L-Nafaryus/bonfire
L-Nafaryus/bonfire
1
0
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects 4 Releases Wiki Activity

Compare commits

base: L-Nafaryus:42d160ad0333bc02405b19ee180a25e42db9fc94
Branches Tags
L-Nafaryus:master
L-Nafaryus:devel
L-Nafaryus:catarina-radio-service
L-Nafaryus:packages-onetagger
L-Nafaryus:packages-wezterm
...
compare: L-Nafaryus:25a4c9af9c47a563aef24fbe4acd98b1a2273a2c
Branches Tags
L-Nafaryus:devel
L-Nafaryus:master
L-Nafaryus:catarina-radio-service
L-Nafaryus:packages-onetagger
L-Nafaryus:packages-wezterm

2 Commits
42d160ad03 ... 25a4c9af9c

Author SHA1 Message Date
L-Nafaryus
25a4c9af9c
flake: update lock
All checks were successful
nix / check (push) Successful in 2m59s
Details 
astora: exclude hyprland and some tools for kde expansion
lib.preconfiguredModules: common nixos configurations
lib.preconfiguredModules.bonvim: change python tool set, remove
deprecations
packages.wezterm: exclude from evaluation [see #8]
nixosModules.zapret: exclude from evaluation [see #9]
 2024-11-03 19:06:04 +05:00
L-Nafaryus
1c09a25ff6
minimizing nixosConfigurations 2024-10-21 23:22:53 +05:00
17 changed files with 481 additions and 422 deletions
Show Stats Expand all files Collapse all files

2
devShells/default.nix
View File

@ -30,4 +30,6 @@ in
rust-x11 = import ./rust-x11.nix environment;
go = import ./go.nix environment;
python-uv = import ./python-uv.nix environment;
})

8
devShells/python-uv.nix Normal file
View File

@ -0,0 +1,8 @@
{pkgs, ...}:
pkgs.mkShellNoCC {
packages = with pkgs; [
uv
curl
jq
];
}

