Merge branch 'main' of src:greg/nixos-config

.gitlab-ci.yml

@@ -49,5 +49,5 @@ default:
   script:
     - podman login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
     - podman load -i "${IMG}.tar.gz"
-    - podman tag "localhost/${IMG}:latest" "$CI_REGISTRY/greg/ci-images/${IMG}:latest"
+    - podman tag "localhost/${IMG}:latest" "$CI_REGISTRY/greg/nixos-config/${IMG}:latest"
-    - podman push "$CI_REGISTRY/greg/ci-images/${IMG}:latest"
+    - podman push "$CI_REGISTRY/greg/nixos-config/${IMG}:latest"

darwin/baseline.nix

@@ -1,5 +1,4 @@
 {
-  config,
   pkgs,
   ...
 }:

darwin/default.nix

@@ -36,4 +36,5 @@ let
 in
 rec {
   "MacBook-Pro" = mac { name = "ivr"; };
+  "MacBook-Prolocal" = mac { name = "ivr"; };
 }

darwin/hosts/ivr/default.nix

@@ -16,23 +16,32 @@ in
         name = "libvirt";
         restart_service = true;
       }
-      "mysql"
       "nushell"
       "poetry"
+      {
+        name = "postgresql@17";
+        restart_service = true;
+      }
+      "pytest"
       "qemu"
     ];
     casks = [
       "alt-tab"
+      "audacity"
       "bitwarden"
       "bruno"
       "chromium"
+      "dbeaver-community"
+      "ghostty"
       "firefox"
       "microsoft-teams"
+      "notunes"
       "onlyoffice"
       "pgadmin4"
+      "podman-desktop"
       "tabby"
-      "twine"
       "vagrant"
+      "virtualbox"
       "visual-studio-code"
       "zed"
       "zoho-workdrive"

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1747575206,
+        "lastModified": 1754433428,
-        "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=",
+        "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "4835b1dc898959d8547a871ef484930675cb47f1",
+        "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
         "type": "github"
       },
       "original": {
@@ -31,11 +31,11 @@
         "nixpkgs-unstable": "nixpkgs-unstable"
       },
       "locked": {
-        "lastModified": 1748187031,
+        "lastModified": 1757876184,
-        "narHash": "sha256-F4zdOfeg0xjEnvFjlHvoMmdmh/FxK1qIsZyscnGDgA0=",
+        "narHash": "sha256-ezKJm8vzMb6bZf2lG+/s4AGhXtMvshEYBYqDT2PLtIU=",
         "owner": "fort-nix",
         "repo": "nix-bitcoin",
-        "rev": "a06d1d8118865af14a9187e7d1a7a141dd89af74",
+        "rev": "0c961fa789d69ccd9503d2548dca1a9285acf2ff",
         "type": "github"
       },
       "original": {
@@ -45,6 +45,28 @@
         "type": "github"
       }
     },
+    "charts": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "haumea": "haumea",
+        "nix-kube-generators": "nix-kube-generators",
+        "nixpkgs": "nixpkgs_2",
+        "poetry2nix": "poetry2nix"
+      },
+      "locked": {
+        "lastModified": 1757985998,
+        "narHash": "sha256-9wxH9I7BJflSBXxXQJwqqWLC/lGr96MNI++Ci70HBF0=",
+        "owner": "nix-community",
+        "repo": "nixhelm",
+        "rev": "0b9e8a1e3ed75731507d1055a75343a616dda286",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixhelm",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -74,11 +96,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749194393,
+        "lastModified": 1757430124,
-        "narHash": "sha256-vt6hM9DNywnXXuW1qPDLzECmbDcmxhh58wpb0EEQjAo=",
+        "narHash": "sha256-MhDltfXesGH8VkGv3hmJ1QEKl1ChTIj9wmGAFfWj/Wk=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "19346808c445f23b08652971be198b9df6c33edc",
+        "rev": "830b3f0b50045cf0bcfd4dab65fad05bf882e196",
         "type": "github"
       },
       "original": {
@@ -117,11 +139,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1696426674,
+        "lastModified": 1747046372,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
         "owner": "edolstra",
         "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
         "type": "github"
       },
       "original": {
@@ -166,11 +188,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1749398372,
+        "lastModified": 1756770412,
-        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+        "rev": "4524271976b625a4a605beefd893f270620fd751",
         "type": "github"
       },
       "original": {
@@ -187,11 +209,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743550720,
+        "lastModified": 1756770412,
-        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
+        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
+        "rev": "4524271976b625a4a605beefd893f270620fd751",
         "type": "github"
       },
       "original": {
@@ -221,24 +243,6 @@
         "type": "github"
       }
     },
-    "flake-parts_4": {
-      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib_2"
-      },
-      "locked": {
-        "lastModified": 1748821116,
-        "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
     "flake-utils": {
       "inputs": {
         "systems": "systems_2"
@@ -269,13 +273,30 @@
         "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
         "type": "github"
       },
+      "original": {
+        "id": "flake-utils",
+        "type": "indirect"
+      }
+    },
+    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
       "original": {
         "owner": "numtide",
         "repo": "flake-utils",
         "type": "github"
       }
     },
-    "flake-utils_3": {
+    "flake-utils_4": {
       "inputs": {
         "systems": "systems_6"
       },
@@ -293,6 +314,24 @@
         "type": "github"
       }
     },
+    "flake-utils_5": {
+      "inputs": {
+        "systems": "systems_9"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "gitignore": {
       "inputs": {
         "nixpkgs": [
@@ -314,6 +353,28 @@
         "type": "github"
       }
     },
+    "haumea": {
+      "inputs": {
+        "nixpkgs": [
+          "charts",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1685133229,
+        "narHash": "sha256-FePm/Gi9PBSNwiDFq3N+DWdfxFq0UKsVVTJS3cQPn94=",
+        "owner": "nix-community",
+        "repo": "haumea",
+        "rev": "34dd58385092a23018748b50f9b23de6266dffc2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "v0.2.2",
+        "repo": "haumea",
+        "type": "github"
+      }
+    },
     "hmunstable": {
       "inputs": {
         "nixpkgs": [
@@ -321,11 +382,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749526396,
+        "lastModified": 1757997814,
-        "narHash": "sha256-UL9F76abAk87llXOrcQRjhd5OaOclUd6MIltsqcUZmo=",
+        "narHash": "sha256-F+1aoG+3NH4jDDEmhnDUReISyq6kQBBuktTUqCUWSiw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "427c96044f11a5da50faf6adaf38c9fa47e6d044",
+        "rev": "5820376beb804de9acf07debaaff1ac84728b708",
         "type": "github"
       },
       "original": {
@@ -360,14 +421,14 @@
       "inputs": {
         "flake-compat": "flake-compat",
         "gitignore": "gitignore",
-        "nixpkgs": "nixpkgs_2"
+        "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1747372754,
+        "lastModified": 1757974173,
-        "narHash": "sha256-2Y53NGIX2vxfie1rOW0Qb86vjRZ7ngizoo+bnXU9D9k=",
+        "narHash": "sha256-4DpXmct/2rcLgScT1CXOLr0TUeIlrBB1rnFqCOf5MUw=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "80479b6ec16fefd9c1db3ea13aeb038c60530f46",
+        "rev": "302af509428169db34f268324162712d10559f74",
         "type": "github"
       },
       "original": {
@@ -390,27 +451,49 @@
         ]
       },
       "locked": {
-        "lastModified": 1748294338,
+        "lastModified": 1754860581,
-        "narHash": "sha256-FVO01jdmUNArzBS7NmaktLdGA5qA3lUMJ4B7a05Iynw=",
+        "narHash": "sha256-EM0IE63OHxXCOpDHXaTyHIOk2cNvMCGPqLt/IdtVxgk=",
         "owner": "NuschtOS",
         "repo": "ixx",
-        "rev": "cc5f390f7caf265461d4aab37e98d2292ebbdb85",
+        "rev": "babfe85a876162c4acc9ab6fb4483df88fa1f281",
         "type": "github"
       },
       "original": {
         "owner": "NuschtOS",
-        "ref": "v0.0.8",
+        "ref": "v0.1.1",
         "repo": "ixx",
         "type": "github"
       }
     },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "charts",
+          "poetry2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
     "nix-hardware": {
       "locked": {
-        "lastModified": 1749195551,
+        "lastModified": 1757943327,
-        "narHash": "sha256-W5GKQHgunda/OP9sbKENBZhMBDNu2QahoIPwnsF6CeM=",
+        "narHash": "sha256-w6cDExPBqbq7fTLo4dZ1ozDGeq3yV6dSN4n/sAaS6OM=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "4602f7e1d3f197b3cb540d5accf5669121629628",
+        "rev": "67a709cfe5d0643dafd798b0b613ed579de8be05",
         "type": "github"
       },
       "original": {
@@ -419,6 +502,21 @@
         "type": "github"
       }
     },
+    "nix-kube-generators": {
+      "locked": {
+        "lastModified": 1729269463,
+        "narHash": "sha256-8jDDpC99fYl5CSHjZyPwb5PK7nQSknhkpfe8+DXI910=",
+        "owner": "farcaller",
+        "repo": "nix-kube-generators",
+        "rev": "2be4f3cb99e179d9f94e6c8723862421437f8efb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "farcaller",
+        "repo": "nix-kube-generators",
+        "type": "github"
+      }
+    },
     "nixlib": {
       "locked": {
         "lastModified": 1736643958,
@@ -442,11 +540,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747663185,
+        "lastModified": 1751903740,
-        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
+        "narHash": "sha256-PeSkNMvkpEvts+9DjFiop1iT2JuBpyknmBUs0Un0a4I=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
+        "rev": "032decf9db65efed428afd2fa39d80f7089085eb",
         "type": "github"
       },
       "original": {
@@ -457,42 +555,27 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748037224,
+        "lastModified": 1757545623,
-        "narHash": "sha256-92vihpZr6dwEMV6g98M5kHZIttrWahb9iRPBm1atcPk=",
+        "narHash": "sha256-mCxPABZ6jRjUQx3bPP4vjA68ETbPLNz9V2pk9tO7pRQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f09dede81861f3a83f7f06641ead34f02f37597f",
+        "rev": "8cd5ce828d5d1d16feff37340171a98fc3bf6526",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-25.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1748740939,
+        "lastModified": 1754788789,
-        "narHash": "sha256-rQaysilft1aVMwF14xIdGS3sj1yHlI6oKQNBRTF40cc=",
+        "narHash": "sha256-x2rJ+Ovzq0sCMpgfgGaaqgBSwY+LST+WbZ6TytnT9Rk=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "656a64127e9d791a334452c6b6606d17539476e2",
+        "rev": "a73b9c743612e4244d865a2fdee11865283c04e6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib_2": {
-      "locked": {
-        "lastModified": 1748740939,
-        "narHash": "sha256-rQaysilft1aVMwF14xIdGS3sj1yHlI6oKQNBRTF40cc=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "656a64127e9d791a334452c6b6606d17539476e2",
         "type": "github"
       },
       "original": {
@@ -518,11 +601,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1747958103,
+        "lastModified": 1757584362,
-        "narHash": "sha256-qmmFCrfBwSHoWw7cVK4Aj+fns+c54EBP8cGqp/yK410=",
+        "narHash": "sha256-XeTX/w16rUNUNBsfaOVCDoMMa7Xu7KvIMT7tn1zIEcg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fe51d34885f7b5e3e7b59572796e1bcb427eccb1",
+        "rev": "d33e926c80e6521a55da380a4c4c44a7462af405",
         "type": "github"
       },
       "original": {
@@ -549,11 +632,27 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1730768919,
+        "lastModified": 1739020877,
-        "narHash": "sha256-8AKquNnnSaJRXZxc5YmF/WfmxiHX6MMZZasRP6RRQkE=",
+        "narHash": "sha256-mIvECo/NNdJJ/bXjNqIh8yeoSjVLAuDuTUzAo7dzs8Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a04d33c0c3f1a59a2c1cb0c6e34cd24500e5a1dc",
+        "rev": "a79cfe0ebd24952b580b1cf08cd906354996d547",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1754340878,
+        "narHash": "sha256-lgmUyVQL9tSnvvIvBp7x1euhkkCho7n3TMzgjdvgPoU=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "cab778239e705082fe97bb4990e0d24c50924c04",
         "type": "github"
       },
       "original": {
@@ -563,13 +662,13 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs_4": {
       "locked": {
-        "lastModified": 1749285348,
+        "lastModified": 1757745802,
-        "narHash": "sha256-frdhQvPbmDYaScPFiCnfdh3B/Vh81Uuoo0w5TkWmmjU=",
+        "narHash": "sha256-hLEO2TPj55KcUFUU1vgtHE9UEIOjRcH/4QbmfHNF820=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3e3afe5174c561dee0df6f2c2b2236990146329f",
+        "rev": "c23193b943c6c689d70ee98ce3128239ed9e32d1",
         "type": "github"
       },
       "original": {
@@ -579,7 +678,7 @@
         "type": "github"
       }
     },
-    "nixpkgs_4": {
+    "nixpkgs_5": {
       "locked": {
         "lastModified": 1744868846,
         "narHash": "sha256-5RJTdUHDmj12Qsv7XOhuospjAjATNiTMElplWnJE9Hs=",
@@ -597,11 +696,11 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1749285348,
+        "lastModified": 1757745802,
-        "narHash": "sha256-frdhQvPbmDYaScPFiCnfdh3B/Vh81Uuoo0w5TkWmmjU=",
+        "narHash": "sha256-hLEO2TPj55KcUFUU1vgtHE9UEIOjRcH/4QbmfHNF820=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3e3afe5174c561dee0df6f2c2b2236990146329f",
+        "rev": "c23193b943c6c689d70ee98ce3128239ed9e32d1",
         "type": "github"
       },
       "original": {
@@ -618,14 +717,14 @@
           "nixunstable"
         ],
         "nuschtosSearch": "nuschtosSearch",
-        "systems": "systems_4"
+        "systems": "systems_7"
       },
       "locked": {
-        "lastModified": 1749496904,
+        "lastModified": 1758032055,
-        "narHash": "sha256-eNDMzrcDBOprdJs7DpMOJfCEcxribxDJP2OjozSC3Wo=",
+        "narHash": "sha256-quoLrTtC8JVG0HEv3VzJSXiQnL40K5CX9yvYqd7OKpc=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "e0b3d8bc3a0ab5a7cc0792c7705e92f9c5c598f3",
+        "rev": "796d662401c420ba11d34901185718059aa3bfb5",
         "type": "github"
       },
       "original": {
@@ -638,15 +737,14 @@
     "nurpkgs": {
       "inputs": {
         "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4"
-        "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1749566933,
+        "lastModified": 1758030607,
-        "narHash": "sha256-rolwj4dzqfzFMG3VGEN7zKwGTBd0XAKcvOTTEOre3XY=",
+        "narHash": "sha256-ph7zS5GkgIh0fvaSNbIstJEVDgkskdRIwNyfXccSTSo=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "28532113cfab3f76c3a80f04ef38dca164d7b819",
+        "rev": "f534dee3dc628ceb5b036b174363c1196df5a529",
         "type": "github"
       },
       "original": {
@@ -657,7 +755,7 @@
     },
     "nuschtosSearch": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils_4",
         "ixx": "ixx",
         "nixpkgs": [
           "nixvimunstable",
@@ -665,11 +763,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748298102,
+        "lastModified": 1757885130,
-        "narHash": "sha256-PP11GVwUt7F4ZZi5A5+99isuq39C59CKc5u5yVisU/U=",
+        "narHash": "sha256-56CMb5W/pgjKLh0bx2ekhn5rde/YmgR63HAqrY9/BCw=",
         "owner": "NuschtOS",
         "repo": "search",
-        "rev": "f8a1c221afb8b4c642ed11ac5ee6746b0fe1d32f",
+        "rev": "fae3c59a646e00c4b1d359c50b27458a0713d2fd",
         "type": "github"
       },
       "original": {
@@ -678,19 +776,28 @@
         "type": "github"
       }
     },
-    "patched-nixpkgs": {
+    "poetry2nix": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": [
+          "charts",
+          "nixpkgs"
+        ],
+        "systems": "systems_5",
+        "treefmt-nix": "treefmt-nix"
+      },
       "locked": {
-        "lastModified": 1748133736,
+        "lastModified": 1738741221,
-        "narHash": "sha256-8DCZF+SHXa7P9O9op2ET7qJtPomzQ49jy2vjzrHocg4=",
+        "narHash": "sha256-UiTOA89yQV5YNlO1ZAp4IqJUGWOnTyBC83netvt8rQE=",
-        "owner": "TomaSajt",
+        "owner": "nix-community",
-        "repo": "nixpkgs",
+        "repo": "poetry2nix",
-        "rev": "76121e3e5db9bfcc4b604b4093abea7b1aa3109e",
+        "rev": "be1fe795035d3d36359ca9135b26dcc5321b31fb",
         "type": "github"
       },
       "original": {
-        "owner": "TomaSajt",
+        "owner": "nix-community",
-        "ref": "fetch-cargo-vendor-dup",
+        "repo": "poetry2nix",
-        "repo": "nixpkgs",
         "type": "github"
       }
     },
@@ -702,11 +809,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1749385025,
+        "lastModified": 1754428470,
-        "narHash": "sha256-2w6+xAMdT9LgMxDHaIyddMTacBbF7RjaZFyGjjTDBhg=",
+        "narHash": "sha256-Sxf8gf+vfGeFaJMW3D+8pwH/+WwYTQOg47Lrm42+kTc=",
         "owner": "SaumonNet",
         "repo": "proxmox-nixos",
-        "rev": "48f39fbe2e8f90f9ac160dd4b6929f3ac06d8223",
+        "rev": "6faed2845ef5f0bb05c9519b75097bbe7fb39327",
         "type": "github"
       },
       "original": {
@@ -719,6 +826,7 @@
       "inputs": {
         "agenix": "agenix",
         "btc": "btc",
+        "charts": "charts",
         "darwin": "darwin_2",
         "flake-parts": "flake-parts",
         "hmunstable": "hmunstable",
@@ -730,8 +838,7 @@
         "nurpkgs": "nurpkgs",
         "proxmox": "proxmox",
         "vsext": "vsext",
-        "wsl": "wsl",
+        "wsl": "wsl"
-        "zed": "zed"
       }
     },
     "systems": {
@@ -824,19 +931,65 @@
         "type": "github"
       }
     },
+    "systems_7": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_8": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_9": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
     "treefmt-nix": {
       "inputs": {
         "nixpkgs": [
-          "nurpkgs",
+          "charts",
+          "poetry2nix",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1733222881,
+        "lastModified": 1730120726,
-        "narHash": "sha256-JIPcz1PrpXUCbaccEnrcUS8jjEb/1vJbZz5KkobyFdM=",
+        "narHash": "sha256-LqHYIxMrl/1p3/kvm2ir925tZ8DkI0KA10djk8wecSk=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "49717b5af6f80172275d47a418c9719a31a78b53",
+        "rev": "9ef337e492a5555d8e17a51c911ff1f02635be15",
         "type": "github"
       },
       "original": {
@@ -847,7 +1000,7 @@
     },
     "utils": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_8"
       },
       "locked": {
         "lastModified": 1710146030,
@@ -865,15 +1018,15 @@
     },
     "vsext": {
       "inputs": {
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_5",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1749521131,
+        "lastModified": 1757987448,
-        "narHash": "sha256-ezZ15tLA2L+rmtn39dKLFW/UM2xlksC61V12blulpjE=",
+        "narHash": "sha256-ltDT7EIfLHV42p99HnDfDviC8jN7tcOed1qsLEFypl8=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "299b2aa650d32310153746135b6a84a6c4de9c21",
+        "rev": "e496568b0e69d9d54c8cfef96ed1370952ad9786",
         "type": "github"
       },
       "original": {
@@ -890,11 +1043,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749574455,
+        "lastModified": 1757937573,
-        "narHash": "sha256-fm2/8KPOYvvIAnNVtjDlTt/My00lIbZQ+LMrfQIWVzs=",
+        "narHash": "sha256-B+MT526k5th4x22h213/CgzdkKWIaeaa0+Y0uuCkH/I=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "917af390377c573932d84b5e31dd9f2c1b5c0f09",
+        "rev": "134e117c969f42277f1c5e60c8fbcac103c2c454",
         "type": "github"
       },
       "original": {
@@ -902,28 +1055,6 @@
         "repo": "NixOS-WSL",
         "type": "github"
       }
-    },
-    "zed": {
-      "inputs": {
-        "flake-parts": "flake-parts_4",
-        "nixpkgs": [
-          "nixunstable"
-        ],
-        "patched-nixpkgs": "patched-nixpkgs"
-      },
-      "locked": {
-        "lastModified": 1749228292,
-        "narHash": "sha256-cavxEaS1a1jQqkQsGVUiu3Hlex3wqUfFB1LE2TXT0vA=",
-        "owner": "HPsaucii",
-        "repo": "zed-editor-flake",
-        "rev": "db6c84831c7bedcf63dcecf1e0b59cddea302c62",
-        "type": "github"
-      },
-      "original": {
-        "owner": "HPsaucii",
-        "repo": "zed-editor-flake",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -21,6 +21,9 @@
     btc = {
       url = "github:fort-nix/nix-bitcoin/release";
     };
+    charts = {
+      url = "github:nix-community/nixhelm";
+    };
     darwin = {
       url = "github:lnl7/nix-darwin/master";
       inputs.nixpkgs.follows = "nixunstable";
@@ -50,10 +53,6 @@
       url = "github:nix-community/NixOS-WSL";
       inputs.nixpkgs.follows = "nixunstable";
     };
-    zed = {
-      url = "github:HPsaucii/zed-editor-flake";
-      inputs.nixpkgs.follows = "nixunstable";
-    };
   };
 
