WIP

.sops.yaml

@@ -1,7 +0,0 @@
-keys:
-  - &host_key age102mctuw7xvs3fakft0mlfh740kc6rdaqqgmmwf400c4g3spefyjqrfmwct
-creation_rules:
-  - path_regex: (yaml|json)$
-    key_groups:
-      - age:
-        - *host_key

configuration.nix

@@ -1,26 +1,36 @@
-{ pkgs, config, ... }: {
-  config = {
-    services.openssh.enable = true;
-    services.avahi = { enable = true; nssmdns4 = true; };
+{ pkgs, userSettings, systemSettings, ... }:
+{
+  nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
-    sops.defaultSopsFile = ./secrets/encrypted_secrets.yaml;
-    sops.defaultSopsFormat = "yaml";
+  environment.systemPackages = with pkgs; [
+    # (pkgs.writeShellScriptBin "nrbs" "sudo nixos-rebuild switch")
+    # (pkgs.writeShellScriptBin "nrbsu" "sudo nix-channel --update && sudo nixos-rebuild switch")
+    bash
+    busybox
+    git
+    eza
+  ];
 
-    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+  # For SSH access
+  services.openssh.enable = true;
 
-    environment.systemPackages = with pkgs; [
-      home-manager
-      bash
-      busybox
-      git
-      eza
-      sops
-    ];
+  # Networking stuff
+  services.avahi = { enable = true; nssmdns4 = true; };
 
-    security.sudo-rs = {
-      enable = true;
-      execWheelOnly = false;
-      wheelNeedsPassword = false; # allows sudo without password for those in the wheel group
-    };
+  # Uses rust-based sudo
+  security.sudo-rs = {
+    enable = true;
+    execWheelOnly = false;
+    wheelNeedsPassword = false; # allows sudo without password for those in the wheel group
   };
+
+  users.users.${userSettings.username} = {
+    isNormalUser  = true;
+    uid = 1000;
+    extraGroups  = [ "wheel" "networkmanager" ];
+    openssh.authorizedKeys.keyFiles = [ /root/.ssh/authorized_keys ];
+  };
+
+  time.timeZone = "${systemSettings.timeZone}";
+  networking.hostName = systemSettings.hostName;
 }

flake.lock

@@ -25,11 +25,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748227609,
-        "narHash": "sha256-SaSdslyo6UGDpPUlmrPA4dWOEuxCy2ihRN9K6BnqYsA=",
+        "lastModified": 1733484277,
+        "narHash": "sha256-i5ay20XsvpW91N4URET/nOc0VQWOAd4c4vbqYtcH8Rc=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d23d20f55d49d8818ac1f1b2783671e8a6725022",
+        "rev": "d00c6f6d0ad16d598bf7e2956f52c1d9d5de3c3a",
         "type": "github"
       },
       "original": {
@@ -40,48 +40,58 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748190013,
-        "narHash": "sha256-R5HJFflOfsP5FBtk+zE8FpL8uqE7n62jqOsADvVshhE=",
-        "owner": "nixos",
+        "lastModified": 1733581040,
+        "narHash": "sha256-Qn3nPMSopRQJgmvHzVqPcE3I03zJyl8cSbgnnltfFDY=",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "62b852f6c6742134ade1abdd2a21685fd617a291",
+        "rev": "22c3f2cf41a0e70184334a958e6b124fb0ce3e01",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
         "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1733412085,
+        "narHash": "sha256-FillH0qdWDt/nlO6ED7h4cmN+G9uXwGjwmCnHs0QVYM=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4dc2fc4e62dbf62b84132fe526356fbac7b03541",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1682134069,
+        "narHash": "sha256-TnI/ZXSmRxQDt2sjRYK/8j8iha4B4zP2cnQCZZ3vp7k=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fd901ef4bf93499374c5af385b2943f5801c0833",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "type": "indirect"
+      }
+    },
     "root": {
       "inputs": {
         "home-manager": "home-manager",
         "nixpkgs": "nixpkgs",
-        "sops-nix": "sops-nix",
+        "nixpkgs-stable": "nixpkgs-stable",
         "vscode-server": "vscode-server"
       }
     },
-    "sops-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1747603214,
-        "narHash": "sha256-lAblXm0VwifYCJ/ILPXJwlz0qNY07DDYdLD+9H+Wc8o=",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "8d215e1c981be3aa37e47aeabd4e61bb069548fd",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "type": "github"
-      }
-    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,
@@ -100,9 +110,7 @@
     "vscode-server": {
       "inputs": {
         "flake-utils": "flake-utils",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
+        "nixpkgs": "nixpkgs_2"
       },
       "locked": {
         "lastModified": 1729422940,

