Add associations for telegram

Will need manual intervention to re-set TPM keys

flake.lock

@@ -133,29 +133,17 @@
     },
     "crane_4": {
       "inputs": {
-        "flake-compat": [
-          "lanzaboote",
-          "flake-compat"
-        ],
-        "flake-utils": [
-          "lanzaboote",
-          "flake-utils"
-        ],
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
-        ],
-        "rust-overlay": [
-          "lanzaboote",
-          "rust-overlay"
         ]
       },
       "locked": {
-        "lastModified": 1681177078,
+        "lastModified": 1717535930,
-        "narHash": "sha256-ZNIjBDou2GOabcpctiQykEQVkI8BDwk7TyvlWlI4myE=",
+        "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "0c9f468ff00576577d83f5019a66c557ede5acf6",
+        "rev": "55e7754ec31dac78980c8be45f8a28e80e370946",
         "type": "github"
       },
       "original": {
@@ -319,11 +307,11 @@
     "flake-compat_4": {
       "flake": false,
       "locked": {
-        "lastModified": 1673956053,
+        "lastModified": 1696426674,
-        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
         "type": "github"
       },
       "original": {
@@ -416,11 +404,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1680392223,
+        "lastModified": 1717285511,
-        "narHash": "sha256-n3g7QFr85lDODKt250rkZj2IFS3i4/8HBU2yKHO3tqw=",
+        "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "dcc36e45d054d7bb554c9cdab69093debd91a0b5",
+        "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8",
         "type": "github"
       },
       "original": {
@@ -521,11 +509,11 @@
         "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1681202837,
+        "lastModified": 1710146030,
-        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
         "type": "github"
       },
       "original": {
@@ -627,11 +615,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1660459072,
+        "lastModified": 1709087332,
-        "narHash": "sha256-8DFJjXG8zqoONA1vXtgeKXy68KdJL5UaXR8NtVMUbx8=",
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
         "owner": "hercules-ci",
         "repo": "gitignore.nix",
-        "rev": "a20de23b925fd8264fd7fad6454652e142fd7f73",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
         "type": "github"
       },
       "original": {
@@ -721,16 +709,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1716736833,
+        "lastModified": 1733050161,
-        "narHash": "sha256-rNObca6dm7Qs524O4st8VJH6pZ/Xe1gxl+Rx6mcWYo0=",
+        "narHash": "sha256-lYnT+EYE47f5yY3KS/Kd4pJ6CO9fhCqumkYYkQ3TK20=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a631666f5ec18271e86a5cde998cba68c33d9ac6",
+        "rev": "62d536255879be574ebfe9b87c4ac194febf47c5",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "release-24.11",
         "repo": "home-manager",
         "type": "github"
       }
@@ -742,11 +730,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1731887066,
+        "lastModified": 1732884235,
-        "narHash": "sha256-uw7K/RsYioJicV79Nl39yjtfhdfTDU2aRxnBgvFhkZ8=",
+        "narHash": "sha256-r8j6R3nrvwbT1aUp4EPQ1KC7gm0pu9VcV1aNaB+XG6Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f3a2ff69586f3a54b461526e5702b1a2f81e740a",
+        "rev": "819f682269f4e002884702b87e445c82840c68f2",
         "type": "github"
       },
       "original": {
@@ -800,16 +788,16 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1682802423,
+        "lastModified": 1718178907,
-        "narHash": "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs=",
+        "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "64b903ca87d18cef2752c19c098af275c6e51d63",
+        "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "v0.3.0",
+        "ref": "v0.4.1",
         "repo": "lanzaboote",
         "type": "github"
       }
@@ -1006,27 +994,27 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1678872516,
+        "lastModified": 1710695816,
-        "narHash": "sha256-/E1YwtMtFAu2KUQKV/1+KFuReYPANM2Rzehk84VxVoc=",
+        "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9b8e5abb18324c7fe9f07cb100c3cd4a29cda8b8",
+        "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-22.11",
+        "ref": "nixos-23.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1731890469,
+        "lastModified": 1734126203,
-        "narHash": "sha256-D1FNZ70NmQEwNxpSSdTXCSklBH1z2isPR84J6DQrJGs=",
+        "narHash": "sha256-0XovF7BYP50rTD2v4r55tR5MuBLet7q4xIz6Rgh3BBU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5083ec887760adfe12af64830a66807423a859a7",
+        "rev": "71a6392e367b08525ee710a93af2e80083b5b3e2",
         "type": "github"
       },
       "original": {
@@ -1052,6 +1040,22 @@
         "type": "github"
       }
     },
+    "nixpkgs_11": {
+      "locked": {
+        "lastModified": 1734424634,
+        "narHash": "sha256-cHar1vqHOOyC7f1+tVycPoWTfKIaqkoe1Q6TnKzuti4=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "d3c42f187194c26d9f0309a8ecc469d6c878ce33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1676300157,
@@ -1166,16 +1170,16 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1731239293,
+        "lastModified": 1734083684,
-        "narHash": "sha256-q2yjIWFFcTzp5REWQUOU9L6kHdCDmFDpqeix86SOvDc=",
+        "narHash": "sha256-5fNndbndxSx5d+C/D0p/VF32xDiJCJzyOqorOYW4JEo=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9256f7c71a195ebe7a218043d9f93390d49e6884",
+        "rev": "314e12ba369ccdb9b352a4db26ff419f7c49fa84",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -1186,10 +1190,6 @@
           "lanzaboote",
           "flake-compat"
         ],
-        "flake-utils": [
-          "lanzaboote",
-          "flake-utils"
-        ],
         "gitignore": "gitignore",
         "nixpkgs": [
           "lanzaboote",
@@ -1198,11 +1198,11 @@
         "nixpkgs-stable": "nixpkgs-stable_2"
       },
       "locked": {
-        "lastModified": 1681413034,
+        "lastModified": 1717664902,
-        "narHash": "sha256-/t7OjNQcNkeWeSq/CFLYVBfm+IEnkjoSm9iKvArnUUI=",
+        "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "d3de8f69ca88fb6f8b09e5b598be5ac98d28ede5",
+        "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1",
         "type": "github"
       },
       "original": {
@@ -1235,7 +1235,8 @@
         "rust-overlay": "rust-overlay_3",
         "secrets": "secrets",
         "sops-nix": "sops-nix",
-        "youmubot": "youmubot"
+        "youmubot": "youmubot",
+        "zen-browser": "zen-browser"
       }
     },
     "rust-analyzer-src": {
@@ -1267,11 +1268,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1682129965,
+        "lastModified": 1717813066,
-        "narHash": "sha256-1KRPIorEL6pLpJR04FwAqqnt4Tzcm4MqD84yhlD+XSk=",
+        "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "2c417c0460b788328220120c698630947547ee83",
+        "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465",
         "type": "github"
       },
       "original": {
@@ -1561,6 +1562,66 @@
         "repo": "youmubot",
         "type": "github"
       }
+    },
+    "zen-browser": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_11",
+        "zen-browser-aarch64": "zen-browser-aarch64",
+        "zen-browser-generic": "zen-browser-generic",
+        "zen-browser-specific": "zen-browser-specific"
+      },
+      "locked": {
+        "lastModified": 1734667644,
+        "narHash": "sha256-vluyzRt6RikEn78Yk0t7Qd96iZZfyRBt4+ESI0mtlhk=",
+        "owner": "youwen5",
+        "repo": "zen-browser-flake",
+        "rev": "8c8af380bf45b42ae14b2f6d5252be3627332f23",
+        "type": "github"
+      },
+      "original": {
+        "owner": "youwen5",
+        "repo": "zen-browser-flake",
+        "type": "github"
+      }
+    },
+    "zen-browser-aarch64": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1734641206,
+        "narHash": "sha256-F5FwGqAgL4kfEy5rNWvofRQl8SH0udQvEIMhysRMDgs=",
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-aarch64.tar.bz2"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-aarch64.tar.bz2"
+      }
+    },
+    "zen-browser-generic": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1734646830,
+        "narHash": "sha256-slIWuEWSV9PK1JTr6UKKC+VP4oLNaczwkxkYiqcjZM8=",
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-generic.tar.bz2"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-generic.tar.bz2"
+      }
+    },
+    "zen-browser-specific": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1734645803,
+        "narHash": "sha256-zAo93sHeB8cTW2JBAqxx0wo3CANcxCgjEcTQgbDeWT4=",
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-specific.tar.bz2"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-specific.tar.bz2"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -2,12 +2,12 @@
   description = "nki's systems";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     nixos-hardware.url = "github:nixos/nixos-hardware";
     darwin.url = "github:lnl7/nix-darwin/master";
     darwin.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    home-manager.url = "github:nix-community/home-manager/release-24.05";
+    home-manager.url = "github:nix-community/home-manager/release-24.11";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
     home-manager-unstable.url = "github:nix-community/home-manager";
     home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -18,7 +18,7 @@
 