   outputs =
@@ -66,16 +65,21 @@
           inherit self top;
           pkgs = prev;
         })
-        // {
+      );
-          zed-editor = top.zed.packages."${prev.stdenv.hostPlatform.system}".zed-editor;
+      charts_overlay = (
+        _f: _p: {
+          chartsDerivations = top.charts.chartsDerivations."${_p.stdenv.hostPlatform.system}";
+          kubelib = top.nix-kube-generators.lib;
         }
       );
       overlays = [
         top.agenix.overlays.default
+        charts_overlay
         local_overlay
         packages_overlay
         top.nurpkgs.overlays.default
         top.vsext.overlays.default
+        top.nixvimunstable.overlays.default
       ];
 
     in

home/baseline/bash.nix

@@ -1,26 +1,15 @@
-{ pkgs, ... }:
+{ config, pkgs, ... }:
 
 {
   programs.bash = {
     enable = true;
     shellAliases = {
-      acp = "rsync --progress -ah";
+      gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh";
-      agbuild = "ansible-galaxy collection build";
+      ls = "ls --color";
-      apub = "ansible-galaxy collection publish --api-key \${GALAXY_API_KEY}";
+      ll = "ls -l --color";
+
       calc = "bc";
       d = "deactivate";
-      devroles = "cd ~/src/ansible_collections/devroles";
-      gohome = "ssh greg@dns.greg-hellings.gmail.com.beta.tailscale.net -D localhost:10080";
-      ll = "ls -l";
-      molcol = "molecule -c ../../tests/molecule.yml";
-      packaging = "cd ~/src/packaging";
-      vdown = "vagrant destroy";
-      vhalt = "vagrant halt";
-      vos = "vagrant up --provision --provider openstack";
-      vprov = "vagrant provision";
-      vssh = "vagrant ssh";
-      vup = "vagrant up --provision --provider libvirt";
-      yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)";
     };
     sessionVariables = {
       ANSIBLE_COLLECTIONS_PATH = "\${HOME}/src/";

home/baseline/default.nix

@@ -7,7 +7,9 @@
     ./direnv.nix
     ./git.nix
     ./nushell.nix
+    ./shell.nix
     ./ssh.nix
+    ./tools.nix
     ./vim
     ./xonsh.nix
   ];

home/baseline/nushell.nix

@@ -1,43 +1,59 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
+let
+  vpn = pkgs.writeText "vpn" ''
+    on run argv
+      ignoring application responses
+        tell application "Viscosity"
+          connect "350Main"
+        end tell
+      end ignoring
+
+      delay 1.0
+
+      activate application "Viscosity"
+      tell application "System Events" to keystroke item 1 of argv
+      delay 0.1
+      tell application "System Events" to keystroke tab
+      delay 0.1
+      tell application "System Events" to keystroke item 2 of argv
+      delay 0.1
+      tell application "System Events" to keystroke return
+    end run
+  '';
+in
 {
   programs = {
-    carapace = {
-      enable = true;
-      enableNushellIntegration = true;
-    };
-    direnv = {
-      enable = true;
-      enableNushellIntegration = true;
-    };
     nushell = {
       enable = true;
-      environmentVariables = {
+      environmentVariables = config.home.sessionVariables;
-        AWS_SHARED_CREDENTIALS_FILE = "/run/agenix/cache-credentials";
-        GOPATH = "${config.home.homeDirectory}/src/go";
-        GOBIN = "${config.home.homeDirectory}/src/bin";
-        LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1";
-        SWORD_PATH = "${config.home.homeDirectory}/.sword/";
-        #TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
-        VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/";
-      };
       extraConfig = ''
         use std/util "path add"
         path add ${config.home.homeDirectory}/src/bin
         path add /opt/homebrew/bin
         path add /run/current-system/sw/bin
         path add ${config.home.homeDirectory}/.nix-profile/bin
+
+        source ${./nushell/functions.nu}
+
+        def --env vpn [] {
+          unlock
+          let username = ^bw get username f7351f9c-b25b-4317-8352-affc00da4644
+          let password = ^bw get password f7351f9c-b25b-4317-8352-affc00da4644
+          let otp = ^bw get totp 10371487-7f40-4b08-9a45-b33e00de318b
+          osascript ${vpn} $username $"($password)($otp)"
+        }
       '';
       settings = {
         buffer_editor = lib.getExe config.programs.nixvim.package;
+        "history.isolation" = true;
+        "history.file_format" = "sqlite";
       };
     };
-    starship = {
-      enable = true;
-      enableNushellIntegration = true;
-    };
   };
+  home.shell.enableNushellIntegration = true;
 }

home/baseline/nushell/functions.nu

@@ -0,0 +1,57 @@
+# vim: set filetype=nushell :
+let servers = [isaiah jeremiah zeke genesis vm-gitlab vm-jellyfin]
+
+def par-map [ items: list, c: closure ] {
+  let results = $items | par-each -k $c
+  $items | enumerate | reduce -f {} {|e, a| $a | upsert $e.item { $results | get $e.index }}
+}
+
+def --env unlock [] {
+    if "BW_SESSION" not-in $env {
+        $env.BW_SESSION = ^bw unlock --raw
+    }
+}
+
+def rebuild [] {
+    if (uname | get operating-system) == "Darwin" {
+        sudo darwin-rebuild switch
+    } else {
+        let hostname = uname | get nodename
+        let build = ^nom build $"/etc/nixos#nixosConfigurations.($hostname).config.system.build.toplevel"
+        if $env.LAST_EXIT_CODE == 0 {
+            nvd diff /run/current-system result
+            run0 nixos-rebuild switch
+        } else {
+            print "Error during build"
+        }
+    }
+}
+
+def deploy [ $host: string, $build: string = "" ] {
+    mut buildhost = $build
+        if $build == "" {
+            $buildhost = $host
+        }
+    if $buildhost == "linode" or $buildhost == "genesis" {
+        $buildhost = "isaiah"
+    }
+    nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost
+}
+
+def ff [ $file: string ] {
+    ls **/* | where name =~ $file
+}
+
+def update_all [] {
+    par-map $servers {|e| deploy $e | complete} | explore
+}
+
+def bake [template: string] {
+    let copier = "~/.copier-templates" | path expand
+    if not ($copier | path exists) {
+        git clone srcpub:greg/copier-templates.git $copier
+    }
+    let srcdir = [$copier $template] | path join
+    print $srcdir
+    copier copy $srcdir .
+}

