feat: enable tailscale for dandelion

hosts/sakura/hardware-configuration.nix

@@ -1,30 +1,45 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
+  imports = [
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/installer/scan/not-detected.nix")
-    ];
+  ];
 
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
+  boot.initrd.availableKernelModules = [
+    "nvme"
+    "xhci_pci"
+    "thunderbolt"
+    "usb_storage"
+    "sd_mod"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
+  fileSystems."/" = {
-    { device = "/dev/disk/by-uuid/24035f97-746a-4aec-b1d8-696bc32d3c97";
+    device = "/dev/disk/by-uuid/24035f97-746a-4aec-b1d8-696bc32d3c97";
-      fsType = "ext4";
+    fsType = "ext4";
-    };
+  };
 
-  boot.initrd.luks.devices."luks-156453ac-bbad-452c-ad92-4fc569db9347".device = "/dev/disk/by-uuid/156453ac-bbad-452c-ad92-4fc569db9347";
+  boot.initrd.luks.devices."luks-root".device = "/dev/nvme0n1p3";
 
-  fileSystems."/boot" =
+  fileSystems."/boot" = {
-    { device = "/dev/disk/by-uuid/0EFD-4B3F";
+    device = "/dev/disk/by-uuid/0EFD-4B3F";
-      fsType = "vfat";
+    fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
+    options = [
-    };
+      "fmask=0022"
+      "dmask=0022"
+    ];
+  };
 
   swapDevices = [ ];
 

modules/core/printing.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 {
   services.avahi = {
-    enable = true;
+    enable = false;
     nssmdns4 = true;
     openFirewall = true;
   };

modules/core/sshd.nix

@@ -2,7 +2,7 @@
 {
   services.openssh = {
     enable = true;
-    ports = [ 22 ];
+    ports = [ 9123 ];
     settings = {
       PasswordAuthentication = lib.mkDefault false;
       AllowUsers = null;

modules/home/waybar/scripts.nix

@@ -155,27 +155,24 @@
     "/home/${username}/.local/bin/waybar-music" = {
       executable = true;
       text = ''
-        #!/usr/bin/env bash
+        #!/usr/bin/env sh
 
-        class=$(playerctl metadata --player=ncspot --format '{{lc(status)}}')
+        META="{{ trunc(artist,17) }} - {{ trunc(title,17) }}"
+        PLAYERS="spotify ncspot mpv mpd"
 
-        if [[ $class == "playing" ]]; then
+        for PLAYER in $PLAYERS; do
-          info=$(playerctl metadata --player=ncspot --format '{{artist}} - {{title}}')
+        	# if the player is not playing, continue to the next player, until we find one that is playing
-          if [[ $\{#info} > 40 ]]; then
+        	[ "$(playerctl --player=$PLAYER status 2>/dev/null)" != "Playing" ] && continue
-            info=$(echo $info | cut -c1-40)"..."
+        	text=$(playerctl metadata --player $PLAYER --format "$META")
-          fi
+        	echo -e "{\"text\":\""$text"\", \"class\":\"Playing\"}"
-          text="$info"
+        	exit 0
-        elif [[ $class == "paused" ]]; then
+        done
-          info=$(playerctl metadata --player=ncspot --format '{{artist}} - {{title}}')
-          if [[ $\{#info} > 40 ]]; then
-            info=$(echo $info | cut -c1-40)"..."
-          fi
-          text=" $info"
-        elif [[ $class == "stopped" ]]; then
-          text=""
-        fi
 
-        echo -e "{\"text\":\""$text"\", \"class\":\""$class"\"}"
+        ICON="❚❚ "
+        PAUSERS="spotify ncspot mpd"
+        for PAUSER in $PAUSERS; do
+        	[ "$(playerctl --player=$PAUSER status 2>/dev/null)" == "Paused" ] || [ "$(playerctl --player=$PAUSER status 2>/dev/null)" == "Stopped" ] && text="$ICON"$(playerctl metadata --player $PAUSER --format "$META") && echo -e "{\"text\":\""$text"\", \"class\":\""paused"\"}" && exit 0
+        done
       '';
     };
     "/home/${username}/.local/bin/waybar-devices" = {

modules/home/zsh.nix

@@ -111,12 +111,12 @@
 
         export export PATH="''${PATH}:''${HOME}/.local/bin/:''${HOME}/.cargo/bin/:''${HOME}/.fzf/bin/"
 
