Merge branch 'vps' of codeberg.org:muon/home into vps

flake.lock

@@ -53,11 +53,11 @@
     "base16-helix": {
       "flake": false,
       "locked": {
-        "lastModified": 1696727917,
+        "lastModified": 1720809814,
-        "narHash": "sha256-FVrbPk+NtMra0jtlC5oxyNchbm8FosmvXIatkRbYy1g=",
+        "narHash": "sha256-numb3xigRGnr/deF7wdjBwVg7fpbTH7reFDkJ75AJkY=",
         "owner": "tinted-theming",
         "repo": "base16-helix",
-        "rev": "dbe1480d99fe80f08df7970e471fac24c05f2ddb",
+        "rev": "34f41987bec14c0f3f6b2155c19787b1f6489625",
         "type": "github"
       },
       "original": {
@@ -164,6 +164,27 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": [
+          "stylix",
+          "systems"
+        ]
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "fromYaml": {
       "flake": false,
       "locked": {
@@ -204,11 +225,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720734513,
+        "lastModified": 1724435763,
-        "narHash": "sha256-neWQ8eNtLTd+YMesb7WjKl1SVCbDyCm46LUgP/g/hdo=",
+        "narHash": "sha256-UNky3lJNGQtUEXT2OY8gMxejakSWPTfWKvpFkpFlAfM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "90ae324e2c56af10f20549ab72014804a3064c7f",
+        "rev": "c2cd2a52e02f1dfa1c88f95abeb89298d46023be",
         "type": "github"
       },
       "original": {
@@ -276,11 +297,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1720542800,
+        "lastModified": 1724224976,
-        "narHash": "sha256-ZgnNHuKV6h2+fQ5LuqnUaqZey1Lqqt5dTUAiAnqH0QQ=",
+        "narHash": "sha256-Z/ELQhrSd7bMzTO8r7NZgi9g5emh+aRKoCdaAv5fiO0=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "feb2849fdeb70028c70d73b848214b00d324a497",
+        "rev": "c374d94f1536013ca8e92341b540eba4c22f9c62",
         "type": "github"
       },
       "original": {
@@ -324,16 +345,18 @@
         "base16-tmux": "base16-tmux",
         "base16-vim": "base16-vim",
         "flake-compat": "flake-compat_2",
+        "flake-utils": "flake-utils_2",
         "gnome-shell": "gnome-shell",
         "home-manager": "home-manager_2",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": "nixpkgs_3",
+        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1719525570,
+        "lastModified": 1724444244,
-        "narHash": "sha256-xSO/H67GAHEW0siD2PHoO/e97MbROL3r3s5SpF6A6Dc=",
+        "narHash": "sha256-fH1lyJvJjUhZ8xMlmiI18EZNzodDSe74rFuwlZDL0aQ=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "1ff9d37d27377bfe8994c24a8d6c6c1734ffa116",
+        "rev": "d042af478ce87e188139480922a3085218194106",
         "type": "github"
       },
       "original": {
@@ -356,6 +379,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -26,6 +26,9 @@
 
         # vps
         mups = utils.mkHost ./hosts/mups/configuration.nix;
+
+        # vm
+        muvm = utils.mkHost ./hosts/muvm/configuration.nix;
       };
 
       homeManagerModules.default = ./modules/home;

hosts/muon/configuration.nix

@@ -17,6 +17,7 @@ in {
   mods.desktop.enable = true;
   mods.desktop.wayland.enable = false;
   mods.desktop.gaming.enable = true;
+  mods.boot.enable = true;
 
   mods.theme.enable = true;
   mods.theme.scheme = "woodland";
@@ -25,10 +26,14 @@ in {
   mods.containers.steam.enable = false;
   mods.server.media.enable = true;
   mods.server.astral.enable = true;
-  mods.server.astral.memory = "6G";
+  mods.server.astral.autoStart = false;
   
+  mods.docker.media.enable = false;
+
+  mods.server.sync.enable = true;
   mods.tailscale.enable = true;
   mods.openvpn.enable = false;
+  mods.wireguard.enable = true;
 
   services.xserver.windowManager.i3.enable = true;
 
