comparing 6f11bf19f2608dee38beb077ab6fec44f3f4c120 and main on pyrox.dev/nix

.nvim.lua

···

       22
        
               flake_parts_perSystem = {

     

       23
        
                 expr = "(builtins.getFlake (builtins.toString ./.)).currentSystem.options",

     

       24
        
               },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       25
        
             },

     

       26
        
           },

     

       27
        
         },

···

       22
        
               flake_parts_perSystem = {

     

       23
        
                 expr = "(builtins.getFlake (builtins.toString ./.)).currentSystem.options",

     

       24
        
               },

     

       25
       +
               my_modules = {

     

       26
       +
                 exper = "(pkgs.lib.evalModules { modules = (builtins.getFlake (builtins.toString ./.)).nixosModules; }).options",

     

       27
       +
               },

     

       28
        
             },

     

       29
        
           },

     

       30
        
         },

Justfile

···

       3
        
       

     

       4
        
       build:

     

       5
        
           nixos-rebuild-ng build --flake . --accept-flake-config --verbose --show-trace \

     

       0
        
       
     

       6
        
           && nvd diff /run/current-system result

     

       7
        
       

     

       8
        
       switch:

···

       3
        
       

     

       4
        
       build:

     

       5
        
           nixos-rebuild-ng build --flake . --accept-flake-config --verbose --show-trace \

     

       6
       +
             --max-jobs 3 --cores 6 \

     

       7
        
           && nvd diff /run/current-system result

     

       8
        
       

     

       9
        
       switch:

-2

TODO.md

···

       18
        
       - [ ] Move all Docker containers to using native versions of databases, redis, etc.

     

       19
        
         - Ensures higher performance and reduces the number of running containers.

     

       20
        
         - https://github.com/felschr/nixos-config/blob/main/services/immich.nix for an example of how to do it

     

       21
       -
       - [ ] Add Archivebox service(needs custom module)

     

       22
       -
       - [ ] Add Immich service

     

       23
        
       

     

       24
        
       ## Zaphod

     

       25

···

       18
        
       - [ ] Move all Docker containers to using native versions of databases, redis, etc.

     

       19
        
         - Ensures higher performance and reduces the number of running containers.

     

       20
        
         - https://github.com/felschr/nixos-config/blob/main/services/immich.nix for an example of how to do it

     

       0
        
       
     

       0
        
       
     

       21
        
       

     

       22
        
       ## Zaphod

     

       23

+7 -3

devShells/default/default.nix

···

       4
        
       }:

     

       5
        
       pkgs.mkShellNoCC {

     

       6
        
         packages = [

     

       0
        
       
     

       7
        
           pkgs.deadnix

     

       8
        
           pkgs.just

     

       9
        
           pkgs.nil

     

       0
        
       
     

       10
        
           pkgs.nix-tree

     

       0
        
       
     

       11
        
           pkgs.nixd

     

       12
       -
           pkgs.nix-output-monitor

     

       13
        
           pkgs.nixfmt-rfc-style

     

       14
       -
           pkgs.statix

     

       15
        
           pkgs.nvd

     

       16
       -
           pkgs.nixos-rebuild-ng

     

       0
        
       
     

       0
        
       
     

       17
        
         ];

     

       18
        
       }

···

       4
        
       }:

     

       5
        
       pkgs.mkShellNoCC {

     

       6
        
         packages = [

     

       7
       +
           # keep-sorted start

     

       8
        
           pkgs.deadnix

     

       9
        
           pkgs.just

     

       10
        
           pkgs.nil

     

       11
       +
           pkgs.nix-output-monitor

     

       12
        
           pkgs.nix-tree

     

       13
       +
           pkgs.nix-update

     

       14
        
           pkgs.nixd

     

       0
        
       
     

       15
        
           pkgs.nixfmt-rfc-style

     

       16
       +
           pkgs.nixos-rebuild-ng

     

       17
        
           pkgs.nvd

     

       18
       +
           pkgs.statix

     

       19
       +
           pkgs.tokei

     

       20
       +
           # keep-sorted endd

     

       21
        
         ];

     

       22
        
       }

+151 -79

flake.lock

···

       1
        
       {

     

       2
        
         "nodes": {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3
        
           "agenix": {

     

       4
        
             "inputs": {

     

       5
        
               "darwin": "darwin",

     
···

       25
        
               "type": "github"

     

       26
        
             }

     

       27
        
           },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       28
        
           "buildbot-nix": {

     

       29
        
             "inputs": {

     

       30
        
               "flake-parts": [

     
···

       37
        
               "treefmt-nix": []

     

       38
        
             },

     

       39
        
             "locked": {

     

       40
       -
               "lastModified": 1761641036,

     

       41
       -
               "narHash": "sha256-WyoAA5qBHimmWj0tuJMnkIq4o8dB01st6smx3ZzI/L0=",

     

       42
        
               "owner": "nix-community",

     

       43
        
               "repo": "buildbot-nix",

     

       44
       -
               "rev": "3cd0114c633815095fde7a3126e1dbd6ad2e673f",

     

       45
        
               "type": "github"

     

       46
        
             },

     

       47
        
             "original": {

     
···

       61
        
               ]

     

       62
        
             },

     

       63
        
             "locked": {

     

       64
       -
               "lastModified": 1762651107,

     

       65
       -
               "narHash": "sha256-V++8JREoP1TC6ROYByMAKx/cSyxza0tp1tUNOpq5Z4k=",

     

       66
        
               "owner": "caelestia-dots",

     

       67
        
               "repo": "shell",

     

       68
       -
               "rev": "c0ea060ffecd3f38233652556d3085d094082400",

     

       69
        
               "type": "github"

     

       70
        
             },

     

       71
        
             "original": {

     
···

       85
        
               ]

     

       86
        
             },

     

       87
        
             "locked": {

     

       88
       -
               "lastModified": 1762480719,

     

       89
       -
               "narHash": "sha256-TjTMNmndJJIxP/N6owC/CoAPiRuM99fNaQbZqHDtwLw=",

     

       90
        
               "owner": "caelestia-dots",

     

       91
        
               "repo": "cli",

     

       92
       -
               "rev": "9323fbf1b497204e17dff103cf412daf04a5c723",

     

       93
        
               "type": "github"

     

       94
        
             },

     

       95
        
             "original": {

     
···

       103
        
               "nixpkgs": "nixpkgs"

     

       104
        
             },

     

       105
        
             "locked": {

     

       106
       -
               "lastModified": 1762510976,

     

       107
       -
               "narHash": "sha256-KGoSj8qMOOPaNE48RTtuNBbqOvKLTeklnRHWWvE/TXo=",

     

       108
        
               "owner": "catppuccin",

     

       109
        
               "repo": "nix",

     

       110
       -
               "rev": "728cb0a667ce37bb0c68557dba819c7fb54ff1c8",

     

       111
        
               "type": "github"

     

       112
        
             },

     

       113
        
             "original": {

     
···

       162
        
           "dms": {

     

       163
        
             "inputs": {

     

       164
        
               "dgop": "dgop",

     

       165
       -
               "dms-cli": "dms-cli",

     

       166
        
               "nixpkgs": [

     

       167
        
                 "nixpkgs"

     

       168
        
               ]

     

       169
        
             },

     

       170
        
             "locked": {

     

       171
       -
               "lastModified": 1762714442,

     

       172
       -
               "narHash": "sha256-ptdW/V1X9td4Ym3ZO6NzXHU55nKzogQI1CUbqVP1PwU=",

     

       173
        
               "owner": "AvengeMedia",

     

       174
        
               "repo": "DankMaterialShell",

     

       175
       -
               "rev": "0197961175ba8e4ed56f90a9a2a6d35f87a2f51a",

     

       176
        
               "type": "github"

     

       177
        
             },

     

       178
        
             "original": {

     
···

       181
        
               "type": "github"

     

       182
        
             }

     

       183
        
           },

     

       184
       -
           "dms-cli": {

     

       185
       -
             "inputs": {

     

       186
       -
               "nixpkgs": [

     

       187
       -
                 "dms",

     

       188
       -
                 "nixpkgs"

     

       189
       -
               ]

     

       190
       -
             },

     

       191
       -
             "locked": {

     

       192
       -
               "lastModified": 1762491516,

     

       193
       -
               "narHash": "sha256-oGLH5Gje/p2Hc1kO3m8P5eAZ7JldBI30EmwzEET4cNU=",

     

       194
       -
               "owner": "AvengeMedia",

     

       195
       -
               "repo": "danklinux",

     

       196
       -
               "rev": "050cf28a2963a7698ed4759736fe5fe77eee7cc2",

     

       197
       -
               "type": "github"

     

       198
       -
             },

     

       199
       -
             "original": {

     

       200
       -
               "owner": "AvengeMedia",

     

       201
       -
               "repo": "danklinux",

     

       202
       -
               "type": "github"

     

       203
       -
             }

     

       204
       -
           },

     

       205
        
           "dms-plugins": {

     

       206
        
             "flake": false,

     

       207
        
             "locked": {

     

       208
       -
               "lastModified": 1762624195,

     

       209
       -
               "narHash": "sha256-zZigP1wet5mwZiXcAuzbWo4gPhPOOYLvG0DOOaWAJgQ=",

     

       210
        
               "owner": "AvengeMedia",

     

       211
        
               "repo": "dms-plugins",

     

       212
       -
               "rev": "759584dfe660d2f8af0c25f91884e0eb397d2424",

     

       213
        
               "type": "github"

     

       214
        
             },

     

       215
        
             "original": {

     
···

       250
        
               "type": "github"

     

       251
        
             }

     

       252
        
           },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       253
        
           "easy-hosts": {

     

       254
        
             "locked": {

     

       255
        
               "lastModified": 1755470564,

     
···

       299
        
               "nixpkgs-lib": "nixpkgs-lib"

     

       300
        
             },

     

       301
        
             "locked": {

     

       302
       -
               "lastModified": 1762440070,

     

       303
       -
               "narHash": "sha256-xxdepIcb39UJ94+YydGP221rjnpkDZUlykKuF54PsqI=",

     

       304
        
               "owner": "hercules-ci",

     

       305
        
               "repo": "flake-parts",

     

       306
       -
               "rev": "26d05891e14c88eb4a5d5bee659c0db5afb609d8",

     

       307
        
               "type": "github"

     

       308
        
             },

     

       309
        
             "original": {

     
···

       332
        
           },

     

       333
        
           "flake-utils_2": {

     

       334
        
             "inputs": {

     

       335
       -
               "systems": "systems_4"

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       336
        
             },

     

       337
        
             "locked": {

     

       338
        
               "lastModified": 1694529238,

     
···

       353
        
               "nixpkgs": [

     

       354
        
                 "nixpkgs"

     

       355
        
               ],

     

       356
       -
               "systems": "systems_3"

     

       357
        
             },

     

       358
        
             "locked": {

     

       359
       -
               "lastModified": 1760925941,

     

       360
       -
               "narHash": "sha256-M+EJsr6z05heKk6iuh3RWZS+9gAMBwG9IyryACVpOy0=",

     

       361
        
               "owner": "tailscale",

     

       362
        
               "repo": "golink",

     

       363
       -
               "rev": "42765dea97afa9f9f5ea167fb0df6f5372d78481",

     

       364
        
               "type": "github"

     

       365
        
             },

     

       366
        
             "original": {

     
···

       371
        
           },

     

       372
        
           "gomod2nix": {

     

       373
        
             "inputs": {

     

       374
       -
               "flake-utils": "flake-utils_2",

     

       375
        
               "nixpkgs": [

     

       376
        
                 "tangled",

     

       377
        
                 "nixpkgs"

     
···

       393
        
           },

     

       394
        
           "hardware": {

     

       395
        
             "locked": {

     

       396
       -
               "lastModified": 1762463231,

     

       397
       -
               "narHash": "sha256-hv1mG5j5PTbnWbtHHomzTus77pIxsc4x8VrMjc7+/YE=",

     

       398
        
               "owner": "nixos",

     

       399
        
               "repo": "nixos-hardware",

     

       400
       -
               "rev": "52113c4f5cfd1e823001310e56d9c8d0699a6226",

     

       401
        
               "type": "github"

     

       402
        
             },

     

       403
        
             "original": {

     
···

       438
        
               ]

     

       439
        
             },

     

       440
        
             "locked": {

     

       441
       -
               "lastModified": 1762704774,

     

       442
       -
               "narHash": "sha256-iodz4xQbULkHqetbPu5BCSWsVEzZiiNSv0/dzfH4XiE=",

     

       443
        
               "owner": "nix-community",

     

       444
        
               "repo": "home-manager",

     

       445
       -
               "rev": "be4a9233dd3f6104c9b0fdd3d56f953eb519a4c7",

     

       446
        
               "type": "github"

     

       447
        
             },

     

       448
        
             "original": {

     
···

       557
        
               ]

     

       558
        
             },

     

       559
        
             "locked": {

     

       560
       -
               "lastModified": 1762660502,

     

       561
       -
               "narHash": "sha256-C9F1C31ys0V7mnp4EcDy7L1cLZw/sCTEXqqTtGnvu08=",

     

       562
        
               "owner": "Mic92",

     

       563
        
               "repo": "nix-index-database",

     

       564
       -
               "rev": "15c5451c63f4c612874a43846bfe3fa828b03eee",

     

       565
        
               "type": "github"

     

       566
        
             },

     

       567
        
             "original": {

     
···

       572
        
           },

     

       573
        
           "nixpkgs": {

     

       574
        
             "locked": {

     

       575
       -
               "lastModified": 1762111121,

     

       576
       -
               "narHash": "sha256-4vhDuZ7OZaZmKKrnDpxLZZpGIJvAeMtK6FKLJYUtAdw=",

     

       577
        
               "owner": "NixOS",

     

       578
        
               "repo": "nixpkgs",

     

       579
       -
               "rev": "b3d51a0365f6695e7dd5cdf3e180604530ed33b4",

     

       580
        
               "type": "github"

     

       581
        
             },

     

       582
        
             "original": {

     
···

       603
        
           },

     

       604
        
           "nixpkgs-stalwart-fix": {

     

       605
        
             "locked": {

     

       606
       -
               "lastModified": 1755293787,

     

       607
       -
               "narHash": "sha256-L+msFwg9jXAj4JmDFQF9BIg2kQhgUzexVmDYePfKMW8=",

     

       608
        
               "owner": "pyrox0",

     

       609
        
               "repo": "nixpkgs",

     

       610
       -
               "rev": "52f6d43ca3db097cde5d0bfb30db0af5bdf41103",

     

       611
        
               "type": "github"

     

       612
        
             },

     

       613
        
             "original": {

     
···

       619
        
           },

     

       620
        
           "nixpkgs_2": {

     

       621
        
             "locked": {

     

       622
       -
               "lastModified": 315532800,

     

       623
       -
               "narHash": "sha256-RpDoXu4dMzS4Q3qq3vdlTXbL8ZLn42i5QPD5X0RPqT0=",

     

       624
       -
               "rev": "e1ebeec86b771e9d387dd02d82ffdc77ac753abc",

     

       625
        
               "type": "tarball",

     

       626
       -
               "url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre890836.e1ebeec86b77/nixexprs.tar.xz"

     

       627
        
             },

     

       628
        
             "original": {

     

       629
        
               "type": "tarball",

     
···

       653
        
               ]

     

       654
        
             },

     

       655
        
             "locked": {

     

       656
       -
               "lastModified": 1761897390,

     

       657
       -
               "narHash": "sha256-er4gYrIoThYLjlsOMTysoRfn67d1Gci+ZpqDrtQxrA0=",

     

       658
        
               "owner": "quickshell-mirror",

     

       659
        
               "repo": "quickshell",

     

       660
       -
               "rev": "fc704e6b5d445899a1565955268c91942a4f263f",

     

       661
        
               "type": "github"

     

       662
        
             },

     

       663
        
             "original": {

     
···

       676
        
               "dms-plugins": "dms-plugins",

     

       677
        
               "dms-power-usage": "dms-power-usage",

     

       678
        
               "dms-wp-shuffler": "dms-wp-shuffler",

     

       0
        
       
     

       679
        
               "easy-hosts": "easy-hosts",

     

       680
        
               "flake-compat": "flake-compat",

     

       681
        
               "flake-parts": "flake-parts",

     

       682
       -
               "flake-utils": "flake-utils",

     

       683
        
               "golink": "golink",

     

       684
        
               "hardware": "hardware",

     

       685
        
               "home-manager": "home-manager",

     
···

       765
        
               "type": "github"

     

       766
        
             }

     

       767
        
           },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       768
        
           "tangled": {

     

       769
        
             "inputs": {

     

       0
        
       
     

       770
        
               "flake-compat": "flake-compat_2",

     

       771
        
               "gomod2nix": "gomod2nix",

     

       772
        
               "htmx-src": "htmx-src",

     
···

       779
        
               "sqlite-lib-src": "sqlite-lib-src"

     

       780
        
             },

     

       781
        
             "locked": {

     

       782
       -
               "lastModified": 1762522051,

     

       783
       -
               "narHash": "sha256-qDVJ2sEQL0TJbWer6ByhhQrzHE1bZI3U1mmCk0sPZqo=",

     

       784
        
               "ref": "refs/heads/master",

     

       785
       -
               "rev": "2e5a4cde904d86825cefe5971e68f1bdfb1dd36f",

     

       786
       -
               "revCount": 1614,

     

       787
        
               "type": "git",

     

       788
        
               "url": "https://tangled.org/@tangled.org/core"

     

       789
        
             },

     
···

       799
        
               ]

     

       800
        
             },

     

       801
        
             "locked": {

     

       802
       -
               "lastModified": 1762410071,

     

       803
       -
               "narHash": "sha256-aF5fvoZeoXNPxT0bejFUBXeUjXfHLSL7g+mjR/p5TEg=",

     

       804
        
               "owner": "numtide",

     

       805
        
               "repo": "treefmt-nix",

     

       806
       -
               "rev": "97a30861b13c3731a84e09405414398fbf3e109f",

     

       807
        
               "type": "github"

     

       808
        
             },

     

       809
        
             "original": {

···

       1
        
       {

     

       2
        
         "nodes": {

     

       3
       +
           "actor-typeahead-src": {

     

       4
       +
             "flake": false,

     

       5
       +
             "locked": {

     

       6
       +
               "lastModified": 1762835797,

     

       7
       +
               "narHash": "sha256-heizoWUKDdar6ymfZTnj3ytcEv/L4d4fzSmtr0HlXsQ=",

     

       8
       +
               "ref": "refs/heads/main",

     

       9
       +
               "rev": "677fe7f743050a4e7f09d4a6f87bbf1325a06f6b",

     

       10
       +
               "revCount": 6,

     

       11
       +
               "type": "git",

     

       12
       +
               "url": "https://tangled.org/@jakelazaroff.com/actor-typeahead"

     

       13
       +
             },

     

       14
       +
             "original": {

     

       15
       +
               "type": "git",

     

       16
       +
               "url": "https://tangled.org/@jakelazaroff.com/actor-typeahead"

     

       17
       +
             }

     

       18
       +
           },

     

       19
        
           "agenix": {

     

       20
        
             "inputs": {

     

       21
        
               "darwin": "darwin",

     
···

       41
        
               "type": "github"

     

       42
        
             }

     

       43
        
           },

     

       44
       +
           "bird": {

     

       45
       +
             "inputs": {

     

       46
       +
               "flake-utils": "flake-utils",

     

       47
       +
               "nixpkgs": [

     

       48
       +
                 "dn42",

     

       49
       +
                 "nixpkgs"

     

       50
       +
               ]

     

       51
       +
             },

     

       52
       +
             "locked": {

     

       53
       +
               "lastModified": 1757884119,

     

       54
       +
               "narHash": "sha256-RF0Em7PjDRaQ5cBFgc3fL22qgDVbv2HoVW1TDRaaSNo=",

     

       55
       +
               "owner": "NuschtOS",

     

       56
       +
               "repo": "bird.nix",

     

       57
       +
               "rev": "f8d18c2c8eebd477987001a9c0af50a9ca7909e5",

     

       58
       +
               "type": "github"

     

       59
       +
             },

     

       60
       +
             "original": {

     

       61
       +
               "owner": "NuschtOS",

     

       62
       +
               "repo": "bird.nix",

     

       63
       +
               "type": "github"

     

       64
       +
             }

     

       65
       +
           },

     

       66
        
           "buildbot-nix": {

     

       67
        
             "inputs": {

     

       68
        
               "flake-parts": [

     
···

       75
        
               "treefmt-nix": []

     

       76
        
             },

     

       77
        
             "locked": {

     

       78
       +
               "lastModified": 1763946641,

     

       79
       +
               "narHash": "sha256-kPP7k2b+Dkd91yJO01y3l1F0t+Mqvv8+FrPfjcCwszg=",

     

       80
        
               "owner": "nix-community",

     

       81
        
               "repo": "buildbot-nix",

     

       82
       +
               "rev": "cd32d1c420320383bfcc80c1b0b402b6a7eccc23",

     

       83
        
               "type": "github"

     

       84
        
             },

     

       85
        
             "original": {

     
···

       99
        
               ]

     

       100
        
             },

     

       101
        
             "locked": {

     

       102
       +
               "lastModified": 1764466211,

     

       103
       +
               "narHash": "sha256-rBK+usqfAP9ZuEthw9wMCwTKQgKUMmziuzrrkpDZdzY=",

     

       104
        
               "owner": "caelestia-dots",

     

       105
        
               "repo": "shell",

     

       106
       +
               "rev": "40813e520582c5df11f6d4c870a31900fe171cce",

     

       107
        
               "type": "github"

     

       108
        
             },

     

       109
        
             "original": {

     
···

       123
        
               ]

     

       124
        
             },

     

       125
        
             "locked": {

     

       126
       +
               "lastModified": 1764381410,

     

       127
       +
               "narHash": "sha256-WR/oQQjveFqQxo8oHngZuOVgBQINDgPe+lCXLeNhAAg=",

     

       128
        
               "owner": "caelestia-dots",

     

       129
        
               "repo": "cli",

     

       130
       +
               "rev": "ed12d4cb82600872a82feb577711be1148c7af35",

     

       131
        
               "type": "github"

     

       132
        
             },

     

       133
        
             "original": {

     
···

       141
        
               "nixpkgs": "nixpkgs"

     

       142
        
             },

     

       143
        
             "locked": {

     

       144
       +
               "lastModified": 1764325801,

     

       145
       +
               "narHash": "sha256-LQ7tsrXs1wuB6KBwUctL3JlUsG/FWI2pCI6NkoO52dk=",

     

       146
        
               "owner": "catppuccin",

     

       147
        
               "repo": "nix",

     

       148
       +
               "rev": "a696fed6b9b6aa89ef495842cdca3fc2a7cef0de",

     

       149
        
               "type": "github"

     

       150
        
             },

     

       151
        
             "original": {

     
···

       200
        
           "dms": {

     

       201
        
             "inputs": {

     

       202
        
               "dgop": "dgop",

     

       0
        
       
     

       203
        
               "nixpkgs": [

     

       204
        
                 "nixpkgs"

     

       205
        
               ]

     

       206
        
             },

     

       207
        
             "locked": {

     

       208
       +
               "lastModified": 1764553800,

     

       209
       +
               "narHash": "sha256-kHlx3E3K2UNWI1Hpbyl5zieoOVevZfwz8P/OcyViDHY=",

     

       210
        
               "owner": "AvengeMedia",

     

       211
        
               "repo": "DankMaterialShell",

     

       212
       +
               "rev": "7959a795753d9f646cfb9e21cfb778adf7e5c933",

     

       213
        
               "type": "github"

     

       214
        
             },

     

       215
        
             "original": {

     
···

       218
        
               "type": "github"

     

       219
        
             }

     

       220
        
           },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       221
        
           "dms-plugins": {

     

       222
        
             "flake": false,

     

       223
        
             "locked": {

     

       224
       +
               "lastModified": 1764085668,

     

       225
       +
               "narHash": "sha256-KtOu12NVLdyho9T4EXJaReNhFO98nAXpemkb6yeOvwE=",

     

       226
        
               "owner": "AvengeMedia",

     

       227
        
               "repo": "dms-plugins",

     

       228
       +
               "rev": "3bc66f186a8184cb8eca5fdfc0699cb4a828cd90",

     

       229
        
               "type": "github"

     

       230
        
             },

     

       231
        
             "original": {

     
···

       266
        
               "type": "github"

     

       267
        
             }

     

       268
        
           },

     

       269
       +
           "dn42": {

     

       270
       +
             "inputs": {

     

       271
       +
               "bird": "bird",

     

       272
       +
               "nixpkgs": [

     

       273
       +
                 "nixpkgs"

     

       274
       +
               ]

     

       275
       +
             },

     

       276
       +
             "locked": {

     

       277
       +
               "lastModified": 1764646680,

     

       278
       +
               "narHash": "sha256-HEVzGL23bev8CuZXbLgDZRWy+mD/qPZhRBpjag7G/dU=",

     

       279
       +
               "owner": "pyrox0",

     

       280
       +
               "repo": "dn43.nix",

     

       281
       +
               "rev": "c8b68602cf1ef696e6a9f9c25e8c177d4101331b",

     

       282
       +
               "type": "github"

     

       283
       +
             },

     

       284
       +
             "original": {

     

       285
       +
               "owner": "pyrox0",

     

       286
       +
               "repo": "dn43.nix",

     

       287
       +
               "type": "github"

     

       288
       +
             }

     

       289
       +
           },

     

       290
        
           "easy-hosts": {

     

       291
        
             "locked": {

     

       292
        
               "lastModified": 1755470564,

     
···

       336
        
               "nixpkgs-lib": "nixpkgs-lib"

     

       337
        
             },

     

       338
        
             "locked": {

     

       339
       +
               "lastModified": 1763759067,

     

       340
       +
               "narHash": "sha256-LlLt2Jo/gMNYAwOgdRQBrsRoOz7BPRkzvNaI/fzXi2Q=",

     

       341
        
               "owner": "hercules-ci",

     

       342
        
               "repo": "flake-parts",

     

       343
       +
               "rev": "2cccadc7357c0ba201788ae99c4dfa90728ef5e0",

     

       344
        
               "type": "github"

     

       345
        
             },

     

       346
        
             "original": {

     
···

       369
        
           },

     

       370
        
           "flake-utils_2": {

     

       371
        
             "inputs": {

     

       372
       +
               "systems": "systems_3"

     

       373
       +
             },

     

       374
       +
             "locked": {

     

       375
       +
               "lastModified": 1731533236,

     

       376
       +
               "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",

     

       377
       +
               "owner": "numtide",

     

       378
       +
               "repo": "flake-utils",

     

       379
       +
               "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",

     

       380
       +
               "type": "github"

     

       381
       +
             },

     

       382
       +
             "original": {

     

       383
       +
               "owner": "numtide",

     

       384
       +
               "repo": "flake-utils",

     

       385
       +
               "type": "github"

     

       386
       +
             }

     

       387
       +
           },

     

       388
       +
           "flake-utils_3": {

     

       389
       +
             "inputs": {

     

       390
       +
               "systems": "systems_5"

     

       391
        
             },

     

       392
        
             "locked": {

     

       393
        
               "lastModified": 1694529238,

     
···

       408
        
               "nixpkgs": [

     

       409
        
                 "nixpkgs"

     

       410
        
               ],

     

       411
       +
               "systems": "systems_4"

     

       412
        
             },

     

       413
        
             "locked": {

     

       414
       +
               "lastModified": 1764170522,

     

       415
       +
               "narHash": "sha256-4c9jCOfkKNRHJLXgOIcVcNSaw/XaiVaqesaLJn86wGA=",

     

       416
        
               "owner": "tailscale",

     

       417
        
               "repo": "golink",

     

       418
       +
               "rev": "6821994de926c565d3ef9fbf3cb0e0fcb780f4be",

     

       419
        
               "type": "github"

     

       420
        
             },

     

       421
        
             "original": {

     
···

       426
        
           },

     

       427
        
           "gomod2nix": {

     

       428
        
             "inputs": {

     

       429
       +
               "flake-utils": "flake-utils_3",

     

       430
        
               "nixpkgs": [

     

       431
        
                 "tangled",

     

       432
        
                 "nixpkgs"

     
···

       448
        
           },

     

       449
        
           "hardware": {

     

       450
        
             "locked": {

     

       451
       +
               "lastModified": 1764440730,

     

       452
       +
               "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",

     

       453
        
               "owner": "nixos",

     

       454
        
               "repo": "nixos-hardware",

     

       455
       +
               "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",

     

       456
        
               "type": "github"

     

       457
        
             },

     

       458
        
             "original": {

     
···

       493
        
               ]

     

       494
        
             },

     

       495
        
             "locked": {

     

       496
       +
               "lastModified": 1764544324,

     

       497
       +
               "narHash": "sha256-GVBGjO7UsmzLrlOJV8NlKSxukHaHencrJqWkCA6FkqI=",

     

       498
        
               "owner": "nix-community",

     

       499
        
               "repo": "home-manager",

     

       500
       +
               "rev": "e4e25a8c310fa45f2a8339c7972dc43d2845a612",

     

       501
        
               "type": "github"

     

       502
        
             },

     

       503
        
             "original": {

     
···

       612
        
               ]

     

       613
        
             },

     

       614
        
             "locked": {

     

       615
       +
               "lastModified": 1764475780,

     

       616
       +
               "narHash": "sha256-77jL5H5x51ksLiOUDjY0ZK8e2T4ZXLhj3ap8ETvknWI=",

     

       617
        
               "owner": "Mic92",

     

       618
        
               "repo": "nix-index-database",

     

       619
       +
               "rev": "5a3ff8c1a09003f399f43d5742d893c0b1ab8af0",

     

       620
        
               "type": "github"

     

       621
        
             },

     

       622
        
             "original": {

     
···

       627
        
           },

     

       628
        
           "nixpkgs": {

     

       629
        
             "locked": {

     

       630
       +
               "lastModified": 1763966396,

     

       631
       +
               "narHash": "sha256-6eeL1YPcY1MV3DDStIDIdy/zZCDKgHdkCmsrLJFiZf0=",

     

       632
        
               "owner": "NixOS",

     

       633
        
               "repo": "nixpkgs",

     

       634
       +
               "rev": "5ae3b07d8d6527c42f17c876e404993199144b6a",

     

       635
        
               "type": "github"

     

       636
        
             },

     

       637
        
             "original": {

     
···

       658
        
           },

     

       659
        
           "nixpkgs-stalwart-fix": {

     

       660
        
             "locked": {

     

       661
       +
               "lastModified": 1762728499,

     

       662
       +
               "narHash": "sha256-XtT/8ID3gz9RGk8ITBnktmodq5/ZG6tF60XSfuKSmro=",

     

       663
        
               "owner": "pyrox0",

     

       664
        
               "repo": "nixpkgs",

     

       665
       +
               "rev": "b5178ff139339638e98a1e5833add22b047f96d0",

     

       666
        
               "type": "github"

     

       667
        
             },

     

       668
        
             "original": {

     
···

       674
        
           },

     

       675
        
           "nixpkgs_2": {

     

       676
        
             "locked": {

     

       677
       +
               "lastModified": 1764527385,

     

       678
       +
               "narHash": "sha256-gpwyCnyi2or0InBXe+4I9YeED3Uly3EGH58qvVnchBY=",

     

       679
       +
               "rev": "23258e03aaa49b3a68597e3e50eb0cbce7e42e9d",

     

       680
        
               "type": "tarball",

     

       681
       +
               "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre904683.23258e03aaa4/nixexprs.tar.xz"

     

       682
        
             },

     

       683
        
             "original": {

     

       684
        
               "type": "tarball",

     
···

       708
        
               ]

     

       709
        
             },

     

       710
        
             "locked": {

     

       711
       +
               "lastModified": 1764482797,

     

       712
       +
               "narHash": "sha256-ynV90KoBrPe38YFlKAHtPFk4Ee3IANUsIFGxRaq7H/s=",

     

       713
        
               "owner": "quickshell-mirror",

     

       714
        
               "repo": "quickshell",

     

       715
       +
               "rev": "d24e8e9736287d01ee73ef9d573d2bc316a62d5c",

     

       716
        
               "type": "github"

     

       717
        
             },

     

       718
        
             "original": {

     
···

       731
        
               "dms-plugins": "dms-plugins",

     

       732
        
               "dms-power-usage": "dms-power-usage",

     

       733
        
               "dms-wp-shuffler": "dms-wp-shuffler",

     

       734
       +
               "dn42": "dn42",

     

       735
        
               "easy-hosts": "easy-hosts",

     

       736
        
               "flake-compat": "flake-compat",

     

       737
        
               "flake-parts": "flake-parts",

     

       738
       +
               "flake-utils": "flake-utils_2",

     

       739
        
               "golink": "golink",

     

       740
        
               "hardware": "hardware",

     

       741
        
               "home-manager": "home-manager",

     
···

       821
        
               "type": "github"

     

       822
        
             }

     

       823
        
           },

     

       824
       +
           "systems_5": {

     

       825
       +
             "locked": {

     

       826
       +
               "lastModified": 1681028828,

     

       827
       +
               "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",

     

       828
       +
               "owner": "nix-systems",

     

       829
       +
               "repo": "default",

     

       830
       +
               "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",

     

       831
       +
               "type": "github"

     

       832
       +
             },

     

       833
       +
             "original": {

     

       834
       +
               "owner": "nix-systems",

     

       835
       +
               "repo": "default",

     

       836
       +
               "type": "github"

     

       837
       +
             }

     

       838
       +
           },

     

       839
        
           "tangled": {

     

       840
        
             "inputs": {

     

       841
       +
               "actor-typeahead-src": "actor-typeahead-src",

     

       842
        
               "flake-compat": "flake-compat_2",

     

       843
        
               "gomod2nix": "gomod2nix",

     

       844
        
               "htmx-src": "htmx-src",

     
···

       851
        
               "sqlite-lib-src": "sqlite-lib-src"

     

