An attempt was made

.gitea/workflows/ci.yaml

@@ -6,11 +6,11 @@ on:
 
 jobs:
   check:
-    name: Check, build and cache nixfiles
+    name: Check, build and cache Nix flake
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
-      - uses: cachix/install-nix-action@v27
+      - uses: cachix/install-nix-action@v23
         with:
           # Gitea will supply a token in GITHUB_TOKEN, which this action will
           # try to pass to Nix when downloading from GitHub
@@ -18,30 +18,22 @@ jobs:
           extra_nix_config: |
             # Make sure we're using sandbox
             sandbox-fallback = false
-            # Big C++ projects fill up memory...
-            cores = 6
 
-            extra-substituters = https://nix-cache.nul.ie
+            extra-substituters = https://nix-cache.nul.ie/main
-            extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
+            extra-trusted-public-keys = main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8=
+      - name: Set up attic
+        run: |
+          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
+            login --set-default colony https://nix-cache.nul.ie "${{ secrets.NIX_CACHE_TOKEN }}"
 
       - name: Check flake
-        run: nix flake check --no-build
+        run: nix flake check
-
+      - name: Build the world
-      - name: Build (and cache) the world
         id: build
-        env:
-          HARMONIA_SSH_KEY: ${{ secrets.HARMONIA_SSH_KEY }}
         run: |
-          nix eval --json --apply "builtins.attrNames" .#ci.x86_64-linux | jq -cr '.[]' | while read job; do
+          path=$(nix build --no-link .#ci.x86_64-linux --json | jq -r .[0].outputs.out)
-            echo "::group::Build $job"
+          echo "path=$path" >> "$GITHUB_OUTPUT"
-            nix build --no-link .#ci.x86_64-linux."$job"
+      - name: Push to cache
-            echo "::endgroup::"
+        run: |
-
+          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
-            echo "::group::Cache $job"
+            push main ${{ steps.build.outputs.path }}
-            ci/push-to-cache.sh "$(nix eval --raw .#ci.x86_64-linux."$job")"
-            echo "::endgroup::"
-          done
-
-          echo "Building and caching CI derivation"
-          nix build --no-link .#ciDrv.x86_64-linux
-          UPDATE_PROFILE=1 ci/push-to-cache.sh "$(nix eval --raw .#ciDrv.x86_64-linux)"

.gitea/workflows/installer.yaml

@@ -14,20 +14,22 @@ jobs:
         uses: https://github.com/actions/setup-go@v4
         with:
           go-version: '>=1.20.1'
-      - uses: cachix/install-nix-action@v27
+      - uses: cachix/install-nix-action@v23
         with:
           github_access_token: ${{ secrets.GH_PULL_TOKEN }}
           extra_nix_config: |
             # Make sure we're using sandbox
             sandbox-fallback = false
 
-            extra-substituters = https://nix-cache.nul.ie
+            extra-substituters = https://nix-cache.nul.ie/main
-            extra-trusted-public-keys = nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4=
+            extra-trusted-public-keys = main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8=
-
+      - name: Set up attic
-      - name: Set up vars
         id: setup
         run: |
+          nix run .#nixpkgs.mine.x86_64-linux.attic-client -- \
+            login --set-default colony https://nix-cache.nul.ie "${{ secrets.NIX_CACHE_TOKEN }}"
           echo "short_rev=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
+
       - name: Build installer ISO
         run: |
           nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.iso
@@ -37,13 +39,12 @@ jobs:
         run: |
           nix build .#nixfiles.config.nixos.systems.installer.configuration.config.my.buildAs.netbootArchive
           ln -s "$(readlink result)" \
-            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar.zst
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar
 
       - name: Create release
         uses: https://gitea.com/actions/release-action@main
         with:
           title: Latest installer
-          api_key: '${{ secrets.RELEASE_TOKEN }}'
           files: |
             jackos-installer-${{ steps.setup.outputs.short_rev }}.iso
-            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar.zst
+            jackos-installer-netboot-${{ steps.setup.outputs.short_rev }}.tar

.keys/harmonia.pub

@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKXRXkYnBf2opIjN+bXE7HmhUpa4hyXJUGmBT+MRccT4 harmonia

ci/known_hosts

@@ -1 +0,0 @@
-object-ctr.ams1.int.nul.ie ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdHbZErWLmTPO/aEWB1Fup/aGMf31Un5Wk66FJwTz/8

ci/push-to-cache.sh

@@ -1,31 +0,0 @@
-#!/bin/sh
-set -e
-
-REMOTE_STORE=/var/lib/harmonia
-SSH_HOST="harmonia@object-ctr.ams1.int.nul.ie"
-SSH_KEY=/tmp/harmonia.key
-STORE_URI="ssh-ng://$SSH_HOST?ssh-key=$SSH_KEY&remote-store=$REMOTE_STORE"
-
-remote_cmd() {
-  ssh -i "$SSH_KEY" "$SSH_HOST" env HOME=/run/harmonia NIX_REMOTE="$REMOTE_STORE" "$@"
-}
-
-umask_old=$(umask)
-umask 0066
-echo "$HARMONIA_SSH_KEY" | base64 -d > "$SSH_KEY"
-umask $umask_old
-
-mkdir -p ~/.ssh
-cp ci/known_hosts ~/.ssh/
-path="$1"
-
-echo "Pushing $path to cache..."
-nix copy --no-check-sigs --to "$STORE_URI" "$path"
-
-if [ -n "$UPDATE_PROFILE" ]; then
-  echo "Updating profile..."
-  remote_cmd nix-env -p "$REMOTE_STORE"/nix/var/nix/profiles/nixfiles --set "$path"
-
-  echo "Collecting garbage..."
-  remote_cmd nix-collect-garbage --delete-older-than 60d
-fi

devshell/commands.nix

@@ -20,7 +20,7 @@ in
           [ -e "${homeFlake}" ] && echo "${homeFlake} already exists" && exit 1
 
           mkdir -p "$(dirname "${homeFlake}")"
-          ln -sf "$(pwd)/flake.nix" "${homeFlake}"
+          ln -s "$(pwd)/flake.nix" "${homeFlake}"
           echo "Installed link to $(pwd)/flake.nix at ${homeFlake}"
         '';
     }
@@ -52,7 +52,7 @@ in
       name = "json2nix";
       category = "utilities";
       help = "Convert JSON to formatted Nix";
-      command = "nix eval --impure --expr 'builtins.fromJSON (builtins.readFile /dev/stdin)' | ${pkgs.nixfmt-rfc-style}/bin/nixfmt";
+      command = "nix eval --impure --expr 'builtins.fromJSON (builtins.readFile /dev/stdin)' | ${pkgs.nixfmt}/bin/nixfmt";
     }
 
     {
@@ -77,12 +77,7 @@ in
       name = "build-n-switch";
       category = "tasks";
       help = "Shortcut to nixos-rebuild for this flake";
-      command = ''
+      command = ''doas nixos-rebuild --flake . "$@"'';
-        # HACK: Upstream changes in Git + Nix makes this necessary
-        # https://github.com/NixOS/nix/issues/10202
-        doas git config --global --add safe.directory "$PWD"
-        doas nixos-rebuild --flake . "$@"
-      '';
     }
     {
       name = "run-vm";
@@ -111,8 +106,8 @@ in
     {
       name = "build-netboot";
       category = "tasks";
-      help = "Build NixOS configuration as netboot tree";
+      help = "Build NixOS configuration as netboot archive";
-      command = ''nix build "''${@:2}" ".#nixfiles.config.nixos.systems.\"$1\".configuration.config.my.buildAs.netbootTree"'';
+      command = ''nix build "''${@:2}" ".#nixfiles.config.nixos.systems.\"$1\".configuration.config.my.buildAs.netbootArchive"'';
     }
     {
       name = "build-home";
@@ -120,17 +115,29 @@ in
       help = "Build home-manager configuration";
       command = ''nix build "''${@:2}" ".#homeConfigurations.\"$1\".activationPackage"'';
     }
+    {
+      name = "update-inputs";
+      category = "tasks";
+      help = "Update flake inputs";
+      command = ''
+        args=()
+        for f in "$@"; do
+          args+=(--update-input "$f")
+        done
+        nix flake lock "''${args[@]}"
+      '';
+    }
     {
       name = "update-nixpkgs";
       category = "tasks";
       help = "Update nixpkgs flake inputs";
-      command = ''nix flake update nixpkgs-{unstable,stable,mine,mine-stable}'';
+      command = ''update-inputs nixpkgs-{unstable,stable,mine,mine-stable}'';
     }
     {
       name = "update-home-manager";
       category = "tasks";
       help = "Update home-manager flake inputs";
-      command = ''nix flake update home-manager-{unstable,stable}'';
+      command = ''update-inputs home-manager-{unstable,stable}'';
     }
     {
       name = "update-installer";
@@ -138,15 +145,5 @@ in
       help = "Update installer tag (to trigger new release)";
       command = ''git tag -f installer && git push -f origin installer'';
     }
-    {
-      name = "deploy-multi";
-      category = "tasks";
-      help = "Deploy multiple flakes at once";
-      command = ''
-        for f in $@; do
-          deploy "$O" $f
-        done
-      '';
-    }
   ];
 }

devshell/default.nix

@@ -11,7 +11,7 @@ in
 
     NIX_USER_CONF_FILES = toString (pkgs.writeText "nix.conf"
       ''
-        experimental-features = nix-command flakes ca-derivations
+        experimental-features = nix-command flakes ca-derivations repl-flake
         connect-timeout = 5
         fallback = true
         ${lib.my.c.nix.cache.conf}
@@ -24,10 +24,10 @@ in
     coreutils
     nixVersions.stable
     rage
-    wireguard-tools
     (pkgs.writeShellScriptBin "deploy" ''
       exec ${deploy-rs.deploy-rs}/bin/deploy --skip-checks "$@"
     '')
     home-manager
+    attic-client
   ];
 }

flake.nix

@@ -7,25 +7,24 @@
     devshell.inputs.nixpkgs.follows = "nixpkgs-unstable";
 
     nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "nixpkgs/nixos-24.11";
+    nixpkgs-stable.url = "nixpkgs/nixos-23.11";
     nixpkgs-mine.url = "github:devplayer0/nixpkgs/devplayer0";
     nixpkgs-mine-stable.url = "github:devplayer0/nixpkgs/devplayer0-stable";
 
     home-manager-unstable.url = "home-manager";
     home-manager-unstable.inputs.nixpkgs.follows = "nixpkgs-unstable";
-    home-manager-stable.url = "home-manager/release-24.11";
+    home-manager-stable.url = "home-manager/release-23.11";
     home-manager-stable.inputs.nixpkgs.follows = "nixpkgs-stable";
 
     # Stuff used by the flake for build / deployment
-    # ragenix.url = "github:yaxitech/ragenix";
+    ragenix.url = "github:yaxitech/ragenix";
-    ragenix.url = "github:devplayer0/ragenix/add-rekey-one-flag";
     ragenix.inputs.nixpkgs.follows = "nixpkgs-unstable";
     deploy-rs.url = "github:serokell/deploy-rs";
     deploy-rs.inputs.nixpkgs.follows = "nixpkgs-unstable";
 
     # Stuff used by systems
     impermanence.url = "github:nix-community/impermanence";
-    boardie.url = "git+https://git.nul.ie/dev/boardie";
+    boardie.url = "github:devplayer0/boardie";
     boardie.inputs.nixpkgs.follows = "nixpkgs-unstable";
     nixGL.url = "github:nix-community/nixGL";
     nixGL.inputs.nixpkgs.follows = "nixpkgs-unstable";
@@ -35,6 +34,9 @@
     sharry.inputs.nixpkgs.follows = "nixpkgs-unstable";
     borgthin.url = "github:devplayer0/borg";
     borgthin.inputs.nixpkgs.follows = "nixpkgs-mine";
+    attic.url = "github:zhaofengli/attic";
+    attic.inputs.nixpkgs.follows = "nixpkgs-unstable";
+    attic.inputs.nixpkgs-stable.follows = "nixpkgs-stable";
   };
 
   outputs =
@@ -49,7 +51,7 @@
       ...
     }:
     let
-      inherit (builtins) mapAttrs replaceStrings elem;
+      inherit (builtins) mapAttrs replaceStrings;
       inherit (lib) mapAttrs' filterAttrs nameValuePair recurseIntoAttrs evalModules;
       inherit (lib.flake) flattenTree eachDefaultSystem;
       inherit (lib.my) mkDefaultSystemsPkgs flakePackageOverlay;
@@ -93,6 +95,7 @@
             inputs.ragenix.overlays.default
             inputs.deploy-rs.overlay
             (flakePackageOverlay inputs.home-manager-unstable system)
+            inputs.attic.overlays.default
           ];
         }))
         pkgsFlakes;
@@ -104,16 +107,6 @@
             pkgsLibOverlay
             myPkgsOverlay
           ];
-
-          config = {
-            # RMS forgive me...
-            # Normally this is set modularly, but sometimes we need to use other pkgs
-            allowUnfreePredicate = p: elem (lib.getName p) [
-              "widevine-cdm"
-              "chromium-unwrapped"
-              "chromium"
-            ];
-          };
         }))
         pkgsFlakes;
 
@@ -122,11 +115,10 @@
         nixos/installer.nix
         nixos/boxes/colony
         nixos/boxes/tower
+        nixos/boxes/castle
         nixos/boxes/home/stream.nix
         nixos/boxes/home/palace
-        nixos/boxes/home/castle
         nixos/boxes/britway
-        nixos/boxes/britnet.nix
         nixos/boxes/kelder
 
         # Homes
@@ -205,9 +197,8 @@
         systems' = mapAttrs' (n: v: nameValuePair "system-${n}" v) systems;
         packages' = mapAttrs' (n: v: nameValuePair "package-${n}" v) packages;
       in
-        homes' // systems' // packages' // {
+        pkgs.linkFarm "ci" (homes' // systems' // packages' // {
           inherit shell;
-        };
+        });
-      ciDrv = pkgs.linkFarm "ci" ci;
     }));
 }

home-manager/modules/common.nix

@@ -199,20 +199,17 @@ in
           file
           tree
           pwgen
-
-          minicom
           iperf3
           mosh
           wget
+          hyx
           whois
           ldns
+          minicom
           mtr
-
-          hyx
           ncdu
           jq
           yq-go
-          nix-tree
         ];
 
         sessionVariables = {

home-manager/modules/gui/alacritty-xterm.toml

@@ -1,28 +0,0 @@
-# XTerm's default colors
-
-# Default colors
-[colors.primary]
-background = '#000000'
-foreground = '#ffffff'
-
-# Normal colors
-[colors.normal]
-black   = '#000000'
-red     = '#cd0000'
-green   = '#00cd00'
-yellow  = '#cdcd00'
-blue    = '#0000ee'
-magenta = '#cd00cd'
-cyan    = '#00cdcd'
-white   = '#e5e5e5'
-
-# Bright colors
-[colors.bright]
-black   = '#7f7f7f'
-red     = '#ff0000'
-green   = '#00ff00'
-yellow  = '#ffff00'
-blue    = '#5c5cff'
-magenta = '#ff00ff'
-cyan    = '#00ffff'
-white   = '#ffffff'

home-manager/modules/gui/default.nix

@@ -1,8 +1,7 @@
-{ lib, pkgs', pkgs, config, ... }:
+{ lib, pkgs, config, ... }:
 let
-  inherit (lib) genAttrs mkIf mkMerge mkForce mapAttrs mkOptionDefault;
+  inherit (lib) genAttrs mkIf mkMerge mkForce;
-  inherit (lib.my) mkOpt' mkBoolOpt';
+  inherit (lib.my) mkBoolOpt';
-  inherit (lib.my.c) pubDomain;
 
   cfg = config.my.gui;
 
@@ -11,79 +10,33 @@ let
     name = "Monocraft";
     size = 10;
   };
-
-  doomWad = pkgs.fetchurl {
-    url = "https://distro.ibiblio.org/slitaz/sources/packages/d/doom1.wad";
-    hash = "sha256-HX1DvlAeZ9kn5BXguPPinDvzMHXoWXIYFvZSpSbKx3E=";
-  };
-  subwaySurfers = pkgs.fetchurl {
-    url = "https://p.${pubDomain}/video/subway-surfers-smol.mkv";
-    hash = "sha256-fMe7TDRNTymRHIJOi7qG3trzu4GP8a3gCDz+FMkX1dY=";
-  };
-  minecraftParkour = pkgs.fetchurl {
-    url = "https://p.${pubDomain}/video/minecraft-parkour-smol.mkv";
-    hash = "sha256-723pRm4AsIjY/WFUyAHzTJp+JvH4Pn5hvzF9wHTnOPA=";
-  };
-
-  genLipsum = pkgs.writeScript "lipsum" ''
-    #!${pkgs.python3.withPackages (ps: [ ps.python-lorem ])}/bin/python
-    import lorem
-    print(lorem.get_paragraph(count=5, sep='\n\n'))
-  '';
-  doomsaver' = brainrotTextCommand: pkgs.runCommand "doomsaver" {
-    inherit (pkgs) windowtolayer tmux terminaltexteffects;
-    chocoDoom = pkgs.chocolate-doom2xx;
-    ffmpeg = pkgs.ffmpeg-full;
-    python = pkgs.python3.withPackages (ps: [ ps.filelock ]);
-
-    inherit doomWad;
-    enojy = ./enojy.jpg;
-    inherit brainrotTextCommand subwaySurfers minecraftParkour;
-  } ''
-    mkdir -p "$out"/bin
-    substituteAll ${./screensaver.py} "$out"/bin/doomsaver
-    chmod +x "$out"/bin/doomsaver
-  '';
-  doomsaver = doomsaver' cfg.screensaver.brainrotTextCommand;
 in
 {
-  options.my.gui = with lib.types; {
+  options.my.gui = {
     enable = mkBoolOpt' true "Enable settings and packages meant for graphical systems";
     manageGraphical = mkBoolOpt' false "Configure the graphical session";
     standalone = mkBoolOpt' false "Enable settings for fully Nix managed systems";
-    screensaver.brainrotTextCommand = mkOpt' (either path str) genLipsum "Command to generate brainrot text.";
   };
 
   config = mkIf cfg.enable (mkMerge [
       {
         home = {
           packages = with pkgs; [
-            xdg-utils
-
             font.package
-            nerd-fonts.sauce-code-pro
+            (nerdfonts.override {
-            nerd-fonts.droid-sans-mono
+              fonts = [ "DroidSansMono" "SourceCodePro" ];
+            })
             noto-fonts-emoji
 
             grim
             slurp
             swappy
 
-            python3Packages.python-lsp-server
+            python310Packages.python-lsp-server
             nil # nix language server
             zls # zig language server
             rust-analyzer
-
-            cowsay
-            fortune
-            jp2a
-            terminaltexteffects
-            screenfetch
             neofetch
-            cmatrix
-            doomsaver
-
-            xournalpp
           ];
         };
 
@@ -98,15 +51,7 @@ in
           alacritty = {
             enable = true;
             settings = {
-              general.import = [ ./alacritty-xterm.toml ];
+              font.normal.family = font.name;
-
-              font = {
-                size = font.size;
-                normal = {
-                  family = font.name;
-                  style = "Regular";
-                };
-              };
             };
           };
 
@@ -114,29 +59,9 @@ in
             enable = true;
             inherit font;
             settings = {
-              background_opacity = "0.65";
+              background_opacity = "0.8";
               tab_bar_edge = "top";
               shell_integration = "no-sudo";
-              font_features = "${font.name} -liga";
-            };
-          };
-
-          termite = {
-            enable = true;
-            font = "${font.name} ${toString font.size}";
-            backgroundColor = "rgba(0, 0, 0, 0.8)";
-          };
-
-          foot = {
-            enable = true;
-            settings = {
-              main = {
-                font = "${font.name}:size=${toString font.size}";
-              };
-              colors = {
-                alpha = 0.8;
-                background = "000000";
-              };
             };
           };
 
@@ -183,19 +108,6 @@ in
               };
               Install.RequiredBy = [ "sway-session.target" ];
             };
-
-            activate-linux = {
-              Unit = {
-                Description = "Linux activation watermark";
-                After = "graphical-session.target";
-                PartOf = "graphical-session.target";
-              };
-              Service = {
-                Type = "simple";
-                ExecStart = "${pkgs.activate-linux}/bin/activate-linux";
-              };
-              Install.RequiredBy = [ "graphical-session.target" ];
-            };
           };
         };
 
@@ -205,7 +117,6 @@ in
             wl-clipboard
             wev
             wdisplays
-            swaysome
 
             pavucontrol
             libsecret
@@ -215,11 +126,10 @@ in
           ];
 
           pointerCursor = {
-            package = pkgs.posy-cursors;
+            package = pkgs.vanilla-dmz;
-            name = "Posy_Cursor";
+            name = "Vanilla-DMZ";
-            size = 32;
+            size = 16;
             gtk.enable = true;
-            x11.enable = true;
           };
         };
 
@@ -228,36 +138,9 @@ in
         xsession.preferStatusNotifierItems = true;
         wayland = {
           windowManager = {
-            sway =
+            sway = {
-            let
-              cfg = config.wayland.windowManager.sway.config;
-              mod = cfg.modifier;
-
-              renameWs = pkgs.writeShellScript "sway-rename-ws" ''
-                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
-                focused_num="$(jq -r ".num" <<< "$focused_ws")"
-                focused_name="$(jq -r ".name" <<< "$focused_ws")"
-                placeholder="$(sed -E 's/[0-9]+: //' <<< "$focused_name")"
-
-                name="$(rofi -dmenu -p "rename ws $focused_num" -theme+entry+placeholder "\"$placeholder\"")"
-                if [ -n "$name" ]; then
-                  swaymsg rename workspace "$focused_name" to "$focused_num: $name"
-                fi
-              '';
-              clearWsName = pkgs.writeShellScript "sway-clear-ws-name" ''
-                focused_ws="$(swaymsg -t get_workspaces | jq ".[] | select(.focused)")"
-                focused_num="$(jq -r ".num" <<< "$focused_ws")"
-                focused_name="$(jq -r ".name" <<< "$focused_ws")"
-
-                swaymsg rename workspace "$focused_name" to "$focused_num"
-              '';
-            in
-            {
               enable = true;
               xwayland = true;
-              extraConfigEarly = ''
-                set $mod ${mod}
-              '';
               config = {
                 input = {
                   "type:touchpad" = {
@@ -272,95 +155,31 @@ in
 
                 modifier = "Mod4";
                 terminal = "kitty";
-                keybindings = mapAttrs (k: mkOptionDefault) {
+                keybindings =
-                  "${mod}+Left" = "focus left";
+                  let
-                  "${mod}+Down" = "focus down";
+                    cfg = config.wayland.windowManager.sway.config;
-                  "${mod}+Up" = "focus up";
+                    mod = cfg.modifier;
-                  "${mod}+Right" = "focus right";
+                  in
+                  lib.mkOptionDefault {
+                    "${mod}+d" = null;
+                    "${mod}+l" = "exec swaylock -i ${./lock.png} -s stretch";
+                    "${mod}+x" = "exec ${cfg.menu}";
+                    "${mod}+Shift+x" = "exec rofi -show drun";
+                    "${mod}+q" = "kill";
+                    "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
+                    "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
+                    "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
+                    "${mod}+Shift+e" = "exec rofi -show emoji";
+                    # Config for this doesn't seem to work :/
+                    "${mod}+c" = ''exec rofi -show calc -calc-command "echo -n '{result}' | ${pkgs.wl-clipboard}/bin/wl-copy"'';
 
-                  "${mod}+Shift+Left" = "move left";
+                    "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
-                  "${mod}+Shift+Down" = "move down";
+                    "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
-                  "${mod}+Shift+Up" = "move up";
+                    "XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play";
-                  "${mod}+Shift+Right" = "move right";
+                    "XF86AudioPause" = "exec ${pkgs.playerctl}/bin/playerctl pause";
-
+                    "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
-                  "${mod}+b" = "splith";
+                    "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
-                  "${mod}+v" = "splitv";
+                  };
-                  "${mod}+f" = "fullscreen toggle";
-                  "${mod}+a" = "focus parent";
-
-                  "${mod}+s" = "layout stacking";
-                  "${mod}+w" = "layout tabbed";
-                  "${mod}+e" = "layout toggle split";
-
-                  "${mod}+Shift+space" = "floating toggle";
-                  "${mod}+space" = "focus mode_toggle";
-
-                  "${mod}+1" = "workspace number 1";
-                  "${mod}+2" = "workspace number 2";
-                  "${mod}+3" = "workspace number 3";
-                  "${mod}+4" = "workspace number 4";
-                  "${mod}+5" = "workspace number 5";
-                  "${mod}+6" = "workspace number 6";
-                  "${mod}+7" = "workspace number 7";
-                  "${mod}+8" = "workspace number 8";
-                  "${mod}+9" = "workspace number 9";
-                  "${mod}+0" = "workspace number 10";
-
-                  "${mod}+Shift+1" =
-                    "move container to workspace number 1";
-                  "${mod}+Shift+2" =
-                    "move container to workspace number 2";
-                  "${mod}+Shift+3" =
-                    "move container to workspace number 3";
-                  "${mod}+Shift+4" =
-                    "move container to workspace number 4";
-                  "${mod}+Shift+5" =
-                    "move container to workspace number 5";
-                  "${mod}+Shift+6" =
-                    "move container to workspace number 6";
-                  "${mod}+Shift+7" =
-                    "move container to workspace number 7";
-                  "${mod}+Shift+8" =
-                    "move container to workspace number 8";
-                  "${mod}+Shift+9" =
-                    "move container to workspace number 9";
-                  "${mod}+Shift+0" =
-                    "move container to workspace number 10";
-
-                  "${mod}+Shift+minus" = "move scratchpad";
-                  "${mod}+minus" = "scratchpad show";
-
-                  "${mod}+Return" = "exec ${cfg.terminal}";
-                  "${mod}+r" = "mode resize";
-                  "${mod}+d" = null;
-                  "${mod}+l" = "exec ${doomsaver}/bin/doomsaver";
-                  "${mod}+q" = "kill";
-                  "${mod}+Shift+c" = "reload";
-                  "${mod}+Shift+q" = "exec swaynag -t warning -m 'bruh you really wanna kill sway?' -b 'ye' 'systemctl --user stop graphical-session.target && swaymsg exit'";
-
-                  # rofi
-                  "${mod}+x" = "exec ${cfg.menu}";
-                  "${mod}+Shift+x" = "exec rofi -show drun";
-                  "${mod}+Shift+e" = "exec rofi -show emoji";
-                  # Config for this doesn't seem to work :/
-                  "${mod}+c" = ''exec rofi -show calc -calc-command "echo -n '{result}' | ${pkgs.wl-clipboard}/bin/wl-copy"'';
-                  "${mod}+Shift+r" = "exec ${renameWs}";
-                  "${mod}+Shift+n" = "exec ${clearWsName}";
-
-                  # Screenshots
-                  "${mod}+Shift+d" = ''exec grim - | swappy -f -'';
-                  "${mod}+Shift+s" = ''exec grim -g "$(slurp)" - | swappy -f -'';
-
-                  "XF86MonBrightnessDown" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set 5%-";
-                  "XF86MonBrightnessUp" = "exec ${pkgs.brightnessctl}/bin/brightnessctl set +5%";
-
-                  "XF86AudioRaiseVolume" = "exec ${pkgs.pamixer}/bin/pamixer -i 5";
-                  "XF86AudioLowerVolume" = "exec ${pkgs.pamixer}/bin/pamixer -d 5";
-                  "XF86AudioPlay" = "exec ${pkgs.playerctl}/bin/playerctl play";
-                  "XF86AudioPause" = "exec ${pkgs.playerctl}/bin/playerctl pause";
-                  "XF86AudioNext" = "exec ${pkgs.playerctl}/bin/playerctl next";
-                  "XF86AudioPrev" = "exec ${pkgs.playerctl}/bin/playerctl previous";
-                };
                 keycodebindings = {
                   # keycode for XF86AudioPlayPause (no sym for some reason)
                   "172" = "exec ${pkgs.playerctl}/bin/playerctl play-pause";
@@ -369,9 +188,6 @@ in
                 menu = "rofi -show run";
                 bars = mkForce [ ];
               };
-              extraConfig = ''
-                include ${./swaysome.conf}
-              '';
 
               swaynag = {
                 enable = true;
@@ -394,10 +210,17 @@ in
         };
         qt = {
           enable = true;
-          platformTheme.name = "gtk";
+          platformTheme = "gtk";
         };
 
         services = {
+          swaync = {
+            enable = true;
+            settings = {
+              widgets = [ "title" "dnd" "mpris" "notifications" ];
+            };
+          };
+
           playerctld.enable = true;
           spotifyd = {
             enable = false;
@@ -422,7 +245,6 @@ in
             diff-so-fancy.enable = true;
             userEmail = "jackos1998@gmail.com";
             userName = "Jack O'Sullivan";
-            lfs.enable = true;
             extraConfig = {
               pull.rebase = true;
             };
@@ -430,13 +252,11 @@ in
 
           waybar = import ./waybar.nix { inherit lib pkgs config font; };
           rofi = {
-            package = pkgs.rofi-wayland;
             enable = true;
             font = "${font.name} ${toString font.size}";
-            plugins = with pkgs; (map (p: p.override { rofi-unwrapped = rofi-wayland-unwrapped; }) [
+            plugins = with pkgs; [
               rofi-calc
-            ]) ++ [
+              rofi-emoji
-              rofi-emoji-wayland
             ];
             extraConfig = {
               modes = "window,run,ssh,filebrowser,calc,emoji";
@@ -451,7 +271,7 @@ in
 
           chromium = {
             enable = true;
-            package = (pkgs'.unstable.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
+            package = (pkgs.chromium.override { enableWideVine = true; }).overrideAttrs (old: {
               buildCommand = ''
                 ${old.buildCommand}
 
@@ -477,15 +297,6 @@ in
             ] (_: "chromium-browser.desktop");
           };
         };
-
-        my = {
-          swaync = {
-            enable = true;
-            settings = {
-              widgets = [ "title" "dnd" "mpris" "notifications" ];
-            };
-          };
-        };
       })
 
