use postgres 15

.gitea/workflows/check-flake.yaml

@@ -15,14 +15,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - run: attic -V
+      - run: |
-
+          pwd
-      - name: Setup Attic Cache
+          ls -lah .
-        uses: https://git.neet.dev/zuckerberg/attic-action@v0.2.5
+          whoami
-        with:
-          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-          cache: ${{ secrets.ATTIC_CACHE }}
-          token: ${{ secrets.ATTIC_TOKEN }}
 
       - name: Check Flake
-        run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace
+        run: nix flake check --show-trace

Makefile

@@ -1,27 +0,0 @@
-# Lockfile utils
-.PHONY: update-lockfile
-update-lockfile:
-	nix flake update --commit-lock-file
-
-.PHONY: update-lockfile-without-commit
-update-lockfile-without-commit:
-	nix flake update
-
-# Agenix utils
-.PHONY: edit-secret
-edit-secret:
-	cd secrets && agenix -e $(filter-out $@,$(MAKECMDGOALS))
-
-.PHONY: rekey-secrets
-rekey-secrets:
-	cd secrets && agenix -r
-
-# NixOS utils
-.PHONY: clean-old-nixos-profiles
-clean-old-nixos-profiles:
-	doas nix-collect-garbage -d
-
-# Garbage Collect
-.PHONY: gc
-gc:
-	nix store gc

common/binary-cache.nix

@@ -6,11 +6,11 @@
       substituters = [
         "https://cache.nixos.org/"
         "https://nix-community.cachix.org"
-        "http://s0.koi-bebop.ts.net:28338/nixos"
+        "http://s0.koi-bebop.ts.net:5000"
       ];
       trusted-public-keys = [
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "nixos:IDhKojUaMz+UIiri1/DQk9EpqDokih8dwxmp41uJnls="
+        "s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU="
       ];
     };
   };

common/boot/bios.nix

@@ -10,10 +10,6 @@ in
     device = mkOption {
       type = types.str;
     };
-    configurationLimit = mkOption {
-      default = 20;
-      type = types.int;
-    };
   };
 
   config = mkIf cfg.enable {
@@ -23,7 +19,7 @@ in
         enable = true;
         device = cfg.device;
         useOSProber = true;
-        configurationLimit = cfg.configurationLimit;
+        configurationLimit = 20;
         theme = pkgs.nixos-grub2-theme;
       };
     };

common/boot/efi.nix

@@ -7,10 +7,6 @@ in
 {
   options.efi = {
     enable = mkEnableOption "enable efi boot";
-    configurationLimit = mkOption {
-      default = 20;
-      type = types.int;
-    };
   };
 
   config = mkIf cfg.enable {
@@ -23,7 +19,7 @@ in
         efiSupport = true;
         useOSProber = true;
         #       memtest86.enable = true;
-        configurationLimit = cfg.configurationLimit;
+        configurationLimit = 20;
         theme = pkgs.nixos-grub2-theme;
       };
     };

common/boot/remote-luks-unlock.nix

@@ -35,6 +35,11 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    # boot.initrd.luks.devices.${cfg.device.name} = {
+    #   device = cfg.device.path;
+    #   allowDiscards = cfg.device.allowDiscards;
+    # };
+
     # Unlock LUKS disk over ssh
     boot.initrd.network.enable = true;
     boot.initrd.kernelModules = cfg.kernelModules;

common/default.nix

@@ -18,7 +18,7 @@
 
   nix.flakes.enable = true;
 
-  system.stateVersion = "23.11";
+  system.stateVersion = "21.11";
 
   networking.useDHCP = false;
 
@@ -26,13 +26,7 @@
   networking.firewall.allowPing = true;
 
   time.timeZone = "America/Denver";
-  i18n = {
+  i18n.defaultLocale = "en_US.UTF-8";
-    defaultLocale = "en_US.UTF-8";
-    extraLocaleSettings = {
-      LANGUAGE = "en_US.UTF-8";
-      LC_ALL = "en_US.UTF-8";
-    };
-  };
 
   services.openssh = {
     enable = true;
@@ -61,9 +55,6 @@
     lm_sensors
     picocom
     lf
-    gnumake
-    tree
-    attic
   ];
 
   nixpkgs.config.allowUnfree = true;

common/flakes.nix

@@ -10,6 +10,7 @@ in
 
   config = mkIf cfg.enable {
     nix = {
+      package = pkgs.nixFlakes;
       extraOptions = ''
         experimental-features = nix-command flakes
       '';

common/pc/default.nix

@@ -6,20 +6,19 @@ in
 {
   imports = [
     ./kde.nix
-    #    ./xfce.nix
+    ./xfce.nix
     ./yubikey.nix
     ./chromium.nix
-    ./firefox.nix
+    #    ./firefox.nix
     ./audio.nix
     #    ./torbrowser.nix
     ./pithos.nix
+    ./spotify.nix
     ./vscodium.nix
     ./discord.nix
     ./steam.nix
     ./touchpad.nix
     ./mount-samba.nix
-    ./udev.nix
-    ./virtualisation.nix
   ];
 
   options.de = {
@@ -42,10 +41,12 @@ in
       mpv
       nextcloud-client
       signal-desktop
+      minecraft
       gparted
       libreoffice-fresh
       thunderbird
-      spotify
+      spotifyd
+      spotify-qt
       arduino
       yt-dlp
       jellyfin-media-player
@@ -56,6 +57,7 @@ in
 
       # For Nix IDE
       nixpkgs-fmt
+      rnix-lsp
     ];
 
     # Networking
@@ -69,25 +71,12 @@ in
     ];
     # Printer discovery
     services.avahi.enable = true;
-    services.avahi.nssmdns4 = true;
+    services.avahi.nssmdns = true;
 
     programs.file-roller.enable = true;
 
     # Security
     services.gnome.gnome-keyring.enable = true;
     security.pam.services.googlebot.enableGnomeKeyring = true;
-
-    # Android dev
-    programs.adb.enable = true;
-
-    # Mount personal SMB stores
-    services.mount-samba.enable = true;
-
-    # allow building ARM derivations
-    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-    # for luks onlock over tor
-    services.tor.enable = true;
-    services.tor.client.enable = true;
   };
 }

common/pc/firefox.nix

@@ -20,6 +20,31 @@ let
   };
 
   firefox = pkgs.wrapFirefox somewhatPrivateFF {
+    desktopName = "Sneed Browser";
+
+    nixExtensions = [
+      (pkgs.fetchFirefoxAddon {
+        name = "ublock-origin";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3719054/ublock_origin-1.33.2-an+fx.xpi";
+        sha256 = "XDpe9vW1R1iVBTI4AmNgAg1nk7BVQdIAMuqd0cnK5FE=";
+      })
+      (pkgs.fetchFirefoxAddon {
+        name = "sponsorblock";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3720594/sponsorblock_skip_sponsorships_on_youtube-2.0.12.3-an+fx.xpi";
+        sha256 = "HRtnmZWyXN3MKo4AvSYgNJGkBEsa2RaMamFbkz+YzQg=";
+      })
+      (pkgs.fetchFirefoxAddon {
+        name = "KeePassXC-Browser";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3720664/keepassxc_browser-1.7.6-fx.xpi";
+        sha256 = "3K404/eq3amHhIT0WhzQtC892he5I0kp2SvbzE9dbZg=";
+      })
+      (pkgs.fetchFirefoxAddon {
+        name = "https-everywhere";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3716461/https_everywhere-2021.1.27-an+fx.xpi";
+        sha256 = "2gSXSLunKCwPjAq4Wsj0lOeV551r3G+fcm1oeqjMKh8=";
+      })
+    ];
+
     extraPolicies = {
       CaptivePortal = false;
       DisableFirefoxStudies = true;
@@ -49,6 +74,12 @@ let
         ExtensionRecommendations = false;
         SkipOnboarding = true;
       };
+      WebsiteFilter = {
+        Block = [
+          "http://paradigminteractive.io/"
+          "https://paradigminteractive.io/"
+        ];
+      };
     };
 
     extraPrefs = ''

common/pc/kde.nix

@@ -5,16 +5,22 @@ let
 in
 {
   config = lib.mkIf cfg.enable {
-    services.displayManager.sddm.enable = true;
+    # kde plasma
-    services.displayManager.sddm.wayland.enable = true;
+    services.xserver = {
-    services.desktopManager.plasma6.enable = true;
+      enable = true;
+      desktopManager.plasma5.enable = true;
+      displayManager.sddm.enable = true;
+    };
 
