Compare commits
10 commits
6224ebd718
...
6faff4de99
Author | SHA1 | Date | |
---|---|---|---|
6faff4de99 | |||
b6647447bf | |||
312645fe2f | |||
cf1c1e506d | |||
538fffeee5 | |||
a14917f664 | |||
c91c32d01c | |||
6f27a20e7a | |||
9d5da09a3a | |||
934545de48 |
31 changed files with 548 additions and 521 deletions
60
flake.lock
60
flake.lock
|
@ -7,11 +7,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1721842668,
|
||||
"narHash": "sha256-k3oiD2z2AAwBFLa4+xfU+7G5fisRXfkvrMTCJrjZzXo=",
|
||||
"lastModified": 1722960479,
|
||||
"narHash": "sha256-NhCkJJQhD5GUib8zN9JrmYGMwt4lCRp6ZVNzIiYCl0Y=",
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"rev": "529c1a0b1f29f0d78fa3086b8f6a134c71ef3aaf",
|
||||
"rev": "4c6c77920b8d44cd6660c1621dea6b3fc4b4c4f4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -27,11 +27,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722476845,
|
||||
"narHash": "sha256-7gZ8uf3qOox8Vrwd+p9EhUHHLhhK8lis/5KcXGmIaow=",
|
||||
"lastModified": 1723080788,
|
||||
"narHash": "sha256-C5LbM5VMdcolt9zHeLQ0bYMRjUL+N+AL5pK7/tVTdes=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "7e1b215a0a96efb306ad6440bf706d2b307dc267",
|
||||
"rev": "ffc1f95f6c28e1c6d1e587b51a2147027a3e45ed",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -122,11 +122,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722630065,
|
||||
"narHash": "sha256-QfM/9BMRkCmgWzrPDK+KbgJOUlSJnfX4OvsUupEUZvA=",
|
||||
"lastModified": 1723015306,
|
||||
"narHash": "sha256-jQnFEtH20/OsDPpx71ntZzGdRlpXhUENSQCGTjn//NA=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "afc892db74d65042031a093adb6010c4c3378422",
|
||||
"rev": "b3d5ea65d88d67d4ec578ed11d4d2d51e3de525e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -221,11 +221,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722609272,
|
||||
"narHash": "sha256-Kkb+ULEHVmk07AX+OhwyofFxBDpw+2WvsXguUS2m6e4=",
|
||||
"lastModified": 1722924007,
|
||||
"narHash": "sha256-+CQDamNwqO33REJLft8c26NbUi2Td083hq6SvAm2xkU=",
|
||||
"owner": "LnL7",
|
||||
"repo": "nix-darwin",
|
||||
"rev": "f7142b8024d6b70c66fd646e1d099d3aa5bfec49",
|
||||
"rev": "91010a5613ffd7ee23ee9263213157a1c422b705",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -236,11 +236,11 @@
|
|||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1722332872,
|
||||
"narHash": "sha256-2xLM4sc5QBfi0U/AANJAW21Bj4ZX479MHPMPkB+eKBU=",
|
||||
"lastModified": 1723310128,
|
||||
"narHash": "sha256-IiH8jG6PpR4h9TxSGMYh+2/gQiJW9MwehFvheSb5rPc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "14c333162ba53c02853add87a0000cbd7aa230c2",
|
||||
"rev": "c54cf53e022b0b3c1d3b8207aa0f9b194c24f0cf",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -251,11 +251,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1722589669,
|
||||
"narHash": "sha256-rxDnGBZK+Sp3df20nCCRrtQzRrJKxY7KtcYNPo5yfg8=",
|
||||
"lastModified": 1723316219,
|
||||
"narHash": "sha256-2B9qh8QBvw3kV/8cHc7ZJcrbVsRwP8wKjkwPXTSz76Y=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "42015a129a2ae1cd43a44490e8235d2b24c8a2e2",
|
||||
"rev": "bef98989a27429e1cb9e3d9c25701ba2da742af2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -281,11 +281,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1721042469,
|
||||
"narHash": "sha256-6FPUl7HVtvRHCCBQne7Ylp4p+dpP3P/OYuzjztZ4s70=",
|
||||
"lastModified": 1723202784,
|
||||
"narHash": "sha256-qbhjc/NEGaDbyy0ucycubq4N3//gDFFH3DOmp1D3u1Q=",
|
||||
"owner": "cachix",
|
||||
"repo": "pre-commit-hooks.nix",
|
||||
"rev": "f451c19376071a90d8c58ab1a953c6e9840527fd",
|
||||
"rev": "c7012d0c18567c889b948781bc74a501e92275d1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -323,11 +323,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722651535,
|
||||
"narHash": "sha256-2uRmNwxe3CO5h7PfvqXrRe8OplXaEdwhqOUtaF13rpU=",
|
||||
"lastModified": 1723343015,
|
||||
"narHash": "sha256-oS8Qhpo71B/6OOsuVBFJbems7RKD/5e3TN2AdXhwMjg=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "56d83ca6f3c557647476f3720426a7615c22b860",
|
||||
"rev": "ed4fe9af3814694d59c572649e881a6aa6eba533",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -346,11 +346,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722114803,
|
||||
"narHash": "sha256-s6YhI8UHwQvO4cIFLwl1wZ1eS5Cuuw7ld2VzUchdFP0=",
|
||||
"lastModified": 1722897572,
|
||||
"narHash": "sha256-3m/iyyjCdRBF8xyehf59QlckIcmShyTesymSb+N4Ap4=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "eb34eb588132d653e4c4925d862f1e5a227cc2ab",
|
||||
"rev": "8ae477955dfd9cbf5fa4eb82a8db8ddbb94e79d9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -381,11 +381,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722330636,
|
||||
"narHash": "sha256-uru7JzOa33YlSRwf9sfXpJG+UAV+bnBEYMjrzKrQZFw=",
|
||||
"lastModified": 1723303070,
|
||||
"narHash": "sha256-krGNVA30yptyRonohQ+i9cnK+CfCpedg6z3qzqVJcTs=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "768acdb06968e53aa1ee8de207fd955335c754b7",
|
||||
"rev": "14c092e0326de759e16b37535161b3cb9770cea3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
@ -104,9 +104,7 @@
|
|||
### nix develop
|
||||
devShells.default = pkgs.mkShell {
|
||||
packages = with pkgs; [
|
||||
alejandra
|
||||
colmena
|
||||
git
|
||||
sops
|
||||
];
|
||||
};
|
||||
|
@ -135,7 +133,6 @@
|
|||
|
||||
### NixOS
|
||||
nixosConfigurations = {
|
||||
"blacksteel" = mkNixOS "x86_64-linux" [./hosts/blacksteel];
|
||||
"dust" = mkNixOS "x86_64-linux" [./hosts/dust];
|
||||
};
|
||||
|
||||
|
@ -157,8 +154,8 @@
|
|||
./nixos/profiles/core
|
||||
];
|
||||
|
||||
"lightsail-tokyo" = {
|
||||
imports = [./hosts/lightsail-tokyo];
|
||||
"tyo0" = {
|
||||
imports = [./hosts/tyo0];
|
||||
deployment.targetHost = "tyo0.ny4.dev";
|
||||
};
|
||||
|
||||
|
|
|
@ -2,7 +2,7 @@
|
|||
encode zstd gzip
|
||||
handle_path /robots.txt {
|
||||
file_server * {
|
||||
root /var/www/robots/robots.txt
|
||||
root @robots@
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
@ -1,28 +1,35 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
# OS
|
||||
../../nixos/profiles/server
|
||||
../../nixos/profiles/opt-in/mihomo
|
||||
../../nixos/profiles/opt-in/wireless
|
||||
|
||||
# Hardware
|
||||
./hardware-configuration.nix
|
||||
./anti-feature.nix
|
||||
|
||||
# Services
|
||||
./services/samba.nix
|
||||
./services/matrix.nix
|
||||
./services/mastodon.nix
|
||||
./services/minecraft.nix
|
||||
./services/jellyfin.nix
|
||||
];
|
||||
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
networking.hostName = "blacksteel";
|
||||
time.timeZone = "Asia/Shanghai";
|
||||
system.stateVersion = "23.11";
|
||||
system.stateVersion = "24.05";
|
||||
|
||||
######## Secrets
|
||||
sops = {
|
||||
secrets = lib.mapAttrs (_name: value: value // {sopsFile = ./secrets.yaml;}) {
|
||||
sops.secrets = lib.mapAttrs (_name: value: value // {sopsFile = ./secrets.yaml;}) {
|
||||
"synapse/secret" = {
|
||||
restartUnits = ["matrix-synapse.service"];
|
||||
owner = config.systemd.services.matrix-synapse.serviceConfig.User;
|
||||
|
@ -42,10 +49,6 @@
|
|||
owner = config.systemd.services."cloudflared-tunnel-6222a3e0-98da-4325-be19-0f86a7318a41".serviceConfig.User;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
######## Services
|
||||
environment.systemPackages = with pkgs; [qbittorrent-nox];
|
||||
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
|
@ -71,6 +74,7 @@
|
|||
enable = true;
|
||||
configFile = pkgs.substituteAll {
|
||||
src = ./Caddyfile;
|
||||
robots = toString ../tyo0/robots.txt;
|
||||
inherit (pkgs) mastodon;
|
||||
};
|
||||
};
|
||||
|
@ -79,25 +83,10 @@
|
|||
SupplementaryGroups = ["mastodon" "matrix-synapse"];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.settings = {
|
||||
"10-www" = {
|
||||
"/var/www/robots/robots.txt".C.argument = toString ../lightsail-tokyo/robots.txt;
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_16;
|
||||
settings = {
|
||||
# Generated by pgTune
|
||||
# https://pgtune.leopard.in.ua/#/
|
||||
#
|
||||
# DB Version: 15
|
||||
# OS Type: linux
|
||||
# DB Type: web
|
||||
# Total Memory (RAM): 16 GB
|
||||
# CPUs num: 8
|
||||
# Data Storage: ssd
|
||||
|
||||
max_connections = 200;
|
||||
shared_buffers = "4GB";
|
||||
effective_cache_size = "12GB";
|
||||
|
@ -105,7 +94,7 @@
|
|||
checkpoint_completion_target = 0.9;
|
||||
wal_buffers = "16MB";
|
||||
default_statistics_target = 100;
|
||||
random_page_cost = "1.1";
|
||||
random_page_cost = 1.1;
|
||||
effective_io_concurrency = 200;
|
||||
work_mem = "5242kB";
|
||||
huge_pages = "off";
|
||||
|
@ -131,180 +120,4 @@
|
|||
compression = "zstd";
|
||||
startAt = "weekly";
|
||||
};
|
||||
|
||||
services.minecraft-server = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
openFirewall = true;
|
||||
|
||||
package = pkgs.minecraftServers.vanilla-1-21;
|
||||
|
||||
# Aikar's flag
|
||||
# https://aikar.co/2018/07/02/tuning-the-jvm-g1gc-garbage-collector-flags-for-minecraft/
|
||||
# https://docs.papermc.io/paper/aikars-flags
|
||||
jvmOpts = lib.concatStringsSep " " [
|
||||
"-Xms2G"
|
||||
"-Xmx2G"
|
||||
"-XX:+UseG1GC"
|
||||
"-XX:+ParallelRefProcEnabled"
|
||||
"-XX:MaxGCPauseMillis=200"
|
||||
"-XX:+UnlockExperimentalVMOptions"
|
||||
"-XX:+DisableExplicitGC"
|
||||
"-XX:+AlwaysPreTouch"
|
||||
"-XX:G1NewSizePercent=30"
|
||||
"-XX:G1MaxNewSizePercent=40"
|
||||
"-XX:G1HeapRegionSize=8M"
|
||||
"-XX:G1ReservePercent=20"
|
||||
"-XX:G1HeapWastePercent=5"
|
||||
"-XX:G1MixedGCCountTarget=4"
|
||||
"-XX:InitiatingHeapOccupancyPercent=15"
|
||||
"-XX:G1MixedGCLiveThresholdPercent=90"
|
||||
"-XX:G1RSetUpdatingPauseTimePercent=5"
|
||||
"-XX:SurvivorRatio=32"
|
||||
"-XX:+PerfDisableSharedMem"
|
||||
"-XX:MaxTenuringThreshold=1"
|
||||
"-Dusing.aikars.flags=https://mcflags.emc.gs"
|
||||
"-Daikars.new.flags=true"
|
||||
];
|
||||
|
||||
declarative = true;
|
||||
serverProperties = {
|
||||
motd = "NixOS Minecraft server!";
|
||||
white-list = true;
|
||||
|
||||
difficulty = 3;
|
||||
gamemode = 0;
|
||||
max-players = 5;
|
||||
};
|
||||
whitelist = {
|
||||
"Guanran928" = "86dbb6c5-8d8b-4c45-b8eb-b3fdf03bfb27";
|
||||
"i_love_ravens" = "2788dd4b-b010-4a2f-9b5c-aad0c0e0cba5";
|
||||
};
|
||||
};
|
||||
|
||||
services.samba = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
shares = {
|
||||
"share" = {
|
||||
path = "/srv/samba/share";
|
||||
"read only" = "no";
|
||||
};
|
||||
"external" = {
|
||||
path = "/mnt";
|
||||
"read only" = "no";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.samba-wsdd = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /srv/samba/share 0755 guanranwang root"
|
||||
];
|
||||
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
withJemalloc = true;
|
||||
enableRegistrationScript = false;
|
||||
extraConfigFiles = [config.sops.secrets."synapse/secret".path];
|
||||
settings = {
|
||||
server_name = "ny4.dev";
|
||||
public_baseurl = "https://matrix.ny4.dev";
|
||||
presence.enabled = false; # tradeoff
|
||||
listeners = [
|
||||
{
|
||||
path = "/run/matrix-synapse/synapse.sock";
|
||||
type = "http";
|
||||
resources = [
|
||||
{
|
||||
names = ["client" "federation"];
|
||||
compress = true;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
