begin migration to dendritic pattern

This commit is contained in:
greyweather committed 2026-08-27 00:50:33 +01:00
1 parent 4a081aef50
commit 7245e872f6
153 files changed
+3352 -53

No files matched your search

@@ -0,0 +1,147 @@
{
pkgs,
lib,
...
}: {
programs.zsh.initContent = lib.mkOrder 1500 "fastfetch";
programs.fastfetch = {
enable = true;
settings = {
logo = {
type = "builtin";
padding = {
top = 1;
left = 2;
right = 2;
};
};
modules = [
{
type = "custom";
format = "┌────────────────── Software ──────────────────┐";
}
{
type = "title";
key = " Session";
format = "{user-name}@{host-name}";
}
{
type = "os";
key = " Distro";
format = "{pretty-name}";
}
{
type = "host";
key = " Device";
format = "{version}";
}
{
type = "kernel";
key = " Kernel";
}
{
type = "shell";
key = " Shell";
}
{
type = "terminal";
key = " Terminal";
}
{
type = "wm";
key = " WM";
}
{
type = "custom";
format = "└──────────────────────────────────────────────┘";
}
"break"
{
type = "custom";
format = "┌────────────────── Hardware ──────────────────┐";
}
{
type = "cpu";
key = " CPU";
format = "{name}";
}
{
type = "memory";
key = " RAM";
percent = {
green = 50;
yellow = 80;
type = 0;
};
}
{
type = "swap";
key = " Swap";
percent = {
green = 50;
yellow = 80;
type = 0;
};
separate = false;
}
{
type = "disk";
key = " Disk";
showRegular = true;
showExternal = false;
showHidden = false;
showSubvolumes = false;
showReadOnly = true;
ShowUnknown = false;
hideFolders = "/efi:/boot:/boot/*:/run/media/*";
useAvailable = false;
percent = {
green = 50;
yellow = 80;
type = 0;
};
}
{
type = "localip";
key = " IP";
showIpv4 = true;
showIpv6 = false;
showMac = false;
showLoop = false;
showPrefixLen = true;
showMtu = false;
showSpeed = false;
showFlags = false;
compact = false;
defaultRouteOnly = true;
showAllIps = false;
}
{
type = "custom";
format = "└──────────────────────────────────────────────┘";
}
"break"
{
type = "custom";
format = "┌──────────────── Age + Uptime ────────────────┐";
}
{
type = "disk";
key = " OS Age";
folders = "/";
format = "{create-time:10} ({days} days)";
}
{
type = "uptime";
key = " Uptime";
}
{
type = "custom";
format = "└──────────────────────────────────────────────┘";
}
];
};
};
}
@@ -0,0 +1,8 @@
{
pkgs,
config,
lib,
...
}: {
programs.zsh.initContent = lib.mkOrder 1500 "${pkgs.fetch}/bin/fetch";
}
@@ -0,0 +1,21 @@
{
config,
pkgs,
inputs,
...
}: {
imports = [
inputs.nix-flatpak.homeManagerModules.nix-flatpak
];
services.flatpak = {
enable = true;
packages = [
"com.github.tchx84.Flatseal"
];
update.auto = {
enable = true;
onCalendar = "05:00";
};
};
}
@@ -0,0 +1,16 @@
{
pkgs,
config,
lib,
...
}: {
programs.kitty = {
enable = true;
font = lib.mkForce {
name = "Iosevka Comfy";
package = pkgs.iosevka-comfy.comfy;
size = 12;
};
};
}
+14
View File
@@ -0,0 +1,14 @@
{
config,
pkgs,
...
}: {
programs.zsh.shellAliases = {
wake-takamaki = "ssh sakamoto .local/bin/wake-takamaki";
shutdown-takamaki = "ssh takamaki universal-shutdown";
reboot-takamaki = "ssh takamaki universal-reboot";
switch-takamaki-os = "ssh takamaki switch-os";
apply-config = "zsh -c 'cd /home/grey/nixos; git add .; nh os switch .'";
update-system = "zsh -c 'cd /home/grey/nixos; git add .; nh os switch -u .'";
};
}
+82
View File
@@ -0,0 +1,82 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{
config,
pkgs,
...
