nix: remove unnecessary config = {} · aly.codes/infra@726b04e

+14 -16

nix/nixos/locale-en-us.nix

··· 1 1 {lib, ...}: { 2 2 flake.modules.nixos.locale-en-us = { 3 - config = { 4 - i18n = { 5 - defaultLocale = lib.mkDefault "en_US.UTF-8"; 3 + i18n = { 4 + defaultLocale = lib.mkDefault "en_US.UTF-8"; 6 5 7 - extraLocaleSettings = { 8 - LC_ADDRESS = lib.mkDefault "en_US.UTF-8"; 9 - LC_IDENTIFICATION = lib.mkDefault "en_US.UTF-8"; 10 - LC_MEASUREMENT = lib.mkDefault "en_US.UTF-8"; 11 - LC_MONETARY = lib.mkDefault "en_US.UTF-8"; 12 - LC_NAME = lib.mkDefault "en_US.UTF-8"; 13 - LC_NUMERIC = lib.mkDefault "en_US.UTF-8"; 14 - LC_PAPER = lib.mkDefault "en_US.UTF-8"; 15 - LC_TELEPHONE = lib.mkDefault "en_US.UTF-8"; 16 - LC_TIME = lib.mkDefault "en_US.UTF-8"; 17 - }; 6 + extraLocaleSettings = { 7 + LC_ADDRESS = lib.mkDefault "en_US.UTF-8"; 8 + LC_IDENTIFICATION = lib.mkDefault "en_US.UTF-8"; 9 + LC_MEASUREMENT = lib.mkDefault "en_US.UTF-8"; 10 + LC_MONETARY = lib.mkDefault "en_US.UTF-8"; 11 + LC_NAME = lib.mkDefault "en_US.UTF-8"; 12 + LC_NUMERIC = lib.mkDefault "en_US.UTF-8"; 13 + LC_PAPER = lib.mkDefault "en_US.UTF-8"; 14 + LC_TELEPHONE = lib.mkDefault "en_US.UTF-8"; 15 + LC_TIME = lib.mkDefault "en_US.UTF-8"; 18 16 }; 17 + }; 19 18 20 - time.timeZone = lib.mkDefault "America/New_York"; 21 - }; 19 + time.timeZone = lib.mkDefault "America/New_York"; 22 20 }; 23 21 }

+33 -35

nix/nixos/profiles/arr.nix

··· 10 10 description = "The directory where *arr stores its data files."; 11 11 }; 12 12 13 - config = lib.mkMerge [ 14 - { 15 - services = { 16 - bazarr = { 17 - enable = true; 18 - dataDir = "${config.myArr.dataDir}/bazarr"; 19 - openFirewall = true; 20 - }; 13 + config = { 14 + services = { 15 + bazarr = { 16 + enable = true; 17 + dataDir = "${config.myArr.dataDir}/bazarr"; 18 + openFirewall = true; 19 + }; 21 20 22 - lidarr = { 23 - enable = true; 24 - dataDir = "${config.myArr.dataDir}/lidarr/.config/Lidarr"; 25 - openFirewall = true; 26 - }; 21 + lidarr = { 22 + enable = true; 23 + dataDir = "${config.myArr.dataDir}/lidarr/.config/Lidarr"; 24 + openFirewall = true; 25 + }; 27 26 28 - prowlarr = { 29 - enable = true; 30 - openFirewall = true; 31 - }; 27 + prowlarr = { 28 + enable = true; 29 + openFirewall = true; 30 + }; 32 31 33 - radarr = { 34 - enable = true; 35 - dataDir = "${config.myArr.dataDir}/radarr/.config/Radarr/"; 36 - openFirewall = true; 37 - }; 32 + radarr = { 33 + enable = true; 34 + dataDir = "${config.myArr.dataDir}/radarr/.config/Radarr/"; 35 + openFirewall = true; 36 + }; 38 37 39 - sonarr = { 40 - enable = true; 41 - dataDir = "${config.myArr.dataDir}/sonarr/.config/NzbDrone/"; 42 - openFirewall = true; 43 - }; 38 + sonarr = { 39 + enable = true; 40 + dataDir = "${config.myArr.dataDir}/sonarr/.config/NzbDrone/"; 41 + openFirewall = true; 44 42 }; 43 + }; 45 44 46 - systemd.tmpfiles.rules = [ 47 - "d ${config.services.lidarr.dataDir} 0755 lidarr lidarr" 48 - "d ${config.services.radarr.dataDir} 0755 radarr radarr" 49 - "d ${config.services.readarr.dataDir} 0755 readarr readarr" 50 - "d ${config.services.sonarr.dataDir} 0755 sonarr sonarr" 51 - ]; 52 - } 53 - ]; 45 + systemd.tmpfiles.rules = [ 46 + "d ${config.services.lidarr.dataDir} 0755 lidarr lidarr" 47 + "d ${config.services.radarr.dataDir} 0755 radarr radarr" 48 + "d ${config.services.readarr.dataDir} 0755 readarr readarr" 49 + "d ${config.services.sonarr.dataDir} 0755 sonarr sonarr" 50 + ]; 51 + }; 54 52 }; 55 53 56 54 flake.modules.nixos.backups = {

