├── handlers └── main.yml ├── current-version.txt ├── .gitattributes ├── machines └── nixos.nix ├── requirements.yml ├── .github ├── workflows │ ├── constraints.txt │ ├── release-drafter.yml │ ├── labeler.yml │ ├── precommit-update.yml │ ├── release.yml │ └── tests.yml ├── dependabot.yml ├── release-drafter.yml ├── labels.yml └── stale.yml ├── .ansible-lint ├── modules ├── gui │ ├── default.nix │ ├── gnome.nix │ └── xdg.nix ├── services │ ├── default.nix │ ├── arr │ │ ├── prowlarr │ │ │ └── default.nix │ │ ├── lidarr │ │ │ └── default.nix │ │ ├── radarr │ │ │ └── default.nix │ │ ├── sonarr │ │ │ └── default.nix │ │ └── bazarr │ │ │ └── default.nix │ ├── jellyfin │ │ └── default.nix │ ├── deluge │ │ └── default.nix │ └── wireguard-netns │ │ └── default.nix ├── tmux.nix ├── nfs │ └── default.nix └── default.nix ├── .gitignore ├── ansible.cfg ├── .yamllint ├── tasks ├── site.yml ├── ssh.yml └── sudoers.yml ├── .pre-commit-config.yaml ├── pkgs └── overlays.nix ├── src ├── default.nix ├── home.nix ├── terminal.nix ├── dconf.nix ├── users.nix └── base.nix ├── molecule └── default │ ├── converge.yml │ ├── molecule.yml │ └── INSTALL.md ├── eg ├── flake.nix └── local.nix ├── Vagrantfile ├── default.config.yml ├── LICENSE ├── main.yml ├── flake.nix ├── CONTRIBUTING.md ├── CODE_OF_CONDUCT.md ├── README.md └── flake.lock /handlers/main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | -------------------------------------------------------------------------------- /current-version.txt: -------------------------------------------------------------------------------- 1 | 1.4.2 2 | -------------------------------------------------------------------------------- /.gitattributes: -------------------------------------------------------------------------------- 1 | * text=auto eol=lf 2 | -------------------------------------------------------------------------------- /machines/nixos.nix: -------------------------------------------------------------------------------- 1 | { ... }: 2 | { 3 | 4 | } 5 | -------------------------------------------------------------------------------- /requirements.yml: -------------------------------------------------------------------------------- 1 | --- 2 | collections: 3 | - name: community.crypto 4 | version: 2.22.3 5 | -------------------------------------------------------------------------------- /.github/workflows/constraints.txt: -------------------------------------------------------------------------------- 1 | ansible==10.7.0 2 | ansible-lint==25.1.0 3 | yamllint==1.37.1 4 | -------------------------------------------------------------------------------- /.ansible-lint: -------------------------------------------------------------------------------- 1 | --- 2 | exclude_paths: [~/.ansible, roles] 3 | 4 | skip_list: 5 | - '306' 6 | - '106' 7 | -------------------------------------------------------------------------------- /modules/gui/default.nix: -------------------------------------------------------------------------------- 1 | { pkgs, lib, config, ... }: 2 | 3 | { 4 | imports = [ 5 | ./gnome.nix 6 | ./xdg.nix 7 | ]; 8 | } 9 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | /docs/_build/ 2 | *.vagrant 3 | *.retry 4 | roles* 5 | config*.yml 6 | .cache/ 7 | .python-version 8 | *.txt 9 | 10 | # Jetbrains IDEs 11 | .idea/ 12 | 13 | # Visual Studio Code 14 | .vscode/ 15 | 16 | **/flake.lock 17 | -------------------------------------------------------------------------------- /ansible.cfg: -------------------------------------------------------------------------------- 1 | [defaults] 2 | nocows = True 3 | roles_path = ./roles:/etc/ansible/roles 4 | timeout = 30 5 | interpreter_python = /usr/bin/python3 6 | 7 | [ssh_connection] 8 | pipelining = True 9 | control_path = /tmp/ansible-ssh-%%h-%%p-%%r 10 | -------------------------------------------------------------------------------- /.yamllint: -------------------------------------------------------------------------------- 1 | --- 2 | extends: default 3 | 4 | rules: 5 | line-length: 6 | max: 180 7 | level: warning 8 | document-start: 9 | level: error 10 | truthy: 11 | level: error 12 | 13 | ignore: | 14 | .github/stale.yml 15 | .cache 16 | .venv 17 | roles 18 | -------------------------------------------------------------------------------- /.github/dependabot.yml: -------------------------------------------------------------------------------- 1 | --- 2 | version: 2 3 | updates: 4 | - package-ecosystem: github-actions 5 | directory: "/" 6 | schedule: 7 | interval: daily 8 | - package-ecosystem: pip 9 | directory: "/.github/workflows" 10 | schedule: 11 | interval: daily 12 | -------------------------------------------------------------------------------- /tasks/site.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Check ssh password first 3 | ansible.builtin.command: echo "ssh password correct" 4 | changed_when: false 5 | 6 | - name: Check sudo password first 7 | ansible.builtin.command: echo "sudo password correct" 8 | become: true 9 | changed_when: false 10 | -------------------------------------------------------------------------------- /.github/workflows/release-drafter.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Release Drafter 3 | "on": 4 | push: 5 | branches: 6 | - main 7 | jobs: 8 | draft_release: 9 | runs-on: ubuntu-latest 10 | steps: 11 | - uses: release-drafter/release-drafter@v6 12 | env: 13 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 14 | -------------------------------------------------------------------------------- /.pre-commit-config.yaml: -------------------------------------------------------------------------------- 1 | --- 2 | repos: 3 | - repo: https://github.com/pre-commit/pre-commit-hooks 4 | rev: v5.0.0 5 | hooks: 6 | - id: check-added-large-files 7 | - id: check-toml 8 | - id: check-yaml 9 | - id: end-of-file-fixer 10 | - id: trailing-whitespace 11 | - id: check-added-large-files 12 | -------------------------------------------------------------------------------- /pkgs/overlays.nix: -------------------------------------------------------------------------------- 1 | { nixpkgs, nixpkgs-unstable, ... }: 2 | let 3 | pkgs-unstable = _: prev: { 4 | pkgs-unstable = import nixpkgs-unstable { 5 | inherit (prev.stdenv) system; 6 | }; 7 | }; 8 | in 9 | { 10 | nix.nixPath = [ "nixpkgs=${nixpkgs}" ]; 11 | nixpkgs = { 12 | overlays = [ 13 | pkgs-unstable 14 | ]; 15 | }; 16 | } 17 | -------------------------------------------------------------------------------- /modules/services/default.nix: -------------------------------------------------------------------------------- 1 | { lib, ... }: 2 | { 3 | options.homelab.services = { 4 | enable = lib.mkEnableOption "Settings and services for the homelab"; 5 | }; 6 | 7 | imports = [ 8 | ./arr/prowlarr 9 | ./arr/bazarr 10 | ./arr/sonarr 11 | ./arr/radarr 12 | ./deluge 13 | ./jellyfin 14 | ./wireguard-netns 15 | ]; 16 | } 17 | -------------------------------------------------------------------------------- /src/default.nix: -------------------------------------------------------------------------------- 1 | { config, stateVersion, ... }: 2 | 3 | let 4 | homelab = config.homelab; 5 | in 6 | { 7 | system = { 8 | stateVersion = stateVersion; 9 | }; 10 | 11 | home-manager = { 12 | sharedModules = [ (import ./home.nix) ]; 13 | extraSpecialArgs = { 14 | inherit stateVersion; 15 | inherit homelab; 16 | }; 17 | }; 18 | } 19 | -------------------------------------------------------------------------------- /src/home.nix: -------------------------------------------------------------------------------- 1 | { lib, stateVersion, homelab, pkgs, ... }@attrs: 2 | 3 | # here we have system-wide configuration - for user configurations see: src/users.nix 4 | { 5 | imports = [ 6 | (import ./dconf.nix attrs) 7 | (import ./terminal.nix attrs) 8 | ]; 9 | 10 | home = { 11 | stateVersion = stateVersion; 12 | }; 13 | 14 | programs.git = { 15 | enable = true; 16 | }; 17 | } 18 | -------------------------------------------------------------------------------- /.github/workflows/labeler.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Labeler 3 | 4 | "on": 5 | push: 6 | branches: 7 | - main 8 | 9 | jobs: 10 | labeler: 11 | runs-on: ubuntu-latest 12 | steps: 13 | - name: Check out the repository 14 | uses: actions/checkout@v4 15 | 16 | - name: Run Labeler 17 | uses: crazy-max/ghaction-github-labeler@v5 18 | with: 19 | skip-delete: true 20 | -------------------------------------------------------------------------------- /tasks/ssh.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Create .ssh directory if it does not exist 3 | ansible.builtin.file: 4 | path: ~/.ssh 5 | state: directory 6 | mode: 0700 7 | 8 | - name: Generate an OpenSSH keypair 9 | community.crypto.openssh_keypair: 10 | path: "~/.ssh/id_{{ ssh_key_type }}" 11 | type: "{{ ssh_key_type }}" 12 | size: "{{ ssh_key_size }}" 13 | passphrase: "{{ ssh_key_passphrase }}" 14 | become: false 15 | -------------------------------------------------------------------------------- /molecule/default/converge.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Converge 3 | hosts: all 4 | 5 | tasks: 6 | - name: Update apt cache 7 | ansible.builtin.apt: 8 | update_cache: true 9 | cache_valid_time: 3600 10 | become: true 11 | 12 | - name: Install required packages 13 | ansible.builtin.apt: 14 | name: 15 | - gpg 16 | - python3-bcrypt 17 | - python3-requests 18 | become: true 19 | 20 | - name: Import playbook 21 | import_playbook: ../../main.yml 22 | -------------------------------------------------------------------------------- /molecule/default/molecule.yml: -------------------------------------------------------------------------------- 1 | --- 2 | dependency: 3 | name: galaxy 4 | driver: 5 | name: podman 6 | lint: | 7 | set -e 8 | yamllint . 9 | platforms: 10 | - name: instance 11 | image: "docker.io/staticdev/docker-${MOLECULE_DISTRO:-debian12}-ansible:latest" 12 | cgroupns_mode: host 13 | command: "" 14 | volumes: 15 | - /sys/fs/cgroup:/sys/fs/cgroup:rw 16 | pre_build_image: true 17 | provisioner: 18 | name: ansible 19 | config_options: 20 | defaults: 21 | remote_user: molecule 22 | verifier: 23 | name: ansible 24 | -------------------------------------------------------------------------------- /molecule/default/INSTALL.md: -------------------------------------------------------------------------------- 1 | # Podman driver installation guide 2 | 3 | ## Requirements 4 | 5 | - Podman 6 | 7 | ## Install 8 | 9 | Please refer to the [Virtual environment](https://virtualenv.pypa.io/en/latest/) documentation for installation best 10 | practices. If not using a virtual environment, please consider passing the 11 | widely recommended ['--user' flag](https://packaging.python.org/tutorials/installing-packages/#installing-to-the-user-site) when invoking `pip`. 