chore: update flake.lock 2026-05-10

This reverts commit 6d1490bd28.

.gitea/workflows/update-flake-lock.yaml

@@ -1,13 +1,13 @@
 name: Update flake.lock
 
-on:
+"on":
   schedule:
     - cron: "0 0 * * 0"  # Every Sunday at midnight UTC
   workflow_dispatch:
 
 jobs:
   update-flake-lock:
-    runs-on: [self-hosted, nix]
+    runs-on: nix-latest
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.gitea/workflows/update-manifests.yaml

@@ -7,7 +7,7 @@ on:
 
 jobs:
   update-manifests:
-    runs-on: [self-hosted, nix]
+    runs-on: [bare-metal, nix-latest]
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.gitlab-ci.yml

@@ -1,23 +0,0 @@
-stages:
-  - eval
-  - build
-  - push
-
-"Evaluate for builds":
-  stage: eval
-  tags:
-    - kubernetes
-  image: "$CI_REGISTRY/greg/ci-images/builder:latest"
-  artifacts:
-    paths:
-      - gitlab-ci-continue.yml
-  script: nix run ".#gen-build" > gitlab-ci-continue.yml
-
-"Trigger builds":
-  stage: build
-  trigger:
-    include:
-      - artifact: gitlab-ci-continue.yml
-        job: "Evaluate for builds"
-  variables:
-    PARENT_PIPELINE_ID: $CI_PIPELINE_ID

.pre-commit-config.yaml

@@ -17,7 +17,7 @@ repos:
       - id: mixed-line-ending
       - id: trailing-whitespace
   - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.37.1
+    rev: v1.38.0
     hooks:
       - id: yamllint
         args:
@@ -30,8 +30,9 @@ repos:
               comments: false
               comments-indentation: false
               document-start: false
+              line-length: false
   - repo: https://github.com/NixOS/nixfmt
-    rev: v1.1.0
+    rev: v1.2.0
     hooks:
       - id: nixfmt-nix
   - repo: https://github.com/astro/deadnix

darwin/baseline.nix

@@ -1,28 +1,38 @@
 {
-  lib,
   pkgs,
   top,
   ...
 }:
 let
-  builder-config = {
+  system = builtins.replaceStrings [ "darwin" ] [ "linux" ] pkgs.stdenv.hostPlatform.system;
-    darwin-aarch-builder = top.self.nixosConfigurations.builder-aarch;
+  builderConfig = top.nixunstable.lib.nixosSystem {
-    darwin-x86-builder = top.self.nixosConfigurations.builder-x86;
+    inherit system;
+    modules = [
+      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
+      {
+        virtualisation = {
+          host.pkgs = pkgs;
+          darwin-builder = {
+            workingDirectory = "/var/lib/darwin-builder";
+            hostPort = 22;
           };
-  builder = arch: let
+        };
-    b = builder-config."darwin-${arch}-builder";
+      }
-  in {
+    ];
-    command = "${b.config.system.build.macos-builder-installer}/bin/create-builder";
+  };
+  builder = {
+    command = "${builderConfig.config.system.build.macos-builder-installer}/bin/create-builder";
     serviceConfig = {
       KeepAlive = true;
       RunAtLoad = true;
-      StandardOutPath = "/var/log/builder-vm-${arch}.log";
+      StandardOutPath = "/var/log/builder-vm-${system}.log";
-      StandardErrorPath = "/var/log/builder-vm-${arch}.stderr.log";
+      StandardErrorPath = "/var/log/builder-vm-${system}.stderr.log";
     };
   };
 in
 {
   environment.systemPackages = with pkgs; [
+    agenix
     hms
   ];
 
@@ -31,23 +41,12 @@ in
     nerd-fonts.hack
   ];
 
-  launchd.daemons = lib.genAttrs' [ "x86" "aarch" ] (arch: lib.nameValuePair "builder-${arch}-machine" (builder arch));
+  launchd.daemons.darwin-builder = builder;
 
   nix = {
     enable = true;
-    buildMachines = [
-      {
-        hostName = "ssh-ng://builder@localhost";
-        system = "aarch64-linux";
-        maxJobs = 4;
-        supportedFeatures = [
-          "kvm"
-          "benchmarch"
-          "big-parallel"
-        ];
-      }
-    ];
     gc.interval.Hour = 3;
+    linux-builder.enable = true;
     settings.auto-optimise-store = false; # Darwin bugs?
   };
 

darwin/default.nix

@@ -37,7 +37,4 @@ let
       ++ lib.optionals (builtins.pathExists ./hosts/${name}) [ ./hosts/${name} ];
     };
 in
-{
+(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) (name: mac { inherit name; }))
-  "MacBook-Pro" = mac { name = "ivr"; };
-  "MacBook-Prolocal" = mac { name = "ivr"; };
-}

darwin/hosts/MacBook-Prolocal

@@ -0,0 +1 @@
+gregory

darwin/hosts/gregory.hellings-mbp

@@ -0,0 +1 @@
+gregory

darwin/hosts/gregory/default.nix

@@ -31,6 +31,7 @@ in
       "bitwarden"
       "bruno"
       "chromium"
+      "claude"
       "dbeaver-community"
       "ghostty"
       "firefox"

darwin/hosts/ivr

@@ -0,0 +1 @@
+gregory/

darwin/hosts/li

@@ -0,0 +1 @@
+lithic/

darwin/hosts/lithic/default.nix

@@ -0,0 +1,53 @@
+{ ... }:
+let
+  username = "greg";
+in
+{
+  greg = {
+    nix.cache = false;
+  };
+
+  homebrew = {
+    enable = true;
+    brews = [
+      "bitwarden-cli"
+      "direnv"
+      "github-mcp-server"
+      {
+        name = "libvirt";
+        restart_service = true;
+      }
+      "mcp-atlassian"
+      "notion-mcp-server"
+      "nushell"
+      "qemu"
+      "slack-mcp-server"
+      "zlib"
+    ];
+    casks = [
+      "alt-tab"
+      "audacity"
+      "bitwarden"
+      "bruno"
+      "chromium"
+      "claude-code"
+      "dbeaver-community"
+      "ghostty"
+      "firefox"
+      "notion"
+      "notunes"
+      "onlyoffice"
+      "podman-desktop"
+      "tabby"
+      "zed"
+    ];
+    user = username;
+  };
+
+  system.primaryUser = username;
+
+  users.users."${username}" = {
+    name = username;
+    home = "/Users/${username}";
+  };
+}

flake.lock

@@ -25,19 +25,17 @@
     },
     "buildbot": {
       "inputs": {
-        "flake-parts": "flake-parts",
-        "hercules-ci-effects": "hercules-ci-effects",
         "nixpkgs": [
           "nixunstable"
         ],
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1772467670,
+        "lastModified": 1778391342,
-        "narHash": "sha256-DF/1VCg7Qmw5iaFhBeKBysOSTDCxZlKJHdbJc7Q2e1k=",
+        "narHash": "sha256-7FVIfUHdQEB6HM+gUPLJVaL7ABrqlnMxS/pO+vNvjd8=",
         "owner": "nix-community",
         "repo": "buildbot-nix",
-        "rev": "f927795b97474875738ac134525af560b2d4a8a5",
+        "rev": "0bedd1aafd1653858d5f1e0f08eba3d7ec397dff",
         "type": "github"
       },
       "original": {
@@ -46,36 +44,12 @@
         "type": "github"
       }
     },
-    "charts": {
-      "inputs": {
-        "flake-utils": "flake-utils",
-        "haumea": "haumea",
-        "nix-kube-generators": "nix-kube-generators",
-        "nixpkgs": "nixpkgs",
-        "pyproject-build-systems": "pyproject-build-systems",
-        "pyproject-nix": "pyproject-nix",
-        "uv2nix": "uv2nix"
-      },
-      "locked": {
-        "lastModified": 1772676442,
-        "narHash": "sha256-bPxUBXS2mdT4BjMAmTap5TkXnUX807qo4Uho2oVb2Fg=",
-        "owner": "nix-community",
-        "repo": "nixhelm",
-        "rev": "19cdbb3a03554059165a25a18b32bd253e62c883",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixhelm",
-        "type": "github"
-      }
-    },
     "colmena": {
       "inputs": {
         "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nix-github-actions": "nix-github-actions",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
         "stable": "stable"
       },
       "locked": {
@@ -121,11 +95,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772379624,
+        "lastModified": 1777780666,
-        "narHash": "sha256-NG9LLTWlz4YiaTAiRGChbrzbVxBfX+Auq4Ab/SWmk4A=",
+        "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "52d061516108769656a8bd9c6e811c677ec5b462",
+        "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777",
         "type": "github"
       },
       "original": {
@@ -152,6 +126,22 @@
       }
     },
     "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1747046372,
+        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
       "flake": false,
       "locked": {
         "lastModified": 1767039857,
@@ -169,17 +159,14 @@
     },
     "flake-parts": {
       "inputs": {
-        "nixpkgs-lib": [
+        "nixpkgs-lib": "nixpkgs-lib"
-          "buildbot",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1769996383,
+        "lastModified": 1777988971,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
         "type": "github"
       },
       "original": {
@@ -190,14 +177,17 @@
     },
     "flake-parts_2": {
       "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
+        "nixpkgs-lib": [
+          "nixvimunstable",
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1772408722,
+        "lastModified": 1777932387,
-        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
+        "narHash": "sha256-nUYVPiqrzr36ThiQOAr5MKeGHDBSDM3OFWkz0uDjOvc=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
+        "rev": "71a3a77326609675e9f8b51084cf23d5d1945899",
         "type": "github"
       },
       "original": {
@@ -207,27 +197,6 @@
       }
     },
     "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixvimunstable",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769996383,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_4": {
       "inputs": {
         "nixpkgs-lib": [
           "nurpkgs",
@@ -249,24 +218,6 @@
       }
     },
     "flake-utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1731533236,
-        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_2": {
       "locked": {
         "lastModified": 1659877975,
         "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
@@ -281,53 +232,6 @@
         "type": "github"
       }
     },
-    "haumea": {
-      "inputs": {
-        "nixpkgs": [
-          "charts",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1685133229,
-        "narHash": "sha256-FePm/Gi9PBSNwiDFq3N+DWdfxFq0UKsVVTJS3cQPn94=",
-        "owner": "nix-community",
-        "repo": "haumea",
-        "rev": "34dd58385092a23018748b50f9b23de6266dffc2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "v0.2.2",
-        "repo": "haumea",
-        "type": "github"
-      }
-    },
-    "hercules-ci-effects": {
-      "inputs": {
-        "flake-parts": [
-          "buildbot",
-          "flake-parts"
-        ],
-        "nixpkgs": [
-          "buildbot",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1771131391,
-        "narHash": "sha256-HPBNYf7HiKtBVy7/69vKpLYHX6wTcUxndxmybzDlXP8=",
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "rev": "0b152e0f7c5cc265a529cd63374b80e2771b207b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "type": "github"
-      }
-    },
     "hmunstable": {
       "inputs": {
         "nixpkgs": [
@@ -335,11 +239,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1772633327,
+        "lastModified": 1778365864,
-        "narHash": "sha256-jl+DJB2DUx7EbWLRng+6HNWW/1/VQOnf0NsQB4PlA7I=",
+        "narHash": "sha256-ImoT/wqmgMImf2dAC+E0MverAdA4QXsedOeES9B7Ezw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5a75730e6f21ee624cbf86f4915c6e7489c74acc",
+        "rev": "2f419037039a152448c5f4ae9494154753d1b399",
         "type": "github"
       },
       "original": {
@@ -370,6 +274,26 @@
         "type": "github"
       }
     },
+    "minecraft": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": "nixpkgs_2",
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1778039471,
+        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Infinidoge",
+        "repo": "nix-minecraft",
+        "type": "github"
+      }
+    },
     "nix-github-actions": {
       "inputs": {
         "nixpkgs": [
@@ -393,11 +317,11 @@
     },
     "nix-hardware": {
       "locked": {
-        "lastModified": 1771969195,
+        "lastModified": 1778143761,
-        "narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
+        "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
+        "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
         "type": "github"
       },
       "original": {
@@ -406,53 +330,7 @@
         "type": "github"
       }
     },
-    "nix-kube-generators": {
-      "locked": {
-        "lastModified": 1762437901,
-        "narHash": "sha256-5yuJODagAq+aMXQAT2c0gfXKLqapmA6eUHR33jKNHuU=",
-        "owner": "farcaller",
-        "repo": "nix-kube-generators",
-        "rev": "810dcf792081790648ba9ae705b9a2286115ace8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "farcaller",
-        "repo": "nix-kube-generators",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
-      "locked": {
-        "lastModified": 1767767207,
-        "narHash": "sha256-Mj3d3PfwltLmukFal5i3fFt27L6NiKXdBezC1EBuZs4=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "5912c1772a44e31bf1c63c0390b90501e5026886",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-lib": {
-      "locked": {
-        "lastModified": 1772328832,
-        "narHash": "sha256-e+/T/pmEkLP6BHhYjx6GmwP5ivonQQn0bJdH9YrRB+Q=",
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "rev": "c185c7a5e5dd8f9add5b2f8ebeff00888b070742",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "nixpkgs.lib",
-        "type": "github"
-      }
-    },
-    "nixpkgs_2": {
       "locked": {
         "lastModified": 1750134718,
         "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
@@ -468,13 +346,44 @@
         "type": "github"
       }
     },
-    "nixpkgs_3": {
+    "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1772624091,
+        "lastModified": 1777168982,
-        "narHash": "sha256-QKyJ0QGWBn6r0invrMAK8dmJoBYWoOWy7lN+UHzW1jc=",
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1769461804,
+        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "80bdc1e5ce51f56b19791b52b2901187931f5353",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1777954456,
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
         "type": "github"
       },
       "original": {
@@ -486,27 +395,27 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1766025857,
+        "lastModified": 1777207419,
-        "narHash": "sha256-Lav5jJazCW4mdg1iHcROpuXqmM94BWJvabLFWaJVJp0=",
+        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
         "type": "github"
       }
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1772963539,
+        "lastModified": 1777954456,
-        "narHash": "sha256-9jVDGZnvCckTGdYT53d/EfznygLskyLQXYwJLKMPsZs=",
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9dcb002ca1690658be4a04645215baea8b95f31d",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
         "type": "github"
       },
       "original": {
@@ -518,18 +427,18 @@
     },
     "nixvimunstable": {
       "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_2",
         "nixpkgs": [
           "nixunstable"
         ],
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1772402258,
+        "lastModified": 1777991353,
-        "narHash": "sha256-3DmCFOdmbkFML1/G9gj8Wb+rCCZFPOQtNoMCpqOF8SA=",
+        "narHash": "sha256-DFwjggMV+nzCZpwK6Obxj9F+P59rbLVowGqHETfctBk=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "21ae25e13b01d3b4cdc750b5f9e7bad68b150c10",
+        "rev": "7986a276960b4dfaed9bb2c3c438b5ba71ae08f1",
         "type": "github"
       },
       "original": {
@@ -541,15 +450,15 @@
     },
     "nurpkgs": {
       "inputs": {
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_3",
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1772717146,
+        "lastModified": 1778395809,
-        "narHash": "sha256-x2nJlzpiHWHLkGDBvaiO1ysLhaxjQCLsG3XieRueJ/c=",
+        "narHash": "sha256-Jl3fg2TTQpFEFR4Xg9wdrNEohWIZI2jrLPO84ctFfPc=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "2e1bffbdde931c4300a59418d0150c7457022f2d",
+        "rev": "4d723c32ac8ccbf63f6f201c95195fae1ac1d11c",
         "type": "github"
       },
       "original": {
@@ -558,65 +467,15 @@
         "type": "github"
       }
     },
-    "pyproject-build-systems": {
-      "inputs": {
-        "nixpkgs": [
-          "charts",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "charts",
-          "pyproject-nix"
-        ],
-        "uv2nix": [
-          "charts",
-          "uv2nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1763662255,
-        "narHash": "sha256-4bocaOyLa3AfiS8KrWjZQYu+IAta05u3gYZzZ6zXbT0=",
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "rev": "042904167604c681a090c07eb6967b4dd4dae88c",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "build-system-pkgs",
-        "type": "github"
-      }
-    },
-    "pyproject-nix": {
-      "inputs": {
-        "nixpkgs": [
-          "charts",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1764134915,
-        "narHash": "sha256-xaKvtPx6YAnA3HQVp5LwyYG1MaN4LLehpQI8xEdBvBY=",
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "rev": "2c8df1383b32e5443c921f61224b198a2282a657",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "pyproject.nix",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "agenix": "agenix",
         "buildbot": "buildbot",
-        "charts": "charts",
         "colmena": "colmena",
         "darwin": "darwin_2",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts",
         "hmunstable": "hmunstable",
+        "minecraft": "minecraft",
         "nix-hardware": "nix-hardware",
         "nixunstable": "nixunstable",
         "nixvimunstable": "nixvimunstable",
@@ -694,11 +553,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770228511,
+        "lastModified": 1775636079,
-        "narHash": "sha256-wQ6NJSuFqAEmIg2VMnLdCnUc0b7vslUohqqGGD+Fyxk=",
+        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "337a4fe074be1042a35086f15481d763b8ddc0e7",
+        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
         "type": "github"
       },
       "original": {
@@ -707,41 +566,16 @@
         "type": "github"
       }
     },
-    "uv2nix": {
-      "inputs": {
-        "nixpkgs": [
-          "charts",
-          "nixpkgs"
-        ],
-        "pyproject-nix": [
-          "charts",
-          "pyproject-nix"
-        ]
-      },
-      "locked": {
-        "lastModified": 1767701098,
-        "narHash": "sha256-CJhKZnWb3gumR9oTRjFvCg/6lYTGbZRU7xtvcyWIRwU=",
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "rev": "9d357f0d2ce6f5f35ec7959d7e704452352eb4da",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pyproject-nix",
-        "repo": "uv2nix",
-        "type": "github"
-      }
-    },
     "vsext": {
       "inputs": {
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1772678592,
+        "lastModified": 1778384975,
-        "narHash": "sha256-1VZ1hg1YHW+WyBXIOfrQ9Oq+qLL0w93lkdKAiRRHEuI=",
+        "narHash": "sha256-+27MJizhdJGXTl3jzNKnGU3C+fJJBcTsBQb6PtS5vBE=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "5521856f37c3d2654fe9b20b03331a6594f855c6",
+        "rev": "5d9f84ecc813690afdd4b35c896904fc02ab6cac",
         "type": "github"
       },
       "original": {
@@ -752,17 +586,17 @@
     },
     "wsl": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
         "nixpkgs": [
           "nixunstable"
         ]
       },
       "locked": {
-        "lastModified": 1772386632,
+        "lastModified": 1777732699,
-        "narHash": "sha256-sm6OpWZuoDwR53KNlsY482YOoHFWlWYwt0wHmqLkRGE=",
+        "narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "be894604b2aa2184c0b3d3b44995acd0da14dc0c",
+        "rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
         "type": "github"
       },
       "original": {

