palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

workhorse using flake

Browse source
This commit is contained in:
Ingolf Wagner 2021-10-31 17:49:44 +01:00
parent 11d07f2dd8
commit 87be340dfa
No known key found for this signature in database
GPG key ID: 76BF5F1928B9618B
17 changed files with 126 additions and 190 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
flake.lock
View file

@ -62,7 +62,7 @@
"secrets": { "secrets": {
"flake": false, "flake": false,
"locked": { "locked": {
"narHash": "sha256-7kNQHKkMjjTBPgRzHh34KqbcorqgEyGcu8UQfFxEvb8=", "narHash": "sha256-tsXsKNsa6/AqhXV6YxsSweX++YlwzQuWt0KeaV3SMgQ=",
"path": "/home/palo/dev/secrets", "path": "/home/palo/dev/secrets",
"type": "path" "type": "path"
}, },

1
nixos/configs/pepe/taskwarrior-pushover.nix
View file

@ -11,6 +11,7 @@
services.taskwarrior-pushover = { services.taskwarrior-pushover = {
enable = true; enable = true;
recurrence="on";
onCalendar = "06:30:00"; onCalendar = "06:30:00";
server = "taskd.ingolf-wagner.de:53589"; server = "taskd.ingolf-wagner.de:53589";
pushoverApiTokenFile = config.sops.secrets.pushoverApiToken.path; pushoverApiTokenFile = config.sops.secrets.pushoverApiToken.path;

44
nixos/configs/workhorse/configuration.nix
View file

@ -4,43 +4,45 @@
../../system/server ../../system/server
./hardware-configuration.nix ./hardware-configuration.nix
./mail-fetcher.nix
./transmission.nix
./nextcloud.nix
./borg.nix
./finance.nix
./gogs.nix ./gogs.nix
./grafana.nix ./grafana.nix
./graylog.nix ./graylog.nix
./jenkins.nix ./jenkins.nix
./kibana.nix ./kibana.nix
./mail-fetcher.nix ./mysql.nix
./packages.nix ./packages.nix
./prometheus.nix ./prometheus.nix
./syncthing.nix ./syncthing.nix
./taskserver.nix ./taskserver.nix
./tinc.nix ./tinc.nix
./transmission.nix
./weechat.nix ./weechat.nix
./nextcloud.nix
./borg.nix #./property.nix # flask sucks, find something else
#./metabase.nix
#./jupyter.nix
./mysql.nix
#./property.nix flask sucks, find something else
./finance.nix
#./mining.nix
]; ];
sops.defaultSopsFile = ../../secrets/workhorse.yaml;
nixpkgs.config.permittedInsecurePackages = nixpkgs.config.permittedInsecurePackages =
[ "gogs-0.11.91" "nextcloud-19.0.6" ]; [ "gogs-0.11.91" ];
# todo: add this to each file instead summing that here # todo: add this to each file instead summing that here
on-failure.plans = { #on-failure.plans = {
gogs.name = "gogs"; # gogs.name = "gogs";
jenkins.name = "jenkins"; # jenkins.name = "jenkins";
graylog.name = "graylog"; # graylog.name = "graylog";
prometheus.name = "prometheus"; # prometheus.name = "prometheus";
taskserver.name = "taskserver"; # taskserver.name = "taskserver";
weechat.name = "weechat"; # weechat.name = "weechat";
transmission.name = "transmission"; # transmission.name = "transmission";
mail-fetcher.name = "fetchmail"; # mail-fetcher.name = "fetchmail";
}; #};
networking.hostName = "workhorse"; networking.hostName = "workhorse";

