thanatos: add Nix runner

Flake lock file updates:

• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/f6581f1c3b137086e42a08a906bdada63045f991' (2024-11-12)
  → 'github:NixOS/nixos-hardware/672ac2ac86f7dff2f6f3406405bddecf960e0db6' (2024-11-16)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/689fed12a013f56d4c4d3f612489634267d86529' (2024-11-12)
  → 'github:NixOS/nixpkgs/e8c38b73aeb218e27163376a2d617e61a2ad9b59' (2024-11-16)

.github/workflows/cachix.yaml

@@ -15,10 +15,10 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - uses: cachix/install-nix-action@v25
+    - uses: cachix/install-nix-action@v27
 
     - name: Run alejandra
-      run: nix run nixpkgs#alejandra -- --check .
+      run: nix develop --command alejandra --check .
 
   flake-check:
     name: Flake check
@@ -26,9 +26,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - uses: cachix/install-nix-action@v25
+    - uses: cachix/install-nix-action@v27
 
-    - uses: cachix/cachix-action@v14
+    - uses: cachix/cachix-action@v15
       with:
         name: alarsyo
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -46,7 +46,6 @@ jobs:
       fail-fast: false
       matrix:
         name:
-        - ansel
         - grafanaDashboards/nginx
         - grafanaDashboards/node-exporter
         - kaleidoscope-udev-rules
@@ -56,9 +55,9 @@ jobs:
     steps:
     - uses: actions/checkout@v4
 
-    - uses: cachix/install-nix-action@v25
+    - uses: cachix/install-nix-action@v27
 
-    - uses: cachix/cachix-action@v14
+    - uses: cachix/cachix-action@v15
       with:
         name: alarsyo
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -78,15 +77,18 @@ jobs:
         name:
         - boreal
         - hades
-        - hephaestus
+        - talos
         - thanatos
 
     steps:
+    - name: Delete huge unnecessary tools folder
+      run: rm -rf /opt/hostedtoolcache
+
     - uses: actions/checkout@v4
 
-    - uses: cachix/install-nix-action@v25
+    - uses: cachix/install-nix-action@v27
 
-    - uses: cachix/cachix-action@v14
+    - uses: cachix/cachix-action@v15
       with:
         name: alarsyo
         authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

base/gui-programs.nix

@@ -23,35 +23,47 @@ in {
     programs.gnupg.agent = {
       enable = true;
       enableSSHSupport = true;
-      pinentryFlavor = "qt";
+      pinentryPackage = pkgs.pinentry-qt;
     };
 
     services = {
       xserver = {
         enable = true;
-        windowManager.i3.enable = true;
+        # NOTE: could use `mkOptionDefault` but this feels more explicit
+        videoDrivers =
+          if config.my.gui.isNvidia
+          then ["nvidia"]
+          else options.services.xserver.videoDrivers.default;
         xkb = {
           layout = "fr";
           variant = "us";
         };
-        libinput = {
+      };
-          enable = true;
+
-          touchpad = {
+      libinput = {
-            naturalScrolling = true;
+        enable = true;
-          };
+        touchpad = {
+          naturalScrolling = true;
         };
       };
 
       logind.lidSwitch = "ignore";
+
+      printing = {
+        enable = true;
+        cups-pdf.enable = true;
+      };
+
+      udev.packages = [pkgs.chrysalis];
     };
 
     environment.systemPackages = builtins.attrValues {
       inherit
         (pkgs)
+        arandr
         chrysalis
-        evince
+        discord
         feh
-        firefox
         ffmpeg
         gimp-with-plugins
         imagemagick
@@ -66,58 +78,10 @@ in {
         zathura
         ;
 
-      inherit (pkgs.gnome) nautilus;
-
       inherit (pkgs.libsForQt5) okular;
-
-      discord = pkgs.discord.override {nss = pkgs.nss_latest;};
     };
 
-    networking.networkmanager = {
+    networking.networkmanager.enable = true;
-      enable = true;
-
-      dispatcherScripts = [
-        {
-          source = let
-            grep = "${pkgs.gnugrep}/bin/grep";
-            nmcli = "${pkgs.networkmanager}/bin/nmcli";
-          in
-            pkgs.writeShellScript "disable_wifi_on_ethernet" ''
-              export LC_ALL=C
-              date >> /tmp/disable_wifi_on_ethernet.log
-              echo START "$@" >> /tmp/disable_wifi_on_ethernet.log
-
-              beginswith() { case $2 in "$1"*) true;; *) false;; esac; }
-
-              is_ethernet_interface ()
-              {
-                  local type="$(${nmcli} dev show "$1" | grep 'GENERAL\.TYPE:' | awk '{ print $2 }')"
-                  test "$type" = "ethernet" || beginswith enp "$1"
-              }
-
-              hotspot_enabled ()
-              {
-                ${nmcli} dev | ${grep} -q "hotspot"
-              }
-
-              if is_ethernet_interface "$1" && ! hotspot_enabled; then
-                echo "change in ethernet and not in hotspot mode" >> /tmp/disable_wifi_on_ethernet.log
-                if [ "$2" = "up" ]; then
-                    echo "turning wifi off" >> /tmp/disable_wifi_on_ethernet.log
-                    nmcli radio wifi off
-                fi
-
-                if [ "$2" = "down" ]; then
-                    echo "turning wifi on" >> /tmp/disable_wifi_on_ethernet.log
-                    nmcli radio wifi on
-                fi
-              fi
-              echo END "$@" >> /tmp/disable_wifi_on_ethernet.log
-            '';
-          type = "basic";
-        }
-      ];
-    };
     programs.nm-applet.enable = true;
     programs.steam.enable = true;
 

base/programs.nix

@@ -26,31 +26,22 @@
       fd
       file
       ripgrep
-      sd
-      tokei
       tree
       wget
-      jq
       pciutils
       usbutils
       # development
       
-      agenix
-      alejandra
       git
       git-crypt
       git-lfs
       gnumake
       gnupg
-      pinentry-qt
       python3
       vim
       # terminal utilities
       
-      dogdns
-      du-dust
       htop
-      ldns # drill
       unzip
       zip
       ;

