From 344b31db65fc6b02f41d7a21c5d6a209c49bdc36 Mon Sep 17 00:00:00 2001 From: Asmir A Date: Sun, 31 May 2026 12:02:20 +0200 Subject: [PATCH] clean old hosts --- blue/configuration.nix | 333 -------------- blue/hardware-configuration.nix | 100 ----- mediabox/configuration.nix | 474 -------------------- mediabox/hardware-configuration.nix | 90 ---- mediabox/peerix-public | 1 - mediabox/secrets/peerix.yaml | 31 -- mediabox/secrets/wg_privkey.yaml | 30 -- mediabox/wg_pubkey | 1 - nixy/configuration.nix | 659 ---------------------------- nixy/hardware-configuration.nix | 65 --- nixy/peerix-public | 1 - nixy/secrets/borgbase_enc_key.yaml | 21 - nixy/secrets/borgbase_ssh_key.yaml | 21 - nixy/secrets/peerix.yaml | 22 - nixy/secrets/wg_preshared.yaml | 21 - nixy/secrets/wg_privkey.yaml | 21 - nixy/secrets/wg_privkey_proton.yaml | 22 - nixy/ssh_pubkey | 1 - nixy/wg_pubkey | 1 - nixy/wg_pubkey_nx | 1 - 20 files changed, 1916 deletions(-) delete mode 100644 blue/configuration.nix delete mode 100644 blue/hardware-configuration.nix delete mode 100644 mediabox/configuration.nix delete mode 100644 mediabox/hardware-configuration.nix delete mode 100644 mediabox/peerix-public delete mode 100644 mediabox/secrets/peerix.yaml delete mode 100644 mediabox/secrets/wg_privkey.yaml delete mode 100644 mediabox/wg_pubkey delete mode 100644 nixy/configuration.nix delete mode 100644 nixy/hardware-configuration.nix delete mode 100644 nixy/peerix-public delete mode 100644 nixy/secrets/borgbase_enc_key.yaml delete mode 100644 nixy/secrets/borgbase_ssh_key.yaml delete mode 100644 nixy/secrets/peerix.yaml delete mode 100644 nixy/secrets/wg_preshared.yaml delete mode 100644 nixy/secrets/wg_privkey.yaml delete mode 100644 nixy/secrets/wg_privkey_proton.yaml delete mode 100644 nixy/ssh_pubkey delete mode 100644 nixy/wg_pubkey delete mode 100644 nixy/wg_pubkey_nx diff --git a/blue/configuration.nix b/blue/configuration.nix deleted file mode 100644 index 687c9f4..0000000 --- a/blue/configuration.nix +++ /dev/null @@ -1,333 +0,0 @@ -{ - config, - pkgs, - ... -}: -{ - imports = [ - ]; - - system.stateVersion = "23.05"; - system.autoUpgrade.enable = true; - - nix = { - optimise.automatic = true; - gc.automatic = true; - gc.options = "--delete-older-than 7d"; - package = pkgs.nixVersions.latest; - settings.experimental-features = [ - "nix-command" - "flakes" - ]; - }; - - boot = { - kernelPackages = pkgs.linuxPackages_latest; - kernelParams = [ "msr.allow_writes=on" ]; - supportedFilesystems = [ "btrfs" ]; - tmpOnTmpfs = true; - initrd.compressor = "zstd"; - loader.systemd-boot = { - enable = true; - editor = false; - memtest86.enable = true; - }; - loader.efi.canTouchEfiVariables = true; - readOnlyNixStore = true; - }; - - security = { - rtkit.enable = true; - allowSimultaneousMultithreading = true; - sudo.enable = false; - doas.enable = true; - doas.extraRules = [ - { - users = [ "akill" ]; - keepEnv = true; - persist = true; - } - ]; - }; - - powerManagement = { - enable = true; - }; - - networking = { - firewall.enable = true; - hostName = "blue"; - nameservers = [ - "127.0.0.1" - "::1" - ]; - dhcpcd.extraConfig = "nohook resolv.conf"; - - networkmanager = { - enable = true; - dns = "none"; - # wifi.backend = "iwd"; - }; - }; - - time.timeZone = "Europe/Sarajevo"; - - nixpkgs.config.allowUnfree = true; - environment = { - homeBinInPath = true; - variables = { - PATH = "$HOME/.cargo/bin"; - }; - }; - - programs = { - gnupg.agent = { - enable = true; - enableSSHSupport = true; - }; - zsh.enable = true; - firejail.enable = true; - adb.enable = true; - wireshark.enable = true; - sway.enable = true; - }; - - # List services that you want to enable: - systemd = { - services = { - "caps2esc" = { - description = "Intercepts keyboard udev events"; - wants = [ "systemd-udevd.service" ]; - wantedBy = [ "multi-user.target" ]; - serviceConfig.Nice = -20; - script = '' - ${pkgs.interception-tools}/bin/intercept \ - -g /dev/input/by-path/*-kbd | \ - /opt/caps2esc | ${pkgs.interception-tools}/bin/uinput \ - -d /dev/input/by-path/*-kbd \ - ''; - }; - }; - - extraConfig = '' - DefaultTimeoutStartSec=30s - DefaultTimeoutStopSec=30s - ''; - }; - - services = { - acpid.enable = true; - btrfs.autoScrub.enable = true; - dbus.enable = true; - fstrim.enable = true; - fwupd.enable = true; - ntp.enable = true; - openssh.enable = false; - printing.enable = true; - - nextcloud = { - enable = true; - hostName = "localhost"; - config.adminpassFile = "${pkgs.writeText "adminpass" "test123"}"; - }; - - jellyfin = { - enable = false; - user = "akill"; - openFirewall = false; - }; - - pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - }; - - xserver = { - enable = true; - dpi = 144; - libinput.enable = true; - desktopManager.xterm.enable = false; - displayManager = { - lightdm.enable = false; - startx.enable = true; - defaultSession = "none+i3"; - }; - windowManager.i3.enable = true; - }; - - udev.packages = [ - pkgs.rtl-sdr - pkgs.openhantek6022 - ]; - - tlp = { - enable = true; - }; - - actkbd = { - enable = true; - bindings = [ - { - keys = [ 113 ]; - events = [ "key" ]; - command = "/run/current-system/sw/bin/runuser -l akill -c 'amixer -q set Master toggle'"; - } - - { - keys = [ 114 ]; - events = [ - "key" - "rep" - ]; - command = "/run/current-system/sw/bin/runuser -l akill -c 'amixer -q set Master 5%- unmute'"; - } - - { - keys = [ 115 ]; - events = [ - "key" - "rep" - ]; - command = "/run/current-system/sw/bin/runuser -l akill -c 'amixer -q set Master 5%+ unmute'"; - } - - { - keys = [ 224 ]; - events = [ "key" ]; - command = "${pkgs.light}/bin/light -U 5"; - } - - { - keys = [ 225 ]; - events = [ "key" ]; - command = "${pkgs.light}/bin/light -A 5"; - } - ]; - }; - - mpd = { - musicDirectory = "/home/mpd/music"; - enable = false; - extraConfig = '' - audio_output { - type "pulse" - name "pulsee srv" - server "127.0.0.1" - } - ''; - }; - - dnscrypt-proxy2 = { - enable = true; - settings = { - ipv6_servers = true; - require_dnssec = true; - - sources.public-resolvers = { - urls = [ - "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md" - "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md" - ]; - cache_file = "/var/lib/dnscrypt-proxy2/public-resolvers.md"; - minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3"; - }; - }; - }; - - journald.extraConfig = '' - SystemMaxUse=50M - ''; - - logind.extraConfig = '' - KillUserProcesses=yes - ''; - }; - - fonts = { - fontconfig = { - cache32Bit = true; - allowBitmaps = true; - useEmbeddedBitmaps = true; - defaultFonts = { - monospace = [ "JetBrainsMono" ]; - }; - }; - - fonts = with pkgs; [ - dejavu_fonts - dina-font - fira-code - fira-code-symbols - font-awesome - font-awesome_4 - inconsolata - iosevka - jetbrains-mono - liberation_ttf - noto-fonts - noto-fonts-cjk - noto-fonts-emoji - proggyfonts - siji - terminus_font - terminus_font_ttf - ubuntu_font_family - ]; - }; - - virtualisation = { - containers.storage.settings = { - storage = { - driver = "btrfs"; - graphroot = "/var/lib/containers/storage"; - runroot = "/run/containers/storage"; - }; - }; - podman = { - enable = true; - dockerCompat = true; - }; - }; - - sound.enable = true; - - hardware = { - bluetooth = { - enable = true; - settings = { - General = { - Enable = "Source,Sink,Media,Socket"; - }; - }; - }; - - opengl = { - enable = true; - driSupport = true; - driSupport32Bit = true; - extraPackages = with pkgs; [ - ]; - }; - }; - - zramSwap = { - enable = false; - algorithm = "zstd"; - }; - - users.users.akill = { - isNormalUser = true; - shell = pkgs.zsh; - extraGroups = [ - "wireshark" - "kvm" - "tty" - "audio" - "sound" - "adbusers" - "dialout" - ]; - }; -} diff --git a/blue/hardware-configuration.nix b/blue/hardware-configuration.nix deleted file mode 100644 index 5538d74..0000000 --- a/blue/hardware-configuration.nix +++ /dev/null @@ -1,100 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ - config, - lib, - modulesPath, - ... -}: -{ - imports = [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ - "xhci_pci" - "ahci" - "nvme" - "usbhid" - "usb_storage" - "sd_mod" - "sr_mod" - ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = { - device = "/dev/disk/by-uuid/0af4dcb9-6e59-4946-87b2-0d2f14b808d4"; - fsType = "btrfs"; - options = [ - "subvol=root" - "compress=zstd" - "noatime" - ]; - }; - - boot.initrd.luks.devices."enc_root".device = - "/dev/disk/by-uuid/8eb8ac22-d89d-4406-bfbd-ce43e283649f"; - - fileSystems."/home" = { - device = "/dev/disk/by-uuid/0af4dcb9-6e59-4946-87b2-0d2f14b808d4"; - fsType = "btrfs"; - options = [ - "subvol=home" - "compress=zstd" - "noatime" - ]; - }; - - fileSystems."/nix" = { - device = "/dev/disk/by-uuid/0af4dcb9-6e59-4946-87b2-0d2f14b808d4"; - fsType = "btrfs"; - options = [ - "subvol=nix" - "compress=zstd" - "noatime" - ]; - }; - - fileSystems."/var/log" = { - device = "/dev/disk/by-uuid/0af4dcb9-6e59-4946-87b2-0d2f14b808d4"; - fsType = "btrfs"; - options = [ - "subvol=log" - "compress=zstd" - "noatime" - ]; - neededForBoot = true; - }; - - fileSystems."/persist" = { - device = "/dev/disk/by-uuid/0af4dcb9-6e59-4946-87b2-0d2f14b808d4"; - fsType = "btrfs"; - options = [ - "subvol=persist" - "compress=zstd" - "noatime" - ]; - }; - - fileSystems."/boot" = { - device = "/dev/disk/by-uuid/6C85-D29B"; - fsType = "vfat"; - }; - - swapDevices = [ ]; - - # Enables DHCP on each ethernet and wireless interface. In case of scripted networking - # (the default) this is the recommended approach. When using systemd-networkd it's - # still possible to use this option, but it's recommended to use it in conjunction - # with explicit per-interface declarations with `networking.interfaces..useDHCP`. - networking.useDHCP = lib.mkDefault true; - # networking.interfaces.eno1.useDHCP = lib.mkDefault true; - # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - powerManagement.cpuFreqGovernor = lib.mkDefault "powersave"; - hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; -} diff --git a/mediabox/configuration.nix b/mediabox/configuration.nix deleted file mode 100644 index 1bbedaf..0000000 --- a/mediabox/configuration.nix +++ /dev/null @@ -1,474 +0,0 @@ -{ config -, nvim -, pkgs -, system -, zremap -, ... -}: -let - USER = "akill"; -in -{ - imports = [ ]; - - system.stateVersion = "23.05"; - system.autoUpgrade.enable = false; - system.switch = { - enable = true; - enableNg = true; - }; - - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - sops.secrets."peerix/private" = { - sopsFile = ./secrets/peerix.yaml; - mode = "0400"; - owner = config.users.users.nobody.name; - group = config.users.users.nobody.group; - }; - - sops.secrets."wg_privkey" = { - sopsFile = ./secrets/wg_privkey.yaml; - }; - - sops.secrets."wg_preshared/mediabox" = { - sopsFile = ../common/secrets/wg_preshared.yaml; - }; - - nix = { - optimise.automatic = true; - gc.automatic = true; - gc.options = "--delete-older-than 7d"; - package = pkgs.nixVersions.latest; - settings = { - experimental-features = [ - "nix-command" - "flakes" - ]; - trusted-users = [ "akill" "root" ]; - }; - }; - - boot = { - initrd = { - compressor = "zstd"; - availableKernelModules = [ "e1000e" ]; - network = { - enable = true; - udhcpc.enable = true; - ssh = { - enable = true; - hostKeys = [ /etc/ssh_dummy_ed25519_key ]; - authorizedKeys = [ (builtins.readFile ../nixy/ssh_pubkey) ]; - }; - }; - }; - - kernelModules = [ "acpi_call" ]; - kernelPackages = pkgs.linuxPackages_latest; - kernelParams = [ "msr.allow_writes=on" ]; - kernel.sysctl = { - "net.core.default_qdisc" = "fq"; - "net.ipv4.tcp_congestion_control" = "bbr"; - }; - loader.systemd-boot = { - editor = false; - enable = true; - memtest86.enable = true; - }; - readOnlyNixStore = true; - supportedFilesystems = [ "btrfs" ]; - tmp.useTmpfs = true; - }; - - security = { - rtkit.enable = true; - allowSimultaneousMultithreading = true; - sudo.enable = true; - doas.enable = true; - doas.extraRules = [ - { - users = [ USER ]; - keepEnv = true; - persist = true; - } - ]; - }; - - powerManagement = { - enable = true; - }; - - networking = { - nftables.enable = true; - firewall = { - enable = true; - allowedTCPPorts = [ - 80 - 443 - 51820 - 8020 - ]; - }; - - hostName = "mediabox"; - interfaces.enp0s25.useDHCP = true; - interfaces.wlp3s0.useDHCP = false; - useDHCP = false; - wireless.enable = false; - wireless.interfaces = [ "wlp3s0" ]; - nameservers = [ - "127.0.0.1" - "::1" - ]; - dhcpcd.extraConfig = "nohook resolv.conf"; - - extraHosts = '' - 192.168.1.173 nixy.lan - 192.168.88.171 jellyfin.mediabox.lan - 192.168.88.171 jellyseerr.mediabox.lan - 192.168.88.171 mediabox.lan - 192.168.88.171 qbittorrent.mediabox.lan - 192.168.88.1 router.lan - 192.168.88.231 workstation.lan - 192.168.88.121 ender.lan - ''; - - wireguard.interfaces = { - wg0 = { - ips = [ "10.100.0.5/24" ]; - privateKeyFile = config.sops.secrets."wg_privkey".path; - peers = [ - { - publicKey = builtins.readFile ../magpie/wg_pubkey; - presharedKeyFile = config.sops.secrets."wg_preshared/mediabox".path; - allowedIPs = [ "10.100.0.0/24" ]; - endpoint = "5.75.229.224:51820"; - persistentKeepalive = 25; - } - ]; - }; - }; - }; - - time.timeZone = "Europe/Sarajevo"; - - nixpkgs.config.allowUnfree = true; - nixpkgs.overlays = [ nvim.overlays.${system}.overlay ]; - environment = { - homeBinInPath = true; - variables = { - PATH = "$HOME/.cargo/bin"; - }; - }; - - programs = { - steam = { - enable = true; - remotePlay.openFirewall = true; - dedicatedServer.openFirewall = false; - localNetworkGameTransfers.openFirewall = true; - }; - gnupg.agent = { - enable = true; - enableSSHSupport = true; - }; - appimage = { - enable = true; - binfmt = true; - }; - nix-ld = { - enable = false; - libraries = with pkgs; [ - stdenv.cc.cc.lib - zlib - ]; - }; - zsh.enable = true; - firejail.enable = true; - }; - - # List services that you want to enable: - systemd = { - services = { - "zremap@" = { - enable = true; - restartIfChanged = true; - serviceConfig.Nice = -20; - unitConfig = { - Description = "zremap on %I"; - ConditionPathExists = "%I"; - }; - serviceConfig = { - Type = "simple"; - ExecStart = "${zremap.defaultPackage.${system}}/bin/zremap %I"; - }; - }; - - "wakeonlan" = { - description = "Reenable wake on lan every boot"; - after = [ "network.target" ]; - serviceConfig = { - Type = "oneshot"; - ExecStart = "${pkgs.ethtool}/sbin/ethtool -s enp0s25 wol m"; - }; - wantedBy = [ - "default.target" - "suspend.target" - "shutdown.target" - ]; - }; - }; - - coredump.enable = false; - extraConfig = '' - DefaultTimeoutStartSec=30s - DefaultTimeoutStopSec=30s - ''; - }; - - services = { - acpid.enable = true; - btrfs.autoScrub.enable = true; - dbus.enable = true; - dbus.implementation = "broker"; - envfs.enable = true; - fstrim.enable = true; - fwupd.enable = true; - ntp.enable = true; - openssh.enable = true; - openssh.settings.PermitRootLogin = "yes"; - thinkfan.enable = false; - - xrdp = { - enable = true; - defaultWindowManager = "icewm"; - openFirewall = true; - }; - - logind = { - lidSwitch = "ignore"; - }; - - jellyfin = { - enable = false; - user = "akill"; - openFirewall = true; - }; - - jellyseerr = { - enable = false; - openFirewall = true; - }; - - pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - }; - - avahi = { - enable = false; - nssmdns4 = false; - openFirewall = true; - }; - - libinput.enable = true; - xserver = { - enable = true; - dpi = 144; - desktopManager.xterm.enable = false; - desktopManager.plasma5.bigscreen.enable = true; - #desktopManager.plasma6.enable = true; - displayManager = { - lightdm.enable = false; - startx.enable = true; - sddm.enable = true; - sddm.wayland.enable = true; - }; - windowManager.i3.enable = false; - }; - - udev = { - packages = [ ]; - extraRules = '' - #zremap on new keyboard - ACTION=="add", SUBSYSTEM=="input", ATTRS{phys}!="", KERNEL=="event[0-9]*", ENV{ID_INPUT_KEY}=="1", ENV{ID_INPUT_KEYBOARD}=="1", TAG+="systemd", ENV{SYSTEMD_WANTS}+="zremap@$env{DEVNAME}.service" - ''; - }; - - tlp = { - enable = false; - }; - - batteryNotifier = { - enable = false; - notifyCapacity = 20; - suspendCapacity = 10; - }; - - actkbd = { - enable = true; - bindings = [ - { - keys = [ 115 ]; - events = [ "key" ]; - command = "XDG_RUNTIME_DIR=/run/user/$(id -u ${USER}) ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"; - } - - { - keys = [ 114 ]; - events = [ - "key" - "rep" - ]; - command = "XDG_RUNTIME_DIR=/run/user/$(id -u ${USER}) ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"; - } - - { - keys = [ 113 ]; - events = [ - "key" - "rep" - ]; - command = "XDG_RUNTIME_DIR=/run/user/$(id -u ${USER}) ${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"; - } - - { - keys = [ 224 ]; - events = [ "key" ]; - command = "${pkgs.light}/bin/light -U 5"; - } - - { - keys = [ 225 ]; - events = [ "key" ]; - command = "${pkgs.light}/bin/light -A 5"; - } - ]; - }; - - dnscrypt-proxy2 = { - enable = true; - settings = { - ipv6_servers = true; - require_dnssec = true; - require_nolog = true; - require_nofilter = true; - http3 = true; - - sources.public-resolvers = { - urls = [ - "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md" - "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md" - ]; - cache_file = "/var/lib/dnscrypt-proxy/public-resolvers.md"; - minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3"; - }; - }; - }; - - journald.extraConfig = '' - SystemMaxUse=50M - ''; - - logind.extraConfig = '' - KillUserProcesses=yes - ''; - - }; - - fonts = { - fontconfig = { - cache32Bit = true; - allowBitmaps = true; - useEmbeddedBitmaps = true; - defaultFonts = { - monospace = [ "JetBrainsMono" ]; - }; - }; - - packages = with pkgs; [ - dejavu_fonts - dina-font - fira-code - fira-code-symbols - font-awesome_6 - inconsolata - iosevka - jetbrains-mono - liberation_ttf - libertine - noto-fonts - noto-fonts-cjk-sans - noto-fonts-color-emoji - noto-fonts-emoji - proggyfonts - siji - terminus_font - terminus_font_ttf - ubuntu_font_family - vistafonts - ]; - }; - - virtualisation = { - podman = { - enable = false; - autoPrune.enable = true; - dockerCompat = true; - }; - }; - - hardware = { - bluetooth = { - enable = true; - settings = { - General = { - Enable = "Source,Sink,Media,Socket"; - }; - }; - }; - - graphics = { - enable = true; - extraPackages = [ ]; - }; - }; - - zramSwap = { - enable = false; - algorithm = "zstd"; - }; - - users.users.