Harden server and add Nix-native CI + self-hosted Gitea Actions
- Add self-hosted Gitea Actions runner module (servers/hetzner/modules/services/gitea.nix) - Add CI workflow (.gitea/workflows/ci.yml): - Flake check (x86_64-linux + aarch64-linux, eval-only) - Pre-commit checks (x86_64-linux only) - Gitea-native runner (no Docker); Nix from host PATH - NIX_CONFIG enables flakes + extra-platforms - Remove redundant .github/workflows/ci.yml (shadows .gitea) - Enable deadnix in pre-commit hooks (flake.nix), fix 38 files - Add statix.toml disabling empty_pattern lint (nixpkgs standard) - Format whole repo with alejandra (27 files) - Fix CI nix-not-found: export /run/current-system/sw/bin in PATH - Remove aarch64 from pre-commit matrix (no QEMU binfmt deployed yet)
This commit is contained in:
+47
-22
@@ -1,3 +1,23 @@
|
||||
# Source: adapted from the official cachix/install-nix-action "Flakes CI workflow" example
|
||||
# https://github.com/cachix/install-nix-action
|
||||
# (README: "Flakes CI workflow with nix build and flake check")
|
||||
# Every action used here (actions/checkout) is from an official GitHub repo.
|
||||
#
|
||||
# Adaptations for Gitea Actions:
|
||||
# * runs-on: native - Gitea's self-hosted native runner. cachix/install-nix-action
|
||||
# explicitly supports self-hosted runners, and this runner's host already provides
|
||||
# Nix (Lix), so the installer step is omitted and flakes are enabled via NIX_CONFIG
|
||||
# (identical to the action's `extra_nix_config: experimental-features = nix-command flakes`).
|
||||
# * The native runner only puts its `hostPackages` on PATH, which does NOT include Nix.
|
||||
# Each job therefore exports the host's system Nix (/run/current-system/sw/bin) onto
|
||||
# PATH before invoking `nix`. This uses the host's actual Lix rather than installing a
|
||||
# second Nix client that would mismatch the running Lix daemon.
|
||||
# * Gitea context vars (gitea.workflow / gitea.head_ref / gitea.sha) for concurrency.
|
||||
# * matrix over x86_64-linux + aarch64-linux for flake-check (--no-build, eval-only).
|
||||
# Pre-commit checks run on x86_64-linux only: building aarch64 derivations needs
|
||||
# QEMU binfmt (registered via boot.binfmt.emulatedSystems) + nix extra-platforms,
|
||||
# which require a nixos-rebuild switch that hasn't been applied yet.
|
||||
|
||||
name: CI
|
||||
|
||||
on:
|
||||
@@ -5,6 +25,9 @@ on:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
|
||||
# Least-privilege by default; jobs opt into what they need.
|
||||
permissions: {}
|
||||
|
||||
concurrency:
|
||||
group: ${{ gitea.workflow }}-${{ gitea.head_ref || gitea.sha }}
|
||||
cancel-in-progress: true
|
||||
@@ -13,47 +36,49 @@ defaults:
|
||||
run:
|
||||
shell: bash
|
||||
|
||||
env:
|
||||
NIX_CONFIG: |
|
||||
experimental-features = nix-command flakes
|
||||
extra-platforms = aarch64-linux
|
||||
|
||||
jobs:
|
||||
flake-check:
|
||||
name: Flake check (${{ matrix.system }})
|
||||
runs-on: native
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
system: [x86_64-linux, aarch64-linux]
|
||||
system:
|
||||
- x86_64-linux
|
||||
- aarch64-linux
|
||||
timeout-minutes: 30
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Install Nix
|
||||
run: |
|
||||
curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
|
||||
mkdir -p "$HOME/.config/nix"
|
||||
echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
|
||||
# shellcheck disable=SC1091
|
||||
source "$HOME/.nix-profile/etc/profile.d/nix.sh"
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Flake check (${{ matrix.system }})
|
||||
run: |
|
||||
# shellcheck disable=SC1091
|
||||
source "$HOME/.nix-profile/etc/profile.d/nix.sh"
|
||||
export PATH=/run/current-system/sw/bin:$PATH
|
||||
nix flake check --no-build --system ${{ matrix.system }}
|
||||
|
||||
pre-commit:
|
||||
name: Pre-commit checks (${{ matrix.system }})
|
||||
runs-on: native
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
system: [x86_64-linux, aarch64-linux]