     # --- Secure boot
     lanzaboote = {
-      url = github:nix-community/lanzaboote/v0.3.0;
+      url = github:nix-community/lanzaboote/v0.4.1;
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -49,6 +49,7 @@
     dtth-phanpy.url = "git+ssh://gitea@git.dtth.ch/nki-dtth/phanpy?ref=dtth-fork";
     conduit.url = "gitlab:famedly/conduit/v0.9.0";
     nix-gaming.url = github:fufexan/nix-gaming;
+    zen-browser.url = "github:youwen5/zen-browser-flake";
 
     # --- Sources
     kakoune.url = github:mawww/kakoune;

home/common.nix

@@ -26,6 +26,7 @@
     ripgrep
     openssh
     tea # gitea CLI (gh-like)
+    glab # gitlab CLI
     fx # JSON viewer
     glow # Markdown viewer
     nix-output-monitor # Nice nix output formatting

home/kakoune.nix

@@ -17,7 +17,6 @@ in
   # Enable the kakoune package.
   programs.my-kakoune.enable = true;
   programs.my-kakoune.enable-fish-session = true;
-
   programs.my-kakoune.tree-sitter.extraAliases = {
     # Scala stuff
     method = "function";

home/modules/linux/graphical/default.nix

@@ -131,6 +131,8 @@ in
       "x-scheme-handler/feed" = [ "thunderbird.desktop" ];
       "application/rss+xml" = [ "thunderbird.desktop" ];
       "application/x-extension-rss" = [ "thunderbird.desktop" ];
+      "x-scheme-handler/tg2" = [ "org.telegram.desktop.desktop" ];
+      "x-scheme-handler/tonsite2" = [ "org.telegram.desktop.desktop" ];
     };
     xdg.mimeApps.defaultApplications = {
       # Email
@@ -167,6 +169,10 @@ in
 
       # Files
       "inode/directory" = [ "dolphin.desktop" ];
+
+      # Telegram
+      "x-scheme-handler/tg2" = "org.telegram.desktop.desktop";
+      "x-scheme-handler/tonsite2" = "org.telegram.desktop.desktop";
     };
 
     # Add one for kakoune

home/osu.nix

@@ -5,10 +5,10 @@ let
   osu-pkg = with pkgs; with lib;
     appimageTools.wrapType2 rec {
       pname = "osu-lazer-bin";
-      version = "2024.1115.3";
+      version = "2024.1219.2";
       src = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        sha256 = "sha256-kwZHy0FfOUFIWvyOj0ghlQz05U+Lnzl5TgC4T6bhm7o=";
+        hash = "sha256-gRUr7jf0+Xbfz8FurPk/o7F67TYisdNySNzVWEMb1es=";
       };
       extraPkgs = pkgs: with pkgs; [ icu ];
 
@@ -19,7 +19,7 @@ let
           mv -v $out/bin/${pname} $out/bin/osu\!
           install -m 444 -D ${contents}/osu\!.desktop -t $out/share/applications
           for i in 16 32 48 64 96 128 256 512 1024; do
-            install -D ${contents}/osu\!.png $out/share/icons/hicolor/''${i}x$i/apps/osu\!.png
+            install -D ${contents}/osu.png $out/share/icons/hicolor/''${i}x$i/apps/osu.png
           done
         '';
     };

modules/cloud/authentik/default.nix

@@ -22,8 +22,8 @@ let
     };
     authentik = mkImage {
       imageName = "ghcr.io/goauthentik/server";
-      finalImageTag = "2024.8.2";
+      finalImageTag = "2024.1.0.4";
-      imageDigest = "sha256:71984fdbb7a9414f5172bb446104d3fe4ab1ab412c8b3343bb97b04449dd53eb";
+      imageDigest = "sha256:5843c56a56be58dcee8927c705f8c9def0af7189511c0e8e687d430f543b0f6d";
     };
   };
   authentikEnv = pkgs.writeText "authentik.env" ''
@@ -105,6 +105,7 @@ in
         ports = [
           "127.0.0.1:${toString cfg.port}:9000"
         ];
+
       };
       services.worker.service = {
         image = images.authentik;
@@ -123,6 +124,7 @@ in
           AUTHENTIK_POSTGRESQL__NAME = "authentik";
         };
         env_file = [ cfg.envFile "${authentikEnv}" ];
+        user = "root";
       };
       docker-compose.volumes = {
         database.driver = "local";

modules/common/linux/default.nix

@@ -26,15 +26,13 @@ let
       };
     };
 
-    graphics = { config, ... }: {
+    graphics = { config, pkgs, ... }: {
-      hardware =
+      hardware.graphics.enable = true;
-        if config.system.nixos.release == "24.05" then {
+      hardware.graphics.enable32Bit = true;
-          opengl.enable = true;
+      # Monitor backlight
-          opengl.driSupport32Bit = true;
+      hardware.i2c.enable = true;
-        } else {
+      services.ddccontrol.enable = true;
-          graphics.enable = true;
+      environment.systemPackages = [ pkgs.luminance pkgs.ddcutil ];
-          graphics.enable32Bit = true;
-        };
     };
 
     accounts = { pkgs, ... }: mkIf (config.common.linux.enable && !pkgs.stdenv.isAarch64) {
@@ -89,7 +87,7 @@ let
       enable = true;
       # defaults (no need to be set unless modified)
       quantum = 32;
-      rate = 48000;
+      rate = 44100;
     };
     security.rtkit.enable = true;
 