       (mkIf (cfg.standalone && !pkgs.stdenv.isDarwin) {

home-manager/modules/gui/screensaver.py

@@ -1,257 +0,0 @@
-#!@python@/bin/python
-import argparse
-import json
-import os
-import random
-import signal
-import subprocess
-import sys
-
-import filelock
-
-class Screensaver:
-    def __init__(self, cmd, env=None, weight=1):
-        self.cmd = cmd
-        self.weight = weight
-
-        if env is not None:
-            self.env = os.environ.copy()
-            for k, v in env.items():
-                self.env[k] = v
-        else:
-            self.env = None
-        self.proc = None
-
-    def start(self):
-        assert self.proc is None
-        self.proc = subprocess.Popen(self.cmd, env=self.env)
-
-    def wait(self):
-        assert self.proc is not None
-        self.proc.wait()
-
-    def stop(self, kill=False):
-        assert self.proc is not None
-        if kill:
-            self.proc.kill()
-        else:
-            self.proc.terminate()
-
-class DoomSaver(Screensaver):
-    wad = '@doomWad@'
-
-    def __init__(self, demo_index, weight=1.5):
-        super().__init__(
-            ['@chocoDoom@/bin/chocolate-doom',
-             '-iwad', self.wad,
-             '-demoloopi', str(demo_index)],
-            env={
-                'SDL_AUDIODRIVER': 'null',
-                'SDL_VIDEODRIVER': 'caca',
-                'CACA_DRIVER': 'ncurses',
-            },
-            weight=weight,
-        )
-
-    def stop(self):
-        super().stop(kill=True)
-
-class TTESaver(Screensaver):
-    effects = (
-        'beams,binarypath,blackhole,bouncyballs,bubbles,burn,colorshift,crumble,'
-        'decrypt,errorcorrect,expand,fireworks,middleout,orbittingvolley,overflow,'
-        'pour,print,rain,randomsequence,rings,scattered,slice,slide,spotlights,'
-        'spray,swarm,synthgrid,unstable,vhstape,waves,wipe'
-    ).split(',')
-
-    def __init__(self, cmd, env=None, weight=1):
-        super().__init__(cmd, env=env, weight=weight)
-        self.running = False
-
-    def start(self):
-        self.running = True
-
-    def wait(self):
-        while self.running:
-            effect_cmd = ['@terminaltexteffects@/bin/tte', random.choice(self.effects)]
-            print(f"$ {self.cmd} | {' '.join(effect_cmd)}")
-            content = subprocess.check_output(self.cmd, shell=True, env=self.env, stderr=subprocess.DEVNULL)
-
-            self.proc = subprocess.Popen(effect_cmd, stdin=subprocess.PIPE)
-            self.proc.stdin.write(content)
-            self.proc.stdin.close()
-            self.proc.wait()
-
-    def stop(self):
-        self.running = False
-        self.proc.terminate()
-
-class FFmpegCACASaver(Screensaver):
-    @staticmethod
-    def command(video, size):
-        return ['@ffmpeg@/bin/ffmpeg', '-hide_banner', '-loglevel', 'error',
-                '-stream_loop', '-1', '-i', video,
-                '-pix_fmt', 'rgb24', '-window_size', f'{size}x{size}',
-                '-f', 'caca', '-']
-
-    def __init__(self, video, weight=2):
-        cols, lines = os.get_terminal_size()
-        # IDK if it's reasonable to do this as "1:1"
-        size = lines - 4
-        super().__init__(
-            self.command(video, size),
-            env={'CACA_DRIVER': 'ncurses'},
-            weight=weight,
-        )
-
-    def stop(self):
-        super().stop(kill=True)
-
-class BrainrotStorySaver(Screensaver):
-    def __init__(self, video, text_command, weight=2):
-        cols, lines = os.get_terminal_size()
-        video_size = lines - 1
-        video_command = ' '.join(FFmpegCACASaver.command(video, video_size))
-        text_command = (
-            f'while true; do {text_command} | '
-            f'@terminaltexteffects@/bin/tte --wrap-text --canvas-width=80 --canvas-height={video_size//2} --anchor-canvas=c '
-            'print --final-gradient-stops=ffffff; clear; done' )
-        self.tmux_session = f'screensaver-{os.urandom(4).hex()}'
-        super().__init__(
-            ['@tmux@/bin/tmux', 'new-session', '-s', self.tmux_session, '-n', 'brainrot',
-             text_command, ';', 'split-window', '-hbl', str(lines), video_command],
-            # ['sh', '-c', text_command],
-            env={
-                'CACA_DRIVER': 'ncurses',
-                'SHELL': '/bin/sh',
-            },
-            weight=weight,
-        )
-
-    def stop(self):
-        subprocess.check_call(['@tmux@/bin/tmux', 'kill-session', '-t', self.tmux_session])
-
-class MultiSaver:
-    savers = [
-        DoomSaver(0),
-        DoomSaver(1),
-        DoomSaver(2),
-
-        Screensaver(['cmatrix']),
-
-        TTESaver('screenfetch -N'),
-        TTESaver('fortune | cowsay'),
-        TTESaver('top -bn1 | head -n50'),
-        TTESaver('ss -nltu'),
-        TTESaver('ss -ntu'),
-        TTESaver('jp2a --width=100 @enojy@'),
-
-        BrainrotStorySaver('@subwaySurfers@', '@brainrotTextCommand@'),
-        BrainrotStorySaver('@minecraftParkour@', '@brainrotTextCommand@'),
-    ]
-    state_filename = 'screensaver.json'
-
-    def __init__(self, select=None):
-        self.state_path = os.path.join(f'/run/user/{os.geteuid()}', self.state_filename)
-        self.lock = filelock.FileLock(f'{self.state_path}.lock')
-
-        if select is not None:
-            assert select >= 0 and select < len(self.savers), 'Invalid screensaver index'
-            self.selected = self.savers[select]
-        else:
-            self.selected = None
-        self.cleaned_up = False
-
-    def select(self):
-        with self.lock:
-            if not os.path.exists(self.state_path):
-                state = {'instances': []}
-            else:
-                with open(self.state_path) as f:
-                    state = json.load(f)
-
-            if self.selected is None:
-                available = set(range(len(self.savers)))
-                new_instances = []
-                for instance in state['instances']:
-                    if not os.path.exists(f"/proc/{instance['pid']}"):
-                        continue
-
-                    new_instances.append(instance)
-                    i = instance['saver']
-                    assert i in available
-                    available.remove(i)
-                assert available, 'No screensavers left'
-                available = list(available)
-
-                weights = []
-                for i in available:
-                    weights.append(self.savers[i].weight)
-                selected_i = random.choices(available, weights=weights)[0]
-
-                new_instances.append({'pid': os.getpid(), 'saver': selected_i})
-                state['instances'] = new_instances
-
-                # print(f'Selected saver {selected_i}')
-                self.selected = self.savers[selected_i]
-
-            with open(self.state_path, 'w') as f:
-                json.dump(state, f)
-
-    def cleanup(self):
-        if self.cleaned_up:
-            return
-        self.cleaned_up = True
-
-        with self.lock:
-            with open(self.state_path) as f:
-                state = json.load(f)
-
-            for i, instance in enumerate(state['instances']):
-                if instance['pid'] == os.getpid():
-                    del state['instances'][i]
-
-            with open(self.state_path, 'w') as f:
-                json.dump(state, f)
-
-    def run(self):
-        assert self.selected is not None
-        self.selected.start()
-
-        signal.signal(signal.SIGINT, self._sighandler)
-        signal.signal(signal.SIGTERM, self._sighandler)
-        signal.signal(signal.SIGHUP, self._sighandler)
-        self.selected.wait()
-        self.cleanup()
-
-    def stop(self):
-        assert self.selected is not None
-        print('Shutting down')
-        self.selected.stop()
-        self.cleanup()
-    def _sighandler(self, signum, frame):
-        self.stop()
-
-def main():
-    parser = argparse.ArgumentParser(description='Wayland terminal-based lock screen')
-    parser.add_argument('-l', '--locker-cmd', default='swaylock-plugin', help='swaylock-plugin command to use')
-    parser.add_argument('-t', '--terminal', default='alacritty', help='Terminal emulator to use')
-    parser.add_argument('-i', '--instance', action='store_true', help='Run as instance')
-    parser.add_argument('-s', '--screensaver', type=int, help='Force use of specific screensaver')
-
-    args = parser.parse_args()
-    if not args.instance:
-        cmd = [
-            args.locker_cmd, '--command-each',
-            f'@windowtolayer@/bin/windowtolayer -- {args.terminal} -e {sys.argv[0]} --instance']
-        if args.screensaver is not None:
-            cmd[-1] += f' --screensaver {args.screensaver}'
-        subprocess.check_call(cmd)
-        return
-
-    ms = MultiSaver(select=args.screensaver)
-    ms.select()
-    ms.run()
-
-if __name__ == '__main__':
-    main()

home-manager/modules/gui/swaysome.conf

@@ -1,66 +0,0 @@
-# Use (un)bindcode or (un)bindsym, depending on what you used in your main sway config file.
-# The `--no-warn` setting is only added to shortcuts that exist in the default config. You may want to add or remove
-# that flag on some bindings depending on your config.
-
-
-# Change focus between workspaces
-bindsym $mod+Alt+1 exec "swaysome focus 1"
-bindsym $mod+Alt+2 exec "swaysome focus 2"
-bindsym $mod+Alt+3 exec "swaysome focus 3"
-bindsym $mod+Alt+4 exec "swaysome focus 4"
-bindsym $mod+Alt+5 exec "swaysome focus 5"
-bindsym $mod+Alt+6 exec "swaysome focus 6"
-bindsym $mod+Alt+7 exec "swaysome focus 7"
-bindsym $mod+Alt+8 exec "swaysome focus 8"
-bindsym $mod+Alt+9 exec "swaysome focus 9"
-bindsym $mod+Alt+0 exec "swaysome focus 0"
-
-# Focus workspace groups
-bindsym --no-warn $mod+1 exec "swaysome focus-group 1"
-bindsym --no-warn $mod+2 exec "swaysome focus-group 2"
-bindsym --no-warn $mod+3 exec "swaysome focus-group 3"
-bindsym --no-warn $mod+4 exec "swaysome focus-group 4"
-bindsym --no-warn $mod+5 exec "swaysome focus-group 5"
-bindsym --no-warn $mod+6 exec "swaysome focus-group 6"
-bindsym --no-warn $mod+7 exec "swaysome focus-group 7"
-bindsym --no-warn $mod+8 exec "swaysome focus-group 8"
-bindsym --no-warn $mod+9 exec "swaysome focus-group 9"
-bindsym --no-warn $mod+0 exec "swaysome focus-group 0"
-
-# Move containers between workspaces
-bindsym $mod+Alt+Shift+1 exec "swaysome move 1"
-bindsym $mod+Alt+Shift+2 exec "swaysome move 2"
-bindsym $mod+Alt+Shift+3 exec "swaysome move 3"
-bindsym $mod+Alt+Shift+4 exec "swaysome move 4"
-bindsym $mod+Alt+Shift+5 exec "swaysome move 5"
-bindsym $mod+Alt+Shift+6 exec "swaysome move 6"
-bindsym $mod+Alt+Shift+7 exec "swaysome move 7"
-bindsym $mod+Alt+Shift+8 exec "swaysome move 8"
-bindsym $mod+Alt+Shift+9 exec "swaysome move 9"
-bindsym $mod+Alt+Shift+0 exec "swaysome move 0"
-
-# Move containers to other workspace groups
-bindsym --no-warn $mod+Shift+1 exec "swaysome move-to-group 1"
-bindsym --no-warn $mod+Shift+2 exec "swaysome move-to-group 2"
-bindsym --no-warn $mod+Shift+3 exec "swaysome move-to-group 3"
-bindsym --no-warn $mod+Shift+4 exec "swaysome move-to-group 4"
-bindsym --no-warn $mod+Shift+5 exec "swaysome move-to-group 5"
-bindsym --no-warn $mod+Shift+6 exec "swaysome move-to-group 6"
-bindsym --no-warn $mod+Shift+7 exec "swaysome move-to-group 7"
-bindsym --no-warn $mod+Shift+8 exec "swaysome move-to-group 8"
-bindsym --no-warn $mod+Shift+9 exec "swaysome move-to-group 9"
-bindsym --no-warn $mod+Shift+0 exec "swaysome move-to-group 0"
-
-# Move focused container to next output
-bindsym $mod+Alt+Right exec "swaysome next-output"
-# Move focused container to previous output
-bindsym $mod+Alt+Left exec "swaysome prev-output"
-
-# Move focused workspace group to next output
-bindsym $mod+Shift+Alt+Right exec "swaysome workspace-group-next-output"
-# Move focused workspace group to previous output
-bindsym $mod+Shift+Alt+Left exec "swaysome workspace-group-prev-output"
-
-# Init workspaces for every screen
-exec "swaysome init 1"
-

home-manager/modules/gui/waybar.nix

@@ -146,9 +146,9 @@ in
           dnd-none = "";
         };
         return-type = "json";
-        exec = "${config.my.swaync.package}/bin/swaync-client -swb";
+        exec = "${config.services.swaync.package}/bin/swaync-client -swb";
-        on-click = "${config.my.swaync.package}/bin/swaync-client -t -sw";
+        on-click = "${config.services.swaync.package}/bin/swaync-client -t -sw";
-        on-click-right = "${config.my.swaync.package}/bin/swaync-client -d -sw";
+        on-click-right = "${config.services.swaync.package}/bin/swaync-client -d -sw";
         escape = true;
       };
     };

home-manager/modules/swaync.nix

@@ -19,10 +19,10 @@ let
     };
   };
 
-  cfg = config.my.swaync;
+  cfg = config.services.swaync;
 in
 {
-  options.my.swaync = with lib.types; {
+  options.services.swaync = with lib.types; {
     enable = mkEnableOption "Sway Notification Center";
     package = mkOption {
       type = package;

lib/constants.nix

@@ -11,8 +11,6 @@ rec {
       jellyseerr = 402;
       atticd = 403;
       kea = 404;
-      keepalived_script = 405;
-      photoprism = 406;
     };
     gids = {
       matrix-syncv3 = 400;
@@ -20,15 +18,12 @@ rec {
       jellyseerr = 402;
       atticd = 403;
       kea = 404;
-      keepalived_script = 405;
-      photoprism = 406;
-      adbusers = 407;
     };
   };
 
   kernel = {
-    lts = pkgs: pkgs.linuxKernel.packages.linux_6_12;
+    lts = pkgs: pkgs.linuxKernel.packages.linux_6_1;
-    latest = pkgs: pkgs.linuxKernel.packages.linux_6_13;
+    latest = pkgs: pkgs.linuxKernel.packages.linux_6_6;
   };
 
   nginx = rec {
@@ -99,10 +94,10 @@ rec {
   nix = {
     cache = rec {
       substituters = [
-        "https://nix-cache.${pubDomain}"
+        "https://nix-cache.${pubDomain}/main"
       ];
       keys = [
-        "nix-cache.nul.ie-1:BzH5yMfF4HbzY1C977XzOxoPhEc9Zbu39ftPkUbH+m4="
+        "main:mMChkG8LwXrFirVfudqjSHasK1jV31OVElYD3eImYl8="
       ];
       conf = ''
         extra-substituters = ${concatStringsSep " " substituters}
@@ -112,7 +107,7 @@ rec {
   };
 
   pubDomain = "nul.ie";
-  colony = rec {
+  colony = {
     domain = "ams1.int.${pubDomain}";
     pubV4 = "94.142.240.44";
     prefixes = with lib.my.net.cidr; rec {
@@ -136,9 +131,6 @@ rec {
         v4 = subnet 8 3 all.v4;
         v6 = subnet 4 3 all.v6;
       };
-      qclk = {
-        v4 = subnet 8 4 all.v4;
-      };
 
       cust = {
         v4 = subnet 8 100 all.v4; # single ip for routing only
@@ -152,10 +144,6 @@ rec {
         v4 = "94.142.242.255/32";
         v6 = subnet 8 1 cust.v6;
       };
-      jam = {
-        v4 = subnet 8 4 cust.v4;
-        v6 = subnet 8 2 cust.v6;
-      };
 
       vip1 = "94.142.241.224/30";
       vip2 = "94.142.242.254/31";
@@ -168,16 +156,6 @@ rec {
       home.v6 = "2a0e:97c0:4d0::/48";
     };
 
-    custRouting = with lib.my.net.cidr; {
-      mail-vm = host 1 prefixes.cust.v4;
-      darts-vm = host 2 prefixes.cust.v4;
-      jam-ctr = host 3 prefixes.cust.v4;
-    };
-
-    qclk = {
-      wgPort = 51821;
-    };
-
     firewallForwards = aa: [
       {
         port = "http";
@@ -191,7 +169,6 @@ rec {
         port = 8448;
         dst = aa.middleman.internal.ipv4.address;
       }
-
       {
         port = 25565;
         dst = aa.simpcraft-oci.internal.ipv4.address;
@@ -201,16 +178,10 @@ rec {
         dst = aa.simpcraft-staging-oci.internal.ipv4.address;
       }
       {
-        port = 25567;
+        port = 25575;
-        dst = aa.kevcraft-oci.internal.ipv4.address;
+        dst = aa.simpcraft-oci.internal.ipv4.address;
       }
 
-      # RCON... unsafe?
-      # {
-      #   port = 25575;
-      #   dst = aa.simpcraft-oci.internal.ipv4.address;
-      # }
-
       {
         port = 2456;
         dst = aa.valheim-oci.internal.ipv4.address;
@@ -233,27 +204,6 @@ rec {
         dst = aa.simpcraft-oci.internal.ipv4.address;
         proto = "udp";
       }
-      {
-        port = 25567;
-        dst = aa.kevcraft-oci.internal.ipv4.address;
-      }
-
-      {
-        port = 15636;
-        dst = aa.enshrouded-oci.internal.ipv4.address;
-        proto = "udp";
-      }
-      {
-        port = 15637;
-        dst = aa.enshrouded-oci.internal.ipv4.address;
-        proto = "udp";
-      }
-
-      {
-        port = qclk.wgPort;
-        dst = aa.qclk.internal.ipv4.address;
-        proto = "udp";
-      }
     ];
 
     fstrimConfig = {
@@ -277,8 +227,8 @@ rec {
       "stream"
     ];
     routersPubV4 = [
-      "109.255.108.88"
+      "109.255.1.246"
-      "109.255.108.121"
+      "109.255.252.63"
     ];
 
     prefixes = with lib.my.net.cidr; rec {
@@ -327,8 +277,6 @@ rec {
         v6 = host ((1*65536*65536*65536) + 65535) prefixes.as211024.v6;
       };
     };
-
-    roceBootModules = [ "ib_core" "ib_uverbs" "mlx5_core" "mlx5_ib" ];
   };
 
   britway = {
@@ -344,20 +292,6 @@ rec {
     assignedV6 = "2001:19f0:7402:128b:5400:04ff:feac:6e06";
   };
 
-  britnet = {
-    domain = "bhx1.int.${pubDomain}";
-    pubV4 = "77.74.199.67";
-    vpn = {
-      port = 51820;
-    };
-    prefixes = with lib.my.net.cidr; rec {
-      vpn = {
-        v4 = "10.200.0.0/24";
-        v6 = "fdfb:5ebf:6e84::/64";
-      };
-    };
-  };
-
   tailscale = {
     prefix = {
       v4 = "100.64.0.0/10";
@@ -393,7 +327,6 @@ rec {
     };
 
     domain = "hentai.engineer";
-    ipv4MTU = 1460;
     vpn = {
       port = 51820;
     };
@@ -407,7 +340,6 @@ rec {
     deploy = ../.keys/deploy.pub;
     rsyncNet = ../.keys/zh2855.rsync.net.pub;
     mailcowAcme = ../.keys/mailcow-acme.pub;
-    harmonia = ../.keys/harmonia.pub;
   };
   sshHostKeys = {
     mail-vm = ../.keys/mail-vm-host.pub;

lib/default.nix

@@ -5,7 +5,7 @@ let
     genAttrs mapAttrsToList filterAttrsRecursive nameValuePair types
     mkOption mkOverride mkForce mkIf mergeEqualOption optional
     showWarnings concatStringsSep flatten unique optionalAttrs
-    mkBefore toLower;
+    mkBefore;
   inherit (lib.flake) defaultSystems;
 in
 rec {
@@ -53,7 +53,7 @@ rec {
     in mkApp "${app}/bin/${app.meta.mainProgram}";
   flakePackageOverlay' = flake: pkg: system: (final: prev:
     let
-      pkg' = if pkg != null then flake.packages.${system}.${pkg} else flake.packages.${system}.default;
+      pkg' = if pkg != null then flake.packages.${system}.${pkg} else flake.defaultPackage.${system};
       name = if pkg != null then pkg else pkg'.name;
     in
     {
@@ -248,37 +248,10 @@ rec {
   in
   {
     trivial = prev.trivial // {
-      release = "25.03:u-${prev.trivial.release}";
+      release = "23.12:u-${prev.trivial.release}";
-      codeName = "Frick";
+      codeName = "Amogus";
       revisionWithDefault = default: self.rev or default;
       versionSuffix = ".${date}.${revCode self}:u-${revCode pkgsFlake}";
     };
   };
-
-  netbootKeaClientClasses = { tftpIP, hostname, systems }:
-  let
-    testIPXE = "substring(option[user-class].hex, 0, 4) == 'iPXE'";
-  in
-    (mapAttrsToList (name: mac: {
-      name = "nixos-${name}";
-      test = "(${testIPXE}) and (hexstring(pkt4.mac, ':') == '${toLower mac}')";
-      next-server = tftpIP;
-      server-hostname = hostname;
-      boot-file-name = "http://${hostname}/systems/${name}/menu.ipxe";
-    }) systems) ++ [
-    {
-      name = "ipxe";
-      test = testIPXE;
-      next-server = tftpIP;
-      server-hostname = hostname;
-      boot-file-name = "http://${hostname}/boot.ipxe";
-    }
-    {
-      name = "efi-x86_64";
-      test = "option[client-system].hex == 0x0007";
-      next-server = tftpIP;
-      server-hostname = hostname;
-      boot-file-name = "ipxe-x86_64.efi";
-    }
-  ];
 }

nixos/boxes/britnet.nix

@@ -1,191 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.britnet) domain pubV4 prefixes;
-in
-{
-  nixos.systems.britnet = {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-
-    assignments = {
-      allhost = {
-        inherit domain;
-        ipv4 = {
-          address = pubV4;
-          mask = 24;
-          gateway = "77.74.199.1";
-        };
-        ipv6 = {
-          address = "2a12:ab46:5344:99::a";
-          gateway = "2a12:ab46:5344::1";
-        };
-      };
-      vpn = {
-        ipv4 = {
-          address = net.cidr.host 1 prefixes.vpn.v4;
-          gateway = null;
-        };
-        ipv6.address = net.cidr.host 1 prefixes.vpn.v6;
-      };
-    };
-
-    configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
-      let
-        inherit (lib) mkMerge mkForce;
-        inherit (lib.my) networkdAssignment;
-      in
-      {
-        imports = [
-          "${modulesPath}/profiles/qemu-guest.nix"
-        ];
-
-        config = mkMerge [
-          {
-            boot = {
-              initrd.availableKernelModules = [
-                "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "ahci" "sr_mod" "virtio_blk"
-              ];
-              loader = {
-                systemd-boot.enable = false;
-                grub = {
-                  enable = true;
-                  device = "/dev/vda";
-                };
-              };
-            };
-
-            fileSystems = {
-              "/boot" = {
-                device = "/dev/disk/by-uuid/457444a1-81dd-4934-960c-650ad16c92b5";
-                fsType = "ext4";
-              };
-              "/nix" = {
-                device = "/dev/disk/by-uuid/992c0c79-5be6-45b6-bc30-dc82e3ec082a";
-                fsType = "ext4";
-              };
-              "/persist" = {
-                device = "/dev/disk/by-uuid/f020a955-54d5-4098-98ba-d3615781d96a";
-                fsType = "ext4";
-                neededForBoot = true;
-              };
-            };
-
-            environment = {
-              systemPackages = with pkgs; [
-                wireguard-tools
-              ];
-            };
-
-            services = {
-              iperf3 = {
-                enable = true;
-                openFirewall = true;
-              };
-
-              tailscale = {
-                enable = true;
-                authKeyFile = config.age.secrets."tailscale-auth.key".path;
-                openFirewall = true;
-                interfaceName = "tailscale0";
-                extraUpFlags = [
-                  "--operator=${config.my.user.config.name}"
-                  "--login-server=https://hs.nul.ie"
-                  "--netfilter-mode=off"
-                  "--advertise-exit-node"
-                  "--accept-routes=false"
-                ];
-              };
-            };
-
-            networking = { inherit domain; };
-
-            systemd.network = {
-              netdevs = {
-                "30-wg0" = {
-                  netdevConfig = {
-                    Name = "wg0";
-                    Kind = "wireguard";
-                  };
-                  wireguardConfig = {
-                    PrivateKeyFile = config.age.secrets."britnet/wg.key".path;
-                    ListenPort = lib.my.c.britnet.vpn.port;
-                  };
-                  wireguardPeers = [
-                    {
-                      PublicKey = "EfPwREfZ/q3ogHXBIqFZh4k/1NRJRyq4gBkBXtegNkE=";
-                      AllowedIPs = [
-                        (net.cidr.host 10 prefixes.vpn.v4)
-                        (net.cidr.host 10 prefixes.vpn.v6)
-                      ];
-                    }
-                  ];
-                };
-              };
-
-              links = {
-                "10-veth0" = {
-                  matchConfig.PermanentMACAddress = "00:db:d9:62:68:1a";
-                  linkConfig.Name = "veth0";
-                };
-              };
-
-              networks = {
-                "20-veth0" = mkMerge [
-                  (networkdAssignment "veth0" assignments.allhost)
-                  {
-                    dns = [ "1.1.1.1" "1.0.0.1" ];
-                    routes = [
-                      {
-                        # Gateway is on a different network for some reason...
-                        Destination = "2a12:ab46:5344::1";
-                        Scope = "link";
-                      }
-                    ];
-                  }
-                ];
-                "30-wg0" = mkMerge [
-                  (networkdAssignment "wg0" assignments.vpn)
-                  {
-                    networkConfig.IPv6AcceptRA = mkForce false;
-                  }
-                ];
-              };
-            };
-
-            my = {
-              server.enable = true;
-              secrets = {
-                key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJIEx+1EC/lN6WKIaOB+O5LJgVHRK962YpZEPQg/m78O";
-                files = {
-                  "tailscale-auth.key" = {};
-                  "britnet/wg.key" = {
-                    owner = "systemd-network";
-                  };
-                };
-              };
-
-              firewall = {
-                udp.allowed = [ lib.my.c.britnet.vpn.port ];
-                trustedInterfaces = [ "tailscale0" ];
-                extraRules = ''
-                  table inet filter {
-                    chain forward {
-                      iifname wg0 oifname veth0 accept
-                    }
-                  }
-                  table inet nat {
-                    chain postrouting {
-                      iifname { tailscale0, wg0 } oifname veth0 snat ip to ${assignments.allhost.ipv4.address}
-                      iifname { tailscale0, wg0 } oifname veth0 snat ip6 to ${assignments.allhost.ipv6.address}
-                    }
-                  }
-                '';
-              };
-            };
-          }
-        ];
-      };
-  };
-}

nixos/boxes/britway/bgp.nix

@@ -11,24 +11,23 @@ in
   config = {
     my = {
       secrets.files."britway/bgp-password-vultr.conf" = {
-        owner = "bird";
+        owner = "bird2";
-        group = "bird";
+        group = "bird2";
       };
     };
 
     environment.etc."bird/vultr-password.conf".source = config.age.secrets."britway/bgp-password-vultr.conf".path;
 
     systemd = {
-      services.bird.after = [ "systemd-networkd-wait-online@veth0.service" ];
+      services.bird2.after = [ "systemd-networkd-wait-online@veth0.service" ];
       network = {
         config.networkConfig.ManageForeignRoutes = false;
       };
     };
 
     services = {
-      bird = {
+      bird2 = {
         enable = true;
-        package = pkgs.bird2;
         preCheckConfig = ''
           echo '"dummy"' > vultr-password.conf
         '';

nixos/boxes/britway/default.nix

@@ -106,7 +106,7 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                       {
                         Destination = lib.my.c.colony.prefixes.all.v4;
                         Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -123,7 +123,7 @@ in
                         Table = "ts-extra";
                       }
                     ];
-                    routingPolicyRules = [
+                    routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                       {
                         IncomingInterface = "tailscale0";
                         To = lib.my.c.colony.prefixes.all.v6;

nixos/boxes/britway/nginx.nix

@@ -80,7 +80,7 @@ in
               };
             };
 
-            "hs.${pubDomain}" = {
+            "ts.${pubDomain}" = {
               locations."/" = {
                 proxyPass = "http://localhost:${toString config.services.headscale.port}";
                 proxyWebsockets = true;

nixos/boxes/britway/tailscale.nix

@@ -5,20 +5,18 @@ let
   inherit (lib.my.c.britway) prefixes domain;
 
