flake.lock

@@ -421,7 +421,8 @@
         "nixpkgs-rust-analyzer": "nixpkgs-rust-analyzer",
         "nixpkgs-stable": "nixpkgs-stable",
         "nur": "nur",
-        "sops": "sops"
+        "sops": "sops",
+        "veracrypt": "veracrypt"
       }
     },
     "rust-analyzer-src": {
@@ -544,6 +545,22 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "veracrypt": {
+      "locked": {
+        "lastModified": 1696681798,
+        "narHash": "sha256-tvga08j8IOHrRbEnqJDc6bzO4la5i7ywf23kLs8W0OY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2bbbf414fed6ab89cd971f5645da692dad6d9420",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "2bbbf414fed6ab89cd971f5645da692dad6d9420",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -1,206 +1,228 @@
 {
   description = "NixOS configuration with flakes";
-  outputs = { alejandra, cryptpad, darwin, disko, endless-sky, flake-compat
+  outputs = {
-    , flake-utils, helix, home-manager, nil, nix-ld, nixos-hardware
+    alejandra,
-    , nixpkgs-master, nixpkgs-nixos-unstable, nixpkgs-rust-analyzer
+    cryptpad,
-    , nixpkgs-stable, nur, self, sops, }@inputs:
+    darwin,
-    let
+    disko,
-      mkServer = pkgs: system: hostname:
+    endless-sky,
-        pkgs.lib.nixosSystem {
+    flake-compat,
-          inherit system;
+    flake-utils,
-          modules = [
+    helix,
-            (./. + "/nixos/boxes/${hostname}")
+    home-manager,
-            (import ./nixos/server-common.nix)
+    nil,
-            sops.nixosModules.sops
+    nix-ld,
-            disko.nixosModules.disko
+    nixos-hardware,
-            ({ pkgs, ... }: {
+    nixpkgs-master,
-              nixpkgs.overlays = [ inputs.cryptpad.overlays.default ];
+    nixpkgs-nixos-unstable,
-            })
+    nixpkgs-rust-analyzer,
-            inputs.cryptpad.nixosModules.cryptpad
+    nixpkgs-stable,
-          ];
+    nur,
-          specialArgs = { inherit inputs system; };
+    self,
-        };
+    sops,
-      mkRaspi = pkgs: hostname:
+    veracrypt,
-        pkgs.lib.nixosSystem {
+  } @ inputs: let
-          system = "aarch64-linux";
+    mkServer = pkgs: system: hostname:
-          modules =
+      pkgs.lib.nixosSystem {
-            [ (./. + "/nixos/boxes/${hostname}") sops.nixosModules.sops ];
+        inherit system;
-          specialArgs = { inherit inputs; };
+        modules = [
-        };
+          (./. + "/nixos/boxes/${hostname}")
-      mkKiosk = pkgs: system: hostname:
+          (import ./nixos/server-common.nix)
-        pkgs.lib.nixosSystem {
+          sops.nixosModules.sops
-          inherit system;
+          disko.nixosModules.disko
-          modules = [
+          ({pkgs, ...}: {
-            (./. + "/nixos/boxes/${hostname}")
+            nixpkgs.overlays = [inputs.cryptpad.overlays.default];
-            (import ./nixos/common.nix)
+          })
-            sops.nixosModules.sops
+          inputs.cryptpad.nixosModules.cryptpad
-
+        ];
-            home-manager.nixosModules.home-manager
+        specialArgs = {inherit inputs system;};
-            {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users.cyryl = {
-                imports =
-                  [ ./nixos/home-manager ./nixos/home-manager/linux.nix ];
-                _module.args.inputs = inputs;
-                _module.args.system = system;
-              };
-            }
-          ];
-          specialArgs = {
-            inherit inputs system;
-            nixpkgs-nixos-stable-and-unfree = import nixpkgs-stable {
-              inherit system;
-              config = { allowUnfree = true; };
-            };
-            nixpkgs-nixos-unstable-and-unfree = import nixpkgs-nixos-unstable {
-              inherit system;
-              config = { allowUnfree = true; };
-            };
-          };
-        };
-      mkWorkstation = pkgs: system: hostname:
-        pkgs.lib.nixosSystem {
-          inherit system;
-          modules = [
-            (./. + "/nixos/boxes/${hostname}")
-            (import ./nixos/email-accounts.nix)
-            (import ./nixos/common.nix)
-            sops.nixosModules.sops
