cschmatzler/nixos-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

up

Browse Source
This commit is contained in:
Christoph Schmatzler
2025-08-14 09:09:56 +02:00
parent c1fcf33afa
commit 2926d7412b
7 changed files with 377 additions and 364 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
flake.lock generated
View File

@@ -100,11 +100,11 @@
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1755107032,
"narHash": "sha256-ckb/RX9rJ/FslBA3K4hYAXgVW/7JdQ50Z+28XZT96zg=",
"lastModified": 1755121891,
"narHash": "sha256-UtYkukiGnPRJ5rpd4W/wFVrLMh8fqtNkqHTPgHEtrqU=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "4b6dd06c6a92308c06da5e0e55f2c505237725c9",
"rev": "279ca5addcdcfa31ac852b3ecb39fc372684f426",
"type": "github"
},
"original": {
@@ -132,11 +132,11 @@
"homebrew-cask": {
"flake": false,
"locked": {
"lastModified": 1755104931,
"narHash": "sha256-jtXcymAnYH/hCvEGaUlt5vpFwqx00/r5Wly9UCqy7vQ=",
"lastModified": 1755147939,
"narHash": "sha256-PD93pCq6q6xtWxtFwK9WCugELrcy50Om7/VLgpV0raM=",
"owner": "homebrew",
"repo": "homebrew-cask",
"rev": "53dc289ce38d2561d853b482d0f03914a7f2f985",
"rev": "5fd00a85f58743b2ac654bfbdda762b8e7d4fbcb",
"type": "github"
},
"original": {
@@ -148,11 +148,11 @@
"homebrew-core": {
"flake": false,
"locked": {
"lastModified": 1755104716,
"narHash": "sha256-6jp9InEQfaVJR4kSdwb0+D6603DanSUEFF3uYYPIQVM=",
"lastModified": 1755152577,
"narHash": "sha256-ix1DIoJEn4V0dOErK12AkIL/iPHtGmGR+/HjyNLwnXQ=",
"owner": "homebrew",
"repo": "homebrew-core",
"rev": "8aa4cd22422bcb03de07c08c24773257d928e988",
"rev": "b3da0366f58c2f89d8c0d1cabdc7cd5bdc732313",
"type": "github"
},
"original": {
@@ -240,11 +240,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1755109924,
"narHash": "sha256-2xroOWuRFMLvqknLQJ8gmpdXuvg9t5qDUJ3KQKq5/GE=",
"lastModified": 1755154419,
"narHash": "sha256-m8tJUveXe6y73A2wvXRomSC5WwBsNfLgZI3qteAAqyU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "b7f46264dd0a1891d52c9a8b919c2eebbc527638",
"rev": "1a58620315b9d6d3c8110ec35ee46bbacb2fe633",
"type": "github"
},
"original": {

5
flake.nix
View File

@@ -43,8 +43,7 @@
];
flake.darwinConfigurations = inputs.nixpkgs.lib.genAttrs darwinHosts (
hostname:
let
hostname: let
syncthingOverlay = import ./overlays/syncthing-darwin.nix;
syncthingModule = (syncthingOverlay null {}).darwinSyncthingModule;
in
@@ -61,7 +60,7 @@
syncthingModule
{
nixpkgs.overlays = [ syncthingOverlay ];
nixpkgs.overlays = [syncthingOverlay];
nix-homebrew = {
inherit user;

5
hosts/darwin/jason/default.nix
View File

@@ -1,7 +1,4 @@
{
user,
...
}: {
{user, ...}: {
imports = [
../shared.nix
];

1
hosts/nixos/tahani/default.nix
View File

@@ -65,7 +65,6 @@
};
};
services.postgresql = {
enable = true;
package = pkgs.postgresql_17;

