commit b87d4c0cbbaf357a17b11c44eb45b0c1bef0f109
parent de1626d0030a06ec2734f9c7280411f82d470af5
Author: MTRNord <mtrnord1@gmail.com>
Date: Mon, 4 Dec 2023 11:54:11 +0100
Update the channel and also use different formatter
Diffstat:
38 files changed, 669 insertions(+), 520 deletions(-)
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
@@ -1,5 +1,7 @@
repos:
- - repo: https://github.com/nix-community/nixpkgs-fmt
- rev: v1.3.0
+ - repo: https://github.com/kamadorueda/alejandra
+ rev: e53c2c6c6c103dc3f848dbd9fbd93ee7c69c109f # frozen: 3.0.0
+ # Choose either the 'alejandra' or 'alejandra-system' hook
+ # depending on what pre-requisites you have:
hooks:
- - id: nixpkgs-fmt
+ - id: alejandra-nix
+\ No newline at end of file
diff --git a/flake.lock b/flake.lock
@@ -68,16 +68,16 @@
]
},
"locked": {
- "lastModified": 1699748081,
- "narHash": "sha256-MOmMapBydd7MTjhX4eeQZzKlCABWw8W6iSHSG4OeFKE=",
+ "lastModified": 1700814205,
+ "narHash": "sha256-lWqDPKHRbQfi+zNIivf031BUeyciVOtwCwTjyrhDB5g=",
"owner": "nix-community",
"repo": "home-manager",
- "rev": "04bac349d585c9df38d78e0285b780a140dc74a4",
+ "rev": "aeb2232d7a32530d3448318790534d196bf9427a",
"type": "github"
},
"original": {
"owner": "nix-community",
- "ref": "release-23.05",
+ "ref": "release-23.11",
"repo": "home-manager",
"type": "github"
}
@@ -200,16 +200,16 @@
},
"nixpkgs_3": {
"locked": {
- "lastModified": 1700097215,
- "narHash": "sha256-ODQ3gBTv1iHd7lG21H+ErVISB5wVeOhd/dEogOqHs/I=",
+ "lastModified": 1701539137,
+ "narHash": "sha256-nVO/5QYpf1GwjvtpXhyxx5M3U/WN0MwBro4Lsk+9mL0=",
"owner": "nixos",
"repo": "nixpkgs",
- "rev": "9fb122519e9cd465d532f736a98c1e1eb541ef6f",
+ "rev": "933d7dc155096e7575d207be6fb7792bc9f34f6d",
"type": "github"
},
"original": {
"owner": "nixos",
- "ref": "nixos-23.05",
+ "ref": "nixos-23.11",
"repo": "nixpkgs",
"type": "github"
}
diff --git a/flake.nix b/flake.nix
@@ -3,7 +3,7 @@
inputs = {
# Nixpkgs
- nixpkgs.url = "github:nixos/nixpkgs/nixos-23.05";
+ nixpkgs.url = "github:nixos/nixpkgs/nixos-23.11";
#nixpkgs.url = "github:nixos/nixpkgs/672430223ef43060b460321b50a2e17628c7d8cd";
nixpkgs-discourse.url = "github:MTRNord/nixpkgs/beee2842bdc9281c94c95ea9c89f20b3da53ffd3";
# You can access packages and modules from different nixpkgs revs
@@ -15,7 +15,7 @@
impermanence.url = "github:nix-community/impermanence";
# Home manager
- home-manager.url = "github:nix-community/home-manager/release-23.05";
+ home-manager.url = "github:nix-community/home-manager/release-23.11";
home-manager.inputs.nixpkgs.follows = "nixpkgs";
# TODO: Add any other flake you might need
@@ -33,89 +33,102 @@
};
};
- outputs = { self, nixpkgs, nixpkgs-unstable, nixpkgs-discourse, home-manager, sops-nix, docker-utils, ... }@inputs:
- let
- inherit (self) outputs;
- forAllSystems = nixpkgs.lib.genAttrs [
- "aarch64-linux"
- "x86_64-linux"
- ];
- in
- rec {
- # Your custom packages
- # Acessible through 'nix build', 'nix shell', etc
- packages = forAllSystems (system:
- let
- pkgs = nixpkgs.legacyPackages.${system};
- build-draupnir = {
- # TODO: Pull Draupnir
- # TODO: Run yarn describe version task
- # TODO: Build image using https://github.com/collinarnett/docker-utils
- };
- in
- import ./pkgs { inherit pkgs; }
- );
+ outputs = {
+ self,
+ nixpkgs,
+ nixpkgs-unstable,
+ nixpkgs-discourse,
+ home-manager,
+ sops-nix,
+ docker-utils,
+ ...
+ } @ inputs: let
+ inherit (self) outputs;
+ forAllSystems = nixpkgs.lib.genAttrs [
+ "aarch64-linux"
+ "x86_64-linux"
+ ];
+ in rec {
+ # Your custom packages
+ # Acessible through 'nix build', 'nix shell', etc
+ packages = forAllSystems (
+ system: let
+ pkgs = nixpkgs.legacyPackages.${system};
+ build-draupnir = {
+ # TODO: Pull Draupnir
+ # TODO: Run yarn describe version task
+ # TODO: Build image using https://github.com/collinarnett/docker-utils
+ };
+ in
+ import ./pkgs {inherit pkgs;}
+ );
- # Devshell for bootstrapping
- # Acessible through 'nix develop' or 'nix-shell' (legacy)
- devShells = forAllSystems (system:
- let pkgs = nixpkgs.legacyPackages.${system};
- in import ./shell.nix { inherit pkgs; }
- );
+ # Devshell for bootstrapping
+ # Acessible through 'nix develop' or 'nix-shell' (legacy)
+ devShells = forAllSystems (
+ system: let
+ pkgs = nixpkgs.legacyPackages.${system};
+ in
+ import ./shell.nix {inherit pkgs;}
+ );
- formatter = forAllSystems (system:
- let pkgs = nixpkgs.legacyPackages.${system};
- in pkgs.nixpkgs-fmt);
+ formatter = forAllSystems (system: let
+ pkgs = nixpkgs.legacyPackages.${system};
+ in
+ pkgs.alejandra);
- # Your custom packages and modifications, exported as overlays
- overlays = import ./overlays { inherit inputs; pkgs = nixpkgs.legacyPackages.aarch64-linux; };
- # Reusable nixos modules you might want to export
- # These are usually stuff you would upstream into nixpkgs
- nixosModules = import ./modules/nixos;
- # Reusable home-manager modules you might want to export
- # These are usually stuff you would upstream into home-manager
- homeManagerModules = import ./modules/home-manager;
+ # Your custom packages and modifications, exported as overlays
+ overlays = import ./overlays {
+ inherit inputs;
+ pkgs = nixpkgs.legacyPackages.aarch64-linux;
+ };
+ # Reusable nixos modules you might want to export
+ # These are usually stuff you would upstream into nixpkgs
+ nixosModules = import ./modules/nixos;
+ # Reusable home-manager modules you might want to export
+ # These are usually stuff you would upstream into home-manager
+ homeManagerModules = import ./modules/home-manager;
- # NixOS configuration entrypoint
- # Available through 'nixos-rebuild --flake .#your-hostname'
- nixosConfigurations = {
- worker-1 = nixpkgs.lib.nixosSystem {
- specialArgs = { inherit inputs outputs; };
- modules = [
- # > Our main nixos configuration file <
- sops-nix.nixosModules.sops
- ./nixos/worker-1/configuration.nix
- ];
- };
- worker-2 = nixpkgs.lib.nixosSystem {
- specialArgs = { inherit inputs outputs; };
- modules = [
- # > Our main nixos configuration file <
- sops-nix.nixosModules.sops
- ./nixos/worker-2/configuration.nix
- ];
- };
+ # NixOS configuration entrypoint
+ # Available through 'nixos-rebuild --flake .#your-hostname'
+ nixosConfigurations = {
+ worker-1 = nixpkgs.lib.nixosSystem {
+ specialArgs = {inherit inputs outputs;};
+ modules = [
+ # > Our main nixos configuration file <
+ sops-nix.nixosModules.sops
+ ./nixos/worker-1/configuration.nix
+ ];
};
+ worker-2 = nixpkgs.lib.nixosSystem {
+ specialArgs = {inherit inputs outputs;};
+ modules = [
+ # > Our main nixos configuration file <
+ sops-nix.nixosModules.sops
+ ./nixos/worker-2/configuration.nix
+ ];
+ };
+ };
- # Standalone home-manager configuration entrypoint
- # Available through 'home-manager --flake .#your-username'
- homeConfigurations = {
- "marcel@worker-1" = home-manager.lib.homeManagerConfiguration {
- pkgs = nixpkgs.legacyPackages.aarch64-linux; # Home-manager requires 'pkgs' instance
- extraSpecialArgs = { inherit inputs outputs nixpkgs-unstable; };
- modules = [
- # > Our main home-manager configuration file <
- ./home-manager/home.nix
- ];
- };
- "marcel@worker-2" = home-manager.lib.homeManagerConfiguration {
- pkgs = nixpkgs.legacyPackages.aarch64-linux; # Home-manager requires 'pkgs' instance
- extraSpecialArgs = { inherit inputs outputs nixpkgs-unstable; };
- modules = [
- # > Our main home-manager configuration file <
- ./home-manager/home.nix
- ];
- };
+ # Standalone home-manager configuration entrypoint
+ # Available through 'home-manager --flake .#your-username'
+ homeConfigurations = {
+ "marcel@worker-1" = home-manager.lib.homeManagerConfiguration {
+ pkgs = nixpkgs.legacyPackages.aarch64-linux; # Home-manager requires 'pkgs' instance
+ extraSpecialArgs = {inherit inputs outputs nixpkgs-unstable;};
+ modules = [
+ # > Our main home-manager configuration file <
+ ./home-manager/home.nix
+ ];
+ };
+ "marcel@worker-2" = home-manager.lib.homeManagerConfiguration {
+ pkgs = nixpkgs.legacyPackages.aarch64-linux; # Home-manager requires 'pkgs' instance
+ extraSpecialArgs = {inherit inputs outputs nixpkgs-unstable;};
+ modules = [
+ # > Our main home-manager configuration file <
+ ./home-manager/home.nix
+ ];
};
};
+ };
}
diff --git a/home-manager/home.nix b/home-manager/home.nix
@@ -1,7 +1,14 @@
# This is your home-manager configuration file
# Use this to configure your home environment (it replaces ~/.config/nixpkgs/home.nix)
-
-{ inputs, outputs, lib, config, pkgs, nixpkgs-unstable, ... }: {
+{
+ inputs,
+ outputs,
+ lib,
+ config,
+ pkgs,
+ nixpkgs-unstable,
+ ...
