sstent/vmimages
1
0
Fork 0
mirror of https://github.com/sstent/vmimages.git synced 2026-01-26 07:02:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

addin ssh key

Browse Source
This commit is contained in:
sstent
2023-11-21 14:00:06 +00:00
parent 4178372853
commit 54c3d889ab
33 changed files with 873 additions and 829 deletions
Download Patch File Download Diff File Expand all files Collapse all files

68
modules/home-manager/beets/default.nix
View File

@@ -1,7 +1,11 @@
{ config, pkgs, lib, ... }:
with lib;
let cfg = config.custom.beets;
{
config,
pkgs,
lib,
...
}:
with lib; let
cfg = config.custom.beets;
in {
options.custom.beets = {
enable = mkOption {
@@ -16,13 +20,12 @@ in {
pkgs.ffmpeg # for replaygain
];
sops = {
secrets.discogs_json = {
path = "${config.xdg.configHome}/beets/discogs_token.json";
sops = {
secrets.discogs_json = {
path = "${config.xdg.configHome}/beets/discogs_token.json";
};
};
};
programs.beets = {
programs.beets = {
enable = true;
settings = {
album_fields = {
@@ -48,12 +51,12 @@ in {
bracket = "[]";
ignore_va = "compilation";
types = [
{ ep = "EP"; }
{ single = "Single"; }
{ soundtrack = "OST"; }
{ live = "Live"; }
{ compilation = "Anthology"; }
{ remix = "Remix"; }
{ep = "EP";}
{single = "Single";}
{soundtrack = "OST";}
{live = "Live";}
{compilation = "Anthology";}
{remix = "Remix";}
];
};
aunique = {
@@ -61,9 +64,9 @@ in {
disambiguators = "media";
keys = "albumartist album";
};
copyartifacts = { extensions = ".cue .log .jpg .jpeg .png .txt"; };
copyartifacts = {extensions = ".cue .log .jpg .jpeg .png .txt";};
directory = "/mnt/q/CleanMusic/";
embedart = { auto = true; };
embedart = {auto = true;};
extrafiles = {
paths = {
artworkdir = "$albumpath/Artwork";
@@ -73,7 +76,7 @@ in {
};
patterns = {
all = "*.*";
artworkdir = [ "[sS]cans/" "[aA]rtwork/" "[aA]rt/" "[cC]over/" ];
artworkdir = ["[sS]cans/" "[aA]rtwork/" "[aA]rt/" "[cC]over/"];
};
};
fetchart = {
@@ -93,8 +96,7 @@ in {
isMultidisc = "1 if disctotal > 1 else 0";
myBitDepth = "('' if bitdepth != 24 else '[24bit - '+ media + ']')";
myDisc = "('' if disctotal <= 1 else str(disc) + ' - ')";
mySongartist =
"artist + ' - ' if artist != albumartist and artist != '' else ''";
mySongartist = "artist + ' - ' if artist != albumartist and artist != '' else ''";
};
library = "~/musiclibrary.db";
match = {
@@ -123,8 +125,7 @@ in {
};
missing = {
format_album = "$albumartist: ($year) $album $albumtype $atype";
format_item =
"$albumartist - $album [$albumtype]$atype: $track/$tracktotal $title";
format_item = "$albumartist - $album [$albumtype]$atype: $track/$tracktotal $title";
};
musicbrainz = {
pass = "7ANCLPczDNFn6Sf65vdZ";
@@ -132,12 +133,9 @@ in {
};
original_date = true;
paths = {
"albumtype:soundtrack" =
"Soundtracks/$albumartist - $album%aunique{} ($year)/$myDisc$track - $artist - $title";
comp =
"Compilations/$albumartist/($year) $album%aunique{}/$myDisc$track - $artist - $title";
default =
"%if{$artist_grouping,$artist_grouping/}$first_artist/$year - $album $atype%aunique{media}[%upper{$format}$bitdepth]%if{$media,[$media]}/%if{$isMultidisc,$disc - }$track - $mySongartist$title";
"albumtype:soundtrack" = "Soundtracks/$albumartist - $album%aunique{} ($year)/$myDisc$track - $artist - $title";
comp = "Compilations/$albumartist/($year) $album%aunique{}/$myDisc$track - $artist - $title";
default = "%if{$artist_grouping,$artist_grouping/}$first_artist/$year - $album $atype%aunique{media}[%upper{$format}$bitdepth]%if{$media,[$media]}/%if{$isMultidisc,$disc - }$track - $mySongartist$title";
};
per_disc_numbering = true;
plugins = [
@@ -154,25 +152,21 @@ in {
"replaygain"
"info"
];
replaygain = {
replaygain = {
backend = "ffmpeg";
};
rewrite = {
"artist Björk & Tríó Guðmundar Ingólfssonar" = "Björk";
"artist Brant Bjork and The Low Desert Punk Band" = "Brant Bjork";
"artist King Gizzard & The Lizard Wizard with Mild High Club" =
"King Gizzard & The Lizard Wizard";
"artist King Gizzard & The Lizard Wizard with Mild High Club" = "King Gizzard & The Lizard Wizard";
"artist Kyuss _ Queens of the Stone Age" = "Kyuss";
"artist Professor Elemental & Tom Caruana" = "Professor Elemental";
"artist Resin Dogs Feat Spikey Tee" = "Resin Dogs";
"artist Sepultura _ Exodus" = "Sepultura";
"artist The Knife in collaboration with Mount Sims and Planningtorock" =
"The Knife";
"artist The Knife in collaboration with Mount Sims and Planningtorock" = "The Knife";
"artist Unida _ Dozer" = "Unida";
};
};
};
};
};
}

