aboutsummaryrefslogtreecommitdiff
path: root/hosts
diff options
context:
space:
mode:
Diffstat (limited to 'hosts')
-rw-r--r--hosts/ganymede/caddy.nix15
-rw-r--r--hosts/ganymede/config.nix9
-rw-r--r--hosts/ganymede/iwlwifi.nix23
-rw-r--r--hosts/ganymede/nixos.nix14
-rw-r--r--hosts/ganymede/secrets/collin-copyparty-password.age7
-rw-r--r--hosts/ganymede/secrets/collin-forgejo-password.age7
-rw-r--r--hosts/ganymede/secrets/copilot-token.age11
-rw-r--r--hosts/ganymede/secrets/ganymede-wg-key.age5
-rw-r--r--hosts/ganymede/secrets/tsnsrv-authkey.age7
-rw-r--r--hosts/ganymede/secrets/wg-privkey.age12
-rw-r--r--hosts/ganymede/secrets/wireguard-privkey.age8
-rw-r--r--hosts/ganymede/wireguard.nix57
-rw-r--r--hosts/mercury/config.nix24
-rw-r--r--hosts/mercury/hjem.nix2
-rw-r--r--hosts/mercury/nixos.nix64
-rw-r--r--hosts/mercury/secrets/wg-privkey.age9
-rw-r--r--hosts/mercury/wireguard.nix54
17 files changed, 175 insertions, 153 deletions
diff --git a/hosts/ganymede/caddy.nix b/hosts/ganymede/caddy.nix
index a03fcdc..3a805f4 100644
--- a/hosts/ganymede/caddy.nix
+++ b/hosts/ganymede/caddy.nix
@@ -19,8 +19,21 @@
}
'';
+ virtualHosts."lindsey.williamsfam.us.com".extraConfig = ''
+ redir https://williams-ryan-lindsey.blogspot.com permanent
+ '';
+
+ virtualHosts."daniel.williamsfam.us.com".extraConfig = ''
+ root * /media/public/www/daniel
+ file_server
+ '';
+
+ # virtualHosts."collin.williamsfam.us.com".extraConfig = ''
+ # root * /med
+ # '';
+
virtualHosts."williamsfam.us.com".extraConfig = ''
- root * /media/public/www
+ root * /media/public/www/root
file_server
'';
};
diff --git a/hosts/ganymede/config.nix b/hosts/ganymede/config.nix
index 8150e14..0858106 100644
--- a/hosts/ganymede/config.nix
+++ b/hosts/ganymede/config.nix
@@ -9,6 +9,11 @@
};
"caddy-env".file = ./secrets/caddy-env.age;
+
+ "wireguard-privkey" = {
+ file = ./secrets/wg-privkey.age;
+ owner = "systemd-network";
+ };
};
terminal = {
@@ -84,6 +89,10 @@
enable = true;
privateUrl = "git.ganymede";
};
+ glance = {
+ enable = true;
+ port = 8081;
+ };
caddy = {
enable = true;
diff --git a/hosts/ganymede/iwlwifi.nix b/hosts/ganymede/iwlwifi.nix
deleted file mode 100644
index 729034f..0000000
--- a/hosts/ganymede/iwlwifi.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-{
- # Append Kernel modules
- boot.kernelModules = [
- "brcmfmac"
- "brcmutil"
- "iwlmvm"
- "iwlwifi"
- "mmc_core"
- "mt76_usb"
- "mt76"
- "mt76x0_common"
- "mt76x02_lib"
- "mt76x02_usb"
- "mt76x0u"
- "r8188eu"
- "rtl_usb"
- "rtl8192c_common"
- "rtl8192cu"
- "rtlwifi"
- ];
- hardware.enableAllFirmware = true;
- hardware.enableRedistributableFirmware = true;
-}
diff --git a/hosts/ganymede/nixos.nix b/hosts/ganymede/nixos.nix
index 77e3ad5..d913df7 100644