+}: {
# You can import other home-manager modules here
imports = [
# If you want to use modules your own flake exports (from modules/home-manager):
@@ -40,7 +47,7 @@
# Disable if you don't want unfree packages
allowUnfree = true;
# Workaround for https://github.com/nix-community/home-manager/issues/2942
- allowUnfreePredicate = (_: true);
+ allowUnfreePredicate = _: true;
};
};
home = {
@@ -92,7 +99,7 @@
};
oh-my-zsh = {
enable = true;
- plugins = [ "git" "thefuck" ];
+ plugins = ["git" "thefuck"];
theme = "robbyrussell";
};
};
@@ -117,8 +124,6 @@
};
};
-
-
# Nicely reload system units when changing configs
systemd.user.startServices = "sd-switch";
diff --git a/modules/home-manager/default.nix b/modules/home-manager/default.nix
@@ -1,6 +1,5 @@
# Add your reusable home-manager modules to this directory, on their own file (https://nixos.wiki/wiki/Module).
# These should be stuff you would like to share with others, not your personal configurations.
-
{
# List your module files here
# my-module = import ./my-module.nix;
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
@@ -1,6 +1,5 @@
# Add your reusable NixOS modules to this directory, on their own file (https://nixos.wiki/wiki/Module).
# These should be stuff you would like to share with others, not your personal configurations.
-
{
# List your module files here
# my-module = import ./my-module.nix;
diff --git a/nixos/common/common.nix b/nixos/common/common.nix
@@ -1,6 +1,9 @@
-{ lib, pkgs, config, ... }:
{
-
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
# General stuff
time.timeZone = "Europe/Berlin";
@@ -9,7 +12,6 @@
sound.enable = false;
powerManagement.cpuFreqGovernor = "performance";
-
environment.systemPackages = with pkgs; [
wget
curl
diff --git a/nixos/common/lib/asterisk.nix b/nixos/common/lib/asterisk.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
nixpkgs = {
# Configure your nixpkgs instance
config = {
@@ -93,7 +97,7 @@
same => n,Verbose(0, Failed to call 6001. Hanging up)
same => n,Playback(/var/lib/asterisk/sounds/en/cannot-complete-as-dialed)
same => n,Hangup()
-
+
[unauthorized]
'';
diff --git a/nixos/common/lib/confd.nix b/nixos/common/lib/confd.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
services.confd = {
enable = true;
nodes = [
@@ -74,7 +78,7 @@
system.activationScripts = {
postgresqlMkdir = {
text = "mkdir -p /etc/pgbouncer && chown pgbouncer:pgbouncer -R /etc/pgbouncer && chmod o+w /etc/pgbouncer";
- deps = [ ];
+ deps = [];
};
};
}
diff --git a/nixos/common/lib/discourse.nix b/nixos/common/lib/discourse.nix
@@ -1,5 +1,10 @@
-{ inputs, lib, pkgs, config, ... }:
{
+ inputs,
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
services.discourse = {
package = inputs.nixpkgs-discourse.legacyPackages.${pkgs.system}.discourse;
enable = true;
@@ -75,5 +80,5 @@
};
};
- systemd.services.discourse.environment = { UNICORN_WORKERS = "8"; };
+ systemd.services.discourse.environment = {UNICORN_WORKERS = "8";};
}
diff --git a/nixos/common/lib/envoy.nix b/nixos/common/lib/envoy.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
services = {
envoy = {
enable = false;
diff --git a/nixos/common/lib/fail2ban.nix b/nixos/common/lib/fail2ban.nix
@@ -1,10 +1,14 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
services = {
fail2ban = {
enable = true;
- extraPackages = [ pkgs.ipset ];
+ extraPackages = [pkgs.ipset];
banaction = "iptables-ipset-proto6-allports";
ignoreIP = [
"148.251.63.154"
diff --git a/nixos/common/lib/github-runner.nix b/nixos/common/lib/github-runner.nix
@@ -1,6 +1,10 @@
-{ lib, pkgs, config, ... }:
{
- users.users."node-yara-rs-runner" = { isNormalUser = false; };
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
+ users.users."node-yara-rs-runner" = {isNormalUser = false;};
environment.systemPackages = with pkgs; [
yarn
nodejs_20
@@ -12,7 +16,7 @@
"node-yara-rs" = {
url = "https://github.com/MTRNord/node-yara-rs";
enable = true;
- extraLabels = [ "arm64" ];
+ extraLabels = ["arm64"];
ephemeral = true;
replace = true;
user = "node-yara-rs-runner";
diff --git a/nixos/common/lib/patroni.nix b/nixos/common/lib/patroni.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
environment.systemPackages = with pkgs; [
patroni
etcd_3_4
@@ -26,8 +30,8 @@
etcd = {
enable = true;
initialClusterState = "existing";
- listenClientUrls = [ "http://10.100.0.1:2379" ];
- listenPeerUrls = [ "http://10.100.0.1:2380" ];
+ listenClientUrls = ["http://10.100.0.1:2379"];
+ listenPeerUrls = ["http://10.100.0.1:2380"];
initialCluster = [
"worker-1=http://10.100.0.1:2380"
"nordgedanken=http://10.100.0.2:2380"
@@ -70,7 +74,7 @@
max_wal_senders = "10";
synchronous_commit = "on";
- # Checkpointing:
+ # Checkpointing:
checkpoint_timeout = "15 min";
checkpoint_completion_target = "0.9";
max_wal_size = "1024 MB";
@@ -87,21 +91,20 @@
wal_writer_flush_after = "1MB";
wal_keep_size = "3650 MB";
-
# Background writer
bgwriter_delay = "200ms";
bgwriter_lru_maxpages = "100";
bgwriter_lru_multiplier = "2.0";
bgwriter_flush_after = "0";
- # Parallel queries:
+ # Parallel queries:
max_worker_processes = "14";
max_parallel_workers_per_gather = "7";
max_parallel_maintenance_workers = "7";
max_parallel_workers = "14";
parallel_leader_participation = "on";
- # Advanced features
+ # Advanced features
enable_partitionwise_join = "on";
enable_partitionwise_aggregate = "on";
jit = "on";
@@ -140,7 +143,7 @@
system.activationScripts = {
postgresqlMkdir = {
text = "mkdir -p /run/postgresql && chmod o+w /run/postgresql";
- deps = [ ];
+ deps = [];
};
};
diff --git a/nixos/common/lib/pdns.nix b/nixos/common/lib/pdns.nix
@@ -1,11 +1,15 @@
-{ lib, pkgs, config, ... }:
{
- sops.secrets.pdns_api_key = { };
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
+ sops.secrets.pdns_api_key = {};
services.powerdns = {
enable = true;
secretFile = config.sops.secrets.pdns_api_key.path;
};
- networking.firewall.allowedTCPPorts = [ 8081 53 ];
- networking.firewall.allowedUDPPorts = [ 53 ];
+ networking.firewall.allowedTCPPorts = [8081 53];
+ networking.firewall.allowedUDPPorts = [53];
}
diff --git a/nixos/common/lib/personal_discourse.nix b/nixos/common/lib/personal_discourse.nix
@@ -1,5 +1,10 @@
-{ inputs, lib, pkgs, config, ... }:
{
+ inputs,
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
