systems/x86_64-linux/teal/default.nix - Infra/NixFiles - Gitiles

 # SPDX-FileCopyrightText: 2024 Auxolotl Infrastructure Contributors
 # SPDX-FileCopyrightText: 2024 Clicks Codes
 #
 # SPDX-License-Identifier: GPL-3.0-only

 {
   pkgs,
   modulesPath,
   lib,
   config,
   ...
 }:
 {
   age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPkKdPSPxsLdx3GUjjyibRLjLl3XfaXmfrrvemDFkjI3";

   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;

   time.timeZone = "Etc/UTC";

   environment.systemPackages = with pkgs; [ neovim ];

   clicks = {
     nix.enable = true;

     backups.key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHYH3yYKcrsDz8U45HF6201BN1nBDQIr4qsGeKh94K6T root@vermilion";

     security = {
       doas.enable = true;

       acme = {
         enable = true;
         defaults = {
           email = "minion@clicks.codes";
           dnsProvider = "cloudflare";
           environmentFile = config.age.secrets."clicks.security.acme.defaults.environmentFile".path;
         };
       };
     };

     sites."docs.auxolotl.org".enable = true;
     sites."a.starrysky.blog".enable = true;
     # sites."blog.thecoded.prof".enable = true;

     services = {
       ssh.enable = true;
       headscale = {
         enable = true;
         domain = "clicks.domains";
         server_url = "vpn.clicks.codes";
         addr = lib.clicks.constants.hosts.generic;
         oidc = {
           enable = true;
           issuer = "https://login.clicks.codes/realms/master";
           allowed_groups = [ "/clicks" ];
           client_secret_path =
             config.age.secrets."clicks.services.headscale.oidc.client_secret_path".path;
         };
         noise_private_key_path =
           config.age.secrets."clicks.services.headscale.noise_private_key_path".path;
         acl = let
           permitted_area_names = [
             # Some phonetic alphabet names are excluded here to avoid confusing
             # them with given names
             "alpha"
             "bravo"
             "delta"
             "echo"
             "foxtrot"
             "golf"
             "hotel"
             "india"
             "kilo"
             "lima"
             "november"
             "papa"
             "quebec"
             "sierra"
             "tango"
             "uniform"
             "whiskey"
             "xray"
             "yankee"
             "zulu"
           ];

           assigned_areas = {
             "alpha" = "coded";
             "bravo" = "minion";
             "echo" = "maddie";
             "sierra" = "pineafan";
             "tango" = "mostlyturquoise";
             "zulu" = "zanderp25";
           };

           users = [
             "coded"
             "maddie"
             "minion"
             "pineafan"
             "zanderp25"
             "mostlyturquoise"
           ];

           friends = [
             "sirdigalot"
           ];
         in
           {
             groups."group:maintainer" = [
               "coded"
               "minion"
             ];
             groups."group:users" = users;
             groups."group:friends" = friends;

             acls = [
               {
                 action = "accept";
                 src = [ "group:users" ];
                 dst = [
                   "group:users:*"
                   "group:friends:*"
                   "autogroup:internet:*"
                 ] ++ (map (tag: "tag:${tag}:*") permitted_area_names);
               }
               {
                 action = "accept";
                 src = [ "group:friends" ];
                 dst = [
                   "group:users:*"
                   "group:friends:*"
                 ];
               }
               {
                 action = "accept";
                 src = (map (tag: "tag:${tag}") permitted_area_names);
                 dst = (map (tag: "tag:${tag}:*") permitted_area_names);
               }
               {
                 action = "accept";
                 src = [ "zulu" ];
                 dst = [ "zanderp25:3000" ];
               }
             ];

             ssh = [
               {
                 action = "check";
                 src = ["group:users"];
                 dst = (map (tag: "tag:${tag}") permitted_area_names);
                 checkPeriod = "8h";
                 acceptEnv = [
                   "BAT_THEME"
                   "COLORTERM"
                   "JQ_COLORS"
                   "LANG"
                   "LS_COLORS"
                   "LSCOLORS"
                   "TERM"
                 ];
               }
             ] ++ (lib.attrsets.mapAttrsToList (area: user: {
               action = "check";
               src = [ user ];
               dst = [ "tag:${area}" ];
               checkPeriod = "2h";
               users = [ "root" "autogroup:nonroot" ];
               acceptEnv = [ "*" ];
             }) assigned_areas) ++ (map (user: {
               action = "check";
               src = [ user ];
               dst = [ user ];
               checkPeriod = "2h";
               users = [ "root" "autogroup:nonroot" ];
               acceptEnv = [ "*" ];
             }) (users ++ friends));

             tagOwners = (lib.pipe permitted_area_names [
               (map (area: {
                 name = "tag:${area}";
                 value = [ "group:maintainer" ];
               }))
               lib.listToAttrs
             ]) // (lib.attrsets.mapAttrs' (area: user: {
               name = "tag:${area}";
               value = [ "group:maintainer" user ];
             }) assigned_areas);
           };
       };
       fava = {
         enable = true;
         extraPythonPackages = [
           pkgs.clicks.beancount-autobean
           pkgs.clicks.beancount-beancount_share
           pkgs.clicks.beancount-smart_importer
         ];
         tailscaleAuth = true;
         credentials = {
           truelayer_client_secret = config.age.secrets."clicks.services.fava.credentials.truelayer_client_secret".path;
         };
         accounts = {
           "clicks" = lib.home-manager.hm.dag.entryAnywhere {
             name = "Clicks Codes";
             beancountExtraOptions.operating_currency = "GBP";
           };
           "coded" = lib.home-manager.hm.dag.entryBetween [ "testing" ] [ "clicks" ] {
             name = "Samuel Shuert";
             beancountExtraOptions.operating_currency = "USD";
           };
           "minion" = lib.home-manager.hm.dag.entryBetween [ "testing" ] [ "clicks" ] {
             name = "Skyler Grey";
             beancountExtraOptions.operating_currency = "GBP";
             favaExtraOptions = {
               invert-income-liabilities-equity = "true";
               auto-reload = "true";
               fiscal-year-end = "04-05";
               import-config = builtins.toString (pkgs.writeText "minion-imports.py" ''
                 import autobean.truelayer
                 from smart_importer import apply_hooks, PredictPayees, PredictPostings

                 import os
                 import pathlib

                 with open(pathlib.Path(os.environ["CREDENTIALS_DIRECTORY"]) / pathlib.Path("truelayer_client_secret")) as f:
                   truelayer_client_secret = f.read().strip()

                 CONFIG = [
                   apply_hooks(
                     autobean.truelayer.Importer(
                       "fava-228732",
                       truelayer_client_secret
                     ),
                     [
                       PredictPayees(),
                       PredictPostings(),
                     ]
                   )
                 ]
               '');
               import-dirs = "/var/lib/private/fava/minion/";
             };
             extraConfig = ''
               plugin "fava.plugins.tag_discovered_documents"
               plugin "fava.plugins.link_documents"

               plugin "beancount.plugins.pedantic"
               plugin "beancount.plugins.unrealized" "Unrealized"
               plugin "beancount.plugins.implicit_prices"

               plugin "beancount_share.share" "{
                   'mark_name': 'share',
                   'meta_name': 'shared',
                   'account_debtors': 'Assets:People',
                   'account_creditors': 'Liabilities:People',
                   'open_date': '1970-01-01',
                   'quantize': '0.01'
               }"
             '';
           };
           "testing" = lib.home-manager.hm.dag.entryAfter [ "clicks" ] {
             name = "Test Data - May Be Wiped At Any Time";
           };
         };
         domain = "fava.clicks.codes";
       };
       silverbullet = {
         enable = true;
         domain = "silverbullet.clicks.codes";
         tailscaleAuth = true;
       };
     };