flake.nix

@@ -1,64 +1,83 @@
 {
-  description = "A very basic flake";
+  description = "Panoptes flake config";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs?ref=nixos-unstable";
-    vscode-server = {
-      url = "github:nix-community/nixos-vscode-server";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-24.11";
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    sops-nix = {
-      url = "github:Mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    vscode-server.url = "github:nix-community/nixos-vscode-server";
   };
 
-  outputs = { self, ... }@args:
+  outputs = {
+    self,
+    nixpkgs,
+    nixpkgs-stable,
+    home-manager,
+    ...
+  } @ inputs:
   let
+    stateVersion = "24.11";
     inherit (self) outputs;
-    systemSettings = {
+    nixosSystem = inputs.nixpkgs.lib.nixosSystem;
+    
+    userSettings = rec {
+      username = "panoptes";
+      gitUserName = "John Lancaster";
+      gitUserEmail = "32917998+jsl12@users.noreply.github.com";
+      # gitUserEmail = "asdfasdf@asdf.com";
+    };
+
+    systemSettings = rec {
       hostName = "panoptes-nix";
       system = "x86_64-linux";
       timeZone = "America/Chicago";
       locale = "en_US.UTF-8";
     };
-    userSettings = {
-      username = "root";
-    };
-    nixosSystem = args.nixpkgs.lib.nixosSystem;
-    pkgs = args.nixpkgs.legacyPackages.${systemSettings.system};
+
+    pkgs = inputs.nixpkgs.legacyPackages.${systemSettings.system};
+    pkgs-stable = inputs.nixpkgs-stable.legacyPackages.${systemSettings.system};
 
   in
   {
-    nixosConfigurations.${systemSettings.hostName} = nixosSystem {
-      system = systemSettings.system;
-      specialArgs = {
-        inherit systemSettings userSettings;
+    nixosConfigurations = {
+      "${systemSettings.hostName}" = nixosSystem {
+        system = systemSettings.system;
+        specialArgs = {
+          inherit inputs;
+          inherit outputs;
+          inherit userSettings;
+          inherit systemSettings;
+        };
+        modules = [
+          ./configuration.nix # > Our main nixos configuration file <
+          "${inputs.nixpkgs}/nixos/modules/virtualisation/proxmox-lxc.nix"
+          ({ ... }: {
+            system.stateVersion = "${stateVersion}";
+            services.vscode-server.enable = true;
+          })
+          inputs.vscode-server.nixosModules.default
+        ];
       };
-      modules = [
-        (args.nixpkgs + "/nixos/modules/virtualisation/proxmox-lxc.nix")
-        args.home-manager.nixosModules.default
-        args.sops-nix.nixosModules.sops
-        args.vscode-server.nixosModules.default
-        ./configuration.nix
-        ./nixosModules
-        ./scripts
-        ({ pkgs, systemSettings, ... }: {
-          networking.hostName = systemSettings.hostName;
-          system.stateVersion = "24.11";
-          nix.settings.experimental-features = [ "nix-command" "flakes" ];
-          time.timeZone = "${systemSettings.timeZone}";
+    };
 
-          nixpkgs.config.allowUnfree = true;
-          services.vscode-server.enable = true;
-          programs.nix-ld.enable = true;
-          environment.systemPackages = with pkgs; [ git ];
-        })
-      ];
+    homeConfigurations = {
+      useGlobalPkgs = true;
+      "panoptes@panoptes-nix" = home-manager.lib.homeManagerConfiguration {
+        inherit pkgs stateVersion;
+        specialArgs = {
+          inherit inputs;
+          inherit outputs;
+          inherit userSettings;
+          inherit systemSettings;
+        };
+        modules = [
+          ./home.nix
+          # ({...}: {home.stateVersion = "${stateVersion}";})
+        ];
+      };
     };
   };
 }

