From 52e1767b0e3028c34697d1f3ba2fb000963c18c9 Mon Sep 17 00:00:00 2001 From: jaysa Date: Wed, 1 Apr 2026 06:33:45 -0700 Subject: [PATCH] nix fmt --- flake.nix | 199 +++++----- hardware/minisforum-new.nix | 17 +- hardware/nuc.nix | 19 +- hardware/nucleus.nix | 18 +- hardware/old-pc.nix | 34 +- hardware/raspberry-pi-4b.nix | 8 +- hardware/ridge-pc.nix | 15 +- hardware/virtualized.nix | 24 +- hosts/misc/termites.nix | 12 +- hosts/misc/tornado.nix | 12 +- hosts/newkube/adenine.nix | 15 +- hosts/newkube/cytosine.nix | 15 +- hosts/newkube/guanine.nix | 15 +- hosts/newkube/thymine.nix | 15 +- hosts/servers/amethyst.nix | 2 - hosts/servers/fluttershy.nix | 7 +- hosts/servers/rainbowdash.nix | 7 +- hosts/servers/scootaloo.nix | 7 +- hosts/servers/zecora.nix | 7 +- modules/acme.nix | 34 +- modules/auth.nix | 22 +- modules/etc.nix | 7 +- modules/github-actions/default.nix | 65 ++-- modules/github-actions/options.nix | 94 ++--- modules/graphical/apps/browsers.nix | 44 ++- modules/graphical/apps/dev.nix | 13 +- modules/graphical/apps/documents.nix | 165 ++++---- modules/graphical/apps/games.nix | 7 +- modules/graphical/apps/other.nix | 7 +- modules/graphical/default.nix | 380 ++++++++++--------- modules/graphical/kiosk.nix | 9 +- modules/irc.nix | 12 +- modules/jukebox.nix | 24 +- modules/kubernetes/default.nix | 32 +- modules/logged-in-users-exporter/default.nix | 20 +- modules/managed-deployment.nix | 7 +- modules/matrix/default.nix | 22 +- modules/matrix/discord-bridge.nix | 7 +- modules/matrix/element.nix | 8 +- modules/matrix/irc-bridge.nix | 7 +- modules/motd.nix | 13 +- modules/network/bond.nix | 8 +- modules/network/default.nix | 14 +- modules/nfs.nix | 23 +- modules/shell/default.nix | 7 +- modules/tmpfs-home.nix | 5 +- modules/webhost.nix | 67 ++-- pkgs/catppuccin-sddm.nix | 8 +- pkgs/ocf-cosmic-greeter.nix | 1 - pkgs/plasma-applet-commandoutput.nix | 6 +- profiles/base.nix | 26 +- profiles/desktop.nix | 23 +- 52 files changed, 1028 insertions(+), 607 deletions(-) diff --git a/flake.nix b/flake.nix index 889e3b55..521e00c0 100644 --- a/flake.nix +++ b/flake.nix @@ -109,21 +109,22 @@ }; outputs = - { self - , nixpkgs - , systems - , colmena - , agenix - , agenix-rekey - , disko - , nix-index-database - , ocflib - , ocf-sync-etc - , ocf-pam-trimspaces - , ocf-utils - , wayout - , ocf-cosmic-applets - , ocf-jukebox + { + self, + nixpkgs, + systems, + colmena, + agenix, + agenix-rekey, + disko, + nix-index-database, + ocflib, + ocf-sync-etc, + ocf-pam-trimspaces, + ocf-utils, + wayout, + ocf-cosmic-applets, + ocf-jukebox, }@inputs: let # ============== # @@ -139,8 +140,9 @@ agenix-rekey.overlays.default ]; - customModules = - (with nixpkgs.lib; filter (hasSuffix ".nix") (filesystem.listFilesRecursive ./modules)); + customModules = ( + with nixpkgs.lib; filter (hasSuffix ".nix") (filesystem.listFilesRecursive ./modules) + ); commonModules = customModules ++ [ ./profiles/base.nix @@ -150,99 +152,115 @@ ]; defaultSystem = "x86_64-linux"; - overrideSystem = { overheat = "aarch64-linux"; }; + overrideSystem = { + overheat = "aarch64-linux"; + }; # ============== # # Glue/Internals # # ============== # - pkgsFor = system: import nixpkgs { - inherit overlays system; - config = { - allowUnfreePredicate = pkg: builtins.elem (nixpkgs.lib.getName pkg) [ - "code" - "claude-code" - "dwarf-fortress" - "google-chrome" - "helvetica-neue-lt-std" #tornado - "mongodb" #zecora for unifi - "nvidia-settings" - "nvidia-x11" - "steam" - "steam-unwrapped" - "unifi-controller" - "vscode" - "zoom" - "drawio" - "datagrip" - "davinci-resolve" - ]; + pkgsFor = + system: + import nixpkgs { + inherit overlays system; + config = { + allowUnfreePredicate = + pkg: + builtins.elem (nixpkgs.lib.getName pkg) [ + "code" + "claude-code" + "dwarf-fortress" + "google-chrome" + "helvetica-neue-lt-std" # tornado + "mongodb" # zecora for unifi + "nvidia-settings" + "nvidia-x11" + "steam" + "steam-unwrapped" + "unifi-controller" + "vscode" + "zoom" + "drawio" + "datagrip" + "davinci-resolve" + ]; + }; }; - }; - forAllSystems = fn: nixpkgs.lib.genAttrs (import systems) - (system: fn (pkgsFor system)); + forAllSystems = fn: nixpkgs.lib.genAttrs (import systems) (system: fn (pkgsFor system)); - readGroup = group: nixpkgs.lib.mapAttrs' - (filename: _: { + readGroup = + group: + nixpkgs.lib.mapAttrs' (filename: _: { name = nixpkgs.lib.nameFromURL filename "."; value = { inherit group; modules = [ ./hosts/${group}/${filename} ]; }; - }) - (builtins.readDir ./hosts/${group}); + }) (builtins.readDir ./hosts/${group}); - hosts = nixpkgs.lib.concatMapAttrs - (group: _: readGroup group) - (builtins.readDir ./hosts); + hosts = nixpkgs.lib.concatMapAttrs (group: _: readGroup group) (builtins.readDir ./hosts); deploy-user = "ocf-nix-deploy-user"; - colmenaHosts = builtins.mapAttrs - (host: { modules, group }: { + colmenaHosts = builtins.mapAttrs ( + host: + { modules, group }: + { imports = commonModules ++ modules; deployment.tags = [ group ]; deployment.targetHost = "${host}.ocf.berkeley.edu"; # TODO: Think of a less ugly way of doing this - deployment.targetUser = nixpkgs.lib.mkIf self.colmenaHive.nodes.${host}.config.ocf.managed-deployment.enable deploy-user; - }) - hosts; + deployment.targetUser = + nixpkgs.lib.mkIf self.colmenaHive.nodes.${host}.config.ocf.managed-deployment.enable + deploy-user; + } + ) hosts; in { formatter = forAllSystems (pkgs: pkgs.nixfmt-tree); - colmenaHive = colmena.lib.makeHive (colmenaHosts // { - meta = { - nixpkgs = pkgsFor defaultSystem; - nodeNixpkgs = nixpkgs.lib.mapAttrs (name: pkgsFor) overrideSystem; - specialArgs = { inherit self inputs; }; + colmenaHive = colmena.lib.makeHive ( + colmenaHosts + // { + meta = { + nixpkgs = pkgsFor defaultSystem; + nodeNixpkgs = nixpkgs.lib.mapAttrs (name: pkgsFor) overrideSystem; + specialArgs = { inherit self inputs; }; + }; + } + ); + + autoDeploy = + let + # returns the value of a managed-deployment option (given as a string containing the option name) for the given node + getOptionForNode = + option: node: self.colmenaHive.nodes.${node}.config.ocf.managed-deployment.${option}; + + # returns a list of the MAC addresses for the given list of nodes with automated deploy enabled + # hosts that do not have mac-address set will be gracefully ignored + getMACs = + nodes: + builtins.filter (mac: mac != "") (builtins.map (node: getOptionForNode "mac-address" node) nodes); + in + { + # list of nodes with automated deploy enabled, to be consumed by github actions + nodes = builtins.filter (node: getOptionForNode "automated-deploy" node) ( + builtins.attrNames self.colmenaHive.nodes + ); + + # list of mac addresses of nodes that github actions should wake up on deploy + MACs = getMACs self.autoDeploy.nodes; + + # attribute set combining automatedDeployNodes and automatedDeployNodeMACs + # get json with `nix eval .#autoDeploy.nodesWithMACs --json`! + # TODO: script to wake up hosts with this + nodesWithMACs = nixpkgs.lib.listToAttrs ( + nixpkgs.lib.zipListsWith (name: value: { + inherit name value; + }) self.autoDeploy.nodes self.autoDeploy.MACs + ); }; - }); - - autoDeploy = let - # returns the value of a managed-deployment option (given as a string containing the option name) for the given node - getOptionForNode = option: node: self.colmenaHive.nodes.${node}.config.ocf.managed-deployment.${option}; - - # returns a list of the MAC addresses for the given list of nodes with automated deploy enabled - # hosts that do not have mac-address set will be gracefully ignored - getMACs = nodes: builtins.filter (mac: mac != "") - (builtins.map - (node: getOptionForNode "mac-address" node) - nodes); - in { - # list of nodes with automated deploy enabled, to be consumed by github actions - nodes = builtins.filter (node: getOptionForNode "automated-deploy" node) (builtins.attrNames self.colmenaHive.nodes); - - # list of mac addresses of nodes that github actions should wake up on deploy - MACs = getMACs self.autoDeploy.nodes; - - # attribute set combining automatedDeployNodes and automatedDeployNodeMACs - # get json with `nix eval .