89
flake.lock generated
View File

@ -55,11 +55,11 @@
},
"catppuccin": {
"locked": {
"lastModified": 1728407414,
"narHash": "sha256-B8LaxUP93eh+it8RW1pGq4SsU2kj7f0ipzFuhBvpON8=",
"lastModified": 1730458408,
"narHash": "sha256-JQ+SphQn13bdibKUrBBBznYehXX4xJrxD1ifBp6vSWw=",
"owner": "catppuccin",
"repo": "nix",
"rev": "96cf8b4a05fb23a53c027621b1147b5cf9e5439f",
"rev": "191fbf2d81a63fad8f62f1233c0051f09b75d0ad",
"type": "github"
},
"original": {
@ -70,11 +70,11 @@
},
"crane": {
"locked": {
"lastModified": 1728344376,
"narHash": "sha256-lxTce2XE6mfJH8Zk6yBbqsbu9/jpwdymbSH5cCbiVOA=",
"lastModified": 1730504891,
"narHash": "sha256-Fvieht4pai+Wey7terllZAKOj0YsaDP0e88NYs3K/Lo=",
"owner": "ipetkov",
"repo": "crane",
"rev": "fd86b78f5f35f712c72147427b1eb81a9bd55d0b",
"rev": "8658adcdad49b8f2c6cbf0cc3cb4b4db988f7638",
"type": "github"
},
"original": {
@ -178,11 +178,11 @@
"rust-analyzer-src": []
},
"locked": {
"lastModified": 1728628307,
"narHash": "sha256-GRMRHZyU+R0RqKPFFgi7BBMDIRFPnHaAhOIxlqyvbZQ=",
"lastModified": 1730529264,
"narHash": "sha256-5gC0y6cKXKQvumK4jOhKyjVsYqQ7EOcWKNtKB8UiP74=",
"owner": "nix-community",
"repo": "fenix",
"rev": "b0a014d5b9dba793ebc205bcf12a93b5f6a4c66c",
"rev": "fff718e230e40b8202d7be6223c13492bb0010a8",
"type": "github"
},
"original": {
@ -321,11 +321,11 @@
]
},
"locked": {
"lastModified": 1728598744,
"narHash": "sha256-sSfvyO5xH3HObHHmh6lp/hcvo7tMjFKd/HXpxyrRnoE=",
"lastModified": 1730490306,
"narHash": "sha256-AvCVDswOUM9D368HxYD25RsSKp+5o0L0/JHADjLoD38=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "342a1d682386d3a1d74f9555cb327f2f311dda6e",
"rev": "1743615b61c7285976f85b303a36cdf88a556503",
"type": "github"
},
"original": {
@ -334,6 +334,34 @@
"type": "github"
}
},
"ixx": {
"inputs": {
"flake-utils": [
"nixvim",
"nuschtosSearch",
"flake-utils"
],
"nixpkgs": [
"nixvim",
"nuschtosSearch",
"nixpkgs"
]
},
"locked": {
"lastModified": 1729544999,
"narHash": "sha256-YcyJLvTmN6uLEBGCvYoMLwsinblXMkoYkNLEO4WnKus=",
"owner": "NuschtOS",
"repo": "ixx",
"rev": "65c207c92befec93e22086da9456d3906a4e999c",
"type": "github"
},
"original": {
"owner": "NuschtOS",
"ref": "v0.0.5",
"repo": "ixx",
"type": "github"
}
},
"libpng": {
"flake": false,
"locked": {
@ -406,11 +434,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1728492678,
"narHash": "sha256-9UTxR8eukdg+XZeHgxW5hQA9fIKHsKCdOIUycTryeVw=",
"lastModified": 1730200266,
