Cleanup now that I finally got the LSP working... so many warnings.

configuration.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   imports = [
@@ -14,7 +14,10 @@
     ./modules/fail2ban.nix
   ];
 
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
 
   environment.systemPackages = with pkgs; [
     git

modules/boot.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   boot.loader.grub = {

modules/fail2ban.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ ... }:
 
 {
   services.fail2ban = {

modules/hardware.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 {
   hardware.enableRedistributableFirmware = true;

modules/locale.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   settings = import ../settings.nix;

modules/matrix.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ pkgs, ... }:
 
 let
   livekitKeyFile = "/run/livekit.key";
@@ -12,13 +12,19 @@ in
     settings = {
       global = {
         server_name = serverName;
-        address = [ "127.0.0.1" "::1" ];
+        address = [
+          "127.0.0.1"
+          "::1"
+        ];
         port = [ 6167 ];
         max_request_size = 104857600;
         allow_registration = false;
         allow_encryption = true;
         allow_federation = true;
-        trusted_servers = [ "matrix.org" "chat.blahaj.zone" ];
+        trusted_servers = [
+          "matrix.org"
+          "chat.blahaj.zone"
+        ];
         ip_range_denylist = [
           "127.0.0.0/8"
           "10.0.0.0/8"
@@ -98,9 +104,16 @@ in
   systemd.services.livekit.requires = [ "acme-${matrixRtcDomain}.service" ];
 
   systemd.services.livekit-key = {
-    before = [ "lk-jwt-service.service" "livekit.service" ];
+    before = [
+      "lk-jwt-service.service"
+      "livekit.service"
+    ];
     wantedBy = [ "multi-user.target" ];
-    path = with pkgs; [ livekit coreutils gawk ];
+    path = with pkgs; [
+      livekit
+      coreutils
+      gawk
+    ];
     script = ''
       echo "Key missing, generating key"
       echo "lk-jwt-service: $(livekit-server generate-keys | tail -1 | awk '{print $3}')" > "${livekitKeyFile}"
@@ -110,10 +123,17 @@ in
   };
 
   networking.firewall = {
-    allowedTCPPorts = [ 7880 7881 5349 ];
+    allowedTCPPorts = [
+      7880
+      7881
+      5349
+    ];
     allowedUDPPorts = [ 3478 ];
     allowedUDPPortRanges = [
-      { from = 50000; to = 60000; }
+      {
+        from = 50000;
+        to = 60000;
+      }
     ];
   };
 }

modules/networking.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   settings = import ../settings.nix;
@@ -10,7 +10,11 @@ in
 
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [ 22 80 443 ];
+    allowedTCPPorts = [
+      22
+      80
+      443
+    ];
     allowedUDPPorts = [ ];
   };
 }

modules/nginx.nix

@@ -1,9 +1,13 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 
 let
-  serverName = "atri.dad";
+  rootDomain = "atri.dad";
-  matrixDomain = "matrix.atri.dad";
+  matrixDomain = "matrix.${rootDomain}";
-  matrixRtcDomain = "matrixrtc.atri.dad";
+  matrixRtcDomain = "matrixrtc.${rootDomain}";
 
   wellKnownServer = builtins.toJSON {
     "m.server" = "${matrixDomain}:443";
@@ -20,13 +24,34 @@ let
       }
     ];
   };
-in
+
+  blockAi = "if ($fuckai) { return 444; }";
+
+  mkProxyVhost =
     {
-  security.acme = {
+      host,
-    acceptTerms = true;
+      upstream,
-    defaults.email = "me@atri.dad";
+      websockets ? false,
+      extraConfig ? "",
+      locationExtraConfig ? "",
+    }:
+    {
+      "${host}" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = extraConfig;
+        locations."/" = {
+          proxyPass = upstream;
+          proxyWebsockets = websockets;
+          extraConfig = lib.concatStringsSep "\n" (
+            [ blockAi ] ++ lib.optional (locationExtraConfig != "") locationExtraConfig
+          );
+        };
+      };
     };
 
+in
+{
   services.nginx = {
     enable = true;
 
@@ -35,7 +60,6 @@ in
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
 
-    # Fuck AI
     clientMaxBodySize = "3g";
 
     commonHttpConfig = ''
@@ -44,7 +68,6 @@ in
 
       map $http_user_agent $fuckai {
         default 0;
-
         "~*GPTBot" 1;
         "~*ChatGPT-User" 1;
         "~*OAI-SearchBot" 1;
@@ -103,293 +126,144 @@ in
       }
     '';
 
