incremental snapshot. + +set -o errtrace + +version="0.7" +name="snap-sync" + +printf "\nsnap-sync version %s, Copyright (C) 2016-2021 Wes Barnett\n" "$version" +printf "snap-sync comes with ABSOLUTELY NO WARRANTY. This is free software, and you are welcome to redistribute it under certain conditions. See the license for more information. \n\n" + +# The following line is modified by the Makefile or +# find_snapper_config script +SNAPPER_CONFIG=/etc/sysconfig/snapper + +donotify=0 +if ! command -v notify-send &> /dev/null; then + donotify=1 +fi + +doprogress=0 +if ! command -v pv &> /dev/null; then + doprogress=1 +fi + +error() { + printf "==> ERROR: %s\n" "$@" + notify_error 'Error' 'Check journal for more information.' +} >&2 + +die() { + error "$@" + exit 1 +} + +traperror() { + printf "Exited due to error on line %s.\n" "$1" + printf "exit status: %s\n" "$2" + printf "command: %s\n" "$3" + printf "bash line: %s\n" "$4" + printf "function name: %s\n" "$5" + exit 1 +} + +trapkill() { + die "Exited due to user intervention." +} + +trap 'traperror ${LINENO} $? "$BASH_COMMAND" $BASH_LINENO "${FUNCNAME[@]}"' ERR +trap trapkill SIGTERM SIGINT + +usage() { + cat <<EOF +$name $version +Usage: $name [options] + +Options: + -c, --config <config> snapper configuration to backup + -d, --description <desc> snapper description + -h, --help print this message + -n, --noconfirm do not ask for confirmation + -k, --keepold keep old incremental snapshots instead of deleting them + after backup is performed + -p, --port <port> remote port; used with '--remote'. + -q, --quiet do not send notifications; instead print them. + -r, --remote <address> ip address of a remote machine to backup to + --sudo use sudo on the remote machine + -s, --subvolid <subvlid> subvolume id of the mounted BTRFS subvolume to back up to + -u, --UUID <UUID> UUID of the mounted BTRFS subvolume to back up to + +See 'man snap-sync' for more details. +EOF +} + +ssh="" +sudo=0 +while [[ $# -gt 0 ]]; do + key="$1" + case $key in + -d|--description) + description="$2" + shift 2 + ;; + -c|--config) + selected_configs="$2" + shift 2 + ;; + -u|--UUID) + uuid_cmdline="$2" + shift 2 + ;; + -s|--subvolid) + subvolid_cmdline="$2" + shift 2 + ;; + -k|--keepold) + keep="yes" + shift + ;; + -n|--noconfirm) + noconfirm="yes" + shift + ;; + -h|--help) + usage + exit 1 + ;; + -q|--quiet) + donotify=1 + shift + ;; + -r|--remote) + remote=$2 + shift 2 + ;; + -p|--port) + port=$2 + shift 2 + ;; + --sudo) + sudo=1 + shift + ;; + *) + die "Unknown option: '$key'. Run '$name -h' for valid options." + ;; + esac +done + +notify() { + for u in $(users | tr ' ' '\n' | sort -u); do + sudo -u "$u" DISPLAY=:0 \ + DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$(sudo -u "$u" id -u)/bus" \ + notify-send -a $name "$1" "$2" --icon="dialog-$3" + done +} + +notify_info() { + if [[ $donotify -eq 0 ]]; then + notify "$1" "$2" "information" + else + printf '%s\n' "$1: $2" + fi +} + +notify_error() { + if [[ $donotify -eq 0 ]]; then + notify "$1" "$2" "error" + else + printf '%s\n' "$1: $2" + fi +} + +[[ $EUID -ne 0 ]] && die "Script must be run as root. See '$name -h' for a description of options" +! [[ -f $SNAPPER_CONFIG ]] && die "$SNAPPER_CONFIG does not exist." + +description=${description:-"latest incremental