Lilac/Chickadee
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update lock file remove tabs

Browse Source
This commit is contained in:
Lilac
2026-09-12 20:33:30 -04:00
parent 7142cba4c2
commit f8e9d1ab30
14 changed files with 159 additions and 171 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.lock
Generated
+16 -16
View File
@@ -9,11 +9,11 @@
"utils": "utils"
},
"locked": {
"lastModified": 1785518313,
"narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=",
"lastModified": 1788879443,
"narHash": "sha256-qb9sL86UCUEd3SYAda4ItN1NV0vhMSdbpA64WckvVI0=",
"owner": "serokell",
"repo": "deploy-rs",
"rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d",
"rev": "414ac5f35d79aabe5a0bf52451d8cf61eadf6c88",
"type": "github"
},
"original": {
@@ -58,11 +58,11 @@
"grasswren": {
"flake": false,
"locked": {
"lastModified": 1783801496,
"narHash": "sha256-awQZQVk5jz8ZyNCEnqarBZENKP7RvKHN8QRuDQJY7YA=",
"lastModified": 1788394295,
"narHash": "sha256-Fg8PUA0tG5/N8fYWpsOHo0j1+Bnez8G0d8Xd3K63zb8=",
"ref": "main",
"rev": "4d505fe6467e14b6e37b89e2e9e3a3b2bbf6649f",
"revCount": 4,
"rev": "5123b8e9873b7f413c080ba97f01feb85be51808",
"revCount": 5,
"type": "git",
"url": "https://code.grasswren.net/Lilac/Grasswren.git"
},
@@ -79,11 +79,11 @@
]
},
"locked": {
"lastModified": 1785119570,
"narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
"lastModified": 1789182507,
"narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
"rev": "b1d1b60084970f9d1e2b72662639dab6d039be71",
"type": "github"
},
"original": {
@@ -111,11 +111,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1785599192,
"narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=",
"lastModified": 1789114715,
"narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07",
"rev": "21a67dc470149f337cecafbe965d8d252a390518",
"type": "github"
},
"original": {
@@ -156,11 +156,11 @@
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1783174389,
"narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
"lastModified": 1788914643,
"narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
"rev": "13616fff713a9f94055c66f15687ebdc17a335df",
"type": "github"
},
"original": {
flake.nix
+17 -23
View File
@@ -40,8 +40,9 @@
home-manager.nixosModules.home-manager
./hosts/vps/default.nix
];
};
backup = nixpkgs.lib.nixosSystem {
};
backup = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
specialArgs = { inherit inputs; };
modules = [
@@ -51,18 +52,20 @@
};
};
homeConfigurations.lilac = home-manager.lib.homeManagerConfiguration {
pkgs = import nixpkgs { system = "x86_64-linux"; };
modules = [
./home/lilac.nix
];
};
# nix run github:nix-community/nixos-anywhere -- --flake .#<CONFIGURATION> --phases install root@<ADDRESS>
# nix run github:serokell/deploy-rs
deploy.nodes = {
desktop = {
hostname = "10.0.0.2";
sshUser = "root";
magicRollbackTimeout = 120;
profiles.system = {
user = "root";
remoteBuild = false;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
};
};
vps = {
hostname = "216.128.177.13";
hostname = "10.0.0.3";
sshUser = "root";
magicRollbackTimeout = 120;
profiles.system = {
@@ -72,16 +75,6 @@
};
};
desktop = {
hostname = "192.168.1.133";
sshUser = "root";
magicRollbackTimeout = 120;
profiles.system = {
user = "root";
remoteBuild = false;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
};
};
backup = {
hostname = "10.0.0.4";
sshUser = "root";
@@ -92,7 +85,8 @@
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup;
};
};
};
};
checks = {
x86_64-linux = deploy-rs.lib.x86_64-linux.deployChecks self.deploy;
};
hosts/backup/default.nix
+24 -24
View File
@@ -7,16 +7,16 @@
users.users.lilac = {
isNormalUser = true;
group = "lilac";
extraGroups = [ "wheel" ];
group = "lilac";
extraGroups = [ "wheel" ];
};
users.groups.lilac = {};
home-manager = {
useGlobalPkgs = true;
useUserPackages = true;
useUserPackages = true;
users.lilac = import ../../home/lilac.nix;
};
users.lilac = import ../../home/lilac.nix;
};
programs.zsh.enable = true;
users.users.lilac.shell = pkgs.zsh;
security.sudo.wheelNeedsPassword = false;