     # kde apps
+    nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true;
     users.users.googlebot.packages = with pkgs; [
       # akonadi
       # kmail
       # plasma5Packages.kmail-account-wizard
       kate
     ];
+
+    services.xserver.desktopManager.plasma5.useQtScaling = true;
   };
 }

common/pc/spotify.nix

@@ -0,0 +1,86 @@
+{ lib, config, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.spotifyd;
+  toml = pkgs.formats.toml { };
+  spotifydConf = toml.generate "spotify.conf" cfg.settings;
+in
+{
+  disabledModules = [
+    "services/audio/spotifyd.nix"
+  ];
+
+  options = {
+    services.spotifyd = {
+      enable = mkEnableOption "spotifyd, a Spotify playing daemon";
+
+      settings = mkOption {
+        default = { };
+        type = toml.type;
+        example = { global.bitrate = 320; };
+        description = ''
+          Configuration for Spotifyd. For syntax and directives, see
+          <link xlink:href="https://github.com/Spotifyd/spotifyd#Configuration"/>.
+        '';
+      };
+
+      users = mkOption {
+        type = with types; listOf str;
+        default = [ ];
+        description = ''
+          Usernames to be added to the "spotifyd" group, so that they
+          can start and interact with the userspace daemon.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    # username specific stuff because i'm lazy...
+    services.spotifyd.users = [ "googlebot" ];
+    users.users.googlebot.packages = with pkgs; [
+      spotify
+      spotify-tui
+    ];
+
+    users.groups.spotifyd = {
+      members = cfg.users;
+    };
+
+    age.secrets.spotifyd = {
+      file = ../../secrets/spotifyd.age;
+      group = "spotifyd";
+      mode = "0440"; # group can read
+    };
+
+    # spotifyd to read secrets and run as user service
+    services.spotifyd = {
+      settings.global = {
+        username_cmd = "sed '1q;d' /run/agenix/spotifyd";
+        password_cmd = "sed '2q;d' /run/agenix/spotifyd";
+        bitrate = 320;
+        backend = "pulseaudio";
+        device_name = config.networking.hostName;
+        device_type = "computer";
+        # on_song_change_hook = "command_to_run_on_playback_events"
+        autoplay = true;
+      };
+    };
+
+    systemd.user.services.spotifyd-daemon = {
+      enable = true;
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      description = "spotifyd, a Spotify playing daemon";
+      environment.SHELL = "/bin/sh";
+      serviceConfig = {
+        ExecStart = "${pkgs.spotifyd}/bin/spotifyd --no-daemon --config-path ${spotifydConf}";
+        Restart = "always";
+        CacheDirectory = "spotifyd";
+      };
+    };
+  };
+}

common/pc/touchpad.nix

@@ -9,7 +9,7 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    services.libinput.enable = true;
+    services.xserver.libinput.enable = true;
-    services.libinput.touchpad.naturalScrolling = true;
+    services.xserver.libinput.touchpad.naturalScrolling = true;
   };
 }

common/pc/udev.nix

@@ -1,25 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.de;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.udev.extraRules = ''
-      # depthai
-      SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
-
-      # Moonlander
-      # Rules for Oryx web flashing and live training
-      KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
-      KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
-      # Wally Flashing rules for the Moonlander and Planck EZ
-      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
-    '';
-    services.udev.packages = [ pkgs.platformio ];
-
-    users.groups.plugdev = {
-      members = [ "googlebot" ];
-    };
-  };
-}

common/pc/use-meson-v57.patch

@@ -0,0 +1,22 @@
+diff --git a/meson.build b/meson.build
+index dace367..8c0e290 100644
+--- a/meson.build
++++ b/meson.build
+@@ -8,7 +8,7 @@ project(
+         'warning_level=0',
+     ],
+     license: 'MIT',
+-    meson_version: '>= 0.58.0',
++    meson_version: '>= 0.57.0',
+ )
+ 
+ cc = meson.get_compiler('c')
+@@ -47,8 +47,3 @@ shared_library(
+     gnu_symbol_visibility: 'hidden',
+ )
+ 
+-meson.add_devenv(environment({
+-    'NVD_LOG': '1',
+-    'LIBVA_DRIVER_NAME': 'nvidia',
+-    'LIBVA_DRIVERS_PATH': meson.project_build_root(),
+-}))

common/pc/virtualisation.nix

@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.de;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # AppVMs
-    virtualisation.appvm.enable = true;
-    virtualisation.appvm.user = "googlebot";
-
-    # Use podman instead of docker
-    virtualisation.podman.enable = true;
-    virtualisation.podman.dockerCompat = true;
-
-    # virt-manager
-    virtualisation.libvirtd.enable = true;
-    programs.dconf.enable = true;
-    virtualisation.spiceUSBRedirection.enable = true;
-    environment.systemPackages = with pkgs; [ virt-manager ];
-    users.users.googlebot.extraGroups = [ "libvirtd" "adbusers" ];
-  };
-}

common/server/actualbudget.nix

@@ -1,87 +0,0 @@
-# Starting point:
-# https://github.com/aldoborrero/mynixpkgs/commit/c501c1e32dba8f4462dcecb57eee4b9e52038e27
-
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.services.actual-server;
-  stateDir = "/var/lib/${cfg.stateDirName}";
-in
-{
-  options.services.actual-server = {
-    enable = lib.mkEnableOption "Actual Server";
-
-    hostname = lib.mkOption {
-      type = lib.types.str;
-      default = "localhost";
-      description = "Hostname for the Actual Server.";
-    };
-
-    port = lib.mkOption {
-      type = lib.types.int;
-      default = 25448;
-      description = "Port on which the Actual Server should listen.";
-    };
-
-    stateDirName = lib.mkOption {
-      type = lib.types.str;
-      default = "actual-server";
-      description = "Name of the directory under /var/lib holding the server's data.";
-    };
-
-    upload = {
-      fileSizeSyncLimitMB = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
-        default = null;
-        description = "File size limit in MB for synchronized files.";
-      };
-
-      syncEncryptedFileSizeLimitMB = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
-        default = null;
-        description = "File size limit in MB for synchronized encrypted files.";
-      };
-
-      fileSizeLimitMB = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
-        default = null;
-        description = "File size limit in MB for file uploads.";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    systemd.services.actual-server = {
-      description = "Actual Server";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        ExecStart = "${pkgs.actual-server}/bin/actual-server";
-        Restart = "always";
-        StateDirectory = cfg.stateDirName;
-        WorkingDirectory = stateDir;
-        DynamicUser = true;
-        UMask = "0007";
-      };
-      environment = {
-        NODE_ENV = "production";
-        ACTUAL_PORT = toString cfg.port;
-
-        # Actual is actually very bad at configuring it's own paths despite that information being readily available
-        ACTUAL_USER_FILES = "${stateDir}/user-files";
-        ACTUAL_SERVER_FILES = "${stateDir}/server-files";
-        ACTUAL_DATA_DIR = stateDir;
-
-        ACTUAL_UPLOAD_FILE_SYNC_SIZE_LIMIT_MB = toString (cfg.upload.fileSizeSyncLimitMB or "");
-        ACTUAL_UPLOAD_SYNC_ENCRYPTED_FILE_SIZE_LIMIT_MB = toString (cfg.upload.syncEncryptedFileSizeLimitMB or "");
-        ACTUAL_UPLOAD_FILE_SIZE_LIMIT_MB = toString (cfg.upload.fileSizeLimitMB or "");
-      };
-    };
-
-    services.nginx.virtualHosts.${cfg.hostname} = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/".proxyPass = "http://localhost:${toString cfg.port}";
-    };
-  };
-}

common/server/atticd.nix

@@ -1,40 +0,0 @@
-{ config, lib, ... }:
-
-let
-  cfg = config.services.atticd;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.atticd = {
-      credentialsFile = "/run/agenix/atticd-credentials";
-
-      settings = {
-        listen = "[::]:28338";
-
-        # Speed things up
-        require-proof-of-possession = false;
-
-        chunking = {
-          # Disable chunking for performance (I have plenty of space)
-          nar-size-threshold = 0;
-
-          # Chunking is disabled due to poor performance so these values don't matter but are required anyway.
-          # One day, when I move away from ZFS maybe this will perform well enough.
-          # nar-size-threshold = 64 * 1024; # 64 KiB
-          min-size = 16 * 1024; # 16 KiB
-          avg-size = 64 * 1024; # 64 KiB
-          max-size = 256 * 1024; # 256 KiB
-        };
-
-        # Disable compression for performance (I have plenty of space)
-        compression.type = "none";
-
-        garbage-collection = {
-          default-retention-period = "6 months";
-        };
-      };
-    };
-
-    age.secrets.atticd-credentials.file = ../../secrets/atticd-credentials.age;
-  };
-}

common/server/default.nix

@@ -20,8 +20,5 @@
     ./searx.nix
     ./gitea-actions-runner.nix
     ./dashy.nix
-    ./librechat.nix
-    ./actualbudget.nix
-    ./atticd.nix
   ];
 }

common/server/gitea-actions-runner.nix

@@ -116,7 +116,6 @@ in
       git
       # Gitea Actions rely heavily on node. Include it because it would be installed anyway.
       nodejs
-      attic
     ];
 
     # To allow building on the host, must override the the service's config so it doesn't use a dynamic user

common/server/gitea.nix

@@ -13,7 +13,7 @@ in
   config = lib.mkIf cfg.enable {
     services.gitea = {
       appName = cfg.hostname;
-      lfs.enable = true;
+      # lfs.enable = true;
       # dump.enable = true;
       settings = {
         server = {
@@ -31,9 +31,6 @@ in
         };
         session = {
           COOKIE_SECURE = true;
-          PROVIDER = "db";
-          SESSION_LIFE_TIME = 259200; # 3 days
-          GC_INTERVAL_TIME = 259200; # 3 days
         };
         mailer = {
           ENABLED = true;
@@ -47,9 +44,6 @@ in
         actions = {
           ENABLED = true;
         };
-        indexer = {
-          REPO_INDEXER_ENABLED = true;
-        };
       };
       mailerPasswordFile = "/run/agenix/robots-email-pw";
     };
@@ -68,7 +62,7 @@ in
       enableACME = true;
       forceSSL = true;
       locations."/" = {
-        proxyPass = "http://localhost:${toString cfg.settings.server.HTTP_PORT}";
+        proxyPass = "http://localhost:${toString cfg.httpPort}";
       };
     };
   };

