Upgrade NixOS. Use upstream libedgetpu, frigate, and gasket kernel module. Fix services broken by upgrade.

common/network/pia-wireguard.nix

@@ -151,7 +151,7 @@ in
       partOf = [ containerServiceName ];
       wantedBy = [ "multi-user.target" ];
 
-      path = with pkgs; [ wireguard-tools jq curl iproute iputils ];
+      path = with pkgs; [ wireguard-tools jq curl iproute2 iputils ];
 
       serviceConfig = {
         Type = "oneshot";
@@ -224,7 +224,7 @@ in
       after = [ "network.target" "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
-      path = with pkgs; [ wireguard-tools iproute curl jq iptables ];
+      path = with pkgs; [ wireguard-tools iproute2 curl jq iptables ];
 
       serviceConfig = {
         Type = "oneshot";

common/pc/chromium.nix

@@ -57,7 +57,7 @@ in
     };
     # todo vulkan in chrome
     # todo video encoding in chrome
-    hardware.opengl = {
+    hardware.graphics = {
       enable = true;
       extraPackages = with pkgs; [
         intel-media-driver # LIBVA_DRIVER_NAME=iHD

common/pc/default.nix

@@ -27,10 +27,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    # vulkan
-    hardware.opengl.driSupport = true;
-    hardware.opengl.driSupport32Bit = true;
-
     # Applications
     users.users.googlebot.packages = with pkgs; [
       chromium

common/server/default.nix

@@ -10,7 +10,6 @@
     ./matrix.nix
     ./zerobin.nix
     ./gitea.nix
-    ./privatebin/privatebin.nix
     ./radio.nix
     ./samba.nix
     ./owncast.nix

common/server/privatebin/conf.php

@@ -1,42 +0,0 @@
-;<?php http_response_code(403); /*
-[main]
-name = "Kode Paste"
-discussion = false
-opendiscussion = false
-password = true
-fileupload = false
-burnafterreadingselected = false
-defaultformatter = "plaintext"
-sizelimit = 10485760
-template = "bootstrap"
-languageselection = false
-
-[expire]
-default = "1week"
-
-[expire_options]
-5min = 300
-10min = 600
-1hour = 3600
-1day = 86400
-1week = 604800
-
-[formatter_options]
-plaintext = "Plain Text"
-syntaxhighlighting = "Source Code"
-markdown = "Markdown"
-
-[traffic]
-limit = 10
-dir = "/var/lib/privatebin"
-
-[purge]
-limit = 300
-batchsize = 10
-dir = "/var/lib/privatebin"
-
-[model]
-class = Filesystem
-
-[model_options]
-dir = "/var/lib/privatebin"

common/server/privatebin/privatebin.nix

@@ -1,74 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.services.privatebin;
-  privateBinSrc = pkgs.stdenv.mkDerivation {
-    name = "privatebin";
-    src = pkgs.fetchFromGitHub {
-      owner = "privatebin";
-      repo = "privatebin";
-      rev = "d65bf02d7819a530c3c2a88f6f9947651fe5258d";
-      sha256 = "7ttAvEDL1ab0cUZcqZzXFkXwB2rF2t4eNpPxt48ap94=";
-    };
-    installPhase = ''
-      cp -ar $src $out
-    '';
-  };
-in
-{
-  options.services.privatebin = {
-    enable = lib.mkEnableOption "enable privatebin";
-    host = lib.mkOption {
-      type = lib.types.str;
-      example = "example.com";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-
-    users.users.privatebin = {
-      description = "privatebin service user";
-      group = "privatebin";
-      isSystemUser = true;
-    };
-    users.groups.privatebin = { };
-
-    services.nginx.enable = true;
-    services.nginx.virtualHosts.${cfg.host} = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        root = privateBinSrc;
-        index = "index.php";
-      };
-      locations."~ \.php$" = {
-        root = privateBinSrc;
-        extraConfig = ''
-          fastcgi_pass  unix:${config.services.phpfpm.pools.privatebin.socket};
-          fastcgi_index index.php;
-        '';
-      };
-    };
-
-    systemd.tmpfiles.rules = [
-      "d '/var/lib/privatebin' 0750 privatebin privatebin - -"
-    ];
-
-    services.phpfpm.pools.privatebin = {
-      user = "privatebin";
-      group = "privatebin";
-      phpEnv = {
-        CONFIG_PATH = "${./conf.php}";
-      };
-      settings = {
-        pm = "dynamic";
-        "listen.owner" = config.services.nginx.user;
-        "pm.max_children" = 5;
-        "pm.start_servers" = 2;
-        "pm.min_spare_servers" = 1;
-        "pm.max_spare_servers" = 3;
-        "pm.max_requests" = 500;
-      };
-    };
-  };
-}

common/server/samba.nix

@@ -5,30 +5,28 @@
     services.samba = {
       openFirewall = true;
       package = pkgs.sambaFull; # printer sharing
-      securityType = "user";
 
