From 5771befa30bd5012de98227ac8729b0814d29113 Mon Sep 17 00:00:00 2001 From: Lilac Date: Mon, 21 Sep 2026 10:58:46 -0400 Subject: [PATCH] pull out some extra modules --- hosts/backup/default.nix | 35 ++++----------- hosts/desktop/default.nix | 41 ++++------------- hosts/laptop/default.nix | 34 ++++++-------- hosts/vps/default.nix | 17 +------ lilac.nix | 86 ++++++++++++++++++++++++++++++++++++ modules/backup-server.nix | 11 +++++ modules/backup.nix | 12 +++++ modules/{site => }/blog.nix | 0 modules/{site => }/code.nix | 9 ++-- modules/{site => }/mail.nix | 0 modules/{site => }/music.nix | 6 +-- modules/{site => }/photo.nix | 10 ++--- modules/ripping.nix | 44 ------------------ modules/site/vpn.nix | 31 ------------- modules/ssh.nix | 17 +++---- modules/{site => }/vault.nix | 8 ++-- modules/vpn.nix | 30 +++++++++++++ 17 files changed, 197 insertions(+), 194 deletions(-) create mode 100644 lilac.nix create mode 100644 modules/backup-server.nix create mode 100644 modules/backup.nix rename modules/{site => }/blog.nix (100%) rename modules/{site => }/code.nix (75%) rename modules/{site => }/mail.nix (100%) rename modules/{site => }/music.nix (59%) rename modules/{site => }/photo.nix (52%) delete mode 100644 modules/ripping.nix delete mode 100644 modules/site/vpn.nix rename modules/{site => }/vault.nix (67%) create mode 100644 modules/vpn.nix diff --git a/hosts/backup/default.nix b/hosts/backup/default.nix index 32d97cb..80226da 100644 --- a/hosts/backup/default.nix +++ b/hosts/backup/default.nix @@ -1,26 +1,17 @@ { config, lib, pkgs, ... }: { - imports = [ ./hardware-configuration.nix ../../modules/ssh.nix ]; + imports = [ + ./hardware-configuration.nix + + ../../modules/backup-server.nix + ../../modules/ssh.nix + + ../../lilac.nix + ]; networking.hostName = "backup"; - users.users.lilac = { - isNormalUser = true; - group = "lilac"; - extraGroups = [ "wheel" ]; - }; - users.groups.lilac = {}; - home-manager = { - useGlobalPkgs = true; - useUserPackages = true; - - users.lilac = import ../../home/lilac.nix; - }; - programs.zsh.enable = true; - users.users.lilac.shell = pkgs.zsh; - security.sudo.wheelNeedsPassword = false; - time.timeZone = "America/Winnipeg"; systemd.sleep.settings.Sleep = { @@ -95,15 +86,5 @@ networking = { nix.settings.experimental-features = [ "nix-command" "flakes" ]; system.stateVersion = "26.05"; - - - services.restic.server = { - enable = true; - listenAddress = "10.0.0.4:8000"; - dataDir = "/var/lib/restic"; - appendOnly = true; - extraFlags = [ "--no-auth" ]; - }; - networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ]; } diff --git a/hosts/desktop/default.nix b/hosts/desktop/default.nix index 7f13803..94f023e 100644 --- a/hosts/desktop/default.nix +++ b/hosts/desktop/default.nix @@ -4,34 +4,20 @@ imports = [ ./hardware-configuration.nix - ../../modules/site/blog.nix - ../../modules/site/code.nix - ../../modules/site/mail.nix - ../../modules/site/music.nix - ../../modules/site/photo.nix - ../../modules/site/vault.nix + ../../modules/backup.nix + ../../modules/blog.nix + ../../modules/code.nix + ../../modules/mail.nix + ../../modules/music.nix + ../../modules/photo.nix + ../../modules/ssh.nix + ../../modules/vault.nix - ../../modules/ssh.nix + ../../lilac.nix ]; networking.hostName = "desktop"; - users.users.lilac = { - isNormalUser = true; - group = "lilac"; - extraGroups = [ "wheel" "render" "video" "input" "uinput" ]; - }; - users.groups.lilac = {}; - home-manager = { - useGlobalPkgs = true; - useUserPackages = true; - - users.lilac = import ../../home/lilac.nix; - }; - programs.zsh.enable = true; - users.users.lilac.shell = pkgs.zsh; - security.sudo.wheelNeedsPassword = false; - time.timeZone = "America/Toronto"; i18n.defaultLocale = "en_US.UTF-8"; @@ -132,13 +118,4 @@ nixpkgs.config.allowUnfree = true; nix.settings.experimental-features = [ "nix-command" "flakes" ]; system.stateVersion = "26.05"; - - services.restic.backups.backup = { - repository = "rest:http://10.0.0.4:8000/backup"; - initialize = true; - passwordFile = "/home/lilac/test-password"; - paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ]; - timerConfig.OnCalendar = "03:30"; - pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ]; - }; } diff --git a/hosts/laptop/default.nix b/hosts/laptop/default.nix index aaf6bae..5ff5001 100644 --- a/hosts/laptop/default.nix +++ b/hosts/laptop/default.nix @@ -1,10 +1,11 @@ { config, pkgs, ... }: { - imports = - [ - ./hardware-configuration.nix - ]; + imports = [ + ./hardware-configuration.nix + + ../../lilac.nix + ]; boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; @@ -44,25 +45,18 @@ alsa.support32Bit = true; pulse.enable = true; }; - users.users.lilac = { - isNormalUser = true; - group = "lilac"; - extraGroups = [ "networkmanager" "wheel" "render" "video" "input" "uinput" ]; - }; - users.groups.lilac = {}; - home-manager = { - useGlobalPkgs = true; - useUserPackages = true; - users.lilac = import ../../home/lilac.nix; - }; - programs.zsh.enable = true; - users.users.lilac.shell = pkgs.zsh; - security.sudo.wheelNeedsPassword = false; + hardware.graphics.enable = true; + hardware.graphics.enable32Bit = true; + hardware.enableRedistributableFirmware = true; environment.systemPackages = with pkgs; [ - vim - tor-browser + mullvad-browser + signal-desktop + discord + protonmail-desktop + steam + obsidian ]; networking = { diff --git a/hosts/vps/default.nix b/hosts/vps/default.nix index f50300c..eefe05b 100644 --- a/hosts/vps/default.nix +++ b/hosts/vps/default.nix @@ -5,25 +5,12 @@ ./hardware-configuration.nix ../../modules/ssh.nix + + ../../lilac.nix ]; networking.hostName = "vps"; - users.users.lilac = { - isNormalUser = true; - group = "lilac"; - extraGroups = [ "wheel" ]; - }; - users.groups.lilac = {}; - home-manager = { - useGlobalPkgs = true; - useUserPackages = true; - users.lilac = import ../../home/lilac.nix; - }; - programs.zsh.enable = true; - users.users.lilac.shell = pkgs.zsh; - security.sudo.wheelNeedsPassword = false; - # forwarding inbound network traffic over wireguard networking = { firewall = { diff --git a/lilac.nix b/lilac.nix new file mode 100644 index 0000000..dcfb509 --- /dev/null +++ b/lilac.nix @@ -0,0 +1,86 @@ +{ config, lib, pkgs, ... }: + +{ + users.users.lilac = { + isNormalUser = true; + group = "lilac"; + extraGroups = [ "wheel" "networkmanager" "render" "video" "input" "uinput" ]; + }; + users.groups.lilac = {}; + + programs.zsh.enable = true; + users.users.lilac.shell = pkgs.zsh; + security.sudo.wheelNeedsPassword = false; + + home-manager = { + useGlobalPkgs = true; + useUserPackages = true; + + users.lilac = { + home.username = "lilac"; + home.homeDirectory = "/home/lilac"; + + home.packages = with pkgs; [ + git + zsh + helix + ]; + + programs.git = { + enable = true; + settings = { + user.name = "Lilac"; + user.email = "lilac@grasswren.net"; + core.editor = "hx"; + init.defaultBranch = "main"; + }; + }; + + programs.ssh = { + enable = true; + settings = { + "desktop" = { + hostname = "10.0.0.2"; + user = "lilac"; + }; + "vps" = { + hostname = "10.0.0.3"; + user = "lilac"; + }; + "backup" = { + hostname = "10.0.0.4"; + user = "lilac"; + }; + "gitea" = { + hostname = "10.0.0.2"; + user = "gitea"; + identityFile = "~/.ssh/gitea"; + }; + }; + }; + + programs.zsh = { + enable = true; + enableCompletion = true; + autosuggestion.enable = true; + syntaxHighlighting.enable = true; + + shellAliases = { + ls = "ls -A"; + }; + }; + + programs.helix = { + enable = true; + }; + + home.sessionVariables = { + EDITOR = "hx"; + }; + + programs.home-manager.enable = true; + home.stateVersion = "26.05"; + + }; + }; +} diff --git a/modules/backup-server.nix b/modules/backup-server.nix new file mode 100644 index 0000000..5e5d996 --- /dev/null +++ b/modules/backup-server.nix @@ -0,0 +1,11 @@ +{ config, lib, pkgs, ... }: + +{ + services.restic.server = { + enable = true; + listenAddress = "10.0.0.4:8000"; + dataDir = "/var/lib/restic"; + appendOnly = true; + extraFlags = [ "--no-auth" ]; + }; +} diff --git a/modules/backup.nix b/modules/backup.nix new file mode 100644 index 0000000..fd7e6a5 --- /dev/null +++ b/modules/backup.nix @@ -0,0 +1,12 @@ +{ config, lib, pkgs, ... }: + +{ + services.restic.backups.backup = { + repository = "rest:http://10.0.0.4:8000/backup"; + initialize = true; + passwordFile = "/home/lilac/test-password"; + paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ]; + timerConfig.OnCalendar = "03:30"; + pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ]; + }; +} diff --git a/modules/site/blog.nix b/modules/blog.nix similarity index 100% rename from modules/site/blog.nix rename to modules/blog.nix diff --git a/modules/site/code.nix b/modules/code.nix similarity index 75% rename from modules/site/code.nix rename to modules/code.nix index 7352097..839a497 100644 --- a/modules/site/code.nix +++ b/modules/code.nix @@ -19,14 +19,13 @@ name = "gitea"; user = "gitea"; }; - - settings.service.DISABLE_REGISTRATION = true; + settings.service.DISABLE_REGISTRATION = true; }; services.caddy = { enable = true; - virtualHosts."code.grasswren.net".extraConfig = '' - reverse_proxy localhost:3000 - ''; + virtualHosts."code.grasswren.net".extraConfig = '' + reverse_proxy localhost:3000 + ''; }; } diff --git a/modules/site/mail.nix b/modules/mail.nix similarity index 100% rename from modules/site/mail.nix rename to modules/mail.nix diff --git a/modules/site/music.nix b/modules/music.nix similarity index 59% rename from modules/site/music.nix rename to modules/music.nix index 37b98d2..fda1a95 100644 --- a/modules/site/music.nix +++ b/modules/music.nix @@ -3,13 +3,13 @@ { services.navidrome = { enable = true; - settings.MusicFolder = "/var/lib/music"; + settings.MusicFolder = "/var/lib/music"; }; services.caddy = { enable = true; - virtualHosts."music.grasswren.net".extraConfig = '' + virtualHosts."music.grasswren.net".extraConfig = '' reverse_proxy localhost:4533 - ''; + ''; }; } diff --git a/modules/site/photo.nix b/modules/photo.nix similarity index 52% rename from modules/site/photo.nix rename to modules/photo.nix index 7c7b589..30535db 100644 --- a/modules/site/photo.nix +++ b/modules/photo.nix @@ -3,15 +3,15 @@ { services.immich = { enable = true; - host = "127.0.0.1"; - port = 2283; - mediaLocation = "/var/lib/immich"; + host = "127.0.0.1"; + port = 2283; + mediaLocation = "/var/lib/immich"; }; services.caddy = { enable = true; - virtualHosts."photo.grasswren.net".extraConfig = '' + virtualHosts."photo.grasswren.net".extraConfig = '' reverse_proxy localhost:2283 - ''; + ''; }; } diff --git a/modules/ripping.nix b/modules/ripping.nix deleted file mode 100644 index 0eeb24f..0000000 --- a/modules/ripping.