flake.lock

@@ -8,11 +8,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1707830867,
+        "lastModified": 1716561646,
-        "narHash": "sha256-PAdwm5QqdlwIqGrfzzvzZubM+FXtilekQ/FA0cI49/o=",
+        "narHash": "sha256-UIGtLO89RxKt7RF2iEgPikSdU53r6v/6WYB0RW3k89I=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "8cb01a0e717311680e0cbca06a76cbceba6f3ed6",
+        "rev": "c2fc0762bbe8feb06a2e59a364fa81b3a57671c9",
         "type": "github"
       },
       "original": {
@@ -48,11 +48,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1709286488,
+        "lastModified": 1717032306,
-        "narHash": "sha256-RDpTZ72zLu05djvXRzK76Ysqp9zSdh84ax/edEaJucs=",
+        "narHash": "sha256-s3Sis+M1qTSVIehHrEKBzHBpqprIFJli5V6WojkJnYE=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "bde7dd352c07d43bd5b8245e6c39074a391fdd46",
+        "rev": "8ea5bcccc03111bdedaeaae9380dfab61e9deb33",
         "type": "github"
       },
       "original": {
@@ -67,11 +67,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1709126324,
+        "lastModified": 1710146030,
-        "narHash": "sha256-q6EQdSeUZOG26WelxqkmR7kArjgWCdw5sfJVHPH/7j8=",
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "d465f4819400de7c8d874d50b982301f28a84605",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
         "type": "github"
       },
       "original": {
@@ -81,6 +81,39 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "inputs": {
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1710146030,
+        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flakey-profile": {
+      "locked": {
+        "lastModified": 1712898590,
+        "narHash": "sha256-FhGIEU93VHAChKEXx905TSiPZKga69bWl1VB37FK//I=",
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "rev": "243c903fd8eadc0f63d205665a92d4df91d42d9d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "lf-",
+        "repo": "flakey-profile",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -109,27 +142,62 @@
         ]
       },
       "locked": {
-        "lastModified": 1709204054,
+        "lastModified": 1726989464,
-        "narHash": "sha256-U1idK0JHs1XOfSI1APYuXi4AEADf+B+ZU4Wifc0pBHk=",
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "2f3367769a93b226c467551315e9e270c3f78b15",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "master",
+        "ref": "release-24.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
+    "lix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1729298361,
+        "narHash": "sha256-hiGtfzxFkDc9TSYsb96Whg0vnqBVV7CUxyscZNhed0U=",
+        "rev": "ad9d06f7838a25beec425ff406fe68721fef73be",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/lix/archive/ad9d06f7838a25beec425ff406fe68721fef73be.tar.gz?rev=ad9d06f7838a25beec425ff406fe68721fef73be"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/lix/archive/2.91.1.tar.gz"
+      }
+    },
+    "lix-module": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "flakey-profile": "flakey-profile",
+        "lix": "lix",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729360442,
+        "narHash": "sha256-6U0CyPycIBc04hbYy2hBINnVso58n/ZyywY2BD3hu+s=",
+        "rev": "9098ac95768f7006d7e070b88bae76939f6034e6",
+        "type": "tarball",
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/9098ac95768f7006d7e070b88bae76939f6034e6.tar.gz?rev=9098ac95768f7006d7e070b88bae76939f6034e6"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz"
+      }
+    },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1709147990,
+        "lastModified": 1731797098,
-        "narHash": "sha256-vpXMWoaCtMYJ7lisJedCRhQG9BSsInEyZnnG5GfY9tQ=",
+        "narHash": "sha256-UhWmEZhwJZmVZ1jfHZFzCg+ZLO9Tb/v3Y6LC0UNyeTo=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "33a97b5814d36ddd65ad678ad07ce43b1a67f159",
+        "rev": "672ac2ac86f7dff2f6f3406405bddecf960e0db6",
         "type": "github"
       },
       "original": {
@@ -157,11 +225,11 @@
     },
     "nixpkgs-unstable-small": {
       "locked": {
-        "lastModified": 1709271102,
+        "lastModified": 1729493358,
-        "narHash": "sha256-Z2sBL/HRRTNABsU8E5XsP+FXBEyBoi6oMwm5bV7lSFw=",
+        "narHash": "sha256-Ti+Y9nWt5Fcs3JlarxLPgIOVlbqQo7jobz/qOwOaziM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "09c1497ce5d4ed4a0edfdd44450d3048074cb300",
+        "rev": "a5e6a9e979367ee14f65d9c38119c30272f8455f",
         "type": "github"
       },
       "original": {
@@ -173,11 +241,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1708815994,
+        "lastModified": 1716914467,
-        "narHash": "sha256-hL7N/ut2Xu0NaDxDMsw2HagAjgDskToGiyZOWriiLYM=",
+        "narHash": "sha256-KkT6YM/yNQqirtYj/frn6RRakliB8RDvGqVGGaNhdcU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9a9dae8f6319600fa9aebde37f340975cab4b8c0",
+        "rev": "4a3fc4cf736b7d2d288d7a8bf775ac8d4c0920b4",
         "type": "github"
       },
       "original": {
@@ -189,16 +257,16 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1709150264,
+        "lastModified": 1731797254,
-        "narHash": "sha256-HofykKuisObPUfj0E9CJVfaMhawXkYx3G8UIFR/XQ38=",
+        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9099616b93301d5cf84274b184a3a5ec69e94e08",
+        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -209,6 +277,7 @@
         "disko": "disko",
         "flake-utils": "flake-utils",
         "home-manager": "home-manager_2",
+        "lix-module": "lix-module",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_3",
         "nixpkgs-unstable-small": "nixpkgs-unstable-small"
@@ -243,6 +312,21 @@
         "repo": "default",
         "type": "github"
       }
+    },
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -5,7 +5,7 @@
       type = "github";
       owner = "NixOS";
       repo = "nixpkgs";
-      ref = "nixos-unstable";
+      ref = "nixos-24.05";
     };
 
     nixpkgs-unstable-small = {
@@ -25,7 +25,7 @@
       type = "github";
       owner = "nix-community";
       repo = "home-manager";
-      ref = "master";
+      ref = "release-24.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -49,6 +49,11 @@
       repo = "disko";
       ref = "master";
     };
+
+    lix-module = {
+      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = {
@@ -57,26 +62,18 @@
     home-manager,
     agenix,
     disko,
+    lix-module,
     ...
   } @ inputs:
     {
       nixosModules = {
         home = {
+          home-manager.backupFileExtension = "hm-backup";
           home-manager.useGlobalPkgs = true;
           home-manager.useUserPackages = true;
           home-manager.users.alarsyo = import ./home;
           home-manager.verbose = true;
         };
-        nix-path = {
-          nix = {
-            nixPath = [
-              "nixpkgs=${inputs.nixpkgs}"
-            ];
-            registry = {
-              nixpkgs.flake = inputs.nixpkgs;
-            };
-          };
-        };
       };
 
       overlays = import ./overlays;
@@ -102,6 +99,7 @@
           [
             agenix.nixosModules.default
             home-manager.nixosModules.default
+            lix-module.nixosModules.default
             {
               nixpkgs = {
                 overlays = shared_overlays;
@@ -141,20 +139,6 @@
             ++ sharedModules;
         };
 
-        hephaestus = nixpkgs.lib.nixosSystem rec {
-          inherit system;
-          modules =
-            [
-              ./hephaestus.nix
-
-              inputs.nixos-hardware.nixosModules.common-cpu-amd
-              inputs.nixos-hardware.nixosModules.common-gpu-amd
-              inputs.nixos-hardware.nixosModules.common-pc-laptop
-              inputs.nixos-hardware.nixosModules.common-pc-ssd
-            ]
-            ++ sharedModules;
-        };
-
         talos = nixpkgs.lib.nixosSystem {
           inherit system;
           modules =
@@ -177,11 +161,16 @@
         };
       };
     }
-    // inputs.flake-utils.lib.eachDefaultSystem (system: {
+    // inputs.flake-utils.lib.eachDefaultSystem (system: let
+      pkgs = nixpkgs.legacyPackages.${system};
+    in {
       packages =
         inputs.flake-utils.lib.flattenTree
-        (import ./pkgs {
+        (import ./pkgs {inherit pkgs;});
-          pkgs = import nixpkgs {inherit system;};
+      devShells.default = pkgs.mkShellNoCC {
-        });
+        buildInputs = [
+          pkgs.alejandra
+        ];
+      };
     });
 }

hephaestus.nix

@@ -1,23 +0,0 @@
-{...}: {
-  imports = [
-    # Default configuration
-    ./base
-
-    # Module definitions
-    ./modules
-
-    # Service definitions
-    ./services
-
-    # Host-specific config
-    ./hosts/hephaestus
-  ];
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "23.05"; # Did you read the comment?
-}

home/default.nix

@@ -2,6 +2,7 @@
   imports = [
     ./alacritty.nix
     ./bat.nix
+    ./direnv.nix
     ./emacs.nix
     ./env.nix
     ./firefox.nix
@@ -10,7 +11,6 @@
     ./git.nix
     ./gtk.nix
     ./laptop.nix
-    ./lorri.nix
     ./mail.nix
     ./rbw.nix
     ./rofi.nix

home/direnv.nix

@@ -9,17 +9,15 @@
     mkIf
     ;
 
-  cfg = config.my.home.lorri;
+  cfg = config.my.home.direnv;
 in {
-  options.my.home.lorri = {
+  options.my.home.direnv = {
-    enable = (mkEnableOption "lorri daemon setup") // {default = true;};
+    enable = (mkEnableOption "setup direnv usage") // {default = true;};
   };
 
   config = mkIf cfg.enable {
-    services.lorri.enable = true;
     programs.direnv = {
       enable = true;
-      # FIXME: proper file, not lorri.nix
       nix-direnv = {
         enable = true;
       };

home/emacs.nix

@@ -43,7 +43,7 @@ in {
 
     programs.emacs = {
       enable = true;
-      package = pkgs.emacs29;
+      package = pkgs.emacs29-pgtk;
       extraPackages = epkgs: [epkgs.vterm epkgs.pdf-tools pkgs.lilypond epkgs.mu4e];
     };
   };

home/fish/functions/nfl.fish

@@ -1,7 +1,4 @@
 function nfl
     set -l flags "--commit-lock-file"
-    for flake in $argv
+    nix flake update $flags $argv
-        set -a flags "--update-input" "$flake"
-    end
-    nix flake lock $flags
 end

home/tridactylrc

@@ -18,8 +18,10 @@ bind ,<Space> nohlsearch
 " case insensitive if lowercase, case sensitive if using some uppercase letters
 set findcase smart
 
+set modeindicatormodes {"ignore": "false"}
+
 " New reddit is bad
-autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")
+" autocmd DocStart ^http(s?)://www.reddit.com js tri.excmds.urlmodify("-t", "www", "old")
 