       # should this be on?
       nsswins = true;
 
-      extraConfig = ''
-        workgroup = HOME
-        server string = smbnix
-        netbios name = smbnix
-        security = user 
-        use sendfile = yes
-        min protocol = smb2
-        guest account = nobody
-        map to guest = bad user
+      settings = {
+        global = {
+          security = "user";
+          workgroup = "HOME";
+          "server string" = "smbnix";
+          "netbios name" = "smbnix";
+          "use sendfile" = "yes";
+          "min protocol" = "smb2";
+          "guest account" = "nobody";
+          "map to guest" = "bad user";
 
           # printing
-        load printers = yes
-        printing = cups
-        printcap name = cups
+          "load printers" = "yes";
+          printing = "cups";
+          "printcap name" = "cups";
 
-        hide files = /.nobackup/.DS_Store/._.DS_Store/
-      '';
-
-      shares = {
+          "hide files" = "/.nobackup/.DS_Store/._.DS_Store/";
+        };
         public = {
           path = "/data/samba/Public";
           browseable = "yes";
@@ -77,9 +75,9 @@
 
     # backups
     backup.group."samba".paths = [
-      config.services.samba.shares.googlebot.path
-      config.services.samba.shares.cris.path
-      config.services.samba.shares.public.path
+      config.services.samba.settings.googlebot.path
+      config.services.samba.settings.cris.path
+      config.services.samba.settings.public.path
     ];
 
     # Windows discovery of samba server

common/server/unifi.nix

@@ -10,7 +10,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    services.unifi.unifiPackage = pkgs.unifi8;
+    services.unifi.unifiPackage = pkgs.unifi;
+    services.unifi.mongodbPackage = pkgs.mongodb-7_0;
 
     networking.firewall = lib.mkIf cfg.openMinimalFirewall {
       allowedUDPPorts = [

flake.lock

@@ -207,36 +207,20 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1728193676,
-        "narHash": "sha256-PbDWAIjKJdlVg+qQRhzdSor04bAPApDqIv2DofTyynk=",
+        "lastModified": 1731278633,
+        "narHash": "sha256-3yxgMFssoDGm9rWJiAGfJRPctr06gaefjnpUltphkAQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ecbc1ca8ffd6aea8372ad16be9ebbb39889e55b6",
+        "rev": "871087c18d344abaa569e7d1b7c1af576aab877f",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.05",
+        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs-frigate": {
-      "locked": {
-        "lastModified": 1695825837,
-        "narHash": "sha256-4Ne11kNRnQsmSJCRSSNkFRSnHC4Y5gPDBIQGjjPfJiU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "5cfafa12d57374f48bcc36fda3274ada276cf69e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "5cfafa12d57374f48bcc36fda3274ada276cf69e",
-        "type": "github"
-      }
-    },
     "radio": {
       "inputs": {
         "flake-utils": [
@@ -288,7 +272,6 @@
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-frigate": "nixpkgs-frigate",
         "radio": "radio",
         "radio-web": "radio-web",
         "simple-nixos-mailserver": "simple-nixos-mailserver",

flake.nix

@@ -1,8 +1,7 @@
 {
   inputs = {
     # nixpkgs
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
-    nixpkgs-frigate.url = "github:NixOS/nixpkgs/5cfafa12d57374f48bcc36fda3274ada276cf69e";
+    nixpkgs.url = "github:NixOS/nixpkgs/master";
 
     # Common Utils Among flake inputs
     systems.url = "github:nix-systems/default";

machines/storage/s0/default.nix

@@ -154,7 +154,7 @@
   nixpkgs.config.packageOverrides = pkgs: {
     vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
   };
-  hardware.opengl = {
+  hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [
       intel-media-driver

machines/storage/s0/frigate.nix

@@ -82,9 +82,11 @@ lib.mkMerge [
       settings = {
         mqtt = {
           enabled = true;
-          host = "localhost:1883";
+          host = "localhost";
+          port = 1883;
+          user = "root";
+          password = "{FRIGATE_MQTT_PASSWORD}";
         };
-        rtmp.enabled = false;
         snapshots = {
           enabled = true;
           bounding_box = true;
@@ -145,11 +147,23 @@ lib.mkMerge [
     systemd.services.frigate.serviceConfig.SupplementaryGroups = [ "apex" ];
 