12 | 13 | ```sh 14 | python3 -m pip install 'molecule-plugins[podman]' podman 15 | ``` 16 | -------------------------------------------------------------------------------- /eg/flake.nix: -------------------------------------------------------------------------------- 1 | { 2 | inputs = { 3 | cfg = { 4 | url = "github:staticdev/linux-workstation-playbook"; 5 | }; 6 | }; 7 | 8 | outputs = 9 | { cfg, ... }: 10 | let 11 | mkHost = 12 | host: systemType: 13 | systemType { 14 | hostName = host; 15 | modules = [ 16 | ./hardware-configuration.nix 17 | ./local.nix 18 | ]; 19 | }; 20 | in 21 | { 22 | nixosConfigurations = builtins.mapAttrs mkHost { 23 | nixos = cfg.systemTypes.x86_64; 24 | }; 25 | }; 26 | } 27 | -------------------------------------------------------------------------------- /src/terminal.nix: -------------------------------------------------------------------------------- 1 | { pkgs, ... }: 2 | let 3 | fontFamily = "NotoMono Nerd Font Mono"; 4 | fontSize = 15; 5 | shell = "${pkgs.tmux}/bin/tmux"; 6 | in 7 | { 8 | programs.gnome-terminal = { 9 | enable = true; 10 | themeVariant = "dark"; 11 | showMenubar = false; 12 | profile."352f48f0-7279-422e-9e0a-95228e86bd1d" = { 13 | visibleName = "default"; 14 | default = true; 15 | allowBold = true; 16 | audibleBell = false; 17 | showScrollbar = false; 18 | cursorShape = "block"; 19 | cursorBlinkMode = "off"; 20 | font = "${fontFamily} ${toString fontSize}"; 21 | customCommand = shell; 22 | }; 23 | }; 24 | } 25 | -------------------------------------------------------------------------------- /tasks/sudoers.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # If the user installs GNU sed through homebrew the path is different. 3 | - name: Register path to sed. 4 | ansible.builtin.command: which sed 5 | register: sed_which_result 6 | changed_when: false 7 | when: sed_path is undefined 8 | 9 | - name: Define sed_path variable. 10 | ansible.builtin.set_fact: 11 | sed_path: "{{ sed_which_result.stdout }}" 12 | when: sed_path is undefined 13 | 14 | # Sudoers configuration. 15 | - name: Copy sudoers configuration into place. 16 | ansible.builtin.copy: 17 | content: "{{ sudoers_custom_config }}" 18 | dest: /private/etc/sudoers.d/custom 19 | mode: 0440 20 | validate: "visudo -cf %s" 21 | become: true 22 | -------------------------------------------------------------------------------- /Vagrantfile: -------------------------------------------------------------------------------- 1 | Vagrant.configure("2") do |config| 2 | # Debian 11 3 | config.vm.box = "debian/bookworm64" 4 | # Sync colletions folder 5 | config.vm.provider "virtualbox" do |provider| 6 | # Display the GUI when booting the machine 7 | provider.gui = true # this option does not exist on libvirt provider 8 | 9 | # Install pip 10 | #config.vm.provision "shell", inline: "sudo apt update && sudo apt upgrade -y && apt install -y python3-pip" 11 | # Customize the amount of memory on the VM: 12 | provider.memory = "6000" 13 | 14 | # Run playbook 15 | config.vm.provision "ansible" do |ansible| 16 | ansible.playbook = "main.yml" 17 | ansible.verbose = "vv" 18 | end 19 | end 20 | end 21 | -------------------------------------------------------------------------------- /.github/release-drafter.yml: -------------------------------------------------------------------------------- 1 | --- 2 | template: | 3 | ## Changes 4 | 5 | $CHANGES 6 | 7 | categories: 8 | - title: ":boom: Breaking Changes" 9 | label: "breaking" 10 | - title: ":rocket: Features" 11 | label: "enhancement" 12 | - title: ":fire: Removals and Deprecations" 13 | label: "removal" 14 | - title: ":beetle: Fixes" 15 | label: "bug" 16 | - title: ":raising_hand: Help wanted" 17 | label: "help wanted" 18 | - title: ":racehorse: Performance" 19 | label: "performance" 20 | - title: ":rotating_light: Testing" 21 | label: "testing" 22 | - title: ":construction_worker: Continuous Integration" 23 | label: "ci" 24 | - title: ":books: Documentation" 25 | label: "documentation" 26 | - title: ":hammer: Refactoring" 27 | label: "refactoring" 28 | - title: ":lipstick: Style" 29 | label: "style" 30 | - title: ":package: Dependencies" 31 | labels: 32 | - "dependencies" 33 | - "build" 34 | 35 | exclude-labels: 36 | - "skip-changelog" 37 | -------------------------------------------------------------------------------- /modules/gui/gnome.nix: -------------------------------------------------------------------------------- 1 | { pkgs, lib, config, ... }: 2 | 3 | let 4 | homelab = config.homelab; 5 | in 6 | { 7 | # Configure graphical interfaces 8 | services.xserver = { 9 | enable = true; 10 | displayManager.gdm.enable = true; 11 | desktopManager.gnome.enable = true; 12 | }; 13 | 14 | environment.gnome.excludePackages = with pkgs; [ 15 | epiphany # web browser 16 | ]; 17 | 18 | # Enable sound. 19 | # hardware.pulseaudio.enable = true; 20 | # OR 21 | security.rtkit.enable = true; 22 | services.pipewire = { 23 | enable = true; 24 | alsa = { 25 | enable = true; 26 | support32Bit = true; 27 | }; 28 | pulse.enable = true; 29 | }; 30 | 31 | fonts = { 32 | packages = with pkgs; [ 33 | nerd-fonts.noto 34 | ]; 35 | enableDefaultPackages = true; 36 | }; 37 | 38 | # Add variables for C-Cedilha if on homelab 39 | environment.variables = lib.mkIf homelab.keyboardCCedilla { 40 | GTK_IM_MODULE = "cedilla"; 41 | QT_IM_MODULE = "cedilla"; 42 | }; 43 | } 44 | -------------------------------------------------------------------------------- /default.config.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # SSH config 3 | configure_ssh: true 4 | ssh_key_type: ed25519 # you can also choose between: dsa, ecdsa and ed25519 5 | # For RSA keys, the minimum size is 1024 bits and the default is 4096 bits. Generally, 2048 bits is considered sufficient. 6 | # DSA keys must be exactly 1024 bits as specified by FIPS 186-2. 7 | # For ECDSA keys, size determines the key length by selecting from one of three elliptic curve sizes: 256, 384 or 521 bits. 8 | # Attempting to use bit lengths other than these three values for ECDSA keys will cause this module to fail. 9 | # Ed25519 keys have a fixed length and the size will be ignored. 10 | ssh_key_size: 11 | ssh_key_passphrase: super_secret_password 12 | 13 | # Sudoers config 14 | configure_sudoers: false 15 | sudoers_custom_config: "" 16 | # Example: 17 | # sudoers_custom_config: | 18 | # # Allow users in admin group to use sudo with no password. 19 | # %admin ALL=(ALL) NOPASSWD: ALL 20 | 21 | # enable entire screen sharing 22 | enable_screen_sharing: false 23 | 24 | # glob pattern to ansible task files to run after all other tasks are finished. 25 | post_provision_tasks: [] 26 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright © 2022 staticdev 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /.github/workflows/precommit-update.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Pre-commit auto-update 3 | 4 | "on": 5 | # every day at midnight 6 | schedule: 7 | - cron: "0 0 * * *" 8 | 9 | jobs: 10 | pre-commit-auto-update: 11 | runs-on: ubuntu-latest 12 | steps: 13 | - uses: actions/checkout@v4 14 | 15 | - uses: actions/setup-python@v5 16 | 17 | - name: Update pre-commit hooks 18 | uses: browniebroke/pre-commit-autoupdate-action@main 19 | 20 | - name: Create pull request with update 21 | uses: peter-evans/create-pull-request@v7 22 | with: 23 | token: ${{ secrets.GITHUB_TOKEN }} 24 | branch: update/pre-commit-hooks 25 | title: Update pre-commit hooks 26 | commit-message: "chore: update pre-commit hooks" 27 | committer: "dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>" 28 | author: "dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>" 29 | signoff: true 30 | labels: | 31 | dependencies 32 | pre-commit 33 | body: Update versions of pre-commit hooks to latest version. 34 | -------------------------------------------------------------------------------- /.github/workflows/release.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Release 3 | 4 | "on": 5 | push: 6 | branches: 7 | - main 8 | 9 | jobs: 10 | release: 11 | name: Release 12 | runs-on: ubuntu-latest 13 | steps: 14 | - name: Check out the repository 15 | uses: actions/checkout@v4 16 | with: 17 | fetch-depth: 2 18 | 19 | - name: Set up Python 20 | uses: actions/setup-python@v5 21 | with: 22 | python-version: "3.13" 23 | 24 | - name: Check if there is a parent commit 25 | id: check-parent-commit 26 | run: | 27 | echo "::set-output name=sha::$(git rev-parse --verify --quiet HEAD^)" 28 | 29 | - name: Detect and tag new version 30 | id: check-version 31 | if: steps.check-parent-commit.outputs.sha 32 | uses: salsify/action-detect-and-tag-new-version@v2 33 | with: 34 | tag-template: "{VERSION}" 35 | version-command: | 36 | cat current-version.txt 37 | 38 | - name: Publish the release notes 39 | uses: release-drafter/release-drafter@v6 40 | with: 41 | publish: ${{ steps.check-version.outputs.tag != '' }} 42 | tag: ${{ steps.check-version.outputs.tag }} 43 | env: 44 | GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} 45 | -------------------------------------------------------------------------------- /main.yml: -------------------------------------------------------------------------------- 1 | --- 2 | - name: Define hosts 3 | hosts: all 4 | 5 | vars_files: 6 | - default.config.yml 7 | 8 | pre_tasks: 9 | - name: SSH and become checks 10 | ansible.builtin.include_tasks: tasks/site.yml 11 | 12 | - name: Load config 13 | ansible.builtin.include_vars: "{{ item }}" 14 | with_fileglob: 15 | - "{{ playbook_dir }}/config.yml" 16 | 17 | handlers: 18 | - name: Restart gnome 19 | ansible.builtin.command: killall -SIGQUIT gnome-shell 20 | changed_when: true 21 | 22 | tasks: 23 | - name: Create SSH key 24 | ansible.builtin.include_tasks: tasks/ssh.yml 25 | when: configure_ssh 26 | 27 | - name: Configure sudoers 28 | ansible.builtin.include_tasks: tasks/sudoers.yml 29 | when: configure_sudoers 30 | 31 | - name: Enable entire screen sharing 32 | ansible.builtin.lineinfile: 33 | dest: /etc/gdm3/daemon.conf 34 | regexp: '^#\s*WaylandEnable=false.*$' 35 | line: "WaylandEnable=false" 36 | become: true 37 | when: enable_screen_sharing 38 | 39 | - name: Run configured post-provision ansible task files. 40 | ansible.builtin.include_tasks: "{{ outer_item }}" 41 | loop_control: 42 | loop_var: outer_item 43 | with_fileglob: "{{ post_provision_tasks | default(omit) }}" 44 | -------------------------------------------------------------------------------- /modules/services/arr/prowlarr/default.nix: -------------------------------------------------------------------------------- 1 | { config, lib, ... }: 2 | let 3 | service = "prowlarr"; 4 | cfg = config.homelab.services.${service}; 5 | homelab = config.homelab; 6 | in 7 | { 8 | options.homelab.services.${service} = { 9 | enable = lib.mkEnableOption { 10 | description = "Enable ${service}"; 11 | }; 12 | configDir = lib.mkOption { 13 | type = lib.types.str; 14 | default = "/var/lib/${service}"; 15 | }; 16 | url = lib.mkOption { 17 | type = lib.types.str; 18 | default = "${service}.${homelab.baseDomain}"; 19 | }; 20 | homepage.name = lib.mkOption { 21 | type = lib.types.str; 22 | default = "Prowlarr"; 23 | }; 24 | homepage.description = lib.mkOption { 25 | type = lib.types.str; 26 | default = "PVR indexer"; 27 | }; 28 | homepage.icon = lib.mkOption { 29 | type = lib.types.str; 30 | default = "prowlarr.svg"; 31 | }; 32 | homepage.category = lib.mkOption { 33 | type = lib.types.str; 34 | default = "Arr"; 35 | }; 36 | }; 37 | config = lib.mkIf cfg.enable { 38 | services.${service} = { 39 | enable = true; 40 | }; 41 | services.caddy.virtualHosts."${cfg.url}" = { 42 | useACMEHost = homelab.baseDomain; 43 | extraConfig = '' 44 | reverse_proxy http://127.0.0.1:9696 45 | ''; 46 | }; 47 | }; 48 | 49 | } 50 | -------------------------------------------------------------------------------- /modules/services/arr/lidarr/default.nix: -------------------------------------------------------------------------------- 1 | { config, lib, ... }: 2 | let 3 | service = "lidarr"; 4 | cfg = config.homelab.services.