patrick/nix-config
1
1
Fork 0
Code Issues Pull requests Projects Wiki Activity

Compare commits

base: patrick:69971151ef6ed2f46942b7155aeaf363aabb25f2
Branches Tags
patrick:master
..
compare: patrick:244e930b218680e44d6c3fe7cf3903bc70b9f150
Branches Tags
patrick:master

5 commits
69971151ef ... 244e930b21

Author SHA1 Message Date
Patrick 244e930b21
feat: measure pcr 15 2025-01-14 22:20:08 +01:00
Patrick b56559ce21
fix: blink cmp 2025-01-14 22:19:52 +01:00
Patrick e15f7aaf4d
feat: allow smb access from fritz-vlan 2025-01-14 22:19:27 +01:00
Patrick 1b983b62d1
feat: tasmota with hme assistant 2025-01-13 21:28:06 +01:00
Patrick 493f6d08d4
update 2025-01-12 22:11:22 +01:00
13 changed files with 207 additions and 116 deletions
Show stats Expand all files Collapse all files

1
config/basic/default.nix
View file

@ -20,6 +20,7 @@
../../modules/deterministic-ids.nix ../../modules/deterministic-ids.nix
../../modules/distributed-config.nix ../../modules/distributed-config.nix
../../modules/ensure-pcr.nix
../../modules/globals.nix ../../modules/globals.nix
../../modules/meta.nix ../../modules/meta.nix
../../modules/iwd.nix ../../modules/iwd.nix

4
config/services/adguardhome.nix
View file

@ -41,8 +41,8 @@
]; ];
}; };
user_rules = [ user_rules = [
"||homematic.internal^$dnsrewrite=${lib.net.cidr.host 30 globals.net.vlans.devices.cidrv4}" # "||homematic.internal^$dnsrewrite=${lib.net.cidr.host 30 globals.net.vlans.devices.cidrv4}"
"||testberry.internal^$dnsrewrite=${lib.net.cidr.host 31 globals.net.vlans.devices.cidrv4}" # "||testberry.internal^$dnsrewrite=${lib.net.cidr.host 31 globals.net.vlans.devices.cidrv4}"
"||smb.internal^$dnsrewrite=${lib.net.cidr.host globals.services.samba.ip globals.net.vlans.home.cidrv4}" "||smb.internal^$dnsrewrite=${lib.net.cidr.host globals.services.samba.ip globals.net.vlans.home.cidrv4}"
"||${globals.domains.web}^$dnsrewrite=${lib.net.cidr.host 1 globals.net.vlans.services.cidrv4}" "||${globals.domains.web}^$dnsrewrite=${lib.net.cidr.host 1 globals.net.vlans.services.cidrv4}"
"@@||${globals.services.vaultwarden.domain}" "@@||${globals.services.vaultwarden.domain}"

42
config/services/homeassistant.nix
View file

@ -36,8 +36,17 @@
]; ];
}; };
networking.nftables.firewall.zones.devices.interfaces = [ "mv-devices" ]; networking.nftables.firewall.zones.devices.interfaces = [ "mv-devices" ];
networking.nftables.firewall.zones.iot.interfaces = [ "mv-iot" ];
networking.nftables.firewall = { networking.nftables.firewall = {
rules = { rules = {
mqtt = {
from = [
"devices"
"iot"
];
to = [ "local" ];
allowedTCPPorts = [ 1883 ];
};
homematic = { homematic = {
from = [ from = [
"devices" "devices"
@ -45,8 +54,38 @@
to = [ "local" ]; to = [ "local" ];
allowedTCPPorts = [ 45053 ]; allowedTCPPorts = [ 45053 ];
}; };
mdns = {
from = [
"devices"
"iot"
];
to = [ "local" ];
allowedUDPPorts = [ 5353 ];
};
}; };
}; };
age.secrets.mosquitto-pw-home_assistant = {
mode = "440";
owner = "hass";
group = "mosquitto";
generator.script = "alnum";
};
services.mosquitto = {
enable = true;
persistence = true;
listeners = [
{
acl = [ "pattern readwrite #" ];
users = {
home_assistant = {
passwordFile = config.age.secrets.mosquitto-pw-home_assistant.path;
acl = [ "readwrite #" ];
};
};
settings.allow_anonymous = false;
}
];
};
services.home-assistant = { services.home-assistant = {
enable = true; enable = true;
@ -77,6 +116,8 @@
mushroom mushroom
multiple-entity-row multiple-entity-row
button-card button-card
weather-chart-card
hourly-weather
]; ];
config = { config = {
http = { http = {
@ -390,6 +431,7 @@
stringcase stringcase
hahomematic hahomematic
pymodbus pymodbus
hatasmota
]; ];
}; };
networking.hosts = { networking.hosts = {