"narHash": "sha256-l253w0XMT8nWHGXuXqyiIC/bMvh1VRszGXgdpQlfhvU=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "5633bcff0c6162b9e4b5f1264264611e950c8ec7",
"rev": "807e9154dcb16384b1b765ebe9cd2bba2ac287fd",
"type": "github"
},
"original": {
@ -437,11 +465,11 @@
},
"nixpkgs-stable": {
"locked": {
"lastModified": 1728156290,
"narHash": "sha256-uogSvuAp+1BYtdu6UWuObjHqSbBohpyARXDWqgI12Ss=",
"lastModified": 1729973466,
"narHash": "sha256-knnVBGfTCZlQgxY1SgH0vn2OyehH9ykfF8geZgS95bk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "17ae88b569bb15590549ff478bab6494dde4a907",
"rev": "cd3e8833d70618c4eea8df06f95b364b016d4950",
"type": "github"
},
"original": {
@ -482,11 +510,11 @@
"treefmt-nix": []
},
"locked": {
"lastModified": 1728593423,
"narHash": "sha256-xM3+7mvWwM5i+RXD97wQ/fSoQDFidVxNszIfKIv9msE=",
"lastModified": 1730499477,
"narHash": "sha256-olt0Sx4alDxv3ko9BgbV3SsE2KQ/Tf0/Az1Fr9s2Y6U=",
"owner": "nix-community",
"repo": "nixvim",
"rev": "af650ba9401501352d6eaaced192bbb4abfaec87",
"rev": "356896f58dde22ee16481b7c954e340dceec340d",
"type": "github"
},
"original": {
@ -498,17 +526,18 @@
"nuschtosSearch": {
"inputs": {
"flake-utils": "flake-utils",
"ixx": "ixx",
"nixpkgs": [
"nixvim",
"nixpkgs"
]
},
"locked": {
"lastModified": 1728513479,
"narHash": "sha256-yAR9M1jvuAoahYNxo3RNnPMcua1TAIPurFKmH2/g3lg=",
"lastModified": 1730337772,
"narHash": "sha256-uTxvqDohfG85+zldO5Tf1B+fuAF8ZhMouNwG5S6OAnA=",
"owner": "NuschtOS",
"repo": "search",
"rev": "5cb7ef512ec20a5b7d60fc70dba014560559698a",
"rev": "4e0a7a95a3df3333771abc4df6a656e7baf67106",
"type": "github"
},
"original": {
@ -669,11 +698,11 @@
"nixpkgs-stable": "nixpkgs-stable"
},
"locked": {
"lastModified": 1728345710,
"narHash": "sha256-lpunY1+bf90ts+sA2/FgxVNIegPDKCpEoWwOPu4ITTQ=",
"lastModified": 1729999681,
"narHash": "sha256-qm0uCtM9bg97LeJTKQ8dqV/FvqRN+ompyW4GIJruLuw=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "06535d0e3d0201e6a8080dd32dbfde339b94f01b",
"rev": "1666d16426abe79af5c47b7c0efa82fd31bf4c56",
"type": "github"
},
"original": {
@ -741,11 +770,11 @@
},
"locked": {
"dir": "nix",
"lastModified": 1728322634,
"narHash": "sha256-cUnwLCSc59Sx3E+meVlVUMfyROr0aToWPID7UA6PZvg=",
"lastModified": 1730443872,
"narHash": "sha256-dQG+9b/EUn+UWDjDSsje19hn3DxiDOzSGmIwsSGdqDA=",
"owner": "wez",
"repo": "wezterm",
"rev": "ed430415ee69279ea692358525196ad7d4c965b8",
"rev": "0983ae90d6dfb45c5f99058e97de73a70ca9dd36",
"type": "github"
},
"original": {

