Compare commits

...

4 commits

Author SHA1 Message Date
2634f89d6f
updated README 2023-11-07 09:20:59 +01:00
6bcaca4bed
Code Linting and hooks to do so automatically 2023-11-07 09:20:59 +01:00
7acba2a5bb
removed .gitkeep 2023-11-06 22:10:13 +01:00
Gonne Kretschmer
823b617aad nix flake update 2023-11-06 17:04:45 +01:00
16 changed files with 335 additions and 211 deletions

2
.gitignore vendored
View file

@ -2,4 +2,4 @@
# Ignore build outputs from performing a nix-build or `nix build` command # Ignore build outputs from performing a nix-build or `nix build` command
result result
result-* result-*
.pre-commit-config.yaml

View file

@ -170,6 +170,10 @@ In your hardware
configuration you should basically only write you filesystem layout and your hostPlatform. The bootloading stuff configuration you should basically only write you filesystem layout and your hostPlatform. The bootloading stuff
is already taken care of by `../../roles`. is already taken care of by `../../roles`.
The `flake-inputs` argument is optional, but you can use it if you need to get a hold of the flake inputs,
else this is a complete normal nixos system configuration module (with a lot of settings already imorted
from `../../roles`).
As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of
this is constant across all systems and will undergo refactor soon. this is constant across all systems and will undergo refactor soon.

View file

@ -1,24 +1,44 @@
{inputs, ...}: {inputs, ...}: {
{
# debug = true; # debug = true;
# We only define machines config in this flake yet, so we only include # We only define machines config in this flake yet, so we only include
# the module that builds these. This file might get fuller, if we need to # the module that builds these. This file might get fuller, if we need to
# build our own packages, that are not flakes. # build our own packages, that are not flakes.
imports = [ ./nixos/flake-module.nix imports = [
./nixos/flake-module.nix
inputs.pre-commit-hooks.flakeModule
# To import a flake module # To import a flake module
# 1. Add foo to inputs # 1. Add foo to inputs
# 2. Add foo as a parameter to the outputs function # 2. Add foo as a parameter to the outputs function
# 3. Add here: foo.flakeModule # 3. Add here: foo.flakeModule
]; ];
systems = ["x86_64-linux"]; systems = ["x86_64-linux"];
# perSystem = { config, self', inputs', pkgs, system, ... }: { perSystem = {
config,
inputs',
pkgs,
...
}: {
devShells.default = pkgs.mkShell {
shellHook = config.pre-commit.installationScript;
};
pre-commit = {
check.enable = true;
pkgs = inputs'.nixpkgs.legacyPackages;
settings.hooks = {
nil.enable = true;
statix.enable = true;
deadnix.enable = true;
alejandra.enable = true;
};
};
# Per-system attributes can be defined here. The self' and inputs' # Per-system attributes can be defined here. The self' and inputs'
# module parameters provide easy access to attributes of the same # module parameters provide easy access to attributes of the same
# system. # system.
};
# Equivalent to inputs'.nixpkgs.legacyPackages.hello; # Equivalent to inputs'.nixpkgs.legacyPackages.hello;
# };
# flake = { # flake = {
# The usual flake attributes can be defined here, including system- # The usual flake attributes can be defined here, including system-
# agnostic ones like nixosModule and system-enumerating ones, although # agnostic ones like nixosModule and system-enumerating ones, although

