1
0
Fork 0

Compare commits

...

8 commits

16 changed files with 260 additions and 129 deletions

View file

@ -29,3 +29,7 @@ creation_rules:
key_groups:
- age:
- *primary
- path_regex: secrets/aquarius-wg.yaml
key_groups:
- age:
- *primary

126
flake.lock generated
View file

@ -8,11 +8,11 @@
},
"locked": {
"dir": "pkgs/firefox-addons",
"lastModified": 1753329806,
"narHash": "sha256-PxQVUrK1rJEQoUSp6vO7OUfvkoZZUtY98HoWUIYW69M=",
"lastModified": 1758879217,
"narHash": "sha256-vWk2iw/i5c0RHc/zLVyB51UYvmbzPq3uB14NN7kaouE=",
"owner": "rycee",
"repo": "nur-expressions",
"rev": "87fd18a0002b8d63a8520dd569a99de509fc43c5",
"rev": "58402e09ad48f9f509d9249b8704c1a4f390c434",
"type": "gitlab"
},
"original": {
@ -62,11 +62,11 @@
]
},
"locked": {
"lastModified": 1753121425,
"narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=",
"lastModified": 1756770412,
"narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "644e0fc48951a860279da645ba77fe4a6e814c5e",
"rev": "4524271976b625a4a605beefd893f270620fd751",
"type": "github"
},
"original": {
@ -76,46 +76,6 @@
}
},
"flake-utils": {
"inputs": {
"systems": [
"nvf",
"systems"
]
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"flake-utils-plus": {
"inputs": {
"flake-utils": "flake-utils_2"
},
"locked": {
"lastModified": 1715533576,
"narHash": "sha256-fT4ppWeCJ0uR300EH3i7kmgRZnAVxrH+XtK09jQWihk=",
"owner": "gytis-ivaskevicius",
"repo": "flake-utils-plus",
"rev": "3542fe9126dc492e53ddd252bb0260fe035f2c0f",
"type": "github"
},
"original": {
"owner": "gytis-ivaskevicius",
"repo": "flake-utils-plus",
"rev": "3542fe9126dc492e53ddd252bb0260fe035f2c0f",
"type": "github"
}
},
"flake-utils_2": {
"inputs": {
"systems": "systems_2"
},
@ -133,6 +93,25 @@
"type": "github"
}
},
"flake-utils-plus": {
"inputs": {
"flake-utils": "flake-utils"
},
"locked": {
"lastModified": 1715533576,
"narHash": "sha256-fT4ppWeCJ0uR300EH3i7kmgRZnAVxrH+XtK09jQWihk=",
"owner": "gytis-ivaskevicius",
"repo": "flake-utils-plus",
"rev": "3542fe9126dc492e53ddd252bb0260fe035f2c0f",
"type": "github"
},
"original": {
"owner": "gytis-ivaskevicius",
"repo": "flake-utils-plus",
"rev": "3542fe9126dc492e53ddd252bb0260fe035f2c0f",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
@ -140,11 +119,11 @@
]
},
"locked": {
"lastModified": 1753294394,
"narHash": "sha256-1Dfgq09lHZ8AdYB2Deu/mYP1pMNpob8CgqT5Mzo44eI=",
"lastModified": 1758928860,
"narHash": "sha256-ZqaRdd+KoR54dNJPtd7UX4O0X+02YItnTpQVu28lSVI=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "1fde6fb1be6cd5dc513dc1c287d69e4eb2de973e",
"rev": "bc2afee55bc5d3b825287829d6592b9cc1405aad",
"type": "github"
},
"original": {
@ -155,11 +134,11 @@
},
"mnw": {
"locked": {
"lastModified": 1748710831,
"narHash": "sha256-eZu2yH3Y2eA9DD3naKWy/sTxYS5rPK2hO7vj8tvUCSU=",
"lastModified": 1756659871,
"narHash": "sha256-v6Rh4aQ6RKjM2N02kK9Usn0Ix7+OY66vNpeklc1MnGE=",
"owner": "Gerg-L",
"repo": "mnw",
"rev": "cff958a4e050f8d917a6ff3a5624bc4681c6187d",
"rev": "ed6cc3e48557ba18266e598a5ebb6602499ada16",
"type": "github"
},
