11 Commits

6 changed files with 45 additions and 140 deletions

30
flake.lock generated
View File

@@ -9,11 +9,11 @@
"rust-overlay": "rust-overlay" "rust-overlay": "rust-overlay"
}, },
"locked": { "locked": {
"lastModified": 1771170334, "lastModified": 1774186997,
"narHash": "sha256-tCgoCWORfNHaRXTh2QS44LwxlV8q28jVvjN5ioMicv8=", "narHash": "sha256-hyNVlhAqmwcBPl7XRkxbGcMt1BfCOdvuEfBDUf0k8Oo=",
"owner": "ezKEa", "owner": "ezKEa",
"repo": "aagl-gtk-on-nix", "repo": "aagl-gtk-on-nix",
"rev": "821b4f92c2c0981ea5b571b03403df87d2b2e2ae", "rev": "546e95f7ec74892a31f883a10b1723c35f2c2edd",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -29,11 +29,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1767634391, "lastModified": 1772129556,
"narHash": "sha256-owcSz2ICqTSvhBbhPP+1eWzi88e54rRZtfCNE5E/wwg=", "narHash": "sha256-Utk0zd8STPsUJPyjabhzPc5BpPodLTXrwkpXBHYnpeg=",
"owner": "lnl7", "owner": "lnl7",
"repo": "nix-darwin", "repo": "nix-darwin",
"rev": "08585aacc3d6d6c280a02da195fdbd4b9cf083c2", "rev": "ebec37af18215214173c98cf6356d0aca24a2585",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -94,11 +94,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1770260404, "lastModified": 1774274588,
"narHash": "sha256-3iVX1+7YUIt23hBx1WZsUllhbmP2EnXrV8tCRbLxHc8=", "narHash": "sha256-dnHvv5EMUgTzGZmA+3diYjQU2O6BEpGLEOgJ1Qe9LaY=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "0d782ee42c86b196acff08acfbf41bb7d13eed5b", "rev": "cf9686ba26f5ef788226843bc31fda4cf72e373b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -142,11 +142,11 @@
}, },
"nixpkgs_2": { "nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1771043024, "lastModified": 1774244481,
"narHash": "sha256-O1XDr7EWbRp+kHrNNgLWgIrB0/US5wvw9K6RERWAj6I=", "narHash": "sha256-4XfMXU0DjN83o6HWZoKG9PegCvKvIhNUnRUI19vzTcQ=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "3aadb7ca9eac2891d52a9dec199d9580a6e2bf44", "rev": "4590696c8693fea477850fe379a01544293ca4e2",
"type": "github" "type": "github"
}, },
"original": { "original": {
@@ -235,11 +235,11 @@
"nixpkgs": "nixpkgs_3" "nixpkgs": "nixpkgs_3"
}, },
"locked": { "locked": {
"lastModified": 1771211437, "lastModified": 1774321696,
"narHash": "sha256-lcNK438i4DGtyA+bPXXyVLHVmJjYpVKmpux9WASa3ro=", "narHash": "sha256-g18xMjMNla/nsF5XyQCNyWmtb2UlZpkY0XE8KinIXAA=",
"owner": "oxalica", "owner": "oxalica",
"repo": "rust-overlay", "repo": "rust-overlay",
"rev": "c62195b3d6e1bb11e0c2fb2a494117d3b55d410f", "rev": "49a67e6894d4cb782842ee6faa466aa90c92812d",
"type": "github" "type": "github"
}, },
"original": { "original": {

View File

@@ -31,6 +31,7 @@
a = "add"; a = "add";
ap = "add -p"; ap = "add -p";
br = "branch"; br = "branch";
cb = "checkout -b";
co = "checkout"; co = "checkout";
st = "status -sb"; st = "status -sb";
status = "status -sb"; status = "status -sb";
@@ -40,6 +41,11 @@
ca = "commit -am"; ca = "commit -am";
dc = "diff --cached"; dc = "diff --cached";
amend = "commit --amend -m"; amend = "commit --amend -m";
wipe = "reset --hard";
gg = "reset --hard";
ggs = "reset --hard";
sw = "switch";
r = "restore";
# aliases for submodules # aliases for submodules
update = "submodule update --init --recursive"; update = "submodule update --init --recursive";