       852
        
             },

     

       853
        
             "locked": {

     

       854
       +
               "lastModified": 1764494836,

     

       855
       +
               "narHash": "sha256-u1i7aMo0fTQ6WVdOZhG2fo/gEx2Fq8+3URmuqEBZGWI=",

     

       856
        
               "ref": "refs/heads/master",

     

       857
       +
               "rev": "d37f774fb8c60aa2bd0cb965c9884457d0afb660",

     

       858
       +
               "revCount": 1689,

     

       859
        
               "type": "git",

     

       860
        
               "url": "https://tangled.org/@tangled.org/core"

     

       861
        
             },

     
···

       871
        
               ]

     

       872
        
             },

     

       873
        
             "locked": {

     

       874
       +
               "lastModified": 1762938485,

     

       875
       +
               "narHash": "sha256-AlEObg0syDl+Spi4LsZIBrjw+snSVU4T8MOeuZJUJjM=",

     

       876
        
               "owner": "numtide",

     

       877
        
               "repo": "treefmt-nix",

     

       878
       +
               "rev": "5b4ee75aeefd1e2d5a1cc43cf6ba65eba75e83e4",

     

       879
        
               "type": "github"

     

       880
        
             },

     

       881
        
             "original": {

+5 -1

flake.nix

···

       50
        
           ctp = {

     

       51
        
             url = "github:catppuccin/nix";

     

       52
        
           };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       53
        
           dms = {

     

       54
        
             url = "github:AvengeMedia/DankMaterialShell";

     

       55
        
             inputs.nixpkgs.follows = "nixpkgs";

     
···

       113
        
               inputs.easy-hosts.flakeModule

     

       114
        
               inputs.home-manager.flakeModules.home-manager

     

       115
        
               inputs.treefmt-nix.flakeModule

     

       116
       -
               ./packages

     

       117
        
               ./lib

     

       118
        
               ./overlays

     

       119
        
               ./devShells

···

       50
        
           ctp = {

     

       51
        
             url = "github:catppuccin/nix";

     

       52
        
           };

     

       53
       +
           dn42 = {

     

       54
       +
             url = "github:pyrox0/dn43.nix";

     

       55
       +
             inputs.nixpkgs.follows = "nixpkgs";

     

       56
       +
           };

     

       57
        
           dms = {

     

       58
        
             url = "github:AvengeMedia/DankMaterialShell";

     

       59
        
             inputs.nixpkgs.follows = "nixpkgs";

     
···

       117
        
               inputs.easy-hosts.flakeModule

     

       118
        
               inputs.home-manager.flakeModules.home-manager

     

       119
        
               inputs.treefmt-nix.flakeModule

     

       120
       +
               ./packages.nix

     

       121
        
               ./lib

     

       122
        
               ./overlays

     

       123
        
               ./devShells

+1 -1

homeModules/profiles/base/default.nix

···

       10
        
       {

     

       11
        
         options.py.profiles.base.enable = lib.mkEnableOption "Base Home Profile";

     

       12
        
         config = lib.mkIf cfg.enable {

     

       13
       -
           home.stateVersion = "25.11";

     

       14
        
           home.language = {

     

       15
        
             base = "en_US.utf8";

     

       16
        
           };

···

       10
        
       {

     

       11
        
         options.py.profiles.base.enable = lib.mkEnableOption "Base Home Profile";

     

       12
        
         config = lib.mkIf cfg.enable {

     

       13
       +
           home.stateVersion = "26.05";

     

       14
        
           home.language = {

     

       15
        
             base = "en_US.utf8";

     

       16
        
           };

+13 -10

homeModules/profiles/desktop/default.nix

···

       8
        
         cfg = config.py.profiles.desktop;

     

       9
        
         inherit (cfg) shell;

     

       10
        
         inherit (lib) mkIf mkDefault mkEnableOption;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       11
        
       in

     

       12
        
       {

     

       13
        
         options.py.profiles.desktop = {

     
···

       20
        
             default = "caelestia";

     

       21
        
             description = "The desktop shell to use in the graphical environment";

     

       22
        
           };

     

       23
       -
           caelestia = lib.mkOption {

     

       24
       -
             type = lib.types.bool;

     

       25
       -
             default = if (shell == "caelestia") then true else false;

     

       26
       -
             description = "Enable caelestia shell";

     

       27
       -
           };

     

       28
       -
           dms = lib.mkOption {

     

       29
       -
             type = lib.types.bool;

     

       30
       -
             default = if (shell == "dms") then true else false;

     

       31
       -
             description = "Enable DMS";

     

       32
       -
           };

     

       33
        
         };

     

       34
        
         config = mkIf cfg.enable {

     

       35
        
           py.profiles.base.enable = true;

···

       8
        
         cfg = config.py.profiles.desktop;

     

       9
        
         inherit (cfg) shell;

     

       10
        
         inherit (lib) mkIf mkDefault mkEnableOption;

     

       11
       +
       

     

       12
       +
         mkShellOption =

     

       13
       +
           name: var:

     

       14
       +
           lib.mkOption {

     

       15
       +
             type = lib.types.bool;

     

       16
       +
             default = if (shell == var) then true else false;

     

       17
       +
             description = "Enable ${name}";

     

       18
       +
             readOnly = true;

     

       19
       +
             visible = false;

     

       20
       +
             internal = true;

     

       21
       +
           };

     

       22
        
       in

     

       23
        
       {

     

       24
        
         options.py.profiles.desktop = {

     
···

       31
        
             default = "caelestia";

     

       32
        
             description = "The desktop shell to use in the graphical environment";

     

       33
        
           };

     

       34
       +
           caelestia = mkShellOption "Caelestia shell" "caelestia";

     

       35
       +
           dms = mkShellOption "DMS" "dms";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       36
        
         };

     

       37
        
         config = mkIf cfg.enable {

     

       38
        
           py.profiles.base.enable = true;

homeModules/programs/default.nix

···

       1
        
       {

     

       2
        
         imports = [

     

       0
        
       
     

       3
        
           ./caelestia

     

       4
        
           ./chromium

     

       5
        
           ./dms

     
···

       17
        
           ./starship

     

       18
        
           ./vscodium

     

       19
        
           ./zed-editor

     

       0
        
       
     

       20
        
         ];

     

       21
        
       }

···

       1
        
       {

     

       2
        
         imports = [

     

       3
       +
           # keep-sorted start

     

       4
        
           ./caelestia

     

       5
        
           ./chromium

     

       6
        
           ./dms

     
···

       18
        
           ./starship

     

       19
        
           ./vscodium

     

       20
        
           ./zed-editor

     

       21
       +
           # keep-sorted end

     

       22
        
         ];

     

       23
        
       }

+6 -6

homeModules/programs/neovim/default.nix

···

       24
        
             pkgs.gcc

     

       25
        
             pkgs.go

     

       26
        
             pkgs.nodejs

     

       27
       -
           ]

     

       28
       -
           ++ lib.optionals config.py.profiles.gui.enable [

     

       29
       -
             pkgs.ffmpegthumbnailer

     

       30
       -
             pkgs.fontpreview

     

       31
       -
             pkgs.poppler

     

       32
       -
             pkgs.ueberzug

     

       33
        
           ];

     

       34
        
         };

     

       35
        
       }

···

       24
        
             pkgs.gcc

     

       25
        
             pkgs.go

     

       26
        
             pkgs.nodejs

     

       27
       +
             # ]

     

       28
       +
             # ++ lib.optionals config.py.profiles.gui.enable [

     

       29
       +
             #   pkgs.ffmpegthumbnailer

     

       30
       +
             #   pkgs.fontpreview

     

       31
       +
             #   pkgs.poppler

     

       32
       +
             #   pkgs.ueberzug

     

       33
        
           ];

     

       34
        
         };

     

       35
        
       }

+1 -1

homeModules/wayland/hypridle.nix

···

       12
        
           settings = {

     

       13
        
             general = {

     

       14
        
               lock_cmd = "loginctl lock-session";

     

       15
       -
               before_sleep_cmd = "loginctl lock-session";

     

       16
        
               after_sleep_cmd = "hyprctl dispatch dpms on";

     

       17
        
               inhibit_sleep = 3;

     

       18
        
             };

···

       12
        
           settings = {

     

       13
        
             general = {

     

       14
        
               lock_cmd = "loginctl lock-session";

     

       15
       +
               # before_sleep_cmd = "loginctl lock-session";

     

       16
        
               after_sleep_cmd = "hyprctl dispatch dpms on";

     

       17
        
               inhibit_sleep = 3;

     

       18
        
             };

hosts/default.nix

···

       40
        
                 "server"

     

       41
        
                 "vps"

     

       42
        
               ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       43
        
             };

     

       44
        
             thought = {

     

       45
        
               deployable = true;

···

       40
        
                 "server"

     

       41
        
                 "vps"

     

       42
        
               ];

     

       43
       +
               modules = [

     

       44
       +
                 inputs.dn42.nixosModules.default

     

       45
       +
               ];

     

       46
        
             };

     

       47
        
             thought = {

     

       48
        
               deployable = true;

+4 -5

hosts/marvin/default.nix

···

       8
        
           ./hardware.nix

     

       9
        
       

     

       10
        
           # Running Services

     

       0
        
       
     

       11
        
           ./services/anubis.nix

     

       12
       -
           # ./services/authentik.nix

     

       13
        
           ./services/avahi.nix

     

       14
        
           ./services/bots.nix

     

       15
        
           ./services/deemix.nix

     
···

       17
        
           ./services/git.nix

     

       18
        
           ./services/golink.nix

     

       19
        
           ./services/grafana.nix

     

       20
       -
           # ./services/iceshrimp.nix

     

       21
        
           ./services/jellyfin.nix

     

       22
        
           ./services/matrix.nix

     

       23
        
           ./services/miniflux.nix

     

       0
        
       
     

       24
        
           ./services/nginx.nix

     

       25
       -
           ./services/nextcloud

     

       26
        
           ./services/pinchflat.nix

     

       27
       -
           ./services/pingvin-share.nix

     

       28
        
           ./services/planka.nix

     

       29
        
           ./services/pocket-id.nix

     

       30
        
           ./services/podman.nix

     

       31
        
           ./services/postgres.nix

     

       32
        
           ./services/prometheus.nix

     

       33
       -
           # ./services/redlib.nix

     

       34
        
           ./services/scrutiny.nix

     

       35
        
           ./services/syncthing.nix

     

       36
        
           ./services/tailscale.nix

     

       37
        
           ./services/tangled.nix

     

       38
        
           ./services/vaultwarden.nix

     

       39
        
           ./services/zfs.nix

     

       0
        
       
     

       40
        
         ];

     

       41
        
         nix.settings.max-jobs = 12;

     

       42
        
         networking = {

···

       8
        
           ./hardware.nix

     

       9
        
       

     

       10
        
           # Running Services

     

       11
       +
           # keep-sorted start

     

       12
        
           ./services/anubis.nix

     

       0
        
       
     

       13
        
           ./services/avahi.nix

     

       14
        
           ./services/bots.nix

     

       15
        
           ./services/deemix.nix

     
···

       17
        
           ./services/git.nix

     

       18
        
           ./services/golink.nix

     

       19
        
           ./services/grafana.nix

     

       20
       +
           ./services/immich.nix

     

       21
        
           ./services/jellyfin.nix

     

       22
        
           ./services/matrix.nix

     

       23
        
           ./services/miniflux.nix

     

       24
       +
           ./services/nextcloud

     

       25
        
           ./services/nginx.nix

     

       0
        
       
     

       26
        
           ./services/pinchflat.nix

     

       0
        
       
     

       27
        
           ./services/planka.nix

     

       28
        
           ./services/pocket-id.nix

     

       29
        
           ./services/podman.nix

     

       30
        
           ./services/postgres.nix

     

       31
        
           ./services/prometheus.nix

     

       0
        
       
     

       32
        
           ./services/scrutiny.nix

     

       33
        
           ./services/syncthing.nix

     

       34
        
           ./services/tailscale.nix

     

       35
        
           ./services/tangled.nix

     

       36
        
           ./services/vaultwarden.nix

     

       37
        
           ./services/zfs.nix

     

       38
       +
           # keep-sorted end

     

       39
        
         ];

     

       40
        
         nix.settings.max-jobs = 12;

     

       41
        
         networking = {

hosts/marvin/services/anubis.nix

···

       1
        
       {

     

       2
        
         config,

     

       0
        
       
     

       3
        
         ...

     

       4
        
       }:

     

       5
        
       {

     
···

       15
        
               ED25519_PRIVATE_KEY_HEX_FILE = config.age.secrets.anubis-key.path;

     

       16
        
               OG_PASSTHROUGH = true;

     

       17
        
               OG_CACHE_CONSIDER_HOST = true;

     

       0
        
       
     

       18
        
             };

     

       19
        
           };

     

       20
        
           age.secrets.anubis-key = {

···

       1
        
       {

     

       2
        
         config,

     

       3
       +
         self',

     

       4
        
         ...

     

       5
        
       }:

     

       6
        
       {

     
···

       16
        
               ED25519_PRIVATE_KEY_HEX_FILE = config.age.secrets.anubis-key.path;

     

       17
        
               OG_PASSTHROUGH = true;

     

       18
        
               OG_CACHE_CONSIDER_HOST = true;

     

       19
       +
               POLICY_FNAME = "${self'.packages.anubis-files}/policies/default.yaml";

     

       20
        
             };

     

       21
        
           };

     

       22
        
           age.secrets.anubis-key = {

-92

hosts/marvin/services/authentik.nix

···

       1
       -
       {

     

       2
       -
         config,

     

       3
       -
         self,

     

       4
       -
         ...

     

       5
       -
       }:

     

       6
       -
       let

     

       7
       -
         d = self.lib.data.services.authentik;

     

       8
       -
       in

     

       9
       -
       {

     

       10
       -
         virtualisation.oci-containers.containers =

     

       11
       -
           let

     

       12
       -
             authentikVersion = "2025.4";

     

       13
       -
             base = {

     

       14
       -
               environmentFiles = [ config.age.secrets.authentik-env.path ];

     

       15
       -
               extraOptions = [ "--network=authentik" ];

     

       16
       -
             };

     

       17
       -
             authentikBase = base // {

     

       18
       -
               image = "ghcr.io/goauthentik/server:${authentikVersion}";

     

       19
       -
               environment = {

     

       20
       -
                 AUTHENTIK_REDIS__HOST = "authentik-redict";

     

       21
       -
       

     

       22
       -
                 # Postgres Settings

     

       23
       -
                 AUTHENTIK_POSTGRESQL__HOST = "authentik-db";

     

       24
       -
                 AUTHENTIK_POSTGRESQL__PORT = "5432";

     

       25
       -
                 AUTHENTIK_POSTGRESQL__USER = "authentik";

     

       26
       -
                 AUTHENTIK_POSTGRESQL__NAME = "authentik";

     

       27
       -
                 AUTHENTIK_POSTGRESQL__PASSWORD = "\${PG_PASS}";

     

       28
       -
       

     

       29
       -
                 # Disable error reporting

     

       30
       -
                 AUTHENTIK_ERROR_REPORTING__ENABLED = "false";

     

       31
       -
       

     

       32
       -
                 # Avatars are an attribute based on an uploaded file

     

       33
       -
                 AUTHENTIK_AVATARS = "attributes.user.avatar";

     

       34
       -
       

     

       35
       -
                 # Email Settings

     

       36
       -
                 AUTHENTIK_EMAIL__HOST = "mail.pyrox.dev";

     

       37
       -
                 AUTHENTIK_EMAIL__USERNAME = "auth@pyrox.dev";

     

       38
       -
                 AUTHENTIK_EMAIL__PORT = "465";

     

       39
       -
                 AUTHENTIK_EMAIL__USE_TLS = "true";

     

       40
       -
                 AUTHENTIK_EMAIL__FROM = "PyroServ Auth <auth@pyrox.dev>";

     

       41
       -
               };

     

       42
       -
             };

     

       43
       -
             authentikVols = [

     

       44
       -
               "/var/lib/authentik/media:/media"

     

       45
       -
               "/var/lib/authentik/templates:/templates"

     

       46
       -
             ];

     

       47
       -
           in

     

       48
       -
           {

     

       49
       -
             authentik-db = base // {

     

       50
       -
               image = "postgres:17-alpine";

     

       51
       -
               volumes = [ "/var/lib/authentik/db:/var/lib/postgresql/data" ];

     

       52
       -
               environment = {

     

       53
       -
                 POSTGRES_PASSWORD = "\${PG_PASS}";

     

       54
       -
                 POSTGRES_USER = "authentik";

     

       55
       -
                 POSTGRES_DB = "authentik";

     

       56
       -
               };

     

       57
       -
             };

     

       58
       -
             authentik-redict = {

     

       59
       -
               image = "registry.redict.io/redict:alpine";

     

       60
       -
               extraOptions = [ "--network=authentik" ];

     

       61
       -
             };

     

       62
       -
             authentik-server = authentikBase // {

     

       63
       -
               cmd = [ "server" ];

     

       64
       -
               ports = [

     

       65
       -
                 "${toString d.port}:9000"

     

       66
       -
                 "6943:9443"

     

       67
       -
                 "9301:9300"

     

       68
       -
               ];

     

       69
       -
               volumes = authentikVols ++ [ "/var/lib/authentik/custom.css:/web/dist/custom.css" ];

     

       70
       -
             };

     

       71
       -
             authentik-worker = authentikBase // {

     

       72
       -
               cmd = [ "worker" ];

     

       73
       -
               volumes = authentikVols ++ [ "/var/lib/authentik/certs:/certs" ];

     

       74
       -
             };

     

       75
       -
             authentik-ldap = base // {

     

       76
       -
               image = "ghcr.io/goauthentik/ldap:${authentikVersion}";

     

       77
       -
               ports = [

     

       78
       -
                 "389:3389"

     

       79
       -
                 "636:6636"

     

       80
       -
               ];

     

       81
       -
               environment = {

     

       82
       -
                 AUTHENTIK_HOST = "https://${d.extUrl}";

     

       83
       -
                 AUTHENTIK_INSECURE = "false";

     

       84
       -
               };

     

       85
       -
             };

     

       86
       -
           };

     

       87
       -
         age.secrets.authentik-env = {

     

       88
       -
           file = ./secrets/authentik-env.age;

     

       89
       -
           owner = "thehedgehog";

     

       90
       -
           group = "misc";

     

       91
       -
         };

     

       92
       -
       }

-5

hosts/marvin/services/bookstack.nix

···

       1
       -
       {

     

       2
       -
         services.bookstack = {

     

       3
       -
           enable = true;

     

       4
       -
         };

     

       5
       -
       }

+1 -1

hosts/marvin/services/gdq-cals.nix

···

       19
        
             description = "GDQ Calendar Updater";

     

       20
        
             path = [ pyWithLibs ];

     

       21
        
             serviceConfig = {

     

       22
       -
               ExecStart = "${lib.getExe pyWithLibs} gdq_cal_ics_exporter.py--fatales --gcal --disable_general";

     

       23
        
               Type = "oneshot";

     

       24
        
               WorkingDirectory = "/home/thehedgehog/gdq-cals/";

     

       25
        
               User = "thehedgehog";

···

       19
        
             description = "GDQ Calendar Updater";

     

       20
        
             path = [ pyWithLibs ];

     

       21
        
             serviceConfig = {

     

       22
       +
               ExecStart = "${lib.getExe pyWithLibs} gdq_cal_ics_exporter.py --fatales --gcal --disable_general";

     

       23
        
               Type = "oneshot";

     

       24
        
               WorkingDirectory = "/home/thehedgehog/gdq-cals/";

     

       25
        
               User = "thehedgehog";

+5 -5

hosts/marvin/services/git.nix

···

       41
        
           };

     

       42
        
           settings = {

     

       43
        
             DEFAULT = {

     

       44
       -
               APP_NAME = "PyroNet Git";

     

       45
        
               RUN_MODE = "prod";

     

       46
        
             };

     

       47
        
             attachment = {

     

       48
        
               MAX_SIZE = 200;

     

       49
        
             };

     

       50
       -
             log."logger.router.MODE" = "";

     

       51
        
             mailer = {

     

       52
        
               ENABLED = true;

     

       53
       -
               FROM = "PyroNet Git <git@pyrox.dev>";

     

       54
        
               PROTOCOL = "smtps";

     

       55
        
               SMTP_ADDR = "mail.pyrox.dev";

     

       56
        
               SMTP_PORT = 465;

     
···

       66
        
             };

     

       67
        
             "ui.meta" = {

     

       68
        
               AUTHOR = "dish";

     

       69
       -
               DESCRIPTION = "PyroNet Git Services";

     

       70
        
             };

     

       71
        
             metrics = {

     

       72
        
               ENABLED = true;

     
···

       85
        
               ISSUE_INDEXER_PATH = "indexers/issues.bleve";

     

       86
        
               # Enable repo indexing

     

       87
        
               REPO_INDEXER_ENABLED = true;

     

       88
       -
               REPO_INDEXER_REPO_TYPES = "sources,forks,templates,mirrors";

     

       89
        
               REPO_INDEXER_TYPE = "bleve";

     

       90
        
               REPO_INDEXER_PATH = "indexers/repos.bleve";

     

       91
        
             };

···

       41
        
           };

     

       42
        
           settings = {

     

       43
        
             DEFAULT = {

     

       44
       +
               APP_NAME = "dishNet Git";

     

       45
        
               RUN_MODE = "prod";

     

       46
        
             };

     

       47
        
             attachment = {

     

       48
        
               MAX_SIZE = 200;

     

       49
        
             };

     

       50
       +
             log.LOGGER_ROUTER_MODE = "";

     

       51
        
             mailer = {

     

       52
        
               ENABLED = true;

     

       53
       +
               FROM = "dishNet Git <git@pyrox.dev>";

     

       54
        
               PROTOCOL = "smtps";

     

       55
        
               SMTP_ADDR = "mail.pyrox.dev";

     

       56
        
               SMTP_PORT = 465;

     
···

       66
        
             };

     

       67
        
             "ui.meta" = {

     

       68
        
               AUTHOR = "dish";

     

       69
       +
               DESCRIPTION = "dishNet Git Services";

     

       70
        
             };

     

       71
        
             metrics = {

     

       72
        
               ENABLED = true;

     
···

       85
        
               ISSUE_INDEXER_PATH = "indexers/issues.bleve";

     

       86
        
               # Enable repo indexing

     

       87
        
               REPO_INDEXER_ENABLED = true;

     

       88
       +
               REPO_INDEXER_REPO_TYPES = "sources,forks";

     

       89
        
               REPO_INDEXER_TYPE = "bleve";

     

       90
        
               REPO_INDEXER_PATH = "indexers/repos.bleve";

     

       91
        
             };

+4 -4

hosts/marvin/services/grafana.nix

···

       40
        
             };

     

       41
        
             smtp = {

     

       42
        
               enabled = true;

     

       43
       -
               user = "grafana@thehedgehog.me";

     

       44
       -
               from_address = "grafana@thehedgehog.me";

     

       45
       -
               host = "smtp.migadu.com:465";

     

       46
        
               password = "$__file{${config.age.secrets.grafana-smtp-password.path}}";

     

       47
        
             };

     

       48
        
           };

     
···

       62
        
         services.anubis.instances.grafana = {

     

       63
        
           settings = {

     

       64
        
             BIND = ":${toString d.anubis}";

     

       65
       -
             POLICY_FNAME = "${self'.packages.anubis-files}/policies/grafana.yaml";

     

       66
        
             TARGET = "http://localhost:${toString d.port}";

     

       67
        
           };

     

       68
        
         };

···

       40
        
             };

     

       41
        
             smtp = {

     

       42
        
               enabled = true;

     

       43
       +
               user = "grafana@pyrox.dev";

     

       44
       +
               from_address = "grafana@pyrox.dev";

     

       45
       +
               host = "mail.pyrox.dev:465";

     

       46
        
               password = "$__file{${config.age.secrets.grafana-smtp-password.path}}";

     

       47
        
             };

     

       48
        
           };

     
···

       62
        
         services.anubis.instances.grafana = {

     

       63
        
           settings = {

     

       64
        
             BIND = ":${toString d.anubis}";

     

       65
       +
             POLICY_FNAME = "${self'.packages.anubis-files}/policies/default.yaml";

     

       66
        
             TARGET = "http://localhost:${toString d.port}";

     

       67
        
           };

     

       68
        
         };

-97

hosts/marvin/services/iceshrimp.nix

···

       1
       -
       {

     

       2
       -
         config,

     

       3
       -
         inputs,

     

       4
       -
         pkgs,

     

       5
       -
         lib,

     

       6
       -
         self,

     

       7
       -
         ...

     

       8
       -
       }:

     

       9
       -
       let

     

       10
       -
       

     

       11
       -
         d = self.lib.data.services.iceshrimp;

     

       12
       -
       

     

       13
       -
         package = inputs.iceshrimp.packages.x86_64-linux.iceshrimp-pre.overrideAttrs rec {

     

       14
       -
           version = "2023.12.8-pyrox1";

     

       15
       -
           src = pkgs.fetchgit {

     

       16
       -
             url = "https://iceshrimp.dev/pyrox/iceshrimp";

     

       17
       -
             hash = "sha256-hxZ3rVVAiAMFAYhZ2o+WhlMuhjbt5EyHKOl1VyyL5RA=";

     

       18
       -
             rev = "v${version}";

     

       19
       -
             fetchLFS = true;

     

       20
       -
             deepClone = false;

     

       21
       -
           };

     

       22
       -
           patches = [ ];

     

       23
       -
         };

     

       24
       -
       in

     

       25
       -
       {

     

       26
       -
         services.iceshrimp = {

     

       27
       -
           inherit package;

     

       28
       -
           enable = false;

     

       29
       -
           secretConfig = config.age.secrets.iceshrimp-secret-config.path;

     

       30
       -
           dbPasswordFile = config.age.secrets.iceshrimp-db-password.path;

     

       31
       -
           createDb = true;

     

       32
       -
           configureNginx.enable = false;

     

       33
       -
           settings = {

     

       34
       -
             inherit (d) port;

     

       35
       -
             url = "https://${d.extUrl}";

     

       36
       -
             accountDomain = "pyrox.dev";

     

       37
       -
             redis.port = 6997;

     

       38
       -
             maxNoteLength = 16384;

     

       39
       -
             maxCaptionLength = 8192;

     

       40
       -
             clusterLimit = 4;

     

       41
       -
             deliverJobConcurrency = 192;

     

       42
       -
             inboxJobConcurrency = 32;

     

       43
       -
             deliverJobPerSec = 256;

     

       44
       -
             inboxJobPerSec = 32;

     

       45
       -
             outgoingAddressFamily = "dual";

     

       46
       -
             # See the withdrawal patches for obliterate info

     

       47
       -
             enableObliterate = true;

     

       48
       -
             obliterateJobPerSec = 16;

     

       49
       -
             obliterateJobMaxAttempts = 3;

     

       50
       -
             mediaCleanup = {

     

       51
       -
               cron = true;

     

       52
       -
               maxAgeDays = 30;

     

       53
       -
               cleanAvatars = true;

     

       54
       -
               cleanHeaders = true;

     

       55
       -
             };

     

       56
       -
             htmlCache = {

     

       57
       -
               ttl = "6h";

     

       58
       -
               prewarm = true;

     

       59
       -
               dbFallback = true;

     

       60
       -
             };

     

       61
       -
             wordMuteCache.ttl = "24h";

     

       62
       -
             isManagedHosting = true;

     

       63
       -
             email = {

     

       64
       -
               managed = true;

     

       65
       -
               address = "social@pyrox.dev";

     

       66
       -
               host = "mail.pyrox.dev";

     

       67
       -
               port = 465;

     

       68
       -
               user = "social@pyrox.dev";

     

       69
       -
               useImplicitSslTls = true;

     

       70
       -
             };

     

       71
       -
             objectStorage = {

     

       72
       -
               managed = true;

     

       73
       -
               baseUrl = "https://pool.jortage.com/socialpyroxdev";

     

       74
       -
               bucket = "socialpyroxdev";

     

       75
       -
               prefix = "mkmedia";

     

       76
       -
               endpoint = "pool-api.jortage.com";

     

       77
       -
               region = "jort";

     

       78
       -
               useSsl = true;

     

       79
       -
               connnectOverProxy = false;

     

       80
       -
               setPublicReadOnUpload = false;

     

       81
       -
               s3ForcePathStyle = true;

     

       82
       -
             };

     

       83
       -
           };

     

       84
       -
         };

     

       85
       -
         age.secrets = lib.mkIf config.services.iceshrimp.enable {

     

       86
       -
           iceshrimp-secret-config = {

     

       87
       -
             inherit (config.services.iceshrimp) group;

     

       88
       -
             file = ./secrets/iceshrimp-secret-config.age;

     

       89
       -
             owner = config.services.iceshrimp.user;

     

       90
       -
           };

     

       91
       -
           iceshrimp-db-password = {

     

       92
       -
             file = ./secrets/iceshrimp-db-password.age;

     

       93
       -
             owner = "postgres";

     

       94
       -
             group = "postgres";

     

       95
       -
           };

     

       96
       -
         };

     

       97
       -
       }

+223

hosts/marvin/services/immich-config.json

···

       1
       +
       {

     

       2
       +
         "backup": {

     

       3
       +
           "database": {

     

       4
       +
             "cronExpression": "0 02 * * *",

     

       5
       +
             "enabled": true,

     

       6
       +
             "keepLastAmount": 14

     

       7
       +
           }

     

       8
       +
         },

     

       9
       +
         "ffmpeg": {

     

       10
       +
           "accel": "vaapi",

     

       11
       +
           "accelDecode": true,

     

       12
       +
           "acceptedAudioCodecs": ["aac", "mp3", "libopus"],

     

       13
       +
           "acceptedContainers": ["mov", "ogg", "webm"],

     

       14
       +
           "acceptedVideoCodecs": ["h264"],

     

       15
       +
           "bframes": -1,

     

       16
       +
           "cqMode": "auto",

     

       17
       +
           "crf": 23,

     

       18
       +
           "gopSize": 0,

     

       19
       +
           "maxBitrate": "0",

     

       20
       +
           "preferredHwDevice": "auto",

     

       21
       +
           "preset": "veryfast",

     

       22
       +
           "refs": 0,

     

       23
       +
           "targetAudioCodec": "aac",

     

       24
       +
           "targetResolution": "720",

     

       25
       +
           "targetVideoCodec": "h264",

     

       26
       +
           "temporalAQ": false,

     

       27
       +
           "threads": 0,

     

       28
       +
           "tonemap": "hable",

     

       29
       +
           "transcode": "required",

     

       30
       +
           "twoPass": false

     

       31
       +
         },

     

       32
       +
         "image": {

     

       33
       +
           "colorspace": "p3",

     

       34
       +
           "extractEmbedded": false,

     

       35
       +
           "fullsize": {

     

       36
       +
             "enabled": false,

     

       37
       +
             "format": "jpeg",

     

       38
       +
             "quality": 80

     

       39
       +
           },

     

       40
       +
           "preview": {

     

       41
       +
             "format": "jpeg",

     

       42
       +
             "quality": 80,

     

       43
       +
             "size": 1440

     

       44
       +
           },

     

       45
       +
           "thumbnail": {

     

       46
       +
             "format": "webp",

     

       47
       +
             "quality": 80,

     

       48
       +
             "size": 250

     

       49
       +
           }

     

       50
       +
         },

     

       51
       +
         "job": {

     

       52
       +
           "backgroundTask": {

     

       53
       +
             "concurrency": 5

     

       54
       +
           },

     

       55
       +
           "faceDetection": {

     

       56
       +
             "concurrency": 2

     

       57
       +
           },

     

       58
       +
           "library": {

     

       59
       +
             "concurrency": 5

     

       60
       +
           },

     

       61
       +
           "metadataExtraction": {

     

       62
       +
             "concurrency": 5

     

       63
       +
           },

     

       64
       +
           "migration": {

     

       65
       +
             "concurrency": 5

     

       66
       +
           },

     

       67
       +
           "notifications": {

     

       68
       +
             "concurrency": 5

     

       69
       +
           },

     

       70
       +
           "ocr": {

     

       71
       +
             "concurrency": 1

     

       72
       +
           },

     

       73
       +
           "search": {

     

       74
       +
             "concurrency": 5

     

       75
       +
           },

     

       76
       +
           "sidecar": {

     

       77
       +
             "concurrency": 5

     

       78
       +
           },

     

       79
       +
           "smartSearch": {

     

       80
       +
             "concurrency": 2

     

       81
       +
           },

     

       82
       +
           "thumbnailGeneration": {

     

       83
       +
             "concurrency": 3

     

       84
       +
           },

     

       85
       +
           "videoConversion": {

     

       86
       +
             "concurrency": 1

     

       87
       +
           },

     

       88
       +
           "workflow": {

     

       89
       +
             "concurrency": 5

     

       90
       +
           }

     

       91
       +
         },

     

       92
       +
         "library": {

     

       93
       +
           "scan": {

     

       94
       +
             "cronExpression": "0 0 * * *",

     

       95
       +
             "enabled": true

     

       96
       +
           },

     

       97
       +
           "watch": {

     

       98
       +
             "enabled": false

     

       99
       +
           }

     

       100
       +
         },

     

       101
       +
         "logging": {

     

       102
       +
           "enabled": true,

     

       103
       +
           "level": "log"

     

       104
       +
         },

     

       105
       +
         "machineLearning": {

     

       106
       +
           "availabilityChecks": {

     

       107
       +
             "enabled": true,

     

       108
       +
             "interval": 30000,

     

       109
       +
             "timeout": 2000

     

       110
       +
           },

     

       111
       +
           "clip": {

     

       112
       +
             "enabled": true,

     

       113
       +
             "modelName": "ViT-B-16-SigLIP2__webli"

     

       114
       +
           },

     

       115
       +
           "duplicateDetection": {

     

       116
       +
             "enabled": true,

     