services.discourse = {
package = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.discourse;
enable = true;
@@ -77,5 +82,5 @@
};
};
- systemd.services.discourse.environment = { UNICORN_WORKERS = "16"; };
+ systemd.services.discourse.environment = {UNICORN_WORKERS = "16";};
}
diff --git a/nixos/common/lib/pgadmin.nix b/nixos/common/lib/pgadmin.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
services = {
postgresql.package = pkgs.postgresql_14;
pgadmin = {
diff --git a/nixos/common/lib/pgbouncer.nix b/nixos/common/lib/pgbouncer.nix
@@ -1,27 +1,31 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
environment.systemPackages = with pkgs; [
pgbouncer
util-linux
];
users = {
- groups.pgbouncer = { };
+ groups.pgbouncer = {};
users = {
pgbouncer = {
isSystemUser = true;
description = "PgBouncer User";
group = "pgbouncer";
- extraGroups = [ "patroni" ];
+ extraGroups = ["patroni"];
};
};
};
systemd.services.pgbouncer = {
enable = true;
- after = [ "network-online.target" ];
- requires = [ "network-online.target" ];
+ after = ["network-online.target"];
+ requires = ["network-online.target"];
description = "PgBouncer - PostgreSQL connection pooler";
- wantedBy = [ "multi-user.target" ];
+ wantedBy = ["multi-user.target"];
serviceConfig = {
LimitNOFILE = 8192;
ExecStart = "${pkgs.pgbouncer}/bin/pgbouncer /etc/pgbouncer/pgbouncer.ini";
@@ -37,7 +41,6 @@
environment.etc = {
"pgbouncer/pg_hba.conf" = {
-
user = config.users.users.pgbouncer.name;
group = config.users.users.pgbouncer.group;
text = ''
diff --git a/nixos/common/lib/pgcat.nix b/nixos/common/lib/pgcat.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
environment.systemPackages = with pkgs; [
pgcat
util-linux
@@ -20,10 +24,10 @@
systemd.services.pgcat = {
enable = true;
- after = [ "network-online.target" ];
- requires = [ "network-online.target" ];
+ after = ["network-online.target"];
+ requires = ["network-online.target"];
description = "PgCat - PostgreSQL connection pooler";
- wantedBy = [ "multi-user.target" ];
+ wantedBy = ["multi-user.target"];
serviceConfig = {
LimitNOFILE = 65536;
Environment = "RUST_LOG=info";
diff --git a/nixos/common/lib/podman.nix b/nixos/common/lib/podman.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
virtualisation.podman = {
enable = true;
defaultNetwork.settings = {
diff --git a/nixos/common/lib/shell.nix b/nixos/common/lib/shell.nix
@@ -1,10 +1,14 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
environment.systemPackages = with pkgs; [
zsh
];
# Ensure /etc/shells is setup for zsh
programs.zsh.enable = true;
- environment.shells = with pkgs; [ zsh ];
+ environment.shells = with pkgs; [zsh];
}
diff --git a/nixos/common/server.nix b/nixos/common/server.nix
@@ -1,5 +1,10 @@
-{ inputs, lib, pkgs, config, ... }:
{
+ inputs,
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
systemd = {
network.enable = true;
# Given that our systems are headless, emergency mode is useless.
@@ -40,8 +45,8 @@
tmp.cleanOnBoot = true;
# btrfs boot
kernelPackages = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.linuxPackages_latest;
- supportedFilesystems = [ "btrfs" ];
- initrd.supportedFilesystems = [ "btrfs" ];
+ supportedFilesystems = ["btrfs"];
+ initrd.supportedFilesystems = ["btrfs"];
};
hardware.enableAllFirmware = true;
diff --git a/nixos/common/sops.nix b/nixos/common/sops.nix
@@ -1,15 +1,19 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
# SOPS
sops = {
age = {
- sshKeyPaths = [ "/persist/etc/ssh/ssh_host_ed25519_key" ];
+ sshKeyPaths = ["/persist/etc/ssh/ssh_host_ed25519_key"];
# This is using an age key that is expected to already be in the filesystem
keyFile = "/persist/var/lib/sops-nix/key.txt";
# This will generate a new key if the key specified above does not exist
generateKey = true;
};
- gnupg.sshKeyPaths = [ "/persist/etc/ssh/ssh_host_rsa_key" ];
+ gnupg.sshKeyPaths = ["/persist/etc/ssh/ssh_host_rsa_key"];
defaultSopsFile = ./secrets/secrets.yaml;
@@ -17,10 +21,10 @@
secrets = {
marcel_initial_password.neededForUsers = true;
root_initial_password.neededForUsers = true;
- "wireguard/worker-1/wg0/private_key" = { };
- "wireguard/worker-1/wg1/private_key" = { };
- "wireguard/worker-2/wg0/private_key" = { };
- "wireguard/worker-2/wg1/private_key" = { };
+ "wireguard/worker-1/wg0/private_key" = {};
+ "wireguard/worker-1/wg1/private_key" = {};
+ "wireguard/worker-2/wg0/private_key" = {};
+ "wireguard/worker-2/wg1/private_key" = {};
ssh_host_ed25519_key = {
mode = "0600";
path = "/etc/ssh/ssh_host_ed25519_key";
@@ -57,8 +61,8 @@
owner = config.users.users.marcel.name;
path = "/root/.ssh/id_ed25519.pub";
};
- backup_password = { };
- forgejo_runner_token = { };
+ backup_password = {};
+ forgejo_runner_token = {};
# sops.secrets.forgejo_runner_token.owner = config.users."gitea-runner".name;
"asterisk/pjsip_conf" = {
mode = "0777";
@@ -124,13 +128,12 @@
path = "/etc/confd/templates/pgcat.toml.tmpl";
};
- kubernetes_ca_file = { };
- kubernetes_ca_client_file = { };
+ kubernetes_ca_file = {};
+ kubernetes_ca_client_file = {};
node_yara_rs_runner_tokenfile = {
owner = "node-yara-rs-runner";
group = "node-yara-rs-runner";
};
};
};
-
}
diff --git a/nixos/worker-1/boot.nix b/nixos/worker-1/boot.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
boot = {
loader = {
systemd-boot = {
@@ -9,7 +13,7 @@
};
efi.canTouchEfiVariables = true;
};
- kernelParams = [ "ip=dhcp" ];
+ kernelParams = ["ip=dhcp"];
initrd = {
network.enable = true;
luks.forceLuksSupportInInitrd = true;
@@ -24,11 +28,10 @@
# keys. Also, make sure to use a boot loader with support for initrd
# secrets (e.g. systemd-boot), or this will be exposed in the nix store
# to unprivileged users.
- hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
+ hostKeys = ["/etc/secrets/initrd/ssh_host_ed25519_key"];
# I'll just authorize all keys authorized post-boot.
authorizedKeys = config.users.users.marcel.openssh.authorizedKeys.keys;
};
};
};
-
}
diff --git a/nixos/worker-1/configuration.nix b/nixos/worker-1/configuration.nix
@@ -1,11 +1,16 @@
# This is your system's configuration file.
# Use this to configure your system environment (it replaces /etc/nixos/configuration.nix)
-{ inputs, outputs, lib, config, pkgs, ... }:
-let
+{
+ inputs,
+ outputs,
+ lib,
+ config,
+ pkgs,
+ ...