@@ -40,7 +45,7 @@ in {
   # Hardware preferences
 
   ## Mouse
-  services.xserver.libinput.mouse.accelProfile = "flat";
+  services.libinput.mouse.accelProfile = "flat";
 
   ## Monitors
   mods.monitors = {

hosts/muon/hardware-configuration.nix

@@ -50,7 +50,7 @@
   networking.useDHCP = lib.mkDefault true;
   # networking.interfaces.docker0.useDHCP = lib.mkDefault true;
   networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
-  networking.interfaces.enp0s31f6.mtu = 1200;
+  networking.interfaces.enp0s31f6.mtu = 1500;
   # networking.interfaces.tun0.useDHCP = lib.mkDefault true;
   # networking.interfaces.vboxnet0.useDHCP = lib.mkDefault true;
 

hosts/muvm/configuration.nix

@@ -0,0 +1,54 @@
+{ config, lib, pkgs, inputs, system, ... }:
+let
+  cfg = config.mods;
+
+in {
+  # Hardware
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  # System
+  mods.user.name = "muon";
+  networking.hostName = "muvm";
+  mods.home.file = ./home.nix;
+
+  users.users.muon.initialPassword = "changeme";
+
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = true;
+    device = "nodev";
+  };
+
+  # Modules
+  mods.desktop.enable = true;
+  mods.boot.enable = false;
+
+  mods.theme.enable = true;
+  mods.theme.scheme = "woodland";
+  mods.theme.wallpaper = ./wallpaper.png;
+
+  services.xserver.windowManager.i3.enable = true;
+
+  # Proprietary </3
+  mods.unfree.steam.enable = true;
+
+  users.users.muon = {
+    openssh.authorizedKeys.keys =
+      [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon'' ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKevYmkH7xvYoquBjnYZ7PJiVqf+GOh9fxAJBN6wZGBB gin4@hi.is'' ];
+  };
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  users.users.root.openssh.authorizedKeys.keys =
+    [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon'' ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKevYmkH7xvYoquBjnYZ7PJiVqf+GOh9fxAJBN6wZGBB gin4@hi.is'' ];
+
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 ];
+  };
+
+  system.stateVersion = "24.05"; # Did you read the comment?
+}
+

hosts/muvm/hardware-configuration.nix

@@ -0,0 +1,18 @@
+{ config, lib, pkgs, modulesPath, ... }: {
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  networking.useDHCP = lib.mkForce true;
+
+  virtualisation.vmVariant = {
+    # following configuration is added only when building VM with build-vm
+    virtualisation = {
+      memorySize = 2048; # Use 2048MiB memory.
+      cores = 3;
+      graphics = false;
+    };
+  };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/muvm/home.nix

@@ -0,0 +1,9 @@
+{ pkgs, lib, osConfig,... }: {
+  # Modules
+  mods.terminal.zsh.enable = true;
+  mods.terminal.development.enable = true;
+  mods.terminal.tools.enable = true;
+
+  # Version of first install
+  home.stateVersion = "24.05";
+}

modules/home/desktop/development.nix

@@ -5,18 +5,20 @@
   config = lib.mkIf config.mods.desktop.development.enable {
     # home.packages = with pkgs; [];
     programs.qutebrowser = {
-      enable = false;
+      enable = true;
 
       settings = {
         content.cookies.accept = "no-3rdparty";
         url = {
-          default_page = "https://searx.be/";
+          default_page = "https://planet.gnu.org/";
-          start_pages = "https://searx.be/";
+          start_pages = "https://planet.gnu.org/";
         };
       };
 
       searchEngines = {
-        DEFAULT = "https://searx.be/?q={}";
+        DEFAULT = "https://searx.be/?s={}";
+        np = "https://search.nixos.org/packages?query={}";
+        no = "https://search.nixos.org/options?query={}";
       };
 
       extraConfig = ''

modules/home/desktop/productivity.nix

@@ -13,14 +13,17 @@
 
       # webgl
       chromium
-    ];
+      mullvad-browser
 
+      # password manager
+      bitwarden-desktop
+    ];
 
     home.sessionVariables.BROWSER = "librewolf";
     programs.zsh.sessionVariables.BROWSER = "librewolf";
 
     programs.librewolf = {
-      enable = true;
+      enable = false;
       settings = {
         "webgl.disabled" = true;
         "privacy.resistFingerprinting" = true;
@@ -29,5 +32,9 @@
         "network.cookie.lifetimePolicy" = 0;
       };
     };
+
+    # programs.qutebrowser = {
+    #   enable = true;
+    # };
   };
 }

modules/nixos/core/boot.nix

@@ -1,4 +1,12 @@
 { pkgs, lib, config, ... }: {
+  options.mods = {
+    boot.enable = lib.mkEnableOption {
+      description = "enables grub"; 
+      default = true;
+    };
+  };
+
+  config = lib.mkIf config.mods.boot.enable {
     boot.loader = lib.mkIf config.mods.xorg.enable {
       timeout = 0;
       efi.canTouchEfiVariables = true;
@@ -9,4 +17,5 @@
         gfxmodeEfi = config.mods.monitors.primary.config.mode;
       };
     };
+  };
 }

