ringofstorms/dotfiles
ringofstorms/dotfiles
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bunch of updates to use more effecient DNS split paths

Browse source
This commit is contained in:
RingOfStorms (Joshua Bell) 2025-10-09 23:02:10 -05:00
parent 160be6071e
commit 1717f8e3e9
15 changed files with 151 additions and 1145 deletions
Download patch file Download diff file Expand all files Collapse all files

12
common/flake.lock generated
View file

@ -266,11 +266,11 @@
"xdph": "xdph"
},
"locked": {
"lastModified": 1759837778,
"narHash": "sha256-12GZqSrRYyhKl7NpNMUQECDi/Zyx17QZhhQ7+mBJMns=",
"lastModified": 1759988134,
"narHash": "sha256-uVaAXjJgo2/uGJz6lD+Bn5nBBmW5AAr2n8lW7v7h0PI=",
"owner": "hyprwm",
"repo": "Hyprland",
"rev": "5ba2d2217b649c4ca2db7e3f383b3f6af6e70d65",
"rev": "b965fb2a40b132209b58f511e2604a2939461818",
"type": "github"
},
"original": {
@ -413,11 +413,11 @@
]
},
"locked": {
"lastModified": 1759490926,
"narHash": "sha256-7IbZGJ5qAAfZsGhBHIsP8MBsfuFYS0hsxYHVkkeDG5Q=",
"lastModified": 1759619523,
"narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
"owner": "hyprwm",
"repo": "hyprutils",
"rev": "94cce794344538c4d865e38682684ec2bbdb2ef3",
"rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
"type": "github"
},
"original": {

48
flake.lock generated
View file

@ -44,11 +44,11 @@
]
},
"locked": {
"lastModified": 1755946532,
"narHash": "sha256-POePremlUY5GyA1zfbtic6XLxDaQcqHN6l+bIxdT5gc=",
"lastModified": 1759499898,
"narHash": "sha256-UNzYHLWfkSzLHDep5Ckb5tXc0fdxwPIrT+MY4kpQttM=",
"owner": "hyprwm",
"repo": "aquamarine",
"rev": "81584dae2df6ac79f6b6dae0ecb7705e95129ada",
"rev": "655e067f96fd44b3f5685e17f566b0e4d535d798",
"type": "github"
},
"original": {
@ -237,11 +237,11 @@
]
},
"locked": {
"lastModified": 1758192433,
"narHash": "sha256-CR6RnqEJSTiFgA6KQY4TTLUWbZ8RBnb+hxQqesuQNzQ=",
"lastModified": 1759490292,
"narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
"owner": "hyprwm",
"repo": "hyprgraphics",
"rev": "c44e749dd611521dee940d00f7c444ee0ae4cfb7",
"rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
"type": "github"
},
"original": {
@ -266,11 +266,11 @@
"xdph": "xdph"
},
"locked": {
"lastModified": 1759094452,
"narHash": "sha256-j7IOTFnQRDjX4PzYb2p6CPviAc8cDrcorzGpM8J89uM=",
"lastModified": 1759988134,
"narHash": "sha256-uVaAXjJgo2/uGJz6lD+Bn5nBBmW5AAr2n8lW7v7h0PI=",
"owner": "hyprwm",
"repo": "Hyprland",
"rev": "f854b5bffbdd13cfe7edad0ee157d6947ff99619",
"rev": "b965fb2a40b132209b58f511e2604a2939461818",
"type": "github"
},
"original": {
@ -359,11 +359,11 @@
]
},
"locked": {
"lastModified": 1757694755,
"narHash": "sha256-j+w5QUUr2QT/jkxgVKecGYV8J7fpzXCMgzEEr6LG9ug=",
"lastModified": 1759080228,
"narHash": "sha256-RgDoAja0T1hnF0pTc56xPfLfFOO8Utol2iITwYbUhTk=",
"owner": "hyprwm",
"repo": "hyprland-qtutils",
"rev": "5ffdfc13ed03df1dae5084468d935f0a3f2c9a4c",
"rev": "629b15c19fa4082e4ce6be09fdb89e8c3312aed7",
"type": "github"
},
"original": {
@ -388,11 +388,11 @@
]
},
"locked": {
"lastModified": 1756810301,
"narHash": "sha256-wgZ3VW4VVtjK5dr0EiK9zKdJ/SOqGIBXVG85C3LVxQA=",
"lastModified": 1758927902,
"narHash": "sha256-LZgMds7M94+vuMql2bERQ6LiFFdhgsEFezE4Vn+Ys3A=",
"owner": "hyprwm",
"repo": "hyprlang",
"rev": "3d63fb4a42c819f198deabd18c0c2c1ded1de931",
"rev": "4dafa28d4f79877d67a7d1a654cddccf8ebf15da",
"type": "github"
},
"original": {
@ -413,11 +413,11 @@
]
},
"locked": {
"lastModified": 1756117388,
"narHash": "sha256-oRDel6pNl/T2tI+nc/USU9ZP9w08dxtl7hiZxa0C/Wc=",
"lastModified": 1759619523,
"narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
"owner": "hyprwm",
"repo": "hyprutils",
"rev": "b2ae3204845f5f2f79b4703b441252d8ad2ecfd0",
"rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
"type": "github"
},
"original": {
@ -485,11 +485,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1758198701,
"narHash": "sha256-7To75JlpekfUmdkUZewnT6MoBANS0XVypW6kjUOXQwc=",
"lastModified": 1759381078,
"narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "0147c2f1d54b30b5dd6d4a8c8542e8d7edf93b5d",
"rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
"type": "github"
},
"original": {
@ -501,11 +501,11 @@
},
"nixpkgs_3": {
"locked": {
"lastModified": 1758690382,
"narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=",
"lastModified": 1759831965,
"narHash": "sha256-vgPm2xjOmKdZ0xKA6yLXPJpjOtQPHfaZDRtH+47XEBo=",
"owner": "nixos",
"repo": "nixpkgs",
"rev": "e643668fd71b949c53f8626614b21ff71a07379d",
"rev": "c9b6fb798541223bbb396d287d16f43520250518",
"type": "github"
},
"original": {

