DuN0z/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CLEAN: nix develop

Browse source
This commit is contained in:
DuN0z 2025-10-05 08:20:57 +02:00
parent daeb15f821
commit c495445e91
22 changed files with 439 additions and 423 deletions
Download patch file Download diff file Expand all files Collapse all files

23
flake.nix
View file

@ -22,24 +22,25 @@
home-manager,
nur,
...
} @ inputs: let
mkUnstablePkgsWithNur = { system, config ? {} }:
}: let
mkUnstablePkgsWithNur = {
system,
config ? {},
}:
import nixpkgs-unstable {
inherit system;
overlays = [ nur.overlays.default ];
config = config ;
overlays = [nur.overlays.default];
inherit config;
};
in
{
in {
nixosConfigurations = {
pennsardin = nixpkgs-unstable.lib.nixosSystem {
system = "x86_64-linux";
pkgs = mkUnstablePkgsWithNur {
system = "x86_64-linux";
config = {
allowUnfree = true ;
allowUnsupportedSystem = true ;
allowUnfree = true;
allowUnsupportedSystem = true;
};
};
modules = [
@ -65,12 +66,12 @@
};
};
# --- DevShell (x86_64 uniquement) ---
# --- DevShell (x86_64 uniquement) ---
devShells.x86_64-linux.default = import ./devshell.nix {
pkgs = import nixpkgs-stable {system = "x86_64-linux";};
};
# --- Formatter (x86_64 uniquement) ---
# --- Formatter (x86_64 uniquement) ---
formatter.x86_64-linux =
(import nixpkgs-stable {system = "x86_64-linux";}).alejandra;
};

18
hm/common/browser.nix
View file

@ -1,15 +1,19 @@
{pkgs, nur, ... }: {
{
pkgs,
nur,
...
}: {
programs.firefox = {
enable = true;
languagePacks = ["fr"];
profiles.default = {
settings = {
"intl.locale.requested" = "fr" ;
"intl.locale.requested" = "fr";
"intl.accept_languages" = "fr, en-US, en";
"layers.acceleration.disabled" = true ;
"gfx.webrender.all" = false ;
"privacy.trackingprotection.enabled" = true ;
"privacy.resistFingerprinting" = true ;
"layers.acceleration.disabled" = true;
"gfx.webrender.all" = false;
"privacy.trackingprotection.enabled" = true;
"privacy.resistFingerprinting" = true;
"network.cookie.cookieBehavior" = 1;
};
extensions.packages = with pkgs.nur.repos.rycee.firefox-addons; [
@ -20,6 +24,6 @@
];
};
};
}
}
# vim: set ts=2 sw=2 sts=2 et :

2
hm/common/git.nix
View file

@ -1,7 +1,7 @@
_: {
programs.git = {
enable = true;
userName = "DuN0z" ;
userName = "DuN0z";
userEmail = "dun0z@porzh.me";
};
}

119
hm/desktop/bspwm.nix
View file

@ -1,20 +1,42 @@
# hm/desktop/bspwm.nix
{ pkgs, lib, ... }:
{
pkgs,
lib,
...
}: {
imports = [
../common/browser.nix
];
home.packages = with pkgs; [
bspwm sxhkd xorg.xinit xterm alacritty rofi feh font-awesome
picom xorg.xset xidlehook betterlockscreen pywal16 imagemagick
pulsemixer ranger jq file highlight unzip mpv
bspwm
sxhkd
xorg.xinit
xterm
alacritty
rofi
feh
font-awesome
picom
xorg.xset
xidlehook
betterlockscreen
pywal16
imagemagick
pulsemixer
ranger
jq
file
highlight
unzip
mpv
protonvpn-gui
];
# Gère le ssh-agent proprement côté user
services.ssh-agent.enable = true;
xsession.enable = true;
xsession = {
enable = true;
xsession.windowManager.bspwm = {
enable = true;
@ -34,18 +56,20 @@
bspc monitor -d I II III IV V VI
'';
};
};
# xsession.initExtra = ''
# xset s 300 300
# xset s on
# xset s noblank
# xset +dpms
# xset dpms 0 0 500
# '';
# xsession.initExtra = ''
# xset s 300 300
# xset s on
# xset s noblank
# xset +dpms
# xset dpms 0 0 500
# '';
services.sxhkd = {
services = {
sxhkd = {
enable = true;
extraOptions = [ "-m" "1" ];
extraOptions = ["-m" "1"];
keybindings = {
"super + Return" = "alacritty";
"super + c" = "bspc node -c";
@ -82,25 +106,7 @@
"super + t" = "bspc node -t tiled";
};
};
# xidlehook (user service)
systemd.user.services.xidlehook = {
Unit.Description = "Idle: lock at 5min, suspend at ~8min";
Service = {
ExecStart = ''
${pkgs.xidlehook}/bin/xidlehook \
--detect-sleep \
--not-when-fullscreen \
--timer 300 "${pkgs.betterlockscreen}/bin/betterlockscreen -l dim" "" \
--timer 500 "systemctl suspend" ""
'';
Restart = "always";
};
Install.WantedBy = [ "graphical-session.target" ];
};
# polybar (config intégrée pour démarrer simple)
services.polybar = {
polybar = {
enable = true;
script = "polybar main &";
config = {
@ -133,23 +139,49 @@
};
};
};
};
# alacritty
programs.alacritty = {
# xidlehook (user service)
systemd.user.services.xidlehook = {
Unit.Description = "Idle: lock at 5min, suspend at ~8min";
Service = {
ExecStart = ''
${pkgs.xidlehook}/bin/xidlehook \
--detect-sleep \
--not-when-fullscreen \
--timer 300 "${pkgs.betterlockscreen}/bin/betterlockscreen -l dim" "" \
--timer 500 "systemctl suspend" ""
'';
Restart = "always";
};
Install.WantedBy = ["graphical-session.target"];
};
programs = {
alacritty = {
enable = true;
settings = {
general.import = [ "~/.cache/wal/colors-alacritty.toml" ];
general.import = ["~/.cache/wal/colors-alacritty.toml"];
font = {
normal = { family = lib.mkForce "Iosevka Nerd Font"; style = "Regular"; };
bold = { family = lib.mkForce "Iosevka Nerd Font"; style = "Bold"; };
italic = { family = lib.mkForce "Iosevka Nerd Font"; style = "Italic"; };
normal = {
family = lib.mkForce "Iosevka Nerd Font";
style = "Regular";
};
bold = {
family = lib.mkForce "Iosevka Nerd Font";
style = "Bold";
};
italic = {
family = lib.mkForce "Iosevka Nerd Font";
style = "Italic";
};
size = lib.mkForce 9;
};
};
};
programs.rtorrent = {
enable = true ;
rtorrent = {
enable = true;
extraConfig = ''
directory = /srv/raid
port_range = 6881-6891
@ -160,10 +192,11 @@
pieces.hash.on_completion.set = no
network.max_open_files.set = 8192
session = /home/lomig/.cache/rtorrent/session
'';
'';
};
};
home.activation.createRtorrentSessionDir = lib.hm.dag.entryAfter ["writeBoundary"] ''
mkdir -p ~/.cache/rtorrent/session
'';
}

85
hosts/forbann/configuration.nix
View file

@ -1,67 +1,70 @@
{ config, pkgs, ...}:
{
boot.loader.grub = {
enable = true ;
{pkgs, ...}: {
boot = {
kernelPackages = pkgs.linuxPackages;
initrd.supportedFilesystems = ["ext4"];
loader.grub = {
enable = true;
device = "/dev/vda";
};
fileSystems."/" = {
device = "/dev/vda1" ;
fsType = "ext4" ;
};
fileSystems."/srv" = {
device = "shared0" ;
fsType = "9p" ;
options = [ "trans=virtio" "version=9p2000.L" "rw" ];
neededForBoot = false ;
noCheck = true ;
fileSystems = {
"/" = {
device = "/dev/vda1";
fsType = "ext4";
};
systemd.services.mountShared = {
description = "Mount 9p shared folder" ;
after = [ "local-fs.target" "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot" ;
ExecStart = "${pkgs.util-linux}/bin/mount -t 9p -o trans=virtio,version=9p2000.L shared0 /srv";
RemainAfterExit = true ;
"/srv" = {
device = "shared0";
fsType = "9p";
options = ["trans=virtio" "version=9p2000.L" "rw"];
neededForBoot = false;
noCheck = true;
};
};
boot.kernelPackages = pkgs.linuxPackages ;
boot.initrd.supportedFilesystems = [ "ext4" ];
networking = {
useDHCP = true;
useNetworkd = true ;
hostName = "forbann" ;
useNetworkd = true;
hostName = "forbann";
};
systemd.network = {
enable = true ;
systemd = {
services.mountShared = {
description = "Mount 9p shared folder";
after = ["local-fs.target" "network.target"];
wantedBy = ["multi-user.target"];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.util-linux}/bin/mount -t 9p -o trans=virtio,version=9p2000.L shared0 /srv";
RemainAfterExit = true;
};
};
network = {
enable = true;
networks."10-eth0" = {
matchConfig.Name = "eth0";
networkConfig = {
Address = "192.168.1.10/24";
Gateway = "192.168.0.254" ;
DNS = "192.168.0.254" ;
Gateway = "192.168.0.254";
DNS = "192.168.0.254";
};
};
};
};
services.openssh.enable = true ;
services.rtorrent = {
enable = true ;
dataDir = "/home/vmuser/torrents" ;
services = {
openssh.enable = true;
rtorrent = {
enable = true;
dataDir = "/home/vmuser/torrents";
};
};
users.users.vmuser = {
isNormalUser = true ;
extraGroups = [ "wheel" ];
password = "changeme" ;
isNormalUser = true;
extraGroups = ["wheel"];
password = "changeme";
};
system.stateVersion = "25.05" ;
system.stateVersion = "25.05";
}

