Changes

9 changed files (+791/-214)

• ThinkPad-X1-Yoga-Gen-6/default.nix (new)
  • @@ -0,0 +1,219 @@
    + { + config, + lib, + pkgs, + ... + }: + + { + imports = [ + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + # Overlays! Fixed points! + nixpkgs.overlays = [ (import ./overlays.nix) ]; + + # Auto screen rotation in tablet mode + hardware.sensor.iio.enable = true; + # VA-API + hardware.graphics.extraPackages = with pkgs; [ intel-media-driver ]; + + boot.loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; + + networking.hostName = "ThinkPad-X1-Yoga-Gen-6"; + # TODO: nmcli connection modify "MIT SECURE" +ipv4.routes "10.0.0.0/9" + networking.networkmanager.enable = true; + + # Oh noes I'm leaking personal info help mayday disaster alert + time.timeZone = "US/Eastern"; + + programs = { + firefox.enable = true; + thunderbird.enable = true; + kdeconnect.enable = true; + # So I can use my computer like a normal person + nix-ld.enable = true; + ssh = { + startAgent = true; + enableAskPassword = true; + askPassword = lib.mkForce "${pkgs.kdePackages.ksshaskpass}/bin/ksshaskpass"; + }; + }; + + environment.systemPackages = with pkgs; [ + # Programming + cargo + gcc + nil + python313 + texliveSmall + uv + + # Dafny stuff + dafny + dotnet-runtime + vscodium + z3 + + # Apps + kdePackages.neochat + kdePackages.tokodon + kdePackages.plasma-vault + kile + libreoffice-qt6-fresh + maliit-keyboard + mpv + mpvScripts.mpris + rnote + + # Utilities + aspellDicts.en + gocryptfs + ripgrep + ]; + + environment.variables = { + # SSH agent + SSH_ASKPASS_REQUIRE = "prefer"; + SSH_ASKPASS = lib.mkForce "${pkgs.kdePackages.ksshaskpass}/bin/ksshaskpass"; + # More Dafny stuff + NIXOS_OZONE_WL = "1"; + DAFNY_SERVER_OVERRIDE = "${pkgs.dafny}/lib/Dafny/Dafny.dll"; + }; + + # TODO: Emojis are broken in fcitx5 and on some sites in Firefox + # https://github.com/NixOS/nixpkgs/issues/336989 + # The default CJK font looks atrocious + fonts.packages = with pkgs; [ wqy_microhei ]; + + # Plasma also pulls in ibus unfortunately + # https://github.com/NixOS/nixpkgs/issues/303593 + i18n.inputMethod = { + enable = true; + type = "fcitx5"; + fcitx5.addons = with pkgs; [ fcitx5-chinese-addons ]; + fcitx5.waylandFrontend = true; + }; + + # KDE! YAY! + services.displayManager.sddm.enable = true; + services.displayManager.sddm.wayland.enable = true; + services.desktopManager.plasma6.enable = true; + + # My hardware is pretty well supported wow what a surprise + services.fwupd.enable = true; + + services.fprintd.enable = true; + # Don't enable fprintd for everything + # Otherwise SDDM takes 30 seconds to log in + security.pam.services.login.fprintAuth = false; + security.pam.services.kde.fprintAuth = false; + # https://unnamed.website/posts/plasma-6-fingerprint-bug/ + systemd.services.kill-fprintd = { + wantedBy = [ "sleep.target" ]; + before = [ "sleep.target" ]; + serviceConfig = { + ExecStart = "${pkgs.killall}/bin/killall fprintd"; + }; + }; + + # Back up /home and unnamed.website using btrfs snapshots and btrbk + services.btrbk.instances.btrbk = { + # Wait a bit for the remote server to make a snapshot first + onCalendar = "00:05 UTC"; + settings = { + volume = { + "/" = { + subvolume = "/home"; + }; + "ssh://unnamed.website/" = { + subvolume = "."; + snapshot_dir = "/.snapshots"; + snapshot_preserve_min = "all"; + snapshot_create = "no"; + target = "/.snapshots"; + target_preserve = "3d 3w 3m *y"; + target_preserve_min = "latest"; + send_compressed_data = "yes"; + }; + }; + }; + }; + systemd.services.btrbk-btrbk = { + # The remote server uses UTC so we have to too + environment = { + TZ = "utc"; + }; + serviceConfig = { + # Wait for internet connectivity if we just woke up + ExecStartPre = "${pkgs.networkmanager}/bin/nm-online -q"; + }; + }; + + # Back up home dir to the cloud too + # TODO: back up latest snapshot as well + systemd.user.services.rclone = { + wantedBy = [ "default.target" ]; + serviceConfig = { + ExecStart = "${pkgs.rclone}/bin/rclone sync . crypt: --transfers 32 --track-renames --track-renames-strategy modtime --copy-links --exclude '.