speed up

.gitea/workflows/check-flake.yaml

@@ -15,5 +15,14 @@ jobs:
         with:
           fetch-depth: 0
 
+      - run: attic -V
+
+      - name: Setup Attic Cache
+        uses: https://git.neet.dev/zuckerberg/attic-action@v0.2.5
+        with:
+          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
+          cache: ${{ secrets.ATTIC_CACHE }}
+          token: ${{ secrets.ATTIC_TOKEN }}
+
       - name: Check Flake
         run: nix flake check --all-systems --print-build-logs --log-format raw --show-trace

Makefile

@@ -20,3 +20,8 @@ rekey-secrets:
 .PHONY: clean-old-nixos-profiles
 clean-old-nixos-profiles:
 	doas nix-collect-garbage -d
+
+# Garbage Collect
+.PHONY: gc
+gc:
+	nix store gc

common/binary-cache.nix

@@ -6,11 +6,11 @@
       substituters = [
         "https://cache.nixos.org/"
         "https://nix-community.cachix.org"
-        "http://s0.koi-bebop.ts.net:5000"
+        "http://s0.koi-bebop.ts.net:28338/nixos"
       ];
       trusted-public-keys = [
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU="
+        "nixos:IDhKojUaMz+UIiri1/DQk9EpqDokih8dwxmp41uJnls="
       ];
     };
   };

common/default.nix

@@ -63,6 +63,7 @@
     lf
     gnumake
     tree
+    attic
   ];
 
   nixpkgs.config.allowUnfree = true;

common/pc/default.nix

@@ -9,7 +9,7 @@ in
     #    ./xfce.nix
     ./yubikey.nix
     ./chromium.nix
-    #    ./firefox.nix
+    ./firefox.nix
     ./audio.nix
     #    ./torbrowser.nix
     ./pithos.nix

common/pc/firefox.nix

@@ -20,31 +20,6 @@ let
   };
 
   firefox = pkgs.wrapFirefox somewhatPrivateFF {
-    desktopName = "Sneed Browser";
-
-    nixExtensions = [
-      (pkgs.fetchFirefoxAddon {
-        name = "ublock-origin";
-        url = "https://addons.mozilla.org/firefox/downloads/file/3719054/ublock_origin-1.33.2-an+fx.xpi";
-        sha256 = "XDpe9vW1R1iVBTI4AmNgAg1nk7BVQdIAMuqd0cnK5FE=";
-      })
-      (pkgs.fetchFirefoxAddon {
-        name = "sponsorblock";
-        url = "https://addons.mozilla.org/firefox/downloads/file/3720594/sponsorblock_skip_sponsorships_on_youtube-2.0.12.3-an+fx.xpi";
-        sha256 = "HRtnmZWyXN3MKo4AvSYgNJGkBEsa2RaMamFbkz+YzQg=";
-      })
-      (pkgs.fetchFirefoxAddon {
-        name = "KeePassXC-Browser";
-        url = "https://addons.mozilla.org/firefox/downloads/file/3720664/keepassxc_browser-1.7.6-fx.xpi";
-        sha256 = "3K404/eq3amHhIT0WhzQtC892he5I0kp2SvbzE9dbZg=";
-      })
-      (pkgs.fetchFirefoxAddon {
-        name = "https-everywhere";
-        url = "https://addons.mozilla.org/firefox/downloads/file/3716461/https_everywhere-2021.1.27-an+fx.xpi";
-        sha256 = "2gSXSLunKCwPjAq4Wsj0lOeV551r3G+fcm1oeqjMKh8=";
-      })
-    ];
-
     extraPolicies = {
       CaptivePortal = false;
       DisableFirefoxStudies = true;
@@ -74,12 +49,6 @@ let
         ExtensionRecommendations = false;
         SkipOnboarding = true;
       };
-      WebsiteFilter = {
-        Block = [
-          "http://paradigminteractive.io/"
-          "https://paradigminteractive.io/"
-        ];
-      };
     };
 
     extraPrefs = ''

common/pc/kde.nix

@@ -10,7 +10,6 @@ in
     services.desktopManager.plasma6.enable = true;
 
