diff --git a/.github/workflows/build-machines-and-homes.yml b/.github/workflows/build-machines-and-homes.yml index 3b36789..1900b0e 100644 --- a/.github/workflows/build-machines-and-homes.yml +++ b/.github/workflows/build-machines-and-homes.yml @@ -7,15 +7,12 @@ env: ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }} NIX_CONFIG: | show-trace = true + extra-substituters = https://cdn.cy7.sh/main + extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0= experimental-features = nix-command flakes accept-flake-config = true system-features = nixos-test benchmark big-parallel kvm - secret-key-files = /home/runner/cache-priv-key.pem - extra-substituters = https://nixcache.cy7.sh - extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= TERM: ansi - AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} - AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }} jobs: build-machines: strategy: @@ -39,14 +36,16 @@ jobs: remove-codeql: 'true' remove-docker-images: 'true' build-mount-path: /nix - - name: setup binary cache key - run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem - name: Install Nix uses: cachix/install-nix-action@v30 - name: Sync repository uses: actions/checkout@v4 with: persist-credentials: false + - name: setup attic + run: | + nix profile install github:zhaofengli/attic + attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN" - name: build run: | package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel" @@ -54,7 +53,10 @@ jobs: - name: cache if: always() run: | - nix copy ".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel" --to "s3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem" + package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel" + derivation="$(nix path-info --derivation "$package")" + cache="$(nix-store --query --requisites --include-outputs "$derivation")" + xargs attic push main <<< "$cache" build-homes: strategy: fail-fast: false @@ -78,14 +80,16 @@ jobs: remove-codeql: 'true' remove-docker-images: 'true' build-mount-path: /nix - - name: setup binary cache key - run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem - name: Install Nix uses: cachix/install-nix-action@v30 - name: Sync repository uses: actions/checkout@v4 with: persist-credentials: false + - name: setup attic + run: | + nix profile install github:zhaofengli/attic + attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN" - name: build run: | package=".#homeConfigurations."${{ matrix.home }}".activationPackage" @@ -93,4 +97,7 @@ jobs: - name: cache if: always() run: | - nix copy ".#homeConfigurations."${{ matrix.home }}".activationPackage" --to "s3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem" + package=".#homeConfigurations."