flake update

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1704099619,
-        "narHash": "sha256-QRVMkdxLmv+aKGjcgeEg31xtJEIsYq4i1Kbyw5EPS6g=",
+        "lastModified": 1706981411,
+        "narHash": "sha256-cLbLPTL1CDmETVh4p0nQtvoF+FSEjsnJTFpTxhXywhQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "7e398b3d76bc1503171b1364c9d4a07ac06f3851",
+        "rev": "652fda4ca6dafeb090943422c34ae9145787af37",
         "type": "github"
       },
       "original": {
@@ -21,13 +21,25 @@
         "type": "github"
       }
     },
+    "local-unstable": {
+      "locked": {
+        "lastModified": 0,
+        "narHash": "sha256-IpDKZGbaoaWizPo0tst5yJ5ZIDwL6iq/juqXjGpQ7jQ=",
+        "path": "/home/giulio/dev/nixpkgs",
+        "type": "path"
+      },
+      "original": {
+        "path": "/home/giulio/dev/nixpkgs",
+        "type": "path"
+      }
+    },
     "nixos-unstable": {
       "locked": {
-        "lastModified": 1704538339,
-        "narHash": "sha256-1734d3mQuux9ySvwf6axRWZRBhtcZA9Q8eftD6EZg6U=",
+        "lastModified": 1708296515,
+        "narHash": "sha256-FyF489fYNAUy7b6dkYV6rGPyzp+4tThhr80KNAaF/yY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "46ae0210ce163b3cba6c7da08840c1d63de9c701",
+        "rev": "b98a4e1746acceb92c509bc496ef3d0e5ad8d4aa",
         "type": "github"
       },
       "original": {
@@ -39,11 +51,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1704795870,
-        "narHash": "sha256-M86cqEn65whEr2JC4yWVJXzGikqpt+2SzcSe3DOiRHQ=",
+        "lastModified": 1708509836,
+        "narHash": "sha256-Gk86rEGzpc4ZtlJs2wqCCpAlDcmVgojazG2FqkHrB6Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "72f7568a6d748d87e878098957077118a6af91f8",
+        "rev": "e837b632e2417b275998501e381be3270afc3ee2",
         "type": "github"
       },
       "original": {
@@ -56,6 +68,7 @@
     "root": {
       "inputs": {
         "home-manager": "home-manager",
+        "local-unstable": "local-unstable",
         "nixos-unstable": "nixos-unstable",
         "nixpkgs": "nixpkgs"
       }

flake.nix

@@ -2,13 +2,14 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/release-23.11";
     nixos-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    local-unstable.url = "path:///home/giulio/dev/nixpkgs";
     home-manager = {
       url = "github:nix-community/home-manager/release-23.11";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
 
-  outputs = { self, nixpkgs, nixos-unstable, home-manager }:
+  outputs = { self, nixpkgs, nixos-unstable, local-unstable, home-manager }:
     let
       sysLinuxX64 = "x86_64-linux";
       sysDarwin = "aarch64-darwin";
@@ -19,9 +20,16 @@
           inherit system;
 
           unstablePkgs = wrapUnstablePkgsSystem { inherit system; };
-          config.allowUnfree = true;
+          localPkgs = import local-unstable {
+            inherit system;
+            config.allowUnfree = true;
+          };
+          config = {
+            allowUnfree = true;
+          };
           overlays = [
             (final: prev: { inherit unstablePkgs; })
+            (final: prev: { inherit localPkgs; })
           ];
         };
 
@@ -29,7 +37,9 @@
         import nixos-unstable {
           inherit system;
 
-          config.allowUnfree = true;
+          config = {
+            allowUnfree = true;
+          };
         };
 
       wrapUtils = { pkgs, unstablePkgs, system }:

hosts/architect/default.nix

@@ -26,34 +26,33 @@ in
     ./matrix.nix
     ./fail2ban.nix
     ./dns.nix
-    ./minecraft.nix
+    # ./minecraft.nix
     ./prowlarr.nix
     ./libreddit.nix
     # ./invidious.nix
     #    ./lidarr.nix
     #    ./navidrome.nix
-    # ./jellyfin.nix
+    ./jellyfin.nix
     # ./prosody.nix
-    ./deluge.nix
+    # ./deluge.nix
     #./calibre.nix
     ./docker.nix
     # ./keycloak.nix
     #    ./runas.nix
     ./tailscale.nix
     # ./searx.nix
-    ./plex.nix
+    # ./plex.nix
     ./headscale.nix
     ./llm.nix
-    ./photoprism.nix
+    # ./photoprism.nix
+    ./sunshine.nix
   ];
 