common/server/librechat.nix

@@ -1,62 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.librechat;
-in
-{
-  options.services.librechat = {
-    enable = mkEnableOption "librechat";
-    port = mkOption {
-      type = types.int;
-      default = 3080;
-    };
-    host = lib.mkOption {
-      type = lib.types.str;
-      example = "example.com";
-    };
-  };
-
-  config = mkIf cfg.enable {
-    virtualisation.oci-containers.containers = {
-      librechat = {
-        image = "ghcr.io/danny-avila/librechat:v0.6.6";
-        environment = {
-          HOST = "0.0.0.0";
-          MONGO_URI = "mongodb://host.containers.internal:27017/LibreChat";
-          ENDPOINTS = "openAI,google,bingAI,gptPlugins";
-        };
-        environmentFiles = [
-          "/run/agenix/librechat-env-file"
-        ];
-        ports = [
-          "${toString cfg.port}:3080"
-        ];
-      };
-    };
-    age.secrets.librechat-env-file.file = ../../secrets/librechat-env-file.age;
-
-    services.mongodb.enable = true;
-    services.mongodb.bind_ip = "0.0.0.0";
-
-    # easier podman maintenance
-    virtualisation.oci-containers.backend = "podman";
-    virtualisation.podman.dockerSocket.enable = true;
-    virtualisation.podman.dockerCompat = true;
-
-    # For mongodb access
-    networking.firewall.trustedInterfaces = [
-      "podman0" # for librechat
-    ];
-
-    services.nginx.virtualHosts.${cfg.host} = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://localhost:${toString cfg.port}";
-        proxyWebsockets = true;
-      };
-    };
-  };
-}

common/server/mailserver.nix

@@ -55,7 +55,6 @@ in
         "joslyn@runyan.org"
         "damon@runyan.org"
         "jonas@runyan.org"
-        "simon@neet.dev"
       ];
       forwards = {
         "amazon@runyan.org" = [
@@ -63,7 +62,7 @@ in
           "cris@runyan.org"
         ];
       };
-      certificateScheme = "acme-nginx"; # use let's encrypt for certs
+      certificateScheme = 3; # use let's encrypt for certs
     };
     age.secrets.hashed-email-pw.file = ../../secrets/hashed-email-pw.age;
     age.secrets.cris-hashed-email-pw.file = ../../secrets/cris-hashed-email-pw.age;

common/server/nextcloud.nix

@@ -8,7 +8,7 @@ in
   config = lib.mkIf cfg.enable {
     services.nextcloud = {
       https = true;
-      package = pkgs.nextcloud29;
+      package = pkgs.nextcloud26;
       hostName = "neet.cloud";
       config.dbtype = "sqlite";
       config.adminuser = "jeremy";

common/server/samba.nix

@@ -97,7 +97,7 @@
     # Printer discovery
     # (is this needed?)
     services.avahi.enable = true;
-    services.avahi.nssmdns4 = true;
+    services.avahi.nssmdns = true;
 
     # printer sharing
     systemd.tmpfiles.rules = [

common/shell.nix

@@ -34,8 +34,6 @@
     io_seq_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=write --size=2g --io_size=10g --blocksize=1024k --ioengine=libaio --fsync=10000 --iodepth=32 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
     io_rand_read = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randread --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=32 --runtime=60 --group_reporting; rm temp.file";
     io_rand_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randrw --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
-
-    llsblk = "lsblk -o +uuid,fsType";
   };
 
   nixpkgs.overlays = [

flake.lock

@@ -6,17 +6,14 @@
         "home-manager": "home-manager",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "systems": [
-          "systems"
         ]
       },
       "locked": {
-        "lastModified": 1716561646,
+        "lastModified": 1690228878,
-        "narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
+        "narHash": "sha256-9Xe7JV0krp4RJC9W9W9WutZVlw6BlHTFMiUP/k48LQY=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
+        "rev": "d8c973fd228949736dedf61b7f8cc1ece3236792",
         "type": "github"
       },
       "original": {
@@ -25,36 +22,6 @@
         "type": "github"
       }
     },
-    "attic": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": [
-          "flake-compat"
-        ],
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1717279440,
-        "narHash": "sha256-kH04ReTjxOpQumgWnqy40vvQLSnLGxWP6RF3nq5Esrk=",
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "rev": "717cc95983cdc357bc347d70be20ced21f935843",
-        "type": "github"
-      },
-      "original": {
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "type": "github"
-      }
-    },
     "blobs": {
       "flake": false,
       "locked": {
@@ -71,27 +38,6 @@
         "type": "gitlab"
       }
     },
-    "crane": {
-      "inputs": {
-        "nixpkgs": [
-          "attic",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1717025063,
-        "narHash": "sha256-dIubLa56W9sNNz0e8jGxrX3CAkPXsq7snuFA/Ie6dn8=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "480dff0be03dac0e51a8dfc26e882b0d123a450e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
     "dailybuild_modules": {
       "inputs": {
         "flake-utils": [
@@ -108,11 +54,11 @@
         "rev": "1290ddd9a2ff2bf2d0f702750768312b80efcd34",
         "revCount": 19,
         "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
       }
     },
     "darwin": {
@@ -123,11 +69,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700795494,
+        "lastModified": 1673295039,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
         "type": "github"
       },
       "original": {
@@ -139,22 +85,21 @@
     },
     "deploy-rs": {
       "inputs": {
-        "flake-compat": [
+        "flake-compat": "flake-compat",
-          "flake-compat"
-        ],
         "nixpkgs": [
           "nixpkgs"
         ],
         "utils": [
-          "flake-utils"
+          "simple-nixos-mailserver",
+          "utils"
         ]
       },
       "locked": {
-        "lastModified": 1718194053,
+        "lastModified": 1686747123,
-        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
+        "narHash": "sha256-XUQK9kwHpTeilHoad7L4LjMCCyY13Oq383CoFADecRE=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
+        "rev": "724463b5a94daa810abfc64a4f87faef4e00f984",
         "type": "github"
       },
       "original": {
@@ -166,11 +111,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
+        "lastModified": 1668681692,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "009399224d5e398d03b22badca40a37ac85412a1",
         "type": "github"
       },
       "original": {
@@ -181,16 +126,14 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": [
+        "systems": "systems"
-          "systems"
-        ]
       },
       "locked": {
-        "lastModified": 1710146030,
+        "lastModified": 1689068808,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
         "type": "github"
       },
       "original": {
@@ -207,11 +150,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703113217,
+        "lastModified": 1682203081,
-        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "narHash": "sha256-kRL4ejWDhi0zph/FpebFYhzqlOBrk0Pl3dzGEKSAlEw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "rev": "32d3e39c491e2f91152c84f8ad8b003420eab0a1",
         "type": "github"
       },
       "original": {
@@ -227,11 +170,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1716772633,
+        "lastModified": 1691292840,
-        "narHash": "sha256-Idcye44UW+EgjbjCoklf2IDF+XrehV6CVYvxR1omst4=",
+        "narHash": "sha256-NA+o/NoOOQhzAQwB2JpeKoG+iYQ6yn/XXVxaGd5HSQI=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "ff80cb4a11bb87f3ce8459be6f16a25ac86eb2ac",
+        "rev": "6c626d54d0414d34c771c0f6f9d771bc8aaaa3c4",
         "type": "github"
       },
       "original": {
@@ -240,52 +183,35 @@
         "type": "github"
       }
     },
-    "nixos-hardware": {
-      "locked": {
-        "lastModified": 1717248095,
-        "narHash": "sha256-e8X2eWjAHJQT82AAN+mCI0B68cIDBJpqJ156+VRrFO0=",
-        "owner": "NixOS",
-        "repo": "nixos-hardware",
-        "rev": "7b49d3967613d9aacac5b340ef158d493906ba79",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "master",
-        "repo": "nixos-hardware",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1717144377,
+        "lastModified": 1706515015,
-        "narHash": "sha256-F/TKWETwB5RaR8owkPPi+SPJh83AQsm6KrQAlJ8v/uA=",
+        "narHash": "sha256-eFfY5A7wlYy3jD/75lx6IJRueg4noE+jowl0a8lIlVo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "805a384895c696f802a9bf5bf4720f37385df547",
+        "rev": "f4a8d6d5324c327dcc2d863eb7f3cc06ad630df4",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.05",
+        "ref": "nixos-23.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
-    "nixpkgs-frigate": {
+    "nixpkgs-22_05": {
       "locked": {
-        "lastModified": 1695825837,
+        "lastModified": 1654936503,
-        "narHash": "sha256-4Ne11kNRnQsmSJCRSSNkFRSnHC4Y5gPDBIQGjjPfJiU=",
+        "narHash": "sha256-soKzdhI4jTHv/rSbh89RdlcJmrPgH8oMb/PLqiqIYVQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5cfafa12d57374f48bcc36fda3274ada276cf69e",
+        "rev": "dab6df51387c3878cdea09f43589a15729cae9f4",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "id": "nixpkgs",
-        "repo": "nixpkgs",
+        "ref": "nixos-22.05",
-        "rev": "5cfafa12d57374f48bcc36fda3274ada276cf69e",
+        "type": "indirect"
-        "type": "github"
       }
     },
     "radio": {
@@ -332,48 +258,36 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "attic": "attic",
         "dailybuild_modules": "dailybuild_modules",
         "deploy-rs": "deploy-rs",
-        "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
         "nix-index-database": "nix-index-database",
-        "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-frigate": "nixpkgs-frigate",
         "radio": "radio",
         "radio-web": "radio-web",
-        "simple-nixos-mailserver": "simple-nixos-mailserver",
+        "simple-nixos-mailserver": "simple-nixos-mailserver"
-        "systems": "systems"
       }
     },
     "simple-nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
-        "flake-compat": [
-          "flake-compat"
-        ],
         "nixpkgs": [
           "nixpkgs"
         ],
-        "nixpkgs-24_05": [
+        "nixpkgs-22_05": "nixpkgs-22_05",
-          "nixpkgs"
+        "utils": "utils"
-        ],
-        "utils": [
-          "flake-utils"
-        ]
       },
       "locked": {
-        "lastModified": 1718084203,
+        "lastModified": 1655930346,
-        "narHash": "sha256-Cx1xoVfSMv1XDLgKg08CUd1EoTYWB45VmB9XIQzhmzI=",
+        "narHash": "sha256-ht56HHOzEhjeIgAv5ZNFjSVX/in1YlUs0HG9c1EUXTM=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "29916981e7b3b5782dc5085ad18490113f8ff63b",
+        "rev": "f535d8123c4761b2ed8138f3d202ea710a334a1d",
         "type": "gitlab"
       },
       "original": {
         "owner": "simple-nixos-mailserver",
-        "ref": "master",
+        "ref": "nixos-22.05",
         "repo": "nixos-mailserver",
         "type": "gitlab"
       }
@@ -392,6 +306,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1605370193,
+        "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5021eac20303a61fafe17224c087f5519baed54d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -1,91 +1,37 @@
 {
   inputs = {
-    # nixpkgs
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
-    nixpkgs-frigate.url = "github:NixOS/nixpkgs/5cfafa12d57374f48bcc36fda3274ada276cf69e";
 
-    # Common Utils Among flake inputs
+    flake-utils.url = "github:numtide/flake-utils";
-    systems.url = "github:nix-systems/default";
-    flake-utils = {
-      url = "github:numtide/flake-utils";
-      inputs.systems.follows = "systems";
-    };
-    flake-compat = {
-      url = "github:edolstra/flake-compat";
-      flake = false;
-    };
 
-    # NixOS hardware
+    # mail server
-    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
+    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-22.05";
+    simple-nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";
 
-    # Mail Server
+    # agenix
-    simple-nixos-mailserver = {
+    agenix.url = "github:ryantm/agenix";
-      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        nixpkgs-24_05.follows = "nixpkgs";
-        flake-compat.follows = "flake-compat";
-        utils.follows = "flake-utils";
-      };
-    };
 
-    # Agenix
+    # radio
-    agenix = {
+    radio.url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
-      url = "github:ryantm/agenix";
+    radio.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    radio.inputs.flake-utils.follows = "flake-utils";
-        nixpkgs.follows = "nixpkgs";
+    radio-web.url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
-        systems.follows = "systems";
+    radio-web.flake = false;
-      };
-    };
 
-    # Radio
+    # drastikbot
-    radio = {
+    dailybuild_modules.url = "git+https://git.neet.dev/zuckerberg/dailybuild_modules.git";
-      url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
+    dailybuild_modules.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    dailybuild_modules.inputs.flake-utils.follows = "flake-utils";
-        nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-      };
-    };
-    radio-web = {
-      url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
-      flake = false;
-    };
 
-    # Dailybot
+    # nixos config deployment
-    dailybuild_modules = {
+    deploy-rs.url = "github:serokell/deploy-rs";
-      url = "git+https://git.neet.dev/zuckerberg/dailybot.git";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    deploy-rs.inputs.utils.follows = "simple-nixos-mailserver/utils";
-        nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-      };
-    };
 
-    # NixOS deployment
+    # prebuilt nix-index database
-    deploy-rs = {
+    nix-index-database.url = "github:Mic92/nix-index-database";
-      url = "github:serokell/deploy-rs";
+    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        flake-compat.follows = "flake-compat";
-        utils.follows = "flake-utils";
-      };
-    };
-
-    # Prebuilt nix-index database
-    nix-index-database = {
-      url = "github:Mic92/nix-index-database";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    # Attic
-    attic = {
-      url = "github:zhaofengli/attic";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        nixpkgs-stable.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-        flake-compat.follows = "flake-compat";
-      };
-    };
   };
 
   outputs = { self, nixpkgs, ... }@inputs:
@@ -105,7 +51,6 @@
             agenix.nixosModules.default
             dailybuild_modules.nixosModule
             nix-index-database.nixosModules.nix-index
-            attic.nixosModules.atticd
             self.nixosModules.kernel-modules
             ({ lib, ... }: {
               config = {
@@ -146,7 +91,6 @@
               specialArgs = {
                 inherit allModules;
                 lib = self.lib;
-                nixos-hardware = inputs.nixos-hardware;
               };
             };
         in
@@ -175,7 +119,7 @@
           "aarch64-linux"."iso" = mkIso "aarch64-linux";
         };
 
-      overlays.default = import ./overlays { inherit inputs; };
+      overlays.default = import ./overlays;
       nixosModules.kernel-modules = import ./overlays/kernel-modules;
 
       deploy.nodes =

lockfile-update.sh

@@ -0,0 +1,4 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p bash
+
+nix flake update --commit-lock-file

machines/howl/default.nix

@@ -1,13 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-  ];
-
-  # don't use remote builders
-  nix.distributedBuilds = lib.mkForce false;
-
-  de.enable = true;
-  de.touchpad.enable = true;
-}

machines/howl/hardware-configuration.nix

@@ -1,58 +0,0 @@
-{ config, lib, pkgs, modulesPath, nixos-hardware, ... }:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-    nixos-hardware.nixosModules.framework-13-7040-amd
-  ];
-
-  boot.kernelPackages = pkgs.linuxPackages_latest;
-
-  hardware.framework.amd-7040.preventWakeOnAC = true;
-  services.fwupd.enable = true;
-  # fingerprint reader has initially shown to be more of a nuisance than a help
-  # it makes sddm log in fail most of the time and take several minutes to finish
-  services.fprintd.enable = false;
-
-  # boot
-  boot.loader.systemd-boot.enable = true;
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  # thunderbolt
-  services.hardware.bolt.enable = true;
-
-  # firmware
-  firmware.x86_64.enable = true;
-
-  # disks
-  remoteLuksUnlock.enable = true;
-  boot.initrd.luks.devices."enc-pv" = {
-    device = "/dev/disk/by-uuid/c801586b-f0a2-465c-8dae-532e61b83fee";
-    allowDiscards = true;
-  };
-  fileSystems."/" =
-    {
-      device = "/dev/disk/by-uuid/95db6950-a7bc-46cf-9765-3ea675ccf014";
-      fsType = "btrfs";
-    };
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/B087-2C20";
-      fsType = "vfat";
-      options = [ "fmask=0022" "dmask=0022" ];
-    };
-  swapDevices =
-    [{ device = "/dev/disk/by-uuid/49fbdf62-eef4-421b-aac3-c93494afd23c"; }];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp1s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-}

machines/howl/properties.nix

@@ -1,26 +0,0 @@
-{
-  hostNames = [
-    "howl"
-  ];
-
-  arch = "x86_64-linux";
-
-  systemRoles = [
-    "personal"
-  ];
-
-  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEQi3q8jU6vRruExAL60J7GFO1gS8HsmXVJuKRT4ljrG";
-
-  userKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKPnLt84bKhUgFxjQf10+Htro9Lo1Pabqm8mGalBUniv"
-  ];
-
-  deployKeys = [
-    # TODO
-  ];
-
-  remoteUnlock = {
-    hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN0N80r0Sl2WlJaUqfxZPkOtYyGumFazkIqq7eq3Gd2o";
-    onionHost = "ll6yjnkh4psmfwmtkmqoutl4gq4elqzbmjxv4s6gpgoavyi3kwhjvnqd.onion";
-  };
-}

machines/phil/properties.nix

@@ -9,6 +9,7 @@
   systemRoles = [
     "server"
     "nix-builder"
+    "gitea-actions-runner"
   ];
 
   hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlgRPpuUkZqe8/lHugRPm/m2vcN9psYhh5tENHZt9I2";

machines/ponyo/default.nix

@@ -5,7 +5,7 @@
     ./hardware-configuration.nix
   ];
 
-  # system.autoUpgrade.enable = true;
+  system.autoUpgrade.enable = true;
 
   # p2p mesh network
   services.tailscale.exitNode = true;
@@ -63,32 +63,17 @@
     };
   };
   pia.wireguard.badPortForwardPorts = [ ];
-  services.nginx.virtualHosts = {
+  services.nginx.virtualHosts."radio.runyan.org" = {
-    "radio.runyan.org" = {
+    enableACME = true;
-      enableACME = true;
+    forceSSL = true;
-      forceSSL = true;
+    locations = {
-      locations = {
+      "/stream.mp3" = {
-        "/stream.mp3" = {
+        proxyPass = "http://vpn.containers:8001/stream.mp3";
-          proxyPass = "http://vpn.containers:8001/stream.mp3";
+        extraConfig = ''
-          extraConfig = ''
+          add_header Access-Control-Allow-Origin *;
-            add_header Access-Control-Allow-Origin *;
+        '';
-          '';
-        };
-        "/".root = config.inputs.radio-web;
-      };
-    };
-    "radio.neet.space" = {
-      enableACME = true;
-      forceSSL = true;
-      locations = {
-        "/stream.mp3" = {
-          proxyPass = "http://vpn.containers:8001/stream.mp3";
-          extraConfig = ''
-            add_header Access-Control-Allow-Origin *;
-          '';
-        };
-        "/".root = config.inputs.radio-web;
       };
+      "/".root = config.inputs.radio-web;
     };
   };
 
