commit bd18f4a8f3d5d3d360216bbb01ae83514c28d00c
parent 1718f4f19bc947c3e1179a278e816310a3c8cec6
Author: vin <vin@vineetk.net>
Date: Sat, 20 Sep 2025 17:31:10 -0400
prepare repo for switching back to nixos
Diffstat:
12 files changed, 556 insertions(+), 1042 deletions(-)
diff --git a/home.nix b/home.nix
@@ -37,6 +37,28 @@ let
};
extraPkgs = pkgs: [ pkgs.icu ];
};
+
+ my-texlive = with pkgs; texlive.withPackages (texlivePackages: with texlivePackages; [
+ # A minimal base scheme and a common build tool
+ scheme-small
+ latexmk
+
+ # Packages from your research paper's preamble
+ amsmath
+ graphicx
+ siunitx
+ booktabs
+ algorithm2e
+ caption
+ pslatex
+ ec
+ microtype
+ cite
+ url
+ xcolor
+ hyperref
+ ]);
+
in
{
home = {
@@ -45,68 +67,50 @@ in
stateVersion = "24.05";
packages = with pkgs; [
- # normal utils
- neofetch
- rclone
- wcalc
-
- # programming
- python3
-
- # CAD software
- kicad
- openscad
-
# document writing and viewing
mupdf # needed for emacs docview
- texlive.combined.scheme-full
- zathura
+ my-texlive
# messaging
profanity
vesktop
# email
- notmuch
+ muchsync
oauth2ms
# hardware
- acpi
- acpilight
amdgpu_top
# encryption
age
- age-plugin-yubikey
- oathToolkit
- yubikey-agent
- yubikey-manager
+ oath-toolkit
+ # TODO actually use my yubikey?
+ #age-plugin-yubikey
+ #yubikey-agent
+ #yubikey-manager
# system utils
- dmenu
file
htop
mlocate
ncdu
- tree
- unzip
- p7zip
- page
- fd
+ #tree
+ #unzip
+ #p7zip
ripgrep
# X and desktop-related
scrot
sxiv
xclip
- xdotool
xwallpaper
- # wayland and desktop-related
- grim
- slurp
- wl-clipboard
- wmenu
+ # desktop-related
+ dmenu
+ scrot
+ xclip
+ xsel
# 3d printing
prusa-slicer
@@ -210,9 +214,9 @@ in
accounts = {
university = {
- address = "***REDACTED_EMAIL***";
+ address = "vsureshkumar3892@floridapoly.edu";
realName = "Vineet Kumar";
- userName = "***REDACTED_EMAIL***";
+ userName = "vsureshkumar3892@floridapoly.edu";
passwordCommand = "oauth2ms";
imap.host = "outlook.office365.com";
@@ -386,6 +390,20 @@ in
mpv = {
enable = true;
+ package = pkgs.mpv.override {
+ archiveSupport = false;
+ bluraySupport = false;
+ bs2bSupport = false;
+ cacaSupport = false;
+ cmsSupport = false;
+ dvdnavSupport = false;
+ javascriptSupport = false;
+ pipewireSupport = true;
+ pulseSupport = false;
+ rubberbandSupport = false;
+ waylandSupport = false;
+ zimgSupport = false;
+ };
bindings = {
# I wish there was a more elegant way of setting Anime4K
@@ -414,197 +432,23 @@ in
};
};
- neovim = {
- enable = true;
-
- extraLuaConfig = ''
- -- my better defaults
- vim.opt.autoindent = true
- vim.opt.autoread = true
- vim.opt.backup = false
- vim.opt.hlsearch = false
- vim.opt.relativenumber = true
- vim.opt.ignorecase = true
-
- -- colors
- vim.opt.bg = "dark"
- vim.opt.colorcolumn = "80"
- vim.cmd("colorscheme everblush")
-
- -- mappings
- vim.g.mapleader = " "
- vim.keymap.set('n', '<Leader>g', '<cmd>Neogit cwd=%:p:h<cr>')
- vim.keymap.set('n', '<Leader>l', '<cmd>ls<cr>')
- vim.keymap.set('n', '<Leader>tt', '<cmd>Telescope<cr>')
- vim.keymap.set('n', '<Leader>tb', '<cmd>Telescope buffers<cr>')
- vim.keymap.set('n', '<Leader>tf', '<cmd>Telescope frecency<cr>')
- '';
-
- plugins = with pkgs.vimPlugins; [
- {
- plugin = (
- pkgs.vimUtils.buildVimPlugin {
- name = "everblush-nvim";
- src = pkgs.fetchFromGitHub {
- owner = "everblush";
- repo = "nvim";
- rev = "9a0e695fdd57b340d3ba2b72406e3ca519029f25";
- hash = "sha256-O6Erp+Tzk5TV5gpgVs73cO6v9vgeUVYpunrtf/7Ppic=";
- };
- }
- );
- config = ''
- lua << END
- require "everblush".setup {
- transparent_background = true,
-
- override = {
- LineNr = { fg = "#b3b9b8" },
- },
- }
- END
- '';
- }
-
- # languages
- vim-nix
-
- # qol plugins
- {
- plugin = which-key-nvim;
- config = ''
- lua << END
- require "which-key".setup {
- delay = 300
- }
- END
- '';
- }
- neogit
- gitsigns-nvim
-
- # telescope stuff
- {
- plugin = telescope-nvim;
- config = ''
- lua << END
- require "telescope".setup {
- defaults = vim.tbl_extend(
- "force",
- require "telescope.themes".get_ivy(),
- {
- layout_config = { height = 10 },
- }
- )
- }
- END
- '';
- }
- {
- plugin = telescope-zf-native-nvim;
- config = ''
- lua << END
- require "telescope".load_extension("zf-native")
- END
- '';
- }
- {
- plugin = telescope-frecency-nvim;
- config = ''
- lua << END
- require "telescope".load_extension("frecency")
- END
- '';
- }
-
- # tree-sitter stuff, mainly for better syntax highlighting
- nvim-treesitter
- nvim-treesitter-textobjects
- ] ++ (with pkgs.vimPlugins.nvim-treesitter-parsers; [
- arduino
- asm
- awk
- bash
- bibtex
- c
- cmake
- commonlisp
- cpp
- css
- csv
- diff
- disassembly
- dockerfile
- forth
- git_config
- git_rebase
- gitattributes
- gitcommit
- gitignore
- go
- gomod
- gosum
- haskell
- html
- ini
- json
- kconfig
- latex
- lua
- luadoc
- luap
- luau
- make
- markdown
- markdown_inline
- meson
- muttrc
- nasm
- ninja
- nix
- ocaml
- ocaml_interface
- ocamllex
- printf
- python
- r
- regex
- rust
- scheme
- scss
- slang
- sql
- sway
- tcl
- toml
- udev
- xml
- yaml
- zig
- ]);
-
- viAlias = true;
- vimAlias = true;
- withNodeJs = false;
- withPython3 = false;
- withRuby = false;
- };
-
notmuch = {
enable = true;
extraConfig.user = {
name = "Vineet Kumar";
primary_email = "me@vineetk.net";
- other_email = "vineet@vineetk.net;***REDACTED_EMAIL***;kar@13f0.net";
+ other_email = "vineet@vineetk.net;vsureshkumar3892@floridapoly.edu;kar@13f0.net";
};
hooks = {
postNew = ''
notmuch tag +13f0 -- tag:unread and to:"*@13f0.net"
notmuch tag +vineetk -- tag:unread and to:"*@vineetk.net"
- notmuch tag +university -- tag:unread and to:***REDACTED_EMAIL***
+ notmuch tag +university -- tag:unread and to:"*@floridapoly.edu"
notmuch tag +openbsd_announce -inbox -- tag:unread and to:announce@openbsd.org
notmuch tag +openbsd_arm -inbox -- tag:unread and to:arm@openbsd.org
notmuch tag +openbsd_misc -inbox -- tag:unread and to:misc@openbsd.org
+ notmuch tag +openbsd_ports -inbox -- tag:unread and to:ports@openbsd.org
+ notmuch tag +openbsd_tech -inbox -- tag:unread and to:tech@openbsd.org
notmuch tag +opensmtpd_misc -inbox -- tag:unread and to:misc@opensmtpd.org
notmuch tag +oss_security -inbox -- tag:unread and to:oss-security@lists.openwall.com
notmuch tag +tuhs -inbox -- tag:unread and to:tuhs@tuhs.org
@@ -619,7 +463,6 @@ in
quickmarks = {
canvas = "https://floridapolytechnic.instructure.com";
cams = "https://cams.floridapoly.org/student/login.asp";
- weather = "https://forecast.weather.gov/MapClick.php***REMOVED***";
entertrained = "https://entertrained.app/";
burst = "https://www.burst-type.pro/";
colemakcamp = "https://colemakcamp.github.io/";
