starred/nix-config-ryan4yin
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-07-17 01:51:15 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity

feat: format via 'ls **/*.nix | each { |it| nixfmt $it.name }'

Browse Source
This commit is contained in:
Ryan Yin
2025-07-30 12:17:24 +08:00
parent d10b30b06b
commit 13bb77108c
219 changed files with 2103 additions and 1728 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/idols-aquamarine/caddy.nix
+8 -3
View File
@@ -3,7 +3,8 @@
config,
wallpapers,
...
}: let
}:
let
hostCommonConfig = ''
encode zstd gzip
tls ${../../certs/ecc-server.crt} ${config.age.secrets."caddy-ecc-server.key".path} {
@@ -11,7 +12,8 @@
curves x25519 secp384r1 secp521r1
}
'';
in {
in
{
services.caddy = {
enable = true;
# Reload Caddy instead of restarting it when configuration file changes.
@@ -124,7 +126,10 @@ in {
# reverse_proxy http://localhost:9090
# '';
};
networking.firewall.allowedTCPPorts = [80 443];
networking.firewall.allowedTCPPorts = [
80
443
];
# Create Directories
# https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type
hosts/idols-aquamarine/default.nix
+8 -9
View File
@@ -17,12 +17,11 @@ let
inherit (myvars.networking) defaultGateway defaultGateway6 nameservers;
inherit (myvars.networking.hostsAddr.${hostName}) iface ipv4;
ipv4WithMask = "${ipv4}/24";
in {
imports =
(mylib.scanPaths ./.)
++ [
disko.nixosModules.default
];
in
{
imports = (mylib.scanPaths ./.) ++ [
disko.nixosModules.default
];
# supported file systems, so we can mount any removable disks with these filesystems
boot.supportedFilesystems = [
@@ -42,7 +41,7 @@ in {
zramSwap.memoryPercent = lib.mkForce 100;
boot.kernelPackages = pkgs.linuxPackages_latest;
boot.kernelModules = ["kvm-amd"];
boot.kernelModules = [ "kvm-amd" ];
boot.extraModprobeConfig = "options kvm_amd nested=1"; # for amd cpu
networking = {
@@ -57,9 +56,9 @@ in {
systemd.network.enable = true;
systemd.network.networks."10-${iface}" = {
matchConfig.Name = [iface];
matchConfig.Name = [ iface ];
networkConfig = {
Address = [ipv4WithMask];
Address = [ ipv4WithMask ];
DNS = nameservers;
DHCP = "ipv6"; # enable DHCPv6 only, so we can get a GUA.
IPv6AcceptRA = true; # for Stateless IPv6 Autoconfiguraton (SLAAC)
hosts/idols-aquamarine/disko-fs.nix
+23 -7
View File
@@ -3,8 +3,9 @@
let
cryptKeyFile = "/etc/agenix/hdd-luks-crypt-key";
unlockDisk = "data-encrypted";
in {
fileSystems."/data/fileshare/public".depends = ["/data/fileshare"];
in
{
fileSystems."/data/fileshare/public".depends = [ "/data/fileshare" ];