       117
       +
             "maxDistance": 0.01

     

       118
       +
           },

     

       119
       +
           "enabled": true,

     

       120
       +
           "facialRecognition": {

     

       121
       +
             "enabled": true,

     

       122
       +
             "maxDistance": 0.5,

     

       123
       +
             "minFaces": 7,

     

       124
       +
             "minScore": 0.7,

     

       125
       +
             "modelName": "buffalo_l"

     

       126
       +
           },

     

       127
       +
           "ocr": {

     

       128
       +
             "enabled": true,

     

       129
       +
             "maxResolution": 736,

     

       130
       +
             "minDetectionScore": 0.5,

     

       131
       +
             "minRecognitionScore": 0.8,

     

       132
       +
             "modelName": "EN__PP-OCRv5_mobile"

     

       133
       +
           },

     

       134
       +
           "urls": ["http://localhost:3003"]

     

       135
       +
         },

     

       136
       +
         "map": {

     

       137
       +
           "darkStyle": "https://tiles.immich.cloud/v1/style/dark.json",

     

       138
       +
           "enabled": true,

     

       139
       +
           "lightStyle": "https://tiles.immich.cloud/v1/style/light.json"

     

       140
       +
         },

     

       141
       +
         "metadata": {

     

       142
       +
           "faces": {

     

       143
       +
             "import": false

     

       144
       +
           }

     

       145
       +
         },

     

       146
       +
         "newVersionCheck": {

     

       147
       +
           "enabled": false

     

       148
       +
         },

     

       149
       +
         "nightlyTasks": {

     

       150
       +
           "clusterNewFaces": true,

     

       151
       +
           "databaseCleanup": true,

     

       152
       +
           "generateMemories": true,

     

       153
       +
           "missingThumbnails": true,

     

       154
       +
           "startTime": "00:00",

     

       155
       +
           "syncQuotaUsage": true

     

       156
       +
         },

     

       157
       +
         "notifications": {

     

       158
       +
           "smtp": {

     

       159
       +
             "enabled": true,

     

       160
       +
             "from": "dishNet Photos <immich@pyrox.dev>",

     

       161
       +
             "replyTo": "",

     

       162
       +
             "transport": {

     

       163
       +
               "host": "mail.pyrox.dev",

     

       164
       +
               "ignoreCert": false,

     

       165
       +
               "port": 25,

     

       166
       +
               "secure": true,

     

       167
       +
               "username": "immich@pyrox.dev"

     

       168
       +
             }

     

       169
       +
           }

     

       170
       +
         },

     

       171
       +
         "oauth": {

     

       172
       +
           "autoLaunch": false,

     

       173
       +
           "autoRegister": true,

     

       174
       +
           "buttonText": "Login with Pocket-ID",

     

       175
       +
           "clientId": "f1312240-d9fc-4336-aca6-b98316867848",

     

       176
       +
           "defaultStorageQuota": null,

     

       177
       +
           "enabled": true,

     

       178
       +
           "issuerUrl": "https://auth.pyrox.dev",

     

       179
       +
           "mobileOverrideEnabled": false,

     

       180
       +
           "mobileRedirectUri": "",

     

       181
       +
           "profileSigningAlgorithm": "none",

     

       182
       +
           "roleClaim": "immich_role",

     

       183
       +
           "scope": "openid email profile immich_role",

     

       184
       +
           "signingAlgorithm": "RS256",

     

       185
       +
           "storageLabelClaim": "preferred_username",

     

       186
       +
           "storageQuotaClaim": "immich_quota",

     

       187
       +
           "timeout": 30000,

     

       188
       +
           "tokenEndpointAuthMethod": "client_secret_post"

     

       189
       +
         },

     

       190
       +
         "passwordLogin": {

     

       191
       +
           "enabled": true

     

       192
       +
         },

     

       193
       +
         "reverseGeocoding": {

     

       194
       +
           "enabled": true

     

       195
       +
         },

     

       196
       +
         "server": {

     

       197
       +
           "externalDomain": "https://img.pyrox.dev",

     

       198
       +
           "loginPageMessage": "",

     

       199
       +
           "publicUsers": true

     

       200
       +
         },

     

       201
       +
         "storageTemplate": {

     

       202
       +
           "enabled": false,

     

       203
       +
           "hashVerificationEnabled": true,

     

       204
       +
           "template": "{{y}}/{{y}}-{{MM}}-{{dd}}/{{filename}}"

     

       205
       +
         },

     

       206
       +
         "templates": {

     

       207
       +
           "email": {

     

       208
       +
             "albumInviteTemplate": "",

     

       209
       +
             "albumUpdateTemplate": "",

     

       210
       +
             "welcomeTemplate": ""

     

       211
       +
           }

     

       212
       +
         },

     

       213
       +
         "theme": {

     

       214
       +
           "customCss": ""

     

       215
       +
         },

     

       216
       +
         "trash": {

     

       217
       +
           "days": 30,

     

       218
       +
           "enabled": true

     

       219
       +
         },

     

       220
       +
         "user": {

     

       221
       +
           "deleteDelay": 7

     

       222
       +
         }

     

       223
       +
       }

+51

hosts/marvin/services/immich.nix

···

       1
       +
       {

     

       2
       +
         self,

     

       3
       +
         config,

     

       4
       +
         lib,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
       +
       let

     

       8
       +
         d = self.lib.data.services.immich;

     

       9
       +
       in

     

       10
       +
       {

     

       11
       +
         services = {

     

       12
       +
           immich = {

     

       13
       +
             inherit (d) port;

     

       14
       +
             enable = true;

     

       15
       +
             host = "0.0.0.0";

     

       16
       +
             redis.enable = true;

     

       17
       +
             mediaLocation = "/var/media/photos/";

     

       18
       +
             accelerationDevices = [ "/dev/dri/renderD128" ];

     

       19
       +
             settings = lib.recursiveUpdate (builtins.fromJSON (builtins.readFile ./immich-config.json)) {

     

       20
       +
               oauth.clientSecret._secret = config.age.secrets.immich-oauth-secret.path;

     

       21
       +
               notifications.smtp.transport.password._secret = config.age.secrets.immich-mail-pw.path;

     

       22
       +
               server.externalDomain = "https://${d.extUrl}";

     

       23
       +
             };

     

       24
       +
           };

     

       25
       +
           immich-public-proxy = {

     

       26
       +
             enable = true;

     

       27
       +
             port = d.pubProxy;

     

       28
       +
             immichUrl = "http://localhost:${toString d.port}";

     

       29
       +
             settings.ipp = {

     

       30
       +
               downloadedFilename = 1;

     

       31
       +
             };

     

       32
       +
           };

     

       33
       +
         };

     

       34
       +
         systemd.services.immich-public-proxy.environment.PUBLIC_BASE_URL = "https://${d.extUrl}";

     

       35
       +
         users.users.immich.extraGroups = [

     

       36
       +
           "video"

     

       37
       +
           "render"

     

       38
       +
         ];

     

       39
       +
         age.secrets = {

     

       40
       +
           immich-oauth-secret = {

     

       41
       +
             file = ./secrets/immich/oauth-secret.age;

     

       42
       +
             owner = "immich";

     

       43
       +
             group = "immich";

     

       44
       +
           };

     

       45
       +
           immich-mail-pw = {

     

       46
       +
             file = ./secrets/immich/mail-pw.age;

     

       47
       +
             owner = "immich";

     

       48
       +
             group = "immich";

     

       49
       +
           };

     

       50
       +
         };

     

       51
       +
       }

-2

hosts/marvin/services/miniflux.nix

···

       1
        
       {

     

       2
        
         config,

     

       3
       -
         self',

     

       4
        
         self,

     

       5
        
         ...

     

       6
        
       }:

     
···

       33
        
         services.anubis.instances.miniflux = {

     

       34
        
           settings = {

     

       35
        
             BIND = ":${toString d.anubis}";

     

       36
       -
             POLICY_FNAME = "${self'.packages.anubis-files}/policies/miniflux.yaml";

     

       37
        
             TARGET = "http://localhost:${toString d.port}";

     

       38
        
           };

     

       39
        
         };

···

       1
        
       {

     

       2
        
         config,

     

       0
        
       
     

       3
        
         self,

     

       4
        
         ...

     

       5
        
       }:

     
···

       32
        
         services.anubis.instances.miniflux = {

     

       33
        
           settings = {

     

       34
        
             BIND = ":${toString d.anubis}";

     

       0
        
       
     

       35
        
             TARGET = "http://localhost:${toString d.port}";

     

       36
        
           };

     

       37
        
         };

-11

hosts/marvin/services/minio.nix

···

       1
       -
       { config, ... }:

     

       2
       -
       {

     

       3
       -
         services.minio = {

     

       4
       -
           enable = true;

     

       5
       -
           region = "us-east-1";

     

       6
       -
           browser = true;

     

       7
       -
           listenAddress = ":6990";

     

       8
       -
           consoleAddress = ":6991";

     

       9
       -
           rootCredentialsFile = config.age.secrets.minio-root.path;

     

       10
       -
         };

     

       11
       -
       }

-130

hosts/marvin/services/pingvin-share.nix

···

       1
       -
       {

     

       2
       -
         config,

     

       3
       -
         pkgs,

     

       4
       -
         self',

     

       5
       -
         self,

     

       6
       -
         ...

     

       7
       -
       }:

     

       8
       -
       let

     

       9
       -
         d = self.lib.data.services.pingvin-share;

     

       10
       -
         cfg = config.services.pingvin-share;

     

       11
       -
         configFormat = pkgs.formats.yaml { };

     

       12
       -
         configFile = configFormat.generate "config.yaml" {

     

       13
       -
           general = {

     

       14
       -
             appName = "dishNet Share";

     

       15
       -
             appUrl = "https://share.pyrox.dev";

     

       16
       -
             secureCookies = "true";

     

       17
       -
             showHomePage = "false";

     

       18
       -
           };

     

       19
       -
           share = {

     

       20
       -
             allowRegistration = "false";

     

       21
       -
             allowUnauthenticatedShares = "false";

     

       22
       -
             maxSize = "10000000000";

     

       23
       -
           };

     

       24
       -
           email.enableShareEmailRecipients = "true";

     

       25
       -
           smtp = {

     

       26
       -
             enabled = "true";

     

       27
       -
             host = "mail.pyrox.dev";

     

       28
       -
             port = "465";

     

       29
       -
             email = "share@pyrox.dev";

     

       30
       -
             username = "share@pyrox.dev";

     

       31
       -
             password = "SMTP_PASSWORD";

     

       32
       -
           };

     

       33
       -
           ldap.enabled = "false";

     

       34
       -
           legal.enabled = "false";

     

       35
       -
           s3.enabled = "false";

     

       36
       -
           oauth = {

     

       37
       -
             ignoreTotp = "true";

     

       38
       -
             oidc-enabled = "true";

     

       39
       -
             oidc-clientSecret = "CLIENT_SECRET";

     

       40
       -
             oidc-clientId = "d83006a6-9b08-47eb-af56-418065db09b5";

     

       41
       -
             oidc-discoveryUri = "https://auth.pyrox.dev/.well-known/openid-configuration";

     

       42
       -
             oidc-signOut = "false";

     

       43
       -
             oidc-scope = "openid email profile groups";

     

       44
       -
             oidc-rolePath = "groups";

     

       45
       -
             oidc-roleAdminAccess = "admins";

     

       46
       -
           };

     

       47
       -
           initUser.enabled = false;

     

       48
       -
         };

     

       49
       -
       in

     

       50
       -
       {

     

       51
       -
         virtualisation.oci-containers.containers = {

     

       52
       -
           pingvin-share-server = {

     

       53
       -
             image = "ghcr.io/stonith404/pingvin-share:latest";

     

       54
       -
             ports = [

     

       55
       -
               "${toString d.port}:3000"

     

       56
       -
               "${toString d.be-port}:8080"

     

       57
       -
             ];

     

       58
       -
             volumes = [

     

       59
       -
               "/var/lib/pingvin-share/data:/opt/app/backend/data"

     

       60
       -
               "/var/lib/pingvin-share/data/images:/opt/app/frontend/public/img"

     

       61
       -
               "/var/lib/pingvin-share/config.yaml:/opt/app/config.yaml"

     

       62
       -
             ];

     

       63
       -
             environment = {

     

       64
       -
               API_URL = "https://share.pyrox.dev";

     

       65
       -
               PUID = "962";

     

       66
       -
               PGID = "959";

     

       67
       -
             };

     

       68
       -
           };

     

       69
       -
         };

     

       70
       -
         users.users.pingvin = {

     

       71
       -
           uid = 962;

     

       72
       -
           inherit (cfg) group;

     

       73
       -
           isSystemUser = true;

     

       74
       -
         };

     

       75
       -
         users.groups.pingvin = {

     

       76
       -
           gid = 959;

     

       77
       -
         };

     

       78
       -
       

     

       79
       -
         services = {

     

       80
       -
           pingvin-share = {

     

       81
       -
             enable = false;

     

       82
       -
             backend.port = d.be-port;

     

       83
       -
             frontend.port = d.port;

     

       84
       -
             hostname = "share.pyrox.dev";

     

       85
       -
             https = true;

     

       86
       -
           };

     

       87
       -
           anubis.instances = {

     

       88
       -
             pingvin-share-be = {

     

       89
       -
               settings = {

     

       90
       -
                 BIND = ":${toString d.be-anubis}";

     

       91
       -
                 POLICY_FNAME = "${self'.packages.anubis-files}/policies/pingvin-share.yaml";

     

       92
       -
                 TARGET = "http://localhost:${toString d.be-port}";

     

       93
       -
               };

     

       94
       -
             };

     

       95
       -
             pingvin-share-fe = {

     

       96
       -
               settings = {

     

       97
       -
                 BIND = ":${toString d.anubis}";

     

       98
       -
                 POLICY_FNAME = "${self'.packages.anubis-files}/policies/pingvin-share.yaml";

     

       99
       -
                 TARGET = "http://localhost:${toString d.port}";

     

       100
       -
               };

     

       101
       -
             };

     

       102
       -
           };

     

       103
       -
         };

     

       104
       -
         systemd.services.init-pingvin-config = {

     

       105
       -
           enable = true;

     

       106
       -
           description = "Pingvin Share configuration setup";

     

       107
       -
           wantedBy = [ "multi-user.target" ];

     

       108
       -
           before = [

     

       109
       -
             "docker-pingvin-share-server.service"

     

       110
       -
           ];

     

       111
       -
           path = [ pkgs.gnused ];

     

       112
       -
           script = ''

     

       113
       -
             rm ${cfg.dataDir}/config.yaml

     

       114
       -
             cp ${configFile} ${cfg.dataDir}/config.yaml

     

       115
       -
             sed -i "s/SMTP_PASSWORD/\"$SMTP_PASSWORD\"/" ${cfg.dataDir}/config.yaml

     

       116
       -
             sed -i "s/CLIENT_SECRET/\"$CLIENT_SECRET\"/" ${cfg.dataDir}/config.yaml

     

       117
       -
           '';

     

       118
       -
           serviceConfig = {

     

       119
       -
             EnvironmentFile = config.age.secrets.pingvin-secrets.path;

     

       120
       -
             User = cfg.user;

     

       121
       -
             Group = cfg.group;

     

       122
       -
             ReadWritePaths = [ "${cfg.dataDir}" ];

     

       123
       -
           };

     

       124
       -
         };

     

       125
       -
         age.secrets.pingvin-secrets = {

     

       126
       -
           file = ./secrets/pingvin-secrets.age;

     

       127
       -
           owner = cfg.user;

     

       128
       -
           inherit (cfg) group;

     

       129
       -
         };

     

       130
       -
       }

+97 -34

hosts/marvin/services/planka.nix

···

       1
        
       {

     

       0
        
       
     

       2
        
         config,

     

       0
        
       
     

       3
        
         self',

     

       4
       -
         self,

     

       5
        
         ...

     

       6
        
       }:

     

       7
        
       let

     

       8
       -
         dataDir = "/var/lib/planka";

     

       9
        
         d = self.lib.data.services.planka;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       10
        
       in

     

       11
        
       {

     

       12
       -
         virtualisation.oci-containers.containers = {

     

       13
       -
           planka-server = {

     

       14
       -
             image = "ghcr.io/plankanban/planka:2.0.0-rc.4";

     

       15
       -
             ports = [ "${toString d.port}:1337" ];

     

       16
       -
             environment = {

     

       17
       -
               BASE_URL = "https://${d.extUrl}";

     

       18
       -
               DATABASE_URL = "postgresql://planka@planka-db/planka";

     

       19
       -
               # Default Admin

     

       20
       -
               DEFAULT_ADMIN_EMAIL = "pyrox@pyrox.dev";

     

       21
       -
               DEFAULT_ADMIN_USERNAME = "pyrox";

     

       22
       -
               TRUST_PROXY = "true";

     

       23
       -
               DEFAULT_LANGUAGE = "en-US";

     

       24
        
             };

     

       25
       -
             environmentFiles = [ config.age.secrets.planka-env.path ];

     

       26
       -
             volumes = [

     

       27
       -
               "${dataDir}/user-avatars:/app/public/user-avatars"

     

       28
       -
               "${dataDir}/project-background-images:/app/public/project-background-images"

     

       29
       -
               "${dataDir}/attachments:/app/private/attachments"

     

       30
       -
               "${dataDir}/favicons:/app/public/favicons"

     

       31
       -
               "${dataDir}/background-images:/app/public/background-images"

     

       32
       -
             ];

     

       33
       -
             extraOptions = [ "--network=planka" ];

     

       34
        
           };

     

       35
       -
           planka-db = {

     

       36
       -
             image = "postgres:16-alpine";

     

       37
       -
             volumes = [ "${dataDir}/db:/var/lib/postgresql/data" ];

     

       38
       -
             environment = {

     

       39
       -
               POSTGRES_USER = "planka";

     

       40
       -
               POSTGRES_DB = "planka";

     

       41
       -
               POSTGRES_HOST_AUTH_METHOD = "trust";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       42
        
             };

     

       43
       -
             extraOptions = [ "--network=planka" ];

     

       44
        
           };

     

       45
        
         };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       46
        
         age.secrets.planka-env = {

     

       47
        
           file = ./secrets/planka-env.age;

     

       48
       -
           owner = "thehedgehog";

     

       49
       -
           group = "misc";

     

       50
        
         };

     

       51
        
         services.anubis.instances.planka = {

     

       52
        
           settings = {

     

       53
        
             COOKIE_DOMAIN = ".cs2a.club";

     

       54
        
             BIND = ":${toString d.anubis}";

     

       55
       -
             POLICY_FNAME = "${self'.packages.anubis-files}/policies/planka.yaml";

     

       56
        
             TARGET = "http://localhost:${toString d.port}";

     

       57
        
           };

     

       58
        
         };

···

       1
        
       {

     

       2
       +
         lib,

     

       3
        
         config,

     

       4
       +
         self,

     

       5
        
         self',

     

       6
       +
         pkgs,

     

       7
        
         ...

     

       8
        
       }:

     

       9
        
       let

     

       0
        
       
     

       10
        
         d = self.lib.data.services.planka;

     

       11
       +
       

     

       12
       +
         commonServiceConfig = {

     

       13
       +
           EnvironmentFile = config.age.secrets.planka-env.path;

     

       14
       +
           StateDirectory = "planka";

     

       15
       +
           WorkingDirectory = "/var/lib/planka";

     

       16
       +
           User = "planka";

     

       17
       +
           Group = "planka";

     

       18
       +
       

     

       19
       +
           # Hardening

     

       20
       +
           LockPersonality = true;

     

       21
       +
           NoNewPrivileges = true;

     

       22
       +
           PrivateDevices = true;

     

       23
       +
           PrivateMounts = true;

     

       24
       +
           PrivateTmp = true;

     

       25
       +
           PrivateUsers = true;

     

       26
       +
           ProtectClock = true;

     

       27
       +
           ProtectControlGroups = true;

     

       28
       +
           ProtectHome = true;

     

       29
       +
           ProtectHostname = true;

     

       30
       +
           ProtectKernelLogs = true;

     

       31
       +
           ProtectKernelModules = true;

     

       32
       +
           ProtectKernelTunables = true;

     

       33
       +
           ProtectProc = "invisible";

     

       34
       +
           RemoveIPC = true;

     

       35
       +
           RestrictRealtime = true;

     

       36
       +
           RestrictSUIDSGID = true;

     

       37
       +
           UMask = "0660";

     

       38
       +
           RestrictAddressFamilies = [

     

       39
       +
             "AF_UNIX"

     

       40
       +
             "AF_INET"

     

       41
       +
             "AF_INET6"

     

       42
       +
           ];

     

       43
       +
         };

     

       44
        
       in

     

       45
        
       {

     

       46
       +
         systemd = {

     

       47
       +
           tmpfiles.settings = {

     

       48
       +
             "10-planka"."/var/lib/planka".d = {

     

       49
       +
               group = "planka";

     

       50
       +
               user = "planka";

     

       51
       +
               mode = "0755";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       52
        
             };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       53
        
           };

     

       54
       +
           services = {

     

       55
       +
             planka-init-db = {

     

       56
       +
               wantedBy = [ "multi-user.target" ];

     

       57
       +
               after = [ "postgres.target" ];

     

       58
       +
               description = "Planka Kanban Database Init Script";

     

       59
       +
               path = [

     

       60
       +
                 pkgs.nodejs

     

       61
       +
               ];

     

       62
       +
               script = ''

     

       63
       +
                 if [ ! -f /var/lib/planka/db-init-ran ]; then

     

       64
       +
                   node run ${self'.packages.planka}/lib/node_modules/planka/db/init.js && \

     

       65
       +
                   touch /var/lib/planka/db-init-ran

     

       66
       +
                 fi

     

       67
       +
               '';

     

       68
       +
               serviceConfig = commonServiceConfig // {

     

       69
       +
                 Type = "oneshot";

     

       70
       +
                 SyslogIdentifier = "planka-init-db";

     

       71
       +
               };

     

       72
       +
             };

     

       73
       +
             planka-server = {

     

       74
       +
               after = [ "planka-init-db.service" ];

     

       75
       +
               wantedBy = [ "multi-user.target" ];

     

       76
       +
               description = "Planka Kanban Server";

     

       77
       +
               documentation = [ "https://docs.planka.cloud" ];

     

       78
       +
               environment = {

     

       79
       +
                 DATABASE_URL = "postgresql://%2Frun%2Fpostgresql/planka";

     

       80
       +
                 DEFAULT_ADMIN_EMAIL = "pyrox@pyrox.dev";

     

       81
       +
                 DEFAULT_ADMIN_USERNAME = "pyrox";

     

       82
       +
                 TRUST_PROXY = "true";

     

       83
       +
                 DEFAULT_LANGUAGE = "en-US";

     

       84
       +
                 BASE_URL = "https://${d.extUrl}";

     

       85
       +
                 NODE_ENV = "production";

     

       86
       +
               };

     

       87
       +
               serviceConfig = commonServiceConfig // {

     

       88
       +
                 Type = "simple";

     

       89
       +
                 ExecStart = "${lib.getExe self'.packages.planka} --port ${toString d.port}";

     

       90
       +
                 SyslogIdentifier = "planka";

     

       91
       +
               };

     

       92
        
             };

     

       0
        
       
     

       93
        
           };

     

       94
        
         };

     

       95
       +
         users.users.planka = {

     

       96
       +
           isSystemUser = true;

     

       97
       +
           group = "planka";

     

       98
       +
         };

     

       99
       +
         users.groups.planka = { };

     

       100
       +
         services.postgresql = {

     

       101
       +
           ensureUsers = [

     

       102
       +
             {

     

       103
       +
               name = "planka";

     

       104
       +
               ensureDBOwnership = true;

     

       105
       +
               ensureClauses.login = true;

     

       106
       +
             }

     

       107
       +
           ];

     

       108
       +
           ensureDatabases = [ "planka" ];

     

       109
       +
         };

     

       110
        
         age.secrets.planka-env = {

     

       111
        
           file = ./secrets/planka-env.age;

     

       112
       +
           owner = "planka";

     

       113
       +
           group = "planka";

     

       114
        
         };

     

       115
        
         services.anubis.instances.planka = {

     

       116
        
           settings = {

     

       117
        
             COOKIE_DOMAIN = ".cs2a.club";

     

       118
        
             BIND = ":${toString d.anubis}";

     

       0
        
       
     

       119
        
             TARGET = "http://localhost:${toString d.port}";

     

       120
        
           };

     

       121
        
         };

-2

hosts/marvin/services/pocket-id.nix

···

       1
        
       {

     

       2
        
         config,

     

       3
       -
         self',

     

       4
        
         self,

     

       5
        
         ...

     

       6
        
       }:

     
···

       43
        
           pocket-id = {

     

       44
        
             settings = {

     

       45
        
               BIND = ":${toString d.anubis}";

     

       46
       -
               POLICY_FNAME = "${self'.packages.anubis-files}/policies/pocket-id.yaml";

     

       47
        
               TARGET = "http://localhost:${toString d.port}";

     

       48
        
             };

     

       49
        
           };

···

       1
        
       {

     

       2
        
         config,

     

       0
        
       
     

       3
        
         self,

     

       4
        
         ...

     

       5
        
       }:

     
···

       42
        
           pocket-id = {

     

       43
        
             settings = {

     

       44
        
               BIND = ":${toString d.anubis}";

     

       0
        
       
     

       45
        
               TARGET = "http://localhost:${toString d.port}";

     

       46
        
             };

     

       47
        
           };

+23 -23

hosts/marvin/services/postgres.nix

···

       1
       -
       { pkgs, config, ... }:

     

       2
       -
       let

     

       3
       -
         cfg = config.services.postgresql;

     

       4
       -
       in

     

       5
        
       {

     

       6
        
         services.postgresql = {

     

       7
        
           enable = true;

     
···

       28
        
             max_parallel_maintenance_workers = 4;

     

       29
        
           };

     

       30
        
         };

     

       31
       -
         systemd.timers.pg-autovacuum = {

     

       32
       -
           description = "Timer for Postgres Autovacuum";

     

       33
       -
           timerConfig = {

     

       34
       -
             OnCalendar = "*-*-* 01:00:00";

     

       35
       -
             Unit = "pg-autovacuum.service";

     

       36
       -
           };

     

       37
       -
         };

     

       38
       -
         systemd.services.pg-autovacuum = {

     

       39
       -
           description = "Vacuum all Postgres databases.";

     

       40
       -
           requisite = [ "postgresql.service" ];

     

       41
       -
           wantedBy = [ "multi-user.target" ];

     

       42
       -
           serviceConfig = {

     

       43
       -
             Type = "oneshot";

     

       44
       -
             User = "postgres";

     

       45
       -
             Group = "postgres";

     

       46
       -
             SyslogIdentifier = "pg-autovacuum";

     

       47
       -
             ExecStart = "${cfg.package}/bin/vacuumdb --all --echo --jobs=6 --parallel=5 --analyze --verbose";

     

       48
       -
           };

     

       49
       -
         };

     

       50
        
       }

···

       1
       +
       { pkgs, ... }:

     

       2
       +
       # let

     

       3
       +
       #   cfg = config.services.postgresql;

     

       4
       +
       # in

     

       5
        
       {

     

       6
        
         services.postgresql = {

     

       7
        
           enable = true;

     
···

       28
        
             max_parallel_maintenance_workers = 4;

     

       29
        
           };

     

       30
        
         };

     

       31
       +
         # systemd.timers.pg-autovacuum = {

     

       32
       +
         #   description = "Timer for Postgres Autovacuum";

     

       33
       +
         #   timerConfig = {

     

       34
       +
         #     OnCalendar = "*-*-* 01:00:00";

     

       35
       +
         #     Unit = "pg-autovacuum.service";

     

       36
       +
         #   };

     

       37
       +
         # };

     

       38
       +
         # systemd.services.pg-autovacuum = {

     

       39
       +
         #   description = "Vacuum all Postgres databases.";

     

       40
       +
         #   requisite = [ "postgresql.service" ];

     

       41
       +
         #   wantedBy = [ "multi-user.target" ];

     

       42
       +
         #   serviceConfig = {

     

       43
       +
         #     Type = "oneshot";

     

       44
       +
         #     User = "postgres";

     

       45
       +
         #     Group = "postgres";

     

       46
       +
         #     SyslogIdentifier = "pg-autovacuum";

     

       47
       +
         #     ExecStart = "${cfg.package}/bin/vacuumdb --all --echo --jobs=6 --parallel=5 --analyze --verbose";

     

       48
       +
         #   };

     

       49
       +
         # };

     

       50
        
       }

-5

hosts/marvin/services/prosody.nix

···

       1
       -
       {

     

       2
       -
         services.prosody = {

     

       3
       -
           enable = true;

     

       4
       -
         };

     

       5
       -
       }

-12

hosts/marvin/services/redlib.nix

···

       1
       -
       { pkgs, self, ... }:

     

       2
       -
       let

     

       3
       -
         d = self.lib.data.services.redlib;

     

       4
       -
       in

     

       5
       -
       {

     

       6
       -
         services.libreddit = {

     

       7
       -
           inherit (d) port;

     

       8
       -
           enable = true;

     

       9
       -
           package = pkgs.redlib;

     

       10
       -
           openFirewall = false;

     

       11
       -
         };

     

       12
       -
       }

-23

hosts/marvin/services/secrets/iceshrimp-db-password.age

···

       1
       -
       age-encryption.org/v1

     

       2
       -
       -> ssh-ed25519 iqBxIA g+DkjSGDd+i/sdqRCuU2I2Qzmq4Q+FI7wSyfkdM9q0Q

     

       3
       -
       cG52xAS/VPjCNgHdky0/jbMvF5tF+cB8BxFNCHYlf2s

     

       4
       -
       -> ssh-rsa fFaiTA

     

       5
       -
       r5mQer6QBi+HdSS16OLHfv/oh0hbug5drdX/BuQHMORogiDfHEM03K6pmg9064Ep

     

       6
       -
       CJgl6z3IS9hlLX7cSq2kVSvP9gk+l5AmI+pMZkJyT9ED43g6wtRI7yiy1ALO0rqB

     

       7
       -
       z/CPaoLkFNFlt7sDg5rijAB+t6DNAxULfFj8KR3b+NvGrrW6Vbaio+T5mg1A2PTd

     

       8
       -
       60eEfuqdn9dHVI82FQFmai1LwoyButrUNn3UiP8aIdvFUueixcqsAXSK1zjPJZ5B

     

       9
       -
       VeAkshwhB9+HKMH1cyRa6LUbzJYxAQBhkgTFqS/r64h3ZAYHTc0lY44VtVhbnEQI

     

       10
       -
       76PBEOcQXXjvPR6yvbcVZfpqCkqfo9hb7wogPfJiRMjKM/qlpR19KOf21T0hsV6q

     

       11
       -
       b7nYf01yBscx6GKXREkZoxgpo6iLLzVQqU5SzQgs7nxW089JdJ62WoZvJwTxv2G8

     

       12
       -
       AdzImnsw73q55MgOYtv/A3hGM8O1Jw4Q4UfMSS43xB+cuvtlEmSqi5mFh0gPbqQR

     

       13
       -
       LN8+OcDLz0SR8U6xHj9ufXfhHc4nwO8iZpzav5nZXMEb3Gmva3k8U+nnmuPKqsrL

     

       14
       -
       VxFmGNxqmWPfxO0FJC/cxLKME/Lj2MU9r6KT8RQ00BjHUfoDgbFzHVLqIEbIE+Vr

     

       15
       -
       /Glcmz/Ecrt3kTwfAhEDpj6g0XVNHt7HA+r4SDWjI00

     

       16
       -
       -> ssh-ed25519 wpmdHA LUF/UncaQTEMQepVAhEqFm345dICeW3d3QGhiflTSH8

     

       17
       -
       ImxpR4innOw1jMSF4gvmOGRDl0BzqAhOyz+GFstsJG4

     

       18
       -
       -> Cg-grease k7q9

     

       19
       -
       MLRf60C4nbEc9XHo26cg7UYySbZtOMP2kZtZmvLiS1XFeIqQaR0RgRcUOoTblYzo

     

       20
       -
       KQ

     

       21
       -
       --- PV6HHY8kDdpFcgNu83K/cwz4qQCW38jcHkTOkCunxrk

     

       22
       -
       �*ǜ�lq��^��fʀ���l�� R��C}Մ�ɧ���F�ĩ�&�~h�

     

       23
       -
       ̟�r��6ʞac,����lc�
>

hosts/marvin/services/secrets/iceshrimp-secret-config.age

This is a binary file and will not be displayed.