-            disko.nixosModules.disko
-            nix-ld.nixosModules.nix-ld
-            { programs.nix-ld.dev.enable = true; }
-            home-manager.nixosModules.home-manager
-            {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users.cyryl = {
-                imports =
-                  [ ./nixos/home-manager ./nixos/home-manager/linux.nix ];
-                _module.args.inputs = inputs;
-                _module.args.system = system;
-              };
-            }
-          ];
-          specialArgs = {
-            inherit inputs system;
-            nixpkgs-nixos-stable-and-unfree = import nixpkgs-stable {
-              inherit system;
-              config = { allowUnfree = true; };
-            };
-            nixpkgs-nixos-unstable =
-              import nixpkgs-nixos-unstable { inherit system; };
-            nixpkgs-nixos-unstable-and-unfree = import nixpkgs-nixos-unstable {
-              inherit system;
-              config = { allowUnfree = true; };
-            };
-          };
-        };
-      mkShell = packageSet: system:
-        let pkgs = packageSet.legacyPackages.${system};
-        in pkgs.mkShell {
-          packages = with pkgs; [
-            inputs.alejandra.defaultPackage.${system}
-            cacert
-            git
-            git-lfs
-            nixpkgs-fmt
-            openssh
-            openssl
-            pkg-config
-            statix
-          ];
-        };
-    in {
-      devShells = {
-        "x86_64-darwin".default = mkShell nixpkgs-stable "x86_64-darwin";
-        "x86_64-linux".default = mkShell nixpkgs-stable "x86_64-linux";
       };
-      darwinConfigurations = {
+    mkRaspi = pkgs: hostname:
-        "FORM3-CYRYLPLOTN" = darwin.lib.darwinSystem rec {
+      pkgs.lib.nixosSystem {
-          system = "x86_64-darwin";
+        system = "aarch64-linux";
-          modules = [
+        modules = [
-            (./. + "/nixos/boxes/form3")
+          (./. + "/nixos/boxes/${hostname}")
-            home-manager.darwinModules.home-manager
+          sops.nixosModules.sops
-            {
+        ];
-              home-manager.useGlobalPkgs = true;
+        specialArgs = {inherit inputs;};
-              home-manager.useUserPackages = true;
+      };
-              home-manager.users.cyryl = {
+    mkKiosk = pkgs: system: hostname:
-                imports = [ ./nixos/home-manager ];
+      pkgs.lib.nixosSystem {
-                _module.args.inputs = inputs;
+        inherit system;
-                _module.args.system = system;
+        modules = [
-              };
+          (./. + "/nixos/boxes/${hostname}")
-            }
+          (import ./nixos/common.nix)
-          ];
+          sops.nixosModules.sops
+
+          home-manager.nixosModules.home-manager
+          {
+            home-manager.useGlobalPkgs = true;
+            home-manager.useUserPackages = true;
+            home-manager.users.cyryl = {
+              imports = [./nixos/home-manager ./nixos/home-manager/linux.nix];
+              _module.args.inputs = inputs;
+              _module.args.system = system;
+            };
+          }
+        ];
+        specialArgs = {
+          inherit inputs system;
+          nixpkgs-nixos-stable-and-unfree = import nixpkgs-stable {
+            inherit system;
+            config = {allowUnfree = true;};
+          };
+          nixpkgs-nixos-unstable-and-unfree = import nixpkgs-nixos-unstable {
+            inherit system;
+            config = {allowUnfree = true;};
+          };
         };
       };
-
+    mkWorkstation = pkgs: system: hostname:
-      nixosConfigurations = {
+      pkgs.lib.nixosSystem {
-        foryog = mkWorkstation nixpkgs-nixos-unstable "x86_64-linux" "foryog";
+        inherit system;
-        thinky = mkWorkstation nixpkgs-stable "x86_64-linux" "thinky";
+        modules = [
-        bolty = mkServer nixpkgs-stable "x86_64-linux" "bolty";
+          (./. + "/nixos/boxes/${hostname}")
-        vpsfree1 = mkServer nixpkgs-stable "x86_64-linux" "vpsfree1";
+          (import ./nixos/email-accounts.nix)
-        cupsnet = mkServer nixpkgs-stable "aarch64-linux" "cupsnet";
