-2

nix/hosts/eterna.nix

Reviewed

··· 21 21 k3s-node 22 22 lanzaboote 23 23 locale-en-us 24 24 - njust 25 24 podman 26 25 prometheus-node 27 27 - recipes 28 26 ssh-keys 29 27 swap 30 28 syncthing

-2

nix/hosts/jubilife.nix

Reviewed

··· 23 23 k3s-node 24 24 lanzaboote 25 25 locale-en-us 26 26 - njust 27 26 plex 28 27 podman 29 28 prometheus-node 30 29 qbittorrent 31 31 - recipes 32 30 ssh-keys 33 31 swap 34 32 syncthing

-2

nix/hosts/pastoria.nix

Reviewed

··· 12 12 fail2ban 13 13 k3s-node 14 14 locale-en-us 15 15 - njust 16 15 podman 17 16 prometheus-node 18 18 - recipes 19 17 ssh-keys 20 18 swap 21 19 tailscale

-2

nix/hosts/snowpoint.nix

Reviewed

··· 16 16 k3s-node 17 17 locale-en-us 18 18 media-share 19 19 - njust 20 19 plex 21 20 prometheus-node 22 22 - recipes 23 21 ssh-keys 24 22 swap 25 23 syncthing

-2

nix/hosts/solaceon.nix

Reviewed

··· 12 12 fail2ban 13 13 k3s-node 14 14 locale-en-us 15 15 - njust 16 15 podman 17 16 prometheus-node 18 18 - recipes 19 17 ssh-keys 20 18 swap 21 19 tailscale

-13

nix/nixos/profiles/btrfs.nix

Reviewed

··· 70 70 persistentTimer = true; 71 71 }; 72 72 }; 73 73 - 74 74 - myRecipes.btrfs = lib.mkIf (btrfsFSDevices != []) '' 75 75 - # List snapper snapshots 76 76 - [group('btrfs')] 77 77 - snapshots config="home": 78 78 - snapper -c {{config}} list 79 79 - 80 80 - # Create a manual snapshot 81 81 - [group('btrfs')] 82 82 - create-snapshot config="home" desc="manual": 83 83 - @echo "Creating snapshot '{{desc}}' for config {{config}}" 84 84 - snapper -c {{config}} create --description "{{desc}}" 85 85 - ''; 86 73 }; 87 74 }; 88 75 }

-96

nix/nixos/programs/njust.nix

Reviewed

··· 1 1 - { 2 2 - flake.modules.nixos.njust = { 3 3 - config, 4 4 - lib, 5 5 - pkgs, 6 6 - ... 7 7 - }: let 8 8 - cfg = config.myNjust; 9 9 - 10 10 - defaultRecipes = { 11 11 - secureboot = '' 12 12 - # Check Secure Boot status 13 13 - [group('secureboot')] 14 14 - sb-status: 15 15 - sudo bootctl status 16 16 - 17 17 - # Generate Secure Boot keys 18 18 - [group('secureboot')] 19 19 - gen-sb-keys: 20 20 - @echo "Generating Secure Boot keys..." 21 21 - sudo sbctl create-keys 22 22 - 23 23 - # Enroll Secure Boot keys 24 24 - [group('secureboot')] 25 25 - enroll-sb-keys: 26 26 - sudo sbctl enroll-keys --microsoft 27 27 - ''; 28 28 - 29 29 - full-disk-encryption = '' 30 30 - # List encrypted volumes 31 31 - [group('encryption')] 32 32 - fde-status: 33 33 - lsblk -o NAME,FSTYPE,SIZE,MOUNTPOINT,TYPE,UUID | grep crypt 34 34 - 35 35 - # Enable TPM2 disk unlock 36 36 - [group('encryption')] 37 37 - [confirm("Verify Secure Boot is active before continuing!")] 38 38 - enable-tpm2-unlock crypt="/dev/nvme0n1p2": 39 39 - sudo systemd-cryptenroll --tpm2-device=auto --tpm2-pcrs=0+2+7+12 --wipe-slot=tpm2 {{crypt}} 40 40 - 41 41 - # Enable FIDO2 disk unlock 42 42 - [group('encryption')] 43 43 - enable-fido2-unlock crypt="/dev/nvme0n1p2": 44 44 - sudo systemd-cryptenroll --fido2-device=auto {{crypt}} 45 45 - ''; 46 46 - }; 47 47 - 48 48 - recipes = config.myRecipes // lib.optionalAttrs cfg.defaultRecipes defaultRecipes; 49 49 - 50 50 - mergedJustfileContent = '' 51 51 - _default: 52 52 - @printf '\033[1;36mnjust\033[0m\n' 53 53 - @printf 'Just-based recipe runner for NixOS.\n\n' 54 54 - @printf '\033[1;33mUsage:\033[0m njust <recipe> [args...]\n\n' 55 55 - @njust --list --list-heading $'Available recipes:\n\n' 56 56 - 57 57 - ${lib.concatStringsSep "\n" (lib.attrValues recipes)} 58 58 - ''; 59 59 - 60 60 - validatedJustfile = 61 61 - pkgs.runCommand "njust-justfile-validated" { 62 62 - nativeBuildInputs = [pkgs.just]; 63 63 - preferLocalBuild = true; 64 64 - } '' 65 65 - echo ${lib.escapeShellArg mergedJustfileContent} > justfile 66 66 - 67 67 - echo "Validating njust justfile syntax..." 68 68 - just --justfile justfile --summary >/dev/null || { 69 69 - echo "ERROR: njust justfile has syntax errors!" 70 70 - echo "Justfile content:" 71 71 - cat justfile 72 72 - exit 1 73 73 - } 74 74 - 75 75 - cp justfile $out 76 76 - echo "njust justfile validation passed" 77 77 - ''; 78 78 - 79 79 - njustScript = pkgs.writeShellApplication { 80 80 - name = "njust"; 81 81 - runtimeInputs = [pkgs.jq pkgs.just]; 82 82 - text = '' 83 83 - exec just --working-directory "$PWD" --justfile ${validatedJustfile} "$@" 84 84 - ''; 85 85 - }; 86 86 - in { 87 87 - options.myNjust = { 88 88 - defaultRecipes = lib.mkOption { 89 89 - type = lib.types.bool; 90 90 - default = true; 91 91 - }; 92 92 - }; 93 93 - 94 94 - config.environment.systemPackages = [njustScript]; 95 95 - }; 96 96 - }

-8

nix/nixos/recipes.nix

Reviewed

··· 1 1 - { 2 2 - flake.modules.nixos.recipes = {lib, ...}: { 3 3 - options.myRecipes = lib.mkOption { 4 4 - type = lib.types.attrsOf lib.types.str; 5 5 - default = {}; 6 6 - }; 7 7 - }; 8 8 - }

-19

nix/nixos/services/tailscale.nix

Reviewed

··· 64 64 useRoutingFeatures = "both"; 65 65 }; 66 66 }; 67 67 - 68 68 - myRecipes.tailscale = '' 69 69 - # Connect to Mullvad NYC 70 70 - [group('tailscale')] 71 71 - enable-mullvad: 72 72 - @echo "Connecting to Mullvad NYC exit node..." 73 73 - tailscale set --exit-node=us-nyc-wg-301.mullvad.ts.net 74 74 - 75 75 - # Disconnect from Mullvad NYC 76 76 - [group('tailscale')] 77 77 - disable-mullvad: 78 78 - @echo "Disconnecting from exit node..." 79 79 - tailscale set --exit-node= 80 80 - 81 81 - # Show Tailscale status 82 82 - [group('tailscale')] 83 83 - ts-status: 84 84 - tailscale status 85 85 - ''; 86 67 }; 87 68 }; 88 69 }