+19

hosts/marvin/services/secrets/immich/mail-pw.age

···

       1
       +
       age-encryption.org/v1

     

       2
       +
       -> ssh-ed25519 iqBxIA 3PVJMF6BgxuDxN9NAEYqcZaYEUhK9TB5XprRyW13Kx0

     

       3
       +
       AIQQG+4/9SVPcfq9ZtL/JsWDmLvW03UiAJaJ1nHSckQ

     

       4
       +
       -> ssh-rsa fFaiTA

     

       5
       +
       ZPBI1w2a48Md+Rt92ssVcfxN26zTLCEalT+jG8SJBv07ouOzd4ibPq65m6uOQU/+

     

       6
       +
       EEgHe23fGsPP4oISWDUgVFxesLA3wjsTWmbVrkrBzGQNeNnevIRMcJu7vWDtby/+

     

       7
       +
       dVxPQIoXH0jPlcDQCm2lwOGD+du+Nb4PnVseRPDaXRypKKmx+J057FQemYBk4OWx

     

       8
       +
       yUfbKV2gHHcuRTVUQG6XAQwWvhh4e25fyc+MzKZNPUK4c/SVibjAsUH+Edd+NaV5

     

       9
       +
       yxku5k4TFZkU69sl2zCdgWfYVTowTGYGyf4Kf+I/kl9m13zIk9vRpocgt4APaJnv

     

       10
       +
       p+KxJvbYRiprWl+IzZg6TwXY5mA1IbvlppR4aak1pwaIE76CgF5mGNDGkviGndtP

     

       11
       +
       +eCMIocp6lk2U0dJEYkBtmjNbxFh3dxOcirgdNDypYPlZTSGvSRGhpL4nUJRsR+l

     

       12
       +
       A7rJ5aHH2B4Vi93zgSV0PWiWSA7899bzgN1kQKKIgYln6Tl8UxQSNt5L3L4VajuW

     

       13
       +
       3UqCltyGWt/926BMS+GrDZSWCEtVsDs5XQqDKEx6D+iviHZJXniI+RhH/eM7FLjp

     

       14
       +
       iXgCRkBIALo2lOiScpr2rtfGDViq3Nh64cIslEPiewjVFTCxkxH+LuQ1stukrNki

     

       15
       +
       IF0+pZ65rgatMAdnZRFXfRxmywKD99z4WRHAxvYloXc

     

       16
       +
       -> ssh-ed25519 wpmdHA SQlzD3yqbnoF0JHqPFFDUugbm8jlBsdntLzF/WlJbjo

     

       17
       +
       FggpB1k5xbq62QNlwkocwjiWhEqNjHAxR/GwoPhXbC8

     

       18
       +
       --- 1g4f2OQbS5iXm/cqBamEWuapvZHorxfX7wHizfPcYsc

     

       19
       +
       �z�92�LN=9���$O���fP���E���~�.��}7�eڰq��y�N�I�L����"%�V�lz'�أ�

+19

hosts/marvin/services/secrets/immich/oauth-secret.age

···

       1
       +
       age-encryption.org/v1

     

       2
       +
       -> ssh-ed25519 iqBxIA 4osfKV5/wFT7mCdc4TjP7pJHdD8wzV7VKKiBSGRqImk

     

       3
       +
       wU6RSxJh8SBbXbiwCl4lXD/m1THoAg5n1Y7pyKFPiec

     

       4
       +
       -> ssh-rsa fFaiTA

     

       5
       +
       RTHaBLsBWbDEmY80LktVL/C6CeFinLm3/4t/hoWmbzLLoElBL86EGVdrE5ovjUYl

     

       6
       +
       j5+ZacmqahwjCtF/ZGBt8MFkWOK9u90YDfLp+kb2ILVy/E+CcQ3xPpH9bf83pPl/

     

       7
       +
       aZmttaRlhnhSDYVXB0lHx3u/cCrYhTf6TjEoVGZ/XrLW0BRmO6GSwcmTrachZzdJ

     

       8
       +
       je+pf2ug//mnAJR0y4MxjGlNPD/Vaj/UiaFQjPT+7ZvUUSkbv/QpPqyhhosFA11e

     

       9
       +
       1EGp21ppwUnJSNdYh2vulpQGurB5bPlv6Y8FpcFKivq/qKmA4ydyER3NcCca5Ly+

     

       10
       +
       01jQ1HRqWylYJj7K4hnxSjnNlOXCrJATuPJYoNdt2U1DnolUAqL6JIP/qNmYx8Fb

     

       11
       +
       ZrfFINBmPsNc9XJn14T4J+VB6e68ODBOvZdbzoBQOWAObnP5OH+zLYCB3II+aLPp

     

       12
       +
       Zo5WsNBBdZih4EbO0Y9PNWBjyCzxqs7zXPg1PjjDVHN/tIpSGnqoCqCPGuePhgRV

     

       13
       +
       h1gnP/lqOW2U1oL004hi3etsUsk3kXHjr35GXMVBeay+3uGXkZqhNYYSluQnJSrs

     

       14
       +
       rzahZZ8/q0FDdlUixWHb2uQjL1XMTqUcw8wPsUak8shkx8s7GPKNxtEKFcK46jk4

     

       15
       +
       ac9TCyee4HzPC/SWkLGFl0bt9s9lGTBSNQrVzogY/sg

     

       16
       +
       -> ssh-ed25519 wpmdHA C6npqn5aqimGJlo+UlvYOoqXSu/hW1JVNAmBPP1Vvjk

     

       17
       +
       gWzXqL92jI83iqSr3dydJo+UAz5OGBo6kw6QC4KRWgM

     

       18
       +
       --- ltHFDmeAbJsQtyY4CKFEz8OGAkPkue/8upHNOOQgn5I

     

       19
       +
       ��O�ӌ#&`���P�IZ�#�[��+�tdeG�ui�����?n"��(��b� ]s�	y줔���

-20

hosts/marvin/services/secrets/pingvin-secrets.age

···

       1
       -
       age-encryption.org/v1

     

       2
       -
       -> ssh-ed25519 iqBxIA HdZwcvp9cLpqrUp0M7sK7ipTslMxK0EYqFfS8xtYeDk

     

       3
       -
       Ud7ismLtRG4RlugV3P5wRNjRe8HcJW0rAz/adadWCNc

     

       4
       -
       -> ssh-rsa fFaiTA

     

       5
       -
       KwjETLhUBpq8Hfp41rg3++syweOB+yNIIdd0KeS2YjxjbDfgwzRVoM+wlB/C3b4X

     

       6
       -
       W0561y9+wsnB5A6k/peXLASfVodw30vI9LdW+nHejQr9v/UooXPztoJNrfgaKUow

     

       7
       -
       PsLbLUj+M8Y4i22GRKrY6rrCfJk8F4a+2b0PzDc1EqUcZOjMV7aE+fQ4U7+FD1jv

     

       8
       -
       xGmrKNRXNUL1j5GpPAi7E7YXuGj2SxjZOiisKqyep5KTEFyIJ04lrN/rtbi2vkEJ

     

       9
       -
       ejAFg2jIvxAWiEzEUbjOLFzeIdpb8pPqQJ3OUF4U0crT/r5dxmJKxB0J7ktS6eEY

     

       10
       -
       NZ4/CtY/kLXjo9sWc6G2UtWAm+myXKsxETxFtp/RQ6LXMjS+3xbzGvkAoY/fzVMt

     

       11
       -
       zLGdOV0X/paLb1jGl9CHkflq7qrpkdgqc6I5nmsOCRLHrsiVWLaCVCvu2T1fpjCh

     

       12
       -
       tP+Mwdjv5ONXduoGUOxjCT8IVv7ceTt93S/9cZakpDIFJ38I1XymrjuFLfbhLMVK

     

       13
       -
       VMfo9cLhWyz2/DAKA4gKnmagUhnYO2vdNBzzM9dg0/ysrLoX71ujEcxB0tx21pkE

     

       14
       -
       eB3LEfFH94Izzn9crNJ1YMUFCpFayedN2uQjv89LN2oHx+mUKemXCdl+AV2sLP7P

     

       15
       -
       pi4/UDjKOcIeK8cSvqJtsemjUn7QJdOamH4/IpgFh5o

     

       16
       -
       -> ssh-ed25519 wpmdHA X+4vtGSjMeIuSearcEfYA8Mv5kmghhItcE1n5BPWLSo

     

       17
       -
       uYkj1VkPXs8mJu99J4GFth6LyqhWymEH5fsN0+5TDsw

     

       18
       -
       --- Ql8rRuZH0kS1eDQ9EYB7mW+GvcHtjXcW/Wu1ZGhjpKI

     

       19
       -
       虌d0dj̭�ھ�f����� g�D�+�q��W��d������%5��1�?�U��)�tܫ��[

     

       20
       -
       S�DV�+��U�".� q�i�,g{}#y�@���3O/M~��CЎBV�š� }�=����*#�7�?Q��

+2 -3

hosts/marvin/services/secrets/secrets.nix

···

       27
        
         "golink-authkey.age".publicKeys = marvinDefault;

     

       28
        
         "grafana-admin-password.age".publicKeys = marvinDefault;

     

       29
        
         "grafana-smtp-password.age".publicKeys = marvinDefault;

     

       30
       -
         "iceshrimp-secret-config.age".publicKeys = marvinDefault;

     

       31
       -
         "iceshrimp-db-password.age".publicKeys = marvinDefault;

     

       32
        
         "jellyfin-exporter-config.age".publicKeys = marvinDefault;

     

       33
        
         "minio-root.age".publicKeys = marvinDefault;

     

       34
        
         "miniflux-admin.age".publicKeys = marvinDefault;

     

       35
        
         "../nextcloud/nextcloud-admin-pw.age".publicKeys = marvinDefault;

     

       36
        
         "nix-serve-priv.age".publicKeys = marvinDefault;

     

       37
        
         "pinchflat-secrets.age".publicKeys = marvinDefault;

     

       38
       -
         "pingvin-secrets.age".publicKeys = marvinDefault;

     

       39
        
         "planka-env.age".publicKeys = marvinDefault;

     

       40
        
         "pocket-id-secrets.age".publicKeys = marvinDefault;

     

       41
        
         "vaultwarden-vars.age".publicKeys = marvinDefault;

···

       27
        
         "golink-authkey.age".publicKeys = marvinDefault;

     

       28
        
         "grafana-admin-password.age".publicKeys = marvinDefault;

     

       29
        
         "grafana-smtp-password.age".publicKeys = marvinDefault;

     

       30
       +
         "immich/oauth-secret.age".publicKeys = marvinDefault;

     

       31
       +
         "immich/mail-pw.age".publicKeys = marvinDefault;

     

       32
        
         "jellyfin-exporter-config.age".publicKeys = marvinDefault;

     

       33
        
         "minio-root.age".publicKeys = marvinDefault;

     

       34
        
         "miniflux-admin.age".publicKeys = marvinDefault;

     

       35
        
         "../nextcloud/nextcloud-admin-pw.age".publicKeys = marvinDefault;

     

       36
        
         "nix-serve-priv.age".publicKeys = marvinDefault;

     

       37
        
         "pinchflat-secrets.age".publicKeys = marvinDefault;

     

       0
        
       
     

       38
        
         "planka-env.age".publicKeys = marvinDefault;

     

       39
        
         "pocket-id-secrets.age".publicKeys = marvinDefault;

     

       40
        
         "vaultwarden-vars.age".publicKeys = marvinDefault;

+2 -23

hosts/marvin/services/vaultwarden.nix

···

       23
        
             rocketAddress = "0.0.0.0";

     

       24
        
             rocketCliColors = false;

     

       25
        
             rocketPort = d.port;

     

       26
       -
             websocketEnabled = true;

     

       27
       -
             ipHeader = "X-Real-IP";

     

       28
        
             reloadTemplates = false;

     

       29
        
             logTimestampFormat = "%Y-%m-%d %H:%M:%S.%3f";

     

       30
        
             # # Ratelimiting

     
···

       36
        
       

     

       37
        
             # Logging

     

       38
        
             useSyslog = true;

     

       39
       -
             logLevel = "info";

     

       40
        
             extendedLogging = true;

     

       41
        
       

     

       42
        
             # Features

     
···

       46
        
       

     

       47
        
             # Invitations

     

       48
        
             invitationsAllowed = true;

     

       49
       -
             invitationOrgName = "PyroNet Vault";

     

       50
        
             invitationExpirationHours = 168;

     

       51
        
       

     

       52
        
             # Database

     
···

       55
        
             # Signups

     

       56
        
             signupsAllowed = false;

     

       57
        
             signupsVerify = true;

     

       58
       -
             signupsVerifyResendTime = 3600;

     

       59
       -
             signupsVerifyResendLimit = 5;

     

       60
        
             signupsDomainWhitelist = "pyrox.dev";

     

       61
        
       

     

       62
        
             # Passwords

     
···

       67
        
       

     

       68
        
             # Mail

     

       69
        
             smtpFrom = "vault@pyrox.dev";

     

       70
       -
             smtpFromName = "PyroNet Vault <vault@pyrox.dev>";

     

       71
        
             smtpUsername = "vault@pyrox.dev";

     

       72
        
             smtpSecurity = "force_tls";

     

       73
        
             smtpPort = 465;

     
···

       76
        
             smtpTimeout = 20;

     

       77
        
             smtpEmbedImages = true;

     

       78
        
             useSendmail = false;

     

       79
       -
             smtpDebug = false;

     

       80
       -
             smtpAcceptInvalidCerts = false;

     

       81
       -
             smtpAcceptInvalidHostnames = false;

     

       82
        
       

     

       83
        
             # Authentication

     

       84
       -
             authenticatorDisableTimeDrift = false;

     

       85
       -
             disable2faRemember = false;

     

       86
        
             incomplete2faTimeLimit = 5;

     

       87
        
             # # Email 2FA

     

       88
       -
             emailAttemptsLimit = 3;

     

       89
        
             emailExpirationTime = 180;

     

       90
        
             emailTokenSize = 7;

     

       91
        
             requireDeviceEmail = true;

     

       92
       -
       

     

       93
       -
             # Icons

     

       94
       -
             disableIconDownload = false;

     

       95
       -
             iconService = "internal";

     

       96
       -
             iconRedirectCode = 302;

     

       97
       -
             iconDownloadTimeout = 10;

     

       98
       -
             iconBlacklistNonGlobalIps = true;

     

       99
       -
             # # 30 Day TTL

     

       100
       -
             iconCacheTtl = 30 * 24 * 60 * 60;

     

       101
       -
             iconCacheNegttl = 30 * 24 * 60 * 60;

     

       102
        
       

     

       103
        
             # Misc Settings

     

       104
        
             trashAutoDeleteDays = 14;

···

       23
        
             rocketAddress = "0.0.0.0";

     

       24
        
             rocketCliColors = false;

     

       25
        
             rocketPort = d.port;

     

       0
        
       
     

       0
        
       
     

       26
        
             reloadTemplates = false;

     

       27
        
             logTimestampFormat = "%Y-%m-%d %H:%M:%S.%3f";

     

       28
        
             # # Ratelimiting

     
···

       34
        
       

     

       35
        
             # Logging

     

       36
        
             useSyslog = true;

     

       0
        
       
     

       37
        
             extendedLogging = true;

     

       38
        
       

     

       39
        
             # Features

     
···

       43
        
       

     

       44
        
             # Invitations

     

       45
        
             invitationsAllowed = true;

     

       46
       +
             invitationOrgName = "dishNet Vault";

     

       47
        
             invitationExpirationHours = 168;

     

       48
        
       

     

       49
        
             # Database

     
···

       52
        
             # Signups

     

       53
        
             signupsAllowed = false;

     

       54
        
             signupsVerify = true;

     

       0
        
       
     

       0
        
       
     

       55
        
             signupsDomainWhitelist = "pyrox.dev";

     

       56
        
       

     

       57
        
             # Passwords

     
···

       62
        
       

     

       63
        
             # Mail

     

       64
        
             smtpFrom = "vault@pyrox.dev";

     

       65
       +
             smtpFromName = "dishNet Vault <vault@pyrox.dev>";

     

       66
        
             smtpUsername = "vault@pyrox.dev";

     

       67
        
             smtpSecurity = "force_tls";

     

       68
        
             smtpPort = 465;

     
···

       71
        
             smtpTimeout = 20;

     

       72
        
             smtpEmbedImages = true;

     

       73
        
             useSendmail = false;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       74
        
       

     

       75
        
             # Authentication

     

       0
        
       
     

       0
        
       
     

       76
        
             incomplete2faTimeLimit = 5;

     

       77
        
             # # Email 2FA

     

       0
        
       
     

       78
        
             emailExpirationTime = 180;

     

       79
        
             emailTokenSize = 7;

     

       80
        
             requireDeviceEmail = true;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       81
        
       

     

       82
        
             # Misc Settings

     

       83
        
             trashAutoDeleteDays = 14;

-23

hosts/marvin/services/webmentiond.nix

···

       1
       -
       { config, self, ... }:

     

       2
       -
       let

     

       3
       -
         d = self.lib.data.services.webmentiond;

     

       4
       -
         p = toString d.port;

     

       5
       -
       in

     

       6
       -
       {

     

       7
       -
         virtualisation.oci-containers.containers.webmentiond = {

     

       8
       -
           image = "zerok/webmentiond:latest";

     

       9
       -
           volumes = [ "/var/lib/webmentiond:/data" ];

     

       10
       -
           environmentFiles = [ config.age.secrets.webmentiond-env.path ];

     

       11
       -
           ports = [ "${p}:${p}" ];

     

       12
       -
           cmd = [

     

       13
       -
             "--addr 0.0.0.0:${p}"

     

       14
       -
             "--public-url https://${d.extUrl}"

     

       15
       -
             "--auth-admin-emails pyrox@pyrox.dev"

     

       16
       -
           ];

     

       17
       -
         };

     

       18
       -
         config.age.secrets = {

     

       19
       -
           webmentiond-env.path = ./secrets/webmentiond-env.age;

     

       20
       -
           owner = "thehedgehog";

     

       21
       -
           group = "misc";

     

       22
       -
         };

     

       23
       -
       }

+4 -4

hosts/prefect/bootloader.nix

···

       32
        
           supportedFilesystems = fileSystems;

     

       33
        
           kernelPackages = pkgs.linuxPackages_6_1;

     

       34
        
           kernel.sysctl = {

     

       35
       -
             "net.ipv4.ip_forward" = 1;

     

       36
       -
             "net.ipv6.conf.all.forwarding" = 1;

     

       37
       -
             "net.ipv4.conf.default.rp_filter" = 0;

     

       38
       -
             "net.ipv4.conf.all.rp_filter" = 0;

     

       39
        
           };

     

       40
        
         };

     

       41
        
         services.udev.extraRules = ''

···

       32
        
           supportedFilesystems = fileSystems;

     

       33
        
           kernelPackages = pkgs.linuxPackages_6_1;

     

       34
        
           kernel.sysctl = {

     

       35
       +
             "net.ipv4.ip_forward" = true;

     

       36
       +
             "net.ipv6.conf.all.forwarding" = true;

     

       37
       +
             "net.ipv4.conf.default.rp_filter" = false;

     

       38
       +
             "net.ipv4.conf.all.rp_filter" = false;

     

       39
        
           };

     

       40
        
         };

     

       41
        
         services.udev.extraRules = ''

-109

hosts/prefect/dn42/bgp.nix

···

       1
       -
       _: {

     

       2
       -
         sessions = [

     

       3
       -
           # Chrismoos

     

       4
       -
           {

     

       5
       -
             multi = true;

     

       6
       -
             multihop = false;

     

       7
       -
             gracefulRestart = true;

     

       8
       -
             name = "chrismoos";

     

       9
       -
             neigh = "fe80::1588%wg42_chris";

     

       10
       -
             as = "4242421588";

     

       11
       -
             link = "1";

     

       12
       -
           }

     

       13
       -
           # Kioubit

     

       14
       -
           {

     

       15
       -
             multi = true;

     

       16
       -
             multihop = false;

     

       17
       -
             gracefulRestart = true;

     

       18
       -
             name = "kioubit";

     

       19
       -
             neigh = "fe80::ade0%wg42_kioubit";

     

       20
       -
             as = "4242423914";

     

       21
       -
             link = "3";

     

       22
       -
           }

     

       23
       -
           # IEDON

     

       24
       -
           {

     

       25
       -
             multi = true;

     

       26
       -
             multihop = false;

     

       27
       -
             gracefulRestart = true;

     

       28
       -
             name = "ideon";

     

       29
       -
             neigh = "fe80::2189:e8%wg42_iedon";

     

       30
       -
             as = "4242422189";

     

       31
       -
             link = "5";

     

       32
       -
           }

     

       33
       -
           # SUNNET

     

       34
       -
           {

     

       35
       -
             multi = true;

     

       36
       -
             multihop = false;

     

       37
       -
             gracefulRestart = true;

     

       38
       -
             name = "sunnet";

     

       39
       -
             neigh = "fe80::3088:193%wg42_sunnet";

     

       40
       -
             as = "4242423088";

     

       41
       -
             link = "3";

     

       42
       -
           }

     

       43
       -
           # C4TG1RL5

     

       44
       -
           {

     

       45
       -
             multi = true;

     

       46
       -
             multihop = false;

     

       47
       -
             gracefulRestart = true;

     

       48
       -
             name = "c4tg1rl5";

     

       49
       -
             neigh = "fe80::4242%wg42_catgirls";

     

       50
       -
             as = "4242421411";

     

       51
       -
             link = "6";

     

       52
       -
           }

     

       53
       -
           # Potat0

     

       54
       -
           {

     

       55
       -
             multi = true;

     

       56
       -
             multihop = false;

     

       57
       -
             gracefulRestart = true;

     

       58
       -
             name = "potato";

     

       59
       -
             neigh = "fe80::1816%wg42_potato";

     

       60
       -
             as = "4242421816";

     

       61
       -
             link = "2";

     

       62
       -
           }

     

       63
       -
           # Uffsalot-v6

     

       64
       -
           {

     

       65
       -
             multi = false;

     

       66
       -
             v4 = false;

     

       67
       -
             v6 = true;

     

       68
       -
             multihop = false;

     

       69
       -
             gracefulRestart = true;

     

       70
       -
             name = "uffsalot_v6";

     

       71
       -
             neigh = "fe80::780%wg42_uffsalot";

     

       72
       -
             as = "4242420780";

     

       73
       -
             link = "5";

     

       74
       -
           }

     

       75
       -
           # Uffsalot-v6

     

       76
       -
           {

     

       77
       -
             multi = false;

     

       78
       -
             v4 = true;

     

       79
       -
             v6 = false;

     

       80
       -
             multihop = false;

     

       81
       -
             gracefulRestart = true;

     

       82
       -
             name = "uffsalot_v4";

     

       83
       -
             neigh = "172.20.191.129";

     

       84
       -
             as = "4242420780";

     

       85
       -
             link = "5";

     

       86
       -
           }

     

       87
       -
           # Bandura

     

       88
       -
           {

     

       89
       -
             multi = true;

     

       90
       -
             multihop = false;

     

       91
       -
             gracefulRestart = true;

     

       92
       -
             name = "bandura";

     

       93
       -
             neigh = "fe80::2926%wg42_bandura";

     

       94
       -
             as = "4242422923";

     

       95
       -
             link = "4";

     

       96
       -
           }

     

       97
       -
           # Bluemedia

     

       98
       -
           {

     

       99
       -
             multi = true;

     

       100
       -
             multihop = false;

     

       101
       -
             gracefulRestart = true;

     

       102
       -
             name = "bluemedia";

     

       103
       -
             neigh = "fe80::42:3343:20:1%wg42_bluemedia";

     

       104
       -
             as = "4242423343";

     

       105
       -
             link = "5";

     

       106
       -
           }

     

       107
       -
         ];

     

       108
       -
         extraConfig = "";

     

       109
       -
       }

-315

hosts/prefect/dn42/bird.conf

···

       1
       -
       log stderr all;

     

       2
       -
       debug protocols all;

     

       3
       -
       timeformat protocol iso long;

     

       4
       -
       ################################################

     

       5
       -
       #               Variable header                #

     

       6
       -
       ################################################

     

       7
       -
       

     

       8
       -
       define OWNAS =  4242422459;

     

       9
       -
       define OWNIP =  172.20.43.96;

     

       10
       -
       define OWNIPv6 = fd21:1500:66b0::1;

     

       11
       -
       define OWNNET = 172.20.43.96/27;

     

       12
       -
       define OWNNETv6 = fd21:1500:66b0::/48;

     

       13
       -
       define OWNNETSET = [172.20.43.96/29+];

     

       14
       -
       define OWNNETSETv6 = [fd21:1500:66b0::/48+];

     

       15
       -
       define DN42_REGION = 42;

     

       16
       -
       

     

       17
       -
       ################################################

     

       18
       -
       #                 Header end                   #

     

       19
       -
       ################################################

     

       20
       -
       

     

       21
       -
       router id OWNIP;

     

       22
       -
       

     

       23
       -
       protocol device {

     

       24
       -
           scan time 10;

     

       25
       -
       }

     

       26
       -
       

     

       27
       -
       /*

     

       28
       -
        *  Utility functions

     

       29
       -
        */

     

       30
       -
       

     

       31
       -
       function is_self_net() {

     

       32
       -
         return net ~ OWNNETSET;

     

       33
       -
       }

     

       34
       -
       

     

       35
       -
       function is_self_net_v6() {

     

       36
       -
         return net ~ OWNNETSETv6;

     

       37
       -
       }

     

       38
       -
       

     

       39
       -
       function is_valid_network() {

     

       40
       -
         return net ~ [

     

       41
       -
           172.20.0.0/14{21,29}, # dn42

     

       42
       -
           172.20.0.0/24{28,32}, # dn42 Anycast

     

       43
       -
           172.21.0.0/24{28,32}, # dn42 Anycast

     

       44
       -
           172.22.0.0/24{28,32}, # dn42 Anycast

     

       45
       -
           172.23.0.0/24{28,32}, # dn42 Anycast

     

       46
       -
           172.31.0.0/16+,       # ChaosVPN

     

       47
       -
           10.100.0.0/14+,       # ChaosVPN

     

       48
       -
           10.127.0.0/16{16,32}, # neonetwork

     

       49
       -
           10.0.0.0/8{15,24}     # Freifunk.net

     

       50
       -
         ];

     

       51
       -
       }

     

       52
       -
       

     

       53
       -
       roa4 table dn42_roa;

     

       54
       -
       roa6 table dn42_roa_v6;

     

       55
       -
       

     

       56
       -
       protocol static {

     

       57
       -
           roa4 { table dn42_roa; };

     

       58
       -
           include "/etc/bird/roa_dn42.conf";

     

       59
       -
       };

     

       60
       -
       

     

       61
       -
       protocol static {

     

       62
       -
           roa6 { table dn42_roa_v6; };

     

       63
       -
           include "/etc/bird/roa_dn42_v6.conf";

     

       64
       -
       };

     

       65
       -
       

     

       66
       -
       function is_valid_network_v6() {

     

       67
       -
         return net ~ [

     

       68
       -
           fd00::/8{44,64} # ULA address space as per RFC 4193

     

       69
       -
         ];

     

       70
       -
       }

     

       71
       -
       

     

       72
       -
       protocol kernel {

     

       73
       -
           scan time 20;

     

       74
       -
       

     

       75
       -
           ipv6 {

     

       76
       -
               import none;

     

       77
       -
               export filter {

     

       78
       -
                   if source = RTS_STATIC then reject;

     

       79
       -
                   krt_prefsrc = OWNIPv6;

     

       80
       -
                   accept;

     

       81
       -
               };

     

       82
       -
           };

     

       83
       -
       };

     

       84
       -
       

     

       85
       -
       protocol kernel {

     

       86
       -
           scan time 20;

     

       87
       -
           ipv4 {

     

       88
       -
               import none;

     

       89
       -
               export filter {

     

       90
       -
                   if source = RTS_STATIC then reject;

     

       91
       -
                   krt_prefsrc = OWNIP;

     

       92
       -
                   accept;

     

       93
       -
               };

     

       94
       -
           };

     

       95
       -
       }

     

       96
       -
       

     

       97
       -
       protocol static {

     

       98
       -
           route OWNNET reject;

     

       99
       -
       

     

       100
       -
           ipv4 {

     

       101
       -
               import all;

     

       102
       -
               export none;

     

       103
       -
           };

     

       104
       -
       }

     

       105
       -
       

     

       106
       -
       protocol static {

     

       107
       -
           route OWNNETv6 reject;

     

       108
       -
       

     

       109
       -
           ipv6 {

     

       110
       -
               import all;

     

       111
       -
               export none;

     

       112
       -
           };

     

       113
       -
       }

     

       114
       -
       

     

       115
       -
       template bgp dnpeers {

     

       116
       -
           local as OWNAS;

     

       117
       -
           path metric 1;

     

       118
       -
       }

     

       119
       -
       

     

       120
       -
       protocol ospf v3 {

     

       121
       -
               ipv4 {

     

       122
       -
                       export filter {

     

       123
       -
                               if source = RTS_STATIC || source = RTS_BGP then reject;

     

       124
       -
                               accept;

     

       125
       -
                       };

     

       126
       -
               };

     

       127
       -
       

     

       128
       -
               area 0 {

     

       129
       -
                       interface "lo" {

     

       130
       -
                               stub;

     

       131
       -
                       };

     

       132
       -
       

     

       133
       -
                       interface "ospf_*"{

     

       134
       -
                   		type pointopoint;

     

       135
       -
                       };

     

       136
       -
               };

     

       137
       -
       }

     

       138
       -
       

     

       139
       -
       protocol ospf v3 {

     

       140
       -
               ipv6 {

     

       141
       -
                       export filter {

     

       142
       -
                               if source = RTS_STATIC || source = RTS_BGP then reject;

     

       143
       -
                               accept;

     

       144
       -
                       };

     

       145
       -
               };

     

       146
       -
       

     

       147
       -
               area 0 {

     

       148
       -
                       interface "lo" {

     

       149
       -
                               stub;

     

       150
       -
                       };

     

       151
       -
       

     

       152
       -
                       interface "ospf_*" {

     

       153
       -
                               type pointopoint;

     

       154
       -
                       };

     

       155
       -
       

     

       156
       -
               };

     

       157
       -
       }

     

       158
       -
       

     

       159
       -
       

     

       160
       -
       function update_latency(int link_latency) {

     

       161
       -
         bgp_community.add((64511, link_latency));

     

       162
       -
              if (64511, 9) ~ bgp_community then { bgp_community.delete([(64511, 1..8)]); return 9; }

     

       163
       -
         else if (64511, 8) ~ bgp_community then { bgp_community.delete([(64511, 1..7)]); return 8; }

     

       164
       -
         else if (64511, 7) ~ bgp_community then { bgp_community.delete([(64511, 1..6)]); return 7; }

     

       165
       -
         else if (64511, 6) ~ bgp_community then { bgp_community.delete([(64511, 1..5)]); return 6; }

     

       166
       -
         else if (64511, 5) ~ bgp_community then { bgp_community.delete([(64511, 1..4)]); return 5; }

     

       167
       -
         else if (64511, 4) ~ bgp_community then { bgp_community.delete([(64511, 1..3)]); return 4; }

     

       168
       -
         else if (64511, 3) ~ bgp_community then { bgp_community.delete([(64511, 1..2)]); return 3; }

     

       169
       -
         else if (64511, 2) ~ bgp_community then { bgp_community.delete([(64511, 1..1)]); return 2; }

     

       170
       -
         else return 1;

     

       171
       -
       }

     

       172
       -
       

     

       173
       -
       function update_bandwidth(int link_bandwidth) {

     

       174
       -
         bgp_community.add((64511, link_bandwidth));

     

       175
       -
              if (64511, 21) ~ bgp_community then { bgp_community.delete([(64511, 22..29)]); return 21; }

     

       176
       -
         else if (64511, 22) ~ bgp_community then { bgp_community.delete([(64511, 23..29)]); return 22; }

     

       177
       -
         else if (64511, 23) ~ bgp_community then { bgp_community.delete([(64511, 24..29)]); return 23; }

     

       178
       -
         else if (64511, 24) ~ bgp_community then { bgp_community.delete([(64511, 25..29)]); return 24; }

     

       179
       -
         else if (64511, 25) ~ bgp_community then { bgp_community.delete([(64511, 26..29)]); return 25; }

     

       180
       -
         else if (64511, 26) ~ bgp_community then { bgp_community.delete([(64511, 27..29)]); return 26; }

     

       181
       -
         else if (64511, 27) ~ bgp_community then { bgp_community.delete([(64511, 28..29)]); return 27; }

     

       182
       -
         else if (64511, 28) ~ bgp_community then { bgp_community.delete([(64511, 29..29)]); return 28; }

     

       183
       -
         else return 29;

     

       184
       -
       }

     

       185
       -
       

     

       186
       -
       function update_crypto(int link_crypto) {

     

       187
       -
         bgp_community.add((64511, link_crypto));

     

       188
       -
              if (64511, 31) ~ bgp_community then { bgp_community.delete([(64511, 32..34)]); return 31; }

     

       189
       -
         else if (64511, 32) ~ bgp_community then { bgp_community.delete([(64511, 33..34)]); return 32; }

     

       190
       -
         else if (64511, 33) ~ bgp_community then { bgp_community.delete([(64511, 34..34)]); return 33; }

     

       191
       -
         else return 34;

     

       192
       -
       }

     

       193
       -
       

     

       194
       -
       function get_region() {

     

       195
       -
       if (64511, 41) ~ bgp_community then { return 41; }

     

       196
       -
       else if (64511, 42) ~ bgp_community then { return 42; }

     

       197
       -
       else if (64511, 43) ~ bgp_community then { return 43; }

     

       198
       -
       else if (64511, 44) ~ bgp_community then { return 44; }

     

       199
       -
       else if (64511, 45) ~ bgp_community then { return 45; }

     

       200
       -
       else if (64511, 46) ~ bgp_community then { return 46; }

     

       201
       -
       else if (64511, 47) ~ bgp_community then { return 47; }

     

       202
       -
       else if (64511, 48) ~ bgp_community then { return 48; }

     

       203
       -
       else if (64511, 49) ~ bgp_community then { return 49; }

     

       204
       -
       else if (64511, 50) ~ bgp_community then { return 50; }

     

       205
       -
       else if (64511, 51) ~ bgp_community then { return 51; }

     

       206
       -
       else if (64511, 52) ~ bgp_community then { return 52; }

     

       207
       -
       else if (64511, 53) ~ bgp_community then { return 53; }

     

       208
       -
       else return DN42_REGION;

     

       209
       -
       }

     

       210
       -
       

     

       211
       -
       

     

       212
       -
       function calculate_local_pref(int dn42_latency)

     

       213
       -
       int pref;

     

       214
       -
       {

     

       215
       -
               pref = 100;

     

       216
       -
               if (is_self_net() || is_self_net_v6()) then {

     

       217
       -
                               pref = 2000;

     

       218
       -
               }

     

       219
       -
               else if (bgp_path.len = 1) then {

     

       220
       -
                       pref = 1000;

     

       221
       -
               }

     

       222
       -
               else if (DN42_REGION = get_region()) then {

     

       223
       -
                       pref= 500;

     

       224
       -
               }

     

       225
       -
       	else {

     

