diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/desktop/hjem/programs/firefox.nix | 4 | ||||
| -rw-r--r-- | modules/desktop/hjem/wm/sway.nix | 2 | ||||
| -rw-r--r-- | modules/services/nixos/copyparty.nix | 22 | ||||
| -rw-r--r-- | modules/services/nixos/goaccess.nix | 8 | ||||
| -rw-r--r-- | modules/services/nixos/minecraft.nix | 2 | ||||
| -rw-r--r-- | modules/services/nixos/openssh.nix | 59 | ||||
| -rw-r--r-- | modules/services/options.nix | 29 | ||||
| -rw-r--r-- | modules/terminal/hjem/programs/helix.nix | 3 |
8 files changed, 49 insertions, 80 deletions
diff --git a/modules/desktop/hjem/programs/firefox.nix b/modules/desktop/hjem/programs/firefox.nix index 46d2dd5..cf9c532 100644 --- a/modules/desktop/hjem/programs/firefox.nix +++ b/modules/desktop/hjem/programs/firefox.nix @@ -35,6 +35,8 @@ in "${profileDir}/chrome/JS/test.uc.js".source = "${inputs.fx-autoconfig}/profile/chrome/JS/test.uc.js"; + "${profileDir}/chrome/JS/aboutCfg.sys.mjs".source = "${inputs.uc-css-js}/JS/aboutCfg.sys.mjs"; + "${profileDir}/chrome/JS/aboutUserChrome.sys.mjs".source = "${inputs.uc-css-js}/JS/aboutUserChrome.sys.mjs"; "${profileDir}/chrome/resources/aboutuserchrome".source = "${inputs.uc-css-js}/resources/aboutuserchrome"; @@ -62,6 +64,4 @@ in "compact_extensions_panel" ]; }; - - packages = [pkgs.firefox]; } diff --git a/modules/desktop/hjem/wm/sway.nix b/modules/desktop/hjem/wm/sway.nix index 03450d2..c880a1b 100644 --- a/modules/desktop/hjem/wm/sway.nix +++ b/modules/desktop/hjem/wm/sway.nix @@ -59,7 +59,7 @@ Mod4+Return exec ${pkgs.foot}/bin/foot Mod4+Space exec tofi-drun - Mod4+b exec ${pkgs.firefox}/bin/firefox + Mod4+b exec firefox Mod4+Shift+b exec ${pkgs.qutebrowser}/bin/qutebrowser Mod4+w exec '${pkgs.iwmenu}/bin/iwmenu -l fuzzel -i font -s 2' diff --git a/modules/services/nixos/copyparty.nix b/modules/services/nixos/copyparty.nix index cfc69bc..0e607e2 100644 --- a/modules/services/nixos/copyparty.nix +++ b/modules/services/nixos/copyparty.nix @@ -78,21 +78,6 @@ in { e2ts = true; # enable music indexing }; }; - - "/incoming" = { - path = "/media/incoming"; - access = { - wG = "*"; - A = "@admin"; - }; - flags = { - fk = 6; - dk = 6; - lifetime = 21600; # files deleted after 6hrs - nosub = true; # must upload to top-level folder - maxb = "20g,21600"; # each IP can upload a max of 20GB every 6 hrs - }; - }; } ] ++ lib.lists.flatten (cfg.users @@ -100,16 +85,13 @@ in { { "/${k}" = { path = "/media/${k}"; - access.A = k; + access.rwd = k; }; } (lib.optionalAttrs v.hasPublicDir { "/public/${k}" = { path = "/media/${k}/public"; - access = { - r = "*"; - A = k; - }; + access.r = "*"; }; }) ]))); diff --git a/modules/services/nixos/goaccess.nix b/modules/services/nixos/goaccess.nix index bb174cb..703e263 100644 --- a/modules/services/nixos/goaccess.nix +++ b/modules/services/nixos/goaccess.nix @@ -1,22 +1,18 @@ { config, pkgs, + inputs, lib, ... }: let cfg = config.collinux.services.goaccess; - geoip = pkgs.fetchurl { - url = "https://github.com/P3TERX/GeoLite.mmdb/releases/download/2026.03.01/GeoLite2-City.mmdb"; - hash = "sha256-SZ/m8b53sawF86Ak46uX7CxdzEMFrmob7Yd12Y+xJfA="; - }; - settings = { date-format = "%s"; log-format = "CADDY"; tz = config.time.timeZone; log-file = "/var/log/caddy/access-williamsfam.us.com.log"; - geoip-database = geoip; + geoip-database = inputs.geolite-db; ws-url = if cfg.publicUrl != null diff --git a/modules/services/nixos/minecraft.nix b/modules/services/nixos/minecraft.nix index fa7ae40..1b8b047 100644 --- a/modules/services/nixos/minecraft.nix +++ b/modules/services/nixos/minecraft.nix @@ -24,5 +24,7 @@ in image = "itzg/minecraft-bedrock-server"; ports = ["${cfg.listenAddr}:${toString cfg.port}:19132/udp"]; volumes = ["/var/lib/minecraft/:/data"]; + + extraOptions = ["--no-healthcheck"]; }; } diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix index be2b51c..2d0c45c 100644 --- a/modules/services/nixos/openssh.nix +++ b/modules/services/nixos/openssh.nix @@ -7,9 +7,6 @@ }: let cfg = config.collinux.services.sshd; - anyAttr = attr: cfg.portConfig |> builtins.map (x: x.