     # kde apps
-    nixpkgs.config.firefox.enablePlasmaBrowserIntegration = true;
     users.users.googlebot.packages = with pkgs; [
       # akonadi
       # kmail

common/server/atticd.nix

@@ -0,0 +1,40 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.services.atticd;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.atticd = {
+      credentialsFile = "/run/agenix/atticd-credentials";
+
+      settings = {
+        listen = "[::]:28338";
+
+        # Speed things up
+        require-proof-of-possession = false;
+
+        chunking = {
+          # Disable chunking for performance (I have plenty of space)
+          nar-size-threshold = 0;
+
+          # Chunking is disabled due to poor performance so these values don't matter but are required anyway.
+          # One day, when I move away from ZFS maybe this will perform well enough.
+          # nar-size-threshold = 64 * 1024; # 64 KiB
+          min-size = 16 * 1024; # 16 KiB
+          avg-size = 64 * 1024; # 64 KiB
+          max-size = 256 * 1024; # 256 KiB
+        };
+
+        # Disable compression for performance (I have plenty of space)
+        compression.type = "none";
+
+        garbage-collection = {
+          default-retention-period = "6 months";
+        };
+      };
+    };
+
+    age.secrets.atticd-credentials.file = ../../secrets/atticd-credentials.age;
+  };
+}

common/server/default.nix

@@ -22,5 +22,6 @@
     ./dashy.nix
     ./librechat.nix
     ./actualbudget.nix
+    ./atticd.nix
   ];
 }

common/server/gitea-actions-runner.nix

@@ -116,6 +116,7 @@ in
       git
       # Gitea Actions rely heavily on node. Include it because it would be installed anyway.
       nodejs
+      attic
     ];
 
     # To allow building on the host, must override the the service's config so it doesn't use a dynamic user

common/shell.nix

@@ -34,6 +34,8 @@
     io_seq_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=write --size=2g --io_size=10g --blocksize=1024k --ioengine=libaio --fsync=10000 --iodepth=32 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
     io_rand_read = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randread --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=32 --runtime=60 --group_reporting; rm temp.file";
     io_rand_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randrw --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
+
+    llsblk = "lsblk -o +uuid,fsType";
   };
 
   nixpkgs.overlays = [

flake.lock

@@ -7,7 +7,9 @@
         "nixpkgs": [
           "nixpkgs"
         ],
-        "systems": "systems"
+        "systems": [
+          "systems"
+        ]
       },
       "locked": {
         "lastModified": 1716561646,
@@ -23,6 +25,36 @@
         "type": "github"
       }
     },
+    "attic": {
+      "inputs": {
+        "crane": "crane",
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "nixpkgs-stable": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1717279440,
+        "narHash": "sha256-kH04ReTjxOpQumgWnqy40vvQLSnLGxWP6RF3nq5Esrk=",
+        "owner": "zhaofengli",
+        "repo": "attic",
+        "rev": "717cc95983cdc357bc347d70be20ced21f935843",
+        "type": "github"
+      },
+      "original": {
+        "owner": "zhaofengli",
+        "repo": "attic",
+        "type": "github"
+      }
+    },
     "blobs": {
       "flake": false,
       "locked": {
@@ -39,6 +71,27 @@
         "type": "gitlab"
       }
     },
+    "crane": {
+      "inputs": {
+        "nixpkgs": [
+          "attic",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1717025063,
+        "narHash": "sha256-dIubLa56W9sNNz0e8jGxrX3CAkPXsq7snuFA/Ie6dn8=",
+        "owner": "ipetkov",
+        "repo": "crane",
+        "rev": "480dff0be03dac0e51a8dfc26e882b0d123a450e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ipetkov",
+        "repo": "crane",
+        "type": "github"
+      }
+    },
     "dailybuild_modules": {
       "inputs": {
         "flake-utils": [
@@ -55,11 +108,11 @@
         "rev": "1290ddd9a2ff2bf2d0f702750768312b80efcd34",
         "revCount": 19,
         "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
       },
       "original": {
         "type": "git",
-        "url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
+        "url": "https://git.neet.dev/zuckerberg/dailybot.git"
       }
     },
     "darwin": {
@@ -86,21 +139,22 @@
     },
     "deploy-rs": {
       "inputs": {
-        "flake-compat": "flake-compat",
+        "flake-compat": [
+          "flake-compat"
+        ],
         "nixpkgs": [
           "nixpkgs"
         ],
         "utils": [
-          "simple-nixos-mailserver",
+          "flake-utils"
-          "utils"
         ]
       },
       "locked": {
-        "lastModified": 1715699772,
+        "lastModified": 1718194053,
-        "narHash": "sha256-sKhqIgucN5sI/7UQgBwsonzR4fONjfMr9OcHK/vPits=",
+        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "b3ea6f333f9057b77efd9091119ba67089399ced",
+        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
         "type": "github"
       },
       "original": {
@@ -125,25 +179,11 @@
         "type": "github"
       }
     },
-    "flake-compat_2": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "inputs": {
-        "systems": "systems_2"
+        "systems": [
+          "systems"
+        ]
       },
       "locked": {
         "lastModified": 1710146030,
@@ -292,8 +332,10 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "attic": "attic",
         "dailybuild_modules": "dailybuild_modules",
         "deploy-rs": "deploy-rs",
+        "flake-compat": "flake-compat",
         "flake-utils": "flake-utils",
         "nix-index-database": "nix-index-database",
         "nixos-hardware": "nixos-hardware",
@@ -301,24 +343,32 @@
         "nixpkgs-frigate": "nixpkgs-frigate",
         "radio": "radio",
         "radio-web": "radio-web",
-        "simple-nixos-mailserver": "simple-nixos-mailserver"
+        "simple-nixos-mailserver": "simple-nixos-mailserver",
+        "systems": "systems"
       }
     },
     "simple-nixos-mailserver": {
       "inputs": {
         "blobs": "blobs",
-        "flake-compat": "flake-compat_2",
+        "flake-compat": [
+          "flake-compat"
+        ],
         "nixpkgs": [
           "nixpkgs"
         ],
-        "utils": "utils"
+        "nixpkgs-24_05": [
+          "nixpkgs"
+        ],
+        "utils": [
+          "flake-utils"
+        ]
       },
       "locked": {
-        "lastModified": 1714720456,
+        "lastModified": 1718084203,
-        "narHash": "sha256-e0WFe1BHqX23ADpGBc4ZRu38Mg+GICCZCqyS6EWCbHc=",
+        "narHash": "sha256-Cx1xoVfSMv1XDLgKg08CUd1EoTYWB45VmB9XIQzhmzI=",
         "owner": "simple-nixos-mailserver",
         "repo": "nixos-mailserver",
-        "rev": "41059fc548088e49e3ddb3a2b4faeb5de018e60f",
+        "rev": "29916981e7b3b5782dc5085ad18490113f8ff63b",
         "type": "gitlab"
       },
       "original": {
@@ -342,36 +392,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "utils": {
-      "locked": {
-        "lastModified": 1605370193,
-        "narHash": "sha256-YyMTf3URDL/otKdKgtoMChu4vfVL3vCMkRqpGifhUn0=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "5021eac20303a61fafe17224c087f5519baed54d",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -1,40 +1,91 @@
 {
   inputs = {
+    # nixpkgs
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
     nixpkgs-frigate.url = "github:NixOS/nixpkgs/5cfafa12d57374f48bcc36fda3274ada276cf69e";
 
-    flake-utils.url = "github:numtide/flake-utils";
+    # Common Utils Among flake inputs
+    systems.url = "github:nix-systems/default";
+    flake-utils = {
+      url = "github:numtide/flake-utils";
+      inputs.systems.follows = "systems";
+    };
+    flake-compat = {
+      url = "github:edolstra/flake-compat";
+      flake = false;
+    };
 
+    # NixOS hardware
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
-    # mail server
+    # Mail Server
-    simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
+    simple-nixos-mailserver = {
-    simple-nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";
+      url = "gitlab:simple-nixos-mailserver/nixos-mailserver/master";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        nixpkgs-24_05.follows = "nixpkgs";
+        flake-compat.follows = "flake-compat";
+        utils.follows = "flake-utils";
+      };
+    };
 
-    # agenix
+    # Agenix
-    agenix.url = "github:ryantm/agenix";
+    agenix = {
-    agenix.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:ryantm/agenix";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        systems.follows = "systems";
+      };
+    };
 
-    # radio
+    # Radio
-    radio.url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
+    radio = {
-    radio.inputs.nixpkgs.follows = "nixpkgs";
+      url = "git+https://git.neet.dev/zuckerberg/radio.git?ref=main&rev=5bf607fed977d41a269942a7d1e92f3e6d4f2473";
-    radio.inputs.flake-utils.follows = "flake-utils";
+      inputs = {
-    radio-web.url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
+        nixpkgs.follows = "nixpkgs";
-    radio-web.flake = false;
+        flake-utils.follows = "flake-utils";
+      };
+    };
+    radio-web = {
+      url = "git+https://git.neet.dev/zuckerberg/radio-web.git";
+      flake = false;
+    };
 
-    # drastikbot
+    # Dailybot
-    dailybuild_modules.url = "git+https://git.neet.dev/zuckerberg/dailybuild_modules.git";
+    dailybuild_modules = {
-    dailybuild_modules.inputs.nixpkgs.follows = "nixpkgs";
+      url = "git+https://git.neet.dev/zuckerberg/dailybot.git";
-    dailybuild_modules.inputs.flake-utils.follows = "flake-utils";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-utils.follows = "flake-utils";
+      };
+    };
 
