1 Commits

Author SHA1 Message Date
Claude a5a6297be8 ci: test status check registration 2026-04-17 20:02:03 +00:00
16 changed files with 49 additions and 917 deletions
@@ -3,7 +3,7 @@ name: Check NixOS Config
on:
pull_request:
push:
branches: [master]
branches: [main]
workflow_dispatch:
jobs:
-1
View File
@@ -1 +0,0 @@
flake.lock
+15 -41
View File
@@ -5,22 +5,8 @@
./hardware-configuration.nix
./packages.nix
./desktop.nix
./niri.nix
./nvidia.nix
./shell.nix
./yami-dev-stack.nix
./gaming.nix
];
nixpkgs.overlays = [
(final: prev: {
pkgsi686Linux = prev.pkgsi686Linux.extend (final': prev': {
openldap = prev'.openldap.overrideAttrs (_old: {
doCheck = false;
doInstallCheck = false;
});
});
})
];
nix = {
@@ -34,7 +20,7 @@
};
boot = {
kernelPackages = pkgs.linuxPackages;
kernelPackages = pkgs.linuxPackages_zen;
loader = {
efi.canTouchEfiVariables = true;
systemd-boot.enable = false;
@@ -58,11 +44,11 @@
fsType = "ext4";
options = [ "nosuid" "nodev" "nofail" ];
};
#"/mnt/wd_blue" = {
# device = "/dev/disk/by-uuid/91feabaf-ea5f-490e-9925-56f7c05e7110";
# fsType = "ext4";
# options = [ "nosuid" "nodev" "nofail" ];
#};
"/mnt/wd_blue" = {
device = "/dev/disk/by-uuid/91feabaf-ea5f-490e-9925-56f7c05e7110";
fsType = "ext4";
options = [ "nosuid" "nodev" "nofail" ];
};
};
networking = {
@@ -70,12 +56,6 @@
networkmanager.enable = true;
};
hardware.bluetooth = {
enable = true;
powerOnBoot = true;
};
services.blueman.enable = true;
time.timeZone = "Europe/Moscow";
i18n = {
@@ -96,31 +76,25 @@
users.users.chexit = {
isNormalUser = true;
description = "chexit";
shell = pkgs.fish;
shell = pkgs.zsh;
extraGroups = [ "networkmanager" "wheel" "docker" ];
};
programs._1password.enable = true;
programs._1password-gui = {
enable = true;
polkitPolicyOwners = [ "chexit" ];
};
programs.throne = {
enable = true;
tunMode.enable = true;
};
programs.steam = {
enable = true;
remotePlay.openFirewall = true;
dedicatedServer.openFirewall = true;
};
programs.gamemode.enable = true;
services.tailscale.enable = true;
# Docker is now managed by yami-dev-stack.nix when that module is enabled.
# services.yami-dev-stack = { enable = true; user = "chexit"; };
services.yami-dev-stack = {
enable = true;
user = "chexit";
dataDir = "/mnt/ssd_110/yami";
};
virtualisation.docker.enable = true;
system.stateVersion = "25.11";
}
Generated
+7 -131
View File
@@ -1,63 +1,5 @@
{
"nodes": {
"codex-cli-nix": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1779385571,
"narHash": "sha256-qvJmkFUHLb0lWUHguEpcFh5sBUSSBzkjGimWkh7RMfQ=",
"owner": "sadjow",
"repo": "codex-cli-nix",
"rev": "1b8816f0f793031ee98c928ae7a3bcca2f0b54c0",
"type": "github"
},
"original": {
"owner": "sadjow",
"repo": "codex-cli-nix",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"helium-browser": {
"inputs": {
"nixpkgs": [
"nixpkgs"
],
"utils": "utils"
},
"locked": {
"lastModified": 1779508010,
"narHash": "sha256-7Wcp38Saw8cnyfc1OyjsxiF0btKBaL5KcHV+q9ljsns=",