home.nix

@@ -5,10 +5,9 @@
   ...
 }:
 let
-  repoURL = "https://gitea.john-stream.com/john/panoptes-nix";
-  repoBranch = "main";
-  homePath = "/home/${userSettings.username}";
-  repoPath = "${homePath}/${systemSettings.hostName}";
+  homePath = "/srv/panoptes";
+  repoURL = "https://gitea.john-stream.com/john/loki-nix";
+  repoBranch = "reorg";
 in
 {
   nixpkgs.config.allowUnfree = true;
@@ -19,26 +18,22 @@ in
     extraConfig.credential.helper = "store --file ~/.git-credentials";
     userName = "${userSettings.gitUserName}";
     userEmail = "${userSettings.gitUserEmail}";
-    extraConfig.safe.directory = "${repoPath}";
+    extraConfig.safe.directory = "${homePath}";
   };
 
   programs.bash.enable = true;
   programs.ssh.enable = true;
 
   home = {
-    stateVersion = "${systemSettings.stateVersion}";
-    username = "${userSettings.username}";
     homeDirectory = "${homePath}";
-    packages = with pkgs; [
-      (writeShellScriptBin "nfs" ''
-        sudo nixos-rebuild switch --flake ${repoPath}#${systemSettings.hostName} --impure
+    packages = [
+      (pkgs.writeShellScriptBin "nfs" ''
+        sudo nixos-rebuild switch --flake ${homePath}#${hostName} --impure
       '')
-      (writeShellScriptBin "nhs" ''
-        home-manager switch --flake ${repoPath}#${userSettings.username}
-      '')
-      (writeShellScriptBin "init-panoptes" ''
-        sudo -u ${userSettings.username} git clone -b ${repoBranch} ${repoURL} ${repoPath}
+      (pkgs.writeShellScriptBin "init-panoptes" ''
+        sudo -u git clone -b ${repoBranch} ${repoURL} /srv/panoptes
       '')
+      git
     ];
   };
 

nixosModules/caddy.nix

@@ -1,27 +0,0 @@
-{ config, pkgs, ... }:
-{
-  sops.secrets.cloudflare-api-key = {};
-
-  # https://nixos.wiki/wiki/Caddy
-  services.caddy = {
-    enable = true;
-    environmentFile = config.sops.secrets.cloudflare-api-key.path;
-    virtualHosts."panoptes.john-stream.com".extraConfig = ''
-      reverse_proxy 192.168.1.110:8000
-      tls {
-        dns cloudflare {env.CF_API_TOKEN}
-      }
-    '';
-    package = pkgs.caddy.withPlugins {
-      plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  # systemd.services.caddy.serviceConfig = {
-  #   # EnvironmentFile = "/etc/caddy/cloudflare.env";
-  #   AmbientCapabilities = "CAP_NET_BIND_SERVICE";
-  # };
-}

nixosModules/cloudflared.nix

@@ -1,38 +0,0 @@
-{ config, pkgs, lib, ... }:
-# https://wiki.nixos.org/wiki/Cloudflared
-{
-  boot.kernel.sysctl."net.ipv4.ping_group_range" = "0 65535";
-  users.groups.cloudflared = {};
-  users.users.cloudflared = {
-    isSystemUser = true;
-    group = "cloudflared"; # Match allowed range
-  };
-
-  sops.secrets.cloudflared-creds = {};
-  environment.systemPackages = with pkgs; [ cloudflared ];
-  services.cloudflared = {
-    enable = true;
-    tunnels = {
-      "panoptes-nix" = {
-        credentialsFile = config.sops.secrets.cloudflared-creds.path;
-        # credentialsFile = /root/.cloudflared/c5d343b4-c12c-4490-9d92-9a2345738dc2.json;
-        default = "http_status:404";
-        ingress = {
-          "panoptes.john-stream.com" = {
-            service = "https://localhost:443";
-            # path = ".*";
-            originRequest = {
-              originServerName = "panoptes.john-stream.com";
-              noTLSVerify = true;
-            };
-          };
-        };
-      };
-    };
-  };
-  systemd.services.cloudflared-tunnel-panoptes-nix.serviceConfig = {
-    DynamicUser = lib.mkForce false;
-    User = "cloudflared";
-    Group = "cloudflared";
-  };
-}

nixosModules/default.nix

@@ -1,9 +1,19 @@
-{ ... }: {
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  outputs,
+  ...
+}: {
   imports =
     [
-      # ./caddy.nix
-      ./cloudflared.nix
       ./services/loki.nix
-      ./users.nix
     ];
+
+  config = {
+    nix.settings.experimental-features = ["nix-command" "flakes"];
+    programs.nix-ld.enable = true;
+    nixpkgs.config.allowUnfree = true;
+  };
 }

