flake.nix

@@ -104,7 +104,7 @@
 
   nixConfig = {
     extra-substituters = [
-      "https://cache.cy7.sh/central"
+      "https://cache.cything.io/central"
       "https://niri.cachix.org"
       "https://nix-community.cachix.org"
       "https://cache.garnix.io"
@@ -112,7 +112,7 @@
       "https://aseipp-nix-cache.global.ssl.fastly.net"
     ];
     extra-trusted-public-keys = [
-      "central:KNxL0JFzHDGosui8ASem9n/tDmEAYLL9dtVMJ6TWsyg="
+      "central:uWhjva6m6dhC2hqNisjn2hXGvdGBs19vPkA1dPEuwFg="
       "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="

home/yt/ytnix.nix

@@ -19,6 +19,30 @@
   };
   programs.home-manager.enable = true;
 
+  systemd.user.startServices = "sd-switch";
+
+  # keep this commented when using plasma
+  # otherwise "system settings" in KDE will not function
+  # qt = {
+  #   enable = true;
+  #   platformTheme.name = "kde";
+  #   style.name = "breeze-dark";
+  #   style.package = pkgs.kdePackages.breeze;
+  # };
+
+  # this one too
+  # gtk = {
+  #   enable = true;
+  #   theme = {
+  #     package = pkgs.adw-gtk3;
+  #     name = "adw-gtk3-dark";
+  #   };
+  #   iconTheme = {
+  #     package = pkgs.adwaita-icon-theme;
+  #     name = "Adwaita";
+  #   };
+  # };
+
   home.pointerCursor = {
     package = pkgs.bibata-cursors;
     name = "Bibata-Modern-Classic";
@@ -32,6 +56,7 @@
     ungoogled-chromium
     librewolf
     bitwarden-desktop
+    bitwarden-cli
     fastfetch
     nwg-look
     kdePackages.gwenview
@@ -42,6 +67,11 @@
     signal-desktop
     pavucontrol
     btop
+    grim
+    slurp
+    rofi-wayland
+    rofimoji
+    cliphist
     jq
     bash-language-server
     sqlite
@@ -58,6 +88,7 @@
     pwgen
     lua-language-server
     gnumake
+    foot
     minisign
     unzip
     lm_sensors
@@ -94,6 +125,7 @@
     radare2
     p7zip
     qbittorrent
+    # vscodium
     nil
     pkg-config
     gtk2
@@ -112,19 +144,27 @@
     telegram-desktop
     jadx
     gradle
-    localsend
-    scrcpy
-    syncthing
-    syncthingtray
-    obsidian
   ];
 
+  programs.waybar.enable = true;
   programs.feh.enable = true;
 
   xdg.configFile = {
+    rofi.source = ../rofi;
+    waybar.source = ../waybar;
     mpv.source = ../mpv;
   };
 
+  programs.newsboat = {
+    enable = true;
+    extraConfig = ''
+      urls-source "miniflux"
+      miniflux-url "https://rss.cything.io/"
+      miniflux-login "cy"
+      miniflux-passwordfile /run/secrets/newsboat/miniflux
+    '';
+  };
+
   programs.direnv = {
     enable = true;
     nix-direnv.enable = true;
@@ -146,12 +186,12 @@
     # sccache stuff
     RUSTC_WRAPPER = "${lib.getExe pkgs.sccache}";
     SCCACHE_BUCKET = "sccache";
-    SCCACHE_REGION = "us-east-1";
+    SCCACHE_REGION = "earth";
     SCCACHE_ENDPOINT = "https://sccache.s3.cy7.sh";
     SCCACHE_ALLOW_CORE_DUMPS = "true";
     SCCACHE_S3_USE_SSL = "true";
     SCCACHE_CACHE_MULTIARCH = "true";
-    SCCACHE_LOG = "warn";
+    SCCACHE_LOG_LEVEL = "warn";
     AWS_DEFAULT_REGION = "us-east-1";
     AWS_ENDPOINT_URL = "https://s3.cy7.sh";
     AWS_ACCESS_KEY_ID = "$(cat /run/secrets/aws/key_id)";

