Updated lock

cachix.nix

@@ -11,4 +11,3 @@ in {
   inherit imports;
   nix.binaryCaches = ["https://cache.nixos.org/"];
 }
-    

cachix/ropfuscator.nix

@@ -9,4 +9,3 @@
     ];
   };
 }
-    

flake.lock

@@ -1,5 +1,36 @@
 {
   "nodes": {
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1650374568,
+        "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1656928814,
+        "narHash": "sha256-RIFfgBuKz6Hp89yRr7+NR5tzIAbn52h8vT6vXkYjZoM=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "7e2a3b3dfd9af950a856d66b0a7d01e3c18aa249",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -7,48 +38,64 @@
         ]
       },
       "locked": {
-        "lastModified": 1639871969,
+        "lastModified": 1665475263,
-        "narHash": "sha256-6feWUnMygRzA9tzkrfAzpA5/NBYg75bkFxnqb1DtD7E=",
+        "narHash": "sha256-T4at7d+KsQNWh5rfjvOtQCaIMWjSDlSgQZKvxb+LcEY=",
         "owner": "rycee",
         "repo": "home-manager",
-        "rev": "697cc8c68ed6a606296efbbe9614c32537078756",
+        "rev": "17208be516fc36e2ab0ceb064d931e90eb88b2a3",
         "type": "github"
       },
       "original": {
         "owner": "rycee",
-        "ref": "release-21.11",
+        "ref": "release-22.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
     "nixos-unstable": {
       "locked": {
-        "lastModified": 1639699734,
+        "lastModified": 1665672983,
-        "narHash": "sha256-tlX6WebGmiHb2Hmniff+ltYp+7dRfdsBxw9YczLsP60=",
+        "narHash": "sha256-V7Va7CRKmQRy95xSdlga5nV7q3/PusZwNAF/leb5PcU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "03ec468b14067729a285c2c7cfa7b9434a04816c",
+        "rev": "bb2fb1524795f2d720cd13a2eb4d35d3a7a0d888",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-unstable",
+        "ref": "master",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1639794673,
+        "lastModified": 1665596265,
-        "narHash": "sha256-bjauV0+Z4WmxeiHXecyiEOEwo+XysO6kx36beeatbl0=",
+        "narHash": "sha256-H7Ku1SF+7zDEqw8QOyEDA5blMJQW9MvdfgB+K3KJNLw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2627c4b795107ba94562626925f5a9a2bc62ebc6",
+        "rev": "9234f5a17e1a7820b5e91ecd4ff0de449e293383",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-21.11",
+        "ref": "nixos-22.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1659190188,
+        "narHash": "sha256-LudYrDFPFaQMW0l68TYkPWRPKmqpxIFU1nWfylIp9AQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a3fddd46a7f3418d7e3940ded94701aba569161d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -57,7 +104,28 @@
       "inputs": {
         "home-manager": "home-manager",
         "nixos-unstable": "nixos-unstable",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs",
+        "vim-extra-plugins": "vim-extra-plugins"
+      }
+    },
+    "vim-extra-plugins": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1665671907,
+        "narHash": "sha256-+YXxqH7OROLJ9G4va5BZb4a8aIzulaUZbnH+R1iWoaw=",
+        "owner": "m15a",
+        "repo": "nixpkgs-vim-extra-plugins",
+        "rev": "6c1624b0942cdecf7f30aa4d411cb3578bc29a38",
+        "type": "github"
+      },
+      "original": {
+        "owner": "m15a",
+        "repo": "nixpkgs-vim-extra-plugins",
+        "type": "github"
       }
     }
   },

flake.nix

@@ -1,22 +1,26 @@
 {
   inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-21.11";
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.05";
-    nixos-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixos-unstable.url = "github:NixOS/nixpkgs/master";
     home-manager = {
-      url = "github:rycee/home-manager/release-21.11";
+      url = "github:rycee/home-manager/release-22.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    navidrome.url = "github:antifuchs/nixpkgs/fix-151550";
+    vim-extra-plugins.url = "github:m15a/nixpkgs-vim-extra-plugins";
   };
 
-  outputs = inputs@{ self, nixpkgs, nixos-unstable, home-manager, navidrome}:
+  outputs =
+    inputs@{ self, nixpkgs, nixos-unstable, home-manager, vim-extra-plugins }:
     let
       system = "x86_64-linux";
 
       pkgs = import nixpkgs {
         inherit system;
         config.allowUnfree = true;
-        overlays = [ (final: prev: { inherit unstable; }) ];
+        overlays = [
+          (final: prev: { inherit unstable; })
+          vim-extra-plugins.overlays.default
+        ];
       };
 
       unstable = import nixos-unstable {
@@ -38,13 +42,6 @@
             user = "giulio";
             roles = [ ];
           }];
-          imports = [
-            {
-              disabledModules = [ "services/audio/navidrome.nix" ];
-              imports =
-                [ (navidrome + "/nixos/modules/services/audio/navidrome.nix") ];
-            }
-          ];
         };
         gAluminum = host.mkHost {
           name = "gAluminum";

