Merge remote-tracking branch 'origin/master' into kakoune-package

flake.lock

@@ -133,17 +133,29 @@
     },
     "crane_4": {
       "inputs": {
+        "flake-compat": [
+          "lanzaboote",
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "lanzaboote",
+          "flake-utils"
+        ],
         "nixpkgs": [
           "lanzaboote",
           "nixpkgs"
+        ],
+        "rust-overlay": [
+          "lanzaboote",
+          "rust-overlay"
         ]
       },
       "locked": {
-        "lastModified": 1717535930,
+        "lastModified": 1681177078,
-        "narHash": "sha256-1hZ/txnbd/RmiBPNUs7i8UQw2N89uAK3UzrGAWdnFfU=",
+        "narHash": "sha256-ZNIjBDou2GOabcpctiQykEQVkI8BDwk7TyvlWlI4myE=",
         "owner": "ipetkov",
         "repo": "crane",
-        "rev": "55e7754ec31dac78980c8be45f8a28e80e370946",
+        "rev": "0c9f468ff00576577d83f5019a66c557ede5acf6",
         "type": "github"
       },
       "original": {
@@ -307,11 +319,11 @@
     "flake-compat_4": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
+        "lastModified": 1673956053,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",
         "type": "github"
       },
       "original": {
@@ -404,11 +416,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1717285511,
+        "lastModified": 1680392223,
-        "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=",
+        "narHash": "sha256-n3g7QFr85lDODKt250rkZj2IFS3i4/8HBU2yKHO3tqw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8",
+        "rev": "dcc36e45d054d7bb554c9cdab69093debd91a0b5",
         "type": "github"
       },
       "original": {
@@ -509,11 +521,11 @@
         "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1710146030,
+        "lastModified": 1681202837,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
         "type": "github"
       },
       "original": {
@@ -615,11 +627,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1709087332,
+        "lastModified": 1660459072,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "narHash": "sha256-8DFJjXG8zqoONA1vXtgeKXy68KdJL5UaXR8NtVMUbx8=",
         "owner": "hercules-ci",
         "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "rev": "a20de23b925fd8264fd7fad6454652e142fd7f73",
         "type": "github"
       },
       "original": {
@@ -709,16 +721,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1733050161,
+        "lastModified": 1716736833,
-        "narHash": "sha256-lYnT+EYE47f5yY3KS/Kd4pJ6CO9fhCqumkYYkQ3TK20=",
+        "narHash": "sha256-rNObca6dm7Qs524O4st8VJH6pZ/Xe1gxl+Rx6mcWYo0=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "62d536255879be574ebfe9b87c4ac194febf47c5",
+        "rev": "a631666f5ec18271e86a5cde998cba68c33d9ac6",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.11",
+        "ref": "release-24.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -730,11 +742,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1732884235,
+        "lastModified": 1731887066,
-        "narHash": "sha256-r8j6R3nrvwbT1aUp4EPQ1KC7gm0pu9VcV1aNaB+XG6Q=",
+        "narHash": "sha256-uw7K/RsYioJicV79Nl39yjtfhdfTDU2aRxnBgvFhkZ8=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "819f682269f4e002884702b87e445c82840c68f2",
+        "rev": "f3a2ff69586f3a54b461526e5702b1a2f81e740a",
         "type": "github"
       },
       "original": {
@@ -788,16 +800,16 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1718178907,
+        "lastModified": 1682802423,
-        "narHash": "sha256-eSZyrQ9uoPB9iPQ8Y5H7gAmAgAvCw3InStmU3oEjqsE=",
+        "narHash": "sha256-Fb5TeRTdvUlo/5Yi2d+FC8a6KoRLk2h1VE0/peMhWPs=",
         "owner": "nix-community",
         "repo": "lanzaboote",
-        "rev": "b627ccd97d0159214cee5c7db1412b75e4be6086",
+        "rev": "64b903ca87d18cef2752c19c098af275c6e51d63",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "v0.4.1",
+        "ref": "v0.3.0",
         "repo": "lanzaboote",
         "type": "github"
       }
@@ -994,27 +1006,27 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1710695816,
+        "lastModified": 1678872516,
-        "narHash": "sha256-3Eh7fhEID17pv9ZxrPwCLfqXnYP006RKzSs0JptsN84=",
+        "narHash": "sha256-/E1YwtMtFAu2KUQKV/1+KFuReYPANM2Rzehk84VxVoc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "614b4613980a522ba49f0d194531beddbb7220d3",
+        "rev": "9b8e5abb18324c7fe9f07cb100c3cd4a29cda8b8",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-23.11",
+        "ref": "nixos-22.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1734126203,
+        "lastModified": 1731890469,
-        "narHash": "sha256-0XovF7BYP50rTD2v4r55tR5MuBLet7q4xIz6Rgh3BBU=",
+        "narHash": "sha256-D1FNZ70NmQEwNxpSSdTXCSklBH1z2isPR84J6DQrJGs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "71a6392e367b08525ee710a93af2e80083b5b3e2",
+        "rev": "5083ec887760adfe12af64830a66807423a859a7",
         "type": "github"
       },
       "original": {
@@ -1040,22 +1052,6 @@
         "type": "github"
       }
     },
-    "nixpkgs_11": {
-      "locked": {
-        "lastModified": 1734424634,
-        "narHash": "sha256-cHar1vqHOOyC7f1+tVycPoWTfKIaqkoe1Q6TnKzuti4=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "d3c42f187194c26d9f0309a8ecc469d6c878ce33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1676300157,
@@ -1170,16 +1166,16 @@
     },
     "nixpkgs_9": {
       "locked": {
-        "lastModified": 1734083684,
+        "lastModified": 1731239293,
-        "narHash": "sha256-5fNndbndxSx5d+C/D0p/VF32xDiJCJzyOqorOYW4JEo=",
+        "narHash": "sha256-q2yjIWFFcTzp5REWQUOU9L6kHdCDmFDpqeix86SOvDc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "314e12ba369ccdb9b352a4db26ff419f7c49fa84",
+        "rev": "9256f7c71a195ebe7a218043d9f93390d49e6884",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.11",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -1190,6 +1186,10 @@
           "lanzaboote",
           "flake-compat"
         ],
+        "flake-utils": [
+          "lanzaboote",
+          "flake-utils"
+        ],
         "gitignore": "gitignore",
         "nixpkgs": [
           "lanzaboote",
@@ -1198,11 +1198,11 @@
         "nixpkgs-stable": "nixpkgs-stable_2"
       },
       "locked": {
-        "lastModified": 1717664902,
+        "lastModified": 1681413034,
-        "narHash": "sha256-7XfBuLULizXjXfBYy/VV+SpYMHreNRHk9nKMsm1bgb4=",
+        "narHash": "sha256-/t7OjNQcNkeWeSq/CFLYVBfm+IEnkjoSm9iKvArnUUI=",
         "owner": "cachix",
         "repo": "pre-commit-hooks.nix",
-        "rev": "cc4d466cb1254af050ff7bdf47f6d404a7c646d1",
+        "rev": "d3de8f69ca88fb6f8b09e5b598be5ac98d28ede5",
         "type": "github"
       },
       "original": {
@@ -1235,8 +1235,7 @@
         "rust-overlay": "rust-overlay_3",
         "secrets": "secrets",
         "sops-nix": "sops-nix",
-        "youmubot": "youmubot",
+        "youmubot": "youmubot"
-        "zen-browser": "zen-browser"
       }
     },
     "rust-analyzer-src": {
@@ -1268,11 +1267,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1717813066,
+        "lastModified": 1682129965,
-        "narHash": "sha256-wqbRwq3i7g5EHIui0bIi84mdqZ/It1AXBSLJ5tafD28=",
+        "narHash": "sha256-1KRPIorEL6pLpJR04FwAqqnt4Tzcm4MqD84yhlD+XSk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "6dc3e45fe4aee36efeed24d64fc68b1f989d5465",
+        "rev": "2c417c0460b788328220120c698630947547ee83",
         "type": "github"
       },
       "original": {
@@ -1562,66 +1561,6 @@
         "repo": "youmubot",
         "type": "github"
       }
-    },
-    "zen-browser": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_11",
-        "zen-browser-aarch64": "zen-browser-aarch64",
-        "zen-browser-generic": "zen-browser-generic",
-        "zen-browser-specific": "zen-browser-specific"
-      },
-      "locked": {
-        "lastModified": 1734667644,
-        "narHash": "sha256-vluyzRt6RikEn78Yk0t7Qd96iZZfyRBt4+ESI0mtlhk=",
-        "owner": "youwen5",
-        "repo": "zen-browser-flake",
-        "rev": "8c8af380bf45b42ae14b2f6d5252be3627332f23",
-        "type": "github"
-      },
-      "original": {
-        "owner": "youwen5",
-        "repo": "zen-browser-flake",
-        "type": "github"
-      }
-    },
-    "zen-browser-aarch64": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1734641206,
-        "narHash": "sha256-F5FwGqAgL4kfEy5rNWvofRQl8SH0udQvEIMhysRMDgs=",
-        "type": "tarball",
-        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-aarch64.tar.bz2"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-aarch64.tar.bz2"
-      }
-    },
-    "zen-browser-generic": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1734646830,
-        "narHash": "sha256-slIWuEWSV9PK1JTr6UKKC+VP4oLNaczwkxkYiqcjZM8=",
-        "type": "tarball",
-        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-generic.tar.bz2"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-generic.tar.bz2"
-      }
-    },
-    "zen-browser-specific": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1734645803,
-        "narHash": "sha256-zAo93sHeB8cTW2JBAqxx0wo3CANcxCgjEcTQgbDeWT4=",
-        "type": "tarball",
-        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-specific.tar.bz2"
-      },
-      "original": {
-        "type": "tarball",
-        "url": "https://github.com/zen-browser/desktop/releases/download/1.0.2-b.3/zen.linux-specific.tar.bz2"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -2,12 +2,12 @@
   description = "nki's systems";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
     nixos-hardware.url = "github:nixos/nixos-hardware";
     darwin.url = "github:lnl7/nix-darwin/master";
     darwin.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    home-manager.url = "github:nix-community/home-manager/release-24.11";
+    home-manager.url = "github:nix-community/home-manager/release-24.05";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
     home-manager-unstable.url = "github:nix-community/home-manager";
     home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -18,7 +18,7 @@
 
