macronova/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Format

Browse source
This commit is contained in:
Sicheng Pan 2026-02-16 22:00:15 -08:00
parent c47db92a88
commit 09bc19268d
Signed by: macronova
GPG key ID: CE969670FB4B4A56
29 changed files with 151 additions and 210 deletions
Download patch file Download diff file Expand all files Collapse all files

64
common/constants.nix
View file

@ -12,6 +12,20 @@ with lib; {
The domain for all devices. The domain for all devices.
''; '';
}; };
fullName = mkOption {
type = types.str;
default = "Sicheng Pan";
description = ''
The full name of the default user.
'';
};
gpgKeyId = mkOption {
type = types.str;
default = "0xCE969670FB4B4A56";
description = ''
The GPG key ID for signing.
'';
};
homeDir = mkOption { homeDir = mkOption {
type = types.str; type = types.str;
default = "/home/${config.constants.userName}"; default = "/home/${config.constants.userName}";
@ -19,6 +33,20 @@ with lib; {
The home directory for the default user. The home directory for the default user.
''; '';
}; };
homeServer = mkOption {
type = types.str;
default = "nebula";
description = ''
The hostname of the home server.
'';
};
locale = mkOption {
type = types.str;
default = "zh_CN.UTF-8";
description = ''
The default locale for all devices.
'';
};
localhost = mkOption { localhost = mkOption {
type = types.str; type = types.str;
default = "127.0.0.1"; default = "127.0.0.1";
@ -40,6 +68,7 @@ with lib; {
prowlarr = 30784; prowlarr = 30784;
radarr = 37196; radarr = 37196;
sonarr = 32438; sonarr = 32438;
tailscale = 62662;
vault = 25487; vault = 25487;
}; };
description = '' description = ''
@ -79,6 +108,13 @@ with lib; {
The secrets file for device. The secrets file for device.
''; '';
}; };
timeZone = mkOption {
type = types.str;
default = "America/Los_Angeles";
description = ''
The default timezone for all devices.
'';
};
syncthingDevices = mkOption { syncthingDevices = mkOption {
type = types.attrsOf (types.attrsOf types.str); type = types.attrsOf (types.attrsOf types.str);
default = { default = {
@ -97,11 +133,37 @@ with lib; {
The username across all devices. The username across all devices.
''; '';
}; };
zfsPoolOptions = mkOption {
type = types.attrsOf types.str;
default = {
ashift = "12";
autotrim = "on";
listsnapshots = "on";
};
description = ''
The default options for ZFS pools.
'';
};
zfsRootFsOptions = mkOption {
type = types.attrsOf types.str;
default = {
acltype = "posix";
atime = "off";
compression = "zstd";
dnodesize = "auto";
mountpoint = "none";
normalization = "formD";
xattr = "sa";
};
description = ''
The default root filesystem options for ZFS pools.
'';
};
wildcard = mkOption { wildcard = mkOption {
type = types.str; type = types.str;
default = "0.0.0.0"; default = "0.0.0.0";
description = '' description = ''
The localhost address. The wildcard address for binding to all interfaces.
''; '';
}; };
}; };

3
common/default.nix
View file

@ -3,9 +3,10 @@
home-manager.nixosModules.default home-manager.nixosModules.default
sops-nix.nixosModules.default sops-nix.nixosModules.default
./constants.nix ./constants.nix
./network.nix
./nix.nix
./secrets.nix ./secrets.nix
./users.nix ./users.nix
./nix.nix
]; ];
home-manager.sharedModules = [inputs.plasma-manager.homeModules.plasma-manager]; home-manager.sharedModules = [inputs.plasma-manager.homeModules.plasma-manager];

8
common/network.nix Normal file
View file

@ -0,0 +1,8 @@
{config, ...}: {
networking.nftables.enable = true;
services.tailscale = {
enable = true;
port = config.constants.port.tailscale;
};
}

2
common/nix.nix
View file

@ -1,4 +1,6 @@
{config, ...}: { {config, ...}: {
boot.tmp.cleanOnBoot = true;
nix = { nix = {
gc = { gc = {
automatic = true; automatic = true;