home/baseline/shell.nix

@@ -0,0 +1,94 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  home = {
+    sessionVariables = {
+      AWS_SHARED_CREDENTIALS_FILE = "/run/agenix/cache-credentials";
+      CARAPACE_BRIDGES = "zsh,bash";
+      EDITOR = lib.getExe config.programs.neovim.package;
+      GOPATH = "${config.home.homeDirectory}/src/go";
+      GOBIN = "${config.home.homeDirectory}/src/bin";
+      LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1";
+      MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true";
+      SWORD_PATH = "${config.home.homeDirectory}/.sword/";
+      #TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
+      VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/";
+    };
+    shellAliases = {
+      nb = "nix build -L";
+      nixdu = "sudo nix-store --gc --print-roots | egrep -v \"^(/nix/var|/run/\\\\w+-system|\\\\{memory|/proc)\"";
+      nixtest = "nixpkgs-review rev HEAD";
+      nixup = "nix flake lock update";
+      nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
+      r = "run0";
+      updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
+
+      # General
+      k = "kubectl";
+      kn = "kubectl get nodes -o wide";
+      kp = "kubectl get pods -o wide";
+      s = "lazyssh";
+      win = "sudo virsh start win10";
+      yaml2js = "python -c 'import sys, yaml, json; json.dump(yaml.load(sys.stdin), sys.stdout, indent=4)'";
+      z = "zeditor .";
+
+      # Tailscale related ones
+      tsup = "sudo tailscale up";
+      tspub = "sudo tailscale up --exit-node=linode";
+      tshome = "sudo tailscale up --exit-node=2maccabees";
+      tsclear = "sudo tailscale up --exit-node=''";
+
+      # Vagrant related
+      vdown = "vagrant destroy";
+      vhalt = "vagrant halt";
+      vos = "vagrant up --provision --provider openstack";
+      vprov = "vagrant provision";
+      vup = "vagrant up --provision --provider libvirt";
+      vssh = "vagrant ssh";
+    };
+  };
+  programs = {
+    carapace = {
+      enable = true;
+    };
+    direnv = {
+      enable = true;
+    };
+    ghostty = {
+      enable = true;
+      package = if pkgs.stdenv.hostPlatform.isDarwin then pkgs.ghostty-bin else pkgs.ghostty;
+      settings = {
+        command = lib.getExe config.programs.nushell.package;
+        font-family = "Hacker";
+        theme = "Dracula";
+        scrollback-limit = "1000000";
+        window-save-state = "always";
+
+        keybind = [
+          "ctrl+n=new_window"
+
+          "ctrl+shift+h=goto_split:left"
+          "ctrl+shift+j=goto_split:down"
+          "ctrl+shift+k=goto_split:up"
+          "ctrl+shift+l=goto_split:right"
+
+          "ctrl+b>h=new_split:left"
+          "ctrl+b>j=new_split:down"
+          "ctrl+b>k=new_split:up"
+          "ctrl+b>l=new_split:right"
+
+          "ctrl+b>t=new_tab"
+          "ctrl+b>n=next_tab"
+          "ctrl+b>p=previous_tab"
+        ];
+      };
+    };
+    starship = {
+      enable = true;
+    };
+  };
+}

home/baseline/ssh.nix

@@ -9,9 +9,9 @@
   };
   programs.ssh = {
     enable = true;
-    serverAliveInterval = 60;
 
     includes = [ "config.local" ];
+    enableDefaultConfig = false;
 
     matchBlocks =
       let
@@ -27,6 +27,11 @@
 
         "*" = {
           dynamicForwards = [ { port = 10240; } ];
+          serverAliveInterval = 60;
+          extraOptions = {
+            LogLevel = "error";
+            SetEnv = "TERM=xterm-256color";
+          };
         };
 
         "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -41,7 +46,7 @@
         };
         "src" = {
           user = "gitlab";
-          hostname = "git.thehellings.lan";
+          hostname = "vm-gitlab.shire-zebra.ts.net";
         };
         srcpub = {
           user = "gitlab";

home/baseline/tools.nix

@@ -0,0 +1,134 @@
+{ lib, pkgs, ... }:
+{
+  home.packages =
+    with pkgs;
+    [
+      dig
+      jqp
+      kubernetes-helm
+      iamb
+      lazyssh
+      rainfrog
+      tenere
+      uv
+      wiki-tui
+    ]
+    ++ (lib.optionals pkgs.stdenv.hostPlatform.isLinux [
+      impala
+    ]);
+
+  programs = {
+    zellij = {
+      enable = true;
+      enableZshIntegration = pkgs.stdenv.hostPlatform.isDarwin;
+      settings = {
+        default_shell = "xonsh";
+        plugins = {
+          autolock = {
+            _props.location = "https://github.com/fresh2dev/zellij-autolock/releases/download/0.2.2/zellij-autolock.wasm";
+            _children = [
+              {
+                is_enabled = true;
+              }
+              {
+                triggers = "nvim|vim|git";
+              }
+              {
+                reaction_seconds = "0.3";
+              }
+              {
+                print_to_log = true;
+              }
+            ];
+          };
+        };
+        load_plugins.autolock = { };
+        keybinds = {
+          normal._children = [
+            {
+              bind = {
+                _args = [ "Enter" ];
+                _children = [
+                  {
+                    WriteChars = "\\u{000D}";
+                    MessagePlugin = {
+                      _args = [ "autolock" ];
+                      _children = [ { } ];
+                    };
+                  }
+                ];
+              };
+            }
+            {
+              bind = {
+                _args = [ "Ctrl z" ];
+                _children = [
+                  {
+                    MessagePlugin = {
+                      _args = [ "autolock" ];
+                      _children = [
+                        {
+                          payload._args = [ "enable" ];
+                        }
+                      ];
+                    };
+                    SwitchToMode._args = [ "Locked" ];
+                  }
+                ];
+              };
+            }
+          ]; # /normal
+          locked._children = [
+            {
+              bind = {
+                _args = [ "Ctrl z" ];
+                _children = [
+                  {
+                    MessagePlugin = {
+                      _args = [ "autolock" ];
+                      _children = [
+                        {
+                          payload._args = [ "disable" ];
+                        }
+                      ];
+                    };
+                    SwitchToMode._args = [ "Normal" ];
+                  }
+                ];
+              };
+            }
+          ]; # /locked
+          shared_except = {
+            _args = [ "locked" ];
+            _children = [
+              {
+                bind = {
+                  _args = [ "Ctrl h" ];
+                  MoveFocusOrTab._args = [ "Left" ];
+                };
+              }
+              {
+                bind = {
+                  _args = [ "Ctrl j" ];
+                  MoveFocus._args = [ "Down" ];
+                };
+              }
+              {
+                bind = {
+                  _args = [ "Ctrl k" ];
+                  MoveFocus._args = [ "Up" ];
+                };
+              }
+              {
+                bind = {
+                  _args = [ "Ctrl l" ];
+                  MoveFocusOrTab._args = [ "Right" ];
+                };
+              }
+            ];
+          }; # /shared_except
+        }; # /keybinds
+      }; # /settings
+    };
+  };
+}

home/baseline/vim/config.nix

@@ -120,6 +120,7 @@
         gopls.enable = true;
         html.enable = true;
         nixd.enable = true;
+        nushell.enable = true;
         pylsp.enable = true;
         pyright.enable = true;
         rust_analyzer = {
@@ -135,6 +136,7 @@
     notify.enable = true;
     remote-nvim.enable = true;
     web-devicons.enable = true;
+    zellij.enable = true;
   };
   userCommands = {
     Ggr = {
@@ -148,7 +150,6 @@
   extraConfigVim = builtins.readFile ./extra.vimrc;
   extraPlugins = with pkgs.vimPlugins; [
     bufexplorer
-
     context-vim
     vim-indent-guides
   ];

home/baseline/vim/default.nix

@@ -1,7 +1,8 @@
 {
   config,
-  pkgs,
   lib,
+  nixvim,
+  pkgs,
   ...
 }:
 
@@ -10,7 +11,16 @@
   fonts.fontconfig.enable = true;
   home.packages = with pkgs.nerd-fonts; [ hack ];
 
-  programs.nixvim = (import ./config.nix { inherit config pkgs lib; }) // {
+  programs.nixvim =
+    (import ./config.nix {
+      inherit
+        config
+        nixvim
+        pkgs
+        lib
+        ;
+    })
+    // {
       enable = true;
     };
 }

home/baseline/xonsh.nix

@@ -20,11 +20,9 @@
 
       sessionVariables = {
         # This is for pushing builds to my local S3 cache
-        AWS_SHARED_CREDENTIALS_FILE = "/run/agenix/cache-credentials";
         CARAPACE_BRIDGES = "zsh,bash";
         COMPLETIONS_CONFIRM = "True";
         CLICOLOR = 1;
-        EDITOR = "nvim";
         # vte_new_tab_cwd causes new Terminal tabs to open in the
         # same CWD as the current tab
         LESS_TERMCAP_mb = "\\033[01;31m"; # begin blinking
@@ -36,10 +34,8 @@
         LESS_TERMCAP_ue = "\\033[0m"; # end underline
         LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN = "1";
         LSCOLORS = "ExGxBxDxCxEgEdxbxgxcxd";
-        MAVEN_OPTS = " -Dmaven.wagon.http.ssl.insecure=true";
         OS_CLOUD = "default";
         PROMPT = "{vte_new_tab_cwd}{env_name}{BOLD_GREEN}{user}@{hostname}{BOLD_BLUE} {short_cwd}{branch_color}{curr_branch: {}}{RESET} {BOLD_BLUE}{prompt_end}{RESET} ";
-        SWORD_PATH = "${config.home.homeDirectory}/.sword/";
         #TIMEFORMAT = "%3Uu %3Ss %3lR %P%%";
         # Tells vox where to find virtualenvs
         VIRTUALENV_HOME = "${config.home.homeDirectory}/venv/";
@@ -53,43 +49,10 @@
         # Python related ones
         ac = "vox activate";
         d = "vox deactivate";
-        s = "nix run \".#runserver\"";
 
-        # Nix related ones
-        deploy = "nixos-rebuild switch --use-remote-sudo --use-substitutes --target-host";
-        gl-nging = "sudo nixos-container run gitlab -- systemctl restart nginx";
-        nb = "nix build -L";
-        nixdu = "sudo nix-store --gc --print-roots | egrep -v r\"^(/nix/var|/run/\\w+-system|\\{memory|/proc)\"";
-        nixtest = "nixpkgs-review rev HEAD";
-        nixup = "nix flake lock --update-input";
-        nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
-        stable = "nix flake lock --update-input nixstable --update-input hm --update-input nixvimstable";
-        unstable = "nix flake lock --update-input nixunstable --update-input hmunstable --update-input nixvimunstable --update-input nurpkgs --update-input vsext --update-input wsl";
-        updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
-
-        # General
         gh-personal = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/personal\" gh";
-        k = "kubectl";
-        kn = "kubectl get nodes -o wide";
-        kp = "kubectl get pods -o wide";
         ls = "ls --color";
         ll = "ls -l --color";
-        win = "sudo virsh start win10";
-        z = "zeditor .";
-
-        # Tailscale related ones
-        tsup = "sudo tailscale up";
-        tspub = "sudo tailscale up --exit-node=linode";
-        tshome = "sudo tailscale up --exit-node=2maccabees";
-        tsclear = "sudo tailscale up --exit-node=''";
-
-        # Vagrant related
-        vdown = "vagrant destroy";
-        vhalt = "vagrant halt";
-        vos = "vagrant up --provision --provider openstack";
-        vprov = "vagrant provision";
-        vup = "vagrant up --provision --provider libvirt";
-        vssh = "vagrant ssh";
       };
 
       configHeader = builtins.readFile ./xonsh_header.xsh;

home/baseline/xonsh_footer.xsh

@@ -63,6 +63,14 @@ def _rebuild(args):
             popd
 aliases['rebuild'] = _rebuild
 
+def _deploy(args):
+    dest = args[0]
+    if dest != "linode":
+        nixos-rebuild switch --use-remote-sudo --use-substitutes --target-host @(dest) --build-host @(dest)
+    else:
+        nixos-rebuild swtich --use-remote-sudo --use-substitutes --target-host @(dest)
+aliases['deploy'] = _deploy
+
 def _yaml2json(args, stdin=None, stdout=None):
     import sys, yaml, json
     from yaml import CLoader

home/default.nix

@@ -32,10 +32,12 @@ let
 in
 {
   "MacBook-Pro.local" = user "aarch64-darwin" "ivr" "gregory.hellings";
+  "MacBook-Prolocal.local" = user "aarch64-darwin" "ivr" "gregory.hellings";
   genesis = greg "genesis";
   exodus = greg "exodus";
-  jude = greg "jude";
+  zeke = greg "zeke";
   isaiah = greg "isaiah";
   jeremiah = greg "jeremiah";
+  linode = greg "linode";
   vm-gitlab = greg "vm-gitlab";
 }

home/home.nix

@@ -17,7 +17,7 @@ let
 in
 {
   imports = [
-    top.nixvimunstable.homeManagerModules.nixvim
+    top.nixvimunstable.homeModules.nixvim
     top.self.modules.homeManagerModule
     ./baseline
   ] ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];

home/hosts/exodus/default.nix

@@ -14,9 +14,11 @@
     freeciv
     gimp
     k9s
+    kdePackages.kdenlive
     kubernetes-helm
     kubectl
     kubectl-cnpg
+    mumble
     wineWowPackages.stable
   ];
 }

home/hosts/ivr/default.nix

@@ -33,13 +33,18 @@ in
       ansible
       direnv
       home-manager
+      just
       k9s
       kubectl
+      mariadb
       minikube
       mise
+      nil
       nixStable
       pipenv-ivr
       pre-commit
+      python311
+      python3Packages.flake8
       skaffold
       x
     ];
@@ -68,7 +73,27 @@ in
     starship = {
       enable = true;
       enableNushellIntegration = true;
+      settings = {
+        directory = {
+          home_symbol = "~";
+          truncate_to_repo = false;
+          truncation_length = 0;
+          use_os_path_sep = true;
         };
+      };
+    };
+    ssh.matchBlocks = lib.listToAttrs (lib.map (key: { name = "${key}.ivrtechnology.com"; value = {}; }) [
+      "apidev1"
+      "asdev1"
+      "agidev1"
+      "kdev1"
+      "kdev2"
+      "kdev3"
+      "webdev4"
+      "webdev5"
+
+      "web4"
+    ]);
     tmux.shell = (lib.getExe x);
   };
 }

home/hosts/zeke/default.nix

@@ -2,12 +2,11 @@
 
 {
   greg = {
-    development = true;
+    development = false;
-    gui = true;
+    gui = false;
-    sway = false;
     gnome = false;
-    vscodium = true;
+    vscodium = false;
-    zed = true;
+    zed = false;
   };
 
   home = {
@@ -20,12 +19,13 @@
     '';
 
     packages = with pkgs; [
-      audacity
+      #audacity
       bitwarden-cli
-      (mumble.override { pulseSupport = true; })
+      #element-desktop
-      #logseq
+      #(mumble.override { pulseSupport = true; })
-      super-productivity
+      #super-productivity
-      webcamoid
+      #vagrant
+      #webcamoid
     ];
   };
 

hosts/baseline.nix

@@ -4,7 +4,6 @@
   overlays,
   pkgs,
   self,
-  top,
   ...
 }:
 let
@@ -148,11 +147,11 @@ in
           ];
           publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0";
         };
-        jude = {
+        zeke = {
           extraHostNames = [
-            "jude.home"
+            "zeke.home"
-            "jude.thehellings.lan"
+            "zeke.thehellings.lan"
-            "jude-builder"
+            "zeke-builder"
           ];
           publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0";
         };
@@ -170,6 +169,7 @@ in
 
