# NixOS Configuration Repository ## NOTE: These configs expect this repo to be cloned to `/etc/nixos/git/` * Installing a system from the ISO: ``` nixos-install [] ``` or ``` ./docs/install.sh [] ``` * Post install: ``` nix develop -c /etc/nixos/git/docs/setup.sh ``` ![Gruv'd Hyprland](./docs/screenshot.png "Hyprland with a Gruvboxy theme") --- # framework-server ToDo List * [x] minio is broken * [x] No updates on Lemmy * [x] cannot send email on port 25 - [Link](https://docker-mailserver.github.io/docker-mailserver/latest/config/security/understanding-the-ports/) * [x] traccar not seeing phone * [x] duplicati needs database repairs * [ ] osaka-linode-01 unable to connect to Headscale * [x] Matrix is unable to send/receive pictures * [x] Go through old sysctl.io cronjob and import what's neccesary * [ ] Back up pass.sysctl.io to memory stick (gpg encrypted csv file) * [x] Get Gnome Remote Desktop / XRDP working * [x] Migrate to Protonmail, use the PM mail bridge docker container (Nix pkg?) * [x] https://github.com/shenxn/protonmail-bridge-docker#initialization * [ ] Set up ssh keys for nix builders on forgejo * [ ] Set up `nixos-rebuild switch --target-host $host` on forgejo actions * [ ] Potentially need to set up a new PGP key for use with ProtonMail * [ ] Try this https://www.ntop.org/products/traffic-analysis/ntop/ # Raspberry Pi ToDo List * [ ] nixos-rpi4-01 - Replace japan-rpi4 * crontab entry for rsyncing storage to /mnt/sda,b,c * [ ] nixos-rpi4-02 - Replace piaware-rpi4 * Container running piaware software # To Do List * [ ] Try Attic - A self-hosted Nix Binary Cache server - [Link](https://discourse.nixos.org/t/introducing-attic-a-self-hostable-nix-binary-cache-server/24343) * [ ] Try [compose2nix](https://github.com/aksiksi/compose2nix) - Docker Compose to Nix converter * [ ] Make a dashboard for all Nixified devices (online status) * [ ] Try deploy-rs - [Link](https://github.com/serokell/deploy-rs) * [ ] Set up actions/forgejo-release - [Link](https://code.forgejo.org/actions/forgejo-release) * [ ] Try lazy.vim - [Link](https://www.lazyvim.org/) * [ ] Look into hosting a binary cache locally - [Link](https://nixos.wiki/wiki/Binary_Cache) * [x] vscode / emacs * Add the nix lsp - [Link](https://github.com/nix-community/rnix-lsp) * [ ] Find a way to remove all default search engines in Firefox (Google, Amazon, etc) * [ ] Figure out what the home-manager `account` options are for. * [ ] Security hardening * [ ] Edit the hosts file * [ ] home-manager/common/software/cli/bash.nix - Break this out for theming -- Currently statically set to 'gruvbox' * [ ] cronjobs * [ ] Change wallpaper at a certain time of day * [ ] Automatic git pull of this repo * [ ] emacs * [ ] Add bracket auto-completion * [ ] Find a way to have magit save login credentials * [ ] btrfs snapshots? * [ ] vscodium and user-config.js file? * [ ] rofi - bitwarden-cli / bitwarden-menu ([Link](https://search.nixos.org/packages?channel=23.05&show=bitwarden-menu&from=0&size=50&sort=relevance&type=packages&query=bitwarden)) * [x] Server migration * Do federated things need to be available externally? * Pixelfed * Mastodon * Lemmy * Sepearate backend/frontend * Matrix * Separate baackend/frontend * Outbound ports * traefik (80, 443) * traccar (5055 tcp/udp) * Can probably bring back internally, both devices will be internal to Headscale * jitsi-jvb (10000 udp, 4443 tcp) * minecraft (25565) * vintage-story (42420) * mailserver - "25:25" # SMTP (explicit TLS => STARTTLS) - "465:465" # ESMTP (implicit TLS) - "587:587" # ESMTP (explicit TLS => STARTTLS) - "143:143" # IMAP4 (explicit TLS => STARTTLS) - "993:993" # IMAP4 (implicit TLS) - "4190:4190" # Sieve support * tor-relay (9001, 9030) - Probably not hosting for legal reasons * headscale-derp (3478/udp, 1443/tcp) - Most likely can't host due to limitations of DERP/xinetd * Headscale needs to be available externally Completed ToDo List [here](docs/complete.md) --- # Information ### Home Manager * Home Manager Documentation - [Link](https://nix-community.github.io/home-manager/index.html) * Home Manager Options