flake.nix

@@ -13,9 +13,6 @@
       url = "github:nix-community/buildbot-nix";
       inputs.nixpkgs.follows = "nixunstable";
     };
-    charts = {
-      url = "github:nix-community/nixhelm";
-    };
     colmena.url = "github:zhaofengli/colmena";
     darwin = {
       url = "github:lnl7/nix-darwin/master";
@@ -26,6 +23,7 @@
       url = "github:nix-community/home-manager/master";
       inputs.nixpkgs.follows = "nixunstable";
     };
+    minecraft.url = "github:Infinidoge/nix-minecraft";
     nix-hardware.url = "github:nixos/nixos-hardware";
     nixvimunstable = {
       url = "github:nix-community/nixvim/main";
@@ -50,6 +48,7 @@
         top.nixvimunstable.overlays.default
         top.nurpkgs.overlays.default
         top.vsext.overlays.default
+        top.minecraft.overlay
       ];
       metadata = builtins.fromJSON (builtins.readFile ./network.json);
       systems = [
@@ -68,6 +67,7 @@
           };
         }
       );
+      lib' = import ./lib { inherit (top.nixunstable) lib; };
     in
     top.flake-parts.lib.mkFlake { inputs = top; } {
       inherit systems;
@@ -79,6 +79,7 @@
               nixpkgs = imported_packages.x86_64-linux;
               specialArgs = {
                 inherit
+                  lib'
                   metadata
                   self
                   top
@@ -115,7 +116,7 @@
 
         nixosConfigurations = (
           import ./hosts {
-            inherit top metadata;
+            inherit top metadata lib';
             nixpkgs = imported_packages;
           }
         );

garnix.yaml

@@ -1,5 +1,6 @@
 builds:
-  exclude:
+  # Exclude most things, as I locally build x86_64-linux and aarch64-linux
+  - exclude:
       - "homeConfigurations.*"
       - "nixosConfigurations.*"
       - "packages.*"
@@ -16,8 +17,14 @@ builds:
       - "devShells.*"
     include:
       - "packages.aarch64-darwin.*"
-    - homeConfigurations.exodus
       - darwinConfigurations.MacBook-Pro
       - darwinConfigurations.MacBook-Prolocal
-    - nixosConfigurations.builder-x86
+      - darwinConfigurations.li
-    - nixosConfigurations.builder-aarch
+  # Some specific includes which are not specific enough to override the rules
+  # above, due to the intrepretation of the glob excludes, but which I still
+  # need included
+  - include:
+      # These are Mac homeConfigurations, which I do not have the infra
+      # to build at home
+      - homeConfigurations."gregory.hellings-mbp"
+      - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024

home/baseline/nushell/functions.nu

@@ -1,5 +1,5 @@
 # vim: set filetype=nushell :
-let servers = [isaiah jeremiah zeke genesis vm-gitlab]
+let servers = [isaiah jeremiah zeke genesis]
 
 def par-map [ items: list, c: closure ] {
   let results = $items | par-each -k $c
@@ -69,6 +69,14 @@ def dc [ $cmd: string = "sh" ] {
     }
 }
 
+def claude [ ] {
+    unlock
+    $env.GITLAB_TOKEN = ^bw get item 7d3da4e9-5f9a-49d0-8e14-b39c010a4001 | from json | get fields | find claudeapi | get value
+    #$env.ANTHROPIC_API_KEY = ^bw get item e122fd08-3506-4f21-9c6a-b42b00fe5be1 | from json | get login.password
+    ^claude
+}
+
 if ("/usr/local/bin" | path exists) {
     $env.PATH = $env.PATH | append "/usr/local/bin"
 }
+$env.PATH = $env.PATH | prepend "~/.local/bin"

home/baseline/shell.nix

@@ -26,6 +26,7 @@
       nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
       r = "run0";
       updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
+      p = "${lib.getExe pkgs.podman-tui}";
 
       # General
       k = "kubectl";

home/baseline/ssh.nix

@@ -5,7 +5,7 @@
   # This allows things like SSH in distrobox to read the config file just fine
   home.file.".ssh/config" = {
     target = ".ssh/config_source";
-    onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
+    onChange = "cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config";
   };
   programs.ssh = {
     enable = true;

home/baseline/tools.nix

@@ -12,7 +12,7 @@
       dig
       jqp
       kubernetes-helm
-      iamb
+      #iamb
       lazyssh
       rainfrog
       tenere

home/baseline/xonsh_footer.xsh

@@ -38,11 +38,6 @@ def _ivr2(args):
     vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology")
 aliases['ivr2'] = _ivr2
 
-def _glrestart(args):
-    sudo nixos-container run gitlab -- systemctl restart gitlab
-    sudo nixos-container run gitlab -- systemctl restart nginx
-aliases['glrestart'] = _glrestart
-
 def _aws_creds(args):
     $AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key")
     $AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key")

home/default.nix

@@ -4,11 +4,14 @@
   top,
 }:
 let
+  inherit (top.nixunstable) lib;
   user =
-    host: username:
+    host:
     let
       inherit (metadata.hosts.${host}) system;
       pkgs = nixpkgs.${system};
+      username =
+        if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
     in
     top.hmunstable.lib.homeManagerConfiguration {
       inherit pkgs;
@@ -28,19 +31,5 @@ let
         gnome = false;
       };
     };
-  greg = host: (user host "greg");
 in
-{
+(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) user)
-  "MacBook-Pro.local" = user "ivr" "gregory.hellings";
-  "MacBook-Prolocal.local" = user "ivr" "gregory.hellings";
-  "MacBook-Pro.thehellings.lan" = user "ivr" "gregory.hellings";
-  "gregory.hellings-mbp" = user "ivr" "gregory.hellings";
-  genesis = greg "genesis";
-  exodus = greg "exodus";
-  zeke = greg "zeke";
-  isaiah = greg "isaiah";
-  jeremiah = greg "jeremiah";
-  linode = greg "linode";
-  hosea = greg "hosea";
-  gitlab = greg "gitlab";
-}

home/home.nix

@@ -19,9 +19,14 @@ in
   imports = [
     top.nixvimunstable.homeModules.nixvim
     top.self.modules.homeManagerModule
+    top.agenix.homeManagerModules.default
     ./baseline
   ]
-  ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
+  ++ lib.optionals (builtins.pathExists ./hosts/${host}/default.nix) [ ./hosts/${host} ];
+
+  age = {
+    identityPaths = [ "${homeDirectory}/.ssh/id_ed25519" ];
+  };
 
   home = {
     inherit homeDirectory username;

home/hosts/exodus/default.nix

@@ -21,11 +21,19 @@
     kubectl
     kubectl-cnpg
     mattermost-desktop
+    minio-client
     mumble
     pre-commit
+    prismlauncher
     restic
     restic-browser
     tea
     wineWow64Packages.stable
   ];
+  programs = {
+    discord = {
+      enable = true;
+      settings.SKIP_HOST_UPDATE = true;
+    };
+  };
 }