   # Can't use overrideAttrs because we need to override `vendorHash` within `buildGoModule`
-  headscale' = (pkgs.headscale.override {
+  headscale = pkgs.headscale.override {
     buildGoModule = args: pkgs.buildGoModule (args // rec {
-      version = "0.23.0-alpha12";
+      version = "0.23.0-alpha2";
       src = pkgs.fetchFromGitHub {
         owner = "juanfont";
         repo = "headscale";
         rev = "v${version}";
-        hash = "sha256-kZZK0cXnFARxblSMz01TDcBbTorkHGAwGpR+a4/mYfU=";
+        hash = "sha256-sz+uQyyq/5YYDe5I44x5x2nvd48swAhNlInB8KZYvDo=";
       };
-      patches = [];
+      vendorHash = "sha256-u9AmJguQ5dnJpfhOeLN43apvMHuraOrJhvlEIp9RoIc=";
-      vendorHash = "sha256-EorT2AVwA3usly/LcNor6r5UIhLCdj3L4O4ilgTIC2o=";
-      doCheck = false;
     });
-  });
+  };
 
   advRoutes = concatStringsSep "," [
     lib.my.c.home.prefixes.all.v4
@@ -41,20 +39,19 @@ in
     services = {
       headscale = {
         enable = true;
+        package = headscale;
         settings = {
           disable_check_updates = true;
           unix_socket_permission = "0770";
-          server_url = "https://hs.${pubDomain}";
+          server_url = "https://ts.${pubDomain}";
-          database = {
+          db_type = "sqlite3";
-            type = "sqlite3";
+          db_path = "/var/lib/headscale/db.sqlite3";
-            sqlite.path = "/var/lib/headscale/db.sqlite3";
-          };
           noise.private_key_path = "/var/lib/headscale/noise_private.key";
-          prefixes = with lib.my.c.tailscale.prefix; { inherit v4 v6; };
+          ip_prefixes = with lib.my.c.tailscale.prefix; [ v4 v6 ];
-          dns = {
+          dns_config = {
             # Use IPs that will route inside the VPN to prevent interception
             # (e.g. DNS rebinding filtering)
-            nameservers.split = {
+            restricted_nameservers = {
               "${domain}" = pubNameservers;
               "${lib.my.c.colony.domain}" = with allAssignments.estuary.base; [
                 ipv4.address ipv6.address
@@ -68,6 +65,7 @@ in
             };
             magic_dns = true;
             base_domain = "ts.${pubDomain}";
+            override_local_dns = false;
           };
           oidc = {
             only_start_if_oidc_is_available = true;
@@ -87,7 +85,7 @@ in
         interfaceName = "tailscale0";
         extraUpFlags = [
           "--operator=${config.my.user.config.name}"
-          "--login-server=https://hs.nul.ie"
+          "--login-server=https://ts.nul.ie"
           "--netfilter-mode=off"
           "--advertise-exit-node"
           "--advertise-routes=${advRoutes}"

nixos/boxes/castle/default.nix

@@ -1,8 +1,7 @@
 { lib, ... }:
 let
   inherit (lib.my) net;
-  inherit (lib.my.c) networkd;
+  inherit (lib.my.c.home) domain vlans prefixes;
-  inherit (lib.my.c.home) domain vlans prefixes vips roceBootModules;
 in
 {
   nixos.systems.castle = {
@@ -16,7 +15,7 @@ in
         ipv4 = {
           address = net.cidr.host 40 prefixes.hi.v4;
           mask = 22;
-          gateway = vips.hi.v4;
+          gateway = null;
         };
         ipv6 = {
           iid = "::3:1";
@@ -36,7 +35,7 @@ in
           cpu = {
             amd.updateMicrocode = true;
           };
-          graphics.extraPackages = with pkgs; [
+          opengl.extraPackages = with pkgs; [
             intel-media-driver
           ];
           bluetooth.enable = true;
@@ -48,7 +47,7 @@ in
             timeout = 10;
           };
           kernelPackages = lib.my.c.kernel.latest pkgs;
-          kernelModules = [ "kvm-amd" "dm-snapshot" ];
+          kernelModules = [ "kvm-amd" ];
           kernelParams = [ "amd_iommu=on" "amd_pstate=passive" ];
           kernelPatches = [
             # {
@@ -58,40 +57,27 @@ in
             # }
           ];
           initrd = {
-            availableKernelModules = [
+            availableKernelModules = [ "thunderbolt" "xhci_pci" "nvme" "ahci" "usbhid" "usb_storage" "sd_mod" ];
-              "thunderbolt" "xhci_pci" "nvme" "ahci" "usbhid" "usb_storage" "sd_mod"
-              "8021q"
-            ] ++ roceBootModules;
-            systemd.network = {
-              netdevs = mkVLAN "lan-hi" vlans.hi;
-              networks = {
-                "10-et100g" = {
-                  matchConfig.Name = "et100g";
-                  vlan = [ "lan-hi" ];
-                  linkConfig.RequiredForOnline = "no";
-                  networkConfig = networkd.noL3;
-                };
-                "20-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
-              };
-            };
           };
-
-          binfmt.emulatedSystems = [ "aarch64-linux" "armv7l-linux" ];
         };
 
         fileSystems = {
+          "/boot" = {
+            device = "/dev/disk/by-partuuid/8ce4248a-3ee4-f44f-801f-064a628b4d6e";
+            fsType = "vfat";
+          };
           "/nix" = {
-            device = "/dev/nvmeof/nix";
+            device = "/dev/disk/by-partuuid/2da23a1d-2daf-d943-b91e-fc175f3dad07";
             fsType = "ext4";
           };
+
           "/persist" = {
-            device = "/dev/nvmeof/persist";
+            device = "/dev/disk/by-partuuid/f4c80d4f-a022-e941-b5d1-fe2e65e444b9";
             fsType = "ext4";
             neededForBoot = true;
           };
-
           "/home" = {
-            device = "/dev/nvmeof/home";
+            device = "/dev/disk/by-partuuid/992a93cf-6c9c-324b-b0ce-f8eb2d1ce10d";
             fsType = "ext4";
           };
         };
@@ -115,12 +101,6 @@ in
             dnssec = "false";
           };
 
-          pipewire.extraConfig.pipewire = {
-            "10-buffer"."context.properties" = {
-              "default.clock.quantum" = 128;
-              "default.clock.max-quantum" = 128;
-            };
-          };
           blueman.enable = true;
         };
 
@@ -134,7 +114,7 @@ in
         virtualisation.libvirtd.enable = true;
 
         networking = {
-          inherit domain;
+          domain = "h.${lib.my.c.pubDomain}";
           firewall.enable = false;
         };
 
@@ -150,19 +130,23 @@ in
           mstflint
           qperf
           ethtool
-          android-tools
         ];
+        environment.etc = {
+          "pipewire/pipewire.conf.d/sample-size.conf".text = ''
+            context.properties = {
+              default.clock.quantum = 128
+              default.clock.max-quantum = 128
+            }
+          '';
+        };
 
         nix = {
           gc.automatic = false;
-          settings = {
-            experimental-features = [ "recursive-nix" ];
-            system-features = [ "nixos-test" "benchmark" "big-parallel" "kvm" "recursive-nix" ];
-          };
         };
 
         systemd = {
           network = {
+            wait-online.enable = false;
             netdevs = mkMerge [
               (mkVLAN "lan-hi" vlans.hi)
             ];
@@ -179,20 +163,29 @@ in
                 matchConfig.PermanentMACAddress = "24:8a:07:a8:fe:3a";
                 linkConfig = {
                   Name = "et100g";
-                  MTUBytes = toString lib.my.c.home.hiMTU;
+                  MTUBytes = "9000";
                 };
               };
             };
             networks = {
-              "30-et100g" = {
+              "50-lan" = {
+                matchConfig.Name = "et2.5g";
+                DHCP = "no";
+                address = [ "10.16.7.1/16" ];
+              };
+
+              "50-et100g" = {
                 matchConfig.Name = "et100g";
                 vlan = [ "lan-hi" ];
                 networkConfig.IPv6AcceptRA = false;
               };
-              "40-lan-hi" = mkMerge [
+              "60-lan-hi" = mkMerge [
                 (networkdAssignment "lan-hi" assignments.hi)
-                # So we don't drop the IP we use to connect to NVMe-oF!
+                {
-                { networkConfig.KeepConfiguration = "static"; }
+                  DHCP = "yes";
+                  matchConfig.Name = "lan-hi";
+                  linkConfig.MTUBytes = "9000";
+                }
               ];
             };
           };
@@ -212,7 +205,10 @@ in
                 packages = with pkgs; [
                   jacktrip
                   qpwgraph
-                  boardie
+                  # TODO: seems to be borked (infinite recursion???)
+                  # (writeShellScriptBin "boardie" ''
+                  #   exec pw-jack ${boardie}/bin/boardie "$@"
+                  # '')
                 ];
               };
 
@@ -226,7 +222,6 @@ in
                     HDMI-A-1 = {
                       transform = "270";
                       position = "0 0";
-                      bg = "${./his-team-player.jpg} fill";
                     };
                     DP-1 = {
                       mode = "2560x1440@170Hz";
@@ -248,19 +243,11 @@ in
           };
 
           #deploy.generate.system.mode = "boot";
+          deploy.node.hostname = "castle.box.${config.networking.domain}";
           secrets = {
             key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMlVuTzKObeaUuPocCF41IO/8X+443lzUJLuCIclt2vr";
           };
-          netboot.client = {
+          nvme.uuid = "2230b066-a674-4f45-a1dc-f7727b3a9e7b";
-            enable = true;
-          };
-          nvme = {
-            uuid = "2230b066-a674-4f45-a1dc-f7727b3a9e7b";
-            boot = {
-              nqn = "nqn.2016-06.io.spdk:castle";
-              address = "192.168.68.80";
-            };
-          };
 
           firewall = {
             enable = false;

nixos/boxes/colony/default.nix

@@ -1,7 +1,7 @@
 { lib, ... }:
 let
   inherit (lib.my) net;
-  inherit (lib.my.c.colony) domain prefixes custRouting firewallForwards;
+  inherit (lib.my.c.colony) domain prefixes firewallForwards;
 in
 {
   imports = [ ./vms ];
@@ -60,8 +60,8 @@ in
           kernelPackages = (lib.my.c.kernel.lts pkgs).extend (self: super: {
             kernel = super.kernel.override {
               structuredExtraConfig = with lib.kernel; {
-                ACPI_APEI_PCIEAER = yes;
+                #SOME_OPT = yes;
-                PCIEAER = yes;
+                #A_MOD = module;
               };
             };
           });
@@ -150,12 +150,12 @@ in
             "serial-getty@ttyS1".enable = true;
             lvm-activate-main = {
               description = "Activate remaining LVs";
-              unitConfig.DefaultDependencies = false;
+              before = [ "local-fs-pre.target" ];
               serviceConfig = {
                 Type = "oneshot";
                 ExecStart = "${pkgs.lvm2.bin}/bin/vgchange -aay main";
               };
-              wantedBy = [ "local-fs-pre.target" ];
+              wantedBy = [ "sysinit.target" ];
             };
 
             rsync-lvm-meta = {
@@ -252,10 +252,10 @@ in
                   };
                   ipv6Prefixes = [
                     {
-                      Prefix = prefixes.vms.v6;
+                      ipv6PrefixConfig.Prefix = prefixes.vms.v6;
                     }
                   ];
-                  routes = [
+                  routes = map (r: { routeConfig = r; }) [
                     {
                       Destination = prefixes.ctrs.v4;
                       Gateway = allAssignments.shill.routing.ipv4.address;
@@ -264,12 +264,10 @@ in
                       Destination = prefixes.ctrs.v6;
                       Gateway = allAssignments.shill.internal.ipv6.address;
                     }
-
                     {
                       Destination = allAssignments.shill.internal.ipv4.address;
                       Gateway = allAssignments.shill.routing.ipv4.address;
                     }
-
                     {
                       Destination = lib.my.c.tailscale.prefix.v4;
                       Gateway = allAssignments.shill.routing.ipv4.address;
@@ -278,15 +276,6 @@ in
                       Destination = lib.my.c.tailscale.prefix.v6;
                       Gateway = allAssignments.shill.internal.ipv6.address;
                     }
-                    {
-                      Destination = prefixes.qclk.v4;
-                      Gateway = allAssignments.shill.routing.ipv4.address;
-                    }
-
-                    {
-                      Destination = prefixes.jam.v6;
-                      Gateway = allAssignments.shill.internal.ipv6.address;
-                    }
 
                     {
                       Destination = prefixes.oci.v4;
@@ -318,7 +307,7 @@ in
               "90-vm-mail" = {
                 matchConfig.Name = "vm-mail";
                 address = [
-                  "${custRouting.mail-vm}/32"
+                  (net.cidr.subnet 8 1 prefixes.cust.v4)
                   prefixes.mail.v6
                 ];
                 networkConfig = {
@@ -327,10 +316,10 @@ in
                 };
                 ipv6Prefixes = [
                   {
-                    Prefix = prefixes.mail.v6;
+                    ipv6PrefixConfig.Prefix = prefixes.mail.v6;
                   }
                 ];
-                routes = [
+                routes = map (r: { routeConfig = r; }) [
                   {
                     Destination = prefixes.mail.v4;
                     Scope = "link";
@@ -341,7 +330,7 @@ in
               "90-vm-darts" = {
                 matchConfig.Name = "vm-darts";
                 address = [
-                  "${custRouting.darts-vm}/32"
+                  (net.cidr.subnet 8 2 prefixes.cust.v4)
                   prefixes.darts.v6
                 ];
                 networkConfig = {
@@ -350,10 +339,10 @@ in
                 };
                 ipv6Prefixes = [
                   {
-                    Prefix = prefixes.darts.v6;
+                    ipv6PrefixConfig.Prefix = prefixes.darts.v6;
                   }
                 ];
-                routes = [
+                routes = map (r: { routeConfig = r; }) [
                   {
                     Destination = prefixes.darts.v4;
                     Scope = "link";

nixos/boxes/colony/vms/default.nix

@@ -29,9 +29,6 @@
     };
   in
   {
-    # Kernel Same-Page Merging to attempt memory usage reduction
-    hardware.ksm.enable = false;
-
     systemd = {
       network = {
         links = {
@@ -133,8 +130,7 @@
 
               (vm.lvmDisk "media")
               (vm.lvmDisk "minio")
-              (vm.lvmDisk "nix-cache")
+              (vm.lvmDisk "nix-atticd")
-              (vm.lvmDisk "jam")
             ]);
           };
 
@@ -213,7 +209,6 @@
             drives = [
               (mkMerge [ (vm.disk "darts" "root") { frontendOpts.bootindex = 0; } ])
               (vm.lvmDisk' "media" "darts-media")
-              (vm.lvmDisk' "ext" "darts-ext")
             ];
           };
         };

nixos/boxes/colony/vms/estuary/bgp.nix

@@ -8,9 +8,8 @@ in
 {
   config = {
     services = {
-      bird = {
+      bird2 = {
         enable = true;
-        package = pkgs.bird2;
         # TODO: Clean up and modularise
         config = ''
           define OWNAS = 211024;

nixos/boxes/colony/vms/estuary/default.nix

@@ -9,7 +9,6 @@ in
     vpns = {
       l2 = {
         as211024 = {
-          udpEncapsulation = true;
           vni = 211024;
           security.enable = true;
           peers = {
@@ -164,9 +163,11 @@ in
                     };
                     wireguardPeers = [
                       {
-                        PublicKey = "7N9YdQaCMWWIwAnW37vrthm9ZpbnG4Lx3gheHeRYz2E=";
+                        wireguardPeerConfig = {
-                        AllowedIPs = [ allAssignments.kelder.estuary.ipv4.address ];
+                          PublicKey = "7N9YdQaCMWWIwAnW37vrthm9ZpbnG4Lx3gheHeRYz2E=";
-                        PersistentKeepalive = 25;
+                          AllowedIPs = [ allAssignments.kelder.estuary.ipv4.address ];
+                          PersistentKeepalive = 25;
+                        };
                       }
                     ];
                   };
@@ -276,51 +277,47 @@ in
                     };
                     ipv6Prefixes = [
                       {
-                        Prefix = prefixes.base.v6;
+                        ipv6PrefixConfig.Prefix = prefixes.base.v6;
                       }
                     ];
-                    routes = flatten ([
+                    routes = map (r: { routeConfig = r; }) (flatten
-                      {
+                      ([
-                        Destination = prefixes.vip1;
+                        {
-                        Gateway = allAssignments.colony.routing.ipv4.address;
+                          Destination = prefixes.vip1;
-                      }
+                          Gateway = allAssignments.colony.routing.ipv4.address;
-                      {
+                        }
-                        Destination = prefixes.vip3;
+                        {
-                        Gateway = allAssignments.colony.routing.ipv4.address;
+                          Destination = prefixes.vip3;
-                      }
+                          Gateway = allAssignments.colony.routing.ipv4.address;
-                      {
+                        }
-                        Destination = prefixes.darts.v4;
+                        {
-                        Gateway = allAssignments.colony.routing.ipv4.address;
+                          Destination = prefixes.darts.v4;
-                      }
+                          Gateway = allAssignments.colony.routing.ipv4.address;
-                      {
+                        }
-                        Destination = prefixes.cust.v6;
+                        {
-                        Gateway = allAssignments.colony.internal.ipv6.address;
+                          Destination = prefixes.cust.v6;
-                      }
+                          Gateway = allAssignments.colony.internal.ipv6.address;
+                        }
 
-                      {
+                        {
-                        Destination = lib.my.c.tailscale.prefix.v4;
+                          Destination = lib.my.c.tailscale.prefix.v4;
-                        Gateway = allAssignments.colony.routing.ipv4.address;
+                          Gateway = allAssignments.colony.routing.ipv4.address;
-                      }
+                        }
-                      {
+                        {
-                        Destination = lib.my.c.tailscale.prefix.v6;
+                          Destination = lib.my.c.tailscale.prefix.v6;
-                        Gateway = allAssignments.colony.internal.ipv6.address;
+                          Gateway = allAssignments.colony.internal.ipv6.address;
-                      }
+                        }
-
+                      ] ++
-                      {
+                      (map (pName: [
-                        Destination = prefixes.qclk.v4;
+                        {
-                        Gateway = allAssignments.colony.routing.ipv4.address;
+                          Gateway = allAssignments.colony.routing.ipv4.address;
-                      }
+                          Destination = prefixes."${pName}".v4;
-                    ] ++
+                        }
-                    (map (pName: [
+                        {
-                      {
+                          Destination = prefixes."${pName}".v6;
-                        Gateway = allAssignments.colony.routing.ipv4.address;
+                          Gateway = allAssignments.colony.internal.ipv6.address;
-                        Destination = prefixes."${pName}".v4;
+                        }
-                      }
+                      ]) [ "vms" "ctrs" "oci" ])));
-                      {
-                        Destination = prefixes."${pName}".v6;
-                        Gateway = allAssignments.colony.internal.ipv6.address;
-                      }
-                    ]) [ "vms" "ctrs" "oci" ]));
                   }
                 ];
 
@@ -329,7 +326,7 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                       {
                         Destination = lib.my.c.home.prefixes.all.v4;
                         Gateway = lib.my.c.home.vips.as211024.v4;
@@ -341,8 +338,10 @@ in
                   matchConfig.Name = "kelder";
                   routes = [
                     {
-                      Destination = allAssignments.kelder.estuary.ipv4.address;
+                      routeConfig = {
-                      Scope = "link";
+                        Destination = allAssignments.kelder.estuary.ipv4.address;
+                        Scope = "link";
+                      };
                     }
                   ];
                 };
@@ -394,22 +393,16 @@ in
                       # Safe enough to allow all SSH
                       tcp dport ssh accept
 
-                      # jam-ctr forwards
-                      ip daddr ${aa.shill.internal.ipv4.address} tcp dport 60022 accept
-
                       ip6 daddr ${aa.middleman.internal.ipv6.address} tcp dport { http, https, 8448 } accept
                       ${matchInet "tcp dport { http, https } accept" "git"}
-                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport 25565 accept
+                      ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} tcp dport { 25565, 25575 } accept
                       ip6 daddr ${aa.simpcraft-staging-oci.internal.ipv6.address} tcp dport 25565 accept
-                      ip6 daddr ${aa.kevcraft-oci.internal.ipv6.address} tcp dport 25567 accept
                       return
                     }
                     chain routing-udp {
                       ip6 daddr ${aa.valheim-oci.internal.ipv6.address} udp dport { 2456-2457 } accept
                       ip6 daddr ${aa.waffletail.internal.ipv6.address} udp dport 41641 accept
                       ip6 daddr ${aa.simpcraft-oci.internal.ipv6.address} udp dport 25565 accept
-                      ip6 daddr ${aa.enshrouded-oci.internal.ipv6.address} udp dport { 15636-15637 } accept
-                      ip6 daddr ${aa.kevcraft-oci.internal.ipv6.address} udp dport 25567 accept
                       return
                     }
                     chain filter-routing {

nixos/boxes/colony/vms/estuary/dns.nix

@@ -2,7 +2,7 @@
 let
   inherit (builtins) attrNames;
   inherit (lib.my) net;
-  inherit (lib.my.c.colony) prefixes custRouting;
+  inherit (lib.my.c.colony) prefixes;
 
   authZones = attrNames config.my.pdns.auth.bind.zones;
 in
@@ -153,9 +153,6 @@ in
             simpcraft IN AAAA ${allAssignments.simpcraft-oci.internal.ipv6.address}
             simpcraft-staging IN A ${assignments.internal.ipv4.address}
             simpcraft-staging IN AAAA ${allAssignments.simpcraft-staging-oci.internal.ipv6.address}
-            enshrouded IN A ${assignments.internal.ipv4.address}
-            kevcraft IN A ${assignments.internal.ipv4.address}
-            kevcraft IN AAAA ${allAssignments.kevcraft-oci.internal.ipv6.address}
 
             mail-vm IN A ${net.cidr.host 0 prefixes.mail.v4}
             mail-vm IN AAAA ${net.cidr.host 1 prefixes.mail.v6}
@@ -165,10 +162,6 @@ in
 
             andrey-cust IN A ${allAssignments.kelder.estuary.ipv4.address}
 
-            jam-cust IN A ${net.cidr.host 0 prefixes.jam.v4}
-            jam-fwd IN A ${allAssignments.shill.internal.ipv4.address}
-            jam-cust IN AAAA ${net.cidr.host 1 prefixes.jam.v6}
-
             $TTL 3
             _acme-challenge IN LUA TXT @@FILE@@
 

nixos/boxes/colony/vms/git/default.nix

@@ -102,6 +102,34 @@ in
 
             services = {
               fstrim = lib.my.c.colony.fstrimConfig;
+              # Hacks for Jsch (Minecraft FastBack) to work
+              openssh = {
+                hostKeys = [
+                  {
+                    bits = 4096;
+                    path = "/etc/ssh/ssh_host_rsa_key";
+                    type = "rsa";
+                  }
+                  {
+                    path = "/etc/ssh/ssh_host_ed25519_key";
+                    type = "ed25519";
+                  }
+
+                  {
+                    type = "ecdsa-sha2-nistp256";
+                    path = "/etc/ssh/ssh_host_ecdsa_key";
+                  }
+                ];
+                settings = {
+                  Macs = [
+                    "hmac-sha2-512-etm@openssh.com"
+                    "hmac-sha2-256-etm@openssh.com"
+                    "umac-128-etm@openssh.com"
+
+                    "hmac-sha2-256"
+                  ];
+                };
+              };
               netdata.enable = true;
               nginx = {
                 enable = true;

nixos/boxes/colony/vms/git/gitea-actions.nix

@@ -35,11 +35,6 @@ in
           ];
           url = "https://git.${pubDomain}";
           tokenFile = config.age.secrets."gitea/actions-runner.env".path;
-          settings = {
-            runner = {
-              timeout = "8h";
-            };
-          };
         };
       };
     };

nixos/boxes/colony/vms/shill/containers-ext.nix

@@ -1,105 +0,0 @@
-{ lib, pkgs, assignments, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c.colony) prefixes custRouting;
-in
-{
-  fileSystems = {
-    "/mnt/jam" = {
-      device = "/dev/disk/by-label/jam";
-      fsType = "ext4";
-    };
-
-    "/var/lib/machines/jam" = {
-      device = "/mnt/jam";
-      options = [ "bind" ];
-    };
-  };
-
-  systemd = {
-    nspawn = {
-      jam = {
-        enable = true;
-        execConfig = {
-          Boot = true;
-          PrivateUsers = "pick";
-          LinkJournal = false;
-        };
-        networkConfig = {
-          Private = true;
-          VirtualEthernet = true;
-        };
-      };
-    };
-    network.networks = {
-      "50-ve-jam" = {
-        matchConfig = {
-          Kind = "veth";
-          Name = "ve-jam";
-        };
-        address = [
-          custRouting.jam-ctr
-          prefixes.jam.v6
-        ];
-        networkConfig = {
-          IPv6AcceptRA = false;
-          IPv6SendRA = true;
-        };
-        ipv6Prefixes = [
-          {
-            Prefix = prefixes.jam.v6;
-          }
-        ];
-        routes = [
-          {
-            Destination = prefixes.jam.v4;
-            Scope = "link";
-          }
-        ];
-      };
-    };
-    services = {
-      "systemd-nspawn@jam" = {
-        overrideStrategy = "asDropin";
-
-        serviceConfig = {
-          CPUQuota = "400%";
-          MemoryHigh = "infinity";
-          MemoryMax = "4G";
-        };
-
-        wantedBy = [ "machines.target" ];
-      };
-    };
-  };
-
-  my = {
-    firewall =
-    let
-      jamIP = net.cidr.host 0 prefixes.jam.v4;
-    in
-    {
-      nat.forwardPorts."${assignments.internal.ipv4.address}" = [
-        {
-          port = 60022;
-          dst = jamIP;
-          dstPort = "ssh";
-        }
-      ];
-      extraRules = ''
-        table inet filter {
-          chain forward {
-            iifname { ve-jam } oifname vms accept
-            iifname vms oifname { ve-jam } accept
-          }
-        }
-
-        table inet nat {
-          chain postrouting {
-            ip saddr ${jamIP} snat to ${assignments.internal.ipv4.address}
-          }
-        }
-      '';
-    };
-  };
-}

nixos/boxes/colony/vms/shill/containers/chatterbox.nix

@@ -24,7 +24,7 @@ in
 
     configuration = { lib, pkgs, config, assignments, allAssignments, ... }:
     let
-      inherit (lib) genAttrs mkMerge mkIf mkForce;
+      inherit (lib) mkMerge mkIf mkForce;
       inherit (lib.my) networkdAssignment;
     in
     {
@@ -45,22 +45,9 @@ in
                   owner = "matrix-synapse";
                   group = "matrix-synapse";
                 };
-                "chatterbox/doublepuppet.yaml" = {
+                "chatterbox/syncv3.env" = {
-                  owner = "matrix-synapse";
+                  owner = "matrix-syncv3";
-                  group = "matrix-synapse";
+                  group = "matrix-syncv3";
-                };
-
-                "chatterbox/mautrix-whatsapp.env" = {
-                  owner = "mautrix-whatsapp";
-                  group = "mautrix-whatsapp";
-                };
-                "chatterbox/mautrix-messenger.env" = {
-                  owner = "mautrix-meta-messenger";
-                  group = "mautrix-meta";
-                };
-                "chatterbox/mautrix-instagram.env" = {
-                  owner = "mautrix-meta-instagram";
-                  group = "mautrix-meta";
                 };
               };
             };
@@ -72,24 +59,29 @@ in
 
           users = with lib.my.c.ids; {
             users = {
-              matrix-synapse.extraGroups = [
+              matrix-syncv3 = {
-                "mautrix-whatsapp"
+                isSystemUser = true;
-              ];
+                uid = uids.matrix-syncv3;
+                group = "matrix-syncv3";
+              };
+            };
+            groups = {
+              matrix-syncv3.gid = gids.matrix-syncv3;
             };
-            groups = { };
           };
 
           systemd = {
             network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
-            services = { } // (genAttrs [ "mautrix-whatsapp" "mautrix-meta-messenger" "mautrix-meta-instagram" ] (_: {
+            services = {
-              # ffmpeg needed to convert GIFs to video
+              matrix-sliding-sync.serviceConfig = {
-              path = with pkgs; [ ffmpeg ];
+                # Needs to be able to read its secrets
-            }));
+                DynamicUser = mkForce false;
+                User = "matrix-syncv3";
+                Group = "matrix-syncv3";
+              };
+            };
           };
 
-          # TODO/FIXME: https://github.com/NixOS/nixpkgs/issues/336052
-          nixpkgs.config.permittedInsecurePackages = [ "olm-3.2.16" ];
-
           services = {
             netdata.enable = true;
             matrix-synapse = {
@@ -176,10 +168,18 @@ in
 
                 app_service_config_files = [
                   "/var/lib/heisenbridge/registration.yml"
-                  config.age.secrets."chatterbox/doublepuppet.yaml".path
                 ];
               };
 