3
hosts/h001/containers/forgejo.nix
View file

@ -69,6 +69,9 @@ in
virtualHosts = {
# forgejo http traffic
"git.joshuabell.xyz" = {
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations."/" = {
proxyPass = "http://10.0.0.2:3000";
};

5
hosts/h001/containers/opengist.nix
View file

@ -29,8 +29,9 @@ in
'';
services.nginx.virtualHosts."gist.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

5
hosts/h001/containers/zitadel.nix
View file

@ -68,8 +68,9 @@ in
options = { };
config = {
services.nginx.virtualHosts."sso.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

5
hosts/h001/mods/n8n.nix
View file

@ -6,8 +6,9 @@
config = {
services.nginx.virtualHosts = {
"n8n.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

5
hosts/h001/mods/oauth2-proxy.nix
View file

@ -45,8 +45,9 @@ in
};
services.nginx.virtualHosts."sso-proxy.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

5
hosts/h001/mods/openwebui.nix
View file

@ -17,8 +17,9 @@ in
options = { };
config = {
services.nginx.virtualHosts."chat.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;

7
hosts/h001/mods/trilium.nix
View file

@ -44,8 +44,9 @@ in
};
services.nginx.virtualHosts = {
"notes.joshuabell.xyz" = {
# enableACME = true;
# forceSSL = true;
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = {
"/" = {
proxyWebsockets = true;
@ -54,6 +55,8 @@ in
};
};
};
# TODO revisit, am I going to use the native app or web version
# this is only needed for the app that can't handle the oauth flow
"trilium_overlay" = {
serverName = "h001.net.joshuabell.xyz";
listen = [

