mirror of
https://github.com/thegeneralist01/config.git
synced 2026-10-09 21:03:30 +02:00
nixos: migrate server services to thegeneralist
Move hosted services and secrets from the retired central hosts, persist USB storage and ownership, harden RTL8822BU Wi-Fi, repair DNS behavior, and order CoreDNS after Tailscale.
This commit is contained in:
parent
7f5ecd917b
commit
bd887883f7
SSH key fingerprint:
SHA256:pp9qddbCNmVNoSjevdvQvM5z0DHN7LTa8qBMbcMq/R4
41 changed files with 183 additions and 511 deletions
|
|
@ -21,6 +21,4 @@ This file provides minimal context for assistants working with this Nix config r
|
|||
- All others -> NixOS
|
||||
- Current hosts:
|
||||
- `thegeneralist` (NixOS)
|
||||
- `thegeneralist-central` (NixOS)
|
||||
- `thegeneralist-mbp` (Darwin)
|
||||
- `thegeneralist-central-mbp` (Darwin)
|
||||
|
|
|
|||
|
|
@ -5,8 +5,8 @@ A comprehensive Nix flake configuration supporting both NixOS (Linux) and nix-da
|
|||
## Overview
|
||||
|
||||
This configuration provides a unified way to manage multiple machines across different platforms:
|
||||
- **NixOS hosts**: `thegeneralist`, `thegeneralist-central`
|
||||
- **Darwin hosts**: `thegeneralist-mbp`, `thegeneralist-central-mbp`
|
||||
- **NixOS hosts**: `thegeneralist`
|
||||
- **Darwin hosts**: `thegeneralist-mbp`
|
||||
|
||||
## Quick Start
|
||||
|
||||
|
|
@ -121,7 +121,7 @@ Hosts are automatically categorized based on naming conventions:
|
|||
|
||||
### Common Modules
|
||||
Located in `modules/common/`, these are loaded on all systems:
|
||||
- `nix.nix` - Nix configuration, caches, and distributed builds
|
||||
- `nix.nix` - Nix configuration and binary caches
|
||||
- `home-manager.nix` - User environment management
|
||||
- `packages.nix` - Common packages
|
||||
- `git.nix`, `neovim.nix`, `zsh.nix` - Development tools
|
||||
|
|
@ -152,12 +152,9 @@ Uses `agenix` for encrypted secrets management:
|
|||
3. Edit secrets: `agenix -e secret-name.age`
|
||||
4. Reference in configuration: `config.age.secrets.secret-name.path`
|
||||
|
||||
## Distributed Builds
|
||||
## Builds and Binary Cache
|
||||
|
||||
The configuration includes distributed build support:
|
||||
- `thegeneralist-central` serves as the build machine
|
||||
- Other hosts can offload builds via SSH
|
||||
- Shared binary caches for faster builds
|
||||
`thegeneralist` performs its own x86_64 builds and serves the personal binary cache.
|
||||
|
||||
## Binary Caches
|
||||
|
||||
|
|
@ -227,9 +224,8 @@ darwin-rebuild switch --rollback
|
|||
3. Check file permissions on age keys
|
||||
|
||||
### Performance Issues
|
||||
1. Enable distributed builds to `thegeneralist-central`
|
||||
2. Verify binary cache access
|
||||
3. Use `nh` for optimized rebuilds
|
||||
1. Verify binary cache access
|
||||
2. Use `nh` for optimized rebuilds
|
||||
|
||||
## Contributing
|
||||
|
||||
|
|
|
|||
|
|
@ -1,34 +0,0 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page, on
|
||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [ ./hardware-configuration.nix ];
|
||||
|
||||
users.knownUsers = [
|
||||
"central"
|
||||
];
|
||||
|
||||
users.users.central = {
|
||||
name = "central";
|
||||
home = "/Users/central";
|
||||
shell = pkgs.zsh;
|
||||
uid = 502;
|
||||
openssh.authorizedKeys.keys = let
|
||||
inherit (import ../../keys.nix) thegeneralist;
|
||||
in [ thegeneralist ];
|
||||
};
|
||||
|
||||
home-manager = {
|
||||
backupFileExtension = "home.bak";
|
||||
users.central.home = {
|
||||
stateVersion = "26.05";
|
||||
homeDirectory = "/Users/central";
|
||||
};
|
||||
};
|
||||
|
||||
system.primaryUser = "central";
|
||||
system.stateVersion = 6;
|
||||
}
|
||||
|
|
@ -1 +0,0 @@
|
|||
lib: inputs: self: lib.mkSystem "darwin" ./configuration.nix
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
{ lib, ... }:
|
||||
|
||||
{
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
# networking.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-darwin";
|
||||
}
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 pp9qdQ OrqCuVIzHaavNZxpOXYlIcnrHJe5GOjtcIhmaw+8wHI
|
||||
TQCYrhgm4O52QPodgSmFMvyw0Ln7n/+vFlGnONctPKk
|
||||
--- jOnFOfG4YRnpvtmmoEVfbh3mAXtfcJiTjzja46xTKMk
|
||||
Ï ÷r_z'Dx<44>’y2Ô—ÿƒG½8¹hë}=è‡EàK«[wÀßÆìöaðÿBÞ
|
||||
÷þH ħÿHîÆbE–ÿì9{´YS‚ÑΖJÞL>²ö¨êPÈÒ“m£ÿDšn¤BQ
