ringofstorms/dotfiles
ringofstorms/dotfiles
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge branch 'master' of ssh://git.joshuabell.xyz:3032/ringofstorms/dotfiles

Browse source
This commit is contained in:
RingOfStorms (Joshua Bell) 2025-11-09 23:54:08 -06:00
commit 023f3b5e18
23 changed files with 549 additions and 848 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hosts/h001/configuration.nix
View file

@ -1,4 +0,0 @@
{ ... }:
{
system.stateVersion = "24.11"; # Did you read the comment?
}

844
hosts/h001/flake.lock generated
View file

File diff suppressed because it is too large Load diff

144
hosts/h001/flake.nix
View file

@ -1,15 +1,20 @@
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
home-manager.url = "github:rycee/home-manager/release-25.05";
# nixpkgs-unstable.url = "github:wrvsrx/nixpkgs/fix-open-webui";
open-webui-nixpkgs.url = "github:nixos/nixpkgs/e9f00bd893984bc8ce46c895c3bf7cac95331127";
open-webui-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
litellm-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
trilium-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
oauth2-proxy-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
pinchflat-nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
# Use relative to get current version for testing
# common.url = "path:../../common";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
# common.url = "path:../../flakes/common";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
# secrets.url = "path:../../flakes/secrets";
secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
@ -19,93 +24,110 @@
outputs =
{
nixpkgs,
home-manager,
common,
secrets,
ros_neovim,
nixarr,
...
}@inputs:
let
configuration_name = "h001";
system = "x86_64-linux";
stateVersion = "24.11";
primaryUser = "luser";
lib = nixpkgs.lib;
in
{
nixosConfigurations = {
"${configuration_name}" = (
lib.nixosSystem {
inherit system;
specialArgs = {
inherit inputs;
};
modules = [
common.nixosModules.default
home-manager.nixosModules.default
secrets.nixosModules.default
ros_neovim.nixosModules.default
common.nixosModules.essentials
common.nixosModules.git
common.nixosModules.boot_systemd
common.nixosModules.hardening
common.nixosModules.nix_options
common.nixosModules.podman
common.nixosModules.tailnet
common.nixosModules.timezone_auto
common.nixosModules.tty_caps_esc
common.nixosModules.zsh
nixarr.nixosModules.default
./configuration.nix
./hardware-configuration.nix
./mods
./nginx.nix
./containers
(
{ config, pkgs, ... }:
{
rec {
# Home Manager
home-manager = {
useUserPackages = true;
useGlobalPkgs = true;
backupFileExtension = "bak";
# add all normal users to home manager so it applies to them
users = lib.mapAttrs (name: user: {
home.stateVersion = stateVersion;
programs.home-manager.enable = true;
}) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
sharedModules = [
common.homeManagerModules.tmux
common.homeManagerModules.atuin
common.homeManagerModules.direnv
common.homeManagerModules.git
common.homeManagerModules.postgres_cli_options
common.homeManagerModules.ssh
common.homeManagerModules.starship
common.homeManagerModules.zoxide
common.homeManagerModules.zsh
];
};
# System configuration
system.stateVersion = stateVersion;
networking.hostName = configuration_name;
programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${configuration_name}";
nixpkgs.config.allowUnfree = true;
users.users = {
"${primaryUser}" = {
isNormalUser = true;
initialPassword = "password1";
shell = pkgs.zsh;
extraGroups = [
"wheel"
"networkmanager"
"video"
"input"
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZigrRMF/HHMhjBIwiOnS2pqbOz8Az19tch680BGvmu nix2h001"
];
};
root = {
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZigrRMF/HHMhjBIwiOnS2pqbOz8Az19tch680BGvmu nix2h001"
];
};
};
environment.systemPackages = with pkgs; [
lua
sqlite
ttyd
];
ringofstorms_common = {
systemName = configuration_name;
boot.systemd.enable = true;
secrets.enable = true;
general = {
reporting.enable = true;
};
programs = {
tailnet.enable = true;
ssh.enable = true;
podman.enable = true;
};
users = {
admins = [ "luser" ]; # First admin is also the primary user owning nix config
users = {
root = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZigrRMF/HHMhjBIwiOnS2pqbOz8Az19tch680BGvmu nix2h001"
];
shell = pkgs.zsh;
};
luser = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILZigrRMF/HHMhjBIwiOnS2pqbOz8Az19tch680BGvmu nix2h001"
];
extraGroups = [
"networkmanager"
"video"
"input"
];
shell = pkgs.zsh;
};
};
};
homeManager = {
users = {
luser = {
imports = with common.homeManagerModules; [
kitty
tmux
atuin
direnv
git
nix_deprecations
postgres
ssh
starship
zoxide
zsh
];
};
};
};
};
}
)
];