"original": {
@ -170,11 +149,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1753122741,
"narHash": "sha256-nFxE8lk9JvGelxClCmwuJYftbHqwnc01dRN4DVLUroM=",
"lastModified": 1758663926,
"narHash": "sha256-6CFdj7Xs616t1W4jLDH7IohAAvl5Dyib3qEv/Uqw1rk=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "cc66fddc6cb04ab479a1bb062f4d4da27c936a22",
"rev": "170ff93c860b2a9868ed1e1102d4e52cb3d934e1",
"type": "github"
},
"original": {
@ -185,11 +164,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1753250450,
"narHash": "sha256-i+CQV2rPmP8wHxj0aq4siYyohHwVlsh40kV89f3nw1s=",
"lastModified": 1758690382,
"narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "fc02ee70efb805d3b2865908a13ddd4474557ecf",
"rev": "e643668fd71b949c53f8626614b21ff71a07379d",
"type": "github"
},
"original": {
@ -201,11 +180,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1752997324,
"narHash": "sha256-vtTM4oDke3SeDj+1ey6DjmzXdq8ZZSCLWSaApADDvIE=",
"lastModified": 1756696532,
"narHash": "sha256-6FWagzm0b7I/IGigOv9pr6LL7NQ86mextfE8g8Q6HBg=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "7c688a0875df5a8c28a53fb55ae45e94eae0dddb",
"rev": "58dcbf1ec551914c3756c267b8b9c8c86baa1b2f",
"type": "github"
},
"original": {
@ -217,11 +196,11 @@
},
"nixpkgs_3": {
"locked": {
"lastModified": 1744868846,
"narHash": "sha256-5RJTdUHDmj12Qsv7XOhuospjAjATNiTMElplWnJE9Hs=",
"lastModified": 1758262103,
"narHash": "sha256-aBGl3XEOsjWw6W3AHiKibN7FeoG73dutQQEqnd/etR8=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "ebe4301cbd8f81c4f8d3244b3632338bbeb6d49c",
"rev": "12bd230118a1901a4a5d393f9f56b6ad7e571d01",
"type": "github"
},
"original": {
@ -235,17 +214,16 @@
"inputs": {
"flake-compat": "flake-compat",
"flake-parts": "flake-parts",
"flake-utils": "flake-utils",
"mnw": "mnw",
"nixpkgs": "nixpkgs_2",
"systems": "systems"
},
"locked": {
"lastModified": 1753181140,
"narHash": "sha256-daKfPQnipcRnKnXknDzv+fzNKeEY3r/10y8YMVQ10vU=",
"lastModified": 1758271661,
"narHash": "sha256-ENqd2/33uP5vB44ClDjjAV+J78oF8q1er4QUZuT8Z7g=",
"owner": "notashelf",
"repo": "nvf",
"rev": "8fbecab446afe3454ecce6a4b817ec4f123a4a34",
"rev": "b7571df4d6e9ac08506a738ddceeec0b141751b0",
"type": "github"
},
"original": {
@ -264,11 +242,11 @@
]
},
"locked": {
"lastModified": 1748196248,
"narHash": "sha256-1iHjsH6/5UOerJEoZKE+Gx1BgAoge/YcnUsOA4wQ/BU=",
"lastModified": 1758185783,
"narHash": "sha256-6fX2CG8PzdBNwJGBISnf/nVHUVMZdCsekT1mP672Uh8=",
"owner": "nix-community",
"repo": "plasma-manager",
"rev": "b7697abe89967839b273a863a3805345ea54ab56",
"rev": "6a7d78cebd9a0f84a508bec9bc47ac504c5f51f4",
"type": "github"
},
"original": {
@ -317,11 +295,11 @@
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1752544651,
"narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
"lastModified": 1758425756,
"narHash": "sha256-L3N8zV6wsViXiD8i3WFyrvjDdz76g3tXKEdZ4FkgQ+Y=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "2c8def626f54708a9c38a5861866660395bb3461",
"rev": "e0fdaea3c31646e252a60b42d0ed8eafdb289762",
"type": "github"
},
"original": {

