Compare changes

Choose any two refs to compare.

Changed files
+195 -175
global
systems
users
cassie
+1
.gitignore
···
# balls
result
+
result-*
.direnv/
*.qcow2
+79 -106
flake.lock
···
},
"crane": {
"locked": {
-
"lastModified": 1731098351,
-
"narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
+
"lastModified": 1754269165,
+
"narHash": "sha256-0tcS8FHd4QjbCVoxN9jI+PjHgA4vc/IjkUSp+N3zy0U=",
"owner": "ipetkov",
"repo": "crane",
-
"rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
+
"rev": "444e81206df3f7d92780680e45858e31d2f07a08",
"type": "github"
},
"original": {
···
"flake-compat": {
"flake": false,
"locked": {
-
"lastModified": 1747046372,
-
"narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+
"lastModified": 1761588595,
+
"narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
"owner": "edolstra",
"repo": "flake-compat",
-
"rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+
"rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
"type": "github"
},
"original": {
···
"flake-compat_2": {
"flake": false,
"locked": {
-
"lastModified": 1696426674,
-
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+
"lastModified": 1747046372,
+
"narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
"owner": "edolstra",
"repo": "flake-compat",
-
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+
"rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
"type": "github"
},
"original": {
···
]
},
"locked": {
-
"lastModified": 1730504689,
-
"narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
+
"lastModified": 1754091436,
+
"narHash": "sha256-XKqDMN1/Qj1DKivQvscI4vmHfDfvYR2pfuFOJiCeewM=",
"owner": "hercules-ci",
"repo": "flake-parts",
-
"rev": "506278e768c2a08bec68eb62932193e341f55c90",
+
"rev": "67df8c627c2c39c41dbec76a1f201929929ab0bd",
"type": "github"
},
"original": {
···
"zon2nix": "zon2nix"
},
"locked": {
-
"lastModified": 1763704826,
-
"narHash": "sha256-Q2ArFuRzdNqR8gK0g2eBfnwwPWmiIIU4TPWa+xNHtqc=",
+
"lastModified": 1765577799,
+
"narHash": "sha256-u7p0NFD83XrA5UZmtUVW7WQpdCsVYa7Flo430cVStd8=",
"owner": "ghostty-org",
"repo": "ghostty",
-
"rev": "5f3645433c0ba5910c7da1f25aaa07efc2c84b64",
+
"rev": "7a1ff7779b6b4106ecc9349efb4e1f6afdb1ba4e",
"type": "github"
},
"original": {
···
]
},
"locked": {
-
"lastModified": 1758463745,
-
"narHash": "sha256-uhzsV0Q0I9j2y/rfweWeGif5AWe0MGrgZ/3TjpDYdGA=",
+
"lastModified": 1765605144,
+
"narHash": "sha256-RM2xs+1HdHxesjOelxoA3eSvXShC8pmBvtyTke4Ango=",
"owner": "nix-community",
"repo": "home-manager",
-
"rev": "3b955f5f0a942f9f60cdc9cacb7844335d0f21c3",
+
"rev": "90b62096f099b73043a747348c11dbfcfbdea949",
"type": "github"
},
"original": {
"owner": "nix-community",
-
"ref": "release-25.05",
+
"ref": "release-25.11",
"repo": "home-manager",
"type": "github"
}
···
"inputs": {
"nix": "nix",
"nix-eval-jobs": "nix-eval-jobs",
-
"nixpkgs": "nixpkgs_4"
+
"nixpkgs": "nixpkgs_3"
},
"locked": {
-
"lastModified": 1762457028,
-