-    # nixos config deployment
+    # NixOS deployment
-    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy-rs = {
-    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:serokell/deploy-rs";
-    deploy-rs.inputs.utils.follows = "simple-nixos-mailserver/utils";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        flake-compat.follows = "flake-compat";
+        utils.follows = "flake-utils";
+      };
+    };
 
-    # prebuilt nix-index database
+    # Prebuilt nix-index database
-    nix-index-database.url = "github:Mic92/nix-index-database";
+    nix-index-database = {
-    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:Mic92/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    # Attic
+    attic = {
+      url = "github:zhaofengli/attic";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        nixpkgs-stable.follows = "nixpkgs";
+        flake-utils.follows = "flake-utils";
+        flake-compat.follows = "flake-compat";
+      };
+    };
   };
 
   outputs = { self, nixpkgs, ... }@inputs:
@@ -54,6 +105,7 @@
             agenix.nixosModules.default
             dailybuild_modules.nixosModule
             nix-index-database.nixosModules.nix-index
+            attic.nixosModules.atticd
             self.nixosModules.kernel-modules
             ({ lib, ... }: {
               config = {

machines/ray/default.nix

@@ -1,22 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-  ];
-
-  nixpkgs.config.cudaSupport = true;
-
-  # don't use remote builders
-  nix.distributedBuilds = lib.mkForce false;
-
-  # services.howdy.enable = true;
-
-  hardware.openrazer.enable = true;
-  hardware.openrazer.users = [ "googlebot" ];
-  hardware.openrazer.devicesOffOnScreensaver = false;
-  users.users.googlebot.packages = [ pkgs.polychromatic ];
-
-  de.enable = true;
-  de.touchpad.enable = true;
-}

machines/ray/hardware-configuration.nix

@@ -1,62 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [
-      (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  # boot
-  efi.enable = true;
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-
-  # kernel
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  # firmware
-  firmware.x86_64.enable = true;
-  hardware.enableAllFirmware = true;
-
-  # gpu
-  services.xserver.videoDrivers = [ "nvidia" ];
-  hardware.nvidia = {
-    modesetting.enable = true; # for nvidia-vaapi-driver
-    prime = {
-      reverseSync.enable = true;
-      offload.enableOffloadCmd = true;
-      nvidiaBusId = "PCI:1:0:0";
-      amdgpuBusId = "PCI:4:0:0";
-    };
-  };
-
-  # disks
-  remoteLuksUnlock.enable = true;
-  boot.initrd.luks.devices."enc-pv" = {
-    device = "/dev/disk/by-uuid/c1822e5f-4137-44e1-885f-954e926583ce";
-    allowDiscards = true;
-  };
-  fileSystems."/" =
-    {
-      device = "/dev/vg/root";
-      fsType = "btrfs";
-      options = [ "subvol=root" ];
-    };
-  fileSystems."/home" =
-    {
-      device = "/dev/vg/root";
-      fsType = "btrfs";
-      options = [ "subvol=home" ];
-    };
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/2C85-2B59";
-      fsType = "vfat";
-    };
-  swapDevices =
-    [{ device = "/dev/vg/swap"; }];
-}

machines/ray/properties.nix

@@ -1,22 +0,0 @@
-{
-  hostNames = [
-    "ray"
-  ];
-
-  arch = "x86_64-linux";
-
-  systemRoles = [
-    "personal"
-    "deploy"
-  ];
-
-  hostKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQM8hwKRgl8cZj7UVYATSLYu4LhG7I0WFJ9m2iWowiB";
-
-  userKeys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeTK1iARlNIKP/DS8/ObBm9yUM/3L1Ub4XI5A2r9OzP"
-  ];
-
-  deployKeys = [
-    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEaGIwLiUa6wQLlEF+keQOIYy/tCmJvV6eENzUQjSqW2AAAABHNzaDo="
-  ];
-}

machines/storage/s0/default.nix

@@ -10,23 +10,6 @@
 
   # system.autoUpgrade.enable = true;
 
-  nix.gc.automatic = lib.mkForce false; # allow the nix store to serve as a build cache
-
-  # binary cache
-  services.nix-serve = {
-    enable = true;
-    openFirewall = true;
-    secretKeyFile = "/run/agenix/binary-cache-private-key";
-  };
-  age.secrets.binary-cache-private-key.file = ../../../secrets/binary-cache-private-key.age;
-  users.users.cache-push = {
-    isNormalUser = true;
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB" ];
-  };
-  nix.settings = {
-    trusted-users = [ "cache-push" ];
-  };
-
   services.iperf3.enable = true;
   services.iperf3.openFirewall = true;
 
