Compare commits
No commits in common. "master" and "modular" have entirely different histories.
@ -1,14 +1,6 @@
|
||||
-- This file simply bootstraps the installation of Lazy.nvim and then calls other files for execution
|
||||
-- This file doesn't necessarily need to be touched, BE CAUTIOUS editing this file and proceed at your own risk.
|
||||
local lazypath = vim.env.LAZY or vim.fn.stdpath "data" .. "/lazy/lazy.nvim"
|
||||
|
||||
vim.api.nvim_set_keymap("v", "<sc-c>", '"+y', { noremap = true })
|
||||
vim.api.nvim_set_keymap("n", "<sc-v>", 'l"+P', { noremap = true })
|
||||
vim.api.nvim_set_keymap("v", "<sc-v>", '"+P', { noremap = true })
|
||||
vim.api.nvim_set_keymap("c", "<sc-v>", '<C-o>l<C-o>"+<C-o>P<C-o>l', { noremap = true })
|
||||
vim.api.nvim_set_keymap("i", "<sc-v>", '<ESC>l"+Pli', { noremap = true })
|
||||
vim.api.nvim_set_keymap("t", "<sc-v>", '<C-\\><C-n>"+Pi', { noremap = true })
|
||||
|
||||
if not (vim.env.LAZY or (vim.uv or vim.loop).fs_stat(lazypath)) then
|
||||
-- stylua: ignore
|
||||
vim.fn.system({ "git", "clone", "--filter=blob:none", "https://github.com/folke/lazy.nvim.git", "--branch=stable", lazypath })
|
||||
|
||||
65
flake.lock
generated
65
flake.lock
generated
@ -2,33 +2,37 @@
|
||||
"nodes": {
|
||||
"darwin": {
|
||||
"inputs": {
|
||||
"nixpkgs": ["nixpkgs"]
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1743127615,
|
||||
"narHash": "sha256-+sMGqywrSr50BGMLMeY789mSrzjkoxZiu61eWjYS/8o=",
|
||||
"lastModified": 1733570843,
|
||||
"narHash": "sha256-sQJAxY1TYWD1UyibN/FnN97paTFuwBw3Vp3DNCyKsMk=",
|
||||
"owner": "lnl7",
|
||||
"repo": "nix-darwin",
|
||||
"rev": "fc843893cecc1838a59713ee3e50e9e7edc6207c",
|
||||
"rev": "a35b08d09efda83625bef267eb24347b446c80b8",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "lnl7",
|
||||
"ref": "nix-darwin-24.11",
|
||||
"ref": "master",
|
||||
"repo": "nix-darwin",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": ["nixpkgs"]
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1745557122,
|
||||
"narHash": "sha256-eqSo9ugzsqhFgaDFYUZj943nurlX4L6f+AW0skJ4W+M=",
|
||||
"lastModified": 1734366194,
|
||||
"narHash": "sha256-vykpJ1xsdkv0j8WOVXrRFHUAdp9NXHpxdnn1F4pYgSw=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "dd26f75fb4ec1c731d4b1396eaf4439ce40a91c1",
|
||||
"rev": "80b0fdf483c5d1cb75aaad909bd390d48673857f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -54,13 +58,47 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nix-ld": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1734338723,
|
||||
"narHash": "sha256-BpJs2QnVwdE4Btsx2BcBmdsq86H7QJYv2GmoOkr1ii4=",
|
||||
"owner": "Mic92",
|
||||
"repo": "nix-ld",
|
||||
"rev": "911665df070e3d6c970e5a248fc4a38550bd5689",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Mic92",
|
||||
"repo": "nix-ld",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1745487689,
|
||||
"narHash": "sha256-FQoi3R0NjQeBAsEOo49b5tbDPcJSMWc3QhhaIi9eddw=",
|
||||
"lastModified": 1733015953,
|
||||
"narHash": "sha256-t4BBVpwG9B4hLgc6GUBuj3cjU7lP/PJfpTHuSqE+crk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "ac35b104800bff9028425fec3b6e8a41de2bbfff",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1734737257,
|
||||
"narHash": "sha256-GIMyMt1pkkoXdCq9un859bX6YQZ/iYtukb9R5luazLM=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "5630cf13cceac06cefe9fc607e8dfa8fb342dde3",
|
||||
"rev": "1c6e20d41d6a9c1d737945962160e8571df55daa",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@ -75,7 +113,8 @@
|
||||
"darwin": "darwin",
|
||||
"home-manager": "home-manager",
|
||||
"nix-flatpak": "nix-flatpak",
|
||||
"nixpkgs": "nixpkgs"
|
||||
"nix-ld": "nix-ld",
|
||||
"nixpkgs": "nixpkgs_2"
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
34
flake.nix
34
flake.nix
@ -3,12 +3,13 @@
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
|
||||
nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=v0.4.1";
|
||||
nix-ld.url = "github:Mic92/nix-ld";
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager/release-24.11";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
darwin = {
|
||||
url = "github:lnl7/nix-darwin/nix-darwin-24.11";
|
||||
url = "github:lnl7/nix-darwin/master";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
};
|
||||
@ -17,6 +18,7 @@
|
||||
self,
|
||||
nixpkgs,
|
||||
nix-flatpak,
|
||||
nix-ld,
|
||||
darwin,
|
||||
home-manager,
|
||||
...
