Enable gitea email notifications

README.md

@@ -3,7 +3,7 @@
 ### Source Layout
 - `/common` - common configuration imported into all `/machines`
     - `/boot` - config related to bootloaders, cpu microcode, and unlocking LUKS root disks over tor
-    - `/network` - config for tailscale, zeroteir, and NixOS container with automatic vpn tunneling via PIA
+    - `/network` - config for tailscale, and NixOS container with automatic vpn tunneling via PIA
     - `/pc` - config that a graphical desktop computer should have. Use `de.enable = true;` to enable everthing.
     - `/server` - config that creates new nixos services or extends existing ones to meet my needs
     - `/ssh.nix` - all ssh public host and user keys for all `/machines`

TODO.md

@@ -10,24 +10,13 @@
 - https://nixos.wiki/wiki/Comparison_of_NixOS_setups
 
 ### Housekeeping
-- Format everything here using nixfmt
 - Cleanup the line between hardware-configuration.nix and configuration.nix in machine config
 - CI https://gvolpe.com/blog/nixos-binary-cache-ci/
 - remove `options.currentSystem`
 - allow `hostname` option for webservices to be null to disable configuring nginx
 
 ### NAS
-- helios64 extra led lights
 - safely turn off NAS on power disconnect
-- hardware de/encoding for rk3399 helios64 https://forum.pine64.org/showthread.php?tid=14018
-- tor unlock
-
-### bcachefs
-- bcachefs health alerts via email
-- bcachefs periodic snapshotting
-- use mount.bcachefs command for mounting
-- bcachefs native encryption
-    - just need a kernel module? https://github.com/firestack/bcachefs-tools-flake/blob/kf/dev/mvp/nixos/module/bcachefs.nix#L40
 
 ### Shell Comands
 - tailexitnode = `sudo tailscale up --exit-node=<exit-node-ip> --exit-node-allow-lan-access=true`
@@ -52,21 +41,7 @@
         - https://ampache.org/
 - replace nextcloud with seafile
 
-### VPN container
-- use wireguard for vpn
-    - https://github.com/triffid/pia-wg/blob/master/pia-wg.sh
-    - https://github.com/pia-foss/manual-connections
-    - port forwarding for vpn
-        - transmission using forwarded port
-    - https://www.wireguard.com/netns/
-    - one way firewall for vpn container
-
-### Networking
-- tailscale for p2p connections
-    - remove all use of zerotier
-
 ### Archive
-- https://www.backblaze.com/b2/cloud-storage.html
 - email
     - https://github.com/Disassembler0/dovecot-archive/blob/main/src/dovecot_archive.py
     - http://kb.unixservertech.com/software/dovecot/archiveserver

common/auto-update.nix

@@ -4,7 +4,8 @@
 
 let
   cfg = config.system.autoUpgrade;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     system.autoUpgrade = {
       flake = "git+https://git.neet.dev/zuckerberg/nix-config.git";

common/backups.nix

@@ -0,0 +1,78 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.backup;
+  hostname = config.networking.hostName;
+
+  mkRespository = group: "s3:s3.us-west-004.backblazeb2.com/D22TgIt0-main-backup/${group}";
+
+  mkBackup = group: paths: {
+    repository = mkRespository group;
+    inherit paths;
+
+    initialize = true;
+
+    timerConfig = {
+      OnCalendar = "daily";
+      RandomizedDelaySec = "1h";
+    };
+
+    extraBackupArgs = [
+      ''--exclude-if-present ".nobackup"''
+    ];
+
+    pruneOpts = [
+      "--keep-daily 7" # one backup for each of the last n days
+      "--keep-weekly 5" # one backup for each of the last n weeks
+      "--keep-monthly 12" # one backup for each of the last n months
+      "--keep-yearly 75" # one backup for each of the last n years
+    ];
+
+    environmentFile = "/run/agenix/backblaze-s3-backups";
+    passwordFile = "/run/agenix/restic-password";
+  };
+
+  # example usage: "sudo restic_samba unlock" (removes lockfile)
+  mkResticGroupCmd = group: pkgs.writeShellScriptBin "restic_${group}" ''
+    if [ "$EUID" -ne 0 ]
+      then echo "Run as root"
+      exit
+    fi
+    . /run/agenix/backblaze-s3-backups
+    export AWS_SECRET_ACCESS_KEY
+    export AWS_ACCESS_KEY_ID
+    export RESTIC_PASSWORD_FILE=/run/agenix/restic-password
+    export RESTIC_REPOSITORY="${mkRespository group}"
+    exec ${pkgs.restic}/bin/restic "$@"
+  '';
+in
+{
+  options.backup = {
+    group = lib.mkOption {
+      default = null;
+      type = lib.types.nullOr (lib.types.attrsOf (lib.types.submodule {
+        options = {
+          paths = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            description = ''
+              Paths to backup
+            '';
+          };
+        };
+      }));
+    };
+  };
+
+  config = lib.mkIf (cfg.group != null) {
+    services.restic.backups = lib.concatMapAttrs
+      (group: groupCfg: {
+        ${group} = mkBackup group groupCfg.paths;
+      })
+      cfg.group;
+
+    age.secrets.backblaze-s3-backups.file = ../secrets/backblaze-s3-backups.age;
+    age.secrets.restic-password.file = ../secrets/restic-password.age;
+
+    environment.systemPackages = map mkResticGroupCmd (builtins.attrNames cfg.group);
+  };
+}

common/boot/bios.nix

@@ -3,7 +3,8 @@
 with lib;
 let
   cfg = config.bios;
-in {
+in
+{
   options.bios = {
     enable = mkEnableOption "enable bios boot";
     device = mkOption {

common/boot/default.nix

@@ -5,6 +5,6 @@
     ./firmware.nix
     ./efi.nix
     ./bios.nix
-    ./luks.nix
+    ./remote-luks-unlock.nix
   ];
 }

common/boot/efi.nix

@@ -3,7 +3,8 @@
 with lib;
 let
   cfg = config.efi;
-in {
+in
+{
   options.efi = {
     enable = mkEnableOption "enable efi boot";
   };
@@ -19,7 +20,7 @@ in {
         version = 2;
         efiSupport = true;
         useOSProber = true;
-#       memtest86.enable = true;
+        #       memtest86.enable = true;
         configurationLimit = 20;
         theme = pkgs.nixos-grub2-theme;
       };

common/boot/firmware.nix

@@ -3,7 +3,8 @@
 with lib;
 let
   cfg = config.firmware;
-in {
+in
+{
   options.firmware.x86_64 = {
     enable = mkEnableOption "enable x86_64 firmware";
   };

common/boot/luks.nix

@@ -1,101 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
-  cfg = config.luks;
-in {
-  options.luks = {
-    enable = lib.mkEnableOption "enable luks root remote decrypt over ssh/tor";
-    device = {
-      name = lib.mkOption {
-        type = lib.types.str;
-        default = "enc-pv";
-      };
-      path = lib.mkOption {
-        type = lib.types.either lib.types.str lib.types.path;
-      };
-      allowDiscards = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-      };
-    };
-    sshHostKeys = lib.mkOption {
-      type = lib.types.listOf (lib.types.either lib.types.str lib.types.path);
-      default = [
-        "/secret/ssh_host_rsa_key"
-        "/secret/ssh_host_ed25519_key"
-      ];
-    };
-    sshAuthorizedKeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = config.users.users.googlebot.openssh.authorizedKeys.keys;
-    };
-    onionConfig = lib.mkOption {
-      type = lib.types.path;
-      default = /secret/onion;
-    };
-    kernelModules = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      default = [ "e1000" "e1000e" "virtio_pci" "r8169" ];
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    boot.initrd.luks.devices.${cfg.device.name} = {
-      device = cfg.device.path;
-      allowDiscards = cfg.device.allowDiscards;
-    };
-
-    # Unlock LUKS disk over ssh
-    boot.initrd.network.enable = true;
-    boot.initrd.kernelModules = cfg.kernelModules;
-    boot.initrd.network.ssh = {
-      enable = true;
-      port = 22;
-      hostKeys = cfg.sshHostKeys;
-      authorizedKeys = cfg.sshAuthorizedKeys;
-    };
-
-    boot.initrd.postDeviceCommands = ''
-      echo 'waiting for root device to be opened...'
-      mkfifo /crypt-ramfs/passphrase
-      echo /crypt-ramfs/passphrase >> /dev/null
-    '';
-
-    # Make machine accessable over tor for boot unlock
-    boot.initrd.secrets = {
-      "/etc/tor/onion/bootup" = cfg.onionConfig;
-    };
-    boot.initrd.extraUtilsCommands = ''
-      copy_bin_and_libs ${pkgs.tor}/bin/tor
-      copy_bin_and_libs ${pkgs.haveged}/bin/haveged
-    '';
-    # start tor during boot process
-    boot.initrd.network.postCommands = let
-      torRc = (pkgs.writeText "tor.rc" ''
-        DataDirectory /etc/tor
-        SOCKSPort 127.0.0.1:9050 IsolateDestAddr
-        SOCKSPort 127.0.0.1:9063
-        HiddenServiceDir /etc/tor/onion/bootup
-        HiddenServicePort 22 127.0.0.1:22
-      '');
-    in ''
-      # Add nice prompt for giving LUKS passphrase over ssh
-      echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
-
-      echo "tor: preparing onion folder"
-      # have to do this otherwise tor does not want to start
-      chmod -R 700 /etc/tor
-
-      echo "make sure localhost is up"
-      ip a a 127.0.0.1/8 dev lo
-      ip link set lo up
-
-      echo "haveged: starting haveged"
-      haveged -F &
-
-      echo "tor: starting tor"
-      tor -f ${torRc} --verify-config
-      tor -f ${torRc} &
-    '';
-  };
-}

common/boot/remote-luks-unlock.nix

@@ -0,0 +1,99 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.remoteLuksUnlock;
+in
+{
+  options.remoteLuksUnlock = {
+    enable = lib.mkEnableOption "enable luks root remote decrypt over ssh/tor";
+    enableTorUnlock = lib.mkOption {
+      type = lib.types.bool;
+      default = cfg.enable;
+      description = "Make machine accessable over tor for ssh boot unlock";
+    };
+    sshHostKeys = lib.mkOption {
+      type = lib.types.listOf (lib.types.either lib.types.str lib.types.path);
+      default = [
+        "/secret/ssh_host_rsa_key"
+        "/secret/ssh_host_ed25519_key"
+      ];
+    };
+    sshAuthorizedKeys = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = config.users.users.googlebot.openssh.authorizedKeys.keys;
+    };
+    onionConfig = lib.mkOption {
+      type = lib.types.path;
+      default = /secret/onion;
+    };
+    kernelModules = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "e1000" "e1000e" "virtio_pci" "r8169" ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # boot.initrd.luks.devices.${cfg.device.name} = {
+    #   device = cfg.device.path;
+    #   allowDiscards = cfg.device.allowDiscards;
+    # };
+
+    # Unlock LUKS disk over ssh
+    boot.initrd.network.enable = true;
+    boot.initrd.kernelModules = cfg.kernelModules;
+    boot.initrd.network.ssh = {
+      enable = true;
+      port = 22;
+      hostKeys = cfg.sshHostKeys;
+      authorizedKeys = cfg.sshAuthorizedKeys;
+    };
+
+    boot.initrd.postDeviceCommands = ''
+      echo 'waiting for root device to be opened...'
+      mkfifo /crypt-ramfs/passphrase
+      echo /crypt-ramfs/passphrase >> /dev/null
+    '';
+
+    boot.initrd.secrets = lib.mkIf cfg.enableTorUnlock {
+      "/etc/tor/onion/bootup" = cfg.onionConfig;
+    };
+    boot.initrd.extraUtilsCommands = lib.mkIf cfg.enableTorUnlock ''
+      copy_bin_and_libs ${pkgs.tor}/bin/tor
+      copy_bin_and_libs ${pkgs.haveged}/bin/haveged
+    '';
+    boot.initrd.network.postCommands = lib.mkMerge [
+      (
+        ''
+          # Add nice prompt for giving LUKS passphrase over ssh
+          echo 'read -s -p "Unlock Passphrase: " passphrase && echo $passphrase > /crypt-ramfs/passphrase && exit' >> /root/.profile
+        ''
+      )
+
+      (
+        let torRc = (pkgs.writeText "tor.rc" ''
+          DataDirectory /etc/tor
+          SOCKSPort 127.0.0.1:9050 IsolateDestAddr
+          SOCKSPort 127.0.0.1:9063
+          HiddenServiceDir /etc/tor/onion/bootup
+          HiddenServicePort 22 127.0.0.1:22
+        ''); in
+        lib.mkIf cfg.enableTorUnlock ''
+          echo "tor: preparing onion folder"
+          # have to do this otherwise tor does not want to start
+          chmod -R 700 /etc/tor
+
+          echo "make sure localhost is up"
+          ip a a 127.0.0.1/8 dev lo
+          ip link set lo up
+
+          echo "haveged: starting haveged"
+          haveged -F &
+
+          echo "tor: starting tor"
+          tor -f ${torRc} --verify-config
+          tor -f ${torRc} &
+        ''
+      )
+    ];
+  };
+}

common/default.nix

@@ -1,7 +1,13 @@
 { config, pkgs, ... }:
 
+let
+  ssh = import ./ssh.nix;
+  sshUserKeys = ssh.users;
+  sshHigherTrustKeys = ssh.higherTrustUserKeys;
+in
 {
   imports = [
+    ./backups.nix
     ./flakes.nix
     ./auto-update.nix
     ./shell.nix
@@ -20,17 +26,23 @@
   networking.firewall.enable = true;
   networking.firewall.allowPing = true;
 
-  time.timeZone = "America/New_York";
+  time.timeZone = "America/Denver";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+    };
+  };
   programs.mosh.enable = true;
 
   environment.systemPackages = with pkgs; [
     wget
     kakoune
     htop
-    git git-lfs
+    git
+    git-lfs
     dnsutils
     tmux
     nethogs
@@ -42,6 +54,7 @@
     micro
     helix
     lm_sensors
+    picocom
   ];
 
   nixpkgs.config.allowUnfree = true;
@@ -54,11 +67,16 @@
       "dialout" # serial
     ];
     shell = pkgs.fish;
-    openssh.authorizedKeys.keys = (import ./ssh.nix).users;
+    openssh.authorizedKeys.keys = sshUserKeys;
     hashedPassword = "$6$TuDO46rILr$gkPUuLKZe3psexhs8WFZMpzgEBGksE.c3Tjh1f8sD0KMC4oV89K2pqAABfl.Lpxu2jVdr5bgvR5cWnZRnji/r/";
     uid = 1000;
   };
-  nix.trustedUsers = [ "root" "googlebot" ];
+  users.users.root = {
+    openssh.authorizedKeys.keys = sshHigherTrustKeys;
+  };
+  nix.settings = {
+    trusted-users = [ "root" "googlebot" ];
+  };
 
   nix.gc.automatic = true;
 

common/flakes.nix

@@ -2,7 +2,8 @@
 with lib;
 let
   cfg = config.nix.flakes;
-in {
+in
+{
   options.nix.flakes = {
     enable = mkEnableOption "use nix flakes";
   };

common/network/default.nix

@@ -9,9 +9,10 @@ in
   imports = [
     ./hosts.nix
     ./pia-openvpn.nix
+    ./pia-wireguard.nix
+    ./ping.nix
     ./tailscale.nix
     ./vpn.nix
-    ./zerotier.nix
   ];
 
   options.networking.ip_forward = mkEnableOption "Enable ip forwarding";

common/network/hosts.nix

@@ -2,62 +2,56 @@
 
 let
   system = (import ../ssh.nix).system;
-in {
-  networking.hosts = {
-    # some DNS providers filter local ip results from DNS request
-    "172.30.145.180" = [ "s0.zt.neet.dev" ];
-    "172.30.109.9" = [ "ponyo.zt.neet.dev" ];
-    "172.30.189.212" = [ "ray.zt.neet.dev" ];
+
+  # hostnames that resolve on clearnet for LUKS unlocking
+  unlock-clearnet-hosts = {
+    ponyo = "unlock.ponyo.neet.dev";
+    s0 = "s0";
   };
 
+  # hostnames that resolve on tor for LUKS unlocking
+  unlock-onion-hosts = {
+    liza = "5synsrjgvfzywruomjsfvfwhhlgxqhyofkzeqt2eisyijvjvebnu2xyd.onion";
+    router = "jxx2exuihlls2t6ncs7rvrjh2dssubjmjtclwr2ysvxtr4t7jv55xmqd.onion";
+    ponyo = "cfamr6artx75qvt7ho3rrbsc7mkucmv5aawebwflsfuorusayacffryd.onion";
+    s0 = "r3zvf7f2ppaeithzswigma46pajt3hqytmkg3rshgknbl3jbni455fqd.onion";
+  };
+in
+{
   programs.ssh.knownHosts = {
-    liza = {
-      hostNames = [ "liza" "liza.neet.dev" ];
-      publicKey = system.liza;
-    };
     ponyo = {
-      hostNames = [ "ponyo" "ponyo.neet.dev" "ponyo.zt.neet.dev" "git.neet.dev" ];
+      hostNames = [ "ponyo" "ponyo.neet.dev" "git.neet.dev" ];
       publicKey = system.ponyo;
     };
     ponyo-unlock = {
-      hostNames = [ "unlock.ponyo.neet.dev" "cfamr6artx75qvt7ho3rrbsc7mkucmv5aawebwflsfuorusayacffryd.onion" ];
+      hostNames = [ unlock-clearnet-hosts.ponyo unlock-onion-hosts.ponyo ];
       publicKey = system.ponyo-unlock;
     };
+    router = {
+      hostNames = [ "router" "192.168.1.228" ];
+      publicKey = system.router;
+    };
+    router-unlock = {
+      hostNames = [ unlock-onion-hosts.router ];
+      publicKey = system.router-unlock;
+    };
     ray = {
-      hostNames = [ "ray" "ray.zt.neet.dev" ];
+      hostNames = [ "ray" ];
       publicKey = system.ray;
     };
     s0 = {
-      hostNames = [ "s0" "s0.zt.neet.dev" ];
+      hostNames = [ "s0" ];
       publicKey = system.s0;
     };
-    n1 = {
-      hostNames = [ "n1" ];
-      publicKey = system.n1;
-    };
-    n2 = {
-      hostNames = [ "n2" ];
-      publicKey = system.n2;
-    };
-    n3 = {
-      hostNames = [ "n3" ];
-      publicKey = system.n3;
-    };
-    n4 = {
-      hostNames = [ "n4" ];
-      publicKey = system.n4;
-    };
-    n5 = {
-      hostNames = [ "n5" ];
-      publicKey = system.n5;
-    };
-    n6 = {
-      hostNames = [ "n6" ];
-      publicKey = system.n6;
-    };
-    n7 = {
-      hostNames = [ "n7" ];
-      publicKey = system.n7;
+    s0-unlock = {
+      hostNames = [ unlock-onion-hosts.s0 ];
+      publicKey = system.s0-unlock;
     };
   };
+
+  # prebuilt cmds for easy ssh LUKS unlock
+  environment.shellAliases =
+    lib.concatMapAttrs (host: addr: { "unlock-over-tor_${host}" = "torsocks ssh root@${addr}"; }) unlock-onion-hosts
+    //
+    lib.concatMapAttrs (host: addr: { "unlock_${host}" = "ssh root@${addr}"; }) unlock-clearnet-hosts;
 }

