ringofstorms/dotfiles
ringofstorms/dotfiles
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

bunch of updates to use more effecient DNS split paths

Browse source
This commit is contained in:
RingOfStorms (Joshua Bell) 2025-10-09 23:02:10 -05:00
parent 160be6071e
commit 1717f8e3e9
15 changed files with 151 additions and 1145 deletions
Download patch file Download diff file Expand all files Collapse all files

12
common/flake.lock generated
View file

@ -266,11 +266,11 @@
"xdph": "xdph" "xdph": "xdph"
}, },
"locked": { "locked": {
"lastModified": 1759837778, "lastModified": 1759988134,
"narHash": "sha256-12GZqSrRYyhKl7NpNMUQECDi/Zyx17QZhhQ7+mBJMns=", "narHash": "sha256-uVaAXjJgo2/uGJz6lD+Bn5nBBmW5AAr2n8lW7v7h0PI=",
"owner": "hyprwm", "owner": "hyprwm",
"repo": "Hyprland", "repo": "Hyprland",
"rev": "5ba2d2217b649c4ca2db7e3f383b3f6af6e70d65", "rev": "b965fb2a40b132209b58f511e2604a2939461818",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -413,11 +413,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1759490926, "lastModified": 1759619523,
"narHash": "sha256-7IbZGJ5qAAfZsGhBHIsP8MBsfuFYS0hsxYHVkkeDG5Q=", "narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
"owner": "hyprwm", "owner": "hyprwm",
"repo": "hyprutils", "repo": "hyprutils",
"rev": "94cce794344538c4d865e38682684ec2bbdb2ef3", "rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
"type": "github" "type": "github"
}, },
"original": { "original": {