58
hosts/pennsardin/configuration.nix
View file

@ -8,34 +8,31 @@
networking.hostName = "pennsardin";
boot.kernelPackages = pkgs.linuxPackages_latest;
boot.swraid.enable = true ;
boot.swraid.enable = true;
fileSystems."/" =
{ device = "/dev/disk/by-uuid/b1a1ae71-4277-45d5-a3d2-f49354f263d4";
fileSystems = {
"/" = {
device = "/dev/disk/by-uuid/b1a1ae71-4277-45d5-a3d2-f49354f263d4";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/1DB2-7A0F";
"/boot" = {
device = "/dev/disk/by-uuid/1DB2-7A0F";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
options = ["fmask=0077" "dmask=0077"];
};
fileSystems."/proc" =
{
device = "proc" ;
fsType = "proc" ;
options = [ "defaults" "hidepid=2" ];
neededForBoot = true ;
"/proc" = {
device = "proc";
fsType = "proc";
options = ["defaults" "hidepid=2"];
neededForBoot = true;
};
fileSystems."/srv/raid" =
{ device = "/dev/disk/by-uuid/85f72160-4720-463a-9dc6-7c5216733f2b";
"/srv/raid" = {
device = "/dev/disk/by-uuid/85f72160-4720-463a-9dc6-7c5216733f2b";
fsType = "btrfs";
};
};
swapDevices = [ ];
swapDevices = [];
users.users.lomig = {
isNormalUser = true;
@ -49,27 +46,27 @@
};
networking = {
useNetworkd = true ;
firewall.allowedTCPPorts = [ 22 80 5900 5901 5902 ];
interfaces.enp11s0.useDHCP = false ;
useNetworkd = true;
firewall.allowedTCPPorts = [22 80 5900 5901 5902];
interfaces.enp11s0.useDHCP = false;
interfaces.br0 = {
useDHCP = false ;
useDHCP = false;
ipv4.addresses = [
{
address = "192.168.0.2";
prefixLength = 24 ;
prefixLength = 24;
}
];
};
defaultGateway = {
interface = "br0" ;
address = "192.168.0.254" ;
interface = "br0";
address = "192.168.0.254";
};
nameservers = [ "192.168.0.254" "1.1.1.1" ];
bridges.br0.interfaces = [ "enp11s0" ];
nameservers = ["192.168.0.254" "1.1.1.1"];
bridges.br0.interfaces = ["enp11s0"];
};
systemd.network = {
enable = true ;
enable = true;
netdevs."br0" = {
netdevConfig = {
Name = "br0";
@ -77,7 +74,7 @@
};
};
networks."br0" = {
matchConfig.Name = "br0" ;
matchConfig.Name = "br0";
};
networks."enp11s0" = {
matchConfig.Name = "enp11s0";
@ -87,6 +84,5 @@
system.stateVersion = "25.05"; # pour éviter les hurlements inutiles
}
# vim: set ts=2 sw=2 sts=2 et :