View file

@ -21,11 +21,11 @@
"nixpkgs-lib": "nixpkgs-lib" "nixpkgs-lib": "nixpkgs-lib"
}, },
"locked": { "locked": {
"lastModified": 1685662779, "lastModified": 1698882062,
"narHash": "sha256-cKDDciXGpMEjP1n6HlzKinN0H+oLmNpgeCTzYnsA2po=", "narHash": "sha256-HkhafUayIqxXyHH1X8d9RDl1M2CkFgZLjKD3MzabiEo=",
"owner": "hercules-ci", "owner": "hercules-ci",
"repo": "flake-parts", "repo": "flake-parts",
"rev": "71fb97f0d875fd4de4994dfb849f2c75e17eb6c3", "rev": "8c9fa2545007b49a5db5f650ae91f227672c3877",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -33,13 +33,31 @@
"type": "indirect" "type": "indirect"
} }
}, },
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1685518550,
"narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"impermanence": { "impermanence": {
"locked": { "locked": {
"lastModified": 1694622745, "lastModified": 1697303681,
"narHash": "sha256-z397+eDhKx9c2qNafL1xv75lC0Q4nOaFlhaU1TINqb8=", "narHash": "sha256-caJ0rXeagaih+xTgRduYtYKL1rZ9ylh06CIrt1w5B4g=",
"owner": "nix-community", "owner": "nix-community",
"repo": "impermanence", "repo": "impermanence",
"rev": "e9643d08d0d193a2e074a19d4d90c67a874d932e", "rev": "0f317c2e9e56550ce12323eb39302d251618f5b5",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -54,14 +72,15 @@
"flake-compat": [], "flake-compat": [],
"nixpkgs": [], "nixpkgs": [],
"nixpkgs-22_11": "nixpkgs-22_11", "nixpkgs-22_11": "nixpkgs-22_11",
"nixpkgs-23_05": "nixpkgs-23_05",
"utils": "utils" "utils": "utils"
}, },
"locked": { "locked": {
"lastModified": 1686468558, "lastModified": 1695910380,
"narHash": "sha256-K69Ojlx3N8I6tRTZsrKFMIqK4yrnJ6/PjfKZi3wchYg=", "narHash": "sha256-CyzeiXQGm8ceEOSK1dffBCfO7JNp8XhQeNkUiJ5HxgY=",
"ref": "refs/heads/master", "ref": "master",
"rev": "290d00f6db4e80467013728819ad73dd4a394d9a", "rev": "84783b661ecf33927c534b6476beb74ea3308968",
"revCount": 554, "revCount": 572,
"type": "git", "type": "git",
"url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git" "url": "https://gitlab.com/simple-nixos-mailserver/nixos-mailserver.git"
}, },
@ -72,11 +91,11 @@
}, },
"nixpkgs": { "nixpkgs": {
"locked": { "locked": {
"lastModified": 1686412476, "lastModified": 1699099776,
"narHash": "sha256-inl9SVk6o5h75XKC79qrDCAobTD1Jxh6kVYTZKHzewA=", "narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "21951114383770f96ae528d0ae68824557768e81", "rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -101,14 +120,29 @@
"type": "indirect" "type": "indirect"
} }
}, },
"nixpkgs-23_05": {
"locked": {
"lastModified": 1684782344,
"narHash": "sha256-SHN8hPYYSX0thDrMLMWPWYulK3YFgASOrCsIL3AJ78g=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "8966c43feba2c701ed624302b6a935f97bcbdf88",
"type": "github"
},
"original": {
"id": "nixpkgs",
"ref": "nixos-23.05",
"type": "indirect"
}
},
"nixpkgs-lib": { "nixpkgs-lib": {
"locked": { "locked": {
"dir": "lib", "dir": "lib",
"lastModified": 1685564631, "lastModified": 1698611440,
"narHash": "sha256-8ywr3AkblY4++3lIVxmrWZFzac7+f32ZEhH/A8pNscI=", "narHash": "sha256-jPjHjrerhYDy3q9+s5EAsuhyhuknNfowY6yt6pjn9pc=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "4f53efe34b3a8877ac923b9350c874e3dcd5dc0a", "rev": "0cbe9f69c234a7700596e943bfae7ef27a31b735",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -121,11 +155,11 @@
}, },
"nixpkgs-stable": { "nixpkgs-stable": {
"locked": { "locked": {
"lastModified": 1694908564, "lastModified": 1699110214,
"narHash": "sha256-ducA98AuWWJu5oUElIzN24Q22WlO8bOfixGzBgzYdVc=", "narHash": "sha256-L2TU4RgtiqF69W8Gacg2jEkEYJrW+Kp0Mp4plwQh5b8=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "596611941a74be176b98aeba9328aa9d01b8b322", "rev": "78f3a4ae19f0e99d5323dd2e3853916b8ee4afee",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -135,12 +169,35 @@
"type": "github" "type": "github"
} }
}, },
"pre-commit-hooks": {
"inputs": {
"flake-compat": [],
"flake-utils": "flake-utils",
"gitignore": [],
"nixpkgs": [],
"nixpkgs-stable": []
},
"locked": {
"lastModified": 1699271226,
"narHash": "sha256-8Jt1KW3xTjolD6c6OjJm9USx/jmL+VVmbooADCkdDfU=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "ea758da1a6dcde6dc36db348ed690d09b9864128",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"type": "github"
}
},
"root": { "root": {
"inputs": { "inputs": {
"flake-parts": "flake-parts", "flake-parts": "flake-parts",
"impermanence": "impermanence", "impermanence": "impermanence",
"nixos-mailserver": "nixos-mailserver", "nixos-mailserver": "nixos-mailserver",
"nixpkgs": "nixpkgs", "nixpkgs": "nixpkgs",
"pre-commit-hooks": "pre-commit-hooks",
"sops-nix": "sops-nix" "sops-nix": "sops-nix"
} }
}, },
@ -152,11 +209,11 @@
"nixpkgs-stable": "nixpkgs-stable" "nixpkgs-stable": "nixpkgs-stable"
}, },
"locked": { "locked": {
"lastModified": 1695284550, "lastModified": 1699252567,
"narHash": "sha256-z9fz/wz9qo9XePEvdduf+sBNeoI9QG8NJKl5ssA8Xl4=", "narHash": "sha256-WCzEBCu17uXilT9OZ3XSy/c4Gk/j3L7AUxBRHzNlQ4Y=",
"owner": "Mic92", "owner": "Mic92",
"repo": "sops-nix", "repo": "sops-nix",
"rev": "2f375ed8702b0d8ee2430885059d5e7975e38f78", "rev": "0a9d5e41f6013a1b8b66573822f9beb827902968",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -165,6 +222,21 @@
"type": "github" "type": "github"
} }
}, },
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"utils": { "utils": {
"locked": { "locked": {
"lastModified": 1605370193, "lastModified": 1605370193,