9
common/users.nix
View file

@ -1,5 +1,6 @@
{ {
config, config,
lib,
pkgs, pkgs,
... ...
}: }:
@ -212,7 +213,7 @@ in {
}; };
i18n = { i18n = {
defaultLocale = "zh_CN.UTF-8"; defaultLocale = locale;
supportedLocales = ["all"]; supportedLocales = ["all"];
}; };
@ -239,7 +240,7 @@ in {
}; };
}; };
resolved.enable = true; resolved.enable = true;
syncthing = { syncthing = lib.mkIf config.services.syncthing.enable {
configDir = "${homeDir}/.config/syncthing"; configDir = "${homeDir}/.config/syncthing";
dataDir = "${homeDir}/.local/share/syncthing"; dataDir = "${homeDir}/.local/share/syncthing";
openDefaultPorts = true; openDefaultPorts = true;
@ -252,12 +253,12 @@ in {
sops.secrets.${usrPwdFile}.neededForUsers = true; sops.secrets.${usrPwdFile}.neededForUsers = true;
time.timeZone = "America/Los_Angeles"; time.timeZone = timeZone;
users = { users = {
mutableUsers = false; mutableUsers = false;
users.${userName} = { users.${userName} = {
description = "Sicheng Pan"; description = fullName;
extraGroups = [ extraGroups = [
"audio" "audio"
"dialout" "dialout"

68
flake.lock generated
View file

@ -19,11 +19,11 @@
"candy-icons": { "candy-icons": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1769644786, "lastModified": 1771031264,
"narHash": "sha256-XyFhC4I7Y1ppTfLs7em+hXmXx6jQ09rJxcf66EwoK7g=", "narHash": "sha256-SzZMCNNTIctzFqx2qHwE4y4lioctpum39AyRrylurZA=",
"ref": "refs/heads/master", "ref": "refs/heads/master",
"rev": "ade95a235a50e5ea653a02fd3773c214ac43d425", "rev": "b0a85a7414504191342b0c6d073c6f9233cb923a",
"revCount": 1361, "revCount": 1363,
"type": "git", "type": "git",
"url": "https://github.com/EliverLara/candy-icons" "url": "https://github.com/EliverLara/candy-icons"
}, },
@ -102,24 +102,6 @@
"type": "github" "type": "github"
} }
}, },
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"git-hooks": { "git-hooks": {
"inputs": { "inputs": {
"flake-compat": [ "flake-compat": [
@ -292,7 +274,7 @@
"nix-custom": { "nix-custom": {
"inputs": { "inputs": {
"candy-icons": "candy-icons", "candy-icons": "candy-icons",
"flake-utils": "flake-utils_2", "flake-utils": "flake-utils",
"nixpkgs": [ "nixpkgs": [
"nixpkgs" "nixpkgs"
], ],
@ -304,11 +286,11 @@
"yorha-sound-theme": "yorha-sound-theme" "yorha-sound-theme": "yorha-sound-theme"
}, },
"locked": { "locked": {
"lastModified": 1770172667, "lastModified": 1771303763,
"narHash": "sha256-eLYjm0L/eG5pvBrcRtf3Q2LQMsJyZcITubf9qywzAPQ=", "narHash": "sha256-zx1XQR1IfcPSS1869Q4m9XlkZdACypLDEIgXnRYuUrI=",
"ref": "refs/heads/main", "ref": "refs/heads/main",
"rev": "e355f045a9b6b53b6f58cd4521a762e1147cdca2", "rev": "7e351308706847a018407e5871c6cb869eb80399",
"revCount": 50, "revCount": 51,
"type": "git", "type": "git",
"url": "https://forgejo.invariantspace.com/macronova/nix-custom" "url": "https://forgejo.invariantspace.com/macronova/nix-custom"
}, },
@ -401,7 +383,6 @@
"root": { "root": {
"inputs": { "inputs": {
"disko": "disko", "disko": "disko",
"flake-utils": "flake-utils",
"hardware": "hardware", "hardware": "hardware",
"home-manager": "home-manager", "home-manager": "home-manager",
"jovian": "jovian", "jovian": "jovian",
@ -436,11 +417,11 @@
"sweet-ambar-blue": { "sweet-ambar-blue": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1769979298, "lastModified": 1770763753,
"narHash": "sha256-FJwCsmp5XM4nYwwttHHlKhl5RVeoWfuY69fuh/+iMNE=", "narHash": "sha256-X3w4vciP0JubTezbslLLi7gBuk7Bx4V6qklFbedKcqU=",
"ref": "Ambar-Blue", "ref": "Ambar-Blue",
"rev": "a045584aee6e0bec19579ef304e482fee9093296", "rev": "0c3d02ce438606719db854697aaea87f13a0272a",
"revCount": 356, "revCount": 357,
"type": "git", "type": "git",
"url": "https://github.com/EliverLara/Sweet" "url": "https://github.com/EliverLara/Sweet"
}, },
@ -453,11 +434,11 @@
"sweet-ambar-blue-dark": { "sweet-ambar-blue-dark": {
"flake": false, "flake": false,
"locked": { "locked": {
"lastModified": 1769979020, "lastModified": 1770763766,
"narHash": "sha256-WGe6zkffqcZRkWStGUE1ozegLWaZsmAj0m+TF2Ypxqk=", "narHash": "sha256-oYi00RU1bWl/7pEANdZTASTCazsC+a+ItogrNsHy1JQ=",
"ref": "Ambar-Blue-Dark", "ref": "Ambar-Blue-Dark",
"rev": "d004b00508ae963f1e42269a5f86120c27b22fe3", "rev": "3fe9cba71b5dbdfc442e2daa97f80115f530603b",
"revCount": 439, "revCount": 440,
"type": "git", "type": "git",
"url": "https://github.com/EliverLara/Sweet" "url": "https://github.com/EliverLara/Sweet"
}, },
@ -515,21 +496,6 @@
"type": "github" "type": "github"
} }
}, },
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"yorha-grub-theme": { "yorha-grub-theme": {
"flake": false, "flake": false,
"locked": { "locked": {

