From eb13a9a552f9e50a66faba985521ba8e3483c447 Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Tue, 17 Dec 2024 23:03:27 -0500 Subject: Push configuration out of flake Projects are not necessarily all exported by the system flake, and should freely support other derivations. The new "mod" directory will be used for most projects, and it can be imported by machine configurations. That said, the tooling around flakes is pretty good and will still be used until the dependency is lessened. --- modules/flake-module.nix | 6 -- modules/xlib/default.nix | 1 - modules/xnet/default.nix | 39 --------- modules/xnet/desktop/default.nix | 125 ----------------------------- modules/xnet/disk.nix | 139 --------------------------------- modules/xnet/gitserver/default.nix | 54 ------------- modules/xnet/gitserver/gitweb.nix | 75 ------------------ modules/xnet/monitoring/default.nix | 38 --------- modules/xnet/monitoring/grafana.nix | 51 ------------ modules/xnet/monitoring/prometheus.nix | 15 ---- modules/xnet/net/default.nix | 44 ----------- modules/xnet/net/sshd.nix | 46 ----------- modules/xnet/nginx.nix | 28 ------- modules/xnet/users.nix | 74 ------------------ 14 files changed, 735 deletions(-) delete mode 100644 modules/flake-module.nix delete mode 100644 modules/xlib/default.nix delete mode 100644 modules/xnet/default.nix delete mode 100644 modules/xnet/desktop/default.nix delete mode 100644 modules/xnet/disk.nix delete mode 100644 modules/xnet/gitserver/default.nix delete mode 100644 modules/xnet/gitserver/gitweb.nix delete mode 100644 modules/xnet/monitoring/default.nix delete mode 100644 modules/xnet/monitoring/grafana.nix delete mode 100644 modules/xnet/monitoring/prometheus.nix delete mode 100644 modules/xnet/net/default.nix delete mode 100644 modules/xnet/net/sshd.nix delete mode 100644 modules/xnet/nginx.nix delete mode 100644 modules/xnet/users.nix (limited to 'modules') diff --git a/modules/flake-module.nix b/modules/flake-module.nix deleted file mode 100644 index 40ec4b4..0000000 --- a/modules/flake-module.nix +++ /dev/null @@ -1,6 +0,0 @@ -{ inputs, ... }: { - flake.nixosModules = { - xnet.imports = [ ./xnet inputs.disko.nixosModules.disko ]; - xlib.imports = [ ./xlib ]; - }; -} diff --git a/modules/xlib/default.nix b/modules/xlib/default.nix deleted file mode 100644 index c915eb0..0000000 --- a/modules/xlib/default.nix +++ /dev/null @@ -1 +0,0 @@ -{ ... }: { } diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix deleted file mode 100644 index a2fb336..0000000 --- a/modules/xnet/default.nix +++ /dev/null @@ -1,39 +0,0 @@ -{ lib, ... }: -let - inherit (lib) mkDefault; -in -{ - imports = [ - ./disk.nix - ./users.nix - ./nginx.nix - ./net - ./desktop - ./gitserver - # ./monitoring - ]; - - i18n.defaultLocale = mkDefault "en_US.UTF-8"; - time.timeZone = mkDefault "America/Toronto"; - - nix = { - settings = { - allowUnfree = true; - auto-optimise-store = true; - experimental-features = [ "nix-command" "flakes" ]; - warn-dirty = false; - - # timeout fast from binary cache - connect-timeout = 5; - }; - gc = { - automatic = true; - options = mkDefault "--delete-older-than 30d"; - }; - }; - - documentation = { - doc.enable = mkDefault false; - info.enable = mkDefault false; - }; -} diff --git a/modules/xnet/desktop/default.nix b/modules/xnet/desktop/default.nix deleted file mode 100644 index 2eeb272..0000000 --- a/modules/xnet/desktop/default.nix +++ /dev/null @@ -1,125 +0,0 @@ -{ config, lib, pkgs, ... }: -let - cfg = config.xnet.desktop; - inherit (lib) mkDefault mkOption mkIf types; -in -{ - options.xnet.desktop = { - enable = mkOption { - type = types.bool; - default = false; - description = "Enable graphical desktop."; - }; - }; - - config = mkIf cfg.enable { - security.rtkit.enable = true; - services.pipewire = { - enable = true; - pulse.enable = true; - alsa = { - enable = true; - support32Bit = true; - }; - }; - - programs.sway = { - enable = true; - wrapperFeatures = { - gtk = true; - base = true; - }; - extraPackages = with pkgs; [ - foot - fuzzel - imv - mako - mpv - playerctl - pop-icon-theme - pwvucontrol - sway-contrib.grimshot - swayidle - swaylock - tigervnc - waybar - wl-clipboard - xwayland - zathura - ]; - extraSessionCommands = '' - export MOZ_ENABLE_WAYLAND=1 - export MOZ_USE_XINPUT2=1 - export MOZ_WEBRENDER=1 - export XDG_CURRENT_DESKTOP=sway - export XDG_SESSION_TYPE=wayland - ''; - }; - - programs.light.enable = mkDefault true; - - qt = { - enable = true; - style = "adwaita-dark"; - platformTheme = "gnome"; - }; - - fonts.packages = with pkgs; [ - departure-mono - noto-fonts - noto-fonts-cjk-sans - noto-fonts-emoji - (nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; }) - ]; - - xdg.portal = { - enable = true; - extraPortals = with pkgs; [ - xdg-desktop-portal-wlr - xdg-desktop-portal-gtk - ]; - }; - - programs.firefox = { - enable = true; - policies = { - DisableTelemetry = true; - DisableFirefoxStudies = true; - EnableTrackingProtection = { - Value = true; - Locked = true; - Cryptomining = true; - Fingerprinting = true; - }; - DisablePocket = true; - DisableFirefoxAccounts = true; - DisableAccounts = true; - DisableFirefoxScreenshots = true; - OverrideFirstRunPage = ""; - OverridePostUpdatePage = ""; - DontCheckDefaultBrowser = true; - DisplayBookmarksToolbar = "never"; - DisplayMenuBar = "default-off"; - SearchBar = "unified"; - ExtensionSettings = { - "*".installation_mode = "blocked"; # blocks all addons except the ones specified below - # uBlock Origin: - "uBlock0@raymondhill.net" = { - install_url = "https://addons.mozilla.org/firefox/downloads/latest/ublock-origin/latest.xpi"; - installation_mode = "force_installed"; - }; - # Bitwarden: - "{446900e4-71c2-419f-a6a7-df9c091e268b}" = { - install_url = "https://addons.mozilla.org/firefox/downloads/latest/bitwarden-password-manager/latest.xpi"; - installation_mode = "force_installed"; - }; - # Dark Reader: - "addon@darkreader.org" = { - install_url = "https://addons.mozilla.org/firefox/downloads/latest/darkreader/latest.xpi"; - installation_mode = "force_installed"; - }; - }; - }; - }; - }; -} diff --git a/modules/xnet/disk.nix b/modules/xnet/disk.nix deleted file mode 100644 index caef61d..0000000 --- a/modules/xnet/disk.nix +++ /dev/null @@ -1,139 +0,0 @@ -{ config, lib, modulesPath, ... }: -let - cfg = config.xnet.disk; - commonOpts = { - acltype = "posixacl"; - atime = "off"; - compression = "on"; - normalization = "formD"; - relatime = "off"; - xattr = "sa"; - "com.sun:auto-snapshot" = "false"; - }; - - inherit (lib) mkOption mkDefault mkIf types; -in -{ - imports = [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; - - options.xnet.disk = { - enable = mkOption { - type = types.bool; - default = false; - description = "Apply xnet-standard ZFS disk layout."; - }; - - device = mkOption { - type = types.str; - description = "Device used for zroot ZFS pool."; - }; - }; - - config = mkIf cfg.enable { - networking.hostId = builtins.substring 0 8 - (builtins.hashString "md5" config.networking.hostName); - - services.zfs = { - autoScrub.enable = true; - trim.enable = true; - }; - - # With root running in memory, swap should be required unless - # otherwise specified - zramSwap.enable = mkDefault true; - - boot = { - kernelParams = [ "nohibernate" "elevator=none" ]; - supportedFilesystems = [ "vfat" "zfs" ]; - zfs.devNodes = "/dev/disk/by-partuuid"; - loader = { - systemd-boot.enable = true; - efi.canTouchEfiVariables = true; - }; - initrd = { - systemd.enable = true; - availableKernelModules = [ - "xhci_pci" - "ahci" - "nvme" - "usb_storage" - "sd_mod" - "sdhci_pci" - ]; - }; - tmp.cleanOnBoot = mkDefault true; - }; - - disko.devices.disk.main = { - type = "disk"; - device = cfg.device; - content = { - type = "gpt"; - partitions.ESP = { - size = "1G"; - type = "EF00"; - content = { - type = "filesystem"; - format = "vfat"; - mountpoint = "/boot"; - }; - }; - partitions.ZFS = { - size = "100%"; - content = { - type = "zfs"; - pool = "zroot"; - }; - }; - }; - }; - - disko.devices = { - nodev."