       226
       -
       		if (DN42_REGION > get_region()) then {

     

       227
       -
       			pref = 500 - ((DN42_REGION - get_region()) * 10);

     

       228
       -
       	        }

     

       229
       -
       		else {

     

       230
       -
       			pref = 500 - ((get_region() - DN42_REGION) * 10);

     

       231
       -
       		}

     

       232
       -
               }

     

       233
       -
               pref = pref - 10*dn42_latency - 10* bgp_path.len;

     

       234
       -
               if pref > 2000 then {

     

       235
       -
                       pref = 10;

     

       236
       -
               }

     

       237
       -
               return pref;

     

       238
       -
       }

     

       239
       -
       

     

       240
       -
       function update_flags(int link_latency; int link_bandwidth; int link_crypto)

     

       241
       -
       int dn42_latency;

     

       242
       -
       int dn42_bandwidth;

     

       243
       -
       int dn42_crypto;

     

       244
       -
       {

     

       245
       -
         dn42_latency = update_latency(link_latency);

     

       246
       -
         dn42_bandwidth = update_bandwidth(link_bandwidth) - 20;

     

       247
       -
         dn42_crypto = update_crypto(link_crypto) - 30;

     

       248
       -
         if dn42_bandwidth > 5 then dn42_bandwidth = 5;

     

       249
       -
         bgp_local_pref = calculate_local_pref(dn42_latency);

     

       250
       -
         return true;

     

       251
       -
       }

     

       252
       -
       

     

       253
       -
       

     

       254
       -
       function dn42_import_filter(int link_latency; int link_bandwidth; int link_crypto) {

     

       255
       -
         if (is_valid_network() && !is_self_net()) || (is_valid_network_v6() && !is_self_net_v6()) then {

     

       256
       -
           if roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID && roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID  then {

     

       257
       -
             print "[dn42] Import : ROA check failed for ", net, " ASN ", bgp_path.last, " on ", proto;

     

       258
       -
             reject;

     

       259
       -
           }

     

       260
       -
           update_flags(link_latency, link_bandwidth, link_crypto);

     

       261
       -
           if (65535, 666) ~ bgp_community then dest = RTD_BLACKHOLE;

     

       262
       -
           accept;

     

       263
       -
         }

     

       264
       -
         print "[dn42] Import : Invalid Network for ", net, " ASN ", bgp_path.last, " on ", proto;

     

       265
       -
         reject;

     

       266
       -
       }

     

       267
       -
       

     

       268
       -
       function dn42_export_filter(int link_latency; int link_bandwith; int link_crypto) {

     

       269
       -
         if is_valid_network() || is_valid_network_v6() then {

     

       270
       -
       #    if roa_check(dn42_roa, net, bgp_path.last) != ROA_VALID && roa_check(dn42_roa_v6, net, bgp_path.last) != ROA_VALID  then {

     

       271
       -
       #      print "[dn42] Export : ROA check failed for ", net, " ASN ", bgp_path.last, " on ", proto;

     

       272
       -
       #      reject;

     

       273
       -
       #    }

     

       274
       -
           if source = RTS_STATIC then bgp_community.add((64511, DN42_REGION));

     

       275
       -
           update_flags(link_latency, link_bandwith, link_crypto);

     

       276
       -
           accept;

     

       277
       -
         }

     

       278
       -
         reject;

     

       279
       -
       }

     

       280
       -
       

     

       281
       -
       protocol bgp route_collector from dnpeers {

     

       282
       -
         neighbor fd42:4242:2601:ac12::1 as 4242422602;

     

       283
       -
         multihop;

     

       284
       -
         ipv4 {

     

       285
       -
           # export all available paths to the collector

     

       286
       -
           add paths tx;

     

       287
       -
       

     

       288
       -
           # import/export filters

     

       289
       -
           import none;

     

       290
       -
           export filter {

     

       291
       -
             # export all valid routes

     

       292
       -
             if ( is_valid_network() && source ~ [ RTS_STATIC, RTS_BGP ] )

     

       293
       -
             then {

     

       294
       -
               accept;

     

       295
       -
             }

     

       296
       -
             reject;

     

       297
       -
           };

     

       298
       -
         };

     

       299
       -
       

     

       300
       -
         ipv6 {

     

       301
       -
           # export all available paths to the collector

     

       302
       -
           add paths tx;

     

       303
       -
       

     

       304
       -
           # import/export filters

     

       305
       -
           import none;

     

       306
       -
           export filter {

     

       307
       -
             # export all valid routes

     

       308
       -
             if ( is_valid_network_v6() && source ~ [ RTS_STATIC, RTS_BGP ] )

     

       309
       -
             then {

     

       310
       -
               accept;

     

       311
       -
             }

     

       312
       -
             reject;

     

       313
       -
           };

     

       314
       -
         };

     

       315
       -
       }

+56 -20

hosts/prefect/dn42/default.nix

···

       1
       -
       { pkgs, ... }:

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       2
        
       {

     

       3
        
         imports = [

     

       4
       -
           ./services.nix

     

       5
       -
           ./wireguard.nix

     

       6
        
         ];

     

       7
       -
         networking.interfaces.lo = {

     

       8
       -
           ipv4.addresses = [

     

       9
       -
             {

     

       10
       -
               address = "172.20.43.96";

     

       11
       -
               prefixLength = 32;

     

       12
       -
             }

     

       13
       -
           ];

     

       14
       -
           ipv6.addresses = [

     

       15
       -
             {

     

       16
       -
               address = "fd21:1500:66b0::1";

     

       17
       -
               prefixLength = 128;

     

       18
       -
             }

     

       19
       -
             {

     

       20
       -
               address = "fe80::1";

     

       21
       -
               prefixLength = 128;

     

       22
       -
             }

     

       23
       -
           ];

     

       0
        
       
     

       0
        
       
     

       24
        
         };

     

       0
        
       
     

       25
        
         environment.systemPackages = with pkgs; [

     

       26
        
           dnsutils

     

       27
        
           mtr

     

       28
        
           tcpdump

     

       29
        
           wireguard-tools

     

       30
        
         ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       31
        
       }

···

       1
       +
       { pkgs, config, ... }:

     

       2
       +
       let

     

       3
       +
         cfg42 = config.dn42;

     

       4
       +
       in

     

       5
        
       {

     

       6
        
         imports = [

     

       7
       +
           ./peers

     

       0
        
       
     

       8
        
         ];

     

       9
       +
         networking = {

     

       10
       +
           interfaces.lo = {

     

       11
       +
             ipv4.addresses = [

     

       12
       +
               {

     

       13
       +
                 address = "172.20.43.96";

     

       14
       +
                 prefixLength = 32;

     

       15
       +
               }

     

       16
       +
             ];

     

       17
       +
             ipv6.addresses = [

     

       18
       +
               {

     

       19
       +
                 address = "fd21:1500:66b0::1";

     

       20
       +
                 prefixLength = 128;

     

       21
       +
               }

     

       22
       +
               {

     

       23
       +
                 address = "fe80::1";

     

       24
       +
                 prefixLength = 128;

     

       25
       +
               }

     

       26
       +
             ];

     

       27
       +
           };

     

       28
        
         };

     

       29
       +
       

     

       30
        
         environment.systemPackages = with pkgs; [

     

       31
        
           dnsutils

     

       32
        
           mtr

     

       33
        
           tcpdump

     

       34
        
           wireguard-tools

     

       35
        
         ];

     

       36
       +
         dn42 = {

     

       37
       +
           enable = true;

     

       38
       +
           # ASN corresponding to DN42 PYRONET

     

       39
       +
           as = 4242422459;

     

       40
       +
           # Communities config

     

       41
       +
           # https://dn42.dev/howto/BGP-communities

     

       42
       +
           region = 42;

     

       43
       +
           country = 1840;

     

       44
       +
           routerId = cfg42.addr.v4;

     

       45
       +
           # Primary IP Addresses

     

       46
       +
           addr = {

     

       47
       +
             v4 = "172.20.43.96";

     

       48
       +
             v6 = "fd21:1500:66b0::1";

     

       49
       +
           };

     

       50
       +
           # Owned IP Ranges

     

       51
       +
           nets = {

     

       52
       +
             v4 = [ "172.20.43.96/27" ];

     

       53
       +
             v6 = [ "fd21:1500:66b0::/48" ];

     

       54
       +
           };

     

       55
       +
           # Enable StayRTR

     

       56
       +
           # https://github.com/bgp/stayrtr

     

       57
       +
           stayrtr.enable = true;

     

       58
       +
           # Peer with GRC

     

       59
       +
           # https://dn42.dev/services/Route-Collector

     

       60
       +
           collector.enable = true;

     

       61
       +
       

     

       62
       +
           wg.tunnelDefaults = {

     

       63
       +
             privateKeyFile = "/run/agenix/dn42-privkey";

     

       64
       +
             localAddrs.v4 = cfg42.addr.v4;

     

       65
       +
           };

     

       66
       +
         };

     

       67
        
       }

+25

hosts/prefect/dn42/peers/bandura.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.bandura = {

     

       5
       +
             as = 4242422923;

     

       6
       +
             addr.v6 = "fe80::2926";

     

       7
       +
             interface = "wg42_bandura";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::11";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."55ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.bandura = {

     

       18
       +
             listenPort = 44923;

     

       19
       +
             peerPubKey = "xPW1/cWYDkk/IAss1GbdwVMW7fzKtyHA+qrfCriOB2k=";

     

       20
       +
             peerEndpoint = "aurora.mk16.de:52459";

     

       21
       +
             peerAddrs.v6 = "fe80::2926";

     

       22
       +
             localAddrs.v6 = "fe80::11";

     

       23
       +
           };

     

       24
       +
         };

     

       25
       +
       }

+26

hosts/prefect/dn42/peers/catgirls.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.catgirls = {

     

       5
       +
             as = 4242421411;

     

       6
       +
             addr.v6 = "fe80::2189:124";

     

       7
       +
             interface = "wg42_catgirls";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::111";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."148ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.catgirls = {

     

       18
       +
             enable = false;

     

       19
       +
             listenPort = 43411;

     

       20
       +
             peerPubKey = "";

     

       21
       +
             peerEndpoint = "";

     

       22
       +
             peerAddrs.v6 = "fe80::111";

     

       23
       +
             localAddrs.v6 = "fe80::7";

     

       24
       +
           };

     

       25
       +
         };

     

       26
       +
       }

+26

hosts/prefect/dn42/peers/chrismoos.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.chrismoos = {

     

       5
       +
             as = 4242421588;

     

       6
       +
             addr.v6 = "fe80::1588";

     

       7
       +
             interface = "wg42_chrismoos";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::100";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."2.7ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.chrismoos = {

     

       18
       +
             listenPort = 43588;

     

       19
       +
             peerPubKey = "itmJ4Z8V1aNN368P6kMzuQM+GdzWbBKZjJiXrgSeGlw=";

     

       20
       +
             peerEndpoint = "us-qas01.dn42.tech9.io:58768";

     

       21
       +
             peerAddrs.v4 = "172.20.16.143";

     

       22
       +
             peerAddrs.v6 = "fe80::1588";

     

       23
       +
             localAddrs.v6 = "fe80::100";

     

       24
       +
           };

     

       25
       +
         };

     

       26
       +
       }

+29

hosts/prefect/dn42/peers/darkpoint.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       let

     

       3
       +
         peerv6 = "fe80::150";

     

       4
       +
         localv6 = "fe80::113";

     

       5
       +
       in

     

       6
       +
       {

     

       7
       +
         config.dn42 = {

     

       8
       +
           peers.darkpoint = {

     

       9
       +
             as = 4242420150;

     

       10
       +
             addr.v6 = peerv6;

     

       11
       +
             interface = "wg42_darkpoint";

     

       12
       +
             extendedNextHop = true;

     

       13
       +
             # My side

     

       14
       +
             srcAddr.v6 = localv6;

     

       15
       +
             # Communities

     

       16
       +
             crypto = dn42Types.crypto.safePFS;

     

       17
       +
             latency = dn42Types.latency."2.7ms";

     

       18
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       19
       +
             transit = true;

     

       20
       +
           };

     

       21
       +
           wg.tunnels.darkpoint = {

     

       22
       +
             listenPort = 42150;

     

       23
       +
             peerPubKey = "1o0XfQvBM1gqknqzfuOnVmf2RjRTHuyMZYNipSSb2TQ=";

     

       24
       +
             peerEndpoint = "iad.darkpoint.xyz:22459";

     

       25
       +
             peerAddrs.v6 = peerv6;

     

       26
       +
             localAddrs.v6 = localv6;

     

       27
       +
           };

     

       28
       +
         };

     

       29
       +
       }

+23

hosts/prefect/dn42/peers/default.nix

···

       1
       +
       _:

     

       2
       +
       let

     

       3
       +
         dn42Types = import ../types.nix;

     

       4
       +
       in

     

       5
       +
       {

     

       6
       +
         # Port numbers are 42000 + `last 4 digits of ASN`

     

       7
       +
         imports = [

     

       8
       +
           # keep-sorted start

     

       9
       +
           (import ./bandura.nix { inherit dn42Types; })

     

       10
       +
           # (import ./catgirls.nix { inherit dn42Types; })

     

       11
       +
           (import ./chrismoos.nix { inherit dn42Types; })

     

       12
       +
           (import ./darkpoint.nix { inherit dn42Types; })

     

       13
       +
           (import ./iedon.nix { inherit dn42Types; })

     

       14
       +
           (import ./kioubit.nix { inherit dn42Types; })

     

       15
       +
           (import ./lare.nix { inherit dn42Types; })

     

       16
       +
           (import ./potato.nix { inherit dn42Types; })

     

       17
       +
           (import ./prefixlabs.nix { inherit dn42Types; })

     

       18
       +
           (import ./routedbits.nix { inherit dn42Types; })

     

       19
       +
           (import ./sunnet.nix { inherit dn42Types; })

     

       20
       +
           (import ./uffsalot.nix { inherit dn42Types; })

     

       21
       +
           # keep-sorted end

     

       22
       +
         ];

     

       23
       +
       }

+26

hosts/prefect/dn42/peers/iedon.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.iedon = {

     

       5
       +
             as = 4242422189;

     

       6
       +
             addr.v6 = "fe80::2189:124";

     

       7
       +
             interface = "wg42_iedon";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::6";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."20ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.iedon = {

     

       18
       +
             listenPort = 44198;

     

       19
       +
             peerPubKey = "2Wmv10a9eVSni9nfZ7YPsyl3ZC5z7vHq0sTZGgk5WGo=";

     

       20
       +
             peerEndpoint = "us-nyc.dn42.iedon.net:48883";

     

       21
       +
             peerAddrs.v4 = "172.23.91.124";

     

       22
       +
             peerAddrs.v6 = "fe80::2189:124";

     

       23
       +
             localAddrs.v6 = "fe80::6";

     

       24
       +
           };

     

       25
       +
         };

     

       26
       +
       }

+27

hosts/prefect/dn42/peers/kioubit.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.kioubit = {

     

       5
       +
             as = 4242423914;

     

       6
       +
             addr.v6 = "fe80::ade0";

     

       7
       +
             interface = "wg42_kioubit";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::ade1";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."7.3ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.kioubit = {

     

       18
       +
             listenPort = 45914;

     

       19
       +
             peerPubKey = "6Cylr9h1xFduAO+5nyXhFI1XJ0+Sw9jCpCDvcqErF1s=";

     

       20
       +
             peerEndpoint = "us2.g-load.eu:22459";

     

       21
       +
             peerAddrs.v4 = "172.20.53.98";

     

       22
       +
             peerAddrs.v6 = "fe80::ade0";

     

       23
       +
             localAddrs.v4 = "192.168.220.70";

     

       24
       +
             localAddrs.v6 = "fe80::ade1";

     

       25
       +
           };

     

       26
       +
         };

     

       27
       +
       }

+25

hosts/prefect/dn42/peers/lare.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.lare = {

     

       5
       +
             as = 4242423035;

     

       6
       +
             addr.v6 = "fe80::3035:137";

     

       7
       +
             interface = "wg42_lare";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::112";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."20ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.lare = {

     

       18
       +
             listenPort = 45035;

     

       19
       +
             peerPubKey = "AREskFoxP2cd6DXoJ7druDsiWKX+8TwrkQqfi4JxRRw=";

     

       20
       +
             peerEndpoint = "use2.dn42.lare.cc:22459";

     

       21
       +
             peerAddrs.v6 = "fe80::3035:137";

     

       22
       +
             localAddrs.v6 = "fe80::112";

     

       23
       +
           };

     

       24
       +
         };

     

       25
       +
       }

+26

hosts/prefect/dn42/peers/potato.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.potato = {

     

       5
       +
             as = 4242421816;

     

       6
       +
             addr.v6 = "fe80::1816";

     

       7
       +
             interface = "wg42_potato";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::111";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."148ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.potato = {

     

       18
       +
             enable = false;

     

       19
       +
             listenPort = 43816;

     

       20
       +
             peerPubKey = "LUwqKS6QrCPv510Pwt1eAIiHACYDsbMjrkrbGTJfviU=";

     

       21
       +
             peerEndpoint = "las.node.potat0.cc:22459";

     

       22
       +
             peerAddrs.v6 = "fe80::1816";

     

       23
       +
             localAddrs.v6 = "fe80::9";

     

       24
       +
           };

     

       25
       +
         };

     

       26
       +
       }

+26

hosts/prefect/dn42/peers/prefixlabs.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.prefixlabs = {

     

       5
       +
             as = 4242421240;

     

       6
       +
             addr.v6 = "fe80::1240:2";

     

       7
       +
             interface = "wg42_prefixlabs";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::240";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."7.3ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.prefixlabs = {

     

       18
       +
             listenPort = 43240;

     

       19
       +
             peerPubKey = "uRYzFGi+/B6pD0FR2SW3G/OzC5LPJXePNIt0s+nJfW0=";

     

       20
       +
             peerEndpoint = "us-01.prefixlabs.net:22459";

     

       21
       +
             peerAddrs.v4 = "172.20.209.11";

     

       22
       +
             peerAddrs.v6 = "fe80::1240:2";

     

       23
       +
             localAddrs.v6 = "fe80::240";

     

       24
       +
           };

     

       25
       +
         };

     

       26
       +
       }

+26

hosts/prefect/dn42/peers/routedbits.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.routedbits = {

     

       5
       +
             as = 4242420207;

     

       6
       +
             addr.v6 = "fe80::207";

     

       7
       +
             interface = "wg42_routedbits";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::5";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."2.7ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.routedbits = {

     

       18
       +
             listenPort = 42207;

     

       19
       +
             peerPubKey = "/RLM4EcF8b7FKKcxnvHIYyDoES59HXIBqhKEWt4yRy0=";

     

       20
       +
             peerEndpoint = "router.iad1.routedbits.com:52459";

     

       21
       +
             peerAddrs.v4 = "172.20.19.73";

     

       22
       +
             peerAddrs.v6 = "fe80::207";

     

       23
       +
             localAddrs.v6 = "fe80::5";

     

       24
       +
           };

     

       25
       +
         };

     

       26
       +
       }

+26

hosts/prefect/dn42/peers/sunnet.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.sunnet = {

     

       5
       +
             as = 4242423088;

     

       6
       +
             addr.v6 = "fe80::3088:193";

     

       7
       +
             interface = "wg42_sunnet";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::abcd";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."148ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.sunnet = {

     

       18
       +
             listenPort = 45088;

     

       19
       +
             peerPubKey = "QSAeFPotqFpF6fFe3CMrMjrpS5AL54AxWY2w1+Ot2Bo=";

     

       20
       +
             peerEndpoint = "lax1-us.dn42.6700.cc:22459";

     

       21
       +
             peerAddrs.v4 = "172.21.100.193";

     

       22
       +
             peerAddrs.v6 = "fe80::3088:193";

     

       23
       +
             localAddrs.v6 = "fe80::abcd";

     

       24
       +
           };

     

       25
       +
         };

     

       26
       +
       }

+26

hosts/prefect/dn42/peers/uffsalot.nix

···

       1
       +
       { dn42Types, ... }:

     

       2
       +
       {

     

       3
       +
         config.dn42 = {

     

       4
       +
           peers.uffsalot = {

     

       5
       +
             as = 4242420780;

     

       6
       +
             addr.v6 = "fe80::780";

     

       7
       +
             interface = "wg42_uffsalot";

     

       8
       +
             extendedNextHop = true;

     

       9
       +
             # My side

     

       10
       +
             srcAddr.v6 = "fe80::10";

     

       11
       +
             # Communities

     

       12
       +
             crypto = dn42Types.crypto.safePFS;

     

       13
       +
             latency = dn42Types.latency."148ms";

     

       14
       +
             bandwidth = dn42Types.bandwidth."1000mb";

     

       15
       +
             transit = true;

     

       16
       +
           };

     

       17
       +
           wg.tunnels.uffsalot = {

     

       18
       +
             listenPort = 42780;

     

       19
       +
             peerPubKey = "7V65FxvD9AQetyUr0qSiu+ik8samB4Atrw2ekvC0xQM=";

     

       20
       +
             peerEndpoint = "dn42-de-fra4.brand-web.net:42459";

     

       21
       +
             peerAddrs.v4 = "172.20.191.129";

     

       22
       +
             peerAddrs.v6 = "fe80::780";

     

       23
       +
             localAddrs.v6 = "fe80::10";

     

       24
       +
           };

     

       25
       +
         };

     

       26
       +
       }

-69

hosts/prefect/dn42/services.nix

···

       1
       -
       { pkgs, lib, ... }:

     

       2
       -
       let

     

       3
       -
         script = pkgs.writeShellScriptBin "update-roa" ''

     

       4
       -
           mkdir -p /etc/bird/

     

       5
       -
           ${pkgs.curl}/bin/curl -sfSLR {-o,-z}/etc/bird/roa_dn42_v6.conf https://dn42.burble.com/roa/dn42_roa_bird2_6.conf

     

       6
       -
           ${pkgs.curl}/bin/curl -sfSLR {-o,-z}/etc/bird/roa_dn42.conf https://dn42.burble.com/roa/dn42_roa_bird2_4.conf

     

       7
       -
           ${pkgs.bird2}/bin/birdc c

     

       8
       -
           ${pkgs.bird2}/bin/birdc reload in all

     

       9
       -
         '';

     

       10
       -
         bgp = import ./bgp.nix { };

     

       11
       -
       in

     

       12
       -
       {

     

       13
       -
         systemd = {

     

       14
       -
           timers.dn42-roa = {

     

       15
       -
             description = "Trigger a ROA table update";

     

       16
       -
       

     

       17
       -
             timerConfig = {

     

       18
       -
               OnBootSec = "5m";

     

       19
       -
               OnUnitInactiveSec = "1h";

     

       20
       -
               Unit = "dn42-roa.service";

     

       21
       -
             };

     

       22
       -
       

     

       23
       -
             wantedBy = [ "timers.target" ];

     

       24
       -
             before = [ "bird.service" ];

     

       25
       -
           };

     

       26
       -
           services = {

     

       27
       -
             dn42-roa = {

     

       28
       -
               after = [ "network.target" ];

     

       29
       -
               description = "DN42 ROA Updated";

     

       30
       -
               unitConfig = {

     

       31
       -
                 Type = "one-shot";

     

       32
       -
               };

     

       33
       -
               serviceConfig = {

     

       34
       -
                 ExecStart = "${script}/bin/update-roa";

     

       35
       -
               };

     

       36
       -
             };

     

       37
       -
           };

     

       38
       -
         };

     

       39
       -
       

     

       40
       -
         services = {

     

       41
       -
           bird = {

     

       42
       -
             enable = true;

     

       43
       -
             package = pkgs.bird2;

     

       44
       -
             checkConfig = false;

     

       45
       -
             config =

     

       46
       -
               builtins.readFile ./bird.conf

     

       47
       -
               + lib.concatStrings (

     

       48
       -
                 builtins.map (

     

       49
       -
                   x:

     

       50
       -
                   "\n      protocol bgp ${x.name} from dnpeers {\n        ${if x.multihop then "multihop;" else ""}\n        ${

     

       51
       -
                     if x.gracefulRestart then "graceful restart on;" else ""

     

       52
       -
                   }\n        neighbor ${x.neigh} as ${x.as};\n        ${

     

       53
       -
                     if x.multi || x.v4 then

     

       54
       -
                       "\n        ipv4 {\n                extended next hop on;\n                import where dn42_import_filter(${x.link},25,34);\n                export where dn42_export_filter(${x.link},25,34);\n                import keep filtered;\n        };\n        "

     

       55
       -
                     else

     

       56
       -
                       ""

     

       57
       -
                   }\n        ${

     

       58
       -
                     if x.multi || x.v6 then

     

       59
       -
                       "\n        ipv6 {\n                extended next hop on;\n                import where dn42_import_filter(${x.link},25,34);\n                export where dn42_export_filter(${x.link},25,34);\n                import keep filtered;\n        };\n        "

     

       60
       -
                     else

     

       61
       -
                       ""

     

       62
       -
                   }\n    }\n        "

     

       63
       -
                 ) bgp.sessions

     

       64
       -
               )

     

       65
       -
               + bgp.extraConfig;

     

       66
       -
           };

     

       67
       -
         };

     

       68
       -
         users.users.thehedgehog.extraGroups = [ "bird2" ];

     

       69
       -
       }

-75

hosts/prefect/dn42/tunnels.nix

···

       1
       -
       { tunnel, ... }:

     

       2
       -
       let

     

       3
       -
         # _defaultPubKey = "e6kp9sca4XIzncKa9GEQwyOnMjje299Xg9ZdgXWMwHg=";

     

       4
       -
         defaultPrivKeyFile = "/run/agenix/dn42-privkey";

     

       5
       -
         defaultLocalIPv4 = "172.20.43.96";

     

       6
       -
       in

     

       7
       -
       {

     

       8
       -
         wg42_chris =

     

       9
       -
           # Ports 485-486 available

     

       10
       -
       

     

       11
       -
           tunnel 487 defaultPrivKeyFile "itmJ4Z8V1aNN368P6kMzuQM+GdzWbBKZjJiXrgSeGlw=" defaultLocalIPv4 "fe80::100"

     

       12
       -
             "us-qas01.dn42.tech9.io:52322"

     

       13
       -
             "wg42_chris"

     

       14
       -
             "172.20.16.143"

     

       15
       -
             "fe80::1588";

     

       16
       -
       

     

       17
       -
         wg42_kioubit =

     

       18
       -
           tunnel 488 defaultPrivKeyFile "6Cylr9h1xFduAO+5nyXhFI1XJ0+Sw9jCpCDvcqErF1s=" defaultLocalIPv4 "fe80::3"

     

       19
       -
             "us2.g-load.eu:22459"

     

       20
       -
             "wg42_kioubit"

     

       21
       -
             "172.20.53.98"

     

       22
       -
             "fe80::ade0";

     

       23
       -
       

     

       24
       -
         # Ports 489-490 available

     

       25
       -
       

     

       26
       -
         wg42_iedon =

     

       27
       -
           tunnel 491 defaultPrivKeyFile "Sz0UhewjDk2yRKI0QL9rB+5daWpXFVlbbz9cLfVVLn4=" defaultLocalIPv4 "fe80::6"

     

       28
       -
             "us-sjc.dn42.kuu.moe:35470"

     

       29
       -
             "wg42_iedon"

     

       30
       -
             "172.23.91.117"

     

       31
       -
             "fe80::2189:e8";

     

       32
       -
       

     

       33
       -
         wg42_sunnet =

     

       34
       -
           tunnel 492 defaultPrivKeyFile "QSAeFPotqFpF6fFe3CMrMjrpS5AL54AxWY2w1+Ot2Bo=" defaultLocalIPv4 "fe80::abcd"

     

       35
       -
             "v6.lax1-us.dn42.6700.cc:22459"

     

       36
       -
             "wg42_sunnet"

     

       37
       -
             "172.21.100.193"

     

       38
       -
             "fe80::3088:193";

     

       39
       -
       

     

       40
       -
         wg42_catgirls =

     

       41
       -
           tunnel 493 defaultPrivKeyFile "jo8eAfY8LeA4FAEJ4laYYMNkMd4z3oO/zN5DN0Mo+RQ=" defaultLocalIPv4 "fe80::7" "karx.xyz:22459"

     

       42
       -
             "wg42_catgirls"

     

       43
       -
             ""

     

       44
       -
             "fe80::4242";

     

       45
       -
       

     

       46
       -
         # Port 494 Available

     

       47
       -
       

     

       48
       -
         wg42_potato =

     

       49
       -
           tunnel 495 defaultPrivKeyFile "LUwqKS6QrCPv510Pwt1eAIiHACYDsbMjrkrbGTJfviU=" defaultLocalIPv4 "fe80::9"

     

       50
       -
             "las.node.potat0.cc:22459"

     

       51
       -
             "wg42_potato"

     

       52
       -
             ""

     

       53
       -
             "fe80::1816";

     

       54
       -
       

     

       55
       -
         wg42_uffsalot =

     

       56
       -
           tunnel 496 defaultPrivKeyFile "7V65FxvD9AQetyUr0qSiu+ik8samB4Atrw2ekvC0xQM=" defaultLocalIPv4 "fe80::10"

     

       57
       -
             "dn42-de-fra4.brand-web.net:42459"

     

       58
       -
             "wg42_uffsalot"

     

       59
       -
             "172.20.191.129"

     

       60
       -
             "fe80::780";

     

       61
       -
       

     

       62
       -
         wg42_bandura =

     

       63
       -
           tunnel 497 defaultPrivKeyFile "xPW1/cWYDkk/IAss1GbdwVMW7fzKtyHA+qrfCriOB2k=" defaultLocalIPv4 "fe80::11"

     

       64
       -
             "aurora.mk16.de:52459"

     

       65
       -
             "wg42_bandura"

     

       66
       -
             ""

     

       67
       -
             "fe80::2926";

     

       68
       -
       

     

       69
       -
         wg42_bluemedia =

     

       70
       -
           tunnel 498 defaultPrivKeyFile "7HNg2+uMI2WfntN+WlMnlTDG6xra/Dusee82cuXWMBY=" defaultLocalIPv4 "fe80::12"

     

       71
       -
             "de-fra01.dn42.bluemedia.dev:22459"

     

       72
       -
             "wg42_bluemedia"

     

       73
       -
             "172.22.167.82"

     

       74
       -
             "fe80::42:3343:20:1";

     

       75
       -
       }

+63

hosts/prefect/dn42/types.nix

···

       1
       +
       # DN42 Community Standard BGP Communities

     

       2
       +
       # See main lists here: https://dn42.dev/howto/BGP-communities

     

       3
       +
       {

     

       4
       +
         latency = {

     

       5
       +
           "2.7ms" = 1;

     

       6
       +
           "7.3ms" = 2;

     

       7
       +
           "20ms" = 3;

     

       8
       +
           "55ms" = 4;

     

       9
       +
           "148ms" = 5;

     

       10
       +
           "403ms" = 6;

     

       11
       +
           "1097ms" = 7;

     

       12
       +
           "2981ms" = 8;

     

       13
       +
           "gt2981" = 9;

     

       14
       +
         };

     

       15
       +
         bandwidth = {

     

       16
       +
           "0.1mb" = 21;

     

       17
       +
           "1mb" = 22;

     

       18
       +
           "10mb" = 23;

     

       19
       +
           "100mb" = 24;

     

       20
       +
           "1000mb" = 25;

     

       21
       +
         };

     

       22
       +
         crypto = {

     

       23
       +
           unencrypted = 31;

     

       24
       +
           unsafeVPN = 32;

     

       25
       +
           safeNoPFS = 33;

     

       26
       +
           safePFS = 34;

     

       27
       +
         };

     

       28
       +
         region = {

     

       29
       +
           europe = 41;

     

       30
       +
           northAmericaEast = 42;

     

       31
       +
           northAmericaCentral = 43;

     

       32
       +
           northAmericaWest = 44;

     

       33
       +
           centralAmerica = 45;

     

       34
       +
           southAmericaEast = 46;

     

       35
       +
           southAmericaWest = 47;

     

       36
       +
           africaNorth = 48;

     

       37
       +
           africaSouth = 49;

     

       38
       +
           asiaSouth = 50;

     

       39
       +
           asiaSouthEast = 51;

     

       40
       +
           asiaEast = 52;

     

       41
       +
           pacificOceania = 53;

     

       42
       +
           antarctica = 54;

     

       43
       +
           asiaNorth = 55;

     

       44
       +
           asiaWest = 56;

     

       45
       +
           centralAsia = 57;

     

       46
       +
         };

     

       47
       +
         country = {

     

       48
       +
           canada = 1124;

     

       49
       +
           china = 1156;

     

       50
       +
           taiwan = 1158;

     

       51
       +
           france = 1250;

     

       52
       +
           germany = 1276;

     

       53
       +
           hongKong = 1344;

     

       54
       +
           japan = 1392;

     

       55
       +
           netherlands = 1528;

     

       56
       +
           norway = 1578;

     

       57
       +
           russianFederation = 1643;

     

       58
       +
           singapore = 1702;

     

       59
       +
           switzerland = 1756;

     

       60
       +
           unitedKingdom = 1826;

     

       61
       +
           unitedStatesOfAmerica = 1840;

     

       62
       +
         };

     

       63
       +
       }

-43

hosts/prefect/dn42/wireguard.nix

···

       1
       -
       { pkgs, lib, ... }:

     

       2
       -
       let

     

       3
       -
         defaultLocalIPv4 = "172.20.43.96/32";

     

       4
       -
         defaultLocalIPv6 = "fe80::1/64";

     

       5
       -
         privKeyFile = "/run/agenix/dn42-privkey";

     

       6
       -
         # _defaultPubKey = "e6kp9sca4XIzncKa9GEQwyOnMjje299Xg9ZdgXWMwHg=";

     

       7
       -
       in

     

       8
       -
       {

     

       9
       -
         environment.systemPackages = [ pkgs.wireguard-tools ];

     

       10
       -
       

     