38
modules/home-manager/keybase/default.nix
View File

@@ -1,11 +1,17 @@
{ config, pkgs, inputs, lib, util, hostName, ... }:
{
config,
pkgs,
inputs,
lib,
util,
hostName,
...
}:
with lib;
with lib.my;
let
cfg = config.custom.keybase;
username = config.home.username;
secretstore = config._secretstore;
with lib.my; let
cfg = config.custom.keybase;
username = config.home.username;
secretstore = config._secretstore;
in {
options.custom.keybase = {
enable = mkOption {
@@ -15,16 +21,14 @@ in {
};
};
config = mkIf cfg.enable {
services.keybase.enable = true;
services.kbfs.enable = true;
systemd.user.services.keybase.Unit.After = [ "sops-nix.service" ];
systemd.user.services.kbfs.Unit.After = [ "sops-nix.service" ];
services.keybase.enable = true;
services.kbfs.enable = true;
systemd.user.services.keybase.Unit.After = ["sops-nix.service"];
systemd.user.services.kbfs.Unit.After = ["sops-nix.service"];
sops = {
secrets = hm_secrets "${secretstore}/user_dotfiles/${username}@${hostName}/keybase/" "${config.xdg.configHome}/keybase/";
};
};
sops = {
secrets = hm_secrets "${secretstore}/user_dotfiles/${username}@${hostName}/keybase/" "${config.xdg.configHome}/keybase/";
};
};
}

53
modules/home-manager/ssh-proxy/default.nix
View File

@@ -1,7 +1,11 @@
{ lib, pkgs, config, ... }:
with lib;
let cfg = config.custom.ssh-proxy;
{
lib,
pkgs,
config,
...
}:
with lib; let
cfg = config.custom.ssh-proxy;
in {
options.custom.ssh-proxy = {
enable = mkOption {
@@ -14,31 +18,28 @@ in {
};
config = mkIf cfg.enable {
home.packages = with pkgs; [
npiperelay
socat
npiperelay
socat
];
systemd.user = {
startServices = true;
systemd.user = {
startServices = true;
services.ssh-proxy = {
Unit = { Description = "WSL Proxy"; After = "sops-nix.service";};
Install = { WantedBy = [ "default.target" ]; };
Service = {
ExecStart = "${pkgs.writeShellScript "start-proxy" ''
set -x -o xtrace # print commands
${pkgs.coreutils}/bin/rm -f /home/sstent/.ssh/wsl-ssh-agent.sock
${pkgs.util-linux}/bin/setsid ${pkgs.socat}/bin/socat UNIX-LISTEN:/home/sstent/.ssh/wsl-ssh-agent.sock,fork EXEC:"${pkgs.npiperelay}/bin/npiperelay.exe -ei -s //./pipe/openssh-ssh-agent",nofork
''}";
services.ssh-proxy = {
Unit = {
Description = "WSL Proxy";
After = "sops-nix.service";
};
Install = {WantedBy = ["default.target"];};
Service = {
ExecStart = "${pkgs.writeShellScript "start-proxy" ''
set -x -o xtrace # print commands
${pkgs.coreutils}/bin/rm -f /home/sstent/.ssh/wsl-ssh-agent.sock
${pkgs.util-linux}/bin/setsid ${pkgs.socat}/bin/socat UNIX-LISTEN:/home/sstent/.ssh/wsl-ssh-agent.sock,fork EXEC:"${pkgs.npiperelay}/bin/npiperelay.exe -ei -s //./pipe/openssh-ssh-agent",nofork
''}";
};
};
};
};
};
};
}
}