48
flake.lock generated
View file

@ -44,11 +44,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1755946532, "lastModified": 1759499898,
"narHash": "sha256-POePremlUY5GyA1zfbtic6XLxDaQcqHN6l+bIxdT5gc=", "narHash": "sha256-UNzYHLWfkSzLHDep5Ckb5tXc0fdxwPIrT+MY4kpQttM=",
"owner": "hyprwm", "owner": "hyprwm",
"repo": "aquamarine", "repo": "aquamarine",
"rev": "81584dae2df6ac79f6b6dae0ecb7705e95129ada", "rev": "655e067f96fd44b3f5685e17f566b0e4d535d798",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -237,11 +237,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1758192433, "lastModified": 1759490292,
"narHash": "sha256-CR6RnqEJSTiFgA6KQY4TTLUWbZ8RBnb+hxQqesuQNzQ=", "narHash": "sha256-T6iWzDOXp8Wv0KQOCTHpBcmAOdHJ6zc/l9xaztW6Ivc=",
"owner": "hyprwm", "owner": "hyprwm",
"repo": "hyprgraphics", "repo": "hyprgraphics",
"rev": "c44e749dd611521dee940d00f7c444ee0ae4cfb7", "rev": "9431db625cd9bb66ac55525479dce694101d6d7a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -266,11 +266,11 @@
"xdph": "xdph" "xdph": "xdph"
}, },
"locked": { "locked": {
"lastModified": 1759094452, "lastModified": 1759988134,
"narHash": "sha256-j7IOTFnQRDjX4PzYb2p6CPviAc8cDrcorzGpM8J89uM=", "narHash": "sha256-uVaAXjJgo2/uGJz6lD+Bn5nBBmW5AAr2n8lW7v7h0PI=",
"owner": "hyprwm", "owner": "hyprwm",
"repo": "Hyprland", "repo": "Hyprland",
"rev": "f854b5bffbdd13cfe7edad0ee157d6947ff99619", "rev": "b965fb2a40b132209b58f511e2604a2939461818",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -359,11 +359,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1757694755, "lastModified": 1759080228,
"narHash": "sha256-j+w5QUUr2QT/jkxgVKecGYV8J7fpzXCMgzEEr6LG9ug=", "narHash": "sha256-RgDoAja0T1hnF0pTc56xPfLfFOO8Utol2iITwYbUhTk=",
"owner": "hyprwm", "owner": "hyprwm",
"repo": "hyprland-qtutils", "repo": "hyprland-qtutils",
"rev": "5ffdfc13ed03df1dae5084468d935f0a3f2c9a4c", "rev": "629b15c19fa4082e4ce6be09fdb89e8c3312aed7",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -388,11 +388,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1756810301, "lastModified": 1758927902,
"narHash": "sha256-wgZ3VW4VVtjK5dr0EiK9zKdJ/SOqGIBXVG85C3LVxQA=", "narHash": "sha256-LZgMds7M94+vuMql2bERQ6LiFFdhgsEFezE4Vn+Ys3A=",
"owner": "hyprwm", "owner": "hyprwm",
"repo": "hyprlang", "repo": "hyprlang",
"rev": "3d63fb4a42c819f198deabd18c0c2c1ded1de931", "rev": "4dafa28d4f79877d67a7d1a654cddccf8ebf15da",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -413,11 +413,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1756117388, "lastModified": 1759619523,
"narHash": "sha256-oRDel6pNl/T2tI+nc/USU9ZP9w08dxtl7hiZxa0C/Wc=", "narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
"owner": "hyprwm", "owner": "hyprwm",
"repo": "hyprutils", "repo": "hyprutils",
"rev": "b2ae3204845f5f2f79b4703b441252d8ad2ecfd0", "rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -485,11 +485,11 @@
}, },
"nixpkgs_2": { "nixpkgs_2": {
"locked": { "locked": {
"lastModified": 1758198701, "lastModified": 1759381078,
"narHash": "sha256-7To75JlpekfUmdkUZewnT6MoBANS0XVypW6kjUOXQwc=", "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "0147c2f1d54b30b5dd6d4a8c8542e8d7edf93b5d", "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -501,11 +501,11 @@
}, },
"nixpkgs_3": { "nixpkgs_3": {
"locked": { "locked": {
"lastModified": 1758690382, "lastModified": 1759831965,
"narHash": "sha256-NY3kSorgqE5LMm1LqNwGne3ZLMF2/ILgLpFr1fS4X3o=", "narHash": "sha256-vgPm2xjOmKdZ0xKA6yLXPJpjOtQPHfaZDRtH+47XEBo=",
"owner": "nixos", "owner": "nixos",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "e643668fd71b949c53f8626614b21ff71a07379d", "rev": "c9b6fb798541223bbb396d287d16f43520250518",
"type": "github" "type": "github"
}, },
"original": { "original": {

3
hosts/h001/containers/forgejo.nix
View file

@ -69,6 +69,9 @@ in
virtualHosts = { virtualHosts = {
# forgejo http traffic # forgejo http traffic
"git.joshuabell.xyz" = { "git.joshuabell.xyz" = {
addSSL = true;
sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations."/" = { locations."/" = {
proxyPass = "http://10.0.0.2:3000"; proxyPass = "http://10.0.0.2:3000";
}; };

5
hosts/h001/containers/opengist.nix
View file

@ -29,8 +29,9 @@ in
''; '';
services.nginx.virtualHosts."gist.joshuabell.xyz" = { services.nginx.virtualHosts."gist.joshuabell.xyz" = {
# enableACME = true; addSSL = true;
# forceSSL = true; sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = { locations = {
"/" = { "/" = {
proxyWebsockets = true; proxyWebsockets = true;

5
hosts/h001/containers/zitadel.nix
View file

@ -68,8 +68,9 @@ in
options = { }; options = { };
config = { config = {
services.nginx.virtualHosts."sso.joshuabell.xyz" = { services.nginx.virtualHosts."sso.joshuabell.xyz" = {
# enableACME = true; addSSL = true;
# forceSSL = true; sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = { locations = {
"/" = { "/" = {
proxyWebsockets = true; proxyWebsockets = true;

5
hosts/h001/mods/n8n.nix
View file

@ -6,8 +6,9 @@
config = { config = {
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"n8n.joshuabell.xyz" = { "n8n.joshuabell.xyz" = {
# enableACME = true; addSSL = true;
# forceSSL = true; sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = { locations = {
"/" = { "/" = {
proxyWebsockets = true; proxyWebsockets = true;