       11
       -
         networking.wireguard.interfaces = import ./tunnels.nix rec {

     

       12
       -
           customTunnel = listenPort: privKeyFile: peerPubKey: endpoint: name: peerIPv4: peerIPv6: localIPv4: localIPv6: isOspf: {

     

       13
       -
             inherit listenPort;

     

       14
       -
             privateKeyFile = privKeyFile;

     

       15
       -
             allowedIPsAsRoutes = false;

     

       16
       -
             peers = [

     

       17
       -
               {

     

       18
       -
                 inherit endpoint;

     

       19
       -
                 publicKey = peerPubKey;

     

       20
       -
                 allowedIPs = [

     

       21
       -
                   "0.0.0.0/0"

     

       22
       -
                   "::/0"

     

       23
       -
                 ];

     

       24
       -
                 dynamicEndpointRefreshSeconds = 5;

     

       25
       -
                 persistentKeepalive = 15;

     

       26
       -
               }

     

       27
       -
             ];

     

       28
       -
             postSetup = ''

     

       29
       -
               ${if peerIPv4 != "" then "${pkgs.iproute2}/bin/ip addr add ${localIPv4} peer ${peerIPv4} dev ${name}" else ""}

     

       30
       -
               ${if peerIPv6 != "" then "${pkgs.iproute2}/bin/ip -6 addr add ${localIPv6} peer ${peerIPv6} dev ${name}" else ""}

     

       31
       -
             ''

     

       32
       -
             + lib.optionalString isOspf "${pkgs.iproute2}/bin/ip -6 addr add ${defaultLocalIPv6} dev ${name}";

     

       33
       -
           };

     

       34
       -
           # deadnix: skip

     

       35
       -
           tunnel =

     

       36
       -
             listenPort: _privKey: peerPubKey: localIPv4: localIPv6: endpoint: name: peerIPv4: peerIPv6:

     

       37
       -
             customTunnel listenPort privKeyFile peerPubKey endpoint name peerIPv4 peerIPv6 localIPv4 localIPv6 false;

     

       38
       -
           # deadnix: skip

     

       39
       -
           ospf =

     

       40
       -
             listenPort: _privKey: peerPubKey: endpoint: name: peerIPv4: peerIPv6: ULAIPv6:

     

       41
       -
             customTunnel listenPort privKeyFile peerPubKey endpoint name peerIPv4 peerIPv6 defaultLocalIPv4 ULAIPv6 true;

     

       42
       -
         };

     

       43
       -
       }

+2 -17

hosts/prefect/firewall.nix

···

       28
        
           ];

     

       29
        
           allowedUDPPortRanges = [

     

       30
        
             {

     

       31
       -
               from = 480;

     

       32
       -
               to = 510;

     

       33
        
             }

     

       34
        
           ];

     

       35
        
           trustedInterfaces = [

     

       36
       -
             "tailscale0"

     

       37
        
             "wg0"

     

       38
       -
       

     

       39
       -
             # DN42 Interfaces

     

       40
       -
             "wg42_bandura"

     

       41
       -
             "wg42_bluemedia"

     

       42
       -
             "wg42_catgirls"

     

       43
       -
             "wg42_chris"

     

       44
       -
             "wg42_iedon"

     

       45
       -
             "wg42_kioubit"

     

       46
       -
             "wg42_liki"

     

       47
       -
             "wg42_lutoma"

     

       48
       -
             "wg42_potato"

     

       49
       -
             "wg42_sunnet"

     

       50
       -
             "wg42_uffsalot"

     

       51
       -
             "wg42_usman"

     

       52
        
           ];

     

       53
        
           extraForwardRules = ''

     

       54
        
             meta iifname "wg42_*" meta oifname "wg42_*" accept

···

       28
        
           ];

     

       29
        
           allowedUDPPortRanges = [

     

       30
        
             {

     

       31
       +
               from = 42000;

     

       32
       +
               to = 52000;

     

       33
        
             }

     

       34
        
           ];

     

       35
        
           trustedInterfaces = [

     

       0
        
       
     

       36
        
             "wg0"

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       37
        
           ];

     

       38
        
           extraForwardRules = ''

     

       39
        
             meta iifname "wg42_*" meta oifname "wg42_*" accept

+8 -13

hosts/prefect/services/caddy.nix

···

       67
        
             # Authentication

     

       68
        
             ${pns.pocket-id.extUrl} = {

     

       69
        
               extraConfig = ''

     

       70
       -
                 reverse_proxy / ${marvin}:${toString pns.pocket-id.port} {

     

       71
       -
                   header_up X-Real-IP {remote_host}

     

       72
       -
                   header_up X-Http-Version {http.request.proto}

     

       73
       -
                 }

     

       74
        
               '';

     

       75
        
             };

     

       76
        
       

     
···

       214
        
               '';

     

       215
        
             };

     

       216
        
       

     

       217
       -
             # Pingvin Share

     

       218
       -
             ${pns.pingvin-share.extUrl} = {

     

       219
        
               extraConfig = ''

     

       220
       -
                 reverse_proxy /api/* ${marvin}:${toString pns.pingvin-share.be-anubis} {

     

       221
       -
                   header_up X-Real-IP {remote_host}

     

       222
       -
                   header_up X-Http-Version {http.request.proto}

     

       223
       -
                 }

     

       224
       -
                 reverse_proxy /* ${marvin}:${toString pns.pingvin-share.anubis} {

     

       225
       -
                   header_up X-Real-IP {remote_host}

     

       226
       -
                   header_up X-Http-Version {http.request.proto}

     

       227
        
                 }

     

       0
        
       
     

       228
        
               '';

     

       229
        
             };

     

       0
        
       
     

       230
        
             # Tangled Services

     

       231
        
             ${pns.tangled-knot.extUrl} = {

     

       232
        
               extraConfig = ''

···

       67
        
             # Authentication

     

       68
        
             ${pns.pocket-id.extUrl} = {

     

       69
        
               extraConfig = ''

     

       70
       +
                 reverse_proxy ${marvin}:${toString pns.pocket-id.port}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       71
        
               '';

     

       72
        
             };

     

       73
        
       

     
···

       211
        
               '';

     

       212
        
             };

     

       213
        
       

     

       214
       +
             # Immich

     

       215
       +
             ${pns.immich.extUrl} = {

     

       216
        
               extraConfig = ''

     

       217
       +
                 @public path /share /share/*

     

       218
       +
                 handle @public {

     

       219
       +
                   reverse_proxy ${marvin}:${toString pns.immich.pubProxy}

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       220
        
                 }

     

       221
       +
                 reverse_proxy ${marvin}:${toString pns.immich.port}

     

       222
        
               '';

     

       223
        
             };

     

       224
       +
       

     

       225
        
             # Tangled Services

     

       226
        
             ${pns.tangled-knot.extUrl} = {

     

       227
        
               extraConfig = ''

-1

hosts/prefect/services/tailscale.nix

···

       6
        
         networking.firewall = {

     

       7
        
           trustedInterfaces = [ "tailscale0" ];

     

       8
        
           allowedUDPPorts = [ config.services.tailscale.port ];

     

       9
       -
           checkReversePath = "loose";

     

       10
        
         };

     

       11
        
       }

···

       6
        
         networking.firewall = {

     

       7
        
           trustedInterfaces = [ "tailscale0" ];

     

       8
        
           allowedUDPPorts = [ config.services.tailscale.port ];

     

       0
        
       
     

       9
        
         };

     

       10
        
       }

-1

hosts/zaphod/packages.nix

···

       14
        
           pkgs.nixpkgs-track

     

       15
        
           pkgs.pmutils

     

       16
        
           pkgs.qbittorrent

     

       17
       -
           pkgs.scrcpy

     

       18
        
           pkgs.steam-run

     

       19
        
           # Tools for working with Framework computers

     

       20
        
           pkgs.framework-tool-tui

···

       14
        
           pkgs.nixpkgs-track

     

       15
        
           pkgs.pmutils

     

       16
        
           pkgs.qbittorrent

     

       0
        
       
     

       17
        
           pkgs.steam-run

     

       18
        
           # Tools for working with Framework computers

     

       19
        
           pkgs.framework-tool-tui

-1

hosts/zaphod/services/greeter.nix

···

       7
        
             hide_version_string = true;

     

       8
        
           };

     

       9
        
         };

     

       10
       -
         security.pam.services.ly.fprintAuth = false;

     

       11
        
       }

···

       7
        
             hide_version_string = true;

     

       8
        
           };

     

       9
        
         };

     

       0
        
       
     

       10
        
       }

lib/data/services.toml

···

       5
        
       # anubis: What port the anubis service for this domain will use, int

     

       6
        
       # tsHost: (optional) What Tailscale host this service will run on, for services only available via Tailscale.

     

       7
        
       # # Should only be set if this is available externally, if at all, since TS-only services aren't able to be scraped.

     

       0
        
       
     

       8
        
       [authentik]

     

       9
        
       port = 6908

     

       10
        
       host = "marvin"

     
···

       43
        
       port = 6923

     

       44
        
       host = "marvin"

     

       45
        
       extUrl = "soc.pyrox.dev"

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       46
        
       

     

       47
        
       [jellyfin]

     

       48
        
       port = 8096

···

       5
        
       # anubis: What port the anubis service for this domain will use, int

     

       6
        
       # tsHost: (optional) What Tailscale host this service will run on, for services only available via Tailscale.

     

       7
        
       # # Should only be set if this is available externally, if at all, since TS-only services aren't able to be scraped.

     

       8
       +
       # Current lowest unassigned port: 6938

     

       9
        
       [authentik]

     

       10
        
       port = 6908

     

       11
        
       host = "marvin"

     
···

       44
        
       port = 6923

     

       45
        
       host = "marvin"

     

       46
        
       extUrl = "soc.pyrox.dev"

     

       47
       +
       

     

       48
       +
       [immich]

     

       49
       +
       port = 6936

     

       50
       +
       host = "marvin"

     

       51
       +
       extUrl = "img.pyrox.dev"

     

       52
       +
       pubProxy = 6937

     

       53
        
       

     

       54
        
       [jellyfin]

     

       55
        
       port = 8096

+1 -1

nixosModules/default-config/default.nix

···

       14
        
           ./users.nix

     

       15
        
         ];

     

       16
        
         system = {

     

       17
       -
           stateVersion = "25.05";

     

       18
        
           disableInstallerTools = true;

     

       19
        
           tools.nixos-rebuild.enable = true;

     

       20
        
         };

···

       14
        
           ./users.nix

     

       15
        
         ];

     

       16
        
         system = {

     

       17
       +
           stateVersion = "26.05";

     

       18
        
           disableInstallerTools = true;

     

       19
        
           tools.nixos-rebuild.enable = true;

     

       20
        
         };

+2 -4

nixosModules/default-config/nixConfig.nix

···

       15
        
       {

     

       16
        
         nix = {

     

       17
        
           enable = true;

     

       18
       -
           # We use `nh.clean` instead, so this is disabled

     

       19
       -
           gc.automatic = false;

     

       20
        
           registry = lib.mapAttrs (_: v: { flake = v; }) flakeInputs;

     

       21
        
           settings = {

     

       22
        
             # Don't auto-accept flake-defined nix settings, they're a CVE waiting to happen.

     
···

       58
        
             keep-going = true;

     

       59
        
             # More direnv gc root stuff

     

       60
        
             keep-outputs = true;

     

       61
       -
             # Show fewer log lines from failed builds since I get them from nh

     

       62
       -
             log-lines = 10;

     

       63
        
             # Limit the max amount of builds

     

       64
        
             max-jobs = lib.mkDefault 4;

     

       65
        
             # Extra system features

···

       15
        
       {

     

       16
        
         nix = {

     

       17
        
           enable = true;

     

       18
       +
           gc.automatic = true;

     

       0
        
       
     

       19
        
           registry = lib.mapAttrs (_: v: { flake = v; }) flakeInputs;

     

       20
        
           settings = {

     

       21
        
             # Don't auto-accept flake-defined nix settings, they're a CVE waiting to happen.

     
···

       57
        
             keep-going = true;

     

       58
        
             # More direnv gc root stuff

     

       59
        
             keep-outputs = true;

     

       60
       +
             log-lines = 20;

     

       0
        
       
     

       61
        
             # Limit the max amount of builds

     

       62
        
             max-jobs = lib.mkDefault 4;

     

       63
        
             # Extra system features

-1

nixosModules/default-config/programs/default.nix

···

       1
        
       {

     

       2
        
         imports = [

     

       3
        
           ./ssh.nix

     

       4
       -
           ./nh.nix

     

       5
        
         ];

     

       6
        
         programs.fish.enable = true;

     

       7
        
       }

···

       1
        
       {

     

       2
        
         imports = [

     

       3
        
           ./ssh.nix

     

       0
        
       
     

       4
        
         ];

     

       5
        
         programs.fish.enable = true;

     

       6
        
       }

-7

nixosModules/default-config/programs/nh.nix

···

       1
       -
       _: {

     

       2
       -
         programs.nh = {

     

       3
       -
           enable = true;

     

       4
       -
           clean.enable = true;

     

       5
       -
           clean.extraArgs = "-k 5";

     

       6
       -
         };

     

       7
       -
       }

nixosModules/default.nix

···

       5
        
           defaultUsers = import ./default-users;

     

       6
        
           profiles = import ./profiles;

     

       7
        
       

     

       0
        
       
     

       0
        
       
     

       8
        
           # Programs

     

       9
        
           chromium = import ./programs/chromium;

     

       10
        
           firefox = import ./programs/firefox;

···

       5
        
           defaultUsers = import ./default-users;

     

       6
        
           profiles = import ./profiles;

     

       7
        
       

     

       8
       +
           dn42Wireguard = import ./dn42Wireguard;

     

       9
       +
       

     

       10
        
           # Programs

     

       11
        
           chromium = import ./programs/chromium;

     

       12
        
           firefox = import ./programs/firefox;

+125

nixosModules/dn42Wireguard/default.nix

···

       1
       +
       {

     

       2
       +
         config,

     

       3
       +
         lib,

     

       4
       +
         pkgs,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
       +
       let

     

       8
       +
         inherit (lib) types;

     

       9
       +
         cfg = config.networking.dn42.wg;

     

       10
       +
       

     

       11
       +
         tunnelDef = {

     

       12
       +
           options = {

     

       13
       +
             enable = lib.mkOption {

     

       14
       +
               description = "Whether to enable this wireguard tunnel";

     

       15
       +
               type = types.bool;

     

       16
       +
               default = true;

     

       17
       +
               example = false;

     

       18
       +
             };

     

       19
       +
             listenPort = lib.mkOption {

     

       20
       +
               description = "The port this tunnel listens on";

     

       21
       +
               type = types.port;

     

       22
       +
               example = 42000;

     

       23
       +
             };

     

       24
       +
             privateKeyFile = lib.mkOption {

     

       25
       +
               description = "Path to the tunnel's private key";

     

       26
       +
               type = types.nullOr types.path;

     

       27
       +
               example = "/path/to/private/key";

     

       28
       +
               default = null;

     

       29
       +
             };

     

       30
       +
             peerPubKey = lib.mkOption {

     

       31
       +
               description = "Public key of the peer you're connecting to";

     

       32
       +
               type = types.str;

     

       33
       +
               example = "e6kp9sca4XIzncKa9GEQwyOnMjje299Xg9ZdgXWMwHg=";

     

       34
       +
             };

     

       35
       +
             peerEndpoint = lib.mkOption {

     

       36
       +
               description = "The endpoint of the peer you're connecting to";

     

       37
       +
               type = types.str;

     

       38
       +
               example = "example.com:42000";

     

       39
       +
             };

     

       40
       +
             peerAddrs = {

     

       41
       +
               v4 = lib.mkOption {

     

       42
       +
                 description = "The peer IPv4 address to connect to in the tunnel";

     

       43
       +
                 type = types.nullOr types.str;

     

       44
       +
                 example = "192.168.1.1";

     

       45
       +
                 default = null;

     

       46
       +
               };

     

       47
       +
               v6 = lib.mkOption {

     

       48
       +
                 description = "The peer IPv6 address to connect to in the tunnel";

     

       49
       +
                 type = types.nullOr types.str;

     

       50
       +
                 example = "fe80::42";

     

       51
       +
                 default = null;

     

       52
       +
               };

     

       53
       +
             };

     

       54
       +
             localAddrs = {

     

       55
       +
               v4 = lib.mkOption {

     

       56
       +
                 description = "The local IPv4 address to listen on in the tunnel";

     

       57
       +
                 type = types.nullOr types.str;

     

       58
       +
                 example = "192.168.1.1";

     

       59
       +
                 default = null;

     

       60
       +
               };

     

       61
       +
               v6 = lib.mkOption {

     

       62
       +
                 description = "The local IPv6 address to listen on in the tunnel";

     

       63
       +
                 type = types.nullOr types.str;

     

       64
       +
                 example = "fe80::42";

     

       65
       +
                 default = null;

     

       66
       +
               };

     

       67
       +
             };

     

       68
       +
           };

     

       69
       +
         };

     

       70
       +
       in

     

       71
       +
       {

     

       72
       +
         options.networking.dn42.wg = {

     

       73
       +
           tunnelDefaults = lib.mkOption {

     

       74
       +
             description = "The default settings to apply to all tunnels";

     

       75
       +
             type = types.submodule tunnelDef;

     

       76
       +
           };

     

       77
       +
           tunnels = lib.mkOption {

     

       78
       +
             description = "DN42 WireGuard tunnels configuration";

     

       79
       +
             type = types.attrsOf (types.submodule tunnelDef);

     

       80
       +
           };

     

       81
       +
         };

     

       82
       +
         config.networking = {

     

       83
       +
           wireguard.interfaces = lib.mapAttrs' (

     

       84
       +
             name: value:

     

       85
       +
             let

     

       86
       +
               # Merge defaults with tunnel config, right side has priority

     

       87
       +
               # so tunnel config overrides defaults

     

       88
       +
               fc = cfg.tunnelDefaults // (lib.filterAttrs (_: v: v != null) value);

     

       89
       +
             in

     

       90
       +
             lib.nameValuePair "wg42_${name}" {

     

       91
       +
               inherit (fc) listenPort privateKeyFile;

     

       92
       +
               allowedIPsAsRoutes = false;

     

       93
       +
               peers = [

     

       94
       +
                 {

     

       95
       +
                   endpoint = fc.peerEndpoint;

     

       96
       +
                   publicKey = fc.peerPubKey;

     

       97
       +
                   allowedIPs = [

     

       98
       +
                     "0.0.0.0/0"

     

       99
       +
                     "::/0"

     

       100
       +
                   ];

     

       101
       +
                   dynamicEndpointRefreshSeconds = 5;

     

       102
       +
                   persistentKeepalive = 15;

     

       103
       +
                 }

     

       104
       +
               ];

     

       105
       +
               postSetup = ''

     

       106
       +
                 ${lib.optionalString (

     

       107
       +
                   fc.peerAddrs.v4 != null && fc.localAddrs.v4 != null

     

       108
       +
                 ) "${pkgs.iproute2}/bin/ip addr add ${fc.localAddrs.v4} peer ${fc.peerAddrs.v4} dev wg42_${name}"}

     

       109
       +
                 ${lib.optionalString (

     

       110
       +
                   fc.peerAddrs.v6 != null && fc.localAddrs.v6 != null

     

       111
       +
                 ) "${pkgs.iproute2}/bin/ip addr add ${fc.localAddrs.v6} peer ${fc.peerAddrs.v6} dev wg42_${name}"}

     

       112
       +
               '';

     

       113
       +
             }

     

       114
       +
           ) (lib.filterAttrs (_: v: v.enable) cfg.tunnels);

     

       115
       +
           firewall = {

     

       116
       +
             trustedInterfaces = lib.mapAttrsToList (name: _: "wg42_" + name) (lib.filterAttrs (_: v: v.enable) cfg.tunnels);

     

       117
       +
             checkReversePath = false;

     

       118
       +
             extraInputRules = ''

     

       119
       +
               ip saddr 172.20.0.0/14 accept

     

       120
       +
               ip6 saddr fd00::/8 accept

     

       121
       +
               ip6 saddr fe80::/64 accept

     

       122
       +
             '';

     

       123
       +
           };

     

       124
       +
         };

     

       125
       +
       }

+1 -1

nixosModules/homes/pyrox/default.nix

···

       9
        
             inputs.self.homeModules.allModules

     

       10
        
             {

     

       11
        
               home.username = "pyrox";

     

       12
       -
               home.stateVersion = "25.11";

     

       13
        
               py.profiles.server.enable = lib.mkDefault true;

     

       14
        
               py.profiles.desktop.enable = lib.mkDefault false;

     

       15
        
             }

···

       9
        
             inputs.self.homeModules.allModules

     

       10
        
             {

     

       11
        
               home.username = "pyrox";

     

       12
       +
               home.stateVersion = "26.05";

     

       13
        
               py.profiles.server.enable = lib.mkDefault true;

     

       14
        
               py.profiles.desktop.enable = lib.mkDefault false;

     

       15
        
             }

+1 -1

nixosModules/homes/thehedgehog/default.nix

···

       9
        
             inputs.self.homeModules.allModules

     

       10
        
             {

     

       11
        
               home.username = "thehedgehog";

     

       12
       -
               home.stateVersion = "25.11";

     

       13
        
               py.profiles.server.enable = lib.mkDefault true;

     

       14
        
               py.profiles.desktop.enable = lib.mkDefault false;

     

       15
        
             }

···

       9
        
             inputs.self.homeModules.allModules

     

       10
        
             {

     

       11
        
               home.username = "thehedgehog";

     

       12
       +
               home.stateVersion = "26.05";

     

       13
        
               py.profiles.server.enable = lib.mkDefault true;

     

       14
        
               py.profiles.desktop.enable = lib.mkDefault false;

     

       15
        
             }

nixosModules/homes/thehedgehog-zaphod/default.nix

···

       2
        
         pkgs,

     

       3
        
         lib,

     

       4
        
         inputs,

     

       0
        
       
     

       5
        
         ...

     

       6
        
       }:

     

       7
        
       let

     
···

       12
        
           home.packages = [

     

       13
        
             pkgs.mindustry

     

       14
        
             pkgs.signal-desktop

     

       0
        
       
     

       15
        
           ];

     

       16
        
           home.sessionVariables = {

     

       17
        
             QT_QPA_PLATFORM = "wayland;xcb";

···

       2
        
         pkgs,

     

       3
        
         lib,

     

       4
        
         inputs,

     

       5
       +
         self',

     

       6
        
         ...

     

       7
        
       }:

     

       8
        
       let

     
···

       13
        
           home.packages = [

     

       14
        
             pkgs.mindustry

     

       15
        
             pkgs.signal-desktop

     

       16
       +
             self'.packages.glide-browser-bin

     

       17
        
           ];

     

       18
        
           home.sessionVariables = {

     

       19
        
             QT_QPA_PLATFORM = "wayland;xcb";

-2

nixosModules/programs/firefox/extensions.nix

···

       32
        
         "{30280527-c46c-4e03-bb16-2e3ed94fa57c}" = mkAMO "protondb-for-steam";

     

       33
        
         "redirector@einaregilsson.com" = mkAMO "redirector";

     

       34
        
         "{a4c4eda4-fb84-4a84-b4a1-f7c1cbf2a1ad}" = mkAMO "refined-github-";

     

       35
       -
         "{762f9885-5a13-4abd-9c77-433dcd38b8fd}" = mkAMO "return-youtube-dislikes";

     

       36
       -
         "{48748554-4c01-49e8-94af-79662bf34d50}" = mkAMO "privacy-pass";

     

       37
        
         "sponsorBlocker@ajay.app" = mkAMO "sponsorblock";

     

       38
        
         "firefox-extension@steamdb.info" = mkAMO "steam-database";

     

       39
        
         "{7a7a4a92-a2a0-41d1-9fd7-1e92480d612d}" = mkAMO "styl-us" // {

···

       32
        
         "{30280527-c46c-4e03-bb16-2e3ed94fa57c}" = mkAMO "protondb-for-steam";

     

       33
        
         "redirector@einaregilsson.com" = mkAMO "redirector";

     

       34
        
         "{a4c4eda4-fb84-4a84-b4a1-f7c1cbf2a1ad}" = mkAMO "refined-github-";

     

       0
        
       
     

       0
        
       
     

       35
        
         "sponsorBlocker@ajay.app" = mkAMO "sponsorblock";

     

       36
        
         "firefox-extension@steamdb.info" = mkAMO "steam-database";

     

       37
        
         "{7a7a4a92-a2a0-41d1-9fd7-1e92480d612d}" = mkAMO "styl-us" // {

-2

nixosModules/services/forgejo-runner/default.nix

···

       26
        
             };

     

       27
        
             cache = {

     

       28
        
               enabled = true;

     

       29
       -
               dir = "/var/lib/forgejo/runners/cache/";

     

       30
       -
               host = "";

     

       31
        
               port = 0;

     

       32
        
             };

     

       33
        
             container = {

···

       26
        
             };

     

       27
        
             cache = {

     

       28
        
               enabled = true;

     

       0
        
       
     

       0
        
       
     

       29
        
               port = 0;

     

       30
        
             };

     

       31
        
             container = {

optnix.toml

···

       1
       +
       [scopes.flake-parts]

     

       2
       +
       description = "flake-parts config"

     

       3
       +
       options-list-cmd = "nix eval --json .#debug.options-doc"

     

       4
       +
       evaluator = "nix eval .#debug.config.{{ .Option }}"

-20

packages/anubis-files/default.nix

···

       1
       -
       {

     

       2
       -
         stdenv,

     

       3
       -
         ...

     

       4
       -
       }:

     

       5
       -
       stdenv.mkDerivation {

     

       6
       -
         pname = "pyronet-anubis-files";

     

       7
       -
         version = "1.0.0";

     

       8
       -
       

     

       9
       -
         src = ./src;

     

       10
       -
       

     

       11
       -
         buildPhase = ''

     

       12
       -
           substituteInPlace policies/*.yaml \

     

       13
       -
             --replace-fail "CUSTOM" $out/rules

     

       14
       -
         '';

     

       15
       -
       

     

       16
       -
         installPhase = ''

     

       17
       -
           mkdir $out

     

       18
       -
           cp -r * $out/

     

       19
       -
         '';

     

       20
       -
       }

+20

packages/anubis-files/package.nix

···

       1
       +
       {

     

       2
       +
         stdenv,

     

       3
       +
         ...

     

       4
       +
       }:

     

       5
       +
       stdenv.mkDerivation {

     

       6
       +
         pname = "pyronet-anubis-files";

     

       7
       +
         version = "1.0.0";

     

       8
       +
       

     

       9
       +
         src = ./src;

     

       10
       +
       

     

       11
       +
         buildPhase = ''

     

       12
       +
           substituteInPlace policies/*.yaml \

     

       13
       +
             --replace-fail "CUSTOM" $out

     

       14
       +
         '';

     

       15
       +
       

     

       16
       +
         installPhase = ''

     

       17
       +
           mkdir $out

     

       18
       +
           cp -r * $out/

     

       19
       +
         '';

     

       20
       +
       }

+56

packages/anubis-files/src/policies/default.yaml

···

       1
       +
       bots:

     

       2
       +
         - import: CUSTOM/policies/meta/base.yaml

     

       3
       +
       dnsbl: false

     

       4
       +
       openGraph:

     

       5
       +
         enabled: true

     

       6
       +
         considerHost: false

     

       7
       +
         ttl: 24h

     

       8
       +
       status_codes:

     

       9
       +
         CHALLENGE: 200

     

       10
       +
         DENY: 200

     

       11
       +
       thresholds:

     

       12
       +
         - name: minimal-suspicion

     

       13
       +
           expression: weight <= 0

     

       14
       +
           action: ALLOW

     

       15
       +
         - name: mild-suspicion

     

       16
       +
           expression:

     

       17
       +
             all:

     

       18
       +
               - weight > 0

     

       19
       +
               - weight < 10

     

       20
       +
           action: CHALLENGE

     

       21
       +
           challenge:

     

       22
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh

     

       23
       +
             algorithm: metarefresh

     

       24
       +
             difficulty: 1

     

       25
       +
             report_as: 1

     

       26
       +
         - name: moderate-suspicion

     

       27
       +
           expression:

     

       28
       +
             all:

     

       29
       +
               - weight >= 10

     

       30
       +
               - weight < 20

     

       31
       +
           action: CHALLENGE

     

       32
       +
           challenge:

     

       33
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       34
       +
             algorithm: fast

     

       35
       +
             difficulty: 2 # two leading zeros, very fast for most clients

     

       36
       +
             report_as: 2

     

       37
       +
         - name: mild-proof-of-work

     

       38
       +
           expression:

     

       39
       +
             all:

     

       40
       +
               - weight >= 20

     

       41
       +
               - weight < 30

     

       42
       +
           action: CHALLENGE

     

       43
       +
           challenge:

     

       44
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       45
       +
             algorithm: fast

     

       46
       +
             difficulty: 4

     

       47
       +
             report_as: 4

     

       48
       +
         # For clients that are browser like and have gained many points from custom rules

     

       49
       +
         - name: extreme-suspicion

     

       50
       +
           expression: weight >= 30

     

       51
       +
           action: CHALLENGE

     

       52
       +
           challenge:

     

       53
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       54
       +
             algorithm: fast

     

       55
       +
             difficulty: 6

     

       56
       +
             report_as: 5

+60 -6

packages/anubis-files/src/policies/forgejo.yaml

···

       1
        
       bots:

     

       2
       -
         - import: (data)/bots/ai-robots-txt.yaml

     

       3
       -
         - import: CUSTOM/block/alibaba-cloud.yaml

     

       4
        
         - import: (data)/clients/git.yaml

     

       5
       -
         - import: (data)/common/keep-internet-working.yaml

     

       6
        
         - import: (data)/apps/gitea-rss-feeds.yaml

     

       7
       -
         - import: (data)/crawlers/internet-archive.yaml

     

       8
       -
         - import: (data)/crawlers/kagibot.yaml

     

       9
       -
         - import: CUSTOM/challenge/generic-browser.yaml

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       10
        
       dnsbl: false

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
        
       bots:

     

       2
       +
         - import: CUSTOM/policies/meta/base.yaml

     

       0
        
       
     

       3
        
         - import: (data)/clients/git.yaml

     

       0
        
       
     

       4
        
         - import: (data)/apps/gitea-rss-feeds.yaml

     

       5
       +
       

     

       6
       +
         # Allow forgejo runner connections from localhost and tailscale

     

       7
       +
         - name: forgejo-runner

     

       8
       +
           user_agent_regex: connect-go

     

       9
       +
           action: ALLOW

     

       10
       +
       

     

       11
        
       dnsbl: false

     

       12
       +
       openGraph:

     

       13
       +
         enabled: true

     

       14
       +
         considerHost: false

     

       15
       +
         ttl: 24h

     

       16
       +
       status_codes:

     

       17
       +
         CHALLENGE: 200

     

       18
       +
         DENY: 200

     

       19
       +
       thresholds:

     

       20
       +
         - name: minimal-suspicion

     

       21
       +
           expression: weight <= 0

     

       22
       +
           action: ALLOW

     

       23
       +
         - name: mild-suspicion

     

       24
       +
           expression:

     

       25
       +
             all:

     

       26
       +
               - weight > 0

     

       27
       +
               - weight < 10

     

       28
       +
           action: CHALLENGE

     

       29
       +
           challenge:

     

       30
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh

     

       31
       +
             algorithm: metarefresh

     

       32
       +
             difficulty: 1

     

       33
       +
             report_as: 1

     

       34
       +
         - name: moderate-suspicion

     

       35
       +
           expression:

     

       36
       +
             all:

     

       37
       +
               - weight >= 10

     

       38
       +
               - weight < 20

     

       39
       +
           action: CHALLENGE

     

       40
       +
           challenge:

     

       41
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       42
       +
             algorithm: fast

     

       43
       +
             difficulty: 2 # two leading zeros, very fast for most clients

     

       44
       +
             report_as: 2

     

       45
       +
         - name: mild-proof-of-work

     

       46
       +
           expression:

     

       47
       +
             all:

     

       48
       +
               - weight >= 20

     

       49
       +
               - weight < 30

     

       50
       +
           action: CHALLENGE

     

       51
       +
           challenge:

     

       52
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       53
       +
             algorithm: fast

     

       54
       +
             difficulty: 4

     

       55
       +
             report_as: 4

     

       56
       +
         # For clients that are browser like and have gained many points from custom rules

     

       57
       +
         - name: extreme-suspicion

     

       58
       +
           expression: weight >= 30

     

       59
       +
           action: CHALLENGE

     

       60
       +
           challenge:

     

       61
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       62
       +
             algorithm: fast

     

       63
       +
             difficulty: 6

     

       64
       +
             report_as: 5

-6

packages/anubis-files/src/policies/grafana.yaml

···

       1
       -
       bots:

     

       2
       -
         - import: (data)/bots/ai-robots-txt.yaml

     

       3
       -
         - import: CUSTOM/block/alibaba-cloud.yaml

     

       4
       -
         - import: (data)/common/keep-internet-working.yaml

     

       5
       -
         - import: CUSTOM/challenge/generic-browser.yaml

     

       6
       -
       dnsbl: false

+54

packages/anubis-files/src/policies/meta/base.yaml

···

       1
       +
       # keep-sorted start

     

       2
       +
       - import: (data)/bots/_deny-pathological.yaml

     

       3
       +
       - import: (data)/bots/aggressive-brazilian-scrapers.yaml

     

       4
       +
       - import: (data)/clients/x-firefox-ai.yaml

     

       5
       +
       - import: (data)/common/keep-internet-working.yaml

     

       6
       +
       - import: (data)/common/rfc-violations.yaml

     

       7
       +
       - import: (data)/crawlers/_allow-good.yaml

     

       8
       +
       - import: (data)/meta/ai-block-aggressive.yaml

     

       9
       +
       # keep-sorted end

     

       10
       +
       - name: realistic-browser-catchall

     

       11
       +
         expression:

     

       12
       +
           all:

     

       13
       +
             - '"User-Agent" in headers'

     

       14
       +
             - '( userAgent.contains("Firefox") ) || ( userAgent.contains("Chrome") ) || ( userAgent.contains("Safari") )'

     

       15
       +
             - '"Accept" in headers'

     

       16
       +
             - '"Sec-Fetch-Dest" in headers'

     

       17
       +
             - '"Sec-Fetch-Mode" in headers'

     

       18
       +
             - '"Sec-Fetch-Site" in headers'

     

       19
       +
             - '"Accept-Encoding" in headers'

     

       20
       +
             - '( headers["Accept-Encoding"].contains("zstd") || headers["Accept-Encoding"].contains("br") )'

     

       21
       +
             - '"Accept-Language" in headers'

     

       22
       +
         action: WEIGH

     

       23
       +
         weight:

     

       24
       +
           adjust: -10

     

       25
       +
           # The Upgrade-Insecure-Requests header is typically sent by browsers, but not always

     

       26
       +
       - name: upgrade-insecure-requests

     

       27
       +
         expression: '"Upgrade-Insecure-Requests" in headers'

     

       28
       +
         action: WEIGH

     

       29
       +
         weight:

     

       30
       +
           adjust: -2

     

       31
       +
       # Chrome should behave like Chrome

     

       32
       +
       - name: chrome-is-proper

     

       33
       +
         expression:

     

       34
       +
           all:

     

       35
       +
             - userAgent.contains("Chrome")

     

       36
       +
             - '"Sec-Ch-Ua" in headers'

     

       37
       +
             - 'headers["Sec-Ch-Ua"].contains("Chromium")'

     

       38
       +
             - '"Sec-Ch-Ua-Mobile" in headers'

     

       39
       +
             - '"Sec-Ch-Ua-Platform" in headers'

     

       40
       +
         action: WEIGH

     

       41
       +
         weight:

     

       42
       +
           adjust: -5

     

       43
       +
       - name: should-have-accept

     

       44
       +
         expression: '!("Accept" in headers)'

     

       45
       +
         action: WEIGH

     

       46
       +
         weight:

     

       47
       +
           adjust: 5

     

       48
       +
       # Generic catchall rule

     

       49
       +
       - name: generic-browser

     

       50
       +
         user_agent_regex: >-

     

       51
       +
           Mozilla|Opera|Chrome|Chromium

     

       52
       +
         action: WEIGH

     

       53
       +
         weight:

     

       54
       +
           adjust: 10

packages/anubis-files/src/policies/meta/openGraph.yaml

This is a binary file and will not be displayed.

