1
0
Fork 0

Compare commits

...

7 commits

Author SHA1 Message Date
d7c83ca823
fix(cinny): update sha256 and fix version to rev less error prone 2025-06-20 15:47:56 +02:00
27b590baa0
fix(prisma): set overlay meta.mainProgram to get rid of the error 2025-06-20 15:47:24 +02:00
9a4e306ef2
update(flake.lock) 2025-06-20 15:46:58 +02:00
c79f9b44ec
feature(steam): add proton-ge-bin to steam module 2025-06-20 15:46:42 +02:00
0377154a3c
add(paperless): enable restic backup of /data
We also disabled immich for now, since the version is currently
incompatible to migrate from my docker services.
2025-06-20 15:46:13 +02:00
a9ec420b9e
add(fwupd) 2025-06-20 15:45:16 +02:00
b32f5d48d8
remove(technitium,invidious): remove all containered services from config 2025-06-20 15:44:29 +02:00
21 changed files with 154 additions and 403 deletions

89
flake.lock generated
View file

@ -8,11 +8,11 @@
},
"locked": {
"dir": "pkgs/firefox-addons",
"lastModified": 1749614614,
"narHash": "sha256-/193T5cui6RiXWn+bqKDwNt4A1zRYjzTI2g1XLrxVRk=",
"lastModified": 1750392203,
"narHash": "sha256-rJU+WeeLxDinRWEGXw5OT4tToIAO8zy/ULFVWHhLp/Q=",
"owner": "rycee",
"repo": "nur-expressions",
"rev": "78ce8a0ab9e72a4127472e6343a92a33fbd12691",
"rev": "09e3cfed476fc06384610a7e6027df221fc93bd3",
"type": "gitlab"
},
"original": {
@ -43,11 +43,11 @@
"nixpkgs-lib": "nixpkgs-lib"
},
"locked": {
"lastModified": 1748821116,
"narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
"lastModified": 1749398372,
"narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
"rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
"type": "github"
},
"original": {
@ -118,11 +118,11 @@
]
},
"locked": {
"lastModified": 1749628652,
"narHash": "sha256-f8jDF4G9m7pPySeQc6KskqMgtcJq6X1o2CytMx66qAE=",
"lastModified": 1750304462,
"narHash": "sha256-Mj5t4yX05/rXnRqJkpoLZTWqgStB88Mr/fegTRqyiWc=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "450f06ec3cd0d86f67db58a7245db8848773e895",
"rev": "863842639722dd12ae9e37ca83bcb61a63b36f6c",
"type": "github"
},
"original": {
@ -148,22 +148,17 @@
},
"nil": {
"inputs": {
"flake-utils": [
"nvf",
"flake-utils"
],
"nixpkgs": [
"nvf",
"nixpkgs"
],
"rust-overlay": "rust-overlay"
]
},
"locked": {
"lastModified": 1741118843,
"narHash": "sha256-ggXU3RHv6NgWw+vc+HO4/9n0GPufhTIUjVuLci8Za8c=",
"lastModified": 1750047244,
"narHash": "sha256-vluLARrk4485npdyHOj8XKr0yk6H22pNf+KVRNL+i/Y=",
"owner": "oxalica",
"repo": "nil",
"rev": "577d160da311cc7f5042038456a0713e9863d09e",
"rev": "870a4b1b5f12004832206703ac15aa85c42c247b",
"type": "github"
},
"original": {
@ -174,11 +169,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1749195551,
"narHash": "sha256-W5GKQHgunda/OP9sbKENBZhMBDNu2QahoIPwnsF6CeM=",
"lastModified": 1750083401,
"narHash": "sha256-ynqbgIYrg7P1fAKYqe8I/PMiLABBcNDYG9YaAP/d/C4=",
"owner": "nixos",
"repo": "nixos-hardware",
