flake: apply nixpkgs-fmt treewide
This commit is contained in:
parent
8c3d03e9cb
commit
b3c0bc9cb0
13 changed files with 279 additions and 276 deletions
|
@ -54,8 +54,8 @@
|
||||||
services.fail2ban.enable = true;
|
services.fail2ban.enable = true;
|
||||||
|
|
||||||
environment.etc."fail2ban/filter.d/nginx-url-probe.local".text = lib.mkDefault (lib.mkAfter ''
|
environment.etc."fail2ban/filter.d/nginx-url-probe.local".text = lib.mkDefault (lib.mkAfter ''
|
||||||
[Definition]
|
[Definition]
|
||||||
failregex = ^<HOST>.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git|notifications)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2})
|
failregex = ^<HOST>.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git|notifications)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2})
|
||||||
'');
|
'');
|
||||||
|
|
||||||
services.fail2ban.jails.nginx-url-probe.settings = {
|
services.fail2ban.jails.nginx-url-probe.settings = {
|
||||||
|
|
|
@ -3,7 +3,7 @@ let
|
||||||
directory = "/srv/postgresql";
|
directory = "/srv/postgresql";
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
persist.directories = [ { inherit directory; user = "postgres"; group = "postgresl"; } ];
|
persist.directories = [{ inherit directory; user = "postgres"; group = "postgresl"; }];
|
||||||
|
|
||||||
services.postgresql = {
|
services.postgresql = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
@ -27,7 +27,8 @@ let
|
||||||
websites = lib.genAttrs [
|
websites = lib.genAttrs [
|
||||||
"inx.moe"
|
"inx.moe"
|
||||||
"stickers.inx.moe"
|
"stickers.inx.moe"
|
||||||
] mkWebsite;
|
]
|
||||||
|
mkWebsite;
|
||||||
|
|
||||||
redirects = lib.mapAttrs mkRedirect {
|
redirects = lib.mapAttrs mkRedirect {
|
||||||
"nitter.inx.moe" = "twitter.com";
|
"nitter.inx.moe" = "twitter.com";
|
||||||
|
|
|
@ -36,8 +36,8 @@
|
||||||
services.fail2ban.enable = true;
|
services.fail2ban.enable = true;
|
||||||
|
|
||||||
environment.etc."fail2ban/filter.d/nginx-url-probe.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
|
environment.etc."fail2ban/filter.d/nginx-url-probe.local".text = pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
|
||||||
[Definition]
|
[Definition]
|
||||||
failregex = ^<HOST>.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git|notifications)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2})
|
failregex = ^<HOST>.*(GET /(wp-|admin|boaform|phpmyadmin|\.env|\.git|notifications)|\.(dll|so|cfm|asp)|(\?|&)(=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000|=PHPE9568F36-D428-11d2-A769-00AA001ACF42|=PHPE9568F35-D428-11d2-A769-00AA001ACF42|=PHPE9568F34-D428-11d2-A769-00AA001ACF42)|\\x[0-9a-zA-Z]{2})
|
||||||
'');
|
'');
|
||||||
|
|
||||||
services.fail2ban.jails.nginx-url-probe.settings = {
|
services.fail2ban.jails.nginx-url-probe.settings = {
|
||||||
|
|
115
lib/default.nix
115
lib/default.nix
|
@ -1,70 +1,71 @@
|
||||||
{ lib }:
|
{ lib }:
|
||||||
lib.makeExtensible (self:
|
lib.makeExtensible
|
||||||
with lib;
|
(self:
|
||||||
rec {
|
with lib;
|
||||||
flattenListSet = imports: (flatten (concatLists (attrValues imports)));
|
rec {
|
||||||
flattenSetList = attrSet: (mapAttrs (name: value: flatten value) attrSet);
|
flattenListSet = imports: (flatten (concatLists (attrValues imports)));
|
||||||
|
flattenSetList = attrSet: (mapAttrs (name: value: flatten value) attrSet);
|
||||||
|
|
||||||
# ["/home/user/" "/.screenrc"] -> ["home" "user" ".screenrc"]
|
# ["/home/user/" "/.screenrc"] -> ["home" "user" ".screenrc"]
|
||||||
splitPath = paths:
|
splitPath = paths:
|
||||||
(filter
|
(filter
|
||||||
(s: builtins.typeOf s == "string" && s != "")
|
(s: builtins.typeOf s == "string" && s != "")
|
||||||
(concatMap (builtins.split "/") paths)
|
(concatMap (builtins.split "/") paths)