-        if [[ $(which sxiv&>/dev/null && echo 1) == "1" ]]; then
+        # if [[ $(which sxiv&>/dev/null && echo 1) == "1" ]]; then
-          alias imv="sxiv"
+        #   alias imv="sxiv"
-        elif [[ $(which nsxiv&>/dev/null && echo 1) == "1" ]]; then
+        # elif [[ $(which nsxiv&>/dev/null && echo 1) == "1" ]]; then
-          alias imv="nsxiv"
+        #   alias imv="nsxiv"
-          alias sxiv="nsxiv"
+        #   alias sxiv="nsxiv"
-        fi
+        # fi
       '';
 
       zsh-abbr = {
@@ -173,6 +173,7 @@
         # nvim = "nix run /home/liv/Development/nixvim --";
         vim = "nvim";
         doas = "sudo";
+        sxiv = "nsxiv";
 
         # NixOS
         ns = "nix-shell --run zsh";

modules/services/dandelion.nix

@@ -7,5 +7,6 @@
     ++ [ (import ./home-assistant.nix) ]
     ++ [ (import ./monitoring.nix) ]
     ++ [ (import ./smart-monitoring.nix) ]
+    ++ [ (import ./tailscale.nix) ]
     ++ [ (import ./hd-idle.nix) ];
 }

modules/services/monitoring.nix

@@ -23,9 +23,9 @@
       ];
     };
   };
-  networking.firewall = {
+  # networking.firewall = {
-    allowedTCPPorts = [
+  # allowedTCPPorts = [
-      9001
+  # 9001
-    ];
+  # ];
-  };
+  # };
 }

modules/services/mumble.nix

@@ -2,6 +2,6 @@
 {
   services.murmur = {
     enable = true;
-    openFirewall = true;
+    openFirewall = false;
   };
 }

modules/services/nginx.nix

@@ -37,41 +37,35 @@
     recommendedProxySettings = true;
     clientMaxBodySize = lib.mkDefault "10G";
 
-    defaultListen =
+    #defaultListen =
-      let
+    #  let
-        listen = [
+    #    listen = [
-          {
+    #      {
-            addr = "[::]";
+    #        addr = "[::]";
-            port = 80;
+    #        port = 80;
-            extraParameters = [ "proxy_protocol" ];
+    #        extraParameters = [ "proxy_protocol" ];
-          }
+    #      }
-          {
+    #      {
-            addr = "[::]";
+    #        addr = "[::]";
-            port = 443;
+    #        port = 443;
-            ssl = true;
+    #        ssl = true;
-            extraParameters = [ "proxy_protocol" ];
+    #        extraParameters = [ "proxy_protocol" ];
-          }
+    #      }
-        ];
+    #    ];
-      in
+    #  in
-      map (x: (x // { addr = "0.0.0.0"; })) listen ++ listen;
+    #  map (x: (x // { addr = "0.0.0.0"; })) listen ++ listen;
 
     # Hardened TLS and HSTS preloading
     appendHttpConfig = ''
       # Proxying
       # real_ip_header proxy_protocol;
 
-      server {
-        listen 80   proxy_protocol;
-        listen 443  ssl proxy_protocol;
-        # set_real_ip_from 10.7.0.0/24;
-      }
-
       ssl_certificate /var/lib/acme/quack.social/cert.pem;
       ssl_certificate_key /var/lib/acme/quack.social/key.pem;
 
-      proxy_set_header Host            $host;
+      # proxy_set_header Host            $host;
-      proxy_set_header X-Real-IP       $proxy_protocol_addr;
+      # proxy_set_header X-Real-IP       $proxy_protocol_addr;
-      proxy_set_header X-Forwarded-For $proxy_protocol_addr;
+      # proxy_set_header X-Forwarded-For $proxy_protocol_addr;
 
       # Add HSTS header with preloading to HTTPS requests.
       # Do not add HSTS header to HTTP requests.
@@ -98,19 +92,6 @@
       add_header pronouns "any but neopronouns";
       add_header locale "[en_US, nl_NL]";
     '';
-    appendConfig = ''
-      # https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/
-      # set_real_ip_from 213.210.34.27;
-
-      # real_ip_header proxy_protocol;
-
-      # proxy_set_header Host               $host;
-      # proxy_set_header X-Real-IP          $proxy_protocol_addr;
-      # proxy_set_header X-Forwarded-For    $proxy_protocol_addr;
-      # proxy_set_header X-Forwarded-Proto  $scheme;
-      # proxy_set_header X-Forwarded-Host   $host;
-      # proxy_set_header X-Forwarded-Server $host;
-    '';
   };
   networking.firewall = {
     allowedTCPPorts = [

roles/creative.nix

@@ -1,8 +1,16 @@
-{ lib, pkgs, config, username, home-manager, ... }:
+{
+  lib,
+  pkgs,
+  config,
+  username,
+  home-manager,
+  ...
+}:
 with lib;
 let
   cfg = config.liv.creative;
-in {
+in
+{
   options.liv.creative = {
     enable = mkEnableOption "Enable creative workflow";
   };
@@ -17,6 +25,7 @@ in {
           obs-studio
           kdePackages.kdenlive
           orca-slicer
+          freecad
         ];
       };
     };