flake update

Signed-off-by: cy <cy@cy7.sh>
2025-03-26 15:08:33 -04:00
10 changed files with 62 additions and 90 deletions
--- a/.github/workflows/build-machines-and-homes.yml
+++ b/.github/workflows/build-machines-and-homes.yml
@ -7,15 +7,12 @@ env:
  ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
  NIX_CONFIG: |
    show-trace = true
+    extra-substituters = https://cdn.cy7.sh/main
+    extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=
    experimental-features = nix-command flakes
    accept-flake-config = true
    system-features = nixos-test benchmark big-parallel kvm
-    secret-key-files = /home/runner/cache-priv-key.pem
-    extra-substituters = https://nixcache.cy7.sh
-    extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
  TERM: ansi
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
 jobs:
  build-machines:
    strategy:
@ -39,14 +36,16 @@ jobs:
          remove-codeql: 'true'
          remove-docker-images: 'true'
          build-mount-path: /nix
-      - name: setup binary cache key
-        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem
      - name: Install Nix
        uses: cachix/install-nix-action@v30
      - name: Sync repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false
+      - name: setup attic
+        run: |
+          nix profile install github:zhaofengli/attic
+          attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
      - name: build
        run: |
          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
@ -54,7 +53,10 @@ jobs:
      - name: cache
        if: always()
        run: |
-          nix copy ".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel" --to "s3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem"
+          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
+          derivation="$(nix path-info --derivation "$package")"
+          cache="$(nix-store --query --requisites --include-outputs "$derivation")"
+          xargs attic push main <<< "$cache"
  build-homes:
    strategy:
      fail-fast: false
@ -78,14 +80,16 @@ jobs:
          remove-codeql: 'true'
          remove-docker-images: 'true'
          build-mount-path: /nix
-      - name: setup binary cache key
-        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem
      - name: Install Nix
        uses: cachix/install-nix-action@v30
      - name: Sync repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false
+      - name: setup attic
+        run: |
+          nix profile install github:zhaofengli/attic
+          attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
      - name: build
        run: |
          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
@ -93,4 +97,7 @@ jobs:
      - name: cache
        if: always()
        run: |
-          nix copy ".#homeConfigurations."${{ matrix.home }}".activationPackage" --to "s3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem"
+          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
+          derivation="$(nix path-info --derivation "$package")"
+          cache="$(nix-store --query --requisites --include-outputs "$derivation")"
+          xargs attic push main <<< "$cache"
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@ -10,11 +10,10 @@ env:
  ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
  NIX_CONFIG: |
    show-trace = true
+    extra-substituters = https://cdn.cy7.sh/main
+    extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=
    experimental-features = nix-command flakes
    accept-flake-config = true
-    secret-key-files = /home/runner/cache-priv-key.pem
-    extra-substituters = https://nixcache.cy7.sh
-    extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
  TERM: ansi
 jobs:
  build-packages:
@ -26,23 +25,27 @@ jobs:
        os:
          - ubuntu-latest
          - ubuntu-24.04-arm
-          # - macos-latest
-          # - macos-13
+          - macos-latest
+          - macos-13
    runs-on: ${{ matrix.os }}
    steps:
-      - name: setup binary cache key
-        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem
      - name: Install Nix
        uses: cachix/install-nix-action@v30
      - name: Sync repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false
+      - name: setup attic
+        run: |
+          nix profile install github:zhaofengli/attic
+          attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
      - run: nix build -L ${{ matrix.package }}
      - name: cache result
        if: always()
        run: |