${service}; 5 | homelab = config.homelab; 6 | in 7 | { 8 | options.homelab.services.${service} = { 9 | enable = lib.mkEnableOption { 10 | description = "Enable ${service}"; 11 | }; 12 | configDir = lib.mkOption { 13 | type = lib.types.str; 14 | default = "/var/lib/${service}"; 15 | }; 16 | url = lib.mkOption { 17 | type = lib.types.str; 18 | default = "${service}.${homelab.baseDomain}"; 19 | }; 20 | homepage.name = lib.mkOption { 21 | type = lib.types.str; 22 | default = "Lidarr"; 23 | }; 24 | homepage.description = lib.mkOption { 25 | type = lib.types.str; 26 | default = "Music collection manager"; 27 | }; 28 | homepage.icon = lib.mkOption { 29 | type = lib.types.str; 30 | default = "lidarr.svg"; 31 | }; 32 | homepage.category = lib.mkOption { 33 | type = lib.types.str; 34 | default = "Arr"; 35 | }; 36 | }; 37 | config = lib.mkIf cfg.enable { 38 | services.${service} = { 39 | enable = true; 40 | user = homelab.user; 41 | group = homelab.group; 42 | }; 43 | services.caddy.virtualHosts."${cfg.url}" = { 44 | useACMEHost = homelab.baseDomain; 45 | extraConfig = '' 46 | reverse_proxy http://127.0.0.1:8686 47 | ''; 48 | }; 49 | }; 50 | 51 | } 52 | -------------------------------------------------------------------------------- /modules/services/arr/radarr/default.nix: -------------------------------------------------------------------------------- 1 | { config, lib, ... }: 2 | let 3 | service = "radarr"; 4 | cfg = config.homelab.services.${service}; 5 | homelab = config.homelab; 6 | in 7 | { 8 | options.homelab.services.${service} = { 9 | enable = lib.mkEnableOption { 10 | description = "Enable ${service}"; 11 | }; 12 | configDir = lib.mkOption { 13 | type = lib.types.str; 14 | default = "/var/lib/${service}"; 15 | }; 16 | url = lib.mkOption { 17 | type = lib.types.str; 18 | default = "${service}.${homelab.baseDomain}"; 19 | }; 20 | homepage.name = lib.mkOption { 21 | type = lib.types.str; 22 | default = "Radarr"; 23 | }; 24 | homepage.description = lib.mkOption { 25 | type = lib.types.str; 26 | default = "Movie collection manager"; 27 | }; 28 | homepage.icon = lib.mkOption { 29 | type = lib.types.str; 30 | default = "radarr.svg"; 31 | }; 32 | homepage.category = lib.mkOption { 33 | type = lib.types.str; 34 | default = "Arr"; 35 | }; 36 | }; 37 | config = lib.mkIf cfg.enable { 38 | services.${service} = { 39 | enable = true; 40 | user = homelab.user; 41 | group = homelab.group; 42 | }; 43 | services.caddy.virtualHosts."${cfg.url}" = { 44 | useACMEHost = homelab.baseDomain; 45 | extraConfig = '' 46 | reverse_proxy http://127.0.0.1:7878 47 | ''; 48 | }; 49 | }; 50 | 51 | } 52 | -------------------------------------------------------------------------------- /modules/services/arr/sonarr/default.nix: -------------------------------------------------------------------------------- 1 | { config, lib, ... }: 2 | let 3 | service = "sonarr"; 4 | cfg = config.homelab.services.${service}; 5 | homelab = config.homelab; 6 | in 7 | { 8 | options.homelab.services.${service} = { 9 | enable = lib.mkEnableOption { 10 | description = "Enable ${service}"; 11 | }; 12 | configDir = lib.mkOption { 13 | type = lib.types.str; 14 | default = "/var/lib/${service}"; 15 | }; 16 | url = lib.mkOption { 17 | type = lib.types.str; 18 | default = "${service}.${homelab.baseDomain}"; 19 | }; 20 | homepage.name = lib.mkOption { 21 | type = lib.types.str; 22 | default = "Sonarr"; 23 | }; 24 | homepage.description = lib.mkOption { 25 | type = lib.types.str; 26 | default = "TV show collection manager"; 27 | }; 28 | homepage.icon = lib.mkOption { 29 | type = lib.types.str; 30 | default = "sonarr.svg"; 31 | }; 32 | homepage.category = lib.mkOption { 33 | type = lib.types.str; 34 | default = "Arr"; 35 | }; 36 | }; 37 | config = lib.mkIf cfg.enable { 38 | services.${service} = { 39 | enable = true; 40 | user = homelab.user; 41 | group = homelab.group; 42 | }; 43 | services.caddy.virtualHosts."${cfg.url}" = { 44 | useACMEHost = homelab.baseDomain; 45 | extraConfig = '' 46 | reverse_proxy http://127.0.0.1:8989 47 | ''; 48 | }; 49 | }; 50 | 51 | } 52 | -------------------------------------------------------------------------------- /modules/services/arr/bazarr/default.nix: -------------------------------------------------------------------------------- 1 | { config, lib, ... }: 2 | let 3 | service = "bazarr"; 4 | cfg = config.homelab.services.${service}; 5 | homelab = config.homelab; 6 | in 7 | { 8 | options.homelab.services.${service} = { 9 | enable = lib.mkEnableOption { 10 | description = "Enable ${service}"; 11 | }; 12 | configDir = lib.mkOption { 13 | type = lib.types.str; 14 | default = "/var/lib/${service}"; 15 | }; 16 | url = lib.mkOption { 17 | type = lib.types.str; 18 | default = "${service}.${homelab.baseDomain}"; 19 | }; 20 | homepage.name = lib.mkOption { 21 | type = lib.types.str; 22 | default = "Bazarr"; 23 | }; 24 | homepage.description = lib.mkOption { 25 | type = lib.types.str; 26 | default = "Subtitle manager"; 27 | }; 28 | homepage.icon = lib.mkOption { 29 | type = lib.types.str; 30 | default = "bazarr.svg"; 31 | }; 32 | homepage.category = lib.mkOption { 33 | type = lib.types.str; 34 | default = "Arr"; 35 | }; 36 | }; 37 | config = lib.mkIf cfg.enable { 38 | services.${service} = { 39 | enable = true; 40 | user = homelab.user; 41 | group = homelab.group; 42 | }; 43 | services.caddy.virtualHosts."${cfg.url}" = { 44 | useACMEHost = homelab.baseDomain; 45 | extraConfig = '' 46 | reverse_proxy http://127.0.0.1:${toString config.services.${service}.listenPort} 47 | ''; 48 | }; 49 | }; 50 | 51 | } 52 | -------------------------------------------------------------------------------- /flake.nix: -------------------------------------------------------------------------------- 1 | { 2 | inputs = { 3 | nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05"; 4 | nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable"; 5 | nixvim = { 6 | url = "github:nix-community/nixvim/nixos-25.05"; 7 | inputs.nixpkgs.follows = "nixpkgs"; 8 | }; 9 | home-manager = { 10 | url = "github:nix-community/home-manager/release-25.05"; 11 | inputs.nixpkgs.follows = "nixpkgs"; 12 | }; 13 | }; 14 | 15 | outputs = 16 | { self, ... }@inputs: 17 | with inputs; 18 | let 19 | stateVersion = "25.05"; 20 | 21 | # Modules 22 | defaultModules = [ 23 | home-manager.nixosModules.home-manager 24 | nixvim.nixosModules.nixvim 25 | (import "${self}/pkgs/overlays.nix" inputs) 26 | (import "${self}/modules") 27 | (import "${self}/src") 28 | (import "${self}/src/base.nix") 29 | (import "${self}/modules/gui") 30 | ]; 31 | optionalLocalModules = 32 | nix_paths: 33 | builtins.concatLists ( 34 | inputs.nixpkgs.lib.lists.forEach nix_paths ( 35 | path: inputs.nixpkgs.lib.optional (builtins.pathExists path) (import path) 36 | ) 37 | ); 38 | in 39 | { 40 | systemArch = { 41 | amd = "x86_64-linux"; 42 | }; 43 | systemTypes = { 44 | x86_64 = 45 | attrs: 46 | nixpkgs.lib.nixosSystem { 47 | system = self.systemArch.amd; 48 | specialArgs = { 49 | inherit stateVersion; 50 | inherit (attrs) hostName; 51 | }; 52 | modules = [ 53 | (import "${self}/machines/nixos.nix") 54 | ] 55 | ++ defaultModules 56 | ++ optionalLocalModules attrs.modules; 57 | }; 58 | }; 59 | }; 60 | } 61 | -------------------------------------------------------------------------------- /modules/tmux.nix: -------------------------------------------------------------------------------- 1 | { pkgs, ... }: 2 | { 3 | programs.tmux = { 4 | enable = true; 5 | shortcut = "a"; 6 | keyMode = "vi"; 7 | terminal = "screen-256color"; 8 | baseIndex = 1; 9 | escapeTime = 0; 10 | clock24 = true; 11 | historyLimit = 100000; 12 | extraConfig = '' 13 | bind r source-file /etc/tmux.conf 14 | bind - split-window -v -c '#{pane_current_path}' 15 | bind \\ split-window -h -c '#{pane_current_path}' 16 | bind _ split-window -vf -c '#{pane_current_path}' 17 | bind | split-window -hf -c '#{pane_current_path}' 18 | bind -r C-k resize-pane -U 19 | bind -r C-j resize-pane -D 20 | bind -r C-h resize-pane -L 21 | bind -r C-l resize-pane -R 22 | bind -r k select-pane -U 23 | bind -r j select-pane -D 24 | bind -r h select-pane -L 25 | bind -r l select-pane -R 26 | 27 | 28 | bind -T copy-mode-vi MouseDragEnd1Pane send-keys -X copy-pipe 29 | bind -T copy-mode-vi Enter send-keys -X copy-pipe 30 | 31 | set -g set-titles on 32 | set -g mouse on 33 | set -g monitor-activity on 34 | set -g default-command "''${SHELL}" 35 | set -s set-clipboard external 36 | set -g copy-command "${pkgs.wl-clipboard}/bin/wl-copy" 37 | set -ga terminal-overrides ",*256col*:Tc" 38 | set -ga terminal-overrides '*:Ss=\E[%p1%d q:Se=\E[ q' 39 | set -g status-interval 60 40 | set -g status-bg black 41 | set -g status-fg green 42 | set -g window-status-activity-style fg=red 43 | set -g status-left-length 100 44 | set -g status-left '#{?client_prefix,#[fg=red]PFX, } #[fg=green](#S) ' 45 | set -g status-right-length 100 46 | set -g status-right '#[fg=yellow]%Y/%m(%b)/%d %a %H:%M#[default]' 47 | set -g pane-border-lines double 48 | 49 | set-environment -g COLORTERM "truecolor" 50 | ''; 51 | }; 52 | } 53 | -------------------------------------------------------------------------------- /modules/services/jellyfin/default.nix: -------------------------------------------------------------------------------- 1 | { 2 | config, 3 | pkgs, 4 | lib, 5 | ... 6 | }: 7 | let 8 | service = "jellyfin"; 9 | cfg = config.homelab.services.${service}; 10 | homelab = config.homelab; 11 | in 12 | { 13 | options.homelab.services.${service} = { 14 | enable = lib.mkEnableOption { 15 | description = "Enable ${service}"; 16 | }; 17 | configDir = lib.mkOption { 18 | type = lib.types.str; 19 | default = "/var/lib/${service}"; 20 | }; 21 | url = lib.mkOption { 22 | type = lib.types.str; 23 | default = "jellyfin.${homelab.baseDomain}"; 24 | }; 25 | homepage.name = lib.mkOption { 26 | type = lib.types.str; 27 | default = "Jellyfin"; 28 | }; 29 | homepage.description = lib.mkOption { 30 | type = lib.types.str; 31 | default = "The Free Software Media System"; 32 | }; 33 | homepage.icon = lib.mkOption { 34 | type = lib.types.str; 35 | default = "jellyfin.svg"; 36 | }; 37 | homepage.category = lib.mkOption { 38 | type = lib.types.str; 39 | default = "Media"; 40 | }; 41 | }; 42 | config = lib.mkIf cfg.enable { 43 | nixpkgs.overlays = with pkgs; [ 44 | (final: prev: { 45 | jellyfin-web = prev.jellyfin-web.overrideAttrs ( 46 | finalAttrs: previousAttrs: { 47 | installPhase = '' 48 | runHook preInstall 49 | 50 | # this is the important line 51 | sed -i "s###" dist/index.html 52 | 53 | mkdir -p $out/share 54 | cp -a dist $out/share/jellyfin-web 55 | 56 | runHook postInstall 57 | ''; 58 | } 59 | ); 60 | }) 61 | ]; 62 | services.${service} = { 63 | enable = true; 64 | user = homelab.mainUser.name; 65 | group = homelab.mainUser.group; 66 | }; 67 | 68 | services.caddy.virtualHosts."