     networking.tailscale = {
       enable = true;
       authKeyFile =
         config.age.secrets."clicks.networking.tailscale.authKeyFile".path;
     };

     storage = {
       raid.enable = true;
       impermanence = {
         enable = true;
         devices = {
           root = "/dev/disk/by-uuid/ab5c2f52-a737-4b29-a505-e3d0b9d0714c";
           persist = "/dev/md/a1d1:persist";
         };
       };
     };
   };

   boot.initrd.availableKernelModules = [
     "nvme"
     "xhci_pci"
     "ahci"
     "usbhid"
     "uas"
     "usb_storage"
     "sd_mod"
   ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];

   fileSystems."/nix" = {
     device = "/dev/disk/by-uuid/ab5c2f52-a737-4b29-a505-e3d0b9d0714c";
     fsType = "btrfs";
     options = [ "subvol=@nix" ];
   };

   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/880D-BBAB";
     fsType = "vfat";
     options = [
       "fmask=0022"
       "dmask=0022"
     ];
   };

   swapDevices = [ ];

   networking.useDHCP = true;

   system.stateVersion = "24.05";

   age.secrets."clicks.networking.tailscale.authKeyFile".rekeyFile = ./clicks.networking.tailscale.authKeyFile.age;

   age.secrets."clicks.security.acme.defaults.environmentFile".rekeyFile = ./clicks.security.acme.defaults.environmentFile.age;

   age.secrets."clicks.services.fava.credentials.truelayer_client_secret".rekeyFile = ./clicks.services.fava.credentials.truelayer_client_secret.age;

   age.secrets."clicks.services.headscale.oidc.client_secret_path" = {
     rekeyFile = ./clicks.services.headscale.oidc.client_secret_path.age;
     group = "headscale";
   };
   age.secrets."clicks.services.headscale.noise_private_key_path" = {
     rekeyFile = ./clicks.services.headscale.noise_private_key_path.age;
     group = "headscale";
   };
 }
	# SPDX-FileCopyrightText: 2024 Auxolotl Infrastructure Contributors
	# SPDX-FileCopyrightText: 2024 Clicks Codes
	#
	# SPDX-License-Identifier: GPL-3.0-only

	{
	pkgs,
	modulesPath,
	lib,
	config,
	...
	}:
	{
	age.rekey.hostPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPkKdPSPxsLdx3GUjjyibRLjLl3XfaXmfrrvemDFkjI3";

	boot.loader.systemd-boot.enable = true;
	boot.loader.efi.canTouchEfiVariables = true;

	time.timeZone = "Etc/UTC";

	environment.systemPackages = with pkgs; [ neovim ];

	clicks = {
	nix.enable = true;

	backups.key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHYH3yYKcrsDz8U45HF6201BN1nBDQIr4qsGeKh94K6T root@vermilion";

	security = {
	doas.enable = true;

	acme = {
	enable = true;
	defaults = {
	email = "minion@clicks.codes";
	dnsProvider = "cloudflare";
	environmentFile = config.age.secrets."clicks.security.acme.defaults.environmentFile".path;
	};
	};
	};

	sites."docs.auxolotl.org".enable = true;
	sites."a.starrysky.blog".enable = true;
	# sites."blog.thecoded.prof".enable = true;

	services = {
	ssh.enable = true;
	headscale = {
	enable = true;
	domain = "clicks.domains";
	server_url = "vpn.clicks.codes";
	addr = lib.clicks.constants.hosts.generic;
	oidc = {
	enable = true;
	issuer = "https://login.clicks.codes/realms/master";
	allowed_groups = [ "/clicks" ];
	client_secret_path =
	config.age.secrets."clicks.services.headscale.oidc.client_secret_path".path;
	};
	noise_private_key_path =
	config.age.secrets."clicks.services.headscale.noise_private_key_path".path;
	acl = let
	permitted_area_names = [
	# Some phonetic alphabet names are excluded here to avoid confusing
	# them with given names
	"alpha"
	"bravo"
	"delta"
	"echo"
	"foxtrot"
	"golf"
	"hotel"
	"india"
	"kilo"
	"lima"
	"november"
	"papa"
	"quebec"
	"sierra"
	"tango"
	"uniform"
	"whiskey"
	"xray"
	"yankee"
	"zulu"
	];

