diff options
62 files changed, 3364 insertions, 1583 deletions
@@ -1 +1 @@ -.nixdeploy +.nixosdeploy @@ -0,0 +1,18 @@ +Copyright 2022-2025 Karel Kočí + +Permission is hereby granted, free of charge, to any person obtaining a copy of +this software and associated documentation files (the “Software”), to deal in +the Software without restriction, including without limitation the rights to +use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of +the Software, and to permit persons to whom the Software is furnished to do so, +subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS +FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR +COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER +IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN +CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/devShells/apo.nix b/devShells/apo.nix index a800557..80b533c 100644 --- a/devShells/apo.nix +++ b/devShells/apo.nix @@ -1,6 +1,6 @@ pkgs: c: let riscvPkgs = import pkgs.path { - localSystem = pkgs.buildPlatform.system; + localSystem = pkgs.stdenv.buildPlatform.system; crossSystem = { config = "riscv32-none-elf"; libc = "newlib"; @@ -13,6 +13,8 @@ in qtrvsim glibc.static riscvPkgs.buildPackages.gcc + pkgsCross.armv7l-hf-multiplatform.buildPackages.gcc + pkgsCross.armv7l-hf-multiplatform.buildPackages.gcc.libc.static ]; inputsFrom = [c]; meta.platforms = pkgs.lib.platforms.linux; diff --git a/devShells/c.nix b/devShells/c.nix index e5ca0a6..7c8c353 100644 --- a/devShells/c.nix +++ b/devShells/c.nix @@ -1,61 +1,60 @@ -pkgs: +pkgs: extra: pkgs.mkShell { - packages = with pkgs; [ - clang-tools_14 - ctags - gcc - gdb - pkg-config + packages = with pkgs; + [ + clang-tools + ctags + pkg-config - autoconf - automake - libtool + autoconf + automake + libtool - gnumake - bear - meson - ninja - cmake + gnumake + bear + meson + ninja + cmake - valgrind - lcov - massif-visualizer - cppcheck - flawfinder + valgrind + lcov + cppcheck + flawfinder - check - curl - ncurses - flex - bison - gperf - gobject-introspection - gtk3 - gtk4 + check + curl + ncurses + flex + bison + gperf + gobject-introspection + gtk3 + gtk4 - # Various libraries - openssl.dev - zlib.dev - curl.dev - libconfig - czmq - libevent.dev + # Various libraries + openssl.dev + zlib.dev + curl.dev + libconfig + czmq + libevent.dev - # LVGL - SDL2 - libffi.dev + # LVGL + SDL2 + libffi.dev - # Qt6 - qt6.qttools - qt6.qtbase - qt6.qttranslations - qt6.qtserialport - qt6.qtwebsockets - qt6.qtcharts - qt6.qtsvg - qt6.qtnetworkauth - qt6.qtwayland - qt6.wrapQtAppsHook - ]; + # Qt + qt6.qttools + qt6.qtbase + qt6.qttranslations + qt6.qtserialport + qt6.qtwebsockets + qt6.qtcharts + qt6.qtsvg + qt6.qtnetworkauth + qt6.qtwayland + qt6.wrapQtAppsHook + ] + ++ extra; meta.platforms = pkgs.lib.platforms.linux; } diff --git a/devShells/default.nix b/devShells/default.nix index 882f828..0f3cf21 100644 --- a/devShells/default.nix +++ b/devShells/default.nix @@ -1,4 +1,7 @@ -pkgs: rec { - c = import ./c.nix pkgs; - apo = import ./apo.nix pkgs c; +pkgs: { + c = import ./c.nix pkgs [pkgs.gcc pkgs.gdb]; + #clang = import ./c.nix pkgs [pkgs.clang]; + #musl = import ./c.nix pkgs.pkgsMusl; + #llvm = import ./c.nix pkgs.pkgsLLVM; + #apo = import ./apo.nix pkgs c; } @@ -8,11 +8,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1723293904, - "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=", + "lastModified": 1770165109, + "narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=", "owner": "ryantm", "repo": "agenix", - "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41", + "rev": "b027ee29d959fda4b60b57566d64c98a202e0feb", "type": "github" }, "original": { @@ -29,11 +29,11 @@ ] }, "locked": { - "lastModified": 1700795494, - "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=", + "lastModified": 1744478979, + "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=", "owner": "lnl7", "repo": "nix-darwin", - "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d", + "rev": "43975d782b418ebf4969e9ccba82466728c2851b", "type": "github" }, "original": { @@ -44,15 +44,12 @@ } }, "flake-utils": { - "inputs": { - "systems": "systems_2" - }, "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "lastModified": 1678901627, + "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=", "owner": "numtide", "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6", "type": "github" }, "original": { @@ -62,14 +59,14 @@ }, "flake-utils_2": { "inputs": { - "systems": "systems_3" + "systems": "systems_10" }, "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", + "lastModified": 1705309234, + "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=", "owner": "numtide", "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", + "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26", "type": "github" }, "original": { @@ -77,101 +74,98 @@ "type": "indirect" } }, - "flake-utils_3": { + "flakepy": { "inputs": { - "systems": "systems_4" + "nixpkgs": "nixpkgs_6", + "systems": "systems_3" }, "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", - "type": "github" - }, - "original": { - "id": "flake-utils", - "type": "indirect" - } - }, - "flake-utils_4": { - "locked": { - "lastModified": 1678901627, - "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6", - "type": "github" + "lastModified": 1762168435, + "narHash": "sha256-a23g9m2KWLSbglUvXZJIenf+y/27w08+UBau0zFFmIM=", + "owner": "Cynerd", + "repo": "flakepy", + "rev": "1b925443cb3945c1f456c412b78c5496d898f2ad", + "type": "gitlab" }, "original": { - "id": "flake-utils", - "type": "indirect" + "owner": "Cynerd", + "repo": "flakepy", + "type": "gitlab" } }, - "flake-utils_5": { + "flakepy_2": { "inputs": { + "nixpkgs": "nixpkgs_9", "systems": "systems_5" }, "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", - "type": "github" + "lastModified": 1762168435, + "narHash": "sha256-a23g9m2KWLSbglUvXZJIenf+y/27w08+UBau0zFFmIM=", + "owner": "Cynerd", + "repo": "flakepy", + "rev": "1b925443cb3945c1f456c412b78c5496d898f2ad", + "type": "gitlab" }, "original": { - "id": "flake-utils", - "type": "indirect" + "owner": "Cynerd", + "repo": "flakepy", + "type": "gitlab" } }, - "flake-utils_6": { + "flakepy_3": { "inputs": { - "systems": "systems_6" + "nixpkgs": "nixpkgs_11", + "systems": "systems_7" }, "locked": { - "lastModified": 1710146030, - "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a", - "type": "github" + "lastModified": 1762168435, + "narHash": "sha256-a23g9m2KWLSbglUvXZJIenf+y/27w08+UBau0zFFmIM=", + "owner": "Cynerd", + "repo": "flakepy", + "rev": "1b925443cb3945c1f456c412b78c5496d898f2ad", + "type": "gitlab" }, "original": { - "id": "flake-utils", - "type": "indirect" + "owner": "Cynerd", + "repo": "flakepy", + "type": "gitlab" } }, - "flake-utils_7": { + "home-manager": { "inputs": { - "systems": "systems_7" + "nixpkgs": [ + "agenix", + "nixpkgs" + ] }, "locked": { - "lastModified": 1705309234, - "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=", - "owner": "numtide", - "repo": "flake-utils", - "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26", + "lastModified": 1745494811, + "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be", "type": "github" }, "original": { - "id": "flake-utils", - "type": "indirect" + "owner": "nix-community", + "repo": "home-manager", + "type": "github" } }, - "home-manager": { + "home-manager_2": { "inputs": { "nixpkgs": [ - "agenix", + "vpsadminos", + "impermanence", "nixpkgs" ] }, "locked": { - "lastModified": 1703113217, - "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=", + "lastModified": 1768598210, + "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=", "owner": "nix-community", "repo": "home-manager", - "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1", + "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6", "type": "github" }, "original": { @@ -180,17 +174,69 @@ "type": "github" } }, - "nixdeploy": { + "impermanence": { + "inputs": { + "home-manager": "home-manager_2", + "nixpkgs": "nixpkgs_14" + }, + "locked": { + "lastModified": 1769548169, + "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=", + "owner": "nix-community", + "repo": "impermanence", + "rev": "7b1d382faf603b6d264f58627330f9faa5cba149", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "impermanence", + "type": "github" + } + }, + "netlinkrb": { + "flake": false, + "locked": { + "lastModified": 1562850306, + "narHash": "sha256-0bXTWUdUDr2XP+bEIfIbxXap8Niva/IoPXTxFeXXImg=", + "owner": "vpsfreecz", + "repo": "netlinkrb", + "rev": "d9de53d843d2586ffa5b7b404887fa801c697ddf", + "type": "github" + }, + "original": { + "owner": "vpsfreecz", + "repo": "netlinkrb", + "type": "github" + } + }, + "nixos-hardware": { "inputs": { - "flake-utils": "flake-utils_2", "nixpkgs": "nixpkgs_2" }, "locked": { - "lastModified": 1718017207, - "narHash": "sha256-JQoiRu2+7PbRlPk4S0kX4ss7yK3O+D7GeXscx+87T3M=", + "lastModified": 1789978172, + "narHash": "sha256-FIRXajv1pPZ+l6On6ekkmcQ6le0Zi0ncRUoR3nB0vKA=", + "owner": "NixOS", + "repo": "nixos-hardware", + "rev": "9ebcb7766700d7e006d9505247bd7ce0426f4232", + "type": "github" + }, + "original": { + "id": "nixos-hardware", + "type": "indirect" + } + }, + "nixosdeploy": { + "inputs": { + "nixpkgs": "nixpkgs_3", + "systems": "systems_2" + }, + "locked": { + "lastModified": 1790083003, + "narHash": "sha256-sJzaIgzcp5UP0n2Uj30eUbodVtRSyD2/G5w91fN/SLk=", "owner": "cynerd", "repo": "nixosdeploy", - "rev": "a44b1eed846479923a968eb465ab39a4bd919434", + "rev": "5a762cfa1910e1a7177a7b1a9e6d468f0ae6eea3", "type": "gitlab" }, "original": { @@ -199,27 +245,29 @@ "type": "gitlab" } }, - "nixos-hardware": { + "nixpkgs": { "locked": { - "lastModified": 1725716377, - "narHash": "sha256-7NzW9O/cAw7iWzRfh7Oo/SuSudL4a1YTKS6yoh3tMck=", + "lastModified": 1754028485, + "narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=", "owner": "NixOS", - "repo": "nixos-hardware", - "rev": "04a1cda0c1725094a4db703cccbb956b7558f5a6", + "repo": "nixpkgs", + "rev": "59e69648d345d6e8fef86158c555730fa12af9de", "type": "github" }, "original": { - "id": "nixos-hardware", - "type": "indirect" + "owner": "NixOS", + "ref": "nixos-25.05", + "repo": "nixpkgs", + "type": "github" } }, - "nixpkgs": { + "nixpkgsUnstable": { "locked": { - "lastModified": 1703013332, - "narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=", + "lastModified": 1789921291, + "narHash": "sha256-Ft/BRnIqw1MywFoXydKobjjWmDFgDdYtSpJliE8+yUw=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6", + "rev": "44a91898084f46797b5fac650c7e8c9ac38c43d4", "type": "github" }, "original": { @@ -229,13 +277,13 @@ "type": "github" } }, - "nixpkgs_2": { + "nixpkgs_10": { "locked": { - "lastModified": 1712883908, - "narHash": "sha256-icE1IJE9fHcbDfJ0+qWoDdcBXUoZCcIJxME4lMHwvSM=", + "lastModified": 1769433173, + "narHash": "sha256-Gf1dFYgD344WZ3q0LPlRoWaNdNQq8kSBDLEWulRQSEs=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "a0c9e3aee1000ac2bfb0e5b98c94c946a5d180a9", + "rev": "13b0f9e6ac78abbbb736c635d87845c4f4bee51b", "type": "github" }, "original": { @@ -243,28 +291,41 @@ "type": "indirect" } }, - "nixpkgs_3": { + "nixpkgs_11": { "locked": { - "lastModified": 1725857262, - "narHash": "sha256-m9n0PncgZepVgmjOO1rfVXMgUACDOwZbhjSRjJ/NUpM=", + "lastModified": 1761880412, + "narHash": "sha256-QoJjGd4NstnyOG4mm4KXF+weBzA2AH/7gn1Pmpfcb0A=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "5af6aefbcc55670e36663fd1f8a796e1e323001a", + "rev": "a7fc11be66bdfb5cdde611ee5ce381c183da8386", "type": "github" }, "original": { "id": "nixpkgs", - "ref": "nixos-unstable-small", "type": "indirect" } }, - "nixpkgs_4": { + "nixpkgs_12": { + "locked": { + "lastModified": 1769433173, + "narHash": "sha256-Gf1dFYgD344WZ3q0LPlRoWaNdNQq8kSBDLEWulRQSEs=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "13b0f9e6ac78abbbb736c635d87845c4f4bee51b", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "type": "indirect" + } + }, + "nixpkgs_13": { "locked": { - "lastModified": 1715653339, - "narHash": "sha256-7lR9tpVXviSccl07GXI0+ve/natd24HAkuy1sQp0OlI=", + "lastModified": 1707877513, + "narHash": "sha256-sp0w2apswd3wv0sAEF7StOGHkns3XUQaO5erhWFZWXk=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "abd6d48f8c77bea7dc51beb2adfa6ed3950d2585", + "rev": "89653a03e0915e4a872788d10680e7eec92f8600", "type": "github" }, "original": { @@ -272,13 +333,86 @@ "type": "indirect" } }, + "nixpkgs_14": { + "locked": { + "lastModified": 1768564909, + "narHash": "sha256-Kell/SpJYVkHWMvnhqJz/8DqQg2b6PguxVWOuadbHCc=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "e4bae1bd10c9c57b2cf517953ab70060a828ee6f", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_15": { + "locked": { + "lastModified": 1789998861, + "narHash": "sha256-62XMQD4WLdMAfdT0/8gJmPH2dKeTw908ryNloAplTr8=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "1e8bc658fc985ef27ccd66d107d767b32bb7ef98", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-26.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_2": { + "locked": { + "lastModified": 1789546076, + "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=", + "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3", + "type": "tarball", + "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.xz" + }, + "original": { + "type": "tarball", + "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz" + } + }, + "nixpkgs_3": { + "locked": { + "lastModified": 1776329215, + "narHash": "sha256-a8BYi3mzoJ/AcJP8UldOx8emoPRLeWqALZWu4ZvjPXw=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "b86751bc4085f48661017fa226dee99fab6c651b", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "type": "indirect" + } + }, + "nixpkgs_4": { + "locked": { + "lastModified": 1790096505, + "narHash": "sha256-rrj0QhcnMUa9E7+D0NpF4FHpTgGsOXIDkh2ruzt641c=", + "rev": "a251c42236bbff9f870fcdc513dac5873009c304", + "type": "tarball", + "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1078218.a251c42236bb/nixexprs.tar.zst" + }, + "original": { + "id": "nixpkgs", + "ref": "nixos-unstable-small", + "type": "indirect" + } + }, "nixpkgs_5": { "locked": { - "lastModified": 1678875422, - "narHash": "sha256-T3o6NcQPwXjxJMn2shz86Chch4ljXgZn746c2caGxd8=", + "lastModified": 1781607440, + "narHash": "sha256-rxO+uc/KFbSJp+pgyXRuAX6QlG9hJdnt0BXpEQRXY+U=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "126f49a01de5b7e35a43fd43f891ecf6d3a51459", + "rev": "3e41b24abd260e8f71dbe2f5737d24122f972158", "type": "github" }, "original": { @@ -288,11 +422,11 @@ }, "nixpkgs_6": { "locked": { - "lastModified": 1724300212, - "narHash": "sha256-x3jl6OWTs+L9C7EtscuWZmGZWI0iSBDafvg3X7JMa1A=", + "lastModified": 1761880412, + "narHash": "sha256-QoJjGd4NstnyOG4mm4KXF+weBzA2AH/7gn1Pmpfcb0A=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "4de4818c1ffa76d57787af936e8a23648bda6be4", + "rev": "a7fc11be66bdfb5cdde611ee5ce381c183da8386", "type": "github" }, "original": { @@ -302,11 +436,11 @@ }, "nixpkgs_7": { "locked": { - "lastModified": 1722141560, - "narHash": "sha256-Ul3rIdesWaiW56PS/Ak3UlJdkwBrD4UcagCmXZR9Z7Y=", + "lastModified": 1769433173, + "narHash": "sha256-Gf1dFYgD344WZ3q0LPlRoWaNdNQq8kSBDLEWulRQSEs=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "038fb464fcfa79b4f08131b07f2d8c9a6bcc4160", + "rev": "13b0f9e6ac78abbbb736c635d87845c4f4bee51b", "type": "github" }, "original": { @@ -316,11 +450,25 @@ }, "nixpkgs_8": { "locked": { - "lastModified": 1707877513, - "narHash": "sha256-sp0w2apswd3wv0sAEF7StOGHkns3XUQaO5erhWFZWXk=", + "lastModified": 1678875422, + "narHash": "sha256-T3o6NcQPwXjxJMn2shz86Chch4ljXgZn746c2caGxd8=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "89653a03e0915e4a872788d10680e7eec92f8600", + "rev": "126f49a01de5b7e35a43fd43f891ecf6d3a51459", + "type": "github" + }, + "original": { + "id": "nixpkgs", + "type": "indirect" + } + }, + "nixpkgs_9": { + "locked": { + "lastModified": 1761880412, + "narHash": "sha256-QoJjGd4NstnyOG4mm4KXF+weBzA2AH/7gn1Pmpfcb0A=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "a7fc11be66bdfb5cdde611ee5ce381c183da8386", "type": "github" }, "original": { @@ -330,15 +478,14 @@ }, "nixturris": { "inputs": { - "flake-utils": "flake-utils_3", - "nixpkgs": "nixpkgs_4" + "nixpkgs": "nixpkgs_5" }, "locked": { - "lastModified": 1715772678, - "narHash": "sha256-UxVyJzWt4/TzJhfbX2LcKAb1fhAH0PXJA9boUaHsyZ0=", + "lastModified": 1782209944, + "narHash": "sha256-w1ci2mDXyMWN9a407O6sMszaeV+P5uDYl1pKVc2YxAM=", "owner": "cynerd", "repo": "nixturris", - "rev": "c3cf29dba9af8a226e527f11b80305bcdd22e5dd", + "rev": "65588ac231764665ce1e5e551ce3058cd1a371a2", "type": "gitlab" }, "original": { @@ -349,11 +496,11 @@ }, "personal-secret": { "locked": { - "lastModified": 1718186830, - "narHash": "sha256-gWvYesgp4/ZHuZZDpSSgpNm/lFGLAZaBnVw1MG0eHC4=", + "lastModified": 1788438578, + "narHash": "sha256-C2Exztqfqth+g+988XKz0VJxi/iSmLOQE44a0T+s9a8=", "ref": "refs/heads/master", - "rev": "07c3c94e37721b4a1365a2cd1ad84a1bac10c4da", - "revCount": 108, + "rev": "98f39613e7e6d102697198735de763be7bcd2bd1", + "revCount": 157, "type": "git", "url": "ssh://git@cynerd.cz/nixos-personal-secret" }, @@ -364,15 +511,56 @@ }, "pyshv": { "inputs": { - "flake-utils": "flake-utils_6", - "nixpkgs": "nixpkgs_7" + "flakepy": "flakepy", + "nixpkgs": "nixpkgs_7", + "systems": "systems_4" + }, + "locked": { + "lastModified": 1774445966, + "narHash": "sha256-6PrmBH0qe4j1YQk3dZFsNOu8OFvYn6PbsOjGvYLXcqY=", + "owner": "silicon-heaven", + "repo": "pyshv", + "rev": "e6d59c5411f9b7820819838683ce99bc9b24083d", + "type": "github" + }, + "original": { + "owner": "silicon-heaven", + "repo": "pyshv", + "type": "github" + } + }, + "pyshv_2": { + "inputs": { + "flakepy": "flakepy_2", + "nixpkgs": "nixpkgs_10", + "systems": "systems_6" }, "locked": { - "lastModified": 1724333785, - "narHash": "sha256-17pWZPRa4UcVOEnaawyshGWnFzoRXBuZNM3t24SV15w=", + "lastModified": 1774445966, + "narHash": "sha256-6PrmBH0qe4j1YQk3dZFsNOu8OFvYn6PbsOjGvYLXcqY=", "owner": "silicon-heaven", "repo": "pyshv", - "rev": "afe9817a30656a9750e9868aa1eccbf8d3c77562", + "rev": "e6d59c5411f9b7820819838683ce99bc9b24083d", + "type": "gitlab" + }, + "original": { + "owner": "silicon-heaven", + "repo": "pyshv", + "type": "gitlab" + } + }, + "pyshv_3": { + "inputs": { + "flakepy": "flakepy_3", + "nixpkgs": "nixpkgs_12", + "systems": "systems_8" + }, + "locked": { + "lastModified": 1770201747, + "narHash": "sha256-9zCrizDDVrHr7H5F8WsoKr2h/QSIbPX22+iaf0lej+E=", + "owner": "silicon-heaven", + "repo": "pyshv", + "rev": "c48c92ca4b0a4764aece735ef21dd1ce384693d8", "type": "gitlab" }, "original": { @@ -384,29 +572,48 @@ "root": { "inputs": { "agenix": "agenix", - "flake-utils": "flake-utils", - "nixdeploy": "nixdeploy", "nixos-hardware": "nixos-hardware", - "nixpkgs": "nixpkgs_3", + "nixosdeploy": "nixosdeploy", + "nixpkgs": "nixpkgs_4", "nixturris": "nixturris", "personal-secret": "personal-secret", + "pyshv": "pyshv", "shellrc": "shellrc", "shvcli": "shvcli", + "shvcli-ell": "shvcli-ell", + "systems": "systems_9", "usbkey": "usbkey", "vpsadminos": "vpsadminos" } }, + "ruby-lxc": { + "flake": false, + "locked": { + "lastModified": 1780499941, + "narHash": "sha256-guAdOSP9MyCL3BQ1LGXAhcCoXgEU1fUE69d2ATMqUGE=", + "owner": "vpsfreecz", + "repo": "ruby-lxc", + "rev": "004bf35eb90d41ba60b347b5b1e73d868a4f95d9", + "type": "github" + }, + "original": { + "owner": "vpsfreecz", + "ref": "2026-06-03-nixos-26-05-port", + "repo": "ruby-lxc", + "type": "github" + } + }, "shellrc": { "inputs": { - "flake-utils": "flake-utils_4", - "nixpkgs": "nixpkgs_5" + "flake-utils": "flake-utils", + "nixpkgs": "nixpkgs_8" }, "locked": { - "lastModified": 1721899791, - "narHash": "sha256-dT+kwR2nuymeq3qqzc5//g4nQJRG1pVWUeZztCXgYCM=", + "lastModified": 1783077633, + "narHash": "sha256-4YtSrDm4aZNuFbBON+H8eypVquhEBTn2Vi3d9isNngo=", "ref": "refs/heads/master", - "rev": "0adc7c32594913d0f4ec774a85cb03554cd719d4", - "revCount": 112, + "rev": "62348187455c0e10257a7a3a899c5562ebbf1db5", + "revCount": 120, "type": "git", "url": "https://git.cynerd.cz/shellrc" }, @@ -417,16 +624,14 @@ }, "shvcli": { "inputs": { - "flake-utils": "flake-utils_5", - "nixpkgs": "nixpkgs_6", - "pyshv": "pyshv" + "pyshv": "pyshv_2" }, "locked": { - "lastModified": 1724334728, - "narHash": "sha256-AXMBOOED8GTdJvpzwZtSkq1GBBzV3/pcWk3mpgQryzo=", + "lastModified": 1774453854, + "narHash": "sha256-qRHRhlobhm7pyxR2WzaQTqo+BcFSwvyYo4mppjZTBAk=", "owner": "silicon-heaven", "repo": "shvcli", - "rev": "77bec05261b5f077ad2790ba4d592acdad3815b1", + "rev": "6c32308b51405b13161291062e35d9ba9d457455", "type": "github" }, "original": { @@ -435,6 +640,42 @@ "type": "github" } }, + "shvcli-ell": { + "inputs": { + "shvcli": "shvcli_2" + }, + "locked": { + "lastModified": 1778673602, + "narHash": "sha256-RpEm9/Xv8AOHs6DyhRqVNwJYzX7WeSdSNjDFgwtHJyg=", + "owner": "elektroline-predator", + "repo": "shvcli-ell", + "rev": "cf8b0e628a49604ff90530f9362adec94e3a95ca", + "type": "gitlab" + }, + "original": { + "owner": "elektroline-predator", + "repo": "shvcli-ell", + "type": "gitlab" + } + }, + "shvcli_2": { + "inputs": { + "pyshv": "pyshv_3" + }, + "locked": { + "lastModified": 1770909970, + "narHash": "sha256-wyxffdgZgtq5jL3d9MNu2lip5qh9sUTw+dxu1k/WMCU=", + "owner": "silicon-heaven", + "repo": "shvcli", + "rev": "e68493c79027177faef461ed5fbef355ab9ec0a7", + "type": "gitlab" + }, + "original": { + "owner": "silicon-heaven", + "repo": "shvcli", + "type": "gitlab" + } + }, "systems": { "locked": { "lastModified": 1681028828, @@ -450,7 +691,7 @@ "type": "github" } }, - "systems_2": { + "systems_10": { "locked": { "lastModified": 1681028828, "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", @@ -465,7 +706,7 @@ "type": "github" } }, - "systems_3": { + "systems_2": { "locked": { "lastModified": 1681028828, "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", @@ -475,9 +716,22 @@ "type": "github" }, "original": { + "id": "systems", + "type": "indirect" + } + }, + "systems_3": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", "owner": "nix-systems", "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", "type": "github" + }, + "original": { + "id": "systems", + "type": "indirect" } }, "systems_4": { @@ -490,9 +744,8 @@ "type": "github" }, "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" + "id": "systems", + "type": "indirect" } }, "systems_5": { @@ -505,9 +758,8 @@ "type": "github" }, "original": { - "owner": "nix-systems", - "repo": "default", - "type": "github" + "id": "systems", + "type": "indirect" } }, "systems_6": { @@ -520,12 +772,25 @@ "type": "github" }, "original": { + "id": "systems", + "type": "indirect" + } + }, + "systems_7": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", "owner": "nix-systems", "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", "type": "github" + }, + "original": { + "id": "systems", + "type": "indirect" } }, - "systems_7": { + "systems_8": { "locked": { "lastModified": 1681028828, "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", @@ -535,22 +800,36 @@ "type": "github" }, "original": { + "id": "systems", + "type": "indirect" + } + }, + "systems_9": { + "locked": { + "lastModified": 1689347949, + "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=", "owner": "nix-systems", - "repo": "default", + "repo": "default-linux", + "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default-linux", "type": "github" } }, "usbkey": { "inputs": { - "flake-utils": "flake-utils_7", - "nixpkgs": "nixpkgs_8" + "flake-utils": "flake-utils_2", + "nixpkgs": "nixpkgs_13" }, "locked": { - "lastModified": 1707940956, - "narHash": "sha256-XUJEkayw/HJlSC1z1pZICju/IA5hx1mgF//ZYHY5QUM=", + "lastModified": 1744029480, + "narHash": "sha256-74ch+U8HooU4UQ+Axyhw7gvTiTQirDWPL33Z50vE9mM=", "owner": "cynerd", "repo": "usbkey", - "rev": "01e2e4b0435163ce65c07573d2dccbfdcca10c36", + "rev": "8905d295c7bc7d44e5dcb925ef6e96bd416c134e", "type": "gitlab" }, "original": { @@ -560,12 +839,19 @@ } }, "vpsadminos": { + "inputs": { + "impermanence": "impermanence", + "netlinkrb": "netlinkrb", + "nixpkgs": "nixpkgs_15", + "nixpkgsUnstable": "nixpkgsUnstable", + "ruby-lxc": "ruby-lxc" + }, "locked": { - "lastModified": 1725810385, - "narHash": "sha256-+6UULi05KMHmLfhlrNGhMdLZUoQeC5Dc1nLFdINyeyI=", + "lastModified": 1790063559, + "narHash": "sha256-3XwYFswjBDtjNijX5cGpqqvrAgI8swBUjKkXCQD/THE=", "owner": "vpsfreecz", "repo": "vpsadminos", - "rev": "37c5eb47ca3f11deac83e4ada20a6c21d5487f29", + "rev": "67da718e391e5bab347f9b53624f553752301c82", "type": "github" }, "original": { @@ -2,14 +2,17 @@ description = "Cynerd's personal flake"; inputs = { - nixpkgs.url = "nixpkgs/nixos-unstable-small"; + systems.url = "github:nix-systems/default-linux"; + nixpkgs.url = "flake:nixpkgs/nixos-unstable-small"; nixos-hardware.url = "nixos-hardware"; - nixdeploy.url = "gitlab:cynerd/nixosdeploy"; + nixosdeploy.url = "gitlab:cynerd/nixosdeploy"; personal-secret.url = "git+ssh://git@cynerd.cz/nixos-personal-secret"; shellrc.url = "git+https://git.cynerd.cz/shellrc"; agenix.url = "github:ryantm/agenix"; + pyshv.url = "github:silicon-heaven/pyshv"; shvcli.url = "github:silicon-heaven/shvcli"; + shvcli-ell.url = "gitlab:elektroline-predator/shvcli-ell"; usbkey.url = "gitlab:cynerd/usbkey"; @@ -19,63 +22,69 @@ outputs = { self, - flake-utils, + systems, nixpkgs, - nixdeploy, + nixosdeploy, personal-secret, shellrc, agenix, + pyshv, shvcli, + shvcli-ell, usbkey, nixturris, ... }: let - inherit (flake-utils.lib) eachDefaultSystem filterPackages; - inherit (nixpkgs.lib) mapAttrs' nameValuePair filterAttrs; - in - { - overlays = { - lib = _: prev: import ./lib prev; - pkgs = final: prev: import ./pkgs final prev; - default = nixpkgs.lib.composeManyExtensions [ - agenix.overlays.default - nixdeploy.overlays.default - self.overlays.pkgs - shellrc.overlays.default - shvcli.overlays.default - usbkey.overlays.default - ]; - }; + inherit (nixpkgs.lib) genAttrs; + inherit (nixosdeploy.lib) nixosFilterHostBuilds; + forSystems = genAttrs (import systems); + withPkgs = func: forSystems (system: func self.legacyPackages.${system}); + in { + overlays = { + lib = import ./lib; + pkgs = import ./pkgs; + default = nixpkgs.lib.composeManyExtensions [ + agenix.overlays.default + nixosdeploy.overlays.default + self.overlays.pkgs + shellrc.overlays.default + pyshv.overlays.default + shvcli.overlays.packages + shvcli-ell.overlays.packages + usbkey.overlays.default + ]; + }; - nixosModules = import ./nixos/modules { - inherit (nixpkgs) lib; - default_modules = [ - nixdeploy.nixosModules.default - nixturris.nixosModules.default - personal-secret.nixosModules.default - shellrc.nixosModules.default - usbkey.nixosModules.default - ]; - }; + nixosModules = import ./nixos/modules { + inherit (nixpkgs) lib; + default_modules = [ + nixosdeploy.nixosModules.default + nixturris.nixosModules.default + personal-secret.nixosModules.default + shellrc.nixosModules.default + usbkey.nixosModules.default + ]; + }; - nixosConfigurations = import ./nixos/configurations self; - lib = import ./lib nixpkgs.lib; - } - // eachDefaultSystem (system: let - pkgs = nixpkgs.legacyPackages."${system}".extend self.overlays.default; - in { - packages = - {default = pkgs.nixdeploy;} - // mapAttrs' (n: v: let - os = - if v.config.nixpkgs.hostPlatform.system == system - then v - else (v.extendModules {modules = [{nixpkgs.buildPlatform.system = system;}];}); - in - nameValuePair "tarball-${n}" os.config.system.build.tarball) - (filterAttrs (_: v: v.config.system.build ? tarball) self.nixosConfigurations); - legacyPackages = pkgs; - devShells = filterPackages system (import ./devShells pkgs); - formatter = pkgs.alejandra; - }); + nixosConfigurations = import ./nixos/configurations self; + + legacyPackages = + forSystems (system: + nixpkgs.legacyPackages.${system}.extend self.overlays.default); + + packages = forSystems ( + system: + {inherit (nixosdeploy.packages.${system}) default;} + // (nixosFilterHostBuilds self.nixosConfigurations [ + "toplevel" + "tarball" + "firmware" + ] + system) + ); + + devShells = withPkgs (import ./devShells); + + formatter = withPkgs (pkgs: pkgs.alejandra); + }; } diff --git a/lib/default.nix b/lib/default.nix index 3f14de0..d6024bc 100644 --- a/lib/default.nix +++ b/lib/default.nix @@ -1,30 +1,26 @@ -nixpkgslib: let - lib = nixpkgslib // nlib; +final: _: let + inherit (final) pow foldl genList id reverseList bitAnd pow2 length add zipListsWith; +in { + # Generic power of number + pow = base: e: + if e == 0 + then 1 + else foldl (x: _: x * base) 1 (genList id (e - 1)); + # Power of 2 + pow2 = pow 2; - nlib = with builtins; - with lib; { - # Generic power of number - pow = base: e: - if e == 0 - then 1 - else foldl (x: _: x * base) 1 (genList id (e - 1)); - # Power of 2 - pow2 = pow 2; + # Convert integer to list of bits + int2bits = len: e: reverseList (genList (x: bitAnd e (pow2 (x + 1)) > 0) len); + # Reverse operation for int2bits + bits2int = l: let + len = length l; + zf = a: b: + if a + then pow2 b + else 0; + in + foldl add 0 (zipListsWith zf l (genList (i: len - i) len)); - # Convert integer to list of bits - int2bits = len: e: reverseList (genList (x: bitAnd e (pow2 (x + 1)) > 0) len); - # Reverse operation for int2bits - bits2int = l: let - len = length l; - zf = a: b: - if a - then pow2 b - else 0; - in - foldl add 0 (zipListsWith zf l (genList (i: len - i) len)); - - # IPv4 utilities - ipv4 = import ./ipv4.nix lib; - }; -in - nlib + # IPv4 utilities + ipv4 = import ./ipv4.nix final; +} diff --git a/lib/ipv4.nix b/lib/ipv4.nix index c843cb6..537525f 100644 --- a/lib/ipv4.nix +++ b/lib/ipv4.nix @@ -1,6 +1,7 @@ -lib: -with builtins; -with lib; rec { +lib: let + inherit (lib) int2bits toInt splitString flatten bits2int sublist genList zipListsWith; + inherit (lib.ipv4) ip2bits bits2ip netmaskBits int2ip ip2int prefix2ip; +in { # Converts string representation of IPv4 address to 32 bits ip2bits = ip: let perBits = map (x: int2bits 8 (toInt x)) (splitString "." ip); diff --git a/nixos/configurations/adm-mpd.nix b/nixos/configurations/adm-mpd.nix deleted file mode 100644 index ac3b4de..0000000 --- a/nixos/configurations/adm-mpd.nix +++ /dev/null @@ -1,56 +0,0 @@ -{ - config, - lib, - ... -}: let - inherit (lib) filterAttrs; -in { - nixpkgs.hostPlatform.system = "aarch64-linux"; - - fileSystems = { - "/" = { - device = "/dev/mmcblk0p2"; - options = ["compress=lzo" "subvol=@nix"]; - }; - "/home" = { - device = "/dev/mmcblk0p2"; - options = ["compress=lzo" "subvol=@home"]; - }; - "/boot" = { - device = "/dev/mmcblk0p1"; - }; - }; - - networking.wireless = { - enable = true; - networks = filterAttrs (n: _: n == "Nela") config.secrets.wifiNetworks; - environmentFile = "/run/secrets/wifi.env"; - userControlled.enable = true; - }; - - #services.pipewire = { - #enable = true; - #alsa.enable = true; - #pulse.enable = true; - #}; - hardware.pulseaudio = { - enable = true; - systemWide = true; - zeroconf.publish.enable = true; - }; - - services.spotifyd = { - enable = true; - settings.global = { - device_name = "Adámkovi"; - device = "sysdefault"; - mixer = "Master"; - bitrate = 320; - cache_path = "/var/cahe/spotify"; - no_audio_cache = true; - volume_normalisation = true; - normalisation_pregain = -10; - initial_volume = 60; - }; - }; -} diff --git a/nixos/configurations/adm-omnia.nix b/nixos/configurations/adm-omnia.nix index 069dfb0..6df1098 100644 --- a/nixos/configurations/adm-omnia.nix +++ b/nixos/configurations/adm-omnia.nix @@ -1,10 +1,13 @@ {config, ...}: let hosts = config.cynerd.hosts.adm; in { + system.stateVersion = "24.05"; + turris.board = "omnia"; deploy = { - enable = false; - ssh.host = "omnia.adm"; + enable = true; + ssh.host = "adm.cynerd.cz"; + configurationLimit = 16; }; cynerd = { @@ -13,51 +16,55 @@ in { wan = "pppoe-wan"; lanIP = hosts.omnia; staticLeases = { - "70:85:c2:4a:59:f2" = hosts.ridcully; - "7c:b0:c2:bb:9c:ca" = hosts.albert; "4c:d5:77:0d:85:d9" = hosts.binky; - "b8:27:eb:49:54:5a" = hosts.mpd; - }; - guestStaticLeases = { "f4:a9:97:a4:bd:59" = hosts.printer; }; }; wifiAP.adm = { - enable = false; + enable = true; ar9287 = { - interface = "wlp1s0"; - bssids = ["04:f0:21:23:3d:ce" "08:f0:21:23:3d:ce" "0c:f0:21:23:3d:ce"]; - channel = 11; + interface = "wlp2s0"; + bssids = config.secrets.wifiMacs.adm-omnia.ar9287; + channel = 7; }; qca988x = { - interface = "wlp3s0"; - bssids = ["04:f0:21:24:0b:4e" "08:f0:21:24:0b:4e" "0c:f0:21:24:0b:4e"]; - channel = 36; + interface = "wlp1s0"; + bssids = config.secrets.wifiMacs.adm-omnia.qca988x; + channel = 44; }; }; wireguard = true; monitoring.speedtest = true; }; - services.journald.extraConfig = '' - SystemMaxUse=8G - ''; + services = { + journald.settings.Journal = { + SystemMaxUse = "8G"; + }; - services.btrfs.autoScrub = { - enable = true; - fileSystems = ["/"]; - }; + btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; + }; - networking = { - useNetworkd = true; - useDHCP = false; + fail2ban = { + enable = true; + ignoreIP = ["10.8.0.0/24" "10.8.1.0/24"]; + }; }; + + # Warning: This Omnia has broker WAN port thus LAN4 is used for WAN!!!!!!!! + networking.useDHCP = false; systemd.network = { networks = { + "lan4" = { + matchConfig.Name = "lan4"; # Ensure that it is managed by systemd-networkd + networkConfig.IPv6AcceptRA = false; + }; "pppoe-wan" = { matchConfig.Name = "pppoe-wan"; networkConfig = { - BindCarrier = "end2"; + BindCarrier = "lan4"; DHCP = "ipv6"; IPv6AcceptRA = "no"; DHCPPrefixDelegation = "yes"; @@ -75,7 +82,7 @@ in { linkConfig.RequiredForOnline = "routable"; }; "lan-brlan" = { - matchConfig.Name = "lan[1-4]"; + matchConfig.Name = "lan0 lan1 lan2 lan3"; networkConfig.Bridge = "brlan"; bridgeVLANs = [ { @@ -85,23 +92,13 @@ in { {VLAN = 2;} ]; }; - "lan-guest" = { - matchConfig.Name = "lan0"; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 2; - PVID = 2; - } - ]; - }; }; }; services.pppd = { enable = true; peers."wan".config = '' - plugin pppoe.so end2 + plugin pppoe.so lan4 ifname pppoe-wan lcp-echo-interval 1 lcp-echo-failure 5 @@ -114,10 +111,21 @@ in { password 02 ''; }; - systemd.services."pppd-wan".after = ["sys-subsystem-net-devices-end2.device"]; + systemd.services = { + "pppd-wan" = { + after = ["sys-subsystem-net-devices-lan4.device"]; + partOf = ["systemd-networkd.service"]; + serviceConfig = { + Restart = "always"; + StartLimitBurst = 0; + }; + }; + "systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug"; + }; # TODO limit NSS clamping to just pppoe-wan networking.firewall.extraForwardRules = '' tcp flags syn tcp option maxseg size set rt mtu comment "Needed for PPPoE to fix IPv4" - iifname {"home", "personalvpn", "wg"} oifname {"home", "personalvpn", "wg"} accept + iifname "wg" oifname "home" accept + iifname "home" oifname "guest" accept comment "Allow home to access guest devices" ''; } diff --git a/nixos/configurations/adm-omnia2.nix b/nixos/configurations/adm-omnia2.nix index 45b8dc4..317ee62 100644 --- a/nixos/configurations/adm-omnia2.nix +++ b/nixos/configurations/adm-omnia2.nix @@ -1,8 +1,11 @@ {config, ...}: { + system.stateVersion = "24.05"; + turris.board = "omnia"; deploy = { enable = true; ssh.host = "omnia2.adm"; + configurationLimit = 16; }; cynerd = { @@ -15,24 +18,26 @@ enable = true; ar9287 = { interface = "wlp2s0"; - bssids = ["12:f0:21:23:2b:00" "12:f0:21:23:2b:01" "12:f0:21:23:2b:02"]; + bssids = config.secrets.wifiMacs.adm-omnia2.ar9287; channel = 11; }; qca988x = { interface = "wlp1s0"; - bssids = ["12:f0:21:23:2b:03" "12:f0:21:23:2b:04" "12:f0:21:23:2b:05"]; + bssids = config.secrets.wifiMacs.adm-omnia2.qca988x; channel = 36; }; }; }; - services.journald.extraConfig = '' - SystemMaxUse=8G - ''; + services = { + journald.settings.Journal = { + SystemMaxUse = "8G"; + }; - services.btrfs.autoScrub = { - enable = true; - fileSystems = ["/"]; + btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; + }; }; networking = { diff --git a/nixos/configurations/albert.nix b/nixos/configurations/albert.nix deleted file mode 100644 index a6a4ee1..0000000 --- a/nixos/configurations/albert.nix +++ /dev/null @@ -1,41 +0,0 @@ -{ - nixpkgs.hostPlatform.system = "x86_64-linux"; - - cynerd = { - desktop = { - enable = true; - laptop = true; - }; - wifiClient = true; - openvpn = { - oldpersonal = true; - }; - }; - - boot.initrd.availableKernelModules = ["xhci_pci" "usb_storage" "sd_mod"]; - - hardware.cpu.intel.updateMicrocode = true; - - fileSystems = { - "/" = { - device = "/dev/disk/by-uuid/1c9bafac-fcf8-41c4-b394-bca5917ca82d"; - fsType = "btrfs"; - options = ["compress=lzo" "subvol=@nix"]; - }; - "/home" = { - device = "/dev/disk/by-uuid/1c9bafac-fcf8-41c4-b394-bca5917ca82d"; - fsType = "btrfs"; - options = ["compress=lzo" "subvol=@home"]; - }; - "/boot" = { - device = "/dev/disk/by-uuid/E403-124B"; - fsType = "vfat"; - }; - - "/home2" = { - device = "/dev/disk/by-uuid/55e177a1-215e-475b-ba9c-771b5fa3f8f0"; - fsType = "btrfs"; - options = ["compress=lzo" "subvol=@home"]; - }; - }; -} diff --git a/nixos/configurations/binky.nix b/nixos/configurations/binky.nix index 7765d01..f4f82fb 100644 --- a/nixos/configurations/binky.nix +++ b/nixos/configurations/binky.nix @@ -1,15 +1,10 @@ -{ - lib, - pkgs, - ... -}: let - inherit (lib) mkDefault; -in { +{lib, ...}: { + system.stateVersion = "24.05"; nixpkgs.hostPlatform.system = "x86_64-linux"; deploy = { enable = true; default = false; - ssh.host = "binky.spt"; + ssh.host = "binky"; }; cynerd = { @@ -19,6 +14,7 @@ in { }; wifiClient = true; develop = true; + gaming = true; wireguard = true; openvpn.elektroline = true; }; @@ -88,16 +84,8 @@ in { services.syncthing = { enable = true; - user = mkDefault "cynerd"; - group = mkDefault "cynerd"; - openDefaultPorts = true; - - overrideDevices = false; - overrideFolders = false; - dataDir = "/home/cynerd"; - configDir = "/home/cynerd/.config/syncthing"; }; - environment.systemPackages = [pkgs.heroic]; + programs.steam.enable = lib.mkForce false; } diff --git a/nixos/configurations/dean.nix b/nixos/configurations/dean.nix index 187e148..a1ec788 100644 --- a/nixos/configurations/dean.nix +++ b/nixos/configurations/dean.nix @@ -1,8 +1,17 @@ -{pkgs, ...}: { +{ + lib, + pkgs, + ... +}: { + system.stateVersion = "24.05"; turris.board = "mox"; - deploy.enable = true; + deploy = { + enable = true; + configurationLimit = 8; + }; cynerd = { + devmin = true; wireguard = true; monitoring = { speedtest = true; @@ -10,6 +19,20 @@ }; }; + boot.initrd.availableKernelModules = ["dm-mod"]; + + hardware.enableAllFirmware = false; # No wifi so we do not need firmwares + services = { + journald.settings.Journal = { + SystemMaxUse = "512M"; + }; + + btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; + }; + }; + networking = { useNetworkd = true; useDHCP = false; @@ -39,5 +62,29 @@ environment.systemPackages = with pkgs; [ #openocd tio + gnupg + ]; + + programs = { + fuse = { + enable = true; + userAllowOther = true; + }; + nix-ld.enable = true; + }; + boot.binfmt = { + emulatedSystems = ["x86_64-linux"]; + }; + environment.sessionVariables = { + NIX_LD_x86_64_linux = "${pkgs.buildPackages.glibc}/lib/ld-linux-x86-64.so.2"; + NIX_LD_LIBRARY_PATH_x86_64_linux = lib.makeLibraryPath (with pkgs.buildPackages; [ + stdenv.cc.cc + glibc + zlib + ]); + }; + systemd.tmpfiles.rules = [ + "d /lib64 0755 root root -" + "L+ /lib64/ld-linux-x86-64.so.2 - - - - ${pkgs.buildPackages.nix-ld}/libexec/nix-ld" ]; } diff --git a/nixos/configurations/dribbler.nix b/nixos/configurations/dribbler.nix new file mode 100644 index 0000000..038f455 --- /dev/null +++ b/nixos/configurations/dribbler.nix @@ -0,0 +1,112 @@ +{pkgs, ...