zoey/config
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

updates

Browse source
This commit is contained in:
zoey 2026-01-13 15:39:16 -05:00
parent 6198cf14d4
commit 1506941c66
Signed by: zoey
GPG key ID: 81FB9FECDD6A33E2
49 changed files with 1963 additions and 1822 deletions
Download patch file Download diff file Expand all files Collapse all files

36
modules/nixos/hardware/audio/default.nix
View file

@ -24,39 +24,9 @@ in {
jack.enable = true;
};
systemd.user.services.cava-combine-inputs = {
description = "Combine MOTU M4 Line Inputs L/R for Cava";
# Ensure this runs after pipewire-pulse is started
after = ["pipewire-pulse.service"];
wants = ["pipewire-pulse.service"]; # Start pipewire-pulse if not already running
# Make it part of the default user session target
wantedBy = ["default.target"];
# Service configuration details
serviceConfig = {
Type = "oneshot"; # Run the command once and exit
# Use RemainAfterExit if you want the service to show as 'active' after running
# RemainAfterExit = true;
# Command to execute. Use full paths for robustness.
# We use sh -c to run multiple commands sequentially.
# pactl is provided by the pulseaudio package.
ExecStart = "${pkgs.writeShellScriptBin "cava-start" ''
echo "Attempting to load Cava combine modules..."
# Load null sink (returns non-zero if it fails AND module doesn't exist)
${pkgs.pulseaudio}/bin/pactl load-module module-null-sink sink_name=cava-line-in sink_properties=device.description="Cava_Combined_LineIn"
# Load loopbacks (returns non-zero on failure)
${pkgs.pulseaudio}/bin/pactl load-module module-loopback source="alsa_input.usb-MOTU_M4_M4MA03F7DV-00.HiFi__Line3__source" sink=cava-line-in latency_msec=10
${pkgs.pulseaudio}/bin/pactl load-module module-loopback source="alsa_input.usb-MOTU_M4_M4MA03F7DV-00.HiFi__Line4__source" sink=cava-line-in latency_msec=10
echo "Finished loading Cava combine modules (ignore errors if already loaded)."
# Exit successfully even if modules were already loaded (pactl might return 0)
exit 0
''}/bin/cava-start";
# Prevent service from restarting automatically
Restart = "no";
services.pipewire.extraConfig.pipewire."92-low-latency" = {
"context.properties" = {
"default.clock.rate" = 192000;
};
};
};

32
modules/nixos/hardware/gpu-passthru/default.nix
View file

@ -110,14 +110,6 @@ with lib.custom; let
libvirtd-cfg = config.virtualisation.libvirtd;
qemuConfigFile = pkgs.writeText "qemu.conf" ''
${optionalString libvirtd-cfg.qemu.ovmf.enable ''
nvram = [
"/run/libvirt/nix-ovmf/AAVMF_CODE.fd:/run/libvirt/nix-ovmf/AAVMF_VARS.fd",
"/run/libvirt/nix-ovmf/AAVMF_CODE.ms.fd:/run/libvirt/nix-ovmf/AAVMF_VARS.ms.fd",
"/run/libvirt/nix-ovmf/OVMF_CODE.fd:/run/libvirt/nix-ovmf/OVMF_VARS.fd",
"/run/libvirt/nix-ovmf/OVMF_CODE.ms.fd:/run/libvirt/nix-ovmf/OVMF_VARS.ms.fd"
]
''}
${optionalString (!libvirtd-cfg.qemu.runAsRoot) ''
user = "qemu-libvirtd"
group = "qemu-libvirtd"
@ -162,16 +154,6 @@ in {
package = pkgs.qemu_kvm;
runAsRoot = true;
swtpm.enable = true;
ovmf = {
enable = true;
packages = [
(pkgs.OVMF.override {
secureBoot = true;
tpmSupport = true;
})
.fd
];
};
};
};
@ -217,20 +199,6 @@ in {
done
ln -s --force ${libvirtd-cfg.qemu.package}/bin/qemu-pr-helper /run/${dirName}/nix-helpers/
${optionalString libvirtd-cfg.qemu.ovmf.enable (
let
ovmfpackage = pkgs.buildEnv {
name = "qemu-ovmf";
paths = libvirtd-cfg.qemu.ovmf.packages;
};
in ''
ln -s --force ${ovmfpackage}/FV/AAVMF_CODE{,.ms}.fd /run/${dirName}/nix-ovmf/
ln -s --force ${ovmfpackage}/FV/OVMF_CODE{,.ms}.fd /run/${dirName}/nix-ovmf/
ln -s --force ${ovmfpackage}/FV/AAVMF_VARS{,.ms}.fd /run/${dirName}/nix-ovmf/
ln -s --force ${ovmfpackage}/FV/OVMF_VARS{,.ms}.fd /run/${dirName}/nix-ovmf/
''
)}
'';
system.activationScripts.libvirt-hooks.text = ''