	assigned_areas = {
	"alpha" = "coded";
	"bravo" = "minion";
	"echo" = "maddie";
	"sierra" = "pineafan";
	"tango" = "mostlyturquoise";
	"zulu" = "zanderp25";
	};

	users = [
	"coded"
	"maddie"
	"minion"
	"pineafan"
	"zanderp25"
	"mostlyturquoise"
	];

	friends = [
	"sirdigalot"
	];
	in
	{
	groups."group:maintainer" = [
	"coded"
	"minion"
	];
	groups."group:users" = users;
	groups."group:friends" = friends;

	acls = [
	{
	action = "accept";
	src = [ "group:users" ];
	dst = [
	"group:users:*"
	"group:friends:*"
	"autogroup:internet:*"
	] ++ (map (tag: "tag:${tag}:*") permitted_area_names);
	}
	{
	action = "accept";
	src = [ "group:friends" ];
	dst = [
	"group:users:*"
	"group:friends:*"
	];
	}
	{
	action = "accept";
	src = (map (tag: "tag:${tag}") permitted_area_names);
	dst = (map (tag: "tag:${tag}:*") permitted_area_names);
	}
	{
	action = "accept";
	src = [ "zulu" ];
	dst = [ "zanderp25:3000" ];
	}
	];

	ssh = [
	{
	action = "check";
	src = ["group:users"];
	dst = (map (tag: "tag:${tag}") permitted_area_names);
	checkPeriod = "8h";
	acceptEnv = [
	"BAT_THEME"
	"COLORTERM"
	"JQ_COLORS"
	"LANG"
	"LS_COLORS"
	"LSCOLORS"
	"TERM"
	];
	}
	] ++ (lib.attrsets.mapAttrsToList (area: user: {
	action = "check";
	src = [ user ];
	dst = [ "tag:${area}" ];
	checkPeriod = "2h";
	users = [ "root" "autogroup:nonroot" ];
	acceptEnv = [ "*" ];
	}) assigned_areas) ++ (map (user: {
	action = "check";
	src = [ user ];
	dst = [ user ];
	checkPeriod = "2h";
	users = [ "root" "autogroup:nonroot" ];
	acceptEnv = [ "*" ];
	}) (users ++ friends));

	tagOwners = (lib.pipe permitted_area_names [
	(map (area: {
	name = "tag:${area}";
	value = [ "group:maintainer" ];
	}))
	lib.listToAttrs
	]) // (lib.attrsets.mapAttrs' (area: user: {
	name = "tag:${area}";
	value = [ "group:maintainer" user ];
	}) assigned_areas);
	};
	};
	fava = {
	enable = true;
	extraPythonPackages = [
	pkgs.clicks.beancount-autobean
	pkgs.clicks.beancount-beancount_share
	pkgs.clicks.beancount-smart_importer
	];
	tailscaleAuth = true;
	credentials = {
	truelayer_client_secret = config.age.secrets."clicks.services.fava.credentials.truelayer_client_secret".path;
	};
	accounts = {
	"clicks" = lib.home-manager.hm.dag.entryAnywhere {
	name = "Clicks Codes";
	beancountExtraOptions.operating_currency = "GBP";
	};
	"coded" = lib.home-manager.hm.dag.entryBetween [ "testing" ] [ "clicks" ] {
	name = "Samuel Shuert";
	beancountExtraOptions.operating_currency = "USD";
	};
	"minion" = lib.home-manager.hm.dag.entryBetween [ "testing" ] [ "clicks" ] {
	name = "Skyler Grey";
	beancountExtraOptions.operating_currency = "GBP";
	favaExtraOptions = {
	invert-income-liabilities-equity = "true";
	auto-reload = "true";
	fiscal-year-end = "04-05";
	import-config = builtins.toString (pkgs.writeText "minion-imports.py" ''
	import autobean.truelayer
	from smart_importer import apply_hooks, PredictPayees, PredictPostings

	import os
	import pathlib

	with open(pathlib.Path(os.environ["CREDENTIALS_DIRECTORY"]) / pathlib.Path("truelayer_client_secret")) as f:
	truelayer_client_secret = f.read().strip()