1
lib/default.nix
View File

@ -17,6 +17,7 @@
[
./preconfiguredModules/bonvim.nix
./preconfiguredModules/homeManager
./preconfiguredModules/nixos
#(import ./preconfiguredModules/bonvim.nix)
#(import ./preconfiguredModules/homeManager {inherit lib inputs;})
]);

32
lib/preconfiguredModules/bonvim.nix
View File

@ -152,13 +152,15 @@
# UI
plugins.noice = {
enable = true;
lsp.override = {
"cmp.entry.get_documentation" = true;
"vim.lsp.util.convert_input_to_markdown_lines" = true;
"vim.lsp.util.stylize_markdown" = true;
};
presets = {
long_message_to_split = true;
settings = {
lsp.override = {
"cmp.entry.get_documentation" = true;
"vim.lsp.util.convert_input_to_markdown_lines" = true;
"vim.lsp.util.stylize_markdown" = true;
};
presets = {
long_message_to_split = true;
};
};
};
@ -365,14 +367,16 @@
};
cmake.enable = true;
nil_ls.enable = true;
pyright.enable = true;
ruff.enable = true;
# pylyzer.enable = true; # not working with virtual environments currently :(
pylsp = {
enable = true; # https://github.com/nix-community/nixvim/pull/1893
settings.plugins = {
pyflakes.enabled = true;
black.enabled = true;
};
};
#pylsp = {
# enable = true; # https://github.com/nix-community/nixvim/pull/1893
# settings.plugins = {
# pyflakes.enabled = true;
# black.enabled = true;
# };
#};
rust_analyzer = {
enable = true;
package = rust-analyzer;

14
lib/preconfiguredModules/homeManager/default.nix
View File

@ -1,20 +1,6 @@
#{
# lib,
# inputs,
# ...
#}:
{
ags = import ./ags;
hyprland = import ./hyprland.nix;
hypridle = import ./hypridle.nix;
hyprlock = import ./hyprlock.nix;
#hyprland =
# (lib.evalModules {
# modules = [
# inputs.home-manager.nixosModules.home-manager
# ./hyprland
# ];
# })
# .config;
}

1
lib/preconfiguredModules/homeManager/hyprland.nix
View File

@ -24,7 +24,6 @@
xdg.portal = {
enable = true;
configPackages = with pkgs; [
#xdg-desktop-portal-wlr
xdg-desktop-portal-hyprland
];
extraPortals = with pkgs; [