}: { + system.stateVersion = "25.11"; + nixpkgs.hostPlatform.system = "x86_64-linux"; + deploy = { + enable = true; + default = false; + ssh.host = "dribbler"; + }; + + cynerd = { + wifiClient = true; + }; + + boot = { + initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage" "sd_mod"]; + kernelModules = ["kvm-intel"]; + kernelParams = ["video=eDP-1:d"]; # Disable internal display for kodi to use HDMI + }; + + hardware.cpu.intel.updateMicrocode = true; + + cynerd.autounlock = { + "encroot" = "/dev/disk/by-uuid/f791f524-0552-487b-9bf9-5c20ca78651b"; + }; + fileSystems = { + "/" = { + device = "/dev/mapper/encroot"; + fsType = "btrfs"; + options = ["compress=lzo"]; + }; + "/boot" = { + device = "/dev/disk/by-uuid/7143-1EE7"; + fsType = "vfat"; + }; + }; + services.btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; + }; + + networking = { + useNetworkd = true; + useDHCP = false; + }; + systemd.network = { + networks = { + "dhcp" = { + matchConfig.Name = "enp1s0"; + networkConfig = { + DHCP = "yes"; + IPv6AcceptRA = "yes"; + }; + linkConfig.RequiredForOnline = "routable"; + }; + "dhcp-wlan" = { + matchConfig.Name = "wlp2s0"; + networkConfig = { + DHCP = "yes"; + IPv6AcceptRA = "yes"; + }; + routes = [{Metric = 1088;}]; + linkConfig.RequiredForOnline = "routable"; + }; + }; + wait-online.enable = false; + }; + + # Kodi + environment.systemPackages = with pkgs; [ + kodi-gbm + ]; + hardware = { + graphics = { + enable = true; + enable32Bit = true; + extraPackages = with pkgs; [ + intel-media-driver + libvdpau-va-gl + ]; + }; + bluetooth.enable = true; + }; + services.pipewire = { + enable = true; + alsa.enable = true; + alsa.support32Bit = true; + pulse.enable = true; + }; + security.rtkit.enable = true; + #nixpkgs.config.kodi.enableAdvancedLauncher = true; + users.extraUsers.kodi = { + isNormalUser = true; + extraGroups = ["audio" "video" "input"]; + }; + systemd.services.kodi = { + description = "Kodi standalone (GBM)"; + wantedBy = ["multi-user.target"]; + conflicts = ["getty@tty1.service"]; + serviceConfig = { + User = "kodi"; + TTYPath = "/dev/tty1"; + ExecStart = "${pkgs.kodi-gbm}/bin/kodi-standalone"; + Restart = "on-abort"; + StandardInput = "tty"; + StandardOutput = "journal"; + }; + }; + networking.firewall = { + allowedTCPPorts = [8080]; + allowedUDPPorts = [8080]; + }; +} diff --git a/nixos/configurations/errol.nix b/nixos/configurations/errol.nix index fd348e8..e45fae5 100644 --- a/nixos/configurations/errol.nix +++ b/nixos/configurations/errol.nix @@ -1,31 +1,24 @@ -{ - config, - lib, - pkgs, - ... -}: let - inherit (lib) mkDefault; -in { +{pkgs, ...}: { + system.stateVersion = "24.05"; nixpkgs.hostPlatform.system = "x86_64-linux"; deploy.enable = true; - cynerd = { - desktop.enable = true; - develop = true; - gaming = true; - openvpn.elektroline = true; - }; - boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage"]; boot.kernelModules = ["kvm-amd"]; hardware.cpu.amd.updateMicrocode = true; services.hardware.openrgb.motherboard = "amd"; + zramSwap = { + enable = true; + memoryPercent = 50; + }; + cynerd.autounlock = { "encroot" = "/dev/disk/by-uuid/7c412ae6-6016-45af-8c2a-8fcc394dbbe6"; "enchdd1" = "/dev/disk/by-uuid/87f16080-5ff6-43dd-89f3-307455a46fbe"; "enchdd2" = "/dev/disk/by-uuid/be4a33fa-8bc6-431d-a3ac-787668f223ed"; + #"encback" = "/dev/disk/by-uuid/1bd8c637-f71e-4fb0-96de-b660c4f1afaf"; }; fileSystems = { "/" = { @@ -53,6 +46,11 @@ in { fsType = "btrfs"; options = ["compress=lzo" "subvol=@home"]; }; + #"/back" = { + # device = "/dev/mapper/encback"; + # fsType = "btrfs"; + # options = ["compress=lzo"]; + #}; }; services.btrfs.autoScrub = { enable = true; @@ -83,75 +81,11 @@ in { pkgs.nvtopPackages.amd ]; - services.syncthing = { - enable = true; - user = mkDefault "cynerd"; - group = mkDefault "cynerd"; - openDefaultPorts = true; - - overrideDevices = false; - overrideFolders = false; - - dataDir = "/home/cynerd"; - configDir = "/home/cynerd/.config/syncthing"; - }; - - nixpkgs.config.permittedInsecurePackages = ["openssl-1.1.1w"]; # TODO - services.home-assistant = { - enable = true; - openFirewall = true; - configDir = "/var/lib/hass"; - config = { - homeassistant = { - name = "SPT"; - latitude = "!secret latitude"; - longitude = "!secret longitude"; - elevation = "!secret elevation"; - time_zone = "Europe/Prague"; - country = "CZ"; - }; - http.server_port = 8808; - mqtt = { - sensor = import ../modules/home-assistant/sensors.nix; - light = import ../modules/home-assistant/light.nix; - }; - default_config = {}; - automation = "!include automations.yaml"; - }; - extraComponents = ["met"]; - package = pkgs.home-assistant.override { - extraPackages = pkgs: - with pkgs; [ - securetar - pyipp - ]; - }; - }; - - services.zigbee2mqtt = { - enable = true; - settings = { - serial.port = "/dev/serial/by-id/usb-ITEAD_SONOFF_Zigbee_3.0_USB_Dongle_Plus_V2_20220812153849-if00"; - mqtt = { - server = "mqtt://${config.cynerd.hosts.spt.mox}:1883"; - user = "zigbee2mqtt"; - password = "!secret.yaml mqtt_password"; - }; - advanced = { - network_key = "!secret.yaml network_key"; - homeassistant_legacy_entity_attributes = false; - legacy_api = false; - legacy_availability_payload = false; - last_seen = "epoch"; - }; - frontend = true; - availability = true; - homeassistant = { - legacy_triggers = false; - }; - device_options.legacy = false; - permit_join = false; - devices = config.secrets.zigbee2mqttDevices; + ############################################################################## + services = { + syncthing = { + enable = true; + dataDir = "/home/cynerd"; }; }; } diff --git a/nixos/configurations/gaspode.nix b/nixos/configurations/gaspode.nix deleted file mode 100644 index 78d8277..0000000 --- a/nixos/configurations/gaspode.nix +++ /dev/null @@ -1,17 +0,0 @@ -{ - nixpkgs.hostPlatform.system = "armv7l-linux"; - - fileSystems = { - "/" = { - device = "/dev/mmcblk0p2"; - options = ["compress=lzo" "subvol=@nix"]; - }; - "/home" = { - device = "/dev/mmcblk0p2"; - options = ["compress=lzo" "subvol=@home"]; - }; - "/boot" = { - device = "/dev/mmcblk0p1"; - }; - }; -} diff --git a/nixos/configurations/lipwig.nix b/nixos/configurations/lipwig.nix index 1a137db..e0992f2 100644 --- a/nixos/configurations/lipwig.nix +++ b/nixos/configurations/lipwig.nix @@ -2,11 +2,13 @@ config, pkgs, inputModules, + lib, ... }: { imports = [inputModules.vpsadminos]; config = { + system.stateVersion = "24.05"; nixpkgs.hostPlatform.system = "x86_64-linux"; deploy = { @@ -19,12 +21,15 @@ hw = false; drives = false; }; - syncthing = { - enable = false; - baseDir = "/nas"; - }; wireguard = true; - openvpn.oldpersonal = true; + borgjobs = { + # TODO backup influx + postgresql.dumpCommand = pkgs.writeScript "postgreqsl-backup.sh" '' + /run/wrappers/bin/sudo -u postgres /run/current-system/sw/bin/pg_dumpall + ''; + nextcloud_data.paths = "/nas/nextcloud/data"; + sync_data.paths = "/sync"; + }; }; boot.loader.systemd-boot.enable = false; @@ -39,24 +44,10 @@ ]; }; "/nas/nextcloud-sync" = { - device = "/nas/sync"; + device = "/sync"; fsType = "fuse.bindfs"; options = ["map=syncthing/nextcloud:@syncthing/@nextcloud"]; }; - "/nas/spt" = { - device = "nas@omnia.spt:/data/nas"; - fsType = "fuse.sshfs"; - options = [ - "allow_other" - "_netdev" - "x-systemd.automount" - "reconnect" - "identityfile=/run/secrets/nas.ssh.priv" - "idmap=user" - "uid=nextcloud" - "gid=nextcloud" - ]; - }; }; networking = { @@ -84,68 +75,71 @@ ]; # Web ###################################################################### - services.nginx = { - enable = true; - virtualHosts = { - "cynerd.cz" = { - forceSSL = true; - enableACME = true; - locations = { - "/".root = ../../web; - "/radicale/" = { - proxyPass = "http://127.0.0.1:5232/"; - extraConfig = '' - proxy_set_header X-Script-Name /radicale; - proxy_pass_header Authorization; - ''; + services = { + nginx = { + enable = true; + virtualHosts = { + "cynerd.cz" = { + forceSSL = true; + enableACME = true; + locations = { + "/".root = ../../web; + "/radicale/" = { + proxyPass = "http://127.0.0.1:5232/"; + extraConfig = '' + proxy_set_header X-Script-Name /radicale; + proxy_pass_header Authorization; + ''; + }; }; }; - }; - "git.cynerd.cz" = { - forceSSL = true; - useACMEHost = "cynerd.cz"; - root = "${pkgs.cgit}/cgit"; - locations."/".tryFiles = "$uri @cgit"; - locations."@cgit".extraConfig = '' - fastcgi_pass unix:${config.services.fcgiwrap.instances.cgit.socket.address}; - fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi; - fastcgi_param PATH_INFO $uri; - fastcgi_param QUERY_STRING $args; - fastcgi_param HTTP_HOST $server_name; - ''; - }; - "cloud.cynerd.cz" = { - forceSSL = true; - useACMEHost = "cynerd.cz"; - }; - "grafana.cynerd.cz" = { - forceSSL = true; - useACMEHost = "cynerd.cz"; - locations."/" = { - proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}/"; - extraConfig = "proxy_set_header Host $host;"; - proxyWebsockets = true; + "git.cynerd.cz" = { + forceSSL = true; + useACMEHost = "cynerd.cz"; + root = "${pkgs.cgit}/cgit"; + locations."/".tryFiles = "$uri @cgit"; + locations."@cgit".extraConfig = '' + fastcgi_pass unix:${config.services.fcgiwrap.instances.cgit.socket.address}; + fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi; + fastcgi_param PATH_INFO $uri; + fastcgi_param QUERY_STRING $args; + fastcgi_param HTTP_HOST $server_name; + ''; + }; + "cloud.cynerd.cz" = { + forceSSL = true; + useACMEHost = "cynerd.cz"; + }; + "grafana.cynerd.cz" = { + forceSSL = true; + useACMEHost = "cynerd.cz"; + locations."/" = { + proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}"; + proxyWebsockets = true; + recommendedProxySettings = true; + }; + }; + "searx.cynerd.cz" = { + forceSSL = true; + useACMEHost = "cynerd.cz"; + locations."/".extraConfig = '' + uwsgi_pass "unix://${config.services.searx.uwsgiConfig.socket}"; + include ${config.services.nginx.package}/conf/uwsgi_params; + ''; }; - }; - "searx.cynerd.cz" = { - forceSSL = true; - useACMEHost = "cynerd.cz"; - locations."/".extraConfig = '' - uwsgi_pass "unix:///run/searx/searx.sock"; - include ${config.services.nginx.package}/conf/uwsgi_params; - ''; }; }; - }; - services.fcgiwrap.instances.cgit = { - process.user = "git"; - socket = {inherit (config.services.nginx) user group;}; + fcgiwrap.instances.cgit = { + process.user = "git"; + socket = {inherit (config.services.nginx) user group;}; + }; }; security.acme = { acceptTerms = true; defaults.email = "cynerd+acme@email.cz"; certs."cynerd.cz".extraDomainNames = [ "cloud.cynerd.cz" + "office.cynerd.cz" "git.cynerd.cz" "grafana.cynerd.cz" "searx.cynerd.cz" @@ -205,7 +199,7 @@ # Nextcloud ################################################################ services.nextcloud = { enable = true; - package = pkgs.nextcloud28; + package = pkgs.nextcloud34; https = true; hostName = "cloud.cynerd.cz"; datadir = "/nas/nextcloud"; @@ -214,11 +208,25 @@ adminpassFile = "/run/secrets/nextcloud.admin.pass"; dbtype = "pgsql"; dbhost = "/run/postgresql"; - dbtableprefix = "oc_"; }; settings = { #log_type = "systemd"; + default_locale = "CZ"; default_phone_region = "CZ"; + default_timezone = "Europe/Prague"; + enabledPreviewProviders = [ + "OC\\Preview\\BMP" + "OC\\Preview\\GIF" + "OC\\Preview\\JPEG" + "OC\\Preview\\Krita" + "OC\\Preview\\MarkDown" + "OC\\Preview\\MP3" + "OC\\Preview\\OpenDocument" + "OC\\Preview\\PNG" + "OC\\Preview\\TXT" + "OC\\Preview\\XBitmap" + "OC\\Preview\\HEIC" + ]; }; phpExtraExtensions = php: [php.pgsql php.pdo_pgsql]; phpOptions = { @@ -226,59 +234,60 @@ }; maxUploadSize = "1G"; appstoreEnable = false; - extraApps = { - inherit - (config.services.nextcloud.package.packages.apps) - bookmarks - calendar - contacts - cookbook - deck - forms - groupfolders - impersonate - maps - memories - notes - phonetrack - previewgenerator - spreed - tasks - twofactor_nextcloud_notification - twofactor_webauthn - ; - # Additional modules can be fetched with: - # NEXTCLOUD_VERSIONS=28 nix run nixpkgs#nc4nix -- -apps "passwords,integration_homeassistant,integration_github,integration_gitlab" - passwords = pkgs.fetchNextcloudApp { - url = "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2024.7.0/passwords.tar.gz"; - sha256 = "1RwLOE2aUwISMF/WcYmL8sKs+KXBlYv0OHw8PizrGCY="; - license = "agpl3Plus"; - }; - integration_github = pkgs.fetchNextcloudApp { - url = "https://github.com/nextcloud-releases/integration_github/releases/download/v2.0.7/integration_github-v2.0.7.tar.gz"; - sha256 = "x4BrBdrvmbdwZcZL6FLAY27B5OpkXIsw92XsD076Aqg="; - license = "agpl3Plus"; - }; - integration_gitlab = pkgs.fetchNextcloudApp { - url = "https://github.com/nextcloud-releases/integration_gitlab/releases/download/v3.0.1/integration_gitlab-v3.0.1.tar.gz"; - sha256 = "FAF5CHwAVm55QS9NO8B5zsvJ0BWa7Mwfw6kYr2js0Es="; - license = "agpl3Plus"; - }; - }; + extraApps = + { + inherit + (config.services.nextcloud.package.packages.apps) + bookmarks + calendar + contacts + cookbook + deck + forms + groupfolders + impersonate + #maps + memories + notes + phonetrack + previewgenerator + spreed + tasks + twofactor_webauthn + ; + } + // (lib.mapAttrs (n: v: + pkgs.fetchNextcloudApp { + inherit (v) url hash; + license = "agpl3Plus"; + }) + # Additional modules can be fetched with: + # NEXTCLOUD_VERSIONS=33 nix run .#nc4nix -- -apps "passwords,money,integration_github,integration_gitlab,fileslibreofficeedit" + (lib.importJSON ../nextcloud-extra-apps.json)); }; # Postgresql ############################################################### services.postgresql = { enable = true; + enableTCPIP = true; ensureUsers = [ - {name = "cynerd";} + { + name = "cynerd"; + ensureClauses = { + login = true; + createdb = true; + createrole = true; + bypassrls = true; + replication = true; + }; + } { name = "nextcloud"; ensureDBOwnership = true; } ]; - ensureDatabases = ["nextcloud"]; - extraPlugins = ps: with ps; [timescaledb]; + ensureDatabases = ["nextcloud" "monitoring"]; + #extensions = ps: [ps.timescaledb]; }; # SearX #################################################################### @@ -348,7 +357,7 @@ } ]; }; - runInUwsgi = true; + configureUwsgi = true; uwsgiConfig = { socket = "/run/searx/searx.sock"; chmod-socket = "660"; @@ -357,16 +366,12 @@ }; users.groups.searx.members = ["nginx"]; - # Old Syncthing ############################################################ + # Syncthing ################################################################ services.syncthing = { enable = true; - openDefaultPorts = true; - - overrideDevices = false; - overrideFolders = false; - - dataDir = "/nas/sync"; - configDir = "/nas/sync/.syncthing"; + user = "syncthing"; + group = "syncthing"; + dataDir = "/sync"; }; }; } diff --git a/nixos/configurations/ridcully.nix b/nixos/configurations/ridcully.nix index 2be1a7a..e454b2c 100644 --- a/nixos/configurations/ridcully.nix +++ b/nixos/configurations/ridcully.nix @@ -1,10 +1,5 @@ -{ - lib, - pkgs, - ... -}: let - inherit (lib) mkDefault; -in { +{pkgs, ...}: { + system.stateVersion = "24.05"; nixpkgs.hostPlatform.system = "x86_64-linux"; deploy.enable = true; @@ -15,17 +10,26 @@ in { openvpn = { elektroline = true; }; + borgjobs = { + hetzner-s3.paths = "/back/hetzner-s3-sync"; + }; }; - boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage"]; + boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"]; boot.kernelModules = ["kvm-amd"]; hardware.cpu.amd.updateMicrocode = true; services.hardware.openrgb.motherboard = "amd"; + zramSwap = { + enable = true; + memoryPercent = 50; + }; + cynerd.autounlock = { "encroot" = "/dev/disk/by-uuid/bc7d2ba4-6e04-4c49-b40c-3aecd1a86c71"; "enchdd" = "/dev/disk/by-uuid/7fee3cda-efa0-47cd-8832-fdead9a7e6db"; + "encback" = "/dev/disk/by-uuid/b426cbe7-fba2-473b-90f9-9ebe3e34b76e"; }; fileSystems = { "/" = { @@ -48,6 +52,11 @@ in { fsType = "btrfs"; options = ["compress=lzo" "subvol=@home"]; }; + "/back" = { + device = "/dev/mapper/encback"; + fsType = "btrfs"; + options = ["compress=lzo"]; + }; }; services.btrfs.autoScrub = { enable = true; @@ -61,28 +70,54 @@ in { systemd.network = { wait-online.enable = false; }; - #networking.vlans."enp6s0.adm" = { - #id = 2; - #interface = "enp6s0"; - #}; environment.systemPackages = [ pkgs.nvtopPackages.amd + #sbctl ]; - services.syncthing = { - enable = true; - user = mkDefault "cynerd"; - group = mkDefault "cynerd"; - openDefaultPorts = true; + # Force nix to use less jobs + nix.settings.max-jobs = 4; + + ############################################################################## + services = { + syncthing = { + enable = true; + dataDir = "/home/cynerd"; + }; - overrideDevices = false; - overrideFolders = false; + #octoprint = { + # enable = true; + # openFirewall = true; + #}; - dataDir = "/home/cynerd"; - configDir = "/home/cynerd/.config/syncthing"; + #mjpg-streamer = { + # enable = true; + # inputPlugin = "input_uvc.so -d /dev/video2 -r 1920x1080 -f 30"; + # outputPlugin = "output_http.so -p 5001 -w @www@"; + #}; }; + networking.firewall.allowedTCPPorts = [5001]; - # Force nix to use less jobs - nix.settings.max-jobs = 8; + # Service to synchronize local copy of Hetzner S3 + systemd = { + services."hetzner-sync" = { + script = '' + /run/current-system/sw/bin/rclone --config /run/secrets/rclone-hetzner.conf \ + sync hetzner: /back/hetzner-s3-sync + ''; + serviceConfig = { + Type = "oneshot"; + User = "root"; + }; + }; + timers."hetzner-sync" = { + wantedBy = ["timers.target"]; + timerConfig.Unit = "hetzner-sync.service"; + timerConfig = { + OnCalendar = "daily"; + Persistent = false; + }; + }; + }; } diff --git a/nixos/configurations/spt-mox.nix b/nixos/configurations/spt-mox.nix index 0bc7627..d1e9208 100644 --- a/nixos/configurations/spt-mox.nix +++ b/nixos/configurations/spt-mox.nix @@ -1,12 +1,17 @@ -{config, ...}: { +{ + config, + pkgs, + ... +}: { + system.stateVersion = "24.05"; turris.board = "mox"; deploy = { enable = true; ssh.host = "mox.spt"; + configurationLimit = 8; }; cynerd = { - home-assistant = true; monitoring.drives = false; switch = { enable = true; @@ -17,19 +22,23 @@ enable = true; qca988x = { interface = "wlp1s0"; - bssids = ["04:f0:21:24:24:d2" "08:f0:21:24:24:d2"]; + bssids = config.secrets.wifiMacs.spt-mox.qca988x; channel = 7; }; }; }; - services.journald.extraConfig = '' - SystemMaxUse=512M - ''; + boot.initrd.availableKernelModules = ["dm-mod"]; - services.btrfs.autoScrub = { - enable = true; - fileSystems = ["/"]; + services = { + journald.settings.Journal = { + SystemMaxUse = "512M"; + }; + + btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; + }; }; networking = { @@ -49,4 +58,104 @@ ]; }; }; + + ############################################################################## + networking.firewall.allowedTCPPorts = [ + 1883 # Mosquitto + ]; + services = { + mosquitto = { + enable = true; + listeners = [ + { + users = { + cynerd = { + acl = ["readwrite #"]; + passwordFile = "/run/secrets/mosquitto.cynerd.pass"; + }; + telegraf = { + acl = ["read bigclown/node/#"]; + passwordFile = "/run/secrets/mosquitto.telegraf.pass"; + }; + bigclown = { + acl = ["readwrite bigclown/#"]; + passwordFile = "/run/secrets/mosquitto.bigclown.pass"; + }; + }; + } + ]; + }; + + telegraf.extraConfig = { + outputs.influxdb_v2 = [ + { + urls = ["http://cynerd.cz:8086"]; + token = "$INFLUX_TOKEN"; + organization = "personal"; + bucket = "bigclown"; + tagpass.source = ["bigclown"]; + } + ]; + inputs.mqtt_consumer = let + consumer = data_type: topics: { + tags = {source = "bigclown";}; + servers = ["tcp://localhost:1883"]; + inherit topics; + username = "telegraf"; + password = "$MQTT_PASSWORD"; + data_format = "value"; + inherit data_type; + topic_parsing = [ + { + topic = "bigclown/node/+/+/+/+"; + measurement = "_/_/_/_/_/measurement"; + tags = "_/_/device/field/_/_"; + } + ]; + }; + in [ + (consumer "float" [ + "bigclown/node/+/battery/+/voltage" + "bigclown/node/+/thermometer/+/temperature" + "bigclown/node/+/hygrometer/+/relative-humidity" + "bigclown/node/+/lux-meter/+/illuminance" + "bigclown/node/+/barometer/+/pressure" + "bigclown/node/+/pir/+/event-count" + "bigclown/node/+/push-button/+/event-count" + ]) + (consumer "boolean" [ + "bigclown/node/+/flood-detector/+/alarm" + ]) + ]; + processors.pivot = [ + { + tag_key = "field"; + value_key = "value"; + tagpass.source = ["bigclown"]; + } + ]; + }; + + bcg = { + enable = true; + device = "/dev/ttyUSB0"; + baseTopicPrefix = "bigclown/"; + environmentFiles = ["/run/secrets/bigclown.env"]; + mqtt = { + username = "bigclown"; + password = "\${MQTT_PASSWORD}"; + }; + }; + }; + + systemd.services = { + telegraf.wants = ["mosquitto.service"]; + + bigclown-leds = { + description = "Bigclown LEDs control"; + wantedBy = ["multi-user.target"]; + wants = ["mosquitto.service"]; + serviceConfig.ExecStart = "${pkgs.bigclown-leds}/bin/bigclown-leds /run/secrets/bigclown-leds.ini"; + }; + }; } diff --git a/nixos/configurations/spt-mox2.nix b/nixos/configurations/spt-mox2.nix index af0796c..1ddf23a 100644 --- a/nixos/configurations/spt-mox2.nix +++ b/nixos/configurations/spt-mox2.nix @@ -1,12 +1,10 @@ -{ - config, - pkgs, - ... -}: { +{config, ...