| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
| |
The URL for drone changed to https://ci.fcuny.net. The secrets also
changed (and we remove the unencrypted file with secrets).
|
| |
|
|
| |
This reverts commit 614fc2fcce0e9ae0bcfdc6e08d3c4bac846d02a8.
|
| | |
|
| |
|
|
|
| |
Since I'm moving everything back to GitHub I don't need to run these
services anymore.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
When rebuilding the host (through `nixos-rebuild switch --flake`) I
don't want to rebuild also my home-manager configuration. I want these
to be two different steps.
I rebuild the home-manager configuration more frequently and it's a
waste of time and CPU to rebuild the world every time.
This is a pretty large refactoring:
- move checks back into the flake: if I modify a check, the
configuration for `pre-commits` is not regenerated, as the file with the
checks is not monitored with `direnv` (I could probably configure it for
it, but not now)
- remove `home.nix` from the host level configuration
- introduce a `mkHomeManagerConfiguration` function to manage the
different user@host
- fix a warning with the rust overlay
|
| |
|
|
|
|
|
|
| |
Installing the rust overlay to get the various tools installed. This is
done by a new module for home-manager, and is installed only on my
laptop at the moment.
Change-Id: I80c1633ca04da82f4321a0687a05d1df7c523702
|
| |
|
|
|
|
|
|
|
|
|
|
| |
The configuration needs to be updated, we set the value for
`bucket_policy_only` to true now that we've set the bucket to use
uniform bucket level
access (https://cloud.google.com/storage/docs/uniform-bucket-level-access).
Change-Id: I7e9516709af4be35a3964937c1dbd728bcfe1f01
Reviewed-on: https://cl.fcuny.net/c/world/+/709
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
| |
Change-Id: Ie87672629ff23eeb93f5308898014cc737490b7c
Reviewed-on: https://cl.fcuny.net/c/world/+/708
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
| |
Change-Id: I17ea0baab0d74888ed1b21342c583495d3f52643
Reviewed-on: https://cl.fcuny.net/c/world/+/705
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Currently the secure configuration for gerrit is not managed by nix.
This is likely going to break in the future and I'll hate myself for
that. Let's move it into nix and encrypt it with age, like we do for
other secrets.
Change-Id: Ia7a006748a3ad64fa4b97ca9e8cbd98c99433982
Reviewed-on: https://cl.fcuny.net/c/world/+/622
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
| |
I don't need to backup these directories in my home.
Change-Id: Ia2302f2ebe74033090b86b52864787d2a63ecb4b
Reviewed-on: https://cl.fcuny.net/c/world/+/620
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
|
|
| |
The pre-commit hook for new lines reported and correct a number of
issues, so let's commit them now and after that we ca enable the hook
for the repository.
Change-Id: I5bb882d3c2cca870ef94301303f029acfb308740
Reviewed-on: https://cl.fcuny.net/c/world/+/592
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
| |
Change-Id: I75df9d3ba133e3f7380a518e1b8c70a564f60482
Reviewed-on: https://cl.fcuny.net/c/world/+/481
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
| |
Change-Id: I905ce6eddc35e4c51a0ab27c8984e0da0fdee7a7
Reviewed-on: https://cl.fcuny.net/c/world/+/457
Reviewed-by: Franck Cuny <franck@fcuny.net>
Tested-by: CI
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
I'm considering trying again fish, and there are a number of things that
should be common between zsh and fish (aliases, environment variables,
...).
Instead of duplicating these settings multiple time, I'm consolidating
the shell configurations under `home/shell`, and I can set the shell I
want to use with `my.home.shell.name`.
The first step is to move the modules for fish and zsh under
`home/shell`, add an interface to pick which one I want to use, and
modify the `host/home.nix` configuration to keep using zsh with the new
interface.
Change-Id: Idb66b1a6fcc11a6eeaf5fd2d32dd3698d2d85bdf
Reviewed-on: https://cl.fcuny.net/c/world/+/455
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
| |
I do not use drone anymore, no need to keep this around.
Change-Id: I8f9564747939a6d1a2b95bcfe8e2c70e46d8bc1e
Reviewed-on: https://cl.fcuny.net/c/world/+/411
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
| |
This was done by running `nixpkgs-fmt .'.
Change-Id: I4ea6c1e759bf468d08074be2111cbc7af72df295
Reviewed-on: https://cl.fcuny.net/c/world/+/404
Tested-by: CI
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
| |
We need to ensure the agents can read the secrets / tokens to vote after
a build.
