From 9ef174152929b038b01bc2f261b719a57cdad654 Mon Sep 17 00:00:00 2001 From: Collin Williams <96917990+bluedragon1221@users.noreply.github.com> Date: Sun, 31 May 2026 14:40:27 -0500 Subject: stuff --- flake.nix | 2 +- hosts/mercury/disks.nix | 7 ++- hosts/mercury/nixos.nix | 4 ++ services/caddy.nix | 104 ------------------------------------ services/goaccess.nix | 136 ------------------------------------------------ 5 files changed, 11 insertions(+), 242 deletions(-) delete mode 100644 services/caddy.nix delete mode 100644 services/goaccess.nix diff --git a/flake.nix b/flake.nix index 12a2b81..d753b56 100644 --- a/flake.nix +++ b/flake.nix @@ -89,7 +89,7 @@ pkgs = buildPkgs; hostname = "mercury"; }; - default = buildPkgs.callPackage ./pkgs/yo.nix { + default = buildPkgs.callPackage ./pkgs/yo { pkgs = buildPkgs; }; }; diff --git a/hosts/mercury/disks.nix b/hosts/mercury/disks.nix index 7ef2d0d..a8cfda3 100644 --- a/hosts/mercury/disks.nix +++ b/hosts/mercury/disks.nix @@ -1,4 +1,4 @@ -{ +{lib, ...}: { fileSystems."/" = { device = "/dev/disk/by-uuid/3d80a86b-3268-4209-a833-b531b8bc0ebc"; fsType = "ext4"; @@ -24,4 +24,9 @@ boot.kernelParams = [ "resume=LABEL=swap" ]; + + virtualisation.vmVariant = { + swapDevices = lib.mkForce []; + boot.kernelParams = lib.mkForce []; + }; } diff --git a/hosts/mercury/nixos.nix b/hosts/mercury/nixos.nix index 9a89fca..25b5a91 100644 --- a/hosts/mercury/nixos.nix +++ b/hosts/mercury/nixos.nix @@ -85,4 +85,8 @@ -----END CERTIFICATE----- '' ]; + + virtualisation.vmVariant = { + virtualisation.diskSize = 8192; + }; } diff --git a/services/caddy.nix b/services/caddy.nix deleted file mode 100644 index 9870af0..0000000 --- a/services/caddy.nix +++ /dev/null @@ -1,104 +0,0 @@ -{ - lib, - config, - ... -}: let - cfg = config.caddy; -in { - options = { - caddy = { - globalConfig = lib.mkOption { - description = "Configuration for top level stuff (ex. dns server api keys)"; - type = lib.types.lines; - default = ""; - }; - tld = lib.mkOption { - description = "Your publically accessable domain name"; - type = lib.types.str; - }; - hostname = lib.mkOption { - description = "Your computers hostname"; - type = lib.types.str; - }; - virtualHosts = lib.mkOption { - description = "Magically configure caddy for services"; - type = lib.types.attrsOf (lib.types.submodule ({config, ...}: { - options = { - serviceName = lib.mkOption { - type = lib.types.str; - default = config._module.args.name; - internal = true; - }; - access = lib.mkOption { - type = lib.types.enum ["public" "private"]; - description = "public: accessable at {serviceName}.my.tld. private: accessable at {serviceName}.{hostname}"; - }; - logFile = lib.mkOption { - type = lib.types.str; - description = "what to name the log file under /var/log/caddy"; - default = "${config.serviceName}.log"; - }; - reverseProxy = lib.mkOption { - type = with lib.types; nullOr str; - description = "configure caddy to reverse-proxy this port or unix domain socket (ex. 127.0.0.1:8080 or unix//var/run/my_socket)"; - default = null; - }; - virtualHostConfig = lib.mkOption { - type = lib.types.lines; - description = "manual config lines to add to the caddy config"; - default = ""; - }; - }; - })); - default = {}; - }; - }; - }; - config = { - configData."caddyfile".text = - '' - { - ${cfg.globalConfig} - } - '' - ++ (cfg.virtualHosts - |> map (vhost_cfg: let - target = - if vhost_cfg.access == "public" - then - ( - if vhost_cfg.serviceName != "root" - then "${vhost_cfg.serviceName}.${cfg.tld}" - else cfg.tld - ) - else - ( - if vhost_cfg.serviceName != "root" - then "${vhost_cfg.serviceName}.