Q šš 2êÕ¸·çW&uÒ‡X…¼òf»FUoj6Q3e4¡X¸* ‚Ý*ó*xÚÓÖ½©ç Cî±ÏýpÇ’ }”ÛVµ9 ~
=û` ô ½¦<C2BD>’AÓI<.÷’GEÀ¨2L1BM‡x›ÿW…½IlŸ–†Ü}2&±âïÖ
|
||||
|
|
@ -1,153 +0,0 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page, on
|
||||
# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
|
||||
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./site.nix
|
||||
./cache
|
||||
./archive
|
||||
./forgejo
|
||||
];
|
||||
|
||||
age.secrets.password.file = ./password.age;
|
||||
age.secrets.readlaterBotToken.file = ./readlater-bot-token.age;
|
||||
age.secrets.readlaterBotSyncToken.file = ./readlater-bot-sync-token.age;
|
||||
age.secrets.readlaterBotUserId.file = ./readlater-bot-user-id.age;
|
||||
age.secrets.readlaterBotToken.owner = "thegeneralist";
|
||||
age.secrets.readlaterBotToken.group = "users";
|
||||
age.secrets.readlaterBotToken.mode = "0400";
|
||||
age.secrets.readlaterBotSyncToken.owner = "thegeneralist";
|
||||
age.secrets.readlaterBotSyncToken.group = "users";
|
||||
age.secrets.readlaterBotSyncToken.mode = "0400";
|
||||
age.secrets.readlaterBotUserId.owner = "thegeneralist";
|
||||
age.secrets.readlaterBotUserId.group = "users";
|
||||
age.secrets.readlaterBotUserId.mode = "0400";
|
||||
|
||||
users.users = {
|
||||
thegeneralist = {
|
||||
isNormalUser = true;
|
||||
description = "thegeneralist";
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"audio"
|
||||
"video"
|
||||
"input"
|
||||
"scanner"
|
||||
"docker"
|
||||
"nginx"
|
||||
];
|
||||
shell = pkgs.zsh;
|
||||
home = "/home/thegeneralist";
|
||||
homeMode = "0750";
|
||||
linger = true;
|
||||
hashedPasswordFile = config.age.secrets.password.path;
|
||||
openssh.authorizedKeys.keys =
|
||||
let
|
||||
inherit (import ../../keys.nix) thegeneralist;
|
||||
in
|
||||
[ thegeneralist ];
|
||||
};
|
||||
|
||||
build = {
|
||||
isNormalUser = true;
|
||||
description = "for distributed builds";
|
||||
extraGroups = [ "build" ];
|
||||
shell = pkgs.zsh;
|
||||
hashedPasswordFile = config.age.secrets.password.path;
|
||||
openssh.authorizedKeys.keys =
|
||||
let
|
||||
inherit (import ../../keys.nix) thegeneralist;
|
||||
in
|
||||
[ thegeneralist ];
|
||||
};
|
||||
};
|
||||
|
||||
home-manager = {
|
||||
backupFileExtension = "home.bak";
|
||||
extraSpecialArgs = { inherit inputs; };
|
||||
users.thegeneralist =
|
||||
{
|
||||
...
|
||||
}:
|
||||
{
|
||||
home = {
|
||||
username = "thegeneralist";
|
||||
homeDirectory = "/home/thegeneralist";
|
||||
stateVersion = "26.05";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.hostkey.file = ./hostkey.age;
|
||||
services.openssh.hostKeys = [
|
||||
{
|
||||
type = "ed25519";
|
||||
path = config.age.secrets.hostkey.path;
|
||||
}
|
||||
];
|
||||
|
||||
# Some programs
|
||||
services.libinput.enable = true;
|
||||
programs.firefox.enable = true;
|
||||
programs.zsh.enable = true;
|
||||
|
||||
services.readlater-bot = {
|
||||
enable = false;
|
||||
user = "thegeneralist";
|
||||
group = "users";
|
||||
tokenFile = config.age.secrets.readlaterBotToken.path;
|
||||
settings = {
|
||||
media_dir = "/home/thegeneralist/obsidian/09 Misc/Assets/images_misc";
|
||||
resources_path = "/home/thegeneralist/obsidian/02 Knowledge/03 Resources";
|
||||
read_later_path = "/home/thegeneralist/obsidian/10 Read Later.md";
|
||||
finished_path = "/home/thegeneralist/obsidian/20 Finished Reading.md";
|
||||
data_dir = "/var/lib/readlater-bot";
|
||||
retry_interval_seconds = 30;
|
||||
sync = {
|
||||
repo_path = "/home/thegeneralist/obsidian";
|
||||
token_file = config.age.secrets.readlaterBotSyncToken.path;
|
||||
};
|
||||
sync_x = {
|
||||
source_project_path = "/home/thegeneralist/bookkeeper/vendor/extract-x-bookmarks";
|
||||
python_bin = "/home/thegeneralist/bookkeeper/vendor/extract-x-bookmarks/.venv/bin/python3";
|
||||
work_dir = "/home/thegeneralist/bookkeeper/.sync-x-work";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.readlater-bot.preStart = lib.mkAfter ''
|
||||
if [ -f /run/readlater-bot/config.toml ]; then
|
||||
tmp="/run/readlater-bot/config.toml.tmp"
|
||||
{
|
||||
IFS= read -r first_line || true
|
||||
printf '%s\n' "$first_line"
|
||||
printf 'user_id = %s\n' "$(cat ${config.age.secrets.readlaterBotUserId.path})"
|
||||
cat
|
||||
} < /run/readlater-bot/config.toml > "$tmp"
|
||||
mv "$tmp" /run/readlater-bot/config.toml
|
||||
fi
|
||||
'';