hosts/chunk/attic.nix

@@ -7,26 +7,32 @@
 
     settings = {
       listen = "[::]:8090";
-      api-endpoint = "https://cache.cy7.sh/";
+      api-endpoint = "https://cache.cything.io/";
-      allowed-hosts = [ "cache.cy7.sh" ];
+      allowed-hosts = [ "cache.cything.io" ];
       require-proof-of-possession = false;
       compression.type = "zstd";
       database.url = "postgresql:///atticd?host=/run/postgresql";
 
       storage = {
-        type = "s3";
+        type = "local";
-        region = "auto";
+        path = "/mnt/attic";
-        bucket = "attic";
-        endpoint = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
       };
 
       garbage-collection = {
-        default-retention-period = "2 weeks";
+        default-retention-period = "3 months";
+      };
+
+      chunking = {
+        nar-size-threshold = 0; # disables chunking
+        min-size = 0;
+        avg-size = 0;
+        max-size = 0;
+        concurrent-chunk-uploads = 32;
       };
     };
   };
 
-  services.caddy.virtualHosts."cache.cy7.sh".extraConfig = ''
+  services.caddy.virtualHosts."cache.cything.io".extraConfig = ''
     import common
     reverse_proxy localhost:8090
   '';

hosts/chunk/default.nix

@@ -1,6 +1,5 @@
 {
   pkgs,
-  lib,
   ...
 }:
 {
@@ -11,6 +10,7 @@
     ./backup.nix
     ./rclone.nix
     ./postgres.nix
+    ./adguard.nix
     ./hedgedoc.nix
     ./miniflux.nix
     ./redlib.nix
@@ -31,6 +31,9 @@
     "borg/rsyncnet" = {
       sopsFile = ../../secrets/borg/chunk.yaml;
     };
+    "services/ntfy" = {
+      sopsFile = ../../secrets/services/ntfy.yaml;
+    };
     "rclone/config" = {
       sopsFile = ../../secrets/rclone.yaml;
     };
@@ -89,35 +92,9 @@
       53
       853
     ];
-    extraCommands =
+    extraCommands = ''
-      let
-        ethtool = lib.getExe pkgs.ethtool;
-        tc = lib.getExe' pkgs.iproute2 "tc";
-      in
-      ''
-        # disable TCP segmentation offload (https://wiki.archlinux.org/title/Advanced_traffic_control#Prerequisites)
-        ${ethtool} -K ens18 tso off
-
-        # clear existing rules
-        ${tc} qdisc del dev ens18 root || true
-
-        # create HTB hierarchy
-        ${tc} qdisc add dev ens18 root handle 1: htb default 30
-        ${tc} class add dev ens18 parent 1: classid 1:1 htb rate 100% ceil 100%
-        # tailscale
-        ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 30% ceil 100%
-        # caddy
-        ${tc} class add dev ens18 parent 1:1 classid 1:20 htb rate 30% ceil 100%
-        # rest
-        ${tc} class add dev ens18 parent 1:1 classid 1:30 htb rate 40% ceil 100%
-
-        # mark traffic
       iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/tailscaled.service" -j MARK --set-mark 1
-        iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 2
+      iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/tor.service" -j MARK --set-mark 2
-
-        # route marked packets
-        ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 1 fw flowid 1:10
-        ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 2 fw flowid 1:20
     '';
   };
   networking.interfaces.ens18 = {

hosts/chunk/tailscale.nix

@@ -7,9 +7,6 @@
       "--advertise-exit-node"
       "--accept-dns=false"
     ];
-    extraDaemonFlags = [
-      "--no-logs-no-support"
-    ];
     useRoutingFeatures = "server";
     openFirewall = true;
   };

hosts/common.nix

@@ -10,7 +10,7 @@
         "@wheel"
       ];
       trusted-public-keys = [
-        "central:KNxL0JFzHDGosui8ASem9n/tDmEAYLL9dtVMJ6TWsyg="
+        "central:uWhjva6m6dhC2hqNisjn2hXGvdGBs19vPkA1dPEuwFg="
         "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
         "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
@@ -18,7 +18,7 @@
       ];
       substituters = [
         "https://aseipp-nix-cache.global.ssl.fastly.net"
-        "https://cache.cy7.sh/central"
+        "https://cache.cything.io/central"
         "https://niri.cachix.org"
         "https://nix-community.cachix.org"
         "https://cache.garnix.io"

hosts/ytnix/default.nix

@@ -17,9 +17,16 @@
     "borg/rsyncnet" = {
       sopsFile = ../../secrets/borg/yt.yaml;
     };
+    "services/ntfy" = {
+      sopsFile = ../../secrets/services/ntfy.yaml;
+    };
     "rsyncnet/id_ed25519" = {
       sopsFile = ../../secrets/zh5061/yt.yaml;
     };
+    "newsboat/miniflux" = {
+      sopsFile = ../../secrets/newsboat.yaml;
+      owner = "yt";
+    };
     "tailscale/auth" = {
       sopsFile = ../../secrets/services/tailscale.yaml;
     };
@@ -84,10 +91,7 @@
     resolvconf.enable = true;
     firewall = {
       enable = true;
-      allowedTCPPorts = [
+      allowedTCPPorts = [ 8080 ]; # for mitmproxy
-        8080 # mitmproxy
-        22000 # syncthing
-      ];
     };
   };
   programs.nm-applet.enable = true;
@@ -219,7 +223,6 @@
       "/home/yt/.local/share/Steam"
       "**/.wine"
       "/home/yt/Games"
-      "/home/yt/Videos"
     ];
     repo = "yt";
     passFile = config.sops.secrets."borg/rsyncnet".path;

hosts/ytnix/tailscale.nix

@@ -6,13 +6,8 @@
     openFirewall = true;
     useRoutingFeatures = "client";
     extraUpFlags = [
-      "--exit-node=chunk"
+      "--exit-node=100.122.132.30"
       "--accept-dns=false"
-      "--operator=yt"
-      "--exit-node-allow-lan-access"
-    ];
-    extraDaemonFlags = [
-      "--no-logs-no-support"
     ];
   };
 }

modules/backup.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.my.backup;
+  hostname = config.networking.hostName;
   defaultPaths = [
     "/root"
     "/home"
@@ -96,6 +97,23 @@ in
       ];
       # warnings are often not that serious
       failOnWarnings = false;
+      postHook = ''
+        invocationId=$(systemctl show -p InvocationID --value borgbackup-job-${cfg.jobName}.service)
+        title="${hostname}: backup completed with exit code: $exitStatus"
+        msg=$(journalctl -o cat _SYSTEMD_INVOCATION_ID=$invocationId)
+
+        if [ "$exitStatus" -eq 0 ]; then
+          tag="v"
+        else
+          tag="rotating_light"
+        fi
+
+        ${pkgs.curl}/bin/curl -sL -u $(cat ${config.sops.secrets."services/ntfy".path}) \
+        -H "Title: $title" \
+        -H "Tags: $tag" \
+        -d "$msg" \
+        https://ntfy.cything.io/backups > /dev/null
+      '';
 
       prune.keep = {
         within = "2d";

overlay/attic/concurrent-32.patch

@@ -1,13 +0,0 @@
-diff --git a/server/src/config.rs b/server/src/config.rs
-index 4412cbf..6dd483a 100644
---- a/server/src/config.rs
-+++ b/server/src/config.rs
-@@ -565,7 +565,7 @@ fn default_default_retention_period() -> Duration {
- }
- 
- fn default_concurrent_chunk_uploads() -> usize {
--    10
-+    32
- }
- 
- fn load_config_from_path(path: &Path) -> Result<Config> {

overlay/attic/default.nix

@@ -16,9 +16,6 @@ final: prev: {
             cargoLock = null;
             cargoHash = "sha256-AbpWnYfBMrR6oOfy2LkQvIPYsClCWE89bJav+iHTtLM=";
             useFetchCargoVendor = true;
-            patches = [
-              ./concurrent-32.patch
-            ];
           }
         );
     };

overlay/zipline/default.nix

@@ -1,4 +1,5 @@
-final: prev: {
+final: prev:
+{
   zipline = prev.zipline.overrideAttrs {
     patches = [
       ./no-check-bucket.patch