38
hosts/terre-neuvas/configuration.nix
View file

@ -1,14 +1,14 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }:
{
nix.settings.experimental-features = ["nix-command" "flakes" ];
imports =
[ # Include the results of the hardware scan.
config,
pkgs,
...
}: {
nix.settings.experimental-features = ["nix-command" "flakes"];
imports = [
# Include the results of the hardware scan.
./hardware.nix
../../profiles/server-selfhosted.nix
../../modules/services/ftp.nix
@ -32,7 +32,7 @@
users.users.lomig = {
isNormalUser = true;
extraGroups = [ "lp" "wheel" "docker" ];
extraGroups = ["lp" "wheel" "docker"];
shell = pkgs.zsh;
};
@ -49,27 +49,27 @@
hugo
];
networking = {
useNetworkd = true ;
firewall.allowedTCPPorts = [ 22 80 5900 5901 5902 ];
interfaces.eno1.useDHCP = false ;
useNetworkd = true;
firewall.allowedTCPPorts = [22 80 5900 5901 5902];
interfaces.eno1.useDHCP = false;
interfaces.br0 = {
useDHCP = false ;
useDHCP = false;
ipv4.addresses = [
{
address = "192.168.0.3";
prefixLength = 24 ;
prefixLength = 24;
}
];
};
defaultGateway = {
interface = "br0" ;
address = "192.168.0.254" ;
interface = "br0";
address = "192.168.0.254";
};
nameservers = [ "192.168.0.254" "1.1.1.1" ];
bridges.br0.interfaces = [ "eno1" ];
nameservers = ["192.168.0.254" "1.1.1.1"];
bridges.br0.interfaces = ["eno1"];
};
systemd.network = {
enable = true ;
enable = true;
netdevs."br0" = {
netdevConfig = {
Name = "br0";
@ -77,7 +77,7 @@
};
};
networks."br0" = {
matchConfig.Name = "br0" ;
matchConfig.Name = "br0";
};
networks."eno1" = {
matchConfig.Name = "eno1";

51
hosts/terre-neuvas/hardware.nix
View file

@ -1,46 +1,43 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
config,
lib,
modulesPath,
...
}: {
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = lib.mkAfter [ "kvm-intel" "tun" ];
boot.extraModulePackages = [ ];
boot = {
initrd.availableKernelModules = ["xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
initrd.kernelModules = [];
kernelModules = lib.mkAfter ["kvm-intel" "tun"];
extraModulePackages = [];
};
fileSystems."/" =
{ device = "/dev/disk/by-uuid/f37e4afb-1ee2-4f70-a93c-398461405181";
fileSystems = {
"/" = {
device = "/dev/disk/by-uuid/f37e4afb-1ee2-4f70-a93c-398461405181";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/111D-E5E8";
"/boot" = {
device = "/dev/disk/by-uuid/111D-E5E8";
fsType = "vfat";
options = [ "fmask=0077" "dmask=0077" ];
options = ["fmask=0077" "dmask=0077"];
};
fileSystems."/srv" =
{ device = "/dev/disk/by-uuid/2ef442a9-0eab-4dc5-b17c-076e18a54873";
"/srv" = {
device = "/dev/disk/by-uuid/2ef442a9-0eab-4dc5-b17c-076e18a54873";
fsType = "btrfs";
};
};
swapDevices =
[ { device = "/dev/disk/by-uuid/c3a69154-ead9-4fcc-a9b1-3b741a42ee97"; }
swapDevices = [
{device = "/dev/disk/by-uuid/c3a69154-ead9-4fcc-a9b1-3b741a42ee97";}
];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
# networking.useDHCP = lib.mkDefault true;
# networking.interfaces.eno1.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

2
modules/common/fonts.nix
View file

@ -1,4 +1,4 @@
{ pkgs, ...}: {
{pkgs, ...}: {
fonts.packages = with pkgs; [
dejavu_fonts
];

4
modules/common/networking.nix
View file

@ -1,8 +1,8 @@
_: {
networking = {
nameservers = ["1.1.1.1" "8.8.8.8"];
# dhcpcd.extraConfig = "nohook resolv.conf";
# dhcpcd.extraConfig = "nohook resolv.conf";
firewall.enable = true;
interfaces.enp11s0.wakeOnLan.enable = true ;
interfaces.enp11s0.wakeOnLan.enable = true;
};
}

4
modules/common/nix.nix
View file

@ -5,7 +5,7 @@
};
nixpkgs.config = {
# allowUnfree = true;
# allowUnsupportedSystem = true;
# allowUnfree = true;
# allowUnsupportedSystem = true;
};
}

7
modules/common/qemu.nix
View file

@ -29,14 +29,13 @@
ovmf.packages = [pkgs.OVMFFull.fd];
runAsRoot = false;
swtpm.enable = true;
} else {
}
else {
runAsRoot = false;
swtpm.enable = true;
};
};
users.users.lomig.extraGroups = ["libvirtd" "kvm" "input"];
environment.etc."qemu/bridge.conf".text = ''
@ -47,7 +46,7 @@
source = "${pkgs.qemu}/libexec/qemu-bridge-helper";
owner = "root";
group = "kvm";
setuid = true ;
setuid = true;
permissions = "u+rwx,g+rx,o+rx";
};
}

