diff options
| -rw-r--r-- | flake.lock | 35 | ||||
| -rw-r--r-- | flake.nix | 4 | ||||
| -rw-r--r-- | hosts/ganymede/config.nix | 6 | ||||
| -rw-r--r-- | hosts/mercury/hjem.nix | 1 | ||||
| -rw-r--r-- | modules/desktop/nixos/programs/firefox.nix | 1 | ||||
| -rw-r--r-- | modules/services/nixos/cgit/gitShellCommands.nix | 77 | ||||
| -rw-r--r-- | modules/services/nixos/goaccess.nix | 12 | ||||
| -rw-r--r-- | modules/services/nixos/qbittorrent.nix | 6 | ||||
| -rw-r--r-- | modules/system/nixos/networking/default.nix | 6 |
9 files changed, 99 insertions, 49 deletions
@@ -377,6 +377,22 @@ "type": "github" } }, + "nixpkgs_2": { + "locked": { + "lastModified": 1746663147, + "narHash": "sha256-Ua0drDHawlzNqJnclTJGf87dBmaO/tn7iZ+TCkTRpRc=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "dda3dcd3fe03e991015e9a74b22d35950f264a54", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, "nmd": { "locked": { "lastModified": 1759339018, @@ -430,6 +446,7 @@ "nixpkgs": "nixpkgs", "nmd": "nmd", "tmux-tsunami": "tmux-tsunami", + "vermilion": "vermilion", "yoshi-lua": "yoshi-lua" } }, @@ -583,6 +600,24 @@ "type": "github" } }, + "vermilion": { + "inputs": { + "nixpkgs": "nixpkgs_2" + }, + "locked": { + "lastModified": 1770166629, + "narHash": "sha256-8gP9fuYIN6epnPskX12rm2vEu/u/MjwJ8ZvIAjoPmLk=", + "owner": "vaxerski", + "repo": "Vermilion", + "rev": "7b77acdeb4563351af215a13d77ba4a8cd93cd6c", + "type": "github" + }, + "original": { + "owner": "vaxerski", + "repo": "Vermilion", + "type": "github" + } + }, "yoshi-lua": { "flake": false, "locked": { @@ -33,6 +33,10 @@ inputs.nixpkgs.follows = "nixpkgs"; }; + vermilion = { + url = "github:vaxerski/Vermilion"; + }; + copyparty = { url = "github:9001/copyparty"; inputs.nixpkgs.follows = "nixpkgs"; diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix index 6d5e34f..8347e5a 100644 --- a/hosts/ganymede/config.nix +++ b/hosts/ganymede/config.nix @@ -57,12 +57,6 @@ { port = 22; listenAddr = "0.0.0.0"; - otp = true; - } - { - # also enable ipv6 - port = 22; - listenAddr = "[::]"; } ]; }; diff --git a/hosts/mercury/hjem.nix b/hosts/mercury/hjem.nix index 8504b64..ded2d7b 100644 --- a/hosts/mercury/hjem.nix +++ b/hosts/mercury/hjem.nix @@ -34,6 +34,7 @@ in { captive-browser # https://words.filippo.io/captive-browser captiveBrowserDesktop inputs.glide-browser.packages."x86_64-linux".default + inputs.vermilion.packages."x86_64-linux".default (pkgs.callPackage ../../pkgs/yoshi.nix {inherit inputs;}) (pkgs.callPackage ../../pkgs/yo.nix {inherit inputs;}) diff --git a/modules/desktop/nixos/programs/firefox.nix b/modules/desktop/nixos/programs/firefox.nix index 7eb7efd..b0163aa 100644 --- a/modules/desktop/nixos/programs/firefox.nix +++ b/modules/desktop/nixos/programs/firefox.nix @@ -93,6 +93,7 @@ in "datareporting.policy.dataSubmissionPolicyBypassNotification" = opt true; "browser.startup.homepage" = opt "about:blank"; + "cookiebanners.ui.desktop.enabled" = opt false; "browser.compactmode.show" = opt true; "browser.uidensity" = opt 1; diff --git a/modules/services/nixos/cgit/gitShellCommands.nix b/modules/services/nixos/cgit/gitShellCommands.nix index e99f9f2..18c6e19 100644 --- a/modules/services/nixos/cgit/gitShellCommands.nix +++ b/modules/services/nixos/cgit/gitShellCommands.nix @@ -1,43 +1,50 @@ { - hjem.users."git".files = { - "git-shell-commands/set-description" = { - executable = true; - text = '' - #!/usr/bin/env bash - set -euo pipefail - repo="$1" - desc="$2" - base="/var/lib/cgit" - repo_path="$base/$repo" + config, + lib, + ... +}: let + cfg = config.collinux.services.cgit; +in + lib.mkIf cfg.enable { + hjem.users."git".files = { + "git-shell-commands/set-description" = { + executable = true; + text = '' + #!