"owner": "schembriaiden",
"repo": "helium-browser-nix-flake",
"rev": "4e6b8bdd6692db7f2357e4dd86444914e53ec095",
"type": "github"
},
"original": {
"owner": "schembriaiden",
"repo": "helium-browser-nix-flake",
"type": "github"
}
},
"home-manager": {
"inputs": {
"nixpkgs": [
@@ -65,11 +7,11 @@
]
},
"locked": {
"lastModified": 1779507042,
"narHash": "sha256-7wOwi8B6D0BYsieZCnHZZj2sNUzgJhLoIVSfkwB7lxQ=",
"lastModified": 1776454077,
"narHash": "sha256-7zSUFWsU0+jlD7WB3YAxQ84Z/iJurA5hKPm8EfEyGJk=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "509ed3c603349a9d43de9e2ae6613baea6bd5b34",
"rev": "565e5349208fe7d0831ef959103c9bafbeac0681",
"type": "github"
},
"original": {
@@ -80,27 +22,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1779259093,
"narHash": "sha256-7DKWmH23hL2eYdkxCKeqj2i+yljTKuU+3Nk1UPHOnxc=",
"lastModified": 1776169885,
"narHash": "sha256-l/iNYDZ4bGOAFQY2q8y5OAfBBtrDAaPuRQqWaFHVRXM=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "d99b013d5d1931ad77fe3912ed218170dec5d9a4",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixpkgs-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1779508470,
"narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "29916453413845e54a65b8a1cf996842300cd299",
"rev": "4bd9165a9165d7b5e33ae57f3eecbcb28fb231c9",
"type": "github"
},
"original": {
@@ -112,58 +38,8 @@
},
"root": {
"inputs": {
"codex-cli-nix": "codex-cli-nix",
"helium-browser": "helium-browser",
"home-manager": "home-manager",
"nixpkgs": "nixpkgs_2"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"systems_2": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"utils": {
"inputs": {
"systems": "systems_2"
},
"locked": {
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
"nixpkgs": "nixpkgs"
}
}
},
+2 -22
View File
@@ -7,25 +7,11 @@
url = "github:nix-community/home-manager";
inputs.nixpkgs.follows = "nixpkgs";
};
helium-browser = {
url = "github:schembriaiden/helium-browser-nix-flake";
inputs.nixpkgs.follows = "nixpkgs";
};
codex-cli-nix.url = "github:sadjow/codex-cli-nix";
};
outputs = { nixpkgs, home-manager, helium-browser, codex-cli-nix, ... }:
let
system = "x86_64-linux";
pkgs = nixpkgs.legacyPackages.${system};
in
{
outputs = { nixpkgs, home-manager, ... }: {
nixosConfigurations.chexit = nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = {
helium = helium-browser.packages.${system}.helium;
codex = codex-cli-nix.packages.${system}.default;
};
system = "x86_64-linux";
modules = [
./configuration.nix
home-manager.nixosModules.home-manager
@@ -37,11 +23,5 @@
}
];
};
devShells.${system}.default = pkgs.mkShell {
buildInputs = [
codex-cli-nix.packages.${system}.default
];
};
};
}
-32
View File
@@ -1,32 +0,0 @@
{ pkgs, ... }:
{
programs.steam = {
enable = true;
remotePlay.openFirewall = true;
dedicatedServer.openFirewall = true;
};
programs.gamemode.enable = true;
services.udev.extraRules = ''