8
modules/desktop/xorg-bspwm.nix
View file

@ -1,15 +1,11 @@
{
config,
lib,
...
}: {
{lib, ...}: {
services = {
xserver = {
enable = true;
displayManager = {
lightdm.enable = true;
};
windowManager.bspwm.enable = true ;
windowManager.bspwm.enable = true;
};
displayManager = {
gdm.enable = lib.mkForce false;

4
modules/roles/workstation.nix
View file

@ -11,8 +11,8 @@
../virtual/vfio.nix
# Dev
# ../dev/qemu.nix
# ../virtual/truenas.nix # seulement si tu l’utilises sur ce host
# ../dev/qemu.nix
# ../virtual/truenas.nix # seulement si tu l’utilises sur ce host
];
environment.systemPackages = with pkgs; [

29
modules/services/forgejo.nix
View file

@ -1,6 +1,4 @@
# NixOS module Forgejo avec SQLite, SSH et reverse proxy Caddy
{ config, pkgs, lib, ... }: {
{pkgs, ...}: {
# --- Utilisateur dédié ---
users.users.git = {
isSystemUser = true;
@ -11,7 +9,8 @@
users.groups.git = {};
# --- Forgejo ---
services.forgejo = {
services = {
forgejo = {
enable = true;
user = "git";
group = "git";
@ -37,16 +36,8 @@
};
};
};
# --- Ouvrir les ports nécessaires ---
networking.firewall.allowedTCPPorts = [ 80 443 2222 ];
# --- Rediriger port SSH interne de Forgejo ---
services.openssh.enable = true;
networking.firewall.interfaces."eth0".allowedTCPPorts = [ 22 ]; # pour admin
# --- Caddy pour govel.porzh.me ---
services.caddy = {
openssh.enable = true;
caddy = {
enable = true;
virtualHosts."govel.porzh.me" = {
extraConfig = ''
@ -54,9 +45,15 @@
'';
};
};
};
# --- Ouvrir les ports nécessaires ---
networking.firewall = {
allowedTCPPorts = [80 443 2222];
interfaces."eth0".allowedTCPPorts = [22];
};
# --- Pour que Forgejo génère les bonnes URLs Git ---
# networking.hostName = "git"; # non strictement obligatoire
# networking.hostName = "git"; # non strictement obligatoire
# --- Optionnel : config DNS ---
# git.lomig.me -> ton IP publique (ou IP locale si LAN)
@ -67,6 +64,4 @@
# --- Astuce : génère une paire de clés pour l’accès SSH Git ---
# ssh-keygen -t ed25519 -f ~/.ssh/id_git_forgejo
# puis ajoute la clé publique dans ton compte Forgejo
}

10
modules/services/ftp.nix
View file

@ -1,4 +1,4 @@
{ config, pkgs, lib, ... }: {
_: {
# -------------------------------------------------
# 1️⃣ Création de l’utilisateur système dédié FTP
# -------------------------------------------------
@ -48,22 +48,20 @@
# Chroot chaque utilisateur local dans son $HOME
chrootlocalUser = true;
allowWriteableChroot = true ;
allowWriteableChroot = true;
extraConfig = ''
extraConfig = ''
pasv_min_port=40000
pasv_max_port=40004
'';
};
# -------------------------------------------------
# 4️⃣ Ouverture des ports dans le firewall NixOS
# -------------------------------------------------
networking.firewall = {
allowedTCPPorts = [ 21 40000 40001 40002 40003 40004 ];
allowedTCPPorts = [21 40000 40001 40002 40003 40004];
# Si vous utilisez FTPS implicite (port 990) :
# allowedTCPPorts = [ 21 990 40000 40001 40002 40003 40004 ];
};
}

12
modules/services/goaccess.nix
View file

@ -1,9 +1,9 @@
{ pkgs, ... }: {
{pkgs, ...}: {
environment.systemPackages = with pkgs; [
goaccess
];
# Service pour générer le rapport statique GoAccess
# Service pour générer le rapport statique GoAccess
systemd.services.goaccess-report = {
description = "Generate GoAccess HTML report";
serviceConfig = {
@ -11,10 +11,10 @@
};
};
# Timer pour régénérer le rapport toutes les heures
# Timer pour régénérer le rapport toutes les heures
systemd.timers.goaccess-report = {
description = "Hourly GoAccess report generation";
wantedBy = [ "timers.target" ];
wantedBy = ["timers.target"];
timerConfig = {
OnCalendar = "hourly";
Persistent = true;
@ -32,6 +32,4 @@
};
};
};
}
}

