zuckerberg/nix-config
1
0
Fork 0
Code Issues Pull Requests Actions Activity

Compare commits

base: zuckerberg:pia-client
Branches Tags
zuckerberg:master zuckerberg:stage zuckerberg:rpi-hotspot zuckerberg:attic zuckerberg:kexec_luks2 zuckerberg:pia-client
..
compare: zuckerberg:bfeafdbe0696615cefcbaeff6deb0e9240e3b18a
Branches Tags
zuckerberg:master zuckerberg:stage zuckerberg:rpi-hotspot zuckerberg:attic zuckerberg:kexec_luks2 zuckerberg:pia-client

1 Commits
pia-client ... bfeafdbe06

Author SHA1 Message Date
Zuckerberg
bfeafdbe06 wip 2022-11-27 18:27:47 -05:00
46 changed files with 2566 additions and 808 deletions
Expand all files Collapse all files

4
common/pc/chromium.nix
View File

@@ -60,6 +60,7 @@ in {
"oboonakemofpalcgghocfoadofidjkkk" # keepassxc plugin
"cimiefiiaegbelhefglklhhakcgmhkai" # plasma integration
"hkgfoiooedgoejojocmhlaklaeopbecg" # picture in picture
"fihnjjcciajhdojfnbdddfaoknhalnja" # I don't care about cookies
"mnjggcdmjocbbbhaepdhchncahnbgone" # SponsorBlock
"dhdgffkkebhmkfjojejmpbldmpobfkfo" # Tampermonkey
# "ehpdicggenhgapiikfpnmppdonadlnmp" # Disable Scroll Jacking
@@ -79,7 +80,6 @@ in {
nixpkgs.config.packageOverrides = pkgs: {
vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
chromium = pkgs.chromium.override {
enableWideVine = true;
# ungoogled = true;
# --enable-native-gpu-memory-buffers # fails on AMD APU
# --enable-webrtc-vp9-support
@@ -89,7 +89,7 @@ in {
# todo vulkan in chrome
# todo video encoding in chrome
hardware.opengl = {
enable = true;
enable = de.enableAcceleration;
extraPackages = with pkgs; [
intel-media-driver # LIBVA_DRIVER_NAME=iHD
vaapiIntel # LIBVA_DRIVER_NAME=i965 (older but works better for Firefox/Chromium)

16
common/pc/default.nix
View File

@@ -14,20 +14,25 @@ in {
./pithos.nix
./spotify.nix
./vscodium.nix
./discord.nix
./steam.nix
# FIXME make optional
# ./discord.nix
# ./steam.nix
./touchpad.nix
./mount-samba.nix
];
options.de = {
enable = lib.mkEnableOption "enable desktop environment";
enableAcceleration = lib.mkOption {
type = lib.types.bool;
default = true;
};
};
config = lib.mkIf cfg.enable {
# vulkan
hardware.opengl.driSupport = true;
hardware.opengl.driSupport32Bit = true;
hardware.opengl.driSupport = de.enableAcceleration;
hardware.opengl.driSupport32Bit = de.enableAcceleration;
# Applications
users.users.googlebot.packages = with pkgs; [
@@ -40,8 +45,7 @@ in {
element-desktop
mpv
nextcloud-client
signal-desktop
minecraft
# signal-desktop # FIXME
gparted
libreoffice-fresh
thunderbird

76
common/pc/pia/default.nix
View File

@@ -1,76 +0,0 @@
{ lib, config, pkgs, ... }:
with lib;
let
cfg = config.services.pia;
in {
imports = [
./pia.nix
];
options.services.pia = {
enable = lib.mkEnableOption "Enable PIA Client";
dataDir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/pia";
description = ''
Path to the pia data directory
'';
};
user = lib.mkOption {
type = lib.types.str;
default = "root";
description = ''
The user pia should run as
'';
};
group = lib.mkOption {
type = lib.types.str;
default = "piagrp";
description = ''
The group pia should run as
'';
};
users = mkOption {
type = with types; listOf str;
default = [];
description = ''
Usernames to be added to the "spotifyd" group, so that they
can start and interact with the userspace daemon.
'';
};
};
config = mkIf cfg.enable {
# users.users.${cfg.user} =
# if cfg.user == "pia" then {
# isSystemUser = true;
# group = cfg.group;
# home = cfg.dataDir;
# createHome = true;
# }
# else {};
users.groups.${cfg.group}.members = cfg.users;
systemd.services.pia-daemon = {
enable = true;
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.ExecStart = "${pkgs.pia-daemon}/bin/pia-daemon";
serviceConfig.PrivateTmp="yes";
serviceConfig.User = cfg.user;
serviceConfig.Group = cfg.group;
preStart = ''
mkdir -p ${cfg.dataDir}
chown ${cfg.user}:${cfg.group} ${cfg.dataDir}
'';
};
};
}

147
common/pc/pia/fix-pia.patch
View File

@@ -1,147 +0,0 @@
diff --git a/Rakefile b/Rakefile
index fa6d771..bcd6fb1 100644
--- a/Rakefile
+++ b/Rakefile
@@ -151,41 +151,6 @@ end
# Install LICENSE.txt
stage.install('LICENSE.txt', :res)
-# Download server lists to ship preloaded copies with the app. These tasks
-# depend on version.txt so they're refreshed periodically (whenver a new commit
-# is made), but not for every build.
-#
-# SERVER_DATA_DIR can be set to use existing files instead of downloading them;
-# this is primarily intended for reproducing a build.
-#
-# Create a probe for SERVER_DATA_DIR so these are updated if it changes.
-serverDataProbe = Probe.new('serverdata')
-serverDataProbe.file('serverdata.txt', "#{ENV['SERVER_DATA_DIR']}")
-# JSON resource build directory
-jsonFetched = Build.new('json-fetched')
-# These are the assets we need to fetch and the URIs we get them from
-{
- 'modern_shadowsocks.json': 'https://serverlist.piaservers.net/shadow_socks',
- 'modern_servers.json': 'https://serverlist.piaservers.net/vpninfo/servers/v6',
- 'modern_region_meta.json': 'https://serverlist.piaservers.net/vpninfo/regions/v2'
-}.each do |k, v|
- fetchedFile = jsonFetched.artifact(k.to_s)
- serverDataDir = ENV['SERVER_DATA_DIR']
- file fetchedFile => [version.artifact('version.txt'),
- serverDataProbe.artifact('serverdata.txt'),
- jsonFetched.componentDir] do |t|
- if(serverDataDir)
- # Use the copy provided instead of fetching (for reproducing a build)
- File.copy(File.join(serverDataDir, k), fetchedFile)
- else
- # Fetch from the web API (write with "binary" mode so LF is not
- # converted to CRLF on Windows)
- File.binwrite(t.name, Net::HTTP.get(URI(v)))
- end
- end
- stage.install(fetchedFile, :res)
-end
-
# Install version/brand/arch info in case an upgrade needs to know what is
# currently installed
stage.install(version.artifact('version.txt'), :res)
diff --git a/common/src/posix/unixsignalhandler.cpp b/common/src/posix/unixsignalhandler.cpp
index f820a6d..e1b6c33 100644
--- a/common/src/posix/unixsignalhandler.cpp
+++ b/common/src/posix/unixsignalhandler.cpp
@@ -132,7 +132,7 @@ void UnixSignalHandler::_signalHandler(int, siginfo_t *info, void *)
// we checked it, we can't even log because the logger is not reentrant.
auto pThis = instance();
if(pThis)
- ::write(pThis->_sigFd[0], info, sizeof(siginfo_t));
+ auto _ = ::write(pThis->_sigFd[0], info, sizeof(siginfo_t));
}
template<int Signal>
void UnixSignalHandler::setAbortAction()
diff --git a/daemon/src/linux/linux_nl.cpp b/daemon/src/linux/linux_nl.cpp
index fd3aced..2367a5e 100644
--- a/daemon/src/linux/linux_nl.cpp
+++ b/daemon/src/linux/linux_nl.cpp
@@ -642,6 +642,6 @@ LinuxNl::~LinuxNl()
unsigned char term = 0;
PosixFd killSocket = _workerKillSocket.get();
if(killSocket)
- ::write(killSocket.get(), &term, sizeof(term));
+ auto _ = ::write(killSocket.get(), &term, sizeof(term));
_workerThread.join();
}
diff --git a/extras/support-tool/launcher/linux-launcher.cpp b/extras/support-tool/launcher/linux-launcher.cpp
index 3f63ac2..420d54d 100644
--- a/extras/support-tool/launcher/linux-launcher.cpp
+++ b/extras/support-tool/launcher/linux-launcher.cpp
@@ -48,7 +48,7 @@ int fork_execv(gid_t gid, char *filename, char *const argv[])
if(forkResult == 0)
{
// Apply gid as both real and effective
- setregid(gid, gid);
+ auto _ = setregid(gid, gid);
int execErr = execv(filename, argv);
std::cerr << "exec err: " << execErr << " / " << errno << " - "
diff --git a/rake/model/qt.rb b/rake/model/qt.rb
index c8cd362..a6abe59 100644
--- a/rake/model/qt.rb
+++ b/rake/model/qt.rb
@@ -171,12 +171,7 @@ class Qt
end
def getQtRoot(qtVersion, arch)
- qtToolchainPtns = getQtToolchainPatterns(arch)
- qtRoots = FileList[*Util.joinPaths([[qtVersion], qtToolchainPtns])]
- # Explicitly filter for existing paths - if the pattern has wildcards
- # we only get existing directories, but if the patterns are just
- # alternates with no wildcards, we can get directories that don't exist
- qtRoots.find_all { |r| File.exist?(r) }.max
+ ENV['QTROOT']
end
def getQtVersionScore(minor, patch)
@@ -192,12 +187,7 @@ class Qt
end
def getQtPathVersion(path)
- verMatch = path.match('^.*/Qt[^/]*/5\.(\d+)\.?(\d*)$')
- if(verMatch == nil)
- nil
- else
- [verMatch[1].to_i, verMatch[2].to_i]
- end
+ [ENV['QT_MAJOR'].to_i, ENV['QT_MINOR'].to_i]
end
# Build a component definition with the defaults. The "Core" component will
diff --git a/rake/product/linux.rb b/rake/product/linux.rb
index f43fb3e..83505af 100644
--- a/rake/product/linux.rb
+++ b/rake/product/linux.rb
@@ -18,8 +18,7 @@ module PiaLinux
QT_BINARIES = %w(pia-client pia-daemon piactl pia-support-tool)
# Version of libicu (needed to determine lib*.so.## file names in deployment)
- ICU_VERSION = FileList[File.join(Executable::Qt.targetQtRoot, 'lib', 'libicudata.so.*')]
- .first.match(/libicudata\.so\.(\d+)(\..*|)/)[1]
+ ICU_VERSION = ENV['ICU_MAJOR'].to_i;
# Copy a directory recursively, excluding *.debug files (debugging symbols)
def self.copyWithoutDebug(sourceDir, destDir)
@@ -220,16 +219,5 @@ module PiaLinux
# Since these are just development workflow tools, they can be skipped if
# specific dependencies are not available.
def self.defineTools(toolsStage)
- # Test if we have libthai-dev, for the Thai word breaking utility
- if(Executable::Tc.sysHeaderAvailable?('thai/thwbrk.h'))
- Executable.new('thaibreak')
- .source('tools/thaibreak')
- .lib('thai')
- .install(toolsStage, :bin)
- toolsStage.install('tools/thaibreak/thai_ts.sh', :bin)
- toolsStage.install('tools/onesky_import/import_translations.sh', :bin)
- else
- puts "skipping thaibreak utility, install libthai-dev to build thaibreak"
- end
end
end

139
common/pc/pia/pia.nix
View File

@@ -1,139 +0,0 @@
{ pkgs, lib, config, ... }:
{
nixpkgs.overlays = [
(self: super:
with self;
let
# arch = builtins.elemAt (lib.strings.splitString "-" builtins.currentSystem) 0;
arch = "x86_64";
pia-desktop = clangStdenv.mkDerivation rec {
pname = "pia-desktop";
version = "3.3.0";
src = fetchgit {
url = "https://github.com/pia-foss/desktop";
rev = version;
fetchLFS = true;
sha256 = "D9txL5MUWyRYTnsnhlQdYT4dGVpj8PFsVa5hkrb36cw=";
};
patches = [
./fix-pia.patch
];
nativeBuildInputs = [
cmake
rake
];
prePatch = ''
sed -i 's|/usr/include/libnl3|${libnl.dev}/include/libnl3|' Rakefile
'';
installPhase = ''
mkdir -p $out/bin $out/lib $out/share
cp -r ../out/pia_release_${arch}/stage/bin $out
cp -r ../out/pia_release_${arch}/stage/lib $out
cp -r ../out/pia_release_${arch}/stage/share $out
'';
cmakeFlags = [
"-DCMAKE_BUILD_TYPE=Release"
];
QTROOT = "${qt5.full}";
QT_MAJOR = lib.versions.minor (lib.strings.parseDrvName qt5.full.name).version;
QT_MINOR = lib.versions.patch (lib.strings.parseDrvName qt5.full.name).version;
ICU_MAJOR = lib.versions.major (lib.strings.parseDrvName icu.name).version;
buildInputs = [
mesa
libsForQt5.qt5.qtquickcontrols
libsForQt5.qt5.qtquickcontrols2
icu
libnl
];
dontWrapQtApps = true;
};
in rec {
openvpn-updown = buildFHSUserEnv {
name = "openvpn-updown";
targetPkgs = pkgs: (with pkgs; [ pia-desktop ]);
runScript = "openvpn-updown.sh";
};
pia-client = buildFHSUserEnv {
name = "pia-client";
targetPkgs = pkgs: (with pkgs; [
pia-desktop
xorg.libXau
xorg.libXdmcp
]);
runScript = "pia-client";
};
piactl = buildFHSUserEnv {
name = "piactl";
targetPkgs = pkgs: (with pkgs; [ pia-desktop ]);
runScript = "piactl";
};
pia-daemon = buildFHSUserEnv {
name = "pia-daemon";
targetPkgs = pkgs: (with pkgs; [ pia-desktop ]);
runScript = "pia-daemon";
};
pia-hnsd = buildFHSUserEnv {
name = "pia-hnsd";
targetPkgs = pkgs: (with pkgs; [ pia-desktop ]);
runScript = "pia-hnsd";
};
pia-openvpn = buildFHSUserEnv {
name = "pia-openvpn";
targetPkgs = pkgs: (with pkgs; [ pia-desktop ]);
runScript = "pia-openvpn";
};
pia-ss-local = buildFHSUserEnv {
name = "pia-ss-local";
targetPkgs = pkgs: (with pkgs; [ pia-desktop ]);
runScript = "pia-ss-local";
};
pia-support-tool = buildFHSUserEnv {
name = "pia-support-tool";
targetPkgs = pkgs: (with pkgs; [
pia-desktop
xorg.libXau
xorg.libXdmcp
]);
runScript = "pia-support-tool";
};
pia-unbound = buildFHSUserEnv {
name = "pia-unbound";
targetPkgs = pkgs: (with pkgs; [ pia-desktop ]);
runScript = "pia-unbound";
};
pia-wireguard-go = buildFHSUserEnv {
name = "pia-wireguard-go";
targetPkgs = pkgs: (with pkgs; [ pia-desktop ]);
runScript = "pia-wireguard-go";
};
support-tool-launcher = buildFHSUserEnv {
name = "support-tool-launcher";
targetPkgs = pkgs: (with pkgs; [ pia-desktop ]);
runScript = "support-tool-launcher";
};
})
];
}

58
common/server/cloudflared.nix Normal file
View File

@@ -0,0 +1,58 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.cloudflared;
settingsFormat = pkgs.formats.yaml { };
in
{
meta.maintainers = with maintainers; [ pmc ];
options = {
services.cloudflared = {
enable = mkEnableOption "cloudflared";
package = mkOption {
type = types.package;
default = pkgs.cloudflared;
description = "The cloudflared package to use";
example = literalExpression ''pkgs.cloudflared'';
};
config = mkOption {
type = settingsFormat.type;
description = "Contents of the config.yaml as an attrset; see https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file for documentation on the contents";
example = literalExpression ''
{
url = "http://localhost:3000";
tunnel = "505c8dd1-e4fb-4ea4-b909-26b8f61ceaaf";
credentials-file = "/var/lib/cloudflared/505c8dd1-e4fb-4ea4-b909-26b8f61ceaaf.json";
}
'';
};
configFile = mkOption {
type = types.path;
description = "Path to cloudflared config.yaml.";
example = literalExpression ''"/etc/cloudflared/config.yaml"'';
};
};
};
config = mkIf cfg.enable ({
# Prefer the config file over settings if both are set.
services.cloudflared.configFile = mkDefault (settingsFormat.generate "cloudflared.yaml" cfg.config);
systemd.services.cloudflared = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
description = "Cloudflare Argo Tunnel";
serviceConfig = {
TimeoutStartSec = 0;
Type = "notify";
ExecStart = "${cfg.package}/bin/cloudflared --config ${cfg.configFile} --no-autoupdate tunnel run";
Restart = "on-failure";
RestartSec = "5s";
};
};
});
}

1
common/server/default.nix
View File

@@ -13,6 +13,7 @@
./privatebin/privatebin.nix
./radio.nix
./samba.nix
./cloudflared.nix
./owncast.nix
];
}

2
common/shell.nix
View File

@@ -6,7 +6,7 @@
# - add some handy shell commands
let
nix-locate = config.inputs.nix-locate.packages.${config.currentSystem}.default;
nix-locate = config.inputs.nix-locate.defaultPackage.${config.currentSystem};
in {
programs.command-not-found.enable = false;

6
common/ssh.nix
View File

@@ -5,13 +5,15 @@ rec {
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO0VFnn3+Mh0nWeN92jov81qNE9fpzTAHYBphNoY7HUx" # reg
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHSkKiRUUmnErOKGx81nyge/9KqjkPh8BfDk0D3oP586" # nat
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFeTK1iARlNIKP/DS8/ObBm9yUM/3L1Ub4XI5A2r9OzP" # ray
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXc9PX3uTYVrgvKdztk+LBh5WMNBUzbXlAo50SCAeNw" # nat 2
];
system = {
liza = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY/pNyWedEfU7Tq9ikGbriRuF1ZWkHhegGS17L0Vcdl";
ponyo = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBBlTAIp38RhErU1wNNV5MBeb+WGH0mhF/dxh5RsAXN";
ponyo-unlock = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC9LQuuImgWlkjDhEEIbM1wOd+HqRv1RxvYZuLXPSdRi";
ray = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDQM8hwKRgl8cZj7UVYATSLYu4LhG7I0WFJ9m2iWowiB";
s0 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAwiXcUFtAvZCayhu4+AIcF+Ktrdgv9ee/mXSIhJbp4q";
nat = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGVgZc5Z2Oh426z7lEftcFUwCFcrZy8bvqS09Tj49GWE";
s0 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHkTQNPzrIhsKk3OpTHq8b7slIp9LktB49r1w/DKb/5b";
n1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWlhd1Oid5Xf2zdcBrcdrR0TlhObutwcJ8piobRTpRt";
n2 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ7bRiRutnI7Bmyt/I238E3Fp5DqiClIXiVibsccipOr";
n3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB+rJEaRrFDGirQC2UoWQkmpzLg4qgTjGJgVqiipWiU5";
@@ -26,6 +28,7 @@ rec {
liza
ponyo
ray
nat
s0
n1
n2
@@ -37,6 +40,7 @@ rec {
];
personal = with system; [
ray
nat
];
servers = with system; [
liza

77
flake.lock generated
View File

@@ -2,17 +2,16 @@
"nodes": {
"agenix": {
"inputs": {
"darwin": "darwin",
"nixpkgs": [
"nixpkgs"
]
},
"locked": {
"lastModified": 1675176355,
"narHash": "sha256-Qjxh5cmN56siY97mzmBLI1+cdjXSPqmfPVsKxBvHmwI=",
"lastModified": 1652712410,
"narHash": "sha256-hMJ2TqLt0DleEnQFGUHK9sV2aAzJPU8pZeiZoqRozbE=",
"owner": "ryantm",
"repo": "agenix",
"rev": "b7ffcfe77f817d9ee992640ba1f270718d197f28",
"rev": "7e5e58b98c3dcbf497543ff6f22591552ebfe65b",
"type": "github"
},
"original": {
@@ -33,7 +32,7 @@
"locked": {
"lastModified": 1648612759,
"narHash": "sha256-SJwlpD2Wz3zFoX2mIYCQfwIOYHaOdeiWGFeDXsLGM84=",
"ref": "refs/heads/master",
"ref": "master",
"rev": "39d338b9b24159d8ef3309eecc0d32a2a9f102b5",
"revCount": 2,
"type": "git",
@@ -72,7 +71,7 @@
"locked": {
"lastModified": 1651719222,
"narHash": "sha256-p/GY5vOP+HUlxNL4OtEhmBNEVQsedOHXEmjfCGONVmE=",
"ref": "refs/heads/master",
"ref": "master",
"rev": "1290ddd9a2ff2bf2d0f702750768312b80efcd34",
"revCount": 19,
"type": "git",
@@ -83,36 +82,14 @@
"url": "https://git.neet.dev/zuckerberg/dailybuild_modules.git"
}
},
"darwin": {
"inputs": {
"nixpkgs": [
"agenix",
"nixpkgs"
]
},
"locked": {
"lastModified": 1673295039,
"narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
"owner": "lnl7",
"repo": "nix-darwin",
"rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
"type": "github"
},
"original": {
"owner": "lnl7",
"ref": "master",
"repo": "nix-darwin",
"type": "github"
}
},
"flake-compat": {
"flake": false,
"locked": {
"lastModified": 1668681692,
"narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=",
"lastModified": 1641205782,
"narHash": "sha256-4jY7RCWUoZ9cKD8co0/4tFARpWB+57+r1bLLvXNJliY=",
"owner": "edolstra",
"repo": "flake-compat",
"rev": "009399224d5e398d03b22badca40a37ac85412a1",
"rev": "b7547d3eed6f32d06102ead8991ec52ab0a4f1a7",
"type": "github"
},
"original": {
@@ -123,11 +100,11 @@
},
"flake-utils": {
"locked": {
"lastModified": 1667395993,
"narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=",
"lastModified": 1653893745,
"narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f",
"rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
"type": "github"
},
"original": {
@@ -144,26 +121,26 @@
]
},
"locked": {
"lastModified": 1673969751,
"narHash": "sha256-U6aYz3lqZ4NVEGEWiti1i0FyqEo4bUjnTAnA73DPnNU=",
"owner": "bennofs",
"lastModified": 1652819416,
"narHash": "sha256-OzYSb66kQUVP1FM0E7Z0ij13mm14DkJi79FAMprAavo=",
"owner": "googlebot42",
"repo": "nix-index",
"rev": "5f98881b1ed27ab6656e6d71b534f88430f6823a",
"rev": "a28bb3175d370c6cb9569e6d4b5570e9ca016a3e",
"type": "github"
},
"original": {
"owner": "bennofs",
"owner": "googlebot42",
"repo": "nix-index",
"type": "github"
}
},
"nixpkgs": {
"locked": {
"lastModified": 1672580127,
"narHash": "sha256-3lW3xZslREhJogoOkjeZtlBtvFMyxHku7I/9IVehhT8=",
"lastModified": 1655456688,
"narHash": "sha256-j2trI5gv2fnHdfUQFBy957avCPxxzCqE8R+TOYHPSRE=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "0874168639713f547c05947c76124f78441ea46c",
"rev": "d17a56d90ecbd1b8fc908d49598fb854ef188461",
"type": "github"
},
"original": {
@@ -190,16 +167,16 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1675835843,
"narHash": "sha256-y1dSCQPcof4CWzRYRqDj4qZzbBl+raVPAko5Prdil28=",
"lastModified": 1649408932,
"narHash": "sha256-JhTW1OtS5fACcRXLqcTTQyYO5vLkO+bceCqeRms13SY=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "32f914af34f126f54b45e482fb2da4ae78f3095f",
"rev": "42948b300670223ca8286aaf916bc381f66a5313",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "master",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
@@ -234,7 +211,7 @@
"locked": {
"lastModified": 1652121792,
"narHash": "sha256-j1Y9MAjUVNgyFSeGzPoqibAnEysJDjZSXukVfQ7+bsQ=",
"ref": "refs/heads/master",
"ref": "master",
"rev": "72e7a9e80b780c84ed8d4a6374bfbb242701f900",
"revCount": 5,
"type": "git",
@@ -269,11 +246,11 @@
"utils": "utils"
},
"locked": {
"lastModified": 1655930346,
"narHash": "sha256-ht56HHOzEhjeIgAv5ZNFjSVX/in1YlUs0HG9c1EUXTM=",
"lastModified": 1655214255,
"narHash": "sha256-hgFF2X9mxFieekDh2VoVAtgwuM6XeAwzvb53yakmjTg=",
"owner": "simple-nixos-mailserver",
"repo": "nixos-mailserver",
"rev": "f535d8123c4761b2ed8138f3d202ea710a334a1d",
"rev": "a48082c79cff8f3b314ba4f95f4ae87ca7d4d068",
"type": "gitlab"
},
"original": {