4
nixos/configs/workhorse/finance.nix
View file

@ -17,7 +17,7 @@ let
# ]; # ];
# results in # results in
# P 2020-01-30 GOOGL $123 # P 2020-01-30 GOOGL $123
stocks = import <secrets/finance/stocks>; stocks = import ../../private_assets/finance/stocks;
stocksFile = toString /home/syncthing/finance/hledger/stocks.journal; stocksFile = toString /home/syncthing/finance/hledger/stocks.journal;
in { in {
@ -32,7 +32,7 @@ in {
script = let script = let
command = { symbol, name, currency, ... }: '' command = { symbol, name, currency, ... }: ''
APIKEY=${lib.fileContents <secrets/finance/alphavantage/apikey>} APIKEY=${lib.fileContents ../../private_assets/finance/alphavantage/apiKey}
SYMBOL="${symbol}" SYMBOL="${symbol}"
${pkgs.curl}/bin/curl --location --silent \ ${pkgs.curl}/bin/curl --location --silent \
"https://www.alphavantage.co/query?function=GLOBAL_QUOTE&symbol=$SYMBOL&apikey=$APIKEY" \ "https://www.alphavantage.co/query?function=GLOBAL_QUOTE&symbol=$SYMBOL&apikey=$APIKEY" \

4
nixos/configs/workhorse/graylog.nix
View file

@ -45,11 +45,11 @@ in {
# pwgen -N 1 -s 96 # pwgen -N 1 -s 96
services.graylog.passwordSecret = services.graylog.passwordSecret =
lib.fileContents <secrets/graylog/password-secret>; lib.fileContents ../../private_assets/graylog/password-secret;
# echo -n yourpassword | shasum -a 256 # echo -n yourpassword | shasum -a 256
services.graylog.rootPasswordSha2 = services.graylog.rootPasswordSha2 =
lib.fileContents <secrets/graylog/root-password-hash>; lib.fileContents ../../private_assets/graylog/root-password-hash;
services.graylog.plugins = [ pkgs.graylogPlugins.slack ]; services.graylog.plugins = [ pkgs.graylogPlugins.slack ];

4
nixos/configs/workhorse/jenkins.nix
View file

@ -36,9 +36,11 @@ in {
}; };
}; };
sops.secrets.jenkins_token = { };
krops.userKeys."accessToken" = { krops.userKeys."accessToken" = {
user = "jenkins"; user = "jenkins";
source = toString <secrets/jenkins/accessToken>; source = config.sops.secrets.jenkins_token.path;
requiredBy = [ "jenkins-job-builder.service" ]; requiredBy = [ "jenkins-job-builder.service" ];
}; };