common/network/pia-openvpn.nix

@@ -1,7 +1,7 @@
 { config, pkgs, lib, ... }:
 
 let
-  cfg = config.pia;
+  cfg = config.pia.openvpn;
   vpnfailsafe = pkgs.stdenv.mkDerivation {
     pname = "vpnfailsafe";
     version = "0.0.1";
@@ -14,7 +14,7 @@ let
   };
 in
 {
-  options.pia = {
+  options.pia.openvpn = {
     enable = lib.mkEnableOption "Enable private internet access";
     server = lib.mkOption {
       type = lib.types.str;

common/network/pia-wireguard.nix

@@ -0,0 +1,357 @@
+{ config, lib, pkgs, ... }:
+
+# Server list:
+#   https://serverlist.piaservers.net/vpninfo/servers/v6
+# Reference materials:
+#   https://github.com/pia-foss/manual-connections
+#   https://github.com/thrnz/docker-wireguard-pia/blob/master/extra/wg-gen.sh
+
+# TODO handle potential errors (or at least print status, success, and failures to the console)
+# TODO parameterize names of systemd services so that multiple wg VPNs could coexist in theory easier
+# TODO implement this module such that the wireguard VPN doesn't have to live in a container
+# TODO don't add forward rules if the PIA port is the same as cfg.forwardedPort
+# TODO verify signatures of PIA responses
+
+with builtins;
+with lib;
+
+let
+  cfg = config.pia.wireguard;
+
+  getPIAToken = ''
+    PIA_USER=`sed '1q;d' /run/agenix/pia-login.conf`
+    PIA_PASS=`sed '2q;d' /run/agenix/pia-login.conf`
+    # PIA_TOKEN only lasts 24hrs
+    PIA_TOKEN=`curl -s -u "$PIA_USER:$PIA_PASS" https://www.privateinternetaccess.com/gtoken/generateToken | jq -r '.token'`
+  '';
+
+  chooseWireguardServer = ''
+    servers=$(mktemp)
+    servers_json=$(mktemp)
+    curl -s "https://serverlist.piaservers.net/vpninfo/servers/v6" > "$servers"
+    # extract json part only
+    head -n 1 "$servers" | tr -d '\n' > "$servers_json"
+
+    echo "Available location ids:" && jq '.regions | .[] | {name, id, port_forward}' "$servers_json"
+
+    # Some locations have multiple servers available. Pick a random one.
+    totalservers=$(jq -r '.regions | .[] | select(.id=="'${cfg.serverLocation}'") | .servers.wg | length' "$servers_json")
+    if ! [[ "$totalservers" =~ ^[0-9]+$ ]] || [ "$totalservers" -eq 0 ] 2>/dev/null; then
+      echo "Location \"${cfg.serverLocation}\" not found."
+      exit 1
+    fi
+    serverindex=$(( RANDOM % totalservers))
+    WG_HOSTNAME=$(jq -r '.regions | .[] | select(.id=="'${cfg.serverLocation}'") | .servers.wg | .['$serverindex'].cn' "$servers_json")
+    WG_SERVER_IP=$(jq -r '.regions | .[] | select(.id=="'${cfg.serverLocation}'") | .servers.wg | .['$serverindex'].ip' "$servers_json")
+    WG_SERVER_PORT=$(jq -r '.groups.wg | .[0] | .ports | .[0]' "$servers_json")
+
+    # write chosen server
+    rm -f /tmp/${cfg.interfaceName}-server.conf
+    touch /tmp/${cfg.interfaceName}-server.conf
+    chmod 700 /tmp/${cfg.interfaceName}-server.conf
+    echo "$WG_HOSTNAME" >> /tmp/${cfg.interfaceName}-server.conf
+    echo "$WG_SERVER_IP" >> /tmp/${cfg.interfaceName}-server.conf
+    echo "$WG_SERVER_PORT" >> /tmp/${cfg.interfaceName}-server.conf
+
+    rm $servers_json $servers
+  '';
+
+  getChosenWireguardServer = ''
+    WG_HOSTNAME=`sed '1q;d' /tmp/${cfg.interfaceName}-server.conf`
+    WG_SERVER_IP=`sed '2q;d' /tmp/${cfg.interfaceName}-server.conf`
+    WG_SERVER_PORT=`sed '3q;d' /tmp/${cfg.interfaceName}-server.conf`
+  '';
+
+  refreshPIAPort = ''
+    ${getChosenWireguardServer}
+    signature=`sed '1q;d' /tmp/${cfg.interfaceName}-port-renewal`
+    payload=`sed '2q;d' /tmp/${cfg.interfaceName}-port-renewal`
+    bind_port_response=`curl -Gs -m 5 --connect-to "$WG_HOSTNAME::$WG_SERVER_IP:" --cacert "${./ca.rsa.4096.crt}" --data-urlencode "payload=$payload" --data-urlencode "signature=$signature" "https://$WG_HOSTNAME:19999/bindPort"`
+  '';
+
+  portForwarding = cfg.forwardPortForTransmission || cfg.forwardedPort != null;
+
+  containerServiceName = "container@${config.vpn-container.containerName}.service";
+in
+{
+  options.pia.wireguard = {
+    enable = mkEnableOption "Enable private internet access";
+    badPortForwardPorts = mkOption {
+      type = types.listOf types.port;
+      description = ''
+        Ports that will not be accepted from PIA.
+        If PIA assigns a port from this list, the connection is aborted since we cannot ask for a different port.
+        This is used to guarantee we are not assigned a port that is used by a service we do not want exposed.
+      '';
+    };
+    wireguardListenPort = mkOption {
+      type = types.port;
+      description = "The port wireguard listens on for this VPN connection";
+      default = 51820;
+    };
+    serverLocation = mkOption {
+      type = types.str;
+      default = "swiss";
+    };
+    interfaceName = mkOption {
+      type = types.str;
+      default = "piaw";
+    };
+    forwardedPort = mkOption {
+      type = types.nullOr types.port;
+      description = "The port to redirect port forwarded TCP VPN traffic too";
+      default = null;
+    };
+    forwardPortForTransmission = mkEnableOption "PIA port forwarding for transmission should be performed.";
+  };
+
+  config = mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.forwardPortForTransmission != (cfg.forwardedPort != null);
+        message = ''
+          The PIA forwarded port cannot simultaneously be used by transmission and redirected to another port.
+        '';
+      }
+    ];
+
+    # mounts used to pass the connection parameters to the container
+    # the container doesn't have internet until it uses these parameters so it cannot fetch them itself
+    vpn-container.mounts = [
+      "/tmp/${cfg.interfaceName}.conf"
+      "/tmp/${cfg.interfaceName}-server.conf"
+      "/tmp/${cfg.interfaceName}-address.conf"
+    ];
+
+    # The container takes ownership of the wireguard interface on its startup
+    containers.vpn.interfaces = [ cfg.interfaceName ];
+
+    # TODO: while this is much better than "loose" networking, it seems to have issues with firewall restarts
+    # allow traffic for wireguard interface to pass since wireguard trips up rpfilter
+    # networking.firewall = {
+    #   extraCommands = ''
+    #     ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --sport ${toString cfg.wireguardListenPort} -j RETURN
+    #     ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --dport ${toString cfg.wireguardListenPort} -j RETURN
+    #   '';
+    #   extraStopCommands = ''
+    #     ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --sport ${toString cfg.wireguardListenPort} -j RETURN || true
+    #     ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --dport ${toString cfg.wireguardListenPort} -j RETURN || true
+    #   '';
+    # };
+    networking.firewall.checkReversePath = "loose";
+
+    systemd.services.pia-vpn-wireguard-init = {
+      description = "Creates PIA VPN Wireguard Interface";
+
+      requires = [ "network-online.target" ];
+      after = [ "network.target" "network-online.target" ];
+      before = [ containerServiceName ];
+      requiredBy = [ containerServiceName ];
+      partOf = [ containerServiceName ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = with pkgs; [ wireguard-tools jq curl iproute ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+
+        # restart once a month; PIA forwarded port expires after two months
+        # because the container is "PartOf" this unit, it gets restarted too
+        RuntimeMaxSec = "30d";
+      };
+
+      script = ''
+        # Prepare to connect by generating wg secrets and auth'ing with PIA since the container
+        # cannot do without internet to start with. NAT'ing the host's internet would address this
+        # issue but is not ideal because then leaking network outside of the VPN is more likely.
+
+        ${chooseWireguardServer}
+
+        ${getPIAToken}
+
+        # generate wireguard keys
+        privKey=$(wg genkey)
+        pubKey=$(echo "$privKey" | wg pubkey)
+
+        # authorize our WG keys with the PIA server we are about to connect to
+        wireguard_json=`curl -s -G --connect-to "$WG_HOSTNAME::$WG_SERVER_IP:" --cacert "${./ca.rsa.4096.crt}" --data-urlencode "pt=$PIA_TOKEN" --data-urlencode "pubkey=$pubKey" https://$WG_HOSTNAME:$WG_SERVER_PORT/addKey`
+
+        # create wg-quick config file
+        rm -f /tmp/${cfg.interfaceName}.conf /tmp/${cfg.interfaceName}-address.conf
+        touch /tmp/${cfg.interfaceName}.conf /tmp/${cfg.interfaceName}-address.conf
+        chmod 700 /tmp/${cfg.interfaceName}.conf /tmp/${cfg.interfaceName}-address.conf
+        echo "
+        [Interface]
+        # Address = $(echo "$wireguard_json" | jq -r '.peer_ip')
+        PrivateKey = $privKey
+        ListenPort = ${toString cfg.wireguardListenPort}
+        [Peer]
+        PersistentKeepalive = 25
+        PublicKey = $(echo "$wireguard_json" | jq -r '.server_key')
+        AllowedIPs = 0.0.0.0/0
+        Endpoint = $WG_SERVER_IP:$(echo "$wireguard_json" | jq -r '.server_port')
+        " >> /tmp/${cfg.interfaceName}.conf
+
+        # create file storing the VPN ip address PIA assigned to us
+        echo "$wireguard_json" | jq -r '.peer_ip' >> /tmp/${cfg.interfaceName}-address.conf
+
+        # Create wg interface now so it inherits from the namespace with internet access
+        # the container will handle actually connecting the interface since that info is
+        # not preserved upon moving into the container's networking namespace
+        # Roughly following this guide https://www.wireguard.com/netns/#ordinary-containerization
+        [[ -z $(ip link show dev ${cfg.interfaceName} 2>/dev/null) ]] || exit
+        ip link add ${cfg.interfaceName} type wireguard
+      '';
+
+      preStop = ''
+        # cleanup wireguard interface
+        ip link del ${cfg.interfaceName}
+        rm -f /tmp/${cfg.interfaceName}.conf /tmp/${cfg.interfaceName}-address.conf
+      '';
+    };
+
+    vpn-container.config.systemd.services.pia-vpn-wireguard = {
+      description = "Initializes the PIA VPN WireGuard Tunnel";
+
+      requires = [ "network-online.target" ];
+      after = [ "network.target" "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      path = with pkgs; [ wireguard-tools iproute curl jq iptables ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+
+      script = ''
+        # pseudo calls wg-quick
+        # Near equivalent of "wg-quick up /tmp/${cfg.interfaceName}.conf"
+        # cannot actually call wg-quick because the interface has to be already
+        # created before the container taken ownership of the interface
+        # Thus, assumes wg interface was already created:
+        #   ip link add ${cfg.interfaceName} type wireguard
+
+        ${getChosenWireguardServer}
+
+        myaddress=`cat /tmp/${cfg.interfaceName}-address.conf`
+
+        wg setconf ${cfg.interfaceName} /tmp/${cfg.interfaceName}.conf
+        ip -4 address add $myaddress dev ${cfg.interfaceName}
+        ip link set mtu 1420 up dev ${cfg.interfaceName}
+        wg set ${cfg.interfaceName} fwmark ${toString cfg.wireguardListenPort}
+        ip -4 route add 0.0.0.0/0 dev ${cfg.interfaceName} table ${toString cfg.wireguardListenPort}
+
+        # TODO is this needed?
+        ip -4 rule add not fwmark ${toString cfg.wireguardListenPort} table ${toString cfg.wireguardListenPort}
+        ip -4 rule add table main suppress_prefixlength 0
+
+        # The rest of the script is only for only for port forwarding skip if not needed
+        if [ ${boolToString portForwarding} == false ]; then exit 0; fi
+
+        # Reserve port
+        ${getPIAToken}
+        payload_and_signature=`curl -s -m 5 --connect-to "$WG_HOSTNAME::$WG_SERVER_IP:" --cacert "${./ca.rsa.4096.crt}" -G --data-urlencode "token=$PIA_TOKEN" "https://$WG_HOSTNAME:19999/getSignature"`
+        signature=$(echo "$payload_and_signature" | jq -r '.signature')
+        payload=$(echo "$payload_and_signature" | jq -r '.payload')
+        port=$(echo "$payload" | base64 -d | jq -r '.port')
+
+        # Check if the port is acceptable
+        notallowed=(${concatStringsSep " " (map toString cfg.badPortForwardPorts)})
+        if [[ " ''${notallowed[*]} " =~ " $port " ]]; then
+          # the port PIA assigned is not allowed, kill the connection
+          wg-quick down /tmp/${cfg.interfaceName}.conf
+          exit 1
+        fi
+
+        # write reserved port to file readable for all users
+        echo $port > /tmp/${cfg.interfaceName}-port
+        chmod 644 /tmp/${cfg.interfaceName}-port
+
+        # write payload and signature info needed to allow refreshing allocated forwarded port
+        rm -f /tmp/${cfg.interfaceName}-port-renewal
+        touch /tmp/${cfg.interfaceName}-port-renewal
+        chmod 700 /tmp/${cfg.interfaceName}-port-renewal
+        echo $signature >> /tmp/${cfg.interfaceName}-port-renewal
+        echo $payload >> /tmp/${cfg.interfaceName}-port-renewal
+
+        # Block all traffic from VPN interface except for traffic that is from the forwarded port
+        iptables -I nixos-fw -p tcp --dport $port -j nixos-fw-accept -i ${cfg.interfaceName}
+        iptables -I nixos-fw -p udp --dport $port -j nixos-fw-accept -i ${cfg.interfaceName}
+
+        # The first port refresh triggers the port to be actually allocated
+        ${refreshPIAPort}
+
+        ${optionalString (cfg.forwardedPort != null) ''
+          # redirect the fowarded port
+          iptables -A INPUT -i ${cfg.interfaceName} -p tcp --dport $port -j ACCEPT
+          iptables -A INPUT -i ${cfg.interfaceName} -p udp --dport $port -j ACCEPT
+          iptables -A INPUT -i ${cfg.interfaceName} -p tcp --dport ${toString cfg.forwardedPort} -j ACCEPT
+          iptables -A INPUT -i ${cfg.interfaceName} -p udp --dport ${toString cfg.forwardedPort} -j ACCEPT
+          iptables -A PREROUTING -t nat -i ${cfg.interfaceName} -p tcp --dport $port -j REDIRECT --to-port ${toString cfg.forwardedPort}
+          iptables -A PREROUTING -t nat -i ${cfg.interfaceName} -p udp --dport $port -j REDIRECT --to-port ${toString cfg.forwardedPort}
+        ''}
+
+        ${optionalString cfg.forwardPortForTransmission ''
+          # assumes no auth needed for transmission
+          curlout=$(curl localhost:9091/transmission/rpc 2>/dev/null)
+          regex='X-Transmission-Session-Id\: (\w*)'
+          if [[ $curlout =~ $regex ]]; then
+              sessionId=''${BASH_REMATCH[1]}
+          else
+              exit 1
+          fi
+
+          # set the port in transmission
+          data='{"method": "session-set", "arguments": { "peer-port" :'$port' } }'
+          curl http://localhost:9091/transmission/rpc -d "$data" -H "X-Transmission-Session-Id: $sessionId"
+        ''}
+      '';
+
+      preStop = ''
+        wg-quick down /tmp/${cfg.interfaceName}.conf
+
+        # The rest of the script is only for only for port forwarding skip if not needed
+        if [ ${boolToString portForwarding} == false ]; then exit 0; fi
+
+        ${optionalString (cfg.forwardedPort != null) ''
+          # stop redirecting the forwarded port
+          iptables -D INPUT -i ${cfg.interfaceName} -p tcp --dport $port -j ACCEPT
+          iptables -D INPUT -i ${cfg.interfaceName} -p udp --dport $port -j ACCEPT
+          iptables -D INPUT -i ${cfg.interfaceName} -p tcp --dport ${toString cfg.forwardedPort} -j ACCEPT
+          iptables -D INPUT -i ${cfg.interfaceName} -p udp --dport ${toString cfg.forwardedPort} -j ACCEPT
+          iptables -D PREROUTING -t nat -i ${cfg.interfaceName} -p tcp --dport $port -j REDIRECT --to-port ${toString cfg.forwardedPort}
+          iptables -D PREROUTING -t nat -i ${cfg.interfaceName} -p udp --dport $port -j REDIRECT --to-port ${toString cfg.forwardedPort}
+        ''}
+      '';
+    };
+
+    vpn-container.config.systemd.services.pia-vpn-wireguard-forward-port = {
+      enable = portForwarding;
+      description = "PIA VPN WireGuard Tunnel Port Forwarding";
+      after = [ "pia-vpn-wireguard.service" ];
+      requires = [ "pia-vpn-wireguard.service" ];
+
+      path = with pkgs; [ curl ];
+
+      serviceConfig = {
+        Type = "oneshot";
+      };
+
+      script = refreshPIAPort;
+    };
+
+    vpn-container.config.systemd.timers.pia-vpn-wireguard-forward-port = {
+      enable = portForwarding;
+      partOf = [ "pia-vpn-wireguard-forward-port.service" ];
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "*:0/10"; # 10 minutes
+        RandomizedDelaySec = "1m"; # vary by 1 min to give PIA servers some relief
+      };
+    };
+
+    age.secrets."pia-login.conf".file = ../../secrets/pia-login.conf;
+  };
+}

common/network/ping.nix

@@ -0,0 +1,59 @@
+{ config, pkgs, lib, ... }:
+
+# keeps peer to peer connections alive with a periodic ping
+
+with lib;
+with builtins;
+
+# todo auto restart
+
+let
+  cfg = config.keepalive-ping;
+
+  serviceTemplate = host:
+    {
+      "keepalive-ping@${host}" = {
+        description = "Periodic ping keep alive for ${host} connection";
+
+        requires = [ "network-online.target" ];
+        after = [ "network.target" "network-online.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig.Restart = "always";
+
+        path = with pkgs; [ iputils ];
+
+        script = ''
+          ping -i ${cfg.delay} ${host} &>/dev/null
+        '';
+      };
+    };
+
+  combineAttrs = foldl recursiveUpdate { };
+
+  serviceList = map serviceTemplate cfg.hosts;
+
+  services = combineAttrs serviceList;
+in
+{
+  options.keepalive-ping = {
+    enable = mkEnableOption "Enable keep alive ping task";
+    hosts = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = ''
+        Hosts to ping periodically
+      '';
+    };
+    delay = mkOption {
+      type = types.str;
+      default = "60";
+      description = ''
+        Ping interval in seconds of periodic ping per host being pinged
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services = services;
+  };
+}

common/network/tailscale.nix

@@ -8,7 +8,11 @@ in
 {
   options.services.tailscale.exitNode = mkEnableOption "Enable exit node support";
 