}: let
modules-dir = ../../modules;
in {
imports = [
../../global-default.nix
./hardware-configuration.nix
"${modules-dir}/zsh.nix"
"${modules-dir}/display-managers/ly.nix"
"${modules-dir}/window-managers/niri.nix"
"${modules-dir}/nautilus.nix"
./modules/hardware-fixes.nix
./modules/plymouth.nix
];
nix.buildMachines = [
{
hostName = "nixremote";
systems = [ "x86_64-linux" "i686-linux" ];
protocol = "ssh-ng";
maxJobs = 250;
speedFactor = 1000;
supportedFeatures = [ "benchmark" "kvm" "big-parallel" ];
}
];
nix.distributedBuilds = true;
nix.settings.builders-use-substitutes = true;
services.blueman.enable = true;
services.tailscale = {
enable = true;
openFirewall = true;
};
environment.systemPackages = with pkgs; [
github-desktop
moonlight-qt
];
hardware.steam-hardware.enable = true;
boot = {
# Enable "Silent boot"
consoleLogLevel = 3;
initrd.verbose = false;
kernelParams = [
"quiet"
"rd.udev.log_level=3"
"rd.systemd.show_status=auto"
];
loader.limine = {
enable = true;
maxGenerations = 10;
};
};
stylix.enable = true;
stylix.image = ../../assets/wallpapers/kitagawa.jpg;
stylix.polarity = "dark";
# List services that you want to enable:
# Enable the OpenSSH daemon.
# services.openssh.enable = true;
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
}
@@ -0,0 +1,45 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "uas" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/b17296df-a72e-4b9d-a3b6-54fc0c97c685";
fsType = "btrfs";
};
fileSystems."/home" =
{ device = "/dev/disk/by-uuid/b17296df-a72e-4b9d-a3b6-54fc0c97c685";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/nix" =
{ device = "/dev/disk/by-uuid/b17296df-a72e-4b9d-a3b6-54fc0c97c685";
fsType = "btrfs";
options = [ "subvol=nix" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/68F7-4D8F";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices =
[ { device = "/dev/disk/by-uuid/e85559e0-a039-4178-929a-8c5ec0328b64"; }
];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
+119
View File
@@ -0,0 +1,119 @@
{
config,
pkgs,
inputs,
lib,
...
}: let
global-configs = ../../global-configs;
in {
imports = [
../../global-home.nix
"${global-configs}/zsh.nix"
"${global-configs}/kitty.nix"
"${global-configs}/floorp.nix"
"${global-configs}/vscode.nix"
#"${global-configs}/gnome.nix"
"${global-configs}/equibop.nix"
"${global-configs}/spicetify.nix"
"${global-configs}/niri.nix"
./configs/kitty.nix
./configs/fastfetch.nix
#./configs/fetch.nix
./configs/zsh.nix
];
home.packages = with pkgs; [
obsidian
thunderbird
jetbrains.clion
jetbrains.idea
proton-vpn
ente-auth
signal-desktop
xarchiver
kdePackages.filelight
remmina
freerdp
loupe
];
stylix.targets.floorp.profileNames = [ "default" ];
dconf.settings = {
"org/gnome/desktop/interface" = {
color-scheme = "prefer-dark";
};
};
gtk = {
enable = true;
gtk3.bookmarks = [
"file:///home/grey/nixos NixOS"
"file:///home/grey/Downloads Downloads"
"file:///home/grey/Documents Documents"
"file:///home/grey/Pictures Pictures"
"file:///home/grey/Music Music"