+          (import ./nixos/common.nix)
-        mb1 = mkServer nixpkgs-stable "x86_64-linux" "mb1";
+          sops.nixosModules.sops
-        homescreen = mkRaspi nixpkgs-stable "homescreen";
+          disko.nixosModules.disko
-
+          nix-ld.nixosModules.nix-ld
-        bootstrap = nixpkgs-stable.lib.nixosSystem rec {
+          {programs.nix-ld.dev.enable = true;}
-          system = "x86_64-linux";
+          home-manager.nixosModules.home-manager
-          modules = [ (./. + "/nixos/boxes/bootstrap") sops.nixosModules.sops ];
+          {
-          specialArgs = {
+            home-manager.useGlobalPkgs = true;
-            inherit inputs system;
+            home-manager.useUserPackages = true;
-            nixpkgs-nixos-unstable-and-unfree = import nixpkgs-nixos-unstable {
+            home-manager.users.cyryl = {
-              inherit system;
+              imports = [./nixos/home-manager ./nixos/home-manager/linux.nix];
-              config = { allowUnfree = true; };
+              _module.args.inputs = inputs;
+              _module.args.system = system;
             };
+          }
+        ];
+        specialArgs = {
+          inherit inputs system;
+          nixpkgs-nixos-stable-and-unfree = import nixpkgs-stable {
+            inherit system;
+            config = {allowUnfree = true;};
+          };
+          nixpkgs-nixos-unstable = import nixpkgs-nixos-unstable {
+            inherit system;
+          };
+          nixpkgs-nixos-unstable-and-unfree = import nixpkgs-nixos-unstable {
+            inherit system;
+            config = {allowUnfree = true;};
+          };
+          nixpkgs-veracrypt = import veracrypt {
+            inherit system;
+            config = {allowUnfree = true;};
           };
         };
-        # nix build .#nixosConfigurations.raspiimage.config.system.build.sdImage
+      };
-        # sudo dd if=result/sd-image/nixos-sd-image-21.11.20211201.a640d83-aarch64-linux.img of=/dev/sda bs=4M conv=fsync status=progress
+    mkShell = packageSet: system: let
-        # make sure to update eeprom https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_4#Board-specific_installation_notes
+      pkgs = packageSet.legacyPackages.${system};
-        raspiimage = nixpkgs-stable.lib.nixosSystem {
+    in
-          system = "aarch64-linux";
+      pkgs.mkShell {
-          modules = [
+        packages = with pkgs; [
-            (import
+          inputs.alejandra.defaultPackage.${system}
-              "${inputs.nixpkgs-stable}/nixos/modules/installer/sd-card/sd-image-aarch64-installer.nix")
+          cacert
-            {
+          git
-              environment.systemPackages =
+          git-lfs
-                with nixpkgs-nixos-unstable.legacyPackages."aarch64-linux"; [
+          nixpkgs-fmt
-                  neovim
+          openssh
-                  htop
+          openssl
-                  btop
+          pkg-config
-                  atop
+          statix
-                ];
+        ];
-
+      };
-              networking.networkmanager.enable = false;
+  in {
-              hardware.enableRedistributableFirmware = true;
+    devShells = {
-              networking.wireless.enable = true;
+      "x86_64-darwin".default = mkShell nixpkgs-stable "x86_64-darwin";
-
+      "x86_64-linux".default = mkShell nixpkgs-stable "x86_64-linux";
-              services.openssh = {
+    };
-                enable = true;
+    darwinConfigurations = {
-                permitRootLogin =
+      "FORM3-CYRYLPLOTN" = darwin.lib.darwinSystem rec {
-                  nixpkgs-stable.lib.mkForce "prohibit-password";
+        system = "x86_64-darwin";
-                passwordAuthentication = false;
+        modules = [
-              };
+          (./. + "/nixos/boxes/form3")
-
+          home-manager.darwinModules.home-manager
-              services.xserver = {
+          {
-                enable = true;
+            home-manager.useGlobalPkgs = true;
-                displayManager.lightdm.enable = true;
+            home-manager.useUserPackages = true;