|
||||||
);
|
);
|
||||||
|
|
||||||
# ["home" "user" ".screenrc"] -> "home/user/.screenrc"
|
# ["home" "user" ".screenrc"] -> "home/user/.screenrc"
|
||||||
dirListToPath = dirList: (concatStringsSep "/" dirList);
|
dirListToPath = dirList: (concatStringsSep "/" dirList);
|
||||||
|
|
||||||
# ["/home/user/" "/.screenrc"] -> "/home/user/.screenrc"
|
# ["/home/user/" "/.screenrc"] -> "/home/user/.screenrc"
|
||||||
concatPaths = paths:
|
concatPaths = paths:
|
||||||
let
|
let
|
||||||
prefix = optionalString (hasPrefix "/" (head paths)) "/";
|
prefix = optionalString (hasPrefix "/" (head paths)) "/";
|
||||||
path = dirListToPath (splitPath paths);
|
path = dirListToPath (splitPath paths);
|
||||||
in
|
in
|
||||||
prefix + path;
|
prefix + path;
|
||||||
|
|
||||||
sanitizeName = name:
|
sanitizeName = name:
|
||||||
replaceStrings
|
replaceStrings
|
||||||
[ "." ] [ "" ]
|
[ "." ] [ "" ]
|
||||||
(sanitizeDerivationName (removePrefix "/" name));
|
(sanitizeDerivationName (removePrefix "/" name));
|
||||||
|
|
||||||
mapGenAttrs = list: func: attrs:
|
mapGenAttrs = list: func: attrs:
|
||||||
lib.genAttrs list (name: func (if builtins.typeOf attrs == "lambda" then attrs name else attrs));
|
lib.genAttrs list (name: func (if builtins.typeOf attrs == "lambda" then attrs name else attrs));
|
||||||
|
|
||||||
dirsOf = dir: lib.attrNames (lib.filterAttrs (file: type: type == "directory") (builtins.readDir dir));
|
dirsOf = dir: lib.attrNames (lib.filterAttrs (file: type: type == "directory") (builtins.readDir dir));
|
||||||
|
|
||||||
# Only useful for functors
|
# Only useful for functors
|
||||||
recMap = f: list:
|
recMap = f: list:
|
||||||
if list == [ ] then f
|
if list == [ ] then f
|
||||||
else recMap (f (head list)) (tail list)
|
else recMap (f (head list)) (tail list)
|
||||||
;
|
;
|
||||||
|
|
||||||
chain = {
|
chain = {
|
||||||
func = id;
|
func = id;
|
||||||
__functor = self: input:
|
__functor = self: input:
|
||||||
if (typeOf input) == "lambda"
|
if (typeOf input) == "lambda"
|
||||||
then self // { func = e: input (self.func e); }
|
then self // { func = e: input (self.func e); }
|
||||||
else self.func input;
|
else self.func input;
|
||||||
};
|
};
|
||||||
|
|
||||||
spread = function: list: if list == [ ] then function else spread (function (head list)) (tail list);
|
spread = function: list: if list == [ ] then function else spread (function (head list)) (tail list);
|
||||||
|
|
||||||
# Takes a function and makes it lazy, by consuming arguments and applying it to the inner function first
|
# Takes a function and makes it lazy, by consuming arguments and applying it to the inner function first
|
||||||
# before calling the original function
|
# before calling the original function
|
||||||
lazy = func: inner: {
|
lazy = func: inner: {
|
||||||
inherit func;
|
inherit func;
|
||||||
app = inner;
|
app = inner;
|
||||||
__functor = self: input:
|
__functor = self: input:
|
||||||
let app = self.app input; in
|
let app = self.app input; in
|
||||||
if (typeOf app) == "lambda" then self // { inherit app; }
|
if (typeOf app) == "lambda" then self // { inherit app; }
|
||||||
else self.func app;
|
else self.func app;
|
||||||
};
|
};
|
||||||
} // (
|
} // (
|
||||||
import ./digga.nix { inherit lib; }
|
import ./digga.nix { inherit lib; }
|
||||||
) // (
|
) // (
|
||||||
import ./hosts.nix { inherit lib; }
|
import ./hosts.nix { inherit lib; }
|
||||||
) // (
|
) // (
|
||||||
import ./options.nix { inherit lib; }
|
import ./options.nix { inherit lib; }
|
||||||
)) // {
|
)) // {
|
||||||
disko = import ./disko.nix { inherit lib; };
|
disko = import ./disko.nix { inherit lib; };
|
||||||
}
|
}
|
||||||
|
|
|
@ -51,7 +51,7 @@ rec {
|
||||||
mkBtrfsSubvols' = mountOptions: mapAttrs (n: v: {
