diff --git a/.sops.yaml b/.sops.yaml index f283a56..0251fcc 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -6,10 +6,9 @@ keys: - &minime age1chq5k0t38882rtyljez8cwmvtcstu4tafzvveuhjrujvsqk72f9s9guc06 # microvms - &auth age1vzwz5s35w9g8ck9l5zaq5skrnl3mqzf3hsnc9w22sj4k8tu8kqfstpg2a8 - - &forgejo age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt + - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c - &immich age1afyntwvj672lcq2e4dpxmw3syplzurnnd8q8j3265843jeedpveqkp465z - &miniflux age15ja22wd9tt60vn32sk59pp6c7vtjsn8y3rypn8qfnvxthug8sp0q6f72uh - - &radicale age1j6z39kmnxkqa7jdcjsydy5cryjce7fttf225fh3pldyvq06ax3fq58mk8c creation_rules: - path_regex: hosts/toaster/[^/]+\.yaml$ key_groups: @@ -53,9 +52,3 @@ creation_rules: - *admin_oxa age: - *miniflux - - path_regex: hosts/forgejo/[^/]+\.yaml$ - key_groups: - - pgp: - - *admin_oxa - age: - - *forgejo diff --git a/flake.lock b/flake.lock index 7a14c69..03abfe4 100644 --- a/flake.lock +++ b/flake.lock @@ -14,11 +14,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1738503522, - "narHash": "sha256-1yrVbGLBMBPl34EibVARkUB9Gak1GjLRLZXJk9jbHxU=", + "lastModified": 1738262370, + "narHash": "sha256-d58ioZQgJMmRfp7KIQKIy5G8uio7nCQPP+YsLEbxIgg=", "owner": "nix-community", "repo": "authentik-nix", - "rev": "bc62d5509989f5dca633c65b58aa0ac79a48db3e", + "rev": "e87750273754e7ee9249785ffc7151510e1d64c7", "type": "github" }, "original": { @@ -385,11 +385,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1738638143, - "narHash": "sha256-ZYMe4c4OCtIUBn5hx15PEGr0+B1cNEpl2dsaLxwY2W0=", + "lastModified": 1737751639, + "narHash": "sha256-ZEbOJ9iT72iwqXsiEMbEa8wWjyFvRA9Ugx8utmYbpz4=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "9bdd53f5908453e4d03f395eb1615c3e9a351f70", + "rev": "dfad538f751a5aa5d4436d9781ab27a6128ec9d4", "type": "github" }, "original": { @@ -401,11 +401,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1738574474, - "narHash": "sha256-rvyfF49e/k6vkrRTV4ILrWd92W+nmBDfRYZgctOyolQ=", + "lastModified": 1738163270, + "narHash": "sha256-B/7Y1v4y+msFFBW1JAdFjNvVthvNdJKiN6EGRPnqfno=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "fecfeb86328381268e29e998ddd3ebc70bbd7f7c", + "rev": "59e618d90c065f55ae48446f307e8c09565d5ab0", "type": "github" }, "original": { @@ -445,11 +445,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1738546358, - "narHash": "sha256-nLivjIygCiqLp5QcL7l56Tca/elVqM9FG1hGd9ZSsrg=", + "lastModified": 1738142207, + "narHash": "sha256-NGqpVVxNAHwIicXpgaVqJEJWeyqzoQJ9oc8lnK9+WC4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "c6e957d81b96751a3d5967a0fd73694f303cc914", + "rev": "9d3ae807ebd2981d593cddd0080856873139aa40", "type": "github" }, "original": { @@ -528,8 +528,7 @@ "nixpkgs": "nixpkgs", "nixpkgs-unstable": "nixpkgs-unstable", "sops-nix": "sops-nix", - "tmux-yank": "tmux-yank", - "website": "website" + "tmux-yank": "tmux-yank" } }, "rust-overlay": { @@ -690,30 +689,6 @@ "repo": "treefmt-nix", "type": "github" } - }, - "website": { - "inputs": { - "flake-utils": [ - "flake-utils" - ], - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1738536830, - "narHash": "sha256-3QbNcI9qJ0tKv00w0r2Amqf9pylHVolcTyEi30WZxY8=", - "ref": "main", - "rev": "6fd169aab3ce461fef6a1a4dcbb2ef643e12d9e6", - "revCount": 5, - "type": "git", - "url": "https://codeberg.org/0xa/website.git" - }, - "original": { - "ref": "main", - "type": "git", - "url": "https://codeberg.org/0xa/website.git" - } } }, "root": "root", diff --git a/flake.nix b/flake.nix index e7ae1b4..8c112fa 100644 --- a/flake.nix +++ b/flake.nix @@ -35,12 +35,6 @@ inputs.nixpkgs.follows = "nixpkgs"; }; - website = { - url = "git+https://codeberg.org/0xa/website.git?ref=main"; - inputs.nixpkgs.follows = "nixpkgs"; - inputs.flake-utils.follows = "flake-utils"; - }; - tmux-yank = { url = "github:tmux-plugins/tmux-yank"; flake = false; @@ -60,96 +54,116 @@ }: { - nixosConfigurations = - let - microvm-list = [ - "auth" - "forgejo" - "immich" - "miniflux" - "radicale" + nixosConfigurations = { + toaster = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + lanzaboote.nixosModules.lanzaboote + nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3 + lix-module.nixosModules.default + + ./hosts/toaster + + ./modules/basic-tools + ./modules/binary-caches.nix + ./modules/devtools.nix + ./modules/gnome.nix + ./modules/gnupg.nix + ./modules/radio.nix + ./modules/science.nix + ./modules/tlp.nix + ./modules/virtualization.nix + ./hosts/toaster/secure-boot.nix + ./modules/chromium.nix + ./modules/mail + ./modules/wg ]; - - microvms = builtins.listToAttrs ( - map (vm: { - name = vm; - value = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.microvm - - ./hosts/${vm} - ./modules/server - ./modules/wg - ]; - }; - }) microvm-list - ); - in - microvms - // { - toaster = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - lanzaboote.nixosModules.lanzaboote - nixos-hardware.nixosModules.lenovo-thinkpad-t14-amd-gen3 - lix-module.nixosModules.default - - ./hosts/toaster - - ./modules/basic-tools - ./modules/binary-caches.nix - ./modules/devtools.nix - ./modules/gnome.nix - ./modules/gnupg.nix - ./modules/radio.nix - ./modules/science.nix - ./modules/tlp.nix - ./modules/virtualization.nix - ./hosts/toaster/secure-boot.nix - ./modules/chromium.nix - ./modules/mail - ./modules/wg - ]; - }; - cloud = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - lix-module.nixosModules.default - - ./hosts/cloud - - ./modules/basic-tools - ./modules/server - ./modules/binary-caches.nix - ./modules/wg - ]; - }; - minime = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - sops-nix.nixosModules.sops - microvm.nixosModules.host - lix-module.nixosModules.default - - ./hosts/minime - ./modules/basic-tools - ./modules/server - ./modules/binary-caches.nix - ./modules/wg - - { - config.microvm.autostart = microvm-list; - } - ]; - }; }; + cloud = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + lix-module.nixosModules.default + + ./hosts/cloud + + ./modules/basic-tools + ./modules/server + ./modules/binary-caches.nix + ./modules/wg + ]; + }; + minime = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.host + lix-module.nixosModules.default + + ./hosts/minime + ./modules/basic-tools + ./modules/server + ./modules/binary-caches.nix + ./modules/wg + ]; + }; + + auth = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.microvm + authentik-nix.nixosModules.default + + ./hosts/auth + ./modules/server + ./modules/wg + ]; + }; + + immich = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.microvm + + ./hosts/immich + ./modules/server + ./modules/wg + ]; + }; + + miniflux = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.microvm + + ./hosts/miniflux + ./modules/server + ./modules/wg + ]; + }; + + radicale = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + specialArgs = { inherit inputs; }; + modules = [ + sops-nix.nixosModules.sops + microvm.nixosModules.microvm + + ./hosts/radicale + ./modules/server + ./modules/wg + ]; + }; + }; }; } diff --git a/hosts/auth/authentik.nix b/hosts/auth/authentik.nix index 023e2db..f60f269 100644 --- a/hosts/auth/authentik.nix +++ b/hosts/auth/authentik.nix @@ -1,8 +1,5 @@ -{ config, inputs, ... }: +{ config, ... }: { - imports = [ - inputs.authentik-nix.nixosModules.default - ]; sops.secrets."authentik/env" = { }; services.authentik = { enable = true; diff --git a/hosts/cloud/networking.nix b/hosts/cloud/networking.nix index 3c5c08d..71af8e1 100644 --- a/hosts/cloud/networking.nix +++ b/hosts/cloud/networking.nix @@ -19,9 +19,7 @@ networkConfig = { Address = [ "188.245.196.27/32" - "116.202.5.66/32" "2a01:4f8:c17:7f8a::1/64" - "2a01:4f8:c17:7f8a::617/64" ]; DNS = [ "2a01:4ff:ff00::add:1" diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index d092b02..c225ce3 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -1,12 +1,8 @@ -{ inputs, ... }: -let - website = inputs.website.packages."x86_64-linux".default; -in +{ ... }: { imports = [ ./auth.nix ./dav.nix - ./git.nix ./immich.nix ./news.nix ]; @@ -52,21 +48,13 @@ in # Prevent injection of code in other mime types (XSS Attacks) add_header X-Content-Type-Options nosniff; ''; - + # default vhost virtualHosts."oxapentane.com" = { forceSSL = true; enableACME = true; - default = true; + # default = true; locations."/" = { - root = "${website}"; - index = "index.html"; - }; - }; - virtualHosts."www.oxapentane.com" = { - forceSSL = true; - enableACME = true; - locations."/" = { - return = "302 https://oxapentane.com"; + return = "503"; }; }; }; diff --git a/hosts/cloud/proxy/git.nix b/hosts/cloud/proxy/git.nix deleted file mode 100644 index ac53f4c..0000000 --- a/hosts/cloud/proxy/git.nix +++ /dev/null @@ -1,68 +0,0 @@ -{ ... }: -{ - # ssh config for forgejo - # need ip forward for nat - boot.kernel.sysctl = { - "net.ipv4.ip_forward" = 1; - }; - - networking.firewall = { - # open port explicitly - allowedTCPPorts = [ 22 ]; - # git.oxapentane.com: port forward 22 to forgejo - # TODO do a proper thing with ipv6 - extraCommands = '' - iptables -t nat -I PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 - iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE - ''; - extraStopCommands = '' - iptables -t nat -D PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 || true - ''; - }; - # host sshd: only listen on oxapentane.com and mgmt vpn - services.openssh.listenAddresses = - map - (a: { - addr = a; - port = 22; - }) - [ - # enp1s0 - "188.245.196.27" - "2a01:4f8:c17:7f8a::1" - # wg-0xa-mgmt - "10.89.87.1" - "fd31:185d:722e::1" - ]; - - services.nginx.upstreams.forgejo = { - servers = { - "10.89.88.15:3000" = { }; - "[fd31:185d:722f::15]:3000" = { }; - }; - }; - - services.nginx.virtualHosts."git.oxapentane.com" = { - enableACME = true; - forceSSL = true; - locations."/" = { - proxyPass = "http://forgejo"; - extraConfig = '' - client_max_body_size 50000M; - - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection "upgrade"; - - proxy_read_timeout 600s; - proxy_send_timeout 600s; - send_timeout 600s; - ''; - }; - }; -} diff --git a/hosts/forgejo/default.nix b/hosts/forgejo/default.nix deleted file mode 100644 index 02211e5..0000000 --- a/hosts/forgejo/default.nix +++ /dev/null @@ -1,77 +0,0 @@ -{ config, lib, ... }: -let - mac = "02:00:00:00:00:05"; -in -{ - imports = [ - ./forgejo.nix - ]; - sops.defaultSopsFile = ./secrets.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - - sops.secrets = { - "wg/0xa-proxy" = { - owner = config.users.users.systemd-network.name; - }; - }; - - microvm = { - hypervisor = "qemu"; - mem = 3 * 1024; - vcpu = 2; - interfaces = [ - { - type = "tap"; - id = "uvm-forgejo"; - mac = mac; - } - ]; - shares = - [ - { - source = "/nix/store"; - mountPoint = "/nix/.ro-store"; - tag = "store"; - proto = "virtiofs"; - socket = "store.socket"; - } - ] - ++ map - (dir: { - source = dir; - mountPoint = "/${dir}"; - tag = dir; - proto = "virtiofs"; - socket = "${dir}.socket"; - }) - [ - "etc" - "var" - "home" - ]; - }; - - networking.useNetworkd = true; - networking.firewall.enable = lib.mkForce false; # firewalling done by the host - - systemd.network = { - enable = true; - networks."11-host" = { - matchConfig.MACAddress = mac; - networkConfig = { - Address = "10.99.99.15/24"; - DHCP = "no"; - }; - routes = [ - { - Gateway = "10.99.99.1"; - Destination = "0.0.0.0/0"; - Metric = 1024; - } - ]; - }; - }; - - networking.hostName = "forgejo"; - system.stateVersion = "24.11"; -} diff --git a/hosts/forgejo/forgejo.nix b/hosts/forgejo/forgejo.nix deleted file mode 100644 index 965354f..0000000 --- a/hosts/forgejo/forgejo.nix +++ /dev/null @@ -1,70 +0,0 @@ -{ - config, - pkgs, - lib, - ... -}: -{ - services.forgejo = { - enable = true; - package = pkgs.forgejo; - useWizard = false; - database = { - type = "postgres"; - createDatabase = true; - }; - lfs.enable = true; - settings = { - DEFAULT.APP_NAME = "0xa's compilable shitposts"; - actions.ENABLED = false; - database.LOG_SQL = false; - indexer.REPO_INDEXER_ENABLED = true; - mailer.ENABLED = false; - packages.ENABLED = false; - session.COOKIE_SECURE = true; - server = { - DOMAIN = "git.oxapentane.com"; - SSH_DOMAIN = "git.oxapentane.com"; - ROOT_URL = "https://git.oxapentane.com/"; - PROTOCOL = "http"; - START_SSH_SERVER = true; - BUILTIN_SSH_SERVER_USER = "git"; - SSH_LISTEN_PORT = 2222; - }; - repository = { - DEFAULT_REPO_UNITS = "repo.code,repo.releases,repo.issues,repo.pulls"; - ENABLE_PUSH_CREATE_USER = true; - }; - service = { - REGISTER_EMAIL_CONFIRM = false; - DISABLE_REGISTRATION = true; - }; - oauth2_client = { - ENABLE_AUTO_REGISTRATION = true; - USERNAME = "nickname"; - ACCOUNT_LINKING = "login"; - }; - }; - }; - - # expose forgejo cli - environment.systemPackages = - let - cfg = config.services.forgejo; - forgejo-cli = pkgs.writeScriptBin "forgejo-cli" '' - #!${pkgs.runtimeShell} - cd ${cfg.stateDir} - sudo=exec - if [[ "$USER" != forgejo ]]; then - sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} -g ${cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM' - fi - # Note that these variable names will change - export GITEA_WORK_DIR=${cfg.stateDir} - export GITEA_CUSTOM=${cfg.customDir} - $sudo ${lib.getExe cfg.package} "$@" - ''; - in - [ - forgejo-cli - ]; -} diff --git a/hosts/forgejo/secrets.yaml b/hosts/forgejo/secrets.yaml deleted file mode 100644 index 1bcf0a0..0000000 --- a/hosts/forgejo/secrets.yaml +++ /dev/null @@ -1,42 +0,0 @@ -wg: - 0xa-proxy: ENC[AES256_GCM,data:DZB/1S2Ev71DbnN+8C/K0mjIf/13Ki1f6vOIOdhsS6qyXKr5OwpbNb9KA0k=,iv:Gnd32DRJtP8LsC1P9GyS98oCLq/MBSCNcxrZngVXF6g=,tag:gyrzJOx9CS+1Kw5JRONIAw==,type:str] -sops: - kms: [] - gcp_kms: [] - azure_kv: [] - hc_vault: [] - age: - - recipient: age1gknaqevzuq7dtqalng3547w5qflk9a0kugymea5h54eg6twu43pqpkr4zt - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyV0ttcmFIeWtCdTFuS0Y1 - ZzZHdUJmZ3ZlaUx3d0x5NGVaLzhXZjdtZHk4CkprNUZ5VThydVJ2dTBCdE5OQS8z - c0VtY1Vmd2N3bThEdDBFZWMxUC83RXMKLS0tIFluRjRrNG1Qam9MSjVvUWJjbHdq - VVRSM2JuOHpTYXRmOVRRSUN0NzlZeDQKcZ6ym4DTJqZjRpAUcWBcYXR/nVYZzhLx - vhtZzCmaQc2qYSVtDZE51N3cTqPWJD+l/cr8zp2lo0GCfNWO6BQthg== - -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-02-03T18:25:04Z" - mac: ENC[AES256_GCM,data:sSG52AUXjzVo5klAx+t9rhWn/alKAETF6bPUSYP5Dz7WH3vcY5bs87RCm+BdxzlueHMTn4HBQ5iZ2V4e34403GPJsQMYgWSkKapbWGBRurT0xBO5aCJhxZWpvjFSPdehOGNODKGtYFgBVd81PwZRWFdx3MrkwIItyYEq4TAtIyI=,iv:p+t0QmQKDaSiwtuHfLzR31AzmmS39NFq1nn1BAG5YTk=,tag:FSm77zDvPbHCarkGZCgtmg==,type:str] - pgp: - - created_at: "2025-02-03T18:24:33Z" - enc: |- - -----BEGIN PGP MESSAGE----- - - hQIMA7zUOKwzpAE7AQ//fcUVRBuEFENKNck1l2/QVMIRwfZzxJO5fMy/r0GQzKiR - Nl9X4z0HGcxlCwfiUImif1UtQdMWs1RCXQ7HtFK8kKyNgIb07y5306TI/dmkhbP7 - nWD0EstGEgbSiVGiFRlT/gy4FIVyKhBPxJqfT/dbAuRZb7NXsl8Rv1fsnZZFcJMu - MKO1S3DivJUS/YVXteoRf3T5DLobSpO7/5ok5LUXuuSpYKk20hUxFdJqhv1hsljZ - kjckGJ2L0OlxVz16nmg8Z1QI0jDfN6dLl/X+di3U2VACDQDMF+K9LCPLfAm295Y5 - TAtPSv/yE5os9crJ+MCVKHbEI11Khe3mfdRWvVboVZP6jXoD4ZTe/ccXLZCN8pgE - KdSZWs/L2Ps66KYuxujk/c8khmmrmLpPk0qJo9zW0mAf9TSC8UPnMYAxbroeijIe - PVYOJS2AzySnRtXQY4MBPLqzlQ0tKf8HxaCBpZ6eCMsX0/9IDjJJOhCMuMavL+oJ - DnNQQwtSDXAtXcgvwIccEMzawjyPMS5QBx0hYuH8t0rSJtCYutk2op6yKb1vWmOq - 5EDksdNevT3QzGesjtPErh6s3hu3YUAM2k2h4MqXVCbFdchA//FBIHequPul+UMm - JMLsPLAk2FmtWAiOuXxdCPtoY7Jnd8Ziqiemhd961WTiWrCtsv7NSn7x4PIMeLfS - XgFpMQ+15G4NNCDpgJWGUUXc1H+OKj3XepY5EoONnhusT/gJAtxT9vnuJ+T9LDTt - a0Ye2g3jxugeupJ58vbZUifHy/B0OtSeXKkRHZuycCJd3bzxzNxpXLJ23ds40JA= - =/5W1 - -----END PGP MESSAGE----- - fp: DD0998E6CDF294537FC604F991FA5E5BF9AA901C - unencrypted_suffix: _unencrypted - version: 3.9.4 diff --git a/hosts/minime/uvm.nix b/hosts/minime/uvm.nix new file mode 100644 index 0000000..93f2253 --- /dev/null +++ b/hosts/minime/uvm.nix @@ -0,0 +1,24 @@ +{ inputs, ... }: +{ + microvm.stateDir = "/var/lib/microvms"; + microvm.autostart = [ + "auth" + "radicale" + "immich" + "miniflux" + ]; + microvm.vms = { + auth = { + flake = inputs.self; + updateFlake = "github:gshipunov/nix-config/master"; + }; + radicale = { + flake = inputs.self; + updateFlake = "github:gshipunov/nix-config/master"; + }; + immich = { + flake = inputs.self; + updateFlake = "github:gshipunov/nix-config/master"; + }; + }; +} diff --git a/modules/chromium.nix b/modules/chromium.nix index 30d6faf..270a52b 100644 --- a/modules/chromium.nix +++ b/modules/chromium.nix @@ -10,16 +10,16 @@ programs.chromium = { enable = true; extensions = [ - # "pkehgijcmpdhfbdbbnkijodmdjhbjlgp" # privacy badger + "pkehgijcmpdhfbdbbnkijodmdjhbjlgp" # privacy badger "ekhagklcjbdpajgpjgmbionohlpdbjgc" # zotero connector "nngceckbapebfimnlniiiahkandclblb" # bitwarden # "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin - # "ddkjiahejlhfcafbddmgiahcphecmpfh" # ublock lite + "ddkjiahejlhfcafbddmgiahcphecmpfh" # ublock lite "mnjggcdmjocbbbhaepdhchncahnbgone" # sponsorblock ]; extraOpts = { "BrowserSignin" = 0; - # "SyncDisabled" = true; + "SyncDisabled" = true; "PasswordManagerEnabled" = false; "TranslateEnabled" = false; "AutofillAddressEnabled" = false; diff --git a/modules/desktop-software.nix b/modules/desktop-software.nix index 054ae37..9bf944f 100644 --- a/modules/desktop-software.nix +++ b/modules/desktop-software.nix @@ -5,20 +5,17 @@ dino ffmpeg-full firefox-wayland - vivaldi - vivaldi-ffmpeg-codecs gimp inkscape kicad signal-desktop tdesktop - tor-browser + tor-browser-bundle-bin wl-clipboard yt-dlp element-desktop discord spotify - mpv ]; programs.steam.enable = true; } diff --git a/modules/science.nix b/modules/science.nix index 421f12e..f937945 100644 --- a/modules/science.nix +++ b/modules/science.nix @@ -4,6 +4,5 @@ gnuplot zotero paraview - numbat ]; } diff --git a/modules/tlp.nix b/modules/tlp.nix index 5606ab2..0265110 100644 --- a/modules/tlp.nix +++ b/modules/tlp.nix @@ -9,6 +9,7 @@ USB_BLACKLIST = "1d50:604b 1d50:6089 1d50:cc15 1fc9:000c"; CPU_SCALING_GOVERNOR_ON_AC = "performance"; CPU_SCALING_GOVERNOR_ON_BAT = "powersave"; + WIFI_PWR_ON_BAT = "off"; }; }; } diff --git a/modules/wg/proxy.nix b/modules/wg/proxy.nix index a94f7e2..f149049 100644 --- a/modules/wg/proxy.nix +++ b/modules/wg/proxy.nix @@ -55,14 +55,6 @@ publicKey = "2Lvjzg8k5EIR0Y5mlsCHOs1cJl1+1SL0QMxkKUmliE0="; privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; }; - "forgejo" = { - address = [ - "10.89.88.15/24" - "fd31:185d:722f::15/48" - ]; - publicKey = "pXiOmI3aspl2IvdvLXLddxw76QYMRTACNm42nq+L4D0="; - privateKeyFile = config.sops.secrets."wg/0xa-proxy".path; - }; }; } ];