-                desktopManager.gnome.enable = true;
+            home-manager.users.cyryl = {
-                libinput.enable = true;
+              imports = [./nixos/home-manager];
-              };
+              _module.args.inputs = inputs;
-
+              _module.args.system = system;
-              users.extraUsers.root.openssh.authorizedKeys.keys = [
+            };
-                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEo4R+6J3h6Ix3xWpOMdU7Es1/YxFchHw0c+kcCOJxFb cyryl@foureighty"
+          }
-              ];
+        ];
-              sdImage.compressImage = false;
-              console.earlySetup = true;
-            }
-          ];
-          specialArgs = { inherit inputs; };
-        };
       };
     };
+
+    nixosConfigurations = {
+      foryog = mkWorkstation nixpkgs-nixos-unstable "x86_64-linux" "foryog";
+      thinky = mkWorkstation nixpkgs-stable "x86_64-linux" "thinky";
+      bolty = mkServer nixpkgs-stable "x86_64-linux" "bolty";
+      vpsfree1 = mkServer nixpkgs-stable "x86_64-linux" "vpsfree1";
+      cupsnet = mkServer nixpkgs-stable "aarch64-linux" "cupsnet";
+      mb1 = mkServer nixpkgs-stable "x86_64-linux" "mb1";
+      homescreen = mkRaspi nixpkgs-stable "homescreen";
+
+      bootstrap = nixpkgs-stable.lib.nixosSystem rec {
+        system = "x86_64-linux";
+        modules = [(./. + "/nixos/boxes/bootstrap") sops.nixosModules.sops];
+        specialArgs = {
+          inherit inputs system;
+          nixpkgs-nixos-unstable-and-unfree = import nixpkgs-nixos-unstable {
+            inherit system;
+            config = {allowUnfree = true;};
+          };
+        };
+      };
+      # nix build .#nixosConfigurations.raspiimage.config.system.build.sdImage
+      # sudo dd if=result/sd-image/nixos-sd-image-21.11.20211201.a640d83-aarch64-linux.img of=/dev/sda bs=4M conv=fsync status=progress
+      # make sure to update eeprom https://nixos.wiki/wiki/NixOS_on_ARM/Raspberry_Pi_4#Board-specific_installation_notes
+      raspiimage = nixpkgs-stable.lib.nixosSystem {
+        system = "aarch64-linux";
+        modules = [
+          (import
+            "${inputs.nixpkgs-stable}/nixos/modules/installer/sd-card/sd-image-aarch64-installer.nix")
+          {
+            environment.systemPackages = with nixpkgs-nixos-unstable.legacyPackages."aarch64-linux"; [
+              neovim
+              htop
+              btop
+              atop
+            ];
+
+            networking.networkmanager.enable = false;
+            hardware.enableRedistributableFirmware = true;
+            networking.wireless.enable = true;
+
+            services.openssh = {
+              enable = true;
+              permitRootLogin =
+                nixpkgs-stable.lib.mkForce "prohibit-password";
+              passwordAuthentication = false;
+            };
+
+            services.xserver = {
+              enable = true;
+              displayManager.lightdm.enable = true;
+              desktopManager.gnome.enable = true;
+              libinput.enable = true;
+            };
+
+            users.extraUsers.root.openssh.authorizedKeys.keys = [
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEo4R+6J3h6Ix3xWpOMdU7Es1/YxFchHw0c+kcCOJxFb cyryl@foureighty"
+            ];
+            sdImage.compressImage = false;
+            console.earlySetup = true;
+          }
+        ];
+        specialArgs = {inherit inputs;};
+      };
+    };
+  };
   inputs = {
     nixpkgs-master = {
       type = "github";
@@ -232,6 +254,12 @@
       repo = "nixpkgs";
       ref = "2100c4926200b1ebbee032ad22113597195932f2";
     };
+    veracrypt = {
+      type = "github";
+      owner = "NixOS";
+      repo = "nixpkgs";
+      ref = "2bbbf414fed6ab89cd971f5645da692dad6d9420";
+    };
     nixos-hardware = {
       type = "github";
       owner = "NixOS";
@@ -301,7 +329,9 @@
     };
     cryptpad = {
       url = "github:michaelshmitty/cryptpad-flake";
-      inputs = { nixpkgs.follows = "nixpkgs-stable"; };
+      inputs = {
+        nixpkgs.follows = "nixpkgs-stable";
+      };
     };
     disko = {
       url = "github:nix-community/disko";