|
||||
@ -57,6 +59,7 @@
|
||||
};
|
||||
modules = [
|
||||
nix-flatpak.nixosModules.nix-flatpak
|
||||
nix-ld.nixosModules.nix-ld
|
||||
./modules/common
|
||||
./modules/machine/cloud
|
||||
|
||||
@ -79,20 +82,21 @@
|
||||
inherit userName userEmail;
|
||||
hostname = "valefor";
|
||||
};
|
||||
modules = [
|
||||
./modules/common
|
||||
./modules/machine/valefor
|
||||
|
||||
home-manager.nixosModules.home-manager
|
||||
{
|
||||
home-manager.useGlobalPkgs = true;
|
||||
home-manager.useUserPackages = true;
|
||||
home-manager.extraSpecialArgs = extraSpecialArgs;
|
||||
home-manager.users.${userName}.imports = [
|
||||
./home
|
||||
];
|
||||
}
|
||||
];
|
||||
# modules = [
|
||||
# nix-ld.nixosModules.nix-ld
|
||||
# ./modules/nix-core.nix
|
||||
# ./modules/host-users.nix
|
||||
#
|
||||
# home-manager.nixosModules.home-manager
|
||||
# {
|
||||
# home-manager.useGlobalPkgs = true;
|
||||
# home-manager.useUserPackages = true;
|
||||
# home-manager.extraSpecialArgs = extraSpecialArgs;
|
||||
# home-manager.users.${userName}.imports = [
|
||||
# ./home
|
||||
# ];
|
||||
# }
|
||||
# ];
|
||||
};
|
||||
|
||||
# Storage, status, game, and media server
|
||||
|
||||
@ -1,52 +1,5 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
programs.firefox = {
|
||||
# please see Mozilla's TOU and privacy policy please i implore you
|
||||
enable = false;
|
||||
};
|
||||
|
||||
programs.chromium = {
|
||||
enable = pkgs.stdenv.isLinux;
|
||||
package = pkgs.ungoogled-chromium.override {
|
||||
enableWideVine = true;
|
||||
commandLineArgs = [
|
||||
"--enable-features=AcceleratedVideoEncoder,Vulkan,VulkanFromANGLE,DefaultANGLEVulkan"
|
||||
"--ignore-gpu-blocklist"
|
||||
"--force-dark-mode"
|
||||
"--enable-zero-copy"
|
||||
];
|
||||
};
|
||||
extensions = let
|
||||
createChromiumExtensionFor = browserVersion: {
|
||||
id,
|
||||
sha256,
|
||||
version,
|
||||
}: {
|
||||
inherit id;
|
||||
crxPath = builtins.fetchurl {
|
||||
url = "https://clients2.google.com/service/update2/crx?response=redirect&acceptformat=crx2,crx3&prodversion=${browserVersion}&x=id%3D${id}%26installsource%3Dondemand%26uc";
|
||||
name = "${id}.crx";
|
||||
inherit sha256;
|
||||
};
|
||||
inherit version;
|
||||
};
|
||||
createChromiumExtension = createChromiumExtensionFor (lib.versions.major pkgs.ungoogled-chromium.version);
|
||||
in [
|
||||
(createChromiumExtension {
|
||||
# ublock origin
|
||||
id = "cjpalhdlnbpafiamejdnhcphjbkeiagm";
|
||||
sha256 = "sha256:0ycnkna72n969crgxfy2lc1qbndjqrj46b9gr5l9b7pgfxi5q0ll";
|
||||
version = "1.63.2";
|
||||