}: { + system.stateVersion = "24.05"; turris.board = "mox"; deploy = { enable = true; ssh.host = "mox2.spt"; + configurationLimit = 8; }; cynerd = { @@ -20,19 +18,23 @@ enable = true; qca988x = { interface = "wlp1s0"; - bssids = ["04:f0:21:45:d3:47" "08:f0:21:45:d3:47"]; + bssids = config.secrets.wifiMacs.spt-mox2.qca988x; channel = 1; }; }; }; - services.journald.extraConfig = '' - SystemMaxUse=512M - ''; + boot.initrd.availableKernelModules = ["dm-mod"]; - services.btrfs.autoScrub = { - enable = true; - fileSystems = ["/"]; + services = { + journald.settings.Journal = { + SystemMaxUse = "512M"; + }; + + btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; + }; }; networking = { diff --git a/nixos/configurations/spt-mpd.nix b/nixos/configurations/spt-mpd.nix deleted file mode 100644 index b212932..0000000 --- a/nixos/configurations/spt-mpd.nix +++ /dev/null @@ -1,15 +0,0 @@ -{inputModules, ...}: { - imports = [inputModules.nixos-hardware.raspberry-pi-2]; - - config = { - nixpkgs.hostPlatform.system = "armv7l-linux"; - - fileSystems = { - "/" = { - device = "/dev/mmcblk0p1"; - fsType = "btrfs"; - options = ["compress=lzo"]; - }; - }; - }; -} diff --git a/nixos/configurations/spt-omnia.nix b/nixos/configurations/spt-omnia.nix index 29fe8c4..e2d56e8 100644 --- a/nixos/configurations/spt-omnia.nix +++ b/nixos/configurations/spt-omnia.nix @@ -1,14 +1,12 @@ -{ - config, - pkgs, - ... -}: let +{config, ...}: let hosts = config.cynerd.hosts.spt; in { + system.stateVersion = "24.05"; turris.board = "omnia"; deploy = { enable = true; - ssh.host = "omnia.spt"; + ssh.host = "spt.cynerd.cz"; + configurationLimit = 16; }; cynerd = { @@ -21,19 +19,18 @@ in { "7c:b0:c2:bb:9c:ca" = hosts.albert; "4c:d5:77:0d:85:d9" = hosts.binky; "b8:27:eb:57:a2:31" = hosts.mpd; - "74:bf:c0:42:82:19" = hosts.printer; }; }; wifiAP.spt = { enable = true; ar9287 = { interface = "wlp1s0"; - bssids = ["04:f0:21:24:21:93" "08:f0:21:24:21:93"]; + bssids = config.secrets.wifiMacs.spt-omnia.ar9287; channel = 11; }; qca988x = { - interface = "wlp3s0"; - bssids = ["04:f0:21:23:16:64" "08:f0:21:23:16:64"]; + interface = "wlp2s0"; + bssids = config.secrets.wifiMacs.spt-omnia.qca988x; channel = 36; }; }; @@ -41,75 +38,21 @@ in { monitoring.speedtest = true; }; - services.journald.extraConfig = '' - SystemMaxUse=8G - ''; - - environment = { - etc.crypttab.text = '' - nas UUID=3472bef9-cbae-48bd-873e-fd4858a0b72f /run/secrets/luks-spt-omnia-nas.key luks - nassec UUID=016e9e75-bbc8-4b24-8bb7-c800c8f6a500 /run/secrets/luks-spt-omnia-nas.key luks - ''; - systemPackages = with pkgs; [ - cryptsetup - ]; - }; - fileSystems = { - "/data" = { - device = "/dev/mapper/nas"; - fsType = "btrfs"; - options = ["compress=lzo" "subvol=@data" "nofail"]; + services = { + journald.settings.Journal = { + SystemMaxUse = "8G"; }; - "/srv" = { - device = "/dev/mapper/nas"; - fsType = "btrfs"; - options = ["compress=lzo" "subvol=@srv" "nofail"]; - depends = ["/data"]; + + btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; }; - }; - services.btrfs.autoScrub = { - enable = true; - fileSystems = ["/" "/data"]; - }; - services.udev.packages = [ - (pkgs.writeTextFile rec { - name = "queue_depth_sata.rules"; - destination = "/etc/udev/rules.d/50-${name}"; - text = '' - SUBSYSTEMS=="pci", DRIVER=="ahci", ATTR{device}!="0x0612", GOTO="turris_pci_end" - ACTION=="add|change", SUBSYSTEM=="scsi", ATTR{vendor}=="ATA", ATTR{queue_depth}="1" - LABEL="turris_pci_end" - ''; - }) - ]; - users = { - groups.nas = {}; - users = { - nas = { - group = "nas"; - openssh.authorizedKeys.keyFiles = [ - (config.personal-secrets + "/unencrypted/nas.pub") - (config.personal-secrets + "/unencrypted/nas-spt.pub") - ]; - isNormalUser = true; - home = "/data/nas"; - homeMode = "770"; - }; - cynerd.extraGroups = ["nas"]; + fail2ban = { + enable = true; + ignoreIP = ["10.8.1.0/24" "10.8.2.0/24"]; }; }; - services.openssh = { - settings.Macs = ["hmac-sha2-256"]; # Allow sha2-256 for Nexcloud access - extraConfig = '' - Match User nas - X11Forwarding no - AllowTcpForwarding no - AllowAgentForwarding no - ForceCommand internal-sftp -d /data/nas - ''; - }; - services.fail2ban.enable = true; networking.useDHCP = false; systemd.network = { @@ -177,24 +120,32 @@ in { defaultroute6 #usepeerdns maxfail 1 + #holdoff 5 + #persist user metronet password metronet ''; }; - systemd.services."pppd-wan".after = ["sys-subsystem-net-devices-end2.848.device"]; + systemd.services."pppd-wan" = { + after = ["sys-subsystem-net-devices-end2.848.device"]; + partOf = ["systemd-networkd.service"]; + serviceConfig = { + Restart = "always"; + StartLimitBurst = 0; + }; + }; # TODO limit NSS clamping to just pppoe-wan networking.firewall.extraForwardRules = '' tcp flags syn tcp option maxseg size set rt mtu comment "Needed for PPPoE to fix IPv4" - iifname {"home", "personalvpn", "wg"} oifname {"home", "personalvpn", "wg"} accept + iifname {"home", "wg"} oifname {"home", "wg"} accept ''; - services.syncthing = { - enable = false; - openDefaultPorts = true; - - overrideDevices = false; - overrideFolders = false; - - dataDir = "/data"; # TODO this can't be the location + ############################################################################## + cynerd.ha = { + enable = true; + domain = "spt.cynerd.cz"; + extraOptions = [ + "--device=/dev/serial/by-id/usb-ITEAD_SONOFF_Zigbee_3.0_USB_Dongle_Plus_V2_20220812153849-if00:/dev/ttyACM0" + ]; }; } diff --git a/nixos/configurations/zd-mox.nix b/nixos/configurations/zd-mox.nix new file mode 100644 index 0000000..225f13f --- /dev/null +++ b/nixos/configurations/zd-mox.nix @@ -0,0 +1,164 @@ +{ + config, + pkgs, + ... +}: let + hosts = config.cynerd.hosts.zd; +in { + system.stateVersion = "25.05"; + turris.board = "mox"; + deploy = { + enable = true; + ssh.host = "zd.cynerd.cz"; + configurationLimit = 8; + }; + + cynerd = { + router = { + enable = true; + wan = "pppoe-wan"; + lanIP = hosts.mox; + staticLeases = { + "4c:d5:77:0d:85:d9" = hosts.binky; + "70:85:c2:4a:59:f2" = hosts.ridcully; + "74:bf:c0:42:82:19" = hosts.printer; + "f8:dc:7a:79:00:e6" = hosts.tc; + "34:94:54:33:6b:48" = hosts.vb; + }; + }; + wireguard = true; + monitoring.speedtest = true; + }; + + boot.initrd.availableKernelModules = ["dm-mod"]; + + services = { + journald.settings.Journal = { + SystemMaxUse = "512M"; + }; + + btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; + }; + + fail2ban = { + enable = true; + ignoreIP = ["10.8.0.0/24" "10.8.1.0/24" "10.8.2.0/24"]; + }; + }; + + networking.useDHCP = false; + systemd.network = { + netdevs = { + "end0.848" = { + netdevConfig = { + Kind = "vlan"; + Name = "end0.848"; + }; + vlanConfig.Id = 848; + }; + }; + networks = { + "end0" = { + matchConfig.Name = "end0"; + networkConfig.VLAN = ["end0.848"]; + }; + "end0.848" = { + matchConfig.Name = "end0.848"; + networkConfig.BindCarrier = "end0"; + }; + "pppoe-wan" = { + matchConfig.Name = "pppoe-wan"; + networkConfig = { + BindCarrier = "end0.848"; + DHCP = "ipv6"; + IPv6AcceptRA = "no"; + DHCPPrefixDelegation = "yes"; + #DNS = ["84.19.64.3" "84.19.64.4" "1.1.1.1"]; + DNS = "1.1.1.1"; + }; + dhcpV6Config = { + PrefixDelegationHint = "::/56"; + UseDNS = "no"; + }; + dhcpPrefixDelegationConfig = { + UplinkInterface = ":self"; + SubnetId = 0; + Announce = "no"; + }; + linkConfig.RequiredForOnline = "routable"; + }; + "lan-brlan" = { + matchConfig.Name = "lan*"; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 1; + PVID = 1; + } + {VLAN = 2;} + ]; + }; + }; + }; + + services.pppd = { + enable = true; + peers."wan".config = '' + plugin pppoe.so end0.848 + ifname pppoe-wan + lcp-echo-interval 1 + lcp-echo-failure 5 + lcp-echo-adaptive + defaultroute + defaultroute6 + maxfail 1 + #holdoff 5 + #persist + # user and password added in secrets + ''; + }; + systemd.services = { + "pppd-wan" = { + requires = ["sys-subsystem-net-devices-end0.848.device"]; + partOf = ["systemd-networkd.service"]; + serviceConfig = { + Restart = "always"; + StartLimitBurst = 0; + }; + }; + "systemd-networkd".environment.SYSTEMD_LOG_LEVEL = "debug"; + }; + # TODO limit NSS clamping to just pppoe-wan + networking.firewall.extraForwardRules = '' + tcp flags syn tcp option maxseg size set rt mtu comment "Needed for PPPoE to fix IPv4" + iifname {"home", "wg"} oifname {"home", "wg"} accept + ''; + + services.nginx = { + enable = true; + virtualHosts = { + "zd.cynerd.cz" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://${hosts.one0}:8123"; + proxyWebsockets = true; + recommendedProxySettings = true; + }; + }; + }; + }; + security.acme = { + acceptTerms = true; + defaults.email = "cynerd+acme@email.cz"; + certs."zd.cynerd.cz" = {}; + }; + networking.firewall.allowedTCPPorts = [80 443]; + + environment.systemPackages = with pkgs; [ + nmap + tcpdump + ]; +} diff --git a/nixos/configurations/zd-one0.nix b/nixos/configurations/zd-one0.nix new file mode 100644 index 0000000..dc261cd --- /dev/null +++ b/nixos/configurations/zd-one0.nix @@ -0,0 +1,65 @@ +{config, ...}: { + system.stateVersion = "25.11"; + deploy = { + enable = true; + #ssh.host = "zd-one0"; + ssh.host = "one0nix"; + }; + + cynerd = { + openwrtone = true; + switch = { + enable = true; + lanAddress = "${config.cynerd.hosts.zd.one0nix}/24"; + lanGateway = config.cynerd.hosts.zd.mox; + }; + wifiAP.zd = { + enable = false; + wlan0 = { + bssids = [ + "20:05:b7:00:4c:02" + "20:05:b7:04:4c:02" + "20:05:b7:08:4c:02" + ]; + channel = 7; + }; + }; + }; + + boot.initrd.availableKernelModules = ["dm-mod"]; + boot.consoleLogLevel = 7; + + services = { + journald.settings.Journal = { + SystemMaxUse = "32G"; + }; + + btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; + }; + + fail2ban = { + enable = true; + ignoreIP = ["10.8.0.0/24" "10.8.1.0/24" "10.8.2.0/24"]; + }; + }; + + networking = { + useNetworkd = true; + useDHCP = false; + }; + systemd.network.networks = { + "lan-brlan" = { + matchConfig.Name = "end*"; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 1; + PVID = 1; + } + {VLAN = 2;} + ]; + }; + }; +} diff --git a/nixos/modules/autounlock.nix b/nixos/modules/autounlock.nix index d7d6a7c..912f55f 100644 --- a/nixos/modules/autounlock.nix +++ b/nixos/modules/autounlock.nix @@ -18,6 +18,7 @@ in { config = mkIf (cnf != {}) { environment.systemPackages = [pkgs.luks-hw-password]; boot.initrd = { + systemd.enable = false; extraFiles."/luks-hw-password".source = pkgs.luks-hw-password; luks.devices = mapAttrs (name: value: { diff --git a/nixos/modules/backup.nix b/nixos/modules/backup.nix new file mode 100644 index 0000000..3f5042b --- /dev/null +++ b/nixos/modules/backup.nix @@ -0,0 +1,63 @@ +{ + config, + lib, + ... +}: let + inherit (builtins) elem readFile readDir; + inherit (lib) mkOption types mkIf hasSuffix removeSuffix hasAttr filterAttrs mapAttrs mapAttrs' nameValuePair mergeAttrsList recursiveUpdate; + + servers = ["ridcully"]; # TODO "errol" + clients = + mapAttrs' (fname: _: + nameValuePair (removeSuffix ".pub" fname) + (readFile (config.personal-secrets + "/unencrypted/backup/${fname}"))) + (filterAttrs (n: v: v == "regular" && hasSuffix ".pub" n) + (readDir (config.personal-secrets + "/unencrypted/backup"))); + edpersonal = readFile (config.personal-secrets + "/unencrypted/edpersonal.pub"); +in { + options.cynerd = { + borgjobs = mkOption { + type = with types; attrsOf anything; + description = "Job to be backed up for this "; + }; + }; + + config = { + services.borgbackup = { + repos = mkIf (elem config.networking.hostName servers) ( + mapAttrs (name: key: { + path = "/back/${name}"; + authorizedKeys = [key edpersonal]; + allowSubRepos = true; + }) + clients + ); + + jobs = mkIf (hasAttr config.networking.hostName clients) (mergeAttrsList + (map (server: (mapAttrs' (n: v: + nameValuePair "${server}-${n}" + (recursiveUpdate + (recursiveUpdate { + encryption.mode = "none"; + prune = { + keep = { + daily = 7; + weekly = 4; + monthly = -1; + }; + prefix = n; + }; + } + v) + { + repo = "borg@${server}:./${n}"; + environment = { + BORG_RSH = "ssh -i /run/secrets/borgbackup.key"; + }; + archiveBaseName = null; + })) + config.cynerd.borgjobs)) + servers)); + }; + }; +} diff --git a/nixos/modules/compile.nix b/nixos/modules/compile.nix index 3c90345..332a095 100644 --- a/nixos/modules/compile.nix +++ b/nixos/modules/compile.nix @@ -20,7 +20,10 @@ in { cores = 0; }; - boot.binfmt.emulatedSystems = ["armv7l-linux" "aarch64-linux" "riscv32-linux"]; + boot.binfmt = { + emulatedSystems = ["armv7l-linux" "aarch64-linux" "riscv32-linux"]; + preferStaticEmulators = true; + }; environment.systemPackages = with pkgs; [ # Tools @@ -28,9 +31,6 @@ in { bash #uroot qemu - - # Python - python3Packages.pip ]; }; } diff --git a/nixos/modules/desktop.nix b/nixos/modules/desktop.nix index 4a8c7dd..a321577 100644 --- a/nixos/modules/desktop.nix +++ b/nixos/modules/desktop.nix @@ -37,6 +37,8 @@ in { wrapperFeatures.gtk = true; extraPackages = with pkgs; [ + appimage-run + dconf-editor glib gsettings-desktop-schemas @@ -47,17 +49,19 @@ in { waybar swaybackground myswaylock + brightnessctl alacritty nautilus kanshi + shikane wdisplays wayvnc wl-mirror slurp grim - wf-recorder + #wf-recorder wl-clipboard wl-color-picker swayidle @@ -67,13 +71,11 @@ in { resources isync + davmail msmtp notmuch - astroid + dodo taskwarrior3 - vdirsyncer - khal - khard gnupg pinentry-gnome3 pinentry-curses @@ -81,15 +83,22 @@ in { exts.pass-otp exts.pass-audit ])) + ranger chromium + tangram ferdium signal-desktop - libreoffice mupdf zathura pdfgrep + libreoffice-qt6-fresh + hunspell + hunspellDicts.en_US-large + hunspellDicts.en_GB-large + hunspellDicts.cs_CZ + xdg-utils xdg-launch mesa-demos @@ -97,8 +106,8 @@ in { pulsemixer mpd - mpc-cli - ncmpcpp + mpc + #ncmpcpp feh shotwell id3lib @@ -107,7 +116,6 @@ in { yt-dlp spotify - nordic nordzy-cursor-theme nordzy-icon-theme adwaita-icon-theme @@ -123,7 +131,6 @@ in { tigervnc freerdp - plasma5Packages.kdeconnect-kde gnome-firmware hdparm @@ -143,28 +150,31 @@ in { gimp inkscape blender - kdenlive + tenacity + kdePackages.kdenlive + qrrs # GStreamer - gst_all_1.gst-libav - gst_all_1.gst-plugins-bad + gst_all_1.gstreamer gst_all_1.gst-plugins-base gst_all_1.gst-plugins-good + gst_all_1.gst-plugins-bad gst_all_1.gst-plugins-ugly - gst_all_1.gst-plugins-viperfx + gst_all_1.gst-plugins-rs + gst_all_1.gst-libav # Writing typst - typst-fmt - typst-live - typst-lsp + typstyle + tinymist vale # CAD - freecad + #freecad kicad sweethome3d.application qelectrotech + super-slicer ] ++ (optionals cnf.laptop [ # Power management @@ -179,11 +189,9 @@ in { nativeMessagingHosts.packages = with pkgs; [browserpass]; }; - light.enable = mkIf cnf.laptop true; - - nix-ld = { + fuse = { enable = true; - libraries = with pkgs; [xorg.libXpm]; + userAllowOther = true; }; usbkey = { @@ -198,7 +206,16 @@ in { enable = true; enableSSHSupport = true; enableBrowserSocket = true; + pinentryPackage = pkgs.writeShellScriptBin "pinentry-auto" '' + if [ -n "$WAYLAND_DISPLAY" ] || [ -n "$DISPLAY" ]; then + exec ${pkgs.pinentry-gnome3}/bin/pinentry-gnome3 "$@" + else + exec ${pkgs.pinentry-gnome3}/bin/pinentry-curses "$@" + fi + ''; }; + + kdeconnect.enable = true; }; xdg = { @@ -237,17 +254,24 @@ in { xserver.xkb.options = "grp:alt_shift_toggle,caps:escape"; # Gnome crypto services (GnuPG) - dbus.packages = [pkgs.gcr]; + dbus.packages = [pkgs.gcr_4]; pipewire = { enable = true; alsa.enable = true; alsa.support32Bit = true; pulse.enable = true; - extraConfig.pipewire."10-zeroconf" = { - "context.modules" = [{name = "libpipewire-module-zeroconf-discover";}]; - }; + configPackages = [ + (pkgs.writeTextDir "share/pipewire/pipewire.conf.d/10-zeroconf-discover.conf" '' + context.modules = [ + { name = libpipewire-module-zeroconf-discover + args = { } + } + ] + '') + ]; }; + playerctld.enable = true; upower.enable = true; hardware.openrgb = { @@ -263,14 +287,46 @@ in { cnijfilter2 ]; }; + saned.enable = true; avahi.enable = true; + samba = { + enable = false; + openFirewall = true; + settings = { + global = { + "workgroup" = "WORKGROUP"; + "server string" = "smbnix"; + "netbios name" = "smbnix"; + "security" = "user"; + "hosts allow" = "0.0.0.0/0"; + "guest account" = "nobody"; + "map to guest" = "bad user"; + }; + public = { + "path" = "/mnt/public"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "yes"; + "create mask" = "0644"; + "directory mask" = "0755"; + "force user" = "cynerd"; + "force group" = "cynerd"; + }; + }; + }; samba-wsdd = { - enable = true; + enable = false; discovery = true; }; - davfs2.enable = true; + #davfs2.enable = true; TODO!!! locate.enable = true; + + gnome = { + at-spi2-core.enable = true; + gnome-keyring.enable = true; + gnome-online-accounts.enable = true; + }; }; # Beneficial for Pipewire @@ -282,22 +338,30 @@ in { allowedUDPPorts = [3702]; }; - fonts.packages = with pkgs; [ - (nerdfonts.override {fonts = ["Hack"];}) - arkpandora_ttf - corefonts - dejavu_fonts - font-awesome - freefont_ttf - hack-font - liberation_ttf - libertine - noto-fonts - noto-fonts-emoji - terminus_font_ttf - ubuntu_font_family - unifont - ]; + fonts = { + enableDefaultPackages = true; + packages = with pkgs; [ + arkpandora_ttf + corefonts + dejavu_fonts + fira-code + fira-code-symbols + fira-math + fira-mono + fira-sans + font-awesome + freefont_ttf + hack-font + liberation_ttf + libertine + nerd-fonts.hack + noto-fonts + noto-fonts-color-emoji + terminus_font_ttf + ubuntu-classic + unifont + ]; + }; documentation = { enable = true; @@ -330,13 +394,13 @@ in { }; # Support running app images - boot.binfmt.registrations.appimage = { - wrapInterpreterInShell = false; - interpreter = "${pkgs.appimage-run}/bin/appimage-run"; - recognitionType = "magic"; - offset = 0; - mask = ''\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff''; - magicOrExtension = ''\x7fELF....AI\x02''; - }; + #boot.binfmt.registrations.appimage = { + # wrapInterpreterInShell = false; + # interpreter = "${pkgs.appimage-run}/bin/appimage-run"; + # recognitionType = "magic"; + # offset = 0; + # mask = ''\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff''; + # magicOrExtension = ''\x7fELF....AI\x02''; + #}; }; } diff --git a/nixos/modules/develop.nix b/nixos/modules/develop.nix index 446d205..8b413a9 100644 --- a/nixos/modules/develop.nix +++ b/nixos/modules/develop.nix @@ -15,10 +15,13 @@ in { }; config = mkIf config.cynerd.develop { - cynerd.compile = true; - environment.enableDebugInfo = true; + cynerd = { + devmin = true; + compile = true; + }; environment.systemPackages = with pkgs; [ # Tools + git-lfs gitlint tig gitg @@ -30,8 +33,10 @@ in { openssl tio vim-vint - nodePackages.vim-language-server + vim-language-server vale + can-utils + unixtools.xxd # Required for neovim plugins editorconfig-checker @@ -43,11 +48,13 @@ in { cachix nurl nil + nixfmt alejandra statix deadnix agenix nix-tree + nix-output-monitor # Shell dash # Posix shell @@ -61,12 +68,14 @@ in { # C clang-tools - massif-visualizer - qcachegrind + bear + #massif-visualizer + elf-size-analyze # Python (python3.withPackages (pypkgs: with pypkgs; [ + pip ipython python-lsp-server @@ -82,11 +91,12 @@ in { pygraphviz matplotlib + seaborn plotly pygal python-gitlab - PyGithub + pygithub schema jinja2 @@ -105,8 +115,14 @@ in { pyserial pylibftdi + pyusb + usbtmc + pylxd selenium + + pyvisa + pyvisa-py ])) ruff geckodriver @@ -123,11 +139,17 @@ in { # Julia julia + # XML + libxml2 + # Qemmu