backup"} +uuid_cmdline=${uuid_cmdline:-"none"} +subvolid_cmdline=${subvolid_cmdline:-"5"} +noconfirm=${noconfirm:-"no"} + +if [[ -z $remote ]]; then + if ! command -v rsync &> /dev/null; then + die "--remote specified but rsync command not found" + fi +fi + +if [[ "$uuid_cmdline" != "none" ]]; then + if [[ -z $remote ]]; then + notify_info "Backup started" "Starting backups to $uuid_cmdline subvolid=$subvolid_cmdline..." + else + notify_info "Backup started" "Starting backups to $uuid_cmdline subvolid $subvolid_cmdline at $remote..." + fi +else + if [[ -z $remote ]]; then + notify_info "Backup started" "Starting backups. Use command line menu to select disk." + else + notify_info "Backup started" "Starting backups. Use command line menu to select disk on $remote." + fi +fi + +if [[ -n $remote ]]; then + ssh="ssh $remote" + if [[ -n $port ]]; then + ssh="$ssh -p $port" + fi + if [[ $sudo -eq 1 ]]; then + ssh="$ssh sudo" + fi +fi + +if [[ "$($ssh findmnt -n -v --target / -o FSTYPE)" == "btrfs" ]]; then + EXCLUDE_UUID=$($ssh findmnt -n -v -t btrfs --target / -o UUID) + TARGETS=$($ssh findmnt -n -v -t btrfs -o UUID,TARGET --list | grep -v "$EXCLUDE_UUID" | awk '{print $2}') + UUIDS=$($ssh findmnt -n -v -t btrfs -o UUID,TARGET --list | grep -v "$EXCLUDE_UUID" | awk '{print $1}') +else + TARGETS=$($ssh findmnt -n -v -t btrfs -o TARGET --list) + UUIDS=$($ssh findmnt -n -v -t btrfs -o UUID --list) +fi + +declare -a TARGETS_ARRAY +declare -a UUIDS_ARRAY +declare -a SUBVOLIDS_ARRAY + +i=0 +for x in $TARGETS; do + SUBVOLIDS_ARRAY[$i]=$($ssh btrfs subvolume show "$x" | awk '/Subvolume ID:/ { print $3 }') + TARGETS_ARRAY[$i]=$x + i=$((i+1)) +done + +i=0 +disk=-1 +disk_count=0 +for x in $UUIDS; do + UUIDS_ARRAY[$i]=$x + if [[ "$x" == "$uuid_cmdline" && ${SUBVOLIDS_ARRAY[$((i))]} == "$subvolid_cmdline" ]]; then + disk=$i + disk_count=$((disk_count+1)) + fi + i=$((i+1)) +done + +if [[ "${#UUIDS_ARRAY[$@]}" -eq 0 ]]; then + die "No external btrfs subvolumes found to backup to. Run '$name -h' for more options." +fi + +if [[ "$disk_count" -gt 1 ]]; then + printf "Multiple mount points were found with UUID %s and subvolid %s.\n" "$uuid_cmdline" "$subvolid_cmdline" + disk="-1" +fi + +if [[ "$disk" == -1 ]]; then + if [[ "$disk_count" == 0 && "$uuid_cmdline" != "none" ]]; then + error "A device with UUID $uuid_cmdline and subvolid $subvolid_cmdline was not found to be mounted, or it is not a BTRFS device." + fi + if [[ -z $ssh ]]; then + printf "Select a mounted BTRFS device on your local machine to backup to.\nFor more options, exit and run '%s -h'.\n" "$name" + else + printf "Select a mounted BTRFS device on %s to backup to.\nFor more options, exit and run '%s -h'.\n" "$remote" "$name" + fi + while [[ $disk -lt 0 || $disk -gt $i ]]; do + for x in "${!TARGETS_ARRAY[@]}"; do + printf "%4s) %s (uuid=%s, subvolid=%s)\n" "$((x+1))" "${TARGETS_ARRAY[$x]}" "${UUIDS_ARRAY[$x]}" "${SUBVOLIDS_ARRAY[$x]}" + done + printf "%4s) Exit\n" "0" + read -e -r -p "Enter a number: " disk + if ! [[ $disk == ?(-)+([0-9]) ]] || [[ $disk -lt 0 || $disk -gt $i ]]; then + printf "\nNo disk selected. Select a disk to continue.\n" + disk=-1 + fi + done + if [[ $disk == 0 ]]; then + exit 0 + fi + disk=$((disk-1)) +fi + +selected_subvolid="${SUBVOLIDS_ARRAY[$((disk))]}" +selected_uuid="${UUIDS_ARRAY[$((disk))]}" +selected_mnt="${TARGETS_ARRAY[$((disk))]}" +printf "\nYou selected the disk with uuid=%s, subvolid=%s.