# DualSense: тачпад не должен работать как мышь рабочего стола.
# Steam Input/SDL читают геймпад (включая тачпад) через hidraw,
# так что в играх он останется доступен как тачпад контроллера.
SUBSYSTEM=="input", ATTRS{name}=="Sony Interactive Entertainment DualSense Wireless Controller Touchpad", ENV{LIBINPUT_IGNORE_DEVICE}="1", ENV{ID_INPUT_MOUSE}="0", ENV{ID_INPUT_TOUCHPAD}="0"
SUBSYSTEM=="input", ATTRS{name}=="DualSense Wireless Controller Touchpad", ENV{LIBINPUT_IGNORE_DEVICE}="1", ENV{ID_INPUT_MOUSE}="0", ENV{ID_INPUT_TOUCHPAD}="0"
'';
environment.systemPackages = with pkgs; [
dualsensectl
protonup-qt
prismlauncher
lutris
winetricks
wineWow64Packages.stagingFull
dxvk
vkd3d-proton
mangohud
gamemode
];
}
+8 -33
View File
@@ -1,47 +1,22 @@
{ ... }:
{ pkgs, ... }:
{
home.username = "chexit";
home.homeDirectory = "/home/chexit";
home.stateVersion = "25.11";
programs.fish = {
programs.zsh = {
enable = true;
enableCompletion = true;
autosuggestion.enable = true;
syntaxHighlighting.enable = true;
initContent = ''
source ${pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k/powerlevel10k.zsh-theme
'';
shellAliases = {
rebuild = "sudo nixos-rebuild switch --flake ~/nixos-config#chexit";
};
};
programs.starship = {
enable = true;
enableFishIntegration = true;
};
programs.alacritty = {
enable = true;
settings = {
window = {
padding = { x = 10; y = 10; };
opacity = 0.95;
decorations = "None";
};
font = {
normal = { family = "JetBrainsMono Nerd Font"; style = "Regular"; };
size = 11;
};
colors = {
primary = { background = "#1e1e2e"; foreground = "#cdd6f4"; };
};
};
};
xdg.configFile = {
"niri/config.kdl".source = ./niri/config.kdl;
"waybar/config.jsonc".source = ./niri/waybar/config.jsonc;
"waybar/style.css".source = ./niri/waybar/style.css;
"mako/config".source = ./niri/mako/config;
"fuzzel/fuzzel.ini".source = ./niri/fuzzel/fuzzel.ini;
};
programs.home-manager.enable = true;
}
-43
View File
@@ -1,43 +0,0 @@
{ pkgs, ... }:
{
programs.niri.enable = true;
environment.systemPackages = with pkgs; [
# terminal + launcher
alacritty
fuzzel
# bar, notifications, wallpaper
waybar
mako
swaybg
# screenshots + clipboard
grim
slurp
swappy
wl-clipboard
# lock + idle
swaylock-effects
swayidle
wlogout
# XWayland shim for niri
xwayland-satellite
# tray + system utilities
networkmanagerapplet
pavucontrol
playerctl
brightnessctl
libnotify
xdg-utils
];
environment.sessionVariables = {
XDG_CURRENT_DESKTOP = "niri";
XDG_SESSION_DESKTOP = "niri";
};
}
-201
View File
@@ -1,201 +0,0 @@
// niri configuration
// docs: https://github.com/YaLTeR/niri/wiki/Configuration:-Overview
input {
keyboard {
xkb {
layout "us"
}
repeat-delay 300
repeat-rate 40
}
touchpad {
tap
dwt
natural-scroll
accel-speed 0.2
}
mouse {
accel-speed 0.0
}
warp-mouse-to-focus
}
output "*" {
// let niri autodetect; override here per-monitor if needed
}
layout {
gaps 12
center-focused-column "never"
preset-column-widths {
proportion 0.33333
proportion 0.5
proportion 0.66667
}
