comparing 1687ded0fcb6b1b0339a172fb6fd72ecc2e4f51e and refactor/move-global-system-config on soopy.moe/gensokyo

-4

.git-crypt/.gitattributes

···

       1
       -
       # Do not edit this file.  To specify the files to encrypt, create your own

     

       2
       -
       # .gitattributes file in the directory where your files are.

     

       3
       -
       * !filter !diff

     

       4
       -
       *.gpg binary

.git-crypt/keys/default/0/7595B36DF6C2E95E10E528662932BA0FA3DDD7D6.gpg

This is a binary file and will not be displayed.

-1

.gitattributes

···

       1
       -
       *.cry filter=git-crypt diff=git-crypt

···

       0

+2 -1

.github/workflows/build.yaml

···

       70
        
               run: nix build .#nixosConfigurations."${{ matrix.host }}".config.system.build.toplevel

     

       71
        
       

     

       72
        
             - name: Setup attic and push to cache

     

       0
        
       
     

       73
        
               run: |

     

       74
        
                 nix run github:zhaofengli/attic#default login nbsm https://nonbunary.soopy.moe ${access_token}

     

       75
       -
                 nix run github:zhaofengli/attic#default push gensokyo-${{ matrix.host }} result

     

       76
        
               env:

     

       77
        
                 access_token: ${{ secrets.ATTIC_ACCESS_TOKEN }}

     

       78
        
               continue-on-error: true

···

       70
        
               run: nix build .#nixosConfigurations."${{ matrix.host }}".config.system.build.toplevel

     

       71
        
       

     

       72
        
             - name: Setup attic and push to cache

     

       73
       +
               if: ${{ github.event_name != 'pull_request' }}

     

       74
        
               run: |

     

       75
        
                 nix run github:zhaofengli/attic#default login nbsm https://nonbunary.soopy.moe ${access_token}

     

       76
       +
                 nix run github:zhaofengli/attic#default push gensokyo-systems result

     

       77
        
               env:

     

       78
        
                 access_token: ${{ secrets.ATTIC_ACCESS_TOKEN }}

     

       79
        
               continue-on-error: true

-50

.github/workflows/docs.yaml

···

       1
       -
       name: Deploy repo docs page with Jekyll and GH Pages

     

       2
       -
       

     

       3
       -
       on:

     

       4
       -
         # Runs on pushes targeting the default branch

     

       5
       -
         push:

     

       6
       -
           branches: ["main"]

     

       7
       -
       

     

       8
       -
         # Allows you to run this workflow manually from the Actions tab

     

       9
       -
         workflow_dispatch:

     

       10
       -
       

     

       11
       -
       # Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages

     

       12
       -
       permissions:

     

       13
       -
         contents: read

     

       14
       -
         pages: write

     

       15
       -
         id-token: write

     

       16
       -
       

     

       17
       -
       # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.

     

       18
       -
       # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.

     

       19
       -
       concurrency:

     

       20
       -
         group: "pages"

     

       21
       -
         cancel-in-progress: false

     

       22
       -
       

     

       23
       -
       jobs:

     

       24
       -
         # Build job

     

       25
       -
         build:

     

       26
       -
           runs-on: ubuntu-latest

     

       27
       -
           steps:

     

       28
       -
             - name: Checkout

     

       29
       -
               uses: actions/checkout@v3

     

       30
       -
             - name: Setup Pages

     

       31
       -
               uses: actions/configure-pages@v3

     

       32
       -
             - name: Build with Jekyll

     

       33
       -
               uses: actions/jekyll-build-pages@v1

     

       34
       -
               with:

     

       35
       -
                 source: ./

     

       36
       -
                 destination: ./_site

     

       37
       -
             - name: Upload artifact

     

       38
       -
               uses: actions/upload-pages-artifact@v2

     

       39
       -
       

     

       40
       -
         # Deployment job

     

       41
       -
         deploy:

     

       42
       -
           environment:

     

       43
       -
             name: github-pages

     

       44
       -
             url: ${{ steps.deployment.outputs.page_url }}

     

       45
       -
           runs-on: ubuntu-latest

     

       46
       -
           needs: build

     

       47
       -
           steps:

     

       48
       -
             - name: Deploy to GitHub Pages

     

       49
       -
               id: deployment

     

       50
       -
               uses: actions/deploy-pages@v2

+4

.github/workflows/update-lockfile.yaml

···

       1
        
       name: "Update Flake Lockfile"

     

       2
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3
        
       on:

     

       4
        
         workflow_dispatch:

     

       5
        
         schedule:

···

       1
        
       name: "Update Flake Lockfile"

     

       2
        
       

     

       3
       +
       permissions:

     

       4
       +
         pull-requests: write

     

       5
       +
         contents: write

     

       6
       +
       

     

       7
        
       on:

     

       8
        
         workflow_dispatch:

     

       9
        
         schedule:

+23

.sops.yaml

···

       1
       +
       keys:

     

       2
       +
         # maintainers

     

       3
       +
         - &soopyc_mpxl7a age10rkyshu0lswdqyvun4cs9cekm9zt4fw5c8ssa38tn3lukgcahcvsltnqx2

     

       4
       +
         - &soopyc_pgp302 8F3B277901484C6EA7E63F82D539637D518022C6

     

       5
       +
         # - &soopyc_age302 age1yubikey1qgmfcf0vddslyza7djdekjjk3t3u29d474c5xscmcdye8x3spvhlxxj23xz

     

       6
       +
         # failed to parse input as Bech32-encoded age public key: malformed recipient "age1yubikey1qgmfcf0vddslyza7djdekjjk3t3u29d474c5xscmcdye8x3spvhlxxj23xz": invalid type "age1yubikey"

     

       7
       +
       

     

       8
       +
         # Hosts

     

       9
       +
         - &koumakan_ssh age18h7hya5terghrwawgpny28swlat2nqkdrfd4clk0svujqlz9xfusd3zeqt

     

       10
       +
       

     

       11
       +
       default_group: &default_group

     

       12
       +
         pgp:

     

       13
       +
           - *soopyc_pgp302

     

       14
       +
         age:

     

       15
       +
           # - *soopyc_age302

     

       16
       +
           - *soopyc_mpxl7a

     

       17
       +
       

     

       18
       +
       creation_rules:

     

       19
       +
         - path_regex: creds/sops/koumakan.yaml

     

       20
       +
           key_groups:

     

       21
       +
             - <<: *default_group

     

       22
       +
               age:

     

       23
       +
                 - *koumakan_ssh

+2

README.md

···

       0
        
       
     

       0
        
       
     

       1
        
       # Cow

     

       2
        
       ![a yak on some grass](docs/quaritsch-photography-1_6rJHQ2Gmw-unsplash.jpg)

     

       3

···

       1
       +
       [![Check and Build configuration](https://github.com/soopyc/nix-on-koumakan/actions/workflows/build.yaml/badge.svg?branch=main)](https://github.com/soopyc/nix-on-koumakan/actions/workflows/build.yaml)

     

       2
       +
       

     

       3
        
       # Cow

     

       4
        
       ![a yak on some grass](docs/quaritsch-photography-1_6rJHQ2Gmw-unsplash.jpg)

     

       5

+3

creds/sops/.gitattributes

···

       1
       +
       # to use, make sure `sops` is in your path and run

     

       2
       +
       #  git config diff.sopsdiff.textconv "sops -d"

     

       3
       +
       *.yaml diff=sopsdiff

+68

creds/sops/koumakan.yaml

···

       1
       +
       comment_unencrypted: See https://github.com/Mic92/sops-nix/issues/120 for synapse.yaml quirks

     

       2
       +
       synapse.yaml: ENC[AES256_GCM,data:eQsUW4mwbSPzsoi8HIEngfU5x/PEaqPxvx1AXXJJj7WDX9RsPtQOqQJjuTAEPtz32Hm1nob+VVYuzAXXfCO8Cd0CIHG+xlV4cWNc4JB8wj1YgtMJu9J3yC7iv3HMULT0TL8MxmwWYKqSPKIVarLVN5gQl1G1SAfxEK3ET6qtmkmCD8y6ZVM/84fTR5lxpLe82CaplbUHXEHKk51XwGYLSp5IZsPwtMMFhYuaoqCsEVr65IiSozbD4LKddYNQKUlYmkSfThQsoPpe9ixE7+HS11S+LklyP1q3usWTfOPsQS8k5NJdcGkrCH2A4ddjWkDBAzdav3qauYoQEvbMd8BpoDqD/67lKuvoyXqDoPf5sLrQcxcUl8ObTI1I8zWhabGa9uTuiaTd3wYdMhvMvs/KIfPXNDqcBuIY9sR6LQmY2Zb9+FtYiQVnrr0XmzjB59oN023y1xC/xqkgRyXysndhnj4P1Q+PYbOMQi7hwAjM5xMk/mLkpLn41Ju4u0MqDwHSxA/NXbsEBp/u3Tim2jsrMZqjRZwQHt1n/gtMjm2cMTminM99c/fV2fcvAmcNB9u1KWgEte1JjQSRftg7pkaznYlfrQLyCQYghVu3kgeAJCaSPMewHVWOF/onTauNHYFMlJ8VDUuYOnt2LNJUk1Wap5dGfKm7661mTeYB8aw0h3111YEViuGkSp+oM5A8X6CBI6YsYYOWq5Qd+A3fFJVpcf9hhhdx0JsRmR3EZOupIVx5Y4ruuA6ipj/xMDRNfTZjqukpn3Y1s5xTjUYEo3moLdgd1PYxAVIY/KjPn31pmRThGG1NZpYHZ1yjmptVydtqf/tTd32i3e0WjIjUEZD1NE7Z5AiWJ+XAEaE3S804C6QxN1jHZvqIokA9C4HO+R/es1uDyf2KDvxf1It0hMLg7CAnq1AQcbLCDqXXZaqibSRNfv09lO4jZ3vBe3owvd1wGbK513nqC6m2gh8YDYiHdw7UlXMbMP9+,iv:fvaZQ66VKU+uzvn5AwTIFgzz+F2kJ8/QR2AfmynRfGU=,tag:8c/cAMZ6c7h3J+shh7l7tw==,type:str]

     

       3
       +
       matrix-signing-key: ENC[AES256_GCM,data:u6miE2oM3TUXaQ7wc776SwSMaOAxJOVlpl2kBW+AjI/aDH5vcGBp0L0uTpZbVfOtIe+RDNEv5E/mKA==,iv:abvwkrNe324QCbWLwiPY0UwqezS0wbyk2Fvi0vs3SI0=,tag:ZmpDB9LHbezQrxuwHNgpRg==,type:str]

     

       4
       +
       akkoma:

     

       5
       +
           dist:

     

       6
       +
               cookie: ENC[AES256_GCM,data:5jpsa4KsOAoCMGAt9laK9ioVTJfuT9+viKva8wDWRnAimVY6jDoNr4+hxVty6yQAAfSJYA7ddTxaSCEjnJtneg==,iv:V8+MpX/IEc57zEfhNGX5f+eMyipraaXDKPDNDOy0Ieo=,tag:+xCy18Ni8F5wYkO/4NbSzw==,type:str]

     

       7
       +
           endpoint:

     

       8
       +
               secret_base: ENC[AES256_GCM,data:l34Rj4iIQIykgzTLJolqWLQQz5pcfa0o5U/ZMKeNc2CBQedxiMXYrLSNOx6OuV38aqoOolccJEOSiVjfbTawtg==,iv:/x0ydo2gOPrhIZI7at877bzfFgMpraauozfLq95aHCk=,tag:RQI4aeLiAkAcWYlwLaTj5w==,type:str]

     

       9
       +
               salt: ENC[AES256_GCM,data:CP4805tG05A=,iv:aSun7ABJdbDQrFcrGQMM9H1/7d5lJqeMwO08gUYrD2A=,tag:ikhxbijsqyBFJs02j2j/vw==,type:str]

     

       10
       +
               live_view:

     

       11
       +
                   salt: ENC[AES256_GCM,data:4fKLclucoV0=,iv:ZvWKutuMTOm2X8w8a0fOTq+ldrXemayIUY2PUcurY80=,tag:qkIB1gPCI5HO0G0mLEsV+w==,type:str]

     

       12
       +
           joken_default_signer: ENC[AES256_GCM,data:myCEFUkf8s1YNQAigjxygRYvbwkpsv7cqgs00fARe9nxSFl2wveWM5JcfOnoVPwVBVV2GaAjFe4oMWXkaTPtqg==,iv:Yk1f/fzzbruW64mvTTeiyTlbrOO/G47CKKfr9BLtQ5g=,tag:QLpM22ec+VWtkjx5U/mzCw==,type:str]

     

       13
       +
           search:

     

       14
       +
               meili:

     

       15
       +
                   host_unencrypted: https://megumin.soopy.moe/

     

       16
       +
                   key: ENC[AES256_GCM,data:00TLCUneHn7NcSK1joURfIzxNFWyOBf/0/fceOn4RMcMt59dZz9LOvbs3F8B0vcH7tf/eUi3SnhYJNyRdPklyw==,iv:t0kQUCmjhFw8Z2CTmYOPUNFvyiYfsXETU8GSxhRR5KE=,tag:CPjtd7jQzgHJDrsIjHlVFQ==,type:str]

     

       17
       +
           vapid:

     

       18
       +
               pub: ENC[AES256_GCM,data:HYMKjhVCW/7DsMfPPssEduuwWnFezH4OOq4hfAovI82RUPsfVEKhgvkI9INY8hArAb/AIfyyxZhVx+bd2QkPlnASz51L7MxPtkPfZNUKqafjlMmK0nwH,iv:154BP5EmBqnKyf9BND2laKV3caVxa34MCRzrsg6/dik=,tag:wHLYdI6oQXPUzbw8dSxgwg==,type:str]

     

       19
       +
               key: ENC[AES256_GCM,data:t+da4NLEPZBMvq3MQkFEr+Fsj3XMGPMFKUWwbHDWNJAyuUZuiVcn3zX0kw==,iv:yQLu5CFl73GCojMBa2II6OhLrNNinsiVG1aPOAx+HtM=,tag:n0oelXaNFvilyee+MRSB8A==,type:str]

     

       20
       +
           postgres:

     

       21
       +
               hostname: ENC[AES256_GCM,data:rFEnhnn/Bw85,iv:GM2SH4Gkvt8tLG8AYIKxfHTZvB1sT+hgIoqkiViH6Es=,tag:yyGY9/nS9WFcJTGXlYpz6Q==,type:str]

     

       22
       +
               database_unencrypted: akkoma

     

       23
       +
               username: ENC[AES256_GCM,data:6skzOqv1,iv:OQ6zNmDn0uqKqNKEqOHWY6VBuT/4/CHog7b0Pf0TAPM=,tag:8HLmGykXg2V4t4RHzB8yaA==,type:str]

     

       24
       +
               password: ENC[AES256_GCM,data:J3OewVKr2A3TlT7ZUTk7tQr4olFs7bKx47Lus4LGbwGAZfNEmyk9coFTeQ8L/EJ0hpLfPfD1OcGBc+p0ZWK/XQ==,iv:UFe/3H/AfTgSlJikHqE1IED3zINjDuOs5niXpGWXGYE=,tag:MvT0z3TMs1dehg4gp54MyQ==,type:str]

     

       25
       +
           smtp:

     

       26
       +
               username: ENC[AES256_GCM,data:N7XbQkngWcUGzn/SR4AXCQ==,iv:wBXWtRYawOkjumsvTPcKfvL95CCB+RbsEyJv0YUG3WA=,tag:vGQREe+Cv0ITTxszl21J2g==,type:str]

     

       27
       +
               password: ENC[AES256_GCM,data:oU/aWkVmDU8WJhmwqOcXJ/EngiF7hvfUzPwpdjwkyh7Dw50dyG5AY7b2+hh6LIv9RZrN4yU+fXPAYr1W21OG/A==,iv:ds8Bg9JSJdNHUXh0FvD5a4pquyRnIXowcsJcVV1TyB4=,tag:JoYqas2RGSv8xyvJT9wHAQ==,type:str]