20
flake.nix
View File

@@ -1,16 +1,17 @@
{
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.05";
nixpkgs-unstable.url = "github:NixOS/nixpkgs/master";
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
flake-utils.url = "github:numtide/flake-utils";
nix-locate.url = "github:bennofs/nix-index";
nix-locate.url = "github:googlebot42/nix-index";
nix-locate.inputs.nixpkgs.follows = "nixpkgs";
# mail server
simple-nixos-mailserver.url = "gitlab:simple-nixos-mailserver/nixos-mailserver/nixos-22.05";
simple-nixos-mailserver.inputs.nixpkgs.follows = "nixpkgs";
simple-nixos-mailserver.inputs.nixpkgs-21_11.follows = "nixpkgs";
# agenix
agenix.url = "github:ryantm/agenix";
@@ -41,12 +42,12 @@
modules = system: [
./common
inputs.simple-nixos-mailserver.nixosModule
inputs.agenix.nixosModules.default
inputs.agenix.nixosModule
inputs.dailybuild_modules.nixosModule
inputs.archivebox.nixosModule
({ lib, ... }: {
config.environment.systemPackages = [
inputs.agenix.packages.${system}.agenix
inputs.agenix.defaultPackage.${system}
];
# because nixos specialArgs doesn't work for containers... need to pass in inputs a different way
@@ -69,7 +70,7 @@
in
{
"reg" = mkSystem "x86_64-linux" nixpkgs ./machines/reg/configuration.nix;
"ray" = mkSystem "x86_64-linux" nixpkgs-unstable ./machines/ray/configuration.nix;
"ray" = mkSystem "x86_64-linux" nixpkgs ./machines/ray/configuration.nix;
"nat" = mkSystem "aarch64-linux" nixpkgs ./machines/nat/configuration.nix;
"liza" = mkSystem "x86_64-linux" nixpkgs ./machines/liza/configuration.nix;
"ponyo" = mkSystem "x86_64-linux" nixpkgs ./machines/ponyo/configuration.nix;
@@ -87,18 +88,11 @@
mkKexec = system:
(nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./machines/ephemeral/kexec.nix ];
modules = [ ./machines/kexec.nix ];
}).config.system.build.kexec_tarball;
mkIso = system:
(nixpkgs.lib.nixosSystem {
inherit system;
modules = [ ./machines/ephemeral/iso.nix ];
}).config.system.build.isoImage;
in {
"x86_64-linux"."kexec" = mkKexec "x86_64-linux";
"x86_64-linux"."iso" = mkIso "x86_64-linux";
"aarch64-linux"."kexec" = mkKexec "aarch64-linux";
"aarch64-linux"."iso" = mkIso "aarch64-linux";
};
};
}

12
machines/ephemeral/iso.nix
View File

@@ -1,12 +0,0 @@
{ modulesPath, ... }:
{
imports = [
(modulesPath + "/installer/cd-dvd/iso-image.nix")
./minimal.nix
];
isoImage.makeUsbBootable = true;
networking.hostName = "iso";
}

28
machines/ephemeral/minimal.nix
View File

@@ -1,28 +0,0 @@
{ pkgs, ... }:
{
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "e1000" "e1000e" "virtio_pci" "r8169" ];
boot.kernelParams = [
"panic=30" "boot.panic_on_fail" # reboot the machine upon fatal boot issues
"console=ttyS0" # enable serial console
"console=tty1"
];
boot.kernel.sysctl."vm.overcommit_memory" = "1";
environment.systemPackages = with pkgs; [
cryptsetup
btrfs-progs
];
environment.variables.GC_INITIAL_HEAP_SIZE = "1M";
networking.useDHCP = true;
services.openssh = {
enable = true;
challengeResponseAuthentication = false;
passwordAuthentication = false;
};
services.getty.autologinUser = "root";
users.users.root.openssh.authorizedKeys.keys = (import ../common/ssh.nix).users;
}

30
machines/ephemeral/kexec.nix → machines/kexec.nix
View File

@@ -6,11 +6,8 @@
imports = [
(modulesPath + "/installer/netboot/netboot.nix")
(modulesPath + "/profiles/qemu-guest.nix")
./minimal.nix
];
networking.hostName = "kexec";
# stripped down version of https://github.com/cleverca22/nix-tests/tree/master/kexec
system.build = rec {
image = pkgs.runCommand "image" { buildInputs = [ pkgs.nukeReferences ]; } ''
@@ -45,4 +42,31 @@
contents = [ ];
};
};
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "e1000" "e1000e" "virtio_pci" "r8169" ];
boot.kernelParams = [
"panic=30" "boot.panic_on_fail" # reboot the machine upon fatal boot issues
"console=ttyS0" # enable serial console
"console=tty1"
];
boot.kernel.sysctl."vm.overcommit_memory" = "1";
environment.systemPackages = with pkgs; [
cryptsetup
btrfs-progs
];
environment.variables.GC_INITIAL_HEAP_SIZE = "1M";
networking.useDHCP = true;
networking.hostName = "kexec";
services.openssh = {
enable = true;
challengeResponseAuthentication = false;
passwordAuthentication = false;
};
services.getty.autologinUser = "root";
users.users.root.openssh.authorizedKeys.keys = (import ../common/ssh.nix).users;
}

46
machines/nat/configuration.nix
View File

@@ -1,17 +1,51 @@
{ config, pkgs, fetchurl, lib, ... }:
{ config, lib, pkgs, ... }:
{
imports = [
./hardware-configuration.nix
./m1-support
];
efi.enable = true;
networking.hostName = "nat";
networking.interfaces.ens160.useDHCP = true;
services.zerotierone.enable = true;
de.enable = true;
de.touchpad.enable = true;
# nixpkgs.overlays = [
# (final: prev: {
# signal-desktop = prev.signal-desktop.overrideAttrs (old: {
# version = "5.50.1";
# src = final.fetchurl {
# url = "https://github.com/0mniteck/Signal-Desktop-Builder/raw/2610eaded94b3c717a63fdff3cb872dbbaf16383/builds/release/signal-desktop_5.50.1_arm64.deb";
# sha256 = "sha256-++xG3fCMvU+nwlkBwjZ0d0wfWiNDSUhyCfzTirsY2xs=";
# };
# #buildInputs = old.buildInputs ++ [ final.openssl_3_0 ];
# preFixup = ''
# gappsWrapperArgs+=(
# --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ final.stdenv.cc.cc ] }"
# --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--enable-features=UseOzonePlatform --ozone-platform=wayland}}"
# --suffix PATH : ${lib.makeBinPath [ final.xdg-utils ]}
# )
# # Fix the desktop link
# substituteInPlace $out/share/applications/signal-desktop.desktop \
# --replace /opt/Signal/signal-desktop $out/bin/signal-desktop
# autoPatchelf --no-recurse -- $out/lib/Signal/
# patchelf --add-needed ${final.libpulseaudio}/lib/libpulse.so $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc-arm64.node
# patchelf --add-needed ${final.openssl_3_0}/lib/libcrypto.so.3 $out/lib/Signal/resources/app.asar.unpacked/node_modules/ringrtc/build/linux/libringrtc-arm64.node
# '';
# meta.platforms = [ "aarch64-linux" ];
# });
# })
# ];
nixpkgs.overlays = [
(final: prev: {
jellyfin-media-player = prev.jellyfin-media-player.overrideAttrs (old: {
meta.platforms = [ "aarch64-linux" ];
});
})
];
}

51
machines/nat/hardware-configuration.nix
View File

@@ -4,22 +4,61 @@
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [ ];
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "uhci_hcd" "ahci" "nvme" "usbhid" ];
boot.initrd.kernelModules = [ ];
efi.enable = true;
# 4k kernel for m1
boot.kernelBuildIs16K = false;
boot.initrd.availableKernelModules = [ "usb_storage" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
boot.initrd.luks.devices."enc-pv" = {
device = "/dev/nvme0n1p5";
allowDiscards = true;
};
fileSystems."/" =
{ device = "/dev/disk/by-uuid/02a8c0c7-fd4e-4443-a83c-2d0b63848779";
{ device = "/dev/disk/by-uuid/f3021c34-2034-4bf0-bf3f-64d6d02c0eff";
fsType = "btrfs";
options = [ "subvol=root" ];
};
fileSystems."/home" =
{ device = "/dev/disk/by-uuid/f3021c34-2034-4bf0-bf3f-64d6d02c0eff";
fsType = "btrfs";
options = [ "subvol=home" ];
};
fileSystems."/nix" =
{ device = "/dev/disk/by-uuid/f3021c34-2034-4bf0-bf3f-64d6d02c0eff";
fsType = "btrfs";
options = [ "subvol=nix" ];
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/0C95-1290";
{ device = "/dev/disk/by-uuid/D33C-18EE";
fsType = "vfat";
};
swapDevices = [ ];
swapDevices =
[ { device = "/dev/disk/by-uuid/98e875e4-4c34-42e9-8c71-404dfe137ba7"; }
];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp1s0f0.useDHCP = lib.mkDefault true;
#nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
powerManagement.cpuFreqGovernor = lib.mkDefault "ondemand";
# high-resolution display
hardware.video.hidpi.enable = lib.mkDefault true;
}

31
machines/nat/m1-support/asahi-fwextract/add_entry_point.patch Normal file
View File

@@ -0,0 +1,31 @@
diff --git a/asahi_firmware/update.py b/asahi_firmware/update.py
index 8d4c480..7d89353 100644
--- a/asahi_firmware/update.py
+++ b/asahi_firmware/update.py
@@ -30,7 +30,7 @@ def update_firmware(source, dest, manifest):
pkg.save_manifest(manifest)
-if __name__ == "__main__":
+def main():
import argparse
import logging
logging.basicConfig()
@@ -46,3 +46,7 @@ if __name__ == "__main__":
args = parser.parse_args()
update_firmware(args.source, args.dest, args.manifest)
+
+if __name__ == "__main__":
+ main()
+
diff --git a/setup.py b/setup.py
index 45ada19..1b371ba 100644
--- a/setup.py
+++ b/setup.py
@@ -9,4 +9,5 @@ setup(name='asahi_firmware',
author_email='marcan@marcan.st',
url='https://github.com/AsahiLinux/asahi-installer/',
packages=['asahi_firmware'],
+ entry_points={"console_scripts": ["asahi-fwextract = asahi_firmware.update:main"]}
)

24
machines/nat/m1-support/asahi-fwextract/default.nix Executable file
View File

@@ -0,0 +1,24 @@
{ lib
, python3
, fetchFromGitHub
, makeBinaryWrapper
}:
python3.pkgs.buildPythonApplication rec {
pname = "asahi-fwextract";
version = "0.4pre2";
# tracking version: https://github.com/AsahiLinux/PKGBUILDs/blob/main/asahi-fwextract/PKGBUILD
src = fetchFromGitHub {
owner = "AsahiLinux";
repo = "asahi-installer";
rev = "v${version}";
hash = "sha256-RqvD2hNjKMlUg+oY1woUN5zpN+1Y/TrBQbokNgdeCW4=";
};
patches = [
./add_entry_point.patch
];
nativeBuildInputs = [ python3.pkgs.setuptools makeBinaryWrapper ];
}

56
machines/nat/m1-support/boot-m1n1/default.nix Normal file
View File

@@ -0,0 +1,56 @@
{ config, pkgs, lib, ... }:
let
buildPkgs = if config.boot.kernelBuildIsCross then
import (pkgs.path) {
system = "x86_64-linux";
crossSystem.system = "aarch64-linux";
}
else pkgs;
bootM1n1 = buildPkgs.callPackage ../m1n1 {
isRelease = true;
withTools = false;
};
bootUBoot = buildPkgs.callPackage ../u-boot {
m1n1 = bootM1n1;
};
bootFiles = {
"m1n1/boot.bin" = pkgs.runCommand "boot.bin" {} ''
cat ${bootM1n1}/build/m1n1.bin > $out
cat ${config.boot.kernelPackages.kernel}/dtbs/apple/*.dtb >> $out
cat ${bootUBoot}/u-boot-nodtb.bin.gz >> $out
if [ -n "${config.boot.m1n1ExtraOptions}" ]; then
echo '${config.boot.m1n1ExtraOptions}' >> $out
fi
'';
};
in {
config = {
# install m1n1 with the boot loader
boot.loader.grub.extraFiles = bootFiles;
boot.loader.systemd-boot.extraFiles = bootFiles;
# ensure the installer has m1n1 in the image
system.extraDependencies = lib.mkForce [ bootM1n1 bootUBoot ];
# give the user the utilities to re-extract the firmware if necessary
environment.systemPackages = [
(buildPkgs.callPackage ../asahi-fwextract {})
];
# system.extraDependencies = [ boot ];
# system.extraDependencies = lib.mkForce [ boot ];
};
options.boot.m1n1ExtraOptions = lib.mkOption {
type = lib.types.str;
default = "";
description = ''
Append extra options to the m1n1 boot binary. Might be useful for fixing
display problems on Mac minis.
https://github.com/AsahiLinux/m1n1/issues/159
'';
};
}

8
machines/nat/m1-support/default.nix Normal file
View File

@@ -0,0 +1,8 @@
{ config, pkgs, lib, ... }:
{
imports = [
./kernel
./firmware
./boot-m1n1
];
}

18
machines/nat/m1-support/firmware/default.nix Normal file
View File

@@ -0,0 +1,18 @@
{ config, pkgs, lib, ... }:
{
hardware.firmware = [
(pkgs.stdenvNoCC.mkDerivation {
name = "firmware";
buildCommand = ''
mkdir -p $out/lib/firmware
FIRMWARE=`echo ${./.}/*firmware*.tar`
if [ -e "$FIRMWARE" ]; then
tar xf "$FIRMWARE" -C $out/lib/firmware
else
# stop nixos infra from breaking when it doesn't have any firmware
touch $out/lib/firmware/.dummy
fi
'';
})
];
}

BIN
machines/nat/m1-support/firmware/firmware.tar Executable file
View File

Binary file not shown.