12
modules/nixos/hardware/nvidia/default.nix
View file

@ -44,12 +44,12 @@ in {
# Optionally, you may need to select the appropriate driver version for your specific GPU.
package = config.boot.kernelPackages.nvidiaPackages.mkDriver {
version = "580.82.07";
sha256_64bit = "sha256-Bh5I4R/lUiMglYEdCxzqm3GLolQNYFB0/yJ/zgYoeYw=";
sha256_aarch64 = "sha256-or3//aV4TQcPDgcLxFB75H/kB8n+3RzwTO1C2ZbJAJI=";
openSha256 = "sha256-8/7ZrcwBMgrBtxebYtCcH5A51u3lAxXTCY00LElZz08=";
settingsSha256 = "sha256-lx1WZHsW7eKFXvi03dAML6BoC5glEn63Tuiz3T867nY=";
persistencedSha256 = "sha256-1JCk2T3H5NNFQum0gA9cnio31jc0pGvfGIn2KkAz9kA=";
version = "580.82.09";
sha256_64bit = "sha256-Puz4MtouFeDgmsNMKdLHoDgDGC+QRXh6NVysvltWlbc=";
sha256_aarch64 = "sha256-6tHiAci9iDTKqKrDIjObeFdtrlEwjxOHJpHfX4GMEGQ=";
openSha256 = "sha256-YB+mQD+oEDIIDa+e8KX1/qOlQvZMNKFrI5z3CoVKUjs=";
settingsSha256 = "sha256-um53cr2Xo90VhZM1bM2CH4q9b/1W2YOqUcvXPV6uw2s=";
persistencedSha256 = "sha256-lbYSa97aZ+k0CISoSxOMLyyMX//Zg2Raym6BC4COipU=";
};
};

4
modules/nixos/protocols/wayland/default.nix
View file

@ -27,8 +27,8 @@ in {
};
};
services.xserver.displayManager.gdm.enable = false;
services.xserver.displayManager.gdm.wayland = true;
services.displayManager.gdm.enable = false;
services.displayManager.gdm.wayland = true;
# services.displayManager.sddm.enable = true;
# services.displayManager.sddm.package = lib.mkForce pkgs.kdePackages.sddm;

26
modules/nixos/services/crypto/default.nix
View file

@ -14,18 +14,18 @@ in {
config = mkIf cfg.enable {
services.wg-container.enable = true;
systemd.services.monero.vpnConfinement = {
enable = true;
vpnNamespace = "wg";
};
services.monero = {
enable = true;
mining.enable = false;
rpc = {address = "192.168.15.1";};
extraConfig = ''
confirm-external-bind=1
'';
};
# systemd.services.monero.vpnConfinement = {
# enable = true;
# vpnNamespace = "wg";
# };
#
# services.monero = {
# enable = true;
# mining.enable = false;
# rpc = {address = "192.168.15.1";};
# extraConfig = ''
# confirm-external-bind=1
# '';
# };
};
}

32
modules/nixos/services/mail/default.nix
View file

@ -33,7 +33,7 @@ in {
gitlab-email-pw-hashed.file = ./sec/gitlab-email-pw-hashed.age;
};
mailserver = {
mailserver = rec {
enable = true;
fqdn = "mail.zoeys.email";
domains = ["zoeys.email" "zoeys.cloud" "zoeys.computer" "zackmyers.io" "zacharymyers.com" "pictureofcat.com"];
@ -64,27 +64,23 @@ in {
};
};
certificateScheme = "acme-nginx";
enableManageSieve = true;
dmarcReporting.enable = true;
x509.useACMEHost = fqdn;
virusScanning = true;
stateVersion = 3;
};
# services.nginx = {
# virtualHosts = {
# "cal.zoeys.cloud" = {
# forceSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://localhost:5232/";
# extraConfig = ''
# proxy_set_header X-Script-Name /;
# proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
# proxy_pass_header Authorization;
# '';
# };
# };
# };
# };
services.nginx = {
virtualHosts = {
"${config.mailserver.fqdn}" = {
forceSSL = true;
enableACME = true;
};
};
};
services.roundcube = {
enable = true;