 " Orange site / Reddit / Lobste.rs specific hints to toggle comments
 bind ;c hint -Jc [class*="expand"],[class="togg"],[class="comment_folder"]
@@ -36,3 +38,6 @@ blacklistadd localhost
 blacklistadd netflix.com
 blacklistadd primevideo.com
 blacklistadd youtube.com
+
+" prevent teams from crashing
+seturl teams.microsoft.com superignore true

home/x/i3.nix

@@ -6,11 +6,12 @@
 }: let
   inherit
     (lib)
+    mkEnableOption
     mkIf
     mkOptionDefault
     ;
 
-  isEnabled = config.my.home.x.enable;
+  isEnabled = config.my.home.x.i3.enable;
 
   myTerminal =
     # FIXME: fix when terminal is setup in home
@@ -26,6 +27,10 @@
 
   i3Theme = config.my.theme.i3Theme;
 in {
+  options.my.home.x.i3 = {
+    enable = mkEnableOption "i3wm configuration";
+  };
+
   config = mkIf isEnabled {
     my.home = {
       flameshot.enable = true;

hosts/boreal/default.nix

@@ -24,10 +24,12 @@
 
   boot.tmp.useTmpfs = true;
 
-  boot.supportedFilesystems = [
+  boot.supportedFilesystems = {
-    "btrfs"
+    btrfs = true;
-    "ntfs"
+    ntfs = true;
-  ];
+  };
+
+  services.xserver.windowManager.i3.enable = true;
 
   services.btrfs = {
     autoScrub = {
@@ -84,7 +86,6 @@
   services = {
     openssh = {
       enable = true;
-      forwardX11 = true;
     };
   };
   my.gui = {
@@ -92,18 +93,14 @@
     isNvidia = true;
   };
 
-  my.wakeonwlan.interfaces.phy0.methods = [
+  hardware = {
-    "magic-packet"
+    bluetooth = {
-    "disconnect"
+      enable = true;
-    "gtk-rekey-failure"
+      powerOnBoot = false;
-    "eap-identity-request"
+    };
-    "rfkill-release"
+    nvidia = {
-  ];
+      open = true;
-
+      modesetting.enable = true;
-  services.udev.packages = [pkgs.chrysalis];
+    };
-
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = false;
   };
 }

hosts/boreal/home.nix

@@ -4,11 +4,11 @@
   ...
 }: {
   home-manager.users.alarsyo = {
-    # TODO: can probably upgrade me
+    home.stateVersion = "20.09";
-    home.stateVersion = "21.05";
 
     # Keyboard settings & i3 settings
     my.home.x.enable = true;
+    my.home.x.i3.enable = true;
     my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
     my.home.x.i3bar.temperature.inputs = ["Tccd1"];
     my.home.x.i3bar.networking.throughput_interfaces = ["enp8s0" "wlp4s0"];

hosts/hades/default.nix

@@ -57,7 +57,7 @@ in {
   my.services = {
     fail2ban.enable = true;
 
-    gitea = {
+    forgejo = {
       enable = true;
       privatePort = 8082;
     };
@@ -81,6 +81,11 @@ in {
       secretConfigFile = config.age.secrets."matrix-synapse/secret-config".path;
     };
 
+    mealie = {
+      enable = true;
+      port = 8090;
+    };
+
     microbin = {
       enable = true;
       privatePort = 8088;
@@ -112,11 +117,6 @@ in {
       secretKeyFile = config.age.secrets."paperless/secret-key".path;
     };
 
-    photoprism = {
-      enable = true;
-      port = 8084;
-    };
-
     pleroma = {
       enable = true;
       port = 8086;

hosts/hades/home.nix

@@ -1,8 +1,6 @@
 {config, ...}: {
   home-manager.users.alarsyo = {
-    # TODO: can probably upgrade me
+    home.stateVersion = "22.05";
-    home.stateVersion = "21.05";
-
     my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
   };
 }

hosts/hades/secrets.nix

@@ -13,8 +13,6 @@
         // attrs;
     in
       lib.mapAttrs toSecret {
-        "gandi/api-key" = {};
-
         "lohr/shared-secret" = {};
 
         "matrix-synapse/secret-config" = {
@@ -29,6 +27,8 @@
           owner = "nextcloud";
         };
 
+        "ovh/credentials" = {};
+
         "paperless/admin-password" = {};
         "paperless/secret-key" = {};
 

hosts/hephaestus/default.nix

@@ -1,246 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}: {
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ./home.nix
-    ./secrets.nix
-  ];
-
-  hardware.amdgpu.opencl = false;
-
-  boot.kernelPackages = pkgs.linuxPackages;
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-
-  # boot.initrd.systemd.enable = true;
-  # boot.plymouth.enable = true;
-  # boot.kernelParams = ["quiet"];
-
-  boot.initrd.secrets = {
-    "/crypto_keyfile.bin" = null;
-  };
-
-  boot.tmp.useTmpfs = true;
-
-  services.btrfs = {
-    autoScrub = {
-      enable = true;
-      fileSystems = ["/"];
-    };
-  };
-
-  networking.hostName = "hephaestus"; # Define your hostname.
-  networking.domain = "alarsyo.net";
-
-  networking.networkmanager.enable = true;
-
-  # Set your time zone.
-  time.timeZone = "Europe/Paris";
-
-  # List services that you want to enable:
-  my.services = {
-    tailscale = {
-      enable = true;
-      useRoutingFeatures = "client";
-    };
-
-    pipewire.enable = true;
-
-    restic-backup = {
-      enable = true;
-      repo = "b2:hephaestus-backup";
-      passwordFile = config.age.secrets."restic-backup/hephaestus-password".path;
-      environmentFile = config.age.secrets."restic-backup/hephaestus-credentials".path;
-
-      timerConfig = {
-        OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
-      };
-
-      paths = [
-        "/home/alarsyo"
-      ];
-      exclude = [
-        "/home/alarsyo/Downloads"
-
-        # Rust builds using half my storage capacity
-        "/home/alarsyo/**/target"
-        "/home/alarsyo/work/rust/build"
-
-        # don't backup nixpkgs
-        "/home/alarsyo/work/nixpkgs"
-
-        "/home/alarsyo/go"
-
-        # C build crap
-        "*.a"
-        "*.o"
-        "*.so"
-
-        ".direnv"
-
-        # test vms
-        "*.qcow2"
-
-        # secrets stay offline
-        "/home/alarsyo/**/secrets"
-
-        # ignore all dotfiles as .config and .cache can become quite big
-        "/home/alarsyo/.*"
-      ];
-    };
-  };
-
-  virtualisation.docker.enable = true;
-  virtualisation.libvirtd.enable = true;
-  programs.dconf.enable = true;
-
-  services = {
-    tlp = {
-      enable = true;
-      settings = {
-        START_CHARGE_THRESH_BAT0 = 70;
-        STOP_CHARGE_THRESH_BAT0 = 80;
-      };
-    };
-    fwupd.enable = true;
-    openssh.enable = true;
-  };
-
-  my.gui.enable = true;
-  my.displayManager.sddm.enable = lib.mkForce false;
-
-  hardware.bluetooth = {
-    enable = true;
-    powerOnBoot = false;
-    settings.General.Experimental = true;
-  };
-
-  # Select internationalisation properties.
-  i18n.defaultLocale = "en_US.UTF-8";
-
-  i18n.extraLocaleSettings = {
-    LC_ADDRESS = "fr_FR.UTF-8";
-    LC_IDENTIFICATION = "fr_FR.UTF-8";
-    LC_MEASUREMENT = "fr_FR.UTF-8";
-    LC_MONETARY = "fr_FR.UTF-8";
-    LC_NAME = "fr_FR.UTF-8";
-    LC_PAPER = "fr_FR.UTF-8";
-    LC_TELEPHONE = "fr_FR.UTF-8";
-  };
-
-  # Enable the X11 windowing system.
-  services.xserver.enable = true;
-
-  # Enable the KDE Plasma Desktop Environment.
-  services.xserver.displayManager.sddm.enable = true;
-  services.xserver.desktopManager.plasma5.enable = true;
-  services.power-profiles-daemon.enable = false;
-
-  services.autorandr = {
-    enable = true;
-    profiles = {
-      default = {
-        fingerprint = {
-          "eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
-        };
-        config = {
-          "eDP-1" = {
-            enable = true;
-            crtc = 0;
-            primary = true;
-            position = "0x0";
-            mode = "1920x1080";
-          };
-        };
-      };
-      dock = {
-        fingerprint = {
-          "eDP-1" = "00ffffffffffff0030e42c0600000000001c0104a51f117802aa95955e598e271b5054000000010101010101010101010101010101012e3680a070381f403020350035ae1000001ab62c80f4703816403020350035ae1000001a000000fe004c4720446973706c61790a2020000000fe004c503134305746412d535044340018";
-          "DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
-          "DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
-        };
-        config = {
-          "eDP-1" = {
-            enable = true;
-            primary = false;
-            position = "3000x840";
-            mode = "1920x1080";
-          };
-          "DP-4" = {
-            enable = true;
-            primary = true;
-            position = "0x420";
-            mode = "1920x1080";
-          };
-          "DP-5" = {
-            enable = true;
-            primary = false;
-            position = "1920x0";
-            mode = "1920x1080";
-            rotate = "left";
-          };
-        };
-      };
-      dock-lid-closed = {
-        fingerprint = {
-          "DP-4" = "00ffffffffffff0026cd4161fb060000021e0104a5351e783aee35a656529d280b5054b74f00714f818081c081009500b300d1c0d1cf023a801871382d40582c45000f282100001e000000fd00374c1e5512000a202020202020000000ff0031313634383030323031373837000000fc00504c32343933480a202020202001c9020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000182a4480a070382740302035000f282100001a00000000000000000000000000a1";
-          "DP-5" = "00ffffffffffff0026cd4561990000001f1c0104a5351e783ace65a657519f270f5054b30c00714f818081c081009500b300d1c00101023a801871382d40582c45000f282100001e000000fd00374c1e5311000a202020202020000000ff0031313634384238383030313533000000fc00504c32343933480a202020202001d3020318f14b9002030411121305141f012309070183010000023a801871382d40582c45000f282100001e8c0ad08a20e02d10103e96000f2821000018011d007251d01e206e2855000f282100001e8c0ad090204031200c4055000f28210000180000000000000000000000000000000000000000000000000000000000000035";
-        };
-        config = {
-          "DP-4" = {
-            enable = true;
-            primary = true;
-            position = "0x420";
-            mode = "1920x1080";
-          };
-          "DP-5" = {
-            enable = true;
-            primary = false;
-            position = "1920x0";
-            mode = "1920x1080";
-            rotate = "left";
-          };
-        };
-      };
-    };
-  };
-
-  systemd.services.autorandr-lid-listener = {
-    wantedBy = ["multi-user.target"];
-    description = "Listening for lid events to invoke autorandr";
-
-    serviceConfig = {
-      Type = "simple";
-      ExecStart = let
-        stdbufExe = lib.getExe' pkgs.coreutils "stdbuf";
-        libinputExe = lib.getExe' pkgs.libinput "libinput";
-        grepExe = lib.getExe pkgs.gnugrep;
-        autorandrExe = lib.getExe pkgs.autorandr;
-      in
-        pkgs.writeShellScript "lid-listener.sh" ''
-          ${stdbufExe} -oL ${libinputExe} debug-events |
-            ${grepExe} -E --line-buffered '^[[:space:]-]+event[0-9]+[[:space:]]+SWITCH_TOGGLE[[:space:]]' |
-            while read line; do
-              ${pkgs.systemd}/bin/systemctl start --no-block autorandr.service
-            done
-        '';
-      Restart = "always";
-      RestartSec = "30";
-    };
-  };
-
-  # Configure console keymap
-  console.keyMap = "us";
-
-  programs.light.enable = true;
-}