@@ -235,4 +218,6 @@
   };
 
   boot.binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
+
+  services.atticd.enable = true;
 }

machines/zoidberg/default.nix

@@ -42,25 +42,25 @@
   ];
 
   # System wide barrier instance
-  systemd.services.barrier-sddm = {
+  # systemd.services.barrier-sddm = {
-    description = "Barrier mouse/keyboard share";
+  #   description = "Barrier mouse/keyboard share";
-    requires = [ "display-manager.service" ];
+  #   requires = [ "display-manager.service" ];
-    after = [ "network.target" "display-manager.service" ];
+  #   after = [ "network.target" "display-manager.service" ];
-    wantedBy = [ "multi-user.target" ];
+  #   wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
+  #   serviceConfig = {
-      Restart = "always";
+  #     Restart = "always";
-      RestartSec = 10;
+  #     RestartSec = 10;
-      # todo use user/group
+  #     # todo use user/group
-    };
+  #   };
-    path = with pkgs; [ barrier doas ];
+  #   path = with pkgs; [ barrier doas ];
-    script = ''
+  #   script = ''
-      # Wait for file to show up. "display-manager.service" finishes a bit too soon
+  #     # Wait for file to show up. "display-manager.service" finishes a bit too soon
-      while ! [ -e /run/sddm/* ]; do sleep 1; done;
+  #     while ! [ -e /run/sddm/* ]; do sleep 1; done;
-      export XAUTHORITY=$(ls /run/sddm/*)
+  #     export XAUTHORITY=$(ls /run/sddm/*)
-      # Disable crypto is fine because tailscale is E2E encrypting better than barrier could anyway
+  #     # Disable crypto is fine because tailscale is E2E encrypting better than barrier could anyway
-      barrierc -f --disable-crypto --name zoidberg ray.koi-bebop.ts.net
+  #     barrierc -f --disable-crypto --name zoidberg ray.koi-bebop.ts.net
-    '';
+  #   '';
-  };
+  # };
 
   # Login into X11 plasma so barrier works well
   services.displayManager.defaultSession = "plasma";

machines/zoidberg/hardware-configuration.nix

@@ -7,7 +7,7 @@
     ];
 
   # boot
-  efi.enable = true;
+  boot.loader.systemd-boot.enable = true;
   boot.loader.timeout = lib.mkForce 15;
   boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
@@ -35,7 +35,7 @@
     };
   fileSystems."/boot" =
     {
-      device = "/dev/disk/by-uuid/8074-B04D";
+      device = "/dev/disk/by-uuid/954B-AB3E";
       fsType = "vfat";
     };
   swapDevices =

secrets/atticd-credentials.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 hPp1nw tMy5kLAcQD62yAfEVJ4LQZjs0kkEEQOfM4HN9yj3hBY
+JvlklGTxxfAZbP+alm3nxLxqhmcu2mTKwRU5WaapL9w
+-> ssh-ed25519 w3nu8g ZGzufldXq7kmIpqFecbkpDxiykWZ207k0+09I2dmxEM
+SK25e5HBe4b5reGXXfCjIFbFGzfu32RFjY++/yteRVc
+--- xZOe1syYAcVRDhiNRv+CsfFgoQbiANA6vNCon+5NExc
+-·ñ1Å,C-.M§Áè?ÐêóµµàY|u+
+‹	³Ø<C2B3>÷ŽæÒ¡ôm†Œûäfß]=érøÜüÎAg¤€æSú:Ð8•S¦LiœùªsêÁâ9JŠð<>¸ÏæñÄÐÃ<ûAz¹[ý§xï<78>:‡'U*<2A>wÀ™D/…±VpM~!õ,* ¿”µ¡øk¥Ö´ßEíîïh› {¢p$¾R`ÿ”

secrets/secrets.nix

@@ -20,10 +20,7 @@ with roles;
   "robots-email-pw.age".publicKeys = gitea;
 
   # nix binary cache
-  # public key: s0.koi-bebop.ts.net:OjbzD86YjyJZpCp9RWaQKANaflcpKhtzBMNP8I2aPUU=
+  "atticd-credentials.age".publicKeys = binary-cache;
-  "binary-cache-private-key.age".publicKeys = binary-cache;
-  # public key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINpUZFFL9BpBVqeeU63sFPhR9ewuhEZerTCDIGW1NPSB
-  "binary-cache-push-sshkey.age".publicKeys = nobody; # this value is directly given to gitea
 
   # vpn
   "iodine.age".publicKeys = iodine;