.github/workflows/build-machines-and-homes.yml

@@ -13,6 +13,7 @@ env:
     extra-experimental-features = nix-command flakes
     accept-flake-config = true
   TERM: ansi
+
 jobs:
   build-machines:
     strategy:
@@ -36,12 +37,15 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
           build-mount-path: /nix
+
       - name: Install Nix
         uses: nixbuild/nix-quick-install-action@master
+
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
+
       - name: Restore and cache Nix store
         uses: nix-community/cache-nix-action@v5.1.0
         with:
@@ -59,10 +63,12 @@ jobs:
           purge-primary-key: never
           # always save the cache
           save-always: true
+          
       - name: setup attic
         run: |
           nix profile install github:zhaofengli/attic
           attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
+
       - name: build and cache
         run: |
           package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
@@ -70,6 +76,7 @@ jobs:
           derivation="$(nix path-info --derivation "$package")"
           cache="$(nix-store --query --requisites --include-outputs "$derivation")"
           attic push main --stdin <<< "$cache"
+
   build-homes:
     strategy:
       matrix:
@@ -92,11 +99,14 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
           build-mount-path: /nix
+
       - uses: nixbuild/nix-quick-install-action@master
+
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
+
       - name: Restore and cache Nix store
         uses: nix-community/cache-nix-action@v5.1.0
         with:
@@ -114,10 +124,12 @@ jobs:
           purge-primary-key: never
           # always save the cache
           save-always: true
+
       - name: setup attic
         run: |
           nix profile install github:zhaofengli/attic
           attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
+
       - name: build and cache
         run: |
           package=".#homeConfigurations."${{ matrix.home }}".activationPackage"

.github/workflows/build-packages.yml

@@ -16,6 +16,7 @@ env:
     extra-experimental-features = nix-command flakes
     accept-flake-config = true
   TERM: ansi
+
 jobs:
   build-packages:
     strategy:
@@ -28,26 +29,33 @@ jobs:
           - ubuntu-24.04-arm
           - macos-latest
           - macos-13
+
     runs-on: ${{ matrix.os }}
     steps:
       - name: Install Nix
         uses: cachix/install-nix-action@v30
+
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
+          
       - name: setup attic
         run: |
           nix profile install github:zhaofengli/attic
           attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
+
       - run: nix build -L ${{ matrix.package }}
+      
       - name: cache result
         run: |
           derivation="$(nix path-info --derivation "${{ matrix.package }}")"
           cache="$(nix-store --query --requisites --include-outputs "$derivation")"
           attic push main --stdin <<< "$cache"
+
       - name: prepare tarball to upload
         run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
+
       - name: upload result
         uses: actions/upload-artifact@v4
         with:

.sops.yaml

@@ -118,8 +118,9 @@ creation_rules:
       - age:
           - *chunk
           - *cy
+
   - path_regex: secrets/services/searx.yaml
     key_groups:
       - age:
           - *chunk
-          - *cy
+          - *cy

home/codium.nix

@@ -10,7 +10,8 @@
       extensions =
         # if unfree
         # with pkgs.vscode-marketplace;
-        with pkgs.open-vsx; [
+        with pkgs.open-vsx;
+        [
           vscodevim.vim
           jnoortheen.nix-ide
           github.github-vscode-theme

hosts/chunk/garage.nix

@@ -10,13 +10,15 @@
         api_bind_addr = "[::]:3900";
         root_domain = "s3.cy7.sh";
       };
+      s3_web = {
+        bind_addr = "[::]:3902";
+        root_domain = ".web.s3.cy7.sh";
+        index = "index.html";
+      };
       admin.api_bind_addr = "[::]:3903";
       rpc_bind_addr = "[::]:3901";
       replication_factor = 1;
       db_engine = "lmdb";
-      disable_scrub = true;
-      block_size = "10M";
-      compression_level = 3;
     };
     environmentFile = config.sops.secrets."garage/env".path;
   };
@@ -29,6 +31,10 @@
         reverse_proxy localhost:3900
       '';
     };
+    "*.web.s3.cy7.sh".extraConfig = ''
+      import common
+      reverse_proxy localhost:3902
+    '';
     "admin.s3.cy7.sh".extraConfig = ''
       import common
       reverse_proxy localhost:3903

hosts/chunk/grafana.nix

@@ -29,14 +29,6 @@
           }
         ];
       }
-      {
-        job_name = "garage";
-        static_configs = [
-          {
-            targets = [ "127.0.0.1:3903" ];
-          }
-        ];
-      }
     ];
   };
 

hosts/chunk/rclone.nix

@@ -32,17 +32,9 @@
     serviceConfig = {
       Type = "notify";
       ExecStartPre = "/usr/bin/env mkdir -p /mnt/garage";
-      ExecStart = ''
+      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
-        ${lib.getExe pkgs.rclone} mount \
+        config.sops.secrets."rclone/config".path
-          --config ${config.sops.secrets."rclone/config".path} \
+      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 5G --allow-other rsyncnet:garage /mnt/garage ";
-          --allow-other \
-          --cache-dir /var/cache/rclone \
-          --transfers=32 --checkers=32 \
-          --vfs-cache-mode writes \
-          --vfs-cache-max-size 5G \
-          --dir-cache-time 30d \
-          rsyncnet:garage /mnt/garage
-      '';
       ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/garage";
     };
   };