120
nixos/configs/workhorse/mail-fetcher.nix
View file

@ -424,47 +424,20 @@ in {
home = "/home/mailfetcher"; home = "/home/mailfetcher";
openssh.authorizedKeys.keyFiles = openssh.authorizedKeys.keyFiles =
config.users.users.root.openssh.authorizedKeys.keyFiles; config.users.users.root.openssh.authorizedKeys.keyFiles;
group = "mailfetcher";
}; };
# configure passwords users.groups.mailUser = {
krops.userKeys = { name = "mailfetcher";
"namecheap.terranix.org" = {
user = config.users.users.mailUser.name;
source = toString <secrets/mail/namecheap/terranix.org>;
requiredBy = [ "fetchmail.service" ];
};
"gmail.palipalo9" = {
user = config.users.users.mailUser.name;
source = toString <secrets/mail/gmail/palipalo9>;
requiredBy = [ "fetchmail.service" ];
};
"gmx.palo_van_dalo" = {
user = config.users.users.mailUser.name;
source = toString <secrets/mail/gmx/palo_van_dalo>;
requiredBy = [ "fetchmail.service" ];
};
"gmx.ingolf_wagner" = {
user = config.users.users.mailUser.name;
source = toString <secrets/mail/gmx/ingolf.wagner>;
requiredBy = [ "fetchmail.service" ];
};
"web.pali_palo" = {
user = config.users.users.mailUser.name;
source = toString <secrets/mail/web.de/pali_palo>;
requiredBy = [ "fetchmail.service" ];
};
"siteground.contact" = {
user = config.users.users.mailUser.name;
source = toString <secrets/mail/siteground/contact>;
requiredBy = [ "fetchmail.service" ];
};
"c-base.palo" = {
user = config.users.users.mailUser.name;
source = toString <secrets/mail/c-base/palo>;
requiredBy = [ "fetchmail.service" ];
};
}; };
sops.secrets.mail_terranix.owner = "mailUser";
sops.secrets.mail_gmail.owner = "mailUser";
sops.secrets.mail_gmx_palo.owner = "mailUser";
sops.secrets.mail_gmx_ingolf.owner = "mailUser";
sops.secrets.mail_web.owner = "mailUser";
sops.secrets.mail_siteground.owner = "mailUser";
environment.systemPackages = [ pkgs.muchsync ]; environment.systemPackages = [ pkgs.muchsync ];
# configure accounts # configure accounts
@ -478,7 +451,7 @@ in {
realName = "Ingolf Wagner"; realName = "Ingolf Wagner";
userName = "palo_van_dalo@gmx.de"; userName = "palo_van_dalo@gmx.de";
passwordCommand = passwordCommand =
"cat ${toString config.krops.userKeys."gmx.palo_van_dalo".target}"; "cat ${toString config.sops.secrets.mail_gmx_palo.path }";
imap = { imap = {
host = "imap.gmx.net"; host = "imap.gmx.net";
tls.enable = true; tls.enable = true;
@ -498,7 +471,7 @@ in {
realName = "Ingolf Wagner"; realName = "Ingolf Wagner";
userName = "ingolf.wagner@gmx.de"; userName = "ingolf.wagner@gmx.de";
passwordCommand = passwordCommand =
"cat ${toString config.krops.userKeys."gmx.ingolf_wagner".target}"; "cat ${toString config.sops.secrets.mail_gmx_ingolf.path }";
imap = { imap = {
host = "imap.gmx.net"; host = "imap.gmx.net";
tls.enable = true; tls.enable = true;
@ -518,7 +491,7 @@ in {
realName = "Ingolf Wagner"; realName = "Ingolf Wagner";
userName = "pali_palo@web.de"; userName = "pali_palo@web.de";
passwordCommand = passwordCommand =
"cat ${toString config.krops.userKeys."web.pali_palo".target}"; "cat ${toString config.sops.secrets.mail_web.path }";
imap = { imap = {
host = "imap.web.de"; host = "imap.web.de";
tls.enable = true; tls.enable = true;
@ -531,57 +504,6 @@ in {
notmuch.enable = true; notmuch.enable = true;
}; };
c-base = {
primary = false;
address = "palo@c-base.org";
aliases = [ ];
realName = "Ingolf Wagner";
userName = "palo";
passwordCommand =
"cat ${toString config.krops.userKeys."c-base.palo".target}";
imap = {
host = "c-mail.c-base.org";
port = 993;
# fetched using : nix-shell -p openssl --run "openssl s_client -connect c-mail.c-base.org:993 -showcerts"
tls.certificatesFile = pkgs.writeText "c-base.pem" ''
-----BEGIN CERTIFICATE-----
MIIFKDCCAxCgAwIBAgIDAtwrMA0GCSqGSIb3DQEBDQUAMFQxFDASBgNVBAoTC0NB
Y2VydCBJbmMuMR4wHAYDVQQLExVodHRwOi8vd3d3LkNBY2VydC5vcmcxHDAaBgNV