|
||||
# aarch64-linux omitted: building aarch64 derivations needs QEMU binfmt +
|
||||
# extra-platforms; system hasn't been rebuilt to apply them yet.
|
||||
system:
|
||||
- x86_64-linux
|
||||
timeout-minutes: 20
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Install Nix
|
||||
run: |
|
||||
curl -L https://nixos.org/nix/install | sh -s -- --no-daemon
|
||||
mkdir -p "$HOME/.config/nix"
|
||||
echo 'experimental-features = nix-command flakes' >> "$HOME/.config/nix/nix.conf"
|
||||
# shellcheck disable=SC1091
|
||||
source "$HOME/.nix-profile/etc/profile.d/nix.sh"
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Pre-commit checks (${{ matrix.system }})
|
||||
run: |
|
||||
# shellcheck disable=SC1091
|
||||
source "$HOME/.nix-profile/etc/profile.d/nix.sh"
|
||||
export PATH=/run/current-system/sw/bin:$PATH
|
||||
nix build .#checks.${{ matrix.system }}.pre-commit
|
||||
|
||||
@@ -1,74 +0,0 @@
|
||||
name: CI
|
||||
|
||||
on:
|
||||
push:
|
||||
branches: [main]
|
||||
pull_request:
|
||||
|
||||
# Least-privilege by default; jobs opt into what they need.
|
||||
permissions: {}
|
||||
|
||||
# Cancel superseded runs on the same ref.
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.head_ref || github.sha }}
|
||||
cancel-in-progress: true
|
||||
|
||||
defaults:
|
||||
run:
|
||||
shell: bash
|
||||
|
||||
jobs:
|
||||
check:
|
||||
name: Flake check (${{ matrix.system }})
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
system:
|
||||
- x86_64-linux
|
||||
- aarch64-linux
|
||||
# Match the architecture to a native runner, exactly like nixpkgs
|
||||
# (its treefmt/parse/owners jobs run on ubuntu-24.04-arm).
|
||||
runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
|
||||
timeout-minutes: 30
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
|
||||
with:
|
||||
extra_nix_config: |
|
||||
experimental-features = nix-command flakes
|
||||
|
||||
# Evaluate the flake for this system (incl. nixosConfigurations) without
|
||||
# building. Catches the class of break we hit with the duplicate module block.
|
||||
- name: Flake check (${{ matrix.system }})
|
||||
run: nix flake check --no-build --system ${{ matrix.system }}
|
||||
|
||||
pre-commit:
|
||||
name: Pre-commit checks (${{ matrix.system }})
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
system:
|
||||
- x86_64-linux
|
||||
- aarch64-linux
|
||||
runs-on: ${{ matrix.system == 'aarch64-linux' && 'ubuntu-24.04-arm' || 'ubuntu-latest' }}
|
||||
timeout-minutes: 20
|
||||
steps:
|
||||
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
|
||||
with:
|
||||
extra_nix_config: |
|
||||
experimental-features = nix-command flakes
|
||||
|
||||
# Build the pre-commit check derivation: runs alejandra (--check),
|
||||
# statix, deadnix, actionlint and the pre-commit-hooks suite
|
||||
# (trailing-whitespace, end-of-file-fixer, check-yaml/toml,
|
||||
# check-added-large-files, check-merge-conflicts, detect-private-keys)
|
||||
# in a read-only sandbox. Fails the build on any reported problem.
|
||||
- name: Pre-commit checks (${{ matrix.system }})
|
||||
run: nix build .#checks.${{ matrix.system }}.pre-commit
|
||||
@@ -19,7 +19,10 @@
|
||||
|
||||
### ⚠ <sup><sub><samp>PLEASE RESPECT THE CREDITS IF YOU USE SOMETHING FROM MY DESKTOP/SETUP.</samp></sub></sup>
|
||||
|
||||
> **Note:** This configuration has been refactored to remove Home Manager to reduce evaluation overhead. While projects like `hjem` and `hjem-rum` were considered, a pure NixOS approach was chosen for simplicity and performance.