hosts/architect/backup.nix

@@ -7,7 +7,7 @@
       passwordFile = "/secrets/restic/data.key";
       environmentFile = "/secrets/restic/credentials.txt";
       repository = "b2:architect:/";
-      paths = [ "/var/lib" "/secrets" ];
+      paths = [ "/var/lib" "/secrets" "/services" ];
       pruneOpts = [
         "--keep-daily 45"
         "--keep-weekly 12"
@@ -15,8 +15,8 @@
         "--keep-yearly 3"
       ];
       timerConfig = {
-        OnCalendar = "monday 00:05";
+        OnCalendar = "monday 03:00";
-        RandomizedDelaySec = "2h";
+        RandomizedDelaySec = "1h";
       };
     };
   };

hosts/architect/calibre.nix

@@ -0,0 +1,35 @@
+{ lib, ... }:
+
+let
+  domain = "books.giugl.io";
+  network = import ./network.nix;
+in {
+  services = {
+    calibre-web = {
+      enable = true;
+      group = "media";
+      options = {
+        enableBookConversion = true;
+        enableBookUploading = true;
+      };
+    };
+
+    nginx.virtualHosts.${domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:8083";
+        extraConfig = ''
+          client_max_body_size 500M;
+        '';
+      };
+    };
+  };
+
+  networking.extraHosts = ''
+    ${network.architect-lan} ${domain}
+    ${network.architect-wg} ${domain}
+  '';
+
+  users.groups.media.members = [ "calibre-web" ];
+}

hosts/architect/default.nix

@@ -25,35 +25,27 @@ in {
     ./dns.nix
     #    ./minecraft.nix
     ./prowlarr.nix
-    ./plex.nix
+    #    ./plex.nix
-    ./githubrunner.nix
+    #./githubrunner.nix
     ./libreddit.nix
     ./invidious.nix
     ./nitter.nix
     ./ccache.nix
     ./lidarr.nix
-    ./navidrome.nix
+#    ./navidrome.nix
     ./jellyfin.nix
     ./prosody.nix
     ./deluge.nix
+    #    ./calibre.nix
+    ../../cachix.nix
+    ./docker.nix
   ];
 
+  nixpkgs.config.permittedInsecurePackages = [ "nodejs-12.22.12" ];
   time.timeZone = "Europe/Rome";
   system.stateVersion = "21.11"; # Did you read the comment?
   users.users.giulio.openssh.authorizedKeys.keys = pubkeys;
-
-  services.fwupd.enable = true;
   boot = {
-    kernelParams = [
-      "ip=${network.architect-lan}::10.0.0.1:255.255.255.0::${network.wan-if}:off"
-      "nvme_core.default_ps_max_latency_us=5500"
-    ];
-
-    kernel.sysctl= {
-      "net.ipv4.ip_forward" = 1;
-      "fs.protected_regular" = 0;
-    };
-
     initrd = {
       availableKernelModules = [ "igc" "r8169" ];
       network = {
@@ -61,19 +53,30 @@ in {
         ssh = {
           enable = true;
           port = 22;
-          hostKeys = [ /boot/ssh_host_rsa_key ];
+          hostKeys = [ /secrets/ssh_host_rsa_key ];
           authorizedKeys = pubkeys;
         };
 
-        postCommands = ''
+       # postCommands = ''
-          zpool import backedpool
+       #   zpool import backedpool -f
-          zpool import zpool
+       #   zpool import zpool -f
 
-          mkdir /mnt-root
+       #   echo "zfs load-key -ar; killall zfs" >> /root/.profile
-          echo "zfs load-key -ar; mount -t zfs zpool/nixos/root /mnt-root; zfs load-key -a; umount /mnt-root; rmdir /mnt-root; killall zfs" >> /root/.profile
+       # '';
-        '';
       };
     };
+  };
+
+  services.fwupd.enable = true;
+  boot = {
+    kernelParams = [
+      "ip=${network.architect-lan}::10.0.0.1:255.255.255.0::${network.wan-if}:off"
+      "nvme_core.default_ps_max_latency_us=5500"
+      "zfs_arc_max=1073741824"
+      "memmap=32M$0x4ca6f9478"
+    ];
+
+    kernel.sysctl = { "net.ipv4.ip_forward" = 1; };
 
     loader = {
       systemd-boot = {
@@ -146,7 +149,10 @@ in {
     openssh = {
       enable = true;
       passwordAuthentication = false;
-      challengeResponseAuthentication = false;
+      kbdInteractiveAuthentication = false;
+      extraConfig = ''
+        MaxAuthTries 15
+      '';
     };
     smartd.enable = true;
   };

hosts/architect/dns.nix

@@ -1,10 +1,16 @@
 { config, pkgs, lib, ... }:
 