21
flake.nix
View file

@ -6,7 +6,6 @@
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
url = "github:nix-community/disko"; url = "github:nix-community/disko";
}; };
flake-utils.url = "github:numtide/flake-utils";
hardware.url = "github:nixos/nixos-hardware"; hardware.url = "github:nixos/nixos-hardware";
home-manager = { home-manager = {
inputs.nixpkgs.follows = "nixpkgs"; inputs.nixpkgs.follows = "nixpkgs";
@ -41,7 +40,6 @@
outputs = inputs @ { outputs = inputs @ {
self, self,
flake-utils,
nixpkgs, nixpkgs,
nix-custom, nix-custom,
pre-commit-hooks, pre-commit-hooks,
@ -49,6 +47,7 @@
}: let }: let
linuxCfgDir = ./linux; linuxCfgDir = ./linux;
templateDir = ./template; templateDir = ./template;
eachSystem = nixpkgs.lib.genAttrs ["x86_64-linux"];
in in
{ {
nixosConfigurations = nixosConfigurations =
@ -59,6 +58,7 @@
# Import config from folder # Import config from folder
(linuxCfgDir + "/${instance}") (linuxCfgDir + "/${instance}")
# Common setups # Common setups
./common
({pkgs, ...}: { ({pkgs, ...}: {
networking.hostName = instance; networking.hostName = instance;
nixpkgs.overlays = [nix-custom.overlays.default]; nixpkgs.overlays = [nix-custom.overlays.default];
@ -75,21 +75,22 @@
}) })
(builtins.readDir templateDir); (builtins.readDir templateDir);
} }
// ( // {
flake-utils.lib.eachDefaultSystem (system: let checks = eachSystem (system: {
pkgs = nixpkgs.legacyPackages.${system}; pre-commit-check = pre-commit-hooks.lib.${system}.run {
in {
checks.pre-commit-check = pre-commit-hooks.lib.${system}.run {
src = ./.; src = ./.;
hooks.alejandra.enable = true; hooks.alejandra.enable = true;
}; };
devShells.default = let });
devShells = eachSystem (system: {
default = let
pkgs = nixpkgs.legacyPackages.${system};
pre-commit = self.checks.${system}.pre-commit-check; pre-commit = self.checks.${system}.pre-commit-check;
in in
pkgs.mkShell { pkgs.mkShell {
inherit (pre-commit) shellHook; inherit (pre-commit) shellHook;
buildInputs = pre-commit.enabledPackages; buildInputs = pre-commit.enabledPackages;
}; };
}) });
); };
} }

9
linux/nebula/configuration.nix
View file

@ -3,12 +3,9 @@
# and in the NixOS manual (accessible by running `nixos-help`). # and in the NixOS manual (accessible by running `nixos-help`).
{...}: { {...}: {
# Configure boot loader # Configure boot loader
boot = { boot.loader = {
loader = { efi.canTouchEfiVariables = true;
efi.canTouchEfiVariables = true; systemd-boot.enable = true;
systemd-boot.enable = true;
};
tmp.cleanOnBoot = true;
}; };
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default

