ONBYJCY7FHCMAC7HNI7USLRJTY4TVKWMLACTEDTINLEVBGSSCECAC FEIJC27NDSY2EBPZJLEZCZGMBHKGVOL2G77EK6GG3Z6ULUKPNAHQC 4BJFBHQYDMLXWJF7FZJDB6TZZXUAWM5RAYNI3FCZDU5T26FAUAIQC MQT74AV47PUYNCX27OMFK6BFN7PP4DX46JAACN2EPRYXUXV7EL3AC RTBMBSBABSGTRICJ4AWBKWO3JJHBRKV6FGOMYPDD7X6SS6X35ZIQC S6ZN4FXJQKJM6BQKDSAKZTAILRKYNFFEUDJKFQTDBWENQTJCPJZAC SUJ7TKWXHFZCEEQFGLRT4PZ4TYAXFLNDZVE57SN2AHXTLEPX7WXAC QEYE6IEG73H4YBRUA3QGQK5NOPWW4YYK2R4NHAUY65ST6WSZNKGAC 4GGQX4QFLTB4FMCYJOIBPOAMZVC5FXUNEZGF3A7E7GUNNVM5WQHAC O5U2RS6S4RUGVSOZPTJGD6HJOOO5VM7SPZUDUHU4G3BHZOTJH47QC { self, config, lib, pkgs, ... }: letinherit (config.networking) domain;inherit (lib) enabled mkConst;in {options.services.nginx.sslTemplate = mkConst {forceSSL = true;quic = true;useACMEHost = domain;};options.services.nginx.headers = mkConst /* nginx */ ''proxy_hide_header Access-Control-Allow-Origin;add_header Access-Control-Allow-Origin $allow_origin always;${config.services.nginx.headersNoAccessControlOrigin}'';options.services.nginx.headersNoAccessControlOrigin = mkConst /* nginx */ ''proxy_hide_header Access-Control-Allow-Methods;add_header Access-Control-Allow-Methods $allow_methods always;proxy_hide_header Strict-Transport-Security;add_header Strict-Transport-Security $hsts_header always;proxy_hide_header Content-Security-Policy;proxy_hide_header Referrer-Policy;add_header Referrer-Policy no-referrer always;proxy_hide_header X-Frame-Options;add_header X-Frame-Options DENY always;'';config.networking.firewall = {allowedTCPPorts = [ 443 80 ];allowedUDPPorts = [ 443 ];};config.services.prometheus.exporters.nginx = enabled {listenAddress = "[::]";};config.security.acme.users = [ "nginx" ];config.services.nginx = enabled {statusPage = true;recommendedBrotliSettings = true;recommendedGzipSettings = true;recommendedOptimisation = true;recommendedProxySettings = true;recommendedTlsSettings = true;commonHttpConfig = /* nginx */ ''map $scheme $hsts_header {https "max-age=31536000; includeSubdomains; preload";}map $http_origin $allow_origin {~^https://(?:.+\.)?${domain}$ $http_origin;}map $http_origin $allow_methods {~^https://(?:.+\.)?${domain}$ "CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT, TRACE";}${config.services.nginx.headers}proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";'';};}~^https://dr-radka\.pl$ "CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT, TRACE";~^https://awesome-technologies\.github\.io$ "CONNECT, DELETE, GET, HEAD, OPTIONS, PATCH, POST, PUT, TRACE";~^https://dr-radka\.pl$ $http_origin;~^https://awesome-technologies\.github\.io$ $http_origin;# cache only successful responsesmap $status $cache_header {200 "public";302 "public";default "no-cache";}proxy_hide_header X-Content-Type-Options;add_header X-Content-Type-Options nosniff always;proxy_hide_header X-XSS-Protection;add_header X-XSS-Protection "1; mode=block" always;proxy_hide_header Permissions-Policy;add_header Permissions-Policy "camera=(), geolocation=(), payment=(), usb=()" always;add_header Content-Security-Policy "script-src 'self' 'unsafe-inline' 'unsafe-eval' ${domain} *.${domain}; object-src 'self' ${domain} *.${domain}; img-src 'self' data: https:; base-uri 'self'; frame-ancestors 'self';" always;options.services.nginx.goatCounterTemplate = mkConst /* nginx */ ''proxy_set_header Accept-Encoding "";sub_filter "</head>" '<script data-goatcounter="https://analytics.${domain}/count" async src="https://analytics.${domain}/count.js"></script></head>';sub_filter_last_modified on;sub_filter_once on;'';imports = [ (self + /modules/acme) ];
let args = if $progress >= 0 and $progress < 100 {["--hint" $"int:value:($progress)"]} else {[]}^${pkgs.libnotify}/bin/notify-send ...$args --urgency=($urgency) --expire-time=($timeout) "Rebuilder" $"($message)"}def --wrapped main [host: string = "" # The host to build.--remote # Deploy to remote host using --target-host.--rollback # Rollback.--quiet (-q) # Run without output (for theme toggling).--try_attempts (-t): int = 0 # How many times to try the same rebuild....arguments # Extra arguments to pass to rebuild commands.]: nothing -> nothing {let host = if ($host | is-not-empty) {if $host != (hostname) and not $remote {if not $quiet { print-notify $"Error: Building local configuration for hostname that does not match the local machine." }exit 1
^${pkgs.libnotify}/bin/notify-send ...$args --urgency=($urgency) --expire-time=($timeout) "Rebuilder" $"($message)"