|
mkBtrfsSubvols' = mountOptions: mapAttrs (n: v: {
|
||||||
mountpoint = n;
|
mountpoint = n;
|
||||||
mountOptions = mountOptions ++ (optionals (v ? mountOptions) v.mountOptions);
|
mountOptions = mountOptions ++ (optionals (v ? mountOptions) v.mountOptions);
|
||||||
} // (removeAttrs v ["mountOptions"]));
|
} // (removeAttrs v [ "mountOptions" ]));
|
||||||
mkBtrfsSubvols = mkBtrfsSubvols' defaultMountOptions;
|
mkBtrfsSubvols = mkBtrfsSubvols' defaultMountOptions;
|
||||||
|
|
||||||
# ZFS
|
# ZFS
|
||||||
|
|
|
@ -32,7 +32,7 @@ let
|
||||||
within = "1d"; # Keep all archives from the last day
|
within = "1d"; # Keep all archives from the last day
|
||||||
daily = 7;
|
daily = 7;
|
||||||
weekly = 4;
|
weekly = 4;
|
||||||
monthly = -1; # Keep at least one archive for each month
|
monthly = -1; # Keep at least one archive for each month
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -50,7 +50,7 @@ in
|
||||||
enable = mkBoolOpt true;
|
enable = mkBoolOpt true;
|
||||||
userEnvironment = mkBoolOpt true;
|
userEnvironment = mkBoolOpt true;
|
||||||
repo = mkOpt str "rsync.net:backups/hosts";
|
repo = mkOpt str "rsync.net:backups/hosts";
|
||||||
excludes = mkOpt (attrsOf (listOf str)) {};
|
excludes = mkOpt (attrsOf (listOf str)) { };
|
||||||
extraExcludes = mkOpt (listOf str) [ ];
|
extraExcludes = mkOpt (listOf str) [ ];
|
||||||
backupTimes = mkOpt (attrsOf str) { };
|
backupTimes = mkOpt (attrsOf str) { };
|
||||||
jobs = mkOpt (attrsOf str) { };
|
jobs = mkOpt (attrsOf str) { };
|
||||||
|
|
|
@ -33,7 +33,8 @@ in
|
||||||
config = mkMerge [
|
config = mkMerge [
|
||||||
{
|
{
|
||||||
home.home.packages = with pkgs; [
|
home.home.packages = with pkgs; [
|
||||||
(mkIf cfg.prismlauncher.enable cfg.prismlauncher.package) alsa-oss
|
(mkIf cfg.prismlauncher.enable cfg.prismlauncher.package)
|
||||||
|
alsa-oss
|
||||||
(mkIf cfg.lutris.enable cfg.lutris.package)
|
(mkIf cfg.lutris.enable cfg.lutris.package)
|
||||||
(mkIf cfg.olympus.enable cfg.olympus.package)
|
(mkIf cfg.olympus.enable cfg.olympus.package)
|
||||||
(mkIf cfg.puzzles.enable cfg.puzzles.package)
|
(mkIf cfg.puzzles.enable cfg.puzzles.package)
|
||||||
|
|
|
@ -5,171 +5,171 @@ with lib;
|
||||||
let
|
let
|
||||||
cfg = config.services.matrix-conduit;
|
cfg = config.services.matrix-conduit;
|
||||||
|
|
||||||
format = pkgs.formats.toml {};
|
format = pkgs.formats.toml { };
|
||||||
configFile = format.generate "conduit.toml" cfg.settings;
|
configFile = format.generate "conduit.toml" cfg.settings;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
disabledModules = [ "services/matrix/conduit.nix" ];
|
disabledModules = [ "services/matrix/conduit.nix" ];
|
||||||
|
|
||||||
options.services.matrix-conduit = {
|
options.services.matrix-conduit = {
|
||||||
enable = mkEnableOption "matrix-conduit";
|
enable = mkEnableOption "matrix-conduit";
|
||||||
|
|
||||||
dataDir = mkOption {
|
dataDir = mkOption {
|
||||||
type = types.path;
|
type = types.path;
|
||||||
description = "The directory to store conduit data in";
|
description = "The directory to store conduit data in";
|
||||||
default = "/var/lib/matrix-conduit/";
|
default = "/var/lib/matrix-conduit/";
|
||||||
};
|
};
|
||||||
|
|
||||||
extraEnvironment = mkOption {
|
extraEnvironment = mkOption {
|
||||||
type = types.attrsOf types.str;
|
type = types.attrsOf types.str;
|
||||||
description = "Extra Environment variables to pass to the conduit server.";
|
description = "Extra Environment variables to pass to the conduit server.";
|
||||||
default = {};
|
default = { };
|
||||||
example = { RUST_BACKTRACE="yes"; };
|
example = { RUST_BACKTRACE = "yes"; };
|
||||||
};
|
};
|
||||||
|
|
||||||
package = mkPackageOption pkgs "matrix-conduit" { };
|