qemu virt-manager cdrtools + # Docker + docker-credential-helpers + # U-Boot ubootTools tftp-hpa @@ -151,13 +173,59 @@ in { linux-manual stdmanpages + # Writing documentation + docstrfmt + # SHV - shvcli + (shvcli.withPlugins [python3Packages.shvcli-ell]) # Images imagemagick + + # S3 + rclone ]; - programs.wireshark.package = pkgs.wireshark; + #programs.wireshark = { + # enable = true; + # package = pkgs.wireshark; + #}; + + programs.nix-ld = { + enable = true; + libraries = with pkgs; [ + alsa-lib + at-spi2-atk + cairo + cups + dbus + expat + gdk-pixbuf + glib + gtk3 + libGL + libXpm + libdrm + libgbm + libgcrypt + libsoup_3 + libudev0-shim + libusb1 + libx11 + libxcb + libxcomposite + libxdamage + libxext + libxfixes + libxkbcommon + libxrandr + nspr + nss + openssl + pango + udev + webkitgtk_4_1 + ]; + }; documentation = { nixos = { @@ -168,12 +236,18 @@ in { doc.enable = true; }; - services.udev.extraRules = '' - SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="3748", MODE:="0660", GROUP="develop", SYMLINK+="stlinkv2_%n" - SUBSYSTEMS=="usb", ATTRS{idVendor}=="a600", ATTRS{idProduct}=="a003", MODE:="0660", GROUP="develop", SYMLINK+="aix_forte_%n" - SUBSYSTEMS=="usb", ATTRS{idVendor}=="1366", ATTRS{idProduct}=="0105", MODE:="0660", GROUP="develop", SYMLINK+="jlink_%n" - SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2111", MODE:="0660", GROUP="develop", SYMLINK+="cmsip_dap_%n" - ''; + services.guix.enable = true; + #environment.etc."guix/machines.scm".text = '' + # (list (build-machine + # (name "czellembsrv.elektroline.cz") + # (systems (list "x86_64-linux" "i686-linux")) + # (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQZIwdzBo5CvMjS0M9tKYG2ikqPmSgSKRa/UPAoyhBC root@embsrv") + # (user "kkoci") + # (private-key "/home/cynerd/.ssh/elektroline-emb") + # (parallel-builds 16) + # (speed 2.0) + # )) + #''; virtualisation = { containers.enable = true; @@ -182,20 +256,21 @@ in { autoPrune.enable = true; storageDriver = "btrfs"; }; - lxd = { + lxc.enable = true; + libvirtd = { enable = true; - recommendedSysctlSettings = true; + qemu = { + swtpm.enable = true; + vhostUserPackages = with pkgs; [virtiofsd]; + }; }; - lxc.enable = true; - libvirtd.enable = true; spiceUSBRedirection.enable = true; }; + networking.firewall.trustedInterfaces = ["virbr0"]; - users.groups.develop = {}; users.users.cynerd.extraGroups = [ "docker" "lxd" - "develop" "libvirtd" ]; }; diff --git a/nixos/modules/devmin.nix b/nixos/modules/devmin.nix new file mode 100644 index 0000000..767cf2c --- /dev/null +++ b/nixos/modules/devmin.nix @@ -0,0 +1,37 @@ +{ + config, + lib, + ... +}: let + inherit (lib) mkOption mkIf types; +in { + options = { + cynerd.devmin = mkOption { + type = types.bool; + default = false; + description = "If machine is about to be used for remote development."; + }; + }; + + config = mkIf config.cynerd.devmin { + environment.enableDebugInfo = true; + + users.groups.develop = {}; + users.users.cynerd.extraGroups = [ + "develop" + ]; + + services.udev.extraRules = '' + SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="3748", MODE:="0660", GROUP="develop", SYMLINK+="stlinkv2_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="a600", ATTRS{idProduct}=="a003", MODE:="0660", GROUP="develop", SYMLINK+="aix_forte_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="1366", ATTRS{idProduct}=="0105", MODE:="0660", GROUP="develop", SYMLINK+="jlink_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2111", MODE:="0660", GROUP="develop", SYMLINK+="cmsip_dap_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="bef3", MODE:="0660", GROUP="develop", SYMLINK+="xds110_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="1cbe", ATTRS{idProduct}=="00ff", MODE:="0660", GROUP="develop", SYMLINK+="xds110_update_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="16a2", MODE:="0660", GROUP="develop", SYMLINK+="ccdebugger_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="1ab1", ATTRS{idProduct}=="0e11", MODE:="0660", GROUP="develop" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="1001", MODE:="0660", GROUP="develop", TAG+="uaccess" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="1002", MODE:="0660", GROUP="develop", TAG+="uaccess" + ''; + }; +} diff --git a/nixos/modules/gaming.nix b/nixos/modules/gaming.nix index 64af068..e939bf2 100644 --- a/nixos/modules/gaming.nix +++ b/nixos/modules/gaming.nix @@ -18,7 +18,14 @@ in { config = mkIf cnf { cynerd.desktop.enable = true; - environment.systemPackages = [pkgs.heroic]; + environment.systemPackages = with pkgs; [ + heroic + prismlauncher + ]; + + nixpkgs.config.permittedInsecurePackages = [ + "SDL_ttf-2.0.11" # TODO + ]; programs.steam = { enable = true; @@ -30,9 +37,29 @@ in { extraPkgs = pkgs: with pkgs; [ ncurses - xorg.libXpm - flac1_3 + libxpm + flac134 + libopus + ]; + }; + heroic = pkgs.heroic.override { + extraPkgs = pkgs: + with pkgs; [ + ncurses + libxpm + flac134 # For Nebuchadnezzar libopus + SDL + SDL2_image + SDL2_mixer + SDL2_ttf + SDL_image + SDL_mixer + SDL_ttf + glew_1_10 + libdrm + libidn + tbb ]; }; }; diff --git a/nixos/modules/generic.nix b/nixos/modules/generic.nix index 02afd17..3e8abaf 100644 --- a/nixos/modules/generic.nix +++ b/nixos/modules/generic.nix @@ -6,20 +6,10 @@ inherit (lib) mkOverride mkDefault; in { config = { - system.stateVersion = "24.05"; - nix = { - extraOptions = "experimental-features = nix-command flakes repl-flake"; + extraOptions = "experimental-features = nix-command flakes"; settings = { auto-optimise-store = true; - substituters = [ - "https://thefloweringash-armv7.cachix.org" - "https://arm.cachix.org" - ]; - trusted-public-keys = [ - "thefloweringash-armv7.cachix.org-1:v+5yzBD2odFKeXbmC+OPWVqx4WVoIVO6UXgnSAWFtso=" - "arm.cachix.org-1:K3XjAeWPgWkFtSS9ge5LJSLw3xgnNqyOaG7MDecmTQ8=" - ]; trusted-users = ["@wheel"]; }; registry = { @@ -31,13 +21,16 @@ in { }; boot = { - loader.systemd-boot.enable = mkOverride 1100 true; - loader.efi.canTouchEfiVariables = mkDefault true; + loader = { + systemd-boot.enable = mkOverride 1100 true; + efi.canTouchEfiVariables = mkDefault true; + grub.enable = mkOverride 1100 false; + }; kernelPackages = mkOverride 1100 pkgs.linuxPackages_latest; kernelParams = ["boot.shell_on_fail"]; }; - hardware.enableAllFirmware = true; - services.fwupd.enable = mkDefault (pkgs.system == "x86_64-linux"); + hardware.enableAllFirmware = mkDefault true; + services.fwupd.enable = mkDefault (pkgs.stdenv.hostPlatform.system == "x86_64-linux"); systemd.oomd.enable = false; networking = { @@ -59,11 +52,6 @@ in { }) ]; - system.extraSystemBuilderCmds = '' - substituteAll ${./nixos-system.sh} $out/bin/nixos-system - chmod +x $out/bin/nixos-system - ''; - documentation = { enable = mkDefault false; doc.enable = mkDefault false; diff --git a/nixos/modules/home-assistant.nix b/nixos/modules/home-assistant.nix deleted file mode 100644 index ab16e8a..0000000 --- a/nixos/modules/home-assistant.nix +++ /dev/null @@ -1,164 +0,0 @@ -{ - config, - lib, - pkgs, - ... -}: let - inherit (lib) mkIf mkEnableOption; -in { - options = { - cynerd.home-assistant = mkEnableOption "Enable Home Assistant and Bigclown"; - }; - - config = mkIf config.cynerd.home-assistant { - services.mosquitto = { - enable = true; - listeners = [ - { - users = { - cynerd = { - acl = ["readwrite #"]; - passwordFile = "/run/secrets/mosquitto.cynerd.pass"; - }; - telegraf = { - acl = ["read bigclown/node/#"]; - passwordFile = "/run/secrets/mosquitto.telegraf.pass"; - }; - homeassistant = { - acl = [ - "readwrite homeassistant/#" - "readwrite bigclown/#" - "readwrite zigbee2mqtt/#" - ]; - passwordFile = "/run/secrets/mosquitto.homeassistant.pass"; - }; - bigclown = { - acl = ["readwrite bigclown/#"]; - passwordFile = "/run/secrets/mosquitto.bigclown.pass"; - }; - zigbee2mqtt = { - acl = [ - "readwrite homeassistant/#" - "readwrite zigbee2mqtt/#" - ]; - passwordFile = "/run/secrets/mosquitto.zigbee2mqtt.pass"; - }; - }; - } - ]; - }; - networking.firewall.allowedTCPPorts = [ - 1883 # Mosquitto - ]; - - services.bcg = { - enable = true; - device = "/dev/ttyUSB0"; - baseTopicPrefix = "bigclown/"; - environmentFiles = ["/run/secrets/bigclown.env"]; - mqtt = { - username = "bigclown"; - password = "\${MQTT_PASSWORD}"; - }; - }; - - systemd.services.bigclown-leds = { - description = "Bigclown LEDs control"; - wantedBy = ["multi-user.target"]; - wants = ["mosquitto.service"]; - serviceConfig.ExecStart = "${pkgs.bigclown-leds}/bin/bigclown-leds /run/secrets/bigclown-leds.ini"; - }; - - services.telegraf.extraConfig = { - outputs.influxdb_v2 = [ - { - urls = ["http://cynerd.cz:8086"]; - token = "$INFLUX_TOKEN"; - organization = "personal"; - bucket = "bigclown"; - tagpass.source = ["bigclown"]; - } - ]; - inputs.mqtt_consumer = let - consumer = data_type: topics: { - tags = {source = "bigclown";}; - servers = ["tcp://localhost:1883"]; - inherit topics; - username = "telegraf"; - password = "$MQTT_PASSWORD"; - data_format = "value"; - inherit data_type; - topic_parsing = [ - { - topic = "bigclown/node/+/+/+/+"; - measurement = "_/_/_/_/_/measurement"; - tags = "_/_/device/field/_/_"; - } - ]; - }; - in [ - (consumer "float" [ - "bigclown/node/+/battery/+/voltage" - "bigclown/node/+/thermometer/+/temperature" - "bigclown/node/+/hygrometer/+/relative-humidity" - "bigclown/node/+/lux-meter/+/illuminance" - "bigclown/node/+/barometer/+/pressure" - "bigclown/node/+/pir/+/event-count" - "bigclown/node/+/push-button/+/event-count" - ]) - (consumer "boolean" [ - "bigclown/node/+/flood-detector/+/alarm" - ]) - ]; - processors.pivot = [ - { - tag_key = "field"; - value_key = "value"; - tagpass.source = ["bigclown"]; - } - ]; - }; - systemd.services.telegraf.wants = ["mosquitto.service"]; - - #nixpkgs.config.permittedInsecurePackages = ["openssl-1.1.1w"]; # TODO - services.home-assistant = { - enable = false; - openFirewall = true; - configDir = "/var/lib/hass"; - config = { - homeassistant = { - name = "SPT"; - latitude = "!secret latitude"; - longitude = "!secret longitude"; - elevation = "!secret elevation"; - time_zone = "Europe/Prague"; - country = "CZ"; - }; - http.server_port = 8808; - mqtt = { - sensor = import ./home-assistant/sensors.nix; - light = import ./home-assistant/light.nix; - }; - default_config = {}; - automation = "!include automations.yaml"; - }; - extraComponents = ["met"]; - package = pkgs.home-assistant.override { - extraPackages = pkgs: - with pkgs; [ - securetar - pyipp - ]; - packageOverrides = _: super: { - scapy = super.scapy.override { - withPlottingSupport = false; - }; - s3transfer = super.s3transfer.overridePythonAttrs { - dontUsePytestCheck = true; - dontUseSetuptoolsCheck = true; - }; - }; - }; - }; - }; -} diff --git a/nixos/modules/home-assistant/light.nix b/nixos/modules/home-assistant/light.nix deleted file mode 100644 index a9d158b..0000000 --- a/nixos/modules/home-assistant/light.nix +++ /dev/null @@ -1,13 +0,0 @@ -[ - { - name = "RGB Osvětlení"; - command_topic = "homeassistant/led-strip"; - brightness_scale = 100; - brightness_command_topic = "bigclown/node/power-controller:0/led-strip/-/brightness/set"; - #brightness_state_topic = "bigclown/node/power-controller:0/led-strip/-/brightness/set"; - rgb_command_template = ''"#{{"%02x" % red}}{{"%02x" % green}}{{"%02x" % blue}}"''; - rgb_command_topic = "bigclown/node/power-controller:0/led-strip/-/color/set"; - #rgb_value_template = ''{{int(value[2:4],16)}},{{int(value[5:7],16)}},{{int(value[8:10],16)}}''; - #rgb_state_topic = "bigclown/node/power-controller:0/led-strip/-/color/set"; - } -] diff --git a/nixos/modules/home-assistant/sensors.nix b/nixos/modules/home-assistant/sensors.nix deleted file mode 100644 index fadd4eb..0000000 --- a/nixos/modules/home-assistant/sensors.nix +++ /dev/null @@ -1,19 +0,0 @@ -[ - { - name = "Teplota"; - state_class = "measurement"; - state_topic = "bigclown/node/climate-monitor:0/thermometer/0:0/temperature"; - unit_of_measurement = "°C"; - } - { - name = "Vlhkost"; - state_class = "measurement"; - state_topic = "bigclown/node/climate-monitor:0/hygrometer/0:4/relative-humidity"; - unit_of_measurement = "%"; - } - { - name = "Osvětlení"; - state_class = "measurement"; - state_topic = "bigclown/node/climate-monitor:0/lux-meter/0:0/illuminance"; - } -] diff --git a/nixos/modules/homeassistant.nix b/nixos/modules/homeassistant.nix new file mode 100644 index 0000000..f7ebe9c --- /dev/null +++ b/nixos/modules/homeassistant.nix @@ -0,0 +1,57 @@ +{ + config, + lib, + ... +}: let + inherit (lib) mkOption mkEnableOption types mkIf; + cnf = config.cynerd.ha; +in { + options.cynerd.ha = { + enable = mkEnableOption "Home assistant setup on the primary router."; + domain = mkOption { + type = with types; str; + description = "The domain name of the system."; + }; + extraOptions = mkOption { + type = with types; listOf str; + default = []; + description = "Extra options passed to the container."; + }; + }; + + config = mkIf cnf.enable { + virtualisation.oci-containers = { + backend = "podman"; + containers.homeassistant = { + volumes = ["home-assistant:/config" "/run/dbus:/run/dbus:ro"]; + environment.TZ = "Europe/Prague"; + image = "ghcr.io/home-assistant/armv7-homeassistant:latest"; + extraOptions = + ["--privileged" "--network=host"] + ++ cnf.extraOptions; + }; + }; + + services.nginx = { + enable = true; + virtualHosts = { + "${cnf.domain}" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://localhost:8123"; + proxyWebsockets = true; + recommendedProxySettings = true; + }; + }; + }; + }; + security.acme = { + acceptTerms = true; + defaults.email = "cynerd+acme@email.cz"; + certs."${cnf.domain}" = {}; + }; + + networking.firewall.allowedTCPPorts = [80 443]; + }; +} diff --git a/nixos/modules/hosts.nix b/nixos/modules/hosts.nix index f53fd8c..0aafb12 100644 --- a/nixos/modules/hosts.nix +++ b/nixos/modules/hosts.nix @@ -19,7 +19,7 @@ in { default = true; description = "Use my personal static hosts"; }; - vpn = staticZoneOption; + zd = staticZoneOption; wg = staticZoneOption; spt = staticZoneOption; adm = staticZoneOption; @@ -28,9 +28,21 @@ in { config = { cynerd.hosts = { - vpn = { - "lipwig" = "10.8.0.1"; - "adm-omnia" = "10.8.0.51"; + zd = { + # Network + "mox" = "10.8.0.1"; + "one0" = "10.8.0.2"; + "one0nix" = "10.8.0.3"; + "camera1" = "10.8.0.21"; + "camera2" = "10.8.0.22"; + # Local + "ridcully" = "10.8.0.59"; + "dribbler" = "10.8.0.60"; + "tc" = "10.8.0.99"; + "vb" = "10.8.0.98"; + "printer" = "10.8.0.90"; + # Portable + "binky" = "10.8.0.63"; }; wg = { "lipwig" = "10.8.1.1"; @@ -40,6 +52,7 @@ in { # Endpoints "spt-omnia" = "10.8.1.50"; "adm-omnia" = "10.8.1.51"; + "zd-mox" = "10.8.1.52"; # Endpoints without routing "dean" = "10.8.1.59"; }; @@ -51,7 +64,6 @@ in { # Local "mpd" = "10.8.2.51"; "errol" = "10.8.2.60"; - "printer" = "10.8.2.90"; # Portable "albert" = "10.8.2.61"; "binky" = "10.8.2.63"; @@ -61,26 +73,27 @@ in { "omnia" = "10.8.3.1"; "omnia2" = "10.8.3.3"; # Local - "ridcully" = "10.8.3.60"; "3dprint" = "10.8.3.80"; - "mpd" = "10.8.3.51"; - "printer" = "192.168.0.20"; + "printer" = "10.8.3.20"; # Portable - "albert" = "10.8.3.61"; "binky" = "10.8.3.63"; }; }; networking.hosts = mkIf cnf.enable { - # VPN - "${cnf.vpn.lipwig}" = ["lipwig.vpn"]; - "${cnf.vpn.adm-omnia}" = ["adm.vpn"]; + # Zd + "${cnf.zd.mox}" = ["mox.zd"]; + "${cnf.zd.one0}" = ["one0.zd"]; + "${cnf.zd.ridcully}" = ["ridcully"]; + "${cnf.zd.tc}" = ["tc.zd"]; + "${cnf.zd.binky}" = ["binky.zd"]; # Wireguard "${cnf.wg.lipwig}" = ["lipwig.wg"]; "${cnf.wg.binky}" = ["binky.wg"]; "${cnf.wg.android}" = ["android.wg"]; "${cnf.wg.spt-omnia}" = ["spt.wg"]; "${cnf.wg.adm-omnia}" = ["adm.wg"]; + "${cnf.wg.zd-mox}" = ["zd.wg"]; "${cnf.wg.dean}" = ["dean" "dean.wg"]; # Spt "${cnf.spt.omnia}" = ["omnia.spt"]; @@ -88,18 +101,15 @@ in { "${cnf.spt.mox2}" = ["mox2.spt"]; "10.8.2.4" = ["mi3g.spt"]; "${cnf.spt.mpd}" = ["mpd.spt"]; - "${cnf.spt.errol}" = ["errol" "desktop.spt"]; + "${cnf.spt.errol}" = ["errol"]; "${cnf.spt.albert}" = ["albert.spt"]; "${cnf.spt.binky}" = ["binky.spt"]; # Adm "${cnf.adm.omnia}" = ["omnia.adm"]; "10.8.3.2" = ["redmi.adm"]; "${cnf.adm.omnia2}" = ["omnia2.adm"]; - "${cnf.adm.ridcully}" = ["ridcully" "desktop.adm"]; - "${cnf.adm.albert}" = ["albert.adm"]; "${cnf.adm.binky}" = ["binky.adm"]; - "${cnf.adm."3dprint"}" = ["3dprint"]; - "${cnf.adm.mpd}" = ["mpd.adm"]; + "${cnf.adm.printer}" = ["printer.adm"]; }; }; } diff --git a/nixos/modules/monitoring.nix b/nixos/modules/monitoring.nix index e4fa195..96761b9 100644 --- a/nixos/modules/monitoring.nix +++ b/nixos/modules/monitoring.nix @@ -32,6 +32,12 @@ in { config = mkMerge [ (mkIf cnf.enable { + # Glances + services.glances = { + enable = true; + openFirewall = true; + }; + # Telegraf configuration services.telegraf = { enable = true; @@ -136,8 +142,8 @@ in { }) (mkIf (config.networking.hostName == "lipwig") { - # InfluxDB services = { + # InfluxDB influxdb2.enable = true; telegraf.extraConfig.inputs.prometheus = { urls = ["http://localhost:8086/metrics"]; @@ -150,6 +156,7 @@ in { security = { admin_user = "cynerd"; admin_password = "$__file{/run/secrets/grafana.admin.pass}"; + secret_key = "SW2YcwTIb9zpOOhoPsMm"; }; server = { domain = "grafana.cynerd.cz"; diff --git a/nixos/modules/nixos-system.sh b/nixos/modules/nixos-system.sh deleted file mode 100644 index 7a220bb..0000000 --- a/nixos/modules/nixos-system.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!