.gitea/workflows/check-flake.yaml

@@ -15,12 +15,5 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Setup Attic Cache
-        uses: https://github.com/ryanccn/attic-action@v0
-        with:
-          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-          cache: ${{ secrets.ATTIC_CACHE }}
-          token: ${{ secrets.ATTIC_TOKEN }}
-
       - name: Check Flake
         run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace

Makefile

@@ -20,8 +20,3 @@ rekey-secrets:
 .PHONY: clean-old-nixos-profiles
 clean-old-nixos-profiles:
 	doas nix-collect-garbage -d
-
-# Garbage Collect
-.PHONY: gc
-gc:
-	nix store gc

common/binary-cache.nix

@@ -6,11 +6,11 @@
       substituters = [
         "https://cache.nixos.org/"
         "https://nix-community.cachix.org"
-        "http://s0.koi-bebop.ts.net:28338/nixos"
+        "http://s0.koi-bebop.ts.net:5000"
       ];
       trusted-public-keys = [
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "nixos:IDhKojUaMz+UIiri1/DQk9EpqDokih8dwxmp41uJnls="
+        "s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU="
       ];
     };
   };

common/default.nix

@@ -63,7 +63,6 @@
     lf
     gnumake
     tree
-    attic
   ];
 
   nixpkgs.config.allowUnfree = true;

common/server/atticd.nix

@@ -1,37 +0,0 @@
-{ config, lib, ... }:
-
-let
-  cfg = config.services.atticd;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.atticd = {
-      credentialsFile = "/run/agenix/atticd-credentials";
-
-      settings = {
-        listen = "[::]:28338";
-
-        chunking = {
-          # Disable chunking for performance (I have plenty of space)
-          nar-size-threshold = 0;
-
-          # Chunking is disabled due to poor performance so these values don't matter but are required anyway.
-          # One day, when I move away from ZFS maybe this will perform well enough.
-          # nar-size-threshold = 64 * 1024; # 64 KiB
-          min-size = 16 * 1024; # 16 KiB
-          avg-size = 64 * 1024; # 64 KiB
-          max-size = 256 * 1024; # 256 KiB
-        };
-
-        # Disable compression for performance (I have plenty of space)
-        compression.type = "none";
-
-        garbage-collection = {
-          default-retention-period = "6 months";
-        };
-      };
-    };
-
-    age.secrets.atticd-credentials.file = ../../secrets/atticd-credentials.age;
-  };
-}

common/server/default.nix

@@ -22,6 +22,5 @@
     ./dashy.nix
     ./librechat.nix
     ./actualbudget.nix
-    ./atticd.nix
   ];
 }

common/shell.nix

@@ -34,8 +34,6 @@
     io_seq_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=write --size=2g --io_size=10g --blocksize=1024k --ioengine=libaio --fsync=10000 --iodepth=32 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
     io_rand_read = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randread --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=32 --runtime=60 --group_reporting; rm temp.file";
     io_rand_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randrw --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
-
-    llsblk = "lsblk -o +uuid,fsType";
   };
 
