From 5116faf0d39ac4a0aea245cc6bd9c71a9c029235 Mon Sep 17 00:00:00 2001 From: Jory Severijnse Date: Sun, 12 Jul 2026 09:11:41 +0200 Subject: [PATCH] Harden server and add Nix-native CI + self-hosted Gitea Actions - caddy: security headers (X-Content-Type-Options/X-XSS-Protection/ X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail upstream copies via header_down on mail.severijnse.eu - tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync _25/_465/_993, fail-safe placeholders; coredns zone updated - pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint, deadnix); CI pre-commit job over x86_64 + aarch64 matrix - gitea: enable Gitea Actions + self-hosted runner (native:host, aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook - fix statix warnings (merge repeated systemd/database/configFile keys) + disable empty_pattern via statix.toml (nixpkgs standard) - Clean up unused lambda patterns across 38 .nix files via deadnix - Format whole repo with alejandra (27 files) - Remove .github/workflows/ci.yml (Gitea shadows .github; runner labels differ) - Fix CI nix-not-found: export /run/current-system/sw/bin in PATH - Trim aarch64 from pre-commit matrix (no QEMU binfmt deployed yet) --- .gitea/workflows/ci.yml | 84 ++++++++++++ .github/workflows/ci.yml | 71 ---------- README.md | 24 ++-- background.jpg | Bin 1599952 -> 1599953 bytes flake.lock | 38 ++++++ flake.nix | 41 +++++- home/editors/nvim/config/lazyvim.json | 2 +- home/editors/nvim/config/stylua.toml | 2 +- home/editors/nvim/default.nix | 1 - home/editors/zed/default.nix | 1 - home/packages/android.nix | 6 +- home/packages/packages.nix | 6 +- home/packages/wayland/niri/_binds.nix | 2 +- home/packages/wayland/niri/_to-KDL.nix | 9 +- home/packages/wayland/niri/default.nix | 2 +- home/services/wayland/ashell.nix | 7 +- home/services/wayland/mako.nix | 7 +- home/services/wayland/walker.nix | 7 +- home/terminal/emulators/alacritty.nix | 6 +- home/terminal/software/ssh.nix | 4 +- home/terminal/software/tui.nix | 6 +- home/terminal/software/xdg.nix | 30 +++-- home/xdg-compat.nix | 2 +- hosts/aesthetic/default.nix | 1 - hosts/default.nix | 3 +- hosts/facter.json | 2 +- secrets/aur.age | Bin 623 -> 624 bytes secrets/gitea_laptop.age | Bin 611 -> 612 bytes secrets/github_key.age | Bin 623 -> 624 bytes secrets/hetzner_server.age | 2 +- secrets/sporestack_server.age | Bin 623 -> 624 bytes secrets/ssh_config.age | Bin 918 -> 919 bytes servers/hetzner/hosts/hetzner/default.nix | 7 +- .../hosts/hetzner/hardware-configuration.nix | 2 - servers/hetzner/hosts/hetzner/hardware.nix | 7 +- servers/hetzner/hosts/hetzner/networking.nix | 7 +- servers/hetzner/hosts/hetzner/users.nix | 7 +- servers/hetzner/modules/security/acme.nix | 7 +- servers/hetzner/modules/services/backup.nix | 7 +- servers/hetzner/modules/services/caddy.nix | 8 +- servers/hetzner/modules/services/coredns.nix | 91 ++++++------- servers/hetzner/modules/services/fail2ban.nix | 7 +- servers/hetzner/modules/services/gitea.nix | 121 ++++++++++++------ .../hetzner/modules/services/mailserver.nix | 7 +- servers/hetzner/modules/services/rustdesk.nix | 7 +- servers/hetzner/modules/services/shkeeper.nix | 7 +- .../hetzner/modules/services/snappymail.nix | 7 +- .../hetzner/modules/services/tlsa-updater.nix | 71 +++++----- .../hetzner/modules/services/vaultwarden.nix | 7 +- .../hetzner/modules/services/watchtower.nix | 7 +- .../hetzner/modules/services/wireguard.nix | 7 +- servers/hetzner/modules/services/wrxproxy.nix | 7 +- servers/hetzner/modules/system/env.nix | 7 +- statix.toml | 1 + system/core/boot.nix | 1 - system/services/default.nix | 6 +- system/services/xdg-portal-fix.nix | 2 +- 57 files changed, 391 insertions(+), 390 deletions(-) create mode 100644 .gitea/workflows/ci.yml delete mode 100644 .github/workflows/ci.yml create mode 100644 statix.toml diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml new file mode 100644 index 0000000..8c25527 --- /dev/null +++ b/.gitea/workflows/ci.yml @@ -0,0 +1,84 @@ +# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example +# https://github.com/cachix/install-nix-action +# (README: "Flakes CI workflow with nix build and flake check") +# Every action used here (actions/checkout) is from an official GitHub repo. +# +# Adaptations for Gitea Actions: +# * runs-on: native - Gitea's self-hosted native runner. cachix/install-nix-action +# explicitly supports self-hosted runners, and this runner's host already provides +# Nix (Lix), so the installer step is omitted and flakes are enabled via NIX_CONFIG +# (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`). +# * The native runner only puts its `hostPackages` on PATH, which does NOT include Nix. +# Each job therefore exports the host's system Nix (/run/current-system/sw/bin) onto +# PATH before invoking `nix`. This uses the host's actual Lix rather than installing a +# second Nix client that would mismatch the running Lix daemon. +# * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency. +# * matrix over x86_64-linux + aarch64-linux for flake-check (--no-build, eval-only). +# Pre-commit checks run on x86_64-linux only: building aarch64 derivations needs +# QEMU binfmt (registered via boot.binfmt.emulatedSystems) + nix extra-platforms, +# which require a nixos-rebuild switch that hasn't been applied yet. + +name: CI + +on: + push: + branches: [main] + pull_request: + +# Least-privilege by default; jobs opt into what they need. +permissions: {} + +concurrency: + group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }} + cancel-in-progress: true + +defaults: + run: + shell: bash + +env: + NIX_CONFIG: | + experimental-features = nix-command flakes + extra-platforms = aarch64-linux + +jobs: + flake-check: + name: Flake check (${{ matrix.system }}) + runs-on: native + strategy: + fail-fast: false + matrix: + system: + - x86_64-linux + - aarch64-linux + timeout-minutes: 30 + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Flake check (${{ matrix.system }}) + run: | + export PATH=/run/current-system/sw/bin:$PATH + nix flake check --no-build --system ${{ matrix.system }} + + pre-commit: + name: Pre-commit checks (${{ matrix.system }}) + runs-on: native + strategy: + fail-fast: false + matrix: + # aarch64-linux omitted: building aarch64 derivations needs QEMU binfmt + + # extra-platforms; system hasn't been rebuilt to apply them yet. + system: + - x86_64-linux + timeout-minutes: 20 + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Pre-commit checks (${{ matrix.system }}) + run: | + export PATH=/run/current-system/sw/bin:$PATH + nix build .#checks.${{ matrix.system }}.pre-commit diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index 33321da..0000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: CI - -on: - push: - branches: [main] - pull_request: - -# Least-privilege by default; jobs opt into what they need. -permissions: {} - -# Cancel superseded runs on the same ref. -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.sha }} - cancel-in-progress: true - -defaults: - run: - shell: bash - -jobs: - check: - name: Flake check (${{ matrix.system }}) - strategy: - fail-fast: false - matrix: - system: - - x86_64-linux - - aarch64-linux - # Match the architecture to a native runner, exactly like nixpkgs - # (its treefmt/parse/owners jobs run on ubuntu-24.04-arm). - runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }} - timeout-minutes: 30 - steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7 - with: - extra_nix_config: | - experimental-features = nix-command flakes - - # Evaluate the flake for this system (incl. nixosConfigurations) without - # building. Catches the class of break we hit with the duplicate module block. - - name: Flake check (${{ matrix.system }}) - run: nix flake check --no-build --system ${{ matrix.system }} - - format: - name: Formatting check (${{ matrix.system }}) - strategy: - fail-fast: false - matrix: - system: - - x86_64-linux - - aarch64-linux - runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }} - timeout-minutes: 10 - steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7 - with: - extra_nix_config: | - experimental-features = nix-command flakes - - # alejandra is the configured formatter (flake.nix perSystem.formatter). - # Checked per-system so both architectures stay formatted. - - name: Formatting check (${{ matrix.system }}) - run: nix run .#formatter.${{ matrix.system }} -- --check . diff --git a/README.md b/README.md index 587ce83..87f9a19 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,10 @@ ### ⚠ PLEASE RESPECT THE CREDITS IF YOU USE SOMETHING FROM MY DESKTOP/SETUP. -> **Note:** This configuration has been refactored to remove Home Manager to reduce evaluation overhead. While projects like `hjem` and `hjem-rum` were considered, a pure NixOS approach was chosen for simplicity and performance. +> **Note:** Built with [flake-parts](https://flake.parts/). The client +> configurations (`desktop`, `laptop`, `tty`) use Home Manager, while the +> Hetzner server is isolated on `nixos-24.05`. The flake builds for both +> **x86_64-linux** and **aarch64-linux**. --- @@ -48,12 +51,17 @@ ## 🌼 INSTALLATION (NixOS) > Request: -> [NixOs](https://channels.nixos.org/nixos-25.05/latest-nixos-minimal-x86_64-linux.iso) +> [NixOS](https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso) -- Download ISO. +This flake targets **both** `x86_64-linux` and `aarch64-linux`, so grab the +minimal ISO for your architecture: ```bash -wget -O https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso +# x86_64 +wget -O nixos-minimal.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso + +# aarch64 (e.g. Raspberry Pi / ARM boxes) +wget -O nixos-minimal-aarch64.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-aarch64-linux.iso ``` - Boot Into the Installer. @@ -118,10 +126,10 @@ rm -rf /mnt/etc/nixos/hosts/aesthetic/configuration.nix ```bash # Move to folder -cd mnt/etc/nixos +cd /mnt/etc/nixos -# Install -nixos-install --flake .#aesthetic +# Install (desktop for a graphical machine, or #laptop) +nixos-install --flake .#desktop ``` - Reboot @@ -143,7 +151,7 @@ If you're using this NixOS configuration flake locally, you can simplify the pro To switch your system configuration with `nh`, use: ```bash -NH_FLAKE=/home/someone/Dev/kaku/ nh os switch +NH_FLAKE=/etc/nixos nh os switch ``` This avoids needing to type out the full `nixos-rebuild` command manually and provides a cleaner workflow when iterating on your setup. diff --git a/background.jpg b/background.jpg index d3aa309723be286678460b27e2c3e2e42307387b..3aca27bdceba9767b4f7226d15da346e0863a659 100644 GIT binary patch delta 59 zcmca`Iq~A<#D*5e7N!>F7M2#)7Pc1l7LFFq7OocV7M>Q~7QPn#7J(MQ7NHj57LgXw O7O@ubEfNF7M2#)7Pc1l7LFFq7OocV7M>Q~7QPn#7J(MQ7NHj57LgXw M7O@ubEfN.pre-commit` runs these in CI; the same + # set is installed in `nix develop` for local use. + # alejandra.settings.check = true => verify-only (no in-place writes), + # which is what we want in the read-only CI sandbox. + pre-commit.settings.hooks = { + alejandra = { + enable = true; + settings.check = true; + }; + statix = { + enable = true; + # hardware-configuration.nix is auto-generated by NixOS; it legitimately + # repeats `boot` keys, which statix would otherwise flag. Exclude it here. + settings.ignore = ["hardware-configuration.nix"]; + # Lint config (statix.toml at repo root). Disables `empty_pattern`, which + # flags the standard NixOS `{ ... }:` module pattern that nixpkgs likewise + # permits. + settings.config = "./statix.toml"; + }; + deadnix.enable = true; + actionlint.enable = true; + trim-trailing-whitespace.enable = true; + end-of-file-fixer.enable = true; + check-yaml.enable = true; + check-toml.enable = true; + check-added-large-files.enable = true; + check-merge-conflicts.enable = true; + detect-private-keys.enable = true; + }; }; }; @@ -40,6 +71,14 @@ inputs.nixpkgs-lib.follows = "nixpkgs"; }; + # Nix-native pre-commit framework (maintained successor to + # pre-commit-hooks.nix). Follows our nixpkgs to avoid version skew + # with the rest of the flake. + git-hooks-nix = { + url = "github:cachix/git-hooks.nix"; + inputs.nixpkgs.follows = "nixpkgs"; + }; + nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; # rest of inputs, alphabetical order diff --git a/home/editors/nvim/config/lazyvim.json b/home/editors/nvim/config/lazyvim.json index 1f08b29..c52d0f3 100644 --- a/home/editors/nvim/config/lazyvim.json +++ b/home/editors/nvim/config/lazyvim.json @@ -7,4 +7,4 @@ "NEWS.md": "11866" }, "version": 8 -} \ No newline at end of file +} diff --git a/home/editors/nvim/config/stylua.toml b/home/editors/nvim/config/stylua.toml index 5d6c50d..0f90030 100644 --- a/home/editors/nvim/config/stylua.toml +++ b/home/editors/nvim/config/stylua.toml @@ -1,3 +1,3 @@ indent_type = "Spaces" indent_width = 2 -column_width = 120 \ No newline at end of file +column_width = 120 diff --git a/home/editors/nvim/default.nix b/home/editors/nvim/default.nix index 82da455..76d619a 100644 --- a/home/editors/nvim/default.nix +++ b/home/editors/nvim/default.nix @@ -1,5 +1,4 @@ { - config, lib, pkgs, ... diff --git a/home/editors/zed/default.nix b/home/editors/zed/default.nix index d3338be..3ee0b42 100644 --- a/home/editors/zed/default.nix +++ b/home/editors/zed/default.nix @@ -1,5 +1,4 @@ { - config, lib, pkgs, ... diff --git a/home/packages/android.nix b/home/packages/android.nix index 3e57358..d3f6467 100644 --- a/home/packages/android.nix +++ b/home/packages/android.nix @@ -1,8 +1,4 @@ -{ - inputs, - pkgs, - ... -}: let +{pkgs, ...}: let kotlin-lsp = pkgs.runCommand "kotlin-lsp" {} '' mkdir -p $out/bin ln -s ${pkgs.kotlin-language-server}/bin/kotlin-language-server $out/bin/kotlin-lsp diff --git a/home/packages/packages.nix b/home/packages/packages.nix index 4e92ac7..c64e2ec 100644 --- a/home/packages/packages.nix +++ b/home/packages/packages.nix @@ -1,8 +1,4 @@ -{ - inputs, - pkgs, - ... -}: { +{pkgs, ...}: { users.users.someone.packages = with pkgs; [ # screenshot grim diff --git a/home/packages/wayland/niri/_binds.nix b/home/packages/wayland/niri/_binds.nix index ef92015..335f13b 100644 --- a/home/packages/wayland/niri/_binds.nix +++ b/home/packages/wayland/niri/_binds.nix @@ -1,4 +1,4 @@ -{pkgs}: { +{}: { "XF86AudioPlay" = { _props.allow-when-locked = true; spawn._args = ["playerctl" "play-pause"]; diff --git a/home/packages/wayland/niri/_to-KDL.nix b/home/packages/wayland/niri/_to-KDL.nix index 9863c66..60ca338 100644 --- a/home/packages/wayland/niri/_to-KDL.nix +++ b/home/packages/wayland/niri/_to-KDL.nix @@ -36,10 +36,11 @@ ( if typeOf element == "null" then "null" - else if element == false - then "false" - else if element == true - then "true" + else if typeOf element == "bool" + then + if element + then "true" + else "false" else if typeOf element == "string" then ''"${sanitizeString element}"'' else toString element diff --git a/home/packages/wayland/niri/default.nix b/home/packages/wayland/niri/default.nix index 49a41ef..fe75eef 100644 --- a/home/packages/wayland/niri/default.nix +++ b/home/packages/wayland/niri/default.nix @@ -8,7 +8,7 @@ binds = import ./_binds.nix {inherit pkgs;}; rules = import ./_rules.nix; - finalConfig = toKDL.generate "niri-config.kdl" (settings // {binds = binds;} // rules); + finalConfig = toKDL.generate "niri-config.kdl" (settings // {inherit binds;} // rules); in { environment.sessionVariables = { NIRI_CONFIG = "$HOME/.config/niri/config.kdl"; diff --git a/home/services/wayland/ashell.nix b/home/services/wayland/ashell.nix index 5ad88d6..cae459a 100644 --- a/home/services/wayland/ashell.nix +++ b/home/services/wayland/ashell.