-    # Stream Hosts
+    virtualHosts = lib.mkMerge [
-    streamConfig = ''
+      (mkProxyVhost {
-      # Port 69
+        host = rootDomain;
-      server {
+        upstream = "http://lloyd.tadpole-pain.ts.net:3000";
-        listen 69;
+      })
-        listen 69 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:69;
-      }
 
-      # Port 420
+      {
-      server {
+        "${rootDomain}".locations."= /.well-known/matrix/server".extraConfig = ''
-        listen 420;
-        listen 420 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:420;
-      }
-
-      # Minecraft / Game Ports
-      server {
-        listen 25565;
-        listen 25565 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:25565;
-      }
-      server {
-        listen 25566;
-        listen 25566 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:25566;
-      }
-      server {
-        listen 25567;
-        listen 25567 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:25567;
-      }
-    '';
-
-    # Proxy Hosts
-    virtualHosts = {
-      # atri.dad hosts
-      "atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:3000";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-        locations."= /.well-known/matrix/server" = {
-          extraConfig = ''
           default_type application/json;
           return 200 '${wellKnownServer}';
         '';
-        };
+        "${rootDomain}".locations."= /.well-known/matrix/client".extraConfig = ''
-        locations."= /.well-known/matrix/client" = {
-          extraConfig = ''
           default_type application/json;
           add_header Access-Control-Allow-Origin "*";
           return 200 '${wellKnownClient}';
         '';
-        };
+      }
-      };
+
-      "analytics.atri.dad" = {
+      (mkProxyVhost {
-        enableACME = true;
+        host = "analytics.${rootDomain}";
-        forceSSL = true;
+        upstream = "http://lloyd.tadpole-pain.ts.net:30060";
-        locations."/" = {
+      })
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30060";
+      (mkProxyVhost {
-          extraConfig = "if ($fuckai) { return 444; }";
+        host = "archive.${rootDomain}";
-        };
+        upstream = "http://lloyd.tadpole-pain.ts.net:30288";
-      };
+      })
-      "archive.atri.dad" = {
+      (mkProxyVhost {
-        enableACME = true;
+        host = "ascently.${rootDomain}";
-        forceSSL = true;
+        upstream = "http://lloyd.tadpole-pain.ts.net:8838";
-        locations."/" = {
+      })
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30288";
+      (mkProxyVhost {
-          extraConfig = "if ($fuckai) { return 444; }";
+        host = "bsky.${rootDomain}";
-        };
+        upstream = "http://lloyd.tadpole-pain.ts.net:31173";
-      };
+      })
-      "ascently.atri.dad" = {
+      (mkProxyVhost {
-        enableACME = true;
+        host = "chef.${rootDomain}";
-        forceSSL = true;
+        upstream = "http://lloyd.tadpole-pain.ts.net:30111";
-        locations."/" = {
+      })
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8838";
+      (mkProxyVhost {
-          extraConfig = "if ($fuckai) { return 444; }";
+        host = "democlimb.${rootDomain}";
-        };
+        upstream = "http://lloyd.tadpole-pain.ts.net:8008";
-      };
+      })
-      "bsky.atri.dad" = {
+      (mkProxyVhost {
-        enableACME = true;
+        host = "fedi.${rootDomain}";
-        forceSSL = true;
+        upstream = "http://lloyd.tadpole-pain.ts.net:8181";
-        locations."/" = {
+      })
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:31173";
+      (mkProxyVhost {
-          extraConfig = "if ($fuckai) { return 444; }";
+        host = "gist.${rootDomain}";
-        };
+        upstream = "http://lloyd.tadpole-pain.ts.net:1227";
-      };
+      })
-      "chef.atri.dad" = {
+      (mkProxyVhost {
-        enableACME = true;
+        host = "git.${rootDomain}";
-        forceSSL = true;
+        upstream = "http://lloyd.tadpole-pain.ts.net:30010";
-        locations."/" = {
+      })
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30111";
+      (mkProxyVhost {
-          extraConfig = "if ($fuckai) { return 444; }";
+        host = "links.${rootDomain}";
-        };
+        upstream = "http://lloyd.tadpole-pain.ts.net:30243";
-      };
+      })
-      "democlimb.atri.dad" = {
+
-        enableACME = true;
+      (mkProxyVhost {
-        forceSSL = true;
+        host = "media.${rootDomain}";
-        locations."/" = {
+        upstream = "http://lloyd.tadpole-pain.ts.net:30013";
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8008";
+        websockets = true;
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "fedi.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8181";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "gist.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:1227";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "git.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30010";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "links.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30243";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "media.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
         extraConfig = ''
           client_max_body_size 0;
         '';
-        locations."/" = {
+        locationExtraConfig = ''
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30013";
-          proxyWebsockets = true;
-          extraConfig = ''
-            if ($fuckai) { return 444; }
           proxy_buffering off;
           proxy_request_buffering off;
           proxy_read_timeout 86400s;
           proxy_send_timeout 86400s;
           send_timeout 86400s;
         '';
-        };
+      })
-      };
-      "memos.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30311";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "mermaid.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8280";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "msrc.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:3311";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "n8n.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30109";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "ocr.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30070";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "openclimb.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:1337";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "photos.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30041";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "pods.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8828";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "requests.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30042";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "ripkyle.org" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:4321";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "s3.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30188";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "search.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30053";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "sync.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:20910";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "travel.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30251";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "travelapi.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30250";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "vault.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30032";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
 