"file:///home/grey/Videos Videos"
"file:/// Root"
];
};
services.udiskie = {
enable = true;
settings = {
# workaround for
# https://github.com/nix-community/home-manager/issues/632
program_options = {
# replace with your favorite file manager
file_manager = "${pkgs.nautilus}/bin/nautilus";
};
};
};
xdg = {
enable = true;
mimeApps.defaultApplications = {
"x-scheme-handler/x-github-client" = [ "github-desktop.desktop" ];
"x-scheme-handler/x-github-desktop-dev-auth" = [ "github-desktop.desktop" ];
"x-scheme-handler/http" = [ "floorp.desktop" ];
"text/html" = [ "floorp.desktop" ];
"application/xhtml+xml" = [ "floorp.desktop" ];
"x-scheme-handler/https" = [ "floorp.desktop" ];
"text/calendar" = [ "thunderbird.desktop" ];
};
};
programs.ssh = {
settings = {
"takamaki" = {
HostName = "greyweather.dev";
Port = "2222";
User = "grey";
IdentityFile = "~/.ssh/id_takamaki";
};
"sakamoto" = {
HostName = "greyweather.dev";
Port = "22";
User = "grey";
IdentityFile = "~/.ssh/id_sakamoto";
};
"nixremote" = {
HostName = "greyweather.dev";
Port = "2222";
User = "nixremote";
IdentityFile = "~/.ssh/id_takamaki";
};
};
};
home.activation = {
linkRemminaPresets = lib.hm.dag.entryAfter ["writeBoundary"] ''
#!/bin/bash
if [ -d /home/grey/.local/share/remmina ]; then
rm -rf /home/grey/.local/share/remmina
fi
ln -s /home/grey/nixos/assets/dotfiles/remmina-presets /home/grey/.local/share/remmina
'';
};
}
@@ -0,0 +1,36 @@
{
pkgs,
config,
...
}: {
systemd.sleep.settings.Sleep = {
AllowSuspend = "no";
AllowHibernation = "yes";
};
services.logind.settings.Login.HandleLidSwitch = "ignore";
systemd.services.disable-lid-wakeup = {
wantedBy = [ "multi-user.target" ];
description = "Prevent the lid switch from waking laptop from hibernation";
serviceConfig = {
Type = "simple";
User = "root";
ExecStart = "/bin/sh -c \"if [ \\\"$(cat /proc/acpi/wakeup | grep 'LID' | grep 'enabled')\\\" != \\\"\\\" ]; then echo LID > /proc/acpi/wakeup; fi\"";
};
};
systemd.services.disable-tty-switch = {
wantedBy = [ "multi-user.target" ];
description = "Prevent alt+arrow keys from switching tty";
serviceConfig = {
Type = "simple";
User = "root";
ExecStart = "/bin/sh -c \"${pkgs.kbd}/bin/dumpkeys -k|grep -v Incr_Console|grep -v Decr_Console|${pkgs.kbd}/bin/loadkeys\"";
};
};
services.fprintd.enable = true;
services.iio-niri.enable = true;
}
@@ -0,0 +1,19 @@
{
pkgs,
config,
...
}: let
plymouthTheme = "double";
in {
stylix.targets.plymouth.enable = false;
boot.plymouth = {
enable = true;
theme = plymouthTheme;
themePackages = with pkgs; [
(adi1090x-plymouth-themes.override {
selected_themes = [ plymouthTheme ];
})
];
};
}
@@ -0,0 +1,18 @@
{
pkgs,
config,
lib,
...
}: {
services.easyeffects.enable = true;
home.activation = {
linkEasyEffectsDb = lib.hm.dag.entryAfter ["writeBoundary"] ''
#!/bin/bash
if [ -d /home/grey/.config/easyeffects/db ]; then
rm -rf /home/grey/.config/easyeffects/db
fi
ln -s /home/grey/nixos/assets/dotfiles/takamaki/easyeffects-config /home/grey/.config/easyeffects/db
'';
};
}
@@ -0,0 +1,164 @@
{
pkgs,
lib,
...
