init
This commit is contained in:
nicknase27
Generated
+196
@@ -0,0 +1,196 @@
|
||||
{
|
||||
"nodes": {
|
||||
"agenix": {
|
||||
"inputs": {
|
||||
"darwin": "darwin",
|
||||
"home-manager": "home-manager",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1770165109,
|
||||
"narHash": "sha256-9VnK6Oqai65puVJ4WYtCTvlJeXxMzAp/69HhQuTdl/I=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "b027ee29d959fda4b60b57566d64c98a202e0feb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"blueprint": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"unifi-os-server",
|
||||
"nixpkgs"
|
||||
],
|
||||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1776249299,
|
||||
"narHash": "sha256-Dt9t1TGRmJFc0xVYhttNBD6QsAgHOHCArqGa0AyjrJY=",
|
||||
"owner": "numtide",
|
||||
"repo": "blueprint",
|
||||
"rev": "56131e8628f173d24a27f6d27c0215eff57e40dd",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "blueprint",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"darwin": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"agenix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1744478979,
|
||||
"narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
|
||||
"owner": "lnl7",
|
||||
"repo": "nix-darwin",
|
||||
"rev": "43975d782b418ebf4969e9ccba82466728c2851b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "lnl7",
|
||||
"ref": "master",
|
||||
"repo": "nix-darwin",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"agenix",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1745494811,
|
||||
"narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1754028485,
|
||||
"narHash": "sha256-IiiXB3BDTi6UqzAZcf2S797hWEPCRZOwyNThJIYhUfk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "59e69648d345d6e8fef86158c555730fa12af9de",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-25.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1784796856,
|
||||
"narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e2587caef70cea85dd97d7daab492899902dbf5d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1776169885,
|
||||
"narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"unifi-os-server": "unifi-os-server"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_2": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"unifi-os-server": {
|
||||
"inputs": {
|
||||
"blueprint": "blueprint",
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1783941815,
|
||||
"narHash": "sha256-9S5fNoQpSipPSRijOhgB0JHsZlLQxJzEzgM8Ia9SJz4=",
|
||||
"owner": "rcambrj",
|
||||
"repo": "unifi-os-server",
|
||||
"rev": "075e542294406a2f3449e06dab12765ce56958c3",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "rcambrj",
|
||||
"repo": "unifi-os-server",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
@@ -0,0 +1,32 @@
|
||||
{
|
||||
description = "Nixos config flake";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
agenix.url = "github:ryantm/agenix";
|
||||
unifi-os-server.url = "github:rcambrj/unifi-os-server";
|
||||
|
||||
# home-manager = {
|
||||
# url = "github:nix-community/home-manager";
|
||||
# inputs.nixpkgs.follows = "nixpkgs";
|
||||
# };
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, agenix, unifi-os-server, ... }@inputs: {
|
||||
# use "nixos", or your hostname as the name of the configuration
|
||||
# it's a better practice than "default" shown in the video
|
||||
nixosConfigurations.Hermes= nixpkgs.lib.nixosSystem {
|
||||
specialArgs = {inherit inputs;};
|
||||
modules = [
|
||||
./hosts/hermes/configuration.nix
|
||||
./hosts/hermes/hardware-configuration.nix
|
||||
./modules/homelab.nix
|
||||
./modules/security.nix
|
||||
./modules/system.nix
|
||||
agenix.nixosModules.default
|
||||
unifi-os-server.nixosModules.unifi-os-server
|
||||
# inputs.home-manager.nixosModules.default
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,66 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
];
|
||||
|
||||
nix.settings.experimental-features = ["nix-command" "flakes"];
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
# Use latest kernel.
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
|
||||
networking.hostName = "Hermes"; # Define your hostname.
|
||||
|
||||
networking.networkmanager.enable = true;
|
||||
networking.nameservers = ["1.1.1.1" "1.0.0.1"];
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
users.users.nick = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.zsh;
|
||||
extraGroups = ["wheel"]; # Enable ‘sudo’ for the user.
|
||||
packages = with pkgs; [
|
||||
];
|
||||
};
|
||||
|
||||
programs.zsh = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
inputs.agenix.packages."${system}".default
|
||||
neovim
|
||||
wget
|
||||
curl
|
||||
git
|
||||
fastfetch
|
||||
rsync
|
||||
starship
|
||||
eza
|
||||
net-tools
|
||||
alejandra
|
||||
nixd
|
||||
];
|
||||
|
||||
networking.firewall.enable = false;
|
||||
networking.firewall.allowedTCPPorts = [8222];
|
||||
|
||||
networking.nftables.enable = true;
|
||||
|
||||
age.identityPaths = [
|
||||
"/etc/ssh/id_ed25519"
|
||||
];
|
||||
|
||||
system.stateVersion = "26.05"; # Did you read the comment?
