Update to NixOS 24.05

.gitea/workflows/check-flake.yaml

@@ -15,14 +15,5 @@ jobs:
         with:
           fetch-depth: 0
 
-      - run: attic -V
-
-      - name: Setup Attic Cache
-        uses: https://git.neet.dev/zuckerberg/attic-action@v0.2.5
-        with:
-          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-          cache: ${{ secrets.ATTIC_CACHE }}
-          token: ${{ secrets.ATTIC_TOKEN }}
-
       - name: Check Flake
-        run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace
+        run: nix flake check --print-build-logs --log-format raw --show-trace

Makefile

@@ -20,8 +20,3 @@ rekey-secrets:
 .PHONY: clean-old-nixos-profiles
 clean-old-nixos-profiles:
 	doas nix-collect-garbage -d
-
-# Garbage Collect
-.PHONY: gc
-gc:
-	nix store gc

common/binary-cache.nix

@@ -6,11 +6,11 @@
       substituters = [
         "https://cache.nixos.org/"
         "https://nix-community.cachix.org"
-        "http://s0.koi-bebop.ts.net:28338/nixos"
+        "http://s0.koi-bebop.ts.net:5000"
       ];
       trusted-public-keys = [
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "nixos:IDhKojUaMz+UIiri1/DQk9EpqDokih8dwxmp41uJnls="
+        "s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU="
       ];
     };
   };

common/default.nix

@@ -63,7 +63,6 @@
     lf
     gnumake
     tree
-    attic
   ];
 
   nixpkgs.config.allowUnfree = true;

common/pc/default.nix

@@ -6,20 +6,19 @@ in
 {
   imports = [
     ./kde.nix
-    #    ./xfce.nix
+    # ./xfce.nix
     ./yubikey.nix
     ./chromium.nix
-    ./firefox.nix
+    #    ./firefox.nix
     ./audio.nix
     #    ./torbrowser.nix
     ./pithos.nix
+    ./spotify.nix
     ./vscodium.nix
     ./discord.nix
     ./steam.nix
     ./touchpad.nix
     ./mount-samba.nix
-    ./udev.nix
-    ./virtualisation.nix
   ];
 
   options.de = {
@@ -45,7 +44,8 @@ in
       gparted
       libreoffice-fresh
       thunderbird
-      spotify
+      spotifyd
+      spotify-qt
       arduino
       yt-dlp
       jellyfin-media-player
@@ -76,18 +76,5 @@ in
     # Security
     services.gnome.gnome-keyring.enable = true;
     security.pam.services.googlebot.enableGnomeKeyring = true;
-
-    # Android dev
-    programs.adb.enable = true;
-
-    # Mount personal SMB stores
-    services.mount-samba.enable = true;
-
-    # allow building ARM derivations
-    boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-    # for luks onlock over tor
-    services.tor.enable = true;
-    services.tor.client.enable = true;
   };
 }

common/pc/firefox.nix

@@ -20,6 +20,31 @@ let
   };
 
   firefox = pkgs.wrapFirefox somewhatPrivateFF {
+    desktopName = "Sneed Browser";
+
+    nixExtensions = [
+      (pkgs.fetchFirefoxAddon {
+        name = "ublock-origin";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3719054/ublock_origin-1.33.2-an+fx.xpi";
+        sha256 = "XDpe9vW1R1iVBTI4AmNgAg1nk7BVQdIAMuqd0cnK5FE=";
+      })
+      (pkgs.fetchFirefoxAddon {
+        name = "sponsorblock";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3720594/sponsorblock_skip_sponsorships_on_youtube-2.0.12.3-an+fx.xpi";
+        sha256 = "HRtnmZWyXN3MKo4AvSYgNJGkBEsa2RaMamFbkz+YzQg=";
+      })
+      (pkgs.fetchFirefoxAddon {
+        name = "KeePassXC-Browser";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3720664/keepassxc_browser-1.7.6-fx.xpi";
+        sha256 = "3K404/eq3amHhIT0WhzQtC892he5I0kp2SvbzE9dbZg=";
+      })
+      (pkgs.fetchFirefoxAddon {
+        name = "https-everywhere";
+        url = "https://addons.mozilla.org/firefox/downloads/file/3716461/https_everywhere-2021.1.27-an+fx.xpi";
+        sha256 = "2gSXSLunKCwPjAq4Wsj0lOeV551r3G+fcm1oeqjMKh8=";
+      })
+    ];
+
     extraPolicies = {
       CaptivePortal = false;
       DisableFirefoxStudies = true;
@@ -49,6 +74,12 @@ let
         ExtensionRecommendations = false;
         SkipOnboarding = true;
       };
+      WebsiteFilter = {
+        Block = [
+          "http://paradigminteractive.io/"
+          "https://paradigminteractive.io/"
+        ];
+      };
     };
 
     extraPrefs = ''

common/pc/kde.nix

@@ -10,6 +10,7 @@ in
     services.desktopManager.plasma6.enable = true;
 