   # Enable the OpenSSH daemon for remote control
   services = {
+    locate.enable = true;
     openssh = {
       enable = true;
       settings.X11Forwarding = true;

hosts/default.nix

@@ -44,7 +44,7 @@ in
 {
   genesis = unstable { name = "genesis"; };
   exodus = unstable { name = "exodus"; };
-  jude = unstable { name = "jude"; };
+  zeke = unstable { name = "zeke"; };
   icdm-root = unstable { name = "icdm-root"; };
   linode = unstable { name = "linode"; };
   hosea = unstable { name = "hosea"; };

hosts/exodus/default.nix

@@ -28,8 +28,9 @@
     podman.enable = true;
     print.enable = true;
     tailscale.enable = true;
+    runner.enable = true;
     vmdev = {
-      enable = true;
+      enable = false;
       system = "intel";
     };
   };
@@ -41,6 +42,8 @@
     networkmanager.enable = lib.mkForce true;
   };
 
+  programs.adb.enable = true;
+
   services = {
     fprintd.enable = true;
     fwupd = {
@@ -53,5 +56,9 @@
     oci-containers.backend = "podman";
   };
 
-  users.users.greg.extraGroups = [ "podman" ];
+  users.users.greg.extraGroups = [
+    "adbusers"
+    "kvm"
+    "podman"
+  ];
 }

hosts/genesis/default.nix

@@ -2,10 +2,9 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ config, pkgs, ... }:
+{ pkgs, ... }:
 
 let
-  dashy_port = "8080";
   speedtest_port = "19472";
 in
 {
@@ -22,7 +21,6 @@ in
     proxies = {
       "speed.home".target = "http://localhost:${speedtest_port}";
       "speedtest.thehellings.lan".target = "http://localhost:${speedtest_port}";
-      "dashy.home".target = "http://localhost:${dashy_port}";
     };
   };
 
@@ -41,102 +39,7 @@ in
 
   networking.hostName = "genesis"; # Define your hostname.
 
-  services = {
-    dashy = {
-      enable = true;
-      settings = {
-        appConfig = {
-          enableFontAwesome = true;
-          statusCheck = true;
-          statusCheckInterval = 20;
-          theme = "callisto";
-        };
-        pageInfo = {
-          description = "Hellings Lab";
-          navLinks = [
-            {
-              path = "/";
-              title = "Home";
-            }
-            {
-              path = "http://speed.home";
-              title = "Local Speedtest";
-            }
-          ];
-        };
-        sections = [
-          {
-            name = "Hosting";
-            displayData = {
-              sortBy = "alphabetical";
-              rows = 1;
-              cols = 1;
-              collapsed = false;
-              hideForGusts = false;
-            };
-            items = [
-              {
-                title = "Romans";
-                description = "Core Proxmox";
-                icon = "favicon";
-                url = "https://10.42.1.1:8006";
-                target = "newtab";
-                statusCheckAllowInsecure = true;
-              }
-              {
-                title = "Isaiah";
-                description = "Isaiah Proxmox";
-                icon = "favicon";
-                url = "https://isaiah.thehellings.lan:8006";
-                target = "newtab";
-                statusCheckAllowInsecure = true;
-              }
-              {
-                title = "Linode";
-                icon = "favicon";
-                url = "https://login.linode.com/login";
-                target = "newtab";
-              }
-            ];
-          }
-          {
-            name = "Services";
-            displayData = {
-              sortBy = "alphabetical";
-              rows = 1;
-              cols = 1;
-              collapsed = false;
-              hideForGusts = false;
-            };
-            items = [
-              {
-                title = "Jellyfin";
-                description = "Home Jellyfin Server";
-                icon = "favicon";
-                url = "http://jellyfin.home";
-                target = "newtab";
-              }
-              {
-                title = "Speedtest";
-                description = "Local Speedtest";
-                icon = "favicon";
-                url = "http://speed.home";
-                target = "newtab";
-              }
-            ];
-          }
-        ];
-      };
-    };
-  };
-
   virtualisation.oci-containers.containers = {
-    dashy = {
-      image = "lissy93/dashy:latest";
-      hostname = "dashy";
-      ports = [ "${dashy_port}:${dashy_port}" ];
-      volumes = [ "${config.services.dashy.finalDrv}/conf.yml:/app/user-data/conf.yml" ];
-    };
     speedtest = {
       image = "ghcr.io/librespeed/speedtest";
       hostname = "speedtest";

hosts/genesis/net/hosts

@@ -13,17 +13,23 @@
 10.42.1.7 hosea hosea.thehellings.lan
 10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan
 10.42.1.9 ivr ivr.thehellings.lan
-10.42.1.10 jude jude.thehellings.lan
+# 10 - monitor
-10.42.1.11 jude1 jude1.thehellings.lan
+# 11 - old jude
 10.42.1.12 tv
+10.42.1.13 zeke zeke.thehellings.lan
+10.42.1.14 nas1 nas1.thehellings.lan
 
 # VMs
 10.42.4.1 matrix matrix.thehellings.lan
 10.42.4.2 jellyfin jellyfin.thehellings.lan vm-jellyfin vm-jellyfin.thehellings.lan
 10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan
 
+# VIP
+10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster
+
 # IPMI
 10.42.100.6 isaiahbmc isaiahbmc.thehellings.lan
+10.42.100.14 nas1bmc nas1bmc.thehellings.lan
 
 # Tailscale hosts
 100.119.228.115 chronicles.home nas.home chronicles.shire-zebra.ts.net
@@ -32,12 +38,13 @@
 100.88.91.27 genesis.home smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
 100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net
-100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes postgres.kubernetes
+100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes
-100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes
+100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes
-100.90.74.19 jude.home
+100.90.74.19 zeke.home
 100.115.57.8 linode.home
 100.65.5.38 matrix.home matrix.shire-zebra.ts.net
 100.127.55.22 jellyfin.home
+100.114.187.61 nas1.home nas1.shire-zebra.ts.net
 
 # Dev hosts
 10.42.101.1 icdm.lan wiki.icdm.lan *.icdm.lan

hosts/genesis/networking/dhcp.nix

@@ -107,7 +107,7 @@
           }
           {
             hw-address = "04:7c:16:d5:60:6f";
-            ip-address = "10.42.1.11"; # Jude - but straight in the motherboard
+            ip-address = "10.42.1.13"; # Zeke - but straight in the motherboard
           }
 
           ########################################

hosts/isaiah/default.nix

@@ -28,16 +28,20 @@
       };
       systemd-boot = {
         enable = true;
-        configurationLimit = 10;
       };
     };
     supportedFilesystems = [ "ntfs" ];
   };
 
   greg = {
-    kubernetes.enable = true;
+    kubernetes = {
+      enable = true;
+      vipInterface = "enp38s0";
+      priority = 255;
+    };
     tailscale.enable = true;
     remote-builder.enable = true;
+    runner.enable = true;
   };
 
   fileSystems = {
@@ -80,16 +84,4 @@
       settings.PermitRootLogin = "yes";
     };
   };
-
-  virtualisation = {
-    libvirtd = {
-      enable = true;
-      allowedBridges = [
-        "br0"
-        "virbr0"
-      ];
-      onBoot = "ignore"; # only restart VMs labeled 'autostart'
-      qemu.ovmf.enable = true;
-    };
-  };
 }

hosts/isaiah/hardware-configuration.nix

@@ -5,13 +5,18 @@
   config,
   lib,
   modulesPath,
+  pkgs,
   ...
 }:
 
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [
+  boot = {
+    extraModulePackages = [ ];
+    kernelModules = [ "kvm-amd" ];
+    initrd = {
+      availableKernelModules = [
         "nvme"
         "xhci_pci"
         "ahci"
@@ -20,9 +25,35 @@
         "sd_mod"
         "sr_mod"
       ];
-  boot.initrd.kernelModules = [ ];
+      kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
+    };
-  boot.extraModulePackages = [ ];
+    loader = {
+      timeout = 15;
+      systemd-boot = {
+        enable = true;
+        configurationLimit = 20;
+        extraEntries = {
+          "Win2.conf" = (
+            lib.strings.concatStringsSep "\n" [
+              "title Windows 11"
+              "efi /shellx64.efi"
+              "options -nointerrupt -noconsolein -noconsoleout windows11.nsh"
+            ]
+          );
+          "Shell.conf" = (
+            lib.strings.concatStringsSep "\n" [
+              "title EFI Shell"
+              "efi /shell.efi"
+            ]
+          );
+        };
+        extraFiles = {
+          "windows11.nsh" = (pkgs.writeText "windows11.nsh" (lib.strings.concatStringsSep "\n" [ ]));
+          "shell.efi" = "${pkgs.edk2-uefi-shell}/shell.efi";
+        };
+      };
+    };
+  };
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
@@ -37,15 +68,20 @@
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/29E7-E20C";
+    device = "/dev/disk/by-uuid/4A92-3E4B";
     fsType = "vfat";
   };
 
   fileSystems."/myvol" = {
-    device = "/dev/nvme0n1p1";
+    device = "/dev/disk/by-uuid/714744ca-dd9d-4713-b571-c6ccfbf56d79";
     fsType = "btrfs";
   };
 
+  fileSystems."/var/lib/longhorn" = {
+    device = "/dev/disk/by-uuid/b9f5ace7-d224-4aff-8770-d5a9d22be2ae";
+    fsType = "xfs";
+  };
+
   swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

hosts/jeremiah/default.nix

@@ -75,9 +75,17 @@ in
 
   greg = {
     home = true;
-    kubernetes.enable = true;
+    kubernetes = {
+      enable = true;
+      vipInterface = "br0";
+      priority = 254;
+    };
     tailscale.enable = true;
     remote-builder.enable = true;
+    runner = {
+      enable = true;
+      threads = 3;
+    };
   };
 
   networking = {
@@ -109,21 +117,6 @@ in
   age.secrets.runner-reg.file = ../../secrets/gitlab/nixos-qemu-shell.age;
 
   services = {
-    gitlab-runner = {
-      enable = true;
-      settings.concurrent = 3;
-      services = {
-        shell = {
-          executor = "shell";
-          limit = 7;
-          authenticationTokenConfigFile = config.age.secrets.runner-reg.path;
-          environmentVariables = {
-            EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-            STORAGE_URL = "s3.thehellings.lan:9000";
-          };
-        };
-      };
-    };
     proxmox-ve = {
       enable = true;
       ipAddress = (builtins.elemAt config.networking.interfaces.br0.ipv4.addresses 0).address;

hosts/jeremiah/hardware-configuration.nix

@@ -33,6 +33,11 @@
     fsType = "vfat";
   };
 
+  fileSystems."/var/lib/longhorn" = {
+    device = "/dev/disk/by-uuid/1c896717-4a01-4136-825d-6c0160a78256";
+    fsType = "xfs";
+  };
+
   swapDevices = [ ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking

hosts/jude/default.nix

@@ -1,172 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  top,
-  ...
-}:
-
-{
-  imports = [
-    ./boot.nix
-    ./hardware-configuration.nix
-    ./virt.nix
-    ./work.nix
-    top.nix-hardware.nixosModules.system76
-  ];
-
-  boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
-
-  greg = {
-    tailscale.enable = true;
-    sway.enable = false;
-    gnome.enable = true;
-    kde.enable = false;
-    kubernetes.enable = true;
-    podman.enable = true;
-    print.enable = true;
-    remote-builder.enable = true;
-  };
-
-  environment.systemPackages =
-    with pkgs;
-    lib.mkMerge [
-      [
-        # for Immersed
-        cudatoolkit
-        immersed
-        libva
-      ]
-      [
-        bind # For things like nslookup
-        create_ssl
-        distrobox
-        expect
-        fswatch
-        gimp
-        go
-        gparted
-        graphviz
-        flock
-        ffmpeg
-        handbrake
-        imagemagick
-        libtheora
-        libxml2
-        linode-cli
-        makemkv
-        oathToolkit
-        usbutils
-        ventoy
-      ]
-
-      [
-        # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
-        gst_all_1.gstreamer
-        gst_all_1.gst-plugins-base
-        gst_all_1.gst-plugins-good
-        gst_all_1.gst-plugins-bad
-        gst_all_1.gst-plugins-ugly
-        gst_all_1.gst-libav
-        gst_all_1.gst-vaapi
-      ]
-    ];
-
-  hardware = {
-    nvidia = {
-      package = config.boot.kernelPackages.nvidiaPackages.vulkan_beta;
-      modesetting.enable = true;
-      powerManagement = {
-        enable = false;
-        finegrained = false;
-      };
-      nvidiaSettings = true;
-      open = true;
-    };
-    system76 = {
-      firmware-daemon.enable = true;
-      #kernel-modules.enable = true;
-    };
-  };
-
-  networking = {
-    hostName = "jude";
-    networkmanager.enable = lib.mkForce true;
-    enableIPv6 = false;
-    useDHCP = false;
-    interfaces = {
-      # This seems to be direct mother board interface
-      enp12s0.useDHCP = true;
-      #enp12s0.ipv4.addresses = [
-      #{
-      #address = "10.42.1.11";
-      #prefixLength = 16;
-      #}
-      #];
-      # This seems to be the one that comes through the monitor hookup
-      enp14s0u1u2.ipv4.addresses = [
-        {
-          address = "10.42.1.10";
-          prefixLength = 16;
-        }
-      ];
-    };
-    defaultGateway = {
-      address = "10.42.1.1";
-      interface = "enp14s0u1u2";
-    };
-    nameservers = [
-      "10.42.1.5"
-      "10.42.1.1"
-    ];
-    firewall = {
-      enable = false;
-      allowedTCPPorts = [ 21000 ];
-      allowedUDPPorts = [
-        21000
-        21010
-      ];
-    };
-  };
-
-  programs = {
-    adb.enable = true;
-    steam.enable = true;
-    nix-index = {
-      enable = true;
-      enableBashIntegration = false;
-      enableFishIntegration = false;
-      enableZshIntegration = false;
-    };
-    nix-ld.enable = false;
-  };
-
-  # Let's do a sound thing
-  services = {
-    k3s.extraFlags =
-      let
-        ip = (builtins.head config.networking.interfaces.enp14s0u1u2.ipv4.addresses).address;
-      in
-      [
-        "--tls-san ${ip}"
-        #"--bind-address ${ip}"
-      ];
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      audio.enable = true;
-      jack.enable = true;
-      pulse.enable = true;
-      wireplumber.enable = true;
-    };
-    pulseaudio.enable = false; # This conflicts with pipewire
-    locate.enable = true;
-    xserver.videoDrivers = [ "nvidia" ];
-  };
-
-  users.users.greg.extraGroups = [
-    "adbusers"
-    "kvm"
-    "podman"
-  ];
-}