@@ -241,6 +239,8 @@ in
         "wheel" # Enable ‘sudo’ for the user.
         "plugdev" # Enable openrazer-daemon privileges
         "audio"
+        "video"
+        "input"
       ];
       shell = pkgs.fish;
     };

modules/personal/fonts/default.nix

@@ -1,6 +1,13 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, config, ... }:
 
 with lib;
+let
+  nerd-fonts =
+    if builtins.hasAttr "nerd-fonts" pkgs then
+      pkgs.nerd-fonts.symbols-only
+    else
+      pkgs.nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; };
+in
 {
   imports = [ ./mounting.nix ];
   # Fonts
@@ -8,7 +15,7 @@ with lib;
     packages = with pkgs; mkForce [
       noto-fonts-emoji-blob-bin
       ibm-plex
-      (nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; })
+      nerd-fonts
       noto-fonts
       (pkgs.noto-fonts-cjk-sans or pkgs.noto-fonts-cjk)
       merriweather

modules/services/nix-cache/default.nix

@@ -39,7 +39,7 @@ in
 
     services.harmonia = mkIf cfg.enableServer {
       enable = true;
-      signKeyPath = cfg.privateKeyFile;
+      signKeyPaths = [ cfg.privateKeyFile ];
       settings = {
         bind = bindAddr;
         priority = 45;

nki-framework/hardware-configuration.nix

@@ -12,7 +12,6 @@
   boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
-  boot.kernelPackages = pkgs.linuxPackages; # until mesa fixed
   boot.kernelParams = [
     # Hibernation
     "resume=UUID=fa8aaf51-b99f-4fb4-9230-8c0957d8af3f"

nki-home/audio/default.nix

@@ -1,5 +1,5 @@
 { config, pkgs, lib, ... }: {
   environment.etc = {
-    "wireplumber/main.lua.d/51-sdac.lua".source = ./sdac.lua;
+    "wireplumber/wireplumber.conf.d/51-sdac.conf".source = ./sdac.conf.json;
   };
 }

nki-home/audio/sdac.conf.json

@@ -0,0 +1,19 @@
+monitor.alsa.rules = [
+  {
+    matches = [
+      {
+        device.name = "alsa_output.usb-Grace_Design_SDAC-00.*"
+      }
+    ]
+    actions = {
+      update-props = {
+        # audio.format = "S24_3LE"
+        audio.rate = 88200
+        api.alsa.period-size = 2
+        api.alsa.headroom = 0
+        api.alsa.disable-batch = true
+      }
+    }
+  }
+]
+

nki-home/audio/sdac.lua

@@ -6,7 +6,7 @@ rule = {
   },
   apply_properties = {
     ["audio.format"] = "S24_3LE",
-    ["audio.rate"] = 96000,
+    ["audio.rate"] = 44100,
     ["api.alsa.period-size"] = 2,
     ["api.alsa.headroom"] = 0,
     ["api.alsa.disable-batch"] = true

nki-home/configuration.nix

@@ -5,6 +5,16 @@
 { lib, config, pkgs, ... }:
 
 with lib;
+let
+  openrazer = { pkgs, ... }: {
+    # Razer stuff
+    hardware.openrazer = {
+      enable = true;
+      users = [ "nki" ];
+    };
+    environment.systemPackages = with pkgs; [ polychromatic ];
+  };
+in
 {
   imports =
     [
@@ -17,6 +27,7 @@ with lib;
       # Other services
       ../modules/personal/u2f.nix
       ./peertube-runner.nix
+      openrazer
     ];
 
   # Kernel
@@ -181,5 +192,13 @@ with lib;
       passwordFile = config.sops.secrets."scrobble/listenbrainz".path;
     };
   };
+
+  programs.virt-manager.enable = true;
+
+  users.groups.libvirtd.members = [ "nki" ];
+
+  virtualisation.libvirtd.enable = true;
+
+  virtualisation.spiceUSBRedirection.enable = true;
 }
 

nki-personal-do/configuration.nix

@@ -25,6 +25,8 @@
     ./owncast.nix
     ./peertube.nix
     ./outline.nix
+    ./vikunja.nix
+    ./n8n.nix
   ];
 
   system.stateVersion = "21.11";
@@ -60,6 +62,7 @@
   ];
 
   virtualisation.docker.enable = true;
+  virtualisation.docker.extraOptions = "--data-root /mnt/data/docker";
 
   services.do-agent.enable = true;
 
@@ -151,7 +154,7 @@
   };
 
   # Mail
-  sops.secrets.mail-users = { owner = "maddy"; };
+  sops.secrets.mail-users = { owner = "maddy"; reloadUnits = [ "maddy.service" ]; };
   cloud.mail = {
     enable = true;
     debug = true;

nki-personal-do/gitea.nix

@@ -180,7 +180,6 @@ in
         MINIO_USE_SSL = "true";
         MINIO_ENDPOINT = "60c0807121eb35ef52cdcd4a33735fa6.r2.cloudflarestorage.com";
         MINIO_ACCESS_KEY_ID = "704c29ade7a8b438b77ab520da2799ca";
-        MINIO_SECRET_ACCESS_KEY = "#miniosecretkey#";
         MINIO_BUCKET = "dtth-gitea";
         MINIO_LOCATION = "auto";
         MINIO_CHECKSUM_ALGORITHM = "md5"; # R2 moment
@@ -192,7 +191,8 @@ in
 
     stateDir = "/mnt/data/gitea";
 
-    mailerPasswordFile = secrets."gitea/mailer-password".path;
+    secrets.mailer.PASSWD = secrets."gitea/mailer-password".path;
+    secrets.storage.MINIO_SECRET_ACCESS_KEY = config.sops.secrets."gitea/minio-secret-key".path;
 
     database = {
       inherit user;
@@ -216,14 +216,7 @@ in
     # https://github.com/NixOS/nixpkgs/commit/93c1d370db28ad4573fb9890c90164ba55391ce7
     serviceConfig.SystemCallFilter = mkForce "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
     preStart =
-      let
-        configFile = "${config.services.forgejo.customDir}/conf/app.ini";
-      in
       ''
-        # Update minio secret key
-        chmod u+w ${configFile} && \
-        ${lib.getExe pkgs.replace-secret} '#miniosecretkey#' '${config.sops.secrets."gitea/minio-secret-key".path}' '${configFile}' && \
-        chmod u-w ${configFile}
         # Import the signing subkey
         if cat ${config.services.forgejo.stateDir}/.gnupg/gpg.conf | grep -q ${signingKey}; then
           echo "Keys already imported"

nki-personal-do/headscale.nix

@@ -27,7 +27,8 @@ rec {
     noCloudflare = true;
   };
 
-  systemd.services.headscale.requires = [ "postgresql.service" ];
+  systemd.services.headscale.requires = [ "postgresql.service" "arion-authentik.service" ];
+  systemd.services.headscale.after = [ "postgresql.service" "arion-authentik.service" ];
   services.headscale = {
     enable = true;
     inherit port;
@@ -35,23 +36,25 @@ rec {
     settings = {
       server_url = "https://hs.dtth.ch";
 
