From 77c6d3ed9b773f29fa9a8825c73f549e21c600c2 Mon Sep 17 00:00:00 2001 From: Alexander Kassouni Date: Mon, 2 Nov 2026 21:23:02 -0800 Subject: init --- .envrc | 1 + .gitignore | 2 ++ configuration.nix | 72 ++++++++++++++++++++++++++++++++++++++++++++++ flake.lock | 44 ++++++++++++++++++++++++++++ flake.nix | 25 ++++++++++++++++ hardware-configuration.nix | 31 ++++++++++++++++++++ justfile | 9 ++++++ linkding.nix | 19 ++++++++++++ miniflux.nix | 23 +++++++++++++++ nginx.nix | 18 ++++++++++++ syncthing.nix | 4 +++ 11 files changed, 248 insertions(+) create mode 100644 .envrc create mode 100644 .gitignore create mode 100644 configuration.nix create mode 100644 flake.lock create mode 100644 flake.nix create mode 100644 hardware-configuration.nix create mode 100644 justfile create mode 100644 linkding.nix create mode 100644 miniflux.nix create mode 100644 nginx.nix create mode 100644 syncthing.nix diff --git a/.envrc b/.envrc new file mode 100644 index 0000000..3550a30 --- /dev/null +++ b/.envrc @@ -0,0 +1 @@ +use flake diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..b91777e --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +/.direnv +/result diff --git a/configuration.nix b/configuration.nix new file mode 100644 index 0000000..f83f09a --- /dev/null +++ b/configuration.nix @@ -0,0 +1,72 @@ +{ config, lib, pkgs, pkgs-unstable, ... }: + +{ + imports = + [ + ./hardware-configuration.nix + ./nginx.nix + ./miniflux.nix + ./linkding.nix + ]; + + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + nix.settings = { + experimental-features = [ "nix-command" "flakes" ]; + trusted-users = [ "kassouni" ]; + }; + + boot.kernelPackages = pkgs.linuxPackages_latest; + + networking.hostName = "strength"; + + networking.networkmanager.enable = true; + + networking.firewall = { + enable = true; + allowedTCPPorts = [ 80 443 ]; + }; + + time.timeZone = "US/Pacific"; + + services.tailscale = { + enable = true; + useRoutingFeatures = "server"; + extraSetFlags = [ + "--advertise-exit-node" + ]; + package = pkgs-unstable.tailscale; + }; + + users.users.kassouni = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + packages = with pkgs; [ neovim cowsay ]; + }; + + services.openssh = { + enable = true; + }; + + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "26.05"; # Did you read the comment? + +} + diff --git a/flake.lock b/flake.lock new file mode 100644 index 0000000..57cff96 --- /dev/null +++ b/flake.lock @@ -0,0 +1,44 @@ +{ + "nodes": { + "nixpkgs": { + "locked": { + "lastModified": 1780145889, + "narHash": "sha256-md0zn0RnwNvPyASas1yG5YUuwQ4ALA6ucL50l0DvqCo=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "8c50a710ddca43d7a530fb805ad55bde8d0141c5", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "26.05", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs-unstable": { + "locked": { + "lastModified": 1793540411, + "narHash": "sha256-fiPJ88izTVucjeo2EQ3jk4aWmLg03I1D4vxnX2QjEgE=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "0bb2eedc20e4739f29e8045034f2828ad7054f8f", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "root": { + "inputs": { + "nixpkgs": "nixpkgs", + "nixpkgs-unstable": "nixpkgs-unstable" + } + } + }, + "root": "root", + "version": 7 +} diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..acd0b17 --- /dev/null +++ b/flake.nix @@ -0,0 +1,25 @@ +{ + description = "A very basic flake"; + + inputs = { + nixpkgs.url = "github:nixos/nixpkgs/26.05"; + nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable"; + }; + + outputs = inputs: let + pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux; + in { + + nixosConfigurations.strength = inputs.nixpkgs.lib.nixosSystem { + specialArgs = { + inherit inputs; + pkgs-unstable = inputs.nixpkgs-unstable.legacyPackages.x86_64-linux; + }; + modules = [ ./configuration.nix ]; + }; + + devShells.x86_64-linux.default = pkgs.mkShell { + packages = [ pkgs.just ]; + }; + }; +} diff --git a/hardware-configuration.nix b/hardware-configuration.nix new file mode 100644 index 0000000..b94295f --- /dev/null +++ b/hardware-configuration.nix @@ -0,0 +1,31 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/84ea039f-2164-4210-bf23-23515d6f7668"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/1753-8A2D"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + + swapDevices = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/justfile b/justfile new file mode 100644 index 0000000..c125899 --- /dev/null +++ b/justfile @@ -0,0 +1,9 @@ +host := "kassouni@home.kassouni.net" +config := "strength" + +deploy: + nixos-rebuild switch --flake .#{{config}} --target-host {{host}} --use-substitutes --sudo --ask-sudo-password + +ssh: + TERM=xterm ssh {{host}} + diff --git a/linkding.nix b/linkding.nix new file mode 100644 index 0000000..056e00a --- /dev/null +++ b/linkding.nix @@ -0,0 +1,19 @@ +{ config, ... }: +let + domain = "links.home.kassouni.net"; +in +{ + services.linkding = { + enable = true; + environmentFile = "/var/lib/linkding/creds.env"; + settings.LD_CSRF_TRUSTED_ORIGINS = "https://${domain}"; + }; + + services.nginx.virtualHosts.${domain} = { + forceSSL = true; + useACMEHost = "home.kassouni.net"; + locations."/" = { + proxyPass = "http://127.0.0.1:${toString config.services.linkding.port}"; + }; + }; +} diff --git a/miniflux.nix b/miniflux.nix new file mode 100644 index 0000000..05c0968 --- /dev/null +++ b/miniflux.nix @@ -0,0 +1,23 @@ +{pkgs-unstable, ...}: +let + domain = "miniflux.home.kassouni.net"; +in +{ + services.miniflux = { + enable = true; + package = pkgs-unstable.miniflux; + adminCredentialsFile = "/var/lib/miniflux/admin-credentials"; + config = { + CREATE_ADMIN = true; + LISTEN_ADDR = "0.0.0.0:8080"; + }; + }; + + services.nginx.virtualHosts.${domain} = { + useACMEHost = "home.kassouni.net"; + forceSSL = true; + locations."/" = { + proxyPass = "http://127.0.0.1:8080"; + }; + }; +} diff --git a/nginx.nix b/nginx.nix new file mode 100644 index 0000000..2bc82c2 --- /dev/null +++ b/nginx.nix @@ -0,0 +1,18 @@ +{...}: { + services.nginx = { + enable = true; + recommendedProxySettings = true; + recommendedTlsSettings = true; + }; + + security.acme = { + acceptTerms = true; + defaults.email = "alex@kassouni.net"; + certs."home.kassouni.net" = { + dnsProvider = "cloudflare"; + extraDomainNames = [ "*.home.kassouni.net" ]; + environmentFile = "/var/lib/cloudflare/dns-01-challenge"; + group = "nginx"; + }; + }; +} diff --git a/syncthing.nix b/syncthing.nix new file mode 100644 index 0000000..dcbef79 --- /dev/null +++ b/syncthing.nix @@ -0,0 +1,4 @@ +{...}: { + services.syncthing = { + enable = true; +} -- cgit v1.3.1