# https://element-hq.github.io/synapse/latest/openid.html#keycloak
|
||||
oidc_providers = [
|
||||
{
|
||||
idp_id = "keycloak";
|
||||
idp_name = "id.ny4.dev";
|
||||
issuer = "https://id.ny4.dev/realms/ny4";
|
||||
client_id = "synapse";
|
||||
client_secret_path = config.sops.secrets."synapse/oidc".path;
|
||||
scopes = ["openid" "profile"];
|
||||
user_mapping_provider.config = {
|
||||
localpart_template = "{{ user.preferred_username }}";
|
||||
display_name_template = "{{ user.name }}";
|
||||
};
|
||||
backchannel_logout_enabled = true;
|
||||
allow_existing_users = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.matrix-synapse = {
|
||||
environment = config.networking.proxy.envVars;
|
||||
serviceConfig.RuntimeDirectory = ["matrix-synapse"];
|
||||
};
|
||||
|
||||
services.matrix-sliding-sync = {
|
||||
enable = true;
|
||||
environmentFile = config.sops.secrets."syncv3/environment".path;
|
||||
settings = {
|
||||
SYNCV3_SERVER = "/run/matrix-synapse/synapse.sock";
|
||||
SYNCV3_BINDADDR = "/run/matrix-sliding-sync/sync.sock";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.matrix-sliding-sync.serviceConfig = {
|
||||
RuntimeDirectory = ["matrix-sliding-sync"];
|
||||
SupplementaryGroups = ["matrix-synapse"];
|
||||
};
|
||||
|
||||
services.mastodon = {
|
||||
enable = true;
|
||||
localDomain = "ny4.dev";
|
||||
streamingProcesses = 1;
|
||||
mediaAutoRemove.olderThanDays = 14;
|
||||
# FIXME: this doesn't exist
|
||||
smtp = {
|
||||
createLocally = false;
|
||||
fromAddress = "mastodon@ny4.dev";
|
||||
};
|
||||
extraConfig = rec {
|
||||
SINGLE_USER_MODE = "true";
|
||||
WEB_DOMAIN = "mastodon.ny4.dev";
|
||||
|
||||
# keycloak
|
||||
OMNIAUTH_ONLY = "true";
|
||||
OIDC_ENABLED = "true";
|
||||
OIDC_CLIENT_ID = "mastodon";
|
||||
# OIDC_CLIENT_SECRET # EnvironmentFile
|
||||
OIDC_DISCOVERY = "true";
|
||||
OIDC_DISPLAY_NAME = "id.ny4.dev";
|
||||
OIDC_ISSUER = "https://id.ny4.dev/realms/ny4";
|
||||
OIDC_REDIRECT_URI = "https://${WEB_DOMAIN}/auth/auth/openid_connect/callback";
|
||||
OIDC_SCOPE = "openid,profile,email";
|
||||
OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED = "true";
|
||||
OIDC_UID_FIELD = "preferred_username";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.mastodon-web = {
|
||||
environment = config.networking.proxy.envVars;
|
||||
serviceConfig.EnvironmentFile = [config.sops.secrets."mastodon/environment".path];
|
||||
};
|
||||
|
||||
systemd.services.mastodon-sidekiq-all.environment = config.networking.proxy.envVars;
|
||||
|
||||
services.jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
}
|
||||
|
|
6
hosts/blacksteel/services/jellyfin.nix
Normal file
6
hosts/blacksteel/services/jellyfin.nix
Normal file
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
services.jellyfin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
}
|
37
hosts/blacksteel/services/mastodon.nix
Normal file
37
hosts/blacksteel/services/mastodon.nix
Normal file
|
@ -0,0 +1,37 @@
|
|||
{config, ...}: {
|
||||
services.mastodon = {
|
||||
enable = true;
|
||||
localDomain = "ny4.dev";
|
||||
streamingProcesses = 1;
|
||||
mediaAutoRemove.olderThanDays = 14;
|
||||
# FIXME: this doesn't exist
|
||||
smtp = {
|
||||
createLocally = false;
|
||||
fromAddress = "mastodon@ny4.dev";
|
||||
};
|
||||
extraConfig = rec {
|
||||
SINGLE_USER_MODE = "true";
|
||||
WEB_DOMAIN = "mastodon.ny4.dev";
|
||||
|
||||
# keycloak
|
||||
OMNIAUTH_ONLY = "true";
|
||||
OIDC_ENABLED = "true";
|
||||
OIDC_CLIENT_ID = "mastodon";
|
||||
# OIDC_CLIENT_SECRET # EnvironmentFile
|
||||
OIDC_DISCOVERY = "true";
|
||||
OIDC_DISPLAY_NAME = "id.ny4.dev";
|
||||
OIDC_ISSUER = "https://id.ny4.dev/realms/ny4";
|
||||
OIDC_REDIRECT_URI = "https://${WEB_DOMAIN}/auth/auth/openid_connect/callback";
|
||||
OIDC_SCOPE = "openid,profile,email";
|
||||
OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED = "true";
|
||||
OIDC_UID_FIELD = "preferred_username";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.mastodon-web = {
|
||||
environment = config.networking.proxy.envVars;
|
||||
serviceConfig.EnvironmentFile = [config.sops.secrets."mastodon/environment".path];
|
||||
};
|
||||
|
||||
systemd.services.mastodon-sidekiq-all.environment = config.networking.proxy.envVars;
|
||||
}
|
62
hosts/blacksteel/services/matrix.nix
Normal file
62
hosts/blacksteel/services/matrix.nix
Normal file
|
@ -0,0 +1,62 @@
|
|||
{config, ...}: {
|
||||
services.matrix-synapse = {
|
||||
enable = true;
|
||||
withJemalloc = true;
|
||||
enableRegistrationScript = false;
|
||||
extraConfigFiles = [config.sops.secrets."synapse/secret".path];
|
||||
settings = {
|
||||
server_name = "ny4.dev";
|
||||
public_baseurl = "https://matrix.ny4.dev";
|
||||
presence.enabled = false; # tradeoff
|
||||
listeners = [
|
||||
{
|
||||
path = "/run/matrix-synapse/synapse.sock";
|
||||
type = "http";
|
||||
resources = [
|
||||
{
|
||||
names = ["client" "federation"];
|
||||
compress = true;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
|
||||
# https://element-hq.github.io/synapse/latest/openid.html#keycloak
|
||||
oidc_providers = [
|
||||
{
|
||||
idp_id = "keycloak";
|
||||
idp_name = "id.ny4.dev";
|
||||
issuer = "https://id.ny4.dev/realms/ny4";
|
||||
client_id = "synapse";
|
||||
client_secret_path = config.sops.secrets."synapse/oidc".path;
|
||||
scopes = ["openid" "profile"];
|
||||
user_mapping_provider.config = {
|
||||
localpart_template = "{{ user.preferred_username }}";
|
||||
display_name_template = "{{ user.name }}";
|
||||
};
|
||||
backchannel_logout_enabled = true;
|
||||