1115
hosts/linode/l001/flake.lock generated
View file

File diff suppressed because it is too large Load diff

12
hosts/linode/l001/flake.nix
View file

@ -1,9 +1,10 @@
{
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
home-manager.url = "github:rycee/home-manager/release-24.11";
deploy-rs.url = "github:serokell/deploy-rs";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles";
ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?rev=39edfefa5871d07c9f88ce92a55995eb347d9b09";
common.inputs.home-manager.follows = "home-manager";
};
outputs =
@ -11,7 +12,6 @@
self,
nixpkgs,
common,
ros_neovim,
deploy-rs,
...
}:
@ -40,7 +40,6 @@
lib.nixosSystem {
modules = [
common.nixosModules.default
ros_neovim.nixosModules.default
./configuration.nix
./hardware-configuration.nix
./linode.nix
@ -49,11 +48,6 @@
(
{ config, pkgs, ... }:
{
environment.systemPackages = with pkgs; [
bitwarden
vaultwarden
];
ringofstorms_common = {
systemName = configuration_name;
general = {

26
hosts/linode/l001/headscale.nix
View file

@ -1,6 +1,5 @@
{ pkgs, ... }:
{
config = {
# TODO backup /var/lib/headscale data
# TODO https://github.com/gurucomputing/headscale-ui ?
@ -17,6 +16,31 @@
dns = {
magic_dns = true;
base_domain = "net.joshuabell.xyz";
extra_records =
let
h001ARecord = name: {
type = "A";
name = "${name}.joshuabell.xyz";
value = "100.64.0.13";
};
in
[
# {
# type = "A";
# name = "jellyfin.joshuabell.xyz";
# value = "100.64.0.13";
# }
h001ARecord "jellyfin"
h001ARecord "media"
h001ARecord "notes"
h001ARecord "chat"
h001ARecord "sso-proxy"
h001ARecord "n8n"
h001ARecord "sso"
h001ARecord "gist"
h001ARecord "git"
];
};
};
};

41
hosts/linode/l001/nginx.nix
View file

@ -4,6 +4,7 @@
{
security.acme.acceptTerms = true;
security.acme.email = "admin@joshuabell.xyz";
# security.acme.default.email = "admin@joshuabell.xyz";
services.nginx = {
enable = true;
recommendedGzipSettings = true;
@ -11,29 +12,16 @@
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts = {
# default that is put first for fallbacks
# Note that order here doesn't matter it orders alphabetically so `0` puts it first
# I had an issue tha the first SSL port 443 site would catch any https traffic instead
# of hitting my default fallback and this fixes that issue and ensure this is hit instead
"001.linodes.joshuabell.xyz" = {
default = true;
enableACME = true;
forceSSL = true;
locations."/" = {
return = "444"; # 404 for not found or 444 for drop
};
};
"172.236.111.33" = {
locations."/" = {
return = "444";
};
};
"2600:3c06::f03c:95ff:fe1c:84d3" = {
locations."/" = {
return = "444";
};
};
# "172.236.111.33" = {
# locations."/" = {
# return = "444";
# };
# };
# "2600:3c06::f03c:95ff:fe1c:84d3" = {
# locations."/" = {
# return = "444";
# };
# };
"headscale.joshuabell.xyz" = {
enableACME = true;
forceSSL = true;
@ -42,6 +30,13 @@
proxyPass = "http://localhost:8080"; # headscale
};
};
"_" = {
rejectSSL = true;
default = true;
locations."/" = {
return = "444"; # 404 for not found or 444 for drop
};
};
};
};

2
hosts/lio/flake.nix
View file

@ -79,6 +79,8 @@
upkgs.ladybird
google-chrome
trilium-desktop
dig
traceroute
];
# Also allow this key to work for root user, this will let us use this as a remote builder easier
users.users.root.openssh.authorizedKeys.keys = [

5
hosts/oracle/o001/flake.nix
View file

@ -19,6 +19,7 @@
}:
let
configuration_name = "o001";
system = "aarch64-linux";
lib = nixpkgs.lib;
in
{
@ -30,7 +31,7 @@
];
nodes.${configuration_name} = {
hostname = "64.181.210.7";
targetPlatform = "aarch64-linux";
targetPlatform = system;
profiles.system = {
user = "root";
path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.${configuration_name};
@ -41,7 +42,7 @@
nixosConfigurations = {
nixos = self.nixosConfigurations.${configuration_name};
"${configuration_name}" = lib.nixosSystem {
system = "aarch64-linux";
inherit system;
modules = [
common.nixosModules.default
ros_neovim.nixosModules.default