"narHash": "sha256-ifmzQS+u/dODQXmMVQLIb4AF4dkWI9s7VGYpV6x/Iq4=",
+
"lastModified": 1764105837,
+
"narHash": "sha256-odn4JAamENIUa+KfWCDi1BxM02TOmvhxyEdFLZrV+/4=",
"owner": "NixOS",
"repo": "hydra",
-
"rev": "241ab718002ca5740b7e3f659d0fbd483ab40523",
+
"rev": "34ff66a460c21ee69d840c8c896d067405ba4a3e",
"type": "github"
},
"original": {
···
"lastModified": 1731402384,
"narHash": "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=",
"type": "tarball",
-
"url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
+
"url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
},
"original": {
"type": "tarball",
-
"url": "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip"
+
"url": "https://github.com/IBM/plex/releases/download/@ibm%2Fplex-mono@1.1.0/ibm-plex-mono.zip"
}
},
"indigo": {
···
"rust-overlay": "rust-overlay"
},
"locked": {
-
"lastModified": 1737639419,
-
"narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
+
"lastModified": 1762205063,
+
"narHash": "sha256-If6vQ+KvtKs3ARBO9G3l+4wFSCYtRBrwX1z+I+B61wQ=",
"owner": "nix-community",
"repo": "lanzaboote",
-
"rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
+
"rev": "88b8a563ff5704f4e8d8e5118fb911fa2110ca05",
"type": "github"
},
"original": {
"owner": "nix-community",
-
"ref": "v0.4.2",
+
"ref": "v0.4.3",
"repo": "lanzaboote",
"type": "github"
}
···
"inputs": {
"flake-compat": "flake-compat_3",
"nix-update-soopy": "nix-update-soopy",
-
"nixpkgs": "nixpkgs_5",
+
"nixpkgs": "nixpkgs_4",
"treefmt-nix": "treefmt-nix_2"
},
"locked": {
-
"lastModified": 1763539333,
-
"narHash": "sha256-Ud3JuLJk0E88Xd99gog1g/T/rs+pd13h7+n04nfRhlg=",
+
"lastModified": 1765558006,
+
"narHash": "sha256-8o8J6YJgx7ZLZJfXlKL/upDyGuRFoTOTKeaLT4ZgUHw=",
"owner": "soopyc",
"repo": "mystia",
-
"rev": "f4e83a7be83730c7afd4dc1506df61b9c2d0ed56",
+
"rev": "5b177c1b32e2f671c1b4b92f0d71ec2a6a55fa9a",
"type": "github"
},
"original": {
···
]
},
"locked": {
-
"lastModified": 1763265660,
-
"narHash": "sha256-Ad9Rd3ZAidrH01xP73S3CjPiyXo7ywZs3uCESjPwUdc=",
+
"lastModified": 1765267181,
+
"narHash": "sha256-d3NBA9zEtBu2JFMnTBqWj7Tmi7R5OikoU2ycrdhQEws=",
"owner": "nix-community",
"repo": "nix-index-database",
-
"rev": "469ef53571ea80890c9497952787920c79c1ee6e",
+
"rev": "82befcf7dc77c909b0f2a09f5da910ec95c5b78f",
"type": "github"
},
"original": {
···
},
"nixos-hardware": {
"locked": {
-
"lastModified": 1762180855,
-
"narHash": "sha256-869wVd48SypgwNuXQQizmFTocbXmSsCir76jH1UKi8w=",
+
"lastModified": 1765610993,
+
"narHash": "sha256-pnnhKVObp3L6dWR9vsLAo7s1HliNW5x4CDyph+v7x3w=",
"owner": "soopyc",
"repo": "nixos-hardware",
-
"rev": "a8ed697c0aefcdfb3334f2f02a4858a634d69f77",
+
"rev": "c880f92af869077edeed4bd8649a2de86fddd5d7",
"type": "github"
},
"original": {
···
"type": "github"
}
},
-
"nixpkgs-stable": {
-
"locked": {
-
"lastModified": 1730741070,
-
"narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
-
"owner": "NixOS",
-
"repo": "nixpkgs",
-
"rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