hosts/jude/virt.nix

@@ -1,124 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  environmentVariables = {
-    EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-    STORAGE_URL = "s3.thehellings.lan:9000";
-  };
-  passthru = [
-    "1002:164e" # Raphael - embedded GPU
-    "1002:1640" # Rembrandt - Audio
-    #"10de:2507" # RTX 3050 video
-    #"10de:228e" # RTX 3050 audio
-  ];
-in
-{
-  specialisation = {
-    vbox.configuration = {
-
-      greg = {
-        podman.enable = lib.mkForce false;
-        vmdev.enable = lib.mkForce false;
-      };
-
-      users.extraGroups.vboxusers.members = [ "greg" ];
-
-      virtualisation = {
-        virtualbox.host = {
-          enable = true;
-          enableExtensionPack = true;
-        };
-      };
-
-      services.gitlab-runner.services = lib.mkForce {
-        vbox = {
-          inherit environmentVariables;
-          authenticationTokenConfigFile = config.age.secrets.vbox.path;
-          executor = "shell";
-          limit = 5;
-        };
-      };
-
-      systemd.services.gitlab-runner = {
-        serviceConfig = {
-          DevicePolicy = lib.mkForce "auto";
-          User = "root";
-          DynamicUser = lib.mkForce false;
-        };
-      };
-    };
-  };
-
-  age.secrets = {
-    qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
-    vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
-  };
-
-  # These options enable sharing of the GPU with the VM
-  boot = {
-    # Order matters here, to prevent the AMD driver from getting to the driver before
-    # vfio-pci does
-    initrd.kernelModules = [
-      "vfio_pci"
-      "vfio"
-      "vfio_iommu_type1"
-
-      #"amdgpu"
-      #"nvidia"
-      #"nvidia_modeset"
-      #"nvidia_uvm"
-      #"nvidia_drm"
-    ];
-    kernelParams = [
-      "amd_iommu=on"
-      "iommu=pt"
-      ("vfio-pci.ids=" + (lib.concatStringsSep "," passthru))
-    ];
-  };
-
-  greg.vmdev.enable = true;
-
-  hardware.graphics.enable = true;
-
-  services.gitlab-runner = {
-    enable = true;
-    settings.concurrent = 5;
-    services.qemu = {
-      inherit environmentVariables;
-      executor = "shell";
-      limit = 5;
-      authenticationTokenConfigFile = config.age.secrets.qemu.path;
-    };
-  };
-
-  systemd.services = {
-    "libvirt-nosleep@" = {
-      description = "Prevent sleep while %i is running";
-      serviceConfig = {
-        Type = "simple";
-        ExecStart = ''
-          ${pkgs.systemd}/bin/systemd-inhibit --what=sleep --why="Libvirt domain %i is running" --who=%U --mode=block sleep infinity
-        '';
-      };
-    };
-  };
-
-  virtualisation = {
-    libvirtd = {
-      extraConfig = ''
-        log_filters="1:qemu"
-        log_outputs="1:file:/var/log/libvirt/libvirtd.log"
-      '';
-      hooks.qemu = {
-        win10 = lib.getExe pkgs.qemu-hook;
-      };
-    };
-
-    spiceUSBRedirection.enable = true;
-  };
-}

hosts/jude/work.nix

@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-
-{
-  services.mongodb = {
-    enable = false;
-  };
-  environment.systemPackages = with pkgs; [
-    mongodb-compass
-    pipenv-ivr
-    pre-commit
-    python311
-    stdenv.cc
-  ];
-}

hosts/linode/git.nix

@@ -6,7 +6,7 @@ let
 in
 {
   greg.proxies."${srcDomain}" = {
-    target = "http://git.thehellings.lan";
+    target = "https://vm-gitlab.shire-zebra.ts.net";
     ssl = true;
     genAliases = false;
     extraConfig = ''
@@ -16,10 +16,14 @@ in
     '';
   };
   greg.proxies."registry.thehellings.com" = {
-    target = "https://registry.thehellings.lan:5000";
+    target = "https://vm-gitlab.shire-zebra.ts.net:5000";
     ssl = true;
     genAliases = false;
-    extraConfig = "client_max_body_size 25000m;";
+    extraConfig = ''
+      proxy_set_header X-Forwarded-Proto https;
+      proxy_set_header X-Forwarded-Ssl on;
+      client_max_body_size 25000m;
+    '';
   };
 
   networking.firewall.allowedTCPPorts = [ sshPort ];
@@ -44,7 +48,7 @@ in
       "	bind *:${toString sshPort}"
       "	timeout client 1h"
       "	mode tcp"
-      "	server git-thehellings-lan git.thehellings.lan:22"
+      "	server git-thehellings-lan vm-gitlab.shire-zebra.ts.net:22"
     ];
   };
 }

hosts/linode/nginx.nix

@@ -29,9 +29,16 @@ in
       ports = [ "${homepage}:80" ];
     };
   };
-  greg.proxies."thehellings.com" = {
+  greg.proxies = {
+    "thehellings.com" = {
       target = "http://${homepage}/";
       ssl = true;
       genAliases = false;
     };
+    "doubles.thehellings.com" = {
+      target = "http://localhost:8081";
+      ssl = true;
+      genAliases = false;
+    };
+  };
 }

hosts/linode/podman.nix

@@ -1,6 +1,10 @@
-{ ... }:
+{ pkgs, ... }:
 
 {
+  environment.systemPackages = with pkgs; [
+    podman-compose
+  ];
+
   virtualisation.podman = {
     enable = true;
     dockerCompat = true;

hosts/vm-gitlab/default.nix

@@ -11,12 +11,10 @@
 
 let
   registryPort = 5000;
-  vpnIp = "100.91.131.66";
+  vpnIp = "100.117.28.111";
-  containerIp = "192.168.200.2";
 in
 {
   imports = [
-    # Include the results of the hardware scan.
     ./hardware-configuration.nix
   ];
 
@@ -33,6 +31,7 @@ in
       gitlab-secret = cfg "secret";
       gitlab-otp = cfg "otp";
       gitlab-db = cfg "db";
+      gitlab-db-password = cfg "db-password";
       gitlab-jws = cfg "jws";
       gitlab-key = cfg "key";
       gitlab-cert = cfg "cert";
@@ -54,30 +53,12 @@ in
       };
     };
 
-  greg.proxies =
+  greg = {
-    let
+    backup.jobs.nas-backup = {
-      t = {
-        target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-        extraConfig = ''
-          proxy_set_header X-Forwarded-Proto https;
-          proxy_set_header X-Forwarded-Ssl on;
-          client_max_body_size 10000m;
-        '';
-      };
-    in
-    {
-      "${containerIp}" = t;
-      "${vpnIp}" = t;
-      "git.thehellings.lan" = t;
-    };
-
-  greg.backup.jobs.nas-backup = {
       src = "/var/gitlab/state/backup/";
       dest = "gitlab";
-    id = "container-gitlab";
+      id = "gitlab";
     };
-
-  greg = {
     home = true;
     tailscale.enable = true;
   };
@@ -95,7 +76,7 @@ in
     cron = {
       enable = true;
       systemCronJobs = [
-        "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx"
+        "0 0 1 */2 * cd /etc/certs && tailscale cert vm-gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx"
       ];
     };
 
@@ -105,47 +86,18 @@ in
         keepTime = 288;
         startAt = [ "03:00" ];
       };
-      host = "src.thehellings.com";
+      databaseHost = "postgres.kubernetes";
-      https = true;
+      databaseName = "gitlab";
-      port = 443;
+      databaseUsername = "gitlab";
+      databasePasswordFile = config.age.secrets.gitlab-db-password.path;
+      databaseCreateLocally = false;
       extraConfig = {
         gitlab = {
           trustedProxies = [
-            "${vpnIp}/32" # The container itself
+            "${vpnIp}/32" # The system itself
-            "100.115.57.8/32" # Public server's IP
+            "100.109.86.8/32" # Public server's IP
           ];
         };
-      };
-      initialRootEmail = "greg@thehellings.com";
-      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
-      pages = {
-        enable = true;
-        settings.pages-domain = "pages.thehellings.com";
-      };
-      puma = {
-        threadsMax = 6;
-        threadsMin = 2;
-        workers = 6;
-      };
-      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
-      registry = {
-        enable = true;
-        certFile = config.age.secrets.gitlab-cert.path;
-        keyFile = config.age.secrets.gitlab-key.path;
-        externalAddress = "registry.thehellings.com";
-        externalPort = 443;
-      };
-      secrets = {
-        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
-        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
-        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
-        dbFile = config.age.secrets.gitlab-db.path;
-        jwsFile = config.age.secrets.gitlab-jws.path;
-        otpFile = config.age.secrets.gitlab-otp.path;
-        secretFile = config.age.secrets.gitlab-secret.path;
-      };
-
-      extraConfig = {
         object_store = {
           enabled = true;
           proxy_download = true; # Tell them to reach out to object storage themselves!
@@ -182,11 +134,62 @@ in
           );
         };
       };
+      host = "src.thehellings.com";
+      https = true;
+      initialRootEmail = "greg@thehellings.com";
+      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
+      pages = {
+        enable = true;
+        settings.pages-domain = "pages.thehellings.com";
+      };
+      port = 443;
+      puma = {
+        threadsMax = 6;
+        threadsMin = 2;
+        workers = 6;
+      };
+      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
+      registry = {
+        enable = true;
+        certFile = config.age.secrets.gitlab-cert.path;
+        keyFile = config.age.secrets.gitlab-key.path;
+        externalAddress = "registry.thehellings.com";
+        externalPort = 443;
+      };
+      secrets = {
+        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
+        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
+        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
+        dbFile = config.age.secrets.gitlab-db.path;
+        jwsFile = config.age.secrets.gitlab-jws.path;
+        otpFile = config.age.secrets.gitlab-otp.path;
+        secretFile = config.age.secrets.gitlab-secret.path;
+      };
     };
 
     nginx = {
+      enable = true;
       clientMaxBodySize = "25000m";
-      virtualHosts."gitlab.shire-zebra.ts.net" = {
+      virtualHosts = {
+        "vm-gitlab.shire-zebra.ts.net" = {
+          listen = [
+            {
+              addr = "0.0.0.0";
+              port = 443;
+              ssl = true;
+            }
+          ];
+          locations."/" = {
+            proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+            recommendedProxySettings = true;
+          };
+          extraConfig = ''
+            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
+            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
+            client_max_body_size 10000m ;
+          '';
+        };
+        "registry" = {
           listen = [
             {
               addr = "0.0.0.0";
@@ -199,49 +202,27 @@ in
             recommendedProxySettings = true;
           };
           extraConfig = ''
-          ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;
+            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
-          ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;
+            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
-          client_max_body_size 10000m ;
+            client_max_body_size 25000m ;
           '';
-      };
+          serverAliases = [
-    };
+            "vm-gitlab.shire-zebra.ts.net"
-
+          ];
-    logrotate = {
-      enable = true;
-      settings = {
-        "/var/lib/postgresql/*/log/*.log" = {
-          enable = true;
-          compress = true;
-          compresscmd = "${pkgs.xz}/bin/xz";
         };
       };
     };
 
     openssh.enable = true;
 
-    postgresql = {
+    postgresql.enable = true;
-      enable = true;
-      checkConfig = true;
-      ensureDatabases = [ "gitlab" ];
-      ensureUsers = [
-        {
-          name = "gitlab";
-          ensureDBOwnership = true;
-        }
-      ];
-      settings = {
-        log_connections = true;
-        log_statement = "all";
-        logging_collector = true;
-        log_filename = "postgresql.log";
-      };
-    };
 
     qemuGuest.enable = true;
 
     redis.servers.gitlab = {
       enable = true;
     };
+
     resolved.enable = true;
   };
 

hosts/vm-gitlab/hardware-configuration.nix

@@ -34,12 +34,12 @@
   };
 
   fileSystems."/" = {
-    device = "/dev/disk/by-uuid/507251f1-efe7-448d-8de8-91ee582a9afb";
+    device = "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab";
     fsType = "ext4";
   };
 
