imnyang/nix-flakes
Watch
1
0
Fork
You've already forked nix-flakes
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

wow

Browse source
This commit is contained in:
암냥 2026-10-13 07:30:18 +09:00
commit a1072f01ad
9 changed files with 110 additions and 1360 deletions
Download patch file Download diff file Expand all files Collapse all files

1324
flake.lock generated
View file

File diff suppressed because it is too large Load diff

63
hosts/server/hikari/hako/configuration.nix
View file

@ -1,4 +1,34 @@
{ pkgs, inputs, ... }:
{ lib, pkgs, inputs, ... }:
let
concordSession = pkgs.writeShellScriptBin "concord-session" ''
set -eu
runtime_dir="''${XDG_RUNTIME_DIR:-/tmp}"
session_dir="$(mktemp -d "$runtime_dir/concord-session.XXXXXX")"
cleanup() {
rm -rf -- "$session_dir"
}
trap cleanup EXIT
trap 'exit 129' HUP
trap 'exit 130' INT
trap 'exit 143' TERM
config_home="$session_dir/config"
state_home="$session_dir/state"
mkdir -p "$config_home" "$state_home"
cat > "$config_home/config.toml" <<'EOF'
[credentials]
store = "plain"
EOF
XDG_CONFIG_HOME="$config_home" \
XDG_STATE_HOME="$state_home" \
"${inputs.concord.packages.${pkgs.system}.default}/bin/concord" "$@"
'';
in
{
imports = [
./hardware-configuration.nix
@ -29,6 +59,24 @@
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOHP3Z+AYrRh9f8TYyqChKfeyNm3lOe0F75AwRHTTaxD imnyang@kazusa"
];
users.users.discord = {
isNormalUser = true;
description = "Ephemeral Concord session user";
shell = pkgs.bashInteractive;
password = "";
};
services.openssh.extraConfig = ''
Match User discord
AuthenticationMethods none
PasswordAuthentication yes
PermitEmptyPasswords yes
ForceCommand ${concordSession}/bin/concord-session
DisableForwarding yes
PermitTTY yes
PermitUserRC no
'';
environment.systemPackages = with pkgs; [
eza
neovim
@ -44,6 +92,19 @@
networking.firewall.enable = false;
# Keep short-lived service memory spikes from turning into a global OOM.
# The host has 8 GiB RAM and currently had no swap configured.
swapDevices = [
{
# nixpkgs currently requires a label definition for swap submodules,
# but file-backed swap must still use its real path here.
label = "hako-swap";
device = lib.mkForce "/swapfile";
}
];
boot.kernel.sysctl."vm.swappiness" = 10;
# /dev/sdd1 (ext4, UUID efdf753d-282c-4b78-9549-a124b353c6a5)
fileSystems."/mnt/static" = {
device = "/dev/disk/by-uuid/efdf753d-282c-4b78-9549-a124b353c6a5";

29
hosts/server/hikari/hako/home.nix
View file

@ -6,34 +6,6 @@
let
nr = import "${inputs.self}/modules/mizukios/features/packages/nr.nix" { inherit pkgs; };
nrr = import "${inputs.self}/modules/mizukios/features/packages/nrr.nix" { inherit pkgs; };
concord = pkgs.writeShellScriptBin "concord" ''
set -eu
runtime_dir="''${XDG_RUNTIME_DIR:-/tmp}"
session_dir="$(mktemp -d "$runtime_dir/concord-session.XXXXXX")"
cleanup() {
rm -rf -- "$session_dir"
}
trap cleanup EXIT
trap 'exit 129' HUP
trap 'exit 130' INT
trap 'exit 143' TERM
config_home="$session_dir/config"
state_home="$session_dir/state"
mkdir -p "$config_home" "$state_home"
cat > "$config_home/config.toml" <<'EOF'
[credentials]
store = "plain"
EOF
XDG_CONFIG_HOME="$config_home" \
XDG_STATE_HOME="$state_home" \
"${inputs.concord.packages.${pkgs.stdenv.hostPlatform.system}.default}/bin/concord" "$@"
'';
in
{
home.stateVersion = "26.05";
@ -41,7 +13,6 @@ in
home.homeDirectory = "/home/imnyang";
home.packages = [
concord
nr
nrr
];