-
"type": "github"
-
},
-
"original": {
-
"owner": "NixOS",
-
"ref": "nixos-24.05",
-
"repo": "nixpkgs",
-
"type": "github"
-
}
-
},
"nixpkgs_2": {
"locked": {
-
"lastModified": 315532800,
-
"narHash": "sha256-sV6pJNzFkiPc6j9Bi9JuHBnWdVhtKB/mHgVmMPvDFlk=",
-
"rev": "82c2e0d6dde50b17ae366d2aa36f224dc19af469",
+
"lastModified": 1763191728,
+
"narHash": "sha256-gI9PpaoX4/f28HkjcTbFVpFhtOxSDtOEdFaHZrdETe0=",
+
"rev": "1d4c88323ac36805d09657d13a5273aea1b34f0c",
"type": "tarball",
-
"url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre877938.82c2e0d6dde5/nixexprs.tar.xz"
+
"url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.11pre896415.1d4c88323ac3/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
···
},
"nixpkgs_3": {
"locked": {
-
"lastModified": 1758360447,
-
"narHash": "sha256-XDY3A83bclygHDtesRoaRTafUd80Q30D/Daf9KSG6bs=",
-
"rev": "8eaee110344796db060382e15d3af0a9fc396e0e",
-
"type": "tarball",
-
"url": "https://releases.nixos.org/nixos/unstable/nixos-25.11pre864002.8eaee1103447/nixexprs.tar.xz"
-
},
-
"original": {
-
"type": "tarball",
-
"url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
-
}
-
},
-
"nixpkgs_4": {
-
"locked": {
-
"lastModified": 1759652726,
-
"narHash": "sha256-2VjnimOYDRb3DZHyQ2WH2KCouFqYm9h0Rr007Al/WSA=",
+
"lastModified": 1764020296,
+
"narHash": "sha256-6zddwDs2n+n01l+1TG6PlyokDdXzu/oBmEejcH5L5+A=",
"owner": "NixOS",
"repo": "nixpkgs",
-
"rev": "06b2985f0cc9eb4318bf607168f4b15af1e5e81d",
+
"rev": "a320ce8e6e2cc6b4397eef214d202a50a4583829",
"type": "github"
},
"original": {
"owner": "NixOS",
-
"ref": "nixos-25.05-small",
+
"ref": "nixos-25.11-small",
"repo": "nixpkgs",
"type": "github"
}
},
-
"nixpkgs_5": {
+
"nixpkgs_4": {
"locked": {
-
"lastModified": 1763421233,
-
"narHash": "sha256-Stk9ZYRkGrnnpyJ4eqt9eQtdFWRRIvMxpNRf4sIegnw=",
+
"lastModified": 1763966396,
+
"narHash": "sha256-6eeL1YPcY1MV3DDStIDIdy/zZCDKgHdkCmsrLJFiZf0=",
"owner": "NixOS",
"repo": "nixpkgs",
-
"rev": "89c2b2330e733d6cdb5eae7b899326930c2c0648",
+
"rev": "5ae3b07d8d6527c42f17c876e404993199144b6a",
"type": "github"
},
"original": {
···
"type": "indirect"
}
},
-
"nixpkgs_6": {
+
"nixpkgs_5": {
"locked": {
-
"lastModified": 1763622513,
-
"narHash": "sha256-jHzzYJrOA9XWDBhsSigPSxL7DPrXvbEuRaeNLjIrkDk=",
-
"rev": "c58bc7f5459328e4afac201c5c4feb7c818d604b",
+
"lastModified": 1765311797,
+
"narHash": "sha256-3bKCEc1JWOn8aj48H1yHKU6WDw0eSU2t7cKCL3FC+Lo=",
+
"rev": "09eb77e94fa25202af8f3e81ddc7353d9970ac1b",
"type": "tarball",
-
"url": "https://releases.nixos.org/nixos/25.05/nixos-25.05.812955.c58bc7f54593/nixexprs.tar.xz"
+
"url": "https://releases.nixos.org/nixos/25.11/nixos-25.11.1335.09eb77e94fa2/nixexprs.tar.xz"
},
"original": {
"type": "tarball",
-
"url": "https://nixpkgs.dev/channel/nixos-25.05"
+
"url": "https://nixpkgs.dev/channel/nixos-25.11"
}
},
"pre-commit-hooks-nix": {
···
"nixpkgs": [
"lanzaboote",
"nixpkgs"
-
],
-
"nixpkgs-stable": "nixpkgs-stable"
+
]
},
"locked": {