60
hosts/h001/mods/litellm.nix
View file

@ -43,16 +43,33 @@ in
drop_params = true;
};
model_list = [
# 宙 Proxy
# { # NOTE model discovery not working yet? https://canary.discord.com/channels/1123360753068540065/1409974123987210350/1427864010241609752
# model_name = "litellm_proxy/*";
# litellm_params = {
# model = "litellm_proxy/*";
# api_base = "http://100.64.0.8:9010/air_key";
# api_key = "os.environ/LITELLM_PROXY_API_KEY";
# };
# }
]
# Copilot
++ (builtins.map
(m: {
model_name = "copilot-${m}";
litellm_params = {
model = "github_copilot/${m}";
extra_headers = {
editor-version = "vscode/${pkgs.vscode.version}";
editor-plugin-version = "copilot/${pkgs.vscode-extensions.github.copilot.version}";
Copilot-Integration-Id = "vscode-chat";
Copilot-Vision-Request = "true";
user-agent = "GithubCopilot/${pkgs.vscode-extensions.github.copilot.version}";
};
};
})
# List from https://github.com/settings/copilot/features enabled models
[
"claude-sonnet-3.5"
"claude-sonnet-4"
"claude-sonnet-4.5"
"gemini-2.5-pro"
"openai-gpt-5"
"openai-gpt-5-mini"
]
)
# Azure
++ (builtins.map
(m: {
@ -74,36 +91,13 @@ in
# "gpt-5-codex-2025-09-15"
]
)
# Copilot
++ (builtins.map
(m: {
model_name = "copilot-${m}";
litellm_params = {
model = "github_copilot/${m}";
extra_headers = {
editor-version = "vscode/${pkgs.vscode.version}";
editor-plugin-version = "copilot/${pkgs.vscode-extensions.github.copilot.version}";
Copilot-Integration-Id = "vscode-chat";
Copilot-Vision-Request = "true";
user-agent = "GithubCopilot/${pkgs.vscode-extensions.github.copilot.version}";
};
};
})
# List from https://github.com/settings/copilot/features enabled models
[
"claude-sonnet-4.5"
"claude-sonnet-4"
"gemini-2.5-pro"
]
)
# 宙 Proxy
++ (builtins.map
(m: {
model_name = "air-${m}";
litellm_params = {
model = "litellm_proxy/${m}";
api_base = "http://100.64.0.8:9010/air_key";
api_base = "http://100.64.0.8:9010/air_prd";
api_key = "os.environ/LITELLM_PROXY_API_KEY";
};
})

25
hosts/h001/mods/openbao.nix
View file

@ -5,23 +5,38 @@
...
}:
{
services.nginx = {
virtualHosts = {
"sec.joshuabell.xyz" = {
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations."/" = {
proxyWebsockets = true;
proxyPass = "http://localhost:8200";
recommendedProxySettings = true;
};
};
};
};
services.openbao = {
enable = true;
package = pkgs.openbao;
settings = {
ui = true;
listener.default = {
type = "tcp";
address = "127.0.0.1:8200";
tls_disable = true; # nginx will handle TLS
};
storage.file = {
path = "/var/lib/openbao";
};
# Disable mlock requirement for development
# In production, you may want to enable this
disable_mlock = true;
@ -42,7 +57,7 @@
ProtectSystem = "strict";
ProtectHome = true;
ReadWritePaths = [ "/var/lib/openbao" ];
# Resource limits
LimitNOFILE = 65536;
LimitNPROC = 4096;