home/hosts/gregory.hellings-mbp/default.nix

@@ -1,21 +1,9 @@
 {
   pkgs,
   lib,
+  username,
   ...
 }:
-let
-  username = "gregory.hellings";
-  x = pkgs.xonsh.override {
-    extraPackages = (
-      ps: [
-        pkgs.nur.repos.xonsh-xontribs.xonsh-direnv
-        pkgs.nur.repos.xonsh-xontribs.xontrib-vox
-        ps.xonsh-apipenv
-        pkgs.pipenv-ivr
-      ]
-    );
-  };
-in
 {
   # Disables hitting local cache
   _module.args.cache = lib.mkForce false;
@@ -28,28 +16,21 @@ in
 
   home = {
     packages = with pkgs; [
-      aacs
       ansible
+      claude-code
       direnv
       home-manager
       python3Packages.ipython
       just
+      glab
       go
       gopls
-      k9s
-      kubectl
       mariadb
-      minikube
-      mise
-      nil
       nixVersions.stable
-      pipenv-ivr
       pre-commit
       python311
       python3Packages.flake8
-      skaffold
       twine
-      x
     ];
     file = {
       ".pip/pip.conf".text = ''
@@ -60,9 +41,11 @@ in
             https://pypidev.ivrtechnology.com/simple/
       '';
       ".config/uv/uv.toml".text = ''
+        index-strategy = "unsafe-first-match"
         [[index]]
         url = "https://pypidev.ivrtechnology.com/simple/"
         name = "pypidev"
+        ignore-error-codes = [403]
       '';
     };
     username = username;
@@ -108,6 +91,5 @@ in
           "web4"
         ]
     );
-    tmux.shell = (lib.getExe x);
   };
 }

home/hosts/gregs-MacBook-Pro-16-inch-Nov-2024

@@ -0,0 +1 @@
+lithic/

home/hosts/ivr

@@ -0,0 +1 @@
+gregory.hellings-mbp/

home/hosts/lithic/default.nix

@@ -0,0 +1,73 @@
+{
+  pkgs,
+  lib,
+  ...
+}:
+let
+  python = pkgs.python312.withPackages (
+    p: with p; [
+      ipython
+    ]
+  );
+in
+{
+  # Disables hitting local cache
+  _module.args.cache = lib.mkForce false;
+
+  greg = {
+    development = true;
+    gui = true;
+    nix.cache = false;
+    zed = true;
+  };
+
+  home = {
+    packages = with pkgs; [
+      ansible
+      awscli2
+      cargo
+      direnv
+      home-manager
+      just
+      mcp-grafana
+      nixVersions.stable
+      podman
+      poetry
+      pre-commit
+      (pulumi.withPackages (
+        p: with p; [
+          pulumi-aws-native
+          pulumi-command
+          pulumi-go
+          pulumi-nodejs
+          pulumi-python
+        ]
+      ))
+      python
+      rustc
+      terraform
+    ];
+  };
+
+  programs = {
+    direnv = {
+      enable = true;
+      enableNushellIntegration = true;
+    };
+    nushell = {
+      enable = true;
+    };
+    starship = {
+      enable = true;
+      enableNushellIntegration = true;
+      settings = {
+        directory = {
+          home_symbol = "~";
+          truncate_to_repo = false;
+          truncation_length = 0;
+          use_os_path_sep = true;
+        };
+      };
+    };
+  };
+}

home/hosts/work/default.nix

@@ -1,7 +0,0 @@
-{ pkgs, ... }:
-
-{
-  greg.vscodium.enable = false;
-
-  home.packages = with pkgs; [ brew ];
-}

hosts/baseline.nix

@@ -53,9 +53,25 @@
 
   # Network Manager pulls in too many deps
   networking = {
+    extraHosts =
+      let
+        onNetwork =
+          attr: _k: v:
+          (builtins.hasAttr attr v) && v.${attr} != null;
+        getIPs =
+          attr: domain:
+          (lib.mapAttrsToList (host: v: "${builtins.getAttr attr v} ${host}.${domain}") (
+            lib.filterAttrs (onNetwork attr) metadata.hosts
+          ));
+      in
+      builtins.concatStringsSep "\n" (
+        (getIPs "ts" "shire-zebra.ts.net")
+        ++ (getIPs "nebulaIp" "nebula.thehellings.com")
+        ++ (getIPs "nebulaIp" "nebula")
+        ++ (getIPs "ip" "thehellings.lan")
+      );
     search = [
-      "thehellings.lan"
+      "nebula.thehellings.com"
-      "home"
     ];
     networkmanager.enable = false;
   };
@@ -114,7 +130,10 @@
     };
   };
 
-  security.sudo.extraRules = [
+  security = {
+    sudo-rs = {
+      enable = true;
+      extraRules = [
         {
           users = [ "greg" ];
           commands = [
@@ -125,6 +144,9 @@
           ];
         }
       ];
+    };
+    sudo.enable = false;
+  };
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
   users.users.greg = {

hosts/default.nix

@@ -1,5 +1,6 @@
 {
   top,
+  lib',
   metadata,
   nixpkgs,
 }:
@@ -18,7 +19,7 @@ let
     channel.lib.nixosSystem {
       pkgs = nixpkgs.${system};
       specialArgs = {
-        inherit metadata top;
+        inherit metadata top lib';
       };
       modules = [
         {
@@ -44,16 +45,6 @@ in
     })
   )
 )
-// (lib.genAttrs
-  (builtins.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./vm)))
-  (
-    name:
-    (unstable {
-      inherit name;
-      extraMods = [ ./vm/${name} ];
-    })
-  )
-)
 // {
   # nix build '.#nixosConfigurations.wsl.config.system.build.installer'
   #nixos = wsl { name = "wsl"; };
@@ -62,26 +53,4 @@ in
   #  name = "wsl";
   #  system = "aarch64-linux";
   #};
-
-  builder-aarch = lib.nixosSystem {
-    system = "aarch64-linux";
-    modules = [
-      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
-      {
-        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
-        boot.loader.grub.devices = [ "/dev/vda" ];
-      }
-    ];
-  };
-
-  builder-x86 = lib.nixosSystem {
-    system = "x86_64-linux";
-    modules = [
-      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
-      {
-        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
-        boot.loader.grub.devices = [ "/dev/vda" ];
-      }
-    ];
-  };
 }

hosts/unstable/exodus/default.nix

@@ -18,7 +18,11 @@
 
   boot = {
     loader = {
-      systemd-boot.enable = true;
+      systemd-boot = {
+        enable = true;
+        memtest86.enable = true;
+        netbootxyz.enable = true;
+      };
       efi.canTouchEfiVariables = true;
     };
     binfmt.emulatedSystems = [
@@ -39,10 +43,6 @@
       enable = true;
       tags = [ "mobile" ];
     };
-    runner = {
-      enable = true;
-      qemu = true;
-    };
   };
 
   hardware = {

hosts/unstable/genesis/default.nix

@@ -2,48 +2,18 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 
-{ lib, pkgs, ... }:
+{ top, pkgs, ... }:
-
-let
-  adblockUpdate = pkgs.writeShellApplication {
-    name = "adblock-update";
-    runtimeInputs = with pkgs; [
-      curl
-      gnused
-      systemd
-    ];
-    text = ''
-      curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
-      curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
-
-      # Custom domains that I need to preserve for some reason
-      for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com" "click.discord.com"; do
-       	sed -i -e "/''${f}/d" /etc/adblock_hosts  # Blocks Trelly content for house investors
-      done
-
-      systemctl restart dnsmasq
-    '';
-  };
-in
 {
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
     ./networking.nix
+    top.minecraft.nixosModules.minecraft-servers
   ];
 
   greg = {
     home = true;
     gnome.enable = false;
-    nebula = {
-      enable = true;
-      # genesis IS the routing node for the home LAN — it does not route through itself.
-      # Override the module default (which points at genesis) to avoid a routing loop.
-      unsafeRoutes = [ ];
-      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
-      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
-      routesSubnet = "10.42.0.0/16";
-    };
     proxies = {
     };
   };
@@ -67,20 +37,109 @@ in
 
   networking.hostName = "genesis"; # Define your hostname.
 
-  systemd = {
+  services = {
-    services.adblock-update = {
+    minecraft-servers = {
-      after = [ "network-online.target" ];
+      enable = true;
-      requires = [ "network-online.target" ];
+      eula = true;
-      script = lib.getExe adblockUpdate;
+      openFirewall = true;
-      serviceConfig.Type = "oneshot";
+
+      servers = {
+        maya = {
+          enable = true;
+          operators = {
+            Almec = {
+              bypassesPlayerLimit = true;
+              uuid = "7884dc5a-ae21-43d5-9506-a934d59be19a";
+            };
+          };
+          package = pkgs.fabricServers.fabric.override { jre_headless = pkgs.openjdk25_headless; };
+
+          serverProperties = {
+            allow-flight = true;
+            motd = "Maya's Minecraft World";
+          };
+          whitelist = { };
+
+          jvmOpts = "-Xms4092M -Xmx4092M";
+
+          symlinks = {
+            mods = pkgs.linkFarmFromDrvs "mods" (
+              builtins.attrValues {
+                # Health info
+                appleskin = pkgs.fetchurl {
+                  url = "https://cdn.modrinth.com/data/EsAfCjCV/versions/HwaLJe3v/appleskin-fabric-mc26.1-3.0.9.jar";
+                  hash = "sha256-iNCycR/oxqFpbPGfIcfgfWOm7PzPiIu5AmBWb8asTb4=";
+                };
+                # Needed by survivalfly
+                balm = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7959/843/balm-fabric-26.1.2-26.1.2.4.jar";
+                  hash = "sha256-zDtDxkxOftpW0wUIap7l6abGCjXNczwrF2wLZDztyA0=";
+                };
+                # Adds more diverse biomes
+                # https://www.curseforge.com/minecraft/mc-mods/biomes-o-plenty
+                biomes = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7977/180/BiomesOPlenty-fabric-26.1.2-26.1.2.0.3.jar";
+                  hash = "sha256-0aPtsRep0ftbkKqbp69PgUnNJyOBLY9vcPsB1mhOy/M=";
+                };
+                # Automation engines
+                # https://www.curseforge.com/minecraft/mc-mods/create
+                #create = pkgs.fetchurl {
+                #  url = "https://mediafilez.forgecdn.net/files/7963/363/create-1.21.1-6.0.10.jar";
+                #  hash = "sha256-74f+Vwnxuh9bi7IKKSW1r7RmnheP1ti/EMFndZ7v43o=";
+                #};
+                fabric_api = pkgs.fetchurl {
+                  url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/tnmuHGZA/fabric-api-0.146.1%2B26.1.2.jar";
+                  hash = "sha256-8Jy/xmxRtw4z4GJ+38wwbXHVn4NGYp4w/mFvW9cmvKg=";
+                };
+                # Required by biomes-o-plenty
+                # https://www.curseforge.com/minecraft/mc-mods/glitchcore
+                glitchcore = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7975/608/GlitchCore-fabric-26.1.2-26.1.2.0.0.jar";
+                  hash = "sha256-IDz+TblWvgt4UxFg3L3DhFMEESoX7y5cTOvXhyccQm8=";
+                };
+                # Tooltips
+                # https://www.curseforge.com/minecraft/mc-mods/jade/
+                jade = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7886/518/Jade-mc26.1-Fabric-26.0.8.jar";
+                  hash = "sha256-Pc3R5eO4Jf+94mNMPtY/vvpbomp+S+qnAUAVbQk1r2Y=";
+                };
+                # Gives info on crafting recipes
+                # https://www.curseforge.com/minecraft/mc-mods/jei
+                jei = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7920/925/jei-26.1.2-fabric-29.5.0.26.jar";
+                  hash = "sha256-7nF7fXYPIg9the/mxi6pUYEmKtosZO6yL2b0Dgf8+fI=";
+                };
+                # Machines
+                # https://www.curseforge.com/minecraft/mc-mods/mekanism
+                #mekanism = pkgs.fetchurl {
+                #  url = "https://mediafilez.forgecdn.net/files/7904/58/Mekanism-1.21.1-10.7.19.85.jar";
+                #  hash = "sha256-AE28nzEG9NGSrqoe4RkN0W7JyoBZ7T0JO4ADT0xXT0M=";
+                #};
+                # Shows installed mods
+                modmenu = pkgs.fetchurl {
+                  url = "https://cdn.modrinth.com/data/mOgUt4GM/versions/jvjwXH6l/modmenu-18.0.0-alpha.8.jar";
+                  hash = "sha256-u0gtCOVAnNxyHcslo+y9l/jCGsFb+U/Y8soiUilhZDA=";
+                };
+                # Better storage engines
+                # https://www.curseforge.com/minecraft/mc-mods/refined-storage
+                refined-storage = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7961/605/refinedstorage-fabric-3.0.0-beta.5.jar";
+                  hash = "sha256-UiXNrGw/giCZAnCjFzFc9k4mrq6deTtL6Z00arSUFOU=";
+                };
+                survivalfly = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7870/312/survivalfly-1.3_fabric-mc26.1.1.jar";
+                  hash = "sha256-Kai4wSxckpXbs1yLp8wJ4BmmjNkdDbeqerqWGIz3+Zk=";
+                };
+                # Also needed by biomes
+                # https://www.curseforge.com/minecraft/mc-mods/terrablender-fabric
+                terrablender = pkgs.fetchurl {
+                  url = "https://mediafilez.forgecdn.net/files/7933/873/TerraBlender-fabric-26.1.2-26.1.2.0.1.jar";
+                  hash = "sha256-lUrkmMIod54Qj78H0rzT4EYoEeiBG7w6sVOJlRvsnQ4=";
+                };
+              }
+            );
+          };
         };
-    timers.adblock-update = {
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network-online.target" ];
-      requires = [ "network-online.target" ];
-      timerConfig = {
-        OnCalendar = "daily";
-        Unit = "adblock-update.service";
       };
     };
   };

hosts/unstable/genesis/net/hosts

@@ -22,8 +22,6 @@
 
 # VMs
 10.42.4.1 matrix matrix.thehellings.lan
-#10.42.4.2 vm-jellyfin vm-jellyfin.thehellings.lan
-10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan
 
