Lint and format
This commit is contained in:
parent
9277dc6907
commit
9c0392359b
5 changed files with 68 additions and 64 deletions
|
|
@ -1,24 +1,25 @@
|
|||
{ pkgs, ... }:
|
||||
let strPalette = with pkgs.rice; pkgs.lib.rice.palette.toRgbHex rec {
|
||||
foreground = colorPalette.normal.white;
|
||||
background = colorPalette.normal.black;
|
||||
color0 = colorPalette.normal.black;
|
||||
color1 = colorPalette.normal.red;
|
||||
color2 = colorPalette.normal.green;
|
||||
color3 = colorPalette.normal.yellow;
|
||||
color4 = colorPalette.normal.blue;
|
||||
color5 = colorPalette.normal.magenta;
|
||||
color6 = colorPalette.normal.cyan;
|
||||
color7 = colorPalette.normal.white;
|
||||
color8 = colorPalette.bright.black;
|
||||
color9 = colorPalette.bright.red;
|
||||
color10 = colorPalette.bright.green;
|
||||
color11 = colorPalette.bright.yellow;
|
||||
color12 = colorPalette.bright.blue;
|
||||
color13 = colorPalette.bright.magenta;
|
||||
color14 = colorPalette.bright.cyan;
|
||||
color15 = colorPalette.bright.white;
|
||||
};
|
||||
let
|
||||
strPalette = with pkgs.rice; pkgs.lib.rice.palette.toRgbHex rec {
|
||||
foreground = colorPalette.normal.white;
|
||||
background = colorPalette.normal.black;
|
||||
color0 = colorPalette.normal.black;
|
||||
color1 = colorPalette.normal.red;
|
||||
color2 = colorPalette.normal.green;
|
||||
color3 = colorPalette.normal.yellow;
|
||||
color4 = colorPalette.normal.blue;
|
||||
color5 = colorPalette.normal.magenta;
|
||||
color6 = colorPalette.normal.cyan;
|
||||
color7 = colorPalette.normal.white;
|
||||
color8 = colorPalette.bright.black;
|
||||
color9 = colorPalette.bright.red;
|
||||
color10 = colorPalette.bright.green;
|
||||
color11 = colorPalette.bright.yellow;
|
||||
color12 = colorPalette.bright.blue;
|
||||
color13 = colorPalette.bright.magenta;
|
||||
color14 = colorPalette.bright.cyan;
|
||||
color15 = colorPalette.bright.white;
|
||||
};
|
||||
in
|
||||
{
|
||||
programs.kitty = {
|
||||
|
|
|
|||
|
|
@ -98,16 +98,19 @@ with lib;
|
|||
load printers = no
|
||||
smb encrypt = required
|
||||
'';
|
||||
shares = let common = {
|
||||
"public" = "no";
|
||||
"writeable" = "yes";
|
||||
"create mask" = "0700";
|
||||
"directory mask" = "2700";
|
||||
"browseable" = "yes";
|
||||
"guest ok" = "no";
|
||||
"read only" = "no";
|
||||
"force group" = "users";
|
||||
}; in
|
||||
shares =
|
||||
let
|
||||
common = {
|
||||
"public" = "no";
|
||||
"writeable" = "yes";
|
||||
"create mask" = "0700";
|
||||
"directory mask" = "2700";
|
||||
"browseable" = "yes";
|
||||
"guest ok" = "no";
|
||||
"read only" = "no";
|
||||
"force group" = "users";
|
||||
};
|
||||
in
|
||||
{
|
||||
bertof = recursiveUpdate common {
|
||||
path = "/mnt/raid0/bertof";
|
||||
|
|
@ -238,36 +241,39 @@ with lib;
|
|||
|
||||
|
||||
systemd.packages = with pkgs; [ syncthing ];
|
||||
systemd.services = let common = {
|
||||
documentation = [ "man:syncthing(1)" ];
|
||||
startLimitIntervalSec = 60;
|
||||
startLimitBurst = 4;
|
||||
after = [ "network.target" ];
|
||||
environment = { STNORESTART = "yes"; STNOUPGRADE = "yes"; };
|
||||
wantedBy = [ "default.target" ];
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
RestartSec = 1;
|
||||
SuccessExitStatus = "3 4";
|
||||
RestartForceExitStatus = "3 4";
|
||||
systemd.services =
|
||||
let
|
||||
common = {
|
||||
documentation = [ "man:syncthing(1)" ];
|
||||
startLimitIntervalSec = 60;
|
||||
startLimitBurst = 4;
|
||||
after = [ "network.target" ];
|
||||
environment = { STNORESTART = "yes"; STNOUPGRADE = "yes"; };
|
||||
wantedBy = [ "default.target" ];
|
||||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
RestartSec = 1;
|
||||
SuccessExitStatus = "3 4";
|
||||
RestartForceExitStatus = "3 4";
|
||||
|
||||
Group = config.ids.gids.users;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
CapabilityBoundingSet = [ "~CAP_SYS_PTRACE" "~CAP_SYS_ADMIN" "~CAP_SETGID" "~CAP_SETUID" "~CAP_SETPCAP" "~CAP_SYS_TIME" "~CAP_KILL" ];
|
||||
};
|
||||
}; in
|
||||
Group = config.ids.gids.users;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
CapabilityBoundingSet = [ "~CAP_SYS_PTRACE" "~CAP_SYS_ADMIN" "~CAP_SETGID" "~CAP_SETUID" "~CAP_SETPCAP" "~CAP_SYS_TIME" "~CAP_KILL" ];
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
syncthing-bertof = recursiveUpdate common {
|
||||
description = "Syncthing service bertof";
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@
|
|||
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/44c53e75-a00d-47bc-a99b-2544fe513e51";
|
||||
device = "/dev/disk/by-uuid/44c53e75-a00d-47bc-a99b-2544fe513e51";
|
||||
fsType = "btrfs";
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
boot.initrd.kernelModules = [ "i915" ];
|
||||
|
|
|
|||
|
|
@ -1,9 +1,6 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
boot.initrd.kernelModules = [ "i915" ];
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue