flake: Initialise new repository

modules/darwin/apps.nix

@@ -0,0 +1,14 @@
+{
+  homebrew.masApps = {
+    "AdGuard for Safari" = 1440147259;
+    "Tailscale" = 1475387142;
+    "GarageBand" = 682658836;
+    "iMovie" = 408981434;
+
+    # Work
+    "Keynote" = 409183694;
+    "Numbers" = 409203825;
+    "Pages" = 409201541;
+    "Things" = 904280696;
+  };
+}

modules/darwin/casks.nix

@@ -0,0 +1,22 @@
+{
+  homebrew.casks = [
+    "glance-chamburr"
+    "iina"
+    "netnewswire"
+    "electrum"
+    "monero-wallet"
+    "keepassxc"
+    "element"
+    "signal"
+
+    # Work
+    "visual-studio-code"
+    "obsidian"
+    "chatgpt"
+    "ghostty"
+
+    # Games
+    "minecraft"
+    "modrinth"
+  ];
+}

modules/darwin/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./apps.nix
+    ./casks.nix
+    ./fonts.nix
+  ];
+}

modules/darwin/fonts.nix

@@ -0,0 +1,18 @@
+{ pkgs, ... }:
+{
+  fonts.packages = with pkgs; [
+    atkinson-hyperlegible
+    jetbrains-mono
+    open-sans
+  ];
+  homebrew.casks = [
+    "font-chomsky"
+    "font-cormorant-garamond"
+    "font-crimson-text"
+    "font-new-york"
+    "font-sf-compact"
+    "font-sf-mono"
+    "font-sf-pro"
+    "font-unifrakturmaguntia"
+  ];
+}

modules/home-manager/colors.nix

@@ -0,0 +1,39 @@
+{ pkgs, ... }:
+{
+  # Rosé Pine Moon (https://rosepinetheme.com)
+  programs = {
+    bat = {
+      config.theme = "rose-pine";
+      themes.rose-pine = {
+        src = pkgs.fetchFromGitHub {
+          owner = "rose-pine";
+          repo = "tm-theme";
+          rev = "c4235f9a65fd180ac0f5e4396e3a86e21a0884ec";
+          hash = "sha256-jji8WOKDkzAq8K+uSZAziMULI8Kh7e96cBRimGvIYKY=";
+        };
+        file = "dist/themes/rose-pine.tmTheme";
+      };
+    };
+
+    fzf.colors = {
+      "fg" = "#908caa";
+      "bg" = "#191724";
+      "hl" = "#ebbcba";
+      "fg+" = "#e0def4";
+      "bg+" = "#26233a";
+      "hl+" = "#ebbcba";
+      "border" = "#403d52";
+      "header" = "#31748f";
+      "gutter" = "#191724";
+      "spinner" = "#f6c177";
+      "info" = "#9ccfd8";
+      "pointer" = "#c4a7e7";
+      "marker" = "#eb6f92";
+      "prompt" = "#908caa";
+    };
+
+    ghostty.settings.theme = "rose-pine";
+
+    helix.settings.theme = "rose_pine";
+  };
+}

modules/home-manager/default.nix

@@ -0,0 +1,89 @@
+{
+  config,
+  pkgs,
+  inputs,
+  ...
+}:
+{
+  imports = [
+    inputs.agenix.homeManagerModules.default
+    ./colors.nix
+    ./ghostty.nix
+    ./git
+    ./helix.nix
+    ./packages.nix
+    ./shell
+  ];
+
+  home = {
+    username = "jan";
+    homeDirectory = "/Users/jan";
+    stateVersion = "24.05";
+
+    ## Mute login message in terminal
+    file.".hushlogin".text = "";
+
+    sessionVariables = {
+      DIRENV_LOG_FORMAT = "";
+      LEDGER_FILE = "${config.xdg.dataHome}/ledger/2024.journal";
+      OPENAI_API_KEY = "$(cat ${config.age.secrets.openai.path})";
+    };
+
+    shellAliases = {
+      "yt" = "yt-dlp";
+      "yta" = "yt-dlp -x";
+    };
+
+    packages = [ inputs.agenix.packages.${pkgs.system}.default ];
+  };
+
+  age = {
+    # identityPaths = [ "~/.ssh/id_ed25519" ];
+    secrets."openai".file = ../secrets/openai.age;
+  };
+
+  xdg = {
+    enable = true;
+    userDirs = {
+      videos = "${config.home.homeDirectory}/Movies/Videos";
+    };
+  };
+
+  programs = {
+    home-manager.enable = true;
+
+    gpg = {
+      enable = true;
+      homedir = "${config.xdg.dataHome}/gnupg";
+      settings = {
+        default-key = "20AF0A659F2B93AD918415D1A7DA689CB3B078EC";
+        keyserver = "hkps://keys.openpgp.org";
+      };
+    };
+
+    pandoc.enable = true;
+
+    ssh = {
+      enable = true;
+      addKeysToAgent = "yes";
+      extraConfig = ''
+        UseKeychain yes
+        IdentityFile ~/.ssh/id_ed25519
+        SetEnv TERM=xterm-256color
+      '';
+    };
+
+    yt-dlp = {
+      enable = true;
+      settings = {
+        output = "${config.xdg.userDirs.videos}/%(title)s.%(ext)s";
+        format-sort = "res:1080";
+        audio-quality = 0;
+        sponsorblock-mark = "default";
+        embed-metadata = true;
+        embed-thumbnail = true;
+        xattrs = true;
+      };
+    };
+  };
+}

modules/home-manager/ghostty.nix

@@ -0,0 +1,14 @@
+{
+  programs.ghostty = {
+    enable = true;
+    package = null;
+    enableZshIntegration = true;
+    settings = {
+      font-size = 16;
+      window-padding-x = 5;
+      window-padding-balance = true;
+      mouse-hide-while-typing = true;
+      macos-option-as-alt = "left";
+    };
+  };
+}

modules/home-manager/git/default.nix

@@ -0,0 +1,68 @@
+{
+  imports = [
+    ./ignores.nix
+  ];
+
+  home.sessionVariables = {
+    GITHUB_TOKEN = "$(gh auth token)";
+  };
+
+  programs = {
+    git = {
+      enable = true;
+      userName = "Jan Kremer";
+      userEmail = "mail@jankremer.eu";
+      lfs.enable = true;
+      difftastic.enable = true;
+
+      extraConfig = {
+        user.signingkey = "A7DA689CB3B078EC";
+        credential.helper = "osxkeychain";
+        merge.conflictstyle = "zdiff3";
+        commit = {
+          verbose = true;
+          gpgsign = true;
+        };
+        branch.sort = "-committerdate";
+        help.autocorrect = 10;
+        diff = {
+          algorithm = "histogram";
+          colorMoved = "default";
+        };
+        log.date = "iso";
+        rebase.autostash = true;
+        rerere.enabled = true;
+        push = {
+          followtags = true;
+          autoSetupRemote = true;
+        };
+      };
+    };
+
+    gh = {
+      enable = true;
+      settings.git_protocol = "ssh";
+    };
+
+    sapling = {
+      enable = true;
+      userName = "Jan Kremer";
+      userEmail = "mail@jankremer.eu";
+    };
+
+    jujutsu = {
+      enable = true;
+      settings = {
+        user = {
+          name = "Jan Kremer";
+          email = "mail@jankremer.eu";
+        };
+        signing = {
+          behavior = "own";
+          backend = "gpg";
+        };
+        ui.default-command = "log";
+      };
+    };
+  };
+}