 # VIP
 10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster
@@ -37,7 +35,6 @@
 100.88.91.27 dns.home
 100.70.99.91 exodus.home exodus.shire-zebra.ts.net
 100.96.198.104 genesis.home genesis.shire-zebra.ts.net smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
-100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net grafana.home
 100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes
 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes buildbot.home

hosts/unstable/genesis/networking.nix

@@ -1,7 +1,9 @@
 {
   config,
-  pkgs,
+  lib,
+  lib',
   metadata,
+  pkgs,
   ...
 }:
 let
@@ -9,7 +11,6 @@ let
   lanIP = metadata.hosts.${config.networking.hostName}.ip;
   iot = "enp2s0";
   iotIP = "192.168.66.250";
-  #routerIP = metadata.infra.gw;
   extraHosts = builtins.readFile ./net/hosts;
 
   proxyPort = 3128;
@@ -24,10 +25,21 @@ let
   ];
 in
 {
-  greg.tailscale = {
+  greg = {
+    nebula = {
+      enable = true;
+      # genesis IS the routing node for the home LAN — it does not route through itself.
+      # Override the module default (which points at genesis) to avoid a routing loop.
+      unsafeRoutes = [ ];
+      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
+      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
+      routesSubnet = "10.42.0.0/16";
+    };
+    tailscale = {
       enable = true;
       tags = [ "home" ];
     };
+  };
 
   # Really, why do I still have to force-disable this crap?
   boot.kernel.sysctl = {
@@ -84,32 +96,42 @@ in
     #########
     # dnsmasq config
     ########
-    dnsmasq = {
+    bind = {
       enable = true;
-      settings = {
+      cacheNetworks = [
-        domain = "thehellings.lan";
+        metadata.infra.lan
-        expand-hosts = true;
+        metadata.infra.tailscale
-        log-queries = true;
+        metadata.infra.nebula
-        no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
+        "127.0.0.0/8"
-        addn-hosts = "/etc/adblock_hosts";
+      ];
-        hostsdir = "/etc/hosts.d/";
+      zones =
-        server = dnsServers;
+        let
-      };
+          makeZoneFile =
-    };
+            hosts: domain:
-
+            let
-    prometheus.exporters = {
+              preamble = [
-      dnsmasq.enable = true;
+                "$ORIGIN\t${domain}."
-      blackbox = {
+                "$TTL\t1h"
-        enable = true;
+                "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
-        openFirewall = true;
+                "\tIN\tNS\t${config.networking.hostName}"
-        configFile = pkgs.writeText "blackbox.yml" ''
+              ];
-          modules:
+              makeHost = host: "${host.name}\tIN\tA\t${host.address}";
-            icmp:
+            in
-              prober: icmp
+            pkgs.writeText "${domain}" (
-              timeout: 5s
+              builtins.concatStringsSep "\n" (preamble ++ (lib.map makeHost hosts) ++ [ "" ])
-              icmp:
+            );
-                preferred_ip_protocol: ip4
+        in
-        '';
+        lib.mapAttrs
+          (domain: net: {
+            master = true;
+            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
+          })
+          {
+            "shire-zebra.ts.net" = "tailscale";
+            "nebula.thehellings.com" = "nebula";
+            nebula = "nebula";
+            "thehellings.lan" = "lan";
+            lan = "lan";
           };
     };
   }; # End of services configuration

hosts/unstable/hosea/default.nix

@@ -60,6 +60,12 @@ in
       enable = true;
       tags = [ "home" ];
     };
+    backup.jobs.albyhub = {
+      src = "/chain/alby";
+      dest = "albyhub";
+      pre = "systemctl stop albyhub || true";
+      post = "systemctl start albyhub";
+    };
   };
 
   hardware = {

hosts/unstable/isaiah/default.nix

@@ -9,12 +9,6 @@
     ./hardware-configuration.nix
   ];
 
-  age.secrets = {
-    gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age;
-    gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
-    runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age;
-  };
-
   boot = {
     binfmt.emulatedSystems = [ "aarch64-linux" ];
     extraModprobeConfig = "options kvm_amd nested=1";
@@ -49,9 +43,9 @@
       tags = [ "home" ];
     };
     remote-builder.enable = true;
-    runner = {
+    gitea-runner = {
       enable = true;
-      qemu = true;
+      extraLabels = [ "bare-metal:host" ];
     };
   };
 
@@ -67,41 +61,6 @@
   };
 
   services = {
-    gitea-actions-runner.instances.podman = {
-      enable = true;
-      labels = [
-        "debian-latest:docker://node:25-trixie"
-
-        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
-        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
-        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
-
-        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
-        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
-        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
-
-        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
-        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
-        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
-
-        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
-        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
-        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
-
-        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
-        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
-        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
-
-        "nix-latest:docker://src.thehellings.com/greg/builder:latest"
-      ];
-      name = "isaiah-podman";
-      settings = {
-        container.force_pull = true;
-        runner.capacity = 7;
-      };
-      tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path;
-      url = "https://gitea.shire-zebra.ts.net";
-    };
     k3s.clusterInit = true; # This is the first node in the cluster
     openssh = {
       enable = true;

hosts/unstable/jeremiah/default.nix

@@ -22,8 +22,6 @@ in
   ];
 
   age.secrets = {
-    runner-reg.file = ../../../secrets/gitlab/nixos-qemu-shell.age;
-
     gitea-buildbotWorkersFile = mk ../../../secrets/gitea/buildbotWorkersFile.age;
     gitea-oauthToken = mk ../../../secrets/gitea/oauthToken.age;
     gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
@@ -78,6 +76,10 @@ in
   };
 
   greg = {
+    gitea-runner = {
+      enable = true;
+      extraLabels = [ "bare-metal:host" ];
+    };
     home = true;
     kubernetes = {
       enable = true;
@@ -91,11 +93,6 @@ in
       tags = [ "home" ];
     };
     remote-builder.enable = true;
-    runner = {
-      enable = true;
-      threads = 3;
-      qemu = true;
-    };
   };
 
   hardware = {

hosts/unstable/linode/default.nix

@@ -24,6 +24,13 @@
   ];
 
   greg = {
+    gitea-runner = {
+      enable = true;
+      extraLabels = [
+        "vps:host"
+        "blog:host"
+      ];
+    };
     home = false;
     linode.enable = true;
     nebula = {
@@ -59,20 +66,4 @@
       immichUrl = "https://immich.shire-zebra.ts.net";
     };
   };
-
-  security.sudo.extraRules = [
-    {
-      users = [ "gitlab-runner" ];
-      commands = [
-        {
-          command = "/run/current-system/sw/bin/systemctl";
-          options = [ "NOPASSWD" ];
-        }
-        {
-          command = "/run/current-system/sw/bin/podman";
-          options = [ "NOPASSWD" ];
-        }
-      ];
-    }
-  ];
 }

hosts/unstable/linode/nextcloud.nix

@@ -13,7 +13,7 @@
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud33;
     appstoreEnable = true;
     hostName = "next.${config.networking.domain}";
     https = true;

hosts/unstable/linode/nginx.nix

@@ -24,7 +24,6 @@ in
   virtualisation.oci-containers = {
     backend = "podman";
     containers."homepage" = {
-      # needs explicit port to match what gitlab-runner sees when pulling
       image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
       ports = [ "${homepage}:80" ];
     };

hosts/unstable/zeke/default.nix

@@ -14,13 +14,13 @@
     top.nix-hardware.nixosModules.system76
   ];
 
-  age.secrets = {
-    gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
-  };
-
   boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
 
   greg = {
+    gitea-runner = {
+      enable = true;
+      extraLabels = [ "bare-metal:host" ];
+    };
     kubernetes = {
       enable = true;
       vipInterface = "enp12s0";
@@ -28,10 +28,6 @@
     };
     nebula.enable = true;
     remote-builder.enable = true;
-    runner = {
-      enable = true;
-      vbox = false;
-    };
     tailscale = {
       enable = true;
       tags = [ "home" ];

hosts/unstable/zeke/hardware-configuration.nix

@@ -35,10 +35,11 @@
       device = "/dev/nvme0n1p1";
       fsType = "auto";
     };
-    #"/mnt/disk1" = {
+    "/mnt/disk1" = {
-    #device = "/dev/disk/by-uuid/0bb64e76-8811-499a-b60e-cc97808f2b0e";
+      device = "/dev/disk/by-uuid/bd04e868-034e-46e8-84ae-cd7347448bbd";
-    #fsType = "btrfs";
+      fsType = "xfs";
-    #};
+      options = [ "nofail" ];
+    };
   };
 
   swapDevices = [ ];

hosts/vm/gitlab/default.nix

@@ -1,273 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-let
-  registryPort = 5000;
-  vpnIp = "100.117.28.111";
-in
-{
-  imports = [
-    ./hardware-configuration.nix
-  ];
-
-  age.secrets =
-    let
-      cfg = n: {
-        file = ../../../secrets/gitlab/${n}.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    in
-    {
-      gitlab-secret = cfg "secret";
-      gitlab-otp = cfg "otp";
-      gitlab-db = cfg "db";
-      gitlab-db-password = cfg "db-password";
-      gitlab-jws = cfg "jws";
-      gitlab-key = cfg "key";
-      gitlab-cert = cfg "cert";
-      gitlab-salt = cfg "salt";
-      gitlab-primary-key = cfg "primary-key";
-      gitlab-deterministic-key = cfg "deterministic-key";
-
-      minio_access_key_id = {
-        file = ../../../secrets/minio_access_key_id.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-      minio_secret_access_key = {
-        file = ../../../secrets/minio_secret_access_key.age;
-        owner = "gitlab";
-        group = "gitlab";
-        mode = "0444";
-      };
-    };
-
-  greg = {
-    backup.jobs.nas-backup = {
-      src = "/var/gitlab/state/backup/";
-      dest = "gitlab";
-    };
-    home = true;
-    tailscale = {
-      enable = true;
-      tags = [ "home" ];
-    };
-  };
-
-  networking = {
-    hostName = "gitlab"; # Define your hostname.
-    firewall.allowedTCPPorts = [
-      80
-      registryPort
-    ];
-  };
-
-  services = {
-    gitlab = {
-      enable = true;
-      backup = {
-        keepTime = 288;
-        startAt = [ "03:00" ];
-      };
-      databaseHost = "postgres.kubernetes";
-      databaseName = "gitlab";
-      databaseUsername = "gitlab";
-      databasePasswordFile = config.age.secrets.gitlab-db-password.path;
-      databaseCreateLocally = false;
-      extraConfig = {
-        registry.port = null;
-        gitlab = {
-          trustedProxies = [
-            "${vpnIp}/32" # The system itself
-            "100.109.86.8/32" # Public server's IP
-          ];
-        };
-        object_store = {
-          enabled = true;
-          proxy_download = true; # Tell them to reach out to object storage themselves!
-          connection = {
-            provider = "AWS";
-            endpoint = "http://s3.thehellings.lan:9000";
-            region = "us-east-1";
-            aws_access_key_id = {
-              _secret = config.age.secrets.minio_access_key_id.path;
-            };
-            aws_secret_access_key = {
-              _secret = config.age.secrets.minio_secret_access_key.path;
-            };
-            path_style = true; # True for MinIO
-            aws_signature_version = 2;
-          };
-          #storage_options = ...;
-          objects = builtins.listToAttrs (
-            builtins.map
-              (
-                x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
-              )
-              [
-                "artifacts"
-                "ci_secure_files"
-                "dependency_proxy"
-                "external_diffs"
-                "lfs"
-                "packages"
-                "pages"
-                "terraform_state"
-                "uploads"
-              ]
-          );
-        };
-      };
-      host = "src.thehellings.com";
-      https = true;
-      initialRootEmail = "greg@thehellings.com";
-      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
-      pages = {
-        enable = true;
-        settings.pages-domain = "pages.thehellings.com";
-      };
-      port = 443;
-      puma = {
-        threadsMax = 6;
-        threadsMin = 2;
-        workers = 6;
-      };
-      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
-      registry = {
-        enable = true;
-        certFile = config.age.secrets.gitlab-cert.path;
-        keyFile = config.age.secrets.gitlab-key.path;
-        externalAddress = "registry.thehellings.com";
-        externalPort = 443;
-      };
-      secrets = {
-        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
-        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
-        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
-        dbFile = config.age.secrets.gitlab-db.path;
-        jwsFile = config.age.secrets.gitlab-jws.path;
-        otpFile = config.age.secrets.gitlab-otp.path;
-        secretFile = config.age.secrets.gitlab-secret.path;
-      };
-    };
-
-    nginx = {
-      enable = true;
-      clientMaxBodySize = "25000m";
-      virtualHosts = {
-        "vm-gitlab.shire-zebra.ts.net" = {
-          listen = [
-            {
-              addr = "0.0.0.0";
-              port = 443;
-              ssl = true;
-            }
-          ];
-          locations."/" = {
-            proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
-            recommendedProxySettings = true;
-          };
-          extraConfig = ''
-            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
-            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
-            client_max_body_size 10000m ;
-          '';
-        };
-        "registry" = {
-          listen = [
-            {
-              addr = "0.0.0.0";
-              port = registryPort;
-              ssl = true;
-            }
-          ];
-          locations."/" = {
-            proxyPass = "http://127.0.0.1:4567/";
-            recommendedProxySettings = true;
-          };
-          extraConfig = ''
-            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
-            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
-            client_max_body_size 25000m ;
-          '';
-          serverAliases = [
-            "vm-gitlab.shire-zebra.ts.net"
-          ];
-        };
-      };
-    };
-
-    openssh.enable = true;
-
-    postgresql.enable = true;
-
-    qemuGuest.enable = true;
-
-    redis.servers.gitlab = {
-      enable = true;
-    };
-
-    #resolved.enable = true;
-  };
-
-  # Do not start nginx until we have tailscaled up and running, so it can bind
-  # to the 100.* addresses
-  systemd = {
-    services = {
-      certRefresh =
-        let
-          script = pkgs.writeShellApplication {
-            name = "cert-refresh";
-            runtimeInputs = [ pkgs.tailscale ];
-
-            text = ''
-              cd /etc/certs
-              tailscale cert vm-gitlab.shire-zebra.ts.net
-              chown nginx ./*
-              systemctl reload nginx
-            '';
-          };
-        in
-        {
-          script = lib.getExe script;
-          serviceConfig = {
-            Type = "oneshot";
-            User = "root";
-          };
-        };
-
-      nginx = rec {
-        after = [ "network-online.target" ];
-        requires = [ "network-online.target" ];
-        wants = after;
-        serviceConfig = {
-          RestartMaxDelaySec = "30s";
-          RestartSteps = "5";
-        };
-      };
-      tailscaled.partOf = [ "network-online.target" ];
-    };
-
-    timers = {
-      "cert-refresh" = {
-        wantedBy = [ "cert-refresh.service" ];
-        timerConfig = {
-          OnCalendar = "monthly";
-          Persistent = true;
-        };
-      };
-    };
-  };
-  system.stateVersion = lib.mkForce "24.11";
-}