#autoDeploy.nodesWithMACs --json`! - # TODO: script to wake up hosts with this - nodesWithMACs = nixpkgs.lib.listToAttrs (nixpkgs.lib.zipListsWith - (name: value: { inherit name value; }) - self.autoDeploy.nodes self.autoDeploy.MACs); - }; overlays.default = final: prev: { ocf-utils = ocf-utils.packages.${final.system}.default; @@ -265,7 +283,7 @@ default = pkgs.mkShell { packages = [ pkgs.git - pkgs.age + pkgs.age pkgs.agenix-rekey pkgs.age-plugin-fido2-hmac pkgs.wol @@ -284,13 +302,14 @@ }; }); - nixosConfigurations = builtins.mapAttrs - (host: colmenaConfig: nixpkgs.lib.nixosSystem rec { + nixosConfigurations = builtins.mapAttrs ( + host: colmenaConfig: + nixpkgs.lib.nixosSystem rec { system = overrideSystem.${host} or defaultSystem; pkgs = pkgsFor system; modules = colmenaConfig.imports; specialArgs = { inherit inputs; }; - }) - colmenaHosts; + } + ) colmenaHosts; }; } diff --git a/hardware/minisforum-new.nix b/hardware/minisforum-new.nix index 6e9173d6..e1f6556b 100644 --- a/hardware/minisforum-new.nix +++ b/hardware/minisforum-new.nix @@ -1,11 +1,24 @@ -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "xhci_pci" "nvme" "thunderbolt" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.availableKernelModules = [ + "xhci_pci" + "nvme" + "thunderbolt" + "usbhid" + "usb_storage" + "sd_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-amd" ]; boot.extraModulePackages = [ ]; diff --git a/hardware/nuc.nix b/hardware/nuc.nix index 5ca2699e..d15b1b40 100644 --- a/hardware/nuc.nix +++ b/hardware/nuc.nix @@ -1,11 +1,26 @@ -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" "rtsx_pci_sdmmc" ]; + boot.initrd.availableKernelModules = [ + "xhci_pci" + "thunderbolt" + "ahci" + "nvme" + "usb_storage" + "usbhid" + "sd_mod" + "rtsx_pci_sdmmc" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; diff --git a/hardware/nucleus.nix b/hardware/nucleus.nix index 2919ab40..0f846d4a 100644 --- a/hardware/nucleus.nix +++ b/hardware/nucleus.nix @@ -1,14 +1,28 @@ # Hardware configuration for 2022 newk8s servers (dna). # Requires filesystems to be labeled with `nixos` and `boot`. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ]; + boot.initrd.availableKernelModules = [ + "nvme" + "xhci_pci" + "ahci" + "usbhid" + "usb_storage" + "sd_mod" + "sr_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-amd" ]; boot.extraModulePackages = [ ]; diff --git a/hardware/old-pc.nix b/hardware/old-pc.nix index 6a7c6baf..56afe5be 100644 --- a/hardware/old-pc.nix +++ b/hardware/old-pc.nix @@ -5,20 +5,32 @@ # - Intel i7-4770 # Requires filesystems to be labeled with `nixos` and `boot`. -{ config, lib, pkgs, modulesPath, ... }: - { - imports = - [ - (modulesPath + "/installer/scan/not-detected.nix") - ]; + config, + lib, + pkgs, + modulesPath, + ... +}: - boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ]; +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ + "xhci_pci" + "ehci_pci" + "ahci" + "usbhid" + "usb_storage" + "sd_mod" + "sr_mod" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; - fileSystems."/" = { device = "/dev/disk/by-label/nixos"; fsType = "ext4"; @@ -27,7 +39,10 @@ fileSystems."/boot" = { device = "/dev/disk/by-label/boot"; fsType = "vfat"; - options = [ "fmask=0022" "dmask=0022" ]; + options = [ + "fmask=0022" + "dmask=0022" + ]; }; swapDevices = [ ]; @@ -46,4 +61,3 @@ nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; } - diff --git a/hardware/raspberry-pi-4b.nix b/hardware/raspberry-pi-4b.nix index 19844b2d..b879f339 100644 --- a/hardware/raspberry-pi-4b.nix +++ b/hardware/raspberry-pi-4b.nix @@ -1,7 +1,13 @@ # Hardware configuration for the Raspberry Pi 4. (near printers) # Installed with the NixOS SD Image. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { imports = [ diff --git a/hardware/ridge-pc.nix b/hardware/ridge-pc.nix index c696fe67..778fa5b1 100644 --- a/hardware/ridge-pc.nix +++ b/hardware/ridge-pc.nix @@ -3,14 +3,25 @@ # - Ryzen 5 8600G # Requires filesystems to be labeled with `nixos` and `boot`. -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { imports = [ (modulesPath + "/installer/scan/not-detected.nix") ]; - boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" ]; + boot.initrd.availableKernelModules = [ + "nvme" + "xhci_pci" + "ahci" + "usbhid" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-amd" ]; boot.extraModulePackages = [ ]; diff --git a/hardware/virtualized.nix b/hardware/virtualized.nix index 4c6377fe..5bafdb0b 100644 --- a/hardware/virtualized.nix +++ b/hardware/virtualized.nix @@ -1,12 +1,24 @@ -{ config, lib, pkgs, modulesPath, ... }: +{ + config, + lib, + pkgs, + modulesPath, + ... +}: { - imports = - [ - (modulesPath + "/profiles/qemu-guest.nix") - ]; + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + ]; - boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "virtio_scsi" "sr_mod" "virtio_blk" ]; + boot.initrd.availableKernelModules = [ + "ahci" + "xhci_pci" + "virtio_pci" + "virtio_scsi" + "sr_mod" + "virtio_blk" + ]; boot.initrd.kernelModules = [ ]; boot.kernelModules = [ "kvm-amd" ]; boot.extraModulePackages = [ ]; diff --git a/hosts/misc/termites.nix b/hosts/misc/termites.nix index ce77e963..ec8564c9 100644 --- a/hosts/misc/termites.nix +++ b/hosts/misc/termites.nix @@ -77,8 +77,14 @@ pulse.enable = true; extraConfig.pipewire-pulse."100-network-audio-sink"."pulse.cmd" = [ - { cmd = "load-module"; args = "module-native-protocol-tcp auth-ip-acl=169.229.226.0/24 auth-anonymous=1"; } - { cmd = "load-module"; args = "module-zeroconf-publish"; } + { + cmd = "load-module"; + args = "module-native-protocol-tcp auth-ip-acl=169.229.226.0/24 auth-anonymous=1"; + } + { + cmd = "load-module"; + args = "module-zeroconf-publish"; + } ]; }; }; @@ -88,8 +94,6 @@ pipewire-pulse.wantedBy = [ "default.target" ]; }; - - # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It's perfectly fine and recommended to leave diff --git a/hosts/misc/tornado.nix b/hosts/misc/tornado.nix index cc8944c5..caa1c49f 100644 --- a/hosts/misc/tornado.nix +++ b/hosts/misc/tornado.nix @@ -61,8 +61,14 @@ }; pipewire.extraConfig.pipewire-pulse."100-network-audio-sink"."pulse.cmd" = [ - { cmd = "load-module"; args = "module-native-protocol-tcp auth-ip-acl=169.229.226.0/24 auth-anonymous=1"; } - { cmd = "load-module"; args = "module-zeroconf-publish"; } + { + cmd = "load-module"; + args = "module-native-protocol-tcp auth-ip-acl=169.229.226.0/24 auth-anonymous=1"; + } + { + cmd = "load-module"; + args = "module-zeroconf-publish"; + } ]; }; @@ -72,8 +78,6 @@ pipewire-pulse.wantedBy = [ "default.target" ]; }; - - # This value determines the NixOS release from which the default # settings for stateful data, like file locations and database versions # on your system were taken. It's perfectly fine and recommended to leave diff --git a/hosts/newkube/adenine.nix b/hosts/newkube/adenine.nix index 44adbabe..485e9271 100644 --- a/hosts/newkube/adenine.nix +++ b/hosts/newkube/adenine.nix @@ -10,13 +10,22 @@ lastOctet = 7; extraRoutes = [ # We use these subnets for Kubernetes, they aren't part of the main /64 - { Destination = "2607:f140:8801:1::/64"; Scope = "link"; } - { Destination = "2607:f140:8801:2::/64"; Scope = "link"; } + { + Destination = "2607:f140:8801:1::/64"; + Scope = "link"; + } + { + Destination = "2607:f140:8801:2::/64"; + Scope = "link"; + } ]; bond = { enable = true; - interfaces = [ "enp66s0f0np0" "enp66s0f1np1" ]; + interfaces = [ + "enp66s0f0np0" + "enp66s0f1np1" + ]; }; }; diff --git a/hosts/newkube/cytosine.nix b/hosts/newkube/cytosine.nix