car_video.mp4

common/default.nix

@@ -30,10 +30,12 @@
     dogdns
     du-dust
     git
+    headscale
     imagemagick
     jq
     killall
     mtr
+    nmap
     openssl
     rsync
     sqlite-interactive
@@ -41,6 +43,8 @@
     xclip
   ];
 
+  services.tailscale.enable = true;
+
   # 🥺
   # security.please.enable = true;
 }

common/fragments/bittorrent/default.nix

@@ -0,0 +1,118 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  imports = [ ./netns.nix ];
+
+  system.fsPackages = with pkgs; [
+    gocryptfs
+    cifs-utils
+  ];
+  systemd.mounts = [
+    {
+      after = [ "network.target" ];
+      what = "//library.technogothic.net/backup";
+      where = "/mnt/library-raw";
+      type = "cifs";
+      options = "gid=users,file_mode=0664,dir_mode=0775";
+      mountConfig.EnvironmentFile = "/var/lib/secrets/hetzner-env";
+    }
+    {
+      what = "/mnt/library-raw";
+      where = "/mnt/library";
+      type = "fuse.gocryptfs";
+      options = "allow_other,passfile=/var/lib/secrets/gocryptfs-pass";
+      wantedBy = [ "multi-user.target" ];
+    }
+  ];
+
+  systemd.services."container@transmission" = {
+    bindsTo = [ "ve-transmission.service" ];
+    after = [
+      "ve-transmission.service"
+      "mnt-library.mount"
+    ];
+  };
+
+  containers.transmission = {
+    autoStart = true;
+
+    extraFlags = [ "--network-namespace-path=/run/netns/transmission" ];
+
+    bindMounts = {
+      "/var/lib/transmission" = {
+        hostPath = "/var/lib/transmission";
+        isReadOnly = false;
+      };
+      "/mnt/library" = {
+        hostPath = "/mnt/library";
+        isReadOnly = false;
+      };
+      "/etc/resolv.conf" = {
+        hostPath = toString (pkgs.writeText "resolv.conf" "nameserver 74.82.42.42");
+      };
+    };
+
+    config = {
+      services.transmission = {
+        enable = true;
+
+        package = pkgs.transmission_4;
+        webHome = pkgs.flood-for-transmission;
+
+        settings = {
+          rpc-bind-address = "::";
+          rpc-whitelist-enabled = false;
+          rpc-host-whitelist-enabled = false;
+
+          download-dir = "/mnt/library/Downloads";
+          incomplete-dir = "/mnt/library/.incomplete";
+          watch-dir = "/mnt/library/watchdir";
+        };
+        openRPCPort = true;
+        openPeerPorts = true;
+      };
+
+      users.users.transmission.extraGroups = [ "users" ];
+
+      # https://github.com/NixOS/nixpkgs/issues/258793
+      systemd.services.transmission.serviceConfig = {
+        RootDirectoryStartOnly = lib.mkForce (lib.mkForce false);
+        RootDirectory = lib.mkForce (lib.mkForce "");
+      };
+
+      system.stateVersion = config.system.stateVersion;
+    };
+  };
+
+  # Jellyfin
+  services.jellyfin = {
+    enable = true;
+    openFirewall = true;
+  };
+  environment.systemPackages = with pkgs; [
+    jellyfin
+    jellyfin-web
+    jellyfin-ffmpeg
+  ];
+
+  # SMB Share
+  services.samba = {
+    enable = true;
+    openFirewall = true;
+    extraConfig = ''
+      server string = Watchtower
+      guest account = nobody
+      map to guest = bad user
+    '';
+    shares.Library = {
+      path = "/mnt/library";
+      browseable = "yes";
+      "read only" = "no";
+      "guest ok" = "yes";
+    };
+  };
+}