+}: let
github_metadata_file = builtins.readFile inputs.github_meta;
github_metadata_json = builtins.fromJSON github_metadata_file;
-in
-{
+in {
# You can import other NixOS modules here
imports = [
# If you want to use modules your own flake exports (from modules/nixos):
@@ -82,7 +87,7 @@ in
nix = {
# This will add each flake input as a registry
# To make nix3 commands consistent with your flake
- registry = lib.mapAttrs (_: value: { flake = value; }) inputs;
+ registry = lib.mapAttrs (_: value: {flake = value;}) inputs;
# This will additionally add your inputs to the system's legacy channels
# Making legacy nix commands consistent as well, awesome!
@@ -96,8 +101,8 @@ in
# Sandbox
sandbox = true;
# Build locally
- trusted-substituters = [ ];
- substituters = [ ];
+ trusted-substituters = [];
+ substituters = [];
};
gc = {
@@ -105,7 +110,6 @@ in
dates = "weekly";
options = "--delete-older-than 60d";
};
-
};
# Broken
@@ -124,7 +128,7 @@ in
floating1 = {
enable = true;
name = "floating1";
- address = [ ];
+ address = [];
matchConfig = {
Name = "floating1";
};
@@ -138,16 +142,30 @@ in
"2a01:4f8:c012:492::1/64"
];
routes = [
- { routeConfig.Gateway = "fe80::1"; }
- { routeConfig = { Gateway = "172.31.1.1"; GatewayOnLink = true; }; }
+ {routeConfig.Gateway = "fe80::1";}
+ {
+ routeConfig = {
+ Gateway = "172.31.1.1";
+ GatewayOnLink = true;
+ };
+ }
# prevent some local traffic Hetzner doesn't like
#{ routeConfig = { Destination = "172.16.0.0/12"; Type = "unreachable"; }; }
- { routeConfig = { Destination = "192.168.0.0/16"; Type = "unreachable"; }; }
+ {
+ routeConfig = {
+ Destination = "192.168.0.0/16";
+ Type = "unreachable";
+ };
+ }
# { routeConfig = { Destination = "10.0.0.0/8"; Type = "unreachable"; }; }
- { routeConfig = { Destination = "fc00::/7"; Type = "unreachable"; }; }
-
+ {
+ routeConfig = {
+ Destination = "fc00::/7";
+ Type = "unreachable";
+ };
+ }
];
};
};
@@ -176,14 +194,14 @@ in
enable = true;
enableIPv6 = true;
externalInterface = "enp1s0";
- internalInterfaces = [ "wg0" ];
+ internalInterfaces = ["wg0"];
};
- nameservers = [ "8.8.8.8" "8.8.4.4" ];
+ nameservers = ["8.8.8.8" "8.8.4.4"];
wg-quick.interfaces = {
nordgedanken = {
- address = [ "10.100.0.1/24" "fe99:13::1/64" ];
+ address = ["10.100.0.1/24" "fe99:13::1/64"];
listenPort = 51820;
privateKeyFile = config.sops.secrets."wireguard/worker-1/wg0/private_key".path;
table = "off";
@@ -210,7 +228,7 @@ in
];
};
worker2 = {
- address = [ "10.100.0.1/24" "fe99:13::1/64" ];
+ address = ["10.100.0.1/24" "fe99:13::1/64"];
listenPort = 51821;
privateKeyFile = config.sops.secrets."wireguard/worker-1/wg1/private_key".path;
table = "off";
@@ -236,106 +254,109 @@ in
}
];
};
-
};
- firewall =
- let
- blockedV4 = [
- "158.101.19.243" # full-text search scraper https://macaw.social/@angilly/109597402157254670
- "207.231.106.226" # fediverse.network / fedi.ninja
- "45.81.20.80" # instances.social
- "198.58.122.231" # fedimapper.tedivm.com
- "142.93.3.121" # fedidb.org
- "45.158.40.164" # fedi.buzz
- "170.39.215.216" # fediverse.observer
- "87.157.136.163" # fedi_stats
- "94.31.103.67" # python/federation
- "45.56.100.29" # scottherr? same as :5a13
- "173.230.137.240" # scottherr@mastodon.social
- "138.37.89.34"
- "104.21.80.126" # gangstalking.services
- "172.67.181.16" # gangstalking.services
- "198.98.54.220" # ryona.agency
- "35.173.245.194"
- "99.105.215.234" # public tl
- "65.108.204.30" # unknown
- "65.109.31.111" # @fediverse@mastodont.cat
- "54.37.233.246" # fba.ryona.agency domain block scraper
- "185.244.192.119" # mooneyed.de / drow.be / bka.li blocklist scraper
- "23.24.204.110" # ryona tool fed.dembased.xyz / annihilation.social blocklist scraper
- "187.190.192.31" # ryona tool unfediblockthefedi.now
- "70.106.192.146" # blocklist scraper
- # https://openai.com/gptbot-ranges.txt
- "20.15.240.64/28"
- "20.15.240.80/28"
- "20.15.240.96/28"
- "20.15.240.176/28"
- "20.15.241.0/28"
- "20.15.242.128/28"
- "20.15.242.144/28"
- "20.15.242.192/28"
- "40.83.2.64/28"
- "169.150.247.39" # etke.cc
- "143.244.38.136" # etke.cc
- ];
- blockedV6 = [
- "2400:52e0:1e00::1082:1" # etke.cc
- "2a01:4f9:4b:4b0b::2" # etke.cc
- "2003:cb:ff2c:2700::1/64" # fedi_stats
- "2600:3c02::/64" # scottherr stats
- "2600:3c03::/64" # unknown, tries public tl access
- "2605:6400:10:1fe::1/64" # ryona.agency
- "2a01:4f9:5a:1cc4::2" # @fediverse@mastodont.cat
- "2604:a880:400:d1::1/64" # fedidb.org
- "2a01:4f8:162:6027::1/64" # blocklist scraper
- ];
- in
- {
- checkReversePath = "loose";
- trustedInterfaces = [ "tailscale0" "floating1" "worker2" "nordgedanken" ];
- enable = true;
- allowPing = true;
- allowedTCPPorts = [
- 22 # ssh
- 5060 # SIP
- 8088
- 80
- 443
- 51820
- 51821
- 9962
- 9100
- 9963
- ];
- allowedUDPPorts = [
- 5060 # SIP
- 51820
- 51821
- config.services.tailscale.port
- ];
-
- allowedUDPPortRanges = [
- { from = 10000; to = 20000; }
- ];
+ firewall = let
+ blockedV4 = [
+ "158.101.19.243" # full-text search scraper https://macaw.social/@angilly/109597402157254670
+ "207.231.106.226" # fediverse.network / fedi.ninja
+ "45.81.20.80" # instances.social
+ "198.58.122.231" # fedimapper.tedivm.com
+ "142.93.3.121" # fedidb.org
+ "45.158.40.164" # fedi.buzz
+ "170.39.215.216" # fediverse.observer
+ "87.157.136.163" # fedi_stats
+ "94.31.103.67" # python/federation
+ "45.56.100.29" # scottherr? same as :5a13
+ "173.230.137.240" # scottherr@mastodon.social
+ "138.37.89.34"
+ "104.21.80.126" # gangstalking.services
+ "172.67.181.16" # gangstalking.services
+ "198.98.54.220" # ryona.agency
+ "35.173.245.194"
+ "99.105.215.234" # public tl
+ "65.108.204.30" # unknown
+ "65.109.31.111" # @fediverse@mastodont.cat
+ "54.37.233.246" # fba.ryona.agency domain block scraper
+ "185.244.192.119" # mooneyed.de / drow.be / bka.li blocklist scraper
+ "23.24.204.110" # ryona tool fed.dembased.xyz / annihilation.social blocklist scraper
+ "187.190.192.31" # ryona tool unfediblockthefedi.now
+ "70.106.192.146" # blocklist scraper
+ # https://openai.com/gptbot-ranges.txt
+ "20.15.240.64/28"
+ "20.15.240.80/28"
+ "20.15.240.96/28"
+ "20.15.240.176/28"
+ "20.15.241.0/28"
+ "20.15.242.128/28"
+ "20.15.242.144/28"
+ "20.15.242.192/28"
+ "40.83.2.64/28"
+ "169.150.247.39" # etke.cc
+ "143.244.38.136" # etke.cc
+ ];
+ blockedV6 = [
+ "2400:52e0:1e00::1082:1" # etke.cc
+ "2a01:4f9:4b:4b0b::2" # etke.cc
+ "2003:cb:ff2c:2700::1/64" # fedi_stats
+ "2600:3c02::/64" # scottherr stats
+ "2600:3c03::/64" # unknown, tries public tl access