     

       28
       +
               relay: ENC[AES256_GCM,data:F2NnRLSTO5kmbWy4fx0=,iv:omnyn+Xa/cjqK+9l5bI573aR2p7UsUvqGX5ZQGf3CD0=,tag:t4u/jLQ1nZchyxf3WrhW6w==,type:str]

     

       29
       +
       sops:

     

       30
       +
           kms: []

     

       31
       +
           gcp_kms: []

     

       32
       +
           azure_kv: []

     

       33
       +
           hc_vault: []

     

       34
       +
           age:

     

       35
       +
               - recipient: age10rkyshu0lswdqyvun4cs9cekm9zt4fw5c8ssa38tn3lukgcahcvsltnqx2

     

       36
       +
                 enc: |

     

       37
       +
                   -----BEGIN AGE ENCRYPTED FILE-----

     

       38
       +
                   YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYMFBMZHdrR2ZMaEErZVlE

     

       39
       +
                   RmRZNnoxRVpVSDc5Rlg3MmhiVkxnK1NkNmljCjBsNE5oejcyOTRJRVVvdzJsMmw3

     

       40
       +
                   SGdyaUM1T0JvN3lDQjd4V054MWc1UjQKLS0tIDVvSndXZ29KSC8yUW5SRjdIcEZL

     

       41
       +
                   WkFkK1hsdzRnMmRBdDI0dWU3a1hBOEUKf+pJ6PAH1tPLXG14ghG4gxHpVN4D6TU1

     

       42
       +
                   GHCvsS5qNW8Cjis/Ubb3PHJfFiN4quN3rLaM/Ivkl5G1gzf9cGSDyQ==

     

       43
       +
                   -----END AGE ENCRYPTED FILE-----

     

       44
       +
               - recipient: age18h7hya5terghrwawgpny28swlat2nqkdrfd4clk0svujqlz9xfusd3zeqt

     

       45
       +
                 enc: |

     

       46
       +
                   -----BEGIN AGE ENCRYPTED FILE-----

     

       47
       +
                   YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXbVhFQXJ5ZWVVZTJocmpn

     

       48
       +
                   Q1VFc01mcnZLRGtqQVF0VjB3RU1DL0phaFVVCkFmU2w3WlhuTDFHYnF5VC9TM0xz

     

       49
       +
                   VGdSSVpVbkN1Tlh4WnQxdHJkQU42dGMKLS0tIFVnVERoQWk1N1dmdWk0KzA0R1ZG

     

       50
       +
                   cHJ5aWIrQ2Zrb1dhbC9yZ1lIMU1jbzgK4mx+S5bF6KBMe6+TrSZfaBcuWEg9cHyd

     

       51
       +
                   tbJty1zxS9pndA/u3qz5EJxDouiAODvyAR07yeegtEcbw1FlG6W/gA==

     

       52
       +
                   -----END AGE ENCRYPTED FILE-----

     

       53
       +
           lastmodified: "2023-09-14T17:13:38Z"

     

       54
       +
           mac: ENC[AES256_GCM,data:Jyx0f+w9fJ+B1lz4jVVkcKxd1xUh3FzxDhk+KaxJLVh0BG/1d8Nx0/cOnxZV1FfJkn5Z2wYiLzBPSvJKe8MjlExOSH1mIAnuXcSP6dvXp21bgX17CXM6OP91Ny6IvwSZriqs6EIpWOkZNdxsEnySwtECoQfgs09ZnA4qmbtb01U=,iv:XHnY20d0WsnaECF1/68eu2/xcGLGeGnzba+/kBxDcc0=,tag:alo+8B2fVHon0lHGsQSUyQ==,type:str]

     

       55
       +
           pgp:

     

       56
       +
               - created_at: "2023-09-08T14:11:19Z"

     

       57
       +
                 enc: |-

     

       58
       +
                   -----BEGIN PGP MESSAGE-----

     

       59
       +
       

     

       60
       +
                   wV4DAxCcDC4ukRQSAQdA6IXTpPTgsoAuUSW0NqFw4MpqX4j3Wt9IqcGbrDobZGIw

     

       61
       +
                   FFZDSKuMgO7ADZCFoADJ9OWOQBUyE3htwkXWjT/NQdBbVX3nuANbsfRfTdPN5NJt

     

       62
       +
                   0lEB30Vck2fEXQsIGrIeg3pPRBl3U/z7F35tw+79EFZ5yOrAsOzSn3wzNA549/T7

     

       63
       +
                   dEVnej/86D4ZxtMqMjVB2NjsXrphqd7ENozlljMM6QKkjtg=

     

       64
       +
                   =juKF

     

       65
       +
                   -----END PGP MESSAGE-----

     

       66
       +
                 fp: 8F3B277901484C6EA7E63F82D539637D518022C6

     

       67
       +
           unencrypted_suffix: _unencrypted

     

       68
       +
           version: 3.7.3

+2 -1

creds/ssh/cassie

···

       0
        
       
     

       1
        
       # SmartCards

     

       2
        
       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvCpt7yWIptJ9XFBhwVIj9zR30OzkWI976B/P5+0whD cardno:13 901 056

     

       3
       -
       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvCpt7yWIptJ9XFBhwVIj9zR30OzkWI976B/P5+0whD cardno:19 302 295

     

       4
        
       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMjRM3BNkLbU57RyfUx7kOlZeBEj/NByr1PfXri82aP cardno:19 302 432

     

       5
        
       

     

       6
        
       # Static devices

···

       1
       +
       # If I had an option, I would not use ecdsa keys.

     

       2
        
       # SmartCards

     

       3
        
       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvCpt7yWIptJ9XFBhwVIj9zR30OzkWI976B/P5+0whD cardno:13 901 056

     

       4
       +
       ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJxpXpPlPEZPfnw2mIuWJEy/C/5h1bb6pIMeFsHAICQ+lLdEkbBSeDXQuA8feLN0MJw8KaB9jqrJbYgFadV/nVA= YubiKey #19302295 PIV Slot 9a

     

       5
        
       ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMjRM3BNkLbU57RyfUx7kOlZeBEj/NByr1PfXri82aP cardno:19 302 432

     

       6
        
       

     

       7
        
       # Static devices

+6

docs/_config.yml

···

       1
       +
       remote_theme: pages-themes/leap-day@v0.2.0

     

       2
       +
       plugins:

     

       3
       +
       - jekyll-remote-theme # add this line to the plugins list if you already have one

     

       4
       +
       

     

       5
       +
       title: nix-on-koumakan

     

       6
       +
       show_downloads: false

+6

docs/docs.md

···

       1
       +
       # documentation

     

       2
       +
       lmao bals

     

       3
       +
       

     

       4
       +
       ## table of contents

     

       5
       +
       - [tips_n_tricks.md](./tips_n_tricks.md) Tips and tricks for nix

     

       6
       +
       - [utils.md](./utils.md) _utils functions reference

+17 -5

docs/index.md

···

       1
       -
       # documentation

     

       2
       -
       bals

     

       0
        
       
     

       0
        
       
     

       3
        
       

     

       4
       -
       ## table of contents

     

       5
       -
       - [tips_n_tricks.md](./tips_n_tricks.md) Tips and tricks for nix

     

       6
       -
       - [utils.md](./utils.md) _utils functions reference 

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
       +
       # Cow

     

       2
       +
       ![a yak on some grass](./quaritsch-photography-1_6rJHQ2Gmw-unsplash.jpg)

     

       3
       +
       

     

       4
       +
       *Gracefully provided by [Quaritsch Photography](https://unsplash.com/@quaritsch) on Unsplash, via https://unsplash.com/photos/1_6rJHQ2Gmw*

     

       5
        
       

     

       6
       +
       # NixOS Configuration

     

       7
       +
       This is a bare minimum nix configuration for koumakan.

     

       8
       +
       

     

       9
       +
       I'm still very, very new to Nix and its ecosystem so pointers to better

     

       10
       +
       way of doing things are very much appreciated.

     

       11
       +
       

     

       12
       +
       ## docs

     

       13
       +
       documentation and extra tips can be found [here](./docs)

     

       14
       +
       

     

       15
       +
       couldn't find what you needed? suffer with me! see the

     

       16
       +
       [How 2 Nix section in this repo.](https://github.com/hlissner/dotfiles#frequently-asked-questions)

     

       17
       +
       

     

       18
       +
       ✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓✓

+8 -4

docs/tips_n_tricks.md

···

       2
        
       this document outlines things that i learned from various sources and some pure guesswork

     

       3
        
       

     

       4
        
       > To learn Nix is to learn to suffer, and to learn the way of numbing the pain

     

       5
       -
       — Cassie circa. 2023

     

       0
        
       
     

       6
        
       

     

       7
        
       ## overriding packages

     

       8
        
       the pill confused me and i thought i had to make overlays to do overrides but no

     
···

       147
        
       

     

       148
        
       just don't!!!11 remove the pkgs definition. (note that this only applies to `pkgs = import nixpkgs {};`)

     

       149
        
       

     

       150
       -
       ### explanation

     

       0
        
       
     

       151
        
       > you shouldn't ever really import nixpkgs with an empty attrset either

     

       152
        
       >

     

       153
        
       > that causes it to fall back on guessing your system using `builtins.currentSystem`,

     

       154
        
       > which is impure and so not allowed in pure evaluation mode

     

       155
       -
       — \@getchoo

     

       156
       -
       ## Useful links

     

       0
        
       
     

       0
        
       
     

       157
        
       

     

       158
        
       Builtin stdlib functions search engine: https://noogle.dev/

     

       159

···

       2
        
       this document outlines things that i learned from various sources and some pure guesswork

     

       3
        
       

     

       4
        
       > To learn Nix is to learn to suffer, and to learn the way of numbing the pain

     

       5
       +
       >

     

       6
       +
       > — Cassie circa. 2023

     

       7
        
       

     

       8
        
       ## overriding packages

     

       9
        
       the pill confused me and i thought i had to make overlays to do overrides but no

     
···

       148
        
       

     

       149
        
       just don't!!!11 remove the pkgs definition. (note that this only applies to `pkgs = import nixpkgs {};`)

     

       150
        
       

     

       151
       +
       explanation

     

       152
       +
       

     

       153
        
       > you shouldn't ever really import nixpkgs with an empty attrset either

     

       154
        
       >

     

       155
        
       > that causes it to fall back on guessing your system using `builtins.currentSystem`,

     

       156
        
       > which is impure and so not allowed in pure evaluation mode

     

       157
       +
       >

     

       158
       +
       > — \@getchoo

     

       159
       +
       

     

       160
       +
       # Useful links

     

       161
        
       

     

       162
        
       Builtin stdlib functions search engine: https://noogle.dev/

     

       163

+42 -2

docs/utils.md

···

       1
        
       # utility functions

     

       2
        
       

     

       3
        
       ## `_utils.mkVhost`

     

       4
       -
       make virtual host with sensible defaults

     

       0
        
       
     

       5
        
       

     

       6
        
       pass in a set to override the defaults.

     

       7
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       8
        
       ## `_utils.mkSimpleProxy`

     

       0
        
       
     

       0
        
       
     

       9
        
       make a simple reverse proxy

     

       10
        
       

     

       11
        
       takes a set:

     
···

       14
        
         port,

     

       15
        
         protocol ? "http",

     

       16
        
         location ? "/",

     

       17
       -
         websockets ? false

     

       0
        
       
     

       18
        
       }

     

       19
        
       ```

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       1
        
       # utility functions

     

       2
        
       

     

       3
        
       ## `_utils.mkVhost`

     

       4
       +
       `attrset -> attrset`

     

       5
       +
       make a virtual host with sensible defaults

     

       6
        
       

     

       7
        
       pass in a set to override the defaults.

     

       8
        
       

     

       9
       +
       ### Example

     

       10
       +
       ```nix

     

       11
       +
       services.nginx.virtualHosts."balls.example" = _utils.mkVhost {};

     

       12
       +
       ```

     

       13
       +
       

     

       14
        
       ## `_utils.mkSimpleProxy`

     

       15
       +
       `attrset -> attrset`

     

       16
       +
       

     

       17
        
       make a simple reverse proxy

     

       18
        
       

     

       19
        
       takes a set:

     
···

       22
        
         port,

     

       23
        
         protocol ? "http",

     

       24
        
         location ? "/",

     

       25
       +
         websockets ? false,

     

       26
       +
         extraConfig ? {}

     

       27
        
       }

     

       28
        
       ```

     

       29
       +
       

     

       30
       +
       It is recommended to override/add attributes with `extraConfig` to

     

       31
       +
       preserve defaults.

     

       32
       +
       

     

       33
       +
       Items in `extraConfig` are merged verbatim to the base attrset with defaults.

     

       34
       +
       They are overridden based on their order.

     

       35
       +
       

     

       36
       +
       ## `_utils.genSecrets`

     

       37
       +
       `namespace[str] -> files[list[str]] -> value[attrset] -> attrset`

     

       38
       +
       a

     

       39
       +
       generate an attrset to be passed into sops.secrets.

     

       40
       +
       

     

       41
       +
       ### Example

     

       42
       +
       ```nix

     

       43
       +
       { _utils, ... }:

     

       44
       +
       let

     

       45
       +
         secrets = [

     

       46
       +
           "secure_secret"

     

       47
       +
           # this is a directory structure, so secrets will be stored as a file in /run/secrets/service/test/secret.

     

       48
       +
           "service/test/secret"

     

       49
       +
         ];

     

       50
       +
       in {

     

       51
       +
         sops.secrets = _utils.genSecrets "" secrets {}; # it's recommended to use a namespace, but having none is still fine.

