Compare commits
5 commits
69971151ef
...
244e930b21
Author | SHA1 | Date | |
---|---|---|---|
Patrick | 244e930b21 | ||
Patrick | b56559ce21 | ||
Patrick | e15f7aaf4d | ||
Patrick | 1b983b62d1 | ||
Patrick | 493f6d08d4 |
|
@ -20,6 +20,7 @@
|
||||||
|
|
||||||
../../modules/deterministic-ids.nix
|
../../modules/deterministic-ids.nix
|
||||||
../../modules/distributed-config.nix
|
../../modules/distributed-config.nix
|
||||||
|
../../modules/ensure-pcr.nix
|
||||||
../../modules/globals.nix
|
../../modules/globals.nix
|
||||||
../../modules/meta.nix
|
../../modules/meta.nix
|
||||||
../../modules/iwd.nix
|
../../modules/iwd.nix
|
||||||
|
|
|
@ -41,8 +41,8 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
user_rules = [
|
user_rules = [
|
||||||
"||homematic.internal^$dnsrewrite=${lib.net.cidr.host 30 globals.net.vlans.devices.cidrv4}"
|
# "||homematic.internal^$dnsrewrite=${lib.net.cidr.host 30 globals.net.vlans.devices.cidrv4}"
|
||||||
"||testberry.internal^$dnsrewrite=${lib.net.cidr.host 31 globals.net.vlans.devices.cidrv4}"
|
# "||testberry.internal^$dnsrewrite=${lib.net.cidr.host 31 globals.net.vlans.devices.cidrv4}"
|
||||||
"||smb.internal^$dnsrewrite=${lib.net.cidr.host globals.services.samba.ip globals.net.vlans.home.cidrv4}"
|
"||smb.internal^$dnsrewrite=${lib.net.cidr.host globals.services.samba.ip globals.net.vlans.home.cidrv4}"
|
||||||
"||${globals.domains.web}^$dnsrewrite=${lib.net.cidr.host 1 globals.net.vlans.services.cidrv4}"
|
"||${globals.domains.web}^$dnsrewrite=${lib.net.cidr.host 1 globals.net.vlans.services.cidrv4}"
|
||||||
"@@||${globals.services.vaultwarden.domain}"
|
"@@||${globals.services.vaultwarden.domain}"
|
||||||
|
|
|
@ -36,8 +36,17 @@
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
networking.nftables.firewall.zones.devices.interfaces = [ "mv-devices" ];
|
networking.nftables.firewall.zones.devices.interfaces = [ "mv-devices" ];
|
||||||
|
networking.nftables.firewall.zones.iot.interfaces = [ "mv-iot" ];
|
||||||
networking.nftables.firewall = {
|
networking.nftables.firewall = {
|
||||||
rules = {
|
rules = {
|
||||||
|
mqtt = {
|
||||||
|
from = [
|
||||||
|
"devices"
|
||||||
|
"iot"
|
||||||
|
];
|
||||||
|
to = [ "local" ];
|
||||||
|
allowedTCPPorts = [ 1883 ];
|
||||||
|
};
|
||||||
homematic = {
|
homematic = {
|
||||||
from = [
|
from = [
|
||||||
"devices"
|
"devices"
|
||||||
|
@ -45,8 +54,38 @@
|
||||||
to = [ "local" ];
|
to = [ "local" ];
|
||||||
allowedTCPPorts = [ 45053 ];
|
allowedTCPPorts = [ 45053 ];
|
||||||
};
|
};
|
||||||
|
mdns = {
|
||||||
|
from = [
|
||||||
|
"devices"
|
||||||
|
"iot"
|
||||||
|
];
|
||||||
|
to = [ "local" ];
|
||||||
|
allowedUDPPorts = [ 5353 ];
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
age.secrets.mosquitto-pw-home_assistant = {
|
||||||
|
mode = "440";
|
||||||
|
owner = "hass";
|
||||||
|
group = "mosquitto";
|
||||||
|
generator.script = "alnum";
|
||||||
|
};
|
||||||
|
services.mosquitto = {
|
||||||