hosts/vm/gitlab/hardware-configuration.nix

@@ -1,58 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  # Bootloader.
-  boot = {
-    extraModulePackages = [ ];
-    initrd = {
-      availableKernelModules = [
-        "uhci_hcd"
-        "ehci_pci"
-        "ahci"
-        "virtio_pci"
-        "virtio_scsi"
-        "sd_mod"
-        "sr_mod"
-      ];
-      kernelModules = [ ];
-    };
-    loader = {
-      efi.canTouchEfiVariables = true;
-      systemd-boot.enable = true;
-    };
-  };
-
-  fileSystems."/" = {
-    device = lib.mkDefault "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/1E6A-C3BB";
-    fsType = "vfat";
-    options = [
-      "fmask=0077"
-      "dmask=0077"
-    ];
-  };
-
-  swapDevices = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
-}

lib/default.nix

@@ -0,0 +1,24 @@
+{ lib, ... }:
+{
+  hostsByNet =
+    net: hosts:
+    let
+      netAttr =
+        {
+          lan = "ip";
+          nebula = "nebulaIp";
+          tailscale = "ts";
+        }
+        .${net};
+    in
+    lib.mapAttrsToList
+      (name: value: {
+        inherit name;
+        address = builtins.getAttr netAttr value;
+      })
+      (
+        lib.filterAttrs (
+          _host: settings: (builtins.hasAttr netAttr settings) && (builtins.getAttr netAttr settings) != null
+        ) hosts
+      );
+}

manifests/auto/nodes.yaml

@@ -40,7 +40,7 @@ metadata:
         },
         {
           "path": "/mnt/disk1",
-          "allowScheduling": false,
+          "allowScheduling": true,
           "tags": ["hdd", "large"]
         }
       ]

manifests/bitwarden/deployment.yaml

@@ -21,9 +21,6 @@ spec:
     spec:
       containers:
         - name: bitwarden-cli
-          # Since my gitlab instance depends on the database hosted in k3s, and
-          # the database depends on this image, I need a way to bootstrap the
-          # system if # I am doing disaster recovery. And this is it.
           image: "ghcr.io/greg-hellings/nixos-config/img-bitwarden:latest"
           #image: >-
           #  registry.thehellings.com/greg/nixos-config/img-bitwarden:latest

manifests/dashboard/chart.yaml

@@ -1,32 +1,21 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: kubernetes-dashboard
+  name: headlamp
 spec:
-  url: https://kubernetes.github.io/dashboard/
+  url: "https://kubernetes-sigs.github.io/headlamp/"
   interval: "24h"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: kubernetes-dashboard
+  name: headlamp
 spec:
   interval: "24h"
   chart:
     spec:
-      chart: kubernetes-dashboard
+      chart: headlamp
       sourceRef:
         kind: HelmRepository
-        name: kubernetes-dashboard
+        name: headlamp
       interval: "24h"
-  values:
-    app:
-      settings:
-        global:
-          clusterName: Hellings Home
-          itemsPerPage: 25
-      ingress:
-        enabled: true
-        hosts:
-          - dashboard.shire-zebra.ts.net
-        ingressClassName: tailscale

manifests/dashboard/ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dashboard-tailscale
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: headlamp
+      port:
+        number: 3001
+  tls:
+    - hosts:
+        - headlamp

manifests/dashboard/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - namespace.yaml
   - chart.yaml
   - user.yaml
+  - ingress.yaml

manifests/databases/immich.yaml

@@ -1,89 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: immich
-spec:
-  imageName: "ghcr.io/corentingiraud/cnpg-pgvector-vectorchord:16-migration"
-  #imageName: "ghcr.io/tensorchord/cloudnative-pgvecto.rs:16-v0.3.0"
-  #postgresUID: 1
-  instances: 1
-  storage:
-    size: 60Gi
-  primaryUpdateStrategy: unsupervised
-  postgresql:
-    shared_preload_libraries:
-      - vectors.so
-      - vchord.so
-
-  bootstrap:
-    recovery:
-      source: origin
-    # initdb:
-    #   database: immich
-    #   owner: immich
-    #   secret:
-    #     name: postgres-user-immich
-    #   dataChecksums: true
-    #   postInitApplicationSQL:
-    #     - ALTER SYSTEM SET search_path TO "$user", public, vectors;
-    #     - SET search_path TO "$user", public, vectors;
-    #     - CREATE EXTENSION IF NOT EXISTS "cube";
-    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance";
-    #     - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
-
-  externalClusters:
-    - name: origin
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        parameters:
-          barmanObjectName: k3sbackup-objectstore
-          serverName: pgvector
-
-  managed:
-    roles:
-      - name: immich
-        ensure: present
-        comment: Immich DB user
-        login: true
-        superuser: true
-        passwordSecret:
-          name: postgres-user-immich
-
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: k3sbackup-objectstore
----
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: database-immich
-spec:
-  name: immich
-  owner: immich
-  cluster:
-    name: immich
-  extensions:
-    - name: vectors
-      ensure: present
-    - name: vectorchord
-      ensure: present
-    - name: cube
-      ensure: present
-    - name: earthdistance
-      ensure: present
----
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: immich-backup
-spec:
-  immediate: true # Create one when this is added to the cluster
-  schedule: "0 2 0 * * *" # 1AM, nightly
-  backupOwnerReference: self
-  cluster:
-    name: immich
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io

manifests/databases/ingress.yaml

@@ -14,14 +14,12 @@ spec:
       - 100.88.91.27 # dns?
       - 100.80.99.48 # exodus
       - 100.88.91.27 # genesis
-      - 100.117.28.111 # gitlab
       - 100.68.203.1 # hosea
       - 100.84.183.79 # isaiah
       - 100.102.186.39 # jeremiah
       - 100.90.74.19 # zeke
       - 100.115.57.8 # linode
       - 100.65.5.38 # matrix
-      #- 100.127.55.22 # jellyfin
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP

manifests/databases/kustomization.yaml

@@ -4,8 +4,6 @@ resources:
   - namespace.yaml
   - secrets.yaml
   - postgres-cluster.yaml
-  - postgres-gitlab.yaml
   - postgres-pgadmin.yaml
   - postgres-matrix.yaml
-  - immich.yaml
   - ingress.yaml

manifests/databases/postgres-cluster.yaml

@@ -11,13 +11,6 @@ spec:
 
   managed:
     roles:
-      - name: gitlab
-        ensure: present
-        comment: Gitlab user
-        login: true
-        superuser: false
-        passwordSecret:
-          name: postgres-user-gitlab
       - name: pgadmin
         ensure: present
         comment: PG Admin user

manifests/databases/postgres-gitlab.yaml

@@ -1,9 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Database
-metadata:
-  name: database-gitlab
-spec:
-  name: gitlab
-  owner: gitlab
-  cluster:
-    name: postgres

manifests/databases/secrets.yaml

@@ -1,39 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
-metadata:
-  name: postgres-user-gitlab
-  namespace: db
-spec:
-  target:
-    name: postgres-user-gitlab
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
-        property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
 metadata:
   name: postgres-user-matrix
   namespace: db
@@ -133,37 +99,3 @@ spec:
       remoteRef:
         key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
         property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: postgres-user-immich
-  namespace: db
-spec:
-  target:
-    name: postgres-user-immich
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        username: |-
-          {{ .username }}
-        password: |-
-          {{ .password }}
-  data:
-    - secretKey: username
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
-        property: username
-    - secretKey: password
-      sourceRef:
-        storeRef:
-          name: bitwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
-        property: password

manifests/gitea/chart.yaml

@@ -15,7 +15,7 @@ spec:
   chart:
     spec:
       chart: gitea
-      version: "12.5.0"
+      version: "12.5.3"
       sourceRef:
         kind: HelmRepository
         name: gitea-repository
@@ -35,7 +35,7 @@ spec:
       storageClass: longhorn-default
 
     image:
-      tag: "1.25.4"
+      tag: "1.25.5"
 
     replicaCount: 1
 

manifests/gitea/dump-cronjob.yaml

@@ -0,0 +1,78 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: gitea-dump
+spec:
+  schedule: "0 3 * * *"
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: Never
+          securityContext:
+            runAsUser: 1000
+            runAsGroup: 1000
+            fsGroup: 1000
+          volumes:
+            - name: gitea-data
+              persistentVolumeClaim:
+                claimName: gitea-shared-storage
+            - name: dump-staging
+              emptyDir: {}
+          initContainers:
+            - name: gitea-dump
+              image: "gitea/gitea:1.25.4"
+              command:
+                - /bin/sh
+                - "-c"
+                - |
+                  set -e
+                  TIMESTAMP=$(date +%Y%m%d-%H%M%S)
+                  OUTFILE="/dump-staging/gitea-dump-${TIMESTAMP}.zip"
+                  gitea dump \
+                    --config /data/gitea/conf/app.ini \
+                    --file "${OUTFILE}" \
+                    --type zip
+                  echo "Dump written to ${OUTFILE}"
+              volumeMounts:
+                - name: gitea-data
+                  mountPath: /data
+                  readOnly: true
+                - name: dump-staging
+                  mountPath: /dump-staging
+          containers:
+            - name: upload-to-s3
+              image: "minio/mc:latest"
+              command:
+                - /bin/sh
+                - "-c"
+                - |
+                  set -e
+                  # Configure mc alias for MinIO
+                  mc alias set nas1 http://nas1.shire-zebra.ts.net:9000 \
+                    "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
+                  # Upload dump to backup-gitea bucket
+                  DUMP_FILE=$(ls /dump-staging/gitea-dump-*.zip | head -1)
+                  mc cp "${DUMP_FILE}" "nas1/backup-gitea/$(basename ${DUMP_FILE})"
+                  echo "Uploaded $(basename ${DUMP_FILE}) to backup-gitea"
+                  # Set 30-day lifecycle on the bucket (idempotent)
+                  mc ilm rule add --expire-days 30 nas1/backup-gitea 2>/dev/null || true
+              volumeMounts:
+                - name: dump-staging
+                  mountPath: /dump-staging
+                  readOnly: true
+              env:
+                - name: MC_CONFIG_DIR
+                  value: /tmp/.mc
+                - name: MINIO_ACCESS_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-config
+                      key: minio_key
+                - name: MINIO_SECRET_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-config
+                      key: minio_secret