\n" "$selected_uuid" "$selected_subvolid" +if [[ -z $ssh ]]; then + printf "The disk is mounted at '%s'.\n" "$selected_mnt" +else + printf "The disk is mounted at '%s:%s'.\n" "$remote" "$selected_mnt" +fi + +# shellcheck source=/etc/default/snapper +source "$SNAPPER_CONFIG" + +if [[ -z $selected_configs ]]; then + printf "\nInteractively cycling through all snapper configurations...\n" +fi +selected_configs=${selected_configs:-$SNAPPER_CONFIGS} + +declare -a BACKUPDIRS_ARRAY +declare -a MYBACKUPDIR_ARRAY +declare -a OLD_NUM_ARRAY +declare -a OLD_SNAP_ARRAY +declare -a NEW_NUM_ARRAY +declare -a NEW_SNAP_ARRAY +declare -a NEW_INFO_ARRAY +declare -a BACKUPLOC_ARRAY +declare -a CONT_BACKUP_ARRAY + +# Initial configuration of where backup directories are +i=0 +for x in $selected_configs; do + + if [[ "$(snapper -c "$x" list --disable-used-space -t single | awk '/'"subvolid=$selected_subvolid, uuid=$selected_uuid"'/ {cnt++} END {print cnt}')" -gt 1 ]]; then + error "More than one snapper entry found with UUID $selected_uuid subvolid $selected_subvolid for configuration $x. Skipping configuration $x." + continue + fi + + if [[ "$(snapper -c "$x" list --disable-used-space -t single | awk '/'$name' backup in progress/ {cnt++} END {print cnt}')" -gt 0 ]]; then + printf "\nNOTE: Previous failed %s backup snapshots found for '%s'.\n" "$name" "$x" + if [[ $noconfirm == "yes" ]]; then + printf "'noconfirm' option passed. Failed backups will not be deleted.\n" + else + read -e -r -p "Delete failed backup snapshot(s)? (These local snapshots from failed backups are not used.) [y/N]? " delete_failed + while [[ -n "$delete_failed" && "$delete_failed" != [Yy]"es" && + "$delete_failed" != [Yy] && "$delete_failed" != [Nn]"o" && + "$delete_failed" != [Nn] ]]; do + read -e -r -p "Delete failed backup snapshot(s)? (These local snapshots from failed backups are not used.) [y/N] " delete_failed + if [[ -n "$delete_failed" && "$delete_failed" != [Yy]"es" && + "$delete_failed" != [Yy] && "$delete_failed" != [Nn]"o" && + "$delete_failed" != [Nn] ]]; then + printf "Select 'y' or 'N'.\n" + fi + done + if [[ "$delete_failed" == [Yy]"es" || "$delete_failed" == [Yy] ]]; then + # explicit split list of snapshots (on whitespace) into multiple arguments + # shellcheck disable=SC2046 + snapper -c "$x" delete $(snapper -c "$x" list --disable-used-space | awk '/'$name' backup in progress/ {print $1}') + fi + fi + fi + + SNAP_SYNC_EXCLUDE=no + + if [[ -f "/etc/snapper/configs/$x" ]]; then + # shellcheck source=/etc/snapper/config-templates/default + source "/etc/snapper/configs/$x" + else + die "Selected snapper configuration $x does not exist." + fi + + if [[ $SNAP_SYNC_EXCLUDE == "yes" ]]; then + continue + fi + + printf "\n" + + old_num=$(snapper -c "$x" list --disable-used-space -t single | awk '/'"subvolid=$selected_subvolid, uuid=$selected_uuid"'/ {print $1}') + old_snap=$SUBVOLUME/.snapshots/$old_num/snapshot + + OLD_NUM_ARRAY[$i]=$old_num + OLD_SNAP_ARRAY[$i]=$old_snap + + if [[ -z "$old_num" ]]; then + printf "No backups have been performed for '%s' on this disk.\n" "$x" + read -e -r -p "Enter name of subvolume to store backups, relative to $selected_mnt (to be created if not existing): " mybackupdir + printf "This will be the initial backup for snapper configuration '%s' to this disk. This could take awhile.