138
flake.lock
View file

@ -36,11 +36,11 @@
"treefmt-nix": "treefmt-nix" "treefmt-nix": "treefmt-nix"
}, },
"locked": { "locked": {
"lastModified": 1735993832, "lastModified": 1736429053,
"narHash": "sha256-gmleUygegZHWfyzgLUSgj9rVe2iUCoAUB0iUkKzQYN4=", "narHash": "sha256-luGqUO7XJKGMO65+xD2xWxr4bsHWATbdFo6JUQIEzrI=",
"owner": "oddlama", "owner": "oddlama",
"repo": "agenix-rekey", "repo": "agenix-rekey",
"rev": "57e286831e3581800178b310c0110c244f2e2469", "rev": "8cd512cc5324de73de9bd47d85c15afb4fee3d9c",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -399,11 +399,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1735468753, "lastModified": 1736591904,
"narHash": "sha256-2dt1nOe9zf9pDkf5Kn7FUFyPRo581s0n90jxYXJ94l0=", "narHash": "sha256-LFO8pSrPKrH8OPq2HaAuBG5skk8/MNJ/9YmK3KsnSks=",
"owner": "nix-community", "owner": "nix-community",
"repo": "disko", "repo": "disko",
"rev": "84a5b93637cc16cbfcc61b6e1684d626df61eb21", "rev": "33827d2bd16bfe2e21b62956526c72d313595dfd",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -747,11 +747,11 @@
"nixpkgs-lib": "nixpkgs-lib" "nixpkgs-lib": "nixpkgs-lib"
}, },
"locked": { "locked": {
"lastModified": 1735774679, "lastModified": 1736143030,
"narHash": "sha256-soePLBazJk0qQdDVhdbM98vYdssfs3WFedcq+raipRI=", "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
"owner": "hercules-ci", "owner": "hercules-ci",
"repo": "flake-parts", "repo": "flake-parts",
"rev": "f2f7418ce0ab4a5309a4596161d154cfc877af66", "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -844,11 +844,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1722555600, "lastModified": 1736143030,
"narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=", "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
"owner": "hercules-ci", "owner": "hercules-ci",
"repo": "flake-parts", "repo": "flake-parts",
"rev": "8471fe90ad337a8074e957b69ca4d0089218391d", "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -865,11 +865,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1735774679, "lastModified": 1736143030,
"narHash": "sha256-soePLBazJk0qQdDVhdbM98vYdssfs3WFedcq+raipRI=", "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
"owner": "hercules-ci", "owner": "hercules-ci",
"repo": "flake-parts", "repo": "flake-parts",
"rev": "f2f7418ce0ab4a5309a4596161d154cfc877af66", "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1252,11 +1252,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1736066484, "lastModified": 1736508663,
"narHash": "sha256-uTstP36WaFrw+TEHb8nLF14hFPzQBOhmIxzioHCDaL8=", "narHash": "sha256-ZOaGwa+WnB7Zn3YXimqjmIugAnHePdXCmNu+AHkq808=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "5ad12b6ea06b84e48f6b677957c74f32d47bdee0", "rev": "2532b500c3ed2b8940e831039dcec5a5ea093afc",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1273,11 +1273,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1735979091, "lastModified": 1736508663,
"narHash": "sha256-WpFjt6+8UD81EP386c269ZTqpEmlGJgcPw+OB4b7EBs=", "narHash": "sha256-ZOaGwa+WnB7Zn3YXimqjmIugAnHePdXCmNu+AHkq808=",
"owner": "nix-community", "owner": "nix-community",
"repo": "home-manager", "repo": "home-manager",
"rev": "11ab08541e61ac3bbf2ab27229f68622629401df", "rev": "2532b500c3ed2b8940e831039dcec5a5ea093afc",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1334,11 +1334,11 @@
}, },
"impermanence": { "impermanence": {
"locked": { "locked": {
"lastModified": 1734945620, "lastModified": 1736688610,
"narHash": "sha256-olIfsfJK4/GFmPH8mXMmBDAkzVQ1TWJmeGT3wBGfQPY=", "narHash": "sha256-1Zl9xahw399UiZSJ9Vxs1W4WRFjO1SsNdVZQD4nghz0=",
"owner": "nix-community", "owner": "nix-community",
"repo": "impermanence", "repo": "impermanence",
"rev": "d000479f4f41390ff7cf9204979660ad5dd16176", "rev": "c64bed13b562fc3bb454b48773d4155023ac31b7",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1406,11 +1406,11 @@
"nixpkgs-lib": "nixpkgs-lib_5" "nixpkgs-lib": "nixpkgs-lib_5"
}, },
"locked": { "locked": {
"lastModified": 1736079376, "lastModified": 1736684024,
"narHash": "sha256-DE/PZoasUoex2Y/y2MnHklCXzGoVlHyMLXB56DHl7fY=", "narHash": "sha256-FYJ4iFD/2L1CFN/aHjI8HxxSxuPNy4OvW+VCBh41Lzk=",
"owner": "nix-community", "owner": "nix-community",
"repo": "lib-aggregate", "repo": "lib-aggregate",
"rev": "ef3ee8050d86486c0f380ddd479370ad33cf83fb", "rev": "917882a0186d7731a61ede986c701e272f744750",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1464,11 +1464,11 @@
"spectrum": "spectrum" "spectrum": "spectrum"
}, },
"locked": { "locked": {
"lastModified": 1735074045, "lastModified": 1736637237,
"narHash": "sha256-CeYsC8J2dNiV2FCQOxK1oZ/jNpOF2io7aCEFHmfi95U=", "narHash": "sha256-kZELEfQDEbCljZUpmIw0G0tNNdcJlnLvc6bwKQ++Okw=",
"owner": "astro", "owner": "astro",
"repo": "microvm.nix", "repo": "microvm.nix",
"rev": "2ae08de8e8068b00193b9cfbc0acc9dfdda03181", "rev": "6f7e4a7bfcdce1c703f9cb89ae9d634167b720b8",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1608,11 +1608,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1735956190, "lastModified": 1736370755,
"narHash": "sha256-svzx3yVXD5tbBJZCn3Lt1RriH8GHo6CyVUPTHejf7sU=", "narHash": "sha256-iWcjToBpx4PUd74uqvIGAfqqVfyrvRLRauC/SxEKIF0=",
"owner": "lnl7", "owner": "lnl7",
"repo": "nix-darwin", "repo": "nix-darwin",
"rev": "3feaf376d75d3d58ebf7e9a4f584d00628548ad9", "rev": "57733bd1dc81900e13438e5b4439239f1b29db0e",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1629,11 +1629,11 @@
"treefmt-nix": "treefmt-nix_5" "treefmt-nix": "treefmt-nix_5"
}, },
"locked": { "locked": {
"lastModified": 1733909753, "lastModified": 1736194844,
"narHash": "sha256-5GChR6LKh6EwGXLfR3HLW2Z0AWoyce4Hyp3VB5C4FCk=", "narHash": "sha256-CXtD5xUKb92EjL9RrsGQ9jgnl0aIoGEPwnJ805d3Xz0=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nix-eval-jobs", "repo": "nix-eval-jobs",
"rev": "b1f94fed4af8e7f30665a3bf8b369dc3b8a95884", "rev": "cbae9154bc76c5aa7873f0a67b3c9f13124929d3",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1671,11 +1671,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1736047960, "lastModified": 1736652904,
"narHash": "sha256-hutd85FA1jUJhhqBRRJ+u7UHO9oFGD/RVm2x5w8WjVQ=", "narHash": "sha256-8uolHABgroXqzs03QdulHp8H9e5kWQZnnhcda1MKbBM=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nix-index-database", "repo": "nix-index-database",
"rev": "816a6ae88774ba7e74314830546c29e134e0dffb", "rev": "271e5bd7c57e1f001693799518b10a02d1123b12",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1692,11 +1692,11 @@
"pre-commit-hooks": "pre-commit-hooks_4" "pre-commit-hooks": "pre-commit-hooks_4"
}, },
"locked": { "locked": {
"lastModified": 1735927098, "lastModified": 1736111688,
"narHash": "sha256-bRAtYb+o9/kFrUDZt5pFD0ET+rG0g5nYM0qNKaRiv2g=", "narHash": "sha256-5z1ZgHgrr1qI0ve+mc0SjbL5PGbDLZb/3uijpmLIWT8=",
"owner": "oddlama", "owner": "oddlama",
"repo": "nix-topology", "repo": "nix-topology",
"rev": "2113ac865a077a7487268d6f1fe27400271ecd19", "rev": "ac1aa5116d858fdff131625dde59a988f74efb11",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1767,11 +1767,11 @@
}, },
"nixos-hardware": { "nixos-hardware": {
"locked": { "locked": {
"lastModified": 1735388221, "lastModified": 1736441705,
"narHash": "sha256-e5IOgjQf0SZcFCEV/gMGrsI0gCJyqOKShBQU0iiM3Kg=", "narHash": "sha256-OL7leZ6KBhcDF3nEKe4aZVfIm6xQpb1Kb+mxySIP93o=",
"owner": "nixos", "owner": "nixos",
"repo": "nixos-hardware", "repo": "nixos-hardware",
"rev": "7c674c6734f61157e321db595dbfcd8523e04e19", "rev": "8870dcaff63dfc6647fb10648b827e9d40b0a337",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -1890,11 +1890,11 @@
}, },
"nixpkgs-lib_5": { "nixpkgs-lib_5": {
"locked": { "locked": {
"lastModified": 1736039079, "lastModified": 1736643958,
"narHash": "sha256-ONaTdkME8AJMoQjkydnlUNrzQrIWIdeprkRKW0V1UIE=", "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixpkgs.lib", "repo": "nixpkgs.lib",
"rev": "e506b7786d099e0dec40e1204c555e3562ee9bf8", "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -2009,11 +2009,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1736082492, "lastModified": 1736685270,
"narHash": "sha256-f+w2ZAMRtnXW2pEC5q3+Eh5J0PEtsMWqAmjW6pOJpCw=", "narHash": "sha256-Zp2n4OoCsvjxS18u8Qsu3PF8R+IhhOEfrokgZmxOwrY=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixpkgs-wayland", "repo": "nixpkgs-wayland",
"rev": "7595aa1a3153be4c7aea30c0982f53230088012c", "rev": "2cb439411d17eb145a99536196f5ab11685268b8",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -2024,11 +2024,11 @@
}, },
"nixpkgs_10": { "nixpkgs_10": {
"locked": { "locked": {
"lastModified": 1735834308, "lastModified": 1736523798,
"narHash": "sha256-dklw3AXr3OGO4/XT1Tu3Xz9n/we8GctZZ75ZWVqAVhk=", "narHash": "sha256-Xb8mke6UCYjge9kPR9o4P1nVrhk7QBbKv3xQ9cj7h2s=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "6df24922a1400241dae323af55f30e4318a6ca65", "rev": "130595eba61081acde9001f43de3248d8888ac4a",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -2040,11 +2040,11 @@
}, },
"nixpkgs_11": { "nixpkgs_11": {
"locked": { "locked": {
"lastModified": 1732238832, "lastModified": 1736042175,
"narHash": "sha256-sQxuJm8rHY20xq6Ah+GwIUkF95tWjGRd1X8xF+Pkk38=", "narHash": "sha256-jdd5UWtLVrNEW8K6u5sy5upNAFmF3S4Y+OIeToqJ1X8=",
"owner": "NixOS", "owner": "NixOS",
"repo": "nixpkgs", "repo": "nixpkgs",
"rev": "8edf06bea5bcbee082df1b7369ff973b91618b8d", "rev": "bf689c40d035239a489de5997a4da5352434632e",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -2213,11 +2213,11 @@
"treefmt-nix": "treefmt-nix_6" "treefmt-nix": "treefmt-nix_6"
}, },
"locked": { "locked": {
"lastModified": 1736025907, "lastModified": 1736598781,
"narHash": "sha256-OopQbnOMP5YCl2aVEQQmPeze8wDmofZjzU6URCFEPQU=", "narHash": "sha256-Y0o9ahm6Kk0DumTo80/vKspkHOkbtFgKCNiICyRjhMs=",
"owner": "nix-community", "owner": "nix-community",
"repo": "nixvim", "repo": "nixvim",
"rev": "e07a482fd86eed90fd9378b97a2f938f07da1499", "rev": "2fc2132a78753fc3d7ec732044eff7ad69530055",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -2848,11 +2848,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1736050526, "lastModified": 1736655351,
"narHash": "sha256-wscvKDsyIES59ltENnOw7Hz8WKU8hg5m7dYbcJN2u6A=", "narHash": "sha256-+kAbUaJxCwKAxFvn3WL8dbzxoPaV+WKP4RG0R4JI4rY=",
"owner": "Gerg-l", "owner": "Gerg-l",
"repo": "spicetify-nix", "repo": "spicetify-nix",
"rev": "78c9ace8b9e1d7b64b4d797a066047c2332d24f6", "rev": "749a821c86fb61be668d7583761f432f21772306",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -3200,11 +3200,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1723303070, "lastModified": 1736154270,
"narHash": "sha256-krGNVA30yptyRonohQ+i9cnK+CfCpedg6z3qzqVJcTs=", "narHash": "sha256-p2r8xhQZ3TYIEKBoiEhllKWQqWNJNoT9v64Vmg4q8Zw=",
"owner": "numtide", "owner": "numtide",
"repo": "treefmt-nix", "repo": "treefmt-nix",
"rev": "14c092e0326de759e16b37535161b3cb9770cea3", "rev": "13c913f5deb3a5c08bb810efd89dc8cb24dd968b",
"type": "github" "type": "github"
}, },
"original": { "original": {
@ -3221,11 +3221,11 @@
] ]
}, },
"locked": { "locked": {
"lastModified": 1735905407, "lastModified": 1736154270,
"narHash": "sha256-1hKMRIT+QZNWX46e4gIovoQ7H8QRb7803ZH4qSKI45o=", "narHash": "sha256-p2r8xhQZ3TYIEKBoiEhllKWQqWNJNoT9v64Vmg4q8Zw=",
"owner": "numtide", "owner": "numtide",
"repo": "treefmt-nix", "repo": "treefmt-nix",
"rev": "29806abab803e498df96d82dd6f34b32eb8dd2c8", "rev": "13c913f5deb3a5c08bb810efd89dc8cb24dd968b",
"type": "github" "type": "github"
}, },
"original": { "original": {

