Lilac/Chickadee
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update lock file remove tabs

Browse Source
This commit is contained in:
Lilac
2026-09-12 20:33:30 -04:00
parent 7142cba4c2
commit f8e9d1ab30
14 changed files with 159 additions and 171 deletions
Download Patch File Download Diff File Expand all files Collapse all files
flake.lock
Generated
+16 -16
View File
@@ -9,11 +9,11 @@
"utils": "utils" "utils": "utils"
}, },
"locked": { "locked": {
"lastModified": 1785518313, "lastModified": 1788879443,
"narHash": "sha256-anlq3YQDCsNrkNlu3HTg4dEIpRugwnyAVUxoPcBmA/U=", "narHash": "sha256-qb9sL86UCUEd3SYAda4ItN1NV0vhMSdbpA64WckvVI0=",
"owner": "serokell", "owner": "serokell",
"repo": "deploy-rs", "repo": "deploy-rs",
"rev": "b974715a27b49fadbf3bf6d85e26bcb3109daa6d", "rev": "414ac5f35d79aabe5a0bf52451d8cf61eadf6c88",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -58,11 +58,11 @@
"grasswren": { "grasswren": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1783801496, "lastModified": 1788394295,
"narHash": "sha256-awQZQVk5jz8ZyNCEnqarBZENKP7RvKHN8QRuDQJY7YA=", "narHash": "sha256-Fg8PUA0tG5/N8fYWpsOHo0j1+Bnez8G0d8Xd3K63zb8=",
"ref": "main", "ref": "main",
"rev": "4d505fe6467e14b6e37b89e2e9e3a3b2bbf6649f", "rev": "5123b8e9873b7f413c080ba97f01feb85be51808",
"revCount": 4, "revCount": 5,
"type": "git", "type": "git",
"url": "https://code.grasswren.net/Lilac/Grasswren.git" "url": "https://code.grasswren.net/Lilac/Grasswren.git"
}, },
@@ -79,11 +79,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1785119570, "lastModified": 1789182507,
"narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=", "narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d", "rev": "b1d1b60084970f9d1e2b72662639dab6d039be71",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -111,11 +111,11 @@
}, },
"nixpkgs_2": { "nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1785599192, "lastModified": 1789114715,
"narHash": "sha256-dg4RTtDxnXY13UkJNdhmgTUTl0n/IJBlCigfO7nutZw=", "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "6d65bfc1bcef2ef39a239d38e577e92a89fb0f07", "rev": "21a67dc470149f337cecafbe965d8d252a390518",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -156,11 +156,11 @@
"nixpkgs": "nixpkgs_3" "nixpkgs": "nixpkgs_3"
}, },
"locked": { "locked": {
"lastModified": 1783174389, "lastModified": 1788914643,
"narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=", "narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
"owner": "Mic92", "owner": "Mic92",
"repo": "sops-nix", "repo": "sops-nix",
"rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9", "rev": "13616fff713a9f94055c66f15687ebdc17a335df",
"type": "github" "type": "github"
}, },
"original": { "original": {
flake.nix
+17 -23
View File
@@ -40,8 +40,9 @@
home-manager.nixosModules.home-manager home-manager.nixosModules.home-manager
./hosts/vps/default.nix ./hosts/vps/default.nix
]; ];
}; };
backup = nixpkgs.lib.nixosSystem {
backup = nixpkgs.lib.nixosSystem {
system = "x86_64-linux"; system = "x86_64-linux";
specialArgs = { inherit inputs; }; specialArgs = { inherit inputs; };
modules = [ modules = [
@@ -51,18 +52,20 @@
}; };
}; };
homeConfigurations.lilac = home-manager.lib.homeManagerConfiguration {
pkgs = import nixpkgs { system = "x86_64-linux"; };
modules = [
./home/lilac.nix
];
};
# nix run github:nix-community/nixos-anywhere -- --flake .#<CONFIGURATION> --phases install root@<ADDRESS>
# nix run github:serokell/deploy-rs
deploy.nodes = { deploy.nodes = {
