hardware-configuration/homeserver.nix

@@ -8,138 +8,103 @@
     [
       (modulesPath + "/installer/scan/not-detected.nix")
     ];
-  config = {
-    boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ "kvm-amd" ];
-    boot.extraModulePackages = [ ];
 
-    fileSystems."/" =
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
-      {
+  boot.initrd.kernelModules = [ ];
-        device = "/dev/disk/by-uuid/439a1beb-1443-495b-9891-012605819803";
+  boot.kernelModules = [ "kvm-amd" ];
-        fsType = "ext4";
+  boot.extraModulePackages = [ ];
-      };
 
-    fileSystems."/boot" =
+  fileSystems."/" =
-      {
+    {
-        device = "/dev/disk/by-uuid/47A1-0296";
+      device = "/dev/disk/by-uuid/439a1beb-1443-495b-9891-012605819803";
-        fsType = "vfat";
-        options = [ "fmask=0022" "dmask=0022" ];
-      };
-
-    fileSystems."/nas" = {
-      device = "/dev/disk/by-label/WD_RED_4T_1";
       fsType = "ext4";
     };
-    fileSystems."/nas/public/Music" = {
-      device = "/nas/Syncthing/Sync/Music";
-      fsType = "auto";
-      options = [
-        "defaults"
-        "nofail"
-        "nobootwait"
-        "bind"
-      ];
-    };
-    fileSystems."/nas/public/Public" = {
-      device = "/nas/Syncthing/Sync/Public";
-      fsType = "auto";
-      options = [
-        "defaults"
-        "nofail"
-        "nobootwait"
-        "bind"
-      ];
-    };
-    fileSystems = {
-      "/nas/telemetry/grafana" = lib.mkIf config.profile.services.telemetry.grafana.enable {
-        device = "/var/lib/grafana";
-        fsType = "auto";
-        options = [
-          "defaults"
-          "nofail"
-          "nobootwait"
-          "bind"
-        ];
-      };
 
-      "/nas/telemetry/loki" = lib.mkIf config.profile.services.telemetry.loki.enable {
+  fileSystems."/boot" =
-        device = "/var/lib/loki";
+    {
-        fsType = "auto";
+      device = "/dev/disk/by-uuid/47A1-0296";
-        options = [
+      fsType = "vfat";
-          "defaults"
+      options = [ "fmask=0022" "dmask=0022" ];
-          "nofail"
-          "nobootwait"
-          "bind"
-        ];
-      };
-
-      "/nas/telemetry/tempo" = lib.mkIf config.profile.services.telemetry.tempo.enable {
-        device = "/var/lib/tempo";
-        fsType = "auto";
-        options = [
-          "defaults"
-          "nofail"
-          "nobootwait"
-          "bind"
-        ];
-      };
     };
 
-    swapDevices = [ ];
+  fileSystems."/nas" = {
+    device = "/dev/disk/by-label/WD_RED_4T_1";
+    fsType = "ext4";
+  };
+  fileSystems."/nas/public/Music" = {
+    device = "/nas/Syncthing/Sync/Music";
+    fsType = "auto";
+    options = [
+      "defaults"
+      "nofail"
+      "nobootwait"
+      "bind"
+    ];
+  };
+  fileSystems."/nas/public/Public" = {
+    device = "/nas/Syncthing/Sync/Public";
+    fsType = "auto";
+    options = [
+      "defaults"
+      "nofail"
+      "nobootwait"
+      "bind"
+    ];
+  };
 
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  swapDevices = [ ];
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    networking.useDHCP = lib.mkDefault true;
-    networking.defaultGateway = "192.168.100.1";
-    networking.interfaces.enp9s0 = {
-      useDHCP = false;
-      ipv4.addresses = [
-        {
-          address = "192.168.100.3";
-          prefixLength = 24;
-        }
-        {
-          address = "192.168.100.4";
-          prefixLength = 24;
-        }
-        {
-          address = "192.168.100.5";
-          prefixLength = 24;
-        }
-      ];
-    };
 