3
linux/nebula/default.nix
View file

@ -1,9 +1,9 @@
# Home media server — hosts Jellyfin, Forgejo, Matrix Conduit, and media management services
{inputs, ...}: { {inputs, ...}: {
imports = with inputs; [ imports = with inputs; [
disko.nixosModules.default disko.nixosModules.default
hardware.nixosModules.common-cpu-amd hardware.nixosModules.common-cpu-amd
hardware.nixosModules.common-cpu-amd-pstate hardware.nixosModules.common-cpu-amd-pstate
../../common
./conduit.nix ./conduit.nix
./configuration.nix ./configuration.nix
./disko.nix ./disko.nix
@ -12,7 +12,6 @@
./jellyfin.nix ./jellyfin.nix
./network.nix ./network.nix
./syncthing.nix ./syncthing.nix
./tailscale.nix
./zfs.nix ./zfs.nix
]; ];
} }

18
linux/nebula/disko.nix
View file

@ -1,4 +1,4 @@
{...}: { {config, ...}: {
disko.devices = { disko.devices = {
# Partition the physical disk # Partition the physical disk
disk.storage = { disk.storage = {
@ -29,20 +29,8 @@
# Construct the primary zfs pool for this system. # Construct the primary zfs pool for this system.
zpool.zroot = { zpool.zroot = {
type = "zpool"; type = "zpool";
options = { options = config.constants.zfsPoolOptions;
ashift = "12"; rootFsOptions = config.constants.zfsRootFsOptions;
autotrim = "on";
listsnapshots = "on";
};
rootFsOptions = {
acltype = "posix";
atime = "off";
compression = "zstd";
dnodesize = "auto";
mountpoint = "none";
normalization = "formD";
xattr = "sa";
};
datasets = { datasets = {
# Encrypt main dataset # Encrypt main dataset
main = { main = {

7
linux/nebula/network.nix
View file

@ -6,8 +6,11 @@
enable = true; enable = true;
wifi.backend = "iwd"; wifi.backend = "iwd";
}; };
nftables.enable = true;
wireless.iwd.enable = true; wireless.iwd.enable = true;
}; };
services.openssh.enable = true;
services = {
openssh.enable = true;
tailscale.useRoutingFeatures = "both";
};
} }

7
linux/nebula/tailscale.nix
View file

@ -1,7 +0,0 @@
{...}: {
services.tailscale = {
enable = true;
port = 25555;
useRoutingFeatures = "both";
};
}

2
linux/nebula/zfs.nix
View file

@ -1,6 +1,4 @@
{...}: { {...}: {
boot.loader.grub.zfsSupport = true;
services.zfs = { services.zfs = {
autoScrub.enable = true; autoScrub.enable = true;
trim.enable = true; trim.enable = true;

10
linux/protostar/configuration.nix
View file

@ -3,13 +3,9 @@
# and in the NixOS manual (accessible by running `nixos-help`). # and in the NixOS manual (accessible by running `nixos-help`).
{...}: { {...}: {
# Configuration boot # Configuration boot
boot = { boot.loader = {
loader = { efi.canTouchEfiVariables = true;
efi.canTouchEfiVariables = true; systemd-boot.enable = true;
systemd-boot.enable = true;
};
tmp.cleanOnBoot = true;
}; };
# Change secrets file # Change secrets file

3
linux/protostar/default.nix
View file

@ -1,14 +1,13 @@
# Game console — Steam Deck running Jovian-NixOS with Steam and KDE Plasma
{inputs, ...}: { {inputs, ...}: {
imports = with inputs; [ imports = with inputs; [
disko.nixosModules.default disko.nixosModules.default
jovian.nixosModules.default jovian.nixosModules.default
../../common
./configuration.nix ./configuration.nix
./disko.nix ./disko.nix
./gui.nix ./gui.nix
./hardware-configuration.nix ./hardware-configuration.nix
./network.nix ./network.nix
./syncthing.nix ./syncthing.nix
./tailscale.nix
]; ];
} }

2
linux/protostar/network.nix
View file

@ -6,7 +6,7 @@
enable = true; enable = true;
wifi.backend = "iwd"; wifi.backend = "iwd";
}; };
nftables.enable = true;
}; };
services.openssh.enable = true; services.openssh.enable = true;
} }

7
linux/protostar/tailscale.nix
View file

@ -1,7 +0,0 @@
{...}: {
services.tailscale = {
enable = true;
port = 25172;
useRoutingFeatures = "client";
};
}