Change-Id: I066c2482a795b21badaa9cc3c525373d7945b084
Reviewed-on: https://cl.fcuny.net/c/world/+/341
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
All the modules that are setup by the profiles are now managed at the
host level. This simplify some configuration, and will make it easier to
adjust things at the host instead of trying to squeeze everything into
profiles.
This will also help the refactoring later, when I'll split nixos and
home-manager configuration.
Change-Id: I17ffda8b0b5d15bf1915c6fae5030380523d74b5
Reviewed-on: https://cl.fcuny.net/c/world/+/297
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
| |
All the configuration is done at the host level.
Change-Id: Ib5ef71ea7955f6872fb08f576e48b24a70600693
Reviewed-on: https://cl.fcuny.net/c/world/+/296
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
| |
Change-Id: I9abd49136df79a9ed040c9ec0e12eea30736c9ff
Reviewed-on: https://cl.fcuny.net/c/world/+/295
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
| |
Change-Id: I92abe7d6c9a1f7c5ef3f157137c59cde751d50f0
Reviewed-on: https://cl.fcuny.net/c/world/+/294
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
| |
Remove the trusted profiles, the modules are installed directly within
the host configuration.
Change-Id: I0566fb359803da16bdd3a38e2901deac477fb078
Reviewed-on: https://cl.fcuny.net/c/world/+/293
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
| |
Consume the modules related to multimedia applications at the host
level, instead of having a level of indirection with a profile.
Change-Id: I567f0e01cbfe591beaa2e9086e33434402a4a002
Reviewed-on: https://cl.fcuny.net/c/world/+/292
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
| |
Change-Id: Ibb55ee455423c101fb6d3e62a2e9e4593682cf16
Reviewed-on: https://cl.fcuny.net/c/world/+/291
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
|
| |
As for the bluetooth configuration, we don't need that level of
indirection. The laptop can consume these services directly, and we can
drop the profile for laptop.
Change-Id: Ia434d336ae581bd040fbc4963e5856806183d55e
Reviewed-on: https://cl.fcuny.net/c/world/+/290
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
|
|
| |
I don't need a profile for this, the module can be consumed directly
from the host's hardware configuration. It removes one level of
indirection and helps us toward the goal of completely removing all the
profiles.
Change-Id: I95a6fdc985420e7fe0ad737e7576d10d5c7eb114
Reviewed-on: https://cl.fcuny.net/c/world/+/289
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
| |
Change-Id: Iae8860631a9d313d5b4f78d171d0dfebc6ef6ff9
Reviewed-on: https://cl.fcuny.net/c/world/+/283
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
| |
There's one user per agent. If we don't set an owner for that file, it
will be owned by root. Let's set the ownership to the first builder.
Change-Id: I1270e6858c0bf2797bd12c2557d84a494cef5081
Reviewed-on: https://cl.fcuny.net/c/world/+/281
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
| |
I'm not using drone anymore. I don't need the CLI and the secret to be
installed.
Change-Id: I9c8ecfe5f051fd70d78f0e2e9aaa705e48627714
Reviewed-on: https://cl.fcuny.net/c/world/+/261
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
|
|
| |
The secret is the configuration for the gerrit-hook tool. It contains
the URL to our gerrit instance, the username/password for the gerrit
user used by the tool, the API token for buildKite and the name of the
organization in buildKite.
Change-Id: I58233e085c92d4c5db5635eb9942a5e87ee9e55d
Reviewed-on: https://cl.fcuny.net/c/world/+/204
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
| |
Change-Id: I12cc741bdfb074f7d2a006547860362176afe372
Reviewed-on: https://cl.fcuny.net/c/world/+/169
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
| |
Change-Id: I652a3326caf8f949e9734849d1492f7b9764a766
Reviewed-on: https://cl.fcuny.net/c/world/+/167
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
|
|
|
| |
I will not be using drone anymore, and will likely replace it with
buildkite.
Change-Id: I45d91c43090aaba119855158e071dae377c1897f
Reviewed-on: https://cl.fcuny.net/c/world/+/162
Reviewed-by: Franck Cuny <franck@fcuny.net>
|
| |
|
|
|
|
| |
Change-Id: I3b00408d7550d7660fb33940ae2cd0806076f4d2
Reviewed-on: https://cl.fcuny.net/c/world/+/62
Reviewed-by: Franck Cuny <franck.cuny@gmail.com>
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
`zsh' is available everywhere and is compatible with bash. When using
`fish' I need to remember how to do things. While the completion style
is nicer, I don't care about the rest. I prefer to have a consistent
experience in the shell, no matter where am I.