@@ -779,7 +622,6 @@ in
# glance?
# gpg-agent with ssh?
# mpd and ncmpcpp?
- # nextcloud-client?
# pass-secret-service?
# plan9port for plumbing?
# recoll?
@@ -787,232 +629,6 @@ in
# screen-locker
# sxhkd if using bspwm and not i3
# unison
- # vdirsyncer
-
- # parametric equalizer (and other stuff I don't use) in pipewire
- easyeffects = {
- enable = true;
- preset = "he5xx_oratory1990";
- extraPresets.he5xx_oratory1990 = {
- output = {
- blocklist = [ ];
- "equalizer#0" = {
- balance = 0;
- bypass = false;
- input-gain = -10.8;
- left = {
- band0 = {
- frequency = 25;
- gain = 5.3;
- mode = "APO (DR)";
- mute = false;
- q = 1;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band1 = {
- frequency = 105;
- gain = 5.5;
- mode = "APO (DR)";
- mute = false;
- q = 0.666667;
- slope = "x1";
- solo = false;
- type = "Lo-shelf";
- width = 4;
- };
- band2 = {
- frequency = 470;
- gain = -1;
- mode = "APO (DR)";
- mute = false;
- q = 4;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band3 = {
- frequency = 530;
- gain = 1.8;
- mode = "APO (DR)";
- mute = false;
- q = 1.2;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band4 = {
- frequency = 800;
- gain = 5;
- mode = "APO (DR)";
- mute = false;
- q = 0.666667;
- slope = "x1";
- solo = false;
- type = "Hi-shelf";
- width = 4;
- };
- band5 = {
- frequency = 910;
- gain = -3.4;
- mode = "APO (DR)";
- mute = false;
- q = 3;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band6 = {
- frequency = 1300;
- gain = -3.3;
- mode = "APO (DR)";
- mute = false;
- q = 3;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band7 = {
- frequency = 5400;
- gain = -4.8;
- mode = "APO (DR)";
- mute = false;
- q = 4.5;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band8 = {
- frequency = 11000;
- gain = -7;
- mode = "APO (DR)";
- mute = false;
- q = 0.666667;
- slope = "x1";
- solo = false;
- type = "Hi-shelf";
- width = 4;
- };
- };
- mode = "IIR";
- num-bands = 9;
- output-gain = 0;
- pitch-left = 0;
- pitch-right = 0;
- right = {
- band0 = {
- frequency = 25;
- gain = 5.3;
- mode = "APO (DR)";
- mute = false;
- q = 1;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band1 = {
- frequency = 105;
- gain = 5.5;
- mode = "APO (DR)";
- mute = false;
- q = 0.666667;
- slope = "x1";
- solo = false;
- type = "Lo-shelf";
- width = 4;
- };
- band2 = {
- frequency = 470;
- gain = -1;
- mode = "APO (DR)";
- mute = false;
- q = 4;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band3 = {
- frequency = 530;
- gain = 1.8;
- mode = "APO (DR)";
- mute = false;
- q = 1.2;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band4 = {
- frequency = 800;
- gain = 5;
- mode = "APO (DR)";
- mute = false;
- q = 0.666667;
- slope = "x1";
- solo = false;
- type = "Hi-shelf";
- width = 4;
- };
- band5 = {
- frequency = 910;
- gain = -3.4;
- mode = "APO (DR)";
- mute = false;
- q = 3;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band6 = {
- frequency = 1300;
- gain = -3.3;
- mode = "APO (DR)";
- mute = false;
- q = 3;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band7 = {
- frequency = 5400;
- gain = -4.8;
- mode = "APO (DR)";
- mute = false;
- q = 4.5;
- slope = "x1";
- solo = false;
- type = "Bell";
- width = 4;
- };
- band8 = {
- frequency = 11000;
- gain = -7;
- mode = "APO (DR)";
- mute = false;
- q = 0.666667;
- slope = "x1";
- solo = false;
- type = "Hi-shelf";
- width = 4;
- };
- };
- split-channels = false;
- };
- plugins_order = [ "equalizer#0" ];
- };
- };
- };
poweralertd.enable = true;
@@ -1118,18 +734,6 @@ in
xdg = {
enable = true;
- portal = {
- enable = true;
- extraPortals = [ pkgs.xdg-desktop-portal-luminous ];
- config.sway = {
- default = [ "luminous" ];
- "org.freedesktop.impl.portal.Screenshot" = [ "luminous" ];
- "org.freedesktop.impl.portal.ScreenCast" = [ "luminous" ];
- "org.freedesktop.impl.portal.Settings" = [ "luminous" ];
- "org.freedesktop.impl.portal.RemoteDesktop" = [ "luminous" ];
- };
- };
-
configFile = {
"qutebrowser/theme.py".text = ''
# Colors.
@@ -1343,221 +947,4 @@ in
videos = "$HOME/";
};
};
-
- wayland.windowManager.sway = {
- enable = true;
- package = pkgs.swayfx;
-
- # https://github.com/nix-community/home-manager/issues/5379#issuecomment-2096066969
- checkConfig = false;
-
- config = {
- input."type:pointer".accel_profile = "flat";
- output."*".background = "~/pics/wp/elite_milky_way_below2.png fill";
-
- bars = [
- {
- colors = {
- # background = colors.current.primary.background;
- background = "#000000";
- statusline = colors.current.primary.foreground;
- focusedWorkspace = {
- background = colors.current.normal.black;
- border = colors.current.normal.black;
- text = colors.current.normal.green;
- };
- activeWorkspace = {
- background = colors.current.normal.black;
- border = colors.current.normal.black;
- text = colors.current.primary.foreground;
- };
- inactiveWorkspace = {
- background = colors.current.primary.background;
- border = colors.current.primary.background;
- text = colors.current.normal.white;
- };
- };
- command = "${pkgs.sway}/bin/swaybar";
- position = "top";
- statusCommand = "while date +'%Y-%m-%d %X'; do sleep 1; done";
- }
- ];
-
- colors = {
- focused = {
- background = colors.current.primary.background;
- border = colors.current.primary.background;
- childBorder = colors.current.primary.background;
- indicator = colors.current.normal.black;
- text = colors.current.normal.green;
- };
- focusedInactive = {
- background = colors.current.primary.background;
- border = colors.current.primary.background;
- childBorder = colors.current.primary.background;
- indicator = colors.current.normal.black;
- text = colors.current.primary.foreground;
- };
- unfocused = {
- background = colors.current.normal.black;
- border = colors.current.normal.black;
- childBorder = colors.current.normal.black;
- indicator = colors.current.primary.background;
- text = colors.current.normal.white;
- };
- };
-
- focus = {
- mouseWarping = true;
- wrapping = "yes";
- };
-
- fonts = {
- names = [ "monospace" ];
- size = 11.0;
- };
-
- gaps = {
- inner = 15;
- smartGaps = true;
- };
-
- keybindings =
- let
- left = "n";
- down = "e";
- up = "o";
- right = "i";
- modifier = config.wayland.windowManager.sway.config.modifier;
- menu = config.wayland.windowManager.sway.config.menu;
- terminal = config.wayland.windowManager.sway.config.terminal;
- in
- lib.mkOptionDefault {
- "${modifier}+Return" = "exec ${terminal}";
- "${modifier}+p" = "exec ${menu}";
- "${modifier}+b" = "exec bm t";
- "${modifier}+Shift+b" = "exec kasimenu";
- "${modifier}+u" = "exec kasimenu user";
- "${modifier}+Shift+u" = "exec kasimenu email";
- "${modifier}+Shift+t" = "exec kasimenu_totp";
-
- "${modifier}+Shift+q" = "kill";
- "${modifier}+Shift+c" = "reload";
- "Mod1+Mod4+Ctrl+Shift+e" = "exit";
-
- "${modifier}+${left}" = "focus left;";
- "${modifier}+${down}" = "focus down;";
- "${modifier}+${up}" = "focus up;";
- "${modifier}+${right}" = "focus right;";
- "${modifier}+Shift+${left}" = "move left";
- "${modifier}+Shift+${down}" = "move down";
- "${modifier}+Shift+${up}" = "move up";
- "${modifier}+Shift+${right}" = "move right";
-
- # TODO do this programatically
- "${modifier}+1" = "workspace number 1";
- "${modifier}+2" = "workspace number 2";
- "${modifier}+3" = "workspace number 3";
- "${modifier}+4" = "workspace number 4";
- "${modifier}+5" = "workspace number 5";
- "${modifier}+6" = "workspace number 6";
- "${modifier}+7" = "workspace number 7";
- "${modifier}+8" = "workspace number 8";
- "${modifier}+9" = "workspace number 9";
- "${modifier}+0" = "workspace number 10";
- "${modifier}+Shift+1" = "move container to workspace number 1";
- "${modifier}+Shift+2" = "move container to workspace number 2";
- "${modifier}+Shift+3" = "move container to workspace number 3";
- "${modifier}+Shift+4" = "move container to workspace number 4";
- "${modifier}+Shift+5" = "move container to workspace number 5";
- "${modifier}+Shift+6" = "move container to workspace number 6";
- "${modifier}+Shift+7" = "move container to workspace number 7";
- "${modifier}+Shift+8" = "move container to workspace number 8";
- "${modifier}+Shift+9" = "move container to workspace number 9";
- "${modifier}+Shift+0" = "move container to workspace number 10";
-
- "${modifier}+Ctrl+Shift+b" = "splith";
- "${modifier}+Ctrl+Shift+v" = "splitv";
- "${modifier}+s" = "layout stacking";
- "${modifier}+t" = "layout tabbed";
- "${modifier}+Ctrl+Shift+t" = "layout toggle split";
- "${modifier}+Shift+f" = "fullscreen";
- "${modifier}+Shift+space" = "floating toggle";
- "${modifier}+space" = "focus mode_toggle";
- "${modifier}+a" = "focus parent";
-
- "${modifier}+r" = "mode resize";
- };
-
- menu = "${pkgs.wmenu}/bin/wmenu-run";
-
- modes.resize =
- let
- left = "n";
- down = "e";
- up = "o";
- right = "i";
- in
- lib.mkOptionDefault {
- ${left} = "resize shrink width 10px";
- ${down} = "resize grow height 10px";
- ${up} = "resize shrink width 10px";
- ${right} = "resize grow width 10px";
- Escape = "mode default";
- };
-
- modifier = "Mod4";
-
- terminal = "foot";
-
- window = {
- border = 0;
- titlebar = false;
- };
-
- defaultWorkspace = "workspace number 1";
- workspaceAutoBackAndForth = true;
- };
-
- extraConfig = ''
- # I hate xdg-desktop-portal
- exec systemctl --user set-environment XDG_CURRENT_DESKTOP=sway
- exec systemctl --user import-environment DISPLAY \
- SWAYSOCK \
- WAYLAND_DISPLAY \
- XDG_CURRENT_DESKTOP
- exec hash dbus-update-activation-environment 2>/dev/null && \
- dbus-update-activation-environment --systemd DISPLAY \
- SWAYSOCK \
- XDG_CURRENT_DESKTOP=sway \
- WAYLAND_DISPLAY
-
- mouse_warping container
-
- blur enable
- blur_xray disable
- blur_radius 3
- blur_passes 5
-
- corner_radius 10
-
- shadows enable
- shadow_blur_radius 10
-
- for_window [class="Emacs"] opacity 0.9
- for_window [app_id="qutebrowser"] opacity 0.9
- for_window [app_id="vesktop"] opacity 0.9
-
- for_window [title="profanity"] move container to workspace 9
- for_window [app_id="vesktop"] move container to workspace 10
-
- exec ${pkgs.qutebrowser}/bin/qutebrowser
- exec ${pkgs.vesktop}/bin/vesktop --use-vulkan --ozone-platform=wayland --enable-features=UseOzonePlatform,Vulkan
- exec ${config.wayland.windowManager.sway.config.terminal} -T profanity -e ${pkgs.profanity}/bin/profanity
-
- # for elite va
- bindsym --whole-window BTN_SIDE echo press >/tmp/elite_va.fifo
- bindsym --whole-window --release BTN_SIDE echo release >/tmp/elite_va.fifo
- '';
- };
}
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
@@ -21,14 +21,6 @@
allowUnfreePredicate =
pkg:
builtins.elem (lib.getName pkg) [
- /*
- "cuda_cccl"
- "cuda_cudart"
- "cuda_nvcc"
- "cudnn"
- "libcublas"
- "libcufile"
- */
"steam"
"steam-unwrapped"
];
@@ -44,30 +36,6 @@