     # kde apps
+    nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true;
     users.users.googlebot.packages = with pkgs; [
       # akonadi
       # kmail

common/pc/spotify.nix

@@ -0,0 +1,85 @@
+{ lib, config, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.spotifyd;
+  toml = pkgs.formats.toml { };
+  spotifydConf = toml.generate "spotify.conf" cfg.settings;
+in
+{
+  disabledModules = [
+    "services/audio/spotifyd.nix"
+  ];
+
+  options = {
+    services.spotifyd = {
+      enable = mkEnableOption "spotifyd, a Spotify playing daemon";
+
+      settings = mkOption {
+        default = { };
+        type = toml.type;
+        example = { global.bitrate = 320; };
+        description = ''
+          Configuration for Spotifyd. For syntax and directives, see
+          <link xlink:href="https://github.com/Spotifyd/spotifyd#Configuration"/>.
+        '';
+      };
+
+      users = mkOption {
+        type = with types; listOf str;
+        default = [ ];
+        description = ''
+          Usernames to be added to the "spotifyd" group, so that they
+          can start and interact with the userspace daemon.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    # username specific stuff because i'm lazy...
+    services.spotifyd.users = [ "googlebot" ];
+    users.users.googlebot.packages = with pkgs; [
+      spotify
+    ];
+
+    users.groups.spotifyd = {
+      members = cfg.users;
+    };
+
+    age.secrets.spotifyd = {
+      file = ../../secrets/spotifyd.age;
+      group = "spotifyd";
+      mode = "0440"; # group can read
+    };
+
+    # spotifyd to read secrets and run as user service
+    services.spotifyd = {
+      settings.global = {
+        username_cmd = "sed '1q;d' /run/agenix/spotifyd";
+        password_cmd = "sed '2q;d' /run/agenix/spotifyd";
+        bitrate = 320;
+        backend = "pulseaudio";
+        device_name = config.networking.hostName;
+        device_type = "computer";
+        # on_song_change_hook = "command_to_run_on_playback_events"
+        autoplay = true;
+      };
+    };
+
+    systemd.user.services.spotifyd-daemon = {
+      enable = true;
+      wantedBy = [ "graphical-session.target" ];
+      partOf = [ "graphical-session.target" ];
+      description = "spotifyd, a Spotify playing daemon";
+      environment.SHELL = "/bin/sh";
+      serviceConfig = {
+        ExecStart = "${pkgs.spotifyd}/bin/spotifyd --no-daemon --config-path ${spotifydConf}";
+        Restart = "always";
+        CacheDirectory = "spotifyd";
+      };
+    };
+  };
+}

common/pc/udev.nix

@@ -1,25 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.de;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.udev.extraRules = ''
-      # depthai
-      SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
-
-      # Moonlander
-      # Rules for Oryx web flashing and live training
-      KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
-      KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
-      # Wally Flashing rules for the Moonlander and Planck EZ
-      SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
-    '';
-    services.udev.packages = [ pkgs.platformio ];
-
-    users.groups.plugdev = {
-      members = [ "googlebot" ];
-    };
-  };
-}

common/pc/use-meson-v57.patch

@@ -0,0 +1,22 @@
+diff --git a/meson.build b/meson.build
+index dace367..8c0e290 100644
+--- a/meson.build
++++ b/meson.build
+@@ -8,7 +8,7 @@ project(
+         'warning_level=0',
+     ],
+     license: 'MIT',
+-    meson_version: '>= 0.58.0',
++    meson_version: '>= 0.57.0',
+ )
+ 
+ cc = meson.get_compiler('c')
+@@ -47,8 +47,3 @@ shared_library(
+     gnu_symbol_visibility: 'hidden',
+ )
+ 
+-meson.add_devenv(environment({
+-    'NVD_LOG': '1',
+-    'LIBVA_DRIVER_NAME': 'nvidia',
+-    'LIBVA_DRIVERS_PATH': meson.project_build_root(),
+-}))