${{ matrix.home }}".activationPackage" + derivation="$(nix path-info --derivation "$package")" + cache="$(nix-store --query --requisites --include-outputs "$derivation")" + xargs attic push main <<< "$cache" diff --git a/.github/workflows/build-packages.yml b/.github/workflows/build-packages.yml index 3411c89..1d23fe9 100644 --- a/.github/workflows/build-packages.yml +++ b/.github/workflows/build-packages.yml @@ -10,11 +10,10 @@ env: ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }} NIX_CONFIG: | show-trace = true + extra-substituters = https://cdn.cy7.sh/main + extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0= experimental-features = nix-command flakes accept-flake-config = true - secret-key-files = /home/runner/cache-priv-key.pem - extra-substituters = https://nixcache.cy7.sh - extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= TERM: ansi jobs: build-packages: @@ -26,23 +25,27 @@ jobs: os: - ubuntu-latest - ubuntu-24.04-arm - # - macos-latest - # - macos-13 + - macos-latest + - macos-13 runs-on: ${{ matrix.os }} steps: - - name: setup binary cache key - run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem - name: Install Nix uses: cachix/install-nix-action@v30 - name: Sync repository uses: actions/checkout@v4 with: persist-credentials: false + - name: setup attic + run: | + nix profile install github:zhaofengli/attic + attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN" - run: nix build -L ${{ matrix.package }} - name: cache result if: always() run: | - nix copy "${{ matrix.package }}" --to "s3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem" + derivation="$(nix path-info --derivation "${{ matrix.package }}")" + cache="$(nix-store --query --requisites --include-outputs "$derivation")" + xargs attic push main <<< "$cache" - name: prepare tarball to upload run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result - name: upload result diff --git a/.sops.yaml b/.sops.yaml index c812080..cb7e65d 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -123,8 +123,3 @@ creation_rules: - age: - *chunk - *cy - - path_regex: secrets/cache-priv-key.pem - key_groups: - - age: - - *yt - - *cy diff --git a/flake.lock b/flake.lock index 0f289a9..6efe59b 100644 --- a/flake.lock +++ b/flake.lock @@ -459,11 +459,11 @@ ] }, "locked": { - "lastModified": 1743094823, - "narHash": "sha256-ZWBc4zCMlJXn5u6JN9lZLOasIaTqxc6RHEKP7w6Ktq4=", + "lastModified": 1742907812, + "narHash": "sha256-iloXwOZWx43mRvW3tlqRbqlDCIkOudrbtqVWE+q5OLg=", "owner": "helix-editor", "repo": "helix", - "rev": "7929c0719d739e248adfd80cd7e5b8e386a43938", + "rev": "388a3b78e3c4feff9c058b020c12f9eb47e72168", "type": "github" }, "original": { @@ -479,11 +479,11 @@ ] }, "locked": { - "lastModified": 1743097780, - "narHash": "sha256-5tUbaMBKYbfTe/4aXACxmiXG22TgwPBNcfZ8Kg3rt+g=", + "lastModified": 1742996658, + "narHash": "sha256-snxgTLVq6ooaD3W3mPHu7LVWpoZKczhxHAUZy2ea4oA=", "owner": "nix-community", "repo": "home-manager", - "rev": "b14a70c40f4fd0b73d095ab04a7c6e31fbc18e52", + "rev": "693840c01b9bef9e54100239cef937e53d4661bf", "type": "github" }, "original": { @@ -804,11 +804,11 @@ }, "nixpkgs-stable_2": { "locked": { - "lastModified": 1742937945, - "narHash": "sha256-lWc+79eZRyvHp/SqMhHTMzZVhpxkRvthsP1Qx6UCq0E=", + "lastModified": 1742751704, + "narHash": "sha256-rBfc+H1dDBUQ2mgVITMGBPI1PGuCznf9rcWX/XIULyE=", "owner": "nixos", "repo": "nixpkgs", - "rev": "d02d88f8de5b882ccdde0465d8fa2db3aa1169f7", + "rev": "f0946fa5f1fb876a9dc2e1850d9d3a4e3f914092", "type": "github" }, "original": { @@ -868,11 +868,11 @@ }, "nixpkgs_5": { "locked": { - "lastModified": 