${USER} = { - isNormalUser = true; - shell = pkgs.zsh; - extraGroups = [ - "wheel" - "tty" - "audio" - "sound" - ]; - openssh.authorizedKeys.keys = [ - (builtins.readFile ../nixy/ssh_pubkey) - ]; - }; - - users.users.ado = { - isNormalUser = true; - shell = pkgs.zsh; - extraGroups = [ - "wheel" - "tty" - "audio" - "sound" - ]; - }; - - users.users.mediauser = { - isNormalUser = true; - shell = pkgs.bash; - extraGroups = [ ]; - }; -} diff --git a/mediabox/hardware-configuration.nix b/mediabox/hardware-configuration.nix deleted file mode 100644 index a7c70cb..0000000 --- a/mediabox/hardware-configuration.nix +++ /dev/null @@ -1,90 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ - lib, - modulesPath, - ... -}: -{ - imports = [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.availableKernelModules = [ - "xhci_pci" - "ehci_pci" - "ahci" - "usb_storage" - "sd_mod" - "rtsx_pci_sdmmc" - ]; - boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ "kvm-intel" ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = { - device = "/dev/disk/by-uuid/ae774285-60dc-4b08-ab26-8208e8f4e81e"; - fsType = "btrfs"; - options = [ - "subvol=root" - "compress=lzo" - "noatime" - ]; - }; - - boot.initrd.luks.devices."enc".device = "/dev/disk/by-uuid/60aa7671-bfee-451b-b871-ac7c5a4a9f3a"; - - fileSystems."/home" = { - device = "/dev/disk/by-uuid/ae774285-60dc-4b08-ab26-8208e8f4e81e"; - fsType = "btrfs"; - options = [ - "subvol=home" - "compress=lzo" - "noatime" - ]; - }; - - fileSystems."/nix" = { - device = "/dev/disk/by-uuid/ae774285-60dc-4b08-ab26-8208e8f4e81e"; - fsType = "btrfs"; - options = [ - "subvol=nix" - "compress=lzo" - "noatime" - ]; - }; - - fileSystems."/persist" = { - device = "/dev/disk/by-uuid/ae774285-60dc-4b08-ab26-8208e8f4e81e"; - fsType = "btrfs"; - options = [ - "subvol=persist" - "compress=lzo" - "noatime" - ]; - }; - - fileSystems."/var/log" = { - device = "/dev/disk/by-uuid/ae774285-60dc-4b08-ab26-8208e8f4e81e"; - fsType = "btrfs"; - options = [ - "subvol=log" - "compress=lzo" - "noatime" - ]; - neededForBoot = true; - }; - - fileSystems."/boot" = { - device = "/dev/disk/by-uuid/4B94-6E7B"; - fsType = "vfat"; - }; - - swapDevices = [ - { device = "/dev/disk/by-uuid/7b44ab02-84ff-4ffd-be26-58247cf5a982"; } - ]; - - hardware.cpu.intel.updateMicrocode = true; - nix.settings.max-jobs = lib.mkDefault 8; -} diff --git a/mediabox/peerix-public b/mediabox/peerix-public deleted file mode 100644 index 6b60209..0000000 --- a/mediabox/peerix-public +++ /dev/null @@ -1 +0,0 @@ -peerix-mediabox:UDgG3xdQYv7bmx2l4ZPNRPJtp2zMmY++H/fnGeJ9BQw= \ No newline at end of file diff --git a/mediabox/secrets/peerix.yaml b/mediabox/secrets/peerix.yaml deleted file mode 100644 index d23e657..0000000 --- a/mediabox/secrets/peerix.yaml +++ /dev/null @@ -1,31 +0,0 @@ -peerix: - private: ENC[AES256_GCM,data:m76hyDWzcIlczegZyPyTtOYOgOGeyX++SeGsqEWS5b3ZbR2M9RqUGYEscLRX3/Dlff2vgs+hI4cOjiMnhq9pnLzP25Xh4XAiJNMkD43fFCCb7zj2RUWEyLAzzmWpR8fSB1mXTpciUGM=,iv:s9EXpkGYR0kI5xQZ8wAmkobK1q4XlVdFH4irEVwy1bs=,tag:L7AF6mFsxss6NDantbqXMw==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age19yrl6pr73cv067ksfz0txp3zm2au25jfyjeerw23ml55ps5cyyfqtm3kmt - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2Zmc0c1AxMVEzdi94L0Nh - dHJFSHVSbG1vay9NUDBEVkM4ZWNoT3h4Q1c0CkhWdWVzTEJxZENZYXVFT2RhV3pT - aDZIUUdWVUVRUDc4ZEFDTkdnaDJxdVkKLS0tIDd6TE56REdjRVdtSXB1dkJrVVNj - dUxhRnB4dVFRam9xNlFiY2VOSXpNamcKNzRghHeyPtltKH4GkJQ0ef4apr5gziq9 - dhXy6Qil48QJd4hnyr7GW1n7eRIq24OWO3WglLbVAUSQr/gzM2TWiA== - -----END AGE ENCRYPTED FILE----- - - recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSMjVQZkVVQmZFbCt3Z2ZI - Q3NVZUJ0VkZjK0E5SFpqWE50c2dOeFNsUm1jCmdDZGxZYk13emhhanRzWjhvZFM1 - UWNpNm5malkrU1Rkak9PNWk2bW5nRDQKLS0tIE9UdXg4L0hMRzJuUERIMytvc2pr - Y1BBZFJseUNIeTVtTjBGazk5WE1ZcUUKs9pEtDbCYRfSP0Rh9ENo9A6nUFkYHr4D - 3DvOKSyLL33FBoEddDBd7Si1mpjY2bunueBAe+diDgOrol6tWIMoUw== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2023-09-30T14:18:57Z" - mac: ENC[AES256_GCM,data:R0TJ/7uihpsCHwPLXFYKi+ZaEUtbZVz02utDF7vO7gYDN1MFa0c5nZ/mAnJJtTJI41GdAu9ezTUiU6H1HTHLxYMeUoNAAvNlSCkvGc/oMQofXidL34hq1X2vG05N3UQlkbAXTlCBkYc20oVVOVmT/lq7USEx29oB/ytxZzKYFvM=,iv:qpz0g+O4kwChct1ddiT3D8rZBg08YUr4Ba5pJ4WQyzo=,tag:pWLFiQWl1QSzveBxnq4uXw==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.0 diff --git a/mediabox/secrets/wg_privkey.yaml b/mediabox/secrets/wg_privkey.yaml deleted file mode 100644 index 38364ee..0000000 --- a/mediabox/secrets/wg_privkey.yaml +++ /dev/null @@ -1,30 +0,0 @@ -wg_privkey: ENC[AES256_GCM,data:ovAxwZEcmRzt/zb42ortPwPyREC16E5YNfDBguZK7uByR4BgJi8kNeoG+GY=,iv:Cv50+JB5S+44U3L9od4zwrEKHi/LM38LnA94DkvCer4=,tag:ehKQrqWwA6daxc2yASDWNQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age19yrl6pr73cv067ksfz0txp3zm2au25jfyjeerw23ml55ps5cyyfqtm3kmt - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKSGxudng1enhDa281S0pm - Q0kwQmc1T2hUK0dHd3B4cUh3RzZPZ1dGaXo4CkdPMzNnQWMyYjJiUWk4WEYyODFp - b2FTbnZwMHh6SHhIcjVNbnBKSVk3TWMKLS0tIFBZOW56K2Y5Q3I4dmh5dXBieEF2 - SWQwcmkzQU5aeEliS29QN3Y0V04zNU0KF0WmF8BDvZ2DyJFztKJv8YmDuqVsAoO4 - QEVLwrJDurRxcNIVGLs5W+60Osa5XMpNc74e23rU7mucB5wPA/84dg== - -----END AGE ENCRYPTED FILE----- - - recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWMUtUYyswV3czWDdXWG1x - cnh5QTZpdlBZYlZ2b2oweXJ5SkZSQldhQmpZCmFrQVlyYnNqZ01kVTVNQTlBRFNR - WDlITEJOUFZGa0U2NG8xMGpkSnNOQTAKLS0tIDNlK0dxWnB3a3dkTnRmTm5oTlFD - eGV1VE1tL1c0a3hUdXM2bExmV1l3RnMK8aOugY3XHTCfeBDJVOyGljuuu6hQGJ7W - ZGoxOz+hhYIHj/04J9DIIOUyt81m8LNCbxcacFKyW7Sqosfj+7N7Gg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-04-14T19:25:26Z" - mac: ENC[AES256_GCM,data:vcyglyYG93K3KBISpIESGlNCs5ojWZAL0gyDUzBNCxG5H8RKEz1Y7yOtr5EXnnP66qcBHlKhb81Iyrc071pmJL9dIttiqmvjSWf0zZ9RuV0uYcO/42cqk3J4tBJ6iYCi64y58jifDObbRni6jiGVEGEkSk8cXFqR8UXoSTeXWtU=,iv:avpWr8SeHK1VHz9XhkO7Nd7VOfMP7JXcQaXJA8Xiuhs=,tag:ixJsw/snZEWXGhdPLU1cGg==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/mediabox/wg_pubkey b/mediabox/wg_pubkey deleted file mode 100644 index 3e922a9..0000000 --- a/mediabox/wg_pubkey +++ /dev/null @@ -1 +0,0 @@ -S+tL/pTm4D7bsWj/dhpPXHYxcye/DuNMguLD5l1ACEU= diff --git a/nixy/configuration.nix b/nixy/configuration.nix deleted file mode 100644 index 87ff81f..0000000 --- a/nixy/configuration.nix +++ /dev/null @@ -1,659 +0,0 @@ -{ config -, nvim -, pkgs -, system -, zremap -, ... -}: -let - USER = "akill"; -in -{ - imports = [ ]; - - system = { - stateVersion = "23.05"; - autoUpgrade.enable = false; - etc.overlay.enable = true; - nixos-init.enable = true; - }; - - sops = { - age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - secrets = { - "peerix/private" = { - sopsFile = ./secrets/peerix.yaml; - mode = "0400"; - owner = config.users.users.nobody.name; - group = config.users.users.nobody.group; - }; - - "wg_privkey" = { - sopsFile = ./secrets/wg_privkey.yaml; - }; - - "wg_preshared/nixy" = { - sopsFile = ../common/secrets/wg_preshared.yaml; - }; - - "wg_privkey_proton" = { - sopsFile = ./secrets/wg_privkey_proton.yaml; - }; - - "wg_endpoint_proton" = { - sopsFile = ./secrets/wg_privkey_proton.yaml; - }; - - "borgbase_enc_key" = { - sopsFile = ./secrets/borgbase_enc_key.yaml; - owner = config.users.users.${USER}.name; - }; - - "borgbase_ssh_key" = { - sopsFile = ./secrets/borgbase_ssh_key.yaml; - owner = config.users.users.${USER}.name; - }; - }; - }; - - nix = { - optimise.automatic = true; - gc.automatic = true; - gc.options = "--delete-older-than 7d"; - package = pkgs.nixVersions.latest; - settings = { - sandbox = true; - experimental-features = [ - "nix-command" - "flakes" - ]; - }; - }; - - boot = { - extraModulePackages = with config.boot.kernelPackages; [ - usbip - v4l2loopback - ]; - initrd.compressor = "zstd"; - initrd.kernelModules = [ ]; - initrd.systemd.enable = true; - binfmt.emulatedSystems = [ - "wasm32-wasi" - "x86_64-windows" - ]; - kernelParams = [ - "psmouse.synaptics_intertouch=0" - "mem_sleep_default=deep" - "amdgpu.sg_display=0" - "amdgpu.gttsize=2048" - ]; - kernelPackages = pkgs.linuxPackages_latest; - kernel.sysctl = { - "net.core.default_qdisc" = "fq"; - "net.ipv4.tcp_congestion_control" = "bbr"; - "kernel.unprivileged_userns_clone" = "1"; /* Needed with harderned kernel */ - }; - loader.efi.canTouchEfiVariables = true; - loader.systemd-boot = { - editor = false; - enable = true; - memtest86.enable = true; - }; - nixStoreMountOpts = [ "ro" ]; - supportedFilesystems = [ - "xfs" - ]; - tmp.useTmpfs = true; - }; - - security = { - rtkit.enable = true; - allowSimultaneousMultithreading = true; - sudo.enable = true; - doas.enable = true; - doas.extraRules = [ - { - users = [ USER ]; - keepEnv = true; - persist = true; - } - ]; - }; - - powerManagement = { - enable = true; - }; - - networking = { - nftables.enable = true; - firewall = { - enable = true; - allowedTCPPorts = [ - 80 - 443 - 51820 - 8020 - ]; - }; - - hostName = "nixy"; - nameservers = [ - "127.0.0.1" - "::1" - ]; - dhcpcd.extraConfig = "nohook resolv.conf"; - - extraHosts = '' - 192.168.88.171 jellyfin.mediabox.lan - 192.168.88.171 jellyseerr.mediabox.lan - 192.168.88.171 mediabox.lan - 192.168.88.171 qbittorrent.mediabox.lan - 192.168.88.1 router.lan - 192.168.88.231 workstation.lan - 192.168.88.121 ender.lan - ''; - - networkmanager = { - enable = true; - dns = "none"; - wifi.backend = "iwd"; - }; - - wireless.iwd = { - enable = true; - settings = { - General = { - AddressRandomization = "network"; - #EnableNetworkConfiguration = true; - }; - }; - }; - - wireguard.interfaces = { - wg0 = { - ips = [ "10.100.0.6/24" ]; - privateKeyFile = config.sops.secrets."wg_privkey".path; - peers = [ - { - publicKey = builtins.readFile ../magpie/wg_pubkey; - presharedKeyFile = config.sops.secrets."wg_preshared/nixy".path; - allowedIPs = [ "10.100.0.0/24" ]; - endpoint = "5.75.229.224:51820"; - persistentKeepalive = 25; - } - ]; - }; - - neox_wg = { - ips = [ "192.168.51.2/32" ]; - privateKeyFile = config.sops.secrets."wg_privkey".path; - peers = [ - { - publicKey = builtins.readFile ../nixy/wg_pubkey_nx; - allowedIPs = [ "192.168.2.0/24" ]; - endpoint = "185.194.64.26:51820"; - persistentKeepalive = 25; - } - ]; - }; - }; - }; - - time.timeZone = "Europe/Sarajevo"; - - nixpkgs.config.allowUnfree = true; - nixpkgs.overlays = [ - nvim.overlays.${system}.overlay - ]; - environment = { - etc = { - "firejail/qutebrowser.local".text = '' - whitelist ''${RUNUSER}/qutebrowser - ''; - }; - extraInit = '' - unset -v SSH_ASKPASS - ''; - homeBinInPath = true; - variables = { - PATH = "$HOME/.cargo/bin"; - }; - }; - - programs = { - steam = { - enable = true; - remotePlay.openFirewall = true; - dedicatedServer.openFirewall = false; - localNetworkGameTransfers.openFirewall = true; - }; - gnupg.agent = { - enable = true; - enableSSHSupport = true; - }; - appimage = { - enable = true; - binfmt = true; - }; - nix-ld = { - enable = false; - libraries = with pkgs; [ - stdenv.cc.cc.lib - zlib - ]; - }; - zsh.enable = true; - firejail.enable = true; - adb.enable = true; - wireshark.enable = true; - sway.enable = true; - }; - - documentation.dev.enable = true; - - # List services that you want to enable: - systemd = { - #sysusers.enable = true; - services = { - # Fix issue where systemd-vconsole-setup failes to find keymap - systemd-vconsole-setup = { - unitConfig = { - After = "local-fs.target"; - }; - }; - - "zremap@" = { - enable = true; - restartIfChanged = true; - serviceConfig.Nice = -20; - unitConfig = { - Description = "zremap on %I"; - ConditionPathExists = "%I"; - }; - serviceConfig = { - Type = "simple"; - ExecStart = "${zremap.defaultPackage.