desktop = {
hostname = "10.0.0.2";
sshUser = "root";
magicRollbackTimeout = 120;
profiles.system = {
user = "root";
remoteBuild = false;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
};
};
vps = { vps = {
hostname = "216.128.177.13"; hostname = "10.0.0.3";
sshUser = "root"; sshUser = "root";
magicRollbackTimeout = 120; magicRollbackTimeout = 120;
profiles.system = { profiles.system = {
@@ -72,16 +75,6 @@
}; };
}; };
desktop = {
hostname = "192.168.1.133";
sshUser = "root";
magicRollbackTimeout = 120;
profiles.system = {
user = "root";
remoteBuild = false;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.desktop;
};
};
backup = { backup = {
hostname = "10.0.0.4"; hostname = "10.0.0.4";
sshUser = "root"; sshUser = "root";
@@ -92,7 +85,8 @@
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup; path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.backup;
}; };
}; };
}; };
checks = { checks = {
x86_64-linux = deploy-rs.lib.x86_64-linux.deployChecks self.deploy; x86_64-linux = deploy-rs.lib.x86_64-linux.deployChecks self.deploy;
}; };
hosts/backup/default.nix
+24 -24
View File
@@ -7,16 +7,16 @@
users.users.lilac = { users.users.lilac = {
isNormalUser = true; isNormalUser = true;
group = "lilac"; group = "lilac";
extraGroups = [ "wheel" ]; extraGroups = [ "wheel" ];
}; };
users.groups.lilac = {}; users.groups.lilac = {};
home-manager = { home-manager = {
useGlobalPkgs = true; useGlobalPkgs = true;
useUserPackages = true; useUserPackages = true;
users.lilac = import ../../home/lilac.nix; users.lilac = import ../../home/lilac.nix;
}; };
programs.zsh.enable = true; programs.zsh.enable = true;
users.users.lilac.shell = pkgs.zsh; users.users.lilac.shell = pkgs.zsh;
security.sudo.wheelNeedsPassword = false; security.sudo.wheelNeedsPassword = false;
@@ -62,8 +62,8 @@
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
whipper whipper
flac flac
tor-browser tor-browser
]; ];
networking.wireless.enable = true; networking.wireless.enable = true;
@@ -73,22 +73,22 @@
networking = { networking = {
firewall = { firewall = {
enable = true; enable = true;
allowedUDPPorts = [ 51820 ]; allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ]; trustedInterfaces = [ "wg0" ];
}; };
wireguard.interfaces."wg0" = { wireguard.interfaces."wg0" = {
ips = [ "10.0.0.4/24" ]; ips = [ "10.0.0.4/24" ];
generatePrivateKeyFile = true; generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key"; privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{ peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k="; publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ]; allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820"; endpoint = "216.128.177.13:51820";
persistentKeepalive = 25; persistentKeepalive = 25;
}]; }];
}; };
}; };
nixpkgs.config.allowUnfree = true; nixpkgs.config.allowUnfree = true;
@@ -99,10 +99,10 @@ networking = {
services.restic.server = { services.restic.server = {
enable = true; enable = true;
listenAddress = "10.0.0.4:8000"; listenAddress = "10.0.0.4:8000";
dataDir = "/var/lib/restic"; dataDir = "/var/lib/restic";
appendOnly = true; appendOnly = true;
extraFlags = [ "--no-auth" ]; extraFlags = [ "--no-auth" ];
}; };
networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ]; networking.firewall.interfaces.wg0.allowedTCPPorts = [ 8000 ];
hosts/desktop/default.nix
+25 -25
View File
@@ -9,17 +9,17 @@