12
hosts/h001/mods/pinchflat.nix
View file

@ -1,10 +1,22 @@
{
lib,
inputs,
...
}:
let
declaration = "services/misc/pinchflat.nix";
nixpkgs = inputs.pinchflat-nixpkgs;
pkgs = import nixpkgs {
system = "x86_64-linux";
config.allowUnfree = true;
};
in
{
disabledModules = [ declaration ];
imports = [ "${nixpkgs}/nixos/modules/${declaration}" ];
config = {
services.pinchflat = {
package = pkgs.pinchflat;
enable = true;
port = 8945;
selfhosted = true;

1
hosts/h001/nginx.nix
View file

@ -17,6 +17,7 @@ let
in
{
# TODO transfer these to o001 to use same certs?
# Will I ever get rate limited by lets encrypt with both doing their own?
security.acme = lib.mkIf (hasSecret "linode_rw_domains") {
acceptTerms = true;
defaults.email = "admin@joshuabell.xyz";

1
hosts/h001/readme.md
View file

@ -1 +0,0 @@
Main media server and run things server, has a bunch of stuff on it I am self hosting

145
hosts/h003/flake.nix
View file

@ -1,10 +1,13 @@
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
home-manager.url = "github:rycee/home-manager/release-25.05";
# Use relative to get current version for testing
# common.url = "path:../../common";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
# common.url = "path:../../flakes/common";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/common";
# secrets.url = "path:../../flakes/secrets";
secrets.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?dir=flakes/secrets";
ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
};
@ -12,89 +15,109 @@
outputs =
{
nixpkgs,
home-manager,
common,
secrets,
ros_neovim,
...
}:
}@inputs:
let
configuration_name = "h003";
system = "x86_64-linux";
stateVersion = "24.11";
primaryUser = "luser";
lib = nixpkgs.lib;
in
{
nixosConfigurations = {
"${configuration_name}" = (
lib.nixosSystem {
inherit system;
specialArgs = {
inherit inputs;
};
modules = [
common.nixosModules.default
home-manager.nixosModules.default
secrets.nixosModules.default
ros_neovim.nixosModules.default
common.nixosModules.essentials
common.nixosModules.git
common.nixosModules.boot_systemd
common.nixosModules.hardening
common.nixosModules.nix_options
common.nixosModules.podman
common.nixosModules.tailnet
common.nixosModules.timezone_auto
common.nixosModules.tty_caps_esc
common.nixosModules.zsh
./configuration.nix
./hardware-configuration.nix
./mods
(
{ config, pkgs, ... }:
{
rec {
# Home Manager
home-manager = {
useUserPackages = true;
useGlobalPkgs = true;
backupFileExtension = "bak";
# add all normal users to home manager so it applies to them
users = lib.mapAttrs (name: user: {
home.stateVersion = stateVersion;
programs.home-manager.enable = true;
}) (lib.filterAttrs (name: user: user.isNormalUser or false) users.users);
sharedModules = [
common.homeManagerModules.tmux
common.homeManagerModules.atuin
common.homeManagerModules.direnv
common.homeManagerModules.git
common.homeManagerModules.postgres_cli_options
common.homeManagerModules.ssh
common.homeManagerModules.starship
common.homeManagerModules.zoxide
common.homeManagerModules.zsh
];
};
# System configuration
system.stateVersion = stateVersion;
networking.hostName = configuration_name;
programs.nh.flake = "/home/${primaryUser}/.config/nixos-config/hosts/${configuration_name}";
nixpkgs.config.allowUnfree = true;
users.users = {
"${primaryUser}" = {
isNormalUser = true;
initialPassword = "password1";
shell = pkgs.zsh;
extraGroups = [
"wheel"
"networkmanager"
"video"
"input"
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3riAQ8RP5JXj2eO87JpjbM/9SrfFHcN5pEJwQpRcOl nix2h003"
];
};
root = {
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3riAQ8RP5JXj2eO87JpjbM/9SrfFHcN5pEJwQpRcOl nix2h003"
];
};
};
environment.systemPackages = with pkgs; [
lua
sqlite
# networking tools
ttyd
tcpdump
dig
];
ringofstorms_common = {
systemName = configuration_name;
boot.systemd.enable = true;
secrets.enable = true;
general = {
reporting.enable = true;
};
programs = {
tailnet.enable = true;
ssh.enable = true;
podman.enable = true;
};
users = {
admins = [ "luser" ]; # First admin is also the primary user owning nix config
users = {
root = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3riAQ8RP5JXj2eO87JpjbM/9SrfFHcN5pEJwQpRcOl nix2h003"
];
shell = pkgs.zsh;
};
luser = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3riAQ8RP5JXj2eO87JpjbM/9SrfFHcN5pEJwQpRcOl nix2h003"
];
extraGroups = [
"networkmanager"
"video"
"input"
];
shell = pkgs.zsh;
};
};
};
homeManager = {
users = {
luser = {
imports = with common.homeManagerModules; [
kitty
tmux
atuin
direnv
git
nix_deprecations
postgres
ssh
starship
zoxide
zsh
];
};
};
};
};
}
)
];

