caspervk/nixos
1
0
Fork 0
Code Activity Actions

nixos 24.11

Browse source
This commit is contained in:
Casper V. Kristensen 2024-12-04 00:34:25 +01:00
parent 5a3ced21b7
commit 3fbd5c17b6
22 changed files with 124 additions and 161 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -137,7 +137,7 @@ nixos-install --no-root-passwd --flake .#omega
### Upgrading ### Upgrading
Nixpkgs uses `stateVersion` so sparingly that auditing the entire nixpkgs repo Nixpkgs uses `stateVersion` so sparingly that auditing the entire nixpkgs repo
is [easy is [easy
enough](https://sourcegraph.com/search?q=context:global+repo:%5Egithub%5C.com/NixOS/nixpkgs%24+lang:Nix+stateVersion+AND+24.05&patternType=keyword&sm=0). enough](https://sourcegraph.com/search?q=context:global+repo:%5Egithub%5C.com/NixOS/nixpkgs%24+lang:Nix+stateVersion+AND+24.11&patternType=keyword&sm=0).
Important changes to home-manager is available at Important changes to home-manager is available at
<https://nix-community.github.io/home-manager/release-notes.xhtml> and <https://nix-community.github.io/home-manager/release-notes.xhtml> and
<https://github.com/nix-community/home-manager/blob/master/modules/misc/news.nix>. <https://github.com/nix-community/home-manager/blob/master/modules/misc/news.nix>.

5
flake.nix
View file

@ -6,7 +6,7 @@
url = "git+ssh://git@git.caspervk.net/caspervk/nixos-secrets.git"; url = "git+ssh://git@git.caspervk.net/caspervk/nixos-secrets.git";
}; };
nixpkgs = { nixpkgs = {
url = "github:NixOS/nixpkgs/nixos-24.05"; url = "github:NixOS/nixpkgs/nixos-24.11";
}; };
nixpkgs-unstable = { nixpkgs-unstable = {
url = "github:NixOS/nixpkgs/nixos-unstable"; url = "github:NixOS/nixpkgs/nixos-unstable";
@ -32,7 +32,7 @@
inputs.nixpkgs.follows = "nixpkgs"; # use the same nixpkgs as the system inputs.nixpkgs.follows = "nixpkgs"; # use the same nixpkgs as the system
}; };
home-manager = { home-manager = {
url = "github:nix-community/home-manager/release-24.05"; url = "github:nix-community/home-manager/release-24.11";
inputs.nixpkgs.follows = "nixpkgs"; # use the same nixpkgs as the system inputs.nixpkgs.follows = "nixpkgs"; # use the same nixpkgs as the system
}; };
home-manager-unstable = { home-manager-unstable = {
@ -40,6 +40,7 @@
inputs.nixpkgs.follows = "nixpkgs"; # use the same nixpkgs as the system inputs.nixpkgs.follows = "nixpkgs"; # use the same nixpkgs as the system
}; };
simple-nixos-mailserver = { simple-nixos-mailserver = {
# TODO: upgrade to 24.11
url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-24.05"; url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-24.05";
inputs.nixpkgs.follows = "nixpkgs"; # use the same nixpkgs as the system inputs.nixpkgs.follows = "nixpkgs"; # use the same nixpkgs as the system
}; };

4
hosts/alpha/default.nix
View file

@ -29,7 +29,7 @@
# this value at the release version of the first install of this system. # this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option # Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "24.05"; # Did you read the comment? system.stateVersion = "24.11"; # Did you read the comment?
# This value determines the Home Manager release that your # This value determines the Home Manager release that your
# configuration is compatible with. This helps avoid breakage # configuration is compatible with. This helps avoid breakage
@ -38,5 +38,5 @@
# You can update Home Manager without changing this value. See # You can update Home Manager without changing this value. See
# the Home Manager release notes for a list of state version # the Home Manager release notes for a list of state version
# changes in each release. # changes in each release.
home-manager.users.caspervk.home.stateVersion = "24.05"; # Did you read the comment? home-manager.users.caspervk.home.stateVersion = "24.11"; # Did you read the comment?
} }