common/fragments/bittorrent/netns.nix

@@ -0,0 +1,96 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+# Collectivized from https://gist.github.com/c0deaddict/53aedbb69c8cbfebfec8f4428dc03102 ☭
+let
+  veth = "ve-transmission";
+  hostIp = "10.0.0.1/24";
+  guestIp = "10.0.0.2/24";
+in
+{
+  # https://mth.st/blog/nixos-wireguard-netns/
+  systemd.services."netns@" = {
+    description = "%I network namespace";
+    before = [ "network.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      PrivateNetwork = true;
+      ExecStart = "${pkgs.writers.writeDash "netns-up" ''
+        ${pkgs.iproute}/bin/ip netns add $1
+        ${pkgs.utillinux}/bin/umount /var/run/netns/$1
+        ${pkgs.utillinux}/bin/mount --bind /proc/self/ns/net /var/run/netns/$1
+      ''} %I";
+      ExecStop = "${pkgs.iproute}/bin/ip netns del %I";
+    };
+  };
+
+  systemd.services."wireguard-ccvpn-fr" = {
+    bindsTo = [ "netns@transmission.service" ];
+    after = [ "netns@transmission.service" ];
+  };
+
+  networking.wireguard.interfaces.ccvpn-fr = {
+    ips = [
+      "10.128.4.199/32"
+      "fd64:e20:68a3::4c7/128"
+    ];
+    privateKeyFile = "/var/lib/secrets/ccvpn-fr-key";
+    socketNamespace = "init";
+    interfaceNamespace = "transmission";
+    peers = [
+      {
+        publicKey = "QFbr19X11tqUZRerZgItb25FnBsNsd7NyJvAkWTRU1U=";
+        # Forward all traffic via VPN.
+        allowedIPs = [
+          "0.0.0.0/0"
+          "::/0"
+        ];
+        endpoint = "fr.204vpn.net:51820";
+        persistentKeepalive = 15;
+      }
+    ];
+  };
+
+  # https://developers.redhat.com/blog/2018/10/22/introduction-to-linux-interfaces-for-virtual-networking#veth
+  systemd.services.${veth} =
+    let
+      ns = "transmission";
+      ipHost = "${pkgs.iproute}/bin/ip";
+      ipGuest = "${ipHost} netns exec ${ns} ${pkgs.iproute}/bin/ip";
+    in
+    {
+      description = "Veth interface for download";
+      bindsTo = [ "netns@${ns}.service" ];
+      after = [ "netns@${ns}.service" ];
+      wantedBy = [ "network.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = pkgs.writers.writeDash "veth-up" ''
+          ${ipHost} link add ${veth} type veth peer name veth1 netns ${ns}
+          ${ipHost} addr add ${hostIp} dev ${veth}
+          ${ipHost} link set dev ${veth} up
+          ${ipGuest} addr add ${guestIp} dev veth1
+          ${ipGuest} link set dev veth1 up
+        '';
+        ExecStop = pkgs.writers.writeDash "veth-down" ''
+          ${ipHost} link del ${veth}
+        '';
+      };
+    };
+
+  networking.firewall.allowedTCPPorts = [ 9091 ];
+
+  services.nginx.enable = true;
+  # TODO: change when headscale updates
+  services.nginx.virtualHosts."watchtower.agatha.thorns.home.arpa" = {
+    locations."/transmission" = {
+      proxyPass = "http://10.0.0.2:9091/transmission";
+      proxyWebsockets = true;
+    };
+  };
+}

common/fragments/graphical/barebones.nix

@@ -0,0 +1,41 @@
+{ pkgs, ... }:
+{
+  # Config for client devices, but not necessarily a full desktop environment.
+
+  imports = [
+    ../restic.nix
+    ../yubikey.nix
+  ];
+
+  # User packages
+  users.users.agatha.packages = with pkgs; [
+    android-tools
+    broot
+    colmena
+    exiftool
+    ffmpeg
+    flac
+    hyperfine
+    just
+    magic-wormhole
+    neofetch
+    nil
+    pfetch
+    pridefetch
+    rink
+    sshfs
+    unstable.rustmission
+    whois
+    wireguard-tools
+    yt-dlp
+  ];
+
+  home-manager.users.agatha = {
+    programs.direnv.enable = true;
+    home.sessionVariables = {
+      "DIRENV_LOG_FORMAT" = "";
+    };
+
+    programs.ssh.enable = true;
+  };
+}

common/fragments/graphical/default.nix

@@ -1,6 +1,12 @@
-{ pkgs, config, lib, ... }: {
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+{
   imports = [
-    ../restic.nix
+    ./barebones.nix
     ./audio.nix
     ./bspwm.nix
     ./clipboard.nix
@@ -22,26 +28,19 @@
     (final: prev: {
       pads = final.callPackage ../../../common/pkgs/pads.nix { };
       bspm = final.callPackage ../../../common/pkgs/bspm.nix { };
-      polybar-scripts =
+      polybar-scripts = final.callPackage ../../../common/pkgs/polybar-scripts.nix { };
-        final.callPackage ../../../common/pkgs/polybar-scripts.nix { };
     })
   ];
 
   # User packages
   users.users.agatha.packages = with pkgs; [
-    android-tools
     blueberry
     brightnessctl
-    broot
     bspm
     cider
-    colmena
     darktable
     dino
     element-desktop
-    exiftool
-    ffmpeg
-    flac
     flameshot
     gimp
     glib
@@ -52,32 +51,19 @@
     gnome.gnome-disk-utility
     gnome.gnome-font-viewer
     gnome.nautilus
-    hyperfine
-    just
-    magic-wormhole
     mpv
     mumble
-    neofetch
-    nil
     nitrogen
-    nmap
     obs-studio
     obsidian
-    pfetch
     polybar-scripts
-    pridefetch
     prismlauncher
-    rink
     rofi-calc
     rofimoji
     speechd
-    sshfs
     tdesktop
-    whois
-    wireguard-tools
     xdg-utils
     xdotool
-    yt-dlp
     yubioath-flutter
   ];
 