-      db_type = "postgres";
+      database.type = "postgres";
-      db_host = "/var/run/postgresql"; # find out yourself
+      database.postgres = {
-      db_user = "headscale";
+        host = "/var/run/postgresql"; # find out yourself
-      db_name = "headscale";
+        user = "headscale";
+        name = "headscale";
+      };
 
-      dns_config = {
+      dns = {
-        base_domain = host;
+        base_domain = "dtth.ts";
       };
 
       noise = {
         private_key_path = "/var/lib/headscale/noise_private.key";
       };
 
-      ip_prefixes = [
+      prefixes = {
-        "fd7a:115c:a1e0::/48"
+        v6 = "fd7a:115c:a1e0::/48";
-        "100.64.0.0/10"
+        v4 = "100.64.0.0/10";
-      ];
+      };
 
       derp.paths = [
         secrets."headscale/derp-servers/vnm".path

nki-personal-do/miniflux.nix

@@ -42,7 +42,7 @@ in
   systemd.services.miniflux = {
     description = "Miniflux service";
     wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
+    after = [ "network.target" "postgresql.service" ];
     requires = [ "postgresql.service" ];
 
     serviceConfig = {

nki-personal-do/n8n.nix

@@ -0,0 +1,78 @@
+{ config, lib, pkgs, ... }:
+let
+  secrets = config.sops.secrets;
+
+  host = "n8n.dtth.ch";
+  db = "n8n";
+  user = db;
+  port = 23412;
+
+  dataFolder = "/mnt/data/n8n";
+
+  plugins = pkgs.callPackage ./n8n/plugins/package.nix { };
+in
+{
+  sops.secrets."n8n/env" = { reloadUnits = [ "n8n.service" ]; };
+  cloud.postgresql.databases = [ db ];
+  cloud.traefik.hosts.n8n = {
+    inherit port host;
+  };
+
+  # users
+  users.users."${user}" = {
+    group = "${user}";
+    isSystemUser = true;
+  };
+  users.groups."${user}" = { };
+
+  services.n8n = {
+    enable = true;
+    webhookUrl = "https://${host}";
+  };
+
+  systemd.services.n8n = {
+    environment = {
+      # Database
+      DB_TYPE = "postgresdb";
+      DB_POSTGRESDB_DATABASE = db;
+      DB_POSTGRESDB_HOST = "/var/run/postgresql";
+      DB_POSTGRESDB_USER = db;
+      # Deployment
+      N8N_EDITOR_BASE_URL = "https://${host}";
+      N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS = "true";
+      N8N_USER_FOLDER = lib.mkForce dataFolder;
+      HOME = lib.mkForce dataFolder;
+      N8N_HOST = host;
+      N8N_PORT = toString port;
+      N8N_LISTEN_ADDRESS = "127.0.0.1";
+      N8N_HIRING_BANNER_ENABLED = "false";
+      N8N_PROXY_HOPS = "1";
+      # Logs
+      N8N_LOG_LEVEL = "debug";
+      # License
+      N8N_HIDE_USAGE_PAGE = "true";
+      # Security
+      N8N_BLOCK_ENV_ACCESS_IN_NODE = "true";
+      # Timezone
+      GENERIC_TIMEZONE = "Europe/Berlin";
+    };
+    serviceConfig = {
+      EnvironmentFile = [ secrets."n8n/env".path ];
+      User = user;
+      DynamicUser = lib.mkForce false;
+      ReadWritePaths = [ dataFolder ];
+      # ReadOnlyPaths = [ "/var/run/postgresql" ];
+    };
+    unitConfig.RequiresMountsFor = [ dataFolder ];
+  };
+  systemd.tmpfiles.settings."10-n8n" = {
+    ${dataFolder}.d = {
+      user = user;
+      group = user;
+      mode = "0700";
+    };
+    "${dataFolder}/.n8n/nodes"."L+" = {
+      argument = "${plugins}";
+    };
+  };
+}

nki-personal-do/n8n/plugins/.gitignore

@@ -0,0 +1 @@
+node_modules

nki-personal-do/n8n/plugins/package.json

@@ -0,0 +1,8 @@
+{
+  "name": "n8n-plugins",
+  "version": "1.0.0",
+  "dependencies": {
+    "n8n-nodes-turndown-html-to-markdown": "^1.0.5",
+    "n8n-nodes-vikunja": "^0.2.0"
+  }
+}

nki-personal-do/n8n/plugins/package.nix

@@ -0,0 +1,4 @@
+{ nodejs, importNpmLock }: importNpmLock.buildNodeModules {
+  inherit nodejs;
+  npmRoot = ./.;
+}

nki-personal-do/peertube.nix

@@ -3,7 +3,9 @@ let
   secrets = config.sops.secrets;
   cfg = config.services.peertube;
 
+  user = "peertube";
   host = "peertube.dtth.ch";
+  dataFolder = "/mnt/data/peertube";
   port = 19878;
 in
 {
@@ -57,12 +59,6 @@ in
     settings.client.videos = {
       resumable_upload.max_chunk_size = "90MB";
     };
-    settings.storage = {
-      storyboards = "/var/lib/peertube/storage/storyboards/";
-      tmp = "/mnt/data/peertube/tmp/";
-      tmp_persistent = "/mnt/data/peertube/tmp_persistent/";
-      web_videos = "/mnt/data/peertube/web-videos/";
-    };
 
     # Trust proxy
     settings.trust_proxy = [ "loopback" ] ++ config.services.traefik.staticConfigOptions.entrypoints.https.forwardedHeaders.trustedIPs;
@@ -76,5 +72,22 @@ in
 
     dataDirs = [ "/var/lib/peertube" "/mnt/data/peertube" ];
   };
+
+  systemd.services.peertube = {
+    requires = [ "arion-authentik.service" ];
+    after = [ "arion-authentik.service" ];
+    unitConfig.RequiresMountsFor = [ dataFolder ];
+  };
+  systemd.tmpfiles.settings."10-peertube" = {
+    # The service hard-codes a lot of paths here, so it's nicer if we just symlink
+    "/var/lib/peertube"."L+" = {
+      argument = dataFolder;
+    };
+    ${dataFolder}."d" = {
+      user = user;
+      group = user;
+      mode = "0700";
+    };
+  };
 }
 