|
||||
}
|
||||
@@ -0,0 +1,77 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = ["ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = ["kvm-amd"];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
|
||||
fsType = "btrfs";
|
||||
options = ["subvol=@"];
|
||||
};
|
||||
|
||||
fileSystems."/home" = {
|
||||
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
|
||||
fsType = "btrfs";
|
||||
options = ["subvol=@home"];
|
||||
};
|
||||
|
||||
fileSystems."/nix" = {
|
||||
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
|
||||
fsType = "btrfs";
|
||||
options = ["subvol=@nix"];
|
||||
};
|
||||
|
||||
fileSystems."/.snapshots" = {
|
||||
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
|
||||
fsType = "btrfs";
|
||||
options = ["subvol=@snapshots"];
|
||||
};
|
||||
|
||||
fileSystems."/var/log" = {
|
||||
device = "/dev/disk/by-uuid/4a3884e7-5c89-4987-8482-3b3640d2aebf";
|
||||
fsType = "btrfs";
|
||||
options = ["subvol=@log"];
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/5802-1BBF";
|
||||
fsType = "vfat";
|
||||
options = ["fmask=0022" "dmask=0022"];
|
||||
};
|
||||
|
||||
fileSystems."/mnt/media" = {
|
||||
device = "//10.0.0.5/media";
|
||||
fsType = "cifs";
|
||||
options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"];
|
||||
};
|
||||
|
||||
fileSystems."/mnt/backups" = {
|
||||
device = "//10.0.0.5/infra/backups";
|
||||
fsType = "cifs";
|
||||
options = ["credentials=${config.age.secrets.smb.path}" "x-systemd.automount" "nofail" "noperm" "x-systemd.after=network-online.target" "x-systemd.automount-options=--timeout=30" "_netdev"];
|
||||
};
|
||||
|
||||
swapDevices = [
|
||||
{device = "/dev/disk/by-uuid/ecbbcef6-c4c2-4cfe-bcd2-5a2e599c3009";}
|
||||
];
|
||||
|
||||
age.secrets.smb = {
|
||||
file = ../../secrets/smb.age;
|
||||
path = "/run/secrets/smb";
|
||||
};
|
||||
|
||||
systemd.network.wait-online.enable = true;
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
./services/vaultwarden.nix
|
||||
./services/navidrome.nix
|
||||
./services/caddy.nix
|
||||
./services/unifi.nix
|
||||
./services/gitea.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
{ pkgs, lib, config, ... }:
|
||||
{
|
||||
imports = [
|
||||
./security/ssh.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,21 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
PermitRootLogin = "no";
|
||||
AllowUsers = ["nick" "gitea"];
|
||||
MaxAuthTries = 3;
|
||||
PerSourcePenalties = "crash:3600s authfail:3600s max:86400s";
|
||||
};
|
||||
};
|
||||
users.users."nick".openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwouafzGDRGeMJQbm9ME/1CSkXicdL7TthJjWkhyLYd nick@Theseus"
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
environmentFile = "/run/secrets/caddy.env";
|
||||
package = pkgs.caddy.withPlugins {
|
||||
plugins = ["github.com/caddy-dns/cloudflare@v0.2.4"];
|
||||
hash = "sha256-7GoH8YLCoPmPExQxoga2FHB58zQDoZVf1BBwkVi0SsQ=";
|
||||
};
|
||||
globalConfig = ''
|
||||
email {$EMAIL}
|
||||
acme_dns cloudflare {$CLOUDFLARE} {
|
||||
resolvers 1.1.1.1:53 1.0.0.1:53
|
||||
}
|
||||
'';
|
||||
# Public
|
||||
virtualHosts = {
|
||||
"nicknase27.com" = {
|
||||
extraConfig = ''
|
||||
respond "Blank" 200
|
||||
'';
|
||||
};
|
||||
"nv.nicknase27.com" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy localhost:4533
|
||||
'';
|
||||
serverAliases = ["music.nicknase27.com"];
|
||||
};
|
||||
"vt.nicknase27.com" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy localhost:8222
|
||||
'';
|
||||
serverAliases = ["vault.nicknase27.com"];
|
||||
};
|
||||
"git.nicknase27.com" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy localhost:3000