691
machines/nat/m1-support/kernel/config Normal file
View File

@@ -0,0 +1,691 @@
# from https://github.com/jannau/AsahiLinux-PKGBUILD/blob/main/linux-apple/config
CONFIG_SWAP=y
CONFIG_DM_SNAPSHOT=m
CONFIG_WERROR=y
CONFIG_DEFAULT_HOSTNAME="m1"
CONFIG_SYSVIPC=y
CONFIG_POSIX_MQUEUE=y
CONFIG_AUDIT=y
CONFIG_NO_HZ_IDLE=y
CONFIG_HIGH_RES_TIMERS=y
CONFIG_BPF_JIT=y
CONFIG_PREEMPT=y
CONFIG_IRQ_TIME_ACCOUNTING=y
CONFIG_BSD_PROCESS_ACCT=y
CONFIG_BSD_PROCESS_ACCT_V3=y
CONFIG_TASKSTATS=y
CONFIG_TASK_DELAY_ACCT=y
CONFIG_TASK_XACCT=y
CONFIG_TASK_IO_ACCOUNTING=y
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
CONFIG_NUMA_BALANCING=y
CONFIG_MEMCG=y
CONFIG_BLK_CGROUP=y
CONFIG_CGROUP_PIDS=y
CONFIG_CGROUP_HUGETLB=y
CONFIG_CPUSETS=y
CONFIG_CGROUP_DEVICE=y
CONFIG_CGROUP_CPUACCT=y
CONFIG_CGROUP_PERF=y
CONFIG_USER_NS=y
CONFIG_SCHED_AUTOGROUP=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_KALLSYMS_ALL=y
# CONFIG_COMPAT_BRK is not set
CONFIG_PROFILING=y
CONFIG_ARCH_APPLE=y
# CONFIG_ARM64_ERRATUM_2054223 is not set
# CONFIG_ARM64_ERRATUM_2067961 is not set
# CONFIG_NVIDIA_CARMEL_CNP_ERRATUM is not set
CONFIG_ARM64_VA_BITS_48=y
CONFIG_SCHED_MC=y
CONFIG_SCHED_CLUSTER=y
CONFIG_NR_CPUS=64
CONFIG_NUMA=y
CONFIG_KEXEC=y
CONFIG_KEXEC_FILE=y
CONFIG_CRASH_DUMP=y
CONFIG_XEN=y
# CONFIG_ARM64_PTR_AUTH_KERNEL is not set
CONFIG_RANDOMIZE_BASE=y
CONFIG_HIBERNATION=y
CONFIG_WQ_POWER_EFFICIENT_DEFAULT=y
CONFIG_ENERGY_MODEL=y
CONFIG_ARM_CPUIDLE=y
CONFIG_ARM_PSCI_CPUIDLE=y
CONFIG_CPU_FREQ=y
CONFIG_CPU_FREQ_STAT=y
CONFIG_CPU_FREQ_GOV_POWERSAVE=m
CONFIG_CPU_FREQ_GOV_USERSPACE=y
CONFIG_CPU_FREQ_GOV_ONDEMAND=y
CONFIG_CPU_FREQ_GOV_CONSERVATIVE=m
CONFIG_CPUFREQ_DT=y
CONFIG_ACPI=y
CONFIG_ACPI_APEI=y
CONFIG_ACPI_APEI_GHES=y
CONFIG_ACPI_APEI_MEMORY_FAILURE=y
CONFIG_ACPI_APEI_EINJ=y
CONFIG_VIRTUALIZATION=y
CONFIG_KVM=y
CONFIG_CRYPTO_SHA1_ARM64_CE=y
CONFIG_CRYPTO_SHA2_ARM64_CE=y
CONFIG_CRYPTO_SHA512_ARM64_CE=m
CONFIG_CRYPTO_SHA3_ARM64=m
CONFIG_CRYPTO_SM3_ARM64_CE=m
CONFIG_CRYPTO_GHASH_ARM64_CE=y
CONFIG_CRYPTO_AES_ARM64=y
CONFIG_CRYPTO_AES_ARM64_CE_CCM=y
CONFIG_CRYPTO_AES_ARM64_CE_BLK=y
CONFIG_CRYPTO_AES_ARM64_BS=m
CONFIG_JUMP_LABEL=y
CONFIG_MODULES=y
CONFIG_MODULE_UNLOAD=y
# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
CONFIG_KSM=y
CONFIG_MEMORY_FAILURE=y
CONFIG_TRANSPARENT_HUGEPAGE=y
CONFIG_CMA=y
CONFIG_NET=y
CONFIG_PACKET=y
CONFIG_UNIX=y
CONFIG_INET=y
CONFIG_IP_MULTICAST=y
CONFIG_IP_PNP=y
CONFIG_IP_PNP_DHCP=y
CONFIG_IP_PNP_BOOTP=y
CONFIG_IPV6=m
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_FILTER=m
CONFIG_IP_NF_TARGET_REJECT=m
CONFIG_IP_NF_NAT=m
CONFIG_IP_NF_TARGET_MASQUERADE=m
CONFIG_IP_NF_MANGLE=m
CONFIG_IP6_NF_IPTABLES=m
CONFIG_IP6_NF_FILTER=m
CONFIG_IP6_NF_TARGET_REJECT=m
CONFIG_IP6_NF_MANGLE=m
CONFIG_IP6_NF_NAT=m
CONFIG_IP6_NF_TARGET_MASQUERADE=m
CONFIG_BRIDGE=m
CONFIG_BRIDGE_VLAN_FILTERING=y
CONFIG_NET_DSA=m
CONFIG_VLAN_8021Q=m
CONFIG_VLAN_8021Q_GVRP=y
CONFIG_VLAN_8021Q_MVRP=y
CONFIG_NET_SCHED=y
CONFIG_NET_SCH_CBS=m
CONFIG_NET_SCH_ETF=m
CONFIG_NET_SCH_TAPRIO=m
CONFIG_NET_SCH_MQPRIO=m
CONFIG_NET_SCH_INGRESS=m
CONFIG_NET_CLS_BASIC=m
CONFIG_NET_CLS_FLOWER=m
CONFIG_NET_CLS_ACT=y
CONFIG_NET_ACT_GACT=m
CONFIG_NET_ACT_MIRRED=m
CONFIG_NET_ACT_GATE=m
CONFIG_QRTR=m
CONFIG_QRTR_TUN=m
CONFIG_CAN=m
CONFIG_CAN_FLEXCAN=m
CONFIG_BT=m
CONFIG_BT_HIDP=m
# CONFIG_BT_LE is not set
# CONFIG_BT_DEBUGFS is not set
CONFIG_BT_HCIBTUSB=m
CONFIG_BT_HCIUART=m
CONFIG_BT_HCIUART_LL=y
CONFIG_BT_HCIUART_BCM=y
CONFIG_BT_HCIUART_QCA=y
CONFIG_CFG80211=m
CONFIG_MAC80211=m
CONFIG_RFKILL=m
CONFIG_RFKILL_GPIO=m
# CONFIG_NET_9P=y
# CONFIG_NET_9P_VIRTIO=y
CONFIG_NFC=m
CONFIG_NFC_NCI=m
CONFIG_NFC_S3FWRN5_I2C=m
CONFIG_PCI=y
CONFIG_PCIEPORTBUS=y
CONFIG_PCI_IOV=y
CONFIG_PCI_PASID=y
CONFIG_HOTPLUG_PCI=y
CONFIG_HOTPLUG_PCI_ACPI=y
CONFIG_PCI_HOST_GENERIC=y
CONFIG_PCIE_APPLE=y
CONFIG_PCIE_DW_PLAT_HOST=y
CONFIG_PCI_ENDPOINT=y
CONFIG_PCI_ENDPOINT_CONFIGFS=y
CONFIG_PCI_EPF_TEST=m
CONFIG_UEVENT_HELPER=y
CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
CONFIG_EFI_BOOTLOADER_CONTROL=y
CONFIG_EFI_CAPSULE_LOADER=y
CONFIG_BLK_DEV_LOOP=y
CONFIG_BLK_DEV_NBD=m
CONFIG_VIRTIO_BLK=y
CONFIG_BLK_DEV_NVME=m
CONFIG_SRAM=y
CONFIG_DW_XDATA_PCIE=y
CONFIG_PCI_ENDPOINT_TEST=m
CONFIG_EEPROM_AT24=m
CONFIG_SCSI=y
# CONFIG_SCSI_PROC_FS is not set
CONFIG_BLK_DEV_SD=y
CONFIG_MD=y
CONFIG_BLK_DEV_MD=m
CONFIG_BLK_DEV_DM=m
CONFIG_DM_MIRROR=m
CONFIG_DM_ZERO=m
CONFIG_DM_CRYPT=m
CONFIG_NETDEVICES=y
CONFIG_WIREGUARD=m
CONFIG_MACVLAN=m
CONFIG_MACVTAP=m
CONFIG_IPVLAN=m
CONFIG_IPVTAP=m
CONFIG_TUN=y
CONFIG_VETH=m
CONFIG_VIRTIO_NET=y
# CONFIG_NET_VENDOR_3COM is not set
# CONFIG_NET_VENDOR_ADAPTEC is not set
# CONFIG_NET_VENDOR_AGERE is not set
# CONFIG_NET_VENDOR_ALACRITECH is not set
# CONFIG_NET_VENDOR_ALTEON is not set
# CONFIG_NET_VENDOR_AMAZON is not set
# CONFIG_NET_VENDOR_AMD is not set
CONFIG_AQTION=y
# CONFIG_NET_VENDOR_ARC is not set
# CONFIG_NET_VENDOR_ATHEROS is not set
CONFIG_TIGON3=y
# CONFIG_NET_VENDOR_BROCADE is not set
# CONFIG_NET_VENDOR_CADENCE is not set
# CONFIG_NET_VENDOR_CAVIUM is not set
# CONFIG_NET_VENDOR_CHELSIO is not set
# CONFIG_NET_VENDOR_CISCO is not set
# CONFIG_NET_VENDOR_CORTINA is not set
# CONFIG_NET_VENDOR_DEC is not set
# CONFIG_NET_VENDOR_DLINK is not set
# CONFIG_NET_VENDOR_EMULEX is not set
# CONFIG_NET_VENDOR_EZCHIP is not set
# CONFIG_NET_VENDOR_GOOGLE is not set
# CONFIG_NET_VENDOR_HISILICON is not set
# CONFIG_NET_VENDOR_HUAWEI is not set
# CONFIG_NET_VENDOR_INTEL is not set
# CONFIG_NET_VENDOR_MICROSOFT is not set
# CONFIG_NET_VENDOR_LITEX is not set
# CONFIG_NET_VENDOR_MARVELL is not set
# CONFIG_NET_VENDOR_MELLANOX is not set
# CONFIG_NET_VENDOR_MICREL is not set
# CONFIG_NET_VENDOR_MICROCHIP is not set
# CONFIG_NET_VENDOR_MICROSEMI is not set
# CONFIG_NET_VENDOR_MYRI is not set
# CONFIG_NET_VENDOR_NATSEMI is not set
# CONFIG_NET_VENDOR_NETERION is not set
# CONFIG_NET_VENDOR_NETRONOME is not set
# CONFIG_NET_VENDOR_NI is not set
# CONFIG_NET_VENDOR_NVIDIA is not set
# CONFIG_NET_VENDOR_OKI is not set
# CONFIG_NET_VENDOR_PACKET_ENGINES is not set
# CONFIG_NET_VENDOR_PENSANDO is not set
# CONFIG_NET_VENDOR_QLOGIC is not set
# CONFIG_NET_VENDOR_QUALCOMM is not set
# CONFIG_NET_VENDOR_RDC is not set
# CONFIG_NET_VENDOR_REALTEK is not set
# CONFIG_NET_VENDOR_RENESAS is not set
# CONFIG_NET_VENDOR_ROCKER is not set
# CONFIG_NET_VENDOR_SAMSUNG is not set
# CONFIG_NET_VENDOR_SEEQ is not set
# CONFIG_NET_VENDOR_SOLARFLARE is not set
# CONFIG_NET_VENDOR_SILAN is not set
# CONFIG_NET_VENDOR_SIS is not set
# CONFIG_NET_VENDOR_SMSC is not set
# CONFIG_NET_VENDOR_SOCIONEXT is not set
# CONFIG_NET_VENDOR_STMICRO is not set
# CONFIG_NET_VENDOR_SUN is not set
# CONFIG_NET_VENDOR_SYNOPSYS is not set
# CONFIG_NET_VENDOR_TEHUTI is not set
# CONFIG_NET_VENDOR_TI is not set
# CONFIG_NET_VENDOR_VIA is not set
# CONFIG_NET_VENDOR_WIZNET is not set
# CONFIG_NET_VENDOR_XILINX is not set
CONFIG_USB_RTL8150=y
CONFIG_USB_RTL8152=y
CONFIG_USB_LAN78XX=y
CONFIG_USB_USBNET=y
CONFIG_USB_NET_SMSC75XX=y
CONFIG_USB_NET_SMSC95XX=y
# CONFIG_USB_NET_NET1080 is not set
# CONFIG_USB_NET_ZAURUS is not set
CONFIG_USB_IPHETH=y
# CONFIG_WLAN_VENDOR_ADMTEK is not set
# CONFIG_WLAN_VENDOR_ATH is not set
# CONFIG_WLAN_VENDOR_ATMEL is not set
# CONFIG_WLAN_VENDOR_CISCO is not set
# CONFIG_WLAN_VENDOR_INTEL is not set
# CONFIG_WLAN_VENDOR_INTERSIL is not set
# CONFIG_WLAN_VENDOR_MARVELL is not set
# CONFIG_WLAN_VENDOR_MEDIATEK is not set
# CONFIG_WLAN_VENDOR_MICROCHIP is not set
# CONFIG_WLAN_VENDOR_RALINK is not set
# CONFIG_WLAN_VENDOR_REALTEK is not set
# CONFIG_WLAN_VENDOR_RSI is not set
# CONFIG_WLAN_VENDOR_ST is not set
# CONFIG_WLAN_VENDOR_TI is not set
# CONFIG_WLAN_VENDOR_ZYDAS is not set
# CONFIG_WLAN_VENDOR_QUANTENNA is not set
# CONFIG_XEN_NETDEV_FRONTEND is not set
CONFIG_INPUT_EVDEV=y
CONFIG_KEYBOARD_APPLESPI=y
CONFIG_INPUT_TOUCHSCREEN=y
CONFIG_TOUCHSCREEN_ATMEL_MXT=m
CONFIG_TOUCHSCREEN_EDT_FT5X06=m
CONFIG_INPUT_MISC=y
# CONFIG_SERIO_SERPORT is not set
CONFIG_SERIO_AMBAKMI=y
CONFIG_LEGACY_PTY_COUNT=16
CONFIG_SERIAL_8250=y
CONFIG_SERIAL_8250_CONSOLE=y
CONFIG_SERIAL_8250_EXTENDED=y
CONFIG_SERIAL_8250_SHARE_IRQ=y
CONFIG_SERIAL_8250_DW=y
CONFIG_SERIAL_OF_PLATFORM=y
CONFIG_SERIAL_AMBA_PL011=y
CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
CONFIG_SERIAL_SAMSUNG=y
CONFIG_SERIAL_SAMSUNG_CONSOLE=y
CONFIG_SERIAL_DEV_BUS=y
CONFIG_VIRTIO_CONSOLE=y
CONFIG_I2C_CHARDEV=y
CONFIG_I2C_MUX=y
# CONFIG_I2C_HELPER_AUTO is not set
CONFIG_I2C_SMBUS=y
CONFIG_SPI=y
CONFIG_SPI_DEBUG=y
CONFIG_SPI_APPLE=y
# CONFIG_PTP_1588_CLOCK is not set
CONFIG_PINCTRL=y
CONFIG_PINCTRL_APPLE_GPIO=y
# CONFIG_HWMON is not set
CONFIG_THERMAL_WRITABLE_TRIPS=y
CONFIG_THERMAL_GOV_USER_SPACE=y
CONFIG_WATCHDOG=y
CONFIG_APPLE_WATCHDOG=y
CONFIG_MFD_SYSCON=y
CONFIG_MEDIA_SUPPORT=m
CONFIG_MEDIA_CAMERA_SUPPORT=y
CONFIG_MEDIA_ANALOG_TV_SUPPORT=y
CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y
CONFIG_MEDIA_SDR_SUPPORT=y
CONFIG_MEDIA_PLATFORM_SUPPORT=y
CONFIG_VIDEO_V4L2_SUBDEV_API=y
CONFIG_MEDIA_USB_SUPPORT=y
CONFIG_USB_VIDEO_CLASS=m
CONFIG_USB_GSPCA=m
CONFIG_V4L_PLATFORM_DRIVERS=y
CONFIG_V4L_MEM2MEM_DRIVERS=y
CONFIG_DRM=y
CONFIG_DRM_SIMPLEDRM=y
CONFIG_FB=y
CONFIG_FB_MODE_HELPERS=y
CONFIG_FB_TILEBLITTING=y
CONFIG_FB_EFI=y
# CONFIG_XEN_FBDEV_FRONTEND is not set
CONFIG_LOGO=y
# CONFIG_LOGO_LINUX_MONO is not set
# CONFIG_LOGO_LINUX_VGA16 is not set
CONFIG_SOUND=y
CONFIG_SND=y
CONFIG_USB_ULPI_BUS=y
CONFIG_USB_CONN_GPIO=y
CONFIG_USB=y
CONFIG_USB_OTG=y
CONFIG_USB_MON=m
CONFIG_USB_XHCI_HCD=y
CONFIG_USB_EHCI_HCD=y
CONFIG_USB_EHCI_HCD_PLATFORM=y
CONFIG_USB_ACM=m
CONFIG_USB_STORAGE=y
CONFIG_USB_UAS=y
CONFIG_USB_DWC3=y
CONFIG_USB_DWC3_ULPI=y
CONFIG_USB_DWC2=y
CONFIG_USB_DWC2_HOST=y
CONFIG_USB_DWC2_PCI=y
CONFIG_USB_SERIAL=m
CONFIG_USB_SERIAL_CP210X=m
CONFIG_USB_SERIAL_FTDI_SIO=m
CONFIG_USB_SERIAL_OPTION=m
CONFIG_USB_GPIO_VBUS=y
CONFIG_USB_ULPI=y
CONFIG_USB_GADGET=y
CONFIG_U_SERIAL_CONSOLE=y
CONFIG_USB_SNP_UDC_PLAT=y
CONFIG_USB_CONFIGFS=m
CONFIG_USB_CONFIGFS_SERIAL=y
CONFIG_USB_CONFIGFS_ACM=y
CONFIG_USB_CONFIGFS_OBEX=y
CONFIG_USB_CONFIGFS_NCM=y
CONFIG_USB_CONFIGFS_ECM=y
CONFIG_USB_CONFIGFS_ECM_SUBSET=y
CONFIG_USB_CONFIGFS_RNDIS=y
CONFIG_USB_CONFIGFS_EEM=y
CONFIG_USB_CONFIGFS_MASS_STORAGE=y
CONFIG_USB_CONFIGFS_F_FS=y
CONFIG_USB_G_SERIAL=y
CONFIG_USB_CDC_COMPOSITE=y
CONFIG_TYPEC=y
CONFIG_TYPEC_TCPM=y
CONFIG_TYPEC_TPS6598X=y
CONFIG_TYPEC_DP_ALTMODE=m
CONFIG_NEW_LEDS=y
CONFIG_LEDS_CLASS=y
CONFIG_LEDS_CLASS_FLASH=y
CONFIG_LEDS_CLASS_MULTICOLOR=y
CONFIG_LEDS_BRIGHTNESS_HW_CHANGED=y
CONFIG_UDMABUF=y
CONFIG_DMABUF_HEAPS=y
CONFIG_DMABUF_SYSFS_STATS=y
CONFIG_DMABUF_HEAPS_SYSTEM=y
CONFIG_DMABUF_HEAPS_CMA=y
# CONFIG_VIRTIO_MENU is not set
# CONFIG_VHOST_MENU is not set
# CONFIG_XEN_PCIDEV_STUB is not set
CONFIG_MAILBOX=y
CONFIG_GENERIC_PHY=y
CONFIG_VALIDATE_FS_PARSER=y
CONFIG_EXT3_FS=y
CONFIG_EXT4_FS_POSIX_ACL=y
CONFIG_BTRFS_FS=m
CONFIG_BTRFS_FS_POSIX_ACL=y
CONFIG_FANOTIFY=y
CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
CONFIG_QUOTA=y
CONFIG_AUTOFS4_FS=y
CONFIG_FUSE_FS=m
CONFIG_CUSE=m
CONFIG_OVERLAY_FS=m
CONFIG_VFAT_FS=y
CONFIG_EXFAT_FS=y
CONFIG_TMPFS=y
CONFIG_TMPFS_POSIX_ACL=y
CONFIG_HUGETLBFS=y
CONFIG_EFIVAR_FS=y
CONFIG_SQUASHFS=y
CONFIG_NFS_FS=y
CONFIG_NFS_V4=y
CONFIG_NFS_V4_1=y
CONFIG_NFS_V4_2=y
CONFIG_ROOT_NFS=y
CONFIG_9P_FS=y
CONFIG_NLS_CODEPAGE_437=y
CONFIG_NLS_ISO8859_1=y
CONFIG_SECURITY=y
CONFIG_CRYPTO_CRYPTD=y
CONFIG_CRYPTO_ECHAINIV=y
CONFIG_CRYPTO_ANSI_CPRNG=y
CONFIG_CRYPTO_USER_API_RNG=m
CONFIG_CRYPTO_DEV_CCREE=m
CONFIG_CRYPTO_DEV_HISI_SEC2=m
CONFIG_CRYPTO_DEV_HISI_ZIP=m
CONFIG_CRYPTO_DEV_HISI_HPRE=m
CONFIG_CRYPTO_DEV_HISI_TRNG=m
CONFIG_DMA_CMA=y
CONFIG_CMA_SIZE_MBYTES=128
CONFIG_PRINTK_TIME=y
CONFIG_DEBUG_INFO=y
CONFIG_DEBUG_INFO_REDUCED=y
CONFIG_MAGIC_SYSRQ=y
CONFIG_DEBUG_FS=y
CONFIG_DEBUG_KERNEL=y
# CONFIG_SCHED_DEBUG is not set
CONFIG_FUNCTION_TRACER=y
CONFIG_MEMTEST=y
# additional nixos mandatory kernel configs
CONFIG_CGROUPS=y
CONFIG_INOTIFY_USER=y
CONFIG_SIGNALFD=y
CONFIG_TIMERFD=y
CONFIG_EPOLL=y
CONFIG_SYSFS=y
CONFIG_PROC_FS=y
CONFIG_FHANDLE=y
CONFIG_CRYPTO_USER_API_HASH=y
CONFIG_CRYPTO_HMAC=y
CONFIG_CRYPTO_SHA256=y
CONFIG_ISO9660_FS=y
CONFIG_ZISOFS=n
CONFIG_JOLIET=y
CONFIG_SQUASHFS_XZ=y
CONFIG_SQUASHFS_ZSTD=y
CONFIG_DMIID=y
CONFIG_TMPFS_XATTR=y
CONFIG_SECCOMP=y
CONFIG_BINFMT_ELF=y
CONFIG_BINFMT_MISC=y
CONFIG_EFI_STUB=y
CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER=y
CONFIG_FW_LOADER_COMPRESS=y
# stuff for the keyboard?
CONFIG_SPI_HID_APPLE=y
CONFIG_HID_APPLE=y
CONFIG_HID_MAGICMOUSE=y
CONFIG_APPLE_SART=y
CONFIG_APPLE_RTKIT=y
CONFIG_NVME_APPLE=y
# stuff for sound?
CONFIG_SND_SOC=y
CONFIG_SND_SOC_GENERIC_DMAENGINE_PCM=y
CONFIG_SND_SIMPLE_CARD=y
CONFIG_SND_SIMPLE_CARD_UTILS=y
CONFIG_SND_SOC_CS42L42=y
CONFIG_SND_SOC_TAS2770=y
CONFIG_DMADEVICES=y
CONFIG_APPLE_ADMAC=y
CONFIG_SND_SOC_APPLE_MCA=y
# stuff for wifi
CONFIG_WLAN=y
CONFIG_WLAN_VENDOR_BROADCOM=y
CONFIG_BRCMUTIL=m
CONFIG_BRCMFMAC=m
CONFIG_BRCMFMAC_PROTO_MSGBUF=y
CONFIG_BRCMFMAC_PCIE=y
# new stuff for 5.17
CONFIG_SPMI=y
CONFIG_SPMI_APPLE=y
CONFIG_CHARGER_MACSMC=y
CONFIG_GPIOLIB=y
CONFIG_GPIOLIB_IRQCHIP=y
CONFIG_GPIO_MACSMC=y
CONFIG_BACKLIGHT_GPIO=y
# nftables related config
CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
CONFIG_BRIDGE_NETFILTER=m
#
# Core Netfilter Configuration
#
CONFIG_NETFILTER_INGRESS=y
CONFIG_NETFILTER_EGRESS=y
CONFIG_NETFILTER_SKIP_EGRESS=y
CONFIG_NETFILTER_NETLINK=m
CONFIG_NETFILTER_FAMILY_BRIDGE=y
CONFIG_NETFILTER_FAMILY_ARP=y
CONFIG_NETFILTER_NETLINK_HOOK=m
CONFIG_NETFILTER_NETLINK_ACCT=m
CONFIG_NETFILTER_NETLINK_QUEUE=m
CONFIG_NETFILTER_NETLINK_LOG=m
CONFIG_NETFILTER_NETLINK_OSF=m
CONFIG_NF_CONNTRACK=m
CONFIG_NF_LOG_SYSLOG=m
CONFIG_NETFILTER_CONNCOUNT=m
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_ZONES=y
CONFIG_NF_CONNTRACK_PROCFS=y
CONFIG_NF_CONNTRACK_EVENTS=y
CONFIG_NF_CONNTRACK_TIMEOUT=y
CONFIG_NF_CONNTRACK_TIMESTAMP=y
CONFIG_NF_CONNTRACK_LABELS=y
CONFIG_NF_CT_PROTO_DCCP=y
CONFIG_NF_CT_PROTO_GRE=y
CONFIG_NF_CT_PROTO_SCTP=y
CONFIG_NF_CT_PROTO_UDPLITE=y
CONFIG_NF_CONNTRACK_AMANDA=m
CONFIG_NF_CONNTRACK_FTP=m
CONFIG_NF_CONNTRACK_H323=m
CONFIG_NF_CONNTRACK_IRC=m
CONFIG_NF_CONNTRACK_BROADCAST=m
CONFIG_NF_CONNTRACK_NETBIOS_NS=m
CONFIG_NF_CONNTRACK_SNMP=m
CONFIG_NF_CONNTRACK_PPTP=m
CONFIG_NF_CONNTRACK_SANE=m
CONFIG_NF_CONNTRACK_SIP=m
CONFIG_NF_CONNTRACK_TFTP=m
CONFIG_NF_CT_NETLINK=m
CONFIG_NF_CT_NETLINK_TIMEOUT=m
CONFIG_NF_CT_NETLINK_HELPER=m
CONFIG_NETFILTER_NETLINK_GLUE_CT=y
CONFIG_NF_NAT=m
CONFIG_NF_NAT_AMANDA=m
CONFIG_NF_NAT_FTP=m
CONFIG_NF_NAT_IRC=m
CONFIG_NF_NAT_SIP=m
CONFIG_NF_NAT_TFTP=m
CONFIG_NF_NAT_REDIRECT=y
CONFIG_NF_NAT_MASQUERADE=y
CONFIG_NETFILTER_SYNPROXY=m
CONFIG_NF_TABLES=m
CONFIG_NF_TABLES_INET=y
CONFIG_NF_TABLES_NETDEV=y
CONFIG_NFT_NUMGEN=m
CONFIG_NFT_CT=m
CONFIG_NFT_FLOW_OFFLOAD=m
CONFIG_NFT_CONNLIMIT=m
CONFIG_NFT_LOG=m
CONFIG_NFT_LIMIT=m
CONFIG_NFT_MASQ=m
CONFIG_NFT_REDIR=m
CONFIG_NFT_NAT=m
CONFIG_NFT_TUNNEL=m
CONFIG_NFT_OBJREF=m
CONFIG_NFT_QUEUE=m
CONFIG_NFT_QUOTA=m
CONFIG_NFT_REJECT=m
CONFIG_NFT_REJECT_INET=m
CONFIG_NFT_COMPAT=m
CONFIG_NFT_HASH=m
CONFIG_NFT_FIB=m
CONFIG_NFT_FIB_INET=m
CONFIG_NFT_XFRM=m
CONFIG_NFT_SOCKET=m
CONFIG_NFT_OSF=m
CONFIG_NFT_TPROXY=m
CONFIG_NFT_SYNPROXY=m
CONFIG_NF_DUP_NETDEV=m
CONFIG_NFT_DUP_NETDEV=m
CONFIG_NFT_FWD_NETDEV=m
CONFIG_NFT_FIB_NETDEV=m
CONFIG_NFT_REJECT_NETDEV=m
CONFIG_NF_FLOW_TABLE_INET=m
CONFIG_NF_FLOW_TABLE=m
CONFIG_NETFILTER_XTABLES=y
#
# Xtables combined modules
#
CONFIG_NETFILTER_XT_MARK=m
CONFIG_NETFILTER_XT_CONNMARK=m
CONFIG_NETFILTER_XT_SET=m
#
# Xtables targets
#
CONFIG_NETFILTER_XT_TARGET_AUDIT=m
CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
CONFIG_NETFILTER_XT_TARGET_CONNMARK=m
CONFIG_NETFILTER_XT_TARGET_CT=m
CONFIG_NETFILTER_XT_TARGET_DSCP=m
CONFIG_NETFILTER_XT_TARGET_HL=m
CONFIG_NETFILTER_XT_TARGET_HMARK=m
CONFIG_NETFILTER_XT_TARGET_IDLETIMER=m
CONFIG_NETFILTER_XT_TARGET_LED=m
CONFIG_NETFILTER_XT_TARGET_LOG=m
CONFIG_NETFILTER_XT_TARGET_MARK=m
CONFIG_NETFILTER_XT_NAT=m
CONFIG_NETFILTER_XT_TARGET_NETMAP=m
CONFIG_NETFILTER_XT_TARGET_NFLOG=m
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set
CONFIG_NETFILTER_XT_TARGET_RATEEST=m
CONFIG_NETFILTER_XT_TARGET_REDIRECT=m
CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m
CONFIG_NETFILTER_XT_TARGET_TEE=m
CONFIG_NETFILTER_XT_TARGET_TPROXY=m
CONFIG_NETFILTER_XT_TARGET_TRACE=m
CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
#
# Xtables matches
#
CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_NETFILTER_XT_MATCH_CGROUP=m
CONFIG_NETFILTER_XT_MATCH_CLUSTER=m
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m
CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_CPU=m
CONFIG_NETFILTER_XT_MATCH_DCCP=m
CONFIG_NETFILTER_XT_MATCH_DEVGROUP=m
CONFIG_NETFILTER_XT_MATCH_DSCP=m
CONFIG_NETFILTER_XT_MATCH_ECN=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HASHLIMIT=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_HL=m
CONFIG_NETFILTER_XT_MATCH_IPCOMP=m
CONFIG_NETFILTER_XT_MATCH_IPRANGE=m
CONFIG_NETFILTER_XT_MATCH_IPVS=m
CONFIG_NETFILTER_XT_MATCH_L2TP=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
CONFIG_NETFILTER_XT_MATCH_LIMIT=m
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
CONFIG_NETFILTER_XT_MATCH_NFACCT=m
CONFIG_NETFILTER_XT_MATCH_OSF=m
CONFIG_NETFILTER_XT_MATCH_OWNER=m
CONFIG_NETFILTER_XT_MATCH_POLICY=m
CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
CONFIG_NETFILTER_XT_MATCH_QUOTA=m
CONFIG_NETFILTER_XT_MATCH_RATEEST=m
CONFIG_NETFILTER_XT_MATCH_REALM=m
CONFIG_NETFILTER_XT_MATCH_RECENT=m
CONFIG_NETFILTER_XT_MATCH_SCTP=m
CONFIG_NETFILTER_XT_MATCH_SOCKET=m
CONFIG_NETFILTER_XT_MATCH_STATE=m
CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
CONFIG_NETFILTER_XT_MATCH_STRING=m
CONFIG_NETFILTER_XT_MATCH_TCPMSS=m
CONFIG_NETFILTER_XT_MATCH_TIME=m
CONFIG_NETFILTER_XT_MATCH_U32=m
# end of Core Netfilter Configuration

13
machines/nat/m1-support/kernel/default-pagesize-16k.patch Normal file
View File

@@ -0,0 +1,13 @@
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index a1eb6572ecd2..b94fbd9b3d70 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1036,7 +1036,7 @@ endmenu
choice
prompt "Page size"
- default ARM64_4K_PAGES
+ default ARM64_16K_PAGES
help
Page size (translation granule) configuration.

62
machines/nat/m1-support/kernel/default.nix Normal file
View File

@@ -0,0 +1,62 @@
# the Asahi Linux kernel and options that must go along with it
{ config, pkgs, lib, ... }:
{
config = {
boot.kernelPackages = pkgs.callPackage ./package.nix {
crossBuild = config.boot.kernelBuildIsCross;
_16KBuild = config.boot.kernelBuildIs16K;
};
# we definitely want to use CONFIG_ENERGY_MODEL, and
# schedutil is a prerequisite for using it
# source: https://www.kernel.org/doc/html/latest/scheduler/sched-energy.html
powerManagement.cpuFreqGovernor = lib.mkOverride 800 "schedutil";
# our kernel config is weird and doesn't really have any modules
# remove?
# boot.initrd.availableKernelModules = lib.mkForce [];
boot.initrd.availableKernelModules = lib.mkForce [ "dm_crypt" ];
boot.kernelParams = [
"earlycon"
"console=ttySAC0,1500000"
"console=tty0"
"boot.shell_on_fail"
# Apple's SSDs are slow (~dozens of ms) at processing flush requests which
# slows down programs that make a lot of fsync calls. This parameter sets
# a delay in ms before actually flushing so that such requests can be
# coalesced. Be warned that increasing this parameter above zero (default
# is 1000) has the potential, though admittedly unlikely, risk of
# UNBOUNDED data corruption in case of power loss!!!! Don't even think
# about it on desktops!!
"nvme_apple.flush_interval=1000"
];
# U-Boot does not support EFI variables
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
# GRUB has to be installed as removable if the user chooses to use it
boot.loader.grub = lib.mkDefault {
version = 2;
efiSupport = true;
efiInstallAsRemovable = true;
device = "nodev";
};
};
options.boot.kernelBuildIsCross = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Set that the Asahi Linux kernel should be cross-compiled.";
};
options.boot.kernelBuildIs16K = lib.mkOption {
type = lib.types.bool;
default = true;
description = ''
Set that the Asahi Linux kernel should be built with 16K pages and various
software patched to be compatible. Some software may still be broken.
'';
};
}

67
machines/nat/m1-support/kernel/package.nix Normal file
View File

@@ -0,0 +1,67 @@
{ pkgs, crossBuild ? false, _16KBuild ? false }: let
buildPkgs = if crossBuild then
import (pkgs.path) {
system = "x86_64-linux";
crossSystem.system = "aarch64-linux";
}
else pkgs;
# we do this so the config can be read on any system and not affect
# the output hash
localPkgs = import (pkgs.path) { system = "aarch64-linux"; };
readConfig = configfile: import (localPkgs.runCommand "config.nix" {} ''
echo "{" > "$out"
while IFS='=' read key val; do
[ "x''${key#CONFIG_}" != "x$key" ] || continue
no_firstquote="''${val#\"}";
echo ' "'"$key"'" = "'"''${no_firstquote%\"}"'";' >> "$out"
done < "${configfile}"
echo "}" >> $out
'').outPath;
linux_asahi_pkg = { stdenv, lib, fetchFromGitHub, fetchpatch, linuxKernel, ... } @ args:
linuxKernel.manualConfig rec {
inherit stdenv lib;
version = "5.19.0-rc7-asahi";
modDirVersion = version;
src = fetchFromGitHub {
# tracking branch: https://github.com/AsahiLinux/linux/tree/asahi
owner = "AsahiLinux";
repo = "linux";
rev = "c7d02d6615a5fb4afefd3084fce93d86e5fb184d";
hash = "sha256-sed405+6L5U7S+Na2DNLGPNTNf3tv96LjK3CimeRjNU=";
};
kernelPatches = [
] ++ lib.optionals (!_16KBuild) [
# thanks to Sven Peter
# https://lore.kernel.org/linux-iommu/20211019163737.46269-1-sven@svenpeter.dev/
{ name = "sven-iommu-4k";
patch = ./sven-iommu-4k.patch;
}
] ++ lib.optionals _16KBuild [
# patch the kernel to set the default size to 16k so we don't need to
# convert our config to the nixos infrastructure or patch it and thus
# introduce a dependency on the host system architecture
{ name = "default-pagesize-16k";
patch = ./default-pagesize-16k.patch;
}
];
configfile = ./config;
config = readConfig configfile;
extraMeta.branch = "5.19";
} // (args.argsOverride or {});
linux_asahi = (buildPkgs.callPackage linux_asahi_pkg { }).overrideAttrs (o: {
# use 5.19 suitable randstruct seed patch
# to be removed when https://github.com/NixOS/nixpkgs/pull/180750 is
# accepted and percolates through
patches = (builtins.filter
(v: (pkgs.lib.hasInfix "randstruct" (builtins.path { path = v; })) != true)
o.patches) ++ [ ./randstruct-provide-seed-5.19.patch ];
});
in buildPkgs.recurseIntoAttrs (buildPkgs.linuxPackagesFor linux_asahi)

13
machines/nat/m1-support/kernel/randstruct-provide-seed-5.19.patch Normal file
View File

@@ -0,0 +1,13 @@
diff --git a/scripts/gen-randstruct-seed.sh b/scripts/gen-randstruct-seed.sh
index 61017b36c464..7bb494dd2e18 100755
--- a/scripts/gen-randstruct-seed.sh
+++ b/scripts/gen-randstruct-seed.sh
@@ -1,7 +1,7 @@
#!/bin/sh
# SPDX-License-Identifier: GPL-2.0
-SEED=$(od -A n -t x8 -N 32 /dev/urandom | tr -d ' \n')
+SEED="NIXOS_RANDSTRUCT_SEED"
echo "$SEED" > "$1"
HASH=$(echo -n "$SEED" | sha256sum | cut -d" " -f1)
echo "#define RANDSTRUCT_HASHED_SEED \"$HASH\"" > "$2"

449
machines/nat/m1-support/kernel/sven-iommu-4k.patch Normal file
View File

@@ -0,0 +1,449 @@
diff --git a/drivers/iommu/apple-dart.c b/drivers/iommu/apple-dart.c
index 4f1a37bdd42d..c8c3ea81d818 100644
--- a/drivers/iommu/apple-dart.c
+++ b/drivers/iommu/apple-dart.c
@@ -97,7 +97,6 @@ struct apple_dart_hw {
* @lock: lock for hardware operations involving this dart
* @pgsize: pagesize supported by this DART
* @supports_bypass: indicates if this DART supports bypass mode
- * @force_bypass: force bypass mode due to pagesize mismatch?
* @sid2group: maps stream ids to iommu_groups
* @iommu: iommu core device
*/
@@ -115,7 +114,6 @@ struct apple_dart {
u32 pgsize;
u32 supports_bypass : 1;
- u32 force_bypass : 1;
struct iommu_group *sid2group[DART_MAX_STREAMS];
struct iommu_device iommu;
@@ -499,9 +497,6 @@ static int apple_dart_attach_dev(struct iommu_domain *domain,
struct apple_dart_master_cfg *cfg = dev_iommu_priv_get(dev);
struct apple_dart_domain *dart_domain = to_dart_domain(domain);
- if (cfg->stream_maps[0].dart->force_bypass &&
- domain->type != IOMMU_DOMAIN_IDENTITY)
- return -EINVAL;
if (!cfg->stream_maps[0].dart->supports_bypass &&
domain->type == IOMMU_DOMAIN_IDENTITY)
return -EINVAL;
@@ -630,8 +625,6 @@ static int apple_dart_of_xlate(struct device *dev, struct of_phandle_args *args)
if (cfg_dart) {
if (cfg_dart->supports_bypass != dart->supports_bypass)
return -EINVAL;
- if (cfg_dart->force_bypass != dart->force_bypass)
- return -EINVAL;
if (cfg_dart->pgsize != dart->pgsize)
return -EINVAL;
}
@@ -736,8 +729,6 @@ static int apple_dart_def_domain_type(struct device *dev)
{
struct apple_dart_master_cfg *cfg = dev_iommu_priv_get(dev);
- if (cfg->stream_maps[0].dart->force_bypass)
- return IOMMU_DOMAIN_IDENTITY;
if (!cfg->stream_maps[0].dart->supports_bypass)
return IOMMU_DOMAIN_DMA;
@@ -1121,8 +1121,6 @@ static int apple_dart_probe(struct platform_device *pdev)
goto err_clk_disable;
}
- dart->force_bypass = dart->pgsize > PAGE_SIZE;
-
ret = apple_dart_hw_reset(dart);
if (ret)
goto err_clk_disable;
@@ -1149,8 +1147,8 @@ static int apple_dart_probe(struct platform_device *pdev)
dev_info(
&pdev->dev,
- "DART [pagesize %x, %d streams, bypass support: %d, bypass forced: %d] initialized\n",
- dart->pgsize, dart->num_streams, dart->supports_bypass, dart->force_bypass);
+ "DART [pagesize %x, %d streams, bypass support: %d] initialized\n",
+ dart->pgsize, dart->num_streams, dart->supports_bypass);
return 0;
err_sysfs_remove:
diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c
index 09f6e1c0f9c0..094592751cfa 100644
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -20,9 +20,11 @@
#include <linux/iommu.h>
#include <linux/iova.h>
#include <linux/irq.h>
+#include <linux/kernel.h>
#include <linux/list_sort.h>
#include <linux/mm.h>
#include <linux/mutex.h>
+#include <linux/pfn.h>
#include <linux/pci.h>
#include <linux/scatterlist.h>
#include <linux/spinlock.h>
@@ -710,6 +712,9 @@ static struct page **__iommu_dma_alloc_pages(struct device *dev,
{
struct page **pages;
unsigned int i = 0, nid = dev_to_node(dev);
+ unsigned int j;
+ unsigned long min_order = __fls(order_mask);
+ unsigned int min_order_size = 1U << min_order;
order_mask &= (2U << MAX_ORDER) - 1;
if (!order_mask)
@@ -749,15 +754,37 @@ static struct page **__iommu_dma_alloc_pages(struct device *dev,
split_page(page, order);
break;
}
- if (!page) {
- __iommu_dma_free_pages(pages, i);
- return NULL;
+
+ /*
+ * If we have no valid page here we might be trying to allocate
+ * the last block consisting of 1<<order pages (to guarantee
+ * alignment) but actually need less pages than that.
+ * In that case we just try to allocate the entire block and
+ * directly free the spillover pages again.
+ */
+ if (!page && !order_mask && count < min_order_size) {
+ page = alloc_pages_node(nid, gfp, min_order);
+ if (!page)
+ goto free_pages;
+ split_page(page, min_order);
+
+ for (j = count; j < min_order_size; ++j)
+ __free_page(page + j);
+
+ order_size = count;
}
+
+ if (!page)
+ goto free_pages;
count -= order_size;
while (order_size--)
pages[i++] = page++;
}
return pages;
+
+free_pages:
+ __iommu_dma_free_pages(pages, i);
+ return NULL;
}
/*
@@ -785,16 +787,28 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev,
bool coherent = dev_is_dma_coherent(dev);
int ioprot = dma_info_to_prot(DMA_BIDIRECTIONAL, coherent, attrs);
unsigned int count, min_size, alloc_sizes = domain->pgsize_bitmap;
+ struct sg_append_table sgt_append = {};
+ struct scatterlist *last_sg;
struct page **pages;
dma_addr_t iova;
ssize_t ret;
+ phys_addr_t orig_s_phys;
+ size_t orig_s_len, orig_s_off, s_iova_off, iova_size;
if (static_branch_unlikely(&iommu_deferred_attach_enabled) &&
iommu_deferred_attach(dev, domain))
return NULL;
min_size = alloc_sizes & -alloc_sizes;
- if (min_size < PAGE_SIZE) {
+ if (iovad->granule > PAGE_SIZE) {
+ if (size < iovad->granule) {
+ /* ensure a single contiguous allocation */
+ min_size = ALIGN(size, PAGE_SIZE*(1U<<get_order(size)));
+ alloc_sizes = min_size;
+ }
+
+ size = PAGE_ALIGN(size);
+ } else if (min_size < PAGE_SIZE) {
min_size = PAGE_SIZE;
alloc_sizes |= PAGE_SIZE;
} else {
@@ -797,13 +836,17 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev,
if (!pages)
return NULL;
- size = iova_align(iovad, size);
- iova = iommu_dma_alloc_iova(domain, size, dev->coherent_dma_mask, dev);
+ iova_size = iova_align(iovad, size);
+ iova = iommu_dma_alloc_iova(domain, iova_size, dev->coherent_dma_mask, dev);
if (!iova)
goto out_free_pages;
- if (sg_alloc_table_from_pages(sgt, pages, count, 0, size, GFP_KERNEL))
+ /* append_table is only used to get a pointer to the last entry */
+ if (sg_alloc_append_table_from_pages(&sgt_append, pages, count, 0,
+ iova_size, UINT_MAX, 0, GFP_KERNEL))
goto out_free_iova;
+ memcpy(sgt, &sgt_append.sgt, sizeof(*sgt));
+ last_sg = sgt_append.prv;
if (!(ioprot & IOMMU_CACHE)) {
struct scatterlist *sg;
@@ -825,18 +839,59 @@ static struct page **__iommu_dma_alloc_noncontiguous(struct device *dev,
arch_dma_prep_coherent(sg_page(sg), sg->length);
}
+ if (iovad->granule > PAGE_SIZE) {
+ if (size < iovad->granule) {
+ /*
+ * we only have a single sg list entry here that is
+ * likely not aligned to iovad->granule. adjust the
+ * entry to represent the encapsulating IOMMU page
+ * and then later restore everything to its original
+ * values, similar to the impedance matching done in
+ * iommu_dma_map_sg.
+ */
+ orig_s_phys = sg_phys(sgt->sgl);
+ orig_s_len = sgt->sgl->length;
+ orig_s_off = sgt->sgl->offset;
+ s_iova_off = iova_offset(iovad, orig_s_phys);
+
+ sg_set_page(sgt->sgl,
+ pfn_to_page(PHYS_PFN(orig_s_phys - s_iova_off)),
+ iova_align(iovad, orig_s_len + s_iova_off),
+ sgt->sgl->offset & ~s_iova_off);
+ } else {
+ /*
+ * convince iommu_map_sg_atomic to map the last block
+ * even though it may be too small.
+ */
+ orig_s_len = last_sg->length;
+ last_sg->length = iova_align(iovad, last_sg->length);
+ }
+ }
+
ret = iommu_map_sg_atomic(domain, iova, sgt->sgl, sgt->orig_nents, ioprot);
- if (ret < 0 || ret < size)
+ if (ret < 0 || ret < iova_size)
goto out_free_sg;
+ if (iovad->granule > PAGE_SIZE) {
+ if (size < iovad->granule) {
+ sg_set_page(sgt->sgl,
+ pfn_to_page(PHYS_PFN(orig_s_phys)),
+ orig_s_len, orig_s_off);
+
+ iova += s_iova_off;
+ } else {
+ last_sg->length = orig_s_len;
+ }
+ }
+
sgt->sgl->dma_address = iova;
- sgt->sgl->dma_length = size;
+ sgt->sgl->dma_length = iova_size;
return pages;
out_free_sg:
sg_free_table(sgt);
out_free_iova:
- iommu_dma_free_iova(cookie, iova, size, NULL);
+ iommu_dma_free_iova(cookie, iova, iova_size, NULL);
out_free_pages:
__iommu_dma_free_pages(pages, count);
return NULL;
@@ -1040,8 +1124,9 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
unsigned int s_length = sg_dma_len(s);
unsigned int s_iova_len = s->length;
- s->offset += s_iova_off;
- s->length = s_length;
+ sg_set_page(s,
+ pfn_to_page(PHYS_PFN(sg_phys(s) + s_iova_off)),
+ s_length, s_iova_off & ~PAGE_MASK);
sg_dma_address(s) = DMA_MAPPING_ERROR;
sg_dma_len(s) = 0;
@@ -1082,13 +1167,17 @@ static int __finalise_sg(struct device *dev, struct scatterlist *sg, int nents,
static void __invalidate_sg(struct scatterlist *sg, int nents)
{
struct scatterlist *s;
+ phys_addr_t orig_paddr;
int i;
for_each_sg(sg, s, nents, i) {
- if (sg_dma_address(s) != DMA_MAPPING_ERROR)
- s->offset += sg_dma_address(s);
- if (sg_dma_len(s))
- s->length = sg_dma_len(s);
+ if (sg_dma_len(s)) {
+ orig_paddr = sg_phys(s) + sg_dma_address(s);
+ sg_set_page(s,
+ pfn_to_page(PHYS_PFN(orig_paddr)),
+ sg_dma_len(s),
+ sg_dma_address(s) & ~PAGE_MASK);
+ }
sg_dma_address(s) = DMA_MAPPING_ERROR;
sg_dma_len(s) = 0;
}
@@ -1166,15 +1255,16 @@ static int iommu_dma_map_sg(struct device *dev, struct scatterlist *sg,
* stashing the unaligned parts in the as-yet-unused DMA fields.
*/
for_each_sg(sg, s, nents, i) {
- size_t s_iova_off = iova_offset(iovad, s->offset);
+ phys_addr_t s_phys = sg_phys(s);
+ size_t s_iova_off = iova_offset(iovad, s_phys);
size_t s_length = s->length;
size_t pad_len = (mask - iova_len + 1) & mask;
sg_dma_address(s) = s_iova_off;
sg_dma_len(s) = s_length;
- s->offset -= s_iova_off;
s_length = iova_align(iovad, s_length + s_iova_off);
- s->length = s_length;
+ sg_set_page(s, pfn_to_page(PHYS_PFN(s_phys - s_iova_off)),
+ s_length, s->offset & ~s_iova_off);
/*
* Due to the alignment of our single IOVA allocation, we can
@@ -1412,9 +1502,15 @@ static int iommu_dma_get_sgtable(struct device *dev, struct sg_table *sgt,
void *cpu_addr, dma_addr_t dma_addr, size_t size,
unsigned long attrs)
{
+ struct iommu_domain *domain = iommu_get_dma_domain(dev);
+ struct iommu_dma_cookie *cookie = domain->iova_cookie;
+ struct iova_domain *iovad = &cookie->iovad;
struct page *page;
int ret;
+ if (iovad->granule > PAGE_SIZE)
+ return -ENXIO;
+
if (is_vmalloc_addr(cpu_addr)) {
struct page **pages = dma_common_find_pages(cpu_addr);
diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index f2c45b85b9fc..0c370e486d6e 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -80,6 +80,8 @@ static struct iommu_domain *__iommu_domain_alloc(struct bus_type *bus,
unsigned type);
static int __iommu_attach_device(struct iommu_domain *domain,
struct device *dev);
+static void __iommu_detach_device(struct iommu_domain *domain,
+ struct device *dev);
static int __iommu_attach_group(struct iommu_domain *domain,
struct iommu_group *group);
static void __iommu_detach_group(struct iommu_domain *domain,
@@ -1976,6 +1978,24 @@ void iommu_domain_free(struct iommu_domain *domain)
}
EXPORT_SYMBOL_GPL(iommu_domain_free);
+static int iommu_check_page_size(struct iommu_domain *domain,
+ struct device *dev)
+{
+ bool trusted = !(dev_is_pci(dev) && to_pci_dev(dev)->untrusted);
+
+ if (!iommu_is_paging_domain(domain))
+ return 0;
+ if (iommu_is_large_pages_domain(domain) && trusted)
+ return 0;
+
+ if (!(domain->pgsize_bitmap & (PAGE_SIZE | (PAGE_SIZE - 1)))) {
+ pr_warn("IOMMU pages cannot exactly represent CPU pages.\n");
+ return -EFAULT;
+ }
+
+ return 0;
+}
+
static int __iommu_attach_device(struct iommu_domain *domain,
struct device *dev)
{
@@ -1985,9 +2005,23 @@ static int __iommu_attach_device(struct iommu_domain *domain,
return -ENODEV;
ret = domain->ops->attach_dev(domain, dev);
- if (!ret)
- trace_attach_device_to_domain(dev);
- return ret;
+ if (ret)
+ return ret;
+
+ /*
+ * Check that CPU pages can be represented by the IOVA granularity.
+ * This has to be done after ops->attach_dev since many IOMMU drivers
+ * only limit domain->pgsize_bitmap after having attached the first
+ * device.
+ */
+ ret = iommu_check_page_size(domain, dev);
+ if (ret) {
+ __iommu_detach_device(domain, dev);
+ return ret;
+ }
+
+ trace_attach_device_to_domain(dev);
+ return 0;
}
int iommu_attach_device(struct iommu_domain *domain, struct device *dev)
diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c
index db77aa675145..180ce65a6789 100644
--- a/drivers/iommu/iova.c
+++ b/drivers/iommu/iova.c
@@ -49,10 +49,11 @@ init_iova_domain(struct iova_domain *iovad, unsigned long granule,
{
/*
* IOVA granularity will normally be equal to the smallest
- * supported IOMMU page size; both *must* be capable of
- * representing individual CPU pages exactly.
+ * supported IOMMU page size; while both usually are capable of
+ * representing individual CPU pages exactly the IOVA allocator
+ * supports any granularities that are an exact power of two.
*/
- BUG_ON((granule > PAGE_SIZE) || !is_power_of_2(granule));
+ BUG_ON(!is_power_of_2(granule));
spin_lock_init(&iovad->iova_rbtree_lock);
iovad->rbroot = RB_ROOT;
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index 9208eca4b0d1..dec2dd70a876 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -63,6 +63,8 @@ struct iommu_domain_geometry {
implementation */
#define __IOMMU_DOMAIN_PT (1U << 2) /* Domain is identity mapped */
#define __IOMMU_DOMAIN_DMA_FQ (1U << 3) /* DMA-API uses flush queue */
+#define __IOMMU_DOMAIN_LP (1U << 4) /* Support for PAGE_SIZE smaller
+ than IOMMU page size */
/*
* This are the possible domain-types
@@ -82,10 +84,12 @@ struct iommu_domain_geometry {
#define IOMMU_DOMAIN_IDENTITY (__IOMMU_DOMAIN_PT)
#define IOMMU_DOMAIN_UNMANAGED (__IOMMU_DOMAIN_PAGING)
#define IOMMU_DOMAIN_DMA (__IOMMU_DOMAIN_PAGING | \
- __IOMMU_DOMAIN_DMA_API)
+ __IOMMU_DOMAIN_DMA_API | \
+ __IOMMU_DOMAIN_LP)
#define IOMMU_DOMAIN_DMA_FQ (__IOMMU_DOMAIN_PAGING | \
__IOMMU_DOMAIN_DMA_API | \
- __IOMMU_DOMAIN_DMA_FQ)
+ __IOMMU_DOMAIN_DMA_FQ | \
+ __IOMMU_DOMAIN_LP)
struct iommu_domain {
unsigned type;
@@ -102,6 +106,16 @@ static inline bool iommu_is_dma_domain(struct iommu_domain *domain)
return domain->type & __IOMMU_DOMAIN_DMA_API;
}
+static inline bool iommu_is_paging_domain(struct iommu_domain *domain)
+{
+ return domain->type & __IOMMU_DOMAIN_PAGING;
+}
+
+static inline bool iommu_is_large_pages_domain(struct iommu_domain *domain)
+{
+ return domain->type & __IOMMU_DOMAIN_LP;
+}
+
enum iommu_cap {
IOMMU_CAP_CACHE_COHERENCY, /* IOMMU can enforce cache coherent DMA
transactions */

85
machines/nat/m1-support/m1n1/default.nix Normal file
View File

@@ -0,0 +1,85 @@
{ stdenv
, lib
, fetchFromGitHub
, pkgsCross
, python3
, dtc
, isRelease ? false
, withTools ? true
, withChainloading ? false
, rust-bin ? null
}:
assert withChainloading -> rust-bin != null;
let
pyenv = python3.withPackages (p: with p; [
construct
pyserial
]);
rustenv = rust-bin.selectLatestNightlyWith (toolchain: toolchain.minimal.override {
targets = [ "aarch64-unknown-none-softfloat" ];
});
in stdenv.mkDerivation rec {
pname = "m1n1";
version = "1.1.3";
src = fetchFromGitHub {
# tracking branch: https://github.com/AsahiLinux/m1n1/tree/main
owner = "AsahiLinux";
repo = "m1n1";
rev = "v${version}";
hash = "sha256-S2HLBLmgER0ZZJ5Q4EX2f1KDxnol0yCDrloDMJaLwBE=";
fetchSubmodules = true;
};
makeFlags = [ "ARCH=aarch64-unknown-linux-gnu-" ]
++ lib.optional isRelease "RELEASE=1"
++ lib.optional withChainloading "CHAINLOADING=1";
nativeBuildInputs = [
dtc
pkgsCross.aarch64-multiplatform.buildPackages.gcc
] ++ lib.optional withChainloading rustenv;
postPatch = ''
substituteInPlace proxyclient/m1n1/asm.py \
--replace 'aarch64-linux-gnu-' 'aarch64-unknown-linux-gnu-' \
--replace 'TOOLCHAIN = ""' 'TOOLCHAIN = "'$out'/toolchain-bin/"'
'';
installPhase = ''
runHook preInstall
mkdir -p $out/build
cp build/m1n1.macho $out/build
cp build/m1n1.bin $out/build
'' + (lib.optionalString withTools ''
mkdir -p $out/{bin,script,toolchain-bin}
cp -r proxyclient $out/script
cp -r tools $out/script
for toolpath in $out/script/proxyclient/tools/*.py; do
tool=$(basename $toolpath .py)
script=$out/bin/m1n1-$tool
cat > $script <<EOF
#!/bin/sh
${pyenv}/bin/python $toolpath "\$@"
EOF
chmod +x $script
done
GCC=${pkgsCross.aarch64-multiplatform.buildPackages.gcc}
BINUTILS=${pkgsCross.aarch64-multiplatform.buildPackages.binutils}
REAL_BINUTILS=$(grep -o '/nix/store/[^ ]*binutils[^ ]*' $BINUTILS/nix-support/propagated-user-env-packages)
ln -s $GCC/bin/*-gcc $out/toolchain-bin/
ln -s $GCC/bin/*-ld $out/toolchain-bin/
ln -s $REAL_BINUTILS/bin/*-objcopy $out/toolchain-bin/
ln -s $REAL_BINUTILS/bin/*-objdump $out/toolchain-bin/
ln -s $REAL_BINUTILS/bin/*-nm $out/toolchain-bin/
'') + ''
runHook postInstall
'';
}

