This commit is contained in:
CherryKitten 2024-04-01 19:16:35 +02:00
parent 6d11664e7b
commit 6a0df97bff
Signed by: sammy
GPG key ID: 98D8F75FB0658276
39 changed files with 202 additions and 224 deletions

View file

@ -1,27 +1 @@
This repository includes my NixOS and Home-manager configurations.
The repo is organized as follows:
```
.
├── flake.lock
├── flake.nix
├── hosts # NixOS-configurations
│   ├── bengal # Host-specific
│   │   ├── default.nix
│   │   └── hardware-configuration.nix
│   ├── common # General, imported by all hosts
│   │   ├── default.nix
│   │   ├── graphical.nix
│   │   ├── security.nix
│   │   ├── users.nix
│   │   ├── virtualization.nix
│   │   └── yubikey.nix
├── misc # just some stuff
├── modules # Home-manager and NixOS modules that follow upstream standards, currently empty lol
│   ├── home
│   └── nixos
└── users # Home-Manager configurations
├── common # General, imported by all
├── sammy.nix # User-specific, but not Host-specific
└── sammy@chansey.nix User- and Host-specific
```

View file

@ -42,19 +42,12 @@
};
defaults = { lib, config, name, ... }: {
imports = [ ./hosts/${name} ./hosts/common (import "${home-manager}/nixos") ];
deployment = {
targetUser = "sammy";
allowLocalDeployment = true;
};
imports = [ ./hosts/${name} ./profiles/base ];
home-manager.extraSpecialArgs = {
inherit inputs outputs;
pkgs-unstable = import nixpkgs-unstable { system = "x86_64-linux"; };
};
cherrykitten.hostname = name;
};
bengal = { };
@ -75,7 +68,7 @@
mkHome = { user ? "sammy", hostname ? null }:
lib.homeManagerConfiguration {
inherit pkgs;
modules = [ ./users/${user}.nix ] ++ lib.optional (!isNull hostname) (./. + "/users/${user}@${hostname}.nix");
modules = [ ./users/${user} ] ++ lib.optional (!isNull hostname) (./. + "/users/${user}@${hostname}");
extraSpecialArgs = {
inherit inputs outputs;
pkgs-unstable = import nixpkgs-unstable { system = "x86_64-linux"; };

View file

@ -1,10 +1,9 @@
{ ... }: {
imports = [
./hardware-configuration.nix
../../profiles/desktop
];
cherrykitten.graphical = true;
boot.loader.systemd-boot.enable = true;
networking.hostName = "bengal";

View file

@ -1,53 +0,0 @@
{ lib, pkgs, ... }: {
options.cherrykitten = {
hostname = lib.mkOption {
type = lib.types.str;
default = "";
description = "the hostname, this is already set for every host by the flake config";
};
test = lib.mkOption {
type = lib.types.str;
default = "nya";
example = "nyanya";
};
};
imports = [
./graphical.nix
./security.nix
./users.nix
./yubikey.nix
./virtualization.nix
];
config = {
nix.settings.experimental-features = [ "nix-command" "flakes" ];
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
time.timeZone = "Europe/Berlin";
i18n.defaultLocale = "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = lib.mkForce "de";
useXkbConfig = true; # use xkb.options in tty.
};
fonts = {
enableDefaultPackages = true;
packages = with pkgs; [
noto-fonts-emoji
];
};
# Packages used on all systems
environment.systemPackages = with pkgs; [
git
openssl
rsync
pinentry
wget
];
};
}

View file

@ -1,21 +0,0 @@
{ config, lib, ... }:
let
cfg = config.cherrykitten.graphical;
in
{
options.cherrykitten.graphical = lib.mkEnableOption (lib.mdDoc "graphical stuffs");
config = lib.mkIf cfg {
services.xserver = {
enable = true;
displayManager.sddm.enable = true;
desktopManager.plasma5.enable = true;
desktopManager.plasma5.bigscreen.enable = true;
libinput.enable = true;
xkb.layout = "de";
xkb.options = "caps:escape";
};
};
}

