starred/nix-config
1
0
Fork 0
mirror of https://github.com/ryan4yin/nix-config.git synced 2026-08-27 13:33:57 +02:00
Code Issues Packages Projects Releases 10 Wiki Activity
2,268 Commits 5 Branches 35 Tags
65ee1a001f3df4ef5ef6871d98bf797f86da9914
Commit Graph
82 Commits
Author SHA1 Message Date
Ryan Yin 65ee1a001f security: disable SSH X11 forwarding on servers, keep on desktops 2026-08-26 18:14:43 +08:00
Ryan Yin 212f45e2ca security: restrict k3s kubeconfig file mode to 600 2026-08-26 18:14:43 +08:00
Ryan Yin be6e2b4110 security: bind aquamarine metrics exporters to loopback 2026-08-26 18:14:43 +08:00
Ryan Yin 36c29a8371 security: enable AppArmor (complain) on all Linux hosts 2026-08-26 18:14:43 +08:00
Ryan Yin b46bb471d8 test: fix security-firewall eval test to scalar per-host values 2026-08-26 18:14:43 +08:00
Ryan Yin 72a6e95cab security: make firewall secure-by-default, disable explicitly on servers 
Flip the base firewall default to ON so new hosts are protected by default. Servers keep the firewall off (trusted internal LAN, WAN protected at the router) via explicit overrides in modules/nixos/server/{server,server-aarch64}.nix. Behavior-preserving for all 18 current hosts; adds a security-firewall eval test guarding the per-host state.
 2026-08-26 18:14:43 +08:00
Ryan Yin f80580772a feat(blender): build 5.2 LTS with CUDA and OptiX 2026-07-24 14:34:25 +08:00
Ryan Yin 3550c6af2a feat(monitoring): collect homelab UPS metrics 2026-07-24 12:44:17 +08:00
Ryan Yin 0fe12bef5a fix(nix): preserve default sandbox shell 
Setting nix.settings.sandbox-paths replaces Nix compiled sandbox defaults. Keeping only /dev/net made local builds lose the sandbox shell that normally provides /bin/sh, which broke upstream scripts with /bin/sh shebangs in packages such as X11-fonts and openldap.

Use extra-sandbox-paths for /dev/net instead. This keeps Nix daemon defaults intact, including the configured sandbox shell, while still allowing builds that need /dev/net.

Add eval coverage for both Linux output sets so future changes keep /dev/net in extra-sandbox-paths and do not reintroduce an explicit sandbox-paths override.
 2026-07-06 23:04:16 +08:00
Ryan Yin 8462d34ade feat: NixOS tests using systemd-nspawn containers 2026-06-22 09:02:06 +08:00
Ryan Yin 691af4ae54 chore: use nixfmt pre-commit hook 2026-06-14 14:15:37 +08:00
Ryan Yin 400725b36c chore: replace nixos-generators image outputs 2026-06-14 14:10:08 +08:00
Ryan Yin 762896ddb9 feat: update nixpkgs, fix bug 2026-05-03 13:04:01 +08:00
Ryan Yin 8207ccbdff refactor(home): consolidate host home modules under home/hosts 2026-03-23 12:38:55 +08:00
Ryan Yin cf7b5a5be7 refactor(home): move host home-manager configs out of hosts 2026-03-23 10:57:09 +08:00
Ryan Yin 54d1d559a0 fix: missing npm/pnpm 2026-03-20 23:29:39 +08:00
Ryan Yin 3dbc94c3de feat: run ai agents on homelab (#251) 
* feat: run ai agents on kana & ruby

* fix: upload vm
 2026-03-17 10:31:18 +08:00
Ryan Yin 69f77fecca feat: new host - idols-akane, hardens VFAT /boot mounts (#245) 
* feat: new host - idols-akane

* fix: missing efi files

* fix: efi partition - permission issue
 2026-03-07 23:54:13 +08:00
Ryan Yin fb7a0cd178 feat: replace waybar/mako/anyrun/wlogout/swaylock with noctolia-shell, remove hyprland (#240) 2026-01-03 09:36:54 -06:00
Ryan Yin 29760ddb27 refactor: update niri, write config in kdl, remove niri-flake (#237) 
• Updated input 'nixpkgs':
  → 'github:NixOS/nixpkgs/0254eab410b90ef2420c1059f908ae777e3b02f9?narHash=sha256-/US2Ei9JHXHVBAxV4FX49Q7H5s4UNBrIiOA6Xjzgq44%3D' (2025-12-06)

• Updated input 'home-manager':
    'github:nix-community/home-manager/f4cb25928fafa9ae68660fe71f730fc820a59028?narHash=sha256-5xOuutXM7UPTUcn3uDAD8UlPQsXmqPrX81cXoDOAGcA%3D' (2025-11-26)
  → 'github:nix-community/home-manager/89c9508bbe9b40d36b3dc206c2483ef176f15173?narHash=sha256-rB45jv4uwC90vM9UZ70plfvY/2Kdygs%2BzlQ07dGQFk4%3D' (2025-12-17)

• Updated input 'nixpkgs-master':
    'github:nixos/nixpkgs/6812bcfd614abedbdb3f68d7b6554eda6ca3e014?narHash=sha256-sNF/PZcuzYBHKRBkerEiPf5mkZM15A3fWD%2BlqpwKc60%3D' (2025-12-15)
  → 'github:nixos/nixpkgs/e50ab9bb181f9fb3ce00e7a6007c70ddaa007203?narHash=sha256-acPMRCAPgPykzkwATwD1EfF7xgmbraAvIJyCeR6bKxc%3D' (2025-12-18)

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2025-12-18 19:56:46 -06:00
Ryan Yin fdcc3be59d chore: update claude models 2025-12-03 14:09:06 +08:00
Ryan Yin 34fdd92351 feat: comment out nixpkgs-unstable, we use unstable by default (#232) 
* feat: comment out nixpkgs-unstable, we use unstable by default

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>

* fix: typo...

