diff --git a/flake.lock b/flake.lock index 032f81d..b1a8cf5 100644 --- a/flake.lock +++ b/flake.lock @@ -9,11 +9,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1785518313, - "narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=", + "lastModified": 1788879443, + "narHash": "sha256-qb9sL86UCUEd3SYAda4ItN1NV0vhMSdbpA64WckvVI0=", "owner": "serokell", "repo": "deploy-rs", - "rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d", + "rev": "414ac5f35d79aabe5a0bf52451d8cf61eadf6c88", "type": "github" }, "original": { @@ -58,11 +58,11 @@ "grasswren": { "flake": false, "locked": { - "lastModified": 1783801496, - "narHash": "sha256-awQZQVk5jz8ZyNCEnqarBZENKP7RvKHN8QRuDQJY7YA=", + "lastModified": 1788394295, + "narHash": "sha256-Fg8PUA0tG5/N8fYWpsOHo0j1+Bnez8G0d8Xd3K63zb8=", "ref": "main", - "rev": "4d505fe6467e14b6e37b89e2e9e3a3b2bbf6649f", - "revCount": 4, + "rev": "5123b8e9873b7f413c080ba97f01feb85be51808", + "revCount": 5, "type": "git", "url": "https://code.grasswren.net/Lilac/Grasswren.git" }, @@ -79,11 +79,11 @@ ] }, "locked": { - "lastModified": 1785119570, - "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=", + "lastModified": 1789182507, + "narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=", "owner": "nix-community", "repo": "home-manager", - "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d", + "rev": "b1d1b60084970f9d1e2b72662639dab6d039be71", "type": "github" }, "original": { @@ -111,11 +111,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1785599192, - "narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=", + "lastModified": 1789114715, + "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07", + "rev": "21a67dc470149f337cecafbe965d8d252a390518", "type": "github" }, "original": { @@ -156,11 +156,11 @@ "nixpkgs": "nixpkgs_3" }, "locked": { - "lastModified": 1783174389, - "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=", + "lastModified": 1788914643, + "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=", "owner": "Mic92", "repo": "sops-nix", - "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9", + "rev": "13616fff713a9f94055c66f15687ebdc17a335df", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index f15c0b3..8707e13 100644 --- a/flake.nix +++ b/flake.nix @@ -40,8 +40,9 @@ home-manager.nixosModules.home-manager ./hosts/vps/default.nix ]; - }; - backup = nixpkgs.lib.nixosSystem { + }; + + backup = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; specialArgs = { inherit inputs; }; modules = [ @@ -51,18 +52,20 @@ }; }; - homeConfigurations.lilac = home-manager.lib.homeManagerConfiguration { - pkgs = import nixpkgs { system = "x86_64-linux"; }; - modules = [ - ./home/lilac.nix - ]; - }; - - # nix run github:nix-community/nixos-anywhere -- --flake .# --phases install root@
- # nix run github:serokell/deploy-rs deploy.nodes = { + desktop = { + hostname = "10.0.0.2"; + sshUser = "root"; + magicRollbackTimeout = 120; + profiles.system = { + user = "root"; + remoteBuild = false; + path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop; + }; + }; + vps = { - hostname = "216.128.177.13"; + hostname = "10.0.0.3"; sshUser = "root"; magicRollbackTimeout = 120; profiles.system = { @@ -72,16 +75,6 @@ }; }; - desktop = { - hostname = "192.168.1.133"; - sshUser = "root"; - magicRollbackTimeout = 120; - profiles.system = { - user = "root"; - remoteBuild = false; - path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop; - }; - }; backup = { hostname = "10.0.0.4"; sshUser = "root"; @@ -92,7 +85,8 @@ path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup; }; }; - }; + }; + checks = { x86_64-linux = deploy-rs.lib.x86_64-linux.deployChecks self.deploy; }; diff --git a/hosts/backup/default.nix b/hosts/backup/default.nix index e200ad8..32d97cb 100644 --- a/hosts/backup/default.nix +++ b/hosts/backup/default.nix @@ -7,16 +7,16 @@ users.users.lilac = { isNormalUser = true; - group = "lilac"; - extraGroups = [ "wheel" ]; + group = "lilac"; + extraGroups = [ "wheel" ]; }; users.groups.lilac = {}; home-manager = { useGlobalPkgs = true; - useUserPackages = true; + useUserPackages = true; - users.lilac = import ../../home/lilac.nix; - }; + users.lilac = import ../../home/lilac.nix; + }; programs.zsh.enable = true; users.users.lilac.shell = pkgs.zsh; security.sudo.wheelNeedsPassword = false; @@ -62,8 +62,8 @@ environment.systemPackages = with pkgs; [ whipper - flac - tor-browser + flac + tor-browser ]; networking.wireless.enable = true; @@ -73,22 +73,22 @@ networking = { firewall = { - enable = true; - allowedUDPPorts = [ 51820 ]; - trustedInterfaces = [ "wg0" ]; - }; + enable = true; + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wg0" ]; + }; - wireguard.interfaces."wg0" = { + wireguard.interfaces."wg0" = { ips = [ "10.0.0.4/24" ]; - generatePrivateKeyFile = true; - privateKeyFile = "/var/lib/wireguard/wg0.key"; - peers = [{ + generatePrivateKeyFile = true; + privateKeyFile = "/var/lib/wireguard/wg0.key"; + peers = [{ publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k="; - allowedIPs = [ "10.0.0.0/24" ]; - endpoint = "216.128.177.13:51820"; - persistentKeepalive = 25; - }]; - }; + allowedIPs = [ "10.0.0.0/24" ]; + endpoint = "216.128.177.13:51820"; + persistentKeepalive = 25; + }]; + }; }; nixpkgs.config.allowUnfree = true; @@ -99,10 +99,10 @@ networking = { services.restic.server = { enable = true; - listenAddress = "10.0.0.4:8000"; - dataDir = "/var/lib/restic"; - appendOnly = true; - extraFlags = [ "--no-auth" ]; + listenAddress = "10.0.0.4:8000"; + dataDir = "/var/lib/restic"; + appendOnly = true; + extraFlags = [ "--no-auth" ]; }; networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ]; diff --git a/hosts/desktop/default.nix b/hosts/desktop/default.nix index d269f57..7f13803 100644 --- a/hosts/desktop/default.nix +++ b/hosts/desktop/default.nix @@ -9,17 +9,17 @@ ../../modules/site/mail.nix ../../modules/site/music.nix ../../modules/site/photo.nix - ../../modules/site/vault.nix + ../../modules/site/vault.nix - ../../modules/ssh.nix + ../../modules/ssh.nix ]; networking.hostName = "desktop"; users.users.lilac = { isNormalUser = true; - group = "lilac"; - extraGroups = [ "wheel" "render" "video" "input" "uinput" ]; + group = "lilac"; + extraGroups = [ "wheel" "render" "video" "input" "uinput" ]; }; users.groups.lilac = {}; home-manager = { @@ -102,31 +102,31 @@ environment.systemPackages = with pkgs; [ whipper - flac - tor-browser - restic + flac + tor-browser + restic ]; programs.steam.enable = true; networking = { firewall = { - enable = true; - allowedUDPPorts = [ 51820 ]; - trustedInterfaces = [ "wg0" ]; - }; + enable = true; + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wg0" ]; + }; - wireguard.interfaces."wg0" = { + wireguard.interfaces."wg0" = { ips = [ "10.0.0.2/24" ]; - generatePrivateKeyFile = true; - privateKeyFile = "/var/lib/wireguard/wg0.key"; - peers = [{ + generatePrivateKeyFile = true; + privateKeyFile = "/var/lib/wireguard/wg0.key"; + peers = [{ publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k="; - allowedIPs = [ "10.0.0.0/24" ]; - endpoint = "216.128.177.13:51820"; - persistentKeepalive = 25; - }]; - }; + allowedIPs = [ "10.0.0.0/24" ]; + endpoint = "216.128.177.13:51820"; + persistentKeepalive = 25; + }]; + }; }; nixpkgs.config.allowUnfree = true; @@ -135,10 +135,10 @@ services.restic.backups.backup = { repository = "rest:http://10.0.0.4:8000/backup"; - initialize = true; - passwordFile = "/home/lilac/test-password"; - paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ]; - timerConfig.OnCalendar = "03:30"; - pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ]; + initialize = true; + passwordFile = "/home/lilac/test-password"; + paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ]; + timerConfig.OnCalendar = "03:30"; + pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ]; }; } diff --git a/hosts/vps/default.nix b/hosts/vps/default.nix index a32e006..f50300c 100644 --- a/hosts/vps/default.nix +++ b/hosts/vps/default.nix @@ -11,8 +11,8 @@ users.users.lilac = { isNormalUser = true; - group = "lilac"; - extraGroups = [ "wheel" ]; + group = "lilac"; + extraGroups = [ "wheel" ]; }; users.groups.lilac = {}; home-manager = { @@ -27,47 +27,47 @@ # forwarding inbound network traffic over wireguard networking = { firewall = { - enable = true; - allowedTCPPorts = [ 80 443 ]; - allowedUDPPorts = [ 51820 ]; - trustedInterfaces = [ "wg0" ]; - }; - wireguard.interfaces."wg0" = { + enable = true; + allowedTCPPorts = [ 80 443 ]; + allowedUDPPorts = [ 51820 ]; + trustedInterfaces = [ "wg0" ]; + }; + wireguard.interfaces."wg0" = { ips = [ "10.0.0.3/24" ]; - listenPort = 51820; - generatePrivateKeyFile = true; - privateKeyFile = "/var/lib/wireguard/wg0.key"; - peers = [ - { - allowedIPs = [ "10.0.0.1/32" ]; + listenPort = 51820; + generatePrivateKeyFile = true; + privateKeyFile = "/var/lib/wireguard/wg0.key"; + peers = [ + { + allowedIPs = [ "10.0.0.1/32" ]; publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw="; - } - { + } + { allowedIPs = [ "10.0.0.2/32" ]; - publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk="; - } - { - allowedIPs = [ "10.0.0.4/32" ]; - publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ="; - } + publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk="; + } + { + allowedIPs = [ "10.0.0.4/32" ]; + publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ="; + } ]; - }; - nftables = { - enable = true; - tables.nat = { - family = "ip"; - content = '' + }; + nftables = { + enable = true; + tables.nat = { + family = "ip"; + content = '' chain prerouting { type nat hook prerouting priority dstnat; policy accept; iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2 } - chain postrouting { + chain postrouting { type nat hook postrouting priority srcnat; policy accept; oifname "wg0" masquerade } ''; }; - }; + }; }; boot.kernel.sysctl = { "net.ipv4.ip_forward" = 1; diff --git a/hosts/vps/hardware-configuration.nix b/hosts/vps/hardware-configuration.nix index a1f04c4..b47f04e 100644 --- a/hosts/vps/hardware-configuration.nix +++ b/hosts/vps/hardware-configuration.nix @@ -3,11 +3,11 @@ { boot = { initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ]; - kernelModules = [ ]; - extraModulePackages = [ ]; - loader.systemd-boot.enable = true; - loader.efi.canTouchEfiVariables = true; - loader.efi.efiSysMountPoint = "/boot/efi"; + kernelModules = [ ]; + extraModulePackages = [ ]; + loader.systemd-boot.enable = true; + loader.efi.canTouchEfiVariables = true; + loader.efi.efiSysMountPoint = "/boot/efi"; }; fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; }; diff --git a/modules/ripping.nix b/modules/ripping.nix index f5bd77f..0eeb24f 100644 --- a/modules/ripping.nix +++ b/modules/ripping.nix @@ -3,7 +3,7 @@ { home.packages = with pkgs; [ whipper - beets + beets ]; programs.beets = { @@ -14,11 +14,11 @@ library = "/var/lib/music/library.db"; plugins = [ - "musicbrainz" + "musicbrainz" "fetchart" "embedart" "scrub" - "chroma" + "chroma" ]; per_disc_numbering = true; @@ -36,7 +36,7 @@ default = "$albumartist/$album%aunique{}/$track - $title"; }; - fetchart.auto = true; + fetchart.auto = true; embedart.auto = true; scrub.auto = true; }; diff --git a/modules/site/blog.nix b/modules/site/blog.nix index 2029760..3eff3f9 100644 --- a/modules/site/blog.nix +++ b/modules/site/blog.nix @@ -14,13 +14,7 @@ in enable = true; virtualHosts."grasswren.net".extraConfig = '' encode - root * ${website}/home - file_server - ''; - - virtualHosts."blog.grasswren.net".extraConfig = '' - encode - root * ${website}/blog + root * ${website} file_server ''; }; diff --git a/modules/site/code.nix b/modules/site/code.nix index 80819e9..7352097 100644 --- a/modules/site/code.nix +++ b/modules/site/code.nix @@ -20,13 +20,13 @@ user = "gitea"; }; - settings.service.DISABLE_REGISTRATION = true; + settings.service.DISABLE_REGISTRATION = true; }; services.caddy = { enable = true; - virtualHosts."code.grasswren.net".extraConfig = '' - reverse_proxy localhost:3000 - ''; + virtualHosts."code.grasswren.net".extraConfig = '' + reverse_proxy localhost:3000 + ''; }; } diff --git a/modules/site/music.nix b/modules/site/music.nix index 1c61dea..37b98d2 100644 --- a/modules/site/music.nix +++ b/modules/site/music.nix @@ -3,13 +3,13 @@ { services.navidrome = { enable = true; - settings.MusicFolder = "/var/lib/music"; + settings.MusicFolder = "/var/lib/music"; }; services.caddy = { enable = true; - virtualHosts."music.grasswren.net".extraConfig = '' + virtualHosts."music.grasswren.net".extraConfig = '' reverse_proxy localhost:4533 - ''; + ''; }; } diff --git a/modules/site/photo.nix b/modules/site/photo.nix index 0b2498d..7c7b589 100644 --- a/modules/site/photo.nix +++ b/modules/site/photo.nix @@ -3,15 +3,15 @@ { services.immich = { enable = true; - host = "127.0.0.1"; - port = 2283; - mediaLocation = "/var/lib/immich"; + host = "127.0.0.1"; + port = 2283; + mediaLocation = "/var/lib/immich"; }; services.caddy = { enable = true; - virtualHosts."photo.grasswren.net".extraConfig = '' + virtualHosts."photo.grasswren.net".extraConfig = '' reverse_proxy localhost:2283 - ''; + ''; }; } diff --git a/modules/site/vault.nix b/modules/site/vault.nix index 9481f8e..7b52139 100644 --- a/modules/site/vault.nix +++ b/modules/site/vault.nix @@ -3,7 +3,7 @@ { services.vaultwarden = { enable = true; - backupDir = "/var/lib/vault-backup"; + backupDir = "/var/lib/vault-backup"; config = { DOMAIN = "https://vault.example.com"; SIGNUPS_ALLOWED = false; @@ -14,8 +14,8 @@ services.caddy = { enable = true; - virtualHosts."vault.grasswren.net".extraConfig = '' - reverse_proxy localhost:8222 - ''; + virtualHosts."vault.grasswren.net".extraConfig = '' + reverse_proxy localhost:8222 + ''; }; } diff --git a/modules/site/vpn.nix b/modules/site/vpn.nix index a53e51b..3130b6b 100644 --- a/modules/site/vpn.nix +++ b/modules/site/vpn.nix @@ -3,29 +3,29 @@ { services.headscale = { enable = true; - settings = { + settings = { server_url = "https://vpn.grasswren.net"; - listen_addr = "127.0.0.1:8080"; + listen_addr = "127.0.0.1:8080"; - database.type = "sqlite"; + database.type = "sqlite"; - ip_prefixes = [ + ip_prefixes = [ "100.64.0.0/10" "fd7a:115c:a1e0::/48" ]; - dns = { - magic_domain = true; - base_domain = "vpn.grasswren.net"; - nameservers.global = [ "1.1.1.1" ]; - }; - }; + dns = { + magic_domain = true; + base_domain = "vpn.grasswren.net"; + nameservers.global = [ "1.1.1.1" ]; + }; + }; }; services.caddy = { enable = true; - virtualHosts."vpn.grasswren.net".extraConfig = '' - reverse_proxy localhost:8080 - ''; + virtualHosts."vpn.grasswren.net".extraConfig = '' + reverse_proxy localhost:8080 + ''; }; } diff --git a/modules/ssh.nix b/modules/ssh.nix index 72de762..9edbab2 100644 --- a/modules/ssh.nix +++ b/modules/ssh.nix @@ -3,19 +3,19 @@ { networking.firewall = { enable = true; - interfaces.wg0.allowedTCPPorts = [ 22 ]; + interfaces.wg0.allowedTCPPorts = [ 22 ]; }; services.openssh = { enable = true; - settings = { + settings = { PermitRootLogin = "prohibit-password"; - PasswordAuthentication = false; - KbdInteractiveAuthentication = false; - }; - listenAddresses = [{ + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + }; + listenAddresses = [{ addr = "0.0.0.0"; - port = 22; - }]; + port = 22; + }]; }; users.users.lilac.openssh.authorizedKeys.keys = [