modules/home-manager/git/ignores.nix

@@ -0,0 +1,30 @@
+{
+  programs.git.ignores = [
+    "*.7z"
+    "*.class"
+    "*.com"
+    "*.dll"
+    "*.dmg"
+    "*.exe"
+    "*.gz"
+    "*.iso"
+    "*.jar"
+    "*.log"
+    "*.o"
+    "*.pdf"
+    "*.rar"
+    "*.so"
+    "*.sql"
+    "*.sqlite"
+    "*.tar"
+    "*.zip"
+    ".DS_Store"
+    ".DS_Store?"
+    ".Spotlight-V100"
+    ".Trashes"
+    "._*"
+    ".direnv"
+    "Thumbs.db"
+    "ehthumbs.db"
+  ];
+}

modules/home-manager/helix.nix

@@ -0,0 +1,103 @@
+{ pkgs, ... }:
+{
+  programs.helix = {
+    enable = true;
+    defaultEditor = true;
+
+    extraPackages = with pkgs; [
+      markdown-oxide
+      nixd
+      nixfmt-rfc-style
+    ];
+
+    settings = {
+      editor = {
+        line-number = "relative";
+        cursorline = true;
+        color-modes = true;
+        mouse = true;
+
+        end-of-line-diagnostics = "hint";
+        inline-diagnostics.cursor-line = "warning";
+
+        cursor-shape = {
+          insert = "bar";
+          normal = "block";
+          select = "underline";
+        };
+
+        soft-wrap.enable = true;
+
+        statusline = {
+          left = [
+            "mode"
+            "spinner"
+            "version-control"
+            "read-only-indicator"
+            "file-modification-indicator"
+          ];
+
+          center = [ "file-name" ];
+
+          right = [
+            "diagnostics"
+            "selections"
+            "register"
+            "position"
+            "position-percentage"
+            "file-encoding"
+            "file-type"
+          ];
+
+          mode = {
+            normal = "NORMAL";
+            insert = "INSERT";
+            select = "SELECT";
+          };
+        };
+      };
+
+      keys = {
+        normal = {
+          X = [
+            "extend_line_up"
+            "extend_to_line_bounds"
+          ];
+        };
+      };
+    };
+
+    languages = {
+      language-server = {
+        tinymist.command = "tinymist";
+        nixd = {
+          command = "nixd";
+          config = {
+            formatting.command = [ "nixfmt" ];
+            nixpkgs.expr = "import (builtins.getFlake \"~/.config/nix\").inputs.nixpkgs { }";
+            options = {
+              nixos.expr = "(builtins.getFlake \"~/.config/nix\").nixosConfigurations.galanthus.options";
+              darwin.expr = "(builtins.getFlake \"~/.config/nix\").darwinConfigurations.Mac-von-Jan.options";
+              home-manager.expr = "(builtins.getFlake \"~/.config/nix\").homeConfigurations.jan.options";
+            };
+          };
+        };
+      };
+
+      language = [
+        {
+          name = "nix";
+          language-servers = [ "nixd" ];
+          formatter.command = "nixfmt";
+          auto-format = true;
+        }
+        {
+          name = "typst";
+          language-servers = [ "tinymist" ];
+          formatter.command = "typstyle";
+          auto-format = true;
+        }
+      ];
+    };
+  };
+}

modules/home-manager/packages.nix

@@ -0,0 +1,24 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    darwin.trash
+    curl
+    nh
+    cachix
+    hledger
+    hledger-web
+    ffmpeg
+    imagemagick
+
+    # Work
+    codex
+    typst
+    hayagriva
+    # quarto
+    # R
+    # rPackages.reticulate
+    # texliveFull
+    plantuml
+    ditaa
+  ];
+}

modules/home-manager/shell/bat.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  programs.bat = {
+    enable = true;
+    extraPackages = with pkgs.bat-extras; [ batman ];
+  };
+
+  home.shellAliases = {
+    "cat" = "bat";
+    "man" = "batman";
+  };
+}