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/7115-EFA6";
+    device = "/dev/disk/by-uuid/1E6A-C3BB";
     fsType = "vfat";
     options = [
       "fmask=0077"

hosts/vm-jellyfin/default.nix

@@ -30,17 +30,17 @@
 
   fileSystems = {
     "/music" = {
-      device = "10.42.1.4:/volume1/music";
+      device = "nas1.shire-zebra.ts.net:/mnt/all/music";
       fsType = "nfs";
       options = [ "ro" ];
     };
     "/photo" = {
-      device = "10.42.1.4:/volume1/photo";
+      device = "nas1.shire-zebra.ts.net:/mnt/all/photos";
       fsType = "nfs";
       options = [ "ro" ];
     };
     "/video" = {
-      device = "10.42.1.4:/volume1/video/";
+      device = "nas1.shire-zebra.ts.net:/mnt/all/video/";
       fsType = "nfs";
       options = [ "ro" ];
     };

hosts/zeke/default.nix

@@ -0,0 +1,89 @@
+{
+  config,
+  lib,
+  top,
+  ...
+}:
+
+{
+  imports = [
+    ./boot.nix
+    ./hardware-configuration.nix
+    ./virt.nix
+    top.nix-hardware.nixosModules.system76
+  ];
+
+  boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
+
+  greg = {
+    kubernetes = {
+      enable = true;
+      vipInterface = "enp12s0";
+      priority = 253;
+    };
+    remote-builder.enable = true;
+    runner.enable = true;
+    tailscale.enable = true;
+  };
+
+  hardware = {
+    nvidia = {
+      modesetting.enable = true;
+      powerManagement = {
+        enable = false;
+        finegrained = false;
+      };
+      nvidiaSettings = true;
+      open = true;
+    };
+    system76 = {
+      firmware-daemon.enable = true;
+      #kernel-modules.enable = true;
+    };
+  };
+
+  networking = {
+    hostName = "zeke";
+    networkmanager.enable = lib.mkForce true;
+    enableIPv6 = false;
+    useDHCP = false;
+    interfaces = {
+      # This seems to be direct mother board interface
+      enp12s0.useDHCP = true;
+      enp12s0.ipv4.addresses = [
+        {
+          address = "10.42.1.13";
+          prefixLength = 16;
+        }
+      ];
+    };
+    defaultGateway = {
+      address = "10.42.1.1";
+      interface = "enp12s0";
+    };
+    nameservers = [
+      "10.42.1.5"
+      "10.42.1.1"
+    ];
+  };
+
+  # Let's do a sound thing
+  services = {
+    k3s = {
+      extraFlags =
+        let
+          ip = (builtins.head config.networking.interfaces.enp12s0.ipv4.addresses).address;
+        in
+        [
+          "--tls-san ${ip}"
+          #"--bind-address ${ip}"
+        ];
+    };
+    xserver.videoDrivers = [ "nvidia" ];
+  };
+
+  users.users.greg.extraGroups = [
+    "kvm"
+    "podman"
+  ];
+}

hosts/zeke/hardware-configuration.nix

@@ -33,10 +33,6 @@
       device = "/dev/nvme0n1p1";
       fsType = "auto";
     };
-    "/windows11" = {
-      device = "/dev/nvme1n1p2";
-      fsType = "ntfs-3g";
-    };
   };
 
   swapDevices = [ ];

hosts/zeke/virt.nix

@@ -0,0 +1,66 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  passthru = [
+    "1002:164e" # Raphael - embedded GPU
+    "1002:1640" # Rembrandt - Audio
+    #"10de:2507" # RTX 3050 video
+    #"10de:228e" # RTX 3050 audio
+  ];
+in
+{
+  greg.runner.enable = true;
+  # These options enable sharing of the GPU with the VM
+  boot = {
+    # Order matters here, to prevent the AMD driver from getting to the driver before
+    # vfio-pci does
+    initrd.kernelModules = [
+      "vfio_pci"
+      "vfio"
+      "vfio_iommu_type1"
+
+      #"amdgpu"
+      #"nvidia"
+      #"nvidia_modeset"
+      #"nvidia_uvm"
+      #"nvidia_drm"
+    ];
+    kernelParams = [
+      "amd_iommu=on"
+      "iommu=pt"
+      ("vfio-pci.ids=" + (lib.concatStringsSep "," passthru))
+    ];
+  };
+
+  hardware.graphics.enable = true;
+
+  systemd.services = {
+    "libvirt-nosleep@" = {
+      description = "Prevent sleep while %i is running";
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = ''
+          ${pkgs.systemd}/bin/systemd-inhibit --what=sleep --why="Libvirt domain %i is running" --who=%U --mode=block sleep infinity
+        '';
+      };
+    };
+  };
+
+  virtualisation = {
+    libvirtd = {
+      extraConfig = ''
+        log_filters="1:qemu"
+        log_outputs="1:file:/var/log/libvirt/libvirtd.log"
+      '';
+      hooks.qemu = {
+        win10 = lib.getExe pkgs.qemu-hook;
+      };
+    };
+
+    spiceUSBRedirection.enable = true;
+  };
+}

manifests/apply.sh

@@ -6,9 +6,17 @@ SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
 # Change to the script directory
 cd "$SCRIPT_DIR"
 
-kubectl apply -k namespaces
-kubectl apply -f helm/flux.yaml
-sleep 5
 kubectl apply -k helm
 sleep 5
+# https://cloudnative-pg.io
+helm repo add cnpg https://cloudnative-pg.github.io/charts/
+helm upgrade --install cnpg \
+    --create-namespace --namespace cnpg-system \
+    cnpg/cloudnative-pg \
+    -f values/cnpg.yaml \
+    --wait
+sleep 5
 kubectl apply -k .
+
+./immich/apply.sh
+./tailscale/apply.sh

manifests/auto/README.md

@@ -0,0 +1,12 @@
+It should not be necessary to deploy these files as, ostensibly, they are
+configured to be auto-deployed on the nodes at startup time.
+
+nodes.yaml contains things like annotations for the nodes and other similar
+hubub that makes the code deploy in a friendly manner.
+
+operator-oauth.yaml includes the secrets that need to be defined before the
+tailscale operator can be deployed. But, of course, it also needs things like
+the external-secrets helm chart before it is fully deployed in the proper
+manner. There is a little bit of a chicken and egg type of problem here, but
+if you just keep applying everyting, over and over, it will eventually be
+installed and configured correctly.

manifests/auto/nodes.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: Node
+metadata:
+  name: isaiah
+  annotations:
+    "node.longhorn.io/default-disks-config": |-
+      [
+        { "path": "/var/lib/longhorn", "allowScheduling" : true, "tags": ["hdd", "large"]}
+      ]
+---
+apiVersion: v1
+kind: Node
+metadata:
+  name: jeremiah
+  annotations:
+    "node.longhorn.io/default-disks-config": |-
+      [
+        { "path": "/var/lib/longhorn", "allowScheduling" : true, "tags": ["hdd", "large"]}
+      ]
+---
+apiVersion: v1
+kind: Node
+metadata:
+  name: zeke
+  annotations:
+    "node.longhorn.io/default-disks-config": |-
+      [
+        { "path": "/var/lib/longhorn", "allowScheduling" : trues, "tags": ["ssd", "fast"]}
+      ]

manifests/auto/operator-oauth.yaml

@@ -1,14 +1,14 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: postgres-user-matrix
+  name: operator-oauth
-  namespace: db
+  namespace: tailscale
 spec:
   target:
-    name: postgres-user-matrix
+    name: operator-oauth
     deletionPolicy: Delete
     template:
-      type: Opaque
+      type: kubernetes.io/basic-auth
       data:
         username: |-
           {{ .username }}
@@ -21,7 +21,7 @@ spec:
           name: bitwarden-login
           kind: ClusterSecretStore
       remoteRef:
-        key: 36d1046b-727e-4e09-a391-b2e90171d3d0
+        key: ffa188a4-63b2-4926-99f0-b33b0021a4f4
         property: username
     - secretKey: password
       sourceRef:
@@ -29,5 +29,5 @@ spec:
           name: bitwarden-login
           kind: ClusterSecretStore
       remoteRef:
-        key: 36d1046b-727e-4e09-a391-b2e90171d3d0
+        key: ffa188a4-63b2-4926-99f0-b33b0021a4f4
         property: password

manifests/bitwarden/deployment.yaml

@@ -21,7 +21,11 @@ spec:
     spec:
       containers:
         - name: bitwarden-cli
-          image: "registry.thehellings.com/greg/nixos-config/img-bitwarden:latest"
+          # Since my gitlab instance depends on the database hosted in k3s, and the
+          # database depends on this image, I need a way to bootstrap the system if
+          # I am doing disaster recovery. And this is it.
+          image: "ghcr.io/greg-hellings/nixos-config/img-bitwarden:latest"
+          #image: "registry.thehellings.com/greg/nixos-config/img-bitwarden:latest"
           imagePullPolicy: Always
           env:
             - name: BW_CLIENTID

manifests/bitwarden/kustomization.yaml

@@ -1,6 +1,7 @@
 namespace: bitwarden
 
 resources:
+  - namespace.yaml
   - deployment.yaml
   - service.yaml
   - cluster-stores.yaml

manifests/databases/ingress.yaml

@@ -14,11 +14,11 @@ spec:
       - 100.88.91.27 # dns?
       - 100.80.99.48 # exodus
       - 100.88.91.27 # genesis
-      - 100.91.131.66 # gitlab
+      - 100.117.28.111 # gitlab
       - 100.68.203.1 # hosea
       - 100.84.183.79 # isaiah
       - 100.102.186.39 # jeremiah
-      - 100.90.74.19 # jude
+      - 100.90.74.19 # zeke
       - 100.115.57.8 # linode
       - 100.65.5.38 # matrix
       - 100.127.55.22 # jellyfin

manifests/databases/kustomization.yaml

@@ -1,6 +1,8 @@
 namespace: db
 
 resources:
+  - namespace.yaml
+  - secrets.yaml
   - postgres-cluster.yaml
   - postgres-gitlab.yaml
   - postgres-pgadmin.yaml

manifests/databases/postgres-cluster.yaml

@@ -3,9 +3,10 @@ kind: Cluster
 metadata:
   name: postgres
 spec:
-  instances: 3
+  instances: 2
+  enablePDB: false
   storage:
-    size: 10Gi
+    size: 20Gi
   primaryUpdateStrategy: unsupervised
 
   managed:
@@ -31,17 +32,45 @@ spec:
         superuser: false
         passwordSecret:
           name: postgres-user-matrix
-  backup:
+
-    retentionPolicy: "30d"
+  plugins:
-    barmanObjectStore:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: false
+      parameters:
+        barmanObjectName: k3sbackup-objectstore
+
+  # Use this as the target of the bootstrap recovery process
+  # It is important that the `externalClusters` serverName matches
+  # the old name of the original cluster that you are upgrading.
+  # When restoring, set the targetTime to the latest backup that you
+  # want to restore to
+# bootstrap:
+#   recovery:
+#     source: origin
+#     recoveryTarget:
+#       targetTime: "2025-08-25 19:00:40+05"
+# externalClusters:
+#   - name: origin
+#     plugin:
+#       name: barman-cloud.cloudnative-pg.io
+#       parameters:
+#         barmanObjectName: k3sbackup-objectstore
+#         serverName: postgres
+---
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: k3sbackup-objectstore
+spec:
+  configuration:
     destinationPath: "s3://k3sbackup/postgres"
     endpointURL: "http://s3.thehellings.lan:9000/"
     s3Credentials:
       accessKeyId:
-          name: k3sbackup
+        name: k3sbackup-secret
         key: username
       secretAccessKey:
-          name: k3sbackup
+        name: k3sbackup-secret
         key: password
     wal:
       compression: gzip
@@ -52,7 +81,7 @@ metadata:
   name: postgres-backup
 spec:
   immediate: true # Create one when this is added to the cluster
-  schedule: "0 0 0 * * *" # Midnight, nightly
+  schedule: "0 1 0 * * *" # 1AM, nightly
   backupOwnerReference: self
   cluster:
     name: postgres

manifests/databases/postgres-pgadmin.yaml

@@ -91,17 +91,13 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: ingress-pgadmin
-  annotations:
-    ingressClassName: traefik
 spec:
-  rules:
+  ingressClassName: tailscale
-    - host: pgadmin.kubernetes
+  defaultBackend:
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
     service:
       name: service-pgadmin
       port:
         number: 80
+  tls:
+    - hosts:
+        - pgadmin

manifests/databases/secrets.yaml

@@ -0,0 +1,135 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-user-gitlab
+  namespace: db
+spec:
+  target:
+    name: postgres-user-gitlab
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-user-matrix
+  namespace: db
+spec:
+  target:
+    name: postgres-user-matrix
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 36d1046b-727e-4e09-a391-b2e90171d3d0
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 36d1046b-727e-4e09-a391-b2e90171d3d0
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-user-pgadmin
+  namespace: db
+spec:
+  target:
+    name: postgres-user-pgadmin
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: f333d637-1667-499d-b9a0-b2e9012bd8b7
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: f333d637-1667-499d-b9a0-b2e9012bd8b7
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: k3sbackup-externalsecret
+  namespace: db
+spec:
+  target:
+    name: k3sbackup-secret
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: password

manifests/gitlab-runner/chart.yaml

@@ -15,7 +15,7 @@ spec:
   chart:
     spec:
       chart: gitlab-runner
-      version: "0.74.1"
+      version: "0.80.1"
       sourceRef:
         kind: HelmRepository
         name: gitlab-runner
@@ -28,9 +28,11 @@ spec:
     runners:
       secret: gitlab-runner
     imagePullSecrets:
-      - image-pull-secrets
+      - name: image-pull-secrets
     rbac:
       create: true
+    serviceAccount:
+      create: true
     extraEnv:
       CACHE_TYPE: s3
       CACHE_SHARED: "true"

manifests/gitlab-runner/kustomization.yaml

@@ -1,4 +1,6 @@
 namespace: gitlab-runner
 
 resources:
+  - namespace.yaml
+  - secrets.yaml
   - chart.yaml

manifests/helm/cloudnative-pg.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cnpg-system
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cloudnative-pg
-  namespace: cnpg-system
-spec:
-  interval: "24h"
-  url: "https://cloudnative-pg.github.io/charts/"
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cnpg
-  namespace: cnpg-system
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: cloudnative-pg
-      version: "0.23.2"
-      sourceRef:
-        kind: HelmRepository
-        name: cloudnative-pg
-      interval: "1h"
-  values:
-    crds:
-      create: true
-    includeCRDs: true

manifests/helm/external-secrets.yaml

@@ -1,33 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: external-secrets
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: external-secrets
-  namespace: external-secrets
-spec:
-  interval: "24h"
-  url: "https://charts.external-secrets.io/"
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: external-secrets
-  namespace: external-secrets
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: external-secrets
-      version: "0.17.0"
-      sourceRef:
-        kind: HelmRepository
-        name: external-secrets
-      interval: "1h"
-  values:
-    crds:
-      create: true
-    includeCRDs: true

manifests/helm/kustomization.yaml

@@ -1,5 +1,3 @@
 resources:
-  - flux.yaml
+  - longhorn.yaml  # Needed for storage
   - traefik.yaml
-  - external-secrets.yaml
-  - cloudnative-pg.yaml