@@ -100,20 +86,22 @@
     enable = true;
     displayManager = {
       gdm.enable = true;
-      # gdm.wayland = true;
 
       sessionPackages = [ pkgs.sway ];
-      session = [{
+      session = [
+        {
           manage = "window";
           name = "bspwm";
-        start = let cfg = config.home-manager.users.agatha;
+          start =
-        in ''
+            let
-          ${cfg.services.sxhkd.package}/bin/sxhkd ${
+              cfg = config.home-manager.users.agatha;
-            toString cfg.services.sxhkd.extraOptions
+            in
-          } &
+            ''
+              ${cfg.services.sxhkd.package}/bin/sxhkd ${toString cfg.services.sxhkd.extraOptions} &
               ${cfg.xsession.windowManager.bspwm.package}/bin/bspwm -c ${cfg.xdg.configHome}/bspwm/bspwmrc
             '';
-      }];
+        }
+      ];
     };
     # Layout overrides
     layout = lib.mkForce "eu,de(qwerty),ua,ru";
@@ -150,51 +138,6 @@
       <Multi_key> <p><l> : "🥺"
       <Multi_key> <m><s> : "/html <span data-mx-spoiler=\"\"></span>"
     '';
-
-    programs.direnv.enable = true;
-    home.sessionVariables = { "DIRENV_LOG_FORMAT" = ""; };
-
-    programs.ssh.enable = true;
-    programs.ssh.matchBlocks = {
-      "bloodletting" = { hostname = "technogothic.net"; };
-
-      "backups" = {
-        match = ''originalhost backups exec "ip r | rg 10.21.0.0/16"'';
-        hostname = "10.20.1.2";
-        user = "agatha";
-        identityFile = [ "~/.ssh/id_ed25519" ];
-      };
-
-      "work" = {
-        match = ''originalhost work exec "ip r | rg 10.21.0.0/16"'';
-        hostname = "10.21.221.6";
-        forwardX11 = true;
-        forwardX11Trusted = true;
-        forwardAgent = true;
-        extraOptions."TCPKeepAlive" = "yes";
-      };
-
-      "ritual" = {
-        match = ''originalhost ritual exec "ip r | rg 10.21.0.0/16"'';
-        hostname = "10.21.221.60";
-      };
-
-      "watchtower" = {
-        match = ''originalhost watchtower exec "ip r | rg 10.21.0.0/16"'';
-        hostname = "10.21.220.205";
-      };
-    };
-
-    xdg.desktopEntries.element-work = {
-      name = "Element @ Work";
-      icon = "im.riot.Riot";
-      exec = "${pkgs.element-desktop}/bin/element-desktop --profile=work";
-      categories = [ "Network" "InstantMessaging" "Chat" "VideoConference" ];
-      mimeType = [ "x-scheme-handler/element" ];
-      settings.StartupWMClass = "element";
-      settings.Keywords =
-        "Matrix;matrix.org;chat;irc;communications;talk;riot;vector;";
-    };
   };
 
   services.gvfs.enable = true;
@@ -224,7 +167,12 @@
   fonts.fontconfig.enable = true;
   fonts.fontDir.enable = true;
   fonts.packages = with pkgs; [
-    (nerdfonts.override { fonts = [ "DaddyTimeMono" "NerdFontsSymbolsOnly" ]; })
+    (nerdfonts.override {
+      fonts = [
+        "DaddyTimeMono"
+        "NerdFontsSymbolsOnly"
+      ];
+    })
     cantarell-fonts
     cm_unicode
     corefonts
@@ -254,13 +202,14 @@
 
   hardware.bluetooth = {
     enable = true;
-    settings = { General = { Disable = "Headset"; }; };
+    settings = {
+      General = {
+        Disable = "Headset";
+      };
+    };
   };
 
   # Virtual Camera config
   boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
   boot.kernelModules = [ "v4l2loopback" ];
-
-  # Fix Wireguard NetworkManager connections
-  networking.firewall.checkReversePath = "loose";
 }

common/fragments/headscale.nix

@@ -0,0 +1,15 @@
+{ pkgs, ... }:
+{
+  services.headscale = {
+    enable = true;
+    port = 52812;
+    settings.server_url = "https://hs.technogothic.net";
+    settings.dns_config = {
+      nameservers = [
+        "94.140.14.14"
+        "94.140.15.15"
+      ]; # AdGuard Public DNS
+      base_domain = "thorns.home.arpa";
+    };
+  };
+}

common/fragments/minecraft.nix

@@ -1,7 +1,11 @@
-{ pkgs, config, lib, ... }:
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
 let
-  rsyncSSHKeys = config.users.users.agatha.openssh.authorizedKeys.keys
+  rsyncSSHKeys = config.users.users.agatha.openssh.authorizedKeys.keys;
-    ++ config.users.users.julia.openssh.authorizedKeys.keys;
 
   jre8 = pkgs.temurin-bin-8;
   jre17 = pkgs.temurin-bin-17;
@@ -33,7 +37,8 @@ let
     allow-flight = true;
     max-tick-time = 2 * 60 * 1000;
   };
-in {
+in
+{
   services.modded-minecraft-servers = {
     eula = true;
 