modules/home-manager/shell/default.nix

@@ -0,0 +1,49 @@
+{
+  imports = [
+    ./bat.nix
+    # ./fish.nix
+    ./starship.nix
+    ./zsh.nix
+  ];
+
+  home.shellAliases = {
+    "deploy" =
+      "ssh -t galanthus 'cd ~/.config/nix; git pull --rebase; sudo nixos-rebuild switch --flake ~/.config/nix'";
+    "mv" = "mv -i";
+    "rm" = "trash";
+    "tree" = "lt";
+    "zz" = "z -";
+  };
+
+  programs = {
+    direnv = {
+      enable = true;
+      nix-direnv.enable = true;
+      config = {
+        warn_timeout = "1m";
+        hide_env_diff = true;
+      };
+    };
+
+    eza = {
+      enable = true;
+      git = true;
+    };
+
+    fzf = {
+      enable = true;
+      defaultCommand = "fd --type f --strip-cwd-prefix --hidden --follow --exclude .git";
+      fileWidgetCommand = "fd --type f --strip-cwd-prefix --hidden --follow --exclude .git";
+      fileWidgetOptions = [ "--preview 'bat --color=always {}'" ];
+    };
+
+    fd.enable = true;
+
+    ripgrep = {
+      enable = true;
+      arguments = [ "--ignore-case" ];
+    };
+
+    zoxide.enable = true;
+  };
+}

modules/home-manager/shell/fish.nix

@@ -0,0 +1,22 @@
+{
+  programs.fish = {
+    enable = true;
+
+    interactiveShellInit = # fish
+      ''
+        set fish_greeting
+        set fish_vi_key_bindings
+        set fish_vi_cursor
+
+        eval $(/opt/homebrew/bin/brew shellenv fish)
+      '';
+
+    shellAbbrs = {
+      gs = "git status";
+      gc = "git commit";
+      gca = "git commit -a";
+      gcaa = "git commit -a --amend";
+      gco = "git checkout";
+    };
+  };
+}

modules/home-manager/shell/starship.nix

@@ -0,0 +1,94 @@
+{ lib, ... }:
+{
+  programs.starship = {
+    enable = true;
+    enableTransience = true;
+    settings = {
+      add_newline = false;
+      format = lib.concatStrings [
+        "$username"
+        "$hostname"
+        "$directory"
+        "$git_branch"
+        "$git_status"
+        "$git_metrics"
+        "$git_state"
+        "$nodejs"
+        "$rust"
+        "$golang"
+        "$python"
+        "$typst"
+        "$gleam"
+        "$fill"
+        "$nix_shell"
+        "$shell"
+        "$line_break"
+        "$character"
+      ];
+
+      fill = {
+        symbol = " ";
+      };
+
+      character = {
+        success_symbol = "[❯](green)";
+        error_symbol = "[❯](red)";
+        vimcmd_symbol = "[❮](blue)";
+      };
+
+      directory = {
+        style = "blue";
+      };
+
+      git_branch = {
+        format = "[$branch(:$remote_branch)](white) ";
+      };
+
+      git_status = {
+        style = "cyan";
+      };
+
+      nodejs = {
+        symbol = "nodejs";
+        format = "[$symbol ($version )](green)";
+      };
+
+      rust = {
+        symbol = "rust";
+        format = "[$symbol ($version )](red)";
+      };
+
+      python = {
+        symbol = "python";
+        format = "[$symbol ($version )](yellow)";
+      };
+
+      golang = {
+        symbol = "go";
+        format = "[$symbol ($version )](green)";
+      };
+
+      typst = {
+        symbol = "typst";
+        format = "[$symbol ($version )](green)";
+      };
+
+      gleam = {
+        symbol = "gleam";
+        format = "[$symbol ($version )](purple)";
+      };
+
+      nix_shell = {
+        symbol = "nix";
+        heuristic = true;
+        format = "[$symbol ($state $name )](red)";
+      };
+
+      shell = {
+        disabled = false;
+        fish_indicator = "fish ";
+        format = "[$indicator](purple)";
+      };
+    };
+  };
+}

