finally works again

flake.lock

@@ -9,11 +9,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1781627888,
+        "lastModified": 1785518313,
-        "narHash": "sha256-5yHuAh9k7rT7rtf3uRaXkiUyYvQE9oaCgzhprLm2mr8=",
+        "narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "6d3087eedff75a715b40c0e124ba15d2dd7bec28",
+        "rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d",
         "type": "github"
       },
       "original": {
@@ -79,11 +79,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783740085,
+        "lastModified": 1785119570,
-        "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=",
+        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb",
+        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
         "type": "github"
       },
       "original": {
@@ -111,11 +111,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1783703440,
+        "lastModified": 1785599192,
-        "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
+        "narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
+        "rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07",
         "type": "github"
       },
       "original": {
@@ -125,6 +125,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1782175435,
+        "narHash": "sha256-EMzXKmnOtBQ2MnvpiNOm7E+kOMvdPrIKaeg52Tip2Uk=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "89570f24e97e614aa34aa9ab1c927b6578a43775",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "deploy-rs": "deploy-rs",
@@ -137,9 +153,7 @@
     },
     "sops-nix": {
       "inputs": {
-        "nixpkgs": [
+        "nixpkgs": "nixpkgs_3"
-          "nixpkgs"
-        ]
       },
       "locked": {
         "lastModified": 1783174389,
@@ -150,9 +164,8 @@
         "type": "github"
       },
       "original": {
-        "owner": "Mic92",
+        "id": "sops-nix",
-        "repo": "sops-nix",
+        "type": "indirect"
-        "type": "github"
       }
     },
     "systems": {

flake.nix

@@ -8,9 +8,6 @@
     home-manager.url = "github:nix-community/home-manager/release-26.05";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    sops-nix.url = "github:Mic92/sops-nix";
-    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-
     grasswren.url = "git+https://code.grasswren.net/Lilac/Grasswren.git?ref=main";
     grasswren.flake = false;
   };
@@ -23,8 +20,6 @@
         specialArgs = { inherit inputs; };
         modules = [
           home-manager.nixosModules.home-manager
-          sops-nix.nixosModules.sops
-
           ./hosts/desktop/default.nix
         ];
       };
@@ -33,6 +28,7 @@
         system = "x86_64-linux";
         specialArgs = { inherit inputs; };
         modules = [
+          home-manager.nixosModules.home-manager
           ./hosts/vps/default.nix
         ];
       };

hosts/desktop/default.nix

@@ -4,18 +4,15 @@
   imports = [
     ./hardware-configuration.nix
 
-	../../modules/network.nix
+    ../../modules/site/blog.nix
-	../../modules/ssh.nix
+    ../../modules/site/code.nix
-	../../modules/wireguard.nix
+    ../../modules/site/mail.nix
-	../../modules/tailscale.nix
+    ../../modules/site/music.nix
+    ../../modules/site/photo.nix
 
-	../../modules/site.nix
+	../../modules/ssh.nix
-	../../modules/gitea.nix
-	../../modules/navidrome.nix
-	../../modules/immich.nix
   ];
 
-  network.node = "desktop";
   networking.hostName = "desktop";
 
   users.users.lilac = {
@@ -105,8 +102,31 @@
   environment.systemPackages = with pkgs; [
     whipper
 	flac
+	tor-browser
   ];
 
+  programs.steam.enable = true;
+
+  networking = {
+    firewall = {
+	  enable = true;
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.2/24" ];
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [{
+        publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
+		allowedIPs = [ "10.0.0.0/24" ];
+		endpoint = "216.128.177.13:51820";
+		persistentKeepalive = 25;
+	  }];
+	};
+  };
+
   nixpkgs.config.allowUnfree = true;
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";

hosts/vps/default.nix

@@ -4,17 +4,71 @@
   imports = [
     ./hardware-configuration.nix
 
-    ../../modules/network.nix
     ../../modules/ssh.nix
-    ../../modules/wireguard.nix
-	../../modules/headscale.nix
-
-    ../../modules/http-forwarding.nix
   ];
 