35
machines/nat/m1-support/u-boot/default.nix Normal file
View File

@@ -0,0 +1,35 @@
{ lib
, fetchFromGitHub
, pkgsCross
, m1n1
}: (pkgsCross.aarch64-multiplatform.buildUBoot rec {
src = fetchFromGitHub {
# tracking branch: https://github.com/AsahiLinux/u-boot/tree/releng/installer-release
owner = "AsahiLinux";
repo = "u-boot";
rev = "300817d324f73c30c998a10435d5d830b58df894";
hash = "sha256-6q4l1gHAlaGM7ktlCBmehb/ZNvmpt1eah6tTdsQJfxM=";
};
version = "unstable-2022-07-11";
defconfig = "apple_m1_defconfig";
extraMeta.platforms = [ "aarch64-linux" ];
filesToInstall = [
"u-boot-nodtb.bin.gz"
"m1n1-u-boot.macho"
"m1n1-u-boot.bin"
];
extraConfig = ''
CONFIG_IDENT_STRING=" ${version}"
'';
}).overrideAttrs (o: {
# nixos's downstream patches are not applicable
patches = [ ];
preInstall = ''
# compress so that m1n1 knows U-Boot's size and can find things after it
gzip -n u-boot-nodtb.bin
cat ${m1n1}/build/m1n1.macho arch/arm/dts/t[68]*.dtb u-boot-nodtb.bin.gz > m1n1-u-boot.macho
cat ${m1n1}/build/m1n1.bin arch/arm/dts/t[68]*.dtb u-boot-nodtb.bin.gz > m1n1-u-boot.bin
'';
})

26
machines/ray/configuration.nix
View File

@@ -1,8 +1,12 @@
{ config, pkgs, lib, ... }:
{
disabledModules = [
"hardware/video/nvidia.nix"
];
imports = [
./hardware-configuration.nix
./nvidia.nix
];
firmware.x86_64.enable = true;
@@ -19,29 +23,25 @@
hardware.enableAllFirmware = true;
# depthai
services.udev.extraRules = ''
SUBSYSTEM=="usb", ATTRS{idVendor}=="03e7", MODE="0666"
'';
# newer kernel for wifi
boot.kernelPackages = pkgs.linuxPackages_latest;
# gpu
services.xserver.videoDrivers = [ "nvidia" ];
services.xserver.logFile = "/var/log/Xorg.0.log";
hardware.nvidia = {
modesetting.enable = true; # for nvidia-vaapi-driver
prime = {
reverseSync.enable = true;
offload.enableOffloadCmd = true;
sync.enable = true;
nvidiaBusId = "PCI:1:0:0";
amdgpuBusId = "PCI:4:0:0";
};
powerManagement = {
# enable = true;
# finegrained = true;
# coarsegrained = true;
};
};
# virt-manager
virtualisation.libvirtd.enable = true;
programs.dconf.enable = true;
virtualisation.spiceUSBRedirection.enable = true;
environment.systemPackages = with pkgs; [ virt-manager ];
users.users.googlebot.extraGroups = [ "libvirtd" ];
# vpn-container.enable = true;
# containers.vpn.interfaces = [ "piaw" ];

485
machines/ray/nvidia.nix Normal file
View File

@@ -0,0 +1,485 @@
# This module provides the proprietary NVIDIA X11 / OpenGL drivers.
{ config, lib, pkgs, ... }:
with lib;
let
nvidia_x11 = let
drivers = config.services.xserver.videoDrivers;
isDeprecated = str: (hasPrefix "nvidia" str) && (str != "nvidia");
hasDeprecated = drivers: any isDeprecated drivers;
in if (hasDeprecated drivers) then
throw ''
Selecting an nvidia driver has been modified for NixOS 19.03. The version is now set using `hardware.nvidia.package`.
''
else if (elem "nvidia" drivers) then cfg.package else null;
enabled = nvidia_x11 != null;
cfg = config.hardware.nvidia;
pCfg = cfg.prime;
syncCfg = pCfg.sync;
offloadCfg = pCfg.offload;
reverseSyncCfg = pCfg.reverse_sync;
primeEnabled = syncCfg.enable || reverseSyncCfg.enable || offloadCfg.enable;
nvidiaPersistencedEnabled = cfg.nvidiaPersistenced;
nvidiaSettings = cfg.nvidiaSettings;
in
{
imports =
[
(mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "enable" ] [ "hardware" "nvidia" "prime" "sync" "enable" ])
(mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "allowExternalGpu" ] [ "hardware" "nvidia" "prime" "allowExternalGpu" ])
(mkRenamedOptionModule [ "hardware" "nvidia" "prime" "sync" "allowExternalGpu" ] [ "hardware" "nvidia" "prime" "allowExternalGpu" ])
(mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "nvidiaBusId" ] [ "hardware" "nvidia" "prime" "nvidiaBusId" ])
(mkRenamedOptionModule [ "hardware" "nvidia" "optimus_prime" "intelBusId" ] [ "hardware" "nvidia" "prime" "intelBusId" ])
];
options = {
hardware.nvidia.powerManagement.enable = mkOption {
type = types.bool;
default = false;
description = ''
Experimental power management through systemd. For more information, see
the NVIDIA docs, on Chapter 21. Configuring Power Management Support.
'';
};
hardware.nvidia.powerManagement.finegrained = mkOption {
type = types.bool;
default = false;
description = ''
Experimental power management of PRIME offload. For more information, see
the NVIDIA docs, chapter 22. PCI-Express runtime power management.
'';
};
hardware.nvidia.powerManagement.coarsegrained = mkOption {
type = types.bool;
default = false;
description = ''
Experimental power management of PRIME offload. For more information, see
the NVIDIA docs, chapter 22. PCI-Express runtime power management.
'';
};
hardware.nvidia.modesetting.enable = mkOption {
type = types.bool;
default = false;
description = ''
Enable kernel modesetting when using the NVIDIA proprietary driver.
Enabling this fixes screen tearing when using Optimus via PRIME (see
<option>hardware.nvidia.prime.sync.enable</option>. This is not enabled
by default because it is not officially supported by NVIDIA and would not
work with SLI.
'';
};
hardware.nvidia.prime.nvidiaBusId = mkOption {
type = types.str;
default = "";
example = "PCI:1:0:0";
description = ''
Bus ID of the NVIDIA GPU. You can find it using lspci; for example if lspci
shows the NVIDIA GPU at "01:00.0", set this option to "PCI:1:0:0".
'';
};
hardware.nvidia.prime.intelBusId = mkOption {
type = types.str;
default = "";
example = "PCI:0:2:0";
description = ''
Bus ID of the Intel GPU. You can find it using lspci; for example if lspci
shows the Intel GPU at "00:02.0", set this option to "PCI:0:2:0".
'';
};
hardware.nvidia.prime.amdgpuBusId = mkOption {
type = types.str;
default = "";
example = "PCI:4:0:0";
description = ''
Bus ID of the AMD APU. You can find it using lspci; for example if lspci
shows the AMD APU at "04:00.0", set this option to "PCI:4:0:0".
'';
};
hardware.nvidia.prime.sync.enable = mkOption {
type = types.bool;
default = false;
description = ''
Enable NVIDIA Optimus support using the NVIDIA proprietary driver via PRIME.
If enabled, the NVIDIA GPU will be always on and used for all rendering,
while enabling output to displays attached only to the integrated Intel/AMD
GPU without a multiplexer.
Note that this option only has any effect if the "nvidia" driver is specified
in <option>services.xserver.videoDrivers</option>, and it should preferably
be the only driver there.
If this is enabled, then the bus IDs of the NVIDIA and Intel/AMD GPUs have to
be specified (<option>hardware.nvidia.prime.nvidiaBusId</option> and
<option>hardware.nvidia.prime.intelBusId</option> or
<option>hardware.nvidia.prime.amdgpuBusId</option>).
If you enable this, you may want to also enable kernel modesetting for the
NVIDIA driver (<option>hardware.nvidia.modesetting.enable</option>) in order
to prevent tearing.
Note that this configuration will only be successful when a display manager
for which the <option>services.xserver.displayManager.setupCommands</option>
option is supported is used.
'';
};
hardware.nvidia.prime.allowExternalGpu = mkOption {
type = types.bool;
default = false;
description = ''
Configure X to allow external NVIDIA GPUs when using Prime [Reverse] Sync.
'';
};
hardware.nvidia.prime.offload.enable = mkOption {
type = types.bool;
default = false;
description = ''
Enable render offload support using the NVIDIA proprietary driver via PRIME.
If this is enabled, then the bus IDs of the NVIDIA and Intel/AMD GPUs have to
be specified (<option>hardware.nvidia.prime.nvidiaBusId</option> and
<option>hardware.nvidia.prime.intelBusId</option> or
<option>hardware.nvidia.prime.amdgpuBusId</option>).
'';
};
hardware.nvidia.prime.offload.enableOffloadCmd = mkOption {
type = types.bool;
default = false;
description = ''
Adds a `nvidia-offload` convenience script to <option>environment.systemPackages</option>
for offloading programs to an nvidia device. To work, should have also enabled
<option>hardware.nvidia.prime.offload.enable</option> or <option>hardware.nvidia.prime.reverse_sync.enable</option>
Example usage `nvidia-offload sauerbraten_client`
'';
};
hardware.nvidia.prime.reverse_sync.enable = mkOption {
type = types.bool;
default = false;
description = ''
Warning: This feature is relatively new, depending on your system this might
work poorly. AMD support, especially so.
See: https://forums.developer.nvidia.com/t/the-all-new-outputsink-feature-aka-reverse-prime/129828
Enable NVIDIA Optimus support using the NVIDIA proprietary driver via reverse
PRIME. If enabled, the Intel/AMD GPU will be used for all rendering, while
enabling output to displays attached only to the NVIDIA GPU without a
multiplexer.
Note that this option only has any effect if the "nvidia" driver is specified
in <option>services.xserver.videoDrivers</option>, and it should preferably
be the only driver there.
If this is enabled, then the bus IDs of the NVIDIA and Intel/AMD GPUs have to
be specified (<option>hardware.nvidia.prime.nvidiaBusId</option> and
<option>hardware.nvidia.prime.intelBusId</option> or
<option>hardware.nvidia.prime.amdgpuBusId</option>).
If you enable this, you may want to also enable kernel modesetting for the
NVIDIA driver (<option>hardware.nvidia.modesetting.enable</option>) in order
to prevent tearing.
Note that this configuration will only be successful when a display manager
for which the <option>services.xserver.displayManager.setupCommands</option>
option is supported is used.
'';
};
hardware.nvidia.nvidiaSettings = mkOption {
default = true;
type = types.bool;
description = ''
Whether to add nvidia-settings, NVIDIA's GUI configuration tool, to
systemPackages.
'';
};
hardware.nvidia.nvidiaPersistenced = mkOption {
default = false;
type = types.bool;
description = ''
Update for NVIDA GPU headless mode, i.e. nvidia-persistenced. It ensures all
GPUs stay awake even during headless mode.
'';
};
hardware.nvidia.package = lib.mkOption {
type = lib.types.package;
default = config.boot.kernelPackages.nvidiaPackages.stable;
defaultText = literalExpression "config.boot.kernelPackages.nvidiaPackages.stable";
description = ''
The NVIDIA X11 derivation to use.
'';
example = literalExpression "config.boot.kernelPackages.nvidiaPackages.legacy_340";
};
};
config = let
igpuDriver = if pCfg.intelBusId != "" then "modesetting" else "amdgpu";
igpuBusId = if pCfg.intelBusId != "" then pCfg.intelBusId else pCfg.amdgpuBusId;
in mkIf enabled {
assertions = [
{
assertion = primeEnabled -> pCfg.intelBusId == "" || pCfg.amdgpuBusId == "";
message = ''
You cannot configure both an Intel iGPU and an AMD APU. Pick the one corresponding to your processor.
'';
}
{
assertion = offloadCfg.enableOffloadCmd -> offloadCfg.enable || reverseSyncCfg.enable;
message = ''
Offload command requires offloading or reverse prime sync to be enabled.
'';
}
{
assertion = primeEnabled -> pCfg.nvidiaBusId != "" && (pCfg.intelBusId != "" || pCfg.amdgpuBusId != "");
message = ''
When NVIDIA PRIME is enabled, the GPU bus IDs must configured.
'';
}
{
assertion = offloadCfg.enable -> versionAtLeast nvidia_x11.version "435.21";
message = "NVIDIA PRIME render offload is currently only supported on versions >= 435.21.";
}
{
assertion = (reverseSyncCfg.enable && pCfg.amdgpuBusId != "") -> versionAtLeast nvidia_x11.version "470.0";
message = "NVIDIA PRIME render offload for AMD APUs is currently only supported on versions >= 470 beta.";
}
{
assertion = !(syncCfg.enable && offloadCfg.enable);
message = "PRIME Sync and Offload cannot be both enabled";
}
{
assertion = !(syncCfg.enable && reverseSyncCfg.enable);
message = "PRIME Sync and PRIME Reverse Sync cannot be both enabled";
}
{
assertion = !(syncCfg.enable && cfg.powerManagement.finegrained && cfg.powerManagement.coarsegrained);
message = "Sync precludes powering down the NVIDIA GPU.";
}
{
assertion = cfg.powerManagement.finegrained -> offloadCfg.enable;
message = "Fine-grained power management requires offload to be enabled.";
}
{
assertion = cfg.powerManagement.coarsegrained -> offloadCfg.enable;
message = "Coarse-grained power management requires offload to be enabled.";
}
{
assertion = cfg.powerManagement.enable -> (
builtins.pathExists (cfg.package.out + "/bin/nvidia-sleep.sh") &&
builtins.pathExists (cfg.package.out + "/lib/systemd/system-sleep/nvidia")
);
message = "Required files for driver based power management don't exist.";
}
];
# If Optimus/PRIME is enabled, we:
# - Specify the configured NVIDIA GPU bus ID in the Device section for the
# "nvidia" driver.
# - Add the AllowEmptyInitialConfiguration option to the Screen section for the
# "nvidia" driver, in order to allow the X server to start without any outputs.
# - Add a separate Device section for the Intel GPU, using the "modesetting"
# driver and with the configured BusID.
# - OR add a separate Device section for the AMD APU, using the "amdgpu"
# driver and with the configures BusID.
# - Reference that Device section from the ServerLayout section as an inactive
# device.
# - Configure the display manager to run specific `xrandr` commands which will
# configure/enable displays connected to the Intel iGPU / AMD APU.
services.xserver.useGlamor = mkDefault offloadCfg.enable;
# reverse sync implies offloading
hardware.nvidia.prime.offload.enable = mkDefault reverseSyncCfg.enable;
services.xserver.drivers = optional primeEnabled {
name = igpuDriver;
display = !syncCfg.enable;
modules = optional (igpuDriver == "amdgpu") [ pkgs.xorg.xf86videoamdgpu ];
deviceSection = ''
BusID "${igpuBusId}"
${optionalString (syncCfg.enable && igpuDriver != "amdgpu") ''Option "AccelMethod" "none"''}
'';
} ++ singleton {
name = "nvidia";
modules = [ nvidia_x11.bin ];
display = syncCfg.enable;
deviceSection = optionalString primeEnabled ''
BusID "${pCfg.nvidiaBusId}"
${optionalString pCfg.allowExternalGpu "Option \"AllowExternalGpus\""}
'';
};
services.xserver.serverLayoutSection = optionalString syncCfg.enable ''
Inactive "Device-${igpuDriver}[0]"
'' + optionalString reverseSyncCfg.enable ''
Inactive "Device-nvidia[0]"
'' + optionalString offloadCfg.enable ''
Option "AllowNVIDIAGPUScreens"
'';
services.xserver.displayManager.setupCommands = let
gpuProviderName = if igpuDriver == "amdgpu" then
# find the name of the provider if amdgpu
"`${pkgs.xorg.xrandr}/bin/xrandr --listproviders | ${pkgs.gnugrep}/bin/grep -i AMD | ${pkgs.gnused}/bin/sed -n 's/^.*name://p'`"
else
igpuDriver;
providerCmdParams = if syncCfg.enable then "\"${gpuProviderName}\" NVIDIA-0" else "NVIDIA-G0 \"${gpuProviderName}\"";
in optionalString (syncCfg.enable || reverseSyncCfg.enable) ''
# Added by nvidia configuration module for Optimus/PRIME.
${pkgs.xorg.xrandr}/bin/xrandr --setprovideroutputsource ${providerCmdParams}
${pkgs.xorg.xrandr}/bin/xrandr --auto
'';
environment.etc."nvidia/nvidia-application-profiles-rc" = mkIf nvidia_x11.useProfiles {
source = "${nvidia_x11.bin}/share/nvidia/nvidia-application-profiles-rc";
};
# 'nvidia_x11' installs it's files to /run/opengl-driver/...
environment.etc."egl/egl_external_platform.d".source =
"/run/opengl-driver/share/egl/egl_external_platform.d/";
hardware.opengl.extraPackages = [
nvidia_x11.out
# pkgs.nvidia-vaapi-driver
];
hardware.opengl.extraPackages32 = [
nvidia_x11.lib32
# pkgs.pkgsi686Linux.nvidia-vaapi-driver
];
environment.systemPackages = [ nvidia_x11.bin ]
++ optionals cfg.nvidiaSettings [ nvidia_x11.settings ]
++ optionals nvidiaPersistencedEnabled [ nvidia_x11.persistenced ]
++ optionals offloadCfg.enableOffloadCmd [
(pkgs.writeShellScriptBin "nvidia-offload" ''
export __NV_PRIME_RENDER_OFFLOAD=1
export __NV_PRIME_RENDER_OFFLOAD_PROVIDER=NVIDIA-G0
export __GLX_VENDOR_LIBRARY_NAME=nvidia
export __VK_LAYER_NV_optimus=NVIDIA_only
exec -a "$0" "$@"
'')
];
systemd.packages = optional cfg.powerManagement.enable nvidia_x11.out;
systemd.services = let
baseNvidiaService = state: {
description = "NVIDIA system ${state} actions";
path = with pkgs; [ kbd ];
serviceConfig = {
Type = "oneshot";
ExecStart = "${nvidia_x11.out}/bin/nvidia-sleep.sh '${state}'";
};
};
nvidiaService = sleepState: (baseNvidiaService sleepState) // {
before = [ "systemd-${sleepState}.service" ];
requiredBy = [ "systemd-${sleepState}.service" ];
};
services = (builtins.listToAttrs (map (t: nameValuePair "nvidia-${t}" (nvidiaService t)) ["hibernate" "suspend"]))
// {
nvidia-resume = (baseNvidiaService "resume") // {
after = [ "systemd-suspend.service" "systemd-hibernate.service" ];
requiredBy = [ "systemd-suspend.service" "systemd-hibernate.service" ];
};
};
in optionalAttrs cfg.powerManagement.enable services
// optionalAttrs nvidiaPersistencedEnabled {
"nvidia-persistenced" = mkIf nvidiaPersistencedEnabled {
description = "NVIDIA Persistence Daemon";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "forking";
Restart = "always";
PIDFile = "/var/run/nvidia-persistenced/nvidia-persistenced.pid";
ExecStart = "${nvidia_x11.persistenced}/bin/nvidia-persistenced --verbose";
ExecStopPost = "${pkgs.coreutils}/bin/rm -rf /var/run/nvidia-persistenced";
};
};
};
systemd.tmpfiles.rules = optional config.virtualisation.docker.enableNvidia
"L+ /run/nvidia-docker/bin - - - - ${nvidia_x11.bin}/origBin"
++ optional (nvidia_x11.persistenced != null && config.virtualisation.docker.enableNvidia)
"L+ /run/nvidia-docker/extras/bin/nvidia-persistenced - - - - ${nvidia_x11.persistenced}/origBin/nvidia-persistenced";
boot.extraModulePackages = [ nvidia_x11.bin ];
# nvidia-uvm is required by CUDA applications.
boot.kernelModules = [ "nvidia-uvm" ] ++
optionals config.services.xserver.enable [ "nvidia" "nvidia_modeset" "nvidia_drm" ];
# If requested enable modesetting via kernel parameter.
boot.kernelParams = optional (offloadCfg.enable || cfg.modesetting.enable) "nvidia-drm.modeset=1"
++ optional cfg.powerManagement.enable "nvidia.NVreg_PreserveVideoMemoryAllocations=1";
services.udev.extraRules =
''
# Create /dev/nvidia-uvm when the nvidia-uvm module is loaded.
KERNEL=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidiactl c $$(grep nvidia-frontend /proc/devices | cut -d \ -f 1) 255'"
KERNEL=="nvidia_modeset", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-modeset c $$(grep nvidia-frontend /proc/devices | cut -d \ -f 1) 254'"
KERNEL=="card*", SUBSYSTEM=="drm", DRIVERS=="nvidia", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia%n c $$(grep nvidia-frontend /proc/devices | cut -d \ -f 1) %n'"
KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm c $$(grep nvidia-uvm /proc/devices | cut -d \ -f 1) 0'"
KERNEL=="nvidia_uvm", RUN+="${pkgs.runtimeShell} -c 'mknod -m 666 /dev/nvidia-uvm-tools c $$(grep nvidia-uvm /proc/devices | cut -d \ -f 1) 0'"
'' + optionalString (cfg.powerManagement.finegrained || cfg.powerManagement.coarsegrained) ''
# Remove NVIDIA USB xHCI Host Controller devices, if present
ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c0330", ATTR{remove}="1"
# Remove NVIDIA USB Type-C UCSI devices, if present
ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x0c8000", ATTR{remove}="1"
# Remove NVIDIA Audio devices, if present
ACTION=="add", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x040300", ATTR{remove}="1"
# Enable runtime PM for NVIDIA VGA/3D controller devices on driver bind
ACTION=="bind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030000", TEST=="power/control", ATTR{power/control}="auto"
ACTION=="bind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030200", TEST=="power/control", ATTR{power/control}="auto"
# Disable runtime PM for NVIDIA VGA/3D controller devices on driver unbind
ACTION=="unbind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030000", TEST=="power/control", ATTR{power/control}="on"
ACTION=="unbind", SUBSYSTEM=="pci", ATTR{vendor}=="0x10de", ATTR{class}=="0x030200", TEST=="power/control", ATTR{power/control}="on"
'';
boot.extraModprobeConfig = optionalString cfg.powerManagement.finegrained ''
options nvidia "NVreg_DynamicPowerManagement=0x02"
'' + optionalString cfg.powerManagement.coarsegrained ''
options nvidia "NVreg_DynamicPowerManagement=0x01"
'';
boot.blacklistedKernelModules = [ "nouveau" "nvidiafb" ];
services.acpid.enable = true;
};
}

BIN
secrets/cloudflared-navidrome.json.age
View File

Binary file not shown.

BIN
secrets/email-pw.age
View File

Binary file not shown.