14
modules/networking/tailscale.nix
View File

@@ -1,10 +1,14 @@
{ pkgs, lib, ... }:
{
services.tailscale = {
pkgs,
lib,
...
}: {
services.tailscale =
{
enable = true;
} // lib.optionalAttrs pkgs.stdenv.isLinux {
useRoutingFeatures = "server";
}
// lib.optionalAttrs pkgs.stdenv.isLinux {
openFirewall = true;
useRoutingFeatures = "server";
};
}

98
overlays/syncthing-darwin.nix
View File

@@ -1,12 +1,16 @@
final: prev: {
darwinSyncthingModule = { config, lib, pkgs, ... }:
with lib;
let
darwinSyncthingModule = {
config,
lib,
pkgs,
...
}:
with lib; let
cfg = config.services.syncthing;
defaultUser = "syncthing";
defaultGroup = defaultUser;
settingsFormat = pkgs.formats.json { };
cleanedConfig = converge (filterAttrsRecursive (_: v: v != null && v != { })) cfg.settings;
settingsFormat = pkgs.formats.json {};
cleanedConfig = converge (filterAttrsRecursive (_: v: v != null && v != {})) cfg.settings;
isUnixGui = (builtins.substring 0 1 cfg.guiAddress) == "/";
@@ -15,21 +19,24 @@ final: prev: {
then "--unix-socket ${cfg.guiAddress} http://.${path}"
else "${cfg.guiAddress}${path}";
devices = mapAttrsToList (_: device: device // { deviceID = device.id; }) cfg.settings.devices;
devices = mapAttrsToList (_: device: device // {deviceID = device.id;}) cfg.settings.devices;
anyAutoAccept = builtins.any (dev: dev.autoAcceptFolders) devices;
folders = mapAttrsToList (_: folder: folder // {
folders = mapAttrsToList (_: folder:
folder
// {
devices = let
folderDevices = folder.devices;
in
map (device:
if builtins.isString device then
{ deviceId = cfg.settings.devices.${device}.id; }
else if builtins.isAttrs device then
{ deviceId = cfg.settings.devices.${device.name}.id; } // device
else
throw "Invalid type for devices in folder; expected list or attrset."
) folderDevices;
map (
device:
if builtins.isString device
then {deviceId = cfg.settings.devices.${device}.id;}
else if builtins.isAttrs device
then {deviceId = cfg.settings.devices.${device.name}.id;} // device
else throw "Invalid type for devices in folder; expected list or attrset."
)
folderDevices;
}) (filterAttrs (_: folder: folder.enable) cfg.settings.folders);
jq = "${pkgs.jq}/bin/jq";
@@ -67,15 +74,17 @@ final: prev: {
baseAddress = curlAddressArgs "/rest/config/folders";
};
} [
(mapAttrs (conf_type: s:
(mapAttrs (
conf_type: s:
lib.pipe s.conf [
(map (new_cfg:
let
(map (
new_cfg: let
jsonPreSecretsFile = pkgs.writeTextFile {
name = "${conf_type}-${new_cfg.id}-conf-pre-secrets.json";
text = builtins.toJSON new_cfg;
};
injectSecretsJqCmd = {
injectSecretsJqCmd =
{
"devs" = "${jq} .";
"dirs" = let
folder = new_cfg;
@@ -87,7 +96,8 @@ final: prev: {
secretPath = device.encryptionPasswordFile;
}))
];
jqUpdates = map (device: ''
jqUpdates =
map (device: ''
.devices[] |= (
if .deviceId == "${device.deviceId}" then
del(.encryptionPasswordFile) |
@@ -96,13 +106,14 @@ final: prev: {
.
end
)
'') devicesWithSecrets;
'')
devicesWithSecrets;
jqRawFiles = map (device: "--rawfile ${device.variableName} ${lib.escapeShellArg device.secretPath}") devicesWithSecrets;
in
"${jq} ${lib.concatStringsSep " " jqRawFiles} ${lib.escapeShellArg (lib.concatStringsSep "|" ([ "." ] ++ jqUpdates))}";
}.${conf_type};
in
''
in "${jq} ${lib.concatStringsSep " " jqRawFiles} ${lib.escapeShellArg (lib.concatStringsSep "|" (["."] ++ jqUpdates))}";