   nixpkgs.overlays = [

flake.lock

@@ -7,9 +7,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": [
+        "systems": "systems"
-          "systems"
-        ]
       },
       "locked": {
         "lastModified": 1716561646,
@@ -25,36 +23,6 @@
         "type": "github"
       }
     },
-    "attic": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": [
-          "flake-compat"
-        ],
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1717279440,
-        "narHash": "sha256-kH04ReTjxOpQumgWnqy40vvQLSnLGxWP6RF3nq5Esrk=",
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "rev": "717cc95983cdc357bc347d70be20ced21f935843",
-        "type": "github"
-      },
-      "original": {
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "type": "github"
-      }
-    },
     "blobs": {
       "flake": false,
       "locked": {
@@ -71,27 +39,6 @@
         "type": "gitlab"
       }
     },
-    "crane": {
-      "inputs": {
-        "nixpkgs": [
-          "attic",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1717025063,
-        "narHash": "sha256-dIubLa56W9sNNz0e8jGxrX3CAkPXsq7snuFA/Ie6dn8=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "480dff0be03dac0e51a8dfc26e882b0d123a450e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
     "dailybuild_modules": {
       "inputs": {
         "flake-utils": [
@@ -108,11 +55,11 @@
         "rev": "1290ddd9a2ff2bf2d0f702750768312b80efcd34",
         "revCount": 19,
         "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
       }
     },
     "darwin": {
@@ -139,22 +86,21 @@
     },
     "deploy-rs": {
       "inputs": {
-        "flake-compat": [
+        "flake-compat": "flake-compat",
-          "flake-compat"
-        ],
         "nixpkgs": [
           "nixpkgs"
         ],
         "utils": [
-          "flake-utils"
+          "simple-nixos-mailserver",
+          "utils"
         ]
       },
       "locked": {
-        "lastModified": 1718194053,
+        "lastModified": 1715699772,
-        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
+        "narHash": "sha256-sKhqIgucN5sI/7UQgBwsonzR4fONjfMr9OcHK/vPits=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
+        "rev": "b3ea6f333f9057b77efd9091119ba67089399ced",
         "type": "github"
       },
       "original": {
@@ -179,11 +125,25 @@
         "type": "github"
       }
     },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
-        "systems": [
+        "systems": "systems_2"
-          "systems"
-        ]
       },
       "locked": {
         "lastModified": 1710146030,
@@ -332,10 +292,8 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "attic": "attic",
         "dailybuild_modules": "dailybuild_modules",
         "deploy-rs": "deploy-rs",
-        "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
@@ -343,32 +301,24 @@
         "nixpkgs-frigate": "nixpkgs-frigate",
         "radio": "radio",
         "radio-web": "radio-web",
-        "simple-nixos-mailserver": "simple-nixos-mailserver",
+        "simple-nixos-mailserver": "simple-nixos-mailserver"
-        "systems": "systems"
       }
     },
     "simple-nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
-        "flake-compat": [
+        "flake-compat": "flake-compat_2",
-          "flake-compat"
-        ],
         "nixpkgs": [
           "nixpkgs"
         ],
-        "nixpkgs-24_05": [
+        "utils": "utils"
-          "nixpkgs"
-        ],
-        "utils": [
-          "flake-utils"
-        ]
       },
       "locked": {
-        "lastModified": 1718084203,
+        "lastModified": 1714720456,
-        "narHash": "sha256-Cx1xoVfSMv1XDLgKg08CUd1EoTYWB45VmB9XIQzhmzI=",
+        "narHash": "sha256-e0WFe1BHqX23ADpGBc4ZRu38Mg+GICCZCqyS6EWCbHc=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "29916981e7b3b5782dc5085ad18490113f8ff63b",
+        "rev": "41059fc548088e49e3ddb3a2b4faeb5de018e60f",
         "type": "gitlab"
       },
       "original": {
@@ -392,6 +342,36 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1605370193,
+        "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5021eac20303a61fafe17224c087f5519baed54d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -1,91 +1,40 @@
 {
   inputs = {
-    # nixpkgs
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
     nixpkgs-frigate.url = "github:NixOS/nixpkgs/5cfafa12d57374f48bcc36fda3274ada276cf69e";
 
-    # Common Utils Among flake inputs
+    flake-utils.url = "github:numtide/flake-utils";
-    systems.url = "github:nix-systems/default";
-    flake-utils = {
-      url = "github:numtide/flake-utils";
-      inputs.systems.follows = "systems";
-    };
-    flake-compat = {
-      url = "github:edolstra/flake-compat";
-      flake = false;
-    };
 
-    # NixOS hardware
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
-    # Mail Server
+    # mail server
-    simple-nixos-mailserver = {
+    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
-      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
+    simple-nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        nixpkgs-24_05.follows = "nixpkgs";
-        flake-compat.follows = "flake-compat";
-        utils.follows = "flake-utils";
-      };
-    };
 
-    # Agenix
+    # agenix
-    agenix = {
+    agenix.url = "github:ryantm/agenix";
-      url = "github:ryantm/agenix";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        systems.follows = "systems";
-      };
-    };
 
-    # Radio
+    # radio
-    radio = {
+    radio.url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
-      url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
+    radio.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    radio.inputs.flake-utils.follows = "flake-utils";
-        nixpkgs.follows = "nixpkgs";
+    radio-web.url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
-        flake-utils.follows = "flake-utils";
+    radio-web.flake = false;
-      };
-    };
-    radio-web = {
-      url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
-      flake = false;
-    };
 
-    # Dailybot
+    # drastikbot
-    dailybuild_modules = {
+    dailybuild_modules.url = "git+https://git.neet.dev/zuckerberg/dailybuild_modules.git";
-      url = "git+https://git.neet.dev/zuckerberg/dailybot.git";
+    dailybuild_modules.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    dailybuild_modules.inputs.flake-utils.follows = "flake-utils";
-        nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-      };
-    };
 
-    # NixOS deployment
+    # nixos config deployment
-    deploy-rs = {
+    deploy-rs.url = "github:serokell/deploy-rs";
-      url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    deploy-rs.inputs.utils.follows = "simple-nixos-mailserver/utils";
-        nixpkgs.follows = "nixpkgs";
-        flake-compat.follows = "flake-compat";
-        utils.follows = "flake-utils";
-      };
-    };
 
-    # Prebuilt nix-index database
+    # prebuilt nix-index database
-    nix-index-database = {
+    nix-index-database.url = "github:Mic92/nix-index-database";
-      url = "github:Mic92/nix-index-database";
+    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    # Attic
-    attic = {
-      url = "github:zhaofengli/attic";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        nixpkgs-stable.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-        flake-compat.follows = "flake-compat";
-      };
-    };
   };
 
   outputs = { self, nixpkgs, ... }@inputs:
@@ -105,7 +54,6 @@
             agenix.nixosModules.default
             dailybuild_modules.nixosModule
             nix-index-database.nixosModules.nix-index
-            attic.nixosModules.atticd
             self.nixosModules.kernel-modules
             ({ lib, ... }: {
               config = {

