nyanya

README.md

@@ -1,27 +1 @@
 This repository includes my NixOS and Home-manager configurations.
-
-The repo is organized as follows:
-```
-.
-├── flake.lock
-├── flake.nix
-├── hosts # NixOS-configurations
-│   ├── bengal # Host-specific
-│   │   ├── default.nix
-│   │   └── hardware-configuration.nix
-│   ├── common # General, imported by all hosts
-│   │   ├── default.nix
-│   │   ├── graphical.nix
-│   │   ├── security.nix
-│   │   ├── users.nix
-│   │   ├── virtualization.nix
-│   │   └── yubikey.nix
-├── misc # just some stuff 
-├── modules # Home-manager and NixOS modules that follow upstream standards, currently empty lol
-│   ├── home
-│   └── nixos
-└── users # Home-Manager configurations
-    ├── common # General, imported by all
-    ├── sammy.nix # User-specific, but not Host-specific
-    └── sammy@chansey.nix User- and Host-specific
-```

flake.nix

@@ -42,19 +42,12 @@
         };
 
         defaults = { lib, config, name, ... }: {
-          imports = [ ./hosts/${name} ./hosts/common (import "${home-manager}/nixos") ];
+          imports = [ ./hosts/${name} ./profiles/base ];
-
-          deployment = {
-            targetUser = "sammy";
-            allowLocalDeployment = true;
-          };
 
           home-manager.extraSpecialArgs = {
             inherit inputs outputs;
             pkgs-unstable = import nixpkgs-unstable { system = "x86_64-linux"; };
           };
-
-          cherrykitten.hostname = name;
         };
 
         bengal = { };
@@ -75,7 +68,7 @@
           mkHome = { user ? "sammy", hostname ? null }:
             lib.homeManagerConfiguration {
               inherit pkgs;
-              modules = [ ./users/${user}.nix ] ++ lib.optional (!isNull hostname) (./. + "/users/${user}@${hostname}.nix");
+              modules = [ ./users/${user} ] ++ lib.optional (!isNull hostname) (./. + "/users/${user}@${hostname}");
               extraSpecialArgs = {
                 inherit inputs outputs;
                 pkgs-unstable = import nixpkgs-unstable { system = "x86_64-linux"; };

hosts/bengal/default.nix

@@ -1,10 +1,9 @@
 { ... }: {
   imports = [
     ./hardware-configuration.nix
+    ../../profiles/desktop
   ];
 
-  cherrykitten.graphical = true;
-
   boot.loader.systemd-boot.enable = true;
 
   networking.hostName = "bengal";

hosts/common/default.nix

@@ -1,53 +0,0 @@
-{ lib, pkgs, ... }: {
-  options.cherrykitten = {
-    hostname = lib.mkOption {
-      type = lib.types.str;
-      default = "";
-      description = "the hostname, this is already set for every host by the flake config";
-    };
-    test = lib.mkOption {
-      type = lib.types.str;
-      default = "nya";
-      example = "nyanya";
-    };
-  };
-  imports = [
-    ./graphical.nix
-    ./security.nix
-    ./users.nix
-    ./yubikey.nix
-    ./virtualization.nix
-  ];
-
-  config = {
-    nix.settings.experimental-features = [ "nix-command" "flakes" ];
-
-    home-manager.useGlobalPkgs = true;
-    home-manager.useUserPackages = true;
-
-    time.timeZone = "Europe/Berlin";
-
-    i18n.defaultLocale = "en_US.UTF-8";
-    console = {
-      font = "Lat2-Terminus16";
-      keyMap = lib.mkForce "de";
-      useXkbConfig = true; # use xkb.options in tty.
-    };
-
-    fonts = {
-      enableDefaultPackages = true;
-      packages = with pkgs; [
-        noto-fonts-emoji
-      ];
-    };
-
-    # Packages used on all systems
-    environment.systemPackages = with pkgs; [
-      git
-      openssl
-      rsync
-      pinentry
-      wget
-    ];
-  };
-}

hosts/common/graphical.nix

@@ -1,21 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.cherrykitten.graphical;
-in
-{
-  options.cherrykitten.graphical = lib.mkEnableOption (lib.mdDoc "graphical stuffs");
-
-
-  config = lib.mkIf cfg {
-    services.xserver = {
-      enable = true;
-      displayManager.sddm.enable = true;
-      desktopManager.plasma5.enable = true;
-      desktopManager.plasma5.bigscreen.enable = true;
-      libinput.enable = true;
-
-      xkb.layout = "de";
-      xkb.options = "caps:escape";
-    };
-  };
-}