-    services.caddy.virtualHosts."public.tigor.web.id".extraConfig = /*caddy*/ ''
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-      file_server browse
+  # (the default) this is the recommended approach. When using systemd-networkd it's
-      root * /nas/public
+  # still possible to use this option, but it's recommended to use it in conjunction
-    '';
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  networking.defaultGateway = "192.168.100.1";
+  networking.interfaces.enp9s0 = {
+    useDHCP = false;
+    ipv4.addresses = [
+      {
+        address = "192.168.100.3";
+        prefixLength = 24;
+      }
+      {
+        address = "192.168.100.4";
+        prefixLength = 24;
+      }
+      {
+        address = "192.168.100.5";
+        prefixLength = 24;
+      }
+    ];
+  };
 
-    systemd.tmpfiles.settings = {
+  services.caddy.virtualHosts."public.tigor.web.id".extraConfig = /*caddy*/ ''
-      "100-nas-public-dir" = {
+    file_server browse
-        "/nas/public" = {
+    root * /nas/public
-          d = {
+  '';
-            group = config.profile.user.name;
+
-            mode = "0777";
+  systemd.tmpfiles.settings = {
-            user = config.profile.user.name;
+    "100-nas-public-dir" = {
-          };
+      "/nas/public" = {
+        d = {
+          group = config.profile.user.name;
+          mode = "0777";
+          user = config.profile.user.name;
         };
       };
     };
-
-    nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-    hardware.enableAllFirmware = true;
-    hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-    hardware.opengl = {
-      enable = true;
-      extraPackages = with pkgs; [
-        intel-media-driver
-        intel-vaapi-driver
-        libvdpau-va-gl
-      ];
-    };
-    environment.sessionVariables = { LIBVA_DRIVER_NAME = "iHD"; }; # Force intel-media-driver
   };
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.enableAllFirmware = true;
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  hardware.opengl = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver
+      intel-vaapi-driver
+      libvdpau-va-gl
+    ];
+  };
+  environment.sessionVariables = { LIBVA_DRIVER_NAME = "iHD"; }; # Force intel-media-driver
 }

home/modules/hyprland/hypridle.nix

@@ -14,18 +14,18 @@ in
       }
 
       listener {
-        timeout = ${toString cfg.hypridle.lockTimeout}
+        timeout = 600
         on-timeout = "hyprlock"
       }
 
       listener {
-        timeout = ${toString cfg.hypridle.dpmsTimeout}
+        timeout = 660
         on-timeout = hyprctl dispatch dpms off
         on-resume = hyprctl dispatch dpms on
       }
 
       listener {
-        timeout = ${toString cfg.hypridle.suspendTimeout}
+        timeout = 1800
         on-timeout = systemctl suspend
       }
     '';

options/hyprland.nix

@@ -1,4 +1,4 @@
-{ lib, config, ... }:
+{ lib, ... }:
 let
   types = lib.types;
 in
@@ -49,24 +49,6 @@ in
       };
     };
 
-    hypridle = {
-      lockTimeout = lib.mkOption {
-        type = lib.types.int;
-        default = 600;
-        description = ''Time in seconds before the screen locks'';
-      };
-      dpmsTimeout = lib.mkOption {
-        type = lib.types.int;
-        default = config.profile.hyprland.hypridle.lockTimeout + 60;
-        description = ''Time in seconds before the screen turns off. default is lockTimeout + 60'';
-      };
-      suspendTimeout = lib.mkOption {
-        type = lib.types.int;
-        default = 1800;
-        description = ''Time in seconds before the system suspends. default is 30 minutes (1800 seconds)'';
-      };
-    };
-
     dunst.monitor = lib.mkOption {
       type = lib.types.str;
       default = "0";