BAMTE0NBY2VydCBDbGFzcyAzIFJvb3QwHhcNMTkxMTA5MDgzMjUyWhcNMjExMTA4
MDgzMjUyWjBhMQswCQYDVQQGEwJERTEPMA0GA1UECBMGQmVybGluMQ8wDQYDVQQH
EwZCZXJsaW4xFDASBgNVBAoTC2MtYmFzZSBlLlYuMRowGAYDVQQDExFjLW1haWwu
Yy1iYXNlLm9yZzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKR3XBxJ
72MayCS0D5GCoHcY0TQLs1DQSohCCobRdSowFJzNQw/2lL6bb+Q2rmevZQXuM4vP
YbFytvTDmY5y5MNXEqGLfi8D5TcaP/RdXWQU++yUunE6yMdqZNheeXPjM//PnoXG
DyT236BovEi3YipUUsLXFiRj+cAjrQE7a2YUs3fjV3P6grMH0V06J6P6+JJvRgp2
K33uhKhnKyb3s1tbdbu1KeGozx2ws9lg79XV+Py6PXxP6jTZ2PCsaxs3BThSdmsl
vQyk/zoW7tA1m2ntRCoyFHZqfOHsN3UOS/HDRlXqgSf0ah8cPYPsl0ayXhgOv0Tu
1PSMt4Ve2GajX8MCAwEAAaOB9TCB8jAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQE
AwIDqDA0BgNVHSUELTArBggrBgEFBQcDAgYIKwYBBQUHAwEGCWCGSAGG+EIEAQYK
KwYBBAGCNwoDAzAzBggrBgEFBQcBAQQnMCUwIwYIKwYBBQUHMAGGF2h0dHA6Ly9v
Y3NwLmNhY2VydC5vcmcvMDgGA1UdHwQxMC8wLaAroCmGJ2h0dHA6Ly9jcmwuY2Fj
ZXJ0Lm9yZy9jbGFzczMtcmV2b2tlLmNybDAtBgNVHREEJjAkghFjLW1haWwuYy1i
YXNlLm9yZ4IPbWFpbC5jLWJhc2Uub3JnMA0GCSqGSIb3DQEBDQUAA4ICAQBjTIa1
xdhUYXJidv1U0qaqSV1DzumakFY20OM4QCV0Qvlq+SQUqroGBTIGodxhTnjG5o01
4xBAnsTcMRNycXHu0j6XYqDS4QhaFcGdFmXP0EQfAFbvhwZdbvgiRHuUTSGEbcLp
Vk8sP8dpzx+zMAZ6PL7XMwPFPTHm7vw40qmTyCuUcnhIwHgwGxu4yu0tdsU+VwRD
RVsdZO4V2GhFTz8oRcHvmC2wmx+Zwx0RXWPXSN5yRDDZWwY4WbECa2MvojH1HlJG
YJkokq7nbYJix/RipSkAXgurcgppVmM5cf7uYgSrltW8pm3IMMPrlaFrlzMMMtdq
SYFk+FDp296B7CDyWpQhDcVjnGQ70JfMWT5S3Lsi8DnI2pul9ljxPOt+Q8XFh1oz
Ofr7y5Qjm72YToOX1j7N8ppCh0RJH4lOsouTPVdp859ch9FxZdceq+nC744wv+Nt
TQPw15Gk3RY5mVYBE/Cw2T7j7qDmBaEUKxkfW7q8t287FXM4XX6C+cKYr6jYx6s1
5/2p4gCuOALYqJ7kD2xjci0VTWu77H4J2QKEZF8AgdI36dIYr7GY0e/+xb/CScwr
uvu2R9jfPOMVu6CiavPGUtcvju4A+qMUDqIyH9dNwkMQRffAtmsF6KR4nMYxhr45
nKY1BaufWLD1UWrjaR1IF6L5qDHOXeMJEChYkg==
-----END CERTIFICATE-----'';
};
mbsync = {
enable = false;
create = "both";
};
notmuch.enable = true;
};
gmail = { gmail = {
# for google accounts you have to allow 'less secure apps' in accounts.google.com # for google accounts you have to allow 'less secure apps' in accounts.google.com
primary = true; primary = true;
@ -590,7 +512,7 @@ in {
realName = "Ingolf Wagner"; realName = "Ingolf Wagner";
userName = "palipalo9@googlemail.com"; userName = "palipalo9@googlemail.com";
passwordCommand = passwordCommand =
"cat ${toString config.krops.userKeys."gmail.palipalo9".target}"; "cat ${toString config.sops.secrets.mail_gmail.path }";
imap = { imap = {
host = "imap.gmail.com"; host = "imap.gmail.com";
tls.enable = true; tls.enable = true;
@ -609,9 +531,7 @@ in {
aliases = [ ]; aliases = [ ];
realName = "Ingolf Wagner"; realName = "Ingolf Wagner";
userName = "palo@terranix.org"; userName = "palo@terranix.org";
passwordCommand = "cat ${ passwordCommand = "cat ${toString config.sops.secrets.mail_terranix.path }";
toString config.krops.userKeys."namecheap.terranix.org".target
}";
imap = { imap = {
host = "mail.privateemail.com"; host = "mail.privateemail.com";
tls.enable = true; tls.enable = true;
@ -631,7 +551,7 @@ in {
realName = "Ingolf Wagner"; realName = "Ingolf Wagner";
userName = "contact@ingolf-wagner.de"; userName = "contact@ingolf-wagner.de";
passwordCommand = passwordCommand =
"cat ${toString config.krops.userKeys."siteground.contact".target}"; "cat ${toString config.sops.secrets.mail_siteground.path }";
imap = { imap = {
host = "securees5.sgcpanel.com"; host = "securees5.sgcpanel.com";
port = 993; port = 993;
@ -715,9 +635,9 @@ in {
enable = true; enable = true;
new.tags = [ "unread" "inbox" "new" ]; new.tags = [ "unread" "inbox" "new" ];
}; };
home-manager.users.mailUser.home.file."notmuch" = { #home-manager.users.mailUser.home.file."notmuch" = {
source = "${config.users.users.mailUser.home}/.config/notmuch/notmuchrc"; # source = "${config.users.users.mailUser.home}/.config/notmuch/notmuchrc";
target = ".notmuch-config"; # target = ".notmuch-config";
}; #};
} }