package = mkPackageOption pkgs "matrix-conduit" { };
|
||||||
|
|
||||||
settings = mkOption {
|
settings = mkOption {
|
||||||
type = types.submodule {
|
type = types.submodule {
|
||||||
freeformType = format.type;
|
freeformType = format.type;
|
||||||
options = {
|
options = {
|
||||||
global.server_name = mkOption {
|
global.server_name = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
example = "example.com";
|
example = "example.com";
|
||||||
description = "The server_name is the name of this server. It is used as a suffix for user # and room ids.";
|
description = "The server_name is the name of this server. It is used as a suffix for user # and room ids.";
|
||||||
};
|
};
|
||||||
global.port = mkOption {
|
global.port = mkOption {
|
||||||
type = types.port;
|
type = types.port;
|
||||||
default = 6167;
|
default = 6167;
|
||||||
description = "The port Conduit will be running on. You need to set up a reverse proxy in your web server (e.g. apache or nginx), so all requests to /_matrix on port 443 and 8448 will be forwarded to the Conduit instance running on this port";
|
description = "The port Conduit will be running on. You need to set up a reverse proxy in your web server (e.g. apache or nginx), so all requests to /_matrix on port 443 and 8448 will be forwarded to the Conduit instance running on this port";
|
||||||
};
|
};
|
||||||
global.max_request_size = mkOption {
|
global.max_request_size = mkOption {
|
||||||
type = types.ints.positive;
|
type = types.ints.positive;
|
||||||
default = 20000000;
|
default = 20000000;
|
||||||
description = "Max request size in bytes. Don't forget to also change it in the proxy.";
|
description = "Max request size in bytes. Don't forget to also change it in the proxy.";
|
||||||
};
|
};
|
||||||
global.allow_registration = mkOption {
|
global.allow_registration = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
description = "Whether new users can register on this server.";
|
description = "Whether new users can register on this server.";
|
||||||
};
|
};
|
||||||
global.allow_encryption = mkOption {
|
global.allow_encryption = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = true;
|
default = true;
|
||||||
description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
|
description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
|
||||||
};
|
};
|
||||||
global.allow_federation = mkOption {
|
global.allow_federation = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = true;
|
default = true;
|
||||||
description = ''
|
description = ''
|
||||||
Whether this server federates with other servers.
|
Whether this server federates with other servers.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
global.trusted_servers = mkOption {
|
global.trusted_servers = mkOption {
|
||||||
type = types.listOf types.str;
|
type = types.listOf types.str;
|
||||||
default = [ "matrix.org" ];
|
default = [ "matrix.org" ];
|
||||||
description = "Servers trusted with signing server keys.";
|
description = "Servers trusted with signing server keys.";
|
||||||
};
|
};
|
||||||
global.address = mkOption {
|
global.address = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = "::1";
|
default = "::1";
|
||||||
description = "Address to listen on for connections by the reverse proxy/tls terminator.";
|
description = "Address to listen on for connections by the reverse proxy/tls terminator.";
|
||||||
};
|
};
|
||||||
global.database_path = mkOption {
|
global.database_path = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
default = cfg.dataDir;
|
default = cfg.dataDir;
|
||||||
readOnly = true;
|
readOnly = true;
|
||||||
description = ''
|
description = ''
|
||||||
Path to the conduit database, the directory where conduit will save its data.