nixosModules/home-manager/git.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  programs.git = {
-    enable = true;
-    extraConfig.credential.helper = "store --file ~/.git-credentials";
-    userName = "John Lancaster";
-    userEmail = "32917998+jsl12@users.noreply.github.com";
-  };
-}

nixosModules/services/loki.nix

@@ -1,15 +1,14 @@
 { pkgs, config, ... }:
-let
-  lokiPort = config.services.loki.configuration.server.http_listen_port;
-in
 {
-  networking.firewall.allowedTCPPorts = [ lokiPort ];
+  networking.firewall.allowedTCPPorts = [
+    config.services.loki.configuration.server.http_listen_port
+  ];
 
   environment.systemPackages = with pkgs; [
     (pkgs.writeShellScriptBin "loki-check" ''
-      curl http://localhost:${builtins.toString lokiPort}/ready
+      curl http://localhost:${config.services.loki.configuration.server.http_listen_port}/ready
     '')
-    (pkgs.writeShellScriptBin "loki-watch" "journalctl -b -u loki.service -n 10 -f")
+    (pkgs.writeShellScriptBin "loki-logs" "journalctl -b -u loki.service -n 10")
   ];
   
   services.loki = {

nixosModules/users.nix

@@ -1,30 +0,0 @@
-{ pkgs, config, userSettings, ... }:
-{
-  # Uses rust-based sudo
-  security.sudo-rs = {
-    enable = true;
-    execWheelOnly = false;
-    wheelNeedsPassword = false; # allows sudo without password for those in the wheel group
-  };
-
-  users.users.root = {
-    isSystemUser = true;
-    extraGroups = [
-      "wheel"   # needed for sudo without password
-      "docker"  # needed for docker without sudo
-    ];
-    openssh.authorizedKeys.keyFiles = [ ../secrets/authorized_keys ];
-  };
-
-  home-manager = {
-    useGlobalPkgs = true;
-    users.root = {
-      home.stateVersion = config.system.stateVersion;
-      imports = [ ./home-manager/git.nix ];
-      programs.vscode = {
-        enable = true;
-        package = pkgs.vscode.fhs;
-      };
-    };
-  };
-}

scripts/default.nix

@@ -1,24 +0,0 @@
-{ pkgs, systemSettings, ... }:
-{
-  environment.systemPackages = with pkgs; [
-    (pkgs.writeShellScriptBin "nfs" ''
-      sudo nixos-rebuild switch --flake $(readlink -f /etc/nixos)#${systemSettings.hostName} --impure
-    '')
-    (pkgs.writeShellScriptBin "nfsu" ''
-      FLAKE=$(readlink -f /etc/nixos)
-      nix flake update --flake $FLAKE --impure
-      git -C $FLAKE add "$FLAKE/flake.lock" > /dev/null 2>&1
-      sudo nixos-rebuild switch --flake $FLAKE#${systemSettings.hostName} --impure
-    '')
-    (pkgs.writeShellScriptBin "edit-secrets" "sudo sops $(readlink -f /etc/nixos)/secrets/encrypted_secrets.yaml")
-    (pkgs.writeShellScriptBin "public-age-key" ''
-      nix run nixpkgs#ssh-to-age -- -i /etc/ssh/ssh_host_ed25519_key.pub
-    '')
-    (pkgs.writeShellScriptBin "private-age-key" ''
-      sudo mkdir -p ~/.config/sops/age
-      sudo nix run nixpkgs#ssh-to-age -- -private-key -i /etc/ssh/ssh_host_ed25519_key > ~/.config/sops/age/keys.txt
-      sudo chown -R 0:0 ~/.config
-      sudo chmod -R 600 ~/.config/sops
-    '')
-  ];
-}

