Merge branch 'massicot'

machines/massicot/default.nix

@@ -4,6 +4,7 @@
   imports = [
     ./hardware-configuration.nix
     ./networking.nix
+    ./services.nix
   ];
 
   boot.loader.efi.canTouchEfiVariables = true;
@@ -11,7 +12,6 @@
   boot.loader.grub = {
     enable = true;
     efiSupport = true;
-    device = "/dev/sda";
   };
 
   environment.systemPackages = with pkgs; [
@@ -19,16 +19,26 @@
   ];
 
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.gc = {
+    automatic = true;
+    dates = "weekly";
+    options = "--delete-older-than 7d";
+  };
+  nix.optimise.automatic = true;
+  nix.settings.auto-optimise-store = true;
+
 
   system.stateVersion = "22.11";
   
   networking = {
     hostName = "massicot";
-    useDHCP = false;
   };
 
   services.openssh = {
     enable = true;
+    settings = {
+      PasswordAuthentication = false;
+    };
   };
   
   systemd.services.sshd.wantedBy = pkgs.lib.mkForce [ "multi-user.target" ];
@@ -39,8 +49,15 @@
     openssh.authorizedKeys.keys = [
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBcSvUQnmMFtpftFKIsDqeyUyZHzRg5ewgn3VEcLnss"
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIInPn+7cMbH7zCEPJArU/Ot6oq8NHo8a2rYaCfTp7zgd"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPeNQ43f/ce4VxVPsAaKPPTp8rokQpmwNIsOX7JBZq4A"
     ];
     hashedPassword = "$y$j9T$JOJn97hZndiDamUmmT.iq.$ue7gNZz/b14ur8GhyutOCvFjsv.3rcsHmk7m.WRk6u7";
   };
+
+  security.sudo.extraRules = [
+    { users = [ "xin" ];
+      commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ];
+    }
+  ];
   
-}
+}

machines/massicot/hardware-configuration.nix

@@ -1,36 +1,13 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
+{ modulesPath, ... }:
 {
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/934bc9cd-c80f-4af0-a446-e92c3b21ad9e";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot/efi" =
-    { device = "/dev/disk/by-uuid/06F4-7777";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
-}
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.loader.grub = {
+    efiSupport = true;
+    device = "nodev";
+  };
+  fileSystems."/boot" = { device = "/dev/disk/by-uuid/AC27-D9D6"; fsType = "vfat"; };
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" ];
+  boot.initrd.kernelModules = [ "nvme" ];
+  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+  
+}

machines/massicot/networking.nix

@@ -1,6 +1,7 @@
 {
   networking = {
     interfaces = {
+      eth0.useDHCP = true;
       eth0.ipv6.addresses = [{
         address = "2a01:4f8:c17:345f::1";
         prefixLength = 64;
@@ -10,6 +11,6 @@
       address = "fe80::1";
       interface = "eth0";
     };
-    nameservers = [ "2a00:1098:2b::1" "2a00:1098:2c::1" "2a01:4f9:c010:3f02::1"];
+    nameservers = [ ];
   };
-}
+}