})
|
||||
(createChromiumExtension {
|
||||
# bitwarden
|
||||
id = "nngceckbapebfimnlniiiahkandclblb";
|
||||
sha256 = "sha256:0jxk3cqmgd5qj8hnw7s0k5s4bfrcmr0w0rckp3x0bmng07azw4gi";
|
||||
version = "2025.3.1";
|
||||
})
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@ -23,7 +23,6 @@ in {
|
||||
./direnv.nix
|
||||
./sway.nix
|
||||
./terminal.nix
|
||||
./browser.nix
|
||||
];
|
||||
|
||||
# Home Manager needs a bit of information about you and the
|
||||
@ -42,7 +41,6 @@ in {
|
||||
XDG_CACHE_HOME = "$HOME/.cache";
|
||||
XDG_DATA_HOME = "$HOME/.local/share";
|
||||
XDG_STATE_HOME = "$HOME/.local/state";
|
||||
NIXOS_OZONE_WL = "1";
|
||||
};
|
||||
|
||||
pointerCursor = lib.mkIf pkgs.stdenv.isLinux {
|
||||
|
||||
11
home/git.nix
11
home/git.nix
@ -3,6 +3,10 @@
|
||||
userEmail,
|
||||
...
|
||||
}: {
|
||||
# `programs.git` will generate the config file: ~/.config/git/config
|
||||
# to make git use this config file, `~/.gitconfig` should not exist!
|
||||
#
|
||||
# https://git-scm.com/docs/git-config#Documentation/git-config.txt---global
|
||||
home.activation.removeExistingGitconfig = lib.hm.dag.entryBefore ["checkLinkTargets"] ''
|
||||
rm -f ~/.gitconfig
|
||||
'';
|
||||
@ -15,8 +19,7 @@
|
||||
extraConfig = {
|
||||
init.defaultBranch = "master";
|
||||
push.autoSetupRemote = true;
|
||||
pull.merge = true;
|
||||
merge.tool = "nvimdiff";
|
||||
pull.rebase = true;
|
||||
};
|
||||
|
||||
ignores = [
|
||||
@ -27,8 +30,6 @@
|
||||
|
||||
aliases = {
|
||||
# common aliases
|
||||
a = "add";
|
||||
ap = "add -p";
|
||||
br = "branch";
|
||||
co = "checkout";
|
||||
st = "status -sb";
|
||||
@ -40,7 +41,7 @@
|
||||
dc = "diff --cached";
|
||||
amend = "commit --amend -m";
|
||||
|
||||
# aliases for submodules
|
||||
# aliases for submodule
|
||||
update = "submodule update --init --recursive";
|
||||
foreach = "submodule foreach";
|
||||
};
|
||||
|
||||
@ -45,8 +45,6 @@
|
||||
nodejs
|
||||
cargo
|
||||
python3
|
||||
jetbrains.rust-rover
|
||||
jetbrains.rider
|
||||
|
||||
# nix specific stuff
|
||||
nixd
|
||||
|
||||
@ -11,6 +11,5 @@
|
||||
mcrcon
|
||||
xfce.thunar
|
||||
pavucontrol
|
||||
# ungoogled-chromium
|
||||
]);
|
||||
}
|
||||
|
||||
@ -1,11 +0,0 @@
|
||||
{...}: {
|
||||
"wymiller" = {
|
||||
email = "wyatt@wyattjmiller.com";
|
||||
name = "Wyatt J. Miller";
|
||||
homepage = "https://wyattjmiller.com";
|
||||
license = {
|
||||
spdxID = "MPL-2.0";
|
||||
fullName = "Mozilla Public License 2.0";
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -5,10 +5,6 @@
|
||||
hostname,
|
||||
...