manifests/helm/longhorn.yaml

@@ -0,0 +1,168 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: longhorn-system
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: "24h"
+  url: "https://charts.longhorn.io"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: longhorn
+      version: "1.9.0"
+      sourceRef:
+        kind: HelmRepository
+        name: longhorn
+      interval: "1h"
+  values:
+    defaultSettings:
+      createDefaultDiskLabeledNodes: true
+      # This should go back to null when I have more cluster
+      replicaSoftAntiAffinity: null
+    persistence:
+      # This should go back to 3 when I have more cluster
+      defaultClassReplicaCount: 2
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: longhorn-custom-path
+  namespace: longhorn-system
+data:
+  PATH: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin
+---
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: add-host-path-to-longhorn
+  annotations:
+    policies.kyverno.io/title: Add Environment Variables from ConfigMap
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/description: >-
+      Longhorn invokes executables on the host system, and needs
+      to be aware of the host systems PATH. This modifies all
+      deployments such that the PATH is explicitly set to support
+      NixOS based systems.
+spec:
+  rules:
+    - name: add-env-vars
+      match:
+        resources:
+          kinds:
+            - Pod
+          namespaces:
+            - longhorn-system
+      mutate:
+        patchStrategicMerge:
+          spec:
+            initContainers:
+              - (name): "*"
+                envFrom:
+                  - configMapRef:
+                      name: longhorn-custom-path
+            containers:
+              - (name): "*"
+                envFrom:
+                  - configMapRef:
+                      name: longhorn-custom-path
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  namespace: longhorn-system
+  name: basic-auth
+spec:
+  basicAuth:
+    realm: Traefik
+    secret: longhorn-ui
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: longhorn-ingress-tailscale
+  namespace: longhorn-system
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: longhorn-frontend
+      port:
+        number: 80
+  tls:
+    - hosts:
+        - longhorn
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: longhorn-ingress
+  namespace: longhorn-system
+  annotations:
+    ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.middlewares: longhorn-system-basic-auth@kubernetescrd
+    # Set body size to 10G to allow uploading large things
+    traefik.ingress.kubernetes.io/buffering: |
+      maxrequestbodybytes: 10000000000
+      memrequestbodybytes: 20000000000
+spec:
+  ingressClassName: traefik
+  rules:
+  - &host
+    host: longhorn.cluster
+    http:
+      paths:
+      - pathType: Prefix
+        path: "/"
+        backend:
+          service:
+            name: longhorn-frontend
+            port:
+              number: 80
+  - <<: *host
+    host: longhorn.kubernetes
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-default
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+parameters:
+  backupTargetName: default
+  numberOfReplicas: "2"
+  staleReplicaTimeout: "2880"
+  fromBackup: ""
+  fsType: ext4
+  diskSelector: "hdd,large"
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-fast
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+volumeBindingMode: Immediate
+parameters:
+  backupTargetName: default
+  numberOfReplicas: "1"
+  staleReplicaTimeout: "2880"
+  fromBackup: ""
+  fsType: ext4
+  diskSelector: "ssd,fast"

manifests/immich/apply.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+
+# Get the directory where the script is located
+SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
+
+# Change to the script directory
+cd "$SCRIPT_DIR"
+
+kubectl apply -k "$SCRIPT_DIR"
+
+# https://www.dragonflydb.io/guides/redis-kubernetes
+# Deploys into immich namespace, directly, in order to allow the password to be
+# accessed by the immich installer
+helm upgrade --install --create-namespace --namespace immich redis \
+    oci://registry-1.docker.io/bitnamicharts/redis \
+    -f "${SCRIPT_DIR}/values-redis.yaml" \
+    --wait
+# https://github.com/immich-app/immich-charts/tree/main
+helm upgrade --install --create-namespace --namespace immich immich \
+    oci://ghcr.io/immich-app/immich-charts/immich \
+    -f "${SCRIPT_DIR}/values.yaml" \
+    --wait

manifests/immich/database.yaml

@@ -0,0 +1,74 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  namespace: db
+  name: pgvector
+spec:
+  imageName: "ghcr.io/tensorchord/cloudnative-pgvecto.rs:16-v0.3.0"
+  instances: 1
+  storage:
+    size: 40Gi
+  primaryUpdateStrategy: unsupervised
+  postgresql:
+    shared_preload_libraries:
+      - "vectors.so"
+
+  bootstrap:
+    initdb:
+      database: immich
+      owner: immich
+      secret:
+        name: postgres-user-immich
+      dataChecksums: true
+      postInitApplicationSQL:
+        - ALTER SYSTEM SET search_path TO "$user", public, vectors;
+        - SET search_path TO "$user", public, vectors;
+        - CREATE EXTENSION IF NOT EXISTS "vectors";
+        - CREATE EXTENSION IF NOT EXISTS "cube";
+        - CREATE EXTENSION IF NOT EXISTS "earthdistance";
+        - ALTER SCHEMA vectors OWNER TO "immich";
+        - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA vectors TO "immich";
+        - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
+  managed:
+    roles:
+      - name: immich
+        ensure: present
+        comment: Immich DB user
+        login: true
+        superuser: false
+        passwordSecret:
+          name: postgres-user-immich
+  backup:
+    retentionPolicy: "30d"
+    barmanObjectStore:
+      destinationPath: "s3://k3sbackup/pgvector"
+      endpointURL: "http://s3.thehellings.lan:9000/"
+      s3Credentials:
+        accessKeyId:
+          name: k3sbackup
+          key: username
+        secretAccessKey:
+          name: k3sbackup
+          key: password
+      wal:
+        compression: gzip
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  namespace: db
+  name: database-immich
+spec:
+  name: immich
+  owner: immich
+  cluster:
+    name: pgvector
+  extensions:
+    - name: vectors
+      ensure: present
+    - name: vectorchord
+      ensure: present
+    - name: cube
+      ensure: present
+    - name: earthdistance
+      ensure: present

manifests/immich/ingress.yaml

@@ -0,0 +1,40 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  namespace: immich
+  name: immich
+  annotations:
+    ingressClassName: traefik
+    # Set body size to 10G to allow uploading large things
+    traefik.ingress.kubernetes.io/buffering: |
+      maxrequestbodybytes: 10000000000
+      memrequestbodybytes: 20000000000
+spec:
+  rules:
+    - &host
+      host: immich.kubernetes
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: immich-server
+                port:
+                  name: http
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  namespace: immich
+  name: immich-ingress-tailscale
+spec:
+  defaultBackend:
+    service:
+      name: immich-server
+      port:
+        name: http
+  ingressClassName: tailscale
+  tls:
+    - hosts:
+        - immich

manifests/immich/kustomization.yaml

@@ -0,0 +1,6 @@
+resources:
+  - namespace.yaml
+  - postgres-user-secret.yaml
+  - database.yaml
+  - pvc.yaml
+  - ingress.yaml

manifests/immich/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: immich

manifests/immich/postgres-user-secret.yaml

@@ -0,0 +1,67 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-user-immich
+  namespace: db
+spec:
+  target:
+    name: postgres-user-immich
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-user-immich
+  namespace: immich
+spec:
+  target:
+    name: postgres-user-immich
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
+        property: password

manifests/immich/pvc.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: immich
+  name: immich-storage
+spec:
+  storageClassName: longhorn-default
+  volumeName: immich-storage
+  resources:
+    requests:
+      storage: 250Gi
+  accessModes:
+    - ReadWriteOnce
+---
+#apiVersion: v1
+#kind: PersistentVolume
+#metadata:
+  #namespace: immich
+  #name: immich-storage
+#spec:
+  #storageClassName: longhorn-default
+  #capacity:
+    #storage: 250Gi
+  #volumeMode: Filesystem
+  #accessModes:
+    #- ReadWriteOnce
+  #csi:
+    #driver: driver.longhorn.io
+    #volumeHandle: immich-storage

manifests/immich/values-redis.yaml

@@ -0,0 +1,8 @@
+# https://github.com/bitnami/charts/blob/main/bitnami/redis/values.yaml
+# https://github.com/bitnami/charts/tree/main/bitnami/redis
+architecture: standalone
+global:
+  defaultStorageClass: longhorn-default
+master:
+  persistence:
+    storageClass: longhorn-default

manifests/immich/values.yaml

@@ -0,0 +1,46 @@
+# https://github.com/immich-app/immich-charts/blob/main/charts/immich/values.yaml
+env:
+  DB_HOSTNAME: pgvector-rw.db.svc.cluster.local
+  DB_DATABASE_NAME: immich
+  DB_USERNAME:
+    valueFrom:
+      secretKeyRef:
+        name: postgres-user-immich
+        key: username
+  DB_PASSWORD:
+    valueFrom:
+      secretKeyRef:
+        name: postgres-user-immich
+        key: password
+  REDIS_HOSTNAME: redis-master
+  REDIS_PASSWORD:
+    valueFrom:
+      secretKeyRef:
+        name: redis
+        key: redis-password
+image:
+  tag: "v1.135.3"
+immich:
+  persistence:
+    library:
+      existingClaim: immich-storage
+server:
+  ingress:
+    main:
+      enabled: true
+      annogations:
+        ingressClassName: traefik
+        # Set body size to 10G to allow uploading large things
+        traefik.ingress.kubernetes.io/buffering: |
+          maxrequestbodybytes: 10000000000
+          memrequestbodybytes: 20000000000
+      hosts:
+        - host: immich.cluster
+          paths:
+            - path: "/"
+machine-learning:
+  persistence:
+    cache:
+      type: pvc
+      storageClass: longhorn-default
+      size: 25Gi

manifests/kustomization.yaml

@@ -1,8 +1,8 @@
 resources:
-  - namespaces
   - helm
   - bitwarden
   - secrets
   - databases
   - matrix
   - gitlab-runner
+  - immich

manifests/matrix/ingress.yaml

@@ -1,21 +1,15 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: dendrite-ingress
+  namespace: matrix
-  annotations:
+  name: dendrite-ingress-tailscale
-    ingressClassName: traefik
 spec:
-  rules:
+  ingressClassName: tailscale
-    - &host
+  defaultBackend:
-      host: matrix.kubernetes
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
     service:
       name: dendrite
       port:
         number: 8008
-    - <<: *host
+  tls:
-      host: matrix.thehellings.com
+    - hosts:
+        - matrix

manifests/matrix/kustomization.yaml

@@ -1,6 +1,7 @@
 namespace: matrix
 
 resources:
+  - namespace.yaml
   - dendrite-config.yaml
   - deployment.yaml
   - service.yaml

manifests/namespaces/kustomization.yaml

@@ -1,5 +0,0 @@
-resources:
-  - bitwarden.yaml
-  - db.yaml
-  - gitlab-runner.yaml
-  - matrix.yaml

manifests/secrets/k3sbackup.yaml

@@ -1,33 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: k3sbackup
-  namespace: db
-spec:
-  target:
-    name: k3sbackup
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
-        property: password

manifests/secrets/kustomization.yaml

@@ -1,6 +1,2 @@
 resources:
-  - postgres-user-gitlab.yaml
+  - longhorn.yaml
-  - postgres-user-pgadmin.yaml
-  - postgres-user-matrix.yaml
-  - k3sbackup.yaml
-  - gitlab-runner.yaml

manifests/secrets/longhorn.yaml

@@ -0,0 +1,61 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: longhorn-ui
+  namespace: longhorn-system
+spec:
+  target:
+    name: longhorn-ui
+    deletionPolicy: Delete
+    template:
+      type: kubernetes.io/basic-auth
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: cbf2bf72-c129-437a-8a75-b30f005d29ec
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: cbf2bf72-c129-437a-8a75-b30f005d29ec
+        property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: longhorn-minio
+  namespace: longhorn-system
+spec:
+  target:
+    name: longhorn-minio
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        AWS_ACCESS_KEY_ID: "{{ .username }}"
+        AWS_SECRET_ACCESS_KEY: "{{ .password }}"
+        AWS_ENDPOINTS: "http://s3.thehellings.lan:9000/"
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    - secretKey: username
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: username
+    - secretKey: password
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: password

manifests/secrets/postgres-user-gitlab.yaml

@@ -1,33 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: postgres-user-gitlab
-  namespace: db
-spec:
-  target:
-    name: postgres-user-gitlab
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: password

manifests/secrets/postgres-user-pgadmin.yaml

@@ -1,33 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: postgres-user-pgadmin
-  namespace: db
-spec:
-  target:
-    name: postgres-user-pgadmin
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: f333d637-1667-499d-b9a0-b2e9012bd8b7
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: f333d637-1667-499d-b9a0-b2e9012bd8b7
-        property: password

manifests/tailscale/apply.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+
+helm repo add tailscale https://pkgs.tailscale.com/helmcharts
+
+helm repo update tailscale
+
+helm upgrade \
+    --install \
+    tailscale-operator \
+    tailscale/tailscale-operator \
+    --namespace=tailscale \
+    --create-namespace \
+    --wait

manifests/values/cnpg.yaml

@@ -0,0 +1,3 @@
+crds:
+  create: true
+includeCRDs: true

modules/hm/default.nix

@@ -6,7 +6,6 @@
     ./gnome.nix
     ./gui.nix
     ./python.nix
-    ./sway.nix
     ./vscodium.nix
     ./xonsh.nix
     ./zed.nix

modules/hm/development.nix

@@ -19,6 +19,7 @@ let
     nixpkgs-review
     nodejs
     process-compose
+    subversion
   ];
 in
 with lib;

modules/hm/gui.nix

@@ -49,7 +49,8 @@ in
             [
               bitwarden
               endeavour
-              jellyfin-media-player
+              # Is removed because it depends on qt5-qtwebengine
+              # jellyfin-media-player
               nextcloud-client
               slack
               (pkgs.zoom-us.overrideAttrs {

