diff options
Diffstat (limited to 'nixos')
26 files changed, 447 insertions, 358 deletions
diff --git a/nixos/configurations/adm-mpd.nix b/nixos/configurations/adm-mpd.nix deleted file mode 100644 index 47ac008..0000000 --- a/nixos/configurations/adm-mpd.nix +++ /dev/null @@ -1,48 +0,0 @@ -{ - config, - lib, - ... -}: let - inherit (lib) filterAttrs; -in { - system.stateVersion = "24.05"; - - cynerd.rpi = 3; - deploy = { - enable = true; - ssh.host = "nixos@mpd.adm"; - }; - - networking.wireless = { - enable = true; - networks = filterAttrs (n: _: n == "Nela") config.secrets.wifiNetworks; - secretsFile = "/run/secrets/wifi.secrets"; - userControlled.enable = true; - }; - - #services.pipewire = { - #enable = true; - #alsa.enable = true; - #pulse.enable = true; - #}; - #hardware.pulseaudio = { - # enable = true; - # systemWide = true; - # zeroconf.publish.enable = true; - #}; - - #services.spotifyd = { - # enable = true; - # settings.global = { - # device_name = "Adámkovi"; - # device = "sysdefault"; - # mixer = "Master"; - # bitrate = 320; - # cache_path = "/var/cahe/spotify"; - # no_audio_cache = true; - # volume_normalisation = true; - # normalisation_pregain = -10; - # initial_volume = 60; - # }; - #}; -} diff --git a/nixos/configurations/adm-omnia.nix b/nixos/configurations/adm-omnia.nix index 826563b..6df1098 100644 --- a/nixos/configurations/adm-omnia.nix +++ b/nixos/configurations/adm-omnia.nix @@ -7,6 +7,7 @@ in { deploy = { enable = true; ssh.host = "adm.cynerd.cz"; + configurationLimit = 16; }; cynerd = { @@ -37,9 +38,9 @@ in { }; services = { - journald.extraConfig = '' - SystemMaxUse=8G - ''; + journald.settings.Journal = { + SystemMaxUse = "8G"; + }; btrfs.autoScrub = { enable = true; @@ -52,17 +53,18 @@ in { }; }; + # Warning: This Omnia has broker WAN port thus LAN4 is used for WAN!!!!!!!! networking.useDHCP = false; systemd.network = { networks = { - "end2" = { - matchConfig.Name = "end2"; # Ensure that it is managed by systemd-networkd + "lan4" = { + matchConfig.Name = "lan4"; # Ensure that it is managed by systemd-networkd networkConfig.IPv6AcceptRA = false; }; "pppoe-wan" = { matchConfig.Name = "pppoe-wan"; networkConfig = { - BindCarrier = "end2"; + BindCarrier = "lan4"; DHCP = "ipv6"; IPv6AcceptRA = "no"; DHCPPrefixDelegation = "yes"; @@ -80,7 +82,7 @@ in { linkConfig.RequiredForOnline = "routable"; }; "lan-brlan" = { - matchConfig.Name = "lan*"; + matchConfig.Name = "lan0 lan1 lan2 lan3"; networkConfig.Bridge = "brlan"; bridgeVLANs = [ { @@ -96,7 +98,7 @@ in { services.pppd = { enable = true; peers."wan".config = '' - plugin pppoe.so end2 + plugin pppoe.so lan4 ifname pppoe-wan lcp-echo-interval 1 lcp-echo-failure 5 @@ -111,7 +113,7 @@ in { }; systemd.services = { "pppd-wan" = { - after = ["sys-subsystem-net-devices-end2.device"]; + after = ["sys-subsystem-net-devices-lan4.device"]; partOf = ["systemd-networkd.service"]; serviceConfig = { Restart = "always"; diff --git a/nixos/configurations/adm-omnia2.nix b/nixos/configurations/adm-omnia2.nix index fc5a92d..317ee62 100644 --- a/nixos/configurations/adm-omnia2.nix +++ b/nixos/configurations/adm-omnia2.nix @@ -5,6 +5,7 @@ deploy = { enable = true; ssh.host = "omnia2.adm"; + configurationLimit = 16; }; cynerd = { @@ -28,13 +29,15 @@ }; }; - services.journald.extraConfig = '' - SystemMaxUse=8G - ''; + services = { + journald.settings.Journal = { + SystemMaxUse = "8G"; + }; - services.btrfs.autoScrub = { - enable = true; - fileSystems = ["/"]; + btrfs.autoScrub = { + enable = true; + fileSystems = ["/"]; + }; }; networking = { diff --git a/nixos/configurations/binky.nix b/nixos/configurations/binky.nix index 9e3866f..f4f82fb 100644 --- a/nixos/configurations/binky.nix +++ b/nixos/configurations/binky.nix @@ -1,4 +1,4 @@ -{ +{lib, ...}: { system.stateVersion = "24.05"; nixpkgs.hostPlatform.system = "x86_64-linux"; deploy = { @@ -14,6 +14,7 @@ }; wifiClient = true; develop = true; + gaming = true; wireguard = true; openvpn.elektroline = true; }; @@ -85,4 +86,6 @@ enable = true; dataDir = "/home/cynerd"; }; + + programs.steam.enable = lib.mkForce false; } diff --git a/nixos/configurations/dean.nix b/nixos/configurations/dean.nix index a95d9f1..a1ec788 100644 --- a/nixos/configurations/dean.nix +++ b/nixos/configurations/dean.nix @@ -1,9 +1,17 @@ -{pkgs, ...}: { +{ + lib, + pkgs, + ... +}: { system.stateVersion = "24.05"; turris.board = "mox"; - deploy.enable = true; + deploy = { + enable = true; + configurationLimit = 8; + }; cynerd = { + devmin = true; wireguard = true; monitoring = { speedtest = true; @@ -15,9 +23,9 @@ hardware.enableAllFirmware = false; # No wifi so we do not need firmwares services = { - journald.extraConfig = '' - SystemMaxUse=512M - ''; + journald.settings.Journal = { + SystemMaxUse = "512M"; + }; btrfs.autoScrub = { enable = true; @@ -54,5 +62,29 @@ environment.systemPackages = with pkgs; [ #openocd tio + gnupg + ]; + + programs = { + fuse = { + enable = true; + userAllowOther = true; + }; + nix-ld.enable = true; + }; + boot.binfmt = { + emulatedSystems = ["x86_64-linux"]; + }; + environment.sessionVariables = { + NIX_LD_x86_64_linux = "${pkgs.buildPackages.glibc}/lib/ld-linux-x86-64.so.2"; + NIX_LD_LIBRARY_PATH_x86_64_linux = lib.makeLibraryPath (with pkgs.buildPackages; [ + stdenv.cc.cc + glibc + zlib + ]); + }; + systemd.tmpfiles.rules = [ + "d /lib64 0755 root root -" + "L+ /lib64/ld-linux-x86-64.so.2 - - - - ${pkgs.buildPackages.nix-ld}/libexec/nix-ld" ]; } diff --git a/nixos/configurations/gaspode.nix b/nixos/configurations/gaspode.nix deleted file mode 100644 index 5d6d090..0000000 --- a/nixos/configurations/gaspode.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ - system.stateVersion = "25.05"; - nixpkgs.hostPlatform.system = "armv7l-linux"; - - fileSystems = { - "/" = { - device = "/dev/mmcblk0p2"; - options = ["compress=lzo" "subvol=@nix"]; - }; - "/home" = { - device = "/dev/mmcblk0p2"; - options = ["compress=lzo" "subvol=@home"]; - }; - "/boot" = { - device = "/dev/mmcblk0p1"; - }; - }; -} diff --git a/nixos/configurations/lipwig.nix b/nixos/configurations/lipwig.nix index a3b2765..e0992f2 100644 --- a/nixos/configurations/lipwig.nix +++ b/nixos/configurations/lipwig.nix @@ -2,6 +2,7 @@ config, pkgs, inputModules, + lib, ... }: { imports = [inputModules.vpsadminos]; @@ -198,7 +199,7 @@ # Nextcloud ################################################################ services.nextcloud = { enable = true; - package = pkgs.nextcloud33; + package = pkgs.nextcloud34; https = true; hostName = "cloud.cynerd.cz"; datadir = "/nas/nextcloud"; @@ -233,59 +234,36 @@ }; maxUploadSize = "1G"; appstoreEnable = false; - extraApps = { - inherit - (config.services.nextcloud.package.packages.apps) - bookmarks - calendar - contacts - cookbook - deck - forms - groupfolders - impersonate - #maps - memories - notes - phonetrack - previewgenerator - spreed - tasks - twofactor_webauthn - ; - # Additional modules can be fetched with: - # NEXTCLOUD_VERSIONS=33 nix run .#nc4nix -- -apps "passwords,money,integration_github,integration_gitlab,fileslibreofficeedit" - analytics = pkgs.fetchNextcloudApp { - url = "https://github.com/Rello/analytics/releases/download/6.3.4/analytics.tar.gz"; - hash = "sha256-t/WJRIVdwfoomkUOTsH6f4MrXdRs+9XdK841I+FSdoE="; - license = "agpl3Plus"; - }; - flow_notifications = pkgs.fetchNextcloudApp { - url = "https://github.com/nextcloud-releases/flow_notifications/releases/download/v4.0.0/flow_notifications-v4.0.0.tar.gz"; - hash = "sha256-D+eGGb+Eto5JtmEsnGhrLp2dKyI6twek5rwKEJGMSxw="; - license = "agpl3Plus"; - }; - fileslibreofficeedit = pkgs.fetchNextcloudApp { - url = "https://github.com/allotropia/nextcloud_files_libreoffice_edit/releases/download/v2.0.1/fileslibreofficeedit.tar.gz"; - hash = "sha256-Xqx5snQWintYJG3Q1Crw22TkNw18DdADXkurMQqt3X8="; - license = "agpl3Plus"; - }; - integration_github = pkgs.fetchNextcloudApp { - url = "https://github.com/nextcloud-releases/integration_github/releases/download/v3.2.5/integration_github-v3.2.5.tar.gz"; - hash = "sha256-QAOKT1Flgsy0kivgP/yoIo1vggb3MwRTGsMaMoEhZEo="; - license = "agpl3Plus"; - }; - integration_gitlab = pkgs.fetchNextcloudApp { - url = "https://github.com/nextcloud-releases/integration_gitlab/releases/download/v5.0.0/integration_gitlab-v5.0.0.tar.gz"; - hash = "sha256-f0D9UrlX8bsf4BSTCzb9bN1gYKDlSY9JxmgO6el7HZw="; - license = "agpl3Plus"; - }; - passwords = pkgs.fetchNextcloudApp { - url = "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2026.5.0/passwords.tar.gz"; - hash = "sha256-SJh+MhO3PysP/qIgzZuyKVVjmNKgXoh06IdNRF4fSgQ="; - license = "agpl3Plus"; - }; - }; + extraApps = + { + inherit + (config.services.nextcloud.package.packages.apps) + bookmarks + calendar + contacts + cookbook + deck + forms + groupfolders + impersonate + #maps + memories + notes + phonetrack + previewgenerator + spreed + tasks + twofactor_webauthn + ; + } + // (lib.mapAttrs (n: v: + pkgs.fetchNextcloudApp { + inherit (v) url hash; + license = "agpl3Plus"; + }) + # Additional modules can be fetched with: + # NEXTCLOUD_VERSIONS=33 nix run .