Formatting

This reverts commit 554e5651a7.

flake.nix

@@ -32,7 +32,12 @@
         };
 
       wrapUtils = { pkgs, unstable, system }:
-        import ./lib { inherit nixpkgs nixos-unstable home-manager system pkgs unstable; };
+        pkgs.lib.makeScope pkgs.newScope (self: {
+          inherit nixpkgs home-manager nixos-unstable;
+          user = self.callPackage ./lib/user.nix { };
+          host = self.callPackage ./lib/host.nix { };
+        });
+
 
       pkgsLinuxX64 = wrapPkgsSystem { system = sysLinuxX64; };
       unstableLinuxX64 = wrapUnstablePkgsSystem { system = sysLinuxX64; };

hosts/architect/default.nix

@@ -6,8 +6,10 @@ let
   ];
   hostname = "architect";
   network = import ./network.nix;
-in {
-  imports = [ # Include the results of the hardware scan.
+in
+{
+  imports = [
+    # Include the results of the hardware scan.
     ./backup.nix
     ./hardware.nix
     ./firewall.nix
@@ -29,7 +31,7 @@ in {
     ./invidious.nix
     ./nitter.nix
     ./lidarr.nix
-#    ./navidrome.nix
+    #    ./navidrome.nix
     ./jellyfin.nix
     ./prosody.nix
     ./deluge.nix
@@ -39,10 +41,11 @@ in {
     ./lezzo.nix
     ./runas.nix
     ./tailscale.nix
+    ./searx.nix
   ];
 
   time.timeZone = "Europe/Rome";
-#  system.stateVersion = "21.11";
+  #  system.stateVersion = "21.11";
   users.users.giulio.openssh.authorizedKeys.keys = pubkeys;
   boot = {
     initrd = {

hosts/architect/deluge.nix

@@ -4,7 +4,8 @@ let
   domain = "htdel.giugl.io";
   network = import ./network.nix;
   auth_block = (import ./openid.nix { inherit lib; }).openresty_oidc_block;
-in {
+in
+{
   services = {
     deluge = {
       enable = true;

hosts/architect/firewall.nix

@@ -49,7 +49,8 @@ let
     wireguard_udp
   ];
 
-in {
+in
+{
   networking = {
     # needed to use nftables
     firewall.enable = false;
@@ -158,7 +159,7 @@ in {
             ip daddr 224.0.0.0/4 accept comment "allow multicast traffic"
             ip saddr ${lan-net} accept comment "lan > local"
             ip saddr ${tailscale-net} accept comment "tailscale > local"
-                    ip saddr {${lib.concatStringsSep "," gdevices-wg}} accept comment "vpn > local"
+            ip saddr {${lib.concatStringsSep "," gdevices}} accept comment "vpn > local"
 
             iifname ${wan-if} tcp dport {${open_tcp_ports}} accept
             iifname ${wan-if} udp dport {${open_udp_ports}} accept
@@ -173,14 +174,9 @@ in {
             type filter hook forward priority filter; policy drop;
             ct state established,related accept
                     
-                    # client to client
-                    ip saddr {${lib.concatStringsSep "," c2c-wg}} ip daddr {${
-                      lib.concatStringsSep "," c2c-wg
-                    }} accept
-                    
             # gdevices talking to everyone in VPN
             ip saddr {${
-                      lib.concatStringsSep "," gdevices-wg
+              lib.concatStringsSep "," gdevices
             }} ip daddr ${vpn-net} accept
             ip saddr {${
               lib.concatStringsSep "," gamenet-wg

hosts/architect/home-assistant.nix

@@ -5,7 +5,8 @@ let
   network = import ./network.nix;
   host = "127.0.0.1";
   port = 8123;
-in {
+in
+{
   services = {
     mosquitto = {
       enable = true;
@@ -52,7 +53,7 @@ in {
             proxy_set_header    Upgrade     $http_upgrade;
             proxy_set_header    Connection  "upgrade";
           allow 10.0.0.0/24;
-          ${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
+          ${lib.concatMapStrings (x: "allow ${x};") network.gdevices}
           deny all;
         '';
       };