     

       52
       +
         # -> sops.secrets."secure_secret" = {};

     

       53
       +
         #    sops.secrets."service/test/secret" = {};

     

       54
       +
         sops.secrets = _utils.genSecrets "balls" ["balls_secret"] {owner = "balls"};

     

       55
       +
         # -> sops.secrets."balls/balls_secret" = {owner = "balls";};

     

       56
       +
       }

     

       57
       +
       ```

     

       58
       +
       

     

       59
       +
       See https://github.com/soopyc/nix-on-koumakan/blob/b7983776143c15c91df69ef34ba4264a22047ec6/systems/koumakan/services/fedivese/akkoma.nix#L8-L34 for a more extensive example

+62 -7

flake.lock

···

       119
        
               "type": "github"

     

       120
        
             }

     

       121
        
           },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       122
        
           "flake-parts": {

     

       123
        
             "inputs": {

     

       124
        
               "nixpkgs-lib": [

     
···

       245
        
           },

     

       246
        
           "mystia": {

     

       247
        
             "inputs": {

     

       0
        
       
     

       248
        
               "nixpkgs": [

     

       249
        
                 "nixpkgs"

     

       250
        
               ]

     

       251
        
             },

     

       252
        
             "locked": {

     

       253
       -
               "lastModified": 1693640431,

     

       254
       -
               "narHash": "sha256-J18gekIkOmEgbZP9Veebj9/0MQZDF2YwMAlaykH/Qsk=",

     

       255
        
               "owner": "soopyc",

     

       256
        
               "repo": "mystia",

     

       257
       -
               "rev": "a0e49e52b8c5651340a29cf85d46b64791fb7b78",

     

       258
        
               "type": "github"

     

       259
        
             },

     

       260
        
             "original": {

     
···

       265
        
           },

     

       266
        
           "nixpkgs": {

     

       267
        
             "locked": {

     

       268
       -
               "lastModified": 1693639988,

     

       269
       -
               "narHash": "sha256-munyCKe2fzSPJGKz14ud3PMjDYRcsMyS3RjOj01/rNU=",

     

       270
        
               "owner": "NixOS",

     

       271
        
               "repo": "nixpkgs",

     

       272
       -
               "rev": "6c72c63dc8aecadc1b960cd4051268c6584b2606",

     

       273
        
               "type": "github"

     

       274
        
             },

     

       275
        
             "original": {

     
···

       310
        
               "type": "github"

     

       311
        
             }

     

       312
        
           },

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       313
        
           "pre-commit-hooks-nix": {

     

       314
        
             "inputs": {

     

       315
        
               "flake-compat": [

     
···

       347
        
               "home-manager": "home-manager",

     

       348
        
               "lanzaboote": "lanzaboote",

     

       349
        
               "mystia": "mystia",

     

       350
       -
               "nixpkgs": "nixpkgs"

     

       0
        
       
     

       351
        
             }

     

       352
        
           },

     

       353
        
           "rust-overlay": {

     
···

       399
        
             "original": {

     

       400
        
               "owner": "oxalica",

     

       401
        
               "repo": "rust-overlay",

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       402
        
               "type": "github"

     

       403
        
             }

     

       404
        
           },

···

       119
        
               "type": "github"

     

       120
        
             }

     

       121
        
           },

     

       122
       +
           "flake-compat_3": {

     

       123
       +
             "flake": false,

     

       124
       +
             "locked": {

     

       125
       +
               "lastModified": 1673956053,

     

       126
       +
               "narHash": "sha256-4gtG9iQuiKITOjNQQeQIpoIB6b16fm+504Ch3sNKLd8=",

     

       127
       +
               "owner": "edolstra",

     

       128
       +
               "repo": "flake-compat",

     

       129
       +
               "rev": "35bb57c0c8d8b62bbfd284272c928ceb64ddbde9",

     

       130
       +
               "type": "github"

     

       131
       +
             },

     

       132
       +
             "original": {

     

       133
       +
               "owner": "edolstra",

     

       134
       +
               "repo": "flake-compat",

     

       135
       +
               "type": "github"

     

       136
       +
             }

     

       137
       +
           },

     

       138
        
           "flake-parts": {

     

       139
        
             "inputs": {

     

       140
        
               "nixpkgs-lib": [

     
···

       261
        
           },

     

       262
        
           "mystia": {

     

       263
        
             "inputs": {

     

       264
       +
               "flake-compat": "flake-compat_3",

     

       265
        
               "nixpkgs": [

     

       266
        
                 "nixpkgs"

     

       267
        
               ]

     

       268
        
             },

     

       269
        
             "locked": {

     

       270
       +
               "lastModified": 1694357290,

     

       271
       +
               "narHash": "sha256-Mai5saiiuBWlQzTreLtIeUJQJN9zMH/UBIKJPOqnasM=",

     

       272
        
               "owner": "soopyc",

     

       273
        
               "repo": "mystia",

     

       274
       +
               "rev": "cfe783698ccd18cb27fb2e422917f14b82f7afc4",

     

       275
        
               "type": "github"

     

       276
        
             },

     

       277
        
             "original": {

     
···

       282
        
           },

     

       283
        
           "nixpkgs": {

     

       284
        
             "locked": {

     

       285
       +
               "lastModified": 1694237756,

     

       286
       +
               "narHash": "sha256-8T29BDnqRexwVy3jhEzIH9r7ROiF9I6ESVD0QLC6VXk=",

     

       287
        
               "owner": "NixOS",

     

       288
        
               "repo": "nixpkgs",

     

       289
       +
               "rev": "1a5bda2b28ea75a96dda2c349fe6d5e7864950ee",

     

       290
        
               "type": "github"

     

       291
        
             },

     

       292
        
             "original": {

     
···

       327
        
               "type": "github"

     

       328
        
             }

     

       329
        
           },

     

       330
       +
           "nixpkgs-stable_3": {

     

       331
       +
             "locked": {

     

       332
       +
               "lastModified": 1693675694,

     

       333
       +
               "narHash": "sha256-2pIOyQwGyy2FtFAUIb8YeKVmOCcPOTVphbAvmshudLE=",

     

       334
       +
               "owner": "NixOS",

     

       335
       +
               "repo": "nixpkgs",

     

       336
       +
               "rev": "5601118d39ca9105f8e7b39d4c221d3388c0419d",

     

       337
       +
               "type": "github"

     

       338
       +
             },

     

       339
       +
             "original": {

     

       340
       +
               "owner": "NixOS",

     

       341
       +
               "ref": "release-23.05",

     

       342
       +
               "repo": "nixpkgs",

     

       343
       +
               "type": "github"

     

       344
       +
             }

     

       345
       +
           },

     

       346
        
           "pre-commit-hooks-nix": {

     

       347
        
             "inputs": {

     

       348
        
               "flake-compat": [

     
···

       380
        
               "home-manager": "home-manager",

     

       381
        
               "lanzaboote": "lanzaboote",

     

       382
        
               "mystia": "mystia",

     

       383
       +
               "nixpkgs": "nixpkgs",

     

       384
       +
               "sops-nix": "sops-nix"

     

       385
        
             }

     

       386
        
           },

     

       387
        
           "rust-overlay": {

     
···

       433
        
             "original": {

     

       434
        
               "owner": "oxalica",

     

       435
        
               "repo": "rust-overlay",

     

       436
       +
               "type": "github"

     

       437
       +
             }

     

       438
       +
           },

     

       439
       +
           "sops-nix": {

     

       440
       +
             "inputs": {

     

       441
       +
               "nixpkgs": [

     

       442
       +
                 "nixpkgs"

     

       443
       +
               ],

     

       444
       +
               "nixpkgs-stable": "nixpkgs-stable_3"

     

       445
       +
             },

     

       446
       +
             "locked": {

     

       447
       +
               "lastModified": 1693898833,

     

       448
       +
               "narHash": "sha256-OIrMAGNYNeLs6IvBynxcXub7aSW3GEUvWNsb7zx6zuU=",

     

       449
       +
               "owner": "Mic92",

     

       450
       +
               "repo": "sops-nix",

     

       451
       +
               "rev": "faf21ac162173c2deb54e5fdeed002a9bd6e8623",

     

       452
       +
               "type": "github"

     

       453
       +
             },

     

       454
       +
             "original": {

     

       455
       +
               "owner": "Mic92",

     

       456
       +
               "repo": "sops-nix",

     

       457
        
               "type": "github"

     

       458
        
             }

     

       459
        
           },

+31 -9

flake.nix

···

       1
        
       {

     

       2
        
         description = "Gensokyo system configurations";

     

       3
        
       

     

       4
       -
         nixConfig = rec {

     

       5
        
           extra-substituters = [

     

       6
        
             "https://nonbunary.soopy.moe/gensokyo-global"

     

       7
        
             "https://nonbunary.soopy.moe/gensokyo-systems"

     

       8
        
           ];

     

       9
       -
       

     

       10
       -
           extra-trusted-substituters = extra-substituters;

     

       11
        
       

     

       12
        
           extra-trusted-public-keys = [

     

       13
        
             "gensokyo-global:XiCN0D2XeSxF4urFYTprR+1Nr/5hWyydcETwZtPG6Ec="

     
···

       34
        
             url = "github:zhaofengli/attic";

     

       35
        
             inputs.nixpkgs.follows = "nixpkgs";

     

       36
        
           };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       37
        
           mystia = {

     

       38
        
             url = "github:soopyc/mystia";

     

       39
        
             inputs.nixpkgs.follows = "nixpkgs";

     

       40
        
           };

     

       41
        
         };

     

       42
        
       

     

       43
       -
         outputs = { nixpkgs, home-manager, ... }@inputs:

     

       44
       -
         let

     

       45
       -
           # pkgs = import nixpkgs {};

     

       46
       -
           _utils = import ./global/utils.nix {};

     

       0
        
       
     

       0
        
       
     

       47
        
           lib = nixpkgs.lib;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       48
        
         in {

     

       49
        
           nixosConfigurations = {

     

       50
       -
             koumakan = (import ./systems/koumakan { inherit _utils lib inputs; });

     

       51
        
           };

     

       52
        
       

     

       53
       -
           # formatter.x86_64-linux = pkgs.alejendra;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       54
        
         };

     

       55
        
       }

···

       1
        
       {

     

       2
        
         description = "Gensokyo system configurations";

     

       3
        
       

     

       4
       +
         nixConfig = {

     

       5
        
           extra-substituters = [

     

       6
        
             "https://nonbunary.soopy.moe/gensokyo-global"

     

       7
        
             "https://nonbunary.soopy.moe/gensokyo-systems"

     

       8
        
           ];

     

       0
        
       
     

       0
        
       
     

       9
        
       

     

       10
        
           extra-trusted-public-keys = [

     

       11
        
             "gensokyo-global:XiCN0D2XeSxF4urFYTprR+1Nr/5hWyydcETwZtPG6Ec="

     
···

       32
        
             url = "github:zhaofengli/attic";

     

       33
        
             inputs.nixpkgs.follows = "nixpkgs";

     

       34
        
           };

     

       35
       +
       

     

       36
       +
           sops-nix = {

     

       37
       +
             url = "github:Mic92/sops-nix";

     

       38
       +
             inputs.nixpkgs.follows = "nixpkgs";

     

       39
       +
           };

     

       40
       +
       

     

       41
        
           mystia = {

     

       42
        
             url = "github:soopyc/mystia";

     

       43
        
             inputs.nixpkgs.follows = "nixpkgs";

     

       44
        
           };

     

       45
        
         };

     

       46
        
       

     

       47
       +
         outputs = {

     

       48
       +
           nixpkgs,

     

       49
       +
           home-manager,

     

       50
       +
           ...

     

       51
       +
         } @ inputs: let

     

       52
       +
           utils = import ./global/utils.nix;

     

       53
        
           lib = nixpkgs.lib;

     

       54
       +
       

     

       55
       +
           systems = [

     

       56
       +
             "x86_64-linux"

     

       57
       +
             "aarch64-linux"

     

       58
       +
             "x86_64-darwin"

     

       59
       +
             "aarch64-darwin"

     

       60
       +
           ];

     

       61
       +
           forAllSystems = fn: lib.genAttrs systems (s: fn nixpkgs.legacyPackages.${s});

     

       62
        
         in {

     

       63
        
           nixosConfigurations = {

     

       64
       +
             koumakan = import ./systems/koumakan {inherit utils lib inputs;};

     

       65
        
           };

     

       66
        
       

     

       67
       +
           devShells = forAllSystems (pkgs: {

     

       68
       +
             default = pkgs.mkShell {

     

       69
       +
               packages = [

     

       70
       +
                 (pkgs.python311.withPackages (p: [p.requests]))

     

       71
       +
               ];

     

       72
       +
             };

     

       73
       +
           });

     

       74
       +
       

     

       75
       +
           formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.alejandra;

     

       76
        
         };

     

       77
        
       }

+4 -8

global/core.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       {

     

       3
        
         imports = [

     

       4
        
           ./upgrade-diff.nix

     

       0
        
       
     

       5
        
         ];

     

       6
        
         # Set default i18n configuration

     

       7
        
         i18n.defaultLocale = "en_US.UTF-8";

     
···

       10
        
           keyMap = "us";

     

       11
        
         };

     

       12
        
       

     

       13
       -
         # # Enable crash dumps globally

     

       14
       -
         # boot.crashDump = {

     

       15
       -
         #   enable = true;

     

       16
       -
         #   reservedMemory = "128M";

     

       17
       -
         # };

     

       18
        
       

     

       19
        
         # Lock root account

     

       20
       -
         users.users.root.shell = pkgs.shadow;  # basically /bin/nologin

     

       21
        
       }

···

       1
       +
       {pkgs, ...}: {

     

       0
        
       
     

       2
        
         imports = [

     

       3
        
           ./upgrade-diff.nix

     

       4
       +
           ./system

     

       5
        
         ];

     

       6
        
         # Set default i18n configuration

     

       7
        
         i18n.defaultLocale = "en_US.UTF-8";

     
···

       10
        
           keyMap = "us";

     

       11
        
         };

     

       12
        
       

     

       13
       +
         time.timeZone = "Asia/Hong_Kong";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       14
        
       

     

       15
        
         # Lock root account

     

       16
       +
         users.users.root.shell = pkgs.shadow; # basically /bin/nologin

     

       17
        
       }

+5

global/overlays/default.nix

···

       1
       +
       inputs:

     

       2
       +
       with inputs; [

     

       3
       +
         mystia.overlays.default

     

       4
       +
         attic.overlays.default

     

       5
       +
       ]

+1 -2

global/programs/compilers.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       {

     

       3
        
         environment.systemPackages = with pkgs; [

     

       4
        
           luajit

     

       5
        
           binutils

···

       1
       +
       {pkgs, ...}: {

     

       0
        
       
     

       2
        
         environment.systemPackages = with pkgs; [

     

       3
        
           luajit

     

       4
        
           binutils

+1 -2

global/programs/default.nix

···

       1
       -
       { ... }: 

     

       2
       -
       {

     

       3
        
         imports = [

     

       4
        
           ./nix.nix

     

       5
        
           ./editors.nix

···

       1
       +
       {...}: {

     

       0
        
       
     

       2
        
         imports = [

     

       3
        
           ./nix.nix

     

       4
        
           ./editors.nix

+1 -3

global/programs/editors.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         programs.neovim = {

     

       5
        
           enable = true;

     

       6
        
           defaultEditor = true;

···

       1
       +
       {...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         programs.neovim = {

     

       3
        
           enable = true;

     

       4
        
           defaultEditor = true;

+2 -4

global/programs/gpg.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
       -
         environment.systemPackages = with pkgs; [ gnupg pinentry ];

     

       5
        
       

     

       6
        
         programs.gnupg.agent.enable = true;

     

       7
        
         # ideally this should be set automatically but in case that doesn't work

···

       1
       +
       {pkgs, ...}: {

     

       2
       +
         environment.systemPackages = with pkgs; [gnupg pinentry];

     

       0
        
       
     

       0
        
       
     

       3
        
       

     

       4
        
         programs.gnupg.agent.enable = true;

     

       5
        
         # ideally this should be set automatically but in case that doesn't work

+2 -3

global/programs/misc.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         # Miscellaneous packages that do not have an option.

     

       5
        
         # It is recommended to use packages.<package>.enable when possible.

     

       6
        
       

     
···

       19
        
           nvd

     

       20
        
           just

     

       21
        
       

     

       0
        
       
     

       22
        
           git-crypt

     

       23
        
         ];

     

       24

···

       1
       +
       {pkgs, ...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         # Miscellaneous packages that do not have an option.

     

       3
        
         # It is recommended to use packages.<package>.enable when possible.

     

       4
        
       

     
···

       17
        
           nvd

     

       18
        
           just

     

       19
        
       

     

       20
       +
           attic

     

       21
        
           git-crypt

     

       22
        
         ];

     

       23

+1 -3

global/programs/multiplexers.nix

···

       1
       -
       { pkgs, ... }: 

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         programs.tmux = {

     

       5
        
           enable = true;

     

       6
        
           newSession = true;

···

       1
       +
       {pkgs, ...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         programs.tmux = {

     

       3
        
           enable = true;

     

       4
        
           newSession = true;

+6 -6

global/programs/nix.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       

     

       3
        
       # some items are sourced from https://jackson.dev/post/nix-reasonable-defaults/

     

       4
        
       {

     

       5
        
         nix.settings = {

     

       6
        
           experimental-features = [

     

       7
        
             "nix-command"

     

       8
        
             "flakes"

     

       0
        
       
     

       9
        
           ];

     

       10
        
       

     

       11
        
           substituters = [

     

       12
       -
             "https://nonbunary.soopy.moe/gensokyo-systems"

     

       13
       -
             "https://nonbunary.soopy.moe/gensokyo-global"

     

       14
        
           ];

     

       15
        
       

     

       16
        
           trusted-substituters = [

     

       17
       -
             "https://nonbunary.soopy.moe/gensokyo-systems"

     

       18
       -
             "https://nonbunary.soopy.moe/gensokyo-global"

     

       19
        
           ];

     

       20
        
       

     

       21
        
           trusted-public-keys = [

···

       1
       +
       {pkgs, ...}:

     

       0
        
       
     

       2
        
       # some items are sourced from https://jackson.dev/post/nix-reasonable-defaults/

     

       3
        
       {

     

       4
        
         nix.settings = {

     

       5
        
           experimental-features = [

     

       6
        
             "nix-command"

     

       7
        
             "flakes"

     

       8
       +
             "repl-flake"

     

       9
        
           ];

     

       10
        
       

     

       11
        
           substituters = [

     

       12
       +
             "https://nonbunary.soopy.moe/gensokyo-systems/"

     

       13
       +
             "https://nonbunary.soopy.moe/gensokyo-global/"

     

       14
        
           ];

     

       15
        
       

     

       16
        
           trusted-substituters = [

     

       17
       +
             "https://nonbunary.soopy.moe/gensokyo-systems/"

     

       18
       +
             "https://nonbunary.soopy.moe/gensokyo-global/"

     

       19
        
           ];

     

       20
        
       

     

       21
        
           trusted-public-keys = [

+1 -2

global/programs/scm.nix

···

       1
       -
       { ... }: 

     

       2
       -
       {

     

       3
        
         programs.git = {

     

       4
        
           enable = true;

     

       5
        
           config = {

···

       1
       +
       {...}: {

     

       0
        
       
     

       2
        
         programs.git = {

     

       3
        
           enable = true;

     

       4
        
           config = {

+1 -3

global/programs/shells.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         users.defaultUserShell = pkgs.zsh;

     

       5
        
         programs.zsh = {

     

       6
        
           enable = true;

···

       1
       +
       {pkgs, ...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         users.defaultUserShell = pkgs.zsh;

     

       3
        
         programs.zsh = {

     

       4
        
           enable = true;

+1 -3

global/programs/ssh.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         # Enable the OpenSSH daemon.