secrets/telemetry.yaml

@@ -9,12 +9,6 @@ loki:
             username: ENC[AES256_GCM,data:MRwky3O8LGS/4w==,iv:CUHjGRNc8NU5FqhqvpqbATmVE3Kg9Z0jMBFlzsAwON0=,tag:uZlxw9skd0VNLfZTJ/6ZSQ==,type:str]
             #ENC[AES256_GCM,data:t+u4g7nvpq2U27CHgmu1xi2Ppwv7cJf1s6Et,iv:LtwoPoxsQn1MujHRoD6SqDLm8uN4uBpuIVmn23DDgjI=,tag:PKOHF5vcQzHszpp1sfuU0Q==,type:comment]
             password: ENC[AES256_GCM,data:GcQ6x8ewxInmAcQwhhwJgXMHxd/ygkscsp2vg7PILEeaOv1heBX0fTHb0sRyAfhLxwKDH84LtGb37656,iv:UEQ7dgqNEKisalpPXFffsVzn6kXDt9DmJP6ec3LOHRE=,tag:CyPPqG2Vf8eeSVzAASintQ==,type:str]
-tempo:
-    caddy:
-        basic_auth:
-            username: ENC[AES256_GCM,data:B+8IkRh/MQ1f8g==,iv:0pmiHofPm+SvavQ1UsxOZcjdkWFuPpOs6cejTfkYH98=,tag:GiPPWqIKxhcxmnp709qyRg==,type:str]
-            #ENC[AES256_GCM,data:7/lgFtPiBjVhWba7cByCXNP2kmtdXTjqCEq6,iv:BAwTjTxXFy3vSxNaPRD9NsraMznrPFcjAQwtO0joOE8=,tag:7HqKeGXpGvT+Du3NoZskGQ==,type:comment]
-            password: ENC[AES256_GCM,data:tx/6SEqOxsStAKov6rZ83WJbO6CckvOw+tFkGSE0Co6ppSJB8CW4KiNGsUj9K6p+NjHalR1+48S32Bik,iv:MIJH6y2m3m+rks4+vwJAi6FrHqE8wv8aF30yvAHVTPM=,tag:uq/yUvoP/7KO0Z0jBEfYhw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -30,8 +24,8 @@ sops:
             bzYzSEQrRkN6WVVmN254a2NCcUxGVFkK4aHv8tiFiNEnd7I5LB0Jd/4upkEEEXis
             9A5hdTn20EqL62QuHeYRav1TRu42dp+R4iZAlVl9cRzThkzZKJdHlg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-02T09:51:05Z"
+    lastmodified: "2024-08-29T05:57:46Z"
-    mac: ENC[AES256_GCM,data:VsbdOVWBk49kiSS+3WXzJ209UENXkGqq4lRr0ETczp5PZAYbrUPzVlBrrqtvyxXMWZI+Q/J2vpoJmEQypyhwodtDp1NMbbiu5Nh0z5GQ1XVo6PBVUyIpCEaKkusWKzWmcWEP7HAvRzNdMEmlaRIaT07x0Ea8xLq79AeA0PZDT6A=,iv:JRIWfCZnO/9O458se670g5ei4xqXk9nEOTEV82bfGoc=,tag:LgX+9xgy5qPQ6EWhQCcFoA==,type:str]
+    mac: ENC[AES256_GCM,data:JGrZUe8PLjlcHULvVa8Yi8ORAW5bMKOMxSGbJ2UFji9byRGu+JHaU7gdF45lrR5XKxJZLmZesWI9fRjsnlEd9WDTEroiwFo965mYFcdmbrJb37BIRO6Thy6C77GXMNcOVW2hBgcVDckNIbAk3qgvVG2QOZ5VKwxPLVQPsfWfCFs=,iv:Do05RY+cgahdv8/Nk6RIOxBA6x28GxyErrgSQRoIR80=,tag:HoqhdhZmcS3QxXGfZyxfFw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.8.1

system/services/telemetry/default.nix

@@ -3,6 +3,5 @@
   imports = [
     ./grafana.nix
     ./loki.nix
-    ./tempo.nix
   ];
 }

system/services/telemetry/loki.nix

@@ -3,10 +3,10 @@ let
   cfg = config.profile.services.telemetry.loki;
   inherit (lib) mkIf;
   lokiDomain = "loki.tigor.web.id";
-  server = config.services.loki.configuration.server;
 in
 {
   config = mkIf cfg.enable {
+
     sops =
       let
         usernameKey = "loki/caddy/basic_auth/username";
@@ -36,7 +36,7 @@ in
       basicauth {
         {$LOKI_USERNAME} {$LOKI_PASSWORD}
       }
-      reverse_proxy ${server.http_listen_address}:${toString server.http_listen_port}
+      reverse_proxy ${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}
     '';
 