secrets/authorized_keys

@@ -1,3 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIaHS9CLiDc6T1tja0fBwwv5qc6iwuckWN6w8MNo5yiR8LPWyrfueowNJkL4HMqu6OEuggtdybGw1Do4sW5o+toHCyWfZf3khI1l15opPXuVpD4CWED+SpJiZ0wBgRaCaWhfxLI+s4JOhjOO2OjiClPX3HfxIHyTpRiR78lOMcIieHSnzrAV2MatYKf6lL2ckOsIPwxo/OVM+1ljjX+HLq9IxGUCpWOnF4nF1rq3gKL2JUh2KsrgrzE3NB7EFuqKm8F0tF2rG3JjSvlwox0h06drKD02lpZWXPOBRlcyFDpNXymmc2bpG0S2Bbj5g+pqNBB0jO0h3kzWvYYqrtU/ElObg1cXhyi0PFOhhptlbhbK0Ao8B+pAbSZ661nMT3jpRWLVbnJrRFnXXdjX08r5eseQ3k4CFpv+g64n7yg3IMo9f8gA9P/hOexR+qu5AQ1Ad/tvkp6pPXnR/zsUnbe4p2A9MaNJm4E1zxbs5VGlXynNikXwDL+spkrnjwdfUULTk= john@JOHN-PC
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFn5ilhqaeDsOWSk7y29se2NvxGm8djlfL3RGLokj0q6 john@john-p14s
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDHh9SBuxU2dOJHnpGZAE4cwe0fXcTBBAx+JmRsmIX+Tk8zooeM32vbNxxSXiZNpBGH5wzHNb534dWexGGG3sOaONmcL7SCoPIvaAdnIn5VsiznerLrzppSbx3Qn8eyF97WAGCcOcIUNmTIDDx1m6zG762WQnoaUEy0Ul5IR7ET5GQxP3p5Qwx8yqfixKDwarvV421sUIxYt9gee31jS9jcI3MFd6EL57hWle95Z8BGpR/Q7sXDBTZQWMZauh5NPwLMZS7k3bHgxXZ7WNOw/J/yts1ckBbvIFJSRNnMuWD0oGnDTL6aivGi+Eiswp0fpKzYGzquB3/wr3VU4G1JcMM5 JuiceSSH

secrets/encrypted_secrets.yaml

@@ -1,17 +0,0 @@
-cloudflare-api-key: ENC[AES256_GCM,data:ktlEznpdv7H6+w7vPe+0ylHdNR9ODZe2TMRiKs5RMEmblqMsvZTiCG5J/54cjaGwgwPHdw02pwc=,iv:H4YoS7sqxl9MBmwYb6N7pA/hGm21AyYgBQv64dSQU/o=,tag:93Ah+xReidRHuhvnuMWqdQ==,type:str]
-cloudflared-creds: ENC[AES256_GCM,data:O0gfegXK/qCZRwgf6I3PTu6wV8dcvLE8Bz4vdoNAqofY3SKVuP0O1xgP+tOZ4kI9Eow/q9EOmDR5sVUTls89515EY9PE/3PG7OmGMK1hRFH63kvXAa9ElUP0W2NU2mtz48qex8DQ12cMBX49C2gvJ9ezhPp930nB+deGb4XOzBuzvixexiEXixyTdOVzjxDULEQL+C2v+HFJP8XncoqjReNSwUg0Xv13TobQdnzHRlM=,iv:bHBu+vGvOKtIb1asfxOlRPk27/3b5vqyqPjV02Z7xk8=,tag:04ey2e4txAoQzhuqWjjmWw==,type:str]
-sops:
-    age:
-        - recipient: age102mctuw7xvs3fakft0mlfh740kc6rdaqqgmmwf400c4g3spefyjqrfmwct
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJSjV4NFo4eFRKck05NWpZ
-            ZmU4QlA2T3lKVzd0M1VhaHRhWXJXQ2U5OHpNCnVPaGtIYVF3MzJjek1iYUFGOFdz
-            bisrRTlOMFYxczI5VUhSWjk5c3MyUVUKLS0tIGpSOStsRTlQaUxkWlpZUUJEMVpK
-            ZnExa3NseGRrdXcrNTN4YkVSa2d6SDAKlzXHOUKAjNxY/okZJQurTpeaZUjjnyp/
-            OrvFMTxuMfK+EIIgj6WTm23ZKV4vmk0q0yboS4eXgDZTEB79tKxgyA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-27T06:37:54Z"
-    mac: ENC[AES256_GCM,data:RWtEhFz2rVae8RZImbcMCwRjv1Zmn0CAKa3O+RU4dEujLxLbu8NGyqJUi5iCloubetTzdAIvYd43Z0bxLQSPyZzCrRAwe6M7t0MMAwpbJnM8oPWzdciotCz4JRiegKTfpYMWx6s+Ixa+b7Dohj76zpToU3c39+llbN1/suGPIUw=,iv:+6cAZt6Nf514YK5yFTVmjL+XE85+bSb7phjFcKe+4j8=,tag:KAYnzouBVLSUI9ScX9tnog==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2