common/pc/virtualisation.nix

@@ -1,23 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  cfg = config.de;
-in
-{
-  config = lib.mkIf cfg.enable {
-    # AppVMs
-    virtualisation.appvm.enable = true;
-    virtualisation.appvm.user = "googlebot";
-
-    # Use podman instead of docker
-    virtualisation.podman.enable = true;
-    virtualisation.podman.dockerCompat = true;
-
-    # virt-manager
-    virtualisation.libvirtd.enable = true;
-    programs.dconf.enable = true;
-    virtualisation.spiceUSBRedirection.enable = true;
-    environment.systemPackages = with pkgs; [ virt-manager ];
-    users.users.googlebot.extraGroups = [ "libvirtd" "adbusers" ];
-  };
-}

common/server/atticd.nix

@@ -1,40 +0,0 @@
-{ config, lib, ... }:
-
-let
-  cfg = config.services.atticd;
-in
-{
-  config = lib.mkIf cfg.enable {
-    services.atticd = {
-      credentialsFile = "/run/agenix/atticd-credentials";
-
-      settings = {
-        listen = "[::]:28338";
-
-        # Speed things up
-        require-proof-of-possession = false;
-
-        chunking = {
-          # Disable chunking for performance (I have plenty of space)
-          nar-size-threshold = 0;
-
-          # Chunking is disabled due to poor performance so these values don't matter but are required anyway.
-          # One day, when I move away from ZFS maybe this will perform well enough.
-          # nar-size-threshold = 64 * 1024; # 64 KiB
-          min-size = 16 * 1024; # 16 KiB
-          avg-size = 64 * 1024; # 64 KiB
-          max-size = 256 * 1024; # 256 KiB
-        };
-
-        # Disable compression for performance (I have plenty of space)
-        compression.type = "none";
-
-        garbage-collection = {
-          default-retention-period = "6 months";
-        };
-      };
-    };
-
-    age.secrets.atticd-credentials.file = ../../secrets/atticd-credentials.age;
-  };
-}

common/server/default.nix

@@ -22,6 +22,5 @@
     ./dashy.nix
     ./librechat.nix
     ./actualbudget.nix
-    ./atticd.nix
   ];
 }

common/server/gitea-actions-runner.nix

@@ -116,7 +116,6 @@ in
       git
       # Gitea Actions rely heavily on node. Include it because it would be installed anyway.
       nodejs
-      attic
     ];
 
     # To allow building on the host, must override the the service's config so it doesn't use a dynamic user

common/server/mailserver.nix

@@ -63,7 +63,7 @@ in
           "cris@runyan.org"
         ];
       };
-      certificateScheme = "acme-nginx"; # use let's encrypt for certs
+      certificateScheme = 3; # use let's encrypt for certs
     };
     age.secrets.hashed-email-pw.file = ../../secrets/hashed-email-pw.age;
     age.secrets.cris-hashed-email-pw.file = ../../secrets/cris-hashed-email-pw.age;

common/server/nextcloud.nix

@@ -8,7 +8,7 @@ in
   config = lib.mkIf cfg.enable {
     services.nextcloud = {
       https = true;
-      package = pkgs.nextcloud29;
+      package = pkgs.nextcloud28;
       hostName = "neet.cloud";
       config.dbtype = "sqlite";
       config.adminuser = "jeremy";

common/shell.nix

@@ -34,8 +34,6 @@
     io_seq_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=write --size=2g --io_size=10g --blocksize=1024k --ioengine=libaio --fsync=10000 --iodepth=32 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
     io_rand_read = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randread --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=32 --runtime=60 --group_reporting; rm temp.file";
     io_rand_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randrw --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
-
-    llsblk = "lsblk -o +uuid,fsType";
   };
 
   nixpkgs.overlays = [

flake.lock

@@ -7,9 +7,7 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": [
+        "systems": "systems"
-          "systems"
-        ]
       },
       "locked": {
         "lastModified": 1716561646,
@@ -25,36 +23,6 @@
         "type": "github"
       }
     },
-    "attic": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": [
-          "flake-compat"
-        ],
-        "flake-utils": [
-          "flake-utils"
-        ],
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1717279440,
-        "narHash": "sha256-kH04ReTjxOpQumgWnqy40vvQLSnLGxWP6RF3nq5Esrk=",
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "rev": "717cc95983cdc357bc347d70be20ced21f935843",
-        "type": "github"
-      },
-      "original": {
-        "owner": "zhaofengli",
-        "repo": "attic",
-        "type": "github"
-      }
-    },
     "blobs": {
       "flake": false,
       "locked": {
@@ -71,27 +39,6 @@
         "type": "gitlab"
       }
     },
-    "crane": {
-      "inputs": {
-        "nixpkgs": [
-          "attic",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1717025063,
-        "narHash": "sha256-dIubLa56W9sNNz0e8jGxrX3CAkPXsq7snuFA/Ie6dn8=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "480dff0be03dac0e51a8dfc26e882b0d123a450e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
     "dailybuild_modules": {
       "inputs": {
         "flake-utils": [
@@ -108,11 +55,11 @@
         "rev": "1290ddd9a2ff2bf2d0f702750768312b80efcd34",
         "revCount": 19,
         "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
       }
     },
     "darwin": {
@@ -139,22 +86,21 @@
     },
     "deploy-rs": {
       "inputs": {
-        "flake-compat": [
+        "flake-compat": "flake-compat",
-          "flake-compat"
-        ],
         "nixpkgs": [
           "nixpkgs"
         ],
         "utils": [
-          "flake-utils"
+          "simple-nixos-mailserver",
+          "utils"
         ]
       },
       "locked": {
-        "lastModified": 1718194053,
+        "lastModified": 1715699772,
-        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
+        "narHash": "sha256-sKhqIgucN5sI/7UQgBwsonzR4fONjfMr9OcHK/vPits=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
+        "rev": "b3ea6f333f9057b77efd9091119ba67089399ced",
         "type": "github"
       },
       "original": {
@@ -181,9 +127,7 @@
     },
     "flake-utils": {
       "inputs": {
-        "systems": [
+        "systems": "systems_2"
-          "systems"
-        ]
       },
       "locked": {
         "lastModified": 1710146030,
@@ -272,6 +216,21 @@
         "type": "github"
       }
     },
+    "nixpkgs-22_05": {
+      "locked": {
+        "lastModified": 1654936503,
+        "narHash": "sha256-soKzdhI4jTHv/rSbh89RdlcJmrPgH8oMb/PLqiqIYVQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "dab6df51387c3878cdea09f43589a15729cae9f4",
+        "type": "github"
+      },
+      "original": {
+        "id": "nixpkgs",
+        "ref": "nixos-22.05",
+        "type": "indirect"
+      }
+    },
     "nixpkgs-frigate": {
       "locked": {
         "lastModified": 1695825837,
@@ -332,10 +291,8 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "attic": "attic",
         "dailybuild_modules": "dailybuild_modules",
         "deploy-rs": "deploy-rs",
-        "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
@@ -343,37 +300,29 @@
         "nixpkgs-frigate": "nixpkgs-frigate",
         "radio": "radio",
         "radio-web": "radio-web",
-        "simple-nixos-mailserver": "simple-nixos-mailserver",
+        "simple-nixos-mailserver": "simple-nixos-mailserver"
-        "systems": "systems"
       }
     },
     "simple-nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
-        "flake-compat": [
-          "flake-compat"
-        ],
         "nixpkgs": [
           "nixpkgs"
         ],
-        "nixpkgs-24_05": [
+        "nixpkgs-22_05": "nixpkgs-22_05",
-          "nixpkgs"
+        "utils": "utils"
-        ],
-        "utils": [
-          "flake-utils"
-        ]
       },
       "locked": {
-        "lastModified": 1718084203,
+        "lastModified": 1655930346,
-        "narHash": "sha256-Cx1xoVfSMv1XDLgKg08CUd1EoTYWB45VmB9XIQzhmzI=",
+        "narHash": "sha256-ht56HHOzEhjeIgAv5ZNFjSVX/in1YlUs0HG9c1EUXTM=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "29916981e7b3b5782dc5085ad18490113f8ff63b",
+        "rev": "f535d8123c4761b2ed8138f3d202ea710a334a1d",
         "type": "gitlab"
       },
       "original": {
         "owner": "simple-nixos-mailserver",
-        "ref": "master",
+        "ref": "nixos-22.05",
         "repo": "nixos-mailserver",
         "type": "gitlab"
       }
@@ -392,6 +341,36 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_2": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "utils": {
+      "locked": {
+        "lastModified": 1605370193,
+        "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "5021eac20303a61fafe17224c087f5519baed54d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -1,91 +1,40 @@
 {
   inputs = {
-    # nixpkgs
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
     nixpkgs-frigate.url = "github:NixOS/nixpkgs/5cfafa12d57374f48bcc36fda3274ada276cf69e";
 
-    # Common Utils Among flake inputs
+    flake-utils.url = "github:numtide/flake-utils";
-    systems.url = "github:nix-systems/default";
-    flake-utils = {
-      url = "github:numtide/flake-utils";
-      inputs.systems.follows = "systems";
-    };
-    flake-compat = {
-      url = "github:edolstra/flake-compat";
-      flake = false;
-    };
 
-    # NixOS hardware
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
-    # Mail Server
+    # mail server
-    simple-nixos-mailserver = {
+    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-22.05";
-      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
+    simple-nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        nixpkgs-24_05.follows = "nixpkgs";
-        flake-compat.follows = "flake-compat";
-        utils.follows = "flake-utils";
-      };
-    };
 
-    # Agenix
+    # agenix
-    agenix = {
+    agenix.url = "github:ryantm/agenix";
-      url = "github:ryantm/agenix";
+    agenix.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        systems.follows = "systems";
-      };
-    };
 
-    # Radio
+    # radio
-    radio = {
+    radio.url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
-      url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
+    radio.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    radio.inputs.flake-utils.follows = "flake-utils";
-        nixpkgs.follows = "nixpkgs";
+    radio-web.url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
-        flake-utils.follows = "flake-utils";
+    radio-web.flake = false;
-      };
-    };
-    radio-web = {
-      url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
-      flake = false;
-    };
 
-    # Dailybot
+    # drastikbot
-    dailybuild_modules = {
+    dailybuild_modules.url = "git+https://git.neet.dev/zuckerberg/dailybuild_modules.git";
-      url = "git+https://git.neet.dev/zuckerberg/dailybot.git";
+    dailybuild_modules.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    dailybuild_modules.inputs.flake-utils.follows = "flake-utils";
-        nixpkgs.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-      };
-    };
 
-    # NixOS deployment
+    # nixos config deployment
-    deploy-rs = {
+    deploy-rs.url = "github:serokell/deploy-rs";
-      url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
-      inputs = {
+    deploy-rs.inputs.utils.follows = "simple-nixos-mailserver/utils";
-        nixpkgs.follows = "nixpkgs";
-        flake-compat.follows = "flake-compat";
-        utils.follows = "flake-utils";
-      };
-    };
 
-    # Prebuilt nix-index database
+    # prebuilt nix-index database
-    nix-index-database = {
+    nix-index-database.url = "github:Mic92/nix-index-database";
-      url = "github:Mic92/nix-index-database";
+    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
-    # Attic
-    attic = {
-      url = "github:zhaofengli/attic";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        nixpkgs-stable.follows = "nixpkgs";
-        flake-utils.follows = "flake-utils";
-        flake-compat.follows = "flake-compat";
-      };
-    };
   };
 
   outputs = { self, nixpkgs, ... }@inputs:
@@ -105,7 +54,6 @@
             agenix.nixosModules.default
             dailybuild_modules.nixosModule
             nix-index-database.nixosModules.nix-index
-            attic.nixosModules.atticd
             self.nixosModules.kernel-modules
             ({ lib, ... }: {
               config = {

machines/howl/default.nix

@@ -1,13 +1,68 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, nixos-hardware, ... }:
 
 {
   imports = [
     ./hardware-configuration.nix
+    nixos-hardware.nixosModules.framework-13-7040-amd
   ];
 
+
+  # for luks onlock over tor
+  services.tor.enable = true;
+  services.tor.client.enable = true;
+
   # don't use remote builders
   nix.distributedBuilds = lib.mkForce false;
 
+  services.udev.extraRules = ''
+    # depthai
+    SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
+
+    # Moonlander
+    # Rules for Oryx web flashing and live training
+    KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
+    KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
+    # Wally Flashing rules for the Moonlander and Planck EZ
+    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
+  '';
+  services.udev.packages = [ pkgs.platformio ];
+  users.groups.plugdev = {
+    members = [ "googlebot" ];
+  };
+
+  # virt-manager
+  virtualisation.libvirtd.enable = true;
+  programs.dconf.enable = true;
+  virtualisation.spiceUSBRedirection.enable = true;
+  environment.systemPackages = with pkgs; [ virt-manager ];
+  users.users.googlebot.extraGroups = [ "libvirtd" "adbusers" ];
+
+  # allow building ARM derivations
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+  services.spotifyd.enable = true;
+
+  virtualisation.podman.enable = true;
+  virtualisation.podman.dockerCompat = true;
+
+  virtualisation.appvm.enable = true;
+  virtualisation.appvm.user = "googlebot";
+
+  services.mount-samba.enable = true;
+
   de.enable = true;
   de.touchpad.enable = true;
+
+  networking.firewall.allowedTCPPorts = [
+    # barrier
+    24800
+  ];
+
+  programs.adb.enable = true;
+
+  services.fwupd.enable = true;
+
+  # fingerprint reader has initially shown to be more of a nuisance than a help
+  # it makes sddm log in fail most of the time and take several minutes to finish
+  services.fprintd.enable = false;
 }

machines/howl/hardware-configuration.nix

@@ -1,19 +1,12 @@
-{ config, lib, pkgs, modulesPath, nixos-hardware, ... }:
+{ config, lib, pkgs, modulesPath, ... }:
 
 {
-  imports = [
+  imports =
-    (modulesPath + "/installer/scan/not-detected.nix")
+    [ (modulesPath + "/installer/scan/not-detected.nix")
-    nixos-hardware.nixosModules.framework-13-7040-amd
+    ];
-  ];
 
   boot.kernelPackages = pkgs.linuxPackages_latest;
 
-  hardware.framework.amd-7040.preventWakeOnAC = true;
-  services.fwupd.enable = true;
-  # fingerprint reader has initially shown to be more of a nuisance than a help
-  # it makes sddm log in fail most of the time and take several minutes to finish
-  services.fprintd.enable = false;
-
   # boot
   boot.loader.systemd-boot.enable = true;
   boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
@@ -34,18 +27,17 @@
     allowDiscards = true;
   };
   fileSystems."/" =
-    {
+    { device = "/dev/disk/by-uuid/95db6950-a7bc-46cf-9765-3ea675ccf014";
-      device = "/dev/disk/by-uuid/95db6950-a7bc-46cf-9765-3ea675ccf014";
       fsType = "btrfs";
     };
   fileSystems."/boot" =
-    {
+    { device = "/dev/disk/by-uuid/B087-2C20";
-      device = "/dev/disk/by-uuid/B087-2C20";
       fsType = "vfat";
       options = [ "fmask=0022" "dmask=0022" ];
     };
   swapDevices =
-    [{ device = "/dev/disk/by-uuid/49fbdf62-eef4-421b-aac3-c93494afd23c"; }];
+    [ { device = "/dev/disk/by-uuid/49fbdf62-eef4-421b-aac3-c93494afd23c"; }
+    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's

machines/phil/properties.nix

@@ -9,6 +9,7 @@
   systemRoles = [
     "server"
     "nix-builder"
+    "gitea-actions-runner"
   ];
 
   hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBlgRPpuUkZqe8/lHugRPm/m2vcN9psYhh5tENHZt9I2";

machines/ray/default.nix

@@ -0,0 +1,69 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+  ];
+
+  nixpkgs.config.cudaSupport = true;
+
+  # for luks onlock over tor
+  services.tor.enable = true;
+  services.tor.client.enable = true;
+
+  # don't use remote builders
+  nix.distributedBuilds = lib.mkForce false;
+
+  # services.howdy.enable = true;
+
+  hardware.openrazer.enable = true;
+  hardware.openrazer.users = [ "googlebot" ];
+  hardware.openrazer.devicesOffOnScreensaver = false;
+  users.users.googlebot.packages = [ pkgs.polychromatic ];
+
+  services.udev.extraRules = ''
+    # depthai
+    SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
+
+    # Moonlander
+    # Rules for Oryx web flashing and live training
+    KERNEL=="hidraw*", ATTRS{idVendor}=="16c0", MODE="0664", GROUP="plugdev"
+    KERNEL=="hidraw*", ATTRS{idVendor}=="3297", MODE="0664", GROUP="plugdev"
+    # Wally Flashing rules for the Moonlander and Planck EZ
+    SUBSYSTEMS=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE:="0666", SYMLINK+="stm32_dfu"
+  '';
+  services.udev.packages = [ pkgs.platformio ];
+  users.groups.plugdev = {
+    members = [ "googlebot" ];
+  };
+
+  # virt-manager
+  virtualisation.libvirtd.enable = true;
+  programs.dconf.enable = true;
+  virtualisation.spiceUSBRedirection.enable = true;
+  environment.systemPackages = with pkgs; [ virt-manager ];
+  users.users.googlebot.extraGroups = [ "libvirtd" "adbusers" ];
+
+  # allow building ARM derivations
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+
+  services.spotifyd.enable = true;
+
+  virtualisation.podman.enable = true;
+  virtualisation.podman.dockerCompat = true;
+
+  virtualisation.appvm.enable = true;
+  virtualisation.appvm.user = "googlebot";
+
+  services.mount-samba.enable = true;
+
+  de.enable = true;
+  de.touchpad.enable = true;
+
+  networking.firewall.allowedTCPPorts = [
+    # barrier
+    24800
+  ];
+
+  programs.adb.enable = true;
+}