|
enable = true;
|
||||||
|
persistence = true;
|
||||||
|
listeners = [
|
||||||
|
{
|
||||||
|
acl = [ "pattern readwrite #" ];
|
||||||
|
users = {
|
||||||
|
home_assistant = {
|
||||||
|
passwordFile = config.age.secrets.mosquitto-pw-home_assistant.path;
|
||||||
|
acl = [ "readwrite #" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
settings.allow_anonymous = false;
|
||||||
|
}
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
services.home-assistant = {
|
services.home-assistant = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
@ -77,6 +116,8 @@
|
||||||
mushroom
|
mushroom
|
||||||
multiple-entity-row
|
multiple-entity-row
|
||||||
button-card
|
button-card
|
||||||
|
weather-chart-card
|
||||||
|
hourly-weather
|
||||||
];
|
];
|
||||||
config = {
|
config = {
|
||||||
http = {
|
http = {
|
||||||
|
@ -390,6 +431,7 @@
|
||||||
stringcase
|
stringcase
|
||||||
hahomematic
|
hahomematic
|
||||||
pymodbus
|
pymodbus
|
||||||
|
hatasmota
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
networking.hosts = {
|
networking.hosts = {
|
||||||
|
|
138
flake.lock
138
flake.lock
|
@ -36,11 +36,11 @@
|
||||||
"treefmt-nix": "treefmt-nix"
|
"treefmt-nix": "treefmt-nix"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735993832,
|
"lastModified": 1736429053,
|
||||||
"narHash": "sha256-gmleUygegZHWfyzgLUSgj9rVe2iUCoAUB0iUkKzQYN4=",
|
"narHash": "sha256-luGqUO7XJKGMO65+xD2xWxr4bsHWATbdFo6JUQIEzrI=",
|
||||||
"owner": "oddlama",
|
"owner": "oddlama",
|
||||||
"repo": "agenix-rekey",
|
"repo": "agenix-rekey",
|
||||||
"rev": "57e286831e3581800178b310c0110c244f2e2469",
|
"rev": "8cd512cc5324de73de9bd47d85c15afb4fee3d9c",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -399,11 +399,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735468753,
|
"lastModified": 1736591904,
|
||||||
"narHash": "sha256-2dt1nOe9zf9pDkf5Kn7FUFyPRo581s0n90jxYXJ94l0=",
|
"narHash": "sha256-LFO8pSrPKrH8OPq2HaAuBG5skk8/MNJ/9YmK3KsnSks=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "disko",
|
"repo": "disko",
|
||||||
"rev": "84a5b93637cc16cbfcc61b6e1684d626df61eb21",
|
"rev": "33827d2bd16bfe2e21b62956526c72d313595dfd",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -747,11 +747,11 @@
|
||||||
"nixpkgs-lib": "nixpkgs-lib"
|
"nixpkgs-lib": "nixpkgs-lib"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735774679,
|
"lastModified": 1736143030,
|
||||||
"narHash": "sha256-soePLBazJk0qQdDVhdbM98vYdssfs3WFedcq+raipRI=",
|
"narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
|
||||||
"owner": "hercules-ci",
|
"owner": "hercules-ci",
|
||||||
"repo": "flake-parts",
|
"repo": "flake-parts",
|
||||||
"rev": "f2f7418ce0ab4a5309a4596161d154cfc877af66",
|
"rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -844,11 +844,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1722555600,
|
"lastModified": 1736143030,
|
||||||
"narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
|
"narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
|
||||||
"owner": "hercules-ci",
|
"owner": "hercules-ci",
|
||||||
"repo": "flake-parts",
|
"repo": "flake-parts",
|
||||||
"rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
|
"rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -865,11 +865,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735774679,
|
"lastModified": 1736143030,
|
||||||
"narHash": "sha256-soePLBazJk0qQdDVhdbM98vYdssfs3WFedcq+raipRI=",
|
"narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
|
||||||
"owner": "hercules-ci",
|
"owner": "hercules-ci",
|
||||||
"repo": "flake-parts",
|
"repo": "flake-parts",
|
||||||
"rev": "f2f7418ce0ab4a5309a4596161d154cfc877af66",
|
"rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1252,11 +1252,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736066484,
|
"lastModified": 1736508663,
|
||||||
"narHash": "sha256-uTstP36WaFrw+TEHb8nLF14hFPzQBOhmIxzioHCDaL8=",
|
"narHash": "sha256-ZOaGwa+WnB7Zn3YXimqjmIugAnHePdXCmNu+AHkq808=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "home-manager",
|
"repo": "home-manager",
|
||||||
"rev": "5ad12b6ea06b84e48f6b677957c74f32d47bdee0",
|
"rev": "2532b500c3ed2b8940e831039dcec5a5ea093afc",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1273,11 +1273,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735979091,
|
"lastModified": 1736508663,
|
||||||
"narHash": "sha256-WpFjt6+8UD81EP386c269ZTqpEmlGJgcPw+OB4b7EBs=",
|
"narHash": "sha256-ZOaGwa+WnB7Zn3YXimqjmIugAnHePdXCmNu+AHkq808=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "home-manager",
|
"repo": "home-manager",
|
||||||
"rev": "11ab08541e61ac3bbf2ab27229f68622629401df",
|
"rev": "2532b500c3ed2b8940e831039dcec5a5ea093afc",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1334,11 +1334,11 @@
|
||||||
},
|
},
|
||||||
"impermanence": {
|
"impermanence": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1734945620,
|
"lastModified": 1736688610,
|
||||||
"narHash": "sha256-olIfsfJK4/GFmPH8mXMmBDAkzVQ1TWJmeGT3wBGfQPY=",
|
"narHash": "sha256-1Zl9xahw399UiZSJ9Vxs1W4WRFjO1SsNdVZQD4nghz0=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "impermanence",
|
"repo": "impermanence",
|
||||||
"rev": "d000479f4f41390ff7cf9204979660ad5dd16176",
|
"rev": "c64bed13b562fc3bb454b48773d4155023ac31b7",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1406,11 +1406,11 @@
|
||||||
"nixpkgs-lib": "nixpkgs-lib_5"
|
"nixpkgs-lib": "nixpkgs-lib_5"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736079376,
|
"lastModified": 1736684024,
|
||||||
"narHash": "sha256-DE/PZoasUoex2Y/y2MnHklCXzGoVlHyMLXB56DHl7fY=",
|
"narHash": "sha256-FYJ4iFD/2L1CFN/aHjI8HxxSxuPNy4OvW+VCBh41Lzk=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "lib-aggregate",
|
"repo": "lib-aggregate",
|
||||||
"rev": "ef3ee8050d86486c0f380ddd479370ad33cf83fb",
|
"rev": "917882a0186d7731a61ede986c701e272f744750",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1464,11 +1464,11 @@
|
||||||