+let 
+  adguard_webui_port = 3031;
+  adguard_dns_port = "5300";
+  dnscrypt_listen_port = "5353";
+in
 {
   services = {
     dnsmasq = {
       enable = true;
-      servers = [ "127.0.0.1#5300" ];
+      # adguard port
+      servers = [ "127.0.0.1#${adguard_dns_port}" ];
       extraConfig = ''
         localise-queries
         min-cache-ttl=120
@@ -14,13 +20,13 @@
 
     adguardhome = {
       enable = true;
-      port = 3031;
+      port = adguard_webui_port;
     };
 
     dnscrypt-proxy2 = {
       enable = true;
       settings = {
-        listen_addresses = [ "127.0.0.1:5353" ];
+        listen_addresses = [ "127.0.0.1:${dnscrypt_listen_port}" ];
         ipv4_servers = true;
         ipv6_servers = false;
         block_ipv6 = true;

hosts/architect/docker.nix

@@ -0,0 +1,10 @@
+{
+#  virtualisation.docker = {
+#    enable = true;
+#    extraOptions = ''
+#      --dns 127.0.0.1 --dns 10.0.0.250 --data-root /docker
+#    '';
+#    enableOnBoot = false;
+#  };
+  users.users.giulio.extraGroups = [ "docker" ];
+}

hosts/architect/firewall.nix

@@ -3,28 +3,48 @@
 with import ./network.nix;
 
 let
+  # TCP services
+  ssh_tcp = 22;
+  http_tcp = 80;
+  https_tcp = 443;
+  synapse_tcp = 8448;
+  gitea_tcp = 10022;
+  prosody_tcp = 5222; 
+  minecraft_tcp = 25565;
+
+  # UDP services
+  dns_udp = 53;
+  wireguard_udp = 1194;
+  
+  # TCP/UDP services
+  torrent_a = 51413;
+  torrent_b = 51414;
+
+  # grouping
   open_tcp_ports = lib.concatMapStringsSep "," (x: toString x) [
-    22 # ssh
+    ssh_tcp
-    80 # http
+    http_tcp
-    443 # https
+    https_tcp
-    8448 # matrix
+    synapse_tcp
-    10022 # gitea
+    gitea_tcp
-    18080 # monero
+    torrent_a
-    51413 # transmission
+    torrent_b
   ];
   open_udp_ports = lib.concatMapStringsSep "," (x: toString x) [
-    1194 # wireguard
+    wireguard_udp
-    51413 # transmission
+    torrent_a
+    torrent_b
   ];
   open_tcp_ports_vpn = lib.concatMapStringsSep "," (x: toString x) [
-    22
+    ssh_tcp
-    80
+    http_tcp
-    443
+    https_tcp
-    32400 # plex
+    prosody_tcp
+    minecraft_tcp
   ];
   open_udp_ports_vpn = lib.concatMapStringsSep "," (x: toString x) [
-    53 # dns
+    dns_udp
-    1194 # vpn
+    wireguard_udp
   ];
 
 in {
@@ -64,6 +84,7 @@ in {
                     oifname ${wan-if} ip saddr {${
                       lib.concatStringsSep "," towan-wg
                     }} masquerade
+                    oifname ${wan-if} ip saddr ${docker-net} masquerade
                   }
                 }
 
@@ -78,6 +99,7 @@ in {
                     iifname ${wan-if} accept comment "bind any ip to intf ${wan-if}"
                     iifname ${proxy-if} ip saddr ${proxy-net} accept comment "bind ip ${proxy-net} to intf ${proxy-if}"
                     iifname ${vpn-if} ip saddr ${vpn-net} accept comment "bind ip ${vpn-net} to intf ${vpn-if}"
+                    iifname ${docker-if} ip saddr ${docker-net} accept comment "bind ip ${docker-net} to intf ${docker-if}"
                     iifname "lo" accept comment "bind any ip to intf lo"
                     jump mangle_drop
                   }
@@ -139,7 +161,7 @@ in {
                     iifname ${vpn-if} tcp dport {${open_tcp_ports_vpn}} accept
                     iifname ${vpn-if} udp dport {${open_udp_ports_vpn}} accept
                     iifname ${vpn-if} icmp type echo-request accept
-
+                    iifname ${docker-if} udp dport 53 accept
                     jump filter_drop
                   }
 
@@ -165,6 +187,8 @@ in {
                       lib.concatStringsSep "," towan-wg
                     }} accept
                     
+                    oifname ${wan-if} ip saddr ${docker-net} accept
+                    
                     jump filter_drop
                   }
 

hosts/architect/hardware.nix

@@ -6,22 +6,22 @@
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules =
-    [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" = {
-    device = "zpool/nixos/root";
+    device = "/dev/disk/by-uuid/28ce6650-de21-4c1d-ae42-95d1e3507740";
-    fsType = "zfs";
+    fsType = "ext4";
   };
 
-  fileSystems."/home" = {
+  fileSystems."/boot" = {
-    device = "zpool/data/home";
+    device = "/dev/disk/by-uuid/B790-869D";
-    fsType = "zfs";
+    fsType = "vfat";
   };
 
+  hardware.cpu.amd.updateMicrocode =
+    lib.mkDefault config.hardware.enableRedistributableFirmware;
+
   fileSystems."/media" = {
     device = "datapool/media";
     fsType = "zfs";
@@ -32,19 +32,26 @@
     fsType = "zfs";
   };
 
-  fileSystems."/var/lib" = {
+  fileSystems."/services" = {
     device = "backedpool/services";
     fsType = "zfs";
   };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/AF19-5616";
-    fsType = "vfat";
-  };
-
   swapDevices = [{
-    device = "/dev/sdc1";
+    device = "/swapfile";
-    size = 10000;
+    size = 1024 * 64; 
   }];
 