146
modules/nixos/services/matrix/default.nix Normal file
View file

@ -0,0 +1,146 @@
{
lib,
config,
pkgs,
...
}:
with lib;
with lib.custom; let
cfg = config.services.matrix;
in {
options.services.matrix = with types; {
enable = mkBoolOpt false "Matrix Web Server";
};
config = mkIf cfg.enable {
sops = {
defaultSopsFile = ../../../.sops.yaml;
gnupg.home = "/var/lib/sops";
gnupg.sshKeyPaths = [];
secrets = {
"password" = {
sopsFile = ../../../../secrets/matrix-db.yaml;
owner = "root";
group = "root";
mode = "0444";
neededForUsers = true;
};
};
};
services.matrix-synapse-next = {
enable = true;
workers.federationSenders = 2;
workers.federationReceivers = 2;
workers.initialSyncers = 2;
workers.normalSyncers = 2;
workers.eventPersisters = 2;
workers.useUserDirectoryWorker = true;
enableNginx = true;
settings = {
server_name = "zoeys.cloud";
recaptcha_public_key = "6LdcENQrAAAAAKFi-gTzPnf6Q2xq7yTmIYv6Xw5o";
recaptcha_private_key = "6LdcENQrAAAAABfnE6TVkMWtRrw0OZqZEfYaGm7m";
enable_registration = true;
enable_registration_captcha = true;
database = {
name = "psycopg2";
args = {
host = "localhost";
user = "synapse";
password = "synapse";
dbname = "synapse";
};
};
};
};
services.redis.servers."".enable = true;
services.coturn = rec {
enable = true;
no-cli = true;
no-tcp-relay = true;
min-port = 49000;
max-port = 50000;
use-auth-secret = true;
static-auth-secret = "will be world readable for local users :(";
realm = "turn.zoeys.cloud";
cert = "${config.security.acme.certs.${realm}.directory}/full.pem";
pkey = "${config.security.acme.certs.${realm}.directory}/key.pem";
extraConfig = ''
verbose
no-multicast-peers
denied-peer-ip=0.0.0.0-0.255.255.255
denied-peer-ip=10.0.0.0-10.255.255.255
denied-peer-ip=100.64.0.0-100.127.255.255
denied-peer-ip=127.0.0.0-127.255.255.255
denied-peer-ip=169.254.0.0-169.254.255.255
denied-peer-ip=172.16.0.0-172.31.255.255
denied-peer-ip=192.0.0.0-192.0.0.255
denied-peer-ip=192.0.2.0-192.0.2.255
denied-peer-ip=192.88.99.0-192.88.99.255
denied-peer-ip=192.168.0.0-192.168.255.255
denied-peer-ip=198.18.0.0-198.19.255.255
denied-peer-ip=198.51.100.0-198.51.100.255
denied-peer-ip=203.0.113.0-203.0.113.255
denied-peer-ip=240.0.0.0-255.255.255.255
denied-peer-ip=::1
denied-peer-ip=64:ff9b::-64:ff9b::ffff:ffff
denied-peer-ip=::ffff:0.0.0.0-::ffff:255.255.255.255
denied-peer-ip=100::-100::ffff:ffff:ffff:ffff
denied-peer-ip=2001::-2001:1ff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=2002::-2002:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff
denied-peer-ip=fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff
'';
};
networking.firewall = {
interfaces.ens3 = let
range = with config.services.coturn; [
{
from = min-port;
to = max-port;
}
];
in {
allowedUDPPortRanges = range;
allowedUDPPorts = [3478 5349];
allowedTCPPortRanges = [];
allowedTCPPorts = [3478 5349];
};
};
services.nginx.virtualHosts.${config.services.coturn.realm} = {
forceSSL = true;
enableACME = true;
locations."/" = {
return = "200 '<html><body>Hai :3</body></html>'";
};
};
users.groups.turnserver.members = ["nginx"];
security.acme.certs.${config.services.coturn.realm} = {
/*
insert here the right configuration to obtain a certificate
*/
postRun = "systemctl restart coturn.service";
group = "turnserver";
};
# configure synapse to point users to coturn
services.matrix-synapse.settings = with config.services.coturn; {
turn_uris = ["turn:${realm}:3478?transport=udp" "turn:${realm}:3478?transport=tcp"];
turn_shared_secret = static-auth-secret;
turn_user_lifetime = "1h";
};
};
}

2
modules/nixos/services/web/nginx/default.nix
View file

@ -20,7 +20,7 @@ in {
services.nginx = {
enable = true;
package = pkgs.nginxStable.override {openssl = pkgs.libressl;};
# package = pkgs.nginxStable.override {openssl = pkgs.libressl;};
recommendedProxySettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;

2
modules/nixos/sites/code/default.nix
View file

@ -36,7 +36,7 @@ in {
catppuccin.forgejo.enable = false;
services.gitea-actions-runner = {
package = pkgs.forgejo-actions-runner;
package = pkgs.forgejo-runner;
instances.default = {
enable = true;
name = "monolith";

2
modules/nixos/sites/pterodactyl/default.nix
View file

@ -148,6 +148,8 @@ in {
'';
};
security.acme.certs."node.nyc.zackmyers.io".keyType = "rsa4096";
services.phpfpm = {
phpOptions = ''
extension=${pkgs.php83Extensions.openssl}/lib/php/extensions/openssl.so

2
modules/nixos/ui/fonts/default.nix
View file

@ -57,7 +57,7 @@ in {
# })
noto-fonts
noto-fonts-cjk-sans
noto-fonts-emoji
noto-fonts-color-emoji
jetbrains-mono
nerd-fonts.iosevka
nerd-fonts.zed-mono