+ "2605:6400:10:1fe::1/64" # ryona.agency
+ "2a01:4f9:5a:1cc4::2" # @fediverse@mastodont.cat
+ "2604:a880:400:d1::1/64" # fedidb.org
+ "2a01:4f8:162:6027::1/64" # blocklist scraper
+ ];
+ in {
+ checkReversePath = "loose";
+ trustedInterfaces = ["tailscale0" "floating1" "worker2" "nordgedanken"];
+ enable = true;
+ allowPing = true;
+ allowedTCPPorts = [
+ 22 # ssh
+ 5060 # SIP
+ 8088
+ 80
+ 443
+ 51820
+ 51821
+ 9962
+ 9100
+ 9963
+ ];
+ allowedUDPPorts = [
+ 5060 # SIP
+ 51820
+ 51821
+ config.services.tailscale.port
+ ];
- extraCommands =
- builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -A INPUT -s ${ip} -j DROP") blockedV4) + "\n"
- + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6) + "\n"
- + ''
- iptables -A nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
- ip6tables -A nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
- '';
+ allowedUDPPortRanges = [
+ {
+ from = 10000;
+ to = 20000;
+ }
+ ];
- extraStopCommands =
- builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -D INPUT -s ${ip} -j DROP") blockedV4) + "\n"
- + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6) + "\n"
- + ''
- iptables -D nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
- ip6tables -D nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
- '';
+ extraCommands =
+ builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -A INPUT -s ${ip} -j DROP") blockedV4)
+ + "\n"
+ + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6)
+ + "\n"
+ + ''
+ iptables -A nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
+ ip6tables -A nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
+ '';
- };
+ extraStopCommands =
+ builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -D INPUT -s ${ip} -j DROP") blockedV4)
+ + "\n"
+ + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6)
+ + "\n"
+ + ''
+ iptables -D nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
+ ip6tables -D nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
+ '';
+ };
};
# packages that are not flakes
@@ -355,7 +376,7 @@ in
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUzC9NeEc4voBeAO7YuQ1ewRKCS2iar4Bcm4cKoNKUH mtrnord@nordgedanken.dev"
];
- extraGroups = [ "wheel" ];
+ extraGroups = ["wheel"];
shell = pkgs.zsh;
};
@@ -366,7 +387,7 @@ in
group = "node-yara-rs-runner";
};
};
- groups.node-yara-rs-runner = { };
+ groups.node-yara-rs-runner = {};
};
services.gitea-actions-runner = {
@@ -375,17 +396,16 @@ in
enable = false;
url = "https://git.nordgedanken.dev";
tokenFile = config.sops.secrets.forgejo_runner_token.path;
- labels = [ ];
+ labels = [];
name = "worker-1";
};
};
};
systemd.services.gitea-runner-nordgedanken = {
- serviceConfig.SupplementaryGroups = [ config.users.groups.keys.name ];
+ serviceConfig.SupplementaryGroups = [config.users.groups.keys.name];
};
-
# Restic Backup
services.restic.backups = {
storagebox = {
@@ -416,7 +436,7 @@ in
upstreams = {
"asterisk_webrtc_ws" = {
servers = {
- "127.0.0.1:8088" = { };
+ "127.0.0.1:8088" = {};
};
};
};
@@ -437,8 +457,7 @@ in
forceSSL = true;
enableACME = true;
locations."/" = {
- proxyPass =
- "http://localhost:${toString config.services.headscale.port}";
+ proxyPass = "http://localhost:${toString config.services.headscale.port}";
proxyWebsockets = true;
};
};
@@ -446,8 +465,7 @@ in
forceSSL = true;
enableACME = true;
locations."/" = {
- proxyPass =
- "http://localhost:5001";
+ proxyPass = "http://localhost:5001";
};
};
};
@@ -465,7 +483,7 @@ in
settings = {
logtail.enabled = false;
server_url = "https://headscale.midnightthoughts.space";
- ip_prefixes = [ "fd7a:115c:a1e0::/48" "100.64.0.0/10" ];
+ ip_prefixes = ["fd7a:115c:a1e0::/48" "100.64.0.0/10"];
dns_config = {
base_domain = "headscale.midnightthoughts.space";
@@ -533,7 +551,7 @@ in
bird-lg = {
proxy = {
enable = true;
- allowedIPs = [ "10.100.0.1" "fe99:13::1" ];
+ allowedIPs = ["10.100.0.1" "fe99:13::1"];
listenAddress = "10.100.0.1:8000";
};
frontend = {
@@ -603,7 +621,7 @@ in
advert_int 1
'';
unicastSrcIp = "10.100.0.1";
- unicastPeers = [ "10.100.0.2" ];
+ unicastPeers = ["10.100.0.2"];
virtualIps = [
{
addr = "10.100.12.1/24";
diff --git a/nixos/worker-1/darlings.nix b/nixos/worker-1/darlings.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
# Darling Erasure
environment.persistence."/persist" = {
directories = [
diff --git a/nixos/worker-1/hardware-configuration.nix b/nixos/worker-1/hardware-configuration.nix
@@ -1,24 +1,28 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
{
+ config,
+ lib,
+ pkgs,
+ modulesPath,
+ ...
+}: {
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
boot = {
- initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ];
- initrd.kernelModules = [ ];
- kernelModules = [ ];
- extraModulePackages = [ ];
+ initrd.availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod"];
+ initrd.kernelModules = [];
+ kernelModules = [];
+ extraModulePackages = [];
};
fileSystems."/" = {
device = "/dev/disk/by-uuid/2dd0146f-acd1-4d76-a353-9f4cf7721972";
fsType = "btrfs";
- options = [ "subvol=root" "compress=zstd" "noatime" ];
+ options = ["subvol=root" "compress=zstd" "noatime"];
};
boot.initrd.luks.devices."enc".device = "/dev/disk/by-uuid/56da9aee-dc91-4736-ae22-781e46ccb25e";
@@ -27,26 +31,26 @@
"/home" = {
device = "/dev/disk/by-uuid/2dd0146f-acd1-4d76-a353-9f4cf7721972";
fsType = "btrfs";
- options = [ "subvol=home" "compress=zstd" "noatime" ];
+ options = ["subvol=home" "compress=zstd" "noatime"];
};
"/nix" = {
device = "/dev/disk/by-uuid/2dd0146f-acd1-4d76-a353-9f4cf7721972";
fsType = "btrfs";
- options = [ "subvol=nix" "compress=zstd" "noatime" ];
+ options = ["subvol=nix" "compress=zstd" "noatime"];
};
"/persist" = {
device = "/dev/disk/by-uuid/2dd0146f-acd1-4d76-a353-9f4cf7721972";
fsType = "btrfs";
- options = [ "subvol=persist" "compress=zstd" "noatime" ];
+ options = ["subvol=persist" "compress=zstd" "noatime"];
neededForBoot = true;
};
"/var/log" = {
device = "/dev/disk/by-uuid/2dd0146f-acd1-4d76-a353-9f4cf7721972";
fsType = "btrfs";
- options = [ "subvol=log" "compress=zstd" "noatime" ];
+ options = ["subvol=log" "compress=zstd" "noatime"];
neededForBoot = true;
};
@@ -56,10 +60,12 @@
};
};
- swapDevices = [{
- device = "/var/lib/swapfile";
- size = 16 * 1024;
- }];
+ swapDevices = [
+ {
+ device = "/var/lib/swapfile";
+ size = 16 * 1024;
+ }
+ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/nixos/worker-1/kubernetes.nix b/nixos/worker-1/kubernetes.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
environment.persistence."/persist" = {
