206 lines
8.2 KiB
Markdown
206 lines
8.2 KiB
Markdown
# NixOS Configuration Repository
|
|
## NOTE: These configs expect this repo to be cloned to `/etc/nixos/git/`
|
|
|
|
* Installing a system from the ISO:
|
|
```
|
|
nixos-install <Hostname> [<Username>]
|
|
```
|
|
or
|
|
```
|
|
./docs/install.sh <Hostname> [<Username>]
|
|
```
|
|
* Post install:
|
|
```
|
|
nix develop -c /etc/nixos/git/docs/setup.sh
|
|
```
|
|
|
|
|
|
---
|
|
# framework-server ToDo List
|
|
* [x] minio is broken
|
|
* [x] No updates on Lemmy
|
|
* [ ] cannot send email on port 25 - [Link](https://docker-mailserver.github.io/docker-mailserver/latest/config/security/understanding-the-ports/)
|
|
* [x] traccar not seeing phone
|
|
* [ ] duplicati needs database repairs
|
|
* [ ] osaka-vultr-01 unable to connect to Headscale
|
|
* [x] Matrix is unable to send/receive pictures
|
|
* [ ] Go through old sysctl.io cronjob and import what's neccesary
|
|
* [ ] Back up pass.sysctl.io to memory stick (gpg encrypted csv file)
|
|
* [ ] Get Gnome Remote Desktop / XRDP working
|
|
|
|
# Raspberry Pi ToDo List
|
|
* [ ] nixos-rpi4-01 - Replace japan-rpi4
|
|
* crontab entry for rsyncing storage to /mnt/sda,b,c
|
|
* [ ] nixos-rpi4-02 - Replace piaware-rpi4
|
|
* Container running piaware software
|
|
|
|
# To Do List
|
|
* [ ] Try Attic - A self-hosted Nix Binary Cache server - [Link](https://discourse.nixos.org/t/introducing-attic-a-self-hostable-nix-binary-cache-server/24343)
|
|
* [ ] Try [compose2nix](https://github.com/aksiksi/compose2nix) - Docker Compose to Nix converter
|
|
* [ ] Make a dashboard for all Nixified devices (online status)
|
|
* [ ] Try deploy-rs - [Link](https://github.com/serokell/deploy-rs)
|
|
* [ ] Set up actions/forgejo-release - [Link](https://code.forgejo.org/actions/forgejo-release)
|
|
* [ ] Try lazy.vim - [Link](https://www.lazyvim.org/)
|
|
* [ ] Look into hosting a binary cache locally - [Link](https://nixos.wiki/wiki/Binary_Cache)
|
|
* [x] vscode / emacs
|
|
* Add the nix lsp - [Link](https://github.com/nix-community/rnix-lsp)
|
|
* [ ] Find a way to remove all default search engines in Firefox (Google, Amazon, etc)
|
|
* [ ] Figure out what the home-manager `account` options are for.
|
|
* [ ] Security hardening
|
|
* [ ] Edit the hosts file
|
|
* [ ] cronjobs
|
|
* [ ] Change wallpaper at a certain time of day
|
|
* [ ] Automatic git pull of this repo
|
|
* [ ] emacs
|
|
* [ ] Add bracket auto-completion
|
|
* [ ] Find a way to have magit save login credentials
|
|
* [ ] btrfs snapshots?
|
|
* [ ] vscodium and user-config.js file?
|
|
* [ ] rofi - bitwarden-cli / bitwarden-menu ([Link](https://search.nixos.org/packages?channel=23.05&show=bitwarden-menu&from=0&size=50&sort=relevance&type=packages&query=bitwarden))
|
|
* [ ] Server migration
|
|
* Do federated things need to be available externally?
|
|
* Pixelfed
|
|
* Mastodon
|
|
* Lemmy
|
|
* Sepearate backend/frontend
|
|
* Matrix
|
|
* Separate baackend/frontend
|
|
* Outbound ports
|
|
* traefik (80, 443)
|
|
* traccar (5055 tcp/udp)
|
|
* Can probably bring back internally, both devices will be internal to Headscale
|
|
* jitsi-jvb (10000 udp, 4443 tcp)
|
|
* minecraft (25565)
|
|
* vintage-story (42420)
|
|
* mailserver
|
|
- "25:25" # SMTP (explicit TLS => STARTTLS)
|
|
- "465:465" # ESMTP (implicit TLS)
|
|
- "587:587" # ESMTP (explicit TLS => STARTTLS)
|
|
- "143:143" # IMAP4 (explicit TLS => STARTTLS)
|
|
- "993:993" # IMAP4 (implicit TLS)
|
|
- "4190:4190" # Sieve support
|
|
* tor-relay (9001, 9030) - Probably not hosting for legal reasons
|
|
* headscale-derp (3478/udp, 1443/tcp) - Most likely can't host due to limitations of DERP/xinetd
|
|
* Headscale needs to be available externally
|
|
|
|
|
|
Completed ToDo List [here](docs/complete.md)
|
|
|
|
---
|
|
|
|
# Information
|
|
### Home Manager
|
|
* Home Manager Documentation - [Link](https://nix-community.github.io/home-manager/index.html)
|
|
* Home Manager Options Search - [Link](https://mipmip.github.io/home-manager-option-search/)
