From 38819b3b236dccead73af27222376739169744d6 Mon Sep 17 00:00:00 2001 From: joshashtondev Date: Sat, 18 Jul 2026 16:17:19 -0600 Subject: [PATCH] refactor and bug fixes. --- flake.lock | 71 ++++++++++++++++++++++--- flake.nix | 14 +++-- home/jashton.nix | 106 ++++++++++++++++++++++++++++++++++++- home/programs/nvim.nix | 2 +- hosts/thinkpad/default.nix | 2 +- ports.registry | 1 + system/core/env.nix | 1 + system/network/default.nix | 5 ++ system/network/pi-hole.nix | 48 +++++++++++++++++ 9 files changed, 235 insertions(+), 15 deletions(-) create mode 100644 ports.registry create mode 100644 system/network/pi-hole.nix diff --git a/flake.lock b/flake.lock index 5a85087..d39e112 100644 --- a/flake.lock +++ b/flake.lock @@ -1,5 +1,23 @@ { "nodes": { + "flake-utils": { + "inputs": { + "systems": "systems" + }, + "locked": { + "lastModified": 1731533236, + "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, "home-manager": { "inputs": { "nixpkgs": [ @@ -7,41 +25,78 @@ ] }, "locked": { - "lastModified": 1779506708, - "narHash": "sha256-QOD/CNm196nCJRheux/URi4/HE66fthdOMqCJoPP1Y0=", + "lastModified": 1783740085, + "narHash": "sha256-qajyHfZY29G2oEQk+uHxmsJcRoBUBXP9maTpFlwP/dI=", "owner": "nix-community", "repo": "home-manager", - "rev": "3ee51fbdac8c8bdfe1e7e1fcaba6520a563f394f", + "rev": "3cd22efe6471dc7365c822bd9ad73a21e55f38fb", "type": "github" }, "original": { "owner": "nix-community", - "ref": "release-25.11", + "ref": "release-26.05", "repo": "home-manager", "type": "github" } }, + "linger": { + "inputs": { + "flake-utils": [ + "flake-utils" + ] + }, + "locked": { + "lastModified": 1670283645, + "narHash": "sha256-SuC/SuQ8RUaM6RthNAkNTSnlpRXJxEmuym2OyPLLpWk=", + "owner": "mindsbackyard", + "repo": "linger-flake", + "rev": "9f8632c0621dc562dd42e9eacfdb6dae82aebf8b", + "type": "github" + }, + "original": { + "owner": "mindsbackyard", + "repo": "linger-flake", + "type": "github" + } + }, "nixpkgs": { "locked": { - "lastModified": 1782847189, - "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=", + "lastModified": 1784280462, + "narHash": "sha256-DtoqIqM7VkR6NxAkcLpMwmi02USwWb3JdmNGLyhthc0=", "owner": "nixos", "repo": "nixpkgs", - "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41", + "rev": "293d6abedf0478e681a4dfcfcb35b30fc796a32f", "type": "github" }, "original": { "owner": "nixos", - "ref": "nixos-25.11", + "ref": "nixos-26.05", "repo": "nixpkgs", "type": "github" } }, "root": { "inputs": { + "flake-utils": "flake-utils", "home-manager": "home-manager", + "linger": "linger", "nixpkgs": "nixpkgs" } + }, + "systems": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } } }, "root": "root", diff --git a/flake.nix b/flake.nix index 56bdff5..15dfe2a 100644 --- a/flake.nix +++ b/flake.nix @@ -1,15 +1,21 @@ { - description = "My multi-device NixOS configuration."; + description = "System Configuration."; inputs = { - nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11"; + nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05"; + flake-utils.url = "github:numtide/flake-utils"; + + linger = { + url = "github:mindsbackyard/linger-flake"; + inputs.flake-utils.follows = "flake-utils"; + }; home-manager = { - url = "github:nix-community/home-manager/release-25.11"; + url = "github:nix-community/home-manager/release-26.05"; inputs.nixpkgs.follows = "nixpkgs"; }; }; - outputs = { self, nixpkgs, home-manager, ... }: { + outputs = { self, nixpkgs, flake-utils, home-manager, ... }: { nixosConfigurations = { thinkpad = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; diff --git a/home/jashton.nix b/home/jashton.nix index 1c4e6c7..a5379b3 100644 --- a/home/jashton.nix +++ b/home/jashton.nix @@ -24,12 +24,116 @@ claude-code discord freetube + gemini-cli intelli-shell jrnl keepass mc + scrot spotify + (pkgs.writeShellScriptBin "find-open-port" '' + if [ -z "$1" ]; then + echo "Please provide an application name, project directory, or other identifier." + echo " Usage: find-open-port $HOME/dev/some-project" + echo " Usage: find-open-port some-app" + + exit 1 + fi + + APP_NAME=$1 + REGISTRY_FILE=$HOME/.dotfiles/ports.registry + + MIN_PORT=8000 + MAX_PORT=8999 + MAX_RETRIES=50 + + echo "Searching for available port between $MIN_PORT and $MAX_PORT for $APP_NAME..." + + for ((i=1; i<=MAX_RETRIES; i++)); do + RANDOM_PORT=$(shuf -i $MIN_PORT-$MAX_PORT -n 1) + + if ! ss -tuln | grep -E -q ":$RANDOM_PORT\b"; then + if [ -f "$REGISTRY_FILE" ] && grep -q "\b$RANDOM_PORT\b" "$REGISTRY_FILE"; then + continue + fi + + echo "$APP_NAME : $RANDOM_PORT" >> "$REGISTRY_FILE" + echo -e "\nSuccessfully wrote '$APP_NAME : $RANDOM_PORT' to $REGISTRY_FILE" + exit 0 + fi + done + + echo -e "\nError: Could not find an open port between $MIN_PORT and $MAX_PORT after $MAX_RETRIES attempts." + exit 1 + '') + + (pkgs.writeShellScriptBin "wipe" '' + exit # Not ready for production use. + + LOG_FILE=/dev/null + + if [[ "$1" == "-l" || "$1" == "--log-file" && -f "$2" ]]; then + echo "Log file successfully set to $2" + LOG_FILE="$2" + fi + + if [[ "$1" == "-h" || "$1" == "--help" ]]; then + echo "wipe" + echo "Created by Josh Ashton" + echo "me@joshashton.dev\n" + echo "Run as root or sudo. Use with caution: this command will" + echo -e "irrevocably erase data.\n" + echo "Usage:" + echo -e " wipe\n Equivalent to running `wipe --dry-run`" + + echo -e " wipe { -h | --help }\n Print this help statement." + + echo -e " wipe { -f | --log-file } /path/to/filename.log /dev/target\n Set the log" + echo " location explicitly for the next or current use." + + echo -e " wipe --force /dev/target\nWipe the target drive without confirmation." + echo " Cannot be used with --all." + + echo -e " wipe --all\nAfter verifying system install disk to exclude, wipe all" + echo " other attached drives with appropriate methods by bus/media type." + echo " Cannot be used with --force." + + echo -e " wipe --dry-run /dev/target\nRefresh drive map and check if target is detected," + echo " frozen, or locked. Unfreeze if needed. Determine wipe type (ie. " + echo " nvme format /dev/target --ses=[0|1|2]; hdparm --security-erase /dev/target;" + echo " dd if=/dev/zero of=/dev/target bs=4M status=progress;) and write S.M.A.R.T." + echo " test to serial_number.log." + + echo -e " wipe --self\nSelf-destruct system disk. The same as wipe --self" + echo " --force. Use with extreme caution, for emergency use." + + echo -e "\n\nConfiguration Options:" + echo " wipe { -l | --log-dir } /path/to/log/location\n Set a default" + echo " location to save log files. The filenames will be" + echo " serial_number.log