hosts/hephaestus/hardware-configuration.nix

@@ -1,45 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = ["nvme" "ehci_pci" "xhci_pci" "usb_storage" "sd_mod" "sdhci_pci"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = ["kvm-amd"];
-  boot.extraModulePackages = [];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/54ded736-367c-4081-9978-9e2d8f61cb1b";
-    fsType = "btrfs";
-    options = ["subvol=@"];
-  };
-
-  boot.initrd.luks.devices."luks-df96458d-45a1-4a30-8633-58feeff603f8".device = "/dev/disk/by-uuid/df96458d-45a1-4a30-8633-58feeff603f8";
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/826A-23F7";
-    fsType = "vfat";
-  };
-
-  swapDevices = [];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp2s0f0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/hephaestus/home.nix

@@ -1,49 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
-  home-manager.users.alarsyo = {
-    # TODO: can probably upgrade me
-    home.stateVersion = "21.05";
-
-    my.home.laptop.enable = true;
-
-    # Keyboard settings & i3 settings
-    my.home.x.enable = true;
-    my.home.x.i3bar.temperature.chip = "k10temp-pci-*";
-    my.home.x.i3bar.temperature.inputs = ["Tctl"];
-    my.home.x.i3bar.networking.throughput_interfaces = ["wlp3s0" "enp6s0f3u1u1"];
-    my.home.emacs.enable = true;
-
-    my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
-
-    # TODO: place in global home conf
-    services.dunst.enable = true;
-
-    home.packages = builtins.attrValues {
-      inherit
-        (pkgs)
-        # some websites only work there :(
-        
-        chromium
-        darktable
-        # dev
-        
-        rustup
-        gdb
-        valgrind
-        arandr
-        zotero
-        ;
-
-      inherit
-        (pkgs.packages)
-        ansel
-        spot
-        ;
-
-      inherit (pkgs.wineWowPackages) stable;
-    };
-  };
-}

hosts/hephaestus/secrets.nix

@@ -1,23 +0,0 @@
-{
-  config,
-  lib,
-  options,
-  ...
-}: {
-  config.age = {
-    secrets = let
-      toSecret = name: {...} @ attrs:
-        {
-          file = ./../../modules/secrets + "/${name}.age";
-        }
-        // attrs;
-    in
-      lib.mapAttrs toSecret {
-        "restic-backup/hephaestus-credentials" = {};
-        "restic-backup/hephaestus-password" = {};
-
-        "users/alarsyo-hashed-password" = {};
-        "users/root-hashed-password" = {};
-      };
-  };
-}

hosts/talos/default.nix

@@ -16,9 +16,16 @@
     ./secrets.nix
   ];
 
-  hardware.amdgpu.opencl = false;
+  boot.kernelPackages = pkgs.linuxPackages_6_11;
-
+  # Set Wi-Fi regulatory domain. Currently always set to '00' (world), and could
-  boot.kernelPackages = pkgs.linuxPackages_6_6;
+  # lead to bad Wi-Fi performance
+  boot.kernelParams = ["cfg80211.ieee80211_regdom=FR"];
+  boot.extraModulePackages = with config.boot.kernelPackages; [
+    v4l2loopback
+  ];
+  boot.extraModprobeConfig = ''
+    options v4l2loopback devices=1 video_nr=1 card_label="OBS Cam" exclusive_caps=1
+  '';
 
   # Use the systemd-boot EFI boot loader.
   boot.loader.systemd-boot = {
@@ -41,7 +48,10 @@
   networking.domain = "alarsyo.net";
   # Pick only one of the below networking options.
   # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-  networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
+  networking.networkmanager = {
+    enable = true;
+    wifi.powersave = true;
+  };
 
   # Set your time zone.
   time.timeZone = "Europe/Paris";
@@ -51,7 +61,6 @@
   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
 
   programs = {
-    dconf.enable = true;
     light.enable = true;
   };
   services = {
@@ -60,7 +69,10 @@
   };
   virtualisation = {
     docker.enable = true;
-    libvirtd.enable = true;
+    libvirtd.enable = false;
+    virtualbox.host = {
+      enable = false;
+    };
   };
 
   my.services = {
@@ -70,10 +82,54 @@
     };
 
     pipewire.enable = true;
+
+    restic-backup = {
+      enable = true;
+      repo = "b2:talos-backup";
+      passwordFile = config.age.secrets."restic-backup/talos-password".path;
+      environmentFile = config.age.secrets."restic-backup/talos-credentials".path;
+
+      timerConfig = {
+        OnCalendar = "*-*-* 13:00:00"; # laptop only gets used during the day
+      };
+
+      paths = [
+        "/home/alarsyo"
+      ];
+      exclude = [
+        "/home/alarsyo/Downloads"
+
+        # Rust builds using half my storage capacity
+        "/home/alarsyo/**/target"
+        "/home/alarsyo/work/rust/build"
+
+        # don't backup nixpkgs
+        "/home/alarsyo/work/nixpkgs"
+
+        "/home/alarsyo/go"
+
+        # C build crap
+        "*.a"
+        "*.o"
+        "*.so"
+
+        ".direnv"
+
+        # test vms
+        "*.qcow2"
+        "*.vbox"
+        "*.vdi"
+
+        # secrets stay offline
+        "/home/alarsyo/**/secrets"
+
+        # ignore all dotfiles as .config and .cache can become quite big
+        "/home/alarsyo/.*"
+      ];
+    };
   };
 
   my.gui.enable = true;
-  my.displayManager.sddm.enable = lib.mkForce false;
 
   hardware.bluetooth = {
     enable = true;
@@ -96,22 +152,21 @@
     LC_TELEPHONE = "fr_FR.UTF-8";
   };
 