@@ -72,7 +77,10 @@ in {
     };
   };
 
-  systemd.services.mc-e2e.path = with pkgs; [ getconf gawk ];
+  systemd.services.mc-e2e.path = with pkgs; [
+    getconf
+    gawk
+  ];
 
   users.users.agatha.packages = with pkgs; [ mcrcon ];
 }

common/fragments/virt.nix

@@ -0,0 +1,39 @@
+{ pkgs, lib, ... }:
+{
+  boot = {
+    initrd.kernelModules = [
+      "vfio_pci"
+      "vfio"
+      "vfio_iommu_type1"
+
+      "amdgpu"
+    ];
+
+    kernelParams =
+      let
+        gpuIDs = [
+          "1002:67df" # Graphics
+          "1002:aaf0" # Audio
+        ];
+      in
+      [
+        # enable IOMMU
+        "amd_iommu=on"
+        ("vfio-pci.ids=" + lib.concatStringsSep "," gpuIDs)
+      ];
+  };
+
+  hardware.opengl.enable = true;
+  virtualisation.spiceUSBRedirection.enable = true;
+  services.openssh.settings.X11Forwarding = true;
+
+  # Virtualization
+  virtualisation.libvirtd = {
+    enable = true;
+    onBoot = "start";
+    onShutdown = "shutdown";
+  };
+
+  programs.virt-manager.enable = true;
+  users.users.agatha.extraGroups = [ "libvirtd" ];
+}

common/linux-specific.nix

@@ -1,3 +1,4 @@
+{ config, ... }:
 {
   imports = [ ./users ];
 
@@ -50,4 +51,20 @@
     '';
     settings.PasswordAuthentication = false;
   };
+
+  services.earlyoom = {
+    enable = true;
+    freeSwapThreshold = 5;
+    freeMemThreshold = 5;
+    extraArgs = [
+      "-g"
+      "--avoid '^(sshd|systemd.*|tailscale.*|)$'"
+    ];
+  };
+  # Fix Wireguard and Tailscale with NetworkManager
+  networking.firewall = {
+    checkReversePath = "loose";
+    trustedInterfaces = [ "tailscale0" ];
+    allowedUDPPorts = [ config.services.tailscale.port ];
+  };
 }

common/remote-builds.nix

@@ -0,0 +1,17 @@
+{
+  nix.distributedBuilds = true;
+  nix.buildMachines = [
+    {
+      hostName = "tears";
+      systems = [
+        "x86_64-linux"
+        "i686-linux"
+      ];
+      supportedFeatures = [ "big-parallel" ];
+      maxJobs = 4;
+
+      sshUser = "root";
+      sshKey = "/Users/agatha/Projects/nix-infra/secrets/id_ed25519-nix-builder";
+    }
+  ];
+}

common/users/julia.nix

@@ -1,16 +0,0 @@
-{ config, pkgs, ... }: {
-  users.users = {
-    julia = {
-      isNormalUser = true;
-      extraGroups = [ "wheel" ];
-      shell = pkgs.fish;
-
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIa/G3M13aVJpOIX8U/5duiGiNNGmM88/0k0+o0EUGRI cardno:20 876 680"
-      ];
-    };
-  };
-
-  users.users.root.openssh.authorizedKeys.keys =
-    config.users.users.julia.openssh.authorizedKeys.keys;
-}