allow_existing_users = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.matrix-synapse = {
|
||||
environment = config.networking.proxy.envVars;
|
||||
serviceConfig.RuntimeDirectory = ["matrix-synapse"];
|
||||
};
|
||||
|
||||
services.matrix-sliding-sync = {
|
||||
enable = true;
|
||||
environmentFile = config.sops.secrets."syncv3/environment".path;
|
||||
settings = {
|
||||
SYNCV3_SERVER = "/run/matrix-synapse/synapse.sock";
|
||||
SYNCV3_BINDADDR = "/run/matrix-sliding-sync/sync.sock";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.matrix-sliding-sync.serviceConfig = {
|
||||
RuntimeDirectory = ["matrix-sliding-sync"];
|
||||
SupplementaryGroups = ["matrix-synapse"];
|
||||
};
|
||||
}
|
54
hosts/blacksteel/services/minecraft.nix
Normal file
54
hosts/blacksteel/services/minecraft.nix
Normal file
|
@ -0,0 +1,54 @@
|
|||
{
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
services.minecraft-server = {
|
||||
enable = true;
|
||||
eula = true;
|
||||
openFirewall = true;
|
||||
package = pkgs.minecraftServers.vanilla-1-21;
|
||||
|
||||
# Aikar's flag
|
||||
# https://aikar.co/2018/07/02/tuning-the-jvm-g1gc-garbage-collector-flags-for-minecraft/
|
||||
# https://docs.papermc.io/paper/aikars-flags
|
||||
jvmOpts = lib.concatStringsSep " " [
|
||||
"-Xms2G"
|
||||
"-Xmx2G"
|
||||
"-XX:+UseG1GC"
|
||||
"-XX:+ParallelRefProcEnabled"
|
||||
"-XX:MaxGCPauseMillis=200"
|
||||
"-XX:+UnlockExperimentalVMOptions"
|
||||
"-XX:+DisableExplicitGC"
|
||||
"-XX:+AlwaysPreTouch"
|
||||
"-XX:G1NewSizePercent=30"
|
||||
"-XX:G1MaxNewSizePercent=40"
|
||||
"-XX:G1HeapRegionSize=8M"
|
||||
"-XX:G1ReservePercent=20"
|
||||
"-XX:G1HeapWastePercent=5"
|
||||
"-XX:G1MixedGCCountTarget=4"
|
||||
"-XX:InitiatingHeapOccupancyPercent=15"
|
||||
"-XX:G1MixedGCLiveThresholdPercent=90"
|
||||
"-XX:G1RSetUpdatingPauseTimePercent=5"
|
||||
"-XX:SurvivorRatio=32"
|
||||
"-XX:+PerfDisableSharedMem"
|
||||
"-XX:MaxTenuringThreshold=1"
|
||||
"-Dusing.aikars.flags=https://mcflags.emc.gs"
|
||||
"-Daikars.new.flags=true"
|
||||
];
|
||||
|
||||
declarative = true;
|
||||
serverProperties = {
|
||||
motd = "NixOS Minecraft server!";
|
||||
white-list = true;
|
||||
|
||||
difficulty = 3;
|
||||
gamemode = 0;
|
||||
max-players = 5;
|
||||
};
|
||||
whitelist = {
|
||||
"Guanran928" = "86dbb6c5-8d8b-4c45-b8eb-b3fdf03bfb27";
|
||||
"i_love_ravens" = "2788dd4b-b010-4a2f-9b5c-aad0c0e0cba5";
|
||||
};
|
||||
};
|
||||
}
|
7
hosts/blacksteel/services/qbittorrent.nix
Normal file
7
hosts/blacksteel/services/qbittorrent.nix
Normal file
|
@ -0,0 +1,7 @@
|
|||
{pkgs, ...}: {
|
||||
# TODO: https://github.com/NixOS/nixpkgs/pull/287923
|
||||
# currently running qbittorrent-nox with tmux :c
|
||||
environment.systemPackages = with pkgs; [
|
||||
qbittorrent-nox
|
||||
];
|
||||
}
|
15
hosts/blacksteel/services/samba.nix
Normal file
15
hosts/blacksteel/services/samba.nix
Normal file
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
services.samba = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
shares."external" = {
|
||||
"path" = "/mnt";
|
||||
"read only" = "no";
|
||||
};
|
||||
};
|
||||
|
||||
services.samba-wsdd = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
};
|
||||
}
|
|
@ -16,7 +16,7 @@
|
|||
|
||||
networking.hostName = "dust";
|
||||
time.timeZone = "Asia/Shanghai";
|
||||
system.stateVersion = "23.11";
|
||||
system.stateVersion = "24.05";
|
||||
|
||||
home-manager.users.guanranwang = import ./home;
|
||||
|
||||
|
|
|
@ -1,249 +0,0 @@
|
|||
{
|
||||
lib,
|
||||
config,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
"${modulesPath}/virtualisation/amazon-image.nix"
|
||||
../../nixos/profiles/server
|
||||
./anti-feature.nix
|
||||
];
|
||||
|
||||
time.timeZone = "Asia/Tokyo";
|
||||
boot.loader.grub.device = lib.mkForce "/dev/nvme0n1";
|
||||
system.stateVersion = "23.11";
|
||||
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/var/lib/swapfile";
|
||||
size = 4 * 1024; # 4 GiB
|
||||
}
|
||||
];
|
||||
|
||||
# WORKAROUND:
|
||||
systemd.services."print-host-key".enable = false;
|
||||
|
||||
### Secrets
|
||||
sops.secrets = lib.mapAttrs (_name: value: value // {sopsFile = ./secrets.yaml;}) {
|
||||
"hysteria/auth" = {
|
||||
restartUnits = ["hysteria.service"];
|
||||
};
|
||||
"pixivfe/environment" = {
|
||||
restartUnits = ["pixivfe.service"];
|
||||
};
|
||||
"searx/environment" = {
|
||||
restartUnits = ["searx.service"];
|
||||
};
|
||||
"miniflux/environment" = {
|
||||
restartUnits = ["miniflux.service"];
|
||||
};
|
||||
};
|
||||
|
||||
### Services
|
||||
networking.firewall.allowedUDPPorts = [443]; # hysteria
|
||||
networking.firewall.allowedTCPPorts = [80 443]; # caddy
|
||||
|
||||
systemd.tmpfiles.settings = {
|
||||
"10-www" = {
|
||||
"/var/www/robots/robots.txt".C.argument = toString ./robots.txt;
|
||||
"/var/www/matrix/client".C.argument = toString ./matrix-client.json;
|
||||
"/var/www/matrix/server".C.argument = toString ./matrix-server.json;
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
configFile = pkgs.substituteAll {
|
||||
src = ./Caddyfile;
|
||||
|
||||
"element" = pkgs.element-web.override {
|
||||
element-web-unwrapped = pkgs.element-web-unwrapped.overrideAttrs (oldAttrs: {
|
||||
version = "1.11.72";
|
||||
src = oldAttrs.src.overrideAttrs {
|
||||
outputHash = "sha256-ZLSCbt00R3azFz2lOuj8yqaLFyobnmGmQKYOYLHCA1w=";
|
||||
};
|
||||
offlineCache = oldAttrs.offlineCache.overrideAttrs {
|
||||
outputHash = "sha256-7NXXjv7xNEBVRmWawpdfZBFV51hAspdP1oAURGaRg48=";
|
||||
};
|
||||
});
|
||||
|
||||
conf.default_server_config."m.homeserver" = {