${system}}/bin/zremap %I"; - }; - }; - - "netns@" = { - description = "%I network namespace"; - before = [ "network.target" ]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - ExecStart = "${pkgs.iproute2}/bin/ip netns add %I"; - ExecStop = "${pkgs.iproute2}/bin/ip netns del %I"; - }; - }; - - "wg_proton" = { - description = "wg network interface"; - bindsTo = [ "netns@wg.service" ]; - requires = [ "network-online.target" ]; - wants = [ "dnscrypt-proxy_proton.service" ]; - after = [ "netns@wg.service" ]; - before = [ "dnscrypt-proxy_proton.service" ]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - ExecStart = pkgs.writers.writeBash "wg-up" '' - set -e - ENDPOINT_IP=$(${pkgs.coreutils-full}/bin/cat "${config.sops.secrets."wg_endpoint_proton".path}") - ${pkgs.iproute2}/bin/ip link add proton_wg type wireguard - ${pkgs.iproute2}/bin/ip link set proton_wg netns wg - ${pkgs.iproute2}/bin/ip -n wg address add 10.2.0.2/32 dev proton_wg - ${pkgs.iproute2}/bin/ip netns exec wg \ - ${pkgs.wireguard-tools}/bin/wg set "proton_wg" private-key "${ - config.sops.secrets."wg_privkey_proton".path - }" - ${pkgs.iproute2}/bin/ip netns exec wg \ - ${pkgs.wireguard-tools}/bin/wg set "proton_wg" peer "g6DkXWKI/68RsLjROIwCEcyB/ZhyK5Q7OWcz1TtqER0=" \ - endpoint "$ENDPOINT_IP:51820" \ - persistent-keepalive "25" \ - allowed-ips "0.0.0.0/0" - ${pkgs.iproute2}/bin/ip -n wg link set lo up - ${pkgs.iproute2}/bin/ip -n wg link set proton_wg up - ${pkgs.iproute2}/bin/ip -n wg route add default dev proton_wg - ''; - ExecStop = pkgs.writers.writeBash "wg-down" '' - ${pkgs.iproute2}/bin/ip -n wg route del default dev proton_wg - ${pkgs.iproute2}/bin/ip -n wg link del proton_wg - ''; - }; - }; - - "dnscrypt-proxy_proton" = { - description = "DNSCrypt-proxy client proton"; - wants = [ - "network-online.target" - "nss-lookup.target" - ]; - before = [ "nss-lookup.target" ]; - after = [ "wg_proton.service" ]; - partOf = [ "wg_proton.service" ]; - serviceConfig = { - AmbientCapabilities = "CAP_NET_BIND_SERVICE"; - CacheDirectory = "dnscrypt-proxy"; - DynamicUser = true; - ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy -config ${config.services.dnscrypt-proxy.configFile}"; - LockPersonality = true; - LogsDirectory = "dnscrypt-proxy"; - MemoryDenyWriteExecute = true; - NetworkNamespacePath = "/var/run/netns/wg"; - NonBlocking = true; - NoNewPrivileges = true; - PrivateDevices = true; - ProtectClock = true; - ProtectControlGroups = true; - ProtectHome = true; - ProtectHostname = true; - ProtectKernelLogs = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - ProtectSystem = "strict"; - Restart = "always"; - RestrictAddressFamilies = [ - "AF_INET" - "AF_INET6" - ]; - RestrictNamespaces = true; - RestrictRealtime = true; - RuntimeDirectory = "dnscrypt-proxy"; - StateDirectory = "dnscrypt-proxy"; - SystemCallArchitectures = "native"; - SystemCallFilter = [ - "@system-service" - "@chown" - "~@aio" - "~@keyring" - "~@memlock" - "~@setuid" - "~@timer" - ]; - }; - }; - }; - - coredump.enable = false; - settings.Manager = { - DefaultTimeoutStartSec = "30s"; - DefaultTimeoutStopSec = "30s"; - }; - }; - - services = { - acpid.enable = true; - dbus.enable = true; - dbus.implementation = "broker"; - envfs.enable = true; - fstrim.enable = true; - fwupd.enable = true; - ntp.enable = true; - openssh.enable = true; - printing.enable = true; - userborn.enable = true; - - pipewire = { - enable = true; - alsa.enable = true; - alsa.support32Bit = true; - pulse.enable = true; - }; - - avahi = { - enable = true; - nssmdns4 = true; - openFirewall = true; - }; - - libinput.enable = true; - xserver = { - enable = true; - dpi = 144; - desktopManager.xterm.enable = false; - displayManager = { - lightdm.enable = false; - startx.enable = true; - }; - windowManager.i3.enable = false; - }; - - udev = { - packages = [ - pkgs.openhantek6022 - pkgs.openocd - ]; - extraRules = '' - #Xilinx FTDI - ACTION=="add", ATTR{idVendor}=="0403", ATTR{manufacturer}=="Xilinx", MODE:="666" - - #Xilinx Digilent - ATTR{idVendor}=="1443", MODE:="666" - ACTION=="add", ATTR{idVendor}=="0403", ATTR{manufacturer}=="Digilent", MODE:="666" - - #Arduino UNO r4 - SUBSYSTEMS=="usb", ATTRS{idVendor}=="2341", MODE:="0666" - - #zremap on new keyboard - ACTION=="add", SUBSYSTEM=="input", ATTRS{phys}!="", KERNEL=="event[0-9]*", ENV{ID_INPUT_KEY}=="1", ENV{ID_INPUT_KEYBOARD}=="1", TAG+="systemd", ENV{SYSTEMD_WANTS}+="zremap@$env{DEVNAME}.service" - ''; - }; - - tlp = { - enable = true; - settings = { - START_CHARGE_THRESH_BAT0 = 70; - STOP_CHARGE_THRESH_BAT0 = 86; - }; - }; - - batteryNotifier = { - enable = true; - notifyCapacity = 12; - suspendCapacity = 5; - }; - - actkbd = { - enable = true; - bindings = [ - { - keys = [ 115 ]; - events = [ "key" ]; - command = "XDG_RUNTIME_DIR=/run/user/$(id -u ${USER}) ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%+"; - } - - { - keys = [ 114 ]; - events = [ - "key" - "rep" - ]; - command = "XDG_RUNTIME_DIR=/run/user/$(id -u ${USER}) ${pkgs.wireplumber}/bin/wpctl set-volume @DEFAULT_AUDIO_SINK@ 5%-"; - } - - { - keys = [ 113 ]; - events = [ - "key" - "rep" - ]; - command = "XDG_RUNTIME_DIR=/run/user/$(id -u ${USER}) ${pkgs.wireplumber}/bin/wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle"; - } - - { - keys = [ 224 ]; - events = [ "key" ]; - command = "${pkgs.light}/bin/light -U 5"; - } - - { - keys = [ 225 ]; - events = [ "key" ]; - command = "${pkgs.light}/bin/light -A 5"; - } - ]; - }; - - dnscrypt-proxy = { - enable = true; - settings = { - ipv6_servers = true; - require_dnssec = true; - require_nolog = true; - require_nofilter = true; - http3 = true; - - sources.public-resolvers = { - urls = [ - "https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md" - "https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md" - ]; - cache_file = "/var/lib/dnscrypt-proxy/public-resolvers.md"; - minisign_key = "RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3"; - }; - }; - }; - - borgbackup.jobs."borgbase" = - let - user = config.users.users.