"spectrum": "spectrum"
|
"spectrum": "spectrum"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735074045,
|
"lastModified": 1736637237,
|
||||||
"narHash": "sha256-CeYsC8J2dNiV2FCQOxK1oZ/jNpOF2io7aCEFHmfi95U=",
|
"narHash": "sha256-kZELEfQDEbCljZUpmIw0G0tNNdcJlnLvc6bwKQ++Okw=",
|
||||||
"owner": "astro",
|
"owner": "astro",
|
||||||
"repo": "microvm.nix",
|
"repo": "microvm.nix",
|
||||||
"rev": "2ae08de8e8068b00193b9cfbc0acc9dfdda03181",
|
"rev": "6f7e4a7bfcdce1c703f9cb89ae9d634167b720b8",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1608,11 +1608,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735956190,
|
"lastModified": 1736370755,
|
||||||
"narHash": "sha256-svzx3yVXD5tbBJZCn3Lt1RriH8GHo6CyVUPTHejf7sU=",
|
"narHash": "sha256-iWcjToBpx4PUd74uqvIGAfqqVfyrvRLRauC/SxEKIF0=",
|
||||||
"owner": "lnl7",
|
"owner": "lnl7",
|
||||||
"repo": "nix-darwin",
|
"repo": "nix-darwin",
|
||||||
"rev": "3feaf376d75d3d58ebf7e9a4f584d00628548ad9",
|
"rev": "57733bd1dc81900e13438e5b4439239f1b29db0e",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1629,11 +1629,11 @@
|
||||||
"treefmt-nix": "treefmt-nix_5"
|
"treefmt-nix": "treefmt-nix_5"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1733909753,
|
"lastModified": 1736194844,
|
||||||
"narHash": "sha256-5GChR6LKh6EwGXLfR3HLW2Z0AWoyce4Hyp3VB5C4FCk=",
|
"narHash": "sha256-CXtD5xUKb92EjL9RrsGQ9jgnl0aIoGEPwnJ805d3Xz0=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "nix-eval-jobs",
|
"repo": "nix-eval-jobs",
|
||||||
"rev": "b1f94fed4af8e7f30665a3bf8b369dc3b8a95884",
|
"rev": "cbae9154bc76c5aa7873f0a67b3c9f13124929d3",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1671,11 +1671,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736047960,
|
"lastModified": 1736652904,
|
||||||
"narHash": "sha256-hutd85FA1jUJhhqBRRJ+u7UHO9oFGD/RVm2x5w8WjVQ=",
|
"narHash": "sha256-8uolHABgroXqzs03QdulHp8H9e5kWQZnnhcda1MKbBM=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "nix-index-database",
|
"repo": "nix-index-database",
|
||||||
"rev": "816a6ae88774ba7e74314830546c29e134e0dffb",
|
"rev": "271e5bd7c57e1f001693799518b10a02d1123b12",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1692,11 +1692,11 @@
|
||||||
"pre-commit-hooks": "pre-commit-hooks_4"
|
"pre-commit-hooks": "pre-commit-hooks_4"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735927098,
|
"lastModified": 1736111688,
|
||||||
"narHash": "sha256-bRAtYb+o9/kFrUDZt5pFD0ET+rG0g5nYM0qNKaRiv2g=",
|
"narHash": "sha256-5z1ZgHgrr1qI0ve+mc0SjbL5PGbDLZb/3uijpmLIWT8=",
|
||||||
"owner": "oddlama",
|
"owner": "oddlama",
|
||||||
"repo": "nix-topology",
|
"repo": "nix-topology",
|
||||||
"rev": "2113ac865a077a7487268d6f1fe27400271ecd19",
|
"rev": "ac1aa5116d858fdff131625dde59a988f74efb11",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1767,11 +1767,11 @@
|
||||||
},
|
},
|
||||||
"nixos-hardware": {
|
"nixos-hardware": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735388221,
|
"lastModified": 1736441705,
