dotfiles
My PC Dotfiles & Websitegit clone https://github.com/maydayv7/dotfiles
commit 73be1ef1a321c82c25b959214399f52c9b86c859 parent 6982c62ce87ffdbe98dbd4a198348bb6e4149801 Author: maydayv7 <maydayv7@gmail.com> Date: Thu, 28 Sep 2023 15:10:20 +0530 refactor: Move out `git` Secrets Also update READMEs
Diffstat:
24 files changed, 105 insertions(+), 125 deletions(-)
diff --git a/.templates/minimal/flake.nix b/.templates/minimal/flake.nix @@ -5,7 +5,7 @@ inputs = { ## Package Repositories ## # NixOS Stable Release - nixpkgs.url = "github:NixOS/nixpkgs?ref=nixos-21.11"; + nixpkgs.url = "github:NixOS/nixpkgs?ref=nixos-23.05"; ## Configuration Modules ## # My PC Dotfiles @@ -25,9 +25,9 @@ imports = [./configuration.nix ./hardware-configuration.nix]; timezone = "Asia/Kolkata"; - locale = "en_IN.UTF-8"; + locale = "IN"; - kernel = "linux_zen"; + kernel = "zen"; kernelModules = ["xhci_pci" "ahci" "usb_storage" "sd_mod"]; hardware = { diff --git a/README.md b/README.md @@ -155,7 +155,6 @@ github:maydayv7/dotfiles ├── packages │ └── overlays ├── lib -│ ├── compat │ ├── build.nix │ ├── map.nix │ ├── pack.nix @@ -326,7 +325,7 @@ All the files and scripts in this repository are licensed under the very permiss ### Branches -There are two branches, [`stable`](../../tree/stable) and [`develop`](../../tree/develop) (when required). The `stable` branch can be used at any time, and consists of configuration that builds without failure, but the `develop` branch is a bleeding-edge testbed, and is not recommended to be used. Releases are always made from the `stable` branch after extensive testing +There are two branches, [`stable`](../../tree/stable) and [`develop`](../../tree/develop) (when required). The `stable` branch can be used at any time, and consists of configuration that builds without failure, but the `develop` branch is a bleeding-edge testbed, and is not recommended to be used ### Build @@ -351,7 +350,7 @@ The system may be set up using either a `simple` or `advanced` filesystem layout #### Data Storage -All important, persisted user files are stored at `/data`. Personal files and media are stored on an NTFS partition mounted to `/data/files` +All important, persisted user files are stored at `/data`, while persisted system files are stored at `/nix/state`. Personal files and media are stored at `/data/files` ### Home Manager @@ -399,8 +398,7 @@ The [`home-manager`](https://github.com/nix-community/home-manager) module is us Here are some repositories that I may have shamelessly rummaged through for building my `dotfiles`: _Thanks a lot! ;)_ -- Over-Engineered [Configuration](https://github.com/divnix/devos) to scare off Beginners -- Minimalistic [Configuration](https://github.com/colemickens/nixos-flake-example) for scared Beginners +- Example [Configuration](https://github.com/srid/nixos-flake) - User Configurations - - [balsoft](https://code.balsoft.ru/balsoft/nixos-config) - [bbigras](https://github.com/bbigras/nix-config) diff --git a/devices/Futura.nix b/devices/Futura.nix @@ -7,7 +7,7 @@ locale = "IN"; update = "weekly"; - kernel = "5_4"; + kernel = "6_5"; hardware = { boot = "efi"; cores = 4; @@ -15,7 +15,7 @@ modules = ["common-cpu-intel" "common-pc" "common-pc-laptop"]; }; - gui.desktop = "gnome"; + gui.desktop = "xfce"; apps.list = ["firefox" "office"]; # User Navya diff --git a/devices/README.md b/devices/README.md @@ -8,9 +8,9 @@ These are the options that can be used in addition to the ones exposed by the `n - `description`: System Description (to add to `config.system.nixos.label`) - `timezone`: System Time Zone - Ex. `"Asia/Kolkata"` -- `locale`: Default Locale - Ex. `"en_IN.UTF-8"` +- `locale`: Default Locale - Ex. `"IN"` - `channel`: System Package Repository to use (from `self.channels.