#nc4nix -- -apps "passwords,money,integration_github,integration_gitlab,fileslibreofficeedit" + (lib.importJSON ../nextcloud-extra-apps.json)); }; # Postgresql ############################################################### @@ -309,7 +287,7 @@ } ]; ensureDatabases = ["nextcloud" "monitoring"]; - extraPlugins = ps: [ps.timescaledb]; + #extensions = ps: [ps.timescaledb]; }; # SearX #################################################################### diff --git a/nixos/configurations/ridcully.nix b/nixos/configurations/ridcully.nix index 9f3ed57..e454b2c 100644 --- a/nixos/configurations/ridcully.nix +++ b/nixos/configurations/ridcully.nix @@ -86,16 +86,16 @@ dataDir = "/home/cynerd"; }; - octoprint = { - enable = true; - openFirewall = true; - }; + #octoprint = { + # enable = true; + # openFirewall = true; + #}; - mjpg-streamer = { - enable = true; - inputPlugin = "input_uvc.so -d /dev/video2 -r 1920x1080 -f 30"; - outputPlugin = "output_http.so -p 5001 -w @www@"; - }; + #mjpg-streamer = { + # enable = true; + # inputPlugin = "input_uvc.so -d /dev/video2 -r 1920x1080 -f 30"; + # outputPlugin = "output_http.so -p 5001 -w @www@"; + #}; }; networking.firewall.allowedTCPPorts = [5001]; diff --git a/nixos/configurations/spt-mox.nix b/nixos/configurations/spt-mox.nix index 4dfa2c8..d1e9208 100644 --- a/nixos/configurations/spt-mox.nix +++ b/nixos/configurations/spt-mox.nix @@ -31,9 +31,9 @@ boot.initrd.availableKernelModules = ["dm-mod"]; services = { - journald.extraConfig = '' - SystemMaxUse=512M - ''; + journald.settings.Journal = { + SystemMaxUse = "512M"; + }; btrfs.autoScrub = { enable = true; diff --git a/nixos/configurations/spt-mox2.nix b/nixos/configurations/spt-mox2.nix index 2e76449..1ddf23a 100644 --- a/nixos/configurations/spt-mox2.nix +++ b/nixos/configurations/spt-mox2.nix @@ -4,6 +4,7 @@ deploy = { enable = true; ssh.host = "mox2.spt"; + configurationLimit = 8; }; cynerd = { @@ -26,9 +27,9 @@ boot.initrd.availableKernelModules = ["dm-mod"]; services = { - journald.extraConfig = '' - SystemMaxUse=512M - ''; + journald.settings.Journal = { + SystemMaxUse = "512M"; + }; btrfs.autoScrub = { enable = true; diff --git a/nixos/configurations/spt-mpd.nix b/nixos/configurations/spt-mpd.nix deleted file mode 100644 index 1849d9b..0000000 --- a/nixos/configurations/spt-mpd.nix +++ /dev/null @@ -1,16 +0,0 @@ -{inputModules, ...}: { - imports = [inputModules.nixos-hardware.raspberry-pi-2]; - - config = { - system.stateVersion = "24.05"; - nixpkgs.hostPlatform.system = "armv7l-linux"; - - fileSystems = { - "/" = { - device = "/dev/mmcblk0p1"; - fsType = "btrfs"; - options = ["compress=lzo"]; - }; - }; - }; -} diff --git a/nixos/configurations/spt-omnia.nix b/nixos/configurations/spt-omnia.nix index df19d82..e2d56e8 100644 --- a/nixos/configurations/spt-omnia.nix +++ b/nixos/configurations/spt-omnia.nix @@ -6,6 +6,7 @@ in { deploy = { enable = true; ssh.host = "spt.cynerd.cz"; + configurationLimit = 16; }; cynerd = { @@ -38,9 +39,9 @@ in { }; services = { - journald.extraConfig = '' - SystemMaxUse=8G - ''; + journald.settings.Journal = { + SystemMaxUse = "8G"; + }; btrfs.autoScrub = { enable = true; diff --git a/nixos/configurations/zd-mox.nix b/nixos/configurations/zd-mox.nix index 54cc150..225f13f 100644 --- a/nixos/configurations/zd-mox.nix +++ b/nixos/configurations/zd-mox.nix @@ -10,6 +10,7 @@ in { deploy = { enable = true; ssh.host = "zd.cynerd.cz"; + configurationLimit = 8; }; cynerd = { @@ -32,9 +33,9 @@ in { boot.initrd.availableKernelModules = ["dm-mod"]; services = { - journald.extraConfig = '' - SystemMaxUse=512M - ''; + journald.settings.Journal = { + SystemMaxUse = "512M"; + }; btrfs.autoScrub = { enable = true; diff --git a/nixos/configurations/zd-one0.nix b/nixos/configurations/zd-one0.nix index 98d9691..dc261cd 100644 --- a/nixos/configurations/zd-one0.nix +++ b/nixos/configurations/zd-one0.nix @@ -1,34 +1,38 @@ -_: { +{config, ...