commit 058bfbfa8fc9d4a945f2455be24b02f96e8bdbe8
parent e34fc237e405e79dff3fa27f6124a4ec4a2e25ea
Author: vin <vin@vineetk.net>
Date: Sun, 21 Sep 2025 14:22:46 -0400
switch to exwm
Diffstat:
6 files changed, 80 insertions(+), 124 deletions(-)
diff --git a/home.nix b/home.nix
@@ -129,9 +129,9 @@ in
];
sessionVariables = {
- EDITOR = "nvim";
- VISUAL = "nvim";
- PAGER = "page";
+ EDITOR = "emacsclient -r";
+ VISUAL = "emacsclient -t";
+ PAGER = "less";
LESS = "-iR";
LESSHISTFILE = "/dev/null";
BROWSER = "qutebrowser";
@@ -304,6 +304,8 @@ in
aerc.enable = true;
+ emacs.enable = true;
+
foot = {
enable = true;
@@ -638,6 +640,16 @@ in
poweralertd.enable = true;
+ emacs = {
+ enable = false;
+ client.enable = true;
+ startWithUserSession = true;
+ extraOptions = [
+ "-f"
+ "exwm-wm-mode"
+ ];
+ };
+
redshift = {
enable = false;
dawnTime = "07:00";
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
@@ -59,7 +59,7 @@
# decrypt agenix secrets
age.secrets = {
wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
- wg1_demiurge.file = ../../secrets/wg1_demiurge.age;
+ tailscale_demiurge.file = ../../secrets/tailscale_demiurge.age;
};
# boot options
@@ -120,109 +120,33 @@
interface = "eth0";
};
- wireguard.interfaces = {
- # mullvad
- wg0 = {
- ips = [
- "10.68.117.111/32"
- "fc00:bbbb:bbbb:bb01::5:756e/128"
- ];
- privateKeyFile = config.age.secrets.wg0_demiurge.path;
-
- postSetup = ''
- ip route add 45.134.142.206 via 192.168.1.1
- ip route add default via 45.134.142.206
- '';
- postShutdown = ''
- ip route del default via 45.134.142.206
- ip route del 45.134.142.206 via 192.168.1.1
- '';
-
- peers = [
- {
- allowedIPs = [
- "0.0.0.0/0"
- "::0/0"
- ];
- endpoint = "45.134.142.206:51820";
- publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
- }
- ];
- };
-
- # epistemia
- wg1 = {
- ips = [
- "10.0.13.2/24"
- "fd00:b0ba:cafe:babe::2/64"
- ];
- privateKeyFile = config.age.secrets.wg1_demiurge.path;
- listenPort = 51820;
- fwMark = "51821";
- mtu = 1420;
-
- #table = "Off";
- postSetup = ''
- ip rule add from 10.0.13.0/24 lookup main pref 31000
- ip rule add from all fwmark 51821 lookup 51821 pref 32000
- ip route replace default via 192.168.1.1 dev eth0 table 51821
-
- # NAT iphonebob and allow traffic between peers (when routing through demiurge)
- ${pkgs.iptables}/bin/iptables -F FORWARD
- ${pkgs.iptables}/bin/iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
- ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT
- ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
- '';
- preShutdown = ''
- ip rule del from all fwmark 51821 lookup 51821 pref 32000
- ip rule del from 10.0.13.0/24 lookup main pref 31000
- ip route flush table 51821
-
- ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
- ${pkgs.iptables}/bin/iptables -F FORWARD
- '';
-
- peers = [
- # saklas
- {
- allowedIPs = [
- "10.0.13.1/32"
- "fd00:b0ba:cafe:babe::1/128"
- ];
- endpoint = "157.180.125.215:51820";
- persistentKeepalive = 25;
- publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
- }
- # hastur
- {
- allowedIPs = [
- "10.0.13.3/32"
- "fd00:b0ba:cafe:babe::3/128"
- ];
- persistentKeepalive = 25;
- publicKey = "MOmRjVbRuWEuK0oHQ+C0jTaceCUPd2fpzDbh8ue6bDc=";
- }
- # iphonebob
- {
- allowedIPs = [
- "10.0.13.4/32"
- "fd00:b0ba:cafe:babe::4/128"
- ];
- persistentKeepalive = 25;
- publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=";