8
hosts/desktopnix/fs.nix
View file

@ -65,4 +65,12 @@
}; };
}; };
}; };
boot.initrd.luks.devices.rpool_m2-ssd.crypttabExtraOpts = [
"tpm2-device=auto"
"tpm2-measure-pcr=yes"
];
boot.initrd.luks.devices.panzer_sata-hdd.crypttabExtraOpts = [
"tpm2-device=auto"
"tpm2-measure-pcr=yes"
];
} }

BIN
hosts/elisabeth/secrets/homeassistant/generated/mosquitto-pw-home_assistant.age Normal file
View file

Binary file not shown.

39
hosts/nucnix/hostapd.nix
View file

@ -15,9 +15,6 @@
homeWlan = { homeWlan = {
generator.script = "alnum"; generator.script = "alnum";
}; };
guestWlan = {
generator.script = "alnum";
};
iotWlan = { iotWlan = {
generator.script = "alnum"; generator.script = "alnum";
}; };
@ -65,36 +62,22 @@
networks.wlan01 = { networks.wlan01 = {
inherit (globals.hostapd) ssid; inherit (globals.hostapd) ssid;
apIsolate = true; apIsolate = true;
# not supporte by laptop :( #logLevel = 0;
# settings.ieee80211w = 0;
logLevel = 0;
settings = { settings = {
vlan_file = "${pkgs.writeText "hostaps.vlans" '' bridge = "br-iot";
10 wifi-home br-home
40 wifi-iot br-iot
50 wifi-guests br-guests
''}";
dynamic_vlan = 1;
}; };
authentication = { authentication = {
saePasswords = [ mode = "wpa2-sha1";
{ wpaPasswordFile = config.age.secrets.iotWlan.path;
passwordFile = config.age.secrets.homeWlan.path; # saePasswords = [
vlanid = 10; # {
} # passwordFile = config.age.secrets.iotWlan.path;
{ # }
passwordFile = config.age.secrets.iotWlan.path; # ];
vlanid = 40;
}
{
passwordFile = config.age.secrets.guestWlan.path;
vlanid = 50;
}
];
pairwiseCiphers = [ pairwiseCiphers = [
"CCMP" "CCMP"
"GCMP" # "GCMP"
"GCMP-256" # "GCMP-256"
]; ];
#enableRecommendedPairwiseCiphers = true; #enableRecommendedPairwiseCiphers = true;
}; };

3
hosts/nucnix/net.nix
View file

@ -171,6 +171,7 @@ in
printer-smb = { printer-smb = {
from = [ from = [
"printer" "printer"
"fritz"
]; ];
to = [ "smb" ]; to = [ "smb" ];
allowedTCPPorts = [ 445 ]; allowedTCPPorts = [ 445 ];
@ -200,8 +201,10 @@ in
from = [ from = [
"home" "home"
"devices" "devices"
"fritz"
"guests" "guests"
"services" "services"
"fritz"
]; ];
to = [ "adguard" ]; to = [ "adguard" ];
allowedUDPPorts = [ 53 ]; allowedUDPPorts = [ 53 ];

15
hosts/nucnix/secrets/generated/guestWlan.age
View file

@ -1,15 +0,0 @@
age-encryption.org/v1
-> X25519 DnkfavonwcikVjuIH3aQTxh9+U+Vr6se2PPdjCL68iw
qcfI8Rz+8fLqePoqk4XEY0vQyH2+eZtE3c/lrei9OWo
-> piv-p256 ZFgiIw AzKnjNFccsLZSS6EipE+gqoMzjj5Q//OMpAxrPFVHzPW
VphyHLTFEc7nsPfETAi/4VLg+mXb6B2qgTikgn1SyJI
-> piv-p256 XTQkUA A6mFKlj6AYBxwe+p3Yn57Re5e4Ihk42qNCbwFXDVLsV2
YogIWza1sZGXOOeZVVD2fcShAG00QQosLlHntBK+UeI
-> piv-p256 ZFgiIw A2dlENHarOIr4e3ZikrRYeWZI1N4NKwzWuIB4+Vuq96a
55zk9XyUEGwwnxxGFyfia8YVF9Sjj7KFut03YrH6+Zc
-> piv-p256 5vmPtQ Aq81XRMh1/reZhBMQIGd7C+sOEG1pKSTJbdEAmkPoP17
WCzUWz3HDZIIrqMuypxkZMqzoggCmaSPrXNdmNMntHY
-> &1koE-grease
dqDfmnpD0sarnFxWDlpn5p3AMIWMPz58V0pJ5Lu2mXAIjEqPimCW/Q
--- UA2bf9I/vCa+Zn6zRM6V7OeHS69Drwes8V0UexK+SBU
‰5ÃPg÷µKD¸Š &éÁòö£ûïß@­ÖuZ<75>¢ú?J$fÄšºëšZC¤ÑÉ‹9ùL R£òã„”Ìxb¹'ù…cMC:ÆJ’²–GÎ~!M(÷

35
hosts/patricknix/fs.nix
View file

@ -1,5 +1,11 @@
{ config, lib, ... }:
{ {
config,
lib,
pkgs,
...
}:
{
disko.devices = { disko.devices = {
disk = { disk = {
m2-ssd = rec { m2-ssd = rec {
@ -27,4 +33,31 @@
}; };
fileSystems."/state".neededForBoot = true; fileSystems."/state".neededForBoot = true;
fileSystems."/persist".neededForBoot = true; fileSystems."/persist".neededForBoot = true;
boot.initrd.systemd.extraBin = {
jq = lib.getExe pkgs.jq;
};
# In ermergency shell type:
# ´systemctl disable check-pcrs´
# ´systemctl default´
# to continue booting
boot.initrd.systemd.services.check-pcrs = {
script = ''
echo "Checking PCRS tag: ctiectie"
if [[ $(systemd-analyze pcrs 15 --json=short | jq -r ".[0].sha256") != "a8cfdc8ec869f9edf4635129ba6bb19a076a5d234655cf4684286dc57e325a38" ]] ; then
echo "PCR 15 contains invalid hash"
exit 1
else
echo "PCR 15 checked"
fi
'';
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
};
unitConfig.DefaultDependencies = "no";
after = [ "cryptsetup.target" ];
before = [ "sysroot.mount" ];
requiredBy = [ "sysroot.mount" ];
};
} }

13
modules/ensure-pcr.nix Normal file
View file

@ -0,0 +1,13 @@
{ lib, ... }:
{
options.boot.initrd.luks.devices = lib.mkOption {
type =
with lib.types;
attrsOf (submodule {
config.crypttabExtraOpts = [
"tpm2-device=auto"
"tpm2-measure-pcr=yes"
];
});
};
}

20
patches/PR/373200.diff Normal file
View file

@ -0,0 +1,20 @@
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix
index 1ae70654dea4c..b021292f9b3c0 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-card/package.nix
@@ -6,13 +6,13 @@
stdenv.mkDerivation rec {
pname = "weather-card";
- version = "1.5.0";
+ version = "2.0.0b0";
src = fetchFromGitHub {
owner = "bramkragten";
repo = "weather-card";
tag = "v${version}";
- hash = "sha256-pod5cayaHP+4vgdBgBRMQ7szkyz9HLaKVJWQX36XdTY=";
+ hash = "sha256-139OhAHxulXovyywBuz552lmDqoV7aLHKKNb81dOKDo=";
};
dontBuild = true;
installPhase = ''

5
users/patrick/programs/nvim/plugins/cmp.nix
View file

@ -44,7 +44,10 @@
}; };
signature.enabled = true; signature.enabled = true;
completion = { completion = {
list.selection = "auto_insert"; list.selection = {
preselect = true;
auto_insert = true;
};
# menu = { # menu = {
# border = "none"; # border = "none";
# draw = { # draw = {