modules/hm/gui/bookmarks.nix

@@ -63,6 +63,19 @@
               }
             ];
           }
+          {
+            name = "IC";
+            bookmarks = [
+              {
+                name = "Azure Portal/Console";
+                url = "https://portal.azure.com";
+              }
+              {
+                name = "Azure Code";
+                url = "https://dev.azure.com";
+              }
+            ];
+          }
           {
             name = "Processes";
             bookmarks = [
@@ -78,6 +91,10 @@
                 name = "DB Request";
                 url = "https://ivrtg.aha.io/develop/features/INFR-1073";
               }
+              {
+                name = "Deploy";
+                url = "https://ivrtg.aha.io/develop/features/EN-1000";
+              }
               {
                 name = "Server list";
                 url = "https://ivrtg.atlassian.net/wiki/spaces/ITS/pages/13009166/350+Main";
@@ -166,6 +183,68 @@
           }
         ];
       }
+      {
+        name = "Tools";
+        bookmarks = [
+          {
+            name = "Proxmoxes";
+            bookmarks = [
+              {
+                name = "PVE1";
+                url = "https://10.42.1.1:8006/";
+              }
+              {
+                name = "Isaiah";
+                url = "https://isaiah.home:8006/";
+              }
+              {
+                name = "Jeremiah";
+                url = "https://jeremiah.home:8006/";
+              }
+            ];
+          }
+          {
+            name = "Kubernetes";
+            bookmarks = [
+              {
+                name = "Longhorn";
+                url = "http://longhorn.shire-zebra.ts.net";
+              }
+              {
+                name = "PGAdmin4";
+                url = "http://pgadmin.shire-zebra.ts.net/";
+              }
+            ];
+          }
+          {
+            name = "Password Hash";
+            url = "https://unix4lyfe.org/crypt/";
+          }
+          {
+            name = "Keymap editor";
+            url = "https://nickcoutsos.github.io/keymap-editor/";
+          }
+          {
+            name = "Bitcoin dashboard";
+            url = "http://hosea.home:60845";
+          }
+          {
+            name = "Syncthing - nas";
+            url = "http://nas.home:8384/#";
+          }
+          {
+            name = "Pinchflat";
+            url = "http://nas1.shire-zebra.ts.net:8945";
+          }
+          {
+            name = "Portainer";
+            url = "http://nas1.shire-zebra.ts.net:31015";
+          }
+        ];
+      }
+      {
+        name = "REI";
+        bookmarks = [
           {
             name = "SubTo";
             bookmarks = [
@@ -191,55 +270,14 @@
               }
             ];
           }
-      {
-        name = "Tools";
-        bookmarks = [
-          {
-            name = "Proxmoxes";
-            bookmarks = [
-              {
-                name = "PVE1";
-                url = "https://10.42.1.1:8006/";
-              }
-              {
-                name = "Isaiah";
-                url = "https://isaiah.home:8006/";
-              }
-              {
-                name = "Jeremiah";
-                url = "https://jeremiah.home:8006/";
-              }
-            ];
-          }
-          {
-            name = "PGAdmin4";
-            url = "http://pgadmin.kubernetes/";
-          }
-          {
-            name = "Password Hash";
-            url = "https://unix4lyfe.org/crypt/";
-          }
-          {
-            name = "Keymap editor";
-            url = "https://nickcoutsos.github.io/keymap-editor/";
-          }
-          {
-            name = "Bitcoin dashboard";
-            url = "http://hosea.home:60845";
-          }
-          {
-            name = "Syncthing - nas";
-            url = "http://nas.home:8384/#";
-          }
-        ];
-      }
-      {
-        name = "REI";
-        bookmarks = [
           {
             name = "Door Loop";
             url = "https://btrgpm.app.doorloop.com/home";
           }
+          {
+            name = "HELOC payoff calculator";
+            url = "https://acceleratedstrategies.com/free-calculator/";
+          }
         ];
       }
       {

modules/hm/sway.nix

@@ -1,115 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  cfg = config.greg.sway;
-  file_browser = {
-    pkg = pkgs.krusader;
-    path = "${pkgs.krusader}/bin/krusader";
-  };
-  term = "${pkgs.alacritty}/bin/alacritty";
-  msg = "${pkgs.sway}/bin/swaymsg";
-  sleep = "${pkgs.coreutils}/bin/sleep";
-  workstation1 = pkgs.writeScriptBin "workstation1" (
-    builtins.concatStringsSep "\n" [
-      "${msg} \"workspace 1 ; exec ${pkgs.firefox}/bin/firefox ; split horizontal ; exec ${pkgs.element-desktop}/bin/element-desktop \""
-      "${sleep} 1"
-      "${msg} '[app_id=\"firefox\"]' move left"
-      "${msg} '[instance=\"element\"]' \"layout tabbed ; exec ${term} \""
-      "${msg} '[app_id=\"firefox\"]' move left"
-      "${sleep} 0.3"
-      "${msg} '[app_id=\"Alacritty\" workspace=\"1\"]' move right"
-      "${msg} '[app_id=\"firefox\"]' resize grow width 300 px"
-    ]
-  );
-  workstation2 = pkgs.writeScriptBin "workstation2" (
-    builtins.concatStringsSep "\n" [
-      "${sleep} 5"
-      "${msg} \"workspace 2 ; exec ${term} ; layout tabbed\""
-    ]
-  );
-in
-{
-  options.greg.sway = lib.mkEnableOption "Enable Sway support and settings";
-
-  config = (
-    lib.mkIf cfg {
-      programs.swaylock.enable = true;
-
-      wayland.windowManager.sway =
-        let
-          mod = config.wayland.windowManager.sway.config.modifier;
-        in
-        {
-          enable = true;
-          config = rec {
-            #fonts.size = 10.0;
-            keybindings = lib.mkOptionDefault {
-              "Mod4+l" = "exec ${pkgs.swaylock}/bin/swaylock -c 000000";
-              "Mod4+h" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/headphones.qpwgraph -m";
-              "Mod4+m" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/monitor.qpwgraph -m";
-              "Mod4+b" = "exec ${pkgs.qpwgraph}/bin/qpwgraph -x /home/greg/sound/both.qpwgraph -m";
-
-              "${mod}+Shift+Return" = file_browser.path;
-            };
-            modifier = "Mod1";
-            output = {
-              "Samsung Electric Company S24E650 H4ZN600985" = {
-                mode = "1920x1200";
-                transform = "90";
-                pos = "0 0";
-              };
-              "ViewSonic Corporation VA2252 Series VMT201800925" = {
-                mode = "1920x1080";
-                pos = "200 1920";
-              };
-            };
-            terminal = term;
-            startup = [
-              { command = "${workstation1}/bin/workstation1"; }
-              { command = "${workstation2}/bin/workstation2"; }
-            ];
-          };
-          extraOptions = [ "--unsupported-gpu" ];
-          extraSessionCommands = ''
-            export WLR_NO_HARDWARE_CURSORS=1
-          '';
-          systemd.enable = true;
-          wrapperFeatures = {
-            base = true;
-            gtk = true;
-          };
-        };
-
-      home.pointerCursor = {
-        name = "Adwaita";
-        package = pkgs.gnome.adwaita-icon-theme;
-        size = 12;
-        x11 = {
-          enable = true;
-          defaultCursor = "Adwaita";
-        };
-      };
-
-      home.packages = with pkgs; [
-        arj
-        dpkg
-        kate
-        kget
-        krename
-        file_browser.pkg
-        p7zip
-        plocate
-        rpm
-        qpwgraph
-        xorg.xev
-        xorg.xmodmap
-        xxdiff
-      ];
-    }
-  );
-}

modules/hm/vscodium.nix

@@ -34,10 +34,12 @@ in
             jnoortheen.nix-ide
             mkhl.direnv
             ms-python.python
+            ms-vscode.cpptools-extension-pack
             ms-vscode.makefile-tools
             ms-vscode-remote.remote-ssh
             njpwerner.autodocstring
             rust-lang.rust-analyzer
+            slint.slint
             tamasfe.even-better-toml
             vscjava.vscode-java-test
             vscjava.vscode-java-dependency

modules/hm/zed.nix

@@ -12,9 +12,84 @@ in
   options.greg.zed = lib.mkEnableOption "Whether to install the Zed editor";
 
   config = lib.mkIf cfg {
-    home.packages = with pkgs; [
+    programs.zed-editor = {
-      nil
+      enable = true;
-      zed-editor
+      extensions = [
+        "ansible"
+        "cargo-tom"
+        "dockerfile"
+        "mcp-server-gitlab"
+        "helm"
+        "html"
+        "ini"
+        "jsonnet"
+        "latex"
+        "make"
+        "markdown-oxide"
+        "material-icon-theme"
+        "nix"
+        "nu"
+        "postgres-context-server"
+        "python-refactoring"
+        "slint"
+        "snippets"
+        "toml"
       ];
+      extraPackages = with pkgs; [
+        cargo
+        direnv
+        nil
+        nix
+        python3
+        rustc
+      ];
+      installRemoteServer = true;
+      userKeymaps = [
+        {
+          context = "Editor && (showing_completions || showing_code_actions)";
+          bindings = {
+            enter = "editor::Newline";
+            escape = "editor::Cancel";
+          };
+        }
+      ];
+      userSettings = {
+        agent = {
+          default_model = {
+            provider = "copilot_chat";
+            model = "claude-4";
+          };
+          single_file_review = true;
+          version = "2";
+        };
+        baseKeymap = "VSCode";
+        buffer_font_size = 16;
+        edit_predictions = {
+          copilot = {
+            proxy = null;
+            proxy_no_verify = null;
+          };
+          enable_in_text_threads = false;
+          mode = "subtle";
+        };
+        features = {
+          copilot = true;
+        };
+        relative_line_numbers = true;
+        telemetry = {
+          metrics = true;
+        };
+        theme = {
+          mode = "system";
+          light = "Gruvbox Dark";
+          dark = "One Dark";
+        };
+        vim = {
+          toggle_relative_line_numbers = true;
+        };
+        vim_mode = true;
+        ui_font_size = 20;
+      };
+    };
   };
 }

modules/nix-conf.nix

@@ -41,8 +41,7 @@ in
         ]; # For home and for work machines
         substituters =
           (lib.optionals cfg.cache [
-            "http://nas.thehellings.lan:9000/binary-cache/"
+            "http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
-            "http://nas.home:9000/binary-cache/"
           ])
           ++ [
             "https://ai.cachix.org"
@@ -50,15 +49,16 @@ in
             "https://greg-hellings.cachix.org"
             "https://nix-community.cachix.org"
             "https://cache.nixos.org"
+            "https://nixhelm.cachix.org"
           ];
         trusted-public-keys = [
-          "nix.thehellings.lan:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
+          "chronicles.shire-zebra.ts.net:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
-          "nix.home:0qWYHn3gGllXChhAaaxKlNZtRy6yG/XJs1RFSqV3nW8="
           "ai.cachix.org-1:N9dzRK+alWwoKXQlnn0H6aUx0lU/mspIoz8hMvGvbbc="
           "nixpkgs-python.cachix.org-1:hxjI7pFxTyuTHn2NkvWCrAUcNZLNS3ZAvfYNuYifcEU="
           "greg-hellings.cachix.org-1:y01Jl/L5evlhxdnUW6n56AiI1k8g1wxWhTxJCe7XSco="
           "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
           "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+          "nixhelm.cachix.org-1:esqauAsR4opRF0UsGrA6H3gD21OrzMnBBYvJXeddjtY="
         ];
       };
     };

modules/nixos/default.nix

@@ -8,6 +8,7 @@
     ./ceph.nix
     ./container.nix
     ./db.nix
+    ./gitlab-runner.nix
     ./gnome.nix
     ./home.nix
     ./kde.nix
@@ -20,7 +21,6 @@
     ./remote-builder.nix
     ./router.nix
     ./rpi4.nix
-    ./sway.nix
     ./syncthing.nix
     ./tailscale.nix
     ./vmdev.nix

modules/nixos/gitlab-runner.nix

@@ -0,0 +1,97 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.greg.runner;
+  environmentVariables = {
+    EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+    STORAGE_URL = "s3.thehellings.lan:9000";
+  };
+in
+{
+  options.greg.runner = {
+    enable = lib.mkEnableOption "Enable as a gitlab-runner with both libvirt and virtualbox";
+
+    threads = lib.mkOption {
+      default = 5;
+      type = lib.types.int;
+      description = "The maximum number of concurrent jobs";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Shared configurations
+    age.secrets = {
+      qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
+      vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
+    };
+
+    # Defaults to running libvirt support
+    services.gitlab-runner = {
+      enable = true;
+      settings.concurrent = cfg.threads;
+      services.qemu = {
+        inherit environmentVariables;
+        executor = "shell";
+        limit = cfg.threads;
+        authenticationTokenConfigFile = config.age.secrets.qemu.path;
+      };
+    };
+
+    systemd.services.gitlab-runner = {
+      serviceConfig = {
+        DevicePolicy = lib.mkForce "auto";
+        User = "root";
+        DynamicUser = lib.mkForce false;
+      };
+    };
+
+    virtualisation = {
+      libvirtd = {
+        enable = lib.mkDefault true;
+        allowedBridges = [
+          "br0"
+          "virbr0"
+        ];
+        onBoot = "ignore"; # only restart VMs labeled 'autostart'
+        qemu.ovmf.enable = true;
+      };
+    };
+    # Boot into this specialisation if you want to build vbox hosts
+    # with this box at that time
+    specialisation = {
+      vbox.configuration = {
+        users.extraGroups.vboxusers.members = [ "greg" ];
+
+        virtualisation = {
+          libvirtd.enable = false;
+          virtualbox.host = {
+            enable = true;
+            enableExtensionPack = true;
+          };
+        };
+
+        services.gitlab-runner.services = lib.mkForce {
+          vbox = {
+            inherit environmentVariables;
+            authenticationTokenConfigFile = config.age.secrets.vbox.path;
+            executor = "shell";
+            limit = 5;
+          };
+        };
+
+        systemd.services.gitlab-runner = {
+          serviceConfig = {
+            DevicePolicy = lib.mkForce "auto";
+            User = "root";
+            DynamicUser = lib.mkForce false;
+          };
+        };
+      };
+    };
+
+  };
+}

modules/nixos/gnome.nix

@@ -23,10 +23,10 @@ with lib;
       # Trackpad support
       libinput.enable = true;
 
-      xserver = {
-        enable = true;
       displayManager.gdm.enable = true;
       desktopManager.gnome.enable = true;
+
+      xserver = {
         xkb.layout = "us";
       };
 

modules/nixos/kde.nix

@@ -24,12 +24,6 @@ with lib;
     systemd.services.bluetooth.requiredBy = [ "multi-user.target" ];
     services =
       {
-        xserver = {
-          enable = true;
-          xkb.layout = "us";
-          # Trackpad support
-        };
-
         libinput.enable = true;
         blueman.enable = true;
 
@@ -49,7 +43,7 @@ with lib;
       });
 
     programs.dconf.enable = true;
-    programs.sway.enable = true; # Gives us Wayland
+
     xdg.portal = {
       enable = true;
       wlr.enable = true; # Enables screen sharing in Wayland