ytnix: disable nix sandbox

.github/workflows/build-machines-and-homes.yml

@@ -3,6 +3,17 @@ on:
   workflow_dispatch:
   push:
   pull_request:
+env:
+  ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+  NIX_CONFIG: |
+    show-trace = true
+    extra-substituters = https://cache.cy7.sh/main
+    extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=
+    experimental-features = nix-command flakes
+    extra-experimental-features = nix-command flakes
+    accept-flake-config = true
+  TERM: ansi
+
 jobs:
   build-machines:
     strategy:
@@ -26,21 +37,15 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
           build-mount-path: /nix
+
       - name: Install Nix
-        uses: cachix/install-nix-action@v30
+        uses: nixbuild/nix-quick-install-action@master
-        with:
+
-          install_url: https://releases.nixos.org/nix/nix-2.25.4/install
-          extra_nix_config: 'accept-flake-config = true'
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: cachix/cachix-action@v14
+
-        with:
-          name: cything
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          useDaemon: false
-          installCommand: nix profile install nixpkgs#cachix
       - name: Restore and cache Nix store
         uses: nix-community/cache-nix-action@v5.1.0
         with:
@@ -58,7 +63,30 @@ jobs:
           purge-primary-key: never
           # always save the cache
           save-always: true
-      - run: nix build -L .#nixosConfigurations.${{ matrix.machine }}.config.system.build.toplevel
+          
+      - name: setup attic
+        run: |
+          nix profile install github:zhaofengli/attic
+          attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
+
+      - name: build and cache
+        run: |
+          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
+          nix build -L "$package"
+          derivation="$(nix path-info --derivation "$package")"
+          cache="$(nix-store --query --requisites --include-outputs "$derivation")"
+          attic push main --stdin <<< "$cache"
+
+      - name: prepare tarball to upload
+        run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
+
+      - name: upload result
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.machine }}-${{ matrix.os }}
+          path: result.tar
+          if-no-files-found: error
+
   build-homes:
     strategy:
       matrix:
@@ -81,17 +109,14 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
           build-mount-path: /nix
+
       - uses: nixbuild/nix-quick-install-action@master
+
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: cachix/cachix-action@v14
+
-        with:
-          name: cything
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-          useDaemon: false
-          installCommand: nix profile install nixpkgs#cachix
       - name: Restore and cache Nix store
         uses: nix-community/cache-nix-action@v5.1.0
         with:
@@ -109,4 +134,26 @@ jobs:
           purge-primary-key: never
           # always save the cache
           save-always: true
-      - run: nix build -L .#homeConfigurations."${{ matrix.home }}".activationPackage
+
+      - name: setup attic
+        run: |
+          nix profile install github:zhaofengli/attic
+          attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
+
+      - name: build and cache
+        run: |
+          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
+          nix build -L "$package"
+          derivation="$(nix path-info --derivation "$package")"
+          cache="$(nix-store --query --requisites --include-outputs "$derivation")"
+          attic push main --stdin <<< "$cache"
+
+      - name: prepare tarball to upload
+        run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
+
+      - name: upload result
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.home }}-${{ matrix.os }}
+          path: result.tar
+          if-no-files-found: error

.github/workflows/build-packages.yml

@@ -6,6 +6,17 @@ on:
         description: "package to build"
         required: false
         type: string
+env:
+  ATTIC_TOKEN: ${{ secrets.ATTIC_TOKEN }}
+  NIX_CONFIG: |
+    show-trace = true
+    extra-substituters = https://cache.cy7.sh/main
+    extra-trusted-public-keys = main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0=
+    experimental-features = nix-command flakes
+    extra-experimental-features = nix-command flakes
+    accept-flake-config = true
+  TERM: ansi
+
 jobs:
   build-packages:
     strategy:
@@ -18,6 +29,7 @@ jobs:
           - ubuntu-24.04-arm
           - macos-latest
           - macos-13
+
     runs-on: ${{ matrix.os }}
     steps:
       - name: Install Nix
@@ -28,11 +40,25 @@ jobs:
         with:
           persist-credentials: false
           
-      - uses: cachix/cachix-action@v14
+      - name: setup attic
-        with:
+        run: |
-          name: cything
+          nix profile install github:zhaofengli/attic
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          attic login cy7 https://cache.cy7.sh "$ATTIC_TOKEN"
-          useDaemon: false
-          installCommand: nix profile install nixpkgs#cachix
 
       - run: nix build -L ${{ matrix.package }}
+      
+      - name: cache result
+        run: |
+          derivation="$(nix path-info --derivation "${{ matrix.package }}")"
+          cache="$(nix-store --query --requisites --include-outputs "$derivation")"
+          attic push main --stdin <<< "$cache"
+
+      - name: prepare tarball to upload
+        run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
+
+      - name: upload result
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.os }}
+          path: result.tar
+          if-no-files-found: error

flake.lock

@@ -342,6 +342,38 @@
         "type": "github"
       }
     },
+    "garage": {
+      "inputs": {
+        "crane": [
+          "crane"
+        ],
+        "flake-compat": [
+          "flake-compat"
+        ],
+        "flake-utils": [
+          "flake-utils"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "rust-overlay": [
+          "rust-overlay"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741360584,
+        "narHash": "sha256-5UkuvKllBRhU943imyc0jHDXQDVhIFx5WWUr3qrLEWQ=",
+        "owner": "deuxfleurs-org",
+        "repo": "garage",
+        "rev": "c96be1a9a8aa3b51075678888b80c2414ead2909",
+        "type": "github"
+      },
+      "original": {
+        "owner": "deuxfleurs-org",
+        "repo": "garage",
+        "type": "github"
+      }
+    },
     "git-hooks": {
       "inputs": {
         "flake-compat": [
@@ -1002,6 +1034,7 @@
         "flake-compat": "flake-compat_2",
         "flake-parts": "flake-parts_2",
         "flake-utils": "flake-utils",
+        "garage": "garage",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "lix": "lix",

flake.nix

@@ -88,6 +88,16 @@
         crane.follows = "crane";
       };
     };
+    garage = {
+      url = "github:deuxfleurs-org/garage";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        rust-overlay.follows = "rust-overlay";
+        crane.follows = "crane";
+        flake-compat.follows = "flake-compat";
+        flake-utils.follows = "flake-utils";
+      };
+    };
 
     nvim-github-theme = {
       url = "github:projekt0n/github-nvim-theme";
@@ -105,11 +115,13 @@
       "https://nix-community.cachix.org"
       "https://cache.garnix.io"
       "https://cything.cachix.org"
+      "https://cache.cy7.sh/main"
     ];
     extra-trusted-public-keys = [
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
       "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
       "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
+      "main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0="
     ];
     builders-use-substitutes = true;
   };

home/codium.nix

@@ -21,6 +21,8 @@
           tomrijndorp.find-it-faster
           streetsidesoftware.code-spell-checker
           emilast.logfilehighlighter
+          tamasfe.even-better-toml
+          golang.go
         ];
       userSettings =
         let

home/yt/ytnix.nix

@@ -102,6 +102,7 @@
       pixelflasher
       element-desktop
       freetube
+      gopls
     ];
 
   home.sessionVariables = {

hosts/chunk/default.nix

@@ -22,7 +22,6 @@
     ./forgejo.nix
     ./garage.nix
     ./tailscale.nix
-    ./tor.nix
   ];
 
   sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@@ -101,22 +100,18 @@
           ${tc} qdisc del dev ens18 root || true
 
           # create HTB hierarchy
-          ${tc} qdisc add dev ens18 root handle 1: htb default 30
+          ${tc} qdisc add dev ens18 root handle 1: htb default 10
           ${tc} class add dev ens18 parent 1: classid 1:1 htb rate 100% ceil 100%
-          # tailscale
-          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 30% ceil 100%
-          # caddy
-          ${tc} class add dev ens18 parent 1:1 classid 1:20 htb rate 30% ceil 100%
           # rest
+          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 60% ceil 100%
+          # caddy
           ${tc} class add dev ens18 parent 1:1 classid 1:30 htb rate 40% ceil 100%
 
           # mark traffic
-          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/tailscaled.service" -j MARK --set-mark 1
+          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 3
-          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 2
 
           # route marked packets
-          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 1 fw flowid 1:10
+          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 3 fw flowid 1:30
-          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 2 fw flowid 1:20
         '';
     };
     interfaces.ens18 = {

hosts/chunk/tor.nix

@@ -1,16 +0,0 @@
-{ ... }:
-{
-  services.tor = {
-    enable = true;
-    openFirewall = true;
-    relay = {
-      enable = true;
-      role = "relay";
-    };
-    settings = {
-      ORPort = 9001;
-      Nickname = "chunk";
-      # MaxAdvertisedBandwidth = "20MBytes";
-    };
-  };
-}

hosts/common.nix

@@ -14,12 +14,14 @@
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
         "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
         "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
+        "main:Ku31HoEWcBtfggge2VGj+QTkVrQuIwRIMGyfV/5VQP0="
       ];
       substituters = [
         "https://niri.cachix.org"
         "https://nix-community.cachix.org"
         "https://cache.garnix.io"
         "https://cything.cachix.org"
+        "https://cache.cy7.sh/main"
       ];
     };
     channel.enable = false;

hosts/ytnix/default.nix

@@ -144,6 +144,7 @@
     "docker"
     "disk"
     "adbusers"
+    "podman"
   ];
 
   environment.systemPackages = with pkgs; lib.flatten [
@@ -384,4 +385,5 @@
   programs.ccache.enable = true;
   nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
   programs.fuse.userAllowOther = true;
+  nix.settings.sandbox = false;
 }

modules/containerization.nix

@@ -28,8 +28,11 @@ in
           dns_enabled = true;
           ipv6_enabled = true;
         };
+        # answer on /var/run/docker.sock
+        dockerSocket.enable = true;
       };
-      oci-containers.backend = lib.mkIf cfg.usePodman "podman";
+      docker.enable = lib.mkIf (!cfg.usePodman) true;
+      oci-containers.backend = lib.mkIf (!cfg.usePodman) "docker";
     };
   };
 }

overlay/default.nix

@@ -19,6 +19,9 @@ in
       pixelflasher = nixpkgsFrom inputs.pixelflasher "pixelflasher";
       attic-server = pkgFrom inputs.attic "attic-server";
       attic = pkgFrom inputs.attic "attic";
+      garage = ((pkgFrom inputs.garage "default").overrideAttrs {
+          meta.mainProgram = "garage";
+      });
     }
   )
 ]