   architect = {
     networks.lan = {
-      interface = "enp5s0";
+      interface = "enp6s0";
       net = "10.0.0.0/24";
       devices = {
-        vodafoneStation = { address = "192.168.1.1"; hostname = "vodafone.station"; };
-
         architect = { address = "10.0.0.250"; hostname = "architect.${domain}"; };
         router = { address = "10.0.0.1"; hostname = "router.${domain}"; };
         dvr = { address = "10.0.0.3"; hostname = "dvr.${domain}"; };
@@ -62,11 +61,10 @@ in
 
     firewall = {
       openTCP = [ 22 ];
-      openTCPVPN = [ 22 ];
     };
   };
 
-  time.timeZone = "Europe/Rome";
+  time.timeZone = "Europe/London";
   users.users.giulio.openssh.authorizedKeys.keys = pubkeys;
   boot = {
     initrd = {
@@ -84,9 +82,6 @@ in
 
     kernelParams = with config.architect.networks.lan; [
       "ip=${devices.architect.address}::${devices.router.address}:255.255.255.0::${interface}:off"
-      "nvme_core.default_ps_max_latency_us=5500"
-      "zfs_arc_max=1073741824"
-      "memmap=32M$0x4ca6f9478"
     ];
 
     kernelPackages = pkgs.linuxPackages;
@@ -116,8 +111,8 @@ in
         address = devices.architect.address;
         prefixLength = 24;
       }];
-      enp6s0.useDHCP = false;
-      wlp4s0.useDHCP = false;
+      # enp6s0.useDHCP = false;
+      # wlp4s0.useDHCP = false;
     };
     extraHosts = (generateDeviceStrings config.architect.networks.lan.devices) + ''
 
@@ -169,7 +164,6 @@ in
 
   environment = {
     variables = { LIBVA_DRIVER_NAME = "vdpau"; };
-    systemPackages = with pkgs; [ cachix linuxPackages.usbip ];
   };
 }
 

hosts/architect/dns.nix

@@ -63,7 +63,7 @@ in
     dnscrypt-proxy2 = {
       enable = true;
       settings = {
-        listen_addresses = [ "127.0.0.1:5353" ];
+        listen_addresses = [ "127.0.0.1:5354" ];
         ipv4_servers = true;
         ipv6_servers = false;
         block_ipv6 = true;

hosts/architect/docker.nix

@@ -16,8 +16,8 @@
       '';
       enableOnBoot = false;
       daemon.settings.iptables = false;
+      enableNvidia = true;
     };
   };
-
   users.users.giulio.extraGroups = [ "docker" ];
 }

hosts/architect/hardware.nix

@@ -1,57 +1,69 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{ config, lib, modulesPath, ... }:
 
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/28ce6650-de21-4c1d-ae42-95d1e3507740";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/B790-869D";
-    fsType = "vfat";
-  };
-
   hardware.cpu.amd.updateMicrocode =
     lib.mkDefault config.hardware.enableRedistributableFirmware;
 
-  fileSystems."/media" = {
-    device = "datapool/media";
-    fsType = "zfs";
+  environment.etc."crypttab".text = ''
+    backedNvme /dev/disk/by-uuid/92cfaa4a-82a1-4336-b552-b7f4f3c68613 /newdrive.key
+  '';
+
+  boot = {
+    kernelModules = [ "kvm-amd" "dm-snapshot" ];
+    initrd = {
+      luks.devices = {
+        # backedNvme = {
+        #   device = "/dev/disk/by-uuid/92cfaa4a-82a1-4336-b552-b7f4f3c68613";
+        #   keyFile = "/newdrive.key";
+        #   allowDiscards = true;
+
+        # };
+        root = {
+          device = "/dev/disk/by-uuid/bdd5f111-ecec-48d8-861f-94083098c724";
+          preLVM = true;
+          allowDiscards = true;
+          fallbackToPassword = true;
+        };
+      };
+      availableKernelModules =
+        [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+    };
   };
 
-  fileSystems."/secrets" = {
-    device = "backedpool/secrets";
-    fsType = "zfs";
-  };
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-uuid/28ce6650-de21-4c1d-ae42-95d1e3507740";
+      fsType = "ext4";
+    };
 