Search - [Link](https://mipmip.github.io/home-manager-option-search/) ### NixOS * NixOS Documentation - Stable - [Link](https://nixos.org/manual/nixos/stable/) * NixOS Packages / Options Search - [Link](https://search.nixos.org/) * Nix User Repository (NUR) Search - [Link](https://nur.nix-community.org/) * ARM NixOS Building - [Link](https://nixos.wiki/wiki/NixOS_on_ARM#NixOS_installation_.26_configuration) * NixOS Manual - [Link](https://nixos.org/manual/nix/unstable/introduction) ### Useful Links * FlakeHub - [Link](https://flakehub.com) * Track a Nixpkgs PR - [Link](https://nixpk.gs/pr-tracker.html) * Awesome-Hyprland - [Link](https://github.com/hyprland-community/awesome-hyprland) ### Examples * Tons of good examples here - [Link](https://github.com/Mic92/dotfiles/blob/main/nixos/modules/) * NixOS Flakes Intro Guide - [Link](https://nixos-and-flakes.thiscute.world/) ### Theming * Neofetch Themes - [Link](https://github.com/Chick2D/neofetch-themes/) * gruvbox-factory - [Link](https://github.com/paulopacitti/gruvbox-factory) * Hyprland Gruvboxy - [Link](https://github.com/0bCdian/Hyprland_dotfiles/tree/gruvboxy) --- # Theming * To change system-wide themes, see [theming.md](docs/theming.md) --- # Lanzaboote / SecureBoot * Instructions here - [Link](https://git.sysctl.io/Mirrors/lanzaboote/src/branch/master/docs/QUICK_START.md) 1. Create your keys: `sbctl create-keys` 2. Verify your machine is ready for SecureBoot: `sbctl verify` - Everything except `*-bzImage.efi` are signed 3. Enter Secureboot Setup mode in your EFI Settings on the motherboard (F10) * Security -> SecureBoot -> Set to Enabled and "Reset to Setup Mode" and exit 4. Enroll the keys: `sbctl enroll-keys --microsoft` * If you wish, you can select `--tpm-eventlog`, but checksums will change later (ie, at a kernel rebuild) 5. Reboot and verify you are activated: `bootctl status` # Manual: GPG Keys 1. Import the user private key: `gpg --import gpg/users/albert/privkey.asc` 2. Mark it as trusted: `gpg --edit-key albert@sysctl.io`, then type `trust`, then `5` 3. On each new machine, run `sudo nix-shell -p ssh-to-pgp --run "ssh-to-pgp -i /etc/ssh/ssh_host_rsa_key -o /etc/nixos/git/keys/hosts/$(hostname).asc"` * This will output the identifier you add to `.sops.yaml` * Move `HOSTNAME.asc` to `keys/hosts/` and upload to git and rename accordingly. # Secrets 1. Run `nix-develop` in `/etc/nixos/git` to import new keys 2. To edit a file: `sops secrets/file.yml"` 3. When you add a new machine, you must update the secrets files encryption. * Run `sops updatekeys secrets/file.yaml` and commit the change. # Troubleshooting 1. To troubleshoot issues, this command can come in handy: ``` nix eval .#nixosConfigurations.[CONFIG_NAME].config.disko.devices._config ``` # Directory Structure ``` ├── docs ├── home-manager │   ├── common │   │   ├── desktops │   │   │   ├── gnome │   │   │   │ ├── common │   │   │   │   └── themes │   │   │   │ ├── default │   │   │   │   └── gruvbox │   │   │   └── hyprland │   │   │   ├── common │   │   │   └── themes │   │   │   ├── default │   │   │   └── gruvbox │   │   └── software │   │   ├── cli │   │   │   └── themes │   │   │   ├── default │   │   │   └── gruvbox │   │   └── gui │   │   └── themes │   │   ├── default │   │   └── gruvbox │   ├── hosts │   └── users ├── keys │   ├── hosts │   ├── ssh │   └── users ├── lib ├── nixos │   ├── common │   │   ├── desktops │   │   │   ├── gnome │   │   │   └── hyprland │   │   ├── modules │   │   ├── services │   │   └── software │   │   ├── cli │   │   └── gui │   ├── hosts │   └── users ├── secrets └── wallpapers ├── default └── gruvbox ``` # Other * Waybar inspirations * https://github.com/Pipshag/dotfiles_nord * https://github.com/hajosattila/dotfiles/ * https://gist.github.com/toger5/3a509d9a9d7ebba1e02205b00449ccff Example of passwordless SSH for deploy-rs: ``` nixosConfigurations.target = { # enable passwordless elevation security.pam.enableSSHAgentAuth = true; }; deploy.nodes.target = { # ssh as normal user but elevate to root after sshUser = "me"; user = "root"; sshOpts = [ "-A" ]; }; ```