"rev": "4602f7e1d3f197b3cb540d5accf5669121629628",
"rev": "61837d2a33ccc1582c5fabb7bf9130d39fee59ad",
"type": "github"
},
"original": {
@ -189,11 +184,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1749285348,
"narHash": "sha256-frdhQvPbmDYaScPFiCnfdh3B/Vh81Uuoo0w5TkWmmjU=",
"lastModified": 1750365781,
"narHash": "sha256-XE/lFNhz5lsriMm/yjXkvSZz5DfvKJLUjsS6pP8EC50=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "3e3afe5174c561dee0df6f2c2b2236990146329f",
"rev": "08f22084e6085d19bcfb4be30d1ca76ecb96fe54",
"type": "github"
},
"original": {
@ -220,11 +215,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1749174413,
"narHash": "sha256-urN9UMK5cd1dzhR+Lx0xHeTgBp2MatA5+6g9JaxjuQs=",
"lastModified": 1750215678,
"narHash": "sha256-Rc/ytpamXRf6z8UA2SGa4aaWxUXRbX2MAWIu2C8M+ok=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "6ad174a6dc07c7742fc64005265addf87ad08615",
"rev": "5395fb3ab3f97b9b7abca147249fa2e8ed27b192",
"type": "github"
},
"original": {
@ -260,11 +255,11 @@
"systems": "systems_2"
},
"locked": {
"lastModified": 1749631819,
"narHash": "sha256-iy7UuA2I0DaKEUMncTQNFg0bYDX7sa5WCRQTrIWqmEU=",
"lastModified": 1750279337,
"narHash": "sha256-K8+lSoyfVIwPpKjPvCQsCWL59VI3XSbgbYdPUkTTaA8=",
"owner": "notashelf",
"repo": "nvf",
"rev": "2a2b5e2790b41eadc42758fd6c4d62b7af64f17c",
"rev": "787678dd731e0246d42ca70b758ae0ac35bd48e2",
"type": "github"
},
"original": {
@ -309,28 +304,6 @@
"stable": "stable"
}
},
"rust-overlay": {
"inputs": {
"nixpkgs": [
"nvf",
"nil",
"nixpkgs"
]
},
"locked": {
"lastModified": 1741055476,
"narHash": "sha256-52vwEV0oS2lCnx3c/alOFGglujZTLmObit7K8VblnS8=",
"owner": "oxalica",
"repo": "rust-overlay",
"rev": "aefb7017d710f150970299685e8d8b549d653649",
"type": "github"
},
"original": {
"owner": "oxalica",
"repo": "rust-overlay",
"type": "github"
}
},
"snowfall-lib": {
"inputs": {
"flake-compat": "flake-compat",
@ -358,11 +331,11 @@
"nixpkgs": "nixpkgs_3"
},
"locked": {
"lastModified": 1749592509,
"narHash": "sha256-VunQzfZFA+Y6x3wYi2UE4DEQ8qKoAZZCnZPUlSoqC+A=",
"lastModified": 1750119275,
"narHash": "sha256-Rr7Pooz9zQbhdVxux16h7URa6mA80Pb/G07T4lHvh0M=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "50754dfaa0e24e313c626900d44ef431f3210138",
"rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
"type": "github"
},
"original": {
@ -373,11 +346,11 @@
},
"stable": {
"locked": {
"lastModified": 1749488106,
"narHash": "sha256-b9GIWdF/8jKpCC5JIMgDLZgwe8cEbty2fyTyo1eDFfI=",
"lastModified": 1750330365,
"narHash": "sha256-hJ7XMNVsTnnbV2NPmStCC07gvv5l2x7+Skb7hyUzazg=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "8fe3e32e7f210522377c3bcff80931a3284ace6a",
"rev": "d883b6213afa179b58ba8bace834f1419707d0ad",
"type": "github"
},
"original": {

View file

@ -25,6 +25,7 @@ in
extraPackages = with pkgs; [
steamtinkerlaunch
proton-ge-bin
];
};

View file

@ -0,0 +1,79 @@
{
lib,
pkgs,
config,
namespace,
...
}:
with lib;
with lib.${namespace};
let
cfg = config.${namespace}.services.paperless;
in
{
options.${namespace}.services.paperless = {
enable = mkEnableOption "Paperless";
nginx = {
enable = mkEnableOption "Enable nginx for this service." // {
default = true;
};
};
package = mkOption {
description = "The package of Paperless to use.";
type = types.package;
default = pkgs.paperless-ngx;
};
port = mkOption {
description = "The port to serve Paperless on.";
type = types.nullOr types.int;
default = 28981;
};
domain = mkOption {
description = "The domain to serve Paperless on.";
type = types.nullOr types.str;
default = "paperless.stahl.sh";
};
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = [
80
443
];
services.paperless = {
enable = true;
port = cfg.port;
package = cfg.package;
dataDir = "/data/paperless";
consumptionDirIsPublic = true;
settings = {
PAPERLESS_OCR_LANGUAGE = "deu+eng";
PAPERLESS_OCR_USER_ARGS = {
optimize = 1;
pdfa_image_compression = "lossless";
};
PAPERLESS_DBHOST = ""; # Ensure sqlite database
PAPERLESS_URL = "https://${cfg.domain}";
};
};
awesome-flake.services.acme.enable = mkIf cfg.nginx.enable true;
services.nginx = mkIf cfg.nginx.enable {
enable = true;
virtualHosts."${cfg.domain}" = {
forceSSL = true;
useACMEHost = "stahl.sh";
locations."/" = {
proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
recommendedProxySettings = true;
};
};
};
};
}

View file

@ -36,7 +36,8 @@ in
repositoryFile = "/run/secrets/restic_url";
paths = [
"/home"
"/var/lib/caddy"
"/var/lib"
"/data"
];
timerConfig = {
OnCalendar = "00:10";

View file

@ -0,0 +1,21 @@
{
config,
lib,
namespace,
...
}:
with lib;
with lib.${namespace};
let
cfg = config.${namespace}.system.fwupd;
in
{
options.${namespace}.system.fwupd = with types; {
enable = mkBoolOpt false "Whether or not to enable fwupd.";
};
config = mkIf cfg.enable {
services.fwupd.enable = true;
};
}

View file

@ -1,12 +0,0 @@
-- Table: public.annotations
-- DROP TABLE public.annotations;
CREATE TABLE IF NOT EXISTS public.annotations
(
id text NOT NULL,
annotations xml,
CONSTRAINT annotations_id_key UNIQUE (id)
);
GRANT ALL ON TABLE public.annotations TO current_user;

View file

@ -1,30 +0,0 @@
-- Table: public.channel_videos
-- DROP TABLE public.channel_videos;
CREATE TABLE IF NOT EXISTS public.channel_videos
(
id text NOT NULL,
title text,
published timestamp with time zone,
updated timestamp with time zone,
ucid text,
author text,
length_seconds integer,
live_now boolean,
premiere_timestamp timestamp with time zone,
views bigint,
CONSTRAINT channel_videos_id_key UNIQUE (id)
);
GRANT ALL ON TABLE public.channel_videos TO current_user;
-- Index: public.channel_videos_ucid_idx
-- DROP INDEX public.channel_videos_ucid_idx;
CREATE INDEX IF NOT EXISTS channel_videos_ucid_idx
ON public.channel_videos
USING btree
(ucid COLLATE pg_catalog."default");

View file

@ -1,25 +0,0 @@
-- Table: public.channels
-- DROP TABLE public.channels;
CREATE TABLE IF NOT EXISTS public.channels
(
id text NOT NULL,
author text,
updated timestamp with time zone,
deleted boolean,
subscribed timestamp with time zone,
CONSTRAINT channels_id_key UNIQUE (id)
);
GRANT ALL ON TABLE public.channels TO current_user;
-- Index: public.channels_id_idx
-- DROP INDEX public.channels_id_idx;
CREATE INDEX IF NOT EXISTS channels_id_idx
ON public.channels
USING btree
(id COLLATE pg_catalog."default");

View file

@ -1,22 +0,0 @@
-- Table: public.nonces
-- DROP TABLE public.nonces;
CREATE TABLE IF NOT EXISTS public.nonces
(
nonce text,
expire timestamp with time zone,
CONSTRAINT nonces_id_key UNIQUE (nonce)
);
GRANT ALL ON TABLE public.nonces TO current_user;
-- Index: public.nonces_nonce_idx
-- DROP INDEX public.nonces_nonce_idx;
CREATE INDEX IF NOT EXISTS nonces_nonce_idx
ON public.nonces
USING btree
(nonce COLLATE pg_catalog."default");

View file

@ -1,19 +0,0 @@
-- Table: public.playlist_videos
-- DROP TABLE public.playlist_videos;
CREATE TABLE IF NOT EXISTS public.playlist_videos
(
title text,
id text,
author text,
ucid text,
length_seconds integer,
published timestamptz,
plid text references playlists(id),
index int8,
live_now boolean,
PRIMARY KEY (index,plid)
);
GRANT ALL ON TABLE public.playlist_videos TO current_user;

View file

@ -1,29 +0,0 @@
-- Type: public.privacy
-- DROP TYPE public.privacy;
CREATE TYPE public.privacy AS ENUM
(
'Public',
'Unlisted',
'Private'
);
-- Table: public.playlists
-- DROP TABLE public.playlists;
CREATE TABLE IF NOT EXISTS public.playlists
(
title text,
id text primary key,
author text,
description text,
video_count integer,
created timestamptz,
updated timestamptz,
privacy privacy,
index int8[]
);
GRANT ALL ON public.playlists TO current_user;

View file

@ -1,23 +0,0 @@
-- Table: public.session_ids
-- DROP TABLE public.session_ids;
CREATE TABLE IF NOT EXISTS public.session_ids
(
id text NOT NULL,
email text,
issued timestamp with time zone,
CONSTRAINT session_ids_pkey PRIMARY KEY (id)
);
GRANT ALL ON TABLE public.session_ids TO current_user;
-- Index: public.session_ids_id_idx
-- DROP INDEX public.session_ids_id_idx;
CREATE INDEX IF NOT EXISTS session_ids_id_idx
ON public.session_ids
USING btree
(id COLLATE pg_catalog."default");

View file

@ -1,29 +0,0 @@
-- Table: public.users
-- DROP TABLE public.users;
CREATE TABLE IF NOT EXISTS public.users
(
updated timestamp with time zone,
notifications text[],
subscriptions text[],
email text NOT NULL,
preferences text,
password text,
token text,
watched text[],
feed_needs_update boolean,
CONSTRAINT users_email_key UNIQUE (email)
);
GRANT ALL ON TABLE public.users TO current_user;
-- Index: public.email_unique_idx
-- DROP INDEX public.email_unique_idx;
CREATE UNIQUE INDEX IF NOT EXISTS email_unique_idx
ON public.users
USING btree
(lower(email) COLLATE pg_catalog."default");

View file

@ -1,23 +0,0 @@
-- Table: public.videos
-- DROP TABLE public.videos;
CREATE UNLOGGED TABLE IF NOT EXISTS public.videos
(
id text NOT NULL,
info text,
updated timestamp with time zone,
CONSTRAINT videos_pkey PRIMARY KEY (id)
);
GRANT ALL ON TABLE public.videos TO current_user;
-- Index: public.id_idx
-- DROP INDEX public.id_idx;
CREATE UNIQUE INDEX IF NOT EXISTS id_idx
ON public.videos
USING btree
(id COLLATE pg_catalog."default");

View file

@ -1,83 +0,0 @@
{
lib,
config,
namespace,
...
}:
with lib;
with lib.${namespace};
let
cfg = config.${namespace}.container.invidious;
in
{
options.${namespace}.container.invidious = {
enable = mkEnableOption "Invidious";
};
config = mkIf cfg.enable {
networking.firewall.allowedTCPPorts = [
3000
];
sops.secrets.invidious-db = {
format = "dotenv";
sopsFile = ../../../../../secrets/invidious-db.env;
key = "";
};
sops.secrets.invidious-config = {
mode = "666";
format = "yaml";
sopsFile = ../../../../../secrets/invidious-config.yaml;
key = "";
};
security.unprivilegedUsernsClone = true;
virtualisation = {
podman = {
enable = true;
autoPrune = {
enable = true;
dates = "weekly";
flags = [ "--all" ];
};
defaultNetwork.settings = {
dns_enabled = true;
};
};
};
virtualisation.oci-containers.containers = {
invidious = {
image = "quay.io/invidious/invidious:latest";
hostname = "invidious";
volumes = [ "/run/secrets/invidious-config:/invidious/config/config.yml" ];
ports = [
"192.168.10.3:3000:3000"
"[fd00:192:168:10::3]:3000:3000"
];
dependsOn = [ "invidious-db" ];
};
signature-helper = {
image = "quay.io/invidious/inv-sig-helper:latest";
hostname = "signature-helper";
cmd = [
"--tcp"
"0.0.0.0:12999"
];
};
invidious-db = {
image = "docker.io/library/postgres:14";
hostname = "invidious-db";
volumes = [
"postgresdata:/var/lib/postgresql/data"
"${config.flakeRoot}/modules/nixos/virtualisation/podman/invidious/config/sql:/config/sql"
"${config.flakeRoot}/modules/nixos/virtualisation/podman/invidious/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh"
];
environmentFiles = [ /run/secrets/invidious-db ];
};
};
};
}

View file

@ -1,12 +0,0 @@
#!/bin/bash
set -eou pipefail
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/channels.sql
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/videos.sql
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/channel_videos.sql
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/users.sql
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/session_ids.sql
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/nonces.sql
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/annotations.sql
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/playlists.sql
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/playlist_videos.sql

View file

@ -1,32 +0,0 @@
{
lib,
config,
namespace,
...
}:
with lib;
with lib.${namespace};
let
cfg = config.${namespace}.container.technitium;
in
{
options.${namespace}.container.technitium = {
enable = mkEnableOption "Technitium";
};
config = mkIf cfg.enable {
virtualisation.oci-containers.containers.technitium = {
image = "technitium/dns-server";
hostname = "blarm-dns";
ports = [
"192.168.1.202:5380:5380"
"192.168.1.202:53:53"
"192.168.1.202:53:53/udp"
"[fd00:192:168:1::202]:53:53"
"[fd00:192:168:1::202]:53:53/udp"
"[fd00:192:168:1::202]:5380:5380"
];
volumes = [ "config:/etc/dns" ];
};
};
}

View file

@ -8,16 +8,16 @@ final: prev: {
awesome-flake = (prev.awesome-flake or { }) // {
cinny = prev.cinny-unwrapped.overrideAttrs (_old: rec {
pname = "cinny-unwrapped";
version = "2025-06-11-15-30";
version = "325144d8b2ca53c32fc6e1eace0603968a5ddc40";
src = final.fetchFromGitHub {
owner = "GigiaJ";
repo = "cinny";
rev = "1b281fe37b29e4b4a36d8bc3007a9abf2240ffff";
hash = "sha256-3DKFOuFR7qYSvWsE/kAnaES/T9CFGNpmmOutE4o6vb4=";
rev = version;
hash = "sha256-822P12rzSLzje7KuBF2RB70SPdfCaHZaPV/1Nr4CCnY=";
};
npmDepsHash = "sha256-Z7GP3aorCnII7KfWajR8L+otiBxYC+uaMSYWcgmnZjw=";
npmDepsHash = "sha256-pP7JH/K9QSqyUVg0UFTDzZvRoL5CeP5pudv83eHVoTo=";
npmDeps = final.fetchNpmDeps {
inherit src;
name = "${pname}-${version}-npm-deps";

View file

@ -0,0 +1,13 @@
{
channels,
inputs,
...
}:
final: prev: {
prisma = prev.prisma.overrideAttrs (_old: rec {
pname = "prisma";
meta.mainProgram = "prisma";
});
}

View file

@ -59,7 +59,8 @@ with lib.${namespace};
linkwarden = enabled;
forgejo = enabled;
searxng = enabled;
immich = enabled;
#immich = enabled; # We wait for the proper version to be in nixpkgs
paperless = enabled;
};
#container.invidious = enabled;

View file

@ -72,6 +72,7 @@ with lib.${namespace};
system = {
tmpfs = enabled;
fwupd = enabled;
fonts = {
enable = true;
emoji = true;