by default." + fi + + if -z "$1"; then + echo "TODO: Dry run." + fi + + if lsblk | grep -q "$1"; then + read -p "Target $1 found. Confirm Basic Secure Erase. (Y/n): " -r -n 1 + + if [[ "$REPLY" == "n" ]]; then + echo "Cancelling Basic Secure Erase." + exit + fi + + sudo nvme format "$1" --ses=1 --force | tee $LOG_FILE + sudo smartctl -a "$1" | tee -a $LOG_FILE + else + echo 1 > /sys/bus/pci/rescan + + fi + '') + (pkgs.writeShellScriptBin "lock-screen" '' # Color palette mapped to i3lock-color format (RRGGBBAA) BLANK="00000000" # Fully transparent @@ -135,6 +239,6 @@ ''; }; - home.stateVersion = "25.11"; # DO NOT CHANGE + home.stateVersion = "26.05"; # DO NOT CHANGE } diff --git a/home/programs/nvim.nix b/home/programs/nvim.nix index 72957f4..85f791f 100644 --- a/home/programs/nvim.nix +++ b/home/programs/nvim.nix @@ -7,7 +7,7 @@ vimAlias = true; defaultEditor = true; - extraLuaConfig = '' + initLua = '' vim.opt.number = true vim.opt.relativenumber = true vim.opt.tabstop = 2 diff --git a/hosts/thinkpad/default.nix b/hosts/thinkpad/default.nix index 489ffb1..4328a64 100644 --- a/hosts/thinkpad/default.nix +++ b/hosts/thinkpad/default.nix @@ -9,5 +9,5 @@ networking.hostName = "nix-pad"; - system.stateVersion = "25.11"; + system.stateVersion = "26.05"; } diff --git a/ports.registry b/ports.registry new file mode 100644 index 0000000..fe3f108 --- /dev/null +++ b/ports.registry @@ -0,0 +1 @@ +pi-hole : 8775 diff --git a/system/core/env.nix b/system/core/env.nix index b71ff26..f7f0816 100644 --- a/system/core/env.nix +++ b/system/core/env.nix @@ -29,6 +29,7 @@ unix = "sudo nixos-rebuild switch --flake $HOME/.dotfiles#thinkpad"; ehome = "nvim $HOME/.dotfiles/home/jashton.nix"; l = "ls -la"; + ports = "cat $HOME/.dotfiles/ports.registry"; }; ohMyZsh = { diff --git a/system/network/default.nix b/system/network/default.nix index 53418d1..198ed1d 100644 --- a/system/network/default.nix +++ b/system/network/default.nix @@ -1,6 +1,11 @@ { config, pkgs, ... }: { + + imports = [ + ./pi-hole.nix + ]; + networking = { networkmanager.enable = true; diff --git a/system/network/pi-hole.nix b/system/network/pi-hole.nix new file mode 100644 index 0000000..c9a5954 --- /dev/null +++ b/system/network/pi-hole.nix @@ -0,0 +1,48 @@ +{ config, pkgs, ... }: + +{ + + networking.networkmanager.insertNameservers = [ "127.0.0.1" ]; + + systemd.tmpfiles.rules = [ + "d /var/lib/pihole 0777 root root -" + "d /var/lib/pihole/etc 0777 root root -" + "d /var/lib/pihole/dnsmasq 0777 root root -" + ]; + + # Explicitly set the OCI container backend to Podman + virtualisation.oci-containers.backend = "podman"; + + # Define the Pi-Hole container + virtualisation.oci-containers.containers.pihole = { + image = "docker.io/pihole/pihole:latest"; + + ports = [ + "53:53/tcp" # DNS + "53:53/udp" # DNS + "8775:80/tcp" # Web UI + ]; + + volumes = [ + "/var/lib/pihole/etc:/etc/pihole" + "/var/lib/pihole/dnsmasq:/etc/dnsmasq.d" + ]; + + environment = { + TZ = "America/Denver"; + }; + + autoStart = true; + + # Extra Podman arguments for additional capabilities Pi-Hole requires + extraOptions = [ + "--cap-add=NET_ADMIN" + ]; + }; + + # Open the required ports in the NixOS firewall + networking.firewall = { + allowedTCPPorts = [ 53 80 ]; + allowedUDPPorts = [ 53 ]; + }; +}