     

       5
        
         services.openssh = {

     

       6
        
           enable = true;

···

       1
       +
       {...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         # Enable the OpenSSH daemon.

     

       3
        
         services.openssh = {

     

       4
        
           enable = true;

+5

global/system/default.nix

···

       1
       +
       {...}: {

     

       2
       +
         imports = [

     

       3
       +
           ./firmware.nix

     

       4
       +
         ];

     

       5
       +
       }

+4

global/system/firmware.nix

···

       1
       +
       {...}: {

     

       2
       +
         hardware.enableRedistributableFirmware = true;

     

       3
       +
         services.fwupd.enable = true;

     

       4
       +
       }

+1 -2

global/upgrade-diff.nix

···

       1
        
       # Thank you https://github.com/luishfonseca/dotfiles/blob/ab7625ec406b48493eda701911ad1cd017ce5bc1/modules/upgrade-diff.nix

     

       2
       -
       

     

       3
       -
       { pkgs, ... }: {

     

       4
        
         system.activationScripts.diff = {

     

       5
        
           supportsDryActivation = true;

     

       6
        
           text = ''

···

       1
        
       # Thank you https://github.com/luishfonseca/dotfiles/blob/ab7625ec406b48493eda701911ad1cd017ce5bc1/modules/upgrade-diff.nix

     

       2
       +
       {pkgs, ...}: {

     

       0
        
       
     

       3
        
         system.activationScripts.diff = {

     

       4
        
           supportsDryActivation = true;

     

       5
        
           text = ''

+41 -19

global/utils.nix

···

       1
        
       # see /docs/utils.md for a usage guide

     

       2
       -
       

     

       3
       -
       { ... }:

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       4
        
       

     

       5
       -
       # let

     

       6
       -
         # lib = pkgs.lib;

     

       7
       -
       # in

     

       8
       -
       rec {

     

       9
       -
         mkVhost = opts: {

     

       10
       -
           # ideally mkOverride/mkDefault would be used, but i have 0 idea how it works.

     

       11
       -
           forceSSL = true;

     

       12
       -
           useACMEHost = "global.c.soopy.moe";

     

       13
       -
           kTLS = true;

     

       14
       -
         } // opts;

     

       0
        
       
     

       15
        
       

     

       16
        
         mkSimpleProxy = {

     

       17
        
           port,

     

       18
        
           protocol ? "http",

     

       19
        
           location ? "/",

     

       20
       -
           websockets ? false

     

       21
       -
         }: mkVhost {

     

       22
       -
           locations."${location}" = {

     

       23
       -
             proxyPass = "${protocol}://localhost:${toString port}";

     

       24
       -
             proxyWebsockets = websockets;

     

       25
       -
           };

     

       26
       -
         };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       27
        
       }

···

       1
        
       # see /docs/utils.md for a usage guide

     

       2
       +
       {

     

       3
       +
         inputs,

     

       4
       +
         system,

     

       5
       +
         ...

     

       6
       +
       }: let

     

       7
       +
         lib = inputs.nixpkgs.lib;

     

       8
       +
       in rec {

     

       9
       +
         mkVhost = opts:

     

       10
       +
           lib.mkMerge [

     

       11
       +
             {

     

       12
       +
               forceSSL = lib.mkDefault true;

     

       13
       +
               useACMEHost = lib.mkDefault "global.c.soopy.moe";

     

       14
       +
               kTLS = lib.mkDefault true;

     

       15
        
       

     

       16
       +
               locations."/_cgi/error/" = {

     

       17
       +
                 alias = "${inputs.mystia.packages.${system}.staticly}/nginx_error_pages/";

     

       18
       +
               };

     

       19
       +
               extraConfig = ''

     

       20
       +
                 error_page 503 /_cgi/error/503.html;

     

       21
       +
                 error_page 502 /_cgi/error/502.html;

     

       22
       +
                 error_page 404 /_cgi/error/404.html;

     

       23
       +
               '';

     

       24
       +
             }

     

       25
       +
             opts

     

       26
       +
           ];

     

       27
        
       

     

       28
        
         mkSimpleProxy = {

     

       29
        
           port,

     

       30
        
           protocol ? "http",

     

       31
        
           location ? "/",

     

       32
       +
           websockets ? false,

     

       33
       +
           extraConfig ? {},

     

       34
       +
         }:

     

       35
       +
           mkVhost (lib.mkMerge [

     

       36
       +
             extraConfig

     

       37
       +
             {

     

       38
       +
               locations."${location}" = {

     

       39
       +
                 proxyPass = "${protocol}://localhost:${toString port}";

     

       40
       +
                 proxyWebsockets = websockets;

     

       41
       +
               };

     

       42
       +
             }

     

       43
       +
           ]);

     

       44
       +
       

     

       45
       +
         genSecrets = namespace: files: value:

     

       46
       +
           lib.genAttrs (

     

       47
       +
             map (x: namespace + lib.optionalString (lib.stringLength namespace != 0) "/" + x) files

     

       48
       +
           ) (_: value);

     

       49
        
       }

+11 -4

justfile

···

       1
        
       # friendship ended with Makefile

     

       2
        
       # I LOVE justFILE!!!!!!

     

       3
        
       

     

       4
       -
       default: build

     

       0
        
       
     

       0
        
       
     

       5
        
       

     

       0
        
       
     

       6
        
       test:

     

       7
        
       	nixos-rebuild test --flake .#

     

       8
        
       

     

       9
       -
       build:

     

       10
       -
       	nixos-rebuild build --flake .#

     

       11
       -
       

     

       12
        
       switch:

     

       13
        
       	nixos-rebuild switch --flake .#

     

       14
        
       

     

       0
        
       
     

       15
        
       utils recipe="list":

     

       16
        
         @echo "Running utils/{{recipe}}"

     

       17
        
         @cd utils && just {{recipe}}

     

       18
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       19
        
       ebuild system:

     

       20
        
         nix build -j8 .#nixosConfigurations."{{system}}".config.system.build.toplevel

···

       1
        
       # friendship ended with Makefile

     

       2
        
       # I LOVE justFILE!!!!!!

     

       3
        
       

     

       4
       +
       # build the current configuration

     

       5
       +
       build:

     

       6
       +
       	nixos-rebuild build --flake .#

     

       7
        
       

     

       8
       +
       # build and test the configuration, but don't switch

     

       9
        
       test:

     

       10
        
       	nixos-rebuild test --flake .#

     

       11
        
       

     

       12
       +
       # switch to the current configuration

     

       0
        
       
     

       0
        
       
     

       13
        
       switch:

     

       14
        
       	nixos-rebuild switch --flake .#

     

       15
        
       

     

       16
       +
       # run utility programs

     

       17
        
       utils recipe="list":

     

       18
        
         @echo "Running utils/{{recipe}}"

     

       19
        
         @cd utils && just {{recipe}}

     

       20
        
       

     

       21
       +
       # update an input in the flake lockfile

     

       22
       +
       update-input input:

     

       23
       +
         nix flake lock --update-input {{input}}

     

       24
       +
       

     

       25
       +
       # build the flake on a non-nixos platform

     

       26
        
       ebuild system:

     

       27
        
         nix build -j8 .#nixosConfigurations."{{system}}".config.system.build.toplevel

-1

overlays/default.nix

···

       0

+4 -5

systems/koumakan/certificates/default.nix

···

       1
       -
       { ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         imports = [

     

       5
        
           ./global.nix

     

       6
        
           ./postgresql.nix

     

       0
        
       
     

       7
        
         ];

     

       8
        
       

     

       9
        
         security.acme = {

     
···

       11
        
             # == lego Configuration ==

     

       12
        
             credentialsFile = "/etc/lego/desec";

     

       13
        
             dnsProvider = "desec";

     

       14
       -
             # In an more ideal world we would have an eddsa algo here but oh well

     

       15
       -
             keyType = "ec256";  # Ensure we use ec keys

     

       16
        
       

     

       17
        
             dnsResolver = "8.8.8.8:53";

     

       18

···

       1
       +
       {...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         imports = [

     

       3
        
           ./global.nix

     

       4
        
           ./postgresql.nix

     

       5
       +
           ./fediverse.nix

     

       6
        
         ];

     

       7
        
       

     

       8
        
         security.acme = {

     
···

       10
        
             # == lego Configuration ==

     

       11
        
             credentialsFile = "/etc/lego/desec";

     

       12
        
             dnsProvider = "desec";

     

       13
       +
             # In a more ideal world we would have an eddsa algo here but oh well

     

       14
       +
             keyType = "ec256"; # Ensure we use ec keys

     

       15
        
       

     

       16
        
             dnsResolver = "8.8.8.8:53";

     

       17

+11

systems/koumakan/certificates/fediverse.nix

···

       1
       +
       {...}: {

     

       2
       +
         # Certificate for fedi services

     

       3
       +
         security.acme.certs."fedi.c.soopy.moe" = {

     

       4
       +
           group = "nginx";

     

       5
       +
           extraDomainNames = [

     

       6
       +
             "a.soopy.moe"

     

       7
       +
             "m.soopy.moe"

     

       8
       +
             "pixie.soopy.moe"

     

       9
       +
           ];

     

       10
       +
         };

     

       11
       +
       }

+1 -3

systems/koumakan/certificates/global.nix

···

       1
       -
       { ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         # Global certificate

     

       5
        
         security.acme.certs."global.c.soopy.moe" = {

     

       6
        
           group = "nginx";

···

       1
       +
       {...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         # Global certificate

     

       3
        
         security.acme.certs."global.c.soopy.moe" = {

     

       4
        
           group = "nginx";

+1 -3

systems/koumakan/certificates/postgresql.nix

···

       1
       -
       { config, ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         # PostgreSQL only certificate

     

       5
        
         security.acme.certs."phant.soopy.moe" = {

     

       6
        
           group = "postgres";

···

       1
       +
       {config, ...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         # PostgreSQL only certificate

     

       3
        
         security.acme.certs."phant.soopy.moe" = {

     

       4
        
           group = "postgres";

+27 -36

systems/koumakan/configuration.nix

···

       1
       -
       # Edit this configuration file to define what should be installed on

     

       2
       -
       # your system.  Help is available in the configuration.nix(5) man page

     

       3
       -
       # and in the NixOS manual (accessible by running `nixos-help`).

     

       4
       -
       

     

       5
       -
       { inputs, ... }:

     

       6
       -
       

     

       7
       -
       {

     

       8
       -
         imports = [ # Include the results of the hardware scan.

     

       9
       -
             ./hardware-configuration.nix

     

       10
        
       

     

       11
       -
             ../../global/core.nix

     

       12
       -
             ../../global/programs

     

       13
        
       

     

       14
       -
             ./networking

     

       15
       -
             ./certificates

     

       16
       -
             ./security

     

       17
       -
             ./services

     

       18
        
         ];

     

       19
        
       

     

       20
       -
         nixpkgs.overlays = import ../../overlays ++ (with inputs; [

     

       21
       -
           mystia.overlays.default

     

       22
       -
           attic.overlays.default

     

       23
       -
         ]);

     

       24
        
       

     

       25
       -
         boot.loader.efi = {

     

       26
       -
           canTouchEfiVariables = true;

     

       27
       -
           efiSysMountPoint = "/boot/efi";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       28
        
         };

     

       29
        
       

     

       30
       -
         boot.loader.systemd-boot = {

     

       31
       -
           enable = true;

     

       32
       -
           graceful = true;

     

       33
       -
           netbootxyz.enable = true;

     

       34
       -
         };

     

       35
       -
       

     

       36
       -
         boot.loader.grub = {

     

       37
       -
           enable = false;

     

       38
       -
         };

     

       39
       -
       

     

       40
       -
         time.timeZone = "Asia/Hong_Kong";

     

       41
       -
       

     

       42
        
         # Define a user account. Don't forget to set a password with ‘passwd’.

     

       43
        
         users.users.cassie = {

     

       44
        
           isNormalUser = true;

     

       45
       -
           extraGroups = [ "wheel" ];

     

       46
        
           openssh = {

     

       47
       -
               authorizedKeys.keyFiles = [ ../../creds/ssh/cassie ];

     

       48
        
           };

     

       49
        
           # packages = with pkgs; [];

     

       50
        
         };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       51
        
       

     

       52
        
         # Just don't change this :p

     

       53
        
         system.stateVersion = "23.05"; # Did you read the comment?

···

       1
       +
       {inputs, ...}: {

     

       2
       +
         imports = [

     

       3
       +
           # Include the results of the hardware scan.

     

       4
       +
           ./hardware-configuration.nix

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       5
        
       

     

       6
       +
           ../../global/core.nix

     

       7
       +
           ../../global/programs

     

       8
        
       

     

       9
       +
           ./networking

     

       10
       +
           ./certificates

     

       11
       +
           ./security

     

       12
       +
           ./services

     

       13
        
         ];

     

       14
        
       

     

       15
       +
         nixpkgs.overlays = import ../../global/overlays inputs;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       16
        
       

     

       17
       +
         boot.loader = {

     

       18
       +
           efi = {

     

       19
       +
             canTouchEfiVariables = true;

     

       20
       +
             efiSysMountPoint = "/boot/efi";

     

       21
       +
           };

     

       22
       +
           systemd-boot = {

     

       23
       +
             enable = true;

     

       24
       +
             graceful = true;

     

       25
       +
             netbootxyz.enable = true;

     

       26
       +
           };

     

       27
       +
           grub.enable = false;

     

       28
        
         };

     

       29
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       30
        
         # Define a user account. Don't forget to set a password with ‘passwd’.

     

       31
        
         users.users.cassie = {

     

       32
        
           isNormalUser = true;

     

       33
       +
           extraGroups = ["wheel"];

     

       34
        
           openssh = {

     

       35
       +
             authorizedKeys.keyFiles = [../../creds/ssh/cassie];

     

       36
        
           };

     

       37
        
           # packages = with pkgs; [];

     

       38
        
         };

     

       39
       +
       

     

       40
       +
         sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];

     

       41
       +
         sops.defaultSopsFile = ../../creds/sops/koumakan.yaml;

     

       42
        
       

     

       43
        
         # Just don't change this :p

     

       44
        
         system.stateVersion = "23.05"; # Did you read the comment?