directories = [
"/var/lib/kubernetes/"
@@ -45,11 +49,10 @@
51871
];
-
services.kubernetes = {
apiserverAddress = "https://[2a01:4f9:4a:451c:2::5]:6443";
masterAddress = "[2a01:4f9:4a:451c:2::5]";
- roles = [ "node" ];
+ roles = ["node"];
proxy.enable = false;
addons.dns.enable = true;
easyCerts = false;
@@ -74,5 +77,5 @@
};
};
services.kubernetes.flannel.enable = false;
- services.kubernetes.kubelet.cni.packages = lib.mkForce [ pkgs.cni-plugins ];
+ services.kubernetes.kubelet.cni.packages = lib.mkForce [pkgs.cni-plugins];
}
diff --git a/nixos/worker-1/znc.nix b/nixos/worker-1/znc.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
environment.persistence."/persist" = {
directories = [
"/var/lib/znc"
@@ -7,7 +11,7 @@
};
services.znc = {
enable = true;
- modulePackages = [ pkgs.zncModules.clientbuffer ];
+ modulePackages = [pkgs.zncModules.clientbuffer];
confOptions = {
useSSL = false;
passBlock = ''
@@ -25,12 +29,11 @@
server = "irc.libera.chat";
port = 6697;
useSSL = true;
- modules = [ "simple_away" ];
- channels = [ "fedora-buildsys" ];
+ modules = ["simple_away"];
+ channels = ["fedora-buildsys"];
};
};
};
-
};
services = {
nginx = {
@@ -38,7 +41,7 @@
upstreams = {
"znc" = {
servers = {
- "[::1]:58457" = { };
+ "[::1]:58457" = {};
};
};
};
@@ -52,25 +55,23 @@
};
};
};
- streamConfig =
- let
- cert = config.security.acme.certs."znc.midnightthoughts.space".directory + "/fullchain.pem";
- certKey = config.security.acme.certs."znc.midnightthoughts.space".directory + "/key.pem";
- trustedCert = config.security.acme.certs."znc.midnightthoughts.space".directory + "/chain.pem";
- in
- ''
- upstream znc {
- server [::1]:58457;
- }
- server {
- listen 6697 ssl;
- listen [::]:6697 ssl;
- ssl_certificate ${cert};
- ssl_certificate_key ${certKey};
- ssl_trusted_certificate ${trustedCert};
- proxy_pass znc;
- }
- '';
+ streamConfig = let
+ cert = config.security.acme.certs."znc.midnightthoughts.space".directory + "/fullchain.pem";
+ certKey = config.security.acme.certs."znc.midnightthoughts.space".directory + "/key.pem";
+ trustedCert = config.security.acme.certs."znc.midnightthoughts.space".directory + "/chain.pem";
+ in ''
+ upstream znc {
+ server [::1]:58457;
+ }
+ server {
+ listen 6697 ssl;
+ listen [::]:6697 ssl;
+ ssl_certificate ${cert};
+ ssl_certificate_key ${certKey};
+ ssl_trusted_certificate ${trustedCert};
+ proxy_pass znc;
+ }
+ '';
};
};
networking.firewall.allowedTCPPorts = [
diff --git a/nixos/worker-2/boot.nix b/nixos/worker-2/boot.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
boot = {
loader = {
systemd-boot = {
@@ -9,7 +13,7 @@
};
efi.canTouchEfiVariables = true;
};
- kernelParams = [ "ip=dhcp" ];
+ kernelParams = ["ip=dhcp"];
initrd = {
network.enable = true;
luks.forceLuksSupportInInitrd = true;
@@ -24,7 +28,7 @@
# keys. Also, make sure to use a boot loader with support for initrd
# secrets (e.g. systemd-boot), or this will be exposed in the nix store
# to unprivileged users.
- hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
+ hostKeys = ["/etc/secrets/initrd/ssh_host_ed25519_key"];
# I'll just authorize all keys authorized post-boot.
#authorizedKeys = config.users.users.marcel.openssh.authorizedKeys.keys;
authorizedKeys = [
@@ -33,5 +37,4 @@
};
};
};
-
}
diff --git a/nixos/worker-2/configuration.nix b/nixos/worker-2/configuration.nix
@@ -1,12 +1,16 @@
# This is your system's configuration file.
# Use this to configure your system environment (it replaces /etc/nixos/configuration.nix)
-
-{ inputs, outputs, lib, config, pkgs, ... }:
-let
+{
+ inputs,
+ outputs,
+ lib,
+ config,
+ pkgs,
+ ...
+}: let
github_metadata_file = builtins.readFile inputs.github_meta;
github_metadata_json = builtins.fromJSON github_metadata_file;
-in
-{
+in {
# You can import other NixOS modules here
imports = [
# If you want to use modules your own flake exports (from modules/nixos):
@@ -74,7 +78,7 @@ in
nix = {
# This will add each flake input as a registry
# To make nix3 commands consistent with your flake
- registry = lib.mapAttrs (_: value: { flake = value; }) inputs;
+ registry = lib.mapAttrs (_: value: {flake = value;}) inputs;
# This will additionally add your inputs to the system's legacy channels
# Making legacy nix commands consistent as well, awesome!
@@ -88,8 +92,8 @@ in
# Sandbox
sandbox = true;
# Build locally
- trusted-substituters = [ ];
- substituters = [ ];
+ trusted-substituters = [];
+ substituters = [];
};
gc = {
@@ -97,7 +101,6 @@ in
dates = "weekly";
options = "--delete-older-than 60d";
};
-
};
# Broken
@@ -113,16 +116,30 @@ in
"2a01:4f9:c012:54d3::/64"
];
routes = [
- { routeConfig.Gateway = "fe80::1"; }
- { routeConfig = { Gateway = "172.31.1.1"; GatewayOnLink = true; }; }
+ {routeConfig.Gateway = "fe80::1";}
+ {
+ routeConfig = {
+ Gateway = "172.31.1.1";
+ GatewayOnLink = true;
+ };
+ }
# prevent some local traffic Hetzner doesn't like
#{ routeConfig = { Destination = "172.16.0.0/12"; Type = "unreachable"; }; }
- { routeConfig = { Destination = "192.168.0.0/16"; Type = "unreachable"; }; }
+ {
+ routeConfig = {
+ Destination = "192.168.0.0/16";
+ Type = "unreachable";
+ };
+ }
# { routeConfig = { Destination = "10.0.0.0/8"; Type = "unreachable"; }; }
- { routeConfig = { Destination = "fc00::/7"; Type = "unreachable"; }; }
-
+ {
+ routeConfig = {
+ Destination = "fc00::/7";
+ Type = "unreachable";
+ };
+ }
];
};
};
@@ -151,14 +168,14 @@ in
enable = true;
enableIPv6 = true;
externalInterface = "enp1s0";
- internalInterfaces = [ "wg0" ];
+ internalInterfaces = ["wg0"];
};
- nameservers = [ "8.8.8.8" "8.8.4.4" ];
+ nameservers = ["8.8.8.8" "8.8.4.4"];
wg-quick.interfaces = {
nordgedanken = {
- address = [ "10.100.0.3/24" "fe99:13::3/64" ];
+ address = ["10.100.0.3/24" "fe99:13::3/64"];
listenPort = 51840;
privateKeyFile = config.sops.secrets."wireguard/worker-2/wg0/private_key".path;
table = "off";
@@ -185,7 +202,7 @@ in
];
};
worker1 = {
- address = [ "10.100.0.3/24" "fe99:13::3/64" ];
+ address = ["10.100.0.3/24" "fe99:13::3/64"];
listenPort = 51841;
privateKeyFile = config.sops.secrets."wireguard/worker-2/wg1/private_key".path;
table = "off";
@@ -211,98 +228,98 @@ in
}
];
};
-
};
- firewall =
- let
- blockedV4 = [
- "158.101.19.243" # full-text search scraper https://macaw.social/@angilly/109597402157254670
- "207.231.106.226" # fediverse.network / fedi.ninja
- "45.81.20.80" # instances.social
- "198.58.122.231" # fedimapper.tedivm.com
- "142.93.3.121" # fedidb.org
- "45.158.40.164" # fedi.buzz
- "170.39.215.216" # fediverse.observer