${system}`) - `"stable" / "unstable"` -- `kernel`: Linux Kernel to use (from `pkgs.linuxKernel.packages.${kernel}`) - Ex. `linux_zfs` +- `kernel`: Linux Kernel to use (from `pkgs.linuxKernel.packages.linux_${kernel}`) - Ex. `zfs` - `kernelModules`: Additional Kernel Modules (to add to `config.boot.initrd.availableKernelModules`) - Ex. `[ "nvme" ]` - `imports`: Additional Configuration Files to import - Ex. `[ ./hardware-configuration.nix ]` - `format`: Generates Output for Specified Target Format (See [this](https://github.com/nix-community/nixos-generators#supported-formats) for the list of supported formats) diff --git a/devices/Vortex.nix b/devices/Vortex.nix @@ -1,37 +0,0 @@ -{ - system = "x86_64-linux"; - name = "Vortex"; - description = "PC - Dell Inspiron 15 5000"; - channel = "stable"; - - timezone = "Asia/Kolkata"; - locale = "IN"; - - kernel = "lqx"; - kernelModules = ["nvme" "thunderbolt"]; - - hardware = { - boot = "efi"; - cores = 8; - filesystem = "advanced"; - security = true; - support = ["mobile" "printer" "virtualisation"]; - modules = ["dell-inspiron-5509"]; - vm.android.enable = true; - }; - - gui.desktop = "gnome"; - shell.utilities = true; - apps.list = ["discord" "firefox" "git" "office" "vscode" "wine"]; - - # User V7 - user = { - name = "v7"; - description = "V 7"; - groups = ["wheel" "keys"]; - uid = 1000; - shell = "zsh"; - shells = ["bash"]; - recovery = true; - }; -} diff --git a/devices/Vortex/default.nix b/devices/Vortex/default.nix @@ -0,0 +1,39 @@ +{ + system = "x86_64-linux"; + name = "Vortex"; + description = "PC - Dell Inspiron 15 5000"; + channel = "stable"; + + timezone = "Asia/Kolkata"; + locale = "IN"; + + kernel = "lqx"; + kernelModules = ["nvme" "thunderbolt"]; + + imports = [./secrets]; + + hardware = { + boot = "efi"; + cores = 8; + filesystem = "advanced"; + security = true; + support = ["mobile" "printer" "virtualisation"]; + modules = ["dell-inspiron-5509"]; + vm.android.enable = true; + }; + + gui.desktop = "gnome"; + shell.utilities = true; + apps.list = ["discord" "firefox" "git" "office" "vscode" "wine"]; + + # User V7 + user = { + name = "v7"; + description = "V 7"; + groups = ["wheel" "keys"]; + uid = 1000; + shell = "zsh"; + shells = ["bash"]; + recovery = true; + }; +} diff --git a/modules/apps/git/secrets/cloudflare.secret b/devices/Vortex/secrets/cloudflare.secret diff --git a/devices/Vortex/secrets/default.nix b/devices/Vortex/secrets/default.nix @@ -0,0 +1,4 @@ +{lib, ...}: { + ## System Secrets ## + config.sops.secrets = lib.util.map.secrets ./. false; +} diff --git a/modules/apps/git/secrets/github-runner.secret b/devices/Vortex/secrets/github-runner.secret diff --git a/modules/apps/git/secrets/github-token.secret b/devices/Vortex/secrets/github-token.secret diff --git a/modules/apps/git/secrets/gitlab-runner.secret b/devices/Vortex/secrets/gitlab-runner.secret diff --git a/modules/apps/git/secrets/gitlab-token.secret b/devices/Vortex/secrets/gitlab-token.secret diff --git a/modules/README.md b/modules/README.md @@ -11,7 +11,10 @@ The `modules` directory contains custom-made pure Flakes-compatible configuratio - `hosting` - - `enable`: Enable Gitea Code Hosting - `true / false` - `domain`: Website Domain Name - Ex. `maydayv7.io` - - `runner`: Enable Support for `git` Runners - `"github" / "gitlab"` + - `secret`: Path to Cloudfare Authentication Credentials + - `runner` - + - `support`: Enable Support for `git` Runners - `"github" / "gitlab"` + - `secret`: Path to Secret for `git` Runner - `wine.package`: Package to use for `wine` - Ex. `pkgs.wineWowPackages.staging` - [`base`](./base): Module that contains the base common/shared configuration diff --git a/modules/apps/git/default.nix b/modules/apps/git/default.nix @@ -4,17 +4,11 @@ pkgs, files, ... -}: let - inherit (lib) mkIf