|
||||
base_url = "https://matrix.ny4.dev";
|
||||
server_name = "ny4.dev";
|
||||
};
|
||||
};
|
||||
|
||||
"cinny" = pkgs.cinny.override {
|
||||
conf = {
|
||||
defaultHomeserver = 0;
|
||||
homeserverList = ["ny4.dev"];
|
||||
};
|
||||
};
|
||||
|
||||
"mastodon" = pkgs.mastodon;
|
||||
};
|
||||
};
|
||||
|
||||
services.hysteria = {
|
||||
enable = true;
|
||||
settings = {
|
||||
auth = {
|
||||
type = "userpass";
|
||||
userpass = {
|
||||
_secret = "/run/credentials/hysteria.service/auth";
|
||||
quote = false;
|
||||
};
|
||||
};
|
||||
masquerade = {
|
||||
type = "proxy";
|
||||
proxy.url = "https://ny4.dev/";
|
||||
};
|
||||
tls = {
|
||||
cert = "/run/credentials/hysteria.service/cert";
|
||||
key = "/run/credentials/hysteria.service/key";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."hysteria".serviceConfig.LoadCredential = [
|
||||
# FIXME: remove hardcoded path
|
||||
"auth:${config.sops.secrets."hysteria/auth".path}"
|
||||
"cert:/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/tyo0.ny4.dev/tyo0.ny4.dev.crt"
|
||||
"key:/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/tyo0.ny4.dev/tyo0.ny4.dev.key"
|
||||
];
|
||||
|
||||
# `journalctl -u murmur.service | grep Password`
|
||||
services.murmur = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
bandwidth = 256 * 1024; # 256 Kbit/s
|
||||
};
|
||||
|
||||
services.searx = {
|
||||
enable = true;
|
||||
package = pkgs.searxng;
|
||||
environmentFile = config.sops.secrets."searx/environment".path;
|
||||
settings = {
|
||||
general.contact_url = "mailto:guanran928@outlook.com";
|
||||
search.autocomplete = "google";
|
||||
server = {
|
||||
port = 8100;
|
||||
secret_key = "@SEARX_SECRET@";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.wastebin = {
|
||||
enable = true;
|
||||
settings.WASTEBIN_ADDRESS_PORT = "127.0.0.1:8200";
|
||||
};
|
||||
|
||||
services.uptime-kuma = {
|
||||
enable = true;
|
||||
settings.PORT = "8300";
|
||||
};
|
||||
|
||||
services.ntfy-sh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
base-url = "https://ntfy.ny4.dev";
|
||||
listen-http = "";
|
||||
listen-unix = "/run/ntfy-sh/ntfy.sock";
|
||||
listen-unix-mode = 511; # 0777
|
||||
behind-proxy = true;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.ntfy-sh.serviceConfig.RuntimeDirectory = ["ntfy-sh"];
|
||||
|
||||
services.pixivfe = {
|
||||
enable = true;
|
||||
EnvironmentFile = config.sops.secrets."pixivfe/environment".path;
|
||||
settings = {
|
||||
PIXIVFE_UNIXSOCKET = "/run/pixivfe/pixiv.sock";
|
||||
PIXIVFE_IMAGEPROXY = "https://i.pixiv.re";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.pixivfe.serviceConfig = {
|
||||
RuntimeDirectory = ["pixivfe"];
|
||||
ExecStartPost = pkgs.writeShellScript "pixivfe-unixsocket" ''
|
||||
${pkgs.coreutils}/bin/sleep 5
|
||||
${pkgs.coreutils}/bin/chmod 777 /run/pixivfe/pixiv.sock
|
||||
'';
|
||||
};
|
||||
|
||||
services.keycloak = {
|
||||
enable = true;
|
||||
settings = {
|
||||
cache = "local";
|
||||
hostname = "id.ny4.dev";
|
||||
http-host = "127.0.0.1";
|
||||
http-port = 8800;
|
||||
proxy = "edge";
|
||||
# proxy-headers = "xforwarded"; # FIXME: Key material not provided to setup HTTPS.
|
||||
};
|
||||
database.passwordFile = toString (pkgs.writeText "password" "keycloak");
|
||||
};
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
package = pkgs.forgejo;
|
||||
database.type = "postgres";
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "git.ny4.dev";
|
||||
PROTOCOL = "http+unix";
|
||||
ROOT_URL = "https://git.ny4.dev/";
|
||||
SSH_DOMAIN = "tyo0.ny4.dev";
|
||||
};
|
||||
|
||||
service = {
|
||||
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.miniflux = {
|
||||
enable = true;
|
||||
adminCredentialsFile = config.sops.secrets."miniflux/environment".path;
|
||||
config = {
|
||||
LISTEN_ADDR = "127.0.0.1:9300";
|
||||
BASE_URL = "https://rss.ny4.dev";
|
||||
|
||||
OAUTH2_PROVIDER = "oidc";
|
||||
OAUTH2_CLIENT_ID = "miniflux";
|
||||
# OAUTH2_CLIENT_SECRET = "replace_me"; # EnvironmentFile
|
||||
OAUTH2_REDIRECT_URL = "https://rss.ny4.dev/oauth2/oidc/callback";
|
||||
OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://id.ny4.dev/realms/ny4";
|
||||
};
|
||||
};
|
||||
|
||||
services.redlib = {
|
||||
enable = true;
|
||||
address = "127.0.0.1";
|
||||
port = 9400;
|
||||
};
|
||||
|
||||
### Prevents me from bankrupt
|
||||
# https://fmk.im/p/shutdown-aws/
|
||||
services.vnstat.enable = true;
|
||||
systemd.services."no-bankrupt" = {
|
||||
serviceConfig.Type = "oneshot";
|
||||
path = with pkgs; [coreutils gawk vnstat systemd];
|
||||
script = ''
|
||||
TRAFF_TOTAL=1900
|
||||
TRAFF_USED=$(vnstat --oneline b | awk -F ';' '{print $11}')
|
||||
CHANGE_TO_GB=$(($TRAFF_USED / 1073741824))
|
||||
|
||||
if [ $CHANGE_TO_GB -gt $TRAFF_TOTAL ]; then
|
||||
shutdown -h now
|
||||
fi
|
||||
'';
|
||||
};
|
||||
systemd.timers."no-bankrupt" = {
|
||||
timerConfig.OnCalendar = "*:0:0"; # Check every hour
|
||||
};
|
||||
}
|
151
hosts/tyo0/default.nix
Normal file
151
hosts/tyo0/default.nix
Normal file
|
@ -0,0 +1,151 @@
|
|||
{
|
||||
lib,
|
||||
modulesPath,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
"${modulesPath}/virtualisation/amazon-image.nix"
|
||||
../../nixos/profiles/server
|
||||
./anti-feature.nix
|
||||
|
||||
./services/forgejo.nix
|
||||
./services/hysteria.nix
|
||||
./services/keycloak.nix
|
||||
./services/miniflux.nix
|
||||
./services/murmur.nix
|
||||
./services/ntfy.nix
|
||||
./services/pixivfe.nix
|
||||
./services/searx.nix
|
||||
];
|
||||
|
||||
time.timeZone = "Asia/Tokyo";