overlays = [
(self: super: {
- invidious = super.invidious.overrideAttrs (old: {
- # try removing shorts by ignoring any videos shorter than 65 seconds
- postPatch =
- old.postPatch
- + ''
- sed -i '/GROUP BY channel/a\ AND length_seconds > 65' src/invidious/database/channels.cr
- sed -i 's/\({view_name}\) \(ORDER BY published\)/\1 WHERE length_seconds > 65 \2/' src/invidious/users.cr
- sed -i 's/\({values})\) \(ORDER BY published\)/\1 AND length_seconds > 65 \2/' src/invidious/users.cr
- '';
- });
- })
- (self: super: {
- inv-sig-helper = super.inv-sig-helper.overrideAttrs (old: {
- version = "0-unstable-2025-04-23";
-
- src = super.fetchFromGitHub {
- owner = "iv-org";
- repo = "inv_sig_helper";
- rev = "5d3c7a4574fafe0bc5fbed9e7e33483889832fd4";
- hash = "sha256-WGh62tjKGe9OD19aq+lP9GfYs5PrGqkeT6VvmtNottQ=";
- };
- });
- })
- (self: super: {
alvr = super.alvr.overrideAttrs (old: {
buildInputs = old.buildInputs ++ [
super.android-tools
@@ -91,11 +59,8 @@
# decrypt agenix secrets
age.secrets = {
- tailscale_demiurge = {
- file = ../../secrets/tailscale_demiurge.age;
- owner = "root";
- group = "root";
- };
+ wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
+ wg1_demiurge.file = ../../secrets/wg0_demiurge.age;
};
# boot options
@@ -114,7 +79,7 @@
zfs.extraPools = [
"data_wd"
- "nvme_warm"
+ "data"
];
};
@@ -134,34 +99,101 @@
allowedUDPPorts = [ 51413 ];
};
- # mullvad to miami
- wg-quick.interfaces.us-mia-wg-002 = {
- address = [
- "10.135.221.102/32"
- "fc00:bbbb:bbbb:bb01:d:0:7:dd66/128"
- ];
- privateKey = "***REDACTED_WG_KEY***=";
+ wg-quick.interfaces = {
+ # mullvad
+ wg0 = {
+ address = [
+ "10.68.117.111/32"
+ "fc00:bbbb:bbbb:bb01::5:756e/128"
+ ];
+ privateKeyFile = config.age.secrets.wg0_demiurge.path;
- # supposed to be done by tailscale instead \_(:/)_/
- postUp = ''
- ip route add 100.64.0.0/24 dev tailscale0
- ip route add 100.100.100.100/32 dev tailscale0
- '';
- postDown = ''
- ip route del 100.64.0.0/24 dev tailscale0
- ip route del 100.100.100.100/32 dev tailscale0
- '';
+ postUp = "ip route add 45.134.142.206 dev eth0";
+ postDown = "ip route del 45.134.142.206 dev eth0";
- peers = [
- {
- allowedIPs = [
- "0.0.0.0/0"
- "::0/0"
- ];
- endpoint = "45.134.142.206:51820";
- publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
- }
- ];
+ peers = [{
+ allowedIPs = [
+ "0.0.0.0/0"
+ "::0/0"
+ ];
+ endpoint = "45.134.142.206:51820";
+ publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
+ }];
+ };
+
+ # epistemia
+ wg1 = {
+ address = [
+ "10.0.13.2/24"
+ "fd00:b0ba:cafe:babe::2/64"
+ ];
+ privateKeyFile = config.age.secrets.wg1_demiurge.path;
+ listenPort = 51820;
+ fwMark = 51821;
+ MTU = 1420;
+
+ table = false;
+ postUp = ''
+PostUp = ip rule add from 10.0.13.0/24 lookup main pref 31000
+PostUp = ip rule add from all fwmark 51821 lookup 51821 pref 32000
+PostUp = ip route add default via 192.168.1.1 dev eth0 table 51821
+
+# NAT iphonebob and allow traffic between peers (when routing through demiurge)
+PostUp = iptables -F FORWARD
+PostUp = iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+PostUp = iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT
+PostUp = iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT
+PostUp = iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+ '';
+ preDown = ''
+PreDown = ip rule del from all fwmark 51821 lookup 51821 pref 32000
+PreDown = ip rule del from 10.0.13.0/24 lookup main pref 31000
+PreDown = ip route flush table 51821
+
+PreDown = iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+PreDown = iptables -F FORWARD
+ '';
+
+ peers = [
+ # saklas
+ {
+ allowedIPs = [
+ "10.0.13.1/32"
+ "fd00:b0ba:cafe:babe::1/128"
+ ];
+ endpoint = "157.180.125.215:51820";
+ persistentKeepalive = 25;
+ publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
+ }
+ # hastur
+ {
+ allowedIPs = [
+ "10.0.13.3/32"
+ "fd00:b0ba:cafe:babe::3/128"
+ ];
+ persistentKeepalive = 25;
+ publicKey = "MOmRjVbRuWEuK0oHQ+C0jTaceCUPd2fpzDbh8ue6bDc=";
+ }
+ # iphonebob
+ {
+ allowedIPs = [
+ "10.0.13.4/32"
+ "fd00:b0ba:cafe:babe::4/128"
+ ];
+ persistentKeepalive = 25;
+ publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30=";
+ }
+ # lab
+ {
+ allowedIPs = [
+ "10.0.13.5/32"
+ "fd00:b0ba:cafe:babe::5/128"
+ ];
+ persistentKeepalive = 25;
+ publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
+ }
+ ];
+ };
};
};
@@ -186,24 +218,19 @@
isNormalUser = true;
extraGroups = [
- "input"
- "kvm"
- "libvirtd"
"transmission"
- "video"
"wheel"
];
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge"
];
packages = with pkgs; [
alvr
bs-manager
- distrobox
(llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; })
#(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
];
@@ -249,9 +276,6 @@
# steam, proprietary. I sometimes like playing nonfree games too.
steam.enable = true;
- # virtualization
- virt-manager.enable = true;
-
# configuration in home-manager
zsh.enable = true;
zsh.promptInit = "PS1='$ '";
@@ -270,53 +294,57 @@
];
};
- pki.certificates = [
- ''
- -----BEGIN CERTIFICATE-----
- MIIDMDCCAhigAwIBAgIUcSUafnojcFKod3f436VELfEKoFkwDQYJKoZIhvcNAQEL
- BQAwHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlhMB4XDTI1MDMwMzEwMjQw
- OVoXDTI2MDMwMzEwMjQwOVowHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlh
- MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwiRlreCXc7f+yWclxR2M
- 639g0+Lr/c9HrX7EM2/olavPAtZgCzqqvJsDmXq4AURlwd82wZUZxXjWFwlRji/+
- WViXQBTWwnXVjc9MJlxTq2X2zfU2GIxYsrA1ZQuj0wVHlA+R/66oL0Padc/qQZfv
- sshQnrqnutvGobBWEGJXcCIDiwUGgHlIoelwY9G0GLE/rkVujNjAonyMhVGJHVUv
- lXyc3RNslQHymr4Wl6+lL6V6XfuB1taECJYSLXPx66TvJqod2Io+b7T7cWp+9g9U
- B2jQu1YnPRpwjdPvbOCPjPbOP6UcbyHdbHAidSM0FSL5riVUmugwDwbQKXFFX2gH
- hwIDAQABo2gwZjAfBgNVHREEGDAWghQqLmRlbWl1cmdlLmVwaXN0ZW1pYTATBgNV
- HSUEDDAKBggrBgEFBQcDATAPBgNVHRMECDAGAQH/AgEAMB0GA1UdDgQWBBTjMVhw
- zmkE6P5jFHkLVQE2gNB2ejANBgkqhkiG9w0BAQsFAAOCAQEAWvnwB83vXzQFpObF
- vn/nfZ9wYpNaBsE15ab3Fwd2nDc55KDkDWgBi5Xl8fwN3OhFOU2XXBCYqbCU6asx
- OnSx9glbhJioORO7B5ENbEYrpB97SaWASNXrBQ2KiQT5aC+9xb52K53kkk0tTn2l
- nBb+jyLItzWX99H6EavOq69a4T2BObZaSPQAfpM8FIrKl+UZC3152+bi8wKfG4K4
- FQsOJMjIvhTm2IiOS8xIaZz7EJORxFjtOkLEIGGZBNK6QcnD714/nYbHSrQx4eNM
- /ek8Rmf6DTLaFBx+raWyDTgMY23lvWTKDTT1+dZnRNcg72bFpIdqHsDrIg/IBjZ0
- 3eGfkQ==
- -----END CERTIFICATE-----
- ''
- ];
-
sudo.enable = false;
};
services = {
- # control unicorn barf
- hardware.openrgb.enable = true;
-
# dns
- dnsmasq = {
+ unbound = {
enable = true;
settings = {
- server = [
- "192.168.1.1"
- "/epistemia/100.100.100.100"
- ];
+ server = {
+ interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ];
+ access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ];
+
+ hide-identity = yes;
+ hide-version = yes;
+
+ # Synthesize NXDOMAINs from DNSSEC NSEC chains.