2
nixos/configs/workhorse/metabase.nix
View file

@ -1,4 +1,4 @@
{ pkgs, lib, config, ... }: { /{ pkgs, lib, config, ... }: {
services.metabase = { services.metabase = {
listen.port = 3040; listen.port = 3040;

56
nixos/configs/workhorse/nextcloud.nix
View file

@ -7,20 +7,32 @@ let
in { in {
sops.secrets.nextcloud_database_password = {};
sops.secrets.nextcloud_root_password = {};
containers.nextcloud = { containers.nextcloud = {
# mount host folders # mount host folders
bindMounts = { bindMounts = {
rootpassword = { rootpassword = {
hostPath = toString <secrets/nextcloud/root_password>; hostPath =
mountPoint = toString <secrets/nextcloud/root_password>; "/run/secrets/nextcloud_root_password";
#toString <secrets/nextcloud/root_password>;
mountPoint =
"/run/secrets/nextcloud_root_password";
#toString <secrets/nextcloud/root_password>;
isReadOnly = true; isReadOnly = true;
}; };
databasepassword = { databasepassword = {
hostPath = toString <secrets/nextcloud/database_password>; hostPath =
mountPoint = toString <secrets/nextcloud/database_password>; "/run/secrets/nextcloud_database_password";
#toString <secrets/nextcloud/database_password>;
mountPoint =
"/run/secrets/nextcloud_database_password";
#toString <secrets/nextcloud/database_password>;
isReadOnly = true; isReadOnly = true;
}; };
home = { home = {
# make sure this folder exist on the host # make sure this folder exist on the host
hostPath = toString "/home/nextcloud"; hostPath = toString "/home/nextcloud";
@ -33,17 +45,6 @@ in {
mountPoint = "/var/lib/mysql"; mountPoint = "/var/lib/mysql";
isReadOnly = false; isReadOnly = false;
}; };
krops-lib = {
mountPoint = toString <krops-lib>;
hostPath = toString <krops-lib>;
isReadOnly = true;
};
modules = {
mountPoint = toString <modules>;
hostPath = toString <modules>;
isReadOnly = true;
};
# shared folders
samples = { samples = {
mountPoint = mountPoint =
toString config.services.syncthing.declarative.folders.samples.path; toString config.services.syncthing.declarative.folders.samples.path;
@ -84,10 +85,7 @@ in {
config = { config, pkgs, lib, ... }: { config = { config, pkgs, lib, ... }: {
imports = [ <modules> <krops-lib> ];
services.nginx = { services.nginx = {
# Use recommended settings # Use recommended settings
recommendedGzipSettings = lib.mkDefault true; recommendedGzipSettings = lib.mkDefault true;
recommendedOptimisation = lib.mkDefault true; recommendedOptimisation = lib.mkDefault true;
@ -214,27 +212,20 @@ in {
https = true; https = true;
config = { config = {
adminpassFile = adminpassFile =
toString config.krops.userKeys."nextcloud_root".target; #config.sops.secrets.nextcloud_root_password.path;
"/run/secrets/nextcloud_root_password";
overwriteProtocol = "https"; overwriteProtocol = "https";
trustedProxies = [ "195.201.134.247" hostAddress ]; trustedProxies = [ "195.201.134.247" hostAddress ];
dbtype = "mysql"; dbtype = "mysql";
dbpassFile = dbpassFile =
toString config.krops.userKeys."nextcloud_database".target; #config.sops.secrets.nextcloud_database_password.path;
"/run/secrets/nextcloud_database_password";
dbport = 3306; dbport = 3306;
}; };
}; };
# provide password file for database with proper rights #sops.secrets.nextcloud_database_password = {};
krops.userKeys."nextcloud_database" = { #sops.secrets.nextcloud_root_password = {};
user = "nextcloud";
source = toString <secrets/nextcloud/database_password>;
requiredBy = [ "nginx.service" "nextcloud-setup.service" ];
};
krops.userKeys."nextcloud_root" = {
user = "nextcloud";
source = toString <secrets/nextcloud/root_password>;
requiredBy = [ "nginx.service" "nextcloud-setup.service" ];
};
environment.systemPackages = [ pkgs.smbclient ]; environment.systemPackages = [ pkgs.smbclient ];
@ -340,7 +331,8 @@ in {
doInit = true; doInit = true;
encryption = { encryption = {
mode = "repokey-blake2"; mode = "repokey-blake2";
passCommand = "cat ${toString <secrets/backup/repo>}"; passCommand =
"cat ${config.sops.secrets.backup_repository_passphrase.path}";
}; };
startAt = "0/3:00:00"; startAt = "0/3:00:00";
prune.keep = { prune.keep = {