|
||||
'';
|
||||
};
|
||||
"jf.nicknase27.com" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy 10.0.0.5:8096
|
||||
'';
|
||||
serverAliases = ["watch.nicknase27.com"];
|
||||
};
|
||||
|
||||
# Local
|
||||
"opn.nicknase27.com" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy 10.0.0.1:80
|
||||
'';
|
||||
};
|
||||
"ui.nicknase27.com" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy https://localhost:11443 {
|
||||
transport http {
|
||||
tls_insecure_skip_verify
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
'';
|
||||
};
|
||||
"storage.nicknase27.com" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy 10.0.0.5:80
|
||||
'';
|
||||
};
|
||||
"photos.nicknase27.com" = {
|
||||
extraConfig = ''
|
||||
reverse_proxy 10.0.0.5:2283
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.caddy = {
|
||||
file = ../../secrets/caddy.age;
|
||||
path = "/run/secrets/caddy.env";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,26 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
database = {
|
||||
type = "sqlite3";
|
||||
passwordFile = "${config.age.secrets.gitea-db.path}";
|
||||
};
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "git.nicknase27.com";
|
||||
ROOT_URL = "https://git.nicknase27.com";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets.gitea-db = {
|
||||
file = ../../secrets/gitea-db.age;
|
||||
path = "/run/secrets/gitea-db";
|
||||
mode = "777";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
services.navidrome = {
|
||||
#Settings
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
settings = {
|
||||
Address = "0.0.0.0";
|
||||
Port = 4533;
|
||||
DataFolder = "/var/lib/navidrome";
|
||||
BaseURL = "https://nv.nicknase27.com";
|
||||
|
||||
# Library
|
||||
MusicFolder = "/mnt/media/music";
|
||||
AlbumPlayCountMode = "normalized";
|
||||
AutoImportPlaylists = false;
|
||||
PID.Track = "musicbrainz_trackid|albumid,discnumber,tracknumber,title";
|
||||
PID.Album = "musicbrainz_albumid|albumartistid,album,albumversion,musicbrainz_acoustid";
|
||||
|
||||
# UI / Features
|
||||
DefaultTheme = "Spotify-ish";
|
||||
EnableDownloads = true;
|
||||
DefaultDownloadableShare = true;
|
||||
EnableInsightsCollector = false;
|
||||
EnableSharing = true;
|
||||
EnableStarRating = true;
|
||||
DefaultUIVolume = 100;
|
||||
|
||||
LastFM.Enabled = true;
|
||||
};
|
||||
|
||||
#Plugins
|
||||
plugins = with pkgs.navidromePlugins; [
|
||||
discord-rich-presence
|
||||
];
|
||||
|
||||
#Environment
|
||||
environmentFile = "/run/secrets/navidrome.env";
|
||||
};
|
||||
|
||||
age.secrets.navidrome = {
|
||||
file = ../../secrets/navidrome.age;
|
||||
path = "/run/secrets/navidrome.env";
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
navidrome = {
|
||||
after = ["mnt-media.mount"];
|
||||
requires = ["mnt-media.mount"];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
virtualisation.podman.enable = true;
|
||||
virtualisation.oci-containers.backend = "podman";
|
||||
|
||||
services.unifi-os-server = {
|
||||
enable = true;
|
||||
uosSystemIP = "10.0.0.10";
|
||||
openFirewallUiPort = true;
|
||||
openFirewallServicePorts = true;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
services.vaultwarden = {
|
||||
enable = true;
|
||||
dbBackend = "sqlite";
|
||||
backupDir = "/var/local/vaultwarden/backup";
|
||||
config = {
|
||||
DOMAIN = "https://vt.nicknase27.com";
|
||||
SIGNUPS_ALLOWED = "true";
|
||||
|
||||
ROCKET_ADDRESS = "0.0.0.0";
|
||||
ROCKET_PORT = 8222;
|
||||
ROCKET_LOG = "critical";
|
||||
};
|
||||
environmentFile = ["/run/secrets/vaultwarden.env"];