-6

packages/anubis-files/src/policies/miniflux.yaml

···

       1
       -
       bots:

     

       2
       -
         - import: (data)/bots/ai-robots-txt.yaml

     

       3
       -
         - import: CUSTOM/block/alibaba-cloud.yaml

     

       4
       -
         - import: (data)/common/keep-internet-working.yaml

     

       5
       -
         - import: CUSTOM/challenge/generic-browser.yaml

     

       6
       -
       dnsbl: false

+50 -4

packages/anubis-files/src/policies/nextcloud-office.yaml

···

       1
        
       bots:

     

       2
       -
         - import: (data)/bots/ai-robots-txt.yaml

     

       3
       -
         - import: CUSTOM/block/alibaba-cloud.yaml

     

       4
        
         # Allow requests from the nextcloud server to bypass checks

     

       5
        
         - name: allow-nextcloud-server

     

       6
        
           user_agent_regex: ^Nextcloud Server / richdocuments$

     

       7
        
           action: ALLOW

     

       8
       -
         - import: (data)/common/keep-internet-working.yaml

     

       9
       -
         - import: CUSTOM/challenge/generic-browser.yaml

     

       10
        
       dnsbl: false

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
        
       bots:

     

       2
       +
         - import: CUSTOM/policies/meta/base.yaml

     

       0
        
       
     

       3
        
         # Allow requests from the nextcloud server to bypass checks

     

       4
        
         - name: allow-nextcloud-server

     

       5
        
           user_agent_regex: ^Nextcloud Server / richdocuments$

     

       6
        
           action: ALLOW

     

       0
        
       
     

       0
        
       
     

       7
        
       dnsbl: false

     

       8
       +
       status_codes:

     

       9
       +
         CHALLENGE: 200

     

       10
       +
         DENY: 200

     

       11
       +
       thresholds:

     

       12
       +
         - name: minimal-suspicion

     

       13
       +
           expression: weight <= 0

     

       14
       +
           action: ALLOW

     

       15
       +
         - name: mild-suspicion

     

       16
       +
           expression:

     

       17
       +
             all:

     

       18
       +
               - weight > 0

     

       19
       +
               - weight < 10

     

       20
       +
           action: CHALLENGE

     

       21
       +
           challenge:

     

       22
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh

     

       23
       +
             algorithm: metarefresh

     

       24
       +
             difficulty: 1

     

       25
       +
             report_as: 1

     

       26
       +
         - name: moderate-suspicion

     

       27
       +
           expression:

     

       28
       +
             all:

     

       29
       +
               - weight >= 10

     

       30
       +
               - weight < 20

     

       31
       +
           action: CHALLENGE

     

       32
       +
           challenge:

     

       33
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       34
       +
             algorithm: fast

     

       35
       +
             difficulty: 2 # two leading zeros, very fast for most clients

     

       36
       +
             report_as: 2

     

       37
       +
         - name: mild-proof-of-work

     

       38
       +
           expression:

     

       39
       +
             all:

     

       40
       +
               - weight >= 20

     

       41
       +
               - weight < 30

     

       42
       +
           action: CHALLENGE

     

       43
       +
           challenge:

     

       44
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       45
       +
             algorithm: fast

     

       46
       +
             difficulty: 4

     

       47
       +
             report_as: 4

     

       48
       +
         # For clients that are browser like and have gained many points from custom rules

     

       49
       +
         - name: extreme-suspicion

     

       50
       +
           expression: weight >= 30

     

       51
       +
           action: CHALLENGE

     

       52
       +
           challenge:

     

       53
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       54
       +
             algorithm: fast

     

       55
       +
             difficulty: 6

     

       56
       +
             report_as: 5

+54 -5

packages/anubis-files/src/policies/nextcloud.yaml

···

       1
        
       bots:

     

       2
       -
         # Block scrapers and abusive cloud providers

     

       3
       -
         - import: (data)/bots/ai-robots-txt.yaml

     

       4
       -
         - import: CUSTOM/block/alibaba-cloud.yaml

     

       5
        
         # Allow android apps that I use

     

       6
        
         - name: allow-android-apps

     

       7
        
           user_agent_regex: Nextcloud-android|DAVx5|ICSx5

     
···

       34
        
               - 'path.startsWith("/apps/theming/")'

     

       35
        
               # Public DAV endpoint

     

       36
        
               - 'path.startsWith("/public.php/dav/files/")'

     

       37
       -
         - import: (data)/common/keep-internet-working.yaml

     

       38
       -
         - import: CUSTOM/challenge/generic-browser.yaml

     

       39
        
       dnsbl: false

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
        
       bots:

     

       2
       +
         - import: CUSTOM/policies/meta/base.yaml

     

       0
        
       
     

       0
        
       
     

       3
        
         # Allow android apps that I use

     

       4
        
         - name: allow-android-apps

     

       5
        
           user_agent_regex: Nextcloud-android|DAVx5|ICSx5

     
···

       32
        
               - 'path.startsWith("/apps/theming/")'

     

       33
        
               # Public DAV endpoint

     

       34
        
               - 'path.startsWith("/public.php/dav/files/")'

     

       0
        
       
     

       0
        
       
     

       35
        
       dnsbl: false

     

       36
       +
       openGraph:

     

       37
       +
         enabled: true

     

       38
       +
         considerHost: false

     

       39
       +
         ttl: 24h

     

       40
       +
       status_codes:

     

       41
       +
         CHALLENGE: 200

     

       42
       +
         DENY: 200

     

       43
       +
       thresholds:

     

       44
       +
         - name: minimal-suspicion

     

       45
       +
           expression: weight <= 0

     

       46
       +
           action: ALLOW

     

       47
       +
         - name: mild-suspicion

     

       48
       +
           expression:

     

       49
       +
             all:

     

       50
       +
               - weight > 0

     

       51
       +
               - weight < 10

     

       52
       +
           action: CHALLENGE

     

       53
       +
           challenge:

     

       54
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh

     

       55
       +
             algorithm: metarefresh

     

       56
       +
             difficulty: 1

     

       57
       +
             report_as: 1

     

       58
       +
         - name: moderate-suspicion

     

       59
       +
           expression:

     

       60
       +
             all:

     

       61
       +
               - weight >= 10

     

       62
       +
               - weight < 20

     

       63
       +
           action: CHALLENGE

     

       64
       +
           challenge:

     

       65
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       66
       +
             algorithm: fast

     

       67
       +
             difficulty: 2 # two leading zeros, very fast for most clients

     

       68
       +
             report_as: 2

     

       69
       +
         - name: mild-proof-of-work

     

       70
       +
           expression:

     

       71
       +
             all:

     

       72
       +
               - weight >= 20

     

       73
       +
               - weight < 30

     

       74
       +
           action: CHALLENGE

     

       75
       +
           challenge:

     

       76
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       77
       +
             algorithm: fast

     

       78
       +
             difficulty: 4

     

       79
       +
             report_as: 4

     

       80
       +
         # For clients that are browser like and have gained many points from custom rules

     

       81
       +
         - name: extreme-suspicion

     

       82
       +
           expression: weight >= 30

     

       83
       +
           action: CHALLENGE

     

       84
       +
           challenge:

     

       85
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       86
       +
             algorithm: fast

     

       87
       +
             difficulty: 6

     

       88
       +
             report_as: 5

-6

packages/anubis-files/src/policies/pingvin-share.yaml

···

       1
       -
       bots:

     

       2
       -
         - import: (data)/bots/ai-robots-txt.yaml

     

       3
       -
         - import: CUSTOM/block/alibaba-cloud.yaml

     

       4
       -
         - import: (data)/common/keep-internet-working.yaml

     

       5
       -
         - import: CUSTOM/challenge/generic-browser.yaml

     

       6
       -
       dnsbl: false

-6

packages/anubis-files/src/policies/planka.yaml

···

       1
       -
       bots:

     

       2
       -
         - import: (data)/bots/ai-robots-txt.yaml

     

       3
       -
         - import: CUSTOM/block/alibaba-cloud.yaml

     

       4
       -
         - import: (data)/common/keep-internet-working.yaml

     

       5
       -
         - import: CUSTOM/challenge/generic-browser.yaml

     

       6
       -
       dnsbl: false

-6

packages/anubis-files/src/policies/pocket-id.yaml

···

       1
       -
       bots:

     

       2
       -
         - import: (data)/bots/ai-robots-txt.yaml

     

       3
       -
         - import: CUSTOM/block/alibaba-cloud.yaml

     

       4
       -
         - import: (data)/common/keep-internet-working.yaml

     

       5
       -
         - import: CUSTOM/challenge/generic-browser.yaml

     

       6
       -
       dnsbl: false

+54 -4

packages/anubis-files/src/policies/vaultwarden.yaml

···

       1
        
       bots:

     

       2
       -
         - import: (data)/bots/ai-robots-txt.yaml

     

       3
       -
         - import: CUSTOM/block/alibaba-cloud.yaml

     

       4
        
         # Allow bitwarden apps

     

       5
        
         - name: allow-bitwarden-mobile

     

       6
        
           user_agent_regex: Bitwarden_Mobile

     
···

       8
        
         - name: allow-bitwarden-webext

     

       9
        
           user_agent_regex: Mozilla

     

       10
        
           action: ALLOW

     

       11
       -
         - import: (data)/common/keep-internet-working.yaml

     

       12
       -
         - import: CUSTOM/challenge/generic-browser.yaml

     

       13
        
       dnsbl: false

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
        
       bots:

     

       2
       +
         - import: CUSTOM/policies/meta/base.yaml

     

       0
        
       
     

       3
        
         # Allow bitwarden apps

     

       4
        
         - name: allow-bitwarden-mobile

     

       5
        
           user_agent_regex: Bitwarden_Mobile

     
···

       7
        
         - name: allow-bitwarden-webext

     

       8
        
           user_agent_regex: Mozilla

     

       9
        
           action: ALLOW

     

       0
        
       
     

       0
        
       
     

       10
        
       dnsbl: false

     

       11
       +
       openGraph:

     

       12
       +
         enabled: true

     

       13
       +
         considerHost: false

     

       14
       +
         ttl: 24h

     

       15
       +
       status_codes:

     

       16
       +
         CHALLENGE: 200

     

       17
       +
         DENY: 200

     

       18
       +
       thresholds:

     

       19
       +
         - name: minimal-suspicion

     

       20
       +
           expression: weight <= 0

     

       21
       +
           action: ALLOW

     

       22
       +
         - name: mild-suspicion

     

       23
       +
           expression:

     

       24
       +
             all:

     

       25
       +
               - weight > 0

     

       26
       +
               - weight < 10

     

       27
       +
           action: CHALLENGE

     

       28
       +
           challenge:

     

       29
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/metarefresh

     

       30
       +
             algorithm: metarefresh

     

       31
       +
             difficulty: 1

     

       32
       +
             report_as: 1

     

       33
       +
         - name: moderate-suspicion

     

       34
       +
           expression:

     

       35
       +
             all:

     

       36
       +
               - weight >= 10

     

       37
       +
               - weight < 20

     

       38
       +
           action: CHALLENGE

     

       39
       +
           challenge:

     

       40
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       41
       +
             algorithm: fast

     

       42
       +
             difficulty: 2 # two leading zeros, very fast for most clients

     

       43
       +
             report_as: 2

     

       44
       +
         - name: mild-proof-of-work

     

       45
       +
           expression:

     

       46
       +
             all:

     

       47
       +
               - weight >= 20

     

       48
       +
               - weight < 30

     

       49
       +
           action: CHALLENGE

     

       50
       +
           challenge:

     

       51
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       52
       +
             algorithm: fast

     

       53
       +
             difficulty: 4

     

       54
       +
             report_as: 4

     

       55
       +
         # For clients that are browser like and have gained many points from custom rules

     

       56
       +
         - name: extreme-suspicion

     

       57
       +
           expression: weight >= 30

     

       58
       +
           action: CHALLENGE

     

       59
       +
           challenge:

     

       60
       +
             # https://anubis.techaro.lol/docs/admin/configuration/challenges/proof-of-work

     

       61
       +
             algorithm: fast

     

       62
       +
             difficulty: 6

     

       63
       +
             report_as: 5

-3

packages/anubis-files/src/rules/block/alibaba-cloud.yaml

···

       1
       -
       - name: alibaba-cloud

     

       2
       -
         action: DENY

     

       3
       -
         remote_addresses: ["45.196.28.0/24", "161.117.128.0/17", "8.209.42.0/23", "47.89.125.0/24", "8.222.48.0/20", "47.79.16.0/21", "149.129.16.0/23", "8.212.0.0/17", "47.89.0.0/19", "47.240.128.0/17", "8.213.176.0/20", "47.77.8.0/22", "47.79.96.0/19", "47.246.198.0/23", "47.91.128.0/17", "47.89.104.0/21", "47.89.102.0/24", "8.222.96.0/19", "170.33.31.0/24", "8.215.168.0/24", "8.222.40.0/21", "47.235.1.0/24", "240b:400f::/32", "170.33.32.0/24", "8.208.0.0/18", "47.79.24.0/21", "47.91.16.0/20", "47.252.0.0/17", "8.213.176.0/21", "8.212.0.0/18", "8.211.192.0/18", "47.79.54.0/23", "47.235.18.0/24", "47.88.0.0/17", "43.96.21.0/24", "47.235.22.0/24", "240b:4001::/33", "47.79.64.0/20", "139.95.4.0/23", "47.254.128.0/19", "47.81.64.0/18", "47.77.128.0/18", "240b:4009::/33", "47.246.90.0/23", "47.89.32.0/19", "205.204.125.0/24", "47.79.56.0/23", "240b:400c:100::/41", "47.235.26.0/23", "8.209.64.0/19", "8.222.16.0/20", "47.235.12.0/23", "116.251.64.0/18", "139.95.64.0/24", "47.235.31.0/24", "8.208.32.0/19", "240b:400c:f00::/48", "47.235.6.0/24", "47.246.160.0/21", "47.246.196.0/22", "2404:2280:3000::/37", "47.74.0.0/21", "240b:4007:8000::/33", "47.91.0.0/20", "2400:3200:baba::/48", "198.11.137.0/24", "47.84.168.0/21", "240b:4006:1020::/44", "149.129.192.0/18", "8.219.40.0/21", "43.96.3.0/24", "240b:4004::/32", "47.77.64.0/20", "47.83.48.0/21", "47.77.104.0/21", "240b:4001:8000::/33", "43.96.5.0/24", "240b:400c:180::/41", "43.96.25.0/24", "47.77.96.0/21", "8.211.160.0/19", "47.245.32.0/19", "8.215.0.0/16", "47.79.32.0/20", "8.213.160.0/21", "47.74.0.0/19", "43.96.4.0/24", "170.33.75.0/24", "8.211.128.0/18", "8.217.0.0/16", "47.81.0.0/19", "47.82.96.0/19", "47.83.56.0/21", "203.107.64.0/24", "240b:4006:1020::/45", "240b:4004::/33", "47.242.0.0/15", "47.80.128.0/17", "8.215.0.0/17", "240b:4000::/32", "47.246.192.0/23", "47.246.176.0/21", "8.212.224.0/19", "47.90.0.0/17", "170.33.107.0/24", "47.237.32.0/20", "47.240.0.0/16", "47.253.0.0/16", "161.117.0.0/16", "47.77.12.0/22", "47.88.128.0/17", "8.220.147.0/24", "47.236.0.0/16", "149.129.192.0/19", "170.33.73.0/24", "47.87.160.0/19", "47.79.0.0/20", "47.246.153.0/24", "47.235.29.0/24", "47.81.128.0/18", "43.96.35.0/24", "8.212.128.0/18", "8.219.0.0/16", "47.246.155.0/24", "8.216.64.0/18", "8.213.253.0/24", "8.220.116.0/24", "8.222.128.0/18", "240b:400e:8000::/33", "43.96.33.0/24", "47.77.192.0/18", "47.81.32.0/19", "47.77.8.0/21", "47.79.16.0/20", "240b:400f:8000::/33", "47.246.145.0/24", "47.88.128.0/18", "170.33.104.0/24", "8.219.0.0/17", "47.82.0.0/18", "139.95.10.0/23", "47.238.0.0/16", "240b:4006:1002::/47", "8.221.188.0/22", "8.213.251.0/24", "47.254.192.0/19", "47.79.32.0/21", "8.212.128.0/19", "47.246.83.0/24", "47.87.64.0/19", "8.222.192.0/18", "170.33.68.0/24", "240b:400c:f01::/48", "170.33.136.0/24", "2400:b200:4101::/48", "2401:8680:4100::/48", "240b:400c::/32", "47.89.92.0/22", "8.223.128.0/18", "47.89.124.0/23", "47.74.32.0/19", "47.244.0.0/17", "43.96.80.0/24", "8.211.104.0/21", "8.213.224.0/19", "47.86.0.0/17", "8.222.64.0/21", "240b:400e::/33", "161.117.143.0/24", "47.246.152.0/23", "47.246.93.0/24", "240b:4006:1010::/45", "47.254.224.0/19", "8.209.40.0/22", "149.129.64.0/18", "43.96.20.0/24", "240b:4000:8000::/33", "47.251.0.0/16", "240b:4002::/32", "8.222.16.0/21", "203.107.66.0/24", "8.222.24.0/21", "47.89.128.0/19", "240b:400c:8000::/33", "8.218.128.0/17", "8.216.128.0/17", "47.91.128.0/18", "8.221.64.0/18", "2404:2280:4000::/36", "8.211.80.0/21", "8.217.128.0/17", "8.220.229.0/24", "170.33.66.0/24", "47.237.0.0/16", "47.235.28.0/23", "170.33.74.0/24", "47.90.64.0/18", "47.246.82.0/23", "8.209.38.0/23", "240b:4005:8000::/33", "8.220.128.0/18", "139.95.14.0/23", "8.216.192.0/18", "8.218.0.0/16", "47.91.192.0/18", "8.221.48.0/21", "149.129.8.0/21", "43.91.0.0/16", "8.223.64.0/18", "8.216.148.0/24", "8.222.80.0/21", "2401:b180:4100::/48", "47.91.0.0/19", "47.246.154.0/24", "47.246.152.0/24", "47.250.64.0/18", "8.216.128.0/18", "170.33.72.0/24", "139.95.12.0/23", "240b:400c::/40", "8.221.128.0/18", "43.96.32.0/24", "47.90.128.0/17", "47.251.0.0/17", "43.96.34.0/24", "47.245.0.0/18", "47.85.112.0/23", "8.209.56.0/21", "8.213.252.0/24", "47.77.128.0/17", "139.95.2.0/23", "43.96.69.0/24", "161.117.126.0/24", "47.75.0.0/16", "47.89.82.0/23", "47.89.224.0/19", "8.209.0.0/20", "47.246.128.0/22", "8.221.0.0/21", "139.95.8.0/23", "47.253.128.0/17", "156.236.12.0/24", "203.107.65.0/24", "47.241.128.0/17", "8.222.88.0/21", "47.87.128.0/18", "47.254.128.0/18", "8.221.192.0/18", "240b:4001::/32", "47.235.16.0/24", "240b:4007::/32", "47.235.13.0/24", "47.235.24.0/23", "47.91.80.0/20", "43.96.11.0/24", "47.235.5.0/24", "8.209.160.0/19", "47.246.88.0/23", "47.77.4.0/22", "156.236.17.0/24", "8.209.224.0/19", "14.1.115.0/24", "149.129.96.0/19", "47.254.192.0/18", "47.245.192.0/18", "8.208.0.0/16", "47.83.0.0/16", "47.87.96.0/19", "47.252.64.0/18", "47.89.192.0/18", "47.89.122.0/24", "47.85.114.0/23", "2404:2280:1000::/36", "47.81.128.0/17", "47.246.147.0/24", "47.87.64.0/18", "47.235.9.0/24", "47.52.0.0/17", "47.246.156.0/22", "47.246.96.0/22", "47.74.0.0/18", "8.214.0.0/17", "47.246.192.0/22", "47.246.150.0/24", "43.91.0.0/17", "170.33.138.0/24", "8.213.0.0/18", "47.90.192.0/18", "47.85.0.0/16", "47.235.24.0/22", "47.235.16.0/23", "47.85.128.0/17", "103.81.186.0/23", "8.221.0.0/18", "43.96.7.0/24", "47.79.56.0/21", "240b:4013::/32", "47.89.108.0/22", "47.235.28.0/24", "47.246.82.0/24", "47.91.48.0/20", "185.78.106.0/23", "47.84.160.0/21", "140.205.1.0/24", "47.88.43.0/24", "47.83.32.0/21", "47.91.64.0/19", "43.96.100.0/24", "43.96.72.0/24", "47.87.0.0/18", "8.210.0.0/16", "47.88.192.0/18", "47.88.42.0/24", "170.33.92.0/24", "149.129.32.0/19", "47.52.128.0/17", "47.246.108.0/22", "8.221.56.0/21", "47.253.0.0/17", "110.76.23.0/24", "170.33.65.0/24", "240b:4006::/48", "47.245.0.0/19", "47.77.64.0/19", "8.209.39.0/24", "47.77.96.0/20", "47.80.128.0/18", "170.33.83.0/24", "47.77.32.0/19", "8.212.64.0/18", "43.96.40.0/24", "2400:b200:4102::/48", "43.96.81.0/24", "8.214.0.0/16", "161.117.128.0/24", "43.96.75.0/24", "8.215.160.0/24", "47.77.0.0/22", "47.239.0.0/16", "47.89.76.0/22", "47.82.14.0/23", "43.91.128.0/17", "47.89.88.0/22", "47.79.8.0/21", "240b:4004:8000::/33", "47.246.140.0/22", "43.96.74.0/24", "161.117.127.0/24", "8.212.192.0/19", "240b:4006:1000::/44", "47.80.192.0/18", "47.79.48.0/21", "47.254.64.0/18", "47.246.144.0/23", "47.246.92.0/24", "47.246.66.0/24", "47.246.150.0/23", "47.91.96.0/20", "47.89.98.0/23", "47.77.80.0/20", "8.210.240.0/24", "8.213.0.0/17", "47.250.99.0/24", "47.88.41.0/24", "47.80.32.0/19", "47.250.0.0/17", "43.96.8.0/24", "14.1.112.0/22", "240b:4006:1008::/45", "8.211.224.0/19", "47.84.144.0/21", "47.88.109.0/24", "2400:3200::/48", "47.56.0.0/16", "8.220.192.0/18", "8.223.0.0/17", "8.222.72.0/21", "47.246.69.0/24", "240b:4002:8000::/33", "43.96.66.0/24", "47.246.92.0/23", "47.246.136.0/22", "205.204.117.0/24", "8.222.80.0/20", "47.85.112.0/22", "47.79.128.0/19", "240b:400d:8000::/33", "170.33.64.0/24", "8.222.56.0/21", "240b:400d::/33", "8.222.64.0/20", "47.75.128.0/17", "8.209.48.0/21", "47.57.0.0/16", "139.95.0.0/23", "47.79.192.0/18", "170.33.30.0/24", "47.77.152.0/21", "8.212.192.0/18", "8.213.128.0/19", "47.77.6.0/23", "47.246.32.0/22", "140.205.122.0/24", "47.244.0.0/16", "47.246.158.0/23", "8.209.192.0/19", "170.33.77.0/24", "8.216.69.0/24", "8.213.192.0/19", "47.77.16.0/22", "47.235.10.0/24", "202.144.199.0/24", "47.254.0.0/17", "43.98.128.0/17", "240b:400c::/41", "47.250.128.0/17", "47.89.101.0/24", "47.90.128.0/18", "240b:4013:8000::/33", "8.209.44.0/23", "240b:400c:80::/41", "161.117.129.0/24", "47.91.64.0/20", "8.209.36.0/24", "8.221.8.0/21", "47.82.32.0/19", "47.77.4.0/23", "47.79.72.0/21", "8.212.160.0/19", "170.33.80.0/24", "47.246.156.0/23", "8.220.192.0/19", "47.246.68.0/24", "47.254.160.0/19", "47.82.56.0/21", "8.223.128.0/17", "47.74.128.0/18", "47.77.24.0/23", "170.33.93.0/24", "47.89.72.0/23", "47.84.152.0/21", "240b:400e::/32", "149.129.224.0/19", "2400:b200:4103::/48", "47.87.32.0/19", "47.86.0.0/16", "47.235.4.0/24", "139.95.6.0/23", "47.252.67.0/24", "47.246.123.0/24", "47.81.96.0/19", "43.96.10.0/24", "8.223.0.0/18", "240b:4005::/32", "47.246.130.0/23", "47.91.96.0/19", "240b:400b::/33", "47.246.132.0/23", "8.213.184.0/21", "47.246.124.0/24", "8.209.64.0/18", "2404:2280:3000::/36", "47.89.78.0/23", "47.250.128.0/18", "47.79.128.0/20", "240b:4011::/33", "47.244.128.0/17", "47.246.151.0/24", "8.211.226.0/24", "47.88.135.0/24", "47.80.0.0/18", "43.96.88.0/24", "47.235.6.0/23", "205.204.111.0/24", "240b:4006:1000::/45", "47.250.0.0/18", "47.89.76.0/23", "47.89.99.0/24", "8.211.0.0/17", "47.89.123.0/24", "8.209.128.0/19", "47.246.160.0/20", "43.99.0.0/16", "47.236.0.0/15", "240b:400e:fffe::/48", "47.80.96.0/19", "47.246.184.0/21", "47.235.8.0/24", "8.222.48.0/21", "47.89.94.0/23", "47.245.64.0/18", "47.77.128.0/21", "47.74.192.0/18", "2404:2280:4000::/37", "8.211.88.0/21", "8.213.192.0/18", "8.223.192.0/18", "240b:4002::/33", "149.129.64.0/19", "47.241.0.0/16", "240b:4006:1018::/45", "8.216.0.0/17", "149.129.0.0/21", "47.254.0.0/18", "8.220.64.0/18", "43.96.22.0/24", "170.33.33.0/24", "47.91.32.0/19", "47.246.76.0/22", "47.246.68.0/23", "47.246.146.0/23", "47.254.113.0/24", "47.89.128.0/18", "47.77.144.0/21", "47.89.104.0/22", "8.211.96.0/21", "47.80.0.0/19", "47.246.104.0/22", "47.80.64.0/18", "161.117.0.0/17", "170.33.88.0/24", "47.77.2.0/23", "47.241.0.0/17", "47.79.224.0/19", "170.33.105.0/24", "47.82.12.0/23", "47.246.146.0/24", "8.213.144.0/20", "43.99.0.0/17", "47.89.88.0/23", "8.220.64.0/19", "47.89.90.0/23", "47.235.19.0/24", "8.215.128.0/17", "47.235.21.0/24", "47.81.192.0/18", "8.211.0.0/18", "47.246.72.0/22", "8.211.64.0/18", "203.107.68.0/24", "59.82.136.0/23", "8.209.44.0/22", "8.209.36.0/23", "47.89.0.0/18", "8.216.0.0/18", "47.246.104.0/21", "240b:400b::/32", "47.246.72.0/21", "8.214.128.0/17", "8.209.48.0/20", "170.33.86.0/24", "110.76.21.0/24", "8.209.128.0/18", "8.222.96.0/20", "47.89.100.0/24", "47.89.192.0/19", "8.213.128.0/20", "2400:b200:4100::/48", "8.208.0.0/17", "170.33.90.0/24", "47.83.0.0/17", "240b:400c:100::/40", "170.33.82.0/24", "8.222.32.0/21", "47.246.86.0/23", "47.52.0.0/16", "47.79.192.0/19", "2404:2280:1800::/37", "8.222.112.0/20", "170.33.24.0/24", "47.89.92.0/23", "47.78.0.0/17", "47.84.0.0/16", "240b:400b:8000::/33", "8.209.38.0/24", "47.235.7.0/24", "47.235.23.0/24", "47.237.34.0/24", "47.79.144.0/20", "43.96.71.0/24", "5.181.224.0/23", "47.246.88.0/22", "47.246.96.0/21", "47.82.0.0/19", "8.209.40.0/23", "47.77.48.0/20", "8.209.16.0/20", "240b:4009::/32", "47.246.176.0/20", "47.250.192.0/18", "47.246.168.0/21", "47.89.160.0/19", "8.222.32.0/20", "223.5.5.0/24", "47.81.0.0/18", "47.89.96.0/24", "47.77.0.0/23", "43.96.24.0/24", "8.221.128.0/17", "47.246.144.0/24", "47.246.125.0/24", "240b:400e:ffff::/48", "47.84.0.0/17", "170.33.106.0/24", "156.227.20.0/24", "170.33.35.0/24", "240b:4006:1028::/45", "170.33.78.0/24", "198.11.128.0/18", "8.210.0.0/17", "47.83.40.0/21", "47.89.80.0/23", "43.98.0.0/16", "47.88.0.0/18", "47.89.74.0/23", "43.96.67.0/24", "47.79.48.0/20", "2404:2280:3800::/37", "47.235.11.0/24", "8.220.160.0/19", "43.96.84.0/24", "8.221.208.0/21", "139.95.18.0/23", "47.246.84.0/22", "47.77.16.0/21", "170.33.69.0/24", "47.78.128.0/17", "8.220.96.0/19", "8.209.0.0/19", "240b:400d::/32", "205.204.102.0/23", "47.87.128.0/19", "47.83.128.0/17", "8.218.0.0/17", "47.235.10.0/23", "8.208.128.0/17", "170.33.137.0/24", "8.209.37.0/24", "8.220.128.0/19", "47.79.112.0/20", "47.243.0.0/16", "47.246.196.0/23", "170.33.79.0/24", "47.252.0.0/18", "47.87.0.0/19", "2404:2280:2000::/36", "47.79.58.0/23", "170.33.34.0/24", "47.246.132.0/22", "240b:4012::/48", "47.91.112.0/20", "47.77.32.0/20", "240b:4005::/33", "8.222.8.0/21", "47.246.194.0/23", "2404:2280:1000::/37", "8.221.200.0/21", "43.96.23.0/24", "47.82.64.0/18", "147.139.128.0/17", "8.211.192.0/19", "47.251.128.0/17", "240b:4011::/32", "8.222.0.0/20", "47.235.12.0/24", "43.99.128.0/17", "47.246.80.0/24", "47.246.67.0/24", "47.246.122.0/24", "156.245.1.0/24", "8.210.128.0/17", "8.213.64.0/18", "45.199.179.0/24", "47.235.0.0/22", "47.246.136.0/21", "8.213.164.0/22", "8.209.192.0/18", "47.77.24.0/22", "47.82.64.0/19", "47.244.73.0/24", "47.89.72.0/22", "47.76.128.0/17", "47.76.0.0/16", "47.245.128.0/17", "47.75.0.0/17", "47.245.96.0/19", "47.235.20.0/24", "47.79.52.0/23", "47.79.80.0/20", "47.82.32.0/21", "47.251.224.0/22", "47.74.128.0/17", "223.6.6.0/24", "47.246.128.0/23", "147.139.128.0/18", "47.246.84.0/23", "240b:4007::/33", "170.33.85.0/24", "43.96.102.0/24", "43.98.0.0/17", "203.107.67.0/24", "8.222.0.0/21", "2404:2280:2800::/37", "43.96.101.0/24", "170.33.84.0/24", "8.219.128.0/17", "47.80.64.0/19", "43.96.85.0/24", "43.96.96.0/24", "43.96.73.0/24", "47.246.100.0/22", "47.79.60.0/23", "47.77.26.0/23", "8.222.128.0/17", "161.117.138.0/24", "47.235.18.0/23", "47.235.0.0/23", "240b:4006:1010::/44", "47.76.0.0/17", "8.221.216.0/21", "47.82.8.0/23", "2404:2280:4800::/37", "170.33.29.0/24", "47.245.128.0/18", "47.79.80.0/21", "47.89.221.0/24", "198.11.184.0/21", "240b:4009:8000::/33", "8.215.162.0/23", "8.211.128.0/19", "47.79.83.0/24", "2408:4009:500::/48", "47.81.64.0/19", "8.208.0.0/19", "47.240.0.0/17", "47.79.64.0/21", "47.90.0.0/18", "43.96.70.0/24", "149.129.0.0/20", "240b:400c::/33", "2408:4000:1000::/48", "170.33.76.0/24", "205.204.96.0/19", "47.88.64.0/18", "8.209.96.0/19", "47.79.104.0/21", "47.82.10.0/23", "47.79.88.0/21", "47.245.64.0/19", "139.95.16.0/23", "47.77.20.0/22", "240b:400f::/33", "47.235.2.0/23", "8.221.0.0/17", "8.213.160.0/22", "8.215.169.0/24", "170.33.81.0/24", "47.89.124.0/24", "47.235.30.0/24", "47.79.62.0/23", "43.96.68.0/24", "47.246.120.0/24", "8.221.192.0/21", "8.221.184.0/22", "47.77.136.0/21", "8.220.224.0/19", "156.240.76.0/23", "8.208.141.0/24", "2404:2280:2000::/37", "47.84.128.0/17", "47.85.0.0/17", "8.217.0.0/17", "47.89.84.0/24", "47.238.0.0/15", "47.86.128.0/17", "240b:4011:8000::/33", "240b:4006:1000::/47", "47.246.134.0/23", "47.79.96.0/20", "47.79.0.0/21", "47.89.103.0/24", "47.89.97.0/24", "240b:4000::/33", "47.242.0.0/16", "47.56.0.0/15", "47.91.32.0/20", "147.139.192.0/18", "240b:4013::/33", "47.79.40.0/21", "8.209.46.0/23", "47.82.48.0/21", "47.82.40.0/21", "47.87.192.0/22", "47.87.192.0/23", "47.87.194.0/23", "47.87.196.0/22", "47.87.196.0/23", "47.87.198.0/23", "240b:400c:ffff::/48", "47.87.208.0/23", "47.87.210.0/23", "47.87.208.0/22", "47.87.222.0/23", "47.87.216.0/23", "47.87.200.0/23", "47.87.220.0/23", "47.87.216.0/22", "47.87.224.0/22", "47.87.204.0/22", "47.87.212.0/23", "47.87.226.0/23", "47.87.200.0/22", "47.87.206.0/23", "43.100.0.0/16", "47.87.212.0/22", "47.87.218.0/23", "47.87.214.0/23", "43.100.0.0/15", "47.87.204.0/23", "47.87.220.0/22", "43.101.0.0/16", "47.87.224.0/23", "47.87.202.0/23"]