@@ -151,11 +136,4 @@
   # owncast live streaming
   services.owncast.enable = true;
   services.owncast.hostname = "live.neet.dev";
-
-  # librechat
-  services.librechat.enable = true;
-  services.librechat.host = "chat.neet.dev";
-
-  services.actual-server.enable = true;
-  services.actual-server.hostname = "actual.runyan.org";
 }

machines/ponyo/hardware-configuration.nix

@@ -16,7 +16,6 @@
   bios = {
     enable = true;
     device = "/dev/sda";
-    configurationLimit = 3; # Save room in /nix/store
   };
 
   remoteLuksUnlock.enable = true;

machines/ponyo/properties.nix

@@ -15,7 +15,6 @@
     "nextcloud"
     "dailybot"
     "gitea"
-    "librechat"
   ];
 
   hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBBlTAIp38RhErU1wNNV5MBeb+WGH0mhF/dxh5RsAXN";

machines/ray/default.nix

@@ -0,0 +1,67 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  # for luks onlock over tor
+  services.tor.enable = true;
+  services.tor.client.enable = true;
+
+  # don't use remote builders
+  nix.distributedBuilds = lib.mkForce false;
+
+  # services.howdy.enable = true;
+
+  hardware.openrazer.enable = true;
+  hardware.openrazer.users = [ "googlebot" ];
+  hardware.openrazer.devicesOffOnScreensaver = false;
+  users.users.googlebot.packages = [ pkgs.polychromatic ];
+
+  services.udev.extraRules = ''
+    # depthai
+    SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
+
+    # Moonlander
+    # Rules for Oryx web flashing and live training
+    KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
+    KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
+    # Wally Flashing rules for the Moonlander and Planck EZ
+    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
+  '';
+  services.udev.packages = [ pkgs.platformio ];
+  users.groups.plugdev = {
+    members = [ "googlebot" ];
+  };
+
+  # virt-manager
+  virtualisation.libvirtd.enable = true;
+  programs.dconf.enable = true;
+  virtualisation.spiceUSBRedirection.enable = true;
+  environment.systemPackages = with pkgs; [ virt-manager ];
+  users.users.googlebot.extraGroups = [ "libvirtd" "adbusers" ];
+
+  # allow building ARM derivations
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+  services.spotifyd.enable = true;
+
+  virtualisation.podman.enable = true;
+  virtualisation.podman.dockerCompat = true;
+
+  virtualisation.appvm.enable = true;
+  virtualisation.appvm.user = "googlebot";
+
+  services.mount-samba.enable = true;
+
+  de.enable = true;
+  de.touchpad.enable = true;
+
+  networking.firewall.allowedTCPPorts = [
+    # barrier
+    24800
+  ];
+
+  programs.adb.enable = true;
+}

machines/ray/hardware-configuration.nix

@@ -0,0 +1,62 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  # boot
+  efi.enable = true;
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+
+  # kernel
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  # firmware
+  firmware.x86_64.enable = true;
+  hardware.enableAllFirmware = true;
+
+  # gpu
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.nvidia = {
+    modesetting.enable = true; # for nvidia-vaapi-driver
+    prime = {
+      reverseSync.enable = true;
+      offload.enableOffloadCmd = true;
+      nvidiaBusId = "PCI:1:0:0";
+      amdgpuBusId = "PCI:4:0:0";
+    };
+  };
+
+  # disks
+  remoteLuksUnlock.enable = true;
+  boot.initrd.luks.devices."enc-pv" = {
+    device = "/dev/disk/by-uuid/c1822e5f-4137-44e1-885f-954e926583ce";
+    allowDiscards = true;
+  };
+  fileSystems."/" =
+    {
+      device = "/dev/vg/root";
+      fsType = "btrfs";
+      options = [ "subvol=root" ];
+    };
+  fileSystems."/home" =
+    {
+      device = "/dev/vg/root";
+      fsType = "btrfs";
+      options = [ "subvol=home" ];
+    };
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/2C85-2B59";
+      fsType = "vfat";
+    };
+  swapDevices =
+    [{ device = "/dev/vg/swap"; }];
+}

machines/ray/properties.nix

@@ -0,0 +1,22 @@
+{
+  hostNames = [
+    "ray"
+  ];
+
+  arch = "x86_64-linux";
+
+  systemRoles = [
+    "personal"
+    "deploy"
+  ];
+
+  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQM8hwKRgl8cZj7UVYATSLYu4LhG7I0WFJ9m2iWowiB";
+
+  userKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeTK1iARlNIKP/DS8/ObBm9yUM/3L1Ub4XI5A2r9OzP"
+  ];
+
+  deployKeys = [
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEaGIwLiUa6wQLlEF+keQOIYy/tCmJvV6eENzUQjSqW2AAAABHNzaDo="
+  ];
+}

machines/storage/s0/default.nix

@@ -10,6 +10,23 @@
 
   # system.autoUpgrade.enable = true;
 
+  nix.gc.automatic = lib.mkForce false; # allow the nix store to serve as a build cache
+
+  # binary cache
+  services.nix-serve = {
+    enable = true;
+    openFirewall = true;
+    secretKeyFile = "/run/agenix/binary-cache-private-key";
+  };
+  age.secrets.binary-cache-private-key.file = ../../../secrets/binary-cache-private-key.age;
+  users.users.cache-push = {
+    isNormalUser = true;
+    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB" ];
+  };
+  nix.settings = {
+    trusted-users = [ "cache-push" ];
+  };
+
   services.iperf3.enable = true;
   services.iperf3.openFirewall = true;
 
@@ -99,19 +116,13 @@
         # "speed-limit-up-enabled" = true;
 
         /* seeding limit */
-        "ratio-limit" = 3;
+        "ratio-limit" = 2;
         "ratio-limit-enabled" = true;
 
         "download-queue-enabled" = true;
         "download-queue-size" = 20; # gotta go fast
       };
     };
-    # https://github.com/NixOS/nixpkgs/issues/258793
-    systemd.services.transmission.serviceConfig = {
-      RootDirectoryStartOnly = lib.mkForce (lib.mkForce false);
-      RootDirectory = lib.mkForce (lib.mkForce "");
-    };
-
     users.groups.public_data.gid = 994;
     users.users.public_data = {
       isSystemUser = true;
@@ -201,7 +212,6 @@
     4534
     8097
     9091
-    8443 # unifi
   ];
 
   virtualisation.oci-containers.backend = "podman";
@@ -211,13 +221,5 @@
     configFile = ./dashy.yaml;
   };
 
-  services.unifi = {
-    enable = true;
-    openFirewall = true;
-    unifiPackage = pkgs.unifi8;
-  };
-
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
-
-  services.atticd.enable = true;
 }

machines/storage/s0/home-automation.nix

@@ -3,40 +3,6 @@
 let
   frigateHostname = "frigate.s0";
   frigatePort = 61617;
-
-  mkEsp32Cam = address: {
-    ffmpeg = {
-      input_args = "";
-      inputs = [{
-        path = address;
-        roles = [ "detect" "record" ];
-      }];
-
-      output_args.record = "-f segment -pix_fmt yuv420p -segment_time 10 -segment_format mp4 -reset_timestamps 1 -strftime 1 -c:v libx264 -preset ultrafast -an ";
-    };
-    rtmp.enabled = false;
-    snapshots = {
-      enabled = true;
-      bounding_box = true;
-    };
-    record = {
-      enabled = true;
-      retain.days = 10; # Keep video for 10 days
-      events.retain = {
-        default = 30; # Keep video with detections for 30 days
-        mode = "active_objects";
-      };
-    };
-    detect = {
-      enabled = true;
-      width = 800;
-      height = 600;
-      fps = 10;
-    };
-    objects = {
-      track = [ "person" ];
-    };
-  };
 in
 {
   networking.firewall.allowedTCPPorts = [
@@ -55,7 +21,40 @@ in
         host = "localhost:1883";
       };
       cameras = {
-        dahlia-cam = mkEsp32Cam "http://dahlia-cam.lan:8080";
+        dahlia-cam = {
+          ffmpeg = {
+            input_args = "";
+            inputs = [{
+              path = "http://dahlia-cam.lan:8080";
+              roles = [ "detect" "record" ];
+            }];
+
+            output_args.record = "-f segment -pix_fmt yuv420p -segment_time 10 -segment_format mp4 -reset_timestamps 1 -strftime 1 -c:v libx264 -preset ultrafast -an ";
+          };
+          rtmp.enabled = false;
+          snapshots = {
+            enabled = true;
+            bounding_box = true;
+          };
+          record = {
+            enabled = false;
+            retain.days = 0; # To not retain any recording if there is no detection of any events 
+            events.retain = {
+              default = 3; # To retain recording for 3 days of only the events that happened
+              mode = "active_objects";
+            };
+          };
+          detect = {
+            enabled = true;
+            width = 800;
+            height = 600;
+            fps = 20;
+          };
+          objects = {
+            track = [ "dog" ];
+            filters.dog.threshold = 0.4;
+          };
+        };
       };
       # ffmpeg = {
       #   hwaccel_args = "preset-vaapi";
@@ -146,8 +145,7 @@ in
     };
   };
 
-  # TODO need services.oauth2-proxy.cookie.domain ?
+  services.oauth2_proxy =
-  services.oauth2-proxy =
     let
       nextcloudServer = "https://neet.cloud/";
     in
@@ -156,10 +154,9 @@ in
 
       httpAddress = "http://0.0.0.0:4180";
 
-      nginx.domain = frigateHostname;
+      nginx.virtualHosts = [
-      # nginx.virtualHosts = [
+        frigateHostname
-      #   frigateHostname
+      ];
-      # ];
 
       email.domains = [ "*" ];
 

machines/zoidberg/default.nix

@@ -42,28 +42,28 @@
   ];
 