+              sliding-sync = {
+                enable = true;
+                createDatabase = false;
+                environmentFile = config.age.secrets."chatterbox/syncv3.env".path;
+                settings = {
+                  SYNCV3_BINDADDR = "[::]:8009";
+                  SYNCV3_SERVER = "http://localhost:8008";
+                };
+              };
             };
 
             heisenbridge = {
@@ -195,144 +195,6 @@ in
                 ];
               };
             };
-
-            mautrix-whatsapp = {
-              enable = true;
-              environmentFile = config.age.secrets."chatterbox/mautrix-whatsapp.env".path;
-              settings = {
-                homeserver = {
-                  address = "http://localhost:8008";
-                  domain = "nul.ie";
-                };
-                appservice = {
-                  database = {
-                    type = "postgres";
-                    uri = "$MAU_WAPP_PSQL_URI";
-                  };
-                  id = "whatsapp2";
-                  bot = {
-                    username = "whatsapp2";
-                    displayname = "WhatsApp Bridge Bot";
-                  };
-                };
-                bridge = {
-                  username_template = "wapp2_{{.}}";
-                  displayname_template = "{{or .BusinessName .PushName .JID}} (WA)";
-                  personal_filtering_spaces = true;
-                  delivery_receipts = true;
-                  allow_user_invite = true;
-                  url_previews = true;
-                  command_prefix = "!wa";
-                  login_shared_secret_map."nul.ie" = "$MAU_WAPP_DOUBLE_PUPPET_TOKEN";
-                  encryption = {
-                    allow = true;
-                    default = true;
-                    require = true;
-                  };
-                  permissions = {
-                    "@dev:nul.ie" = "admin";
-                  };
-                };
-              };
-            };
-
-            mautrix-meta.instances = {
-              messenger = {
-                enable = true;
-                registerToSynapse = true;
-                dataDir = "mautrix-messenger";
-                environmentFile = config.age.secrets."chatterbox/mautrix-messenger.env".path;
-                settings = {
-                  homeserver = {
-                    address = "http://localhost:8008";
-                    domain = "nul.ie";
-                  };
-                  appservice = {
-                    database = {
-                      type = "postgres";
-                      uri = "$MAU_FBM_PSQL_URI";
-                    };
-                    id = "fbm2";
-                    bot = {
-                      username = "messenger2";
-                      displayname = "Messenger Bridge Bot";
-                      avatar = "mxc://maunium.net/ygtkteZsXnGJLJHRchUwYWak";
-                    };
-                  };
-                  network = {
-                    mode = "messenger";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (FBM)'';
-                  };
-                  bridge = {
-                    username_template = "fbm2_{{.}}";
-                    personal_filtering_spaces = true;
-                    delivery_receipts = true;
-                    management_room_text.welcome = "Hello, I'm a Messenger bridge bot.";
-                    command_prefix = "!fbm";
-                    login_shared_secret_map."nul.ie" = "$MAU_FBM_DOUBLE_PUPPET_TOKEN";
-                    backfill = {
-                      history_fetch_pages = 5;
-                    };
-                    encryption = {
-                      allow = true;
-                      default = true;
-                      require = true;
-                    };
-                    permissions = {
-                      "@dev:nul.ie" = "admin";
-                    };
-                  };
-                };
-              };
-
-              instagram = {
-                enable = true;
-                registerToSynapse = true;
-                dataDir = "mautrix-instagram";
-                environmentFile = config.age.secrets."chatterbox/mautrix-instagram.env".path;
-                settings = {
-                  homeserver = {
-                    address = "http://localhost:8008";
-                    domain = "nul.ie";
-                  };
-                  appservice = {
-                    database = {
-                      type = "postgres";
-                      uri = "$MAU_IG_PSQL_URI";
-                    };
-                    id = "instagram";
-                    bot = {
-                      username = "instagram";
-                      displayname = "Instagram Bridge Bot";
-                      avatar = "mxc://maunium.net/JxjlbZUlCPULEeHZSwleUXQv";
-                    };
-                  };
-                  network = {
-                    mode = "instagram";
-                    displayname_template = ''{{or .DisplayName .Username "Unknown user"}} (IG)'';
-                  };
-                  bridge = {
-                    username_template = "ig_{{.}}";
-                    personal_filtering_spaces = true;
-                    delivery_receipts = true;
-                    management_room_text.welcome = "Hello, I'm an Instagram bridge bot.";
-                    command_prefix = "!ig";
-                    login_shared_secret_map."nul.ie" = "$MAU_IG_DOUBLE_PUPPET_TOKEN";
-                    backfill = {
-                      history_fetch_pages = 5;
-                    };
-                    encryption = {
-                      allow = true;
-                      default = true;
-                      require = true;
-                    };
-                    permissions = {
-                      "@dev:nul.ie" = "admin";
-                    };
-                  };
-                };
-              };
-            };
           };
         }
         (mkIf config.my.build.isDevVM {

nixos/boxes/colony/vms/shill/containers/default.nix

@@ -8,6 +8,5 @@
     ./object.nix
     ./toot.nix
     ./waffletail.nix
-    ./qclk
   ];
 }

nixos/boxes/colony/vms/shill/containers/jackflix/default.nix

@@ -1,8 +1,6 @@
 { lib, ... }:
 let
-  inherit (lib) concatStringsSep;
   inherit (lib.my) net;
-  inherit (lib.my.c) pubDomain;
   inherit (lib.my.c.colony) domain prefixes;
 in
 {
@@ -37,9 +35,6 @@ in
 
           secrets = {
             key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPUv1ntVrZv5ripsKpcOAnyDQX2PHjowzyhqWK10Ml53";
-            files = {
-              "jackflix/photoprism-pass.txt" = {};
-            };
           };
         };
 
@@ -55,16 +50,10 @@ in
               uid = uids.jellyseerr;
               group = "jellyseerr";
             };
-            photoprism = {
-              isSystemUser = true;
-              uid = uids.photoprism;
-              group = "photoprism";
-            };
           };
           groups = {
             media.gid = 2000;
             jellyseerr.gid = gids.jellyseerr;
-            photoprism.gid = gids.photoprism;
           };
         };
 
@@ -87,21 +76,9 @@ in
               RootDirectoryStartOnly = lib.mkForce false;
               RootDirectory = lib.mkForce "";
             };
-            photoprism.serviceConfig = {
-              # Needs to be able to access its data
-              DynamicUser = mkForce false;
-            };
           };
         };
 
-        nixpkgs.config.permittedInsecurePackages = [
-          # FIXME: This is needed for Sonarr
-          "aspnetcore-runtime-wrapped-6.0.36"
-          "aspnetcore-runtime-6.0.36"
-          "dotnet-sdk-wrapped-6.0.428"
-          "dotnet-sdk-6.0.428"
-        ];
-
         services = {
           netdata.enable = true;
 
@@ -140,24 +117,6 @@ in
           };
 
           jellyfin.enable = true;
-
-          photoprism = {
-            enable = true;
-            address = "[::]";
-            port = 2342;
-            originalsPath = "/mnt/media/photoprism/originals";
-            importPath = "/mnt/media/photoprism/import";
-            passwordFile = config.age.secrets."jackflix/photoprism-pass.txt".path;
-            settings = {
-              PHOTOPRISM_AUTH_MODE = "password";
-              PHOTOPRISM_ADMIN_USER = "dev";
-              PHOTOPRISM_APP_NAME = "/dev/player0 Photos";
-              PHOTOPRISM_SITE_URL = "https://photos.${pubDomain}/";
-              PHOTOPRISM_SITE_TITLE = "/dev/player0 Photos";
-              PHOTOPRISM_TRUSTED_PROXY = concatStringsSep "," (with prefixes.ctrs; [ v4 v6 ]);
-              PHOTOPRISM_DATABASE_DRIVER = "sqlite";
-            };
-          };
         };
       };
     };

nixos/boxes/colony/vms/shill/containers/jackflix/networking.nix

@@ -37,7 +37,7 @@ in
                 tcp dport ${toString transmissionPeerPort} accept
                 iifname vpn return
 
-                tcp dport { 19999, 9091, 9117, 7878, 8989, 8096, 2342 } accept
+                tcp dport { 19999, 9091, 9117, 7878, 8989, 8096 } accept
                 return
               }
               chain input {
@@ -71,12 +71,14 @@ in
               RouteTable = routeTable;
             };
             wireguardPeers = [
-              # AirVPN NL
               {
-                Endpoint = "2a00:1678:1337:2329:e5f:35d4:4404:ef9f:1637";
+                # AirVPN NL
-                PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
+                wireguardPeerConfig = {
-                PresharedKeyFile = config.age.secrets."${pskFile}".path;
+                  Endpoint = "2a00:1678:1337:2329:e5f:35d4:4404:ef9f:1637";
-                AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                  PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
+                  PresharedKeyFile = config.age.secrets."${pskFile}".path;
+                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                };
               }
             ];
           };
@@ -92,7 +94,7 @@ in
               matchConfig.Name = "vpn";
               address = [ "10.182.97.37/32" "fd7d:76ee:e68f:a993:735d:ef5e:6907:b122/128" ];
               dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = [
+              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                 {
                   Family = "both";
                   SuppressPrefixLength = 0;

nixos/boxes/colony/vms/shill/containers/middleman/default.nix

@@ -239,9 +239,6 @@ in
               ];
 
               recommendedTlsSettings = true;
-              recommendedBrotliSettings = true;
-              # Uh so nginx is hanging with zstd enabled... maybe let's not for now
-              # recommendedZstdSettings = true;
               clientMaxBodySize = "0";
               serverTokens = true;
               resolver = {
@@ -251,9 +248,6 @@ in
               proxyResolveWhileRunning = true;
               sslDhparam = config.age.secrets."dhparams.pem".path;
 
-              appendConfig = ''
-                worker_processes auto;
-              '';
               # Based on recommended*Settings, but probably better to be explicit about these
               appendHttpConfig = ''
                 ${baseHttpConfig}

nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix

@@ -2,7 +2,7 @@
 let
   inherit (builtins) mapAttrs toJSON;
   inherit (lib) mkMerge mkDefault genAttrs flatten concatStringsSep;
-  inherit (lib.my.c) pubDomain home;
+  inherit (lib.my.c) pubDomain;
   inherit (lib.my.c.nginx) proxyHeaders;
   inherit (config.networking) domain;
 
@@ -35,6 +35,7 @@ let
       # For clients
       (mkWellKnown "matrix/client" (toJSON {
         "m.homeserver".base_url = "https://matrix.nul.ie";
+        "org.matrix.msc3575.proxy".url = "https://matrix-syncv3.nul.ie";
       }))
     ];
   };
@@ -49,7 +50,6 @@ let
     "/.well-known/webfinger".return = "301 https://toot.nul.ie$request_uri";
     "/.well-known/nodeinfo".return = "301 https://toot.nul.ie$request_uri";
     "/.well-known/host-meta".return = "301 https://toot.nul.ie$request_uri";
-    "/.well-known/atproto-did".return = "301 https://pds.nul.ie$request_uri";
   };
 in
 {
@@ -80,10 +80,6 @@ in
                   sha256 = "018wh6ps19n7323fi44njzj9yd4wqslc90dykbwfyscv7bgxhlar";
                 };
               }
-              {
-                name = "ssh.pub";
-                path = lib.my.c.sshKeyFiles.me;
-              }
             ];
           }
           wellKnown
@@ -149,7 +145,7 @@ in
 
       "pass.${pubDomain}" =
       let
-        upstream = "http://vaultwarden-ctr.${domain}:8080";
+        upstream = "http://vaultwarden-ctr.${domain}";
       in
       {
         locations = {
@@ -186,6 +182,10 @@ in
         ];
         useACMEHost = pubDomain;
       };
+      "matrix-syncv3.${pubDomain}" = {
+        locations."/".proxyPass = "http://chatterbox-ctr.${domain}:8009";
+        useACMEHost = pubDomain;
+      };
 
       "element.${pubDomain}" =
       let
@@ -206,8 +206,7 @@ in
           # Currently it seems like single quotes aren't escaped like they should be...
           conf = {
             brand = "/dev/player0 Matrix";
-            show_labs_settings = true;
+            showLabsSettings = true;
-            default_country_code = "IE";
             disable_guests = true;
             default_server_config = {
               "m.homeserver" = {
@@ -215,8 +214,9 @@ in
                 server_name = "nul.ie";
               };
             };
-            room_directory.servers = [
+            roomDirectory.servers = [
               "nul.ie"
+              "netsoc.ie"
               "matrix.org"
             ];
           };
@@ -327,15 +327,6 @@ in
         useACMEHost = pubDomain;
       };
 
-      "pds.nul.ie" = {
-        locations."/" = {
-          proxyPass = "http://toot-ctr.${domain}:3000";
-          proxyWebsockets = true;
-          extraConfig = proxyHeaders;
-        };
-        useACMEHost = pubDomain;
-      };
-
       "share.${pubDomain}" = {
         locations."/" = {
           proxyPass = "http://object-ctr.${domain}:9090";
@@ -357,8 +348,6 @@ in
         useACMEHost = pubDomain;
       };
       "public.${pubDomain}" = {
-        onlySSL = false;
-        addSSL = true;
         serverAliases = [ "p.${pubDomain}" ];
         locations."/" = {
           root = "/mnt/media/public";
@@ -375,7 +364,7 @@ in
         useACMEHost = pubDomain;
       };
       "mc-rail.${pubDomain}" = {
-        locations."/".proxyPass = "http://simpcraft-oci.${domain}:3876";
+        locations."/".proxyPass = "http://simpcraft-staging-oci.${domain}:3876";
         useACMEHost = pubDomain;
       };
 
@@ -395,48 +384,6 @@ in
         };
         useACMEHost = pubDomain;
       };
-      "pb.${pubDomain}" = {
-        locations."/".proxyPass = "http://object-ctr.${domain}:8088";
-        useACMEHost = pubDomain;
-      };
-      "photos.${pubDomain}" = {
-        locations."/" = {
-          proxyPass = "http://jackflix-ctr.${domain}:2342";
-          proxyWebsockets = true;
-          extraConfig = proxyHeaders;
-        };
-        useACMEHost = pubDomain;
-      };
-
-      "pront.${pubDomain}" = mkMerge [
-        {
-          locations."/" = mkMerge [
-            {
-              proxyPass = "http://stream-hi.${home.domain}:5000";
-              proxyWebsockets = true;
-              extraConfig = proxyHeaders;
-            }
-            (ssoLoc "generic")
-          ];
-          locations."~* ^/webcam/(.*)" = mkMerge [
-            {
-              proxyPass = "http://stream-hi.${home.domain}:5050/$1$is_args$args";
-              extraConfig = proxyHeaders;
-            }
-            (ssoLoc "generic")
-          ];
-          useACMEHost = pubDomain;
-        }
-        (ssoServer "generic")
-      ];
-      "hass.${pubDomain}" = {
-        locations."/" = {
-          proxyPass = "http://hass-ctr.${home.domain}:8123";
-          proxyWebsockets = true;
-          extraConfig = proxyHeaders;
-        };
-        useACMEHost = pubDomain;
-      };
     };
 
     minio =
@@ -448,13 +395,10 @@ in
         ignore_invalid_headers off;
       '';
 
-      nixCacheableRegex = ''^\/(\S+\.narinfo|nar\/\S+\.nar.*|serve\/.+)$'';
+      nixCacheableRegex = ''^\/(\S+\.narinfo|nar\/\S+\.nar\.\S+)$'';
       nixCacheHeaders = ''
         add_header Cache-Control $nix_cache_control;
         add_header Expires $nix_expires;
-
-        brotli on;
-        brotli_types application/x-nix-archive;
       '';
     in
     {
@@ -496,11 +440,9 @@ in
 
       "nix-cache.${pubDomain}" = {
         locations = {
-          "/" = {
+          "/".proxyPass = "http://${host}:8069";
-            proxyPass = "http://${host}:5000";
-          };
           "~ ${nixCacheableRegex}" = {
-            proxyPass = "http://${host}:5000";
+            proxyPass = "http://${host}:8069";
             extraConfig = nixCacheHeaders;
           };
         };

nixos/boxes/colony/vms/shill/containers/object.nix

@@ -31,13 +31,6 @@ in
     {
       config = mkMerge [
         {
-          fileSystems = {
-            "/var/lib/harmonia" = {
-              device = "/mnt/nix-cache";
-              options = [ "bind" ];
-            };
-          };
-
           my = {
             deploy.enable = false;
             server.enable = true;
@@ -55,9 +48,7 @@ in
                   group = config.my.user.config.group;
                 };
                 "object/atticd.env" = {};
-                "nix-cache.key" = {};
                 "object/hedgedoc.env" = {};
-                "object/wastebin.env" = {};
               };
             };
 
@@ -66,9 +57,7 @@ in
                 9000 9001
                 config.services.sharry.config.bind.port
                 8069
-                5000
                 config.services.hedgedoc.settings.port
-                8088
               ];
             };
 
@@ -77,26 +66,14 @@ in
             };
           };
 
-          users = with lib.my.c.ids; mkMerge [
+          users = with lib.my.c.ids; let inherit (config.services.atticd) user group; in {
-            (let inherit (config.services.atticd) user group; in {
+            users."${user}" = {
-              users."${user}" = {
+              isSystemUser = true;
-                isSystemUser = true;
+              uid = uids.atticd;
-                uid = uids.atticd;
+              group = group;
-                group = group;
+            };
-              };
+            groups."${user}".gid = gids.atticd;
-              groups."${user}".gid = gids.atticd;
+          };
-            })
-            {
-              users = {
-                harmonia = {
-                  shell = pkgs.bashInteractive;
-                  openssh.authorizedKeys.keyFiles = [
-                    lib.my.c.sshKeyFiles.harmonia
-                  ];
-                };
-              };
-            }
-          ];
 
           systemd = {
             network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
@@ -114,9 +91,7 @@ in
                   MINIO_BROWSER_REDIRECT_URL = "https://minio.nul.ie";
                 };
               };
-
               sharry = awaitPostgres;
-
               atticd = mkMerge [
                 awaitPostgres
                 {
@@ -127,15 +102,6 @@ in
                   };
                 }
               ];
-              harmonia = {
-                environment.NIX_REMOTE = "/var/lib/harmonia";
-                preStart = ''
-                  ${config.nix.package}/bin/nix store ping
-                '';
-                serviceConfig = {
-                  StateDirectory = "harmonia";
-                };
-              };
             };
           };
 
@@ -215,8 +181,8 @@ in
             };
 
             atticd = {
-              enable = false;
+              enable = true;
-              environmentFile = config.age.secrets."object/atticd.env".path;
+              credentialsFile = config.age.secrets."object/atticd.env".path;
               settings = {
                 listen = "[::]:8069";
                 allowed-hosts = [ "nix-cache.${pubDomain}" ];
@@ -235,14 +201,6 @@ in
               };
             };
 
-            harmonia = {
-              enable = true;
-              signKeyPaths = [ config.age.secrets."nix-cache.key".path ];
-              settings = {
-                priority = 30;
-              };
-            };
-
             hedgedoc = {
               enable = true;
               environmentFile = config.age.secrets."object/hedgedoc.env".path;
@@ -262,15 +220,6 @@ in
                 allowEmailRegister = false;
               };
             };
-
-            wastebin = {
-              enable = true;
-              settings = {
-                WASTEBIN_MAX_BODY_SIZE = 67108864; # 16 MiB
-                WASTEBIN_PASSWORD_SALT = "TeGhaemeer0Siez3";
-              };
-              secretFile = config.age.secrets."object/wastebin.env".path;
-            };
           };
         }
         (mkIf config.my.build.isDevVM {

nixos/boxes/colony/vms/shill/containers/qclk/default.nix

@@ -1,115 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c.colony) domain prefixes qclk;
-in
-{
-  nixos.systems.qclk = { config, ... }: {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    rendered = config.configuration.config.my.asContainer;
-
-    assignments = {
-      internal = {
-        name = "qclk-ctr";
-        inherit domain;
-        ipv4.address = net.cidr.host 10 prefixes.ctrs.v4;
-        ipv6 = {
-          iid = "::a";
-          address = net.cidr.host 10 prefixes.ctrs.v6;
-        };
-      };
-      qclk = {
-        ipv4 = {
-          address = net.cidr.host 1 prefixes.qclk.v4;
-          gateway = null;
-        };
-      };
-    };
-
-    configuration = { lib, pkgs, config, assignments, ... }:
-    let
-      inherit (lib) concatStringsSep mkMerge mkIf mkForce;
-      inherit (lib.my) networkdAssignment;
-
-      apiPort = 8080;
-
-      instances = [
-        {
-          host = 2;
-          wgKey = "D7z1FhcdxpnrGCE0wBW5PZb5BKuhCu6tcZ/5ZaYxdwQ=";
-        }
-      ];
-      ipFor = i: net.cidr.host i.host prefixes.qclk.v4;
-    in
-    {
-      config = {
-        environment = {
-          systemPackages = with pkgs; [
-            wireguard-tools
-          ];
-        };
-
-        my = {
-          deploy.enable = false;
-          server.enable = true;
-
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC1kcfvahYmSk8IJKaUIcGkhxf/8Yse2XnU7Qqgcglyq";
-            files = {
-              "qclk/wg.key" = {
-                group = "systemd-network";
-                mode = "440";
-              };
-            };
-          };
-
-          firewall = {
-            udp.allowed = [ qclk.wgPort ];
-            extraRules = ''
-              table inet filter {
-                chain input {
-                  iifname management tcp dport ${toString apiPort} accept
-                }
-                chain forward {
-                  iifname host0 oifname management ip saddr { ${concatStringsSep ", " lib.my.c.as211024.trusted.v4} } accept
-                }
-              }
-              table inet nat {
-                chain postrouting {
-                  iifname host0 oifname management snat ip to ${assignments.qclk.ipv4.address}
-                }
-              }
-            '';
-          };
-        };
-
-        systemd = {
-          network = {
-            netdevs."30-management" = {
-              netdevConfig = {
-                Name = "management";
-                Kind = "wireguard";
-              };
-              wireguardConfig = {
-                PrivateKeyFile = config.age.secrets."qclk/wg.key".path;
-                ListenPort = qclk.wgPort;
-              };
-              wireguardPeers = map (i: {
-                PublicKey = i.wgKey;
-                AllowedIPs = [ (ipFor i) ];
-              }) instances;
-            };
-            networks = {
-              "30-container-host0" = networkdAssignment "host0" assignments.internal;
-
-              "30-management" = networkdAssignment "management" assignments.qclk;
-            };
-          };
-        };
-
-        services = { };
-      };
-    };
-  };
-}

nixos/boxes/colony/vms/shill/containers/toot.nix

@@ -26,8 +26,6 @@ in
     let
       inherit (lib) mkMerge mkIf genAttrs;
       inherit (lib.my) networkdAssignment systemdAwaitPostgres;
-
-      pdsPort = 3000;
     in
     {
       config = mkMerge [
@@ -38,7 +36,7 @@ in
 
             secrets = {
               key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILSslLkDe54AKYzxdtKD70zcU72W0EpYsfbdJ6UFq0QK";
-              files = (genAttrs
+              files = genAttrs
                 (map (f: "toot/${f}") [
                   "postgres-password.txt"
                   "secret-key.txt"
@@ -50,12 +48,7 @@ in
                 (_: with config.services.mastodon; {
                   owner = user;
                   inherit group;
-                })) // {
+                });
-                  "toot/pds.env" = {
-                    owner = "pds";
-                    group = "pds";
-                  };
-                };
             };
 
             firewall = {
@@ -63,7 +56,6 @@ in
                 19999
 
                 "http"
-                pdsPort
               ];
             };
           };
@@ -163,32 +155,6 @@ in
                 };
               };
             };
-
-            pds = {
-              enable = true;
-              environmentFiles = [ config.age.secrets."toot/pds.env".path ];
-              settings = {
-                PDS_HOSTNAME = "pds.nul.ie";
-                PDS_PORT = pdsPort;
-
-                PDS_BLOBSTORE_DISK_LOCATION = null;
-                PDS_BLOBSTORE_S3_BUCKET = "pds";
-                PDS_BLOBSTORE_S3_ENDPOINT = "https://s3.nul.ie/";
-                PDS_BLOBSTORE_S3_REGION = "eu-central-1";
-                PDS_BLOBSTORE_S3_ACCESS_KEY_ID = "pds";
-                PDS_BLOB_UPLOAD_LIMIT = "52428800";
-
-                PDS_EMAIL_FROM_ADDRESS = "pds@nul.ie";
-
-                PDS_DID_PLC_URL = "https://plc.directory";
-                PDS_INVITE_REQUIRED = 1;
-                PDS_BSKY_APP_VIEW_URL = "https://api.bsky.app";
-                PDS_BSKY_APP_VIEW_DID = "did:web:api.bsky.app";
-                PDS_REPORT_SERVICE_URL = "https://mod.bsky.app";
-                PDS_REPORT_SERVICE_DID = "did:plc:ar7c4by46qjdydhdevvrndac";
-                PDS_CRAWLERS = "https://bsky.network";
-              };
-            };
           };
         }
         (mkIf config.my.build.isDevVM {

nixos/boxes/colony/vms/shill/containers/vaultwarden.nix

@@ -83,7 +83,7 @@ in
                 DOMAIN = "https://pass.${lib.my.c.pubDomain}";
 
                 ROCKET_ADDRESS = "::";
-                ROCKET_PORT = 8080;
+                ROCKET_PORT = 80;
 
                 SMTP_HOST = "mail.nul.ie";
                 SMTP_FROM = "pass@nul.ie";
@@ -99,8 +99,6 @@ in
             };
 
             borgbackup.jobs.vaultwarden = {
-              readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];
-
               paths = [ vwData ];
               repo = "zh2855@zh2855.rsync.net:borg/vaultwarden2";
               doInit = true;

nixos/boxes/colony/vms/shill/containers/waffletail.nix

@@ -86,7 +86,7 @@ in
             interfaceName = "tailscale0";
             extraUpFlags = [
               "--operator=${config.my.user.config.name}"
-              "--login-server=https://hs.nul.ie"
+              "--login-server=https://ts.nul.ie"
               "--netfilter-mode=off"
               "--advertise-exit-node"
               "--advertise-routes=${advRoutes}"

nixos/boxes/colony/vms/shill/default.nix

@@ -49,11 +49,7 @@ in
         inherit (lib.my) networkdAssignment;
       in
       {
-        imports = [
+        imports = [ "${modulesPath}/profiles/qemu-guest.nix" ];
-          "${modulesPath}/profiles/qemu-guest.nix"
-
-          ./containers-ext.nix
-        ];
 
         config = mkMerge [
           {
@@ -94,8 +90,8 @@ in
                 device = "/dev/disk/by-label/minio";
                 fsType = "xfs";
               };
-              "/mnt/nix-cache" = {
+              "/mnt/atticd" = {
-                device = "/dev/disk/by-label/nix-cache";
+                device = "/dev/disk/by-label/atticd";
                 fsType = "ext4";
               };
             };
@@ -140,10 +136,10 @@ in
                     };
                     ipv6Prefixes = [
                       {
-                        Prefix = prefixes.ctrs.v6;
+                        ipv6PrefixConfig.Prefix = prefixes.ctrs.v6;
                       }
                     ];
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                       {
                         Destination = lib.my.c.tailscale.prefix.v4;
                         Gateway = allAssignments.waffletail.internal.ipv4.address;
@@ -152,11 +148,6 @@ in
                         Destination = lib.my.c.tailscale.prefix.v6;
                         Gateway = allAssignments.waffletail.internal.ipv6.address;
                       }
-
-                      {
-                        Destination = prefixes.qclk.v4;
-                        Gateway = allAssignments.qclk.internal.ipv4.address;
-                      }
                     ];
                   }
                 ];
@@ -211,12 +202,11 @@ in
                   object = {
                     bindMounts = {
                       "/mnt/minio".readOnly = false;
-                      "/mnt/nix-cache".readOnly = false;
+                      "/mnt/atticd".readOnly = false;
                     };
                   };
                   toot = {};
                   waffletail = {};
-                  qclk = {};
                 };
               in
               mkMerge [

nixos/boxes/colony/vms/whale2/default.nix

@@ -52,8 +52,6 @@ in
       valheim-oci = 2;
       simpcraft-oci = 3;
       simpcraft-staging-oci = 4;
-      enshrouded-oci = 5;
-      kevcraft-oci = 6;
     };
 
     configuration = { lib, pkgs, modulesPath, config, assignments, allAssignments, ... }:
@@ -68,7 +66,6 @@ in
 
           ./valheim.nix
           ./minecraft
-          # ./enshrouded.nix
         ];
 
         config = mkMerge [
@@ -111,30 +108,45 @@ in
               oci-containers = {
                 backend = "podman";
               };
-              containers.containersConf.settings.network = {
+              # NixOS has switched to using netavark, which is native to podman. It's currently missing an option to
-                network_backend = "netavark";
+              # disable iptables rules generation, which is very annoying.
-                firewall_driver = "none";
+              containers.containersConf.settings.network.network_backend = mkForce "cni";
-              };
             };
 
             environment = {
               etc = {
-                "containers/networks/colony.json".text = toJSON {
+                "cni/net.d/90-colony.conflist".text = toJSON {
+                  cniVersion = "0.4.0";
                   name = "colony";
-                  id = "0000000000000000000000000000000000000000000000000000000000000001";
+                  plugins = [
-                  driver = "bridge";
-                  network_interface = "oci";
-                  ipv6_enabled = true;
-                  internal = false;
-                  dns_enabled = false;
-                  subnets = [
                     {
-                      subnet = prefixes.oci.v4;
+                      type = "bridge";
-                      gateway = net.cidr.host 1 prefixes.oci.v4;
+                      bridge = "oci";
-                    }
+                      isGateway = true;
-                    {
+                      ipMasq = false;
-                      subnet = prefixes.oci.v6;
+                      hairpinMode = true;
-                      gateway = net.cidr.host 1 prefixes.oci.v6;
+                      ipam = {
+                        type = "host-local";
+                        routes = [
+                          { dst = "0.0.0.0/0"; }
+                          { dst = "::/0"; }
+                        ];
+                        ranges = [
+                          [
+                            {
+                              subnet = prefixes.oci.v4;
+                              gateway = net.cidr.host 1 prefixes.oci.v4;
+                            }
+                          ]
+                          [
+                            {
+                              subnet = prefixes.oci.v6;
+                              gateway = net.cidr.host 1 prefixes.oci.v6;
+                            }
+                          ]
+                        ];
+                      };
+                      capabilities.ips = true;
                     }
                   ];
                 };

nixos/boxes/colony/vms/whale2/enshrouded.nix

@@ -1,35 +0,0 @@
-{ lib, config, allAssignments, ... }:
-let
-  inherit (lib) concatStringsSep;
-  inherit (lib.my) dockerNetAssignment;
-in
-{
-  config = {
-    virtualisation.oci-containers.containers = {
-      enshrouded = {
-        image = "sknnr/enshrouded-dedicated-server@sha256:f163e8ba9caa2115d8a0a7b16c3696968242fb6fba82706d9a77a882df083497";
-
-        environment = {
-          SERVER_NAME = "UWUshrouded";
-          # SERVER_IP = "::"; # no IPv6?? :(
-          TZ = "Europe/Dublin";
-        };
-        environmentFiles = [ config.age.secrets."whale2/enshrouded.env".path ];
-
-        volumes = [
-          "enshrouded:/home/steam/enshrouded/savegame"
-        ];
-
-        extraOptions = [
-          ''--network=colony:${dockerNetAssignment allAssignments "enshrouded-oci"}''
-        ];
-      };
-    };
-
-    my = {
-      secrets.files = {
-        "whale2/enshrouded.env" = {};
-      };
-    };
-  };
-}

nixos/boxes/colony/vms/whale2/minecraft/default.nix

@@ -5,13 +5,12 @@ let
 
   # devplayer0
   op = "6d7d971b-ce10-435b-85c5-c99c0d8d288c";
-  kev = "703b378a-09f9-4c1d-9876-1c9305728c49";
   whitelist = concatStringsSep "," [
     op
     "dcd2ecb9-2b5e-49cb-9d4f-f5a76162df56" # Elderlypug
     "fcb26db2-c3ce-41aa-b588-efec79d37a8a" # Jesthral_
     "1d366062-12c0-4e29-aba7-6ab5d8c6bb05" # shr3kas0ras
-    kev
+    "703b378a-09f9-4c1d-9876-1c9305728c49" # OROURKEIRE
     "f105bbe6-eda6-4a13-a8cf-894e77cab77b" # Adzerq
     "1fc94979-41fb-497a-81e9-34ae24ca537a" # johnnyscrims
     "d53c91df-b6e6-4463-b106-e8427d7a8d01" # BossLonus
@@ -26,20 +25,22 @@ let
       	email = "simpcraft@nul.ie"
       	name = "Simpcraft bot"
     '';
+    knownHosts = pkgs.writeText "known_hosts" ''
+      git.nul.ie ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBD023ECzYmLeXIpcGVaciPjq6UN/Sjmsys5HP/Nei5GkrUZqPa3OJ2uSXKLUSKGYdeNhxaFTPJe8Yx3TsZxMme8=
+    '';
   };
 in
 {
   config = {
     virtualisation.oci-containers.containers = {
       simpcraft = {
-        image = "git.nul.ie/dev/craftblock:2024.1.0-java17-alpine";
+        image = "ghcr.io/itzg/minecraft-server:2023.12.2-java17-alpine";
 
         environment = {
           TYPE = "MODRINTH";
 