manifests/gitea/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - chart.yaml
   - ingress.yaml
   - secrets.yaml
+  - dump-cronjob.yaml

manifests/gitea/secrets.yaml

@@ -13,8 +13,10 @@ spec:
           USER={{ .dbuser }}
           PASSWD="""{{ .dbpass }}"""
         storage: |-
-          MINIO_ACCESS_KEY_ID={{ .minio_key }}
+          MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
-          MINIO_SECRET_ACCESS_KEY={{ .minio_secret }}
+          MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
+        #minio_key: "{{ .minio_nas1_key }}"
+        #minio_secret: "{{ .minio_nas1_secret }}"
   secretStoreRef:
     name: bitwarden-login
     kind: ClusterSecretStore
@@ -28,6 +30,15 @@ spec:
       remoteRef:
         key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
         property: password
+    # MinIO credentials for NAS1
+    - secretKey: minio_nas1_key
+      remoteRef:
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        property: username
+    - secretKey: minio_nas1_secret
+      remoteRef:
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        property: password
     # Postgres credentials
     - secretKey: dbuser
       remoteRef:

manifests/gitlab-runner/chart.yaml

@@ -1,64 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: gitlab-runner
-spec:
-  interval: "24h"
-  url: https://charts.gitlab.io
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitlab-runner
-spec:
-  interval: 10m
-  chart:
-    spec:
-      chart: gitlab-runner
-      version: "0.83.1"
-      sourceRef:
-        kind: HelmRepository
-        name: gitlab-runner
-      interval: "1h"
-  dependsOn:
-    - name: external-secrets
-      namespace: external-secrets
-    - name: tailscae
-      namespace: tailscale
-  values:
-    crds:
-      create: true
-    includeCRDs: true
-    gitlabUrl: https://src.thehellings.com
-    runners:
-      secret: gitlab-runner
-    imagePullSecrets:
-      - name: image-pull-secrets
-    rbac:
-      create: true
-    serviceAccount:
-      create: true
-    metrics:
-      enabled: true
-    extraEnv:
-      CACHE_TYPE: s3
-      CACHE_SHARED: "true"
-      CACHE_S3_BUCKET_NAME: gitlab-runner-cache
-      CACHE_S3_INSECURE: "true"
-    extraEnvFrom:
-      PACKER_GITHUB_API_TOKEN:
-        secretKeyRef:
-          name: gitlab-runner
-          key: PACKER_GITHUB_API_TOKEN
-      CACHE_S3_SERVER_ADDRESS:
-        secretKeyRef:
-          name: gitlab-runner
-          key: CACHE_S3_SERVER_ADDRESS
-      CACHE_S3_ACCESS_KEY:
-        secretKeyRef:
-          name: s3-access
-          key: username
-      CACHE_S3_SECRET_KEY:
-        secretKeyRef:
-          name: s3-access
-          key: password

manifests/gitlab-runner/kustomization.yaml

@@ -1,6 +0,0 @@
-namespace: gitlab-runner
-
-resources:
-  - namespace.yaml
-  - secrets.yaml
-  - chart.yaml

manifests/gitlab-runner/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitlab-runner

manifests/gitlab-runner/secrets.yaml

@@ -1,101 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: gitlab-runner
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-fields
-    kind: ClusterSecretStore
-  target:
-    name: gitlab-runner
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        runner-registration-token: ""
-        runner-token: "{{ .runnerToken }}"
-        PACKER_GITHUB_API_TOKEN: "{{ .PACKER_GITHUB_API_TOKEN }}"
-        CACHE_S3_SERVER_ADDRESS: "{{ .CACHE_S3_SERVER_ADDRESS }}"
-  data:
-    - secretKey: runnerToken
-      remoteRef:
-        key: &key 53719920-b100-4355-8c80-b2f9002fad22
-        property: CI_SERVER_TOKEN
-    - secretKey: PACKER_GITHUB_API_TOKEN
-      remoteRef:
-        key: *key
-        property: PACKER_GITHUB_API_TOKEN
-    - secretKey: CACHE_S3_SERVER_ADDRESS
-      remoteRef:
-        key: *key
-        property: CACHE_S3_SERVER_ADDRESS
-        # Includes
-        # CI_SERVER_TOKEN
-        # PACKER_GITHUB_API_TOKEN
-        # CACHE_S3_SERVER_ADDRESS
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: s3-access
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    name: s3-access
-    deletionPolicy: Delete
-  data:
-    - secretKey: username
-      remoteRef:
-        key: &key 04dd39c2-268d-4a33-aa4c-b1550166139f
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: *key
-        property: password
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: image-pull-secrets
-  namespace: gitlab-runner
-spec:
-  secretStoreRef:
-    name: bitwarden-login
-    kind: ClusterSecretStore
-  target:
-    deletionPolicy: Delete
-    template:
-      type: kubernetes.io/dockerconfigjson
-      data:
-        .dockerconfigjson: >-
-          {
-            "auths": {
-              "https://index.docker.io/v1/": {
-                "username": "{{ .user }}",
-                "password": "{{ .password }}",
-                "email": "greg.hellings@gmail.com",
-                "auth": "{{ .auth }}"
-              }
-            }
-          }
-  data:
-    - secretKey: user
-      remoteRef:
-        key: &key f560ae38-368c-4e58-898c-aeb90012d597
-        property: username
-    - secretKey: password
-      remoteRef:
-        key: *key
-        property: password
-    - secretKey: auth
-      sourceRef:
-        storeRef:
-          name: bitwarden-fields
-          kind: ClusterSecretStore
-      remoteRef:
-        key: *key
-        property: auth

manifests/helm/external-secrets.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  interval: "24h"
+  url: "https://charts.external-secrets.io/"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: external-secrets
+      version: "2.3.0"
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+      interval: "1h"
+  values:
+    crds:
+      create: true
+    includeCRDs: true
+    webhook:
+      certManager:
+        enable: true

manifests/helm/kustomization.yaml

@@ -1,3 +1,6 @@
 resources:
+  - kyverno.yaml
+  - external-secrets.yaml
+  - tailscale.yaml
   - longhorn.yaml # Needed for storage
   - traefik.yaml

manifests/helm/kyverno.yaml

@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kyverno-system
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: kyverno
+  namespace: kyverno-system
+spec:
+  interval: "24h"
+  url: "https://kyverno.github.io/kyverno/"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kyverno
+  namespace: kyverno-system
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: kyverno
+      version: "3.7.1"
+      sourceRef:
+        kind: HelmRepository
+        name: kyverno
+      interval: "1h"
+  values:
+    admissionController:
+      replicas: 3
+    backgroundController:
+      replicas: 3
+    cleanupController:
+      replicas: 2
+    reportsController:
+      replicas: 2
+    crds:
+      install: true

manifests/helm/longhorn.yaml

@@ -19,10 +19,15 @@ metadata:
   namespace: longhorn-system
 spec:
   interval: 10m
+  dependsOn:
+    - name: tailscale
+      namespace: tailscale
+    - name: kyverno
+      namespace: kyverno-system
   chart:
     spec:
       chart: longhorn
-      version: "1.10.2"
+      version: "1.11.1"
       sourceRef:
         kind: HelmRepository
         name: longhorn

manifests/helm/tailscale.yaml

@@ -1,3 +1,36 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tailscale
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: tailscale
+  namespace: tailscale
+spec:
+  interval: "24h"
+  url: "https://pkgs.tailscale.com/helmcharts"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: tailscale
+  namespace: tailscale
+spec:
+  interval: 10m
+  dependsOn:
+    - name: external-secrets
+      namespace: external-secrets
+  chart:
+    spec:
+      chart: tailscale-operator
+      version: "1.96.5"
+      sourceRef:
+        kind: HelmRepository
+        name: tailscale
+      interval: "1h"
+---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:

manifests/immich/backup.yaml

@@ -19,23 +19,76 @@ spec:
         key: "dd0de40c-9ad6-4034-9d5c-b311016ebf19"
         property: apikey
 ---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: immich-minio-creds
+spec:
+  target:
+    name: immich-minio-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        access-key: "{{ .minio_key }}"
+        secret-key: "{{ .minio_secret }}"
+        rclone.conf: |
+          [nas1minio]
+          type = s3
+          provider = Minio
+          endpoint = http://nas1.shire-zebra.ts.net:9000
+          access_key_id = {{ .minio_key }}
+          secret_access_key = {{ .minio_secret }}
+          region = us-east-1
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    - secretKey: minio_key
+      remoteRef:
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        property: username
+    - secretKey: minio_secret
+      remoteRef:
+        key: c4c66ab3-2ade-4086-9c0d-b3a80172b1ba
+        property: password
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: immich-backup-staging
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-default
+  resources:
+    requests:
+      storage: 400Gi
+---
 apiVersion: batch/v1
 kind: CronJob
 metadata:
   name: backup
 spec:
   schedule: "0 4 * * *" # At 4am each day
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
   jobTemplate:
     spec:
       template:
         spec:
           restartPolicy: Never
           volumes:
-            - name: nas1
+            - name: staging
-              nfs:
+              persistentVolumeClaim:
-                path: /mnt/all/backups/immich
+                claimName: immich-backup-staging
-                server: nas1.shire-zebra.ts.net
+            - name: rclone-config
-          containers:
+              secret:
+                secretName: immich-minio-creds
+                items:
+                  - key: rclone.conf
+                    path: rclone.conf
+          initContainers:
             - name: immich-go
               image: "src.thehellings.com/greg/immich:latest"
               imagePullPolicy: "Always"
@@ -43,21 +96,42 @@ spec:
                 - /bin/sh
                 - "-c"
                 - >-
+                  rm -r /staging/*;
                   immich-go
                   archive
                   "--write-to-folder"
-                  /nas1
+                  /staging
                   from-immich
                   "--from-api-key"
                   "$IMMICH_API_KEY"
                   "--from-server"
                   "http://immich-server:2283"
               volumeMounts:
-                - name: nas1
+                - name: staging
-                  mountPath: /nas1
+                  mountPath: /staging
               env:
                 - name: IMMICH_API_KEY
                   valueFrom:
                     secretKeyRef:
                       name: immich-login
                       key: apikey
+          containers:
+            - name: rclone-sync
+              image: "rclone/rclone:1.68"
+              command:
+                - /bin/sh
+                - "-c"
+                - |
+                  rclone sync \
+                    --config /rclone-config/rclone.conf \
+                    --checksum \
+                    --progress \
+                    --transfers 4 \
+                    --checkers 8 \
+                    /staging nas1minio:immich
+              volumeMounts:
+                - name: staging
+                  mountPath: /staging
+                - name: rclone-config
+                  mountPath: /rclone-config
+                  readOnly: true

manifests/immich/chart.yaml

@@ -32,9 +32,9 @@ spec:
         containers:
           main:
             image:
-              tag: v2.4.1
+              tag: v2.7.5
             env:
-              DB_HOSTNAME: immich-rw.db.svc.cluster.local
+              DB_HOSTNAME: immich-rw
               DB_DATABASE_NAME: immich
               DB_USERNAME:
                 valueFrom:

manifests/immich/database.yaml

@@ -0,0 +1,161 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: immich
+spec:
+  imageName: "ghcr.io/tensorchord/cloudnative-vectorchord:18"
+  #postgresUID: 1
+  instances: 1
+  storage:
+    size: 60Gi
+  primaryUpdateStrategy: unsupervised
+  postgresql:
+    shared_preload_libraries:
+      - vchord.so
+
+  bootstrap:
+    # Use these with the name "immich-1" to restore from the backups
+    recovery:
+      source: origin
+    # Use these two lines in order to restore from the other database,
+    # once it has restored from the WALs
+    #pg_basebackup:
+    #  source: restore
+    # Use this block to bootstrap the cluster, if you don't have backups.
+    # What are you doing without backups, you chump?!
+    # initdb:
+    #   database: immich
+    #   owner: immich
+    #   secret:
+    #     name: postgres-user-immich
+    #   dataChecksums: true
+    #   postInitApplicationSQL:
+    #     - ALTER SYSTEM SET search_path TO "$user", public, vectors;
+    #     - SET search_path TO "$user", public, vectors;
+    #     - CREATE EXTENSION IF NOT EXISTS "cube";
+    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance";
+    #     - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
+
+  externalClusters:
+    - name: origin
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: k3sbackup-objectstore
+          serverName: immich
+    - name: restore
+      connectionParameters:
+        host: immich-1-rw
+        user: streaming_replica
+        sslmode: verify-full
+      sslCert:
+        name: immich-1-replication
+        key: tls.crt
+      sslKey:
+        name: immich-1-replication
+        key: tls.key
+      sslRootCert:
+        name: immich-1-ca
+        key: ca.crt
+
+  managed:
+    roles:
+      - name: immich
+        ensure: present
+        comment: Immich DB user
+        login: true
+        superuser: true
+        passwordSecret:
+          name: postgres-user-immich
+
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: k3sbackup-objectstore
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: database-immich
+spec:
+  name: immich
+  owner: immich
+  cluster:
+    name: immich
+  extensions:
+    - name: vectors
+      ensure: present
+    - name: vectorchord
+      ensure: present
+    - name: cube
+      ensure: present
+    - name: earthdistance
+      ensure: present
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: k3sbackup-externalsecret
+spec:
+  target:
+    name: k3sbackup-secret
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: |-
+          {{ .username }}
+        password: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
+        property: password
+
+---
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: k3sbackup-objectstore
+spec:
+  configuration:
+    destinationPath: "s3://k3sbackup/postgres"
+    endpointURL: "http://chronicles.thehellings.lan:9000/"
+    s3Credentials:
+      accessKeyId:
+        name: k3sbackup-secret
+        key: username
+      secretAccessKey:
+        name: k3sbackup-secret
+        key: password
+    wal:
+      compression: gzip
+  retentionPolicy: "30d"
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: immich-backup
+spec:
+  immediate: false # Create one when this is added to the cluster
+  schedule: "0 2 0 * * *" # 1AM, nightly
+  backupOwnerReference: self
+  cluster:
+    name: immich
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io