     # Coral PCIe driver
-    kernel.enableGasketKernelModule = true;
+    boot.extraModulePackages = with config.boot.kernelPackages; [ gasket ];
+    services.udev.extraRules = ''
+      SUBSYSTEM=="apex", MODE="0660", GROUP="apex"
+    '';
 
     services.frigate.settings.detectors.coral = {
       type = "edgetpu";
       device = "pci";
     };
   }
+  {
+    # Fix bug in nixos module where cache is not cleared when starting the service because "rm" cannot be found
+    systemd.services.frigate.serviceConfig.ExecStartPre = lib.mkForce "${pkgs.bash}/bin/sh -c 'rm -f /var/cache/frigate/*.mp4'";
+  }
+  {
+    # Don't require authentication for frigate
+    # This is ok because the reverse proxy already requires tailscale access anyway
+    services.frigate.settings.auth.enabled = false;
+  }
 ]

machines/storage/s0/hardware-configuration.nix

@@ -22,7 +22,6 @@
   # zfs
   networking.hostId = "5e6791f0";
   boot.supportedFilesystems = [ "zfs" ];
-  boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
 
   # luks
   remoteLuksUnlock.enable = true;

machines/storage/s0/home-automation.nix

@@ -24,12 +24,13 @@
       homeassistant = true;
       permit_join = false;
       serial = {
+        adapter = "ember";
         port = "/dev/ttyACM0";
       };
       mqtt = {
         server = "mqtt://localhost:1883";
         user = "root";
-        password = "'!/run/agenix/zigbee2mqtt.yaml mqtt_password'";
+        password = "!/run/agenix/zigbee2mqtt.yaml mqtt_password";
       };
       frontend = {
         host = "localhost";

machines/zoidberg/default.nix

@@ -33,7 +33,7 @@
   hardware.enableAllFirmware = true;
 
   # ROCm
-  hardware.opengl.extraPackages = with pkgs; [
+  hardware.graphics.extraPackages = with pkgs; [
     rocm-opencl-icd
     rocm-opencl-runtime
   ];

overlays/default.nix

@@ -3,13 +3,7 @@ final: prev:
 
 let
   system = prev.system;
-  frigatePkgs = inputs.nixpkgs-frigate.legacyPackages.${system};
 in
 {
-  # It seems that libedgetpu needs to be built with the newer version of tensorflow in nixpkgs
-  # but I am lazy so I instead just downgrade by using the old nixpkgs
-  libedgetpu = frigatePkgs.callPackage ./libedgetpu { };
-  frigate = frigatePkgs.frigate;
-
   actual-server = prev.callPackage ./actualbudget { };
 }

overlays/kernel-modules/default.nix

@@ -7,13 +7,5 @@
 
 let
   cfg = config.kernel;
-
-  gasket = config.boot.kernelPackages.callPackage ./gasket.nix { };
 in
-{
-  options.kernel.enableGasketKernelModule = lib.mkEnableOption "Enable Gasket Kernel Module";
-
-  config = lib.mkIf cfg.enableGasketKernelModule {
-    boot.extraModulePackages = [ gasket ];
-  };
-}
+{ }

overlays/kernel-modules/gasket.nix

@@ -1,36 +0,0 @@
-{ stdenv, lib, fetchFromGitHub, kernel }:
-
-stdenv.mkDerivation rec {
-  pname = "gasket";
-  version = "1.0-18-unstable-2023-09-05";
-
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "gasket-driver";
-    rev = "5815ee3908a46a415aac616ac7b9aedcb98a504c";
-    sha256 = "sha256-O17+msok1fY5tdX1DvqYVw6plkUDF25i8sqwd6mxYf8=";
-  };
-
-  makeFlags = kernel.makeFlags ++ [
-    "-C"
-    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-    "M=$(PWD)"
-  ];
-  buildFlags = [ "modules" ];
-
-  installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
-  installTargets = [ "modules_install" ];
-
-  sourceRoot = "${src.name}/src";
-  hardeningDisable = [ "pic" "format" ];
-  nativeBuildInputs = kernel.moduleBuildDependencies;
-
-  meta = with lib; {
-    description = "The Coral Gasket Driver allows usage of the Coral EdgeTPU on Linux systems.";
-    homepage = "https://github.com/google/gasket-driver";
-    license = licenses.gpl2;
-    maintainers = [ lib.maintainers.kylehendricks ];
-    platforms = platforms.linux;
-    broken = versionOlder kernel.version "5.15";
-  };
-}