75
secrets/iodine.age
View File

@@ -1,39 +1,38 @@
age-encryption.org/v1
-> ssh-ed25519 xoAm7w NvgGcHYNA6WmPn3sCmMzPCib+6P7s5R/G6lSJFpih2E
gLugCNcPJtAl9+2fa80OD7D7XaBkpb2bzKJclOdjGfw
-> ssh-ed25519 mbw8xA dBYbSV7QcUTOp9a5hUAZeMlL828KrRp6tB3zMIopPDA
i4QRHxTVaN60elfiuYXuESwbphxPN4tsQ7scH0ZJjoA
-> ssh-ed25519 N240Tg Xg5q74f1ylRZGLpPggkTy1QU+LWEcHpqCV6wQ2OhQlk
RubXACwdS4+xNt8nt0C0wk8XU2YIWOSRwIXUg47sNA0
-> ssh-ed25519 2a2Yhw p5w1WsmcVHImVtolvrULgSsYXlm06g2za8zSiDf9uR8
qVuj2L8jvRmINprQbYg91yoJU0XZmO7TprQv2UsvpmY
-> ssh-ed25519 dMQYog EFYjggjACyNwvNCG75XsceqnUrrrsX4cv7e+Mu2Z2zI
Q7VPIP7iNqHxGGtRG2Q122f60ZztSRsRHRbziGAinNY
-> ssh-ed25519 G2eSCQ 5Y6Tazqz2Wjl2/lrlQMUWgEnSBJpmzwXAUGEK56upgE
eVxcvshe+uecw4ORKdS/2W8p+jcrro8cDcDdmeY7Olg
-> ssh-ed25519 6AT2/g h6E5M1uJRhqfR1bm82rXrJvmr+nkeUPbygD8S+zbAmY
r5yR6W2uCcR4cEnbk/1tXwhAanT2EqTsH1mIDbrVGVM
-> ssh-ed25519 yHDAQw lWomhFF/IyKtOUlBori7wNjrtsbqvKXXhAwF4a1y8js
baOAc0tKMbh6Sw0bWyynI3OMrsOPA3W1fCCIn26azeQ
-> ssh-ed25519 hPp1nw ZGwi0yK0Nu+Y/uXIxnQH6Pwmw1SWBE0yQ9FOuBNKp1U
tN8kk/0AxUIiFbEOSeIlGiBIy0d96wTG8VrGPnEHTg4
-> ssh-ed25519 CRfjsA ntYznFouB2JWY2LZ6aycDogIFbLHOhqcx50QbJIB+RY
slo38Rvg+2GV2fKRlt4Yns644kd55DrDz7ivi6RTyXg
-> ssh-ed25519 vwVIvQ UF+Bo3Rl5OPPqqddi0bqleRJV9XTuykrl2dkPPSyRAE
znn5KNsXZPHN2/E652cPhOx8RF5+uuFUyGhrI+kCou0
-> ssh-ed25519 fBrw3g w8EkEo1db0Po5ZhDzz/5nshsSmjy9wMSKp+XFDEuUQA
q50eyTDTxQULpogMbVXI2zSfu+ZZP9DOXjM+Y2/rMNI
-> ssh-ed25519 S5xQfg 651xn3mNSl/3+KT5d4XD2pkMNcxi6BScqX3teoKbgio
EOfzB+woFBWBaVKuv4t4E0Gx3vf7Lg40WXSovXs8N6s
-> ssh-ed25519 XPxfUQ FL+FYVsRNJBv7xEpwf0fXgJt3G/FiARQ7+aWK/sxryE
xneOKh3muAhjkLC2upsRrc4B0mggwm7IOMFsg+25gT8
-> ssh-ed25519 SpD5mg f140sUr/7itxtllfcbBaNV9xhRaV/IULGVn6AaP7zkw
FnostzjoSC/bdOu2UF+rT+0mZ0aUM8rAAoQltUXn534
-> ssh-ed25519 Kk8sng 9JnybgIcROZf+l0C9YGNb4xWkZLtdfUPm2V0WJsGPUI
fs4wBEIdK6kU1CIhI8zz/yqa4Fb6Q2u+MO6SsudQlCM
-> C89-grease >Fa(j6s UN5!{
nb+ymnliEEKJf3IGloFQMNl/SyFjvFUqekC2YEY2qJblAUaft3Tf6hMYf7uDSjew
5SRhESY0VucHhAK6OybwPWYRlXXv2gM/wxUicB8
--- t6Q6ULdQzW4/xDtZDVI/lfP5i8Cq8lnURqQSyKWHvyI
h,:ìüæ
H)'’ЊÂ/²)žÒ¾ìpˆ¡Rç›2QU
-> ssh-ed25519 xoAm7w Hfe9WoVDvMWc8P60BreiUS9+F1PmpZwUQ/Rf1tRxIRY
oFunT3z6xg8BRAqzcaHVxafBUJbXJSCrsge1/nEI8x4
-> ssh-ed25519 mbw8xA xR/jq0KjCpwusJJ60mHqt6TGBdsSjUxWHChO8dGYhzA
kFEYLlnF7g6e7Tvud8JsblOtsj2v3QrAdkjJwV0b9ng
-> ssh-ed25519 N240Tg DoXupPWk4YsgqpQ4yPfpz9a13Qu+ZcxavLbKjStf40E
+mCkreDEjo8G5Ew9TNaRp221VL6l20jG/6QVa8Cbwa4
-> ssh-ed25519 2a2Yhw t0BY1ZmbeSORtHRvy5c3XeIe29QSRd5wSgibjZgcmAE
5+EWlrZoeg3SZ6MCaj+YN4ovWxrTbfVz5IV9gA7bcwg
-> ssh-ed25519 dMQYog gaJXyfz3aN5CnbKGao5nxnKc6ZGyXuLI9s5DQ7zcfDA
6BdUMh7erbIXstvEPnc0jE38rL9+0QU8PYtcQp5PUNA
-> ssh-ed25519 G2eSCQ boj8/IRM5HG4LEHWMYzDr37Z/fVyI+ZAGbFaUzGtOS8
tzZLK/jzjron85vLrxFALKUgGVi8ZdPnM/zcVpfp6Ps
-> ssh-ed25519 6AT2/g A8NtCXr6AksNJCnOLsErYIqKy2SqMza0GsUURr1YASo
lMnDpcWZxXIIRqBtLYG6Pkd6L+/dPVGRCgyYPzRLnII
-> ssh-ed25519 yHDAQw NOqmfI7ZuSMTmEErJjHkbjGtNwJhpHTWeS/6zPsTVC4
5tZLg+GbfpnCi2CbSP7lZLssYm7hR/B7PZCZZ5X3ahs
-> ssh-ed25519 2+FxVg SA3lD4YzgKQWnztnaKZkkWZvooAnH3uv3o4lKn59rAI
vXkGl4IUstTQ6BZsT3c5PmPKU3lJxosX5LRUuAGVSVY
-> ssh-ed25519 CRfjsA uIa4dBktv7pMMv4U8hwlUJz+Ewh7ZjQ+j5ln7ZqxlAw
WadTmmOeOlaNlejglQ3NgOk86zS/yyKKkVabIPajeCQ
-> ssh-ed25519 vwVIvQ pg5Yv6YQh2tYXmv9PP5etAMxNN85dwQ28jXZRkQI9RY
zE81eln0hmbRchzNNYXaMxI8aF/xwGXy2wm6GlKnzg8
-> ssh-ed25519 fBrw3g gtUFDnC6CowNoKxwgLCOsSQ8rK21y327K8B94zlMHQE
+WepWvCmTZj+ht7U8aMD4kJ+zDSH7+c5lNSDw2JKrzA
-> ssh-ed25519 S5xQfg vsDTXbJTOjL7wVx1rA5ny0Ix/f6QFlZxxB1z6X2YcGk
im/TCt3Rszp0tP8hx1CV1xqaxh/PEUmC6ZoARVJXUzo
-> ssh-ed25519 XPxfUQ OQf+JUauisYKuYtya1HlpnZKteLLJonnd8JZiVwfAQA
wDSRsGMxQ2rXtej/iBX8n7KRfdLIB5q12Z6zu2I4wNw
-> ssh-ed25519 SpD5mg UlMJvnqDtRj3BTE4wAYa11D1mM5Q4vIkKIPmtODKYSc
RW1Brw2kCbUlBZK+UdusWAKEW5ZC5VHt49qUsyeUr+s
-> ssh-ed25519 Kk8sng 1TYOMJBzUZrgcRE02YtFllJgV4bxsCFRrRgnoasWyVA
FXSNZ6U60lRRgS3EvqKZwWdwA3vIW9xe5+NcmuYorug
-> x'-grease dT
viYi3YkLyuugYlo01uxExjHQVbq6hMoAGI64lXiE6fE0I0AV5Wr8yHiylwAH8ax2
4ylwQQVAA66xCEF+2QoIapO+V7oaWrjeiEVEAn1D
--- q9OmQIHexmW/2u7d1XKjUgwp+QYHbiiPgC9ZurBY5l8
¥qÌr.¹s;ñïÑïMdYŠuÜ~°#i¸ï-øÁVBCÞrå·>üADéÝÉþ83<38>ú:"î¶o+

74
secrets/nextcloud-pw.age
View File

@@ -1,39 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 xoAm7w 7+DO9mI/zZfTIN/0KBMOIjMNnReyGoH/XVQa0OLdAHY
qg/UIBJr8GX79d7xrIIN9GUt3pDIormlOM7IdjIytHk
-> ssh-ed25519 mbw8xA 9KorXegEBX3PYQm+Ljdjs2hkxAIpz2CZrITNCGo0BnM
QNQWGWqoudiryg/0fV2KZUuJQGp/suZun9KF9c2OTqw
-> ssh-ed25519 N240Tg kfl4aaKI28cDfzX3MBisRGraQYChPdUF2WigjOFYx0Y
u8dgbgJSmcJBp2Uc8qbWMbpa/cKEmx4V3psQgzqnitA
-> ssh-ed25519 2a2Yhw MGk791xEYHlC4bYfU5CMS3rY8TVI8KYvEIwUhE7wQ3k
iFT3QUR8PyWw4grqy7/8KfLfYNIDkgDKM2MqSr6cj0U
-> ssh-ed25519 dMQYog IW1ntuHrV85WX60GI295c197NUlQMKuo5gd3sQZl/gA
gAnx0rMggqZ7Rn8tHFAXJx3z3t9MkZpmjpgI2qAtK4g
-> ssh-ed25519 G2eSCQ 7ZpZQAda0uxjIIdpLnC5JlU6cbLtJWr9LSIIdi7PUQw
PfGFrMVLCmy8SDv2nn6p6M560Xu8lte8DjbCORDM+uc
-> ssh-ed25519 6AT2/g JGE9jVFM2Wu348XIHpubyCEismpfBraxnFGTnEvqqnI
kDHfyJdBIGIURDJ0Nsce4DqzPzhk5p+LM1QZ44pZ4g8
-> ssh-ed25519 yHDAQw KNzCNjvErLwEJZpWWMIBFUGOC8jURyvoKzCWX0ATrRM
EyIJpn48eU8oEB5FbMhCOd16hAVrxTFLyJEoos7WGOY
-> ssh-ed25519 hPp1nw kdjLNwgYQV/4NMubVpJw8QCIuKn+u3CT1boZNJEWfCM
FXNLqmpZB+CtSmCY9zGr+3UebEwNK3JmdP4ifdXiQL4
-> ssh-ed25519 CRfjsA axLQSlgVkaYmRktIP+fwHnhN2pJ55NCOW0fzTzgjFF4
ElO0byzF3PJxN9WgENIN/YfmsOR9rOhEh3xRNIIGIyk
-> ssh-ed25519 vwVIvQ LtrPXRJ0hztkWFnoKt5c0UzWQpD9CO990k52gjWcQnY
nHb1hsXhHQokcA4WoRlbZy0EFQt8Xd0cYUGqblY17Q4
-> ssh-ed25519 fBrw3g dnWs7lWY8QoWOjWHG68FSYqZDzsIaA/qU4AXrndGNTw
gh4+t6THL2mtrPUzGlYd/YxDjk3hpHxUmGq+kRcz9BQ
-> ssh-ed25519 S5xQfg kEXs5hXXR4ocYYWoT2xFr4HITe9wIOOLz73zm/9bf0o
WpO+5/zXc+UGYJGkNNQr8UsEz2RyBUtQ4Syep718294
-> ssh-ed25519 XPxfUQ pL4j/idFPiIPnWI7bIwn0+FuB6az/hXURAh+tvdr7Hc
WWJPFYanmf3+KnjG84XlnEapI1vh0wRi9XFJRn5JVpo
-> ssh-ed25519 SpD5mg CpGcl7ONt0juh/N2hwcxWiuc9u9wjQ4d+AAF+1BQim0
7Xs7qYITkCsjloA74CDGn6lZhXNTqFV05omLiCz9efg
-> ssh-ed25519 Kk8sng DzLM7ewz+4yz5YNQfBDKcOOlqMxScGR34XfVpCUHMEM
eH2ogYJO2N4cqxRibCOEoL5cXcTdWavHS3uRX7wwHxY
-> h<Vf$Fh-grease :~Z8 qwh*'} 2*OyJh )iMU_m?t
u9QuYuPJEVl7Rt1cEcXZPQ0IfpOzqB59iTMch/SDoByr966PBlBfjDS/7i9U0sEI
GMeVtXePXkKPXVvhmbZ/C9KI
--- 1F0kxs/7SRrpoj9q4t1eCg381LzCgrwA1DYG7zcI3dI
ö>°cY§ÀeéEò‹ƒ\ã¯<>Ôc¸j‘½ ßÎíÃS­—XpºýG<C3BD>§$½}i¼10
ϱ™< œ`á Œ<>, öAž¤£~r>ø$|wˆ¿
-> ssh-ed25519 xoAm7w ftH5Ym/ik0hpKF9/keVodc9lbrbl/tfgI7FNYvY7aCo
2UxiWjJ18muZg1qcomcFEJChlebx5dvdsVfdxdVCnEQ
-> ssh-ed25519 mbw8xA CKMJ+LK6HWZybajuHKTNkPUJWTcR/E7Pu7E0LwLljRE
aXgVMhoC8GEAm4YqHPAascX4CDX5D4T/uwbfdcfheI8
-> ssh-ed25519 N240Tg WjE5EbH6nsSCsZfHBTDebdCYU4lNyEemAfqdSIpYxiU
Dt6ZVntKzQo65WWHRg9Bp0JJhjwMIDqfV2WMdtELhpQ
-> ssh-ed25519 2a2Yhw Nvaz150AMV7M9QuY87wPGfHCfNJ7CH3VSl6tTbNlHig
U7KG+Yl8OnEFjso8s5xgHDsnHSe6IfkImG92uoo8BoQ
-> ssh-ed25519 dMQYog EMPtqpONlZ1XJycSBZJMNx2LBQEcPEcPIoJ1LstdJE4
IdewH3GF1c5hWGNQYbLYWMYFrhiFfoN811GDdoNEVlE
-> ssh-ed25519 G2eSCQ unDoBOz26bzNaKAoYfS+Bf6M+bGf/D38aZrGL7pifgs
uNcXcIOaS3ZGxwmKXMqRR7kG3ErDW4VW0ZSDVkrDPVY
-> ssh-ed25519 6AT2/g hAm89Sp/tWm7lnSggrK0CCMEXxkBaToQ6wsXSzZifTE
qhRrlwPCdaAmvW+S6XdbWsKnwoO2eLgWIfSF1XKaP2c
-> ssh-ed25519 yHDAQw vm25bEwFJg6jY2LIHTxbOnYDE2u+8MuahtBQJpzdW3s
/tZPXzO363LuyAQ2juZnq5S6tRXaq5RA1VsdQI6I3LU
-> ssh-ed25519 2+FxVg EfDKgl4yXd0MaTMOYVUwWqlujNiDJn8cUensuRHa9WY
lmq9qcJaGm1IIlC4wZ6rcnywJrZP1XrjXGpQmRrE6WE
-> ssh-ed25519 CRfjsA eJXHwGRcgGRy7jziDsuWJlpJZ367DgmPk33vMza+PVM
kQzmsqhxydPnO8zkQAF6V69inaIur+Jj/Y/UWSlm8bU
-> ssh-ed25519 vwVIvQ g7Dbz/nR7ltZVJtfnLfNcuTl0EEmwevqx4uzE2yU9Bo
t0kEKYGDjcjDRCnKcyLoLJigfupgSwFGNKnWZNgcEjk
-> ssh-ed25519 fBrw3g 8YAKhKpmrEqyg96QOTPjHv/Ufjzn4ebyf812/u3crB4
joYiN6sLiz5zlp+w1nezyVLsN4cTMreL7vG2Q1BR8IA
-> ssh-ed25519 S5xQfg PvaGUlWhWUhW8KXg9GK0Tlw4ru1M7vpeG4jdZt6HnmU
rFb37EZYgmmmrJNxVe4S5CkFEadUNw72FWS67qlOcmM
-> ssh-ed25519 XPxfUQ BQkn2MzbRQT32mrGK9jyvpm4e2cnZEmrFig+YVOy0TY
vvemmqvcsE+4MZYBltYMZyuosZy5JxDYe+a+EbeDTv8
-> ssh-ed25519 SpD5mg mndEjGwk50wd8+zdFao9dvscApXrQVk5HcdgBzTAzhI
1Bl7ixB7xYLsAYvu3HY67u48Dv4ktDwYo5oMAbr4n1k
-> ssh-ed25519 Kk8sng PR7IpsRjn/4WYchFHfkGPgNayTSJDM9rY2X1CFKN5Fo
mHPqmcdjP1atZYLaA3phPsjrNAEbAfvpu01mfZ8qK54
-> ZN_d{1-grease {~-\e[ 8c 0LUi]F)=
E+1JKauEcaaXzol/Gg4rqPJmO3+x0EU3V3evmxbZ
--- hl4Pp2I55YOS97jg8WRxXI1+wylN6RvGF3P+kRxL/YE
Ù$²L1ÒuðC,œ,QLÖiõØ&º`ñÍe<C38D><65>0§ÿøÙC§”„ד\7ÈP3Ñݤ,ª}U¢ üî·½î-¹R.¯îb®‰|1ò3  ùŸ“àÚÒ

75
secrets/peertube-db-pw.age
View File

@@ -1,39 +1,38 @@
age-encryption.org/v1
-> ssh-ed25519 xoAm7w 6fOw4Kh4O0WAdZG0WPBdl63ap/Xr/w+Rweylt/0mKDU
M2ZYVPz9vVGjJ6us48pXSFKKH8tK8PhkvBUJAUriimY
-> ssh-ed25519 mbw8xA JBYsd9iwH4E2GfGP63DwdwT4Y+gvL31sB3rSY2GKDmQ
zMHRL3bDxeAkWdKYPPtc/xyrkZlNtzBwzMyt5lb0H4o
-> ssh-ed25519 N240Tg 9DErfKdTHuvUcw9+5yzo8kMHa+IKxspGlWb6KRvPB0o
q1FLalljaHyYxEu6JrmcXGYhYi0L7TAtV0U8UsaQ4cs
-> ssh-ed25519 2a2Yhw eDolYbro00zktVZA8xdhbjvLkcOItFU/lTBPXNYypWI
d1MlKnVGRf2T2VFPhDnsSF8fboF+5mAdXEMeJRTjJz8
-> ssh-ed25519 dMQYog 2y6zkr37iC5VarUPOlrXVj9XyS5pihQq6O/K20gTMnc
jQxtJYCH1JagBpaupGVizzk0ZCswOQvFTcxT8IeFtRI
-> ssh-ed25519 G2eSCQ 8b0ZqtAxiFRfLEMHnj6LZmq5CQT7nMmfTwc+gpKbQQs
kl9EvBs9BpZXoomdg30ViCMBV8xEnYlCD9GFY+dNVBM
-> ssh-ed25519 6AT2/g kA3H9/fN5qyPquKIBQqYSGZYhxqDc7Zyj0CrjF0Nqgg
zXrT+jpTJo6ToVzLuLzDcqblXKdDbjxt4Zr9CvWBZc0
-> ssh-ed25519 yHDAQw vuMN4IU9wAIAWDFEDCr1yjEPtEMCISxYTx27qh4QS3U
2vrVYYbBlbyEOmd7cpeijKeNk6uEe/1iWQcZO8dSrWI
-> ssh-ed25519 hPp1nw TwogaV1PZXUekJoqXepW8sUm+DvPCxTEL+RobecJ3ys
VKM1QHFM8qDW1ZCpueQEqQtQknoQ470nll7y6WTjlWA
-> ssh-ed25519 CRfjsA dvkLphHpCButJtI/RMlt7RvaIuMNHLbF9y663tvuvhs
VEwK/KDK93e2iwEcwmGM8vvhwqi+tNW8SYrbsehZbWE
-> ssh-ed25519 vwVIvQ xnd9Vgz9FCeRu6yZbbIZbSBEvSkgPzFifye5eT8kmT0
XOCZBNTP66Wzy5Vdn4qJwzApDx3U2qNnQqEBcwfARHk
-> ssh-ed25519 fBrw3g 81Mv0OtBk9J2Tb7kjnT4uCGeytV7HJfOTcA5C4NoLy4
hiMbGjXjtvBa2Puhb8GBas3WXc0fozRD4hg73MvQumw
-> ssh-ed25519 S5xQfg F2oOMdM1U1aT4K6pIhCnCz5EbxnEb9Q4QZ0MkhSJKnE
Pz2cyF+IGLz64466ne8np3xA7g+51S4s4mlaLRohIM4
-> ssh-ed25519 XPxfUQ 3rIutnjj8fXIo3mCAL5nfzJep7q70j+AGLE3j/JxOhY
v2Xj5PbpFMsf6Tx68u7VHCRqGa3Wrnsk4E6Q08SklUc
-> ssh-ed25519 SpD5mg tmM+zaXpX+W8xsMfBCoWZc+7wPRI6yFt2W/p4O2s4lo
ckNxHza6ruYdIffwxDFOWnYOUgpbWNfwzU5AQJb6ZAA
-> ssh-ed25519 Kk8sng 2ddBuZ+DEVuvRmWS2O8r+xT4Qtrev78Vre+yQ3kNdEA
LojDcUOsZtA5kw8kIPC2y+G21T1uKUEUkwkJ3xPiUX4
-> "JnF1%Gd-grease |=~ P
tzG7OLiEsRVyoTBpLPGwqNBUGkz0
--- /AHllIllItlnpPXQAkywTF1UsUb7Wpec2jdYE6kOkO4
lß´“ <>§K
^U5{Ôpœ_l9ûá7I#J¯˜Á!ë†å`Cθ^vÚÕˆEòµßŸÁˆuž¥òä×_WPæo2.<èù w}¶Ì
(!V®
-> ssh-ed25519 xoAm7w 99ufX8x+2IWSFhunUnSeH5Li0bdNZQpnjAeoI7TBZQ4
AtecBXuKzWfxYO80lRha9uyltLExWqTTpT80HHOsW5s
-> ssh-ed25519 mbw8xA ZEtocwiOLTy313asl0C9MDGPy8KTk5wo6hZHLSx0WjI
wwxe3HF3P5BFfAMI5nes+dwnzM51HSY3xtia7wVBn8s
-> ssh-ed25519 N240Tg 1tT+WIwhrNAZKiU11+rS6lo4XqII4yjwoC5h/J8GLkQ
hLWQ7XFlmycr+J1MukhHFebYpsJVUwUz5F2+XNDU5g4
-> ssh-ed25519 2a2Yhw 5JwVo1eeVRryxYYaWznfHlIm2IbNcONOKK++ssMj2VY
o1P5EycNl31HBfQYZyB3KL62ZxBej/t3T30dfo3WYko
-> ssh-ed25519 dMQYog Gh9wRFQ5at0IRp7lSUxqx4cmo9khOPMfS4B+QM7JRzU
zVhsUzfXDOowR2ICIEqpTfm2TjsiFmK+3k0/cHJ/o/o
-> ssh-ed25519 G2eSCQ iv5pDSg2yIcqCJcBHS4GL2lbCZvzPxjHbkLjZJQEWD8
JFGDm/7tRozdGVSdeA7kd6N8+Sj39OjJ/Aut6A/7w9A
-> ssh-ed25519 6AT2/g 3aE7p8BUJ0Dt6zATjGBql9Hgv4gzpAR5zqPahLbR/j0
nfhfhAP2ZLWZPzRr2ZV7oaP2DEOGH/9Ygo0plrkmu4Y
-> ssh-ed25519 yHDAQw KR40v7vC6hRm9QqWtlF9WX8WIzbo7b0Bukvl1dHMiRE
2F2jAXTK2g+82Y1kSzkRruqAfsCzhYwKEbJWtg2JbMk
-> ssh-ed25519 2+FxVg JQxr5S9RIOcVzBK2tNBtIBDnncldTPk9blnuGNxrmyI
4vcIXvs9seQZ3GVPIqYr41Bd9xhPA11BlLHa+YNDf9Y
-> ssh-ed25519 CRfjsA HjpZxl25Xu175mNcmhb6gBJkSiN0rZAHGaxChssjkVw
dX2D42NviiSQGCIPBPK1x4CzLf5v3fkcFM6+tVAi7k0
-> ssh-ed25519 vwVIvQ a08tDilNeVsKz/SdzmI7/drnMTyh8o45JJgc27yRZG0
5qiAp/6uHLIBNdG9FZQqZsa7q9pbJyzlTe0UQvWikPw
-> ssh-ed25519 fBrw3g dDA8Vy5fpfTs7b3+mAVkR1HXvtSRcyq5shCHZtwDRxo
gIk85ymB3yWjINCmlSJkaFMihCD1vDon8+OLwAh2wRU
-> ssh-ed25519 S5xQfg ElRT4mtq4Ksv0imJ5dbvW5M5DIgdStHQdrFqzmXZXho
QCK3xZRemQtgXczwgwEbrf9oJZ9NtSHa3a50T+nE6AE
-> ssh-ed25519 XPxfUQ l8AbR8IsS33Q99i9uC0b3eT83tAX7CFiep0V6+62hRE
D2YSywYJ3WzTm3VWMh4YWKBaTARQ/rexq7ked3Di9fA
-> ssh-ed25519 SpD5mg IQUqhLhcHQn9wfFY1RSZnv/GeQau6y2N9JOl6e8prgo
K11LjHTz0VZyYj90xsbQznUBGvckPDX8jDy8md5o+8Y
-> ssh-ed25519 Kk8sng XRNVn/26tWcdLBzO3cb/XVdewgaw+b8sDIn0jDcWIU0
r8yDTjK6W9BG18hAU/sN3G6o2jU1dyhn/no9SBNcT8s
-> P_O-grease M#%Ei0hU
rzNzlsj4euy4zrS7S85p
--- T48w5S/LYYKktHmqdc//AxHomtH3Xz7CPxRD8KOhYoA
dú6ûJ+B†·r!žøµŠC&Y1G/ÖKm½ BÞè©\ÆñS Tü[l„uW
á®fÄŒNTõå6éÜ|5c,R"É…ÜqôÍ+;šè|€ªÜ