+  boot = {
+    initrd.luks.devices = {
+      root = {
+        device = "/dev/disk/by-uuid/bdd5f111-ecec-48d8-861f-94083098c724";
+        preLVM = true;
+        allowDiscards = true;
+        fallbackToPassword = true;
+      };
+    };
+    initrd.availableKernelModules =
+      [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+    initrd.kernelModules = [ "dm-snapshot" ];
+  };
 }

hosts/architect/hardware.nix.bk

@@ -0,0 +1,50 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules =
+    [ "nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "zpool/nixos/root";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "zpool/data/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/media" = {
+    device = "datapool/media";
+    fsType = "zfs";
+  };
+
+  fileSystems."/secrets" = {
+    device = "backedpool/secrets";
+    fsType = "zfs";
+  };
+
+  fileSystems."/var/lib" = {
+    device = "backedpool/services";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/AF19-5616";
+    fsType = "vfat";
+  };
+
+#  swapDevices = [{
+#    device = "/dev/sdc1";
+#    size = 10000;
+#  }];
+
+}

hosts/architect/home-assistant.nix

@@ -0,0 +1,66 @@
+{ lib, config, pkgs, ... }:
+
+let
+  domain = "home.giugl.io";
+  network = import ./network.nix;
+  host = "127.0.0.1";
+  port = 8123;
+in {
+  services = {
+    mosquitto = {
+      enable = true;
+      listeners = [{
+        acl = [ "pattern readwrite #" ];
+        omitPasswordAuth = true;
+        settings.allow_anonymous = true;
+      }];
+    };
+    home-assistant = {
+      enable = true;
+      extraComponents = [
+        # Components required to complete the onboarding
+        "met"
+        "radio_browser"
+      ];
+      config = {
+        default_config = { };
+
+        http = {
+          server_port = port;
+          server_host = host;
+          trusted_proxies = [ host ];
+          use_x_forwarded_for = true;
+        };
+
+        homeassistant = {
+          name = "Manduria";
+          latitude = 40.4;
+          longitude = 17.63;
+          unit_system = "metric";
+          time_zone = "Europe/Rome";
+          external_url = "http://${domain}";
+        };
+      };
+    };
+
+    nginx.virtualHosts.${domain} = {
+      #      forceSSL = true;
+      #      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${host}:${toString port}";
+        extraConfig = ''
+            proxy_set_header    Upgrade     $http_upgrade;
+            proxy_set_header    Connection  "upgrade";
+          allow 10.0.0.0/24;
+          ${lib.concatMapStrings (x: "allow ${x};") network.gdevices-wg}
+          deny all;
+        '';
+      };
+    };
+  };
+
+  networking.extraHosts = ''
+    ${network.architect-lan} ${domain}
+    ${network.architect-wg} ${domain}
+  '';
+}

hosts/architect/jellyfin.nix

@@ -2,7 +2,7 @@
 
 let
   network = import ./network.nix;
-  domain = "jellyfin.giugl.io";
+  domain = "media.giugl.io";
 in {
   disabledModules = [ "services/misc/jellyfin.nix" ];
   imports = [ ./modules/jellyfin.nix ];
@@ -15,15 +15,32 @@ in {
     };
 
     nginx.virtualHosts.${domain} = {
-#      forceSSL = true;
+      forceSSL = true;
-#      enableACME = true;
+      enableACME = true;
+      extraConfig = ''
+        # External Javascript (such as cast_sender.js for Chromecast) must be whitelisted.
+        #add_header Content-Security-Policy "default-src https: data: blob: http://image.tmdb.org; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js https://www.gstatic.com/eureka/clank/95/cast_sender.js https://www.gstatic.com/eureka/clank/96/cast_sender.js https://www.gstatic.com/eureka/clank/97/cast_sender.js https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'";
+        # Disable buffering when the nginx proxy gets very resource heavy upon streaming
+        proxy_buffering off;
+      '';
+
       locations."/" = {
         proxyPass = "http://localhost:8096";
-        extraConfig = ''
+#        extraConfig = ''
-          allow 10.0.0.0/24;
+#          allow 10.0.0.0/24;
-          allow 10.3.0.0/24;
+#          allow 10.3.0.0/24;
-          deny all;
+#          deny all;
-        '';
+#        '';
+      };
+
+      locations."/socket" = {
+        proxyPass = "http://localhost:8096";
+        proxyWebsockets = true;
+#        extraConfig = ''
+#          allow 10.0.0.0/24;
+#          allow 10.3.0.0/24;
+#          deny all;
+#        '';
       };
     };
   };

hosts/architect/matrix.nix

@@ -4,12 +4,14 @@ let
   domain = "matrix.giugl.io";
   webui_domain = "chat.giugl.io";
   network = import ./network.nix;
+  db_name = "matrix-synapse";
 in {
   services = {
     matrix-synapse = {
       enable = true;
+      settings = {
         server_name = "${domain}";
-      database_name = "synapse";
+        database_name = db_name;
         public_baseurl = "https://${domain}";
         registration_shared_secret = "runas!";
         url_preview_enabled = true;
@@ -21,14 +23,9 @@ in {
           #        "/var/lib/matrix-synapse/hookshot-registration.yml"
           #        "/var/lib/matrix-synapse/telegram-registration.yaml"
         ];
-      extraConfig = ''
-        auto_join_rooms:
-          - "#general:matrix.giugl.io"
-        max_upload_size: "50M"
-      '';
         listeners = [{
           port = 8008;
-        bind_address = "::1";
+          bind_addresses = [ "::1" ];
           type = "http";
           tls = false;
           x_forwarded = true;
@@ -37,48 +34,22 @@ in {
             compress = false;
           }];
         }];
-      turn_uris = [
+      };
-        "turns:turn.giugl.io:5349?transport=udp"
-        "turns:turn.giugl.io:5349?transport=tcp"
-      ];
-      turn_shared_secret = "69duck duck fuck420";
-      turn_user_lifetime = "1h";
-      logConfig = ''
-        version: 1
 