/" = { - fsType = "tmpfs"; - mountOptions = [ "defaults" "size=2G" "mode=755" ]; - }; - - zpool.zroot = { - type = "zpool"; - options = { - ashift = "12"; - autotrim = "on"; - }; - - datasets = { - "local" = { - type = "zfs_fs"; - options = commonOpts // { - mountpoint = "none"; - }; - }; - - "local/nix" = { - type = "zfs_fs"; - mountpoint = "/nix"; - options.mountpoint = "legacy"; - }; - - "local/reserved" = { - type = "zfs_fs"; - options = { - refreservation = "10G"; - mountpoint = "none"; - }; - }; - - "persist" = { - type = "zfs_fs"; - mountpoint = "/persist"; - options = commonOpts // { - mountpoint = "legacy"; - }; - }; - }; - }; - }; - }; -} diff --git a/modules/xnet/gitserver/default.nix b/modules/xnet/gitserver/default.nix deleted file mode 100644 index da83f73..0000000 --- a/modules/xnet/gitserver/default.nix +++ /dev/null @@ -1,54 +0,0 @@ -{ config, lib, pkgs, ... }: -let - cfg = config.xnet.gitServer; - inherit (lib) mkOption mkIf types; -in -{ - imports = [ ./gitweb.nix ]; - - options.xnet.gitServer = { - enable = mkOption { - type = types.bool; - default = false; - description = "Serve git repos over SSH."; - }; - - path = mkOption { - type = types.path; - default = "/persist/repo/git"; - description = "Directory where repos will be stored."; - }; - - keys = mkOption { - type = types.listOf types.str; - description = "SSH public keys used for git operations."; - }; - }; - - config = mkIf cfg.enable { - users.users.git = { - group = "git"; - initialPassword = ""; - isSystemUser = true; - home = cfg.path; - homeMode = "755"; - createHome = true; - shell = "${pkgs.git}/bin/git-shell"; - openssh.authorizedKeys.keys = cfg.keys; - }; - - users.groups.git = { }; - - programs.git = { - enable = true; - config = { - init = { - defaultBranch = "master"; - }; - safe = { - directory = "*"; - }; - }; - }; - }; -} diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix deleted file mode 100644 index bfd593d..0000000 --- a/modules/xnet/gitserver/gitweb.nix +++ /dev/null @@ -1,75 +0,0 @@ -{ config, lib, pkgs, ... }: -let - cfg = config.xnet.gitServer.gitweb; - inherit (lib) mkOption mkIf types; -in -{ - options.xnet.gitServer.gitweb = { - enable = mkOption { - type = types.bool; - default = false; - description = "Enable web interface to git repos."; - }; - - hostName = mkOption { - type = types.str; - default = "src.web.4kb.net"; - description = "Hostname the webUI is served from."; - }; - }; - - config = mkIf cfg.enable { - xnet.nginx.enable = true; - - users.users.nginx.extraGroups = [ "git" ]; - services.cgit.main = { - enable = true; - scanPath = config.xnet.gitServer.path; - package = pkgs.cgit-pink; - nginx = { - virtualHost = cfg.hostName; - location = "/"; - }; - extraConfig = '' - mimetype.gif=image/gif - mimetype.html=text/html - mimetype.jpeg=image/jpeg - mimetype.jpg=image/jpeg - mimetype.pdf=application/pdf - mimetype.png=image/png - mimetype.svg=image/svg+xml - readme=:readme - readme=:readme.md - readme=:readme.txt - readme=:README - readme=:README.md - readme=:README.txt - ''; - settings = { - about-filter = "${pkgs.cgit-pink}/lib/cgit/filters/about-formatting.sh"; - clone-url = "https://${cfg.hostName}/$CGIT_REPO_URL git@${cfg.hostName}:$CGIT_REPO_URL"; - enable-commit-graph = true; - enable-http-clone = false; - enable-index-links = true; - enable-remote-branches = true; - remove-suffix = true; - robots = "noindex, nofollow"; - root-desc = "What I cannot create, I do not understand"; - root-title = cfg.hostName; - section-from-path = true; - snapshots = "tar.gz tar.bz2 zip"; - }; - }; - - # required for rendering markdown readme - environment.systemPackages = with pkgs; [ - python312 - python312Packages.markdown - ]; - - # services.nginx.virtualHosts."