This is an initial configuration, I might need to make a few changes as
I go.
|
| | |
|
| |
|
|
|
| |
This is the configuration needed to interact with GCP from this
repository. We only want it on aptos for now.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
From the laptop I only backup /home/fcuny, as the rest should be
straightforward to rebuild with nix.
I run that backup as my own user, since I need my ssh key to use the
remote repository (which is on the NAS). I also need a new secret for
it (I might have been able to use `pass' for this, but well, that's easy
enough).
For the NAS, I update the list of directories to backup to include home,
this will be on the systems backup.
|
| | |
|
| |
|
|
| |
Add the cert and key for aptos.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
This will ultimately replace traefik.
|
| |
|
|
|
|
| |
Having the secrets closer to the host is easier to manage. At the moment
I don't have secrets that are shared across multiple hosts, so that's an
OK approach.
|
| | |
|
| |
|
|
|
| |
Refactor a bit the configuration, which should simplify the management
and usage of secrets from now on.
|
| |
|
|
| |
Do a single backup for the host, instead of running multiple ones.
|
| |
|
|
| |
So we can unlock the disks remotely.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
aptos is now using the new home-manager setup.
|
| |
|
|
|
|
|
|
|
|
| |
All the modules that are needed for home-manager should be under
`home/`, and each host will have a `host.nix` where the modules are
enabled as needed. Later on we can create some profiles to make it
easier to consume the configuration.
I apply this only to tahoe for now, as the amount of packages needed for
my user are pretty limited.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
The list of public share is configurable too.
|
| |
|
|
|
|
|
|
|
| |
We don't need the previous `hosts/common/system` configs anymore, as
everything has been moved out.
We keep some boot configuration for carmel in the host configuration for
now, but I need to check why I don't have similar settings for
tahoe (since I also need to unlock the host remotely).
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
Move the networking configuration for the hosts to its own file.
|
| |
|
|
| |
Also install mosh and ensure the firewall opens the correct ports.
|
| | |
|
| |
|
|
|
|
|
|
|
|
| |
This is the start of yet another refactoring of the configuration.
Sound configuration is moving to a module, and we enable it as needed at
the host level. It takes care of configuring pipewire and install the
packages needed too.
This module is applied to the laptop and the desktop.
|
| |
|
|
| |
We're using the ones from the prober
|
| | |
|
| |
|
|
|
|
|
|
| |
If we don't, by default we try over ipv6, and this is not going to work
well for us (yet):
```
ts=2022-04-05T01:39:13.830414184Z caller=main.go:130 module=https_2xx target=https://notes.fcuny.net level=error msg="Error for HTTP request" err="Get \"https://[2a09:8280:1::a:2aed]\": dial tcp [2a09:8280:1::a:2aed]:443: connect: network is unreachable"
```
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
This reverts commit 814a495e9c74e3211c6b6640397111115832207b.
|
| |
|
|
| |
Apply the role to tahoe.
|
| |
|
|
|
| |
We also don't need the music-organizer anymore since we're switching to
beets.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
we're shutting it down!
|
| | |
|
| | |
|
| |
|
|
| |
why not ?
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
Profiles contain a collection of modules.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
Add a couple of secrets to store the configuration and the service
account, and add a timer to synchronize the restic repository to a GCS
bucket once a day.
|
| | |
|
| |
|
|
| |
Otherwise, `git` will conflict, since it exists on both domains.
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
fcuny.net is for public facing domains, while fcuny.xyz are for domains
on the tailscale network.
I need to support configuration in traefik for both. The main
difference, for traefik, is the domain name and which let's encrypt
challenge to use (DNS for TS, HTTP for public).
Refactor the function `mkServiceConfig` to accept the domain and LE
challenge as argument, and add new entries for git.fcuny.net and
git.fcuny.xyz.
|
| | |
|
| | |
|
| |
|
|
| |
It's always useful to have it around.
|
| | |
|
| |
|
|
|
|
|
| |
Instead of rsync-ing these folders to a GCS bucket, I should instead do
a backup. If I screw up something, the content will be sync-ed, and I
won't be able to restore it. It's better (maybe more expensive, but
that's OK) to keep snapshots and be able to restore.
|
| |
|
|
|
| |
If they start running at the same time, they won't be able to succeed
since there's a global lock on the repository.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
This is not working as I think, will follow up later.
|
| | |
|
| |
|
|
|
| |
Create a user and group 'nas' so we can run tranmission in it. This will
also help us to enable some specific permissions on some directories.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
| |
I want to run traefik on the NAS, so I can reach grafana and other
future services running on that host.