-
"lastModified": 1731363552,
-
"narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
+
"lastModified": 1750779888,
+
"narHash": "sha256-wibppH3g/E2lxU43ZQHC5yA/7kIKLGxVEnsnVK1BtRg=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
-
"rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
+
"rev": "16ec914f6fb6f599ce988427d9d94efddf25fe6d",
"type": "github"
},
"original": {
···
"mystia": "mystia",
"nix-index-database": "nix-index-database",
"nixos-hardware": "nixos-hardware",
-
"nixpkgs": "nixpkgs_6",
+
"nixpkgs": "nixpkgs_5",
"sops-nix": "sops-nix",
"tangled-core": "tangled-core",
"treefmt-nix": "treefmt-nix_3",
···
]
},
"locked": {
-
"lastModified": 1731897198,
-
"narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
+
"lastModified": 1761791894,
+
"narHash": "sha256-myRIDh+PxaREz+z9LzbqBJF+SnTFJwkthKDX9zMyddY=",
"owner": "oxalica",
"repo": "rust-overlay",
-
"rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
+
"rev": "59c45eb69d9222a4362673141e00ff77842cd219",
"type": "github"
},
"original": {
···
]
},
"locked": {
-
"lastModified": 1763607916,
-
"narHash": "sha256-VefBA1JWRXM929mBAFohFUtQJLUnEwZ2vmYUNkFnSjE=",
+
"lastModified": 1765553226,
+
"narHash": "sha256-Ii16Nq5jL2wURXpV3D3tOM3vPpbKh18roHLkyZCHK4Q=",
"owner": "Mic92",
"repo": "sops-nix",
-
"rev": "877bb495a6f8faf0d89fc10bd142c4b7ed2bcc0b",
+
"rev": "496a6f625f63b780ce849891868f2fad22fd49c6",
"type": "github"
},
"original": {
···
"sqlite-lib-src": "sqlite-lib-src"
},
"locked": {
-
"lastModified": 1763697468,
-
"narHash": "sha256-DTvjkhwp7xelWd4+90+uAZoeoZOJxojEXq9SbZKXkLQ=",
+
"lastModified": 1765553661,
+
"narHash": "sha256-sj9NLGdgfXanu3wnqFg6BfWyFG1UsQ46O5UwQ2120is=",
"ref": "refs/heads/master",
-
"rev": "ed4b1ab103a6c936a887ccbf051d31ac4e4473b8",
-
"revCount": 1680,
+
"rev": "92ded47ecdfd0606aa15f78dde0014af18bcc06a",
+
"revCount": 1732,
"type": "git",
"url": "https://tangled.org/@tangled.sh/core"
},
···
]
},
"locked": {
-
"lastModified": 1760401936,
-
"narHash": "sha256-/zj5GYO5PKhBWGzbHbqT+ehY8EghuABdQ2WGfCwZpCQ=",
+
"lastModified": 1763295135,
+
"narHash": "sha256-sGv/NHCmEnJivguGwB5w8LRmVqr1P72OjS+NzcJsssE=",
"owner": "mitchellh",
"repo": "zig-overlay",
-
"rev": "365085b6652259753b598d43b723858184980bbe",
+
"rev": "64f8b42cfc615b2cf99144adf2b7728c7847c72a",
"type": "github"
},
"original": {
···
},
"zon2nix": {
"inputs": {
-
"nixpkgs": "nixpkgs_3"
+
"nixpkgs": [
+
"ghostty",
+
"nixpkgs"
+
]
},
"locked": {
"lastModified": 1758405547,
+4 -4
flake.nix
···
inputs = {
mystia.url = "github:soopyc/mystia";
# nixpkgs.follows = "mystia/nixpkgs";
-
nixpkgs.url = "https://nixpkgs.dev/channel/nixos-25.05";
+
nixpkgs.url = "https://nixpkgs.dev/channel/nixos-25.11";
nixos-hardware.url = "github:soopyc/nixos-hardware/apple-t2-updates";
-
catppuccin.url = "github:catppuccin/nix/release-25.05";
+
catppuccin.url = "github:catppuccin/nix/release-25.05"; # TODO
hydra.url = "github:NixOS/hydra";
ghostty.url = "github:ghostty-org/ghostty";