+12 -3

systems/koumakan/default.nix

···

       1
       -
       { lib, _utils, inputs, ... }:

     

       2
       -
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       3
        
       lib.nixosSystem {

     

       4
        
         system = "x86_64-linux";

     

       5
        
       

     

       6
        
         # see docs/tips_n_tricks.md#extra_opts for syntax

     

       7
        
         # see docs/utils.md for functions

     

       8
        
         specialArgs = {

     

       9
       -
           inherit inputs _utils;

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       10
        
         };

     

       11
        
       

     

       12
        
         modules = [

     

       13
        
           inputs.lanzaboote.nixosModules.lanzaboote

     

       14
        
           inputs.attic.nixosModules.atticd

     

       0
        
       
     

       15
        
       

     

       16
        
           ./configuration.nix

     

       17
        
         ];

···

       1
       +
       {

     

       2
       +
         lib,

     

       3
       +
         utils,

     

       4
       +
         inputs,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
        
       lib.nixosSystem {

     

       8
        
         system = "x86_64-linux";

     

       9
        
       

     

       10
        
         # see docs/tips_n_tricks.md#extra_opts for syntax

     

       11
        
         # see docs/utils.md for functions

     

       12
        
         specialArgs = {

     

       13
       +
           inherit inputs;

     

       14
       +
           _utils = utils {

     

       15
       +
             inherit inputs;

     

       16
       +
             system = "x86_64-linux";

     

       17
       +
           };

     

       18
        
         };

     

       19
        
       

     

       20
        
         modules = [

     

       21
        
           inputs.lanzaboote.nixosModules.lanzaboote

     

       22
        
           inputs.attic.nixosModules.atticd

     

       23
       +
           inputs.sops-nix.nixosModules.sops

     

       24
        
       

     

       25
        
           ./configuration.nix

     

       26
        
         ];

+48 -44

systems/koumakan/hardware-configuration.nix

···

       1
        
       # Do not modify this file!  It was generated by ‘nixos-generate-config’

     

       2
        
       # and may be overwritten by future invocations.  Please make changes

     

       3
        
       # to /etc/nixos/configuration.nix instead.

     

       4
       -
       { config, lib, pkgs, modulesPath, ... }:

     

       5
       -
       

     

       6
        
       {

     

       7
       -
         imports =

     

       8
       -
           [ (modulesPath + "/installer/scan/not-detected.nix")

     

       9
       -
           ];

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       10
        
       

     

       11
       -
         boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sr_mod" ];

     

       12
       -
         boot.initrd.kernelModules = [ "dm-snapshot" ];

     

       13
       -
         boot.kernelModules = [ "kvm-intel" ];

     

       14
       -
         boot.extraModulePackages = [ ];

     

       15
        
       

     

       16
       -
         fileSystems."/" =

     

       17
       -
           { device = "/dev/disk/by-uuid/0b38be0c-5365-4f02-85b8-72f37bb2ddf8";

     

       18
       -
             fsType = "btrfs";

     

       19
       -
           };

     

       20
        
       

     

       21
       -
         fileSystems."/var/log" =

     

       22
       -
           { device = "/dev/disk/by-uuid/e6ff7c96-3bef-4a17-9114-64ef1460fc00";

     

       23
       -
             fsType = "btrfs";

     

       24
       -
           };

     

       25
        
       

     

       26
       -
         fileSystems."/var/log/audit" =

     

       27
       -
           { device = "/dev/disk/by-uuid/a20e2995-7297-4f69-af89-b58ff314e029";

     

       28
       -
             fsType = "btrfs";

     

       29
       -
           };

     

       30
        
       

     

       31
       -
         fileSystems."/srv/osm-data" =

     

       32
       -
           { device = "/dev/disk/by-uuid/3c1a8b58-fbe6-4522-8e27-72419b3c2d6f";

     

       33
       -
             fsType = "btrfs";

     

       34
       -
           };

     

       35
        
       

     

       36
       -
         fileSystems."/boot" =

     

       37
       -
           { device = "/dev/disk/by-uuid/9E0F-3FDE";

     

       38
       -
             fsType = "vfat";

     

       39
       -
           };

     

       40
        
       

     

       41
       -
         fileSystems."/boot/efi" =

     

       42
       -
           { device = "/dev/disk/by-uuid/9EB1-FA5A";

     

       43
       -
             fsType = "vfat";

     

       44
       -
           };

     

       45
        
       

     

       46
       -
         fileSystems."/srv/www/keine" =

     

       47
       -
           { device = "/dev/disk/by-uuid/0a0e102a-b1ac-44a2-947b-2ec505b532ad";

     

       48
       -
             fsType = "btrfs";

     

       49
       -
           };

     

       50
        
       

     

       51
       -
         fileSystems."/home" =

     

       52
       -
           { device = "/dev/disk/by-uuid/50165105-6b82-4228-9640-2d32ce45f76e";

     

       53
       -
             fsType = "btrfs";

     

       54
       -
           };

     

       55
        
       

     

       56
       -
         swapDevices =

     

       57
       -
           [ { device = "/dev/disk/by-uuid/efd68464-2e0c-4aaf-8264-519dd7d05ddf"; }

     

       58
       -
           ];

     

       59
        
       

     

       60
        
         # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

     

       61
        
         # (the default) this is the recommended approach. When using systemd-networkd it's

···

       1
        
       # Do not modify this file!  It was generated by ‘nixos-generate-config’

     

       2
        
       # and may be overwritten by future invocations.  Please make changes

     

       3
        
       # to /etc/nixos/configuration.nix instead.

     

       0
        
       
     

       0
        
       
     

       4
        
       {

     

       5
       +
         config,

     

       6
       +
         lib,

     

       7
       +
         pkgs,

     

       8
       +
         modulesPath,

     

       9
       +
         ...

     

       10
       +
       }: {

     

       11
       +
         imports = [

     

       12
       +
           (modulesPath + "/installer/scan/not-detected.nix")

     

       13
       +
         ];

     

       14
        
       

     

       15
       +
         boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "usbhid" "sr_mod"];

     

       16
       +
         boot.initrd.kernelModules = ["dm-snapshot"];

     

       17
       +
         boot.kernelModules = ["kvm-intel"];

     

       18
       +
         boot.extraModulePackages = [];

     

       19
        
       

     

       20
       +
         fileSystems."/" = {

     

       21
       +
           device = "/dev/disk/by-uuid/0b38be0c-5365-4f02-85b8-72f37bb2ddf8";

     

       22
       +
           fsType = "btrfs";

     

       23
       +
         };

     

       24
        
       

     

       25
       +
         fileSystems."/var/log" = {

     

       26
       +
           device = "/dev/disk/by-uuid/e6ff7c96-3bef-4a17-9114-64ef1460fc00";

     

       27
       +
           fsType = "btrfs";

     

       28
       +
         };

     

       29
        
       

     

       30
       +
         fileSystems."/var/log/audit" = {

     

       31
       +
           device = "/dev/disk/by-uuid/a20e2995-7297-4f69-af89-b58ff314e029";

     

       32
       +
           fsType = "btrfs";

     

       33
       +
         };

     

       34
        
       

     

       35
       +
         fileSystems."/srv/osm-data" = {

     

       36
       +
           device = "/dev/disk/by-uuid/3c1a8b58-fbe6-4522-8e27-72419b3c2d6f";

     

       37
       +
           fsType = "btrfs";

     

       38
       +
         };

     

       39
        
       

     

       40
       +
         fileSystems."/boot" = {

     

       41
       +
           device = "/dev/disk/by-uuid/9E0F-3FDE";

     

       42
       +
           fsType = "vfat";

     

       43
       +
         };

     

       44
        
       

     

       45
       +
         fileSystems."/boot/efi" = {

     

       46
       +
           device = "/dev/disk/by-uuid/9EB1-FA5A";

     

       47
       +
           fsType = "vfat";

     

       48
       +
         };

     

       49
        
       

     

       50
       +
         fileSystems."/srv/www/keine" = {

     

       51
       +
           device = "/dev/disk/by-uuid/0a0e102a-b1ac-44a2-947b-2ec505b532ad";

     

       52
       +
           fsType = "btrfs";

     

       53
       +
         };

     

       54
        
       

     

       55
       +
         fileSystems."/home" = {

     

       56
       +
           device = "/dev/disk/by-uuid/50165105-6b82-4228-9640-2d32ce45f76e";

     

       57
       +
           fsType = "btrfs";

     

       58
       +
         };

     

       59
        
       

     

       60
       +
         swapDevices = [

     

       61
       +
           {device = "/dev/disk/by-uuid/efd68464-2e0c-4aaf-8264-519dd7d05ddf";}

     

       62
       +
         ];

     

       63
        
       

     

       64
        
         # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

     

       65
        
         # (the default) this is the recommended approach. When using systemd-networkd it's

+1 -3

systems/koumakan/networking/default.nix

···

       1
       -
       { ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         imports = [

     

       5
        
           ./firewall.nix

     

       6
        
           ./interface.nix

···

       1
       +
       {...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         imports = [

     

       3
        
           ./firewall.nix

     

       4
        
           ./interface.nix

+3 -4

systems/koumakan/networking/firewall.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         networking.firewall = {

     

       5
        
           enable = true;

     

       6
        
           allowedTCPPorts = [

     

       7
        
             22 # ssh

     

       8
       -
             80 443 # http[s]

     

       0
        
       
     

       9
        
           ];

     

       10
        
         };

     

       11
        
       }

···

       1
       +
       {...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         networking.firewall = {

     

       3
        
           enable = true;

     

       4
        
           allowedTCPPorts = [

     

       5
        
             22 # ssh

     

       6
       +
             80

     

       7
       +
             443 # http[s]

     

       8
        
           ];

     

       9
        
         };

     

       10
        
       }

+2 -3

systems/koumakan/networking/interface.nix

···

       1
       -
       { ... } :

     

       2
       -
       {

     

       3
       -
         networking.networkmanager.ethernet.macAddress = builtins.readFile ./nma.cry;

     

       4
        
       }

···

       1
       +
       {...}: {

     

       2
       +
         networking.networkmanager.ethernet.macAddress = "stable";

     

       0
        
       
     

       3
        
       }

systems/koumakan/networking/nma.cry

This is a binary file and will not be displayed.

+1 -2

systems/koumakan/security/default.nix

···

       1
       -
       { ... }:

     

       2
       -
       {

     

       3
        
         imports = [

     

       4
        
           ./pam.nix

     

       5
        
           ./sudo.nix

···

       1
       +
       {...}: {

     

       0
        
       
     

       2
        
         imports = [

     

       3
        
           ./pam.nix

     

       4
        
           ./sudo.nix

+2 -3

systems/koumakan/security/pam.nix

···

       1
       -
       { ... }:

     

       2
       -
       {

     

       3
        
         security.pam.yubico = {

     

       4
        
           enable = true;

     

       5
       -
           id = builtins.readFile ./ykid.cry;

     

       6
        
           mode = "client";

     

       7
        
           control = "requisite";

     

       8
        
         };

···

       1
       +
       {...}: {

     

       0
        
       
     

       2
        
         security.pam.yubico = {

     

       3
        
           enable = true;

     

       4
       +
           id = "91582";

     

       5
        
           mode = "client";

     

       6
        
           control = "requisite";

     

       7
        
         };

+4 -2

systems/koumakan/security/secureboot.nix

···

       1
       -
       { pkgs, lib, ... }:

     

       2
       -
       

     

       3
        
       {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       4
        
         environment.systemPackages = with pkgs; [

     

       5
        
           cryptsetup

     

       6
        
           sbctl

···

       0
        
       
     

       0
        
       
     

       1
        
       {

     

       2
       +
         pkgs,

     

       3
       +
         lib,

     

       4
       +
         ...

     

       5
       +
       }: {

     

       6
        
         environment.systemPackages = with pkgs; [

     

       7
        
           cryptsetup

     

       8
        
           sbctl

+2 -3

systems/koumakan/security/sudo.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       {

     

       3
        
         security.sudo.extraConfig = ''

     

       4
        
           Defaults insults

     

       5
        
         '';

     

       6
       -
         security.sudo.package = (pkgs.sudo.override {withInsults = true;});

     

       7
        
       }

···

       1
       +
       {pkgs, ...}: {

     

       0
        
       
     

       2
        
         security.sudo.extraConfig = ''

     

       3
        
           Defaults insults

     

       4
        
         '';

     

       5
       +
         security.sudo.package = pkgs.sudo.override {withInsults = true;};

     

       6
        
       }

systems/koumakan/security/ykid.cry

This is a binary file and will not be displayed.

+13 -10

systems/koumakan/services/attic.nix

···

       1
       -
       { _utils, pkgs, ... }:

     

       2
       -
       

     

       3
       -
       let

     

       0
        
       
     

       0
        
       
     

       4
        
         # where tf are the docs for pkgs.formats??

     

       5
        
         toml = pkgs.formats.toml {};

     

       6
        
       in {

     
···

       39
        
       

     

       40
        
         services.nginx.virtualHosts."nonbunary.soopy.moe" = _utils.mkSimpleProxy {

     

       41
        
           port = 38191;

     

       42
       -
         } // {

     

       43
       -
           extraConfig = ''

     

       44
       -
             client_max_body_size 1G;

     

       45
       -
             proxy_read_timeout 3h;

     

       46
       -
             proxy_connect_timeout 3h;

     

       47
       -
             proxy_send_timeout 3h;

     

       48
       -
           '';

     

       0
        
       
     

       49
        
         };

     

       50
        
       }

···

       1
       +
       {

     

       2
       +
         _utils,

     

       3
       +
         pkgs,

     

       4
       +
         ...

     

       5
       +
       }: let

     

       6
        
         # where tf are the docs for pkgs.formats??

     

       7
        
         toml = pkgs.formats.toml {};

     

       8
        
       in {

     
···

       41
        
       

     

       42
        
         services.nginx.virtualHosts."nonbunary.soopy.moe" = _utils.mkSimpleProxy {

     

       43
        
           port = 38191;

     

       44
       +
           extraConfig = {

     

       45
       +
             extraConfig = ''

     

       46
       +
               client_max_body_size 1G;

     

       47
       +
               proxy_read_timeout 3h;

     

       48
       +
               proxy_connect_timeout 3h;

     

       49
       +
               proxy_send_timeout 3h;

     

       50
       +
             '';

     

       51
       +
           };

     

       52
        
         };

     

       53
        
       }

+6

systems/koumakan/services/databases/default.nix

···

       1
       +
       {...}: {

     

       2
       +
         imports = [

     

       3
       +
           ./postgresql.nix

     

       4
       +
           ./redis.nix

     

       5
       +
         ];

     

       6
       +
       }

+40

systems/koumakan/services/databases/postgresql.nix

···

       1
       +
       {pkgs, ...}: {

     

       2
       +
         services.postgresql = {

     

       3
       +
           enable = true;

     

       4
       +
       

     

       5
       +
           package = pkgs.postgresql_15;

     

       6
       +
           dataDir = "/var/lib/postgresql/15";

     

       7
       +
           logLinePrefix = "%m [%p] %h ";

     

       8
       +
       

     

       9
       +
           authentication = ''

     

       10
       +
             # unix socket connection

     

       11
       +
             local   all             all                                     peer

     

       12
       +
             # local ipv4/6 tcp connection

     

       13
       +
             host    all             all             127.0.0.1/32            scram-sha-256

     

       14
       +
             host    all             all             ::1/128                 scram-sha-256

     

       15
       +
             # world (encrypted) tcp traffic

     

       16
       +
             hostssl all             all             all                     scram-sha-256

     

       17
       +
           '';

     

       18
       +
       

     

       19
       +
           settings = let

     

       20
       +
             credsDir = "/run/credentials/postgresql.service";

     

       21
       +
           in {

     

       22
       +
             listen_addresses = pkgs.lib.mkForce "*";

     

       23
       +
             max_connections = 200;

     

       24
       +
             password_encryption = "scram-sha-256";

     

       25
       +
       

     

       26
       +
             ssl = "on";

     

       27
       +
             ssl_cert_file = "${credsDir}/cert.pem";

     

       28
       +
             ssl_key_file = "${credsDir}/key.pem";

     

       29
       +
       

     

       30
       +
             log_hostname = true;

     

       31
       +
             datestyle = "iso, dmy";

     

       32
       +
             log_timezone = "Asia/Hong_Kong";

     

       33
       +
             timezone = "Asia/Hong_Kong";

     

       34
       +
             default_text_search_config = "pc_catalog.english";

     

       35
       +
       

     

       36
       +
             max_wal_size = "2GB";

     

       37
       +
             min_wal_size = "80MB";

     

       38
       +
           };

     

       39
       +
         };

     

       40
       +
       }

+5

systems/koumakan/services/databases/redis.nix

···

       1
       +
       {...}: {

     

       2
       +
         services.redis.servers."" = {

     

       3
       +
           enable = true;

     

       4
       +
         };

     

       5
       +
       }

+6 -6

systems/koumakan/services/default.nix

···

       1
       -
       { ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         imports = [

     

       5
        
           ./nginx.nix

     

       6
        
       

     

       7
       -
           # databases

     

       8
       -
           ./postgresql.nix

     

       9
       -
           ./redis.nix

     

       10
        
       

     

       11
        
           ./attic.nix

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       12
        
       

     

       13
        
           ./proxies

     

       14
        
           ./static-sites

···

       1
       +
       {...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         imports = [

     

       3
        
           ./nginx.nix

     

       4
        
       

     

       5
       +
           ./databases

     

       0
        
       
     

       0
        
       
     

       6
        
       

     

       7
        
           ./attic.nix

     

       8
       +
       

     

       9
       +
           # fediverse

     

       10
       +
           ./matrix

     

       11
       +
           ./fediverse

     

       12
        
       

     

       13
        
           ./proxies

     

       14
        
           ./static-sites

+150

systems/koumakan/services/fediverse/akkoma.nix

···

       1
       +
       {

     

       2
       +
         _utils,

     

       3
       +
         pkgs,

     

       4
       +
         config,

     

       5
       +
         lib,

     

       6
       +
         ...