/usr/bin/env bash + set -euo pipefail + repo="$1" + desc="$2" + base="/var/lib/cgit" + repo_path="$base/$repo" - test -d "$repo_path" || { echo "Repository does not exist"; exit 1; } + test -d "$repo_path" || { echo "Repository does not exist"; exit 1; } - # Prevent path traversal - real=$(realpath "$repo_path") - if [[ "$real" != "$base/"* ]]; then - echo "Invalid path" - exit 1 - fi + # Prevent path traversal + real=$(realpath "$repo_path") + if [[ "$real" != "$base/"* ]]; then + echo "Invalid path" + exit 1 + fi - echo "$desc" | head -n 1 > "$repo_path/description" + echo "$desc" | head -n 1 > "$repo_path/description" - echo "Description updated for '$repo'" - ''; - }; - "git-shell-commands/create-repo" = { - executable = true; - text = '' - #!/usr/bin/env bash - set -euo pipefail - repo="$1" - base="/var/lib/cgit" - repo_path="$base/$repo" + echo "Description updated for '$repo'" + ''; + }; + "git-shell-commands/create-repo" = { + executable = true; + text = '' + #!/usr/bin/env bash + set -euo pipefail + repo="$1" + base="/var/lib/cgit" + repo_path="$base/$repo" - test -d "$repo_path" && { echo "Repository already exists."; exit 1; } + test -d "$repo_path" && { echo "Repository already exists."; exit 1; } - git init --bare "$repo_path" - echo "Repository '$repo' created" - ''; + git init --bare "$repo_path" + echo "Repository '$repo' created" + ''; + }; }; - }; -} + } diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix index 19b003f..a71a9c3 100644 --- a/modules/services/nixos/goaccess.nix +++ b/modules/services/nixos/goaccess.nix @@ -14,7 +14,7 @@ settings = { date-format = "%s"; log-format = "CADDY"; - tz = "America/Chicago"; + tz = config.time.timeZone; ws-url = if cfg.publicUrl != null @@ -27,7 +27,7 @@ real-time-html = "true"; log-file = "/var/log/caddy/access-williamsfam.us.com.log"; - geoip-database = "${geoip}"; + geoip-database = geoip; output = "/var/www/goaccess/index.html"; external-assets = "true"; all-static-files = "false"; @@ -47,6 +47,10 @@ settingsFile = pkgs.writeText "goaccess.conf" (settings |> builtins.mapAttrs (k: v: "${k} ${v}") |> builtins.attrValues |> lib.concatStringsSep "\n"); in { + imports = [ + (import ./mkCaddyCfg.nix cfg) + ]; + config = lib.mkIf cfg.enable { users.groups."goaccess" = {}; users.users."goaccess" = { @@ -122,9 +126,7 @@ in { wantedBy = ["multi-user.target"]; }; - systemd.tmpfiles.rules = [ - "d /var/www/goaccess/ 755 goaccess goaccess" - ]; + systemd.tmpfiles.rules = ["d /var/www/goaccess/ 755 goaccess goaccess"]; collinux.services.goaccess.manualCaddyConfig = '' root * /var/www/goaccess diff --git a/modules/services/nixos/qbittorrent.nix b/modules/services/nixos/qbittorrent.nix index af3cdbc..d0249d0 100644 --- a/modules/services/nixos/qbittorrent.nix +++ b/modules/services/nixos/qbittorrent.nix @@ -12,13 +12,13 @@ in { config = lib.mkIf cfg.enable { users.users."qbittorrent".extraGroups = ["fileserver"]; # torrent files go to /media/library - networking.firewall.allowedTCPPorts = [6882]; - networking.firewall.allowedUDPPorts = [6882]; + networking.firewall.allowedTCPPorts = [49252]; + networking.firewall.allowedUDPPorts = [49252]; services.qbittorrent = { enable = true; webuiPort = cfg.port; - torrentingPort = 6882; + torrentingPort = 49252; }; }; } diff --git a/modules/system/nixos/networking/default.nix b/modules/system/nixos/networking/default.nix index a042411..f063036 100644 --- a/modules/system/nixos/networking/default.nix +++ b/modules/system/nixos/networking/default.nix @@ -10,4 +10,10 @@ enable = true; checkReversePath = "loose"; }; + + # disable all ipv6 + boot.kernel.sysctl = { + "net.ipv6.conf.all.disable_ipv6" = 1; + "net.ipv6.conf.default.disable_ipv6" = 1; + }; } |