2
modules/services/pihole.nix
View file

@ -19,6 +19,6 @@
"/srv/pihole/etc-pihole:/etc/pihole"
"/srv/pihole/etc-dnsmasq.d:/etc/dnsmasq.d"
];
extraOptions = [ "--cap-add=NET_ADMIN" ];
extraOptions = ["--cap-add=NET_ADMIN"];
};
}

47
modules/sites/levr.porzh.me.nix
View file

@ -1,28 +1,27 @@
{ config, pkgs, ... }:
{
# -----------------------------------------------------------------
# 1️⃣ Caddy (reverse‑proxy / serveur web statique)
# -----------------------------------------------------------------
_: {
# -----------------------------------------------------------------
# 1️⃣ Caddy (reverse‑proxy / serveur web statique)
# -----------------------------------------------------------------
services.caddy = {
enable = true;
# Caddy démarre en tant qu’utilisateur « caddy ».
# On lui donne accès au répertoire du blog via les ACL créées plus haut.
# (Pas besoin de config supplémentaire côté OS.)
# Caddy démarre en tant qu’utilisateur « caddy ».
# On lui donne accès au répertoire du blog via les ACL créées plus haut.
# (Pas besoin de config supplémentaire côté OS.)
# -----------------------------------------------------------------
# 2️⃣ Sites gérés par Caddy (Caddyfile intégré)
# -----------------------------------------------------------------
# -----------------------------------------------------------------
# 2️⃣ Sites gérés par Caddy (Caddyfile intégré)
# -----------------------------------------------------------------
virtualHosts = {
"levr.porzh.me" = {
# Le domaine sera automatiquement provisionné avec TLS via ACME
# (Let's Encrypt) grâce à l’option `autoHTTPS = true` (défaut).
# Aucun certificat manuel n’est requis.
# Le domaine sera automatiquement provisionné avec TLS via ACME
# (Let's Encrypt) grâce à l’option `autoHTTPS = true` (défaut).
# Aucun certificat manuel n’est requis.
# Le répertoire contenant les fichiers générés par Hugo
# Le répertoire contenant les fichiers générés par Hugo
# (Optionnel) Rediriger HTTP → HTTPS – Caddy le fait déjà,
# mais on le rend explicite pour la clarté.
# (Optionnel) Rediriger HTTP → HTTPS – Caddy le fait déjà,
# mais on le rend explicite pour la clarté.
extraConfig = ''
@http {
protocol http
@ -39,11 +38,11 @@
};
};
# -----------------------------------------------------------------
# 3️⃣ Ouverture du firewall (ports 80 et 443)
# -----------------------------------------------------------------
# networking.firewall.allowedTCPPorts = [
# 80 # HTTP (pour la redirection ACME)
# 443 # HTTPS (site final)
# ];
# -----------------------------------------------------------------
# 3️⃣ Ouverture du firewall (ports 80 et 443)
# -----------------------------------------------------------------
# networking.firewall.allowedTCPPorts = [
# 80 # HTTP (pour la redirection ACME)
# 443 # HTTPS (site final)
# ];
}

7
modules/sites/porzh.me.nix
View file

@ -1,6 +1,4 @@
{ config, pkgs, ... }:
let
{pkgs, ...}: let
porzhSite = pkgs.stdenv.mkDerivation {
pname = "porzh-site";
version = "1.0";
@ -16,7 +14,7 @@ in {
enable = true;
virtualHosts = {
"porzh.me" = {
serverAliases = [ "www.porzh.me" ];
serverAliases = ["www.porzh.me"];
extraConfig = ''
root * ${porzhSite}
file_server
@ -25,4 +23,3 @@ in {
};
};
}

4
profiles/server-selfhosted.nix
View file

@ -12,8 +12,8 @@
services.openssh = {
enable = true;
settings = {
PasswordAuthentication = false ;
PubkeyAuthentication = true ;
PasswordAuthentication = false;
PubkeyAuthentication = true;
};
};

4
profiles/workstation-bspwm.nix
View file

@ -20,8 +20,8 @@
services.openssh = {
enable = true;
settings = {
X11Forwarding = true ;
X11DisplayOffset = 10 ;
X11Forwarding = true;
X11DisplayOffset = 10;
};
};