hosts/ytnix/containers.nix

@@ -1,4 +1,4 @@
-{
+{ 
   config,
   pkgs,
   lib,
@@ -6,22 +6,20 @@
 }:
 {
   virtualisation.oci-containers.containers = {
-    immich-ml =
+    immich-ml = let
-      let
+      modelCache = "/opt/immich-ml";
-        modelCache = "/opt/immich-ml";
+    in {
-      in
+      image = "ghcr.io/immich-app/immich-machine-learning:release";
-      {
+      autoStart = true;
-        image = "ghcr.io/immich-app/immich-machine-learning:release";
+      pull = "newer";
-        autoStart = true;
+      ports = [ "3003:3003" ];
-        pull = "newer";
+      environment = {
-        ports = [ "3003:3003" ];
+        REDIS_HOSTNAME = "immich-redis";
-        environment = {
+        DB_HOSTNAME = "immich-db";
-          REDIS_HOSTNAME = "immich-redis";
-          DB_HOSTNAME = "immich-db";
-        };
-        volumes = [ "${modelCache}:/cache" ];
-        networks = [ "immich-net" ];
       };
+      volumes = [ "${modelCache}:/cache" ];
+      networks = [ "immich-net" ];
+    };
   };
 
   systemd.services.create-immich-net = rec {
@@ -35,4 +33,4 @@
       ${lib.getExe pkgs.podman} network create immich-net
     '';
   };
-}
+}

hosts/ytnix/default.nix

@@ -147,49 +147,47 @@
     "podman"
   ];
 
-  environment.systemPackages =
+  environment.systemPackages = with pkgs; lib.flatten [
-    with pkgs;
+    tmux
-    lib.flatten [
+    vim
-      tmux
+    wget
-      vim
+    tree
-      wget
+    kitty
-      tree
+    borgbackup
-      kitty
+    htop
-      borgbackup
+    file
-      htop
+    dnsutils
-      file
+    q
-      dnsutils
+    age
-      q
+    compsize
-      age
+    wireguard-tools
-      compsize
+    traceroute
-      wireguard-tools
+    sops
-      traceroute
+    sbctl # secure boot
-      sops
+    lm_sensors
-      sbctl # secure boot
+    sshfs
-      lm_sensors
+    openssl
-      sshfs
+    just
-      openssl
+    killall
-      just
+    lshw
-      killall
+    bubblewrap
-      lshw
+    fuse-overlayfs
-      bubblewrap
+    dwarfs
-      fuse-overlayfs
+    wineWowPackages.stagingFull
-      dwarfs
+    (with gst_all_1; [
-      wineWowPackages.stagingFull
+      gst-plugins-good
-      (with gst_all_1; [
+      gst-plugins-bad
-        gst-plugins-good
+      gst-plugins-ugly
-        gst-plugins-bad
+      gst-plugins-base
-        gst-plugins-ugly
+    ])
-        gst-plugins-base
+    vulkan-loader
-      ])
+    (heroic.override {
-      vulkan-loader
+      extraPkgs = pkgs: [
-      (heroic.override {
+        pkgs.gamescope
-        extraPkgs = pkgs: [
+        pkgs.gamemode
-          pkgs.gamescope
+      ];
-          pkgs.gamemode
+    })
-        ];
+  ];
-      })
-    ];
 
   environment.sessionVariables = {
     NIXOS_OZONE_WL = "1";

modules/attic.nix

@@ -44,4 +44,4 @@ in
       reverse_proxy localhost:8091
     '';
   };
-}
+}

modules/searx.nix

@@ -44,4 +44,4 @@ in
       reverse_proxy 127.0.0.1:8090
     '';
   };
-}
+}

modules/vaultwarden.nix

@@ -29,4 +29,4 @@ in
       };
     };
   };
-}
+}

overlay/bitwarden/default.nix

@@ -1,9 +1,7 @@
 final: prev: {
-  bitwarden-desktop = prev.bitwarden-desktop.overrideAttrs (
+  bitwarden-desktop = prev.bitwarden-desktop.overrideAttrs (finalAttrs: prevAttrs: {
-    finalAttrs: prevAttrs: {
+    patches = prevAttrs.patches ++ [
-      patches = prevAttrs.patches ++ [
+      ./ssh-agent-no-confirm.patch
-        ./ssh-agent-no-confirm.patch
+    ];
-      ];
+  });
-    }
+}
-  );
-}

overlay/default.nix

@@ -14,15 +14,14 @@ in
       pkgFrom = flake: pkg: flake.packages.${prev.system}.${pkg};
     in
     {
-      conduwuit = pkgFrom inputs.conduwuit "static-x86_64-linux-musl-all-features-x86_64-haswell-optimised";
+      conduwuit =
+       pkgFrom inputs.conduwuit "static-x86_64-linux-musl-all-features-x86_64-haswell-optimised";
       pixelflasher = nixpkgsFrom inputs.pixelflasher "pixelflasher";
       attic-server = pkgFrom inputs.attic "attic-server";
       attic = pkgFrom inputs.attic "attic";
-      garage = (
+      garage = ((pkgFrom inputs.garage "default").overrideAttrs {
-        (pkgFrom inputs.garage "default").overrideAttrs {
           meta.mainProgram = "garage";
-        }
+      });
-      );
     }
   )
 ]