*{/**,}'"; + }; + }; + systemd.user.timers.rclone = { + wantedBy = [ "timers.target" ]; + timerConfig = { + OnCalendar = "daily UTC"; + }; + }; + + # https://unnamed.website/posts/switch-virtual-keyboard/ + systemd.user.services.switch-virtual-keyboard = { + wantedBy = [ "default.target" ]; + # Yes I know I'm supposed to be a Fish fan + # But there's already a Bash script in that post + # So let's just use it instead + # I've succumbed to the dark side I know + script = '' + switch() { + echo "Starting $1" + ${pkgs.kdePackages.kconfig}/bin/kwriteconfig6 --file kwinrc --group Wayland --key InputMethod "/run/current-system/sw/share/applications/$1" + busctl --user emit /kwinrc org.kde.kconfig.notify ConfigChanged "a{saay}" 1 Wayland 1 11 73 110 112 117 116 77 101 116 104 111 100 + } + + busctl --user monitor --match "type=signal,interface=org.kde.KWin.TabletModeManager,member=tabletModeChanged" | while read -r line + do + if [[ $line == *"true"* ]]; then + switch com.github.maliit.keyboard.desktop + elif [[ $line == *"false"* ]]; then + switch fcitx5-wayland-launcher.desktop + fi + done + ''; + }; + + # TODO: delete this eventually + nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ]; + + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "24.11"; # Did you read the comment? + + }
• hardware-configuration.nix > ThinkPad-X1-Yoga-Gen-6/hardware-configuration.nix
  • @@ -60,8 +60,8 @@
    device = "/dev/disk/by-uuid/3A93-17DE"; fsType = "vfat"; options = [ - "fmask=0022" - "dmask=0022" + "fmask=0077" + "dmask=0077" ]; };
• overlays.nix > ThinkPad-X1-Yoga-Gen-6/overlays.nix
• Unnamed-Server/default-page.patch (new)
  • @@ -0,0 +1,246 @@
    + From d9f3d6fb1817fd22512ac62e8d7c36c67dc5584a Mon Sep 17 00:00:00 2001 + From: Naïm Favier <fnaim42@gmail.com> + Date: Mon, 9 Dec 2019 19:38:14 +0100 + Subject: Make default pages configurable + + Signed-off-by: Christian Hesse <mail@eworm.de> + --- + cgit.c | 10 ++++++++++ + cgit.h | 3 +++ + cgitrc.5.txt | 14 ++++++++++++++ + cmd.c | 18 +++++++++--------- + ui-repolist.c | 2 +- + ui-shared.c | 12 +++++++++--- + ui-shared.h | 2 ++ + 7 files changed, 48 insertions(+), 13 deletions(-) + + diff --git a/cgit.c b/cgit.c + index 57d7097..e7c0172 100644 + --- a/cgit.c + +++ b/cgit.c + @@ -56,6 +56,8 @@ static void repo_config(struct cgit_repo *repo, const char *name, const char *va + repo->homepage = xstrdup(value); + else if (!strcmp(name, "defbranch")) + repo->defbranch = xstrdup(value); + + else if (!strcmp(name, "default-page")) + + repo->default_page = xstrdup(value); + else if (!strcmp(name, "extra-head-content")) + repo->extra_head_content = xstrdup(value); + else if (!strcmp(name, "snapshots")) + @@ -141,6 +143,8 @@ static void config_cb(const char *name, const char *value) + ctx.cfg.root_desc = xstrdup(value); + else if (!strcmp(name, "root-readme")) + ctx.cfg.root_readme = xstrdup(value); + + else if (!strcmp(name, "root-default-page")) + + ctx.cfg.root_default_page = xstrdup(value); + else if (!strcmp(name, "css")) + string_list_append(&ctx.cfg.css, xstrdup(value)); + else if (!strcmp(name, "js")) + @@ -157,6 +161,8 @@ static void config_cb(const char *name, const char *value) + ctx.cfg.logo = xstrdup(value); + else if (!strcmp(name, "logo-link")) + ctx.cfg.logo_link = xstrdup(value); + + else if (!strcmp(name, "default-page")) + + ctx.cfg.default_page = xstrdup(value); + else if (!strcmp(name, "module-link")) + ctx.cfg.module_link = xstrdup(value); + else if (!strcmp(name, "strict-export")) + @@ -380,6 +386,7 @@ static void prepare_context(void) + ctx.cfg.case_sensitive_sort = 1; + ctx.cfg.branch_sort = 0; + ctx.cfg.commit_sort = 0; + + ctx.cfg.default_page= "summary"; + ctx.cfg.logo = "/cgit.png"; + ctx.cfg.favicon = "/favicon.ico"; + ctx.cfg.local_time = 0; + @@ -400,6 +407,7 @@ static void prepare_context(void) + ctx.cfg.robots = "index, nofollow"; + ctx.cfg.root_title = "Git repository browser"; + ctx.cfg.root_desc = "a fast webinterface for the git dscm"; + + ctx.cfg.root_default_page = "repolist"; + ctx.cfg.scan_hidden_path = 0; + ctx.cfg.script_name = CGIT_SCRIPT_NAME; + ctx.cfg.section = ""; + @@ -811,6 +819,8 @@ static void print_repo(FILE *f, struct cgit_repo *repo) + } + if (repo->defbranch) + fprintf(f, "repo.defbranch=%s\n", repo->defbranch); + + if (repo->default_page) + + fprintf(f, "repo.default-page=%s\n", repo->default_page); + if (repo->extra_head_content) + fprintf(f, "repo.extra-head-content=%s\n", repo->extra_head_content); + if (repo->module_link) + diff --git a/cgit.h b/cgit.h + index ddd2ccb..9f9daac 100644 + --- a/cgit.h + +++ b/cgit.h + @@ -87,6 +87,7 @@ struct cgit_repo { + char *owner; + char *homepage; + char *defbranch; + + char *default_page; + char *module_link; + struct string_list readme; + char *section; + @@ -196,6 +197,7 @@ struct cgit_config { + char *cache_root; + char *clone_prefix; + char *clone_url; + + char *default_page; + char *favicon; + char *footer; + char *head_include; + @@ -211,6 +213,7 @@ struct cgit_config { + char *root_title; + char *root_desc; + char *root_readme; + + char *root_default_page; + char *script_name; + char *section; + char *repository_sort; + diff --git a/cgitrc.5.txt b/cgitrc.5.txt + index 6f3e952..ac86864 100644 + --- a/cgitrc.5.txt + +++ b/cgitrc.5.txt + @@ -129,6 +129,12 @@ css:: + Default value: "/cgit.css". May be given multiple times, each + css URL path is added in the head section of the document in turn. + + +default-page:: + + Specifies the default page for repositories. This setting is only used + + if `repo.default-page` is unspecified. Possible values: "about", + + "summary", "refs", "log", "tree", "commit", "diff", "stats". Default + + value: "summary". + + + email-filter:: + Specifies a command which will be invoked to format names and email + address of committers, authors, and taggers, as represented in various + @@ -359,6 +365,10 @@ robots:: + Text used as content for the "robots" meta-tag. Default value: + "index, nofollow". + + +root-default-page:: + + Specifies the default root page. Possible values are "repolist" and + + "about". Default value: "repolist". + + + root-desc:: + Text printed below the heading on the repository index page. Default + value: "a fast webinterface for the git dscm". + @@ -482,6 +492,10 @@ repo.commit-sort:: + ordering. If unset, the default ordering of "git log" is used. Default + value: unset. + + +repo.default-page:: + + Specifies the default page for the repository. Default value: global + + default-page. + + + repo.defbranch:: + The name of the default branch for this repository. If no such branch + exists in the repository, the first branch name (when sorted) is used + diff --git a/cmd.c b/cmd.c + index 0eb75b1..669c345 100644 + --- a/cmd.c + +++ b/cmd.c + @@ -51,13 +51,10 @@ static void about_fn(void) + free(redirect); + } else if (ctx.repo->readme.nr) + cgit_print_repo_readme(ctx.qry.path); + - else if (ctx.repo->homepage) + - cgit_redirect(ctx.repo->homepage, false); + else { + - char *currenturl = cgit_currenturl(); + - char *redirect = fmtalloc("%s../", currenturl); + + char *redirect = fmtalloc("%s%s/summary/", + + ctx.cfg.virtual_root, ctx.repo->url); + cgit_redirect(redirect, false); + - free(currenturl); + free(redirect); + } + } else + @@ -195,10 +192,13 @@ struct cgit_cmd *cgit_get_cmd(void) + int i; + + if (ctx.qry.page == NULL) { + - if (ctx.repo) + - ctx.qry.page = "summary"; + - else + - ctx.qry.page = "repolist"; + + if (ctx.repo) { + + if (ctx.repo->default_page && *ctx.repo->default_page) + + ctx.qry.page = ctx.repo->default_page; + + else + + ctx.qry.page = ctx.cfg.default_page; + + } else + + ctx.qry.page = ctx.cfg.root_default_page; + } + + for (i = 0; i < sizeof(cmds)/sizeof(*cmds); i++) + diff --git a/ui-repolist.c b/ui-repolist.c + index d12e3dd..2390eae 100644 + --- a/ui-repolist.c + +++ b/ui-repolist.c + @@ -321,7 +321,7 @@ void cgit_print_repolist(void) + } + htmlf("<tr><td class='%s'>", + !sorted && section ? "sublevel-repo" : "toplevel-repo"); + - cgit_summary_link(ctx.repo->name, NULL, NULL, NULL); + + cgit_repo_link(ctx.repo->name, NULL, NULL, NULL); + html("</td><td>"); + repourl = cgit_repourl(ctx.repo->url); + html_link_open(repourl, NULL, NULL); + diff --git a/ui-shared.c b/ui-shared.c + index baea6f2..81e1f46 100644 + --- a/ui-shared.c + +++ b/ui-shared.c + @@ -328,10 +328,16 @@ static void reporevlink(const char *page, const char *name, const char *title, + html("</a>"); + } + + +void cgit_repo_link(const char *name, const char *title, const char *class, + + const char *head) + +{ + + reporevlink(NULL, name, title, class, head, NULL, NULL); + +} + + + void cgit_summary_link(const char *name, const char *title, const char *class, + const char *head) + { + - reporevlink(NULL, name, title, class, head, NULL, NULL); + + reporevlink("summary", name, title, class, head, NULL, NULL); + } + + void cgit_tag_link(const char *name, const char *title, const char *class, + @@ -1035,7 +1041,7 @@ static void print_header(void) + if (ctx.repo) { + cgit_index_link("index", NULL, NULL, NULL, NULL, 0, 1); + html(" : "); + - cgit_summary_link(ctx.repo->name, NULL, NULL, NULL); + + cgit_repo_link(ctx.repo->name, NULL, NULL, NULL); + if (ctx.env.authenticated) { + html("</td><td class='form'>"); + html("<form method='get'>\n"); + @@ -1130,7 +1136,7 @@ void cgit_print_pageheader(void) + html("</form>\n"); + } else if (ctx.env.authenticated) { + char *currenturl = cgit_currenturl(); + - site_link(NULL, "index", NULL, hc("repolist"), NULL, NULL, 0, 1); + + site_link("repolist", "index", NULL, hc("repolist"), NULL, NULL, 0, 1); + if (ctx.cfg.root_readme) + site_link("about", "about", NULL, hc("about"), + NULL, NULL, 0, 1); + diff --git a/ui-shared.h b/ui-shared.h + index 6964873..4d14858 100644 + --- a/ui-shared.h + +++ b/ui-shared.h + @@ -17,6 +17,8 @@ extern void cgit_add_clone_urls(void (*fn)(const char *)); + + extern void cgit_index_link(const char *name, const char *title, + const char *class, const char *pattern, const char *sort, int ofs, int always_root); + +extern void cgit_repo_link(const char *name, const char *title, + + const char *class, const char *head); + extern void cgit_summary_link(const char *name, const char *title, + const char *class, const char *head); + extern void cgit_tag_link(const char *name, const char *title, + -- + cgit v1.2.3-59-g8ed1b +
• Unnamed-Server/default.nix (new)
  • @@ -0,0 +1,237 @@