40
modules/nixos/mnt_public/default.nix
View File

@@ -1,19 +1,21 @@
{ lib, inputs, outputs, config, ... }:
with lib;
let cfg = config.custom.mnt_public;
in {
options.custom.mnt_public.enable = mkEnableOption "Enable mnt/Public";
config = mkIf cfg.enable {
fileSystems."/mnt/Public" = {
device = "//192.168.1.109/Public";
fsType = "cifs";
# options = ["uid=0,gid=1000"];
options = ["guest" "uid=1000"];
};
};
}
{
lib,
inputs,
outputs,
config,
...
}:
with lib; let
cfg = config.custom.mnt_public;
in {
options.custom.mnt_public.enable = mkEnableOption "Enable mnt/Public";
config = mkIf cfg.enable {
fileSystems."/mnt/Public" = {
device = "//192.168.1.109/Public";
fsType = "cifs";
# options = ["uid=0,gid=1000"];
options = ["guest" "uid=1000"];
};
};
}

32
modules/nixos/ssh/default.nix
View File

@@ -1,20 +1,22 @@
{ lib, pkgs, config, ... }:
with lib;
let cfg = config.custom.sshd;
{
lib,
pkgs,
config,
...
}:
with lib; let
cfg = config.custom.sshd;
in {
#define option to enable this
#define option to enable this
options.custom.sshd.enable = mkEnableOption "Enable SSH";
config = mkIf cfg.enable {
services.openssh = {
enable = true;
permitRootLogin = "no";
passwordAuthentication = false;
};
services.openssh = {
enable = true;
permitRootLogin = "no";
passwordAuthentication = false;
};
networking.firewall.allowedTCPPorts = [ 22 ];
};
}
networking.firewall.allowedTCPPorts = [22];
};
}

70
modules/nixos/syncthing/default.nix
View File

@@ -1,33 +1,37 @@
{ lib, inputs, outputs, config, ... }:
with lib;
let cfg = config.custom.syncthing;
in {
options.custom.syncthing.enable = mkEnableOption "Enable mnt/Public";
config = mkIf cfg.enable {
services.syncthing = {
enable = true;
dataDir = "/home/sstent";
openDefaultPorts = true;
configDir = "/home/sstent/.config/syncthing";
user = "sstent";
group = "users";
guiAddress = "0.0.0.0:8385";
overrideDevices = true;
overrideFolders = true;
devices = {
"StuPC" = { id = "Z43MPGF-OKG6K34-WTTFUDO-UG6E3TE-YCLSOAT-5LN5KMW-QHL2VSK-EZCGCAP"; };
"go3" = { id = "YDOL433-AHAL33M-NWLLDDQ-2D36ZIE-YNZVTKE-25TRBZ2-JXRSN7Y-Z5EOVQN"; };
};
folders = {
"default" = {
path = "/home/sstent/sync";
devices = [ "StuPC" "go3" ];
};
};
};
};
}
{
lib,
inputs,
outputs,
config,
...
}:
with lib; let
cfg = config.custom.syncthing;
in {
options.custom.syncthing.enable = mkEnableOption "Enable mnt/Public";
config = mkIf cfg.enable {
services.syncthing = {
enable = true;
dataDir = "/home/sstent";
openDefaultPorts = true;
configDir = "/home/sstent/.config/syncthing";
user = "sstent";
group = "users";
guiAddress = "0.0.0.0:8385";
overrideDevices = true;
overrideFolders = true;
devices = {
"StuPC" = {id = "Z43MPGF-OKG6K34-WTTFUDO-UG6E3TE-YCLSOAT-5LN5KMW-QHL2VSK-EZCGCAP";};
"go3" = {id = "YDOL433-AHAL33M-NWLLDDQ-2D36ZIE-YNZVTKE-25TRBZ2-JXRSN7Y-Z5EOVQN";};
};
folders = {
"default" = {
path = "/home/sstent/sync";
devices = ["StuPC" "go3"];
};
};
};
};
}

57
modules/nixos/vpn/default.nix
View File

@@ -1,41 +1,38 @@
{ lib, pkgs, config, ... }:
with lib;
{
lib,
pkgs,
config,
...
}:
with lib; let
secretstore = config._secretstore;
host = config.networking.hostName;
let
secretstore = config._secretstore;
host = config.networking.hostName;
cfg = config.custom.mullvad;
secret = if builtins.pathExists "${secretstore}/hosts/${host}/mullvad/device.json" then
./secrets.nix
else
{ };
cfg = config.custom.mullvad;
secret =
if builtins.pathExists "${secretstore}/hosts/${host}/mullvad/device.json"
then ./secrets.nix
else {};
in {
#define option to enable this
#define option to enable this
options.custom.mullvad.enable = mkEnableOption "Enable SSH";
# imports = [ secret ];
config = mkIf cfg.enable {
networking.wireguard.enable = true;
services.mullvad-vpn.enable = true;
networking.wireguard.enable = true;
services.mullvad-vpn.enable = true;
# set some options after every daemon start
# to avoid accidentally leaving unsafe settings
systemd.services."mullvad-daemon" = {
postStart = ''
while ! ${pkgs.mullvad}/bin/mullvad status >/dev/null; do sleep 1; done
${pkgs.mullvad}/bin/mullvad lan set allow #enable local lan access
${pkgs.mullvad}/bin/mullvad relay set tunnel-protocol wireguard
${pkgs.mullvad}/bin/mullvad relay set location ca mtr
'';
# to avoid accidentally leaving unsafe settings
systemd.services."mullvad-daemon" = {
postStart = ''
while ! ${pkgs.mullvad}/bin/mullvad status >/dev/null; do sleep 1; done
${pkgs.mullvad}/bin/mullvad lan set allow #enable local lan access
${pkgs.mullvad}/bin/mullvad relay set tunnel-protocol wireguard
${pkgs.mullvad}/bin/mullvad relay set location ca mtr
'';
};
};
};
}
}