index 03d306f6..1ecb9c4a 100644 --- a/hosts/newkube/cytosine.nix +++ b/hosts/newkube/cytosine.nix @@ -10,13 +10,22 @@ lastOctet = 9; extraRoutes = [ # We use these subnets for Kubernetes, they aren't part of the main /64 - { Destination = "2607:f140:8801:1::/64"; Scope = "link"; } - { Destination = "2607:f140:8801:2::/64"; Scope = "link"; } + { + Destination = "2607:f140:8801:1::/64"; + Scope = "link"; + } + { + Destination = "2607:f140:8801:2::/64"; + Scope = "link"; + } ]; bond = { enable = true; - interfaces = [ "enp66s0f0np0" "enp66s0f1np1" ]; + interfaces = [ + "enp66s0f0np0" + "enp66s0f1np1" + ]; }; }; diff --git a/hosts/newkube/guanine.nix b/hosts/newkube/guanine.nix index 697bbef2..40843bf5 100644 --- a/hosts/newkube/guanine.nix +++ b/hosts/newkube/guanine.nix @@ -10,13 +10,22 @@ lastOctet = 8; extraRoutes = [ # We use these subnets for Kubernetes, they aren't part of the main /64 - { Destination = "2607:f140:8801:1::/64"; Scope = "link"; } - { Destination = "2607:f140:8801:2::/64"; Scope = "link"; } + { + Destination = "2607:f140:8801:1::/64"; + Scope = "link"; + } + { + Destination = "2607:f140:8801:2::/64"; + Scope = "link"; + } ]; bond = { enable = true; - interfaces = [ "enp66s0f0np0" "enp66s0f1np1" ]; + interfaces = [ + "enp66s0f0np0" + "enp66s0f1np1" + ]; }; }; diff --git a/hosts/newkube/thymine.nix b/hosts/newkube/thymine.nix index c7d68e60..e0a080f2 100644 --- a/hosts/newkube/thymine.nix +++ b/hosts/newkube/thymine.nix @@ -10,13 +10,22 @@ lastOctet = 10; extraRoutes = [ # We use these subnets for Kubernetes, they aren't part of the main /64 - { Destination = "2607:f140:8801:1::/64"; Scope = "link"; } - { Destination = "2607:f140:8801:2::/64"; Scope = "link"; } + { + Destination = "2607:f140:8801:1::/64"; + Scope = "link"; + } + { + Destination = "2607:f140:8801:2::/64"; + Scope = "link"; + } ]; bond = { enable = true; - interfaces = [ "enp66s0f0np0" "enp66s0f1np1" ]; + interfaces = [ + "enp66s0f0np0" + "enp66s0f1np1" + ]; }; }; diff --git a/hosts/servers/amethyst.nix b/hosts/servers/amethyst.nix index 0eb14c5c..abecd6b4 100644 --- a/hosts/servers/amethyst.nix +++ b/hosts/servers/amethyst.nix @@ -26,7 +26,5 @@ ]; }; - - system.stateVersion = "24.11"; } diff --git a/hosts/servers/fluttershy.nix b/hosts/servers/fluttershy.nix index 00f13dc5..70a2c8e3 100644 --- a/hosts/servers/fluttershy.nix +++ b/hosts/servers/fluttershy.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: { imports = [ ../../hardware/virtualized.nix ]; diff --git a/hosts/servers/rainbowdash.nix b/hosts/servers/rainbowdash.nix index 1ac1ed50..a10816ed 100644 --- a/hosts/servers/rainbowdash.nix +++ b/hosts/servers/rainbowdash.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: { imports = [ ../../hardware/virtualized.nix ]; diff --git a/hosts/servers/scootaloo.nix b/hosts/servers/scootaloo.nix index 20fecc1b..81372ef3 100644 --- a/hosts/servers/scootaloo.nix +++ b/hosts/servers/scootaloo.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: { imports = [ ../../hardware/virtualized.nix ]; diff --git a/hosts/servers/zecora.nix b/hosts/servers/zecora.nix index 28ae09d2..0aafc4c0 100644 --- a/hosts/servers/zecora.nix +++ b/hosts/servers/zecora.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: { imports = [ ../../hardware/virtualized.nix ]; diff --git a/modules/acme.nix b/modules/acme.nix index 4bea5c71..5d3f4329 100644 --- a/modules/acme.nix +++ b/modules/acme.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.acme; @@ -35,8 +40,14 @@ in email = "root@ocf.berkeley.edu"; dnsProvider = "rfc2136"; # https://letsencrypt.org/docs/profiles/#tlsserver - extraLegoRunFlags = [ "--profile" "tlsserver" ]; - extraLegoRenewFlags = [ "--profile" "tlsserver" ]; + extraLegoRunFlags = [ + "--profile" + "tlsserver" + ]; + extraLegoRenewFlags = [ + "--profile" + "tlsserver" + ]; credentialFiles = { "RFC2136_NAMESERVER_FILE" = pkgs.writeText "name-server" "169.229.226.22"; "RFC2136_TSIG_KEY_FILE" = pkgs.writeText "tsig-key" "letsencrypt.ocf.io"; @@ -46,20 +57,25 @@ in } (lib.mkIf cfg.shortlived { - # TODO: Currently still being rolled out and restriced to a allowlist so + # TODO: Currently still being rolled out and restriced to a allowlist so # we can't request these certs but def worth moving over once it's available. # https://letsencrypt.org/2025/01/16/6-day-and-ip-certs/ # https://letsencrypt.org/2025/02/20/first-short-lived-cert-issued/ - extraLegoRunFlags = lib.mkForce [ "--profile" "shortlived" ]; - extraLegoRenewFlags = lib.mkForce [ "--profile" "shortlived" ]; + extraLegoRunFlags = lib.mkForce [ + "--profile" + "shortlived" + ]; + extraLegoRenewFlags = lib.mkForce [ + "--profile" + "shortlived" + ]; # TODO: Remove this when Lego moves to v5 and uses --dynamic by default instead - # of having to manually set --days. This will automatically renew shortlived + # of having to manually set --days. This will automatically renew shortlived # certs in 3 days. https://go-acme.github.io/lego/usage/cli/options/index.html validMinDays = 3; - } - ) + }) ]; certs."${config.networking.hostName}.ocf.berkeley.edu" = { diff --git a/modules/auth.nix b/modules/auth.nix index cc02150a..812187f3 100644 --- a/modules/auth.nix +++ b/modules/auth.nix @@ -1,4 +1,9 @@ -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let cfg = config.ocf.auth; @@ -49,8 +54,19 @@ in ''; extraRules = [ - { groups = [ "ocfroot" ]; commands = [ "ALL" ]; } - { users = [ "ocfbackups" ]; commands = [{ command = lib.getExe pkgs.rsync; options = [ "NOPASSWD" ]; }]; } + { + groups = [ "ocfroot" ]; + commands = [ "ALL" ]; + } + { + users = [ "ocfbackups" ]; + commands = [ + { + command = lib.getExe pkgs.rsync; + options = [ "NOPASSWD" ]; + } + ]; + } ]; }; diff --git a/modules/etc.nix b/modules/etc.nix index 5fe26046..1edc15a9 100644 --- a/modules/etc.nix +++ b/modules/etc.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.etc; diff --git a/modules/github-actions/default.nix b/modules/github-actions/default.nix index 51154545..1d0a6e7f 100644 --- a/modules/github-actions/default.nix +++ b/modules/github-actions/default.nix @@ -1,18 +1,28 @@ -{ inputs, lib, config, ... }: +{ + inputs, + lib, + config, + ... +}: let cfg = config.ocf.github-actions; - getSecrets = runner-cfg: lib.mkIf runner-cfg.enable { - ${runner-cfg.token}.rekeyFile = - inputs.self + "/secrets/master-keyed/github/ci-tokens/${runner-cfg.token}.age"; - }; + getSecrets = + runner-cfg: + lib.mkIf runner-cfg.enable { + ${runner-cfg.token}.rekeyFile = + inputs.self + "/secrets/master-keyed/github/ci-tokens/${runner-cfg.token}.age"; + }; - makeContainer = runner-cfg: + makeContainer = + runner-cfg: let name = if (builtins.isNull runner-cfg.workflow) then - "ci-${runner-cfg.owner}-${runner-cfg.repo}" else "ci-${runner-cfg.owner}-${runner-cfg.repo}-${runner-cfg.workflow}"; + "ci-${runner-cfg.owner}-${runner-cfg.repo}" + else + "ci-${runner-cfg.owner}-${runner-cfg.repo}-${runner-cfg.workflow}"; in lib.mkIf runner-cfg.enable { ${name} = { @@ -32,35 +42,28 @@ let nix.settings.experimental-features = "nix-command flakes"; networking.firewall.enable = true; - services.github-runners = - builtins.listToAttrs ( - builtins.genList - ( - i: - { - name = "${name}-${builtins.toString i}"; - value = { - enable = true; - ephemeral = true; - user = null; - group = null; - replace = true; - noDefaultLabels = true; - extraLabels = [ name ]; - url = "https://github.com/${runner-cfg.owner}/${runner-cfg.repo}"; - tokenFile = "/run/token"; - extraPackages = runner-cfg.packages; - }; - } - ) - runner-cfg.instances - ); + services.github-runners = builtins.listToAttrs ( + builtins.genList (i: { + name = "${name}-${builtins.toString i}"; + value = { + enable = true; + ephemeral = true; + user = null; + group = null; + replace = true; + noDefaultLabels = true; + extraLabels = [ name ]; + url = "https://github.com/${runner-cfg.owner}/${runner-cfg.repo}"; + tokenFile = "/run/token"; + extraPackages = runner-cfg.packages; + }; + }) runner-cfg.instances + ); system.stateVersion = "24.11"; }; }; }; - in { imports = [ ./options.nix ]; diff --git a/modules/github-actions/options.nix b/modules/github-actions/options.nix index 1a7d16f4..eab23309 100644 --- a/modules/github-actions/options.nix +++ b/modules/github-actions/options.nix @@ -4,60 +4,64 @@ options.ocf.github-actions = { enable = lib.mkEnableOption "Enable Containerized OCF GitHub Actions Runners"; runners = lib.mkOption { - type = lib.types.listOf (lib.types.submodule ({ config, ... }: { + type = lib.types.listOf ( + lib.types.submodule ( + { config, ... }: + { - options = { - enable = lib.mkEnableOption "Enable this self-hosted runner"; + options = { + enable = lib.mkEnableOption "Enable this self-hosted runner"; - owner = lib.mkOption { - type = lib.types.str; - description = "Owner of the GitHub Repository"; - default = "ocf"; - }; + owner = lib.mkOption { + type = lib.types.str; + description = "Owner of the GitHub Repository"; + default = "ocf"; + }; - repo = lib.mkOption { - type = lib.types.str; - description = "Name of the GitHub Repository"; - }; + repo = lib.mkOption { + type = lib.types.str; + description = "Name of the GitHub Repository"; + }; - workflow = lib.mkOption { - type = lib.types.nullOr lib.types.str; - description = "Name of the GitHub Actions Workflow - only needed if you want to have independent runners per workflow"; - default = null; - }; + workflow = lib.mkOption { + type = lib.types.nullOr lib.types.str; + description = "Name of the GitHub Actions Workflow - only needed if you want to have independent runners per workflow"; + default = null; + }; - token = lib.mkOption { - type = lib.types.str; - description = '' - Name of encrypted GitHub CI Token stored in - `/secrets/master-keyed/github/ci-tokens/.age`. + token = lib.mkOption { + type = lib.types.str; + description = '' + Name of encrypted GitHub CI Token stored in + `/secrets/master-keyed/github/ci-tokens/.age`. - When generating the token on GitHub ensure that it's a fine grained - Personal Access Token scoped to a single repo with the following - permissions: - Repository: - - Read access to metadata - - Read and Write access to administration - Organization: - - Read and Write access to organization self hosted runners - ''; - default = config.repo; - }; + When generating the token on GitHub ensure that it's a fine grained + Personal Access Token scoped to a single repo with the following + permissions: + Repository: + - Read access to metadata + - Read and Write access to administration + Organization: + - Read and Write access to organization self hosted runners + ''; + default = config.repo; + }; - packages = lib.mkOption { - type = with lib.types; listOf package; - description = "Packages to be installed in the runner enviornment"; - default = [ pkgs.nix ]; - }; + packages = lib.mkOption { + type = with lib.types; listOf package; + description = "Packages to be installed in the runner enviornment"; + default = [ pkgs.nix ]; + }; - instances = lib.mkOption { - type = lib.types.int; - description = "Number of parallel instances for this workflow"; - default = 1; - }; + instances = lib.mkOption { + type = lib.types.int; + description = "Number of parallel instances for this workflow"; + default = 1; + }; - }; - }) + }; + } + ) ); }; }; diff --git a/modules/graphical/apps/browsers.nix b/modules/graphical/apps/browsers.nix index ef78923a..01f25acf 100644 --- a/modules/graphical/apps/browsers.nix +++ b/modules/graphical/apps/browsers.nix @@ -1,4 +1,9 @@ -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let cfg = config.ocf.graphical; @@ -15,25 +20,28 @@ in }; config = lib.mkIf cfg.apps.browsers.enable { - environment.systemPackages = with pkgs; [ - firefox - ] ++ lib.optionals cfg.extra [ - librewolf - tor-browser - mullvad-browser - google-chrome # absolutely proprietary - ungoogled-chromium - ]; + environment.systemPackages = + with pkgs; + [ + firefox + ] + ++ lib.optionals cfg.extra [ + librewolf + tor-browser + mullvad-browser + google-chrome # absolutely proprietary + ungoogled-chromium + ]; # FIXME: cosmic files does not read the multiple mimeapps.list files # correctly, but it does correctly read the one in XDG_CONFIG_HOME. thus, # mimeapps.list is stored in skel until this is fixed. /* - xdg.mime.defaultApplications = { - "application/pdf" = lib.mkIf cfg.apps.browsers.handlePDFs "firefox.desktop"; - "x-scheme-handler/http" = "firefox.desktop"; - "x-scheme-handler/https" = "firefox.desktop"; - }; + xdg.mime.defaultApplications = { + "application/pdf" = lib.mkIf cfg.apps.browsers.handlePDFs "firefox.desktop"; + "x-scheme-handler/http" = "firefox.desktop"; + "x-scheme-handler/https" = "firefox.desktop"; + }; */ programs.firefox = { @@ -73,7 +81,10 @@ in DisableBuiltinPDFViewer = true; OverrideFirstRunPage = "https://www.ocf.berkeley.edu/about/lab/open-source"; - Authentication.SPNEGO = [ "auth.ocf.berkeley.edu" "idm.ocf.berkeley.edu" ]; + Authentication.SPNEGO = [ + "auth.ocf.berkeley.edu" + "idm.ocf.berkeley.edu" + ]; ExtensionSettings = { "uBlock0@raymondhill.net" = { @@ -153,7 +164,6 @@ in }; }; }; - # Force Chrome to use Wayland, rather than XWayland environment.sessionVariables.NIXOS_OZONE_WL = "1"; diff --git a/modules/graphical/apps/dev.nix b/modules/graphical/apps/dev.nix index 59231953..e2420ef3 100644 --- a/modules/graphical/apps/dev.nix +++ b/modules/graphical/apps/dev.nix @@ -1,6 +1,11 @@ # development related apps for ocf desktops -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let cfg = config.ocf.graphical; @@ -47,7 +52,11 @@ in claude-code # Languages - (python3.withPackages (ps: [ ps.tkinter ps.numpy ps.pygobject3 ])) + (python3.withPackages (ps: [ + ps.tkinter + ps.numpy + ps.pygobject3 + ])) poetry ruby elixir diff --git a/modules/graphical/apps/documents.nix b/modules/graphical/apps/documents.nix index 8789c8e2..ab8f898c 100644 --- a/modules/graphical/apps/documents.nix +++ b/modules/graphical/apps/documents.nix @@ -1,6 +1,11 @@ # documents and media -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let cfg = config.ocf.graphical; @@ -12,7 +17,6 @@ in default = cfg.enable; }; - config = lib.mkIf cfg.apps.documents.enable { # grammar checker for libreoffice services.languagetool.enable = true; @@ -33,85 +37,90 @@ in # correctly, but it does correctly read the one in XDG_CONFIG_HOME. thus, # mimeapps.list is stored in skel until this is fixed. /* - xdg.mime.defaultApplications = { - "image/jpeg" = "org.kde.gwenview.desktop"; - "image/png" = "org.kde.gwenview.desktop"; - "image/gif" = "org.kde.gwenview.desktop"; - "image/webp" = "org.kde.gwenview.desktop"; - "image/bmp" = "org.kde.gwenview.desktop"; - "image/tiff" = "org.kde.gwenview.desktop"; - "image/svg+xml" = "org.kde.gwenview.desktop"; - }; + xdg.mime.defaultApplications = { + "image/jpeg" = "org.kde.gwenview.desktop"; + "image/png" = "org.kde.gwenview.desktop"; + "image/gif" = "org.kde.gwenview.desktop"; + "image/webp" = "org.kde.gwenview.desktop"; + "image/bmp" = "org.kde.gwenview.desktop"; + "image/tiff" = "org.kde.gwenview.desktop"; + "image/svg+xml" = "org.kde.gwenview.desktop"; + }; */ - environment.systemPackages = with pkgs; [ - # scanning - simple-scan - - # pdfs - ocf-okular - ocf-papers - - # libreoffice - libreoffice-still - mythes - hunspell # spell check - hunspellDicts.en_US - hyphenDicts.en_US - - # editors - xournalpp - - kdePackages.gwenview - vlc - - # useful for iso files even without a cd drive - # needed for melange (cd drive host) - brasero - kdePackages.k3b - ] ++ lib.optionals cfg.extra [ - apostrophe - #texliveFull - texstudio - pandoc - img2pdf - - krita - gimp3 - darktable - inkscape - blender - drawio - octave - kdePackages.kdenlive - davinci-resolve - - audacity - ardour - musescore - milkytracker - schismtracker - - freecad - kicad - openscad - - mpv - ncmpcpp - strawberry - xmp - yt-dlp - ffmpeg - songrec - - exiftool - imagemagick - ]; + environment.systemPackages = + with pkgs; + [ + # scanning + simple-scan + + # pdfs + ocf-okular + ocf-papers + + # libreoffice + libreoffice-still + mythes + hunspell # spell check + hunspellDicts.en_US + hyphenDicts.en_US + + # editors + xournalpp + + kdePackages.gwenview + vlc + + # useful for iso files even without a cd drive + # needed for melange (cd drive host) + brasero + kdePackages.k3b + ] + ++ lib.optionals cfg.extra [ + apostrophe + #texliveFull + texstudio + pandoc + img2pdf + + krita + gimp3 + darktable + inkscape + blender + drawio + octave + kdePackages.kdenlive + davinci-resolve + + audacity + ardour + musescore + milkytracker + schismtracker + + freecad + kicad + openscad + + mpv + ncmpcpp + strawberry + xmp + yt-dlp + ffmpeg + songrec + + exiftool + imagemagick + ]; ocf.graphical.apps.browsers.handlePDFs = true; - assertions = [{ - assertion = cfg.apps.browsers.enable; - message = "browser is used as default PDF viewer"; - }]; + assertions = [ + { + assertion = cfg.apps.browsers.enable; + message = "browser is used as default PDF viewer"; + } + ]; }; } diff --git a/modules/graphical/apps/games.nix b/modules/graphical/apps/games.nix index 1d936050..f154ae14 100644 --- a/modules/graphical/apps/games.nix +++ b/modules/graphical/apps/games.nix @@ -1,4 +1,9 @@ -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let cfg = config.ocf.graphical; diff --git a/modules/graphical/apps/other.nix b/modules/graphical/apps/other.nix index 83ac7c39..909177f7 100644 --- a/modules/graphical/apps/other.nix +++ b/modules/graphical/apps/other.nix @@ -1,6 +1,11 @@ # other apps for ocf desktops -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let cfg = config.ocf.graphical; diff --git a/modules/graphical/default.nix b/modules/graphical/default.nix index 3ed29282..3bdf6df3 100644 --- a/modules/graphical/default.nix +++ b/modules/graphical/default.nix @@ -10,7 +10,12 @@ # - apps.games: games # - apps.other: everything else -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let cfg = config.ocf.graphical; @@ -53,215 +58,228 @@ in }; }; - config = lib.mkIf cfg.enable (lib.mkMerge [ - (lib.mkIf cfg.extra { - programs.sway.enable = true; - programs.sway.extraOptions = [ "--unsupported-gpu" ]; - programs.hyprland.enable = true; - programs.wayfire.enable = true; - programs.niri.enable = true; - services.xserver.desktopManager.xfce.enable = true; + config = lib.mkIf cfg.enable ( + lib.mkMerge [ + (lib.mkIf cfg.extra { + programs.sway.enable = true; + programs.sway.extraOptions = [ "--unsupported-gpu" ]; + programs.hyprland.enable = true; + programs.wayfire.enable = true; + programs.niri.enable = true; + services.xserver.desktopManager.xfce.enable = true; + + services.desktopManager.gnome.enable = true; + services.gnome.gcr-ssh-agent.enable = false; - services.desktopManager.gnome.enable = true; - services.gnome.gcr-ssh-agent.enable = false; + services.desktopManager.plasma6.enable = true; + environment.systemPackages = [ pkgs.plasma-applet-commandoutput ]; + }) - services.desktopManager.plasma6.enable = true; - environment.systemPackages = [ pkgs.plasma-applet-commandoutput ]; - }) + { + i18n.inputMethod = { + enable = true; + # see https://github.com/pop-os/libcosmic/pull/1182, cosmic specific text will have ime support once this is merged soon + # see skel/.config/fcitx5 for IMEs enabled by default on cosmic + type = "fcitx5"; + fcitx5.waylandFrontend = true; + fcitx5.addons = with pkgs; [ + fcitx5-gtk + fcitx5-mozc + fcitx5-rime + qt6Packages.fcitx5-chinese-addons + fcitx5-hangul + kdePackages.fcitx5-unikey + fcitx5-bamboo + fcitx5-m17n + ]; + }; - { - i18n.inputMethod = { - enable = true; - # see https://github.com/pop-os/libcosmic/pull/1182, cosmic specific text will have ime support once this is merged soon - # see skel/.config/fcitx5 for IMEs enabled by default on cosmic - type = "fcitx5"; - fcitx5.waylandFrontend = true; - fcitx5.addons = with pkgs; [ - fcitx5-gtk - fcitx5-mozc - fcitx5-rime - qt6Packages.fcitx5-chinese-addons - fcitx5-hangul - kdePackages.fcitx5-unikey - fcitx5-bamboo - fcitx5-m17n + # cosmic-initial-setup will run on every desktop environment and is a + # nuisance since home directories are cleared + environment.cosmic.excludePackages = [ + pkgs.cosmic-initial-setup ]; - }; - # cosmic-initial-setup will run on every desktop environment and is a - # nuisance since home directories are cleared - environment.cosmic.excludePackages = [ - pkgs.cosmic-initial-setup - ]; + environment.etc = { + skel.source = ./skel; + ocf-assets.source = ./assets; + }; + + # Conflict override since multiple DEs set this option + programs.ssh.askPassword = pkgs.lib.mkForce (lib.getExe pkgs.ksshaskpass.out); - environment.etc = { - skel.source = ./skel; - ocf-assets.source = ./assets; - }; + environment.systemPackages = with pkgs; [ + catppuccin-sddm - # Conflict override since multiple DEs set this option - programs.ssh.askPassword = pkgs.lib.mkForce (lib.getExe pkgs.ksshaskpass.out); + # terminal emulators + kitty + foot - environment.systemPackages = with pkgs; [ - catppuccin-sddm + # misc wayland utils + wl-clipboard + libnotify - # terminal emulators - kitty - foot + ocf-tv - # misc wayland utils - wl-clipboard - libnotify + # COSMIC greeter override for logout button + ocf-cosmic-greeter - ocf-tv + # OCF IRC + halloy + ]; - # COSMIC greeter override for logout button - ocf-cosmic-greeter + fonts.packages = with pkgs; [ + meslo-lgs-nf + noto-fonts + noto-fonts-cjk-sans + ]; - # OCF IRC - halloy - ]; + services = { + desktopManager.cosmic = { + enable = true; + showExcludedPkgsWarning = false; + }; - fonts.packages = with pkgs; [ meslo-lgs-nf noto-fonts noto-fonts-cjk-sans ]; + displayManager = { + defaultSession = cfg.desktop; - services = { - desktopManager.cosmic = { - enable = true; - showExcludedPkgsWarning = false; + sddm = { + enable = true; + theme = "${catppuccin-sddm}/share/sddm/themes/catppuccin-latte"; + wayland.enable = true; + settings.Users = { + RememberLastUser = false; + RememberLastSession = false; + }; + }; + }; }; - displayManager = { - defaultSession = cfg.desktop; + systemd.user.services.wayout = { + description = "Automatic idle logout manager"; + after = [ "graphical-session.target" ]; + partOf = [ "graphical-session.target" ]; + wantedBy = [ "graphical-session.target" ]; + serviceConfig = { + ExecStart = "${pkgs.ocf-wayout}/bin/wayout"; + Type = "simple"; + Restart = "on-failure"; + }; + }; - sddm = { - enable = true; - theme = "${catppuccin-sddm}/share/sddm/themes/catppuccin-latte"; - wayland.enable = true; - settings.Users = { - RememberLastUser = false; - RememberLastSession = false; - }; + systemd.user.services.desktoprc = { + description = "Source custom rc shared across desktops"; + after = [ "graphical-session.target" ]; + partOf = [ "graphical-session.target" ]; + wantedBy = [ "graphical-session.target" ]; + environment = { + PATH = lib.mkForce "/run/current-system/sw/bin"; }; + script = '' + if [ -f ~/remote/.desktoprc ]; then + . ~/remote/.desktoprc + else + echo "User doesn't have a ~/remote/.desktoprc file" + fi + ''; }; - }; - systemd.user.services.wayout = { - description = "Automatic idle logout manager"; - after = [ "graphical-session.target" ]; - partOf = [ "graphical-session.target" ]; - wantedBy = [ "graphical-session.target" ]; - serviceConfig = { - ExecStart = "${pkgs.ocf-wayout}/bin/wayout"; - Type = "simple"; - Restart = "on-failure"; + systemd.user.services.cosmic-scale = { + description = "Set COSMIC display scaling"; + after = [ "cosmic-session.target" ]; + partOf = [ "graphical-session.target" ]; + wantedBy = [ "cosmic-session.target" ]; + environment = { + PATH = lib.mkForce "/run/current-system/sw/bin"; + }; + script = '' + # Set 175% scaling for all enabled displays + ${pkgs.cosmic-randr}/bin/cosmic-randr list | grep "(enabled)" | sed 's/\x1b[[0-9;]*m//g' | awk '{print $1}' | while read -r output; do + # Get current mode for this output + mode=$(${pkgs.cosmic-randr}/bin/cosmic-randr list | awk '/@/ {gsub(/\x1b[[0-9;]*m/, ""); print $1, $3; + exit}') + if [ -n "$mode" ]; then + width=$(echo "$mode" | cut -d'x' -f1) + height=$(echo "$mode" | cut -d'x' -f2 | cut -d' ' -f1) + hz=$(echo "$mode" | cut -d' ' -f2) + scale=1.25 + if [[ "$height" -ge "2160" ]]; then + scale=1.5 + fi + ${pkgs.cosmic-randr}/bin/cosmic-randr mode "$output" "$width" "$height" --refresh "$hz" --scale "$scale" + fi + done + ''; }; - }; - systemd.user.services.desktoprc = { - description = "Source custom rc shared across desktops"; - after = [ "graphical-session.target" ]; - partOf = [ "graphical-session.target" ]; - wantedBy = [ "graphical-session.target" ]; - environment = { PATH = lib.mkForce "/run/current-system/sw/bin"; }; - script = '' - if [ -f ~/remote/.desktoprc ]; then - . ~/remote/.desktoprc - else - echo "User doesn't have a ~/remote/.desktoprc file" - fi - ''; - }; + # EDGE CASE: if user has custom halloy config with specific rose pine colorscheme and doesnt want it to dynamically change with dark/light mode, they should name their colorscheme something aside from the OCF defaults (rose-pine.toml and rose-pine-dawn.toml)! Content can stay the same. + systemd.user.services.cosmictheme-dark = { + description = "Changes the user's persistent preference in ~/remote when the cosmic dark mode setting is changed."; + after = [ "cosmic-session.target" ]; + partOf = [ "graphical-session.target" ]; + wantedBy = [ "cosmic-session.target" ]; + environment = { + PATH = lib.mkForce "/run/current-system/sw/bin"; + }; + script = '' + COSMIC_THEME_FILE="$HOME/.config/cosmic/com.system76.CosmicTheme.Mode/v1/is_dark" + COSMIC_BG_FILE="$HOME/.config/cosmic/com.system76.CosmicBackground/v1/all" + OCF_THEME_FILE="$HOME/remote/.config/ocf/theme" - systemd.user.services.cosmic-scale = { - description = "Set COSMIC display scaling"; - after = [ "cosmic-session.target" ]; - partOf = [ "graphical-session.target" ]; - wantedBy = [ "cosmic-session.target" ]; - environment = { PATH = lib.mkForce "/run/current-system/sw/bin"; }; - script = '' - # Set 175% scaling for all enabled displays - ${pkgs.cosmic-randr}/bin/cosmic-randr list | grep "(enabled)" | sed 's/\x1b[[0-9;]*m//g' | awk '{print $1}' | while read -r output; do - # Get current mode for this output - mode=$(${pkgs.cosmic-randr}/bin/cosmic-randr list | awk '/@/ {gsub(/\x1b[[0-9;]*m/, ""); print $1, $3; - exit}') - if [ -n "$mode" ]; then - width=$(echo "$mode" | cut -d'x' -f1) - height=$(echo "$mode" | cut -d'x' -f2 | cut -d' ' -f1) - hz=$(echo "$mode" | cut -d' ' -f2) - scale=1.25 - if [[ "$height" -ge "2160" ]]; then - scale=1.5 + sync_theme() { + if [ -f "$COSMIC_THEME_FILE" ]; then + content=$(cat "$COSMIC_THEME_FILE") + mkdir -p "$(dirname "$OCF_THEME_FILE")" + if [ "$content" = "true" ]; then + echo "dark" > "$OCF_THEME_FILE" + sed -i -E 's/bg-(light|dark)/bg-dark/g' $COSMIC_BG_FILE + sed -i 's/theme = "rose-pine-dawn"/theme = "rose-pine"/' $HOME/.config/halloy/config.toml + else + echo "light" > "$OCF_THEME_FILE" + sed -i -E 's/bg-(light|dark)/bg-light/g' $COSMIC_BG_FILE + sed -i 's/theme = "rose-pine"/theme = "rose-pine-dawn"/' $HOME/.config/halloy/config.toml + fi + pkill -USR1 halloy || true fi - ${pkgs.cosmic-randr}/bin/cosmic-randr mode "$output" "$width" "$height" --refresh "$hz" --scale "$scale" - fi - done - ''; - }; + } - # EDGE CASE: if user has custom halloy config with specific rose pine colorscheme and doesnt want it to dynamically change with dark/light mode, they should name their colorscheme something aside from the OCF defaults (rose-pine.toml and rose-pine-dawn.toml)! Content can stay the same. - systemd.user.services.cosmictheme-dark = { - description = "Changes the user's persistent preference in ~/remote when the cosmic dark mode setting is changed."; - after = [ "cosmic-session.target" ]; - partOf = [ "graphical-session.target" ]; - wantedBy = [ "cosmic-session.target" ]; - environment = { PATH = lib.mkForce "/run/current-system/sw/bin"; }; - script = '' - COSMIC_THEME_FILE="$HOME/.config/cosmic/com.system76.CosmicTheme.Mode/v1/is_dark" - COSMIC_BG_FILE="$HOME/.config/cosmic/com.system76.CosmicBackground/v1/all" - OCF_THEME_FILE="$HOME/remote/.config/ocf/theme" + # Initial sync + sync_theme - sync_theme() { - if [ -f "$COSMIC_THEME_FILE" ]; then - content=$(cat "$COSMIC_THEME_FILE") - mkdir -p "$(dirname "$OCF_THEME_FILE")" - if [ "$content" = "true" ]; then - echo "dark" > "$OCF_THEME_FILE" - sed -i -E 's/bg-(light|dark)/bg-dark/g' $COSMIC_BG_FILE - sed -i 's/theme = "rose-pine-dawn"/theme = "rose-pine"/' $HOME/.config/halloy/config.toml - else - echo "light" > "$OCF_THEME_FILE" - sed -i -E 's/bg-(light|dark)/bg-light/g' $COSMIC_BG_FILE - sed -i 's/theme = "rose-pine"/theme = "rose-pine-dawn"/' $HOME/.config/halloy/config.toml + # Watch for changes + ${pkgs.inotify-tools}/bin/inotifywait -m -e close_write,moved_to,create \ + "$(dirname "$COSMIC_THEME_FILE")" 2>/dev/null | while read -r dir events file; do + if [ "$file" = "is_dark" ]; then + sync_theme fi - pkill -USR1 halloy || true - fi - } - - # Initial sync - sync_theme + done + ''; + }; - # Watch for changes - ${pkgs.inotify-tools}/bin/inotifywait -m -e close_write,moved_to,create \ - "$(dirname "$COSMIC_THEME_FILE")" 2>/dev/null | while read -r dir events file; do - if [ "$file" = "is_dark" ]; then - sync_theme - fi - done - ''; - }; + ## Generate Halloy IRC config + # First, checks for plaintext password file at ~/remote/.config/hallow/nickserv-password. + # If that doesn't exist, prompts for password with kdialog gui. + systemd.user.services."halloy-config" = { + description = "Generate default halloy IRC config with OCF username"; + wantedBy = [ "default.target" ]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + }; + script = '' + cat > $HOME/.config/halloy/config.toml << EOF + theme = "rose-pine-dawn" + [servers.ocf] + nickname = "$USER" + server = "irc.ocf.berkeley.edu" - ## Generate Halloy IRC config - # First, checks for plaintext password file at ~/remote/.config/hallow/nickserv-password. - # If that doesn't exist, prompts for password with kdialog gui. - systemd.user.services."halloy-config" = { - description = "Generate default halloy IRC config with OCF username"; - wantedBy = [ "default.target" ]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; + [servers.ocf.sasl.plain] + username = "$USER" + password_command = 'sh -c "cat ~/remote/.config/ocf/halloy/nickserv-password 2>/dev/null || kdialog --password \"NickServ password (leave blank if not registered)\""' + EOF + ''; }; - script = '' - cat > $HOME/.config/halloy/config.toml << EOF - theme = "rose-pine-dawn" - [servers.ocf] - nickname = "$USER" - server = "irc.ocf.berkeley.edu" - - [servers.ocf.sasl.plain] - username = "$USER" - password_command = 'sh -c "cat ~/remote/.config/ocf/halloy/nickserv-password 2>/dev/null || kdialog --password \"NickServ password (leave blank if not registered)\""' - EOF - ''; - }; - }]); + } + ] + ); } diff --git a/modules/graphical/kiosk.nix b/modules/graphical/kiosk.nix index 6b939442..e975db01 100644 --- a/modules/graphical/kiosk.nix +++ b/modules/graphical/kiosk.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.graphical.kiosk; @@ -20,7 +25,7 @@ in extraConfig = lib.mkOption { type = lib.types.lines; description = "Extra config to pass on to sway"; - default = ''''; + default = ""; }; }; diff --git a/modules/irc.nix b/modules/irc.nix index c9fa430b..92344430 100644 --- a/modules/irc.nix +++ b/modules/irc.