Update webui

flake.lock

@@ -608,11 +608,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1742670145,
-        "narHash": "sha256-xQ2F9f+ICAGBp/nNv3ddD2U4ZvzuLOci0u/5lyMXPvk=",
+        "lastModified": 1744138333,
+        "narHash": "sha256-l0Vjq1EZoYTfWImVmwsvMEuIdasrBRRCoNTV0rNtYi0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "63e77d09a133ac641a0c204e7cfb0c97e133706d",
+        "rev": "760eed59594f2f258db0d66b7ca4a5138681fd97",
         "type": "github"
       },
       "original": {
@@ -942,11 +942,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1742578646,
-        "narHash": "sha256-GiQ40ndXRnmmbDZvuv762vS+gew1uDpFwOfgJ8tLiEs=",
+        "lastModified": 1744032190,
+        "narHash": "sha256-KSlfrncSkcu1YE+uuJ/PTURsSlThoGkRqiGDVdbiE/k=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "94c4dbe77c0740ebba36c173672ca15a7926c993",
+        "rev": "b0b4b5f8f621bfe213b8b21694bab52ecfcbf30b",
         "type": "github"
       },
       "original": {
@@ -990,11 +990,11 @@
     },
     "nixpkgs_12": {
       "locked": {
-        "lastModified": 1742889210,
-        "narHash": "sha256-hw63HnwnqU3ZQfsMclLhMvOezpM7RSB0dMAtD5/sOiw=",
+        "lastModified": 1743827369,
+        "narHash": "sha256-rpqepOZ8Eo1zg+KJeWoq1HAOgoMCDloqv5r2EAa9TSA=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "698214a32beb4f4c8e3942372c694f40848b360d",
+        "rev": "42a1c966be226125b48c384171c44c651c236c22",
         "type": "github"
       },
       "original": {
@@ -1546,11 +1546,11 @@
         "nixpkgs": "nixpkgs_12"
       },
       "locked": {
-        "lastModified": 1743134754,
-        "narHash": "sha256-NC90oFdXwjABXs7wg0tMi5yxNW/xT1bgezg+0a9+3AI=",
+        "lastModified": 1743912348,
+        "narHash": "sha256-Ui+kUYOhkQ0wkoJbCPLN/LpYQGp+R5sNVsawZWZsEcQ=",
         "owner": "youwen5",
         "repo": "zen-browser-flake",
-        "rev": "ceb2e7122307700e9c310973c793c2c241dc0901",
+        "rev": "75acddf6a50f3a4dd920a3a7220828605ba91090",
         "type": "github"
       },
       "original": {

modules/common/linux/default.nix

@@ -357,6 +357,17 @@ in
     # Firewall: only open to SSH now
     networking.firewall.allowedTCPPorts = [ 22 ];
     networking.firewall.allowedUDPPorts = [ 22 ];
+    # Network namespaces management
+    systemd.services."netns@" = {
+      description = "Network namespace %I";
+      before = [ "network.target" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
+        ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
+      };
+    };
 
     ## Time and Region
     time.timeZone = lib.mkDefault "Europe/Zurich";

nki-home/configuration.nix

@@ -33,9 +33,13 @@ in
     # Other services
     ../modules/personal/u2f.nix
     ./peertube-runner.nix
+    ./deluge.nix
     openrazer
   ];
 
+  config = mkMerge [
+    {
+
       # Kernel
       boot.kernelPackages = pkgs.linuxKernel.packages.linux_xanmod_stable;
 