   # System wide barrier instance
-  # systemd.services.barrier-sddm = {
+  systemd.services.barrier-sddm = {
-  #   description = "Barrier mouse/keyboard share";
+    description = "Barrier mouse/keyboard share";
-  #   requires = [ "display-manager.service" ];
+    requires = [ "display-manager.service" ];
-  #   after = [ "network.target" "display-manager.service" ];
+    after = [ "network.target" "display-manager.service" ];
-  #   wantedBy = [ "multi-user.target" ];
+    wantedBy = [ "multi-user.target" ];
-  #   serviceConfig = {
+    serviceConfig = {
-  #     Restart = "always";
+      Restart = "always";
-  #     RestartSec = 10;
+      RestartSec = 10;
-  #     # todo use user/group
+      # todo use user/group
-  #   };
+    };
-  #   path = with pkgs; [ barrier doas ];
+    path = with pkgs; [ barrier doas ];
-  #   script = ''
+    script = ''
-  #     # Wait for file to show up. "display-manager.service" finishes a bit too soon
+      # Wait for file to show up. "display-manager.service" finishes a bit too soon
-  #     while ! [ -e /run/sddm/* ]; do sleep 1; done;
+      while ! [ -e /run/sddm/* ]; do sleep 1; done;
-  #     export XAUTHORITY=$(ls /run/sddm/*)
+      export XAUTHORITY=$(ls /run/sddm/*)
-  #     # Disable crypto is fine because tailscale is E2E encrypting better than barrier could anyway
+      # Disable crypto is fine because tailscale is E2E encrypting better than barrier could anyway
-  #     barrierc -f --disable-crypto --name zoidberg ray.koi-bebop.ts.net
+      barrierc -f --disable-crypto --name zoidberg ray.koi-bebop.ts.net
-  #   '';
+    '';
-  # };
+  };
 
   # Login into X11 plasma so barrier works well
-  services.displayManager.defaultSession = "plasma";
+  services.xserver.displayManager.defaultSession = "plasma";
 
   users.users.cris = {
     isNormalUser = true;
@@ -83,7 +83,7 @@
   };
 
   # Auto login into Plasma in john zoidberg account
-  services.displayManager.sddm.settings = {
+  services.xserver.displayManager.sddm.settings = {
     Autologin = {
       Session = "plasma";
       User = "john";
@@ -96,14 +96,4 @@
     spotify
     retroarchFull
   ];
-
-  # Command and Conquer Ports
-  networking.firewall.allowedUDPPorts = [ 4321 27900 ];
-  networking.firewall.allowedTCPPorts = [ 6667 28910 29900 29920 ];
-
-  nixpkgs.config.rocmSupport = true;
-  services.ollama = {
-    enable = true;
-    acceleration = "rocm";
-  };
 }

machines/zoidberg/hardware-configuration.nix

@@ -7,7 +7,7 @@
     ];
 
   # boot
-  boot.loader.systemd-boot.enable = true;
+  efi.enable = true;
   boot.loader.timeout = lib.mkForce 15;
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
@@ -35,7 +35,7 @@
     };
   fileSystems."/boot" =
     {
-      device = "/dev/disk/by-uuid/954B-AB3E";
+      device = "/dev/disk/by-uuid/8074-B04D";
       fsType = "vfat";
     };
   swapDevices =

overlays/actualbudget/default.nix

@@ -1,39 +0,0 @@
-{ lib
-, buildNpmPackage
-, fetchFromGitHub
-, python3
-, nodejs
-, runtimeShell
-}:
-buildNpmPackage rec {
-  pname = "actual-server";
-  version = "24.3.0";
-
-  src = fetchFromGitHub {
-    owner = "actualbudget";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-y51Dhdn84AWR/gM4LnAzvBIBpvKwUiclnPnwzkRoJ0I=";
-  };
-
-  npmDepsHash = "sha256-/UM2Tz8t4hi621HtXSu0LTDIzZ9SWMqKXqKfPwkdpE8=";
-
-  patches = [
-    ./migrations-should-use-pkg-path.patch
-  ];
-
-  postPatch = ''
-    cp ${./package-lock.json} package-lock.json
-  '';
-
-  dontNpmBuild = true;
-
-  postInstall = ''
-    mkdir -p $out/bin
-    cat <<EOF > $out/bin/actual-server
-    #!${runtimeShell}
-    exec ${nodejs}/bin/node $out/lib/node_modules/actual-sync/app.js "\$@"
-    EOF
-    chmod +x $out/bin/actual-server
-  '';
-}

overlays/actualbudget/migrations-should-use-pkg-path.patch

@@ -1,47 +0,0 @@
-diff --git a/src/load-config.js b/src/load-config.js
-index d3cc5dd..cfcad8a 100644
---- a/src/load-config.js
-+++ b/src/load-config.js
-@@ -3,7 +3,8 @@ import path from 'node:path';
- import { fileURLToPath } from 'node:url';
- import createDebug from 'debug';
- 
--const debug = createDebug('actual:config');
-+// const debug = createDebug('actual:config');
-+const debug = console.log;
- const debugSensitive = createDebug('actual-sensitive:config');
- 
- const projectRoot = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-@@ -90,6 +91,7 @@ const finalConfig = {
-   serverFiles: process.env.ACTUAL_SERVER_FILES || config.serverFiles,
-   userFiles: process.env.ACTUAL_USER_FILES || config.userFiles,
-   webRoot: process.env.ACTUAL_WEB_ROOT || config.webRoot,
-+  dataDir: process.env.ACTUAL_DATA_DIR || config.dataDir,
-   https:
-     process.env.ACTUAL_HTTPS_KEY && process.env.ACTUAL_HTTPS_CERT
-       ? {
-diff --git a/src/migrations.js b/src/migrations.js
-index 964e1f2..3a341d7 100644
---- a/src/migrations.js
-+++ b/src/migrations.js
-@@ -1,6 +1,12 @@
- import migrate from 'migrate';
- import path from 'node:path';
- import config from './load-config.js';
-+import { fileURLToPath } from 'url';
-+
-+const __filename = fileURLToPath(import.meta.url);
-+const __dirname = path.dirname(__filename);
-+const appRoot = path.dirname(__dirname);
-+const migrationsDirectory = path.join(appRoot, "migrations");
- 
- export default function run(direction = 'up') {
-   console.log(
-@@ -13,6 +19,7 @@ export default function run(direction = 'up') {
-         stateStore: `${path.join(config.dataDir, '.migrate')}${
-           config.mode === 'test' ? '-test' : ''
-         }`,
-+        migrationsDirectory,
-       },
-       (err, set) => {
-         if (err) {

overlays/default.nix

@@ -1,22 +1,5 @@
-{ inputs }:
 final: prev:
 
-let
-  system = prev.system;
-  frigatePkgs = inputs.nixpkgs-frigate.legacyPackages.${system};
-in
 {
-  # It seems that libedgetpu needs to be built with the newer version of tensorflow in nixpkgs
+  libedgetpu = prev.callPackage ./libedgetpu { };
-  # but I am lazy so I instead just downgrade by using the old nixpkgs
-  libedgetpu = frigatePkgs.callPackage ./libedgetpu { };
-  frigate = frigatePkgs.frigate;
-
-  actual-server = prev.callPackage ./actualbudget { };
-  unifi8 = prev.unifi.overrideAttrs (oldAttrs: rec {
-    version = "8.1.113";
-    src = prev.fetchurl {
-      url = "https://dl.ui.com/unifi/8.1.113/unifi_sysvinit_all.deb";
-      sha256 = "1knm+l8MSb7XKq2WIbehAnz7loRPjgnc+R98zpWKEAE=";
-    };
-  });
 }

overlays/kernel-modules/gasket.nix

@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "gasket";
-  version = "1.0-18-unstable-2023-09-05";
+  version = "1.0-18";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "gasket-driver";
-    rev = "5815ee3908a46a415aac616ac7b9aedcb98a504c";
+    rev = "09385d485812088e04a98a6e1227bf92663e0b59";
-    sha256 = "sha256-O17+msok1fY5tdX1DvqYVw6plkUDF25i8sqwd6mxYf8=";
+    sha256 = "fcnqCBh04e+w8g079JyuyY2RPu34M+/X+Q8ObE+42i4=";
   };
 
-  makeFlags = kernel.makeFlags ++ [
+  makeFlags = [
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(PWD)"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
-  sourceRoot = "${src.name}/src";
+  sourceRoot = "source/src";
   hardeningDisable = [ "pic" "format" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
@@ -31,6 +31,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ lib.maintainers.kylehendricks ];
     platforms = platforms.linux;
-    broken = versionOlder kernel.version "5.15";
   };
 }

patches/gamepadui.patch

@@ -6,8 +6,8 @@ index 29c449c16946..f6c728eb7f0c 100644
    in
      pkgs.writeShellScriptBin "steam-gamescope" ''
        ${builtins.concatStringsSep "\n" exports}
--      gamescope --steam ${builtins.toString cfg.gamescopeSession.args} -- steam -tenfoot -pipewire-dmabuf
+-      gamescope --steam ${toString cfg.gamescopeSession.args} -- steam -tenfoot -pipewire-dmabuf
-+      gamescope --steam ${builtins.toString cfg.gamescopeSession.args} -- steam -gamepadui -steamdeck -pipewire-dmabuf &> /tmp/steamlog
++      gamescope --steam ${toString cfg.gamescopeSession.args} -- steam -gamepadui -steamdeck -pipewire-dmabuf &> /tmp/steamlog
      '';
  
    gamescopeSessionFile =

secrets/atticd-credentials.age

@@ -1,8 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 hPp1nw tMy5kLAcQD62yAfEVJ4LQZjs0kkEEQOfM4HN9yj3hBY
-JvlklGTxxfAZbP+alm3nxLxqhmcu2mTKwRU5WaapL9w
--> ssh-ed25519 w3nu8g ZGzufldXq7kmIpqFecbkpDxiykWZ207k0+09I2dmxEM
-SK25e5HBe4b5reGXXfCjIFbFGzfu32RFjY++/yteRVc
---- xZOe1syYAcVRDhiNRv+CsfFgoQbiANA6vNCon+5NExc
--·ñ1Å,C-.M§Áè?ÐêóµµàY|u+
-‹	³Ø<C2B3>÷ŽæÒ¡ôm†Œûäfß]=érøÜüÎAg¤€æSú:Ð8•S¦LiœùªsêÁâ9JŠð<>¸ÏæñÄÐÃ<ûAz¹[ý§xï<78>:‡'U*<2A>wÀ™D/…±VpM~!õ,* ¿”µ¡øk¥Ö´ßEíîïh› {¢p$¾R`ÿ”