${cfg.gitweb.hostName}" = { - # useACMEHost = "4kb.net"; - # addSSL = true; - # }; - }; -} diff --git a/modules/xnet/monitoring/default.nix b/modules/xnet/monitoring/default.nix deleted file mode 100644 index 87ae724..0000000 --- a/modules/xnet/monitoring/default.nix +++ /dev/null @@ -1,38 +0,0 @@ -{ config, ... }: -let - inherit (config.networking) hostName; - inherit (config.services.prometheus) exporters; -in -{ - imports = [ ./grafana.nix ./prometheus.nix ]; - - exporters = { - node = { - enable = true; - enabledCollectors = [ "processes" "systemd" ]; - }; - - systemd = { - enable = true; - extraFlags = [ - "--systemd.collector.enable-ip-accounting" - "--systemd.collector.enable-restart-count" - ]; - }; - }; - - services.prometheus.scrapeConfigs = [ - { - job_name = "node"; - static_configs = [{ - targets = [ "${hostName}:${toString exporters.node.port}" ]; - }]; - } - { - job_name = "systemd"; - static_configs = [{ - targets = [ "${hostName}:${toString exporters.systemd.port}" ]; - }]; - } - ]; -} diff --git a/modules/xnet/monitoring/grafana.nix b/modules/xnet/monitoring/grafana.nix deleted file mode 100644 index 6a37ce1..0000000 --- a/modules/xnet/monitoring/grafana.nix +++ /dev/null @@ -1,51 +0,0 @@ -{ config, pkgs, ... }: { - services.grafana.provision = { - enable = true; - datasources.settings.datasources = [{ - name = "Prometheus"; - type = "prometheus"; - url = "http://localhost:9090"; - access = "proxy"; - editable = false; - }]; - - dashboards.settings.providers = [{ - name = "Fetched Dashboards"; - options.path = "/etc/grafana/dashboards"; - }]; - }; - - environment.etc = { - "grafana/dashboards/node-exporter.json" = { - user = "grafana"; - group = "grafana"; - source = pkgs.fetchurl { - url = "https://grafana.com/api/dashboards/1860/revisions/37/download"; - hash = "sha256-1DE1aaanRHHeCOMWDGdOS1wBXxOF84UXAjJzT5Ek6mM="; - }; - }; - }; - - services.grafana = { - enable = true; - settings.server = { - domain = "grafana.web.4kb.net"; - protocol = "socket"; - }; - settings."auth.anonymous" = { - enabled = true; - org_role = "Admin"; - }; - }; - - users.groups.grafana.members = [ "nginx" ]; - systemd.services.nginx.serviceConfig.ProtectHome = false; - - services.nginx.virtualHosts."${config.services.grafana.settings.server.domain}" = { - useACMEHost = "4kb.net"; - addSSL = true; - locations."/" = { - proxyPass = "http://unix:/${toString config.services.grafana.settings.server.socket}"; - }; - }; -} diff --git a/modules/xnet/monitoring/prometheus.nix b/modules/xnet/monitoring/prometheus.nix deleted file mode 100644 index e32e078..0000000 --- a/modules/xnet/monitoring/prometheus.nix +++ /dev/null @@ -1,15 +0,0 @@ -{ config, ... }: { - services.prometheus = { - enable = true; - globalConfig.scrape_interval = "1m"; - # scrapeConfigs = [{ - # job_name = "node"; - # relabel_configs = [{ - # source_labels = [ "__address__" ]; - # regex = "(.*):[0-9]+"; - # target_label = "instance"; - # replacement = "$1"; - # }]; - # }]; - }; -} diff --git a/modules/xnet/net/default.nix b/modules/xnet/net/default.nix deleted file mode 100644 index 2255f53..0000000 --- a/modules/xnet/net/default.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.xnet.net; - inherit (lib) mkOption mkIf types; - prefix = "10.26.4"; -in -{ - imports = [ - ./sshd.nix - ]; - - options.xnet.net = { - interface = mkOption { - type = types.str; - default = ""; - description = "Network interface connecting to xnet."; - }; - - addr = mkOption { - type = types.ints.between 0 255; - description = "Final octet for xnet address."; - example = 4; - }; - }; - - # TODO: - # - Add assertion that each address is only used once across config - # - Add each host to each other hosts dns configuration - config = mkIf (builtins.stringLength cfg.interface > 0) { - networking.vlans = { - "${cfg.interface}.4" = { - inherit (cfg) interface; - id = 4; - }; - }; - - networking.interfaces = { - "${cfg.interface}.4".ipv4.addresses = [{ - address = "${prefix}.