@shell@ -# Simple script handy to be used for activation - -while getopts "s" opt; do - case "$opt" in - s) - if [ ! -v NIXOS_SYSTEM_GNU_SCREEN ]; then - export NIXOS_SYSTEM_GNU_SCREEN=1 - exec @out@/sw/bin/screen "$0" "$@" - fi - ;; - *) - echo "Invalid argument: $1" >&2 - exit 1 - ;; - esac -done -shift $((OPTIND - 1)) - - -@out@/sw/bin/nix-env --profile /nix/var/nix/profiles/system --set '@out@' - -@out@/bin/switch-to-configuration "$@" || { - echo "Switch failed!" >&2 - read -r _ - exit 1 -} diff --git a/nixos/modules/openvpn.nix b/nixos/modules/openvpn.nix index 6a21721..8837904 100644 --- a/nixos/modules/openvpn.nix +++ b/nixos/modules/openvpn.nix @@ -9,11 +9,6 @@ in { options = { cynerd.openvpn = { - oldpersonal = mkOption { - type = types.bool; - default = false; - description = "My personal old OpenVPN"; - }; elektroline = mkOption { type = types.bool; default = false; @@ -24,9 +19,6 @@ in { config = { services.openvpn.servers = { - oldpersonal = mkIf cnf.oldpersonal { - config = "config /run/secrets/old.ovpn"; - }; elektroline = mkIf cnf.elektroline { config = "config /run/secrets/elektroline.ovpn"; up = '' @@ -48,6 +40,10 @@ in { ${pkgs.systemd}/bin/resolvectl domain "$dev" "~$domain" ''; }; + ellshv = mkIf cnf.elektroline { + config = "config /run/secrets/ellshv.ovpn"; + autoStart = false; + }; }; }; } diff --git a/nixos/modules/openwrtone.nix b/nixos/modules/openwrtone.nix new file mode 100644 index 0000000..b4ffe06 --- /dev/null +++ b/nixos/modules/openwrtone.nix @@ -0,0 +1,119 @@ +{ + config, + lib, + pkgs, + modulesPath, + extendModules, + ... +}: let + inherit (lib) mkEnableOption mkIf mkDefault; + variant = extendModules { + modules = [ + { + boot.postBootCommands = '' + # On the first boot do some maintenance tasks + if [ -f /nix-path-registration ]; then + set -euo pipefail + + # Register the contents of the initial Nix store + ${config.nix.package.out}/bin/nix-store --load-db < /nix-path-registration + + # nixos-rebuild also requires a "system" profile and an /etc/NIXOS tag. + touch /etc/NIXOS + ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system + + # Prevents this from running on later boots. + rm -f /nix-path-registration + fi + ''; + # We do not have generations in the initial image + boot.loader.generic-extlinux-compatible.configurationLimit = 0; + } + ]; + }; + inherit (variant.config.system.build) toplevel; +in { + options.cynerd.openwrtone = mkEnableOption "Configuration for OpenWrt One"; + + config = mkIf config.cynerd.openwrtone { + nixpkgs = { + hostPlatform = { + config = "aarch64-unknown-linux-gnu"; + system = "aarch64-linux"; + }; + buildPlatform = { + config = "x86_64-unknown-linux-gnu"; + system = "x86_64-linux"; + }; + }; + + # We do not need Grub as U-Boot supports boot using extlinux like file + boot = { + loader = { + grub.enable = mkDefault false; + systemd-boot.enable = mkDefault false; + generic-extlinux-compatible.enable = mkDefault true; + }; + + # Use OpenWrt One specific kernel. It fixes SError with patch. + kernelPackages = mkDefault (pkgs.linuxPackagesFor pkgs.linux_7_2); + kernelParams = [ + "fw_devlink=permissive" + "clk_ignore_unused" + ]; + + initrd = { + kernelModules = ["pcie-mediatek-gen3" "nvme"]; + # This includes modules to support common PC manufacturers but is not + # something required on embedded device. + includeDefaultModules = false; + supportedFilesystems = ["btrfs"]; + }; + supportedFilesystems = ["btrfs"]; + }; + hardware.deviceTree.name = mkDefault "mediatek/mt7981b-openwrt-one.dtb"; + + # Cover nix memory consumption peaks by compressing the RAM + zramSwap = mkDefault { + enable = true; + memoryPercent = 80; + }; + + fileSystems = { + "/boot" = mkDefault { + device = "/dev/nvme0n1p1"; + fsType = "vfat"; + }; + "/" = mkDefault { + device = "/dev/nvme0n1p2"; + fsType = "btrfs"; + }; + }; + + environment.systemPackages = with pkgs; [ + iw + ]; + + # No need for installer tools in standard system + system.disableInstallerTools = true; + # No need for NixOS documentation in headless system + documentation.nixos.enable = mkDefault false; + + system.build.tarball = pkgs.callPackage "${modulesPath}/../lib/make-system-tarball.nix" { + extraCommands = pkgs.buildPackages.writeShellScript "tarball-extra-commands" '' + ${variant.config.boot.loader.generic-extlinux-compatible.populateCmd} \ + -c ${toplevel} -d ./boot + ''; + contents = []; + + storeContents = + map (x: { + object = x; + symlink = "none"; + }) [ + toplevel + pkgs.stdenv + ]; + }; + }; +} diff --git a/nixos/modules/packages.nix b/nixos/modules/packages.nix index d321901..a85f14a 100644 --- a/nixos/modules/packages.nix +++ b/nixos/modules/packages.nix @@ -1,11 +1,11 @@ { - config, lib, pkgs, ... }: let inherit (lib) optionals; - isNative = config.nixpkgs.hostPlatform == config.nixpkgs.buildPlatform; + inherit (pkgs.stdenv.hostPlatform) isx86_64; + isNative = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform; in { nixpkgs = { config.allowUnfree = true; @@ -41,14 +41,12 @@ in { btop iotop mc - screen - tmux - pv # ls tools tree lsof strace + ripgrep sourceHighlight # Colors for less unrar @@ -65,13 +63,16 @@ in { wakeonlan speedtest-cli librespeed-cli - termshark + #termshark + w3m lm_sensors ] - ++ optionals (system == "x86_64-linux") [ + ++ optionals isx86_64 [ nmap ltrace + pv + screen ] ++ optionals (!isNative) [ ncdu_1 diff --git a/nixos/modules/router.nix b/nixos/modules/router.nix index 224037b..b01c94a 100644 --- a/nixos/modules/router.nix +++ b/nixos/modules/router.nix @@ -178,12 +178,11 @@ in { services.resolved = { enable = true; - dnssec = "true"; - fallbackDns = ["1.1.1.1" "8.8.8.8"]; - extraConfig = '' - DNSStubListenerExtra=${cnf.lanIP} - DNSStubListenerExtra=192.168.1.1 - ''; + settings.Resolve = { + FallbackDNS = ["1.1.1.1" "8.8.8.8"]; + DNSStubListenerExtra = [cnf.lanIP "192.168.1.1"]; + # TODO possibly enforce DNSSEC again + }; }; }; } diff --git a/nixos/modules/rpi.md b/nixos/modules/rpi.md new file mode 100644 index 0000000..43b172f --- /dev/null +++ b/nixos/modules/rpi.md @@ -0,0 +1,25 @@ +# Raspberry Pi SD card preparation steps + +``` +~# parted /dev/sdx +(parted) mktable msdos +(parted) mkpart primary fat16 0% 120M +(parted) mkpart primary btrfs 120M 100% +(parted) set 2 boot on +(parted) quit +~# mkfs.vfat -F16 /dev/sdx1 +~# mkfs.btrfs /dev/sdx2 + +~# mount /dev/sdx1 /mnt +~# nix build .#firmware-HOST +~# cp -r result/* /mnt/ +~# umount mnt + +~# mount /dev/sdx2 /mnt +~# nix copy --to /mnt .#toplevel-HOST +~# nix build --print-out-paths .#toplevel-HOST +~# nix eval .#nixosConfigurations.HOST.config.boot.loader.generic-extlinux-compatible.populateCmd +"/nix/store/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-extlinux-conf-builder.sh -g 20 -t 5" +~# /nix/store/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-extlinux-conf-builder.sh -c -d ./mnt/boot +~# umount mnt +``` diff --git a/nixos/modules/rpi.nix b/nixos/modules/rpi.nix new file mode 100644 index 0000000..08a2e91 --- /dev/null +++ b/nixos/modules/rpi.nix @@ -0,0 +1,88 @@ +{ + config, + lib, + pkgs, + ... +}: let + inherit (lib) mkOption types mkMerge mkIf; + + configTxt = pkgs.writeText "config.txt" '' + [pi3] + kernel=u-boot-rpi3.bin + + # Boot in 64-bit mode. + arm_64bit=1 + + # Otherwise the serial output will be garbled. + core_freq=250 + # Boot in 64-bit mode. + arm_64bit=1 + + [all] + # U-Boot needs this to work, regardless of whether UART is actually used or not. + # Look in arch/arm/mach-bcm283x/Kconfig in the U-Boot tree to see if this is still + # a requirement in the future. + enable_uart=1 + + # Prevent the firmware from smashing the framebuffer setup done by the mainline kernel + # when attempting to show low-voltage or overtemperature warnings. + avoid_warnings=1 + ''; +in { + options.cynerd.rpi = mkOption { + type = with types; nullOr (enum [2 3]); + default = null; + description = "If machine is RaspberryPi and which version"; + }; + + config = mkMerge [ + (mkIf (config.cynerd.rpi == 2) { + nixpkgs.hostPlatform.system = "armv7l-linux"; + }) + (mkIf (config.cynerd.rpi == 3) { + nixpkgs.hostPlatform.system = "aarch64-linux"; + boot.kernelParams = ["console=ttyS1,115200n8"]; + }) + (mkIf (config.cynerd.rpi != null) { + boot.loader = { + systemd-boot.enable = false; + efi.canTouchEfiVariables = false; + generic-extlinux-compatible.enable = true; + }; + boot.consoleLogLevel = 7; + + fileSystems = { + "/" = { + device = "/dev/mmcblk0p2"; + fsType = "ext4"; + }; + #"/" = { + # device = "/dev/mmcblk0p2"; + # fsType = "btrfs"; + # options = ["compress=lzo"]; + #}; + "/boot/firmware" = { + device = "/dev/mmcblk0p1"; + fsType = "vfat"; + options = ["nofail"]; + }; + }; + + services.journald.settings.Journal = { + SystemMaxUse = "512M"; + }; + + system.build.firmware = pkgs.callPackage ({stdenvNoCC}: + stdenvNoCC.mkDerivation { + name = "${config.system.name}-firmware"; + buildCommand = '' + mkdir $out + cp -r ${pkgs.raspberrypifw}/share/raspberrypi/boot/* $out/ + cp ${configTxt} $out/config.txt + # TODO support rpi2 + cp ${pkgs.ubootRaspberryPi3_btrfs}/u-boot.bin $out/u-boot-rpi3.bin + ''; + }) {}; + }) + ]; +} diff --git a/nixos/modules/syncthing.nix b/nixos/modules/syncthing.nix index 91736ca..eab61c7 100644 --- a/nixos/modules/syncthing.nix +++ b/nixos/modules/syncthing.nix @@ -3,119 +3,96 @@ lib, ... }: let - inherit (lib) filterAttrs mkOption types mkIf any mkDefault recursiveUpdate genAttrs; - cnf = config.cynerd.syncthing; - inherit (config.networking) hostName; + inherit (lib) elem filterAttrs mkIf any mkDefault recursiveUpdate genAttrs; + allDevices = [ - "albert" "binky" "errol" "lipwig" "ridcully" - "spt-omnia" - ]; - mediaDevices = [ - "lipwig" - "binky" - "errol" - "ridcully" - "spt-omnia" ]; bigStorageDevices = [ "errol" "ridcully" - "spt-omnia" ]; + + inherit (config.networking) hostName; + baseDir = config.services.syncthing.dataDir; filterDevice = filterAttrs (_: v: any (d: d == hostName) v.devices); in { - options = { - cynerd.syncthing = { - enable = mkOption { - type = types.bool; - default = false; - description = "My personal Syncthing configuration"; - }; - - baseDir = mkOption { - type = types.str; - default = "/home/cynerd"; - description = "Base directory for all folders being synced."; - }; - }; - }; - - config = mkIf cnf.enable { + config = mkIf (config.services.syncthing.enable && elem hostName allDevices) { services.syncthing = { - enable = any (n: n == hostName) allDevices; user = mkDefault "cynerd"; + group = mkDefault "cynerd"; + key = "/run/secrets/syncthing.key.pem"; cert = "/run/secrets/syncthing.cert.pem"; openDefaultPorts = true; - overrideFolders = true; - folders = filterDevice { - "${cnf.baseDir}/documents" = { - label = "Documents"; - id = "documents"; - devices = allDevices; - ignorePerms = false; - }; - "${cnf.baseDir}/notes" = { - label = "Notes"; - id = "notes"; - devices = allDevices; - ignorePerms = false; - }; - "${cnf.baseDir}/projects" = { - label = "Projects"; - id = "projects"; - devices = allDevices; - ignorePerms = false; - }; - "${cnf.baseDir}/pictures" = { - label = "Pictures"; - id = "pictures"; - devices = mediaDevices; - ignorePerms = false; - }; - # TODO phone-photos - "${cnf.baseDir}/music/primary" = { - label = "Music-primary"; - id = "music-primary"; - devices = mediaDevices; - ignorePerms = false; - }; - "${cnf.baseDir}/music/secondary" = { - label = "Music-secondary"; - id = "music-secondary"; - devices = bigStorageDevices; - ignorePerms = false; - }; - "${cnf.baseDir}/music/flac" = { - label = "Music-flac"; - id = "music-flac"; - devices = bigStorageDevices; - ignorePerms = false; - }; - "${cnf.baseDir}/video" = { - label = "Video"; - id = "video"; - devices = bigStorageDevices; - ignorePerms = false; - }; - }; - overrideDevices = true; - devices = - recursiveUpdate - (genAttrs allDevices (name: { - id = config.secrets.syncthingIDs."${name}"; - })) - { - lipwig.addresses = ["tcp://cynerd.cz"]; + + settings = { + folders = filterDevice { + "${baseDir}/documents" = { + label = "Documents"; + id = "documents"; + devices = allDevices; + ignorePerms = false; + }; + "${baseDir}/notes" = { + label = "Notes"; + id = "notes"; + devices = allDevices; + ignorePerms = false; + }; + "${baseDir}/projects" = { + label = "Projects"; + id = "projects"; + devices = allDevices; + ignorePerms = false; + }; + "${baseDir}/elektroline" = { + label = "Elektroline"; + id = "elektroline"; + devices = allDevices; + ignorePerms = false; + }; + "${baseDir}/images" = { + label = "Images"; + id = "pictures"; + devices = bigStorageDevices; + ignorePerms = false; + }; + "${baseDir}/music" = { + label = "Music"; + id = "music"; + devices = bigStorageDevices; + ignorePerms = false; + }; + "${baseDir}/video" = { + label = "Video"; + id = "video"; + devices = bigStorageDevices; + ignorePerms = false; + }; + "${baseDir}/turris" = { + label = "Turris"; + id = "turris"; + devices = bigStorageDevices; + ignorePerms = false; + }; }; - # TODO phone + + devices = + recursiveUpdate + (genAttrs allDevices (name: { + id = config.secrets.syncthingIDs."${name}"; + })) + { + lipwig.addresses = ["tcp://cynerd.cz"]; + }; + }; }; }; } diff --git a/nixos/modules/users.nix b/nixos/modules/users.nix index 1c143bb..24eedb5 100644 --- a/nixos/modules/users.nix +++ b/nixos/modules/users.nix @@ -3,8 +3,8 @@ config, ... }: let - isNative = config.nixpkgs.hostPlatform == config.nixpkgs.buildPlatform; - isArm = config.nixpkgs.hostPlatform.isAarch; + isNative = pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform; + isArm = pkgs.stdenv.hostPlatform.isAarch; in { users = { mutableUsers = false; @@ -43,12 +43,25 @@ in { }; }; - security.sudo.extraRules = [ - { - groups = ["wheel"]; - commands = ["ALL"]; - } - ]; + security = { + doas = { + enable = true; + extraRules = [ + { + groups = ["wheel"]; + keepEnv = true; + persist = true; + } + ]; + }; + + sudo.extraRules = [ + { + groups = ["wheel"]; + commands = ["ALL"]; + } + ]; + }; services.openssh = { enable = true; @@ -72,9 +85,9 @@ in { enable = !isArm; defaultEditor = !isArm; withNodeJs = true; + withPython3 = true; + withRuby = true; }; - - wireshark.enable = true; }; programs.fuse.userAllowOther = true; diff --git a/nixos/modules/wifi-adm.nix b/nixos/modules/wifi-adm.nix index 1db730c..e69afd1 100644 --- a/nixos/modules/wifi-adm.nix +++ b/nixos/modules/wifi-adm.nix @@ -3,9 +3,55 @@ lib, ... }: let - inherit (lib) mkOption mkEnableOption types mkIf hostapd elemAt; + inherit (lib) mkOption mkEnableOption types mkIf mkMerge hostapd elemAt; cnf = config.cynerd.wifiAP.adm; + wifi-networks = name: { + "${cnf."${name}".interface}" = { + bssid = elemAt cnf."${name}".bssids 0; + ssid = "TurrisAdamkovi"; + authentication = { + mode = "wpa3-sae-transition"; + wpaPasswordFile = "/run/secrets/hostapd-TurrisAdamkovi.pass"; + saePasswordsFile = "/run/secrets/hostapd-TurrisAdamkovi.pass"; + }; + }; + "${cnf."${name}".interface}.milan" = { + bssid = elemAt cnf."${name}".bssids 1; + ssid = "MILAN-AC"; + authentication = { + mode = "wpa2-sha1"; + wpaPasswordFile = "/run/secrets/hostapd-MILAN-AC.pass"; + }; + }; + }; + + net-networks = name: { + "lan-${cnf."${name}".interface}" = { + matchConfig = { + Name = cnf."${name}".interface; + WLANInterfaceType = "ap"; + }; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 1; + PVID = 1; + } + ]; + }; + "lan-${cnf."${name}".interface}.milan" = { + matchConfig.Name = "${cnf."${name}".interface}.milan"; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 1; + PVID = 1; + } + ]; + }; + }; + wOptions = card: channelDefault: { interface = mkOption { type = with types; nullOr str; @@ -43,32 +89,7 @@ in { enable = true; inherit (hostapd.qualcomAtherosAR9287.wifi4) capabilities; }; - networks = { - "${cnf.ar9287.interface}" = { - bssid = elemAt cnf.ar9287.bssids 0; - ssid = "TurrisAdamkovi"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-TurrisAdamkovi.pass"; - }; - }; - "${cnf.ar9287.interface}-nela" = { - bssid = elemAt cnf.ar9287.bssids 1; - ssid = "Nela"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-Nela.pass"; - }; - }; - "${cnf.ar9287.interface}.milan" = { - bssid = elemAt cnf.ar9287.bssids 2; - ssid = "MILAN-AC"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-MILAN-AC.pass"; - }; - }; - }; + networks = wifi-networks "ar9287"; }; "${cnf.qca988x.interface}" = mkIf (cnf.qca988x.interface != null) { countryCode = "CZ"; @@ -82,96 +103,13 @@ in { enable = true; inherit (hostapd.qualcomAtherosQCA988x.wifi5) capabilities; }; - networks = { - "${cnf.qca988x.interface}" = { - bssid = elemAt cnf.qca988x.bssids 0; - ssid = "TurrisAdamkovi"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-TurrisAdamkovi.pass"; - }; - }; - "${cnf.qca988x.interface}-nela" = { - bssid = elemAt cnf.qca988x.bssids 1; - ssid = "Nela"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-Nela.pass"; - }; - }; - "${cnf.qca988x.interface}.milan" = { - bssid = elemAt cnf.qca988x.bssids 2; - ssid = "MILAN-AC"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-MILAN-AC.pass"; - }; - }; - }; + networks = wifi-networks "qca988x"; }; }; }; - systemd.network.networks = { - "lan-${cnf.ar9287.interface}" = { - matchConfig.Name = cnf.ar9287.interface; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 1; - PVID = 1; - } - ]; - }; - "lan-${cnf.ar9287.interface}-nela" = { - matchConfig.Name = "${cnf.ar9287.interface}-nela"; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 2; - PVID = 2; - } - ]; - }; - "lan-${cnf.ar9287.interface}.milan" = { - matchConfig.Name = "${cnf.ar9287.interface}.milan"; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 2; - PVID = 2; - } - ]; - }; - "lan-${cnf.qca988x.interface}" = { - matchConfig.Name = cnf.qca988x.interface; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 1; - PVID = 1; - } - ]; - }; - "lan-${cnf.qca988x.interface}-nela" = { - matchConfig.Name = "${cnf.qca988x.interface}-nela"; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 2; - PVID = 2; - } - ]; - }; - "lan-${cnf.qca988x.interface}.milan" = { - matchConfig.Name = "${cnf.qca988x.interface}.milan"; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 2; - PVID = 2; - } - ]; - }; - }; + systemd.network.networks = mkMerge [ + (mkIf (cnf.ar9287.interface != null) (net-networks "ar9287")) + (mkIf (cnf.qca988x.interface != null) (net-networks "qca988x")) + ]; }; } diff --git a/nixos/modules/wifi-client.nix b/nixos/modules/wifi-client.nix index 8fc803d..07eb686 100644 --- a/nixos/modules/wifi-client.nix +++ b/nixos/modules/wifi-client.nix @@ -21,8 +21,9 @@ in { networking.wireless = { enable = true; networks = config.secrets.wifiNetworks; - environmentFile = "/run/secrets/wifi.env"; - userControlled.enable = true; + secretsFile = "/run/secrets/wifi.secrets"; + userControlled = true; }; + users.users.cynerd.extraGroups = ["wpa_supplicant"]; }; } diff --git a/nixos/modules/wifi-spt.nix b/nixos/modules/wifi-spt.nix index d013473..dc1de09 100644 --- a/nixos/modules/wifi-spt.nix +++ b/nixos/modules/wifi-spt.nix @@ -6,6 +6,61 @@ inherit (lib) mkOption mkEnableOption types mkIf mkForce mkMerge hostapd elemAt; cnf = config.cynerd.wifiAP.spt; + wifi-networks = name: let + is2g = cnf."${name}".channel <= 14; + in { + "${cnf."${name}".interface}" = { + bssid = elemAt cnf."${name}".bssids 0; + ssid = "TurrisRules${ + if is2g + then "" + else "5" + }"; + authentication = { + mode = "wpa2-sha256"; + wpaPasswordFile = "/run/secrets/hostapd-TurrisRules.pass"; + }; + settings = mkIf is2g { + ieee80211w = mkForce 0; + wpa_key_mgmt = mkForce "WPA-PSK"; # force use without sha256 + }; + }; + "${cnf."${name}".interface}.guest" = { + bssid = elemAt cnf."${name}".bssids 1; + ssid = "Kocovi"; + authentication = { + mode = "wpa2-sha256"; + wpaPasswordFile = "/run/secrets/hostapd-Kocovi.pass"; + }; + }; + }; + + net-networks = name: { + "lan-${cnf."${name}".interface}" = { + matchConfig = { + Name = cnf."${name}".interface; + WLANInterfaceType = "ap"; + }; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 1; + PVID = 1; + } + ]; + }; + "lan-${cnf."${name}".interface}-guest" = { + matchConfig.Name = "${cnf."