View File

@@ -1,4 +1,15 @@
{ lib, pkgs, isNixOS ? true, ... }: { lib, pkgs, isNixOS ? true, ... }:
lib.mkIf pkgs.stdenv.isLinux { lib.mkIf pkgs.stdenv.isLinux {
home.packages = with pkgs; [
imv
xdg-utils
] ++ lib.optionals isNixOS [
vesktop
xfce.thunar
pavucontrol
zathura
gpu-screen-recorder
gpu-screen-recorder-gtk
inetutils
];
} }

View File

@@ -62,7 +62,13 @@
"If youve brought your ivory standard, Ill be happy to tell you where you can stick it" \ "If youve brought your ivory standard, Ill be happy to tell you where you can stick it" \
"Speeches? Oh, yes, I love them. There's nothing like a good exposition when you're having trouble sleeping!" \ "Speeches? Oh, yes, I love them. There's nothing like a good exposition when you're having trouble sleeping!" \
"Somehow, the boy just isn't very buoyant" \ "Somehow, the boy just isn't very buoyant" \
"I am...not interested, little sun. Try again when you have become a man" "I am...not interested, little sun. Try again when you have become a man" \
"I am rightousness! And rightousness shall previal!" \
"Ahhh such bliss!" \
"The gods themselves will be my meal. Your dear companions my dessert. Upon this world I'll feast, and death shall follow in my wake. All your hate, all your rage, you will render unto me." \
"Boring, boring, boring" \
"Would you be 'happier' had I a 'good reason'?" \
"A test of your reflexes!"
set choose_meme (random)"%"(count $memes) set choose_meme (random)"%"(count $memes)

View File

@@ -10,6 +10,10 @@ I like Final Fantasy, alright? Isn't everyone supposed to have a hobby?
These are named after Final Fantasy VII characters. These are named after Final Fantasy VII characters.
### Servers/Network Infrastructure ### Servers/Network Infrastructure (bare metal)
These are named after Final Fantasy summons. There is some infrastructure missing here like my routers and switches that I also name after summons. These are named after Final Fantasy summons. There is some infrastructure missing here like my routers and switches that I also name after summons.
### Servers/Network Infrastructure (virtual machines)
These are named after Final Fantasy XIV Online characters (currently, these are named after the Scions of the Seventh Dawn).