|
Path to the conduit database, the directory where conduit will save its data.
|
||||||
Note that due to using the DynamicUser feature of systemd, this value should not be changed
|
Note that due to using the DynamicUser feature of systemd, this value should not be changed
|
||||||
and is set to be read only.
|
and is set to be read only.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
global.database_backend = mkOption {
|
global.database_backend = mkOption {
|
||||||
type = types.enum [ "sqlite" "rocksdb" ];
|
type = types.enum [ "sqlite" "rocksdb" ];
|
||||||
default = "sqlite";
|
default = "sqlite";
|
||||||
example = "rocksdb";
|
example = "rocksdb";
|
||||||
description = ''
|
description = ''
|
||||||
The database backend for the service. Switching it on an existing
|
The database backend for the service. Switching it on an existing
|
||||||
instance will require manual migration of data.
|
instance will require manual migration of data.
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
global.allow_check_for_updates = mkOption {
|
global.allow_check_for_updates = mkOption {
|
||||||
type = types.bool;
|
type = types.bool;
|
||||||
default = false;
|
default = false;
|
||||||
description = ''
|
description = ''
|
||||||
Whether to allow Conduit to automatically contact
|
Whether to allow Conduit to automatically contact
|
||||||
<https://conduit.rs> hourly to check for important Conduit news.
|
<https://conduit.rs> hourly to check for important Conduit news.
|
||||||
|
|
||||||
Disabled by default because nixpkgs handles updates.
|
Disabled by default because nixpkgs handles updates.
|
||||||
'';
|
'';
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
default = {};
|
|
||||||
description = ''
|
|
||||||
Generates the conduit.toml configuration file. Refer to
|
|
||||||
<https://docs.conduit.rs/configuration.html>
|
|
||||||
for details on supported values.
|
|
||||||
Note that database_path can not be edited because the service's reliance on systemd StateDir.
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
|
default = { };
|
||||||
|
description = ''
|
||||||
|
Generates the conduit.toml configuration file. Refer to
|
||||||
|
<https://docs.conduit.rs/configuration.html>
|
||||||
|
for details on supported values.
|
||||||
|
Note that database_path can not be edited because the service's reliance on systemd StateDir.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
users.users.conduit = {
|
||||||
|
group = "conduit";
|
||||||
|
isSystemUser = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
users.groups.conduit = { };
|
||||||
users.users.conduit = {
|
|
||||||
|
systemd.tmpfiles.settings."10-conduit" = {
|
||||||
|
${cfg.dataDir}.d = {
|
||||||
|
user = "conduit";
|
||||||
group = "conduit";
|
group = "conduit";
|
||||||
isSystemUser = true;
|
mode = "0700";
|
||||||
};
|
|
||||||
|
|
||||||
users.groups.conduit = {};
|
|
||||||
|
|
||||||
systemd.tmpfiles.settings."10-conduit" = {
|
|
||||||
${cfg.dataDir}.d = {
|
|
||||||
user = "conduit";
|
|
||||||
group = "conduit";
|
|
||||||
mode = "0700";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.conduit = {
|
|
||||||
description = "Conduit Matrix Server";
|
|
||||||
documentation = [ "https://gitlab.com/famedly/conduit/" ];
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
environment = lib.mkMerge ([
|
|
||||||
{ CONDUIT_CONFIG = configFile; }
|
|
||||||
cfg.extraEnvironment
|
|
||||||
]);
|
|
||||||
serviceConfig = {
|
|
||||||
User = "conduit";
|
|