76
secrets/peertube-init.age
View File

@@ -1,41 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 xoAm7w N9ZPma02+vK6eoQ6X9/AufI8d9Sq0fAmbCygEAprM30
qUcK7qCxU/wGxssjMO3BFmiP+ZPCMMA+MPsqTS6Hau8
-> ssh-ed25519 mbw8xA 1uhQY3YHakSRBjgVfqWc3ynGGNT+T6qR74oy7UpbdGM
7cvBh7xPxDxZqrQURBUUnyk2YjzVY/kzAUf7dy5y/JI
-> ssh-ed25519 N240Tg ujiP5iMMSupxkwhY1DpkmRQOQlZSr9WjPGrY7aUKmnQ
FNeXuINzgDB+gn/u76gQq7J1zYCQC0wbFyUVxvbalI4
-> ssh-ed25519 2a2Yhw C8/2A7AOzjyrH4Ulre9G+w1y7H1pvVZe6k5PTmGBlCI
9W6w4Ib0riy9sbZEQvSYeJ42LXwPruV8kPvTOP+dMqg
-> ssh-ed25519 dMQYog hIbfS8dz5LGPZ9sU+lHHnL8KB0CceM2nYV5mFV038gY
6r14pRwszEZGVzDRZQlymlgjdp1Zd+r/O2IfjqxBZcs
-> ssh-ed25519 G2eSCQ kvgWxBHowwVcGlm3KiWjxug+Wx3zkcMWl4wbPRrhrl8
A5VtHqvDwaa8jONXMTvVQC1ALcnsiqxllM/DrRXWFws
-> ssh-ed25519 6AT2/g XUGBtkOcpLRKNDS3hsyXAap1DXAIeaRX9jFOfhUpMw4
sq/Ziv4RGRBmrUgS0GWTQs8AViUXBWjUxqf0V/rAN8E
-> ssh-ed25519 yHDAQw GmscTQwu+lHC2VARJusQ606NLf6OlxITZzINjrbxf2o
LmuIU71tE+2OlF0HGNS+DdXCLdA5lAeTPXl1S+V5KCA
-> ssh-ed25519 hPp1nw XQbGxz+YJ8RieN0HxEQz9kJfikbWTtz1hFNGQBHkXzg
1yst2YMs9XelKpIGyl+qxAgrFZ+Hq9odh6wBovbb8sc
-> ssh-ed25519 CRfjsA 79TlEM5+g11lMOkkW/KvSTmt//ChklK3jlUHLAM/1hQ
9X1VP6SYST3Q841ahE+fAeg0FhKq+/XcZdysigIOgdc
-> ssh-ed25519 vwVIvQ 1r0/J5T1fEmOjM7ybKDPOBdE2UIDEUdkIFNWGJBzXGs
gAOX/3koAfQx8er8nt4dlvLbIoYfeVPENjz7wLNoFwg
-> ssh-ed25519 fBrw3g 9hdWAt6qEwjAwVmTprCkR2q6GsE4dEOCiCTRfz58fTk
f24fPWUrwtt1UN2ebk7tj7gBY8EiAMwvEvztCvaNZRc
-> ssh-ed25519 S5xQfg wyY1lx8QIDJy9pCi9zS3T3lNV0jQGhVC8HvyI60zrD4
6+agBFHfxcaTLfZLyEeUMl9zyaFbsM9X2EXPvf6DfeM
-> ssh-ed25519 XPxfUQ IabbhU0TM3zImRHyKk1NLnGRUUTuQHHCMLzp9AltDVE
vf+5OlycHphA0i4nB7c6OtBBahWPJR/8VSWzudM9FEc
-> ssh-ed25519 SpD5mg VSBErQVSLWPcA7C3p+wuL0/JaP58O5Gvy8z5eJduky0
jnd3tBVjqhf8oZy9h2soMZVPEa2dvYHxvrNUdKK/UwU
-> ssh-ed25519 Kk8sng 3gM4o/sdewPR8BZo8owBVEE2GwqnQgUeA1Uxsd8nOlM
VpgZRzc4tN7QX8s41iKoCstfU0KgrGhWolfws8QXYr8
-> vWbrVo-grease ,kVQ{
PpMMMc8V/eqh5OBEcK067OIY3UQt9QTjHCVVesZediQxm/E2rRYvKm793NdgsflT
mAA0Lcu8/6EPFWtK05TxkDO+JaVfrvKLKuh/E3k
--- eKZw2cOm1WsLYj/Bx14q433kkZ6altIqL0qnBSYXjn8
>»KÝ’-B<15>vœâŒ×ôÕŽ}4©Q‹åÎ˳x
ÅîÝÒ{ʱí­
0U<01>Ò
ê¶×Ý
-> ssh-ed25519 xoAm7w cxa29LYBQrc3YAW5rUvS6nfkEg0j66w5wYu1PZ8Wc0E
NdsMgB5PVVsFrm7wR3xrOcMmIvP5pv6g+KYAhiRvpuI
-> ssh-ed25519 mbw8xA CKUESfDlXNokBZDcbmCkgD16V9han/+r5dFI2rnBcRc
uc1sJ/OQ5gclZUSIAJ2c9VY2Xb/ArMNpSnNp+gSTWZA
-> ssh-ed25519 N240Tg 8ZUgwgnxZFMnR3F+8VSXDAYooXrJsWK5QpfSxKKSKBg
raQOAeM4rpFuGMtjts6AkwcFaVRNoy0byVXBDR5BYYE
-> ssh-ed25519 2a2Yhw ig2GjUHCFT57AldnHOWs5uQAaOoFJeoounbweJTQlwE
VARizPNxh8KHt/PxPgkagovHAVIiL8ex6XIwUM3xYLg
-> ssh-ed25519 dMQYog LQUCsEaZI+6jWrwz3HKWj4CJN1r2SeCJmc35b2/WsHc
5S4K966vu1EdRTENYLgyCdmGBln28O/j9V3uPgjaS7g
-> ssh-ed25519 G2eSCQ zLkbxZbH3rsgENTIZJKDPo6ByTGjwRScgl3HVZxwu0E
lHvz8F27CTG0pCW/nAJpdISuTcOiqpD2PhLOYyWCC6A
-> ssh-ed25519 6AT2/g 3pshwP5X6PFs8GhQVPQ5s3TSyEt/Z6mEswTvZ5ZLgUc
nFSzE4oF+tnXklCyacNQwBJ82s1HdmGC6mWrYqRVd+w
-> ssh-ed25519 yHDAQw wnJ41lJounkHLnZB56fLgjles3dYOzoiFM8vOfEHPEU
33TGDVzGFr5TSVSzK3MHYB5rHR70lBrnvpgyTVBsLl8
-> ssh-ed25519 2+FxVg NnL/Wt2gNb/0vkd9FgiZFlkbpCfwweAJUCXi94U1Jms
fvkC5RGNBDZ4DLVjZvAQCvnqLeQAuQn0XCS+VFSyb2Y
-> ssh-ed25519 CRfjsA YC4+VW4epc3UKMDV5r6RXR4Vx8td1qCuTJwnSiHyxV4
gRLgJqsMuTKD8SObfpR+3zWew5rjwdpEmUluyWco3Ps
-> ssh-ed25519 vwVIvQ qr9hH+jPD/2eXesSPE9/sk51EeuNHmPe+Br1XVJpsDo
fiRhSdMKVo4K63UAJh4jyTky0aUZZUYFDAE0abWinYs
-> ssh-ed25519 fBrw3g d1YdgbjHQpvTgLjN9z/0eRtEYs3x0Wht506uxogWCm8
d5bULkVNiFT4l9uJ/6k59dfcY5jYkv38YHjx7+07YRQ
-> ssh-ed25519 S5xQfg 9Q0QgN7g9kRGiOvBGZp+3TrVuGU3oyAvK9M64aUmbSA
PJQPEpCM4zU5VLrqsMa9Qd2rZvQSq1vYbPc0uCwtWyk
-> ssh-ed25519 XPxfUQ qS5Y1YSx2g7ulSINPEbjm1lqL3OvGuLaj04tcPmjTiE
hSw0TZRL+V4NinnYq37fC64zFM8CdhZFNXmd3ps0f3o
-> ssh-ed25519 SpD5mg 6215GJh97SQIklYqTx5WPUlPbNJUMo0vhXTwtr95rGM
jklCiz/2AIAIuCKPFS8u1Bw8SXMf1AOV9X2P5UHXMUU
-> ssh-ed25519 Kk8sng F8va5sud1ck2V5MQ8ky14Eolj+YEIzoibGrty0wVQhw
FQIkCvXEtPy+aek5rvU6SO/Cet+f4wzQ/ebqbLSaunU
-> 1k-grease wE~W)OD
DXxr4+gUdNeA2+skSQ
--- n9Ef7xVWYWE0Gu0h2fLzw2gP4qOHKLsCZ/6Yjfxp/xA
Ô…Ñ…(¾= e‘ŠjÿE‚ƒl)h·:¹žiÉ<C383>…ÂÎ(>6ð¶{ÜäêÏ :ÜlŽ,D¨º,I;þ3”˜»ªw¼¾úµ­Þþ)0“غ0ÆøXÖ{fè·—­@þƒÛꀪM­ˆÒ˜ Žä!t

BIN
secrets/peertube-redis-pw.age
View File

Binary file not shown.

BIN
secrets/peertube-smtp.age
View File

Binary file not shown.

73
secrets/pia-login.conf
View File

@@ -1,38 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 xoAm7w SqYHa6RK3Qc2q7PnzW+2zWIc+A45lcgsGUOcloo5NCY
YK3fq1eFLcrYyeB0jrbpaDlvZI4QXtGDB6gBsNOHRbc
-> ssh-ed25519 mbw8xA td67bdiy9OVhynehUE0t9WNhSm5mibBSouANJsb54DI
k5Q0NYRDLuEVqi6spysZ3wczsl6KeJHnzeQs4AcfOPM
-> ssh-ed25519 N240Tg yQxm7sk3zmluyfrHuXcfcUH4bep9yO2yasWsZL8jlm0
0uLbEiU6G+BOFnhdtQ7y1TaZun3L9cayeOJUiKmhK3I
-> ssh-ed25519 2a2Yhw rWgv/wgxs/G8JqWRMX4K8OMkbDDEWKXn8tr1EZHXNTg
//vsUBg5VSyyPOhUppiV4hkEhSVh7TUxlgRhroeMH2Y
-> ssh-ed25519 dMQYog C231LaIgcDukZz+Q0w3BS6QoRNPYBpQnDc0iapNDACY
h053cONj1m8SP/V9oFU7MuMRNKq8KNxr9FyWoRShZ2w
-> ssh-ed25519 G2eSCQ oazxEulqB0zTHwBBZxxBvskYLENNm62hy0EMt/6BIi0
rM8Evty9wq4qC/Tau0bU0LgBqNP1J6Zt+iQeYwhBJ1g
-> ssh-ed25519 6AT2/g GWYlWQLxy+JjQUGGG4P2ePuqYkUov/0OV1gyAUfo7xE
CT4W8xfyQyZ8LgnVWncxL9TMyf2tC1mXhjJ8/OrV/yk
-> ssh-ed25519 yHDAQw 5FsOvziKO7oXBvIbJ6ikUHyZsfJcwoXcXYmCCCZlUl4
5wywGXF9/QbqT0H3f7GY1J79ZwrFaSG6qzHll5G9Xcc
-> ssh-ed25519 hPp1nw Aii3iq5LHQPAWIGj7RbK18ChTij7zYnARHqXTAcU+wo
218UL87Ev75zAsloHSkLlQoSLk3u+XaRgMpqFlHQEIM
-> ssh-ed25519 CRfjsA AafQ3rTlpqLZqz614VPy0h0o+ha4f7gdx3zuoO7h9BI
jyhVN8DsgSo58YPKb8c/eBWSgunbLgN0tnvqTaaOxTU
-> ssh-ed25519 vwVIvQ oQHpWgGDhgea9M774iyQ2gP0hvSgFr5ScM4ZdhMHD2g
9vJjWXwOqpOfegf9ZtKMxAayDsn2ziHGTHGIBlAO71E
-> ssh-ed25519 fBrw3g lGSzsEt5Ot/RHwJbL3fNQoR29ZQ7EsFUWv7HjWnU9wg
cufwuuyT/Vcf3QeJGXEcYFUQqjf0US95po7FaGMYXAE
-> ssh-ed25519 S5xQfg CGj9qzx3vvlNnHh5RUyg4+3gVpIEcgGYbYJr61oTJgI
x3TLtdaRpFtMRTC/RdngyBOeXQFEVvQIRdfAsaj8hj4
-> ssh-ed25519 XPxfUQ r1iu+mpoUVuf0AqaDsrumw8SOdiHapODcgrYRrAuSjo
1XNRKfEgm2U9DXZmNogFr9B9MqibE72NjyHiy2zZFMk
-> ssh-ed25519 SpD5mg NM2MP1/5yxwQvvpiHnq1aiXQg4yxWpsNH/Isrwcz1Vo
IdWPzZg+/mwCr91bIlDMpAiii/HWsnIxTGXnetYjRPA
-> ssh-ed25519 Kk8sng 4NAaCbs1EOQpZz/qm8yW7PkFdsn8seSTgInow1zqBiE
2MJJNUFyBkxy26adDmoJKNndeQT+MsJGjdYiXMpMS4g
-> A-grease L''*[IU]
5xdl3E2HB0Yz2TKiRucf1X/PV2JS4rc4LG4cKJ9VYIUksE5Aoj26E8h1izCrhEsp
Hnr2xC029yD3shPQ1w
--- OjLAmZwep6nKTZYMUuBBaMe+F3FmWqsCM2XCDqoiG/4
ÍZΛëk²¬¨œoéG´ûCbÇÚ!Zö{ʦ ƒ\ öO˜+PK±¬†’rîЕî A´~zÕô@ö’\Õ‘±M3G¿i’ÚGl‹èçÒ~€!þ§Á*Qõ‡ã
-> ssh-ed25519 xoAm7w 6YE8Xut+bONuueEoD3aAPn6ly0nlgHKmPhrOYmaZyys
OFY0cogxB/TM5ShiYG9OyAlIXJvPWrgmB4QZrdTYTGA
-> ssh-ed25519 mbw8xA mZdtNfY4gLd31NYVhhdFqKhNh+tKTCGayG8n8CY16Xk
3FVJm0Ky29mtmCo2NaeCPqcurt1oy+1kFaGzBMRFvgY
-> ssh-ed25519 N240Tg 8ldjy789NFoPb6FprQEESprs2G+tH4h59uZ1cR9OKmI
527JcKENr6ddpZ1xWy+9rWgsFG/0/okHYtyZ8bnIGtU
-> ssh-ed25519 2a2Yhw CSpAusLjwTyUMR3TQEX7K6wLkEBQCTwDmDWzqa4BWE8
ZMWO6kC/xXdzeYzuMtj0PU78rjCB2SxmLW2FkEm3GwA
-> ssh-ed25519 dMQYog xKjJsFoT+B3+vm+92ywinppmwbMDFqlLHLlQh56d5m0
c8yhBQL/umJZoAqPXJFYFZVN2CwyftPnXZbL6BEo/XA
-> ssh-ed25519 G2eSCQ PNecZsY2AXDMAZvPw+HMdioRE+4hiqoXViwQDAvCWn0
3xemYVepW2NvII/zDuUsFfp5uBFQzU5Iz2zHpnSACfo
-> ssh-ed25519 6AT2/g fnRDsTvXSqLKzraCy2QUqIqCteAlVuSqrkohHoIQh1A
NJaoRKC8IyZcaObclNuvIJV1xtNA2Vnh6+6gylNBRko
-> ssh-ed25519 yHDAQw vhIaLzY3A5H4xVoWXJDFXdlX/Ddk0OCScSp72Jy+jjA
r4sj0I/Vs1/klWNa1Ud/alCCmuGGKbZ38K0UAbxOaNg
-> ssh-ed25519 2+FxVg UfBGv5v9kilraMWTgPj6reFn1Ipv8elF/Je2L8HJfzE
xeMgBC6Ao2ykXFNRbdok/gC1RXHjH4NPiv7lpFzCWGI
-> ssh-ed25519 CRfjsA 7Zz5w+LgThJBhCeTLsT09rZnQiaLnFUuuxxFz0ui7xQ
XCPZeaiQ9uDS7dachDEFKZXc2VI+2S3EpP8m4fWH714
-> ssh-ed25519 vwVIvQ 5Bc4/BrCY4VdCabJ+XW+e3UPshgZWYFktE/QBb7+0Tk
0+2IcVoyV7aX4wSBkwD0uuZlzInTXXJpJ582dQiwlME
-> ssh-ed25519 fBrw3g NcGqfNA75TZK8snDZ1RV7CXDVDHzIo27CzUlisWw8X4
s9UR8O4q4w/PbAZPSd3+hubg8GdUBYfhQ0zaRTgTx5o
-> ssh-ed25519 S5xQfg xtYjArK1YYAV4ts55E0jPIovtagFV7UJRb3iv1Om43U
SkqJ8UmlKtf+0KntLyjZ8Rgf0MtapEnEoVA+xTFbVSc
-> ssh-ed25519 XPxfUQ gy1JvMR1oy1mstVgPAc8m2haExzpEaJj+2POUNc0ZUw
+HaGMvuuybpJaWs2yCjUyJ29jXKaDLkFBm9l1WLus/M
-> ssh-ed25519 SpD5mg C2BcTINChQTOMgMnn6wjJZ7ADmiqJpE4Z5dYZ3z4wwE
QgUNdg/PSj67SdNfa08YvupPfV4GWnSkwcRIt7ZgOVY
-> ssh-ed25519 Kk8sng +bkUV2nOzxIrwjFWNErRE3G5itxwzDKs6lG0NlSe/CI
X8rlOeGQLzZXiIrkVFHJDHPt6ruuBs99jZ1XLZSAgBw
-> N+U,G!$-grease u eB<}B2q $nG@I[&z D..uu,:
E3PUEP7Z7anp0PcXD2CDpRsv
--- FlP6ry9X2YIf++tM8sOD6wqqrmRgGNBED5RmAepRfOk
(Z‘4š¾´×Éxt-à<>¡Ø¤N9¥ÌÜÖ<í®Tû‹ÁGß.RW#kÞ'v%øã@êR‰!#Á%Ô|<7C>CùÉP€YÜÀší¹‘ Œt1Ñ¿³ †Ñ3qÑ`

BIN
secrets/sasl_relay_passwd.age
View File

Binary file not shown.

