init

11 files changed, 248 insertions, 0 deletions

diff --git a/.envrc b/.envrc
new file mode 100644
index 0000000..3550a30
--- /dev/null
+++ b/.envrc
@@ -0,0 +1 @@
+use flake
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b91777e
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,2 @@
+/.direnv
+/result
diff --git a/configuration.nix b/configuration.nix
new file mode 100644
index 0000000..f83f09a
--- /dev/null
+++ b/configuration.nix
@@ -0,0 +1,72 @@
+{ config, lib, pkgs, pkgs-unstable, ... }:
+
+{
+  imports =
+    [ 
+      ./hardware-configuration.nix
+      ./nginx.nix
+      ./miniflux.nix
+      ./linkding.nix
+    ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  nix.settings = {
+    experimental-features = [ "nix-command" "flakes" ];
+    trusted-users = [ "kassouni" ];
+  };
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  networking.hostName = "strength"; 
+
+  networking.networkmanager.enable = true;
+
+  networking.firewall = {
+    enable = true;
+    allowedTCPPorts = [ 80 443 ];
+  };
+
+  time.timeZone = "US/Pacific";
+
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "server";
+    extraSetFlags = [
+      "--advertise-exit-node"
+    ];
+    package = pkgs-unstable.tailscale;
+  };
+
+  users.users.kassouni = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    packages = with pkgs; [ neovim cowsay ];
+  }; 
+
+  services.openssh = {
+    enable = true;
+  };
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "26.05"; # Did you read the comment?
+
+}
+
diff --git a/flake.lock b/flake.lock
new file mode 100644
index 0000000..57cff96
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,44 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1780145889,
+        "narHash": "sha256-md0zn0RnwNvPyASas1yG5YUuwQ4ALA6ucL50l0DvqCo=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "8c50a710ddca43d7a530fb805ad55bde8d0141c5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1793540411,
+        "narHash": "sha256-fiPJ88izTVucjeo2EQ3jk4aWmLg03I1D4vxnX2QjEgE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "0bb2eedc20e4739f29e8045034f2828ad7054f8f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-unstable": "nixpkgs-unstable"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 0000000..acd0b17
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,25 @@
+{
+  description = "A very basic flake";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/26.05";
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+  };
+
+  outputs = inputs: let
+    pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux;
+  in {
+
+    nixosConfigurations.strength = inputs.nixpkgs.lib.nixosSystem {
+      specialArgs = {
+        inherit inputs;
+        pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.x86_64-linux;
+      };
+      modules = [ ./configuration.nix ];
+    };
+
+    devShells.x86_64-linux.default = pkgs.mkShell {
+      packages = [ pkgs.just ];
+    };
+  };
+}
diff --git a/hardware-configuration.nix b/hardware-configuration.nix
new file mode 100644
index 0000000..b94295f
--- /dev/null
+++ b/hardware-configuration.nix
@@ -0,0 +1,31 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/84ea039f-2164-4210-bf23-23515d6f7668";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/1753-8A2D";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}
diff --git a/justfile b/justfile
new file mode 100644
index 0000000..c125899
--- /dev/null
+++ b/justfile
@@ -0,0 +1,9 @@
+host := "kassouni@home.kassouni.net"
+config := "strength"
+
+deploy:
+    nixos-rebuild switch --flake .#{{config}} --target-host {{host}} --use-substitutes --sudo --ask-sudo-password
+
+ssh:
+    TERM=xterm ssh {{host}}
+
diff --git a/linkding.nix b/linkding.nix
new file mode 100644
index 0000000..056e00a
--- /dev/null
+++ b/linkding.nix
@@ -0,0 +1,19 @@
+{ config, ... }:
+let
+  domain = "links.home.kassouni.net";
+in
+{
+  services.linkding = {
+    enable = true;
+    environmentFile = "/var/lib/linkding/creds.env";
+    settings.LD_CSRF_TRUSTED_ORIGINS = "https://${domain}";
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    useACMEHost = "home.kassouni.net";
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString config.services.linkding.port}";
+    };
+  };
+}
diff --git a/miniflux.nix b/miniflux.nix
new file mode 100644
index 0000000..05c0968
--- /dev/null
+++ b/miniflux.nix
@@ -0,0 +1,23 @@
+{pkgs-unstable, ...}:
+let
+  domain = "miniflux.home.kassouni.net";
+in
+{
+  services.miniflux = {
+    enable = true;
+    package = pkgs-unstable.miniflux;
+    adminCredentialsFile = "/var/lib/miniflux/admin-credentials";
+    config = {
+      CREATE_ADMIN = true;
+      LISTEN_ADDR = "0.0.0.0:8080";
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    useACMEHost = "home.kassouni.net";
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8080";
+    };
+  };
+}
diff --git a/nginx.nix b/nginx.nix
new file mode 100644
index 0000000..2bc82c2
--- /dev/null
+++ b/nginx.nix
@@ -0,0 +1,18 @@
+{...}: {
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "alex@kassouni.net";
+    certs."home.kassouni.net" = {
+      dnsProvider = "cloudflare";
+      extraDomainNames = [ "*.home.kassouni.net" ];
+      environmentFile = "/var/lib/cloudflare/dns-01-challenge";
+      group = "nginx";
+    };
+  };
+}
diff --git a/syncthing.nix b/syncthing.nix
new file mode 100644
index 0000000..dcbef79
--- /dev/null
+++ b/syncthing.nix
@@ -0,0 +1,4 @@
+{...}: {
+  services.syncthing = {
+    enable = true;
+}