1
linux/quasar/configuration.nix
View file

@ -23,7 +23,6 @@
theme = "target_2"; theme = "target_2";
themePackages = [pkgs.adi1090x-plymouth-themes]; themePackages = [pkgs.adi1090x-plymouth-themes];
}; };
tmp.cleanOnBoot = true;
}; };
# This option defines the first version of NixOS you have installed on this particular machine, # This option defines the first version of NixOS you have installed on this particular machine,

3
linux/quasar/default.nix
View file

@ -1,8 +1,8 @@
# Home personal computer — primary desktop workstation with KDE Plasma, gaming, and development
{inputs, ...}: { {inputs, ...}: {
imports = imports =
[ [
inputs.disko.nixosModules.default inputs.disko.nixosModules.default
../../common
./configuration.nix ./configuration.nix
./device.nix ./device.nix
./disko.nix ./disko.nix
@ -10,7 +10,6 @@
./hardware-configuration.nix ./hardware-configuration.nix
./network.nix ./network.nix
./syncthing.nix ./syncthing.nix
./tailscale.nix
./zfs.nix ./zfs.nix
] ]
++ (with inputs.hardware.nixosModules; [ ++ (with inputs.hardware.nixosModules; [

23
linux/quasar/disko.nix
View file

@ -1,4 +1,4 @@
{...}: { {config, ...}: {
disko.devices = { disko.devices = {
# Partition the physical disk # Partition the physical disk
disk = { disk = {
@ -46,24 +46,12 @@
# Declare zfs pools for this system. # Declare zfs pools for this system.
zpool = let zpool = let
options = { inherit (config.constants) zfsPoolOptions zfsRootFsOptions;
ashift = "12";
autotrim = "on";
listsnapshots = "on";
};
rootFsOptions = {
acltype = "posix";
atime = "off";
compression = "zstd";
dnodesize = "auto";
mountpoint = "none";
normalization = "formD";
xattr = "sa";
};
in { in {
zactive = { zactive = {
type = "zpool"; type = "zpool";
inherit options rootFsOptions; options = zfsPoolOptions;
rootFsOptions = zfsRootFsOptions;
datasets = { datasets = {
# Encrypt main dataset # Encrypt main dataset
main = { main = {
@ -98,7 +86,8 @@
zarchive = { zarchive = {
type = "zpool"; type = "zpool";
inherit options rootFsOptions; options = zfsPoolOptions;
rootFsOptions = zfsRootFsOptions;
datasets = { datasets = {
snapshot.type = "zfs_fs"; snapshot.type = "zfs_fs";
# Reserve space for performance # Reserve space for performance

40
linux/quasar/gui.nix
View file

@ -31,7 +31,7 @@ in {
]; ];
programs = { programs = {
git.signing = { git.signing = {
key = "0xCE969670FB4B4A56"; key = osConfig.constants.gpgKeyId;
signByDefault = true; signByDefault = true;
}; };
gpg = { gpg = {
@ -53,43 +53,7 @@ in {
]; ];
}; };
obs-studio.enable = true; obs-studio.enable = true;
zathura = { zathura.enable = true;
enable = true;
options = {
completion-bg = "#504945";
completion-fg = "#ebdbb2";
completion-group-bg = "#3c3836";
completion-group-fg = "#928374";
completion-highlight-bg = "#83a598";
completion-highlight-fg = "#504945";
default-bg = "#1d2021";
default-fg = "#ebdbb2";
highlight-active-color = "#fe8019";
highlight-color = "#fabd2f";
index-active-bg = "#83a598";
index-active-fg = "#504945";
index-bg = "#504945";
index-fg = "#ebdbb2";
inputbar-bg = "#1d2021";
inputbar-fg = "#ebdbb2";
notification-bg = "#1d2021";
notification-error-bg = "#1d2021";
notification-error-fg = "#fb4934";
notification-fg = "#b8bb26";
notification-warning-bg = "#1d2021";
notification-warning-fg = "#fabd2f";
recolor = "true";
recolor-darkcolor = "#ebdbb2";
recolor-keephue = "true";
recolor-lightcolor = "#1d2021";
render-loading = "true";
render-loading-bg = "#1d2021";
render-loading-fg = "#ebdbb2";
selection-clipboard = "clipboard";
statusbar-bg = "#504945";
statusbar-fg = "#ebdbb2";
};
};
}; };
services = { services = {
easyeffects.enable = true; easyeffects.enable = true;

1
linux/quasar/network.nix
View file

@ -5,7 +5,6 @@
enable = true; enable = true;
wifi.backend = "iwd"; wifi.backend = "iwd";
}; };
nftables.enable = true;
wireless.iwd.enable = true; wireless.iwd.enable = true;
}; };
} }