# By adding this crypttab entry, the disk will be unlocked by systemd-cryptsetup@xxx.service at boot time.
# This systemd service is running after agenix, so that the keyfile is already available.
@@ -59,7 +60,7 @@ in {
];
content = {
type = "btrfs";
extraArgs = ["-f"]; # Force override existing partition
extraArgs = [ "-f" ]; # Force override existing partition
subvolumes = {
"@apps" = {
mountpoint = "/data/apps";
@@ -71,15 +72,27 @@ in {
};
"@fileshare" = {
mountpoint = "/data/fileshare";
mountOptions = ["compress-force=zstd:1" "noatime" "nofail"];
mountOptions = [
"compress-force=zstd:1"
"noatime"
"nofail"
];
};
"@backups" = {
mountpoint = "/data/backups";
mountOptions = ["compress-force=zstd:1" "noatime" "nofail"];
mountOptions = [
"compress-force=zstd:1"
"noatime"
"nofail"
];
};
"@snapshots" = {
mountpoint = "/data/apps-snapshots";
mountOptions = ["compress-force=zstd:1" "noatime" "nofail"];
mountOptions = [
"compress-force=zstd:1"
"noatime"
"nofail"
];
};
};
};
@@ -101,7 +114,10 @@ in {
subvolumes = {
"@persistent" = {
mountpoint = "/data/fileshare/public";
mountOptions = ["compress-force=zstd:1" "nofail"];
mountOptions = [
"compress-force=zstd:1"
"nofail"
];
};
};
};
hosts/idols-aquamarine/exporters/default.nix
+2 -1
View File
@@ -1,3 +1,4 @@
{mylib, ...}: {
{ mylib, ... }:
{
imports = mylib.scanPaths ./.;
}
hosts/idols-aquamarine/gitea.nix
+2 -1
View File
@@ -1,4 +1,5 @@
{pkgs, ...}: {
{ pkgs, ... }:
{
# https://github.com/NixOS/nixpkgs/blob/nixos-25.05/nixos/modules/services/misc/gitea.nix
services.gitea = {
enable = true;
hosts/idols-aquamarine/grafana/default.nix
+2 -1
View File
@@ -2,7 +2,8 @@
config,
myvars,
...
}: {
}:
{
services.grafana = {
enable = true;
dataDir = "/data/apps/grafana";
hosts/idols-aquamarine/minio.nix
+5 -3
View File
@@ -1,7 +1,9 @@
{config, ...}: let
dataDir = ["/data/apps/minio/data"];
{ config, ... }:
let
dataDir = [ "/data/apps/minio/data" ];
configDir = "/data/apps/minio/config";
in {
in
{
# https://github.com/NixOS/nixpkgs/blob/nixos-25.05/nixos/modules/services/web-servers/minio.nix
services.minio = {
enable = true;
hosts/idols-aquamarine/monitoring/alertmanager.nix
+3 -2
View File
@@ -1,4 +1,5 @@
{config, ...}: {
{ config, ... }:
{
services.prometheus.alertmanager = {
enable = true;
listenAddress = "127.0.0.1";
@@ -22,7 +23,7 @@
receiver = "default";
routes = [
{
group_by = ["host"];
group_by = [ "host" ];
group_wait = "5m";
group_interval = "5m";
repeat_interval = "4h";
hosts/idols-aquamarine/monitoring/default.nix
+2 -1
View File
@@ -1,4 +1,5 @@
{mylib, ...}: {
{ mylib, ... }:
{
imports = [
./victoriametrics.nix
./alertmanager.nix
hosts/idols-aquamarine/monitoring/victoriametrics.nix
+72 -75
View File
@@ -2,10 +2,11 @@
lib,
myvars,
...
}: {
}:
{
# Since victoriametrics use DynamicUser, the user & group do not exists before the service starts.
# this group is used as a supplementary Unix group for the service to access our data dir(/data/apps/xxx)
users.groups.victoriametrics-data = {};
users.groups.victoriametrics-data = { };
# Workaround for victoriametrics to store data in another place
# https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type
@@ -16,8 +17,8 @@
# Symlinks do not work with DynamicUser, so we should use bind mount here.
# https://github.com/systemd/systemd/issues/25097#issuecomment-1929074961
systemd.services.victoriametrics.serviceConfig = {
SupplementaryGroups = ["victoriametrics-data"];
BindPaths = ["/data/apps/victoriametrics:/var/lib/victoriametrics:rbind"];
SupplementaryGroups = [ "victoriametrics-data" ];
BindPaths = [ "/data/apps/victoriametrics:/var/lib/victoriametrics:rbind" ];
};