hosts/common/security.nix

@@ -1,49 +0,0 @@
-{ ... }: {
-  networking.firewall.allowedTCPPorts = [ 22 ];
-
-  services.openssh = {
-    enable = true;
-    extraConfig = ''
-      StreamLocalBindUnlink yes
-    '';
-    settings = {
-      PermitRootLogin = "no";
-      PasswordAuthentication = false;
-      Macs = [
-        "hmac-sha2-512"
-        "hmac-sha2-256"
-      ];
-      KexAlgorithms = [
-        "sntrup761x25519-sha512@openssh.com"
-        "curve25519-sha256"
-        "curve25519-sha256@libssh.org"
-        "diffie-hellman-group-exchange-sha256"
-      ];
-      Ciphers = [
-        "aes256-gcm@openssh.com"
-        "aes128-gcm@openssh.com"
-        "aes256-ctr"
-        "aes192-ctr"
-        "aes128-ctr"
-      ];
-    };
-  };
-
-  security = {
-    sudo = {
-      enable = true;
-      wheelNeedsPassword = false;
-      keepTerminfo = true;
-    };
-
-    acme = {
-      acceptTerms = true;
-      defaults.email = "admin@cherrykitten.dev";
-    };
-  };
-
-  services.fail2ban = {
-    enable = true;
-    maxretry = 5;
-  };
-}

hosts/common/users.nix

@@ -1,23 +0,0 @@
-{ pkgs, config, lib, ... }:
-let
-  cfg = config.cherrykitten.users;
-  hostname = config.cherrykitten.hostname;
-in
-{
-  options.cherrykitten.users = {
-    sammy.enable = lib.mkEnableOption "sammy" // { default = true; };
-  };
-
-  config = {
-    users.users.sammy = lib.mkIf cfg.sammy.enable {
-      isNormalUser = true;
-      extraGroups = [ "networkmanager" "wheel" "docker" ];
-      shell = pkgs.fish;
-      ignoreShellProgramCheck = true;
-      openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZyQSZw+pExsx2RXB+yxbaJGB9mtvudbQ/BP7E1yKvr openpgp:0x6068FEBB" ];
-    };
-
-    home-manager.users.sammy = lib.mkIf cfg.sammy.enable (import ../../users/sammy.nix);
-# something with this is wrong lol      // lib.mkIf (lib.pathExists (../../users + "/sammy@${hostname}.nix")) (import ../../users + "sammy@${hostname}.nix");
-  };
-}

hosts/common/virtualization.nix

@@ -1,11 +0,0 @@
-{ ... }: {
-  virtualisation.vmVariant = {
-    # following configuration is added only when building VM with build-vm
-    virtualisation = {
-      memorySize = 8192;
-      cores = 6;
-      graphics = true;
-    };
-    users.users.sammy.initialPassword = "test";
-  };
-}

hosts/common/yubikey.nix

@@ -1,11 +0,0 @@
-{ pkgs, ... }: {
-  services.udev.packages = with pkgs; [ libu2f-host yubikey-personalization ];
-
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-    enableExtraSocket = true;
-  };
-
-  services.pcscd.enable = true;
-}

hosts/ocelot/default.nix

@@ -1,10 +1,9 @@
 { ... }: {
   imports = [
     ./hardware-configuration.nix
+    ./gotosocial.nix
   ];
 
-  cherrykitten.graphical = false;
-
   boot.tmp.cleanOnBoot = true;
   zramSwap.enable = true;
   networking.hostName = "ocelot";

hosts/ocelot/gotosocial.nix

@@ -1,12 +1,14 @@
-{ ... }:
+{ pkgs-unstable, ... }:
 let
   bind-address = "127.0.0.1";
-  host = "test-gts.cherrykitten.xyz";
+  host = "gts-test.cherrykitten.xyz";
   port = 8553;
 in
 {
   services.gotosocial = {
     enable = true;
+    setupPostgresqlDB = true;
+    package = pkgs-unstable.gotosocial;
     settings = {
       inherit bind-address host port;
       application-name = "CherryKitten";

misc/module-template.nix

@@ -1,5 +0,0 @@
-{ ... }: {
-  options.cherrykitten = { };
-
-  config = { };
-}

modules/home/foot.nix

@@ -1,12 +1,6 @@
-{ config, lib, ... }:
+{ ... }:
-let
-  graphical =
-    if builtins.hasAttr "cherrykitten" config
-    then config.cherrykitten.graphical
-    else true;
-in
 {
-  programs.foot = lib.mkIf graphical {
+  programs.foot = {
     enable = true;
     settings = {
       main = {