modules/home-manager/shell/zsh.nix

@@ -0,0 +1,40 @@
+{ config, ... }:
+{
+  programs.zsh = {
+    enable = true;
+    # enableVteIntegration = true;
+    dotDir = ".config/zsh";
+    history = {
+      path = "${config.xdg.stateHome}/zsh/zsh_history";
+      extended = true;
+    };
+    autosuggestion.enable = true;
+    autocd = true;
+    syntaxHighlighting = {
+      enable = true;
+      highlighters = [
+        "main"
+        "cursor"
+        "brackets"
+        "root"
+      ];
+    };
+    initContent = # sh
+      ''
+        eval "$(/opt/homebrew/bin/brew shellenv)"
+
+        setopt COMPLETE_IN_WORD
+        setopt ALWAYS_TO_END
+        setopt PATH_DIRS
+        setopt AUTO_MENU
+        setopt AUTO_LIST
+        setopt MENU_COMPLETE
+      '';
+
+    completionInit = # sh
+      ''
+        autoload -U compinit && compinit
+        zstyle ':completion:*' matcher-list 'm:{a-zA-Z}={A-Za-z}' 'r:|[._-]=* r:|=*' 'l:|=* r:|=*'
+      '';
+  };
+}

modules/nixos/adguardhome.nix

@@ -0,0 +1,6 @@
+{
+  services.adguardhome = {
+    enable = true;
+    port = 3000;
+  };
+}

modules/nixos/audiobookshelf.nix

@@ -0,0 +1,31 @@
+{
+  containers.audiobooks = {
+    autoStart = true;
+    bindMounts = {
+      "/var/lib/audiobookshelf" = {
+        hostPath = "/mnt/sdb1/media/audiobooks";
+        isReadOnly = false;
+      };
+    };
+
+    config =
+      { pkgs, ... }:
+      {
+        services = {
+          audiobookshelf = {
+            enable = true;
+            # port = 8000;
+            # host = "audiobooks.alpine-centauri.ts.net";
+          };
+
+          tailscale = {
+            enable = true;
+            useRoutingFeatures = "server";
+            interfaceName = "userspace-networking";
+          };
+        };
+
+        system.stateVersion = "24.05";
+      };
+  };
+}

modules/nixos/default.nix

@@ -0,0 +1,18 @@
+{
+  imports = [
+    # ./adguardhome.nix
+    ./audiobookshelf.nix
+    ./forgejo.nix
+    # ./freshrss.nix
+    # ./immich.nix
+    ./jellyfin.nix
+    ./mealie.nix
+    ./minecraft.nix
+    ./navidrome.nix
+    # ./nextcloud.nix
+    # ./pinchflat.nix
+    ./samba.nix
+    ./tailscale.nix
+    # ./vaultwarden.nix
+  ];
+}

modules/nixos/forgejo.nix

@@ -0,0 +1,58 @@
+{ inputs, ... }:
+{
+  containers.git = {
+    autoStart = true;
+    bindMounts."/etc/ssh/ssh_host_ed25519_key".hostPath = "/etc/ssh/ssh_host_ed25519_key";
+
+    config = {
+      imports = [ inputs.agenix.nixosModules.default ];
+
+      age = {
+        identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+        secrets."forgejo-runner-token" = {
+          file = ../secrets/forgejo-runner-token.age;
+          mode = "400";
+          owner = "forgejo";
+        };
+      };
+
+      services = {
+        forgejo = {
+          enable = true;
+          database.type = "postgres";
+          lfs.enable = true;
+          settings = {
+            server = {
+              DOMAIN = "git.alpine-centauri.ts.net";
+              ROOT_URL = "https://git.alpine-centauri.ts.net/";
+              HTTP_PORT = 3000;
+            };
+            actions = {
+              ENABLED = true;
+              DEFAULT_ACTIONS_URL = "https://code.forgejo.org";
+            };
+          };
+        };
+
+        # gitea-actions-runner = {
+        #   package = pkgs.forgejo-runner;
+        #   instances.native = {
+        #     enable = true;
+        #     name = "native";
+        #     url = "https://git.alpine-centauri.ts.net";
+        #     tokenFile = config.age.secrets.forgejo-runner-token.path;
+        #     labels = [ "native:host" ];
+        #   };
+        # };
+
+        tailscale = {
+          enable = true;
+          useRoutingFeatures = "server";
+          interfaceName = "userspace-networking";
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