@@ -62,8 +62,8 @@
environment.systemPackages = with pkgs; [
whipper
flac
tor-browser
flac
tor-browser
];
networking.wireless.enable = true;
@@ -73,22 +73,22 @@
networking = {
firewall = {
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.4/24" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
};
nixpkgs.config.allowUnfree = true;
@@ -99,10 +99,10 @@ networking = {
services.restic.server = {
enable = true;
listenAddress = "10.0.0.4:8000";
dataDir = "/var/lib/restic";
appendOnly = true;
extraFlags = [ "--no-auth" ];
listenAddress = "10.0.0.4:8000";
dataDir = "/var/lib/restic";
appendOnly = true;
extraFlags = [ "--no-auth" ];
};
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ];
hosts/desktop/default.nix
+25 -25
View File
@@ -9,17 +9,17 @@
../../modules/site/mail.nix
../../modules/site/music.nix
../../modules/site/photo.nix
../../modules/site/vault.nix
../../modules/site/vault.nix
../../modules/ssh.nix
../../modules/ssh.nix
];
networking.hostName = "desktop";
users.users.lilac = {
isNormalUser = true;
group = "lilac";
extraGroups = [ "wheel" "render" "video" "input" "uinput" ];
group = "lilac";
extraGroups = [ "wheel" "render" "video" "input" "uinput" ];
};
users.groups.lilac = {};
home-manager = {
@@ -102,31 +102,31 @@
environment.systemPackages = with pkgs; [
whipper
flac
tor-browser
restic
flac
tor-browser
restic
];
programs.steam.enable = true;
networking = {
firewall = {
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
enable = true;
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.2/24" ];
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820";
persistentKeepalive = 25;
}];
};
};
nixpkgs.config.allowUnfree = true;
@@ -135,10 +135,10 @@
services.restic.backups.backup = {
repository = "rest:http://10.0.0.4:8000/backup";
initialize = true;
passwordFile = "/home/lilac/test-password";
paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ];
timerConfig.OnCalendar = "03:30";
pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
initialize = true;
passwordFile = "/home/lilac/test-password";
paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ];
timerConfig.OnCalendar = "03:30";
pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
};
}
hosts/vps/default.nix
+30 -30
View File
@@ -11,8 +11,8 @@
users.users.lilac = {
isNormalUser = true;
group = "lilac";
extraGroups = [ "wheel" ];
group = "lilac";
extraGroups = [ "wheel" ];
};
users.groups.lilac = {};
home-manager = {
@@ -27,47 +27,47 @@
# forwarding inbound network traffic over wireguard
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 443 ];
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
enable = true;
allowedTCPPorts = [ 80 443 ];
allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ];
};
wireguard.interfaces."wg0" = {
ips = [ "10.0.0.3/24" ];
listenPort = 51820;
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [
{
allowedIPs = [ "10.0.0.1/32" ];
listenPort = 51820;
generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [
{
allowedIPs = [ "10.0.0.1/32" ];
publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw=";
}
{
}
{
allowedIPs = [ "10.0.0.2/32" ];
publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
}
{
allowedIPs = [ "10.0.0.4/32" ];
publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
}
publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
}
{
allowedIPs = [ "10.0.0.4/32" ];
publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
}
];
};
nftables = {
enable = true;
tables.nat = {
family = "ip";
content = ''
};
nftables = {
enable = true;
tables.nat = {
family = "ip";
content = ''
chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
}
chain postrouting {
chain postrouting {
type nat hook postrouting priority srcnat; policy accept;
oifname "wg0" masquerade
}
'';
};
};
};
};
boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1;
hosts/vps/hardware-configuration.nix
+5 -5
View File
@@ -3,11 +3,11 @@
{
boot = {
initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
kernelModules = [ ];
extraModulePackages = [ ];