util; - enable = builtins.elem "git" config.apps.list; -in { +}: { imports = [./hosting.nix ./runner.nix]; ## 'git' Configuration ## - config = mkIf enable { - # Secrets - sops.secrets = util.map.secrets ./secrets false; - + config = lib.mkIf (builtins.elem "git" config.apps.list) { # Utilities environment.systemPackages = with pkgs; [ gitFull diff --git a/modules/apps/git/hosting.nix b/modules/apps/git/hosting.nix @@ -4,9 +4,8 @@ ... }: let inherit (lib) mkEnableOption mkIf mkOption types; - inherit (config.apps.git.hosting) enable domain; - opt = config.apps.git.hosting.domain; - inherit (config.sops) secrets; + inherit (config.apps.git.hosting) enable domain secret; + opt = config.apps.git.hosting; in { options.apps.git.hosting = { enable = lib.mkEnableOption "Enable Gitea Code Hosting"; @@ -16,13 +15,22 @@ in { default = ""; example = "maydayv7.io"; }; + secret = mkOption { + description = "Path to Cloudfare Authentication Credentials"; + type = types.str; + default = ""; + }; }; config = mkIf enable { assertions = [ { assertion = domain != ""; - message = opt + " must be set"; + message = opt.domain.description + " must be set"; + } + { + assertion = secret != ""; + message = opt.secret.description + " must be set"; } ]; @@ -68,7 +76,7 @@ in { group = "nginx"; email = "admin@${domain}"; dnsProvider = "cloudflare"; - credentialsFile = secrets."cloudflare.secret".path; + credentialsFile = secret; extraLegoFlags = ["--dns.resolvers=8.8.8.8:53"]; }; }; diff --git a/modules/apps/git/runner.nix b/modules/apps/git/runner.nix @@ -1,5 +1,6 @@ { config, + options, lib, pkgs, files, @@ -7,28 +8,42 @@ }: let inherit (lib) mkIf mkMerge mkOption types; inherit (config.apps.git) runner; - inherit (config.sops) secrets; in { - options.apps.git.runner = mkOption { - description = "Support for 'git' Runners"; - type = types.nullOr (types.enum ["github" "gitlab"]); - default = null; + options.apps.git.runner = { + support = mkOption { + description = "Support for 'git' Runners"; + type = types.nullOr (types.enum ["github" "gitlab"]); + default = null; + }; + secret = mkOption { + description = "Path to Secret for 'git' Runner"; + type = types.str; + default = ""; + }; }; ## Runner Configuration ## - config = mkIf (runner != null) (mkMerge [ - (mkIf (runner == "github") { + config = mkIf (runner.support != null) (mkMerge [ + { + assertions = [ + { + assertion = runner.secret != ""; + message = options.apps.git.runner.secret.description + " must be set"; + } + ]; + } + (mkIf (runner.support == "github") { # GitHub Runner environment.systemPackages = [pkgs.act]; services.github-runner = { enable = true; url = files.path.repo; extraLabels = ["self"]; - tokenFile = secrets."github-runner.secret".path; + tokenFile = runner.secret; }; }) - (mkIf (runner == "gitlab") { + (mkIf (runner.support == "gitlab") { # Docker Support boot.kernel.sysctl."net.ipv4.ip_forward" = true; virtualisation.docker.enable = true; @@ -39,7 +54,7 @@ in { services.default = { dockerImage = "alpine"; tagList = ["self"]; - registrationConfigFile = secrets."gitlab-runner.secret".path; + registrationConfigFile = runner.secret; }; }; }) diff --git a/modules/apps/git/secrets/.git-keep b/modules/apps/git/secrets/.git-keep diff --git a/modules/gui/gnome.nix b/modules/gui/gnome.nix @@ -66,7 +66,7 @@ in { enable = true; theme = { name = "adw-gtk3-dark"; - package = pkgs.custom.adw-gtk3; + package = pkgs.adw-gtk3; }; iconTheme = { diff --git a/packages/adw-gtk3/default.nix b/packages/adw-gtk3/default.nix @@ -1,43 +0,0 @@ -{ - lib, - pkgs, - ... -}: -with pkgs; let - metadata = import ./metadata.nix; -in - stdenvNoCC.mkDerivation rec { - pname = "adw-gtk3"; - version = metadata.rev; - - src = fetchFromGitHub { - owner = "lassekongo83"; - repo = pname; - inherit (metadata) rev