View file

@ -17,6 +17,15 @@
impermanence = { impermanence = {
url = "github:nix-community/impermanence"; url = "github:nix-community/impermanence";
}; };
pre-commit-hooks = {
url = "github:cachix/pre-commit-hooks.nix";
inputs = {
flake-compat.follows = "";
gitignore.follows = "";
nixpkgs-stable.follows = "";
nixpkgs.follows = "";
};
};
}; };
outputs = inputs @ {flake-parts, ...}: outputs = inputs @ {flake-parts, ...}:

View file

@ -1,20 +1,30 @@
# copied and adopted from maralorns config # copied and adopted from maralorns config
# This automatically searches for nixos configs in ./machines/${name}/configuration.nix # This automatically searches for nixos configs in ./machines/${name}/configuration.nix
# and exposes them as outputs.nixosConfigurations.${name} # and exposes them as outputs.nixosConfigurations.${name}
{ withSystem, lib, inputs, ... }: { {
withSystem,
lib,
inputs,
...
}: {
flake = { flake = {
nixosConfigurations = withSystem "x86_64-linux" ({ pkgs, ... }: nixosConfigurations = withSystem "x86_64-linux" ({pkgs, ...}: let
let
machines = builtins.attrNames (builtins.readDir ./machines); machines = builtins.attrNames (builtins.readDir ./machines);
makeSystem = name: makeSystem = name: let
importedModule = import (./. + "/machines/${name}/configuration.nix");
configModule =
if lib.isFunction importedModule
then importedModule inputs
else importedModule;
in
pkgs.nixos { pkgs.nixos {
imports = [ imports = [
(import (./. + "/machines/${name}/configuration.nix") inputs) configModule
inputs.sops-nix.nixosModules.sops inputs.sops-nix.nixosModules.sops
inputs.impermanence.nixosModules.impermanence inputs.impermanence.nixosModules.impermanence
]; ];
}; };
in lib.genAttrs machines makeSystem); in
lib.genAttrs machines makeSystem);
}; };
} }

View file

@ -1,6 +1,4 @@
flake-inputs: {
{config, pkgs, lib, ... }: {
imports = [ imports = [
./hardware-configuration.nix ./hardware-configuration.nix
../../modules/jitsi.nix ../../modules/jitsi.nix

View file

@ -1,4 +1,4 @@
{config, lib, pkgs, modulesPath, ...}: { {lib, ...}: {
imports = []; imports = [];
fileSystems."/" = { fileSystems."/" = {
@ -22,8 +22,7 @@
options = ["subvol=nix"]; options = ["subvol=nix"];
}; };
swapDevices = swapDevices = [{device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a";}];
[{ device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a"; }];
nix.settings.max-jobs = lib.mkDefault 4; nix.settings.max-jobs = lib.mkDefault 4;