     

       7
       +
       }: let

     

       8
       +
         mkRaw = (pkgs.formats.elixirConf {}).lib.mkRaw;

     

       9
       +
         # I don't know what i did but i made this abomination

     

       10
       +
         mkSecret = file:

     

       11
       +
           if !lib.elem file secrets

     

       12
       +
           then throw "Provided secret file ${file} is not in the list of defined secrets."

     

       13
       +
           else {_secret = "/run/secrets/akkoma/${file}";};

     

       14
       +
         secrets = [

     

       15
       +
           "joken_default_signer" # can't think of any better name spacing

     

       16
       +
           "dist/cookie"

     

       17
       +
           "search/meili/host_unencrypted"

     

       18
       +
           "search/meili/key"

     

       19
       +
           "endpoint/secret_base"

     

       20
       +
           "endpoint/salt"

     

       21
       +
           "endpoint/live_view/salt"

     

       22
       +
           "vapid/pub"

     

       23
       +
           "vapid/key"

     

       24
       +
           "postgres/hostname"

     

       25
       +
           "postgres/database_unencrypted"

     

       26
       +
           "postgres/username"

     

       27
       +
           "postgres/password"

     

       28
       +
           "smtp/username"

     

       29
       +
           "smtp/password"

     

       30
       +
           "smtp/relay"

     

       31
       +
         ];

     

       32
       +
       in {

     

       33
       +
         # secrets definition

     

       34
       +
         sops.secrets = _utils.genSecrets "akkoma" secrets {};

     

       35
       +
       

     

       36
       +
         services.akkoma = {

     

       37
       +
           enable = true;

     

       38
       +
           initSecrets = false;

     

       39
       +
           initDb.enable = false;

     

       40
       +
           # TODO: figure out how to add swagger ui

     

       41
       +
           # frontends = {

     

       42
       +
           #   swagger

     

       43
       +
           # };

     

       44
       +
       

     

       45
       +
           # TODO: Issue #5

     

       46
       +
           dist.cookie = mkSecret "dist/cookie";

     

       47
       +
           config = {

     

       48
       +
             ":joken".":default_signer" = mkSecret "joken_default_signer";

     

       49
       +
       

     

       50
       +
             ":pleroma" = {

     

       51
       +
               ":http_security" = {

     

       52
       +
                 sts = true;

     

       53
       +
               };

     

       54
       +
       

     

       55
       +
               ":configurable_from_database" = true;

     

       56
       +
               ":instance" = {

     

       57
       +
                 name = "CassieAkko";

     

       58
       +
                 description = "You should not see this here...";

     

       59
       +
                 email = "me@soopy.moe";

     

       60
       +
                 notify_email = "noreply@a.soopy.moe";

     

       61
       +
                 limit = 5000;

     

       62
       +
                 registrations_open = true;

     

       63
       +
               };

     

       64
       +
       

     

       65
       +
               # TODO: add proper proxy support

     

       66
       +
               # also refer to https://meta.akkoma.dev/t/another-vector-for-the-injection-vulnerability-found/483

     

       67
       +
               ":media_proxy" = {

     

       68
       +
                 enabled = true;

     

       69
       +
                 redirect_on_failure = true;

     

       70
       +
               };

     

       71
       +
       

     

       72
       +
               "Pleroma.Repo" = {

     

       73
       +
                 adapter = mkRaw "Ecto.Adapters.Postgres";

     

       74
       +
                 database = mkSecret "postgres/database_unencrypted";

     

       75
       +
                 hostname = mkSecret "postgres/hostname";

     

       76
       +
                 username = mkSecret "postgres/username";

     

       77
       +
                 password = mkSecret "postgres/password";

     

       78
       +
               };

     

       79
       +
       

     

       80
       +
               "Pleroma.Upload" = {

     

       81
       +
                 filters = [

     

       82
       +
                   (mkRaw "Pleroma.Upload.Filter.Exiftool")

     

       83
       +
                   (mkRaw "Pleroma.Upload.Filter.Dedupe")

     

       84
       +
                 ];

     

       85
       +
               };

     

       86
       +
       

     

       87
       +
               "Pleroma.Web.Endpoint" = {

     

       88
       +
                 # We don't need to specify http ip/ports here because we use unix sockets

     

       89
       +
                 # ok we do because it's broken

     

       90
       +
                 http = {

     

       91
       +
                   ip = "127.0.0.1";

     

       92
       +
                   port = 35378;

     

       93
       +
                 };

     

       94
       +
                 url = {

     

       95
       +
                   host = "a.soopy.moe";

     

       96
       +
                   scheme = "https";

     

       97
       +
                   port = 443;

     

       98
       +
                 };

     

       99
       +
                 secure_cookie_flag = true;

     

       100
       +
       

     

       101
       +
                 secret_key_base = mkSecret "endpoint/secret_base";

     

       102
       +
                 signing_salt = mkSecret "endpoint/salt";

     

       103
       +
                 live_view = {

     

       104
       +
                   signing_salt = mkSecret "endpoint/live_view/salt";

     

       105
       +
                 };

     

       106
       +
               };

     

       107
       +
       

     

       108
       +
               "Pleroma.Emails.Mailer" = {

     

       109
       +
                 adapter = mkRaw "Swoosh.Adapters.SMTP";

     

       110
       +
                 relay = mkSecret "smtp/relay";

     

       111
       +
                 username = mkSecret "smtp/username";

     

       112
       +
                 password = mkSecret "smtp/password";

     

       113
       +
               };

     

       114
       +
       

     

       115
       +
               "Pleroma.Search.Meilisearch" = {

     

       116
       +
                 url = mkSecret "search/meili/host_unencrypted";

     

       117
       +
                 private_key = mkSecret "search/meili/key";

     

       118
       +
                 initial_indexing_chunk_size = 100000;

     

       119
       +
               };

     

       120
       +
             };

     

       121
       +
       

     

       122
       +
             ":web_push_encryption".":vapid_details" = {

     

       123
       +
               subject = "mailto:me@soopy.moe";

     

       124
       +
               public_key = mkSecret "vapid/pub";

     

       125
       +
               private_key = mkSecret "vapid/key";

     

       126
       +
             };

     

       127
       +
           };

     

       128
       +
       

     

       129
       +
           nginx = _utils.mkVhost {

     

       130
       +
             useACMEHost = "fedi.c.soopy.moe";

     

       131
       +
             extraConfig = ''

     

       132
       +
               client_max_body_size 100M;

     

       133
       +
             '';

     

       134
       +
           };

     

       135
       +
       

     

       136
       +
           extraStatic = {

     

       137
       +
             "static/terms-of-service.html" = pkgs.writeText "terms-of-service.html" ''

     

       138
       +
               <h1>Terms of Service</h1><p>Please refer to this ToS:

     

       139
       +
               <a href="https://m.soopy.moe/@admin/pages/tos" rel="noopener noreferrer nofollow">

     

       140
       +
               https://m.soopy.moe/@admin/pages/tos</a></p>

     

       141
       +
             '';

     

       142
       +
             # refer to https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/servers/akkoma/emoji/blobs_gg.nix#L29

     

       143
       +
             # "emoji/Cat_girls_Emoji" = ...

     

       144
       +
           };

     

       145
       +
         };

     

       146
       +
       

     

       147
       +
         systemd.services.akkoma-config = {

     

       148
       +
           serviceConfig.SupplementaryGroups = [config.users.groups.keys.name];

     

       149
       +
         };

     

       150
       +
       }

+5

systems/koumakan/services/fediverse/default.nix

···

       1
       +
       {...}: {

     

       2
       +
         imports = [

     

       3
       +
           ./akkoma.nix

     

       4
       +
         ];

     

       5
       +
       }

+5

systems/koumakan/services/matrix/default.nix

···

       1
       +
       {...}: {

     

       2
       +
         imports = [

     

       3
       +
           ./synapse.nix

     

       4
       +
         ];

     

       5
       +
       }

+116

systems/koumakan/services/matrix/synapse.nix

···

       1
       +
       {

     

       2
       +
         _utils,

     

       3
       +
         pkgs,

     

       4
       +
         config,

     

       5
       +
         ...

     

       6
       +
       }: {

     

       7
       +
         sops.secrets."synapse.yaml" = {

     

       8
       +
           mode = "0400";

     

       9
       +
           owner = config.users.users.matrix-synapse.name;

     

       10
       +
         };

     

       11
       +
       

     

       12
       +
         sops.secrets.matrix-signing-key = {

     

       13
       +
           mode = "0400";

     

       14
       +
           owner = config.users.users.matrix-synapse.name;

     

       15
       +
         };

     

       16
       +
       

     

       17
       +
         users.users.matrix-synapse.extraGroups = [config.users.groups.keys.name];

     

       18
       +
       

     

       19
       +
         services.matrix-synapse = {

     

       20
       +
           enable = true;

     

       21
       +
           withJemalloc = true;

     

       22
       +
           extras = [

     

       23
       +
             "jwt"

     

       24
       +
             "oidc"

     

       25
       +
           ];

     

       26
       +
       

     

       27
       +
           extraConfigFiles = [

     

       28
       +
             "/run/secrets/synapse.yaml"

     

       29
       +
           ];

     

       30
       +
       

     

       31
       +
           settings = {

     

       32
       +
             server_name = "nue.soopy.moe";

     

       33
       +
             serve_server_wellknown = true;

     

       34
       +
             allow_public_rooms_over_federation = true;

     

       35
       +
             federation_client_minimum_tls_version = 1.2;

     

       36
       +
             # TODO: Setup TURN servers

     

       37
       +
             # TODO: Setup OIDC providers

     

       38
       +
             # TODO: Configure email

     

       39
       +
             # TODO: Setup opentracing

     

       40
       +
             url_preview_enabled = true;

     

       41
       +
             enable_registration = false;

     

       42
       +
             session_lifetime = "99y";

     

       43
       +
       

     

       44
       +
             max_upload_size = "100M";

     

       45
       +
             signing_key_path = "/run/secrets/matrix-signing-key";

     

       46
       +
       

     

       47
       +
             server_notices = {

     

       48
       +
               system_mxid_localpart = "server";

     

       49
       +
               system_mxid_display_name = "Server Notices";

     

       50
       +
               room_name = "Server Notices";

     

       51
       +
             };

     

       52
       +
       

     

       53
       +
             trusted_key_servers = [

     

       54
       +
               {

     

       55
       +
                 server_name = "matrix.org";

     

       56
       +
                 verify_keys = {

     

       57
       +
                   "ed25519:auto" = "Noi6WqcDj0QmPxCNQqgezwTlBKrfqehY1u2FyWP9uYw";

     

       58
       +
                 };

     

       59
       +
               }

     

       60
       +
               {

     

       61
       +
                 server_name = "m.lea.moe";

     

       62
       +
               }

     

       63
       +
             ];

     

       64
       +
       

     

       65
       +
             password_config = {

     

       66
       +
               policy = {

     

       67
       +
                 enabled = true;

     

       68
       +
                 minimum_length = 12;

     

       69
       +
               };

     

       70
       +
             };

     

       71
       +
           };

     

       72
       +
         };

     

       73
       +
       

     

       74
       +
         services.postgresql = {

     

       75
       +
           ensureDatabases = ["synapse"];

     

       76
       +
           ensureUsers = [

     

       77
       +
             {

     

       78
       +
               name = "synapse";

     

       79
       +
               ensurePermissions = {

     

       80
       +
                 "database \"synapse\"" = "all privileges";

     

       81
       +
               };

     

       82
       +
             }

     

       83
       +
           ];

     

       84
       +
         };

     

       85
       +
       

     

       86
       +
         services.nginx.virtualHosts."nue.soopy.moe" = _utils.mkVhost {

     

       87
       +
           locations."= /config.json" = {

     

       88
       +
             alias = "${pkgs.staticly}/configs/";

     

       89
       +
             tryFiles = "cinny.json =404";

     

       90
       +
             extraConfig = ''

     

       91
       +
               add_header access_control_allow_origin "*";

     

       92
       +
             '';

     

       93
       +
           };

     

       94
       +
       

     

       95
       +
           locations."= /.well-known/matrix/server" = {

     

       96
       +
             return = "200 '{\"m.server\": \"nue.soopy.moe:443\"}'";

     

       97
       +
           };

     

       98
       +
       

     

       99
       +
           locations."~ ^(/_matrix|/_synapse/client)" = {

     

       100
       +
             proxyPass = "http://localhost:8008";

     

       101
       +
             extraConfig = ''

     

       102
       +
               client_max_body_size 100M;

     

       103
       +
             '';

     

       104
       +
           };

     

       105
       +
       

     

       106
       +
           locations."= /.well-known/matrix/client" = {

     

       107
       +
             alias = "${pkgs.staticly}/configs/matrix/";

     

       108
       +
             tryFiles = "stable.json =404";

     

       109
       +
           };

     

       110
       +
       

     

       111
       +
           locations."/" = {

     

       112
       +
             root = "${pkgs.staticly}/pages/matrix/landing/";

     

       113
       +
             tryFiles = "$uri $uri/index.html $uri.html =404";

     

       114
       +
           };

     

       115
       +
         };

     

       116
       +
       }

+1 -3

systems/koumakan/services/nginx.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         services.nginx = {

     

       5
        
           enable = true;

     

       6
        
           enableReload = true;

···

       1
       +
       {pkgs, ...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         services.nginx = {

     

       3
        
           enable = true;

     

       4
        
           enableReload = true;

-42

systems/koumakan/services/postgresql.nix

···

       1
       -
       { pkgs, ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
       -
         services.postgresql = {

     

       5
       -
           enable = true;

     

       6
       -
       

     

       7
       -
           package = pkgs.postgresql_15;

     

       8
       -
           dataDir = "/var/lib/postgresql/15";

     

       9
       -
           logLinePrefix = "%m [%p] %h ";  # bollocks to that

     

       10
       -
       

     

       11
       -
           authentication = ''

     

       12
       -
             # unix socket connection

     

       13
       -
             local   all             all                                     trust

     

       14
       -
             # local ipv4/6 tcp connection

     

       15
       -
             host    all             all             127.0.0.1/32            scram-sha-256

     

       16
       -
             host    all             all             ::1/128                 scram-sha-256

     

       17
       -
             # world (encrypted) tcp traffic

     

       18
       -
             hostssl all             all             all                     scram-sha-256

     

       19
       -
           '';

     

       20
       -
       

     

       21
       -
           settings = let

     

       22
       -
             credsDir = "/run/credentials/postgresql.service";

     

       23
       -
           in {

     

       24
       -
             listen_addresses = pkgs.lib.mkForce "*";

     

       25
       -
             max_connections = 200;

     

       26
       -
             password_encryption = "scram-sha-256";

     

       27
       -
       

     

       28
       -
             ssl = "on";

     

       29
       -
             ssl_cert_file = "${credsDir}/cert.pem";

     

       30
       -
             ssl_key_file = "${credsDir}/key.pem";

     

       31
       -
       

     

       32
       -
             log_hostname = true;

     

       33
       -
             datestyle = "iso, dmy";

     

       34
       -
             log_timezone = "Asia/Hong_Kong";

     

       35
       -
             timezone = "Asia/Hong_Kong";

     

       36
       -
             default_text_search_config = "pc_catalog.english";

     

       37
       -
       

     

       38
       -
             max_wal_size = "2GB";

     

       39
       -
             min_wal_size = "80MB";

     

       40
       -
           };

     

       41
       -
         };

     

       42
       -
       }

+1 -3

systems/koumakan/services/proxies/default.nix

···

       1
       -
       { ... }:

     

       2
       -
       

     

       3
       -
       {

     

       4
        
         imports = [

     

       5
        
           ./nitter.nix

     

       6
        
         ];

···

       1
       +
       {...}: {

     

       0
        
       
     

       0
        
       
     

       2
        
         imports = [

     

       3
        
           ./nitter.nix

     

       4
        
         ];

+5 -3

systems/koumakan/services/proxies/nitter.nix

···

       1
       -
       { _utils, pkgs, ... }:

     

       2
       -
       

     

       3
        
       {

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       4
        
         services.nitter = {

     

       5
        
           enable = true;

     

       6
       -
           redisCreateLocally = false;  # why is the default of this `true`??