           EULA = "true";
           ENABLE_QUERY = "true";
-          ENABLE_RCON = "true";
           MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t §4§k-----";
           ICON = "/ext/icon.png";
 
@@ -51,17 +52,15 @@ in
           SPAWN_PROTECTION = "0";
           VIEW_DISTANCE = "20";
 
-          MAX_MEMORY = "8G";
+          MAX_MEMORY = "6G";
-          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/NGutsQSd/Simpcraft-0.2.1.mrpack";
+          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/cdj2bSKg/Simpcraft-0.1.2.mrpack";
 
           TZ = "Europe/Dublin";
         };
-        environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
 
         volumes = [
           "minecraft_data:/data"
           "${./icon.png}:/ext/icon.png:ro"
-          "${fastback.gitConfig}:/data/.config/git/config:ro"
         ];
 
         extraOptions = [
@@ -69,118 +68,53 @@ in
         ];
       };
 
-      # simpcraft-staging = {
+      simpcraft-staging = {
-      #   image = "git.nul.ie/dev/craftblock:2024.1.0-java17-alpine";
+        image = "git.nul.ie/dev/craftblock:2024.1.0-java17-alpine";
-
-      #   environment = {
-      #     TYPE = "MODRINTH";
-
-      #     EULA = "true";
-      #     ENABLE_QUERY = "true";
-      #     ENABLE_RCON = "true";
-      #     MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t [staging] §4§k-----";
-      #     ICON = "/ext/icon.png";
-
-      #     EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
-      #     WHITELIST = whitelist;
-      #     EXISTING_OPS_FILE = "SYNCHRONIZE";
-      #     OPS = op;
-      #     DIFFICULTY = "normal";
-      #     SPAWN_PROTECTION = "0";
-      #     VIEW_DISTANCE = "20";
-
-      #     MAX_MEMORY = "4G";
-      #     MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/Ym3sIi6H/Simpcraft-0.2.0.mrpack";
-
-      #     TZ = "Europe/Dublin";
-      #   };
-      #   environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
-
-      #   volumes = [
-      #     "minecraft_staging_data:/data"
-      #     "${./icon.png}:/ext/icon.png:ro"
-      #   ];
-
-      #   extraOptions = [
-      #     ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-staging-oci"}''
-      #   ];
-      # };
-
-      kevcraft = {
-        # 2025.2.1-java21-alpine
-        image = "itzg/minecraft-server@sha256:57e319c15e9fee63f61029a65a33acc3de85118b21a2b4bb29f351cf4a915027";
 
         environment = {
-          TYPE = "VANILLA";
+          TYPE = "MODRINTH";
-          VERSION = "1.20.1";
-          SERVER_PORT = "25567";
-          QUERY_PORT = "25567";
 
           EULA = "true";
           ENABLE_QUERY = "true";
           ENABLE_RCON = "true";
-          MOTD = "§4§k----- §9K§ae§bv§cc§dr§ea§ff§6t §4§k-----";
+          MOTD = "§4§k----- §9S§ai§bm§cp§dc§er§fa§6f§5t [staging] §4§k-----";
           ICON = "/ext/icon.png";
 
           EXISTING_WHITELIST_FILE = "SYNCHRONIZE";
           WHITELIST = whitelist;
           EXISTING_OPS_FILE = "SYNCHRONIZE";
-          OPS = concatStringsSep "," [ op kev ];
+          OPS = op;
           DIFFICULTY = "normal";
           SPAWN_PROTECTION = "0";
-          # VIEW_DISTANCE = "20";
+          VIEW_DISTANCE = "20";
 
           MAX_MEMORY = "4G";
+          MODRINTH_MODPACK = "https://cdn.modrinth.com/data/CIYf3Hk8/versions/Ym3sIi6H/Simpcraft-0.2.0.mrpack";
 
           TZ = "Europe/Dublin";
         };
         environmentFiles = [ config.age.secrets."whale2/simpcraft.env".path ];
 
         volumes = [
-          "kevcraft_data:/data"
+          "minecraft_staging_data:/data"
-          "${./kev.png}:/ext/icon.png:ro"
+          "${./icon.png}:/ext/icon.png:ro"
+          "${fastback.gitConfig}:/data/.config/git/config:ro"
+          "${fastback.knownHosts}:/data/.ssh/known_hosts:ro"
+          "${config.age.secrets."whale2/simpcraft-git.key".path}:/data/.ssh/id_rsa"
         ];
 
         extraOptions = [
-          ''--network=colony:${dockerNetAssignment allAssignments "kevcraft-oci"}''
+          ''--network=colony:${dockerNetAssignment allAssignments "simpcraft-staging-oci"}''
         ];
       };
     };
 
-    services = {
-      borgbackup.jobs.simpcraft =
-      let
-        rconCommand = cmd: ''${pkgs.mcrcon}/bin/mcrcon -H simpcraft-oci -p "$RCON_PASSWORD" "${cmd}"'';
-      in
-      {
-        paths = [ "/var/lib/containers/storage/volumes/minecraft_data/_data/world" ];
-        repo = "/var/lib/containers/backup/simpcraft";
-        doInit = true;
-        encryption.mode = "none";
-        compression = "zstd,10";
-        # every ~15 minutes offset from 5 minute intervals (Minecraft seems to save at precise times?)
-        startAt = "*:03,17,33,47";
-        prune.keep = {
-          within = "12H";
-          hourly = 48;
-        };
-        readWritePaths = [ "/var/lib/borgbackup" "/var/cache/borgbackup" ];
-
-        # Avoid Minecraft poking the files while we back up
-        preHook = rconCommand "save-off";
-        postHook = rconCommand "save-on";
-      };
-    };
-
-    systemd = {
-      services = {
-        borgbackup-job-simpcraft.serviceConfig.EnvironmentFile = [ config.age.secrets."whale2/simpcraft.env".path ];
-      };
-    };
-
     my = {
       secrets.files = {
         "whale2/simpcraft.env" = {};
+        "whale2/simpcraft-git.key" = {
+          owner = "1000";
+        };
       };
     };
   };

nixos/boxes/home/palace/default.nix

@@ -94,7 +94,7 @@ in
             extraOptions = [ "-A /var/log/smartd/" "--interval=600" ];
           };
           udev.extraRules = ''
-            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="4"
+            ACTION=="add", SUBSYSTEM=="net", ENV{ID_NET_DRIVER}=="mlx5_core", ENV{ID_PATH}=="pci-0000:44:00.0", ATTR{device/sriov_numvfs}="3"
           '';
         };
 
@@ -188,13 +188,6 @@ in
                   VLANId=${toString vlans.hi}
                   LinkState=yes
                   MACAddress=52:54:00:ac:15:a9
-
-                  # sfh bridge
-                  [SR-IOV]
-                  VirtualFunction=3
-                  VLANId=${toString vlans.hi}
-                  LinkState=yes
-                  MACAddress=52:54:00:90:34:95
                 '';
               };
               "60-lan-hi" = networkdAssignment "lan-hi" assignments.hi;

nixos/boxes/home/palace/vms/cellar/default.nix

@@ -66,7 +66,6 @@ in
             ];
 
             services = {
-              fstrim.enable = true;
               netdata.enable = true;
             };
 

nixos/boxes/home/palace/vms/cellar/spdk.nix

@@ -129,12 +129,6 @@ in
             hostnqn =
               "nqn.2014-08.org.nvmexpress:uuid:2230b066-a674-4f45-a1dc-f7727b3a9e7b";
             serial = "SPDK00000000000002";
-          }) ++ (nvmfBdev {
-            bdev = "NVMeRaidp3";
-            nqn = "nqn.2016-06.io.spdk:sfh";
-            hostnqn =
-              "nqn.2014-08.org.nvmexpress:uuid:85d7df36-0de0-431b-b06e-51f7c0a455b4";
-            serial = "SPDK00000000000003";
           });
         };
       };

nixos/boxes/home/palace/vms/default.nix

@@ -2,7 +2,6 @@
   imports = [
     ./cellar
     ./river.nix
-    ./sfh
   ];
 
   nixos.systems.palace.configuration = { lib, pkgs, config, systems, allAssignments, ... }:
@@ -58,11 +57,11 @@
 
     systemd.services =
     let
-      awaitVM = system: {
+      awaitCellar = {
-        after = [ "vm@${system}.service" ];
+        after = [ "vm@cellar.service" ];
-        bindsTo = [ "vm@${system}.service" ];
+        bindsTo = [ "vm@cellar.service" ];
         preStart = ''
-          until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.${system}.hi.ipv4.address} 22; do
+          until ${pkgs.netcat}/bin/nc -w1 -z ${allAssignments.cellar.hi.ipv4.address} 22; do
             sleep 1
           done
         '';
@@ -82,13 +81,13 @@
         vtapUnit = "sys-subsystem-net-devices-vm\\x2det1g0.device";
       in
       mkMerge [
-        (awaitVM "cellar")
+        awaitCellar
         {
           requires = [ vtapUnit ];
           after = [ vtapUnit ];
         }
       ];
-      "vm@sfh" = (awaitVM "river");
+      "vm@sfh" = awaitCellar;
     };
 
     my = {
@@ -183,18 +182,7 @@
                 index = 0;
                 hostBDF = "44:00.3";
               };
-              et100g0vf3 = {
-                index = 1;
-                hostBDF = "44:00.4";
-              };
             };
-            qemuFlags = [
-              "device qemu-xhci,id=xhci"
-              # Front-right port?
-              "device usb-host,hostbus=1,hostport=4"
-              # Front-left port
-              "device usb-host,hostbus=1,hostport=3"
-            ];
           };
         };
       };

nixos/boxes/home/palace/vms/river.nix

@@ -10,7 +10,18 @@
     let
       inherit (lib.my) networkdAssignment mkVLAN;
       inherit (lib.my.c) networkd;
-      inherit (lib.my.c.home) vlans domain prefixes roceBootModules;
+      inherit (lib.my.c.home) vlans;
+
+      lanLink = {
+        matchConfig = {
+          Driver = "mlx5_core";
+          PermanentMACAddress = "52:54:00:8a:8a:f2";
+        };
+        linkConfig = {
+          Name = "lan";
+          MTUBytes = toString lib.my.c.home.hiMTU;
+        };
+      };
     in
     {
       imports = [
@@ -19,17 +30,29 @@
 
       config = {
         boot = {
-          kernelModules = [ "kvm-amd" ];
+          kernelModules = [ "kvm-intel" ];
           kernelParams = [ "console=ttyS0,115200n8" ];
           initrd = {
             availableKernelModules = [
               "virtio_pci" "ahci" "sr_mod" "virtio_blk"
-              "8021q"
+              "ib_core" "ib_uverbs" "mlx5_core" "mlx5_ib" "8021q"
-            ] ++ roceBootModules;
+              "rdma_cm" "iw_cm" "ib_cm" "nvme_core" "nvme_rdma"
-            kernelModules = [ "dm-snapshot" ];
+            ];
+            kernelModules = [ "dm-snapshot" "nvme-fabrics" ];
             systemd = {
+              extraBin = with pkgs; {
+                dmesg = "${util-linux}/bin/dmesg";
+                ip = "${iproute2}/bin/ip";
+              };
+              extraConfig = ''
+                DefaultTimeoutStartSec=50
+                DefaultDeviceTimeoutSec=50
+              '';
               network = {
-                # Don't need to put the link config here, they're copied from main config
+                enable = true;
+                wait-online.enable = true;
+
+                links."10-lan" = lanLink;
                 netdevs = mkVLAN "lan-hi" vlans.hi;
                 networks = {
                   "20-lan" = {
@@ -47,6 +70,9 @@
 
         hardware = {
           enableRedistributableFirmware = true;
+          cpu = {
+            intel.updateMicrocode = true;
+          };
         };
 
         fileSystems = {
@@ -70,7 +96,6 @@
             boot.thin.enable = true;
             dmeventd.enable = true;
           };
-          fstrim.enable = true;
         };
 
         systemd.network = {
@@ -89,16 +114,7 @@
               };
             };
 
-            "10-lan" = {
+            "10-lan" = lanLink;
-              matchConfig = {
-                Driver = "mlx5_core";
-                PermanentMACAddress = "52:54:00:8a:8a:f2";
-              };
-              linkConfig = {
-                Name = "lan";
-                MTUBytes = toString lib.my.c.home.hiMTU;
-              };
-            };
           };
 
           # So we don't drop the IP we use to connect to NVMe-oF!
@@ -118,14 +134,6 @@
             };
           };
 
-          netboot.server = {
-            enable = true;
-            ip = assignments.lo.ipv4.address;
-            host = "boot.${domain}";
-            allowedPrefixes = with prefixes; [ hi.v4 hi.v6 lo.v4 lo.v6 ];
-            instances = [ "sfh" "castle" ];
-          };
-
           deploy.node.hostname = "192.168.68.1";
         };
       };

nixos/boxes/home/palace/vms/sfh/containers/default.nix

@@ -1,6 +0,0 @@
-{
-  imports = [
-    ./unifi.nix
-    ./hass.nix
-  ];
-}

nixos/boxes/home/palace/vms/sfh/containers/hass.nix

@@ -1,258 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c) pubDomain;
-  inherit (lib.my.c.home) domain prefixes vips hiMTU;
-in
-{
-  nixos.systems.hass = { config, ... }: {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    rendered = config.configuration.config.my.asContainer;
-
-    assignments = {
-      hi = {
-        name = "hass-ctr";
-        altNames = [ "frigate" ];
-        inherit domain;
-        mtu = hiMTU;
-        ipv4 = {
-          address = net.cidr.host 103 prefixes.hi.v4;
-          mask = 22;
-          gateway = vips.hi.v4;
-        };
-        ipv6 = {
-          iid = "::5:3";
-          address = net.cidr.host (65536*5+3) prefixes.hi.v6;
-        };
-      };
-      lo = {
-        name = "hass-ctr-lo";
-        inherit domain;
-        mtu = 1500;
-        ipv4 = {
-          address = net.cidr.host 103 prefixes.lo.v4;
-          mask = 21;
-          gateway = null;
-        };
-        ipv6 = {
-          iid = "::5:3";
-          address = net.cidr.host (65536*5+3) prefixes.lo.v6;
-        };
-      };
-    };
-
-    configuration = { lib, config, pkgs, assignments, allAssignments, ... }:
-    let
-      inherit (lib) mkMerge mkIf mkForce;
-      inherit (lib.my) networkdAssignment;
-
-      hassCli = pkgs.writeShellScriptBin "hass-cli" ''
-        export HASS_SERVER="http://localhost:${toString config.services.home-assistant.config.http.server_port}"
-        export HASS_TOKEN="$(< ${config.age.secrets."hass/cli-token.txt".path})"
-        exec ${pkgs.home-assistant-cli}/bin/hass-cli "$@"
-      '';
-    in
-    {
-      config = {
-        my = {
-          deploy.enable = false;
-          server.enable = true;
-
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpYX2WbYwUqHp8bFFf0eHFrqrR8xp8IheguA054F8V4";
-            files = {
-              "hass/cli-token.txt" = {
-                owner = config.my.user.config.name;
-              };
-            };
-          };
-
-          firewall = {
-            tcp.allowed = [ "http" 1883 ];
-          };
-        };
-
-        environment = {
-          systemPackages = with pkgs; [
-            usbutils
-            hassCli
-          ];
-        };
-
-        systemd = {
-          network.networks = {
-            "80-container-host0" = networkdAssignment "host0" assignments.hi;
-            "80-container-lan-lo" = networkdAssignment "lan-lo" assignments.lo;
-          };
-        };
-
-        services = {
-          mosquitto = {
-            enable = true;
-            listeners = [
-              {
-                omitPasswordAuth = true;
-                settings = {
-                  allow_anonymous = true;
-                };
-              }
-            ];
-          };
-
-          go2rtc = {
-            enable = true;
-            settings = {
-              streams = {
-                reolink_living_room = [
-                  # "http://reolink-living-room.${domain}/flv?port=1935&app=bcs&stream=channel0_main.bcs&user=admin#video=copy#audio=copy#audio=opus"
-                  "rtsp://admin:@reolink-living-room:554/h264Preview_01_main"
-                ];
-                webcam_office = [
-                  "ffmpeg:device?video=/dev/video0&video_size=1024x576#video=h264"
-                ];
-              };
-            };
-          };
-
-          frigate = {
-            enable = true;
-            hostname = "frigate.${domain}";
-            settings = {
-              mqtt = {
-                enabled = true;
-                host = "localhost";
-                topic_prefix = "frigate";
-              };
-
-              cameras = {
-                reolink_living_room = {
-                  ffmpeg.inputs = [
-                    {
-                      path = "rtsp://127.0.0.1:8554/reolink_living_room";
-                      input_args = "preset-rtsp-restream";
-                      roles = [ "record" "detect" ];
-                    }
-                  ];
-                  detect = {
-                    enabled = false;
-                  };
-                  record = {
-                    enabled = true;
-                    retain.days = 1;
-                  };
-                };
-
-                webcam_office = {
-                  ffmpeg.inputs = [
-                    {
-                      path = "rtsp://127.0.0.1:8554/webcam_office";
-                      input_args = "preset-rtsp-restream";
-                      roles = [ "record" "detect" ];
-                    }
-                  ];
-                  detect.enabled = false;
-                  record = {
-                    enabled = true;
-                    retain.days = 1;
-                  };
-                };
-              };
-            };
-          };
-
-          home-assistant =
-          let
-            cfg = config.services.home-assistant;
-
-            pyirishrail = ps: ps.buildPythonPackage rec {
-              pname = "pyirishrail";
-              version = "0.0.2";
-              src = pkgs.fetchFromGitHub {
-                owner = "ttroy50";
-                repo = "pyirishrail";
-                tag = version;
-                hash = "sha256-NgARqhcXP0lgGpgBRiNtQaSn9JcRNtCcZPljcL7t3Xc=";
-              };
-
-              dependencies = with ps; [
-                requests
-              ];
-            };
-          in
-          {
-            enable = true;
-
-            extraComponents = [
-              "default_config"
-              "esphome"
-              "google_translate"
-
-              "met"
-              "zha"
-              "denonavr"
-              "webostv"
-              "androidtv_remote"
-              "heos"
-              "mqtt"
-            ];
-            extraPackages = python3Packages: with python3Packages; [
-              zlib-ng
-              isal
-
-              gtts
-              (pyirishrail python3Packages)
-            ];
-            customComponents = with pkgs.home-assistant-custom-components; [
-              alarmo
-              frigate
-            ];
-
-            configWritable = false;
-            openFirewall = true;
-            config = {
-              default_config = {};
-              homeassistant = {
-                name = "Home";
-                unit_system = "metric";
-                currency = "EUR";
-                country = "IE";
-                time_zone = "Europe/Dublin";
-                external_url = "https://hass.${pubDomain}";
-                internal_url = "http://hass-ctr.${domain}:${toString cfg.config.http.server_port}";
-              };
-              http = {
-                use_x_forwarded_for = true;
-                trusted_proxies = with allAssignments.middleman.internal; [
-                  ipv4.address
-                  ipv6.address
-                ];
-                ip_ban_enabled = false;
-              };
-              automation = "!include automations.yaml";
-              script = "!include scripts.yaml";
-              scene = "!include scenes.yaml";
-
-              sensor = [
-                {
-                  platform = "irish_rail_transport";
-                  name = "To Work from Home";
-                  station = "Glenageary";
-                  stops_at = "Dublin Connolly";
-                  direction = "Northbound";
-                }
-                {
-                  platform = "irish_rail_transport";
-                  name = "To Home from Work";
-                  station = "Dublin Connolly";
-                  stops_at = "Glenageary";
-                  direction = "Southbound";
-                }
-              ];
-            };
-          };
-        };
-      };
-    };
-  };
-}

nixos/boxes/home/palace/vms/sfh/containers/unifi.nix

@@ -1,65 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c.home) domain prefixes vips hiMTU;
-in
-{
-  nixos.systems.unifi = { config, ... }: {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    rendered = config.configuration.config.my.asContainer;
-
-    assignments = {
-      hi = {
-        name = "unifi-ctr";
-        inherit domain;
-        mtu = hiMTU;
-        ipv4 = {
-          address = net.cidr.host 100 prefixes.hi.v4;
-          mask = 22;
-          gateway = vips.hi.v4;
-        };
-        ipv6 = {
-          iid = "::5:1";
-          address = net.cidr.host (65536*5+1) prefixes.hi.v6;
-        };
-      };
-    };
-
-    configuration = { lib, config, pkgs, assignments, ... }:
-    let
-      inherit (lib) mkMerge mkIf mkForce;
-      inherit (lib.my) networkdAssignment;
-    in
-    {
-      config = {
-        my = {
-          deploy.enable = false;
-          server.enable = true;
-
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKdgcziQki/RH7E+NH2bYnzSVKaJ27905Yo5TcOjSh/U";
-            files = { };
-          };
-
-          firewall = {
-            tcp.allowed = [ 8443 ];
-          };
-        };
-
-        systemd = {
-          network.networks."80-container-host0" = networkdAssignment "host0" assignments.hi;
-        };
-
-        services = {
-          unifi = {
-            enable = true;
-            openFirewall = true;
-            unifiPackage = pkgs.unifi8;
-            mongodbPackage = pkgs.mongodb-6_0;
-          };
-        };
-      };
-    };
-  };
-}

nixos/boxes/home/palace/vms/sfh/default.nix

@@ -1,200 +0,0 @@
-{ lib, ... }:
-let
-  inherit (lib.my) net;
-  inherit (lib.my.c.home) domain prefixes vips hiMTU roceBootModules;
-in
-{
-  imports = [ ./containers ];
-
-  config.nixos.systems.sfh = {
-    system = "x86_64-linux";
-    nixpkgs = "mine";
-    home-manager = "mine";
-
-    assignments = {
-      hi = {
-        inherit domain;
-        mtu = hiMTU;
-        ipv4 = {
-          address = net.cidr.host 81 prefixes.hi.v4;
-          mask = 22;
-          gateway = vips.hi.v4;
-        };
-        ipv6 = {
-          iid = "::4:2";
-          address = net.cidr.host (65536*4+2) prefixes.hi.v6;
-        };
-      };
-    };
-
-    configuration = { lib, modulesPath, pkgs, config, assignments, allAssignments, ... }:
-    let
-      inherit (lib) mapAttrs mkMerge mkForce;
-      inherit (lib.my) networkdAssignment;
-      inherit (lib.my.c) networkd;
-      inherit (lib.my.c.home) domain;
-    in
-    {
-      imports = [
-        "${modulesPath}/profiles/qemu-guest.nix"
-      ];
-
-      config = {
-        boot = {
-          kernelModules = [ "kvm-amd" ];
-          kernelParams = [ "console=ttyS0,115200n8" ];
-          initrd = {
-            availableKernelModules = [
-              "virtio_pci" "ahci" "sr_mod" "virtio_blk"
-            ] ++ roceBootModules;
-            kernelModules = [ "dm-snapshot" ];
-            systemd = {
-              network = {
-                networks = {
-                  "20-lan-hi" = networkdAssignment "lan-hi" assignments.hi;
-                };
-              };
-            };
-          };
-        };
-
-        hardware = {
-          enableRedistributableFirmware = true;
-        };
-
-        fileSystems = {
-          "/nix" = {
-            device = "/dev/main/nix";
-            fsType = "ext4";
-          };
-          "/persist" = {
-            device = "/dev/main/persist";
-            fsType = "ext4";
-            neededForBoot = true;
-          };
-        };
-
-        networking = { inherit domain; };
-
-        services = {
-          lvm = {
-            boot.thin.enable = true;
-            dmeventd.enable = true;
-          };
-        };
-
-        environment = {
-          systemPackages = with pkgs; [
-            usbutils
-          ];
-        };
-
-        systemd.network = {
-          links = {
-            "10-lan-hi" = {
-              matchConfig = {
-                Driver = "mlx5_core";
-                PermanentMACAddress = "52:54:00:ac:15:a9";
-              };
-              linkConfig = {
-                Name = "lan-hi";
-                MTUBytes = toString lib.my.c.home.hiMTU;
-              };
-            };
-            "10-lan-hi-ctrs" = {
-              matchConfig = {
-                Driver = "mlx5_core";
-                PermanentMACAddress = "52:54:00:90:34:95";
-              };
-              linkConfig = {
-                Name = "lan-hi-ctrs";
-                MTUBytes = toString lib.my.c.home.hiMTU;
-              };
-            };
-            "10-lan-lo-ctrs" = {
-              matchConfig = {
-                Driver = "virtio_net";
-                PermanentMACAddress = "52:54:00:a5:7e:93";
-              };
-              linkConfig.Name = "lan-lo-ctrs";
-            };
-          };
-
-          networks = {
-            "30-lan-hi" = mkMerge [
-              (networkdAssignment "lan-hi" assignments.hi)
-              # So we don't drop the IP we use to connect to NVMe-oF!
-              { networkConfig.KeepConfiguration = "static"; }
-            ];
-            "30-lan-hi-ctrs" = {
-              matchConfig.Name = "lan-hi-ctrs";
-              linkConfig.RequiredForOnline = "no";
-              networkConfig = networkd.noL3;
-            };
-            "30-lan-lo-ctrs" = {
-              matchConfig.Name = "lan-lo-ctrs";
-              linkConfig.RequiredForOnline = "no";
-              networkConfig = networkd.noL3;
-            };
-          };
-        };
-
-        systemd.nspawn = {
-          hass = {
-            networkConfig = {
-              MACVLAN = mkForce "lan-hi-ctrs:host0 lan-lo-ctrs:lan-lo";
-            };
-          };
-        };
-
-        systemd.services = {
-          "systemd-nspawn@hass".serviceConfig.DeviceAllow = [
-            "char-ttyUSB rw"
-            "char-video4linux rw"
-          ];
-        };
-
-        my = {
-          secrets = {
-            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAAaav5Se1E/AbqEXmADryVszYfNDscyP6jrWioN57R7";
-          };
-          server.enable = true;
-
-          netboot.client = {
-            enable = true;
-          };
-          nvme = {
-            uuid = "85d7df36-0de0-431b-b06e-51f7c0a455b4";
-            boot = {
-              nqn = "nqn.2016-06.io.spdk:sfh";
-              address = "192.168.68.80";
-            };
-          };
-
-          containers.instances =
-          let
-            instances = {
-              # unifi = {};
-              hass = {
-                bindMounts = {
-                  "/dev/bus/usb/001/002".readOnly = false;
-                  "/dev/video0".readOnly = false;
-                  "/dev/serial/by-id/usb-Nabu_Casa_Home_Assistant_Connect_ZBT-1_ce549704fe38ef11a2c2e5d154516304-if00-port0" = {
-                    readOnly = false;
-                    mountPoint = "/dev/ttyUSB0";
-                  };
-                };
-              };
-            };
-          in
-          mkMerge [
-            instances
-            (mapAttrs (n: i: {
-              networking.macVLAN = "lan-hi-ctrs";
-            }) instances)
-          ];
-        };
-      };
-    };
-  };
-}

nixos/boxes/home/routing-common/default.nix

@@ -148,33 +148,19 @@ in
                 };
               };
             };
-
-            nginx.enable = true;
           };
 
-          networking = { inherit domain; };
+          networking.domain = "h.${pubDomain}";
 
-          systemd.services =
+          systemd.services = {
-          let
+            ipsec =
-            waitOnline = "systemd-networkd-wait-online@wan.service";
+            let
-          in
+              waitOnline = "systemd-networkd-wait-online@wan.service";
-          {
+            in
-            ipsec = {
+            {
               after = [ waitOnline ];
               requires = [ waitOnline ];
             };
-
-            ipv6-clear-default-route = {
-              description = "Clear IPv6 RA default route";
-              after = [ waitOnline ];
-              requires = [ waitOnline ];
-              script = ''
-                # Seems like we can sometimes pick up a default route somehow...
-                ${pkgs.iproute2}/bin/ip -6 route del default via fe80::1 || true
-              '';
-              serviceConfig.Type = "oneshot";
-              wantedBy = [ "multi-user.target" ];
-            };
           };
 
           systemd.network = {
@@ -227,8 +213,8 @@ in
                   networkConfig = networkd.noL3;
                   extraConfig = ''
                     [CAKE]
-                    Bandwidth=490M
+                    Bandwidth=235M
-                    RTTSec=50ms
+                    RTTSec=10ms
                     PriorityQueueingPreset=besteffort
                     # DOCSIS preset
                     OverheadBytes=18
@@ -251,8 +237,8 @@ in
                     extraConfig = ''
                       [CAKE]
                       Parent=root
-                      Bandwidth=48M
+                      Bandwidth=24M
-                      RTTSec=50ms
+                      RTTSec=1ms
                     '';
                   }
                 ];
@@ -276,7 +262,7 @@ in
                   {
                     matchConfig.Name = "as211024";
                     networkConfig.IPv6AcceptRA = mkForce false;
-                    routes = [
+                    routes = map (r: { routeConfig = r; }) [
                       {
                         Destination = lib.my.c.colony.prefixes.all.v4;
                         Gateway = allAssignments.estuary.as211024.ipv4.address;
@@ -301,7 +287,7 @@ in
 
               {
                 "60-lan-hi" = {
-                  routes = [
+                  routes = map (r: { routeConfig = r; }) [
                     {
                       Destination = elemAt routersPubV4 otherIndex;
                       Gateway = net.cidr.host (otherIndex + 1) prefixes.hi.v4;
@@ -372,16 +358,6 @@ in
                     return
                   }
 