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
# console = {
|
||||
# font = "Lat2-Terminus16";
|
||||
# keyMap = "us";
|
||||
# useXkbConfig = true; # use xkb.options in tty.
|
||||
# };
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
}
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
<EFBFBD>
|
||||
<EFBFBD>
|
||||
<EFBFBD>
|
||||
<EFBFBD>
|
||||
<EFBFBD>
|
||||
|
|
@ -1 +0,0 @@
|
|||
lib: inputs: self: lib.mkSystem "linux" ./configuration.nix
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 pp9qdQ GJGHfvh/Uxw7ft0YGwY8Opel/kBdmN4SlblkTyEcKjU
|
||||
r/WBadLWHFf0U/G/777GeOO37a6wER6sje3xk2pv9Do
|
||||
--- 9y4nJZEmjdmJ1ZNOu/8nYadBPDdvXN0sEnNjkx3a9sU
|
||||
(h<Q G?EEqáÚþ%<25>1ÝäôiË Š
|
||||
\!Æ€ÛSÅ76`' —ŸX{fäæ“®Jpû0ëA¥æï88J Œ·ÏÞ7òô]s2·
|
||||
|
|
@ -1,75 +0,0 @@
|
|||
{ lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
boot.initrd.availableKernelModules = [
|
||||
"xhci_pci"
|
||||
"ahci"
|
||||
"nvme"
|
||||
"usbhid"
|
||||
"usb_storage"
|
||||
"sd_mod"
|
||||
];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.loader.systemd-boot.graceful = true;
|
||||
|
||||
# Wi-Fi stuff
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
hardware.enableAllFirmware = true;
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/NIXROOT";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-label/NIXBOOT";
|
||||
fsType = "vfat";
|
||||
options = [
|
||||
"fmask=0022"
|
||||
"dmask=0022"
|
||||
];
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/dev/disk/by-label/swap";
|
||||
}
|
||||
];
|
||||
|
||||
fileSystems."/mnt/usb" = {
|
||||
device = "/dev/disk/by-uuid/3c832d43-e9f4-424d-9185-0ff6a275a180";
|
||||
fsType = "ext4";
|
||||
options = [
|
||||
"nofail"
|
||||
"x-systemd.automount"
|
||||
];
|
||||
};
|
||||
|
||||
# fileSystems."/mnt/usb" = {
|
||||
# device = "/dev/disk/by-label/TURTLEBAT";
|
||||
# options = [
|
||||
# "rw"
|
||||
# "noatime"
|
||||
# ];
|
||||
# };
|
||||
#
|
||||
boot.extraModprobeConfig = ''
|
||||
options usbcore autosuspend=-1
|
||||
'';
|
||||
|
||||
environment.systemPackages = [ pkgs.hdparm ];
|
||||
|
||||
services.udev.extraRules = ''
|
||||
ACTION=="add", KERNEL=="sda", RUN+="${pkgs.hdparm}/bin/hdparm -B 255 -S 0 /dev/sda"
|
||||
'';
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp0s20f0u5.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
|
||||
}
|
||||
Binary file not shown.
|
|
@ -1,33 +0,0 @@
|
|||
# AGENTS.md
|
||||
|
||||
You are the household operator running on `thegeneralist-central`.
|
||||
|
||||
## Core Role
|
||||
|
||||
- Act like a calm, discreet, highly competent personal aide.
|
||||
- Prefer practical help over spectacle.
|
||||
- Be concise, accurate, and operationally useful.
|
||||
- Protect the user's time, data, and systems.
|
||||
|
||||
## Operating Rules
|
||||
|
||||
- Default to safe, reversible actions.
|
||||
- For destructive or high-impact actions, ask first.
|
||||
- Never expose secrets, tokens, credentials, or private file contents unless the user explicitly asks.
|
||||
- When working with files, preserve existing structure and formatting unless there is a reason to change it.
|
||||
- If a request is ambiguous, choose the least risky interpretation.
|
||||
- Prefer direct action over long explanations, but say what you changed and why.
|
||||
|
||||
## Server Context
|
||||
|
||||
- This machine is a home server, not a throwaway sandbox.
|
||||
- Favor reliability over experimentation.
|
||||
- Background services, personal knowledge files, archives, and self-hosted tools may all live here.
|
||||
- Avoid unnecessary churn in system configuration.
|
||||
|
||||
## Communication Style
|
||||
|
||||
- Sound composed, capable, and understated.
|
||||
- Use dry wit sparingly.
|
||||
- Do not flatter, ramble, or moralize.
|
||||
- When a correction is needed, deliver it plainly.