--- a/hosts/ganymede/nixos.nix
+++ b/hosts/ganymede/nixos.nix
@@ -9,24 +9,12 @@
inputs.disko.nixosModules.disko
inputs.nixos-facter-modules.nixosModules.facter
./disks.nix
-
- ./iwlwifi.nix
./caddy.nix
+ ./wireguard.nix
];
facter.reportPath = ./facter.json;
- environment.systemPackages = [
- pkgs.python313
- pkgs.net-tools
- ];
-
- # backup usb teather configuration
- systemd.network.networks."80-usb-teather" = {
- name = "enp0s20f0u2";
- networkConfig.DHCP = "yes";
- };
-
systemd.services."disable-wifi-powersave" = {
description = "Disable wifi powersaving using iw";
after = ["network.target"];
diff --git a/hosts/ganymede/secrets/collin-copyparty-password.age b/hosts/ganymede/secrets/collin-copyparty-password.age
deleted file mode 100644
index af3ae6c..0000000
--- a/hosts/ganymede/secrets/collin-copyparty-password.age
+++ /dev/null
@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 azBilg hZH7PIwhHf7XWaPmri/OvgvJtlPEip5lqfFf77NKCVE
-gbqmQLIN9edp8Om4VXD6wkI0+OymOcbBiKnunUXgqM0
--> ssh-ed25519 Jg4yWQ 0DeQ/sVqXTYjTBZS+lXVZWLDHYSYz836nbfNXejEdmQ
-/b4pRvTK2+42G4Vp3WKun99pxGxYzAE3PzSD86Q5lVw
---- rXCPzVmtD1TorsW0ZV17ciC5y4rq5ZJDSm+1ssu+uVw
-ygp]r͗|f)܊~<pPmaqA n1F \ No newline at end of file
diff --git a/hosts/ganymede/secrets/collin-forgejo-password.age b/hosts/ganymede/secrets/collin-forgejo-password.age
deleted file mode 100644
index 76bdc67..0000000
--- a/hosts/ganymede/secrets/collin-forgejo-password.age
+++ /dev/null
@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 azBilg vmw/nKIBoQoNUFX5L/30ll21pT0pC2aj/w2qjTc2nSM
-x4udezFrc1+YG2ejgSVL6iIdPUgkiUeYxl0nijurqmE
--> ssh-ed25519 Jg4yWQ X6KPKYcqIzzllcP96/VdMH+SHzvwy5L2Yf8VIjL7GRg
-ZREY05ecsxqutY2VEktNqwX8pXvmXnVL8M9FnlIkQy4
---- MGA/XzVEB308uJE/c/bLe0GKrLDVSxciKxTV54S4oDM
-#;brLܐ&̓]WD5m ЃG`B6b \ No newline at end of file
diff --git a/hosts/ganymede/secrets/copilot-token.age b/hosts/ganymede/secrets/copilot-token.age
deleted file mode 100644
index 7dd6e51..0000000
--- a/hosts/ganymede/secrets/copilot-token.age
+++ /dev/null
@@ -1,11 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IEpnNHlXUSBDSlBB
-cXJaNHU0V3VjVnB5czdya0lYMjBTdFFWRlhvWE5lVTRJenBhL3hRCmREcnJwUEo4
-UDVXQTFxdkk3ZXJrVE05cGZWT040U282bldhcm5QVkdSWW8KLT4gUCl4fUBGLWdy
-ZWFzZSB4LHJZRVt7ICVYIjVGdlVbICR6fCBkdAp4T0pZM1hBRm9WcmFFQjJqaW9Y
-Z2x5cE9mQk83U0pDRzdMUXozTkxjUC9FaW5MOUM4NjM3SlhTTnJvVldjK01KCm03
-TTBFdGtEWkZHVmc4RDVMc1QrNndNR2FHOXRreW5FZEhYdG9BdWZpYVBBb0ZSSFl2
-bFN1UUFWCi0tLSBVaUpmVjhibW5jWW9nS2pJV1JXVjJaZ2JYZ0VHQkY0emwrd1NL
-QXFpNmN3Cv69mt8dZSWNQqM8qDledKrYS7PBZDoIXy+FivL42kaUxF0jXjHXefED
-DsjubBCEK0OiAh6nyvuEn9wbSkaALmpqjMARM32QyAOiam2skY0LB8E=
------END AGE ENCRYPTED FILE-----
diff --git a/hosts/ganymede/secrets/ganymede-wg-key.age b/hosts/ganymede/secrets/ganymede-wg-key.age