     # --- Secure boot
     lanzaboote = {
-      url = github:nix-community/lanzaboote/v0.4.1;
+      url = github:nix-community/lanzaboote/v0.3.0;
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -49,7 +49,6 @@
     dtth-phanpy.url = "git+ssh://gitea@git.dtth.ch/nki-dtth/phanpy?ref=dtth-fork";
     conduit.url = "gitlab:famedly/conduit/v0.9.0";
     nix-gaming.url = github:fufexan/nix-gaming;
-    zen-browser.url = "github:youwen5/zen-browser-flake";
 
     # --- Sources
     kakoune.url = github:mawww/kakoune;

home/common.nix

@@ -26,7 +26,6 @@
     ripgrep
     openssh
     tea # gitea CLI (gh-like)
-    glab # gitlab CLI
     fx # JSON viewer
     glow # Markdown viewer
     nix-output-monitor # Nice nix output formatting

home/kakoune.nix

@@ -17,6 +17,7 @@ in
   # Enable the kakoune package.
   programs.my-kakoune.enable = true;
   programs.my-kakoune.enable-fish-session = true;
+
   programs.my-kakoune.tree-sitter.extraAliases = {
     # Scala stuff
     method = "function";

home/modules/linux/graphical/default.nix

@@ -131,8 +131,6 @@ in
       "x-scheme-handler/feed" = [ "thunderbird.desktop" ];
       "application/rss+xml" = [ "thunderbird.desktop" ];
       "application/x-extension-rss" = [ "thunderbird.desktop" ];
-      "x-scheme-handler/tg2" = [ "org.telegram.desktop.desktop" ];
-      "x-scheme-handler/tonsite2" = [ "org.telegram.desktop.desktop" ];
     };
     xdg.mimeApps.defaultApplications = {
       # Email
@@ -169,10 +167,6 @@ in
 
       # Files
       "inode/directory" = [ "dolphin.desktop" ];
-
-      # Telegram
-      "x-scheme-handler/tg2" = "org.telegram.desktop.desktop";
-      "x-scheme-handler/tonsite2" = "org.telegram.desktop.desktop";
     };
 
     # Add one for kakoune

home/osu.nix

@@ -5,10 +5,10 @@ let
   osu-pkg = with pkgs; with lib;
     appimageTools.wrapType2 rec {
       pname = "osu-lazer-bin";
-      version = "2024.1219.2";
+      version = "2024.1115.3";
       src = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-gRUr7jf0+Xbfz8FurPk/o7F67TYisdNySNzVWEMb1es=";
+        sha256 = "sha256-kwZHy0FfOUFIWvyOj0ghlQz05U+Lnzl5TgC4T6bhm7o=";
       };
       extraPkgs = pkgs: with pkgs; [ icu ];
 
@@ -19,7 +19,7 @@ let
           mv -v $out/bin/${pname} $out/bin/osu\!
           install -m 444 -D ${contents}/osu\!.desktop -t $out/share/applications
           for i in 16 32 48 64 96 128 256 512 1024; do
-            install -D ${contents}/osu.png $out/share/icons/hicolor/''${i}x$i/apps/osu.png
+            install -D ${contents}/osu\!.png $out/share/icons/hicolor/''${i}x$i/apps/osu\!.png
           done
         '';
     };

modules/cloud/authentik/default.nix

@@ -22,8 +22,8 @@ let
     };
     authentik = mkImage {
       imageName = "ghcr.io/goauthentik/server";
-      finalImageTag = "2024.1.0.4";
+      finalImageTag = "2024.8.2";
-      imageDigest = "sha256:5843c56a56be58dcee8927c705f8c9def0af7189511c0e8e687d430f543b0f6d";
+      imageDigest = "sha256:71984fdbb7a9414f5172bb446104d3fe4ab1ab412c8b3343bb97b04449dd53eb";
     };
   };
   authentikEnv = pkgs.writeText "authentik.env" ''
@@ -105,7 +105,6 @@ in
         ports = [
           "127.0.0.1:${toString cfg.port}:9000"
         ];
-
       };
       services.worker.service = {
         image = images.authentik;
@@ -124,7 +123,6 @@ in
           AUTHENTIK_POSTGRESQL__NAME = "authentik";
         };
         env_file = [ cfg.envFile "${authentikEnv}" ];
-        user = "root";
       };
       docker-compose.volumes = {
         database.driver = "local";

modules/common/linux/default.nix

@@ -26,13 +26,15 @@ let
       };
     };
 