${cfg.url}" = { 69 | useACMEHost = homelab.baseDomain; 70 | extraConfig = '' 71 | reverse_proxy http://127.0.0.1:8096 72 | ''; 73 | }; 74 | }; 75 | 76 | } 77 | -------------------------------------------------------------------------------- /src/dconf.nix: -------------------------------------------------------------------------------- 1 | { lib, homelab, ... }: 2 | 3 | { 4 | home.packages = homelab.dconf.gnomeExtensions; 5 | dconf.settings = lib.mkMerge [ 6 | { 7 | "org/gnome/shell" = lib.mkMerge [ 8 | # Gnome extensions 9 | { 10 | 11 | disable-user-extensions = false; 12 | enabled-extensions = lib.lists.forEach homelab.dconf.gnomeExtensions (e: e.extensionUuid); 13 | } 14 | # Favorite apps for Dash 15 | (lib.mkIf (homelab.dconf.favoriteApps != [ ]) { 16 | favorite-apps = homelab.dconf.favoriteApps; 17 | }) 18 | ]; 19 | } 20 | # Guake keybinding 21 | (lib.mkIf (homelab.dconf.guakeHotkey != null) { 22 | "org/gnome/settings-daemon/plugins/media-keys" = { 23 | custom-keybindings = [ "/org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/guake/" ]; 24 | }; 25 | 26 | "org/gnome/settings-daemon/plugins/media-keys/custom-keybindings/guake" = { 27 | name = "Guake"; 28 | command = "/usr/bin/guake-toggle"; 29 | binding = homelab.dconf.guakeHotkey; 30 | }; 31 | }) 32 | # Hot corners 33 | { 34 | "org/gnome/desktop/interface".enable-hot-corners = homelab.dconf.hotCorners; 35 | } 36 | # Keyboard layout 37 | { 38 | "org/gnome/desktop/input-sources".sources = 39 | map (k: 40 | lib.hm.gvariant.mkTuple [ 41 | "xkb" (k.layout + (if k.variant != null then "+" + k.variant else "")) 42 | ] 43 | ) homelab.dconf.keyboardLayout; 44 | } 45 | # Show lock-screen notifications 46 | { 47 | "org/gnome/desktop/notifications".show-in-lock-screen = homelab.dconf.lockScreenNotifications; 48 | } 49 | # Night light 50 | (lib.mkIf homelab.dconf.nightLight { 51 | "org/gnome/settings-daemon/plugins/color" = { 52 | night-light-enabled = true; 53 | night-light-temperature = 2700; 54 | night-light-schedule-automatic = false; 55 | night-light-schedule-to = 6.0; 56 | night-light-schedule-from = 16.0; 57 | night-light-last-coordinates = "(91.0, 181.0)"; 58 | active = true; 59 | priority = 0; 60 | }; 61 | }) 62 | ]; 63 | } 64 | -------------------------------------------------------------------------------- /.github/labels.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # Labels names are important as they are used by Release Drafter to decide 3 | # regarding where to record them in changelog or if to skip them. 4 | # 5 | # The repository labels will be automatically configured using this file and 6 | # the GitHub Action https://github.com/marketplace/actions/github-labeler. 7 | - name: breaking 8 | description: Breaking Changes 9 | color: "bfd4f2" 10 | - name: bug 11 | description: Something isn't working 12 | color: "d73a4a" 13 | - name: build 14 | description: Build System and Dependencies 15 | color: "bfdadc" 16 | - name: ci 17 | description: Continuous Integration 18 | color: "4a97d6" 19 | - name: dependencies 20 | description: Pull requests that update a dependency file 21 | color: "0366d6" 22 | - name: documentation 23 | description: Improvements or additions to documentation 24 | color: "0075ca" 25 | - name: duplicate 26 | description: This issue or pull request already exists 27 | color: "cfd3d7" 28 | - name: enhancement 29 | description: New feature or request 30 | color: "a2eeef" 31 | - name: github_actions 32 | description: Pull requests that update Github_actions code 33 | color: "000000" 34 | - name: good first issue 35 | description: Good for newcomers 36 | color: "7057ff" 37 | - name: help wanted 38 | description: Extra attention is needed 39 | color: "008672" 40 | - name: invalid 41 | description: This doesn't seem right 42 | color: "e4e669" 43 | - name: performance 44 | description: Performance 45 | color: "016175" 46 | - name: python 47 | description: Pull requests that update Python code 48 | color: "2b67c6" 49 | - name: question 50 | description: Further information is requested 51 | color: "d876e3" 52 | - name: refactoring 53 | description: Refactoring 54 | color: "ef67c4" 55 | - name: removal 56 | description: Removals and deprecations 57 | color: "9ae7ea" 58 | - name: style 59 | description: Style 60 | color: "c120e5" 61 | - name: testing 62 | description: Testing 63 | color: "b1fc6f" 64 | - name: wontfix 65 | description: This will not be worked on 66 | color: "ffffff" 67 | - name: skip-changelog 68 | description: This will not be added to release notes 69 | color: "dddddd" 70 | -------------------------------------------------------------------------------- /modules/nfs/default.nix: -------------------------------------------------------------------------------- 1 | { config, lib, pkgs, ... }: 2 | 3 | let 4 | hl = config.homelab; 5 | cfg = hl.nfs; 6 | in 7 | { 8 | options.homelab.nfs = { 9 | enable = lib.mkEnableOption { 10 | description = "Enable declarative NFS mounts for the homelab"; 11 | }; 12 | 13 | mounts = lib.mkOption { 14 | type = lib.types.attrsOf (lib.types.submodule { 15 | options = { 16 | remoteHost = lib.mkOption { 17 | type = lib.types.str; 18 | description = "Remote NFS server hostname or IP"; 19 | }; 20 | 21 | remotePath = lib.mkOption { 22 | type = lib.types.str; 23 | description = "Path on the remote server to mount"; 24 | }; 25 | 26 | localPath = lib.mkOption { 27 | type = lib.types.str; 28 | description = "Path where the NFS share will be mounted locally"; 29 | }; 30 | 31 | options = lib.mkOption { 32 | type = lib.types.str; 33 | default = "defaults"; 34 | description = "Mount options for the NFS mount"; 35 | }; 36 | 37 | fsType = lib.mkOption { 38 | type = lib.types.enum [ "nfs" "nfs4" ]; 39 | default = "nfs4"; 40 | description = "NFS version to use (nfs or nfs4)"; 41 | }; 42 | }; 43 | }); 44 | 45 | default = { }; 46 | description = "List of NFS shares to mount on this machine"; 47 | example = { 48 | backups = { 49 | remoteHost = "nas.local"; 50 | remotePath = "/exports/backups"; 51 | localPath = "/mnt/backups"; 52 | options = "noatime"; 53 | }; 54 | }; 55 | }; 56 | }; 57 | 58 | config = lib.mkIf cfg.enable { 59 | # Ensure required directories exist 60 | systemd.tmpfiles.rules = map 61 | (m: "d ${m.localPath} 0755 root root - -") 62 | (lib.attrValues cfg.mounts); 63 | 64 | # Mount NFS shares via fileSystems 65 | fileSystems = lib.mapAttrs' (name: m: { 66 | name = m.localPath; 67 | value = { 68 | device = "${m.remoteHost}:${m.remotePath}"; 69 | fsType = m.fsType; 70 | options = [ m.options ]; 71 | }; 72 | }) cfg.mounts; 73 | 74 | # Optionally allow NFS client ports through firewall if needed 75 | networking.firewall.allowedTCPPorts = lib.mkDefault [ 2049 ]; 76 | networking.firewall.allowedUDPPorts = lib.mkDefault [ 2049 ]; 77 | }; 78 | } 79 | -------------------------------------------------------------------------------- /src/users.nix: -------------------------------------------------------------------------------- 1 | { config, lib, pkgs, ... }: 2 | 3 | let 4 | homelab = config.homelab; 5 | in 6 | { 7 | # Define a user account. Don't forget to set a password with ‘passwd’. 8 | users.users."${homelab.mainUser.name}" = { 9 | isNormalUser = true; 10 | shell = pkgs.zsh; 11 | extraGroups = [ 12 | "docker" # Run docker without ‘sudo’ 13 | "wheel" # Enable ‘sudo’ for the user. 14 | ]; 15 | packages = config.homelab.mainUser.pkgs; 16 | }; 17 | 18 | home-manager.users = { 19 | "${homelab.mainUser.name}" = { ... }: 20 | { 21 | home = { 22 | username = homelab.mainUser.name; 23 | homeDirectory = "/home/${homelab.mainUser.name}"; 24 | }; 25 | 26 | programs.git = { 27 | userName = config.homelab.git.userName; 28 | userEmail = config.homelab.git.email; 29 | extraConfig = { 30 | credential.helper = "cache --timeout=36000"; 31 | core = { 32 | editor = "vi"; 33 | autocrlf = "input"; 34 | }; 35 | color.ui = "always"; 36 | init.defaultBranch = config.homelab.git.defaultBranch; 37 | alias = { 38 | c = "commit"; 39 | ca = "commit -a"; 40 | cm = "commit -m"; 41 | cam = "commit -am"; 42 | d = "diff"; 43 | dc = "diff --cached"; 44 | graph = "log --graph --all --oneline"; 45 | l = ''log --graph --pretty=format:"%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset" --abbrev-commit''; 46 | acommit = "commit --amend --no-edit --all"; 47 | fpush = "push --force-with-lease"; 48 | }; 49 | push.autoSetupRemote = true; 50 | pull.rebase = true; 51 | 52 | }; 53 | includes = lib.optionals homelab.git.createWorkspaces ( 54 | map (ws: { 55 | condition = "gitdir:~/${ws.folderName}/"; 56 | path = "~/${ws.folderName}/.gitconfig"; 57 | }) homelab.git.workspaces 58 | ); 59 | }; 60 | 61 | home.file = lib.mkIf homelab.git.createWorkspaces ( 62 | lib.listToAttrs (map (ws: 63 | { 64 | name = "${ws.folderName}/.gitconfig"; 65 | value = { 66 | text = '' 67 | [user] 68 | email = ${ws.email} 69 | name = ${ws.userName} 70 | ''; 71 | }; 72 | }) homelab.git.workspaces) 73 | ); 74 | }; 75 | }; 76 | } 77 | -------------------------------------------------------------------------------- /.github/stale.yml: -------------------------------------------------------------------------------- 1 | --- 2 | # Configuration for probot-stale - https://github.com/probot/stale 3 | 4 | # Number of days of inactivity before an Issue or Pull Request becomes stale 5 | daysUntilStale: 90 6 | 7 | # Number of days of inactivity before an Issue or Pull Request with the stale label is closed. 8 | # Set to false to disable. If disabled, issues still need to be closed manually, but will remain marked as stale. 9 | daysUntilClose: 30 10 | 11 | # Only issues or pull requests with all of these labels are check if stale. Defaults to `[]` (disabled) 12 | onlyLabels: [] 13 | 14 | # Issues or Pull Requests with these labels will never be considered stale. Set to `[]` to disable 15 | exemptLabels: 16 | - pinned 17 | - security 18 | - planned 19 | 20 | # Set to true to ignore issues in a project (defaults to false) 21 | exemptProjects: false 22 | 23 | # Set to true to ignore issues in a milestone (defaults to false) 24 | exemptMilestones: false 25 | 26 | # Set to true to ignore issues with an assignee (defaults to false) 27 | exemptAssignees: false 28 | 29 | # Label to use when marking as stale 30 | staleLabel: stale 31 | 32 | # Limit the number of actions per hour, from 1-30. Default is 30 33 | limitPerRun: 30 34 | 35 | pulls: 36 | markComment: |- 37 | This pull request has been marked 'stale' due to lack of recent activity. If there is no further activity, the PR will be closed in another 30 days. Thank you for your contribution! 38 | 39 | Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark pull requests as stale. 40 | 41 | unmarkComment: >- 42 | This pull request is no longer marked for closure. 43 | 44 | closeComment: >- 45 | This pull request has been closed due to inactivity. If you feel this is in error, please reopen the pull request or file a new PR with the relevant details. 46 | 47 | issues: 48 | markComment: |- 49 | This issue has been marked 'stale' due to lack of recent activity. If there is no further activity, the issue will be closed in another 30 days. Thank you for your contribution! 50 | 51 | Please read [this blog post](https://www.jeffgeerling.com/blog/2020/enabling-stale-issue-bot-on-my-github-repositories) to see the reasons why I mark issues as stale. 52 | 53 | unmarkComment: >- 54 | This issue is no longer marked for closure. 55 | 56 | closeComment: >- 57 | This issue has been closed due to inactivity. If you feel this is in error, please reopen the issue or file a new issue with the relevant details. 58 | -------------------------------------------------------------------------------- /.github/workflows/tests.yml: -------------------------------------------------------------------------------- 1 | --- 2 | name: Tests 3 | 4 | "on": 5 | pull_request: 6 | push: 7 | branches: 8 | - main 9 | 10 | jobs: 11 | lint: 12 | name: Lint 13 | runs-on: ubuntu-latest 14 | steps: 15 | - name: Check out the repository 16 | uses: actions/checkout@v4 17 | with: 18 | fetch-depth: 2 19 | 20 | - name: Set up Python 3. 