}: {
programs.zsh.initContent = lib.mkOrder 1500 ''
SESSION_TYPE=local
if [ -n "$SSH_CLIENT" ] || [ -n "$SSH_TTY" ]; then
SESSION_TYPE=remote/ssh
# many other tests omitted
else
case $(ps -o comm= -p "$PPID") in
sshd|*/sshd) SESSION_TYPE=remote/ssh;;
esac
fi
if [ $SESSION_TYPE != remote/ssh ]; then
fastfetch
fi
'';
programs.fastfetch = {
enable = true;
settings = {
logo = {
source = "/home/grey/nixos/assets/jiji.jpg";
width = 30;
padding = {
top = 1;
left = 2;
right = 2;
};
};
modules = [
{
type = "custom";
format = "┌────────────────── Software ──────────────────┐";
}
{
type = "title";
key = " Session";
format = "{user-name}@{host-name}";
}
{
type = "os";
key = " Distro";
format = "{pretty-name}";
}
{
type = "kernel";
key = " Kernel";
}
{
type = "shell";
key = " Shell";
}
{
type = "terminal";
key = " Terminal";
}
{
type = "de";
key = " DE";
}
{
type = "custom";
format = "└──────────────────────────────────────────────┘";
}
"break"
{
type = "custom";
format = "┌────────────────── Hardware ──────────────────┐";
}
{
type = "cpu";
key = " CPU";
format = "{name}";
}
{
type = "gpu";
key = " GPU";
temp = false;
hideType = "integrated";
format = "{name}";
}
{
type = "memory";
key = " RAM";
percent = {
green = 50;
yellow = 80;
type = 0;
};
}
{
type = "swap";
key = " Swap";
percent = {
green = 50;
yellow = 80;
type = 0;
};
separate = false;
}
{
type = "disk";
key = " Disk";
showRegular = true;
showExternal = false;
showHidden = false;
showSubvolumes = false;
showReadOnly = true;
ShowUnknown = false;
hideFolders = "/efi:/boot:/boot/*:/run/media/*";
useAvailable = false;
percent = {
green = 50;
yellow = 80;
type = 0;
};
}
{
type = "localip";
key = " IP";
showIpv4 = true;
showIpv6 = false;
showMac = false;
showLoop = false;
showPrefixLen = true;
showMtu = false;
showSpeed = false;
showFlags = false;
compact = false;
defaultRouteOnly = true;
showAllIps = false;
}
{
type = "custom";
format = "└──────────────────────────────────────────────┘";
}
"break"
{
type = "custom";
format = "┌──────────────── Age / Uptime ────────────────┐";
}
{
type = "disk";
key = " OS Age";
folders = "/";
format = "{create-time:10} ({days} days)";
}
{
type = "uptime";
key = " Uptime";
}
{
type = "custom";
format = "└──────────────────────────────────────────────┘";
}
];
};
};
}
@@ -0,0 +1,32 @@
{
config,
pkgs,
inputs,
...
}: {
imports = [
inputs.nix-flatpak.homeManagerModules.nix-flatpak
];
services.flatpak = {
enable = true;
packages = [
"com.github.tchx84.Flatseal"
rec {
appId = "com.hypixel.HytaleLauncher";
sha256 = "sha256-Fno5t0dztF23+/KldnSC2GYSmFbnGW3aFsZQdJ8HIfY=";
bundle = "${pkgs.fetchurl {
url = "https://launcher.hytale.com/builds/release/linux/amd64/hytale-launcher-latest.flatpak";
inherit sha256;
}}";
}
"com.valvesoftware.Steam"
"org.vinegarhq.Sober"
"org.freedesktop.Platform.VulkanLayer.gamescope//25.08"
];
update.auto = {
enable = true;
onCalendar = "05:00";
};
};
}
@@ -0,0 +1,12 @@
{
pkgs,
...