||||||
Group = "conduit";
|
|
||||||
LockPersonality = true;
|
|
||||||
MemoryDenyWriteExecute = true;
|
|
||||||
ProtectClock = true;
|
|
||||||
ProtectControlGroups = true;
|
|
||||||
ProtectHostname = true;
|
|
||||||
ProtectKernelLogs = true;
|
|
||||||
ProtectKernelModules = true;
|
|
||||||
ProtectKernelTunables = true;
|
|
||||||
PrivateDevices = true;
|
|
||||||
PrivateMounts = true;
|
|
||||||
PrivateUsers = true;
|
|
||||||
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
|
||||||
RestrictNamespaces = true;
|
|
||||||
RestrictRealtime = true;
|
|
||||||
SystemCallArchitectures = "native";
|
|
||||||
SystemCallFilter = [
|
|
||||||
"@system-service"
|
|
||||||
"~@privileged"
|
|
||||||
];
|
|
||||||
WorkingDirectory = cfg.dataDir;
|
|
||||||
ReadWritePaths = cfg.dataDir;
|
|
||||||
ExecStart = lib.getExe' cfg.package "conduit";
|
|
||||||
Restart = "on-failure";
|
|
||||||
RestartSec = 10;
|
|
||||||
StartLimitBurst = 5;
|
|
||||||
UMask = "077";
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
|
||||||
|
systemd.services.conduit = {
|
||||||
|
description = "Conduit Matrix Server";
|
||||||
|
documentation = [ "https://gitlab.com/famedly/conduit/" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
environment = lib.mkMerge ([
|
||||||
|
{ CONDUIT_CONFIG = configFile; }
|
||||||
|
cfg.extraEnvironment
|
||||||
|
]);
|
||||||
|
serviceConfig = {
|
||||||
|
User = "conduit";
|
||||||
|
Group = "conduit";
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
PrivateMounts = true;
|
||||||
|
PrivateUsers = true;
|
||||||
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = [
|
||||||
|
"@system-service"
|
||||||
|
"~@privileged"
|
||||||
|
];
|
||||||
|
WorkingDirectory = cfg.dataDir;
|
||||||
|
ReadWritePaths = cfg.dataDir;
|
||||||
|
ExecStart = lib.getExe' cfg.package "conduit";
|
||||||
|
Restart = "on-failure";
|
||||||
|
RestartSec = 10;
|
||||||
|
StartLimitBurst = 5;
|
||||||
|
UMask = "077";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
|
@ -77,7 +77,7 @@ in
|
||||||
ExecStart = "${cfg.package}/bin/jellyfin --datadir '${cfg.dataDir}' --cachedir '${cfg.cacheDir}' --logdir '${cfg.logDir}'";
|
ExecStart = "${cfg.package}/bin/jellyfin --datadir '${cfg.dataDir}' --cachedir '${cfg.cacheDir}' --logdir '${cfg.logDir}'";
|
||||||
Restart = "on-failure";
|
Restart = "on-failure";
|
||||||
TimeoutSec = 15;
|
TimeoutSec = 15;
|
||||||
SuccessExitStatus = ["0" "143"];
|
SuccessExitStatus = [ "0" "143" ];
|
||||||
|
|
||||||
# Security options:
|
# Security options:
|
||||||
NoNewPrivileges = true;
|
NoNewPrivileges = true;
|
||||||
|
@ -128,7 +128,7 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
users.groups = mkIf (cfg.group == "jellyfin") {
|
users.groups = mkIf (cfg.group == "jellyfin") {
|
||||||
jellyfin = {};
|
jellyfin = { };
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall = mkIf cfg.openFirewall {
|
networking.firewall = mkIf cfg.openFirewall {
|
||||||
|
|
|
@ -1,164 +1,164 @@
|
||||||
{
|
{
|
||||||
equatable = {
|
equatable = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "1sjm9zjakyixyvsqziikdrsqfzis6j3fq23crgjkp6fwkfgndj7x";
|
sha256 = "1sjm9zjakyixyvsqziikdrsqfzis6j3fq23crgjkp6fwkfgndj7x";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.5.0";
|
version = "0.5.0";
|
||||||
};
|
};
|
||||||
httpclient-fixcerts = {
|
httpclient-fixcerts = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "1zfszylh51y8ic8sbff3mwf30jb0gj270r5nxkcm1ydxad19w6sl";
|