-  network.node = "vps";
   networking.hostName = "vps";
 
+  users.users.lilac = {
+    isNormalUser = true;
+	group = "lilac";
+	extraGroups = [ "wheel" ];
+  };
+  users.groups.lilac = {};
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    users.lilac = import ../../home/lilac.nix;
+  };
+  programs.zsh.enable = true;
+  users.users.lilac.shell = pkgs.zsh;
+  security.sudo.wheelNeedsPassword = false;
+
+  # forwarding inbound network traffic over wireguard
+  networking = {
+    firewall = {
+	  enable = true;
+	  allowedTCPPorts = [ 80 443 ];
+	  allowedUDPPorts = [ 51820 ];
+	  trustedInterfaces = [ "wg0" ];
+	};
+	wireguard.interfaces."wg0" = {
+      ips = [ "10.0.0.3/24" ];
+	  listenPort = 51820;
+	  generatePrivateKeyFile = true;
+	  privateKeyFile = "/var/lib/wireguard/wg0.key";
+	  peers = [
+	    {
+		  allowedIPs = [ "10.0.0.1/32" ];
+          publicKey = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
+		}
+		{
+          allowedIPs = [ "10.0.0.2/32" ];
+		  publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
+		}
+      ];
+	};
+	nftables = {
+	  enable = true;
+	  tables.nat = {
+	    family = "ip";
+		content = ''
+          chain prerouting {
+            type nat hook prerouting priority dstnat; policy accept;
+            iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
+          }
+	      chain postrouting {
+            type nat hook postrouting priority srcnat; policy accept;
+            oifname "wg0" masquerade
+          }
+        '';
+      };
+	};
+  };
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+  };
+
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
   system.stateVersion = "26.05";
 }

hosts/vps/hardware-configuration.nix

@@ -7,11 +7,11 @@
 	extraModulePackages = [ ];
   	loader.systemd-boot.enable = true;
   	loader.efi.canTouchEfiVariables = true;
-  	loader.efi.efiSysMountPoint = "/boot";
+  	loader.efi.efiSysMountPoint = "/boot/efi";
   };
 
   fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
-  fileSystems."/boot" = { device = "/dev/vda1"; fsType = "vfat"; };
+  fileSystems."/boot/efi" = { device = "/dev/vda1"; fsType = "vfat"; };
   swapDevices = [ ];
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

modules/http-forwarding.nix

@@ -1,28 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  networking.firewall.enable = true;
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  networking.nftables.enable = true;
-  networking.nftables.tables.nat = {
-    family = "ip";
-    content = ''
-      chain prerouting {
-        type nat hook prerouting priority dstnat; policy accept;
-
-        iifname "enp1s0" tcp dport 80 dnat to 10.0.0.2:80
-        iifname "enp1s0" tcp dport 443 dnat to 10.0.0.2:443
-      }
-	    chain postrouting {
-        type nat hook postrouting priority srcnat; policy accept;
-
-        oifname "wg0" masquerade
-      }
-    '';
-  };
-
-  boot.kernel.sysctl = {
-    "net.ipv4.ip_forward" = 1;
-  };
-}

modules/network.nix

@@ -1,41 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  options.network = {
-    nodes = lib.mkOption { type = lib.types.attrsOf
-	  (lib.types.submodule ({ name, config, ... }: {
-        options = {
-          id          = lib.mkOption { type = lib.types.int; };
-          ssh         = lib.mkOption { type = lib.types.str; };
-          vpn         = lib.mkOption { type = lib.types.str; };
-		  address-vpn = lib.mkOption { type = lib.types.str; };
-          address-pub = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; };
-		};
-		config = {
-          address-vpn = "10.0.0.${toString config.id}";
-		};
-	  }));
-	};
-	node = lib.mkOption { type = lib.types.str; };
-  };
-  config.network = {
-    nodes = {
-      laptop = {
-        id = 1;
-        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg";
-        vpn = "n+9eh8VUP9NCnjPL0Z/KPc0TQCQloXE2Ipc5+CBtJjU=";
-      };
-      desktop = {
-        id = 2;
-        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdOUv+mUhnS2sbahlqcqm9Ili16/rOk2WAlMSXrjnHu";
-        vpn = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
-      };
-      vps = {
-        id = 3;
-        ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGiiLFiy+UcOi0RgZ1Xvuzl4C5aiZ+bcGaOmQcI/UBXp";
-        vpn = "c5irm217aE+QVwHYmnQh4r91u2fZmQKBIWVgFVMaEwU=";
-        address-pub = "216.128.177.13";
-      };
-    };
-  };
-}