flake.lock

@@ -67,18 +67,12 @@
       }
     },
     "crane": {
-      "inputs": {
-        "nixpkgs": [
-          "helix",
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1709610799,
+        "lastModified": 1727974419,
-        "narHash": "sha256-5jfLQx0U9hXbi2skYMGodDJkIgffrjIOgMRjZqms2QE=",
+        "narHash": "sha256-WD0//20h+2/yPGkO88d2nYbb23WMWYvnRyDQ9Dx4UHg=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "81c393c776d5379c030607866afef6406ca1be57",
+        "rev": "37e4f9f0976cb9281cd3f0c70081e5e0ecaee93f",
         "type": "github"
       },
       "original": {
@@ -139,11 +133,11 @@
         "systems": "systems_4"
       },
       "locked": {
-        "lastModified": 1709126324,
+        "lastModified": 1726560853,
-        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
         "type": "github"
       },
       "original": {
@@ -204,7 +198,7 @@
       "inputs": {
         "naersk": "naersk_2",
         "nixpkgs": [
-          "nixpkgs-unstable"
+          "nixpkgs"
         ],
         "utils": "utils_3"
       },
@@ -232,11 +226,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1725452565,
+        "lastModified": 1729690460,
-        "narHash": "sha256-kxduxKvEBSEhoxYHQbMCbxHT0t14kRF4zT6ZmWaqH6M=",
+        "narHash": "sha256-x8qkGujBPuOefXPyjcaB8Ot0IYkQBy6O2ZYb8NrnB3k=",
         "owner": "helix-editor",
         "repo": "helix",
-        "rev": "41db5d735eae03be9a69b1136844dac642484ed8",
+        "rev": "101a74bf6edbbfdf9b0628a0bdbbc307ebe10ff2",
         "type": "github"
       },
       "original": {
@@ -252,11 +246,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1720042825,
+        "lastModified": 1726989464,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
         "type": "github"
       },
       "original": {
@@ -468,11 +462,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1725544312,
+        "lastModified": 1730070491,
-        "narHash": "sha256-ETyDNLOF5YvFO2lVlKttXgdHTqSGdp9ZCRRCjv2gaoM=",
+        "narHash": "sha256-+RYCbdU6l4E4pr40++lrdhdE3gNC/BR54AL7xWG/YRU=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "a55b3f1ab41bb6d5025ebeebb4da5fd240b9b3b3",
+        "rev": "5c0c6aaa797d6ccbb6cdab14de0248135735709d",
         "type": "github"
       },
       "original": {
@@ -497,11 +491,11 @@
     },
     "nixpkgs-darwin": {
       "locked": {
-        "lastModified": 1725140114,
+        "lastModified": 1730091932,
-        "narHash": "sha256-tlRqsd84YFI7dL8Lz/Sm+M9Bm+Mh7kUs+5ArJbZsuy8=",
+        "narHash": "sha256-Xg1O6tAHBK8EVHMLylYFlpRmqtG/deKqTfI9atLRLE0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4927f77b7a68615ce99678086cd3dcd0eda34fdd",
+        "rev": "9b9516e15a60ce6633efccb02d703f6eca973228",
         "type": "github"
       },
       "original": {
@@ -529,17 +523,18 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1725369773,
+        "lastModified": 1729980323,
-        "narHash": "sha256-gT+rUDbw+TQuszQEzMUJWTW7QYtccZ5xxWmKOSrPvEw=",
+        "narHash": "sha256-eWPRZAlhf446bKSmzw6x7RWEE4IuZgAp8NW3eXZwRAY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "8b4061fd60ccc3b3f44b73faa7c983eacf7a6f7b",
+        "rev": "86e78d3d2084ff87688da662cf78c2af085d8e73",
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "owner": "NixOS",
         "ref": "nixpkgs-unstable",
-        "type": "indirect"
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs_2": {
@@ -588,17 +583,18 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1725407940,
+        "lastModified": 1729973466,
-        "narHash": "sha256-tiN5Rlg/jiY0tyky+soJZoRzLKbPyIdlQ77xVgREDNM=",
+        "narHash": "sha256-knnVBGfTCZlQgxY1SgH0vn2OyehH9ykfF8geZgS95bk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6f6c45b5134a8ee2e465164811e451dcb5ad86e3",
+        "rev": "cd3e8833d70618c4eea8df06f95b364b016d4950",
         "type": "github"
       },
       "original": {
-        "id": "nixpkgs",
+        "owner": "NixOS",
         "ref": "nixos-24.05",
-        "type": "indirect"
+        "repo": "nixpkgs",
+        "type": "github"
       }
     },
     "nixpkgs_6": {
@@ -638,21 +634,17 @@
     },
     "rust-overlay": {
       "inputs": {
-        "flake-utils": [
-          "helix",
-          "flake-utils"
-        ],
         "nixpkgs": [
           "helix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1709604635,
+        "lastModified": 1728268235,
-        "narHash": "sha256-le4fwmWmjGRYWwkho0Gr7mnnZndOOe4XGbLw68OvF40=",
+        "narHash": "sha256-lJMFnMO4maJuNO6PQ5fZesrTmglze3UFTTBuKGwR1Nw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "e86c0fb5d3a22a5f30d7f64ecad88643fe26449d",
+        "rev": "25685cc2c7054efc31351c172ae77b21814f2d42",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,7 +1,7 @@
 {
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
-    nixpkgs-unstable.url = "nixpkgs/nixpkgs-unstable";
+    nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
     nixpkgs-darwin.url = "github:NixOS/nixpkgs/nixpkgs-24.05-darwin";
 
     lix-module = {
@@ -49,7 +49,7 @@
 
     frq-friend = {
       url = "git+https://git.xenua.me/xenua/fedi-frq-friend";
-      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
 
     helix = {
@@ -66,6 +66,7 @@
     {
       nixpkgs,
       nixpkgs-unstable,
+      nixpkgs-darwin,
       lix-module,
       home-manager,
       nix-darwin,
@@ -81,7 +82,7 @@
       ...
     }:
     let
-      overlays = system: config: [
+      mkOverlays = system: config: [
         (final: prev: {
           helix =
             let
@@ -106,6 +107,7 @@
           unstable = import nixpkgs-unstable { inherit system config; };
         })
         colmena.overlay
+        lix-module.overlays.default
       ];
       mkDesktop = hostname: {
         imports = [
@@ -113,7 +115,6 @@
           ./common/linux-specific.nix
           ./hosts/${hostname}/configuration.nix
           ./common/options.nix
-          lix-module.nixosModules.default
           (import "${home-manager}/nixos")
           url-eater.nixosModules.default
           colorpickle.nixosModules.default
@@ -154,7 +155,7 @@
           nixpkgs = import nixpkgs rec {
             system = "x86_64-linux";
             config.allowUnfree = true;
-            overlays = overlays system config;
+            overlays = mkOverlays system config;
           };
         };
 