···
home-manager = {
# sync with nixpkgs!
-
url = "github:nix-community/home-manager/release-25.05";
+
url = "github:nix-community/home-manager/release-25.11";
inputs.nixpkgs.follows = "nixpkgs";
};
···
};
lanzaboote = {
-
url = "github:nix-community/lanzaboote/v0.4.2";
+
url = "github:nix-community/lanzaboote/v0.4.3";
inputs.nixpkgs.follows = "nixpkgs";
};
-2
global/gensokyo/presets/nginx.nix
···
{
lib,
-
pkgs,
config,
...
}:
···
services.nginx = {
enable = lib.mkDefault true;
enableReload = lib.mkDefault true;
-
package = lib.mkDefault pkgs.nginxQuic;
statusPage = true;
-1
global/gui/browser.nix
···
{
-
pkgs,
lib,
config,
...
+4
global/gui/input.nix
···
];
};
};
+
+
environment.systemPackages = [
+
pkgs.showmethekey
+
];
}
+5 -4
global/overlays/default.nix
···
-
inputs: [
-
# we can probably live without an overlay?
-
# inputs.mystia.overlays.default
-
]
+
_: [ ]
+
# inputs: [
+
# # we can probably live without an overlay?
+
# # inputs.mystia.overlays.default
+
# ]
+1 -1
global/programs/misc.nix
···
file
ripgrep
ack
-
du-dust
+
dust
parallel
cryptsetup
borgbackup
+2
global/programs/nix/config.nix
···
max-jobs = "auto";
auto-optimise-store = true;
download-buffer-size = 268435456; # 256 MiB
+
+
trace-import-from-derivation = true;
};
nix.gc = {
+1
global/programs/scm.nix
···
push.autoSetupRemote = true;
gpg.ssh.allowedSignersFile = pkgs.writeText "soopyc.allowedsigners" ''
me@soopy.moe namespaces="git" ${builtins.readFile ../../creds/ssh/auth}
+
git@soopy.moe namespaces="git" ${builtins.readFile ../../creds/ssh/auth}
'';
rebase.autoStash = true;
+2 -1
global/programs/security/crypto.nix
···
{
environment.systemPackages = with pkgs; [
gnupg
-
pinentry
+
pinentry-curses
+
pinentry-qt
opensc
rage
+1 -1
global/programs/security/kanidm.nix
···
{
services.kanidm = {
enableClient = true;
-
package = pkgs.kanidm_1_7;
+
package = pkgs.kanidm_1_8;
clientSettings = {
uri = "https://serenity.mist-nessie.ts.net";
};
+7 -1
global/programs/shells.nix
···
-
{ pkgs, ... }:
+
{ pkgs, lib, ... }:
{
users.defaultUserShell = pkgs.zsh;
programs.zsh = {
···
programs.direnv = {
enable = true;
nix-direnv.enable = true;
+
};
+
+
programs.pay-respects = {
+
enable = true;
+
alias = "fuck";
+
aiIntegration = lib.mkForce false;
};
# conflicts with comma
+3
global/programs/ssh.nix
···
ConnectTimeout 5
''; # if things exceed 5 seconds to connect something has gone wrong. Fail fast to not wait.