${name}".interface}.guest"; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 2; + PVID = 2; + } + ]; + }; + }; + wOptions = card: channelDefault: { interface = mkOption { type = with types; nullOr str; @@ -48,28 +103,7 @@ in { enable = true; inherit (hostapd.qualcomAtherosAR9287.wifi4) capabilities; }; - networks = { - "${cnf.ar9287.interface}" = { - bssid = elemAt cnf.ar9287.bssids 0; - ssid = "TurrisRules"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-TurrisRules.pass"; - }; - settings = { - ieee80211w = 0; - wpa_key_mgmt = mkForce "WPA-PSK"; # force use without sha256 - }; - }; - "${cnf.ar9287.interface}.guest" = { - bssid = elemAt cnf.ar9287.bssids 1; - ssid = "Kocovi"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-Kocovi.pass"; - }; - }; - }; + networks = wifi-networks "ar9287"; }; }) (mkIf (cnf.qca988x.interface != null) { @@ -90,87 +124,14 @@ in { enable = !is2g; inherit (hostapd.qualcomAtherosQCA988x.wifi5) capabilities; }; - networks = { - "${cnf.qca988x.interface}" = { - bssid = elemAt cnf.qca988x.bssids 0; - ssid = "TurrisRules${ - if is2g - then "" - else "5" - }"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-TurrisRules.pass"; - }; - settings = mkIf is2g { - ieee80211w = 0; - wpa_key_mgmt = mkForce "WPA-PSK"; # force use without sha256 - }; - }; - "${cnf.qca988x.interface}.guest" = { - bssid = elemAt cnf.qca988x.bssids 1; - ssid = "Kocovi"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-Kocovi.pass"; - }; - }; - }; + networks = wifi-networks "qca988x"; }; }) ]; }; systemd.network.networks = mkMerge [ - (mkIf (cnf.ar9287.interface != null) { - "lan-${cnf.ar9287.interface}" = { - matchConfig = { - Name = cnf.ar9287.interface; - WLANInterfaceType = "ap"; - }; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 1; - PVID = 1; - } - ]; - }; - "lan-${cnf.ar9287.interface}-guest" = { - matchConfig.Name = "${cnf.ar9287.interface}.guest"; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 2; - PVID = 2; - } - ]; - }; - }) - (mkIf (cnf.qca988x.interface != null) { - "lan-${cnf.qca988x.interface}" = { - matchConfig = { - Name = cnf.qca988x.interface; - WLANInterfaceType = "ap"; - }; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 1; - PVID = 1; - } - ]; - }; - "lan-${cnf.qca988x.interface}-guest" = { - matchConfig.Name = "${cnf.qca988x.interface}.guest"; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 2; - PVID = 2; - } - ]; - }; - }) + (mkIf (cnf.ar9287.interface != null) (net-networks "ar9287")) + (mkIf (cnf.qca988x.interface != null) (net-networks "qca988x")) ]; }; } diff --git a/nixos/modules/wifi-zd.nix b/nixos/modules/wifi-zd.nix new file mode 100644 index 0000000..c275fc3 --- /dev/null +++ b/nixos/modules/wifi-zd.nix @@ -0,0 +1,112 @@ +{ + config, + lib, + ... +}: let + inherit (lib) mkOption mkEnableOption types mkIf mkForce elemAt; + cnf = config.cynerd.wifiAP.zd; + + wOptions = { + bssids = mkOption { + type = with types; listOf str; + default = []; + description = "BSSIDs for networks."; + }; + channel = mkOption { + type = types.ints.positive; + description = "Channel to be used"; + }; + }; +in { + options = { + cynerd.wifiAP.zd = { + enable = mkEnableOption "Enable Wi-Fi Access Point support (OpenWrt One)"; + wlan0 = wOptions; + wlan1 = wOptions; + }; + }; + + config = mkIf cnf.enable { + # TODO regdom doesn't work for some reason + boot.extraModprobeConfig = '' + options cfg80211 ieee80211_regdom="CZ" + ''; + services.hostapd = { + enable = true; + radios = { + "wlan0" = { + inherit (cnf.wlan0) channel; + countryCode = "CZ"; + wifi4 = { + enable = true; + capabilities = [ + "HT40" + "SHORT-GI-20" + "SHORT-GI-40" + "TX-STBC" + "RX-STBC1" + "MAX-AMSDU-7935" + ]; + }; + networks = { + "wlan0" = { + bssid = elemAt cnf.wlan0.bssids 0; + ssid = "UNas"; + authentication = { + mode = "wpa2-sha256"; + wpaPasswordFile = "/run/secrets/hostapd-UNas.pass"; + }; + }; + "wlan0.guest" = { + bssid = elemAt cnf.wlan0.bssids 1; + ssid = "Koci"; + authentication = { + mode = "wpa2-sha256"; + wpaPasswordFile = "/run/secrets/hostapd-Koci.pass"; + }; + }; + "wlan0.iotd" = { + bssid = elemAt cnf.wlan0.bssids 2; + ssid = "IOTD"; + authentication = { + mode = "wpa2-sha256"; + wpaPasswordFile = "/run/secrets/hostapd-IOTD.pass"; + }; + settings = { + ieee80211w = mkForce 0; + wpa_key_mgmt = mkForce "WPA-PSK"; # force use without sha256 + }; + }; + }; + }; + #"wlan1" = { + #}; + }; + }; + systemd.network.networks = { + "lan-wlan0" = { + matchConfig = { + Name = "wlan0 wlan0.iotd"; + WLANInterfaceType = "ap"; + }; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 1; + PVID = 1; + } + ]; + }; + "lan-wlan0-guest" = { + matchConfig.Name = "wlan0.guest"; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 2; + PVID = 2; + } + ]; + }; + }; + }; +} diff --git a/nixos/modules/wireguad.nix b/nixos/modules/wireguard.nix index 1b1db90..4fd942c 100644 --- a/nixos/modules/wireguad.nix +++ b/nixos/modules/wireguard.nix @@ -6,7 +6,7 @@ }: let inherit (lib) any all mkEnableOption mkIf mapAttrsToList optional optionals optionalAttrs filterAttrs; inherit (config.networking) hostName; - endpoints = ["lipwig" "spt-omnia" "adm-omnia"]; + endpoints = ["lipwig" "spt-omnia" "adm-omnia" "zd-mox"]; is_endpoint = any (v: v == hostName) endpoints; in { options = { @@ -44,18 +44,24 @@ in { PublicKey = config.secrets.wireguardPubs.spt-omnia; } // (optionalAttrs (!is_endpoint) {PersistentKeepalive = 25;})) - #{ - # wireguardPeerConfig = - # { - # Endpoint = "adm.cynerd.cz:51820"; - # AllowedIPs = [ - # "${config.cynerd.hosts.wg.adm-omnia}/32" - # "10.8.3.0/24" - # ]; - # PublicKey = config.secrets.wireguardPubs.adm-omnia; - # } - # // (optionalAttrs (!is_endpoint) {PersistentKeepalive = 25;}); - #} + ({ + Endpoint = "adm.cynerd.cz:51820"; + AllowedIPs = [ + "${config.cynerd.hosts.wg.adm-omnia}/32" + "10.8.3.0/24" + ]; + PublicKey = config.secrets.wireguardPubs.adm-omnia; + } + // (optionalAttrs (!is_endpoint) {PersistentKeepalive = 25;})) + ({ + Endpoint = "zd.cynerd.cz:51820"; + AllowedIPs = [ + "${config.cynerd.hosts.wg.zd-mox}/32" + "10.8.0.0/24" + ]; + PublicKey = config.secrets.wireguardPubs.zd-mox; + } + // (optionalAttrs (!is_endpoint) {PersistentKeepalive = 25;})) ] ++ (optionals is_endpoint (mapAttrsToList (n: v: { AllowedIPs = "${config.cynerd.hosts.wg."${n}"}/32"; @@ -69,23 +75,23 @@ in { IPv4Forwarding = "yes"; }; routes = - (optional (hostName != "lipwig") { - # OpenVPN network - Gateway = config.cynerd.hosts.wg.lipwig; - Destination = "10.8.0.0/24"; - Metric = 2048; - }) - ++ (optional (hostName != "spt-omnia") { + (optional (hostName != "spt-omnia") { # SPT network Gateway = config.cynerd.hosts.wg.spt-omnia; Destination = "10.8.2.0/24"; Metric = 2048; }) - ++ (optional (hostName != "adm-omnia" && hostName != "lipwig") { - # Adamkovi network + ++ (optional (hostName != "adm-omnia") { + # ADM network Gateway = config.cynerd.hosts.wg.adm-omnia; Destination = "10.8.3.0/24"; Metric = 2048; + }) + ++ (optional (hostName != "zd-mox") { + # ZD network + Gateway = config.cynerd.hosts.wg.zd-mox; + Destination = "10.8.0.0/24"; + Metric = 2048; }); }; }; diff --git a/nixos/nextcloud-extra-apps.json b/nixos/nextcloud-extra-apps.json new file mode 100644 index 0000000..29be7b0 --- /dev/null +++ b/nixos/nextcloud-extra-apps.json @@ -0,0 +1,52 @@ +{ + "fileslibreofficeedit": { + "hash": "sha256-Xqx5snQWintYJG3Q1Crw22TkNw18DdADXkurMQqt3X8=", + "url": "https://github.com/allotropia/nextcloud_files_libreoffice_edit/releases/download/v2.0.1/fileslibreofficeedit.tar.gz", + "version": "2.0.1", + "description": "This adds a new context menu item to the Files dropdown menu \"Edit with LibreOffice\".\nClicking that item will open the file in LibreOffice via WebDAV (the file can then be edited and saved back directly in LibreOffice).\n\nThis greatly improves the user experience when working with Office files in the browser. No need to download, edit, reupload. Instead use the \"Edit with LibreOffice\" item.\n\nThis app requires at least LibreOffice 7.2 on Linux and macOS. On Windows it also works with older LibreOffice versions (since LibreOffice 5.3).", + "homepage": "https://github.com/allotropia/nextcloud_files_libreoffice_edit", + "licenses": [ + "agpl" + ] + }, + "integration_github": { + "hash": "sha256-7fdQzM4yaFJ9To8lIoiQ4IgfKPGqh8ZXnVxy0Xzo+q8=", + "url": "https://github.com/nextcloud-releases/integration_github/releases/download/v3.2.6/integration_github-v3.2.6.tar.gz", + "version": "3.2.6", + "description": "GitHub integration provides a dashboard widget displaying your most important notifications\n and a unified search provider for repositories, issues and pull requests. It also provides a link reference provider\n to render links to issues, pull requests and comments in Talk and Text.", + "homepage": "https://github.com/nextcloud/integration_github", + "licenses": [ + "agpl" + ] + }, + "integration_gitlab": { + "hash": "sha256-f0D9UrlX8bsf4BSTCzb9bN1gYKDlSY9JxmgO6el7HZw=", + "url": "https://github.com/nextcloud-releases/integration_gitlab/releases/download/v5.0.0/integration_gitlab-v5.0.0.tar.gz", + "version": "5.0.0", + "description": "GitLab integration provides a dashboard widget displaying your most important notifications\n and a unified search provider for repositories, issues and merge requests.", + "homepage": "https://github.com/nextcloud/integration_gitlab", + "licenses": [ + "agpl" + ] + }, + "money": { + "hash": "sha256-bEcKzgItP/Bs336qXAI72cGFXkPVNSfzMjrYQ5212K8=", + "url": "https://github.com/powerpaul17/nc_money/releases/download/v0.32.0/money.tar.gz", + "version": "0.32.0", + "description": "Finance manager for Nextcloud.", + "homepage": "https://github.com/powerpaul17/nc_money", + "licenses": [ + "agpl" + ] + }, + "passwords": { + "hash": "sha256-8ER2MqyePpERD7RRfw8Hq5xNx+s8vUhPbDyJ2JvU/ho=", + "url": "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2026.7.0/passwords.tar.gz", + "version": "2026.7.20", + "description": "Passwords is the most advanced password manager for Nextcloud and allows you to manage and store your passwords safely in your own cloud.\nThe intuitive and modern web interface of the app makes it easy to update and add new passwords from anywhere.\nIncluded security checks help you to keep your online accounts safe and up-to-date.\nYou can also share passwords with other Nextcloud users.\n\n**Features**\n * Intuitive and modern user interface\n * Password security monitor\n * Secure encryption\n * Folders & tags\n * Sharing\n * Dashboard Widget\n * API for apps\n * Extensive handbook\n * Import & Export\n * Browser extensions & Apps\n * ... and many more to come\n\n**Support**\n * [Official Chat](https://matrix.to/#/#nextcloud-passwords:chat.passwordsapp.org)\n * [Official Forum](https://help.nextcloud.com/tag/passwords-app)\n * [User Handbook](https://git.mdns.eu/nextcloud/passwords/-/wikis/Users/Index)\n * [Administrator Handbook](https://git.mdns.eu/nextcloud/passwords/-/wikis/Administrators/Index)\n\n**Apps & Extensions**\n * [Official Firefox Add-On](https://addons.mozilla.org/de/firefox/addon/nextcloud-passwords?utm_source=app&utm_medium=nc-apps)\n * [Official Chrome Extension](https://chrome.google.com/webstore/detail/nextcloud-passwords/mhajlicjhgoofheldnmollgbgjheenbi)\n * [Official Microsoft Edge Extension](https://microsoftedge.microsoft.com/addons/detail/cjmlcljdpphgdfpkngjcmeepdpcgpffk)\n * [Android App](https://play.google.com/store/apps/details?id=de.jbservices.nc_passwords_app) by [joleaf](https://gitlab.com/joleaf/nc-passwords-app)\n * [Android App](https://play.google.com/store/apps/details?id=com.hegocre.nextcloudpasswords) by [hegocre](https://github.com/hegocre/NextcloudPasswords)\n * [Windows App (WIP)](https://www.microsoft.com/store/apps/9NXVZ0ZP6D5Z) by [j0chn](https://gitlab.com/j0chn/nextcloud_password_client)\n * [Linux App (WIP)](https://gitlab.com/j0chn/nextcloud_password_client/-/tree/main#linux) by [j0chn](https://gitlab.com/j0chn/nextcloud_password_client)\n * [macOS App (WIP)](https://gitlab.com/j0chn/nextcloud_password_client/-/tree/main#mac-os) by [j0chn](https://gitlab.com/j0chn/nextcloud_password_client)\n * [iOS App](https://apps.apple.com/app/id1546212226) by [Johannes Schliephake](https://github.com/johannes-schliephake/nextcloud-passwords-ios)", + "homepage": "https://passwordsapp.org/", + "licenses": [ + "agpl" + ] + } +} diff --git a/pkgs/default.nix b/pkgs/default.nix index eca6db6..cb4f913 100644 --- a/pkgs/default.nix +++ b/pkgs/default.nix @@ -1,13 +1,6 @@ -final: prev: let - # The NodeJS packages has to be build in 32bit environment if host platform is - # also 32bit because it uses 32bit stubs and links against 32bit OpenSSL. The - # only architecture that generally supports execution of 32bit is x86_64 and - # thus that is the only one handled here. - callPackageNodejs = - if prev.stdenv.buildPlatform.isx86_64 && prev.stdenv.is32bit - then prev.buildPackages.pkgsi686Linux.callPackage - else prev.callPackage; -in { +final: prev: { + pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [(import ./python.nix)]; + luks-hw-password = final.callPackage ./luks-hw-password {}; dev = final.callPackage ./dev { devShells = import ../devShells final; @@ -22,31 +15,122 @@ in { stardict-en-cz = final.callPackage ./stardict/en-cz.nix {}; stardict-de-cz = final.callPackage ./stardict/de-cz.nix {}; stardict-cz = final.callPackage ./stardict/cz.nix {}; - sdcv-unwrapped = final.callPackage ./sdcv {}; + sdcv-unwrapped = prev.sdcv; sdcv = final.callPackage ./stardict/wrapper.nix {stardict = final.sdcv-unwrapped;}; lorem-text = final.callPackage ./lorem-text {}; bigclown-leds = final.callPackage ./bigclown-leds {}; - # nixpkgs patches - zigbee2mqtt = prev.zigbee2mqtt.overrideAttrs { - npmInstallFlags = ["--no-optional"]; # Fix cross build + dodo = final.callPackage ./dodo {}; + elf-size-analyze = final.callPackage ./elf-size-analyze {}; + + # OpenWrt One + armTrustedFirmwareMT7981 = final.callPackage ./mtk-arm-trusted-firmware rec { + extraMakeFlags = [ + "BOOT_DEVICE=spim-nand" + "DRAM_USE_DDR4=1" + "UBI=1" + "OVERRIDE_UBI_START_ADDR=0x100000" + "bl2" + "bl31" + ]; + platform = "mt7981"; + extraMeta.platforms = ["aarch64-linux"]; + filesToInstall = ["build/${platform}/release/bl2.bin" "build/${platform}/release/bl31.bin"]; + }; + ubootOpenWrtOne = + # ubiupdatevol /dev/ubi0_2 u-boot.fip + (final.buildUBoot { + defconfig = "mt7981_openwrt-one-spi-nand_defconfig"; + extraMeta.platforms = ["aarch64-linux"]; + filesToInstall = ["u-boot.fip" ".config"]; + extraPatches = [./u-boot-add-openwrt-one.patch]; + extraConfig = '' + CONFIG_CMD_BOOTMENU=n + CONFIG_AUTOBOOT_MENU_SHOW=n + CONFIG_BOOTDELAY=3 + + CONFIG_PCI=y + CONFIG_PCIE_MEDIATEK_GEN3=y + CONFIG_PCI_DEBUG=y + CONFIG_DM_REGULATOR=y + CONFIG_NVME=y + CONFIG_NVME_PCI=y + CONFIG_CMD_NVME=y + CONFIG_EFI_PARTITION=y + + CONFIG_CMD_SYSBOOT=y + CONFIG_SUPPORT_RAW_INITRD=y + + CONFIG_BOARD_LATE_INIT=n + ''; + postBuild = '' + ${final.buildPackages.armTrustedFirmwareTools}/bin/fiptool create \ + --soc-fw '${final.armTrustedFirmwareMT7981}/bl31.bin' \ + --nt-fw ./u-boot.bin \ + u-boot.fip + ''; + }).overrideAttrs (oldAttrs: { + nativeBuildInputs = [final.buildPackages.unixtools.xxd] ++ oldAttrs.nativeBuildInputs; + }); + + # RaspberryPi + ubootRaspberryPi3_btrfs = prev.buildUBoot { + defconfig = "rpi_3_defconfig"; + extraConfig = '' + CONFIG_FS_BTRFS=y + CONFIG_CMD_BTRFS=y + ''; + extraMeta.platforms = ["aarch64-linux"]; + filesToInstall = ["u-boot.bin"]; }; - nodejs_18 = callPackageNodejs (prev.path + "/pkgs/development/web/nodejs/v18.nix") {}; - nodejs-slim_18 = callPackageNodejs (prev.path + "/pkgs/development/web/nodejs/v18.nix") {enableNpm = false;}; - nodejs_20 = callPackageNodejs (prev.path + "/pkgs/development/web/nodejs/v20.nix") {}; - nodejs-slim_20 = callPackageNodejs (prev.path + "/pkgs/development/web/nodejs/v20.nix") {enableNpm = false;}; - nodejs_22 = callPackageNodejs (prev.path + "/pkgs/development/web/nodejs/v22.nix") {}; - nodejs-slim_22 = callPackageNodejs (prev.path + "/pkgs/development/web/nodejs/v22.nix") {enableNpm = false;}; + + # NixPkgs patches + xdg-desktop-portal = prev.xdg-desktop-portal.overrideAttrs (oldAttrs: { + patches = + oldAttrs.patches + ++ [ + # https://github.com/NixOS/nixpkgs/pull/548762 + (final.fetchpatch { + url = "https://github.com/NixOS/nixpkgs/raw/4ba561388760a6fdfe376cbef28613b4366161ab/pkgs/by-name/xd/xdg-desktop-portal/allow-no-graphical-session-target.patch"; + hash = "sha256-55RFYk4Fzsj8xp6j0wg1AEz+9c05tqfNkPCP+z9czdI="; + }) + ]; + }); + #gnutls = + # if prev.stdenv.hostPlatform != prev.stdenv.buildPlatform + # then + # prev.gnutls.overrideAttrs (oldAttrs: { + # configureFlags = oldAttrs.configureFlags ++ ["--disable-doc"]; + # outputs = builtins.filter (v: v != "man" && v != "devdoc") oldAttrs.outputs; + # }) + # else prev.gnutls; + #git = + # if prev.stdenv.hostPlatform != prev.stdenv.buildPlatform + # then prev.git.override {rustSupport = false;} + # else prev.git; + gvproxy = + if prev.stdenv.hostPlatform.is32bit + then + # Downgrade to get 32bit support working + prev.gvproxy.overrideAttrs (oldAttrs: { + version = "0.8.6"; + src = oldAttrs.src.override { + rev = "v0.8.6"; + hash = "sha256-a/Gd1QUxZ+47sQtndbehx86UjC1DezhqwS5d5VTIjRc="; + }; + }) + else prev.gvproxy; # Older version of packages - flac1_3 = prev.flac.overrideAttrs { + flac134 = prev.flac.overrideAttrs { version = "1.3.4"; src = final.fetchurl { url = "http://downloads.xiph.org/releases/flac/flac-1.3.4.tar.xz"; hash = "sha256-j/BgfnWjIt181uxI9PIlRxQEricw0OqUUSexNVFV5zc="; }; outputs = ["out"]; + doCheck = false; }; } diff --git a/pkgs/dodo/default.nix b/pkgs/dodo/default.nix new file mode 100644 index 0000000..07ee8b1 --- /dev/null +++ b/pkgs/dodo/default.nix @@ -0,0 +1,37 @@ +{ + python3Packages, + fetchFromGitHub, + qt6, + copyDesktopItems, +}: +python3Packages.buildPythonApplication { + pname = "dodo"; + version = "20260730"; + pyproject = true; + + src = fetchFromGitHub { + owner = "akissinger"; + repo = "dodo"; + rev = "2d1c91a625ac026f7624f80a36b29c2a4bdd0f4f"; + hash = "sha256-v4eXwzmS3DFYQ/v8sQWnnsyGjflf+OhVbVNqXLrYmZE="; + }; + + build-system = with python3Packages; [ + setuptools + ]; + + dependencies = with python3Packages; [ + qt6.qtwayland + bleach + pyqt6 + pyqt6-webengine + python-gnupg + copyDesktopItems + ]; + + nativeBuildInputs = [qt6.wrapQtAppsHook]; + dontWrapQtApps = true; + preFixup = '' + wrapQtApp "$out/bin/dodo" --prefix PATH : $out/bin/dodo + ''; +} diff --git a/pkgs/elf-size-analyze/default.nix b/pkgs/elf-size-analyze/default.nix new file mode 100644 index 0000000..87d1161 --- /dev/null +++ b/pkgs/elf-size-analyze/default.nix @@ -0,0 +1,21 @@ +{ + python3Packages, + fetchFromGitHub, +}: +python3Packages.buildPythonApplication { + pname = "elf-size-analyze"; + version = "20250901"; + pyproject = true; + + src = fetchFromGitHub { + owner = "jedrzejboczar"; + repo = "elf-size-analyze"; + rev = "9cff8203c8616a1be2adfd1b8cd114069049ea58"; + hash = "sha256-HaLBwUBx51cvFKwhMCfy+0EOP3kNtsl19e7sKU893J0="; + }; + + build-system = with python3Packages; [ + setuptools + setuptools-git-versioning + ]; +} diff --git a/pkgs/mtk-arm-trusted-firmware/default.nix b/pkgs/mtk-arm-trusted-firmware/default.nix new file mode 100644 index 0000000..3c0ba33 --- /dev/null +++ b/pkgs/mtk-arm-trusted-firmware/default.nix @@ -0,0 +1,64 @@ +{ + lib, + stdenv, + fetchFromGitHub, + buildPackages, + openssl, + dtc, + filesToInstall, + platform ? null, + extraMakeFlags ? [], + extraMeta ? {}, +}: +stdenv.mkDerivation { + pname = "arm-trusted-firmware${lib.optionalString (platform != null) "-${platform}"}"; + version = "2025.07.11"; + + src = fetchFromGitHub { + owner = "mtk-openwrt"; + repo = "arm-trusted-firmware"; + rev = "78a0dfd927bb00ce973a1f8eb4079df0f755887a"; + hash = "sha256-m9ApkBVf0I11rNg68vxofGRJ+BcnlM6C+Zrn8TfMvbY="; + }; + + depsBuildBuild = [buildPackages.stdenv.cc]; + nativeBuildInputs = [dtc]; + buildInputs = [openssl]; + + makeFlags = + [ + "HOSTCC=$(CC_FOR_BUILD)" + "CROSS_COMPILE=${stdenv.cc.targetPrefix}" + # Make the new toolchain guessing (from 2.11+) happy + "CC=${stdenv.cc.targetPrefix}cc" + "LD=${stdenv.cc.targetPrefix}cc" + "AS=${stdenv.cc.targetPrefix}cc" + "OC=${stdenv.cc.targetPrefix}objcopy" + "OD=${stdenv.cc.targetPrefix}objdump" + # Passing OpenSSL path according to docs/design/trusted-board-boot-build.rst + "OPENSSL_DIR=${openssl}" + ] + ++ (lib.optional (platform != null) "PLAT=${platform}") + ++ extraMakeFlags; + + installPhase = '' + runHook preInstall + + mkdir -p $out + cp ${lib.concatStringsSep " " filesToInstall} $out + + runHook postInstall + ''; + + hardeningDisable = ["all"]; + dontStrip = true; + + meta = with lib; + { + homepage = "https://github.com/mtk-openwrt/arm-trusted-firmware"; + description = "MediaTek ARM Trusted Firmware"; + license = [licenses.bsd3]; + maintainers = with maintainers; [cynerd]; + } + // extraMeta; +} diff --git a/pkgs/python.nix b/pkgs/python.nix new file mode 100644 index 0000000..b1a76fd --- /dev/null +++ b/pkgs/python.nix @@ -0,0 +1,6 @@ +_: prev: { + # NixPkgs patches + sphinx-book-theme = prev.sphinx-book-theme.overrideAttrs { + pythonRelaxDeps = ["pydata-sphinx-theme"]; + }; +} diff --git a/pkgs/sdcv/default.nix b/pkgs/sdcv/default.nix deleted file mode 100644 index 8817270..0000000 --- a/pkgs/sdcv/default.nix +++ /dev/null @@ -1,33 +0,0 @@ -{ - lib, - stdenv, - fetchFromGitHub, - cmake, - pkg-config, - gettext, - zlib, - glib, - pcre, - readline, -}: -stdenv.mkDerivation (attrs: { - pname = "sdcv"; - version = "0.5.5"; - - src = fetchFromGitHub { - owner = "Dushistov"; - repo = attrs.pname; - rev = "v${attrs.version}"; - hash = "sha256-EyvljVXhOsdxIYOGTzD+T16nvW7/RNx3DuQ2OdhjXJ4="; - }; - - nativeBuildInputs = [cmake pkg-config gettext]; - buildInputs = [zlib glib pcre readline]; - makeFlags = "sdcv lang"; - - meta = with lib; { - description = "Console version of Stardict program"; - homepage = "https://dushistov.github.io/sdcv/"; - license = licenses.gpl2; - }; -}) diff --git a/pkgs/u-boot-add-openwrt-one.patch b/pkgs/u-boot-add-openwrt-one.patch new file mode 100644 index 0000000..a154b6c --- /dev/null +++ b/pkgs/u-boot-add-openwrt-one.patch @@ -0,0 +1,598 @@ +diff --git a/arch/arm/dts/openwrt-one.dts b/arch/arm/dts/openwrt-one.dts +new file mode 100644 +index 00000000000..5828310fb2d +--- /dev/null ++++ b/arch/arm/dts/openwrt-one.dts +@@ -0,0 +1,207 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Copyright (c) 2024 John Crispin <john@phrozen.org> ++ */ ++ ++/dts-v1/; ++#include "mt7981.dtsi" ++#include <dt-bindings/gpio/gpio.h> ++#include <dt-bindings/input/input.h> ++ ++/ { ++ #address-cells = <1>; ++ #size-cells = <1>; ++ model = "OpenWrt One"; ++ compatible = "openwrt,one", "mediatek,mt7981"; ++ chosen { ++ stdout-path = &uart0; ++ tick-timer = &timer0; ++ }; ++ ++ memory@40000000 { ++ device_type = "memory"; ++ reg = <0x40000000 0x10000000>; ++ }; ++ ++ keys { ++ compatible = "gpio-keys"; ++ ++ user { ++ label = "front"; ++ gpios = <&pio 0 GPIO_ACTIVE_LOW>; ++ linux,code = <BTN_0>; ++ }; ++ ++ reset { ++ label = "back"; ++ gpios = <&pio 1 GPIO_ACTIVE_LOW>; ++ linux,code = <BTN_1>; ++ }; ++ }; ++ ++ leds { ++ compatible = "gpio-leds"; ++ ++ red { ++ label = "red"; ++ gpios = <&pio 9 GPIO_ACTIVE_HIGH>; ++ }; ++ ++ white { ++ label = "white"; ++ gpios = <&pio 13 GPIO_ACTIVE_HIGH>; ++ }; ++ ++ green { ++ label = "green"; ++ gpios = <&pio 15 GPIO_ACTIVE_HIGH>; ++ }; ++ }; ++}; ++ ++&uart0 { ++ status = "okay"; ++}; ++ ++&pcie { ++ status = "okay"; ++}; ++ ++ð { ++ status = "okay"; ++ mediatek,gmac-id = <1>; ++ phy-mode = "gmii"; ++ phy-handle = <&phy0>; ++ ++ phy0: eth-phy@0 { ++ compatible = "ethernet-phy-ieee802.3-c22"; ++ reg = <0>; ++ }; ++}; ++ ++&pio { ++ spi_flash_pins: spi0-pins-func-1 { ++ mux { ++ function = "flash"; ++ groups = "spi0", "spi0_wp_hold"; ++ }; ++ ++ conf-pu { ++ pins = "SPI0_CS", "SPI0_HOLD", "SPI0_WP"; ++ drive-strength = <MTK_DRIVE_8mA>; ++ bias-pull-up = <MTK_PUPD_SET_R1R0_11>; ++ }; ++ ++ conf-pd { ++ pins = "SPI0_CLK", "SPI0_MOSI", "SPI0_MISO"; ++ drive-strength = <MTK_DRIVE_8mA>; ++ bias-pull-down = <MTK_PUPD_SET_R1R0_11>; ++ }; ++ }; ++ ++ spi2_flash_pins: spi2-spi2-pins { ++ mux { ++ function = "spi"; ++ groups = "spi2", "spi2_wp_hold"; ++ }; ++ ++ conf-pu { ++ pins = "SPI2_CS", "SPI2_HOLD", "SPI2_WP"; ++ drive-strength = <MTK_DRIVE_8mA>; ++ bias-pull-down = <MTK_PUPD_SET_R1R0_00>; ++ }; ++ ++ conf-pd { ++ pins = "SPI2_CLK", "SPI2_MOSI", "SPI2_MISO"; ++ drive-strength = <MTK_DRIVE_8mA>; ++ bias-pull-down = <MTK_PUPD_SET_R1R0_00>; ++ }; ++ }; ++}; ++ ++&spi0 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&spi_flash_pins>; ++ status = "okay"; ++ must_tx; ++ enhance_timing; ++ dma_ext; ++ ipm_design; ++ support_quad; ++ tick_dly = <2>; ++ sample_sel = <0>; ++ ++ spi_nand@0 { ++ compatible = "spi-nand"; ++ reg = <0>; ++ spi-max-frequency = <52000000>; ++ ++ partitions { ++ compatible = "fixed-partitions"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ++ partition@0 { ++ label = "bl2"; ++ reg = <0x0 0x100000>; ++ }; ++ ++ partition@200000 { ++ label = "ubi"; ++ reg = <0x100000 0xff00000>; ++ }; ++ }; ++ }; ++}; ++ ++&spi2 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&spi2_flash_pins>; ++ status = "okay"; ++ must_tx; ++ enhance_timing; ++ dma_ext; ++ ipm_design; ++ tick_dly = <2>; ++ sample_sel = <0>; ++ ++ spi_nor@0 { ++ compatible = "jedec,spi-nor"; ++ reg = <0>; ++ spi-max-frequency = <5000000>; ++ ++ partitions { ++ compatible = "fixed-partitions"; ++ #address-cells = <1>; ++ #size-cells = <1>; ++ ++ partition@00000 { ++ label = "bl2-nor"; ++ reg = <0x00000 0x0040000>; ++ }; ++ ++ partition@40000 { ++ label = "factory"; ++ reg = <0x40000 0x00C0000>; ++ }; ++ ++ partition@100000 { ++ label = "fip-nor"; ++ reg = <0x100000 0x0080000>; ++ }; ++ ++ partition@180000 { ++ label = "recovery"; ++ reg = <0x180000 0xc80000>; ++ }; ++ }; ++ }; ++}; ++ ++&watchdog { ++ status = "disabled"; ++}; +diff --git a/configs/mt7981_openwrt-one-nor_defconfig b/configs/mt7981_openwrt-one-nor_defconfig +new file mode 100644 +index 00000000000..c83d6f2a516 +--- /dev/null ++++ b/configs/mt7981_openwrt-one-nor_defconfig +@@ -0,0 +1,125 @@ ++CONFIG_ARM=y ++CONFIG_SYS_HAS_NONCACHED_MEMORY=y ++CONFIG_POSITION_INDEPENDENT=y ++CONFIG_ARCH_MEDIATEK=y ++CONFIG_TEXT_BASE=0x41e00000 ++CONFIG_SYS_MALLOC_F_LEN=0x4000 ++CONFIG_NR_DRAM_BANKS=1 ++CONFIG_ENV_SIZE=0x8000 ++CONFIG_DEFAULT_DEVICE_TREE="openwrt-one" ++CONFIG_OF_LIBFDT_OVERLAY=y ++CONFIG_TARGET_MT7981=y ++CONFIG_RESET_BUTTON_LABEL="back" ++CONFIG_SYS_LOAD_ADDR=0x46000000 ++CONFIG_DEBUG_UART_BASE=0x11002000 ++CONFIG_DEBUG_UART_CLOCK=40000000 ++CONFIG_DEBUG_UART=y ++CONFIG_FIT=y ++CONFIG_SPI_BOOT=y ++CONFIG_AUTOBOOT_MENU_SHOW=y ++CONFIG_USE_PREBOOT=y ++CONFIG_DEFAULT_FDT_FILE="openwrt-one" ++CONFIG_SYS_CBSIZE=512 ++CONFIG_SYS_PBSIZE=1049 ++CONFIG_LOGLEVEL=7 ++CONFIG_LOG=y ++CONFIG_BOARD_LATE_INIT=y ++CONFIG_HUSH_PARSER=y ++CONFIG_SYS_PROMPT="OpenWrt One> " ++CONFIG_SYS_MAXARGS=16 ++CONFIG_CMD_CPU=y ++CONFIG_CMD_LICENSE=y ++# CONFIG_BOOTM_NETBSD is not set ++# CONFIG_BOOTM_PLAN9 is not set ++# CONFIG_BOOTM_RTEMS is not set ++# CONFIG_BOOTM_VXWORKS is not set ++# CONFIG_CMD_BOOTEFI_BOOTMGR is not set ++CONFIG_CMD_BOOTMENU=y ++CONFIG_CMD_ASKENV=y ++CONFIG_CMD_ERASEENV=y ++CONFIG_CMD_ENV_FLAGS=y ++CONFIG_CMD_STRINGS=y ++# CONFIG_CMD_UNLZ4 is not set ++# CONFIG_CMD_UNZIP is not set ++CONFIG_CMD_DM=y ++CONFIG_CMD_GPIO=y ++CONFIG_CMD_PWM=y ++CONFIG_CMD_MTD=y ++CONFIG_CMD_PCI=y ++CONFIG_CMD_SF_TEST=y ++CONFIG_CMD_USB=y ++CONFIG_CMD_TFTPSRV=y ++CONFIG_CMD_RARP=y ++CONFIG_CMD_CDP=y ++CONFIG_CMD_SNTP=y ++CONFIG_CMD_LINK_LOCAL=y ++CONFIG_CMD_DHCP=y ++CONFIG_CMD_DNS=y ++CONFIG_CMD_PING=y ++CONFIG_CMD_PXE=y ++CONFIG_CMD_CACHE=y ++CONFIG_CMD_PSTORE=y ++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000 ++CONFIG_CMD_UUID=y ++CONFIG_CMD_HASH=y ++CONFIG_CMD_SMC=y ++CONFIG_CMD_FAT=y ++CONFIG_CMD_FS_GENERIC=y ++CONFIG_CMD_FS_UUID=y ++CONFIG_CMD_UBI=y ++CONFIG_CMD_UBI_RENAME=y ++CONFIG_ENV_OVERWRITE=y ++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y ++CONFIG_SYS_RELOC_GD_ENV_ADDR=y ++CONFIG_USE_DEFAULT_ENV_FILE=y ++CONFIG_DEFAULT_ENV_FILE="defenvs/openwrt-one-nor_env" ++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y ++CONFIG_VERSION_VARIABLE=y ++CONFIG_NET_RANDOM_ETHADDR=y ++CONFIG_BUTTON=y ++CONFIG_BUTTON_GPIO=y ++CONFIG_CLK=y ++CONFIG_GPIO_HOG=y ++CONFIG_LED=y ++CONFIG_LED_BLINK=y ++CONFIG_LED_GPIO=y ++# CONFIG_MMC is not set ++CONFIG_MTD=y ++CONFIG_DM_MTD=y ++CONFIG_MTD_SPI_NAND=y ++CONFIG_DM_SPI_FLASH=y ++CONFIG_SPI_FLASH_SFDP_SUPPORT=y ++CONFIG_SPI_FLASH_EON=y ++CONFIG_SPI_FLASH_GIGADEVICE=y ++CONFIG_SPI_FLASH_ISSI=y ++CONFIG_SPI_FLASH_MACRONIX=y ++CONFIG_SPI_FLASH_SPANSION=y ++CONFIG_SPI_FLASH_STMICRO=y ++CONFIG_SPI_FLASH_WINBOND=y ++CONFIG_SPI_FLASH_XMC=y ++CONFIG_SPI_FLASH_XTX=y ++CONFIG_SPI_FLASH_MTD=y ++CONFIG_UBI_SILENCE_MSG=y ++CONFIG_PHY_FIXED=y ++CONFIG_MEDIATEK_ETH=y ++CONFIG_PHY=y ++CONFIG_PHY_MTK_TPHY=y ++CONFIG_PINCTRL=y ++CONFIG_PINCONF=y ++CONFIG_PINCTRL_MT7981=y ++CONFIG_POWER_DOMAIN=y ++CONFIG_MTK_POWER_DOMAIN=y ++CONFIG_DM_PWM=y ++CONFIG_PWM_MTK=y ++CONFIG_DM_SERIAL=y ++CONFIG_SERIAL_RX_BUFFER=y ++CONFIG_MTK_SERIAL=y ++CONFIG_SPI=y ++CONFIG_DM_SPI=y ++CONFIG_MTK_SPIM=y ++CONFIG_USB=y ++CONFIG_USB_XHCI_HCD=y ++CONFIG_USB_XHCI_MTK=y ++CONFIG_USB_STORAGE=y ++CONFIG_UBIFS_SILENCE_MSG=y ++CONFIG_HEXDUMP=y +diff --git a/configs/mt7981_openwrt-one-spi-nand_defconfig b/configs/mt7981_openwrt-one-spi-nand_defconfig +new file mode 100644 +index 00000000000..ccca0a0c9dc +--- /dev/null ++++ b/configs/mt7981_openwrt-one-spi-nand_defconfig +@@ -0,0 +1,126 @@ ++CONFIG_ARM=y ++CONFIG_SYS_HAS_NONCACHED_MEMORY=y ++CONFIG_POSITION_INDEPENDENT=y ++CONFIG_ARCH_MEDIATEK=y ++CONFIG_TEXT_BASE=0x41e00000 ++CONFIG_SYS_MALLOC_F_LEN=0x4000 ++CONFIG_NR_DRAM_BANKS=1 ++CONFIG_DEFAULT_DEVICE_TREE="openwrt-one" ++CONFIG_OF_LIBFDT_OVERLAY=y ++CONFIG_TARGET_MT7981=y ++CONFIG_RESET_BUTTON_LABEL="back" ++CONFIG_SYS_LOAD_ADDR=0x46000000 ++CONFIG_DEBUG_UART_BASE=0x11002000 ++CONFIG_DEBUG_UART_CLOCK=40000000 ++CONFIG_DEBUG_UART=y ++CONFIG_FIT=y ++CONFIG_SPI_BOOT=y ++CONFIG_AUTOBOOT_MENU_SHOW=y ++CONFIG_USE_PREBOOT=y ++CONFIG_DEFAULT_FDT_FILE="openwrt-one" ++CONFIG_SYS_CBSIZE=512 ++CONFIG_SYS_PBSIZE=1049 ++CONFIG_LOGLEVEL=7 ++CONFIG_LOG=y ++CONFIG_BOARD_LATE_INIT=y ++CONFIG_HUSH_PARSER=y ++CONFIG_SYS_PROMPT="OpenWrt One> " ++CONFIG_SYS_MAXARGS=16 ++CONFIG_CMD_CPU=y ++CONFIG_CMD_LICENSE=y ++# CONFIG_BOOTM_NETBSD is not set ++# CONFIG_BOOTM_PLAN9 is not set ++# CONFIG_BOOTM_RTEMS is not set ++# CONFIG_BOOTM_VXWORKS is not set ++# CONFIG_CMD_BOOTEFI_BOOTMGR is not set ++CONFIG_CMD_BOOTMENU=y ++CONFIG_CMD_ASKENV=y ++CONFIG_CMD_ERASEENV=y ++CONFIG_CMD_ENV_FLAGS=y ++CONFIG_CMD_STRINGS=y ++# CONFIG_CMD_UNLZ4 is not set ++# CONFIG_CMD_UNZIP is not set ++CONFIG_CMD_DM=y ++CONFIG_CMD_GPIO=y ++CONFIG_CMD_PWM=y ++CONFIG_CMD_MTD=y ++CONFIG_CMD_PCI=y ++CONFIG_CMD_SF_TEST=y ++CONFIG_CMD_USB=y ++CONFIG_CMD_TFTPSRV=y ++CONFIG_CMD_RARP=y ++CONFIG_CMD_CDP=y ++CONFIG_CMD_SNTP=y ++CONFIG_CMD_LINK_LOCAL=y ++CONFIG_CMD_DHCP=y ++CONFIG_CMD_DNS=y ++CONFIG_CMD_PING=y ++CONFIG_CMD_PXE=y ++CONFIG_CMD_CACHE=y ++CONFIG_CMD_PSTORE=y ++CONFIG_CMD_PSTORE_MEM_ADDR=0x42ff0000 ++CONFIG_CMD_UUID=y ++CONFIG_CMD_HASH=y ++CONFIG_CMD_SMC=y ++CONFIG_CMD_FAT=y ++CONFIG_CMD_FS_GENERIC=y ++CONFIG_CMD_FS_UUID=y ++CONFIG_CMD_UBI=y ++CONFIG_CMD_UBI_RENAME=y ++CONFIG_ENV_OVERWRITE=y ++CONFIG_ENV_IS_IN_UBI=y ++CONFIG_SYS_REDUNDAND_ENVIRONMENT=y ++CONFIG_ENV_UBI_PART="ubi" ++CONFIG_ENV_UBI_VOLUME="ubootenv" ++CONFIG_ENV_UBI_VOLUME_REDUND="ubootenv2" ++CONFIG_SYS_RELOC_GD_ENV_ADDR=y ++CONFIG_USE_DEFAULT_ENV_FILE=y ++CONFIG_DEFAULT_ENV_FILE="defenvs/openwrt-one-spi-nand_env" ++CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG=y ++CONFIG_VERSION_VARIABLE=y ++CONFIG_NET_RANDOM_ETHADDR=y ++CONFIG_BUTTON=y ++CONFIG_BUTTON_GPIO=y ++CONFIG_CLK=y ++CONFIG_GPIO_HOG=y ++CONFIG_LED=y ++CONFIG_LED_BLINK=y ++CONFIG_LED_GPIO=y ++# CONFIG_MMC is not set ++CONFIG_MTD=y ++CONFIG_DM_MTD=y ++CONFIG_MTD_SPI_NAND=y ++CONFIG_DM_SPI_FLASH=y ++CONFIG_SPI_FLASH_SFDP_SUPPORT=y ++CONFIG_SPI_FLASH_EON=y ++CONFIG_SPI_FLASH_GIGADEVICE=y ++CONFIG_SPI_FLASH_ISSI=y ++CONFIG_SPI_FLASH_MACRONIX=y ++CONFIG_SPI_FLASH_SPANSION=y ++CONFIG_SPI_FLASH_STMICRO=y ++CONFIG_SPI_FLASH_WINBOND=y ++CONFIG_SPI_FLASH_XMC=y ++CONFIG_SPI_FLASH_XTX=y ++CONFIG_SPI_FLASH_MTD=y ++CONFIG_PHY_FIXED=y ++CONFIG_MEDIATEK_ETH=y ++CONFIG_PHY=y ++CONFIG_PHY_MTK_TPHY=y ++CONFIG_PINCTRL=y ++CONFIG_PINCONF=y ++CONFIG_PINCTRL_MT7981=y ++CONFIG_POWER_DOMAIN=y ++CONFIG_MTK_POWER_DOMAIN=y ++CONFIG_DM_PWM=y ++CONFIG_PWM_MTK=y ++CONFIG_DM_SERIAL=y ++CONFIG_SERIAL_RX_BUFFER=y ++CONFIG_MTK_SERIAL=y ++CONFIG_SPI=y ++CONFIG_DM_SPI=y ++CONFIG_MTK_SPIM=y ++CONFIG_USB=y ++CONFIG_USB_XHCI_HCD=y ++CONFIG_USB_XHCI_MTK=y ++CONFIG_USB_STORAGE=y ++CONFIG_HEXDUMP=y +diff --git a/defenvs/openwrt-one-nor_env b/defenvs/openwrt-one-nor_env +new file mode 100644 +index 00000000000..f3ffa599f5d +--- /dev/null ++++ b/defenvs/openwrt-one-nor_env +@@ -0,0 +1,48 @@ ++ethaddr_factory=mtd read factory 0x46000000 0x0 0x20000 && env readmem -b ethaddr 0x4600002a 0x6 ; setenv ethaddr_factory ++bl2_mtd_write=mtd erase bl2-nor && mtd write bl2-nor $loadaddr 0x0 0x40000 ++bl2_tftp_write=tftpboot $loadaddr $bootfile_bl2_nor && run bl2_mtd_write ++bootcmd=run check_button ; run led_start ; mtd read recovery ${loadaddr} ; bootm ; run led_loop_error ++bootconf=config-1 ++bootdelay=0 ++bootfile=openwrt-mediatek-filogic-openwrt_one-initramfs.itb ++bootfile_bl2_nor=openwrt-mediatek-filogic-openwrt_one-nor-preloader.bin ++bootfile_fip_nor=openwrt-mediatek-filogic-openwrt_one-nor-bl31-uboot.fip ++bootmenu_0=Initialize environment.=run _firstboot ++bootmenu_0d=Run default boot command.=run bootcmd ++bootmenu_1=Boot system via TFTP.=run tftp_boot ; run bootmenu_confirm_return ++bootmenu_2=[31mUnlock NOR. (Make sure the NOR/WP jumper is populated)[0m=sf probe 1:0 && sf protect unlock 0x0 0x1000000 ; run bootmenu_confirm_return ++bootmenu_3=[31mLoad BL31+U-Boot FIP via TFTP then write to NOR.[0m=run fip_tftp_write ; run bootmenu_confirm_return ++bootmenu_4=[31mLoad BL2 preloader via TFTP then write to NOR.[0m=run bl2_tftp_write ; run bootmenu_confirm_return ++bootmenu_5=[31mLoad recovery system via TFTP then write to NOR.[0m=run tftp_write ; run bootmenu_confirm_return ++bootmenu_6=[31mLock NOR. (Remove jumper afterwards)[0m=sf probe 1:0 && sf protect lock 0x0 0x1000000 ; run bootmenu_confirm_return ++bootmenu_7=Reboot.=reset ++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; bootmenu 60 ++bootmenu_default=0 ++bootmenu_delay=0 ++bootmenu_title= [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) ) [0;36m[SPI-NOR][0m ++check_button=if button front ; then run usb_recovery ; run led_loop_error ; fi ++fip_mtd_write=mtd erase fip-nor && mtd write fip-nor $loadaddr ++fip_tftp_write=tftpboot $loadaddr $bootfile_fip_nor && run fip_mtd_write ++ipaddr=192.168.11.11 ++led_done=led green off ; led white on ++led_loop_done=led white off ; led green on ; echo done ; while true ; do sleep 1 ; done ++led_loop_error=led white off ; led green off ; while true ; do led red on ; sleep 1 ; led red off ; sleep 1 ; done ++led_boot=led green on ; led white on ; led red on ++led_start=led green off ; led red off; led white on ++loadaddr=0x46000000 ++preboot=run led_boot ++recoverfile_bl2=openwrt-mediatek-filogic-openwrt_one-snand-preloader.bin ++recoverfile_ubi=openwrt-mediatek-filogic-openwrt_one-factory.ubi ++recovery_write_bl2=mtd erase bl2 && for offset in 0x0 0x40000 0x80000; do mtd write bl2 $loadaddr $offset 0x40000 ; done ++recovery_write_ubi=mtd erase ubi && mtd write ubi $loadaddr 0 ${filesize} ++serverip=192.168.11.23 ++tftp_boot=run led_start ; tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf ++tftp_write=run led_start ; tftpboot $loadaddr $bootfile && mtd erase recovery 0x0 ${filesize} && mtd write recovery $loadaddr 0x0 ${filesize} ++usb_pgood_delay=4000 ++usb_recovery=run led_start ; usb start && run usb_recovery_bl2 && run usb_recovery_ubi && run led_loop_done ++usb_recovery_bl2=fatload usb 0:1 ${loadaddr} ${recoverfile_bl2} && run recovery_write_bl2 ++usb_recovery_ubi=fatload usb 0:1 ${loadaddr} ${recoverfile_ubi} && run recovery_write_ubi ++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; bootmenu ++_init_env=setenv _init_env ; echo Initialize Env ; run ubi_create_env ; saveenv ++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title ++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title [33m$ver[0m" +diff --git a/defenvs/openwrt-one-spi-nand_env b/defenvs/openwrt-one-spi-nand_env +new file mode 100644 +index 00000000000..8d59dd3dd6d +--- /dev/null ++++ b/defenvs/openwrt-one-spi-nand_env +@@ -0,0 +1,62 @@ ++ethaddr_factory=mtd read factory 0x46000000 0x0 0x20000 && env readmem -b ethaddr 0x4600002a 0x6 ; setenv ethaddr_factory ++ipaddr=192.168.11.11 ++serverip=192.168.11.23 ++loadaddr=0x46000000 ++console=earlycon=uart8250,mmio32,0x11002000 console=ttyS0 ++bootcmd=run check_buttons ; run led_start ; run boot_calibration ; run boot_production ; run boot_recovery ++bootconf=config-1 ++bootdelay=0 ++bootfile=openwrt-mediatek-filogic-openwrt_one-initramfs.itb ++bootfile_bl2=openwrt-mediatek-filogic-openwrt_one-snand-preloader.bin ++bootfile_fip=openwrt-mediatek-filogic-openwrt_one-snand-bl31-uboot.fip ++bootfile_upg=openwrt-mediatek-filogic-openwrt_one-squashfs-sysupgrade.itb ++bootmenu_confirm_return=askenv - Press ENTER to return to menu ; run led_boot ; bootmenu 60 ++bootmenu_default=0 ++bootmenu_delay=0 ++bootmenu_title= [0;34m( ( ( [1;39mOpenWrt[0;34m ) ) ) [0;36m[SPI-NAND][0m ++bootmenu_0=Initialize environment.=run _firstboot ++bootmenu_0d=Run default boot command.=run boot_default ++bootmenu_1=Boot system via TFTP.=run boot_tftp ; run bootmenu_confirm_return ++bootmenu_2=Boot production system from NAND.=run boot_production ; run bootmenu_confirm_return ++bootmenu_3=Boot recovery system from NAND.=run boot_recovery ; run bootmenu_confirm_return ++bootmenu_4=Load production system via TFTP then write to NAND.=noboot=1 ; replacevol=1 ; run boot_tftp_production ; noboot= ; replacevol= ; run bootmenu_confirm_return ++bootmenu_5=Load recovery system via TFTP then write to NAND.=noboot=1 ; replacevol=1 ; run boot_tftp_recovery ; noboot= ; replacevol= ; run bootmenu_confirm_return ++bootmenu_6=[31mLoad BL31+U-Boot FIP via TFTP then write to NAND.[0m=run boot_tftp_write_fip ; run bootmenu_confirm_return ++bootmenu_7=[31mLoad BL2 preloader via TFTP then write to NAND.[0m=run boot_tftp_write_bl2 ; run bootmenu_confirm_return ++bootmenu_8=Reboot.=reset ++bootmenu_9=Reset all settings to factory defaults.=run reset_factory ; reset ++boot_default=run bootcmd ; run boot_recovery ; replacevol=1 ; run boot_tftp_forever ++boot_calibration=ubi read $loadaddr calibration && bootm $loadaddr#$bootconf ++boot_production=led white on ; run ubi_read_production && bootm $loadaddr#$bootconf ; led white off ++boot_recovery=led green on ; run ubi_read_recovery && bootm $loadaddr#$bootconf ; led green off ++boot_tftp=run led_start ; tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf ++boot_tftp_forever=led green off ; led white off ; led red on ; while true ; do run boot_tftp_recovery ; led red off ; sleep 1 ; done ++boot_tftp_production=tftpboot $loadaddr $bootfile_upg && test $replacevol = 1 && iminfo $loadaddr && run ubi_write_production ; if test $noboot = 1 ; then else bootm $loadaddr#$bootconf ; fi ++boot_tftp_recovery=tftpboot $loadaddr $bootfile && test $replacevol = 1 && iminfo $loadaddr && run ubi_write_recovery ; if test $noboot = 1 ; then else bootm $loadaddr#$bootconf ; fi ++boot_tftp=tftpboot $loadaddr $bootfile && bootm $loadaddr#$bootconf ++boot_tftp_write_fip=tftpboot $loadaddr $bootfile_fip && run ubi_write_fip && run reset_factory ++boot_tftp_write_bl2=tftpboot $loadaddr $bootfile_bl2 && run snand_write_bl2 ++check_buttons=if button front ; then run boot_recovery ; run boot_tftp ; run led_loop_error ; else if button back ; then ; run usb_recover ; run led_loop_error ; fi ; fi ++led_boot=led green on ; led white on ; led red on ++led_done=led green on ; led white off ; led red off ++led_loop_done=led white off ; led green on ; echo done ; while true ; do sleep 1 ; done ++led_loop_error=led white off ; led green off ; while true ; do led red on ; sleep 1 ; led red off ; sleep 1 ; done ++led_start=led white on ; led green off ; led red off ++preboot=run led_boot ++reset_factory=mw $loadaddr 0xff 0x1f000 ; ubi write $loadaddr ubootenv 0x1f000 ; ubi write $loadaddr ubootenv2 0x1f000 ; ubi remove rootfs_data ++snand_write_bl2=mtd erase bl2 && for offset in 0x0 0x40000 0x80000 0xc0000 ; do mtd write bl2 $loadaddr $offset 0x40000 ; done ++ubi_create_env=ubi check ubootenv || ubi create ubootenv 0x1f000 dynamic ; ubi check ubootenv2 || ubi create ubootenv2 0x1f000 dynamic ++ubi_prepare_rootfs=if ubi check rootfs_data ; then else if env exists rootfs_data_max ; then ubi create rootfs_data $rootfs_data_max dynamic || ubi create rootfs_data - dynamic ; else ubi create rootfs_data - dynamic ; fi ; fi ++ubi_read_production=ubi read $loadaddr fit && iminfo $loadaddr && run ubi_prepare_rootfs ++ubi_read_recovery=ubi check recovery && ubi read $loadaddr recovery ++ubi_remove_rootfs=ubi check rootfs_data && ubi remove rootfs_data ++usb_pgood_delay=4000 ++usb_recover=run led_start ; usb start && run usb_recover_production && run led_loop_done ++usb_recover_production=fatload usb 0:1 ${loadaddr} ${bootfile_upg} && iminfo $loadaddr && run ubi_write_production ++ubi_write_fip=run ubi_remove_rootfs ; ubi check fip && ubi remove fip ; ubi create fip $filesize static && ubi write $loadaddr fip $filesize ++ubi_write_production=ubi check fit && ubi remove fit ; run ubi_remove_rootfs ; ubi create fit $filesize dynamic && ubi write $loadaddr fit $filesize ++ubi_write_recovery=ubi check recovery && ubi remove recovery ; run ubi_remove_rootfs ; ubi create recovery $filesize dynamic && ubi write $loadaddr recovery $filesize ++_init_env=setenv _init_env ; run ubi_create_env ; saveenv ; saveenv ++_firstboot=setenv _firstboot ; run ethaddr_factory ; run _switch_to_menu ; run _init_env ; bootmenu ++_switch_to_menu=setenv _switch_to_menu ; setenv bootdelay 3 ; setenv bootmenu_delay 3 ; setenv bootmenu_0 $bootmenu_0d ; setenv bootmenu_0d ; run _bootmenu_update_title ++_bootmenu_update_title=setenv _bootmenu_update_title ; setenv bootmenu_title "$bootmenu_title [33m$ver[0m" |