}: { system.stateVersion = "25.11"; deploy = { enable = true; - ssh.host = "zd-one0"; + #ssh.host = "zd-one0"; + ssh.host = "one0nix"; }; cynerd = { openwrtone = true; - #switch = { - # enable = true; - # lanAddress = "10.8.12.10/24"; - # lanGateway = config.cynerd.hosts.spt.omnia; - #}; - #wifiAP.zd = { - # enable = false; - # qca988x = { - # interface = "wlp1s0"; - # bssids = config.secrets.wifiMacs.zd-mox.qca988x; - # channel = 36; - # }; - #}; + switch = { + enable = true; + lanAddress = "${config.cynerd.hosts.zd.one0nix}/24"; + lanGateway = config.cynerd.hosts.zd.mox; + }; + wifiAP.zd = { + enable = false; + wlan0 = { + bssids = [ + "20:05:b7:00:4c:02" + "20:05:b7:04:4c:02" + "20:05:b7:08:4c:02" + ]; + channel = 7; + }; + }; }; boot.initrd.availableKernelModules = ["dm-mod"]; boot.consoleLogLevel = 7; services = { - journald.extraConfig = '' - SystemMaxUse=8G - ''; + journald.settings.Journal = { + SystemMaxUse = "32G"; + }; btrfs.autoScrub = { enable = true; @@ -41,21 +45,21 @@ _: { }; }; - networking.useDHCP = false; - networking.useNetworkd = true; - - systemd.network = { - networks = { - "eth0" = { - matchConfig.Name = "eth0"; - networkConfig = { - Address = "10.8.2.10/24"; - Gateway = "10.8.2.1"; - DNS = "1.1.1.1"; - IPv6AcceptRA = "yes"; - }; - }; + networking = { + useNetworkd = true; + useDHCP = false; + }; + systemd.network.networks = { + "lan-brlan" = { + matchConfig.Name = "end*"; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 1; + PVID = 1; + } + {VLAN = 2;} + ]; }; - wait-online.anyInterface = true; }; } diff --git a/nixos/modules/compile.nix b/nixos/modules/compile.nix index 3c90345..332a095 100644 --- a/nixos/modules/compile.nix +++ b/nixos/modules/compile.nix @@ -20,7 +20,10 @@ in { cores = 0; }; - boot.binfmt.emulatedSystems = ["armv7l-linux" "aarch64-linux" "riscv32-linux"]; + boot.binfmt = { + emulatedSystems = ["armv7l-linux" "aarch64-linux" "riscv32-linux"]; + preferStaticEmulators = true; + }; environment.systemPackages = with pkgs; [ # Tools @@ -28,9 +31,6 @@ in { bash #uroot qemu - - # Python - python3Packages.pip ]; }; } diff --git a/nixos/modules/desktop.nix b/nixos/modules/desktop.nix index 63eba7d..a321577 100644 --- a/nixos/modules/desktop.nix +++ b/nixos/modules/desktop.nix @@ -37,6 +37,8 @@ in { wrapperFeatures.gtk = true; extraPackages = with pkgs; [ + appimage-run + dconf-editor glib gsettings-desktop-schemas @@ -59,7 +61,7 @@ in { wl-mirror slurp grim - wf-recorder + #wf-recorder wl-clipboard wl-color-picker swayidle @@ -114,7 +116,6 @@ in { yt-dlp spotify - nordic nordzy-cursor-theme nordzy-icon-theme adwaita-icon-theme @@ -161,7 +162,6 @@ in { gst_all_1.gst-plugins-ugly gst_all_1.gst-plugins-rs gst_all_1.gst-libav - gst_all_1.gst-vaapi # Writing typst @@ -170,10 +170,10 @@ in { vale # CAD - freecad + #freecad kicad sweethome3d.application - #qelectrotech + qelectrotech super-slicer ] ++ (optionals cnf.laptop [ @@ -189,9 +189,9 @@ in { nativeMessagingHosts.packages = with pkgs; [browserpass]; }; - nix-ld = { + fuse = { enable = true; - libraries = with pkgs; [libXpm]; + userAllowOther = true; }; usbkey = { @@ -254,7 +254,7 @@ in { xserver.xkb.options = "grp:alt_shift_toggle,caps:escape"; # Gnome crypto services (GnuPG) - dbus.packages = [pkgs.gcr]; + dbus.packages = [pkgs.gcr_4]; pipewire = { enable = true; @@ -289,8 +289,33 @@ in { }; saned.enable = true; avahi.enable = true; + samba = { + enable = false; + openFirewall = true; + settings = { + global = { + "workgroup" = "WORKGROUP"; + "server string" = "smbnix"; + "netbios name" = "smbnix"; + "security" = "user"; + "hosts allow" = "0.0.0.0/0"; + "guest account" = "nobody"; + "map to guest" = "bad user"; + }; + public = { + "path" = "/mnt/public"; + "browseable" = "yes"; + "read only" = "no"; + "guest ok" = "yes"; + "create mask" = "0644"; + "directory mask" = "0755"; + "force user" = "cynerd"; + "force group" = "cynerd"; + }; + }; + }; samba-wsdd = { - enable = true; + enable = false; discovery = true; }; #davfs2.enable = true; TODO!!! @@ -369,13 +394,13 @@ in { }; # Support running app images - boot.binfmt.registrations.appimage = { - wrapInterpreterInShell = false; - interpreter = "${pkgs.appimage-run}/bin/appimage-run"; - recognitionType = "magic"; - offset = 0; - mask = ''\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff''; - magicOrExtension = ''\x7fELF....AI\x02''; - }; + #boot.binfmt.registrations.appimage = { + # wrapInterpreterInShell = false; + # interpreter = "${pkgs.appimage-run}/bin/appimage-run"; + # recognitionType = "magic"; + # offset = 0; + # mask = ''\xff\xff\xff\xff\x00\x00\x00\x00\xff\xff\xff''; + # magicOrExtension = ''\x7fELF....AI\x02''; + #}; }; } diff --git a/nixos/modules/develop.nix b/nixos/modules/develop.nix index 69c58bc..8b413a9 100644 --- a/nixos/modules/develop.nix +++ b/nixos/modules/develop.nix @@ -15,10 +15,13 @@ in { }; config = mkIf config.cynerd.develop { - cynerd.compile = true; - environment.enableDebugInfo = true; + cynerd = { + devmin = true; + compile = true; + }; environment.systemPackages = with pkgs; [ # Tools + git-lfs gitlint tig gitg @@ -33,6 +36,7 @@ in { vim-language-server vale can-utils + unixtools.xxd # Required for neovim plugins editorconfig-checker @@ -64,12 +68,14 @@ in { # C clang-tools + bear #massif-visualizer elf-size-analyze # Python (python3.withPackages (pypkgs: with pypkgs; [ + pip ipython python-lsp-server @@ -141,6 +147,9 @@ in { virt-manager cdrtools + # Docker + docker-credential-helpers + # U-Boot ubootTools tftp-hpa @@ -181,6 +190,43 @@ in { # package = pkgs.wireshark; #}; + programs.nix-ld = { + enable = true; + libraries = with pkgs; [ + alsa-lib + at-spi2-atk + cairo + cups + dbus + expat + gdk-pixbuf + glib + gtk3 + libGL + libXpm + libdrm + libgbm + libgcrypt + libsoup_3 + libudev0-shim + libusb1 + libx11 + libxcb + libxcomposite + libxdamage + libxext + libxfixes + libxkbcommon + libxrandr + nspr + nss + openssl + pango + udev + webkitgtk_4_1 + ]; + }; + documentation = { nixos = { enable = true; @@ -190,19 +236,18 @@ in { doc.enable = true; }; - services = { - udev.extraRules = '' - SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="3748", MODE:="0660", GROUP="develop", SYMLINK+="stlinkv2_%n" - SUBSYSTEMS=="usb", ATTRS{idVendor}=="a600", ATTRS{idProduct}=="a003", MODE:="0660", GROUP="develop", SYMLINK+="aix_forte_%n" - SUBSYSTEMS=="usb", ATTRS{idVendor}=="1366", ATTRS{idProduct}=="0105", MODE:="0660", GROUP="develop", SYMLINK+="jlink_%n" - SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2111", MODE:="0660", GROUP="develop", SYMLINK+="cmsip_dap_%n" - SUBSYSTEMS=="usb", ATTRS{idVendor}=="1ab1", ATTRS{idProduct}=="0e11", MODE:="0660", GROUP="develop" - SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="1001", MODE:="0660", GROUP="develop", TAG+="uaccess" - SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="1002", MODE:="0660", GROUP="develop", TAG+="uaccess" - ''; - - guix.enable = true; - }; + services.guix.enable = true; + #environment.etc."guix/machines.scm".text = '' + # (list (build-machine + # (name "czellembsrv.elektroline.cz") + # (systems (list "x86_64-linux" "i686-linux")) + # (host-key "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQZIwdzBo5CvMjS0M9tKYG2ikqPmSgSKRa/UPAoyhBC root@embsrv") + # (user "kkoci") + # (private-key "/home/cynerd/.ssh/elektroline-emb") + # (parallel-builds 16) + # (speed 2.0) + # )) + #''; virtualisation = { containers.enable = true; @@ -212,15 +257,20 @@ in { storageDriver = "btrfs"; }; lxc.enable = true; - libvirtd.enable = true; + libvirtd = { + enable = true; + qemu = { + swtpm.enable = true; + vhostUserPackages = with pkgs; [virtiofsd]; + }; + }; spiceUSBRedirection.enable = true; }; + networking.firewall.trustedInterfaces = ["virbr0"]; - users.groups.develop = {}; users.users.cynerd.extraGroups = [ "docker" "lxd" - "develop" "libvirtd" ]; }; diff --git a/nixos/modules/devmin.nix b/nixos/modules/devmin.nix new file mode 100644 index 0000000..767cf2c --- /dev/null +++ b/nixos/modules/devmin.nix @@ -0,0 +1,37 @@ +{ + config, + lib, + ... +}: let + inherit (lib) mkOption mkIf types; +in { + options = { + cynerd.devmin = mkOption { + type = types.bool; + default = false; + description = "If machine is about to be used for remote development."; + }; + }; + + config = mkIf config.cynerd.devmin { + environment.enableDebugInfo = true; + + users.groups.develop = {}; + users.users.cynerd.extraGroups = [ + "develop" + ]; + + services.udev.extraRules = '' + SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="3748", MODE:="0660", GROUP="develop", SYMLINK+="stlinkv2_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="a600", ATTRS{idProduct}=="a003", MODE:="0660", GROUP="develop", SYMLINK+="aix_forte_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="1366", ATTRS{idProduct}=="0105", MODE:="0660", GROUP="develop", SYMLINK+="jlink_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="03eb", ATTRS{idProduct}=="2111", MODE:="0660", GROUP="develop", SYMLINK+="cmsip_dap_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="bef3", MODE:="0660", GROUP="develop", SYMLINK+="xds110_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="1cbe", ATTRS{idProduct}=="00ff", MODE:="0660", GROUP="develop", SYMLINK+="xds110_update_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="0451", ATTRS{idProduct}=="16a2", MODE:="0660", GROUP="develop", SYMLINK+="ccdebugger_%n" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="1ab1", ATTRS{idProduct}=="0e11", MODE:="0660", GROUP="develop" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="1001", MODE:="0660", GROUP="develop", TAG+="uaccess" + SUBSYSTEMS=="usb", ATTRS{idVendor}=="303a", ATTRS{idProduct}=="1002", MODE:="0660", GROUP="develop", TAG+="uaccess" + ''; + }; +} diff --git a/nixos/modules/hosts.nix b/nixos/modules/hosts.nix index 0263d1c..0aafb12 100644 --- a/nixos/modules/hosts.nix +++ b/nixos/modules/hosts.nix @@ -32,6 +32,7 @@ in { # Network "mox" = "10.8.0.1"; "one0" = "10.8.0.2"; + "one0nix" = "10.8.0.3"; "camera1" = "10.8.0.21"; "camera2" = "10.8.0.22"; # Local diff --git a/nixos/modules/monitoring.nix b/nixos/modules/monitoring.nix index 481854c..96761b9 100644 --- a/nixos/modules/monitoring.nix +++ b/nixos/modules/monitoring.nix @@ -32,6 +32,12 @@ in { config = mkMerge [ (mkIf cnf.enable { + # Glances + services.glances = { + enable = true; + openFirewall = true; + }; + # Telegraf configuration services.telegraf = { enable = true; diff --git a/nixos/modules/openwrtone.nix b/nixos/modules/openwrtone.nix index c70dcbc..b4ffe06 100644 --- a/nixos/modules/openwrtone.nix +++ b/nixos/modules/openwrtone.nix @@ -56,7 +56,7 @@ in { }; # Use OpenWrt One specific kernel. It fixes SError with patch. - kernelPackages = mkDefault (pkgs.linuxPackagesFor pkgs.linux_7_0); + kernelPackages = mkDefault (pkgs.linuxPackagesFor pkgs.linux_7_2); kernelParams = [ "fw_devlink=permissive" "clk_ignore_unused" diff --git a/nixos/modules/router.nix b/nixos/modules/router.nix index 1c8f4cc..b01c94a 100644 --- a/nixos/modules/router.nix +++ b/nixos/modules/router.nix @@ -180,7 +180,7 @@ in { enable = true; settings.Resolve = { FallbackDNS = ["1.1.1.1" "8.8.8.8"]; - DNSStubListenerExtra=[cnf.lanIP "192.168.1.1"]; + DNSStubListenerExtra = [cnf.lanIP "192.168.1.1"]; # TODO possibly enforce DNSSEC again }; }; diff --git a/nixos/modules/rpi.nix b/nixos/modules/rpi.nix index e4e10fe..08a2e91 100644 --- a/nixos/modules/rpi.nix +++ b/nixos/modules/rpi.nix @@ -68,9 +68,9 @@ in { }; }; - services.journald.extraConfig = '' - SystemMaxUse=512M - ''; + services.journald.settings.Journal = { + SystemMaxUse = "512M"; + }; system.build.firmware = pkgs.callPackage ({stdenvNoCC}: stdenvNoCC.mkDerivation { diff --git a/nixos/modules/wifi-spt.nix b/nixos/modules/wifi-spt.nix index bec093e..dc1de09 100644 --- a/nixos/modules/wifi-spt.nix +++ b/nixos/modules/wifi-spt.nix @@ -21,7 +21,7 @@ wpaPasswordFile = "/run/secrets/hostapd-TurrisRules.pass"; }; settings = mkIf is2g { - ieee80211w = 0; + ieee80211w = mkForce 0; wpa_key_mgmt = mkForce "WPA-PSK"; # force use without sha256 }; }; diff --git a/nixos/modules/wifi-zd.nix b/nixos/modules/wifi-zd.nix index 107fdf4..c275fc3 100644 --- a/nixos/modules/wifi-zd.nix +++ b/nixos/modules/wifi-zd.nix @@ -3,70 +3,10 @@ lib, ... }: let - inherit (lib) mkOption mkEnableOption types mkIf mkForce mkMerge hostapd elemAt; + inherit (lib) mkOption mkEnableOption types mkIf mkForce elemAt; cnf = config.cynerd.wifiAP.zd; - wifi-networks = name: let - is2g = cnf."${name}".channel <= 14; - in { - "${cnf."${name}".interface}" = { - bssid = elemAt cnf."${name}".bssids 0; - ssid = "UNas${ - if is2g - then "" - else "5" - }"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-UNas.pass"; - }; - settings = mkIf is2g { - ieee80211w = 0; - wpa_key_mgmt = mkForce "WPA-PSK"; # force use without sha256 - }; - }; - "${cnf."${name}".interface}.guest" = { - bssid = elemAt cnf."${name}".bssids 1; - ssid = "Koci"; - authentication = { - mode = "wpa2-sha256"; - wpaPasswordFile = "/run/secrets/hostapd-Koci.pass"; - }; - }; - }; - - net-networks = name: { - "lan-${cnf."