|
|
|
|
### NixOS
|
|
* NixOS Documentation - Stable - [Link](https://nixos.org/manual/nixos/stable/)
|
|
* NixOS Packages / Options Search - [Link](https://search.nixos.org/)
|
|
* Nix User Repository (NUR) Search - [Link](https://nur.nix-community.org/)
|
|
* ARM NixOS Building - [Link](https://nixos.wiki/wiki/NixOS_on_ARM#NixOS_installation_.26_configuration)
|
|
* NixOS Manual - [Link](https://nixos.org/manual/nix/unstable/introduction)
|
|
|
|
### Useful Links
|
|
* FlakeHub - [Link](https://flakehub.com)
|
|
* Track a Nixpkgs PR - [Link](https://nixpk.gs/pr-tracker.html)
|
|
* Awesome-Hyprland - [Link](https://github.com/hyprland-community/awesome-hyprland)
|
|
|
|
### Examples
|
|
* Tons of good examples here - [Link](https://github.com/Mic92/dotfiles/blob/main/nixos/modules/)
|
|
* NixOS Flakes Intro Guide - [Link](https://nixos-and-flakes.thiscute.world/)
|
|
|
|
### Theming
|
|
* Neofetch Themes - [Link](https://github.com/Chick2D/neofetch-themes/)
|
|
* gruvbox-factory - [Link](https://github.com/paulopacitti/gruvbox-factory)
|
|
* Hyprland Gruvboxy - [Link](https://github.com/0bCdian/Hyprland_dotfiles/tree/gruvboxy)
|
|
|
|
---
|
|
# Theming
|
|
* To change system-wide themes, see [theming.md](docs/theming.md)
|
|
|
|
---
|
|
# Lanzaboote / SecureBoot
|
|
* Instructions here - [Link](https://git.sysctl.io/Mirrors/lanzaboote/src/branch/master/docs/QUICK_START.md)
|
|
1. Create your keys: `sbctl create-keys`
|
|
2. Verify your machine is ready for SecureBoot: `sbctl verify` - Everything except `*-bzImage.efi` are signed
|
|
3. Enter Secureboot Setup mode in your EFI Settings on the motherboard (F10)
|
|
* Security -> SecureBoot -> Set to Enabled and "Reset to Setup Mode" and exit
|
|
4. Enroll the keys: `sbctl enroll-keys --microsoft`
|
|
* If you wish, you can select `--tpm-eventlog`, but checksums will change later (ie, at a kernel rebuild)
|
|
5. Reboot and verify you are activated: `bootctl status`
|
|
|
|
# Manual: GPG Keys
|
|
1. Import the user private key: `gpg --import gpg/users/albert/privkey.asc`
|
|
2. Mark it as trusted: `gpg --edit-key albert@sysctl.io`, then type `trust`, then `5`
|
|
3. On each new machine, run `sudo nix-shell -p ssh-to-pgp --run "ssh-to-pgp -i /etc/ssh/ssh_host_rsa_key -o /etc/nixos/git/keys/hosts/$(hostname).asc"`
|
|
* This will output the identifier you add to `.sops.yaml`
|
|
* Move `HOSTNAME.asc` to `keys/hosts/` and upload to git and rename accordingly.
|
|
|
|
# Secrets
|
|
1. Run `nix-develop` in `/etc/nixos/git` to import new keys
|
|
2. To edit a file: `sops secrets/file.yml"`
|
|
3. When you add a new machine, you must update the secrets files encryption.
|
|
* Run `sops updatekeys secrets/file.yaml` and commit the change.
|
|
|
|
# Troubleshooting
|
|
1. To troubleshoot issues, this command can come in handy:
|
|
```
|
|
nix eval .#nixosConfigurations.[CONFIG_NAME].config.disko.devices._config
|
|
```
|
|
|
|
|
|
# Directory Structure
|
|
```
|
|
├── docs
|
|
├── home-manager
|
|
│ ├── common
|
|
│ │ ├── desktops
|
|
│ │ │ ├── gnome
|
|
│ │ │ │ ├── common
|
|
│ │ │ │ └── themes
|
|
│ │ │ │ ├── default
|
|
│ │ │ │ └── gruvbox
|
|
│ │ │ └── hyprland
|
|
│ │ │ ├── common
|
|
│ │ │ └── themes
|
|
│ │ │ ├── default
|
|
│ │ │ └── gruvbox
|
|
│ │ └── software
|
|
│ │ ├── cli
|
|
│ │ │ └── themes
|
|
│ │ │ ├── default
|
|
│ │ │ └── gruvbox
|
|
│ │ └── gui
|
|
│ │ └── themes
|
|
│ │ ├── default
|
|
│ │ └── gruvbox
|
|
│ ├── hosts
|
|
│ └── users
|
|
├── keys
|
|
│ ├── hosts
|
|
│ ├── ssh
|
|
│ └── users
|
|
├── lib
|
|
├── nixos
|
|
│ ├── common
|
|
│ │ ├── desktops
|
|
│ │ │ ├── gnome
|
|
│ │ │ └── hyprland
|
|
│ │ ├── modules
|
|
│ │ ├── services
|
|
│ │ └── software
|
|
│ │ ├── cli
|
|
│ │ └── gui
|
|
│ ├── hosts
|
|
│ └── users
|
|
├── secrets
|
|
└── wallpapers
|
|
├── default
|
|
└── gruvbox
|
|
```
|
|
|
|
# Other
|
|
* Waybar inspirations
|
|
* https://github.com/Pipshag/dotfiles_nord
|
|
* https://github.com/hajosattila/dotfiles/
|
|
* https://gist.github.com/toger5/3a509d9a9d7ebba1e02205b00449ccff
|