\n" "$x" + BACKUPDIR="$selected_mnt/$mybackupdir" + $ssh test -d "$BACKUPDIR" || $ssh btrfs subvolume create "$BACKUPDIR" + else + mybackupdir=$(snapper -c "$x" list --disable-used-space -t single | awk -F"|" '/'"subvolid=$selected_subvolid, uuid=$selected_uuid"'/ {print $5}' | awk -F "," '/backupdir/ {print $1}' | awk -F"=" '{print $2}') + BACKUPDIR="$selected_mnt/$mybackupdir" + $ssh test -d "$BACKUPDIR" || die "%s is not a directory on %s.\n" "$BACKUPDIR" "$selected_uuid" + fi + BACKUPDIRS_ARRAY[$i]="$BACKUPDIR" + MYBACKUPDIR_ARRAY[$i]="$mybackupdir" + + printf "Creating new local snapshot for '%s' configuration...\n" "$x" + new_num=$(snapper -c "$x" create --print-number -d "$name backup in progress") + new_snap=$SUBVOLUME/.snapshots/$new_num/snapshot + new_info=$SUBVOLUME/.snapshots/$new_num/info.xml + sync + backup_location=$BACKUPDIR/$x/$new_num/ + if [[ -z $ssh ]]; then + printf "Will backup %s to %s\n" "$new_snap" "$backup_location/snapshot" + else + printf "Will backup %s to %s\n" "$new_snap" "$remote":"$backup_location/snapshot" + fi + + if ($ssh test -d "$backup_location/snapshot") ; then + printf "WARNING: Backup directory '%s' already exists. This configuration will be skipped!\n" "$backup_location/snapshot" + printf "Move or delete destination directory and try backup again.\n" + fi + + NEW_NUM_ARRAY[$i]="$new_num" + NEW_SNAP_ARRAY[$i]="$new_snap" + NEW_INFO_ARRAY[$i]="$new_info" + BACKUPLOC_ARRAY[$i]="$backup_location" + + cont_backup="K" + CONT_BACKUP_ARRAY[$i]="yes" + if [[ $noconfirm == "yes" ]]; then + cont_backup="yes" + else + while [[ -n "$cont_backup" && "$cont_backup" != [Yy]"es" && + "$cont_backup" != [Yy] && "$cont_backup" != [Nn]"o" && + "$cont_backup" != [Nn] ]]; do + read -e -r -p "Proceed with backup of '$x' configuration [Y/n]? " cont_backup + if [[ -n "$cont_backup" && "$cont_backup" != [Yy]"es" && + "$cont_backup" != [Yy] && "$cont_backup" != [Nn]"o" && + "$cont_backup" != [Nn] ]]; then + printf "Select 'Y' or 'n'.\n" + fi + done + fi + + if [[ "$cont_backup" != [Yy]"es" && "$cont_backup" != [Yy] && -n "$cont_backup" ]]; then + CONT_BACKUP_ARRAY[$i]="no" + printf "Not backing up '%s' configuration.\n" "$x" + snapper -c "$x" delete "$new_num" + fi + + i=$((i+1)) + +done + +# Actual backing up +printf "\nPerforming backups...\n" +i=-1 +for x in $selected_configs; do + + i=$((i+1)) + + SNAP_SYNC_EXCLUDE=no + + if [[ -f "/etc/snapper/configs/$x" ]]; then + # shellcheck source=/etc/snapper/config-templates/default + source "/etc/snapper/configs/$x" + else + die "Selected snapper configuration $x does not exist." + fi + + cont_backup=${CONT_BACKUP_ARRAY[$i]} + if [[ $cont_backup == "no" || $SNAP_SYNC_EXCLUDE == "yes" ]]; then + notify_info "Backup in progress" "NOTE: Skipping $x configuration." + continue + fi + + notify_info "Backup in progress" "Backing up $x configuration." + + printf "\n" + + old_num="${OLD_NUM_ARRAY[$i]}" + old_snap="${OLD_SNAP_ARRAY[$i]}" + BACKUPDIR="${BACKUPDIRS_ARRAY[$i]}" + mybackupdir="${MYBACKUPDIR_ARRAY[$i]}" + new_num="${NEW_NUM_ARRAY[$i]}" + new_snap="${NEW_SNAP_ARRAY[$i]}" + new_info="${NEW_INFO_ARRAY[$i]}" + backup_location="${BACKUPLOC_ARRAY[$i]}" + + if ($ssh test -d "$backup_location/snapshot") ; then + printf "ERROR: Backup directory '%s' already exists. Skipping backup of this configuration!