View file

@ -4,12 +4,13 @@
{ {
imports = []; imports = [];
networking = { networking = {
interfaces.enX0.ipv4.addresses = [ { interfaces.enX0.ipv4.addresses = [
{
address = "192.168.0.25"; address = "192.168.0.25";
prefixLength = 16; prefixLength = 16;
} ]; }
];
defaultGateway = "192.168.0.152"; defaultGateway = "192.168.0.152";
nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
}; };
} }

View file

@ -1,16 +1,17 @@
{lib, config, ...} : {
lib,
let config,
inherit (lib) ...
}: let
inherit
(lib)
mkEnableOption mkEnableOption
mkIf mkIf
mkOption mkOption
types types
; ;
cfg = config.impermanence; cfg = config.impermanence;
in in {
{
imports = []; imports = [];
options.impermanence = { options.impermanence = {
@ -43,5 +44,4 @@ config = mkIf cfg.enable {
}; };
environment.etc.machine-id.source = "${cfg.storagePath}/machine-id"; environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
}; };
} }

View file

@ -1,14 +1,19 @@
{pkgs, config, lib, modulesPath, ...}: {
let config,
inherit (lib) lib,
modulesPath,
...
}: let
inherit
(lib)
mkIf mkIf
mkEnableOption mkEnableOption
mkOption mkOption
head; head
;
inherit (lib.types) str; inherit (lib.types) str;
cfg = config.services.mathebau-jitsi; cfg = config.services.mathebau-jitsi;
in in {
{
imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")]; imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")];
options.services.mathebau-jitsi = { options.services.mathebau-jitsi = {
@ -25,16 +30,16 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.jitsi-meet = { services.jitsi-meet = {
enable = true; enable = true;
hostName = cfg.hostName;
config = { config = {
defaultLang = "de"; defaultLang = "de";
}; };
inherit (cfg) hostName;
}; };
services.jitsi-videobridge = { services.jitsi-videobridge = {
openFirewall = true; openFirewall = true;
nat = { nat = {
publicAddress = "130.83.2.184"; publicAddress = "130.83.2.184";
localAddress = cfg.localAddress; inherit (cfg) localAddress;
}; };
}; };
environment.persistence.${config.impermanence.name} = { environment.persistence.${config.impermanence.name} = {

View file

@ -1,26 +1,24 @@
{lib, ...}: {lib, ...}:
with lib; with lib; let
let
admins = { admins = {
nerf = { nerf = {
hashedPassword = hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
"$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
keys = [ keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
]; ];
}; };
gonne = { gonne = {
hashedPassword = hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
"$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
keys = [ keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
]; ];
}; };
}; };
mkAdmin = name : mkAdmin = name: {
{hashedPassword, keys}: { hashedPassword,
keys,
}: {
"${name}" = { "${name}" = {
isNormalUser = true; isNormalUser = true;
createHome = true; createHome = true;
@ -31,7 +29,6 @@ let
inherit hashedPassword; inherit hashedPassword;
}; };
}; };
in { in {
users.users = mkMerge (mapAttrsToList mkAdmin admins); users.users = mkMerge (mapAttrsToList mkAdmin admins);
} }

View file

@ -1,5 +1,9 @@
{pkgs, config, lib, modulesPath, ...} : { {
pkgs,
lib,
modulesPath,
...
}: {
imports = [ imports = [
./admins.nix ./admins.nix
./nix_keys.nix ./nix_keys.nix
@ -15,7 +19,8 @@ nix = {
}; };
networking = { networking = {
firewall = { # these shoud be default, but better make sure! firewall = {
# these shoud be default, but better make sure!
enable = true; enable = true;
allowPing = true; allowPing = true;
}; };
@ -35,8 +40,13 @@ sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
environment = { environment = {
systemPackages = builtins.attrValues { systemPackages = builtins.attrValues {
inherit (pkgs) inherit
htop lsof tmux btop; (pkgs)
htop
lsof
tmux
btop
;
}; };
}; };

View file

@ -1,5 +1,4 @@
{config, ...}: {config, ...}: {
{
imports = []; imports = [];
services.prometheus.exporters.node = { services.prometheus.exporters.node = {
enable = true; enable = true;