modules/nixos/core/network.nix

@@ -1,6 +1,7 @@
 { pkgs, lib, config, ... }: {
   options.mods = {
     tailscale.enable = lib.mkEnableOption "enables tailscale";
+    wireguard.enable = lib.mkEnableOption "enables wireguard client";
     openvpn.enable = lib.mkEnableOption "enables openvpn config";
     openvpn.config = let 
       username = "${config.mods.user.name}";
@@ -20,5 +21,30 @@
     services.openvpn.servers = lib.mkIf config.mods.openvpn.enable {
       remote.config = ''config ${config.mods.openvpn.config}'';
     };
+
+
+    networking = lib.mkIf config.mods.wireguard.enable {
+      firewall = {
+        allowedUDPPorts = [ 51820 ]; # Clients and peers can use the same port, see listenport
+      };
+      wireguard.interfaces = {
+        wg0 = {
+          ips = [ "10.100.0.2/24" ];
+          listenPort = 51820;
+
+          privateKeyFile = "/home/muon/wireguard-keys/private";
+
+          peers = [
+            {
+              publicKey = "2RF8GmTZwQdzVm2l2piYy6U0qiMU3wSxC7Lt8urAjwA=";
+              allowedIPs = [ "0.0.0.0/0" ];
+              endpoint = "{server ip}:51820";
+              persistentKeepalive = 25;
+            }
+          ];
+        };
+      };
+    };
+
   };
 }

modules/nixos/desktop/xorg.nix

@@ -2,7 +2,7 @@
   monitorModule = lib.types.submodule {
     options = {
       name = lib.mkOption {
-        type = lib.types.string;
+        type = lib.types.str;
         description = "monitor name";
         example = "HDMI-1";
       };
@@ -34,8 +34,8 @@ in {
     services.xserver.xkb.options = "caps:escape";
 
     services.xserver.displayManager.gdm.enable = true;
-    services.xserver.displayManager.autoLogin.enable = true;
+    services.displayManager.autoLogin.enable = true;
-    services.xserver.displayManager.autoLogin.user =
+    services.displayManager.autoLogin.user =
       config.mods.user.name;
 
     systemd.services.display-manager.wants = startupTargets;

modules/nixos/server/containers/default.nix

@@ -22,6 +22,22 @@
       externalInterface = "enp0s31f6";
     };
     networking.networkmanager.unmanaged = [ "interface-name:ve-*" ];
+    networking = {
+      bridges.br0.interfaces = [ "enp0s31f6" ]; # Adjust interface accordingly
+  
+      # Get bridge-ip with DHCP
+      useDHCP = false;
+      interfaces."br0".useDHCP = true;
+
+      # Set bridge-ip static
+      interfaces."br0".ipv4.addresses = [{
+        address = "192.168.1.171";
+        prefixLength = 24;
+      }];
+
+      defaultGateway = "192.168.1.1";
+      nameservers = [ "192.168.1.1" ];
+    };
 
     # networking.firewall.allowedTCPPorts = [ 4713 6000 ];
     # hardware.pulseaudio = {

modules/nixos/server/containers/steam.nix

@@ -18,8 +18,10 @@ in {
 
     containers.steam = {
       privateNetwork = true;
-      hostAddress = "192.168.100.10";
+      # hostAddress = "192.168.100.10";
-      localAddress = "192.168.100.11";
+      # localAddress = "192.168.100.11";
+      # hostBridge = "br0"; # Specify the bridge name
+      # localAddress = "192.168.1.171/24";
 
       bindMounts = {
         "/home/steam/.steam/steam/steamapps/common/SMITE" = {
@@ -48,7 +50,6 @@ in {
             "steam-run"
           ];
 
-
         programs.steam = {
           enable = true;
           remotePlay.openFirewall = true;
@@ -64,6 +65,8 @@ in {
           glxinfo
           wget
           bottles
+          ungoogled-chromium
+          zellij
 
           openbox
           steam-xinit
@@ -109,6 +112,14 @@ in {
           initialPassword = "changeme";
         };
 