     

       7
        
           server = {

     

       8
        
             title = "NSM";

     

       9
        
             port = 36325;

···

       0
        
       
     

       0
        
       
     

       1
        
       {

     

       2
       +
         _utils,

     

       3
       +
         pkgs,

     

       4
       +
         ...

     

       5
       +
       }: {

     

       6
        
         services.nitter = {

     

       7
        
           enable = true;

     

       8
       +
           redisCreateLocally = false; # why is the default of this `true`??

     

       9
        
           server = {

     

       10
        
             title = "NSM";

     

       11
        
             port = 36325;

-6

systems/koumakan/services/redis.nix

···

       1
       -
       { ... }: 

     

       2
       -
       {

     

       3
       -
         services.redis.servers."" = {

     

       4
       -
           enable = true;

     

       5
       -
         };

     

       6
       -
       }

+2 -4

systems/koumakan/services/static-sites/default.nix

···

       1
       -
       { ... }:

     

       2
       -
       {

     

       3
        
         imports = [

     

       4
        
           ./keine.nix

     

       5
        
         ];

     
···

       16
        
             "~ ^/(index.html|splash.png)".root = "/srv/www/maintenance";

     

       17
        
           };

     

       18
        
           extraConfig = ''

     

       19
       -
           	error_page 503 /index.html;

     

       20
        
           '';

     

       21
       -
       

     

       22
        
         };

     

       23
        
       }

···

       1
       +
       {...}: {

     

       0
        
       
     

       2
        
         imports = [

     

       3
        
           ./keine.nix

     

       4
        
         ];

     
···

       15
        
             "~ ^/(index.html|splash.png)".root = "/srv/www/maintenance";

     

       16
        
           };

     

       17
        
           extraConfig = ''

     

       18
       +
             error_page 503 /index.html;

     

       19
        
           '';

     

       0
        
       
     

       20
        
         };

     

       21
        
       }

+4 -5

systems/koumakan/services/static-sites/keine.nix

···

       1
       -
       { ... }:

     

       2
       -
       {

     

       3
       -
         services.nginx.virtualHosts."keine.soopy.moe" = {

     

       4
       -
           useACMEHost = "global.c.soopy.moe";

     

       5
       -
           addSSL = true;  # Don't force SSL on a mirror (implications TBD)

     

       6
        
       

     

       7
        
           root = "/srv/www/keine";

     

       8
        
           locations = {

···

       1
       +
       {_utils, ...}: {

     

       2
       +
         services.nginx.virtualHosts."keine.soopy.moe" = _utils.mkVhost {

     

       3
       +
           forceSSL = false;

     

       4
       +
           addSSL = true; # Don't force SSL on a mirror (implications TBD)

     

       0
        
       
     

       5
        
       

     

       6
        
           root = "/srv/www/keine";

     

       7
        
           locations = {

-59

utils/flake.lock

···

       1
       -
       {

     

       2
       -
         "nodes": {

     

       3
       -
           "flake-utils": {

     

       4
       -
             "inputs": {

     

       5
       -
               "systems": "systems"

     

       6
       -
             },

     

       7
       -
             "locked": {

     

       8
       -
               "lastModified": 1692799911,

     

       9
       -
               "narHash": "sha256-3eihraek4qL744EvQXsK1Ha6C3CR7nnT8X2qWap4RNk=",

     

       10
       -
               "owner": "numtide",

     

       11
       -
               "repo": "flake-utils",

     

       12
       -
               "rev": "f9e7cf818399d17d347f847525c5a5a8032e4e44",

     

       13
       -
               "type": "github"

     

       14
       -
             },

     

       15
       -
             "original": {

     

       16
       -
               "owner": "numtide",

     

       17
       -
               "repo": "flake-utils",

     

       18
       -
               "type": "github"

     

       19
       -
             }

     

       20
       -
           },

     

       21
       -
           "nixpkgs": {

     

       22
       -
             "locked": {

     

       23
       -
               "lastModified": 1693060755,

     

       24
       -
               "narHash": "sha256-KNsbfqewEziFJEpPR0qvVz4rx0x6QXxw1CcunRhlFdk=",

     

       25
       -
               "owner": "NixOS",

     

       26
       -
               "repo": "nixpkgs",

     

       27
       -
               "rev": "c66ccfa00c643751da2fd9290e096ceaa30493fc",

     

       28
       -
               "type": "github"

     

       29
       -
             },

     

       30
       -
             "original": {

     

       31
       -
               "id": "nixpkgs",

     

       32
       -
               "type": "indirect"

     

       33
       -
             }

     

       34
       -
           },

     

       35
       -
           "root": {

     

       36
       -
             "inputs": {

     

       37
       -
               "flake-utils": "flake-utils",

     

       38
       -
               "nixpkgs": "nixpkgs"

     

       39
       -
             }

     

       40
       -
           },

     

       41
       -
           "systems": {

     

       42
       -
             "locked": {

     

       43
       -
               "lastModified": 1681028828,

     

       44
       -
               "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",

     

       45
       -
               "owner": "nix-systems",

     

       46
       -
               "repo": "default",

     

       47
       -
               "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",

     

       48
       -
               "type": "github"

     

       49
       -
             },

     

       50
       -
             "original": {

     

       51
       -
               "owner": "nix-systems",

     

       52
       -
               "repo": "default",

     

       53
       -
               "type": "github"

     

       54
       -
             }

     

       55
       -
           }

     

       56
       -
         },

     

       57
       -
         "root": "root",

     

       58
       -
         "version": 7

     

       59
       -
       }

-16

utils/flake.nix

···

       1
       -
       {

     

       2
       -
         inputs = {

     

       3
       -
           flake-utils.url = "github:numtide/flake-utils";

     

       4
       -
         };

     

       5
       -
       

     

       6
       -
         outputs = { self, nixpkgs, flake-utils }:

     

       7
       -
           flake-utils.lib.eachDefaultSystem (system:

     

       8
       -
             let

     

       9
       -
               pkgs = nixpkgs.legacyPackages.${system};

     

       10
       -
             in {

     

       11
       -
               packages = rec {

     

       12
       -
                 python3 = pkgs.python311.withPackages (p: with p; [requests]);

     

       13
       -
                 default = python3;

     

       14
       -
               };

     

       15
       -
           });

     

       16
       -
       }

+2 -1

utils/justfile

···

       1
       -
       python_executable := if os() == "android" { "python3" } else { "nix run .#python3 --" }

     

       2
        
       

     

       3
        
       list:

     

       4
        
         just -l

     

       5
        
       

     

       0
        
       
     

       6
        
       nitter-token:

     

       7
        
         {{python_executable}} nitter-guest-account.py tokens.json

···

       1
       +
       python_executable := if os() == "android" { "python3" } else { "nix develop ..# -c python3" }

     

       2
        
       

     

       3
        
       list:

     

       4
        
         just -l

     

       5
        
       

     

       6
       +
       # grab a new nitter guest account and save it

     

       7
        
       nitter-token:

     

       8
        
         {{python_executable}} nitter-guest-account.py tokens.json

-146

utils/nitter-guest-account.js

···

       1
       -
       // adapted from https://github.com/zedeus/nitter/issues/983#issuecomment-1681199357

     

       2
       -
       // deno run --allow-{env,read,net} nitter-guest-account.js

     

       3
       -
       

     

       4
       -
       import axios from 'npm:axios'

     

       5
       -
       import chalk from 'npm:chalk'

     

       6
       -
       const TW_CONSUMER_KEY = '3nVuSoBZnx6U4vzUxf5w'

     

       7
       -
       const TW_CONSUMER_SECRET = 'Bcs59EFbbsdF6Sl9Ng71smgStWEGwXXKSjYvPVt7qys'

     

       8
       -
       

     

       9
       -
       const TW_ANDROID_BASIC_TOKEN = `Basic ${btoa(TW_CONSUMER_KEY+':'+TW_CONSUMER_SECRET)}`

     

       10
       -
       

     

       11
       -
       const VERBOSE_MODE = Deno.args.includes('-v') || Deno.args.includes("--verbose") || Deno.args.includes('--debug') || Deno.args.includes('-d')

     

       12
       -
       const NO_PRETTYPRINT = Deno.args.includes('-P') || Deno.args.includes("--no-pretty")

     

       13
       -
       

     

       14
       -
       function debug(msg) {

     

       15
       -
           if (VERBOSE_MODE) {

     

       16
       -
               console.log(chalk.gray(`[*] ${msg}`))

     

       17
       -
           }

     

       18
       -
       }

     

       19
       -
       

     

       20
       -
       const getBearerToken = async () => {

     

       21
       -
           console.error(chalk.blue("[i] Getting bearer token..."));

     

       22
       -
           const tmpTokenResponse = await axios('https://api.twitter.com/oauth2/token', {

     

       23
       -
               headers: {

     

       24
       -
                   Authorization: TW_ANDROID_BASIC_TOKEN,

     

       25
       -
                   'Content-Type': 'application/x-www-form-urlencoded'

     

       26
       -
               },

     

       27
       -
               method: 'post',

     

       28
       -
               data: 'grant_type=client_credentials'

     

       29
       -
           });

     

       30
       -
           return Object.values(tmpTokenResponse.data).join(" ");

     

       31
       -
       }

     

       32
       -
       // The bearer token is immutable

     

       33
       -
       // Bearer AAAAAAAAAAAAAAAAAAAAAFXzAwAAAAAAMHCxpeSDG1gLNLghVe8d74hl6k4%3DRUMF4xAQLsbeBhTSRrCiQpJtxoGWeyHrDb5te2jpGskWDFW82F

     

       34
       -
       const bearer_token = await getBearerToken()

     

       35
       -
       console.error(chalk.blue(`[i] bearer token = ${bearer_token}`));

     

       36
       -
       if (bearer_token.toLowerCase() !== "Bearer AAAAAAAAAAAAAAAAAAAAAFXzAwAAAAAAMHCxpeSDG1gLNLghVe8d74hl6k4%3DRUMF4xAQLsbeBhTSRrCiQpJtxoGWeyHrDb5te2jpGskWDFW82F".toLowerCase()) {

     

       37
       -
           console.warn(chalk.yellow("[!] bearer token does not match expected value"))

     

       38
       -
       } else {

     

       39
       -
           console.error(chalk.green('[i] bearer token matches expected value'))

     

       40
       -
       }

     

       41
       -
       

     

       42
       -
       console.error(chalk.blue(`[i] getting guest token`))

     

       43
       -
       const guest_token = (await axios("https://api.twitter.com/1.1/guest/activate.json", {

     

       44
       -
           headers: {

     

       45
       -
               Authorization: bearer_token

     

       46
       -
           },

     

       47
       -
           method: "post"

     

       48
       -
       })).data.guest_token

     

       49
       -
       console.error(chalk.blue(`[i] guest token = ${guest_token}`));

     

       50
       -
       

     

       51
       -
       console.error(chalk.blue(`[i] getting flow_token`))

     

       52
       -
       const flow_token_r = (await axios('https://api.twitter.com/1.1/onboarding/task.json?flow_name=welcome&api_version=1&known_device_token=&sim_country_code=us', {

     

       53
       -
           headers: {

     

       54
       -
               Authorization: bearer_token,

     

       55
       -
               'Content-Type': 'application/json',

     

       56
       -
               'User-Agent': 'TwitterAndroid/9.95.0-release.0 (29950000-r-0) ONEPLUS+A3010/9 (OnePlus;ONEPLUS+A3010;OnePlus;OnePlus3;0;;1;2016)',

     

       57
       -
               'X-Twitter-API-Version': 5,

     

       58
       -
               'X-Twitter-Client': 'TwitterAndroid',

     

       59
       -
               'X-Twitter-Client-Version': '9.95.0-release.0',

     

       60
       -
               'OS-Version': '28',

     

       61
       -
               'System-User-Agent': 'Dalvik/2.1.0 (Linux; U; Android 9; ONEPLUS A3010 Build/PKQ1.181203.001)',

     

       62
       -
               'X-Twitter-Active-User': 'yes',

     

       63
       -
               'X-Guest-Token': guest_token

     

       64
       -
           },

     

       65
       -
           method: 'post',

     

       66
       -
           data: '{"flow_token":null,"input_flow_data":{"country_code":null,"flow_context":{"start_location":{"location":"splash_screen"}},"requested_variant":null,"target_user_id":0},"subtask_versions":{"generic_urt":3,"standard":1,"open_home_timeline":1,"app_locale_update":1,"enter_date":1,"email_verification":3,"enter_password":5,"enter_text":5,"one_tap":2,"cta":7,"single_sign_on":1,"fetch_persisted_data":1,"enter_username":3,"web_modal":2,"fetch_temporary_password":1,"menu_dialog":1,"sign_up_review":5,"interest_picker":4,"user_recommendations_urt":3,"in_app_notification":1,"sign_up":2,"typeahead_search":1,"user_recommendations_list":4,"cta_inline":1,"contacts_live_sync_permission_prompt":3,"choice_selection":5,"js_instrumentation":1,"alert_dialog_suppress_client_events":1,"privacy_options":1,"topics_selector":1,"wait_spinner":3,"tweet_selection_urt":1,"end_flow":1,"settings_list":7,"open_external_link":1,"phone_verification":5,"security_key":3,"select_banner":2,"upload_media":1,"web":2,"alert_dialog":1,"open_account":2,"action_list":2,"enter_phone":2,"open_link":1,"show_code":1,"update_users":1,"check_logged_in_account":1,"enter_email":2,"select_avatar":4,"location_permission_prompt":2,"notifications_permission_prompt":4}}'

     

       67
       -
       })).data

     

       68
       -
       const flow_token = flow_token_r.flow_token

     

       69
       -
       debug(`flow_token => ${JSON.stringify(flow_token_r, null, 2)}`)

     

       70
       -
       console.error(chalk.blue(`[i] flow_token = ${flow_token}`))

     

       71
       -
       

     

       72
       -
       const tasks_raw = (await axios('https://api.twitter.com/1.1/onboarding/task.json', {

     

       73
       -
           headers: {

     

       74
       -
               Authorization: bearer_token,

     

       75
       -
               'Content-Type': 'application/json',

     

       76
       -
               'User-Agent': 'TwitterAndroid/9.95.0-release.0 (29950000-r-0) ONEPLUS+A3010/9 (OnePlus;ONEPLUS+A3010;OnePlus;OnePlus3;0;;1;2016)',

     

       77
       -
               'X-Twitter-API-Version': 5,

     

       78
       -
               'X-Twitter-Client': 'TwitterAndroid',

     

       79
       -
               'X-Twitter-Client-Version': '9.95.0-release.0',

     

       80
       -
               'OS-Version': '28',

     

       81
       -
               'System-User-Agent': 'Dalvik/2.1.0 (Linux; U; Android 9; ONEPLUS A3010 Build/PKQ1.181203.001)',

     

       82
       -
               'X-Twitter-Active-User': 'yes',

     

       83
       -
               'X-Guest-Token': guest_token

     

       84
       -
           },

     

       85
       -
           method: 'post',

     

       86
       -
           data: '{"flow_token":"' + flow_token + '","subtask_inputs":[{"open_link":{"link":"next_link"},"subtask_id":"NextTaskOpenLink"}],"subtask_versions":{"generic_urt":3,"standard":1,"open_home_timeline":1,"app_locale_update":1,"enter_date":1,"email_verification":3,"enter_password":5,"enter_text":5,"one_tap":2,"cta":7,"single_sign_on":1,"fetch_persisted_data":1,"enter_username":3,"web_modal":2,"fetch_temporary_password":1,"menu_dialog":1,"sign_up_review":5,"interest_picker":4,"user_recommendations_urt":3,"in_app_notification":1,"sign_up":2,"typeahead_search":1,"user_recommendations_list":4,"cta_inline":1,"contacts_live_sync_permission_prompt":3,"choice_selection":5,"js_instrumentation":1,"alert_dialog_suppress_client_events":1,"privacy_options":1,"topics_selector":1,"wait_spinner":3,"tweet_selection_urt":1,"end_flow":1,"settings_list":7,"open_external_link":1,"phone_verification":5,"security_key":3,"select_banner":2,"upload_media":1,"web":2,"alert_dialog":1,"open_account":2,"action_list":2,"enter_phone":2,"open_link":1,"show_code":1,"update_users":1,"check_logged_in_account":1,"enter_email":2,"select_avatar":4,"location_permission_prompt":2,"notifications_permission_prompt":4}}'

     

       87
       -
       })).data

     

       88
       -
       

     

       89
       -
       debug(`tasks => ${JSON.stringify(tasks_raw, null, 2)}`);

     

       90
       -
       const subtasks = tasks_raw.subtasks;

     

       91
       -
       const account = subtasks.find(task => task.subtask_id === 'OpenAccount')?.open_account

     

       92
       -
       

     

       93
       -
       async function tryAppendJSON(file, content) {

     

       94
       -
       

     

       95
       -
         async function tryRead(file, _default = "[]") {

     

       96
       -
           try {

     

       97
       -
             const rawD = await Deno.readTextFile(file);

     

       98
       -
             return rawD

     

       99
       -
           } catch (e) {

     

       100
       -
             if (e?.code === "ENOENT") {

     

       101
       -
               return _default

     

       102
       -
             } else {

     

       103
       -
               throw e

     

       104
       -
             }

     

       105
       -
           }

     

       106
       -
         }

     

       107
       -
       

     

       108
       -
         if (file) {

     

       109
       -
           debug(`attempting to write to file ${file}`)

     

       110
       -
           try {

     

       111
       -
             const rD = await tryRead(file)

     

       112
       -
             debug("read old file with contents => " + rD);

     

       113
       -
             const oldData = JSON.parse(rD)

     

       114
       -
             if (!Array.isArray(oldData)) {

     

       115
       -
               console.error(chalk.red(`[!] top-level object of existing file ${file} is not an array, not proceeding.`))

     

       116
       -
               return false;

     

       117
       -
             }

     

       118
       -
             oldData.push(content)

     

       119
       -
             await Deno.writeTextFile(file, JSON.stringify(oldData, null, 4))

     

       120
       -
             return true

     

       121
       -
           } catch (e) {

     

       122
       -
             console.error(chalk.red("[!] Uncaught error", e))

     

       123
       -
             return false

     

       124
       -
           }

     

       125
       -
         } else {

     

       126
       -
           debug("file is not truthy, bailing")

     

       127
       -
           return false

     

       128
       -
         }

     

       129
       -
       }

     

       130
       -
       

     

       131
       -
       if (!account) {

     

       132
       -
           console.error(chalk.red(`[!] unable to acquire account token. API response => ${JSON.stringify(account)}`))

     

       133
       -
           console.error(chalk.red(`[!] this might be because of a plethora of reasons, but most likely it's due to your IP being rate-limited.`))

     

       134
       -
           console.error(chalk.red(`[!] try again with a new IP address or retry in a day.`))

     

       135
       -
           console.info(chalk.yellow(`[i] not writing to file because we did not receive a valid account object.`))

     

       136
       -
       } else {

     

       137
       -
           const outfile = Deno.args.find(i => i.match(/^(?!-).*$/));

     

       138
       -
           if (!await tryAppendJSON(outfile, account)) {

     

       139
       -
             debug("appending to file failed, printing to stdout instead.")

     

       140
       -
             if (NO_PRETTYPRINT) {

     

       141
       -
               console.log(JSON.stringify(account))

     

       142
       -
             } else {

     

       143
       -
               console.log(account)

     

       144
       -
             }

     

       145
       -
           }

     

       146
       -
       }

+78 -64

utils/nitter-guest-account.py

···

       3
        
       # thank you!

     

       4
        
       import sys

     

       5
        
       import json

     

       0
        
       
     

       0
        
       
     

       6
        
       import typing

     

       7
        
       import traceback

     

       8
        
       from base64 import b64encode

     
···

       256
        
       	success(f'flow token => {flow_token}')

     

       257
        
       

     

       258
        
       	info('Fetching final account object...')

     

       259
       -
       	tasks = send_req('post', TASKS_ENDPOINT, headers=request_headers, json=get_tasks_body(flow_token)).json()

     

       260
       -
       	try:

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       261
        
       		try:

     

       262
       -
       			open_account_task = next(filter(lambda i: i.get('subtask_id') == "OpenAccount", tasks['subtasks']))

     

       263
       -
       			account = open_account_task['open_account']

     

       264
       -
       		except StopIteration:

     

       265
       -
       			debug("resulting tasks =>", format_json(tasks), override=True)

     

       266
       -
       			error("Unable to acquire guest account credentials as it isn't present in the API response.")

     

       267
       -
       			error("This might be because of a wide variety of reasons, but it most likely is due to your IP being rate-limited.")

     

       268
       -
       			error("Try again with a new IP address or in 24 hours after this attempt.")

     

       269
       -
       			return 1

     

       0
        
       
     

       270
        
       

     

       271
       -
       		if args.outfile == "-":

     

       272
       -
       			debug("outfile is `-`, printing to stdout")

     

       273
       -
       			print(format_json(account))

     

       274
       -
       			return 0

     

       0
        
       
     

       275
        
       

     

       276
       -
       		# Sanity checks

     

       277
       -
       		try:

     

       278
       -
       			debug(f"attempting to read file: {args.outfile}")

     

       279
       -
       			with open(args.outfile) as f:

     

       280
       -
       				old_data = json.load(f)

     

       281
       -
       		except FileNotFoundError:

     

       282
       -
       			# that's okay, we might be able to create it later.

     

       283
       -
       			old_data = []

     

       284
       -
       		except PermissionError:

     

       285
       -
       			# that's not okay. we will need to access the file later anyways.

     

       286
       -
       			error("unable to read file due to a permission error.")

     

       287
       -
       			error("please make sure this script has read and write access to the file.")

     

       288
       -
       			print(format_json(account))

     

       289
       -
       			return 1

     

       290
       -
       		except json.JSONDecodeError:

     

       291
       -
       			error("could not parse the provided JSON file.")

     

       292
       -
       			if not prompt_bool("Do you want to overwrite the file?", default=None):

     

       293
       -
       				warn("Not overwriting file, printing to stdout instead.")

     

       294
        
       				print(format_json(account))

     

       295
        
       				return 1

     

       296
       -
       			debug('assuming old data is an empty array because we are overwriting')

     

       297
       -
       			old_data = []

     

       298
       -
       		if type(old_data) != list:

     

       299
       -
       			error("top-level object of the existing JSON file is not a list.")

     

       300
       -
       			error("due to the implementation, the file must be overwritten.")

     

       301
       -
       			if not (prompt_bool("Do you want to overwrite?", default=None)):

     

       302
       -
       				warn("Not overwriting existing data, printing to stdout instead.")

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       303
        
       				print(format_json(account))

     

       304
        
       				return 1

     

       305
       -
       			debug("assuming old data is an empty array because we are overwriting")

     

       306
       -
       			old_data = []

     

       307
       -
       

     

       308
       -
       		old_data.append(account)

     

       0
        
       
     

       309
        
       

     

       310
       -
       		try:

     

       311
       -
       			debug("attempting to write file")

     

       312
       -
       			with open(args.outfile, 'w+') as f:

     

       313
       -
       				f.write(format_json(old_data))

     

       314
       -
       			success(f"successfully written to file {args.outfile}")

     

       315
       -
       			return 0

     

       316
       -
       		except PermissionError:

     

       317
       -
       			error("unable to write to file due to permission error.")

     

       318
       -
       			error("please make sure this script has write access to the file.")

     

       319
       -
       			print(format_json(account))

     

       320
       -
       			return 1

     

       321
       -
       		except Exception as e:

     

       322
       -
       			error("Unable to write to file due to an uncaught error:", e)

     

       323
       -
       			tb = ''.join(traceback.TracebackException.from_exception(e).format())

     

       324
       -
       			debug("exception stacktrace\n" + tb)

     

       325
       -
       			print(format_json(account))

     

       326
        
       

     

       327
       -
       	except Exception:

     

       328
       -
       		debug("resulting tasks =>", format_json(tasks), override=True)

     

       329
       -
       		error("an unhandled error occurred. the tasks object is printed to avoid losing otherwise successful data.")

     

       330
       -
       		error("please file a bug report and attach the traceback below.")

     

       331
       -
       		raise

     

       0
        
       
     

       332
        
       

     

       333
        
       	return 0

     

       334

···

       3
        
       # thank you!

     

       4
        
       import sys

     

       5
        
       import json

     

       6
       +
       import time

     

       7
       +
       import random

     

       8
        
       import typing

     

       9
        
       import traceback

     

       10
        
       from base64 import b64encode

     
···

       258
        
       	success(f'flow token => {flow_token}')

     

       259
        
       

     

       260
        
       	info('Fetching final account object...')

     

       261
       +
       	backoff_time = 0

     

       262
       +
       	exception = None

     

       263
       +
       	for attempt in range(0, 6):

     

       264
       +
       		debug(f"Attempt #{attempt + 1}")

     

       265
       +
       		tasks = send_req('post', TASKS_ENDPOINT, headers=request_headers, json=get_tasks_body(flow_token)).json()

     

       266
        
       		try:

     

       267
       +
       			try:

     

       268
       +
       				open_account_task = next(filter(lambda i: i.get('subtask_id') == "OpenAccount", tasks['subtasks']))

     

       269
       +
       				account = open_account_task['open_account']

     

       270
       +
       			except StopIteration as e:

     

       271
       +
       				backoff_time += random.randint(5000,10000) / 1000

     

       272
       +
       				exception = e

     

       273
       +
       				warn(f"attempt #{attempt + 1} failed to acquire token, retrying in {backoff_time}s.")

     

       274
       +
       				time.sleep(backoff_time)

     

       275
       +
       				continue

     

       276
        
       

     

       277
       +
       			info(f"Attempt #{attempt + 1} succeeded")

     

       278
       +
       			if args.outfile == "-":

     

       279
       +
       				debug("outfile is `-`, printing to stdout")

     

       280
       +
       				print(format_json(account))

     

       281
       +
       				return 0

     

       282
        
       

     

       283
       +
       			# Sanity checks

     

       284
       +
       			try:

     

       285
       +
       				debug(f"attempting to read file: {args.outfile}")

     

       286
       +
       				with open(args.outfile) as f:

     

       287
       +
       					old_data = json.load(f)

     

       288
       +
       			except FileNotFoundError:

     

       289
       +
       				# that's okay, we might be able to create it later.

     

       290
       +
       				old_data = []

     

       291
       +
       			except PermissionError:

     

       292
       +
       				# that's not okay. we will need to access the file later anyways.

     

       293
       +
       				error("unable to read file due to a permission error.")

     

       294
       +
       				error("please make sure this script has read and write access to the file.")

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       295
        
       				print(format_json(account))

     

       296
        
       				return 1

     

       297
       +
       			except json.JSONDecodeError:

     

       298
       +
       				error("could not parse the provided JSON file.")

     

       299
       +
       				if not prompt_bool("Do you want to overwrite the file?", default=None):

     

       300
       +
       					warn("Not overwriting file, printing to stdout instead.")

     

       301
       +
       					print(format_json(account))

     

       302
       +
       					return 1

     

       303
       +
       				debug('assuming old data is an empty array because we are overwriting')

     

       304
       +
       				old_data = []

     

       305
       +
       			if type(old_data) != list:

     

       306
       +
       				error("top-level object of the existing JSON file is not a list.")

     

       307
       +
       				error("due to the implementation, the file must be overwritten.")

     

       308
       +
       				if not (prompt_bool("Do you want to overwrite?", default=None)):

     

       309
       +
       					warn("Not overwriting existing data, printing to stdout instead.")

     

       310
       +
       					print(format_json(account))

     

       311
       +
       					return 1

     

       312
       +
       				debug("assuming old data is an empty array because we are overwriting")

     

       313
       +
       				old_data = []

     

       314
       +
       

     

       315
       +
       			old_data.append(account)

     

       316
       +
       

     

       317
       +
       			try:

     

       318
       +
       				debug("attempting to write file")

     

       319
       +
       				with open(args.outfile, 'w+') as f:

     

       320
       +
       					f.write(format_json(old_data))

     

       321
       +
       				success(f"successfully written to file {args.outfile}")

     

       322
       +
       				return 0

     

       323
       +
       			except PermissionError:

     

       324
       +
       				error("unable to write to file due to permission error.")

     

       325
       +
       				error("please make sure this script has write access to the file.")

     

       326
        
       				print(format_json(account))

     

       327
        
       				return 1

     

       328
       +
       			except Exception as e:

     

       329
       +
       				error("Unable to write to file due to an uncaught error:", e)

     

       330
       +
       				tb = ''.join(traceback.TracebackException.from_exception(e).format())

     

       331
       +
       				debug("exception stacktrace\n" + tb)

     

       332
       +
       				print(format_json(account))

     

       333
        
       

     

       334
       +
       		except Exception:

     

       335
       +
       			debug("resulting tasks =>", format_json(tasks), override=True)

     

       336
       +
       			error("an unhandled error occurred. the tasks object is printed to avoid losing otherwise successful data.")

     

       337
       +
       			error("please file a bug report and attach the traceback below.")

     

       338
       +
       			raise

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       339
        
       

     

       340
       +
       	if exception != None:

     

       341
       +
       		debug("resulting tasks =>", format_json(tasks))

     

       342
       +
       		error("Unable to acquire guest account credentials with 5 attempts as it isn't present in any of the API responses.")

     

       343
       +
       		error("This might be because of a wide variety of reasons, but it most likely is due to your IP being rate-limited.")

     

       344
       +
       		error("Try again with a new IP address or in 24 hours after this attempt.")

     

       345
       +
       		return 1

     

       346
        
       

     

       347
        
       	return 0

     

       348

Compare changes