21 | uses: actions/setup-python@v5 22 | with: 23 | python-version: "3.13" 24 | 25 | - name: Install UV 26 | uses: astral-sh/setup-uv@v6 27 | with: 28 | version: ">=0.5.24" 29 | 30 | - name: Create venv 31 | run: | 32 | uv venv 33 | 34 | - name: Install yamllint 35 | run: | 36 | uv pip install --constraint=.github/workflows/constraints.txt yamllint 37 | 38 | - name: Lint code. 39 | run: | 40 | uv run yamllint . 41 | 42 | tests: 43 | name: Flake Test 44 | runs-on: ubuntu-latest 45 | steps: 46 | - name: Check out the repository 47 | uses: actions/checkout@v4 48 | 49 | - uses: cachix/install-nix-action@v31 50 | with: 51 | github_access_token: ${{ secrets.GITHUB_TOKEN }} 52 | 53 | - name: Dynamically update flake input URL 54 | run: | 55 | # Replace with your repository details 56 | DEFAULT_URL="github:staticdev/linux-workstation-playbook" 57 | FLAKE_FOLDER="eg" 58 | 59 | FLAKE_FILE="${FLAKE_FOLDER}/flake.nix" 60 | 61 | # Default to the current repo and branch (for pushes) 62 | REPO_SLUG="${{ github.repository }}" 63 | BRANCH_NAME="${{ github.ref_name }}" 64 | 65 | # If the trigger is a pull request, use its specific context 66 | if [[ "${{ github.event_name }}" == "pull_request" ]]; then 67 | echo "Pull request event detected. Using PR head context." 68 | REPO_SLUG="${{ github.event.pull_request.head.repo.full_name }}" 69 | BRANCH_NAME="${{ github.event.pull_request.head.ref }}" 70 | fi 71 | 72 | # The final URL points to the correct repository and branch 73 | FINAL_URL="github:${REPO_SLUG}/${BRANCH_NAME}" 74 | 75 | echo "Source Repository: ${REPO_SLUG}" 76 | echo "Source Branch: ${BRANCH_NAME}" 77 | echo "Final Flake URL: ${FINAL_URL}" 78 | 79 | # Replace the default URL with the dynamically constructed one 80 | sed -i "s|${DEFAULT_URL}|${FINAL_URL}|" "$FLAKE_FILE" 81 | 82 | echo "--- Verifying ${FLAKE_FILE} modification --" 83 | cat "$FLAKE_FILE" 84 | echo "-------------------------------------------" 85 | 86 | - name: Check Eg. Flake 87 | run: | 88 | cd eg 89 | nix flake check 90 | -------------------------------------------------------------------------------- /modules/services/deluge/default.nix: -------------------------------------------------------------------------------- 1 | { 2 | config, 3 | lib, 4 | pkgs, 5 | ... 6 | }: 7 | let 8 | homelab = config.homelab; 9 | cfg = homelab.services.deluge; 10 | ns = homelab.services.wireguard-netns.namespace; 11 | in 12 | { 13 | options.homelab.services.deluge = { 14 | enable = lib.mkEnableOption "Deluge torrent client (bound to a Wireguard VPN network)"; 15 | configDir = lib.mkOption { 16 | type = lib.types.str; 17 | default = "/var/lib/deluge"; 18 | }; 19 | url = lib.mkOption { 20 | type = lib.types.str; 21 | default = "deluge.${homelab.baseDomain}"; 22 | }; 23 | homepage.name = lib.mkOption { 24 | type = lib.types.str; 25 | default = "Deluge"; 26 | }; 27 | homepage.description = lib.mkOption { 28 | type = lib.types.str; 29 | default = "Torrent client"; 30 | }; 31 | homepage.icon = lib.mkOption { 32 | type = lib.types.str; 33 | default = "deluge.svg"; 34 | }; 35 | homepage.category = lib.mkOption { 36 | type = lib.types.str; 37 | default = "Downloads"; 38 | }; 39 | }; 40 | config = lib.mkIf cfg.enable { 41 | services.deluge = { 42 | enable = true; 43 | user = homelab.mainUser.name; 44 | group = homelab.mainUser.group; 45 | web = { 46 | enable = true; 47 | }; 48 | }; 49 | 50 | services.caddy.virtualHosts."${cfg.url}" = { 51 | useACMEHost = homelab.baseDomain; 52 | extraConfig = '' 53 | reverse_proxy http://127.0.0.1:8112 54 | ''; 55 | }; 56 | 57 | systemd = lib.mkIf homelab.services.wireguard-netns.enable { 58 | services.deluged.bindsTo = [ "netns@${ns}.service" ]; 59 | services.deluged.requires = [ 60 | "network-online.target" 61 | "${ns}.service" 62 | ]; 63 | services.deluged.serviceConfig.NetworkNamespacePath = [ "/var/run/netns/${ns}" ]; 64 | sockets."deluged-proxy" = { 65 | enable = true; 66 | description = "Socket for Proxy to Deluge WebUI"; 67 | listenStreams = [ "58846" ]; 68 | wantedBy = [ "sockets.target" ]; 69 | }; 70 | services."deluged-proxy" = { 71 | enable = true; 72 | description = "Proxy to Deluge Daemon in Network Namespace"; 73 | requires = [ 74 | "deluged.service" 75 | "deluged-proxy.socket" 76 | ]; 77 | after = [ 78 | "deluged.service" 79 | "deluged-proxy.socket" 80 | ]; 81 | unitConfig = { 82 | JoinsNamespaceOf = "deluged.service"; 83 | }; 84 | serviceConfig = { 85 | User = config.services.deluge.user; 86 | Group = config.services.deluge.group; 87 | ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd --exit-idle-time=5min 127.0.0.1:58846"; 88 | PrivateNetwork = "yes"; 89 | }; 90 | }; 91 | }; 92 | }; 93 | } 94 | -------------------------------------------------------------------------------- /src/base.nix: -------------------------------------------------------------------------------- 1 | # Edit this configuration file to define what should be installed on 2 | # your system. Help is available in the configuration.nix(5) man page, on 3 | # https://search.nixos.org/options and in the NixOS manual (`nixos-help`). 4 | 5 | { config, lib, pkgs, ... }: 6 | 7 | let 8 | homelab = config.homelab; 9 | in 10 | { 11 | imports = [ 12 | (import ./users.nix {inherit config lib pkgs;}) 13 | ]; 14 | 15 | # Use the GRUB 2 boot loader. 16 | boot.loader.grub.enable = true; 17 | boot.loader.grub.efiSupport = true; 18 | boot.loader.grub.efiInstallAsRemovable = true; 19 | boot.loader.grub.useOSProber = true; 20 | # boot.loader.efi.efiSysMountPoint = "/boot/efi"; 21 | # Define on which hard drive you want to install Grub. 22 | boot.loader.grub.device = "nodev"; # or "nodev" for efi only 23 | 24 | networking.hostName = "nixos"; # Define your hostname. 25 | # Pick only one of the below networking options. 26 | # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. 27 | # networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. 28 | 29 | # Set your time zone. 30 | time.timeZone = config.homelab.timeZone; 31 | 32 | # Configure network proxy if necessary 33 | # networking.proxy.default = "http://user:password@proxy:port/"; 34 | # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; 35 | 36 | # Select internationalisation properties. 37 | # i18n.defaultLocale = "en_US.UTF-8"; 38 | # console = { 39 | # font = "Lat2-Terminus16"; 40 | # keyMap = "us"; 41 | # useXkbConfig = true; # use xkb.options in tty. 42 | # }; 43 | 44 | # Enable CUPS to print documents. 45 | # services.printing.enable = true; 46 | 47 | # List packages installed in system profile. To search, run: 48 | # $ nix search wget 49 | environment.systemPackages = homelab.systemWidePkgs; 50 | 51 | # Some programs need SUID wrappers, can be configured further or are 52 | # started in user sessions. 53 | # programs.mtr.enable = true; 54 | # programs.gnupg.agent = { 55 | # enable = true; 56 | # enableSSHSupport = true; 57 | # }; 58 | 59 | # List services that you want to enable: 60 | 61 | # Enable the OpenSSH daemon. 62 | services.openssh.enable = true; 63 | 64 | nix = { 65 | optimise = { 66 | automatic = true; 67 | dates = [ 68 | "00:00" 69 | "12:00" 70 | "18:00" 71 | ]; 72 | }; 73 | settings = { 74 | flake-registry = ""; 75 | auto-optimise-store = true; 76 | tarball-ttl = 0; 77 | experimental-features = [ 78 | "nix-command" 79 | "flakes" 80 | ]; 81 | }; 82 | }; 83 | 84 | # Open ports in the firewall. 85 | networking.firewall = { 86 | enable = true; 87 | allowedTCPPorts = [ 8096 ]; # Jellyfin 88 | checkReversePath = "loose"; # Fix VPN issue 89 | }; 90 | 91 | # Copy the NixOS configuration file and link it from the resulting system 92 | # (/run/current-system/configuration.nix). This is useful in case you 93 | # accidentally delete configuration.nix. 94 | # system.copySystemConfiguration = true; 95 | } 96 | -------------------------------------------------------------------------------- /modules/services/wireguard-netns/default.nix: -------------------------------------------------------------------------------- 1 | { 2 | pkgs, 3 | config, 4 | lib, 5 | ... 6 | }: 7 | let 8 | hl = config.homelab; 9 | cfg = hl.services.wireguard-netns; 10 | in 11 | { 12 | options.homelab.services.wireguard-netns = { 13 | enable = lib.mkEnableOption { 14 | description = "Enable Wireguard client network namespace"; 15 | }; 16 | namespace = lib.mkOption { 17 | type = lib.types.str; 18 | description = "Network namespace to be created"; 19 | default = "wg_client"; 20 | }; 21 | configFile = lib.mkOption { 22 | type = lib.types.path; 23 | description = "Path to a file with Wireguard config (not a wg-quick one!)"; 24 | example = lib.literalExpression '' 25 | pkgs.writeText "wg0.conf" ''' 26 | [Interface] 27 | Address = 192.168.2.2 28 | PrivateKey = 29 | ListenPort = 21841 30 | 31 | [Peer] 32 | PublicKey = 33 | Endpoint = :51820 34 | ''' 35 | ''; 36 | }; 37 | privateIP = lib.mkOption { 38 | type = lib.types.str; 39 | }; 40 | dnsIP = lib.mkOption { 41 | type = lib.types.str; 42 | }; 43 | }; 44 | config = lib.mkIf cfg.enable { 45 | systemd.services."netns@" = { 46 | description = "%I network namespace"; 47 | before = [ "network.target" ]; 48 | serviceConfig = { 49 | Type = "oneshot"; 50 | RemainAfterExit = true; 51 | ExecStart = "${pkgs.iproute2}/bin/ip netns add %I"; 52 | ExecStop = "${pkgs.iproute2}/bin/ip netns del %I"; 53 | }; 54 | }; 55 | environment.etc."netns/${cfg.namespace}/resolv.conf".text = "nameserver ${cfg.dnsIP}"; 56 | 57 | systemd.services.${cfg.namespace} = { 58 | description = "${cfg.namespace} network interface"; 59 | bindsTo = [ "netns@${cfg.namespace}.service" ]; 60 | requires = [ "network-online.target" ]; 61 | after = [ "netns@${cfg.namespace}.service" ]; 62 | wantedBy = [ "multi-user.target" ]; 63 | serviceConfig = { 64 | Type = "oneshot"; 65 | RemainAfterExit = true; 66 | ExecStart = 67 | with pkgs; 68 | writers.writeBash "wg-up" '' 69 | set -e 70 | ${iproute2}/bin/ip link add wg0 type wireguard 71 | ${iproute2}/bin/ip link set wg0 netns ${cfg.namespace} 72 | ${iproute2}/bin/ip -n ${cfg.namespace} address add ${cfg.privateIP} dev wg0 73 | ${iproute2}/bin/ip netns exec ${cfg.namespace} \ 74 | ${pkgs.wireguard-tools}/bin/wg setconf wg0 ${cfg.configFile} 75 | ${iproute2}/bin/ip -n ${cfg.namespace} link set wg0 up 76 | ${iproute2}/bin/ip -n ${cfg.namespace} link set lo up 77 | ${iproute2}/bin/ip -n ${cfg.namespace} route add default dev wg0 78 | ''; 79 | ExecStop = 80 | with pkgs; 81 | writers.writeBash "wg-down" '' 82 | set -e 83 | ${iproute2}/bin/ip -n ${cfg.namespace} route del default dev wg0 84 | ${iproute2}/bin/ip -n ${cfg.namespace} link del wg0 85 | ''; 86 | }; 87 | }; 88 | }; 89 | } 90 | -------------------------------------------------------------------------------- /CONTRIBUTING.md: -------------------------------------------------------------------------------- 1 | # Contributor Guide 2 | 3 | Thank you for your interest in improving this project. 4 | This project is open-source under the [MIT license] and 5 | welcomes contributions in the form of bug reports, feature requests, and pull requests. 6 | 7 | Here is a list of important resources for contributors: 8 | 9 | - [Source Code] 10 | - [Issue Tracker] 11 | - [Code of Conduct] 12 | 13 | [mit license]: https://opensource.org/licenses/MIT 14 | [source code]: https://github.com/staticdev/linux-workstation-playbook 15 | [issue tracker]: https://github.com/staticdev/linux-workstation-playbook/issues 16 | 17 | ## How to report a bug 18 | 19 | Report bugs on the [Issue Tracker]. 