     services.loki =
@@ -90,14 +90,17 @@ in
       {
         name = "Loki";
         type = "loki";
-        uid = "loki";
         access = "proxy";
-        url = "http://${server.http_listen_address}:${toString server.http_listen_port}";
+        url = "http://${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}";
-        basicAuth = false;
+        basicAuth = true;
+        basicAuthUser = "$__file{${config.sops.secrets."loki/caddy/basic_auth/username".path}}";
         jsonData = {
           timeout = 60;
           maxLines = 1000;
         };
+        secureJsonData = {
+          basicAuthPassword = "$__file{${config.sops.secrets."loki/caddy/basic_auth/password".path}}";
+        };
       }
     ];
   };

system/services/telemetry/tempo.nix

@@ -1,104 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.profile.services.telemetry.tempo;
-  inherit (lib) mkIf;
-  domain = "tempo.tigor.web.id";
-  basic_auth = {
-    username = "tempo/caddy/basic_auth/username";
-    password = "tempo/caddy/basic_auth/password";
-    template = "tempo/caddy/basic_auth";
-  };
-  server = config.services.tempo.settings.server;
-in
-{
-  config = mkIf cfg.enable {
-    sops = {
-      secrets =
-        let
-          opts = { sopsFile = ../../../secrets/telemetry.yaml; owner = "grafana"; };
-        in
-        {
-          ${basic_auth.username} = opts;
-          ${basic_auth.password} = opts;
-        };
-      templates = {
-        ${basic_auth.template}.content = /*sh*/ ''
-          TEMPO_USERNAME=${config.sops.placeholder.${basic_auth.username}}
-          TEMPO_PASSWORD=${config.sops.placeholder.${basic_auth.password}}
-        '';
-      };
-    };
-
-    systemd.services."caddy".serviceConfig = {
-      EnvironmentFile = [ config.sops.templates.${basic_auth.template}.path ];
-    };
-
-    services.caddy.virtualHosts.${domain}.extraConfig = ''
-      basicauth {
-          {$TEMPO_USERNAME} {$TEMPO_PASSWORD}
-      }
-
-      reverse_proxy ${server.http_listen_address}:${toString server.http_listen_port}
-    '';
-
-    services.tempo = {
-      enable = true;
-      settings = {
-        server = {
-          http_listen_address = "0.0.0.0";
-          http_listen_port = 3200;
-          grpc_listen_port = 9096;
-        };
-        distributor = {
-          receivers = {
-            otlp = {
-              protocols = {
-                http = { };
-              };
-            };
-          };
-        };
-        storage.trace = {
-          backend = "local";
-          local.path = "/var/lib/tempo/traces";
-          wal.path = "/var/lib/tempo/wal";
-        };
-        ingester = {
-          lifecycler.ring.replication_factor = 1;
-        };
-      };
-    };
-    services.grafana.provision.datasources.settings.datasources = [
-      {
-        name = "Tempo";
-        type = "tempo";
-        access = "proxy";
-        url = "http://${server.http_listen_address}:${toString server.http_listen_port}";
-        basicAuth = false;
-        jsonData = {
-          nodeGraph.enabled = true;
-          search.hide = false;
-          traceQuery = {
-            timeShiftEnabled = true;
-            spanStartTimeShift = "1h";
-            spanEndTimeShift = "1h";
-          };
-          spanBar = {
-            type = "Tag";
-            tag = "http.path";
-          };
-          tracesToLogsV2 = mkIf config.profile.services.telemetry.loki.enable {
-            datasourceUid = "loki";
-            spanStartTimeShift = "-1h";
-            spanEndTimeShift = "1h";
-            tags = [ "job" "instance" "pod" "namespace" ];
-            filterByTraceID = false;
-            filterBySpanID = false;
-            customQuery = true;
-            query = ''method="$''${__span.tags.method}"'';
-          };
-        };
-      }
-    ];
-  };
-}