10
hosts/alpha/network.nix
View file

@ -13,14 +13,12 @@
"2a01:4f8:c2c:71c0::/64" "2a01:4f8:c2c:71c0::/64"
]; ];
routes = [ routes = [
{routeConfig = {Destination = "172.31.1.1";};} {Destination = "172.31.1.1";}
{ {
routeConfig = {
Gateway = "172.31.1.1"; Gateway = "172.31.1.1";
GatewayOnLink = true; GatewayOnLink = true;
};
} }
{routeConfig = {Gateway = "fe80::1";};} {Gateway = "fe80::1";}
]; ];
# Enable proxy ARP to answer ARP requests for the floating IP addresses, # Enable proxy ARP to answer ARP requests for the floating IP addresses,
# intended for the wireguard peers, from Hetzner's router. Without this, # intended for the wireguard peers, from Hetzner's router. Without this,
@ -42,14 +40,12 @@
}; };
wireguardPeers = [ wireguardPeers = [
{ {
wireguardPeerConfig = {
PublicKey = "sigmaH/DKSU8KWyrPtucYmS2ewUvDvCNLxd/qYEo0n0="; PublicKey = "sigmaH/DKSU8KWyrPtucYmS2ewUvDvCNLxd/qYEo0n0=";
PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path; PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path;
# Add to the main routing table that traffic for the address should # Add to the main routing table that traffic for the address should
# be sent to sigma. # be sent to sigma.
AllowedIPs = ["49.13.33.75/32"]; AllowedIPs = ["49.13.33.75/32"];
RouteTable = "main"; RouteTable = "main";
};
} }
]; ];
}; };
@ -71,12 +67,10 @@
}; };
wireguardPeers = [ wireguardPeers = [
{ {
wireguardPeerConfig = {
PublicKey = "sigmaH/DKSU8KWyrPtucYmS2ewUvDvCNLxd/qYEo0n0="; PublicKey = "sigmaH/DKSU8KWyrPtucYmS2ewUvDvCNLxd/qYEo0n0=";
PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path; PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path;
AllowedIPs = ["${secrets.hosts.alpha.sigma-p2p-ip-address}/32"]; AllowedIPs = ["${secrets.hosts.alpha.sigma-p2p-ip-address}/32"];
RouteTable = "main"; RouteTable = "main";
};
} }
]; ];
}; };

4
hosts/delta/default.nix
View file

@ -25,7 +25,7 @@
# this value at the release version of the first install of this system. # this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option # Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "24.05"; # Did you read the comment? system.stateVersion = "24.11"; # Did you read the comment?
# This value determines the Home Manager release that your # This value determines the Home Manager release that your
# configuration is compatible with. This helps avoid breakage # configuration is compatible with. This helps avoid breakage
@ -34,5 +34,5 @@
# You can update Home Manager without changing this value. See # You can update Home Manager without changing this value. See
# the Home Manager release notes for a list of state version # the Home Manager release notes for a list of state version
# changes in each release. # changes in each release.
home-manager.users.caspervk.home.stateVersion = "24.05"; # Did you read the comment? home-manager.users.caspervk.home.stateVersion = "24.11"; # Did you read the comment?
} }

6
hosts/delta/network.nix
View file

@ -11,14 +11,12 @@
"2a01:4f8:1c0c:70d1::1/64" "2a01:4f8:1c0c:70d1::1/64"
]; ];
routes = [ routes = [
{routeConfig = {Destination = "172.31.1.1";};} {Destination = "172.31.1.1";}
{ {
routeConfig = {
Gateway = "172.31.1.1"; Gateway = "172.31.1.1";
GatewayOnLink = true; GatewayOnLink = true;
};
} }
{routeConfig = {Gateway = "fe80::1";};} {Gateway = "fe80::1";}
]; ];
}; };
}; };

4
hosts/mu/default.nix
View file

@ -27,7 +27,7 @@
# this value at the release version of the first install of this system. # this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option # Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "24.05"; # Did you read the comment? system.stateVersion = "24.11"; # Did you read the comment?
# This value determines the Home Manager release that your # This value determines the Home Manager release that your
# configuration is compatible with. This helps avoid breakage # configuration is compatible with. This helps avoid breakage
@ -36,5 +36,5 @@
# You can update Home Manager without changing this value. See # You can update Home Manager without changing this value. See
# the Home Manager release notes for a list of state version # the Home Manager release notes for a list of state version
# changes in each release. # changes in each release.
home-manager.users.caspervk.home.stateVersion = "24.05"; # Did you read the comment? home-manager.users.caspervk.home.stateVersion = "24.11"; # Did you read the comment?
} }

4
hosts/omega/default.nix
View file

@ -26,7 +26,7 @@
# this value at the release version of the first install of this system. # this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option # Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "24.05"; # Did you read the comment? system.stateVersion = "24.11"; # Did you read the comment?
# This value determines the Home Manager release that your # This value determines the Home Manager release that your
# configuration is compatible with. This helps avoid breakage # configuration is compatible with. This helps avoid breakage
@ -35,5 +35,5 @@
# You can update Home Manager without changing this value. See # You can update Home Manager without changing this value. See
# the Home Manager release notes for a list of state version # the Home Manager release notes for a list of state version
# changes in each release. # changes in each release.
home-manager.users.caspervk.home.stateVersion = "24.05"; # Did you read the comment? home-manager.users.caspervk.home.stateVersion = "24.11"; # Did you read the comment?
} }

6
hosts/omega/hardware.nix
View file

@ -54,8 +54,12 @@
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
# GPU # GPU
hardware.amdgpu.amdvlk = { hardware.amdgpu = {
amdvlk = {
enable = true; enable = true;
support32Bit.enable = true; support32Bit.enable = true;
supportExperimental.enable = true;
};
opencl.enable = true;
}; };
} }

4
hosts/sigma/default.nix
View file

@ -39,7 +39,7 @@
# this value at the release version of the first install of this system. # this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option # Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "24.05"; # Did you read the comment? system.stateVersion = "24.11"; # Did you read the comment?
# This value determines the Home Manager release that your # This value determines the Home Manager release that your
# configuration is compatible with. This helps avoid breakage # configuration is compatible with. This helps avoid breakage
@ -48,5 +48,5 @@
# You can update Home Manager without changing this value. See # You can update Home Manager without changing this value. See
# the Home Manager release notes for a list of state version # the Home Manager release notes for a list of state version
# changes in each release. # changes in each release.
home-manager.users.caspervk.home.stateVersion = "24.05"; # Did you read the comment? home-manager.users.caspervk.home.stateVersion = "24.11"; # Did you read the comment?
} }

17
hosts/sigma/matrix.nix
View file

@ -51,16 +51,6 @@
}; };
}; };
# https://github.com/matrix-org/sliding-sync
services.matrix-sliding-sync = {
# Unlike matrix-synapse, sliding-sync has createDatabase=true by default,
# which means we don't have to configure the database in the postgres
# service manually.
enable = true;
settings.SYNCV3_SERVER = config.services.matrix-synapse.settings.public_baseurl;
environmentFile = config.age.secrets.matrix-sliding-sync-environment-file.path;
};
services.postgresql = { services.postgresql = {
ensureDatabases = [ ensureDatabases = [
# matrix-synapse expects the database to have the options `LC_COLLATE` # matrix-synapse expects the database to have the options `LC_COLLATE`
@ -91,11 +81,4 @@
} }
]; ];
}; };
age.secrets.matrix-sliding-sync-environment-file = {
file = "${secrets}/secrets/matrix-sliding-sync-environment-file.age";
mode = "400";
owner = "root";
group = "root";
};
} }

23
hosts/sigma/network.nix
View file

@ -71,26 +71,23 @@
}; };
wireguardPeers = [ wireguardPeers = [
{ {
wireguardPeerConfig = {
PublicKey = "AlphazUR/z+1DRCFSvxTeKPIJnyPQvYsDoSgESvqJhM="; PublicKey = "AlphazUR/z+1DRCFSvxTeKPIJnyPQvYsDoSgESvqJhM=";
PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path; PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path;
# Explicit IPv4 address of alpha.caspervk.net to avoid attempting # Explicit IPv4 address of alpha.caspervk.net to avoid attempting to
# to (re)connect through IPv6(??). # (re)connect through IPv6(??).
Endpoint = "116.203.179.206:51820"; Endpoint = "116.203.179.206:51820";
# Keep NAT mappings and stateful firewalls open at the ISP # Keep NAT mappings and stateful firewalls open at the ISP
PersistentKeepalive = 25; PersistentKeepalive = 25;
# AllowedIPs is both an ACL for incoming traffic, as well as a # AllowedIPs is both an ACL for incoming traffic, as well as a
# routing table specifying to which peer outgoing traffic should be # routing table specifying to which peer outgoing traffic should be
# sent. We want to allow incoming traffic from any address on the # sent. We want to allow incoming traffic from any address on the
# internet (routed through alpha), but only replies to this should # internet (routed through alpha), but only replies to this should be
# be routed back over wireguard. Unlike if we had used NAT, IP # routed back over wireguard. Unlike if we had used NAT, IP routes
# routes are stateless, so we have no notion of "replies". Instead, # are stateless, so we have no notion of "replies". Instead, we add
# we add these routes to a specific routing table and configure a # these routes to a specific routing table and configure a routing
# routing policy rule to only use it for packets being sent as the # policy rule to only use it for packets being sent as the public IP.
# public IP.
AllowedIPs = ["0.0.0.0/0"]; AllowedIPs = ["0.0.0.0/0"];
RouteTable = "wg-sigma-public"; RouteTable = "wg-sigma-public";
};
} }
]; ];
}; };
@ -144,16 +141,14 @@
}; };
wireguardPeers = [ wireguardPeers = [
{ {
wireguardPeerConfig = {
PublicKey = "AlphazUR/z+1DRCFSvxTeKPIJnyPQvYsDoSgESvqJhM="; PublicKey = "AlphazUR/z+1DRCFSvxTeKPIJnyPQvYsDoSgESvqJhM=";
PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path; PresharedKeyFile = config.age.secrets.wireguard-preshared-key-file.path;
# Explicit IPv4 address of alpha.caspervk.net to avoid attempting # Explicit IPv4 address of alpha.caspervk.net to avoid attempting to
# to (re)connect through IPv6(??). # (re)connect through IPv6(??).
Endpoint = "116.203.179.206:51821"; Endpoint = "116.203.179.206:51821";
PersistentKeepalive = 25; PersistentKeepalive = 25;
AllowedIPs = ["0.0.0.0/0"]; AllowedIPs = ["0.0.0.0/0"];
RouteTable = "wg-sigma-p2p"; RouteTable = "wg-sigma-p2p";
};
} }
]; ];
}; };

1
hosts/sigma/postgresql.nix
View file

@ -5,6 +5,7 @@
services.postgresql = { services.postgresql = {
enable = true; enable = true;
# https://nixos.org/manual/nixos/stable/#module-services-postgres-upgrading # https://nixos.org/manual/nixos/stable/#module-services-postgres-upgrading
# https://wiki.nixos.org/wiki/PostgreSQL#Major_upgrades
package = pkgs.postgresql_16; package = pkgs.postgresql_16;
}; };

6
hosts/sigma/samba.nix
View file

@ -24,11 +24,11 @@
# Disable discovery: don't reply to NetBIOS over IP name service requests # Disable discovery: don't reply to NetBIOS over IP name service requests
# or participate in the browsing protocols which make up the Windows # or participate in the browsing protocols which make up the Windows
# “Network Neighborhood” view. # “Network Neighborhood” view.
enableNmbd = false; samba.enableNmbd = false;
# Disable Samba’s winbindd, which provides a number of services to the Name # Disable Samba’s winbindd, which provides a number of services to the Name
# Service Switch capability found in most modern C libraries, to arbitrary # Service Switch capability found in most modern C libraries, to arbitrary
# applications via PAM and ntlm_auth and to Samba itself. # applications via PAM and ntlm_auth and to Samba itself.
enableWinbindd = false; winbindd.enable = false;
# https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html # https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html
extraConfig = '' extraConfig = ''
# Only allow local access. This should also be enforced by the firewall. # Only allow local access. This should also be enforced by the firewall.
@ -43,7 +43,7 @@
# Allow Windows clients to run .exe's # Allow Windows clients to run .exe's
acl allow execute always = True acl allow execute always = True
''; '';
shares = { services.samba.settings = {
downloads = { downloads = {
path = "/srv/torrents/downloads"; path = "/srv/torrents/downloads";
# Use the 'torrent' group for access for all users connecting # Use the 'torrent' group for access for all users connecting

4
hosts/tor/default.nix
View file

@ -24,7 +24,7 @@
# this value at the release version of the first install of this system. # this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option # Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "24.05"; # Did you read the comment? system.stateVersion = "24.11"; # Did you read the comment?
# This value determines the Home Manager release that your # This value determines the Home Manager release that your
# configuration is compatible with. This helps avoid breakage # configuration is compatible with. This helps avoid breakage
@ -33,5 +33,5 @@
# You can update Home Manager without changing this value. See # You can update Home Manager without changing this value. See
# the Home Manager release notes for a list of state version # the Home Manager release notes for a list of state version
# changes in each release. # changes in each release.
home-manager.users.caspervk.home.stateVersion = "24.05"; # Did you read the comment? home-manager.users.caspervk.home.stateVersion = "24.11"; # Did you read the comment?
} }

4
hosts/tor/network.nix
View file

@ -19,8 +19,8 @@
"2a0c:5700:3133:650:b0ea:eeff:fedb:1f7b/64" "2a0c:5700:3133:650:b0ea:eeff:fedb:1f7b/64"
]; ];
routes = [ routes = [
{routeConfig = {Gateway = "185.231.102.1";};} {Gateway = "185.231.102.1";}
{routeConfig = {Gateway = "fe80::200:5eff:fe00:20c";};} {Gateway = "fe80::200:5eff:fe00:20c";}
]; ];
}; };
}; };

4
hosts/zeta/default.nix
View file

@ -25,7 +25,7 @@
# this value at the release version of the first install of this system. # this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option # Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "24.05"; # Did you read the comment? system.stateVersion = "24.11"; # Did you read the comment?
# This value determines the Home Manager release that your # This value determines the Home Manager release that your
# configuration is compatible with. This helps avoid breakage # configuration is compatible with. This helps avoid breakage
@ -34,5 +34,5 @@
# You can update Home Manager without changing this value. See # You can update Home Manager without changing this value. See
# the Home Manager release notes for a list of state version # the Home Manager release notes for a list of state version
# changes in each release. # changes in each release.
home-manager.users.caspervk.home.stateVersion = "24.05"; # Did you read the comment? home-manager.users.caspervk.home.stateVersion = "24.11"; # Did you read the comment?
} }

2
modules/base/nix.nix
View file

@ -28,7 +28,7 @@
auto-optimise-store = true; auto-optimise-store = true;
# Enable flakes # Enable flakes
experimental-features = ["nix-command" "flakes" "repl-flake"]; experimental-features = ["nix-command" "flakes"];
# Timeout connections to the binary cache instead of waiting forever # Timeout connections to the binary cache instead of waiting forever
connect-timeout = 5; connect-timeout = 5;

3
modules/desktop/docker.nix
View file

@ -7,9 +7,6 @@
enable = true; enable = true;
# Automatically `docker system prune` weekly # Automatically `docker system prune` weekly
autoPrune.enable = true; autoPrune.enable = true;
# Fix waiting for docker containers to exit on shutdown/reboot
# https://discourse.nixos.org/t/docker-hanging-on-reboot/18270/4
liveRestore = false;
}; };
# Being a member of the docker group is effectively equivalent to being root, # Being a member of the docker group is effectively equivalent to being root,

4
modules/desktop/foot.nix
View file

@ -1,7 +1,6 @@
{home-manager, ...}: { {...}: {
# Terminal emulator # Terminal emulator
# https://codeberg.org/dnkl/foot # https://codeberg.org/dnkl/foot
home-manager.users.caspervk = {
programs.foot = { programs.foot = {
enable = true; enable = true;
# https://man.archlinux.org/man/foot.ini.5.en # https://man.archlinux.org/man/foot.ini.5.en
@ -52,5 +51,4 @@
}; };
}; };
}; };
};
} }

9
modules/desktop/programs.nix
View file

@ -1,7 +1,5 @@
{ {
home-manager,
lib, lib,
nixpkgs,
pkgs, pkgs,
... ...
}: { }: {
@ -13,7 +11,6 @@
aspellDicts.da aspellDicts.da
aspellDicts.en aspellDicts.en
aspellDicts.en-computers aspellDicts.en-computers
aspellDicts.en-science
black black
element-desktop element-desktop
firefox-wayland firefox-wayland
@ -50,16 +47,12 @@
"steam" "steam"
"steam-original" "steam-original"
"steam-run" "steam-run"
"steam-unwrapped"
"terraform" "terraform"
]; ];
home-manager.users.caspervk = { home-manager.users.caspervk = {
home.sessionVariables = { home.sessionVariables = {
# The firefox-wayland package works with wayland without any further
# configuration, but tor-browser doesn't.
# TODO: remove when tor browser is based on firefox v121.
# https://www.mozilla.org/en-US/firefox/121.0/releasenotes/
MOZ_ENABLE_WAYLAND = 1;
# https://wiki.archlinux.org/title/Sway#Java_applications # https://wiki.archlinux.org/title/Sway#Java_applications
_JAVA_AWT_WM_NONREPARENTING = 1; _JAVA_AWT_WM_NONREPARENTING = 1;
# https://wiki.nixos.org/wiki/Wayland # https://wiki.nixos.org/wiki/Wayland

1
modules/desktop/sway.nix
View file

@ -1,5 +1,4 @@
{ {
home-manager,
lib, lib,
pkgs, pkgs,
... ...