|
||||
} @ args: {
|
||||
imports = [
|
||||
../security/sudo.nix
|
||||
];
|
||||
|
||||
networking.hostName = hostname;
|
||||
|
||||
# Don't forget to set a password with ‘passwd’!
|
||||
@ -27,8 +23,6 @@
|
||||
})
|
||||
];
|
||||
|
||||
security.sudo.needsPassword = false;
|
||||
|
||||
users.groups.wyatt = {};
|
||||
|
||||
nix.settings.trusted-users = [userName];
|
||||
|
||||
@ -63,6 +63,8 @@ in {
|
||||
(mkIf (cfg.gpuVendor == "amd") {
|
||||
services.xserver.videoDrivers = ["amdgpu"];
|
||||
hardware.opengl.extraPackages = with pkgs; [
|
||||
rocm-opencl-icd
|
||||
rocm-opencl-runtime
|
||||
amdvlk
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
|
||||
@ -23,7 +23,6 @@ in {
|
||||
../../apps/gaming.nix
|
||||
../../graphics
|
||||
../../pwrMgmt
|
||||
../../networking/core.nix
|
||||
../../sound/pipewire.nix
|
||||
../../sound/shairport.nix
|
||||
../../virtualization/podman.nix
|
||||
@ -59,7 +58,6 @@ in {
|
||||
wttrbar
|
||||
cliphist
|
||||
patchelf
|
||||
nix-ld
|
||||
];
|
||||
|
||||
# Set the EDITOR global environment variable to neovim
|
||||
@ -86,7 +84,7 @@ in {
|
||||
# Graphics module (../../graphics/default.nix)
|
||||
graphics = {
|
||||
enable = true;
|
||||
gpuVendor = "amd"; # or "amd" or "intel"
|
||||
gpuVendor = "nvidia"; # or "amd" or "intel"
|
||||
wayland.enable = true;
|
||||
vulkan.enable = true;
|
||||
};
|
||||
@ -142,9 +140,9 @@ in {
|
||||
};
|
||||
|
||||
# Core networking module (see ../../networking/core.nix)
|
||||
network = {
|
||||
networking = {
|
||||
firewall.enable = true;
|
||||
networkManager.enable = true;
|
||||
networkmanager.enable = true;
|
||||
};
|
||||
|
||||
# Enable dconf
|
||||
|
||||
@ -8,11 +8,17 @@
|
||||
|
||||
homebrew = {
|
||||
enable = true;
|
||||
|
||||
onActivation = {
|
||||
autoUpdate = false;
|
||||
# 'zap': uninstalls all formulae(and related files) not listed here.
|
||||
cleanup = "zap";
|
||||
};
|
||||
|
||||
# Applications to install from Mac App Store using mas.
|
||||
# You need to install all these Apps manually first so that your apple account have records for them.
|
||||
# otherwise Apple Store will refuse to install them.
|
||||
# For details, see https://github.com/mas-cli/mas
|
||||
masApps = {
|
||||
Xcode = 497799835;
|
||||
"Reeder 5." = 1529448980;
|
||||
@ -22,24 +28,14 @@
|
||||
};
|
||||
|
||||
taps = [
|
||||
"iina/homebrew-mpv-iina"
|
||||
];
|
||||
|
||||
brews = [
|
||||
];
|
||||
|
||||
casks = [
|
||||
"ghostty"
|
||||
"raycast"
|
||||
"jordanbaird-ice"
|
||||
"iina"
|
||||
"linearmouse"
|
||||
"sanesidebuttons"
|
||||
"betterdisplay"
|
||||
"maccy"
|
||||
"swift-quit"
|
||||
"medis"
|
||||
# "alt-tab"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@ -167,7 +167,7 @@
|
||||
|
||||
system.stateVersion = 5;
|
||||
|
||||
podman = {
|
||||
containers.podman = {
|
||||
enable = true;
|
||||
extraPackages = with pkgs; [
|
||||
docker-credential-helpers
|
||||
|
||||
@ -1,103 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
userName,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
../../graphics
|
||||
../../pwrMgmt
|
||||
../../networking/core.nix
|
||||
../../networking/dns.nix
|
||||
../../virtualization/podman.nix
|
||||
];
|
||||
|
||||
# Enable flakes for NixOS
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
|
||||
# Custom kernel/boot stuff
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# Enable Bluetooth if present
|
||||
hardware.bluetooth.enable = true;
|
||||
|
||||
# Set your timezone
|
||||
time.timeZone = "America/Detroit";
|
||||
|
||||
# Install packages to be installed system-wide
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
neovim
|
||||
git
|
||||
patchelf
|
||||
nix-ld
|
||||
];
|
||||
|
||||
# Set the EDITOR global environment variable to neovim
|
||||
environment.variables.EDITOR = "nvim";
|
||||
|
||||
# Enable OpenSSH
|
||||
services.openssh.enable = true;
|
||||
|
||||
# Enable keyring
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
|
||||
# Enable GnuPG
|
||||
programs.gnupg.agent = {
|
||||
enable = true;
|
||||
enableSSHSupport = true;
|
||||
};
|
||||
|
||||
# Enable SUID wrappers (some programs need them)
|
||||
programs.mtr.enable = true;
|
||||
|
||||
# Enable Polkit
|
||||
security.polkit.enable = true;
|
||||
|
||||
# Graphics module (../../graphics/default.nix)
|
||||
graphics = {
|
||||
enable = true;
|
||||
gpuVendor = "intel";
|
||||
wayland.enable = true;
|
||||
vulkan.enable = true;
|
||||
};
|
||||
|
||||
# Power management (see ../../pwrMgmt/default.nix)
|
||||
pwrMgmt = {
|
||||
enable = true;
|
||||
cpuFreqGovernor = "performance";
|
||||
powertop.enable = false;
|
||||
};
|
||||
|
||||
# Podman module (see ../../virtualization/podman.nix)
|
||||
podman = {
|
||||
enable = true;
|
||||
extraPackages = with pkgs; [
|
||||
docker-credential-helpers
|
||||
toolbox
|
||||
cosign
|
||||
crane
|
||||
podman-tui
|
||||
podman-desktop
|
||||
];
|
||||
};
|
||||
|
||||
# Core networking module (see ../../networking/core.nix)
|
||||
network = {
|
||||
firewall.enable = true;
|
||||
networkManager.enable = true;
|
||||
};
|
||||
|
||||
# DNS module (see ../../networking/dns.nix)
|
||||
dns = {
|
||||
technitium.enable = true;
|
||||
};
|
||||
|
||||
# Add username to groups "wheel" and "video" - more may be added here later
|
||||
users.users.${userName}.extraGroups = ["wheel" "podman" "network"];
|
||||
|
||||
system.stateVersion = "24.11";
|
||||
}
|
||||
@ -1,6 +0,0 @@
|
||||
{...}: {
|
||||
imports = [
|
||||
./configuration.nix
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
}
|
||||
@ -1,39 +0,0 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/ff89bde1-4b33-4277-b649-b92700b2406c";
|
||||
fsType = "xfs";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/3A4B-6866";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0022" "dmask=0022" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
@ -3,28 +3,90 @@
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
cfg = config.network;
|
||||
cfg = config.networking;
|
||||
in {
|
||||
options.network = {
|
||||
options.networking = {
|
||||
# Firewall Configuration
|
||||
firewall = {
|
||||
enable = lib.mkEnableOption "system firewall";
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "Enable system firewall";
|
||||
};
|
||||
|
||||
tcpPorts = {
|
||||
ssh.enable = lib.mkEnableOption "SSH service port (22)";
|
||||
web.enable = lib.mkEnableOption "common web service ports (80, 443)";
|
||||
smtp.enable = lib.mkEnableOption "SMTP service ports (25, 465, 587)";
|
||||
imap.enable = lib.mkEnableOption "IMAP service ports (143, 993)";
|
||||
mysql.enable = lib.mkEnableOption "MySQL service port (3306)";
|
||||
mssql.enable = lib.mkEnableOption "Microsoft SQL Server service port (1433)";
|
||||
postgres.enable = lib.mkEnableOption "Postgres service port (5432)";
|
||||
# Predefined, default common service ports
|
||||
ssh = {
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open SSH service port (22)";
|
||||
};
|
||||
};
|
||||
web = {
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open common web service ports (80, 443)";
|
||||
};
|
||||
};
|
||||
smtp = {
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open SMTP service ports (25, 465, 587)";
|
||||
};
|
||||
};
|
||||