1
hosts/linode/l001/headscale.nix
View file

@ -32,6 +32,7 @@
(h001ARecord "chat")
(h001ARecord "sso-proxy")
(h001ARecord "n8n")
(h001ARecord "sec")
(h001ARecord "sso")
(h001ARecord "gist")
(h001ARecord "git")

8
hosts/lio/flake.lock generated
View file

@ -1207,11 +1207,11 @@
"rust-overlay": "rust-overlay"
},
"locked": {
"lastModified": 1761621645,
"narHash": "sha256-pbwLPnz2WEAJ4K6d/iBy0u/Rko9NLaN8gn8NqsBzUNo=",
"lastModified": 1761712156,
"narHash": "sha256-4vU7FPZFXSFguQUIPrbLQOk3VSokp6RH8t7zQoqneow=",
"ref": "refs/heads/master",
"rev": "26dd42aebb0b2bc218acf2e36113997133f4dbbd",
"revCount": 319,
"rev": "04f666dabbaced8d661693cfbe4eb7efa359ce7d",
"revCount": 320,
"type": "git",
"url": "https://git.joshuabell.xyz/ringofstorms/nvim"
},

10
hosts/lio/flake.nix
View file

@ -49,6 +49,12 @@
secrets.nixosModules.default
ros_neovim.nixosModules.default
(
{ ... }:
{
ringofstorms-nvim.includeAllRuntimeDependencies = true;
}
)
flatpaks.nixosModules.default
common.nixosModules.essentials
@ -150,6 +156,10 @@
"org.blender.Blender"
"com.rustdesk.RustDesk"
];
networking.firewall.allowedTCPPorts = [
8080
];
}
)
];

3
hosts/lio/i3_customizations.nix
View file

@ -14,7 +14,8 @@ let
'';
bg1 = ../_shared_assets/wallpapers/pixel_neon.png;
bg2 = ../_shared_assets/wallpapers/pixel_neon_v.png;
xrSetup = "xrandr --output DP-1 --mode 3840x2160 --rate 97.98 --pos 0x0 --primary; sleep 0.2; xrandr --output DP-2 --mode 3440x1440 --rate 99.98 --rotate left --left-of DP-1";
# xrSetup = "xrandr --output DP-1 --mode 3840x2160 --rate 119.88 --pos 0x0 --primary; sleep 0.2; xrandr --output DP-2 --mode 3440x1440 --rate 99.98 --rotate left --left-of DP-1";
xrSetup = "xrandr --output DP-1 --mode 3840x2160 --rate 60 --pos 0x0 --primary; sleep 0.2; xrandr --output DP-2 --mode 3440x1440 --rate 99.98 --rotate left --left-of DP-1";
xwallpaperCmd = "xwallpaper --output DP-1 --zoom ${bg1} --output DP-2 --zoom ${bg2}";
startupCmd = "sh -c 'sleep 0.2; i3-msg workspace number 7; sleep 0.2; i3-msg workspace number 1'";
i3ExtraOptions = {

7
hosts/oracle/o001/nginx.nix
View file

@ -187,6 +187,13 @@
proxyPass = "http://100.64.0.13";
};
};
"sec.joshuabell.xyz" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://100.64.0.13";
};
};
"sso.joshuabell.xyz" = {
enableACME = true;
forceSSL = true;