nki-personal-do/secrets/secrets.yaml

@@ -5,7 +5,7 @@ authentik-oidc-client-secret: ENC[AES256_GCM,data:lD/xyU87nik68JX+T2H3Gw5ZqsSGzX
 cloudflare-dns-api-token: ENC[AES256_GCM,data:2ny3JehpK30fTUDKrbzHv1QOczriChRyMQn6kNPULpUJ+eVwdptLvg==,iv:8wNAn3oawzLez7sO4ZvhFXcaZIpFVKgKCvTBlszFHn8=,tag:fRaO+u/5MtAWnTiy2Zwh0Q==,type:str]
 #ENC[AES256_GCM,data:KWrVRQg+cLm5MUdfsYrh7hkI4CWkl4Z0sDj0769eebeXDy+veixrQrxh1ZW+ro3WLwoIdU/IH5DPM4TWYn2qoM5aDHjGX764pr1x,iv:uZHBsGvSHv9vd/Wragl1dYNJ+8vCcMit2K3SrMFlz7s=,tag:7z4LyADfQvXsM2vvtWru8w==,type:comment]
 traefik-dashboard-users: ENC[AES256_GCM,data:kviapOq+xzxhjryse+5DaZbXRS/LEYyjqqFbHymXAZVEkWlu0T5pZ2bxSNCbXN+tXnb0u+6YPgGCaRNPLW74AF1hO8W8QqlLDA==,iv:41bwPyFQcuOLILTjLWUu5Kcnct/MaIIJsMbllc+n7Y0=,tag:17HyUjfRUcLGb0FrUm1O2A==,type:str]
-mail-users: ENC[AES256_GCM,data:qKLi42k8LT6ojxbPXQgbi6FlI2I6ge6qJn0aNj/Lp9iRjjnnuArdsLJTfBMB7rPUyKWELa7jPrh8cHzJZZX7PsaXt1x07tQrVitKY6aDMpmb0pdU5TsvRTNhMV8lNWDrQeDXMV3hfigFXDU9YYRowllTJn8Uh5m20oGm8xjQrc55pPd2mDRWUt8WdJYGIYvXJ4Dyc+kXwibFC5xb0+7sLIPOcL8SkurMk0v2E63oBvoR089ZOhgWZ2DtqsUF7cGMcEDj6D6GcH2tlIkhTXo/na0b6caK6/mSIHbz/cfeVD/kdphC+q9edqm5UAAm5SaBDsar5vrXZcgQfD3/iEDHpqfdNJQv7Jt1l4vfwSY6nx3BgjggAZpL7YKXME+5Qqrp/epSegailDled5GUOlXKtomzixTA4OsgTjhMFPPOR/GiBuNIbYoGWnnR6Zs6l9Nw5ITJXKFgwNQTZVkndvQcr1Bw6nQqBDXt1qgmTdKTtNkrWEfgyYBnJtQW6qS+rZL8RB1x9Rjnu5PE+ao4YzrZEnKcenlWRh7+1GUdkRPm5qJWAMnuT1LkBdUx4bUPGf1D8iQ12kMLa5NnMQMq4Yek,iv:fTsBB5yZYi47dk8JIDs1JmgtnK8dOhkNt481vqAU+ME=,tag:pAXBSgzPB8nDdAO9YXM02A==,type:str]
+mail-users: ENC[AES256_GCM,data:4ugvUKK1Hxlnt/bTrAe7pEt5Ehla6yfCzeeZkwaXGN0rlYO3zIFz2paajuFDVoZ1UOntxgdoL/bmS55SkvinQybzQqK+1HUb5N4esODZyJkf8qhacBjjUnDq2sK0GXmoWRoR36ny4haRTbfzTxoVph+Y81P6+T7etnMuARM55i/kWCTcKyin9WKkllLF8vEi6MdbvDj5fwVSxKYQZk2Ti4xY+hCGkEUFL3S2l4Hgbzt2irV0ccjU4+GXSrRepFWSakvDl0fuQf0N3oXMQWCYkRqsoPdtV/n1+C1all9HWtA4XNcnNHlPk7bbi51gO3fSQwmayrgsqO4QAIKY2oJMCrMOabvSjRF8pjR/WFqEMN6fLOCByPYTtej2JEDZ0mg/uQIuIh+Us+QIO/ulMSK+Cq4WTBsmN0V9tYucp1vNv2xzuLUN4GkHc0tRZ6jIVPFUCIGEgw9x7qVPNqFPgr4RFzGGP12746+UwHqDuBIz4od47aQMNrXJOD9xbX7mp54bqwkdASIP/5iBAsnzRDhg/9hHMkJrhPjzrGC4feVNYzI9yo+v0cOPworKYuSfk6KYX5SGu2HgcgCG7zGRL4/NoytNwDGoqBKWA81Xuyp9+vMFF//nm5bKQH6Zt2gVaMViyqKZrTkITrOZMaMKVkOeiJdQQpsM1jqU5ygsrHIq9jc8BJ2MbK8WW2wlfovAo2MNtSN68LknoWiMbEuRXIcC8rhvdVX9C++XT/JQH+kHwg==,iv:059jHrKniQmw2H45FDz/5DJqeTzKdsg9a51pX3FxvHE=,tag:aCMJOFv8PWtz80ouUqUCGA==,type:str]
 youmubot-env: ENC[AES256_GCM,data:EQ9e6lmCrjofHiHyN5Qe4b2oplP9/3JKl0vuFp54Hw9aYIS7j3nqzWLCvV54ZK7j1PcQ+CQorjeCVMV0TUy1f1Pf3qjrLkdOdV7ICq540gdfXOeXuhAx2EILpGkwIYOdKmTMSO3l2QkOlM02RNOn1lq/DogAydkEq7gJ7qSWnUEr45oNCa1+LamH8vcbDmIyzUWWXyA5EQ==,iv:fnNGZ6OaZ4D71SvWPRynsMpO1IsvxjQ3XtrswNSY+Wo=,tag:cN/ZnKrjSfD6AbU9pYNl+Q==,type:str]
 outline:
     smtp-password: ENC[AES256_GCM,data:zpIi6jVB2Y7ksBOR8SGFgjOD1x3aS6dKa6taLKB8v2l9p92iWDti75qgB1puglmmq8mCzz8KXLrM0Bv7W8GWRg==,iv:6tKINzQcApmNuIbNn0kSzFJtwn3rky/uFG2Ff3lazUk=,tag:kjB6qB87tRQVpy32Pt3D5A==,type:str]
@@ -42,6 +42,11 @@ peertube: ENC[AES256_GCM,data:YWySVZVTC26qPMcgSV5v4Vp1u69jGt7VV2ElQBSxvG/R589PCJ
 peertube-env: ENC[AES256_GCM,data:ZrWBwSfMuepIYTzHVCCSnpsXb+MTcOfklI0O/UdcGaR3RzO1R+/wXQcFlV46g9dvKLMOaH7bxrHeWxqPh/7hlPEYFYwlbwcX31MGiSeRyeR5YtVi0CmhiGRA3l8X5NMCpvZmNhnjYNuri/My86SMkjhuaFQ5+BjYISoJ5WnbNSqE9qgQKuJVu64hsOgaQQbmaBL/LU7Pv/vushbNg421kdbRnzCPcc3IzkVzsFsgYH2fdEJa3gE8M63eLn99PbA+e5cWEwGNkuoNuro2tnaMaX1PM6iTF+q0A8HbiEioNMRIdD9czatgF7EwKgCFNu44cm2lp/c5qj+Lm/nC,iv:+MjpreGr9M+Oe5DrDe5SIBKtLuIqtb0a50YvGhDZT2Y=,tag:gYGlMcgWwa1ZpbQb4XfMmQ==,type:str]
 nix-build-farm:
     private-key: ENC[AES256_GCM,data:bYQ5TAHgJ8rZmmnp0ZW9pM3p6e2ewAqz9+clp2lDnvPsU/YHr/POSW+UESvulT0UDI8t5th71py2G4BG3z9PdPaWw2iSm6hW3VITYCGYvLbF2yK6anSkww0ilpjwm5NXKJLTiPehkAqsZlZsAxeYw5bF0+7JjeH9+49jLOXtGD0uFSf5M3wVZcObzSYsdGaNKGYkokBYeZii1tdwZvAuUKKZ1eOvDAz5v6hjqZA7brDWr5IZXNCqRZOdyGQ5g3UP4o5XFnl57d1RAmKPK9WaTCjbi0hMfms4zldqGeXTRDAhvqMH2w/BY7KvgIOr+aQelTvQbOciq+DaZbzNgdI5gqrSUA19EEL04Qu/gjoVGwMhZ7Lq9+yS2Lb+xdhmn/99sbcRjaRqqjgzHRvbyirPT9EuEAdrijyuZzY9kASv8LN/Q8cawRZNk2vf0M8Qzg0F7iw2kcDrf+dwdcyrrAbg2XDlGsFBckBcPKA44PkOPtFLHZRU9pSpd15rL1JIes6m2YX7AmJFP2+FA5WjXQoqF+CRhBVUWXaXAmcq,iv:7Uqnu2xEcHotczRzIcDfq9bM7wNXdz0Fg2HNpxlV1/Q=,tag:w5aLsT9LN92+83rdP2YJTg==,type:str]
+vikunja:
+    env: ENC[AES256_GCM,data:wHwLaX7z31Ogee0fSIJ4EpP/FUHOmj8lESqPacmrgokf9+2NpG8OKt99csDiYM9EEq2S3P70N6r+Dhzxob53lmQhNK8JuvZqrZ1HxgvMXirjnkXl0LGqVHBM4QdMvxVkICRNc1GMrG6ZY4OBQkn5did1ZZiCuXFC/ByuNTqBNHXoZmZMrewF9MFY+wfGx7+gIYzZ5JF1sgkTqtBdnAiUT2t9AaYNc8qjoZvNj3sgMb35/tKG0CYpt0vz6QuMQwOBJNrRkh2lV7YgTcr1tOkTc2FvRoLLyDykl8fjUf9KDcJLz672E90D0rRA5oHp/Lk28sSThh9WAM0skJofjXMOpq9ScsljWovUuizXUVCg5O/79EyhI7zPX6M3C/415sWdmGLYcRYRq7Ww1IoRgi2j9nCDLstHSMgF1igRWnsBEIFISCmSURMHOZNMkxWsxJ+0HJoMX9bmoZLLMrkjCqyPi/1r0X90aforkmA2xB+pC8rvYBKSxXYt8Nfu6KOK1JsmKTMmmC1R1dswuXvt/qCCH0yf0tl7GrGACKkDerDXVDZj4+SygkXM2bQF/L/KjQI7UspSdmGUmAvjhX31Zt1qZoYa2E2gabBWSGgXDuNixgbL/twaUA1CcA+ZPVBH0oAlOCc0dLXy0OZSn2U4IV1NH//66s1cmWEQQs4GKxhXzABiBvYaSj45LQtnEo2/HaifKhBWPxkjY9fW85Hy4Bgock4ReHYKsCF0LbsgKZhZ+WQp9mjTGLKxmRJJskwSEgxLmjK+AC2FK8zq2COMQ/eOxHe9OxEwjiQs5xCwnYXt2wOMHcxg3yoBCkTxoqMLs11kWORqcXzyoW1rV5W5DHk8K+7a4N385arHyg9+9S2FtfFUL46/GPcqf7lw5qgCDP/An5lPQZxA7/ItLzxFkviSx+e/cNl3UMTdx2aX4dn4L2cv54GuXDMHVHw++onJJnqn97aczK4O5y0=,iv:4T7vftUcSOS84MpZUOM9ODA36GSrKeW5TClQM3GN2mk=,tag:5mzK4NsmmrYERRn+Vb01Eg==,type:str]
+    provider-clientsecret: ENC[AES256_GCM,data:/fN1rH2CKoaivhespd+/KamERjBQOdwR7QQ+hoB+pQ3ZSrBVIKbLMWyOJe8f7rVwXAByqDxQIZJEVPjcjhWSU1eicwpu57FBx+/xJLFazspTVZ+5XKyAwR+UxTHDGAgtFV00QHN53l7ygg4joWWko4IPN1JIpNIASaIWWzpsrIo=,iv:NLsZcmE1kKlzV7B/XPVfENMWlpQtOpESH0ByX1KQ8IQ=,tag:P+ZmsKq0KJAeRTTbvbduMg==,type:str]
+n8n:
+    env: ENC[AES256_GCM,data:LA/6tMfGgX0cDNfhIZ+n2Ay+6OW5gPPebcXQnfO3qQJSjMjf9vwauF2+W3KpIvM1Dsg3hyNEwqLNRn/28bgWC/qpBpgU2/gVI2n5oxcQaYGgnS/jB0nZWXvORVTnXjH0R+HBFCWgMJe7v+o0EeBH6kni/Nc9geb8paRkxZOGVKeJQy9K4OB2CN6FVO9KeR7gpeQpsh5V5SVW1MoND2tpCOiIK7d0uM6OHF/7p2RFrEEAarvJssj/dZRHjA/jALuqbQ6UDAaAppqlkEgIdZdFEfgebfCWR4e4aWjznW1DGOQQYtg4k/Kj8J/df8CWXX+lUO+9nTo/lhhcH395w+CRE8GUwze15yxQppUwqyLKdYwgmpK1tFnLP/W/As2f97c1fBB9rXrZYOUEIq4GspHOTPgjzcRfWOxX8cMKG69EmeZ3mWPsIDaC1ZvkVQjjcH/o9aC7QeFCwPfcy+mgI+9RjAaCw7qdig1CwgQabAaCd2hzQ4FTXBFJoZRfYZ1v3Rdwe8zqMivIcw2AHv6kYx6c9A==,iv:KmyJ/CLAGrYfzHjSWygtgA/+am9fUrKnOsGRPgV9QfU=,tag:G3LhfdSujcaC9ZZFUse0DQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -75,8 +80,8 @@ sops:
             by9kZFlTRVdCZFkxYTVVb0RIRk8zUlkKCqMw9oL9RaYBV5Hhy3o8Nm5xmGrPH8Sd
             hv36sxRFFNZT/DCKaHaSRbT3mfpBZSTXJt1dgl4nZe6whH54t/1KmA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-26T12:06:05Z"
+    lastmodified: "2024-12-07T23:38:16Z"
-    mac: ENC[AES256_GCM,data:nici08Luubj2xDfsi1s16VCyG5oizIC6DRfvypmjWRpn0DSpcoWW1j32ya2poEwzpBJoVksFp7ijyjaJv8obExKx94ZYc790eOp/kp1f8lBaHDF8qrYYPL5penkt+UTKeb8xb7BPCJ7O89IVkIjAt7EoQOliMYrLpbiZGkMdHE0=,iv:qY5+MjU5VaXAesuFGt4SgmEdcJ6+vb/mk+NdOPLjCik=,tag:poRJZW3sAMv6EMi64SEQyA==,type:str]
+    mac: ENC[AES256_GCM,data:GKCMZJVKj5Fq7Ak4wQgI/pAl8JKDdzAYCBRwnxHlg0Z10AstbchAYm+LLwCaE85ebl6m/JexmfJeutJo0yGXuOIQKcEgfyNq9O/i/y34ISc4looQ6cyH5Hcxsd9JXgrmgQzVPquBXQzDHz4rj93VhNrvqmw+SgDPZVwcUznvCBI=,iv:HtUmf0qjvbYW7ngocISpqycX7ceNv0YsILgZhOMTSMg=,tag:kJ7EFOLL8o/2OFkn5PhvJw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.1