${cfg.hostName}" - else cfg.hostname - ); - in '' - log { - output file /var/log/caddy/${vhost_cfg.logFile} - } - - ${target} { - ${ - if vhost_cfg.access == "private" - then "tls internal" - else "" - } - ${ - if vhost_cfg.reverseProxy != null - then "reverse_proxy ${vhost_cfg.reverseProxy}" - else "" - } - ${vhost_cfg.virtualHostConfig} - } - '') - |> builtins.concatStringsSep "\n\n"); - - services."caddy".systemd.service = { - }; - }; -} diff --git a/services/goaccess.nix b/services/goaccess.nix deleted file mode 100644 index dd6b26d..0000000 --- a/services/goaccess.nix +++ /dev/null @@ -1,136 +0,0 @@ -{ - lib, - pkgs, - config, - inputs, - ... -}: let - cfg = config.goaccess; -in { - options."caddy-goaccess" = { - timeZone = lib.mkOption { - type = lib.types.str; - description = "time zone"; - }; - logFile = lib.mkOption { - type = lib.types.str; - description = "caddy log file for goaccess to read (must be chmod 775)"; - }; - websocketUrl = lib.mkOption { - type = lib.types.str; - description = "url that the frontend should use to attach to the service websocket"; - }; - }; - config = let - settings = { - unix-socket = "/run/caddy-goaccess/socket"; - ws-url = cfg.websocketUrl; - - date-format = "%s"; - log-format = "CADDY"; - tz = cfg.timeZone; - log-file = cfg.logFile; - geoip-database = inputs.geolite-db; - - output = "/run/caddy-goaccess/index.html"; - real-time-html = "true"; - external-assets = "true"; - all-static-files = "false"; - html-report-title = "stats@ganymede"; - hl-header = "true"; - agent-list = "false"; - with-output-resolver = "false"; - http-method = "yes"; - http-protocol = "yes"; - "4xx-to-unique-count" = "false"; - ignore-crawlers = "false"; - crawlers-only = "false"; - unknowns-as-crawlers = "false"; - real-os = "true"; - }; - in { - configData."goaccess.conf".text = settings |> builtins.mapAttrs (k: v: "${k} ${toString v}") |> builtins.attrValues |> lib.concatStringsSep "\n"; - services."caddy-goaccess" = { - systemd.socket = { - description = "caddy-goaccess uds"; - socketConfig = { - ListenStream = "/run/caddy-goaccess/socket"; - SocketMode = "0660"; - SocketUser = "goaccess"; - SocketGroup = "caddy"; - }; - wantedBy = ["sockets.target"]; - }; - - systemd.service = { - description = "GoAccess Real-Time Log Analyzer"; - restartIfChanged = true; - wants = ["network-online.target" "caddy.service"]; - after = ["network-online.target" "caddy.service"]; - requires = ["caddy-goaccess.socket"]; - - serviceConfig = { - Type = "simple"; - - DynamicUser = true; - SupplimentaryGroup = "caddy"; # to read caddy log files - RuntimeDirectory = "caddy-goaccess"; # /run/caddy-goaccess - ExecStart = "${pkgs.goaccess}/bin/goaccess -p ${config.configData."goaccess.conf".path}"; - - # hardening stuff - AmbientCapabilities = []; - CapabilityBoundingSet = [ - "~CAP_RAWIO" - "~CAP_MKNOD" - "~CAP_AUDIT_CONTROL" - "~CAP_AUDIT_READ" - "~CAP_AUDIT_WRITE" - "~CAP_SYS_BOOT" - "~CAP_SYS_TIME" - "~CAP_SYS_MODULE" - "~CAP_SYS_PACCT" - "~CAP_LEASE" - "~CAP_LINUX_IMMUTABLE" - "~CAP_IPC_LOCK" - "~CAP_BLOCK_SUSPEND" - "~CAP_WAKE_ALARM" - "~CAP_SYS_TTY_CONFIG" - "~CAP_MAC_ADMIN" - "~CAP_MAC_OVERRIDE" - "~CAP_NET_ADMIN" - "~CAP_NET_BROADCAST" - "~CAP_NET_RAW" - "~CAP_SYS_ADMIN" - "~CAP_SYS_PTRACE" - "~CAP_SYSLOG" - ]; - DevicePolicy = "closed"; - KeyringMode = "private"; - LockPersonality = true; - NoNewPrivileges = true; - PrivateDevices = true; - PrivateMounts = true; - PrivateTmp = true; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectSystem = "full"; - RemoveIPC = true; - RestrictAddressFamilies = [ - "AF_UNIX" - "AF_INET" - "AF_INET6" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; - }; - - wantedBy = ["multi-user.target"]; - }; - }; - }; -} -- cgit v1.3.1