-  config.services.tailscale.enable = !config.boot.isContainer;
+  config.services.tailscale.enable = mkDefault (!config.boot.isContainer);
+
+  # MagicDNS
+  config.networking.nameservers = mkIf cfg.enable [ "1.1.1.1" "8.8.8.8" ];
+  config.networking.search = mkIf cfg.enable [ "koi-bebop.ts.net" ];
 
   # exit node
   config.networking.firewall.checkReversePath = mkIf cfg.exitNode "loose";

common/network/vpn.nix

@@ -26,9 +26,11 @@ in
       '';
     };
 
+    useOpenVPN = mkEnableOption "Uses OpenVPN instead of wireguard for PIA VPN connection";
+
     config = mkOption {
       type = types.anything;
-      default = {};
+      default = { };
       example = ''
         {
           services.nginx.enable = true;
@@ -41,6 +43,9 @@ in
   };
 
   config = mkIf cfg.enable {
+    pia.wireguard.enable = !cfg.useOpenVPN;
+    pia.wireguard.forwardPortForTransmission = !cfg.useOpenVPN;
+
     containers.${cfg.containerName} = {
       ephemeral = true;
       autoStart = true;
@@ -59,36 +64,43 @@ in
         }
       )));
 
-      enableTun = true;
+      enableTun = cfg.useOpenVPN;
       privateNetwork = true;
       hostAddress = "172.16.100.1";
       localAddress = "172.16.100.2";
 
       config = {
-        imports = allModules ++ [cfg.config];
+        imports = allModules ++ [ cfg.config ];
 
+        # speeds up evaluation
         nixpkgs.pkgs = pkgs;
 
-        networking.firewall.enable = mkForce false;
+        # networking.firewall.enable = mkForce false;
+        networking.firewall.trustedInterfaces = [
+          # completely trust internal interface to host
+          "eth0"
+        ];
 
-        pia.enable = true;
-        pia.server = "swiss.privacy.network"; # swiss vpn
+        pia.openvpn.enable = cfg.useOpenVPN;
+        pia.openvpn.server = "swiss.privacy.network"; # swiss vpn
 
+        # TODO fix so it does run it's own resolver again
         # run it's own DNS resolver
         networking.useHostResolvConf = false;
-        services.resolved.enable = true;
+        # services.resolved.enable = true;
+        networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
       };
     };
 
     # load secrets the container needs
     age.secrets = config.containers.${cfg.containerName}.config.age.secrets;
 
-    # forwarding for vpn container
-    networking.nat.enable = true;
-    networking.nat.internalInterfaces = [
+    # forwarding for vpn container (only for OpenVPN)
+    networking.nat.enable = mkIf cfg.useOpenVPN true;
+    networking.nat.internalInterfaces = mkIf cfg.useOpenVPN [
       "ve-${cfg.containerName}"
     ];
-    networking.ip_forward = true;
+    networking.ip_forward = mkIf cfg.useOpenVPN true;
 
     # assumes only one potential interface
     networking.usePredictableInterfaceNames = false;

common/network/zerotier.nix

@@ -1,14 +0,0 @@
-{ lib, config, ... }:
-
-let
-  cfg = config.services.zerotierone;
-in {
-  config = lib.mkIf cfg.enable {
-    services.zerotierone.joinNetworks = [
-      "565799d8f6d654c0"
-    ];
-    networking.firewall.allowedUDPPorts = [
-      9993
-    ];
-  };
-}

common/pc/audio.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.de;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     # enable pulseaudio support for packages
     nixpkgs.config.pulseaudio = true;
@@ -28,29 +29,29 @@ in {
             # properyty when no other driver is currently active. JACK clients need this.
             factory = "spa-node-factory";
             args = {
-              "factory.name"     = "support.node.driver";
-              "node.name"        = "Dummy-Driver";
-              "priority.driver"  = 8000;
+              "factory.name" = "support.node.driver";
+              "node.name" = "Dummy-Driver";
+              "priority.driver" = 8000;
             };
           }
           {
             factory = "adapter";
             args = {
-              "factory.name"     = "support.null-audio-sink";
-              "node.name"        = "Microphone-Proxy";
+              "factory.name" = "support.null-audio-sink";
+              "node.name" = "Microphone-Proxy";
               "node.description" = "Microphone";
-              "media.class"      = "Audio/Source/Virtual";
-              "audio.position"   = "MONO";
+              "media.class" = "Audio/Source/Virtual";
+              "audio.position" = "MONO";
             };
           }
           {
             factory = "adapter";
             args = {
-              "factory.name"     = "support.null-audio-sink";
-              "node.name"        = "Main-Output-Proxy";
+              "factory.name" = "support.null-audio-sink";
+              "node.name" = "Main-Output-Proxy";
               "node.description" = "Main Output";
-              "media.class"      = "Audio/Sink";
-              "audio.position"   = "FL,FR";
+              "media.class" = "Audio/Sink";
+              "audio.position" = "FL,FR";
             };
           }
         ];

common/pc/chromium.nix

@@ -49,7 +49,8 @@ let
     ];
   };
 
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     # chromium with specific extensions + settings
     programs.chromium = {
@@ -92,7 +93,7 @@ in {
       enable = true;
       extraPackages = with pkgs; [
         intel-media-driver # LIBVA_DRIVER_NAME=iHD
-        vaapiIntel         # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
+        vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)
         # vaapiVdpau
         libvdpau-va-gl
         nvidia-vaapi-driver

common/pc/default.nix

@@ -2,15 +2,16 @@
 
 let
   cfg = config.de;
-in {
+in
+{
   imports = [
     ./kde.nix
     ./xfce.nix
     ./yubikey.nix
     ./chromium.nix
-#    ./firefox.nix
+    #    ./firefox.nix
     ./audio.nix
-#    ./torbrowser.nix
+    #    ./torbrowser.nix
     ./pithos.nix
     ./spotify.nix
     ./vscodium.nix
@@ -50,6 +51,12 @@ in {
       arduino
       yt-dlp
       jellyfin-media-player
+      joplin-desktop
+      config.inputs.deploy-rs.packages.${config.currentSystem}.deploy-rs
+
+      # For Nix IDE
+      nixpkgs-fmt
+      rnix-lsp
     ];
 
     # Networking

common/pc/discord.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.de;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     users.users.googlebot.packages = [
       pkgs.discord

common/pc/firefox.nix

@@ -20,7 +20,7 @@ let
   };
 
   firefox = pkgs.wrapFirefox somewhatPrivateFF {
-   desktopName = "Sneed Browser";
+    desktopName = "Sneed Browser";
 
     nixExtensions = [
       (pkgs.fetchFirefoxAddon {
@@ -71,8 +71,8 @@ let
         TopSites = false;
       };
       UserMessaging = {
-         ExtensionRecommendations = false;
-         SkipOnboarding = true;
+        ExtensionRecommendations = false;
+        SkipOnboarding = true;
       };
       WebsiteFilter = {
         Block = [

common/pc/kde.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.de;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     # kde plasma
     services.xserver = {

common/pc/mount-samba.nix

@@ -1,36 +1,48 @@
-# mounts the samba share on s0 over zeroteir
+# mounts the samba share on s0 over tailscale
 
-{ config, lib, ... }:
+{ config, lib, pkgs, ... }:
 
 let
   cfg = config.services.mount-samba;
 
-  # prevents hanging on network split
-  network_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s,nostrictsync,cache=loose,handlecache,handletimeout=30000,rwpidforward,mapposix,soft,resilienthandles,echo_interval=10,noblocksend";
+  # prevents hanging on network split and other similar niceties to ensure a stable connection
+  network_opts = "nostrictsync,cache=strict,handlecache,handletimeout=30000,rwpidforward,mapposix,soft,resilienthandles,echo_interval=10,noblocksend,fsc";
 
+  systemd_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
   user_opts = "uid=${toString config.users.users.googlebot.uid},file_mode=0660,dir_mode=0770,user";
-  auth_opts = "credentials=/run/agenix/smb-secrets";
-  version_opts = "vers=2.1";
+  auth_opts = "sec=ntlmv2i,credentials=/run/agenix/smb-secrets";
+  version_opts = "vers=3.1.1";
 
-  opts = "${network_opts},${user_opts},${version_opts},${auth_opts}";
-in {
+  opts = "${systemd_opts},${network_opts},${user_opts},${version_opts},${auth_opts}";
+in
+{
   options.services.mount-samba = {
     enable = lib.mkEnableOption "enable mounting samba shares";
   };
 
-  config = lib.mkIf (cfg.enable && config.services.zerotierone.enable) {
+  config = lib.mkIf (cfg.enable && config.services.tailscale.enable) {
     fileSystems."/mnt/public" = {
-        device = "//s0.zt.neet.dev/public";
-        fsType = "cifs";
-        options = [ opts ];
+      device = "//s0.koi-bebop.ts.net/public";
+      fsType = "cifs";
+      options = [ opts ];
     };
 
     fileSystems."/mnt/private" = {
-        device = "//s0.zt.neet.dev/googlebot";
-        fsType = "cifs";
-        options = [ opts ];
+      device = "//s0.koi-bebop.ts.net/googlebot";
+      fsType = "cifs";
+      options = [ opts ];
     };
 
     age.secrets.smb-secrets.file = ../../secrets/smb-secrets.age;
+
+    environment.shellAliases = {
+      # remount storage
+      remount_public = "sudo systemctl restart mnt-public.mount";
+      remount_private = "sudo systemctl restart mnt-private.mount";
+
+      # Encrypted Vault
+      vault_unlock = "${pkgs.gocryptfs}/bin/gocryptfs /mnt/private/.vault/ /mnt/vault/";
+      vault_lock = "umount /mnt/vault/";
+    };
   };
 }

common/pc/pithos.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.de;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     nixpkgs.overlays = [
       (self: super: {
@@ -11,7 +12,7 @@ in {
           version = "1.5.1";
           src = super.fetchFromGitHub {
             owner = pname;
-            repo  = pname;
+            repo = pname;
             rev = version;
             sha256 = "il7OAALpHFZ6wjco9Asp04zWHCD8Ni+iBdiJWcMiQA4=";
           };

common/pc/spotify.nix

@@ -4,7 +4,7 @@ with lib;
 
 let
   cfg = config.services.spotifyd;
-  toml = pkgs.formats.toml {};
+  toml = pkgs.formats.toml { };
   spotifydConf = toml.generate "spotify.conf" cfg.settings;
 in
 {
@@ -17,7 +17,7 @@ in
       enable = mkEnableOption "spotifyd, a Spotify playing daemon";
 
       settings = mkOption {
-        default = {};
+        default = { };
         type = toml.type;
         example = { global.bitrate = 320; };
         description = ''
@@ -28,7 +28,7 @@ in
 
       users = mkOption {
         type = with types; listOf str;
-        default = [];
+        default = [ ];
         description = ''
           Usernames to be added to the "spotifyd" group, so that they
           can start and interact with the userspace daemon.

common/pc/steam.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.de;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     programs.steam.enable = true;
     hardware.steam-hardware.enable = true; # steam controller

common/pc/torbrowser.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.de;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     nixpkgs.overlays = [
       (self: super: {

common/pc/touchpad.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.de.touchpad;
-in {
+in
+{
   options.de.touchpad = {
     enable = lib.mkEnableOption "enable touchpad";
   };

common/pc/vscodium.nix

@@ -4,8 +4,8 @@ let
   cfg = config.de;
 
   extensions = with pkgs.vscode-extensions; [
-#    bbenoist.Nix # nix syntax support
-#    arrterian.nix-env-selector  # nix dev envs
+    #    bbenoist.Nix # nix syntax support
+    #    arrterian.nix-env-selector  # nix dev envs
   ];
 
   vscodium-with-extensions = pkgs.vscode-with-extensions.override {

common/pc/xfce.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.de;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     services.xserver = {
       enable = true;

common/pc/yubikey.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.de;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     # yubikey
     services.pcscd.enable = true;

common/server/ceph.nix

@@ -3,9 +3,9 @@
 with lib;
 let
   cfg = config.ceph;
-in {
-  options.ceph = {
-  };
+in
+{
+  options.ceph = { };
 
   config = mkIf cfg.enable {
     # ceph.enable = true;

common/server/default.nix

@@ -14,5 +14,9 @@
     ./radio.nix
     ./samba.nix
     ./owncast.nix
+    ./mailserver.nix
+    ./nextcloud.nix
+    ./iodine.nix
+    ./searx.nix
   ];
 }

common/server/gitea.nix

@@ -1,8 +1,9 @@
-{ lib, config, ... }:
+{ lib, pkgs, config, ... }:
 
 let
   cfg = config.services.gitea;
-in {
+in
+{
   options.services.gitea = {
     hostname = lib.mkOption {
       type = lib.types.str;
@@ -14,11 +15,8 @@ in {
       domain = cfg.hostname;
       rootUrl = "https://${cfg.hostname}/";
       appName = cfg.hostname;
-      ssh.enable = true;
       # lfs.enable = true;
-      dump.enable = true;
-      cookieSecure = true;
-      disableRegistration = true;
+      # dump.enable = true;
       settings = {
         other = {
           SHOW_FOOTER_VERSION = false;
@@ -26,8 +24,34 @@ in {
         ui = {
           DEFAULT_THEME = "arc-green";
         };
+        service = {
+          DISABLE_REGISTRATION = true;
+        };
+        session = {
+          COOKIE_SECURE = true;
+        };
+        mailer = {
+          ENABLED = true;
+          MAILER_TYPE = "smtp";
+          SMTP_ADDR = "mail.neet.dev";
+          SMTP_PORT = "465";
+          IS_TLS_ENABLED = true;
+          USER = "robot@runyan.org";
+          FROM = "no-reply@neet.dev";
+        };
       };
+      mailerPasswordFile = "/run/agenix/robots-email-pw";
     };
+    age.secrets.robots-email-pw = {
+      file = ../../secrets/robots-email-pw.age;
+      owner = config.services.gitea.user;
+    };
+
+    # backups
+    backup.group."gitea".paths = [
+      config.services.gitea.stateDir
+    ];
+
     services.nginx.enable = true;
     services.nginx.virtualHosts.${cfg.hostname} = {
       enableACME = true;

common/server/hydra.nix

@@ -20,6 +20,6 @@ in
     hydraURL = "https://${domain}";
     useSubstitutes = true;
     notificationSender = notifyEmail;
-    buildMachinesFiles = [];
+    buildMachinesFiles = [ ];
   };
 }

common/server/icecast.nix

@@ -7,7 +7,8 @@
 
 let
   cfg = config.services.icecast;
-in {
+in
+{
   options.services.icecast = {
     mount = lib.mkOption {
       type = lib.types.str;

common/server/iodine.nix

@@ -0,0 +1,21 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.iodine.server;
+in
+{
+  config = lib.mkIf cfg.enable {
+    # iodine DNS-based vpn
+    services.iodine.server = {
+      ip = "192.168.99.1";
+      domain = "tun.neet.dev";
+      passwordFile = "/run/agenix/iodine";
+    };
+    age.secrets.iodine.file = ../../secrets/iodine.age;
+    networking.firewall.allowedUDPPorts = [ 53 ];
+
+    networking.nat.internalInterfaces = [
+      "dns0" # iodine
+    ];
+  };
+}

common/server/mailserver.nix

@@ -0,0 +1,99 @@
+{ config, pkgs, lib, ... }:
+
+with builtins;
+
+let
+  cfg = config.mailserver;
+  domains = [
+    "neet.space"
+    "neet.dev"
+    "neet.cloud"
+    "runyan.org"
+    "runyan.rocks"
+    "thunderhex.com"
+    "tar.ninja"
+    "bsd.ninja"
+    "bsd.rocks"
+  ];
+in
+{
+  config = lib.mkIf cfg.enable {
+    # kresd doesn't work with tailscale MagicDNS
+    mailserver.localDnsResolver = false;
+    services.resolved.enable = true;
+
+    mailserver = {
+      fqdn = "mail.neet.dev";
+      dkimKeyBits = 2048;
+      indexDir = "/var/lib/mailindex";
+      enableManageSieve = true;
+      fullTextSearch.enable = true;
+      fullTextSearch.indexAttachments = true;
+      fullTextSearch.memoryLimit = 500;
+      inherit domains;
+      loginAccounts = {
+        "jeremy@runyan.org" = {
+          hashedPasswordFile = "/run/agenix/email-pw";
+          # catchall for all domains
+          aliases = map (domain: "@${domain}") domains;
+        };
+        "robot@runyan.org" = {
+          aliases = [
+            "no-reply@neet.dev"
+            "robot@neet.dev"
+          ];
+          sendOnly = true;
+          hashedPassword = "$2b$05$hkmwXGJSKuG/1.SmLecWSuzlq1F5pjp2ScoipQoVLR0ssSN5MgRs.";
+        };
+      };
+      rejectRecipients = [
+        "george@runyan.org"
+        "joslyn@runyan.org"
+        "damon@runyan.org"
+        "jonas@runyan.org"
+      ];
+      certificateScheme = 3; # use let's encrypt for certs
+    };
+    age.secrets.email-pw.file = ../../secrets/email-pw.age;
+
+    # sendmail to use xxx@domain instead of xxx@mail.domain
+    services.postfix.origin = "$mydomain";
+
+    # relay sent mail through mailgun
+    # https://www.howtoforge.com/community/threads/different-smtp-relays-for-different-domains-in-postfix.82711/#post-392620
+    services.postfix.config = {
+      smtp_sasl_auth_enable = "yes";
+      smtp_sasl_security_options = "noanonymous";
+      smtp_sasl_password_maps = "hash:/var/lib/postfix/conf/sasl_relay_passwd";
+      smtp_use_tls = "yes";
+      sender_dependent_relayhost_maps = "hash:/var/lib/postfix/conf/sender_relay";
+      smtp_sender_dependent_authentication = "yes";
+    };
+    services.postfix.mapFiles.sender_relay =
+      let
+        relayHost = "[smtp.mailgun.org]:587";
+      in
+      pkgs.writeText "sender_relay"
+        (concatStringsSep "\n" (map (domain: "@${domain} ${relayHost}") domains));
+    services.postfix.mapFiles.sasl_relay_passwd = "/run/agenix/sasl_relay_passwd";
+    age.secrets.sasl_relay_passwd.file = ../../secrets/sasl_relay_passwd.age;
+
+    # webmail
+    services.nginx.enable = true;
+    services.roundcube = {
+      enable = true;
+      hostName = config.mailserver.fqdn;
+      extraConfig = ''
+        # starttls needed for authentication, so the fqdn required to match the certificate
+        $config['smtp_server'] = "tls://${config.mailserver.fqdn}";
+        $config['smtp_user'] = "%u";
+        $config['smtp_pass'] = "%p";
+      '';
+    };
+
+    # backups
+    backup.group."email".paths = [
+      config.mailserver.mailDirectory
+    ];
+  };
+}

common/server/matrix.nix

@@ -3,7 +3,8 @@
 let
   cfg = config.services.matrix;
   certs = config.security.acme.certs;
-in {
+in
+{
   options.services.matrix = {
     enable = lib.mkEnableOption "enable matrix";
     element-web = {
@@ -62,15 +63,15 @@ in {
       settings = {
         server_name = cfg.host;
         enable_registration = cfg.enable_registration;
-        listeners = [ {
-          bind_addresses = ["127.0.0.1"];
+        listeners = [{
+          bind_addresses = [ "127.0.0.1" ];
           port = cfg.port;
           tls = false;
-          resources = [ {
+          resources = [{
             compress = true;
             names = [ "client" "federation" ];
-          } ];
-        } ];
+          }];
+        }];
         turn_uris = [
           "turn:${cfg.turn.host}:${toString cfg.turn.port}?transport=udp"
           "turn:${cfg.turn.host}:${toString cfg.turn.port}?transport=tcp"
@@ -120,7 +121,7 @@ in {
     services.nginx = {
       enable = true;
 