profiles/base/default.nix

@@ -0,0 +1,128 @@
+{ lib, config, pkgs, inputs, ... }: {
+  imports = [
+    ../../users
+    inputs.home-manager.nixosModules.home-manager
+  ];
+
+  deployment.tags = [ pkgs.stdenv.hostPlatform.system ];
+  deployment.targetUser = lib.mkDefault "sammy";
+  deployment.targetHost = lib.mkDefault config.networking.fqdnOrHostName;
+
+  nix = {
+    settings = {
+      experimental-features = [ "nix-command" "flakes" ];
+      trusted-users = [ "root" "@wheel" "sammy" ];
+    };
+    gc = {
+      automatic = lib.mkDefault true;
+      options = lib.mkDefault "--delete-older-than 7d";
+    };
+  };
+
+  users.mutableUsers = false;
+  home-manager.useGlobalPkgs = true;
+  home-manager.useUserPackages = true;
+  nixpkgs.config.allowUnfree = true;
+  hardware.enableAllFirmware = true;
+
+  time.timeZone = lib.mkDefault "Europe/Berlin";
+
+  i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = lib.mkDefault "de";
+    useXkbConfig = true;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 22 ];
+
+  services.openssh = {
+    enable = true;
+    extraConfig = ''
+      StreamLocalBindUnlink yes
+    '';
+    settings = {
+      PermitRootLogin = "no";
+      PasswordAuthentication = false;
+      Macs = [
+        "hmac-sha2-512"
+        "hmac-sha2-256"
+      ];
+      KexAlgorithms = [
+        "sntrup761x25519-sha512@openssh.com"
+        "curve25519-sha256"
+        "curve25519-sha256@libssh.org"
+        "diffie-hellman-group-exchange-sha256"
+      ];
+      Ciphers = [
+        "aes256-gcm@openssh.com"
+        "aes128-gcm@openssh.com"
+        "aes256-ctr"
+        "aes192-ctr"
+        "aes128-ctr"
+      ];
+    };
+  };
+
+  security = {
+    sudo = {
+      enable = true;
+      wheelNeedsPassword = false;
+      keepTerminfo = true;
+    };
+
+    acme = {
+      acceptTerms = true;
+      defaults.email = "admin@cherrykitten.dev";
+    };
+  };
+
+  services.fail2ban = {
+    enable = lib.mkDefault true;
+    maxretry = 5;
+  };
+  services.udev.packages = with pkgs; [ libu2f-host yubikey-personalization ];
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+    enableExtraSocket = true;
+  };
+
+  services.pcscd.enable = true;
+
+  virtualisation.vmVariant = {
+    # following configuration is added only when building VM with build-vm
+    virtualisation = {
+      memorySize = 8192;
+      cores = 6;
+      graphics = true;
+    };
+    users.users.sammy.hashedPassword = "";
+  };
+
+  programs.fish.enable = true;
+  # Packages used on all systems
+  environment.systemPackages = with pkgs; [
+    bat
+    bind.dnsutils
+    fd
+    file
+    git
+    gnupg
+    htop
+    jq
+    mtr
+    nmap
+    openssl
+    pinentry
+    rsync
+    tcpdump
+    tmux
+    wget
+    whois
+    wireguard-tools
+  ];
+
+
+}

profiles/desktop/default.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }: {
+  services.xserver = {
+    enable = true;
+    displayManager.sddm.enable = true;
+    desktopManager.plasma5.enable = true;
+    libinput.enable = true;
+
+    xkb.layout = "de";
+    xkb.options = "caps:escape";
+  };
+  fonts = {
+    enableDefaultPackages = true;
+    packages = [ pkgs.noto-fonts-emoji ];
+  };
+}

users/default.nix

@@ -0,0 +1,6 @@
+{ ... }: {
+  imports = [
+    ./sammy
+    ./root
+  ];
+}

users/root/default.nix

@@ -0,0 +1,14 @@
+{ pkgs, lib, ... }:
+{
+  deployment.keys."root_password_hash" = {
+    destDir = "/nix/persist/keys";
+    keyCommand = [ "pass" "users/root/hashedPassword" ];
+  };
+
+  users.users.root = {
+    shell = pkgs.fish;
+    hashedPasswordFile = lib.mkDefault "/nix/persist/keys/root_password_hash";
+  };
+
+  home-manager.users.root = import ./home.nix;
+}

users/root/home.nix

@@ -0,0 +1,10 @@
+{ ... }: {
+  imports = [ ../../modules/home ];
+
+  home.stateVersion = "23.11"; # Please read the comment before changing.
+
+  home.sessionVariables = {
+    EDITOR = "nvim";
+  };
+
+}

users/sammy/default.nix

@@ -0,0 +1,17 @@
+{ pkgs, lib, ... }:
+{
+  deployment.keys."sammy_password_hash" = {
+    destDir = "/nix/persist/keys";
+    keyCommand = [ "pass" "users/sammy/hashedPassword" ];
+  };
+
+  users.users.sammy = {
+    isNormalUser = true;
+    extraGroups = [ "networkmanager" "wheel" "docker" ];
+    shell = pkgs.fish;
+    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZyQSZw+pExsx2RXB+yxbaJGB9mtvudbQ/BP7E1yKvr openpgp:0x6068FEBB" ];
+    hashedPasswordFile = lib.mkDefault "/nix/persist/keys/sammy_password_hash";
+  };
+
+  home-manager.users.sammy = import ./home.nix;
+}

users/sammy/home.nix

@@ -1,5 +1,5 @@
 { ... }: {
-  imports = [ ./common ];
+  imports = [ ../../modules/home ];
 
   programs.git = {
     userName = "CherryKitten";
@@ -19,7 +19,7 @@
     enable = true;
     publicKeys = [
       {
-        source = ../cherrykitten.pgp;
+        source = ../../files/cherrykitten.pgp;
         trust = "ultimate";
       }