nix fmt

.github/workflows/build-machines-and-homes.yml

@@ -13,7 +13,6 @@ env:
     extra-experimental-features = nix-command flakes
     accept-flake-config = true
   TERM: ansi
-
 jobs:
   build-machines:
     strategy:
@@ -37,15 +36,12 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
           build-mount-path: /nix
-
       - name: Install Nix
         uses: nixbuild/nix-quick-install-action@master
-
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-
       - name: Restore and cache Nix store
         uses: nix-community/cache-nix-action@v5.1.0
         with:
@@ -63,12 +59,10 @@ jobs:
           purge-primary-key: never
           # always save the cache
           save-always: true
-          
       - name: setup attic
         run: |
           nix profile install github:zhaofengli/attic
           attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
-
       - name: build and cache
         run: |
           package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
@@ -76,7 +70,6 @@ jobs:
           derivation="$(nix path-info --derivation "$package")"
           cache="$(nix-store --query --requisites --include-outputs "$derivation")"
           attic push main --stdin <<< "$cache"
-
   build-homes:
     strategy:
       matrix:
@@ -99,14 +92,11 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
           build-mount-path: /nix
-
       - uses: nixbuild/nix-quick-install-action@master
-
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-
       - name: Restore and cache Nix store
         uses: nix-community/cache-nix-action@v5.1.0
         with:
@@ -124,12 +114,10 @@ jobs:
           purge-primary-key: never
           # always save the cache
           save-always: true
-
       - name: setup attic
         run: |
           nix profile install github:zhaofengli/attic
           attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
-
       - name: build and cache
         run: |
           package=".#homeConfigurations."${{ matrix.home }}".activationPackage"

.github/workflows/build-packages.yml

@@ -16,7 +16,6 @@ env:
     extra-experimental-features = nix-command flakes
     accept-flake-config = true
   TERM: ansi
-
 jobs:
   build-packages:
     strategy:
@@ -29,33 +28,26 @@ jobs:
           - ubuntu-24.04-arm
           - macos-latest
           - macos-13
-
     runs-on: ${{ matrix.os }}
     steps:
       - name: Install Nix
         uses: cachix/install-nix-action@v30
-
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-          
       - name: setup attic
         run: |
           nix profile install github:zhaofengli/attic
           attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
-
       - run: nix build -L ${{ matrix.package }}
-      
       - name: cache result
         run: |
           derivation="$(nix path-info --derivation "${{ matrix.package }}")"
           cache="$(nix-store --query --requisites --include-outputs "$derivation")"
           attic push main --stdin <<< "$cache"
-
       - name: prepare tarball to upload
         run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
-
       - name: upload result
         uses: actions/upload-artifact@v4
         with:

.sops.yaml

@@ -118,9 +118,8 @@ creation_rules:
       - age:
           - *chunk
           - *cy
-
   - path_regex: secrets/services/searx.yaml
     key_groups:
       - age:
           - *chunk
-          - *cy
+          - *cy

home/codium.nix

@@ -10,8 +10,7 @@
       extensions =
         # if unfree
         # with pkgs.vscode-marketplace;
-        with pkgs.open-vsx;
+        with pkgs.open-vsx; [
-        [
           vscodevim.vim
           jnoortheen.nix-ide
           github.github-vscode-theme

hosts/chunk/garage.nix

@@ -10,15 +10,13 @@
         api_bind_addr = "[::]:3900";
         root_domain = "s3.cy7.sh";
       };
-      s3_web = {
-        bind_addr = "[::]:3902";
-        root_domain = ".web.s3.cy7.sh";
-        index = "index.html";
-      };
       admin.api_bind_addr = "[::]:3903";
       rpc_bind_addr = "[::]:3901";
       replication_factor = 1;
       db_engine = "lmdb";
+      disable_scrub = true;
+      block_size = "10M";
+      compression_level = 3;
     };
     environmentFile = config.sops.secrets."garage/env".path;
   };
@@ -31,10 +29,6 @@
         reverse_proxy localhost:3900
       '';
     };
-    "*.web.s3.cy7.sh".extraConfig = ''
-      import common
-      reverse_proxy localhost:3902
-    '';
     "admin.s3.cy7.sh".extraConfig = ''
       import common
       reverse_proxy localhost:3903

hosts/chunk/grafana.nix

@@ -29,6 +29,14 @@
           }
         ];
       }
+      {
+        job_name = "garage";
+        static_configs = [
+          {
+            targets = [ "127.0.0.1:3903" ];
+          }
+        ];
+      }
     ];
   };
 

hosts/chunk/rclone.nix

@@ -32,9 +32,17 @@
     serviceConfig = {
       Type = "notify";
       ExecStartPre = "/usr/bin/env mkdir -p /mnt/garage";
-      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
+      ExecStart = ''
-        config.sops.secrets."rclone/config".path
+        ${lib.getExe pkgs.rclone} mount \
-      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 5G --allow-other rsyncnet:garage /mnt/garage ";
+          --config ${config.sops.secrets."rclone/config".path} \
+          --allow-other \
+          --cache-dir /var/cache/rclone \
+          --transfers=32 --checkers=32 \
+          --vfs-cache-mode writes \
+          --vfs-cache-max-size 5G \
+          --dir-cache-time 30d \
+          rsyncnet:garage /mnt/garage
+      '';
       ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/garage";
     };
   };

hosts/ytnix/containers.nix

@@ -1,4 +1,4 @@
-{ 
+{
   config,
   pkgs,
   lib,
@@ -6,20 +6,22 @@
 }:
 {
   virtualisation.oci-containers.containers = {
-    immich-ml = let
+    immich-ml =
-      modelCache = "/opt/immich-ml";
+      let
-    in {
+        modelCache = "/opt/immich-ml";
-      image = "ghcr.io/immich-app/immich-machine-learning:release";
+      in
-      autoStart = true;
+      {
-      pull = "newer";
+        image = "ghcr.io/immich-app/immich-machine-learning:release";
-      ports = [ "3003:3003" ];
+        autoStart = true;
-      environment = {
+        pull = "newer";
-        REDIS_HOSTNAME = "immich-redis";
+        ports = [ "3003:3003" ];
-        DB_HOSTNAME = "immich-db";
+        environment = {
+          REDIS_HOSTNAME = "immich-redis";
+          DB_HOSTNAME = "immich-db";
+        };
+        volumes = [ "${modelCache}:/cache" ];
+        networks = [ "immich-net" ];
       };
-      volumes = [ "${modelCache}:/cache" ];
-      networks = [ "immich-net" ];
-    };
   };
 
   systemd.services.create-immich-net = rec {
@@ -33,4 +35,4 @@
       ${lib.getExe pkgs.podman} network create immich-net
     '';
   };
-}
+}

hosts/ytnix/default.nix

@@ -147,47 +147,49 @@
     "podman"
   ];
 
-  environment.systemPackages = with pkgs; lib.flatten [
+  environment.systemPackages =
-    tmux
+    with pkgs;
-    vim
+    lib.flatten [
-    wget
+      tmux
-    tree
+      vim
-    kitty
+      wget
-    borgbackup
+      tree
-    htop
+      kitty
-    file
+      borgbackup
-    dnsutils
+      htop
-    q
+      file
-    age
+      dnsutils
-    compsize
+      q
-    wireguard-tools
+      age
-    traceroute
+      compsize
-    sops
+      wireguard-tools
-    sbctl # secure boot
+      traceroute
-    lm_sensors
+      sops
-    sshfs
+      sbctl # secure boot
-    openssl
+      lm_sensors
-    just
+      sshfs
-    killall
+      openssl
-    lshw
+      just
-    bubblewrap
+      killall
-    fuse-overlayfs
+      lshw
-    dwarfs
+      bubblewrap
-    wineWowPackages.stagingFull
+      fuse-overlayfs
-    (with gst_all_1; [
+      dwarfs
-      gst-plugins-good
+      wineWowPackages.stagingFull
-      gst-plugins-bad
+      (with gst_all_1; [
-      gst-plugins-ugly
+        gst-plugins-good
-      gst-plugins-base
+        gst-plugins-bad
-    ])
+        gst-plugins-ugly
-    vulkan-loader
+        gst-plugins-base
-    (heroic.override {
+      ])
-      extraPkgs = pkgs: [
+      vulkan-loader
-        pkgs.gamescope
+      (heroic.override {
-        pkgs.gamemode
+        extraPkgs = pkgs: [
-      ];
+          pkgs.gamescope
-    })
+          pkgs.gamemode
-  ];
+        ];
+      })
+    ];
 
   environment.sessionVariables = {
     NIXOS_OZONE_WL = "1";

modules/attic.nix

@@ -44,4 +44,4 @@ in
       reverse_proxy localhost:8091
     '';
   };
-}
+}

modules/searx.nix

@@ -44,4 +44,4 @@ in
       reverse_proxy 127.0.0.1:8090
     '';
   };
-}
+}

modules/vaultwarden.nix

@@ -29,4 +29,4 @@ in
       };
     };
   };
-}
+}

overlay/bitwarden/default.nix

@@ -1,7 +1,9 @@
 final: prev: {
-  bitwarden-desktop = prev.bitwarden-desktop.overrideAttrs (finalAttrs: prevAttrs: {
+  bitwarden-desktop = prev.bitwarden-desktop.overrideAttrs (
-    patches = prevAttrs.patches ++ [
+    finalAttrs: prevAttrs: {
-      ./ssh-agent-no-confirm.patch
+      patches = prevAttrs.patches ++ [
-    ];
+        ./ssh-agent-no-confirm.patch
-  });
+      ];
-}
+    }
+  );
+}

overlay/default.nix

@@ -14,14 +14,15 @@ in
       pkgFrom = flake: pkg: flake.packages.${prev.system}.${pkg};
     in
     {
-      conduwuit =
+      conduwuit = pkgFrom inputs.conduwuit "static-x86_64-linux-musl-all-features-x86_64-haswell-optimised";
-       pkgFrom inputs.conduwuit "static-x86_64-linux-musl-all-features-x86_64-haswell-optimised";
       pixelflasher = nixpkgsFrom inputs.pixelflasher "pixelflasher";
       attic-server = pkgFrom inputs.attic "attic-server";
       attic = pkgFrom inputs.attic "attic";
-      garage = ((pkgFrom inputs.garage "default").overrideAttrs {
+      garage = (
+        (pkgFrom inputs.garage "default").overrideAttrs {
           meta.mainProgram = "garage";
-      });
+        }
+      );
     }
   )
 ]