try out appvm

TODO.md

@@ -11,7 +11,6 @@
 
 ### Housekeeping
 - Cleanup the line between hardware-configuration.nix and configuration.nix in machine config
-- CI https://gvolpe.com/blog/nixos-binary-cache-ci/
 - remove `options.currentSystem`
 - allow `hostname` option for webservices to be null to disable configuring nginx
 
@@ -50,6 +49,29 @@
 - https://christine.website/blog/paranoid-nixos-2021-07-18
 - https://nixos.wiki/wiki/Impermanence
 
+# Setup CI
+- CI
+    - hydra
+    - https://docs.cachix.org/continuous-integration-setup/
+- Binary Cache
+    - Maybe use cachix https://gvolpe.com/blog/nixos-binary-cache-ci/
+    - Self hosted binary cache? https://www.tweag.io/blog/2019-11-21-untrusted-ci/
+    - https://github.com/edolstra/nix-serve
+    - https://nixos.wiki/wiki/Binary_Cache
+    - https://discourse.nixos.org/t/introducing-attic-a-self-hostable-nix-binary-cache-server/24343
+- Both
+    - https://garnix.io/
+    - https://nixbuild.net
+
+
+# Secrets
+- consider using headscale
+- Replace luks over tor for remote unlock with luks over tailscale using ephemeral keys
+- Rollover luks FDE passwords
+- /secrets on personal computers should only be readable using a trusted ssh key, preferably requiring a yubikey
+- Rollover shared yubikey secrets
+- offsite backup yubikey, pw db, and ssh key with /secrets access
+
 ### Misc
 - https://github.com/pop-os/system76-scheduler
 - improve email a little bit https://helloinbox.email

machines/ray/configuration.nix

@@ -18,10 +18,20 @@
   hardware.openrazer.devicesOffOnScreensaver = false;
   users.users.googlebot.packages = [ pkgs.polychromatic ];
 
-  # depthai
   services.udev.extraRules = ''
+    # depthai
     SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
+
+    # Moonlander
+    # Rules for Oryx web flashing and live training
+    KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
+    KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
+    # Wally Flashing rules for the Moonlander and Planck EZ
+    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
   '';
+  users.groups.plugdev = {
+    members = [ "googlebot" ];
+  };
 
   # virt-manager
   virtualisation.libvirtd.enable = true;
@@ -37,6 +47,9 @@
 
   virtualisation.docker.enable = true;
 
+  virtualisation.appvm.enable = true;
+  virtualisation.appvm.user = "googlebot";
+
   services.mount-samba.enable = true;
 
   de.enable = true;