default-column-width { proportion 0.5; }
focus-ring {
width 2
active-color "#7fc8ff"
inactive-color "#3a3a3a"
}
border {
off
}
struts {
left 8
right 8
top 4
bottom 4
}
}
cursor {
xcursor-theme "Adwaita"
xcursor-size 24
}
prefer-no-csd
screenshot-path "~/Pictures/Screenshots/Screenshot-%Y-%m-%d-%H%M%S.png"
hotkey-overlay {
skip-at-startup
}
environment {
DISPLAY ":0"
QT_QPA_PLATFORM "wayland;xcb"
GDK_BACKEND "wayland,x11"
MOZ_ENABLE_WAYLAND "1"
_JAVA_AWT_WM_NONREPARENTING "1"
}
spawn-at-startup "xwayland-satellite"
spawn-at-startup "waybar"
spawn-at-startup "mako"
spawn-at-startup "swaybg" "-c" "#1e1e2e"
spawn-at-startup "nm-applet" "--indicator"
spawn-at-startup "swayidle" "-w" \
"timeout" "600" "swaylock -f" \
"timeout" "900" "niri msg action power-off-monitors" \
"before-sleep" "swaylock -f"
window-rule {
geometry-corner-radius 8
clip-to-geometry true
}
window-rule {
match app-id="^org\\.keepassxc\\.KeePassXC$"
match app-id="^1Password$"
block-out-from "screen-capture"
}
binds {
Mod+Shift+Slash { show-hotkey-overlay; }
// launchers
Mod+Return { spawn "alacritty"; }
Mod+D { spawn "fuzzel"; }
Mod+E { spawn "dolphin"; }
Mod+B { spawn "firefox"; }
Mod+Ctrl+L { spawn "swaylock" "-f"; }
Mod+Shift+Escape { spawn "wlogout"; }
// media keys
XF86AudioRaiseVolume allow-when-locked=true { spawn "wpctl" "set-volume" "-l" "1.0" "@DEFAULT_AUDIO_SINK@" "5%+"; }
XF86AudioLowerVolume allow-when-locked=true { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "5%-"; }
XF86AudioMute allow-when-locked=true { spawn "wpctl" "set-mute" "@DEFAULT_AUDIO_SINK@" "toggle"; }
XF86AudioMicMute allow-when-locked=true { spawn "wpctl" "set-mute" "@DEFAULT_AUDIO_SOURCE@" "toggle"; }
XF86AudioPlay { spawn "playerctl" "play-pause"; }
XF86AudioPause { spawn "playerctl" "play-pause"; }
XF86AudioNext { spawn "playerctl" "next"; }
XF86AudioPrev { spawn "playerctl" "previous"; }
XF86MonBrightnessUp { spawn "brightnessctl" "set" "5%+"; }
XF86MonBrightnessDown { spawn "brightnessctl" "set" "5%-"; }
// window management
Mod+Q { close-window; }
Mod+Left { focus-column-left; }
Mod+Right { focus-column-right; }
Mod+Up { focus-window-up; }
Mod+Down { focus-window-down; }
Mod+H { focus-column-left; }
Mod+L { focus-column-right; }
Mod+K { focus-window-up; }
Mod+J { focus-window-down; }
Mod+Ctrl+Left { move-column-left; }
Mod+Ctrl+Right { move-column-right; }
Mod+Ctrl+Up { move-window-up; }
Mod+Ctrl+Down { move-window-down; }
Mod+Ctrl+H { move-column-left; }
Mod+Ctrl+L { move-column-right; }
Mod+Ctrl+K { move-window-up; }
Mod+Ctrl+J { move-window-down; }
Mod+Home { focus-column-first; }
Mod+End { focus-column-last; }
Mod+Page_Down { focus-workspace-down; }
Mod+Page_Up { focus-workspace-up; }
Mod+U { focus-workspace-down; }
Mod+I { focus-workspace-up; }
Mod+Shift+Page_Down { move-column-to-workspace-down; }
Mod+Shift+Page_Up { move-column-to-workspace-up; }
Mod+Shift+U { move-column-to-workspace-down; }
Mod+Shift+I { move-column-to-workspace-up; }
Mod+1 { focus-workspace 1; }
Mod+2 { focus-workspace 2; }