View File

@@ -1,6 +1,5 @@
{ {
pkgs, pkgs,
config,
userName, userName,
... ...
}: let }: let
@@ -11,14 +10,6 @@
supportEmail = "wyatt@wyattjmiller.com"; supportEmail = "wyatt@wyattjmiller.com";
livekitKeyFile = "/var/lib/livekit/livekit.key"; livekitKeyFile = "/var/lib/livekit/livekit.key";
matrixRegistrationTokenFile = "/var/lib/matrix.key"; matrixRegistrationTokenFile = "/var/lib/matrix.key";
mastodonFqdn = "social.wyattjmiller.com";
mastodonSecretsDir = "/var/lib/mastodon/secrets";
# After deploying Mastodon, register an OAuth application at
# https://social.wyattjmiller.com/settings/applications and write the
# client ID / secret to these paths (chmod 400, owned by the tuwunel user):
mastodonOauthClientIdFile = "/var/lib/tuwunel/mastodon-oauth-client-id";
mastodonOauthClientSecretFile = "/var/lib/tuwunel/mastodon-oauth-client-secret";
in { in {
imports = [ imports = [
../../pwrMgmt ../../pwrMgmt
@@ -103,8 +94,6 @@ in {
}; };
# Add username to groups "wheel" and "video" - more may be added here later # Add username to groups "wheel" and "video" - more may be added here later
users.users.caddy.extraGroups = [ "mastodon" ];
users.users.${userName} = { users.users.${userName} = {
openssh.authorizedKeys.keys = [ openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFV9eSc9L+aJLoKoexq2f/jb5rpyZnhuGiyhS8YQAbaS wyatt@wyattjmiller.com"
@@ -125,25 +114,6 @@ in {
}; };
}; };
# Mastodon service — social.wyattjmiller.com
services.mastodon = {
enable = true;
localDomain = mastodonFqdn;
configureNginx = false;
secretKeyBaseFile = "${mastodonSecretsDir}/secret_key_base";
otpSecretFile = "${mastodonSecretsDir}/otp_secret";
vapidPrivateKeyFile = "${mastodonSecretsDir}/vapid_private_key";
vapidPublicKeyFile = "${mastodonSecretsDir}/vapid_public_key";
# Configure SMTP after initial deploy via mastodonSecretsDir or a separate
# NixOS secrets manager (sops-nix / agenix).
smtp = {
host = "mail.wyattjmiller.com";
port = 25;
fromAddress = "notifications@${mastodonFqdn}";
authenticate = false;
};
};
# Matrix server # Matrix server
services.matrix-tuwunel = { services.matrix-tuwunel = {
enable = true; enable = true;
@@ -180,29 +150,6 @@ in {
livekit_service_url = "https://${rtcFqdn}"; livekit_service_url = "https://${rtcFqdn}";
}]; }];
}; };
# Mastodon as OIDC provider for Matrix login.
# Mastodon 4.3+ exposes OpenID Connect discovery at
# https://<domain>/.well-known/openid-configuration.
#
# REQUIRED RUNTIME SETUP (once, after first Mastodon deploy):
# 1. Visit https://social.wyattjmiller.com/settings/applications
# 2. Create a new application with the redirect URI:
# https://chat.wyattjmiller.com/_matrix/client/v3/login/sso/redirect/oidc-mastodon
# and scopes: read:accounts
# 3. Write the Application ID → /var/lib/tuwunel/mastodon-oauth-client-id (chmod 400, owned by tuwunel)
# Write the Client Secret → /var/lib/tuwunel/mastodon-oauth-client-secret
# 4. nixos-rebuild switch (or restart tuwunel.service)
identity_provider= [
{
brand = "Mastodon";
issuer_url = "https://${mastodonFqdn}";
id = "oidc-mastodon";
client_id = mastodonOauthClientIdFile;
client_secret = mastodonOauthClientSecretFile;
scope = ["openid" "read:accounts"];
}
];
}; };
}; };
}; };
@@ -227,32 +174,6 @@ in {
enable = true; enable = true;
package = pkgs.caddy; package = pkgs.caddy;
virtualHosts = { virtualHosts = {
"${mastodonFqdn}" = {
extraConfig = ''
encode zstd gzip
root * ${config.services.mastodon.package}/public
handle /system/* {
uri strip_prefix /system
root * /var/lib/mastodon/public-system
file_server
}
@streaming path /api/v1/streaming*
handle @streaming {
reverse_proxy localhost:4000
}
handle {
@notfile not file
handle @notfile {
reverse_proxy localhost:3000
}
file_server
}
'';
};
"${matrixFqdn}" = { "${matrixFqdn}" = {
extraConfig = '' extraConfig = ''
encode zstd gzip encode zstd gzip
@@ -344,49 +265,6 @@ in {
User = "root"; User = "root";
}; };
}; };
mastodon-secrets-gen = {
before = [ "mastodon-web.service" "mastodon-sidekiq-0.service" "mastodon-streaming.service" ];
wantedBy = [ "multi-user.target" ];
path = with pkgs; [ coreutils openssl ruby_3_4 ];
script = ''
set -eu
dir="${mastodonSecretsDir}"
install -d -m 0750 -o mastodon -g mastodon "$dir"
gen_hex() {
local f="$1"
if [ ! -f "$f" ]; then
umask 077
openssl rand -hex 64 | install -o mastodon -g mastodon -m 0400 /dev/stdin "$f"
fi
}
gen_hex "$dir/secret_key_base"
gen_hex "$dir/otp_secret"
if [ ! -f "$dir/vapid_private_key" ]; then
umask 077
ruby -ropenssl -rbase64 -e '
key = OpenSSL::PKey::EC.generate("prime256v1")
priv = Base64.urlsafe_encode64(key.private_key.to_s(2).rjust(32, "\x00"), padding: false)
pub = Base64.urlsafe_encode64(key.public_key.to_bn.to_s(2), padding: false)
File.write(ARGV[0], priv)
File.write(ARGV[1], pub)
' \
"$dir/vapid_private_key" \
"$dir/vapid_public_key"
chown mastodon:mastodon "$dir/vapid_private_key" "$dir/vapid_public_key"
chmod 0400 "$dir/vapid_private_key" "$dir/vapid_public_key"
fi
'';
serviceConfig = {
Type = "oneshot";
User = "root";
RemainAfterExit = true;
};
};
}; };
system.stateVersion = "25.11"; system.stateVersion = "25.11";