|
||||||
"narHash": "sha256-e5IOgjQf0SZcFCEV/gMGrsI0gCJyqOKShBQU0iiM3Kg=",
|
"narHash": "sha256-OL7leZ6KBhcDF3nEKe4aZVfIm6xQpb1Kb+mxySIP93o=",
|
||||||
"owner": "nixos",
|
"owner": "nixos",
|
||||||
"repo": "nixos-hardware",
|
"repo": "nixos-hardware",
|
||||||
"rev": "7c674c6734f61157e321db595dbfcd8523e04e19",
|
"rev": "8870dcaff63dfc6647fb10648b827e9d40b0a337",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -1890,11 +1890,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs-lib_5": {
|
"nixpkgs-lib_5": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736039079,
|
"lastModified": 1736643958,
|
||||||
"narHash": "sha256-ONaTdkME8AJMoQjkydnlUNrzQrIWIdeprkRKW0V1UIE=",
|
"narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "nixpkgs.lib",
|
"repo": "nixpkgs.lib",
|
||||||
"rev": "e506b7786d099e0dec40e1204c555e3562ee9bf8",
|
"rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -2009,11 +2009,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736082492,
|
"lastModified": 1736685270,
|
||||||
"narHash": "sha256-f+w2ZAMRtnXW2pEC5q3+Eh5J0PEtsMWqAmjW6pOJpCw=",
|
"narHash": "sha256-Zp2n4OoCsvjxS18u8Qsu3PF8R+IhhOEfrokgZmxOwrY=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "nixpkgs-wayland",
|
"repo": "nixpkgs-wayland",
|
||||||
"rev": "7595aa1a3153be4c7aea30c0982f53230088012c",
|
"rev": "2cb439411d17eb145a99536196f5ab11685268b8",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -2024,11 +2024,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs_10": {
|
"nixpkgs_10": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735834308,
|
"lastModified": 1736523798,
|
||||||
"narHash": "sha256-dklw3AXr3OGO4/XT1Tu3Xz9n/we8GctZZ75ZWVqAVhk=",
|
"narHash": "sha256-Xb8mke6UCYjge9kPR9o4P1nVrhk7QBbKv3xQ9cj7h2s=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "6df24922a1400241dae323af55f30e4318a6ca65",
|
"rev": "130595eba61081acde9001f43de3248d8888ac4a",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -2040,11 +2040,11 @@
|
||||||
},
|
},
|
||||||
"nixpkgs_11": {
|
"nixpkgs_11": {
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1732238832,
|
"lastModified": 1736042175,
|
||||||
"narHash": "sha256-sQxuJm8rHY20xq6Ah+GwIUkF95tWjGRd1X8xF+Pkk38=",
|
"narHash": "sha256-jdd5UWtLVrNEW8K6u5sy5upNAFmF3S4Y+OIeToqJ1X8=",
|
||||||
"owner": "NixOS",
|
"owner": "NixOS",
|
||||||
"repo": "nixpkgs",
|
"repo": "nixpkgs",
|
||||||
"rev": "8edf06bea5bcbee082df1b7369ff973b91618b8d",
|
"rev": "bf689c40d035239a489de5997a4da5352434632e",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -2213,11 +2213,11 @@
|
||||||
"treefmt-nix": "treefmt-nix_6"
|
"treefmt-nix": "treefmt-nix_6"
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736025907,
|
"lastModified": 1736598781,
|
||||||
"narHash": "sha256-OopQbnOMP5YCl2aVEQQmPeze8wDmofZjzU6URCFEPQU=",
|
"narHash": "sha256-Y0o9ahm6Kk0DumTo80/vKspkHOkbtFgKCNiICyRjhMs=",
|
||||||
"owner": "nix-community",
|
"owner": "nix-community",
|
||||||
"repo": "nixvim",
|
"repo": "nixvim",
|
||||||
"rev": "e07a482fd86eed90fd9378b97a2f938f07da1499",
|
"rev": "2fc2132a78753fc3d7ec732044eff7ad69530055",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -2848,11 +2848,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1736050526,
|
"lastModified": 1736655351,
|
||||||
"narHash": "sha256-wscvKDsyIES59ltENnOw7Hz8WKU8hg5m7dYbcJN2u6A=",
|
"narHash": "sha256-+kAbUaJxCwKAxFvn3WL8dbzxoPaV+WKP4RG0R4JI4rY=",
|
||||||
"owner": "Gerg-l",
|
"owner": "Gerg-l",
|
||||||
"repo": "spicetify-nix",
|
"repo": "spicetify-nix",
|
||||||
"rev": "78c9ace8b9e1d7b64b4d797a066047c2332d24f6",
|
"rev": "749a821c86fb61be668d7583761f432f21772306",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -3200,11 +3200,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1723303070,
|
"lastModified": 1736154270,
|
||||||
"narHash": "sha256-krGNVA30yptyRonohQ+i9cnK+CfCpedg6z3qzqVJcTs=",
|
"narHash": "sha256-p2r8xhQZ3TYIEKBoiEhllKWQqWNJNoT9v64Vmg4q8Zw=",
|
||||||
"owner": "numtide",
|
"owner": "numtide",
|
||||||
"repo": "treefmt-nix",
|
"repo": "treefmt-nix",
|
||||||
"rev": "14c092e0326de759e16b37535161b3cb9770cea3",
|
"rev": "13c913f5deb3a5c08bb810efd89dc8cb24dd968b",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
@ -3221,11 +3221,11 @@
|
||||||
]
|
]
|
||||||
},
|
},
|
||||||
"locked": {
|
"locked": {
|
||||||
"lastModified": 1735905407,
|
"lastModified": 1736154270,
|
||||||
"narHash": "sha256-1hKMRIT+QZNWX46e4gIovoQ7H8QRb7803ZH4qSKI45o=",
|
"narHash": "sha256-p2r8xhQZ3TYIEKBoiEhllKWQqWNJNoT9v64Vmg4q8Zw=",
|
||||||
"owner": "numtide",
|
"owner": "numtide",
|
||||||
"repo": "treefmt-nix",
|
"repo": "treefmt-nix",
|
||||||
"rev": "29806abab803e498df96d82dd6f34b32eb8dd2c8",
|
"rev": "13c913f5deb3a5c08bb810efd89dc8cb24dd968b",
|
||||||
"type": "github"
|
"type": "github"
|
||||||
},
|
},
|
||||||
"original": {
|
"original": {
|
||||||
|
|
|
@ -65,4 +65,12 @@
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
boot.initrd.luks.devices.rpool_m2-ssd.crypttabExtraOpts = [
|
||||||
|
"tpm2-device=auto"
|
||||||
|
"tpm2-measure-pcr=yes"
|
||||||
|
];
|
||||||
|
boot.initrd.luks.devices.panzer_sata-hdd.crypttabExtraOpts = [
|
||||||
|
"tpm2-device=auto"
|
||||||
|
"tpm2-measure-pcr=yes"
|
||||||
|
];
|
||||||
}
|
}
|
||||||
|
|
Binary file not shown.
|
@ -15,9 +15,6 @@
|
||||||
homeWlan = {
|
homeWlan = {
|
||||||
generator.script = "alnum";
|
generator.script = "alnum";
|
||||||
};
|
};
|
||||||
guestWlan = {
|
|
||||||
generator.script = "alnum";
|
|
||||||
};
|
|
||||||
iotWlan = {
|
iotWlan = {
|
||||||
generator.script = "alnum";
|
generator.script = "alnum";
|
||||||
};
|
};
|
||||||
|
@ -65,36 +62,22 @@
|
||||||
networks.wlan01 = {
|
networks.wlan01 = {
|
||||||
inherit (globals.hostapd) ssid;
|
inherit (globals.hostapd) ssid;
|
||||||
apIsolate = true;
|
apIsolate = true;
|
||||||
# not supporte by laptop :(
|
#logLevel = 0;
|
||||||
# settings.ieee80211w = 0;
|
|
||||||
logLevel = 0;
|
|
||||||
settings = {
|