}: {
imports = [
../../../global-configs/kitty.nix
];
programs.kitty = {
themeFile = "Arthur";
};
}
+93
View File
@@ -0,0 +1,93 @@
{
config,
pkgs,
inputs,
pkgs-mesa-overlay,
...
}: let
modules-dir = ../../modules;
in {
imports = [
# inputs.nixos-millennium.nixosModules.default
../../global-default.nix
./hardware-configuration.nix
"${modules-dir}/display-managers/sddm.nix"
"${modules-dir}/desktop-environments/plasma6.nix"
"${modules-dir}/zsh.nix"
./modules/openssh.nix
./modules/sudo.nix
./modules/remote-builder.nix
./modules/virt-manager.nix
];
nixpkgs.overlays = [
inputs.nix-cachyos-kernel.overlays.pinned
/*(final: prev: {
mesa = pkgs-mesa-overlay.mesa;
})*/
];
# boot.kernelPackages = pkgs.cachyosKernels.linuxPackages-cachyos-bore-zen4;
environment.systemPackages = with pkgs; [
efibootmgr
iptables
ipset
appimage-run
fluxer
fluxer-canary
proton-vpn
gamescope
];
hardware.steam-hardware.enable = true;
environment.localBinInPath = true;
programs.dconf.enable = true; # apparently necessary for easyeffects to work in home.nix
boot.loader.grub = {
enable = true;
device = "nodev"; # "nodev" is used for UEFI
efiSupport = true;
useOSProber = true;
theme = pkgs.stdenv.mkDerivation {
pname = "minegrub-world-selection";
version = "v1.0.0";
src = pkgs.fetchFromGitHub {
owner = "Lxtharia";
repo = "minegrub-world-sel-theme";
rev = "main";
hash = "sha256-gBlP4aQQ0f3L6S1gWbidbflnp0p5hsJ8qmbyArZ8LO4=";
};
installPhase = "cp -r minegrub-world-selection $out";
};
};
services.flatpak.enable = true;
hardware.i2c.enable = true;
users.users."grey".extraGroups = [ config.hardware.i2c.group ];
services.lact.enable = true;
# hardware.amdgpu.overdrive.enable = true;
zramSwap = {
enable = true;
algorithm = "zstd";
memoryMax = 17179869184;
};
boot.kernel.sysctl = {
"vm.swappiness" = 180;
"vm.watermark_boost_factor" = 0;
"vm.watermark_scale_factor" = 125;
"vm.page-cluster" = 0;
};
networking.interfaces."enp10s0".wakeOnLan = {
enable = true;
policy = [ "magic" ];
};
}
@@ -0,0 +1,31 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "uas" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/e845a5a1-cc91-4598-910a-c0b8b8486318";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/9E25-4C54";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
};
swapDevices = [ ];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}
+117
View File
@@ -0,0 +1,117 @@
{
config,
pkgs,
inputs,
lib,
...