-          nix copy "${{ matrix.package }}" --to "s3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem"
+          derivation="$(nix path-info --derivation "${{ matrix.package }}")"
+          cache="$(nix-store --query --requisites --include-outputs "$derivation")"
+          xargs attic push main <<< "$cache"
      - name: prepare tarball to upload
        run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
      - name: upload result
--- a/.sops.yaml
+++ b/.sops.yaml
@ -123,8 +123,3 @@ creation_rules:
      - age:
          - *chunk
          - *cy
-  - path_regex: secrets/cache-priv-key.pem
-    key_groups:
-      - age:
-          - *yt
-          - *cy
--- a/flake.lock
+++ b/flake.lock
@ -459,11 +459,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1743094823,
-        "narHash": "sha256-ZWBc4zCMlJXn5u6JN9lZLOasIaTqxc6RHEKP7w6Ktq4=",
+        "lastModified": 1742907812,
+        "narHash": "sha256-iloXwOZWx43mRvW3tlqRbqlDCIkOudrbtqVWE+q5OLg=",
        "owner": "helix-editor",
        "repo": "helix",
-        "rev": "7929c0719d739e248adfd80cd7e5b8e386a43938",
+        "rev": "388a3b78e3c4feff9c058b020c12f9eb47e72168",
        "type": "github"
      },
      "original": {
@ -479,11 +479,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1743097780,
-        "narHash": "sha256-5tUbaMBKYbfTe/4aXACxmiXG22TgwPBNcfZ8Kg3rt+g=",
+        "lastModified": 1742996658,
+        "narHash": "sha256-snxgTLVq6ooaD3W3mPHu7LVWpoZKczhxHAUZy2ea4oA=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "b14a70c40f4fd0b73d095ab04a7c6e31fbc18e52",
+        "rev": "693840c01b9bef9e54100239cef937e53d4661bf",
        "type": "github"
      },
      "original": {
@ -804,11 +804,11 @@
    },
    "nixpkgs-stable_2": {
      "locked": {
-        "lastModified": 1742937945,
-        "narHash": "sha256-lWc+79eZRyvHp/SqMhHTMzZVhpxkRvthsP1Qx6UCq0E=",
+        "lastModified": 1742751704,
+        "narHash": "sha256-rBfc+H1dDBUQ2mgVITMGBPI1PGuCznf9rcWX/XIULyE=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d02d88f8de5b882ccdde0465d8fa2db3aa1169f7",
+        "rev": "f0946fa5f1fb876a9dc2e1850d9d3a4e3f914092",
        "type": "github"
      },
      "original": {
@ -868,11 +868,11 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1743082947,
-        "narHash": "sha256-wZ/bfXu9x025oNa4pVcwYbgVRSl2tf/izZTegPSljUQ=",
+        "lastModified": 1743008566,
+        "narHash": "sha256-vqiNwWvNcIuHIPu6RC1WScwDHlcGerCZWZ8XOLVu0B0=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "8b1bcd4edc0de0a950eb117a37c55294997588b5",
+        "rev": "f55926cd4adb4db12ca97a86bc4e48e2c213f4d9",
        "type": "github"
      },
      "original": {
@ -1038,11 +1038,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1743042789,
-        "narHash": "sha256-yPlxN0r3pQjUIwyX/qeWSTdpHjWy/AfmM0PK1bYkO18=",
+        "lastModified": 1742956365,
+        "narHash": "sha256-Slrqmt6kJ/M7Z/ce4ebQWsz2aeEodrX56CsupOEPoz0=",
        "owner": "oxalica",
        "repo": "rust-overlay",
-        "rev": "b4d2dee9d16e7725b71969f28862ded3a94a7934",
+        "rev": "a0e3395c63cdbc9c1ec17915f8328c077c79c4a1",
        "type": "github"
      },
      "original": {
@ -1108,11 +1108,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1743081648,
-        "narHash": "sha256-WRAylyYptt6OX5eCEBWyTwOEqEtD6zt33rlUkr6u3cE=",
+        "lastModified": 1742982148,
+        "narHash": "sha256-aRA6LSxjlbMI6MmMzi/M5WH/ynd8pK+vACD9za3MKLQ=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "29a3d7b768c70addce17af0869f6e2bd8f5be4b7",
+        "rev": "61c88349bf6dff49fa52d7dfc39b21026c2a8881",
        "type": "github"
      },
      "original": {
@ -1131,11 +1131,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1743040433,
-        "narHash": "sha256-OskUn34vJJdealUG1rdOdnpBEBRfJfw9vKeqNyZKs+s=",
+        "lastModified": 1742954036,
+        "narHash": "sha256-L6QGMSkquAqW2IjiAI6Q0e0aOR1DsZW8teDxzHQaNaA=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "14a6e019c40901428b97cdef2d873c18386c8e7f",
+        "rev": "463df39cfb76e4896a8625554d3c675c30fbe63a",
        "type": "github"
      },
      "original": {
--- a/flake.nix
+++ b/flake.nix
@ -111,11 +111,11 @@
  nixConfig = {
    extra-substituters = [
      "https://nix-community.cachix.org"
-      "https://nixcache.cy7.sh"
+      "https://cdn.cy7.sh/main"
    ];
    extra-trusted-public-keys = [
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-      "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8="
+      "main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0="
    ];
  };

--- a/hosts/chunk/default.nix
+++ b/hosts/chunk/default.nix
@ -184,6 +184,7 @@
  security.sudo.enable = true;
  security.sudo.wheelNeedsPassword = false;

+  programs.gnupg.agent.enable = true;
  programs.git.enable = true;

  my.caddy.enable = true;
@ -191,5 +192,8 @@
  # container stuff
  my.containerization.enable = true;

+  my.roundcube.enable = true;
+  my.zipline.enable = true;
+  my.searx.enable = true;
  my.attic.enable = true;
 }
--- a/hosts/chunk/garage.nix
+++ b/hosts/chunk/garage.nix
@ -10,11 +10,6 @@
        api_bind_addr = "[::]:3900";
        root_domain = "s3.cy7.sh";
      };
-      s3_web = {
-        bind_addr = "[::]:3902";
-        root_domain = ".web.cy7.sh";
-        add_host_to_metrics = true;
-      };
      admin.api_bind_addr = "[::]:3903";
      rpc_bind_addr = "[::]:3901";
      replication_factor = 1;
@ -38,12 +33,5 @@
      import common
      reverse_proxy localhost:3903
    '';
-    "*.web.cy7.sh" = {
-      serverAliases = [ "nixcache.cy7.sh" ];
-      extraConfig = ''
-        import common
-        reverse_proxy localhost:3902
-      '';
-    };
  };
 }
--- a/hosts/chunk/rclone.nix
+++ b/hosts/chunk/rclone.nix
@ -14,18 +14,17 @@ let
        --config ${config.sops.secrets."rclone/config".path} \
        --allow-other \
        --cache-dir /var/cache/rclone \
-        --transfers 16 \
+        --transfers 32 \
        --vfs-cache-mode full \
        --vfs-cache-min-free-space 5G \
        --dir-cache-time 30d \
        --no-checksum \
        --no-modtime \
        --vfs-fast-fingerprint \
-        --vfs-read-chunk-size 16M \
-        --vfs-read-chunk-streams 16 \
-        --sftp-concurrency 64 \
+        --vfs-read-chunk-size 4M \
+        --vfs-read-chunk-streams 32 \
+        --sftp-concurrency 128 \
        --sftp-chunk-size 255k \
-        --buffer-size 0 \
        ${remote} ${mount}
    '';
    ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -zu ${mount}";
--- a/hosts/common.nix
+++ b/hosts/common.nix
@ -11,11 +11,11 @@
      ];
      trusted-public-keys = [
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8="
+        "main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0="
      ];
      extra-substituters = [
        "https://nix-community.cachix.org"
-        "https://nixcache.cy7.sh"
+        "https://cdn.cy7.sh/main"
      ];
    };
    channel.enable = false;
--- a/secrets/cache-priv-key.pem
+++ b/secrets/cache-priv-key.pem
@ -1,24 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:IVRg3IqrlV1Cy3xwyVszhUnRzbWP3OSb/XZF1H0N30eKL8d0DxFGngC5qMgRcmSs203/QL3w0fENp1u0f8tVajqJVlzLjlsiQrMdtXmiMv0LKO7E+aj4UZ0wMchB0XgSVUWrKUXxZrA=,iv:3GtA07yuAAI++RsLSwY3U62k1iG9+hvkGn45HjFt/Gk=,tag:PJ13CrjcE06KMC383txqHw==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVdkxBV3NSL1NDRjhPanpZ\nWTQwUmJmTExNOG0xZ1l1M2ZUSlFaTWdzS2hvCkdNT0dmK3FhcC85RE1mQmN1Uncw\nU1A4Znk1Vnk3RmY1UWdBY21VdnRZdWMKLS0tIHhTYUVUeTZsYkJFWk5LdnNDWlc5\ndDFDMUN2RmN0MDNXclpEMFA5Z0F5M0kKsLgc2D73RPNdTo4q7hBPGcBVPGwY73g+\nqQZbkVVzKPHo814ivwIVFYv+i5Qvf+p985Rko/fQ98GxW0G5c9Qfkg==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuZ3B4czExQVZxNUJGNk1X\nbE9Md1Z6blM1S2xhb3VLT0JWbUpjSkxxS1U0Cm41bmt5Rk9LVTJFbVRFT2xxM01i\nTGUyYVU2RWdzRUhBVmNsTzJZWmh6cFUKLS0tIFlXVHQrcTVvbnptRitQVkVXRHBJ\nTjIxVXFvRmRQbUFHRXFjbFIva1IxVG8KciKyUdNjec7ocuKVX8KflMVPKpf/tEVr\nTxudivOoQ0XaqyPVi3cWDpuk2IAWUuJDxjmEctE6JgPtQvs1GsKCdg==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-03-27T20:37:28Z",
-		"mac": "ENC[AES256_GCM,data:35iUoodcjvIn+VAE20f2sHFaTh3+aqCYQ4HalWdVz4eUSkVNcdXs2uqOZtFv3MszDiH9izM84OyHwykudJ99QE3B/NwpfIoKQaU6Qg5X/g/rC1meffMaZwcASVbepjznahbTKmJqeSrMeybrBIV+6FaSjWXn0+D72GEEM1vgH9c=,iv:N2CbttHJsczm37qdapOCrlNeSSgsZBDlvWyvUpa3mkk=,tag:btniVwaVS9h4jDo4IM2wcA==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.4"
-	}
-}