nixos/boxes/cupsnet/gitea-runner.nix

@@ -3,13 +3,6 @@ let
   unstable = inputs.nixpkgs-nixos-unstable;
   package = unstable.legacyPackages."${system}".gitea-actions-runner;
 in {
-
-  disabledModules =
-    [ "services/continuous-integration/gitea-actions-runner.nix" ];
-  imports = [
-    "${unstable}/nixos/modules/services/continuous-integration/gitea-actions-runner.nix"
-  ];
-
   sops.secrets."gitea-runner-token" = {
     sopsFile = ./gitea-runner-token.sops;
     format = "binary";

nixos/boxes/foryog/default.nix

@@ -51,7 +51,6 @@
       "vscode-extension-ms-vscode-cpptools"
       "vscode-with-extensions"
       "vscode"
-      "veracrypt"
     ];
 
   home-manager.users.cyryl = { ... }: {

nixos/common.nix

@@ -1,5 +1,12 @@
-{ config, pkgs, lib, inputs, nixpkgs-nixos-unstable-and-unfree, ... }:
+{
-let
+  config,
+  pkgs,
+  lib,
+  inputs,
+  nixpkgs-nixos-unstable-and-unfree,
+  nixpkgs-veracrypt,
+  ...
+}: let
   stateVersion = "23.11";
   username = "cyryl";
 in {
@@ -30,7 +37,7 @@ in {
     tmux
     usbutils
     wget
-    veracrypt
+    nixpkgs-veracrypt.veracrypt
   ];
 
   i18n.defaultLocale = "en_GB.UTF-8";
@@ -54,10 +61,9 @@ in {
     shell = pkgs.zsh;
   };
 
-  networking.nameservers =
+  networking.nameservers = ["9.9.9.9" "2620:fe::fe" "149.112.112.112" "2620:fe::9"];
-    [ "9.9.9.9" "2620:fe::fe" "149.112.112.112" "2620:fe::9" ];
 
-  networking.hosts = { "10.11.99.1" = [ "remarkable" ]; };
+  networking.hosts = {"10.11.99.1" = ["remarkable"];};
 
   programs.light.enable = true;
   programs.adb.enable = true;
@@ -80,13 +86,13 @@ in {
     enable = true;
     autoPrune.enable = true;
     daemon.settings = {
-      "insecure-registries" = [ "vpsfree1.raptor-carp.ts.net:5000" ];
+      "insecure-registries" = ["vpsfree1.raptor-carp.ts.net:5000"];
     };
   };
 
   fonts.fontconfig = {
     enable = true;
-    defaultFonts.monospace = [ "BerkeleyMono Nerd Font" ];
+    defaultFonts.monospace = ["BerkeleyMono Nerd Font"];
   };
 
   fonts.packages = with pkgs; [
@@ -112,7 +118,7 @@ in {
     '';
   };
 
-  system = { inherit stateVersion; };
+  system = {inherit stateVersion;};
   system.activationScripts.diff = ''
     ${pkgs.nvd}/bin/nvd --nix-bin-dir=${pkgs.nix}/bin diff /run/current-system "$systemConfig"
   '';