machines/massicot/services.nix

@@ -0,0 +1,135 @@
+{ config, pkgs, inputs, ... }:
+let
+  kanidm_listen_port = 5324;
+in
+{
+  security.acme = {
+    acceptTerms = true;
+    certs."auth.xinyang.life" = {
+        email = "lixinyang411@gmail.com";
+        listenHTTP = "127.0.0.1:1360";
+        group = "kanidm";
+    };
+  };
+  services.kanidm = {
+    enableServer = true;
+    serverSettings = {
+      domain = "auth.xinyang.life";
+      origin = "https://auth.xinyang.life";
+      bindaddress = "[::]:${toString kanidm_listen_port}";
+      tls_key = ''${config.security.acme.certs."auth.xinyang.life".directory}/key.pem'';
+      tls_chain = ''${config.security.acme.certs."auth.xinyang.life".directory}/fullchain.pem'';
+      # db_path = "/var/lib/kanidm/kanidm.db";
+    };
+  };
+  services.matrix-conduit = {
+    enable = true;
+    # package = inputs.conduit.packages.${pkgs.system}.default;
+    package = pkgs.matrix-conduit;
+    settings.global = {
+      server_name = "xinyang.life";
+      port = 6167;
+      # database_path = "/var/lib/matrix-conduit/";
+      database_backend = "rocksdb";
+      allow_registration = false;
+    };
+  };
+
+  services.gotosocial = {
+    enable = true;
+    settings = {
+      log-level = "debug";
+      host = "xinyang.life";
+      letsencrypt-enabled = false;
+      bind-address = "localhost";
+      instance-expose-public-timeline = true;
+      oidc-enabled = true;
+      oidc-idp-name = "Kanidm";
+      oidc-issuer = "https://auth.xinyang.life/oauth2/openid/gts";
+      oidc-client-id = "gts";
+      oidc-client-secret = "QkqhD6kWj8QLACa51YyFttTfyGMkFyESPsSKzvGVT8WTs3J5";
+      oidc-link-existing = true;
+    };
+  };
+
+  services.forgejo = {
+    enable = true;
+    settings = {
+      service.DISABLE_REGISTRATION = true;
+      server = {
+        ROOT_URL = "https://git.xinyang.life/";
+        START_SSH_SERVER = true;
+        BUILTIN_SSH_SERVER_USER = "git";
+        SSH_DOMAIN = "ssh.xinyang.life";
+        SSH_PORT = 2222;
+      };
+      repository = {
+        ENABLE_PUSH_CREATE_USER = true;
+      };
+      service = {
+        ENABLE_BASIC_AUTHENTICATION = false;
+      };
+      oauth2 = {
+        ENABLE = false; # Disable forgejo as oauth2 provider
+      };
+      oauth2_client = {
+        ACCOUNT_LINKING = "auto";
+        ENABLE_AUTO_REGISTRATION = true;
+        UPDATE_AVATAR = true;
+        OPENID_CONNECT_SCOPES = "openid profile email";
+      };
+      other = {
+        SHOW_FOOTER_VERSION = false;
+      };
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+    virtualHosts."xinyang.life:443".extraConfig = ''
+      tls internal
+      encode zstd gzip
+      reverse_proxy /_matrix/* localhost:6167
+      handle_path /.well-known/matrix/client {
+          header Content-Type "application/json"
+          header Access-Control-Allow-Origin "*"
+          header Content-Disposition attachment; filename="client"
+          respond `{"m.homeserver":{"base_url":"https://xinyang.life/"}, "org.matrix.msc3575.proxy":{"url":"https://xinyang.life/"}}`
+      }
+      handle_path /.well-known/matrix/server {
+          header Content-Type "application/json"
+          header Access-Control-Allow-Origin "*"
+          respond `{"m.server": "xinyang.life:443"}`
+      }
+      reverse_proxy * http://localhost:8080 {
+          flush_interval -1
+      }
+    '';
+    virtualHosts."git.xinyang.life:443".extraConfig = ''
+      reverse_proxy http://${config.services.gitea.settings.server.DOMAIN}:${toString config.services.gitea.settings.server.HTTP_PORT}
+    '';
+    
+    virtualHosts."http://auth.xinyang.life:80".extraConfig = ''
+        reverse_proxy ${config.security.acme.certs."auth.xinyang.life".listenHTTP}
+        route {
+           reverse_proxy * ${config.security.acme.certs."auth.xinyang.life".listenHTTP} order first
+           abort
+        }
+    '';
+    virtualHosts."https://auth.xinyang.life:443".extraConfig = ''
+      reverse_proxy https://auth.xinyang.life:${toString kanidm_listen_port} {
+          header_up Host {upstream_hostport}
+          header_down Access-Control-Allow-Origin "*"
+          transport http {
+              tls_server_name ${config.services.kanidm.serverSettings.domain}
+          }
+      }
+    '';
+    # 
+    # respond `Hello World`
+
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 2222 8448 ];
+  networking.firewall.allowedUDPPorts = [ 80 443 8448 ];
+}

machines/raspite/configuration.nix

@@ -10,13 +10,11 @@
   ];
   
   imports = [
-    ../clash.nix
     ../sops.nix
   ];
 
   environment.systemPackages = with pkgs; [
     git
-    clash
   ];
 
   # Use mirror for binary cache
@@ -59,4 +57,4 @@
     hashedPassword = "$y$j9T$KEOMZBlXtudOYWq/elAdI.$Vd3X8rjEplbuRBeZPp.8/gpL3zthpBNjhBR47wFc8D4";
   };
   
-}
+}