237
lib/preconfiguredModules/nixos/common.nix Normal file
View File

@ -0,0 +1,237 @@
{
lib,
config,
pkgs,
...
}: {
# Nix settings
nix = {
settings = {
experimental-features = ["nix-command" "flakes"];
substituters = [
"https://cache.elnafo.ru"
"https://bonfire.cachix.org"
"https://nix-community.cachix.org"
];
trusted-public-keys = [
"cache.elnafo.ru:j3VD+Hn+is2Qk3lPXDSdPwHJQSatizk7V82iJ2RP1yo="
"bonfire.cachix.org-1:mzAGBy/Crdf8NhKail5ciK7ZrGRbPJJobW6TwFb7WYM="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
auto-optimise-store = true;
};
gc = {
automatic = lib.mkDefault true;
dates = lib.mkDefault "weekly";
options = lib.mkDefault "--delete-older-than 7d";
};
};
# Filesystem
fileSystems = {
"/" = {
device = "/dev/disk/by-label/nixos";
fsType = "btrfs";
options = ["subvol=root" "compress=zstd"];
};
"/boot" = {
device = "/dev/disk/by-label/boot";
fsType = "vfat";
};
"/nix" = {
device = "/dev/disk/by-label/nixos";
fsType = "btrfs";
options = ["subvol=nix" "compress=zstd" "noatime"];
};
"/home" = {
device = "/dev/disk/by-label/nixos";
fsType = "btrfs";
options = ["subvol=home" "compress=zstd"];
};
"/swap" = {
device = "/dev/disk/by-label/nixos";
fsType = "btrfs";
options = ["subvol=swap" "noatime"];
};
};
swapDevices = [
{device = "/swap/swapfile";}
];
# Boot and kernel options
boot = {
loader.systemd-boot.enable = true;
loader.systemd-boot.configurationLimit = 5;
loader.efi.canTouchEfiVariables = true;
tmp.useTmpfs = lib.mkDefault true;
tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"];
initrd.kernelModules = [];
kernelModules = ["tcp_bbr" "coretemp" "nct6775"];
kernelParams = ["threadirqs"];
kernel.sysctl = {
# The Magic SysRq key is a key combo that allows users connected to the
# system console of a Linux kernel to perform some low-level commands.
# Disable it, since we don't need it, and is a potential security concern.
"kernel.sysrq" = 0;
## TCP hardening
# Prevent bogus ICMP errors from filling up logs.
"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
# Reverse path filtering causes the kernel to do source validation of
# packets received from all interfaces. This can mitigate IP spoofing.
"net.ipv4.conf.default.rp_filter" = 1;
"net.ipv4.conf.all.rp_filter" = 1;
# Do not accept IP source route packets
"net.ipv4.conf.all.accept_source_route" = 1;
"net.ipv4.conf.wlo1.accept_source_route" = 1;
"net.ipv6.conf.all.accept_source_route" = 1;
# Don't send ICMP redirects
"net.ipv4.conf.all.send_redirects" = 0;
"net.ipv4.conf.default.send_redirects" = 0;
# Refuse ICMP redirects (MITM mitigations)
"net.ipv4.conf.all.accept_redirects" = 0;
"net.ipv4.conf.default.accept_redirects" = 0;
"net.ipv4.conf.all.secure_redirects" = 0;
"net.ipv4.conf.default.secure_redirects" = 0;
"net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0;
# Protects against SYN flood attacks
"net.ipv4.tcp_syncookies" = 1;
# Incomplete protection again TIME-WAIT assassination
"net.ipv4.tcp_rfc1337" = 1;
## TCP optimization
# TCP Fast Open is a TCP extension that reduces network latency by packing
# data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for
# both incoming and outgoing connections:
"net.ipv4.tcp_fastopen" = 3;
# Bufferbloat mitigations + slight improvement in throughput & latency
"net.ipv4.tcp_congestion_control" = "bbr";
"net.core.default_qdisc" = "cake";
};
};
# Security
security = {
protectKernelImage = true;
sudo.extraConfig = ''Defaults timestamp_timeout=30'';
rtkit.enable = true;
polkit.enable = true;
pam.loginLimits = [
{
domain = "@audio";
item = "memlock";
type = "-";
value = "unlimited";
}
{
domain = "@audio";
item = "rtprio";
type = "-";
value = "99";
}
{
domain = "@audio";
item = "nofile";
type = "soft";
value = "99999";
}
{
domain = "@audio";
item = "nofile";
type = "hard";
value = "99999";
}
{
domain = "*";
item = "nofile";
type = "-";
value = "524288";
}
{
domain = "*";
item = "memlock";
type = "-";
value = "524288";
}
];
};
# Hardware
hardware = {
enableRedistributableFirmware = true;
};
# Timezone and locale
time.timeZone = "Asia/Yekaterinburg";
i18n = {
defaultLocale = "en_US.UTF-8";
extraLocaleSettings = {
LC_ADDRESS = "en_US.UTF-8";
LC_IDENTIFICATION = "en_US.UTF-8";
LC_MEASUREMENT = "en_US.UTF-8";
LC_MONETARY = "en_US.UTF-8";
LC_NAME = "en_US.UTF-8";
LC_NUMERIC = "en_US.UTF-8";
LC_PAPER = "en_US.UTF-8";
LC_TELEPHONE = "en_US.UTF-8";
LC_TIME = "en_US.UTF-8";
};
};
# Base packages
environment.systemPackages = with pkgs; [
wget
parted
ntfs3g
sshfs
exfat
btrfs-progs
btrbk
lm_sensors
btop
git
git-lfs
lazygit
nnn
fzf
ripgrep
fd
unzip
fishPlugins.fzf-fish
fishPlugins.tide
fishPlugins.grc
fishPlugins.hydro
grc
gnupg
pass
bat
];
programs = {
fish.enable = true;
neovim = {
enable = true;
defaultEditor = true;
};
};
}

5
lib/preconfiguredModules/nixos/default.nix Normal file
View File

@ -0,0 +1,5 @@
{
common = import ./common.nix;
hyprland = import ./hyprland.nix;
hyprland-greetd = import ./hyprland-greetd.nix;
}