2
hosts/server/hikari/hako/services/api.nix
View file

@ -22,7 +22,7 @@ let
'';
outputHashMode = "recursive";
outputHash = "sha256-ke6cG/cBON6d6giFo1RAQ4gMfIbmagJfCI1FfZl1w/8=";
outputHash = "sha256-RMIfjUQKyC3iTGvBUvneSEMTf1Aws2WiOqRm+GqdPTQ=";
};
apiPackage = pkgs.stdenv.mkDerivation {

6
hosts/server/hikari/hako/services/forgejo.nix
View file

@ -39,7 +39,7 @@
services.forgejo = {
enable = true;
package = pkgs.forgejo;
package = import ../../../../../overlays/forgejo-codefloe.nix { inherit pkgs; };
database = {
type = "postgres";
@ -79,8 +79,8 @@
service = {
REGISTER_EMAIL_CONFIRM = true;
ENABLE_NOTIFY_MAIL = true;
DISABLE_REGISTRATION = false;
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
DISABLE_REGISTRATION = true;
ALLOW_ONLY_EXTERNAL_REGISTRATION = false;
ENABLE_CAPTCHA = false;
REQUIRE_SIGNIN_VIEW = lib.mkForce false;
DEFAULT_KEEP_EMAIL_PRIVATE = false;

10
hosts/server/hikari/hako/services/helium-services.nix
View file

@ -18,7 +18,7 @@ let
version = "2026-08-26";
src = pkgs.fetchurl {
url = "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries/+archive/cccf64a8acc951afe3f47fee023908e55699bc58.tar.gz";
hash = "sha256-KMVNa0XsR9BXJzW6d7/D6AzAGErRVRGPU9CjjTIvyv0=";
hash = "sha256-mI929q+yEj0oDWGgt1gA21WTZRN6gm4a35SPCMBYgvU=";
};
dontUnpack = true;
@ -201,6 +201,14 @@ in
file_server browse
}
@ext path /ext
handle @ext {
rewrite * /
reverse_proxy 127.0.0.1:18080 127.0.0.1:18081 {
lb_policy first
}
}
handle_path /ext/* {
reverse_proxy 127.0.0.1:18080 127.0.0.1:18081 {
lb_policy first

8
modules/home/ssh.nix
View file

@ -19,6 +19,14 @@
ControlPath = "~/.ssh/master-%r@%n:%p";
ControlPersist = "no";
};
"mizuki.guru" = {
User = "discord";
PreferredAuthentications = [ "none" ];
PubkeyAuthentication = false;
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
};
};
};
}

2
modules/mizukios/features/caddy/common.nix
View file

@ -43,7 +43,7 @@ in
"github.com/RussellLuo/caddy-ext/ratelimit@v0.3.0"
"github.com/neodyme-labs/user_agent_parse@v0.0.1"
];
hash = "sha256-r4MgRk8HpKYx7f8FmA3PKgD/5ZNTIHpQvlE+zRbP0lw=";
hash = "sha256-sh5R+MqWfzYJ6GTRHW0rmnz1D5l91ULaSyupcGvEatA=";
};
globalConfig = ''
admin unix//run/caddy/admin.socket

26
overlays/forgejo-codefloe.nix Normal file
View file

@ -0,0 +1,26 @@
{ pkgs }:
let
# CodeFloe's v16.0/forgejo-codefloe deployment branch, pinned for reproducibility.
src = pkgs.fetchzip {
url = "https://codefloe.com/codefloe/forgejo-codefloe/archive/ed1b96c66680ed99d7d11201915eca28587b8171.tar.gz";
hash = "sha256-hdLR4A2qa2oRUXKmApQngVDy15I214/NB53syNmMacE=";
};
in
# Revisit the pinned fork and build recipe together when nixpkgs updates Forgejo.
assert pkgs.forgejo.version == "16.0.5";
(pkgs.forgejo.override {
buildNpmPackage =
args:
pkgs.buildNpmPackage (
args
// {
inherit src;
npmDepsHash = "sha256-t9v9gVuCd9uqiK47lUDpJdzzwqc6sQwBkPxw/mAST0c=";
}
);
}).overrideAttrs {
pname = "forgejo-codefloe";
inherit src;
vendorHash = "sha256-bu1kJqXvPSEehhbG5tkAEQAEbhRl5FlJ+EEM01FiBSY=";
}