${toString cfg.addr}"; - prefixLength = 24; - }]; - }; - }; -} diff --git a/modules/xnet/net/sshd.nix b/modules/xnet/net/sshd.nix deleted file mode 100644 index ef225db..0000000 --- a/modules/xnet/net/sshd.nix +++ /dev/null @@ -1,46 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.xnet.net.sshd; - inherit (lib) mkOption mkIf types; -in -{ - options.xnet.net.sshd = { - enable = mkOption { - type = types.bool; - default = false; - description = "Enable hardened SSH service."; - }; - }; - - config = mkIf cfg.enable { - services.openssh = { - enable = true; - startWhenNeeded = true; - openFirewall = true; - hostKeys = [{ - path = "/persist/certs/ssh/ssh_host_ed25519_key"; - type = "ed25519"; - }]; - settings = { - UsePAM = true; - X11Forwarding = false; - PermitRootLogin = "no"; - PasswordAuthentication = false; - Ciphers = [ "chacha20-poly1305@openssh.com" ]; - Macs = [ "hmac-sha2-512-etm@openssh.com" ]; - KexAlgorithms = [ "curve25519-sha256@libssh.org" ]; - }; - sftpServerExecutable = "internal-sftp"; - sftpFlags = [ "-f AUTHPRIV" "-l INFO" ]; - extraConfig = - let - pubkeyTypes = lib.strings.concatStringsSep "," [ - "sk-ssh-ed25519-cert-v01@openssh.com" - "ssh-ed25519-cert-v01@openssh.com" - "ssh-ed25519" - ]; - in - "PubkeyAcceptedKeyTypes ${pubkeyTypes}"; - }; - }; -} diff --git a/modules/xnet/nginx.nix b/modules/xnet/nginx.nix deleted file mode 100644 index 64c1d65..0000000 --- a/modules/xnet/nginx.nix +++ /dev/null @@ -1,28 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.xnet.nginx; - - inherit (lib) mkOption mkIf types; -in -{ - - options.xnet.nginx = { - enable = mkOption { - type = types.bool; - default = false; - description = "Enable optimized nginx."; - }; - }; - - config = mkIf cfg.enable { - networking.firewall.allowedTCPPorts = [ 80 443 ]; - - services.nginx = { - enable = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedProxySettings = true; - recommendedTlsSettings = true; - }; - }; -} diff --git a/modules/xnet/users.nix b/modules/xnet/users.nix deleted file mode 100644 index 53aa15b..0000000 --- a/modules/xnet/users.nix +++ /dev/null @@ -1,74 +0,0 @@ -{ pkgs, lib, config, ... }: -let - cfg = config.xnet.users; - inherit (lib) mkOption mkIf types; -in -{ - - options.xnet.users = { - enable = mkOption { - type = types.listOf (types.enum [ "kle" ]); - default = [ ]; - description = "Users to enable."; - }; - }; - - config = { - users = { - mutableUsers = false; - users.kle = mkIf (builtins.elem "kle" cfg.enable) { - hashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/"; - isNormalUser = true; - createHome = true; - extraGroups = [ "wheel" "users" "networkmanager" "video" ]; - packages = with pkgs; [ - btop - curl - fzf - jq - lynx - neovim - ranger - rsync - sshfs - tree - zip - ]; - openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9" - ]; - }; - }; - - security.sudo = { - execWheelOnly = true; - extraConfig = "Defaults lecture = never"; - }; - - programs.ssh = { - knownHosts = { - "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl"; - }; - extraConfig = '' - Host github - HostName github.com - User git - PreferredAuthentications publickey - ''; - }; - - programs.git = { - config = { - init.defaultBranch = "master"; - fetch.prune = true; - core.excludesFile = pkgs.writeText "gitignore" '' - # dev shell caching - .direnv/ - .envrc - ''; - push.default = "upstream"; - push.autoSetupRemote = true; - }; - }; - }; -} -- cgit v1.3.1