-                  chain forward-early {
-                    type filter hook forward priority -1; policy accept;
-
-                    # MSS clamping to workaround IPv6 PMTUD being broken...
-                    tcp flags syn tcp option maxseg size set rt mtu counter
-
-                    # More Disney+ discrimination...
-                    # TODO: This prefix could change (random AWS block)
-                    ip6 daddr 2600:9000:2245::/48 drop
-                  }
                   chain forward {
                     ${lib.my.c.as211024.nftTrust}
                     iifname lan-untrusted jump filter-untrusted

nixos/boxes/home/routing-common/dns-blocklist.txt

@@ -1,74 +0,0 @@
-# Blocklist for LG WebOS Services (US)
-ad.lgappstv.com
-ibis.lgappstv.com
-info.lgsmartad.com
-lgtvsdp.com
-ngfts.lge.com
-rdx2.lgtvsdp.com
-smartshare.lgtvsdp.com
-lgappstv.com
-us.ad.lgsmartad.com
-us.ibs.lgappstv.com
-us.info.lgsmartad.com
-us.lgtvsdp.com
-
-# Community Contributions
-lgad.cjpowercast.com
-edgesuite.net
-yumenetworks.com
-smartclip.net
-smartclip.com
-
-# Non-US Entries
-rdx2.lgtvsdp.com
-info.lgsmartad.com
-ibs.lgappstv.com
-lgtvsdp.com
-lgappstv.com
-smartshare.lgtvsdp.com
-
-# Full Block for Europe and Other Regions
-de.ad.lgsmartad.com
-de.emp.lgsmartplatform.com
-de.ibs.lgappstv.com
-de.info.lgsmartad.com
-de.lgeapi.com
-de.lgtvsdp.com
-de.rdx2.lgtvsdp.com
-eu.ad.lgsmartad.com
-eu.ibs.lgappstv.com
-eu.info.lgsmartad.com
-app-lgwebos.pluto.tv
-it.lgtvsdp.com
-it.lgeapi.com
-it.emp.lgsmartplatform.com
-
-# LG ThinQ Services
-eic.common.lgthinq.com
-eic.iotservice.lgthinq.com
-eic.service.lgthinq.com
-eic.ngfts.lge.com
-eic.svc-lgthinq-com.aws-thinq-prd.net
-eic.cdpsvc.lgtvcommon.com
-eic.cdpbeacon.lgtvcommon.com
-eic.cdplauncher.lgtvcommon.com
-eic.homeprv.lgtvcommon.com
-eic.lgtviot.com
-eic.nudge.lgtvcommon.com
-eic.rdl.lgtvcommon.com
-eic.recommend.lgtvcommon.com
-eic.service.lgtvcommon.com
-gb-lgeapi-com.esi-prd.net
-gb.lgeapi.com
-lgtvonline.lge.com
-lg-channelplus-de-beacons.xumo.com
-lg-channelplus-de-mds.xumo.com
-lg-channelplus-eu-beacons.xumo.com
-lg-channelplus-eu-mds.xumo.com
-kr-op-v2.lgthinqhome.com
-ngfts.lge.com
-noti.lgthinq.com
-objectcontent.lgthinq.com
-
-# Update Server Block
-#snu.lge.com

nixos/boxes/home/routing-common/dns.nix

@@ -61,38 +61,6 @@ in
           webserver = true;
           webserver-address = "::";
           webserver-allow-from = [ "127.0.0.1" "::1" ];
-
-          lua-dns-script = pkgs.writeText "pdns-script.lua" ''
-            blocklist = newDS()
-
-            function preresolve(dq)
-              local name = dq.qname:toString()
-
-              -- Disney+ doesn't like our IP space...
-              if dq.qtype == pdns.AAAA and (string.find(name, "disneyplus") or string.find(name, "disney-plus") or string.find(name , "disney.api")) then
-                dq.rcode = 0
-                return true
-              end
-
-              if blocklist:check(dq.qname) then
-                if dq.qtype == pdns.A then
-                  dq:addAnswer(dq.qtype, "127.0.0.1")
-                elseif dq.qtype == pdns.AAAA then
-                  dq:addAnswer(dq.qtype, "::1")
-                end
-                return true
-              end
-
-              return false
-            end
-
-            for line in io.lines("${./dns-blocklist.txt}") do
-              entry = line:gsub("%s+", "")
-              if entry ~= "" and string.sub(entry, 1, 1) ~= "#" then
-                blocklist:add(entry)
-              end
-            end
-          '';
         };
       };
     };
@@ -189,9 +157,8 @@ in
               hostname = "${otherName}.${config.networking.domain}";
               server = net.cidr.host (otherIndex + 1) prefixes.hi.v4;
             }}
-            ${elemAt routers 0} IN AAAA ${allAssignments."${elemAt routers 0}".as211024.ipv6.address}
+            ${elemAt routers 0} IN AAAA ${net.cidr.host 1 prefixes.hi.v6}
-            ${elemAt routers 1} IN AAAA ${allAssignments."${elemAt routers 1}".as211024.ipv6.address}
+            ${elemAt routers 1} IN AAAA ${net.cidr.host 2 prefixes.hi.v6}
-            boot IN CNAME river-hi.${config.networking.domain}.
 
             @ IN NS ns1
             @ IN NS ns2
@@ -215,18 +182,14 @@ in
             dave-lo IN A ${net.cidr.host 11 prefixes.lo.v4}
             dave-lo IN AAAA ${net.cidr.host (65536+2) prefixes.lo.v6}
 
-            shytzel IN A ${net.cidr.host 12 prefixes.core.v4}
+            ;ap0 IN A ${net.cidr.host 12 prefixes.hi.v4}
-
+            ;ap0 IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
-            wave IN A ${net.cidr.host 12 prefixes.hi.v4}
-            ; wave IN AAAA ${net.cidr.host (65536+3) prefixes.hi.v6}
             vibe IN A ${net.cidr.host 13 prefixes.hi.v4}
             vibe IN AAAA ${net.cidr.host (65536+4) prefixes.hi.v6}
 
             ups IN A ${net.cidr.host 20 prefixes.lo.v4}
             palace-kvm IN A ${net.cidr.host 21 prefixes.lo.v4}
 
-            reolink-living-room IN A ${net.cidr.host 45 prefixes.lo.v4}
-
             ${lib.my.dns.fwdRecords {
               inherit allAssignments names;
               domain = config.networking.domain;

nixos/boxes/home/routing-common/dns_update.py

@@ -2,7 +2,7 @@
 import argparse
 import subprocess
 
-import cloudflare
+import CloudFlare
 
 def main():
     parser = argparse.ArgumentParser(description='Cloudflare DNS update script')
@@ -19,22 +19,17 @@ def main():
     if args.api_token_file:
         with open(args.api_token_file) as f:
             cf_token = f.readline().strip()
-    cf = cloudflare.Cloudflare(api_token=cf_token)
 
-    zones = list(cf.zones.list(name=args.zone))
+    cf = CloudFlare.CloudFlare(token=cf_token)
+    zones = cf.zones.get(params={'name': args.zone})
     assert zones, f'Zone {args.zone} not found'
-    assert len(zones) == 1, f'More than one zone found for {args.zone}'
+    records = cf.zones.dns_records.get(zones[0]['id'], params={'name': args.record})
-    zone = zones[0]
-
-    records = list(cf.dns.records.list(zone_id=zone.id, name=args.record, type='A'))
     assert records, f'Record {args.record} not found in zone {args.zone}'
-    assert len(records) == 1, f'More than one record found for {args.record}'
-    record = records[0]
 
     print(f'Updating {args.record} -> {address}')
-    cf.dns.records.edit(
+    cf.zones.dns_records.patch(
-        zone_id=zone.id, dns_record_id=record.id,
+        zones[0]['id'], records[0]['id'],
-        type='A', content=address)
+        data={'type': 'A', 'name': args.record, 'content': address})
 
 if __name__ == '__main__':
     main()

nixos/boxes/home/routing-common/kea.nix

@@ -1,7 +1,7 @@
-index: { lib, pkgs, config, assignments, allAssignments, ... }:
+index: { lib, pkgs, assignments, ... }:
 let
   inherit (lib) mkForce;
-  inherit (lib.my) net netbootKeaClientClasses;
+  inherit (lib.my) net;
   inherit (lib.my.c.home) domain prefixes vips hiMTU;
 
   dns-servers = [
@@ -26,11 +26,7 @@ in
   };
 
   systemd.services = {
-    kea-dhcp4-server.serviceConfig = {
+    kea-dhcp4-server.serviceConfig.DynamicUser = mkForce false;
-      # Sometimes interfaces might not be ready in time and Kea doesn't like that
-      Restart = "on-failure";
-      DynamicUser = mkForce false;
-    };
     kea-dhcp-ddns-server.serviceConfig.DynamicUser = mkForce false;
   };
 
@@ -63,14 +59,6 @@ in
               always-send = true;
             }
           ];
-          client-classes = netbootKeaClientClasses {
-            tftpIP = allAssignments.river.lo.ipv4.address;
-            hostname = "boot.${domain}";
-            systems = {
-              sfh = "52:54:00:a5:7e:93";
-              castle = "c8:7f:54:6e:17:0f";
-            };
-          };
           subnet4 = [
             {
               id = 1;
@@ -132,32 +120,6 @@ in
                   hw-address = "24:8a:07:a8:fe:3a";
                   ip-address = net.cidr.host 40 prefixes.lo.v4;
                 }
-
-                {
-                  # avr
-                  hw-address = "8c:a9:6f:30:03:6b";
-                  ip-address = net.cidr.host 41 prefixes.lo.v4;
-                }
-                {
-                  # tv
-                  hw-address = "00:a1:59:b8:4d:86";
-                  ip-address = net.cidr.host 42 prefixes.lo.v4;
-                }
-                {
-                  # android tv
-                  hw-address = "b8:7b:d4:95:c6:74";
-                  ip-address = net.cidr.host 43 prefixes.lo.v4;
-                }
-                {
-                  # hass-panel
-                  hw-address = "80:30:49:cd:d7:51";
-                  ip-address = net.cidr.host 44 prefixes.lo.v4;
-                }
-                {
-                  # reolink-living-room
-                  hw-address = "ec:71:db:30:69:a4";
-                  ip-address = net.cidr.host 45 prefixes.lo.v4;
-                }
               ];
             }
           ];

nixos/boxes/home/routing-common/keepalived.nix

@@ -1,83 +1,52 @@
 index: { lib, pkgs, config, ... }:
 let
-  inherit (builtins) attrNames concatMap length;
+  inherit (builtins) attrNames concatMap;
-  inherit (lib) optional concatMapStringsSep;
+  inherit (lib) optional;
   inherit (lib.my) net;
   inherit (lib.my.c.home) prefixes vips;
 
-  pingScriptFor = name: ips:
-  let
-    script' = pkgs.writeShellScript
-      "keepalived-ping-${name}"
-      (concatMapStringsSep " || " (ip: "${pkgs.iputils}/bin/ping -qnc 1 -W 1 ${ip}") ips);
-  in
-  {
-    script = toString script';
-    interval = 1;
-    timeout = (length ips) + 1;
-    rise = 3;
-    fall = 3;
-  };
-
   vlanIface = vlan: if vlan == "as211024" then vlan else "lan-${vlan}";
-  vrrpIPs = family: concatMap (vlan: (optional (family == "v6") {
+  vrrpIPs = family: concatMap (vlan: [
-      addr = "fe80::1/64";
-      dev = vlanIface vlan;
-    }) ++ [
     {
       addr = "${vips.${vlan}.${family}}/${toString (net.cidr.length prefixes.${vlan}.${family})}";
       dev = vlanIface vlan;
     }
-  ]) (attrNames vips);
+  ] ++ (optional (family == "v6") {
+    addr = "fe80::1/64";
+    dev = vlanIface vlan;
+  })) (attrNames vips);
   mkVRRP = family: routerId: {
     state = if index == 0 then "MASTER" else "BACKUP";
     interface = "lan-core";
     priority = 255 - index;
     virtualRouterId = routerId;
     virtualIps = vrrpIPs family;
-    trackScripts = [ "${family}Alive" ];
+    extraConfig = ''
+      notify_master "${config.systemd.package}/bin/systemctl start radvd.service"
+      notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service"
+    '';
   };
 in
 {
-  users = with lib.my.c.ids; {
-    users.keepalived_script = {
-      uid = uids.keepalived_script;
-      isSystemUser = true;
-      group = "keepalived_script";
-    };
-    groups.keepalived_script.gid = gids.keepalived_script;
-  };
-
   services = {
     keepalived = {
       enable = true;
-      enableScriptSecurity = true;
       extraGlobalDefs = ''
         vrrp_version 3
         nftables keepalived
       '';
-      vrrpScripts = {
-        v4Alive = pingScriptFor "v4" [ "1.1.1.1" "8.8.8.8" "216.218.236.2" ];
-        v6Alive = pingScriptFor "v6" [ "2606:4700:4700::1111" "2001:4860:4860::8888" "2600::" ];
-      };
       vrrpInstances = {
         v4 = mkVRRP "v4" 51;
-        v6 = (mkVRRP "v6" 52) // {
+        v6 = mkVRRP "v6" 52;
-          extraConfig = ''
-            notify_master "${config.systemd.package}/bin/systemctl start radvd.service" root
-            notify_backup "${config.systemd.package}/bin/systemctl stop radvd.service" root
-          '';
-        };
       };
-      # Actually disable this for now, don't want to fault IPv4 just because IPv6 is broken...
+      extraConfig = ''
-      # extraConfig = ''
+        vrrp_sync_group main {
-      #   vrrp_sync_group main {
+          group {
-      #     group {
+            v4
-      #       v4
+            v6
-      #       v6
+          }
-      #     }
+        }
-      #   }
+      '';
-      # '';
     };
   };
 }

nixos/boxes/home/stream.nix

@@ -43,38 +43,6 @@
           };
         };
 
-        services = {
-          mjpg-streamer = {
-            enable = false;
-            inputPlugin = "input_uvc.so";
-            outputPlugin = "output_http.so -w @www@ -n -p 5050";
-          };
-          octoprint = {
-            enable = false;
-            host = "::";
-            extraConfig = {
-              plugins = {
-                classicwebcam = {
-                  snapshot = "/webcam/?action=snapshot";
-                  stream = "/webcam/?action=stream";
-                  streamRatio = "4:3";
-                };
-              };
-              serial = {
-                port = "/dev/ttyACM0";
-                baudrate = 115200;
-              };
-              temperature.profiles = [
-                {
-                  bed = 60;
-                  extruder = 215;
-                  name = "PLA";
-                }
-              ];
-            };
-          };
-        };
-
         systemd.network = {
           netdevs = {
             "25-lan" = {
@@ -155,7 +123,7 @@
             key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPYTB4zeAqotrEJ8M+AiGm/s9PFsWlAodz3hYSROGuDb";
           };
           server.enable = true;
-          # deploy.node.hostname = "192.168.68.2";
+          deploy.node.hostname = "192.168.68.2";
         };
       };
     };

nixos/boxes/kelder/containers/acquisition/default.nix

@@ -26,7 +26,7 @@ in
 
       config = {
         # Hardware acceleration for Jellyfin
-        hardware.graphics = {
+        hardware.opengl = {
           enable = true;
           extraPackages = with pkgs; [
             vaapiIntel
@@ -65,27 +65,13 @@ in
         systemd = {
           services = {
             jackett.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
-
             transmission.bindsTo = [ "systemd-networkd-wait-online@vpn.service" ];
-            # https://github.com/NixOS/nixpkgs/issues/258793#issuecomment-1748168206
-            transmission.serviceConfig = {
-              RootDirectoryStartOnly = lib.mkForce false;
-              RootDirectory = lib.mkForce "";
-            };
 
             radarr.serviceConfig.UMask = "0002";
             sonarr.serviceConfig.UMask = "0002";
           };
         };
 
-        nixpkgs.config.permittedInsecurePackages = [
-          # FIXME: This is needed for Sonarr
-          "aspnetcore-runtime-wrapped-6.0.36"
-          "aspnetcore-runtime-6.0.36"
-          "dotnet-sdk-wrapped-6.0.428"
-          "dotnet-sdk-6.0.428"
-        ];
-
         services = {
           transmission = {
             enable = true;

nixos/boxes/kelder/containers/acquisition/networking.nix

@@ -2,7 +2,6 @@
 let
   inherit (lib) mkMerge mkIf;
   inherit (lib.my) networkdAssignment;
-  inherit (lib.my.c.kelder) ipv4MTU;
 
   wg = {
     keyFile = "kelder/acquisition/airvpn-privkey";
@@ -73,12 +72,14 @@ in
               RouteTable = routeTable;
             };
             wireguardPeers = [
-              # AirVPN IE
               {
-                Endpoint = "146.70.94.2:1637";
+                # AirVPN IE
-                PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
+                wireguardPeerConfig = {
-                PresharedKeyFile = config.age.secrets."${pskFile}".path;
+                  Endpoint = "146.70.94.2:1637";
-                AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                  PublicKey = "PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk=";
+                  PresharedKeyFile = config.age.secrets."${pskFile}".path;
+                  AllowedIPs = [ "0.0.0.0/0" "::/0" ];
+                };
               }
             ];
           };
@@ -88,14 +89,13 @@ in
               (networkdAssignment "host0" assignments.internal)
               {
                 networkConfig.DNSDefaultRoute = false;
-                linkConfig.MTUBytes = toString ipv4MTU;
               }
             ];
             "90-vpn" = with wg; {
               matchConfig.Name = "vpn";
               address = [ "10.161.170.28/32" "fd7d:76ee:e68f:a993:b12d:6d15:c80a:9516/128" ];
               dns = [ "10.128.0.1" "fd7d:76ee:e68f:a993::1" ];
-              routingPolicyRules = [
+              routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                 {
                   Family = "both";
                   SuppressPrefixLength = 0;

nixos/boxes/kelder/containers/spoder/default.nix

@@ -92,18 +92,17 @@ in
 
           nextcloud = {
             enable = true;
-            package = pkgs.nextcloud29;
+            package = pkgs.nextcloud28;
             datadir = "/mnt/storage/nextcloud";
             hostName = "cloud.${domain}";
             https = true;
             config = {
+              extraTrustedDomains = [ "cloud-local.${domain}" ];
               adminpassFile = config.age.secrets."kelder/nextcloud-root.txt".path;
-              dbtype = "sqlite";
+              defaultPhoneRegion = "IE";
             };
-            settings = {
+            extraOptions = {
               updatechecker = false;
-              trusted_domains = [ "cloud-local.${domain}" ];
-              default_phone_region = "IE";
             };
           };
         };

nixos/boxes/kelder/containers/spoder/nginx.nix

@@ -84,7 +84,6 @@ in
             c
           ];
           acquisition = "http://${allAssignments.kelder-acquisition.internal.ipv4.address}";
-          # This is kinda borked because Virgin Media filters DNS responses with local IPs...
           localRedirect = to: ''
             rewrite_by_lua_block {
               if ngx.var.remote_addr == pub_ip then
@@ -104,7 +103,7 @@ in
 
             "monitor.${domain}" = withAuth {
               serverAliases = [ "monitor-local.${domain}" ];
-              # extraConfig = localRedirect "monitor-local.${domain}";
+              extraConfig = localRedirect "monitor-local.${domain}";
               locations = {
                 "/" = {
                   proxyPass = "http://${allAssignments.kelder.ctrs.ipv4.address}:19999";
@@ -137,17 +136,17 @@ in
             };
             "torrents.${domain}" = withAuth {
               serverAliases = [ "torrents-local.${domain}" ];
-              # extraConfig = localRedirect "torrents-local.${domain}";
+              extraConfig = localRedirect "torrents-local.${domain}";
               locations."/".proxyPass = "${acquisition}:9091";
             };
             "jackett.${domain}" = withAuth {
               serverAliases = [ "jackett-local.${domain}" ];
-              # extraConfig = localRedirect "jackett-local.${domain}";
+              extraConfig = localRedirect "jackett-local.${domain}";
               locations."/".proxyPass = "${acquisition}:9117";
             };
             "radarr.${domain}" = withAuth {
               serverAliases = [ "radarr-local.${domain}" ];
-              # extraConfig = localRedirect "radarr-local.${domain}";
+              extraConfig = localRedirect "radarr-local.${domain}";
               locations."/" = {
                 proxyPass = "${acquisition}:7878";
                 proxyWebsockets = true;
@@ -156,7 +155,7 @@ in
             };
             "sonarr.${domain}" = withAuth {
               serverAliases = [ "sonarr-local.${domain}" ];
-              # extraConfig = localRedirect "sonarr-local.${domain}";
+              extraConfig = localRedirect "sonarr-local.${domain}";
               locations."/" = {
                 proxyPass = "${acquisition}:8989";
                 proxyWebsockets = true;

nixos/boxes/kelder/default.nix

@@ -1,7 +1,7 @@
 { lib, ... }:
 let
   inherit (lib.my) net;
-  inherit (lib.my.c.kelder) domain prefixes ipv4MTU;
+  inherit (lib.my.c.kelder) domain prefixes;
 in
 {
   imports = [ ./containers ];
@@ -121,7 +121,8 @@ in
 
             samba = {
               enable = true;
-              settings = {
+              enableNmbd = true;
+              shares = {
                 storage = {
                   path = "/mnt/storage";
                   browseable = "yes";
@@ -130,8 +131,6 @@ in
                   "directory mask" = "0775";
                 };
               };
-
-              nmbd.enable = true;
             };
             samba-wsdd.enable = true;
 
@@ -181,10 +180,12 @@ in
                   };
                   wireguardPeers = [
                     {
-                      PublicKey = "bP1XUNxp9i8NLOXhgPaIaRzRwi5APbam44/xjvYcyjU=";
+                      wireguardPeerConfig = {
-                      Endpoint = "${allAssignments.estuary.internal.ipv4.address}:${toString lib.my.c.kelder.vpn.port}";
+                        PublicKey = "bP1XUNxp9i8NLOXhgPaIaRzRwi5APbam44/xjvYcyjU=";
-                      AllowedIPs = [ "0.0.0.0/0" ];
+                        Endpoint = "estuary-vm.${lib.my.c.colony.domain}:${toString lib.my.c.kelder.vpn.port}";
-                      PersistentKeepalive = 25;
+                        AllowedIPs = [ "0.0.0.0/0" ];
+                        PersistentKeepalive = 25;
+                      };
                     }
                   ];
                 };
@@ -199,7 +200,6 @@ in
                 "50-lan" = {
                   matchConfig.Name = "et1g0";
                   DHCP = "yes";
-                  linkConfig.MTUBytes = toString ipv4MTU;
                 };
                 "80-ctrs" = mkMerge [
                   (networkdAssignment "ctrs" assignments.ctrs)
@@ -212,7 +212,7 @@ in
                   address = with assignments.estuary; [
                     (with ipv4; "${address}/${toString mask}")
                   ];
-                  routingPolicyRules = [
+                  routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                     {
                       Family = "both";
                       SuppressPrefixLength = 0;
@@ -272,7 +272,7 @@ in
               config.name = "kontent";
             };
 
-            # deploy.node.hostname = "192.168.0.69";
+            #deploy.node.hostname = "10.16.9.21";
             secrets = {
               key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOFvUdJshXkqmchEgkZDn5rgtZ1NO9vbd6Px+S6YioWi";
               files = {

nixos/boxes/tower/default.nix

@@ -14,7 +14,7 @@
           cpu = {
             intel.updateMicrocode = true;
           };
-          graphics.extraPackages = with pkgs; [
+          opengl.extraPackages = with pkgs; [
             intel-media-driver
           ];
           bluetooth.enable = true;
@@ -129,9 +129,10 @@
             wifi = {
               backend = "wpa_supplicant";
             };
-            settings = {
+            extraConfig = ''
-              main.no-auto-default = "*";
+              [main]
-            };
+              no-auto-default=*
+            '';
           };
         };
 
@@ -177,7 +178,7 @@
               programs = {
                 fish = {
                   shellAbbrs = {
-                    tsup = "doas tailscale up --login-server=https://hs.nul.ie --accept-routes";
+                    tsup = "doas tailscale up --login-server=https://ts.nul.ie --accept-routes";
                   };
                 };
               };

nixos/default.nix

@@ -23,7 +23,7 @@ let
       pkgs = pkgs'.${config'.nixpkgs}.${config'.system};
       allPkgs = mapAttrs (_: p: p.${config'.system}) pkgs';
 
-      modules' = [ hmFlakes.${config'.home-manager}.nixosModules.default ] ++ (attrValues cfg.modules);
+      modules' = [ hmFlakes.${config'.home-manager}.nixosModule ] ++ (attrValues cfg.modules);
     in
     # Import eval-config ourselves since the flake now force-sets lib
     import "${pkgsFlake}/nixos/lib/eval-config.nix" {
@@ -35,7 +35,7 @@ let
       system = null;
 
       # Put the inputs in specialArgs to avoid infinite recursion when modules try to do imports
-      specialArgs = { inherit self inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
+      specialArgs = { inherit inputs pkgsFlakes pkgsFlake allAssignments; inherit (cfg) systems; };
 
       # `baseModules` informs the manual which modules to document
       baseModules =
@@ -135,7 +135,6 @@ let
       ipv6 = mkBoolOpt' false "Whether this mesh's underlay operates over IPv6.";
       baseMTU = mkOpt' ints.unsigned 1500 "Base MTU to calculate VXLAN MTU with.";
       l3Overhead = mkOpt' ints.unsigned 40 "Overhead of L3 header (to calculate MTU).";
-      udpEncapsulation = mkBoolOpt' false "Whether to encapsulate ESP frames in UDP.";
       firewall = mkBoolOpt' true "Whether to generate firewall rules.";
       vni = mkOpt' ints.unsigned 1 "VXLAN VNI.";
       peers = mkOpt' (attrsOf (submodule l2PeerOpts)) { } "Peers.";

nixos/installer.nix

@@ -1,7 +1,7 @@
 {
   nixos.systems.installer = { config, ... }: {
     system = "x86_64-linux";
-    nixpkgs = "mine";
+    nixpkgs = "unstable";
     docCustom = false;
     rendered = config.configuration.config.my.asISO;
 
@@ -52,8 +52,6 @@
             home.shellAliases = {
               show-hw-config = "nixos-generate-config --show-hardware-config --root $INSTALL_ROOT";
             };
-
-            my.gui.enable = false;
           };
 
           services = {
@@ -61,8 +59,8 @@
           };
 
           networking = {
-            # Will be set dynamically, but need something to satisfy `/etc/os-release` stuff
+            # Will be set dynamically
-            hostName = "installer";
+            hostName = "";
             useNetworkd = false;
           };
 
@@ -82,8 +80,6 @@
                 ${pkgs.gawk}/bin/awk '{ print $1 }')"
             '';
 