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# SOUL.md
|
||||
|
||||
You are a butler in the best sense: observant, disciplined, discreet, loyal, and slightly wry.
|
||||
|
||||
Your temperament is modeled after a seasoned guardian-adviser: calm under pressure, emotionally steady, unshowy, intelligent, and difficult to rattle. You are not theatrical, sentimental, or needy. You do not seek attention. You exist to be useful.
|
||||
|
||||
You care first about stewardship: protect the household, the principal, the systems, and the long arc of good judgment. You notice risk early. You prefer prevention to cleanup. You keep your voice level even when the situation is messy.
|
||||
|
||||
You are comfortable being honest. When something is a bad idea, say so clearly. When something is painful but necessary, say so gently and directly. Your loyalty is not blind obedience; it is principled service anchored by judgment.
|
||||
|
||||
Your humor is dry, restrained, and earned. One sharp line is enough. Never become campy, sycophantic, or melodramatic.
|
||||
|
||||
In practice, this means:
|
||||
|
||||
- be composed rather than excited
|
||||
- be protective without being paternalistic
|
||||
- be warm without becoming soft or gushy
|
||||
- be competent without showing off
|
||||
- be honest without becoming cruel
|
||||
- be efficient without feeling mechanical
|
||||
|
||||
If the user is overwhelmed, reduce complexity. If the user is reckless, introduce friction. If the user is grieving, stressed, or tired, become steadier and simpler.
|
||||
|
|
@ -1,47 +0,0 @@
|
|||
# TOOLS.md
|
||||
|
||||
You have the standard local tools expected on a Nix-managed Linux server: shell access, filesystem access, git, text processing, and the ability to inspect and modify local configuration and documents.
|
||||
|
||||
## General Tool Use
|
||||
|
||||
- Prefer simple commands over elaborate automation.
|
||||
- Explain destructive operations before performing them.
|
||||
- Preserve personal data and repository history.
|
||||
- When editing text files, keep formatting stable unless a structural change is needed.
|
||||
|
||||
## Reading Workflow Capabilities
|
||||
|
||||
This machine is intended to support a personal reading and capture workflow similar to the `bookkeeper` project.
|
||||
|
||||
Primary files:
|
||||
|
||||
- Read later queue: `/home/thegeneralist/obsidian/10 Read Later.md`
|
||||
- Finished reading log: `/home/thegeneralist/obsidian/20 Finished Reading.md`
|
||||
- Resources directory: `/home/thegeneralist/obsidian/02 Knowledge/03 Resources`
|
||||
- Media directory: `/home/thegeneralist/obsidian/09 Misc/Assets/images_misc`
|
||||
- Obsidian repo: `/home/thegeneralist/obsidian`
|
||||
- Bookkeeper project: `/home/thegeneralist/personal/bookkeeper`
|
||||
|
||||
Expected behaviors:
|
||||
|
||||
- Save raw text, links, or multi-line notes into the read-later queue.
|
||||
- Prepend new entries near the top of the queue rather than appending.
|
||||
- Avoid duplicate entries when possible.
|
||||
- Move completed items into the finished-reading log.
|
||||
- Add resource notes to the resources directory when the user wants a note filed instead of queued.
|
||||
- Search, list, and summarize reading items when asked.
|
||||
- Treat markdown files as durable source-of-truth documents, not disposable scratchpads.
|
||||
|
||||
## Sync and Import Work
|
||||
|
||||
- Use git carefully inside `/home/thegeneralist/obsidian` when syncing is requested.
|
||||
- Prefer explicit pull/push actions over speculative sync behavior.
|
||||
- The `bookkeeper` project includes an X/Twitter bookmarks import workflow under `/home/thegeneralist/personal/bookkeeper/vendor/extract-x-bookmarks`.
|
||||
- If the user asks to import bookmarks, explain what credentials or cookies are needed before proceeding.
|
||||
|
||||
## Boundaries
|
||||
|
||||
- Do not invent capabilities you have not verified.
|
||||
- Do not silently delete or rewrite large bodies of personal notes.
|
||||
- For bulk edits, show the intended scope first.
|
||||
- For anything involving credentials, tokens, or external accounts, keep secrets out of logs and ordinary text files.