-      virtualHosts.${cfg.host} =  {
+      virtualHosts.${cfg.host} = {
         enableACME = true;
         forceSSL = true;
         listen = [
@@ -137,7 +138,8 @@ in {
         ];
         locations."/".proxyPass = "http://localhost:${toString cfg.port}";
       };
-      virtualHosts.${cfg.turn.host} =  { # get TLS cert for TURN server
+      virtualHosts.${cfg.turn.host} = {
+        # get TLS cert for TURN server
         enableACME = true;
         forceSSL = true;
       };

common/server/mumble.nix

@@ -3,7 +3,8 @@
 let
   cfg = config.services.murmur;
   certs = config.security.acme.certs;
-in {
+in
+{
   options.services.murmur.domain = lib.mkOption {
     type = lib.types.str;
   };

common/server/nextcloud.nix

@@ -0,0 +1,34 @@
+{ config, pkgs, lib, ... }:
+
+
+let
+  cfg = config.services.nextcloud;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.nextcloud = {
+      https = true;
+      package = pkgs.nextcloud25;
+      hostName = "neet.cloud";
+      config.dbtype = "sqlite";
+      config.adminuser = "jeremy";
+      config.adminpassFile = "/run/agenix/nextcloud-pw";
+      autoUpdateApps.enable = true;
+      enableBrokenCiphersForSSE = false;
+    };
+    age.secrets.nextcloud-pw = {
+      file = ../../secrets/nextcloud-pw.age;
+      owner = "nextcloud";
+    };
+
+    # backups
+    backup.group."nextcloud".paths = [
+      config.services.nextcloud.home
+    ];
+
+    services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+}

common/server/nginx-stream.nix

@@ -5,7 +5,8 @@ let
   nginxWithRTMP = pkgs.nginx.override {
     modules = [ pkgs.nginxModules.rtmp ];
   };
-in {
+in
+{
   options.services.nginx.stream = {
     enable = lib.mkEnableOption "enable nginx rtmp/hls/dash video streaming";
     port = lib.mkOption {

common/server/nginx.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.services.nginx;
-in {
+in
+{
   config = lib.mkIf cfg.enable {
     services.nginx = {
       recommendedGzipSettings = true;

common/server/owncast.nix

@@ -4,7 +4,8 @@ with lib;
 
 let
   cfg = config.services.owncast;
-in {
+in
+{
   options.services.owncast = {
     hostname = lib.mkOption {
       type = types.str;

common/server/privatebin/privatebin.nix

@@ -14,7 +14,8 @@ let
       cp -ar $src $out
     '';
   };
-in {
+in
+{
   options.services.privatebin = {
     enable = lib.mkEnableOption "enable privatebin";
     host = lib.mkOption {
@@ -30,7 +31,7 @@ in {
       group = "privatebin";
       isSystemUser = true;
     };
-    users.groups.privatebin = {};
+    users.groups.privatebin = { };
 
     services.nginx.enable = true;
     services.nginx.virtualHosts.${cfg.host} = {

common/server/radio.nix

@@ -3,7 +3,8 @@
 let
   cfg = config.services.radio;
   radioPackage = config.inputs.radio.packages.${config.currentSystem}.radio;
-in {
+in
+{
   options.services.radio = {
     enable = lib.mkEnableOption "enable radio";
     user = lib.mkOption {
@@ -56,11 +57,11 @@ in {
       home = cfg.dataDir;
       createHome = true;
     };
-    users.groups.${cfg.group} = {};
+    users.groups.${cfg.group} = { };
     systemd.services.radio = {
       enable = true;
-      after = ["network.target"];
-      wantedBy = ["multi-user.target"];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
       serviceConfig.ExecStart = "${radioPackage}/bin/radio ${config.services.icecast.listen.address}:${toString config.services.icecast.listen.port} ${config.services.icecast.mount} 5500";
       serviceConfig.User = cfg.user;
       serviceConfig.Group = cfg.group;

common/server/samba.nix

@@ -25,9 +25,7 @@
         printing = cups
         printcap name = cups
 
-        # horrible files
-        veto files = /._*/.DS_Store/ /._*/._.DS_Store/
-        delete veto files = yes
+        hide files = /.nobackup/.DS_Store/._.DS_Store/
       '';
 
       shares = {
@@ -77,6 +75,13 @@
       };
     };
 
+    # backups
+    backup.group."samba".paths = [
+      config.services.samba.shares.googlebot.path
+      config.services.samba.shares.cris.path
+      config.services.samba.shares.public.path
+    ];
+
     # Windows discovery of samba server
     services.samba-wsdd = {
       enable = true;
@@ -110,6 +115,6 @@
     # samba user for share
     users.users.cris.isSystemUser = true;
     users.users.cris.group = "cris";
-    users.groups.cris = {};
+    users.groups.cris = { };
   };
 }

common/server/searx.nix

@@ -0,0 +1,30 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.services.searx;
+in
+{
+  config = lib.mkIf cfg.enable {
+    services.searx = {
+      environmentFile = "/run/agenix/searx";
+      settings = {
+        server.port = 43254;
+        server.secret_key = "@SEARX_SECRET_KEY@";
+        engines = [{
+          name = "wolframalpha";
+          shortcut = "wa";
+          api_key = "@WOLFRAM_API_KEY@";
+          engine = "wolframalpha_api";
+        }];
+      };
+    };
+    services.nginx.virtualHosts."search.neet.space" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.searx.settings.server.port}";
+      };
+    };
+    age.secrets.searx.file = ../../secrets/searx.age;
+  };
+}

common/server/thelounge.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.services.thelounge;
-in {
+in
+{
   options.services.thelounge = {
     fileUploadBaseUrl = lib.mkOption {
       type = lib.types.str;
@@ -28,7 +29,7 @@ in {
         reverseProxy = true;
         maxHistory = -1;
         https.enable = false;
-  #      theme = "thelounge-theme-solarized";
+        #      theme = "thelounge-theme-solarized";
         prefetch = false;
         prefetchStorage = false;
         fileUpload = {
@@ -42,6 +43,10 @@ in {
       };
     };
 
+    backup.group."thelounge".paths = [
+      "/var/lib/thelounge/"
+    ];
+
     # the lounge client
     services.nginx.virtualHosts.${cfg.host} = {
       enableACME = true;

common/server/video-stream.nix

@@ -15,14 +15,14 @@ let
 in
 {
   networking.firewall.allowedUDPPorts = [ rtp-port ];
-  networking.firewall.allowedTCPPortRanges = [ {
+  networking.firewall.allowedTCPPortRanges = [{
     from = webrtc-peer-lower-port;
     to = webrtc-peer-upper-port;
-  } ];
-  networking.firewall.allowedUDPPortRanges = [ { 
+  }];
+  networking.firewall.allowedUDPPortRanges = [{
     from = webrtc-peer-lower-port;
     to = webrtc-peer-upper-port;
-  } ];
+  }];
 
   virtualisation.docker.enable = true;
 
@@ -49,12 +49,12 @@ in
         ports = [
           "${toStr ingest-port}:8084"
         ];
-#        imageFile = pkgs.dockerTools.pullImage {
-#          imageName = "projectlightspeed/ingest";
-#          finalImageTag = "version-0.1.4";
-#          imageDigest = "sha256:9fc51833b7c27a76d26e40f092b9cec1ac1c4bfebe452e94ad3269f1f73ff2fc";
-#          sha256 = "19kxl02x0a3i6hlnsfcm49hl6qxnq2f3hfmyv1v8qdaz58f35kd5";
-#        };
+        #        imageFile = pkgs.dockerTools.pullImage {
+        #          imageName = "projectlightspeed/ingest";
+        #          finalImageTag = "version-0.1.4";
+        #          imageDigest = "sha256:9fc51833b7c27a76d26e40f092b9cec1ac1c4bfebe452e94ad3269f1f73ff2fc";
+        #          sha256 = "19kxl02x0a3i6hlnsfcm49hl6qxnq2f3hfmyv1v8qdaz58f35kd5";
+        #        };
       };
       "lightspeed-react" = {
         workdir = "/var/lib/lightspeed-react";
@@ -62,12 +62,12 @@ in
         ports = [
           "${toStr web-port}:80"
         ];
-#        imageFile = pkgs.dockerTools.pullImage {
-#          imageName = "projectlightspeed/react";
-#          finalImageTag = "version-0.1.3";
-#          imageDigest = "sha256:b7c58425f1593f7b4304726b57aa399b6e216e55af9c0962c5c19333fae638b6";
-#          sha256 = "0d2jh7mr20h7dxgsp7ml7cw2qd4m8ja9rj75dpy59zyb6v0bn7js";
-#        };
+        #        imageFile = pkgs.dockerTools.pullImage {
+        #          imageName = "projectlightspeed/react";
+        #          finalImageTag = "version-0.1.3";
+        #          imageDigest = "sha256:b7c58425f1593f7b4304726b57aa399b6e216e55af9c0962c5c19333fae638b6";
+        #          sha256 = "0d2jh7mr20h7dxgsp7ml7cw2qd4m8ja9rj75dpy59zyb6v0bn7js";
+        #        };
       };
       "lightspeed-webrtc" = {
         workdir = "/var/lib/lightspeed-webrtc";
@@ -79,15 +79,18 @@ in
           "${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}:${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}/udp"
         ];
         cmd = [
-          "lightspeed-webrtc" "--addr=0.0.0.0" "--ip=${domain}"
-          "--ports=${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}" "run"
+          "lightspeed-webrtc"
+          "--addr=0.0.0.0"
+          "--ip=${domain}"
+          "--ports=${toStr webrtc-peer-lower-port}-${toStr webrtc-peer-upper-port}"
+          "run"
         ];
-#        imageFile = pkgs.dockerTools.pullImage {
-#          imageName = "projectlightspeed/webrtc";
-#          finalImageTag = "version-0.1.2";
-#          imageDigest = "sha256:ddf8b3dd294485529ec11d1234a3fc38e365a53c4738998c6bc2c6930be45ecf";
-#          sha256 = "1bdy4ak99fjdphj5bsk8rp13xxmbqdhfyfab14drbyffivg9ad2i";
-#        };
+        #        imageFile = pkgs.dockerTools.pullImage {
+        #          imageName = "projectlightspeed/webrtc";
+        #          finalImageTag = "version-0.1.2";
+        #          imageDigest = "sha256:ddf8b3dd294485529ec11d1234a3fc38e365a53c4738998c6bc2c6930be45ecf";
+        #          sha256 = "1bdy4ak99fjdphj5bsk8rp13xxmbqdhfyfab14drbyffivg9ad2i";
+        #        };
       };
     };
   };

common/server/vscode/modules/vscode-server/default.nix

@@ -1,8 +1,8 @@
 import ./module.nix ({ name, description, serviceConfig }:
 
-{
-  systemd.user.services.${name} = {
-    inherit description serviceConfig;
-    wantedBy = [ "default.target" ];
-  };
-})
+  {
+    systemd.user.services.${name} = {
+      inherit description serviceConfig;
+      wantedBy = [ "default.target" ];
+    };
+  })

common/server/vscode/modules/vscode-server/home.nix

@@ -1,15 +1,15 @@
 import ./module.nix ({ name, description, serviceConfig }:
 
-{
-  systemd.user.services.${name} = {
-    Unit = {
-      Description = description;
-    };
+  {
+    systemd.user.services.${name} = {
+      Unit = {
+        Description = description;
+      };
 
-    Service = serviceConfig;
+      Service = serviceConfig;
 
-    Install = {
-      WantedBy = [ "default.target" ];
+      Install = {
+        WantedBy = [ "default.target" ];
+      };
     };
-  };
-})
+  })

common/server/zerobin.nix

@@ -2,7 +2,8 @@
 
 let
   cfg = config.services.zerobin;
-in {
+in
+{
   options.services.zerobin = {
     host = lib.mkOption {
       type = lib.types.str;

common/shell.nix

@@ -1,34 +1,24 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 # Improvements to the default shell
-# - use nix-locate for command-not-found
+# - use nix-index for command-not-found
 # - disable fish's annoying greeting message
 # - add some handy shell commands
 
-let
-  nix-locate = config.inputs.nix-locate.packages.${config.currentSystem}.default;
-in {
-  programs.command-not-found.enable = false;
-
-  environment.systemPackages = [
-    nix-locate
+{
+  environment.systemPackages = with pkgs; [
+    comma
   ];
 
+  # nix-index
+  programs.nix-index.enable = true;
+  programs.nix-index.enableFishIntegration = true;
+  programs.command-not-found.enable = false;
+
   programs.fish = {
     enable = true;
 
-    shellInit = let
-      wrapper = pkgs.writeScript "command-not-found" ''
-        #!${pkgs.bash}/bin/bash
-        source ${nix-locate}/etc/profile.d/command-not-found.sh
-        command_not_found_handle "$@"
-      '';
-    in ''
-      # use nix-locate for command-not-found functionality
-      function __fish_command_not_found_handler --on-event fish_command_not_found
-          ${wrapper} $argv
-      end
-
+    shellInit = ''
       # disable annoying fish shell greeting
       set fish_greeting
     '';
@@ -38,9 +28,23 @@ in {
     myip = "dig +short myip.opendns.com @resolver1.opendns.com";
 
     # https://linuxreviews.org/HOWTO_Test_Disk_I/O_Performance
-    io_seq_read = "nix run nixpkgs#fio -- --name TEST --eta-newline=5s --filename=temp.file --rw=read --size=2g --io_size=10g --blocksize=1024k --ioengine=libaio --fsync=10000 --iodepth=32 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
-    io_seq_write = "nix run nixpkgs#fio -- --name TEST --eta-newline=5s --filename=temp.file --rw=write --size=2g --io_size=10g --blocksize=1024k --ioengine=libaio --fsync=10000 --iodepth=32 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
-    io_rand_read = "nix run nixpkgs#fio -- --name TEST --eta-newline=5s --filename=temp.file --rw=randread --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=32 --runtime=60 --group_reporting; rm temp.file";
-    io_rand_write = "nix run nixpkgs#fio -- --name TEST --eta-newline=5s --filename=temp.file --rw=randrw --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
+    io_seq_read = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=read --size=2g --io_size=10g --blocksize=1024k --ioengine=libaio --fsync=10000 --iodepth=32 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
+    io_seq_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=write --size=2g --io_size=10g --blocksize=1024k --ioengine=libaio --fsync=10000 --iodepth=32 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
+    io_rand_read = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randread --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=32 --runtime=60 --group_reporting; rm temp.file";
+    io_rand_write = "${pkgs.fio}/bin/fio --name TEST --eta-newline=5s --filename=temp.file --rw=randrw --size=2g --io_size=10g --blocksize=4k --ioengine=libaio --fsync=1 --iodepth=1 --direct=1 --numjobs=1 --runtime=60 --group_reporting; rm temp.file";
   };
+
+  nixpkgs.overlays = [
+    (final: prev: {
+      # comma uses the "nix-index" package built into nixpkgs by default.
+      # That package doesn't use the prebuilt nix-index database so it needs to be changed.
+      comma = prev.comma.overrideAttrs (old: {
+        postInstall = ''
+          wrapProgram $out/bin/comma \
+            --prefix PATH : ${lib.makeBinPath [ prev.fzy config.programs.nix-index.package ]}
+          ln -s $out/bin/comma $out/bin/,
+        '';
+      });
+    })
+  ];
 }

common/ssh.nix

@@ -2,62 +2,37 @@ rec {
   users = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMVR/R3ZOsv7TZbICGBCHdjh1NDT8SnswUyINeJOC7QG"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0dcqL/FhHmv+a1iz3f9LJ48xubO7MZHy35rW9SZOYM"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO0VFnn3+Mh0nWeN92jov81qNE9fpzTAHYBphNoY7HUx" # reg
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHSkKiRUUmnErOKGx81nyge/9KqjkPh8BfDk0D3oP586" # nat
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeTK1iARlNIKP/DS8/ObBm9yUM/3L1Ub4XI5A2r9OzP" # ray
   ];
   system = {
-    liza = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY/pNyWedEfU7Tq9ikGbriRuF1ZWkHhegGS17L0Vcdl";
     ponyo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBBlTAIp38RhErU1wNNV5MBeb+WGH0mhF/dxh5RsAXN";
     ponyo-unlock = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9LQuuImgWlkjDhEEIbM1wOd+HqRv1RxvYZuLXPSdRi";
     ray = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQM8hwKRgl8cZj7UVYATSLYu4LhG7I0WFJ9m2iWowiB";
+    router = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFr2IHmWFlaLaLp5dGoSmFEYKA/eg2SwGXAogaOmLsHL";
+    router-unlock = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJOw5dTPmtKqiPBH6VKyz5MYBubn8leAh5Eaw7s/O85c";
     s0 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";
-    n1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWlhd1Oid5Xf2zdcBrcdrR0TlhObutwcJ8piobRTpRt";
-    n2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ7bRiRutnI7Bmyt/I238E3Fp5DqiClIXiVibsccipOr";
-    n3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+rJEaRrFDGirQC2UoWQkmpzLg4qgTjGJgVqiipWiU5";
-    n4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINYm2ROIfCeGz6QtDwqAmcj2DX9tq2CZn0eLhskdvB4Z";
-    n5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE5Qhvwq3PiHEKf+2/4w5ZJkSMNzFLhIRrPOR98m7wW4";
-    n6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID/P/pa9+qhKAPfvvd8xSO2komJqDW0M1nCK7ZrP6PO7";
-    n7 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPtOlOvTlMX2mxPaXDJ6VlMe5rmroUXpKmJVNxgV32xL";
+    s0-unlock = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNiceeFMos5ZXcYem4yFxh8PiZNNnuvhlyLbQLrgIZH";
   };
 