sha256; - }; - - nativeBuildInputs = [ - meson - ninja - sassc - ]; - - postPatch = '' - chmod +x gtk/src/adw-gtk3-dark/gtk-3.0/install-dark-theme.sh - patchShebangs gtk/src/adw-gtk3-dark/gtk-3.0/install-dark-theme.sh - ''; - - passthru = { - updateScript = nix-update-script { - attrPath = pname; - }; - }; - - meta = with lib; { - description = "The theme from libadwaita ported to GTK-3"; - homepage = metadata.repo; - license = licenses.lgpl21Only; - platforms = platforms.linux; - maintainers = ["maydayv7"]; - }; - } diff --git a/packages/adw-gtk3/metadata.nix b/packages/adw-gtk3/metadata.nix @@ -1,6 +0,0 @@ -{ - repo = "https://github.com/lassekongo83/adw-gtk3"; - rev = "v4.9"; - sha256 = "sha256-ni1u6696jrwjYZ4gppF9yD1RAum0+D7WxQgu09cxVGg="; - release = "true"; -} diff --git a/secrets/.sops.yaml b/secrets/.sops.yaml @@ -6,7 +6,7 @@ creation_rules: key_groups: - pgp: - *v7 - - path_regex: modules/apps/git/secrets/.*$ + - path_regex: devices/Vortex/secrets/.*$ key_groups: - pgp: - *v7 diff --git a/secrets/README.md b/secrets/README.md @@ -1,3 +1,5 @@ ### Credentials The authentication credentials are managed using [`sops-nix`](https://github.com/Mic92/sops-nix) at `secrets`. The [`sops`](https://github.com/mozilla/sops) encrypted secrets (using GPG authentication) are stored at multiple places, like in this directory, as well as [`modules/user/passwords`](../modules/user/passwords). User passwords are made using the command `mkpasswd -m sha-512` and specified using the `passwordFile` option. The `sops` encrypted secrets are of `binary` format (and have the extension `.secret`) and can be conveniently managed using the [`nixos`](../scripts/README.md) `secret` command. The `keys` directory contains the _public_ User GPG Keys which are automatically imported + +To create a secret, use the `nixos secret create` command, and append the directory along with requisite access permissions to the `.sops.yaml` file diff --git a/site/content/anime.md b/site/content/anime.md @@ -31,6 +31,7 @@ comments = true - Fuufu Ijou, Koibito Miman <sup>\*</sup> - Gekkan Shoujo Nozaki-kun - Golden Time +- Heavenly Delusion <sup>\*</sup> - Higehiro - Horimiya - I Can't Understand What My Husband Is Saying @@ -39,6 +40,7 @@ comments = true - Ijinaraide, Nagatoro-san <sup>\*</sup> <sup>#</sup> - Insomniacs after School - Kaguya-sama: Love is War <sup>#</sup> +- Kakegurui <sup>#</sup> - Kakkou no Iinazuke - Kawaii dake ja nai Shikimori-san - Kimi ni Todoke @@ -87,6 +89,7 @@ comments = true - Yamada-kun to Lv999 no Koi wo Suru <sup>\*</sup> - Yosuga no Sora - Your Lie in April +- Yuri on Ice! # Ongoing diff --git a/users/README.md b/users/README.md @@ -1,3 +1,3 @@ ### Users -The `users` directory contains the individual user-specific configurations for multiple users (of a single PC or multiple ones). To add a new user, simply create a configuration file for it (name of the file/directory must be the same as the `username` of the user) and write down the configuration using the `home-manager` module [options](https://mipmip.github.io/home-manager-option-search/). The configuration is automatically imported by `lib.build`, if present +The `users` directory contains the individual user-specific configurations for multiple users (of a single PC or multiple ones). To add a new user, simply create a configuration file for it (name of the file/directory must be the same as the `username` of the user) and write down the configuration using the `home-manager` module [options](https://mipmip.github.io/home-manager-option-search/). The configuration is automatically imported by `lib.build`, if present. Do not forget to create a `USERNAME.secret` file (using `nixos secret create`) in [`modules/user/passwords`](../modules/user/passwords/) containing the user password