../../modules/site/mail.nix ../../modules/site/mail.nix
../../modules/site/music.nix ../../modules/site/music.nix
../../modules/site/photo.nix ../../modules/site/photo.nix
../../modules/site/vault.nix ../../modules/site/vault.nix
../../modules/ssh.nix ../../modules/ssh.nix
]; ];
networking.hostName = "desktop"; networking.hostName = "desktop";
users.users.lilac = { users.users.lilac = {
isNormalUser = true; isNormalUser = true;
group = "lilac"; group = "lilac";
extraGroups = [ "wheel" "render" "video" "input" "uinput" ]; extraGroups = [ "wheel" "render" "video" "input" "uinput" ];
}; };
users.groups.lilac = {}; users.groups.lilac = {};
home-manager = { home-manager = {
@@ -102,31 +102,31 @@
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
whipper whipper
flac flac
tor-browser tor-browser
restic restic
]; ];
programs.steam.enable = true; programs.steam.enable = true;
networking = { networking = {
firewall = { firewall = {
enable = true; enable = true;
allowedUDPPorts = [ 51820 ]; allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ]; trustedInterfaces = [ "wg0" ];
}; };
wireguard.interfaces."wg0" = { wireguard.interfaces."wg0" = {
ips = [ "10.0.0.2/24" ]; ips = [ "10.0.0.2/24" ];
generatePrivateKeyFile = true; generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key"; privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [{ peers = [{
publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k="; publicKey = "Tst6SiqoGLSoOAF9l5vT2vvR2RGJ/mFcoBL3BL5n90k=";
allowedIPs = [ "10.0.0.0/24" ]; allowedIPs = [ "10.0.0.0/24" ];
endpoint = "216.128.177.13:51820"; endpoint = "216.128.177.13:51820";
persistentKeepalive = 25; persistentKeepalive = 25;
}]; }];
}; };
}; };
nixpkgs.config.allowUnfree = true; nixpkgs.config.allowUnfree = true;
@@ -135,10 +135,10 @@
services.restic.backups.backup = { services.restic.backups.backup = {
repository = "rest:http://10.0.0.4:8000/backup"; repository = "rest:http://10.0.0.4:8000/backup";
initialize = true; initialize = true;
passwordFile = "/home/lilac/test-password"; passwordFile = "/home/lilac/test-password";
paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ]; paths = [ "/var/lib/immich" "/var/lib/music" "/var/lib/gitea" "/var/lib/vault-backup" ];
timerConfig.OnCalendar = "03:30"; timerConfig.OnCalendar = "03:30";
pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ]; pruneOpts = [ "--keep-daily 7" "--keep-weekly 4" "--keep-monthly 12" ];
}; };
} }
hosts/vps/default.nix
+30 -30
View File
@@ -11,8 +11,8 @@
users.users.lilac = { users.users.lilac = {
isNormalUser = true; isNormalUser = true;
group = "lilac"; group = "lilac";
extraGroups = [ "wheel" ]; extraGroups = [ "wheel" ];
}; };
users.groups.lilac = {}; users.groups.lilac = {};
home-manager = { home-manager = {
@@ -27,47 +27,47 @@
# forwarding inbound network traffic over wireguard # forwarding inbound network traffic over wireguard
networking = { networking = {
firewall = { firewall = {
enable = true; enable = true;
allowedTCPPorts = [ 80 443 ]; allowedTCPPorts = [ 80 443 ];
allowedUDPPorts = [ 51820 ]; allowedUDPPorts = [ 51820 ];
trustedInterfaces = [ "wg0" ]; trustedInterfaces = [ "wg0" ];
}; };
wireguard.interfaces."wg0" = { wireguard.interfaces."wg0" = {
ips = [ "10.0.0.3/24" ]; ips = [ "10.0.0.3/24" ];
listenPort = 51820; listenPort = 51820;
generatePrivateKeyFile = true; generatePrivateKeyFile = true;