loader.systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true;
loader.efi.efiSysMountPoint = "/boot/efi";
kernelModules = [ ];
extraModulePackages = [ ];
loader.systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true;
loader.efi.efiSysMountPoint = "/boot/efi";
};
fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
modules/ripping.nix
+4 -4
View File
@@ -3,7 +3,7 @@
{
home.packages = with pkgs; [
whipper
beets
beets
];
programs.beets = {
@@ -14,11 +14,11 @@
library = "/var/lib/music/library.db";
plugins = [
"musicbrainz"
"musicbrainz"
"fetchart"
"embedart"
"scrub"
"chroma"
"chroma"
];
per_disc_numbering = true;
@@ -36,7 +36,7 @@
default = "$albumartist/$album%aunique{}/$track - $title";
};
fetchart.auto = true;
fetchart.auto = true;
embedart.auto = true;
scrub.auto = true;
};
modules/site/blog.nix
+1 -7
View File
@@ -14,13 +14,7 @@ in
enable = true;
virtualHosts."grasswren.net".extraConfig = ''
encode
root * ${website}/home
file_server
'';
virtualHosts."blog.grasswren.net".extraConfig = ''
encode
root * ${website}/blog
root * ${website}
file_server
'';
};
modules/site/code.nix
+4 -4
View File
@@ -20,13 +20,13 @@
user = "gitea";
};
settings.service.DISABLE_REGISTRATION = true;
settings.service.DISABLE_REGISTRATION = true;
};
services.caddy = {
enable = true;
virtualHosts."code.grasswren.net".extraConfig = ''
reverse_proxy localhost:3000
'';
virtualHosts."code.grasswren.net".extraConfig = ''
reverse_proxy localhost:3000
'';
};
}
modules/site/music.nix
+3 -3
View File
@@ -3,13 +3,13 @@
{
services.navidrome = {
enable = true;
settings.MusicFolder = "/var/lib/music";
settings.MusicFolder = "/var/lib/music";
};
services.caddy = {
enable = true;
virtualHosts."music.grasswren.net".extraConfig = ''
virtualHosts."music.grasswren.net".extraConfig = ''
reverse_proxy localhost:4533
'';
'';
};
}
modules/site/photo.nix
+5 -5
View File
@@ -3,15 +3,15 @@
{
services.immich = {
enable = true;
host = "127.0.0.1";
port = 2283;
mediaLocation = "/var/lib/immich";
host = "127.0.0.1";
port = 2283;
mediaLocation = "/var/lib/immich";
};
services.caddy = {
enable = true;
virtualHosts."photo.grasswren.net".extraConfig = ''
virtualHosts."photo.grasswren.net".extraConfig = ''
reverse_proxy localhost:2283
'';
'';
};
}
modules/site/vault.nix
+4 -4
View File
@@ -3,7 +3,7 @@
{
services.vaultwarden = {
enable = true;
backupDir = "/var/lib/vault-backup";
backupDir = "/var/lib/vault-backup";
config = {
DOMAIN = "https://vault.example.com";
SIGNUPS_ALLOWED = false;
@@ -14,8 +14,8 @@
services.caddy = {
enable = true;
virtualHosts."vault.grasswren.net".extraConfig = ''
reverse_proxy localhost:8222
'';
virtualHosts."vault.grasswren.net".extraConfig = ''
reverse_proxy localhost:8222
'';
};
}
modules/site/vpn.nix
+13 -13
View File
@@ -3,29 +3,29 @@
{
services.headscale = {
enable = true;
settings = {
settings = {
server_url = "https://vpn.grasswren.net";
listen_addr = "127.0.0.1:8080";
listen_addr = "127.0.0.1:8080";
database.type = "sqlite";
database.type = "sqlite";
ip_prefixes = [
ip_prefixes = [
"100.64.0.0/10"
"fd7a:115c:a1e0::/48"
];
dns = {
magic_domain = true;
base_domain = "vpn.grasswren.net";
nameservers.global = [ "1.1.1.1" ];
};
};
dns = {
magic_domain = true;
base_domain = "vpn.grasswren.net";
nameservers.global = [ "1.1.1.1" ];
};
};
};
services.caddy = {
enable = true;
virtualHosts."vpn.grasswren.net".extraConfig = ''
reverse_proxy localhost:8080
'';
virtualHosts."vpn.grasswren.net".extraConfig = ''
reverse_proxy localhost:8080
'';
};
}
modules/ssh.nix
+8 -8
View File
@@ -3,19 +3,19 @@
{
networking.firewall = {
enable = true;
interfaces.wg0.allowedTCPPorts = [ 22 ];
interfaces.wg0.allowedTCPPorts = [ 22 ];
};
services.openssh = {
enable = true;
settings = {
settings = {
PermitRootLogin = "prohibit-password";
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
};
listenAddresses = [{
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
};
listenAddresses = [{
addr = "0.0.0.0";
port = 22;
}];
port = 22;
}];
};
users.users.lilac.openssh.authorizedKeys.keys = [