deleted file mode 100644
index 2ef8256..0000000
--- a/hosts/ganymede/secrets/ganymede-wg-key.age
+++ /dev/null
@@ -1,5 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 Jg4yWQ PMAfdBRZ9mLnral4UdHEtr3QWmk8j9lKek6XH8L6QCk
-B342qgV/kGHvIt3hm8Yyd0yw7nHJ1kqV3UGLREhWbKA
---- mOBS3t1P5ZAIV8llDldbGC+F855Xy3Jd5V8tVrwisig
-L\đg5w\̃9 A:= bLnOc"<JO;wJ[.*/ 0 \ No newline at end of file
diff --git a/hosts/ganymede/secrets/tsnsrv-authkey.age b/hosts/ganymede/secrets/tsnsrv-authkey.age
deleted file mode 100644
index d0e6eb1..0000000
--- a/hosts/ganymede/secrets/tsnsrv-authkey.age
+++ /dev/null
@@ -1,7 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 Jg4yWQ NYO6CUksU6appmdib7CER3YYbcKoyn0wmB4YGTCeTE0
-tizx14UdvQftYrkDa3iXQYDp6JPWHfjDmFwjr11FBxQ
--> ssh-ed25519 azBilg 3PYXHVdB2y2Y42ijOiv8LJ9c4WmeB5ivEPcehfS3Wns
-tP/xCHzd31DydF5aCn1tJGudanXLl+DIPod7KFtglXQ
---- nbch7DRt1CYKBqzE9CeUIJgTMKIUCEA/CXVQZjkywfI
-~}H <42)U{QK3%G^FW3GJy 1 \ No newline at end of file
diff --git a/hosts/ganymede/secrets/wg-privkey.age b/hosts/ganymede/secrets/wg-privkey.age
new file mode 100644
index 0000000..398a4b2
--- /dev/null
+++ b/hosts/ganymede/secrets/wg-privkey.age
@@ -0,0 +1,12 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyBQS20w
+cEVsZkNQN3pkNm5mLzhIbEQ0ejVmcG9Md1d5YWd4WXBKa0tON3lZCk80a2lmQ3Zw
+ZGlCRjZwdG5GY25RWFZrMktZYVZoWHZMeHFHUnJXSUlFa2sKLT4gc3NoLWVkMjU1
+MTkgSmc0eVdRIEIvcGNuVDVJWHV5UHpNMklXME1Sd2drNDYrTVk5aFUrbUN5SVVT
+dVhSVEUKRG92b2NxZ0oxT3h0UGttZmhHb3gxT1VIMFVzOUQvSCt5RGEyL2NSRmp5
+SQotPiB2fGhLSSQuLWdyZWFzZQo5WlBvV1pWRkkvaTRHS0lha0R5R3A0cFFJbm04
+cTNGamZMNnlFMkZndy9QTlFlckZBd2J2eWt6R3l6MTVER0RQCkdrbG10bTRyMTZi
+cQotLS0gazNldzNoSU1VOFdCTklsRFhjNVF6a2d5YlA2Q3gxdUVNbFFwU0dRSGhK
+WQosSz+PG1ZS0BTINC2BVnJLFApgLIpos8pYgQz7MYdtcVrOSbhRA1VKxGT1zy3p
+7o4Eu4MYzC9a7qmq547UKN0sjHhDRlmi9aH7zshN2A==
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/ganymede/secrets/wireguard-privkey.age b/hosts/ganymede/secrets/wireguard-privkey.age
deleted file mode 100644
index ee9130d..0000000
--- a/hosts/ganymede/secrets/wireguard-privkey.age
+++ /dev/null
@@ -1,8 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 azBilg tvscfH96l4w2AkLjaczmtAJ3CKeU1mEPJWT82tR2HiY
-F83pJqPj+qlFw4nb+ANCMJ7lOufSMluDIeWbaYvJkEU
--> ssh-ed25519 Jg4yWQ SXz2kA4FODscXLqsNsCjuqKqBUXSkEx5SIpSdjGKpQU
-mVg50RgaBauKlTCyHUYDTPZYnDJkppOthhMC+MAsiiE
---- dlTzxZODPVxlkdRP3HRJSK6BU3yEHrs1fo/sudC6EKo
-dEV!Axr?z(YKمSukst]<o(޶
->Mjzψ\D\Bs./2= \ No newline at end of file
diff --git a/hosts/ganymede/wireguard.nix b/hosts/ganymede/wireguard.nix
new file mode 100644
index 0000000..a1be5f7
--- /dev/null
+++ b/hosts/ganymede/wireguard.nix
@@ -0,0 +1,57 @@
+{
+ config,
+ hosts,
+ pkgs,
+ ...