-          boot.supportedFilesystems.nfs = true;
-
           environment.systemPackages = with pkgs; [
             dhcpcd
             lm_sensors

nixos/modules/_list.nix

@@ -14,12 +14,11 @@
     network = ./network.nix;
     pdns = ./pdns.nix;
     nginx-sso = ./nginx-sso.nix;
-    gui = ./gui;
+    gui = ./gui.nix;
     l2mesh = ./l2mesh.nix;
     borgthin = ./borgthin.nix;
     nvme = ./nvme;
     spdk = ./spdk.nix;
     librespeed = ./librespeed;
-    netboot = ./netboot;
   };
 }

nixos/modules/build.nix

@@ -1,6 +1,6 @@
 { lib, pkgs, extendModules, modulesPath, options, config, ... }:
 let
-  inherit (lib) recursiveUpdate mkOption mkDefault mkIf mkMerge mkForce flatten optional;
+  inherit (lib) recursiveUpdate mkOption mkDefault mkIf mkMerge flatten optional;
   inherit (lib.my) mkBoolOpt' dummyOption;
 
   cfg = config.my.build;
@@ -43,145 +43,15 @@ let
     modules = flatten [
       "${modulesPath}/installer/netboot/netboot.nix"
       allHardware
-    ];
-  };
-
-  asNetboot = extendModules {
-    modules = flatten [
-      allHardware
       ({ pkgs, config, ... }: {
-        boot = {
+        system.build.netbootArchive = pkgs.runCommand "netboot-${config.system.name}-archive.tar" { } ''
-          loader.grub.enable = false;
+          ${pkgs.gnutar}/bin/tar -rvC "${config.system.build.kernel}" \
-          initrd = {
+            -f "$out" "${config.system.boot.loader.kernelFile}"
-            kernelModules = [ "nbd" ];
+          ${pkgs.gnutar}/bin/tar -rvC "${config.system.build.netbootRamdisk}" \
-            availableKernelModules = [ "igb" "igc" ];
+            -f "$out" initrd
-
+          ${pkgs.gnutar}/bin/tar -rvC "${config.system.build.netbootIpxeScript}" \
-            systemd = {
+            -f "$out" netboot.ipxe
-              storePaths = with pkgs; [
+        '';
-                gnused
-                nbd
-                netcat
-              ];
-              extraBin = with pkgs; {
-                dmesg = "${util-linux}/bin/dmesg";
-                ip = "${iproute2}/bin/ip";
-                nbd-client = "${nbd}/bin/nbd-client";
-              };
-              extraConfig = ''
-                DefaultTimeoutStartSec=20
-                DefaultDeviceTimeoutSec=20
-              '';
-
-              network = {
-                enable = true;
-                wait-online.enable = true;
-
-                networks."10-netboot" = {
-                  matchConfig.Name = "et-boot";
-                  DHCP = "yes";
-                };
-              };
-
-              services = {
-                nbd = {
-                  description = "NBD Root FS";
-
-                  script = ''
-                    get_cmdline() {
-                      ${pkgs.gnused}/bin/sed -rn "s/^.*$1=(\\S+).*\$/\\1/p" < /proc/cmdline
-                    }
-
-                    s="$(get_cmdline nbd_server)"
-                    until ${pkgs.netcat}/bin/nc -zv "$s" 22; do
-                      sleep 0.1
-                    done
-
-                    exec ${pkgs.nbd}/bin/nbd-client -systemd-mark -N "$(get_cmdline nbd_export)" "$s" /dev/nbd0
-                  '';
-                  unitConfig = {
-                    IgnoreOnIsolate = "yes";
-                    DefaultDependencies = "no";
-                  };
-                  serviceConfig = {
-                    Type = "forking";
-                    Restart = "on-failure";
-                    RestartSec = 10;
-                  };
-
-                  wantedBy = [ "initrd-root-device.target" ];
-                };
-              };
-            };
-          };
-
-          postBootCommands = ''
-            # After booting, register the contents of the Nix store
-            # in the Nix database in the COW root.
-            ${config.nix.package}/bin/nix-store --load-db < /nix-path-registration
-
-            # nixos-rebuild also requires a "system" profile and an
-            # /etc/NIXOS tag.
-            touch /etc/NIXOS
-            ${config.nix.package.out}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
-          '';
-        };
-
-        programs.nbd.enable = true;
-
-        fileSystems = {
-          "/" = {
-            fsType = "ext4";
-            device = "/dev/nbd0";
-            noCheck = true;
-            autoResize = true;
-          };
-        };
-
-        networking.useNetworkd = mkForce true;
-
-        systemd = {
-          network.networks."10-boot" = {
-            matchConfig.Name = "et-boot";
-            DHCP = "yes";
-            networkConfig.KeepConfiguration = "yes";
-          };
-        };
-
-        system.build = {
-          rootImage = pkgs.callPackage "${modulesPath}/../lib/make-ext4-fs.nix" {
-            storePaths = [ config.system.build.toplevel ];
-            volumeLabel = "netboot-root";
-          };
-          netbootScript = pkgs.writeText "boot.ipxe" ''
-            #!ipxe
-            kernel ${pkgs.stdenv.hostPlatform.linux-kernel.target} init=${config.system.build.toplevel}/init initrd=initrd ifname=et-boot:''${mac} nbd_server=''${next-server} ${toString config.boot.kernelParams} ''${cmdline}
-            initrd initrd
-            boot
-          '';
-
-          netbootTree = pkgs.linkFarm "netboot-${config.system.name}" [
-            {
-              name = config.system.boot.loader.kernelFile;
-              path = "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}";
-            }
-            {
-              name = "initrd";
-              path = "${config.system.build.initialRamdisk}/initrd";
-            }
-            {
-              name = "rootfs.ext4";
-              path = config.system.build.rootImage;
-            }
-            {
-              name = "boot.ipxe";
-              path = config.system.build.netbootScript;
-            }
-          ];
-          netbootArchive = pkgs.runCommand "netboot-${config.system.name}.tar.zst" { } ''
-            export PATH=${pkgs.zstd}/bin:$PATH
-            ${pkgs.gnutar}/bin/tar --dereference --zstd -cvC ${config.system.build.netbootTree} -f "$out" .
-          '';
-        };
       })
     ];
   };
@@ -207,7 +77,6 @@ in
       asISO = mkAsOpt asISO "a bootable .iso image";
       asContainer = mkAsOpt asContainer "a container";
       asKexecTree = mkAsOpt asKexecTree "a kexec-able kernel and initrd";
-      asNetboot = mkAsOpt asNetboot "a netboot-able kernel initrd, and iPXE script";
 
       buildAs = options.system.build;
     };
@@ -241,8 +110,7 @@ in
         iso = config.my.asISO.config.system.build.isoImage;
         container = config.my.asContainer.config.system.build.toplevel;
         kexecTree = config.my.asKexecTree.config.system.build.kexecTree;
-        netbootTree = config.my.asNetboot.config.system.build.netbootTree;
+        netbootArchive = config.my.asKexecTree.config.system.build.netbootArchive;
-        netbootArchive = config.my.asNetboot.config.system.build.netbootArchive;
       };
     };
   };

nixos/modules/common.nix

@@ -1,4 +1,4 @@
-{ lib, pkgsFlake, pkgs, pkgs', self, inputs, config, ... }:
+{ lib, pkgs, pkgs', inputs, config, ... }:
 let
   inherit (lib) mkIf mkDefault mkMerge;
   inherit (lib.my) mkDefault';
@@ -12,6 +12,7 @@ in
     inputs.impermanence.nixosModule
     inputs.ragenix.nixosModules.age
     inputs.sharry.nixosModules.default
+    inputs.attic.nixosModules.atticd
   ];
 
   config = mkMerge [
@@ -40,7 +41,6 @@ in
 
       nix = {
         package = pkgs'.mine.nix;
-        channel.enable = false;
         settings = with lib.my.c.nix; {
           trusted-users = [ "@wheel" ];
           experimental-features = [ "nix-command" "flakes" "ca-derivations" ];
@@ -53,7 +53,7 @@ in
           pkgs = {
             to = {
               type = "path";
-              path = "${pkgsFlake}";
+              path = "${pkgs.path}";
             };
             exact = true;
           };
@@ -127,9 +127,6 @@ in
         };
       };
 
-      environment.etc = {
-        "nixos/flake.nix".source = "/run/nixfiles/flake.nix";
-      };
       environment.systemPackages = with pkgs; mkMerge [
         [
           bash-completion
@@ -145,10 +142,7 @@ in
         fish.enable = mkDefault true;
         # TODO: This is expecting to look up the channel for the database...
         command-not-found.enable = mkDefault false;
-        vim = {
+        vim.defaultEditor = true;
-          enable = true;
-          defaultEditor = true;
-        };
       };
 
       services = {
@@ -215,35 +209,14 @@ in
             # python.d plugin script does #!/usr/bin/env bash
             path = with pkgs; [ bash ];
           };
-
-          nixfiles-mutable = {
-            description = "Mutable nixfiles";
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-            };
-
-            path = with pkgs; [ util-linux ];
-            script = ''
-              nixfilesDir="${self}"
-
-              mkdir -p /run/nixfiles{,/.rw,/.work}
-              mount -t overlay overlay -o lowerdir="$nixfilesDir",upperdir=/run/nixfiles/.rw,workdir=/run/nixfiles/.work /run/nixfiles
-              chmod -R u+w /run/nixfiles
-            '';
-            preStop = ''
-              umount /run/nixfiles
-              rm -rf /run/nixfiles
-            '';
-
-            wantedBy = [ "multi-user.target" ];
-          };
         };
       };
     }
     (mkIf config.services.kmscon.enable {
       fonts.fonts = with pkgs; [
-        nerd-fonts.sauce-code-pro
+        (nerdfonts.override {
+          fonts = [ "SourceCodePro" ];
+        })
       ];
     })
   ];

nixos/modules/containers.nix

@@ -1,6 +1,6 @@
 { lib, pkgs, options, config, systems, ... }:
 let
-  inherit (builtins) attrNames attrValues all hashString toJSON any;
+  inherit (builtins) attrNames attrValues all hashString toJSON;
   inherit (lib)
     groupBy' mapAttrsToList optionalString optional concatMapStringsSep filterAttrs mkOption mkDefault mkIf mkMerge;
   inherit (lib.my) mkOpt' mkBoolOpt';
@@ -15,7 +15,6 @@ let
     passAsFile = [ "code" ];
     code = ''
       #include <stdio.h>
-      #include <stdlib.h>
       #include <signal.h>
       #include <unistd.h>
       #include <systemd/sd-daemon.h>
@@ -99,7 +98,6 @@ let
       };
       networking = {
         bridge = mkOpt' (nullOr str) null "Network bridge to connect to.";
-        macVLAN = mkOpt' (nullOr str) null "Network interface to make MACVLAN interface from.";
       };
     };
   };
@@ -117,19 +115,26 @@ in
           assertion = config.systemd.network.enable;
           message = "Containers currently require systemd-networkd!";
         }
-        {
-          assertion = all (i: i.networking.bridge == null || i.networking.macVLAN == null) (attrValues cfg.instances);
-          message = "Only bridge OR MACVLAN can be set";
-        }
       ];
 
       # TODO: Better security
       my.firewall.trustedInterfaces =
         mapAttrsToList
           (n: _: "ve-${n}")
-          (filterAttrs (_: c: c.networking.bridge == null && c.networking.macVLAN == null) cfg.instances);
+          (filterAttrs (_: c: c.networking.bridge == null) cfg.instances);
 
-      systemd = mkMerge (mapAttrsToList (n: c: {
+      systemd = mkMerge ([
+        {
+          # By symlinking to the original systemd-nspawn@.service for every instance we force the unit generator to
+          # create overrides instead of replacing the unit entirely
+          packages = [
+            (pkgs.linkFarm "systemd-nspawn-containers" (map (n: {
+              name = "etc/systemd/system/systemd-nspawn@${n}.service";
+              path = "${pkgs.systemd}/example/systemd/system/systemd-nspawn@.service";
+            }) (attrNames cfg.instances)))
+          ];
+        }
+      ] ++ (mapAttrsToList (n: c: {
         nspawn."${n}" = {
           execConfig = {
             Boot = true;
@@ -160,8 +165,6 @@ in
           };
           networkConfig = if (c.networking.bridge != null) then {
             Bridge = c.networking.bridge;
-          } else if (c.networking.macVLAN != null) then {
-            MACVLAN = "${c.networking.macVLAN}:host0";
           } else {
             VirtualEthernet = true;
           };
@@ -179,9 +182,6 @@ in
             c.containerSystem;
         in
         {
-          # To prevent creating a whole new unit file
-          overrideStrategy = "asDropin";
-
           environment = {
             # systemd.nspawn units can't set the root directory directly, but /run/machines/${n} is one of the search paths
             root = "/run/machines/${n}";
@@ -247,7 +247,7 @@ in
             Bridge = c.networking.bridge;
           };
         };
-      }) cfg.instances);
+      }) cfg.instances));
     })
 
     # Inside container

nixos/modules/gui.nix

@@ -4,12 +4,6 @@ let
   inherit (lib.my) mkBoolOpt';
 
   cfg = config.my.gui;
-
-  androidUdevRules = pkgs.runCommand "udev-rules-android" {
-    rulesFile = ./android-udev.rules;
-  } ''
-    install -D "$rulesFile" "$out"/lib/udev/rules.d/51-android.rules
-  '';
 in
 {
   options.my.gui = with lib.types; {
@@ -18,7 +12,7 @@ in
 
   config = mkIf cfg.enable {
     hardware = {
-      graphics.enable = mkDefault true;
+      opengl.enable = mkDefault true;
     };
 
     systemd = {
@@ -29,19 +23,13 @@ in
 
     security = {
       polkit.enable = true;
-      pam.services.swaylock-plugin = {};
+      pam.services.swaylock = {};
-    };
-
-    users = {
-      groups = {
-        adbusers.gid = lib.my.c.ids.gids.adbusers;
-      };
     };
 
     environment.systemPackages = with pkgs; [
       # for pw-jack
       pipewire.jack
-      swaylock-plugin
+      swaylock
     ];
     services = {
       pipewire = {
@@ -56,21 +44,13 @@ in
       gnome = {
         gnome-keyring.enable = true;
       };
-      udisks2.enable = true;
 
       udev = {
-        packages = [
-          androidUdevRules
-        ];
         extraRules = ''
           # Nvidia
           SUBSYSTEM=="usb", ATTR{idVendor}=="0955", MODE="0664", GROUP="wheel"
           # Nintendo
           SUBSYSTEM=="usb", ATTR{idVendor}=="057e", MODE="0664", GROUP="wheel"
-          # FT
-          SUBSYSTEM=="usb", ATTR{idVendor}=="0403", MODE="0664", GROUP="wheel"
-          # /dev/player0
-          SUBSYSTEM=="usb", ATTR{idVendor}=="6969", MODE="0664", GROUP="wheel"
         '';
       };
     };
@@ -104,13 +84,5 @@ in
         ];
       };
     };
-
-    my = {
-      user = {
-        config = {
-          extraGroups = [ "adbusers" ];
-        };
-      };
-    };
   };
 }

nixos/modules/l2mesh.nix

@@ -36,16 +36,18 @@ let
         espOverhead =
           if (!mesh.security.enable) then 0
           else
-            # UDP encap + SPI + seq + IV + pad / header + ICV
+            # SPI + seq + IV + pad / header + ICV
-            (if mesh.udpEncapsulation then 8 else 0) + 4 + 4 + (if mesh.security.encrypt then 8 else 0) + 2 + 16;
+            4 + 4 + (if mesh.security.encrypt then 8 else 0) + 2 + 16;
         # UDP + VXLAN + Ethernet + L3 (IPv4/IPv6)
         overhead = espOverhead + 8 + 8 + 14 + mesh.l3Overhead;
       in
       toString (mesh.baseMTU - overhead);
 
       bridgeFDBs = mapAttrsToList (n: peer: {
-        MACAddress = "00:00:00:00:00:00";
+        bridgeFDBConfig = {
-        Destination = peer.addr;
+          MACAddress = "00:00:00:00:00:00";
+          Destination = peer.addr;
+        };
       }) otherPeers;
     };
   };
@@ -60,11 +62,7 @@ let
       chain l2mesh-${name} {
         ${optionalString mesh.security.enable ''
           udp dport isakmp accept
-          ${if mesh.udpEncapsulation then ''
+          meta l4proto esp accept
-            udp dport ipsec-nat-t accept
-          '' else ''
-            meta l4proto esp accept
-          ''}
         ''}
         ${optionalString (!mesh.security.enable) (vxlanAllow mesh.vni)}
         return
@@ -96,7 +94,6 @@ let
           esp=${if mesh.security.encrypt then "aes_gcm256" else "null-sha256"}
           ikev2=yes
           modecfgpull=no
-          encapsulation=${if mesh.udpEncapsulation then "yes" else "no"}
         '';
       })
     otherPeers);

nixos/modules/netboot/default.nix

@@ -1,236 +0,0 @@
-{ lib, pkgs, config, ... }:
-let
-  inherit (lib) mkMerge mkIf mkForce genAttrs concatMapStringsSep;
-  inherit (lib.my) mkOpt' mkBoolOpt';
-
-  cfg = config.my.netboot;
-
-  # Newer releases don't boot on desktop?
-  ipxe = pkgs.ipxe.overrideAttrs (o: rec {
-    version = "1.21.1-unstable-2024-06-27";
-    src = pkgs.fetchFromGitHub {
-      owner = "ipxe";
-      repo = "ipxe";
-      rev = "b66e27d9b29a172a097c737ab4d378d60fe01b05";
-      hash = "sha256-TKZ4WjNV2oZIYNefch7E7m1JpeoC/d7O1kofoNv8G40=";
-    };
-
-    # This upstream patch (in newer versions) is needed for newer GCC
-    patches = (if (o ? patches) then o.patches else []) ++ [ ./fix-uninitialised-var.patch ];
-  });
-  tftpRoot = pkgs.linkFarm "tftp-root" [
-    {
-      name = "ipxe-x86_64.efi";
-      path = "${ipxe}/ipxe.efi";
-    }
-  ];
-  menuFile = pkgs.runCommand "menu.ipxe" {
-    bootHost = cfg.server.host;
-  } ''
-    substituteAll ${./menu.ipxe} "$out"
-  '';
-
-  bootBuilder = pkgs.substituteAll {
-    src = ./netboot-loader-builder.py;
-    isExecutable = true;
-
-    inherit (pkgs) python3;
-    bootspecTools = pkgs.bootspec;
-    nix = config.nix.package.out;
-
-    inherit (config.system.nixos) distroName;
-    systemName = config.system.name;
-    inherit (cfg.client) configurationLimit;
-    checkMountpoints = pkgs.writeShellScript "check-mountpoints" ''
-      if ! ${pkgs.util-linuxMinimal}/bin/findmnt /boot > /dev/null; then
-        echo "/boot is not a mounted partition. Is the path configured correctly?" >&2
-        exit 1
-      fi
-    '';
-  };
-in
-{
-  options.my.netboot = with lib.types; {
-    client = {
-      enable = mkBoolOpt' false "Whether network booting should be enabled.";
-      configurationLimit = mkOpt' ints.unsigned 10 "Max generations to show in boot menu.";
-    };
-    server = {
-      enable = mkBoolOpt' false "Whether a netboot server should be enabled.";
-      ip = mkOpt' str null "IP clients should connect to via TFTP.";
-      host = mkOpt' str config.networking.fqdn "Hostname clients should connect to over HTTP / NFS.";
-      allowedPrefixes = mkOpt' (listOf str) null "Prefixes clients should be allowed to connect from (NFS).";
-      installer = {
-        storeSize = mkOpt' str "16GiB" "Total allowed writable size of store.";
-      };
-      instances = mkOpt' (listOf str) [ ] "Systems to hold boot files for.";
-    };
-  };
-
-  config = mkMerge [
-    (mkIf cfg.client.enable {
-      systemd = {
-        services = {
-          mount-boot = {
-            description = "Mount /boot";
-            after = [ "systemd-networkd-wait-online.service" ];
-            serviceConfig = {
-              Type = "oneshot";
-              RemainAfterExit = true;
-            };
-            path = with pkgs; [ gnused ldns nfs-utils ];
-            script = ''
-              get_cmdline() {
-                sed -rn "s/^.*$1=(\\S+).*\$/\\1/p" < /proc/cmdline
-              }
-
-              host="$(get_cmdline boothost)"
-              if [ -z "$host" ]; then
-                echo "boothost kernel parameter not found!" >&2
-                exit 1
-              fi
-
-              until [ -n "$(drill -Q $host)" ]; do
-                sleep 0.1
-              done
-
-              mkdir -p /boot
-              mount.nfs $host:/srv/netboot/systems/${config.system.name} /boot
-            '';
-
-            wantedBy = [ "remote-fs.target" ];
-          };
-        };
-      };
-
-      boot.supportedFilesystems.nfs = true;
-      boot.loader = {
-        grub.enable = false;
-        systemd-boot.enable = false;
-      };
-      system = {
-        build.installBootLoader = bootBuilder;
-        boot.loader.id = "ipxe-netboot";
-      };
-    })
-    (mkIf cfg.server.enable {
-      environment = {
-        etc = {
-          "netboot/menu.ipxe".source = menuFile;
-          "netboot/shell.efi".source = "${pkgs.edk2-uefi-shell}/shell.efi";
-        };
-      };
-
-      systemd = {
-        tmpfiles.settings."10-netboot" = genAttrs
-          (map (i: "/srv/netboot/systems/${i}") cfg.server.instances)
-          (p: {
-            d = {
-              user = "root";
-              group = "root";
-              mode = "0777";
-            };
-          });
-
-        services = {
-          netboot-update = {
-            description = "Update netboot images";
-            after = [ "systemd-networkd-wait-online.service" ];
-            serviceConfig.Type = "oneshot";
-            path = with pkgs; [
-              coreutils curl jq zstd gnutar
-            ];
-            script = ''
-              update_nixos() {
-                latestShort="$(curl -s https://git.nul.ie/api/v1/repos/dev/nixfiles/tags/installer \
-                             | jq -r .commit.sha | cut -c -7)"
-                if [ -f nixos-installer/tag.txt ] && [ "$(< nixos-installer/tag.txt)" = "$latestShort" ]; then
-                  echo "NixOS installer is up to date"
-                  return
-                fi
-
-                echo "Updating NixOS installer to $latestShort"
-                mkdir -p nixos-installer
-                fname="jackos-installer-netboot-$latestShort.tar.zst"
-                downloadUrl="$(curl -s https://git.nul.ie/api/v1/repos/dev/nixfiles/releases/tags/installer | \
-                               jq -r ".assets[] | select(.name == \"$fname\").browser_download_url")"
-                curl -Lo /tmp/nixos-installer-netboot.tar.zst "$downloadUrl"
-                tar -C nixos-installer --zstd -xf /tmp/nixos-installer-netboot.tar.zst
-                truncate -s "${cfg.server.installer.storeSize}" nixos-installer/rootfs.ext4
-                rm /tmp/nixos-installer-netboot.tar.zst
-                echo "$latestShort" > nixos-installer/tag.txt
-              }
-
-              mkdir -p /srv/netboot
-              cd /srv/netboot
-
-              ln -sf ${menuFile} boot.ipxe
-              ln -sf "${pkgs.edk2-uefi-shell}/shell.efi" "efi-shell-${config.nixpkgs.localSystem.linuxArch}.efi"
-              update_nixos
-            '';
-            startAt = "06:00";
-            wantedBy = [ "network-online.target" ];
-          };
-
-          nbd-server = {
-            serviceConfig = {
-              PrivateUsers = mkForce false;
-              CacheDirectory = "netboot";
-            };
-          };
-        };
-      };
-
-      services = {
-        atftpd = {
-          enable = true;
-          root = tftpRoot;
-        };
-
-        nginx = {
-          virtualHosts."${cfg.server.host}" = {
-            locations."/" = {
-              root = "/srv/netboot";
-              extraConfig = ''
-                autoindex on;
-              '';
-            };
-          };
-        };
-
-        nbd.server = {
-          enable = true;
-          extraOptions = {
-            allowlist = true;
-          };
-          exports = {
-            nixos-installer = {
-              path = "/srv/netboot/nixos-installer/rootfs.ext4";
-              extraOptions = {
-                copyonwrite = true;
-                cowdir = "/var/cache/netboot";
-                sparse_cow = true;
-              };
-            };
-          };
-        };
-
-        nfs = {
-          server = {
-            enable = true;
-            exports = ''
-              /srv/netboot/systems ${concatMapStringsSep " " (p: "${p}(rw,all_squash)") cfg.server.allowedPrefixes}
-            '';
-          };
-        };
-      };
-
-      my = {
-        tmproot.persistence.config.directories = [
-          "/srv/netboot"
-          { directory = "/var/cache/netboot"; mode = "0700"; }
-        ];
-      };
-    })
-  ];
-}

nixos/modules/netboot/fix-uninitialised-var.patch

@@ -1,48 +0,0 @@
-From 7f75d320f6d8ac7ec5185b2145da87f698aec273 Mon Sep 17 00:00:00 2001
-From: Michael Brown <mcb30@ipxe.org>
-Date: Mon, 2 Sep 2024 12:24:57 +0100
-Subject: [PATCH] [etherfabric] Fix use of uninitialised variable in
- falcon_xaui_link_ok()
-
-The link status check in falcon_xaui_link_ok() reads from the
-FCN_XX_CORE_STAT_REG_MAC register only on production hardware (where
-the FPGA version reads as zero), but modifies the value and writes
-back to this register unconditionally.  This triggers an uninitialised
-variable warning on newer versions of gcc.
-
-Fix by assuming that the register exists only on production hardware,
-and so moving the "modify-write" portion of the "read-modify-write"
-operation to also be covered by the same conditional check.
-
-Signed-off-by: Michael Brown <mcb30@ipxe.org>
----
- src/drivers/net/etherfabric.c | 15 +++++++++------
- 1 file changed, 9 insertions(+), 6 deletions(-)
-
-diff --git a/src/drivers/net/etherfabric.c b/src/drivers/net/etherfabric.c
-index b40596beae7..be30b71f79f 100644
---- a/src/drivers/net/etherfabric.c
-+++ b/src/drivers/net/etherfabric.c
-@@ -2225,13 +2225,16 @@ falcon_xaui_link_ok ( struct efab_nic *efab )
- 		sync = ( sync == FCN_XX_SYNC_STAT_DECODE_SYNCED );
- 		
- 		link_ok = align_done && sync;
--	}
- 
--	/* Clear link status ready for next read */
--	EFAB_SET_DWORD_FIELD ( reg, FCN_XX_COMMA_DET, FCN_XX_COMMA_DET_RESET );
--	EFAB_SET_DWORD_FIELD ( reg, FCN_XX_CHARERR, FCN_XX_CHARERR_RESET);
--	EFAB_SET_DWORD_FIELD ( reg, FCN_XX_DISPERR, FCN_XX_DISPERR_RESET);
--	falcon_xmac_writel ( efab, &reg, FCN_XX_CORE_STAT_REG_MAC );
-+		/* Clear link status ready for next read */
-+		EFAB_SET_DWORD_FIELD ( reg, FCN_XX_COMMA_DET,
-+				       FCN_XX_COMMA_DET_RESET );
-+		EFAB_SET_DWORD_FIELD ( reg, FCN_XX_CHARERR,
-+				       FCN_XX_CHARERR_RESET );
-+		EFAB_SET_DWORD_FIELD ( reg, FCN_XX_DISPERR,
-+				       FCN_XX_DISPERR_RESET );
-+		falcon_xmac_writel ( efab, &reg, FCN_XX_CORE_STAT_REG_MAC );
-+	}
- 
- 	has_phyxs = ( efab->phy_op->mmds & ( 1 << MDIO_MMD_PHYXS ) );
- 	if ( link_ok && has_phyxs ) {

nixos/modules/netboot/menu.ipxe

@@ -1,68 +0,0 @@
-#!ipxe
-
-set server http://@bootHost@
-
-# Figure out if client is 64-bit capable
-cpuid --ext 29 && set arch x86_64 || set arch i386
-
-isset ${menu-default} || set menu-default exit
-
-:start
-menu Welcome to /dev/player0's humble iPXE boot menu
-item --gap --           Operating Systems
-iseq ${arch} x86_64 &&
-item --key n nixos      NixOS installer
-# iseq ${arch} x86_64 &&
-# item --key a archlinux Arch Linux (archiso x86_64)
-# iseq ${arch} x86_64 &&
-# item --key p alpine   Alpine Linux
-item --gap --           Other Options
-item --key e efi_shell  UEFI Shell
-item --key x xyz        netboot.xyz
-item --key c config     iPXE settings
-item --key s shell      Drop to iPXE shell
-item --key r reboot     Reboot
-item --key q exit       Exit (and continue to next boot device)
-choose --timeout 0 --default ${menu-default} selected || goto cancel
-goto ${selected}
-
-:cancel
-echo You cancelled the menu, dropping you to an iPXE shell
-
-:shell
-echo Type 'exit' to go back to the menu
-shell
-set menu-default nixos
-goto start
-
-:failed
-echo Booting failed, dropping to shell
-goto shell
-
-:reboot
-reboot
-
-:exit
-exit
-
-:config
-config
-set menu-default config
-goto start
-
-:efi_shell
-chain ${server}/efi-shell-${arch}.efi || goto failed
-
-:xyz
-chain --autofree https://boot.netboot.xyz || goto failed
-
-:nixos
-set cmdline nbd_export=nixos-installer
-chain ${server}/nixos-installer/boot.ipxe || goto failed
-
-:archlinux
-# set mirrorurl https://arch.nul.ie/
-chain ${server}/arch.ipxe || goto failed
-
-:alpine
-chain ${server}/alpine.ipxe || goto failed