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - home.packages = with pkgs; [ - whipper - beets - ]; - - programs.beets = { - enable = true; - - settings = { - directory = "/var/lib/music"; - library = "/var/lib/music/library.db"; - - plugins = [ - "musicbrainz" - "fetchart" - "embedart" - "scrub" - "chroma" - ]; - - per_disc_numbering = true; - - import = { - move = true; - copy = false; - write = true; - timid = true; - incremental = false; - resume = "ask"; - }; - - paths = { - default = "$albumartist/$album%aunique{}/$track - $title"; - }; - - fetchart.auto = true; - embedart.auto = true; - scrub.auto = true; - }; - }; -} diff --git a/modules/site/vpn.nix b/modules/site/vpn.nix deleted file mode 100644 index 3130b6b..0000000 --- a/modules/site/vpn.nix +++ /dev/null @@ -1,31 +0,0 @@ -{ config, lib, pkgs, ... }: - -{ - services.headscale = { - enable = true; - settings = { - server_url = "https://vpn.grasswren.net"; - listen_addr = "127.0.0.1:8080"; - - database.type = "sqlite"; - - ip_prefixes = [ - "100.64.0.0/10" - "fd7a:115c:a1e0::/48" - ]; - - dns = { - magic_domain = true; - base_domain = "vpn.grasswren.net"; - nameservers.global = [ "1.1.1.1" ]; - }; - }; - }; - - services.caddy = { - enable = true; - virtualHosts."vpn.grasswren.net".extraConfig = '' - reverse_proxy localhost:8080 - ''; - }; -} diff --git a/modules/ssh.nix b/modules/ssh.nix index 9edbab2..84c5ab5 100644 --- a/modules/ssh.nix +++ b/modules/ssh.nix @@ -3,19 +3,20 @@ { networking.firewall = { enable = true; - interfaces.wg0.allowedTCPPorts = [ 22 ]; + interfaces.wg0.allowedTCPPorts = [ 22 ]; }; + services.openssh = { enable = true; - settings = { + settings = { PermitRootLogin = "prohibit-password"; - PasswordAuthentication = false; - KbdInteractiveAuthentication = false; - }; - listenAddresses = [{ + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + }; + listenAddresses = [{ addr = "0.0.0.0"; - port = 22; - }]; + port = 22; + }]; }; users.users.lilac.openssh.authorizedKeys.keys = [ diff --git a/modules/site/vault.nix b/modules/vault.nix similarity index 67% rename from modules/site/vault.nix rename to modules/vault.nix index 7b52139..1e307d7 100644 --- a/modules/site/vault.nix +++ b/modules/vault.nix @@ -3,7 +3,7 @@ { services.vaultwarden = { enable = true; - backupDir = "/var/lib/vault-backup"; + backupDir = "/var/lib/vault-backup"; config = { DOMAIN = "https://vault.example.com"; SIGNUPS_ALLOWED = false; @@ -14,8 +14,8 @@ services.caddy = { enable = true; - virtualHosts."vault.grasswren.net".extraConfig = '' - reverse_proxy localhost:8222 - ''; + virtualHosts."vault.grasswren.net".extraConfig = '' + reverse_proxy localhost:8222 + ''; }; } diff --git a/modules/vpn.nix b/modules/vpn.nix new file mode 100644 index 0000000..abcabef --- /dev/null +++ b/modules/vpn.nix @@ -0,0 +1,30 @@ +{ config, lib, pkgs, ... }: + +{ + services.headscale = { + enable = true; + settings = { + server_url = "https://vpn.grasswren.net"; + listen_addr = "127.0.0.1:8080"; + database.type = "sqlite"; + + ip_prefixes = [ + "100.64.0.0/10" + "fd7a:115c:a1e0::/48" + ]; + + dns = { + magic_domain = true; + base_domain = "vpn.grasswren.net"; + nameservers.global = [ "1.1.1.1" ]; + }; + }; + }; + + services.caddy = { + enable = true; + virtualHosts."vpn.grasswren.net".extraConfig = '' + reverse_proxy localhost:8080 + ''; + }; +}