nki-personal-do/vikunja.nix

@@ -0,0 +1,99 @@
+{ pkgs, lib, config, ... }:
+let
+  secrets = config.sops.secrets;
+
+  host = "kanban.dtth.ch";
+  user = "vikunja";
+  port = 12785;
+
+  storageMount = "/mnt/data/vikunja";
+in
+{
+  sops.secrets."vikunja/env" = { restartUnits = [ "vikunja.service" ]; };
+  sops.secrets."vikunja/provider-clientsecret" = { restartUnits = [ "vikunja.service" ]; };
+  cloud.postgresql.databases = [ user ];
+  cloud.traefik.hosts.vikunja = {
+    inherit port host;
+  };
+
+  # users
+  users.users."${user}" = {
+    group = "${user}";
+    isSystemUser = true;
+  };
+  users.groups."${user}" = { };
+
+
+  services.vikunja = {
+    inherit port;
+    enable = true;
+
+    frontendScheme = "https";
+    frontendHostname = host;
+
+    environmentFiles = [ secrets."vikunja/env".path ];
+
+    database = {
+      type = "postgres";
+      host = "/var/run/postgresql";
+      user = user;
+      database = user;
+    };
+
+    settings = {
+      service = {
+        publicurl = "https://${host}";
+        enableregistration = false;
+        enablepublicteams = true;
+      };
+      mailer = {
+        enabled = true;
+        host = "mx1.nkagami.me";
+        port = 465;
+        forcessl = true;
+      };
+      files.basepath = lib.mkForce storageMount;
+      migration = {
+        todoist.enable = true;
+        trello.enable = true;
+      };
+      backgrounds.providers.unsplash.enabled = true;
+      auth = {
+        local.enabled = false;
+        openid = {
+          enabled = true;
+          providers.authentik = {
+            name = "DTTH Discord Account";
+            authurl = "https://auth.dtth.ch/application/o/vikunja/";
+            logouturl = "https://auth.dtth.ch/application/o/vikunja/end-session/";
+            clientid = "GvCIBtdE2ZRbAo5BJzw4FbZjer7umJlaROT1Pvlp";
+            scope = "openid profile email vikunja_scope";
+          };
+        };
+      };
+      defaultsettings = {
+        avatar_provider = "gravatar";
+        week_start = 1;
+        language = "VN";
+        timezone = "Asia/Ho_Chi_Minh";
+      };
+    };
+  };
+
+  systemd.services.vikunja = {
+    serviceConfig.LoadCredential = [ "VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET_FILE:${secrets."vikunja/provider-clientsecret".path}" ];
+    serviceConfig.User = user;
+    serviceConfig.DynamicUser = lib.mkForce false;
+    serviceConfig.ReadWritePaths = [ storageMount ];
+    environment.VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET_FILE = "%d/VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET_FILE";
+    unitConfig = {
+      RequiresMountsFor = [ storageMount ];
+    };
+  };
+  systemd.tmpfiles.settings."10-vikunja".${storageMount}.d = {
+    user = user;
+    group = user;
+    mode = "0700";
+  };
+}
+

nki-yoga-g8/configuration.nix

@@ -4,6 +4,14 @@
 
 { config, pkgs, lib, ... }:
 
+let
+  vmware = { pkgs, ... }: {
+    environment.systemPackages = [ pkgs.vmware-horizon-client ];
+    virtualisation.vmware.host = {
+      enable = true;
+    };
+  };
+in
 {
   imports =
     [
@@ -13,6 +21,8 @@
       ../modules/personal/fonts
       # Encrypted DNS
       ../modules/services/edns
+
+      vmware
     ];
 
   # Secrets
@@ -70,7 +80,7 @@
   services.printing.drivers = with pkgs; [ epfl-cups-drivers ];
 
   # Enable touchpad support (enabled default in most desktopManager).
-  services.xserver.libinput.enable = true;
+  services.libinput.enable = true;
   # Keyboard
   services.input-remapper.enable = true;
   services.input-remapper.serviceWantedBy = [ "multi-user.target" ];

overlay.nix

@@ -9,9 +9,6 @@ let
     # Typst updates really quickly.
     typst = final.unstable.typst;
     typst-lsp = final.unstable.typst-lsp;
-
-    # Until 0.35 is in
-    kitty = final.unstable.kitty;
   };
   overlay-imported = final: prev: {
     sway = prev.sway.override { sway-unwrapped = final.swayfx-unwrapped; };
@@ -74,19 +71,18 @@ let
       nativeMessagingHosts = with final; [ kdePackages.plasma-browser-integration ];
     });
 
-    # Add desktop file to premid
+    vikunja =
-    premid = final.symlinkJoin {
+      builtins.seq
-      name = prev.premid.name;
+        (final.lib.assertMsg (prev.vikunja.version == "0.24.5") "Vikunja probably doesn't need custom versions anymore")
-      paths = [
+        (final.callPackage ./packages/common/vikunja.nix { });
-        prev.premid
+
-        (final.makeDesktopItem {
+    luminance = prev.luminance.overrideAttrs (attrs: {
-          name = prev.premid.name;
+      nativeBuildInputs = attrs.nativeBuildInputs ++ [ final.wrapGAppsHook ];
-          desktopName = "PreMID";
+      buildInputs = attrs.buildInputs ++ [ final.glib ];
-          exec = "${final.lib.getExe prev.premid} --no-sandbox %U";
+      postInstall = attrs.postInstall + ''
-          icon = "premid";
+        glib-compile-schemas $out/share/glib-2.0/schemas
-        })
+      '';
-      ];
+    });
-    };
   };
 
   overlay-libs = final: prev: {
@@ -110,22 +106,14 @@ let
         meta.mainProgram = "kak-lsp";
       };
 
-    zen-browser-bin = final.callPackage ./packages/x86_64-linux/zen-browser-bin.nix {
+    zen-browser-bin = final.callPackage inputs.zen-browser.packages.${final.stdenv.system}.zen-browser.override {
+      wrap-firefox = opts: final.wrapFirefox (opts // {
         nativeMessagingHosts = with final; [ kdePackages.plasma-browser-integration ];
+      });
+      zen-browser-unwrapped = final.callPackage inputs.zen-browser.packages.${final.stdenv.system}.zen-browser-unwrapped.override {
+        sources = inputs.zen-browser.inputs;
       };
     };
-
-  overlay-rust-is-dumb = final: prev: {
-    # Use stable delta compiled with old Rust version
-    delta = final.stable.delta;
-    deepfilternet = final.stable.deepfilternet;
-    harmonia = final.callPackage
-      (import
-        (builtins.fetchurl {
-          url = "https://raw.githubusercontent.com/Mic92/nixpkgs/63f91202f5cd071187ede5e5ffc56003cb442876/pkgs/by-name/ha/harmonia/package.nix";
-          sha256 = "1mz211c0bxn116ix0j5xx4wlglpbkfg7d3npw1z8hg9gc0vbj2xb";
-        }))
-      { };
   };
 in
 [
@@ -135,17 +123,17 @@ in
   inputs.rust-overlay.overlays.default
   inputs.youmubot.overlays.default
 