}: let
global-configs = ../../global-configs;
packages = ../../packages;
in {
imports = [
# inputs.nixos-millennium.homeManagerModules.default
../../global-home.nix
"${global-configs}/plasma.nix"
"${global-configs}/zen-browser.nix"
"${global-configs}/vscode.nix"
"${global-configs}/zsh.nix"
"${global-configs}/equibop.nix"
"${global-configs}/spicetify.nix"
./configs/easyeffects.nix
./configs/kitty.nix
./configs/fastfetch.nix
./configs/flatpak.nix
];
home.packages = with pkgs; [
prismlauncher
obsidian
github-desktop
thunderbird
unityhub
godot
jetbrains.clion
jetbrains.idea
obs-studio
ente-auth
winetricks
protontricks
kdePackages.filelight
dconf-editor
mangohud
mangojuice
python3
android-tools
protonplus
signal-desktop
];
home.pointerCursor = {
enable = true;
package = pkgs.bibata-cursors;
name = "Bibata-Modern-Ice";
size = 22;
gtk.enable = true;
x11.enable = true;
};
gtk = {
enable = true;
colorScheme = "dark";
gtk2.configLocation = "${config.home.homeDirectory}/.config/.gtkrc-2.0"; # prevents file conflicts between this and other parts of the nix config
gtk2.force = true;
};
programs.ssh = {
settings = {
"sakamoto" = {
HostName = "192.168.0.40";
Port = "22";
User = "grey";
IdentityFile = "~/.ssh/id_sakamoto";
};
};
};
home.activation = {
linkAutostartDir = lib.hm.dag.entryAfter ["writeBoundary"] ''
#!/bin/bash
if [ -d /home/grey/.config/autostart ]; then
rm -rf /home/grey/.config/autostart
fi
ln -s /home/grey/nixos/assets/dotfiles/takamaki/autostart-config /home/grey/.config/autostart
'';
};
home.file.".local/bin/switch-os" = {
enable = true;
force = true;
executable = true;
text = ''
#!/usr/bin/env bash
sudo efibootmgr --bootnext 0000
sudo reboot
'';
};
home.file.".local/bin/universal-shutdown" = {
enable = true;
force = true;
executable = true;
text = ''
#!/usr/bin/env bash
sudo systemctl poweroff
'';
};
home.file.".local/bin/universal-reboot" = {
enable = true;
force = true;
executable = true;
text = ''
#!/usr/bin/env bash
sudo reboot
'';
};
}
@@ -0,0 +1,29 @@
{
config,
pkgs,
...
}: {
users.users."grey".openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeYFzFyv1LEdWngyTDqnsdJQhmgAfQbbksyZrNWkameVMJpi8IJ+3IIrL96BtD8EAC/jxHIbri49TInN0lYRBH3cH3jbBupdDFaziH3ohyMoeg8enKYsiisaT+MTGEGFygF9Ul1WDrOM1oThEP1LTYj5pWNfZRtIG870jLzRkNczb0eCtEO0qWtyH92Cb5BSpXBKd4Eaysvkm5ex77I5Y1Hl0RUjyEiegiwC1LrcrFhjhVFQGlShTr5kf/LJrwamyGJx4oLi462Omf/jLwNoIMLNgxzuJBynYK714AY9U/IbNq//bEQro6i2cwxPm4lSTaGemnhvEItHsDfbeAJ06iqOl51OtsM2qees2ygCgFvraKNRTmOoRkhS/IwC1bqoMqR8uraYcfKlXeXBjYnJbVG6u/SAGLg7Llmt5UAs7a6/W/7ytWJ90uQVjgPcb7h+9ji+jK18EQUd/AAknfLkLE5IoU5wj6+2OTAGeCT46BbMpYOk2RJinUy93VBIPuRyvZ5tdIt76BPt3JgosYbYtbdkyZTI8V72iCVLWae1uCF2pJlZ1gLteaS0ZmkgyEsAchm8VaoE8NrIO4MBpyZ3fZ9gsprT5jsnUb9Hc+opKSgX+OwDjzM5BadCUFtvoJE3FNTv7koIDg2myHyYj+1kFxp6ctjNgP9V9/0rc4oWz9ew== grey@kitagawa" ];
services.openssh = {
enable = true;
enableRecommendedAlgorithms = false;
generateHostKeys = false;
settings = {
AllowUsers = [ "grey" ];
KbdInteractiveAuthentication = false;
PasswordAuthentication = false;
PermitRootLogin = "no";
MaxAuthTries = 3;
MaxSessions = 5;
MaxStartups = "2:50:5";
};
startWhenNeeded = true;
};
networking.firewall.extraCommands = ''
if [ "$(iptables -S INPUT)" != "-P INPUT ACCEPT" ]; then iptables -D INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP; ${pkgs.ipset}/bin/ipset destroy geo-whitelist; fi
${pkgs.ipset}/bin/ipset restore -file /home/grey/nixos/assets/geo-whitelist.ipset
iptables -I INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP
'';
}
@@ -0,0 +1,20 @@
{
pkgs,
config,
...