View file

@ -52,7 +52,7 @@
systems.modules.nixos = with inputs; [
home-manager.nixosModules.home-manager
{
home-manager.sharedModules = [ inputs.plasma-manager.homeManagerModules.plasma-manager ];
home-manager.sharedModules = [ inputs.plasma-manager.homeModules.plasma-manager ];
home-manager.backupFileExtension = "bk-hm";
}
nvf.nixosModules.default

View file

@ -23,7 +23,7 @@ with lib.${namespace};
thunderbird = enabled;
chatterino = enabled;
mpv = enabled;
cinny = enabled;
cinny = disabled; # Currently insecure because of libsoup
spotify = enabled;
obs = enabled;
discord = enabled;

View file

@ -31,6 +31,7 @@ let
sponsorblock
ublock-origin
seventv
floccus
];
defaultSearch = {
force = true; # We need this, else the build fails

View file

@ -22,6 +22,7 @@ in
shellAliases = {
nix-dns = "nixos-rebuild switch --flake ${flakeRoot}/.#dns --target-host dns-1 --sudo --ask-sudo-password && nixos-rebuild switch --flake ${flakeRoot}/.#dns --target-host dns-2 --sudo --ask-sudo-password";
nix-blarm = "nixos-rebuild switch --flake ${flakeRoot}/.#blarm --target-host blarm --sudo --ask-sudo-password";
nix-aquarius = "nixos-rebuild switch --flake ${flakeRoot}/.#aquarius --target-host aquarius --sudo --ask-sudo-password";
cd = "z";
ls = "exa --icons";
l = "exa";

View file

@ -26,6 +26,7 @@ in
extraPackages = with pkgs; [
steamtinkerlaunch
proton-ge-bin
awesome-flake.proton-ge-bin-9
];
};

View file

@ -0,0 +1,31 @@
{
lib,
config,
pkgs,
namespace,
...
}:
with lib;
with lib.${namespace};
let
cfg = config.${namespace}.services.printer;
in
{
options.${namespace}.services.printer = {
enable = mkBoolOpt false "Printer";
};
config = mkIf cfg.enable {
services.printing = {
enable = true;
drivers = [ pkgs.hplip ];
};
services.avahi = {
enable = true;
nssmdns4 = true;
openFirewall = true;
};
};
}

View file

@ -8,16 +8,17 @@ final: prev: {
awesome-flake = (prev.awesome-flake or { }) // {
cinny = prev.cinny-unwrapped.overrideAttrs (_old: rec {
pname = "cinny-unwrapped";
version = "65475050d76d6e8da8c3402528215b1425e8ed4e";
version = "76ac4e298733e67dbfcd3f0c3a4bae169cd521dd";
src = final.fetchFromGitHub {
owner = "GigiaJ";
#owner = "GigiaJ";
owner = "cinnyapp";
repo = "cinny";
rev = version;
hash = "sha256-kJZDc53mcJrGIw3Dl4ANq+1O5O2p0tcO2btQGNGRg4A=";
hash = "sha256-tvBaONJwfkCK77aHmWJ/UAAZHq2WIc7geNT2tEFKuZ0=";
};
npmDepsHash = "sha256-GkD+CrblXBv7yPVrTBVIGkz7Wu5llWzlluNq7rmm3CE=";
npmDepsHash = "sha256-9faffTlXEI1lMrVrkSyso/tfjs/4W+TVzmiv+bZAv18=";
npmDeps = final.fetchNpmDeps {
inherit src;
name = "${pname}-${version}-npm-deps";