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.irc; @@ -119,7 +124,10 @@ in }; }; - ocf.acme.extraCerts = [ "irc.ocf.berkeley.edu" "irc.ocf.io" ]; + ocf.acme.extraCerts = [ + "irc.ocf.berkeley.edu" + "irc.ocf.io" + ]; users.users."ergochat" = { isNormalUser = true; diff --git a/modules/jukebox.nix b/modules/jukebox.nix index aef41a78..83351685 100644 --- a/modules/jukebox.nix +++ b/modules/jukebox.nix @@ -1,4 +1,9 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let cfg = config.ocf.jukebox; @@ -28,13 +33,19 @@ in config = lib.mkIf cfg.enable { - ocf.acme.extraCerts = [ "jukebox.ocf.berkeley.edu" "jukebox.ocf.io" ]; + ocf.acme.extraCerts = [ + "jukebox.ocf.berkeley.edu" + "jukebox.ocf.io" + ]; users.users."nginx".extraGroups = [ "acme" ]; systemd.services.jukebox = { description = "OCF Jukebox Django Server"; - after = [ "network.target" "nss-lookup.target" ]; + after = [ + "network.target" + "nss-lookup.target" + ]; wants = [ "nss-lookup.target" ]; wantedBy = [ "multi-user.target" ]; environment = { @@ -59,7 +70,6 @@ in recommendedGzipSettings = true; recommendedProxySettings = true; - virtualHosts = { "jukebox" = { listen = [ @@ -80,13 +90,13 @@ in useACMEHost = "${config.networking.hostName}.ocf.berkeley.edu"; onlySSL = true; - locations."/" = { + locations."/" = { proxyPass = "http://127.0.0.1:${toString cfg.port}"; proxyWebsockets = true; }; }; - - "force-ssl" = { + + "force-ssl" = { listen = [ { addr = "0.0.0.0"; diff --git a/modules/kubernetes/default.nix b/modules/kubernetes/default.nix index 77bad599..8e5e55f0 100644 --- a/modules/kubernetes/default.nix +++ b/modules/kubernetes/default.nix @@ -1,4 +1,9 @@ -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: let kubernetes = pkgs.kubernetes.overrideAttrs (oldAttrs: rec { @@ -11,7 +16,19 @@ let hash = "sha256-UZdrfQEEx0RRe4Bb4EAWcjgCCLq4CJL06HIriYuk1Io="; }; }); - kubePkgs = with pkgs; [ kubernetes util-linux iproute2 ethtool cri-o iptables-legacy socat conntrack-tools gvisor cri-tools ebtables ]; + kubePkgs = with pkgs; [ + kubernetes + util-linux + iproute2 + ethtool + cri-o + iptables-legacy + socat + conntrack-tools + gvisor + cri-tools + ebtables + ]; in { # Configuration for Nodes @@ -30,7 +47,9 @@ in ocf.managed-deployment.automated-deploy = false; environment.etc = { - "kubernetes/manifests/kubevip.yaml" = lib.mkIf config.services.ocfKubernetes.isLeader { source = ./kubevip.yaml; }; + "kubernetes/manifests/kubevip.yaml" = lib.mkIf config.services.ocfKubernetes.isLeader { + source = ./kubevip.yaml; + }; "kubernetes/kubeadm.yaml".source = ./kubeadm.yaml; }; @@ -89,7 +108,12 @@ in # networking.firewall.allowedUDPPorts = [ 8472 ]; # - networking.firewall.allowedTCPPortRanges = [{ from = 30000; to = 32767; }]; + networking.firewall.allowedTCPPortRanges = [ + { + from = 30000; + to = 32767; + } + ]; # networking.nftables.enable = false; diff --git a/modules/logged-in-users-exporter/default.nix b/modules/logged-in-users-exporter/default.nix index e1a391f9..3414c4ae 100644 --- a/modules/logged-in-users-exporter/default.nix +++ b/modules/logged-in-users-exporter/default.nix @@ -1,4 +1,9 @@ -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: with lib; let @@ -46,8 +51,17 @@ in node = { enable = true; port = 9100; - enabledCollectors = [ "systemd" "textfile" ]; - extraFlags = [ "--collector.ethtool" "--collector.softirqs" "--collector.tcpstat" "--collector.wifi" "--collector.textfile.directory=/var/lib/node_exporter/textfile_collector" ]; + enabledCollectors = [ + "systemd" + "textfile" + ]; + extraFlags = [ + "--collector.ethtool" + "--collector.softirqs" + "--collector.tcpstat" + "--collector.wifi" + "--collector.textfile.directory=/var/lib/node_exporter/textfile_collector" + ]; }; }; }; diff --git a/modules/managed-deployment.nix b/modules/managed-deployment.nix index 1c025370..19938eda 100644 --- a/modules/managed-deployment.nix +++ b/modules/managed-deployment.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.managed-deployment; diff --git a/modules/matrix/default.nix b/modules/matrix/default.nix index 84f47458..d69c6be5 100644 --- a/modules/matrix/default.nix +++ b/modules/matrix/default.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.matrix; @@ -33,7 +38,12 @@ in config = lib.mkIf cfg.enable { - ocf.acme.extraCerts = [ "matrix.ocf.berkeley.edu" "matrix.ocf.io" "chat.ocf.berkeley.edu" "chat.ocf.io" ]; + ocf.acme.extraCerts = [ + "matrix.ocf.berkeley.edu" + "matrix.ocf.io" + "chat.ocf.berkeley.edu" + "chat.ocf.io" + ]; age.secrets.synapse-client-secret.rekeyFile = ../../secrets/master-keyed/matrix/client-secret.age; age.secrets.synapse-client-secret.owner = "matrix-synapse"; @@ -65,7 +75,7 @@ in room_list_publication_rules = [ { - action = "allow"; + action = "allow"; } ]; @@ -83,7 +93,10 @@ in issuer = "https://idm.ocf.berkeley.edu/realms/ocf"; client_id = "matrix"; client_secret_path = config.age.secrets.synapse-client-secret.path; - scopes = [ "openid" "profile" ]; + scopes = [ + "openid" + "profile" + ]; user_mapping_provider = { config = { localpart_template = "{{ user.preferred_username }}"; @@ -127,7 +140,6 @@ in recommendedGzipSettings = true; recommendedProxySettings = true; - virtualHosts = { "synapse" = { listen = [ diff --git a/modules/matrix/discord-bridge.nix b/modules/matrix/discord-bridge.nix index 6321ebdd..ded95e3c 100644 --- a/modules/matrix/discord-bridge.nix +++ b/modules/matrix/discord-bridge.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.matrix; diff --git a/modules/matrix/element.nix b/modules/matrix/element.nix index 80609349..227510c9 100644 --- a/modules/matrix/element.nix +++ b/modules/matrix/element.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.matrix; @@ -7,7 +12,6 @@ in options.ocf.matrix.element = { enable = lib.mkEnableOption "Enable Element web client."; - url = lib.mkOption { type = lib.types.str; description = "Element URL."; diff --git a/modules/matrix/irc-bridge.nix b/modules/matrix/irc-bridge.nix index 54bc3b5a..b3643944 100644 --- a/modules/matrix/irc-bridge.nix +++ b/modules/matrix/irc-bridge.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.matrix; diff --git a/modules/motd.nix b/modules/motd.nix index 5eea5e28..de58daeb 100644 --- a/modules/motd.nix +++ b/modules/motd.nix @@ -1,6 +1,12 @@ -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: -let cfg = config.ocf.motd; +let + cfg = config.ocf.motd; in { options.ocf.motd = { @@ -14,8 +20,7 @@ in }; config = lib.mkIf cfg.enable { - users.motd = - '' + users.motd = '' Hi, I am \e[31m${config.networking.hostName}\e[39m, a \e[31m${builtins.concatStringsSep ", " config.deployment.tags}\e[39m at \e[31m169.229.226.${builtins.toString config.ocf.network.lastOctet}\e[39m. ${cfg.description} diff --git a/modules/network/bond.nix b/modules/network/bond.nix index 4f8783f7..02ff2ccb 100644 --- a/modules/network/bond.nix +++ b/modules/network/bond.nix @@ -36,15 +36,15 @@ in }; }; - networks = lib.listToAttrs (map - (interface: { + networks = lib.listToAttrs ( + map (interface: { name = "10-${interface}"; value = { matchConfig.Name = interface; networkConfig.Bond = cfg.bondInterface; }; - }) - cfg.interfaces); + }) cfg.interfaces + ); }; }; } diff --git a/modules/network/default.nix b/modules/network/default.nix index edb02e1c..0200a92b 100644 --- a/modules/network/default.nix +++ b/modules/network/default.nix @@ -52,9 +52,17 @@ in routes = [ { Gateway = "169.229.226.1"; } { Gateway = "2607:f140:8801::1"; } - ] ++ cfg.extraRoutes; - dns = [ "169.229.226.22" "2607:f140:8801::1:22" "1.1.1.1" ]; - domains = [ "ocf.berkeley.edu" "ocf.io" ]; + ] + ++ cfg.extraRoutes; + dns = [ + "169.229.226.22" + "2607:f140:8801::1:22" + "1.1.1.1" + ]; + domains = [ + "ocf.berkeley.edu" + "ocf.io" + ]; }; }; }; diff --git a/modules/nfs.nix b/modules/nfs.nix index c88742b3..01935e94 100644 --- a/modules/nfs.nix +++ b/modules/nfs.nix @@ -1,4 +1,9 @@ -{ pkgs, lib, config, ... }: +{ + pkgs, + lib, + config, + ... +}: let cfg = config.ocf.nfs; @@ -26,13 +31,25 @@ in fileSystems."