{ inputs, config, lib, pkgs, isUnstable, ... }: let #photoPrismTag = "220901-bullseye"; httpCacheTime = "720m"; httpAllow = '' allow 10.6.0.0/24; allow 100.64.0.0/10; allow 10.20.30.1/32; ''; openbsdPub = { extraConfig = '' proxy_cache my_cache; proxy_cache_revalidate on; proxy_cache_min_uses 1; proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504; proxy_cache_background_update on; proxy_cache_lock on; proxy_ignore_headers Cache-Control; proxy_cache_valid any ${httpCacheTime}; # from jeremy proxy_set_header Connection ""; proxy_http_version 1.1; proxy_pass http://cdn.openbsd.org; ''; }; pubKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILnaC1v+VoVNnK04D32H+euiCyWPXU8nX6w+4UoFfjA3 qbit@plq" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO7v+/xS8832iMqJHCWsxUZ8zYoMWoZhjj++e26g1fLT europa" ]; userBase = {openssh.authorizedKeys.keys = pubKeys;}; mkNginxSecret = { sopsFile = config.xin-secrets.box.certs; owner = config.users.users.nginx.name; mode = "400"; }; in { _module.args.isUnstable = false; imports = [ ./hardware-configuration.nix "${inputs.unstable}/nixos/modules/services/home-automation/home-assistant.nix" ]; sops.secrets = { #nextcloud_db_pass = { # owner = config.users.users.nextcloud.name; # sopsFile = config.xin-secrets.box.services; #}; #nextcloud_admin_pass = { # owner = config.users.users.nextcloud.name; # sopsFile = config.xin-secrets.box.services; #}; #photoprism_admin_password = {sopsFile = config.xin-secrets.box.services;}; gitea_db_pass = { owner = config.users.users.gitea.name; sopsFile = config.xin-secrets.box.services; }; "bitwarden_rs.env" = {sopsFile = config.xin-secrets.box.services;}; "wireguard_private_key" = {sopsFile = config.xin-secrets.box.services;}; }; sops.secrets.books_cert = mkNginxSecret; sops.secrets.books_key = mkNginxSecret; sops.secrets.jelly_cert = mkNginxSecret; sops.secrets.jelly_key = mkNginxSecret; sops.secrets.lidarr_cert = mkNginxSecret; sops.secrets.lidarr_key = mkNginxSecret; sops.secrets.nzb_cert = mkNginxSecret; sops.secrets.nzb_key = mkNginxSecret; sops.secrets.prowlarr_cert = mkNginxSecret; sops.secrets.prowlarr_key = mkNginxSecret; sops.secrets.radarr_cert = mkNginxSecret; sops.secrets.radarr_key = mkNginxSecret; sops.secrets.reddit_cert = mkNginxSecret; sops.secrets.reddit_key = mkNginxSecret; sops.secrets.sonarr_cert = mkNginxSecret; sops.secrets.sonarr_key = mkNginxSecret; sops.secrets.graph_cert = mkNginxSecret; sops.secrets.graph_key = mkNginxSecret; sops.secrets.bw_cert = mkNginxSecret; sops.secrets.bw_key = mkNginxSecret; sops.secrets.invidious_cert = mkNginxSecret; sops.secrets.invidious_key = mkNginxSecret; sops.secrets.readarr_cert = mkNginxSecret; sops.secrets.readarr_key = mkNginxSecret; sops.secrets.home_cert = mkNginxSecret; sops.secrets.home_key = mkNginxSecret; boot.supportedFilesystems = ["zfs"]; boot.loader.grub.copyKernels = true; boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; doas.enable = true; networking = { hostName = "box"; hostId = "9a2d2563"; useDHCP = false; enableIPv6 = false; hosts = { "127.0.0.1" = ["git.tapenet.org"]; "10.6.0.15" = ["jelly.bold.daemon"]; "100.122.61.43" = ["nix-binary-cache.humpback-trout.ts.net"]; }; interfaces.enp7s0 = {useDHCP = true;}; firewall = { interfaces = {"tailscale0" = {allowedTCPPorts = [3030];};}; interfaces = { "wg0" = { allowedTCPPorts = [ config.services.gitea.settings.server.SSH_PORT config.services.gitea.settings.server.HTTP_PORT config.services.vaultwarden.config.rocketPort ]; }; }; allowedTCPPorts = config.services.openssh.ports ++ [ 80 443 config.services.gitea.settings.server.SSH_PORT 21063 #homekit 21064 #homekit 1883 # mosquitto ]; allowedUDPPorts = [ 5353 #homekit ]; allowedUDPPortRanges = [ { from = 60000; to = 61000; } ]; }; wireguard = { enable = true; interfaces = { wg0 = { listenPort = 7122; ips = ["192.168.112.4/32"]; peers = [ { publicKey = "IMJ1gVK6KzRghon5Wg1dxv1JCB8IbdSqeFjwQAxJM10="; endpoint = "23.29.118.127:7122"; allowedIPs = ["192.168.112.3/32"]; persistentKeepalive = 25; } ]; privateKeyFile = "${config.sops.secrets.wireguard_private_key.path}"; #privateKeyFile = "/root/wgpk"; }; }; }; }; nixpkgs = { config.allowUnfree = true; overlays = [ (_: _: { inherit (inputs.unstable.legacyPackages.${pkgs.system}) home-assistant; }) ]; }; disabledModules = [ "services/home-automation/home-assistant.nix" ]; environment.systemPackages = with pkgs; [ tmux mosh apg git signify glowing-bear rtl_433 (callPackage ../../pkgs/athens.nix {inherit isUnstable;}) ]; security.acme = { acceptTerms = true; defaults.email = "aaron@bolddaemon.com"; }; users.groups.media = { name = "media"; members = ["qbit" "sonarr" "radarr" "lidarr" "nzbget" "jellyfin" "headphones" "rtorrent" "readarr"]; }; users.groups.photos = { name = "photos"; members = ["qbit"]; }; users.groups.photoprism = { name = "photoprism"; gid = 986; }; users.users.photoprism = { uid = 991; name = "photoprism"; isSystemUser = true; hashedPassword = null; group = "photoprism"; shell = "/bin/sh"; openssh.authorizedKeys.keys = pubKeys; }; systemd.services.photoprism = { serviceConfig = { WorkingDirectory = lib.mkForce "/media/pictures/photoprism"; }; preStart = lib.mkForce ""; }; hardware.rtl-sdr.enable = true; services = { mosquitto = { enable = true; listeners = [ { acl = ["pattern readwrite #"]; omitPasswordAuth = true; settings.allow_anonymous = true; } ]; }; avahi = { enable = true; openFirewall = true; }; home-assistant = { enable = true; extraPackages = python3Packages: with python3Packages; [ pyipp pymetno ]; extraComponents = [ "airthings" "airthings_ble" "airvisual" "airvisual_pro" "apple_tv" #"aprs" "brother" "esphome" "ffmpeg" "homekit" "homekit_controller" "icloud" "jellyfin" "logger" "met" "mqtt" "nextdns" "openevse" "prometheus" "pushover" "rest" "snmp" "zeroconf" ]; config = { mqtt.sensor = [ ]; logger = { default = "warning"; logs = { #"homeassistant.components.aprs" = "debug"; }; }; "automation manual" = [ ]; "automation ui" = "!include automations.yaml"; rest = [ { resource = "http://127.0.0.1:9001/api/v1/query?query=rtl_433_temperature_celsius"; sensor = { name = "rtl_433_temperature_celsius"; value_template = "{{value_json.data.result[0].value[1]}}"; }; } { resource = "http://127.0.0.1:9001/api/v1/query?query=wstation_temp_c"; sensor = { name = "wstation_garage_temp_c"; value_template = "{{value_json.data.result[0].value[1]}}"; }; } ]; device_tracker = [ ]; default_config = {}; http = { use_x_forwarded_for = true; server_host = "127.0.0.1"; trusted_proxies = "127.0.0.1"; }; homeassistant = { name = "Home"; time_zone = "America/Denver"; temperature_unit = "C"; unit_system = "metric"; longitude = -104.72; latitude = 38.35; }; }; }; #photoprism = { # enable = true; # port = 2343; # storagePath = "/media/pictures/photoprism/storage"; # originalsPath = "/media/pictures/photoprism/originals"; # importPath = "/media/pictures/photoprism/import"; # settings = { # PHOTOPRISM_UPLOAD_NSFW = "true"; # PHOTOPRISM_DETECT_NSFW = "false"; # PHOTOPRISM_SITE_URL = "https://box.humpback-trout.ts.net/photos"; # PHOTOPRISM_SETTINGS_HIDDEN = "false"; # PHOTOPRISM_DATABASE_DRIVER = "sqlite"; # }; #}; #nextcloud = { # enable = true; # enableBrokenCiphersForSSE = false; # hostName = "box.humpback-trout.ts.net"; # home = "/media/nextcloud"; # https = true; # package = pkgs.nextcloud27; # extraApps = with config.services.nextcloud.package.packages.apps; { # inherit bookmarks calendar contacts notes tasks twofactor_webauthn; # }; # extraAppsEnable = true; # config = { # overwriteProtocol = "https"; # dbtype = "pgsql"; # dbuser = "nextcloud"; # dbhost = "/run/postgresql"; # dbname = "nextcloud"; # dbpassFile = "${config.sops.secrets.nextcloud_db_pass.path}"; # adminpassFile = "${config.sops.secrets.nextcloud_admin_pass.path}"; # adminuser = "admin"; # }; #}; invidious = { enable = true; settings = { port = lib.mkForce 1538; host_binding = "127.0.0.1"; domain = "invidious.bold.daemon"; https_only = true; popular_enabled = false; statistics_enabled = false; default_home = "Subscriptions"; }; }; cron = { enable = true; systemCronJobs = let tsCertsScript = pkgs.writeScriptBin "ts-certs.sh" '' #!/usr/bin/env sh . /etc/profile; ( mkdir -p /etc/nixos/secrets; chown root /etc/nixos/secrets/box.humpback-trout.ts.net.*; tailscale cert \ --cert-file /etc/nixos/secrets/box.humpback-trout.ts.net.crt \ --key-file=/etc/nixos/secrets/box.humpback-trout.ts.net.key \ box.humpback-trout.ts.net; chown nginx /etc/nixos/secrets/box.humpback-trout.ts.net.* ) >/dev/null 2>&1 ''; in ["@daily root ${tsCertsScript}/bin/ts-certs.sh"]; }; openssh = {settings.X11Forwarding = true;}; tor.enable = true; transmission = { enable = true; group = "media"; downloadDirPermissions = "770"; settings = { download-dir = "/media/downloads/torrents"; }; }; readarr = { enable = true; dataDir = "/media/books"; group = "media"; }; sonarr.enable = true; radarr.enable = true; lidarr.enable = true; jackett.enable = false; prowlarr.enable = true; headphones.enable = false; nzbget = { enable = true; group = "media"; settings = {MainDir = "/media/downloads";}; }; fwupd.enable = true; zfs = { autoSnapshot.enable = true; autoReplication = { enable = true; host = "10.6.0.245"; identityFilePath = "/etc/ssh/ssh_host_ed25519_key"; localFilesystem = "rpool"; recursive = true; remoteFilesystem = "tank/backups/box"; username = "root"; }; }; jellyfin = { enable = true; openFirewall = true; }; calibre-web = { enable = true; group = "media"; options = {enableBookUploading = true;}; listen.port = 8909; listen.ip = "127.0.0.1"; }; grafana = { enable = true; settings = { analytics.reporting_enabled = false; server = { domain = "graph.tapenet.org"; http_port = 2342; http_addr = "127.0.0.1"; }; }; #declarativePlugins = with pkgs; [ grafana-image-renderer ]; provision = { enable = true; datasources.settings.datasources = [ { name = "Prometheus"; type = "prometheus"; access = "proxy"; url = "http://127.0.0.1:${toString config.services.prometheus.port}"; } { name = "Loki"; type = "loki"; access = "proxy"; url = "http://127.0.0.1:${ toString config.services.loki.configuration.server.http_listen_port }"; } ]; }; }; loki = { enable = true; configuration = { analytics.reporting_enabled = false; server.http_listen_port = 3030; server.http_listen_address = "0.0.0.0"; auth_enabled = false; ingester = { lifecycler = { address = "127.0.0.1"; ring = { kvstore = {store = "inmemory";}; replication_factor = 1; }; }; chunk_idle_period = "1h"; max_chunk_age = "1h"; chunk_target_size = 999999; chunk_retain_period = "30s"; max_transfer_retries = 0; }; schema_config = { configs = [ { from = "2022-06-06"; store = "boltdb-shipper"; object_store = "filesystem"; schema = "v11"; index = { prefix = "index_"; period = "24h"; }; } ]; }; storage_config = { boltdb_shipper = { active_index_directory = "/var/lib/loki/boltdb-shipper-active"; cache_location = "/var/lib/loki/boltdb-shipper-cache"; cache_ttl = "24h"; shared_store = "filesystem"; }; filesystem = {directory = "/var/lib/loki/chunks";}; }; limits_config = { reject_old_samples = true; reject_old_samples_max_age = "168h"; }; chunk_store_config = {max_look_back_period = "0s";}; table_manager = { retention_deletes_enabled = false; retention_period = "0s"; }; compactor = { working_directory = "/var/lib/loki"; shared_store = "filesystem"; compactor_ring = {kvstore = {store = "inmemory";};}; }; }; }; promtail = { enable = true; configuration = { server = { http_listen_port = 3031; grpc_listen_port = 0; }; positions = {filename = "/tmp/positions.yaml";}; clients = [ { url = "http://127.0.0.1:${ toString config.services.loki.configuration.server.http_listen_port }/loki/api/v1/push"; } ]; scrape_configs = [ { job_name = "journal"; journal = { max_age = "12h"; labels = { job = "systemd-journal"; host = "box"; }; }; relabel_configs = [ { source_labels = ["__journal__systemd_unit"]; target_label = "unit"; } ]; } ]; }; }; prometheus = { enable = true; port = 9001; exporters = { node = { enable = true; enabledCollectors = ["systemd"]; port = 9002; }; nginx = {enable = true;}; rtl_433 = { enable = true; group = "plugdev"; ids = [ { id = 55; name = "LaCrosse-TX141Bv3"; location = "Kitchen"; } ]; }; }; scrapeConfigs = [ { job_name = "rtl_433"; static_configs = [ { targets = [ "127.0.0.1:${ toString config.services.prometheus.exporters.rtl_433.port }" ]; } ]; } { job_name = "box"; static_configs = [ { targets = [ "127.0.0.1:${ toString config.services.prometheus.exporters.node.port }" ]; } ]; } { job_name = "greenhouse"; static_configs = [{targets = ["10.6.0.20:80"];}]; } { job_name = "house"; static_configs = [{targets = ["10.6.0.21:80"];}]; } { job_name = "outside"; static_configs = [{targets = ["10.6.0.22:8811"];}]; } { job_name = "faf"; static_configs = [{targets = ["10.6.0.245:9002"];}]; } { job_name = "h"; static_configs = [{targets = ["100.64.247.69:9002"];}]; } { job_name = "namish"; static_configs = [{targets = ["10.200.0.100:9100"];}]; } { job_name = "nginx"; static_configs = [ { targets = [ "127.0.0.1:${ toString config.services.prometheus.exporters.nginx.port }" ]; } ]; } ]; }; vaultwarden = { enable = true; backupDir = "/backups/bitwarden_rs"; config = { domain = "https://bw.tapenet.org"; signupsAllowed = false; rocketPort = 8222; rocketAddress = "192.168.112.4"; # wg0 rocketLog = "critical"; }; environmentFile = config.sops.secrets."bitwarden_rs.env".path; }; gitea = { enable = true; stateDir = "/media/git"; appName = "Tape:neT"; package = inputs.unstable.legacyPackages.${pkgs.system}.forgejo; lfs.enable = true; settings = { server = { DOMAIN = "git.tapenet.org"; ROOT_URL = "https://git.tapenet.org"; START_SSH_SERVER = true; SSH_SERVER_HOST_KEYS = "ssh/gitea-ed25519"; SSH_PORT = 2222; DISABLE_REGISTRATION = true; COOKIE_SECURE = true; }; }; database = { type = "postgres"; passwordFile = "${config.sops.secrets.gitea_db_pass.path}"; socket = "/run/postgresql"; }; }; rsnapshot = { enable = false; enableManualRsnapshot = true; extraConfig = '' snapshot_root /backups/snapshots/ retain daily 7 retain manual 