Compare commits
17 commits
98425c9dcc
...
d9dff63cea
| Author | SHA1 | Date | |
|---|---|---|---|
|
d9dff63cea | ||
|
|
f288c688d0 | ||
|
|
17e059995f | ||
| 1b2f4c0381 | |||
| 179dd7be1f | |||
|
|
b739cd4190 | ||
|
|
9f1a6e85ee | ||
| 331a912c82 | |||
| c215f5f358 | |||
| bb75261d95 | |||
| 5d9c1fb6fc | |||
| 41bd07afb4 | |||
|
|
1e5ba64175 | ||
|
|
829a8dab4e | ||
|
|
be346e0e29 | ||
|
|
2d3726d535 | ||
|
|
06cd3dd1ac |
17 changed files with 646 additions and 447 deletions
|
|
@ -1,11 +1,11 @@
|
||||||
@_default: list
|
@_default: list
|
||||||
|
|
||||||
[doc('List machines')]
|
[doc('List machines')]
|
||||||
@list:
|
@list:
|
||||||
ls -1 ../systems/x86_64-linux/
|
ls -1 ../systems/x86_64-linux/
|
||||||
|
|
||||||
[no-exit-message]
|
[doc('Update the target machine')]
|
||||||
[doc('Update the target machine')]
|
[no-exit-message]
|
||||||
@update machine:
|
@update machine:
|
||||||
just assert '-d "../systems/x86_64-linux/{{ machine }}"' "Machine {{ machine }} does not exist, must be one of: $(ls ../systems/x86_64-linux/ | tr '\n' ' ')"
|
just assert '-d "../systems/x86_64-linux/{{ machine }}"' "Machine {{ machine }} does not exist, must be one of: $(ls ../systems/x86_64-linux/ | sed ':a;N;$!ba;s/\n/, /g')"
|
||||||
nixos-rebuild switch --use-remote-sudo --target-host {{ machine }} --flake ..#{{ machine }}
|
nixos-rebuild switch --use-remote-sudo --target-host {{ machine }} --flake ..#{{ machine }}
|
||||||
|
|
|
||||||
|
|
@ -1,36 +1,36 @@
|
||||||
set unstable
|
set unstable
|
||||||
|
|
||||||
base_path := invocation_directory() / "systems/x86_64-linux"
|
base_path := invocation_directory() / "systems/x86_64-linux"
|
||||||
# sops := "nix shell nixpkgs#sops --command sops"
|
# sops := "nix shell nixpkgs#sops --command sops"
|
||||||
# yq := "nix shell nixpkgs#yq --command yq"
|
# yq := "nix shell nixpkgs#yq --command yq"
|
||||||
sops := "sops"
|
sops := "sops"
|
||||||
yq := "yq"
|
yq := "yq"
|
||||||
|
|
||||||
@_default:
|
@_default:
|
||||||
just --list
|
just --list
|
||||||
|
|
||||||
[doc('list all vars of the target machine')]
|
[doc('list all vars of the target machine')]
|
||||||
list machine:
|
list machine:
|
||||||
sops decrypt {{ base_path }}/{{ machine }}/secrets.yml
|
sops decrypt {{ base_path }}/{{ machine }}/secrets.yml
|
||||||
|
|
||||||
@edit machine:
|
@edit machine:
|
||||||
sops edit {{ base_path }}/{{ machine }}/secrets.yml
|
sops edit {{ base_path }}/{{ machine }}/secrets.yml
|
||||||
|
|
||||||
@set machine key value:
|
@set machine key value:
|
||||||
sops set {{ base_path }}/{{ machine }}/secrets.yml "$(printf '%s\n' '["{{ key }}"]' | sed -E 's#/#"]["#g; s/\["([0-9]+)"\]/[\1]/g')" "\"$(echo '{{ value }}' | sed 's/\"/\\\"/g')\""
|
sops set {{ base_path }}/{{ machine }}/secrets.yml "$(printf '%s\n' '["{{ key }}"]' | sed -E 's#/#"]["#g; s/\["([0-9]+)"\]/[\1]/g')" "\"$(echo '{{ value }}' | sed 's/\"/\\\"/g')\""
|
||||||
|
|
||||||
git add {{ base_path }}/{{ machine }}/secrets.yml
|
git add {{ base_path }}/{{ machine }}/secrets.yml
|
||||||
git commit -m 'chore(secrets): set secret "{{ key }}" for machine "{{ machine}}"' -- {{ base_path }}/{{ machine }}/secrets.yml > /dev/null
|
git commit -m 'chore(secrets): set secret "{{ key }}" for machine "{{ machine}}"' -- {{ base_path }}/{{ machine }}/secrets.yml > /dev/null
|
||||||
|
|
||||||
echo "Done"
|
echo "Done"
|
||||||
|
|
||||||
@get machine key:
|
@get machine key:
|
||||||
sops decrypt {{ base_path }}/{{ machine }}/secrets.yml | yq ".$(echo "{{ key }}" | sed -E 's/\//./g')"
|
sops decrypt {{ base_path }}/{{ machine }}/secrets.yml | yq ".$(echo "{{ key }}" | sed -E 's/\//./g')"
|
||||||
|
|
||||||
@remove machine key:
|
@remove machine key:
|
||||||
sops unset {{ base_path }}/{{ machine }}/secrets.yml "$(printf '%s\n' '["{{ key }}"]' | sed -E 's#/#"]["#g; s/\["([0-9]+)"\]/[\1]/g')"
|
sops unset {{ base_path }}/{{ machine }}/secrets.yml "$(printf '%s\n' '["{{ key }}"]' | sed -E 's#/#"]["#g; s/\["([0-9]+)"\]/[\1]/g')"
|
||||||
|
|
||||||
git add {{ base_path }}/{{ machine }}/secrets.yml
|
git add {{ base_path }}/{{ machine }}/secrets.yml
|
||||||
git commit -m 'chore(secrets): removed secret "{{ key }}" from machine "{{ machine}}"' -- {{ base_path }}/{{ machine }}/secrets.yml > /dev/null
|
git commit -m 'chore(secrets): removed secret "{{ key }}" from machine "{{ machine}}"' -- {{ base_path }}/{{ machine }}/secrets.yml > /dev/null
|
||||||
|
|
||||||
echo "Done"
|
echo "Done"
|
||||||
64
.justfile
64
.justfile
|
|
@ -1,33 +1,33 @@
|
||||||
@_default:
|
@_default:
|
||||||
just --list --list-submodules
|
just --list --list-submodules
|
||||||
|
|
||||||
[doc('Manage vars')]
|
[doc('Manage vars')]
|
||||||
mod vars '.just/vars.just'
|
mod vars '.just/vars.just'
|
||||||
|
|
||||||
[doc('Manage machines')]
|
[doc('Manage machines')]
|
||||||
mod machine '.just/machine.just'
|
mod machine '.just/machine.just'
|
||||||
|
|
||||||
[doc('Show information about project')]
|
[doc('Show information about project')]
|
||||||
@show:
|
@show:
|
||||||
echo "show"
|
echo "show"
|
||||||
|
|
||||||
[doc('update the flake dependencies')]
|
[doc('update the flake dependencies')]
|
||||||
@update:
|
@update:
|
||||||
nix flake update
|
nix flake update
|
||||||
git commit -m 'chore: update dependencies' -- ./flake.lock > /dev/null
|
git commit -m 'chore: update dependencies' -- ./flake.lock > /dev/null
|
||||||
echo "Done"
|
echo "Done"
|
||||||
|
|
||||||
[doc('Introspection on flake output')]
|
[doc('Introspection on flake output')]
|
||||||
@select key:
|
@select key:
|
||||||
nix eval --json .#{{ key }} | jq .
|
nix eval --json .#{{ key }} | jq .
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
#===============================================================================================
|
#===============================================================================================
|
||||||
# Utils
|
# Utils
|
||||||
#===============================================================================================
|
#===============================================================================================
|
||||||
[no-exit-message]
|
[no-exit-message]
|
||||||
[no-cd]
|
[no-cd]
|
||||||
[private]
|
[private]
|
||||||
@assert condition message:
|
@assert condition message:
|
||||||
[ {{ condition }} ] || { echo -e 1>&2 "\n\x1b[1;41m Error \x1b[0m {{ message }}\n"; exit 1; }
|
[ {{ condition }} ] || { echo -e 1>&2 "\n\x1b[1;41m Error \x1b[0m {{ message }}\n"; exit 1; }
|
||||||
129
flake.lock
generated
129
flake.lock
generated
|
|
@ -402,7 +402,7 @@
|
||||||
},
|
},
|
||||||
"flake-utils-plus": {
|
"flake-utils-plus": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-utils": "flake-utils_4"
|
"flake-utils": "flake-utils_5"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1715533576,
|
"lastModified": 1715533576,
|
||||||
|
|
@ -457,7 +457,25 @@
|
||||||
},
|
},
|
||||||
"flake-utils_4": {
|
"flake-utils_4": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"systems": "systems_6"
|
"systems": "systems_5"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1731533236,
|
||||||
|
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "numtide",
|
||||||
|
"repo": "flake-utils",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"flake-utils_5": {
|
||||||
|
"inputs": {
|
||||||
|
"systems": "systems_7"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1694529238,
|
"lastModified": 1694529238,
|
||||||
|
|
@ -662,6 +680,25 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"mydia": {
|
||||||
|
"inputs": {
|
||||||
|
"flake-utils": "flake-utils_3",
|
||||||
|
"nixpkgs": "nixpkgs_5"
|
||||||
|
},
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1764568388,
|
||||||
|
"narHash": "sha256-kl8165eI0lUz9E96sdreZ48/nApydDfJP8IksjBveAw=",
|
||||||
|
"owner": "getmydia",
|
||||||
|
"repo": "mydia",
|
||||||
|
"rev": "74f0cf9a8ca782581ec0a35acf6526fccfbb6e2a",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "getmydia",
|
||||||
|
"repo": "mydia",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"nix-darwin": {
|
"nix-darwin": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
|
|
@ -708,8 +745,8 @@
|
||||||
"nix-minecraft": {
|
"nix-minecraft": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-compat": "flake-compat_3",
|
"flake-compat": "flake-compat_3",
|
||||||
"flake-utils": "flake-utils_3",
|
"flake-utils": "flake-utils_4",
|
||||||
"nixpkgs": "nixpkgs_5"
|
"nixpkgs": "nixpkgs_6"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1763171892,
|
"lastModified": 1763171892,
|
||||||
|
|
@ -856,6 +893,22 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"nixpkgs_10": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1762977756,
|
||||||
|
"narHash": "sha256-4PqRErxfe+2toFJFgcRKZ0UI9NSIOJa+7RXVtBhy4KE=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "c5ae371f1a6a7fd27823bc500d9390b38c05fa55",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "NixOS",
|
||||||
|
"ref": "nixos-unstable",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"nixpkgs_2": {
|
"nixpkgs_2": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1763469780,
|
"lastModified": 1763469780,
|
||||||
|
|
@ -905,6 +958,22 @@
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs_5": {
|
"nixpkgs_5": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1764242076,
|
||||||
|
"narHash": "sha256-sKoIWfnijJ0+9e4wRvIgm/HgE27bzwQxcEmo2J/gNpI=",
|
||||||
|
"owner": "NixOS",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"rev": "2fad6eac6077f03fe109c4d4eb171cf96791faa4",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "NixOS",
|
||||||
|
"ref": "nixos-unstable",
|
||||||
|
"repo": "nixpkgs",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"nixpkgs_6": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1748929857,
|
"lastModified": 1748929857,
|
||||||
"narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
|
"narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
|
||||||
|
|
@ -920,7 +989,7 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs_6": {
|
"nixpkgs_7": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1763421233,
|
"lastModified": 1763421233,
|
||||||
"narHash": "sha256-Stk9ZYRkGrnnpyJ4eqt9eQtdFWRRIvMxpNRf4sIegnw=",
|
"narHash": "sha256-Stk9ZYRkGrnnpyJ4eqt9eQtdFWRRIvMxpNRf4sIegnw=",
|
||||||
|
|
@ -936,7 +1005,7 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs_7": {
|
"nixpkgs_8": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1761880412,
|
"lastModified": 1761880412,
|
||||||
"narHash": "sha256-QoJjGd4NstnyOG4mm4KXF+weBzA2AH/7gn1Pmpfcb0A=",
|
"narHash": "sha256-QoJjGd4NstnyOG4mm4KXF+weBzA2AH/7gn1Pmpfcb0A=",
|
||||||
|
|
@ -952,7 +1021,7 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs_8": {
|
"nixpkgs_9": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1763191728,
|
"lastModified": 1763191728,
|
||||||
"narHash": "sha256-esRhOS0APE6k40Hs/jjReXg+rx+J5LkWw7cuWFKlwYA=",
|
"narHash": "sha256-esRhOS0APE6k40Hs/jjReXg+rx+J5LkWw7cuWFKlwYA=",
|
||||||
|
|
@ -968,22 +1037,6 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"nixpkgs_9": {
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1762977756,
|
|
||||||
"narHash": "sha256-4PqRErxfe+2toFJFgcRKZ0UI9NSIOJa+7RXVtBhy4KE=",
|
|
||||||
"owner": "NixOS",
|
|
||||||
"repo": "nixpkgs",
|
|
||||||
"rev": "c5ae371f1a6a7fd27823bc500d9390b38c05fa55",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "NixOS",
|
|
||||||
"ref": "nixos-unstable",
|
|
||||||
"repo": "nixpkgs",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"nur": {
|
"nur": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-parts": [
|
"flake-parts": [
|
||||||
|
|
@ -1014,8 +1067,8 @@
|
||||||
"flake-compat": "flake-compat_4",
|
"flake-compat": "flake-compat_4",
|
||||||
"flake-parts": "flake-parts_2",
|
"flake-parts": "flake-parts_2",
|
||||||
"mnw": "mnw",
|
"mnw": "mnw",
|
||||||
"nixpkgs": "nixpkgs_7",
|
"nixpkgs": "nixpkgs_8",
|
||||||
"systems": "systems_5"
|
"systems": "systems_6"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1762622004,
|
"lastModified": 1762622004,
|
||||||
|
|
@ -1065,11 +1118,12 @@
|
||||||
"himmelblau": "himmelblau",
|
"himmelblau": "himmelblau",
|
||||||
"home-manager": "home-manager",
|
"home-manager": "home-manager",
|
||||||
"jovian": "jovian",
|
"jovian": "jovian",
|
||||||
|
"mydia": "mydia",
|
||||||
"nix-minecraft": "nix-minecraft",
|
"nix-minecraft": "nix-minecraft",
|
||||||
"nixos-boot": "nixos-boot",
|
"nixos-boot": "nixos-boot",
|
||||||
"nixos-generators": "nixos-generators",
|
"nixos-generators": "nixos-generators",
|
||||||
"nixos-wsl": "nixos-wsl",
|
"nixos-wsl": "nixos-wsl",
|
||||||
"nixpkgs": "nixpkgs_6",
|
"nixpkgs": "nixpkgs_7",
|
||||||
"nvf": "nvf",
|
"nvf": "nvf",
|
||||||
"plasma-manager": "plasma-manager",
|
"plasma-manager": "plasma-manager",
|
||||||
"snowfall-lib": "snowfall-lib",
|
"snowfall-lib": "snowfall-lib",
|
||||||
|
|
@ -1162,7 +1216,7 @@
|
||||||
},
|
},
|
||||||
"sops-nix_2": {
|
"sops-nix_2": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"nixpkgs": "nixpkgs_8"
|
"nixpkgs": "nixpkgs_9"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1763509310,
|
"lastModified": 1763509310,
|
||||||
|
|
@ -1187,9 +1241,9 @@
|
||||||
"firefox-gnome-theme": "firefox-gnome-theme",
|
"firefox-gnome-theme": "firefox-gnome-theme",
|
||||||
"flake-parts": "flake-parts_3",
|
"flake-parts": "flake-parts_3",
|
||||||
"gnome-shell": "gnome-shell",
|
"gnome-shell": "gnome-shell",
|
||||||
"nixpkgs": "nixpkgs_9",
|
"nixpkgs": "nixpkgs_10",
|
||||||
"nur": "nur",
|
"nur": "nur",
|
||||||
"systems": "systems_7",
|
"systems": "systems_8",
|
||||||
"tinted-foot": "tinted-foot",
|
"tinted-foot": "tinted-foot",
|
||||||
"tinted-kitty": "tinted-kitty",
|
"tinted-kitty": "tinted-kitty",
|
||||||
"tinted-schemes": "tinted-schemes",
|
"tinted-schemes": "tinted-schemes",
|
||||||
|
|
@ -1330,13 +1384,28 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
|
"systems_9": {
|
||||||
|
"locked": {
|
||||||
|
"lastModified": 1681028828,
|
||||||
|
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||||
|
"type": "github"
|
||||||
|
},
|
||||||
|
"original": {
|
||||||
|
"owner": "nix-systems",
|
||||||
|
"repo": "default",
|
||||||
|
"type": "github"
|
||||||
|
}
|
||||||
|
},
|
||||||
"terranix": {
|
"terranix": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"flake-parts": "flake-parts_4",
|
"flake-parts": "flake-parts_4",
|
||||||
"nixpkgs": [
|
"nixpkgs": [
|
||||||
"nixpkgs"
|
"nixpkgs"
|
||||||
],
|
],
|
||||||
"systems": "systems_8"
|
"systems": "systems_9"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1762472226,
|
"lastModified": 1762472226,
|
||||||
|
|
|
||||||
75
flake.nix
75
flake.nix
|
|
@ -88,49 +88,54 @@
|
||||||
url = "https://git.clan.lol/clan/clan-core/archive/main.tar.gz";
|
url = "https://git.clan.lol/clan/clan-core/archive/main.tar.gz";
|
||||||
inputs.nixpkgs.follows = "nixpkgs";
|
inputs.nixpkgs.follows = "nixpkgs";
|
||||||
};
|
};
|
||||||
|
|
||||||
|
mydia = {
|
||||||
|
url = "github:getmydia/mydia";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = inputs: inputs.snowfall-lib.mkFlake {
|
outputs = inputs:
|
||||||
inherit inputs;
|
inputs.snowfall-lib.mkFlake {
|
||||||
src = ./.;
|
inherit inputs;
|
||||||
|
src = ./.;
|
||||||
|
|
||||||
snowfall = {
|
snowfall = {
|
||||||
namespace = "sneeuwvlok";
|
namespace = "sneeuwvlok";
|
||||||
|
|
||||||
meta = {
|
meta = {
|
||||||
name = "sneeuwvlok";
|
name = "sneeuwvlok";
|
||||||
title = "Sneeuwvlok";
|
title = "Sneeuwvlok";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
|
||||||
|
|
||||||
channels-config = {
|
channels-config = {
|
||||||
allowUnfree = true;
|
allowUnfree = true;
|
||||||
permittedInsecurePackages = [
|
permittedInsecurePackages = [
|
||||||
# Due to *arr stack
|
# Due to *arr stack
|
||||||
"dotnet-sdk-6.0.428"
|
"dotnet-sdk-6.0.428"
|
||||||
"aspnetcore-runtime-6.0.36"
|
"aspnetcore-runtime-6.0.36"
|
||||||
|
|
||||||
# I think this is because of zen
|
# I think this is because of zen
|
||||||
"qtwebengine-5.15.19"
|
"qtwebengine-5.15.19"
|
||||||
|
|
||||||
# For Nheko, the matrix client
|
# For Nheko, the matrix client
|
||||||
"olm-3.2.16"
|
"olm-3.2.16"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
overlays = with inputs; [
|
||||||
|
fenix.overlays.default
|
||||||
|
nix-minecraft.overlay
|
||||||
|
flux.overlays.default
|
||||||
|
];
|
||||||
|
|
||||||
|
systems.modules = with inputs; [
|
||||||
|
clan-core.nixosModules.default
|
||||||
|
];
|
||||||
|
|
||||||
|
homes.modules = with inputs; [
|
||||||
|
stylix.homeModules.stylix
|
||||||
|
plasma-manager.homeModules.plasma-manager
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
overlays = with inputs; [
|
|
||||||
fenix.overlays.default
|
|
||||||
nix-minecraft.overlay
|
|
||||||
flux.overlays.default
|
|
||||||
];
|
|
||||||
|
|
||||||
systems.modules = with inputs; [
|
|
||||||
clan-core.nixosModules.default
|
|
||||||
];
|
|
||||||
|
|
||||||
homes.modules = with inputs; [
|
|
||||||
stylix.homeModules.stylix
|
|
||||||
plasma-manager.homeModules.plasma-manager
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,55 +1,55 @@
|
||||||
{ inputs, config, lib, pkgs, namespace, ... }:
|
{ inputs, config, lib, pkgs, namespace, ... }:
|
||||||
let
|
let
|
||||||
inherit (lib) mkIf mkEnableOption;
|
inherit (lib) mkIf mkEnableOption;
|
||||||
|
|
||||||
cfg = config.${namespace}.application.steam;
|
cfg = config.${namespace}.application.steam;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options.${namespace}.application.steam = {
|
options.${namespace}.application.steam = {
|
||||||
enable = mkEnableOption "enable steam";
|
enable = mkEnableOption "enable steam";
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
config = mkIf cfg.enable {
|
||||||
home.packages = with pkgs; [ protonup ];
|
home.packages = with pkgs; [ protonup-ng ];
|
||||||
|
|
||||||
home.sessionVariables = {
|
home.sessionVariables = {
|
||||||
STEAM_EXTRA_COMPAT_TOOLS_PATHS = "\${HOME}/.steam/root/compatibilitytools.d";
|
STEAM_EXTRA_COMPAT_TOOLS_PATHS = "\${HOME}/.steam/root/compatibilitytools.d";
|
||||||
};
|
};
|
||||||
|
|
||||||
programs = {
|
programs = {
|
||||||
# steam = {
|
# steam = {
|
||||||
# enable = true;
|
# enable = true;
|
||||||
# package = pkgs.steam-small.override {
|
# package = pkgs.steam-small.override {
|
||||||
# extraEnv = {
|
# extraEnv = {
|
||||||
# DXVK_HUD = "compiler";
|
# DXVK_HUD = "compiler";
|
||||||
# MANGOHUD = true;
|
# MANGOHUD = true;
|
||||||
# };
|
# };
|
||||||
# };
|
# };
|
||||||
|
|
||||||
# gamescopeSession = {
|
# gamescopeSession = {
|
||||||
# enable = true;
|
# enable = true;
|
||||||
# args = ["--immediate-flips"];
|
# args = ["--immediate-flips"];
|
||||||
# };
|
# };
|
||||||
# };
|
# };
|
||||||
|
|
||||||
# https://github.com/FeralInteractive/gamemode
|
# https://github.com/FeralInteractive/gamemode
|
||||||
# gamemode = {
|
# gamemode = {
|
||||||
# enable = true;
|
# enable = true;
|
||||||
# enableRenice = true;
|
# enableRenice = true;
|
||||||
# settings = {};
|
# settings = {};
|
||||||
# };
|
# };
|
||||||
|
|
||||||
# gamescope = {
|
# gamescope = {
|
||||||
# enable = true;
|
# enable = true;
|
||||||
# capSysNice = true;
|
# capSysNice = true;
|
||||||
# env = {
|
# env = {
|
||||||
# DXVK_HDR = "1";
|
# DXVK_HDR = "1";
|
||||||
# ENABLE_GAMESCOPE_WSI = "1";
|
# ENABLE_GAMESCOPE_WSI = "1";
|
||||||
# WINE_FULLSCREEN_FSR = "1";
|
# WINE_FULLSCREEN_FSR = "1";
|
||||||
# WLR_RENDERER = "vulkan";
|
# WLR_RENDERER = "vulkan";
|
||||||
# };
|
# };
|
||||||
# args = ["--hdr-enabled"];
|
# args = ["--hdr-enabled"];
|
||||||
# };
|
# };
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,15 +1,15 @@
|
||||||
{ inputs, config, lib, pkgs, namespace, ... }:
|
{ inputs, config, lib, pkgs, namespace, ... }:
|
||||||
let
|
let
|
||||||
inherit (lib) mkIf mkEnableOption;
|
inherit (lib) mkIf mkEnableOption;
|
||||||
|
|
||||||
cfg = config.${namespace}.application.teamspeak;
|
cfg = config.${namespace}.application.teamspeak;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
options.${namespace}.application.teamspeak = {
|
options.${namespace}.application.teamspeak = {
|
||||||
enable = mkEnableOption "enable teamspeak";
|
enable = mkEnableOption "enable teamspeak";
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
config = mkIf cfg.enable {
|
||||||
home.packages = with pkgs; [ teamspeak_client ];
|
home.packages = with pkgs; [ teamspeak3 teamspeak6-client ];
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -13,7 +13,7 @@ in
|
||||||
|
|
||||||
organization = mkOption {
|
organization = mkOption {
|
||||||
type = types.attrsOf (types.submodule ({ name, ... }: {
|
type = types.attrsOf (types.submodule ({ name, ... }: {
|
||||||
options =
|
options =
|
||||||
let
|
let
|
||||||
org = name;
|
org = name;
|
||||||
in
|
in
|
||||||
|
|
@ -23,11 +23,11 @@ in
|
||||||
default = false;
|
default = false;
|
||||||
example = "true";
|
example = "true";
|
||||||
description = ''
|
description = ''
|
||||||
True sets the org as default org for the instance. Only one org can be default org.
|
True sets the '${org}' org as default org for the instance. Only one org can be default org.
|
||||||
Nothing happens if you set it to false until you set another org as default org.
|
Nothing happens if you set it to false until you set another org as default org.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
project = mkOption {
|
project = mkOption {
|
||||||
default = {};
|
default = {};
|
||||||
type = types.attrsOf (types.submodule {
|
type = types.attrsOf (types.submodule {
|
||||||
|
|
@ -46,7 +46,7 @@ in
|
||||||
default = null;
|
default = null;
|
||||||
example = "enforceProjectResourceOwnerPolicy";
|
example = "enforceProjectResourceOwnerPolicy";
|
||||||
description = ''
|
description = ''
|
||||||
Defines from where the private labeling should be triggered,
|
Defines from where the private labeling should be triggered,
|
||||||
|
|
||||||
supported values:
|
supported values:
|
||||||
- unspecified
|
- unspecified
|
||||||
|
|
@ -54,7 +54,7 @@ in
|
||||||
- allowLoginUserResourceOwnerPolicy
|
- allowLoginUserResourceOwnerPolicy
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
projectRoleAssertion = mkOption {
|
projectRoleAssertion = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
|
|
@ -63,7 +63,7 @@ in
|
||||||
Describes if roles of user should be added in token.
|
Describes if roles of user should be added in token.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
projectRoleCheck = mkOption {
|
projectRoleCheck = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
|
|
@ -72,11 +72,11 @@ in
|
||||||
ZITADEL checks if the user has at least one on this project.
|
ZITADEL checks if the user has at least one on this project.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
role = mkOption {
|
role = mkOption {
|
||||||
default = {};
|
default = {};
|
||||||
type = types.attrsOf (types.submodule ({ name, ... }: {
|
type = types.attrsOf (types.submodule ({ name, ... }: {
|
||||||
options =
|
options =
|
||||||
let
|
let
|
||||||
roleName = name;
|
roleName = name;
|
||||||
in
|
in
|
||||||
|
|
@ -101,12 +101,12 @@ in
|
||||||
};
|
};
|
||||||
}));
|
}));
|
||||||
};
|
};
|
||||||
|
|
||||||
assign = mkOption {
|
assign = mkOption {
|
||||||
default = {};
|
default = {};
|
||||||
type = types.attrsOf (types.listOf types.str);
|
type = types.attrsOf (types.listOf types.str);
|
||||||
};
|
};
|
||||||
|
|
||||||
application = mkOption {
|
application = mkOption {
|
||||||
default = {};
|
default = {};
|
||||||
type = types.attrsOf (types.submodule {
|
type = types.attrsOf (types.submodule {
|
||||||
|
|
@ -141,8 +141,8 @@ in
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
exportMap =
|
exportMap =
|
||||||
let
|
let
|
||||||
strOpt = mkOption { type = types.nullOr types.str; default = null; };
|
strOpt = mkOption { type = types.nullOr types.str; default = null; };
|
||||||
in
|
in
|
||||||
mkOption {
|
mkOption {
|
||||||
|
|
@ -164,11 +164,11 @@ in
|
||||||
};
|
};
|
||||||
});
|
});
|
||||||
};
|
};
|
||||||
|
|
||||||
user = mkOption {
|
user = mkOption {
|
||||||
default = {};
|
default = {};
|
||||||
type = types.attrsOf (types.submodule ({ name, ... }: {
|
type = types.attrsOf (types.submodule ({ name, ... }: {
|
||||||
options =
|
options =
|
||||||
let
|
let
|
||||||
username = name;
|
username = name;
|
||||||
in
|
in
|
||||||
|
|
@ -226,7 +226,7 @@ in
|
||||||
};
|
};
|
||||||
}));
|
}));
|
||||||
};
|
};
|
||||||
|
|
||||||
action = mkOption {
|
action = mkOption {
|
||||||
default = {};
|
default = {};
|
||||||
type = types.attrsOf (types.submodule ({ name, ... }: {
|
type = types.attrsOf (types.submodule ({ name, ... }: {
|
||||||
|
|
@ -263,7 +263,7 @@ in
|
||||||
};
|
};
|
||||||
}));
|
}));
|
||||||
};
|
};
|
||||||
|
|
||||||
triggers = mkOption {
|
triggers = mkOption {
|
||||||
default = [];
|
default = [];
|
||||||
type = types.listOf (types.submodule {
|
type = types.listOf (types.submodule {
|
||||||
|
|
@ -321,28 +321,20 @@ in
|
||||||
accessTokenType = mapEnum "OIDC_TOKEN_TYPE" value;
|
accessTokenType = mapEnum "OIDC_TOKEN_TYPE" value;
|
||||||
}."${type}" or value);
|
}."${type}" or value);
|
||||||
|
|
||||||
toResource = name: value: nameValuePair
|
toResource = name: value: nameValuePair
|
||||||
(toSnakeCase name)
|
(toSnakeCase name)
|
||||||
(lib.mapAttrs' (k: v: nameValuePair (toSnakeCase k) (mapValue k v)) value);
|
(lib.mapAttrs' (k: v: nameValuePair (toSnakeCase k) (mapValue k v)) value);
|
||||||
|
|
||||||
withRef = type: name: attrs: attrs // (mapRef type name);
|
withRef = type: name: attrs: attrs // (mapRef type name);
|
||||||
|
|
||||||
select = keys: callback: set:
|
select = keys: callback: set:
|
||||||
if (length keys) == 0 then
|
if (length keys) == 0 then
|
||||||
mapAttrs' callback set
|
mapAttrs' callback set
|
||||||
else let key = head keys; in
|
else let key = head keys; in
|
||||||
concatMapAttrs (k: v: select (drop 1 keys) (callback k) (v.${key} or {})) set
|
concatMapAttrs (k: v: select (drop 1 keys) (callback k) (v.${key} or {})) set
|
||||||
;
|
;
|
||||||
|
|
||||||
append = attrList: set: set // (listToAttrs attrList);
|
append = attrList: set: set // (listToAttrs attrList);
|
||||||
forEach = src: key: set:
|
|
||||||
let
|
|
||||||
_key = concatMapStringsSep "_" (k: "\${item.${k}}") key;
|
|
||||||
in
|
|
||||||
{
|
|
||||||
forEach = "{ for item in ${src} : \"${_key}\" => item }";
|
|
||||||
}
|
|
||||||
// set;
|
|
||||||
|
|
||||||
config' = config;
|
config' = config;
|
||||||
|
|
||||||
|
|
@ -352,7 +344,21 @@ in
|
||||||
|
|
||||||
modules = [
|
modules = [
|
||||||
({ config, lib, ... }: {
|
({ config, lib, ... }: {
|
||||||
config = {
|
config =
|
||||||
|
let
|
||||||
|
forEach = src: key: set:
|
||||||
|
let
|
||||||
|
_key = concatMapStringsSep "_" (k: "\${item.${k}}") key;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
forEach = lib.tfRef ''{
|
||||||
|
for item in ${src} :
|
||||||
|
"''${item.org}_''${item.name}" => item
|
||||||
|
}'';
|
||||||
|
}
|
||||||
|
// set;
|
||||||
|
in
|
||||||
|
{
|
||||||
terraform.required_providers.zitadel = {
|
terraform.required_providers.zitadel = {
|
||||||
source = "zitadel/zitadel";
|
source = "zitadel/zitadel";
|
||||||
version = "2.2.0";
|
version = "2.2.0";
|
||||||
|
|
@ -376,18 +382,18 @@ in
|
||||||
}
|
}
|
||||||
] ])
|
] ])
|
||||||
";
|
";
|
||||||
orgs = cfg.organization |> mapAttrs (org: _: lib.tfRef "resource.zitadel_org.${org}.id");
|
orgs = cfg.organization |> mapAttrs (org: _: lib.tfRef "resource.zitadel_org.${org}.id");
|
||||||
};
|
};
|
||||||
|
|
||||||
resource = {
|
resource = {
|
||||||
# Organizations
|
# Organizations
|
||||||
zitadel_org = cfg.organization |> select [] (name: { isDefault, ... }:
|
zitadel_org = cfg.organization |> select [] (name: { isDefault, ... }:
|
||||||
{ inherit name isDefault; }
|
{ inherit name isDefault; }
|
||||||
|> toResource name
|
|> toResource name
|
||||||
);
|
);
|
||||||
|
|
||||||
# Projects per organization
|
# Projects per organization
|
||||||
zitadel_project = cfg.organization |> select [ "project" ] (org: name: { hasProjectCheck, privateLabelingSetting, projectRoleAssertion, projectRoleCheck, ... }:
|
zitadel_project = cfg.organization |> select [ "project" ] (org: name: { hasProjectCheck, privateLabelingSetting, projectRoleAssertion, projectRoleCheck, ... }:
|
||||||
{
|
{
|
||||||
inherit name hasProjectCheck privateLabelingSetting projectRoleAssertion projectRoleCheck;
|
inherit name hasProjectCheck privateLabelingSetting projectRoleAssertion projectRoleCheck;
|
||||||
}
|
}
|
||||||
|
|
@ -396,7 +402,7 @@ in
|
||||||
);
|
);
|
||||||
|
|
||||||
# Each OIDC app per project
|
# Each OIDC app per project
|
||||||
zitadel_application_oidc = cfg.organization |> select [ "project" "application" ] (org: project: name: { redirectUris, grantTypes, responseTypes, ...}:
|
zitadel_application_oidc = cfg.organization |> select [ "project" "application" ] (org: project: name: { redirectUris, grantTypes, responseTypes, ...}:
|
||||||
{
|
{
|
||||||
inherit name redirectUris grantTypes responseTypes;
|
inherit name redirectUris grantTypes responseTypes;
|
||||||
|
|
||||||
|
|
@ -404,41 +410,41 @@ in
|
||||||
idTokenRoleAssertion = true;
|
idTokenRoleAssertion = true;
|
||||||
accessTokenType = "JWT";
|
accessTokenType = "JWT";
|
||||||
}
|
}
|
||||||
|> withRef "org" org
|
|> withRef "org" org
|
||||||
|> withRef "project" "${org}_${project}"
|
|> withRef "project" "${org}_${project}"
|
||||||
|> toResource "${org}_${project}_${name}"
|
|> toResource "${org}_${project}_${name}"
|
||||||
);
|
);
|
||||||
|
|
||||||
# Each project role
|
# Each project role
|
||||||
zitadel_project_role = cfg.organization |> select [ "project" "role" ] (org: project: name: value:
|
zitadel_project_role = cfg.organization |> select [ "project" "role" ] (org: project: name: value:
|
||||||
{ inherit (value) displayName group; roleKey = name; }
|
{ inherit (value) displayName group; roleKey = name; }
|
||||||
|> withRef "org" org
|
|> withRef "org" org
|
||||||
|> withRef "project" "${org}_${project}"
|
|> withRef "project" "${org}_${project}"
|
||||||
|> toResource "${org}_${project}_${name}"
|
|> toResource "${org}_${project}_${name}"
|
||||||
);
|
);
|
||||||
|
|
||||||
# Each project role assignment
|
# Each project role assignment
|
||||||
zitadel_user_grant = cfg.organization |> select [ "project" "assign" ] (org: project: user: roles:
|
zitadel_user_grant = cfg.organization |> select [ "project" "assign" ] (org: project: user: roles:
|
||||||
{ roleKeys = roles; }
|
{ roleKeys = roles; }
|
||||||
|> withRef "org" org
|
|> withRef "org" org
|
||||||
|> withRef "project" "${org}_${project}"
|
|> withRef "project" "${org}_${project}"
|
||||||
|> withRef "user" "${org}_${user}"
|
|> withRef "user" "${org}_${user}"
|
||||||
|> toResource "${org}_${project}_${user}"
|
|> toResource "${org}_${project}_${user}"
|
||||||
);
|
);
|
||||||
|
|
||||||
# Users
|
# Users
|
||||||
zitadel_human_user =
|
zitadel_human_user =
|
||||||
cfg.organization
|
cfg.organization
|
||||||
|> select [ "user" ] (org: name: { email, userName, firstName, lastName, ... }:
|
|> select [ "user" ] (org: name: { email, userName, firstName, lastName, ... }:
|
||||||
{
|
{
|
||||||
inherit email userName firstName lastName;
|
inherit email userName firstName lastName;
|
||||||
|
|
||||||
isEmailVerified = true;
|
isEmailVerified = true;
|
||||||
}
|
}
|
||||||
|> withRef "org" org
|
|> withRef "org" org
|
||||||
|> toResource "${org}_${name}"
|
|> toResource "${org}_${name}"
|
||||||
)
|
)
|
||||||
|> append
|
|> append
|
||||||
[
|
[
|
||||||
(forEach "local.extra_users" [ "org" "name" ] {
|
(forEach "local.extra_users" [ "org" "name" ] {
|
||||||
orgId = lib.tfRef "local.orgs[each.value.org]";
|
orgId = lib.tfRef "local.orgs[each.value.org]";
|
||||||
|
|
@ -446,7 +452,7 @@ in
|
||||||
email = lib.tfRef "each.value.email";
|
email = lib.tfRef "each.value.email";
|
||||||
firstName = lib.tfRef "each.value.firstName";
|
firstName = lib.tfRef "each.value.firstName";
|
||||||
lastName = lib.tfRef "each.value.lastName";
|
lastName = lib.tfRef "each.value.lastName";
|
||||||
|
|
||||||
isEmailVerified = true;
|
isEmailVerified = true;
|
||||||
}
|
}
|
||||||
|> toResource "extraUsers")
|
|> toResource "extraUsers")
|
||||||
|
|
@ -454,20 +460,20 @@ in
|
||||||
;
|
;
|
||||||
|
|
||||||
# Global user roles
|
# Global user roles
|
||||||
zitadel_instance_member =
|
zitadel_instance_member =
|
||||||
cfg.organization
|
cfg.organization
|
||||||
|> filterAttrsRecursive (n: v: !(v ? "instanceRoles" && (length v.instanceRoles) == 0))
|
|> filterAttrsRecursive (n: v: !(v ? "instanceRoles" && (length v.instanceRoles) == 0))
|
||||||
|> select [ "user" ] (org: name: { instanceRoles, ... }:
|
|> select [ "user" ] (org: name: { instanceRoles, ... }:
|
||||||
{ roles = instanceRoles; }
|
{ roles = instanceRoles; }
|
||||||
|> withRef "user" "${org}_${name}"
|
|> withRef "user" "${org}_${name}"
|
||||||
|> toResource "${org}_${name}"
|
|> toResource "${org}_${name}"
|
||||||
);
|
);
|
||||||
|
|
||||||
# Organazation specific roles
|
# Organazation specific roles
|
||||||
zitadel_org_member =
|
zitadel_org_member =
|
||||||
cfg.organization
|
cfg.organization
|
||||||
|> filterAttrsRecursive (n: v: !(v ? "roles" && (length v.roles) == 0))
|
|> filterAttrsRecursive (n: v: !(v ? "roles" && (length v.roles) == 0))
|
||||||
|> select [ "user" ] (org: name: { roles, ... }:
|
|> select [ "user" ] (org: name: { roles, ... }:
|
||||||
{ inherit roles; }
|
{ inherit roles; }
|
||||||
|> withRef "org" org
|
|> withRef "org" org
|
||||||
|> withRef "user" "${org}_${name}"
|
|> withRef "user" "${org}_${name}"
|
||||||
|
|
@ -475,9 +481,9 @@ in
|
||||||
);
|
);
|
||||||
|
|
||||||
# Organazation's actions
|
# Organazation's actions
|
||||||
zitadel_action = cfg.organization |> select [ "action" ] (org: name: { timeout, allowedToFail, script, ...}:
|
zitadel_action = cfg.organization |> select [ "action" ] (org: name: { timeout, allowedToFail, script, ...}:
|
||||||
{
|
{
|
||||||
inherit allowedToFail name;
|
inherit allowedToFail name;
|
||||||
timeout = "${toString timeout}s";
|
timeout = "${toString timeout}s";
|
||||||
script = "const ${name} = ${script}";
|
script = "const ${name} = ${script}";
|
||||||
}
|
}
|
||||||
|
|
@ -486,20 +492,20 @@ in
|
||||||
);
|
);
|
||||||
|
|
||||||
# Organazation's action assignments
|
# Organazation's action assignments
|
||||||
zitadel_trigger_actions =
|
zitadel_trigger_actions =
|
||||||
cfg.organization
|
cfg.organization
|
||||||
|> concatMapAttrs (org: { triggers, ... }:
|
|> concatMapAttrs (org: { triggers, ... }:
|
||||||
triggers
|
triggers
|
||||||
|> imap0 (i: { flowType, triggerType, actions, ... }: (let name = "trigger_${toString i}"; in
|
|> imap0 (i: { flowType, triggerType, actions, ... }: (let name = "trigger_${toString i}"; in
|
||||||
{
|
{
|
||||||
inherit flowType triggerType;
|
inherit flowType triggerType;
|
||||||
|
|
||||||
actionIds =
|
actionIds =
|
||||||
actions
|
actions
|
||||||
|> map (action: (lib.tfRef "zitadel_action.${org}_${toSnakeCase action}.id"));
|
|> map (action: (lib.tfRef "zitadel_action.${org}_${toSnakeCase action}.id"));
|
||||||
}
|
}
|
||||||
|> withRef "org" org
|
|> withRef "org" org
|
||||||
|> toResource "${org}_${name}"
|
|> toResource "${org}_${name}"
|
||||||
))
|
))
|
||||||
|> listToAttrs
|
|> listToAttrs
|
||||||
);
|
);
|
||||||
|
|
@ -516,7 +522,7 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
# Client credentials per app
|
# Client credentials per app
|
||||||
local_sensitive_file = cfg.organization |> select [ "project" "application" ] (org: project: name: { exportMap, ... }:
|
local_sensitive_file = cfg.organization |> select [ "project" "application" ] (org: project: name: { exportMap, ... }:
|
||||||
nameValuePair "${org}_${project}_${name}" {
|
nameValuePair "${org}_${project}_${name}" {
|
||||||
content = ''
|
content = ''
|
||||||
${if exportMap.client_id != null then exportMap.client_id else "CLIENT_ID"}=${lib.tfRef "resource.zitadel_application_oidc.${org}_${project}_${name}.client_id"}
|
${if exportMap.client_id != null then exportMap.client_id else "CLIENT_ID"}=${lib.tfRef "resource.zitadel_application_oidc.${org}_${project}_${name}.client_id"}
|
||||||
|
|
@ -530,7 +536,7 @@ in
|
||||||
})
|
})
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
mkIf cfg.enable {
|
mkIf cfg.enable {
|
||||||
${namespace}.services.persistance.postgresql.enable = true;
|
${namespace}.services.persistance.postgresql.enable = true;
|
||||||
|
|
||||||
|
|
@ -548,8 +554,12 @@ in
|
||||||
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
wants = [ "zitadel.service" ];
|
wants = [ "zitadel.service" ];
|
||||||
|
|
||||||
script = ''
|
script =
|
||||||
|
let
|
||||||
|
tofu = lib.getExe pkgs.opentofu;
|
||||||
|
in
|
||||||
|
''
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
if [ "$(systemctl is-active zitadel)" != "active" ]; then
|
if [ "$(systemctl is-active zitadel)" != "active" ]; then
|
||||||
|
|
@ -564,11 +574,11 @@ in
|
||||||
cp -f ${terraformConfiguration} config.tf.json
|
cp -f ${terraformConfiguration} config.tf.json
|
||||||
|
|
||||||
# Initialize OpenTofu
|
# Initialize OpenTofu
|
||||||
${lib.getExe pkgs.opentofu} init
|
${tofu} init
|
||||||
|
|
||||||
# Run the infrastructure code
|
# Run the infrastructure code
|
||||||
# ${lib.getExe pkgs.opentofu} plan
|
${tofu} plan -refresh=false -out=tfplan
|
||||||
${lib.getExe pkgs.opentofu} apply -auto-approve
|
${tofu} apply -auto-approve tfplan
|
||||||
'';
|
'';
|
||||||
|
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
|
|
@ -628,7 +638,7 @@ in
|
||||||
|
|
||||||
Org = {
|
Org = {
|
||||||
Name = "kruining";
|
Name = "kruining";
|
||||||
|
|
||||||
Human = {
|
Human = {
|
||||||
UserName = "chris";
|
UserName = "chris";
|
||||||
FirstName = "Chris";
|
FirstName = "Chris";
|
||||||
|
|
@ -639,7 +649,7 @@ in
|
||||||
};
|
};
|
||||||
Password = "KaasIsAwesome1!";
|
Password = "KaasIsAwesome1!";
|
||||||
};
|
};
|
||||||
|
|
||||||
Machine = {
|
Machine = {
|
||||||
Machine = {
|
Machine = {
|
||||||
Username = "terraform-service-user";
|
Username = "terraform-service-user";
|
||||||
|
|
@ -648,7 +658,7 @@ in
|
||||||
MachineKey = { ExpirationDate = "2026-01-01T00:00:00Z"; Type = 1; };
|
MachineKey = { ExpirationDate = "2026-01-01T00:00:00Z"; Type = 1; };
|
||||||
# Pat = { ExpirationDate = "2026-01-01T00:00:00Z"; };
|
# Pat = { ExpirationDate = "2026-01-01T00:00:00Z"; };
|
||||||
};
|
};
|
||||||
|
|
||||||
# LoginClient.Machine = {
|
# LoginClient.Machine = {
|
||||||
# Username = "terraform-service-user";
|
# Username = "terraform-service-user";
|
||||||
# Name = "Terraform";
|
# Name = "Terraform";
|
||||||
|
|
@ -689,7 +699,7 @@ in
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||||
|
|
||||||
# Secrets
|
# Secrets
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,10 @@
|
||||||
{ config, lib, pkgs, namespace, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
namespace,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
inherit (builtins) toString toJSON;
|
inherit (builtins) toString toJSON;
|
||||||
inherit (lib) mkIf mkEnableOption;
|
inherit (lib) mkIf mkEnableOption;
|
||||||
|
|
||||||
|
|
@ -10,8 +15,7 @@ let
|
||||||
port = 4001;
|
port = 4001;
|
||||||
|
|
||||||
database = "synapse";
|
database = "synapse";
|
||||||
in
|
in {
|
||||||
{
|
|
||||||
options.${namespace}.services.communication.matrix = {
|
options.${namespace}.services.communication.matrix = {
|
||||||
enable = mkEnableOption "Matrix server (Synapse)";
|
enable = mkEnableOption "Matrix server (Synapse)";
|
||||||
};
|
};
|
||||||
|
|
@ -22,13 +26,13 @@ in
|
||||||
# virtualisation.podman.enable = true;
|
# virtualisation.podman.enable = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [ 4001 ];
|
networking.firewall.allowedTCPPorts = [4001];
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
matrix-synapse = {
|
matrix-synapse = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
extras = [ "oidc" ];
|
extras = ["oidc"];
|
||||||
|
|
||||||
extraConfigFiles = [
|
extraConfigFiles = [
|
||||||
config.sops.templates."synapse-oidc.yaml".path
|
config.sops.templates."synapse-oidc.yaml".path
|
||||||
|
|
@ -52,7 +56,7 @@ in
|
||||||
backchannel_logout_enabled = true;
|
backchannel_logout_enabled = true;
|
||||||
|
|
||||||
sso = {
|
sso = {
|
||||||
client_whitelist = [ "http://[::1]:9092" ];
|
client_whitelist = ["http://[::1]:9092"];
|
||||||
update_profile_information = true;
|
update_profile_information = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -75,7 +79,7 @@ in
|
||||||
|
|
||||||
resources = [
|
resources = [
|
||||||
{
|
{
|
||||||
names = [ "client" "federation" "openid" "metrics" "media" "health" ];
|
names = ["client" "federation" "openid" "metrics" "media" "health"];
|
||||||
compress = true;
|
compress = true;
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
@ -132,7 +136,7 @@ in
|
||||||
|
|
||||||
postgresql = {
|
postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ensureDatabases = [ database ];
|
ensureDatabases = [database];
|
||||||
ensureUsers = [
|
ensureUsers = [
|
||||||
{
|
{
|
||||||
name = database;
|
name = database;
|
||||||
|
|
@ -192,7 +196,7 @@ in
|
||||||
localpart_template: "{{ user.preferred_username }}"
|
localpart_template: "{{ user.preferred_username }}"
|
||||||
display_name_template: "{{ user.name }}"
|
display_name_template: "{{ user.name }}"
|
||||||
'';
|
'';
|
||||||
restartUnits = [ "matrix-synapse.service" ];
|
restartUnits = ["matrix-synapse.service"];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,12 +1,16 @@
|
||||||
{ config, lib, pkgs, namespace, ... }:
|
{
|
||||||
let
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
namespace,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
inherit (builtins) toString;
|
inherit (builtins) toString;
|
||||||
inherit (lib) mkIf mkEnableOption mkOption;
|
inherit (lib) mkIf mkEnableOption mkOption;
|
||||||
|
|
||||||
cfg = config.${namespace}.services.development.forgejo;
|
cfg = config.${namespace}.services.development.forgejo;
|
||||||
domain = "git.amarth.cloud";
|
domain = "git.amarth.cloud";
|
||||||
in
|
in {
|
||||||
{
|
|
||||||
options.${namespace}.services.development.forgejo = {
|
options.${namespace}.services.development.forgejo = {
|
||||||
enable = mkEnableOption "Forgejo";
|
enable = mkEnableOption "Forgejo";
|
||||||
|
|
||||||
|
|
@ -26,7 +30,7 @@ in
|
||||||
virtualisation.podman.enable = true;
|
virtualisation.podman.enable = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [ forgejo ];
|
environment.systemPackages = with pkgs; [forgejo];
|
||||||
|
|
||||||
services = {
|
services = {
|
||||||
forgejo = {
|
forgejo = {
|
||||||
|
|
@ -141,7 +145,7 @@ in
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
openssh.settings.AllowUsers = [ "forgejo" ];
|
openssh.settings.AllowUsers = ["forgejo"];
|
||||||
|
|
||||||
gitea-actions-runner = {
|
gitea-actions-runner = {
|
||||||
package = pkgs.forgejo-runner;
|
package = pkgs.forgejo-runner;
|
||||||
|
|
@ -184,14 +188,14 @@ in
|
||||||
"forgejo/action_runner_token" = {
|
"forgejo/action_runner_token" = {
|
||||||
owner = "gitea-runner";
|
owner = "gitea-runner";
|
||||||
group = "gitea-runner";
|
group = "gitea-runner";
|
||||||
restartUnits = [ "gitea-runner-default.service" ];
|
restartUnits = ["gitea-runner-default.service"];
|
||||||
};
|
};
|
||||||
|
|
||||||
"forgejo/email" = {
|
"forgejo/email" = {
|
||||||
owner = "forgejo";
|
owner = "forgejo";
|
||||||
group = "forgejo";
|
group = "forgejo";
|
||||||
key = "email/chris_kruining_eu";
|
key = "email/chris_kruining_eu";
|
||||||
restartUnits = [ "forgejo.service" ];
|
restartUnits = ["forgejo.service"];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
52
modules/nixos/services/media/mydia/default.nix
Normal file
52
modules/nixos/services/media/mydia/default.nix
Normal file
|
|
@ -0,0 +1,52 @@
|
||||||
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
namespace,
|
||||||
|
inputs,
|
||||||
|
system,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
|
inherit (lib) mkIf mkEnableOption;
|
||||||
|
|
||||||
|
cfg = config.${namespace}.services.media.mydia;
|
||||||
|
in {
|
||||||
|
imports = [
|
||||||
|
inputs.mydia.nixosModules.default
|
||||||
|
];
|
||||||
|
|
||||||
|
options.${namespace}.services.media.mydia = {
|
||||||
|
enable = mkEnableOption "Enable Mydia";
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
services.mydia = {
|
||||||
|
enable = true;
|
||||||
|
package = inputs.mydia.packages.${system}.default;
|
||||||
|
|
||||||
|
port = 2010;
|
||||||
|
listenAddress = "0.0.0.0";
|
||||||
|
openFirewall = true;
|
||||||
|
|
||||||
|
secretKeyBaseFile = config.sops.secrets."mydia/secret_key_base".path;
|
||||||
|
guardianSecretKeyFile = config.sops.secrets."mydia/guardian_secret".path;
|
||||||
|
|
||||||
|
oidc = {
|
||||||
|
enable = true;
|
||||||
|
issuer = "https://auth.kruining.eu";
|
||||||
|
clientIdFile = config.sops.secrets."mydia/oidc_id".path;
|
||||||
|
clientSecretFile = config.sops.secrets."mydia/oidc_secret".path;
|
||||||
|
scopes = ["openid" "profile" "email"];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
sops.secrets =
|
||||||
|
["secret_key_base" "guardian_secret" "oidc_id" "oidc_secret"]
|
||||||
|
|> lib.map (name:
|
||||||
|
lib.nameValuePair "mydia/${name}" {
|
||||||
|
owner = config.services.mydia.user;
|
||||||
|
group = config.services.mydia.group;
|
||||||
|
restartUnits = ["mydia.service"];
|
||||||
|
})
|
||||||
|
|> lib.listToAttrs;
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
@ -1,14 +1,20 @@
|
||||||
{ pkgs, config, lib, namespace, inputs, system, ... }:
|
{
|
||||||
let
|
pkgs,
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
namespace,
|
||||||
|
inputs,
|
||||||
|
system,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
inherit (builtins) toString;
|
inherit (builtins) toString;
|
||||||
inherit (lib) mkIf mkEnableOption mkOption types;
|
inherit (lib) mkIf mkEnableOption mkOption types;
|
||||||
|
|
||||||
cfg = config.${namespace}.services.media.servarr;
|
cfg = config.${namespace}.services.media.servarr;
|
||||||
in
|
in {
|
||||||
{
|
|
||||||
options.${namespace}.services.media = {
|
options.${namespace}.services.media = {
|
||||||
servarr = mkOption {
|
servarr = mkOption {
|
||||||
type = types.attrsOf (types.submodule ({ name, ... }: {
|
type = types.attrsOf (types.submodule ({name, ...}: {
|
||||||
options = {
|
options = {
|
||||||
enable = mkEnableOption "Enable ${name}";
|
enable = mkEnableOption "Enable ${name}";
|
||||||
debug = mkEnableOption "Use tofu plan instead of tofu apply for ${name} ";
|
debug = mkEnableOption "Use tofu plan instead of tofu apply for ${name} ";
|
||||||
|
|
@ -28,9 +34,13 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
config = {
|
config = {
|
||||||
services =
|
services =
|
||||||
cfg
|
cfg
|
||||||
|> lib.mapAttrsToList (service: { enable, port, ... }: (mkIf enable {
|
|> lib.mapAttrsToList (service: {
|
||||||
|
enable,
|
||||||
|
port,
|
||||||
|
...
|
||||||
|
}: (mkIf enable {
|
||||||
"${service}" = {
|
"${service}" = {
|
||||||
enable = true;
|
enable = true;
|
||||||
openFirewall = true;
|
openFirewall = true;
|
||||||
|
|
@ -58,31 +68,44 @@ in
|
||||||
};
|
};
|
||||||
}))
|
}))
|
||||||
|> lib.mergeAttrsList
|
|> lib.mergeAttrsList
|
||||||
|> (set: set // {
|
|> (set:
|
||||||
postgres = {
|
set
|
||||||
ensureDatabases = cfg |> lib.attrNames;
|
// {
|
||||||
ensureUsers = cfg |> lib.attrNames |> lib.map (service: {
|
postgresql = {
|
||||||
name = service;
|
ensureDatabases = cfg |> lib.attrNames;
|
||||||
ensureDBOwnership = true;
|
ensureUsers =
|
||||||
});
|
cfg
|
||||||
};
|
|> lib.attrNames
|
||||||
})
|
|> lib.map (service: {
|
||||||
;
|
name = service;
|
||||||
|
ensureDBOwnership = true;
|
||||||
|
});
|
||||||
|
};
|
||||||
|
});
|
||||||
|
|
||||||
systemd =
|
systemd =
|
||||||
cfg
|
cfg
|
||||||
|> lib.mapAttrsToList (service: { enable, debug, port, rootFolders, ... }: (mkIf enable {
|
|> lib.mapAttrsToList (service: {
|
||||||
|
enable,
|
||||||
|
debug,
|
||||||
|
port,
|
||||||
|
rootFolders,
|
||||||
|
...
|
||||||
|
}: (mkIf enable {
|
||||||
tmpfiles.rules = [
|
tmpfiles.rules = [
|
||||||
"d /var/lib/${service}ApplyTerraform 0755 ${service} ${service} -"
|
"d /var/lib/${service}ApplyTerraform 0755 ${service} ${service} -"
|
||||||
];
|
];
|
||||||
|
|
||||||
services."${service}ApplyTerraform" =
|
services."${service}ApplyTerraform" = let
|
||||||
let
|
|
||||||
terraformConfiguration = inputs.terranix.lib.terranixConfiguration {
|
terraformConfiguration = inputs.terranix.lib.terranixConfiguration {
|
||||||
inherit system;
|
inherit system;
|
||||||
|
|
||||||
modules = [
|
modules = [
|
||||||
({ config, lib, ... }: {
|
({
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}: {
|
||||||
config = {
|
config = {
|
||||||
variable = {
|
variable = {
|
||||||
api_key = {
|
api_key = {
|
||||||
|
|
@ -102,23 +125,21 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
resource = {
|
resource = {
|
||||||
"${service}_root_folder" =
|
"${service}_root_folder" =
|
||||||
rootFolders
|
rootFolders
|
||||||
|> lib.imap (i: f: lib.nameValuePair "local${toString i}" { path = f; })
|
|> lib.imap (i: f: lib.nameValuePair "local${toString i}" {path = f;})
|
||||||
|> lib.listToAttrs
|
|> lib.listToAttrs;
|
||||||
;
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
})
|
})
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
in
|
in {
|
||||||
{
|
|
||||||
description = "${service} terraform apply";
|
description = "${service} terraform apply";
|
||||||
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = ["multi-user.target"];
|
||||||
wants = [ "${service}.service" ];
|
wants = ["${service}.service"];
|
||||||
|
|
||||||
script = ''
|
script = ''
|
||||||
#!/usr/bin/env bash
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
|
@ -141,7 +162,11 @@ in
|
||||||
|
|
||||||
# Run the infrastructure code
|
# Run the infrastructure code
|
||||||
${lib.getExe pkgs.opentofu} \
|
${lib.getExe pkgs.opentofu} \
|
||||||
${if debug then "plan" else "apply -auto-approve"} \
|
${
|
||||||
|
if debug
|
||||||
|
then "plan"
|
||||||
|
else "apply -auto-approve"
|
||||||
|
} \
|
||||||
-var-file='${config.sops.templates."${service}/config.tfvars".path}'
|
-var-file='${config.sops.templates."${service}/config.tfvars".path}'
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
|
@ -158,31 +183,29 @@ in
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}))
|
}))
|
||||||
|> lib.mergeAttrsList
|
|> lib.mergeAttrsList;
|
||||||
;
|
|
||||||
|
|
||||||
users.users =
|
users.users =
|
||||||
cfg
|
cfg
|
||||||
|> lib.mapAttrsToList (service: { enable, ... }: (mkIf enable {
|
|> lib.mapAttrsToList (service: {enable, ...}: (mkIf enable {
|
||||||
"${service}".extraGroups = [ "media" ];
|
"${service}".extraGroups = ["media"];
|
||||||
}))
|
}))
|
||||||
|> lib.mergeAttrsList
|
|> lib.mergeAttrsList;
|
||||||
;
|
|
||||||
|
|
||||||
sops =
|
sops =
|
||||||
cfg
|
cfg
|
||||||
|> lib.mapAttrsToList (service: { enable, ... }: (mkIf enable {
|
|> lib.mapAttrsToList (service: {enable, ...}: (mkIf enable {
|
||||||
secrets."${service}/apikey" = {
|
secrets."${service}/apikey" = {
|
||||||
owner = service;
|
owner = service;
|
||||||
group = service;
|
group = service;
|
||||||
restartUnits = [ "${service}.service" ];
|
restartUnits = ["${service}.service"];
|
||||||
};
|
};
|
||||||
|
|
||||||
templates = {
|
templates = {
|
||||||
"${service}/config.env" = {
|
"${service}/config.env" = {
|
||||||
owner = service;
|
owner = service;
|
||||||
group = service;
|
group = service;
|
||||||
restartUnits = [ "${service}.service" ];
|
restartUnits = ["${service}.service"];
|
||||||
content = ''
|
content = ''
|
||||||
${lib.toUpper service}__AUTH__APIKEY="${config.sops.placeholder."${service}/apikey"}"
|
${lib.toUpper service}__AUTH__APIKEY="${config.sops.placeholder."${service}/apikey"}"
|
||||||
'';
|
'';
|
||||||
|
|
@ -191,18 +214,16 @@ in
|
||||||
"${service}/config.tfvars" = {
|
"${service}/config.tfvars" = {
|
||||||
owner = service;
|
owner = service;
|
||||||
group = service;
|
group = service;
|
||||||
restartUnits = [ "${service}.service" ];
|
restartUnits = ["${service}.service"];
|
||||||
content = ''
|
content = ''
|
||||||
api_key = "${config.sops.placeholder."${service}/apikey"}"
|
api_key = "${config.sops.placeholder."${service}/apikey"}"
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}))
|
}))
|
||||||
|> lib.mergeAttrsList
|
|> lib.mergeAttrsList;
|
||||||
;
|
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
# cfg
|
# cfg
|
||||||
# |> lib.mapAttrsToList (service: { enable, debug, port, rootFolders, ... }: (mkIf enable {
|
# |> lib.mapAttrsToList (service: { enable, debug, port, rootFolders, ... }: (mkIf enable {
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,25 +1,31 @@
|
||||||
{ pkgs, config, lib, namespace, ... }:
|
{
|
||||||
let
|
pkgs,
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
namespace,
|
||||||
|
...
|
||||||
|
}: let
|
||||||
inherit (builtins) toString;
|
inherit (builtins) toString;
|
||||||
inherit (lib) mkIf mkEnableOption mkOption types getAttrs toUpper concatMapAttrsStringSep;
|
inherit (lib) mkIf mkEnableOption mkOption types getAttrs toUpper concatMapAttrsStringSep;
|
||||||
|
|
||||||
cfg = config.${namespace}.services.security.vaultwarden;
|
cfg = config.${namespace}.services.security.vaultwarden;
|
||||||
|
|
||||||
databaseProviderSqlite = types.submodule ({ ... }: {
|
databaseProviderSqlite = types.submodule ({...}: {
|
||||||
options = {
|
options = {
|
||||||
type = mkOption {
|
type = mkOption {
|
||||||
type = types.enum [ "sqlite" ];
|
type = types.enum ["sqlite"];
|
||||||
};
|
};
|
||||||
|
|
||||||
file = mkOption {
|
file = mkOption {
|
||||||
type = types.str;
|
type = types.path;
|
||||||
description = '''';
|
description = ''
|
||||||
|
Path to sqlite database file.
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
});
|
});
|
||||||
|
|
||||||
databaseProviderPostgresql = types.submodule ({ ... }:
|
databaseProviderPostgresql = types.submodule ({...}: let
|
||||||
let
|
|
||||||
urlOptions = lib.${namespace}.options.mkUrlOptions {
|
urlOptions = lib.${namespace}.options.mkUrlOptions {
|
||||||
host = {
|
host = {
|
||||||
description = ''
|
description = ''
|
||||||
|
|
@ -40,36 +46,36 @@ let
|
||||||
example = "postgres";
|
example = "postgres";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
in
|
in {
|
||||||
{
|
options =
|
||||||
options = {
|
{
|
||||||
type = mkOption {
|
type = mkOption {
|
||||||
type = types.enum [ "postgresql" ];
|
type = types.enum ["postgresql"];
|
||||||
};
|
};
|
||||||
|
|
||||||
sslMode = mkOption {
|
sslMode = mkOption {
|
||||||
type = types.enum [ "verify-ca" "verify-full" "require" "prefer" "allow" "disabled" ];
|
type = types.enum ["verify-ca" "verify-full" "require" "prefer" "allow" "disabled"];
|
||||||
default = "verify-full";
|
default = "verify-full";
|
||||||
example = "verify-ca";
|
example = "verify-ca";
|
||||||
description = ''
|
description = ''
|
||||||
How to verify the server's ssl
|
How to verify the server's ssl
|
||||||
|
|
||||||
| mode | eavesdropping protection | MITM protection | Statement |
|
| mode | eavesdropping protection | MITM protection | Statement |
|
||||||
|-------------|--------------------------|----------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
|
|-------------|--------------------------|----------------------|---------------------------------------------------------------------------------------------------------------------------------------------|
|
||||||
| disable | No | No | I don't care about security, and I don't want to pay the overhead of encryption. |
|
| disable | No | No | I don't care about security, and I don't want to pay the overhead of encryption. |
|
||||||
| allow | Maybe | No | I don't care about security, but I will pay the overhead of encryption if the server insists on it. |
|
| allow | Maybe | No | I don't care about security, but I will pay the overhead of encryption if the server insists on it. |
|
||||||
| prefer | Maybe | No | I don't care about encryption, but I wish to pay the overhead of encryption if the server supports it. |
|
| prefer | Maybe | No | I don't care about encryption, but I wish to pay the overhead of encryption if the server supports it. |
|
||||||
| require | Yes | No | I want my data to be encrypted, and I accept the overhead. I trust that the network will make sure I always connect to the server I want. |
|
| require | Yes | No | I want my data to be encrypted, and I accept the overhead. I trust that the network will make sure I always connect to the server I want. |
|
||||||
| verify-ca | Yes | Depends on CA policy | I want my data encrypted, and I accept the overhead. I want to be sure that I connect to a server that I trust. |
|
| verify-ca | Yes | Depends on CA policy | I want my data encrypted, and I accept the overhead. I want to be sure that I connect to a server that I trust. |
|
||||||
| verify-full | Yes | Yes | I want my data encrypted, and I accept the overhead. I want to be sure that I connect to a server I trust, and that it's the one I specify. |
|
| verify-full | Yes | Yes | I want my data encrypted, and I accept the overhead. I want to be sure that I connect to a server I trust, and that it's the one I specify. |
|
||||||
|
|
||||||
[Source](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-SSLMODE-STATEMENTS)
|
[Source](https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-SSLMODE-STATEMENTS)
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
} // (urlOptions |> getAttrs [ "protocol" "host" "port" ]);
|
}
|
||||||
|
// (urlOptions |> getAttrs ["protocol" "host" "port"]);
|
||||||
});
|
});
|
||||||
in
|
in {
|
||||||
{
|
|
||||||
options.${namespace}.services.security.vaultwarden = {
|
options.${namespace}.services.security.vaultwarden = {
|
||||||
enable = mkEnableOption "enable vaultwarden";
|
enable = mkEnableOption "enable vaultwarden";
|
||||||
|
|
||||||
|
|
@ -136,7 +142,7 @@ in
|
||||||
|
|
||||||
postgresql = {
|
postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
ensureDatabases = [ "vaultwarden" ];
|
ensureDatabases = ["vaultwarden"];
|
||||||
ensureUsers = [
|
ensureUsers = [
|
||||||
{
|
{
|
||||||
name = "vaultwarden";
|
name = "vaultwarden";
|
||||||
|
|
@ -171,7 +177,7 @@ in
|
||||||
owner = config.users.users.vaultwarden.name;
|
owner = config.users.users.vaultwarden.name;
|
||||||
group = config.users.users.vaultwarden.name;
|
group = config.users.users.vaultwarden.name;
|
||||||
key = "email/chris_kruining_eu";
|
key = "email/chris_kruining_eu";
|
||||||
restartUnits = [ "vaultwarden.service" ];
|
restartUnits = ["vaultwarden.service"];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
@ -183,34 +189,31 @@ in
|
||||||
owner = config.users.users.vaultwarden.name;
|
owner = config.users.users.vaultwarden.name;
|
||||||
group = config.users.groups.vaultwarden.name;
|
group = config.users.groups.vaultwarden.name;
|
||||||
};
|
};
|
||||||
temp-db-output.content =
|
temp-db-output.content = let
|
||||||
let
|
config =
|
||||||
config =
|
cfg.database
|
||||||
cfg.database
|
|> (
|
||||||
|> ({ type, ... }@db:
|
{type, ...} @ db:
|
||||||
if type == "sqlite" then
|
if type == "sqlite"
|
||||||
{ inherit (db) type file; }
|
then {inherit (db) type file;}
|
||||||
else if type == "postgresql" then
|
else if type == "postgresql"
|
||||||
{
|
then {
|
||||||
inherit (db) type;
|
inherit (db) type;
|
||||||
url = lib.${namespace}.strings.toUrl {
|
url = lib.${namespace}.strings.toUrl {
|
||||||
inherit (db) protocol host port;
|
inherit (db) protocol host port;
|
||||||
path = "vaultwarden";
|
path = "vaultwarden";
|
||||||
query = {
|
query = {
|
||||||
sslmode = db.sslMode;
|
sslmode = db.sslMode;
|
||||||
};
|
|
||||||
};
|
};
|
||||||
}
|
};
|
||||||
else
|
}
|
||||||
{}
|
else {}
|
||||||
)
|
)
|
||||||
|> concatMapAttrsStringSep "\n" (n: v: "${toUpper n}=${v}")
|
|> concatMapAttrsStringSep "\n" (n: v: "${toUpper n}=${v}");
|
||||||
;
|
in ''
|
||||||
in
|
# GENERATED VALUES
|
||||||
''
|
${config}
|
||||||
# GENERATED VALUES
|
'';
|
||||||
${config}
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,2 +1,2 @@
|
||||||
{ ... }:
|
{...}: {
|
||||||
{}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,10 @@
|
||||||
{ mkShell, inputs, pkgs, ... }:
|
{
|
||||||
|
mkShell,
|
||||||
|
inputs,
|
||||||
|
pkgs,
|
||||||
|
stdenv,
|
||||||
|
...
|
||||||
|
}:
|
||||||
mkShell {
|
mkShell {
|
||||||
packages = with pkgs; [
|
packages = with pkgs; [
|
||||||
bash
|
bash
|
||||||
|
|
@ -7,6 +12,10 @@ mkShell {
|
||||||
just
|
just
|
||||||
yq
|
yq
|
||||||
pwgen
|
pwgen
|
||||||
inputs.clan-core.packages.x86_64-linux.clan-cli
|
alejandra
|
||||||
|
nil
|
||||||
|
nixd
|
||||||
|
openssl
|
||||||
|
inputs.clan-core.packages.${stdenv.hostPlatform.system}.clan-cli
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,5 +1,4 @@
|
||||||
{ ... }:
|
{...}: {
|
||||||
{
|
|
||||||
imports = [
|
imports = [
|
||||||
./disks.nix
|
./disks.nix
|
||||||
./hardware.nix
|
./hardware.nix
|
||||||
|
|
@ -8,7 +7,10 @@
|
||||||
networking = {
|
networking = {
|
||||||
interfaces.enp2s0 = {
|
interfaces.enp2s0 = {
|
||||||
ipv6.addresses = [
|
ipv6.addresses = [
|
||||||
{ address = "2a0d:6e00:1dc9:0::dead:beef"; prefixLength = 64; }
|
{
|
||||||
|
address = "2a0d:6e00:1dc9:0::dead:beef";
|
||||||
|
prefixLength = 64;
|
||||||
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
useDHCP = true;
|
useDHCP = true;
|
||||||
|
|
@ -39,7 +41,7 @@
|
||||||
sneeuwvlok = {
|
sneeuwvlok = {
|
||||||
services = {
|
services = {
|
||||||
backup.borg.enable = true;
|
backup.borg.enable = true;
|
||||||
|
|
||||||
authentication.zitadel = {
|
authentication.zitadel = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
|
|
@ -51,8 +53,8 @@
|
||||||
firstName = "Chris";
|
firstName = "Chris";
|
||||||
lastName = "Kruining";
|
lastName = "Kruining";
|
||||||
|
|
||||||
roles = [ "ORG_OWNER" ];
|
roles = ["ORG_OWNER"];
|
||||||
instanceRoles = [ "IAM_OWNER" ];
|
instanceRoles = ["IAM_OWNER"];
|
||||||
};
|
};
|
||||||
|
|
||||||
kaas = {
|
kaas = {
|
||||||
|
|
@ -78,27 +80,27 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
assign = {
|
assign = {
|
||||||
chris = [ "jellyfin" "jellyfin_admin" ];
|
chris = ["jellyfin" "jellyfin_admin"];
|
||||||
kaas = [ "jellyfin" ];
|
kaas = ["jellyfin"];
|
||||||
};
|
};
|
||||||
|
|
||||||
application = {
|
application = {
|
||||||
jellyfin = {
|
jellyfin = {
|
||||||
redirectUris = [ "https://jellyfin.kruining.eu/sso/OID/redirect/zitadel" ];
|
redirectUris = ["https://jellyfin.kruining.eu/sso/OID/redirect/zitadel"];
|
||||||
grantTypes = [ "authorizationCode" ];
|
grantTypes = ["authorizationCode"];
|
||||||
responseTypes = [ "code" ];
|
responseTypes = ["code"];
|
||||||
};
|
};
|
||||||
|
|
||||||
forgejo = {
|
forgejo = {
|
||||||
redirectUris = [ "https://git.amarth.cloud/user/oauth2/zitadel/callback" ];
|
redirectUris = ["https://git.amarth.cloud/user/oauth2/zitadel/callback"];
|
||||||
grantTypes = [ "authorizationCode" ];
|
grantTypes = ["authorizationCode"];
|
||||||
responseTypes = [ "code" ];
|
responseTypes = ["code"];
|
||||||
};
|
};
|
||||||
|
|
||||||
vaultwarden = {
|
vaultwarden = {
|
||||||
redirectUris = [ "https://vault.kruining.eu/identity/connect/oidc-signin" ];
|
redirectUris = ["https://vault.kruining.eu/identity/connect/oidc-signin"];
|
||||||
grantTypes = [ "authorizationCode" ];
|
grantTypes = ["authorizationCode"];
|
||||||
responseTypes = [ "code" ];
|
responseTypes = ["code"];
|
||||||
exportMap = {
|
exportMap = {
|
||||||
client_id = "SSO_CLIENT_ID";
|
client_id = "SSO_CLIENT_ID";
|
||||||
client_secret = "SSO_CLIENT_SECRET";
|
client_secret = "SSO_CLIENT_SECRET";
|
||||||
|
|
@ -106,9 +108,15 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
matrix = {
|
matrix = {
|
||||||
redirectUris = [ "https://matrix.kruining.eu/_synapse/client/oidc/callback" ];
|
redirectUris = ["https://matrix.kruining.eu/_synapse/client/oidc/callback"];
|
||||||
grantTypes = [ "authorizationCode" ];
|
grantTypes = ["authorizationCode"];
|
||||||
responseTypes = [ "code" ];
|
responseTypes = ["code"];
|
||||||
|
};
|
||||||
|
|
||||||
|
mydia = {
|
||||||
|
redirectUris = ["http://localhost:2010/auth/oidc/callback"];
|
||||||
|
grantTypes = ["authorizationCode"];
|
||||||
|
responseTypes = ["code"];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
@ -121,9 +129,9 @@
|
||||||
if (ctx.v1.user.grants == undefined || ctx.v1.user.grants.count == 0) {
|
if (ctx.v1.user.grants == undefined || ctx.v1.user.grants.count == 0) {
|
||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
|
|
||||||
const roles = ctx.v1.user.grants.grants.flatMap(({ roles, projectId }) => roles.map(role => projectId + ':' + role));
|
const roles = ctx.v1.user.grants.grants.flatMap(({ roles, projectId }) => roles.map(role => projectId + ':' + role));
|
||||||
|
|
||||||
api.v1.claims.setClaim('nix:zitadel:custom', JSON.stringify({ roles }));
|
api.v1.claims.setClaim('nix:zitadel:custom', JSON.stringify({ roles }));
|
||||||
};
|
};
|
||||||
'';
|
'';
|
||||||
|
|
@ -131,8 +139,16 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
triggers = [
|
triggers = [
|
||||||
{ flowType = "customiseToken"; triggerType = "preUserinfoCreation"; actions = [ "flattenRoles" ]; }
|
{
|
||||||
{ flowType = "customiseToken"; triggerType = "preAccessTokenCreation"; actions = [ "flattenRoles" ]; }
|
flowType = "customiseToken";
|
||||||
|
triggerType = "preUserinfoCreation";
|
||||||
|
actions = ["flattenRoles"];
|
||||||
|
}
|
||||||
|
{
|
||||||
|
flowType = "customiseToken";
|
||||||
|
triggerType = "preAccessTokenCreation";
|
||||||
|
actions = ["flattenRoles"];
|
||||||
|
}
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
@ -146,6 +162,7 @@
|
||||||
|
|
||||||
media.enable = true;
|
media.enable = true;
|
||||||
media.homer.enable = true;
|
media.homer.enable = true;
|
||||||
|
media.mydia.enable = true;
|
||||||
media.nfs.enable = true;
|
media.nfs.enable = true;
|
||||||
media.servarr = {
|
media.servarr = {
|
||||||
# radarr = {
|
# radarr = {
|
||||||
|
|
@ -190,7 +207,7 @@
|
||||||
database = {
|
database = {
|
||||||
# type = "sqlite";
|
# type = "sqlite";
|
||||||
# file = "/var/lib/vaultwarden/state.db";
|
# file = "/var/lib/vaultwarden/state.db";
|
||||||
|
|
||||||
type = "postgresql";
|
type = "postgresql";
|
||||||
host = "localhost";
|
host = "localhost";
|
||||||
port = 5432;
|
port = 5432;
|
||||||
|
|
|
||||||
|
|
@ -19,6 +19,11 @@ lidarr:
|
||||||
apikey: ENC[AES256_GCM,data:I2eKaxidmxem7C7ukmyIfwASNqrkS4vEOiCcU5kSNY6DR0pXsYg0PBdgu8vzK6llbXODLdG5t55BordIWvVRJGAauo0FMvtp59NSNpza7cK68tdKGvNefD6bqhUIR06BY11niQ==,iv:48AD7cd17TlWY5yAagepLOIVwgxhD/d13Pnup6GsWDA=,tag:teOVtW8opE99hqAXQwvlrA==,type:str]
|
apikey: ENC[AES256_GCM,data:I2eKaxidmxem7C7ukmyIfwASNqrkS4vEOiCcU5kSNY6DR0pXsYg0PBdgu8vzK6llbXODLdG5t55BordIWvVRJGAauo0FMvtp59NSNpza7cK68tdKGvNefD6bqhUIR06BY11niQ==,iv:48AD7cd17TlWY5yAagepLOIVwgxhD/d13Pnup6GsWDA=,tag:teOVtW8opE99hqAXQwvlrA==,type:str]
|
||||||
prowlarr:
|
prowlarr:
|
||||||
apikey: ENC[AES256_GCM,data:pyZ2WGEs/PlIdhDsQq2TPGJbplkd5fLF0ZkBjITqIJlnAzYHb+rl+KOM4rHqQcI6yAJM8X1Y3ymGrD7vG7GiRxB7yoEG13SKhZIWOddTnxIhbkz81RfrL2fUJIydOaP6sS//9Q==,iv:Tr6MWoC6nC7rdVTOjT1T2itT+lVL4GnUiAr5/+IHAs0=,tag:keIJNuGeVht8+xSN3FnBGA==,type:str]
|
apikey: ENC[AES256_GCM,data:pyZ2WGEs/PlIdhDsQq2TPGJbplkd5fLF0ZkBjITqIJlnAzYHb+rl+KOM4rHqQcI6yAJM8X1Y3ymGrD7vG7GiRxB7yoEG13SKhZIWOddTnxIhbkz81RfrL2fUJIydOaP6sS//9Q==,iv:Tr6MWoC6nC7rdVTOjT1T2itT+lVL4GnUiAr5/+IHAs0=,tag:keIJNuGeVht8+xSN3FnBGA==,type:str]
|
||||||
|
mydia:
|
||||||
|
oidc_id: ENC[AES256_GCM,data:LfYWh9EC0aio3w1Xsj/jtU6z,iv:+dX9KkNtfQMYSX4yr83KyXalWMD/aWby7fC8aL4ZT3I=,tag:CvdbMoMTuC9FohTMIE5pmg==,type:str]
|
||||||
|
oidc_secret: ENC[AES256_GCM,data:PgI4hmP/3wt9uj+1QvCYcT8Wav0hgCRADouzWM3V695SSfXfbwDgez8tA/tm1/1jymAU2F2sZH8G2hZ1cdHyHQ==,iv:h3o3jsTmnoNE3+mGX12J3ZU0/6PlQNjdndEvaj/czj0=,tag:p3+p4E8fBtR7a8UpM8cUsg==,type:str]
|
||||||
|
secret_key_base: ENC[AES256_GCM,data:yG7HJ5r74Qtxbeyf8F6dA0uHv2pQ8YAJKlKiKjS+m24JRvJWQaTThJ+c5HbuUa6R3e9XtVHchhlVPkF0Is/b+g==,iv:v65xdRr4JdKZmBtjZ08/J3LLqnphSGt9QfVPNQ2x/xg=,tag:n7tD2dhr4IJn1LWM9WW8UA==,type:str]
|
||||||
|
guardian_secret: ENC[AES256_GCM,data:OjnNFSHlecL+qXwlhTm++itRM6ga5E5KrSJxbgIUpbMEkIWgu3xhRtnPdipXbedgall0XdO/s+jnWCagZX94BA==,iv:DukdKvm9vey8BWUiml20tgA/Vji1XVX4+sUPge9nTk0=,tag:q3HdvgUYqR0APiaFz0ul5Q==,type:str]
|
||||||
sops:
|
sops:
|
||||||
age:
|
age:
|
||||||
- recipient: age19qfpf980tadguqq44zf6xwvjvl428dyrj46ha3n6aeqddwhtnuqqml7etq
|
- recipient: age19qfpf980tadguqq44zf6xwvjvl428dyrj46ha3n6aeqddwhtnuqqml7etq
|
||||||
|
|
@ -39,7 +44,7 @@ sops:
|
||||||
TTRWaHhpNWlkVDFmMFN4ZTNHMUxyNVkKV693pzTKRkZboQCMPr9IyMGSgxfuHXcb
|
TTRWaHhpNWlkVDFmMFN4ZTNHMUxyNVkKV693pzTKRkZboQCMPr9IyMGSgxfuHXcb
|
||||||
Y6BNcp6Qg6PWtX5QI7wRkPNINAK1TEbRBba+b8h6gMmVU4DliQyFiQ==
|
Y6BNcp6Qg6PWtX5QI7wRkPNINAK1TEbRBba+b8h6gMmVU4DliQyFiQ==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2025-11-19T09:51:26Z"
|
lastmodified: "2025-12-01T14:27:13Z"
|
||||||
mac: ENC[AES256_GCM,data:pMMkxHPochpI8si/oHhU7MHqC1JjNhMP7HCRNQQEkwBQI489xiC02t+qUwpmG4oIheqi8lEcZPpL4t9HzRN9sZImaI2LrJn3cHFojHzXzo7FPfvfUilZe1+JXLfm+wn+bflAEutIcfDiZc/MjiKOxRHwZy5Pr41Mj6uPIUr62zk=,iv:GwvMVgJ6m1DQcRZMVzshbuMK/Kx8vE8Ym83KbxuvYRg=,tag:wVSol9LDRzoFjQppB8J9gA==,type:str]
|
mac: ENC[AES256_GCM,data:v8t65zlWw6UuFeFQ5oBNVGjnuewPlZZG7ea8P4cEHXN+JnSAE67HivSCyjhUAFmX/UbksxnSLYdl72swTb9ASv6JaW2FVJsaF+5zmZbuM5pAjZl4MR6Y7+Vc9YqAi+axnSE1s8pRe9U1PYmcbLWaY9kRZdccavfM2bsoAIpJRTk=,iv:EevmWMh6ygEAlf9RE4qZ1KVKm6yDR5dTZeraoFHmdRg=,tag:sCdtEYc9iNjfEvyYyXH8rQ==,type:str]
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.11.0
|
version: 3.11.0
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue