From bd18f4a8f3d5d3d360216bbb01ae83514c28d00c Mon Sep 17 00:00:00 2001 From: vin Date: Sat, 20 Sep 2025 17:31:10 -0400 Subject: prepare repo for switching back to nixos --- home.nix | 727 ++++------------------------------------- hosts/demiurge/default.nix | 509 +++++++++++++++-------------- hosts/hastur/default.nix | 297 +++++++++++------ secrets/secrets.nix | 9 +- secrets/tailscale_demiurge.age | 10 - secrets/tailscale_hastur.age | Bin 371 -> 0 bytes secrets/tailscale_saklas.age | 11 - secrets/wg0_demiurge.age | 7 + secrets/wg0_hastur.age | 8 + secrets/wg1_demiurge.age | 7 + secrets/wg1_hastur.age | 7 + secrets/wpa_supplicant.age | Bin 0 -> 1095 bytes 12 files changed, 552 insertions(+), 1040 deletions(-) delete mode 100644 secrets/tailscale_demiurge.age delete mode 100644 secrets/tailscale_hastur.age delete mode 100644 secrets/tailscale_saklas.age create mode 100644 secrets/wg0_demiurge.age create mode 100644 secrets/wg0_hastur.age create mode 100644 secrets/wg1_demiurge.age create mode 100644 secrets/wg1_hastur.age create mode 100644 secrets/wpa_supplicant.age diff --git a/home.nix b/home.nix index 6497147..a56ea21 100644 --- a/home.nix +++ b/home.nix @@ -37,6 +37,28 @@ let }; extraPkgs = pkgs: [ pkgs.icu ]; }; + + my-texlive = with pkgs; texlive.withPackages (texlivePackages: with texlivePackages; [ + # A minimal base scheme and a common build tool + scheme-small + latexmk + + # Packages from your research paper's preamble + amsmath + graphicx + siunitx + booktabs + algorithm2e + caption + pslatex + ec + microtype + cite + url + xcolor + hyperref + ]); + in { home = { @@ -45,68 +67,50 @@ in stateVersion = "24.05"; packages = with pkgs; [ - # normal utils - neofetch - rclone - wcalc - - # programming - python3 - - # CAD software - kicad - openscad - # document writing and viewing mupdf # needed for emacs docview - texlive.combined.scheme-full - zathura + my-texlive # messaging profanity vesktop # email - notmuch + muchsync oauth2ms # hardware - acpi - acpilight amdgpu_top # encryption age - age-plugin-yubikey - oathToolkit - yubikey-agent - yubikey-manager + oath-toolkit + # TODO actually use my yubikey? + #age-plugin-yubikey + #yubikey-agent + #yubikey-manager # system utils - dmenu file htop mlocate ncdu - tree - unzip - p7zip - page - fd + #tree + #unzip + #p7zip ripgrep # X and desktop-related scrot sxiv xclip - xdotool xwallpaper - # wayland and desktop-related - grim - slurp - wl-clipboard - wmenu + # desktop-related + dmenu + scrot + xclip + xsel # 3d printing prusa-slicer @@ -210,9 +214,9 @@ in accounts = { university = { - address = "***REDACTED_EMAIL***"; + address = "vsureshkumar3892@floridapoly.edu"; realName = "Vineet Kumar"; - userName = "***REDACTED_EMAIL***"; + userName = "vsureshkumar3892@floridapoly.edu"; passwordCommand = "oauth2ms"; imap.host = "outlook.office365.com"; @@ -386,6 +390,20 @@ in mpv = { enable = true; + package = pkgs.mpv.override { + archiveSupport = false; + bluraySupport = false; + bs2bSupport = false; + cacaSupport = false; + cmsSupport = false; + dvdnavSupport = false; + javascriptSupport = false; + pipewireSupport = true; + pulseSupport = false; + rubberbandSupport = false; + waylandSupport = false; + zimgSupport = false; + }; bindings = { # I wish there was a more elegant way of setting Anime4K @@ -414,197 +432,23 @@ in }; }; - neovim = { - enable = true; - - extraLuaConfig = '' - -- my better defaults - vim.opt.autoindent = true - vim.opt.autoread = true - vim.opt.backup = false - vim.opt.hlsearch = false - vim.opt.relativenumber = true - vim.opt.ignorecase = true - - -- colors - vim.opt.bg = "dark" - vim.opt.colorcolumn = "80" - vim.cmd("colorscheme everblush") - - -- mappings - vim.g.mapleader = " " - vim.keymap.set('n', 'g', 'Neogit cwd=%:p:h') - vim.keymap.set('n', 'l', 'ls') - vim.keymap.set('n', 'tt', 'Telescope') - vim.keymap.set('n', 'tb', 'Telescope buffers') - vim.keymap.set('n', 'tf', 'Telescope frecency') - ''; - - plugins = with pkgs.vimPlugins; [ - { - plugin = ( - pkgs.vimUtils.buildVimPlugin { - name = "everblush-nvim"; - src = pkgs.fetchFromGitHub { - owner = "everblush"; - repo = "nvim"; - rev = "9a0e695fdd57b340d3ba2b72406e3ca519029f25"; - hash = "sha256-O6Erp+Tzk5TV5gpgVs73cO6v9vgeUVYpunrtf/7Ppic="; - }; - } - ); - config = '' - lua << END - require "everblush".setup { - transparent_background = true, - - override = { - LineNr = { fg = "#b3b9b8" }, - }, - } - END - ''; - } - - # languages - vim-nix - - # qol plugins - { - plugin = which-key-nvim; - config = '' - lua << END - require "which-key".setup { - delay = 300 - } - END - ''; - } - neogit - gitsigns-nvim - - # telescope stuff - { - plugin = telescope-nvim; - config = '' - lua << END - require "telescope".setup { - defaults = vim.tbl_extend( - "force", - require "telescope.themes".get_ivy(), - { - layout_config = { height = 10 }, - } - ) - } - END - ''; - } - { - plugin = telescope-zf-native-nvim; - config = '' - lua << END - require "telescope".load_extension("zf-native") - END - ''; - } - { - plugin = telescope-frecency-nvim; - config = '' - lua << END - require "telescope".load_extension("frecency") - END - ''; - } - - # tree-sitter stuff, mainly for better syntax highlighting - nvim-treesitter - nvim-treesitter-textobjects - ] ++ (with pkgs.vimPlugins.nvim-treesitter-parsers; [ - arduino - asm - awk - bash - bibtex - c - cmake - commonlisp - cpp - css - csv - diff - disassembly - dockerfile - forth - git_config - git_rebase - gitattributes - gitcommit - gitignore - go - gomod - gosum - haskell - html - ini - json - kconfig - latex - lua - luadoc - luap - luau - make - markdown - markdown_inline - meson - muttrc - nasm - ninja - nix - ocaml - ocaml_interface - ocamllex - printf - python - r - regex - rust - scheme - scss - slang - sql - sway - tcl - toml - udev - xml - yaml - zig - ]); - - viAlias = true; - vimAlias = true; - withNodeJs = false; - withPython3 = false; - withRuby = false; - }; - notmuch = { enable = true; extraConfig.user = { name = "Vineet Kumar"; primary_email = "me@vineetk.net"; - other_email = "vineet@vineetk.net;***REDACTED_EMAIL***;kar@13f0.net"; + other_email = "vineet@vineetk.net;vsureshkumar3892@floridapoly.edu;kar@13f0.net"; }; hooks = { postNew = '' notmuch tag +13f0 -- tag:unread and to:"*@13f0.net" notmuch tag +vineetk -- tag:unread and to:"*@vineetk.net" - notmuch tag +university -- tag:unread and to:***REDACTED_EMAIL*** + notmuch tag +university -- tag:unread and to:"*@floridapoly.edu" notmuch tag +openbsd_announce -inbox -- tag:unread and to:announce@openbsd.org notmuch tag +openbsd_arm -inbox -- tag:unread and to:arm@openbsd.org notmuch tag +openbsd_misc -inbox -- tag:unread and to:misc@openbsd.org + notmuch tag +openbsd_ports -inbox -- tag:unread and to:ports@openbsd.org + notmuch tag +openbsd_tech -inbox -- tag:unread and to:tech@openbsd.org notmuch tag +opensmtpd_misc -inbox -- tag:unread and to:misc@opensmtpd.org notmuch tag +oss_security -inbox -- tag:unread and to:oss-security@lists.openwall.com notmuch tag +tuhs -inbox -- tag:unread and to:tuhs@tuhs.org @@ -619,7 +463,6 @@ in quickmarks = { canvas = "https://floridapolytechnic.instructure.com"; cams = "https://cams.floridapoly.org/student/login.asp"; - weather = "https://forecast.weather.gov/MapClick.php***REMOVED***"; entertrained = "https://entertrained.app/"; burst = "https://www.burst-type.pro/"; colemakcamp = "https://colemakcamp.github.io/"; @@ -779,7 +622,6 @@ in # glance? # gpg-agent with ssh? # mpd and ncmpcpp? - # nextcloud-client? # pass-secret-service? # plan9port for plumbing? # recoll? @@ -787,232 +629,6 @@ in # screen-locker # sxhkd if using bspwm and not i3 # unison - # vdirsyncer - - # parametric equalizer (and other stuff I don't use) in pipewire - easyeffects = { - enable = true; - preset = "he5xx_oratory1990"; - extraPresets.he5xx_oratory1990 = { - output = { - blocklist = [ ]; - "equalizer#0" = { - balance = 0; - bypass = false; - input-gain = -10.8; - left = { - band0 = { - frequency = 25; - gain = 5.3; - mode = "APO (DR)"; - mute = false; - q = 1; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band1 = { - frequency = 105; - gain = 5.5; - mode = "APO (DR)"; - mute = false; - q = 0.666667; - slope = "x1"; - solo = false; - type = "Lo-shelf"; - width = 4; - }; - band2 = { - frequency = 470; - gain = -1; - mode = "APO (DR)"; - mute = false; - q = 4; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band3 = { - frequency = 530; - gain = 1.8; - mode = "APO (DR)"; - mute = false; - q = 1.2; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band4 = { - frequency = 800; - gain = 5; - mode = "APO (DR)"; - mute = false; - q = 0.666667; - slope = "x1"; - solo = false; - type = "Hi-shelf"; - width = 4; - }; - band5 = { - frequency = 910; - gain = -3.4; - mode = "APO (DR)"; - mute = false; - q = 3; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band6 = { - frequency = 1300; - gain = -3.3; - mode = "APO (DR)"; - mute = false; - q = 3; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band7 = { - frequency = 5400; - gain = -4.8; - mode = "APO (DR)"; - mute = false; - q = 4.5; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band8 = { - frequency = 11000; - gain = -7; - mode = "APO (DR)"; - mute = false; - q = 0.666667; - slope = "x1"; - solo = false; - type = "Hi-shelf"; - width = 4; - }; - }; - mode = "IIR"; - num-bands = 9; - output-gain = 0; - pitch-left = 0; - pitch-right = 0; - right = { - band0 = { - frequency = 25; - gain = 5.3; - mode = "APO (DR)"; - mute = false; - q = 1; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band1 = { - frequency = 105; - gain = 5.5; - mode = "APO (DR)"; - mute = false; - q = 0.666667; - slope = "x1"; - solo = false; - type = "Lo-shelf"; - width = 4; - }; - band2 = { - frequency = 470; - gain = -1; - mode = "APO (DR)"; - mute = false; - q = 4; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band3 = { - frequency = 530; - gain = 1.8; - mode = "APO (DR)"; - mute = false; - q = 1.2; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band4 = { - frequency = 800; - gain = 5; - mode = "APO (DR)"; - mute = false; - q = 0.666667; - slope = "x1"; - solo = false; - type = "Hi-shelf"; - width = 4; - }; - band5 = { - frequency = 910; - gain = -3.4; - mode = "APO (DR)"; - mute = false; - q = 3; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band6 = { - frequency = 1300; - gain = -3.3; - mode = "APO (DR)"; - mute = false; - q = 3; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band7 = { - frequency = 5400; - gain = -4.8; - mode = "APO (DR)"; - mute = false; - q = 4.5; - slope = "x1"; - solo = false; - type = "Bell"; - width = 4; - }; - band8 = { - frequency = 11000; - gain = -7; - mode = "APO (DR)"; - mute = false; - q = 0.666667; - slope = "x1"; - solo = false; - type = "Hi-shelf"; - width = 4; - }; - }; - split-channels = false; - }; - plugins_order = [ "equalizer#0" ]; - }; - }; - }; poweralertd.enable = true; @@ -1118,18 +734,6 @@ in xdg = { enable = true; - portal = { - enable = true; - extraPortals = [ pkgs.xdg-desktop-portal-luminous ]; - config.sway = { - default = [ "luminous" ]; - "org.freedesktop.impl.portal.Screenshot" = [ "luminous" ]; - "org.freedesktop.impl.portal.ScreenCast" = [ "luminous" ]; - "org.freedesktop.impl.portal.Settings" = [ "luminous" ]; - "org.freedesktop.impl.portal.RemoteDesktop" = [ "luminous" ]; - }; - }; - configFile = { "qutebrowser/theme.py".text = '' # Colors. @@ -1343,221 +947,4 @@ in videos = "$HOME/"; }; }; - - wayland.windowManager.sway = { - enable = true; - package = pkgs.swayfx; - - # https://github.com/nix-community/home-manager/issues/5379#issuecomment-2096066969 - checkConfig = false; - - config = { - input."type:pointer".accel_profile = "flat"; - output."*".background = "~/pics/wp/elite_milky_way_below2.png fill"; - - bars = [ - { - colors = { - # background = colors.current.primary.background; - background = "#000000"; - statusline = colors.current.primary.foreground; - focusedWorkspace = { - background = colors.current.normal.black; - border = colors.current.normal.black; - text = colors.current.normal.green; - }; - activeWorkspace = { - background = colors.current.normal.black; - border = colors.current.normal.black; - text = colors.current.primary.foreground; - }; - inactiveWorkspace = { - background = colors.current.primary.background; - border = colors.current.primary.background; - text = colors.current.normal.white; - }; - }; - command = "${pkgs.sway}/bin/swaybar"; - position = "top"; - statusCommand = "while date +'%Y-%m-%d %X'; do sleep 1; done"; - } - ]; - - colors = { - focused = { - background = colors.current.primary.background; - border = colors.current.primary.background; - childBorder = colors.current.primary.background; - indicator = colors.current.normal.black; - text = colors.current.normal.green; - }; - focusedInactive = { - background = colors.current.primary.background; - border = colors.current.primary.background; - childBorder = colors.current.primary.background; - indicator = colors.current.normal.black; - text = colors.current.primary.foreground; - }; - unfocused = { - background = colors.current.normal.black; - border = colors.current.normal.black; - childBorder = colors.current.normal.black; - indicator = colors.current.primary.background; - text = colors.current.normal.white; - }; - }; - - focus = { - mouseWarping = true; - wrapping = "yes"; - }; - - fonts = { - names = [ "monospace" ]; - size = 11.0; - }; - - gaps = { - inner = 15; - smartGaps = true; - }; - - keybindings = - let - left = "n"; - down = "e"; - up = "o"; - right = "i"; - modifier = config.wayland.windowManager.sway.config.modifier; - menu = config.wayland.windowManager.sway.config.menu; - terminal = config.wayland.windowManager.sway.config.terminal; - in - lib.mkOptionDefault { - "${modifier}+Return" = "exec ${terminal}"; - "${modifier}+p" = "exec ${menu}"; - "${modifier}+b" = "exec bm t"; - "${modifier}+Shift+b" = "exec kasimenu"; - "${modifier}+u" = "exec kasimenu user"; - "${modifier}+Shift+u" = "exec kasimenu email"; - "${modifier}+Shift+t" = "exec kasimenu_totp"; - - "${modifier}+Shift+q" = "kill"; - "${modifier}+Shift+c" = "reload"; - "Mod1+Mod4+Ctrl+Shift+e" = "exit"; - - "${modifier}+${left}" = "focus left;"; - "${modifier}+${down}" = "focus down;"; - "${modifier}+${up}" = "focus up;"; - "${modifier}+${right}" = "focus right;"; - "${modifier}+Shift+${left}" = "move left"; - "${modifier}+Shift+${down}" = "move down"; - "${modifier}+Shift+${up}" = "move up"; - "${modifier}+Shift+${right}" = "move right"; - - # TODO do this programatically - "${modifier}+1" = "workspace number 1"; - "${modifier}+2" = "workspace number 2"; - "${modifier}+3" = "workspace number 3"; - "${modifier}+4" = "workspace number 4"; - "${modifier}+5" = "workspace number 5"; - "${modifier}+6" = "workspace number 6"; - "${modifier}+7" = "workspace number 7"; - "${modifier}+8" = "workspace number 8"; - "${modifier}+9" = "workspace number 9"; - "${modifier}+0" = "workspace number 10"; - "${modifier}+Shift+1" = "move container to workspace number 1"; - "${modifier}+Shift+2" = "move container to workspace number 2"; - "${modifier}+Shift+3" = "move container to workspace number 3"; - "${modifier}+Shift+4" = "move container to workspace number 4"; - "${modifier}+Shift+5" = "move container to workspace number 5"; - "${modifier}+Shift+6" = "move container to workspace number 6"; - "${modifier}+Shift+7" = "move container to workspace number 7"; - "${modifier}+Shift+8" = "move container to workspace number 8"; - "${modifier}+Shift+9" = "move container to workspace number 9"; - "${modifier}+Shift+0" = "move container to workspace number 10"; - - "${modifier}+Ctrl+Shift+b" = "splith"; - "${modifier}+Ctrl+Shift+v" = "splitv"; - "${modifier}+s" = "layout stacking"; - "${modifier}+t" = "layout tabbed"; - "${modifier}+Ctrl+Shift+t" = "layout toggle split"; - "${modifier}+Shift+f" = "fullscreen"; - "${modifier}+Shift+space" = "floating toggle"; - "${modifier}+space" = "focus mode_toggle"; - "${modifier}+a" = "focus parent"; - - "${modifier}+r" = "mode resize"; - }; - - menu = "${pkgs.wmenu}/bin/wmenu-run"; - - modes.resize = - let - left = "n"; - down = "e"; - up = "o"; - right = "i"; - in - lib.mkOptionDefault { - ${left} = "resize shrink width 10px"; - ${down} = "resize grow height 10px"; - ${up} = "resize shrink width 10px"; - ${right} = "resize grow width 10px"; - Escape = "mode default"; - }; - - modifier = "Mod4"; - - terminal = "foot"; - - window = { - border = 0; - titlebar = false; - }; - - defaultWorkspace = "workspace number 1"; - workspaceAutoBackAndForth = true; - }; - - extraConfig = '' - # I hate xdg-desktop-portal - exec systemctl --user set-environment XDG_CURRENT_DESKTOP=sway - exec systemctl --user import-environment DISPLAY \ - SWAYSOCK \ - WAYLAND_DISPLAY \ - XDG_CURRENT_DESKTOP - exec hash dbus-update-activation-environment 2>/dev/null && \ - dbus-update-activation-environment --systemd DISPLAY \ - SWAYSOCK \ - XDG_CURRENT_DESKTOP=sway \ - WAYLAND_DISPLAY - - mouse_warping container - - blur enable - blur_xray disable - blur_radius 3 - blur_passes 5 - - corner_radius 10 - - shadows enable - shadow_blur_radius 10 - - for_window [class="Emacs"] opacity 0.9 - for_window [app_id="qutebrowser"] opacity 0.9 - for_window [app_id="vesktop"] opacity 0.9 - - for_window [title="profanity"] move container to workspace 9 - for_window [app_id="vesktop"] move container to workspace 10 - - exec ${pkgs.qutebrowser}/bin/qutebrowser - exec ${pkgs.vesktop}/bin/vesktop --use-vulkan --ozone-platform=wayland --enable-features=UseOzonePlatform,Vulkan - exec ${config.wayland.windowManager.sway.config.terminal} -T profanity -e ${pkgs.profanity}/bin/profanity - - # for elite va - bindsym --whole-window BTN_SIDE echo press >/tmp/elite_va.fifo - bindsym --whole-window --release BTN_SIDE echo release >/tmp/elite_va.fifo - ''; - }; } diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix index ab36f02..c53c3eb 100644 --- a/hosts/demiurge/default.nix +++ b/hosts/demiurge/default.nix @@ -21,14 +21,6 @@ allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ - /* - "cuda_cccl" - "cuda_cudart" - "cuda_nvcc" - "cudnn" - "libcublas" - "libcufile" - */ "steam" "steam-unwrapped" ]; @@ -43,30 +35,6 @@ }; overlays = [ - (self: super: { - invidious = super.invidious.overrideAttrs (old: { - # try removing shorts by ignoring any videos shorter than 65 seconds - postPatch = - old.postPatch - + '' - sed -i '/GROUP BY channel/a\ AND length_seconds > 65' src/invidious/database/channels.cr - sed -i 's/\({view_name}\) \(ORDER BY published\)/\1 WHERE length_seconds > 65 \2/' src/invidious/users.cr - sed -i 's/\({values})\) \(ORDER BY published\)/\1 AND length_seconds > 65 \2/' src/invidious/users.cr - ''; - }); - }) - (self: super: { - inv-sig-helper = super.inv-sig-helper.overrideAttrs (old: { - version = "0-unstable-2025-04-23"; - - src = super.fetchFromGitHub { - owner = "iv-org"; - repo = "inv_sig_helper"; - rev = "5d3c7a4574fafe0bc5fbed9e7e33483889832fd4"; - hash = "sha256-WGh62tjKGe9OD19aq+lP9GfYs5PrGqkeT6VvmtNottQ="; - }; - }); - }) (self: super: { alvr = super.alvr.overrideAttrs (old: { buildInputs = old.buildInputs ++ [ @@ -91,11 +59,8 @@ # decrypt agenix secrets age.secrets = { - tailscale_demiurge = { - file = ../../secrets/tailscale_demiurge.age; - owner = "root"; - group = "root"; - }; + wg0_demiurge.file = ../../secrets/wg0_demiurge.age; + wg1_demiurge.file = ../../secrets/wg0_demiurge.age; }; # boot options @@ -114,7 +79,7 @@ zfs.extraPools = [ "data_wd" - "nvme_warm" + "data" ]; }; @@ -134,34 +99,101 @@ allowedUDPPorts = [ 51413 ]; }; - # mullvad to miami - wg-quick.interfaces.us-mia-wg-002 = { - address = [ - "10.135.221.102/32" - "fc00:bbbb:bbbb:bb01:d:0:7:dd66/128" - ]; - privateKey = "***REDACTED_WG_KEY***="; + wg-quick.interfaces = { + # mullvad + wg0 = { + address = [ + "10.68.117.111/32" + "fc00:bbbb:bbbb:bb01::5:756e/128" + ]; + privateKeyFile = config.age.secrets.wg0_demiurge.path; - # supposed to be done by tailscale instead \_(:/)_/ - postUp = '' - ip route add 100.64.0.0/24 dev tailscale0 - ip route add 100.100.100.100/32 dev tailscale0 - ''; - postDown = '' - ip route del 100.64.0.0/24 dev tailscale0 - ip route del 100.100.100.100/32 dev tailscale0 - ''; + postUp = "ip route add 45.134.142.206 dev eth0"; + postDown = "ip route del 45.134.142.206 dev eth0"; - peers = [ - { - allowedIPs = [ - "0.0.0.0/0" - "::0/0" - ]; - endpoint = "45.134.142.206:51820"; - publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw="; - } - ]; + peers = [{ + allowedIPs = [ + "0.0.0.0/0" + "::0/0" + ]; + endpoint = "45.134.142.206:51820"; + publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw="; + }]; + }; + + # epistemia + wg1 = { + address = [ + "10.0.13.2/24" + "fd00:b0ba:cafe:babe::2/64" + ]; + privateKeyFile = config.age.secrets.wg1_demiurge.path; + listenPort = 51820; + fwMark = 51821; + MTU = 1420; + + table = false; + postUp = '' +PostUp = ip rule add from 10.0.13.0/24 lookup main pref 31000 +PostUp = ip rule add from all fwmark 51821 lookup 51821 pref 32000 +PostUp = ip route add default via 192.168.1.1 dev eth0 table 51821 + +# NAT iphonebob and allow traffic between peers (when routing through demiurge) +PostUp = iptables -F FORWARD +PostUp = iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE +PostUp = iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT +PostUp = iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT +PostUp = iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + ''; + preDown = '' +PreDown = ip rule del from all fwmark 51821 lookup 51821 pref 32000 +PreDown = ip rule del from 10.0.13.0/24 lookup main pref 31000 +PreDown = ip route flush table 51821 + +PreDown = iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE +PreDown = iptables -F FORWARD + ''; + + peers = [ + # saklas + { + allowedIPs = [ + "10.0.13.1/32" + "fd00:b0ba:cafe:babe::1/128" + ]; + endpoint = "157.180.125.215:51820"; + persistentKeepalive = 25; + publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0="; + } + # hastur + { + allowedIPs = [ + "10.0.13.3/32" + "fd00:b0ba:cafe:babe::3/128" + ]; + persistentKeepalive = 25; + publicKey = "MOmRjVbRuWEuK0oHQ+C0jTaceCUPd2fpzDbh8ue6bDc="; + } + # iphonebob + { + allowedIPs = [ + "10.0.13.4/32" + "fd00:b0ba:cafe:babe::4/128" + ]; + persistentKeepalive = 25; + publicKey = "Xn0EmeRZdpMejBgzr98mYtb/2f5O58GAzQLNZV/SS30="; + } + # lab + { + allowedIPs = [ + "10.0.13.5/32" + "fd00:b0ba:cafe:babe::5/128" + ]; + persistentKeepalive = 25; + publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE="; + } + ]; + }; }; }; @@ -186,24 +218,19 @@ isNormalUser = true; extraGroups = [ - "input" - "kvm" - "libvirtd" "transmission" - "video" "wheel" ]; shell = pkgs.zsh; openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@demiurge" ]; packages = with pkgs; [ alvr bs-manager - distrobox (llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; }) #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; }) ]; @@ -249,9 +276,6 @@ # steam, proprietary. I sometimes like playing nonfree games too. steam.enable = true; - # virtualization - virt-manager.enable = true; - # configuration in home-manager zsh.enable = true; zsh.promptInit = "PS1='$ '"; @@ -270,53 +294,57 @@ ]; }; - pki.certificates = [ - '' - -----BEGIN CERTIFICATE----- - MIIDMDCCAhigAwIBAgIUcSUafnojcFKod3f436VELfEKoFkwDQYJKoZIhvcNAQEL - BQAwHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlhMB4XDTI1MDMwMzEwMjQw - OVoXDTI2MDMwMzEwMjQwOVowHTEbMBkGA1UEAwwSZGVtaXVyZ2UuZXBpc3RlbWlh - MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwiRlreCXc7f+yWclxR2M - 639g0+Lr/c9HrX7EM2/olavPAtZgCzqqvJsDmXq4AURlwd82wZUZxXjWFwlRji/+ - WViXQBTWwnXVjc9MJlxTq2X2zfU2GIxYsrA1ZQuj0wVHlA+R/66oL0Padc/qQZfv - sshQnrqnutvGobBWEGJXcCIDiwUGgHlIoelwY9G0GLE/rkVujNjAonyMhVGJHVUv - lXyc3RNslQHymr4Wl6+lL6V6XfuB1taECJYSLXPx66TvJqod2Io+b7T7cWp+9g9U - B2jQu1YnPRpwjdPvbOCPjPbOP6UcbyHdbHAidSM0FSL5riVUmugwDwbQKXFFX2gH - hwIDAQABo2gwZjAfBgNVHREEGDAWghQqLmRlbWl1cmdlLmVwaXN0ZW1pYTATBgNV - HSUEDDAKBggrBgEFBQcDATAPBgNVHRMECDAGAQH/AgEAMB0GA1UdDgQWBBTjMVhw - zmkE6P5jFHkLVQE2gNB2ejANBgkqhkiG9w0BAQsFAAOCAQEAWvnwB83vXzQFpObF - vn/nfZ9wYpNaBsE15ab3Fwd2nDc55KDkDWgBi5Xl8fwN3OhFOU2XXBCYqbCU6asx - OnSx9glbhJioORO7B5ENbEYrpB97SaWASNXrBQ2KiQT5aC+9xb52K53kkk0tTn2l - nBb+jyLItzWX99H6EavOq69a4T2BObZaSPQAfpM8FIrKl+UZC3152+bi8wKfG4K4 - FQsOJMjIvhTm2IiOS8xIaZz7EJORxFjtOkLEIGGZBNK6QcnD714/nYbHSrQx4eNM - /ek8Rmf6DTLaFBx+raWyDTgMY23lvWTKDTT1+dZnRNcg72bFpIdqHsDrIg/IBjZ0 - 3eGfkQ== - -----END CERTIFICATE----- - '' - ]; - sudo.enable = false; }; services = { - # control unicorn barf - hardware.openrgb.enable = true; - # dns - dnsmasq = { + unbound = { enable = true; settings = { - server = [ - "192.168.1.1" - "/epistemia/100.100.100.100" - ]; + server = { + interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ]; + access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ]; + + hide-identity = yes; + hide-version = yes; + + # Synthesize NXDOMAINs from DNSSEC NSEC chains. + # https://tools.ietf.org/html/rfc8198 + aggressive-nsec = no; + + local-zone = "saklas.epistemia." redirect; + local-data = "saklas.epistemia. 86400 IN A 10.0.13.1"; + local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1"; + local-zone = "demiurge.epistemia." redirect; + local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2"; + local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2"; + local-zone = "hastur.epistemia." redirect; + local-data = "hastur.epistemia. 86400 IN A 10.0.13.3"; + local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3"; + local-zone = "iphonebob.epistemia." redirect; + local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4"; + local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4"; + local-zone = "lab.epistemia." redirect; + local-data = "lab.epistemia. 86400 IN A 10.0.13.5"; + local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5"; + local-zone = "paraclete.epistemia." redirect; + local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6"; + local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6"; + }; - interface = "lo"; - listen-address = "127.0.0.1"; - bind-interfaces = true; - no-resolv = true; + # hagezi for dns-based adblocking (in addition to others) + rpz = { + name = "hagezi.ultimate"; + zonefile = "hagezi.ultimate"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"; + }; - conf-file = "/data/src/clones/networking/hagezi_dns-blocklists/dnsmasq/ultimate.txt"; + # go through mullvad for regular dns queries + forward-zone = { + name = "."; + forward-addr = [ "100.64.0.3" ]; + }; }; }; @@ -361,39 +389,6 @@ }; }; - # invidious - invidious = { - enable = true; - - http3-ytproxy.enable = true; - nginx.enable = true; - sig-helper.enable = true; - - domain = "invidious.demiurge.epistemia"; - extraSettingsFile = "/run/invidious_settings"; - settings = { - admins = [ "vin" ]; - captcha_enabled = false; - registration_enabled = false; - hmac_key = "zCYyRa7vD0qt"; - default_user_preferences = { - captions = [ "English" ]; - dark_mode = "dark"; - feed_menu = [ - "Popular" - "Subscriptions" - "Playlists" - ]; - max_results = 100; - quality = "dash"; - save_player_pos = true; - unseen_only = true; - local = true; - extend_desc = true; - }; - }; - }; - # graphical input libinput = { enable = true; @@ -420,7 +415,7 @@ nginx = { enable = true; - defaultListenAddresses = [ "100.64.0.2" ]; + defaultListenAddresses = [ "10.0.13.2" "fd00:b0ba:cafe:babe::2" ]; recommendedGzipSettings = true; recommendedOptimisation = true; @@ -460,22 +455,14 @@ }; "sdui.demiurge.epistemia" = { - # addSSL = true; - # sslCertificate = "/var/demiurge.epistemia.crt"; - # sslCertificateKey = "/var/demiurge.epistemia.key"; + addSSL = true; + sslCertificate = "/var/demiurge.epistemia.crt"; + sslCertificateKey = "/var/demiurge.epistemia.key"; locations."/" = { proxyPass = "http://127.0.0.1:7860"; proxyWebsockets = true; }; }; - - "invidious.demiurge.epistemia" = { - addSSL = true; - enableACME = false; - forceSSL = false; - sslCertificate = "/var/demiurge.epistemia.crt"; - sslCertificateKey = "/var/demiurge.epistemia.key"; - }; }; }; @@ -508,7 +495,127 @@ # using pulseaudio and home-manager, so had to disable pulseaudio. pipewire = { enable = true; + alsa.enable = true; + audio.enable = true; pulse.enable = true; + + extraConfig.pipewire = { + "99-filter-he5xx.conf" = { + "context.modules" = [ + { + name = "libpipewire-module-filter-chain"; + args = { + node.name = "peq-he5xx-sink"; + node.description = "PEQ HE5XX (auto)"; + # playback.props is the virtual sink/device properties + playback.props = { + media.class = "Audio/Sink"; + "filter.smart" = true; + "filter.smart.name" = "peq-he5xx"; + # tell WirePlumber what target properties this filter is intended for + # (we leave this unset here; smart target matching will be done by wireplumber) + }; + # filter graph: single builtin param_eq node that loads the param file + filter.graph = [ + { + type = "builtin"; + name = "param_eq"; + label = "param_eq_he5xx"; + config.filename = "/etc/pipewire/parametric/he5xx.txt"; + } + ]; + }; + }; + ]; + }; + + "99-filter-airpods.conf" = { + "context.modules" = [ + { + name = "libpipewire-module-filter-chain"; + args = { + node.name = "peq-airpods-pro-2-sink"; + node.description = "PEQ AirPods Pro 2 (auto)"; + playback.props = { + media.class = "Audio/Sink"; + "filter.smart" = true; + "filter.smart.name" = "peq-airpods-pro-2"; + }; + filter.graph = [ + { + type = "builtin"; + name = "param_eq"; + label = "param_eq_airpods"; + config.filename = "/etc/pipewire/parametric/airpods-pro-2.txt"; + } + ]; + }; + } + ]; + }; + }; + + # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt) + wireplumber = { + enable = true; + extraConfig."50-smartfilters-airpods.conf".text = '' + { + "monitor.bluez.rules" : [ + # When a BlueZ device is detected we set an identifying property that the smart filter will match. + # (This fragment adds nothing by default; we're using a policy to match target.node later.) + ], + + "policy.rules" : [ + # The core smart filter matching is done by matching the target.node properties + # WirePlumber's smart filters will look for filter.smart.target (set below). + ], + + "policy" : { + "smart_filters" : { + "rules" : [ + { + "matches" : [ + { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } } + ], + "actions" : { + # If target device matches, set the 'target.node' metadata for smart filters to use + "update-metadata" : { + "target.node" : { "name" : "bluez_output.