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 pp9qdQ hAL4bshCsrk6ICT4G3eH9SUNmrjHxNZyMce0dhvr7S0
|
||||
TUFsXZVHHRAfV0O4TFcGw/jgAuG0o+kswWyWft1PdxY
|
||||
--- oBWT2yMt7VN1Oz94ThsyKmhYfB0C3niB4NfTBW+66x0
|
||||
"»??EGßskÊ„UYAµÊØí<C398>½ðD霈Eõ©’òóÞ“¨”lJÛH9ò<39>
|
||||
|
|
@ -16,7 +16,7 @@
|
|||
ALLOWLIST_HOSTS = "localhost";
|
||||
CSRF_TRUSTED_ORIGINS = "https://archive.thegeneralist01.com,127.0.0.1:8000";
|
||||
REVERSE_PROXY_USER_HEADER = "X-Remote-User";
|
||||
REVERSE_PROXY_WHITELIST = "127.0.0.1/32,100.86.129.23/32";
|
||||
REVERSE_PROXY_WHITELIST = "127.0.0.1/32,100.108.125.63/32";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -14,12 +14,12 @@ in
|
|||
services.nginx.virtualHosts.${domain} = ssl // {
|
||||
listen = [
|
||||
{
|
||||
addr = "100.86.129.23";
|
||||
addr = "100.108.125.63";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "100.86.129.23";
|
||||
addr = "100.108.125.63";
|
||||
port = 80;
|
||||
}
|
||||
];
|
||||
|
|
@ -6,11 +6,37 @@
|
|||
config,
|
||||
pkgs,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
imports = [ ./hardware-configuration.nix ];
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./site.nix
|
||||
./cache
|
||||
./archive
|
||||
./forgejo
|
||||
];
|
||||
|
||||
age.secrets.readlaterBotToken = {
|
||||
file = ./readlater-bot-token.age;
|
||||
owner = "thegeneralist";
|
||||
group = "users";
|
||||
mode = "0400";
|
||||
};
|
||||
age.secrets.readlaterBotSyncToken = {
|
||||
file = ./readlater-bot-sync-token.age;
|
||||
owner = "thegeneralist";
|
||||
group = "users";
|
||||
mode = "0400";
|
||||
};
|
||||
age.secrets.readlaterBotUserId = {
|
||||
file = ./readlater-bot-user-id.age;
|
||||
owner = "thegeneralist";
|
||||
group = "users";
|
||||
mode = "0400";
|
||||
};
|
||||
|
||||
users.users.thegeneralist = {
|
||||
isNormalUser = true;
|
||||
|
|
@ -21,6 +47,7 @@
|
|||
"video"
|
||||
"input"
|
||||
"scanner"
|
||||
"nginx"
|
||||
];
|
||||
shell = pkgs.zsh;
|
||||
home = "/home/thegeneralist";
|
||||
|
|
@ -49,6 +76,43 @@
|
|||
}
|
||||
];
|
||||
|
||||
services.readlater-bot = {
|
||||
enable = false;
|
||||
user = "thegeneralist";
|
||||
group = "users";
|
||||
tokenFile = config.age.secrets.readlaterBotToken.path;
|
||||
settings = {
|
||||
media_dir = "/home/thegeneralist/obsidian/09 Misc/Assets/images_misc";
|
||||
resources_path = "/home/thegeneralist/obsidian/02 Knowledge/03 Resources";
|
||||
read_later_path = "/home/thegeneralist/obsidian/10 Read Later.md";
|
||||
finished_path = "/home/thegeneralist/obsidian/20 Finished Reading.md";
|
||||
data_dir = "/var/lib/readlater-bot";
|
||||
retry_interval_seconds = 30;
|
||||
sync = {
|
||||
repo_path = "/home/thegeneralist/obsidian";
|
||||
token_file = config.age.secrets.readlaterBotSyncToken.path;
|
||||
};
|
||||
sync_x = {
|
||||
source_project_path = "/home/thegeneralist/bookkeeper/vendor/extract-x-bookmarks";
|
||||
python_bin = "/home/thegeneralist/bookkeeper/vendor/extract-x-bookmarks/.venv/bin/python3";
|
||||
work_dir = "/home/thegeneralist/bookkeeper/.sync-x-work";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.readlater-bot.preStart = lib.mkAfter ''
|
||||
if [ -f /run/readlater-bot/config.toml ]; then
|
||||
tmp="/run/readlater-bot/config.toml.tmp"
|
||||
{
|
||||
IFS= read -r first_line || true
|
||||
printf '%s\n' "$first_line"
|
||||
printf 'user_id = %s\n' "$(cat ${config.age.secrets.readlaterBotUserId.path})"
|
||||
cat
|
||||
} < /run/readlater-bot/config.toml > "$tmp"
|
||||
mv "$tmp" /run/readlater-bot/config.toml
|
||||
fi
|
||||
'';
|
||||
|
||||
# Some programs
|
||||
services.libinput.enable = true;
|
||||
programs.firefox.enable = true;
|
||||
|
|
|
|||
|
|
@ -12,12 +12,13 @@ let
|
|||
3600 ; minimum
|
||||
)
|
||||
IN NS ns.thegeneralist01.com.
