Merge branch 'master' into firewall-changes

Reviewed-on: #16

flake.lock

@@ -32,11 +32,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1788678360,
-        "narHash": "sha256-wY0SpYoSCFUEDViELieo2hh39JRNRwQcPonrtrmAc40=",
+        "lastModified": 1791702392,
+        "narHash": "sha256-8uWZP3UiJBtYzBzazI18WvlshKYHxPb+8aqm02OxL5M=",
         "ref": "refs/heads/master",
-        "rev": "e6a3ec44bc55dcd9531e69b7a5ba05e49561d7c7",
-        "revCount": 23,
+        "rev": "ee2a27ad749d6d774e26c2be5de5f3a5ecd4a93f",
+        "revCount": 28,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/caitsith.git"
       },
@@ -267,11 +267,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1789395265,
-        "narHash": "sha256-EvwCTZsXjw2AkEYP3dJd/ZQDxfMhK73p1t17Dl+kx3g=",
+        "lastModified": 1792166485,
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "615091b8fb4b01d37b01f81bd68fe57e500066c4",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -290,11 +290,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789140629,
-        "narHash": "sha256-1TN95Z5nh1z6pyuou2QguhkWJKAl+hIpcfVV/RayGQQ=",
+        "lastModified": 1792166485,
+        "narHash": "sha256-TL2RJ56FbBQNi6vsCXAn7QhZECh5DPbvzfiX6v+4r1A=",
         "owner": "purpleclay",
         "repo": "go-overlay",
-        "rev": "7069b95f142184721d3aeac373d687912e7ada0e",
+        "rev": "5971ffb6c5de960d37f3b85c53cb5a30387cd05a",
         "type": "github"
       },
       "original": {
@@ -313,11 +313,11 @@
         "rust-overlay": "rust-overlay_3"
       },
       "locked": {
-        "lastModified": 1788678407,
-        "narHash": "sha256-Yh0HFdJyYJ9s/9R74ybEAWs8bT8aeIiebFHCJE3534E=",
+        "lastModified": 1791702441,
+        "narHash": "sha256-qHf8tVIYu6OE1PKcthmpBgblg27u3bU7v4TVqy0B3jg=",
         "ref": "refs/heads/master",
-        "rev": "9b9eec68fe154e8ea0bc560677006d7aa69bf855",
-        "revCount": 7,
+        "rev": "2c2e99f6347e9be744a72f7df6043015989d6cd7",
+        "revCount": 17,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/hildibrand.git"
       },
@@ -333,11 +333,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789267039,
-        "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
+        "lastModified": 1792274446,
+        "narHash": "sha256-AM1HmBeDnB2B3dSiXuCYeu7Me+lHNpz/P39lVxGJBuQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
+        "rev": "ab3823b4b24c0c3ca984c1f3ee577fd6d667424c",
         "type": "github"
       },
       "original": {
@@ -355,11 +355,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789273010,
-        "narHash": "sha256-E7dWx+utzZPpqQsBUd5sMimKTWMEEbTKFD+ya99Shps=",
+        "lastModified": 1792098797,
+        "narHash": "sha256-u4DIIZgznEGzByxXrxWCXK19VcMtTBmi/M9gZ7Jk9bM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "fdc36b12804b0179b24a5ffd282e4c95c37072e2",
+        "rev": "640725978b99076e18e069f6e7d2959124584f8f",
         "type": "github"
       },
       "original": {
@@ -370,11 +370,11 @@
     },
     "mnw": {
       "locked": {
-        "lastModified": 1780772958,
-        "narHash": "sha256-VKKe8r4pwCGWZ3Yr9CPN129R4S3CKLSrlYqdYz3vKpM=",
+        "lastModified": 1784154424,
+        "narHash": "sha256-HRn4O1X2ShYtbq5Egji72/aemyc2cIQicjRZD9hBqM8=",
         "owner": "Gerg-L",
         "repo": "mnw",
-        "rev": "0871dbf63a53610c95db04439ed8ea4d6ec9c160",
+        "rev": "0151d9fa87992cbeb67c86616fb9170dcec830b6",
         "type": "github"
       },
       "original": {
@@ -401,11 +401,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1789006805,
-        "narHash": "sha256-xB8mKMOx1IA9vTDNLmJZ6n4wCMq/cuWBBOzGCRnqxrU=",
+        "lastModified": 1789286504,
+        "narHash": "sha256-eiEK7cKZORNEvX0GeF3RtNEF/JXhgf2RqSp3230q13E=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "8ce4ef6cb6f871616146b9fe26d2a5ae594e94fe",
+        "rev": "ef34387ddd751e1ab8857adf4676492d32eb24ec",
         "type": "github"
       },
       "original": {
@@ -417,11 +417,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1789344334,
-        "narHash": "sha256-vdhpDJ3Lr24lkZ+fDCjmBRRtw9/vcSzkqGJOJyF5h2U=",