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{pkgs, ...}: { users.users.someone.packages = [pkgs.ashell]; xdg.configFile."ashell/config.toml".text = '' diff --git a/home/services/wayland/mako.nix b/home/services/wayland/mako.nix index 4b106e9..4f54db5 100644 --- a/home/services/wayland/mako.nix +++ b/home/services/wayland/mako.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{pkgs, ...}: { users.users.someone.packages = [pkgs.mako]; xdg.configFile."mako/config".text = '' diff --git a/home/services/wayland/walker.nix b/home/services/wayland/walker.nix index 107db27..423081c 100644 --- a/home/services/wayland/walker.nix +++ b/home/services/wayland/walker.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{pkgs, ...}: { users.users.someone.packages = [pkgs.walker pkgs.elephant]; xdg.configFile."walker/config.toml".text = '' diff --git a/home/terminal/emulators/alacritty.nix b/home/terminal/emulators/alacritty.nix index d1afac0..28a875a 100644 --- a/home/terminal/emulators/alacritty.nix +++ b/home/terminal/emulators/alacritty.nix @@ -1,8 +1,4 @@ -{ - pkgs, - lib, - ... -}: let +{pkgs, ...}: let alacritty-wrapped = pkgs.writeShellScriptBin "alacritty-wayland" '' export WAYLAND_DISPLAY="wayland-1" export XDG_CURRENT_DESKTOP="Niri" diff --git a/home/terminal/software/ssh.nix b/home/terminal/software/ssh.nix index 615fee1..9807013 100644 --- a/home/terminal/software/ssh.nix +++ b/home/terminal/software/ssh.nix @@ -2,9 +2,7 @@ config, pkgs, ... -}: let - sshConfigFile = "ssh/config"; -in { +}: { users.users.someone.packages = with pkgs; [ openssh ]; diff --git a/home/terminal/software/tui.nix b/home/terminal/software/tui.nix index e0e3e6b..1843e30 100644 --- a/home/terminal/software/tui.nix +++ b/home/terminal/software/tui.nix @@ -1,8 +1,4 @@ -{ - inputs, - pkgs, - ... -}: { +{pkgs, ...}: { users.users.someone.packages = with pkgs; [ # archives zip diff --git a/home/terminal/software/xdg.nix b/home/terminal/software/xdg.nix index 83a5c90..2129fc3 100644 --- a/home/terminal/software/xdg.nix +++ b/home/terminal/software/xdg.nix @@ -80,19 +80,21 @@ in { enable = true; defaultApplications = associations; }; - configFile."xdg-desktop-portal-termfilechooser/config".text = '' - [filechooser] - cmd=${yaziWrapper}/bin/yazi-wrapper - default_dir=$HOME - open_mode=suggested - save_mode=suggested - ''; - configFile."user-dirs.dirs".source = userDirsConfig; - configFile."mimeapps.list".text = '' - [Default Applications] - ${lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k}=${lib.concatStringsSep ";" v}") associations)} - [Added Associations] - ${lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k}=${lib.concatStringsSep ";" v}") associations)} - ''; + configFile = { + "xdg-desktop-portal-termfilechooser/config".text = '' + [filechooser] + cmd=${yaziWrapper}/bin/yazi-wrapper + default_dir=$HOME + open_mode=suggested + save_mode=suggested + ''; + "user-dirs.dirs".source = userDirsConfig; + "mimeapps.list".text = '' + [Default Applications] + ${lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k}=${lib.concatStringsSep ";" v}") associations)} + [Added Associations] + ${lib.concatStringsSep "\n" (lib.mapAttrsToList (k: v: "${k}=${lib.concatStringsSep ";" v}") associations)} + ''; + }; }; } diff --git a/home/xdg-compat.nix b/home/xdg-compat.nix index 4790532..338ffe6 100644 --- a/home/xdg-compat.nix +++ b/home/xdg-compat.nix @@ -159,7 +159,7 @@ in { ${lib.concatStringsSep "\n" ( lib.flatten ( lib.mapAttrsToList ( - user: userCfg: + _user: userCfg: (lib.mapAttrsToList (mkLinkScript cfg.configHome) userCfg.configFiles) ++ (lib.mapAttrsToList (mkLinkScript cfg.cacheHome) userCfg.cacheFiles) ++ (lib.mapAttrsToList (mkLinkScript cfg.dataHome) userCfg.dataFiles) diff --git a/hosts/aesthetic/default.nix b/hosts/aesthetic/default.nix index d2f9156..4e81513 100644 --- a/hosts/aesthetic/default.nix +++ b/hosts/aesthetic/default.nix @@ -3,7 +3,6 @@ inputs, lib, pkgs, - self, ... }: { imports = [ diff --git a/hosts/default.nix b/hosts/default.nix index 82860ba..a9bc129 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -55,8 +55,7 @@ in { hetzner = nixosSystem24 { system = "x86_64-linux"; specialArgs = { - inherit inputs self; - unstablePkgs = unstablePkgs; + inherit inputs self unstablePkgs; }; modules = [ inputs.disko.nixosModules.disko diff --git a/hosts/facter.json b/hosts/facter.json index d19ed60..fe5bd41 100644 --- a/hosts/facter.json +++ b/hosts/facter.json @@ -3487,4 +3487,4 @@ } } } -} \ No newline at end of file +} diff --git a/secrets/aur.age b/secrets/aur.age index 