@@ -163,14 +164,13 @@
             ./common
             ./common/linux-specific.nix
             ./hosts/bloodletting/configuration.nix
-            lix-module.nixosModules.default
             (import "${home-manager}/nixos")
             mms.module
           ];
 
           deployment = {
             targetUser = "root";
-            targetHost = "bloodletting";
+            targetHost = "technogothic.net";
 
             tags = [ "prod" ];
 
@@ -220,7 +220,6 @@
             ./common
             ./common/linux-specific.nix
             ./hosts/watchtower/configuration.nix
-            lix-module.nixosModules.default
             (import "${home-manager}/nixos")
           ];
 
@@ -229,6 +228,23 @@
             targetHost = "watchtower";
 
             tags = [ "prod" ];
+
+            keys = {
+              "hetzner-env" = {
+                keyCommand = [
+                  "cat"
+                  "./secrets/hetzner-env"
+                ];
+                destDir = "/var/lib/secrets/";
+              };
+              "gocryptfs-pass" = {
+                keyCommand = [
+                  "cat"
+                  "./secrets/gocryptfs-pass"
+                ];
+                destDir = "/var/lib/secrets/";
+              };
+            };
           };
         };
 
@@ -236,22 +252,23 @@
         tears = mkDesktop "tears";
       };
       darwinConfigurations."Agathas-Mac-mini" = nix-darwin.lib.darwinSystem {
+        pkgs = import nixpkgs-darwin rec {
+          system = "aarch64-darwin";
+          config.allowUnfree = true;
+          overlays = mkOverlays system config;
+        };
         modules = [
           ./common
           ./hosts/Agathas-Mac-mini/configuration.nix
-          lix-module.nixosModules.default
           (import "${home-manager}/nix-darwin")
-          (
-            { config, ... }:
-            {
-              nixpkgs.overlays = overlays nixpkgs.system config;
-            }
-          )
         ];
       };
-      devShells."x86_64-linux".default =
+      devShells =
         let
-          pkgs = import nixpkgs { system = "x86_64-linux"; };
+          patchedColmena =
+            system:
+            let
+              pkgs = import nixpkgs { inherit system; };
             in
             pkgs.mkShell {
               buildInputs = [
@@ -260,5 +277,10 @@
                 '')
               ];
             };
+        in
+        {
+          "x86_64-linux".default = patchedColmena "x86_64-linux";
+          "aarch64-darwin".default = patchedColmena "aarch64-darwin";
+        };
     };
 }

hosts/Agathas-Mac-mini/configuration.nix

@@ -2,6 +2,8 @@
 {
   imports = [
     ../../common/home_manager/common.nix
+    ../../common/remote-builds.nix
+    ../../common/fragments/graphical/barebones.nix
     ../../common/fragments/graphical/iosevka.nix
   ];
 
@@ -17,6 +19,7 @@
       "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
       "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
     ];
+    trusted-users = [ "@admin" ];
   };
 
   # Needed for the nix-darwin environment even if zsh is not used.
@@ -40,4 +43,6 @@
     iosevka
     siji
   ];
+
+  system.stateVersion = 1;
 }

hosts/bloodletting/configuration.nix

@@ -1,11 +1,17 @@
-{ config, pkgs, lib, ... }: {
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
   imports = [
     ./hardware-configuration.nix
-    ../../common/users/julia.nix
     ../../common/fragments/bin.nix
     ../../common/fragments/fail2ban.nix
     ../../common/fragments/frq-friend.nix
     ../../common/fragments/grafana.nix
+    ../../common/fragments/headscale.nix
     ../../common/fragments/hedgedoc.nix
     ../../common/fragments/mastodon-ebooks.nix
     ../../common/fragments/mastodon.nix
@@ -24,8 +30,7 @@
   nixpkgs.overlays = [
     (final: prev: {
       bin = final.callPackage ../../common/pkgs/bin.nix { };
-      agatha-mastodon =
+      agatha-mastodon = final.callPackage ../../common/pkgs/mastodon/default.nix { };
-        final.callPackage ../../common/pkgs/mastodon/default.nix { };
     })
   ];
 
@@ -40,15 +45,19 @@
   networking.networkmanager.enable = true;
 
   networking.interfaces.ens20 = {
-    ipv4.addresses = [{
+    ipv4.addresses = [
+      {
         address = "91.198.192.199";
         prefixLength = 27;
-    }];
+      }
+    ];
 