secrets/backblaze-s3-backups.age

@@ -1,24 +1,23 @@
 age-encryption.org/v1
--> ssh-ed25519 N7drjg YHZO6ENbBihFQFqRRjdWtgfX3R+qHtaJWIa54igHpEc
+-> ssh-ed25519 yHDAQw BnVxLTfrWFqaT6+Tz8I0gQReC2NjADak1TlzotVHzEs
-HLeZDyErwJme8knPYCxuSXMmHBkz2kDI6OBG6/EtP7w
+tzQGIMBFH1v91gezCWjCk3qNi6nhCFVMxaZrrxqFT+c
--> ssh-ed25519 yHDAQw 2YvHNNsiDJSUkKZOlhWzP4l1NfH0zTnldZV4Jjfy620
+-> ssh-ed25519 jQaHAA BwpFr2XXWTaNeYgieI1rkRw5u/mf55vVooZnJJhMLSI
-dHM0wG9JLiQJJ+NquhPeI/xv1iEqsxRy9D//NcYTr8k
+4VmJ1R5lcmD+apxg4WLnMk+aTJt3GOS+6KOE75NqjEY
--> ssh-ed25519 jQaHAA QtNkLsgdVgJqbmxLFhaf7AIG208NXHzgBweO8L3Dc3E
+-> ssh-ed25519 dMQYog oBypOzXH4ioZv9PzYGYxG4jBDRv6qIiRglj/f/uJugU
-SGjvdajk9M5azgP4QcynnxKieKEJYil1T2az4hYffdM
+SQRv3Iel0jeONRAVp96VFtKjXGJ8PMvp80ys4otQp0U
--> ssh-ed25519 w3nu8g JuFJuOdVOc8Uk5es2rpqPVHgg+l6/K0J+MHDFuffn0A
+-> ssh-ed25519 WBT1Hw wb7yUuZOQPhCYusR6WS5/e/NgC7UpBnIO0HZaO2+xxM
-n7tzohV+Uvecu6GVNeht/O/dL4x6e5SVdHEzRbJg3rI
+faHL6WBApWk8+871XmVRHcllXN4I7kgnqngY633jSI0
--> ssh-ed25519 dMQYog 44RRRe8M2FJWigy3d9TNaUQSM47gLDgU38F6ow1Xe2c
+-> ssh-ed25519 6AT2/g +l7AjVqKk9oi96mglZDQN5AVncmVqjEjFfPXFZYdGlI
-uQVkQma/hZVMCMtgcelyZhscvc46LItvbcPBuJI81Ns
+nEQtVZGMIKJlIf0Bj8T2YkUKQawpyP0bqCJ3Nj8PDPc
--> ssh-ed25519 WBT1Hw +b+2TOduL4XERN7qOYPtJ3R5w54m7VYqmyy8Smz6tXU
+-> ssh-ed25519 VyYH/Q QHjWhus6HvedZXiDtkoK9DiS8EPOpUxRHix1cSwVuiU
-TyQ+bjSK6IYSulW0rm12V+lpXYCt5kr3byaNNGJeMVc
+vn0vSFHo6doBH/rzk42DxKN8XzSzMVDMMaeqQX6iuII
--> ssh-ed25519 6AT2/g ZUmtQOHWmn0shq1iP3Ca7aQ74PLcqZGTprvsM/HAXR8
+-> ssh-ed25519 hPp1nw FH8TXl9deDyGS9pCyG3sBvzpi8d9S0u4tprKopO6vBo
-eNonzRSAwNCQi0DgtVs67zCjpOYsqeLEJYBmLjuS9rI
+ZaricPkMTEn+xNPOJP4nLIpsHdFDVCCEqFVq4FxOPCw
--> ssh-ed25519 hPp1nw qzrGZr5bFvfPwWrfNIUFubvGXBT+oQo9HZQuePSbPwk
+-> ssh-ed25519 dMQYog FYeNrUyYZ/aYZkmjTEVJ3Fq4J5qAe+Do7IDPiYDZrgw
-MKNlVl3OXBYEFWiu2hbbXDQnqkV4nENG+lcLcd+H33I
+RroBGlF7DyNKmL4+Nd84eKKkJh7AGE9FP1VxgUO3iF4
--> ssh-ed25519 w3nu8g H2UDASHwHNxU74g5IbuHIDHEZYgyWNmSX7Wv/lV41HQ
+-> htnK=h-grease F7l m it+; <4OvM
-WMgKT0GZxWQoK57E9B2j8MsyOroMhWd5SiCQtZa7AIY
+2MOngVDIi1sJJnjX2eAt4L3jObghFIbv20wJHLb7G0AMyavVmOiQ4xSehDKCb34g
--> ssh-ed25519 dMQYog YkL6XApXeP9qc4pVaIHFaNmYIK/PVEKoJz5SotQbGmQ
+10vwok0cSXaKOGmbXOFst9J2tk+z
-H+3wAxIl9Yip4xQqjhje9tL1V4m00NNSxNjH6Dbb1K8
+--- nOQEybjt9MPX5X2cUnpKFgHtTSPvJSFnDGyj3ATlrEQ
---- vBQpXXpKzzXwpNP17r8OBqO4Q3bIS4pHqbEl4u9dB1w
+ÞO¸†’¿"of<6F>æÕ¹|ñÜŠšÇ'_j]þ–ëI<u‡‡:*¼†¾hœµÆ?"M‰)Ñ̦Ví*KAôN3µ@rWí¤©¨‹
-ÎL“9[íg¡dŒxgº8Ø*0‘«šœ’…·¾öWå&`*?`ÔÊ­IQÛ÷Ýd1*ª–ñ¶bM\‹<>D™+«)‡
+tX€«Ñí…o
-\ƒg¤hDá3#k3;Åj¾ÞŽ±Ý¾Hš·ÙF&ÙX	%6˜Bî8”¹T·fG`Q¯®âñ?[hDªö*c

secrets/binary-cache-private-key.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw eORh0m8mAPd3H/wjnHocuh/xheMuhLgWyzepL9RNii0
+154IPIdkb8WpYgX/fj5jraQY5mN7udg3iaZ3VJB+3X8
+-> ssh-ed25519 dMQYog 0eg1j3jL736OwjeMB55z52A6P34mSEYL6ulrn72blj0
+UdFKIbrzAKCzZhYfH41z64cwkQRp1RZztYgknIEfoDc
+-> K/&@p'&{-grease yb~ xHlc7m _t xm{3f
+Gi2UGm5YXyByJuH6rRRBle/D5T7GS4FDt7Kv8aBKe8dfwUCu65OcvoaXzjm08EKA
+m0yx
+--- f79zGG5kBOul/cF0NJu1+f/NmaI0h/JcuHDano/1ghU
+U¥÷7°åó
ʤï1måÔE\{^£$ŸÕCx~2"±8¶Æõ?&öó°„ÂË‹(áä±
+…aÝÀyßÝ쥘g¬â†øÇ	CYX}’Ö

secrets/cris-hashed-email-pw.age

@@ -1,10 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 6AT2/g WZ9p/pCsEDpKbgGDLcTtisn25kExQX9iv+tL3wyPwiY
+-> ssh-ed25519 6AT2/g MmInWcw6GlfzvN9kxFtTVWMX+UX9PHO5V35TzRcmex0
-vom2z9QRIQSFB0+4/7lSWUEB0eoAG+08nXgiUg/OSX4
+dSMoGNuJMpRwyWTAnjHpO9mJBCxsJ77M5fWA0F1gR6s
--> ssh-ed25519 w3nu8g ECLZwCRJVJqyUMf70EOl2/3ExTruKaxCSQlY5fBZqxk
+-> ssh-ed25519 dMQYog ua3OPiErZcVRNGf/uxv7PiBBFOKAUkaSSIV4UCMu5Wc
-VemnmGpzx1VprkybW1hPlkfmiDaNcBDoEzX0mDZgmu0
+L8kYIzyEXcAxAlPQbqasgiaQi7JARhja6vM6WzvdMrs
--> ssh-ed25519 dMQYog QiPsbFE8MtXnRNBwkUEC+6grqXEbDstEtxYR8uJks2w
+-> CIn-grease !G{f,9h( Hjn\ \hTpE MAP<)J
-O3JWQGppFeZEd6o3W0KVTEIyNVGeLxKfTYTlgsAEVHQ
+0u+eQDvbxgI6aDT7xqdwOX3A34E2T4Ft9bSF6KBpHqucHib9tA5lJHgtXwgkpa/P
---- RncZzBFEyMAkpZRWrPORA0DPHuCTNswmWG5CMNnfm4A
+nbaJDnRWbM/AL7nnT7XpdLVO2r7w2ish4ALBgPvXxH/0iUXqvQk1B/E
-	ñ/¼ÔËõôŒ8nàÅ¥«¸7hîtä?T˜=‘%zˆ°[¤ÝØ!(…uÔdÇuò@
+--- +aKXbSfk6VkxqtTn+fI8VhcgO7Dw0jNSUJOJlqCbEGM
-×¢EbƒyŽ¦ù¦D=Ü!‹„XþtÞÔ:#¦þþãÞXÈX@ú_M‘
+á? Þ÷Ùþq}` ¿Žiämó<>.6Û{I

secrets/hostapd-pw-CXNK00BF9176.age

@@ -1,7 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 w3nu8g ER07FH17Wm9op5F4pCftNK76f+nNjtA6zQc/2dLyAHI
+-> ssh-ed25519 VyYH/Q evYn+9ipH4t4cT2lZOiwnGqSkU+bbdVw80S0rgAqt00
-nxxq/8tS3ENJhAEIhJCiSi7dV+68AmcEMh9zvZoWpdY
+Vr24AqHOqH5DQYYlyS0X+k6TnczKHRDGZCeoLOJkybE
--> ssh-ed25519 dMQYog JelCfh+akP7C/i1kimq3fC5PRQa9gHbmBaOnjKu+PDw
+-> ssh-ed25519 dMQYog 23GqNi0N24EtnRV25Ick+aurPOngZ2Zd279LmZH15WY
-GVTwo7MzkpCereZRh0HVjGYmtdMY1gHowMZtUQl7XQw
+FEo0GyymjnPrSjf608SyCH22FvaqEixyVcbXdQ+Z3zA
---- p2l83t3bEdBrrp1ctaqqKhwB4l2McgZqZTtc2SXgd8Q
+-> (Rd{ky@}-grease D f/KA]Pe
-ø±ôeÆd\Yå4lXVF§U©<55>þM||)دÔûú•¶Ü8¿>ëž­%ðóJ$à´Õè
+8Ip1fddb0BYUwg62FSmUBp7O+TILFaCtWHcxheEyUlXPoY9TGTaySl6Znw9Mksde
+q2aAHn8
+--- ibLXcq9R/5X2jFKBABgsUcDiBjjuoA9SrCuFbGOiNBI
+¸Ó;ù½XôóÀ	m£hŽ²ý%펗
+6â×k@nWÃäT®‘0

secrets/iodine.age

@@ -1,9 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 6AT2/g Knb25oYknkiXyMqVBR3T0sFSO4hDjWUTq3xIml/b4ig
+-> ssh-ed25519 6AT2/g UG+Ub0bZK74/Ifa/YkZOc6B3cPl6oI7M4Ev1zxkFEh0
-n7xamnrZ+SCWiKqniF3r2JvH4G8q2pJaHzF0riNEDf4
+z71vjnEqhL3kuLePbP0nKQNwU0mrCOO386wLdUhH5tU
--> ssh-ed25519 w3nu8g 7+2R5RpLjBf4jjj3S8ibMquUWgRMrifziGQubwuLrhA
+-> ssh-ed25519 dMQYog t8H6XoIhhE4H9g4913sWgZ5BaYK04uk7Mj0FYnOdtTo
-3jLCalnbA3Z2jr8Zs+qrpzSoi3Jv6E5OV2binpr3Kk4
+U4Ygto4z3l4dcCsnGxnRo1YGBl6YZ5y5pnVBJXCSrOc
--> ssh-ed25519 dMQYog Nh2e7me0tiG7ZwQK8669VS0LCYFSH+b33I9tr8uI5CY
+-> Bad-grease <$Y
-7Gs1N9eZa1CGR9pczzugHbqnghqevX7kQCOeqR4q0eI
+1xw
---- OzW+omJsZA/b4DMF4hdQga7JVgiEYluZok3r8JM258I
+--- wiGO0H6gfd+3D/+V/rMNLGkDk6FPFUihXi43J82LAkg
-*³²ÝPŽ†AcèÈ1·@Át¸e÷nf&ù#I7‡a‰Ûâc†ÃÀ<C383>êbDâ–~aõ]1w=Á
+³8>`®À
s«»pú¨€¿U#ü™º¯KV%jbwïxN¸@
+Žî@œª€iæ
+Ow\º(@@Tòìèzá

secrets/pia-login.age

@@ -1,11 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 6AT2/g MGKlbzVOk5+czgAOerwl+eIyOifXJm/q4UgQUXVpx1c
+-> ssh-ed25519 6AT2/g gPeZnJ8arK6xAGnEK9uTcGfwBI1pYjjv6VX4o9EBIns
-43l6s4+5TSMQyO9tAg7v9Y5OdXOjKYz56lbr9Jm2r+o
+sKFfqnafLachTKE93Pb7gsZ5gdKis64N64BK5128LKg
--> ssh-ed25519 hPp1nw aOxni4sFPPgedUkBOuOyEWfFPJrhdTJnivIaWt5RJxM
+-> ssh-ed25519 hPp1nw e2taazZ3R6EBCbgh6Gg0Dc9p1K7zp5R7n9LIkWF/Wj8
-KNaxijzSMp7EjYKwWiAP66nPYYZK3/VXL8u+3uJt6bg
++/VkcMDL1HNJhbc6/OxpiUe1dlO0lrc1hgkD/RrYXjY
--> ssh-ed25519 w3nu8g qTAzEzQbFze35AtbvkYREw3wa7ApDN5u7RSZUXrEpms
+-> ssh-ed25519 dMQYog znMKkv1O7F/EeAyvTfULUn/pWdai2NI0uBfWn/02xg0
-Dy0uGF458A9RJMvDl2XKOkEABbbRgT+eIgvb6ZOEQqg
+45W9s4Vo8J+xOTGec9h6s0ra9ZSUA6JkorAAyqqlPfg
--> ssh-ed25519 dMQYog 5DfYuGeWuN0/CO6WWbFIi7LaKl23FXYVdPROM+TFpCA
+-> T/!XI-grease GJ_O'
-PDBdDn+YUMKYNKFkCEfXesmkB/XUxZRK3ddQt0kqQ7g
+mAOW54Txa2H9WdEMog0g1XQjkC5z0wQIoqNlnbsjCSvM1UaPiiu6vJOJKCmJb1Z6
---- JOeG87EVD+QBx6n+rMoPTOni0PyoG7xx4a2USNiapYI
+3wyLN6lCIjkR
-Zsý{ÅiÁ_
QÂ\+ô@@Üò߸ù&_š5­$¿Gt2¢rF“y×ÄQ§Iaž7ôÙÉzàgf­%O(µÙ,VéÂ}ÿn|û'J¸2ø¨óQÑB
+--- yX7lzKnDkn+KkRVTumffcd/SJSznR5n6JtUgWkSSohk
+ãQô^àèyW; â§]Š+u>¥3wŒz±¨oêM:ã™øêúÀöŸÃ9,xv×KÁÜXT-K8rÔAç(@Ø-|³
+:PÈ<50>‡*H
6€'¹&Ôi

secrets/rekey.sh

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+set -e
+
+agenix -r
+git commit . -m "Rekey secrets"

secrets/secrets.nix

@@ -20,7 +20,10 @@ with roles;
   "robots-email-pw.age".publicKeys = gitea;
 
   # nix binary cache
-  "atticd-credentials.age".publicKeys = binary-cache;
+  # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
+  "binary-cache-private-key.age".publicKeys = binary-cache;
+  # public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB
+  "binary-cache-push-sshkey.age".publicKeys = nobody; # this value is directly given to gitea
 
   # vpn
   "iodine.age".publicKeys = iodine;
@@ -33,6 +36,7 @@ with roles;
 
   # services
   "searx.age".publicKeys = nobody;
+  "spotifyd.age".publicKeys = personal;
   "wolframalpha.age".publicKeys = dailybot;
 
   # hostapd
@@ -45,7 +49,4 @@ with roles;
 
   # gitea actions runner
   "gitea-actions-runner-token.age".publicKeys = gitea-actions-runner;
-
-  # Librechat
-  "librechat-env-file.age".publicKeys = librechat;
 }

secrets/wolframalpha.age

@@ -1,10 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 6AT2/g Kw5/he5m/XAJUNv8XEJQU+e+Ou7hCYluMXXWlHiePXY
+-> ssh-ed25519 6AT2/g 3xkROcKh6I/oVGRwnvJ9Dy36JvYmsJQZq2DBvYC4Dz4
-GkhJOzSlcC9S7bs8FuDNMvMaFU3+fQ5z+o+Pb8wllp8
+JunaGg8zg2SJZmBnuV0ZcDSc8vsMHgTd1RbDn8giy+Y
--> ssh-ed25519 w3nu8g fUORtXN1ygOeV42jveCosGXR/Y6R6OG6DK7LPDBEAk8
+-> ssh-ed25519 dMQYog JG8QC1thl+CMlxoI1Y+ZUj0dQ3FXF4cquk7tdzfaS0E
-yFpoasbY/sl6BQp0LVBQnInA4Kxd8A8meEObU1KD108
+zW7jyrXhVvyIq7HXfcRqkyZdg/wkWwNfPk5KbI2jH7I
--> ssh-ed25519 dMQYog 75qVEe6/1yOV4DDLAOGaufs3ojx1/Sc1fIQOe+Oirz0
+-> $"v%-grease `Xo|a eIFIq 7hBk?8%1
-iDFsr6/30AHKH6hUs/WTpHEM8WQ03QMlGbtQkGrnVCU
+ZoNiAXY1HE1GEQPd1aJirTitFgXf3HKcV2H6HxRpzWysUd1DGOsF/jScUO36JgIP
---- islx8t7a6bShXGxvYeDVuUxkmAMtpUfr0Gp7aYrJUkI
+sY8FA22PjyUv7g
-2Ûí4¤†7Õ
+--- zFpfG3JQpSmE108GMEWLjGWMJe7cXVn3NN9vs8iDY3E
-?Õw€À<E282AC>JÁÆØv	¨º9’,ËxÅŠò¨‰¦Æ¦ñnäH?>I­
+8f,ÕªÒÅðÚÏ*}V¥Æ@j†3ÿïCèM*@}ìy2Øì9€Éè ìN|y›æ

update.sh

@@ -0,0 +1,6 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i bash -p bash
+
+git pull
+nix flake update # intentionally ignore the lockfile
+sudo nixos-rebuild switch --flake .