machines/ray/hardware-configuration.nix

@@ -0,0 +1,62 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  # boot
+  efi.enable = true;
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+
+  # kernel
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  # firmware
+  firmware.x86_64.enable = true;
+  hardware.enableAllFirmware = true;
+
+  # gpu
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.nvidia = {
+    modesetting.enable = true; # for nvidia-vaapi-driver
+    prime = {
+      reverseSync.enable = true;
+      offload.enableOffloadCmd = true;
+      nvidiaBusId = "PCI:1:0:0";
+      amdgpuBusId = "PCI:4:0:0";
+    };
+  };
+
+  # disks
+  remoteLuksUnlock.enable = true;
+  boot.initrd.luks.devices."enc-pv" = {
+    device = "/dev/disk/by-uuid/c1822e5f-4137-44e1-885f-954e926583ce";
+    allowDiscards = true;
+  };
+  fileSystems."/" =
+    {
+      device = "/dev/vg/root";
+      fsType = "btrfs";
+      options = [ "subvol=root" ];
+    };
+  fileSystems."/home" =
+    {
+      device = "/dev/vg/root";
+      fsType = "btrfs";
+      options = [ "subvol=home" ];
+    };
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/2C85-2B59";
+      fsType = "vfat";
+    };
+  swapDevices =
+    [{ device = "/dev/vg/swap"; }];
+}

machines/ray/properties.nix

@@ -0,0 +1,22 @@
+{
+  hostNames = [
+    "ray"
+  ];
+
+  arch = "x86_64-linux";
+
+  systemRoles = [
+    "personal"
+    "deploy"
+  ];
+
+  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQM8hwKRgl8cZj7UVYATSLYu4LhG7I0WFJ9m2iWowiB";
+
+  userKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeTK1iARlNIKP/DS8/ObBm9yUM/3L1Ub4XI5A2r9OzP"
+  ];
+
+  deployKeys = [
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEaGIwLiUa6wQLlEF+keQOIYy/tCmJvV6eENzUQjSqW2AAAABHNzaDo="
+  ];
+}

machines/storage/s0/default.nix

@@ -10,6 +10,23 @@
 
   # system.autoUpgrade.enable = true;
 
+  nix.gc.automatic = lib.mkForce false; # allow the nix store to serve as a build cache
+
+  # binary cache
+  services.nix-serve = {
+    enable = true;
+    openFirewall = true;
+    secretKeyFile = "/run/agenix/binary-cache-private-key";
+  };
+  age.secrets.binary-cache-private-key.file = ../../../secrets/binary-cache-private-key.age;
+  users.users.cache-push = {
+    isNormalUser = true;
+    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB" ];
+  };
+  nix.settings = {
+    trusted-users = [ "cache-push" ];
+  };
+
   services.iperf3.enable = true;
   services.iperf3.openFirewall = true;
 
@@ -218,6 +235,4 @@
   };
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
-
-  services.atticd.enable = true;
 }

machines/storage/s0/home-automation.nix

@@ -146,8 +146,7 @@ in
     };
   };
 
-  # TODO need services.oauth2-proxy.cookie.domain ?
+  services.oauth2_proxy =
-  services.oauth2-proxy =
     let
       nextcloudServer = "https://neet.cloud/";
     in
@@ -156,10 +155,9 @@ in
 
       httpAddress = "http://0.0.0.0:4180";
 
-      nginx.domain = frigateHostname;
+      nginx.virtualHosts = [
-      # nginx.virtualHosts = [
+        frigateHostname
-      #   frigateHostname
+      ];
-      # ];
 
       email.domains = [ "*" ];
 

machines/zoidberg/default.nix

@@ -42,28 +42,28 @@
   ];
 
   # System wide barrier instance
-  # systemd.services.barrier-sddm = {
+  systemd.services.barrier-sddm = {
-  #   description = "Barrier mouse/keyboard share";
+    description = "Barrier mouse/keyboard share";
-  #   requires = [ "display-manager.service" ];
+    requires = [ "display-manager.service" ];
-  #   after = [ "network.target" "display-manager.service" ];
+    after = [ "network.target" "display-manager.service" ];
-  #   wantedBy = [ "multi-user.target" ];
+    wantedBy = [ "multi-user.target" ];
-  #   serviceConfig = {
+    serviceConfig = {
-  #     Restart = "always";
+      Restart = "always";
-  #     RestartSec = 10;
+      RestartSec = 10;
-  #     # todo use user/group
+      # todo use user/group
-  #   };
+    };
-  #   path = with pkgs; [ barrier doas ];
+    path = with pkgs; [ barrier doas ];
-  #   script = ''
+    script = ''
-  #     # Wait for file to show up. "display-manager.service" finishes a bit too soon
+      # Wait for file to show up. "display-manager.service" finishes a bit too soon
-  #     while ! [ -e /run/sddm/* ]; do sleep 1; done;
+      while ! [ -e /run/sddm/* ]; do sleep 1; done;
-  #     export XAUTHORITY=$(ls /run/sddm/*)
+      export XAUTHORITY=$(ls /run/sddm/*)
-  #     # Disable crypto is fine because tailscale is E2E encrypting better than barrier could anyway
+      # Disable crypto is fine because tailscale is E2E encrypting better than barrier could anyway
-  #     barrierc -f --disable-crypto --name zoidberg ray.koi-bebop.ts.net
+      barrierc -f --disable-crypto --name zoidberg ray.koi-bebop.ts.net
-  #   '';
+    '';
-  # };
+  };
 