Mod+3 { focus-workspace 3; }
Mod+4 { focus-workspace 4; }
Mod+5 { focus-workspace 5; }
Mod+6 { focus-workspace 6; }
Mod+7 { focus-workspace 7; }
Mod+8 { focus-workspace 8; }
Mod+9 { focus-workspace 9; }
Mod+Shift+1 { move-column-to-workspace 1; }
Mod+Shift+2 { move-column-to-workspace 2; }
Mod+Shift+3 { move-column-to-workspace 3; }
Mod+Shift+4 { move-column-to-workspace 4; }
Mod+Shift+5 { move-column-to-workspace 5; }
Mod+Shift+6 { move-column-to-workspace 6; }
Mod+Shift+7 { move-column-to-workspace 7; }
Mod+Shift+8 { move-column-to-workspace 8; }
Mod+Shift+9 { move-column-to-workspace 9; }
Mod+Comma { consume-window-into-column; }
Mod+Period { expel-window-from-column; }
Mod+R { switch-preset-column-width; }
Mod+F { maximize-column; }
Mod+Shift+F { fullscreen-window; }
Mod+C { center-column; }
Mod+Minus { set-column-width "-10%"; }
Mod+Equal { set-column-width "+10%"; }
Mod+Shift+Minus { set-window-height "-10%"; }
Mod+Shift+Equal { set-window-height "+10%"; }
// screenshots
Print { screenshot; }
Ctrl+Print { screenshot-screen; }
Alt+Print { screenshot-window; }
// session
Mod+Shift+E { quit; }
Mod+Shift+P { power-off-monitors; }
}
-23
View File
@@ -1,23 +0,0 @@
font=JetBrainsMono Nerd Font:size=12
dpi-aware=yes
terminal=alacritty
prompt=" "
icon-theme=Adwaita
width=40
lines=12
horizontal-pad=20
vertical-pad=14
inner-pad=10
[colors]
background=1e1e2eee
text=cdd6f4ff
match=f9e2afff
selection=89b4faff
selection-text=1e1e2eff
selection-match=1e1e2eff
border=89b4faff
[border]
width=2
radius=10
-20
View File
@@ -1,20 +0,0 @@
font=JetBrainsMono Nerd Font 10
background-color=#1e1e2eee
text-color=#cdd6f4
border-color=#89b4fa
border-size=2
border-radius=8
padding=12
margin=8
default-timeout=5000
ignore-timeout=1
max-visible=5
layer=overlay
anchor=top-right
[urgency=low]
border-color=#6c7086
[urgency=high]
border-color=#f38ba8
default-timeout=0
-77
View File
@@ -1,77 +0,0 @@
{
"layer": "top",
"position": "top",
"height": 30,
"spacing": 6,
"margin-top": 4,
"margin-left": 8,
"margin-right": 8,
"modules-left": ["niri/workspaces", "niri/window"],
"modules-center": ["clock"],
"modules-right": [
"tray",
"network",
"pulseaudio",
"cpu",
"memory",
"custom/power"
],
"niri/workspaces": {
"format": "{icon}",
"format-icons": {
"default": "",
"active": "",
"urgent": ""
}
},
"niri/window": {
"format": "{title}",
"max-length": 80,
"separate-outputs": true
},
"clock": {
"format": "{:%a %d %b %H:%M}",
"tooltip-format": "<tt><small>{calendar}</small></tt>"
},
"cpu": {
"format": " {usage}%",
"interval": 2
},
"memory": {
"format": " {used:0.1f}G",
"interval": 5
},
"network": {
"format-wifi": " {essid}",
"format-ethernet": " {ifname}",
"format-disconnected": "⚠ offline",
"tooltip-format": "{ifname} · {ipaddr}"
},
"pulseaudio": {
"format": "{icon} {volume}%",
"format-muted": " muted",
"format-icons": {
"default": ["", "", ""]
},
"on-click": "pavucontrol"
},
"tray": {
"icon-size": 16,
"spacing": 8
},
"custom/power": {
"format": "⏻",
"tooltip": false,
"on-click": "wlogout"
}
}
-62
View File
@@ -1,62 +0,0 @@
* {
font-family: "JetBrainsMono Nerd Font", "Geist", sans-serif;
font-size: 13px;
border: none;
border-radius: 0;
min-height: 0;
}
window#waybar {
background: rgba(30, 30, 46, 0.85);
color: #cdd6f4;
border-radius: 10px;
}
#workspaces button {
padding: 0 8px;
color: #9399b2;
background: transparent;
border-radius: 6px;
}
#workspaces button.active {
color: #1e1e2e;
background: #89b4fa;
}
#workspaces button.urgent {
background: #f38ba8;
color: #1e1e2e;
}
#window,
#clock,
#cpu,
#memory,
#network,
#pulseaudio,
#tray,
#custom-power {
padding: 0 10px;
margin: 4px 2px;
border-radius: 6px;
background: rgba(49, 50, 68, 0.6);
}
#clock {
color: #f9e2af;
font-weight: 600;
}
#custom-power {
color: #f38ba8;
padding: 0 12px;
}
#network.disconnected {
color: #f38ba8;
}
#pulseaudio.muted {
color: #6c7086;
}
+4 -10
View File
@@ -1,4 +1,4 @@
{ pkgs, helium, codex, ... }:
{ pkgs, ... }:
{
nixpkgs.config.allowUnfree = true;
@@ -9,32 +9,26 @@
git
htop
btop
nvtopPackages.nvidia
ntfs3g
kdePackages.qtstyleplugin-kvantum
kdePackages.kate
# soft
helium
firefox
vesktop
materialgram
termius
throne
spotify
thunderbird
openvpn
# dev
vscode
zed-editor
docker-compose
codex
jetbrains.rust-rover
# media / gpu utils
gpu-screen-recorder-gtk
# gaming / media
libva-utils
vdpauinfo
lazydocker
mangohud
];
}
+1 -1
View File
@@ -1,5 +1,5 @@
{ ... }:
{
programs.fish.enable = true;
programs.zsh.enable = true;
}
-208
View File
@@ -1,208 +0,0 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.yami-dev-stack;
in
{
options.services.yami-dev-stack = {
enable = mkEnableOption "Yami development stack (gitea, postgres, docker, runner)";
user = mkOption {
type = types.str;
description = "User that will own runner token and be added to docker group";
};
dataDir = mkOption {
type = types.nullOr types.path;
default = null;
example = "/mnt/ssd_110/yami";
description = ''
If set, bind-mounts /var/lib/{gitea,postgresql,gitea-runner} under this
path so all stack data lives on a separate disk. Directories are created
automatically; existing data must be rsync'd manually before enabling.
'';
};
};
config = mkIf cfg.enable (mkMerge [ {
# ── Systemd target ─────────────────────────────────────────────────────────
# Manual-only: nothing in wantedBy, so it never starts on boot.
systemd.targets.yami-dev = {
description = "Yami development stack (gitea, postgres, docker, runner)";
wantedBy = [ ];
};
# ── PostgreSQL 16 ──────────────────────────────────────────────────────────
services.postgresql = {
enable = true;
package = pkgs.postgresql_16;
ensureDatabases = [ "gitea" ];
ensureUsers = [
{
name = "gitea";
ensureDBOwnership = true;
}
];
};
# Pull postgres under yami-dev.target; stop it when target stops.
systemd.services.postgresql = {
wantedBy = mkForce [ "yami-dev.target" ];
partOf = [ "yami-dev.target" ];
};
# ── Gitea ──────────────────────────────────────────────────────────────────
services.gitea = {
enable = true;
appName = "Yami Git";