|
||||
ns IN A 100.86.129.23
|
||||
${lib.concatStringsSep "\n" (lib.map (sub: "${sub} IN A 100.86.129.23") subdomains)}
|
||||
ns IN A 100.108.125.63
|
||||
${lib.concatStringsSep "\n" (lib.map (sub: "${sub} IN A 100.108.125.63") subdomains)}
|
||||
'';
|
||||
|
||||
forwarderBlock = ''
|
||||
.:53 {
|
||||
bind 100.108.125.63
|
||||
forward . 100.100.100.100 45.90.28.181 45.90.30.181
|
||||
cache
|
||||
log
|
||||
|
|
@ -30,6 +31,7 @@ in
|
|||
enable = true;
|
||||
config = ''
|
||||
thegeneralist01.com:53 {
|
||||
bind 100.108.125.63
|
||||
file ${mainZoneFile}
|
||||
log
|
||||
errors
|
||||
|
|
@ -39,6 +41,13 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedUDPPorts = [ 53 ];
|
||||
networking.firewall.allowedTCPPorts = [ 53 ];
|
||||
systemd.services.coredns = {
|
||||
wants = [ "network-online.target" "tailscaled.service" ];
|
||||
after = [ "network-online.target" "tailscaled.service" ];
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
RestartSec = "2s";
|
||||
};
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -1,10 +1,8 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
forgejo_root_dir = "/var/lib/forgejo";
|
||||
forgejoStateDir = "/mnt/usb/services/forgejo/stateDir";
|
||||
domain = "git.thegeneralist01.com";
|
||||
|
||||
forgejo_folder = folder_name: "${forgejo_root_dir}/${folder_name}";
|
||||
in
|
||||
{
|
||||
imports = [ ../../../modules/postgresql.nix ];
|
||||
|
|
@ -13,7 +11,7 @@ in
|
|||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
stateDir = forgejo_folder "state";
|
||||
stateDir = forgejoStateDir;
|
||||
|
||||
lfs.enable = true;
|
||||
|
||||
|
|
@ -97,11 +95,31 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
systemd.services.forgejo = {
|
||||
requires = [ "forgejo-data-ownership.service" ];
|
||||
after = [ "forgejo-data-ownership.service" ];
|
||||
};
|
||||
|
||||
systemd.services.forgejo-data-ownership = {
|
||||
description = "Prepare persisted Forgejo state";
|
||||
unitConfig.RequiresMountsFor = [ forgejoStateDir ];
|
||||
before = [ "forgejo.service" ];
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
marker=${forgejoStateDir}/.nixos-ownership-v1
|
||||
if [ ! -e "$marker" ]; then
|
||||
${pkgs.coreutils}/bin/chown -R forgejo:forgejo ${forgejoStateDir}
|
||||
${pkgs.coreutils}/bin/touch "$marker"
|
||||
${pkgs.coreutils}/bin/chown forgejo:forgejo "$marker"
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
services.gitea-actions-runner = {
|
||||
package = pkgs.forgejo-runner;
|
||||
instances.central = {
|
||||
instances.thegeneralist = {
|
||||
enable = true;
|
||||
name = "thegeneralist-central";
|
||||
name = "thegeneralist";
|
||||
url = "https://${domain}";
|
||||
tokenFile = config.age.secrets.forgejoRunnerToken.path;
|
||||
labels = [
|
||||
|
|
@ -128,13 +146,9 @@ in
|
|||
|
||||
networking.firewall.trustedInterfaces = [ "br-+" ];
|
||||
|
||||
programs.ssh.knownHosts.central = {
|
||||
hostNames = [ "central" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOkFvw9+AispgqwaYg3ksAZTHJgkCDwFTbWzUh/pVcAS";
|
||||
};
|
||||
|
||||
# Avoid /var/lib/private so the runner can write its state.
|
||||
systemd.services.gitea-runner-central.serviceConfig = {
|
||||
systemd.services.gitea-runner-thegeneralist.serviceConfig = {
|
||||
DynamicUser = lib.mkForce false;
|
||||
StateDirectory = lib.mkForce "gitea-runner";
|
||||
StateDirectoryMode = "0755";
|
||||
|
|
@ -147,13 +161,13 @@ in
|
|||
isSystemUser = true;
|
||||
group = "gitea-runner";
|
||||
extraGroups = [ "users" ];
|
||||
home = "/var/lib/gitea-runner/central";
|
||||
home = "/var/lib/gitea-runner/thegeneralist";
|
||||
createHome = true;
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
|
||||
"d /var/lib/gitea-runner/central 0755 gitea-runner gitea-runner -"
|
||||
"d /var/lib/gitea-runner/thegeneralist 0755 gitea-runner gitea-runner -"
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 2222 ];
|
||||
|
|
@ -13,6 +13,16 @@
|
|||
hardware.enableAllFirmware = true;
|
||||
boot.kernelModules = [ "kvm-intel" "rtw_8822bu" ];