${name}".interface}" = { - matchConfig = { - Name = cnf."${name}".interface; - WLANInterfaceType = "ap"; - }; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 1; - PVID = 1; - } - ]; - }; - "lan-${cnf."${name}".interface}-guest" = { - matchConfig.Name = "${cnf."${name}".interface}.guest"; - networkConfig.Bridge = "brlan"; - bridgeVLANs = [ - { - EgressUntagged = 2; - PVID = 2; - } - ]; - }; - }; - - wOptions = card: channelDefault: { - interface = mkOption { - type = with types; nullOr str; - default = null; - description = "Specify interface for ${card}"; - }; + wOptions = { bssids = mkOption { type = with types; listOf str; default = []; @@ -74,16 +14,15 @@ }; channel = mkOption { type = types.ints.positive; - default = channelDefault; - description = "Channel to be used for ${card}"; + description = "Channel to be used"; }; }; in { options = { cynerd.wifiAP.zd = { - enable = mkEnableOption "Enable Wi-Fi Access Point support"; - ar9287 = wOptions "Qualcom Atheros AR9287" 7; - qca988x = wOptions "Qualcom Atheros QCA988x" 36; + enable = mkEnableOption "Enable Wi-Fi Access Point support (OpenWrt One)"; + wlan0 = wOptions; + wlan1 = wOptions; }; }; @@ -94,44 +33,80 @@ in { ''; services.hostapd = { enable = true; - radios = mkMerge [ - (mkIf (cnf.ar9287.interface != null) { - "${cnf.ar9287.interface}" = { - inherit (cnf.ar9287) channel; - countryCode = "CZ"; - wifi4 = { - enable = true; - inherit (hostapd.qualcomAtherosAR9287.wifi4) capabilities; - }; - networks = wifi-networks "ar9287"; + radios = { + "wlan0" = { + inherit (cnf.wlan0) channel; + countryCode = "CZ"; + wifi4 = { + enable = true; + capabilities = [ + "HT40" + "SHORT-GI-20" + "SHORT-GI-40" + "TX-STBC" + "RX-STBC1" + "MAX-AMSDU-7935" + ]; }; - }) - (mkIf (cnf.qca988x.interface != null) { - "${cnf.qca988x.interface}" = let - is2g = cnf.qca988x.channel <= 14; - in { - inherit (cnf.qca988x) channel; - countryCode = "CZ"; - band = - if is2g - then "2g" - else "5g"; - wifi4 = { - enable = true; - inherit (hostapd.qualcomAtherosQCA988x.wifi4) capabilities; + networks = { + "wlan0" = { + bssid = elemAt cnf.wlan0.bssids 0; + ssid = "UNas"; + authentication = { + mode = "wpa2-sha256"; + wpaPasswordFile = "/run/secrets/hostapd-UNas.pass"; + }; + }; + "wlan0.guest" = { + bssid = elemAt cnf.wlan0.bssids 1; + ssid = "Koci"; + authentication = { + mode = "wpa2-sha256"; + wpaPasswordFile = "/run/secrets/hostapd-Koci.pass"; + }; }; - wifi5 = { - enable = !is2g; - inherit (hostapd.qualcomAtherosQCA988x.wifi5) capabilities; + "wlan0.iotd" = { + bssid = elemAt cnf.wlan0.bssids 2; + ssid = "IOTD"; + authentication = { + mode = "wpa2-sha256"; + wpaPasswordFile = "/run/secrets/hostapd-IOTD.pass"; + }; + settings = { + ieee80211w = mkForce 0; + wpa_key_mgmt = mkForce "WPA-PSK"; # force use without sha256 + }; }; - networks = wifi-networks "qca988x"; }; - }) - ]; + }; + #"wlan1" = { + #}; + }; + }; + systemd.network.networks = { + "lan-wlan0" = { + matchConfig = { + Name = "wlan0 wlan0.iotd"; + WLANInterfaceType = "ap"; + }; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 1; + PVID = 1; + } + ]; + }; + "lan-wlan0-guest" = { + matchConfig.Name = "wlan0.guest"; + networkConfig.Bridge = "brlan"; + bridgeVLANs = [ + { + EgressUntagged = 2; + PVID = 2; + } + ]; + }; }; - systemd.network.networks = mkMerge [ - (mkIf (cnf.ar9287.interface != null) (net-networks "ar9287")) - (mkIf (cnf.qca988x.interface != null) (net-networks "qca988x")) - ]; }; } diff --git a/nixos/nextcloud-extra-apps.json b/nixos/nextcloud-extra-apps.json new file mode 100644 index 0000000..29be7b0 --- /dev/null +++ b/nixos/nextcloud-extra-apps.json @@ -0,0 +1,52 @@ +{ + "fileslibreofficeedit": { + "hash": "sha256-Xqx5snQWintYJG3Q1Crw22TkNw18DdADXkurMQqt3X8=", + "url": "https://github.com/allotropia/nextcloud_files_libreoffice_edit/releases/download/v2.0.1/fileslibreofficeedit.tar.gz", + "version": "2.0.1", + "description": "This adds a new context menu item to the Files dropdown menu \"Edit with LibreOffice\".\nClicking that item will open the file in LibreOffice via WebDAV (the file can then be edited and saved back directly in LibreOffice).\n\nThis greatly improves the user experience when working with Office files in the browser. No need to download, edit, reupload. Instead use the \"Edit with LibreOffice\" item.