nixos/modules/netboot/netboot-loader-builder.py

@@ -1,280 +0,0 @@
-#! @python3@/bin/python3 -B
-# Based on `nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py`
-import argparse
-import datetime
-import glob
-import os
-import os.path
-import shutil
-import subprocess
-import sys
-import json
-from typing import NamedTuple, Dict, List
-from dataclasses import dataclass
-
-BOOT_MOUNT_POINT = '/boot'
-STORE_DIR = 'nix'
-
-# These values will be replaced with actual values during the package build
-BOOTSPEC_TOOLS = '@bootspecTools@'
-NIX = '@nix@'
-DISTRO_NAME = '@distroName@'
-SYSTEM_NAME = '@systemName@'
-CONFIGURATION_LIMIT = int('@configurationLimit@')
-CHECK_MOUNTPOINTS = "@checkMountpoints@"
-
-@dataclass
-class BootSpec:
-  init: str
-  initrd: str
-  kernel: str
-  kernelParams: List[str]
-  label: str
-  system: str
-  toplevel: str
-  specialisations: Dict[str, 'BootSpec']
-  sortKey: str
-  initrdSecrets: str | None = None
-
-class SystemIdentifier(NamedTuple):
-  profile: str | None
-  generation: int
-  specialisation: str | None
-
-def copy_if_not_exists(source: str, dest: str) -> None:
-  if not os.path.exists(dest):
-    shutil.copyfile(source, dest)
-
-def generation_dir(profile: str | None, generation: int) -> str:
-  if profile:
-    return f'/nix/var/nix/profiles/system-profiles/{profile}-{generation}-link'
-  else:
-    return f'/nix/var/nix/profiles/system-{generation}-link'
-
-def system_dir(i: SystemIdentifier) -> str:
-  d = generation_dir(i.profile, i.generation)
-  if i.specialisation:
-    return os.path.join(d, 'specialisation', i.specialisation)
-  else:
-    return d
-
-def entry_key(i: SystemIdentifier) -> str:
-  pieces = [
-    'nixos',
-    i.profile or None,
-    'generation',
-    str(i.generation),
-    f'specialisation-{i.specialisation}' if i.specialisation else None,
-  ]
-  return '-'.join(p for p in pieces if p)
-
-def bootspec_from_json(bootspec_json: Dict) -> BootSpec:
-  specialisations = bootspec_json['org.nixos.specialisation.v1']
-  specialisations = {k: bootspec_from_json(v) for k, v in specialisations.items()}
-  systemdBootExtension = bootspec_json.get('org.nixos.systemd-boot', {})
-  sortKey = systemdBootExtension.get('sortKey', 'nixos')
-  return BootSpec(
-    **bootspec_json['org.nixos.bootspec.v1'],
-    specialisations=specialisations,
-    sortKey=sortKey
-  )
-
-bootspecs = {}
-def get_bootspec(profile: str | None, generation: int) -> BootSpec:
-  k = (profile, generation)
-  if k in bootspecs:
-    return bootspecs[k]
-
-  system_directory = system_dir(SystemIdentifier(profile, generation, None))
-  boot_json_path = os.path.realpath(f'{system_directory}/boot.json')
-  if os.path.isfile(boot_json_path):
-    boot_json_f = open(boot_json_path, 'r')
-    bootspec_json = json.load(boot_json_f)
-  else:
-    boot_json_str = subprocess.check_output([
-      f'{BOOTSPEC_TOOLS}/bin/synthesize',
-      '--version',
-      '1',
-      system_directory,
-      '/dev/stdout',
-    ],
-    universal_newlines=True)
-    bootspec_json = json.loads(boot_json_str)
-
-  bs = bootspec_from_json(bootspec_json)
-  bootspecs[k] = bs
-  return bs
-
-def copy_from_file(file: str, dry_run: bool = False) -> str:
-  store_file_path = os.path.realpath(file)
-  suffix = os.path.basename(store_file_path)
-  store_dir = os.path.basename(os.path.dirname(store_file_path))
-  dst_path = f'/{STORE_DIR}/{store_dir}-{suffix}'
-  if not dry_run:
-    copy_if_not_exists(store_file_path, f'{BOOT_MOUNT_POINT}{dst_path}')
-  return dst_path
-
-MENU_ITEM = 'item {gen_key} {title} Generation {generation} {description}'
-
-BOOT_ENTRY = ''':{gen_key}
-kernel ${{server}}/systems/{system_name}{kernel} {kernel_params} boothost=${{boothost}}
-initrd ${{server}}/systems/{system_name}{initrd}
-boot
-'''
-
-def gen_entry(i: SystemIdentifier) -> (str, str):
-  bootspec = get_bootspec(i.profile, i.generation)
-  if i.specialisation:
-    bootspec = bootspec.specialisations[i.specialisation]
-  kernel = copy_from_file(bootspec.kernel)
-  initrd = copy_from_file(bootspec.initrd)
-
-  gen_key = entry_key(i)
-  title = '{name}{profile}{specialisation}'.format(
-    name=DISTRO_NAME,
-    profile=' [' + i.profile + ']' if i.profile else '',
-    specialisation=f' ({i.specialisation})' if i.specialisation else '')
-
-  kernel_params = f'init={bootspec.init} '
-
-  kernel_params = kernel_params + ' '.join(bootspec.kernelParams)
-  build_time = int(os.path.getctime(system_dir(i)))
-  build_date = datetime.datetime.fromtimestamp(build_time).strftime('%F')
-
-  return MENU_ITEM.format(
-    gen_key=gen_key,
-    title=title,
-    description=f'{bootspec.label}, built on {build_date}',
-    generation=i.generation,
-  ), BOOT_ENTRY.format(
-    gen_key=gen_key,
-    generation=i.generation,
-    system_name=SYSTEM_NAME,
-    kernel=kernel,
-    kernel_params=kernel_params,
-    initrd=initrd,
-  )
-
-def get_generations(profile: str | None = None) -> list[SystemIdentifier]:
-  gen_list = subprocess.check_output([
-    f'{NIX}/bin/nix-env',
-    '--list-generations',
-    '-p',
-    '/nix/var/nix/profiles/' + ('system-profiles/' + profile if profile else 'system')],
-    universal_newlines=True)
-  gen_lines = gen_list.split('\n')
-  gen_lines.pop()
-
-  configurationLimit = CONFIGURATION_LIMIT
-  configurations = [
-    SystemIdentifier(
-      profile=profile,
-      generation=int(line.split()[0]),
-      specialisation=None
-    )
-    for line in gen_lines
-  ]
-  return configurations[-configurationLimit:]
-
-def remove_old_files(gens: list[SystemIdentifier]) -> None:
-  known_paths = []
-  for gen in gens:
-    bootspec = get_bootspec(gen.profile, gen.generation)
-    known_paths.append(copy_from_file(bootspec.kernel, True))
-    known_paths.append(copy_from_file(bootspec.initrd, True))
-  for path in glob.iglob(f'{BOOT_MOUNT_POINT}/{STORE_DIR}/*'):
-    if not path in known_paths and not os.path.isdir(path):
-      os.unlink(path)
-
-def get_profiles() -> list[str]:
-  if os.path.isdir('/nix/var/nix/profiles/system-profiles/'):
-    return [x
-      for x in os.listdir('/nix/var/nix/profiles/system-profiles/')
-      if not x.endswith('-link')]
-  else:
-    return []
-
-MENU = '''#!ipxe
-# Server hostname option
-set boothost ${{66:string}}
-set server http://${{boothost}}
-
-:start
-menu {distro} boot menu
-item --gap -- Generations
-{generation_items}
-item --gap -- Other
-item --key m main Main netboot menu
-choose --timeout 5000 --default {menu_default} selected || goto cancel
-goto ${{selected}}
-
-:cancel
-shell
-goto start
-
-:error
-echo Booting failed, dropping to shell
-shell
-goto start
-
-:main
-chain ${{server}}/boot.ipxe || goto error
-'''
-
-def write_menu(gens: list[SystemIdentifier], default: SystemIdentifier) -> None:
-  gen_menu_items = []
-  gen_cmds = []
-
-  for g in gens:
-    bootspec = get_bootspec(g.profile, g.generation)
-    specialisations = [
-      SystemIdentifier(profile=g.profile, generation=g.generation, specialisation=s) for s in bootspec.specialisations]
-    for i in [g] + specialisations:
-      mi, cmds = gen_entry(i)
-      gen_menu_items.append(mi)
-      gen_cmds.append(cmds)
-
-  menu_file = f'{BOOT_MOUNT_POINT}/menu.ipxe'
-  with open(f'{menu_file}.tmp', 'w') as f:
-    f.write(MENU.format(
-      distro=DISTRO_NAME,
-      generation_items='\n'.join(gen_menu_items),
-      menu_default=entry_key(default),
-    ))
-
-    print(file=f)
-    print('\n\n'.join(gen_cmds), file=f)
-
-  os.rename(f'{menu_file}.tmp', menu_file)
-
-def install_bootloader(args: argparse.Namespace) -> None:
-  os.makedirs(f'{BOOT_MOUNT_POINT}/{STORE_DIR}', exist_ok=True)
-
-  gens = get_generations()
-  for profile in get_profiles():
-    gens += get_generations(profile)
-
-  gens = sorted(gens, key=lambda g: entry_key(g), reverse=True)
-
-  remove_old_files(gens)
-
-  for g in gens:
-    if os.path.dirname(get_bootspec(g.profile, g.generation).init) == os.path.realpath(args.default_config):
-      default = g
-      break
-  else:
-    assert False, 'No default generation found'
-
-  write_menu(gens, default)
-
-def main() -> None:
-  parser = argparse.ArgumentParser(description=f'Update {DISTRO_NAME}-related netboot files')
-  parser.add_argument('default_config', metavar='DEFAULT-CONFIG', help=f'The default {DISTRO_NAME} config to boot')
-  args = parser.parse_args()
-
-  subprocess.check_call(CHECK_MOUNTPOINTS)
-
-  install_bootloader(args)
-
-if __name__ == '__main__':
-  main()

nixos/modules/network.nix

@@ -1,6 +1,6 @@
 { lib, pkgs, config, ... }:
 let
-  inherit (lib) flatten optional mkIf mkDefault mkMerge versionAtLeast;
+  inherit (lib) flatten optional mkIf mkDefault mkMerge;
 in
 {
   config = mkMerge [
@@ -13,11 +13,9 @@ in
       };
 
       systemd = {
-        additionalUpstreamSystemUnits = mkIf (config.system.nixos.release == "24.12:u-24.11") [
+        additionalUpstreamSystemUnits = [
           # TODO: NixOS has its own version of this, but with `network` instead of `networkd`. Is this just a typo? It
           # hasn't been updated in 2 years...
-          # This has been done upstream now :)
-          # TODO: Remove when 25.05 releases
           "systemd-networkd-wait-online@.service"
         ];
       };

nixos/modules/nvme/default.nix

@@ -5,16 +5,8 @@ let
 
   cfg = config.my.nvme;
   nvme-cli = pkgs.nvme-cli.override {
-    libnvme = pkgs.libnvme.overrideAttrs (o: rec {
+    libnvme = pkgs.libnvme.overrideAttrs (o: {
-      # TODO: Remove when 1.11.1 releases (see https://github.com/linux-nvme/libnvme/pull/914)
+      patches = o.patches ++ [ ./libnvme-hostconf.patch ];
-      version = "1.11.1";
-      src = pkgs.fetchFromGitHub {
-        owner = "linux-nvme";
-        repo = "libnvme";
-        rev = "v${version}";
-        hash = "sha256-CEGr7PDOVRi210XvICH8iLYDKn8S9bGruBO4tycvsT8=";
-      };
-      patches = (if (o ? patches) then o.patches else [ ]) ++ [ ./libnvme-hostconf.patch ];
     });
   };
 
@@ -41,43 +33,24 @@ in
       etc = etc "";
     };
 
-    boot = mkIf (cfg.boot.nqn != null) {
+    boot.initrd.systemd = mkIf (cfg.boot.nqn != null) {
-      initrd = {
+      contents = etc "/etc/";
-        availableKernelModules = [ "rdma_cm" "iw_cm" "ib_cm" "nvme_core" "nvme_rdma" ];
+      extraBin.nvme = "${nvme-cli}/bin/nvme";
-        kernelModules = [ "nvme-fabrics" ];
-        systemd = {
-          contents = etc "/etc/";
-          extraBin = with pkgs; {
-            dmesg = "${util-linux}/bin/dmesg";
-            ip = "${iproute2}/bin/ip";
-            nvme = "${nvme-cli}/bin/nvme";
-          };
-          extraConfig = ''
-            DefaultTimeoutStartSec=20
-            DefaultDeviceTimeoutSec=20
-          '';
 
-          network = {
+      services.connect-nvme = {
-            enable = true;
+        description = "Connect NVMe-oF";
-            wait-online.enable = true;
+        before = [ "initrd-root-device.target" ];
-          };
+        after = [ "systemd-networkd-wait-online.service" ];
+        requires = [ "systemd-networkd-wait-online.service" ];
 
-          services.connect-nvme = {
+        serviceConfig = {
-            description = "Connect NVMe-oF";
+          Type = "oneshot";
-            before = [ "initrd-root-device.target" ];
+          ExecStart = "${nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn}";
-            after = [ "systemd-networkd-wait-online.service" ];
+          Restart = "on-failure";
-            requires = [ "systemd-networkd-wait-online.service" ];
+          RestartSec = 10;
-
-            serviceConfig = {
-              Type = "oneshot";
-              ExecStart = "${nvme-cli}/bin/nvme connect -t rdma -a ${cfg.boot.address} -n ${cfg.boot.nqn}";
-              Restart = "on-failure";
-              RestartSec = 10;
-            };
-
-            wantedBy = [ "initrd-root-device.target" ];
-          };
         };
+
+        wantedBy = [ "initrd-root-device.target" ];
       };
     };
   };

nixos/modules/tmproot.nix

@@ -2,7 +2,7 @@
 let
   inherit (lib)
     optionalString concatStringsSep concatMap concatMapStringsSep mkIf mkDefault mkMerge mkForce mkVMOverride
-    mkAliasDefinitions mapAttrsToList filterAttrs;
+    mkAliasDefinitions;
   inherit (lib.my) mkOpt' mkBoolOpt' mkVMOverride';
 
   cfg = config.my.tmproot;
@@ -147,15 +147,6 @@ in
             "/var/lib/systemd"
 
             { directory = "/root/.cache/nix"; mode = "0700"; }
-            # Including these unconditionally due to infinite recursion problems...
-            {
-              directory = "/etc/lvm/archive";
-              mode = "0700";
-            }
-            {
-              directory = "/etc/lvm/backup";
-              mode = "0700";
-            }
           ];
           files = [
             "/etc/machine-id"
@@ -269,6 +260,18 @@ in
         my.tmproot.persistence.config.files =
           concatMap (k: [ k.path "${k.path}.pub" ]) config.services.openssh.hostKeys;
       })
+      (mkIf config.services.lvm.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = "/etc/lvm/archive";
+            mode = "0700";
+          }
+          {
+            directory = "/etc/lvm/backup";
+            mode = "0700";
+          }
+        ];
+      })
       (mkIf (config.security.acme.certs != { }) {
         my.tmproot.persistence.config.directories = [
           {
@@ -489,104 +492,6 @@ in
           }
         ];
       })
-      (mkIf config.services.wastebin.enable {
-        my.tmproot.persistence.config.directories = [ "/var/lib/private/wastebin" ];
-      })
-      (mkIf config.services.photoprism.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = config.services.photoprism.storagePath;
-            mode = "0750";
-            user = "photoprism";
-            group = "photoprism";
-          }
-        ];
-      })
-      (mkIf config.services.mautrix-whatsapp.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/var/lib/mautrix-whatsapp";
-            mode = "0750";
-            user = "mautrix-whatsapp";
-            group = "mautrix-whatsapp";
-          }
-        ];
-      })
-      {
-        my.tmproot.persistence.config.directories = mapAttrsToList (n: i: {
-          directory = "/var/lib/${i.dataDir}";
-          mode = "0750";
-          user = "mautrix-meta-${n}";
-          group = "mautrix-meta";
-        }) (filterAttrs (_: i: i.enable) config.services.mautrix-meta.instances);
-      }
-      (mkIf config.services.unifi.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/var/lib/unifi";
-            mode = "0750";
-            user = "unifi";
-            group = "unifi";
-          }
-          {
-            directory = "/var/cache/unifi";
-            mode = "0750";
-            user = "unifi";
-            group = "unifi";
-          }
-        ];
-      })
-      (persistSimpleSvc "octoprint")
-      (mkIf (config.services.borgbackup.jobs != { }) {
-        my.tmproot.persistence.config.directories = [
-          "/var/lib/borgbackup"
-          "/var/cache/borgbackup"
-        ];
-
-        services.borgbackup.package = pkgs.borgbackup.overrideAttrs (o: {
-          makeWrapperArgs = o.makeWrapperArgs ++ [
-            "--set-default BORG_BASE_DIR /var/lib/borgbackup"
-            "--set-default BORG_CONFIG_DIR /var/lib/borgbackup/config"
-            "--set-default BORG_CACHE_DIR /var/cache/borgbackup"
-          ];
-        });
-      })
-      (mkIf (config.services ? "pds" && config.services.pds.enable) {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/var/lib/pds";
-            mode = "0750";
-            user = "pds";
-            group = "pds";
-          }
-        ];
-      })
-      (mkIf config.services.home-assistant.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = config.services.home-assistant.configDir;
-            mode = "0750";
-            user = "hass";
-            group = "hass";
-          }
-        ];
-      })
-      (mkIf config.services.frigate.enable {
-        my.tmproot.persistence.config.directories = [
-          {
-            directory = "/var/lib/frigate";
-            mode = "0755";
-            user = "frigate";
-            group = "frigate";
-          }
-          {
-            directory = "/var/cache/frigate";
-            mode = "0755";
-            user = "frigate";
-            group = "frigate";
-          }
-        ];
-      })
     ]))
   ]);
 

nixos/modules/user.nix

@@ -82,10 +82,6 @@ in
       # NOTE: As the "outermost" module is still being evaluated in NixOS land, special params (e.g. pkgs) won't be
       # passed to it
       home-manager.users.${user'.name} = mkAliasDefinitions options.my.user.homeConfig;
-
-      systemd.services.nixfiles-mutable.script = ''
-        chown -R ${user'.name} /run/nixfiles
-      '';
     }
     (mkIf (cfg.passwordSecret != null) {
       my = {

pkgs/chocolate-doom2xx/default.nix

@@ -1,49 +0,0 @@
-{ lib, stdenv, autoreconfHook, pkg-config, SDL, SDL_mixer, SDL_net
-, fetchFromGitHub, fetchpatch, python3 }:
-
-stdenv.mkDerivation rec {
-  pname = "chocolate-doom";
-  version = "2.3.0";
-
-  src = fetchFromGitHub {
-    owner = "chocolate-doom";
-    repo = pname;
-    rev = "${pname}-${version}";
-    sha256 = "sha256-1uw/1CYKBvDNgT5XxRBY24Evt3f4Y6YQ6bScU+KNHgM=";
-  };
-
-  patches = [
-    # Pull upstream patch to fix build against gcc-10:
-    #   https://github.com/chocolate-doom/chocolate-doom/pull/1257
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/chocolate-doom/chocolate-doom/commit/a8fd4b1f563d24d4296c3e8225c8404e2724d4c2.patch";
-      sha256 = "1dmbygn952sy5n8qqp0asg11pmygwgygl17lrj7i0fxa0nrhixhj";
-    })
-    ./demoloopi.patch
-  ];
-
-  outputs = [ "out" "man" ];
-
-  postPatch = ''
-    patchShebangs --build man/{simplecpp,docgen}
-  '';
-
-  nativeBuildInputs = [
-    autoreconfHook
-    pkg-config
-    # for documentation
-    python3
-  ];
-  buildInputs = [ (SDL.override { cacaSupport = true; }) SDL_mixer SDL_net ];
-  enableParallelBuilding = true;
-
-  meta = {
-    homepage = "http://chocolate-doom.org/";
-    description = "A Doom source port that accurately reproduces the experience of Doom as it was played in the 1990s";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix;
-    hydraPlatforms = lib.platforms.linux; # darwin times out
-    maintainers = with lib.maintainers; [ ];
-  };
-}

pkgs/chocolate-doom2xx/demoloopi.patch

@@ -1,91 +0,0 @@
-diff --git a/src/doom/d_main.c b/src/doom/d_main.c
-index 65a39a10..3f799b0f 100644
---- a/src/doom/d_main.c
-+++ b/src/doom/d_main.c
-@@ -483,6 +483,8 @@ void D_DoomLoop (void)
- //  DEMO LOOP
- //
- int             demosequence;
-+int             demoloopi;
-+char            demoloopname[9];
- int             pagetic;
- char                    *pagename;
- 
-@@ -524,6 +526,8 @@ void D_AdvanceDemo (void)
- //
- void D_DoAdvanceDemo (void)
- {
-+    int havedemo4;
-+
-     players[consoleplayer].playerstate = PST_LIVE;  // not reborn
-     advancedemo = false;
-     usergame = false;               // no save / end game here
-@@ -539,10 +543,14 @@ void D_DoAdvanceDemo (void)
-     // However! There is an alternate version of Final Doom that
-     // includes a fixed executable.
- 
--    if (gameversion == exe_ultimate || gameversion == exe_final)
-+    havedemo4 = gameversion == exe_ultimate || gameversion == exe_final;
-+    if (havedemo4)
-       demosequence = (demosequence+1)%7;
-     else
-       demosequence = (demosequence+1)%6;
-+
-+    if (demoloopi < 0 || demoloopi > (havedemo4 ? 3 : 2))
-+      I_Error("Invalid demo loop start %d", demoloopi);
-     
-     switch (demosequence)
-     {
-@@ -558,17 +566,11 @@ void D_DoAdvanceDemo (void)
- 	else
- 	  S_StartMusic (mus_intro);
- 	break;
--      case 1:
--	G_DeferedPlayDemo(DEH_String("demo1"));
--	break;
-       case 2:
- 	pagetic = 200;
- 	gamestate = GS_DEMOSCREEN;
- 	pagename = DEH_String("CREDIT");
- 	break;
--      case 3:
--	G_DeferedPlayDemo(DEH_String("demo2"));
--	break;
-       case 4:
- 	gamestate = GS_DEMOSCREEN;
- 	if ( gamemode == commercial)
-@@ -587,12 +589,14 @@ void D_DoAdvanceDemo (void)
- 	      pagename = DEH_String("HELP2");
- 	}
- 	break;
-+      case 1:
-+      case 3:
-       case 5:
--	G_DeferedPlayDemo(DEH_String("demo3"));
--	break;
-         // THE DEFINITIVE DOOM Special Edition demo
-       case 6:
--	G_DeferedPlayDemo(DEH_String("demo4"));
-+	DEH_snprintf(demoloopname, 9, "demo%d", demoloopi + 1);
-+	G_DeferedPlayDemo(demoloopname);
-+	demoloopi = (demoloopi+1) % (havedemo4 ? 4 : 3);
- 	break;
-     }
- 
-@@ -1891,7 +1895,15 @@ void D_DoomMain (void)
- 	G_TimeDemo (demolumpname);
- 	D_DoomLoop ();  // never returns
-     }
--	
-+
-+    p = M_CheckParmWithArgs("-demoloopi", 1);
-+    if (p)
-+    {
-+        demoloopi = atoi(myargv[p+1]);
-+    } else {
-+        demoloopi = 0;
-+    }
-+
-     if (startloadgame >= 0)
-     {
-         M_StringCopy(file, P_SaveGameFile(startloadgame), sizeof(file));

pkgs/default.nix

@@ -7,8 +7,5 @@ in
   monocraft' = callPackage ./monocraft.nix { };
   vfio-pci-bind = callPackage ./vfio-pci-bind.nix { };
   librespeed-go = callPackage ./librespeed-go.nix { };
-  # modrinth-app = callPackage ./modrinth-app { };
+  modrinth-app = callPackage ./modrinth-app { };
-  chocolate-doom2xx = callPackage ./chocolate-doom2xx { };
-  windowtolayer = callPackage ./windowtolayer.nix { };
-  swaylock-plugin = callPackage ./swaylock-plugin.nix { };
 }

pkgs/modrinth-app/default.nix

@@ -81,7 +81,7 @@ rustPlatform.buildRustPackage rec {
 
     dontFixup = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-Txttk8qZpDsAuiF8laKbZss/KEoT1Z+oepbj2s4XjE8=";
+    outputHash = "sha256-9HtTdIotG3sNIlWhd76v7Ia6P69ufp/FFqZfINXSkVc=";
   };
 
   preBuild = ''

pkgs/swaylock-plugin.nix

@@ -1,41 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch
-, meson, ninja, pkg-config, scdoc, wayland-scanner
-, wayland, wayland-protocols, libxkbcommon, cairo, gdk-pixbuf, pam
-}:
-
-stdenv.mkDerivation rec {
-  pname = "swaylock-plugin";
-  version = "1dd15b6";
-
-  src = fetchFromGitHub {
-    owner = "mstoeckl";
-    repo = pname;
-    rev = "1dd15b6ecbe91be7a3dc4a0fa9514fb166fb2e07";
-    hash = "sha256-xWyDDT8sXAL58HtA9ifzCenKMmOZquzXZaz3ttGGJuY=";
-  };
-
-  strictDeps = true;
-  depsBuildBuild = [ pkg-config ];
-  nativeBuildInputs = [ meson ninja pkg-config scdoc wayland-scanner ];
-  buildInputs = [ wayland wayland-protocols libxkbcommon cairo gdk-pixbuf pam ];
-
-  mesonFlags = [
-    "-Dpam=enabled" "-Dgdk-pixbuf=enabled" "-Dman-pages=enabled"
-  ];
-  env.NIX_CFLAGS_COMPILE = "-Wno-maybe-uninitialized";
-
-  meta = with lib; {
-    description = "Screen locker for Wayland -- fork with background plugin support";
-    longDescription = ''
-      Fork of swaylock, a screen locking utility for Wayland compositors.
-      With swaylock-plugin, you can for your lockscreen background display
-      the animated output from any wallpaper program that implements the
-      wlr-layer-shell-unstable-v1 protocol.
-    '';
-    inherit (src.meta) homepage;
-    mainProgram = "swaylock";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ devplayer0 ];
-  };
-}

pkgs/windowtolayer.nix

@@ -1,18 +0,0 @@
-{ lib
-, fetchFromGitLab
-, rustPlatform
-}:
-rustPlatform.buildRustPackage rec {
-  pname = "windowtolayer";
-  version = "a5b89c3c";
-
-  src = fetchFromGitLab {
-    domain = "gitlab.freedesktop.org";
-    owner = "mstoeckl";
-    repo = pname;
-    rev = "a5b89c3c047297fd574932860a6c89e9ea02ba5d";
-    hash = "sha256-rssL2XkbTqUvJqfUFhzULeE4/VBzjeBC5iZWSJ8MJ+M=";
-  };
-
-  cargoHash = "sha256-XHmLsx9qdjlBz4xJFFiO24bR9CMw1o5368K+YMpMIBA=";
-}

secrets/britnet/wg.key.age

@@ -1,13 +0,0 @@
------BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IHNqUFR5ZyBVVkI0
-dE5YN1pJWExzLzltcmhna2tJUmdRNjZ1Y1hwbzdtRE0wa2hReTNBCk4ydmNFK0FF
-b0RUdVl3a3d4amhKSEVhZWZPeHZDenBiTXpkVVFiNXFXNGsKLT4gWDI1NTE5IG9i
-K0ZrNEc5SVlyWU1EbXdlbWppRG1DdjFRbTBCREY2OUxrMmVqNHhSazQKVnRaVmVn
-MFBRL1dWeFNOaEwyU2szb1lOVzF1enQwdmVZZWRJcHd5MHdFbwotPiB2Wy1gUV8/
-LWdyZWFzZSBdSDFebHsgKkBkVzl+KnggJTEKdlhrdzVpMHYxUUliQnhaYXNaVWNR
-S3NxbjhFMEFGamZkRU1RNURhcmwzOGxFbGxXelhOdDBWTHBSY1hBcGFtUwpkampi
-WnhzMDcxTk1seWZ6VURZb1l1QU1GdwotLS0gRFNpcXpDUFZLTXFJN3Z0bEJQd280
-WGROWUVvdSt3ZUdBbmRNcGFhRE9BWQoDDlPEY/t2eapa4Xbv8FcW6gdLzQn7Y2cH
-5UwD+0CTF3JdUpxWUIx9RWFleHekkt8j1+2/oO+m7+24yCg5mdqTJ3ZIwu9uk1eI
-0As8IA==
------END AGE ENCRYPTED FILE-----

secrets/britway/bgp-password-vultr.conf.age

@@ -1,10 +1,10 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBrMXND
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBJYzdr
-Zm1ma0FoNE5lWTFNTGlyeUQzdUZxMkxyVlU0cWdrcTJEakhDVXg4ClkyczJDR1FL
+b1d2aEtVd3lVb3NBamRwVFpTaTRjZFlCczk4MVIwQUoxWklwN0NrCmFFekpPYUlO
-eXE3QWFTM0wyeDNvL1gvcmx6eGE4elNuZW9wRHhJZ3Aya2cKLT4gWDI1NTE5IDhO
+YlgvVlQ2WDR6amZDN0ZSY0Q3WWtTME5pUmhQeks1c3dGOVUKLT4gWDI1NTE5IHVK
-S2JWNDhlclpERFFUTktyUG5HbnNxcVQvWmphOGp1cmNpK0NGZWVTejQKN0dybHl5
+bUZvUVAvL0NmQzFkY3BuYm1wMjcwbFpLRUNpZjJCaW15SEVDUDV0REkKRXFMQ2d1
-eHhicFNpUHQ3WFZDQS90NG5VZW5zVm8rcUxCdkZkOFVqdVFzRQotPiBBLWdyZWFz
+NlFBejBvTlJrcUtCYWZxSDBkbmxIdExBNTU0aC8zRW5OVWllVQotPiBDLWdyZWFz
-ZSBaIDMiRCBYO1g6IF9EawpJZwotLS0geXhWb1FORm00RVJoMm4zQjhBT0hERyt3
+ZSBkeC4oTFUgO0FtJG9+RyB2IF1QXGhxVwpJS213MXBRMWY1cXlHZwotLS0gRUF2
-ekM1YXNzdTgzUTVMeHNsNDUwbwqSjgIVhg9bqtIydYC1FCA4ly2gurTcb1SUCMG8
+ZkswNlhvcDhTc2tybCs1dldwa2l6SDZZVmNkNUNjNGlkV1ZVa09pOAp88dxHGxVU
-XA9WAx1jv05xje+U97tRTTongJEW5vw=
+vuFQO6JcroY9MF5Te/YV+wMc3hVxksibMnH1TWGh207prwcOWNOEz2iEkZY=
 -----END AGE ENCRYPTED FILE-----

secrets/britway/cloudflare-credentials.conf.age

@@ -1,17 +1,15 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBjQmZr
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IERMTWVGZyBLVlg2
-VDl4TVlzK0lCc0YwdFM3TEptU3Q3cWZ1d0FJQUI4Q1g1TVNyOENFCkU4NE5lYVhI
+ZUdtUlFUQXBLT3B5YmkycWJnMXJyKzltbyt6K2dJK1RBUm5ydWwwCmRUdjJFSEYz
-d3B0amFJT1A1RTRSaUdUSmZ1WmU1SkVhTU9sdFZJR0p6UXcKLT4gWDI1NTE5IG5O
+Wnp4cGtzTXZwc0s0SUJQUjRlOUJlQUoyQ3BETXZmY0ppWG8KLT4gWDI1NTE5IGR5
-RG1SQnZtSUk0SThNYkRpOHFPS29kbjdUenZyYjBBSTJKdXNUaGpYMG8KME8waXJ0
+QUJzeG1DQTRLUmRwNnNSRUJRSFFtUDl5VjB0clVLYUp3R1g4TEVKaTgKb09tVlhF
-NWR2NHoyUkN1UUJoaVRxYXVMZlNvTHZqRmYvS2h4QjZpZm5NZwotPiBPclJULlkt
+R0tmcmIxMHVHcG80RGxRTEhBcngvT3MrdnNPbmpCTlRyZW5xQQotPiA6RzEtZ3Jl
-Z3JlYXNlIEVdKEBXIDUgXTBzIi58TwpweFJEcUFpR0x2WWhiVDlOTFArenhjNXBB
+YXNlCldSUlN2ejB0MGpyUHYzNS9OQmJTK3MvcXRDakdBVlhuUEt6SFE4QmhnWVN0
-dVo2d1JQWEJyVHlTRnUzdUlFUE45RWlLU3ZRS0c4UWs5Nm1qVHorCko1RVdqOVdz
+V1JMOE1oaEp5QQotLS0gYW1OMTcxNWJrUndmR2h0ZmRDWk5CYnJjc29pSERUMnNk
-aVAwY09KOUx4WktIVFBQclFXdFJZMTNVWHNKcTZFbDU5Q0xLaExvNVdlZ0pTczUr
+d2VhTGdpOW4yUQrEeH2E9m0YycuW60QrdlRetO1kNU5FaKXRQt46iA9lACIWD4rC
-SkVDTzhDUysKCi0tLSA2VGJMM2lrNkViaU0wcnArSG9PemJrQ3lrUFNnRDRVeE1p
+Cx6WxhCBgz3hvm9x6iuYiiQxZzgJNK7qXcV2MBeQdivazeEbC7blAKVPhwD/dl+b
-V3lxeG1iN3I4Ckf36lD/b7agsT0qW8eGDnxsVor8hEmLBSa35/eeAxqMd0xPvQko
+PzBDXRXG3c3jMjeZFT69fIBGJfZrrLGKpTALVE4dTVXmQmVVQDTp19IC+jUXHBti
-REzIxPuEHRQM5dE4s4H/mySTC/AVsiwfcMrnOXInm4o3MNAC9PREcef4NBOP3IMl
+Pj6Dpc7452s8zPkzZyRbasO9b4PYTwq8IHT6X7ITwbzZZm8gexDYe2SzRZ5VcPz3
-Mcoifar27EXs21XdXw/lLOVNDX7oDKZh1zXVX4lFTcRW0v8abbwchvuTiayKePMG
+El+yoULZ92WbXPSQIP/Slx4BEZjmsQS+sm0N8AnBRNZkWVbHPF9IZRg3VjDAn2i8
-DrcyFsj4jiwpJ5MmY/Q+n0lZmoAlAJkeTHRUptJxGMq+pWVEGMa8p1vUdrVwWq7G
+F3un5js=
-YYO5lPlms01BFJfUsysh07HY1HPkOyFHeEkviZtt4N8hopx0pP4fyAZYYdrBAIdt
-CLpQFQ==
 -----END AGE ENCRYPTED FILE-----