34
nixos/configs/workhorse/prometheus.nix
View file

@ -84,23 +84,23 @@
}; };
}]; }];
} }
{ #{
job_name = "home-assistant"; # job_name = "home-assistant";
scrape_interval = "60s"; # scrape_interval = "60s";
metrics_path = "/api/prometheus"; # metrics_path = "/api/prometheus";
# you can create this token on your user profile page # # you can create this token on your user profile page
# http://pepe.private:8123/profile # # http://pepe.private:8123/profile
bearer_token = # bearer_token =
lib.fileContents <secrets/prometheus/home-assistant/api_token>; # lib.fileContents <secrets/prometheus/home-assistant/api_token>;
static_configs = [{ # static_configs = [{
targets = [ "pepe.private:8123" ]; # targets = [ "pepe.private:8123" ];
labels = { # labels = {
service = "hass"; # service = "hass";
server = "pepe"; # server = "pepe";
city = "essen"; # city = "essen";
}; # };
}]; # }];
} #}
]; ];
}; };
} }

8
nixos/configs/workhorse/syncthing.nix
View file

@ -11,14 +11,18 @@
}; };
}; };
sops.secrets.syncthing_cert = { };
sops.secrets.syncthing_key = { };
services.syncthing = { services.syncthing = {
enable = true; enable = true;
openDefaultPorts = false; openDefaultPorts = false;
dataDir = "/home/syncthing"; dataDir = "/home/syncthing";
configDir = "/home/syncthing"; configDir = "/home/syncthing";
declarative = { declarative = {
cert = toString <secrets/syncthing/cert.pem>; cert = toString config.sops.secrets.syncthing_cert.path;
key = toString <secrets/syncthing/key.pem>; key = toString config.sops.secrets.syncthing_key.path;
overrideFolders = true; overrideFolders = true;
folders = { folders = {

3
nixos/configs/workhorse/tinc.nix
View file

@ -17,4 +17,7 @@
}; };
}; };
sops.secrets.tinc_retiolum_ed25519_key = { };
sops.secrets.tinc_retiolum_rsa_key = { };
} }