/home" = lib.mkIf cfg.mountHome { device = "homes:/home"; fsType = "nfs4"; - options = [ "rw" "bg" "noatime" "nodev" "nosuid" ]; + options = [ + "rw" + "bg" + "noatime" + "nodev" + "nosuid" + ]; }; fileSystems."/services" = lib.mkIf cfg.mountHome { device = "services:/services"; fsType = "nfs4"; - options = [ "rw" "bg" "noatime" "nodev" "nosuid" ]; + options = [ + "rw" + "bg" + "noatime" + "nodev" + "nosuid" + ]; }; }; } diff --git a/modules/shell/default.nix b/modules/shell/default.nix index de2f46d5..4aea1e10 100644 --- a/modules/shell/default.nix +++ b/modules/shell/default.nix @@ -1,4 +1,9 @@ -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let cfg = config.ocf.shell; diff --git a/modules/tmpfs-home.nix b/modules/tmpfs-home.nix index a7c417f2..1c445e90 100644 --- a/modules/tmpfs-home.nix +++ b/modules/tmpfs-home.nix @@ -12,7 +12,10 @@ in fileSystems."/home" = { device = "tmpfs"; fsType = "tmpfs"; - options = [ "size=16G" "mode=755" ]; + options = [ + "size=16G" + "mode=755" + ]; }; }; } diff --git a/modules/webhost.nix b/modules/webhost.nix index 1238dc3e..18b5ac9e 100644 --- a/modules/webhost.nix +++ b/modules/webhost.nix @@ -1,4 +1,9 @@ -{ lib, config, pkgs, ... }: +{ + lib, + config, + pkgs, + ... +}: let cfg = config.ocf.webhost; @@ -26,9 +31,9 @@ let serverAliases = [ "${website-cfg.name}.${shortDomain}" ]; root = "/var/www/${website-cfg.name}"; extraConfig = '' - add_header Last-Modified ""; - add_header Cache-Control "public, max-age=${website-cfg.cacheTime}"; - ''; + add_header Last-Modified ""; + add_header Cache-Control "public, max-age=${website-cfg.cacheTime}"; + ''; }; }; @@ -54,7 +59,6 @@ let }; }; - makeExtraCerts = website-cfg: [ "${website-cfg.name}.${baseDomain}" "${website-cfg.name}.${shortDomain}" @@ -65,32 +69,31 @@ in options.ocf.webhost = { enable = lib.mkEnableOption "Enable static webhosting configuration"; websites = lib.mkOption { - type = lib.types.listOf (lib.types.submodule { - - - options = { - enable = lib.mkEnableOption "Enable this website"; - - name = lib.mkOption { - type = lib.types.str; - description = "Subdomain of webpage - will set .ocf.berkeley.edu & .ocf.io"; + type = lib.types.listOf ( + lib.types.submodule { + + options = { + enable = lib.mkEnableOption "Enable this website"; + + name = lib.mkOption { + type = lib.types.str; + description = "Subdomain of webpage - will set .ocf.berkeley.edu & .ocf.io"; + }; + + githubActionsPubkey = lib.mkOption { + type = lib.types.str; + description = "SSH Public Key of Github Actions Deploy Workflow"; + }; + # For some reason Nginx on our nix servers doesn't update the Last Modified header, + # which leads to content being cached indefinetely. + cacheTime = lib.mkOption { + type = lib.types.str; + description = "Browser file cache time in seconds"; + default = "3600"; + }; }; - githubActionsPubkey = lib.mkOption { - type = lib.types.str; - description = "SSH Public Key of Github Actions Deploy Workflow"; - }; - # For some reason Nginx on our nix servers doesn't update the Last Modified header, - # which leads to content being cached indefinetely. - cacheTime = lib.mkOption { - type = lib.types.str; - description = "Browser file cache time in seconds"; - default = "3600"; - }; - }; - - - } + } ); }; }; @@ -101,13 +104,9 @@ in systemd.tmpfiles.settings."web-roots" = lib.mkMerge (builtins.map makeTmpFileRules enabledSites); ocf.acme.extraCerts = (builtins.concatMap makeExtraCerts enabledSites); - services.nginx = { enable = true; - virtualHosts = lib.mkMerge ( - (builtins.map makeVirtHosts enabledSites) - ++ defaultVirtHost - ); + virtualHosts = lib.mkMerge ((builtins.map makeVirtHosts enabledSites) ++ defaultVirtHost); }; }; diff --git a/pkgs/catppuccin-sddm.nix b/pkgs/catppuccin-sddm.nix index e56578ce..3a1e4158 100644 --- a/pkgs/catppuccin-sddm.nix +++ b/pkgs/catppuccin-sddm.nix @@ -1,4 +1,10 @@ -{ lib, formats, stdenvNoCC, fetchFromGitHub, themeConfig ? null }: +{ + lib, + formats, + stdenvNoCC, + fetchFromGitHub, + themeConfig ? null, +}: let config = (formats.ini { }).generate "theme.conf.user" themeConfig; diff --git a/pkgs/ocf-cosmic-greeter.nix b/pkgs/ocf-cosmic-greeter.nix index 07490710..8fe418ad 100644 --- a/pkgs/ocf-cosmic-greeter.nix +++ b/pkgs/ocf-cosmic-greeter.nix @@ -10,4 +10,3 @@ cosmic-greeter.overrideAttrs (oldAttrs: { hash = "sha256-4yRBgFrH4RBpuvChTED+ynx+PyFumoT2Z+R1gXxF4Xc="; }; }) - diff --git a/pkgs/plasma-applet-commandoutput.nix b/pkgs/plasma-applet-commandoutput.nix index c6603e60..b1a0a164 100644 --- a/pkgs/plasma-applet-commandoutput.nix +++ b/pkgs/plasma-applet-commandoutput.nix @@ -1,4 +1,8 @@ -{ lib, stdenvNoCC, fetchFromGitHub }: +{ + lib, + stdenvNoCC, + fetchFromGitHub, +}: stdenvNoCC.mkDerivation { pname = "plasma-applet-commandoutput"; diff --git a/profiles/base.nix b/profiles/base.nix index 85563aea..41f74f46 100644 --- a/profiles/base.nix +++ b/profiles/base.nix @@ -1,19 +1,24 @@ -{ self, pkgs, lib, inputs, config, ... }: +{ + self, + pkgs, + lib, + inputs, + config, + ... +}: let secretsDir = inputs.self + "/secrets"; hostKeyFile = secretsDir + "/host-keys/${config.networking.hostName}.pub"; variant_id = - if config.system.nixos.variant_id != null then - config.system.nixos.variant_id - else - "ocf"; + if config.system.nixos.variant_id != null then config.system.nixos.variant_id else "ocf"; gitRev = - if (self ? shortRev ) then + if (self ? shortRev) then self.shortRev else if (self ? dirtyShortRev) then self.dirtyShortRev - else "nullrev"; + else + "nullrev"; in { @@ -35,7 +40,8 @@ in automatic = true; dates = "weekly"; }; - settings = { #makes devenv shells build significantly faster + settings = { + # makes devenv shells build significantly faster trusted-substituters = [ "https://devenv.cachix.org" ]; trusted-public-keys = [ "devenv.cachix.org-1:w1cLUi8dv3hnoSPGAuibQv+f9TZLr6cv/Hm9XgU50cw=" ]; }; @@ -100,7 +106,7 @@ in ''; }; - environment.variables.EDITOR = "${pkgs.vim}/bin/ex"; # line editor + environment.variables.EDITOR = "${pkgs.vim}/bin/ex"; # line editor environment.variables.VISUAL = "${pkgs.nano}/bin/nano"; # visual editor environment.systemPackages = with pkgs; [ @@ -152,7 +158,7 @@ in teleport k9s kubectl - + # OCF utilities (python312.withPackages (ps: [ ps.ocflib ])) ocf-utils diff --git a/profiles/desktop.nix b/profiles/desktop.nix index def51fa9..9db45611 100644 --- a/profiles/desktop.nix +++ b/profiles/desktop.nix @@ -1,6 +1,12 @@ # basic minimal profile for desktops -{ config, pkgs, lib, inputs, ... }: +{ + config, + pkgs, + lib, + inputs, + ... +}: let # Default openssh doesn't include GSSAPI support, so we need to override sshfs @@ -8,9 +14,11 @@ let # sshfs package's openssh argument is nested in another layer of callPackage, # so we override callPackage instead to override openssh. sshfs = pkgs.sshfs.override { - callPackage = fn: args: (pkgs.callPackage fn args).override { - openssh = pkgs.openssh_gssapi; - }; + callPackage = + fn: args: + (pkgs.callPackage fn args).override { + openssh = pkgs.openssh_gssapi; + }; }; in { @@ -51,8 +59,11 @@ in security.pam = { # Mount ~/remote services.login.pamMount = true; - services.login.rules.session.mount.order = config.security.pam.services.login.rules.session.krb5.order + 50; - mount.extraVolumes = [ '''' ]; + services.login.rules.session.mount.order = + config.security.pam.services.login.rules.session.krb5.order + 50; + mount.extraVolumes = [ + '''' + ]; # Trim spaces from username services.login.rules.auth.trimspaces = {