modules/nixos/freshrss.nix

@@ -0,0 +1,24 @@
+{
+  containers.freshrss = {
+    autoStart = true;
+
+    config = {
+      services = {
+        freshrss = {
+          enable = true;
+          language = "de";
+          authType = "none";
+          baseUrl = "https://freshrss.alpine-centauri.ts.net";
+        };
+
+        tailscale = {
+          enable = true;
+          useRoutingFeatures = "server";
+          interfaceName = "userspace-networking";
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

modules/nixos/immich.nix

@@ -0,0 +1,29 @@
+{
+  containers.immich = {
+    autoStart = true;
+
+    bindMounts = {
+      "/var/lib/immich" = {
+        hostPath = "/mnt/sdb1/photos";
+        isReadOnly = false;
+      };
+    };
+
+    config = {
+      services = {
+        immich = {
+          enable = true;
+          host = "immich.alpine-centauri.ts.net";
+        };
+
+        tailscale = {
+          enable = true;
+          useRoutingFeatures = "server";
+          interfaceName = "userspace-networking";
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

modules/nixos/jellyfin.nix

@@ -0,0 +1,69 @@
+{
+  containers.jellyfin = {
+    autoStart = true;
+    bindMounts = {
+      "/media" = {
+        hostPath = "/mnt/sdb1/media";
+        isReadOnly = false;
+      };
+    };
+
+    config =
+      { pkgs, ... }:
+      {
+        services = {
+          jellyfin = {
+            enable = true; # port = 8096
+            openFirewall = true;
+          };
+
+          tailscale = {
+            enable = true;
+            useRoutingFeatures = "server";
+            interfaceName = "userspace-networking";
+          };
+        };
+
+        environment.systemPackages = with pkgs; [
+          jellyfin
+          jellyfin-web
+          jellyfin-ffmpeg
+        ];
+
+        ## Hardware transcoding
+        nixpkgs.config.packageOverrides = pkgs: {
+          vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
+        };
+        hardware.graphics = {
+          enable = true;
+          extraPackages = with pkgs; [
+            intel-media-driver
+            intel-vaapi-driver # previously vaapiIntel
+            vaapiVdpau
+            intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
+            # vpl-gpu-rt # QSV on 11th gen or newer
+            intel-media-sdk # QSV up to 11th gen
+          ];
+        };
+
+        ## Grab EPG data daily
+        systemd = {
+          services.epg = {
+            script = "${pkgs.nodejs_18}/bin/npm run --prefix /media/TV/epg/ grab -- --channels=custom.channels.xml";
+            path = [
+              pkgs.bash
+              pkgs.nodejs_18
+            ];
+            serviceConfig = {
+              Type = "oneshot";
+              User = "root";
+            };
+            startAt = "daily"; # Creates a timer
+          };
+          timers.epg.timerConfig.Persistent = true;
+        };
+
+        system.stateVersion = "24.05";
+      };
+  };
+}

modules/nixos/mealie.nix

@@ -0,0 +1,22 @@
+{
+  containers.mealie = {
+    autoStart = true;
+
+    config = {
+      services = {
+        mealie = {
+          enable = true;
+          port = 9000;
+        };
+
+        tailscale = {
+          enable = true;
+          useRoutingFeatures = "server";
+          interfaceName = "userspace-networking";
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