77
secrets/searx.age
View File

@@ -1,40 +1,39 @@
age-encryption.org/v1
-> ssh-ed25519 xoAm7w CNXq63Qxe5wvwn0dr7QKcJogg9cO5+no3FcNmxkL7Gg
w14UiCOJofq3r8VikRCOjIp29NXvoKJHyRms6tjr3/M
-> ssh-ed25519 mbw8xA tzrtBUcTaOZBi2BNhgwN45MqMlQKGZU6FYm8IEQJKH8
Vpc/0IHNizsxTozoVm0YZdm0qgKwx1sZ/JMIKSjQW3g
-> ssh-ed25519 N240Tg F4wZmhSgHx1+tLok5IdJe+CCzWf6LmlkOFNGWqOpxXc
ZF7+t0HDmfaJnyNe3lkz5aVFezD7mAxqRiDCZCwW2sk
-> ssh-ed25519 2a2Yhw rC3PH9ftW4UWPuUpP6tThaSe9AkfKUiEgQPPXerJ/SA
UNKobz02TnEN/oqhp7hwS46mU1IA0ehVzLqeIm9QVVk
-> ssh-ed25519 dMQYog XowiBliO/PhqZFnmfnXWmw7KVT8I8Rp46RjuFd/amEM
eAhc4PVY/3ZjwiNihO9Yqa/au6ebkXmqbK4Zehf/FxQ
-> ssh-ed25519 G2eSCQ ann2y2LP2fIHtQRLtpLow/g2yTmcEYpUrbc0N69iJxI
N1VAHkPjzxA5Vf9lKY5o7SWFy1kxlv78LSDcRt/MxaU
-> ssh-ed25519 6AT2/g uQhLUtHpvNoLBUs0zvdMeGTtXQH8gHzNiRfDq1x/3yA
rhSm2KQw3k/nhrm2UmCWJ1oBcmYwP1S8hAY5xUALY5U
-> ssh-ed25519 yHDAQw qO/7smo6DZpW4/dBvkorYBYSGBdemDe7UrdSXDjb8zk
xkRizpKMEbD0X3BsdSfc5DgjYG1IQLKJuQjLLSwPnzU
-> ssh-ed25519 hPp1nw +Y+MeoeD58k8uedCeD2RbRyGlcLYEgNc2PC0Hr7MuTY
B3wQcio9YW1Vl6reg6APLKDbizQDxWY32CkXbuzyyt4
-> ssh-ed25519 CRfjsA 6KxnAOe2pmjfwTiQZe8zHaeNJApPYdCCFK1OlFaE61A
9psQfGIFCSjSYw0AKpKRFZ5qIYFOvq3FvHFyVRa/zbI
-> ssh-ed25519 vwVIvQ Zghw7uz/yR4dgsFhbeXfPvk1HmSaXV6CcRD6GlHeiGI
KTM1Xu01FBcsmhJVeB6VGhMqHpnpLNmvWVBxV0+JW5Y
-> ssh-ed25519 fBrw3g h+wmH368BHkFp5Mu3PnbZFjyMVRBNcwU4hloIaZEaGo
TKPz2C3yF2wBsiT8/WhbKEg792PLcQ3YN5UWcxJnwtE
-> ssh-ed25519 S5xQfg YZcNHfVDJ0GRF+IpLVSxOeBOSoDhDhdL7r2npRYcuEg
mPfQ+m3SGGnGO32oA917AfosSnXGqHRDdMfIypK+UOw
-> ssh-ed25519 XPxfUQ jsXVjpItFnuJiaeYIaYKsJFusASry67LiqDW3n5+QSg
0KzbBSbRrq6JrpWEyTbs41b4gUUiKeZzWI3rBaa/AdM
-> ssh-ed25519 SpD5mg 873X6UIo87svyS+jhQGjILcVy+RjtsKwJfDyj6gmF3I
KNHCRKZ5NhJbNmrhWehpUXEv6jBGeJkRxCi9+/bgouA
-> ssh-ed25519 Kk8sng /ItiKGK46Wia6VSKa2AtEPj+PqpDtWxBhea4s3mqOVo
OPclxoc2MygKYJtahVbLfE72X4s4yVil4dugeSF/3DU
-> U(/M3X-grease Jh[D'
z6L8qVMUmuElYKbQViqc6tecJic8gho79RaMilbwp7uS+owmgqNMUFxv9+8bbtYY
wC+YIigf5xAKlwcOipCJ7xv3jlqt8yUFWV8hg3J0GRbkWnhFYdWGXHnPtomPFtE
--- bD5IgVE3GQSnej0FLxh1nGD2q2/fuhqRL2yYw+2KMek
·)ˆ7&ªð„3¦ Ñ_¾â%!2aâýÍݱQ
ÿ6hêlÑ )Í0ß}*ÌmìO(¿l8^"È‘Ì‘ù<H¡Žqr¶²û³!r<0F>ÌXóÖ˜ºxó:FF£¹áÉó§‚#.Ž™Ú"[Š9çZ„°
C¾ÜÊ62›¥-'™ÛX$S
-> ssh-ed25519 xoAm7w 8/Xbnl2GV2BouMzSyi9SccnOvkr9MhD16hL7mATBok0
IIUWe7J0BA2KtKSCV9hGHwwutyV0iDXEp4iBw2ECP1E
-> ssh-ed25519 mbw8xA ljb+MWwZ9neSLiGcRRiVV77AS887N9LrfJLi6f/XYQk
sNYx/g82DJC8boBMYev5HpHrBf/6d3Itr3O3C1M9nUE
-> ssh-ed25519 N240Tg RpJNQFws7kfcXBoEjAHSZSDrxxCK+Wvd+TxAS218iUI
Ykb4uzw9s3TYcNmV5Bv3Fos2P3L9OkKwPCP/dr5aMJI
-> ssh-ed25519 2a2Yhw kFpleOyyyhKDq41jgohT0BCpVpasAoiIUPs3oB/kEWw
9tHqujFzQ6QI8jQUEevspybHVDtzwyNoWEXUhDitlKo
-> ssh-ed25519 dMQYog ISBfsqV1suikFT1b/0bWj3Lk8VLR/PQrQjviWg4JmCg
nDnUy5N987f/TAwanzzOKtdYLJ2ywoikugr2sGuVI7s
-> ssh-ed25519 G2eSCQ ygV0RkgqXQxvsmXOIjAPfopWldnsMZ8KgwRKletoGCU
sELGgITcp3DKT1sNoUzE1Nl7tyINq06TfYP7k2yKLYo
-> ssh-ed25519 6AT2/g EtzGUZOzofDnfd5M8wIIxaoTk34hr49PbChEqMmRHHw
DvEzWA9X7OWjHAl5JCVV09R6KTA/JwlBcB/lyFVgbvU
-> ssh-ed25519 yHDAQw +ojBBWCXn0DDBK9kfhDRYwbIQgOVE49vAZJ5skq0Wy0
MbX37CfoHI/Y9KAj39XgRfa83CzgGuTRkZ+tcKT4Icw
-> ssh-ed25519 2+FxVg 421B7+BKrkKUv4anVKUtptyCneC9lMuAuqfYtow6j3U
4BDAGe7MmBPX/3c6SXnSIiZB1QzkyIDT+HKiXIB5QdI
-> ssh-ed25519 CRfjsA aBrHk8ZZKbSLYKjjySs1Qj//e7kGIjIBVMeT7An9zkk
W20VN7h3QwmRJmV5J3VGl7IhqUQatVAlncfufjnPwII
-> ssh-ed25519 vwVIvQ b9wq6xiir/uVFSbs+0pN34Ec+F47CwKAvjEDQEZJylA
CKiFnDpY0S/iZrMPNNMAT4+aZ55KNviXmCphe89bjCk
-> ssh-ed25519 fBrw3g F7MkD9bPZ3awfYdd3v4If+XCgtCRRS+rq/uW365mnks
vGWy9YrSiBESG4MWxgqWZzol1YSRUGgbjY+2Q6FwLWQ
-> ssh-ed25519 S5xQfg lZDkCihzUwC7rGSeRFxvN1Yue5Ql/8MveeIMv8nXLRU
5yxTfZhyk00iQnnFIsGvStPGFb4lWhn8bgDsnQvNnsY
-> ssh-ed25519 XPxfUQ zlZV5zjm2XkSo+6CQ5nLTaw6gPTaDbu0D7VHsYmKYg0
SpdQFAmBAOQVZL+kAKIQcix2+lCwvxqJvOPid6crL+o
-> ssh-ed25519 SpD5mg 4z+FHDyqILNWuc1iyqC9bLSZ43MhzdZmsMi0rnMb/wU
aBGWQ7GIIkQ8gDyrFYCLBFIzaj+VY88FfTJphzprST0
-> ssh-ed25519 Kk8sng p0YQLEF0uEq1aLcaNnnCE+z1FkI0DA5QaCR7VJ3ZaXE
djFc0xi5DqZpf+on2ytj1GuVy7SVcxey2Wzuvwy8AY4
-> UuD+-grease b 4<Q0g" hgjWJo qiA
19psCQoHNTysO3fsEMnVkLahsWJPgshhy5hQKX3dWUUaNUwnVSf+WDKXKnjeupWo
OaEPSmp8I5e0lpAggFZZhYwCu9fG2BZCFLeXNm2LFzUli9pgjFdYz/up2hB5C/c4
--- jMFadnLfkEPXvTzhx5TKtnK6Yr+r3pgpv4cz2RBok/I
Èþ

BIN
secrets/smb-secrets.age
View File

Binary file not shown.

73
secrets/spotifyd.age
View File

@@ -1,38 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 xoAm7w F1C6i9iOvzUf6pS7eBfcsRFRn4q2YE7htxCqiLvasw0
viF83MLadEfum6wQWgbl/h0l65+jAtBszhevVS4jh4k
-> ssh-ed25519 mbw8xA Ec2wju2txmmCHuVNDWdLQkfUNY7/okY2koAz6Jur53o
JLmlpd43QO/LPvS0TW9eKh6f5zZmbVDWjYn44J5ZqMo
-> ssh-ed25519 N240Tg 1bl9Y+I3XGx7RiY8078wEMdaAishvW84nMrprt8jjVU
4lXtc1rGouF1DoTohQnSEMvNwRZaaenimEFypsfxajM
-> ssh-ed25519 2a2Yhw SDknhtgjNgNy3ktoNNvLie3OdO8bKhWW5P4s73OtLk8
Ihl/yNw35f2CgcZX6KHRXUTpAHp6aAQR/7oeU+gq3V4
-> ssh-ed25519 dMQYog dME46DZmwFnKBKlmx5AZEoaVipBmpuz66RXPQfFoXSY
eAzeaSpIL5KPQADGEeuX/bkQ014L8MeTQF2fapO2N/w
-> ssh-ed25519 G2eSCQ 8/xTD9nSXyAeZwBEdJgLcOembBwnMOgWX3jR4N2sXC8
0BmY7u5TEcIEza2PZIJEamV2dfC0sDeVl0UXECBwDlc
-> ssh-ed25519 6AT2/g xSdH52Oq0TOg0D76WlDVSY5kJb0hMAWoM3XVyMtAeWk
0p2AHJDa9XK6C2g8AM/g7cWdR5DGLk6SoUL3Nah2G1M
-> ssh-ed25519 yHDAQw mQBHUkvKf+Na8pCfl2Vb7+sKLmKth0lbxDFEcTtH/ng
JDPxV93vE8mKJtDp/MewHA0F78rW/0ZPYUQKkdNUivs
-> ssh-ed25519 hPp1nw htVxNW9zp7J38WN06jfEX417xtXt50iMTRUtrzLRO2k
iTHjoS5eWNiQxIWtuylkqXlO8E+Dx/2CkENs16lZqhQ
-> ssh-ed25519 CRfjsA Dqs/SAfRhgszI9pz4yZHyVp0iqPg1ssspX6ZW2QTv10
tA7NQXpPtJQ4mHjTDr4pTt9jrqDkMJZGMLVazOenMbs
-> ssh-ed25519 vwVIvQ oNmVe26rEpI7nNGlI5G7Er9fu7blpHNE6NOeGkoR/TM
vAL2gsM9NatGQpnNIh8XpCP+o9KoOnuLVt9e8+Kymcw
-> ssh-ed25519 fBrw3g 7GVBA1eUhgxGfiiKirK/i5JUbehOJVgmc2H/tgQ+A1s
n3i9gtNt4aRT4EOk8C94lGmXNN538HNOqo8uCmxZz6o
-> ssh-ed25519 S5xQfg 2KQLClmvqWMuJDOSAkzcpJkRTJgV6ig5Cq22RcCixWA
zYULXTJL5o5uZxxi/fOCrocxZooH3KarUj8vUDkfWn8
-> ssh-ed25519 XPxfUQ z0v4A6O509NqQgbKFzZrY2WL1ATc9SCYckbtqaSOdk0
PbDNvSWw4QEGLUzhp8IrX0oMDJzWjeemuEDZ02YlClo
-> ssh-ed25519 SpD5mg +A6LavFPjRHuTyk0MTZ6zmJf+CIMX69fT/HI6/0RJWI
CVgJC3y/H7MHUCMR5s77oPWA56oIEpj+7MZH+Qw/LTU
-> ssh-ed25519 Kk8sng 4Re6/B65/TMi45/fZh7zl7dAzH4MnCnHqca1Otpaa2o
zJAlQ96vODytPwtwPSxEEi8hn052vCGcPUxECyU9Ivo
-> V1&(!o4J-grease I)F/
AQ7tCx9XyVd3QDf9Tadcz8QIOJ3bgj4kDh8YuwATAmF7M9DPAlQiW5qkkvaALloG
KwwV
--- VnZ2JJVPKnr8hDMqsZidpehwkLY9W2UmF40/5Khu7rg
„;»­ 晣,‘ΧÂ<C2A7>òHµˆ›¿ˆ±‚>ê¬?þL¬Üiv?PËwùìŒímW£›­3„^¯{^ÂÆ«"ýçMÈ[…P¤$­RàüNðú…£ÄŽýÓ6LÍ Ï
-> ssh-ed25519 xoAm7w oWqlikYvtZPfXQywZ/XuMW0b/w3+5D+KkaAimixxwAQ
I4kD0+enhgNuQWC4PYaL+9yvitL471K5EiUJ5B8nAw8
-> ssh-ed25519 mbw8xA CBJUxWTXE8Ln/3qFqMg0FeLBc9OFsSAl2AHeeygOwEk
+abHOk0hrRQDn7grE9frUJh7Wa28hW5Mak2m0mVGWpo
-> ssh-ed25519 N240Tg X2+ColuqWnXT1WRmLQ8wr8qea8uwhWteClBYBNKTIFc
v3YeIjzItehJKMPovIcGxOsAH3lBt7Au5GzcMFyYQME
-> ssh-ed25519 2a2Yhw UJX1qygh1EOG7IR3kRTaUF+CTTmeK64K7WDlSRejoBs
3dHllueF9JR8pirslK9KnRh5DuIg3yoI+P3xAETWgZc
-> ssh-ed25519 dMQYog el0Oc5Er66UQiJXKbS0K1bKKb1fP3gvlaJE0PxMF60s
ceoXPA0zjkFcqWA2sBA7F956w0yzIH1EWTZhPAxmEOc
-> ssh-ed25519 G2eSCQ 4Lo9os9HsE/S8RD9hvFmMZCUZndu4u+Y5kiMMDqxEEU
N7Ii/hgJ2YzyykzZYyL42xirKE7czTfhcdg59j5T090
-> ssh-ed25519 6AT2/g vBgK1qHPdccfAhfW+XhMuUwki5j4V34mbC1JStDy8hw
6dMibsL7dkzOdNFXq95iIVLZrcw1gvjX//Kv2ggNbeM
-> ssh-ed25519 yHDAQw nu+lave53WZ3gTlQbxIbNZCQWwOgx9oHqcGmBf3YkDM
aqpjYlhHa2osez/hbXlRD4nbNwAPelCWeQo7BjUYuHI
-> ssh-ed25519 2+FxVg W/YJBvKMT8etI3GGFNzQMne+3s3bX96+C01hqpl0QWc
bRDwFFn4R0oVoItxfiBgtg6GIypDxVnsgjQCYDqa1/Q
-> ssh-ed25519 CRfjsA v3Mq+ywipRWdk7E0uiGkzVrTLGbKtVRKQCeENsprXFQ
pUNkotqQs7AdnOFq6uK+Y1Aw1XPpYOk78MrL7mYNXBs
-> ssh-ed25519 vwVIvQ ktAGql+uSv5FlTGRX/dh/i+SeNf/425Ty9EP7LvIyQA
uzyYPdpoY+wu8K1XphBaQUQaPUI/eaj+pN4hFQOEb1s
-> ssh-ed25519 fBrw3g 89smE2Osv+DQnmjli4erhsBx/tajT4kcUMn9BFANWHk
PFVelVa6VjY/09vFwqTIrRuvEuiOjV66KzFMYrMqksE
-> ssh-ed25519 S5xQfg AneXz8P0Uzq9xlAhUo8NjP+4Lu98LEvVjXuI4T7nGTs
8maTe5Ql/BydWva8FpGqFW19yjOEwR9m3WjnHwoaP/Y
-> ssh-ed25519 XPxfUQ tCIPHgsUCVjL8J6rel0wriavQPI8X8A+LrralWhX7XM
tw75vmwvDkfkSsLHm7J/1G1RtXCBmmK+4/x8kszHaDk
-> ssh-ed25519 SpD5mg +zS3tCZuEDPmyJJAwxd5XwHZ6Oj529ASDJncvkHiWx8
s4FlthCezHVAwnAxeEsaaztzmhEvsd9Rfv2BiyyQHcs
-> ssh-ed25519 Kk8sng aAfQRcv43KV2/bU4Lu+Do4KEz++WmvqjHBjpK5Frmjo
I+fuEjPECpvC8hvEX+eDjFWWo3nOSuxApJuMmaq/ROM
-> L((Gv+;X-grease
FJW/OLKcapzoBETajzdgteof4o4CS0SCge1G
--- c4qHoenW7h4CZIBcFhf/jkGQFc1ztJPcC6VqwmQKZdE
<EFBFBD>[qáAÚÀÛP»øK!É¥eÙAÁ¼Já1¤ãÀ<C3A3>õŽ'Ÿâ¯¢•}\±cù«vñŒJW< c•€µ~ÊÙB¾˜Ö&³?d-~¾¾f^ödæ0{hárJ÷ÝLÑ<4C>‹óB­¬†|ªPêºÈî

73
secrets/wolframalpha.age
View File

@@ -1,38 +1,37 @@
age-encryption.org/v1
-> ssh-ed25519 xoAm7w QDzXkxhczV+ZUvEHmN1Uf7xWaEDSugv2dcisOakVPEc
+k9M+R98OqsfIROOedql7ksLCtejx5uzFXigxB1Dhzs
-> ssh-ed25519 mbw8xA ERuMyLhLVrNwmr1wS9h0ssZYayCn0Hc1dhu3zBKzDF0
pz2rEMX3MtxtVOTuEyO5K9ZE5s0C+2JL7lNE5BdUsRo
-> ssh-ed25519 N240Tg kHC1Wn8T3aUpWd4yK0+GJo+SDBXrVmTSrNz/Z+3kfGs
sg6A3DgaQev5ZezJeSNAR7+G4MS1rdwHd/6u1H5+0us
-> ssh-ed25519 2a2Yhw 64vHNVi/UCK1aCBFu+BnSyy42DHZIFeiDekfnQeDlHE
19On29XUAiUsTmlqxrY8PQGderv7VzBO4a10jT5aZwY
-> ssh-ed25519 dMQYog EHtR1wf5/2aWvGwkD4EBOECctp2zs2RjAUOKcncjUSI
s7dfQHaLjO6Hor6xXpx8h5hox3OQA4mPRGt8ewr0jQM
-> ssh-ed25519 G2eSCQ 4L9zIv4aApkZgFneUjVm2esXp4DJYVzm94LA2sS0Qkc
+iDy2G82PX6yuIyn7zITzp/jvBX2P25u26n/NuGdjVM
-> ssh-ed25519 6AT2/g HyH+8r/SZUXilmITIsFVyr2t6rCJK9scP9TR2/rO+1M
0Hkx2o3wlq7nj6fRSL3QNtrxKFxYlfhg7CwsyQDjIo8
-> ssh-ed25519 yHDAQw vZlwV2QvrzG1Xu4XZt4Yi5aDQ8qmPQnadCJtHdtTSlc
4NscOK2mu+P+vrZ8FIbIYhQ/97DPo5vgsl0jnlZM0gY
-> ssh-ed25519 hPp1nw YWRekiOxwuK8eAGehbBfOzW7Rmw95V+A/XD4rmFxS3Y
sd+q4ya9k/KE06GYGFV2O9P3O77aZcJl05tAvY6W1s8
-> ssh-ed25519 CRfjsA LfIzQhaql9b4EAotyVrvKBV1AhlMVcRarA49q7+rQXc
v4WddjXusd/m/s/T7E+wdKm9tDR3rGj6CNE3AdVrDb8
-> ssh-ed25519 vwVIvQ 53S5tWgmlVnKIHonBAmvxbv+w0j9b65NdyWvwlvgZWg
xa+z7MYrJHCgILtG/3Yw1OKH1/YKvuVG2jabnv3gSoA
-> ssh-ed25519 fBrw3g GsaGAXiMo4WhEZTQPgr761gAiQHmHPSwdWF0t910+DI
dmZGcEghoXi7giaxC/1UVJVAtyY5hcknUBxr0wQ4RBk
-> ssh-ed25519 S5xQfg wgkQBHQi8xY4++/quS4ZJWb9PPpg6b0KZpSwypdS7HY
+1yatx5SUanPC04jJMVVILHAwdtg2r9Bd+sj9728BnY
-> ssh-ed25519 XPxfUQ Hj2e1U4udGkp04dSdTSsaaJPIQ7gB1bwralXazBzpVM
LPOMpbX+ndXRkQlR3GKKpwSd5zOT03j5bII8btjY52o
-> ssh-ed25519 SpD5mg ++/8/U9XQKg6L3SHej+mvXeZYrvoWhiwmcurC3V0aTU
qR3nTcugxtBgDhcbZpCe0/NUavbzV6tFJZKv3IopAO4
-> ssh-ed25519 Kk8sng /bL56jng2lp0INyIDqUAX5L8mFmKxCBeHFWPUW6gE0U
4v+jq2N6RIQAh0VRrBZkMjSQW6L+LYcAfYUBvfTM+Jw
-> ";etw{[s-grease E;mh^R$ c8
ossMGyq0gpvz9PjjLBWD+QHRKKhzY6/9Kj4b0M7YdP0OgMdpr5QlA7UIDhiGQQBL
dbt0YyLxbAdhqG7S3lLeedQmvzv/oIyhmV0jsTB79W1l/27FujvPRWYf
--- pYjss6AEPZn0PG7FmO6bGq1O+k1IFGzoxsitB4qgotY
ÌÐçJö›Ç<10>>Z`´{ª <0C>b%RW^óºñ–&<26>·ª’ ­-4¥ðè¬ÙÚW…á
-> ssh-ed25519 xoAm7w Zhpc9RVEpY8IQHoaV7bXITknEzZvD3vhtlkyS2NiED4
XF4a0bcetANx/Uc14yI/g4iu1rg6tilwGXS4EZDiC9M
-> ssh-ed25519 mbw8xA 3y/ebluo5ydfc0dvKgfjX9d3h9oMIHB2f4zrTQZ1VRY
J+QzUk3lK6Lts4xbrFB9MsZGaITH2727tZ7wP5vv6II
-> ssh-ed25519 N240Tg wn8PvBMhca6ZaWwSGC6QT6RU0Evkf+T0pyp0KtL4u38
7/qQJHlx0KawNp6h6UeNvhXEEZ9c2m+BBHxdYihh/Yo
-> ssh-ed25519 2a2Yhw HC2B/ovIP9yOY8f1Y9vfdPqGmf2WDZOZ02o0U09CPTI
RlEnllYliqBORlAXMHBBJBQD2L8MUmtrCnnO37f1BfI
-> ssh-ed25519 dMQYog 0iDHfwUHCba5Qybli5GDAqCtNPplS5n9j76ukk0ZBDI
qCDVF47jdG5NesPRNy0IKLbJqPazoZ636Ow2WCdXTZk
-> ssh-ed25519 G2eSCQ 3QltdxVJUixiewBLgdpJDaovHIHErX3Q2mhvTH1XgVg
6rbVirj6LznfVZ6FcD+VoeOyj/4sduMVkWAm/pLVVwk
-> ssh-ed25519 6AT2/g Kyz9q3tPuiX6X5wUU6fyESJetkcTNgPu3KoWFFO/EE8
wQRGnXdTrFVhdUrCRfHYoIRK1Yun4QURxIdd9dBvH8s
-> ssh-ed25519 yHDAQw lElQZAKDD+AhsNEAIrz/3i1Z5YS0U46bQ+YHjxtX7Fc
ez72aO1BiG6J1G4LOVQDMUh8cAhqpxc1kcXJRRkg2Qg
-> ssh-ed25519 2+FxVg gbGEias/yB8ILGsVhhwfCNwGDCtKEa027TY5f8vAfhA
LcsSY9f5UI2akH5USLBMd0V9eDwd6vCpxjDPWZcXnpQ
-> ssh-ed25519 CRfjsA Pd2ZMD1asDSzddRD36LZUPvkYjDeHfZyEpOXMnwB8Xc
aFqMTiRL7zPKc480CysFu9645UIZ0BmqBAhB3nAxb44
-> ssh-ed25519 vwVIvQ LEym3BnhIR0eFb1/T3HHh+Ozo64qJ4L0L9gH3OGfLQU
54g4goCKamaNHNfx2kNVoMD/RmbcGMgbQ/71zdsuYhg
-> ssh-ed25519 fBrw3g rodu0fR9X+20LKQ8+FccwWpiT0LbU0KAA2NHmXbSM2A
w0W9cqZ81aJcpl6GT/zCHKMy2qhAKWdVRSVTgmmq7Ec
-> ssh-ed25519 S5xQfg zi2A//LI7Ot9MX1gohQxS8e6qHRozw3kEpyMU7jnfWc
72T7ctknEgZ+nnFCgct7B8tDa1/DJqkk6LAiJ5Kqktk
-> ssh-ed25519 XPxfUQ jXrYF/rcG2aJ9he1dCcmkuQtQlTAZQrqQFu4AaTESG8
i9o+h5NcB+NYgrU+Pei2xHSF2fihw75IDM/rx9ddziw
-> ssh-ed25519 SpD5mg 7u3lIXggJjgRZRXCkfgDb7+Sp+q+GtSKJH4gAycaSQs
jEEdWSJHjXUsx8T4kmmjKUjWNwmLIwQzl9FXKbHhXM0
-> ssh-ed25519 Kk8sng VmT7aS3ggF/M21MsUMCEF6cT8C8QvIN4IQ0le2SlyWg
G8rxkI0WaA2K3T5ETrEZJNfYpmhVESo0n3sDEs5YbVE
-> T.{#h\gw-grease \R/D bw>~X%FP
xW/YLhgKe2qTxlZSe836hH7hDCb40FXAQJ1VPjij02iCZEBW
--- KUhBgZXJA+9QxOwdJeJj4qk/rcUmTRXS8LcyaKro4c0
Ä䡬Vm9ëvcHÊj¹®²ä´*†z;±@–ó ƒÖÏ1õÆKZõ/TNk\nj