+ # https://tools.ietf.org/html/rfc8198
+ aggressive-nsec = no;
+
+ local-zone = "saklas.epistemia." redirect;
+ local-data = "saklas.epistemia. 86400 IN A 10.0.13.1";
+ local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1";
+ local-zone = "demiurge.epistemia." redirect;
+ local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2";
+ local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2";
+ local-zone = "hastur.epistemia." redirect;
+ local-data = "hastur.epistemia. 86400 IN A 10.0.13.3";
+ local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3";
+ local-zone = "iphonebob.epistemia." redirect;
+ local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4";
+ local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4";
+ local-zone = "lab.epistemia." redirect;
+ local-data = "lab.epistemia. 86400 IN A 10.0.13.5";
+ local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5";
+ local-zone = "paraclete.epistemia." redirect;
+ local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6";
+ local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6";
+ };
- interface = "lo";
- listen-address = "127.0.0.1";
- bind-interfaces = true;
- no-resolv = true;
+ # hagezi for dns-based adblocking (in addition to others)
+ rpz = {
+ name = "hagezi.ultimate";
+ zonefile = "hagezi.ultimate";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
+ };
- conf-file = "/data/src/clones/networking/hagezi_dns-blocklists/dnsmasq/ultimate.txt";
+ # go through mullvad for regular dns queries
+ forward-zone = {
+ name = ".";
+ forward-addr = [ "100.64.0.3" ];
+ };
};
};
@@ -361,39 +389,6 @@
};
};
- # invidious
- invidious = {
- enable = true;
-
- http3-ytproxy.enable = true;
- nginx.enable = true;
- sig-helper.enable = true;
-
- domain = "invidious.demiurge.epistemia";
- extraSettingsFile = "/run/invidious_settings";
- settings = {
- admins = [ "vin" ];
- captcha_enabled = false;
- registration_enabled = false;
- hmac_key = "zCYyRa7vD0qt";
- default_user_preferences = {
- captions = [ "English" ];
- dark_mode = "dark";
- feed_menu = [
- "Popular"
- "Subscriptions"
- "Playlists"
- ];
- max_results = 100;
- quality = "dash";
- save_player_pos = true;
- unseen_only = true;
- local = true;
- extend_desc = true;
- };
- };
- };
-
# graphical input
libinput = {
enable = true;
@@ -420,7 +415,7 @@
nginx = {
enable = true;
- defaultListenAddresses = [ "100.64.0.2" ];
+ defaultListenAddresses = [ "10.0.13.2" "fd00:b0ba:cafe:babe::2" ];
recommendedGzipSettings = true;
recommendedOptimisation = true;
@@ -460,22 +455,14 @@
};
"sdui.demiurge.epistemia" = {
- # addSSL = true;
- # sslCertificate = "/var/demiurge.epistemia.crt";
- # sslCertificateKey = "/var/demiurge.epistemia.key";
+ addSSL = true;
+ sslCertificate = "/var/demiurge.epistemia.crt";
+ sslCertificateKey = "/var/demiurge.epistemia.key";
locations."/" = {
proxyPass = "http://127.0.0.1:7860";
proxyWebsockets = true;
};
};
-
- "invidious.demiurge.epistemia" = {
- addSSL = true;
- enableACME = false;
- forceSSL = false;
- sslCertificate = "/var/demiurge.epistemia.crt";
- sslCertificateKey = "/var/demiurge.epistemia.key";
- };
};
};
@@ -508,7 +495,127 @@
# using pulseaudio and home-manager, so had to disable pulseaudio.
pipewire = {
enable = true;
+ alsa.enable = true;
+ audio.enable = true;
pulse.enable = true;
+
+ extraConfig.pipewire = {
+ "99-filter-he5xx.conf" = {
+ "context.modules" = [
+ {
+ name = "libpipewire-module-filter-chain";
+ args = {
+ node.name = "peq-he5xx-sink";
+ node.description = "PEQ HE5XX (auto)";
+ # playback.props is the virtual sink/device properties
+ playback.props = {
+ media.class = "Audio/Sink";
+ "filter.smart" = true;
+ "filter.smart.name" = "peq-he5xx";
+ # tell WirePlumber what target properties this filter is intended for
+ # (we leave this unset here; smart target matching will be done by wireplumber)
+ };
+ # filter graph: single builtin param_eq node that loads the param file
+ filter.graph = [
+ {
+ type = "builtin";
+ name = "param_eq";
+ label = "param_eq_he5xx";
+ config.filename = "/etc/pipewire/parametric/he5xx.txt";
+ }
+ ];
+ };
+ };
+ ];
+ };
+
+ "99-filter-airpods.conf" = {
+ "context.modules" = [
+ {
+ name = "libpipewire-module-filter-chain";
+ args = {
+ node.name = "peq-airpods-pro-2-sink";
+ node.description = "PEQ AirPods Pro 2 (auto)";
+ playback.props = {
+ media.class = "Audio/Sink";
+ "filter.smart" = true;
+ "filter.smart.name" = "peq-airpods-pro-2";
+ };
+ filter.graph = [
+ {
+ type = "builtin";
+ name = "param_eq";
+ label = "param_eq_airpods";
+ config.filename = "/etc/pipewire/parametric/airpods-pro-2.txt";
+ }
+ ];
+ };
+ }
+ ];
+ };
+ };
+
+ # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt)
+ wireplumber = {
+ enable = true;
+ extraConfig."50-smartfilters-airpods.conf".text = ''
+ {
+ "monitor.bluez.rules" : [
+ # When a BlueZ device is detected we set an identifying property that the smart filter will match.
+ # (This fragment adds nothing by default; we're using a policy to match target.node later.)
+ ],
+
+ "policy.rules" : [
+ # The core smart filter matching is done by matching the target.node properties
+ # WirePlumber's smart filters will look for filter.smart.target (set below).
+ ],
+
+ "policy" : {
+ "smart_filters" : {
+ "rules" : [
+ {
+ "matches" : [
+ { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
+ ],
+ "actions" : {
+ # If target device matches, set the 'target.node' metadata for smart filters to use
+ "update-metadata" : {
+ "target.node" : { "name" : "bluez_output.*AirPods.*" }
+ }
+ }
+ }
+ ]
+ }
+ },
+
+ "endpoint.rules" : [
+ {
+ "matches" : [
+ { "node.name" : "peq-airpods-pro-2-sink" }
+ ],
+ "actions" : {
+ "update-props" : {
+ # Mark this WF sink as intended for a specific target device.
+ # WirePlumber will use filter.smart.target to identify which device to chain to.
+ "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
+ }
+ }
+ },
+ {
+ "matches" : [
+ { "node.name" : "peq-he5xx-sink" }
+ ],
+ "actions" : {
+ "update-props" : {
+ # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules.