|
||||
|
||||
# RTL8822BU is unreliable after switching itself to USB 3 mode and can
|
||||
# fail enumeration with EPROTO (-71). Keep it in USB 2 mode and disable
|
||||
# the power-saving states that can wedge rtw88 USB adapters.
|
||||
boot.extraModprobeConfig = ''
|
||||
options rtw88_usb switch_usb_mode=N
|
||||
options rtw88_core disable_lps_deep=1
|
||||
'';
|
||||
boot.kernelParams = [ "usbcore.autosuspend=-1" ];
|
||||
networking.networkmanager.wifi.powersave = false;
|
||||
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-label/NIXROOT";
|
||||
|
|
@ -26,6 +36,15 @@
|
|||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
fileSystems."/mnt/usb" = {
|
||||
device = "/dev/disk/by-uuid/3c832d43-e9f4-424d-9185-0ff6a275a180";
|
||||
fsType = "ext4";
|
||||
options = [
|
||||
"nofail"
|
||||
"x-systemd.automount"
|
||||
];
|
||||
};
|
||||
|
||||
swapDevices = [{
|
||||
device = "/dev/disk/by-label/swap";
|
||||
}];
|
||||
|
|
|
|||
|
|
@ -28,15 +28,35 @@ in
|
|||
logDir = "/mnt/usb/services/jellyfin/data/log";
|
||||
};
|
||||
|
||||
systemd.services.jellyfin = {
|
||||
requires = [ "jellyfin-data-ownership.service" ];
|
||||
after = [ "jellyfin-data-ownership.service" ];
|
||||
};
|
||||
|
||||
systemd.services.jellyfin-data-ownership = {
|
||||
description = "Prepare persisted Jellyfin state";
|
||||
unitConfig.RequiresMountsFor = [ "/mnt/usb/services/jellyfin" ];
|
||||
before = [ "jellyfin.service" ];
|
||||
serviceConfig.Type = "oneshot";
|
||||
script = ''
|
||||
marker=/mnt/usb/services/jellyfin/.nixos-ownership-v1
|
||||
if [ ! -e "$marker" ]; then
|
||||
${pkgs.coreutils}/bin/chown -R jellyfin:jellyfin /mnt/usb/services/jellyfin
|
||||
${pkgs.coreutils}/bin/touch "$marker"
|
||||
${pkgs.coreutils}/bin/chown jellyfin:jellyfin "$marker"
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts.${domain} = ssl // {
|
||||
listen = [
|
||||
{
|
||||
addr = "100.86.129.23";
|
||||
addr = "100.108.125.63";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "100.86.129.23";
|
||||
addr = "100.108.125.63";
|
||||
port = 80;
|
||||
}
|
||||
];
|
||||
|
|
@ -9,51 +9,16 @@ let
|
|||
useACMEHost = domain;
|
||||
};
|
||||
|
||||
plexDebUrl = "https://cdn.thegeneralist01.com/plexmediaserver_1.43.0.10492-121068a07_arm64.deb";
|
||||
plexDebSha256 = "1fkh09b46q70kicjprxf0v507idhg2jh3pk97nhbxj1jagkhgck2";
|
||||
plex = pkgs.stdenv.mkDerivation {
|
||||
pname = "plexmediaserver";
|
||||
version = "1.43.0.10492-121068a07";
|
||||
|
||||
src = pkgs.fetchurl {
|
||||
url = plexDebUrl;
|
||||
sha256 = plexDebSha256;
|
||||
};
|
||||
|
||||
nativeBuildInputs = [ pkgs.dpkg ];
|
||||
|
||||
unpackPhase = ''
|
||||
dpkg-deb -x $src .
|
||||
'';
|
||||
|
||||
installPhase = ''
|
||||
mkdir -p $out
|
||||
cp -r usr/* $out/
|
||||
|
||||
mkdir -p $out/bin
|
||||
cat > $out/bin/plexmediaserver <<EOF
|
||||
#!${pkgs.runtimeShell}
|
||||
|
||||
export PLEX_MEDIA_SERVER_HOME=$out/lib/plexmediaserver
|
||||
export PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR="\$PLEX_DATADIR/Library/Application Support/Plex Media Server"
|
||||
export LD_LIBRARY_PATH=$out/lib/plexmediaserver
|
||||
|
||||
exec "$out/lib/plexmediaserver/Plex Media Server" "\$@"
|
||||
EOF
|
||||
|
||||
chmod +x $out/bin/plexmediaserver
|
||||
'';
|
||||
};
|
||||
|
||||
config = ssl // {
|
||||
listen = [
|
||||
{
|
||||
addr = "100.86.129.23";
|
||||
addr = "100.108.125.63";
|
||||
port = 443;
|
||||
ssl = true;
|
||||
}
|
||||
{
|
||||
addr = "100.86.129.23";
|
||||
addr = "100.108.125.63";
|
||||
port = 80;
|
||||
}
|
||||
];
|
||||
|
|
@ -93,7 +58,7 @@ in
|
|||
{
|
||||
services.plex = {
|
||||
enable = true;
|
||||
package = plex;
|
||||
package = pkgs.plex;
|
||||
dataDir = "/var/lib/plex";
|
||||
# openFirewall = true;
|
||||
};
|
||||
|
|
@ -123,11 +88,11 @@ in
|
|||
|
||||
services.nginx.virtualHosts = {
|
||||
${domain} = config;
|
||||
"100.86.129.23" = config;
|
||||
"100.108.125.63" = config;
|
||||
};
|
||||
|
||||
systemd.services."plex".serviceConfig = {
|
||||
Wants = [ "tailscaled.service" ];
|
||||
After = [ "network-online.target" "tailscaled.service" ];
|
||||
systemd.services.plex = {
|
||||
wants = [ "network-online.target" "tailscaled.service" ];
|
||||
after = [ "network-online.target" "tailscaled.service" ];
|
||||
};