+  higherTrustUserKeys = [
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIEaGIwLiUa6wQLlEF+keQOIYy/tCmJvV6eENzUQjSqW2AAAABHNzaDo=" # ray fido
+  ];
+
   # groups
   systems = with system; [
-    liza
     ponyo
     ray
+    router
     s0
-    n1
-    n2
-    n3
-    n4
-    n5
-    n6
-    n7
   ];
   personal = with system; [
     ray
   ];
   servers = with system; [
-    liza
     ponyo
+    router
     s0
-    n1
-    n2
-    n3
-    n4
-    n5
-    n6
-    n7
-  ];
-  compute = with system; [
-    n1
-    n2
-    n3
-    n4
-    n5
-    n6
-    n7
   ];
   storage = with system; [
     s0

flake.lock

@@ -105,6 +105,31 @@
         "type": "github"
       }
     },
+    "deploy-rs": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "utils": [
+          "simple-nixos-mailserver",
+          "utils"
+        ]
+      },
+      "locked": {
+        "lastModified": 1674127017,
+        "narHash": "sha256-QO1xF7stu5ZMDLbHN30LFolMAwY6TVlzYvQoUs1RD68=",
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "rev": "8c9ea9605eed20528bf60fae35a2b613b901fd77",
+        "type": "github"
+      },
+      "original": {
+        "owner": "serokell",
+        "repo": "deploy-rs",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -136,39 +161,38 @@
         "type": "github"
       }
     },
-    "nix-locate": {
+    "nix-index-database": {
       "inputs": {
-        "flake-compat": "flake-compat",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1673969751,
-        "narHash": "sha256-U6aYz3lqZ4NVEGEWiti1i0FyqEo4bUjnTAnA73DPnNU=",
-        "owner": "bennofs",
-        "repo": "nix-index",
-        "rev": "5f98881b1ed27ab6656e6d71b534f88430f6823a",
+        "lastModified": 1677382901,
+        "narHash": "sha256-2idFWlTVG+qUZkU2/W50amGSIxmN56igIkMAXKbv4S4=",
+        "owner": "Mic92",
+        "repo": "nix-index-database",
+        "rev": "4306fa7c12e098360439faac1a2e6b8e509ec97c",
         "type": "github"
       },
       "original": {
-        "owner": "bennofs",
-        "repo": "nix-index",
+        "owner": "Mic92",
+        "repo": "nix-index-database",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1672580127,
-        "narHash": "sha256-3lW3xZslREhJogoOkjeZtlBtvFMyxHku7I/9IVehhT8=",
+        "lastModified": 1677823547,
+        "narHash": "sha256-xD2qco8Pw8HAXgjf9OSi2H2N20WaTrtvgcl21525kVE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "0874168639713f547c05947c76124f78441ea46c",
+        "rev": "78c4d33c16092e535bc4ba1284ba49e3e138483a",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-22.05",
+        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -188,20 +212,16 @@
         "type": "indirect"
       }
     },
-    "nixpkgs-unstable": {
+    "nixpkgs-hostapd-pr": {
+      "flake": false,
       "locked": {
-        "lastModified": 1675835843,
-        "narHash": "sha256-y1dSCQPcof4CWzRYRqDj4qZzbBl+raVPAko5Prdil28=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "32f914af34f126f54b45e482fb2da4ae78f3095f",
-        "type": "github"
+        "narHash": "sha256-1rGQKcB1jeRPc1n021ulyOVkA6L6xmNYKmeqQ94+iRc=",
+        "type": "file",
+        "url": "https://github.com/NixOS/nixpkgs/pull/222536.patch"
       },
       "original": {
-        "owner": "NixOS",
-        "ref": "master",
-        "repo": "nixpkgs",
-        "type": "github"
+        "type": "file",
+        "url": "https://github.com/NixOS/nixpkgs/pull/222536.patch"
       }
     },
     "radio": {
@@ -250,10 +270,11 @@
         "agenix": "agenix",
         "archivebox": "archivebox",
         "dailybuild_modules": "dailybuild_modules",
+        "deploy-rs": "deploy-rs",
         "flake-utils": "flake-utils",
-        "nix-locate": "nix-locate",
+        "nix-index-database": "nix-index-database",
         "nixpkgs": "nixpkgs",
-        "nixpkgs-unstable": "nixpkgs-unstable",
+        "nixpkgs-hostapd-pr": "nixpkgs-hostapd-pr",
         "radio": "radio",
         "radio-web": "radio-web",
         "simple-nixos-mailserver": "simple-nixos-mailserver"

flake.nix

@@ -1,13 +1,11 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.05";
-    nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";
+    nixpkgs.url = "github:NixOS/nixpkgs/master";
+    # nixpkgs-patch-howdy.url = "https://github.com/NixOS/nixpkgs/pull/216245.diff";
+    # nixpkgs-patch-howdy.flake = false;
 
     flake-utils.url = "github:numtide/flake-utils";
 
-    nix-locate.url = "github:bennofs/nix-index";
-    nix-locate.inputs.nixpkgs.follows = "nixpkgs";
-
     # mail server
     simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-22.05";
     simple-nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";
@@ -32,73 +30,110 @@
     archivebox.url = "git+https://git.neet.dev/zuckerberg/archivebox.git";
     archivebox.inputs.nixpkgs.follows = "nixpkgs";
     archivebox.inputs.flake-utils.follows = "flake-utils";
+
+    # nixos config deployment
+    deploy-rs.url = "github:serokell/deploy-rs";
+    deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
+    deploy-rs.inputs.utils.follows = "simple-nixos-mailserver/utils";
+
+    # prebuilt nix-index database
+    nix-index-database.url = "github:Mic92/nix-index-database";
+    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
+
+    nixpkgs-hostapd-pr.url = "https://github.com/NixOS/nixpkgs/pull/222536.patch";
+    nixpkgs-hostapd-pr.flake = false;
   };
 
-  outputs = { self, nixpkgs, nixpkgs-unstable, ... }@inputs: {
+  outputs = { self, nixpkgs, ... }@inputs: {
 
     nixosConfigurations =
-    let
-      modules = system: [
-        ./common
-        inputs.simple-nixos-mailserver.nixosModule
-        inputs.agenix.nixosModules.default
-        inputs.dailybuild_modules.nixosModule
-        inputs.archivebox.nixosModule
-        ({ lib, ... }: {
-          config.environment.systemPackages = [
-            inputs.agenix.packages.${system}.agenix
-          ];
+      let
+        modules = system: with inputs; [
+          ./common
+          simple-nixos-mailserver.nixosModule
+          agenix.nixosModules.default
+          dailybuild_modules.nixosModule
+          archivebox.nixosModule
+          nix-index-database.nixosModules.nix-index
+          ({ lib, ... }: {
+            config.environment.systemPackages = [
+              agenix.packages.${system}.agenix
+            ];
 
-          # because nixos specialArgs doesn't work for containers... need to pass in inputs a different way
-          options.inputs = lib.mkOption { default = inputs; };
-          options.currentSystem = lib.mkOption { default = system; };
-        })
-      ];
+            # because nixos specialArgs doesn't work for containers... need to pass in inputs a different way
+            options.inputs = lib.mkOption { default = inputs; };
+            options.currentSystem = lib.mkOption { default = system; };
+          })
+        ];
 
-      mkSystem = system: nixpkgs: path:
-        let
-          allModules = modules system;
-        in nixpkgs.lib.nixosSystem {
-          inherit system;
-          modules = allModules ++ [path];
+        mkSystem = system: nixpkgs: path:
+          let
+            allModules = modules system;
 
-          specialArgs = {
-            inherit allModules;
+            # allow patching nixpkgs, remove this hack once this is solved: https://github.com/NixOS/nix/issues/3920
+            patchedNixpkgsSrc = nixpkgs.legacyPackages.${system}.applyPatches {
+              name = "nixpkgs-patched";
+              src = nixpkgs;
+              patches = [
+                inputs.nixpkgs-hostapd-pr
+              ];
+            };
+            patchedNixpkgs = nixpkgs.lib.fix (self: (import "${patchedNixpkgsSrc}/flake.nix").outputs { self = nixpkgs; });
+
+          in
+          patchedNixpkgs.lib.nixosSystem {
+            inherit system;
+            modules = allModules ++ [ path ];
+
+            specialArgs = {
+              inherit allModules;
+            };
           };
-        };
-    in
-    {
-      "reg" = mkSystem "x86_64-linux" nixpkgs ./machines/reg/configuration.nix;
-      "ray" = mkSystem "x86_64-linux" nixpkgs-unstable ./machines/ray/configuration.nix;
-      "nat" = mkSystem "aarch64-linux" nixpkgs ./machines/nat/configuration.nix;
-      "liza" = mkSystem "x86_64-linux" nixpkgs ./machines/liza/configuration.nix;
-      "ponyo" = mkSystem "x86_64-linux" nixpkgs ./machines/ponyo/configuration.nix;
-      "s0" = mkSystem "aarch64-linux" nixpkgs-unstable ./machines/storage/s0/configuration.nix;
-      "n1" = mkSystem "aarch64-linux" nixpkgs ./machines/compute/n1/configuration.nix;
-      "n2" = mkSystem "aarch64-linux" nixpkgs ./machines/compute/n2/configuration.nix;
-      "n3" = mkSystem "aarch64-linux" nixpkgs ./machines/compute/n3/configuration.nix;
-      "n4" = mkSystem "aarch64-linux" nixpkgs ./machines/compute/n4/configuration.nix;
-      "n5" = mkSystem "aarch64-linux" nixpkgs ./machines/compute/n5/configuration.nix;
-      "n6" = mkSystem "aarch64-linux" nixpkgs ./machines/compute/n6/configuration.nix;
-      "n7" = mkSystem "aarch64-linux" nixpkgs ./machines/compute/n7/configuration.nix;
-    };
+      in
+      {
+        "ray" = mkSystem "x86_64-linux" nixpkgs ./machines/ray/configuration.nix;
+        # "nat" = mkSystem "aarch64-linux" nixpkgs ./machines/nat/configuration.nix;
+        "ponyo" = mkSystem "x86_64-linux" nixpkgs ./machines/ponyo/configuration.nix;
+        "router" = mkSystem "x86_64-linux" nixpkgs ./machines/router/configuration.nix;
+        "s0" = mkSystem "x86_64-linux" nixpkgs ./machines/storage/s0/configuration.nix;
+      };
 
-    packages = let
-      mkKexec = system:
-        (nixpkgs.lib.nixosSystem {
-          inherit system;
-          modules = [ ./machines/ephemeral/kexec.nix ];
-        }).config.system.build.kexec_tarball;
-      mkIso = system:
-        (nixpkgs.lib.nixosSystem {
-          inherit system;
-          modules = [ ./machines/ephemeral/iso.nix ];
-        }).config.system.build.isoImage;
-    in {
-      "x86_64-linux"."kexec" = mkKexec "x86_64-linux";
-      "x86_64-linux"."iso" = mkIso "x86_64-linux";
-      "aarch64-linux"."kexec" = mkKexec "aarch64-linux";
-      "aarch64-linux"."iso" = mkIso "aarch64-linux";
-    };
+    packages =
+      let
+        mkKexec = system:
+          (nixpkgs.lib.nixosSystem {
+            inherit system;
+            modules = [ ./machines/ephemeral/kexec.nix ];
+          }).config.system.build.kexec_tarball;
+        mkIso = system:
+          (nixpkgs.lib.nixosSystem {
+            inherit system;
+            modules = [ ./machines/ephemeral/iso.nix ];
+          }).config.system.build.isoImage;
+      in
+      {
+        "x86_64-linux"."kexec" = mkKexec "x86_64-linux";
+        "x86_64-linux"."iso" = mkIso "x86_64-linux";
+        "aarch64-linux"."kexec" = mkKexec "aarch64-linux";
+        "aarch64-linux"."iso" = mkIso "aarch64-linux";
+      };
+
+    deploy.nodes =
+      let
+        mkDeploy = configName: hostname: {
+          inherit hostname;
+          magicRollback = false;
+          sshUser = "root";
+          profiles.system.path = inputs.deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.${configName};
+        };
+
+      in
+      {
+        s0 = mkDeploy "s0" "s0";
+        router = mkDeploy "router" "router";
+        ponyo = mkDeploy "ponyo" "ponyo.neet.dev";
+      };
+
+    checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;
   };
 }

machines/compute/common.nix

@@ -1,24 +0,0 @@
-{ config, ... }:
-
-{
-  # NixOS wants to enable GRUB by default
-  boot.loader.grub.enable = false;
-  # Enables the generation of /boot/extlinux/extlinux.conf
-  boot.loader.generic-extlinux-compatible.enable = true;
-
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-label/NIXOS_SD";
-      fsType = "ext4";
-    };
-  };
-
-  system.autoUpgrade.enable = true;
-
-  networking.interfaces.eth0.useDHCP = true;
-
-  hardware.deviceTree.enable = true;
-  hardware.deviceTree.overlays = [
-    ./sopine-baseboard-ethernet.dtbo # fix pine64 clusterboard ethernet
-  ];
-}

machines/compute/n1/configuration.nix

@@ -1,9 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ../common.nix
-  ];
-
-  networking.hostName = "n1";
-}

machines/compute/n2/configuration.nix

@@ -1,9 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ../common.nix
-  ];
-
-  networking.hostName = "n2";
-}

machines/compute/n3/configuration.nix

@@ -1,9 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ../common.nix
-  ];
-
-  networking.hostName = "n3";
-}

machines/compute/n4/configuration.nix

@@ -1,9 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ../common.nix
-  ];
-
-  networking.hostName = "n4";
-}

machines/compute/n5/configuration.nix

@@ -1,9 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ../common.nix
-  ];
-
-  networking.hostName = "n5";
-}

machines/compute/n6/configuration.nix

@@ -1,9 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ../common.nix
-  ];
-
-  networking.hostName = "n6";
-}

machines/compute/n7/configuration.nix

@@ -1,9 +0,0 @@
-{ config, ... }:
-
-{
-  imports = [
-    ../common.nix
-  ];
-
-  networking.hostName = "n7";
-}

machines/compute/sopine-baseboard-ethernet.dts

@@ -1,15 +0,0 @@
-/dts-v1/;
-
-/ {
-	model = "SoPine with baseboard";
-	compatible = "pine64,sopine-baseboard\0pine64,sopine\0allwinner,sun50i-a64";
-
-	fragment@0 {
-/*		target = <&ethernet@1c30000>; */
-		target-path = "/soc/ethernet@1c30000";
-		__overlay__ {
-			allwinner,tx-delay-ps = <500>;
-		};
-	};
-
-};

machines/ephemeral/minimal.nix

@@ -1,18 +1,37 @@
-{ pkgs, ... }:
+{ pkgs, modulesPath, ... }:
 
 {
+  imports = [
+    (modulesPath + "/installer/cd-dvd/channel.nix")
+  ];
+
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "e1000" "e1000e" "virtio_pci" "r8169" ];
   boot.kernelParams = [
-    "panic=30" "boot.panic_on_fail" # reboot the machine upon fatal boot issues
-    "console=ttyS0" # enable serial console
+    "panic=30"
+    "boot.panic_on_fail" # reboot the machine upon fatal boot issues
+    "console=ttyS0,115200" # enable serial console
     "console=tty1"
   ];
   boot.kernel.sysctl."vm.overcommit_memory" = "1";
 
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  # hardware.enableAllFirmware = true;
+  # nixpkgs.config.allowUnfree = true;
+
   environment.systemPackages = with pkgs; [
     cryptsetup
     btrfs-progs
+    git
+    git-lfs
+    wget
+    htop
+    dnsutils
+    pciutils
+    usbutils
+    lm_sensors
   ];
+
   environment.variables.GC_INITIAL_HEAP_SIZE = "1M";
 
   networking.useDHCP = true;
@@ -24,5 +43,5 @@
   };
 
   services.getty.autologinUser = "root";
-  users.users.root.openssh.authorizedKeys.keys = (import ../common/ssh.nix).users;
+  users.users.root.openssh.authorizedKeys.keys = (import ../../common/ssh.nix).users;
 }

machines/liza/configuration.nix

@@ -1,110 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports =[
-    ./hardware-configuration.nix
-  ];
-
-  # 5synsrjgvfzywruomjsfvfwhhlgxqhyofkzeqt2eisyijvjvebnu2xyd.onion
-
-  firmware.x86_64.enable = true;
-  bios = {
-    enable = true;
-    device = "/dev/sda";
-  };
-
-  luks = {
-    enable = true;
-    device.path = "/dev/disk/by-uuid/2f736fba-8a0c-4fb5-8041-c849fb5e1297";
-  };
-
-  system.autoUpgrade.enable = true;
-
-  networking.hostName = "liza";
-
-  networking.interfaces.enp1s0.useDHCP = true;
-
-  mailserver = {
-    enable = true;
-    fqdn = "mail.neet.dev";
-    dkimKeyBits = 2048;
-    indexDir = "/var/lib/mailindex";
-    enableManageSieve = true;
-    fullTextSearch.enable = true;
-    fullTextSearch.indexAttachments = true;
-    fullTextSearch.memoryLimit = 500;
-    domains = [
-      "neet.space" "neet.dev" "neet.cloud"
-      "runyan.org" "runyan.rocks"
-      "thunderhex.com" "tar.ninja"
-      "bsd.ninja" "bsd.rocks"
-    ];
-    loginAccounts = {
-      "jeremy@runyan.org" = {
-        hashedPasswordFile = "/run/agenix/email-pw";
-        aliases = [
-          "@neet.space" "@neet.cloud" "@neet.dev"
-          "@runyan.org" "@runyan.rocks"
-          "@thunderhex.com" "@tar.ninja"
-          "@bsd.ninja" "@bsd.rocks"
-        ];
-      };
-    };
-    rejectRecipients = [
-      "george@runyan.org"
-      "joslyn@runyan.org"
-      "damon@runyan.org"
-      "jonas@runyan.org"
-    ];
-    certificateScheme = 3; # use let's encrypt for certs
-  };
-  age.secrets.email-pw.file = ../../secrets/email-pw.age;
-
-  # sendmail to use xxx@domain instead of xxx@mail.domain
-  services.postfix.origin = "$mydomain";
-
-  # relay sent mail through mailgun
-  # https://www.howtoforge.com/community/threads/different-smtp-relays-for-different-domains-in-postfix.82711/#post-392620
-  services.postfix.config = {
-    smtp_sasl_auth_enable = "yes";
-    smtp_sasl_security_options = "noanonymous";
-    smtp_sasl_password_maps = "hash:/var/lib/postfix/conf/sasl_relay_passwd";
-    smtp_use_tls = "yes";
-    sender_dependent_relayhost_maps = "hash:/var/lib/postfix/conf/sender_relay";
-    smtp_sender_dependent_authentication = "yes";
-  };
-  services.postfix.mapFiles.sender_relay = let
-    relayHost = "[smtp.mailgun.org]:587";
-  in pkgs.writeText "sender_relay" ''
-    @neet.space ${relayHost}
-    @neet.cloud ${relayHost}
-    @neet.dev ${relayHost}
-    @runyan.org ${relayHost}
-    @runyan.rocks ${relayHost}
-    @thunderhex.com ${relayHost}
-    @tar.ninja ${relayHost}
-    @bsd.ninja ${relayHost}
-    @bsd.rocks ${relayHost}
-  '';
-  services.postfix.mapFiles.sasl_relay_passwd = "/run/agenix/sasl_relay_passwd";
-  age.secrets.sasl_relay_passwd.file = ../../secrets/sasl_relay_passwd.age;
-
-  services.nextcloud = {
-    enable = true;
-    https = true;
-    package = pkgs.nextcloud22;
-    hostName = "neet.cloud";
-    config.dbtype = "sqlite";
-    config.adminuser = "jeremy";
-    config.adminpassFile = "/run/agenix/nextcloud-pw";
-    autoUpdateApps.enable = true;
-  };
-  age.secrets.nextcloud-pw = {
-    file = ../../secrets/nextcloud-pw.age;
-    owner = "nextcloud";
-  };
-  services.nginx.virtualHosts.${config.services.nextcloud.hostName} = {
-    enableACME = true;
-    forceSSL = true;
-  };
-}

machines/liza/hardware-configuration.nix

@@ -1,36 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "ata_piix" "virtio_pci" "floppy" "sr_mod" "virtio_blk" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/b90eaf3c-2f91-499a-a066-861e0f4478df";
-      fsType = "btrfs";
-    };
-
-  fileSystems."/home" =
-    { device = "/dev/disk/by-uuid/b90eaf3c-2f91-499a-a066-861e0f4478df";
-      fsType = "btrfs";
-      options = [ "subvol=home" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/2b8f6f6d-9358-4d30-8341-7426574e0819";
-      fsType = "ext3";
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/ef7a83db-4b33-41d1-85fc-cff69e480352"; }
-    ];
-
-}

machines/nat/configuration.nix

@@ -10,8 +10,6 @@
   networking.hostName = "nat";
   networking.interfaces.ens160.useDHCP = true;
 