+        networking = {
+          # Use systemd-resolved inside the container
+          # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+          useHostResolvConf = lib.mkForce false;
+        };
+    
+        services.resolved.enable = true;
+
         system.stateVersion = "23.11";
       };
     };

modules/nixos/server/default.nix

@@ -2,8 +2,10 @@
   imports = [
     ./containers
     ./gaming
+    ./docker
 
     ./media.nix
     ./sync.nix
+    ./wireguard.nix
   ];
 }

modules/nixos/server/docker/default.nix

@@ -0,0 +1,32 @@
+{ pkgs, lib, config, ... }: {
+  imports = [
+    ./media.nix
+  ];
+
+  options.mods.docker = {
+    enable = lib.mkEnableOption {
+      default = false;
+      description = "enables docker containers";
+    };
+  };
+
+  config = lib.mkIf config.mods.docker.enable {
+    environment.systemPackages = [
+      pkgs.arion
+
+       # Do install the docker CLI to talk to podman.
+       # Not needed when virtualisation.docker.enable = true;
+      pkgs.docker-client
+    ];
+
+    # Arion works with Docker, but for NixOS-based containers, you need Podman
+    # since NixOS 21.05.
+    virtualisation.docker.enable = false;
+    virtualisation.podman.enable = true;
+    virtualisation.podman.dockerSocket.enable = true;
+    virtualisation.podman.defaultNetwork.dnsname.enable = true;
+
+    # Use your username instead of `myuser`
+    users.extraUsers.${config.mods.user.name}.extraGroups = ["podman"];
+  };
+}

modules/nixos/server/docker/media.nix

@@ -0,0 +1,30 @@
+{ pkgs, lib, config, ... }: {
+  options.mods.docker.media = {
+    enable = lib.mkEnableOption {
+      default = false;
+      description = "enables docker containers for media server";
+    };
+  };
+
+  config = lib.mkIf config.mods.docker.media.enable {
+    # virtualisation.arion = {
+    #   backend = "docker";
+    #   projects = {
+    #     "hyperpipe".settings.services = {
+    #       "hyperpipe-frontend".service = {
+    #         image = "codeberg.org/hyperpipe/hyperpipe:latest";
+    #         container-name = "hyperpipe-frontend";
+    #         restart = "unless-stopped";
+    #         ports = ["8080:80"];
+    #       };
+    #       "hyperpipe-backend".service = {
+    #         image = "codeberg.org/hyperpipe/hyperpipe:latest";
+    #         container_name = "hyperpipe-backend";
+    #         restart = "unless-stopped";
+    #         ports = ["3000:3000"];
+    #       };
+    #     };
+    #   };
+    # };
+  };
+}

modules/nixos/server/gaming/astral.nix

@@ -20,6 +20,10 @@ in {
       default = "4G";
       description = "server detitated wam";
     };
+    autoStart = lib.mkEnableOption {
+      default = true;
+      description = "start server on boot";
+    };
   };
 
   config = lib.mkIf config.mods.server.astral.enable {
@@ -28,6 +32,7 @@ in {
       serverProperties = {
         online-mode = true;
       };
+      autoStart = config.mods.server.astral.autoStart;
       jvmOpts = (import ./aikar-flags.nix) config.mods.server.astral.memory;
       package = pkgs.fabricServers.${serverVersion}.override {
         loaderVersion = fabricVersion;

modules/nixos/server/wireguard.nix

@@ -0,0 +1,45 @@
+{ pkgs, lib, config, ... }: {
+  options.mods.server.wireguard = {
+    enable = lib.mkEnableOption {
+      default = false;
+      description = "enables wireguard server";
+    };
+  };
+
+
+  config = lib.mkIf config.mods.server.wireguard.enable {
+    networking.nat.enable = true;
+    networking.nat.externalInterface = "ens3";
+    networking.nat.internalInterfaces = [ "wg0" ];
+    networking.firewall = {
+      allowedUDPPorts = [ 51820 ];
+    };
+
+    networking.wireguard.interfaces = {
+      wg0 = {
+        ips = [ "10.100.0.1/24" ];
+
+        listenPort = 51820;
+
+        postSetup = ''
+          ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+
+        # This undoes the above command
+        postShutdown = ''
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.100.0.0/24 -o eth0 -j MASQUERADE
+        '';
+
+        privateKeyFile = "/home/muon/wireguard-keys/private";
+
+        peers = [
+          { 
+            publicKey = "MDBdADwP/SE/T9cadXB1Mup7Dr3x+l6gBFBN83BU4Dg=";
+            allowedIPs = [ "10.100.0.2/32" ];
+          }
+        ];
+      };
+    };
+
+  };
+}

modules/nixos/unfree/nvidia.nix

@@ -19,9 +19,9 @@ in {
 
   config = lib.mkIf cfg.enable {
     # nixos.wiki/wiki/Nvidia
-    hardware.opengl = {
+    hardware.graphics = {
       enable = true;
-      driSupport32Bit = true;
+      enable32Bit = true;
     };
 
     services.xserver.videoDrivers = [ "nvidia" "nvidia-dkms" ];