-    ipv6.addresses = [{
+    ipv6.addresses = [
+      {
         address = "2001:67c:b54:1::6";
         prefixLength = 64;
-    }];
+      }
+    ];
   };
 
   networking.defaultGateway = {
@@ -63,11 +72,20 @@
 
   # Open ports in the firewall.
   networking.firewall = {
-    allowedTCPPorts = [ 20 21 22 80 443 990 ];
+    allowedTCPPorts = [
-    allowedTCPPortRanges = [{
+      20
+      21
+      22
+      80
+      443
+      990
+    ];
+    allowedTCPPortRanges = [
+      {
         from = 40000;
         to = 40200;
-    }];
+      }
+    ];
     trustedInterfaces = [ "podman0" ];
   };
 
@@ -77,7 +95,7 @@
       dockerCompat = true;
       defaultNetwork.settings.dns_enabled = true;
     };
-    oci-containers = { backend = "podman"; };
+    oci-containers.backend = "podman";
   };
 
   # SSL/TLS Certificates
@@ -86,13 +104,20 @@
 
   security.acme.certs."technogothic.net" = {
     domain = "*.technogothic.net";
-    extraDomainNames = [ "technogothic.net" "*.argent.technogothic.net" ];
+    extraDomainNames = [
+      "technogothic.net"
+      "*.argent.technogothic.net"
+    ];
     dnsProvider = "hurricane";
     credentialsFile = "/var/lib/secrets/hurricane-tokens";
     group = "nginx";
   };
 
-  security.acme.defaults.reloadServices = [ "nginx" "vsftpd" "prosody" ];
+  security.acme.defaults.reloadServices = [
+    "nginx"
+    "vsftpd"
+    "prosody"
+  ];
   systemd.services.nginx.serviceConfig.ProtectHome = "read-only";
 
   # Nginx
@@ -109,10 +134,14 @@
 
     upstreams = {
       "backend-mastodon-streaming" = {
-        servers = builtins.listToAttrs (map (i: {
+        servers = builtins.listToAttrs (
+          map (i: {
             name = "unix:/run/mastodon-streaming/streaming-${toString i}.socket";
-          value = { fail_timeout = "0"; };
+            value = {
-        }) (lib.range 1 config.services.mastodon.streamingProcesses));
+              fail_timeout = "0";
+            };
+          }) (lib.range 1 config.services.mastodon.streamingProcesses)
+        );
         extraConfig = ''
           least_conn;
         '';
@@ -126,7 +155,9 @@
 
       serverAliases = [ "agatha.technogothic.net" ];
 
-      locations."=/cv.pdf" = { alias = "/home/ftp/cv.pdf"; };
+      locations."=/cv.pdf" = {
+        alias = "/home/ftp/cv.pdf";
+      };
 
       locations."=/.well-known/host-meta" = {
         return = "301 https://fv.technogothic.net$request_uri";
@@ -169,9 +200,7 @@
       locations."/" = {
         proxyPass = "http://localhost:6162";
         proxyWebsockets = true;
-        extraConfig = "client_max_body_size ${
+        extraConfig = "client_max_body_size ${toString config.services.bin.textUploadLimit}M;";
-            toString config.services.bin.textUploadLimit
-          }M;";
       };
     };
 
@@ -181,7 +210,9 @@
 
       root = "/home/ftp";
 
-      locations."/" = { extraConfig = "autoindex on;"; };
+      locations."/" = {
+        extraConfig = "autoindex on;";
+      };
     };
 
     virtualHosts."fv.technogothic.net" = {
@@ -192,7 +223,9 @@
 
       locations."/system/".alias = "/var/lib/mastodon/public-system/";
 
-      locations."/" = { tryFiles = "$uri @proxy"; };
+      locations."/" = {
+        tryFiles = "$uri @proxy";
+      };
 
       locations."@proxy" = {
         proxyPass = "http://unix:/run/mastodon-web/web.socket";
@@ -225,6 +258,27 @@
         extraConfig = "proxy_ssl_server_name on;";
       };
     };
+
+    virtualHosts."hs.technogothic.net" = {
+      useACMEHost = "technogothic.net";
+      forceSSL = true;
+
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.headscale.port}";
+        proxyWebsockets = true;
+      };
+    };
+
+    virtualHosts."carvideo.technogothic.net" = {
+      useACMEHost = "technogothic.net";
+      forceSSL = true;
+
+      serverAliases = [ "agatha.technogothic.net" ];
+
+      locations."/" = {
+        return = "301 https://ftp.technogothic.net/car_video.mp4";
+      };
+    };
   };
 