+        "lastModified": 1792030654,
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c3eea5b2156db11c7eeeada3dc737711255b253e",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -433,11 +433,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1789114715,
-        "narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
+        "lastModified": 1792030654,
+        "narHash": "sha256-OaQwAtPMTjQiY2sT/2/62UbSPhzP/0aDnWzMm/NCiUw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "21a67dc470149f337cecafbe965d8d252a390518",
+        "rev": "26f4107e47e3ad0ffd0db220469ba83b6f6d96e8",
         "type": "github"
       },
       "original": {
@@ -449,11 +449,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1787498568,
-        "narHash": "sha256-FoOSoBG7tEvOlGRTpWnVdY506Ner4y7r7UYO3OGgmE8=",
-        "rev": "56c02bc00adcf003215cc4bd996d6efaf4cff188",
+        "lastModified": 1790046670,
+        "narHash": "sha256-OJe62m8gZx4xEAQnMcqH1u31/uu4Xf0q2ykAEHZfgrg=",
+        "rev": "6774f7bc253789b113a4f39285dc0fa100abeacc",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1060451.56c02bc00adc/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1077996.6774f7bc2537/nixexprs.tar.xz"
       },
       "original": {
         "type": "tarball",
@@ -487,11 +487,11 @@
         "rust-overlay": "rust-overlay_4"
       },
       "locked": {
-        "lastModified": 1789283127,
-        "narHash": "sha256-lax4hk2gJykg1bPLkSUTMRokudDWvvia3M4/72sTBt8=",
+        "lastModified": 1792344577,
+        "narHash": "sha256-Sbd2veIdg9iDiwwDeEKIiuk8FYMtjBXWvDlrrM0FjVA=",
         "ref": "refs/heads/master",
-        "rev": "024df8e385052c32a2b5d98bb33aa261710fb987",
-        "revCount": 96,
+        "rev": "2debafc63297a24d2ca5c749b0d3f6bdbf6324cb",
+        "revCount": 113,
         "type": "git",
         "url": "https://scm.wyattjmiller.com/wymiller/nur.git"
       },
@@ -507,11 +507,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1789333536,
-        "narHash": "sha256-C9GsjXostGh50d62SYEXVJOSDTwk7RjAumJmwzkJKEY=",
+        "lastModified": 1792175215,
+        "narHash": "sha256-XD64JVLV8iE4lR+W5gkTweEaT+SBwOrSy0+le2WgITI=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "2d6b480abfa9fcf84841e62c27922bfa3f3d0d2b",
+        "rev": "a736b60b1e2019931168979951c94dc46e342957",
         "type": "github"
       },
       "original": {
@@ -563,11 +563,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788678114,
-        "narHash": "sha256-pcqbpV4ZI79al6KAlr+WJjaEo/PYfgctRlG43D5BSJM=",
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "4748ec2f5ed4a881474ed4c98aa71a5308cdac8d",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -585,11 +585,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1788678114,
-        "narHash": "sha256-pcqbpV4ZI79al6KAlr+WJjaEo/PYfgctRlG43D5BSJM=",
+        "lastModified": 1791620365,
+        "narHash": "sha256-CVZXIDNw7HEwyD8X6q9Ln370Sc0ZqRlTzDRwOZ1hJMY=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "4748ec2f5ed4a881474ed4c98aa71a5308cdac8d",
+        "rev": "e90fafa71b440fabcd52dd7fb017ab2da81c781a",
         "type": "github"
       },
       "original": {
@@ -606,11 +606,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1789196581,
-        "narHash": "sha256-yJr1Bt4fKkKIpPYbsKGqJ0VFdoDnURgRwuffmBQ2WzY=",
+        "lastModified": 1792219666,
+        "narHash": "sha256-RMO08tKD+hFIL5ryWi85VY4aHE5oIpdV1h4kVFctOkw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "228ecefb6329d5a531b77b46b581a2f0c26ee056",
+        "rev": "a110337465cfb76e3806b81b9db3094c3e6e770a",
         "type": "github"
       },
       "original": {
@@ -624,11 +624,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1789372034,
-        "narHash": "sha256-mu6atvdBHYpDsFhJkPtSsS6auSWAnWONVJMCvpL0900=",
+        "lastModified": 1792307278,
+        "narHash": "sha256-wJgFFtw/vlzsjWrQFmTn40TTkSkqHM4XXN0nh4q4uMk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "a5f41d15ba0e9442542c5324fbccd7a87105a90d",
+        "rev": "42076d1c6a0fb405ed04f9a674e4a8f69de62ba3",
         "type": "github"
       },
       "original": {