settings = {
|
||||||
vlan_file = "${pkgs.writeText "hostaps.vlans" ''
|
bridge = "br-iot";
|
||||||
10 wifi-home br-home
|
|
||||||
40 wifi-iot br-iot
|
|
||||||
50 wifi-guests br-guests
|
|
||||||
''}";
|
|
||||||
dynamic_vlan = 1;
|
|
||||||
};
|
};
|
||||||
authentication = {
|
authentication = {
|
||||||
saePasswords = [
|
mode = "wpa2-sha1";
|
||||||
{
|
wpaPasswordFile = config.age.secrets.iotWlan.path;
|
||||||
passwordFile = config.age.secrets.homeWlan.path;
|
# saePasswords = [
|
||||||
vlanid = 10;
|
# {
|
||||||
}
|
# passwordFile = config.age.secrets.iotWlan.path;
|
||||||
{
|
# }
|
||||||
passwordFile = config.age.secrets.iotWlan.path;
|
# ];
|
||||||
vlanid = 40;
|
|
||||||
}
|
|
||||||
{
|
|
||||||
passwordFile = config.age.secrets.guestWlan.path;
|
|
||||||
vlanid = 50;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
pairwiseCiphers = [
|
pairwiseCiphers = [
|
||||||
"CCMP"
|
"CCMP"
|
||||||
"GCMP"
|
# "GCMP"
|
||||||
"GCMP-256"
|
# "GCMP-256"
|
||||||
];
|
];
|
||||||
#enableRecommendedPairwiseCiphers = true;
|
#enableRecommendedPairwiseCiphers = true;
|
||||||
};
|
};
|
||||||
|
|
|
@ -171,6 +171,7 @@ in
|
||||||
printer-smb = {
|
printer-smb = {
|
||||||
from = [
|
from = [
|
||||||
"printer"
|
"printer"
|
||||||
|
"fritz"
|
||||||
];
|
];
|
||||||
to = [ "smb" ];
|
to = [ "smb" ];
|
||||||
allowedTCPPorts = [ 445 ];
|
allowedTCPPorts = [ 445 ];
|
||||||
|
@ -200,8 +201,10 @@ in
|
||||||
from = [
|
from = [
|
||||||
"home"
|
"home"
|
||||||
"devices"
|
"devices"
|
||||||
|
"fritz"
|
||||||
"guests"
|
"guests"
|
||||||
"services"
|
"services"
|
||||||
|
"fritz"
|
||||||
];
|
];
|
||||||
to = [ "adguard" ];
|
to = [ "adguard" ];
|
||||||
allowedUDPPorts = [ 53 ];
|
allowedUDPPorts = [ 53 ];
|
||||||
|
|
|
@ -1,15 +0,0 @@
|
||||||
age-encryption.org/v1
|
|
||||||
-> X25519 DnkfavonwcikVjuIH3aQTxh9+U+Vr6se2PPdjCL68iw
|
|
||||||
qcfI8Rz+8fLqePoqk4XEY0vQyH2+eZtE3c/lrei9OWo
|
|
||||||
-> piv-p256 ZFgiIw AzKnjNFccsLZSS6EipE+gqoMzjj5Q//OMpAxrPFVHzPW
|
|
||||||
VphyHLTFEc7nsPfETAi/4VLg+mXb6B2qgTikgn1SyJI
|
|
||||||
-> piv-p256 XTQkUA A6mFKlj6AYBxwe+p3Yn57Re5e4Ihk42qNCbwFXDVLsV2
|
|
||||||
YogIWza1sZGXOOeZVVD2fcShAG00QQosLlHntBK+UeI
|
|
||||||
-> piv-p256 ZFgiIw A2dlENHarOIr4e3ZikrRYeWZI1N4NKwzWuIB4+Vuq96a
|
|
||||||
55zk9XyUEGwwnxxGFyfia8YVF9Sjj7KFut03YrH6+Zc
|
|
||||||
-> piv-p256 5vmPtQ Aq81XRMh1/reZhBMQIGd7C+sOEG1pKSTJbdEAmkPoP17
|
|
||||||
WCzUWz3HDZIIrqMuypxkZMqzoggCmaSPrXNdmNMntHY
|
|
||||||
-> &1koE-grease
|
|
||||||
dqDfmnpD0sarnFxWDlpn5p3AMIWMPz58V0pJ5Lu2mXAIjEqPimCW/Q
|
|
||||||
--- UA2bf9I/vCa+Zn6zRM6V7OeHS69Drwes8V0UexK+SBU
|
|
||||||
‰5ÃPg÷µKD¸Š &éÁòö£ûïß@ÖuZ<75>¢ú?J$fÄšºëšZC¤ÑÉ‹9ùL
R£òã„”Ìxb¹'ù…cMC:ÆJ’²–GÎ~!M(÷
|
|
|
@ -1,5 +1,11 @@
|
||||||
{ config, lib, ... }:
|
|
||||||
{
|
{
|
||||||
|
config,
|
||||||
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
|
||||||
disko.devices = {
|
disko.devices = {
|
||||||
disk = {
|
disk = {
|
||||||
m2-ssd = rec {
|
m2-ssd = rec {
|