\n" "$backup_location/snapshot" + continue + fi + + $ssh mkdir -p "$backup_location" + + if [[ -z "$old_num" ]]; then + printf "Sending first snapshot for '%s' configuration...\n" "$x" + if [[ $doprogress -eq 0 ]]; then + btrfs send "$new_snap" | pv | $ssh btrfs receive "$backup_location" &>/dev/null + else + btrfs send "$new_snap" | $ssh btrfs receive "$backup_location" &>/dev/null + fi + else + + printf "Sending incremental snapshot for '%s' configuration...\n" "$x" + # Sends the difference between the new snapshot and old snapshot to the + # backup location. Using the -c flag instead of -p tells it that there + # is an identical subvolume to the old snapshot at the receiving + # location where it can get its data. This helps speed up the transfer. + + if [[ $doprogress -eq 0 ]]; then + btrfs send -c "$old_snap" "$new_snap" | pv | $ssh btrfs receive "$backup_location" + else + btrfs send -c "$old_snap" "$new_snap" | $ssh btrfs receive "$backup_location" + fi + + if [[ $keep == "yes" ]]; then + printf "Modifying data for old local snapshot for '%s' configuration...\n" "$x" + snapper -v -c "$x" modify -d "old snap-sync snapshot (you may remove)" -u "backupdir=,subvolid=,uuid=" -c "number" "$old_num" + else + printf "Deleting old snapshot for %s...\n" "$x" + snapper -c "$x" delete "$old_num" + fi + + fi + + if [[ -z $remote ]]; then + cp "$new_info" "$backup_location" + else + if [[ -z $port ]]; then + rsync -avzq "$new_info" "$remote":"$backup_location" + else + rsync -avzqe "ssh -p $port" "$new_info" "$remote":"$backup_location" + fi + fi + + # It's important not to change this userdata in the snapshots, since that's how + # we find the previous one. + + userdata="backupdir=$mybackupdir, subvolid=$selected_subvolid, uuid=$selected_uuid" + + # Tag new snapshot as the latest + printf "Tagging local snapshot as latest backup for '%s' configuration...\n" "$x" + snapper -v -c "$x" modify -d "$description" -u "$userdata" "$new_num" + + printf "Backup complete for '%s' configuration.\n" "$x" + +done + +printf "\nDone!\n" + +if [[ "$uuid_cmdline" != "none" ]]; then + notify_info "Finished" "Backups to $uuid_cmdline complete!" +else + notify_info "Finished" "Backups complete!" +fi diff --git a/sys/svcs/dconf/default.nix b/sys/svcs/dconf/default.nix new file mode 100644 index 00000000..db35208e --- /dev/null +++ b/sys/svcs/dconf/default.nix @@ -0,0 +1,10 @@ +{ + config, + lib, + pkgs, + ... +}: { + # needed to make home-manager play nice with some apps. See: + # https://nix-community.github.io/home-manager/index.html#_why_do_i_get_an_error_message_about_literal_ca_desrt_dconf_literal_or_literal_dconf_service_literal + programs.dconf.enable = true; +} diff --git a/sys/svcs/default.nix b/sys/svcs/default.nix new file mode 100644 index 00000000..c4b95394 --- /dev/null +++ b/sys/svcs/default.nix @@ -0,0 +1,17 @@ +{...}: { + imports = [ + ./backup + ./dconf + ./fwupd + ./nix + ./openssh + ./postgresql + ./printing + ./scanning + #./serverphone + ./snapper + ./steam + ./swaylock + ./xdg + ]; +} diff --git a/sys/svcs/fwupd/default.nix b/sys/svcs/fwupd/default.nix new file mode 100644 index 00000000..999ca72b --- /dev/null +++ b/sys/svcs/fwupd/default.nix @@ -0,0 +1,3 @@ +{...