From ed979a450a37fd9761c1ba8393e4ee9dd243b81d Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Mon, 3 Mar 2025 11:48:26 -0500 Subject: early feb sprint --- flake.lock | 8 ++--- flake.nix | 2 +- machines/radon/default.nix | 15 ++------- machines/t1/default.nix | 23 +++++++++----- machines/xnet/default.nix | 2 ++ machines/xnet/desktop/default.nix | 10 ++++-- machines/xnet/net/dns.nix | 64 +++++++++++++++++++-------------------- machines/xnet/persist.nix | 2 +- mod/tools/typst/default.nix | 4 +-- mod/tools/typst/main.typ | 1 + mod/users/kle/default.nix | 3 +- 11 files changed, 69 insertions(+), 65 deletions(-) create mode 100644 mod/tools/typst/main.typ diff --git a/flake.lock b/flake.lock index 93e38cf..87bcbbb 100644 --- a/flake.lock +++ b/flake.lock @@ -59,16 +59,16 @@ }, "nixpkgs": { "locked": { - "lastModified": 1731755305, - "narHash": "sha256-v5P3dk5JdiT+4x69ZaB18B8+Rcu3TIOrcdG4uEX7WZ8=", + "lastModified": 1740126099, + "narHash": "sha256-ozoOtE2hGsqh4XkTJFsrTkNxkRgShxpQxDynaPZUGxk=", "owner": "nixos", "repo": "nixpkgs", - "rev": "057f63b6dc1a2c67301286152eb5af20747a9cb4", + "rev": "32fb99ba93fea2798be0e997ea331dd78167f814", "type": "github" }, "original": { "owner": "nixos", - "ref": "nixos-24.11", + "ref": "nixos-unstable", "repo": "nixpkgs", "type": "github" } diff --git a/flake.nix b/flake.nix index 700f230..456d147 100644 --- a/flake.nix +++ b/flake.nix @@ -2,7 +2,7 @@ description = "Personal monorepo"; inputs = { - nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11"; + nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable"; disko.url = "github:nix-community/disko/v1.6.1"; disko.inputs.nixpkgs.follows = "nixpkgs"; diff --git a/machines/radon/default.nix b/machines/radon/default.nix index e1a62e5..59a4042 100644 --- a/machines/radon/default.nix +++ b/machines/radon/default.nix @@ -15,7 +15,7 @@ in imports = [ common-cpu-intel common-gpu-intel - ./jellyfin.nix + # ./jellyfin.nix ./pxeboot.nix ]; @@ -27,24 +27,13 @@ in "net.ipv6.conf.all.forwarding" = true; }; - services.unbound.settings.server = { - interface = [ "10.88.88.2" ]; - access-control = [ - "10.88.88.0/24 allow" - ]; - }; - - networking.firewall.interfaces.plaza = { - allowedTCPPorts = [ 53 ]; - allowedUDPPorts = [ 53 ]; - }; - users.groups.media.gid = 2000; boot.zfs.pools.radon.devNodes = "/dev/disk/by-id/"; boot.zfs.extraPools = [ "radon" ]; services.nfs.server.enable = true; + networking.firewall.allowedTCPPorts = [ 2049 ]; xnet = { disk = { diff --git a/machines/t1/default.nix b/machines/t1/default.nix index e68eece..68bc7b9 100644 --- a/machines/t1/default.nix +++ b/machines/t1/default.nix @@ -20,7 +20,11 @@ in xnet = { desktop.enable = true; - net.join = [ "plaza" ]; + net = { + interface = "enp5s0"; + join = [ "plaza" ]; + sshd.enable = true; + }; disk = { enable = true; device = "/dev/nvme0n1"; @@ -31,12 +35,7 @@ in hostName = "t1"; }; - nixpkgs.config.allowNonFree = true; - programs = { - # override default from xnet - light.enable = false; - steam.enable = true; corectrl = { enable = true; @@ -44,8 +43,18 @@ in }; }; + fileSystems."/mnt/media" = { + device = "radon:/radon/media"; + fsType = "nfs"; + options = [ "noauto" "x-systemd.automount" "x-systemd.idle-timeout=600" ]; + }; + + services.udev.packages = [ pkgs.ddcutil ]; + environment.shellAliases.b = "${pkgs.ddcutil}/bin/ddcutil setvcp 10"; + environment.systemPackages = with pkgs; [ - spotify + ddcutil prismlauncher + spotify ]; } diff --git a/machines/xnet/default.nix b/machines/xnet/default.nix index 808bebc..455be0b 100644 --- a/machines/xnet/default.nix +++ b/machines/xnet/default.nix @@ -73,6 +73,8 @@ in extraConfig = "Defaults lecture = never"; }; + nixpkgs.config.allowUnfree = true; + programs.ssh = { knownHosts = { "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"; diff --git a/machines/xnet/desktop/default.nix b/machines/xnet/desktop/default.nix index 0063a66..04a1250 100644 --- a/machines/xnet/desktop/default.nix +++ b/machines/xnet/desktop/default.nix @@ -65,10 +65,11 @@ in fonts.packages = with pkgs; [ departure-mono + iosevka noto-fonts noto-fonts-cjk-sans noto-fonts-emoji - (nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; }) + nerd-fonts.symbols-only terminus_font ]; @@ -80,6 +81,8 @@ in ]; }; + environment.systemPackages = [ pkgs.man-pages pkgs.man-pages-posix ]; + programs = { fish = { enable = true; @@ -120,16 +123,17 @@ in yubikey-agent.enable = true; pcscd.enable = true; udev.packages = with pkgs; [ yubikey-personalization ]; + udisks2.enable = true; }; - services.udisks2.enable = true; - programs.firefox = { enable = true; preferences = { # Enable hardware transcoding "media.ffmpeg.vaapi.enabled" = true; + # Disable controlling media with keyboard + "media.hardwaremediakeys.enabled" = false; # Enable legacy compact mode "browser.compactmode.show" = true; "browser.uidensity" = 1; diff --git a/machines/xnet/net/dns.nix b/machines/xnet/net/dns.nix index 579d6aa..186e43c 100644 --- a/machines/xnet/net/dns.nix +++ b/machines/xnet/net/dns.nix @@ -1,39 +1,37 @@ -{ ... }: { - services.resolved.enable = false; +{ lib, ... }: +let + inherit (lib) + mkDefault + ; - services.unbound = { - enable = true; - settings.server = { - interface = [ "127.0.0.1" ]; - access-control = [ - "0.0.0.0/0 refuse" - "127.0.0.0/8 allow" - ]; - - private-domain = [ ]; - private-address = [ ]; + quad9 = [ + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + "2620:fe::fe#dns.quad9.net" + "2620:fe::9#dns.quad9.net" + ]; - harden-glue = true; - harden-dnssec-stripped = true; - use-caps-for-id = false; - prefetch = true; - edns-buffer-size = 1232; - hide-identity = true; - hide-version = true; - tls-system-cert = true; - }; + cloudflare = [ + "1.1.1.1#one.one.one.one" + "1.0.0.1#one.one.one.one" + "2606:4700:4700::1111#one.one.one.one" + "2606:4700:4700::1001#one.one.one.one" + ]; +in +{ - settings.forward-zone = [{ - name = "."; - forward-tls-upstream = true; - forward-addr = [ - "9.9.9.9#dns.quad9.net" - "149.112.112.112#dns.quad9.net" - ]; - }]; - }; + networking.nameservers = mkDefault [ + "9.9.9.9#dns.quad9.net" + "149.112.112.112#dns.quad9.net" + "2620:fe::fe#dns.quad9.net" + "2620:fe::9#dns.quad9.net" + ]; - networking = { - nameservers = [ "::1" ]; + services.resolved = { + enable = true; + llmnr = "true"; + dnssec = "false"; + dnsovertls = mkDefault "opportunistic"; + fallbackDns = quad9 ++ cloudflare; }; } diff --git a/machines/xnet/persist.nix b/machines/xnet/persist.nix index 0ace84f..10eb883 100644 --- a/machines/xnet/persist.nix +++ b/machines/xnet/persist.nix @@ -50,7 +50,7 @@ in mode = if isString entry then "-" else entry.mode; dent = "d /persist${path} ${mode} ${user} ${group} - -"; - link = "L ${path} - - - - /persist${path}"; + link = "L+ ${path} - - - - /persist${path}"; perm = "Z ${mode} ${user} ${group} - -"; in [ dent link perm ]; diff --git a/mod/tools/typst/default.nix b/mod/tools/typst/default.nix index dc3eab2..1871cc6 100644 --- a/mod/tools/typst/default.nix +++ b/mod/tools/typst/default.nix @@ -28,7 +28,7 @@ in depotPackages ]; - # shellHook = "export TYPST_PACKAGE_PATH=${depotPackages}/share"; - shellHook = "alias typst='XDG_DATA_HOME=${depotPackages}/share typst'"; + shellHook = "export TYPST_PACKAGE_PATH=${depotPackages}/share/typst"; + # shellHook = "alias typst='XDG_DATA_HOME=${depotPackages}/share typst'"; }; } diff --git a/mod/tools/typst/main.typ b/mod/tools/typst/main.typ new file mode 100644 index 0000000..c6be2b4 --- /dev/null +++ b/mod/tools/typst/main.typ @@ -0,0 +1 @@ +#import "@depot/tmu:0.0.0": * diff --git a/mod/users/kle/default.nix b/mod/users/kle/default.nix index d8fd3a2..fca1ec7 100644 --- a/mod/users/kle/default.nix +++ b/mod/users/kle/default.nix @@ -16,6 +16,7 @@ let keys = { t480 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd"; + t1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9"; }; in { @@ -30,10 +31,10 @@ in createHome = true; extraGroups = [ "wheel" "users" "networkmanager" "video" "corectrl" ]; packages = with pkgs; [ - # utilities btop curl fzf + guvcview jq lynx neovim -- cgit v1.3.1