flake.nix

@@ -50,6 +50,10 @@
     };
   in {
     meta = import ./meta;
+    formatter = nixpkgs.lib.genAttrs [
+      "x86_64-linux"
+      "aarch64-darwin"
+    ] (system: nixpkgs.legacyPackages.${system}.nixfmt);
 
     common = {
       overlays = import ./modules/common/overlays.nix;
@@ -219,7 +223,7 @@
     nixosConfigurations."yshtola" = nixpkgs.lib.nixosSystem {
       system = "x86_64-linux";
       specialArgs = {
-        inherit userName userEmail;
+        inherit userName userEmail nur;
         hostname = "yshtola";
         role = "server";
       };

home/neovim.nix

@@ -27,6 +27,7 @@
             enable = true;
             lsp.servers = [ "typescript-language-server" "deno" ];
           };
+          csharp.enable = true;
         };
 
         utility.surround.enable = true;

home/shell.nix

@@ -66,8 +66,14 @@
             "The gods themselves will be my meal. Your dear companions my dessert. Upon this world I'll feast, and death shall follow in my wake. All your hate, all your rage, you will render unto me." \
             "Boring, boring, boring" \
             "Would you be 'happier' had I a 'good reason'?" \
-            "A test of your reflexes!"
-
+            "A test of your reflexes!" \ 
+            "Yer a wizard, Wyatt" \
+            "Yer a lizard, Wyatt" \ 
+            "Po-Tay-To boil em mash em stick em in a stew" \ 
+            "Oh look it's the cutie patootie potato!" 
+            "What a charming young man" \ 
+            "Wyatt, you are smart, kind, and resilient. I believe in you no matter what life throws at you! Kick this project's butt!! - Nico" \
+            "Ganbatte!"
 
           set choose_meme (random)"%"(count $memes)
           set choose_meme $memes[(math $choose_meme"+1")]

modules/machine/cloud/configuration.nix

@@ -151,7 +151,10 @@ in {
 
   # Core networking module (see ../../networking/core.nix)
   network = {
-    firewall.enable = true;
+    firewall = {
+      enable = true;
+      firewalld.enable = true;
+    };
     networkManager.enable = true;
   };
 

modules/machine/yshtola/configuration.nix

@@ -1,8 +1,10 @@
 {
+  nur,
   pkgs,
   userName,
   ...
-}: let
+}:
+let
   # INFO: set these to your liking
   matrixFqdn = "chat.wyattjmiller.com";
   rtcFqdn = "rtc.wyattjmiller.com";
@@ -10,13 +12,47 @@
   supportEmail = "wyatt@wyattjmiller.com";
   livekitKeyFile = "/var/lib/livekit/livekit.key";
   matrixRegistrationTokenFile = "/var/lib/matrix.key";
-in {
+
+  sableWeb = nur.packages.${pkgs.stdenv.hostPlatform.system}.sable-web;
+
+  sableConfig = pkgs.writeTextDir "config.json" (
+    builtins.toJSON {
+      defaultHomeserver = 0;
+      homeserverList = [ matrixFqdn ];
+      allowCustomHomeservers = false;
+
+      disableAccountSwitcher = false;
+      hideUsernamePasswordFields = false;
+
+      hashRouter = {
+        enabled = false;
+        basename = "/";
+      };
+
+      featuredCommunities = {
+        spaces = [
+          "#seventhdawn:chat.wyattjmiller.com"
+        ];
+        rooms = [
+          "#general:chat.wyattjmiller.com"
+          "#gposeglams:chat.wyattjmiller.com"
+          "#lobby-vc:chat.wyattjmiller.com"
+          "#annoucements:chat.wyattjmiller.com"
+        ];
+      };
+    }
+  );
+in
+{
   imports = [
     ../../pwrMgmt
   ];
 