- "87.157.136.163" # fedi_stats
- "94.31.103.67" # python/federation
- "45.56.100.29" # scottherr? same as :5a13
- "173.230.137.240" # scottherr@mastodon.social
- "138.37.89.34"
- "104.21.80.126" # gangstalking.services
- "172.67.181.16" # gangstalking.services
- "198.98.54.220" # ryona.agency
- "35.173.245.194"
- "99.105.215.234" # public tl
- "65.108.204.30" # unknown
- "65.109.31.111" # @fediverse@mastodont.cat
- "54.37.233.246" # fba.ryona.agency domain block scraper
- "185.244.192.119" # mooneyed.de / drow.be / bka.li blocklist scraper
- "23.24.204.110" # ryona tool fed.dembased.xyz / annihilation.social blocklist scraper
- "187.190.192.31" # ryona tool unfediblockthefedi.now
- "70.106.192.146" # blocklist scraper
- # https://openai.com/gptbot-ranges.txt
- "20.15.240.64/28"
- "20.15.240.80/28"
- "20.15.240.96/28"
- "20.15.240.176/28"
- "20.15.241.0/28"
- "20.15.242.128/28"
- "20.15.242.144/28"
- "20.15.242.192/28"
- "40.83.2.64/28"
- "169.150.247.39" # etke.cc
- "143.244.38.136" # etke.cc
- ];
- blockedV6 = [
- "2400:52e0:1e00::1082:1" # etke.cc
- "2a01:4f9:4b:4b0b::2" # etke.cc
- "2003:cb:ff2c:2700::1/64" # fedi_stats
- "2600:3c02::/64" # scottherr stats
- "2600:3c03::/64" # unknown, tries public tl access
- "2605:6400:10:1fe::1/64" # ryona.agency
- "2a01:4f9:5a:1cc4::2" # @fediverse@mastodont.cat
- "2604:a880:400:d1::1/64" # fedidb.org
- "2a01:4f8:162:6027::1/64" # blocklist scraper
- ];
- in
- {
- checkReversePath = "loose";
- trustedInterfaces = [ "tailscale0" "floating1" "worker1" "nordgedanken" ];
- enable = true;
- allowPing = true;
- allowedTCPPorts = [
- 22 # ssh
- 51840
- 51841
- 9962
- 9100
- 80
- 443
- 9963
- ];
- allowedUDPPorts = [
- 51840
- 51841
- ];
+ firewall = let
+ blockedV4 = [
+ "158.101.19.243" # full-text search scraper https://macaw.social/@angilly/109597402157254670
+ "207.231.106.226" # fediverse.network / fedi.ninja
+ "45.81.20.80" # instances.social
+ "198.58.122.231" # fedimapper.tedivm.com
+ "142.93.3.121" # fedidb.org
+ "45.158.40.164" # fedi.buzz
+ "170.39.215.216" # fediverse.observer
+ "87.157.136.163" # fedi_stats
+ "94.31.103.67" # python/federation
+ "45.56.100.29" # scottherr? same as :5a13
+ "173.230.137.240" # scottherr@mastodon.social
+ "138.37.89.34"
+ "104.21.80.126" # gangstalking.services
+ "172.67.181.16" # gangstalking.services
+ "198.98.54.220" # ryona.agency
+ "35.173.245.194"
+ "99.105.215.234" # public tl
+ "65.108.204.30" # unknown
+ "65.109.31.111" # @fediverse@mastodont.cat
+ "54.37.233.246" # fba.ryona.agency domain block scraper
+ "185.244.192.119" # mooneyed.de / drow.be / bka.li blocklist scraper
+ "23.24.204.110" # ryona tool fed.dembased.xyz / annihilation.social blocklist scraper
+ "187.190.192.31" # ryona tool unfediblockthefedi.now
+ "70.106.192.146" # blocklist scraper
+ # https://openai.com/gptbot-ranges.txt
+ "20.15.240.64/28"
+ "20.15.240.80/28"
+ "20.15.240.96/28"
+ "20.15.240.176/28"
+ "20.15.241.0/28"
+ "20.15.242.128/28"
+ "20.15.242.144/28"
+ "20.15.242.192/28"
+ "40.83.2.64/28"
+ "169.150.247.39" # etke.cc
+ "143.244.38.136" # etke.cc
+ ];
+ blockedV6 = [
+ "2400:52e0:1e00::1082:1" # etke.cc
+ "2a01:4f9:4b:4b0b::2" # etke.cc
+ "2003:cb:ff2c:2700::1/64" # fedi_stats
+ "2600:3c02::/64" # scottherr stats
+ "2600:3c03::/64" # unknown, tries public tl access
+ "2605:6400:10:1fe::1/64" # ryona.agency
+ "2a01:4f9:5a:1cc4::2" # @fediverse@mastodont.cat
+ "2604:a880:400:d1::1/64" # fedidb.org
+ "2a01:4f8:162:6027::1/64" # blocklist scraper
+ ];
+ in {
+ checkReversePath = "loose";
+ trustedInterfaces = ["tailscale0" "floating1" "worker1" "nordgedanken"];
+ enable = true;
+ allowPing = true;
+ allowedTCPPorts = [
+ 22 # ssh
+ 51840
+ 51841
+ 9962
+ 9100
+ 80
+ 443
+ 9963
+ ];
+ allowedUDPPorts = [
+ 51840
+ 51841
+ ];
- extraCommands =
- builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -A INPUT -s ${ip} -j DROP") blockedV4) + "\n"
- + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6) + "\n"
- + ''
- iptables -A nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
- ip6tables -A nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
- '';
-
- extraStopCommands =
- builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -D INPUT -s ${ip} -j DROP") blockedV4) + "\n"
- + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6) + "\n"
- + ''
- iptables -D nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
- ip6tables -D nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
- '';
+ extraCommands =
+ builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -A INPUT -s ${ip} -j DROP") blockedV4)
+ + "\n"
+ + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -A INPUT -s ${ip} -j DROP") blockedV6)
+ + "\n"
+ + ''
+ iptables -A nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
+ ip6tables -A nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
+ '';
- };
+ extraStopCommands =
+ builtins.concatStringsSep "\n" (builtins.map (ip: "iptables -D INPUT -s ${ip} -j DROP") blockedV4)
+ + "\n"
+ + builtins.concatStringsSep "\n" (builtins.map (ip: "ip6tables -D INPUT -s ${ip} -j DROP") blockedV6)
+ + "\n"
+ + ''
+ iptables -D nixos-fw -p tcp --source 10.245.0.0/16 -j nixos-fw-accept
+ ip6tables -D nixos-fw -p tcp --source fd00::/104 -j nixos-fw-accept
+ '';
+ };
};
# Configure your system-wide user settings (groups, etc), add more users as needed.
@@ -315,7 +332,7 @@ in
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKUzC9NeEc4voBeAO7YuQ1ewRKCS2iar4Bcm4cKoNKUH mtrnord@nordgedanken.dev"
];
- extraGroups = [ "wheel" ];
+ extraGroups = ["wheel"];
shell = pkgs.zsh;
};
"root".passwordFile = config.sops.secrets.root_initial_password.path;
@@ -343,10 +360,10 @@ in
group = "node-yara-rs-runner";
};
};
- groups.discourse = { };
- groups.patroni = { };
- groups.pgbouncer = { };
- groups.node-yara-rs-runner = { };
+ groups.discourse = {};
+ groups.patroni = {};
+ groups.pgbouncer = {};
+ groups.node-yara-rs-runner = {};
};
# Restic Backup
@@ -430,7 +447,7 @@ in
bird-lg = {
proxy = {
enable = true;
- allowedIPs = [ "10.100.0.1" ];
+ allowedIPs = ["10.100.0.1"];
listenAddress = "10.100.0.3:8000";
};
};
diff --git a/nixos/worker-2/darlings.nix b/nixos/worker-2/darlings.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
# Darling Erasure
environment.persistence."/persist" = {
directories = [
diff --git a/nixos/worker-2/hardware-configuration.nix b/nixos/worker-2/hardware-configuration.nix
@@ -1,65 +1,62 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
{
+ config,
+ lib,
+ pkgs,
+ modulesPath,
+ ...