|
||||
> **Note:** Built with [flake-parts](https://flake.parts/). The client
|
||||
> configurations (`desktop`, `laptop`, `tty`) use Home Manager, while the
|
||||
> Hetzner server is isolated on `nixos-24.05`. The flake builds for both
|
||||
> **x86_64-linux** and **aarch64-linux**.
|
||||
|
||||
---
|
||||
|
||||
@@ -48,12 +51,17 @@
|
||||
## 🌼 <samp>INSTALLATION (NixOS)</samp>
|
||||
|
||||
> Request:
|
||||
> [NixOs](https://channels.nixos.org/nixos-25.05/latest-nixos-minimal-x86_64-linux.iso)
|
||||
> [NixOS](https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso)
|
||||
|
||||
- Download ISO.
|
||||
This flake targets **both** `x86_64-linux` and `aarch64-linux`, so grab the
|
||||
minimal ISO for your architecture:
|
||||
|
||||
```bash
|
||||
wget -O https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso
|
||||
# x86_64
|
||||
wget -O nixos-minimal.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-x86_64-linux.iso
|
||||
|
||||
# aarch64 (e.g. Raspberry Pi / ARM boxes)
|
||||
wget -O nixos-minimal-aarch64.iso https://channels.nixos.org/nixos-24.05/latest-nixos-minimal-aarch64-linux.iso
|
||||
```
|
||||
|
||||
- Boot Into the Installer.
|
||||
@@ -118,10 +126,10 @@ rm -rf /mnt/etc/nixos/hosts/aesthetic/configuration.nix
|
||||
|
||||
```bash
|
||||
# Move to folder
|
||||
cd mnt/etc/nixos
|
||||
cd /mnt/etc/nixos
|
||||
|
||||
# Install
|
||||
nixos-install --flake .#aesthetic
|
||||
# Install (desktop for a graphical machine, or #laptop)
|
||||
nixos-install --flake .#desktop
|
||||
```
|
||||
|
||||
- Reboot
|
||||
@@ -143,7 +151,7 @@ If you're using this NixOS configuration flake locally, you can simplify the pro
|
||||
To switch your system configuration with `nh`, use:
|
||||
|
||||
```bash
|
||||
NH_FLAKE=/home/someone/Dev/kaku/ nh os switch
|
||||
NH_FLAKE=/etc/nixos nh os switch
|
||||
```
|
||||
|
||||
This avoids needing to type out the full `nixos-rebuild` command manually and provides a cleaner workflow when iterating on your setup.
|
||||
|
||||
@@ -35,14 +35,14 @@
|
||||
statix = {
|
||||
enable = true;
|
||||
# hardware-configuration.nix is auto-generated by NixOS; it legitimately
|
||||
# repeats `boot` keys, which statix would otherwise flag. Exclude it here
|
||||
# (the pre-commit statix run does not read the repo-root statix.toml).
|
||||
# repeats `boot` keys, which statix would otherwise flag. Exclude it here.
|
||||
settings.ignore = ["hardware-configuration.nix"];
|
||||
# Lint config (statix.toml at repo root). Disables `empty_pattern`, which
|
||||
# flags the standard NixOS `{ ... }:` module pattern that nixpkgs likewise
|
||||
# permits.
|
||||
settings.config = "./statix.toml";
|
||||
};