manifests/immich/kustomization.yaml

@@ -2,8 +2,9 @@ namespace: immich
 
 resources:
   - namespace.yaml
-  - chart.yaml
   - postgres-user-secret.yaml
+  - database.yaml
+  - chart.yaml
   - pvc.yaml
   - ingress.yaml
   - backup.yaml

manifests/kustomization.yaml

@@ -7,7 +7,6 @@ resources:
   - mariadb-operator
   - databases
   - matrix
-  #- gitlab-runner
   - immich
   - monitoring
   - pinchflat

modules/hm/gui.nix

@@ -158,6 +158,8 @@ in
                   "https://thehellings.com"
                 else
                   "https://kuma.shire-zebra.ts.net/";
+              "devtools.debugger.remote-enabled" = true;
+              "devtools.debugger.remote-port" = 9222;
               "doh-rollout.doorhanger-decision" = "UIDisabled";
               "doh-rollout.doneFirstRun" = true;
               "signon.rememberSignons" = false;

modules/hm/gui/bookmarks.nix

@@ -35,6 +35,23 @@
           }
         ];
       }
+      {
+        name = "Lithic";
+        bookmarks = [
+          {
+            name = "Okta";
+            url = "https://privacy.okta.com";
+          }
+          {
+            name = "Jira";
+            url = "https://lithichq.atlassian.net";
+          }
+          {
+            name = "Notion";
+            url = "https://www.notion.so/lithichq/";
+          }
+        ];
+      }
       {
         name = "IVR";
         bookmarks = [
@@ -351,6 +368,15 @@
               }
             ];
           }
+          {
+            name = "Jurisdictions";
+            bookmarks = [
+              {
+                name = "Weatherford";
+                url = "https://weatherfordtx.gov/3062/Development-Services";
+              }
+            ];
+          }
           {
             name = "Door Loop";
             url = "https://btrgpm.app.doorloop.com/home";
@@ -359,6 +385,14 @@
             name = "HELOC payoff calculator";
             url = "https://acceleratedstrategies.com/free-calculator/";
           }
+          {
+            name = "Odoo";
+            url = "http://10.42.2.57:8069/odoo/crm";
+          }
+          {
+            name = "Mattermost";
+            url = "http://10.42.2.89:8065/login";
+          }
         ];
       }
       {
@@ -378,6 +412,15 @@
           }
         ];
       }
+      {
+        name = "Home";
+        bookmarks = [
+          {
+            name = "Home Assistant";
+            url = "http://10.42.2.155:8123/config/dashboard";
+          }
+        ];
+      }
     ];
   }
 ]

modules/nix-conf.nix

@@ -9,6 +9,7 @@
 let
   builderHosts = lib.filterAttrs (_n: v: (builtins.hasAttr "builder" v) && v.builder) metadata.hosts;
   cfg = config.greg.nix;
+  hostname = x: if cfg.cache then "${x}.shire-zebra.ts.net" else "${x}.thehellings.lan";
 in
 {
   options.greg.nix = {
@@ -22,7 +23,7 @@ in
     programs.ssh.extraConfig = builtins.concatStringsSep "\n" (
       lib.map (x: ''
         Host ${x}-builder
-          Hostname ${x}.shire-zebra.ts.net
+          Hostname ${hostname x}
           User remote-builder-user
       '') (lib.attrNames builderHosts)
     );
@@ -57,12 +58,17 @@ in
           "gregory.hellings"
         ]; # For home and for work machines
         substituters =
-          (if cfg.cache then [
+          (
+            if cfg.cache then
+              [
                 #"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
                 "http://nas1.shire-zebra.ts.net:8080/default"
-          ] else [
+              ]
+            else
+              [
                 "http://nas1.thehellings.lan:8080/default"
-          ])
+              ]
+          )
           ++ [
             "https://ai.cachix.org"
             "https://nixpkgs-python.cachix.org"

modules/nixos/adblock-update.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.greg.adblockUpdate;
+in
+{
+
+  options.greg.adblockUpdate = {
+    enable = lib.mkEnableOption "Enable auto-update of block list";
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd = {
+      services.adblock-update = {
+        after = [ "network-online.target" ];
+        requires = [ "network-online.target" ];
+        script = lib.getExe pkgs.adblockUpdate;
+        serviceConfig.Type = "oneshot";
+      };
+      timers.adblock-update = {
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network-online.target" ];
+        requires = [ "network-online.target" ];
+        timerConfig = {
+          OnCalendar = "daily";
+          Unit = "adblock-update.service";
+        };
+      };
+    };
+  };
+}

modules/nixos/default.nix

@@ -4,11 +4,12 @@
 
 {
   imports = [
+    ./adblock-update.nix
     ./albyhub.nix
     ./backup.nix
     ./ceph.nix
     ./db.nix
-    ./gitlab-runner.nix
+    ./gitea-runner.nix
     ./gnome.nix
     ./home.nix
     ./kde.nix

modules/nixos/gitea-runner.nix

@@ -6,58 +6,103 @@
 }:
 let
   cfg = config.greg.gitea-runner;
-  hostname = config.networking.hostName;
+  host = config.networking.hostName;
-
+  labels = cfg.labels ++ cfg.extraLabels;
-  # Determine extra labels based on host role
-  roleLabels =
-    if builtins.elem hostname [ "isaiah" "jeremiah" "zeke" ] then
-      [ "bare-metal" ]
-    else if hostname == "linode" then
-      [ "linode" ]
-    else
-      [ ];
 in
 {
   options.greg.gitea-runner = {
-    enable = lib.mkEnableOption "Enable Gitea Actions runner (exec/shell mode)";
+    enable = lib.mkEnableOption "Enable Gitea act_runner (shell mode)";
 
-    hostnameLabel = lib.mkOption {
+    instanceURL = lib.mkOption {
+      type = lib.types.str;
+      default = "https://src.thehellings.com";
+      description = "URL of the Gitea instance to connect to";
+    };
+
+    name = lib.mkOption {
       type = lib.types.str;
       default = config.networking.hostName;
-      description = "Label identifying this host in the runner pool (defaults to hostname)";
+      description = "Name of the runner (defaults to hostname)";
+    };
+
+    capacity = lib.mkOption {
+      type = lib.types.int;
+      default = 5;
+      description = "Number of concurrent jobs the runner can handle";
+    };
+
+    extraLabels = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+    };
+
+    labels = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [
+        "self-hosted:host"
+        "nixos-${host}:host"
+
+        "debian-latest:docker://node:25-trixie"
+
+        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        "ubuntu-26.04:docker://docker.gitea.com/runner-images:ubuntu-26.04"
+        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+
+        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
+        "ubuntu-full-26.04:docker://ghcr.io/catthehacker/ubuntu:full-26.04"
+        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
+        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
+
+        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+        "ubuntu-act-26.04:docker://ghcr.io/catthehacker/ubuntu:act-26.04"
+        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
+        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
+
+        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
+        "ubuntu-runner-26.04:docker://ghcr.io/catthehacker/ubuntu:runner-26.04"
+        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
+        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
+
+        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
+        "ubuntu-rust-26.04:docker://ghcr.io/catthehacker/ubuntu:rust-26.04"
+        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
+        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
+
+        "nix-latest:docker://src.thehellings.com/greg/builder:latest"
+      ];
+      description = "Labels to assign to this runner";
     };
 
     tokenFile = lib.mkOption {
       type = lib.types.path;
-      description = ''
+      description = "Path to a file containing the runner registration token (from agenix)";
-        Path to the file containing the runner registration token.
+      default = ../../secrets/gitea/runner-isaiah-podman.age;
-        Wire in your agenix secret path here, e.g.:
-          config.age.secrets.gitea-runner-token.path
-      '';
-    };
-
-    threads = lib.mkOption {
-      type = lib.types.int;
-      default = 4;
-      description = "Maximum number of concurrent jobs";
     };
   };
 
   config = lib.mkIf cfg.enable {
+    age.secrets."gitea-runner-${host}-podman".file = cfg.tokenFile;
+
+    environment.systemPackages = with pkgs; [
+      bash
+      git
+      nodejs
+    ];
+
+    greg.podman.enable = true;
+
     services.gitea-actions-runner = {
       package = pkgs.gitea-actions-runner;
-      instances.${hostname} = {
+      instances.${cfg.name} = {
+        inherit labels;
+        inherit (cfg) name;
         enable = true;
-        url = "https://src.thehellings.com";
+        url = cfg.instanceURL;
-        tokenFile = cfg.tokenFile;
+        tokenFile = config.age.secrets."gitea-runner-${host}-podman".path;
-        labels =
-          [
-            "self-hosted"
-            cfg.hostnameLabel
-          ]
-          ++ roleLabels;
         settings = {
-          runner.capacity = cfg.threads;
+          container.force_pull = true;
+          runner.capacity = cfg.capacity;
         };
       };
     };

modules/nixos/gitlab-runner.nix

@@ -1,82 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.greg.runner;
-  environmentVariables = {
-    EFI_DIR = "${pkgs.OVMF.fd}/FV/";
-    STORAGE_URL = "s3.thehellings.lan:9000";
-  };
-  runnerCfg = file: {
-    inherit environmentVariables;
-    authenticationTokenConfigFile = file;
-    executor = "shell";
-    limit = cfg.threads;
-  };
-in
-# We want exactly one of these to be true, but not both. Neither can both be false
-{
-  options.greg.runner = {
-    enable = lib.mkEnableOption "Enable as a gitlab-runner with both libvirt and virtualbox";
-
-    threads = lib.mkOption {
-      default = 5;
-      type = lib.types.int;
-      description = "The maximum number of concurrent jobs";
-    };
-
-    qemu = lib.mkEnableOption "Enable the qemu host (mutually exclusive with vbox)";
-    vbox = lib.mkEnableOption "Enable the vbox host (mutually exclusive with qemu)";
-  };
-
-  config = lib.mkIf cfg.enable ({
-    # assertions = [
-    #   {
-    #     assertion = cfg.qemu || cfg.vbox && (cfg.qemu != cfg.vbox);
-    #     message = "You must enable exactly one of qemu or vbox";
-    #   }
-    # ];
-    # Shared configurations
-    age.secrets = {
-      qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
-      vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
-    };
-
-    services.gitlab-runner = {
-      enable = false;
-      settings.concurrent = cfg.threads;
-      services = {
-        qemu = lib.mkIf cfg.qemu (runnerCfg config.age.secrets.qemu.path);
-        vbox = lib.mkIf cfg.vbox (runnerCfg config.age.secrets.vbox.path);
-      };
-    };
-
-    systemd.services.gitlab-runner = {
-      serviceConfig = {
-        DevicePolicy = lib.mkForce "auto";
-        User = "root";
-        DynamicUser = lib.mkForce false;
-      };
-    };
-
-    users.extraGroups.vboxusers.members = lib.optional cfg.vbox "greg";
-
-    virtualisation = {
-      libvirtd = lib.mkIf cfg.qemu {
-        enable = true;
-        allowedBridges = [
-          "br0"
-          "virbr0"
-        ];
-        onBoot = "ignore"; # only restart VMs labeled 'autostart'
-      };
-      virtualbox.host = lib.mkIf cfg.vbox {
-        enable = true;
-        enableExtensionPack = true;
-      };
-    };
-  });
-}