hosts/architect/jellyfin.nix

@@ -19,7 +19,7 @@ in
     nginx.virtualHosts.${domain} = {
       forceSSL = true;
       enableACME = true;
-      extraConfig = auth_block { access_role = "jellyfin"; whitelisted_ips = network.gdevices-wg; } +
+      extraConfig = auth_block { access_role = "jellyfin"; whitelisted_ips = network.gdevices; } +
         ''
           # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
           #add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js https://www.gstatic.com/eureka/clank/95/cast_sender.js https://www.gstatic.com/eureka/clank/96/cast_sender.js https://www.gstatic.com/eureka/clank/97/cast_sender.js https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";

hosts/architect/keycloak.nix

@@ -3,7 +3,8 @@
 let
   network = import ./network.nix;
   domain = "auth.giugl.io";
-in {
+in
+{
   services = {
     keycloak = {
       enable = true;

hosts/architect/lidarr.nix

@@ -4,7 +4,8 @@ let
   domain = "htlid.giugl.io";
   network = import ./network.nix;
   auth_block = (import ./openid.nix { inherit lib; }).openresty_oidc_block;
-in {
+in
+{
   services = {
     lidarr = {
       enable = true;

hosts/architect/matrix.nix

@@ -97,9 +97,9 @@ in
             return 200 '${builtins.toJSON client}';
           '';
 
-#        locations."/".extraConfig = ''
-#          return 404;
-#        '';
+        #        locations."/".extraConfig = ''
+        #          return 404;
+        #        '';
 
         # forward all Matrix API calls to the synapse Matrix homeserver
         locations."/_matrix" = {

hosts/architect/minio.nix

@@ -3,7 +3,8 @@
 let
   domain = "s3.giugl.io";
   network = import ./network.nix;
-in {
+in
+{
   services = {
     minio.enable = true;
 
@@ -15,7 +16,7 @@ in {
         extraConfig = ''
           client_max_body_size 500M;
           allow 10.0.0.0/24;
-          ${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg }
+          ${lib.concatMapStrings (x: "allow ${x};") network.gdevices }
           allow ${network.manduria-wg};
           deny all;
         '';

hosts/architect/modules/jellyfin.nix

@@ -77,7 +77,7 @@ in {
         PrivateTmp = true;
         PrivateUsers = true;
 
-#        ProtectClock = true;
+        #        ProtectClock = true;
         ProtectControlGroups = true;
         ProtectHostname = true;
         ProtectKernelLogs = true;

hosts/architect/navidrome.nix

@@ -6,7 +6,8 @@ let
   library_path = "/media/Music";
   beets_config = "/media/beets.conf";
   auth_block = (import ./openid.nix { inherit lib; }).openresty_oidc_block;
-in {
+in
+{
   services = {
     navidrome = {
       enable = true;

hosts/architect/network.nix

@@ -62,12 +62,8 @@ rec {
   dodino-ts = "100.106.244.35";
 
   # groups
-  gdevices-wg =
-    [ giuliopc-wg giuliophone-wg gbeast-wg peppiniell-wg kclvm-wg ] ++ routers-wg;
-  routers-wg = [ hotpottino-wg angellane-wg dodino-wg ];
-  c2c-wg = [ ] ++ gdevices-wg;
-  towan-wg = [ shield-wg parina-wg parina-ipad-wg germano-wg framecca-wg ]
-    ++ gdevices-wg ++ routers-wg;
+  gdevices = [ giuliophone-ts architect-ts giuliopc-ts dodino-ts ];
+  towan-wg = [ shield-wg parina-wg parina-ipad-wg germano-wg framecca-wg ];
   gamenet-wg = [
     andrew-wg
     giuliopc-wg

hosts/architect/nextcloud.nix

@@ -4,7 +4,8 @@ let
   domain = "cloud.giugl.io";
   network = import ./network.nix;
   redis_port = 6379;
-in {
+in
+{
   services = {
     mysql = {
       enable = true;