||||||
|
@ -27,4 +33,31 @@
|
||||||
};
|
};
|
||||||
fileSystems."/state".neededForBoot = true;
|
fileSystems."/state".neededForBoot = true;
|
||||||
fileSystems."/persist".neededForBoot = true;
|
fileSystems."/persist".neededForBoot = true;
|
||||||
|
|
||||||
|
boot.initrd.systemd.extraBin = {
|
||||||
|
jq = lib.getExe pkgs.jq;
|
||||||
|
};
|
||||||
|
# In ermergency shell type:
|
||||||
|
# ´systemctl disable check-pcrs´
|
||||||
|
# ´systemctl default´
|
||||||
|
# to continue booting
|
||||||
|
boot.initrd.systemd.services.check-pcrs = {
|
||||||
|
script = ''
|
||||||
|
echo "Checking PCRS tag: ctiectie"
|
||||||
|
if [[ $(systemd-analyze pcrs 15 --json=short | jq -r ".[0].sha256") != "a8cfdc8ec869f9edf4635129ba6bb19a076a5d234655cf4684286dc57e325a38" ]] ; then
|
||||||
|
echo "PCR 15 contains invalid hash"
|
||||||
|
exit 1
|
||||||
|
else
|
||||||
|
echo "PCR 15 checked"
|
||||||
|
fi
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
};
|
||||||
|
unitConfig.DefaultDependencies = "no";
|
||||||
|
after = [ "cryptsetup.target" ];
|
||||||
|
before = [ "sysroot.mount" ];
|
||||||
|
requiredBy = [ "sysroot.mount" ];
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|
13
modules/ensure-pcr.nix
Normal file
13
modules/ensure-pcr.nix
Normal file
|
@ -0,0 +1,13 @@
|
||||||
|
{ lib, ... }:
|
||||||
|
{
|
||||||
|
options.boot.initrd.luks.devices = lib.mkOption {
|
||||||
|
type =
|
||||||
|
with lib.types;
|
||||||
|
attrsOf (submodule {
|
||||||
|
config.crypttabExtraOpts = [
|
||||||
|
"tpm2-device=auto"
|
||||||
|
"tpm2-measure-pcr=yes"
|
||||||
|
];
|
||||||
|
});
|
||||||
|
};
|
||||||
|
}
|
20
patches/PR/373200.diff
Normal file
20
patches/PR/373200.diff
Normal file
|
@ -0,0 +1,20 @@
|
||||||
|
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix
|
||||||
|
index 1ae70654dea4c..b021292f9b3c0 100644
|
||||||
|
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix
|
||||||
|
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix
|
||||||
|
@@ -6,13 +6,13 @@
|
||||||
|
|
||||||
|
stdenv.mkDerivation rec {
|
||||||
|
pname = "weather-card";
|
||||||
|
- version = "1.5.0";
|
||||||
|
+ version = "2.0.0b0";
|
||||||
|
|
||||||
|
src = fetchFromGitHub {
|
||||||
|
owner = "bramkragten";
|
||||||
|
repo = "weather-card";
|
||||||
|
tag = "v${version}";
|
||||||
|
- hash = "sha256-pod5cayaHP+4vgdBgBRMQ7szkyz9HLaKVJWQX36XdTY=";
|
||||||
|
+ hash = "sha256-139OhAHxulXovyywBuz552lmDqoV7aLHKKNb81dOKDo=";
|
||||||
|
};
|
||||||
|
dontBuild = true;
|
||||||
|
installPhase = ''
|
|
@ -44,7 +44,10 @@
|
||||||
};
|
};
|
||||||
signature.enabled = true;
|
signature.enabled = true;
|
||||||
completion = {
|
completion = {
|
||||||
list.selection = "auto_insert";
|
list.selection = {
|
||||||
|
preselect = true;
|
||||||
|
auto_insert = true;
|
||||||
|
};
|
||||||
# menu = {
|
# menu = {
|
||||||
# border = "none";
|
# border = "none";
|
||||||
# draw = {
|
# draw = {
|
||||||
|
|
Loading…
Reference in a new issue