20 | 21 | When filing an issue, make sure to answer these questions: 22 | 23 | - Which operating system and Python version are you using? 24 | - Which version of this project are you using? 25 | - What did you do? 26 | - What did you expect to see? 27 | - What did you see instead? 28 | 29 | The best way to get your bug fixed is to provide a test case, 30 | and/or steps to reproduce the issue. 31 | 32 | ## How to request a feature 33 | 34 | Request features on the [Issue Tracker]. 35 | 36 | ## How to set up your development environment 37 | 38 | You need Python 3.13+ and the following tools: 39 | 40 | - [Molecule] 41 | - [Podman] 42 | - [Pre-commit] 43 | - [Vagrant] (optional) 44 | 45 | The good thing is to install them you just need [Ansible] and this playbook. 46 | 47 | [Pre-commit] is installed with `python_developer` tools, [Podman] and [Vagrant] with [Nix] packages by default. For [Molecule] read their docs. 48 | 49 | [molecule]: https://ansible.readthedocs.io/projects/molecule/en/latest/ 50 | [podman]: https://podman.io/ 51 | [pre-commit]: https://pre-commit.com/ 52 | [vagrant]: https://www.vagrantup.com/ 53 | 54 | ## How to test the project 55 | 56 | 57 | Run the tests locally: 58 | 59 | ```sh 60 | molecule test 61 | ``` 62 | 63 | Tests are located in the `Molecule` directory and are executed in `Podman` containers. 64 | 65 | ### Using Vagrant 66 | 67 | To provision this playbook in a VM use our `Vagrantfile` using VirtualBox or modify the file to use Libvirt. 68 | 69 | The VM is created and provisioned with: 70 | 71 | ```sh 72 | vagrant up 73 | ``` 74 | 75 | The default password for `root` in the VM is `vagrant`. 76 | 77 | ## How to upgrade the flake 78 | 79 | ```sh 80 | sudo nix flake update --flake . 81 | ``` 82 | 83 | ## How to submit changes 84 | 85 | Open a [pull request] to submit changes to this project. 86 | 87 | Your pull request needs to meet the following guidelines for acceptance: 88 | 89 | - Pre-commit hooks need to pass. 90 | - Include tests when relevant. This project maintains a high code coverage. 91 | - If your changes add functionality, update the documentation accordingly. 92 | 93 | Feel free to submit early, though—we can always iterate on this. 94 | 95 | To run linting and code formatting checks before commiting your change, you can install pre-commit as a Git hook by running the following command: 96 | 97 | ```sh 98 | pre-commit install 99 | pre-commit run --all-files 100 | ``` 101 | 102 | It is recommended to open an issue before starting work on anything. 103 | This will allow a chance to talk it over with the owners and validate your approach. 104 | 105 | [pull request]: https://github.com/staticdev/linux-workstation-playbook/pulls 106 | [pytest]: https://pytest.readthedocs.io/ 107 | 108 | 109 | 110 | [code of conduct]: CODE_OF_CONDUCT.md 111 | -------------------------------------------------------------------------------- /CODE_OF_CONDUCT.md: -------------------------------------------------------------------------------- 1 | # Contributor Covenant Code of Conduct 2 | 3 | ## Our Pledge 4 | 5 | We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation. 6 | 7 | We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. 8 | 9 | ## Our Standards 10 | 11 | Examples of behavior that contributes to a positive environment for our community include: 12 | 13 | - Demonstrating empathy and kindness toward other people 14 | - Being respectful of differing opinions, viewpoints, and experiences 15 | - Giving and gracefully accepting constructive feedback 16 | - Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience 17 | - Focusing on what is best not just for us as individuals, but for the overall community 18 | 19 | Examples of unacceptable behavior include: 20 | 21 | - The use of sexualized language or imagery, and sexual attention or 22 | advances of any kind 23 | - Trolling, insulting or derogatory comments, and personal or political attacks 24 | - Public or private harassment 25 | - Publishing others' private information, such as a physical or email 26 | address, without their explicit permission 27 | - Other conduct which could reasonably be considered inappropriate in a 28 | professional setting 29 | 30 | ## Enforcement Responsibilities 31 | 32 | Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful. 33 | 34 | Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate. 35 | 36 | ## Scope 37 | 38 | This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. 39 | 40 | ## Enforcement 41 | 42 | Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at . All complaints will be reviewed and investigated promptly and fairly. 43 | 44 | All community leaders are obligated to respect the privacy and security of the reporter of any incident. 45 | 46 | ## Enforcement Guidelines 47 | 48 | Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct: 49 | 50 | ### 1. Correction 51 | 52 | **Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community. 53 | 54 | **Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested. 55 | 56 | ### 2. Warning 57 | 58 | **Community Impact**: A violation through a single incident or series of actions. 59 | 60 | **Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban. 61 | 62 | ### 3. Temporary Ban 63 | 64 | **Community Impact**: A serious violation of community standards, including sustained inappropriate behavior. 65 | 66 | **Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban. 67 | 68 | ### 4. Permanent Ban 69 | 70 | **Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals. 71 | 72 | **Consequence**: A permanent ban from any sort of public interaction within the community. 73 | 74 | ## Attribution 75 | 76 | This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.0, 77 | available at . 78 | 79 | Community Impact Guidelines were inspired by [Mozilla’s code of conduct enforcement ladder](https://github.com/mozilla/diversity). 80 | 81 | For answers to common questions about this code of conduct, see the FAQ at 82 | . Translations are available at . 83 | 84 | [homepage]: https://www.contributor-covenant.org 85 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Linux Workstation Playbook 2 | 3 | [![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)][pre-commit] 4 | [![Tests](https://github.com/staticdev/linux-workstation-playbook/workflows/Tests/badge.svg)][tests] 5 | 6 | [pre-commit]: https://github.com/pre-commit/pre-commit 7 | [tests]: https://github.com/staticdev/linux-workstation-playbook/actions?workflow=Tests 8 | 9 | ## Features 10 | 11 | - Support processor architectures: x86_64 (only one for now, may be extended in the future). 12 | - IDEs: [VSCodium] installation (via Nixpkgs), [Neovim] (via [NixVim]). 13 | - Browsers: [Brave] and [Mullvad Browser] (via Nix). 14 | - Containers and virtualization: [Docker], [Podman] and [libvirtd]. 15 | - Your favorite programs via [Nixpkgs]. 16 | - Configurations: dotfiles, [tmux] and zsh (via Nix), Guake terminal, [Gnome] (and extensions), [Git], ssh, keyboard... 17 | 18 | Note: this is an opinionated setup I personally use for software development on [NixOS](https://nixos.org). You can customize all the changes following instructions in [Overriding Defaults](#overriding-defaults). 19 | 20 | ## Requirements 21 | 22 | 1. Install latest stable, recommended Minimal ISO image from [NixOS download ISO page](https://nixos.org/download/#nixos-iso). 23 | 1. [Ansible] installed. Make sure you have it in you `local.nix` either in `systemWidePkgs` or `mainUser.pkgs`. 24 | 25 | ## Installation 26 | 27 | 1. Create a `local.nix` file from [eg folder](eg/local.nix) and change: 28 | - remove the first part that has some comments to "do not add". 29 | - git variables. 30 | - main Linux username. 31 | - timezone. 32 | - browser configurations. 33 | 1. Create at /etc/nixos a `flake.nix` file [eg folder](eg/flake.nix). 34 | 35 | ```sh 36 | curl -s "https://raw.githubusercontent.com/staticdev/linux-workstation-playbook/main/eg/flake.nix?token=$(date +%s)" -o /etc/nixos/flake.nix 37 | nixos-generate-config 38 | nixos-rebuild boot --upgrade-all 39 | ``` 40 | 41 | 1. Rebuild hardware config with `sudo nixos-generate-config`. 42 | 1. Rebuild your system with `sudo nixos-rebuild boot --upgrade-all`. 43 | 44 | ## Usage 45 | 46 | 1. Make a copy of **default.config.yml** with the name **config.yml** and change the configurations you want to use. 47 | 1. Run the command: 48 | 49 | ```sh 50 | ansible-playbook main.yml -i inventory --ask-become-pass 51 | ``` 52 | 53 | ### Included Applications / Configuration (Default) 54 | 55 | It installs packages with [Nix] package manager: 56 | 57 | ```yaml 58 | - git 59 | - thefuck 60 | - tmux 61 | - wget 62 | - wl-clipboard 63 | ``` 64 | 65 | Finally, there are a few other preferences and settings added on for various apps and services. 66 | 67 | Dotfiles for [tmux] and [zsh] are already configured in specific modules. 68 | 69 | ### Overriding Defaults 70 | 71 | Not everyone's workstation and preferred software configuration is the same. 72 | 73 | You can override any of the defaults configured in **default.config.yml** by creating a **config.yml** file and setting the overrides in that file. 74 | 75 | For [Nix] packages, update your [Home Manager] config on your dotfiles repo. 76 | 77 | Any variable can be overridden in **config.yml**; see the supporting roles' documentation for a complete list of available variables. 78 | 79 | ### Use with a remote machine 80 | 81 | You can use this playbook to manage other machine as well; the playbook doesn't even need to be run from a Linux computer at all! If you want to manage a remote Linux, either another Linux on your network, or a hosted Linux in the cloud, you just need to make sure you can connect to it with SSH. 82 | 83 | Edit the **inventory** file in this repository and change the line that starts with **127.0.0.1** to: 84 | 85 | ```ini 86 | [ip address or hostname of linux] ansible_user=[linux ssh username] 87 | ``` 88 | 89 | If you need to supply an SSH password (if you don't use SSH keys), make sure to pass the **--ask-pass** parameter to the **ansible-playbook** command. 90 | 91 | ## Contributing 92 | 93 | Contributions are very welcome. 94 | To learn more, see the [Contributor Guide]. 95 | 96 | ## License 97 | 98 | Distributed under the terms of the [MIT] license, 99 | _Linux Workstation Playbook_ is free and open source software. 100 | 101 | ## Issues 102 | 103 | If you encounter any problems, 104 | please [file an issue] along with a detailed description. 105 | 106 | ## Credits 107 | 108 | This project was inspired by [@geerlingguy]'s [Mac Development Ansible Playbook]. 