-  # Enable the X11 windowing system.
-  services.xserver.enable = true;
-
   # Enable the KDE Plasma Desktop Environment.
-  services.xserver.displayManager.sddm = {
+  services.desktopManager.plasma6.enable = true;
-    enable = true;
-    wayland.enable = true;
-  };
-  services.xserver.desktopManager.plasma5.enable = true;
   services.power-profiles-daemon.enable = true;
 
-  programs.hyprland.enable = true;
+  environment.systemPackages = [
+    pkgs.unstable.zed-editor
+    pkgs.foot
+  ];
+
+  #programs.hyprland.enable = true;
   programs.sway = {
     enable = true;
     wrapperFeatures.gtk = true;
   };
+
   # Copy the NixOS configuration file and link it from the resulting system
   # (/run/current-system/configuration.nix). This is useful in case you
   # accidentally delete configuration.nix.

hosts/talos/disko-config.nix

@@ -20,7 +20,7 @@
               };
             };
             luks = {
-              size = "100%";
+              size = "600G";
               content = {
                 type = "luks";
                 name = "crypted";
@@ -35,19 +35,24 @@
                   type = "btrfs";
                   extraArgs = ["-f"];
                   subvolumes = {
-                    "/root" = {
+                    "@" = {
                       mountpoint = "/";
                       mountOptions = ["compress=zstd" "noatime"];
                     };
-                    "/home" = {
+                    "@home" = {
                       mountpoint = "/home";
                       mountOptions = ["compress=zstd" "noatime"];
                     };
-                    "/nix" = {
+                    "@nix" = {
                       mountpoint = "/nix";
                       mountOptions = ["compress=zstd" "noatime"];
                     };
-                    "/swap" = {
+                    "@persist" = {
+                      mountpoint = "/persist";
+                      mountOptions = ["compress=zstd" "noatime"];
+                    };
+                    "@snapshots" = {};
+                    "@swap" = {
                       mountpoint = "/.swapvol";
                       swap.swapfile.size = "8G";
                     };

hosts/talos/home.nix

@@ -1,10 +1,16 @@
 {
   config,
+  lib,
   pkgs,
   ...
-}: {
+}: let
+  inherit
+    (lib)
+    mkOptionDefault
+    ;
+in {
   home-manager.users.alarsyo = {
-    home.stateVersion = "24.05";
+    home.stateVersion = "23.11";
 
     my.home.laptop.enable = true;
 
@@ -23,26 +29,101 @@
     home.packages = builtins.attrValues {
       inherit
         (pkgs)
-        # some websites only work there :(
+        ansel
-        
+        chromium # some websites only work there :(
-        chromium
-        darktable
-        # dev
-        
-        rustup
-        gdb
-        valgrind
-        arandr
         zotero
         ;
 
-      #inherit
+      inherit
-      #  (pkgs.packages)
+        (pkgs.packages)
-      #  ansel
+        spot
-      #  spot
+        ;
-      #  ;
+    };
 
-      inherit (pkgs.wineWowPackages) stable;
+    wayland.windowManager.sway = {
+      enable = true;
+      swaynag.enable = true;
+      wrapperFeatures.gtk = true;
+      config = {
+        modifier = "Mod4";
+        input = {
+          "type:keyboard" = {
+            xkb_layout = "fr";
+            xkb_variant = "us";
+          };
+          "type:touchpad" = {
+            dwt = "enabled";
+            tap = "enabled";
+            middle_emulation = "enabled";
+            natural_scroll = "enabled";
+          };
+        };
+        output = {
+          "eDP-1" = {
+            scale = "1.5";
+          };
+        };
+        fonts = {
+          names = ["Iosevka Fixed" "FontAwesome6Free"];
+          size = 9.0;
+        };
+        bars = [
+          {
+            mode = "dock";
+            hiddenState = "hide";
+            position = "top";
+            workspaceButtons = true;
+            workspaceNumbers = true;
+            statusCommand = "${pkgs.i3status}/bin/i3status";
+            fonts = {
+              names = ["Iosevka Fixed" "FontAwesome6Free"];
+              size = 9.0;
+            };
+            trayOutput = "primary";
+            colors = {
+              background = "#000000";
+              statusline = "#ffffff";
+              separator = "#666666";
+              focusedWorkspace = {
+                border = "#4c7899";
+                background = "#285577";
+                text = "#ffffff";
+              };
+              activeWorkspace = {
+                border = "#333333";
+                background = "#5f676a";
+                text = "#ffffff";
+              };
+              inactiveWorkspace = {
+                border = "#333333";
+                background = "#222222";
+                text = "#888888";
+              };
+              urgentWorkspace = {
+                border = "#2f343a";
+                background = "#900000";
+                text = "#ffffff";
+              };
+              bindingMode = {
+                border = "#2f343a";
+                background = "#900000";
+                text = "#ffffff";
+              };
+            };
+          }
+        ];
+
+        keybindings = mkOptionDefault {
+          "Mod4+i" = "exec emacsclient --create-frame";
+        };
+      };
+    };
+    programs = {
+      fuzzel.enable = true;
+      swaylock.enable = true;
+      waybar = {
+        enable = true;
+      };
     };
   };
 }

hosts/talos/secrets.nix

@@ -13,8 +13,8 @@
         // attrs;
     in
       lib.mapAttrs toSecret {
-        #"restic-backup/hephaestus-credentials" = {};
+        "restic-backup/talos-credentials" = {};
-        #"restic-backup/hephaestus-password" = {};
+        "restic-backup/talos-password" = {};
 
         "users/alarsyo-hashed-password" = {};
         "users/root-hashed-password" = {};

hosts/thanatos/default.nix

@@ -35,6 +35,56 @@ in {
   };
 
   services = {
+    gitlab-runner = {
+      enable = true;
+      settings = {
+        concurrent = 4;
+      };
+      services = {
+        nix = {
+          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-nix-runner-env".path;
+          dockerImage = "alpine";
+          dockerVolumes = [
+            "/nix/store:/nix/store:ro"
+            "/nix/var/nix/db:/nix/var/nix/db:ro"
+            "/nix/var/nix/daemon-socket:/nix/var/nix/daemon-socket:ro"
+          ];
+          dockerDisableCache = true;
+          preBuildScript = pkgs.writeScript "setup-container" ''
+            mkdir -p -m 0755 /nix/var/log/nix/drvs
+            mkdir -p -m 0755 /nix/var/nix/gcroots
+            mkdir -p -m 0755 /nix/var/nix/profiles
+            mkdir -p -m 0755 /nix/var/nix/temproots
+            mkdir -p -m 0755 /nix/var/nix/userpool
+            mkdir -p -m 1777 /nix/var/nix/gcroots/per-user
+            mkdir -p -m 1777 /nix/var/nix/profiles/per-user
+            mkdir -p -m 0755 /nix/var/nix/profiles/per-user/root
+            mkdir -p -m 0700 "$HOME/.nix-defexpr"
+
+            . ${pkgs.nix}/etc/profile.d/nix.sh
+
+            ${pkgs.nix}/bin/nix-env -i ${lib.concatStringsSep " " (with pkgs; [nix cacert git openssh])}
+
+            ${pkgs.nix}/bin/nix-channel --add https://nixos.org/channels/nixpkgs-unstable
+            ${pkgs.nix}/bin/nix-channel --update nixpkgs
+
+            mkdir -p ~/.config/nix
+            echo "experimental-features = nix-command flakes" > ~/.config/nix/nix.conf
+          '';
+          environmentVariables = {
+            ENV = "/etc/profile";
+            USER = "root";
+            NIX_REMOTE = "daemon";
+            PATH = "/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin:/bin:/sbin:/usr/bin:/usr/sbin";
+            NIX_SSL_CERT_FILE = "/nix/var/nix/profiles/default/etc/ssl/certs/ca-bundle.crt";
+          };
+        };
+        default = {
+          authenticationTokenConfigFile = config.age.secrets."gitlab-runner/thanatos-runner-env".path;
+          dockerImage = "debian:stable";
+        };
+      };
+    };
     openssh.enable = true;
   };
 

hosts/thanatos/home.nix

@@ -1,7 +1,6 @@
 {config, ...}: {
   home-manager.users.alarsyo = {
-    # TODO: can probably upgrade me
+    home.stateVersion = "23.11";
-    home.stateVersion = "21.05";
 
     my.theme = config.home-manager.users.alarsyo.my.themes.solarizedLight;
   };

hosts/thanatos/secrets.nix

@@ -15,6 +15,8 @@
       lib.mapAttrs toSecret {
         "users/alarsyo-hashed-password" = {};
         "users/root-hashed-password" = {};
+        "gitlab-runner/thanatos-runner-env" = {};
+        "gitlab-runner/thanatos-nix-runner-env" = {};
       };
   };
 }

modules/sddm.nix

@@ -15,23 +15,17 @@ in {
   options.my.displayManager.sddm.enable = mkEnableOption "SDDM setup";
 
   config = mkIf cfg.enable {
-    services.xserver.displayManager.sddm = {
+    services.displayManager.sddm = {
       enable = true;
-      theme = "sugar-candy";
+      theme = "catppuccin-latte";
+      wayland.enable = true;
     };
 