+ "filter.smart.target" : {}
+ }
+ }
+ }
+ ]
+ }
+ '';
+ };
};
# reddit
@@ -555,11 +662,11 @@
# Disable autoplay videos by default
REDLIB_DEFAULT_AUTOPLAY_VIDEOS = false;
# Define a default list of subreddit subscriptions (format: sub1+sub2+sub3)
- REDLIB_DEFAULT_SUBSCRIPTIONS = "ergomechkeyboards+localllama+factorio+warframe+elitedangerous+unixporn+usabilityporn";
+ REDLIB_DEFAULT_SUBSCRIPTIONS = "ergomechkeyboards+localllama+elitedangerous";
# Define a default list of subreddit filters (format: sub1+sub2+sub3)
REDLIB_DEFAULT_FILTERS = "popular+all+funny+memes";
# Hide awards by default
- REDLIB_DEFAULT_HIDE_AWARDS = false;
+ REDLIB_DEFAULT_HIDE_AWARDS = true;
# Hide sidebar and summary
REDLIB_DEFAULT_HIDE_SIDEBAR_AND_SUMMARY = false;
# Disable the confirmation before visiting Reddit
@@ -604,8 +711,8 @@
hostnames = {
replace = {
- "(.*\.)?youtube\.com$" = "invidious.demiurge.epistemia";
- "(.*\.)?youtu\.be$" = "invidious.demiurge.epistemia";
+ "(.*\.)?youtube\.com$" = "yewtu.be";
+ "(.*\.)?youtu\.be$" = "yewtu.be";
"(.*\.)?reddit\.com$" = "redlib.demiurge.epistemia";
"(.*\.)?redd\.it$" = "redlib.demiurge.epistemia";
};
@@ -967,7 +1074,6 @@
doi_resolvers = {
"oadoi.org" = "https://oadoi.org/";
"doi.org" = "https://doi.org/";
- "doai.io" = "https://dissem.in/";
"sci-hub.se" = "https://sci-hub.se/";
"sci-hub.st" = "https://sci-hub.st/";
"sci-hub.ru" = "https://sci-hub.ru/";
@@ -977,25 +1083,10 @@
};
};
- # vpn
- tailscale = {
- enable = true;
- authKeyFile = config.age.secrets.tailscale_demiurge.path;
- extraDaemonFlags = [ "--no-logs-no-support" ];
- extraUpFlags = [
- "--login-server=https://headscale.13f0.net"
- "--advertise-exit-node"
- ];
- openFirewall = true;
- };
-
# udev rules
udev = {
enable = true;
extraRules = ''
- # ST-Link v2.1
- SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="374b", MODE:="0666"
-
# Oculus Quest 2
SUBSYSTEM=="usb", ATTR{idVendor}=="2833", ATTR{idProduct}=="0186", MODE="0660",
GROUP="input", SYMLINK+="ocuquest%n"
@@ -1015,53 +1106,10 @@
};
# extra systemd stuff
- systemd = {
- services = {
- invidious_token = {
- script = ''
- set -euo pipefail
-
- a="$(${pkgs.podman}/bin/podman run quay.io/invidious/youtube-trusted-session-generator | sed -n 4,5p)"
- visitor_data=$(echo "$a" | sed -n 1p | cut -d' ' -f2)
- po_token=$(echo "$a" | sed -n 2p | cut -d' ' -f2)
- day=$(date +%e | tr -d ' ')
-
- printf '{"visitor_data": "%s",\n"po_token": "%s",\n' \
- "$visitor_data" "$po_token" \
- >/run/invidious_settings
-
- if [ $((day % 2)) -eq 0 ]; then
- printf '"force_resolve": "ipv6"}\n' >>/run/invidious_settings
- else
- printf '"force_resolve": "ipv4"}\n' >>/run/invidious_settings
- fi
-
- ${pkgs.systemd}/bin/systemctl restart invidious-sig-helper
- ${pkgs.systemd}/bin/systemctl restart invidious
- '';
- serviceConfig = {
- Type = "oneshot";
- User = "root";
- };
- };
-
- nginx = {
- after = [ "tailscaled.service" ];
- requires = [ "tailscaled.service" ];
- serviceConfig.Type = lib.mkForce "idle";
- };
-
- postgresql.serviceConfig.Type = lib.mkForce "idle";
- tailscaled.serviceConfig.Type = lib.mkForce "idle";
- };
-
- timers.invidious_token = {
- timerConfig = {
- OnCalendar = "hourly";
- Persistent = true;
- };
- wantedBy = [ "timers.target" ];
- };
+ systemd.services.nginx = {
+ after = [ "wg-quick@wg1.service" ];
+ requires = [ "wg-quick@wg1.service" ];
+ serviceConfig.Type = lib.mkForce "idle";
};
# create caches and use mandoc
@@ -1072,20 +1120,5 @@
mandoc.enable = true;
};
- # virtualization stuff
- virtualisation = {
- libvirtd.enable = true;
-
- podman = {
- enable = true;
- dockerCompat = true;
- };
- };
-
- xdg.portal = {
- config.common.default = [ "wlr" ];
- wlr.enable = true;
- };
-
system.stateVersion = "24.05";
}
diff --git a/hosts/hastur/default.nix b/hosts/hastur/default.nix
@@ -19,11 +19,9 @@
# decrypt agenix secrets
age.secrets = {
- tailscale_hastur = {
- file = ../../secrets/tailscale_hastur.age;
- owner = "root";
- group = "root";
- };
+ wg0_hastur.file = ../../secrets/wg0_hastur.age;
+ wg1_hastur.file = ../../secrets/wg1_hastur.age;
+ wpa_supplicant.file = ../../secrets/wpa_supplicant.age;
};
# boot options
@@ -40,34 +38,14 @@
];
};
- # disable wifi and open some ports
networking = {
hostName = "hastur";
hostId = "deadcafe";
wireless = {
enable = true;
-
- networks = {
- OpenDyna.pskRaw = "***REDACTED_PSK***";
-
- FloridaPoly = {
- authProtocols = [ "WPA-EAP" ];
- auth = ''
- eap=PEAP
- phase2="auth=MSCHAPv2"
- identity="***REDACTED_EMAIL***"
- password="***REDACTED_PASSWORD***"
- '';
- };
-
- USF-Guest = { };
-
- iphonebob.pskRaw = "***REDACTED_PSK***";
- Retreat_86WiFi.pskRaw = "***REDACTED_PSK***";
- Orbi-1.pskRaw = "***REDACTED_PSK***";
- SETUP-E55E.pskRaw = "***REDACTED_PSK***";
- };
+ userControlled = true;
+ allowAuxiliaryImperativeNetworks = true;
};
firewall = {
@@ -75,34 +53,58 @@
# allowedUDPPorts = [ ];
};
- # mullvad to miami
- wg-quick.interfaces.us-mia-wg-001 = {
- address = [
- "10.70.235.16/32"
- "fc00:bbbb:bbbb:bb01::7:eb0f/128"
- ];
- privateKey = "***REDACTED_WG_KEY***=";
-
- # supposed to be done by tailscale instead \_(:/)_/
- postUp = ''
- ip route add 100.64.0.0/24 dev tailscale0
- ip route add 100.100.100.100/32 dev tailscale0
- '';
- postDown = ''
- ip route del 100.64.0.0/24 dev tailscale0
- ip route del 100.100.100.100/32 dev tailscale0
- '';
+ wg-quick.interfaces = {
+ # mullvad
+ wg0 = {
+ address = [
+ "10.75.226.117/32"
+ "fc00:bbbb:bbbb:bb01::c:e274/128"
+ ];
+ privateKeyFile = config.age.secrets.wg0_hastur.path;
+
+ peers = [{
+ allowedIPs = [
+ "0.0.0.0/0"
+ "::0/0"
+ ];
+ endpoint = "45.134.142.206:51820";
+ publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
+ }];
+ };
- peers = [
- {
- allowedIPs = [
- "0.0.0.0/0"
- "::0/0"
- ];
- endpoint = "45.134.142.219:51820";
- publicKey = "FVEKAMJqaJU2AwWn5Mg9TK9IAfJc4XDUmSzEeC/VXGs=";
- }
- ];
+ # epistemia
+ wg1 = {
+ address = [
+ "10.0.13.3/24"
+ "fd00:b0ba:cafe:babe::3/64"
+ ];
+ privateKeyFile = config.age.secrets.wg1_hastur.path;
+
+ peers = [
+ # saklas
+ {
+ allowedIPs = [
+ "10.0.13.1/32"
+ "fd00:b0ba:cafe:babe::1/128"
+ ];
+ endpoint = "vineetk.net:51820";
+ persistentKeepalive = 25;
+ publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0=";
+ }
+ # demiurge (and lab through it)
+ {
+ allowedIPs = [
+ "10.0.13.2/32"
+ "10.0.13.5/32"
+ "fd00:b0ba:cafe:babe::2/128"
+ "fd00:b0ba:cafe:babe::5/128"
+ ];
+ endpoint = "carcosa.13f0.net:51820";
+ persistentKeepalive = 25;
+ publicKey = "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4=";
+ }
+ ];
+ };
};
};
@@ -126,8 +128,6 @@
isNormalUser = true;
extraGroups = [
- "kvm"
- "libvirtd"
"transmission"
"wheel"
];
@@ -135,7 +135,12 @@
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@hastur"
+ ];
+
+ packages = with pkgs; [
+ acpi
+ acpilight
];
};
@@ -149,6 +154,8 @@
];
pathsToLink = [ "/share/zsh" ];
+
+ etc."wpa_supplicant.conf".source = config.age.secrets.wpa_supplicant.path;
};
# enable bluetooth and add some udev rules
@@ -190,39 +197,57 @@
];
};
- pki.certificates = [
- ''
- -----BEGIN CERTIFICATE-----
- MIIBoDCCAUagAwIBAgIRANI8aOT3LE+pzmsQWjcDOIgwCgYIKoZIzj0EAwIwLjER
- MA8GA1UEChMIZGVtaXVyZ2UxGTAXBgNVBAMTEGRlbWl1cmdlIFJvb3QgQ0EwHhcN
- MjUwMjE4MDUzNTA5WhcNMzUwMjE2MDUzNTA5WjAuMREwDwYDVQQKEwhkZW1pdXJn
- ZTEZMBcGA1UEAxMQZGVtaXVyZ2UgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49
- AwEHA0IABMv8weeXJSDLygVlBxxAHLCvQCdf2COCk0QffNeDaVlIU/NFo3IyPSqG
- E3YtWEWamU/icgsJS999z3BZ5O+cTP6jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV
- HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRM51S3OgTxXwNhdSSHw6llz0APFzAK
- BggqhkjOPQQDAgNIADBFAiA9alHJ1XHLlKNRUGRL4tdFC3RZYHtoN8BmBHEfDa1S
- LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i
- -----END CERTIFICATE-----
- ''
- ];
-
sudo.enable = false;
};
services = {
# dns
- dnsmasq = {
+ unbound = {
enable = true;
settings = {
- server = [
- "/epistemia/100.100.100.100"
- "9.9.9.9"
- ];
+ server = {
+ interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ];
+ access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ];
+
+ hide-identity = yes;
+ hide-version = yes;
+
+ # Synthesize NXDOMAINs from DNSSEC NSEC chains.
+ # https://tools.ietf.org/html/rfc8198
+ aggressive-nsec = no;
+
+ local-zone = "saklas.epistemia." redirect;
+ local-data = "saklas.epistemia. 86400 IN A 10.0.13.1";
+ local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1";
+ local-zone = "demiurge.epistemia." redirect;
+ local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2";
+ local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2";
+ local-zone = "hastur.epistemia." redirect;
+ local-data = "hastur.epistemia. 86400 IN A 10.0.13.3";
+ local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3";
+ local-zone = "iphonebob.epistemia." redirect;
+ local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4";
+ local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4";
+ local-zone = "lab.epistemia." redirect;
+ local-data = "lab.epistemia. 86400 IN A 10.0.13.5";
+ local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5";
+ local-zone = "paraclete.epistemia." redirect;
+ local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6";
+ local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6";
+ };
+
+ # hagezi for dns-based adblocking (in addition to others)
+ rpz = {
+ name = "hagezi.ultimate";
+ zonefile = "hagezi.ultimate";
+ url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt";
+ };
- interface = "lo";
- listen-address = "127.0.0.1";
- bind-interfaces = true;
- no-resolv = true;
+ # go through mullvad for regular dns queries
+ forward-zone = {
+ name = ".";
+ forward-addr = [ "100.64.0.3" ];
+ };
};
};
@@ -258,33 +283,90 @@
# using pulseaudio and home-manager, so had to disable pulseaudio.
pipewire = {
enable = true;
+ alsa.enable = true;
+ audio.enable = true;
pulse.enable = true;
- };
- # vpn
- tailscale = {
- enable = true;
- authKeyFile = config.age.secrets.tailscale_hastur.path;
- extraDaemonFlags = [ "--no-logs-no-support" ];
- extraUpFlags = [
- "--login-server=https://headscale.13f0.net"
- "--advertise-exit-node"
- ];
- openFirewall = true;
+ extraConfig.pipewire = {
+ "99-filter-airpods.conf" = {
+ "context.modules" = [
+ {
+ name = "libpipewire-module-filter-chain";
+ args = {
+ node.name = "peq-airpods-pro-2-sink";
+ node.description = "PEQ AirPods Pro 2 (auto)";
+ playback.props = {
+ media.class = "Audio/Sink";
+ "filter.smart" = true;
+ "filter.smart.name" = "peq-airpods-pro-2";
+ };
+ filter.graph = [
+ {
+ type = "builtin";
+ name = "param_eq";
+ label = "param_eq_airpods";
+ config.filename = "/etc/pipewire/parametric/airpods-pro-2.txt";
+ }
+ ];
+ };
+ }
+ ];
+ };
+ };
+
+ # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt)
+ wireplumber = {
+ enable = true;
+ extraConfig."50-smartfilters-airpods.conf".text = ''
+ {
+ "monitor.bluez.rules" : [
+ # When a BlueZ device is detected we set an identifying property that the smart filter will match.
+ # (This fragment adds nothing by default; we're using a policy to match target.node later.)
+ ],
+
+ "policy.rules" : [
+ # The core smart filter matching is done by matching the target.node properties
+ # WirePlumber's smart filters will look for filter.smart.target (set below).