# https://victoriametrics.io/docs/victoriametrics/latest/configuration/configuration/
@@ -36,87 +37,83 @@
# specifies a set of targets and parameters describing how to scrape metrics from them.
# https://prometheus.io/docs/prometheus/latest/configuration/configuration/#scrape_config
prometheusConfig = {
scrape_configs =
[
# --- Homelab Applications --- #
scrape_configs = [
# --- Homelab Applications --- #
{
job_name = "dnsmasq-exporter";
scrape_interval = "30s";
metrics_path = "/metrics";
static_configs = [
{
targets = ["${myvars.networking.hostsAddr.suzi.ipv4}:9153"];
labels.type = "app";
labels.app = "dnsmasq";
labels.host = "suzi";
}
];
}
{
job_name = "dnsmasq-exporter";
scrape_interval = "30s";
metrics_path = "/metrics";
static_configs = [
{
targets = [ "${myvars.networking.hostsAddr.suzi.ipv4}:9153" ];
labels.type = "app";
labels.app = "dnsmasq";
labels.host = "suzi";
}
];
}
{
job_name = "v2ray-exporter";
scrape_interval = "30s";
metrics_path = "/metrics";
static_configs = [
{
targets = [ "${myvars.networking.hostsAddr.aquamarine.ipv4}:9153" ];
labels.type = "app";
labels.app = "v2ray";
labels.host = "aquamarine";
}
];
}
{
job_name = "postgres-exporter";
scrape_interval = "30s";
metrics_path = "/metrics";
static_configs = [
{
targets = [ "${myvars.networking.hostsAddr.aquamarine.ipv4}:9187" ];
labels.type = "app";
labels.app = "postgresql";
labels.host = "aquamarine";
}
];
}
{
job_name = "sftpgo-embedded-exporter";
scrape_interval = "30s";
metrics_path = "/metrics";
static_configs = [
{
targets = [ "${myvars.networking.hostsAddr.aquamarine.ipv4}:10000" ];
labels.type = "app";
labels.app = "sftpgo";
labels.host = "aquamarine";
}
];
}
]
# --- Hosts --- #
++ (lib.attrsets.foldlAttrs (
acc: hostname: addr:
acc
++ [
{
job_name = "v2ray-exporter";
job_name = "node-exporter-${hostname}";
scrape_interval = "30s";
metrics_path = "/metrics";
static_configs = [
{
targets = ["${myvars.networking.hostsAddr.aquamarine.ipv4}:9153"];
labels.type = "app";
labels.app = "v2ray";
labels.host = "aquamarine";
}
];
}
{
job_name = "postgres-exporter";
scrape_interval = "30s";
metrics_path = "/metrics";
static_configs = [
{
targets = ["${myvars.networking.hostsAddr.aquamarine.ipv4}:9187"];
labels.type = "app";
labels.app = "postgresql";
labels.host = "aquamarine";
}
];
}
{
job_name = "sftpgo-embedded-exporter";
scrape_interval = "30s";
metrics_path = "/metrics";
static_configs = [
{
targets = ["${myvars.networking.hostsAddr.aquamarine.ipv4}:10000"];
labels.type = "app";
labels.app = "sftpgo";
labels.host = "aquamarine";
# All my NixOS hosts.
targets = [ "${addr.ipv4}:9100" ];
labels.type = "node";
labels.host = hostname;
}
];
}
]
# --- Hosts --- #
++ (
lib.attrsets.foldlAttrs
(acc: hostname: addr:
acc
++ [
{
job_name = "node-exporter-${hostname}";
scrape_interval = "30s";
metrics_path = "/metrics";
static_configs = [
{
# All my NixOS hosts.
targets = ["${addr.ipv4}:9100"];
labels.type = "node";
labels.host = hostname;
}
];
}
])
[]
myvars.networking.hostsAddr
);
) [ ] myvars.networking.hostsAddr);
};
};
@@ -124,7 +121,7 @@
enable = true;
settings = {
"datasource.url" = "http://localhost:9090";
"notifier.url" = ["http://localhost:9093"]; # alertmanager's api
"notifier.url" = [ "http://localhost:9093" ]; # alertmanager's api
# Whether to disable long-lived connections to the datasource.
"datasource.disableKeepAlive" = true;
hosts/idols-aquamarine/oci-containers/default.nix
+3 -2
View File
@@ -2,7 +2,8 @@
lib,
mylib,
...
}: {
}:
{
imports = mylib.scanPaths ./.;
virtualisation = {
@@ -17,7 +18,7 @@
autoPrune = {
enable = true;
dates = "weekly";
flags = ["--all"];
flags = [ "--all" ];
};
};
hosts/idols-aquamarine/oci-containers/homepage/default.nix
+6 -4
View File
@@ -2,11 +2,13 @@
config,
pkgs,
...