-4

packages/anubis-files/src/rules/challenge/generic-browser.yaml

···

       1
       -
       - name: generic-browser

     

       2
       -
         user_agent_regex: >-

     

       3
       -
           Mozilla|Opera

     

       4
       -
         action: CHALLENGE

+26

packages/bgutil-pot-server/librusty_v8.nix

···

       1
       +
       # COPIED FROM nixpkgs/pkgs/by-name/router

     

       2
       +
       {

     

       3
       +
         lib,

     

       4
       +
         stdenv,

     

       5
       +
         fetchurl,

     

       6
       +
       }:

     

       7
       +
       

     

       8
       +
       let

     

       9
       +
         fetch_librusty_v8 =

     

       10
       +
           args:

     

       11
       +
           fetchurl {

     

       12
       +
             name = "librusty_v8-${args.version}";

     

       13
       +
             url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a";

     

       14
       +
             sha256 = args.shas.${stdenv.hostPlatform.system};

     

       15
       +
             meta = {

     

       16
       +
               inherit (args) version;

     

       17
       +
               sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

     

       18
       +
             };

     

       19
       +
           };

     

       20
       +
       in

     

       21
       +
       fetch_librusty_v8 {

     

       22
       +
         version = "130.0.7";

     

       23
       +
         shas = {

     

       24
       +
           x86_64-linux = "sha256-pkdsuU6bAkcIHEZUJOt5PXdzK424CEgTLXjLtQ80t10=";

     

       25
       +
         };

     

       26
       +
       }

+49

packages/bgutil-pot-server/package.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         callPackage,

     

       4
       +
         rustPlatform,

     

       5
       +
         fetchFromGitHub,

     

       6
       +
         pkg-config,

     

       7
       +
         openssl,

     

       8
       +
         _experimental-update-script-combinators,

     

       9
       +
         nix-update-script,

     

       10
       +
       }:

     

       11
       +
       rustPlatform.buildRustPackage (finalAttrs: {

     

       12
       +
         pname = "bgutil-pot-server";

     

       13
       +
         version = "0.6.0";

     

       14
       +
       

     

       15
       +
         src = fetchFromGitHub {

     

       16
       +
           owner = "jim60105";

     

       17
       +
           repo = "bgutil-ytdlp-pot-provider-rs";

     

       18
       +
           tag = "v${finalAttrs.version}";

     

       19
       +
           hash = "sha256-kEu5WqOymH8yAyMhGKtVPOq3qlTRpFU/FO71uWEX/e8=";

     

       20
       +
         };

     

       21
       +
       

     

       22
       +
         cargoHash = "sha256-fJZeyIsFUfpWeC1MWsU1hANb6cqC9xHQOnhcohEMTeM=";

     

       23
       +
       

     

       24
       +
         nativeBuildInputs = [

     

       25
       +
           pkg-config

     

       26
       +
         ];

     

       27
       +
       

     

       28
       +
         buildInputs = [

     

       29
       +
           openssl

     

       30
       +
         ];

     

       31
       +
       

     

       32
       +
         env.RUSTY_V8_ARCHIVE = callPackage ./librusty_v8.nix { };

     

       33
       +
       

     

       34
       +
         doCheck = false;

     

       35
       +
       

     

       36
       +
         passthru.updateScript = _experimental-update-script-combinators.sequence [

     

       37
       +
           (nix-update-script { })

     

       38
       +
           ./update-librusty.sh

     

       39
       +
         ];

     

       40
       +
       

     

       41
       +
         meta = {

     

       42
       +
           changelog = "https://github.com/jim60105/bgutil-ytdlp-pot-provider-rs/releases/tag/v${finalAttrs.version}";

     

       43
       +
           description = "Proof-of-origin token provider plugin for yt-dlp in Rust";

     

       44
       +
           homepage = "https://github.com/jim60105/bgutil-ytdlp-pot-provider-rs";

     

       45
       +
           license = lib.licenses.gpl3Plus;

     

       46
       +
           maintainers = with lib.maintainers; [ pyrox0 ];

     

       47
       +
           mainProgram = "bgutil-pot";

     

       48
       +
         };

     

       49
       +
       })

+45

packages/bgutil-pot-server/update-librusty.sh

···

       1
       +
       #!/usr/bin/env nix-shell

     

       2
       +
       #!nix-shell -i bash -p gnugrep gnused nix jq

     

       3
       +
       # shellcheck shell=bash

     

       4
       +
       # COPIED FROM nixpkgs/pkgs/by-name/wi/windmill

     

       5
       +
       

     

       6
       +
       set -eu -o pipefail

     

       7
       +
       

     

       8
       +
       echo "librusty_v8: UPDATING"

     

       9
       +
       

     

       10
       +
       BGUTIL_LATEST_VERSION=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location "https://api.github.com/repos/jim60105/bgutil-ytdlp-pot-provider-rs/releases/latest" | jq --raw-output .tag_name)

     

       11
       +
       CARGO_LOCK=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location "https://github.com/jim60105/bgutil-ytdlp-pot-provider-rs/raw/$BGUTIL_LATEST_VERSION/Cargo.lock")

     

       12
       +
       

     

       13
       +
       PACKAGE_DIR=$(dirname "$(readlink --canonicalize-existing "${BASH_SOURCE[0]}")")

     

       14
       +
       OUTPUT_FILE="$PACKAGE_DIR/librusty_v8.nix"

     

       15
       +
       NEW_VERSION=$(echo "$CARGO_LOCK" | grep --after-context 5 'name = "v8"' | grep 'version =' | sed -E 's/version = "//;s/"//')

     

       16
       +
       

     

       17
       +
       CURRENT_VERSION=""

     

       18
       +
       if [ -f "$OUTPUT_FILE" ]; then

     

       19
       +
         CURRENT_VERSION="$(grep 'version =' "$OUTPUT_FILE" | sed -E 's/version = "//;s/"//')"

     

       20
       +
       fi

     

       21
       +
       

     

       22
       +
       if [ "$CURRENT_VERSION" == "$NEW_VERSION" ]; then

     

       23
       +
         echo "No update needed, $CURRENT_VERSION is already latest"

     

       24
       +
         exit 0

     

       25
       +
       fi

     

       26
       +
       

     

       27
       +
       x86Hash="$(nix-prefetch-url --type sha256 https://github.com/denoland/rusty_v8/releases/download/v"$NEW_V")"

     

       28
       +
       TEMP_FILE="$OUTPUT_FILE.tmp"

     

       29
       +
       cat >"$TEMP_FILE" <<EOF

     

       30
       +
       # COPIED FROM nixpkgs/pkgs/by-name/wi/windmill

     

       31
       +
       # auto-generated file -- DO NOT EDIT!

     

       32
       +
       { fetchLibrustyV8 }:

     

       33
       +
       

     

       34
       +
       fetchLibrustyV8 {

     

       35
       +
         version = "$NEW_VERSION";

     

       36
       +
         shas = {

     

       37
       +
           # NOTE; Follows supported platforms of package (see meta.platforms attribute)!

     

       38
       +
           x86_64-linux = "$(nix hash convert --hash-algo sha256 --from nix32 "$x86Hash")";

     

       39
       +
         };

     

       40
       +
       }

     

       41
       +
       EOF

     

       42
       +
       

     

       43
       +
       mv "$TEMP_FILE" "$OUTPUT_FILE"

     

       44
       +
       

     

       45
       +
       echo "librusty_v8: UPDATE DONE"

-30

packages/default.nix

···

       1
       -
       _: {

     

       2
       -
       

     

       3
       -
         perSystem =

     

       4
       -
           {

     

       5
       -
             pkgs,

     

       6
       -
             lib,

     

       7
       -
             ...

     

       8
       -
           }:

     

       9
       -
           let

     

       10
       -
             packages = lib.makeScope pkgs.newScope (_: {

     

       11
       -
               anubis-files = pkgs.callPackage ./anubis-files { };

     

       12
       -
               doc2dash = pkgs.callPackage ./doc2dash { };

     

       13
       -
               jellyfin-exporter = pkgs.callPackage ./jellyfin-exporter { };

     

       14
       -
               pingvin-share-config = pkgs.callPackage ./pingvin-share-config { };

     

       15
       -
       

     

       16
       -
             });

     

       17
       -
           in

     

       18
       -
           {

     

       19
       -
             legacyPackages = packages;

     

       20
       -
             packages = lib.filterAttrs (

     

       21
       -
               _: pkg:

     

       22
       -
               let

     

       23
       -
                 isDerivation = lib.isDerivation pkg;

     

       24
       -
                 availableOnHost = lib.meta.availableOn pkgs.stdenv.hostPlatform pkg;

     

       25
       -
                 isBroken = pkg.meta.broken or false;

     

       26
       -
               in

     

       27
       -
               isDerivation && !isBroken && availableOnHost

     

       28
       -
             ) packages;

     

       29
       -
           };

     

       30
       -
       }

-34

packages/doc2dash/default.nix

···

       1
       -
       {

     

       2
       -
         fetchFromGitHub,

     

       3
       -
         python3Packages,

     

       4
       -
       }:

     

       5
       -
       python3Packages.buildPythonApplication rec {

     

       6
       -
         pname = "doc2dash";

     

       7
       -
         version = "3.1.0";

     

       8
       -
         pyproject = true;

     

       9
       -
       

     

       10
       -
         src = fetchFromGitHub {

     

       11
       -
           owner = "hynek";

     

       12
       -
           repo = "doc2dash";

     

       13
       -
           rev = version;

     

       14
       -
           hash = "sha256-u6K+BDc9tUxq4kCekTaqQLtNN/OLVc3rh14sVSfPtoQ=";

     

       15
       -
         };

     

       16
       -
       

     

       17
       -
         build-system = with python3Packages; [

     

       18
       -
           hatchling

     

       19
       -
           hatch-vcs

     

       20
       -
           hatch-fancy-pypi-readme

     

       21
       -
         ];

     

       22
       -
       

     

       23
       -
         dependencies = with python3Packages; [

     

       24
       -
           attrs

     

       25
       -
           beautifulsoup4

     

       26
       -
           click

     

       27
       -
           rich

     

       28
       -
         ];

     

       29
       -
       

     

       30
       -
         nativeCheckInputs = with python3Packages; [

     

       31
       -
           pytestCheckHook

     

       32
       -
           pytest-cov-stub

     

       33
       -
         ];

     

       34
       -
       }

+34

packages/doc2dash/package.nix

···

       1
       +
       {

     

       2
       +
         fetchFromGitHub,

     

       3
       +
         python3Packages,

     

       4
       +
       }:

     

       5
       +
       python3Packages.buildPythonApplication rec {

     

       6
       +
         pname = "doc2dash";

     

       7
       +
         version = "3.1.0";

     

       8
       +
         pyproject = true;

     

       9
       +
       

     

       10
       +
         src = fetchFromGitHub {

     

       11
       +
           owner = "hynek";

     

       12
       +
           repo = "doc2dash";

     

       13
       +
           rev = version;

     

       14
       +
           hash = "sha256-u6K+BDc9tUxq4kCekTaqQLtNN/OLVc3rh14sVSfPtoQ=";

     

       15
       +
         };

     

       16
       +
       

     

       17
       +
         build-system = with python3Packages; [

     

       18
       +
           hatchling

     

       19
       +
           hatch-vcs

     

       20
       +
           hatch-fancy-pypi-readme

     

       21
       +
         ];

     

       22
       +
       

     

       23
       +
         dependencies = with python3Packages; [

     

       24
       +
           attrs

     

       25
       +
           beautifulsoup4

     

       26
       +
           click

     

       27
       +
           rich

     

       28
       +
         ];

     

       29
       +
       

     

       30
       +
         nativeCheckInputs = with python3Packages; [

     

       31
       +
           pytestCheckHook

     

       32
       +
           pytest-cov-stub

     

       33
       +
         ];

     

       34
       +
       }

+147

packages/glide-browser-bin/package.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         stdenv,

     

       4
       +
         fetchurl,

     

       5
       +
         # keep-sorted start

     

       6
       +
         adwaita-icon-theme,

     

       7
       +
         alsa-lib,

     

       8
       +
         autoPatchelfHook,

     

       9
       +
         copyDesktopItems,

     

       10
       +
         curl,

     

       11
       +
         dbus-glib,

     

       12
       +
         gtk3,

     

       13
       +
         hicolor-icon-theme,

     

       14
       +
         libXtst,

     

       15
       +
         libva,

     

       16
       +
         makeBinaryWrapper,

     

       17
       +
         makeDesktopItem,

     

       18
       +
         patchelfUnstable,

     

       19
       +
         pciutils,

     

       20
       +
         pipewire,

     

       21
       +
         wrapGAppsHook3,

     

       22
       +
         # keep-sorted end

     

       23
       +
         nix-update-script,

     

       24
       +
         ...

     

       25
       +
       }:

     

       26
       +
       stdenv.mkDerivation (finalAttrs: {

     

       27
       +
         pname = "glide-browser";

     

       28
       +
         version = "0.1.55a";

     

       29
       +
       

     

       30
       +
         src = fetchurl {

     

       31
       +
           url = "https://github.com/glide-browser/glide/releases/download/${finalAttrs.version}/glide.linux-x86_64.tar.xz";

     

       32
       +
           hash = "sha256-mjk8KmB/T5ZpB9AMQw1mtb9VbMXVX2VV4N+hWpWkSYI=";

     

       33
       +
         };

     

       34
       +
       

     

       35
       +
         nativeBuildInputs = [

     

       36
       +
           # keep-sorted start

     

       37
       +
           autoPatchelfHook

     

       38
       +
           copyDesktopItems

     

       39
       +
           makeBinaryWrapper

     

       40
       +
           patchelfUnstable

     

       41
       +
           wrapGAppsHook3

     

       42
       +
           # keep-sorted end

     

       43
       +
         ];

     

       44
       +
       

     

       45
       +
         buildInputs = [

     

       46
       +
           # keep-sorted start

     

       47
       +
           adwaita-icon-theme

     

       48
       +
           alsa-lib

     

       49
       +
           dbus-glib

     

       50
       +
           gtk3

     

       51
       +
           hicolor-icon-theme

     

       52
       +
           libXtst

     

       53
       +
           # keep-sorted end

     

       54
       +
         ];

     

       55
       +
       

     

       56
       +
         runtimeDependencies = [

     

       57
       +
           # keep-sorted start

     

       58
       +
           curl

     

       59
       +
           libva.out

     

       60
       +
           pciutils

     

       61
       +
           # keep-sorted end

     

       62
       +
         ];

     

       63
       +
       

     

       64
       +
         appendRunpaths = [ "${pipewire}/lib" ];

     

       65
       +
       

     

       66
       +
         # Firefox uses "relrhack" to manually process relocations from a fixed offset

     

       67
       +
         patchelfFlags = [ "--no-clobber-old-sections" ];

     

       68
       +
       

     

       69
       +
         installPhase = ''

     

       70
       +
           runHook preInstall

     

       71
       +
       

     

       72
       +
           mkdir -p $out/bin $out/share/icons/hicolor/ $out/lib/glide-browser-bin-${finalAttrs.version}

     

       73
       +
           cp -t $out/lib/glide-browser-bin-${finalAttrs.version} -r *

     

       74
       +
           chmod +x $out/lib/glide-browser-bin-${finalAttrs.version}/glide

     

       75
       +
           iconDir=$out/share/icons/hicolor

     

       76
       +
           browserIcons=$out/lib/glide-browser-bin-${finalAttrs.version}/browser/chrome/icons/default

     

       77
       +
       

     

       78
       +
           for i in 16 32 48 64 128; do

     

       79
       +
             iconSizeDir="$iconDir/''${i}x$i/apps"

     

       80
       +
             mkdir -p $iconSizeDir

     

       81
       +
             cp $browserIcons/default$i.png $iconSizeDir/glide-browser.png

     

       82
       +
           done

     

       83
       +
       

     

       84
       +
       

     

       85
       +
           ln -s $out/lib/glide-browser-bin-${finalAttrs.version}/glide $out/bin/glide

     

       86
       +
           ln -s $out/bin/glide $out/bin/glide-browser

     

       87
       +
       

     

       88
       +
           runHook postInstall

     

       89
       +
         '';

     

       90
       +
       

     

       91
       +
         desktopItems = [

     

       92
       +
           (makeDesktopItem {

     

       93
       +
             name = "glide-browser-bin";

     

       94
       +
             exec = "glide-browser --name glide-browser %U";

     

       95
       +
             icon = "glide-browser";

     

       96
       +
             desktopName = "Glide Browser";

     

       97
       +
             genericName = "Web Browser";

     

       98
       +
             terminal = false;

     

       99
       +
             startupNotify = true;

     

       100
       +
             startupWMClass = "glide-browser";

     

       101
       +
             categories = [

     

       102
       +
               "Network"

     

       103
       +
               "WebBrowser"

     

       104
       +
             ];

     

       105
       +
             mimeTypes = [

     

       106
       +
               "text/html"

     

       107
       +
               "text/xml"

     

       108
       +
               "application/xhtml+xml"

     

       109
       +
               "application/vnd.mozilla.xul+xml"

     

       110
       +
               "x-scheme-handler/http"

     

       111
       +
               "x-scheme-handler/https"

     

       112
       +
             ];

     

       113
       +
             actions = {

     

       114
       +
               new-window = {

     

       115
       +
                 name = "New Window";

     

       116
       +
                 exec = "glide-browser --new-window %U";

     

       117
       +
               };

     

       118
       +
               new-private-window = {

     

       119
       +
                 name = "New Private Window";

     

       120
       +
                 exec = "glide-browser --private-window %U";

     

       121
       +
               };

     

       122
       +
               profile-manager-window = {

     

       123
       +
                 name = "Profile Manager";

     

       124
       +
                 exec = "glide-browser --ProfileManager";

     

       125
       +
               };

     

       126
       +
             };

     

       127
       +
           })

     

       128
       +
         ];

     

       129
       +
       

     

       130
       +
         passthru.updateScript = nix-update-script {

     

       131
       +
           extraArgs = [

     

       132
       +
             "--url"

     

       133
       +
             "https://github.com/glide-browser/glide"

     

       134
       +
           ];

     

       135
       +
         };

     

       136
       +
       

     

       137
       +
         meta = {

     

       138
       +
           changelog = "https://glide-browser.app/changelog#${finalAttrs.version}";

     

       139
       +
           description = "Extensible and keyboard-focused web browser, based on Firefox (binary package)";

     

       140
       +
           homepage = "https://glide-browser.app/";

     

       141
       +
           license = lib.licenses.mpl20;

     

       142
       +
           sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];

     

       143
       +
           platforms = [ "x86_64-linux" ];

     

       144
       +
           maintainers = with lib.maintainers; [ pyrox0 ];

     

       145
       +
           mainProgram = "glide-browser";

     

       146
       +
         };

     

       147
       +
       })

-34

packages/jellyfin-exporter/default.nix

···

       1
       -
       {

     

       2
       -
         lib,

     

       3
       -
         buildGoModule,

     

       4
       -
         fetchFromGitHub,

     

       5
       -
         ...

     

       6
       -
       }:

     

       7
       -
       buildGoModule (finalAttrs: {

     

       8
       -
         pname = "jellyfin-exporter";

     

       9
       -
         version = "1.3.8";

     

       10
       -
       

     

       11
       -
         src = fetchFromGitHub {

     

       12
       -
           owner = "rebelcore";

     

       13
       -
           repo = "jellyfin_exporter";

     

       14
       -
           tag = "v${finalAttrs.version}";

     

       15
       -
           hash = "sha256-7fIrjcy6y/Ayj43WeuPNCx3uVJyl5Wf6bWs5ta2PpWc=";

     

       16
       -
         };

     

       17
       -
       

     

       18
       -
         # We need to patch the tests since we don't move the binary to `$GOPATH/bin`, but to `$out/bin` instead.

     

       19
       -
         postPatch = ''

     

       20
       -
           substituteInPlace jellyfin_exporter_test.go \

     

       21
       -
             --replace-fail "GOPATH" "out"

     

       22
       -
         '';

     

       23
       -
       

     

       24
       -
         vendorHash = "sha256-JSOKDbefQyDLNy2y1oW7HUplQw8uhhOGZ+ueWyUYYQ0=";

     

       25
       -
       

     

       26
       -
         meta = {

     

       27
       -
           changelog = "https://github.com/rebelcore/jellyfin_exporter/blob/v${finalAttrs.version}/CHANGELOG.md";

     

       28
       -
           description = "Jellyfin Media System metrics exporter for prometheus";

     

       29
       -
           homepage = "https://github.com/rebelcore/jellyfin_exporter";

     

       30
       -
           license = lib.licenses.asl20;

     

       31
       -
           maintainers = with lib.maintainers; [ pyrox0 ];

     

       32
       -
           mainProgram = "jellyfin_exporter";

     

       33
       -
         };

     

       34
       -
       })

+34

packages/jellyfin-exporter/package.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         buildGoModule,

     

       4
       +
         fetchFromGitHub,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
       +
       buildGoModule (finalAttrs: {

     

       8
       +
         pname = "jellyfin-exporter";

     

       9
       +
         version = "1.3.9";

     

       10
       +
       

     

       11
       +
         src = fetchFromGitHub {

     

       12
       +
           owner = "rebelcore";

     

       13
       +
           repo = "jellyfin_exporter";

     

       14
       +
           tag = "v${finalAttrs.version}";

     

       15
       +
           hash = "sha256-oHPzdV+Fe7XmSyRWm5jh7oGqlY9uyLy7u9tCTlkfhQk=";

     

       16
       +
         };

     

       17
       +
       

     

       18
       +
         # We need to patch the tests since we don't move the binary to `$GOPATH/bin`, but to `$out/bin` instead.

     

       19
       +
         postPatch = ''

     

       20
       +
           substituteInPlace jellyfin_exporter_test.go \

     

       21
       +
             --replace-fail "GOPATH" "out"

     

       22
       +
         '';

     

       23
       +
       

     

       24
       +
         vendorHash = "sha256-Z3XM4vTsm5R/Me1jR9oqLcWqmEn1bd653UNvDKLM80g=";

     

       25
       +
       

     

       26
       +
         meta = {

     

       27
       +
           changelog = "https://github.com/rebelcore/jellyfin_exporter/blob/v${finalAttrs.version}/CHANGELOG.md";

     

       28
       +
           description = "Jellyfin Media System metrics exporter for prometheus";

     

       29
       +
           homepage = "https://github.com/rebelcore/jellyfin_exporter";

     

       30
       +
           license = lib.licenses.asl20;

     

       31
       +
           maintainers = with lib.maintainers; [ pyrox0 ];

     

       32
       +
           mainProgram = "jellyfin_exporter";

     

       33
       +
         };

     

       34
       +
       })

-19

packages/pingvin-share-config/default.nix

···

       1
       -
       {

     

       2
       -
         pkgs,

     

       3
       -
         stdenv,

     

       4
       -
         settings ? { },

     

       5
       -
         ...

     

       6
       -
       }:

     

       7
       -
       let

     

       8
       -
         format = pkgs.formats.yaml { };

     

       9
       -
         file = format.generate "config.yaml" settings;

     

       10
       -
       in

     

       11
       -
       stdenv.mkDerivation {

     

       12
       -
         pname = "pingvin-share-config";

     

       13
       -
         version = "1.0.0";

     

       14
       -
       

     

       15
       -
         installPhase = ''

     

       16
       -
           mkdir $out

     

       17
       -
           cp ${file} $out/config.yaml

     

       18
       -
         '';

     

       19
       -
       }

+138

packages/planka/package.nix

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         stdenv,

     

       4
       +
         fetchFromGitHub,

     

       5
       +
         fetchNpmDeps,

     

       6
       +
         nix-update-script,

     

       7
       +
         npmHooks,

     

       8
       +
         dart-sass,

     

       9
       +
         nodejs,

     

       10
       +
         python3,

     

       11
       +
       }:

     

       12
       +
       let

     

       13
       +
         version = "2.0.0-rc.4";

     

       14
       +
         src = fetchFromGitHub {

     

       15
       +
           owner = "plankanban";

     

       16
       +
           repo = "planka";

     

       17
       +
           tag = "v${version}";

     

       18
       +
           hash = "sha256-RUOIOXrpoNGxoKwUlgkPsk4kTnA95E+iwYIjBzSBoTA=";

     

       19
       +
         };

     

       20
       +
         meta = {

     

       21
       +
           description = "Kanban-style project mastering tool for everyone";

     

       22
       +
           homepage = "https://docs.planka.cloud/";

     

       23
       +
           license = {

     

       24
       +
             fullName = "Planka Community License";

     

       25
       +
             url = "https://github.com/plankanban/planka/blob/master/LICENSE.md";

     

       26
       +
             free = false;

     

       27
       +
             redistributable = true;

     

       28
       +
           };

     

       29
       +
           maintainers = with lib.maintainers; [ pyrox0 ];

     

       30
       +
         };

     

       31
       +
       

     

       32
       +
         frontend = stdenv.mkDerivation (finalAttrs: {

     

       33
       +
           pname = "planka-frontend";

     

       34
       +
           inherit version src meta;

     

       35
       +
       

     

       36
       +
           sourceRoot = "${finalAttrs.src.name}/client";

     

       37
       +
       

     

       38
       +
           npmDeps = fetchNpmDeps {

     

       39
       +
             inherit (finalAttrs) src sourceRoot;

     

       40
       +
             hash = "sha256-XtVwO8253XBVtG0jrikeVr1yaS1PpphCbN5B6jz54qc=";

     

       41
       +
           };

     

       42
       +
       

     

       43
       +
           npmFlags = [

     

       44
       +
             "--ignore-scripts"

     

       45
       +
           ];

     

       46
       +
       

     

       47
       +
           nativeBuildInputs = [

     

       48
       +
             npmHooks.npmConfigHook

     

       49
       +
             nodejs

     

       50
       +
             dart-sass

     

       51
       +
           ];

     

       52
       +
       

     

       53
       +
           buildPhase = ''

     

       54
       +
             runHook preBuild

     

       55
       +
       

     

       56
       +
             npx patch-package

     

       57
       +
       

     

       58
       +
             # Replace dart path in sass-embedded since node_modules doesn't have the native binary

     

       59
       +
             substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \

     

       60
       +
               --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'

     

       61
       +
       

     

       62
       +
             npm run build

     

       63
       +
       

     

       64
       +
             runHook postBuild

     

       65
       +
           '';

     

       66
       +
       

     

       67
       +
           installPhase = ''

     

       68
       +
             runHook preInstall

     

       69
       +
       

     

       70
       +
             mkdir $out/

     

       71
       +
             mv dist $out/dist

     

       72
       +
       

     

       73
       +
             runHook postInstall

     

       74
       +
           '';

     

       75
       +
         });

     

       76
       +
       

     

       77
       +
         serverPython = python3.withPackages (ps: [ ps.apprise ]);

     

       78
       +
       in

     

       79
       +
       stdenv.mkDerivation (finalAttrs: {

     

       80
       +
         pname = "planka";

     

       81
       +
         inherit version src;

     

       82
       +
       

     

       83
       +
         sourceRoot = "${finalAttrs.src.name}/server";

     

       84
       +
       

     

       85
       +
         npmDeps = fetchNpmDeps {

     

       86
       +
           inherit (finalAttrs) src sourceRoot;

     

       87
       +
           hash = "sha256-yW9uzPALGdPrrUV129ToXayLyeLbAK9mCl2emCPYUdc=";

     

       88
       +
         };

     

       89
       +
       

     

       90
       +
         npmFlags = [ "--ignore-scripts" ];

     

       91
       +
       

     

       92
       +
         nativeBuildInputs = [

     

       93
       +
           npmHooks.npmConfigHook

     

       94
       +
           nodejs

     

       95
       +
         ];

     

       96
       +
       

     

       97
       +
         buildInputs = [

     

       98
       +
           serverPython

     

       99
       +
           nodejs

     

       100
       +
         ];

     

       101
       +
       

     

       102
       +
         preBuild = ''

     

       103
       +
           # Patch notifs helper to use nixpkgs' python

     

       104
       +
           substituteInPlace api/helpers/utils/send-notifications.js \

     

       105
       +
             --replace-fail '(`$' '(`' \

     

       106
       +
             --replace-fail "{sails.config.appPath}/.venv/bin/python3" "${lib.getExe serverPython}"

     

       107
       +
         '';

     

       108
       +
       

     

       109
       +
         buildPhase = ''

     

       110
       +
           runHook preBuild

     

       111
       +
       

     

       112
       +
           npx patch-package

     

       113
       +
       

     

       114
       +
           runHook postBuild

     

       115
       +
         '';

     

       116
       +
       

     

       117
       +
         installPhase = ''

     

       118
       +
           runHook preInstall

     

       119
       +
       

     

       120
       +
           npm prune --omit=dev --no-save $npmFlags "$${npmFlagsArray[@]}"

     

       121
       +
           find node_modules -maxdepth 1 -type d -empty -delete

     

       122
       +
       

     

       123
       +
           mkdir -p $out/lib/node_modules/planka

     

       124
       +
           mkdir $out/bin

     

       125
       +
           mv * $out/lib/node_modules/planka

     

       126
       +
           cp -t $out/lib/node_modules/planka/public -r ${frontend}/dist/*

     

       127
       +
           cp ${frontend}/dist/index.html $out/lib/node_modules/planka/views/index.html

     

       128
       +
       

     

       129
       +
           ln -s $out/lib/node_modules/planka/start.sh $out/bin/planka

     

       130
       +
       

     

       131
       +
           runHook postInstall

     

       132
       +
         '';

     

       133
       +
       

     

       134
       +
         passthru.updateScript = nix-update-script { extraArgs = [ "--version=unstable" ]; };

     

       135
       +
         meta = meta // {

     

       136
       +
           mainProgram = "planka";

     

       137
       +
         };

     

       138
       +
       })

+26

packages.nix

···

       1
       +
       {

     

       2
       +
         perSystem =

     

       3
       +
           {

     

       4
       +
             pkgs,

     

       5
       +
             lib,

     

       6
       +
             ...

     

       7
       +
           }:

     

       8
       +
           let

     

       9
       +
             packages = lib.packagesFromDirectoryRecursive {

     

       10
       +
               inherit (pkgs) callPackage;

     

       11
       +
               directory = ./packages;

     

       12
       +
             };

     

       13
       +
           in

     

       14
       +
           {

     

       15
       +
             legacyPackages = packages;

     

       16
       +
             packages = lib.filterAttrs (

     

       17
       +
               _: pkg:

     

       18
       +
               let

     

       19
       +
                 isDerivation = lib.isDerivation pkg;

     

       20
       +
                 availableOnHost = lib.meta.availableOn pkgs.stdenv.hostPlatform pkg;

     

       21
       +
                 isBroken = pkg.meta.broken or false;

     

       22
       +
               in

     

       23
       +
               isDerivation && !isBroken && availableOnHost

     

       24
       +
             ) packages;

     

       25
       +
           };

     

       26
       +
       }

Compare changes