@@ -81,29 +85,29 @@ in
       nki.services.edns.ipv6 = true;
       ## DTTH Wireguard
       #
-  sops.secrets."dtth-wg/private-key" = {
+      sops.secrets."wg-dtth/private-key" = {
         owner = "root";
         group = "systemd-network";
         mode = "0640";
       };
-  sops.secrets."dtth-wg/preshared-key" = {
+      sops.secrets."wg-dtth/preshared-key" = {
         owner = "root";
         group = "systemd-network";
         mode = "0640";
       };
-  systemd.network.netdevs."10-dtth-wg" = {
+      systemd.network.netdevs."10-wg-dtth" = {
         netdevConfig = {
           Kind = "wireguard";
-      Name = "dtth-wg";
+          Name = "wg-dtth";
           MTUBytes = "1280";
         };
         wireguardConfig = {
-      PrivateKeyFile = config.sops.secrets."dtth-wg/private-key".path;
+          PrivateKeyFile = config.sops.secrets."wg-dtth/private-key".path;
         };
         wireguardPeers = [
           {
             PublicKey = "+7iI4jwmM1Qr+/DKB1Hv8JgFkGu7lSV0PAoo+O5d3yQ=";
-        PresharedKeyFile = config.sops.secrets."dtth-wg/preshared-key".path;
+            PresharedKeyFile = config.sops.secrets."wg-dtth/preshared-key".path;
             AllowedIPs = [
               "100.64.0.0/10"
               "fd00::/106"
@@ -113,8 +117,8 @@ in
           }
         ];
       };
-  systemd.network.networks."dtth-wg" = {
-    matchConfig.Name = "dtth-wg";
+      systemd.network.networks."wg-dtth" = {
+        matchConfig.Name = "wg-dtth";
         address = [
           "100.73.146.80/32"
           "fd00::33:105b/128"
@@ -237,3 +241,34 @@ in
 
       virtualisation.spiceUSBRedirection.enable = true;
     }
+    {
+      # LLM poop
+      services.ollama = {
+        enable = true;
+        loadModels = [
+          "deepseek-r1:14b"
+          "gemma3:12b"
+        ];
+        acceleration = "rocm";
+        rocmOverrideGfx = "10.3.1";
+      };
+      systemd.services.ollama = {
+        serviceConfig.LimitMEMLOCK = "${toString (16 * 1024 * 1024 * 1024)}";
+      };
+      services.open-webui = {
+        enable = true;
+        port = 5689;
+        openFirewall = true;
+        host = "0.0.0.0";
+        environment = {
+          ANONYMIZED_TELEMETRY = "False";
+          DO_NOT_TRACK = "True";
+          SCARF_NO_ANALYTICS = "True";
+          ENV = "prod";
+          ENABLE_SIGNUP = "false";
+        };
+      };
+      common.linux.tailscale.firewall.allowPorts = [ config.services.open-webui.port ];
+    }
+  ];
+}

nki-home/deluge.nix

@@ -0,0 +1,96 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  wg = "wgdeluge";
+  webui-port = "58846";
+in
+{
+  services.deluge = {
+    enable = true;
+    web.enable = true;
+  };
+
+  sops.secrets."wg-deluge.conf" = {
+    owner = "root";
+    mode = "0400";
+    reloadUnits = [ "${wg}.service" ];
+  };
+  # setting up wireguard interface within network namespace
+  systemd.services.${wg} =
+    let
+      ip = lib.getExe' pkgs.iproute2 "ip";
+      wireguard = lib.getExe pkgs.wireguard-tools;
+    in
+    {
+      description = "WireGuard network interface for Deluge";
+      bindsTo = [ "netns@${wg}.service" ];
+      requires = [ "network-online.target" ];
+      after = [ "netns@${wg}.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        ExecStart = pkgs.writers.writeBash "wg-up" ''
+          set -e
+          ${ip} link add ${wg} type wireguard
+          ${ip} link set ${wg} netns ${wg}
+          ${ip} -n ${wg} address add "100.123.50.189/32" dev ${wg}
+          ${ip} netns exec ${wg} \
+            ${wireguard} setconf ${wg} ${config.sops.secrets."wg-deluge.conf".path}
+          ${ip} -n ${wg} link set ${wg} up
+          # need to set lo up as network namespace is started with lo down
+          ${ip} -n ${wg} link set lo up
+          ${ip} -n ${wg} route add default dev ${wg}
+          # ${ip} -n ${wg} -6 route add default dev ${wg}
+        '';
+        ExecStop = pkgs.writers.writeBash "wg-down" ''
+          ${ip} -n ${wg} route del default dev ${wg}
+          # ${ip} -n ${wg} -6 route del default dev ${wg}
+          ${ip} -n ${wg} link del ${wg}
+          ${ip} link del ${wg}
+        '';
+      };
+    };
+
+  # binding deluged to network namespace
+  systemd.services.deluged.bindsTo = [ "netns@${wg}.service" ];
+  systemd.services.deluged.requires = [
+    "network-online.target"
+    "${wg}.service"
+  ];
+  systemd.services.deluged.serviceConfig.NetworkNamespacePath = [ "/var/run/netns/${wg}" ];
+
+  # allowing delugeweb to access deluged in network namespace, a socket is necesarry
+  systemd.sockets."proxy-to-deluged" = {
+    enable = true;
+    description = "Socket for Proxy to Deluge Daemon";
+    listenStreams = [ "${webui-port}" ];
+    wantedBy = [ "sockets.target" ];
+  };
+
+  # creating proxy service on socket, which forwards the same port from the root namespace to the isolated namespace
+  systemd.services."proxy-to-deluged" = {
+    enable = true;
+    description = "Proxy to Deluge Daemon in Network Namespace";
+    requires = [
+      "deluged.service"
+      "proxy-to-deluged.socket"
+    ];
+    after = [
+      "deluged.service"
+      "proxy-to-deluged.socket"
+    ];
+    unitConfig = {
+      JoinsNamespaceOf = "deluged.service";
+    };
+    serviceConfig = {
+      User = "deluge";
+      Group = "deluge";
+      ExecStart = "${pkgs.systemd}/lib/systemd/systemd-socket-proxyd --exit-idle-time=5min 127.0.0.1:${webui-port}";
+      PrivateNetwork = "yes";
+    };
+  };
+}

nki-home/secrets.yaml

@@ -8,20 +8,17 @@ windscribe:
 scrobble:
     lastfm: ENC[AES256_GCM,data:+3G9zwmAu/B9omG0KUT0b5G+lJ4=,iv:ubrE4A35si9f6+m2sAino4SfOf9F4g2UjtF2Yy9n2e4=,tag:A/e6GECfIZuX2bVGPo9qyA==,type:str]
     listenbrainz: ENC[AES256_GCM,data:FNSJnYEQd+LgInmdyqcaAQG6imiJS/OPBEe2fBKQGKBjpCLy,iv:qhloVpcwcGwRDn6vOujgmvelbPl2korhELfyf5BvdjM=,tag:WnLaMUtHsxBaXNTAKwchkQ==,type:str]
-dtth-wg:
-    private-key: ENC[AES256_GCM,data:ySxPGzOplKwNLxRnPNw7If7xzxMwRkwTasT7FaQE9n5YB04R+gaQVjDqPqg=,iv:f5t94bUoo9sCGGwWytiuhg5jcKjzRjbR3Q0OIM28VDU=,tag:fJos9Hb9XytQbfGaPMa1/A==,type:str]
-    preshared-key: ENC[AES256_GCM,data:96q0ZfvPz4pb53XvTGameVkcETamYH8Xbv69672RBdacH6QjRCCVvPnBTfA=,iv:Q2Yonb07/Uu6KidhMgRX4zJuNU1ZySNC7g/5TwpMU80=,tag:1qQQdk20yIQlGZmX+/25RA==,type:str]
+wg-dtth:
+    private-key: ENC[AES256_GCM,data:a//pmovhmjh73YBHmae/91oVtWFmbiuh87gz6busqi7XcEZEn3KiYszuiMI=,iv:hLw5nqJDGDdiT9CfwDShXGRP6qoTWvfReq7qPs9x0n4=,tag:+b3cMjuVJTsz73wnlPW02Q==,type:str]
+    preshared-key: ENC[AES256_GCM,data:go9dm+FTEq7k0ec936ay1loTJZV8espqTFpGzqAQa9TzMnB1AD/JJHLMENQ=,iv:LjXD3ySLJVkerQH5J7ylSGATykTT6jEObuJc4vUnh28=,tag:qYO5r72tjothlT16Y8Ms0Q==,type:str]
 peertube:
     dtth-key: ENC[AES256_GCM,data:Gu7qOisVBZrFXKBr51165FJ7Ej4hV+lIf3AMC02R3UFNXOnTHF2xC8E=,iv:F83FuD1VjZEJFMcx3gkQuKCpJmYdHtO15fRHkYdMxJM=,tag:ScH42Tr5ZsIo9JMnXhylSw==,type:str]
 nix-cache:
     private-key: ENC[AES256_GCM,data:4sbfIQb10Y50CrZbgjN+1iXEbXTpDqMbIB/yA3WlaAqhLtb8HKib5aZX3DLoxFbVihJcztQsvBBgEAhT9iMijoksaT9qzBQ5yIn4NGCfFem1DK8DQdjhTLMCVTyMFCT7hQHu/2Sd7w==,iv:zTSxuKOtOLekOBKBvl9MScD/Bo1Hviqq/n8Saa+1Cgo=,tag:fx73fCDPY9d07V3KKMw3DA==,type:str]
 nix-build-farm:
     private-key: ENC[AES256_GCM,data:m5neeWCEdaZ1MRhNwTptfDIgv3ABNlYyNil3oTD81Jbe/6WxWaS5Q++CRlHCjc2hOoHsWsZixw8iGZVTA+QXgH6B9C6A4oOAhgR9m92EGTEfFw0qxQbdzs7U98Yonx/N8SApUycZZB/EU81+MrDNY4GGzCiO6s00/vZLkDTYnqRFgbo+8KTG0BQTl4q+VYP2q3l0wy+Ivz5CWPmbz42Xdin/sBnjeFHKDuof4iZZnN3i8gUJ/mMw3lbdiHd6A8DL0G5Ut46ljzMC2aMsZOATCID3mPOPgI0xIetDofPJLDqVsNqptRHo8WB+KwDidvl222f5F7JqdSqgAMOJYPscrX0odufApiJfg5bbXBygvrDfAlPSruW7GsWGoKAhw0qC4NC/j+qYCwhS0qdorCLnIy3zzMtA6HkHtE675hy7/7oLj7k9Y8MhE4PxztjXTmDazaVCtKhnA/DpaxP2mH84gfCkJFD1YF9jtPm+P3e+46FwkW+WnHaA2L+H7Evava30DLEBhh5y9Gd1A3JN4isn,iv:7KUWg7+GWgmGJkbIvsy9gtccZBb+1Y5uDWhXQFk0obk=,tag:qJdM684XPHxecLVxVb5pgw==,type:str]
+wg-deluge.conf: ENC[AES256_GCM,data:CjCqgC1458C6odMtcWigE9tZwci4bJYyk+2fVTpP2OnHYwAp38bt0TbBLwgytMqKfB5EpJZLdbeTSoL33MhT2MD4gWBuDH1++p59l9213LS+9mF6gxG/RksrnnLvz9Pnk5J19qOz1PDxm6t8ZF2qu5qAHY83CF+k32G04/p2Nl04bDllAmMUlGGHJ5TXvXCSRcNU/2tWYv/sC4SwfUfpMjRbSKJUQSTEXnQsPaKsf+fq3mhj1a/xT6zJ6sxwDAGQ3PwIY8xTDf5ucS9ULPO9Zn27NUBoFmS1g0fJd+ZCJJYIWkG2uYDf+ldu/Ag95BduHX7Juf3GolhVd24hZzaIq3LeME99+T3SYA4LBkAaASnBvrVOXmFavHPKhFfbZ1DG0mO7S2M+Ticz+dUktjTXCh/Fe4uwf2R82PieuPhNng==,iv:AKleoSHG6qKEMJ7vIFsQ+X7d/jaXt+d0kg3LnbeWrRc=,tag:zrtqRIxEBbpSh9Ryj8cwqw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1tt0peqg8zdfh74m5sdgwsczcqh036nhgmwvkqnvywll88uvmm9xs433rhm
           enc: |
@@ -50,8 +47,7 @@ sops:
             bUhIT0Z2b1dVWGNyS1hRVFRyZTA4d00KchP7EhSOMwBl5vFuuskzosRoi8jUu1sw
             hVjJNF2a40ewgkQgVAoWEzirHbknbQORzmepDDRth7Bve3UQU64+GA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-16T13:59:20Z"
-    mac: ENC[AES256_GCM,data:ncT8fbtEb9ZcLcftXwgAKJRPPSG4TRHFMArtVgWNmIjDRcCNNT7ICa+9Dl8DAYKRJ+8pgelV9StIg2f7rvypHYlckontEP5nwSFzEApLItG3AZXewTC8VPoDYb4T8/OWKDoa5kBMvGrDr1bFP/CZz7H8No+k5TV7fVExsw0PHpg=,iv:vxbkeJtHkOAq7NcaZEIOMV3qGEqBUg/vpJYumBBfY70=,tag:T0yw2x1O5Tp0UllLpcFryg==,type:str]
-    pgp: []
+    lastmodified: "2025-04-08T23:20:49Z"
+    mac: ENC[AES256_GCM,data:4RANoPaf4TCLkkTkY/UyOCLWKVL6o5N+bSXbNCoQLoI5hI5oW6zgPnvEKtERhJiKNttEoPStb68dt8/DRZ6enpi6h/DP+kNm7wCCT0atMnfKUXz1Hco6ixub9cyT1wpRxjU0O5EPmYSDRYTayOBOqvXzns+OpVFGMcskUAeroL8=,iv:JHMW8tsydX2k39SPqbFfyash4k8juTCi8DtufA8lL/s=,tag:lTQc62Y4nDEErT/TbL+Hbg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.10.1

nki-personal-do/headscale.nix

@@ -89,7 +89,7 @@ rec {
   environment.etc."headscale/config.yaml".mode = "0644";
   virtualisation.arion.projects.headscale-webui.settings = {
     services.webui.service = {
-      image = "ghcr.io/ifargle/headscale-webui@sha256:b4f02337281853648b071301af4329b4e4fc9189d77ced2eb2fbb78204321cab";
+      image = "ghcr.io/ifargle/headscale-webui@sha256:f047209ddf2f71587d8a0f749b0cb92f22a3105dda624724a053c2a7aa23a210";
       restart = "unless-stopped";
 
       environment = {

overlay.nix

@@ -131,7 +131,7 @@ let
     kak-lsp = final.unstable.rustPlatform.buildRustPackage {
       name = "kak-lsp";
       src = inputs.kak-lsp;
-      cargoHash = "sha256-8Y+haxC7ssN07ODZcKoDdTv0vEnKqxYseLPoQSNmWI4=";
+      cargoLock.lockFile = "${inputs.kak-lsp}/Cargo.lock";
       buildInputs = [ final.libiconv ];
 
       meta.mainProgram = "kak-lsp";

packages/common/kak-tree-sitter/default.nix

@@ -20,7 +20,8 @@ let
     inherit src;
     pname = "kak-tree-sitter";
     version = "1.1.3";
-    cargoHash = "sha256-1OwPfl1446SYt1556jwR9mvWOWEv+ab+wH7GZQeS4/E=";
+    cargoLock.lockFile = "${src}/Cargo.lock";
+
     cargoBuildOptions = [
       "--package"
       "kak-tree-sitter"