|
||||
boot.loader.grub.device = lib.mkForce "/dev/nvme0n1";
|
||||
system.stateVersion = "24.05";
|
||||
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/var/lib/swapfile";
|
||||
size = 4 * 1024; # 4 GiB
|
||||
}
|
||||
];
|
||||
|
||||
# WORKAROUND:
|
||||
systemd.services."print-host-key".enable = false;
|
||||
|
||||
### Secrets
|
||||
sops.secrets = lib.mapAttrs (_name: value: value // {sopsFile = ./secrets.yaml;}) {
|
||||
"hysteria/auth" = {
|
||||
restartUnits = ["hysteria.service"];
|
||||
};
|
||||
"pixivfe/environment" = {
|
||||
restartUnits = ["pixivfe.service"];
|
||||
};
|
||||
"searx/environment" = {
|
||||
restartUnits = ["searx.service"];
|
||||
};
|
||||
"miniflux/environment" = {
|
||||
restartUnits = ["miniflux.service"];
|
||||
};
|
||||
};
|
||||
|
||||
### Services
|
||||
networking.firewall.allowedUDPPorts = [443]; # hysteria
|
||||
networking.firewall.allowedTCPPorts = [80 443]; # caddy
|
||||
|
||||
systemd.tmpfiles.settings = {
|
||||
"10-www" = {
|
||||
"/var/www/robots/robots.txt".C.argument = toString ./robots.txt;
|
||||
"/var/www/matrix/client".C.argument = toString ./matrix-client.json;
|
||||
"/var/www/matrix/server".C.argument = toString ./matrix-server.json;
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
configFile = pkgs.substituteAll {
|
||||
src = ./Caddyfile;
|
||||
|
||||
"element" = pkgs.element-web.override {
|
||||
element-web-unwrapped = pkgs.element-web-unwrapped.overrideAttrs (oldAttrs: {
|
||||
version = "1.11.74-rc.0";
|
||||
src = oldAttrs.src.overrideAttrs {
|
||||
outputHash = "sha256-Dik4vBzybkb6Q7OgEDrQ3FBaUGOmUxr9SplyNm1JWZU=";
|
||||
};
|
||||
offlineCache = oldAttrs.offlineCache.overrideAttrs {
|
||||
outputHash = "sha256-+SSsFUVIVuNpy+CQT6+oFIGvzQLAHEokibXtxsidumQ=";
|
||||
};
|
||||
});
|
||||
|
||||
conf.default_server_config."m.homeserver" = {
|
||||
base_url = "https://matrix.ny4.dev";
|
||||
server_name = "ny4.dev";
|
||||
};
|
||||
};
|
||||
|
||||
"cinny" = pkgs.cinny.override {
|
||||
conf = {
|
||||
defaultHomeserver = 0;
|
||||
homeserverList = ["ny4.dev"];
|
||||
};
|
||||
};
|
||||
|
||||
"mastodon" = pkgs.mastodon;
|
||||
};
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
package = pkgs.postgresql_16;
|
||||
settings = {
|
||||
max_connections = 200;
|
||||
shared_buffers = "256MB";
|
||||
effective_cache_size = "768MB";
|
||||
maintenance_work_mem = "64MB";
|
||||
checkpoint_completion_target = 0.9;
|
||||
wal_buffers = "7864kB";
|
||||
default_statistics_target = 100;
|
||||
random_page_cost = 1.1;
|
||||
effective_io_concurrency = 200;
|
||||
work_mem = "655kB";
|
||||
huge_pages = "off";
|
||||
min_wal_size = "1GB";
|
||||
max_wal_size = "4GB";
|
||||
};
|
||||
};
|
||||
|
||||
services.wastebin = {
|
||||
enable = true;
|
||||
settings.WASTEBIN_ADDRESS_PORT = "127.0.0.1:8200";
|
||||
};
|
||||
|
||||
services.uptime-kuma = {
|
||||
enable = true;
|
||||
settings.PORT = "8300";
|
||||
};
|
||||
|
||||
services.redlib = {
|
||||
enable = true;
|
||||
address = "127.0.0.1";
|
||||
port = 9400;
|
||||
};
|
||||
|
||||
### Prevents me from bankrupt
|
||||
# https://fmk.im/p/shutdown-aws/
|
||||
services.vnstat.enable = true;
|
||||
systemd.services."no-bankrupt" = {
|
||||
serviceConfig.Type = "oneshot";
|
||||
path = with pkgs; [coreutils gawk vnstat systemd];
|
||||
script = ''
|
||||
TRAFF_TOTAL=1900
|
||||
TRAFF_USED=$(vnstat --oneline b | awk -F ';' '{print $11}')
|
||||
CHANGE_TO_GB=$(($TRAFF_USED / 1073741824))
|
||||
|
||||
if [ $CHANGE_TO_GB -gt $TRAFF_TOTAL ]; then
|
||||
shutdown -h now
|
||||
fi
|
||||
'';
|
||||
};
|
||||
systemd.timers."no-bankrupt" = {
|
||||
timerConfig.OnCalendar = "*:0:0"; # Check every hour
|
||||
};
|
||||
}
|
19
hosts/tyo0/services/forgejo.nix
Normal file
19
hosts/tyo0/services/forgejo.nix
Normal file
|
@ -0,0 +1,19 @@
|
|||
{pkgs, ...}: {
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
package = pkgs.forgejo;
|
||||
database.type = "postgres";
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "git.ny4.dev";
|
||||
PROTOCOL = "http+unix";
|
||||
ROOT_URL = "https://git.ny4.dev/";
|
||||
SSH_DOMAIN = "tyo0.ny4.dev";
|
||||
};
|
||||
|
||||
service = {
|
||||
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
29
hosts/tyo0/services/hysteria.nix
Normal file
29
hosts/tyo0/services/hysteria.nix
Normal file
|
@ -0,0 +1,29 @@
|
|||
{config, ...}: {
|
||||
services.hysteria = {
|
||||
enable = true;
|
||||
settings = {
|
||||
auth = {
|
||||
type = "userpass";
|
||||
userpass = {
|
||||
_secret = "/run/credentials/hysteria.service/auth";
|
||||
quote = false;
|
||||
};
|
||||
};
|
||||
masquerade = {
|
||||
type = "proxy";
|
||||
proxy.url = "https://ny4.dev/";
|
||||
};
|
||||
tls = {
|
||||
cert = "/run/credentials/hysteria.service/cert";
|
||||
key = "/run/credentials/hysteria.service/key";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."hysteria".serviceConfig.LoadCredential = [
|
||||
# FIXME: remove hardcoded path
|
||||
"auth:${config.sops.secrets."hysteria/auth".path}"
|
||||
"cert:/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/tyo0.ny4.dev/tyo0.ny4.dev.crt"
|
||||
"key:/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/tyo0.ny4.dev/tyo0.ny4.dev.key"
|
||||
];
|
||||
}
|
14
hosts/tyo0/services/keycloak.nix
Normal file
14
hosts/tyo0/services/keycloak.nix
Normal file
|
@ -0,0 +1,14 @@
|
|||
{pkgs, ...}: {
|
||||
services.keycloak = {
|
||||
enable = true;
|
||||
settings = {
|
||||
cache = "local";
|
||||
hostname = "id.ny4.dev";
|
||||
http-host = "127.0.0.1";
|
||||
http-port = 8800;
|
||||
proxy = "edge";