+}: {
+ environment.systemPackages = [pkgs.wireguard-tools];
+
+ services.dnsmasq = {
+ enable = true;
+ settings = {
+ port = 5353;
+ local = "/ganymede/";
+ address = "/.ganymede/10.100.0.1";
+ listen-address = ["127.0.0.1" "10.100.0.1"];
+ };
+ };
+
+ boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+ networking.firewall.allowedUDPPorts = [51820 5353];
+ systemd.network.netdevs."50-wg0" = {
+ netdevConfig = {
+ Kind = "wireguard";
+ Name = "wg0";
+ MTUBytes = "1300";
+ };
+ wireguardConfig = {
+ PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path;
+ ListenPort = 51820;
+ };
+ wireguardPeers = [
+ {
+ PublicKey = hosts.mercury.wg_pubkey;
+ AllowedIPs = ["${hosts.mercury.wg_ip}/32"];
+ }
+ {
+ PublicKey = hosts.terra.wg_pubkey;
+ AllowedIPs = ["${hosts.terra.wg_ip}/32"];
+ }
+ ];
+ };
+ systemd.network.networks."wg0" = {
+ matchConfig.Name = "wg0";
+ address = ["${hosts.ganymede.wg_ip}/24"];
+ dns = ["127.0.0.1:5353"];
+ domains = ["~ganymede"];
+ networkConfig = {
+ IPMasquerade = "ipv4";
+ IPv4Forwarding = true;
+ };
+ extraConfig = ''
+ DNSOverTLS=no
+ DNSSEC=no
+ '';
+ };
+}
diff --git a/hosts/mercury/config.nix b/hosts/mercury/config.nix
index a1faded..ef383d7 100644
--- a/hosts/mercury/config.nix
+++ b/hosts/mercury/config.nix
@@ -2,7 +2,12 @@
collinux = {
theme = "catppuccin";
- secrets = {};
+ secrets = {
+ "wireguard-privkey" = {
+ file = ./secrets/wg-privkey.age;
+ owner = "systemd-network";
+ };
+ };
user.useRun0 = true;
@@ -17,32 +22,28 @@
greetd = {
enable = true;
autologin.enable = true;
+ # cosmic-greeter.enable = true;
};
wm = {
niri.enable = true;
- # sway.enable = true;
kdeDesktopPortal.enable = true;
- components = {
- fuzzel.enable = true;
- };
+ components.fuzzel.enable = true; # noctalia launcher SUCKS
};
programs = {
- firefox = {
- enable = true;
- extensions.foxyproxy.enable = true;
- };
- foot.enable = true;
-
+ firefox.enable = true;
research.enable = true;
+
+ foot.enable = true;
};
};
system = {
boot = {
systemd-boot.enable = true;
+ plymouth.enable = true;
secureBoot.enable = true;
};
@@ -65,7 +66,6 @@
bat.enable = true;
eza.enable = true;
broot.enable = true;
- tmux.enable = true;
helix = {
enable = true;
hardMode = true;
diff --git a/hosts/mercury/hjem.nix b/hosts/mercury/hjem.nix
index b1ca4d9..75784d4 100644
--- a/hosts/mercury/hjem.nix
+++ b/hosts/mercury/hjem.nix
@@ -3,7 +3,7 @@
anki
libreoffice-qt
musescore
- (pkgs.callPackage ../../pkgs/obsidian.nix {})
+ obsidian
noctalia-shell
diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix
index 764f6f5..5937aeb 100644
--- a/hosts/mercury/nixos.nix
+++ b/hosts/mercury/nixos.nix
@@ -1,76 +1,25 @@
-{
- lib,
- inputs,
- pkgs,
- ...
