.github/workflows/build-machines-and-homes.yml

@@ -8,8 +8,6 @@ env:
   TERM: ansi
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
-  AWS_DEFAULT_REGION: us-east-1
-  AWS_ENDPOINT_URL: https://s3.cy7.sh
 
 jobs:
   build-machines:
@@ -37,26 +35,7 @@ jobs:
           build-mount-path: /nix
 
       - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
-
-      - name: Sync repository
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: post-build-hook
-        run: |
-          sudo mkdir -p /etc/nix
-          sudo cp ci/upload-to-cache.sh /etc/nix/
-          sudo chmod +x /etc/nix/upload-to-cache.sh
-
-      - name: setup s3 credentials
-        run: |
-          sudo mkdir /root/.aws
-          echo "[default]" |sudo tee /root/.aws/config |sudo tee /root/.aws/credentials
-          echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" |sudo tee -a /root/.aws/credentials
-          echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" |sudo tee -a /root/.aws/credentials
-          echo "endpoint_url=$AWS_ENDPOINT_URL" |sudo tee -a /root/.aws/config
+        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem
 
       - name: Install Nix
         uses: cachix/install-nix-action@v30
@@ -67,15 +46,39 @@ jobs:
             experimental-features = nix-command flakes
             accept-flake-config = true
             system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-            post-build-hook = /etc/nix/upload-to-cache.sh
+            secret-key-files = /home/runner/cache-priv-key.pem
+            extra-substituters = https://nixcache.cy7.sh https://cache.lix.systems
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
+
+      - name: Install Lix
+        run: |
+          sudo --preserve-env=PATH $(which nix) run \
+          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
+          upgrade-nix
+          nix --version
+
+      - name: Sync repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: build
         run: |
+          # package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
+          # nix build -L "$package"
           nix run nixpkgs#nixos-rebuild build -- -L --flake ".#${{ matrix.machine }}"
 
+      - name: cache
+        # https://stackoverflow.com/a/58859404
+        if: '!cancelled()'
+        run: |
+          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
+          nix run git+https://git.cy7.sh/cy/nixcp.git -- \
+            --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem&compression=zstd' \
+            -u https://nix-community.cachix.org \
+            -u https://nixcache.web.cy7.sh \
+            $package
+
   build-homes:
     strategy:
       fail-fast: false
@@ -102,26 +105,7 @@ jobs:
           build-mount-path: /nix
 
       - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
-
-      - name: Sync repository
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-
-      - name: post-build-hook
-        run: |
-          sudo mkdir -p /etc/nix
-          sudo cp ci/upload-to-cache.sh /etc/nix/
-          sudo chmod +x /etc/nix/upload-to-cache.sh
-
-      - name: setup s3 credentials
-        run: |
-          sudo mkdir /root/.aws
-          echo "[default]" |sudo tee /root/.aws/config |sudo tee /root/.aws/credentials
-          echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" |sudo tee -a /root/.aws/credentials
-          echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" |sudo tee -a /root/.aws/credentials
-          echo "endpoint_url=$AWS_ENDPOINT_URL" |sudo tee -a /root/.aws/config
+        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem
 
       - name: Install Nix
         uses: cachix/install-nix-action@v30
@@ -132,12 +116,34 @@ jobs:
             experimental-features = nix-command flakes
             accept-flake-config = true
             system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-            post-build-hook = /etc/nix/upload-to-cache.sh
+            secret-key-files = /home/runner/cache-priv-key.pem
+            extra-substituters = https://nixcache.cy7.sh https://cache.lix.systems
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
+
+      - name: Install Lix
+        run: |
+          sudo --preserve-env=PATH $(which nix) run \
+          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
+          upgrade-nix
+          nix --version
+
+      - name: Sync repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: build
         run: |
           package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
           nix build -L "$package"
+
+      - name: cache
+        # https://stackoverflow.com/a/58859404
+        if: '!cancelled()'
+        run: |
+          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
+          nix run git+https://git.cy7.sh/cy/nixcp.git -- \
+            --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem&compression=zstd' \
+            -u https://nix-community.cachix.org \
+            -u https://nixcache.web.cy7.sh \
+            $package

.github/workflows/build-packages.yml

@@ -11,8 +11,6 @@ env:
   TERM: ansi
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
-  AWS_DEFAULT_REGION: us-east-1
-  AWS_ENDPOINT_URL: https://s3.cy7.sh
 
 jobs:
   build-packages:
@@ -24,13 +22,13 @@ jobs:
         os:
           - ubuntu-latest
           - ubuntu-24.04-arm
-          - macos-latest
-          - macos-13
+          # - macos-latest
+          # - macos-13
     runs-on: ${{ matrix.os }}
 
     steps:
       - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
+        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem
 
       - name: Install Nix
         uses: cachix/install-nix-action@v30
@@ -41,9 +39,21 @@ jobs:
             experimental-features = nix-command flakes
             accept-flake-config = true
             system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
+            secret-key-files = /home/runner/cache-priv-key.pem
+            extra-substituters = https://nixcache.cy7.sh https://cache.lix.systems
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
+
+      - name: Install Lix
+        run: |
+          sudo --preserve-env=PATH $(which nix) run \
+          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
+          upgrade-nix
+          nix --version
+
+      - name: Sync repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - run: nix build -L ${{ matrix.package }}
 