5
hosts/h001/mods/oauth2-proxy.nix
View file

@ -45,8 +45,9 @@ in
}; };
services.nginx.virtualHosts."sso-proxy.joshuabell.xyz" = { services.nginx.virtualHosts."sso-proxy.joshuabell.xyz" = {
# enableACME = true; addSSL = true;
# forceSSL = true; sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = { locations = {
"/" = { "/" = {
proxyWebsockets = true; proxyWebsockets = true;

5
hosts/h001/mods/openwebui.nix
View file

@ -17,8 +17,9 @@ in
options = { }; options = { };
config = { config = {
services.nginx.virtualHosts."chat.joshuabell.xyz" = { services.nginx.virtualHosts."chat.joshuabell.xyz" = {
# enableACME = true; addSSL = true;
# forceSSL = true; sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = { locations = {
"/" = { "/" = {
proxyWebsockets = true; proxyWebsockets = true;

7
hosts/h001/mods/trilium.nix
View file

@ -44,8 +44,9 @@ in
}; };
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"notes.joshuabell.xyz" = { "notes.joshuabell.xyz" = {
# enableACME = true; addSSL = true;
# forceSSL = true; sslCertificate = "/var/lib/acme/joshuabell.xyz/fullchain.pem";
sslCertificateKey = "/var/lib/acme/joshuabell.xyz/key.pem";
locations = { locations = {
"/" = { "/" = {
proxyWebsockets = true; proxyWebsockets = true;
@ -54,6 +55,8 @@ in
}; };
}; };
}; };
# TODO revisit, am I going to use the native app or web version
# this is only needed for the app that can't handle the oauth flow
"trilium_overlay" = { "trilium_overlay" = {
serverName = "h001.net.joshuabell.xyz"; serverName = "h001.net.joshuabell.xyz";
listen = [ listen = [

1115
hosts/linode/l001/flake.lock generated
View file

File diff suppressed because it is too large Load diff

12
hosts/linode/l001/flake.nix
View file

@ -1,9 +1,10 @@
{ {
inputs = { inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11"; nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
home-manager.url = "github:rycee/home-manager/release-24.11";
deploy-rs.url = "github:serokell/deploy-rs"; deploy-rs.url = "github:serokell/deploy-rs";
common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles"; common.url = "git+https://git.joshuabell.xyz/ringofstorms/dotfiles?rev=39edfefa5871d07c9f88ce92a55995eb347d9b09";
ros_neovim.url = "git+https://git.joshuabell.xyz/ringofstorms/nvim"; common.inputs.home-manager.follows = "home-manager";
}; };
outputs = outputs =
@ -11,7 +12,6 @@
self, self,
nixpkgs, nixpkgs,
common, common,
ros_neovim,
deploy-rs, deploy-rs,
... ...
}: }:
@ -40,7 +40,6 @@
lib.nixosSystem { lib.nixosSystem {
modules = [ modules = [
common.nixosModules.default common.nixosModules.default
ros_neovim.nixosModules.default
./configuration.nix ./configuration.nix
./hardware-configuration.nix ./hardware-configuration.nix
./linode.nix ./linode.nix
@ -49,11 +48,6 @@
( (
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
environment.systemPackages = with pkgs; [
bitwarden
vaultwarden
];
ringofstorms_common = { ringofstorms_common = {
systemName = configuration_name; systemName = configuration_name;
general = { general = {

26
hosts/linode/l001/headscale.nix
View file

@ -1,6 +1,5 @@
{ pkgs, ... }: { pkgs, ... }:
{ {
config = { config = {
# TODO backup /var/lib/headscale data # TODO backup /var/lib/headscale data
# TODO https://github.com/gurucomputing/headscale-ui ? # TODO https://github.com/gurucomputing/headscale-ui ?
@ -17,6 +16,31 @@
dns = { dns = {
magic_dns = true; magic_dns = true;
base_domain = "net.joshuabell.xyz"; base_domain = "net.joshuabell.xyz";
extra_records =
let
h001ARecord = name: {
type = "A";
name = "${name}.joshuabell.xyz";
value = "100.64.0.13";
};
in
[
# {
# type = "A";
# name = "jellyfin.joshuabell.xyz";
# value = "100.64.0.13";
# }
h001ARecord "jellyfin"
h001ARecord "media"
h001ARecord "notes"
h001ARecord "chat"
h001ARecord "sso-proxy"
h001ARecord "n8n"
h001ARecord "sso"
h001ARecord "gist"
h001ARecord "git"
];
}; };
}; };
}; };

