sept rice

nixos/consensus/backups.nix

@@ -1,10 +1,11 @@
-{config, ...}: {
+{ config, ... }:
+{
   sops = {
     defaultSopsFile = ../../secrets/restic.yaml;
     secrets = {
-      "b2-immich/env" = {};
-      "b2-immich/repo" = {};
-      "b2-immich/password" = {};
+      "b2-immich/env" = { };
+      "b2-immich/repo" = { };
+      "b2-immich/password" = { };
     };
   };
   services.restic.backups = {
@@ -15,7 +16,7 @@
       passwordFile = config.sops.secrets."b2-immich/password".path;
 
       paths = [
-        "/rice/immich"
+        "/srv/immich"
       ];
       timerConfig = {
         OnCalendar = "06:00";

nixos/consensus/configuration.nix

@@ -3,14 +3,17 @@
   pkgs,
   config,
   ...
-}: {
+}:
+{
   imports = [
     ./hardware-configuration.nix
     ./backups.nix
   ];
   sops = {
     secrets = {
-      "env" = {sopsFile = ../../secrets/cf-acme.yaml;};
+      "env" = {
+        sopsFile = ../../secrets/cf-acme.yaml;
+      };
     };
   };
   documentation = {
@@ -55,7 +58,7 @@
     };
     openssh = {
       enable = true;
-      ports = [2022];
+      ports = [ 2022 ];
       settings = {
         PasswordAuthentication = false;
         PermitRootLogin = "prohibit-password";
@@ -81,19 +84,19 @@
       ];
     };
     immich = {
-      # enable = true;
       enable = false;
       port = 2283;
       host = "localhost";
       openFirewall = true;
       machine-learning.enable = true;
-      mediaLocation = "/rice/immich";
+      mediaLocation = "/srv/immich";
     };
     nginx = {
-      enable = true;
-      virtualHosts."img.10110110.xyz" = {
-        useACMEHost = "10110110.xyz";
-        forceSSL = true;
+      enable = false;
+      virtualHosts."img.consensus.tailc353f.ts.net" = {
+        # forceSSL = true;
+        # sslCertificate = "/etc/nginx/certs/consensus.tailc353f.ts.net.crt";
+        # sslCertificateKey = "/etc/nginx/certs/consensus.tailc353f.ts.net.key";
         locations."/" = {
           proxyPass = "http://localhost:${toString config.services.immich.port}";
           proxyWebsockets = true;
@@ -145,31 +148,33 @@
   };
   users.users = {
     root = {
-      openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
+      openssh.authorizedKeys.keys = [
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
+      ];
     };
     e = {
       isNormalUser = true;
-      extraGroups = ["wheel"];
+      extraGroups = [ "wheel" ];
       home = "/home/e";
       openssh.authorizedKeys.keys = [
         ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
-        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAdo4PS8myKaKAdyIqSFj2VJ+oZ9DNRIp7PBz8IWKjjy''
+        ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJou+k8HtIWdlztpWog7fVfJgxJnRIo7c5xVPUBhBxhi'' # phone
       ];
     };
   };
   security.sudo-rs.wheelNeedsPassword = false;
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "acme@10110110.xyz";
-    certs = {
-      "10110110.xyz" = {
-        domain = "*.10110110.xyz";
-        group = config.services.nginx.group;
-        dnsProvider = "cloudflare";
-        environmentFile = config.sops.secrets."env".path;
-      };
-    };
-  };
-  nix.settings.trusted-users = ["e"];
+  # security.acme = {
+  #   acceptTerms = true;
+  #   defaults.email = "acme@10110110.xyz";
+  #   certs = {
+  #     "10110110.xyz" = {
+  #       domain = "*.10110110.xyz";
+  #       group = config.services.nginx.group;
+  #       dnsProvider = "cloudflare";
+  #       environmentFile = config.sops.secrets."env".path;
+  #     };
+  #   };
+  # };
+  nix.settings.trusted-users = [ "e" ];
   system.stateVersion = "23.11";
 }

nixos/consensus/hardware-configuration.nix

@@ -2,11 +2,17 @@
   lib,
   modulesPath,
   ...
-}: {
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
+}:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
   boot.loader.grub.device = "/dev/nvme0n1";
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi"];
-  boot.initrd.kernelModules = ["nvme"];
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "uhci_hcd"
+    "xen_blkfront"
+    "vmw_pvscsi"
+  ];
+  boot.initrd.kernelModules = [ "nvme" ];
   fileSystems."/" = {
     device = "/dev/mapper/vg-root";
     fsType = "btrfs";
@@ -15,5 +21,9 @@
     device = "/dev/mapper/vg-var";
     fsType = "btrfs";
   };
+  fileSystems."/srv" = {
+    device = "/dev/ext/srv";
+    fsType = "ext4";
+  };
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

nixos/t14/backups.nix

@@ -1,11 +1,12 @@
-{config, ...}: {
+{ config, ... }:
+{
   sops = {
     defaultSopsFile = ../../secrets/restic.yaml;
     age.keyFile = "/home/e/.config/sops/age/keys.txt";
     secrets = {
-      "b2-home/env" = {};
-      "b2-home/repo" = {};
-      "b2-home/password" = {};
+      "b2-home/env" = { };
+      "b2-home/repo" = { };
+      "b2-home/password" = { };
     };
   };
   services.restic.backups = {
@@ -21,6 +22,7 @@
         "/home/e/.ssh"
         "/home/e/.librewolf"
         "/home/e/.runelite"
+        "/home/e/.local/share/PrismLauncher/instances"
       ];
       timerConfig = {
         OnCalendar = "01:00";

nixos/t14/configuration.nix

@@ -2,10 +2,12 @@
   pkgs,
   attrs,
   ...
-}: let
+}:
+let
   # Horrid workaround for https://github.com/nix-community/home-manager/issues/1011
   homeManagerSessionVars = "/etc/profiles/per-user/${attrs.username}/etc/profile.d/hm-session-vars.sh";
-in {
+in
+{
   imports = [
     ./hardware-configuration.nix
     ./backups.nix
@@ -24,21 +26,24 @@ in {
     loader.systemd-boot.enable = true;
     loader.efi.canTouchEfiVariables = true;
     kernelPackages = pkgs.linuxPackages_latest;
-    blacklistedKernelModules = ["bluetooth"];
+    blacklistedKernelModules = [ "bluetooth" ];
   };
   # Networking
   networking = {
     hostId = "1185c58e";
-    nameservers = ["9.9.9.9" "1.1.1.1"];
+    nameservers = [
+      "9.9.9.9"
+      "1.1.1.1"
+    ];
     networkmanager = {
       enable = true;
       dns = "systemd-resolved";
     };
     firewall = {
       enable = true;
-      allowedTCPPorts = [11111];
-      allowedUDPPorts = [];
-      trustedInterfaces = ["tailscale0"];
+      allowedTCPPorts = [ 11111 ];
+      allowedUDPPorts = [ ];
+      trustedInterfaces = [ "tailscale0" ];
       logRefusedConnections = true;
     };
   };
@@ -50,11 +55,11 @@ in {
     };
   };
 
-  security.pam.services.swaylock = {};
+  security.pam.services.swaylock = { };
   xdg.portal = {
     enable = true;
     xdgOpenUsePortal = false;
-    extraPortals = [pkgs.xdg-desktop-portal-gtk];
+    extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
   };
   programs = {
     light.enable = true;
@@ -64,13 +69,16 @@ in {
     };
     steam.enable = true;
     adb.enable = true;
-    fish.enable = true; #enable vendor completions
+    fish.enable = true; # enable vendor completions
   };
 
   # workaround for wait-online killing nixos build
   systemd.services.NetworkManager-wait-online = {
     serviceConfig = {
-      ExecStart = ["" "${pkgs.networkmanager}/bin/nm-online -q"];
+      ExecStart = [
+        ""
+        "${pkgs.networkmanager}/bin/nm-online -q"
+      ];
     };
   };
 
@@ -128,7 +136,7 @@ in {
       enable = true;
       keyboards = {
         default = {
-          ids = ["*"];
+          ids = [ "*" ];
           settings = {
             main = {
               pause = "timeout(esc, 150, space)";
@@ -145,6 +153,7 @@ in {
 
     trezord.enable = true;
     udisks2.enable = true; # kindle
+    ollama.enable = true;
   };
   fonts = {
     # Set a sane system-wide default font
@@ -152,7 +161,7 @@ in {
       nerd-fonts.ubuntu-mono
       spleen
     ];
-    fontconfig.defaultFonts.monospace = ["UbuntuMono"];
+    fontconfig.defaultFonts.monospace = [ "UbuntuMono" ];
   };
   system.stateVersion = "22.11";
 }