diff options
| -rw-r--r-- | flake.lock | 69 | ||||
| -rw-r--r-- | flake.nix | 13 | ||||
| -rw-r--r-- | hosts.toml | 4 | ||||
| -rw-r--r-- | hosts/ganymede/config.nix | 33 | ||||
| -rw-r--r-- | hosts/ganymede/nixos.nix | 37 | ||||
| -rw-r--r-- | hosts/gliese-key.age | 18 | ||||
| -rw-r--r-- | hosts/mercury/config.nix | 7 | ||||
| -rw-r--r-- | hosts/mercury/nixos.nix | 33 | ||||
| -rw-r--r-- | modules/desktop/hjem/programs/firefox.nix | 4 | ||||
| -rw-r--r-- | modules/desktop/hjem/wm/sway.nix | 2 | ||||
| -rw-r--r-- | modules/services/nixos/copyparty.nix | 22 | ||||
| -rw-r--r-- | modules/services/nixos/goaccess.nix | 8 | ||||
| -rw-r--r-- | modules/services/nixos/minecraft.nix | 2 | ||||
| -rw-r--r-- | modules/services/nixos/openssh.nix | 59 | ||||
| -rw-r--r-- | modules/services/options.nix | 29 | ||||
| -rw-r--r-- | modules/terminal/hjem/programs/helix.nix | 3 | ||||
| -rw-r--r-- | secrets.nix | 1 |
17 files changed, 83 insertions, 261 deletions
@@ -180,6 +180,18 @@ "type": "github" } }, + "geolite-db": { + "flake": false, + "locked": { + "narHash": "sha256-+9DF7PHaxaMdrnf3IPnuM1Eyyr8MgUCiBBsO0PuaAD4=", + "type": "file", + "url": "https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-City.mmdb" + }, + "original": { + "type": "file", + "url": "https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-City.mmdb" + } + }, "gitignore": { "inputs": { "nixpkgs": [ @@ -202,26 +214,6 @@ "type": "github" } }, - "glide-browser": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1768858368, - "narHash": "sha256-EqqShMa+LXRymE8Vc3or5lHU2ftYTSEgixYtqwRpr0M=", - "owner": "glide-browser", - "repo": "glide.nix", - "rev": "93646ce641920fa1ed4917cc9dbfa56f15e90a06", - "type": "github" - }, - "original": { - "owner": "glide-browser", - "repo": "glide.nix", - "type": "github" - } - }, "hjem": { "inputs": { "nix-darwin": "nix-darwin", @@ -375,22 +367,6 @@ "type": "github" } }, - "nixpkgs_2": { - "locked": { - "lastModified": 1746663147, - "narHash": "sha256-Ua0drDHawlzNqJnclTJGf87dBmaO/tn7iZ+TCkTRpRc=", - "owner": "NixOS", - "repo": "nixpkgs", - "rev": "dda3dcd3fe03e991015e9a74b22d35950f264a54", - "type": "github" - }, - "original": { - "owner": "NixOS", - "ref": "nixos-unstable", - "repo": "nixpkgs", - "type": "github" - } - }, "pre-commit": { "inputs": { "flake-compat": "flake-compat", @@ -422,7 +398,7 @@ "disko": "disko", "firefox-csshacks": "firefox-csshacks", "fx-autoconfig": "fx-autoconfig", - "glide-browser": "glide-browser", + "geolite-db": "geolite-db", "hjem": "hjem", "lanzaboote": "lanzaboote", "nix-index-database": "nix-index-database", @@ -430,7 +406,6 @@ "nixpkgs": "nixpkgs", "tmux-tsunami": "tmux-tsunami", "uc-css-js": "uc-css-js", - "vermilion": "vermilion", "yoshi-lua": "yoshi-lua" } }, @@ -567,24 +542,6 @@ "type": "github" } }, - "vermilion": { - "inputs": { - "nixpkgs": "nixpkgs_2" - }, - "locked": { - "lastModified": 1770166629, - "narHash": "sha256-8gP9fuYIN6epnPskX12rm2vEu/u/MjwJ8ZvIAjoPmLk=", - "owner": "vaxerski", - "repo": "Vermilion", - "rev": "7b77acdeb4563351af215a13d77ba4a8cd93cd6c", - "type": "github" - }, - "original": { - "owner": "vaxerski", - "repo": "Vermilion", - "type": "github" - } - }, "yoshi-lua": { "flake": false, "locked": { @@ -29,19 +29,14 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - glide-browser = { - url = "github:glide-browser/glide.nix"; - inputs.nixpkgs.follows = "nixpkgs"; - }; - - vermilion = { - url = "github:vaxerski/Vermilion"; - }; - copyparty = { url = "github:9001/copyparty"; inputs.nixpkgs.follows = "nixpkgs"; }; + geolite-db = { + url = "file+https://github.com/P3TERX/GeoLite.mmdb/releases/latest/download/GeoLite2-City.mmdb"; + flake = false; + }; tmux-tsunami = { url = "github:bluedragon1221/tmux-tsunami"; @@ -13,7 +13,3 @@ host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB7feUHl5qoD5zF9AMOV2meViA+w [hosts.io] hostnames = ["io", "192.168.50.3"] host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXSvoVpMh/Y84THjKAYqkbuPmmv/yIU8DunMov7tKKT" - -[hosts.gliese] -hostnames = ["gliese", "20.251.8.247"] -host_pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBRa7adrNY1CskUWepNexmh86a6Lei8xuVzTCyEwbsnY" diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 6fe1e3e..c4d9109 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -8,11 +8,6 @@ owner = "wpa_supplicant"; }; - "gliese-key" = { - file = ../gliese-key.age; - owner = "collin"; - }; - "caddy-env".file = ./secrets/caddy-env.age; "collin-copyparty-password" = { @@ -55,18 +50,9 @@ services = { sshd = { enable = true; - portConfig = [ - { - port = 2222; - listenAddr = "0.0.0.0"; - rootLogin = true; - } - { - port = 22; - listenAddr = "0.0.0.0"; - rootLogin = true; - } - ]; + port = 22; + listenAddr = "0.0.0.0"; + rootLogin = true; }; goaccess = { @@ -83,21 +69,16 @@ privateUrl = "git.ganymede"; }; - agate = { - enable = true; - publicUrl = "williamsfam.us.com"; - }; + # agate = { + # enable = true; + # publicUrl = "williamsfam.us.com"; + # }; minecraft = { enable = true; listenAddr = "0.0.0.0"; }; - polaris = { - enable = true; - privateUrl = "music.ganymede"; - }; - qbittorrent = { enable = true; privateUrl = "bittorrent.ganymede"; diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix index a2314ee..a706b5f 100644 --- a/hosts/ganymede/nixos.nix +++ b/hosts/ganymede/nixos.nix @@ -16,8 +16,6 @@ facter.reportPath = ./facter.json; - virtualisation.oci-containers.backend = "docker"; # fix weird issue with minecraft server (only thing running in docker right now) - # backup usb teather configuration systemd.network.networks."80-usb-teather" = { name = "enp0s20f0u2"; @@ -31,43 +29,8 @@ wantedBy = ["default.target"]; }; - # VPN to server - systemd.network = { - netdevs."10-wg0" = { - netdevConfig = { - Kind = "wireguard"; - Name = "wg0"; - }; - wireguardConfig = { - PrivateKeyFile = config.collinux.secrets."wireguard-pk".path; - ListenPort = 51820; - }; - wireguardPeers = [ - { - PublicKey = "seOq75FUGb+KThvOXCEAGdabWbb+jTRUntITpuAPgWA="; - AllowedIPs = "0.0.0.0/0"; - Endpoint = "20.251.8.247:51820"; - PersistentKeepalive = 25; - } - ]; - }; - networks."wg0" = { - matchConfig.Name = "wg0"; - address = ["10.100.0.2/24"]; - DHCP = "no"; - networkConfig.IPv6AcceptRA = false; - }; - }; - services.fail2ban.enable = true; - programs.ssh.extraConfig = '' - Host gliese - HostName 10.100.0.1 - User green - IdentityFile ${config.collinux.secrets."gliese-key".path} - ''; - # merge logs from subdomains services.caddy.virtualHosts."up.williamsfam.us.com".logFormat = lib.mkForce '' output file /var/log/caddy/access-williamsfam.us.com.log diff --git a/hosts/gliese-key.age b/hosts/gliese-key.age deleted file mode 100644 index 6fc5ce5..0000000 --- a/hosts/gliese-key.age +++ /dev/null @@ -1,18 +0,0 @@ ------BEGIN AGE ENCRYPTED FILE----- -YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyA0RCtu -NWFrbW0zTU53Rk05NzRUUG1oRG4rK05EM1pnYTYwaEpCYWZBbFFrCmM3TmtRandq -TnBVVk9ZRm1oMzlIajR1b1RJdHl4MERtbkw1MmQ3em55cncKLT4gc3NoLWVkMjU1 -MTkgSmc0eVdRIGJPcG56L3c0QUovSVJsVDlrTkJhNTBaSXlzQkkweU1mcTB5dEtK -SDhKekUKaWEzdTUvbU5seVkvZUJDQW9XTVQ1bEJzWU5XVU5VREhIMnFxd0FRWHhS -dwotPiAyQC1ncmVhc2UgLE85NyBOZ2ssbmIKMEN1MWNWL2dWZwotLS0gazN5U0xM -ZjhXV1B2MmlhUm5rQXJGcWJKcVRUdXZ5Z3cxWEN2a3FVdEJWMAqoHBpRSjJB1CKI -fWVLuRxB5c/gBXoiE8VfQ7O5v1JN6ZJ7C9m+d6PcgSKaCjEgPdnRxxe7JCDc3dUS -cnebY/h7q+vAkLTqvtuiBMw67c5p79/EW7FpN6Wzzmc9wIHvbPf0zsn4EOqfc24I -cuB55uviE0//E3Xh6iRvvx5XEgSBUGLeycZa5P0fmUJUOhG9CtJya4D2tB6huyNK -2+dJgQdFkXghinzPQimnDXYhoD7PTM6yGaJQdrB0GT6lXMCBlRB9p2uEArrVYhJu -/vAXFsGxENjI7XvH1RabM1gLN7Eytq/ptz+9/S/sMQ4D4FPp3L2gHklEqepOv3Df -z1b7PA5aOQj3+jlpcAUkfKtgA32vT7KddlRXQWHzC7VyuEpGjT+qydNet+tBW5Z6 -DDNc/LJ/sNvOsBQE2wqvi4/bLpAG2By6CKrZYZrE+l1zJMWkbT6QnOR9/aby15am -iSq4agnTdxsx3JrJ+V5thUyDNrAIY/DQg0rLfoGy37g877vENco+3USdoOeRJjHD -1yRjq39y8h4EQCyeaAx0h3MQEJMiReHxbQ== ------END AGE ENCRYPTED FILE----- diff --git a/hosts/mercury/config.nix b/hosts/mercury/config.nix index 12518f4..d2164c4 100644 --- a/hosts/mercury/config.nix +++ b/hosts/mercury/config.nix @@ -2,12 +2,7 @@ collinux = { theme = "catppuccin"; - secrets = { - "gliese-key" = { - file = ../gliese-key.age; - owner = "collin"; - }; - }; + secrets = {}; user.useRun0 = true; diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix index 3f5c0b0..8fcb504 100644 --- a/hosts/mercury/nixos.nix +++ b/hosts/mercury/nixos.nix @@ -1,19 +1,20 @@ { lib, inputs, - config, ... }: { imports = [ ./disks.nix ./battery.nix - # ./ai.nix inputs.nixos-facter-modules.nixosModules.facter inputs.lanzaboote.nixosModules.lanzaboote ]; facter.reportPath = ./facter.json; + services.dbus.implementation = "broker"; + + environment.defaultPackages = lib.mkForce []; # im not a noob services.syncthing = { enable = true; @@ -26,14 +27,14 @@ name = "ganymede"; user = "collin"; monitoringPort = 20000; - extraArguments = "-N -D 9090 -L 4141:localhost:4141 collin@williamsfam.us.com"; + extraArguments = "-N -D 9090 collin@williamsfam.us.com"; } ]; - - services.dbus.implementation = "broker"; - - environment.defaultPackages = lib.mkForce []; # im not a noob - + programs.ssh.extraConfig = '' + Host ganymede + HostName williamsfam.us.com + Port 22 + ''; security.pki.certificates = [ '' -----BEGIN CERTIFICATE----- @@ -50,22 +51,6 @@ '' ]; - programs.ssh.extraConfig = '' - Match host ganymede exec "nc -z -w1 192.168.50.2 2222" - HostName 192.168.50.2 - Port 2222 - - Host ganymede - HostName williamsfam.us.com - Port 22 - - Host gliese - HostName 10.100.0.1 - User green - IdentityFile ${config.collinux.secrets."gliese-key".path} - ProxyJump collin@ganymede - ''; - programs.firefox.policies.ExtensionSettings = { "foxyproxy@eric.h.jung" = { installation_mode = "force_installed"; diff --git a/modules/desktop/hjem/programs/firefox.nix b/modules/desktop/hjem/programs/firefox.nix index 46d2dd5..cf9c532 100644 --- a/modules/desktop/hjem/programs/firefox.nix +++ b/modules/desktop/hjem/programs/firefox.nix @@ -35,6 +35,8 @@ in "${profileDir}/chrome/JS/test.uc.js".source = "${inputs.fx-autoconfig}/profile/chrome/JS/test.uc.js"; + "${profileDir}/chrome/JS/aboutCfg.sys.mjs".source = "${inputs.uc-css-js}/JS/aboutCfg.sys.mjs"; + "${profileDir}/chrome/JS/aboutUserChrome.sys.mjs".source = "${inputs.uc-css-js}/JS/aboutUserChrome.sys.mjs"; "${profileDir}/chrome/resources/aboutuserchrome".source = "${inputs.uc-css-js}/resources/aboutuserchrome"; @@ -62,6 +64,4 @@ in "compact_extensions_panel" ]; }; - - packages = [pkgs.firefox]; } diff --git a/modules/desktop/hjem/wm/sway.nix b/modules/desktop/hjem/wm/sway.nix index 03450d2..c880a1b 100644 --- a/modules/desktop/hjem/wm/sway.nix +++ b/modules/desktop/hjem/wm/sway.nix @@ -59,7 +59,7 @@ Mod4+Return exec ${pkgs.foot}/bin/foot Mod4+Space exec tofi-drun - Mod4+b exec ${pkgs.firefox}/bin/firefox + Mod4+b exec firefox Mod4+Shift+b exec ${pkgs.qutebrowser}/bin/qutebrowser Mod4+w exec '${pkgs.iwmenu}/bin/iwmenu -l fuzzel -i font -s 2' diff --git a/modules/services/nixos/copyparty.nix b/modules/services/nixos/copyparty.nix index cfc69bc..0e607e2 100644 --- a/modules/services/nixos/copyparty.nix +++ b/modules/services/nixos/copyparty.nix @@ -78,21 +78,6 @@ in { e2ts = true; # enable music indexing }; }; - - "/incoming" = { - path = "/media/incoming"; - access = { - wG = "*"; - A = "@admin"; - }; - flags = { - fk = 6; - dk = 6; - lifetime = 21600; # files deleted after 6hrs - nosub = true; # must upload to top-level folder - maxb = "20g,21600"; # each IP can upload a max of 20GB every 6 hrs - }; - }; } ] ++ lib.lists.flatten (cfg.users @@ -100,16 +85,13 @@ in { { "/${k}" = { path = "/media/${k}"; - access.A = k; + access.rwd = k; }; } (lib.optionalAttrs v.hasPublicDir { "/public/${k}" = { path = "/media/${k}/public"; - access = { - r = "*"; - A = k; - }; + access.r = "*"; }; }) ]))); diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix index bb174cb..703e263 100644 --- a/modules/services/nixos/goaccess.nix +++ b/modules/services/nixos/goaccess.nix @@ -1,22 +1,18 @@ { config, pkgs, + inputs, lib, ... }: let cfg = config.collinux.services.goaccess; - geoip = pkgs.fetchurl { - url = "https://github.com/P3TERX/GeoLite.mmdb/releases/download/2026.03.01/GeoLite2-City.mmdb"; - hash = "sha256-SZ/m8b53sawF86Ak46uX7CxdzEMFrmob7Yd12Y+xJfA="; - }; - settings = { date-format = "%s"; log-format = "CADDY"; tz = config.time.timeZone; log-file = "/var/log/caddy/access-williamsfam.us.com.log"; - geoip-database = geoip; + geoip-database = inputs.geolite-db; ws-url = if cfg.publicUrl != null diff --git a/modules/services/nixos/minecraft.nix b/modules/services/nixos/minecraft.nix index fa7ae40..1b8b047 100644 --- a/modules/services/nixos/minecraft.nix +++ b/modules/services/nixos/minecraft.nix @@ -24,5 +24,7 @@ in image = "itzg/minecraft-bedrock-server"; ports = ["${cfg.listenAddr}:${toString cfg.port}:19132/udp"]; volumes = ["/var/lib/minecraft/:/data"]; + + extraOptions = ["--no-healthcheck"]; }; } diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix index be2b51c..2d0c45c 100644 --- a/modules/services/nixos/openssh.nix +++ b/modules/services/nixos/openssh.nix @@ -7,9 +7,6 @@ }: let cfg = config.collinux.services.sshd; - anyAttr = attr: cfg.portConfig |> builtins.map (x: x.${attr} != null) |> builtins.any (x: x); - anyOTP = cfg.portConfig |> builtins.map (x: x.otp == true) |> builtins.any (x: x); - authorizedKeys = hosts |> builtins.mapAttrs (_: data: data.user_pubkey or null) @@ -17,7 +14,7 @@ |> builtins.filter (x: x != null); in { config = lib.mkIf cfg.enable { - networking.firewall.allowedTCPPorts = cfg.portConfig |> builtins.map (x: x.port); + networking.firewall.allowedTCPPorts = [cfg.port]; services.openssh = { enable = true; @@ -30,12 +27,12 @@ in { } ]; - listenAddresses = - cfg.portConfig - |> builtins.map (x: { - addr = x.listenAddr; - port = x.port; - }); + listenAddresses = [ + { + addr = cfg.listenAddr; + port = cfg.port; + } + ]; # Lock down everything by default settings = { @@ -46,30 +43,26 @@ in { AllowAgentForwarding = false; }; - extraConfig = - cfg.portConfig - |> builtins.map (x: - lib.concatStringsSep "\n" [ - "Match LocalPort ${toString x.port}" - ( - if x.otp - then '' - ChallengeResponseAuthentication yes - PubkeyAuthentication yes - KbdInteractiveAuthentication yes - AuthenticationMethods publickey,keyboard-interactive:pam - '' - else '' - PubkeyAuthentication yes - AuthenticationMethods publickey - '' - ) - (lib.optionalString x.rootLogin "PermitRootLogin yes") - ]) - |> lib.concatStringsSep "\n\n"; + extraConfig = lib.concatStringsSep "\n" [ + "Match LocalPort ${toString cfg.port}" + ( + if cfg.otp + then '' + ChallengeResponseAuthentication yes + PubkeyAuthentication yes + KbdInteractiveAuthentication yes + AuthenticationMethods publickey,keyboard-interactive:pam + '' + else '' + PubkeyAuthentication yes + AuthenticationMethods publickey + '' + ) + (lib.optionalString cfg.rootLogin "PermitRootLogin yes") + ]; }; - security.pam.services = lib.optionalAttrs anyOTP { + security.pam.services = lib.optionalAttrs cfg.otp { login.googleAuthenticator.enable = true; sshd.text = '' @@ -86,7 +79,7 @@ in { }; users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys; - users.users."root".openssh.authorizedKeys.keys = lib.mkIf (anyAttr "rootLogin") authorizedKeys; + users.users."root".openssh.authorizedKeys.keys = lib.mkIf cfg.rootLogin authorizedKeys; systemd.services."openssh" = { after = lib.mkAfter ["network-online.target"]; diff --git a/modules/services/options.nix b/modules/services/options.nix index 17a4e6b..70fd695 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -56,26 +56,19 @@ in { sshd = { enable = mkEnableOption "OpenSSH server"; - portConfig = mkOption { - description = "List of ssh bind hosts. see submodule options for details"; - type = lib.types.listOf (lib.types.submodule { - options = { - port = mkOption { - description = "Port to run on"; - type = lib.types.port; - }; - - listenAddr = mkOption { - description = "Address to listen on"; - type = lib.types.str; - default = "127.0.0.1"; - }; + port = mkOption { + description = "Port to run on"; + type = lib.types.port; + }; - otp = mkEnableOption "Whether to require TOTP (Google Authenticator) 2fa codes for this port"; - rootLogin = mkEnableOption "Whether to allow root login for this port"; - }; - }); + listenAddr = mkOption { + description = "Address to listen on"; + type = lib.types.str; + default = "127.0.0.1"; }; + + otp = mkEnableOption "Whether to require TOTP (Google Authenticator) 2fa codes"; + rootLogin = mkEnableOption "Whether to allow root login"; }; forgejo = webserviceOptions { diff --git a/modules/terminal/hjem/programs/helix.nix b/modules/terminal/hjem/programs/helix.nix index a544616..5a8db19 100644 --- a/modules/terminal/hjem/programs/helix.nix +++ b/modules/terminal/hjem/programs/helix.nix @@ -33,6 +33,9 @@ command = "${pkgs.superhtml}/bin/superhtml"; args = ["lsp"]; }; + golsp = { + command = "${pkgs.gopls}/bin/gopls"; + }; dhall-lsp-server.command = "${pkgs.dhall-lsp-server}/bin/dhall-lsp-server"; }; diff --git a/secrets.nix b/secrets.nix index 75733c7..67ab5fd 100644 --- a/secrets.nix +++ b/secrets.nix @@ -2,7 +2,6 @@ let inherit ((builtins.fromTOML (builtins.readFile ./hosts.toml)).hosts) mercury ganymede jupiter; in { "modules/terminal/nixos/github-ssh-key.age".publicKeys = [mercury.host_pubkey jupiter.host_pubkey ganymede.host_pubkey]; - "hosts/gliese-key.age".publicKeys = [mercury.host_pubkey ganymede.host_pubkey]; "hosts/ganymede/secrets/caddy-env.age".publicKeys = [ganymede.host_pubkey]; "hosts/ganymede/secrets/williams-psk.age".publicKeys = [ganymede.host_pubkey]; |