privateKeyFile = "/var/lib/wireguard/wg0.key"; privateKeyFile = "/var/lib/wireguard/wg0.key";
peers = [ peers = [
{ {
allowedIPs = [ "10.0.0.1/32" ]; allowedIPs = [ "10.0.0.1/32" ];
publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw="; publicKey = "guKFJGQW946HXWjca/biMYH1nJKw0fguLjzGXKZ7Bxw=";
} }
{ {
allowedIPs = [ "10.0.0.2/32" ]; allowedIPs = [ "10.0.0.2/32" ];
publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk="; publicKey = "7BcwtszpzS4ABDwKwMaiJ7F35sJRa89fBbuh80Sk8Uk=";
} }
{ {
allowedIPs = [ "10.0.0.4/32" ]; allowedIPs = [ "10.0.0.4/32" ];
publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ="; publicKey = "XjuV3wzkP03UUjYSJfY3OG3WWLRtoQBN7GokDEWhdhQ=";
} }
]; ];
}; };
nftables = { nftables = {
enable = true; enable = true;
tables.nat = { tables.nat = {
family = "ip"; family = "ip";
content = '' content = ''
chain prerouting { chain prerouting {
type nat hook prerouting priority dstnat; policy accept; type nat hook prerouting priority dstnat; policy accept;
iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2 iifname "enp1s0" tcp dport { 80, 443 } dnat to 10.0.0.2
} }
chain postrouting { chain postrouting {
type nat hook postrouting priority srcnat; policy accept; type nat hook postrouting priority srcnat; policy accept;
oifname "wg0" masquerade oifname "wg0" masquerade
} }
''; '';
}; };
}; };
}; };
boot.kernel.sysctl = { boot.kernel.sysctl = {
"net.ipv4.ip_forward" = 1; "net.ipv4.ip_forward" = 1;
hosts/vps/hardware-configuration.nix
+5 -5
View File
@@ -3,11 +3,11 @@
{ {
boot = { boot = {
initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ]; initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
kernelModules = [ ]; kernelModules = [ ];
extraModulePackages = [ ]; extraModulePackages = [ ];
loader.systemd-boot.enable = true; loader.systemd-boot.enable = true;
loader.efi.canTouchEfiVariables = true; loader.efi.canTouchEfiVariables = true;
loader.efi.efiSysMountPoint = "/boot/efi"; loader.efi.efiSysMountPoint = "/boot/efi";
}; };
fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; }; fileSystems."/" = { device = "/dev/vda2"; fsType = "ext4"; };
modules/ripping.nix
+4 -4
View File
@@ -3,7 +3,7 @@
{ {
home.packages = with pkgs; [ home.packages = with pkgs; [
whipper whipper
beets beets
]; ];
programs.beets = { programs.beets = {
@@ -14,11 +14,11 @@
library = "/var/lib/music/library.db"; library = "/var/lib/music/library.db";
plugins = [ plugins = [
"musicbrainz" "musicbrainz"
"fetchart" "fetchart"
"embedart" "embedart"
"scrub" "scrub"
"chroma" "chroma"
]; ];
per_disc_numbering = true; per_disc_numbering = true;
@@ -36,7 +36,7 @@
default = "$albumartist/$album%aunique{}/$track - $title"; default = "$albumartist/$album%aunique{}/$track - $title";
}; };
fetchart.auto = true; fetchart.auto = true;
embedart.auto = true; embedart.auto = true;
scrub.auto = true; scrub.auto = true;
}; };
modules/site/blog.nix
+1 -7
View File
@@ -14,13 +14,7 @@ in
enable = true; enable = true;
virtualHosts."grasswren.net".extraConfig = '' virtualHosts."grasswren.net".extraConfig = ''
encode encode
root * ${website}/home root * ${website}
file_server
'';
virtualHosts."blog.grasswren.net".extraConfig = ''
encode
root * ${website}/blog
file_server file_server
''; '';
}; };
modules/site/code.nix
+4 -4
View File
@@ -20,13 +20,13 @@
user = "gitea"; user = "gitea";
}; };
settings.service.DISABLE_REGISTRATION = true; settings.service.DISABLE_REGISTRATION = true;
}; };