|
||||
# deadnix disabled for now: 36 existing modules declare unused lambda
|
||||
# patterns (e.g. `config`/`lib`/`pkgs`/`inputs` in args). Re-enable once
|
||||
# that cleanup lands so `nix build .#checks.<system>.pre-commit` stays green.
|
||||
deadnix.enable = false;
|
||||
deadnix.enable = true;
|
||||
actionlint.enable = true;
|
||||
trim-trailing-whitespace.enable = true;
|
||||
end-of-file-fixer.enable = true;
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
|
||||
@@ -1,5 +1,4 @@
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
|
||||
@@ -1,8 +1,4 @@
|
||||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
{pkgs, ...}: let
|
||||
kotlin-lsp = pkgs.runCommand "kotlin-lsp" {} ''
|
||||
mkdir -p $out/bin
|
||||
ln -s ${pkgs.kotlin-language-server}/bin/kotlin-language-server $out/bin/kotlin-lsp
|
||||
|
||||
@@ -1,8 +1,4 @@
|
||||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
users.users.someone.packages = with pkgs; [
|
||||
# screenshot
|
||||
grim
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{pkgs}: {
|
||||
{}: {
|
||||
"XF86AudioPlay" = {
|
||||
_props.allow-when-locked = true;
|
||||
spawn._args = ["playerctl" "play-pause"];
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
users.users.someone.packages = [pkgs.ashell];
|
||||
|
||||
xdg.configFile."ashell/config.toml".text = ''
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
users.users.someone.packages = [pkgs.mako];
|
||||
|
||||
xdg.configFile."mako/config".text = ''
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
users.users.someone.packages = [pkgs.walker pkgs.elephant];
|
||||
|
||||
xdg.configFile."walker/config.toml".text = ''
|
||||
|
||||
@@ -1,8 +1,4 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
{pkgs, ...}: let
|
||||
alacritty-wrapped = pkgs.writeShellScriptBin "alacritty-wayland" ''
|
||||
export WAYLAND_DISPLAY="wayland-1"
|
||||
export XDG_CURRENT_DESKTOP="Niri"
|
||||
|
||||
@@ -2,9 +2,7 @@
|
||||
config,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
sshConfigFile = "ssh/config";
|
||||
in {
|
||||
}: {
|
||||
users.users.someone.packages = with pkgs; [
|
||||
openssh
|
||||
];
|
||||
|
||||
@@ -1,8 +1,4 @@
|
||||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
users.users.someone.packages = with pkgs; [
|
||||
# archives
|
||||
zip
|
||||
|
||||
+1
-1
@@ -159,7 +159,7 @@ in {
|
||||
${lib.concatStringsSep "\n" (
|
||||
lib.flatten (
|
||||
lib.mapAttrsToList (
|
||||
user: userCfg:
|
||||
_user: userCfg:
|
||||
(lib.mapAttrsToList (mkLinkScript cfg.configHome) userCfg.configFiles)
|
||||
++ (lib.mapAttrsToList (mkLinkScript cfg.cacheHome) userCfg.cacheFiles)
|
||||
++ (lib.mapAttrsToList (mkLinkScript cfg.dataHome) userCfg.dataFiles)
|
||||
|
||||
@@ -3,7 +3,6 @@
|
||||
inputs,
|
||||
lib,
|
||||
pkgs,
|
||||
self,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
imports = [
|
||||
./networking.nix
|
||||
./users.nix
|
||||
|
||||
@@ -2,9 +2,7 @@
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
boot = {
|
||||
loader = {
|
||||
grub = {
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
networking = {
|
||||
hostName = "debian-4gb-fsn1-1";
|
||||
domain = "severijnse.eu";
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = [
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
# NOTE: Caddy handles all TLS natively via its ACME integration.
|
||||
# This module is kept as a fallback for non-Caddy services.
|
||||
# Currently NOT imported in default.nix — uncomment there to activate.
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
{pkgs, ...}: let
|
||||
backupScript = pkgs.writeShellScript "weekly-backup" ''
|
||||
BACKUP_DIR="/home/admin/backups"
|
||||
SRC="/home/admin"
|
||||
|
||||
@@ -1,10 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
domain = "severijnse.eu";
|
||||
{...}: let
|
||||
antiScrape = ''
|
||||
@bad_bot {
|
||||
header_regexp User-Agent "(?i)(scrapy|cpython-requests|python-requests|curl|wget|go-http-client|ltx71|petalbot|bytespider|dotbot|ahrefsbot|semrushbot|mj12bot|dataforseo|facebookexternalhit|claudebot|anthropic-ai|perplexity|gptbot|chatgpt-user|omnisci|imgproxy|ccbot|exabot|360spider|baiduspider|sogou|duckduckgo|amazonbot|cohere-ai|diffbot|imagesiftbot).*"
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
{pkgs, ...}: let
|
||||
zoneFile = pkgs.writeText "severijnse.eu.db" ''
|
||||
$ORIGIN severijnse.eu.