# Build locally (always).let os = (uname | get kernel-name)let config_path = if $os == "Darwin" { "/Users/jam/nixos" } else { "/home/jam/nixos" }
def --wrapped main [host: string = "" # The host to build.--remote # Deploy to remote host using --target-host.--rollback # Rollback.--quiet (-q) # Run without output (for theme toggling).--try_attempts (-t): int = 0 # How many times to try the same rebuild....arguments # Extra arguments to pass to rebuild commands.]: nothing -> nothing {let host = if ($host | is-not-empty) {if $host != (hostname) and not $remote {if not $quiet { print-notify $"Error: Building local configuration for hostname that does not match the local machine." }exit 1}$host} else if $remote {if not $quiet { print-notify "Error: Hostname not specified for remote deployment." }exit 1} else {(hostname)}
# nh os/darwin switch [flake_path] --hostname [host] -- [nix_args]let base_args = ["switch"$config_path"--hostname" yuzu-dendritic # TODO: Change back to $host."--accept-flake-config" # Avoid asking for y/n approval for all settings."--fallback" # Build locally if substituters fail.] | append $arguments
# Build locally (always).let os = (uname | get kernel-name)let config_path = if $os == "Darwin" { "/Users/jam/nixos" } else { "/home/jam/nixos" }
# Add target-host for remote deployments.let final_args = if $remote {$base_args | append ["--target-host" $"root@($host)"]} else {$base_args}
# nh os/darwin switch [flake_path] --hostname [host] -- [nix_args]let base_args = ["switch"$config_path"--hostname" $host"--accept-flake-config" # Avoid asking for y/n approval for all settings."--fallback" # Build locally if substituters fail.] | append $arguments
# Execute final command.let action = if $remote { $"Deploying to: ($host)" } else { "Building locally:" }let platform = if $os == "Darwin" { "Darwin" } else { "NixOS" }if not $quiet { print-notify $"($action) ($platform). Configuration for: ($host)." 50 }
let final_args = if $rollback {[$host] | append $arguments} else {$final_args}# Execute final command.let action = if $remote { $"Deploying to: ($host)" } else { "Building locally:" }let platform = if $os == "Darwin" { "Darwin" } else { "NixOS" }if not $quiet { print-notify $"($action) ($platform). Configuration for: ($host)." 50 }
if $remote {for attempts in 1..($try_attempts + 1) {try {NH_BYPASS_ROOT_CHECK=true NH_NO_CHECKS=true nh $command ...$final_argsbreak} catch { |e|if $attempts < $try_attempts {print-notify $"First attempt failed, retrying... (attempt ($attempts) of ($try_attempts))"} else {print-notify $"Error: Rebuild failed after ($try_attempts) attempts, run manually in a terminal."exit 1
if $remote {for attempts in 1..($try_attempts + 1) {try {NH_BYPASS_ROOT_CHECK=true NH_NO_CHECKS=true nh $command ...$final_argsbreak} catch { |e|if $attempts < $try_attempts {print-notify $"First attempt failed, retrying... (attempt ($attempts) of ($try_attempts))"} else {print-notify $"Error: Rebuild failed after ($try_attempts) attempts, run manually in a terminal."exit 1}}}} else {for attempts in 1..($try_attempts + 1) {try {sudo NH_BYPASS_ROOT_CHECK=true NH_NO_CHECKS=true nh $command ...$final_argsbreak} catch { |e|if $attempts < $try_attempts {print-notify $"First attempt failed, retrying... (attempt ($attempts) of ($try_attempts))"} else {print-notify $"Error: Rebuild failed after ($try_attempts) attempts, run manually in a terminal."exit 1}}
}} else {for attempts in 1..($try_attempts + 1) {try {sudo NH_BYPASS_ROOT_CHECK=true NH_NO_CHECKS=true nh $command ...$final_argsbreak} catch { |e|if $attempts < $try_attempts {print-notify $"First attempt failed, retrying... (attempt ($attempts) of ($try_attempts))"} else {print-notify $"Error: Rebuild failed after ($try_attempts) attempts, run manually in a terminal."exit 1}
if $rollback {if not $quiet { print-notify $"Rollback for ($host) succeeded." 100 }} else {if not $quiet { print-notify $"Rebuild for ($host) succeeded." 100 }
}if $rollback {if not $quiet { print-notify $"Rollback for ($host) succeeded." 100 }} else {if not $quiet { print-notify $"Rebuild for ($host) succeeded." 100 }}}'';in {# home-manager.sharedModules = mkIf config.isDesktopNotWsl [{# xdg.desktopEntries.rebuild = {# name = "Rebuild";# icon = "system-run";# exec = ''rebuild'';# terminal = false;# };# xdg.desktopEntries.rebuild-plum = {# name = "Rebuild plum";# icon = "system-run";# exec = ''rebuild --remote plum'';# terminal = false;# };# xdg.desktopEntries.rebuild-kiwi = {# name = "Rebuild kiwi";# icon = "system-run";# exec = ''rebuild --remote kiwi'';# terminal = false;# };# xdg.desktopEntries.rollback = {# name = "Rollback";# icon = "folder";# exec = ''rebuild rollback'';# terminal = false;# };# }];environment.systemPackages = [rebuildScript];
'';in{environment.systemPackages = [pkgs.nhpkgs.nix-output-monitorrebuildScript];};