modules/nixos/minecraft.nix

@@ -0,0 +1,36 @@
+{ lib, ... }:
+{
+  containers.minecraft = {
+    autoStart = true;
+
+    bindMounts = {
+      "/var/lib/minecraft" = {
+        hostPath = "/mnt/sdb1/minecraft";
+        isReadOnly = false;
+      };
+    };
+
+    config = {
+      nixpkgs.config.allowUnfreePredicate =
+        pkg:
+        builtins.elem (lib.getName pkg) [
+          "minecraft-server"
+        ];
+
+      services = {
+        minecraft-server = {
+          enable = true;
+          eula = true;
+        };
+
+        tailscale = {
+          enable = true;
+          useRoutingFeatures = "server";
+          interfaceName = "userspace-networking";
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

modules/nixos/navidrome.nix

@@ -0,0 +1,31 @@
+{
+  containers.music = {
+    autoStart = true;
+    bindMounts = {
+      "/Music" = {
+        hostPath = "/mnt/sdb1/media/Music";
+        isReadOnly = false;
+      };
+    };
+
+    config = {
+      services = {
+        navidrome = {
+          enable = true;
+          settings = {
+            MusicFolder = "/Music";
+            port = 4533;
+          };
+        };
+
+        tailscale = {
+          enable = true;
+          useRoutingFeatures = "server";
+          interfaceName = "userspace-networking";
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

modules/nixos/nextcloud.nix

@@ -0,0 +1,86 @@
+{ inputs, ... }:
+{
+  containers.nextcloud = {
+    autoStart = true;
+    bindMounts = {
+      "/etc/ssh/ssh_host_ed25519_key".hostPath = "/etc/ssh/ssh_host_ed25519_key";
+      "/var/lib/nextcloud/data" = {
+        hostPath = "/mnt/sdb1/data";
+        isReadOnly = false;
+      };
+    };
+
+    config =
+      { pkgs, config, ... }:
+      {
+        imports = [ inputs.agenix.nixosModules.default ];
+
+        age = {
+          identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+          secrets."nextcloud" = {
+            file = ../secrets/nextcloud.age;
+            mode = "400";
+            owner = "nextcloud";
+          };
+        };
+
+        services = {
+          nextcloud = {
+            enable = true;
+            package = pkgs.nextcloud30;
+            hostName = "nextcloud";
+            https = true;
+            config = {
+              adminpassFile = config.age.secrets.nextcloud.path;
+            };
+            settings = {
+              trusted_domains = [ "nextcloud.alpine-centauri.ts.net" ];
+              enabledPreviewProviders = [
+                "OC\\Preview\\AVI"
+                "OC\\Preview\\BMP"
+                "OC\\Preview\\GIF"
+                "OC\\Preview\\HEIC"
+                "OC\\Preview\\JPEG"
+                "OC\\Preview\\Krita"
+                "OC\\Preview\\MKV"
+                "OC\\Preview\\MP3"
+                "OC\\Preview\\MP4"
+                "OC\\Preview\\MarkDown"
+                "OC\\Preview\\Movie"
+                "OC\\Preview\\OpenDocument"
+                "OC\\Preview\\PDF"
+                "OC\\Preview\\PNG"
+                "OC\\Preview\\TXT"
+                "OC\\Preview\\XBitmap"
+              ];
+            };
+
+            database.createLocally = true;
+            configureRedis = true;
+
+            maxUploadSize = "1G";
+
+            ## Set up non-declaratively for now
+            # extraAppsEnable = true;
+            # autoUpdateApps.enable = true;
+            # extraApps = {
+            #   inherit (config.services.nextcloud.package.packages.apps)
+            #     news
+            #     contacts
+            #     calendar
+            #     tasks
+            #     ;
+            # };
+          };
+
+          tailscale = {
+            enable = true;
+            useRoutingFeatures = "server";
+            interfaceName = "userspace-networking";
+          };
+        };
+
+        system.stateVersion = "24.05";
+      };
+  };
+}

