diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/desktop/nixos/fonts.nix | 2 | ||||
| -rw-r--r-- | modules/desktop/nixos/programs/firefox.nix | 19 | ||||
| -rw-r--r-- | modules/services/nixos/default.nix | 1 | ||||
| -rw-r--r-- | modules/services/nixos/glance.nix | 145 | ||||
| -rw-r--r-- | modules/services/nixos/openssh.nix | 96 | ||||
| -rw-r--r-- | modules/services/nixos/qbittorrent.nix | 2 | ||||
| -rw-r--r-- | modules/services/options.nix | 6 | ||||
| -rw-r--r-- | modules/system/nixos/boot.nix | 3 | ||||
| -rw-r--r-- | modules/system/nixos/networking/resolved.nix | 36 | ||||
| -rw-r--r-- | modules/user/nixos/default.nix | 2 |
10 files changed, 202 insertions, 110 deletions
diff --git a/modules/desktop/nixos/fonts.nix b/modules/desktop/nixos/fonts.nix index d2e8ba9..e740bf1 100644 --- a/modules/desktop/nixos/fonts.nix +++ b/modules/desktop/nixos/fonts.nix @@ -2,6 +2,6 @@ fonts = { enableDefaultPackages = false; fontconfig.enable = true; - packages = [pkgs.nerd-fonts.iosevka pkgs.ibm-plex pkgs.liberation_ttf]; # for terminal (blackbox or foot or ghostty) + packages = [pkgs.nerd-fonts.iosevka pkgs.ibm-plex pkgs.liberation_ttf pkgs.rubik]; # for terminal (blackbox or foot or ghostty) }; } diff --git a/modules/desktop/nixos/programs/firefox.nix b/modules/desktop/nixos/programs/firefox.nix index 9e2b8ca..8267857 100644 --- a/modules/desktop/nixos/programs/firefox.nix +++ b/modules/desktop/nixos/programs/firefox.nix @@ -23,9 +23,23 @@ in OverrideFirstRunPage = ""; OverridePostUpdatePage = ""; - NewTabPage = false; - SearchEngines.Default = "DuckDuckGo"; + Homepage = { + URL = "https://home.ganymede"; + Locked = true; + StartPage = "homepage-locked"; + }; + + AIControls = { + Default = { + Value = "blocked"; + Locked = true; + }; + Translations = { + Value = "available"; + Locked = true; + }; + }; Preferences = let opt = Value: { @@ -97,7 +111,6 @@ in "media.webspeech.synth.dont_notify_on_error" = opt true; "datareporting.policy.dataSubmissionPolicyBypassNotification" = opt true; - "browser.startup.homepage" = opt "about:blank"; "browser.compactmode.show" = opt true; "browser.uidensity" = opt 1; diff --git a/modules/services/nixos/default.nix b/modules/services/nixos/default.nix index 68ed3ee..65315cf 100644 --- a/modules/services/nixos/default.nix +++ b/modules/services/nixos/default.nix @@ -8,6 +8,7 @@ ./cgit ./ganyupload ./jta + ./glance.nix ./minecraft.nix ./ngircd.nix diff --git a/modules/services/nixos/glance.nix b/modules/services/nixos/glance.nix new file mode 100644 index 0000000..1396562 --- /dev/null +++ b/modules/services/nixos/glance.nix @@ -0,0 +1,145 @@ +{ + pkgs, + config, + lib, + ... +}: let + cfg = config.collinux.services.glance; + + pure = x: [x]; + + settings = { + server = { + inherit (cfg) port; + proxied = true; + host = "127.0.0.1"; + assets-path = "/var/lib/glance"; + }; + + branding.hide-footer = true; + pages = pure { + name = "Dashboard"; + width = "slim"; + hide-desktop-navigation = true; + center-vertically = true; + columns = pure { + size = "full"; + widgets = [ + { + type = "search"; + autofocus = true; + search-engine = "duckduckgo"; + bangs = [ + { + title = "GitHub"; + shortcut = "gh"; + url = "https://github.com/search?q={QUERY}&type=repositories"; + } + { + title = "I'm Feeling Lucky"; + shortcut = "!"; + url = "https://www.google.com/search?q={QUERY}&btnI=&sourceid=navclient&gfns=1"; + } + { + title = "YouTube Music"; + shortcut = "ytm"; + url = "https://music.youtube.com/search?q={QUERY}"; + } + { + title = "Google AI Mode"; + shortcut = "ai"; + url = "https://www.google.com/search?udm=50&q={QUERY}"; + } + ]; + } + { + type = "server-stats"; + servers = pure { + type = "local"; + name = "Ganymede"; + hide-mountpoints-by-default = true; + mountpoints = { + "/".hide = false; + "/media".hide = false; + }; + }; + } + { + type = "monitor"; + cache = "1m"; + title = "Services"; + sites = [ + { + title = "stats"; + url = "https://stats.ganymede"; + icon = "mdi:poll"; + } + { + title = "btop"; + url = "https://btop.ganymede"; + icon = "si:htop"; + } + { + title = "git"; + url = "https://git.ganymede"; + icon = "si:git"; + } + { + title = "bittorrent"; + url = "https://bittorrent.ganymede"; + icon = "si:qbittorrent"; + } + { + title = "website"; + url = "https://williamsfam.us.com"; + icon = "mdi:web"; + } + ]; + } + ]; + }; + }; + }; + + settingsFile = (pkgs.formats.yaml {}).generate "config.yml" settings; +in { + config = lib.mkIf cfg.enable { + users.groups."glance" = {}; + users.users."glance" = { + isSystemUser = true; + group = "glance"; + + home = "/var/lib/glance"; + createHome = true; + }; + + systemd.services."glance" = { + restartIfChanged = true; + wants = ["network-online.target"]; + after = ["network-online.target"]; + + serviceConfig = { + User = "glance"; + Type = "simple"; + + ReadWritePaths = "/var/lib/glance"; + WorkingDirectory = "/var/lib/glance"; + ExecStart = "${pkgs.glance}/bin/glance -config ${settingsFile}"; + + NoNewPrivileges = true; + PrivateTmp = true; + ProtectSystem = "strict"; + ProtectHome = true; + ProtectKernelTunables = true; + ProtectKernelModules = true; + ProtectControlGroups = true; + }; + }; + + services.caddy.virtualHosts."home.ganymede".extraConfig = '' + tls internal + + reverse_proxy 127.0.0.1:${toString cfg.port} + ''; + }; +} diff --git a/modules/services/nixos/openssh.nix b/modules/services/nixos/openssh.nix index 98f8b87..1d7834b 100644 --- a/modules/services/nixos/openssh.nix +++ b/modules/services/nixos/openssh.nix @@ -1,94 +1,54 @@ { config, lib, - pkgs, hosts, ... }: let cfg = config.collinux.services.sshd; + + pure = x: [x]; + + authorizedKeys = + hosts + |> builtins.mapAttrs (_: data: data.user_pubkey or null) + |> builtins.attrValues + |> builtins.filter (x: x != null); in { config = lib.mkIf cfg.enable { - networking.firewall.allowedTCPPorts = lib.optional cfg.public cfg.port; - services.openssh = { enable = true; allowSFTP = true; - hostKeys = [ - { - path = "/etc/ssh/ssh_host_ed25519_key"; - type = "ed25519"; - } - ]; + hostKeys = pure { + path = "/etc/ssh/ssh_host_ed25519_key"; + type = "ed25519"; + }; - listenAddresses = [ - { - addr = - if cfg.public - then "0.0.0.0" - else "127.0.0.1"; - port = cfg.port; - } - ]; + listenAddresses = pure { + addr = "0.0.0.0"; + port = cfg.port; + }; - # Lock down everything by default settings = { - PermitRootLogin = "no"; + PermitRootLogin = + if cfg.conf.rootLogin + then "yes" + else "no"; + PasswordAuthentication = false; - PubkeyAuthentication = false; KbdInteractiveAuthentication = false; - AllowAgentForwarding = false; + PubkeyAuthentication = true; }; - - extraConfig = lib.concatStringsSep "\n" [ - "Match LocalPort ${toString cfg.port}" - ( - if cfg.conf.otp - then '' - ChallengeResponseAuthentication yes - PubkeyAuthentication yes - KbdInteractiveAuthentication yes - AuthenticationMethods publickey,keyboard-interactive:pam - '' - else '' - PubkeyAuthentication yes - AuthenticationMethods publickey - '' - ) - (lib.optionalString cfg.conf.rootLogin "PermitRootLogin yes") - ]; - }; - - security.pam.services = lib.optionalAttrs cfg.conf.otp { - login.googleAuthenticator.enable = true; - - sshd.text = '' - account required pam_unix.so - - auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so nullok no_increment_hotp - auth sufficient pam_permit.so - - session required pam_env.so conffile=/etc/pam/environment readenv=0 - session required pam_unix.so - session required pam_loginuid.so - session optional ${pkgs.systemd}/lib/security/pam_systemd.so - ''; }; - users.users = let - k.openssh.authorizedKeys.keys = - hosts - |> builtins.mapAttrs (_: data: data.user_pubkey or null) - |> builtins.attrValues - |> builtins.filter (x: x != null); - in { - ${config.collinux.user.name} = k; - "root" = lib.mkIf cfg.conf.rootLogin k; + users.users = { + ${config.collinux.user.name}.openssh.authorizedKeys.keys = authorizedKeys; + root.openssh.authorizedKeys.keys = lib.mkIf cfg.conf.rootLogin authorizedKeys; }; - systemd.services."openssh" = { - after = lib.mkAfter ["network-online.target"]; - wants = lib.mkAfter ["network-online.target"]; + systemd.services.openssh = { + after = ["network-online.target"]; + wants = ["network-online.target"]; }; }; } diff --git a/modules/services/nixos/qbittorrent.nix b/modules/services/nixos/qbittorrent.nix index bb0fab7..cc147b1 100644 --- a/modules/services/nixos/qbittorrent.nix +++ b/modules/services/nixos/qbittorrent.nix @@ -23,7 +23,7 @@ in { services.caddy.virtualHosts."bittorrent.ganymede".extraConfig = '' tls internal - reverse_proxy ${toString cfg.port} + reverse_proxy 127.0.0.1:${toString cfg.port} ''; }; } diff --git a/modules/services/options.nix b/modules/services/options.nix index 1cb1019..7dbaa2c 100644 --- a/modules/services/options.nix +++ b/modules/services/options.nix @@ -100,6 +100,12 @@ in { goaccess = webserviceOptions { service_name = "goaccess"; }; + glance = { + enable = mkEnableOption "Glance homepage"; + port = lib.mkOption { + type = lib.types.port; + }; + }; cgit = webserviceOptions { service_name = "cgit"; reverse_proxy = false; diff --git a/modules/system/nixos/boot.nix b/modules/system/nixos/boot.nix index 71bac70..50d66fe 100644 --- a/modules/system/nixos/boot.nix +++ b/modules/system/nixos/boot.nix @@ -8,6 +8,7 @@ in { boot = { + kernelParams = ["quiet"]; bcache.enable = false; # why is this default on? I DON'T CARE ABOUT bcachefs initrd = { verbose = false; @@ -77,7 +78,7 @@ in { enable = true; mutable = true; # necessary for installing secrets into etc }; - # system.nixos-init.enable = true; + system.nixos-init.enable = true; # store journald logs in memory services.journald.extraConfig = '' diff --git a/modules/system/nixos/networking/resolved.nix b/modules/system/nixos/networking/resolved.nix index 161471f..e49e004 100644 --- a/modules/system/nixos/networking/resolved.nix +++ b/modules/system/nixos/networking/resolved.nix @@ -1,40 +1,6 @@ -{config, ...}: let - hostname = config.networking.hostName; - netname = "${hostname}net0"; -in { +{config, ...}: { networking.resolvconf.enable = false; - services.dnsmasq = { - enable = true; - settings = { - port = 5353; - address = "/.${hostname}/127.0.0.1"; - bind-interfaces = true; - }; - }; - - systemd.network.netdevs."19-localnet" = { - netdevConfig = { - Name = netname; - Kind = "dummy"; - }; - }; - - systemd.network.networks."19-localnet" = { - matchConfig = { - Name = netname; - }; - address = ["192.0.2.1/32"]; # BUG(?): a dummy network must have an address for systemd-networkd to attempt to use it to resolve dns queries (that took forever to debug) - dns = ["127.0.0.1:5353"]; - domains = ["~${hostname}"]; - extraConfig = '' - LinkLocalAddressing=no - ConfigureWithoutCarrier=yes - DNSSEC=no - DNSOverTLS=no - ''; - }; - networking.nameservers = [ "9.9.9.9#dns.quad9.net" "149.112.112.112#dns.quad9.net" diff --git a/modules/user/nixos/default.nix b/modules/user/nixos/default.nix index fbc6001..68238d6 100644 --- a/modules/user/nixos/default.nix +++ b/modules/user/nixos/default.nix @@ -15,7 +15,7 @@ in { extraGroups = ["networkmanager" "disks" "input" "video" "dialout" "kvm"] ++ (lib.optional cfg.isAdmin "wheel"); }; }; - # services.userborn.enable = true; + services.userborn.enable = true; # sudo security = { |