+43 -47

nix/nixos/profiles/btrfs.nix

··· 34 34 in { 35 35 options.myBtrfs.deduplicate = lib.mkEnableOption "deduplicate btrfs filesystems"; 36 36 37 - config = lib.mkMerge [ 38 - { 39 - boot.supportedFilesystems = ["btrfs"]; 40 - environment.systemPackages = lib.optionals config.services.xserver.enable [pkgs.snapper-gui]; 37 + config = { 38 + boot.supportedFilesystems = ["btrfs"]; 39 + environment.systemPackages = lib.optionals config.services.xserver.enable [pkgs.snapper-gui]; 41 40 42 - services = lib.mkIf (btrfsFSDevices != []) { 43 - beesd.filesystems = lib.mkIf config.myBtrfs.deduplicate beesdConfig; 44 - btrfs.autoScrub.enable = true; 41 + services = lib.mkIf (btrfsFSDevices != []) { 42 + beesd.filesystems = lib.mkIf config.myBtrfs.deduplicate beesdConfig; 43 + btrfs.autoScrub.enable = true; 45 44 46 - snapper = { 47 - configs.home = lib.mkIf hasHomeSubvolume { 48 - ALLOW_GROUPS = ["users"]; 49 - FSTYPE = "btrfs"; 50 - SUBVOLUME = "/home"; 51 - TIMELINE_CLEANUP = true; 52 - TIMELINE_CREATE = true; 53 - }; 45 + snapper = { 46 + configs.home = lib.mkIf hasHomeSubvolume { 47 + ALLOW_GROUPS = ["users"]; 48 + FSTYPE = "btrfs"; 49 + SUBVOLUME = "/home"; 50 + TIMELINE_CLEANUP = true; 51 + TIMELINE_CREATE = true; 52 + }; 54 53 55 - filters = '' 56 - -.bash_profile 57 - -.bashrc 58 - -.cache 59 - -.config 60 - -.librewolf 61 - -.local 62 - -.mozilla 63 - -.nix-profile 64 - -.pki 65 - -.share 66 - -.snapshots 67 - -.thunderbird 68 - -.zshrc 69 - ''; 54 + filters = '' 55 + -.bash_profile 56 + -.bashrc 57 + -.cache 58 + -.config 59 + -.librewolf 60 + -.local 61 + -.mozilla 62 + -.nix-profile 63 + -.pki 64 + -.share 65 + -.snapshots 66 + -.thunderbird 67 + -.zshrc 68 + ''; 70 69 71 - persistentTimer = true; 72 - }; 70 + persistentTimer = true; 73 71 }; 74 - } 72 + }; 75 73 76 - { 77 - myRecipes.btrfs = lib.mkIf (btrfsFSDevices != []) '' 78 - # List snapper snapshots 79 - [group('btrfs')] 80 - snapshots config="home": 81 - snapper -c {{config}} list 74 + myRecipes.btrfs = lib.mkIf (btrfsFSDevices != []) '' 75 + # List snapper snapshots 76 + [group('btrfs')] 77 + snapshots config="home": 78 + snapper -c {{config}} list 82 79 83 - # Create a manual snapshot 84 - [group('btrfs')] 85 - create-snapshot config="home" desc="manual": 86 - @echo "Creating snapshot '{{desc}}' for config {{config}}" 87 - snapper -c {{config}} create --description "{{desc}}" 88 - ''; 89 - } 90 - ]; 80 + # Create a manual snapshot 81 + [group('btrfs')] 82 + create-snapshot config="home" desc="manual": 83 + @echo "Creating snapshot '{{desc}}' for config {{config}}" 84 + snapper -c {{config}} create --description "{{desc}}" 85 + ''; 86 + }; 91 87 }; 92 88 }