modules/site/blog.nix

@@ -23,11 +23,5 @@ in
       root * ${website}/blog
       file_server
     '';
-
-    virtualHosts."birds.grasswren.net".extraConfig = ''
-      encode
-      root * ${website}/birds
-      file_server
-    '';
   };
 }

modules/site/photo.nix

@@ -10,7 +10,7 @@
 
   services.caddy = {
     enable = true;
-	virtualHosts."image.grasswren.net".extraConfig = ''
+	virtualHosts."photo.grasswren.net".extraConfig = ''
       reverse_proxy localhost:2283
 	'';
   };

modules/site/vpn.nix

@@ -17,6 +17,7 @@
 	  dns = {
 	    magic_domain = true;
 	    base_domain = "vpn.grasswren.net";
+		nameservers.global = [ "1.1.1.1" ];
 	  };
 	};
   };

modules/ssh.nix

@@ -1,8 +1,5 @@
 { config, lib, pkgs, ... }:
 
-let
-  me = config.network.nodes.${config.network.node};
-in
 {
   networking.firewall = {
     enable = true;
@@ -16,19 +13,16 @@ in
 	  KbdInteractiveAuthentication = false;
 	};
 	listenAddresses = [{
-      addr = me.address-vpn;
+      addr = "0.0.0.0";
 	  port = 22;
 	}];
   };
 
+  users.users.lilac.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
+  ];
+
   users.users.root.openssh.authorizedKeys.keys = [
-    config.network.nodes.laptop.ssh
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKhCH6YN63AWFsR1wZ6wJdZ2jlTtYBSkY5FnLrWoLKeg"
-	config.network.nodes.desktop.ssh
   ];
-  users.users.lilac = lib.mkIf (config.network.node != "vps") {
-    openssh.authorizedKeys.keys = [
-      config.network.nodes.laptop.ssh
-      config.network.nodes.desktop.ssh
-    ];
-  };
 }

modules/tailscale.nix

@@ -1,5 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services.tailscale.enable = true;
-}

modules/wireguard.nix

@@ -1,38 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  me = config.network.nodes.${config.network.node};
-in
-{
-  networking = {
-    firewall = {
-      allowedUDPPorts = [ 51820 ];
-	    trustedInterfaces = [ "wg0" ];
-	  };
-	  wireguard.interfaces."wg0" = {
-      ips = [ "${me.address-vpn}/24" ];
-	    listenPort = 51820;
-	    generatePrivateKeyFile = true;
-	    privateKeyFile = "/var/lib/wireguard/wg0.key";
-	    peers = lib.mapAttrsToList (name: peer: {
-        publicKey = peer.vpn;
-		    allowedIPs =
-		      if config.network.node == "vps"
-			      then [ "${peer.address-vpn}/32" ]
-			      else [ "10.0.0.0/24" ];
-		    endpoint =
-		      if peer.address-pub != null
-			      then "${peer.address-pub}:51820"
-			      else null;
-		    persistentKeepalive =
-		      if peer.address-pub != null
-			      then 25
-			      else null;
-	    }) (lib.filterAttrs (name: _:
-        if config.network.node == "vps"
-		      then name != "vps"
-          else name == "vps"
-      ) config.network.nodes);
-	  };
-  };
-}