-  fileSystems."/services" = {
-    device = "backedpool/services";
-    fsType = "zfs";
+    "/boot" = {
+      device = "/dev/disk/by-uuid/B790-869D";
+      fsType = "vfat";
+    };
+
+    "/backednvme" = {
+      device = "/dev/mapper/backedNvme";
+    };
+
+    "/services" = {
+      device = "/backednvme/services";
+      options = [ "bind" ];
+    };
+
+    "/secrets" = {
+      device = "/backednvme/secrets";
+      options = [ "bind" ];
+    };
+
+    "/media" = {
+      device = "nvmedata/media";
+      fsType = "zfs";
+    };
   };
+  
   swapDevices = [{
     device = "/swapfile";
     size = 1024 * 64;
   }];
-
-  boot = {
-    initrd.luks.devices = {
-      root = {
-        device = "/dev/disk/by-uuid/bdd5f111-ecec-48d8-861f-94083098c724";
-        preLVM = true;
-        allowDiscards = true;
-        fallbackToPassword = true;
-      };
-    };
-    initrd.availableKernelModules =
-      [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
-    initrd.kernelModules = [ "dm-snapshot" ];
-  };
 }

hosts/architect/headscale.nix

@@ -26,7 +26,8 @@ in
   services.headscale = {
     enable = true;
     package = headscalePkg;
-
+    port = 1194;
+    
     settings = {
       server_url = "https://${domain}";
       log.level = "debug";

hosts/architect/llm.nix

@@ -2,13 +2,13 @@
 
 let
   domain = "pino.giugl.io";
-  backendPort = 3000;
-  frontendPort = 3002;
-  llama-cpp = pkgs.unstablePkgs.llama-cpp.override { cudaSupport = true; };
-  ollama = pkgs.unstablePkgs.ollama.override { inherit llama-cpp; };
+  backendPort = 8080;
+  frontendPort = 3030;
+  # llama-cpp = pkgs.unstablePkgs.llama-cpp.override { cudaSupport = true; };
+  # ollama = pkgs.unstablePkgs.ollama.override { inherit llama-cpp; };
 in
 {
-  environment.systemPackages = [ ollama ];
+  # environment.systemPackages = [ ollama ];
   architect.vhost.${domain} = {
     dnsInterfaces = [ "tailscale" ];
 
@@ -16,25 +16,69 @@ in
       host = "172.17.0.1";
       port = frontendPort;
       allowLan = true;
-      allow = [ config.architect.networks."tailscale".net ];
+      allowWAN = true;
+      # allow = [ config.architect.networks."tailscale".net ];
+      extraConfig = ''
+        proxy_read_timeout 600s;
+      '';
+    };
+  };
+
+  architect.vhost."ollama.giugl.io" = {
+    dnsInterfaces = [ "tailscale" ];
+
+    locations."/" = {
+      host = "172.17.0.1";
+      port = 11434;
+      allowLan = true;
+      allowWAN = true;
+      # allow = [ config.architect.networks."tailscale".net ];
+      extraConfig = ''
+        proxy_read_timeout 600s;
+      '';
     };
   };
 
   virtualisation.oci-containers = {
     containers = {
-      big-agi = {
-        image = "ghcr.io/enricoros/big-agi:latest";
+      ollama-webui = {
+        image = "ghcr.io/open-webui/open-webui:main";
         autoStart = true;
 
         ports = [
           "172.17.0.1:${toString frontendPort}:${toString backendPort}"
         ];
-        environmentFiles = [
-          "/var/lib/llm/big-agi.env"
-        ];
+
+        environment = {
+          PORT = "${toString backendPort}";
+          OLLAMA_API_BASE_URL = "http://172.17.0.1:11434/api";
+        };
+
         extraOptions = [
           "--pull=always"
         ];
+        volumes = [
+          "/var/lib/ollama-webui:/app/backend/data"
+        ];
+      };
+
+      ollama = {
+        image = "ollama/ollama:latest";
+        autoStart = true;
+        extraOptions = [
+          "--pull=always"
+          "--gpus=all"
+        ];
+        environment = {
+          OLLAMA_ORIGINS = "*";
+        };
+        volumes = [
+          "/ollama:/root/.ollama"
+        ];
+        ports = [
+          "127.0.0.1:11434:11434"
+          "172.17.0.1:11434:11434"
+        ];
       };
     };
   };

hosts/architect/sunshine.nix

@@ -0,0 +1,173 @@
+{ pkgs, ... }:
+
+let
+  user = "sunshine";
+  resolutionScript = pkgs.writeTextFile {
+    name = "sunshine-resolution-script";
+    text = ''
+      #!/usr/bin/env bash      
+      
+      width=''${1:-1920}
+      height=''${2:-1080}
+      refresh_rate=''${3:-120}
+
+      # Get the modeline info from the 2nd row in the cvt output
+      modeline=$(cvt ''${width} ''${height} ''${refresh_rate} | gawk 'FNR == 2')
+      xrandr_mode_str=''${modeline//Modeline \"*\" /}
+      mode_alias="''${width}x''${height}"
+
+      echo "xrandr setting new mode ''${mode_alias} ''${xrandr_mode_str}" 
+      xrandr --rmmode ''${mode_alias} 
+      xrandr --newmode ''${mode_alias} ''${xrandr_mode_str}
+      xrandr --addmode DP-0 ''${mode_alias}
+
+      # Apply new xrandr mode
+      xrandr --output DP-0 --primary --mode ''${mode_alias} --pos 0x0 --rotate normal
+    '';
+    executable = true;
+    destination = "/bin/resolution.sh";
+  };
+  configFile = pkgs.writeText "sunshine.conf"
+    ''
+      output_name=1
+      origin_web_ui_allowed=lan
+      channels=2
+      min_threads=12
+      global_prep_cmd=[{"do":"${pkgs.bash}/bin/bash -c \"${resolutionScript}/bin/resolution.sh ''${SUNSHINE_CLIENT_WIDTH} ''${SUNSHINE_CLIENT_HEIGHT} ''${SUNSHINE_CLIENT_FPS}\""}]
+    '';
+  sunshineOverride = pkgs.sunshine.override { cudaSupport = true; stdenv = pkgs.cudaPackages.backendStdenv; };
+in
+{
+  security = {
+    polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+          if (action.id == "org.freedesktop.login1.suspend" ||
+              action.id == "org.freedesktop.login1.suspend-multiple-sessions" ||
+              action.id == "org.freedesktop.login1.hibernate" ||
+              action.id == "org.freedesktop.login1.hibernate-multiple-sessions")
+          {
+              return polkit.Result.NO;
+          }
+      });
+    '';
+  };
+
+  systemd.targets = {
+    sleep.enable = false;
+    suspend.enable = false;
+    hibernate.enable = false;
+    hybrid-sleep.enable = false;
+  };
+
+  environment.systemPackages = with pkgs; [
+    sunshineOverride
+    xorg.xrandr
+    xorg.xorgserver
+    xorg.libxcvt
+  ];
+  sound.enable = true;
+
+  services.xserver = {
+    enable = true;
+    videoDrivers = [ "nvidia" ];
+
+    displayManager = {
+      sddm = {
+        enable = true;
+        wayland.enable = false;
+        autoLogin.relogin = true;
+      };
+      autoLogin = {
+        inherit user;
+        enable = true;
+      };
+    };
+    desktopManager.xfce.enable = true;
+
+    monitorSection = ''
+      HorizSync       5.0 - 1000.0
+      VertRefresh     5.0 - 1000.0
+      Option         "DPMS"
+
+      # 2240x1290 @ 30.00 Hz (GTF) hsync: 39.39 kHz; pclk: 113.44 MHz
+      Modeline "2240x1290_30.00"  113.44  2240 2328 2560 2880  1290 1291 1294 1313  -HSync +Vsync
+      # 2240x1290 @ 60.00 Hz (GTF) hsync: 80.10 kHz; pclk: 243.50 MHz
+      Modeline "2240x1290_60.00"  243.50  2240 2400 2640 3040  1290 1291 1294 1335  -HSync +Vsync
+      # 2240x1290 @ 120.00 Hz (GTF) hsync: 165.84 kHz; pclk: 517.42 MHz
+      Modeline "2240x1290_120.00"  517.42  2240 2432 2680 3120  1290 1291 1294 1382  -HSync +Vsync
+      # 2800x1290 @ 30.00 Hz (GTF) hsync: 39.39 kHz; pclk: 141.80 MHz
+      Modeline "2800x1290_30.00"  141.80  2800 2912 3200 3600  1290 1291 1294 1313  -HSync +Vsync
+      # 2800x1290 @ 60.00 Hz (GTF) hsync: 80.10 kHz; pclk: 303.74 MHz
+      Modeline "2800x1290_60.00"  303.74  2800 2992 3296 3792  1290 1291 1294 1335  -HSync +Vsync
+      # 2800x1290 @ 120.00 Hz (GTF) hsync: 165.84 kHz; pclk: 647.44 MHz
+      Modeline "2800x1290_120.00"  647.44  2800 3040 3352 3904  1290 1291 1294 1382  -HSync +Vsync
+    '';
+
+    deviceSection = ''
+      VendorName  "NVIDIA Corporation"
+      Option      "CustomEDID" "DFP-1:/etc/X11/120edid.bin"
+      Option "ConnectedMonitor" "DFP-1"
+    '';
+
+    screenSection = ''
+      Monitor         "Configured Monitor"
+      DefaultDepth    24
+
+      Option "ModeValidation" "NoVertRefreshCheck, NoHorizSyncCheck, NoMaxSizeCheck, NoMaxPClkCheck, AllowNonEdidModes, NoEdidMaxPClkCheck"
+      
+      SubSection     "Display"
+          Depth       24
+      EndSubSection
+    '';
+  };
+
+  # Sunshine user, service and config 
+  users.users.${user} = {
+    isNormalUser = true;
+    home = "/home/${user}";
+    description = "Sunshine Server";
+    extraGroups = [ "wheel" "networkmanager" "input" "video" "sound" ];
+    openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC1we38/N+t8Ah5yrLof8QUwhrob7/VXFKIddaJeOVBLuDVnW7ljiAtdtEiL69D/DV4Ohmt5wMvkAAjfuHmim6FD9A6lzPbSU4KH9W2dcckszKbbI636kuDwem/xui6BW3wJa6P+0xW5ksygEAkzcK2PXuC2b4B9uwhuUdKahiGMKDxISG/WianqAe72cGMfNkYvion3Y1VsMLUdm48d2ABnxNpr7NI9B5iJ8dziOft9gpgfz13CCQRlReo75gk/4xI+vSNrQp7eR+wzJy2/dZg/T8jtyA9Q6jVxrxBpqQ1LNXkAKaJkGo9OabF6Wgpzp+YTAurL4nwR2NaJxwFuyoKvACQy0ai4jrS3206gC6JXZv8ktZMZrwUN+jPqCwfgh5qObFkAqKCxbp52ioDek2MQLdOvzQBX//DBhGEp5rzHGLZ3vhRIiiQiaof5sF5zWiYDW5mqezSPNxJPX/BrTP/Wbs/jpwTLBh3wytiia0S1WXQmya89bqzTPFiDWvTRA62EVKB/JaQtPQQOFAxWwg799DMycPeZ81xttZOyMtI/MZSddyqx2S8fWGwvToZQvuZ38mSIpFseLM1IkgabRIrAmat5SBNGGy9Dqa0eMEa7bwIY/4CMB1y6HMTnaoMXA6cnQfHMoB/zyTZ6oTXIeqeOyiZsK+RN0Mvahj8mXi7dw== giulio@giulio-X230" ];
+  };
+
+
+  systemd.user.services.${user} = {
+    description = "Sunshine server";
+    wantedBy = [ "graphical-session.target" ];
+    startLimitIntervalSec = 500;
+    startLimitBurst = 5;
+    partOf = [ "graphical-session.target" ];
+    wants = [ "graphical-session.target" ];
+    after = [ "graphical-session.target" ];
+    path = [ resolutionScript pkgs.xorg.xrandr pkgs.bash pkgs.xorg.libxcvt pkgs.xorg.xorgserver pkgs.gawk ];
+    serviceConfig = {
+      ExecStart = "${sunshineOverride}/bin/sunshine ${configFile}";
+      Restart = "on-failure";
+      RestartSec = "5s";
+    };
+  };
+
+  services.avahi.publish.userServices = true;
+  boot.kernelModules = [ "uinput" ];
+
+  programs.steam.enable = true;
+
+  hardware = {
+    pulseaudio.enable = true;
+    opengl = {
+      enable = true;
+      driSupport = true;
+      driSupport32Bit = true;
+    };
+
+    nvidia = {
+      modesetting.enable = true;
+      powerManagement.enable = false;
+      powerManagement.finegrained = false;
+      open = false;
+      nvidiaSettings = true;
+    };
+  };
+
+  users.groups.media.members = [ user ];
+}

roles/common.nix

@@ -52,5 +52,6 @@
     ripgrep
     jq
     helix
+    poetry
   ];
 }