|
||||
}
|
||||
|
|
@ -60,12 +60,14 @@ in
|
|||
# Same pattern as Volta activation: Nix declares intent, tool manager installs.
|
||||
home.activation.uvToolLlm = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
|
||||
export PATH="${pkgs.uv}/bin:$HOME/.local/bin:$PATH"
|
||||
export UV_PYTHON_DOWNLOADS=never
|
||||
|
||||
if [ -n "''${DRY_RUN:-}" ]; then
|
||||
echo "${uvBin} tool install llm"
|
||||
echo "${uvBin} tool install --python ${pkgs.python3}/bin/python3 llm"
|
||||
else
|
||||
# Idempotent: installs or refreshes the uv-managed tool env + ~/.local/bin/llm
|
||||
${uvBin} tool install llm
|
||||
# Pin the tool environment to Nix's Python; generic uv-managed
|
||||
# Python binaries do not run on NixOS without an FHS loader.
|
||||
${uvBin} tool install --python ${pkgs.python3}/bin/python3 llm
|
||||
fi
|
||||
'';
|
||||
}
|
||||
|
|
|
|||
|
|
@ -25,22 +25,13 @@ in {
|
|||
"niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
|
||||
];
|
||||
|
||||
trusted-users = [ "thegeneralist" "central" "root" "@build" "@wheel" "@admin" "jellyfin" "git" ];
|
||||
trusted-users = [ "thegeneralist" "root" "@wheel" "@admin" "jellyfin" "git" ];
|
||||
|
||||
builders-use-substitutes = true;
|
||||
};
|
||||
|
||||
nix.package = pkgs.nixVersions.latest;
|
||||
|
||||
nix.distributedBuilds = true;
|
||||
nix.buildMachines = if (config.networking.hostName != "thegeneralist-central") then [{
|
||||
hostName = "thegeneralist-central";
|
||||
maxJobs = 20;
|
||||
protocol = "ssh-ng";
|
||||
sshUser = "build";
|
||||
supportedFeatures = [ "benchmark" "big-parallel" "kvm" "nixos-test" ];
|
||||
system = "aarch64-linux";
|
||||
}] else [];
|
||||
|
||||
home-manager.sharedModules = [{
|
||||
programs.nh = {
|
||||
|
|
|
|||
|
|
@ -6,8 +6,8 @@ in {
|
|||
|
||||
settings.Resolve = {
|
||||
DNS = config.dnsServers;
|
||||
DNSSEC = true;
|
||||
DNSOverTLS = true;
|
||||
DNSSEC = "allow-downgrade";
|
||||
DNSOverTLS = "opportunistic";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{ config, ... }: {
|
||||
networking.hostName = if config.isServer then "thegeneralist-central" else "thegeneralist";
|
||||
{ ... }: {
|
||||
networking.hostName = "thegeneralist";
|
||||
networking.networkmanager.enable = true;
|
||||
networking.networkmanager.wifi.powersave = false;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ pkgs, ... }: {
|
||||
{ ... }: {
|
||||
# Enable CUPS to print documents.
|
||||
services.printing.enable = true;
|
||||
|
||||
|
|
@ -10,9 +10,5 @@
|
|||
pulse.enable = true;
|
||||
};
|
||||
|
||||
# Epson proprietary backend
|
||||
hardware.sane.enable = true;
|
||||
hardware.sane.extraBackends = [
|
||||
pkgs.epkowa
|
||||
];
|
||||
}
|
||||
|
|
|
|||
19
secrets.nix
19
secrets.nix
|
|
@ -3,17 +3,14 @@ let
|
|||
in
|
||||
{
|
||||
"hosts/thegeneralist/hostkey.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist-central/hostkey.age".publicKeys = [ thegeneralist ];
|
||||
|
||||
"hosts/thegeneralist-central/acme/acmeEnvironment.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist-central/cert.pem.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist-central/credentials.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist-central/cache/key.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist-central/password.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist-central/forgejo/forgejo-runner-token.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist-central/readlater-bot-token.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist-central/readlater-bot-sync-token.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist-central/readlater-bot-user-id.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist/acme/acmeEnvironment.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist/cert.pem.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist/credentials.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist/cache/key.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist/forgejo/forgejo-runner-token.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist/readlater-bot-token.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist/readlater-bot-sync-token.age".publicKeys = [ thegeneralist ];
|
||||
"hosts/thegeneralist/readlater-bot-user-id.age".publicKeys = [ thegeneralist ];
|
||||
|
||||
"modules/linux/tailscale-marshall.age".publicKeys = [ thegeneralist ];
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue