Simon Bruder
feb82fca2e
nix: Make netrc readable by wheel group
...
This also splits the nix configuration from the default module into its
own file.
2021-04-09 11:34:49 +02:00
Simon Bruder
8d9e3af211
Add binary cache hosted on fuuko
...
See machines/fuuko/services/binary-cache.nix for limitations.
2021-04-08 16:19:57 +02:00
Simon Bruder
07d4260b95
nix: Use daemonNiceLevel instead of CPUSchedulingPolicy
2021-04-08 15:42:49 +02:00
Simon Bruder
4a8a7e0a4f
Use sops for secrets
...
Since I currently do not have access to sayuri, sayuri’s migration is
not done yet. The host keys and wg-home-private-key secret still have to
be added.
2021-04-06 14:05:48 +02:00
Simon Bruder
e94c72e42e
Add open ports for quick tests
2021-03-29 22:26:10 +02:00
Simon Bruder
a7ad88a5ec
Include unstable channel as overlay
...
This allows nix cli tools to access unstable from niv’s pinned rev
(instead of having to rely on uncached and unpinned
channel:nixos-unstable). Also packageOverrides might get
deprecated/removed[1] eventually.
[1]: https://github.com/NixOS/nixpkgs/issues/43266
2021-03-29 12:03:58 +02:00
Simon Bruder
270f20d05b
Add nginx hardening option
2021-03-05 15:58:53 +01:00
Simon Bruder
83f1c69713
restic/system: Constantly use system for naming
...
In the future I may create add other backup jobs, so it should be clear,
that this only backs up the system.
2021-02-28 12:22:43 +01:00
Simon Bruder
e0ef586e5e
nginx-interactive-index: Init
2021-02-18 12:10:03 +01:00
Simon Bruder
eb97e936ed
zsh: Use grml config system wide
2021-02-14 13:29:51 +01:00
Simon Bruder
15cdd42845
Remove global swapiness
...
All machines should either import <nixpkgs-hardware/common/pc/hdd> or
<nixpkgs-hardware/common/pc/ssd> if they have swap.
2021-02-08 23:20:31 +01:00
Simon Bruder
29c6d37142
Remove journald extra configuration
...
Since `Storage=persistent` is the default in NixOS, it is not needed.
2021-02-08 23:19:02 +01:00
Simon Bruder
9c62905442
mailserver: Add module
2021-02-06 12:48:05 +01:00
Simon Bruder
998d47fd1a
nix: Only keep outputs and drvs on full systems
2021-02-05 17:19:19 +01:00
Simon Bruder
1437601d5a
Reduce locales and disable docs on small systems
2021-02-05 15:36:51 +01:00
Simon Bruder
520d750404
firewall: Entirely disable reverse path checking
...
This hopefully fixes #26 (or more specific a regression caused by it,
see the comment in the issue). I didn’t test it for long, but it seems
to work.
2021-02-02 21:40:30 +01:00
Simon Bruder
34c801c7e9
Make it possible to disable smartd per-machine
...
On virtual machines it does not make much sense to have it activated
(also the service fails to start).
2021-02-01 17:03:26 +01:00
Simon Bruder
cce86ac2c9
pkgs: Add wordclock-dimmer (including module)
2021-01-31 19:48:18 +01:00
Simon Bruder
a02d3cb883
Use separate state version for every machine
...
This also uses the system state version as the home-manager state
version.
Fixes #35 .
2021-01-31 12:21:05 +01:00
Simon Bruder
f211bae4e2
Globally set Let’s Encrypt requirements
2021-01-31 12:21:05 +01:00
Simon Bruder
05a72217aa
Use nixos-hardware for hardware configuration
...
This removes the manual modules that use options to activate hardware
configuration. It seems to general (e.g. newer Intel GPUs require
different opencl icd) or not flexible enough (in case of the ssd
module).
Closes #21 .
2021-01-29 15:50:16 +01:00
Simon Bruder
603a006df8
Make routing all traffic over wireguard tunnel work
...
Fixes #26 (regression introduced in
126a0dad4b
2021-01-24 14:44:00 +01:00
Simon Bruder
c1283b6ffa
Add option to disable large packages
...
Fixes #27
This adds the `sbruder.full` option (enabled by default), which disables
some otherwise enabled packages/modules when disabled. When setting it
to false on a full gui system it reduces the size of the system closure
by over 50%. It is intended for systems with low (main) disk space.
2021-01-20 16:23:18 +01:00
Simon Bruder
126a0dad4b
Enable firewall by default
...
Fixes #25
2021-01-17 11:03:54 +01:00
Simon Bruder
7152112076
home/games: Add module and option
2021-01-07 18:29:18 +01:00
Simon Bruder
37c54887b9
Add custom overlay
...
Fixes #20
2021-01-07 17:10:32 +01:00
Simon Bruder
a44f1fd1ac
Add optional ssh server to initrd
2021-01-07 13:39:25 +01:00
Simon Bruder
7b2da0349c
Overhaul secrets management
2021-01-06 13:09:29 +01:00
Simon Bruder
131d0cc1a5
Add options for unfree software and assets
2021-01-03 17:11:22 +01:00
Simon Bruder
337ef729e1
sway: wallpaper: Specify license
2021-01-03 15:46:08 +01:00
Simon Bruder
fa8323bddc
Enable rar support of p7zip
2021-01-01 13:00:38 +01:00
Simon Bruder
58d667f6b8
sway: Rename to gui
2021-01-01 12:32:55 +01:00
Simon Bruder
cb913a9b00
Add media-proxy
...
This also adds secrets management for nginx. It is far from perfect
(e.g. nginx does not get reloaded when a secret changes).
2020-12-31 15:44:24 +01:00
Simon Bruder
a34d5a110a
Disable command-not-found
2020-12-25 16:41:48 +01:00
Simon Bruder
208922d9f9
Fix nix run
...
It requires an explicit `nixpkgs=` entry in `NIX_PATH` to work.
2020-12-13 17:57:09 +01:00
Simon Bruder
94d625784a
Pin unstable nixpkgs version
2020-12-13 17:57:09 +01:00
Simon Bruder
049e02089f
Set NIX_PATH to krops sources
2020-12-12 16:15:43 +01:00
Simon Bruder
0bbfafcafb
Make nix keep output of derivations with gc root
2020-12-06 13:58:46 +01:00
Simon Bruder
29cfc3750d
Move most tools to user environment
...
Fixes #1 .
2020-12-05 19:44:41 +01:00
Simon Bruder
bdc1c12f9c
Refactor pubkey configuration
2020-12-05 16:42:49 +01:00
Simon Bruder
73021c1a94
Parameterise cpu config
2020-12-05 16:00:34 +01:00
Simon Bruder
76bd3a4bc8
Parameterise gpu config
2020-12-05 15:57:23 +01:00
Simon Bruder
9b22c91170
config.sbruder.gui → config.sbruder.gui.enable
2020-12-05 15:44:58 +01:00
Simon Bruder
a23c3801cb
Parameterise libvirt
2020-12-05 15:40:54 +01:00
Simon Bruder
ab39c6035c
Parameterise ssd module
2020-12-05 15:40:49 +01:00
Simon Bruder
74ddf83617
Parameterise wireguard
2020-12-05 15:40:44 +01:00
Simon Bruder
8a63f8aac4
Parameterise restic
2020-12-05 15:40:31 +01:00
Simon Bruder
6d0f3a9964
Reorganise profiles/options
2020-12-05 14:43:01 +01:00
Simon Bruder