	CONFIG = [
	apply_hooks(
	autobean.truelayer.Importer(
	"fava-228732",
	truelayer_client_secret
	),
	[
	PredictPayees(),
	PredictPostings(),
	]
	)
	]
	'');
	import-dirs = "/var/lib/private/fava/minion/";
	};
	extraConfig = ''
	plugin "fava.plugins.tag_discovered_documents"
	plugin "fava.plugins.link_documents"

	plugin "beancount.plugins.pedantic"
	plugin "beancount.plugins.unrealized" "Unrealized"
	plugin "beancount.plugins.implicit_prices"

	plugin "beancount_share.share" "{
	'mark_name': 'share',
	'meta_name': 'shared',
	'account_debtors': 'Assets:People',
	'account_creditors': 'Liabilities:People',
	'open_date': '1970-01-01',
	'quantize': '0.01'
	}"
	'';
	};
	"testing" = lib.home-manager.hm.dag.entryAfter [ "clicks" ] {
	name = "Test Data - May Be Wiped At Any Time";
	};
	};
	domain = "fava.clicks.codes";
	};
	silverbullet = {
	enable = true;
	domain = "silverbullet.clicks.codes";
	tailscaleAuth = true;
	};
	};

	networking.tailscale = {
	enable = true;
	authKeyFile =
	config.age.secrets."clicks.networking.tailscale.authKeyFile".path;
	};

	storage = {
	raid.enable = true;
	impermanence = {
	enable = true;
	devices = {
	root = "/dev/disk/by-uuid/ab5c2f52-a737-4b29-a505-e3d0b9d0714c";
	persist = "/dev/md/a1d1:persist";
	};
	};
	};
	};

	boot.initrd.availableKernelModules = [
	"nvme"
	"xhci_pci"
	"ahci"
	"usbhid"
	"uas"
	"usb_storage"
	"sd_mod"
	];
	boot.initrd.kernelModules = [ ];
	boot.kernelModules = [ "kvm-amd" ];
	boot.extraModulePackages = [ ];

	fileSystems."/nix" = {
	device = "/dev/disk/by-uuid/ab5c2f52-a737-4b29-a505-e3d0b9d0714c";
	fsType = "btrfs";
	options = [ "subvol=@nix" ];
	};

	fileSystems."/boot" = {
	device = "/dev/disk/by-uuid/880D-BBAB";
	fsType = "vfat";
	options = [
	"fmask=0022"
	"dmask=0022"
	];
	};

	swapDevices = [ ];

	networking.useDHCP = true;

	system.stateVersion = "24.05";

	age.secrets."clicks.networking.tailscale.authKeyFile".rekeyFile = ./clicks.networking.tailscale.authKeyFile.age;

	age.secrets."clicks.security.acme.defaults.environmentFile".rekeyFile = ./clicks.security.acme.defaults.environmentFile.age;

	age.secrets."clicks.services.fava.credentials.truelayer_client_secret".rekeyFile = ./clicks.services.fava.credentials.truelayer_client_secret.age;

	age.secrets."clicks.services.headscale.oidc.client_secret_path" = {
	rekeyFile = ./clicks.services.headscale.oidc.client_secret_path.age;
	group = "headscale";
	};
	age.secrets."clicks.services.headscale.noise_private_key_path" = {
	rekeyFile = ./clicks.services.headscale.noise_private_key_path.age;
	group = "headscale";
	};
	}