}: let
}:
let
user = "homepage";
configDir = "/data/apps/homepage-dashboard";
in {
users.groups.${user} = {};
in
{
users.groups.${user} = { };
users.users.${user} = {
group = user;
home = configDir;
@@ -26,7 +28,7 @@ in {
homepage = {
hostname = "homepage";
image = "ghcr.io/gethomepage/homepage:latest";
ports = ["127.0.0.1:54401:3000"];
ports = [ "127.0.0.1:54401:3000" ];
# https://github.com/louislam/uptime-kuma/wiki/Environment-Variables
environment = {
# "PUID" = config.users.users.${user}.uid;
hosts/idols-aquamarine/oci-containers/uptime-kuma/default.nix
+6 -4
View File
@@ -1,8 +1,10 @@
{config, ...}: let
{ config, ... }:
let
user = "kuma";
dataDir = "/data/apps/uptime-kuma";
in {
users.groups.${user} = {};
in
{
users.groups.${user} = { };
users.users.${user} = {
group = user;
home = dataDir;
@@ -21,7 +23,7 @@ in {
uptime-kuma = {
hostname = "uptime-kuma";
image = "louislam/uptime-kuma:1";
ports = ["127.0.0.1:53350:3001"];
ports = [ "127.0.0.1:53350:3001" ];
# https://github.com/louislam/uptime-kuma/wiki/Environment-Variables
environment = {
# "PUID" = config.users.users.${user}.uid;
hosts/idols-aquamarine/postgresql.nix
+6 -4
View File
@@ -4,13 +4,15 @@
lib,
myvars,
...
}: let
}:
let
inherit (myvars) username;
user = "postgres"; # postgresql's default system user
package = pkgs.postgresql_16;
dataDir = "/data/apps/postgresql/${package.psqlSchema}";
in {
in
{
# Create Directories
# https://www.freedesktop.org/software/systemd/man/latest/tmpfiles.d.html#Type
systemd.tmpfiles.rules = [
@@ -58,8 +60,8 @@ in {
"--allow-group-access"
];
extraPlugins = ps:
with ps; [
extraPlugins =
ps: with ps; [
# postgis
# pg_repack
];
hosts/idols-aquamarine/proxy.nix
+1 -1
View File
@@ -5,7 +5,7 @@
enable = true;
config = {
# for monitoring
"stats" = {};
"stats" = { };
"api" = {
"tag" = "api";
"services" = [
hosts/idols-aquamarine/restic.nix
+5 -3
View File
@@ -1,8 +1,10 @@
{pkgs, ...}: let
{ pkgs, ... }:
let
passwordFile = "/etc/agenix/restic-password";
sshKeyPath = "/etc/agenix/ssh-key-for-restic-backup";
rcloneConfigFile = "/etc/agenix/rclone-conf-for-restic-backup";
in {
in
{
# https://github.com/NixOS/nixpkgs/blob/nixos-25.05/nixos/modules/services/backup/restic.nix
services.restic.backups = {
homelab-backup = {
@@ -29,7 +31,7 @@ in {
# Patterns to exclude when backing up. See
# https://restic.readthedocs.io/en/latest/040_backup.html#excluding-files
# for details on syntax.
exclude = [];
exclude = [ ];
# A script that must run before starting the backup process.
backupPrepareCommand = ''
hosts/idols-aquamarine/sftpgo.nix
+4 -2
View File
@@ -1,7 +1,9 @@
{config, ...}: let
{ config, ... }:
let
user = "sftpgo";
dataDir = "/data/apps/sftpgo";
in {
in
{
# Read SFTPGO_DEFAULT_ADMIN_USERNAME and SFTPGO_DEFAULT_ADMIN_PASSWORD from a file
systemd.services.sftpgo.serviceConfig.EnvironmentFile = config.age.secrets."sftpgo.env".path;
hosts/idols-aquamarine/transmission.nix
+4 -2
View File
@@ -2,10 +2,12 @@
config,
myvars,
...
}: let
}:
let
dataDir = "/data/fileshare/public/transmission";
name = "transmission";
in {
in
{
# the headless Transmission BitTorrent daemon
# https://github.com/NixOS/nixpkgs/blob/nixos-25.05/nixos/modules/services/torrent/transmission.nix
# https://wiki.archlinux.org/title/transmission