}.${
conf_type
};
in ''
${injectSecretsJqCmd} ${jsonPreSecretsFile} | curl --json @- -X POST ${s.baseAddress}
''
))
@@ -125,7 +136,7 @@ final: prev: {
])
+ (lib.pipe cleanedConfig [
builtins.attrNames
(lib.subtractLists [ "folders" "devices" ])
(lib.subtractLists ["folders" "devices"])
(map (subOption: ''
curl -X PUT -d ${lib.escapeShellArg (builtins.toJSON cleanedConfig.${subOption})} ${curlAddressArgs "/rest/config/${subOption}"}
''))
@@ -138,8 +149,7 @@ final: prev: {
fi
''
);
in
{
in {
options = {
services.syncthing = {
enable = mkEnableOption "Syncthing, a self-hosted open-source alternative to Dropbox and Bittorrent Sync";
@@ -173,7 +183,7 @@ final: prev: {
freeformType = settingsFormat.type;
options = {
options = mkOption {
default = { };
default = {};
description = "The options element contains all other global configuration options";
type = types.submodule {
freeformType = settingsFormat.type;
@@ -203,9 +213,9 @@ final: prev: {
};
devices = mkOption {
default = { };
default = {};
description = "Peers/devices which Syncthing should communicate with.";
type = types.attrsOf (types.submodule ({ name, ... }: {
type = types.attrsOf (types.submodule ({name, ...}: {
freeformType = settingsFormat.type;
options = {
name = mkOption {
@@ -227,9 +237,9 @@ final: prev: {
};
folders = mkOption {
default = { };
default = {};
description = "Folders which should be shared by Syncthing.";
type = types.attrsOf (types.submodule ({ name, ... }: {
type = types.attrsOf (types.submodule ({name, ...}: {
freeformType = settingsFormat.type;
options = {
enable = mkOption {
@@ -253,7 +263,7 @@ final: prev: {
description = "The label of the folder.";
};
type = mkOption {
type = types.enum [ "sendreceive" "sendonly" "receiveonly" "receiveencrypted" ];
type = types.enum ["sendreceive" "sendonly" "receiveonly" "receiveencrypted"];
default = "sendreceive";
description = "Controls how the folder is handled by Syncthing.";
};
@@ -275,7 +285,7 @@ final: prev: {
};
})
]);
default = [ ];
default = [];
description = "The devices this folder should be shared with.";
};
};
@@ -283,7 +293,7 @@ final: prev: {
};
};
};
default = { };
default = {};
description = "Extra configuration options for Syncthing.";
};
@@ -323,7 +333,7 @@ final: prev: {
description = "Whether to open the default ports in the firewall (not applicable on Darwin).";
};
package = mkPackageOption pkgs "syncthing" { };
package = mkPackageOption pkgs "syncthing" {};
};
};
@@ -335,14 +345,18 @@ final: prev: {
}
];
environment.systemPackages = [ cfg.package ];
environment.systemPackages = [cfg.package];
launchd.user.agents.syncthing = {
serviceConfig = {
ProgramArguments = [
"${cfg.package}/bin/syncthing"
"-no-browser"
"-gui-address=${if isUnixGui then "unix://" else ""}${cfg.guiAddress}"
"-gui-address=${
if isUnixGui
then "unix://"
else ""
}${cfg.guiAddress}"
"-config=${cfg.configDir}"
"-data=${cfg.configDir}"
];
@@ -358,9 +372,9 @@ final: prev: {
};
};
launchd.user.agents.syncthing-init = mkIf (cleanedConfig != { }) {
launchd.user.agents.syncthing-init = mkIf (cleanedConfig != {}) {
serviceConfig = {
ProgramArguments = [ "${updateConfig}" ];
ProgramArguments = ["${updateConfig}"];
RunAtLoad = true;
KeepAlive = false;
ProcessType = "Background";