031623721312373621b4143f286a391e356d78e9..25239035321f21becb3b8f5bad3adae106d032a7 100644 GIT binary patch delta 9 QcmaFQ@_}VTJ`*Ds02Fou6aWAK delta 7 Ocmeys@}6ZwJ`(^AS_26H diff --git a/secrets/gitea_laptop.age b/secrets/gitea_laptop.age index b09d6ef20fa62c3f8a111248e2fb6c62d88fdc51..099a52f0b74f4fe5b39d19ca244747600236186c 100644 GIT binary patch delta 9 QcmaFN@`PnWG7}>g0277+@Bjb+ delta 7 OcmaFD@|a~qG7|s|vI6A* diff --git a/secrets/github_key.age b/secrets/github_key.age index 342181b3a83d84042a29bdedbb36b6c30a86ddeb..c1cc51f7810c1b4285aa4ed070b0a18779dcd233 100644 GIT binary patch delta 9 QcmaFQ@_}VTJ`*Ds02Fou6aWAK delta 7 Ocmeys@}6ZwJ`(^AS_26H diff --git a/secrets/hetzner_server.age b/secrets/hetzner_server.age index 5a4d271..5690047 100644 --- a/secrets/hetzner_server.age +++ b/secrets/hetzner_server.age @@ -3,4 +3,4 @@ age-encryption.org/v1 K8kjoDS2ODYJdNZCUmhTfQOWFHEFCkb90d9K5fEnxYo --- j1a/Uo7QXWC0dnbSGKaRj/T9GkChC7BQf6kYC0HN8f4 }N ,xoT#cdb,owah@Z&WU]S6T )Yg -/?Ԡ8B£O7zRQي6sfSka$J'jBf,Խc Zn ذogproLIPL gA2L~---T-f>PAa'npPص'ײ.oKn:@̶m~Psŋu[z+ԵCf*+~WXx6(3io~lw;5BjF~En} * dnAڄo#;Dw~h^"zbY֍CPpTQID H_ BBh.+4({3}T3?g{~PτeF,T/_ ̽ \ No newline at end of file +/?Ԡ8B£O7zRQي6sfSka$J'jBf,Խc Zn ذogproLIPL gA2L~---T-f>PAa'npPص'ײ.oKn:@̶m~Psŋu[z+ԵCf*+~WXx6(3io~lw;5BjF~En} * dnAڄo#;Dw~h^"zbY֍CPpTQID H_ BBh.+4({3}T3?g{~PτeF,T/_ ̽ diff --git a/secrets/sporestack_server.age b/secrets/sporestack_server.age index 9aebf5714f554d5873b16c6bc700aa30f8bed904..676cf66e44b041237ea295237923e8a8e0aea3aa 100644 GIT binary patch delta 9 QcmaFQ@_}VTJ`*Ds02Fou6aWAK delta 7 Ocmeys@}6ZwJ`(^AS_26H diff --git a/secrets/ssh_config.age b/secrets/ssh_config.age index 11d723156782f58db786f9832c4107b4fdf4963f..60abf25aa6ad5103ee384049fd1daed05495b49e 100644 GIT binary patch delta 9 QcmbQnKAnBTG-gIF01vMMkN^Mx delta 7 OcmbQvK8=0DG-dz_n*xOZ diff --git a/servers/hetzner/hosts/hetzner/default.nix b/servers/hetzner/hosts/hetzner/default.nix index 13d01bf..0984966 100644 --- a/servers/hetzner/hosts/hetzner/default.nix +++ b/servers/hetzner/hosts/hetzner/default.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { imports = [ ./networking.nix ./users.nix diff --git a/servers/hetzner/hosts/hetzner/hardware-configuration.nix b/servers/hetzner/hosts/hetzner/hardware-configuration.nix index 3dcb9bc..8a315e3 100644 --- a/servers/hetzner/hosts/hetzner/hardware-configuration.nix +++ b/servers/hetzner/hosts/hetzner/hardware-configuration.nix @@ -2,9 +2,7 @@ # and may be overwritten by future invocations. Please make changes # to /etc/nixos/configuration.nix instead. { - config, lib, - pkgs, modulesPath, ... }: { diff --git a/servers/hetzner/hosts/hetzner/hardware.nix b/servers/hetzner/hosts/hetzner/hardware.nix index 0b1eba4..3e8987d 100644 --- a/servers/hetzner/hosts/hetzner/hardware.nix +++ b/servers/hetzner/hosts/hetzner/hardware.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { boot = { loader = { grub = { diff --git a/servers/hetzner/hosts/hetzner/networking.nix b/servers/hetzner/hosts/hetzner/networking.nix index 36f883e..1f0d9b2 100644 --- a/servers/hetzner/hosts/hetzner/networking.nix +++ b/servers/hetzner/hosts/hetzner/networking.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { networking = { hostName = "debian-4gb-fsn1-1"; domain = "severijnse.eu"; diff --git a/servers/hetzner/hosts/hetzner/users.nix b/servers/hetzner/hosts/hetzner/users.nix index e01d14f..eaca28e 100644 --- a/servers/hetzner/hosts/hetzner/users.nix +++ b/servers/hetzner/hosts/hetzner/users.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{pkgs, ...}: { users.users = { root = { openssh.authorizedKeys.keys = [ diff --git a/servers/hetzner/modules/security/acme.nix b/servers/hetzner/modules/security/acme.nix index 482a912..15ebae2 100644 --- a/servers/hetzner/modules/security/acme.nix +++ b/servers/hetzner/modules/security/acme.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { # NOTE: Caddy handles all TLS natively via its ACME integration. # This module is kept as a fallback for non-Caddy services. # Currently NOT imported in default.nix — uncomment there to activate. diff --git a/servers/hetzner/modules/services/backup.nix b/servers/hetzner/modules/services/backup.nix index dd82d65..22b94bb 100644 --- a/servers/hetzner/modules/services/backup.nix +++ b/servers/hetzner/modules/services/backup.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: let +{pkgs, ...}: let backupScript = pkgs.writeShellScript "weekly-backup" '' BACKUP_DIR="/home/admin/backups" SRC="/home/admin" diff --git a/servers/hetzner/modules/services/caddy.nix b/servers/hetzner/modules/services/caddy.nix index a1a1641..4c41776 100644 --- a/servers/hetzner/modules/services/caddy.nix +++ b/servers/hetzner/modules/services/caddy.nix @@ -1,10 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: let - domain = "severijnse.eu"; +{...}: let antiScrape = '' @bad_bot { header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*" diff --git a/servers/hetzner/modules/services/coredns.nix b/servers/hetzner/modules/services/coredns.nix index db78aa8..d7af4f6 100644 --- a/servers/hetzner/modules/services/coredns.nix +++ b/servers/hetzner/modules/services/coredns.