+70 -72

nix/nixos/profiles/k3s.nix

··· 42 42 ingress = lib.mkEnableOption "cute.haus/ingress=true node label"; 43 43 }; 44 44 45 - config = lib.mkMerge [ 46 - { 47 - sops.secrets.k3s = { 48 - sopsFile = "${self}/secrets/k3s.yaml"; 49 - key = "TOKEN"; 50 - }; 45 + config = { 46 + sops.secrets.k3s = { 47 + sopsFile = "${self}/secrets/k3s.yaml"; 48 + key = "TOKEN"; 49 + }; 51 50 52 - # systemd-oomd fights kubelet's eviction manager 53 - systemd.oomd.enable = lib.mkForce false; 51 + # systemd-oomd fights kubelet's eviction manager 52 + systemd.oomd.enable = lib.mkForce false; 54 53 55 - networking.firewall.allowedTCPPorts = lib.mkIf cfg.ingress [80 443 2222]; 54 + networking.firewall.allowedTCPPorts = lib.mkIf cfg.ingress [80 443 2222]; 56 55 57 - services = { 58 - k3s = { 59 - enable = true; 60 - inherit (cfg) role clusterInit; 61 - serverAddr = lib.mkIf (cfg.serverAddr != null) cfg.serverAddr; 62 - tokenFile = config.sops.secrets.k3s.path; 63 - extraFlags = 64 - ["--flannel-iface=tailscale0"] 65 - ++ lib.optionals (cfg.role == "server") ( 66 - [ 67 - "--service-node-port-range=8000-32767" 68 - "--disable=traefik" 69 - "--disable=servicelb" 70 - ] 71 - ++ map (san: "--tls-san=${san}") cfg.tlsSans 72 - ) 73 - ++ lib.optionals cfg.clusterInit ["--write-kubeconfig-mode=644"] 74 - ++ lib.optionals (cfg.zone != null) ["--node-label=topology.kubernetes.io/zone=${cfg.zone}"] 75 - ++ lib.optionals cfg.ingress ["--node-label=cute.haus/ingress=true"]; 76 - }; 56 + services = { 57 + k3s = { 58 + enable = true; 59 + inherit (cfg) role clusterInit; 60 + serverAddr = lib.mkIf (cfg.serverAddr != null) cfg.serverAddr; 61 + tokenFile = config.sops.secrets.k3s.path; 62 + extraFlags = 63 + ["--flannel-iface=tailscale0"] 64 + ++ lib.optionals (cfg.role == "server") ( 65 + [ 66 + "--service-node-port-range=8000-32767" 67 + "--disable=traefik" 68 + "--disable=servicelb" 69 + ] 70 + ++ map (san: "--tls-san=${san}") cfg.tlsSans 71 + ) 72 + ++ lib.optionals cfg.clusterInit ["--write-kubeconfig-mode=644"] 73 + ++ lib.optionals (cfg.zone != null) ["--node-label=topology.kubernetes.io/zone=${cfg.zone}"] 74 + ++ lib.optionals cfg.ingress ["--node-label=cute.haus/ingress=true"]; 75 + }; 77 76 78 - openiscsi = { 79 - enable = true; 80 - name = "iqn.2026-05.haus.cute:${config.networking.hostName}"; 81 - }; 77 + openiscsi = { 78 + enable = true; 79 + name = "iqn.2026-05.haus.cute:${config.networking.hostName}"; 82 80 }; 81 + }; 83 82 84 - environment.systemPackages = with pkgs; [ 85 - helmfile 86 - kubernetes-helm 87 - nfs-utils 88 - ]; 83 + environment.systemPackages = with pkgs; [ 84 + helmfile 85 + kubernetes-helm 86 + nfs-utils 87 + ]; 89 88 90 - systemd = { 91 - # Longhorn instance-manager looks for binaries in /usr/local/bin 92 - tmpfiles.rules = [ 93 - "L+ /usr/local/bin - - - - /run/current-system/sw/bin/" 94 - ]; 89 + systemd = { 90 + # Longhorn instance-manager looks for binaries in /usr/local/bin 91 + tmpfiles.rules = [ 92 + "L+ /usr/local/bin - - - - /run/current-system/sw/bin/" 93 + ]; 95 94 96 - services = { 97 - # Block k3s startup until tailscale0 has its IP — flannel-iface=tailscale0 98 - # otherwise races and etcd peer setup fails on cold boot. 99 - k3s = { 100 - after = ["tailscaled.service"]; 101 - wants = ["tailscaled.service"]; 102 - serviceConfig.ExecStartPre = pkgs.writeShellScript "wait-tailscale0" '' 103 - until ${pkgs.iproute2}/bin/ip -4 addr show tailscale0 | grep -q inet; do 104 - ${pkgs.coreutils}/bin/sleep 1 105 - done 106 - ''; 107 - }; 95 + services = { 96 + # Block k3s startup until tailscale0 has its IP — flannel-iface=tailscale0 97 + # otherwise races and etcd peer setup fails on cold boot. 98 + k3s = { 99 + after = ["tailscaled.service"]; 100 + wants = ["tailscaled.service"]; 101 + serviceConfig.ExecStartPre = pkgs.writeShellScript "wait-tailscale0" '' 102 + until ${pkgs.iproute2}/bin/ip -4 addr show tailscale0 | grep -q inet; do 103 + ${pkgs.coreutils}/bin/sleep 1 104 + done 105 + ''; 106 + }; 108 107 109 - # Cleanly log out iSCSI sessions at shutdown so reboots don't hang 110 - # waiting for udev scsi_id timeouts against dead longhorn devices. 111 - iscsi-logout = { 112 - description = "Log out iSCSI sessions cleanly at shutdown"; 113 - after = ["iscsid.service"]; 114 - before = ["k3s.service"]; 115 - requires = ["iscsid.service"]; 116 - wantedBy = ["multi-user.target"]; 117 - serviceConfig = { 118 - Type = "oneshot"; 119 - RemainAfterExit = true; 120 - ExecStart = "${pkgs.coreutils}/bin/true"; 121 - ExecStop = "-${pkgs.openiscsi}/bin/iscsiadm -m node -u"; 122 - TimeoutStopSec = "30s"; 123 - }; 108 + # Cleanly log out iSCSI sessions at shutdown so reboots don't hang 109 + # waiting for udev scsi_id timeouts against dead longhorn devices. 110 + iscsi-logout = { 111 + description = "Log out iSCSI sessions cleanly at shutdown"; 112 + after = ["iscsid.service"]; 113 + before = ["k3s.service"]; 114 + requires = ["iscsid.service"]; 115 + wantedBy = ["multi-user.target"]; 116 + serviceConfig = { 117 + Type = "oneshot"; 118 + RemainAfterExit = true; 119 + ExecStart = "${pkgs.coreutils}/bin/true"; 120 + ExecStop = "-${pkgs.openiscsi}/bin/iscsiadm -m node -u"; 121 + TimeoutStopSec = "30s"; 124 122 }; 125 123 }; 126 124 }; 127 - } 128 - ]; 125 + }; 126 + }; 129 127 }; 130 128 131 129 flake.modules.nixos.backups = {

+24 -26

nix/nixos/services/plex.nix

··· 10 10 type = lib.types.str; 11 11 }; 12 12 13 - config = lib.mkMerge [ 14 - { 15 - services.plex = { 16 - enable = true; 17 - dataDir = "${config.myPlex.dataDir}/plex"; 13 + config = { 14 + services.plex = { 15 + enable = true; 16 + dataDir = "${config.myPlex.dataDir}/plex"; 18 17 19 - extraPlugins = [ 20 - (builtins.path { 21 - name = "Audnexus.bundle"; 22 - path = inputs.audnexus; 23 - }) 24 - (builtins.path { 25 - name = "Hama.bundle"; 26 - path = inputs.hama; 27 - }) 28 - ]; 18 + extraPlugins = [ 19 + (builtins.path { 20 + name = "Audnexus.bundle"; 21 + path = inputs.audnexus; 22 + }) 23 + (builtins.path { 24 + name = "Hama.bundle"; 25 + path = inputs.hama; 26 + }) 27 + ]; 29 28 30 - extraScanners = [ 31 - (builtins.path { 32 - name = "Absolute-Series-Scanner"; 33 - path = inputs.absolute; 34 - }) 35 - ]; 29 + extraScanners = [ 30 + (builtins.path { 31 + name = "Absolute-Series-Scanner"; 32 + path = inputs.absolute; 33 + }) 34 + ]; 36 35 37 - openFirewall = true; 38 - }; 36 + openFirewall = true; 37 + }; 39 38 40 - systemd.services.plex.serviceConfig.TimeoutStopSec = 15; 41 - } 42 - ]; 39 + systemd.services.plex.serviceConfig.TimeoutStopSec = 15; 40 + }; 43 41 }; 44 42 45 43 flake.modules.nixos.tautulli = {

+6 -10

nix/nixos/services/qbittorrent.nix

··· 40 40 }; 41 41 }; 42 42 43 - config = lib.mkMerge [ 44 - { 45 - services.qbittorrent = { 46 - inherit (cfg) openFirewall user group package; 47 - enable = true; 48 - profileDir = cfg.dataDir; 49 - webuiPort = cfg.port; 50 - }; 51 - } 52 - ]; 43 + config.services.qbittorrent = { 44 + inherit (cfg) openFirewall user group package; 45 + enable = true; 46 + profileDir = cfg.dataDir; 47 + webuiPort = cfg.port; 48 + }; 53 49 }; 54 50 55 51 flake.modules.nixos.backups = {

+55 -59

nix/nixos/services/tailscale.nix

··· 18 18 }; 19 19 }; 20 20 21 - config = lib.mkMerge [ 22 - { 23 - sops.secrets.tailscaleAuthKey = { 24 - sopsFile = "${self}/secrets/tailscale.yaml"; 25 - key = "auth_key"; 26 - }; 21 + config = { 22 + sops.secrets.tailscaleAuthKey = { 23 + sopsFile = "${self}/secrets/tailscale.yaml"; 24 + key = "auth_key"; 25 + }; 27 26 28 - assertions = [ 29 - { 30 - assertion = config.myTailscale.authKeyFile != null; 31 - message = "config.myTailscale.authKeyFile cannot be null."; 32 - } 33 - ]; 27 + assertions = [ 28 + { 29 + assertion = config.myTailscale.authKeyFile != null; 30 + message = "config.myTailscale.authKeyFile cannot be null."; 31 + } 32 + ]; 34 33 35 - networking.firewall = { 36 - allowedUDPPorts = [config.services.tailscale.port]; 37 - trustedInterfaces = [config.services.tailscale.interfaceName]; 38 - }; 34 + networking.firewall = { 35 + allowedUDPPorts = [config.services.tailscale.port]; 36 + trustedInterfaces = [config.services.tailscale.interfaceName]; 37 + }; 39 38 40 - services = { 41 - # When caddy is also enabled, expose a tailnet-hostname vhost that 42 - # proxies the local syncthing UI through /syncthing/. 43 - caddy = lib.mkIf config.services.caddy.enable { 44 - virtualHosts."${config.networking.hostName}.narwhal-snapper.ts.net".extraConfig = lib.concatLines (lib.optional config.services.syncthing.enable '' 45 - redir /syncthing /syncthing/ 46 - handle_path /syncthing/* { 47 - reverse_proxy localhost:8384 { 48 - header_up Host localhost 49 - } 39 + services = { 40 + # When caddy is also enabled, expose a tailnet-hostname vhost that 41 + # proxies the local syncthing UI through /syncthing/. 42 + caddy = lib.mkIf config.services.caddy.enable { 43 + virtualHosts."${config.networking.hostName}.narwhal-snapper.ts.net".extraConfig = lib.concatLines (lib.optional config.services.syncthing.enable '' 44 + redir /syncthing /syncthing/ 45 + handle_path /syncthing/* { 46 + reverse_proxy localhost:8384 { 47 + header_up Host localhost 50 48 } 51 - ''); 52 - }; 49 + } 50 + ''); 51 + }; 53 52 54 - tailscale = { 55 - enable = true; 56 - inherit (config.myTailscale) authKeyFile; 53 + tailscale = { 54 + enable = true; 55 + inherit (config.myTailscale) authKeyFile; 57 56 58 - extraUpFlags = 59 - ["--ssh"] 60 - ++ lib.optional (config.myTailscale.operator != null) 61 - "--operator ${config.myTailscale.operator}"; 57 + extraUpFlags = 58 + ["--ssh"] 59 + ++ lib.optional (config.myTailscale.operator != null) 60 + "--operator ${config.myTailscale.operator}"; 62 61 63 - openFirewall = true; 64 - permitCertUid = lib.mkIf config.services.caddy.enable "caddy"; 65 - useRoutingFeatures = "both"; 66 - }; 62 + openFirewall = true; 63 + permitCertUid = lib.mkIf config.services.caddy.enable "caddy"; 64 + useRoutingFeatures = "both"; 67 65 }; 68 - } 66 + }; 69 67 70 - { 71 - myRecipes.tailscale = '' 72 - # Connect to Mullvad NYC 73 - [group('tailscale')] 74 - enable-mullvad: 75 - @echo "Connecting to Mullvad NYC exit node..." 76 - tailscale set --exit-node=us-nyc-wg-301.mullvad.ts.net 68 + myRecipes.tailscale = '' 69 + # Connect to Mullvad NYC 70 + [group('tailscale')] 71 + enable-mullvad: 72 + @echo "Connecting to Mullvad NYC exit node..." 73 + tailscale set --exit-node=us-nyc-wg-301.mullvad.ts.net 77 74 78 - # Disconnect from Mullvad NYC 79 - [group('tailscale')] 80 - disable-mullvad: 81 - @echo "Disconnecting from exit node..." 82 - tailscale set --exit-node= 75 + # Disconnect from Mullvad NYC 76 + [group('tailscale')] 77 + disable-mullvad: 78 + @echo "Disconnecting from exit node..." 79 + tailscale set --exit-node= 83 80 84 - # Show Tailscale status 85 - [group('tailscale')] 86 - ts-status: 87 - tailscale status 88 - ''; 89 - } 90 - ]; 81 + # Show Tailscale status 82 + [group('tailscale')] 83 + ts-status: 84 + tailscale status 85 + ''; 86 + }; 91 87 }; 92 88 }

Configure Feed

Configure Feed