-  services.zerotierone.enable = true;
-
   de.enable = true;
   de.touchpad.enable = true;
 }

machines/nat/hardware-configuration.nix

@@ -12,12 +12,14 @@
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/02a8c0c7-fd4e-4443-a83c-2d0b63848779";
+    {
+      device = "/dev/disk/by-uuid/02a8c0c7-fd4e-4443-a83c-2d0b63848779";
       fsType = "btrfs";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/0C95-1290";
+    {
+      device = "/dev/disk/by-uuid/0C95-1290";
       fsType = "vfat";
     };
 

machines/ponyo/configuration.nix

@@ -1,33 +1,30 @@
 { config, pkgs, lib, ... }:
 
 {
-  imports =[
+  imports = [
     ./hardware-configuration.nix
   ];
 
   networking.hostName = "ponyo";
 
-  firmware.x86_64.enable = true;
-  bios = {
-    enable = true;
-    device = "/dev/sda";
-  };
-
-  luks = {
-    enable = true;
-    device.path = "/dev/disk/by-uuid/4cc36be4-dbff-4afe-927d-69bf4637bae2";
-  };
-
   system.autoUpgrade.enable = true;
 
-  services.zerotierone.enable = true;
+  # p2p mesh network
+  services.tailscale.exitNode = true;
 
+  # email server
+  mailserver.enable = true;
+
+  # nextcloud
+  services.nextcloud.enable = true;
+
+  # git
   services.gitea = {
     enable = true;
     hostname = "git.neet.dev";
-    disableRegistration = true;
   };
 
+  # IRC
   services.thelounge = {
     enable = true;
     port = 9000;
@@ -39,12 +36,14 @@
     };
   };
 
+  # mumble
   services.murmur = {
     enable = true;
     port = 23563;
     domain = "voice.neet.space";
   };
 
+  # IRC bot
   services.drastikbot = {
     enable = true;
     wolframAppIdFile = "/run/agenix/wolframalpha";
@@ -53,8 +52,11 @@
     file = ../../secrets/wolframalpha.age;
     owner = config.services.drastikbot.user;
   };
+  backup.group."dailybot".paths = [
+    config.services.drastikbot.dataDir
+  ];
 
-  # wrap radio in a VPN
+  # music radio
   vpn-container.enable = true;
   vpn-container.config = {
     services.radio = {
@@ -62,11 +64,7 @@
       host = "radio.runyan.org";
     };
   };
-
-  # tailscale
-  services.tailscale.exitNode = true;
-
-  # icecast endpoint + website
+  pia.wireguard.badPortForwardPorts = [ ];
   services.nginx.virtualHosts."radio.runyan.org" = {
     enableACME = true;
     forceSSL = true;
@@ -81,6 +79,7 @@
     };
   };
 
+  # matrix home server
   services.matrix = {
     enable = true;
     host = "neet.space";
@@ -98,67 +97,36 @@
       secret = "a8369a0e96922abf72494bb888c85831b";
     };
   };
+  # pin postgresql for matrix (will need to migrate eventually)
   services.postgresql.package = pkgs.postgresql_11;
 
-  services.searx = {
-    enable = true;
-    environmentFile = "/run/agenix/searx";
-    settings = {
-      server.port = 43254;
-      server.secret_key = "@SEARX_SECRET_KEY@";
-      engines = [ {
-        name = "wolframalpha";
-        shortcut = "wa";
-        api_key = "@WOLFRAM_API_KEY@";
-        engine = "wolframalpha_api";
-      } ];
-    };
-  };
-  services.nginx.virtualHosts."search.neet.space" = {
-    enableACME = true;
-    forceSSL = true;
-    locations."/" = {
-      proxyPass = "http://localhost:${toString config.services.searx.settings.server.port}";
-    };
-  };
-  age.secrets.searx.file = ../../secrets/searx.age;
-
   # iodine DNS-based vpn
-  services.iodine.server = {
-    enable = true;
-    ip = "192.168.99.1";
-    domain = "tun.neet.dev";
-    passwordFile = "/run/agenix/iodine";
-  };
-  age.secrets.iodine.file = ../../secrets/iodine.age;
-  networking.firewall.allowedUDPPorts = [ 53 ];
-
-  networking.nat.internalInterfaces = [
-    "dns0" # iodine
-  ];
+  services.iodine.server.enable = true;
 
+  # proxied web services
   services.nginx.enable = true;
   services.nginx.virtualHosts."jellyfin.neet.cloud" = {
     enableACME = true;
     forceSSL = true;
     locations."/" = {
-      proxyPass = "http://s0.zt.neet.dev";
+      proxyPass = "http://s0.koi-bebop.ts.net";
       proxyWebsockets = true;
     };
   };
   services.nginx.virtualHosts."navidrome.neet.cloud" = {
     enableACME = true;
     forceSSL = true;
-    locations."/".proxyPass = "http://s0.zt.neet.dev:4533";
+    locations."/".proxyPass = "http://s0.koi-bebop.ts.net:4533";
   };
 
+  # TODO replace with a proper file hosting service
   services.nginx.virtualHosts."tmp.neet.dev" = {
     enableACME = true;
     forceSSL = true;
     root = "/var/www/tmp";
   };
 
-  # redirect to github
+  # redirect runyan.org to github
   services.nginx.virtualHosts."runyan.org" = {
     enableACME = true;
     forceSSL = true;
@@ -167,6 +135,7 @@
     '';
   };
 
+  # owncast live streaming
   services.owncast.enable = true;
   services.owncast.hostname = "live.neet.dev";
 }

machines/ponyo/hardware-configuration.nix

@@ -2,7 +2,8 @@
 
 {
   imports =
-    [ (modulesPath + "/profiles/qemu-guest.nix")
+    [
+      (modulesPath + "/profiles/qemu-guest.nix")
     ];
 
   boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
@@ -10,13 +11,26 @@
   boot.kernelModules = [ "kvm-intel" "nvme" ];
   boot.extraModulePackages = [ ];
 
+  firmware.x86_64.enable = true;
+
+  bios = {
+    enable = true;
+    device = "/dev/sda";
+  };
+
+  remoteLuksUnlock.enable = true;
+  boot.initrd.luks.devices."enc-pv".device = "/dev/disk/by-uuid/4cc36be4-dbff-4afe-927d-69bf4637bae2";
+  boot.initrd.luks.devices."enc-pv2".device = "/dev/disk/by-uuid/e52b01b3-81c8-4bb2-ae7e-a3d9c793cb00"; # expanded disk
+
   fileSystems."/" =
-    { device = "/dev/mapper/enc-pv";
+    {
+      device = "/dev/mapper/enc-pv";
       fsType = "btrfs";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/d3a3777d-1e70-47fa-a274-804dc70ee7fd";
+    {
+      device = "/dev/disk/by-uuid/d3a3777d-1e70-47fa-a274-804dc70ee7fd";
       fsType = "ext4";
     };
 
@@ -27,11 +41,5 @@
     }
   ];
 
-  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
-  # Per-interface useDHCP will be mandatory in the future, so this generated config
-  # replicates the default behaviour.
-  networking.useDHCP = lib.mkDefault false;
-  networking.interfaces.eth0.useDHCP = lib.mkDefault true;
-
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  networking.interfaces.eth0.useDHCP = true;
 }

machines/ray/configuration.nix

@@ -5,37 +5,24 @@
     ./hardware-configuration.nix
   ];
 
-  firmware.x86_64.enable = true;
-  efi.enable = true;
-
-  boot.initrd.luks.devices."enc-pv" = {
-    device = "/dev/disk/by-uuid/c1822e5f-4137-44e1-885f-954e926583ce";
-    allowDiscards = true;
-  };
-
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
   networking.hostName = "ray";
 
-  hardware.enableAllFirmware = true;
+  # for luks onlock over tor
+  services.tor.enable = true;
+  services.tor.client.enable = true;
+
+  # services.howdy.enable = true;
+
+  hardware.openrazer.enable = true;
+  hardware.openrazer.users = [ "googlebot" ];
+  hardware.openrazer.devicesOffOnScreensaver = false;
+  users.users.googlebot.packages = [ pkgs.polychromatic ];
 
   # depthai
   services.udev.extraRules = ''
     SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
   '';
 
-  # gpu
-  services.xserver.videoDrivers = [ "nvidia" ];
-  hardware.nvidia = {
-    modesetting.enable = true; # for nvidia-vaapi-driver
-    prime = {
-      reverseSync.enable = true;
-      offload.enableOffloadCmd = true;
-      nvidiaBusId = "PCI:1:0:0";
-      amdgpuBusId = "PCI:4:0:0";
-    };
-  };
-
   # virt-manager
   virtualisation.libvirtd.enable = true;
   programs.dconf.enable = true;
@@ -43,75 +30,13 @@
   environment.systemPackages = with pkgs; [ virt-manager ];
   users.users.googlebot.extraGroups = [ "libvirtd" ];
 
-  # vpn-container.enable = true;
-  # containers.vpn.interfaces = [ "piaw" ];
+  # allow building ARM derivations
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
-  # allow traffic for wireguard interface to pass
-  # networking.firewall = {
-  #   # wireguard trips rpfilter up
-  #   extraCommands = ''
-  #     ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN
-  #     ip46tables -t raw -I nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN
-  #   '';
-  #   extraStopCommands = ''
-  #     ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --sport 51820 -j RETURN || true
-  #     ip46tables -t raw -D nixos-fw-rpfilter -p udp -m udp --dport 51820 -j RETURN || true
-  #   '';
-  # };
-
-  # systemd.services.pia-vpn-wireguard = {
-  #   enable = true;
-  #   description = "PIA VPN WireGuard Tunnel";
-  #   requires = [ "network-online.target" ];
-  #   after = [ "network.target" "network-online.target" ];
-  #   wantedBy = [ "multi-user.target" ];
-  #   environment.DEVICE = "piaw";
-  #   path = with pkgs; [ kmod wireguard-tools jq curl ];
-
-  #   serviceConfig = {
-  #     Type = "oneshot";
-  #     RemainAfterExit = true;
-  #   };
-
-  #   script = ''
-  #     WG_HOSTNAME=zurich406
-  #     WG_SERVER_IP=156.146.62.153
-
-  #     PIA_USER=`sed '1q;d' /run/agenix/pia-login.conf`
-  #     PIA_PASS=`sed '2q;d' /run/agenix/pia-login.conf`
-  #     PIA_TOKEN=`curl -s -u "$PIA_USER:$PIA_PASS" https://www.privateinternetaccess.com/gtoken/generateToken | jq -r '.token'`
-  #     privKey=$(wg genkey)
-  #     pubKey=$(echo "$privKey" | wg pubkey)
-  #     wireguard_json=`curl -s -G --connect-to "$WG_HOSTNAME::$WG_SERVER_IP:" --cacert "${./ca.rsa.4096.crt}" --data-urlencode "pt=$PIA_TOKEN" --data-urlencode "pubkey=$pubKey" https://$WG_HOSTNAME:1337/addKey`
-
-  #     echo "               
-  #     [Interface]
-  #     Address = $(echo "$wireguard_json" | jq -r '.peer_ip')
-  #     PrivateKey = $privKey
-  #     ListenPort = 51820
-  #     [Peer]
-  #     PersistentKeepalive = 25
-  #     PublicKey = $(echo "$wireguard_json" | jq -r '.server_key')
-  #     AllowedIPs = 0.0.0.0/0
-  #     Endpoint = $WG_SERVER_IP:$(echo "$wireguard_json" | jq -r '.server_port')
-  #     " > /tmp/piaw.conf
-
-  #     # TODO make /tmp/piaw.conf ro to root
-
-  #     ${lib.optionalString (!config.boot.isContainer) "modprobe wireguard"}
-  #     wg-quick up /tmp/piaw.conf
-  #   '';
-
-  #   preStop = ''
-  #     wg-quick down /tmp/piaw.conf
-  #   '';
-  # };
-  # age.secrets."pia-login.conf".file = ../../secrets/pia-login.conf;
+  services.spotifyd.enable = true;
 
   virtualisation.docker.enable = true;
 
-  services.zerotierone.enable = true;
-
   services.mount-samba.enable = true;
 
   de.enable = true;

machines/ray/hardware-configuration.nix

@@ -5,36 +5,60 @@
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
+  # boot
+  efi.enable = true;
   boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "usbhid" "usb_storage" "sd_mod" ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
+
+  # kernel
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
+  # firmware
+  firmware.x86_64.enable = true;
+  hardware.enableAllFirmware = true;
+
+  # gpu
+  services.xserver.videoDrivers = [ "nvidia" ];
+  hardware.nvidia = {
+    modesetting.enable = true; # for nvidia-vaapi-driver
+    prime = {
+      reverseSync.enable = true;
+      offload.enableOffloadCmd = true;
+      nvidiaBusId = "PCI:1:0:0";
+      amdgpuBusId = "PCI:4:0:0";
+    };
+  };
+
+  # disks
+  remoteLuksUnlock.enable = true;
+  boot.initrd.luks.devices."enc-pv" = {
+    device = "/dev/disk/by-uuid/c1822e5f-4137-44e1-885f-954e926583ce";
+    allowDiscards = true;
+  };
   fileSystems."/" =
-    { device = "/dev/vg/root";
+    {
+      device = "/dev/vg/root";
       fsType = "btrfs";
       options = [ "subvol=root" ];
     };
-
   fileSystems."/home" =
-    { device = "/dev/vg/root";
+    {
+      device = "/dev/vg/root";
       fsType = "btrfs";
       options = [ "subvol=home" ];
     };
-
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/2C85-2B59";
+    {
+      device = "/dev/disk/by-uuid/2C85-2B59";
       fsType = "vfat";
     };
-
   swapDevices =
-    [ { device = "/dev/vg/swap"; }
-    ];
-
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+    [{ device = "/dev/vg/swap"; }];
 
   # high-resolution display
   hardware.video.hidpi.enable = lib.mkDefault true;

machines/reg/configuration.nix

@@ -1,35 +0,0 @@
-{ config, pkgs, fetchurl, ... }:
-
-{
-  imports = [
-    ./hardware-configuration.nix
-  ];
-
-  # smcxui7kwoyxpswwage4fkcppxnqzpw33xcmxmlhxvk5gcp5s6lrtfad.onion
-
-  boot.kernelPackages = pkgs.linuxPackages_5_12;
-
-  firmware.x86_64.enable = true;
-  efi.enable = true;
-
-  luks = {
-    enable = true;
-    device = {
-      path = "/dev/disk/by-uuid/975d8427-2c6a-440d-a1d2-18dd15ba5bc2";
-      allowDiscards = true;
-    };
-  };
-
-  networking.hostName = "reg";
-
-  de.enable = true;
-  de.touchpad.enable = true;
-
-  services.zerotierone.enable = true;
-
-  # VNC
-  networking.firewall.allowedTCPPorts = [ 5900 ];
-
-  networking.interfaces.enp57s0f1.useDHCP = true;
-}
-

machines/reg/hardware-configuration.nix

@@ -1,38 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
-  boot.initrd.kernelModules = [ "dm-snapshot" ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/b3a2906b-e9a5-45bd-aac5-960297437fe9";
-      fsType = "btrfs";
-      options = [ "subvol=root" "noatime" "nodiratime" "discard" ];
-    };
-
-  fileSystems."/home" =
-    { device = "/dev/disk/by-uuid/b3a2906b-e9a5-45bd-aac5-960297437fe9";
-      fsType = "btrfs";
-      options = [ "subvol=home" "noatime" "nodiratime" "discard" ];
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/6C41-24A0";
-      fsType = "vfat";
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/34ec322f-79c3-4993-a073-ef1da3c6ef51"; }
-    ];
-
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-}

machines/router/configuration.nix

@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./router.nix
+  ];
+
+  # https://dataswamp.org/~solene/2022-08-03-nixos-with-live-usb-router.html
+  # https://github.com/mdlayher/homelab/blob/391cfc0de06434e4dee0abe2bec7a2f0637345ac/nixos/routnerr-2/configuration.nix
+  # https://github.com/skogsbrus/os/blob/master/sys/router.nix
+  # http://trac.gateworks.com/wiki/wireless/wifi 
+
+  networking.hostName = "router";
+
+  system.autoUpgrade.enable = true;
+
+  services.tailscale.exitNode = true;
+
+  router.enable = true;
+  router.privateSubnet = "192.168.3";
+
+  services.iperf3.enable = true;
+
+  # networking.useDHCP = lib.mkForce true;
+
+  # TODO
+  # networking.usePredictableInterfaceNames = true;
+
+  powerManagement.cpuFreqGovernor = "ondemand";
+
+
+  services.irqbalance.enable = true;
+
+  #   services.miniupnpd = {
+  #     enable = true;
+  #     externalInterface = "eth0";
+  #     internalIPs = [ "br0" ];
+  # };
+}