    + { + config, + lib, + pkgs, + ... + }: + + { + disko.devices.disk.main = { + imageSize = "3G"; + type = "disk"; + device = "/dev/vda"; + content = { + type = "gpt"; + partitions = { + boot = { + size = "1M"; + type = "EF02"; + }; + ESP = { + size = "128M"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ + "fmask=0077" + "dmask=0077" + ]; + }; + }; + root = { + size = "100%"; + content = { + type = "btrfs"; + subvolumes = { + "@" = { + mountpoint = "/"; + }; + "@nix" = { + mountpoint = "/nix"; + }; + "@log" = { + mountpoint = "/var/log"; + }; + "@.snapshots" = { + mountpoint = "/.snapshots"; + }; + "@home" = { + mountpoint = "/home"; + }; + }; + }; + }; + }; + }; + }; + + boot.loader.grub.enable = true; + boot.initrd.availableKernelModules = [ + "xen-blkfront" + "xen-kbdfront" + ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + # Overlays! Fixed points! + nixpkgs.overlays = [ (import ./overlays.nix) ]; + + # Very creative, I know + networking.hostName = "Unnamed-Server"; + + time.timeZone = "UTC"; + + users.users.a.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDLPakDnAelqFTUudQB8X0T7yc/8ekV3jGqpeJb062l anthonywang" + ]; + users.users.btrbk.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoXy/V1rfnAcBJyRMAsqygOAeSNwxf8+oYtWNnUs3Rf btrbk@ThinkPad-X1-Yoga-Gen-6" + ]; + services.openssh = { + enable = true; + settings = { + # https://docs.gitlab.com/administration/git_protocol/ + # Is this necessary? + # I'm not even GitLabbing + AcceptEnv = "GIT_PROTOCOL"; + # Don't hack me + PasswordAuthentication = false; + PermitRootLogin = "no"; + }; + }; + + # Keep the journal small + services.journald.extraConfig = "SystemMaxUse=1G"; + + # TODO: open firewall ports? + services.caddy = { + enable = true; + package = pkgs.caddy.withPlugins { + plugins = [ "github.com/caddy-dns/porkbun@v0.2.1" ]; + hash = "sha256-X8QbRc2ahW1B5niV8i3sbfpe1OPYoaQ4LwbfeaWvfjg="; + }; + environmentFile = "/etc/caddy/env"; + globalConfig = '' + acme_dns porkbun { + api_key {env.PORKBUN_API_KEY} + api_secret_key {env.PORKBUN_API_SECRET_KEY} + } + ''; + virtualHosts = { + "unnamed.website".extraConfig = '' + root * /srv/http/www + file_server + handle_errors { + rewrite * /{err.status_code}.html + file_server + } + log + ''; + "git.unnamed.website".extraConfig = '' + handle /robots.txt { + respond "User-agent: * + Disallow: /*/*/ + Allow: /" + } + @assets path /cgit.css /cgit.js /cgit.png /favicon.ico + handle @assets { + root * ${pkgs.cgit}/cgit + file_server + } + reverse_proxy unix//run/fcgiwrap-cgit-cgit.sock { + transport fastcgi { + env SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi + } + } + log + ''; + "*.unnamed.website".extraConfig = '' + root * /srv/http/{labels.2} + handle /cgi-bin/* { + reverse_proxy unix//run/fcgiwrap-cgit-cgit.sock { + transport fastcgi { + env SCRIPT_FILENAME {http.vars.root}{path} + } + } + } + file_server + log + ''; + "a.exozy.me".extraConfig = '' + redir https://unnamed.website{uri} permanent + ''; + "ta180m.exozy.me".extraConfig = '' + redir https://unnamed.website{uri} permanent + ''; + }; + }; + + # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/networking/cgit.nix + # cgit automatically enables nginx + services.nginx.enable = lib.mkForce false; + # cgit also already sets up fcgiwrap + services.fcgiwrap.instances.cgit-cgit.socket = { + socket.user = "caddy"; + socket.group = "caddy"; + }; + services.cgit.cgit = { + enable = true; + settings = { + root-title = "Purely dysfunctional programming"; + root-desc = "I apologize in advance"; + clone-prefix = "https://git.unnamed.website"; + default-page = "about"; + # To clear cache, run + # sudo sh -c "rm /var/cache/cgit/*" + cache-size = 64; + # Idle column uses master branch + # https://lists.zx2c4.com/pipermail/cgit/2020-August/004514.html + # Can manually set the time + # https://ch1p.io/cgit-idle-time/ + repository-sort = "age"; + # No spam plz + noplainemail = 1; + # The default md2html