109 | 110 | [@geerlingguy]: https://github.com/geerlingguy 111 | [brave]: https://brave.com/ 112 | [contributor guide]: https://github.com/staticdev/linux-workstation-playbook/blob/main/CONTRIBUTING.md 113 | [debian]: https://www.debian.org/ 114 | [docker]: https://www.docker.com/ 115 | [download]: https://github.com/staticdev/linux-workstation-playbook/archive/refs/heads/main.zip 116 | [file an issue]: https://github.com/staticdev/linux-workstation-playbook/issues 117 | [git]: https://git-scm.com/ 118 | [nixpkgs]: https://search.nixos.org/packages 119 | [gnome]: https://www.gnome.org/ 120 | [home manager]: https://github.com/nix-community/home-manager 121 | [libvirtd]: https://libvirt.org/manpages/libvirtd.html 122 | [mac development ansible playbook]: https://github.com/geerlingguy/mac-dev-playbook 123 | [mit]: https://opensource.org/licenses/MIT 124 | [mullvad browser]: https://mullvad.net/en/browser 125 | [neovim]: https://github.com/neovim/neovim 126 | [nix]: https://nixos.org/ 127 | [nixos download iso page]: https://nixos.org/download/#nixos-iso 128 | [nixvim]: https://github.com/nix-community/nixvim 129 | [pep-668]: https://peps.python.org/pep-0668/ 130 | [podman]: https://podman.io/ 131 | [tmux]: https://github.com/tmux/tmux 132 | [vscodium]: https://vscodium.com/ 133 | [zsh]: https://www.zsh.org/ 134 | -------------------------------------------------------------------------------- /eg/local.nix: -------------------------------------------------------------------------------- 1 | { lib, pkgs, options, ... }: 2 | 3 | { 4 | # DO NOT ADD THIS PART - ONLY FOR TESTING 5 | fileSystems."/" = lib.mkForce { 6 | device = "none"; 7 | }; 8 | # END - DO NOT ADD THIS PART - ONLY FOR TESTING 9 | 10 | homelab = { 11 | dconf = { 12 | favoriteApps = [ "brave-browser.desktop" "org.gnome.Nautilus.desktop" "org.gnome.Terminal.desktop" ]; 13 | # gnome extesions require wayland restart 14 | gnomeExtensions = with pkgs.gnomeExtensions; [ 15 | appindicator 16 | tiling-assistant 17 | vitals 18 | ]; 19 | guakeHotkey = "F12"; 20 | hotCorners = false; 21 | keyboardLayout = [ 22 | { layout = "us"; variant = "intl"; } 23 | { layout = "de"; variant = null; } 24 | ]; 25 | lockScreenNotifications = false; 26 | nightLight = false; 27 | }; 28 | git = { 29 | userName = "Rick Sanchez"; 30 | email = "Rick.Sanchez@Wabalaba.dubdub"; 31 | defaultBranch = "main"; 32 | createWorkspaces = true; 33 | workspaces = [ 34 | { 35 | folderName = "workspace_personal"; 36 | email = "personal@example.com"; 37 | userName = "Rick Personal"; 38 | } 39 | { 40 | folderName = "workspace_work"; 41 | email = "rick@rick.com"; 42 | userName = "Rick Professional"; 43 | } 44 | ]; 45 | }; 46 | mainUser = { 47 | name = "username"; 48 | group = "groupname"; 49 | pkgs = with pkgs; [ 50 | brave 51 | pkgs-unstable.devenv 52 | git 53 | htop 54 | obs-studio 55 | onlyoffice-desktopeditors 56 | thefuck 57 | tmux 58 | vscodium 59 | wl-clipboard 60 | ]; 61 | }; 62 | nfs = { 63 | enable = true; 64 | mounts = { 65 | media = { 66 | remoteHost = "nas.internal"; 67 | remotePath = "/srv/media"; 68 | localPath = "/mnt/media"; 69 | options = "rsize=8192,wsize=8192,hard,intr"; 70 | fsType = "nfs"; 71 | }; 72 | }; 73 | }; 74 | services = { 75 | enable = true; 76 | jellyfin.enable = true; 77 | }; 78 | systemWidePkgs = with pkgs; [ 79 | ansible 80 | openssl 81 | wget 82 | ]; 83 | timeZone = "Europe/Amsterdam"; 84 | }; 85 | 86 | programs.chromium = { 87 | enable = true; 88 | extensions = [ 89 | "cjpalhdlnbpafiamejdnhcphjbkeiagm" # ublock origin 90 | ]; 91 | }; 92 | # fix issues with running ruff being dynamically linked 93 | programs.nix-ld.enable = true; 94 | programs.nix-ld.libraries = options.programs.nix-ld.libraries.default; 95 | # Neovim configs 96 | programs.nixvim = { 97 | enable = true; 98 | viAlias = true; 99 | vimAlias = true; 100 | defaultEditor = true; 101 | colorschemes.vscode.enable = true; 102 | opts = { 103 | number = true; 104 | relativenumber = false; 105 | guicursor = ""; 106 | undofile = true; 107 | encoding = "utf-8"; 108 | signcolumn = "yes"; 109 | belloff = "all"; 110 | wrap = false; 111 | wildmenu = true; 112 | modeline = true; 113 | modelines = 1; 114 | tabstop = 2; 115 | softtabstop = 2; 116 | shiftwidth = 2; 117 | expandtab = true; 118 | smarttab = true; 119 | autoindent = true; 120 | }; 121 | clipboard = { 122 | register = "unnamedplus"; 123 | providers.wl-copy.enable = true; 124 | }; 125 | plugins = { 126 | web-devicons.enable = true; 127 | lualine.enable = true; 128 | barbar.enable = true; 129 | lazygit.enable = true; 130 | gitblame.enable = true; 131 | gitsigns.enable = true; 132 | indent-blankline.enable = true; 133 | lastplace.enable = true; 134 | treesitter.enable = true; 135 | neo-tree.enable = true; 136 | nvim-autopairs.enable = true; 137 | helm.enable = true; 138 | cmp.enable = true; 139 | lsp = { 140 | enable = true; 141 | servers = { 142 | nixd.enable = true; 143 | clangd.enable = true; 144 | }; 145 | }; 146 | }; 147 | }; 148 | # Enable zsh in case you want to use it 149 | programs.zsh = { 150 | enable = true; 151 | enableCompletion = true; 152 | autosuggestions.enable = true; 153 | syntaxHighlighting.enable = true; 154 | shellAliases = { 155 | clip = "wl-copy"; 156 | cplocal = "viewlocal|clip"; 157 | df = "df -h"; 158 | editflake = "sudo nvim /etc/nixos/flake.nix"; 159 | editlocal = "sudo nvim /etc/nixos/local.nix"; 160 | viewflake = "cat /etc/nixos/flake.nix"; 161 | viewlocal = "cat /etc/nixos/local.nix"; 162 | mkdir = "mkdir -p"; 163 | ngc = "nix store gc"; 164 | # git aliases inspired on https://kapeli.com/cheat_sheets/Oh-My-Zsh_Git.docset/Contents/Resources/Documents/index 165 | ga = "git add"; 166 | gac = "git commit --amend --no-edit --all"; 167 | gc = "git commit -m"; 168 | gcf = "git config --list"; 169 | gco = "git checkout"; 170 | gf = "git fetch"; 171 | gfa = "git fetch --all --prune"; 172 | gfo = "git fetch origin"; 173 | gfp = "git push --force-with-lease"; 174 | gl = ''git log --graph --pretty=format:"%Cred%h%Creset -%C(yellow)%d%Creset %s %Cgreen(%cr) %C(bold blue)<%an>%Creset" --abbrev-commit''; 175 | gp = "git pull"; 176 | gr = "git reset"; 177 | grb = "git rebase"; 178 | grba = "git rebase --abort"; 179 | grbc = "git rebase --continue"; 180 | gs = "git status"; 181 | gsta = "git stash"; 182 | gstaa = "git stash apply"; 183 | gstl = "git stash list"; 184 | la = "ls --color -lha"; 185 | ls = "ls --color=auto"; 186 | nixup = "sudo nix flake update --flake /etc/nixos && sudo nixos-rebuild switch"; 187 | }; 188 | shellInit = '' 189 | if [ ! -f ~/.zshrc ]; then 190 | echo 'eval "$(direnv hook zsh)"' > ~/.zshrc 191 | fi 192 | ''; 193 | }; 194 | 195 | virtualisation = { 196 | libvirtd = { 197 | enable = true; 198 | }; 199 | podman = { 200 | enable = true; 201 | dockerCompat = false; 202 | defaultNetwork.settings.dns_enabled = true; 203 | }; 204 | docker.enable = true; 205 | }; 206 | } 207 | -------------------------------------------------------------------------------- /flake.lock: -------------------------------------------------------------------------------- 1 | { 2 | "nodes": { 3 | "flake-parts": { 4 | "inputs": { 5 | "nixpkgs-lib": [ 6 | "nixvim", 7 | "nixpkgs" 8 | ] 9 | }, 10 | "locked": { 11 | "lastModified": 1748821116, 12 | "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=", 13 | "owner": "hercules-ci", 14 | "repo": "flake-parts", 15 | "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1", 16 | "type": "github" 17 | }, 18 | "original": { 19 | "owner": "hercules-ci", 20 | "repo": "flake-parts", 21 | "type": "github" 22 | } 23 | }, 24 | "flake-utils": { 25 | "inputs": { 26 | "systems": "systems" 27 | }, 28 | "locked": { 29 | "lastModified": 1731533236, 30 | "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", 31 | "owner": "numtide", 32 | "repo": "flake-utils", 33 | "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", 34 | "type": "github" 35 | }, 36 | "original": { 37 | "owner": "numtide", 38 | "repo": "flake-utils", 39 | "type": "github" 40 | } 41 | }, 42 | "home-manager": { 43 | "inputs": { 44 | "nixpkgs": [ 45 | "nixpkgs" 46 | ] 47 | }, 48 | "locked": { 49 | "lastModified": 1749154018, 50 | "narHash": "sha256-gjN3j7joRvT3a8Zgcylnd4NFsnXeDBumqiu4HmY1RIg=", 51 | "owner": "nix-community", 52 | "repo": "home-manager", 53 | "rev": "7aae0ee71a17b19708b93b3ed448a1a0952bf111", 54 | "type": "github" 55 | }, 56 | "original": { 57 | "owner": "nix-community", 58 | "ref": "release-25.05", 59 | "repo": "home-manager", 60 | "type": "github" 61 | } 62 | }, 63 | "ixx": { 64 | "inputs": { 65 | "flake-utils": [ 66 | "nixvim", 67 | "nuschtosSearch", 68 | "flake-utils" 69 | ], 70 | "nixpkgs": [ 71 | "nixvim", 72 | "nuschtosSearch", 73 | "nixpkgs" 74 | ] 75 | }, 76 | "locked": { 77 | "lastModified": 1748294338, 78 | "narHash": "sha256-FVO01jdmUNArzBS7NmaktLdGA5qA3lUMJ4B7a05Iynw=", 79 | "owner": "NuschtOS", 80 | "repo": "ixx", 81 | "rev": "cc5f390f7caf265461d4aab37e98d2292ebbdb85", 82 | "type": "github" 83 | }, 84 | "original": { 85 | "owner": "NuschtOS", 86 | "ref": "v0.0.8", 87 | "repo": "ixx", 88 | "type": "github" 89 | } 90 | }, 91 | "nixpkgs": { 92 | "locked": { 93 | "lastModified": 1749237914, 94 | "narHash": "sha256-N5waoqWt8aMr/MykZjSErOokYH6rOsMMXu3UOVH5kiw=", 95 | "owner": "NixOS", 96 | "repo": "nixpkgs", 97 | "rev": "70c74b02eac46f4e4aa071e45a6189ce0f6d9265", 98 | "type": "github" 99 | }, 100 | "original": { 101 | "owner": "NixOS", 102 | "ref": "nixos-25.05", 103 | "repo": "nixpkgs", 104 | "type": "github" 105 | } 106 | }, 107 | "nixpkgs-unstable": { 108 | "locked": { 109 | "lastModified": 1749285348, 110 | "narHash": "sha256-frdhQvPbmDYaScPFiCnfdh3B/Vh81Uuoo0w5TkWmmjU=", 111 | "owner": "NixOS", 112 | "repo": "nixpkgs", 113 | "rev": "3e3afe5174c561dee0df6f2c2b2236990146329f", 114 | "type": "github" 115 | }, 116 | "original": { 117 | "owner": "NixOS", 118 | "ref": "nixos-unstable", 119 | "repo": "nixpkgs", 120 | "type": "github" 121 | } 122 | }, 123 | "nixvim": { 124 | "inputs": { 125 | "flake-parts": "flake-parts", 126 | "nixpkgs": [ 127 | "nixpkgs" 128 | ], 129 | "nuschtosSearch": "nuschtosSearch", 130 | "systems": "systems_2" 131 | }, 132 | "locked": { 133 | "lastModified": 1749378622, 134 | "narHash": "sha256-x9YXIwWgxLmqpmKVdA0JojCbL4hNNwxKKFXFuM0Jo54=", 135 | "owner": "nix-community", 136 | "repo": "nixvim", 137 | "rev": "168a51a36f3a10f0046dcec125ee9b3480dc622b", 138 | "type": "github" 139 | }, 140 | "original": { 141 | "owner": "nix-community", 142 | "ref": "nixos-25.05", 143 | "repo": "nixvim", 144 | "type": "github" 145 | } 146 | }, 147 | "nuschtosSearch": { 148 | "inputs": { 149 | "flake-utils": "flake-utils", 150 | "ixx": "ixx", 151 | "nixpkgs": [ 152 | "nixvim", 153 | "nixpkgs" 154 | ] 155 | }, 156 | "locked": { 157 | "lastModified": 1748298102, 158 | "narHash": "sha256-PP11GVwUt7F4ZZi5A5+99isuq39C59CKc5u5yVisU/U=", 159 | "owner": "NuschtOS", 160 | "repo": "search", 161 | "rev": "f8a1c221afb8b4c642ed11ac5ee6746b0fe1d32f", 162 | "type": "github" 163 | }, 164 | "original": { 165 | "owner": "NuschtOS", 166 | "repo": "search", 167 | "type": "github" 168 | } 169 | }, 170 | "root": { 171 | "inputs": { 172 | "home-manager": "home-manager", 173 | "nixpkgs": "nixpkgs", 174 | "nixpkgs-unstable": "nixpkgs-unstable", 175 | "nixvim": "nixvim" 176 | } 177 | }, 178 | "systems": { 179 | "locked": { 180 | "lastModified": 1681028828, 181 | "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", 182 | "owner": "nix-systems", 183 | "repo": "default", 184 | "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", 185 | "type": "github" 186 | }, 187 | "original": { 188 | "owner": "nix-systems", 189 | "repo": "default", 190 | "type": "github" 191 | } 192 | }, 193 | "systems_2": { 194 | "locked": { 195 | "lastModified": 1681028828, 196 | "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", 197 | "owner": "nix-systems", 198 | "repo": "default", 199 | "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", 200 | "type": "github" 201 | }, 202 | "original": { 203 | "owner": "nix-systems", 204 | "repo": "default", 205 | "type": "github" 206 | } 207 | } 208 | }, 209 | "root": "root", 210 | "version": 7 211 | } 212 | -------------------------------------------------------------------------------- /modules/default.nix: -------------------------------------------------------------------------------- 1 | { lib, pkgs, ... }: 2 | 3 | let 4 | inherit (lib) mkOption types; 5 | in { 6 | options.homelab = { 7 | dconf = mkOption { 8 | type = with types; submodule { 9 | options = { 10 | favoriteApps = mkOption { 11 | type = with types; listOf str; 12 | default = [ ]; 13 | description = "List of favorite applications shown in GNOME Dash."; 14 | example = [ "brave-browser.desktop" "org.gnome.Nautilus.desktop" "org.gnome.Terminal.desktop" ]; 15 | }; 16 | gnomeExtensions = mkOption { 17 | type = listOf package; 18 | default = []; 19 | description = "List of Gnome extensions."; 20 | }; 21 | guakeHotkey = mkOption { 22 | type = types.nullOr str; 23 | default = null; 24 | example = "F12"; 25 | description = "Optional hotkey for toggling Guake."; 26 | }; 27 | hotCorners = mkOption { 28 | type = bool; 29 | default = false; 30 | description = "Whether to enable hot corners on Gnome."; 31 | }; 32 | keyboardLayout = mkOption { 33 | type = with types; listOf (submodule { 34 | options = { 35 | layout = mkOption { 36 | type = str; 37 | description = "Keyboard layout, e.g. 