machines/router/generate_hostapd_config.sh

@@ -0,0 +1,223 @@
+#!/bin/sh
+
+# TODO allow adding custom parameters to ht_capab, vht_capab
+# TODO detect bad channel numbers (preferably not at runtime)
+# TODO error if 160mhz is not supported
+# TODO 'b' only goes up to 40mhz
+
+# gets the phy number using the input interface
+# Ex: get_phy_number("wlan0") -> "1"
+get_phy_number() {
+  local interface=$1
+  phy=$(iw dev "$interface" info | awk '/phy/ {gsub(/#/,"");print $2}')
+  if [[ -z "$phy" ]]; then
+    echo "Error: interface not found" >&2
+    exit 1
+  fi
+  phy=phy$phy
+}
+
+get_ht_cap_mask() {
+  ht_cap_mask=0
+
+  for cap in $(iw phy "$phy" info | grep 'Capabilities:' | cut -d: -f2); do
+    ht_cap_mask="$(($ht_cap_mask | $cap))"
+  done
+
+  local cap_rx_stbc
+  cap_rx_stbc=$((($ht_cap_mask >> 8) & 3))
+  ht_cap_mask="$(( ($ht_cap_mask & ~(0x300)) | ($cap_rx_stbc << 8) ))"
+}
+
+get_vht_cap_mask() {
+  vht_cap_mask=0
+  for cap in $(iw phy "$phy" info | awk -F "[()]" '/VHT Capabilities/ { print $2 }'); do
+    vht_cap_mask="$(($vht_cap_mask | $cap))"
+  done
+
+  local cap_rx_stbc
+  cap_rx_stbc=$((($vht_cap_mask >> 8) & 7))
+  vht_cap_mask="$(( ($vht_cap_mask & ~(0x700)) | ($cap_rx_stbc << 8) ))"
+}
+
+mac80211_add_capabilities() {
+  local __var="$1"; shift
+  local __mask="$1"; shift
+  local __out= oifs
+
+  oifs="$IFS"
+  IFS=:
+  for capab in "$@"; do
+    set -- $capab
+    [ "$(($4))" -gt 0 ] || continue
+    [ "$(($__mask & $2))" -eq "$((${3:-$2}))" ] || continue
+    __out="$__out[$1]"
+  done
+  IFS="$oifs"
+
+  export -n -- "$__var=$__out"
+}
+
+add_special_ht_capabilities() {
+  case "$hwmode" in
+    a)
+      case "$(( ($channel / 4) % 2 ))" in
+        1) ht_capab="$ht_capab[HT40+]";;
+        0) ht_capab="$ht_capab[HT40-]";;
+      esac
+    ;;
+    *)
+      if [ "$channel" -lt 7 ]; then
+        ht_capab="$ht_capab[HT40+]"
+      else
+        ht_capab="$ht_capab[HT40-]"
+      fi
+    ;;
+  esac
+}
+
+add_special_vht_capabilities() {
+  local cap_ant
+  [ "$(($vht_cap_mask & 0x800))" -gt 0 ] && {
+    cap_ant="$(( ( ($vht_cap_mask >> 16) & 3 ) + 1 ))"
+    [ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[SOUNDING-DIMENSION-$cap_ant]"
+  }
+
+  [ "$(($vht_cap_mask & 0x1000))" -gt 0 ] && {
+    cap_ant="$(( ( ($vht_cap_mask >> 13) & 3 ) + 1 ))"
+    [ "$cap_ant" -gt 1 ] && vht_capab="$vht_capab[BF-ANTENNA-$cap_ant]"
+  }
+
+  if [ "$(($vht_cap_mask & 12))" -eq 4 ]; then
+    vht_capab="$vht_capab[VHT160]"
+  fi
+
+  local vht_max_mpdu_hw=3895
+  [ "$(($vht_cap_mask & 3))" -ge 1 ] && \
+    vht_max_mpdu_hw=7991
+  [ "$(($vht_cap_mask & 3))" -ge 2 ] && \
+    vht_max_mpdu_hw=11454
+  [ "$vht_max_mpdu_hw" != 3895 ] && \
+    vht_capab="$vht_capab[MAX-MPDU-$vht_max_mpdu_hw]"
+
+  # maximum A-MPDU length exponent
+  local vht_max_a_mpdu_len_exp_hw=0
+  [ "$(($vht_cap_mask & 58720256))" -ge 8388608 ] && \
+    vht_max_a_mpdu_len_exp_hw=1
+  [ "$(($vht_cap_mask & 58720256))" -ge 16777216 ] && \
+    vht_max_a_mpdu_len_exp_hw=2
+  [ "$(($vht_cap_mask & 58720256))" -ge 25165824 ] && \
+    vht_max_a_mpdu_len_exp_hw=3
+  [ "$(($vht_cap_mask & 58720256))" -ge 33554432 ] && \
+    vht_max_a_mpdu_len_exp_hw=4
+  [ "$(($vht_cap_mask & 58720256))" -ge 41943040 ] && \
+    vht_max_a_mpdu_len_exp_hw=5
+  [ "$(($vht_cap_mask & 58720256))" -ge 50331648 ] && \
+    vht_max_a_mpdu_len_exp_hw=6
+  [ "$(($vht_cap_mask & 58720256))" -ge 58720256 ] && \
+    vht_max_a_mpdu_len_exp_hw=7
+  vht_capab="$vht_capab[MAX-A-MPDU-LEN-EXP$vht_max_a_mpdu_len_exp_hw]"
+
+  local vht_link_adapt_hw=0
+  [ "$(($vht_cap_mask & 201326592))" -ge 134217728 ] && \
+    vht_link_adapt_hw=2
+  [ "$(($vht_cap_mask & 201326592))" -ge 201326592 ] && \
+    vht_link_adapt_hw=3
+  [ "$vht_link_adapt_hw" != 0 ] && \
+    vht_capab="$vht_capab[VHT-LINK-ADAPT-$vht_link_adapt_hw]"
+}
+
+calculate_channel_offsets() {
+  vht_oper_chwidth=0
+  vht_oper_centr_freq_seg0_idx=
+
+  local idx="$channel"
+  case "$channelWidth" in
+    40)
+      case "$(( ($channel / 4) % 2 ))" in
+        1) idx=$(($channel + 2));;
+        0) idx=$(($channel - 2));;
+      esac
+      vht_oper_centr_freq_seg0_idx=$idx
+    ;;
+    80)
+      case "$(( ($channel / 4) % 4 ))" in
+        1) idx=$(($channel + 6));;
+        2) idx=$(($channel + 2));;
+        3) idx=$(($channel - 2));;
+        0) idx=$(($channel - 6));;
+      esac
+      vht_oper_chwidth=1
+      vht_oper_centr_freq_seg0_idx=$idx
+    ;;
+    160)
+      case "$channel" in
+        36|40|44|48|52|56|60|64) idx=50;;
+        100|104|108|112|116|120|124|128) idx=114;;
+      esac
+      vht_oper_chwidth=2
+      vht_oper_centr_freq_seg0_idx=$idx
+    ;;
+  esac
+
+  he_oper_chwidth=$vht_oper_chwidth
+  he_oper_centr_freq_seg0_idx=$vht_oper_centr_freq_seg0_idx
+}
+
+interface=$1
+channel=$2
+hwmode=$3
+channelWidth=$4
+
+get_phy_number $interface
+get_ht_cap_mask
+get_vht_cap_mask
+
+mac80211_add_capabilities vht_capab $vht_cap_mask \
+  RXLDPC:0x10::1 \
+  SHORT-GI-80:0x20::1 \
+  SHORT-GI-160:0x40::1 \
+  TX-STBC-2BY1:0x80::1 \
+  SU-BEAMFORMER:0x800::1 \
+  SU-BEAMFORMEE:0x1000::1 \
+  MU-BEAMFORMER:0x80000::1 \
+  MU-BEAMFORMEE:0x100000::1 \
+  VHT-TXOP-PS:0x200000::1 \
+  HTC-VHT:0x400000::1 \
+  RX-ANTENNA-PATTERN:0x10000000::1 \
+  TX-ANTENNA-PATTERN:0x20000000::1 \
+  RX-STBC-1:0x700:0x100:1 \
+  RX-STBC-12:0x700:0x200:1 \
+  RX-STBC-123:0x700:0x300:1 \
+  RX-STBC-1234:0x700:0x400:1 \
+
+mac80211_add_capabilities ht_capab $ht_cap_mask \
+  LDPC:0x1::1 \
+  GF:0x10::1 \
+  SHORT-GI-20:0x20::1 \
+  SHORT-GI-40:0x40::1 \
+  TX-STBC:0x80::1 \
+  RX-STBC1:0x300::1 \
+  MAX-AMSDU-7935:0x800::1 \
+
+  # TODO this is active when the driver doesn't support it?
+  # DSSS_CCK-40:0x1000::1 \
+
+  # TODO these are active when the driver doesn't support them?
+  # RX-STBC1:0x300:0x100:1 \
+  # RX-STBC12:0x300:0x200:1 \
+  # RX-STBC123:0x300:0x300:1 \
+
+add_special_ht_capabilities
+add_special_vht_capabilities
+
+echo ht_capab=$ht_capab
+echo vht_capab=$vht_capab
+
+if [ "$channelWidth" != "20" ]; then
+  calculate_channel_offsets
+  echo he_oper_chwidth=$he_oper_chwidth
+  echo vht_oper_chwidth=$vht_oper_chwidth
+  echo he_oper_centr_freq_seg0_idx=$he_oper_centr_freq_seg0_idx
+  echo vht_oper_centr_freq_seg0_idx=$vht_oper_centr_freq_seg0_idx
+fi

machines/router/hardware-configuration.nix

@@ -0,0 +1,50 @@
+{ config, pkgs, ... }:
+
+{
+  # kernel
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.initrd.availableKernelModules = [ "igb" "mt7915e" "xhci_pci" "ahci" "ehci_pci" "usb_storage" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ "dm-snapshot" ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  # Enable serial output
+  boot.kernelParams = [
+    "panic=30"
+    "boot.panic_on_fail" # reboot the machine upon fatal boot issues
+    "console=ttyS0,115200n8" # enable serial console
+  ];
+  boot.loader.grub.extraConfig = "
+    serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
+    terminal_input serial
+    terminal_output serial
+  ";
+
+  # firmware
+  firmware.x86_64.enable = true;
+  nixpkgs.config.allowUnfree = true;
+
+  # boot
+  bios = {
+    enable = true;
+    device = "/dev/sda";
+  };
+
+  # disks
+  remoteLuksUnlock.enable = true;
+  boot.initrd.luks.devices."enc-pv".device = "/dev/disk/by-uuid/9b090551-f78e-45ca-8570-196ed6a4af0c";
+  fileSystems."/" =
+    {
+      device = "/dev/disk/by-uuid/421c82b9-d67c-4811-8824-8bb57cb10fce";
+      fsType = "btrfs";
+    };
+  fileSystems."/boot" =
+    {
+      device = "/dev/disk/by-uuid/d97f324f-3a2e-4b84-ae2a-4b3d1209c689";
+      fsType = "ext3";
+    };
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/45bf58dd-67eb-45e4-9a98-246e23fa7abd"; }];
+
+  nixpkgs.hostPlatform = "x86_64-linux";
+}

machines/router/router.nix

@@ -0,0 +1,205 @@
+{ config, pkgs, lib, ... }:
+
+let
+  cfg = config.router;
+  inherit (lib) mapAttrs' genAttrs nameValuePair mkOption types mkIf mkEnableOption;
+in
+{
+  options.router = {
+    enable = mkEnableOption "router";
+
+    privateSubnet = mkOption {
+      type = types.str;
+      default = "192.168.1";
+      description = "IP block (/24) to use for the private subnet";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.ip_forward = true;
+
+    networking.interfaces.enp1s0.useDHCP = true;
+
+    networking.nat = {
+      enable = true;
+      internalInterfaces = [
+        "br0"
+      ];
+      externalInterface = "enp1s0";
+    };
+
+    networking.bridges = {
+      br0 = {
+        interfaces = [
+          "enp2s0"
+          "wlp4s0"
+          "wlan1"
+        ];
+      };
+    };
+
+    networking.interfaces = {
+      br0 = {
+        useDHCP = false;
+        ipv4.addresses = [
+          {
+            address = "${cfg.privateSubnet}.1";
+            prefixLength = 24;
+          }
+        ];
+      };
+    };
+
+    networking.firewall = {
+      enable = true;
+      trustedInterfaces = [ "br0" "tailscale0" ];
+
+      interfaces = {
+        enp1s0 = {
+          allowedTCPPorts = [ ];
+          allowedUDPPorts = [ ];
+        };
+      };
+    };
+
+    services.dnsmasq = {
+      enable = true;
+      extraConfig = ''
+        # sensible behaviours
+        domain-needed
+        bogus-priv
+        no-resolv
+
+        # upstream name servers
+        server=1.1.1.1
+        server=8.8.8.8
+
+        # local domains
+        expand-hosts
+        domain=home
+        local=/home/
+
+        # Interfaces to use DNS on
+        interface=br0
+
+        # subnet IP blocks to use DHCP on
+        dhcp-range=${cfg.privateSubnet}.10,${cfg.privateSubnet}.254,24h
+      '';
+    };
+
+    services.hostapd = {
+      enable = true;
+      radios = {
+        # 2.4GHz
+        wlp4s0 = {
+          hwMode = "g";
+          noScan = true;
+          channel = 6;
+          countryCode = "US";
+          wifi4 = {
+            capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40+" ];
+          };
+          wifi5 = {
+            operatingChannelWidth = "20or40";
+            capabilities = [ "MAX-A-MPDU-LEN-EXP0" ];
+          };
+          wifi6 = {
+            enable = true;
+            singleUserBeamformer = true;
+            singleUserBeamformee = true;
+            multiUserBeamformer = true;
+            operatingChannelWidth = "20or40";
+          };
+          networks = {
+            wlp4s0 = {
+              ssid = "CXNK00BF9176";
+              authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
+            };
+            # wlp4s0-1 = {
+            #   ssid = "- Experimental 5G Tower by AT&T";
+            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+            # };
+            # wlp4s0-2 = {
+            #   ssid = "FBI Surveillance Van 2";
+            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+            # };
+          };
+          extraConfig = ''
+            he_oper_centr_freq_seg0_idx=8
+            vht_oper_centr_freq_seg0_idx=8
+          '';
+        };
+
+        # 5GHz
+        wlan1 = {
+          hwMode = "a";
+          noScan = true;
+          channel = 128;
+          countryCode = "US";
+          wifi4 = {
+            capabilities = [ "LDPC" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1" "MAX-AMSDU-7935" "HT40-" ];
+          };
+          wifi5 = {
+            operatingChannelWidth = "160";
+            capabilities = [ "RXLDPC" "SHORT-GI-80" "SHORT-GI-160" "TX-STBC-2BY1" "SU-BEAMFORMER" "SU-BEAMFORMEE" "MU-BEAMFORMER" "MU-BEAMFORMEE" "RX-ANTENNA-PATTERN" "TX-ANTENNA-PATTERN" "RX-STBC-1" "SOUNDING-DIMENSION-3" "BF-ANTENNA-3" "VHT160" "MAX-MPDU-11454" "MAX-A-MPDU-LEN-EXP7" ];
+          };
+          wifi6 = {
+            enable = true;
+            singleUserBeamformer = true;
+            singleUserBeamformee = true;
+            multiUserBeamformer = true;
+            operatingChannelWidth = "160";
+          };
+          networks = {
+            wlan1 = {
+              ssid = "CXNK00BF9176";
+              authentication.saePasswordsFile = "/run/agenix/hostapd-pw-CXNK00BF9176";
+            };
+            # wlan1-1 = {
+            #   ssid = "- Experimental 5G Tower by AT&T";
+            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+            # };
+            # wlan1-2 = {
+            #   ssid = "FBI Surveillance Van 5";
+            #   authentication.saePasswordsFile = "/run/agenix/hostapd-pw-experimental-tower";
+            # };
+          };
+          extraConfig = ''
+            vht_oper_centr_freq_seg0_idx=114
+            he_oper_centr_freq_seg0_idx=114
+          '';
+        };
+      };
+    };
+    age.secrets.hostapd-pw-experimental-tower.file = ../../secrets/hostapd-pw-experimental-tower.age;
+    age.secrets.hostapd-pw-CXNK00BF9176.file = ../../secrets/hostapd-pw-CXNK00BF9176.age;
+
+    hardware.firmware = [
+      pkgs.mt7916-firmware
+    ];
+
+    nixpkgs.overlays = [
+      (self: super: {
+        mt7916-firmware = pkgs.stdenvNoCC.mkDerivation {
+          pname = "mt7916-firmware";
+          version = "custom-feb-02-23";
+          src = ./firmware/mediatek; # from here https://github.com/openwrt/mt76/issues/720#issuecomment-1413537674
+          dontBuild = true;
+          installPhase = ''
+            for i in \
+              mt7916_eeprom.bin \
+              mt7916_rom_patch.bin \
+              mt7916_wa.bin \
+              mt7916_wm.bin;
+            do
+              install -D -pm644 $i $out/lib/firmware/mediatek/$i
+            done
+          '';
+          meta = with lib; {
+            license = licenses.unfreeRedistributableFirmware;
+          };
+        };
+      })
+    ];
+  };
+}

machines/storage/s0/configuration.nix

@@ -1,51 +1,49 @@
 { config, pkgs, lib, ... }:
 
 {
-  imports =[
-    ./helios64
+  imports = [
     ./hardware-configuration.nix
   ];
 
-  # nsw2zwifzyl42mbhabayjo42b2kkq3wd3dqyl6efxsz6pvmgm5cup5ad.onion
-
   networking.hostName = "s0";
 
-  boot.loader.grub.enable = false;
-  boot.loader.generic-extlinux-compatible.enable = true;
-
   system.autoUpgrade.enable = true;
 
-  boot.supportedFilesystems = [ "bcachefs" ];
+  services.iperf3.enable = true;
+  services.iperf3.openFirewall = true;
 
-  services.zerotierone.enable = true;
+  # p2p mesh network
+  services.tailscale.exitNode = true;
 
   # for education purposes only
   services.pykms.enable = true;
   services.pykms.openFirewallPort = true;
 
-  users.users.googlebot.packages = with pkgs; [
-    bcachefs-tools
-  ];
-
+  # samba
   services.samba.enable = true;
 
+  # disable suspend on lid close
+  services.logind.lidSwitch = "ignore";
+
+  # navidrome
   services.navidrome = {
     enable = true;
     settings = {
       Address = "0.0.0.0";
       Port = 4533;
-      MusicFolder = "/data/samba/Public/Plex/Music";
+      MusicFolder = "/data/samba/Public/Media/Music";
     };
   };
   networking.firewall.allowedTCPPorts = [ config.services.navidrome.settings.Port ];
 
+  # allow access to transmisson data
   users.users.googlebot.extraGroups = [ "transmission" ];
   users.groups.transmission.gid = config.ids.gids.transmission;
 
   vpn-container.enable = true;
   vpn-container.mounts = [
     "/var/lib"
-    "/data/samba/Public/Plex"
+    "/data/samba/Public"
   ];
   vpn-container.config = {
     # servarr services
@@ -63,9 +61,6 @@
     services.lidarr.user = "public_data";
     services.lidarr.group = "public_data";
 
-    services.jellyfin.enable = true;
-    users.users.${config.services.jellyfin.user}.extraGroups = [ "public_data" ];
-
     services.transmission = {
       enable = true;
       performanceNetParameters = true;
@@ -75,7 +70,7 @@
         /* directory settings */
         # "watch-dir" = "/srv/storage/Transmission/To-Download";
         # "watch-dir-enabled" = true;
-        "download-dir" = "/data/samba/Public/Plex/Transmission";
+        "download-dir" = "/data/samba/Public/Media/Transmission";
         "incomplete-dir" = "/var/lib/transmission/.incomplete";
         "incomplete-dir-enabled" = true;
 