1743082947, - "narHash": "sha256-wZ/bfXu9x025oNa4pVcwYbgVRSl2tf/izZTegPSljUQ=", + "lastModified": 1743008566, + "narHash": "sha256-vqiNwWvNcIuHIPu6RC1WScwDHlcGerCZWZ8XOLVu0B0=", "owner": "nixos", "repo": "nixpkgs", - "rev": "8b1bcd4edc0de0a950eb117a37c55294997588b5", + "rev": "f55926cd4adb4db12ca97a86bc4e48e2c213f4d9", "type": "github" }, "original": { @@ -1038,11 +1038,11 @@ ] }, "locked": { - "lastModified": 1743042789, - "narHash": "sha256-yPlxN0r3pQjUIwyX/qeWSTdpHjWy/AfmM0PK1bYkO18=", + "lastModified": 1742956365, + "narHash": "sha256-Slrqmt6kJ/M7Z/ce4ebQWsz2aeEodrX56CsupOEPoz0=", "owner": "oxalica", "repo": "rust-overlay", - "rev": "b4d2dee9d16e7725b71969f28862ded3a94a7934", + "rev": "a0e3395c63cdbc9c1ec17915f8328c077c79c4a1", "type": "github" }, "original": { @@ -1108,11 +1108,11 @@ ] }, "locked": { - "lastModified": 1743081648, - "narHash": "sha256-WRAylyYptt6OX5eCEBWyTwOEqEtD6zt33rlUkr6u3cE=", + "lastModified": 1742982148, + "narHash": "sha256-aRA6LSxjlbMI6MmMzi/M5WH/ynd8pK+vACD9za3MKLQ=", "owner": "numtide", "repo": "treefmt-nix", - "rev": "29a3d7b768c70addce17af0869f6e2bd8f5be4b7", + "rev": "61c88349bf6dff49fa52d7dfc39b21026c2a8881", "type": "github" }, "original": { @@ -1131,11 +1131,11 @@ ] }, "locked": { - "lastModified": 1743040433, - "narHash": "sha256-OskUn34vJJdealUG1rdOdnpBEBRfJfw9vKeqNyZKs+s=", + "lastModified": 1742954036, + "narHash": "sha256-L6QGMSkquAqW2IjiAI6Q0e0aOR1DsZW8teDxzHQaNaA=", "owner": "nix-community", "repo": "nix-vscode-extensions", - "rev": "14a6e019c40901428b97cdef2d873c18386c8e7f", + "rev": "463df39cfb76e4896a8625554d3c675c30fbe63a", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 52d012f..b5fccc8 100644 --- a/flake.nix +++ b/flake.nix @@ -111,11 +111,11 @@ nixConfig = { extra-substituters = [ "https://nix-community.cachix.org" - "https://nixcache.cy7.sh" + "https://cdn.cy7.sh/main" ]; extra-trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" - "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=" + "main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=" ]; }; diff --git a/hosts/chunk/default.nix b/hosts/chunk/default.nix index f016a84..9a621c4 100644 --- a/hosts/chunk/default.nix +++ b/hosts/chunk/default.nix @@ -184,6 +184,7 @@ security.sudo.enable = true; security.sudo.wheelNeedsPassword = false; + programs.gnupg.agent.enable = true; programs.git.enable = true; my.caddy.enable = true; @@ -191,5 +192,8 @@ # container stuff my.containerization.enable = true; + my.roundcube.enable = true; + my.zipline.enable = true; + my.searx.enable = true; my.attic.enable = true; } diff --git a/hosts/chunk/garage.nix b/hosts/chunk/garage.nix index da9b650..6a25df2 100644 --- a/hosts/chunk/garage.nix +++ b/hosts/chunk/garage.nix @@ -10,11 +10,6 @@ api_bind_addr = "[::]:3900"; root_domain = "s3.cy7.sh"; }; - s3_web = { - bind_addr = "[::]:3902"; - root_domain = ".web.cy7.sh"; - add_host_to_metrics = true; - }; admin.api_bind_addr = "[::]:3903"; rpc_bind_addr = "[::]:3901"; replication_factor = 1; @@ -38,12 +33,5 @@ import common reverse_proxy localhost:3903 ''; - "*.web.cy7.sh" = { - serverAliases = [ "nixcache.cy7.sh" ]; - extraConfig = '' - import common - reverse_proxy localhost:3902 - ''; - }; }; } diff --git a/hosts/chunk/rclone.nix b/hosts/chunk/rclone.nix index 803a188..31cdf54 100644 --- a/hosts/chunk/rclone.nix +++ b/hosts/chunk/rclone.nix @@ -14,18 +14,17 @@ let --config ${config.sops.secrets."rclone/config".path} \ --allow-other \ --cache-dir /var/cache/rclone \ - --transfers 16 \ + --transfers 32 \ --vfs-cache-mode full \ --vfs-cache-min-free-space 5G \ --dir-cache-time 30d \ --no-checksum \ --no-modtime \ --vfs-fast-fingerprint \ - --vfs-read-chunk-size 16M \ - --vfs-read-chunk-streams 16 \ - --sftp-concurrency 64 \ + --vfs-read-chunk-size 4M \ + --vfs-read-chunk-streams 32 \ + --sftp-concurrency 128 \ --sftp-chunk-size 255k \ - --buffer-size 0 \ ${remote} ${mount} ''; ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -zu ${mount}"; diff --git a/hosts/common.nix b/hosts/common.nix index 1d54545..7067008 100644 --- a/hosts/common.nix +++ b/hosts/common.nix @@ -11,11 +11,11 @@ ]; trusted-public-keys = [ "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=" - "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=" + "main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=" ]; extra-substituters = [ "https://nix-community.cachix.org" - "https://nixcache.cy7.sh" + "https://cdn.cy7.sh/main" ]; }; channel.enable = false; diff --git a/secrets/cache-priv-key.pem b/secrets/cache-priv-key.pem deleted file mode 100644 index 30618df..0000000 --- a/secrets/cache-priv-key.pem +++ /dev/null @@ -1,24 +0,0 @@ -{ - "data": "ENC[AES256_GCM,data:IVRg3IqrlV1Cy3xwyVszhUnRzbWP3OSb/XZF1H0N30eKL8d0DxFGngC5qMgRcmSs203/QL3w0fENp1u0f8tVajqJVlzLjlsiQrMdtXmiMv0LKO7E+aj4UZ0wMchB0XgSVUWrKUXxZrA=,iv:3GtA07yuAAI++RsLSwY3U62k1iG9+hvkGn45HjFt/Gk=,tag:PJ13CrjcE06KMC383txqHw==,type:str]", - "sops": { - "kms": null, - "gcp_kms": null, - "azure_kv": null, - "hc_vault": null, - "age": [ - { - "recipient": "age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVdkxBV3NSL1NDRjhPanpZ\nWTQwUmJmTExNOG0xZ1l1M2ZUSlFaTWdzS2hvCkdNT0dmK3FhcC85RE1mQmN1Uncw\nU1A4Znk1Vnk3RmY1UWdBY21VdnRZdWMKLS0tIHhTYUVUeTZsYkJFWk5LdnNDWlc5\ndDFDMUN2RmN0MDNXclpEMFA5Z0F5M0kKsLgc2D73RPNdTo4q7hBPGcBVPGwY73g+\nqQZbkVVzKPHo814ivwIVFYv+i5Qvf+p985Rko/fQ98GxW0G5c9Qfkg==\n-----END AGE ENCRYPTED FILE-----\n" - }, - { - "recipient": "age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn", - "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuZ3B4czExQVZxNUJGNk1X\nbE9Md1Z6blM1S2xhb3VLT0JWbUpjSkxxS1U0Cm41bmt5Rk9LVTJFbVRFT2xxM01i\nTGUyYVU2RWdzRUhBVmNsTzJZWmh6cFUKLS0tIFlXVHQrcTVvbnptRitQVkVXRHBJ\nTjIxVXFvRmRQbUFHRXFjbFIva1IxVG8KciKyUdNjec7ocuKVX8KflMVPKpf/tEVr\nTxudivOoQ0XaqyPVi3cWDpuk2IAWUuJDxjmEctE6JgPtQvs1GsKCdg==\n-----END AGE ENCRYPTED FILE-----\n" - } - ], - "lastmodified": "2025-03-27T20:37:28Z", - "mac": "ENC[AES256_GCM,data:35iUoodcjvIn+VAE20f2sHFaTh3+aqCYQ4HalWdVz4eUSkVNcdXs2uqOZtFv3MszDiH9izM84OyHwykudJ99QE3B/NwpfIoKQaU6Qg5X/g/rC1meffMaZwcASVbepjznahbTKmJqeSrMeybrBIV+6FaSjWXn0+D72GEEM1vgH9c=,iv:N2CbttHJsczm37qdapOCrlNeSSgsZBDlvWyvUpa3mkk=,tag:btniVwaVS9h4jDo4IM2wcA==,type:str]", - "pgp": null, - "unencrypted_suffix": "_unencrypted", - "version": "3.9.4" - } -} \ No newline at end of file