---------

Signed-off-by: Ryan Yin <xiaoyin_c@qq.com>
 2025-11-01 07:21:57 -06:00
Ryan Yin 070aeae8db feat: gaming (#223) 
* refactor: configure gaming suite via options, use pkgs-x64
* fix: gaming on apple silicon (not work yet)
 2025-09-17 13:54:27 +08:00
Ryan Yin a1d51ffe0c fix: qq with input method https://patch-diff.githubusercontent.com/raw/NixOS/nixpkgs/pull/439070.patch 2025-09-01 14:28:06 +08:00
Ryan Yin da1e7253da docs: flypy - user customized words, fix typos 2025-09-01 14:00:24 +08:00
Ryan Yin ce4588d0c2 feat: niri - define configs via home-manager 2025-08-20 01:59:42 +08:00
Ryan Yin 69eee64e7e feat: add new wayland compositor - niri 2025-08-20 00:03:25 +08:00
Ryan Yin 13bb77108c feat: format via 'ls **/*.nix | each { |it| nixfmt $it.name }' 2025-07-30 12:17:24 +08:00
Ryan Yin bc163b8157 feat: replace alejandra with nixfmt(rfc-style) 1.0.0 2025-07-30 10:57:05 +08:00
Ryan Yin 18cabc994c feat: shoukei - add x64 support via binfmt 2025-07-26 17:03:29 +08:00
Ryan Yin ae0158b226 fix: shoukei - allowUnsupportedSstem 2025-07-13 02:42:32 +08:00
Ryan Yin 264611e334 fix: shoukei - hardening 2025-07-13 02:12:24 +08:00
Ryan Yin db82d2d8c5 feat: remove x86_64-darwin, add new nixos host on macbook pro m2 2025-07-12 23:30:52 +08:00
Ryan Yin 77a792710a docs: outputs 2025-07-12 16:55:41 +08:00
Ryan Yin 0c7e43a21b feat: add sandboxed wechat (#196) 2025-07-12 16:49:45 +08:00
Ryan Yin 8690978d7e feat: replace impermanence with preservation (#198) 
* feat: replace impermanence with preservation

* fix: This module cannot be used with scripted initrd.

* fix: permission for /var/lib/private

* chore: boot.initrd.systemd.enable

* docs: boot.initrd.luks.devices.<name>.fallbackToPassword is implied by systemd stage 1

* fix: typo
 2025-06-29 13:02:36 +08:00
Ryan Yin 4ec26c5e5f refactor: fonts (#194) 2025-06-22 20:13:50 +08:00
Ryan Yin e13079f7a8 feat(darwin): new host - frieren 2025-05-13 13:07:47 +08:00
Ryan Yin cfdf12b356 fix: attribute 'nix-access-tokens' missing for homelab 2025-03-01 06:26:23 +08:00
Ryan Yin 46ed22565d fix: kubevirt-shoryu - disable home-manager 2024-09-09 17:27:54 +08:00
Ryan Yin df9ca7aefa feat: hardening nixos desktops (#160) 
* feat: hardening nixos desktops

* refactor: move hardening to the root folder

* feat: add nixpaks into nixpkgs via overlays

* feat: nixpak - add netease music

* docs: hardening

* fix: nvidia

* fix: disable apparmor & hardening profile to avoid neovim being killed

* fix: firefox cursor & fonts
 2024-09-05 23:59:39 +08:00
Ryan Yin a1789eebff refactor: remove i3 (#162) 2024-09-03 00:06:34 +08:00
Ryan Yin d853036fb1 feat: data-crypted 2024-08-17 02:26:39 +08:00
Ryan Yin 35eb6ed5c9 refactor: migrate sbcs to https://github.com/ryan4yin/nixos-config-sbc 2024-08-16 15:06:24 +08:00
Ryan Yin b671c05db9 feat: migrate services to aqua 2024-07-31 14:29:21 +08:00
Ryan Yin 385bcd2d87 chore: update graphics config 2024-07-20 11:49:14 +08:00
Ryan Yin f37588df64 fix: nixpkgs for darwin 2024-06-02 12:59:13 +08:00
Ryan Yin 93c423a75b feat: update flake.nix 2024-04-12 23:15:06 +08:00
Ryan Yin f831061889 feat: add private ca for all internal web services 2024-04-03 16:51:51 +08:00
Ryan Yin f5f27bff96 feat: add home-manager for kubevirt-shoryu 2024-04-01 15:16:35 +08:00