View file

@ -0,0 +1,81 @@
{
lib,
stdenvNoCC,
fetchzip,
writeScript,
# Can be overridden to alter the display name in steam
# This could be useful if multiple versions should be installed together
steamDisplayName ? "GE-Proton",
}:
stdenvNoCC.mkDerivation (finalAttrs: {
pname = "proton-ge-bin-9";
version = "GE-Proton9-27";
src = fetchzip {
url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
hash = "sha256-70au1dx9co3X+X7xkBCDGf1BxEouuw3zN+7eDyT7i5c=";
};
dontUnpack = true;
dontConfigure = true;
dontBuild = true;
outputs = [
"out"
"steamcompattool"
];
installPhase = ''
runHook preInstall
# Make it impossible to add to an environment. You should use the appropriate NixOS option.
# Also leave some breadcrumbs in the file.
echo "${finalAttrs.pname} should not be installed into environments. Please use programs.steam.extraCompatPackages instead." > $out
mkdir $steamcompattool
ln -s $src/* $steamcompattool
rm $steamcompattool/compatibilitytool.vdf
cp $src/compatibilitytool.vdf $steamcompattool
runHook postInstall
'';
preFixup = ''
substituteInPlace "$steamcompattool/compatibilitytool.vdf" \
--replace-fail "${finalAttrs.version}" "${steamDisplayName}"
'';
/*
We use the created releases, and not the tags, for the update script as nix-update loads releases.atom
that contains both. Sometimes upstream pushes the tags but the Github releases don't get created due to
CI errors. Last time this happened was on 8-33, where a tag was created but no releases were created.
As of 2024-03-13, there have been no announcements indicating that the CI has been fixed, and thus
we avoid nix-update-script and use our own update script instead.
See: <https://github.com/NixOS/nixpkgs/pull/294532#issuecomment-1987359650>
*/
passthru.updateScript = writeScript "update-proton-ge" ''
#!/usr/bin/env nix-shell
#!nix-shell -i bash -p curl jq common-updater-scripts
repo="https://api.github.com/repos/GloriousEggroll/proton-ge-custom/releases"
version="$(curl -sL "$repo" | jq 'map(select(.prerelease == false)) | .[0].tag_name' --raw-output)"
update-source-version proton-ge-bin "$version"
'';
meta = {
description = ''
Compatibility tool for Steam Play based on Wine and additional components.
(This is intended for use in the `programs.steam.extraCompatPackages` option only.)
'';
homepage = "https://github.com/GloriousEggroll/proton-ge-custom";
license = lib.licenses.bsd3;
maintainers = with lib.maintainers; [
NotAShelf
Scrumplex
shawn8901
];
platforms = [ "x86_64-linux" ];
sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
};
})

18
secrets/aquarius-wg.yaml Normal file
View file

@ -0,0 +1,18 @@
privateKey: ENC[AES256_GCM,data:WtmzHDKRbqbJJ3VXKqqKnqKTcvVDV+yFgFfeKxLv+UErOiEBgqtDhKEs0Io=,iv:admaUfhhKLlu58wKpRvgyGSqOsiY82ix2xJgT0GL8Xs=,tag:eP9Ka0jo2BYxZX0w7eKGqA==,type:str]
publicKey: ENC[AES256_GCM,data://Kq875vV3gpE3tbMRVt/q7m5LqPRXOka8fzoA2oZzglfE1xtS/kAMPMR44=,iv:5fLk4lBTHwIcGiAM325ykceViCBwRHFLnxZkcqm3Ao4=,tag:g6R0ZSRa2m9JNB2UH3JIJg==,type:str]
presharedKey: ENC[AES256_GCM,data:EpOJCMzi1XHDbbqdEB+SoC/6LxkHwxZ2DxQINBnGhjXl6JhNYswqTWQuFVU=,iv:GFcxLghV+SQMaJ5J4bQOBPGDQatkSwPLtx57wlWaB+8=,tag:2ofR6eSplwLwe/vYyGyrLg==,type:str]
sops:
age:
- recipient: age132m0pg4utk3cjve2lgcjffvz7cevl0fq5krufu9sgud7wu2wgurqk49kgl
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0QWtnVkU1QnVyUU9ROHpO
WWp5TU1rTSt6aUlMOHczTXhXTmpUeDIvcDB3CnRRdk5BTnRWOUZiK0R1L0NUNHBn
L3FVNnFTbEVmQ2lHUlZwZFJyUWtFRVUKLS0tIFhPcUoxbXgrd3FWYmJMU2ZUTXFv
ekZnYTVDS1habTBpSUtOaURWTFBxRU0KblHpvcdwLANZdxUmT4hDQqooPXDiRvH1
f8qVPOVveoOBzmoN9HN08TFbQcwZ6YM0IQggxdtMyhZk/qyhy+CqNw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-08-02T12:06:55Z"
mac: ENC[AES256_GCM,data:T9trFCzxJm3eINbuJIDN04feEHViZz6yiaA59yf9+WyJrLB467DagDc4Qv90vdRJXzakwZSYvprDtglrVReT+Wg2GLdVtNIZmPEaLrfpfBgVaBCEZch48dOh+Ytgc09f95ecyXJV/2xNLBtW8YUs3JZsIAcJQTOOrLLhhPjj96A=,iv:wrwIeLhEsN6LFpO/6RF+DE343xdFhshd4TSeF+le+m8=,tag:rNXmYSJsStd5HeDCgtKSRQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2