41
hosts/linode/l001/nginx.nix
View file

@ -4,6 +4,7 @@
{ {
security.acme.acceptTerms = true; security.acme.acceptTerms = true;
security.acme.email = "admin@joshuabell.xyz"; security.acme.email = "admin@joshuabell.xyz";
# security.acme.default.email = "admin@joshuabell.xyz";
services.nginx = { services.nginx = {
enable = true; enable = true;
recommendedGzipSettings = true; recommendedGzipSettings = true;
@ -11,29 +12,16 @@
recommendedProxySettings = true; recommendedProxySettings = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
virtualHosts = { virtualHosts = {
# default that is put first for fallbacks # "172.236.111.33" = {
# Note that order here doesn't matter it orders alphabetically so `0` puts it first # locations."/" = {
# I had an issue tha the first SSL port 443 site would catch any https traffic instead # return = "444";
# of hitting my default fallback and this fixes that issue and ensure this is hit instead # };
"001.linodes.joshuabell.xyz" = { # };
default = true; # "2600:3c06::f03c:95ff:fe1c:84d3" = {
enableACME = true; # locations."/" = {
forceSSL = true; # return = "444";
locations."/" = { # };
return = "444"; # 404 for not found or 444 for drop # };
};
};
"172.236.111.33" = {
locations."/" = {
return = "444";
};
};
"2600:3c06::f03c:95ff:fe1c:84d3" = {
locations."/" = {
return = "444";
};
};
"headscale.joshuabell.xyz" = { "headscale.joshuabell.xyz" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
@ -42,6 +30,13 @@
proxyPass = "http://localhost:8080"; # headscale proxyPass = "http://localhost:8080"; # headscale
}; };
}; };
"_" = {
rejectSSL = true;
default = true;
locations."/" = {
return = "444"; # 404 for not found or 444 for drop
};
};
}; };
}; };

2
hosts/lio/flake.nix
View file

@ -79,6 +79,8 @@
upkgs.ladybird upkgs.ladybird
google-chrome google-chrome
trilium-desktop trilium-desktop
dig
traceroute
]; ];
# Also allow this key to work for root user, this will let us use this as a remote builder easier # Also allow this key to work for root user, this will let us use this as a remote builder easier
users.users.root.openssh.authorizedKeys.keys = [ users.users.root.openssh.authorizedKeys.keys = [

5
hosts/oracle/o001/flake.nix
View file

@ -19,6 +19,7 @@
}: }:
let let
configuration_name = "o001"; configuration_name = "o001";
system = "aarch64-linux";
lib = nixpkgs.lib; lib = nixpkgs.lib;
in in
{ {
@ -30,7 +31,7 @@
]; ];
nodes.${configuration_name} = { nodes.${configuration_name} = {
hostname = "64.181.210.7"; hostname = "64.181.210.7";
targetPlatform = "aarch64-linux"; targetPlatform = system;
profiles.system = { profiles.system = {
user = "root"; user = "root";
path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.${configuration_name}; path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.${configuration_name};
@ -41,7 +42,7 @@
nixosConfigurations = { nixosConfigurations = {
nixos = self.nixosConfigurations.${configuration_name}; nixos = self.nixosConfigurations.${configuration_name};
"${configuration_name}" = lib.nixosSystem { "${configuration_name}" = lib.nixosSystem {
system = "aarch64-linux"; inherit system;
modules = [ modules = [
common.nixosModules.default common.nixosModules.default
ros_neovim.nixosModules.default ros_neovim.nixosModules.default