-      "matrix.atri.dad" = {
+      (mkProxyVhost {
+        host = "memos.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30311";
+      })
+      (mkProxyVhost {
+        host = "mermaid.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:8280";
+      })
+      (mkProxyVhost {
+        host = "msrc.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:3311";
+      })
+      (mkProxyVhost {
+        host = "n8n.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30109";
+      })
+      (mkProxyVhost {
+        host = "ocr.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30070";
+      })
+      (mkProxyVhost {
+        host = "openclimb.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:1337";
+      })
+      (mkProxyVhost {
+        host = "photos.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30041";
+      })
+      (mkProxyVhost {
+        host = "pods.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:8828";
+      })
+      (mkProxyVhost {
+        host = "requests.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30042";
+      })
+      (mkProxyVhost {
+        host = "s3.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30188";
+      })
+      (mkProxyVhost {
+        host = "search.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30053";
+      })
+      (mkProxyVhost {
+        host = "sync.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:20910";
+      })
+      (mkProxyVhost {
+        host = "travel.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30251";
+      })
+      (mkProxyVhost {
+        host = "travelapi.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30250";
+      })
+      (mkProxyVhost {
+        host = "vault.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30032";
+      })
+
+      {
+        "${matrixDomain}" = {
           enableACME = true;
           forceSSL = true;
 
@@ -406,12 +280,12 @@ in
             proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
           };
         };
+      }
 
-      "matrixrtc.atri.dad" = {
+      {
+        "${matrixRtcDomain}" = {
           enableACME = true;
           forceSSL = true;
-
-        # livekit
           locations."/" = {
             proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
             proxyWebsockets = true;
@@ -423,27 +297,20 @@ in
             '';
           };
         };
-
+      }
-      "atash.dev" = {
+
-        enableACME = true;
+      (mkProxyVhost {
-        forceSSL = true;
+        host = "ripkyle.org";
-        locations."/" = {
+        upstream = "http://lloyd.tadpole-pain.ts.net:4321";
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:6969";
+      })
-          extraConfig = "if ($fuckai) { return 444; }";
+      (mkProxyVhost {
-        };
+        host = "atash.dev";
-      };
+        upstream = "http://lloyd.tadpole-pain.ts.net:6969";
-      "chronus.atash.dev" = {
+      })
-        enableACME = true;
+      (mkProxyVhost {
-        forceSSL = true;
+        host = "chronus.atash.dev";
-        locations."/" = {
+        upstream = "http://lloyd.tadpole-pain.ts.net:7337";
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:7337";
+      })
-          extraConfig = "if ($fuckai) { return 444; }";
+    ];
-        };
+  };
-      };
-    };
-  };
-
-  # Open Ports
-  networking.firewall.allowedTCPPorts = [ 80 443 69 420 25565 25566 25567 ];
-  networking.firewall.allowedUDPPorts = [ 69 420 25565 25566 25567 ];
 }

modules/services.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 {
   services.openssh = {

modules/users.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ ... }:
 
 let
   settings = import ../settings.nix;
@@ -8,10 +8,14 @@ in
     isNormalUser = true;
     description = settings.userDescription;
     extraGroups = settings.userGroups;
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC"
+    ];
   };
 
-  users.users.root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC" ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMuiXQV7+vtLxoyLojnW/Pkt6ScWQs29KPZe8aJVAvvC"
+  ];
 
   security.sudo.execWheelOnly = true;
 }

settings.nix

@@ -4,5 +4,9 @@
   userDescription = "Atridad Lahiji";
   timezone = "America/Edmonton";
   locale = "en_CA.UTF-8";
-  userGroups = [ "networkmanager" "wheel" "docker" ];
+  userGroups = [
+    "networkmanager"
+    "wheel"
+    "docker"
+  ];
 }