sha256 = "1zfszylh51y8ic8sbff3mwf30jb0gj270r5nxkcm1ydxad19w6sl";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "2.8.5";
|
version = "2.8.5";
|
||||||
};
|
};
|
||||||
necromancer = {
|
necromancer = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "0v9nhdkv6zrp7cn48xv7n2vjhsbslpvs0ha36mfkcd56cp27pavz";
|
sha256 = "0v9nhdkv6zrp7cn48xv7n2vjhsbslpvs0ha36mfkcd56cp27pavz";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.4.0";
|
version = "0.4.0";
|
||||||
};
|
};
|
||||||
neocities = {
|
neocities = {
|
||||||
dependencies = ["httpclient-fixcerts" "pastel" "rake" "tty-prompt" "tty-table"];
|
dependencies = [ "httpclient-fixcerts" "pastel" "rake" "tty-prompt" "tty-table" ];
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "1hfvy4gc7rzxkgl2dbrjs2fqzi5mphmr22rjfhk6n0i3bd0wazbw";
|
sha256 = "1hfvy4gc7rzxkgl2dbrjs2fqzi5mphmr22rjfhk6n0i3bd0wazbw";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.0.18";
|
version = "0.0.18";
|
||||||
};
|
};
|
||||||
pastel = {
|
pastel = {
|
||||||
dependencies = ["equatable" "tty-color"];
|
dependencies = [ "equatable" "tty-color" ];
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "1yf30d9kzpm96gw9kwbv31p0qigwfykn8qdis5950plnzgc1vlp1";
|
sha256 = "1yf30d9kzpm96gw9kwbv31p0qigwfykn8qdis5950plnzgc1vlp1";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.7.2";
|
version = "0.7.2";
|
||||||
};
|
};
|
||||||
rake = {
|
rake = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "1cvaqarr1m84mhc006g3l1vw7sa5qpkcw0138lsxlf769zdllsgp";
|
sha256 = "1cvaqarr1m84mhc006g3l1vw7sa5qpkcw0138lsxlf769zdllsgp";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "12.3.3";
|
version = "12.3.3";
|
||||||
};
|
};
|
||||||
strings = {
|
strings = {
|
||||||
dependencies = ["strings-ansi" "unicode-display_width" "unicode_utils"];
|
dependencies = [ "strings-ansi" "unicode-display_width" "unicode_utils" ];
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "111876lcqrykh30w7zzkrl06d6rj9lq24y625m28674vgfxkkcz0";
|
sha256 = "111876lcqrykh30w7zzkrl06d6rj9lq24y625m28674vgfxkkcz0";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.1.8";
|
version = "0.1.8";
|
||||||
};
|
};
|
||||||
strings-ansi = {
|
strings-ansi = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "120wa6yjc63b84lprglc52f40hx3fx920n4dmv14rad41rv2s9lh";
|
sha256 = "120wa6yjc63b84lprglc52f40hx3fx920n4dmv14rad41rv2s9lh";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.2.0";
|
version = "0.2.0";
|
||||||
};
|
};
|
||||||
tty-color = {
|
tty-color = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "0zz5xa6xbrj69h334d8nx7z732fz80s1a0b02b53mim95p80s7bk";
|
sha256 = "0zz5xa6xbrj69h334d8nx7z732fz80s1a0b02b53mim95p80s7bk";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.4.3";
|
version = "0.4.3";
|
||||||
};
|
};
|
||||||
tty-cursor = {
|
tty-cursor = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "07whfm8mnp7l49s2cm2qy1snhsqq3a90sqwb71gvym4hm2kx822a";
|
sha256 = "07whfm8mnp7l49s2cm2qy1snhsqq3a90sqwb71gvym4hm2kx822a";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.4.0";
|
version = "0.4.0";
|
||||||
};
|
};
|
||||||
tty-prompt = {
|
tty-prompt = {
|
||||||
dependencies = ["necromancer" "pastel" "tty-cursor" "wisper"];
|
dependencies = [ "necromancer" "pastel" "tty-cursor" "wisper" ];
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "1026nyqhgmgxi2nmk8xk3hca07gy5rpisjs8y6w00wnw4f01kpv0";
|
sha256 = "1026nyqhgmgxi2nmk8xk3hca07gy5rpisjs8y6w00wnw4f01kpv0";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.12.0";
|
version = "0.12.0";
|
||||||
};
|
};
|
||||||
tty-screen = {
|