19
nixos/configs/workhorse/transmission.nix
View file

@ -6,18 +6,20 @@ let
in { in {
sops.secrets.nordvpn = {};
containers.torrent = { containers.torrent = {
# mount host folders # mount host folders
bindMounts = { bindMounts = {
password = { #password = {
hostPath = toString <secrets/transmission/password>; # hostPath = "/run/secrets/transmission_password";
mountPoint = toString <secrets/transmission/password>; # mountPoint = "/run/secrets/transmission_password";
isReadOnly = true; # isReadOnly = true;
}; #};
nordvpnPassword = { nordvpnPassword = {
hostPath = toString <secrets/transmission/nordvpn.txt>; hostPath = "/run/secrets/nordvpn";
mountPoint = toString <secrets/transmission/nordvpn.txt>; mountPoint = "/run/secrets/nordvpn";
isReadOnly = true; isReadOnly = true;
}; };
home = { home = {
@ -183,7 +185,8 @@ in {
remote-cert-tls server remote-cert-tls server
auth-user-pass ${toString <secrets/transmission/nordvpn.txt>} auth-user-pass /run/secrets/nordvpn.txt
verb 3 verb 3
pull pull
resolv-retry infinite resolv-retry infinite

5
nixos/flake.nix
View file

@ -63,6 +63,11 @@
}) })
]; ];
}) })
home-manager.nixosModules.home-manager
{
home-manager.useGlobalPkgs = true;
home-manager.useUserPackages = true;
}
]; ];
desktopModules = [ desktopModules = [
home-manager.nixosModules.home-manager home-manager.nixosModules.home-manager

2
nixos/krops.nix
View file

@ -5,7 +5,7 @@ let
command = targetPath: command = targetPath:
let let
commandLine = commandLine =
"TMPDIR=/tmp nixos-rebuild switch --flake ${targetPath} -L --keep-going"; "TMPDIR=/tmp nixos-rebuild build --flake ${targetPath} -L --keep-going";
in '' in ''
echo '${commandLine}' echo '${commandLine}'
nix-shell \ nix-shell \

6
nixos/modules/services/taskwarrior-pushover.nix
View file

@ -13,6 +13,10 @@ in
type = str; type = str;
default = "4:00:00"; default = "4:00:00";
}; };
recurrence = mkOption {
type = enum["on" "off"];
default = "off";
};
pushoverApiTokenFile = mkOption { pushoverApiTokenFile = mkOption {
type = path; type = path;
}; };
@ -54,7 +58,7 @@ in
script = let script = let
taskwarriorCommand = pkgs.writers.writeDash "taskwarrior-push" '' taskwarriorCommand = pkgs.writers.writeDash "taskwarrior-push" ''
${pkgs.taskwarrior}/bin/task \ ${pkgs.taskwarrior}/bin/task \
rc.recurrence=off \ rc.recurrence=${cfg.recurrence} \
rc:/var/lib/${name}/.taskrc \ rc:/var/lib/${name}/.taskrc \
rc.data.location=/var/lib/${name}/${cfg.dataDir} \ rc.data.location=/var/lib/${name}/${cfg.dataDir} \
rc.taskd.ca=${cfg.caFile} \ rc.taskd.ca=${cfg.caFile} \

2
nixos/system/desktop/mail-stuff.nix
View file

@ -118,7 +118,7 @@ in {
enable = true; enable = true;
# msmtp --serverinfo --tls --tls-certcheck=off -a ingolf-wagner # msmtp --serverinfo --tls --tls-certcheck=off -a ingolf-wagner
tls.fingerprint = tls.fingerprint =
"F3:5C:9A:BF:82:35:78:AA:42:85:F5:D1:2A:08:B9:B4:56:6D:B7:BF:47:3B:37:B4:D8:B5:10:AE:0E:95:03:CD"; "16:94:47:E0:00:86:BB:F7:56:D3:81:F1:89:7B:CD:67:65:0B:EE:0B:A9:26:96:5E:0B:1F:56:AB:FD:DE:96:C5";
}; };
gpg = { gpg = {
encryptByDefault = true; encryptByDefault = true;