33
lib/preconfiguredModules/nixos/hyprland-greetd.nix Normal file
View File

@ -0,0 +1,33 @@
{
pkgs,
lib,
config,
...
}:
lib.mkIf config.programs.hyprland.enable {
services.greetd = let
hyprConfig = pkgs.writeText "greetd-hyprland-config" ''
exec-once = ${lib.getExe pkgs.greetd.regreet}; hyprctl dispatch exit
'';
in {
enable = true;
settings = {
default_session = {
command = "${lib.getExe config.programs.hyprland.package} --config ${hyprConfig}";
user = "greeter";
};
};
};
programs.regreet = {
enable = true;
settings = {
GTK = {
application_prefer_dark_theme = true;
};
appearance = {
greeting_msg = "Hey, you. You're finally awake.";
};
};
};
}

6
lib/preconfiguredModules/nixos/hyprland.nix Normal file
View File

@ -0,0 +1,6 @@
{...}: {
programs.hyprland = {
enable = true;
xwayland.enable = true;
};
}

20
lib/preconfiguredModules/pack/hyprland.nix Normal file
View File

@ -0,0 +1,20 @@
{
inputs,
hmConfig,
username,
bonLib,
...
}: {
imports = [
../nixos/hyprland.nix
../nixos/hyprland-greetd.nix
];
home-manager.users.${username} = {...}: {
imports = [
(bonLib.injectArgs {inherit hmConfig;})
inputs.ags.homeManagerModules.default
../homeManager/hyprland.nix
];
};
}

134
nixosConfigurations/astora/default.nix
View File

@ -2,35 +2,21 @@
pkgs,
lib,
config,
bonLib,
...
}: {
system.stateVersion = "23.11";
imports = [./hardware.nix ./users.nix];
imports = [
bonLib.preconfiguredModules.nixos.common
./hardware.nix
./users.nix
];
# Nix settings
nix = {
settings = {
experimental-features = ["nix-command" "flakes" "repl-flake"];
trusted-users = ["l-nafaryus"];
allowed-users = ["l-nafaryus"];
substituters = [
"https://cache.elnafo.ru"
"https://bonfire.cachix.org"
"https://nix-community.cachix.org"
];
trusted-public-keys = [
"cache.elnafo.ru:j3VD+Hn+is2Qk3lPXDSdPwHJQSatizk7V82iJ2RP1yo="
"bonfire.cachix.org-1:mzAGBy/Crdf8NhKail5ciK7ZrGRbPJJobW6TwFb7WYM="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
auto-optimise-store = true;
};
gc = {
automatic = lib.mkDefault true;
dates = lib.mkDefault "weekly";
options = lib.mkDefault "--delete-older-than 7d";
};
nix.settings = {
trusted-users = ["l-nafaryus"];
allowed-users = ["l-nafaryus"];
};
# Nix packages
@ -57,54 +43,21 @@
videoDrivers = ["nvidia"];
#displayManager.gdm = {
# enable = true;
# autoSuspend = false;
# wayland = true;
#};
#desktopManager.gnome.enable = true;
#windowManager.awesome.enable = true;
wacom.enable = true;
};
services.greetd = let
hyprConfig = pkgs.writeText "greetd-hyprland-config" ''
exec-once = ${lib.getExe pkgs.greetd.regreet}; hyprctl dispatch exit
'';
in {
services.desktopManager.plasma6.enable = true;
services.displayManager.sddm = {
enable = true;
settings = {
default_session = {
command = "${lib.getExe config.programs.hyprland.package} --config ${hyprConfig}";
user = "greeter";
};
};
wayland.enable = true;
};
programs.regreet = {
services.dbus = {
enable = true;
settings = {
GTK = {
application_prefer_dark_theme = true;
# TODO: provide gtk themes
# theme_name = "Catppuccin-Macchiato-Standard-Green-Dark";
# icon_theme_name = "Catppuccin-Macchiato-Green-Cursors";
# cursor_theme_name = "Papirus-Dark";
# font_name = "";
};
appearance = {
greeting_msg = "Hey, you. You're finally awake.";
};
};
packages = with pkgs; [networkmanager];
};
programs.hyprland = {
enable = true;
xwayland.enable = true;
};
services.dbus.enable = true;
services.printing = {
enable = true;
drivers = [pkgs.hplip];
@ -132,14 +85,13 @@
};
services.udev = {
packages = with pkgs; [gnome.gnome-settings-daemon];
extraRules = ''
KERNEL=="rtc0", GROUP="audio"
KERNEL=="hpet", GROUP="audio"
'';
};
services.blueman.enable = true;
#services.blueman.enable = true;
services.btrfs.autoScrub = {
enable = true;
@ -147,49 +99,6 @@
fileSystems = ["/"];
};
# Packages
environment.systemPackages = with pkgs; [
wget
parted
ntfs3g
sshfs
exfat
lm_sensors
git
git-lfs
ripgrep
fd
lazygit
unzip
gnumake
fishPlugins.fzf-fish
fishPlugins.tide
fishPlugins.grc
fishPlugins.hydro
nnn
fzf
grc
gcc
cachix
];
programs = {
fish.enable = true;
neovim = {
enable = true;
defaultEditor = true;
};
};
programs.ssh.extraConfig = ''
Host astora
HostName 192.168.156.101
@ -202,13 +111,6 @@
User l-nafaryus
'';
programs.direnv.enable = true;
fonts.packages = with pkgs; [nerdfonts];
programs.steam.enable = true;
systemd.extraConfig = "DefaultLimitNOFILE=1048576";
virtualisation = {
containers.enable = true;
podman = {
@ -217,5 +119,9 @@
defaultNetwork.settings.dns_enabled = true;
};
libvirtd.enable = true;
test-share = {
source = "/home/l-nafaryus/vms/shared";
target = "/mnt/shared";
};
};
}