}: {
users.users.remotebuild = {
isSystemUser = true;
group = "remotebuild";
useDefaultShell = true;
# also uses id_takamaki for simplicity's sake
openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeYFzFyv1LEdWngyTDqnsdJQhmgAfQbbksyZrNWkameVMJpi8IJ+3IIrL96BtD8EAC/jxHIbri49TInN0lYRBH3cH3jbBupdDFaziH3ohyMoeg8enKYsiisaT+MTGEGFygF9Ul1WDrOM1oThEP1LTYj5pWNfZRtIG870jLzRkNczb0eCtEO0qWtyH92Cb5BSpXBKd4Eaysvkm5ex77I5Y1Hl0RUjyEiegiwC1LrcrFhjhVFQGlShTr5kf/LJrwamyGJx4oLi462Omf/jLwNoIMLNgxzuJBynYK714AY9U/IbNq//bEQro6i2cwxPm4lSTaGemnhvEItHsDfbeAJ06iqOl51OtsM2qees2ygCgFvraKNRTmOoRkhS/IwC1bqoMqR8uraYcfKlXeXBjYnJbVG6u/SAGLg7Llmt5UAs7a6/W/7ytWJ90uQVjgPcb7h+9ji+jK18EQUd/AAknfLkLE5IoU5wj6+2OTAGeCT46BbMpYOk2RJinUy93VBIPuRyvZ5tdIt76BPt3JgosYbYtbdkyZTI8V72iCVLWae1uCF2pJlZ1gLteaS0ZmkgyEsAchm8VaoE8NrIO4MBpyZ3fZ9gsprT5jsnUb9Hc+opKSgX+OwDjzM5BadCUFtvoJE3FNTv7koIDg2myHyYj+1kFxp6ctjNgP9V9/0rc4oWz9ew== grey@kitagawa" ];
};
services.openssh.settings.AllowUsers = [ "remotebuild" ];
users.groups.remotebuild = {};
nix.settings.trusted-users = [ "remotebuild" ];
}
@@ -0,0 +1,51 @@
{
pkgs,
config,
...
}: {
security.sudo = {
enable = true;
extraRules = [{
commands = [
{
command = "${pkgs.systemd}/bin/systemctl poweroff";
options = [ "NOPASSWD" ];
}
{
command = "${pkgs.systemd}/bin/shutdown";
options = [ "NOPASSWD" ];
}
{
command = "${pkgs.systemd}/bin/systemctl reboot";
options = [ "NOPASSWD" ];
}
{
command = "${pkgs.systemd}/bin/reboot";
options = [ "NOPASSWD" ];
}
{
command = "${pkgs.efibootmgr}/bin/efibootmgr";
options = [ "NOPASSWD" ];
}
{
command = "/run/current-system/sw/bin/efibootmgr";
options = [ "NOPASSWD" ];
}
{
command = "${pkgs.efibootmgr}/bin/efibootdump";
options = [ "NOPASSWD" ];
}
{
command = "${pkgs.efibootmgr}/sbin/efibootdump";
options = [ "NOPASSWD" ];
}
];
users = [ "grey" ];
}];
extraConfig = with pkgs; ''
Defaults:grey secure_path="${lib.makeBinPath [
systemd
]}:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin"
'';
};
}
@@ -0,0 +1,20 @@
{
pkgs,
config,
...
}: {
virtualisation.libvirtd = {
enable = true;
qemu.vhostUserPackages = with pkgs; [ virtiofsd ];
};
programs.virt-manager.enable = true;
users.users.grey.extraGroups = [ "libvirtd" ];
environment.systemPackages = with pkgs; [
dnsmasq
];
networking.firewall.trustedInterfaces = [ "virbr0" ];
}