   # This value determines the NixOS release from which the default
@@ -235,4 +289,3 @@
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "22.11"; # Did you read the comment?
 }
-

hosts/ritual/configuration.nix

@@ -2,7 +2,7 @@
   imports = [
     ./hardware-configuration.nix
     ../../common/fragments/graphical
-    ../../common/fragments/yubikey.nix
+    ../../common/remote-builds.nix
     ../../common/home_manager/common.nix
   ];
 
@@ -14,7 +14,9 @@
   boot.loader.systemd-boot.configurationLimit = 5;
 
   # Setup keyfile
-  boot.initrd.secrets = { "/crypto_keyfile.bin" = null; };
+  boot.initrd.secrets = {
+    "/crypto_keyfile.bin" = null;
+  };
 
   networking.hostName = "ritual";
 
@@ -27,7 +29,7 @@
       dockerCompat = true;
       defaultNetwork.settings.dns_enabled = true;
     };
-    oci-containers = { backend = "podman"; };
+    oci-containers.backend = "podman";
   };
 
   # Don't suspend when closed and plugged into power
@@ -35,7 +37,18 @@
 
   home-manager.users.agatha = {
     xsession.windowManager.bspwm = {
-      monitors = { eDP-1 = [ "I" "II" "III" "IV" "V" "VI" "VII" "VIII" ]; };
+      monitors = {
+        eDP-1 = [
+          "I"
+          "II"
+          "III"
+          "IV"
+          "V"
+          "VI"
+          "VII"
+          "VIII"
+        ];
+      };
       rules = {
         "Element".desktop = "II";
         "TelegramDesktop".desktop = "III";
@@ -68,4 +81,3 @@
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "22.11"; # Did you read the comment?
 }
-

hosts/tears/configuration.nix

@@ -1,8 +1,8 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../common/fragments/graphical
+    ../../common/fragments/graphical/barebones.nix
-    ../../common/fragments/yubikey.nix
+    ../../common/fragments/virt.nix
     ../../common/home_manager/common.nix
   ];
 
@@ -14,7 +14,9 @@
   boot.loader.systemd-boot.configurationLimit = 3;
 
   # Setup keyfile
-  boot.initrd.secrets = { "/crypto_keyfile.bin" = null; };
+  boot.initrd.secrets = {
+    "/crypto_keyfile.bin" = null;
+  };
 
   networking.hostName = "tears";
 
@@ -27,47 +29,13 @@
       dockerCompat = true;
       defaultNetwork.settings.dns_enabled = true;
     };
-    oci-containers = { backend = "podman"; };
+    oci-containers.backend = "podman";
   };
 
-  home-manager.users.agatha = {
+  # Needed for remote builds
-    xsession.windowManager.bspwm = {
+  users.users.root.openssh.authorizedKeys.keys = [
-      monitors = {
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGCsAQfMx1X+8HEa88x+l3KdJPFAzXg0vL0l/pm56/ZR nix-builder"
-        DP-1 = [ "I" "II" "III" "IV" "V" ];
+  ];
-        HDMI-1 = [ "VI" "VII" "VIII" "IX" "X" ];
-      };
-      extraConfigEarly =
-        "xrandr --output HDMI-1 --mode 1920x1080 --rate 144 --dpi 92 --output DP-1 --mode 1920x1080 --rate 144 --dpi 92 --left-of HDMI-1";
-      rules = {
-        "Element".desktop = "I";
-        "TelegramDesktop".desktop = "II";
-        "dino".desktop = "II";
-        "Cider".desktop = "III";
-        "Geary".desktop = "IV";
-        "firefox" = {
-          desktop = "VI";
-          state = "tiled";
-          follow = false;
-        };
-      };
-    };
-
-    services.polybar = {
-      script = ''
-        polybar left &
-        polybar right &'';
-      settings."bar/right" = {
-        monitor = "\${env:MONITOR:HDMI-1}";
-        modules.right =
-          "filesystem battery pulseaudio xkeyboard memory cpu powermenu";
-      };
-      settings."bar/left".monitor = "\${env:MONITOR:DP-1}";
-    };
-  };
-
-  environment.graphical.theme.name = "bridge";
-
-  services.syncthing.dataDir = "/mnt/hdd/syncthing";
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions

hosts/watchtower/configuration.nix

@@ -1,8 +1,8 @@
 {
   imports = [
     ./hardware-configuration.nix
-    ../../common/users/julia.nix
     ../../common/home_manager/common.nix
+    ../../common/fragments/bittorrent
     ../../common/fragments/home-assistant.nix
     ../../common/fragments/sponsorblock.nix
   ];
@@ -17,6 +17,7 @@
 
   # Enable networking
   networking.networkmanager.enable = true;
+  systemd.services.NetworkManager-wait-online.enable = false;
 
   # Open ports in the firewall.
   networking.firewall = {
@@ -34,9 +35,7 @@
       dockerCompat = true;
       defaultNetwork.settings.dns_enabled = true;
     };
-    oci-containers = {
+    oci-containers.backend = "podman";
-      backend = "podman";
-    };
   };
 
   # This value determines the NixOS release from which the default