- }
- # lab
- {
- allowedIPs = [
- "10.0.13.5/32"
- "fd00:b0ba:cafe:babe::5/128"
- ];
- persistentKeepalive = 25;
- publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
- }
- ];
- };
+ # mullvad
+ wireguard.interfaces.wg0 = {
+ ips = [
+ "10.68.117.111/32"
+ "fc00:bbbb:bbbb:bb01::5:756e/128"
+ ];
+ privateKeyFile = config.age.secrets.wg0_demiurge.path;
+
+ postSetup = ''
+ ip route add 45.134.142.206 via 192.168.1.1
+ ip route add default via 45.134.142.206
+ '';
+ postShutdown = ''
+ ip route del default via 45.134.142.206
+ ip route del 45.134.142.206 via 192.168.1.1
+ '';
+
+ peers = [
+ {
+ allowedIPs = [
+ "0.0.0.0/0"
+ "::0/0"
+ ];
+ endpoint = "45.134.142.206:51820";
+ publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
+ }
+ ];
};
};
@@ -390,6 +314,19 @@
};
};
+ # vpn
+ tailscale = {
+ enable = true;
+ authKeyFile = config.age.secrets.tailscale_demiurge.path;
+ disableTaildrop = true;
+ disableUpstreamLogging = true;
+ extraSetFlags = [ "--advertise-exit-node" ];
+ #extraUpFlags = [ "--login-server=https://headscale.13f0.net" ];
+ extraUpFlags = [ "--login-server=https://controlplane.tailscale.com" ];
+ openFirewall = true;
+ useRoutingFeatures = "both";
+ };
+
# automatically scrub zfs pools (every week by default)
zfs.autoScrub.enable = true;
@@ -1154,21 +1091,10 @@
# extra systemd stuff
systemd.services = {
- nginx = {
- after = [ "wireguard-wg1.service" ];
- requires = [ "wireguard-wg1.service" ];
- serviceConfig.Type = lib.mkForce "idle";
- };
-
- wireguard-wg0 = {
- after = [ "network-addresses-eth0.service" ];
- requires = [ "network-addresses-eth0.service" ];
- };
-
- wireguard-wg1 = {
- after = [ "wireguard-wg0.service" ];
- requires = [ "wireguard-wg0.service" ];
- };
+ #nginx = {
+ # after = [ "wireguard-wg1.service" ];
+ # serviceConfig.Type = lib.mkForce "idle";
+ #};
};
# create caches and use mandoc
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -20,8 +20,9 @@ in
"wg0_demiurge.age".publicKeys = users ++ [ demiurge ];
"wg0_hastur.age".publicKeys = users ++ [ hastur ];
- "wg1_demiurge.age".publicKeys = users ++ [ demiurge ];
- "wg1_hastur.age".publicKeys = users ++ [ hastur ];
+ "tailscale_demiurge.age".publicKeys = users ++ [ demiurge ];
+ "tailscale_hastur.age".publicKeys = users ++ [ hastur ];
+ "tailscale_saklas.age".publicKeys = users ++ [ saklas ];
"wpa_supplicant.age".publicKeys = users ++ [ hastur ];
}
diff --git a/secrets/tailscale_demiurge.age b/secrets/tailscale_demiurge.age
Binary files differ.
diff --git a/secrets/tailscale_hastur.age b/secrets/tailscale_hastur.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ ZhtqaDNCYfckXuWoIPlmf6VMSZIbEoKROUTVsC3QJ2w
+bQVjId8jiQXIUarsPUYwLEGof4W4b2gEOnL6ndd7hB8
+-> ssh-ed25519 CQpZUw f3XFvZLovkTydK2odqGU0UZd58s273diGLtku4uLSzQ
+puBoVJ9Cb+m00M1UivQBD2NbxB9QJgeg0W+tv49WW2I
+--- /4rFWR1tyCNnBgRlmH6Yku2GQwASTJ4GQbyQii0TZAo
+E,;l&L/@q.x 8(,hӾ_їY;aˌh`Zn(D5T ͒,فrr:SzkjG
+\ No newline at end of file
diff --git a/secrets/tailscale_saklas.age b/secrets/tailscale_saklas.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ CFompU5/+edOgTq43LDiW2D1QfWrOCDraA81AwkBfGM
+IxCXSQGTxY5XudpDZsszmRv6PTMwsuGjO926gABKfIY
+-> ssh-ed25519 hc2ELA LitSyMM/w8BfhK6KlXu3Vcyc8nw1gMPHnXgnaWB1tDc
+lw5E5c5eoPj5H4kdg3P23LTY+Rp3tdfui8vchHwN8Y0
+--- JjsrCNKCL69/V8ullEAbaYmCxmP3LSnjl6BT0HnWZV4
+tpM^/BPhH"WP#m/ƶږ1
+8dHޝQMhA "# m fśф}FCyH
+\ No newline at end of file