${attr} != null) |> builtins.any (x: x); - anyOTP = cfg.portConfig |> builtins.map (x: x.otp == true) |> builtins.any (x: x); - authorizedKeys = hosts |> builtins.mapAttrs (_: data: data.user_pubkey or null) @@ -17,7 +14,7 @@ |> builtins.filter (x: x != null); in { config = lib.mkIf cfg.enable { - networking.firewall.allowedTCPPorts = cfg.portConfig |> builtins.map (x: x.port); + networking.firewall.allowedTCPPorts = [cfg.port]; services.openssh = { enable = true; @@ -30,12 +27,12 @@ in { } ]; - listenAddresses = - cfg.portConfig - |> builtins.map (x: { - addr = x.listenAddr; - port = x.port; - }); + listenAddresses = [ + { + addr = cfg.listenAddr; + port = cfg.port; + } + ]; # Lock down everything by default settings = { @@ -46,30 +43,26 @@ in { AllowAgentForwarding = false; }; - extraConfig = - cfg.portConfig - |> builtins.map (x: - lib.concatStringsSep "\n" [ - "Match LocalPort ${toString x.port}" - ( - if x.otp - then '' - ChallengeResponseAuthentication yes - PubkeyAuthentication yes - KbdInteractiveAuthentication yes - AuthenticationMethods publickey,keyboard-interactive:pam - '' - else '' - PubkeyAuthentication yes - AuthenticationMethods publickey - '' - ) - (lib.optionalString x.rootLogin "PermitRootLogin yes") - ]) - |> lib.concatStringsSep "\n\n"; + extraConfig = lib.concatStringsSep "\n" [ + "Match LocalPort ${toString cfg.port}" + ( + if cfg.otp + then '' + ChallengeResponseAuthentication yes + PubkeyAuthentication yes + KbdInteractiveAuthentication yes + AuthenticationMethods publickey,keyboard-interactive:pam + '' + else '' + PubkeyAuthentication yes + AuthenticationMethods publickey + '' + ) + (lib.optionalString cfg.rootLogin "PermitRootLogin yes") + ]; }; - security.pam.services = lib.optionalAttrs anyOTP { + security.pam.services = lib.optionalAttrs cfg.otp { login.googleAuthenticator.enable = true; sshd.text = '' @@ -86,7 +79,7 @@ in { }; users.users.${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys; - users.users."root".openssh.authorizedKeys.keys = lib.mkIf (anyAttr "rootLogin") authorizedKeys; + users.users."root".openssh.authorizedKeys.keys = lib.mkIf cfg.rootLogin authorizedKeys; systemd.services."openssh" = { after = lib.mkAfter ["network-online.target"]; diff --git a/modules/services/options.nix b/modules/services/options.nix index 17a4e6b..70fd695 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -56,26 +56,19 @@ in { sshd = { enable = mkEnableOption "OpenSSH server"; - portConfig = mkOption { - description = "List of ssh bind hosts. see submodule options for details"; - type = lib.types.listOf (lib.types.submodule { - options = { - port = mkOption { - description = "Port to run on"; - type = lib.types.port; - }; - - listenAddr = mkOption { - description = "Address to listen on"; - type = lib.types.str; - default = "127.0.0.1"; - }; + port = mkOption { + description = "Port to run on"; + type = lib.types.port; + }; - otp = mkEnableOption "Whether to require TOTP (Google Authenticator) 2fa codes for this port"; - rootLogin = mkEnableOption "Whether to allow root login for this port"; - }; - }); + listenAddr = mkOption { + description = "Address to listen on"; + type = lib.types.str; + default = "127.0.0.1"; }; + + otp = mkEnableOption "Whether to require TOTP (Google Authenticator) 2fa codes"; + rootLogin = mkEnableOption "Whether to allow root login"; }; forgejo = webserviceOptions { diff --git a/modules/terminal/hjem/programs/helix.nix b/modules/terminal/hjem/programs/helix.nix index a544616..5a8db19 100644 --- a/modules/terminal/hjem/programs/helix.nix +++ b/modules/terminal/hjem/programs/helix.nix @@ -33,6 +33,9 @@ command = "${pkgs.superhtml}/bin/superhtml"; args = ["lsp"]; }; + golsp = { + command = "${pkgs.gopls}/bin/gopls"; + }; dhall-lsp-server.command = "${pkgs.dhall-lsp-server}/bin/dhall-lsp-server"; }; |