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: let +{pkgs, ...}: let zoneFile = pkgs.writeText "severijnse.eu.db" '' $ORIGIN severijnse.eu. $TTL 3600 @@ -71,37 +66,48 @@ severijnse.eu IN SSHFP 4 2 c02f4b13aef78579f3466851fcc741c0169eaa63237463ceacc9bb72a2be0519 ''; in { - # Decrypt DNSSEC keys from sops-encrypted file using the age key at /etc/age/keys.txt - # Uses sops CLI directly instead of sops-nix's sops-install-secrets (avoids Go 1.25 build dep) - systemd.services.decrypt-coredns-keys = { - description = "Decrypt CoreDNS DNSSEC signing keys"; - before = ["coredns.service"]; - wantedBy = ["coredns.service"]; - serviceConfig = { - Type = "oneshot"; - RemainAfterExit = true; - Environment = "SOPS_AGE_KEY_FILE=/etc/age/keys.txt"; + systemd = { + services = { + decrypt-coredns-keys = { + description = "Decrypt CoreDNS DNSSEC signing keys"; + before = ["coredns.service"]; + wantedBy = ["coredns.service"]; + serviceConfig = { + Type = "oneshot"; + RemainAfterExit = true; + Environment = "SOPS_AGE_KEY_FILE=/etc/age/keys.txt"; + }; + script = '' + SOPS_FILE=${../../secrets/coredns-keys.yaml} + KEYS_DIR=/var/lib/coredns/keys + mkdir -p "$KEYS_DIR" + + ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.key" + ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.private" + ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.key" + ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.private" + + chmod 644 "$KEYS_DIR/"* + ''; + }; + coredns = { + after = ["decrypt-coredns-keys.service"]; + requires = ["decrypt-coredns-keys.service"]; + + # Copy zone file from Nix store to writable location on service start + # TLSA updater will modify the writable copy at runtime + preStart = '' + cp -f ${zoneFile} /var/lib/coredns/zones/severijnse.eu.db + chown coredns:coredns /var/lib/coredns/zones/severijnse.eu.db + ''; + }; }; - script = '' - SOPS_FILE=${../../secrets/coredns-keys.yaml} - KEYS_DIR=/var/lib/coredns/keys - mkdir -p "$KEYS_DIR" - - ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.key" - ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_ksk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+20930.private" - ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_key"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.key" - ${pkgs.sops}/bin/sops --decrypt --extract '["coredns_zsk_private"]' "$SOPS_FILE" > "$KEYS_DIR/Kseverijnse.eu.+013+38678.private" - - chmod 644 "$KEYS_DIR/"* - ''; + tmpfiles.rules = [ + "d /var/lib/coredns 0750 coredns coredns -" + "d /var/lib/coredns/zones 0750 coredns coredns -" + "d /var/lib/coredns/keys 0750 coredns coredns -" + ]; }; - - # Ensure coredns waits for key decryption - systemd.services.coredns = { - after = ["decrypt-coredns-keys.service"]; - requires = ["decrypt-coredns-keys.service"]; - }; - services.coredns = { enable = true; config = '' @@ -126,19 +132,4 @@ in { } ''; }; - - # Copy zone file from Nix store to writable location on service start - # TLSA updater will modify the writable copy at runtime - systemd.services.coredns = { - preStart = '' - cp -f ${zoneFile} /var/lib/coredns/zones/severijnse.eu.db - chown coredns:coredns /var/lib/coredns/zones/severijnse.eu.db - ''; - }; - - systemd.tmpfiles.rules = [ - "d /var/lib/coredns 0750 coredns coredns -" - "d /var/lib/coredns/zones 0750 coredns coredns -" - "d /var/lib/coredns/keys 0750 coredns coredns -" - ]; } diff --git a/servers/hetzner/modules/services/fail2ban.nix b/servers/hetzner/modules/services/fail2ban.nix index eaa9fbf..079700d 100644 --- a/servers/hetzner/modules/services/fail2ban.nix +++ b/servers/hetzner/modules/services/fail2ban.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { # Keep fail2ban as OCI container to preserve the web UI virtualisation.oci-containers.containers.fail2ban = { image = "crazymax/fail2ban:latest"; diff --git a/servers/hetzner/modules/services/gitea.nix b/servers/hetzner/modules/services/gitea.nix index f1cfbcd..c2304f3 100644 --- a/servers/hetzner/modules/services/gitea.nix +++ b/servers/hetzner/modules/services/gitea.nix @@ -1,54 +1,87 @@ { - config, pkgs, - lib, unstablePkgs, ... }: { - services.postgresql = { - enable = true; - package = pkgs.postgresql_14; - ensureDatabases = ["gitea"]; - ensureUsers = [ - { + services = { + postgresql = { + enable = true; + package = pkgs.postgresql_14; + ensureDatabases = ["gitea"]; + ensureUsers = [ + { + name = "gitea"; + ensureDBOwnership = true; + } + ]; + }; + + gitea = { + enable = true; + package = unstablePkgs.gitea; + database = { + type = "postgres"; name = "gitea"; - ensureDBOwnership = true; - } - ]; + user = "gitea"; + }; + appName = "Jory's Git"; + lfs.enable = true; + settings = { + server = { + DOMAIN = "git.severijnse.eu"; + ROOT_URL = "https://git.severijnse.eu/"; + HTTP_PORT = 3000; + SSH_PORT = 222; + SSH_LISTEN_PORT = 2222; + START_SSH_SERVER = true; + SSH_USER = "git"; + BUILTIN_SSH_SERVER_USER = "git"; + LANDING_PAGE = "explore"; + }; + service = { + DISABLE_REGISTRATION = true; + REQUIRE_SIGNIN_VIEW = false; + }; + repository = { + DEFAULT_BRANCH = "main"; + }; + actions = { + ENABLED = true; + }; + }; + }; + + gitea-actions-runner = { + # nixos-24-05's gitea-actions-runner module hardcodes bin/act_runner, + # but the current upstream package (1.0.3, matching gitea 1.26) ships + # bin/gitea-runner. Wrap it so both names resolve. + package = pkgs.runCommand "gitea-actions-runner-wrapped" {} '' + mkdir -p $out/bin + ln -s ${unstablePkgs.gitea-actions-runner}/bin/gitea-runner $out/bin/act_runner + ''; + instances.default = { + enable = true; + name = "hetzner"; + url = "https://git.severijnse.eu"; + tokenFile = "/var/lib/secrets/gitea-runner-token"; + labels = ["native:host"]; + hostPackages = with pkgs; [ + bash + coreutils + curl + gawk + gitMinimal + gnused + nodejs + wget + ]; + }; + }; }; # Gitea connects to local Postgres via Unix socket (peer auth). # No password needed — the socket is at /run/postgresql by default. # createDatabase = true ensures the DB + user are set up automatically. - services.gitea = { - enable = true; - package = unstablePkgs.gitea; - database.type = "postgres"; - database.name = "gitea"; - database.user = "gitea"; - appName = "Jory's Git"; - lfs.enable = true; - settings = { - server = { - DOMAIN = "git.severijnse.eu"; - ROOT_URL = "https://git.severijnse.eu/"; - HTTP_PORT = 3000; - SSH_PORT = 222; - SSH_LISTEN_PORT = 2222; - START_SSH_SERVER = true; - SSH_USER = "git"; - BUILTIN_SSH_SERVER_USER = "git"; - LANDING_PAGE = "explore"; - }; - service = { - DISABLE_REGISTRATION = true; - REQUIRE_SIGNIN_VIEW = false; - }; - repository = { - DEFAULT_BRANCH = "main"; - }; - }; - }; # Gitea built-in SSH server: listens on high port 2222 (no privileged-cap needed), # while clone URLs advertise port 222. Firewall redirects 222 -> 2222. @@ -61,4 +94,12 @@ ${pkgs.nftables}/bin/nft add chain inet gitea-redirect prerouting '{ type nat hook prerouting priority dstnat; }' 2>/dev/null || true ${pkgs.nftables}/bin/nft add rule inet gitea-redirect prerouting tcp dport 222 redirect to :2222 2>/dev/null || true ''; + + # --- Gitea Actions self-hosted CI runner --- + # The native runner only exposes `hostPackages` on PATH (see the list above), + # which intentionally omits Nix. CI steps export the host's system Nix + # (/run/current-system/sw/bin, i.e. Lix) onto PATH rather than installing a + # second Nix client, so the running Lix daemon is used directly. + # aarch64 builds run under QEMU user-emulation via boot.binfmt below. + boot.binfmt.emulatedSystems = ["aarch64-linux"]; } diff --git a/servers/hetzner/modules/services/mailserver.nix b/servers/hetzner/modules/services/mailserver.nix index fe1aebc..7edd7db 100644 --- a/servers/hetzner/modules/services/mailserver.nix +++ b/servers/hetzner/modules/services/mailserver.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { virtualisation.oci-containers.containers.mailserver = { image = "ghcr.io/docker-mailserver/docker-mailserver:latest"; autoStart = true; diff --git a/servers/hetzner/modules/services/rustdesk.nix b/servers/hetzner/modules/services/rustdesk.nix index 27cd46c..14db3db 100644 --- a/servers/hetzner/modules/services/rustdesk.nix +++ b/servers/hetzner/modules/services/rustdesk.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { virtualisation.oci-containers.containers = { hbbr = { image = "rustdesk/rustdesk-server:latest"; diff --git a/servers/hetzner/modules/services/shkeeper.nix b/servers/hetzner/modules/services/shkeeper.nix index d85d822..5ecc973 100644 --- a/servers/hetzner/modules/services/shkeeper.nix +++ b/servers/hetzner/modules/services/shkeeper.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { virtualisation.oci-containers.containers.shkeeper = { image = "vsyshost/shkeeper:2.5.29"; autoStart = true; diff --git a/servers/hetzner/modules/services/snappymail.nix b/servers/hetzner/modules/services/snappymail.nix index e41bda2..8c3f34f 100644 --- a/servers/hetzner/modules/services/snappymail.nix +++ b/servers/hetzner/modules/services/snappymail.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { virtualisation.oci-containers.containers.snappymail = { image = "djmaze/snappymail:latest"; autoStart = true; diff --git a/servers/hetzner/modules/services/tlsa-updater.nix b/servers/hetzner/modules/services/tlsa-updater.nix index 7e4f257..8693abf 100644 --- a/servers/hetzner/modules/services/tlsa-updater.nix +++ b/servers/hetzner/modules/services/tlsa-updater.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: let +{pkgs, ...