modules/nixos/pinchflat.nix

@@ -0,0 +1,31 @@
+{
+  virtualisation.oci-containers = {
+    containers = {
+      pinchflat = {
+        image = "ghcr.io/kieraneglin/pinchflat:latest";
+        environment.TZ = "Europe/Berlin";
+        ports = [ "127.0.0.1:8945:8945" ];
+        volumes = [
+          "/mnt/sdb1/media/youtube/config:/config"
+          "/mnt/sdb1/media/youtube/downloads:/downloads"
+        ];
+      };
+    };
+  };
+
+  containers.youtube = {
+    autoStart = true;
+
+    config = {
+      services = {
+        tailscale = {
+          enable = true;
+          useRoutingFeatures = "server";
+          interfaceName = "userspace-networking";
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

modules/nixos/samba.nix

@@ -0,0 +1,34 @@
+{
+  services.samba = {
+    enable = true;
+
+    settings = {
+      global = {
+        "vfs objects" = "catia fruit streams_xattr";
+        "guest account" = "jan";
+        "fruit:model" = "MacPro7,1@ECOLOR=226,226,224";
+      };
+
+      Media = {
+        path = "/mnt/sdb1/media";
+        writeable = "yes";
+      };
+
+      TimeMachine = {
+        path = "/mnt/sdb1/timemachine";
+        writeable = "yes";
+        "fruit:time machine" = "yes";
+      };
+    };
+  };
+
+  ## Used to advertise the shares to Windows hosts
+  services.samba-wsdd = {
+    enable = true;
+  };
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+  };
+}

modules/nixos/tailscale.nix

@@ -0,0 +1,9 @@
+{
+  services.tailscale = {
+    enable = true;
+    useRoutingFeatures = "both";
+    extraUpFlags = [ "--ssh" ];
+  };
+
+  networking.firewall.checkReversePath = "loose";
+}

modules/nixos/vaultwarden.nix

@@ -0,0 +1,32 @@
+{
+  containers.vault = {
+    autoStart = true;
+    bindMounts = {
+      "/var/backup/vaultwarden" = {
+        hostPath = "/mnt/sdb1/vaultwarden";
+        isReadOnly = false;
+      };
+    };
+
+    config = {
+      services = {
+        vaultwarden = {
+          enable = true;
+          backupDir = "/var/backup/vaultwarden";
+          dbBackend = "postgresql";
+          config = {
+            # SIGNUPS_ALLOWED = false;
+          };
+        };
+
+        tailscale = {
+          enable = true;
+          useRoutingFeatures = "server";
+          interfaceName = "userspace-networking";
+        };
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

modules/secrets/nextcloud.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 2otpcg 3veZJ75b0D5gej3P4fHkM8yGzVH5ldkGOCYBkdztoSw
+KXDhfvj/wfpMXqQ1MspymfJBBqRJktcSngIkEBDSUu4
+-> ssh-ed25519 40YjXQ L1yJYjyAmCi7W05BAVeFZi3mSCzBNU0/hqm2prEV/wI
+J6lFx4DD+Lj4tjsBntIlzuvZfqTQ3P7xzNZs0vcZBko
+--- 0uC4zy+Xahwt3nuFJyNyHVCIPcgwxVX8cXo0ivwQUaU
+Q€½áÁã²±•!ÅR<C385>GÑEØ)®c¦@Ç n²‡¿
âôû…ŠÚ ñ‰nz„hµk²—µ€r

modules/secrets/secrets.nix

@@ -0,0 +1,13 @@
+let
+  Mac-von-Jan = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPTpgedzJ7vs3GMOjUeQGkAzGhNZRhvMMz9Z1whaWieE";
+  galanthus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIZYQao2OKQxyic+I327VZ7lQECh9hSS9cgsls3e/a1u";
+  all = [
+    Mac-von-Jan
+    galanthus
+  ];
+in
+{
+  "nextcloud.age".publicKeys = all;
+  "forgejo-runner-token.age".publicKeys = all;
+  "openai.age".publicKeys = all;
+}