\n\nThis app requires at least LibreOffice 7.2 on Linux and macOS. On Windows it also works with older LibreOffice versions (since LibreOffice 5.3).", + "homepage": "https://github.com/allotropia/nextcloud_files_libreoffice_edit", + "licenses": [ + "agpl" + ] + }, + "integration_github": { + "hash": "sha256-7fdQzM4yaFJ9To8lIoiQ4IgfKPGqh8ZXnVxy0Xzo+q8=", + "url": "https://github.com/nextcloud-releases/integration_github/releases/download/v3.2.6/integration_github-v3.2.6.tar.gz", + "version": "3.2.6", + "description": "GitHub integration provides a dashboard widget displaying your most important notifications\n and a unified search provider for repositories, issues and pull requests. It also provides a link reference provider\n to render links to issues, pull requests and comments in Talk and Text.", + "homepage": "https://github.com/nextcloud/integration_github", + "licenses": [ + "agpl" + ] + }, + "integration_gitlab": { + "hash": "sha256-f0D9UrlX8bsf4BSTCzb9bN1gYKDlSY9JxmgO6el7HZw=", + "url": "https://github.com/nextcloud-releases/integration_gitlab/releases/download/v5.0.0/integration_gitlab-v5.0.0.tar.gz", + "version": "5.0.0", + "description": "GitLab integration provides a dashboard widget displaying your most important notifications\n and a unified search provider for repositories, issues and merge requests.", + "homepage": "https://github.com/nextcloud/integration_gitlab", + "licenses": [ + "agpl" + ] + }, + "money": { + "hash": "sha256-bEcKzgItP/Bs336qXAI72cGFXkPVNSfzMjrYQ5212K8=", + "url": "https://github.com/powerpaul17/nc_money/releases/download/v0.32.0/money.tar.gz", + "version": "0.32.0", + "description": "Finance manager for Nextcloud.", + "homepage": "https://github.com/powerpaul17/nc_money", + "licenses": [ + "agpl" + ] + }, + "passwords": { + "hash": "sha256-8ER2MqyePpERD7RRfw8Hq5xNx+s8vUhPbDyJ2JvU/ho=", + "url": "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2026.7.0/passwords.tar.gz", + "version": "2026.7.20", + "description": "Passwords is the most advanced password manager for Nextcloud and allows you to manage and store your passwords safely in your own cloud.\nThe intuitive and modern web interface of the app makes it easy to update and add new passwords from anywhere.\nIncluded security checks help you to keep your online accounts safe and up-to-date.\nYou can also share passwords with other Nextcloud users.\n\n**Features**\n * Intuitive and modern user interface\n * Password security monitor\n * Secure encryption\n * Folders & tags\n * Sharing\n * Dashboard Widget\n * API for apps\n * Extensive handbook\n * Import & Export\n * Browser extensions & Apps\n * ... and many more to come\n\n**Support**\n * [Official Chat](https://matrix.to/#/#nextcloud-passwords:chat.passwordsapp.org)\n * [Official Forum](https://help.nextcloud.com/tag/passwords-app)\n * [User Handbook](https://git.mdns.eu/nextcloud/passwords/-/wikis/Users/Index)\n * [Administrator Handbook](https://git.mdns.eu/nextcloud/passwords/-/wikis/Administrators/Index)\n\n**Apps & Extensions**\n * [Official Firefox Add-On](https://addons.mozilla.org/de/firefox/addon/nextcloud-passwords?utm_source=app&utm_medium=nc-apps)\n * [Official Chrome Extension](https://chrome.google.com/webstore/detail/nextcloud-passwords/mhajlicjhgoofheldnmollgbgjheenbi)\n * [Official Microsoft Edge Extension](https://microsoftedge.microsoft.com/addons/detail/cjmlcljdpphgdfpkngjcmeepdpcgpffk)\n * [Android App](https://play.google.com/store/apps/details?id=de.jbservices.nc_passwords_app) by [joleaf](https://gitlab.com/joleaf/nc-passwords-app)\n * [Android App](https://play.google.com/store/apps/details?id=com.hegocre.nextcloudpasswords) by [hegocre](https://github.com/hegocre/NextcloudPasswords)\n * [Windows App (WIP)](https://www.microsoft.com/store/apps/9NXVZ0ZP6D5Z) by [j0chn](https://gitlab.com/j0chn/nextcloud_password_client)\n * [Linux App (WIP)](https://gitlab.com/j0chn/nextcloud_password_client/-/tree/main#linux) by [j0chn](https://gitlab.com/j0chn/nextcloud_password_client)\n * [macOS App (WIP)](https://gitlab.com/j0chn/nextcloud_password_client/-/tree/main#mac-os) by [j0chn](https://gitlab.com/j0chn/nextcloud_password_client)\n * [iOS App](https://apps.apple.com/app/id1546212226) by [Johannes Schliephake](https://github.com/johannes-schliephake/nextcloud-passwords-ios)", + "homepage": "https://passwordsapp.org/", + "licenses": [ + "agpl" + ] + } +} |