-    environment.systemPackages = builtins.attrValues {
+    environment.systemPackages = [
-      inherit
+      (pkgs.catppuccin-sddm.override
-        (pkgs.packages)
+        {
-        sddm-sugar-candy
+          flavor = "latte";
-        ;
+        })
-
+    ];
-      inherit
-        (pkgs.libsForQt5.qt5)
-        qtgraphicaleffects
-        qtquickcontrols2
-        qtsvg
-        ;
-    };
   };
 }

modules/secrets/gitlab-runner/thanatos-runner-env.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw naNq55qkAm47KXPJpYFDjVQuxPz2Ffpima5z1WEqRSA
+ETC3Hh4gglwYpiJCu/EGOUzjN3BJYk8yJshMeMkgYug
+-> ssh-ed25519 6UUuZw Azk9jDbUL/nO20lvzs0s36q/4ZcWSpkUbt1J/PE7A2M
+kPKHGLoWHDpFhsRr+CBteWKYsDw0dn/+IKbrh/5qMoE
+--- g1akMn28voSQByQR9/ArJ4CsQehcwJ7MfCco+k2fPWo
+› YMZÓíî:ú{R­^
n~ó½±ã¢ÊwPaª§h£8<C2A3>T'hcmªe(<28>‘ÝXx=7”‹‡Ë¢[äË4@b=“&ª®æYÅ;‘€Ü[„ª¹ØÁˆß¿kôk>ˆ5’4‚0ÞGâŒ÷ðÌŸ­±Q<C2B1>Êë·±Ÿw¡

modules/secrets/ovh/credentials.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw XED7gkKAp1ioBegA7ryqULRF1BORpW74esfIGp9zPE8
+ANxnQN+tox9KYdZvNZFZvQxOymckldPQMhFnz6fSIBo
+-> ssh-ed25519 pX8y2g 9wgPqL6GoOxad5AAUmDAYj0h/57AEM8VsQKq1pGTtjM
+SxD++XJioZLpt6C8Xse5Nmz4wtL0Fb5NKWo5ijKpyv8
+--- 3qOJnkY3Uc4fIex9mgz2+w+su5dS7K7Tmtk1hiqkn9M
+ÁXª¨àeéˆaLQH2*ZÅTé¿ ‘®P;Ý(jCÌ€k‡viäµû<C2B5>ÿ’ħ¡à†kæ`™ô]mò<6D>ÿBñ,³±,ü÷?!¶{àŠ%­eÙì(„Su¿-SŸ
D¢¾“=H#‡„¼Þq=ï<>Uùí;=OÍ<÷R¼ÇÎE±“<+&­èdÂæ<18>>G+_oP¥Þ]ÿê¦RÄßL$Ö³\š°ü0ø¤N!þ"Áã&÷%Nž à<ËÃ,òv°1ÿ‘Ê‘Új1

modules/secrets/restic-backup/hephaestus-credentials.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 k2gHjw tTdHZJpSocTHlznYH9eRzeZkrYBbsdT4F8jV1FKw/yk
-xKIkYhL/A8wTy6LqDkTuUvm4rhDI6+DXwjzl43PcR8E
--> ssh-ed25519 SYm+hA vzQCZWYdgG0yxUEyGJ4Q8EAh1Kzw5CutDa6q6XSaels
-Y7VqpvLfrUvWZcXqGeulRld9kff03kgzz22UBW77AOw
--> j-c8-grease
-WeQ
---- KHLA1KlfWM432GDbPIiKInzZeqVRJZ2YCKtF3qClfgs
- ü
8Êâ5œ¢|<7C>ŒòQx_5':Á½È´A?îÎÚ¡ÄÛ 	­ØŠ¾þèoA‘x‰)rýd!Š(´®”èѨ5£¸ìô~ý\†ŽLd"^ÑZ¨Z^®…Vï/‡§5Ë•¶¢¨Ý¦<C39D>a诲áḷo]O/®Eueà†

modules/secrets/restic-backup/hephaestus-password.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 k2gHjw 2/spllcr7Fo+1sQ4VJW/MywBVUcpKEbicv4vZQyre0c
-Vc2Wugxc5M4i73UKMFXWA2PeHgUOm/+HekoeYt9ycro
--> ssh-ed25519 SYm+hA KFjo2JVxpdOey8A7GAKeZci+ezE0RYBRKR8vNtloU3M
-SAzpTjF/RGOgjawT2Sk5H7TNnk/SdbksuAcZZqakJOs
--> !!6BS-grease Gs<Om0
-d7WvJNMg3OX9CwWvGNWCuViu1X+e9oFE5vZQixfaJI3xKax2lTNh
---- QICRX2ve/1CFNHjnVXDpue3DRlFbTftu9yrWw745gVk
-|†`F…3Þ°˜¤VEû²ÊósßK³ÞQwÿÙ$ùÉŒ{‘¨¯†>¹Hˆ7Þh™î”Ä©Û’2ÅïÂÈÆcH^¸“×÷Ÿ© X_ñæzv'¢ÄÐ!Zkš_„þÉ0Ë}Yo•je§¼<icé{SkÁ|1Ÿalé*ü7ÓÖ3ÅŒF«Þ9j¬\§X{¢¾#H7ÑŒ¢!><.^¸¿[ï£q4åpP

modules/secrets/restic-backup/talos-credentials.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 k2gHjw WWJQxqfxQzLmBFPpTzuKBMhAl+ZxnQdvnaDvfpwxR00
+tEsf6xSw/MP/qJnr/SyLlkEEf/LaI7IxjVzaxRwh5FI
+-> ssh-ed25519 nh0dAQ yRu0VZqx+DuB3SSQaVtg+txuRu9OyJDfLDNCKg9XYk0
+xTpucapaejG2EMrZLIDt46JD3QYM4XXT1Y2F77HPQO8
+--- uZjO0dDIFesU2B/GkjpqrOJas1+K6hGbQAdFV/t1GOk
+BV͵
Ç\Õ	8Û‘¾ºý[%<25>½l^>9<>\Eö5¹šþ¿Új(6èÜgå;(I7CS4èv6ièÉÐþSªÐXïC»ï`OòT™ŒÓÚ\ô;I·Ýœò6ƒ<36>_k˜éy-‡±¹½qKl†¾ôKþÓ hŠ?tô

modules/secrets/secrets.nix

@@ -4,16 +4,18 @@ let
 
   boreal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAagal1aqZh52wEmgsw7fkCzO41o4Cx+nV4wJGZuX1RP root@boreal";
   hades = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxw8CtKUPAiPdKDEnuS7UyRrZN5BkUwsy5UPVF8V+lt root@hades";
-  hephaestus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7Cp+n5+huof68QlAoJV8bVf5h5p9kEZFAVpltWopdL root@hephaestus";
   talos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMBYcmL9HZJ9SqB9OJwQ0Nt6ZbvHZTS+fzM8A6D5MPZs root@talos";
   thanatos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID8JEAWk/8iSl8fN6/f76JkmVFwtyixTpLol4zSVsnVw root@thanatos";
 
-  machines = [boreal hades hephaestus talos thanatos];
+  machines = [boreal hades talos thanatos];
 
   all = users ++ machines;
 in {
   "gandi/api-key.age".publicKeys = [alarsyo hades];
 
+  "gitlab-runner/thanatos-runner-env.age".publicKeys = [alarsyo thanatos];
+  "gitlab-runner/thanatos-nix-runner-env.age".publicKeys = [alarsyo thanatos];
+
   "lohr/shared-secret.age".publicKeys = [alarsyo hades];
 
   "matrix-synapse/secret-config.age".publicKeys = [alarsyo hades];
@@ -24,6 +26,8 @@ in {
 
   "nextcloud/admin-pass.age".publicKeys = [alarsyo hades];
 
+  "ovh/credentials.age".publicKeys = [alarsyo hades];
+
   "paperless/admin-password.age".publicKeys = [alarsyo hades];
   "paperless/secret-key.age".publicKeys = [alarsyo hades];
 
@@ -33,8 +37,8 @@ in {
   "restic-backup/boreal-credentials.age".publicKeys = [alarsyo boreal];
   "restic-backup/hades-password.age".publicKeys = [alarsyo hades];
   "restic-backup/hades-credentials.age".publicKeys = [alarsyo hades];
-  "restic-backup/hephaestus-password.age".publicKeys = [alarsyo hephaestus];
+  "restic-backup/talos-password.age".publicKeys = [alarsyo talos];
-  "restic-backup/hephaestus-credentials.age".publicKeys = [alarsyo hephaestus];
+  "restic-backup/talos-credentials.age".publicKeys = [alarsyo talos];
 
   "users/root-hashed-password.age".publicKeys = machines ++ [alarsyo];
   "users/alarsyo-hashed-password.age".publicKeys = machines ++ [alarsyo];

pkgs/ansel/default.nix

@@ -1,155 +0,0 @@
-{
-  cmake,
-  colord,
-  colord-gtk,
-  curl,
-  dav1d,
-  desktop-file-utils,
-  exiftool,
-  exiv2,
-  fetchFromGitHub,
-  glib,
-  gmic,
-  graphicsmagick,
-  gtk3,
-  icu,
-  intltool,
-  isocodes,
-  jasper,
-  json-glib,
-  lcms,
-  lensfun,
-  lib,
-  libXdmcp,
-  libXtst,
-  libaom,
-  libavif,
-  libdatrie,
-  libde265,
-  libepoxy,
-  libffi,
-  libgcrypt,
-  libgpg-error,
-  libheif,
-  libjpeg,
-  libpsl,
-  librsvg,
-  libsecret,
-  libselinux,
-  libsepol,
-  libsoup,
-  libsysprof-capture,
-  libthai,
-  libwebp,
-  libxkbcommon,
-  libxml2,
-  libxslt,
-  llvmPackages,
-  openexr_3,
-  openjpeg,
-  osm-gps-map,
-  pcre,
-  pcre2,
-  perlPackages,
-  pkg-config,
-  pugixml,
-  python3Packages,
-  rav1e,
-  sqlite,
-  stdenv,
-  util-linux,
-  wrapGAppsHook,
-  x265,
-}:
-stdenv.mkDerivation {
-  pname = "ansel";
-  version = "unstable-2024-01-05";
-
-  src = fetchFromGitHub {
-    owner = "aurelienpierreeng";
-    repo = "ansel";
-    rev = "e2c4a0a60cd80f741dd3d3c6ab72be9ac11234fb";
-    hash = "sha256-Kg020MHy9fn1drCk+66f25twqczvD/5evutDODqOjYM=";
-    fetchSubmodules = true;
-  };
-
-  nativeBuildInputs = [
-    cmake
-    desktop-file-utils
-    exiftool
-    intltool
-    libxml2
-    llvmPackages.clang
-    llvmPackages.llvm
-    pkg-config
-    perlPackages.perl
-    python3Packages.jsonschema
-    wrapGAppsHook
-  ];
-
-  buildInputs = [
-    colord
-    colord-gtk
-    curl
-    dav1d
-    exiv2
-    json-glib
-    glib
-    gmic
-    graphicsmagick
-    gtk3
-    icu
-    isocodes
-    jasper
-    lcms
-    lensfun
-    libaom
-    libavif
-    libdatrie
-    libde265
-    libepoxy
-    libffi
-    libgcrypt
-    libgpg-error
-    libheif
-    libjpeg
-    libpsl
-    librsvg
-    libsecret
-    libselinux
-    libsepol
-    libsoup
-    libsysprof-capture
-    libthai
-    libwebp
-    libXdmcp
-    libxkbcommon
-    libxslt
-    libXtst
-    openexr_3
-    openjpeg
-    osm-gps-map
-    pcre
-    pcre2
-    perlPackages.Po4a
-    pugixml
-    rav1e
-    sqlite
-    util-linux
-    x265
-  ];
-
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH ":" "$out/lib/ansel"
-    )
-  '';
-
-  meta = {
-    description = "A darktable fork minus the bloat plus some design vision";
-    homepage = "https://ansel.photos/";
-    license = lib.licenses.gpl3Plus;
-    mainProgram = "ansel";
-    platforms = lib.platforms.linux;
-  };
-}

pkgs/default.nix

@@ -1,5 +1,4 @@
 {pkgs}: {
-  ansel = pkgs.callPackage ./ansel {};
   sddm-sugar-candy = pkgs.callPackage ./sddm-sugar-candy {};
   kaleidoscope-udev-rules = pkgs.callPackage ./kaleidoscope-udev-rules {};
   grafanaDashboards = pkgs.recurseIntoAttrs (pkgs.callPackage ./grafana-dashboards {});

pkgs/spot/default.nix

@@ -3,7 +3,7 @@
   fetchurl,
   python3,
 }: let
-  version = "2.11.6";
+  version = "2.12.1";
 in
   stdenv.mkDerivation {
     inherit version;
@@ -15,6 +15,6 @@ in
 
     src = fetchurl {
       url = "https://www.lrde.epita.fr/dload/spot/spot-${version}.tar.gz";
-      sha256 = "sha256-ppJ5T4nA2zlWulkZvdUxPjcuDeNAAKkCLynhxukcU4o=";
+      sha256 = "sha256-VHfAjU4dBi8WTC5IaoNVaSXQfXDyGA3nBq96qUnG/1w=";
     };
   }

services/default.nix

@@ -3,11 +3,13 @@
     ./vaultwarden.nix
     ./fail2ban.nix
     ./fava.nix
+    ./forgejo
     ./gitea
     ./immich.nix
     ./jellyfin.nix
     ./lohr.nix
     ./matrix.nix
+    ./mealie.nix
     ./media.nix
     ./microbin.nix
     ./miniflux.nix

services/forgejo/default.nix

@@ -0,0 +1,129 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit
+    (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    ;
+
+  cfg = config.my.services.forgejo;
+  my = config.my;
+
+  domain = config.networking.domain;
+  hostname = config.networking.hostName;
+  fqdn = "${hostname}.${domain}";
+
+  forgejoUser = "git";
+in {
+  options.my.services.forgejo = let
+    inherit (lib) types;
+  in {
+    enable = mkEnableOption "Personal Git hosting with Forgejo";
+
+    privatePort = mkOption {
+      type = types.port;
+      default = 8082;
+      example = 8082;
+      description = "Port to serve the app";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # use git as user to have `git clone git@git.domain`
+    users.users.${forgejoUser} = {
+      description = "Forgejo Service";
+      home = config.services.forgejo.stateDir;
+      useDefaultShell = true;
+      group = forgejoUser;
+
+      # the systemd service for the forgejo module seems to hardcode the group as
+      # forgejo, so, uh, just in case?
+      extraGroups = ["forgejo"];
+
+      isSystemUser = true;
+    };
+    users.groups.${forgejoUser} = {};
+
+    services.forgejo = {
+      enable = true;
+      user = forgejoUser;
+      group = config.users.users.${forgejoUser}.group;
+      stateDir = "/var/lib/${forgejoUser}";
+
+      lfs.enable = true;
+
+      settings = {
+        server = {
+          ROOT_URL = "https://git.${domain}/";
+          DOMAIN = "git.${domain}";
+          HTTP_ADDR = "127.0.0.1";
+          HTTP_PORT = cfg.privatePort;
+        };
+        log.LEVEL = "Warn"; # [ "Trace" "Debug" "Info" "Warn" "Error" "Critical" ]
+        repository = {
+          ENABLE_PUSH_CREATE_USER = true;
+          DEFAULT_BRANCH = "main";
+        };
+
+        # NOTE: temporarily remove this for initial setup
+        service.DISABLE_REGISTRATION = true;
+
+        # only send cookies via HTTPS
+        session.COOKIE_SECURE = true;
+
+        DEFAULT.APP_NAME = "Personal Forge";
+      };
+
+      # NixOS module uses `forgejo dump` to backup repositories and the database,
+      # but it produces a single .zip file that's not very restic friendly.
+      # I configure my backup system manually below.
+      dump.enable = false;
+
+      database = {
+        type = "postgres";
+        # user needs to be the same as forgejo user
+        user = forgejoUser;
+        name = forgejoUser;
+      };
+    };
+
+    # FIXME: Borg *could* be backing up files while they're being edited by
+    # forgejo, so it may produce corrupt files in the snapshot if I push stuff
+    # around midnight. I'm not sure how `forgejo dump` handles this either,
+    # though.
+    my.services.restic-backup = {
+      paths = [
+        config.services.forgejo.lfs.contentDir
+        config.services.forgejo.repositoryRoot
+      ];
+    };
+
+    # NOTE: no need to use postgresql.ensureDatabases because the forgejo module
+    # takes care of this automatically
+    services.postgresqlBackup = {
+      databases = [config.services.forgejo.database.name];
+    };
+
+    services.nginx = {
+      virtualHosts = {
+        "git.${domain}" = {
+          forceSSL = true;
+          useACMEHost = fqdn;
+
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
+          };
+        };
+      };
+    };
+
+    security.acme.certs.${fqdn}.extraDomainNames = ["git.${domain}"];
+
+    systemd.services.forgejo.preStart = "${pkgs.coreutils}/bin/ln -sfT ${./templates} ${config.services.forgejo.stateDir}/custom/templates";
+  };
+}