189
nixosConfigurations/astora/hardware.nix
View File

@ -5,144 +5,14 @@
}: {
# Boot
boot = {
loader.systemd-boot.enable = true;
loader.systemd-boot.configurationLimit = 5;
loader.efi.canTouchEfiVariables = true;
tmp.useTmpfs = lib.mkDefault true;
tmp.cleanOnBoot = lib.mkDefault (!config.boot.tmp.useTmpfs);
initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"];
initrd.kernelModules = [];
kernelModules = ["kvm-amd" "tcp_bbr" "coretemp" "nct6775"];
kernelModules = ["kvm-amd"];
extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
extraModprobeConfig = ''
options v4l2loopback devices=1 video_nr=1 card_label="OBS Camera" exclusive_caps=1
'';
kernelParams = ["threadirqs"];
kernel.sysctl = {
# The Magic SysRq key is a key combo that allows users connected to the
# system console of a Linux kernel to perform some low-level commands.
# Disable it, since we don't need it, and is a potential security concern.
"kernel.sysrq" = 0;
## TCP hardening
# Prevent bogus ICMP errors from filling up logs.
"net.ipv4.icmp_ignore_bogus_error_responses" = 1;
# Reverse path filtering causes the kernel to do source validation of
# packets received from all interfaces. This can mitigate IP spoofing.
"net.ipv4.conf.default.rp_filter" = 1;
"net.ipv4.conf.all.rp_filter" = 1;
# Do not accept IP source route packets
"net.ipv4.conf.all.accept_source_route" = 0;
"net.ipv6.conf.all.accept_source_route" = 0;
# Don't send ICMP redirects
"net.ipv4.conf.all.send_redirects" = 0;
"net.ipv4.conf.default.send_redirects" = 0;
# Refuse ICMP redirects (MITM mitigations)
"net.ipv4.conf.all.accept_redirects" = 0;
"net.ipv4.conf.default.accept_redirects" = 0;
"net.ipv4.conf.all.secure_redirects" = 0;
"net.ipv4.conf.default.secure_redirects" = 0;
"net.ipv6.conf.all.accept_redirects" = 0;
"net.ipv6.conf.default.accept_redirects" = 0;
# Protects against SYN flood attacks
"net.ipv4.tcp_syncookies" = 1;
# Incomplete protection again TIME-WAIT assassination
"net.ipv4.tcp_rfc1337" = 1;
## TCP optimization
# TCP Fast Open is a TCP extension that reduces network latency by packing
# data in the sender’s initial TCP SYN. Setting 3 = enable TCP Fast Open for
# both incoming and outgoing connections:
"net.ipv4.tcp_fastopen" = 3;
# Bufferbloat mitigations + slight improvement in throughput & latency
"net.ipv4.tcp_congestion_control" = "bbr";
"net.core.default_qdisc" = "cake";
};
};
# Security
security = {
protectKernelImage = true;
acme.acceptTerms = true;
sudo.extraConfig = ''Defaults timestamp_timeout=30'';
rtkit.enable = true;
pam.loginLimits = [
{
domain = "@audio";
item = "memlock";
type = "-";
value = "unlimited";
}
{
domain = "@audio";
item = "rtprio";
type = "-";
value = "99";
}
{
domain = "@audio";
item = "nofile";
type = "soft";
value = "99999";
}
{
domain = "@audio";
item = "nofile";
type = "hard";
value = "99999";
}
{
domain = "*";
item = "nofile";
type = "-";
value = "524288";
}
{
domain = "*";
item = "memlock";
type = "-";
value = "524288";
}
];
polkit.enable = true;
};
users.users.root.initialPassword = "nixos";
# Filesystem
fileSystems = {
"/" = {
device = "/dev/disk/by-label/nixos";
fsType = "btrfs";
options = ["subvol=root" "compress=zstd"];
};
"/boot" = {
device = "/dev/disk/by-label/boot";
fsType = "vfat";
};
"/nix" = {
device = "/dev/disk/by-label/nixos";
fsType = "btrfs";
options = ["subvol=nix" "compress=zstd" "noatime"];
};
"/home" = {
device = "/dev/disk/by-label/nixos";
fsType = "btrfs";
options = ["subvol=home" "compress=zstd"];
};
"/swap" = {
device = "/dev/disk/by-label/nixos";
fsType = "btrfs";
options = ["subvol=swap" "noatime"];
};
"/media/steam-library" = {
device = "/dev/disk/by-label/siegward";
fsType = "btrfs";
@ -156,16 +26,10 @@
};
};
swapDevices = [
{device = "/swap/swapfile";}
];
services.fstrim.enable = true;
# Hardware etc
hardware = {
enableRedistributableFirmware = true;
cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
nvidia.nvidiaSettings = true;
@ -181,56 +45,9 @@
};
networking = {
networkmanager.enable = true;
networkmanager.unmanaged = ["interface-name:ve-*"];
useDHCP = lib.mkDefault true;
hostName = "astora";
extraHosts = '''';
firewall = {
networkmanager = {
enable = true;
allowedTCPPorts = [80 443];
trustedInterfaces = ["ve-+"];
extraCommands = ''
iptables -t nat -A POSTROUTING -o wlo1 -j MASQUERADE
'';
extraStopCommands = ''
iptables -t nat -D POSTROUTING -o wlo1 -j MASQUERADE
'';
};
nat = {
enable = true;
externalInterface = "wlo1";
internalInterfaces = ["ve-+"];
};
interfaces.wlo1.ipv4.addresses = [
{
address = "192.168.156.101";
prefixLength = 24;
}
];
defaultGateway = "192.168.156.1";
nameservers = ["192.168.156.1" "8.8.8.8"];
};
# Common
time.timeZone = "Asia/Yekaterinburg";
i18n = {
defaultLocale = "en_US.UTF-8";
extraLocaleSettings = {
LC_ADDRESS = "en_US.UTF-8";
LC_IDENTIFICATION = "en_US.UTF-8";
LC_MEASUREMENT = "en_US.UTF-8";
LC_MONETARY = "en_US.UTF-8";
LC_NAME = "en_US.UTF-8";
LC_NUMERIC = "en_US.UTF-8";
LC_PAPER = "en_US.UTF-8";
LC_TELEPHONE = "en_US.UTF-8";
LC_TIME = "en_US.UTF-8";
enableStrongSwan = true;
};
};
}

118
nixosConfigurations/astora/users.nix
View File

@ -36,16 +36,11 @@ in {
})
inputs.catppuccin.homeManagerModules.catppuccin
inputs.ags.homeManagerModules.default
bonLib.preconfiguredModules.homeManager.hyprland
#bonLib.preconfiguredModules.homeManager.hyprland
];
home.packages = with pkgs; [
#gnupg
git
#nnn
pass
taskwarrior3
#tmux
gparted
@ -99,22 +94,13 @@ in {
jdk
bonPkgs.ultimmc
liberation_ttf
steamtinkerlaunch
discord
webcord
tor
#rofi-wayland
kgx
dunst
libnotify
#dunst
#libnotify
# btop
lua
# bat
musikcube
mangohud
gamescope
libstrangle
@ -124,8 +110,27 @@ in {
freenect
mpc-cli
kdePackages.kmail
kdePackages.kmail-account-wizard
flacon
picard
podman-desktop
virtiofsd
];
xdg.portal = {
enable = true;
configPackages = with pkgs; [
kdePackages.xdg-desktop-portal-kde
];
extraPortals = with pkgs; [
xdg-desktop-portal-gtk
];
};
# Theme
catppuccin = {
# global, for all enabled programs
@ -134,22 +139,6 @@ in {
accent = "green";
};
gtk = {
enable = true;
# TODO: fix catppuccin deprecation. Provide Paper icons to gtk and gnomeShell manually. (+ regreet)
catppuccin = {
enable = true;
accent = "green";
flavor = "macchiato";
gnomeShellTheme = true;
icon = {
enable = true;
accent = "green";
flavor = "macchiato";
};
};
};
programs = {
# General
fish = {
@ -231,6 +220,9 @@ in {
homedir = "${hmConfig.xdg.configHome}/gnupg";
mutableKeys = true;
mutableTrust = true;
settings = {
default-key = "B0B3 DFDB B842 BE9C 7468 B511 86F1 EA98 B48F FB19";
};
# TODO: replace existing ssh key with gpg provided
};
@ -258,7 +250,7 @@ in {
# Graphical
wezterm = {
enable = true;
enable = false;
package = inputs.wezterm.packages.x86_64-linux.default;
extraConfig = ''
return {
@ -281,7 +273,7 @@ in {
};
rofi = {
enable = true;
enable = false;
package = pkgs.rofi-wayland;
terminal = "${lib.getExe hmConfig.programs.wezterm.package}";
cycle = true;
@ -326,7 +318,7 @@ in {
defaultCacheTtl = 3600;
defaultCacheTtlSsh = 3600;
enableSshSupport = true;
pinentryPackage = pkgs.pinentry-gtk2;
pinentryPackage = pkgs.pinentry-qt;
enableFishIntegration = true;
enableBashIntegration = true;
};
@ -392,28 +384,28 @@ in {
};
# Services
services.spoofdpi.enable = true;
#services.spoofdpi.enable = true;
services.zapret = {
enable = true;
mode = "nfqws";
firewallType = "iptables";
disableIpv6 = true;
settings = ''
MODE_HTTP=1
MODE_HTTP_KEEPALIVE=0
MODE_HTTPS=1
MODE_QUIC=1
MODE_FILTER=ipset
TPWS_OPT="--split-http-req=method --split-pos=1 --oob"
NFQWS_OPT_DESYNC="--dpi-desync=fake --dpi-desync-ttl=7 --dpi-desync-fake-http=0x00000000"
NFQWS_OPT_DESYNC_HTTP="--dpi-desync=fake,split2 --dpi-desync-ttl=4"
NFQWS_OPT_DESYNC_HTTPS="--dpi-desync=split2 --dpi-desync-split-pos=1"
NFQWS_OPT_DESYNC_QUIC="--dpi-desync=split2 --dpi-desync-repeats=6"
INIT_APPLY_FW=1
'';
filterAddressesSource = "https://antifilter.network/download/ipsmart.lst";
};
#services.zapret = {
# enable = true;
# mode = "nfqws";
# firewallType = "iptables";
# disableIpv6 = true;
# settings = ''
# MODE_HTTP=1
# MODE_HTTP_KEEPALIVE=0
# MODE_HTTPS=1
# MODE_QUIC=1
# MODE_FILTER=ipset
# TPWS_OPT="--split-http-req=method --split-pos=1 --oob"
# NFQWS_OPT_DESYNC="--dpi-desync=fake --dpi-desync-ttl=5"
# NFQWS_OPT_DESYNC_HTTP="--dpi-desync=fake --dpi-desync-ttl=5"
# NFQWS_OPT_DESYNC_HTTPS="--dpi-desync=fake --dpi-desync-ttl=5"
# NFQWS_OPT_DESYNC_QUIC="--dpi-desync=fake --dpi-desync-ttl=5"
# INIT_APPLY_FW=1
# '';
# filterAddressesSource = "https://antifilter.network/download/ipsmart.lst";
#};
# TODO: remember who use gvfs
services.gvfs.enable = true;
@ -437,4 +429,16 @@ in {
# User-id must match above user. MPD will look inside this directory for the PipeWire socket.
XDG_RUNTIME_DIR = "/run/user/${toString config.users.users.l-nafaryus.uid}";
};
programs.kdeconnect = {
enable = true;
package = lib.mkForce pkgs.kdePackages.kdeconnect-kde;
};
programs.direnv.enable = true;
fonts.packages = with pkgs; [nerdfonts liberation_ttf];
programs.steam.enable = true;
systemd.extraConfig = "DefaultLimitNOFILE=1048576";
}

3
nixosModules/default.nix
View File

@ -10,7 +10,8 @@
./services/papermc.nix
./services/qbittorrent-nox.nix
./services/spoofdpi.nix
./services/zapret.nix
# ISSUE: collision with nixos module zapret
#./services/zapret.nix
./services/conduit.nix
];

11
packages/default.nix
View File

@ -83,11 +83,12 @@ in
# Pass for cache
wezterm = {
source = ./wezterm;
platforms = ["x86_64-linux"];
builder = {...}: import;
};
# ISSUE: attribute 'targetPlatforms' missing
#wezterm = {
# source = ./wezterm;
# platforms = ["x86_64-linux"];
# builder = {...}: import;
#};
# Container images