imap = {
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open IMAP service ports (143, 993)";
|
||||
};
|
||||
};
|
||||
mysql = {
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open MySQL service port (3306)";
|
||||
};
|
||||
};
|
||||
mssql = {
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open Microsoft SQL Server service port (1433)";
|
||||
};
|
||||
};
|
||||
postgres = {
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open Postgres service port (5432)";
|
||||
};
|
||||
};
|
||||
allowedPorts = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.port;
|
||||
default = [];
|
||||
description = "List of custom TCP ports to open";
|
||||
};
|
||||
};
|
||||
|
||||
udpPorts = {
|
||||
dns.enable = lib.mkEnableOption "DNS service port (53)";
|
||||
ntp.enable = lib.mkEnableOption "NTP service port (123)";
|
||||
dns = {
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open DNS service port (53)";
|
||||
};
|
||||
};
|
||||
ntp = {
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Open NTP service port (123)";
|
||||
};
|
||||
};
|
||||
allowedPorts = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.port;
|
||||
default = [];
|
||||
@ -32,8 +94,14 @@ in {
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networkManager = {
|
||||
enable = lib.mkEnableOption "NetworkManager for network connection management";
|
||||
enable = lib.mkEnableOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = "Enable NetworkManager for network connection management";
|
||||
};
|
||||
|
||||
extraPlugins = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.package;
|
||||
default = [];
|
||||
@ -41,27 +109,35 @@ in {
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking.firewall = {
|
||||
enable = cfg.firewall.enable;
|
||||
allowedTCPPorts = lib.flatten [
|
||||
(lib.optionals cfg.firewall.tcpPorts.ssh.enable [22])
|
||||
(lib.optionals cfg.firewall.tcpPorts.web.enable [80 443])
|
||||
(lib.optionals cfg.firewall.tcpPorts.smtp.enable [25 465 587])
|
||||
(lib.optionals cfg.firewall.tcpPorts.imap.enable [143 993])
|
||||
(lib.optionals cfg.firewall.tcpPorts.mysql.enable [3306])
|
||||
(lib.optionals cfg.firewall.tcpPorts.mssql.enable [1433])
|
||||
(lib.optionals cfg.firewall.tcpPorts.postgres.enable [5432])
|
||||
cfg.firewall.tcpPorts.allowedPorts
|
||||
];
|
||||
allowedUDPPorts = lib.flatten [
|
||||
(lib.optionals cfg.firewall.udpPorts.dns.enable [53])
|
||||
(lib.optionals cfg.firewall.udpPorts.ntp.enable [123])
|
||||
cfg.firewall.udpPorts.allowedPorts
|
||||
];
|
||||
|
||||
allowedTCPPorts =
|
||||
(
|
||||
lib.optionals
|
||||
cfg.firewall.tcpPorts.ssh.enable [22]
|
||||
cfg.firewall.tcpPorts.web.enable [80 443]
|
||||
cfg.firewall.tcpPorts.smtp.enable [25 465 587]
|
||||
cfg.firewall.tcpPorts.imap.enable [143 993]
|
||||
cfg.firewall.tcpPorts.mysql.enable [3306]
|
||||
cfg.firewall.tcpPorts.mssql.enable [1433]
|
||||
cfg.firewall.tcpPorts.postgres.enable [5432]
|
||||
)
|
||||
++ cfg.firewall.tcpPorts.allowedPorts;
|
||||
|
||||
allowedUDPPorts =
|
||||
(
|
||||
lib.optionals
|
||||
cfg.firewall.udpPorts.dns.enable [53]
|
||||
cfg.firewall.udpPorts.ntp.enable [123]
|
||||
)
|
||||
++ cfg.firewall.udpPorts.allowedPorts;
|
||||
};
|
||||
|
||||
networking.networkmanager = {
|
||||
enable = lib.mkForce cfg.networkManager.enable;
|
||||
enable = cfg.networkManager.enable;
|
||||
packages = cfg.networkManager.extraPlugins;
|
||||
};
|
||||
};
|
||||
|
||||
@ -13,13 +13,7 @@ in {
|
||||
interfaces = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = ["127.0.0.1"];
|
||||
description = "Network interfaces BIND should listen on (IPv4)";