*AirPods.*" } + } + } + } + ] + } + }, + + "endpoint.rules" : [ + { + "matches" : [ + { "node.name" : "peq-airpods-pro-2-sink" } + ], + "actions" : { + "update-props" : { + # Mark this WF sink as intended for a specific target device. + # WirePlumber will use filter.smart.target to identify which device to chain to. + "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" } + } + } + }, + { + "matches" : [ + { "node.name" : "peq-he5xx-sink" } + ], + "actions" : { + "update-props" : { + # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules. + "filter.smart.target" : {} + } + } + } + ] + } + ''; + }; }; # reddit @@ -555,11 +662,11 @@ # Disable autoplay videos by default REDLIB_DEFAULT_AUTOPLAY_VIDEOS = false; # Define a default list of subreddit subscriptions (format: sub1+sub2+sub3) - REDLIB_DEFAULT_SUBSCRIPTIONS = "ergomechkeyboards+localllama+factorio+warframe+elitedangerous+unixporn+usabilityporn"; + REDLIB_DEFAULT_SUBSCRIPTIONS = "ergomechkeyboards+localllama+elitedangerous"; # Define a default list of subreddit filters (format: sub1+sub2+sub3) REDLIB_DEFAULT_FILTERS = "popular+all+funny+memes"; # Hide awards by default - REDLIB_DEFAULT_HIDE_AWARDS = false; + REDLIB_DEFAULT_HIDE_AWARDS = true; # Hide sidebar and summary REDLIB_DEFAULT_HIDE_SIDEBAR_AND_SUMMARY = false; # Disable the confirmation before visiting Reddit @@ -604,8 +711,8 @@ hostnames = { replace = { - "(.*\.)?youtube\.com$" = "invidious.demiurge.epistemia"; - "(.*\.)?youtu\.be$" = "invidious.demiurge.epistemia"; + "(.*\.)?youtube\.com$" = "yewtu.be"; + "(.*\.)?youtu\.be$" = "yewtu.be"; "(.*\.)?reddit\.com$" = "redlib.demiurge.epistemia"; "(.*\.)?redd\.it$" = "redlib.demiurge.epistemia"; }; @@ -967,7 +1074,6 @@ doi_resolvers = { "oadoi.org" = "https://oadoi.org/"; "doi.org" = "https://doi.org/"; - "doai.io" = "https://dissem.in/"; "sci-hub.se" = "https://sci-hub.se/"; "sci-hub.st" = "https://sci-hub.st/"; "sci-hub.ru" = "https://sci-hub.ru/"; @@ -977,25 +1083,10 @@ }; }; - # vpn - tailscale = { - enable = true; - authKeyFile = config.age.secrets.tailscale_demiurge.path; - extraDaemonFlags = [ "--no-logs-no-support" ]; - extraUpFlags = [ - "--login-server=https://headscale.13f0.net" - "--advertise-exit-node" - ]; - openFirewall = true; - }; - # udev rules udev = { enable = true; extraRules = '' - # ST-Link v2.1 - SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="374b", MODE:="0666" - # Oculus Quest 2 SUBSYSTEM=="usb", ATTR{idVendor}=="2833", ATTR{idProduct}=="0186", MODE="0660", GROUP="input", SYMLINK+="ocuquest%n" @@ -1015,53 +1106,10 @@ }; # extra systemd stuff - systemd = { - services = { - invidious_token = { - script = '' - set -euo pipefail - - a="$(${pkgs.podman}/bin/podman run quay.io/invidious/youtube-trusted-session-generator | sed -n 4,5p)" - visitor_data=$(echo "$a" | sed -n 1p | cut -d' ' -f2) - po_token=$(echo "$a" | sed -n 2p | cut -d' ' -f2) - day=$(date +%e | tr -d ' ') - - printf '{"visitor_data": "%s",\n"po_token": "%s",\n' \ - "$visitor_data" "$po_token" \ - >/run/invidious_settings - - if [ $((day % 2)) -eq 0 ]; then - printf '"force_resolve": "ipv6"}\n' >>/run/invidious_settings - else - printf '"force_resolve": "ipv4"}\n' >>/run/invidious_settings - fi - - ${pkgs.systemd}/bin/systemctl restart invidious-sig-helper - ${pkgs.systemd}/bin/systemctl restart invidious - ''; - serviceConfig = { - Type = "oneshot"; - User = "root"; - }; - }; - - nginx = { - after = [ "tailscaled.service" ]; - requires = [ "tailscaled.service" ]; - serviceConfig.Type = lib.mkForce "idle"; - }; - - postgresql.serviceConfig.Type = lib.mkForce "idle"; - tailscaled.serviceConfig.Type = lib.mkForce "idle"; - }; - - timers.invidious_token = { - timerConfig = { - OnCalendar = "hourly"; - Persistent = true; - }; - wantedBy = [ "timers.target" ]; - }; + systemd.services.nginx = { + after = [ "wg-quick@wg1.service" ]; + requires = [ "wg-quick@wg1.service" ]; + serviceConfig.Type = lib.mkForce "idle"; }; # create caches and use mandoc @@ -1072,20 +1120,5 @@ mandoc.enable = true; }; - # virtualization stuff - virtualisation = { - libvirtd.enable = true; - - podman = { - enable = true; - dockerCompat = true; - }; - }; - - xdg.portal = { - config.common.default = [ "wlr" ]; - wlr.enable = true; - }; - system.stateVersion = "24.05"; } diff --git a/hosts/hastur/default.nix b/hosts/hastur/default.nix index 5127533..d9507c4 100644 --- a/hosts/hastur/default.nix +++ b/hosts/hastur/default.nix @@ -19,11 +19,9 @@ # decrypt agenix secrets age.secrets = { - tailscale_hastur = { - file = ../../secrets/tailscale_hastur.age; - owner = "root"; - group = "root"; - }; + wg0_hastur.file = ../../secrets/wg0_hastur.age; + wg1_hastur.file = ../../secrets/wg1_hastur.age; + wpa_supplicant.file = ../../secrets/wpa_supplicant.age; }; # boot options @@ -40,34 +38,14 @@ ]; }; - # disable wifi and open some ports networking = { hostName = "hastur"; hostId = "deadcafe"; wireless = { enable = true; - - networks = { - OpenDyna.pskRaw = "***REDACTED_PSK***"; - - FloridaPoly = { - authProtocols = [ "WPA-EAP" ]; - auth = '' - eap=PEAP - phase2="auth=MSCHAPv2" - identity="***REDACTED_EMAIL***" - password="***REDACTED_PASSWORD***" - ''; - }; - - USF-Guest = { }; - - iphonebob.pskRaw = "***REDACTED_PSK***"; - Retreat_86WiFi.pskRaw = "***REDACTED_PSK***"; - Orbi-1.pskRaw = "***REDACTED_PSK***"; - SETUP-E55E.pskRaw = "***REDACTED_PSK***"; - }; + userControlled = true; + allowAuxiliaryImperativeNetworks = true; }; firewall = { @@ -75,34 +53,58 @@ # allowedUDPPorts = [ ]; }; - # mullvad to miami - wg-quick.interfaces.us-mia-wg-001 = { - address = [ - "10.70.235.16/32" - "fc00:bbbb:bbbb:bb01::7:eb0f/128" - ]; - privateKey = "***REDACTED_WG_KEY***="; - - # supposed to be done by tailscale instead \_(:/)_/ - postUp = '' - ip route add 100.64.0.0/24 dev tailscale0 - ip route add 100.100.100.100/32 dev tailscale0 - ''; - postDown = '' - ip route del 100.64.0.0/24 dev tailscale0 - ip route del 100.100.100.100/32 dev tailscale0 - ''; + wg-quick.interfaces = { + # mullvad + wg0 = { + address = [ + "10.75.226.117/32" + "fc00:bbbb:bbbb:bb01::c:e274/128" + ]; + privateKeyFile = config.age.secrets.wg0_hastur.path; + + peers = [{ + allowedIPs = [ + "0.0.0.0/0" + "::0/0" + ]; + endpoint = "45.134.142.206:51820"; + publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw="; + }]; + }; - peers = [ - { - allowedIPs = [ - "0.0.0.0/0" - "::0/0" - ]; - endpoint = "45.134.142.219:51820"; - publicKey = "FVEKAMJqaJU2AwWn5Mg9TK9IAfJc4XDUmSzEeC/VXGs="; - } - ]; + # epistemia + wg1 = { + address = [ + "10.0.13.3/24" + "fd00:b0ba:cafe:babe::3/64" + ]; + privateKeyFile = config.age.secrets.wg1_hastur.path; + + peers = [ + # saklas + { + allowedIPs = [ + "10.0.13.1/32" + "fd00:b0ba:cafe:babe::1/128" + ]; + endpoint = "vineetk.net:51820"; + persistentKeepalive = 25; + publicKey = "XvRailvccuc7LJIF4aaYM/MLkU4upiprwFlCfBllhl0="; + } + # demiurge (and lab through it) + { + allowedIPs = [ + "10.0.13.2/32" + "10.0.13.5/32" + "fd00:b0ba:cafe:babe::2/128" + "fd00:b0ba:cafe:babe::5/128" + ]; + endpoint = "carcosa.13f0.net:51820"; + persistentKeepalive = 25; + publicKey = "FMLvbSxY6vA8CRV4S1vl4+pMeCr/kR9n0G5w9buNqh4="; + } + ]; + }; }; }; @@ -126,8 +128,6 @@ isNormalUser = true; extraGroups = [ - "kvm" - "libvirtd" "transmission" "wheel" ]; @@ -135,7 +135,12 @@ shell = pkgs.zsh; openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH vin@hastur" + ]; + + packages = with pkgs; [ + acpi + acpilight ]; }; @@ -149,6 +154,8 @@ ]; pathsToLink = [ "/share/zsh" ]; + + etc."wpa_supplicant.conf".source = config.age.secrets.wpa_supplicant.path; }; # enable bluetooth and add some udev rules @@ -190,39 +197,57 @@ ]; }; - pki.certificates = [ - '' - -----BEGIN CERTIFICATE----- - MIIBoDCCAUagAwIBAgIRANI8aOT3LE+pzmsQWjcDOIgwCgYIKoZIzj0EAwIwLjER - MA8GA1UEChMIZGVtaXVyZ2UxGTAXBgNVBAMTEGRlbWl1cmdlIFJvb3QgQ0EwHhcN - MjUwMjE4MDUzNTA5WhcNMzUwMjE2MDUzNTA5WjAuMREwDwYDVQQKEwhkZW1pdXJn - ZTEZMBcGA1UEAxMQZGVtaXVyZ2UgUm9vdCBDQTBZMBMGByqGSM49AgEGCCqGSM49 - AwEHA0IABMv8weeXJSDLygVlBxxAHLCvQCdf2COCk0QffNeDaVlIU/NFo3IyPSqG - E3YtWEWamU/icgsJS999z3BZ5O+cTP6jRTBDMA4GA1UdDwEB/wQEAwIBBjASBgNV - HRMBAf8ECDAGAQH/AgEBMB0GA1UdDgQWBBRM51S3OgTxXwNhdSSHw6llz0APFzAK - BggqhkjOPQQDAgNIADBFAiA9alHJ1XHLlKNRUGRL4tdFC3RZYHtoN8BmBHEfDa1S - LQIhANgsvYmyCp/Nur2RKaV25CDg3kMYVBXED2HVDy8qa+3i - -----END CERTIFICATE----- - '' - ]; - sudo.enable = false; }; services = { # dns - dnsmasq = { + unbound = { enable = true; settings = { - server = [ - "/epistemia/100.100.100.100" - "9.9.9.9" - ]; + server = { + interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ]; + access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ]; + + hide-identity = yes; + hide-version = yes; + + # Synthesize NXDOMAINs from DNSSEC NSEC chains. + # https://tools.ietf.org/html/rfc8198 + aggressive-nsec = no; + + local-zone = "saklas.epistemia." redirect; + local-data = "saklas.epistemia. 86400 IN A 10.0.13.1"; + local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1"; + local-zone = "demiurge.epistemia." redirect; + local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2"; + local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2"; + local-zone = "hastur.epistemia." redirect; + local-data = "hastur.epistemia. 86400 IN A 10.0.13.3"; + local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3"; + local-zone = "iphonebob.epistemia." redirect; + local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4"; + local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4"; + local-zone = "lab.epistemia." redirect; + local-data = "lab.epistemia. 86400 IN A 10.0.13.5"; + local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5"; + local-zone = "paraclete.epistemia." redirect; + local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6"; + local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6"; + }; + + # hagezi for dns-based adblocking (in addition to others) + rpz = { + name = "hagezi.ultimate"; + zonefile = "hagezi.ultimate"; + url = "https://raw.githubusercontent.com/hagezi/dns-blocklists/main/rpz/ultimate.txt"; + }; - interface = "lo"; - listen-address = "127.0.0.1"; - bind-interfaces = true; - no-resolv = true; + # go through mullvad for regular dns queries + forward-zone = { + name = "."; + forward-addr = [ "100.64.0.3" ]; + }; }; }; @@ -258,33 +283,90 @@ # using pulseaudio and home-manager, so had to disable pulseaudio. pipewire = { enable = true; + alsa.enable = true; + audio.enable = true; pulse.enable = true; - }; - # vpn - tailscale = { - enable = true; - authKeyFile = config.age.secrets.tailscale_hastur.path; - extraDaemonFlags = [ "--no-logs-no-support" ]; - extraUpFlags = [ - "--login-server=https://headscale.13f0.net" - "--advertise-exit-node" - ]; - openFirewall = true; + extraConfig.pipewire = { + "99-filter-airpods.conf" = { + "context.modules" = [ + { + name = "libpipewire-module-filter-chain"; + args = { + node.name = "peq-airpods-pro-2-sink"; + node.description = "PEQ AirPods Pro 2 (auto)"; + playback.props = { + media.class = "Audio/Sink"; + "filter.smart" = true; + "filter.smart.name" = "peq-airpods-pro-2"; + }; + filter.graph = [ + { + type = "builtin"; + name = "param_eq"; + label = "param_eq_airpods"; + config.filename = "/etc/pipewire/parametric/airpods-pro-2.txt"; + } + ]; + }; + } + ]; + }; + }; + + # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt) + wireplumber = { + enable = true; + extraConfig."50-smartfilters-airpods.conf".text = '' + { + "monitor.bluez.rules" : [ + # When a BlueZ device is detected we set an identifying property that the smart filter will match. + # (This fragment adds nothing by default; we're using a policy to match target.node later.) + ], + + "policy.rules" : [ + # The core smart filter matching is done by matching the target.node properties + # WirePlumber's smart filters will look for filter.smart.target (set below). + ], + + "policy" : { + "smart_filters" : { + "rules" : [ + { + "matches" : [ + { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } } + ], + "actions" : { + # If target device matches, set the 'target.node' metadata for smart filters to use + "update-metadata" : { + "target.node" : { "name" : "bluez_output.