|
||||
};
|
||||
age.secrets.vaultwarden = {
|
||||
file = ../../secrets/vaultwarden.age;
|
||||
path = "/run/secrets/vaultwarden.env";
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
{ pkgs, lib, config, ... }:
|
||||
{
|
||||
imports = [
|
||||
./system/garbage-collection.nix
|
||||
./system/backups.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,33 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
services.restic.backups.hermes = {
|
||||
initialize = true;
|
||||
|
||||
repository = "/mnt/backups/";
|
||||
|
||||
passwordFile = config.age.secrets.restic.path;
|
||||
|
||||
paths = [
|
||||
"/var/lib"
|
||||
];
|
||||
|
||||
timerConfig = {
|
||||
OnCalendar = "daily";
|
||||
RandomizedDelaySec = "1h";
|
||||
};
|
||||
|
||||
pruneOpts = [
|
||||
"--keep-daily=7"
|
||||
"--keep-weekly=4"
|
||||
"--keep-monthly=12"
|
||||
];
|
||||
};
|
||||
|
||||
age.secrets.restic = {
|
||||
file = ../../secrets/restic.age;
|
||||
};
|
||||
}
|
||||
@@ -0,0 +1,16 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
nix = {
|
||||
gc = {
|
||||
automatic = true;
|
||||
dates = "weekly";
|
||||
options = "--delete-older-than 30d";
|
||||
};
|
||||
|
||||
optimise.automatic = true;
|
||||
};
|
||||
}
|
||||
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,5 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 dq4eSg Bq3jE4tZijPeR0roGJHQA7JH914Evpn6z1WGRllF5Bg
|
||||
/b27LMvQPH3GLDPCCBye1rkwmGfCyP9q6G5sejPMWis
|
||||
--- Vyv4jpwB4CKfE0jALdWEydsowc/4aRV4iz8UvkWxibQ
|
||||
ü ~¯:üx‰5Ûº5›À°îf�àƒŸËDƒÅ$¿ÃÊ«cѽ÷]y¸ý ììÀ"dÒ Ê8a»×õ?ÿº9ùdÚ t¶þÈ`ÝB‚Ïó,j�-û·±YS¹E^@(¬ÄK[Ï2 fñænh��ãk}¦>tbqxôc:‹ê�(d.wj©�
|
||||
@@ -0,0 +1,8 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 dq4eSg oxAzXUKcoOjUxNB4tZII/ytFF6DRjm7duIS9Ds/2Zwo
|
||||
xm7nHystUY8VeCPKUHIkWrDsXHLJTsYMZX8tKtp5VYI
|
||||
-> ssh-ed25519 xLUmZQ zrJy1kKXBVSKyKUXGT2Cpi9SW46Kxuz7SCviY/56HFw
|
||||
dWs2+G1D7oTpHc71xOlqy8nWYjw+Qw2JsQ23X5JrU5Q
|
||||
--- XojFhUQJoBobIDxGDG9rW52zmf4K3Z73Iiu9EpTSQB0
|
||||
|
||||
¶f¿5q—r¦#ç4;.°õ |ÒS–ãíR òajQdÅð«_j`óÐÝwè¼Ó Çô;ôþ€�î=ÂxñÕ$Lˆ†1ÅÐÂ=2VÛ a—
|
||||
@@ -0,0 +1,15 @@
|
||||
let
|
||||
hermes = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+0IQBasZ9MUZxF7hlx3aH00pEIgpkuWh5ZVRmOLpMN nick@Hermes";
|
||||
theseus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJwouafzGDRGeMJQbm9ME/1CSkXicdL7TthJjWkhyLYd nick@Theseus";
|
||||
|
||||
systems = [hermes theseus];
|
||||
in {
|
||||
"caddy.age".publicKeys = systems;
|
||||
"restic.age".publicKeys = systems;
|
||||
"smb.age".publicKeys = systems;
|
||||
"gitea-db.age".publicKeys = systems;
|
||||
#"wireguard-private.age".publicKeys = systems;
|
||||
#"wireguard-public.age".publicKeys = systems;
|
||||
"navidrome.age".publicKeys = systems;
|
||||
"vaultwarden.age".publicKeys = systems;
|
||||
}
|
||||
@@ -0,0 +1,7 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 dq4eSg B7XhfVlAF4n2nOiakXwfDlmabbeYctB5kfGHQeTBIg8
|
||||
QRMGoqZ+3m9eCh4JtSvrMkwB8REo/SFy/E5x1acZLnQ
|
||||
-> ssh-ed25519 xLUmZQ kx3yrLGzWjAY2xfF6wqND5aYZMxlDkSW1NKeoylxrhk
|
||||
Tz8/KjlcYO0MCiypLQWNuZID+BJXmJ3vQH3c22Bbs/A
|
||||
--- tlKKxD/3yE85aBdrMC6o5gr86RBo8qNJPJdEJ6gbkxE
|
||||
.Ëß¼hå9‹>Ým¸HÏpI‹yZÉ7%ª!-4ÝgèÎyñ¥·Î o>¾éeŒA¬ dEN±lƒÝZ.È7NÖ蜘"›”tØ# ÇPó{R†}ïŒÄ7P÷_¾eØÌÙ
|
||||
@@ -0,0 +1,5 @@
|
||||
age-encryption.org/v1
|
||||
-> ssh-ed25519 dq4eSg kIejU5J8ePOW65gY/72byCy5jQk/y4TBwuJ+Ss/fpmg
|
||||
UI2cKAJ3sOwSKmlavV0SZ3sFnCNEwbGpled1QMQPppU
|
||||
--- vpqeBDI2Vbds2jih32m5uqVmgsFlZMbfwsqTvEND6pY
|
||||
`áŠí!e~Y@ ž®>0#[ô)Â�±Å 4èg^Á¿óî1©°A@Ý;8 ”0*É1ÁÅÏëKÖbÄôRGœˆ\uaïA· “Ø_£ä9ðå’Á;iÆ�G
|
||||
Reference in New Issue
Block a user