filter uses python-markdown and is super slow + # Instead use MD4C + # about-filter = (pkgs.writeShellScript { + # name = "md2html"; + # text = '' + # if [ "$1" = "/etc/cgitrc" ]; then + # echo "<pre>" + # # https://stackoverflow.com/a/12873723 + # sed 's/&/\&amp;/g; s/</\&lt;/g; s/>/\&gt;/g; s/"/\&quot;/g; s/'"'"'/\&#39;/g' "$1" + # echo "</pre>" + # else + # # Fix README file links + # md2html --github | sed 's/<a href="\([^/]*\)">/<a href="tree\/\1">/g' + # fi + # ''; + # }).outPath; + readme = ":README.md"; + # To make repo unlisted, add hide=1 to its cgitrc + section-from-path = 1; + # Tip: Generate a GitHub-style contrib graph with + # https://github.com/tos-kamiya/git-contrib-graph + }; + scanPath = "/srv/git"; + }; + + # Back up / using btrfs snapshots and btrbk + services.btrbk.instances.btrbk = { + onCalendar = "daily"; + settings = { + volume."/".subvolume = "."; + }; + }; + + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "24.11"; # Did you read the comment? + + }
• Unnamed-Server/overlays.nix (new)
  • @@ -0,0 +1,14 @@
    + final: prev: { + cgit = prev.cgit.overrideAttrs (old: { + src = prev.fetchurl { + url = "https://git.zx2c4.com/cgit/snapshot/cgit-ch/for-jason.tar.xz"; + hash = "sha256-n5hPVGiiVHmdnu0vTcCP/w3Wtleoj4MgWF3NuAcc2JY="; + }; + sourceRoot = "cgit-ch/for-jason"; + gitSrc = prev.fetchurl { + url = "mirror://kernel/software/scm/git/git-2.49.0.tar.xz"; + hash = "sha256-YYGQz1kLfp9sEfkfI7HSZ82Yw6szuFBBbYdY+LWoVig="; + }; + patch = "default-page.patch"; + }); + }
• configuration.nix
  • @@ -1,7 +1,3 @@
    - # Edit this configuration file to define what should be installed on - # your system. Help is available in the configuration.nix(5) man page, on - # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). - { config, lib,
  • @@ -10,11 +6,6 @@
    }: { - imports = [ - # Include the results of the hardware scan. - ./hardware-configuration.nix - ]; - # BAD NIX STORE STOP BEING 100GB nix.gc = { automatic = true;
  • @@ -37,33 +28,14 @@
    "pipe-operators" ]; - # Overlays! Fixed points! - nixpkgs.overlays = [ (import ./overlays.nix) ]; - # Use a better rebuild tool instead of a Bash script system.rebuild.enableNg = true; - # Auto screen rotation in tablet mode - hardware.sensor.iio.enable = true; - # VA-API - hardware.graphics.extraPackages = with pkgs; [ intel-media-driver ]; - - boot.loader = { - systemd-boot.enable = true; - efi.canTouchEfiVariables = true; - timeout = 0; - }; + # Instant boot + boot.loader.timeout = 0; # This is what literally every other distro does boot.tmp.useTmpfs = true; - # Very creative, I know - networking.hostName = "ThinkPad-X1-Yoga-Gen-6"; - # TODO: nmcli connection modify "MIT SECURE" +ipv4.routes "10.0.0.0/9" - networking.networkmanager.enable = true; - - # Oh noes I'm leaking personal info help mayday disaster alert - time.timeZone = "US/Eastern"; - # I NEED ZSTD # NixOS is a disk destroyer fileSystems = {
  • @@ -87,101 +59,20 @@
    description = "Anthony Wang"; # I can't bash you know shell = pkgs.fish; + initialPassword = "silly insecure password"; }; programs = { git.enable = true; fish.enable = true; - firefox.enable = true; - thunderbird.enable = true; - kdeconnect.enable = true; - # So I can use my computer like a normal person - nix-ld.enable = true; - ssh = { - startAgent = true; - enableAskPassword = true; - askPassword = lib.mkForce "${pkgs.kdePackages.ksshaskpass}/bin/ksshaskpass"; - }; }; environment.systemPackages = with pkgs; [ - # Programming - cargo - micro - python313 - texliveSmall - uv - - # Dafny stuff - dafny - dotnet-runtime - vscodium - z3 - - # Apps - kdePackages.neochat - kdePackages.tokodon - kdePackages.plasma-vault - kile - libreoffice-qt6-fresh - maliit-keyboard - mpv - mpvScripts.mpris - rnote - - # Utilities - aspellDicts.en btop - gocryptfs hugo - ripgrep + micro ]; - environment.variables = { - # SSH agent - SSH_ASKPASS_REQUIRE = "prefer"; - SSH_ASKPASS = lib.mkForce "${pkgs.kdePackages.ksshaskpass}/bin/ksshaskpass"; - # More Dafny stuff - NIXOS_OZONE_WL = "1"; - DAFNY_SERVER_OVERRIDE = "${pkgs.dafny}/lib/Dafny/Dafny.dll"; - }; - - # TODO: Emojis are broken in fcitx5 and on some sites in Firefox - # https://github.com/NixOS/nixpkgs/issues/336989 - # The default CJK font looks atrocious - fonts.packages = with pkgs; [ wqy_microhei ]; - - # Plasma also pulls in ibus unfortunately - # https://github.com/NixOS/nixpkgs/issues/303593 - i18n.inputMethod = { - enable = true; - type = "fcitx5"; - fcitx5.addons = with pkgs; [ fcitx5-chinese-addons ]; - fcitx5.waylandFrontend = true; - }; - - # KDE! YAY! - services.displayManager.sddm.enable = true; - services.displayManager.sddm.wayland.enable = true; - services.desktopManager.plasma6.enable = true; - - # My hardware is pretty well supported wow what a surprise - services.fwupd.enable = true; - - services.fprintd.enable = true; - # Don't enable fprintd for everything - # Otherwise SDDM takes 30 seconds to log in - security.pam.services.login.fprintAuth = false; - security.pam.services.kde.fprintAuth = false; - # https://unnamed.website/posts/plasma-6-fingerprint-bug/ - systemd.services.kill-fprintd = { - wantedBy = [ "sleep.target" ]; - before = [ "sleep.target" ]; - serviceConfig = { - ExecStart = "${pkgs.killall}/bin/killall fprintd"; - }; - }; - # It sync things I guess services.syncthing.enable = true; # Disable the system service
  • @@ -193,107 +84,34 @@
    unitConfig.ConditionUser = "!@system"; }; - # Back up /home and unnamed.website using btrfs snapshots and btrbk # THE ONLY CORRECT BACKUP METHOD - services.btrbk.instances."btrbk" = { - # Wait a bit for the remote server to make a snapshot first - onCalendar = "00:05 UTC"; + services.btrbk.instances.btrbk = { settings = { - backend = "btrfs-progs"; transaction_log = "/var/log/btrbk.log"; timestamp_format = "short"; - volume = { - "/" = { - subvolume = "/home"; - snapshot_dir = "/.snapshots"; - snapshot_preserve = "3d 3w 3m *y"; - snapshot_preserve_min = "latest"; - }; - "ssh://unnamed.website/" = { - subvolume = "."; - snapshot_dir = "/.snapshots"; - snapshot_preserve_min = "all"; - snapshot_create = "no"; - target = "/.snapshots"; - target_preserve = "3d 3w 3m *y"; - target_preserve_min = "latest"; - send_compressed_data = "yes"; - }; - }; - }; - }; - systemd.services.btrbk-btrbk = { - # The remote server uses UTC so we have to too - environment = { - TZ = "utc"; - }; - serviceConfig = { - # Wait for internet connectivity if we just woke up - ExecStartPre = "${pkgs.networkmanager}/bin/nm-online -q"; - # TODO: Don't run as root - User = lib.mkForce "root"; - }; - }; - - # Back up home dir to the cloud too - systemd.user.services.rclone = { - wantedBy = [ "default.target" ]; - serviceConfig = { - ExecStart = "${pkgs.rclone}/bin/rclone sync . crypt: --transfers 32 --track-renames --track-renames-strategy modtime --copy-links --exclude '.*{/**,}'"; + snapshot_dir = "/.snapshots"; + snapshot_preserve = "3d 3w 3m *y"; + snapshot_preserve_min = "latest"; }; }; - systemd.user.timers.rclone = { - wantedBy = [ "timers.target" ]; - timerConfig = { - OnCalendar = "daily UTC"; - }; - }; - - # https://unnamed.website/posts/switch-virtual-keyboard/ - systemd.user.services.switch-virtual-keyboard = { - wantedBy = [ "default.target" ]; - # Yes I know I'm supposed to be a Fish fan - # But there's already a Bash script in that post - # So let's just use it instead - # I've succumbed to the dark side I know - script = '' - switch() { - echo "Starting $1" - ${pkgs.kdePackages.kconfig}/bin/kwriteconfig6 --file kwinrc --group Wayland --key InputMethod "/run/current-system/sw/share/applications/$1" - busctl --user emit /kwinrc org.kde.kconfig.notify ConfigChanged "a{saay}" 1 Wayland 1 11 73 110 112 117 116 77 101 116 104 111 100 - } - - busctl --user monitor --match "type=signal,interface=org.kde.KWin.TabletModeManager,member=tabletModeChanged" | while read -r line - do - if [[ $line == *"true"* ]]; then - switch com.github.maliit.keyboard.desktop - elif [[ $line == *"false"* ]]; then - switch fcitx5-wayland-launcher.desktop - fi - done - ''; - }; - - # TODO: delete this eventually - nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ]; - - # This option defines the first version of NixOS you have installed on this particular machine, - # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. - # - # Most users should NEVER change this value after the initial install, for any reason, - # even if you've upgraded your system to a new NixOS release. - # - # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, - # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how - # to actually do that. - # - # This value being lower than the current NixOS release does NOT mean your system is - # out of date, out of support, or vulnerable. - # - # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, - # and migrated your data accordingly. - # - # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . - system.stateVersion = "24.11"; # Did you read the comment? - + # Basically equivalent to making the btrbk user root? + security.sudo.extraRules = [ + { + users = [ "btrbk" ]; + commands = [ + { + command = "${pkgs.coreutils}/bin/test"; + options = [ "NOPASSWD" ]; + } + { + command = "${pkgs.coreutils}/bin/readlink"; + options = [ "NOPASSWD" ]; + } + { + command = "${pkgs.btrfs-progs}/bin/btrfs"; + options = [ "NOPASSWD" ]; + } + ]; + } + ]; }
• flake.lock
  • @@ -1,5 +1,26 @@
    { "nodes": { + "disko": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1736864502, + "narHash": "sha256-ItkIZyebGvNH2dK9jVGzJHGPtb6BSWLN8Gmef16NeY0=", + "owner": "nix-community", + "repo": "disko", + "rev": "0141aabed359f063de7413f80d906e1d98c0c123", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "latest", + "repo": "disko", + "type": "github" + } + }, "nixpkgs": { "locked": { "lastModified": 1744463964,
  • @@ -18,6 +39,7 @@
    }, "root": { "inputs": { + "disko": "disko", "nixpkgs": "nixpkgs" } }
• flake.nix
  • @@ -5,6 +5,11 @@
    # i.e. nixos-24.11 # Use `nix flake update` to update the flake to the latest revision of the chosen release channel. nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; + + # Building an image for XVM + # https://lantian.pub/en/article/modify-computer/nixos-low-ram-vps.lantian/ + disko.url = "github:nix-community/disko/latest"; + disko.inputs.nixpkgs.follows = "nixpkgs"; }; outputs = inputs@{ self, nixpkgs, ... }:
  • @@ -13,8 +18,24 @@
    pkgs = nixpkgs.legacyPackages.${system}; in { - nixosConfigurations.ThinkPad-X1-Yoga-Gen-6 = nixpkgs.lib.nixosSystem { - modules = [ ./configuration.nix ]; + nixosConfigurations = { + # Very creative name, I know + ThinkPad-X1-Yoga-Gen-6 = nixpkgs.lib.nixosSystem { + modules = [ + ./configuration.nix + ./ThinkPad-X1-Yoga-Gen-6 + ]; + }; + Unnamed-Server = nixpkgs.lib.nixosSystem { + modules = [ + ./configuration.nix + ./Unnamed-Server + inputs.disko.nixosModules.disko + ]; + }; + }; + packages.${system} = { + image = self.nixosConfigurations.Unnamed-Server.config.system.build.diskoImages; }; formatter.${system} = pkgs.nixfmt-tree; };