|
||||
# proxy-headers = "xforwarded"; # FIXME: Key material not provided to setup HTTPS.
|
||||
};
|
||||
database.passwordFile = toString (pkgs.writeText "password" "keycloak");
|
||||
};
|
||||
}
|
16
hosts/tyo0/services/miniflux.nix
Normal file
16
hosts/tyo0/services/miniflux.nix
Normal file
|
@ -0,0 +1,16 @@
|
|||
{config, ...}: {
|
||||
services.miniflux = {
|
||||
enable = true;
|
||||
adminCredentialsFile = config.sops.secrets."miniflux/environment".path;
|
||||
config = {
|
||||
LISTEN_ADDR = "127.0.0.1:9300";
|
||||
BASE_URL = "https://rss.ny4.dev";
|
||||
|
||||
OAUTH2_PROVIDER = "oidc";
|
||||
OAUTH2_CLIENT_ID = "miniflux";
|
||||
# OAUTH2_CLIENT_SECRET = "replace_me"; # EnvironmentFile
|
||||
OAUTH2_REDIRECT_URL = "https://rss.ny4.dev/oauth2/oidc/callback";
|
||||
OAUTH2_OIDC_DISCOVERY_ENDPOINT = "https://id.ny4.dev/realms/ny4";
|
||||
};
|
||||
};
|
||||
}
|
8
hosts/tyo0/services/murmur.nix
Normal file
8
hosts/tyo0/services/murmur.nix
Normal file
|
@ -0,0 +1,8 @@
|
|||
{
|
||||
# `journalctl -u murmur.service | grep Password`
|
||||
services.murmur = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
bandwidth = 256 * 1024; # 256 Kbit/s
|
||||
};
|
||||
}
|
14
hosts/tyo0/services/ntfy.nix
Normal file
14
hosts/tyo0/services/ntfy.nix
Normal file
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
services.ntfy-sh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
base-url = "https://ntfy.ny4.dev";
|
||||
listen-http = "";
|
||||
listen-unix = "/run/ntfy-sh/ntfy.sock";
|
||||
listen-unix-mode = 511; # 0777
|
||||
behind-proxy = true;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.ntfy-sh.serviceConfig.RuntimeDirectory = ["ntfy-sh"];
|
||||
}
|
22
hosts/tyo0/services/pixivfe.nix
Normal file
22
hosts/tyo0/services/pixivfe.nix
Normal file
|
@ -0,0 +1,22 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
services.pixivfe = {
|
||||
enable = true;
|
||||
EnvironmentFile = config.sops.secrets."pixivfe/environment".path;
|
||||
settings = {
|
||||
PIXIVFE_UNIXSOCKET = "/run/pixivfe/pixiv.sock";
|
||||
PIXIVFE_IMAGEPROXY = "https://i.pixiv.re";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.pixivfe.serviceConfig = {
|
||||
RuntimeDirectory = ["pixivfe"];
|
||||
ExecStartPost = pkgs.writeShellScript "pixivfe-unixsocket" ''
|
||||
${pkgs.coreutils}/bin/sleep 5
|
||||
${pkgs.coreutils}/bin/chmod 777 /run/pixivfe/pixiv.sock
|
||||
'';
|
||||
};
|
||||
}
|
19
hosts/tyo0/services/searx.nix
Normal file
19
hosts/tyo0/services/searx.nix
Normal file
|
@ -0,0 +1,19 @@
|
|||
{
|
||||
pkgs,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
services.searx = {
|
||||
enable = true;
|
||||
package = pkgs.searxng;
|
||||
environmentFile = config.sops.secrets."searx/environment".path;
|
||||
settings = {
|
||||
general.contact_url = "mailto:guanran928@outlook.com";
|
||||
search.autocomplete = "google";
|
||||
server = {
|
||||
port = 8100;
|
||||
secret_key = "@SEARX_SECRET@";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
|
@ -11,7 +11,6 @@ use: &use
|
|||
type: select
|
||||
use:
|
||||
- efcloud
|
||||
- flyairport
|
||||
- spcloud
|
||||
|
||||
port: 7890
|
||||
|
@ -30,9 +29,6 @@ proxy-providers:
|
|||
efcloud:
|
||||
<<: *fetch
|
||||
url: "@clash/proxy-providers/efcloud@"
|
||||
flyairport:
|
||||
<<: *fetch
|
||||
url: "@clash/proxy-providers/flyairport@"
|
||||
spcloud:
|
||||
<<: *fetch
|
||||
url: "@clash/proxy-providers/spcloud@"
|
||||
|
|
|
@ -10,10 +10,10 @@
|
|||
webui = pkgs.metacubexd;
|
||||
};
|
||||
|
||||
systemd.services.mihomo.serviceConfig.ExecStartPre = [
|
||||
"${pkgs.coreutils}/bin/ln -sf ${pkgs.v2ray-geoip}/share/v2ray/geoip.dat /var/lib/private/mihomo/GeoIP.dat"
|
||||
"${pkgs.coreutils}/bin/ln -sf ${pkgs.v2ray-domain-list-community}/share/v2ray/geosite.dat /var/lib/private/mihomo/GeoSite.dat"
|
||||
];
|
||||
systemd.services.mihomo.serviceConfig.preStart = ''
|
||||
${pkgs.coreutils}/bin/ln -sf ${pkgs.v2ray-geoip}/share/v2ray/geoip.dat /var/lib/private/mihomo/GeoIP.dat