};
+
+
# i did not consent to having this automatically enabled
+
services.gnome.gcr-ssh-agent.enable = false;
}
+1 -1
systems/koumakan/certificates/default.nix
···
{
imports = [
./global.nix
-
./postgresql.nix
+
# ./postgresql.nix
./fediverse.nix
./bsky-pds.nix
./breezewiki.nix
+2
systems/koumakan/certificates/postgresql.nix
···
+
# WARN: unused. see default.nix
+
{ config, ... }:
{
# PostgreSQL only certificate
+16 -20
systems/koumakan/services/databases/postgresql.nix
···
host all all ::1/128 scram-sha-256
'';
-
settings =
-
let
-
credsDir = "/run/credentials/postgresql.service";
-
in
-
{
-
listen_addresses = pkgs.lib.mkForce "*";
-
max_connections = 200;
-
password_encryption = "scram-sha-256";
+
settings = {
+
listen_addresses = pkgs.lib.mkForce "*";
+
max_connections = 200;
+
password_encryption = "scram-sha-256";
-
log_line_prefix = "%m [%p] %h ";
-
ssl = "on";
-
ssl_cert_file = "${credsDir}/cert.pem";
-
ssl_key_file = "${credsDir}/key.pem";
+
log_line_prefix = "%m [%p] %h ";
+
# ssl = "on";
+
# ssl_cert_file = "${credsDir}/cert.pem";
+
# ssl_key_file = "${credsDir}/key.pem";
-
log_hostname = true;
-
datestyle = "iso, dmy";
-
log_timezone = "Asia/Hong_Kong";
-
timezone = "Asia/Hong_Kong";
-
default_text_search_config = "pg_catalog.english";
+
log_hostname = true;
+
datestyle = "iso, dmy";
+
log_timezone = "Asia/Hong_Kong";
+
timezone = "Asia/Hong_Kong";
+
default_text_search_config = "pg_catalog.english";
-
max_wal_size = "2GB";
-
min_wal_size = "80MB";
-
};
+
max_wal_size = "2GB";
+
min_wal_size = "80MB";
+
};
};
users.users.postgres.useDefaultShell = lib.mkForce false;
+2 -1
systems/koumakan/services/proxies/searxng.nix
···
services.searx = {
enable = true;
-
runInUwsgi = true;
environmentFile = secrets.getTemplate "searxng.env";
redisCreateLocally = true;
+
+
configureUwsgi = true;
uwsgiConfig = {
http = "/run/searx/searxng.sock";
chmod-socket = "660";
+3 -2
systems/koumakan/services/scm/forgejo.nix
···
ENABLE_NOTIFY_MAIL = true;
REGISTER_EMAIL_CONFIRM = true;
-
DISABLE_REGISTRATION = false;
+
DISABLE_REGISTRATION = false; # need to be false to enable any sort of reg.
+
ENABLE_INTERNAL_SIGNIN = true; # we have gatekeeper setup now and working, this can be turned off.
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
ENABLE_CAPTCHA = true;
···
# Logging {{{
log = {
ROOT_PATH = "/var/log/forgejo/";
-
"logger.router.MODE" = "";
+
LOGGER_ROUTER_MODE = "";
};
# }}}
-7
systems/koumakan/services/scm/tangled-knot.nix
···
{
_utils,
-
config,
...
}:
-
let
-
secrets = _utils.setupSecrets config {
-
namespace = "tangled";
-
secrets = [ "knot/key" ];
-
};
-
in
{
services.tangled-knotserver = {
enable = true;
+20 -2
systems/koumakan/services/security/pocket-id.nix
···
{
_utils,
config,
-
# lib,
...