+ ],
+
+ "policy" : {
+ "smart_filters" : {
+ "rules" : [
+ {
+ "matches" : [
+ { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
+ ],
+ "actions" : {
+ # If target device matches, set the 'target.node' metadata for smart filters to use
+ "update-metadata" : {
+ "target.node" : { "name" : "bluez_output.*AirPods.*" }
+ }
+ }
+ }
+ ]
+ }
+ },
+
+ "endpoint.rules" : [
+ {
+ "matches" : [
+ { "node.name" : "peq-airpods-pro-2-sink" }
+ ],
+ "actions" : {
+ "update-props" : {
+ "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
+ }
+ }
+ }
+ ]
+ }
+ '';
+ };
};
# enable better power management
tlp.enable = true;
- # udev rules
- udev = {
- enable = true;
- extraRules = ''
- # ST-Link v2.1
- SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="374b", MODE:="0666"
- '';
- };
-
# to get startx and use amdgpu driver
# WM in home-manager
xserver = {
@@ -295,6 +377,11 @@
};
};
+ systemd.services."wg-quick@wg1" = {
+ after = [ "wg-quick@wg0.service" ];
+ requires = [ "wg-quick@wg0.service" ];
+ };
+
# create caches and use mandoc
documentation.man = {
enable = true;
@@ -303,11 +390,5 @@
mandoc.enable = true;
};
- # virtualization stuff
- virtualisation.podman = {
- enable = true;
- dockerCompat = true;
- };
-
system.stateVersion = "24.05";
}
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -18,7 +18,10 @@ in
"hetzner_dns.age".publicKeys = users ++ [ saklas ];
"radicale_users.age".publicKeys = users ++ [ saklas ];
- "tailscale_demiurge.age".publicKeys = users ++ [ demiurge ];
- "tailscale_hastur.age".publicKeys = users ++ [ hastur ];
- "tailscale_saklas.age".publicKeys = users ++ [ saklas ];
+ "wg0_demiurge.age".publicKeys = users ++ [ demiurge ];
+ "wg0_hastur.age".publicKeys = users ++ [ hastur ];
+ "wg1_demiurge.age".publicKeys = users ++ [ demiurge ];
+ "wg1_hastur.age".publicKeys = users ++ [ hastur ];
+
+ "wpa_supplicant.age".publicKeys = users ++ [ hastur ];
}
diff --git a/secrets/tailscale_demiurge.age b/secrets/tailscale_demiurge.age
@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 AaF/mQ Tgl9rg4GuKxgZMuHcwCw7ykOoZqRX3t4UN/E9qcMZSI
-LdVTcOS8pGeKwh/18QYtaGFuSRTKawDTtYyvurev0NE
--> ssh-ed25519 F30WWA G0HHHxSzX7RznR8CLhlDOqev4a8eA5odn6IyJnEZaRA
-j9ivd4Jg3uAO13ffuouTlGyJDsTppBlHGFftzSncuKM
--> ssh-ed25519 hc2ELA iCpXfQ7xRoQNkN0meAy3weOJkWOLY9dLNm9chmMGmlE
-6E7ZRjh7C+HrjyzGCVAf5Menk4UGXyIRrqOAb4nyOvI
---- QgTpqSI1sMG0nNYu1jtZAKJ9pcvCVgivW7UW24+F9nw
-к!J%ngNheG/
-ej~TBEm`k⍾pIpR 5~96?+8>
-\ No newline at end of file
diff --git a/secrets/tailscale_hastur.age b/secrets/tailscale_hastur.age
Binary files differ.
diff --git a/secrets/tailscale_saklas.age b/secrets/tailscale_saklas.age
@@ -1,11 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 AaF/mQ eUu7OoAObwNKVNHnf4gqC1tJ7xlmjkhW01G+HdcqAxc
-SwYGhawZISYmqHSyA7fqKs05IzVlVu+3+7zDgvBBbkQ
--> ssh-ed25519 F30WWA A8NddnDcg3IlQ8wJhuLoj1oS9rvRaIzLWFR+zp5qjAA
-Rezb8NRw32cQSytyegAGW5s/knHQUseHoSTeHpmlJGs
--> ssh-ed25519 hc2ELA za1uRZpbO1VkGdIVnNqYJkrJpCji/JEBq3lPolodhxU
-u/FlNi8t03cwOvdqmUGOMPhAbVmLnWHAbScYCAbTvxw
---- BaEwzkb52piuKrSglC0P8xCr/HlD97B3WgklyyuBEbA
-C`
-fqAO4̛4/{W᫇Tƫ)j_dnDkACi3
-8(L^'I҆$bgp
-\ No newline at end of file
diff --git a/secrets/wg0_demiurge.age b/secrets/wg0_demiurge.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ yqsS5z6keZjZRc2WECiDtrIQ81uy9dPNuC+4JL4QGgQ
+PZfc4aEh3zIexIpLjcJjtPmXN7nFNFPzUcsjwNj1GtI
+-> ssh-ed25519 F30WWA lK3glF0i1Z8i16YF+Pc7AlJjEk3zETFt6HYBrzHntFk
+hsh9wGSi08ZFGUzF8nl3aT3EqMmciGTDjvfxW9FXNKA
+--- 5SHG64tPuD9a4EfWVs8RteQTpBcNR9ZiLKvuUukraZI
+k] !ax ^ OLOb^93@h) Vx˲-"!AR
+\ No newline at end of file
diff --git a/secrets/wg0_hastur.age b/secrets/wg0_hastur.age
@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ 56BWU8ca94VnN9a2XS9MyMECcA2NnUvclaIgzsAasGw
+4ym2vDPFta3Jjp1ZEmGg+4QjtfqCv98crJmFFJxK4Wk
+-> ssh-ed25519 CQpZUw 8T0BdKSFpFj9j8wfe2h9s1uvweGDlJYmLaBaF1h+31A
+JV2ckgV8Hg6EYx44Uh0XF3FvZf6T5bnRULT+5pCueLw
+--- jB4Nfx/RnFtL0sOSc0mfZ3a98IsDl03dAj0SqqqZoz0
+oR-ɨKlЍlg a!RĝX)_Tě
+nclyV2!Yqkpjois|
+\ No newline at end of file
diff --git a/secrets/wg1_demiurge.age b/secrets/wg1_demiurge.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ MX+cICKRHIB8NaZ6+Kdz6wmhGQHgzNthVe4BiFp3V2c
+pZa2tCwE4YRTS/4kTdlu5DrHNFePU8BiDNXZI0Uaeg0
+-> ssh-ed25519 F30WWA UfyQtZSmrl9pw9FVNCxGOo0ICIglS9Q4sDRTg/1PXTw
+Sd6q4jECTtdRfGbgeAf/AniX5gw64ZZ/PrESAlst5tg
+--- YkDaRa81QgMNVefXmDCPv2OdDI1BtMO4AhixPoKx2Os
+8ח/-p>т^?A$<>|!0Mu-Az m/g!;tᙌǙ!ݎ
+\ No newline at end of file
diff --git a/secrets/wg1_hastur.age b/secrets/wg1_hastur.age
@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 AaF/mQ Bb1FBNNOPSZ5hJeoRIfnjBU4kQVbXOK/0Eems+055Xo
+l1O6Jab0xAzeV1VgnzltinixgeC3xT+60vMrW49CtYQ
+-> ssh-ed25519 CQpZUw gTPSRzQQ25H7oimwatm0F1pgKdXGHGyuaww6dhPaqCE
+VxK1cjss0z6Vw5hCM4Soao9E5VdQw1FoXUNTLQ2744M
+--- h1Cg8XMs8MEPnjDtsebMzWsjvoJ2oyi+YthMaSxAhvA
+i_3KfH=j<PUf ; wU#3aax琞_:8g( 6|Uw>
+\ No newline at end of file
diff --git a/secrets/wpa_supplicant.age b/secrets/wpa_supplicant.age
Binary files differ.