overlays/libedgetpu/default.nix

@@ -1,72 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, libusb1
-, abseil-cpp
-, flatbuffers
-, xxd
-}:
-
-let
-  flatbuffers_1_12 = flatbuffers.overrideAttrs (oldAttrs: rec {
-    version = "1.12.0";
-    NIX_CFLAGS_COMPILE = "-Wno-error=class-memaccess -Wno-error=maybe-uninitialized";
-    cmakeFlags = (oldAttrs.cmakeFlags or [ ]) ++ [ "-DFLATBUFFERS_BUILD_SHAREDLIB=ON" ];
-    NIX_CXXSTDLIB_COMPILE = "-std=c++17";
-    configureFlags = (oldAttrs.configureFlags or [ ]) ++ [ "--enable-shared" ];
-    src = fetchFromGitHub {
-      owner = "google";
-      repo = "flatbuffers";
-      rev = "v${version}";
-      sha256 = "sha256-L1B5Y/c897Jg9fGwT2J3+vaXsZ+lfXnskp8Gto1p/Tg=";
-    };
-  });
-
-in
-stdenv.mkDerivation rec {
-  pname = "libedgetpu";
-  version = "grouper";
-
-  src = fetchFromGitHub {
-    owner = "google-coral";
-    repo = pname;
-    rev = "release-${version}";
-    sha256 = "sha256-73hwItimf88Iqnb40lk4ul/PzmCNIfdt6Afi+xjNiBE=";
-  };
-
-  patches = [ ./libedgetpu-stddef.diff ];
-
-  makeFlags = [ "-f" "makefile_build/Makefile" "libedgetpu" ];
-
-  buildInputs = [
-    libusb1
-    abseil-cpp
-    flatbuffers_1_12
-  ];
-
-  nativeBuildInputs = [
-    xxd
-  ];
-
-  NIX_CXXSTDLIB_COMPILE = "-std=c++17";
-
-  TFROOT = "${fetchFromGitHub {
-    owner = "tensorflow";
-    repo = "tensorflow";
-    rev = "v2.7.4";
-    sha256 = "sha256-liDbUAdaVllB0b74aBeqNxkYNu/zPy7k3CevzRF5dk0=";
-  }}";
-
-  enableParallelBuilding = false;
-
-  installPhase = ''
-    mkdir -p $out/lib
-    cp out/direct/k8/libedgetpu.so.1.0 $out/lib
-    ln -s $out/lib/libedgetpu.so.1.0 $out/lib/libedgetpu.so.1
-    mkdir -p $out/lib/udev/rules.d
-    cp debian/edgetpu-accelerator.rules $out/lib/udev/rules.d/99-edgetpu-accelerator.rules
-
-    # PCIe rule
-    echo 'SUBSYSTEM=="apex", MODE="0660", GROUP="apex"' > $out/lib/udev/rules.d/65-apex.rules
-  '';
-}

overlays/libedgetpu/libedgetpu-stddef.diff

@@ -1,12 +0,0 @@
-diff --git a/api/allocated_buffer.h b/api/allocated_buffer.h
-index 97740f0..7bc0547 100644
---- a/api/allocated_buffer.h
-+++ b/api/allocated_buffer.h
-@@ -16,6 +16,7 @@
- #define DARWINN_API_ALLOCATED_BUFFER_H_
- 
- #include <functional>
-+#include <cstddef>
- 
- namespace platforms {
- namespace darwinn {

secrets/frigate-credentials.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 hPp1nw Chke1ZtpXxN1c1+AnJ6Cd5kpM1KfQKTwymrfPW53QCA
-jUcw8eitC7r0rwefjllndZjARIqpWoVqGCnefHfjQ6Y
--> ssh-ed25519 w3nu8g KY/5bU1B5uvmfGHF2d6qBL1NYy64qo324rdvkgnXoDA
-OBvuFtzZXQ0RmmEXelyzHMMiVqZir7zQJMA36ZH2siE
---- CSd7lYSYQ2fCTjkJLPGdaNGL8eVpE9IBEyFo0LW907M
-£³$šO†ÈIß/À//Êw*ƒ™õD¤@u5o[¼â:·äš¥t¾˜]Jñ쮸™@Ùhþu£Àk;?·XüÁHRº’Ñ°E5¥ÍçÜ9
+-> ssh-ed25519 hPp1nw zOXF7NsZjm+DCYrJ+Ap2mX35JUt37CLJP1RhyOjB/XE
+ePprJM2cnhYZhP8aJUXOZeGHJm/DHlRYomWN+lFaU6w
+-> ssh-ed25519 w3nu8g gjeFAbFWXyPdGauKHXAzuIP9fmaj2Oysq9fHO8q7u38
+KiMR0pgEPtsfZnYAIsH7UHNhnsB6rtsW/hqV03uS2dI
+--- BPzPECz1g6vEv4OlRn6+FnWP9oq3tn6TN2o867icxYA
+}ìjºùŽ+l&þàx<C3A0>-TïÝ‹b‡ÅèØÄ·<C384>€Dg‰ñgc’*ˆ0<CB86>÷µcp
…}uþ‹7Íßã%9Ð%ŽÒú›©S¥ ‰|šôêöQœÃ*9Ø$ä ŽŠ
ÍÖi;)c?ÍÍýGh¤VvªnlÚs¤Ç)r }Ò­hE5K‡bg­–-<2D>®