machines/storage/s0/default.nix

@@ -10,6 +10,23 @@
 
   # system.autoUpgrade.enable = true;
 
+  nix.gc.automatic = lib.mkForce false; # allow the nix store to serve as a build cache
+
+  # binary cache
+  services.nix-serve = {
+    enable = true;
+    openFirewall = true;
+    secretKeyFile = "/run/agenix/binary-cache-private-key";
+  };
+  age.secrets.binary-cache-private-key.file = ../../../secrets/binary-cache-private-key.age;
+  users.users.cache-push = {
+    isNormalUser = true;
+    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB" ];
+  };
+  nix.settings = {
+    trusted-users = [ "cache-push" ];
+  };
+
   services.iperf3.enable = true;
   services.iperf3.openFirewall = true;
 
@@ -218,6 +235,4 @@
   };
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
-
-  services.atticd.enable = true;
 }

machines/zoidberg/default.nix

@@ -42,25 +42,25 @@
   ];
 
   # System wide barrier instance
-  # systemd.services.barrier-sddm = {
+  systemd.services.barrier-sddm = {
-  #   description = "Barrier mouse/keyboard share";
+    description = "Barrier mouse/keyboard share";
-  #   requires = [ "display-manager.service" ];
+    requires = [ "display-manager.service" ];
-  #   after = [ "network.target" "display-manager.service" ];
+    after = [ "network.target" "display-manager.service" ];
-  #   wantedBy = [ "multi-user.target" ];
+    wantedBy = [ "multi-user.target" ];
-  #   serviceConfig = {
+    serviceConfig = {
-  #     Restart = "always";
+      Restart = "always";
-  #     RestartSec = 10;
+      RestartSec = 10;
-  #     # todo use user/group
+      # todo use user/group
-  #   };
+    };
-  #   path = with pkgs; [ barrier doas ];
+    path = with pkgs; [ barrier doas ];
-  #   script = ''
+    script = ''
-  #     # Wait for file to show up. "display-manager.service" finishes a bit too soon
+      # Wait for file to show up. "display-manager.service" finishes a bit too soon
-  #     while ! [ -e /run/sddm/* ]; do sleep 1; done;
+      while ! [ -e /run/sddm/* ]; do sleep 1; done;
-  #     export XAUTHORITY=$(ls /run/sddm/*)
+      export XAUTHORITY=$(ls /run/sddm/*)
-  #     # Disable crypto is fine because tailscale is E2E encrypting better than barrier could anyway
+      # Disable crypto is fine because tailscale is E2E encrypting better than barrier could anyway
-  #     barrierc -f --disable-crypto --name zoidberg ray.koi-bebop.ts.net
+      barrierc -f --disable-crypto --name zoidberg ray.koi-bebop.ts.net
-  #   '';
+    '';
-  # };
+  };
 
   # Login into X11 plasma so barrier works well
   services.displayManager.defaultSession = "plasma";

machines/zoidberg/hardware-configuration.nix

@@ -7,7 +7,7 @@
     ];
 
   # boot
-  boot.loader.systemd-boot.enable = true;
+  efi.enable = true;
   boot.loader.timeout = lib.mkForce 15;
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
@@ -35,7 +35,7 @@
     };
   fileSystems."/boot" =
     {
-      device = "/dev/disk/by-uuid/954B-AB3E";
+      device = "/dev/disk/by-uuid/8074-B04D";
       fsType = "vfat";
     };
   swapDevices =

secrets/atticd-credentials.age

@@ -1,8 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 hPp1nw tMy5kLAcQD62yAfEVJ4LQZjs0kkEEQOfM4HN9yj3hBY
-JvlklGTxxfAZbP+alm3nxLxqhmcu2mTKwRU5WaapL9w
--> ssh-ed25519 w3nu8g ZGzufldXq7kmIpqFecbkpDxiykWZ207k0+09I2dmxEM
-SK25e5HBe4b5reGXXfCjIFbFGzfu32RFjY++/yteRVc
---- xZOe1syYAcVRDhiNRv+CsfFgoQbiANA6vNCon+5NExc
--·ñ1Å,C-.M§Áè?ÐêóµµàY|u+
-‹	³Ø<C2B3>÷ŽæÒ¡ôm†Œûäfß]=érøÜüÎAg¤€æSú:Ð8•S¦LiœùªsêÁâ9JŠð<>¸ÏæñÄÐÃ<ûAz¹[ý§xï<78>:‡'U*<2A>wÀ™D/…±VpM~!õ,* ¿”µ¡øk¥Ö´ßEíîïh› {¢p$¾R`ÿ”

secrets/secrets.nix

@@ -20,7 +20,10 @@ with roles;
   "robots-email-pw.age".publicKeys = gitea;
 
   # nix binary cache
-  "atticd-credentials.age".publicKeys = binary-cache;
+  # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
+  "binary-cache-private-key.age".publicKeys = binary-cache;
+  # public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB
+  "binary-cache-push-sshkey.age".publicKeys = nobody; # this value is directly given to gitea
 
   # vpn
   "iodine.age".publicKeys = iodine;