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts."code.grasswren.net".extraConfig = '' virtualHosts."code.grasswren.net".extraConfig = ''
reverse_proxy localhost:3000 reverse_proxy localhost:3000
''; '';
}; };
} }
modules/site/music.nix
+3 -3
View File
@@ -3,13 +3,13 @@
{ {
services.navidrome = { services.navidrome = {
enable = true; enable = true;
settings.MusicFolder = "/var/lib/music"; settings.MusicFolder = "/var/lib/music";
}; };
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts."music.grasswren.net".extraConfig = '' virtualHosts."music.grasswren.net".extraConfig = ''
reverse_proxy localhost:4533 reverse_proxy localhost:4533
''; '';
}; };
} }
modules/site/photo.nix
+5 -5
View File
@@ -3,15 +3,15 @@
{ {
services.immich = { services.immich = {
enable = true; enable = true;
host = "127.0.0.1"; host = "127.0.0.1";
port = 2283; port = 2283;
mediaLocation = "/var/lib/immich"; mediaLocation = "/var/lib/immich";
}; };
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts."photo.grasswren.net".extraConfig = '' virtualHosts."photo.grasswren.net".extraConfig = ''
reverse_proxy localhost:2283 reverse_proxy localhost:2283
''; '';
}; };
} }
modules/site/vault.nix
+4 -4
View File
@@ -3,7 +3,7 @@
{ {
services.vaultwarden = { services.vaultwarden = {
enable = true; enable = true;
backupDir = "/var/lib/vault-backup"; backupDir = "/var/lib/vault-backup";
config = { config = {
DOMAIN = "https://vault.example.com"; DOMAIN = "https://vault.example.com";
SIGNUPS_ALLOWED = false; SIGNUPS_ALLOWED = false;
@@ -14,8 +14,8 @@
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts."vault.grasswren.net".extraConfig = '' virtualHosts."vault.grasswren.net".extraConfig = ''
reverse_proxy localhost:8222 reverse_proxy localhost:8222
''; '';
}; };
} }
modules/site/vpn.nix
+13 -13
View File
@@ -3,29 +3,29 @@
{ {
services.headscale = { services.headscale = {
enable = true; enable = true;
settings = { settings = {
server_url = "https://vpn.grasswren.net"; server_url = "https://vpn.grasswren.net";
listen_addr = "127.0.0.1:8080"; listen_addr = "127.0.0.1:8080";
database.type = "sqlite"; database.type = "sqlite";
ip_prefixes = [ ip_prefixes = [
"100.64.0.0/10" "100.64.0.0/10"
"fd7a:115c:a1e0::/48" "fd7a:115c:a1e0::/48"
]; ];
dns = { dns = {
magic_domain = true; magic_domain = true;
base_domain = "vpn.grasswren.net"; base_domain = "vpn.grasswren.net";
nameservers.global = [ "1.1.1.1" ]; nameservers.global = [ "1.1.1.1" ];
}; };
}; };
}; };
services.caddy = { services.caddy = {
enable = true; enable = true;
virtualHosts."vpn.grasswren.net".extraConfig = '' virtualHosts."vpn.grasswren.net".extraConfig = ''
reverse_proxy localhost:8080 reverse_proxy localhost:8080
''; '';
}; };
} }
modules/ssh.nix
+8 -8
View File
@@ -3,19 +3,19 @@
{ {
networking.firewall = { networking.firewall = {
enable = true; enable = true;
interfaces.wg0.allowedTCPPorts = [ 22 ]; interfaces.wg0.allowedTCPPorts = [ 22 ];
}; };
services.openssh = { services.openssh = {
enable = true; enable = true;
settings = { settings = {
PermitRootLogin = "prohibit-password"; PermitRootLogin = "prohibit-password";
PasswordAuthentication = false; PasswordAuthentication = false;
KbdInteractiveAuthentication = false; KbdInteractiveAuthentication = false;
}; };
listenAddresses = [{ listenAddresses = [{
addr = "0.0.0.0"; addr = "0.0.0.0";
port = 22; port = 22;
}]; }];
}; };
users.users.lilac.openssh.authorizedKeys.keys = [ users.users.lilac.openssh.authorizedKeys.keys = [