To manage TLS, we use let's encrypt with a DNS challenge. For this to
work we need a service account configuration, that is encrypted with
age.
|
| |
|
|
|
| |
This will be run via a timer once a day, to perform maintenance on my
backups on the nas.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
The laptop was rebooting when I'd open the lid.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
This is done in the module itself.
|
| |
|
|
|
| |
Don't use the IP from wireguard as the name of the host, let's map to
the actual hostname.
|
| | |
|
| | |
|
| |
|
|
| |
Start with node-exporter-full dashboard.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
Run prometheus via systemd, and configure to pull node-exporter's
metrics from two hosts.
The retention is set for 3 years.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
This is a profile for servers related stuff. We start with monitoring
for now.
|
| |
|
|
| |
Ensure at least /data/media/music is created with the proper ownership.
|
| |
|
|
|
| |
Some settings were missing, others incorrect, and the name of the share
was also incorrect.
|
| | |
|
| |
|
|
| |
For now we only want samba on it.
|
| | |
|
| |
|
|
|
|
|
|
|
| |
Replace nautilus with pcmanfm, which is more than enough for my needs (I
still can't open correctly images / PDF with nautilus, I don't care
why).
Add a few more packages (seahorse, easyeffects) to improve usability of
the desktop.
|
| |
|
|
| |
I don't use GDM anymore.
|
| | |
|
| |
|
|
|
| |
Create a new module for hardware related things, in order to configure
correctly the various machines.
|
| | |
|
| |
|
|
|
|
| |
The key was created under /run/agenix, which is wiped out after a
reboot. The key being absent prevents the wireguard interface to come
up. Store the key somewhere persistent to prevent this to happen.
|
| |
|
|
|
|
|
| |
Without these settings a few things are not working correctly (nautilus
can't browse ssh servers for example).
This module needs to be renamed too.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
Let's remove this, I was only using it to get GDM running, but that's
causing a bunch of issues so far:
- not all environment variables are loaded correctly
- some units are not loaded in time
When trying to use xorg and i3, I have way too many tears and I can't
figure out a proper configuration.
To make it easier, I'm going to keep sway and start `sway` from `tty1`
directly.
|
| | |
|
| |
|
|
|
|
|
|
|
| |
Add a new module to automatically configure the peers for wireguard. The
module needs a configuration file (in `configs/wireguard.toml`) which
lists all the peers, their IP and and their public keys. The secret keys
is encrypted as a secret with agenix.
There's some initial documentation on how to use this setup.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
Replace wpa_supplicant with iwd (I prefer that daemon and the associated
tool, iwctl).
Enable thermald for managing power.
|
| |
|
|
|
| |
aptos is my laptop (dell xps 13'). This adds the initial configuration
for it.
|
| |
|
|
|
| |
See https://github.com/NixOS/nixpkgs/issues/16327 for details (this
removes warnings in some services)
|
| | |
|
| | |
|
| |
|
|
|
| |
`fontconfig.ultimate` does not exists anymore, and `enableFontDir` has
been renamed to `fontDir.enable`.
|
| | |
|
| | |
|
| |
|
|
| |
Most of the options for booting are common to all hosts.
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
| |
The host would not boot successfully with that, I'm doing something
wrong.
|
| |
|
|
|
| |
Create a subvolume named 'media' that we will mount under
/home/fcuny/media so we can snapshots /home/fcuny without the medias.
|
| | |
|
| |
|
|
| |
We need to load the driver for the NIC.
|
| |
|
|
|
| |
Enable a SSH daemon in initrd, with our keys, so we can unlock remotely
the disk on reboot.
|
| | |
|
| |
|
|
| |
This is not working yet, we will figure this out later.
|
| | |
|
| |
|
|
|
| |
Let's switch right away to sway instead, now that there's an emacs
package to support wayland.
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
This is going to be needed to print (for example).
|
| |
|
|
|
|
| |
These services are not configured at the user level, but at the host
level. We might need a better separation in the future, in case I don't
use xserver for example.
|
| | |
|
| |
|
|
|
|
| |
Update the `mkSystem` function to include the proper common module, and
fix the path to import the common configuration for a desktop into
`carmel`.
|
| |
|
|
| |
Sorry, this is a mess, hopefully the last one.
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