}: { + services.fwupd.enable = true; +} diff --git a/sys/svcs/nix/default.nix b/sys/svcs/nix/default.nix new file mode 100644 index 00000000..97b7220d --- /dev/null +++ b/sys/svcs/nix/default.nix @@ -0,0 +1,39 @@ +{ + pkgs, + nixpkgs_as_input, + templates, + ... +}: let + nixpkgs = nixpkgs_as_input; +in { + nix = { + package = pkgs.nixStable; + + registry = { + nixpkgs.flake = nixpkgs; + n.flake = nixpkgs; + t.flake = templates; + }; + + gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 7d"; + }; + settings = { + auto-optimise-store = true; + experimental-features = [ + "nix-command" + "flakes" + #"ca-derivations" + ]; + + #substituters = ["https://cache.ngi0.nixos.org/"]; + #trusted-public-keys = ["cache.ngi0.nixos.org-1:KqH5CBLNSyX184S9BKZJo1LxrxJ9ltnY2uAs5c/f1MA="]; + fallback = true; # TODO: what does this do? + + keep-failed = true; # keep failed tmp build dirs + pure-eval = true; # restrict file system and network access to hash + }; + }; +} diff --git a/sys/svcs/openssh/default.nix b/sys/svcs/openssh/default.nix new file mode 100644 index 00000000..b733dbe7 --- /dev/null +++ b/sys/svcs/openssh/default.nix @@ -0,0 +1,15 @@ +{...}: { + services.openssh = { + enable = true; + hostKeys = [ + { + path = "/srv/sshd/ssh_host_ed25519_key"; + rounds = 1000; + type = "ed25519"; + } + ]; + settings = { + PasswordAuthentication = false; + }; + }; +} diff --git a/sys/svcs/postgresql/default.nix b/sys/svcs/postgresql/default.nix new file mode 100644 index 00000000..4fc26034 --- /dev/null +++ b/sys/svcs/postgresql/default.nix @@ -0,0 +1,5 @@ +{...}: { + services.postgresql = { + enable = false; + }; +} diff --git a/sys/svcs/printing/default.nix b/sys/svcs/printing/default.nix new file mode 100644 index 00000000..7b8a871e --- /dev/null +++ b/sys/svcs/printing/default.nix @@ -0,0 +1,26 @@ +{pkgs, ...}: { + services.avahi = { + enable = true; + nssmdns = true; + openFirewall = true; + }; + services.printing = { + enable = true; + startWhenNeeded = true; + webInterface = false; + drivers = []; + }; + hardware = { + printers = { + ensurePrinters = [ + { + name = "Brother"; + description = "Brother DCP-9022CDW"; + model = "everywhere"; + deviceUri = "ipp://BRWACD1B84F4503.local:631/ipp/print"; + } + ]; + ensureDefaultPrinter = "Brother"; + }; + }; +} diff --git a/sys/svcs/scanning/default.nix b/sys/svcs/scanning/default.nix new file mode 100644 index 00000000..6621e08f --- /dev/null +++ b/sys/svcs/scanning/default.nix @@ -0,0 +1,12 @@ +{pkgs, ...}: { + hardware = { + sane = { + enable = true; + extraBackends = [pkgs.sane-airscan]; + }; + }; + + users.users.soispha.extraGroups = [ + "scanner" # for permission to access the scanner. + ]; +} diff --git a/sys/svcs/serverphone/certificates/ca.crt b/sys/svcs/serverphone/certificates/ca.crt new file mode 100644 index 00000000..7a4ae6f9 --- /dev/null +++ b/sys/svcs/serverphone/certificates/ca.crt @@ -0,0 +1,10 @@ +-----BEGIN CERTIFICATE----- +MIIBXDCCAQOgAwIBAgIIRQ2wXiaD5pMwCgYIKoZIzj0EAwIwGTEXMBUGA1UEAwwO +U2VydmVycGhvbmUgQ0EwHhcNMjMwNjA2MTIzNzM3WhcNMzMwNjAzMTIzNzM3WjAZ +MRcwFQYDVQQDDA5TZXJ2ZXJwaG9uZSBDQTBZMBMGByqGSM49AgEGCCqGSM49AwEH +A0IABDZMtz3liWniBedisStXDO2sxFCKBH239ezH7uADu8g5peGssmNu1rXEDrg1 +sFwVUjQeJAocYYNoUeHiVpODf1ejNTAzMB0GA1UdDgQWBBST5oMmXrANRbCLIQpN +W7e5uSCL3DASBgNVHRMBAf8ECDAGAQH/AgEBMAoGCCqGSM49BAMCA0cAMEQCIFig +xA3MvRNP4uXaUEWwdP1pYL/R8N46G4NZrPEfiNV4AiA+NJSTFRCOUqEsvSb7PTFx +YuMuJF4XxWnmStz3ym7xXA== +-----END CERTIFICATE----- diff --git a/sys/svcs/serverphone/certificates/server.crt b/sys/svcs/serverphone/certificates/server.crt new file mode 100644 index 00000000..f994cdc8 --- /dev/null +++ b/sys/svcs/serverphone/certificates/server.crt @@ -0,0 +1,10 @@ +-----BEGIN CERTIFICATE----- +MIIBTjCB9KADAgECAgkAhKrdjsoiOrkwCgYIKoZIzj0EAwIwGTEXMBUGA1UEAwwO +U2VydmVycGhvbmUgQ0EwHhcNMjMwNjA2MTIzOTIwWhcNMjQwNjA1MTIzOTIwWjAm +MSQwIgYDVQQDDBtDbGllbnQgcnVubmluZyBvbiBsb2NhbGhvc3QwWTATBgcqhkjO +PQIBBggqhkjOPQMBBwNCAAS1ILQo8ae8ydqFlt5RncUT7joQiozk6Omunb0vxVz5 +toJRDmVqc1s6KhpCTipUV5coTcaK1TBz0+fft+9VH7cwoxgwFjAUBgNVHREEDTAL +gglsb2NhbGhvc3QwCgYIKoZIzj0EAwIDSQAwRgIhAN7ohtsBLrjlgmSe9ngovxZM +z61n0+/7w2mtX/OrLMWIAiEAu+D2S2o0s7E9pp2Rkug8cT5T4GCWgFgEHk5x2L/E +RVI= +-----END CERTIFICATE----- diff --git a/sys/svcs/serverphone/default.nix b/sys/svcs/serverphone/default.nix new file mode 100644 index 00000000..20125a75 --- /dev/null +++ b/sys/svcs/serverphone/default.nix @@ -0,0 +1,49 @@ +{ + config, + serverphone, + system, + lib, + ... +}: { + config = lib.mkIf config.soispha.secrets.enable { + services.serverphone = { + package = "${serverphone.packages.${system}.default}"; + enable = true; + domain = "localhost"; + configureDoas = true; + acceptedSshKeys = [ + "AAAAC3NzaC1lZDI1NTE5AAAAIGBFuTNNn71Rhfnop2cdz3r/RhWWlCePnSBOhTBbu2ME" + ]; + authorized = { + acceptedGpgKeys = [ + { + source = ./keys/key_1; + trust = "ultimate"; + } + { + source = ./keys/key_2; + trust = "ultimate"; + } + ]; + }; + caCertificate = "${./certificates/ca.crt}"; + certificate = "${./certificates/server.crt}"; + privateKey = config.age.secrets.serverphoneServer.path; + certificateRequest = { + acceptedUsers = [ + "soispha $argon2id$v=19$m=19456,t=2,p=1$EvhPENIBqL5b1RO5waNMWA$pJ8vDrCNJKDlqwB5bVDLjHVPEXm9McQhtt9OXSD8Zkc" + ]; + caPrivateKey = config.age.secrets.serverphoneCa.path; + }; + }; + + users.users.serverphone = { + group = "serverphone"; + isSystemUser = true; + home = "/run/serverphone"; + }; + users.groups.serverphone = { + members = ["serverphone"]; + }; + }; +} diff --git a/sys/svcs/serverphone/keys/key_1 b/sys/svcs/serverphone/keys/key_1 new file mode 120000 index 00000000..67720882 --- /dev/null +++ b/sys/svcs/serverphone/keys/key_1 @@ -0,0 +1 @@ +../../../../home-manager/soispha/config/gpg/keys/key_1 \ No newline at end of file diff --git a/sys/svcs/serverphone/keys/key_2 b/sys/svcs/serverphone/keys/key_2 new file mode 120000 index 00000000..24df7207 --- /dev/null +++ b/sys/svcs/serverphone/keys/key_2 @@ -0,0 +1 @@ +../../../../home-manager/soispha/config/gpg/keys/key_2 \ No newline at end of file diff --git a/sys/svcs/snapper/default.nix b/sys/svcs/snapper/default.nix new file mode 100644 index 00000000..41e4b381 --- /dev/null +++ b/sys/svcs/snapper/default.nix @@ -0,0 +1,41 @@ +{...