-        # In systemd's journal, loglevel is implicitly stored, so let's omit it
+      #extraConfig = ''
-        # from the message text.
+      #  auto_join_rooms:
-        formatters:
+      #    - "#general:matrix.giugl.io"
-            journal_fmt:
+      #  max_upload_size: "50M"
-                format: '%(name)s: [%(request)s] %(message)s'
+      #'';
-
-        filters:
-            context:
-                (): synapse.util.logcontext.LoggingContextFilter
-                request: ""
-
-        handlers:
-            journal:
-                class: systemd.journal.JournalHandler
-                formatter: journal_fmt
-                filters: [context]
-                SYSLOG_IDENTIFIER: synapse
-
-        root:
-            level: WARN
-            handlers: [journal]
-
-        disable_existing_loggers: False
-      '';
     };
 
     postgresql = {
       enable = true;
-      package = pkgs.postgresql_11;
+      package = pkgs.postgresql;
-      ensureDatabases = [ "synapse" ];
+      ensureDatabases = [ db_name ];
       ensureUsers = [{
-        name = "matrix-synapse";
+        name = db_name;
-        ensurePermissions = { "DATABASE synapse" = "ALL PRIVILEGES"; };
+        ensurePermissions = { "DATABASE \"${db_name}\"" = "ALL PRIVILEGES"; };
       }];
     };
 
@@ -148,61 +119,8 @@ in {
         };
       };
     };
-
-    # telegram bridge
-
-    #   mautrix-telegram = {
-    #     enable = true;
-    #     environmentFile = /secrets/mautrix-telegram/mautrix-telegram.env;
-
-    #     settings = {
-    #       homeserver = {
-    #         address = "https://${domain}";
-    #         domain = "${domain}";
-    #       };
-
-    #       appservice = {
-    #         provisioning.enabled = false;
-    #         id = "telegram";
-    #       };
-
-    #       bridge = {
-    #         permissions = {
-    #           "@pepe:${domain}" = "admin";
-    #           "${domain}" = "puppeting";
-    #         };
-
-    #         # Animated stickers conversion requires additional packages in the
-    #         # service's path.
-    #         # If this isn't a fresh installation, clearing the bridge's uploaded
-    #         # file cache might be necessary (make a database backup first!):
-    #         # delete from telegram_file where \
-    #         #   mime_type in ('application/gzip', 'application/octet-stream')
-    #         animated_sticker = {
-    #           target = "gif";
-    #           args = {
-    #             width = 256;
-    #             height = 256;
-    #             fps = 30; # only for webm
-    #             background = "020202"; # only for gif, transparency not supported
-    #           };
-    #         };
-
-    #         encryption = {
-    #           allow = true;
-    #           default = true;
-    #         };
-    #       };
-    #     };
-    #   };
-
   };
 
-  # systemd.services.mautrix-telegram.path = with pkgs; [
-  #   lottieconverter # for animated stickers conversion, unfree package
-  #   ffmpeg # if converting animated stickers to webm (very slow!)
-  # ];
-
   networking.extraHosts = ''
     ${network.architect-lan} ${domain} ${webui_domain}
     ${network.architect-wg} ${domain} ${webui_domain}

hosts/architect/modules/jellyfin.nix

@@ -50,12 +50,10 @@ in {
       serviceConfig = rec {
         User = cfg.user;
         Group = cfg.group;
-#        # Allows access to drm devices for transcoding with hardware acceleration
+        StateDirectory = "/jellyfin";
-#        SupplementaryGroups = [ "video" ];
+        CacheDirectory = "/jellyfin/cache";
-        StateDirectory = "jellyfin";
-        CacheDirectory = "jellyfin";
         ExecStart =
-          "${cfg.package}/bin/jellyfin --datadir '/var/lib/${StateDirectory}' --cachedir '/var/cache/${CacheDirectory}'";
+          "${cfg.package}/bin/jellyfin --datadir '/jellyfin' --cachedir '/jellyfin/cache'";
         Restart = "on-failure";
 
         # Security options:

hosts/architect/navidrome.nix

@@ -3,13 +3,15 @@
 let
   domain = "music.giugl.io";
   network = import ./network.nix;
+  library_path = "/media/Music";
+  beets_config = "/media/beets.conf";
 in {
   services = {
     navidrome = {
       enable = true;
 
       settings = {
-        MusicFolder = "/media/Music";
+        MusicFolder = library_path;
         LastFM.enable = true;
         LastFM.ApiKey = "5cef5cb5f9d31326b97d0f929ca9cf20";
         LastFM.Secret = "d1296896126f4caae47407aecf080b25";
@@ -34,16 +36,53 @@ in {
     };
   };
 
-  systemd.services."beets-rename" = {
+  systemd.services = {
+    "beets-update" = {
       enable = true;
+      #      requires = [ "remove-badmp3.service" "remove-badflac.service" ];
+      before = [ "beets-import.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.beets}/bin/beet -c ${beets_config} update";
+      };
+    };
+
+    "beets-import" = {
+      enable = true;
+      path = [ pkgs.imagemagick ];
+      requires = [ "beets-update.service" ];
+      after = [ "beets-update.service" ];
       serviceConfig = {
         Type = "oneshot";
         ExecStart =
-        "${pkgs.findutils}/bin/find /media/Music -type d -mindepth 2 -maxdepth 2 -exec ${pkgs.beets}/bin/beet -c /media/config.conf import --flat -q {} \\;";
+          "${pkgs.beets}/bin/beet -c ${beets_config} import --flat -q ${library_path}";
       };
       startAt = "daily";
     };
 
+    "remove-badmp3" = {
+      enable = true;
+      before = [ "beets-import.service" "beets-update.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = ''
+          ${pkgs.findutils}/bin/find ${library_path} -name "*.mp3" -type f -exec ${pkgs.bash}/bin/sh -c '${pkgs.mp3val}/bin/mp3val "{}" | grep -Pi error 1>/dev/null && ${pkgs.busybox}/bin/rm "{}"' \;
+        '';
+      };
+    };
+
+    "remove-badflac" = {
+      enable = true;
+      before = [ "beets-import.service" "beets-update.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = ''
+          ${pkgs.findutils}/bin/find ${library_path} -name "*.flac" -type f -exec ${pkgs.bash}/bin/sh -c '${pkgs.flac}/bin/flac -st "{}" || ${pkgs.busybox}/bin/rm "{}"' \;
+        '';
+      };
+    };
+  };
+
   networking.extraHosts = ''
     ${network.architect-lan} ${domain}
     ${network.architect-wg} ${domain}

hosts/architect/network.nix

@@ -3,12 +3,14 @@ rec {
   wan-if = "enp5s0";
   vpn-if = "wg0";
   proxy-if = "proxy";
+  docker-if = "docker0";
 
   # nets
   lan-net = "10.0.0.0/24";
   vpn-net = "10.3.0.0/24";
   proxy-net = "10.4.0.0/24";
   external_lan-net = "192.168.1.0/24";
+  docker-net = "172.17.0.0/16";
 
   # ips
   dvr-lan = "10.0.0.2";
@@ -47,19 +49,19 @@ rec {
   parina-wg = "10.3.0.31";
   nilo-wg = "10.3.0.32";
   parina-ipad-wg = "10.3.0.33";
+  kclvm-wg = "10.3.0.34";
   eleonora-wg = "10.3.0.100";
-  angellane-wg = "10.3.0.200";
+  angellane-wg = "10.3.0.203";
   hotpottino-wg = "10.3.0.201";
   dodino-wg = "10.3.0.202";
-  wolfsonhouse-wg = "10.3.0.203";
 
   # groups
   gdevices-wg =
-    [ galuminum-wg oneplus-wg ipad-wg gbeast-wg peppiniell-wg padulino-wg wolfsonhouse-wg ];
+    [ galuminum-wg oneplus-wg gbeast-wg peppiniell-wg kclvm-wg ] ++ routers-wg;
-  routers-wg = [ hotpottino-wg angellane-wg dodino-wg wolfsonhouse-wg ];
+  routers-wg = [ hotpottino-wg angellane-wg dodino-wg ];
   c2c-wg = [ ] ++ gdevices-wg;
-  towan-wg = [ shield-wg parisaphone-wg parisapc-wg parina-wg parina-ipad-wg ] ++ gdevices-wg
+  towan-wg = [ shield-wg parisaphone-wg parisapc-wg parina-wg parina-ipad-wg ]
-    ++ routers-wg;
+    ++ gdevices-wg ++ routers-wg;
   gamenet-wg = [
     andrew-wg
     galuminum-wg

hosts/architect/nextcloud.nix

@@ -8,13 +8,13 @@ in {
     mysql.enable = true;
     mysql.package = pkgs.unstable.mysql80;
 
-    redis.enable = true;
+    redis.servers."default".enable = true;
 
     nextcloud = {
       enable = true;
       hostName = "${domain}";
       https = true;
-      package = pkgs.unstable.nextcloud23;
+      package = pkgs.unstable.nextcloud24;
 
       caching.redis = true;
 

hosts/architect/nginx.nix

@@ -8,29 +8,26 @@
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
 
-    #    virtualHosts."giugl.io" = {
+    virtualHosts."architect.devs.giugl.io" = {
-    #      default = true;
+      default = true;
-    #      enableACME = true;
+      enableACME = true;
-    #      addSSL = true;
+      addSSL = true;
-    #      root = "/var/lib/nginx/error_pages";
+      root = "/var/lib/nginx/error_pages";
-    #      extraConfig = "error_page 404 /index.htm;";
+      extraConfig = "error_page 404 /index.htm;";
-    #
-    #      locations = {
-    #        "/" = {
-    #          return = "404";
-    #        };
-    #
-    #        "/index.htm" = {
-    #        };
-    #
-    #        "/style.css" = {
-    #        };
-    #
-    #        "/wat.jpg" = {
-    #        };
-    #      };
-    #    };
-  };
 
+      locations = {
+        "/" = { return = "404"; };
+
+        "/index.htm" = { };
+
+        "/style.css" = { };
+
+        "/wat.jpg" = { };
+      };
+    };
+    appendConfig = ''
+      worker_processes 24;
+    '';
+  };
   users.groups.acme.members = [ "nginx" ];
 }

hosts/architect/prosody.nix

@@ -37,5 +37,8 @@ in {
     ${network.architect-wg} ${domain}
   '';
 
-  users.groups.acme.members = [ "prosody" ];
+  users.groups = {
+    acme.members = [ "prosody" ];
+    nginx.members = [ "prosody" ];
+  };
 }

hosts/architect/wireguard.nix

@@ -28,25 +28,25 @@ with import ./network.nix; {
       ${mikey-wg}           mikey.devs.giugl.io
       ${andrew-wg}          andrew.devs.giugl.io
       ${mikeylaptop-wg}     mikeylaptop.devs.giugl.io
-      ${wolfsonhouse-wg}    wolfsonhouse.devs.giugl.io
       ${frznn-wg}           frznn.devs.giugl.io
       ${ludo-wg}            ludo.devs.giugl.io
       ${parina-wg}          parina.devs.giugl.io
       ${parina-ipad-wg}     parinaipad.devs.giugl.io
       ${nilo-wg}            nilo.devs.giugl.io
+      ${kclvm-wg}           kclvm.devs.giugl.io
     '';
 
     wireguard = {
-      interfaces.${proxy-if} = {
+     # interfaces.${proxy-if} = {
-        ips = [ "10.4.0.2/32" ];
+     #   ips = [ "10.4.0.2/32" ];
-        privateKeyFile = "/secrets/wireguard/proxy.key";
+     #   privateKeyFile = "/secrets/wireguard/proxy.key";
-        peers = [{
+     #   peers = [{
-          publicKey = "WmJBpXpYebcmJEF8nVTKMqQK01KyBe42vzc38K66rVs=";
+     #     publicKey = "WmJBpXpYebcmJEF8nVTKMqQK01KyBe42vzc38K66rVs=";
-          allowedIPs = [ "10.4.0.1/32" ];
+     #     allowedIPs = [ "10.4.0.1/32" ];
-          endpoint = "giugl.io:1195";
+     #     endpoint = "giugl.io:1195";
-          persistentKeepalive = 21;
+     #     persistentKeepalive = 21;
-        }];
+     #   }];
-      };
+     # };
 
       interfaces.${vpn-if} = {
         listenPort = 1194;
@@ -120,12 +120,6 @@ with import ./network.nix; {
             publicKey = "bzoW3Rx+7Un9hx/2opgBQJmmnZ/hgj1lQ2FnonCHjTc=";
           }
 
-          {
-            # angellane
-            allowedIPs = [ angellane-wg ];
-            publicKey = "MZ+nZklHpBxTL7QN9QJpBBx7yOYRZLONfvqAnuk85x0=";
-          }
-
           {
             # hotpottino
             allowedIPs = [ hotpottino-wg ];
@@ -199,8 +193,8 @@ with import ./network.nix; {
           }
 
           {
-            # wolfsonhouse
+            # angel-lane
-            allowedIPs = [ wolfsonhouse-wg ];
+            allowedIPs = [ angellane-wg ];
             publicKey = "UJRJcAOcnEjEB3o4K2I7gEM97SrhENEesZNf28z+EBQ=";
           }
 
@@ -263,6 +257,12 @@ with import ./network.nix; {
             allowedIPs = [ parina-ipad-wg ];
             publicKey = "ezkCzl2qC7Hd7rFKfqMa0JXDKRhVqy79H52rA06x7mU=";
           }
+
+          {
+            # kcl vm
+            allowedIPs = [ kclvm-wg ];
+            publicKey = "jVBaY8AhgAA7myVjU/PJPDUCOjsCi23LT+pGZUoNEkE=";
+          }
         ];
       };
     };

lib/host.nix

@@ -7,7 +7,11 @@
 
       mkRole = role: import (../roles + "/${role}.nix");
 
-    users_mod= (map (u: user.mkUser {name = u.user; roles = u.roles; }) users);
+      users_mod = (map (u:
+        user.mkUser {
+          name = u.user;
+          roles = u.roles;
+        }) users);
       roles_mod = (map (r: mkRole r) roles);
       add_imports = imports;
     in nixpkgs.lib.nixosSystem {
@@ -16,23 +20,19 @@
       modules = [
         {
           imports = users_mod ++ roles_mod ++ add_imports;
-        nixpkgs = {
+          nixpkgs = { inherit pkgs; };
-          pkgs = pkgs;
-        };
 
-        nix.nixPath = [ 
+          nix.nixPath = [ "nixpkgs=${nixpkgs}" "unstable=${nixos-unstable}" ];
-          "nixpkgs=${nixpkgs}" 
-          "unstable=${nixos-unstable}"
-        ];
           nix.registry.nixpkgs.flake = nixpkgs;
           nix.registry.unstable.flake = nixos-unstable;
 
-        users.users.root = {
+          users.users.root = { shell = pkgs.zsh; };
-          shell = pkgs.zsh;
-        };
 
-        home-manager.users.root.imports = [ ../roles/home/common.nix ];
+          home-manager = {
-        home-manager.extraSpecialArgs.unstable = unstable;
+            users.root.imports = [ ../roles/home/common.nix ];
+            extraSpecialArgs.unstable = unstable;
+            useGlobalPkgs = true;
+          };
         }
 
         home-manager.nixosModules.home-manager

roles/acme.nix

@@ -1,4 +1,8 @@
-{ ... }: {
+{ 
-  security.acme.acceptTerms = true;
+  security.acme = {
-  security.acme.email = "sysadmin@giugl.io";
+    acceptTerms = true;
+    defaults = {
+      email = "sysadmin@giugl.io";
+    };
+  };
 }

roles/home/common.nix

@@ -1,21 +1,22 @@
-{ config, pkgs, unstable, ... }:
+{ config, pkgs, ... }:
 
 {
   imports = [ ./zsh.nix ./git.nix ];
 
+  
   home = {
     stateVersion = "21.05";
     sessionVariables = {
       EDITOR = "nvim";
       VISUAL = "nvim";
     };
-
     packages = with pkgs; [ rizin sshfs nixfmt victor-mono ];
   };
 
   programs.neovim = {
     enable = true;
-    package = unstable.neovim-unwrapped;
+    viAlias = true;
+    vimAlias = true;
     extraPackages = with pkgs; [
       nodePackages.prettier
       nodePackages.pyright
@@ -25,6 +26,26 @@
       clang-tools
       rustfmt
     ];
+    plugins = with pkgs.vimPlugins; [
+      vim-nix
+      molokai
+      vim-airline
+      vim-airline-themes
+      vim-lsp
+      vim-indent-guides
+      vim-signify
+      vim-fugitive
+      vimtex
+      neoformat
+      nvim-lspconfig
+      vim-vsnip
+      nvim-cmp
+      cmp-nvim-lsp
+      (nvim-treesitter.withPlugins (_: pkgs.tree-sitter.allGrammars))
+      nvim-treesitter-textobjects
+      pkgs.vimExtraPlugins.leap-nvim
+    ];
+    
     extraConfig = ''
         " syntax
         syntax enable
@@ -37,38 +58,16 @@
         set wildmode=longest:full,full
 
         " remapping popup menu (command autocompletion)
-        "      cnoremap <expr> <up> pumvisible() ? "<C-p>" : "<up>
+        cnoremap <expr> <up> pumvisible() ? "<C-p>" : "<up>
-        "      cnoremap <expr> <down> pumvisible() ? "<C-n>" : "<down>"
+        cnoremap <expr> <down> pumvisible() ? "<C-n>" : "<down>"
-        "      cnoremap <expr> <CR> pumvisible() ? "<C-e>":"<CR>"
+        cnoremap <expr> <CR> pumvisible() ? "<C-e>":"<CR>"
+        
         " set line numbers
         set number
 
         " enable indent guides
         let g:indent_guides_enable_on_vim_startup = 1
 
-        " Exit Vim if NERDTree is the only window left.
-        autocmd BufEnter * if tabpagenr('$') == 1 && winnr('$') == 1 && exists('b:NERDTree') && b:NERDTree.isTabTree() |
-        \ quit | endif
-
-        " Start NERDTree. If a file is specified, move the cursor to its window.
-        autocmd StdinReadPre * let s:std_in=1
-        autocmd VimEnter * NERDTree | if argc() > 0 || exists("s:std_in") | wincmd p | endif
-
-        " Start NERDTree when Vim starts with a directory argument.
-        autocmd StdinReadPre * let s:std_in=1
-        autocmd VimEnter * if argc() == 1 && isdirectory(argv()[0]) && !exists('s:std_in') |
-        \ execute 'NERDTree' argv()[0] | wincmd p | enew | execute 'cd '.argv()[0] | endif
-
-        " Exit Vim if NERDTree is the only window left.
-        autocmd BufEnter * if tabpagenr('$') == 1 && winnr('$') == 1 && exists('b:NERDTree') && b:NERDTree.isTabTree() |
-        \ quit | endif
-
-        " Start interactive EasyAlign in visual mode (e.g. vipga)
-        xmap ga <Plug>(EasyAlign)
-
-        " Start interactive EasyAlign for a motion/text object (e.g. gaip)
-        nmap ga <Plug>(EasyAlign)
-
         " Highlight row and column
         set cul
         set cuc
@@ -87,6 +86,10 @@
         let g:neoformat_basic_format_trim = 1
 
         lua << EOF
+
+        -- Setup leap-nvim keymappings
+        require('leap').add_default_mappings()
+
         ------------------
         -- Setup nvim-cmp.
         ------------------
@@ -183,27 +186,5 @@
       EOF
     '';
 
-    viAlias = true;
-    vimAlias = true;
-    plugins = with unstable.vimPlugins; [
-      vim-nix
-      molokai
-      vim-airline
-      vim-airline-themes
-      vim-lsp
-      vim-indent-guides
-      vim-signify
-      nerdtree
-      vim-easy-align
-      vim-fugitive
-      vimtex
-      neoformat
-      nvim-lspconfig
-      vim-vsnip
-      nvim-cmp
-      cmp-nvim-lsp
-      (nvim-treesitter.withPlugins (_: unstable.tree-sitter.allGrammars))
-      nvim-treesitter-textobjects
-    ];
   };
 }