View file

@ -19,13 +19,17 @@ with lib.${namespace};
generic-extlinux-compatible.enable = true;
};
nix.settings.experimental-features = [
"nix-command"
"flakes"
];
nix.settings = {
trusted-users = [ "philipp" ];
experimental-features = [
"nix-command"
"flakes"
];
};
# Disable detailed ddocumentation
documentation.nixos.enable = false;
documentation.man.generateCaches = false;
# Set your time zone.
time.timeZone = "Europe/Berlin";
@ -38,7 +42,6 @@ with lib.${namespace};
description = "Philipp Böhm";
extraGroups = [
"wheel"
"caddy"
];
};
@ -50,16 +53,15 @@ with lib.${namespace};
};
};
services.openssh.settings.PasswordAuthentication = false;
services.openssh.settings.PermitRootLogin = "no";
services.cron = enabled;
awesome-flake = {
services = {
ssh = enabled;
caddy = enabled;
restic = enabled;
};
container = {
technitium = enabled;
invidious = enabled;
technitium-dns-server = enabled;
};
system.sops = enabled;

View file

@ -0,0 +1,46 @@
{
networking = {
hostName = "aquarius";
networkmanager.enable = false;
dhcpcd.enable = true;
interfaces.end0.useDHCP = true;
firewall = {
enable = true;
allowedUDPPorts = [ 51820 ];
};
wireguard = {
enable = true;
interfaces."wg0" = {
ips = [ "192.168.100.10/24" "fd00:100::10/64" ];
listenPort = 51820;
mtu = 1400;
privateKeyFile = "/run/secrets/privateKey";
peers = [
{
publicKey = "ylsjhpKiq3B6Kv4q2uiHXUJpyxY2b1DOAlGc/FWdflQ=";
presharedKeyFile = "/run/secrets/presharedKey";
allowedIPs = [ "192.168.100.1/32" "fd00:100::1/128" ];
endpoint = "neuruppin.boehm.sh:51820";
persistentKeepalive = 25;
}
];
};
};
};
sops.secrets = {
privateKey = {
sopsFile = ../../../secrets/aquarius-wg.yaml;
key = "privateKey";
};
presharedKey = {
sopsFile = ../../../secrets/aquarius-wg.yaml;
key = "presharedKey";
};
};
}

View file

@ -1,33 +0,0 @@
{
networking = {
hostName = "blarm";
firewall.enable = false;
networkmanager.enable = false;
dhcpcd.enable = true;
defaultGateway.address = "192.168.1.1";
interfaces.end0 = {
useDHCP = true;
ipv4.addresses = [
{
address = "192.168.1.251";
prefixLength = 32;
}
{
address = "192.168.1.202";
prefixLength = 32;
}
];
ipv6.addresses = [
{
address = "fd00:192:168:1::202";
prefixLength = 64;
}
{
address = "fd00:192:168:1::251";
prefixLength = 64;
}
];
};
};
}

View file

@ -7,9 +7,7 @@
}:
with lib.${namespace};
{
imports = [
(modulesPath + "/virtualisation/proxmox-lxc.nix")
];
imports = [ (modulesPath + "/virtualisation/proxmox-lxc.nix") ];
nix.settings = {
trusted-users = [ "philipp" ];

View file

@ -1,5 +1,4 @@
{
pkgs,
lib,
namespace,
...
@ -50,6 +49,8 @@ with lib.${namespace};
};
};
services.teamviewer.enable = true;
awesome-flake = {
cli = {
neovim = enabled;
@ -68,6 +69,7 @@ with lib.${namespace};
services = {
btrfs = enabled;
ssh = enabled;
printer = enabled;
};
system = {