-    graphics = { config, pkgs, ... }: {
+    graphics = { config, ... }: {
-      hardware.graphics.enable = true;
+      hardware =
-      hardware.graphics.enable32Bit = true;
+        if config.system.nixos.release == "24.05" then {
-      # Monitor backlight
+          opengl.enable = true;
-      hardware.i2c.enable = true;
+          opengl.driSupport32Bit = true;
-      services.ddccontrol.enable = true;
+        } else {
-      environment.systemPackages = [ pkgs.luminance pkgs.ddcutil ];
+          graphics.enable = true;
+          graphics.enable32Bit = true;
+        };
     };
 
     accounts = { pkgs, ... }: mkIf (config.common.linux.enable && !pkgs.stdenv.isAarch64) {
@@ -87,7 +89,7 @@ let
       enable = true;
       # defaults (no need to be set unless modified)
       quantum = 32;
-      rate = 44100;
+      rate = 48000;
     };
     security.rtkit.enable = true;
 
@@ -239,8 +241,6 @@ in
         "wheel" # Enable ‘sudo’ for the user.
         "plugdev" # Enable openrazer-daemon privileges
         "audio"
-        "video"
-        "input"
       ];
       shell = pkgs.fish;
     };

modules/personal/fonts/default.nix

@@ -1,13 +1,6 @@
-{ pkgs, lib, config, ... }:
+{ pkgs, lib, ... }:
 
 with lib;
-let
-  nerd-fonts =
-    if builtins.hasAttr "nerd-fonts" pkgs then
-      pkgs.nerd-fonts.symbols-only
-    else
-      pkgs.nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; };
-in
 {
   imports = [ ./mounting.nix ];
   # Fonts
@@ -15,7 +8,7 @@ in
     packages = with pkgs; mkForce [
       noto-fonts-emoji-blob-bin
       ibm-plex
-      nerd-fonts
+      (nerdfonts.override { fonts = [ "NerdFontsSymbolsOnly" ]; })
       noto-fonts
       (pkgs.noto-fonts-cjk-sans or pkgs.noto-fonts-cjk)
       merriweather

modules/services/nix-cache/default.nix

@@ -39,7 +39,7 @@ in
 
     services.harmonia = mkIf cfg.enableServer {
       enable = true;
-      signKeyPaths = [ cfg.privateKeyFile ];
+      signKeyPath = cfg.privateKeyFile;
       settings = {
         bind = bindAddr;
         priority = 45;

nki-framework/hardware-configuration.nix

@@ -12,6 +12,7 @@
   boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "thunderbolt" "usb_storage" "sd_mod" ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
+  boot.kernelPackages = pkgs.linuxPackages; # until mesa fixed
   boot.kernelParams = [
     # Hibernation
     "resume=UUID=fa8aaf51-b99f-4fb4-9230-8c0957d8af3f"

nki-home/audio/default.nix

@@ -1,5 +1,5 @@
 { config, pkgs, lib, ... }: {
   environment.etc = {
-    "wireplumber/wireplumber.conf.d/51-sdac.conf".source = ./sdac.conf.json;
+    "wireplumber/main.lua.d/51-sdac.lua".source = ./sdac.lua;
   };
 }

nki-home/audio/sdac.conf.json

@@ -1,19 +0,0 @@
-monitor.alsa.rules = [
-  {
-    matches = [
-      {
-        device.name = "alsa_output.usb-Grace_Design_SDAC-00.*"
-      }
-    ]
-    actions = {
-      update-props = {
-        # audio.format = "S24_3LE"
-        audio.rate = 88200
-        api.alsa.period-size = 2
-        api.alsa.headroom = 0
-        api.alsa.disable-batch = true
-      }
-    }
-  }
-]
-

nki-home/audio/sdac.lua

@@ -6,7 +6,7 @@ rule = {
   },
   apply_properties = {
     ["audio.format"] = "S24_3LE",
-    ["audio.rate"] = 44100,
+    ["audio.rate"] = 96000,
     ["api.alsa.period-size"] = 2,
     ["api.alsa.headroom"] = 0,
     ["api.alsa.disable-batch"] = true

nki-home/configuration.nix

@@ -5,16 +5,6 @@
 { lib, config, pkgs, ... }:
 
 with lib;
-let
-  openrazer = { pkgs, ... }: {
-    # Razer stuff
-    hardware.openrazer = {
-      enable = true;
-      users = [ "nki" ];
-    };
-    environment.systemPackages = with pkgs; [ polychromatic ];
-  };
-in
 {
   imports =
     [
@@ -27,7 +17,6 @@ in
       # Other services
       ../modules/personal/u2f.nix
       ./peertube-runner.nix
-      openrazer
     ];
 
   # Kernel
@@ -192,13 +181,5 @@ in
       passwordFile = config.sops.secrets."scrobble/listenbrainz".path;
     };
   };
-
-  programs.virt-manager.enable = true;
-
-  users.groups.libvirtd.members = [ "nki" ];
-
-  virtualisation.libvirtd.enable = true;
-
-  virtualisation.spiceUSBRedirection.enable = true;
 }
 

nki-personal-do/configuration.nix

@@ -25,8 +25,6 @@
     ./owncast.nix
     ./peertube.nix
     ./outline.nix
-    ./vikunja.nix
-    ./n8n.nix
   ];
 
   system.stateVersion = "21.11";
@@ -62,7 +60,6 @@
   ];
 
   virtualisation.docker.enable = true;
-  virtualisation.docker.extraOptions = "--data-root /mnt/data/docker";
 
   services.do-agent.enable = true;
 
@@ -154,7 +151,7 @@
   };
 
   # Mail
-  sops.secrets.mail-users = { owner = "maddy"; reloadUnits = [ "maddy.service" ]; };
+  sops.secrets.mail-users = { owner = "maddy"; };
   cloud.mail = {
     enable = true;
     debug = true;

nki-personal-do/gitea.nix

@@ -180,6 +180,7 @@ in
         MINIO_USE_SSL = "true";
         MINIO_ENDPOINT = "60c0807121eb35ef52cdcd4a33735fa6.r2.cloudflarestorage.com";
         MINIO_ACCESS_KEY_ID = "704c29ade7a8b438b77ab520da2799ca";
+        MINIO_SECRET_ACCESS_KEY = "#miniosecretkey#";
         MINIO_BUCKET = "dtth-gitea";
         MINIO_LOCATION = "auto";
         MINIO_CHECKSUM_ALGORITHM = "md5"; # R2 moment
@@ -191,8 +192,7 @@ in
 
     stateDir = "/mnt/data/gitea";
 
-    secrets.mailer.PASSWD = secrets."gitea/mailer-password".path;
+    mailerPasswordFile = secrets."gitea/mailer-password".path;
-    secrets.storage.MINIO_SECRET_ACCESS_KEY = config.sops.secrets."gitea/minio-secret-key".path;
 
     database = {
       inherit user;
@@ -216,7 +216,14 @@ in
     # https://github.com/NixOS/nixpkgs/commit/93c1d370db28ad4573fb9890c90164ba55391ce7
     serviceConfig.SystemCallFilter = mkForce "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @setuid @swap";
     preStart =
+      let
+        configFile = "${config.services.forgejo.customDir}/conf/app.ini";
+      in
       ''
+        # Update minio secret key
+        chmod u+w ${configFile} && \
+        ${lib.getExe pkgs.replace-secret} '#miniosecretkey#' '${config.sops.secrets."gitea/minio-secret-key".path}' '${configFile}' && \
+        chmod u-w ${configFile}
         # Import the signing subkey
         if cat ${config.services.forgejo.stateDir}/.gnupg/gpg.conf | grep -q ${signingKey}; then
           echo "Keys already imported"

nki-personal-do/headscale.nix

@@ -27,8 +27,7 @@ rec {
     noCloudflare = true;
   };
 