   # Enable flakes for NixOS
-  nix.settings.experimental-features = ["nix-command" "flakes"];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
 
   nix.settings = {
     download-buffer-size = 134217728; # 128 MiB in bytes
@@ -79,7 +115,7 @@ in {
       8448
     ];
 
-    allowedUDPPortRanges =[
+    allowedUDPPortRanges = [
       # TURN UDP relays
       {
         from = 49000;
@@ -99,7 +135,11 @@ in {
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO4WKvKnnYpTbzZHFEslOKyfiiMqWxhW3AfX6E7ACmYU wyatt@wyattjmiller.com"
     ];
-    extraGroups = ["wheel" "video" "network"];
+    extraGroups = [
+      "wheel"
+      "video"
+      "network"
+    ];
   };
 
   # fail2ban
@@ -145,10 +185,12 @@ in {
           support_email = supportEmail;
           support_mxid = "@wymiller:${matrixFqdn}";
 
-          rtc_transports = [{
+          rtc_transports = [
+            {
               type = "livekit";
               livekit_service_url = "https://${rtcFqdn}";
-          }];
+            }
+          ];
         };
       };
     };
@@ -176,8 +218,37 @@ in {
     virtualHosts = {
       "${matrixFqdn}" = {
         extraConfig = ''
+          @matrixEndpoints path \
+            /_matrix/* \
+            /_tuwunel/* \
+            /.well-known/matrix/*
+
+          handle @matrixEndpoints {
+            reverse_proxy 127.0.0.1:8008
+          }
+
+          @sableConfig path /config.json
+          handle @sableConfig {
+            root * ${sableConfig}
+            header Cache-Control "no-store"
+            file_server
+          }
+
+          handle {
+            root * ${sableWeb}
+
             encode zstd gzip
-          reverse_proxy localhost:8008
+            try_files {path} /index.html
+
+            file_server {
+              precompressed br
+            }
+
+            header /assets/* Cache-Control "public, max-age=31536000, immutable"
+            header /sw.js Cache-Control "no-cache"
+            header /index.html Cache-Control "no-cache"
+            header Document-Policy "js-profiling"
+          }
         '';
       };
       "${matrixFqdn}:8448" = {
@@ -220,7 +291,10 @@ in {
     matrix-registration-token-gen = {
       before = [ "tuwunel.service" ];
       wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ coreutils openssl ];
+      path = with pkgs; [
+        coreutils
+        openssl
+      ];
       script = ''
         set -eu
 
@@ -242,9 +316,15 @@ in {
     };
 
     livekit-key-gen = {
-      before = [ "lk-jwt-service.service" "livekit.service" ];
+      before = [
+        "lk-jwt-service.service"
+        "livekit.service"
+      ];
       wantedBy = [ "multi-user.target" ];
-      path = with pkgs; [ coreutils openssl ];
+      path = with pkgs; [
+        coreutils
+        openssl
+      ];
       script = ''
         set -eu
 

modules/networking/core.nix

@@ -8,6 +8,12 @@ in {
   options.network = {
     firewall = {
       enable = lib.mkEnableOption "system firewall";
+      firewalld.enable = lib.mkEnableOption "firewalld with its nftables backend";
+      nftables.extraConfig = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        description = "Rules inside a separate inet nftables table alongside firewalld";
+      };
       tcpPorts = {
         ssh.enable = lib.mkEnableOption "SSH service port (22)";
         web.enable = lib.mkEnableOption "common web service ports (80, 443)";
@@ -42,6 +48,21 @@ in {
     };
   };
   config = {
+    assertions = [
+      {
+        assertion = cfg.firewall.nftables.extraConfig == "" || cfg.firewall.firewalld.enable;
+        message = "network.firewall.nftables.extraConfig requires network.firewall.firewalld.enable";
+      }
+    ];
+    services.firewalld.enable = cfg.firewall.firewalld.enable;
+    networking.nftables = lib.mkIf cfg.firewall.firewalld.enable {
+      enable = true;
+      flushRuleset = false;
+      tables."local-extra" = lib.mkIf (cfg.firewall.nftables.extraConfig != "") {
+        family = "inet";
+        content = cfg.firewall.nftables.extraConfig;
+      };
+    };
     networking.firewall = {
       enable = cfg.firewall.enable;
       allowedTCPPorts = lib.flatten [