|
||||
$TTL 3600
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
# Keep fail2ban as OCI container to preserve the web UI
|
||||
virtualisation.oci-containers.containers.fail2ban = {
|
||||
image = "crazymax/fail2ban:latest";
|
||||
|
||||
@@ -1,7 +1,5 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
unstablePkgs,
|
||||
...
|
||||
}: {
|
||||
@@ -98,8 +96,10 @@
|
||||
'';
|
||||
|
||||
# --- Gitea Actions self-hosted CI runner ---
|
||||
# Jobs install their own Nix inside the runner (official installer,
|
||||
# --no-daemon) so no system Nix daemon / nix-users group is needed.
|
||||
# The native runner only exposes `hostPackages` on PATH (see the list above),
|
||||
# which intentionally omits Nix. CI steps export the host's system Nix
|
||||
# (/run/current-system/sw/bin, i.e. Lix) onto PATH rather than installing a
|
||||
# second Nix client, so the running Lix daemon is used directly.
|
||||
# aarch64 builds run under QEMU user-emulation via boot.binfmt below.
|
||||
boot.binfmt.emulatedSystems = ["aarch64-linux"];
|
||||
}
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
virtualisation.oci-containers.containers.mailserver = {
|
||||
image = "ghcr.io/docker-mailserver/docker-mailserver:latest";
|
||||
autoStart = true;
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
virtualisation.oci-containers.containers = {
|
||||
hbbr = {
|
||||
image = "rustdesk/rustdesk-server:latest";
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
virtualisation.oci-containers.containers.shkeeper = {
|
||||
image = "vsyshost/shkeeper:2.5.29";
|
||||
autoStart = true;
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
virtualisation.oci-containers.containers.snappymail = {
|
||||
image = "djmaze/snappymail:latest";
|
||||
autoStart = true;
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: let
|
||||
{pkgs, ...}: let
|
||||
# Caddy's canonical certificate storage (XDG data dir). Renewals land here,
|
||||
# owned caddy:caddy 0600 — the mail server's non-root Postfix/Dovecot cannot
|
||||
# read it directly, so we copy it into a world-readable distribution dir.
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
virtualisation.oci-containers.containers.vaultwarden = {
|
||||
image = "vaultwarden/server:latest";
|
||||
autoStart = true;
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
virtualisation.oci-containers.containers.watchtower = {
|
||||
image = "ghcr.io/nicholas-fedor/watchtower:latest";
|
||||
autoStart = true;
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
virtualisation.oci-containers.containers.wg-easy = {
|
||||
image = "ghcr.io/wg-easy/wg-easy:latest";
|
||||
autoStart = true;
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{...}: {
|
||||
virtualisation.oci-containers.containers.wrxproxy = {
|
||||
image = "localhost/wrxproxy:latest";
|
||||
autoStart = false;
|
||||
|
||||
@@ -1,9 +1,4 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
time.timeZone = "Europe/Amsterdam";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
+1
-9
@@ -1,9 +1 @@
|
||||
# Ignore list for statix. `ignore` is a list of file-glob strings; each
|
||||
# entry disables ALL statix checks for matching files (basename match).
|
||||
# hardware-configuration.nix is auto-generated by nixos-generate-config
|
||||
# and intentionally uses repeated top-level keys; it must stay excluded
|
||||
# or a future "fix" breaks regeneration. Keep this entry in sync if more
|
||||
# generated hardware files appear.
|
||||
ignore = [
|
||||
"hardware-configuration.nix",
|
||||
]
|
||||
disabled = ["empty_pattern"]
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
boot = {
|
||||
|
||||
@@ -1,8 +1,4 @@
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
services = {
|
||||
printing = {
|
||||
enable = true;
|
||||
|
||||
Reference in New Issue
Block a user