-  systemd.services.headscale.requires = [ "postgresql.service" "arion-authentik.service" ];
+  systemd.services.headscale.requires = [ "postgresql.service" ];
-  systemd.services.headscale.after = [ "postgresql.service" "arion-authentik.service" ];
   services.headscale = {
     enable = true;
     inherit port;
@@ -36,25 +35,23 @@ rec {
     settings = {
       server_url = "https://hs.dtth.ch";
 
-      database.type = "postgres";
+      db_type = "postgres";
-      database.postgres = {
+      db_host = "/var/run/postgresql"; # find out yourself
-        host = "/var/run/postgresql"; # find out yourself
+      db_user = "headscale";
-        user = "headscale";
+      db_name = "headscale";
-        name = "headscale";
-      };
 
-      dns = {
+      dns_config = {
-        base_domain = "dtth.ts";
+        base_domain = host;
       };
 
       noise = {
         private_key_path = "/var/lib/headscale/noise_private.key";
       };
 
-      prefixes = {
+      ip_prefixes = [
-        v6 = "fd7a:115c:a1e0::/48";
+        "fd7a:115c:a1e0::/48"
-        v4 = "100.64.0.0/10";
+        "100.64.0.0/10"
-      };
+      ];
 
       derp.paths = [
         secrets."headscale/derp-servers/vnm".path

nki-personal-do/miniflux.nix

@@ -42,7 +42,7 @@ in
   systemd.services.miniflux = {
     description = "Miniflux service";
     wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" "postgresql.service" ];
+    after = [ "network.target" ];
     requires = [ "postgresql.service" ];
 
     serviceConfig = {

nki-personal-do/n8n.nix

@@ -1,78 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  secrets = config.sops.secrets;
-
-  host = "n8n.dtth.ch";
-  db = "n8n";
-  user = db;
-  port = 23412;
-
-  dataFolder = "/mnt/data/n8n";
-
-  plugins = pkgs.callPackage ./n8n/plugins/package.nix { };
-in
-{
-  sops.secrets."n8n/env" = { reloadUnits = [ "n8n.service" ]; };
-  cloud.postgresql.databases = [ db ];
-  cloud.traefik.hosts.n8n = {
-    inherit port host;
-  };
-
-  # users
-  users.users."${user}" = {
-    group = "${user}";
-    isSystemUser = true;
-  };
-  users.groups."${user}" = { };
-
-  services.n8n = {
-    enable = true;
-    webhookUrl = "https://${host}";
-  };
-
-  systemd.services.n8n = {
-    environment = {
-      # Database
-      DB_TYPE = "postgresdb";
-      DB_POSTGRESDB_DATABASE = db;
-      DB_POSTGRESDB_HOST = "/var/run/postgresql";
-      DB_POSTGRESDB_USER = db;
-      # Deployment
-      N8N_EDITOR_BASE_URL = "https://${host}";
-      N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS = "true";
-      N8N_USER_FOLDER = lib.mkForce dataFolder;
-      HOME = lib.mkForce dataFolder;
-      N8N_HOST = host;
-      N8N_PORT = toString port;
-      N8N_LISTEN_ADDRESS = "127.0.0.1";
-      N8N_HIRING_BANNER_ENABLED = "false";
-      N8N_PROXY_HOPS = "1";
-      # Logs
-      N8N_LOG_LEVEL = "debug";
-      # License
-      N8N_HIDE_USAGE_PAGE = "true";
-      # Security
-      N8N_BLOCK_ENV_ACCESS_IN_NODE = "true";
-      # Timezone
-      GENERIC_TIMEZONE = "Europe/Berlin";
-    };
-    serviceConfig = {
-      EnvironmentFile = [ secrets."n8n/env".path ];
-      User = user;
-      DynamicUser = lib.mkForce false;
-      ReadWritePaths = [ dataFolder ];
-      # ReadOnlyPaths = [ "/var/run/postgresql" ];
-    };
-    unitConfig.RequiresMountsFor = [ dataFolder ];
-  };
-  systemd.tmpfiles.settings."10-n8n" = {
-    ${dataFolder}.d = {
-      user = user;
-      group = user;
-      mode = "0700";
-    };
-    "${dataFolder}/.n8n/nodes"."L+" = {
-      argument = "${plugins}";
-    };
-  };
-}

nki-personal-do/n8n/plugins/.gitignore

@@ -1 +0,0 @@
-node_modules

nki-personal-do/n8n/plugins/package.json

@@ -1,8 +0,0 @@
-{
-  "name": "n8n-plugins",
-  "version": "1.0.0",
-  "dependencies": {
-    "n8n-nodes-turndown-html-to-markdown": "^1.0.5",
-    "n8n-nodes-vikunja": "^0.2.0"
-  }
-}

nki-personal-do/n8n/plugins/package.nix

@@ -1,4 +0,0 @@
-{ nodejs, importNpmLock }: importNpmLock.buildNodeModules {
-  inherit nodejs;
-  npmRoot = ./.;
-}

nki-personal-do/peertube.nix

@@ -3,9 +3,7 @@ let
   secrets = config.sops.secrets;
   cfg = config.services.peertube;
 
-  user = "peertube";
   host = "peertube.dtth.ch";
-  dataFolder = "/mnt/data/peertube";
   port = 19878;
 in
 {
@@ -59,6 +57,12 @@ in
     settings.client.videos = {
       resumable_upload.max_chunk_size = "90MB";
     };
+    settings.storage = {
+      storyboards = "/var/lib/peertube/storage/storyboards/";
+      tmp = "/mnt/data/peertube/tmp/";
+      tmp_persistent = "/mnt/data/peertube/tmp_persistent/";
+      web_videos = "/mnt/data/peertube/web-videos/";
+    };
 
     # Trust proxy
     settings.trust_proxy = [ "loopback" ] ++ config.services.traefik.staticConfigOptions.entrypoints.https.forwardedHeaders.trustedIPs;
@@ -72,22 +76,5 @@ in
 
     dataDirs = [ "/var/lib/peertube" "/mnt/data/peertube" ];
   };
-
-  systemd.services.peertube = {
-    requires = [ "arion-authentik.service" ];
-    after = [ "arion-authentik.service" ];
-    unitConfig.RequiresMountsFor = [ dataFolder ];
-  };
-  systemd.tmpfiles.settings."10-peertube" = {
-    # The service hard-codes a lot of paths here, so it's nicer if we just symlink
-    "/var/lib/peertube"."L+" = {
-      argument = dataFolder;
-    };
-    ${dataFolder}."d" = {
-      user = user;
-      group = user;
-      mode = "0700";
-    };
-  };
 }
 

nki-personal-do/secrets/secrets.yaml

@@ -5,7 +5,7 @@ authentik-oidc-client-secret: ENC[AES256_GCM,data:lD/xyU87nik68JX+T2H3Gw5ZqsSGzX
 cloudflare-dns-api-token: ENC[AES256_GCM,data:2ny3JehpK30fTUDKrbzHv1QOczriChRyMQn6kNPULpUJ+eVwdptLvg==,iv:8wNAn3oawzLez7sO4ZvhFXcaZIpFVKgKCvTBlszFHn8=,tag:fRaO+u/5MtAWnTiy2Zwh0Q==,type:str]
 #ENC[AES256_GCM,data:KWrVRQg+cLm5MUdfsYrh7hkI4CWkl4Z0sDj0769eebeXDy+veixrQrxh1ZW+ro3WLwoIdU/IH5DPM4TWYn2qoM5aDHjGX764pr1x,iv:uZHBsGvSHv9vd/Wragl1dYNJ+8vCcMit2K3SrMFlz7s=,tag:7z4LyADfQvXsM2vvtWru8w==,type:comment]
 traefik-dashboard-users: ENC[AES256_GCM,data:kviapOq+xzxhjryse+5DaZbXRS/LEYyjqqFbHymXAZVEkWlu0T5pZ2bxSNCbXN+tXnb0u+6YPgGCaRNPLW74AF1hO8W8QqlLDA==,iv:41bwPyFQcuOLILTjLWUu5Kcnct/MaIIJsMbllc+n7Y0=,tag:17HyUjfRUcLGb0FrUm1O2A==,type:str]
-mail-users: ENC[AES256_GCM,data:4ugvUKK1Hxlnt/bTrAe7pEt5Ehla6yfCzeeZkwaXGN0rlYO3zIFz2paajuFDVoZ1UOntxgdoL/bmS55SkvinQybzQqK+1HUb5N4esODZyJkf8qhacBjjUnDq2sK0GXmoWRoR36ny4haRTbfzTxoVph+Y81P6+T7etnMuARM55i/kWCTcKyin9WKkllLF8vEi6MdbvDj5fwVSxKYQZk2Ti4xY+hCGkEUFL3S2l4Hgbzt2irV0ccjU4+GXSrRepFWSakvDl0fuQf0N3oXMQWCYkRqsoPdtV/n1+C1all9HWtA4XNcnNHlPk7bbi51gO3fSQwmayrgsqO4QAIKY2oJMCrMOabvSjRF8pjR/WFqEMN6fLOCByPYTtej2JEDZ0mg/uQIuIh+Us+QIO/ulMSK+Cq4WTBsmN0V9tYucp1vNv2xzuLUN4GkHc0tRZ6jIVPFUCIGEgw9x7qVPNqFPgr4RFzGGP12746+UwHqDuBIz4od47aQMNrXJOD9xbX7mp54bqwkdASIP/5iBAsnzRDhg/9hHMkJrhPjzrGC4feVNYzI9yo+v0cOPworKYuSfk6KYX5SGu2HgcgCG7zGRL4/NoytNwDGoqBKWA81Xuyp9+vMFF//nm5bKQH6Zt2gVaMViyqKZrTkITrOZMaMKVkOeiJdQQpsM1jqU5ygsrHIq9jc8BJ2MbK8WW2wlfovAo2MNtSN68LknoWiMbEuRXIcC8rhvdVX9C++XT/JQH+kHwg==,iv:059jHrKniQmw2H45FDz/5DJqeTzKdsg9a51pX3FxvHE=,tag:aCMJOFv8PWtz80ouUqUCGA==,type:str]
+mail-users: ENC[AES256_GCM,data:qKLi42k8LT6ojxbPXQgbi6FlI2I6ge6qJn0aNj/Lp9iRjjnnuArdsLJTfBMB7rPUyKWELa7jPrh8cHzJZZX7PsaXt1x07tQrVitKY6aDMpmb0pdU5TsvRTNhMV8lNWDrQeDXMV3hfigFXDU9YYRowllTJn8Uh5m20oGm8xjQrc55pPd2mDRWUt8WdJYGIYvXJ4Dyc+kXwibFC5xb0+7sLIPOcL8SkurMk0v2E63oBvoR089ZOhgWZ2DtqsUF7cGMcEDj6D6GcH2tlIkhTXo/na0b6caK6/mSIHbz/cfeVD/kdphC+q9edqm5UAAm5SaBDsar5vrXZcgQfD3/iEDHpqfdNJQv7Jt1l4vfwSY6nx3BgjggAZpL7YKXME+5Qqrp/epSegailDled5GUOlXKtomzixTA4OsgTjhMFPPOR/GiBuNIbYoGWnnR6Zs6l9Nw5ITJXKFgwNQTZVkndvQcr1Bw6nQqBDXt1qgmTdKTtNkrWEfgyYBnJtQW6qS+rZL8RB1x9Rjnu5PE+ao4YzrZEnKcenlWRh7+1GUdkRPm5qJWAMnuT1LkBdUx4bUPGf1D8iQ12kMLa5NnMQMq4Yek,iv:fTsBB5yZYi47dk8JIDs1JmgtnK8dOhkNt481vqAU+ME=,tag:pAXBSgzPB8nDdAO9YXM02A==,type:str]
 youmubot-env: ENC[AES256_GCM,data:EQ9e6lmCrjofHiHyN5Qe4b2oplP9/3JKl0vuFp54Hw9aYIS7j3nqzWLCvV54ZK7j1PcQ+CQorjeCVMV0TUy1f1Pf3qjrLkdOdV7ICq540gdfXOeXuhAx2EILpGkwIYOdKmTMSO3l2QkOlM02RNOn1lq/DogAydkEq7gJ7qSWnUEr45oNCa1+LamH8vcbDmIyzUWWXyA5EQ==,iv:fnNGZ6OaZ4D71SvWPRynsMpO1IsvxjQ3XtrswNSY+Wo=,tag:cN/ZnKrjSfD6AbU9pYNl+Q==,type:str]
 outline:
     smtp-password: ENC[AES256_GCM,data:zpIi6jVB2Y7ksBOR8SGFgjOD1x3aS6dKa6taLKB8v2l9p92iWDti75qgB1puglmmq8mCzz8KXLrM0Bv7W8GWRg==,iv:6tKINzQcApmNuIbNn0kSzFJtwn3rky/uFG2Ff3lazUk=,tag:kjB6qB87tRQVpy32Pt3D5A==,type:str]
@@ -42,11 +42,6 @@ peertube: ENC[AES256_GCM,data:YWySVZVTC26qPMcgSV5v4Vp1u69jGt7VV2ElQBSxvG/R589PCJ
 peertube-env: ENC[AES256_GCM,data:ZrWBwSfMuepIYTzHVCCSnpsXb+MTcOfklI0O/UdcGaR3RzO1R+/wXQcFlV46g9dvKLMOaH7bxrHeWxqPh/7hlPEYFYwlbwcX31MGiSeRyeR5YtVi0CmhiGRA3l8X5NMCpvZmNhnjYNuri/My86SMkjhuaFQ5+BjYISoJ5WnbNSqE9qgQKuJVu64hsOgaQQbmaBL/LU7Pv/vushbNg421kdbRnzCPcc3IzkVzsFsgYH2fdEJa3gE8M63eLn99PbA+e5cWEwGNkuoNuro2tnaMaX1PM6iTF+q0A8HbiEioNMRIdD9czatgF7EwKgCFNu44cm2lp/c5qj+Lm/nC,iv:+MjpreGr9M+Oe5DrDe5SIBKtLuIqtb0a50YvGhDZT2Y=,tag:gYGlMcgWwa1ZpbQb4XfMmQ==,type:str]
 nix-build-farm:
     private-key: ENC[AES256_GCM,data:bYQ5TAHgJ8rZmmnp0ZW9pM3p6e2ewAqz9+clp2lDnvPsU/YHr/POSW+UESvulT0UDI8t5th71py2G4BG3z9PdPaWw2iSm6hW3VITYCGYvLbF2yK6anSkww0ilpjwm5NXKJLTiPehkAqsZlZsAxeYw5bF0+7JjeH9+49jLOXtGD0uFSf5M3wVZcObzSYsdGaNKGYkokBYeZii1tdwZvAuUKKZ1eOvDAz5v6hjqZA7brDWr5IZXNCqRZOdyGQ5g3UP4o5XFnl57d1RAmKPK9WaTCjbi0hMfms4zldqGeXTRDAhvqMH2w/BY7KvgIOr+aQelTvQbOciq+DaZbzNgdI5gqrSUA19EEL04Qu/gjoVGwMhZ7Lq9+yS2Lb+xdhmn/99sbcRjaRqqjgzHRvbyirPT9EuEAdrijyuZzY9kASv8LN/Q8cawRZNk2vf0M8Qzg0F7iw2kcDrf+dwdcyrrAbg2XDlGsFBckBcPKA44PkOPtFLHZRU9pSpd15rL1JIes6m2YX7AmJFP2+FA5WjXQoqF+CRhBVUWXaXAmcq,iv:7Uqnu2xEcHotczRzIcDfq9bM7wNXdz0Fg2HNpxlV1/Q=,tag:w5aLsT9LN92+83rdP2YJTg==,type:str]
-vikunja:
-    env: ENC[AES256_GCM,data:wHwLaX7z31Ogee0fSIJ4EpP/FUHOmj8lESqPacmrgokf9+2NpG8OKt99csDiYM9EEq2S3P70N6r+Dhzxob53lmQhNK8JuvZqrZ1HxgvMXirjnkXl0LGqVHBM4QdMvxVkICRNc1GMrG6ZY4OBQkn5did1ZZiCuXFC/ByuNTqBNHXoZmZMrewF9MFY+wfGx7+gIYzZ5JF1sgkTqtBdnAiUT2t9AaYNc8qjoZvNj3sgMb35/tKG0CYpt0vz6QuMQwOBJNrRkh2lV7YgTcr1tOkTc2FvRoLLyDykl8fjUf9KDcJLz672E90D0rRA5oHp/Lk28sSThh9WAM0skJofjXMOpq9ScsljWovUuizXUVCg5O/79EyhI7zPX6M3C/415sWdmGLYcRYRq7Ww1IoRgi2j9nCDLstHSMgF1igRWnsBEIFISCmSURMHOZNMkxWsxJ+0HJoMX9bmoZLLMrkjCqyPi/1r0X90aforkmA2xB+pC8rvYBKSxXYt8Nfu6KOK1JsmKTMmmC1R1dswuXvt/qCCH0yf0tl7GrGACKkDerDXVDZj4+SygkXM2bQF/L/KjQI7UspSdmGUmAvjhX31Zt1qZoYa2E2gabBWSGgXDuNixgbL/twaUA1CcA+ZPVBH0oAlOCc0dLXy0OZSn2U4IV1NH//66s1cmWEQQs4GKxhXzABiBvYaSj45LQtnEo2/HaifKhBWPxkjY9fW85Hy4Bgock4ReHYKsCF0LbsgKZhZ+WQp9mjTGLKxmRJJskwSEgxLmjK+AC2FK8zq2COMQ/eOxHe9OxEwjiQs5xCwnYXt2wOMHcxg3yoBCkTxoqMLs11kWORqcXzyoW1rV5W5DHk8K+7a4N385arHyg9+9S2FtfFUL46/GPcqf7lw5qgCDP/An5lPQZxA7/ItLzxFkviSx+e/cNl3UMTdx2aX4dn4L2cv54GuXDMHVHw++onJJnqn97aczK4O5y0=,iv:4T7vftUcSOS84MpZUOM9ODA36GSrKeW5TClQM3GN2mk=,tag:5mzK4NsmmrYERRn+Vb01Eg==,type:str]
-    provider-clientsecret: ENC[AES256_GCM,data:/fN1rH2CKoaivhespd+/KamERjBQOdwR7QQ+hoB+pQ3ZSrBVIKbLMWyOJe8f7rVwXAByqDxQIZJEVPjcjhWSU1eicwpu57FBx+/xJLFazspTVZ+5XKyAwR+UxTHDGAgtFV00QHN53l7ygg4joWWko4IPN1JIpNIASaIWWzpsrIo=,iv:NLsZcmE1kKlzV7B/XPVfENMWlpQtOpESH0ByX1KQ8IQ=,tag:P+ZmsKq0KJAeRTTbvbduMg==,type:str]
-n8n:
-    env: ENC[AES256_GCM,data:LA/6tMfGgX0cDNfhIZ+n2Ay+6OW5gPPebcXQnfO3qQJSjMjf9vwauF2+W3KpIvM1Dsg3hyNEwqLNRn/28bgWC/qpBpgU2/gVI2n5oxcQaYGgnS/jB0nZWXvORVTnXjH0R+HBFCWgMJe7v+o0EeBH6kni/Nc9geb8paRkxZOGVKeJQy9K4OB2CN6FVO9KeR7gpeQpsh5V5SVW1MoND2tpCOiIK7d0uM6OHF/7p2RFrEEAarvJssj/dZRHjA/jALuqbQ6UDAaAppqlkEgIdZdFEfgebfCWR4e4aWjznW1DGOQQYtg4k/Kj8J/df8CWXX+lUO+9nTo/lhhcH395w+CRE8GUwze15yxQppUwqyLKdYwgmpK1tFnLP/W/As2f97c1fBB9rXrZYOUEIq4GspHOTPgjzcRfWOxX8cMKG69EmeZ3mWPsIDaC1ZvkVQjjcH/o9aC7QeFCwPfcy+mgI+9RjAaCw7qdig1CwgQabAaCd2hzQ4FTXBFJoZRfYZ1v3Rdwe8zqMivIcw2AHv6kYx6c9A==,iv:KmyJ/CLAGrYfzHjSWygtgA/+am9fUrKnOsGRPgV9QfU=,tag:G3LhfdSujcaC9ZZFUse0DQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -80,8 +75,8 @@ sops:
             by9kZFlTRVdCZFkxYTVVb0RIRk8zUlkKCqMw9oL9RaYBV5Hhy3o8Nm5xmGrPH8Sd
             hv36sxRFFNZT/DCKaHaSRbT3mfpBZSTXJt1dgl4nZe6whH54t/1KmA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-07T23:38:16Z"
+    lastmodified: "2024-10-26T12:06:05Z"
-    mac: ENC[AES256_GCM,data:GKCMZJVKj5Fq7Ak4wQgI/pAl8JKDdzAYCBRwnxHlg0Z10AstbchAYm+LLwCaE85ebl6m/JexmfJeutJo0yGXuOIQKcEgfyNq9O/i/y34ISc4looQ6cyH5Hcxsd9JXgrmgQzVPquBXQzDHz4rj93VhNrvqmw+SgDPZVwcUznvCBI=,iv:HtUmf0qjvbYW7ngocISpqycX7ceNv0YsILgZhOMTSMg=,tag:kJ7EFOLL8o/2OFkn5PhvJw==,type:str]
+    mac: ENC[AES256_GCM,data:nici08Luubj2xDfsi1s16VCyG5oizIC6DRfvypmjWRpn0DSpcoWW1j32ya2poEwzpBJoVksFp7ijyjaJv8obExKx94ZYc790eOp/kp1f8lBaHDF8qrYYPL5penkt+UTKeb8xb7BPCJ7O89IVkIjAt7EoQOliMYrLpbiZGkMdHE0=,iv:qY5+MjU5VaXAesuFGt4SgmEdcJ6+vb/mk+NdOPLjCik=,tag:poRJZW3sAMv6EMi64SEQyA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.1

nki-personal-do/vikunja.nix

@@ -1,99 +0,0 @@
-{ pkgs, lib, config, ... }:
-let
-  secrets = config.sops.secrets;
-
-  host = "kanban.dtth.ch";
-  user = "vikunja";
-  port = 12785;
-
-  storageMount = "/mnt/data/vikunja";
-in
-{
-  sops.secrets."vikunja/env" = { restartUnits = [ "vikunja.service" ]; };
-  sops.secrets."vikunja/provider-clientsecret" = { restartUnits = [ "vikunja.service" ]; };
-  cloud.postgresql.databases = [ user ];
-  cloud.traefik.hosts.vikunja = {
-    inherit port host;
-  };
-
-  # users
-  users.users."${user}" = {
-    group = "${user}";
-    isSystemUser = true;
-  };
-  users.groups."${user}" = { };
-
-
-  services.vikunja = {
-    inherit port;
-    enable = true;
-
-    frontendScheme = "https";
-    frontendHostname = host;
-
-    environmentFiles = [ secrets."vikunja/env".path ];
-
-    database = {
-      type = "postgres";
-      host = "/var/run/postgresql";
-      user = user;
-      database = user;
-    };
-
-    settings = {
-      service = {
-        publicurl = "https://${host}";
-        enableregistration = false;
-        enablepublicteams = true;
-      };
-      mailer = {
-        enabled = true;
-        host = "mx1.nkagami.me";
-        port = 465;
-        forcessl = true;
-      };
-      files.basepath = lib.mkForce storageMount;
-      migration = {
-        todoist.enable = true;
-        trello.enable = true;
-      };
-      backgrounds.providers.unsplash.enabled = true;
-      auth = {
-        local.enabled = false;
-        openid = {
-          enabled = true;
-          providers.authentik = {
-            name = "DTTH Discord Account";
-            authurl = "https://auth.dtth.ch/application/o/vikunja/";
-            logouturl = "https://auth.dtth.ch/application/o/vikunja/end-session/";
-            clientid = "GvCIBtdE2ZRbAo5BJzw4FbZjer7umJlaROT1Pvlp";
-            scope = "openid profile email vikunja_scope";
-          };
-        };
-      };
-      defaultsettings = {
-        avatar_provider = "gravatar";
-        week_start = 1;
-        language = "VN";
-        timezone = "Asia/Ho_Chi_Minh";
-      };
-    };
-  };
-
-  systemd.services.vikunja = {
-    serviceConfig.LoadCredential = [ "VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET_FILE:${secrets."vikunja/provider-clientsecret".path}" ];
-    serviceConfig.User = user;
-    serviceConfig.DynamicUser = lib.mkForce false;
-    serviceConfig.ReadWritePaths = [ storageMount ];
-    environment.VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET_FILE = "%d/VIKUNJA_AUTH_OPENID_PROVIDERS_AUTHENTIK_CLIENTSECRET_FILE";
-    unitConfig = {
-      RequiresMountsFor = [ storageMount ];
-    };
-  };
-  systemd.tmpfiles.settings."10-vikunja".${storageMount}.d = {
-    user = user;
-    group = user;
-    mode = "0700";
-  };
-}
-

nki-yoga-g8/configuration.nix

@@ -4,14 +4,6 @@
 
 { config, pkgs, lib, ... }:
 
-let
-  vmware = { pkgs, ... }: {
-    environment.systemPackages = [ pkgs.vmware-horizon-client ];
-    virtualisation.vmware.host = {
-      enable = true;
-    };
-  };
-in
 {
   imports =
     [
@@ -21,8 +13,6 @@ in
       ../modules/personal/fonts
       # Encrypted DNS
       ../modules/services/edns
-
-      vmware
     ];
 
   # Secrets
@@ -80,7 +70,7 @@ in
   services.printing.drivers = with pkgs; [ epfl-cups-drivers ];
 
   # Enable touchpad support (enabled default in most desktopManager).
-  services.libinput.enable = true;
+  services.xserver.libinput.enable = true;
   # Keyboard
   services.input-remapper.enable = true;
   services.input-remapper.serviceWantedBy = [ "multi-user.target" ];

overlay.nix

@@ -9,6 +9,9 @@ let
     # Typst updates really quickly.
     typst = final.unstable.typst;
     typst-lsp = final.unstable.typst-lsp;
+
+    # Until 0.35 is in
+    kitty = final.unstable.kitty;
   };
   overlay-imported = final: prev: {
     sway = prev.sway.override { sway-unwrapped = final.swayfx-unwrapped; };
@@ -71,18 +74,19 @@ let
       nativeMessagingHosts = with final; [ kdePackages.plasma-browser-integration ];
     });
 
-    vikunja =
+    # Add desktop file to premid
-      builtins.seq
+    premid = final.symlinkJoin {
-        (final.lib.assertMsg (prev.vikunja.version == "0.24.5") "Vikunja probably doesn't need custom versions anymore")
+      name = prev.premid.name;
-        (final.callPackage ./packages/common/vikunja.nix { });
+      paths = [
-
+        prev.premid
-    luminance = prev.luminance.overrideAttrs (attrs: {
+        (final.makeDesktopItem {
-      nativeBuildInputs = attrs.nativeBuildInputs ++ [ final.wrapGAppsHook ];
+          name = prev.premid.name;
-      buildInputs = attrs.buildInputs ++ [ final.glib ];
+          desktopName = "PreMID";
-      postInstall = attrs.postInstall + ''
+          exec = "${final.lib.getExe prev.premid} --no-sandbox %U";
-        glib-compile-schemas $out/share/glib-2.0/schemas
+          icon = "premid";
-      '';
+        })
-    });
+      ];
+    };
   };
 
   overlay-libs = final: prev: {
@@ -106,15 +110,23 @@ let
         meta.mainProgram = "kak-lsp";
       };
 
-    zen-browser-bin = final.callPackage inputs.zen-browser.packages.${final.stdenv.system}.zen-browser.override {
+    zen-browser-bin = final.callPackage ./packages/x86_64-linux/zen-browser-bin.nix {
-      wrap-firefox = opts: final.wrapFirefox (opts // {
+      nativeMessagingHosts = with final; [ kdePackages.plasma-browser-integration ];
-        nativeMessagingHosts = with final; [ kdePackages.plasma-browser-integration ];
-      });
-      zen-browser-unwrapped = final.callPackage inputs.zen-browser.packages.${final.stdenv.system}.zen-browser-unwrapped.override {
-        sources = inputs.zen-browser.inputs;
-      };
     };
   };
+
+  overlay-rust-is-dumb = final: prev: {
+    # Use stable delta compiled with old Rust version
+    delta = final.stable.delta;
+    deepfilternet = final.stable.deepfilternet;
+    harmonia = final.callPackage
+      (import
+        (builtins.fetchurl {
+          url = "https://raw.githubusercontent.com/Mic92/nixpkgs/63f91202f5cd071187ede5e5ffc56003cb442876/pkgs/by-name/ha/harmonia/package.nix";
+          sha256 = "1mz211c0bxn116ix0j5xx4wlglpbkfg7d3npw1z8hg9gc0vbj2xb";
+        }))
+      { };
+  };
 in
 [
   # inputs.swayfx.inputs.scenefx.overlays.override
@@ -123,17 +135,17 @@ in
   inputs.rust-overlay.overlays.default
   inputs.youmubot.overlays.default
 
+  (import ./overlays/openrazer)
   overlay-unstable
   overlay-needs-unstable
   overlay-packages
   overlay-imported
   overlay-versioning
   overlay-libs
+  overlay-rust-is-dumb
 
   (import ./packages/common)
 
   # Bug fixes
 ] # we assign the overlay created before to the overlays of nixpkgs.
 
-
-

overlays/openrazer/default.nix

@@ -0,0 +1,31 @@
+final: prev:
+let
+  version = "3.3.0";
+  src = final.fetchFromGitHub {
+    owner = "openrazer";
+    repo = "openrazer";
+    rev = "v${version}";
+    sha256 = "sha256-lElE1nIiJ5fk2DupHu43tmxRjRsS5xeL1Yz/LuRlgtM=";
+  };
+in
+rec
+{
+  openrazer-daemon = prev.openrazer-daemon.overrideAttrs (old: {
+    inherit src version;
+  });
+
+  python3 = prev.python3.override {
+    packageOverrides = self: super: {
+      openrazer-daemon = super.openrazer-daemon.overrideAttrs (old: {
+        inherit src version;
+      });
+    };
+  };
+  python3Packages = python3.pkgs;
+
+  linuxPackages_latest = prev.linuxPackages_latest.extend (self: super: {
+    openrazer = super.openrazer.overrideAttrs (old: {
+      inherit src version;
+    });
+  });
+}

packages/common/vikunja.nix

@@ -1,128 +0,0 @@
-{ lib, fetchFromGitHub, stdenv, nodejs, pnpm, buildGoModule, mage, writeShellScriptBin, nixosTests, autoPatchelfHook, musl }:
-
-let
-  version = "0.24.5-git";
-  src = fetchFromGitHub {
-    owner = "go-vikunja";
-    repo = "vikunja";
-    rev = "e57f04ec23e9ff8aa9877d2ea7d571c2a44790b0";
-    hash = "sha256-W6o1h6XBPvT1lH1zO5N7HcodksKill5eqSuaFl2kfuY=";
-  };
-
-  frontend = stdenv.mkDerivation (finalAttrs: {
-    pname = "vikunja-frontend";
-    inherit version src;
-
-    sourceRoot = "${finalAttrs.src.name}/frontend";
-
-    pnpmDeps = pnpm.fetchDeps {
-      inherit (finalAttrs) pname version src sourceRoot;
-      hash = "sha256-sOCaJDBgEMID+lN5plQpSqaGBIUs5h2tAwDzhtOH53o=";
-    };
-
-    nativeBuildInputs = [
-      nodejs
-      pnpm.configHook
-      autoPatchelfHook
-    ];
-
-    buildInputs = [
-      musl # For sass-embedded
-    ];
-
-    doCheck = true;
-    dontAutoPatchelf = true;
-
-    # See https://github.com/sass/embedded-host-node/issues/334
-    preBuild = ''
-      autoPatchelf node_modules/.pnpm/sass-embedded*
-    '';
-
-    postBuild = ''
-      pnpm run build
-    '';
-
-    checkPhase = ''
-      pnpm run test:unit --run
-    '';
-
-    installPhase = ''
-      cp -r dist/ $out
-    '';
-  });
-
-  # Injects a `t.Skip()` into a given test since there's apparently no other way to skip tests here.
-  skipTest = lineOffset: testCase: file:
-    let
-      jumpAndAppend = lib.concatStringsSep ";" (lib.replicate (lineOffset - 1) "n" ++ [ "a" ]);
-    in
-    ''
-      sed -i -e '/${testCase}/{
-      ${jumpAndAppend} t.Skip();
-      }' ${file}
-    '';
-in
-buildGoModule {
-  inherit src version;
-  pname = "vikunja";
-
-  nativeBuildInputs =
-    let
-      fakeGit = writeShellScriptBin "git" ''
-        if [[ $@ = "describe --tags --always --abbrev=10" ]]; then
-            echo "${version}"
-        else
-            >&2 echo "Unknown command: $@"
-            exit 1
-        fi
-      '';
-    in
-    [ fakeGit mage ];
-
-  vendorHash = "sha256-UWjlivF9ySXCAr84A1trCJ/n9pB98ZhEyG11qz3PL7g=";
-
-  inherit frontend;
-
-  prePatch = ''
-    cp -r ${frontend} frontend/dist
-  '';
-
-  postConfigure = ''
-    # These tests need internet, so we skip them.
-    ${skipTest 1 "TestConvertTrelloToVikunja" "pkg/modules/migration/trello/trello_test.go"}
-    ${skipTest 1 "TestConvertTodoistToVikunja" "pkg/modules/migration/todoist/todoist_test.go"}
-  '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    # Fixes "mkdir /homeless-shelter: permission denied" - "Error: error compiling magefiles" during build
-    export HOME=$(mktemp -d)
-    mage build:build
-
-    runHook postBuild
-  '';
-
-  checkPhase = ''
-    mage test:unit
-    mage test:integration
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    install -Dt $out/bin vikunja
-    runHook postInstall
-  '';
-
-  passthru.tests.vikunja = nixosTests.vikunja;
-
-  meta = {
-    changelog = "https://kolaente.dev/vikunja/api/src/tag/v${version}/CHANGELOG.md";
-    description = "Todo-app to organize your life";
-    homepage = "https://vikunja.io/";
-    license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [ leona ];
-    mainProgram = "vikunja";
-    platforms = lib.platforms.linux;
-  };
-}

packages/x86_64-linux/zen-browser-bin.nix

@@ -0,0 +1,32 @@
+{ appimageTools, fetchurl, nativeMessagingHosts ? [ ], ... }:
+let
+  pname = "zen-browser-bin";
+  version = "1.0.1-a.19";
+  src = fetchurl {
+    url = "https://github.com/zen-browser/desktop/releases/download/${version}/zen-specific.AppImage";
+    hash = "sha256-qAPZ4VyVmeZLRfL0kPHF75zyrSUFHKQUSUcpYKs3jk8=";
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit pname version src;
+  };
+
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    mv $out/bin/${pname} $out/bin/zen
+    install -m 444 -D ${appimageContents}/zen.desktop $out/share/applications/zen.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/128x128/apps/zen.png \
+      $out/share/icons/hicolor/128x128/apps/zen.png
+
+    mkdir -p $out/lib/mozilla/native-messaging-hosts
+    for ext in ${toString nativeMessagingHosts}; do
+        ln -sLt $out/lib/mozilla/native-messaging-hosts $ext/lib/mozilla/native-messaging-hosts/*
+    done
+  '';
+
+  meta.mainProgram = "zen";
+}
+