-  (import ./overlays/openrazer)
   overlay-unstable
   overlay-needs-unstable
   overlay-packages
   overlay-imported
   overlay-versioning
   overlay-libs
-  overlay-rust-is-dumb
 
   (import ./packages/common)
 
   # Bug fixes
 ] # we assign the overlay created before to the overlays of nixpkgs.
 
+
+

overlays/openrazer/default.nix

@@ -1,31 +0,0 @@
-final: prev:
-let
-  version = "3.3.0";
-  src = final.fetchFromGitHub {
-    owner = "openrazer";
-    repo = "openrazer";
-    rev = "v${version}";
-    sha256 = "sha256-lElE1nIiJ5fk2DupHu43tmxRjRsS5xeL1Yz/LuRlgtM=";
-  };
-in
-rec
-{
-  openrazer-daemon = prev.openrazer-daemon.overrideAttrs (old: {
-    inherit src version;
-  });
-
-  python3 = prev.python3.override {
-    packageOverrides = self: super: {
-      openrazer-daemon = super.openrazer-daemon.overrideAttrs (old: {
-        inherit src version;
-      });
-    };
-  };
-  python3Packages = python3.pkgs;
-
-  linuxPackages_latest = prev.linuxPackages_latest.extend (self: super: {
-    openrazer = super.openrazer.overrideAttrs (old: {
-      inherit src version;
-    });
-  });
-}

packages/common/vikunja.nix

@@ -0,0 +1,128 @@
+{ lib, fetchFromGitHub, stdenv, nodejs, pnpm, buildGoModule, mage, writeShellScriptBin, nixosTests, autoPatchelfHook, musl }:
+
+let
+  version = "0.24.5-git";
+  src = fetchFromGitHub {
+    owner = "go-vikunja";
+    repo = "vikunja";
+    rev = "e57f04ec23e9ff8aa9877d2ea7d571c2a44790b0";
+    hash = "sha256-W6o1h6XBPvT1lH1zO5N7HcodksKill5eqSuaFl2kfuY=";
+  };
+
+  frontend = stdenv.mkDerivation (finalAttrs: {
+    pname = "vikunja-frontend";
+    inherit version src;
+
+    sourceRoot = "${finalAttrs.src.name}/frontend";
+
+    pnpmDeps = pnpm.fetchDeps {
+      inherit (finalAttrs) pname version src sourceRoot;
+      hash = "sha256-sOCaJDBgEMID+lN5plQpSqaGBIUs5h2tAwDzhtOH53o=";
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      pnpm.configHook
+      autoPatchelfHook
+    ];
+
+    buildInputs = [
+      musl # For sass-embedded
+    ];
+
+    doCheck = true;
+    dontAutoPatchelf = true;
+
+    # See https://github.com/sass/embedded-host-node/issues/334
+    preBuild = ''
+      autoPatchelf node_modules/.pnpm/sass-embedded*
+    '';
+
+    postBuild = ''
+      pnpm run build
+    '';
+
+    checkPhase = ''
+      pnpm run test:unit --run
+    '';
+
+    installPhase = ''
+      cp -r dist/ $out
+    '';
+  });
+
+  # Injects a `t.Skip()` into a given test since there's apparently no other way to skip tests here.
+  skipTest = lineOffset: testCase: file:
+    let
+      jumpAndAppend = lib.concatStringsSep ";" (lib.replicate (lineOffset - 1) "n" ++ [ "a" ]);
+    in
+    ''
+      sed -i -e '/${testCase}/{
+      ${jumpAndAppend} t.Skip();
+      }' ${file}
+    '';
+in
+buildGoModule {
+  inherit src version;
+  pname = "vikunja";
+
+  nativeBuildInputs =
+    let
+      fakeGit = writeShellScriptBin "git" ''
+        if [[ $@ = "describe --tags --always --abbrev=10" ]]; then
+            echo "${version}"
+        else
+            >&2 echo "Unknown command: $@"
+            exit 1
+        fi
+      '';
+    in
+    [ fakeGit mage ];
+
+  vendorHash = "sha256-UWjlivF9ySXCAr84A1trCJ/n9pB98ZhEyG11qz3PL7g=";
+
+  inherit frontend;
+
+  prePatch = ''
+    cp -r ${frontend} frontend/dist
+  '';
+
+  postConfigure = ''
+    # These tests need internet, so we skip them.
+    ${skipTest 1 "TestConvertTrelloToVikunja" "pkg/modules/migration/trello/trello_test.go"}
+    ${skipTest 1 "TestConvertTodoistToVikunja" "pkg/modules/migration/todoist/todoist_test.go"}
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # Fixes "mkdir /homeless-shelter: permission denied" - "Error: error compiling magefiles" during build
+    export HOME=$(mktemp -d)
+    mage build:build
+
+    runHook postBuild
+  '';
+
+  checkPhase = ''
+    mage test:unit
+    mage test:integration
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out/bin vikunja
+    runHook postInstall
+  '';
+
+  passthru.tests.vikunja = nixosTests.vikunja;
+
+  meta = {
+    changelog = "https://kolaente.dev/vikunja/api/src/tag/v${version}/CHANGELOG.md";
+    description = "Todo-app to organize your life";
+    homepage = "https://vikunja.io/";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ leona ];
+    mainProgram = "vikunja";
+    platforms = lib.platforms.linux;
+  };
+}

packages/x86_64-linux/zen-browser-bin.nix

@@ -1,32 +0,0 @@
-{ appimageTools, fetchurl, nativeMessagingHosts ? [ ], ... }:
-let
-  pname = "zen-browser-bin";
-  version = "1.0.1-a.19";
-  src = fetchurl {
-    url = "https://github.com/zen-browser/desktop/releases/download/${version}/zen-specific.AppImage";
-    hash = "sha256-qAPZ4VyVmeZLRfL0kPHF75zyrSUFHKQUSUcpYKs3jk8=";
-  };
-
-  appimageContents = appimageTools.extract {
-    inherit pname version src;
-  };
-
-in
-appimageTools.wrapType2 {
-  inherit pname version src;
-
-  extraInstallCommands = ''
-    mv $out/bin/${pname} $out/bin/zen
-    install -m 444 -D ${appimageContents}/zen.desktop $out/share/applications/zen.desktop
-    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/128x128/apps/zen.png \
-      $out/share/icons/hicolor/128x128/apps/zen.png
-
-    mkdir -p $out/lib/mozilla/native-messaging-hosts
-    for ext in ${toString nativeMessagingHosts}; do
-        ln -sLt $out/lib/mozilla/native-messaging-hosts $ext/lib/mozilla/native-messaging-hosts/*
-    done
-  '';
-
-  meta.mainProgram = "zen";
-}
-