}:
let
···
enable = true;
settings = {
-
PUBLIC_APP_URL = "https://gatekeeper.soopy.moe";
+
APP_URL = "https://gatekeeper.soopy.moe";
+
HOST = "127.0.0.1";
TRUST_PROXY = true;
PORT = "31411";
KEYS_STORAGE = "database";
···
services.nginx.virtualHosts."gatekeeper.soopy.moe" = _utils.mkSimpleProxy {
port = 31411;
+
+
extraConfig.locations."= /humans.txt" = _utils.mkNginxFile {
+
filename = "humans.txt";
+
content = ''
+
/* Credits */
+
Login Background: https://www.pixiv.net/artworks/122054405
+
You: for using our services
+
+
/* People */
+
Administrator: soopyc
+
Contact: https://soopy.moe/about
+
+
/* Service */
+
Software: Pocket ID
+
Deployed-With: NixOS
+
Security: https://soopy.moe/.well-known/security.txt
+
'';
+
};
};
}
+1 -1
systems/koumakan/services/storage/garage.nix
···
isSystemUser = true;
group = "garage";
};
-
groups.garage = {};
+
groups.garage = { };
};
services.garage = {
+7
systems/koumakan/services/storage/zipline.nix
···
DATASOURCE_S3_REGION = "ap-east-1";
DATASOURCE_S3_ENDPOINT = "https://s3.soopy.moe";
DATASOURCE_S3_FORCE_PATH_STYLE = "true";
+
+
FEATURES_OAUTH_REGISTRATION = "true";
};
};
···
extraConfig.extraConfig = ''
client_max_body_size 100M;
'';
+
};
+
+
systemd.services.zipline.serviceConfig = {
+
Restart = "on-failure";
+
RestartSec = "10s";
};
}
+1 -1
systems/renko/configuration.nix
···
];
networking.firewall = {
-
allowedTCPPorts = [ 59153 ];
+
allowedTCPPorts = [ 59153 5515 ];
allowedTCPPortRanges = [
{
from = 25560;
+1 -1
systems/renko/services/forgejo-runner.nix
···
imports = lib.singleton secrets.generate;
services.gitea-actions-runner = {
-
package = pkgs.forgejo-actions-runner;
+
package = pkgs.forgejo-runner;
instances.default = {
enable = true;
name = "renko-default";
+4 -2
users/cassie/default.nix
···
-
{ ... }:
{
users.users.cassie = {
isNormalUser = true;
-
extraGroups = [ "wheel" ];
+
extraGroups = [
+
"wheel"
+
"dialout" # esp programming
+
];
openssh = {
authorizedKeys.keyFiles = [ ../../creds/ssh/users/cassie ];
};
+16 -14
users/cassie/home/dev/git.nix
···
programs.git = lib.mkMerge [
{
enable = true;
-
userName = "Sophie Cheung";
-
userEmail = "me@soopy.moe";
-
# difftastic.enable = true;
-
# delta.enable = true;
-
diff-so-fancy = {
-
enable = true;
-
stripLeadingSymbols = false;
+
settings = {
+
user.name = "Sophie Cheung";
+
user.email = "git@soopy.moe";
};
}
(lib.mkIf traits.gui {
-
signing = {
-
signByDefault = true;
-
key = inputs.self + "/creds/ssh/auth";
-
};
-
-
extraConfig = {
+
settings = {
gpg.format = "ssh";
+
commit.gpgSign = true;
+
tag.gpgSign = true;
+
+
user.signingKey = inputs.self + "/creds/ssh/auth";
};
})
];
+
programs.diff-so-fancy = {
+
enable = true;
+
enableGitIntegration = true;
+
+
settings.stripLeadingSymbols = false;
+
};
+
home.shellAliases = {
# redo previous commit when something explodes, like my key died or something
-
gcmm = "git commit -eF .git/COMMIT_EDITMSG";
+
gcmm = "git commit -eF .git/COMMIT_EDITMSG"; # FIXME: strip the thing after ------ 8< ------
};
}
+11 -2
users/cassie/home/dev/ssh.nix
···
{
programs.ssh = {
enable = true;
-
hashKnownHosts = true;
-
forwardAgent = true;
+
enableDefaultConfig = false; # silent warning
matchBlocks = {
# most intuitive design /s
···
user = "forgejo";
identitiesOnly = true;
identityFile = "~/.ssh/id_minecraft_backup";
+
};
+
+
"*" = {
+
forwardAgent = true;
+
compression = false;
+
serverAliveInterval = 0;
+
serverAliveCountMax = 3;
+
hashKnownHosts = true;
+
userKnownHostsFile = "~/.ssh/known_hosts";
+
# visualHostKey = true; # if this doesn't work im moving to hjem
};
};