tty-screen = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "0azpjgyhdm8ycblnx9crq3dgb2x8yg454a13n60zfpsc0n138sw1";
|
sha256 = "0azpjgyhdm8ycblnx9crq3dgb2x8yg454a13n60zfpsc0n138sw1";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.6.5";
|
version = "0.6.5";
|
||||||
};
|
};
|
||||||
tty-table = {
|
tty-table = {
|
||||||
dependencies = ["equatable" "necromancer" "pastel" "strings" "tty-screen"];
|
dependencies = [ "equatable" "necromancer" "pastel" "strings" "tty-screen" ];
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "05krrj1x5pmfbz74paszrsr1316w9b9jlc4wpd9s9gpzqfzwjzcg";
|
sha256 = "05krrj1x5pmfbz74paszrsr1316w9b9jlc4wpd9s9gpzqfzwjzcg";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "0.10.0";
|
version = "0.10.0";
|
||||||
};
|
};
|
||||||
unicode-display_width = {
|
unicode-display_width = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "1204c1jx2g89pc25qk5150mk7j5k90692i7ihgfzqnad6qni74h2";
|
sha256 = "1204c1jx2g89pc25qk5150mk7j5k90692i7ihgfzqnad6qni74h2";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "1.8.0";
|
version = "1.8.0";
|
||||||
};
|
};
|
||||||
unicode_utils = {
|
unicode_utils = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "0h1a5yvrxzlf0lxxa1ya31jcizslf774arnsd89vgdhk4g7x08mr";
|
sha256 = "0h1a5yvrxzlf0lxxa1ya31jcizslf774arnsd89vgdhk4g7x08mr";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
version = "1.4.0";
|
version = "1.4.0";
|
||||||
};
|
};
|
||||||
wisper = {
|
wisper = {
|
||||||
groups = ["default"];
|
groups = [ "default" ];
|
||||||
platforms = [];
|
platforms = [ ];
|
||||||
source = {
|
source = {
|
||||||
remotes = ["https://rubygems.org"];
|
remotes = [ "https://rubygems.org" ];
|
||||||
sha256 = "19bw0z1qw1dhv7gn9lad25hgbgpb1bkw8d599744xdfam158ms2s";
|
sha256 = "19bw0z1qw1dhv7gn9lad25hgbgpb1bkw8d599744xdfam158ms2s";
|
||||||
type = "gem";
|
type = "gem";
|
||||||
};
|
};
|
||||||
|
|
|
@ -13,7 +13,7 @@ let
|
||||||
Infini-OPTIPLEX = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEG8fY684SPKeOUsJqaV6LJwwztWxztaU9nAHPBxBtyU root@Infini-OPTIPLEX";
|
Infini-OPTIPLEX = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEG8fY684SPKeOUsJqaV6LJwwztWxztaU9nAHPBxBtyU root@Infini-OPTIPLEX";
|
||||||
Infini-STICK = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMCg81G/oysjFkHXo1E9XPGoULpv9rR0HyWoR2wIcl6C root@Infini-STICK";
|
Infini-STICK = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMCg81G/oysjFkHXo1E9XPGoULpv9rR0HyWoR2wIcl6C root@Infini-STICK";
|
||||||
Infini-SD = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO8oViHNz64NG51uyll/q/hrSGwoHRgvYI3luD/IWTUT root@Infini-SD";
|
Infini-SD = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO8oViHNz64NG51uyll/q/hrSGwoHRgvYI3luD/IWTUT root@Infini-SD";
|
||||||
Infini-DL360 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPjmvE76BcPwZSjeNGzlguDQC67Yxa3uyOf5ZmVDWNys root@Infini-DL360";
|
Infini-DL360 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPjmvE76BcPwZSjeNGzlguDQC67Yxa3uyOf5ZmVDWNys root@Infini-DL360";
|
||||||
};
|
};
|
||||||
users = {
|
users = {
|
||||||
infinidoge = import ../users/infinidoge/ssh-keys.nix;
|
infinidoge = import ../users/infinidoge/ssh-keys.nix;
|
||||||
|
|
|
@ -5,5 +5,5 @@
|
||||||
openssh.authorizedKeys.keys = import ./ssh-keys.nix;
|
openssh.authorizedKeys.keys = import ./ssh-keys.nix;
|
||||||
};
|
};
|
||||||
|
|
||||||
home-manager.users.root = { ... }: {};
|
home-manager.users.root = { ... }: { };
|
||||||
}
|
}
|
||||||
|
|
Loading…
Add table
Add a link
Reference in a new issue