services/forgejo/templates/home.tmpl

@@ -0,0 +1,17 @@
+{{template "base/head" .}}
+<div class="page-content home">
+	<div class="ui stackable middle very relaxed page grid">
+		<div class="sixteen wide center aligned centered column">
+			<div>
+				<img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
+			</div>
+			<div class="hero">
+				<h1 class="ui icon header title">
+					{{AppName}}
+				</h1>
+				<h2>alarsyo's personal projects are hosted here</h2>
+			</div>
+		</div>
+	</div>
+</div>
+{{template "base/footer" .}}

services/immich.nix

@@ -74,7 +74,7 @@ in {
           proxy_connect_timeout 600;
           proxy_read_timeout 600;
           proxy_send_timeout 600;
-          client_max_body_size 100m;
+          client_max_body_size 1000m;
           access_log syslog:server=unix:/dev/log,tag=immich;
         '';
       };

services/mealie.nix

@@ -0,0 +1,122 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit
+    (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    ;
+
+  cfg = config.my.services.mealie;
+  my = config.my;
+
+  domain = config.networking.domain;
+  hostname = config.networking.hostName;
+  fqdn = "${hostname}.${domain}";
+  pkg = pkgs.unstable.mealie;
+  listenAddress = "127.0.0.1";
+in {
+  options.my.services.mealie = let
+    inherit (lib) types;
+  in {
+    enable = mkEnableOption "Mealie";
+    port = mkOption {
+      type = types.port;
+      example = 8080;
+      description = "Internal port for Mealie webapp";
+    };
+    credentialsFile = lib.mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = "/run/secrets/mealie-credentials.env";
+      description = ''
+        File containing credentials used in mealie such as {env}`POSTGRES_PASSWORD`
+        or sensitive LDAP options.
+
+        Expects the format of an `EnvironmentFile=`, as described by {manpage}`systemd.exec(5)`.
+      '';
+    };
+  };
+
+  # FIXME(NixOS 24.11) Copy pasted from nixpkgs master module, because some needed changes weren't in stable yet.
+  config = mkIf cfg.enable (let
+    settings = {
+      ALLOW_SIGNUP = "false";
+      BASE_URL = "https://mealie.${domain}";
+      TZ = config.time.timeZone;
+
+      # Use PostgreSQL
+      DB_ENGINE = "postgres";
+
+      # Settings for Mealie 1.7+
+      POSTGRES_URL_OVERRIDE = "postgresql://mealie:@/mealie?host=/run/postgresql";
+    };
+  in {
+    systemd.services = {
+      mealie = {
+        after = ["network-online.target" "postgresql.service"];
+        requires = ["postgresql.service"];
+        wants = ["network-online.target"];
+        wantedBy = ["multi-user.target"];
+
+        description = "Mealie, a self hosted recipe manager and meal planner";
+
+        environment =
+          {
+            PRODUCTION = "true";
+            API_PORT = toString cfg.port;
+            BASE_URL = "http://localhost:${toString cfg.port}";
+            DATA_DIR = "/var/lib/mealie";
+            CRF_MODEL_PATH = "/var/lib/mealie/model.crfmodel";
+          }
+          // (builtins.mapAttrs (_: val: toString val) settings);
+
+        serviceConfig = {
+          DynamicUser = true;
+          User = "mealie";
+          ExecStartPre = "${pkg}/libexec/init_db";
+          ExecStart = "${lib.getExe pkg} -b ${listenAddress}:${builtins.toString cfg.port}";
+          EnvironmentFile = lib.mkIf (cfg.credentialsFile != null) cfg.credentialsFile;
+          StateDirectory = "mealie";
+          StandardOutput = "journal";
+        };
+      };
+    };
+
+    # Set-up database
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = ["mealie"];
+      ensureUsers = [
+        {
+          name = "mealie";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    services.postgresqlBackup = {
+      databases = ["mealie"];
+    };
+
+    services.nginx.virtualHosts."mealie.${domain}" = {
+      forceSSL = true;
+      useACMEHost = fqdn;
+
+      locations."/" = {
+        proxyPass = "http://${listenAddress}:${toString cfg.port}/";
+        proxyWebsockets = true;
+      };
+    };
+
+    security.acme.certs.${fqdn}.extraDomainNames = ["mealie.${domain}"];
+
+    my.services.restic-backup = {
+      paths = ["/var/lib/mealie"];
+    };
+  });
+}

services/nextcloud.nix

@@ -62,15 +62,11 @@ in {
 
       hostName = "cloud.${domain}";
       https = true;
-      package = pkgs.nextcloud27;
+      package = pkgs.nextcloud29;
 
       maxUploadSize = "1G";
 
       config = {
-        overwriteProtocol = "https";
-
-        defaultPhoneRegion = "FR";
-
         dbtype = "pgsql";
         dbuser = "nextcloud";
         dbname = dbName;
@@ -79,6 +75,11 @@ in {
         adminuser = "admin";
         adminpassFile = cfg.adminpassFile;
       };
+
+      settings = {
+        default_phone_region = "FR";
+        overwriteprotocol = "https";
+      };
     };
 
     users.groups.media.members = ["nextcloud"];

services/nginx.nix

@@ -66,8 +66,8 @@ in {
         gandiKey = config.my.secrets.gandiKey;
       in {
         "${fqdn}" = {
-          dnsProvider = "gandiv5";
+          dnsProvider = "ovh";
-          credentialsFile = config.age.secrets."gandi/api-key".path;
+          credentialsFile = config.age.secrets."ovh/credentials".path;
           group = "nginx";
         };
       };

services/paperless.nix

@@ -50,7 +50,7 @@ in {
       enable = true;
       port = cfg.port;
       passwordFile = cfg.passwordFile;
-      extraConfig = {
+      settings = {
         # Postgres settings
         PAPERLESS_DBHOST = "/run/postgresql";
         PAPERLESS_DBUSER = "paperless";

services/photoprism.nix

@@ -61,7 +61,7 @@ in {
           proxy_connect_timeout 600;
           proxy_read_timeout 600;
           proxy_send_timeout 600;
-          client_max_body_size 100m;
+          client_max_body_size 500m;
           access_log syslog:server=unix:/dev/log,tag=photoprism;
         '';
       };

services/restic-backup.nix

@@ -98,7 +98,7 @@ in {
       environmentFile = cfg.environmentFile;
 
       extraBackupArgs =
-        ["--verbose=2"]
+        ["--verbose=1"]
         ++ optional (builtins.length cfg.exclude != 0) excludeArg;
 
       timerConfig = cfg.timerConfig;

talos.nix

@@ -19,5 +19,5 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.05"; # Did you read the comment?
+  system.stateVersion = "23.11"; # Did you read the comment?
 }

todo.org

@@ -0,0 +1,5 @@
+* TODO Take a look at goldwarden when 24.05 releases
+
+https://github.com/quexten/goldwarden
+
+* TODO Setup sway correctly