@@ -51,11 +61,10 @@ jobs:
         # https://stackoverflow.com/a/58859404
         if: '!cancelled()'
         run: |
-          nix run github:cything/nixcp -- \
-            push \
-            --bucket nixcache \
-            --signing-key ${{ runner.temp }}/cache-priv-key.pem \
+          nix run git+https://git.cy7.sh/cy/nixcp.git -- \
+            --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem&compression=zstd' \
             -u https://nix-community.cachix.org \
+            -u https://nixcache.web.cy7.sh \
             "${{ matrix.package }}"
 
       - name: prepare tarball to upload

README

@@ -1 +0,0 @@
-this is only open source for free ci

README.md

@@ -0,0 +1,40 @@
+# infra
+## ./home
+- [home-manager](https://github.com/nix-community/home-manager) configuration files
+- foot, tmux, and zsh are configured in Nix
+- nvim, rofi, sway, waybar are configured in their own literature and symlinked to $XDG_CONFIG_HOME with home-manager
+
+## ./hosts
+- [`hosts/common.nix`](hosts/common.nix): configuration that makes sense on all computers
+- [`hosts/zsh.nix`](hosts/zsh.nix): for computers that have the power to run zsh
+### ./hosts/ytnix
+- personal laptop
+- a single [`default.nix`](hosts/ytnix/default.nix) that could be modularized but works for now
+
+### ./hosts/chunk
+- the overworked server with 5% SLA
+- very short and concise [`default.nix`](hosts/chunk/default.nix)
+- services organized in their modules
+- some services run through `virtualisation.oci-containers`:
+    - [immich](hosts/chunk/immich.nix)
+    - [conduwuit](hosts/chunk/conduwuit.nix)
+
+### ./hosts/titan
+- got this cause chunk would go down way too often :(
+- hosted on azure for "reliability"
+- runs:
+    - [ghost](hosts/titan/ghost.nix) (through `virtualisation.oci-containers`)
+    - [uptime-kuma](hosts/titan/uptime-kuma.nix)
+    - [ntfy-sh](hosts/titan/ntfy.nix)
+
+## ./secrets
+- secrets
+- see [`.sops.yaml`](.sops.yaml) for who privy to what
+
+## backups
+- hourly borgbackup to [rsync.net](https://rsync.net)
+- see [modules/backup](modules/backup.nix)
+
+## monitoring
+- [status.cything.io](https://status.cything.io/): uptime kuma (reliable)
+- [grafana.cything.io](https://grafana.cything.io/): some real-time metrics here; unlike the status page this will go kaput often

ci/upload-to-cache.sh

@@ -1,8 +0,0 @@
-#!/bin/sh
-
-# https://nix.dev/guides/recipes/post-build-hook.html#implementing-the-build-hook
-set -eu
-set -f # disable globbing
-export IFS=' '
-echo "Uploading paths" $OUT_PATHS
-exec /nix/var/nix/profiles/default/bin/nix copy --to "s3://nixcache?endpoint=s3.cy7.sh&compression=zstd&parallel-compression=true" $OUT_PATHS

flake.nix

@@ -2,7 +2,8 @@
   description = "cy's flake";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable-small";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11";
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
     home-manager.url = "github:nix-community/home-manager";
@@ -11,6 +12,9 @@
     lanzaboote.inputs.nixpkgs.follows = "nixpkgs";
     rust-overlay.url = "github:oxalica/rust-overlay";
     rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
+    conduwuit.url = "github:girlbossceo/conduwuit";
+    conduwuit.inputs.nixpkgs.follows = "nixpkgs";
+    lix-module.url = "git+https://git.lix.systems/lix-project/nixos-module?ref=release-2.92";
     nix-ld.url = "github:nix-community/nix-ld";
     nix-ld.inputs.nixpkgs.follows = "nixpkgs";
     nil.url = "github:oxalica/nil";
@@ -67,6 +71,7 @@
                 ./modules
                 inputs.sops-nix.nixosModules.sops
                 inputs.lanzaboote.nixosModules.lanzaboote
+                inputs.lix-module.nixosModules.default
                 inputs.nix-ld.nixosModules.nix-ld
               ];
             };
@@ -79,6 +84,7 @@
                 ./hosts/chunk
                 ./modules
                 inputs.sops-nix.nixosModules.sops
+                inputs.lix-module.nixosModules.default
               ];
             };
           };

garnix.yaml

@@ -0,0 +1,6 @@
+builds:
+  include:
+    - 'nixosConfigurations.*'
+    - 'homeConfigurations.*'
+    - '*.aarch64-linux.*'
+    - '*.x86_64-linux.*'

home/codium.nix

@@ -23,6 +23,8 @@
           tamasfe.even-better-toml
           golang.go
           ms-python.python
+          christian-kohler.path-intellisense
+          # firefox-devtools.vscode-firefox-debug
         ];
       userSettings =
         let
@@ -73,7 +75,11 @@
           "telemetry.enableTelemetry" = false;
           "telemetry.telemetryLevel" = "off";
           "window.titleBarStyle" = "custom";
-          "editor.formatOnSave" = true;
+          # https://github.com/ChristianKohler/PathIntellisense#installation
+          "typescript.suggest.paths" = false;
+          "javascript.suggest.paths" = false;
+
+          "path-intellisense.absolutePathToWorkspace" = true;
 
           # terminal stuff
           "terminal.integrated.cursorBlinking" = true;

home/kitty.nix

@@ -7,6 +7,7 @@
       package = pkgs.ibm-plex;
       size = 12;
     };
+    themeFile = "GitHub_Dark";
     settings = {
       enable_audio_bell = true;
       # how many windows should be open before kitty asks

home/yt/ytnix.nix

@@ -103,8 +103,6 @@
       gopls
       rust-analyzer
       minio-client
-      nil
-      keepassxc
     ];
 
   home.sessionVariables = {
@@ -162,6 +160,4 @@
     enable = true;
     addKeysToAgent = "yes";
   };
-
-  programs.firefox.enable = true;
 }

hosts/chunk/conduwuit.nix

@@ -0,0 +1,33 @@
+{ ... }:
+{
+  services.conduwuit = {
+    enable = true;
+    settings.global = {
+      port = [ 8448 ];
+      server_name = "cything.io";
+      allow_check_for_updates = true;
+    };
+  };
+
+  services.caddy.virtualHosts."chat.cything.io".extraConfig = ''
+    import common
+    reverse_proxy localhost:8448
+  '';
+
+  services.caddy.virtualHosts."cything.io" = {
+    serverAliases = [ "www.cything.io" ];
+    extraConfig = ''
+      import common
+
+      header /.well-known/matrix/* Content-Type application/json
+      header /.well-known/matrix/* Access-Control-Allow-Origin *
+      header /.well-known/matrix/* Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH,HEAD
+      header /.well-known/matrix/* Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization,Origin,Accept
+      route {
+        respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
+        respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
+        redir https://cy7.sh/posts{uri} permanent
+      }
+    '';
+  };
+}

hosts/chunk/default.nix

@@ -16,6 +16,7 @@
     ./redlib.nix
     ./vaultwarden.nix
     ./grafana.nix
+    ./conduwuit.nix
     ./immich.nix
     ./forgejo.nix
     ./garage.nix
@@ -137,15 +138,13 @@
       "podman"
     ];
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
     ];
   };
   users.users.root.openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
-    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
   ];
   # for forgejo
   users.users.git = {
@@ -184,7 +183,7 @@
   my.containerization.enable = true;
   my.authelia.enable = true;
   my.karakeep = {
-    enable = false;
+    enable = true;
     dataDir = "/opt/karakeep";
   };
 }

hosts/common.nix

@@ -1,7 +1,6 @@
-{ inputs, config, pkgs, ... }:
+{ inputs, config, ... }:
 {
   nix = {
-    package = pkgs.lix;
     settings = {
       experimental-features = "nix-command flakes";
       auto-optimise-store = true;

hosts/ytnix/default.nix

@@ -274,6 +274,7 @@
     enable = true;
     # nix run github:thiagokokada/nix-alien#nix-alien-find-libs ./<binary>
     libraries = with pkgs; [
+      # TODO: revisit what we actually need
       mesa
       extest
       stdenv.cc.cc
@@ -329,7 +330,6 @@
       pcre2
       gsettings-desktop-schemas
       fzf
-      systemd
     ];
   };
   programs.evolution.enable = true;

modules/caddy.nix

@@ -21,7 +21,7 @@ in
           # (still need the @ to pass nix config check)
           "github.com/caddy-dns/cloudflare@v0.0.0-20250228175314-1fb64108d4de"
         ];
-        hash = "sha256-pfh9DXUj35jlAntkWc4D5wuW04xxQfM1rZ4KFauMzvc=";
+        hash = "sha256-YYpsf8HMONR1teMiSymo2y+HrKoxuJMKIea5/NEykGc=";
       };
       logFormat = lib.mkForce "level INFO";
       acmeCA = "https://acme-v02.api.letsencrypt.org/directory";
@@ -49,8 +49,7 @@ in
         respond / 200 {
           body "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6
         ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhUt9h5dCcrwOrZNKkStCX5OxumPzEwYXSU/0DgtWgP
-        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD
-        sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
+        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD"
         }
       '';
     };

overlay/default.nix

@@ -7,12 +7,14 @@
       pkgFrom = flake: pkg: flake.packages.${prev.system}.${pkg};
     in
     {
+      conduwuit = pkgFrom inputs.conduwuit "default";
+      attic-server = pkgFrom inputs.attic "attic-server";
+      attic = pkgFrom inputs.attic "attic";
       garage = (
         (pkgFrom inputs.garage "default").overrideAttrs {
           meta.mainProgram = "garage";
         }
       );
-      nil = pkgFrom inputs.nil "default";
     }
   )
 ]