*AirPods.*" } + } + } + } + ] + } + }, + + "endpoint.rules" : [ + { + "matches" : [ + { "node.name" : "peq-airpods-pro-2-sink" } + ], + "actions" : { + "update-props" : { + "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" } + } + } + } + ] + } + ''; + }; }; # enable better power management tlp.enable = true; - # udev rules - udev = { - enable = true; - extraRules = '' - # ST-Link v2.1 - SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="374b", MODE:="0666" - ''; - }; - # to get startx and use amdgpu driver # WM in home-manager xserver = { @@ -295,6 +377,11 @@ }; }; + systemd.services."wg-quick@wg1" = { + after = [ "wg-quick@wg0.service" ]; + requires = [ "wg-quick@wg0.service" ]; + }; + # create caches and use mandoc documentation.man = { enable = true; @@ -303,11 +390,5 @@ mandoc.enable = true; }; - # virtualization stuff - virtualisation.podman = { - enable = true; - dockerCompat = true; - }; - system.stateVersion = "24.05"; } diff --git a/secrets/secrets.nix b/secrets/secrets.nix index ca794fd..c1c6978 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -18,7 +18,10 @@ in "hetzner_dns.age".publicKeys = users ++ [ saklas ]; "radicale_users.age".publicKeys = users ++ [ saklas ]; - "tailscale_demiurge.age".publicKeys = users ++ [ demiurge ]; - "tailscale_hastur.age".publicKeys = users ++ [ hastur ]; - "tailscale_saklas.age".publicKeys = users ++ [ saklas ]; + "wg0_demiurge.age".publicKeys = users ++ [ demiurge ]; + "wg0_hastur.age".publicKeys = users ++ [ hastur ]; + "wg1_demiurge.age".publicKeys = users ++ [ demiurge ]; + "wg1_hastur.age".publicKeys = users ++ [ hastur ]; + + "wpa_supplicant.age".publicKeys = users ++ [ hastur ]; } diff --git a/secrets/tailscale_demiurge.age b/secrets/tailscale_demiurge.age deleted file mode 100644 index 2dfd303..0000000 --- a/secrets/tailscale_demiurge.age +++ /dev/null @@ -1,10 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 AaF/mQ Tgl9rg4GuKxgZMuHcwCw7ykOoZqRX3t4UN/E9qcMZSI -LdVTcOS8pGeKwh/18QYtaGFuSRTKawDTtYyvurev0NE --> ssh-ed25519 F30WWA G0HHHxSzX7RznR8CLhlDOqev4a8eA5odn6IyJnEZaRA -j9ivd4Jg3uAO13ffuouTlGyJDsTppBlHGFftzSncuKM --> ssh-ed25519 hc2ELA iCpXfQ7xRoQNkN0meAy3weOJkWOLY9dLNm9chmMGmlE -6E7ZRjh7C+HrjyzGCVAf5Menk4UGXyIRrqOAb4nyOvI ---- QgTpqSI1sMG0nNYu1jtZAKJ9pcvCVgivW7UW24+F9nw -к!J%ngNheG / -ej~TBEm`k⍾pIpR 5~96?+8> \ No newline at end of file diff --git a/secrets/tailscale_hastur.age b/secrets/tailscale_hastur.age deleted file mode 100644 index 167826a..0000000 Binary files a/secrets/tailscale_hastur.age and /dev/null differ diff --git a/secrets/tailscale_saklas.age b/secrets/tailscale_saklas.age deleted file mode 100644 index ae7369a..0000000 --- a/secrets/tailscale_saklas.age +++ /dev/null @@ -1,11 +0,0 @@ -age-encryption.org/v1 --> ssh-ed25519 AaF/mQ eUu7OoAObwNKVNHnf4gqC1tJ7xlmjkhW01G+HdcqAxc -SwYGhawZISYmqHSyA7fqKs05IzVlVu+3+7zDgvBBbkQ --> ssh-ed25519 F30WWA A8NddnDcg3IlQ8wJhuLoj1oS9rvRaIzLWFR+zp5qjAA -Rezb8NRw32cQSytyegAGW5s/knHQUseHoSTeHpmlJGs --> ssh-ed25519 hc2ELA za1uRZpbO1VkGdIVnNqYJkrJpCji/JEBq3lPolodhxU -u/FlNi8t03cwOvdqmUGOMPhAbVmLnWHAbScYCAbTvxw ---- BaEwzkb52piuKrSglC0P8xCr/HlD97B3WgklyyuBEbA -C` -fqAO4̛4/{W᫇Tƫ)j_dnDkACi3 -8(L^'I҆$bgp \ No newline at end of file diff --git a/secrets/wg0_demiurge.age b/secrets/wg0_demiurge.age new file mode 100644 index 0000000..11f2561 --- /dev/null +++ b/secrets/wg0_demiurge.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 AaF/mQ yqsS5z6keZjZRc2WECiDtrIQ81uy9dPNuC+4JL4QGgQ +PZfc4aEh3zIexIpLjcJjtPmXN7nFNFPzUcsjwNj1GtI +-> ssh-ed25519 F30WWA lK3glF0i1Z8i16YF+Pc7AlJjEk3zETFt6HYBrzHntFk +hsh9wGSi08ZFGUzF8nl3aT3EqMmciGTDjvfxW9FXNKA +--- 5SHG64tPuD9a4EfWVs8RteQTpBcNR9ZiLKvuUukraZI +k] !ax^OLOb^93@h)Vx˲-"!AR \ No newline at end of file diff --git a/secrets/wg0_hastur.age b/secrets/wg0_hastur.age new file mode 100644 index 0000000..83079cf --- /dev/null +++ b/secrets/wg0_hastur.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 AaF/mQ 56BWU8ca94VnN9a2XS9MyMECcA2NnUvclaIgzsAasGw +4ym2vDPFta3Jjp1ZEmGg+4QjtfqCv98crJmFFJxK4Wk +-> ssh-ed25519 CQpZUw 8T0BdKSFpFj9j8wfe2h9s1uvweGDlJYmLaBaF1h+31A +JV2ckgV8Hg6EYx44Uh0XF3FvZf6T5bnRULT+5pCueLw +--- jB4Nfx/RnFtL0sOSc0mfZ3a98IsDl03dAj0SqqqZoz0 +oR-ɨKlЍlg a!RĝX)_Tě +nclyV2!Yqkpjois| \ No newline at end of file diff --git a/secrets/wg1_demiurge.age b/secrets/wg1_demiurge.age new file mode 100644 index 0000000..b9bbbff --- /dev/null +++ b/secrets/wg1_demiurge.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 AaF/mQ MX+cICKRHIB8NaZ6+Kdz6wmhGQHgzNthVe4BiFp3V2c +pZa2tCwE4YRTS/4kTdlu5DrHNFePU8BiDNXZI0Uaeg0 +-> ssh-ed25519 F30WWA UfyQtZSmrl9pw9FVNCxGOo0ICIglS9Q4sDRTg/1PXTw +Sd6q4jECTtdRfGbgeAf/AniX5gw64ZZ/PrESAlst5tg +--- YkDaRa81QgMNVefXmDCPv2OdDI1BtMO4AhixPoKx2Os +8ח/-p>т^?A$<>|!0M u-Azm/g!;tᙌǙ!ݎ \ No newline at end of file diff --git a/secrets/wg1_hastur.age b/secrets/wg1_hastur.age new file mode 100644 index 0000000..62841ca --- /dev/null +++ b/secrets/wg1_hastur.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 AaF/mQ Bb1FBNNOPSZ5hJeoRIfnjBU4kQVbXOK/0Eems+055Xo +l1O6Jab0xAzeV1VgnzltinixgeC3xT+60vMrW49CtYQ +-> ssh-ed25519 CQpZUw gTPSRzQQ25H7oimwatm0F1pgKdXGHGyuaww6dhPaqCE +VxK1cjss0z6Vw5hCM4Soao9E5VdQw1FoXUNTLQ2744M +--- h1Cg8XMs8MEPnjDtsebMzWsjvoJ2oyi+YthMaSxAhvA +i_3KfH=j<PUf ; wU#3a ax琞_:8g(6|Uw> \ No newline at end of file diff --git a/secrets/wpa_supplicant.age b/secrets/wpa_supplicant.age new file mode 100644 index 0000000..f7a08ec Binary files /dev/null and b/secrets/wpa_supplicant.age differ -- cgit v1.2.3