${USER}; - home = user.home; - in - { - user = user.name; - paths = [ - (home + "/pic/priv") - (home + "/pproj") - (home + "/videos/priv") - ]; - exclude = [ - "**/.ccls_cache" - "**/*.d" - "**/*.map" - "**/*.o" - "**/zig-cache" - "**/zig-out" - ]; - repo = "ssh://oda929rv@oda929rv.repo.borgbase.com/./repo"; - encryption = { - mode = "repokey-blake2"; - passCommand = "${pkgs.coreutils-full}/bin/cat ${config.sops.secrets."borgbase_enc_key".path}"; - }; - environment.BORG_RSH = "${pkgs.openssh}/bin/ssh -i ${config.sops.secrets."borgbase_ssh_key".path}"; - compression = "auto,zstd"; - startAt = "daily"; - }; - - nix-serve = { - enable = false; - secretKeyFile = "/var/cache-priv-key.pem"; - }; - - journald.extraConfig = '' - SystemMaxUse=50M - ''; - - logind.settings.Login = { - KillUserProcesses = true; - }; - - }; - - fonts = { - fontconfig = { - cache32Bit = true; - allowBitmaps = true; - useEmbeddedBitmaps = true; - defaultFonts = { - monospace = [ "JetBrainsMono" ]; - }; - }; - - packages = with pkgs; [ - dejavu_fonts - dina-font - fira-code - fira-code-symbols - font-awesome_6 - inconsolata - iosevka - jetbrains-mono - liberation_ttf - libertine - noto-fonts - noto-fonts-cjk-sans - noto-fonts-color-emoji - proggyfonts - siji - terminus_font - terminus_font_ttf - ubuntu-classic - vista-fonts - ]; - }; - - virtualisation = { - waydroid.enable = false; - libvirtd = { - enable = true; - allowedBridges = [ - "virbr0" - "br0" - ]; - }; - spiceUSBRedirection.enable = true; - containers.storage.settings = { - storage = { - graphroot = "/var/lib/containers/storage"; - runroot = "/run/containers/storage"; - }; - }; - podman = { - enable = true; - autoPrune.enable = true; - dockerCompat = true; - }; - }; - - hardware = { - bluetooth = { - enable = true; - settings = { - General = { - Experimental = true; - Enable = "Source,Sink,Media,Socket"; - }; - }; - }; - - graphics = { - enable = true; - extraPackages = [ ]; - }; - rtl-sdr.enable = true; - }; - - zramSwap = { - enable = true; - algorithm = "zstd"; - }; - - users.users.${USER} = { - isNormalUser = true; - initialHashedPassword = "$y$j9T$XGffGsmN/u.wO5wZ.cBml/$9iCw3eWY0GSUH/aA8ESCAxKeTCAMqY21XQF7b5ujxD6"; - shell = pkgs.zsh; - extraGroups = [ - "adbusers" - "audio" - "dialout" - "kvm" - "plugdev" - "sound" - "tty" - "wheel" - "wireshark" - ]; - }; -} diff --git a/nixy/hardware-configuration.nix b/nixy/hardware-configuration.nix deleted file mode 100644 index 3e95ad3..0000000 --- a/nixy/hardware-configuration.nix +++ /dev/null @@ -1,65 +0,0 @@ -# Do not modify this file! It was generated by ‘nixos-generate-config’ -# and may be overwritten by future invocations. Please make changes -# to /etc/nixos/configuration.nix instead. -{ - config, - lib, - pkgs, - modulesPath, - ... -}: - -{ - imports = [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - boot.initrd.luks.devices."crypt_dev".device = - "/dev/disk/by-uuid/e10821b9-5426-4f03-b716-1645a64fcd6a"; - boot.initrd.luks.devices."crypt_dev".allowDiscards = true; - boot.initrd.availableKernelModules = [ - "nvme" - "ehci_pci" - "xhci_pci" - "uas" - "usb_storage" - "sd_mod" - "rtsx_pci_sdmmc" - ]; - boot.initrd.kernelModules = [ "dm-snapshot" ]; - boot.kernelModules = [ - "kvm-amd" - "amd-gpu" - ]; - boot.extraModulePackages = [ ]; - - fileSystems."/" = { - device = "/dev/disk/by-uuid/c461c971-54ca-4fb7-91e8-6ac70de53ef2"; - fsType = "xfs"; - }; - - fileSystems."/nix" = { - device = "/dev/disk/by-uuid/eeaa6fab-d67d-400f-b6d4-b1f44c2e0047"; - fsType = "xfs"; - }; - - fileSystems."/home" = { - device = "/dev/disk/by-uuid/aeaa71ca-a439-4ef3-9ab8-db7ae8f59376"; - fsType = "xfs"; - }; - - fileSystems."/boot" = { - device = "/dev/disk/by-uuid/828E-F3C3"; - fsType = "vfat"; - options = [ - "fmask=0022" - "dmask=0022" - ]; - }; - - swapDevices = [ ]; - - nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; - hardware.cpu.amd.updateMicrocode = true; - hardware.enableRedistributableFirmware = true; -} diff --git a/nixy/peerix-public b/nixy/peerix-public deleted file mode 100644 index 046e1d1..0000000 --- a/nixy/peerix-public +++ /dev/null @@ -1 +0,0 @@ -peerix-nixy:8THqS0R2zWF/47ai0RFmqJnieYTZ1jaWOD9tnzpvA6s= \ No newline at end of file diff --git a/nixy/secrets/borgbase_enc_key.yaml b/nixy/secrets/borgbase_enc_key.yaml deleted file mode 100644 index 117afbb..0000000 --- a/nixy/secrets/borgbase_enc_key.yaml +++ /dev/null @@ -1,21 +0,0 @@ -borgbase_enc_key: ENC[AES256_GCM,data:AD+JghEOX25tBGYhoU1ge1fqrA+5AK8N4yg=,iv:u05GVeWbL3xdZQgGkXSPkxlATd2M9MX4uSZiLOHMMRE=,tag:pmTQIJWmz+ePmSNzO/EO4Q==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEaDhSZVVibVl1NU84NG9U - aEVQbThIcC9CajNHS25SVW1SMFFwMUsvMmxJCkpTVThpZ0JZdEpLTnJlQWFqM244 - LzFaUFVvWWxIcU4wRlhXalF5TkNpVHMKLS0tIExXMUx5cDBBbDloQ0sxbEY0eGdj - bE5vNHVHekI2RzY5M3JNcTdCa3pNeUUK8C04wF1te6epA97sNrhoz0VUn+MC7SML - 6N1CZK3MuRARBqcj4c/W1aXuTysvuV1o/Fl5xOk/gbumcfwnDYj28A== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-04-21T08:14:25Z" - mac: ENC[AES256_GCM,data:7M+akGH09E2JYyKLmwpjx0VCEBmXqO6bNHFNRCO+9LdSIqsEw8MD4WGO0zwHOD9ls7+1OPFeoU+MVbtfMhmvN4g6rg+tFkXbxPSXCPkTA4tL90ZLXoBIpUBxKKhFMxtdOnjXxES3rTzjXGAvxocFOiNv/7pKbzeqMJUnH9FgAcM=,iv:h0+OpLmutMyPN3YFhyuHFgWSqxVK5WmBAE0k5ezEo9A=,tag:UKOXnTOjWaLDEOYk5YK4Aw==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/nixy/secrets/borgbase_ssh_key.yaml b/nixy/secrets/borgbase_ssh_key.yaml deleted file mode 100644 index 064dd32..0000000 --- a/nixy/secrets/borgbase_ssh_key.yaml +++ /dev/null @@ -1,21 +0,0 @@ -borgbase_ssh_key: ENC[AES256_GCM,data:lLHIBmw/03An3SRJUjYS2pn0g7XEW0kTXtSObhIGwjBwlRypU7uQDz4JseOA2GbSm+GqsGK8U3Ifgirb7t8AsGy6DPxO+2sm+ByJ1S46G6cwkO2GateJw4Zg0mmhUBBuB/eXQMLuBLKZM2WGta5+6O0SWxDtsrTsBhlo5qbwwYILu0gg2zsBWFSn1OBGgvjYYRTd7N85WX8+S7oNYVAL2HjCmhHHtYrLnua4ajBY9dQEzrKdZaQW4v39HV9MyoilEz17fFLU8S2KbJ1iw8HgoAc9W81hpQNNd8fWKY+e0iWxD9X5H7UTs8YP/bsKeWyG4OAwr99zIZ1Lqzi0EuZI+PYkIz4Q4WBmv1wD6Py274iug3kr1OqvaIOmIT/9j2C3mOZTqxuFaF5T4NMkcIeViCBmRwUMTl/8a36X+n/MYxRoznHCQmg8zKubDuykVJfBmFwxbUc9tx8PeodnWeiASOV7FvBie47yq+NyBGItJXAK14SxLE9T2sxRchJWcrQBcekZdZ5Mej20lfUlcAGkwfUc0e54xsv1K3oY,iv:5157BQmbfuF5EYbDHCy/TmnTYErIwmgXO8RaX6f18xs=,tag:T2eZN46Qd6RgLWk4kbYgPQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5b2YzSDdaU3R5TUdqS3Nv - eUYraFBiZlZ1TXBqYzlWNUNYOFlyMzJvWEE4ClJ6R25CRXRUZ2FDTFY2ZmJIRkRX - WVJCSy83N2JUNzRuT3VuSUF1OTV2TUkKLS0tIEZ5cVg1V2o0MkdmWEx1emJVdjZ0 - RkZFL2tRNW9RdnAwalE2ZzVQcnljRFUKRyN8ahv9ZI63m8ycl74GZ59lyAXUsKmi - tfPqQvL1oTtJr3hzwy2bkctXQLYjGvsMyZt2tiWpy5vLc1MrxlqVDQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-04-21T08:16:40Z" - mac: ENC[AES256_GCM,data:VkXpCPQB4RypDrK31pYWXeOcl8ulis6fMF1q/SLCg2wXnL0jFrmAFp78C+ers9xFhbnUnMbVc/ZJIVKfa0g94WV3jJbn4+HB0GPWQCz7LwhmG5XEY5O5sFLuDCcHb/epZvDbCsEQeiq+TGDHp6TtdL8qDF+hE2k8qfsy570wocU=,iv:HQleJtHWQ5uk4+Witn2aaqh0SvXqomfiSO/ExgPzVag=,tag:hlBmboddR8GDAmBpETi0Ow==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/nixy/secrets/peerix.yaml b/nixy/secrets/peerix.yaml deleted file mode 100644 index e2de063..0000000 --- a/nixy/secrets/peerix.yaml +++ /dev/null @@ -1,22 +0,0 @@ -peerix: - private: ENC[AES256_GCM,data:Oi8H5nqJ0Bf45wQepCjdZNHBOv4AlPxNN7L5Th3gcRQlW1FS77nusIWGSUvlmL2a5LTN0FV36o2GFPrrhiwmvnkQwuSZKc9VeDTf7SX0RRL1NLmRR/zy4WsRNJFxlqtjahieqg==,iv:6hJwqcdPayZaYZhJ0OfYLAtmeVndLEfeYZjUq5/3qJE=,tag:MiAfg8aZAHNYbB0JwcdStg==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSMEIyck1xbVJ4Zm56Z3dM - OGsxa1p0TGIvRE5DYXZzTDM3YUZFVTAxbUUwCllPd0FOUlRiZW5wT2QvLzZXYjRr - S1A5WjZxLzNYQ1ZWVFFQTzRwMFQweFEKLS0tIHNoZUpHS2dDNmFKc3ZVNFZuUFU4 - L0M0MitMeDg1ZWYxcDNCQlVGUjRKeFkKvD2SKnuh517o2knPr2SOWq3kubMyI7UV - j6HgXVbHUDjmKl2dY+YVTnmxrK54E+Q6iiu7mQnvLdzxYBK/EiNt9w== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-04-21T08:17:51Z" - mac: ENC[AES256_GCM,data:v4KQq3Y5ZxsyMxR+FS1BZkH/bPTIIHfQu800U44odaNycIbWnuwCnLWGyJK6Por76bWALycGppDbHPKKW/N1I1XLy/EAXo02+nhHNvKVi2cXSXciuEPc/Cl+6TbP39lx4+EOM8CZoNZ8HAiS3QPy2bwZdMjEw/OHl8TqlN07q9s=,iv:PIcv/b6t+54/yCTZj+12Yep15ors/wXNUnaXjLjpVbM=,tag:JxO5M3OYaWzqgf4gUhCzzg==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/nixy/secrets/wg_preshared.yaml b/nixy/secrets/wg_preshared.yaml deleted file mode 100644 index fc4c74b..0000000 --- a/nixy/secrets/wg_preshared.yaml +++ /dev/null @@ -1,21 +0,0 @@ -wg_preshared: ENC[AES256_GCM,data:k+aFYDNMojf5kktn6KJ4F5mH5oGdqxdF0MO88NcYpai9USnH394XRL9ASvs=,iv:L5LIXbADhrivKjK/V0E5QpRT7BDsktwIuKHgY+2qr84=,tag:pCW1naU/ygxAIDYWV2hHPQ==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZSHZvYy9TTmVEb2ZSTncy - ckJ1bXZGWVdJSkVHMGx2Vk5ZNlZ3Q2wzVFQ0Cmg1M3hKNFhnZk5nTE54RTdyR0Vs - NVRiTEltSnkxdmhhdGlycHNPWjFLbncKLS0tIE02NVJRZTd0VmowT1c4cjhKNlZk - Q01BQWNSVWtIMnFXRWpxR3JDMU8zYTAKIbfpM8uUb09cUlA8YWtgEOL5zvWf5omv - baZINiAu0/f1avYmW6Qb+aLa2ALrSZaotj46Uwd9Lb5mtjJ/8v9IOg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-04-20T18:12:20Z" - mac: ENC[AES256_GCM,data:4PWjwxOO0UuNsevCbzCLaiW7C+So4mEGivd9GzyLKx2JlkNFVB8wqPrY1Rl1ANMrT+7LKc8tVOA4zbweNc9idFG4y5DcvnDSieqKu9v1MeEMHqNpz5TTLbCP81g7qegjI/WKul2kaWIdPaioI/f5x2E6rEYnzFv+Di2mc3W+Qcc=,iv:iE9sali0O3sQIhOw30RGR/4ZQsAPcSxq1qxosfasojU=,tag:+9AOwph5A4oDXsK6Z3YeZA==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/nixy/secrets/wg_privkey.yaml b/nixy/secrets/wg_privkey.yaml deleted file mode 100644 index d341b5c..0000000 --- a/nixy/secrets/wg_privkey.yaml +++ /dev/null @@ -1,21 +0,0 @@ -wg_privkey: ENC[AES256_GCM,data:XL9FU1kZXvBJfwyt3HpQe8k8zg9HT6Xm0BdjNMduSu9uAgcHbglpLc/qTB0=,iv:QgX1VsmLUsDozFXmzDVPukjPNTa4Lnh806AQ4qdgpa8=,tag:RNVlDbtx8vAAbG0rinLVOw==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBSnkyM1ZrcnEvM3VHL0Nk - THhUUDdGU2s5UFgrVGZ3WXhkYTRIVTlaeGs4CjR4eVpmRy9qUkZSWkpFZDZHRDZI - ZWRXSmMzL2RWZkVrSlFPcC9ueGpDVFkKLS0tIDZWbENyS2hrSCtlNlBHaE56QTha - eFJmWXk1SVJEbDJOc1Q1VFlzVS8yODgKFXRAtR+67x0dkQTqZPtMT0Hd+aW+5K17 - S/lhuHRhITt3woQnecVPMYklgJJlsyQ6blKhJw8dvhbVWWThZ853rQ== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-04-21T08:18:59Z" - mac: ENC[AES256_GCM,data:xPKsGZD5RKT/WMRupe4YTgoiUQRFq77KQyGaazeY1GEPI117gWxRHEpiyCLnfhZWcaekPWoXosm32wRLwDAXM/Femk567i5uKKG2wAqApWbc+FXTQ71w/CFr9uEWFApBjpEHpuBBaFV23qJfylsqeMp9r52d9Sp5eDQC4RJead0=,iv:oiNoZ/bqQUe+luqeuldw1M0KB2d4C5T7kXy+mLFZNZQ=,tag:5pK22TYGwbBNyWlfd/Ufxw==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/nixy/secrets/wg_privkey_proton.yaml b/nixy/secrets/wg_privkey_proton.yaml deleted file mode 100644 index 86753af..0000000 --- a/nixy/secrets/wg_privkey_proton.yaml +++ /dev/null @@ -1,22 +0,0 @@ -wg_privkey_proton: ENC[AES256_GCM,data:qVVd+1s2T3sKDi03V+eMvgqW8LAVl/yEKwtG2EMn8NhBCN7RvlttC5SeIDM=,iv:/QcrtmMjCzZRulumIz5u9oxyaRt+HUq96ZiP8ecpvAo=,tag:1DCaJqVGfg3sfvKTQnmzZA==,type:str] -wg_endpoint_proton: ENC[AES256_GCM,data:ggoWnB6nGjGc/kSOaCo=,iv:1r5J6SO5JYH7+bMhE2lGwfFETVFeS61eCXtej0Pl07M=,tag:p+0hhQ/vqZzZML24YReA0g==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxdXZpL1lrOEYyYVdFTzNJ - SHhXRVc5Y0o4ZzN2THRjM215UWczVjZOTXg4CjBJZ2VxN0t0ZFgzTmJMeXo5SWZk - UjRlNmdRTVVPbHVEeXM3TWhoS0pSUTQKLS0tIEtkTURBc1A3d2lTalhmeEoxUkZj - K3BHZnUzN3ZrL1dFQk8rWFpZR05pbFUKObrnIpY3NR1o3/lKhTfVpQU+eQRTi7wF - SAjGZ5BRdCi5x1VWRxiT1Fvjqkm7kBEQFvdSvbqW2UK6lVHtWgt2Vg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2024-05-12T13:30:18Z" - mac: ENC[AES256_GCM,data:3UqJGcNGPZDlLA3a0uNHUI0ykDC0ByxAR2ZsrsbWQMv3BS6zyBuc+zpTHQZoIPGsAMUetuB3OuA0IQNll3abg6u2AadEQBUf1PYMWlo58txLYlAs/q0g+575F+LhDSgmDMKOFXz4HqbFP0RYTHkPnmjWPMWWY3G9o6B3Iaw5+Kc=,iv:massJRpGcH4pDZxJrpQYy80XVViyw+qFsZ8Sk9Xze08=,tag:eDvuNadKGKBS/3jauvnuFQ==,type:str] - pgp: [] - unencrypted_suffix: _unencrypted - version: 3.8.1 diff --git a/nixy/ssh_pubkey b/nixy/ssh_pubkey deleted file mode 100644 index 6b5fcaf..0000000 --- a/nixy/ssh_pubkey +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPNCxE/8z02lVOC1unJbPMH+Ma+KRJfmz33oUfz3hKc root@nixy diff --git a/nixy/wg_pubkey b/nixy/wg_pubkey deleted file mode 100644 index ed01ed9..0000000 --- a/nixy/wg_pubkey +++ /dev/null @@ -1 +0,0 @@ -oHVmhw80daHjDjo7nwt/Y9eKBaH5FoTiVeukwDObijM= diff --git a/nixy/wg_pubkey_nx b/nixy/wg_pubkey_nx deleted file mode 100644 index 5ad6892..0000000 --- a/nixy/wg_pubkey_nx +++ /dev/null @@ -1 +0,0 @@ -eoYSDh27qQFpvOcDmuVFzSTuPnrHQYXDMqatKmDAth0=