hosts/architect/nitter.nix

@@ -3,7 +3,8 @@
 let
   domain = "tweet.giugl.io";
   network = import ./network.nix;
-in {
+in
+{
   services = {
     nitter = {
       enable = true;

hosts/architect/nzbget.nix

@@ -4,7 +4,8 @@ let
   domain = "htnzb.giugl.io";
   network = import ./network.nix;
   auth_block = (import ./openid.nix { inherit lib; }).openresty_oidc_block;
-in {
+in
+{
   services = {
     nzbget = {
       enable = true;

hosts/architect/openid.nix

@@ -2,7 +2,7 @@
 
 {
   openresty_oidc_block =
-    { access_role ? "", whitelisted_ips ? [] }: ''
+    { access_role ? "", whitelisted_ips ? [ ] }: ''
       access_by_lua_block {
         local opts = {
           discovery = "https://auth.giugl.io/realms/master/.well-known/openid-configuration",

hosts/architect/plex.nix

@@ -3,7 +3,8 @@
 let
   domain = "media.giugl.io";
   network = import ./network.nix;
-in {
+in
+{
   services.plex = {
     enable = true;
     package = pkgs.unstable.plex;

hosts/architect/prosody.nix

@@ -5,7 +5,8 @@ let
   conference_domain = "conference.${domain}";
   upload_domain = "uploads.${domain}";
   network = import ./network.nix;
-in {
+in
+{
   services = {
     prosody = {
       enable = true;

hosts/architect/prowlarr.nix

@@ -3,7 +3,8 @@
 let
   domain = "htpro.giugl.io";
   network = import ./network.nix;
-in {
+in
+{
   services = {
     prowlarr.enable = true;
 
@@ -14,7 +15,7 @@ in {
         proxyPass = "http://127.0.0.1:9696";
         extraConfig = ''
           allow 10.0.0.0/24;
-          ${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
+          ${lib.concatMapStrings (x: "allow ${x};") network.gdevices}
           deny all;
         '';
       };

hosts/architect/radarr.nix

@@ -4,7 +4,8 @@ let
   domain = "htrad.giugl.io";
   network = import ./network.nix;
   auth_block = (import ./openid.nix { inherit lib; }).openresty_oidc_block;
-in {
+in
+{
   services = {
     radarr = {
       enable = true;

hosts/architect/searx.nix

@@ -0,0 +1,65 @@
+{ mach-nix, lib, config, pkgs, ... }:
+
+let
+  domain = "gugol.giugl.io";
+  network = import ./network.nix;
+in
+{
+  services = {
+    redis.servers."searx" = { enable = true; port = 4456; };
+    searx = {
+      enable = true;
+      package = pkgs.searxng;
+      #            package = mach-nix.buildPythonPackage "https://github.com/searxng/searxng/commit/2cf1425e8bc5d3143b6e001e82a034a794e8a206https://github.com/searxng/searxng/commit/2cf1425e8bc5d3143b6e001e82a034a794e8a206";
+
+      environmentFile = /secrets/searx/env;
+      settings = {
+        server = {
+          secret_key = "@SEARX_SECRET_KEY@";
+          port = 4455;
+        };
+
+        general = {
+          instance_name = "Pepe's Gugol";
+          contact_url = "mailto:gugol@depasquale.giugl.io";
+          enable_metrics = false;
+        };
+
+        search = {
+          safe_search = 0;
+          autocomplete = "duckduckgo";
+          prefer_configured_language = false;
+        };
+
+        ui = {
+          infinite_scroll = true;
+        };
+
+        redis.url = "127.0.0.1:${toString config.services.redis.servers."searx".port}";
+
+        engines = [
+          { name = "google"; disabled = false; }
+          { name = "bing"; disabled = false; }
+          { name = "qwant"; disabled = false; }
+          { name = "duckduckgo"; disabled = false; }
+          { name = "yahoo"; disabled = false; }
+        ];
+      };
+    };
+
+    nginx.virtualHosts.${domain} = {
+      forceSSL = true;
+      enableACME = true;
+
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString config.services.searx.settings.server.port}";
+      };
+    };
+  };
+
+  networking.extraHosts = ''
+    ${network.architect-lan} ${domain}
+    ${network.architect-wg} ${domain}
+    ${network.architect-ts} ${domain}
+  '';
+}

hosts/architect/sonarr.nix

@@ -4,7 +4,8 @@ let
   domain = "htson.giugl.io";
   network = import ./network.nix;
   auth_block = (import ./openid.nix { inherit lib; }).openresty_oidc_block;
-in {
+in
+{
   services = {
     sonarr = {
       enable = true;

hosts/architect/tailscale.nix

@@ -4,7 +4,8 @@ let
   network = import ./network.nix;
 
   ifname = "ts0";
-in {
+in
+{
   services = {
     tailscale = {
       enable = true;

hosts/architect/transmission.nix

@@ -3,7 +3,8 @@
 let
   domain = "httra.giugl.io";
   network = import ./network.nix;
-in {
+in
+{
   services = {
     transmission = {
       enable = true;
@@ -27,7 +28,7 @@ in {
         proxyPass = "http://127.0.0.1:9091";
         extraConfig = ''
           allow 10.0.0.0/24;
-          ${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
+          ${lib.concatMapStrings (x: "allow ${x};") network.gdevices}
           deny all;
         '';
       };

hosts/gAluminum/default.nix

@@ -9,7 +9,8 @@ let
     export __VK_LAYER_NV_optimus=NVIDIA_only
     exec -a "$0" "$@"
   '';
-in {
+in
+{
   imports = [ ./hardware.nix ./wireguard.nix ./sound.nix ];
 
   boot = {
@@ -70,5 +71,5 @@ in {
 
   programs.steam.enable = true;
   environment.systemPackages = with pkgs; [ efibootmgr nvidia-offload ];
-#  system.stateVersion = "21.05"; # Did you read the comment?
+  #  system.stateVersion = "21.05"; # Did you read the comment?
 }

lib/default.nix

@@ -1,6 +0,0 @@
-{ pkgs, unstable, nixpkgs, nixos-unstable, home-manager, system, ... }: rec {
-  user = import ./user.nix { inherit pkgs unstable system home-manager; };
-  host = import ./host.nix {
-    inherit pkgs nixpkgs unstable nixos-unstable home-manager user system;
-  };
-}

lib/host.nix

@@ -5,14 +5,17 @@
     let
       mkRole = role: import (../roles + "/${role}.nix");
 
-      users_mod = (map (u:
+      users_mod = (map
+        (u:
           user.mkUser {
             name = u.user;
             roles = u.roles;
-        }) users);
+          })
+        users);
       roles_mod = (map (r: mkRole r) roles);
       add_imports = imports;
-    in nixpkgs.lib.nixosSystem {
+    in
+    nixpkgs.lib.nixosSystem {
       inherit system;
 
       modules = [

lib/user.nix

@@ -5,7 +5,8 @@
     let
       mkRole = role: import (../roles/home + "/${role}.nix");
       roles_mod = (map (r: mkRole r) roles);
-    in {
+    in
+    {
       users.groups.plugdev = { };
 
       fileSystems."/home/${name}/Downloads" = {
@@ -27,7 +28,8 @@
     let
       mkRole = role: import (../roles/home + "/${role}.nix");
       roles_mod = (map (r: mkRole r) roles);
-    in home-manager.lib.homeManagerConfiguration {
+    in
+    home-manager.lib.homeManagerConfiguration {
       inherit pkgs;
       modules = [
         {

roles/home/desktop.nix

@@ -9,7 +9,8 @@ let
     name = "guake";
     package = pkgs.guake;
   });
-in {
+in
+{
   imports = [ ./gnome.nix ];
 
   nixpkgs.config.allowUnfree = true;