7
linux/quasar/tailscale.nix
View file

@ -1,7 +0,0 @@
{...}: {
services.tailscale = {
enable = true;
port = 62662;
useRoutingFeatures = "client";
};
}

2
linux/singularity/caddy.nix
View file

@ -21,7 +21,7 @@ with config.constants; {
}; };
}) })
fqdns); fqdns);
homeSrv = s: "nebula:${portStr.${s}}"; homeSrv = s: "${homeServer}:${portStr.${s}}";
localSrv = s: "${localhost}:${portStr.${s}}"; localSrv = s: "${localhost}:${portStr.${s}}";
mtfqdn = "matrix.${domain}"; mtfqdn = "matrix.${domain}";
portStr = builtins.mapAttrs (n: v: toString v) port; portStr = builtins.mapAttrs (n: v: toString v) port;

5
linux/singularity/configuration.nix
View file

@ -1,8 +1,5 @@
{...}: { {...}: {
boot = { boot.loader.grub.device = "/dev/sda";
loader.grub.device = "/dev/sda";
tmp.cleanOnBoot = true;
};
constants.sopsFile = ../../common/auths.yaml; constants.sopsFile = ../../common/auths.yaml;

2
linux/singularity/default.nix
View file

@ -1,7 +1,7 @@
# Public beacon — cloud VPS providing reverse proxy, mail server, Headscale VPN, and Vaultwarden
{inputs, ...}: { {inputs, ...}: {
imports = with inputs; [ imports = with inputs; [
mailserver.nixosModules.default mailserver.nixosModules.default
../../common
./caddy.nix ./caddy.nix
./configuration.nix ./configuration.nix
./hardware-configuration.nix ./hardware-configuration.nix

25
linux/singularity/headscale.nix
View file

@ -1,21 +1,14 @@
{config, ...}: { {config, ...}: {
services = { services.headscale = with config.constants; {
headscale = with config.constants; { enable = true;
enable = true; address = localhost;
address = localhost; port = port.headscale;
port = port.headscale; settings = {
settings = { dns = {
dns = { base_domain = "tailscale.${domain}";
base_domain = "tailscale.${domain}"; override_local_dns = false;
override_local_dns = false;
};
server_url = "https://headscale.${domain}";
}; };
}; server_url = "https://headscale.${domain}";
tailscale = {
enable = true;
port = 27919;
useRoutingFeatures = "both";
}; };
}; };
} }

2
linux/singularity/network.nix
View file

@ -2,7 +2,6 @@
networking = { networking = {
firewall.allowedTCPPorts = with config.constants.port; [http https]; firewall.allowedTCPPorts = with config.constants.port; [http https];
hostId = "2cadb253"; hostId = "2cadb253";
nftables.enable = true;
}; };
services = { services = {
@ -12,6 +11,7 @@
domains = builtins.attrNames config.services.caddy.virtualHosts; domains = builtins.attrNames config.services.caddy.virtualHosts;
}; };
openssh.enable = true; openssh.enable = true;
tailscale.useRoutingFeatures = "both";
}; };
sops.secrets.cloudflare = {}; sops.secrets.cloudflare = {};

7
linux/singularity/vaultwarden.nix
View file

@ -1,5 +1,6 @@
{config, ...}: let {config, ...}: let
vaultEnvironment = "vaultwarden/environment"; vaultEnvironment = "vaultwarden/environment";
vaultwardenAddr = "vaultwarden@${config.constants.domain}";
in { in {
services.vaultwarden = { services.vaultwarden = {
enable = true; enable = true;
@ -11,10 +12,10 @@ in {
# Disable signup # Disable signup
SIGNUPS_ALLOWED = false; SIGNUPS_ALLOWED = false;
# SMTP config # SMTP config
SMTP_FROM = "vaultwarden@${domain}"; SMTP_FROM = vaultwardenAddr;
SMTP_FROM_NAME = "vaultwarden"; SMTP_FROM_NAME = "vaultwarden";
SMTP_HOST = "mail.${domain}"; SMTP_HOST = config.mailserver.fqdn;
SMTP_USERNAME = "vaultwarden@${domain}"; SMTP_USERNAME = vaultwardenAddr;
SMTP_PORT = 587; SMTP_PORT = 587;
SMTP_SECURITY = "starttls"; SMTP_SECURITY = "starttls";
}; };