|
||||
${pkgs.coreutils}/bin/ln -sf ${pkgs.v2ray-domain-list-community}/share/v2ray/geosite.dat /var/lib/private/mihomo/GeoSite.dat
|
||||
'';
|
||||
|
||||
### System proxy settings
|
||||
networking.proxy.default = "http://127.0.0.1:7890/";
|
||||
|
@ -34,13 +34,12 @@
|
|||
"clash/secret" = {};
|
||||
"clash/proxies/lightsail" = {};
|
||||
"clash/proxy-providers/efcloud" = {};
|
||||
"clash/proxy-providers/flyairport" = {};
|
||||
"clash/proxy-providers/spcloud" = {};
|
||||
};
|
||||
|
||||
# why not substituteAll? see https://github.com/NixOS/nixpkgs/issues/237216
|
||||
sops.templates."clash.yaml".file = let
|
||||
substituteV2 = {src, ...} @ args: let
|
||||
substituteAll' = {src, ...} @ args: let
|
||||
args' = lib.removeAttrs args ["src"];
|
||||
in
|
||||
pkgs.substitute {
|
||||
|
@ -48,14 +47,13 @@
|
|||
substitutions = lib.flatten (lib.mapAttrsToList (n: v: ["--subst-var-by" n v]) args');
|
||||
};
|
||||
in
|
||||
substituteV2 {
|
||||
substituteAll' {
|
||||
src = ./config.yaml;
|
||||
inherit
|
||||
(config.sops.placeholder)
|
||||
"clash/secret"
|
||||
"clash/proxies/lightsail"
|
||||
"clash/proxy-providers/efcloud"
|
||||
"clash/proxy-providers/flyairport"
|
||||
"clash/proxy-providers/spcloud"
|
||||
;
|
||||
};
|
||||
|
|
|
@ -3,7 +3,6 @@ clash:
|
|||
proxies:
|
||||
lightsail: ENC[AES256_GCM,data:YfyZsBi3yMIAMIjotAk4g4M+yYYozSSbKE77oz3lwbRHCMVJqxeo5nR04HrG8Hy2mQvVV09et1MbgnDMhEaSERZvsfaBojFUoRE6Du18n1ET8P1/ez5aKgC6ZnHy90a99mktqD4QDGNE8VDX2xBtNcVLF6i9dJ9di9tJEtnOdw+Q,iv:/uqtX6E2I0sqSWt2FmKwzG9zQb2TjdQqfDBZQXLh8cs=,tag:ofvc5GKEPrizajUaevI1jA==,type:str]
|
||||
proxy-providers:
|
||||
flyairport: ENC[AES256_GCM,data:x6li/5tWuAX9ZvLVUETLaBDqjB8pb8vSD9jD8HDMXNiiilq03RVHx7eXTiWMVJMlRUBOxvhTXH1fQxzye34aZQMx4BftMOQzvG5soF/P+K5hGapC9wbFnoH8znHkAdIgRLIeDBHRix3ll2OqGhqCENkWF4jjs/Pxqfz5bJlhcA==,iv:lO59riu5seloBRIy8QG02afNciEKvElzovLyaX90iSA=,tag:/L+elOLB2agQdRvg9tR0WQ==,type:str]
|
||||
efcloud: ENC[AES256_GCM,data:36mToXGiHVAgM4vVQFOYvNPaHHuVf4mtvnNOgMBTyzbZ/mKpT1Exx7rWZ7i9EVBy5eX7SJtKmnHs0CqD48hr7R708W2oW3YNPEfkK7aGDqfQFyS1TVjT+MM=,iv:+qiFyM10fcAjcdyVZCC+0hb83GYENooM52+1GPXpamQ=,tag:wZupiFJMQq8A5ZwJtjXiOg==,type:str]
|
||||
spcloud: ENC[AES256_GCM,data:gmJM+sTTaUrIxQXRBlDtE+K1gEfseMPUC2AQLq1LeY6iQmgq3wK7oJlz+buLbm/LUDitvls9d517905hz/Mpp2F7ohBeW9m1Jkcvdh/Zfgnfqg==,iv:FPe//+/ZMDZloZg2AnQ7JXRzqZdKDjLYs3wqMxqNA/Y=,tag:JPEU/WnUfy8bNlhAgPQwJw==,type:str]
|
||||
sops:
|
||||
|
@ -48,8 +47,8 @@ sops:
|
|||
UG9TTEV5R0R2bm5lUTAwSWlaelJFcW8KfBuQEVhkYJ74wYUjEcFYXFf9oWSSdkGR
|
||||
Yu5lpV9UsjaiJxaD1Qp4xtNgMzzLW7q6surQGEReTDBbN1ZCx+S3Aw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2024-07-09T22:04:17Z"
|
||||
mac: ENC[AES256_GCM,data:iKwYqxBllI8SydCUjyK2cJkcUKVj4CqjmfDSMNJtLwM6IWUoOScV4Pu0YJz0aui5F8nbyC92vdDwsE599GZMTWdCH20MeWEMo7pbkPFxxL1bY5BMCNNE3Tm354nz4ihmBXMB9aI1JRiSareV5yQ1v6lOxzDargDigMrPI/6DRfo=,iv:JRvJQ3YdFZsBstT55xKcCMGJODy42FImugHbwEbpV2I=,tag:go33lpTdouZoFk53g9FXTw==,type:str]
|
||||
lastmodified: "2024-08-10T15:24:00Z"
|
||||
mac: ENC[AES256_GCM,data:BGF/DAfOhdw0YZ6PGipXu0sL9+8E1s509bg89dMnAtf1WfreFCQMuHe7uqfkC3Be99proNgJ1O5fWTENaynXyMKto1YF+7z9ZZ3CCOceFLNqbBucaxRFAO+tkMlVixLoqIvEHdyoZD+iM45wOO6mn+/o6wR/z3Ze36wmZCJ1+4c=,iv:s9N2lNx1SwPm0qNyqgGm2Qp5zS4xIhxwp2kj7sQmcQc=,tag:o1/WS7b7FR//IZK1iNQkCg==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.9.0
|
||||
|
|
|
@ -2,15 +2,15 @@
|
|||
projectRootFile = "flake.nix";
|
||||
|
||||
### nix
|
||||
programs.alejandra.enable = true;
|
||||
programs.deadnix.enable = true;
|
||||
programs.statix.enable = true;
|
||||
programs.alejandra.enable = true;
|
||||
|
||||
### misc
|
||||
programs.prettier.enable = true;
|
||||
settings.formatter.prettier.excludes = [
|
||||
"hosts/blacksteel/secrets.yaml"
|
||||
"hosts/lightsail-tokyo/secrets.yaml"
|
||||
"hosts/tyo0/secrets.yaml"
|
||||
"nixos/profiles/opt-in/mihomo/secrets.yaml"
|
||||
"nixos/profiles/opt-in/wireless/secrets.yaml"
|
||||
"secrets.yaml"
|
||||
|
|
Loading…
Reference in a new issue