}: { + services.snapper = { + configs = { + srv = { + SUBVOLUME = "/srv"; + FSTYPE = "btrfs"; + # users and groups allowed to work with config + ALLOW_GROUPS = ["wheel"]; + + # sync users and groups from ALLOW_USERS and ALLOW_GROUPS to .snapshots + # directory + SYNC_ACL = true; + + # run daily number cleanup + NUMBER_CLEANUP = false; + + # limit for number cleanup + NUMBER_MIN_AGE = 1800; + NUMBER_LIMIT = 50; + NUMBER_LIMIT_IMPORTANT = 10; + + # create hourly snapshots + TIMELINE_CREATE = true; + + # cleanup hourly snapshots after some time + TIMELINE_CLEANUP = true; + + # limits for timeline cleanup + TIMELINE_MIN_AGE = 1800; + TIMELINE_LIMIT_HOURLY = 7; + TIMELINE_LIMIT_DAILY = 3; + TIMELINE_LIMIT_WEEKLY = 2; + TIMELINE_LIMIT_MONTHLY = 0; + TIMELINE_LIMIT_YEARLY = 2; + + # cleanup empty pre-post-pairs + EMPTY_PRE_POST_CLEANUP = true; + }; + }; + }; +} diff --git a/sys/svcs/steam/default.nix b/sys/svcs/steam/default.nix new file mode 100644 index 00000000..54091493 --- /dev/null +++ b/sys/svcs/steam/default.nix @@ -0,0 +1,23 @@ +{ + lib, + config, + pkgs, + ... +}: let + cfg = config.soispha.services.steam; +in { + options.soispha.services.steam = { + enable = lib.mkOption { + default = false; + description = lib.mdDoc "Steam"; + }; + }; + config = lib.mkIf cfg.enable { + programs.steam = { + enable = true; + }; + environment.systemPackages = [ + pkgs.wineWowPackages.waylandFull + ]; + }; +} diff --git a/sys/svcs/swaylock/default.nix b/sys/svcs/swaylock/default.nix new file mode 100644 index 00000000..6cbcef28 --- /dev/null +++ b/sys/svcs/swaylock/default.nix @@ -0,0 +1,4 @@ +{...}: { + # otherwise swaylock can't access the user password. + security.pam.services.swaylock = {}; +} diff --git a/sys/svcs/xdg/default.nix b/sys/svcs/xdg/default.nix new file mode 100644 index 00000000..297928ce --- /dev/null +++ b/sys/svcs/xdg/default.nix @@ -0,0 +1,11 @@ +{pkgs, ...}: { + xdg = { + portal = { + enable = true; + # TODO: only enable the below, when on river (or wlr based compositor) + wlr.enable = true; + extraPortals = [pkgs.xdg-desktop-portal-wlr]; + }; + }; + # TODO: mime = {}; +} diff --git a/sys/tempfiles/default.nix b/sys/tempfiles/default.nix new file mode 100644 index 00000000..2d48b02e --- /dev/null +++ b/sys/tempfiles/default.nix @@ -0,0 +1,6 @@ +{config, ...}: { + systemd.tmpfiles.rules = [ + # this file is needed to trash stuff on the temp fs + "d /.Trash 1777 root root" # TODO: move this to the lf config + ]; +} diff --git a/sys/users/default.nix b/sys/users/default.nix new file mode 100644 index 00000000..365ffd41 --- /dev/null +++ b/sys/users/default.nix @@ -0,0 +1,44 @@ +{ + config, + pkgs, + lib, + ... +}: let + cfg = config.soispha.users; +in { + options.soispha.users = { + # enable = lib.mkEnableOption (lib.mdDoc "users"); + hashedPassword = lib.mkOption { + type = lib.types.str; + example = lib.literalExpression "$y$jFT$ONrCqZIJKB7engmfA4orD/$0GO58/wV5wrYWj0cyONhyujZPjFmbT0XKtx2AvXLG0B"; + default = "$y$jFT$ONrCqZIJKB7engmfA4orD/$0GO58/wV5wrYWj0cyONhyujZPjFmbT0XKtx2AvXLG0B"; + description = lib.mdDoc "Hashed password for the user"; + }; + }; + config = { + # I was told, that this solves some nasty problems: + programs.zsh.enable = true; + + users = { + groups = { + plugdev.members = ["soispha"]; + }; + mutableUsers = false; + users.soispha = { + isNormalUser = true; + home = "/home/soispha"; + createHome = true; + shell = pkgs.zsh; + initialHashedPassword = cfg.hashedPassword; + extraGroups = [ + "plugdev" # although deprecated, this helps with old udev rules, that still use this group. TODO: check for an open issue + "wheel" + ]; + uid = 1000; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGBFuTNNn71Rhfnop2cdz3r/RhWWlCePnSBOhTBbu2ME soispha" + ]; + }; + }; + }; +} |