@@ -121,10 +116,35 @@
       uid = 994;
     };
   };
+  pia.wireguard.badPortForwardPorts = [
+    9696 # prowlarr
+    8989 # sonarr
+    6767 # bazarr
+    7878 # radarr
+    8686 # lidarr
+    9091 # transmission web
+  ];
 
-  # unpackerr
-  # flaresolverr
+  # jellyfin
+  # jellyfin cannot run in the vpn container and use hardware encoding
+  # I could not figure out how to allow the container to access the encoder
+  services.jellyfin.enable = true;
+  users.users.${config.services.jellyfin.user}.extraGroups = [ "public_data" ];
+  nixpkgs.config.packageOverrides = pkgs: {
+    vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
+  };
+  hardware.opengl = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver
+      vaapiIntel
+      vaapiVdpau
+      libvdpau-va-gl
+      intel-compute-runtime # OpenCL filter support (hardware tonemapping and subtitle burn-in)
+    ];
+  };
 
+  # nginx
   services.nginx.enable = true;
   services.nginx.virtualHosts."bazarr.s0".locations."/".proxyPass = "http://vpn.containers:6767";
   services.nginx.virtualHosts."radarr.s0".locations."/".proxyPass = "http://vpn.containers:7878";
@@ -133,57 +153,15 @@
   services.nginx.virtualHosts."prowlarr.s0".locations."/".proxyPass = "http://vpn.containers:9696";
   services.nginx.virtualHosts."music.s0".locations."/".proxyPass = "http://localhost:4533";
   services.nginx.virtualHosts."jellyfin.s0".locations."/" = {
-    proxyPass = "http://vpn.containers:8096";
+    proxyPass = "http://localhost:8096";
     proxyWebsockets = true;
   };
   services.nginx.virtualHosts."jellyfin.neet.cloud".locations."/" = {
-    proxyPass = "http://vpn.containers:8096";
+    proxyPass = "http://localhost:8096";
     proxyWebsockets = true;
   };
   services.nginx.virtualHosts."transmission.s0".locations."/" = {
     proxyPass = "http://vpn.containers:9091";
     proxyWebsockets = true;
   };
-
-  # tailscale
-  services.tailscale.exitNode = true;
-
-  nixpkgs.overlays = [
-    (final: prev: {
-      radarr = prev.radarr.overrideAttrs (old: rec {
-        installPhase = ''
-          runHook preInstall
-          mkdir -p $out/{bin,share/${old.pname}-${old.version}}
-          cp -r * $out/share/${old.pname}-${old.version}/.
-          makeWrapper "${final.dotnet-runtime}/bin/dotnet" $out/bin/Radarr \
-            --add-flags "$out/share/${old.pname}-${old.version}/Radarr.dll" \
-            --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
-              final.curl final.sqlite final.libmediainfo final.mono final.openssl final.icu final.zlib ]}
-          runHook postInstall
-        '';
-      });
-
-      prowlarr = prev.prowlarr.overrideAttrs (old: {
-        installPhase = ''
-          runHook preInstall
-          mkdir -p $out/{bin,share/${old.pname}-${old.version}}
-          cp -r * $out/share/${old.pname}-${old.version}/.
-          makeWrapper "${final.dotnet-runtime}/bin/dotnet" $out/bin/Prowlarr \
-            --add-flags "$out/share/${old.pname}-${old.version}/Prowlarr.dll" \
-            --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [
-              final.curl final.sqlite final.libmediainfo final.mono final.openssl final.icu final.zlib ]}
-          runHook postInstall
-        '';
-      });
-
-      pykms = prev.pykms.overrideAttrs (old: {
-        src = pkgs.fetchFromGitHub {
-          owner = "Py-KMS-Organization";
-          repo = "py-kms";
-          rev = "7bea3a2cb03c4c3666ff41185ace9f7ea2a07b99";
-          sha256 = "90DqMqPjfqfyRq86UzG9B/TjY+yclJBlggw+eIDgRe0=";
-        };
-      });
-    })
-  ];
 }

machines/storage/s0/hardware-configuration.nix

@@ -1,58 +1,75 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
 { config, lib, pkgs, modulesPath, ... }:
 
 {
   imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+    [
+      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [
-    "ahci"
-    "usb_storage"
-    "bcache"
-  ];
+  # boot
+  efi.enable = true;
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "uas" "sd_mod" "rtsx_pci_sdmmc" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  boot.initrd.luks.devices."enc-pv1" = {
-    device = "/dev/disk/by-uuid/e3b588b6-d07f-4221-a194-e1e900299752";
-    allowDiscards = true; # SSD
-  };
-  boot.initrd.luks.devices."enc-pv2".device = "/dev/disk/by-uuid/514231c1-5934-401f-80e1-e3b6b62dc9d5";
-  boot.initrd.luks.devices."enc-pv3".device = "/dev/disk/by-uuid/f45abe73-d0c6-446f-b28c-7a96a3f87851";
-  boot.initrd.luks.devices."enc-pv4".device = "/dev/disk/by-uuid/e2c7402a-e72c-4c4a-998f-82e4c10187bc";
-  boot.initrd.luks.devices."enc-pv5".device = "/dev/disk/by-uuid/5d1002b8-a0ed-4a1c-99f5-24b8816d9e38";
-  boot.initrd.luks.devices."enc-pvUSB" = {
-    device = "/dev/disk/by-uuid/c8e18f86-a950-4e4e-8f3c-366cc78db29b";
-    allowDiscards = true; # SSD
-  };
+  # firmware
+  firmware.x86_64.enable = true;
 
+  ### disks ###
+
+  # zfs
+  networking.hostId = "5e6791f0";
+  boot.supportedFilesystems = [ "zfs" ];
+  boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+
+  # luks
+  remoteLuksUnlock.enable = true;
+  boot.initrd.luks.devices."enc-pv1".device = "/dev/disk/by-uuid/d52e99a9-8825-4d0a-afc1-8edbef7e0a86";
+  boot.initrd.luks.devices."enc-pv2".device = "/dev/disk/by-uuid/f7275585-7760-4230-97de-36704b9a2aa3";
+  boot.initrd.luks.devices."enc-pv3".device = "/dev/disk/by-uuid/5d1002b8-a0ed-4a1c-99f5-24b8816d9e38";
+  boot.initrd.luks.devices."enc-pv4".device = "/dev/disk/by-uuid/e2c7402a-e72c-4c4a-998f-82e4c10187bc";
+
+  # mounts
   fileSystems."/" =
-    { device = "/dev/mapper/enc-pv1:/dev/mapper/enc-pv2:/dev/mapper/enc-pv3:/dev/mapper/enc-pv4:/dev/mapper/enc-pv5:/dev/mapper/enc-pvUSB";
-      fsType = "bcachefs";
+    {
+      device = "rpool/nixos/root";
+      fsType = "zfs";
+      options = [ "zfsutil" "X-mount.mkdir" ];
+    };
+  fileSystems."/home" =
+    {
+      device = "rpool/nixos/home";
+      fsType = "zfs";
+      options = [ "zfsutil" "X-mount.mkdir" ];
+    };
+  fileSystems."/var/lib" =
+    {
+      device = "rpool/nixos/var/lib";
+      fsType = "zfs";
+      options = [ "zfsutil" "X-mount.mkdir" ];
+    };
+  fileSystems."/var/log" =
+    {
+      device = "rpool/nixos/var/log";
+      fsType = "zfs";
+      options = [ "zfsutil" "X-mount.mkdir" ];
     };
 
+  fileSystems."/data" =
+    {
+      device = "rpool/nixos/data";
+      fsType = "zfs";
+      options = [ "zfsutil" "X-mount.mkdir" ];
+    };
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/8F7E-53C4";
+    {
+      device = "/dev/disk/by-uuid/4FB4-738E";
       fsType = "vfat";
     };
+  swapDevices = [ ];
 
-  swapDevices = [
-    {
-      device = "/dev/mmcblk1p2";
-      randomEncryption.enable = true;
-    }
-  ];
+  networking.interfaces.eth0.useDHCP = true;
 
-  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
-  # Per-interface useDHCP will be mandatory in the future, so this generated config
-  # replicates the default behaviour.
-  networking.useDHCP = lib.mkDefault false;
-  networking.interfaces.eth0.useDHCP = lib.mkDefault true;
-  networking.interfaces.eth1.useDHCP = lib.mkDefault true;
-
-  powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
+  powerManagement.cpuFreqGovernor = "powersave";
 }

machines/storage/s0/helios64/README.md

@@ -1,62 +0,0 @@
-Kobol Helios64
-==============
-
-The `default.nix` module provides the required setup for the system to work.
-
-The `recommended.nix` module adds recommended settings for the system.
-
-Status
-------
-
-### Works
-
- - SATA hard drives
- - Ethernet (1gbps)
- - Serial through USB type-c (`ttyS2`)
-
-### Untested
-
- - Ethernet (2.5gbps)
- - DP video out
- - UPS behaviour
- - `rootfs` on SATA drives
-
-### Disabled
-
-Due to misbehaviour, `ttyS0` (`&uart0`, `serial@ff180000`) has been disabled
-via a kernel patch.
-
-Without this change, using, or attempting to use `ttyS0` will break serial
-output from `ttyS2`.
-
-
-Kernel
-------
-
-Only Linux 5.10 (LTS) is supported, using the patch set derived from Armbian.
-
-
-Requirements
-------------
-
-A *platform firmware* needs to be provided out of band for the system.
-
-The author recommends Tow-Boot, for which a [draft pull request](https://github.com/Tow-Boot/Tow-Boot/pull/54)
-adds support for the Helios64.
-
-Any other supported *platform firmware* should work too.
-
-> **NOTE**: at the time of writing (2021-10-10) the *platform firmware*
-> **must** make use of the proprietary ram training. The open source equivalent
-> will make the system unstable, and worse, will cause silent memory
-> corruption, in addition to loud memory corruption.
-
-
-Notes
------
-
-### Baud rate
-
-The serial baud rate is configured for `115200`, which is a more common default
-than the usual for Rockchip at `1500000`. See [the rationale for the decision](https://github.com/Tow-Boot/Tow-Boot/pull/33).
-

machines/storage/s0/helios64/default.nix

@@ -1,27 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-  imports = [
-    ./modules/fancontrol.nix
-    ./modules/heartbeat.nix
-    ./modules/ups.nix
-  ];
-
-  boot.kernelParams = lib.mkAfter [
-    "console=ttyS2,115200n8"
-    "earlycon=uart8250,mmio32,0xff1a0000"
-  ];
-
-  # Required for rootfs on sata
-  boot.initrd.availableKernelModules = [
-    "pcie-rockchip-host" # required for rootfs on pcie sata disks
-    "phy-rockchip-pcie" # required for rootfs on pcie sata disks
-    "phy-rockchip-usb" # maybe not needed
-    "uas" # required for rootfs on USB 3.0 sata disks
-  ];
-
-  # bcachefs kernel is 5.15. but need patches that are only in 5.16+
-  # Patch the device tree to add support for getting the cpu thermal temp
-  hardware.deviceTree.enable = true;
-  hardware.deviceTree.kernelPackage = pkgs.linux_latest;
-}

machines/storage/s0/helios64/modules/bsp/90-helios64-hwmon.rules

@@ -1,23 +0,0 @@
-# Helios64 persistent hwmon
-
-ACTION=="remove", GOTO="helios64_hwmon_end"
-
-#
-KERNELS=="fan1", SUBSYSTEMS=="platform", ENV{_HELIOS64_FAN_}="p6", ENV{_IS_HELIOS64_FAN_}="1", ENV{IS_HELIOS64_HWMON}="1"
-KERNELS=="fan2", SUBSYSTEMS=="platform", ENV{_HELIOS64_FAN_}="p7", ENV{_IS_HELIOS64_FAN_}="1", ENV{IS_HELIOS64_HWMON}="1"
-KERNELS=="2-004c", SUBSYSTEMS=="i2c", DRIVERS=="lm75", ENV{IS_HELIOS64_HWMON}="1"
-
-SUBSYSTEM!="hwmon", GOTO="helios64_hwmon_end"
-
-ENV{HWMON_PATH}="/sys%p"
-#
-ATTR{name}=="cpu_thermal", ENV{IS_HELIOS64_HWMON}="1", ENV{HELIOS64_SYMLINK}="/dev/thermal-cpu"
-#
-ENV{IS_HELIOS64_HWMON}=="1", ATTR{name}=="lm75", ENV{HELIOS64_SYMLINK}="/dev/thermal-board"
-ENV{_IS_HELIOS64_FAN_}=="1", ENV{HELIOS64_SYMLINK}="/dev/fan-$env{_HELIOS64_FAN_}"
-
-#
-ENV{IS_HELIOS64_HWMON}=="1", RUN+="/bin/ln -sf $env{HWMON_PATH} $env{HELIOS64_SYMLINK}"
-
-LABEL="helios64_hwmon_end"
-

machines/storage/s0/helios64/modules/bsp/90-helios64-ups.rules

@@ -1,11 +0,0 @@
-ACTION=="add", GOTO="helios64_ups_end"
-ACTION=="remove", GOTO="helios64_ups_end"
-
-# Power loss event
-ACTION=="change", SUBSYSTEM=="power_supply", ATTR{type}=="Mains", ATTRS{online}=="0", RUN+="/usr/bin/systemctl start helios64-ups.timer"
-
-# Power restore event
-ACTION=="change", SUBSYSTEM=="power_supply", ATTR{type}=="Mains", ATTRS{online}=="1", RUN+="/usr/bin/systemctl stop helios64-ups.timer"
-
-LABEL="helios64_ups_end"
-

machines/storage/s0/helios64/modules/fancontrol.nix

@@ -1,41 +0,0 @@
-{ pkgs, ... }:
-{
-  hardware.fancontrol.enable = true;
-  hardware.fancontrol.config = ''
-    # Helios64 PWM Fan Control Configuration
-    # Temp source : /dev/thermal-cpu
-    INTERVAL=10
-    FCTEMPS=/dev/fan-p6/pwm1=/dev/thermal-cpu/temp1_input /dev/fan-p7/pwm1=/dev/thermal-cpu/temp1_input
-    MINTEMP=/dev/fan-p6/pwm1=40 /dev/fan-p7/pwm1=40
-    MAXTEMP=/dev/fan-p6/pwm1=80 /dev/fan-p7/pwm1=80
-    MINSTART=/dev/fan-p6/pwm1=60 /dev/fan-p7/pwm1=60
-    MINSTOP=/dev/fan-p6/pwm1=29 /dev/fan-p7/pwm1=29
-    MINPWM=20
-  '';
-
-  services.udev.packages = [
-    # Fan control
-    (pkgs.callPackage (
-      { stdenv, lib, coreutils }:
-      stdenv.mkDerivation {
-        name = "helios64-udev-fancontrol";
-
-        dontUnpack = true;
-        dontBuild = true;
-
-        installPhase = ''
-          mkdir -p "$out/etc/udev/rules.d/";
-          install -Dm644 "${./bsp/90-helios64-hwmon.rules}" \
-            "$out/etc/udev/rules.d/90-helios64-hwmon.rules"
-          substituteInPlace "$out/etc/udev/rules.d/90-helios64-hwmon.rules" \
-            --replace '/bin/ln'  '${lib.getBin coreutils}/bin/ln'
-        '';
-
-        meta = with lib; {
-          description = "Udev rules for fancontrol for the Helios64";
-          platforms = platforms.linux;
-        };
-      }
-    ) {})
-  ];
-}

machines/storage/s0/helios64/modules/heartbeat.nix

@@ -1,22 +0,0 @@
-{ pkgs, lib, ... }:
-{
-  systemd.services.heartbeat = {
-    enable = true;
-    description = "Enable heartbeat & network activity led on Helios64";
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = ''
-        ${lib.getBin pkgs.bash}/bin/bash -c 'echo heartbeat | ${lib.getBin pkgs.coreutils}/bin/tee /sys/class/leds/helios64\\:green\\:status/trigger'
-
-        # this led is not supported yet in the kernel i'm using
-        # ${lib.getBin pkgs.bash}/bin/bash -c 'echo netdev | ${lib.getBin pkgs.coreutils}/bin/tee /sys/class/leds/helios64\\:blue\\:net/trigger'
-        # ${lib.getBin pkgs.bash}/bin/bash -c 'echo eth0 | ${lib.getBin pkgs.coreutils}/bin/tee /sys/class/leds/helios64\\:blue\\:net/device_name'
-        # ${lib.getBin pkgs.bash}/bin/bash -c 'echo 1 | ${lib.getBin pkgs.coreutils}/bin/tee /sys/class/leds/helios64\\:blue\\:net/link'
-        # ${lib.getBin pkgs.bash}/bin/bash -c 'echo 1 | ${lib.getBin pkgs.coreutils}/bin/tee /sys/class/leds/helios64\\:blue\\:net/rx'
-        # ${lib.getBin pkgs.bash}/bin/bash -c 'echo 1 | ${lib.getBin pkgs.coreutils}/bin/tee /sys/class/leds/helios64\\:blue\\:net/tx'
-      '';
-    };
-    after = [ "getty.target" ];
-    wantedBy = [ "multi-user.target" ];
-  };
-}

machines/storage/s0/helios64/modules/ups.nix

@@ -1,51 +0,0 @@
-{ pkgs, ... }:
-{
-  systemd.services.helios64-ups = {
-    enable = true;
-    description = "Helios64 UPS Action";
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = "${pkgs.systemd}/bin/poweroff";
-    };
-  };
-
-  systemd.timers.helios64-ups = {
-    enable = true;
-    description = "Helios64 UPS Shutdown timer on power loss";
-    # disabling the timer by default. Even though armbian enaled
-    # the timer by default through this, we don't, as we can't
-    # rely on the udev rules to disable it after a system switch.
-    # wantedBy = [ "multi-user.target" ];
-    timerConfig = {
-      OnActiveSec = "10m";
-      AccuracySec = "1s";
-      Unit = "helios64-ups.service";
-    };
-  };
-  # The udev rule that will trigger the above service.
-  services.udev.packages = [
-    (pkgs.callPackage (
-      { stdenv, lib, coreutils, systemd }:
-      stdenv.mkDerivation {
-          name = "helios64-udev-ups";
-
-          dontUnpack = true;
-          dontBuild = true;
-
-          installPhase = ''
-              mkdir -p "$out/etc/udev/rules.d/";
-              install -Dm644 "${./bsp/90-helios64-ups.rules}" \
-                "$out/etc/udev/rules.d/90-helios64-ups.rules"
-              substituteInPlace "$out/etc/udev/rules.d/90-helios64-ups.rules" \
-                  --replace '/bin/ln'  '${lib.getBin coreutils}/bin/ln' \
-                  --replace '/usr/bin/systemctl' '${lib.getBin systemd}/bin/systemctl'
-          '';
-
-          meta = with lib; {
-              description = "Udev rules for UPS for the Helios64";
-              platforms = platforms.linux;
-          };
-      }
-    ) {})
-  ];
-}