   # Login into X11 plasma so barrier works well
-  services.displayManager.defaultSession = "plasma";
+  services.xserver.displayManager.defaultSession = "plasma";
 
   users.users.cris = {
     isNormalUser = true;
@@ -83,7 +83,7 @@
   };
 
   # Auto login into Plasma in john zoidberg account
-  services.displayManager.sddm.settings = {
+  services.xserver.displayManager.sddm.settings = {
     Autologin = {
       Session = "plasma";
       User = "john";

machines/zoidberg/hardware-configuration.nix

@@ -7,7 +7,7 @@
     ];
 
   # boot
-  boot.loader.systemd-boot.enable = true;
+  efi.enable = true;
   boot.loader.timeout = lib.mkForce 15;
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
@@ -35,7 +35,7 @@
     };
   fileSystems."/boot" =
     {
-      device = "/dev/disk/by-uuid/954B-AB3E";
+      device = "/dev/disk/by-uuid/8074-B04D";
       fsType = "vfat";
     };
   swapDevices =

overlays/kernel-modules/gasket.nix

@@ -2,16 +2,16 @@
 
 stdenv.mkDerivation rec {
   pname = "gasket";
-  version = "1.0-18-unstable-2023-09-05";
+  version = "1.0-18";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "gasket-driver";
-    rev = "5815ee3908a46a415aac616ac7b9aedcb98a504c";
+    rev = "09385d485812088e04a98a6e1227bf92663e0b59";
-    sha256 = "sha256-O17+msok1fY5tdX1DvqYVw6plkUDF25i8sqwd6mxYf8=";
+    sha256 = "fcnqCBh04e+w8g079JyuyY2RPu34M+/X+Q8ObE+42i4=";
   };
 
-  makeFlags = kernel.makeFlags ++ [
+  makeFlags = [
     "-C"
     "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
     "M=$(PWD)"
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   installFlags = [ "INSTALL_MOD_PATH=${placeholder "out"}" ];
   installTargets = [ "modules_install" ];
 
-  sourceRoot = "${src.name}/src";
+  sourceRoot = "source/src";
   hardeningDisable = [ "pic" "format" ];
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
@@ -31,6 +31,5 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2;
     maintainers = [ lib.maintainers.kylehendricks ];
     platforms = platforms.linux;
-    broken = versionOlder kernel.version "5.15";
   };
 }

secrets/atticd-credentials.age

@@ -1,8 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 hPp1nw tMy5kLAcQD62yAfEVJ4LQZjs0kkEEQOfM4HN9yj3hBY
-JvlklGTxxfAZbP+alm3nxLxqhmcu2mTKwRU5WaapL9w
--> ssh-ed25519 w3nu8g ZGzufldXq7kmIpqFecbkpDxiykWZ207k0+09I2dmxEM
-SK25e5HBe4b5reGXXfCjIFbFGzfu32RFjY++/yteRVc
---- xZOe1syYAcVRDhiNRv+CsfFgoQbiANA6vNCon+5NExc
--·ñ1Å,C-.M§Áè?ÐêóµµàY|u+
-‹	³Ø<C2B3>÷ŽæÒ¡ôm†Œûäfß]=érøÜüÎAg¤€æSú:Ð8•S¦LiœùªsêÁâ9JŠð<>¸ÏæñÄÐÃ<ûAz¹[ý§xï<78>:‡'U*<2A>wÀ™D/…±VpM~!õ,* ¿”µ¡øk¥Ö´ßEíîïh› {¢p$¾R`ÿ”

secrets/secrets.nix

@@ -20,7 +20,10 @@ with roles;
   "robots-email-pw.age".publicKeys = gitea;
 
   # nix binary cache
-  "atticd-credentials.age".publicKeys = binary-cache;
+  # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
+  "binary-cache-private-key.age".publicKeys = binary-cache;
+  # public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB
+  "binary-cache-push-sshkey.age".publicKeys = nobody; # this value is directly given to gitea
 
   # vpn
   "iodine.age".publicKeys = iodine;
@@ -33,6 +36,7 @@ with roles;
 
   # services
   "searx.age".publicKeys = nobody;
+  "spotifyd.age".publicKeys = personal;
   "wolframalpha.age".publicKeys = dailybot;
 
   # hostapd