View file

@ -1,49 +0,0 @@
{ ... }: {
networking.firewall.allowedTCPPorts = [ 22 ];
services.openssh = {
enable = true;
extraConfig = ''
StreamLocalBindUnlink yes
'';
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
Macs = [
"hmac-sha2-512"
"hmac-sha2-256"
];
KexAlgorithms = [
"sntrup761x25519-sha512@openssh.com"
"curve25519-sha256"
"curve25519-sha256@libssh.org"
"diffie-hellman-group-exchange-sha256"
];
Ciphers = [
"aes256-gcm@openssh.com"
"aes128-gcm@openssh.com"
"aes256-ctr"
"aes192-ctr"
"aes128-ctr"
];
};
};
security = {
sudo = {
enable = true;
wheelNeedsPassword = false;
keepTerminfo = true;
};
acme = {
acceptTerms = true;
defaults.email = "admin@cherrykitten.dev";
};
};
services.fail2ban = {
enable = true;
maxretry = 5;
};
}

View file

@ -1,23 +0,0 @@
{ pkgs, config, lib, ... }:
let
cfg = config.cherrykitten.users;
hostname = config.cherrykitten.hostname;
in
{
options.cherrykitten.users = {
sammy.enable = lib.mkEnableOption "sammy" // { default = true; };
};
config = {
users.users.sammy = lib.mkIf cfg.sammy.enable {
isNormalUser = true;
extraGroups = [ "networkmanager" "wheel" "docker" ];
shell = pkgs.fish;
ignoreShellProgramCheck = true;
openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZyQSZw+pExsx2RXB+yxbaJGB9mtvudbQ/BP7E1yKvr openpgp:0x6068FEBB" ];
};
home-manager.users.sammy = lib.mkIf cfg.sammy.enable (import ../../users/sammy.nix);
# something with this is wrong lol // lib.mkIf (lib.pathExists (../../users + "/sammy@${hostname}.nix")) (import ../../users + "sammy@${hostname}.nix");
};
}

View file

@ -1,11 +0,0 @@
{ ... }: {
virtualisation.vmVariant = {
# following configuration is added only when building VM with build-vm
virtualisation = {
memorySize = 8192;
cores = 6;
graphics = true;
};
users.users.sammy.initialPassword = "test";
};
}

View file

@ -1,11 +0,0 @@
{ pkgs, ... }: {
services.udev.packages = with pkgs; [ libu2f-host yubikey-personalization ];
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
enableExtraSocket = true;
};
services.pcscd.enable = true;
}

View file

@ -1,10 +1,9 @@
{ ... }: {
imports = [
./hardware-configuration.nix
./gotosocial.nix
];
cherrykitten.graphical = false;
boot.tmp.cleanOnBoot = true;
zramSwap.enable = true;
networking.hostName = "ocelot";

View file

@ -1,12 +1,14 @@
{ ... }:
{ pkgs-unstable, ... }:
let
bind-address = "127.0.0.1";
host = "test-gts.cherrykitten.xyz";
host = "gts-test.cherrykitten.xyz";
port = 8553;
in
{
services.gotosocial = {
enable = true;
setupPostgresqlDB = true;
package = pkgs-unstable.gotosocial;
settings = {
inherit bind-address host port;
application-name = "CherryKitten";

View file

@ -1,5 +0,0 @@
{ ... }: {
options.cherrykitten = { };
config = { };
}

View file

@ -1,12 +1,6 @@
{ config, lib, ... }:
let
graphical =
if builtins.hasAttr "cherrykitten" config
then config.cherrykitten.graphical
else true;
in
{ ... }:
{
programs.foot = lib.mkIf graphical {
programs.foot = {
enable = true;
settings = {
main = {

0
modules/nixos/.gitkeep Normal file
View file

128
profiles/base/default.nix Normal file
View file

@ -0,0 +1,128 @@
{ lib, config, pkgs, inputs, ... }: {
imports = [
../../users
inputs.home-manager.nixosModules.home-manager
];
deployment.tags = [ pkgs.stdenv.hostPlatform.system ];
deployment.targetUser = lib.mkDefault "sammy";
deployment.targetHost = lib.mkDefault config.networking.fqdnOrHostName;
nix = {
settings = {
experimental-features = [ "nix-command" "flakes" ];
trusted-users = [ "root" "@wheel" "sammy" ];
};
gc = {
automatic = lib.mkDefault true;
options = lib.mkDefault "--delete-older-than 7d";
};
};
users.mutableUsers = false;
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
nixpkgs.config.allowUnfree = true;
hardware.enableAllFirmware = true;
time.timeZone = lib.mkDefault "Europe/Berlin";
i18n.defaultLocale = lib.mkDefault "en_US.UTF-8";
console = {
font = "Lat2-Terminus16";
keyMap = lib.mkDefault "de";
useXkbConfig = true;
};
networking.firewall.allowedTCPPorts = [ 22 ];
services.openssh = {
enable = true;
extraConfig = ''
StreamLocalBindUnlink yes
'';
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
Macs = [
"hmac-sha2-512"
"hmac-sha2-256"
];
KexAlgorithms = [
"sntrup761x25519-sha512@openssh.com"
"curve25519-sha256"
"curve25519-sha256@libssh.org"
"diffie-hellman-group-exchange-sha256"
];
Ciphers = [
"aes256-gcm@openssh.com"
"aes128-gcm@openssh.com"
"aes256-ctr"
"aes192-ctr"
"aes128-ctr"
];
};
};
security = {
sudo = {
enable = true;
wheelNeedsPassword = false;
keepTerminfo = true;
};
acme = {
acceptTerms = true;
defaults.email = "admin@cherrykitten.dev";
};
};
services.fail2ban = {
enable = lib.mkDefault true;
maxretry = 5;
};
services.udev.packages = with pkgs; [ libu2f-host yubikey-personalization ];
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
enableExtraSocket = true;
};
services.pcscd.enable = true;
virtualisation.vmVariant = {
# following configuration is added only when building VM with build-vm
virtualisation = {
memorySize = 8192;
cores = 6;
graphics = true;
};
users.users.sammy.hashedPassword = "";
};
programs.fish.enable = true;
# Packages used on all systems
environment.systemPackages = with pkgs; [
bat
bind.dnsutils
fd
file
git
gnupg
htop
jq
mtr
nmap
openssl
pinentry
rsync
tcpdump
tmux
wget
whois
wireguard-tools
];
}

View file

@ -0,0 +1,15 @@
{ pkgs, ... }: {
services.xserver = {
enable = true;
displayManager.sddm.enable = true;
desktopManager.plasma5.enable = true;
libinput.enable = true;
xkb.layout = "de";
xkb.options = "caps:escape";
};
fonts = {
enableDefaultPackages = true;
packages = [ pkgs.noto-fonts-emoji ];
};
}

6
users/default.nix Normal file
View file

@ -0,0 +1,6 @@
{ ... }: {
imports = [
./sammy
./root
];
}

14
users/root/default.nix Normal file
View file

@ -0,0 +1,14 @@
{ pkgs, lib, ... }:
{
deployment.keys."root_password_hash" = {
destDir = "/nix/persist/keys";
keyCommand = [ "pass" "users/root/hashedPassword" ];
};
users.users.root = {
shell = pkgs.fish;
hashedPasswordFile = lib.mkDefault "/nix/persist/keys/root_password_hash";
};
home-manager.users.root = import ./home.nix;
}

10
users/root/home.nix Normal file
View file

@ -0,0 +1,10 @@
{ ... }: {
imports = [ ../../modules/home ];
home.stateVersion = "23.11"; # Please read the comment before changing.
home.sessionVariables = {
EDITOR = "nvim";
};
}

17
users/sammy/default.nix Normal file
View file

@ -0,0 +1,17 @@
{ pkgs, lib, ... }:
{
deployment.keys."sammy_password_hash" = {
destDir = "/nix/persist/keys";
keyCommand = [ "pass" "users/sammy/hashedPassword" ];
};
users.users.sammy = {
isNormalUser = true;
extraGroups = [ "networkmanager" "wheel" "docker" ];
shell = pkgs.fish;
openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZyQSZw+pExsx2RXB+yxbaJGB9mtvudbQ/BP7E1yKvr openpgp:0x6068FEBB" ];
hashedPasswordFile = lib.mkDefault "/nix/persist/keys/sammy_password_hash";
};
home-manager.users.sammy = import ./home.nix;
}

View file

@ -1,5 +1,5 @@
{ ... }: {
imports = [ ./common ];
imports = [ ../../modules/home ];
programs.git = {
userName = "CherryKitten";
@ -19,7 +19,7 @@
enable = true;
publicKeys = [
{
source = ../cherrykitten.pgp;
source = ../../files/cherrykitten.pgp;
trust = "ultimate";
}