|
||||
};
|
||||
|
||||
interfaces6 = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = ["::1"];
|
||||
description = "Network interfaces BIND should listen on (IPv6)";
|
||||
description = "Network interfaces BIND should listen on";
|
||||
};
|
||||
|
||||
zones = lib.mkOption {
|
||||
@ -75,12 +69,18 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
# Validate that only one DNS server is enabled
|
||||
imports = [
|
||||
(lib.mkIf (cfg.bind.enable && cfg.technitium.enable) (throw "Only one DNS server can be enabled at a time"))
|
||||
];
|
||||
|
||||
# Implementation of the configuration
|
||||
config = lib.mkMerge [
|
||||
# BIND DNS Server Configuration
|
||||
(lib.mkIf cfg.bind.enable {
|
||||
services.bind = {
|
||||
services.named = {
|
||||
enable = true;
|
||||
listenOn = cfg.bind.settings.interfaces;
|
||||
listenOnIpv6 = cfg.bind.settings.interfaces6;
|
||||
interfaces = cfg.bind.settings.interfaces;
|
||||
zones =
|
||||
map (zone: {
|
||||
name = zone.name;
|
||||
@ -97,13 +97,37 @@ in {
|
||||
environment.systemPackages = [pkgs.bind];
|
||||
})
|
||||
|
||||
# Technitium DNS Server Configuration
|
||||
(lib.mkIf cfg.technitium.enable {
|
||||
services.technitium-dns-server = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
firewallTCPPorts = [53 5380 53443];
|
||||
firewallUDPPorts = [53];
|
||||
# Create a systemd service for Technitium
|
||||
systemd.services.technitium-dns = {
|
||||
description = "Technitium DNS Server";
|
||||
wantedBy = ["multi-user.target"];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.technitium}/bin/dns-server-start.sh";
|
||||
Restart = "on-failure";
|
||||
};
|
||||
|
||||
# Environment configuration
|
||||
environment =
|
||||
{
|
||||
DNS_LISTEN_ADDRESS = cfg.technitium.settings.address;
|
||||
DNS_LISTEN_PORT = toString cfg.technitium.settings.port;
|
||||
}
|
||||
// lib.mapAttrs' (
|
||||
name: value:
|
||||
lib.nameValuePair "DNS_${lib.toUpper name}" (toString value)
|
||||
)
|
||||
cfg.technitium.settings.extraOptions;
|
||||
};
|
||||
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [cfg.technitium.settings.port];
|
||||
allowedUDPPorts = [cfg.technitium.settings.port];
|
||||
};
|
||||
|
||||
environment.systemPackages = [pkgs.technitium];
|
||||
})
|
||||
];
|
||||
}
|
||||
|
||||
@ -14,7 +14,7 @@ Given that this configuration is in the `machine/<hostname>` directory (where ho
|
||||
# other configuration files here...
|
||||
];
|
||||
|
||||
pwrMgmt = {
|
||||
customPowerManagement = {
|
||||
enable = true;
|
||||
cpuFreqGovernor = "performance";
|
||||
powertop.enable = false;
|
||||
@ -29,7 +29,7 @@ Given that this configuration is in the `machine/<hostname>` directory (where ho
|
||||
# other configuration files here...
|
||||
];
|
||||
|
||||
pwrMgmt = {
|
||||
customPowerManagement = {
|
||||
enable = true;
|
||||
cpuFreqGovernor = "powersave";
|
||||
powertop = {
|
||||
|
||||
@ -1,3 +0,0 @@
|
||||
# Security modules
|
||||
|
||||
These are modules relating to security and security-related programs
|
||||
@ -1,25 +0,0 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; {
|
||||
options = {
|
||||
security.sudo = {
|
||||
needsPassword = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Whether users in the wheel group need to provide a password for sudo.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
environment.etc."sudoers.d/wheel-no-password" = mkIf (!config.security.sudo.needsPassword) {
|
||||
text = ''
|
||||
%wheel ALL=(ALL) NOPASSWD: ALL
|
||||
'';
|
||||
# mode = "0440";
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
x
Reference in New Issue
Block a user