# LFS enabled via the NixOS helper so the module manages LFS_JWT_SECRET
# (writing it to app.ini, which is read-only by design).
lfs.enable = true;
database = {
type = "postgres";
socket = "/run/postgresql";
name = "gitea";
user = "gitea";
};
settings = {
server = {
DOMAIN = "localhost";
ROOT_URL = "http://localhost:3000/";
HTTP_ADDR = "0.0.0.0";
HTTP_PORT = 3000;
SSH_PORT = 2222;
START_SSH_SERVER = true;
};
service = {
DISABLE_REGISTRATION = true;
DEFAULT_KEEP_EMAIL_PRIVATE = true;
};
repository = {
DEFAULT_BRANCH = "main";
ENABLE_PUSH_CREATE_USER = true;
ENABLE_PUSH_CREATE_ORG = true;
};
actions = {
ENABLED = true;
DEFAULT_ACTIONS_URL = "github";
LOG_RETENTION_DAYS = 14;
ARTIFACT_RETENTION_DAYS = 30;
};
packages = {
ENABLED = true;
};
session = {
COOKIE_SECURE = false;
};
"cron.git_gc_repos" = {
ENABLED = true;
SCHEDULE = "@every 72h";
ARGS = "--aggressive --prune=now";
};
};
};
systemd.services.gitea = {
wantedBy = mkForce [ "yami-dev.target" ];
partOf = [ "yami-dev.target" ];
after = [ "postgresql.service" ];
requires = [ "postgresql.service" ];
};
# ── Docker ─────────────────────────────────────────────────────────────────
virtualisation.docker = {
enable = true;
enableOnBoot = false;
};
systemd.services.docker = {
wantedBy = mkForce [ "yami-dev.target" ];
partOf = [ "yami-dev.target" ];
};
users.users.${cfg.user}.extraGroups = [ "docker" ];
# ── Gitea Actions Runner ───────────────────────────────────────────────────
services.gitea-actions-runner.instances.default = {
enable = true;
name = "home-runner";
url = "http://localhost:3000";
# NOT under /var/lib/gitea-runner — that path is systemd-managed for the
# service (DynamicUser + StateDirectory means it becomes a symlink to
# /var/lib/private/gitea-runner). Pre-creating it ourselves breaks the
# service with "Failed to set up special execution directory: File exists".
tokenFile = "/var/lib/gitea-runner-secret/token";
labels = [
"ubuntu-latest:docker://node:20"
"native:host"
];
};
systemd.services."gitea-runner-default" = {
wantedBy = mkForce [ "yami-dev.target" ];
partOf = [ "yami-dev.target" ];
after = [ "gitea.service" "docker.service" ];
requires = [ "gitea.service" "docker.service" ];
};
# Runner uses DynamicUser, so there's no static gitea-runner user/group.
# Token lives in a sibling dir (not /var/lib/gitea-runner — that's systemd's
# StateDirectory and pre-creating it breaks DynamicUser bind setup).
# The file MUST be in env-file format, not a raw token:
# TOKEN=<paste-registration-token-from-gitea-ui>
# Get the token from Site Administration → Actions → Runners → Create new Runner.
systemd.tmpfiles.rules = [
"d /var/lib/gitea-runner-secret 0700 root root -"
];
# ── Shell aliases ──────────────────────────────────────────────────────────
environment.shellAliases = {
yami-up = "sudo systemctl start yami-dev.target && echo 'Gitea http://localhost:3000'";
yami-down = "sudo systemctl stop yami-dev.target && echo 'Yami dev stack stopped'";
yami-status = "systemctl status yami-dev.target gitea postgresql docker gitea-runner-default --no-pager";
yami-logs = "journalctl -u gitea -u gitea-runner-default -f";
};
# ── Firewall ───────────────────────────────────────────────────────────────
# Merged with existing rules (Steam etc.); does not overwrite them.
networking.firewall.allowedTCPPorts = [ 3000 2222 ];
}
# ── Optional: move all stack data to a separate disk via bind-mounts ─────────
(mkIf (cfg.dataDir != null) (
let
# gitea-runner intentionally NOT bind-mounted: its service uses
# DynamicUser + StateDirectory, which refuses to adopt an existing
# mount point ("Failed to set up special execution directory: File exists").
# Its data is tiny (token + .runner state) so it stays on the system disk.
subs = [ "gitea" "postgresql" ];
mkBind = name: {
name = "/var/lib/${name}";
value = {
device = "${cfg.dataDir}/${name}";
fsType = "none";
options = [ "bind" ];
};
};
in {
# Ensure target dirs exist on the data disk before mounts happen.
systemd.tmpfiles.rules = map (n: "d ${cfg.dataDir}/${n} 0755 root root -") subs
++ [ "d ${cfg.dataDir} 0755 root root -" ];
fileSystems = listToAttrs (map mkBind subs);
}
))
]);
}