3 backup_exec date "+ backup of suah.dev started at %c" backup root@suah.dev:/home/ suah.dev/ backup root@suah.dev:/etc/ suah.dev/ backup root@suah.dev:/var/synapse/ suah.dev/ backup root@suah.dev:/var/dendrite/ suah.dev/ backup root@suah.dev:/var/hammer/ suah.dev/ backup root@suah.dev:/var/go-ipfs/ suah.dev/ backup root@suah.dev:/var/gopher/ suah.dev/ backup root@suah.dev:/var/honk/ suah.dev/ backup root@suah.dev:/var/mcchunkie/ suah.dev/ backup root@suah.dev:/var/www/ suah.dev/ backup_exec date "+ backup of suah.dev ended at %c" ''; cronIntervals = {daily = "50 21 * * *";}; }; libreddit = { enable = true; port = 8482; }; nginx = { enable = true; package = pkgs.openresty; statusPage = true; recommendedTlsSettings = true; recommendedOptimisation = true; recommendedGzipSettings = true; recommendedProxySettings = true; clientMaxBodySize = "512M"; commonHttpConfig = '' proxy_cache_path /backups/nginx_cache levels=1:2 keys_zone=my_cache:10m max_size=10g inactive=${httpCacheTime} use_temp_path=off; ''; virtualHosts = { "home.bold.daemon" = { forceSSL = true; sslCertificateKey = "${config.sops.secrets.home_key.path}"; sslCertificate = "${config.sops.secrets.home_cert.path}"; extraConfig = '' proxy_buffering off; ''; locations."/" = { proxyPass = "http://127.0.0.1:8123"; proxyWebsockets = true; }; }; "invidious.bold.daemon" = { forceSSL = true; sslCertificateKey = "${config.sops.secrets.invidious_key.path}"; sslCertificate = "${config.sops.secrets.invidious_cert.path}"; locations."/" = { proxyPass = "http://127.0.0.1:${ toString config.services.invidious.settings.port }"; proxyWebsockets = true; }; }; "box.humpback-trout.ts.net" = { forceSSL = true; sslCertificateKey = "/etc/nixos/secrets/box.humpback-trout.ts.net.key"; sslCertificate = "/etc/nixos/secrets/box.humpback-trout.ts.net.crt"; locations."/photos" = { proxyPass = "http://localhost:2343"; proxyWebsockets = true; }; locations."/pub" = openbsdPub; }; #"photos.tapenet.org" = { # forceSSL = true; # enableACME = true; # locations."/" = { # proxyPass = "http://localhost:2343"; # proxyWebsockets = true; # }; #}; "jelly.bold.daemon" = { forceSSL = true; sslCertificateKey = "${config.sops.secrets.jelly_key.path}"; sslCertificate = "${config.sops.secrets.jelly_cert.path}"; locations."/" = { # TODO: jellyfin.nix doesn't expose the port being used. proxyPass = "http://localhost:8096"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "reddit.bold.daemon" = { sslCertificateKey = "${config.sops.secrets.reddit_key.path}"; sslCertificate = "${config.sops.secrets.reddit_cert.path}"; forceSSL = true; locations."/" = { proxyPass = "http://localhost:${toString config.services.libreddit.port}"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "books.bold.daemon" = { sslCertificateKey = "${config.sops.secrets.books_key.path}"; sslCertificate = "${config.sops.secrets.books_cert.path}"; forceSSL = true; locations."/" = { proxyPass = "http://localhost:${ toString config.services.calibre-web.listen.port }"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "sonarr.bold.daemon" = { sslCertificateKey = "${config.sops.secrets.sonarr_key.path}"; sslCertificate = "${config.sops.secrets.sonarr_cert.path}"; forceSSL = true; locations."/" = { proxyPass = "http://localhost:8989"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "radarr.bold.daemon" = { sslCertificateKey = "${config.sops.secrets.radarr_key.path}"; sslCertificate = "${config.sops.secrets.radarr_cert.path}"; forceSSL = true; locations."/" = { proxyPass = "http://localhost:7878"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "prowlarr.bold.daemon" = { sslCertificateKey = "${config.sops.secrets.prowlarr_key.path}"; sslCertificate = "${config.sops.secrets.prowlarr_cert.path}"; forceSSL = true; locations."/" = { proxyPass = "http://localhost:9696"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "nzb.bold.daemon" = { sslCertificateKey = "${config.sops.secrets.nzb_key.path}"; sslCertificate = "${config.sops.secrets.nzb_cert.path}"; forceSSL = true; locations."/" = { proxyPass = "http://localhost:6789"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "headphones.bold.daemon" = { locations."/" = { proxyPass = "http://localhost:8181"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "lidarr.bold.daemon" = { sslCertificateKey = "${config.sops.secrets.lidarr_key.path}"; sslCertificate = "${config.sops.secrets.lidarr_cert.path}"; forceSSL = true; locations."/" = { proxyPass = "http://localhost:8686"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "readarr.bold.daemon" = { sslCertificateKey = "${config.sops.secrets.readarr_key.path}"; sslCertificate = "${config.sops.secrets.readarr_cert.path}"; forceSSL = true; locations."/" = { proxyPass = "http://localhost:8787"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; }; "graph.bold.daemon" = { sslCertificateKey = "${config.sops.secrets.graph_key.path}"; sslCertificate = "${config.sops.secrets.graph_cert.path}"; forceSSL = true; locations."/" = { proxyPass = "http://127.0.0.1:${ toString config.services.grafana.settings.server.http_port }"; proxyWebsockets = true; extraConfig = '' ${httpAllow} deny all; ''; }; locations."/_pub" = { extraConfig = '' default_type 'application/json'; content_by_lua_block { function lsplit (str, sep) sep = "\n" local t={} for str in string.gmatch(str, "([^"..sep.."]+)") do table.insert(t, str) end return t end local sock = ngx.socket.tcp() local ok, err = sock:connect("127.0.0.1", ${ toString config.services.prometheus.port }) if not ok then ngx.say("failed to connect to backend: ", err) return end local bytes = sock:send("GET /api/v1/query?query=wstation_temp_c HTTP/1.1\nHost: 127.0.0.1:${ toString config.services.prometheus.port }\n\n") sock:settimeouts(1000, 1000, 1000) local data, err = sock:receiveany(10 * 1024) if not data then ngx.say("failed to read weather data: ", err) return end local b = lsplit(data) ngx.say(b[#b]) sock:close() } ''; }; }; }; }; postgresqlBackup = { enable = true; location = "/backups/postgresql"; }; postgresql = { enable = true; dataDir = "/db/postgres"; #enableTCPIP = true; #authentication = pkgs.lib.mkOverride 14 '' # local all all trust # host all all 127.0.0.1/32 trust # host all all ::1/128 trust #''; ensureDatabases = ["nextcloud" "gitea" "invidious"]; ensureUsers = [ { name = "nextcloud"; ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES"; } { name = "gitea"; ensurePermissions."DATABASE gitea" = "ALL PRIVILEGES"; } { name = "invidious"; ensurePermissions."DATABASE invidious" = "ALL PRIVILEGES"; } ]; }; }; systemd.services.nginx.serviceConfig = { ReadWritePaths = ["/backups/nginx_cache"]; ReadOnlyPaths = ["/etc/nixos/secrets"]; }; systemd.services.gitea.environment = { GIT_CONFIG_NOGLOBAL = "true"; GIT_CONFIG_NOSYSTEM = "true"; }; #systemd.services."nextcloud-setup" = { # requires = [ "postgresql.service" ]; # after = [ "postgresql.service" ]; #}; users.users.qbit = userBase; users.users.root = userBase; programs.zsh.enable = true; system.stateVersion = "20.03"; }