41
modules/nixos/vpn/secrets.nix
View File

@@ -1,23 +1,18 @@
{ lib, pkgs, config, ... }:
with lib;
let
secretstore = config._secretstore;
host = config.networking.hostName;
secretpath = "${secretstore}/hosts/${host}/mullvad/device.json";
in {
sops.secrets.device_json= {
sopsFile = "${secretstore}/hosts/${host}/mullvad/device.json";
device_json.format = "binary";
};
environment.etc."mullvad-vpn/device.conf".source = config.sops.secrets.device_json.path;
}
{
lib,
pkgs,
config,
...
}:
with lib; let
secretstore = config._secretstore;
host = config.networking.hostName;
secretpath = "${secretstore}/hosts/${host}/mullvad/device.json";
in {
sops.secrets.device_json = {
sopsFile = "${secretstore}/hosts/${host}/mullvad/device.json";
device_json.format = "binary";
};
environment.etc."mullvad-vpn/device.conf".source = config.sops.secrets.device_json.path;
}

113
modules/nixos/wsl2/default.nix
View File

@@ -1,56 +1,57 @@
{ lib, inputs, outputs, config, pkgs, ... }:
with lib;
let cfg = config.custom.wsl;
in {
options.custom.wsl.enable = mkEnableOption "Enable WSL2 settings";
config = mkIf cfg.enable {
# Enable native Docker support
virtualisation.docker.enable = true;
wsl = {
enable = true;
wslConf.automount.root = "/mnt";
defaultUser = "sstent";
startMenuLaunchers = true;
wslConf.interop.appendWindowsPath = false;
#No longer needed in 23.05
#interop.preserveArgvZero = true;
#docker-native.enable = true;
nativeSystemd = true;
# Enable integration with Docker Desktop (needs to be installed)
# docker-desktop.enable = true;
};
systemd.services.nixs-wsl-systemd-fix = {
description = "Fix the /dev/shm symlink to be a mount";
unitConfig = {
DefaultDependencies = "no";
Before = [
"sysinit.target"
"systemd-tmpfiles-setup-dev.service"
"systemd-tmpfiles-setup.service"
"systemd-sysctl.service"
];
ConditionPathExists = "/dev/shm";
ConditionPathIsSymbolicLink = "/dev/shm";
ConditionPathIsMountPoint = "/run/shm";
};
serviceConfig = {
Type = "oneshot";
ExecStart = [
"${pkgs.coreutils-full}/bin/rm /dev/shm"
"/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
];
};
wantedBy = [ "sysinit.target" ];
};
};
}
{
lib,
inputs,
outputs,
config,
pkgs,
...
}:
with lib; let
cfg = config.custom.wsl;
in {
options.custom.wsl.enable = mkEnableOption "Enable WSL2 settings";
config = mkIf cfg.enable {
# Enable native Docker support
virtualisation.docker.enable = true;
wsl = {
enable = true;
wslConf.automount.root = "/mnt";
defaultUser = "sstent";
startMenuLaunchers = true;
wslConf.interop.appendWindowsPath = false;
#No longer needed in 23.05
#interop.preserveArgvZero = true;
#docker-native.enable = true;
nativeSystemd = true;
# Enable integration with Docker Desktop (needs to be installed)
# docker-desktop.enable = true;
};
systemd.services.nixs-wsl-systemd-fix = {
description = "Fix the /dev/shm symlink to be a mount";
unitConfig = {
DefaultDependencies = "no";
Before = [
"sysinit.target"
"systemd-tmpfiles-setup-dev.service"
"systemd-tmpfiles-setup.service"
"systemd-sysctl.service"
];
ConditionPathExists = "/dev/shm";
ConditionPathIsSymbolicLink = "/dev/shm";
ConditionPathIsMountPoint = "/run/shm";
};
serviceConfig = {
Type = "oneshot";
ExecStart = [
"${pkgs.coreutils-full}/bin/rm /dev/shm"
"/run/wrappers/bin/mount --bind -o X-mount.mkdir /run/shm /dev/shm"
];
};
wantedBy = ["sysinit.target"];
};
};
}