+}: {
imports = [
(modulesPath + "/profiles/qemu-guest.nix")
];
- boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ];
- boot.initrd.kernelModules = [ ];
- boot.kernelModules = [ ];
- boot.extraModulePackages = [ ];
+ boot.initrd.availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod"];
+ boot.initrd.kernelModules = [];
+ boot.kernelModules = [];
+ boot.extraModulePackages = [];
- fileSystems."/" =
- {
- device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
- fsType = "btrfs";
- options = [ "subvol=root" "compress=zstd" "noatime" ];
- };
+ fileSystems."/" = {
+ device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
+ fsType = "btrfs";
+ options = ["subvol=root" "compress=zstd" "noatime"];
+ };
boot.initrd.luks.devices."enc".device = "/dev/disk/by-uuid/bd88a6e2-e470-4b87-95a9-78be4a02a6ed";
- fileSystems."/home" =
- {
- device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
- fsType = "btrfs";
- options = [ "subvol=home" "compress=zstd" "noatime" ];
- };
+ fileSystems."/home" = {
+ device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
+ fsType = "btrfs";
+ options = ["subvol=home" "compress=zstd" "noatime"];
+ };
- fileSystems."/nix" =
- {
- device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
- fsType = "btrfs";
- options = [ "subvol=nix" "compress=zstd" "noatime" ];
- };
+ fileSystems."/nix" = {
+ device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
+ fsType = "btrfs";
+ options = ["subvol=nix" "compress=zstd" "noatime"];
+ };
- fileSystems."/persist" =
- {
- device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
- fsType = "btrfs";
- options = [ "subvol=persist" "compress=zstd" "noatime" ];
- neededForBoot = true;
- };
+ fileSystems."/persist" = {
+ device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
+ fsType = "btrfs";
+ options = ["subvol=persist" "compress=zstd" "noatime"];
+ neededForBoot = true;
+ };
- fileSystems."/var/log" =
- {
- device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
- fsType = "btrfs";
- options = [ "subvol=log" "compress=zstd" "noatime" ];
- neededForBoot = true;
- };
+ fileSystems."/var/log" = {
+ device = "/dev/disk/by-uuid/3267cf0b-449b-493b-9c8c-5803ec6ef158";
+ fsType = "btrfs";
+ options = ["subvol=log" "compress=zstd" "noatime"];
+ neededForBoot = true;
+ };
- fileSystems."/boot" =
- {
- device = "/dev/disk/by-uuid/73A5-870C";
- fsType = "vfat";
- };
+ fileSystems."/boot" = {
+ device = "/dev/disk/by-uuid/73A5-870C";
+ fsType = "vfat";
+ };
- swapDevices =
- [{ device = "/dev/disk/by-uuid/fb4a046f-2f7b-42c9-9af7-694cf44e8bff"; }];
+ swapDevices = [{device = "/dev/disk/by-uuid/fb4a046f-2f7b-42c9-9af7-694cf44e8bff";}];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
diff --git a/nixos/worker-2/kubernetes.nix b/nixos/worker-2/kubernetes.nix
@@ -1,5 +1,9 @@
-{ lib, pkgs, config, ... }:
{
+ lib,
+ pkgs,
+ config,
+ ...
+}: {
environment.persistence."/persist" = {
directories = [
"/var/lib/kubernetes/"
@@ -46,11 +50,10 @@
51871
];
-
services.kubernetes = {
apiserverAddress = "https://[2a01:4f9:4a:451c:2::5]:6443";
masterAddress = "[2a01:4f9:4a:451c:2::5]";
- roles = [ "node" ];
+ roles = ["node"];
proxy.enable = false;
addons.dns.enable = true;
easyCerts = false;
@@ -75,5 +78,5 @@
};
};
services.kubernetes.flannel.enable = false;
- services.kubernetes.kubelet.cni.packages = lib.mkForce [ pkgs.cni-plugins ];
+ services.kubernetes.kubelet.cni.packages = lib.mkForce [pkgs.cni-plugins];
}
diff --git a/nixpkgs.nix b/nixpkgs.nix
@@ -1,8 +1,9 @@
# A nixpkgs instance that is grabbed from the pinned nixpkgs commit in the lock file
# This is useful to avoid using channels when using legacy nix commands
-let lock = (builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked;
+let
+ lock = (builtins.fromJSON (builtins.readFile ./flake.lock)).nodes.nixpkgs.locked;
in
-import (fetchTarball {
- url = "https://github.com/nixos/nixpkgs/archive/${lock.rev}.tar.gz";
- sha256 = lock.narHash;
-})
+ import (fetchTarball {
+ url = "https://github.com/nixos/nixpkgs/archive/${lock.rev}.tar.gz";
+ sha256 = lock.narHash;
+ })
diff --git a/overlays/default.nix b/overlays/default.nix
@@ -1,8 +1,11 @@
# This file defines overlays
-{ inputs, pkgs, ... }:
{
+ inputs,
+ pkgs,
+ ...
+}: {
# This one brings our custom packages from the 'pkgs' directory
- additions = final: _prev: import ../pkgs { pkgs = final; };
+ additions = final: _prev: import ../pkgs {pkgs = final;};
# This one contains whatever you want to overlay
# You can change versions, add patches, set compilation flags, anything really.
@@ -22,7 +25,7 @@
substituteInPlace menuselect.makeopts --replace 'codec_opus_open_source ' ""
substituteInPlace menuselect.makeopts --replace 'format_ogg_opus_open_source ' ""
'';
- buildInputs = old.buildInputs ++ [ pkgs.postgresql ];
+ buildInputs = old.buildInputs ++ [pkgs.postgresql];
});
# envoy = prev.envoy.overrideAttrs (old: {
# bazelBuildFlags = old.bazelBuildFlags ++ [ "--//contrib/postgres_proxy/filters/network/source:enabled" ];
@@ -36,12 +39,11 @@
hash = "sha256-ojZ23n8Bq4288yna9RVhDvZe+AcPEInG93z7/o3uQwY=";
};
- nativeBuildInputs = [ pkgs.python312 pkgs.pandoc pkgs.libevent pkgs.libtool pkgs.autoconf pkgs.automake pkgs.openssl pkgs.pkg-config pkgs.autoreconfHook ];
+ nativeBuildInputs = [pkgs.python312 pkgs.pandoc pkgs.libevent pkgs.libtool pkgs.autoconf pkgs.automake pkgs.openssl pkgs.pkg-config pkgs.autoreconfHook];
autoreconfPhase = ''
./autogen.sh
'';
-
});
apipkg = prev.apipkg.overrideAttrs (old: {
@@ -49,14 +51,13 @@
# ModuleNotFoundError: No module named '_xyz'
"test_apipkg.py"
];
- pytestFlagsArray = [ ];
+ pytestFlagsArray = [];
doCheck = false;
});
sqlalchemy = prev.sqlalchemy.overrideAttrs (old: {
doCheck = false;
});
-
};
# When applied, the unstable nixpkgs set (declared in the flake inputs) will
diff --git a/pkgs/default.nix b/pkgs/default.nix
@@ -1,9 +1,9 @@
# Custom packages, that can be defined similarly to ones from nixpkgs
# You can build them using 'nix build .#example' or (legacy) 'nix-build -A example'
-
-{ pkgs ? (import ../nixpkgs.nix) { } }: {
+{pkgs ? (import ../nixpkgs.nix) {}}: {
# example = pkgs.callPackage ./example { };
- discourse-footnote = pkgs.discourse.mkDiscoursePlugin
+ discourse-footnote =
+ pkgs.discourse.mkDiscoursePlugin
{
name = "discourse-footnote";
src = pkgs.fetchFromGitHub {
@@ -13,7 +13,8 @@
sha256 = "sha256-jF7FzFjMcy5YNdfd5W7gvkzl755UbEmlHUl9j67/DvE=";
};
};
- discourse-cakeday = pkgs.discourse.mkDiscoursePlugin
+ discourse-cakeday =
+ pkgs.discourse.mkDiscoursePlugin
{
name = "discourse-cakeday";
src = pkgs.fetchFromGitHub {
@@ -23,7 +24,8 @@
sha256 = "sha256-1OtI+or47XBwq3mdRfOIg3OGCfVzNcK4hseJs7H+Vm8";
};
};
- discourse-templates = pkgs.discourse.mkDiscoursePlugin
+ discourse-templates =
+ pkgs.discourse.mkDiscoursePlugin
{
name = "discourse-templates";
src = pkgs.fetchFromGitHub {
@@ -33,7 +35,8 @@
sha256 = "sha256-rhkwAZGq9WPqVBuLc5eZJz+ve8x1nk6pVoYNEfDmPwI=";
};
};
- discourse-gamification = pkgs.discourse.mkDiscoursePlugin
+ discourse-gamification =
+ pkgs.discourse.mkDiscoursePlugin
{
name = "discourse-gamification";
src = pkgs.fetchFromGitHub {
@@ -43,7 +46,8 @@
sha256 = "sha256-urmCt3FCIU0YSbkEJgDOzN/2dYjyYnPstjWCGOp/Vbs=";
};
};
- discourse-locations = pkgs.discourse.mkDiscoursePlugin
+ discourse-locations =
+ pkgs.discourse.mkDiscoursePlugin
{
name = "discourse-locations";
src = pkgs.fetchFromGitHub {
diff --git a/shell.nix b/shell.nix
@@ -1,10 +1,9 @@
# Shell for bootstrapping flake-enabled nix and home-manager
# You can enter it through 'nix develop' or (legacy) 'nix-shell'
-
-{ pkgs ? (import ./nixpkgs.nix) { } }: {
+{pkgs ? (import ./nixpkgs.nix) {}}: {
default = pkgs.mkShell {
# Enable experimental features without having to specify the argument
NIX_CONFIG = "experimental-features = nix-command flakes";
- nativeBuildInputs = with pkgs; [ nix home-manager git ];
+ nativeBuildInputs = with pkgs; [nix home-manager git];
};
}