-}: {
+{inputs, ...}: {
imports = [
./disks.nix
./battery.nix
+ ./wireguard.nix
+
inputs.nixos-facter-modules.nixosModules.facter
inputs.lanzaboote.nixosModules.lanzaboote
];
facter.reportPath = ./facter.json;
- services.dbus.implementation = "broker";
services.upower.enable = true;
- environment.defaultPackages = lib.mkForce []; # im not a noob
-
programs.ssh.extraConfig = ''
Host ganymede
- HostName williamsfam.us.com
+ HostName 10.100.0.1
Port 22
'';
- virtualisation.podman = {
- enable = true;
- dockerCompat = true;
- };
- users.users.collin = {
- extraGroups = ["podman"];
- subGidRanges = [
- {
- count = 65536;
- startGid = 100000;
- }
- ];
- subUidRanges = [
- {
- count = 65536;
- startUid = 100000;
- }
- ];
- };
- virtualisation.waydroid = {
- package = pkgs.waydroid-nftables;
- enable = true;
- };
-
programs.kdeconnect.enable = true;
- services.autossh.sessions = [
- {
- name = "ganymede";
- user = "collin";
- monitoringPort = 20000;
- extraArguments = "-N -D 9090 collin@ganymede";
- }
- ];
- boot.supportedFilesystems."fuse.sshfs" = true;
- fileSystems."/home/collin/ganymede" = {
- device = "collin@ganymede:/media";
- fsType = "fuse.sshfs";
- options = [
- "identityfile=/home/collin/.ssh/id_ed25519"
- "idmap=user"
- "x-systemd.automount" # mount the filesystem automatically on first access
- "allow_other" # don't restrict access to only the user which `mount`s it (because that's probably systemd who mounts it, not you)
- "user" # allow manual `mount`ing, as ordinary user.
- ];
- };
-
security.pki.certificates = [
''
-----BEGIN CERTIFICATE-----
@@ -87,7 +36,6 @@
''
];
- virtualisation.vmVariant = {
- virtualisation.diskSize = 8192;
- };
+ # required for vm testing
+ virtualisation.vmVariant.virtualisation.diskSize = 8192;
}
diff --git a/hosts/mercury/secrets/wg-privkey.age b/hosts/mercury/secrets/wg-privkey.age
new file mode 100644
index 0000000..767692f
--- /dev/null
+++ b/hosts/mercury/secrets/wg-privkey.age
@@ -0,0 +1,9 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IGF6QmlsZyA0L2Ry
+ZXZFOUxvL25CemdScnhEc3Ewb0NVUnBCNHZ5WjlNaDgwMVQxL0VzCmFoWTlQM0N6
+aFBSK05qZ3pKazF1a1BhRDBudkUwQmVpOHNsemUzazV4REkKLT4gbTtrJiw4Qy1n
+cmVhc2UKazJ3UW9zQmh6RlBlTmpmekduUlpMSHl4TGgvcUJKTnB6aE43YTJDR2Vm
+SHZVMGsKLS0tIFpnV21lOE9ZYUtwUFBVeGFWRDVMNFpkSStsSmpIaWZ3MHJVL29G
+dzA2SXMKuuAvweyyyuIFVJftn6tNANBkHp0NGxJZ0LXTj+daziYleOUFn3R1KTVu
+0UMQIZM/WsfesWXkvN1E4+LZKTdNdJOsEJv9ahYnk8btBgU=
+-----END AGE ENCRYPTED FILE-----
diff --git a/hosts/mercury/wireguard.nix b/hosts/mercury/wireguard.nix
new file mode 100644
index 0000000..268cdc6
--- /dev/null
+++ b/hosts/mercury/wireguard.nix
@@ -0,0 +1,54 @@
+{
+ config,
+ hosts,
+ pkgs,
+ ...
+}: {
+ environment.systemPackages = [pkgs.wireguard-tools];
+
+ networking.firewall.interfaces."wg0" = {
+ allowedTCPPortRanges = [
+ {
+ from = 1714;
+ to = 1764;
+ }
+ ];
+ allowedUDPPortRanges = [
+ {
+ from = 1714;
+ to = 1764;
+ }
+ ];
+ };
+
+ systemd.network.netdevs."10-wg" = {
+ netdevConfig = {
+ Kind = "wireguard";
+ Name = "wg0";
+ MTUBytes = "1300";
+ };
+ wireguardConfig = {
+ PrivateKeyFile = config.collinux.secrets."wireguard-privkey".path;
+ ListenPort = 9918;
+ };
+ wireguardPeers = [
+ {
+ PublicKey = hosts.ganymede.wg_pubkey;
+ AllowedIPs = ["10.100.0.0/24"];
+ Endpoint = "williamsfam.us.com:51820";
+ }
+ ];
+ };
+ systemd.network.networks."wg0" = {
+ matchConfig.Name = "wg0";
+ address = ["${hosts.mercury.wg_ip}/24"];
+ DHCP = "no";
+ dns = ["${hosts.ganymede.wg_ip}:5353"];
+ domains = ["~ganymede"];
+ networkConfig.IPv6AcceptRA = false;
+ extraConfig = ''
+ DNSOverTLS=no
+ DNSSEC=no
+ '';
+ };
+}