'us'"; 38 | example = "us"; 39 | }; 40 | 41 | variant = mkOption { 42 | type = nullOr str; 43 | default = null; 44 | description = "Optional keyboard variant, e.g. 'intl'"; 45 | example = "intl"; 46 | }; 47 | }; 48 | }); 49 | default = []; 50 | description = "List of keyboard layout and optional variant tuples."; 51 | example = [ 52 | { layout = "us"; variant = "intl"; } 53 | { layout = "de"; variant = null; } 54 | ]; 55 | }; 56 | lockScreenNotifications = mkOption { 57 | type = bool; 58 | default = false; 59 | description = "Whether to enable notifications in lock screen Gnome."; 60 | }; 61 | nightLight = mkOption { 62 | type = bool; 63 | default = false; 64 | description = "Whether to enable night light on Gnome."; 65 | }; 66 | }; 67 | }; 68 | default = {}; 69 | example = { 70 | favoriteApps = [ "brave-browser.desktop" "org.gnome.Nautilus.desktop" "org.gnome.Terminal.desktop" ]; 71 | gnomeExtensions = with pkgs.gnomeExtensions; [ 72 | appindicator 73 | tiling-assistant 74 | vitals 75 | ]; 76 | guakeHotkey = "F12"; 77 | hotCorners = false; 78 | keyboardLayout = [ 79 | { layout = "us"; variant = "intl"; } 80 | { layout = "de"; variant = null; } 81 | ]; 82 | lockScreenNotifications = false; 83 | nightLight = true; 84 | }; 85 | description = "DConf configuration for Gnome."; 86 | }; 87 | 88 | git = mkOption { 89 | type = with types; submodule { 90 | options = { 91 | userName = mkOption { 92 | type = str; 93 | default = "Rick Sanchez"; 94 | description = "Git global username."; 95 | }; 96 | 97 | email = mkOption { 98 | type = str; 99 | default = "Rick.Sanchez@Wabalaba.dubdub"; 100 | description = "Git global email."; 101 | }; 102 | 103 | defaultBranch = mkOption { 104 | type = str; 105 | default = "main"; 106 | description = "Default Git branch name (e.g. main or master)."; 107 | }; 108 | 109 | createWorkspaces = mkOption { 110 | type = bool; 111 | default = false; 112 | description = "Whether to enable per-workspace Git configs."; 113 | }; 114 | 115 | workspaces = mkOption { 116 | type = listOf (submodule { 117 | options = { 118 | folderName = mkOption { 119 | type = str; 120 | description = "Relative folder path for the Git workspace."; 121 | }; 122 | email = mkOption { 123 | type = str; 124 | description = "Git email to use in this workspace."; 125 | }; 126 | userName = mkOption { 127 | type = str; 128 | description = "Git username to use in this workspace."; 129 | }; 130 | }; 131 | }); 132 | default = [ ]; 133 | description = "List of Git workspace configurations."; 134 | }; 135 | }; 136 | }; 137 | default = {}; 138 | example = { 139 | userName = "Rick Sanchez"; 140 | email = "Rick.Sanchez@Wabalaba.dubdub"; 141 | defaultBranch = "main"; 142 | createWorkspaces = true; 143 | workspaces = [ 144 | { 145 | folderName = "workspace_personal"; 146 | email = "personal@example.com"; 147 | userName = "Rick Personal"; 148 | } 149 | { 150 | folderName = "workspace_work"; 151 | email = "rick@rick.com"; 152 | userName = "Rick Professional"; 153 | } 154 | ]; 155 | }; 156 | description = "Git configuration including user info and optional workspace-specific overrides."; 157 | }; 158 | 159 | keyboardCCedilla = mkOption { 160 | type = types.bool; 161 | default = false; 162 | description = "Whether to enable cedilla support via GTK/QT IM modules."; 163 | }; 164 | 165 | mainUser = mkOption { 166 | type = with types; attrsOf (oneOf [str (listOf package)]); 167 | default = { 168 | name = "rick"; 169 | group = "rick"; 170 | pkgs = with pkgs; [ 171 | git 172 | thefuck 173 | tmux 174 | vscodium 175 | wl-clipboard 176 | ]; 177 | }; 178 | description = "The main user of the system: name and pkgs"; 179 | }; 180 | 181 | systemWidePkgs = mkOption { 182 | type = types.listOf types.package; 183 | default = with pkgs; [ 184 | openssl 185 | ]; 186 | description = "The system packages"; 187 | }; 188 | 189 | timeZone = mkOption { 190 | type = types.str; 191 | default = "UTC"; 192 | description = "The system time zone"; 193 | }; 194 | }; 195 | 196 | config = { }; 197 | 198 | imports = [ 199 | ./nfs 200 | ./services 201 | ./tmux.nix 202 | ]; 203 | } 204 | -------------------------------------------------------------------------------- /modules/gui/xdg.nix: -------------------------------------------------------------------------------- 1 | { pkgs, ... }: 2 | { 3 | environment.systemPackages = with pkgs; [ 4 | nautilus 5 | papers 6 | eog 7 | vlc 8 | ]; 9 | 10 | # enable screen sharing 11 | xdg = { 12 | mime = 13 | let 14 | web = "brave-browser.desktop"; 15 | inode = "org.gnome.Nautilus.desktop"; 16 | pdf = "org.gnome.Papers.desktop"; 17 | image = "org.gnome.eog.desktop"; 18 | video = "vlc.desktop"; 19 | in 20 | { 21 | enable = true; 22 | addedAssociations = { 23 | "inode/directory" = [ inode ]; 24 | "x-scheme-handler/http" = [ web ]; 25 | "x-scheme-handler/https" = [ web ]; 26 | "application/pdf" = [ pdf ]; 27 | "image/bmp" = [ image ]; 28 | "image/gif" = [ image ]; 29 | "image/jpg" = [ image ]; 30 | "image/pjpeg" = [ image ]; 31 | "image/png" = [ image ]; 32 | "image/tiff" = [ image ]; 33 | "image/webp" = [ image ]; 34 | "image/x-bmp" = [ image ]; 35 | "image/x-gray" = [ image ]; 36 | "image/x-icb" = [ image ]; 37 | "image/x-ico" = [ image ]; 38 | "image/x-png" = [ image ]; 39 | "image/x-portable-anymap" = [ image ]; 40 | "image/x-portable-bitmap" = [ image ]; 41 | "image/x-portable-graymap" = [ image ]; 42 | "image/x-portable-pixmap" = [ image ]; 43 | "image/x-xbitmap" = [ image ]; 44 | "image/x-xpixmap" = [ image ]; 45 | "image/x-pcx" = [ image ]; 46 | "image/svg+xml" = [ image ]; 47 | "image/svg+xml-compressed" = [ image ]; 48 | "image/vnd.wap.wbmp" = [ image ]; 49 | "image/x-icns" = [ image ]; 50 | "video/x-ogm+ogg" = [ video ]; 51 | "video/3gp" = [ video ]; 52 | "video/3gpp" = [ video ]; 53 | "video/3gpp2" = [ video ]; 54 | "video/dv" = [ video ]; 55 | "video/divx" = [ video ]; 56 | "video/fli" = [ video ]; 57 | "video/flv" = [ video ]; 58 | "video/mp2t" = [ video ]; 59 | "video/mp4" = [ video ]; 60 | "video/mp4v-es" = [ video ]; 61 | "video/mpeg" = [ video ]; 62 | "video/mpeg-system" = [ video ]; 63 | "video/msvideo" = [ video ]; 64 | "video/ogg" = [ video ]; 65 | "video/quicktime" = [ video ]; 66 | "video/vivo" = [ video ]; 67 | "video/vnd.divx" = [ video ]; 68 | "video/vnd.mpegurl" = [ video ]; 69 | "video/vnd.rn-realvideo" = [ video ]; 70 | "video/vnd.vivo" = [ video ]; 71 | "video/webm" = [ video ]; 72 | "video/x-anim" = [ video ]; 73 | "video/x-avi" = [ video ]; 74 | "video/x-flc" = [ video ]; 75 | "video/x-fli" = [ video ]; 76 | "video/x-flic" = [ video ]; 77 | "video/x-flv" = [ video ]; 78 | "video/x-m4v" = [ video ]; 79 | "video/x-matroska" = [ video ]; 80 | "video/x-mjpeg" = [ video ]; 81 | "video/x-mpeg" = [ video ]; 82 | "video/x-mpeg2" = [ video ]; 83 | "video/x-ms-asf" = [ video ]; 84 | "video/x-ms-asf-plugin" = [ video ]; 85 | "video/x-ms-asx" = [ video ]; 86 | "video/x-msvideo" = [ video ]; 87 | "video/x-ms-wm" = [ video ]; 88 | "video/x-ms-wmv" = [ video ]; 89 | "video/x-ms-wmx" = [ video ]; 90 | "video/x-ms-wvx" = [ video ]; 91 | "video/x-nsv" = [ video ]; 92 | "video/x-theora" = [ video ]; 93 | "video/x-theora+ogg" = [ video ]; 94 | "video/x-ogm" = [ video ]; 95 | "video/avi" = [ video ]; 96 | "video/x-mpeg-system" = [ video ]; 97 | }; 98 | defaultApplications = { 99 | "inode/directory" = [ inode ]; 100 | "x-scheme-handler/http" = [ web ]; 101 | "x-scheme-handler/https" = [ web ]; 102 | "application/pdf" = [ pdf ]; 103 | "image/bmp" = [ image ]; 104 | "image/gif" = [ image ]; 105 | "image/jpg" = [ image ]; 106 | "image/pjpeg" = [ image ]; 107 | "image/png" = [ image ]; 108 | "image/tiff" = [ image ]; 109 | "image/webp" = [ image ]; 110 | "image/x-bmp" = [ image ]; 111 | "image/x-gray" = [ image ]; 112 | "image/x-icb" = [ image ]; 113 | "image/x-ico" = [ image ]; 114 | "image/x-png" = [ image ]; 115 | "image/x-portable-anymap" = [ image ]; 116 | "image/x-portable-bitmap" = [ image ]; 117 | "image/x-portable-graymap" = [ image ]; 118 | "image/x-portable-pixmap" = [ image ]; 119 | "image/x-xbitmap" = [ image ]; 120 | "image/x-xpixmap" = [ image ]; 121 | "image/x-pcx" = [ image ]; 122 | "image/svg+xml" = [ image ]; 123 | "image/svg+xml-compressed" = [ image ]; 124 | "image/vnd.wap.wbmp" = [ image ]; 125 | "image/x-icns" = [ image ]; 126 | "video/x-ogm+ogg" = [ video ]; 127 | "video/3gp" = [ video ]; 128 | "video/3gpp" = [ video ]; 129 | "video/3gpp2" = [ video ]; 130 | "video/dv" = [ video ]; 131 | "video/divx" = [ video ]; 132 | "video/fli" = [ video ]; 133 | "video/flv" = [ video ]; 134 | "video/mp2t" = [ video ]; 135 | "video/mp4" = [ video ]; 136 | "video/mp4v-es" = [ video ]; 137 | "video/mpeg" = [ video ]; 138 | "video/mpeg-system" = [ video ]; 139 | "video/msvideo" = [ video ]; 140 | "video/ogg" = [ video ]; 141 | "video/quicktime" = [ video ]; 142 | "video/vivo" = [ video ]; 143 | "video/vnd.divx" = [ video ]; 144 | "video/vnd.mpegurl" = [ video ]; 145 | "video/vnd.rn-realvideo" = [ video ]; 146 | "video/vnd.vivo" = [ video ]; 147 | "video/webm" = [ video ]; 148 | "video/x-anim" = [ video ]; 149 | "video/x-avi" = [ video ]; 150 | "video/x-flc" = [ video ]; 151 | "video/x-fli" = [ video ]; 152 | "video/x-flic" = [ video ]; 153 | "video/x-flv" = [ video ]; 154 | "video/x-m4v" = [ video ]; 155 | "video/x-matroska" = [ video ]; 156 | "video/x-mjpeg" = [ video ]; 157 | "video/x-mpeg" = [ video ]; 158 | "video/x-mpeg2" = [ video ]; 159 | "video/x-ms-asf" = [ video ]; 160 | "video/x-ms-asf-plugin" = [ video ]; 161 | "video/x-ms-asx" = [ video ]; 162 | "video/x-msvideo" = [ video ]; 163 | "video/x-ms-wm" = [ video ]; 164 | "video/x-ms-wmv" = [ video ]; 165 | "video/x-ms-wmx" = [ video ]; 166 | "video/x-ms-wvx" = [ video ]; 167 | "video/x-nsv" = [ video ]; 168 | "video/x-theora" = [ video ]; 169 | "video/x-theora+ogg" = [ video ]; 170 | "video/x-ogm" = [ video ]; 171 | "video/avi" = [ video ]; 172 | "video/x-mpeg-system" = [ video ]; 173 | }; 174 | }; 175 | portal = { 176 | enable = true; 177 | extraPortals = with pkgs; [ 178 | xdg-desktop-portal-wlr 179 | xdg-desktop-portal-gtk 180 | ]; 181 | }; 182 | }; 183 | } 184 | --------------------------------------------------------------------------------