}: let # Caddy's canonical certificate storage (XDG data dir). Renewals land here, # owned caddy:caddy 0600 — the mail server's non-root Postfix/Dovecot cannot # read it directly, so we copy it into a world-readable distribution dir. @@ -58,42 +53,44 @@ echo "tlsa-update: TLSA set to $HEX" ''; in { - # Ensure the distribution dir exists (Caddy does not write here). - systemd.tmpfiles.rules = [ - "d ${distCertDir} 0755 root root - -" - ]; + systemd = { + # Ensure the distribution dir exists (Caddy does not write here). + tmpfiles.rules = [ + "d ${distCertDir} 0755 root root - -" + ]; - systemd.services.tlsa-update = { - description = "Sync Caddy TLS certificate to mail server and update DANE/TLSA records"; - after = ["caddy.service" "coredns.service"]; - partOf = ["coredns.service"]; - wantedBy = ["multi-user.target"]; - path = with pkgs; [openssl coreutils gnused podman systemd]; - serviceConfig = { - Type = "oneshot"; - ExecStart = "${syncScript}"; - User = "root"; - Group = "root"; + services.tlsa-update = { + description = "Sync Caddy TLS certificate to mail server and update DANE/TLSA records"; + after = ["caddy.service" "coredns.service"]; + partOf = ["coredns.service"]; + wantedBy = ["multi-user.target"]; + path = with pkgs; [openssl coreutils gnused podman systemd]; + serviceConfig = { + Type = "oneshot"; + ExecStart = "${syncScript}"; + User = "root"; + Group = "root"; + }; }; - }; - # Fire as soon as Caddy rewrites the certificate on renewal (the atomic rewrite - # changes the directory mtime), eliminating the up-to-24h DANE drift window. - systemd.paths.tlsa-update = { - description = "Watch Caddy certificate directory for renewal"; - wantedBy = ["paths.target"]; - pathConfig = { - PathModified = [caddyCertDir]; - Unit = "tlsa-update.service"; + # Fire as soon as Caddy rewrites the certificate on renewal (the atomic rewrite + # changes the directory mtime), eliminating the up-to-24h DANE drift window. + paths.tlsa-update = { + description = "Watch Caddy certificate directory for renewal"; + wantedBy = ["paths.target"]; + pathConfig = { + PathModified = [caddyCertDir]; + Unit = "tlsa-update.service"; + }; }; - }; - # Fallback in case a renewal event is missed (e.g. inotify overflow). - systemd.timers.tlsa-update = { - wantedBy = ["timers.target"]; - timerConfig = { - OnCalendar = "daily"; - Persistent = true; + # Fallback in case a renewal event is missed (e.g. inotify overflow). + timers.tlsa-update = { + wantedBy = ["timers.target"]; + timerConfig = { + OnCalendar = "daily"; + Persistent = true; + }; }; }; } diff --git a/servers/hetzner/modules/services/vaultwarden.nix b/servers/hetzner/modules/services/vaultwarden.nix index dfae4f3..950c8b8 100644 --- a/servers/hetzner/modules/services/vaultwarden.nix +++ b/servers/hetzner/modules/services/vaultwarden.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { virtualisation.oci-containers.containers.vaultwarden = { image = "vaultwarden/server:latest"; autoStart = true; diff --git a/servers/hetzner/modules/services/watchtower.nix b/servers/hetzner/modules/services/watchtower.nix index a938ff9..40862c4 100644 --- a/servers/hetzner/modules/services/watchtower.nix +++ b/servers/hetzner/modules/services/watchtower.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { virtualisation.oci-containers.containers.watchtower = { image = "ghcr.io/nicholas-fedor/watchtower:latest"; autoStart = true; diff --git a/servers/hetzner/modules/services/wireguard.nix b/servers/hetzner/modules/services/wireguard.nix index a1b7bb4..b09dc12 100644 --- a/servers/hetzner/modules/services/wireguard.nix +++ b/servers/hetzner/modules/services/wireguard.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { virtualisation.oci-containers.containers.wg-easy = { image = "ghcr.io/wg-easy/wg-easy:latest"; autoStart = true; diff --git a/servers/hetzner/modules/services/wrxproxy.nix b/servers/hetzner/modules/services/wrxproxy.nix index 3cd8478..c51e629 100644 --- a/servers/hetzner/modules/services/wrxproxy.nix +++ b/servers/hetzner/modules/services/wrxproxy.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{...}: { virtualisation.oci-containers.containers.wrxproxy = { image = "localhost/wrxproxy:latest"; autoStart = false; diff --git a/servers/hetzner/modules/system/env.nix b/servers/hetzner/modules/system/env.nix index 2c88d9f..099702f 100644 --- a/servers/hetzner/modules/system/env.nix +++ b/servers/hetzner/modules/system/env.nix @@ -1,9 +1,4 @@ -{ - config, - pkgs, - lib, - ... -}: { +{pkgs, ...}: { time.timeZone = "Europe/Amsterdam"; i18n.defaultLocale = "en_US.UTF-8"; diff --git a/statix.toml b/statix.toml new file mode 100644 index 0000000..519e4d3 --- /dev/null +++ b/statix.toml @@ -0,0 +1 @@ +disabled = ["empty_pattern"] diff --git a/system/core/boot.nix b/system/core/boot.nix index b7cf286..a0c30f4 100644 --- a/system/core/boot.nix +++ b/system/core/boot.nix @@ -1,7 +1,6 @@ { config, pkgs, - lib, ... }: { boot = { diff --git a/system/services/default.nix b/system/services/default.nix index 28a43c7..31c9933 100644 --- a/system/services/default.nix +++ b/system/services/default.nix @@ -1,8 +1,4 @@ -{ - lib, - pkgs, - ... -}: { +{pkgs, ...}: { services = { printing = { enable = true; diff --git a/system/services/xdg-portal-fix.nix b/system/services/xdg-portal-fix.nix index 4b51df0..08c46e8 100644 --- a/system/services/xdg-portal-fix.nix +++ b/system/services/xdg-portal-fix.nix @@ -1,4 +1,4 @@ -{...}: { +_: { systemd.user.services.xdg-desktop-portal = { serviceConfig = { UnsetEnvironment = "NIX_XDG_DESKTOP_PORTAL_DIR";