modules/nixos/kubernetes.nix

@@ -2,14 +2,13 @@
   config,
   lib,
   pkgs,
-  top,
   ...
 }:
 let
   cfg = config.greg.kubernetes;
   cert-manager = pkgs.fetchurl {
-    url = "https://github.com/cert-manager/cert-manager/releases/download/v1.18.2/cert-manager.yaml";
+    url = "https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml";
-    sha256 = "0vx1nfyhl0rzb6psfxplq8pfp18mrrdk83n8rj2ph8q6r15vcih5";
+    sha256 = "sha256-HOEcrpEq3sxp5rtiNDX6/J7SFQX57/+YvXHXuA8B2x8=";
   };
   flux = pkgs.fetchurl {
     url = "https://github.com/fluxcd/flux2/releases/download/v2.7.2/install.yaml";
@@ -86,43 +85,6 @@ in
     services = {
       k3s = {
         enable = true;
-        autoDeployCharts = {
-          external-secrets = {
-            inherit (top.charts.chartsMetadata.external-secrets.external-secrets) repo version;
-            enable = true;
-            name = top.charts.chartsMetadata.external-secrets.external-secrets.chart;
-            hash = "sha256-dPuUWthwN6L0jdAKRpkDtDedGyDUxUlJrwkvUNwLsrU=";
-            createNamespace = true;
-            targetNamespace = "external-secrets";
-            values = {
-              crds.create = true;
-              includeCRDs = true;
-            };
-          };
-          kyverno = {
-            inherit (top.charts.chartsMetadata.kyverno.kyverno) repo version;
-            enable = true;
-            name = top.charts.chartsMetadata.kyverno.kyverno.chart;
-            hash = "sha256-sNdFEupwfnYSo2iGqKwTadPtXfcbyM1kuisavpiGUyU=";
-            createNamespace = true;
-            targetNamespace = "kyverno-system";
-            values = {
-              admissionController.replicas = 3;
-              backgroundController.replicas = 3;
-              cleanupController.replicas = 2;
-              reportsController.replicas = 2;
-              crds.install = true;
-            };
-          };
-          tailscale = {
-            inherit (top.charts.chartsMetadata.tailscale.tailscale-operator) repo version;
-            enable = true;
-            name = top.charts.chartsMetadata.tailscale.tailscale-operator.chart;
-            hash = "sha256-BtZ24mCT2GMHE9iR+2xuIkB+4m1r2OC3WLkY3jC3i3I=";
-            createNamespace = true;
-            targetNamespace = "tailscale";
-          };
-        };
         extraFlags = [
           "--cluster-cidr=10.211.0.0/16"
           "--service-cidr=10.221.0.0/16"
@@ -138,7 +100,6 @@ in
           cert-manager.source = cert-manager;
           flux.source = flux;
           node-annotations.source = ../../manifests/auto/nodes.yaml;
-          operator-oauth.source = ../../manifests/auto/operator-oauth.yaml;
         };
         role = if cfg.agentOnly then "agent" else "server";
         serverAddr = lib.mkIf (

modules/nixos/proxy.nix

@@ -54,7 +54,7 @@ with lib;
 
                 target = mkOption {
                   type = types.str;
-                  description = ''The destination that is being proxied.'';
+                  description = "The destination that is being proxied.";
                   example = "http://localhost:8080";
                 };
 

modules/nixos/remote-builder.nix

@@ -57,6 +57,7 @@ with lib;
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLOqwbp4hFYkiJpokh9i2RToa/6tQcwthDNQH69tyBF root@vm-matrix.thehellings.lan"
         # Mac
         "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBT5BFHQz1I5k/zkLQNLjL77EaqfdpRiF2Ci4eS9LMDK gregory.hellings@jude.thehellings.lan"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPVlMoN2pkKRRwKNuMbMczki5ybR34wvjdgDNlgR74Wh greg@gregs-MacBook-Pro-16-inch-Nov-2024"
       ];
       homeMode = "500";
       isNormalUser = true;

modules/nixos/syncthing.nix

@@ -18,7 +18,6 @@ with lib;
         devices = {
           chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
           genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
-          gitlab.id = "GKNOZWI-CNC2Q2F-R5GGGDX-RYFGHK4-CCC37LC-GVOEMJI-46QPC6G-AWFEOQE";
           linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
         };
         options = {

network.json

@@ -2,8 +2,11 @@
   "infra": {
     "dns": "10.42.1.5",
     "gw": "10.42.1.1",
+    "lan": "10.42.0.0/16",
     "netmask": "255.255.0.0",
-    "prefix": "16"
+    "nebula": "10.157.0.0/16",
+    "prefix": "16",
+    "tailscale": "100.64.0.0/10"
   },
   "hosts": {
     "chronicles": {
@@ -24,10 +27,7 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO/CGE2rqlL2Qr0TJkwQMsHFSDkhGWlrUlvfcvcylO1n",
       "ts": "100.96.198.104",
       "system": "x86_64-linux",
-      "tags": [
+      "tags": ["router", "server"],
-        "router",
-        "server"
-      ],
       "nebulaIp": "10.157.0.2"
     },
     "hosea": {
@@ -35,9 +35,7 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz",
       "ts": "100.68.203.1",
       "system": "x86_64-linux",
-      "tags": [
+      "tags": ["server"],
-        "server"
-      ],
       "nebulaIp": "10.157.0.3"
     },
     "icdm-root": {
@@ -50,24 +48,18 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf",
       "ts": "100.84.183.79",
       "system": "x86_64-linux",
-      "systems": [
+      "systems": ["x86_64-linux", "aarch64-linux"],
-        "x86_64-linux",
+      "tags": ["builder", "kube", "server"],
-        "aarch64-linux"
-      ],
-      "tags": [
-        "builder",
-        "kube",
-        "server"
-      ],
       "nebulaIp": "10.157.0.4"
     },
     "iso": {
       "external": true,
       "system": "x86_64-linux"
     },
-    "ivr": {
+    "gregory.hellings-mbp": {
       "external": true,
-      "system": "aarch64-darwin"
+      "system": "aarch64-darwin",
+      "user": "gregory.hellings"
     },
     "jeremiah": {
       "builder": true,
@@ -75,15 +67,8 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0",
       "ts": "100.102.186.39",
       "system": "x86_64-linux",
-      "systems": [
+      "systems": ["x86_64-linux", "aarch64-linux"],
-        "x86_64-linux",
+      "tags": ["builder", "kube", "server"],
-        "aarch64-linux"
-      ],
-      "tags": [
-        "builder",
-        "kube",
-        "server"
-      ],
       "nebulaIp": "10.157.0.5"
     },
     "joel": {
@@ -91,24 +76,33 @@
       "ip": "10.42.0.4",
       "ts": null
     },
+    "gregs-MacBook-Pro-16-inch-Nov-2024": {
+      "external": true,
+      "system": "aarch64-darwin"
+    },
+    "lithic": {
+      "external": true,
+      "system": "aarch64-darwin"
+    },
     "linode": {
       "ip": null,
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
       "ts": "100.109.86.8",
       "system": "x86_64-linux",
-      "tags": [
+      "tags": ["public", "server"],
-        "public",
-        "server"
-      ],
       "nebulaIp": "10.157.0.1"
     },
+    "ivr": {
+      "external": true,
+      "system": "aarch64-darwin"
+    },
     "MacBook-Pro.local": {
       "external": true,
-      "system": "aarc64-darwin"
+      "system": "aarch64-darwin"
     },
     "MacBook-Prolocal.local": {
       "external": true,
-      "system": "aarc64-darwin"
+      "system": "aarch64-darwin"
     },
     "nas1": {
       "external": true,
@@ -119,13 +113,14 @@
       "external": true,
       "system": "x86_64-linux"
     },
+    "printer": {
+      "external": true,
+      "ip": "10.42.1.3"
+    },
     "proxmoxtemplate": {
       "external": true,
       "system": "x86_64-linux"
     },
-    "gitlab": {
-      "system": "x86_64-linux"
-    },
     "wsl": {
       "external": true,
       "system": "aarch64-linux"
@@ -136,15 +131,8 @@
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0",
       "ts": "100.90.74.19",
       "system": "x86_64-linux",
-      "systems": [
+      "systems": ["x86_64-linux", "aarch64-linux"],
-        "x86_64-linux",
+      "tags": ["builder", "kube", "server"],
-        "aarch64-linux"
-      ],
-      "tags": [
-        "builder",
-        "kube",
-        "server"
-      ],
       "nebulaIp": "10.157.0.6"
     }
   }

overlays/default.nix

@@ -10,7 +10,6 @@ final: prev:
       in
       {
         daikinone = cp ./daikinone.nix { };
-        xonsh-apipenv = cp ./xonsh-apipenv.nix { };
       }
     )
   ];
@@ -25,7 +24,6 @@ final: prev:
     withBDplus = true;
   };
   handbrake = prev.handbrake.override { libbluray = final.libbluray-custom; };
-  pipenv-ivr = prev.callPackage ./pipenv.nix { };
   OVMFFull = prev.OVMFFull.override {
     secureBoot = true;
     msVarsTemplate = true;

overlays/pipenv.nix

@@ -1,92 +0,0 @@
-{
-  lib,
-  stdenv,
-  python3,
-  fetchFromGitHub,
-  installShellFiles,
-}:
-
-let
-
-  runtimeDeps =
-    ps:
-    with ps;
-    [
-      certifi
-      pysocks
-      setuptools
-      (pip.overridePythonAttrs {
-        dependencies = [ ps.pysocks ];
-      })
-      virtualenv
-      virtualenv-clone
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isAndroid [ pyjnius ];
-
-  pythonEnv = python3.withPackages runtimeDeps;
-
-in
-python3.pkgs.buildPythonApplication rec {
-  pname = "pipenv";
-  version = "2023.11.15";
-  format = "pyproject";
-
-  src = fetchFromGitHub {
-    owner = "pypa";
-    repo = "pipenv";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-kxwyws22xJkqBy/hXXcAPHZR2NgZHbmwZr9vYqce434=";
-  };
-
-  env.LC_ALL = "en_US.UTF-8";
-
-  nativeBuildInputs = with python3.pkgs; [
-    installShellFiles
-    setuptools
-    wheel
-  ];
-
-  postPatch = ''
-    # pipenv invokes python in a subprocess to create a virtualenv
-    # and to call setup.py.
-    # It would use sys.executable, which in our case points to a python that
-    # does not have the required dependencies.
-    substituteInPlace pipenv/utils/virtualenv.py \
-      --replace "sys.executable" "'${pythonEnv.interpreter}'"
-  '';
-
-  propagatedBuildInputs = runtimeDeps python3.pkgs;
-
-  preCheck = ''
-    export HOME="$TMPDIR"
-  '';
-
-  nativeCheckInputs = with python3.pkgs; [
-    mock
-    pytestCheckHook
-    pytest-xdist
-    pytz
-    requests
-  ];
-
-  disabledTests = [
-    "test_convert_deps_to_pip"
-    "test_download_file"
-  ];
-
-  disabledTestPaths = [ "tests/integration" ];
-
-  postInstall = ''
-    installShellCompletion --cmd pipenv \
-      --bash <(_PIPENV_COMPLETE=bash_source $out/bin/pipenv) \
-      --zsh <(_PIPENV_COMPLETE=zsh_source $out/bin/pipenv) \
-      --fish <(_PIPENV_COMPLETE=fish_source $out/bin/pipenv)
-  '';
-
-  meta = with lib; {
-    description = "Python Development Workflow for Humans";
-    license = licenses.mit;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ berdario ];
-  };
-}

overlays/xonsh-apipenv.nix

@@ -1,31 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  toPythonModule,
-  pipenv,
-  setuptools,
-}:
-
-buildPythonPackage rec {
-  pname = "xonsh-apipenv";
-  version = "0.6.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "greg-hellings";
-    repo = "xontrib-apipenv";
-    rev = version;
-    hash = "sha256-Wa8iev0ow1oh95tPCv5tAJUMBYiStWms8I31WbVcOok=";
-  };
-
-  dependencies = [ (toPythonModule pipenv) ];
-  build-system = [ setuptools ];
-
-  meta = with lib; {
-    description = "Auto pipenv support for Xonsh";
-    homepage = "https://github.com/greg-hellings/xontrib-apipenv";
-    license = licenses.mit;
-    maintainers = [ ];
-  };
-}

pkgs/adblock_update.nix

@@ -0,0 +1,21 @@
+{
+  writeShellApplication,
+  curl,
+  gnused,
+}:
+writeShellApplication {
+  name = "adblock-update";
+  runtimeInputs = [
+    curl
+    gnused
+  ];
+  text = ''
+    curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
+    curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
+
+    # Custom domains that I need to preserve for some reason
+    for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com" "click.discord.com"; do
+     	sed -i -e "/''${f}/d" /etc/adblock_hosts  # Blocks Trelly content for house investors
+    done
+  '';
+}

pkgs/default.nix

@@ -12,6 +12,7 @@ in
   #iso = top.self.nixosConfigurations.iso.config.system.build.isoImage;
   #iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
   aacs = c ./aacs.nix { };
+  adblock_update = c ./adblock_update.nix { };
   brew = c ./homebrew.nix { };
   create_ssl = c ./create_ssl.nix { };
   gcc-tune = c ./gcc-tune.nix { };

pkgs/inject-darwin.nix

@@ -3,6 +3,7 @@
   coreutils,
   curl,
   gnutar,
+  inetutils,
   nix,
   ...
 }:
@@ -12,27 +13,17 @@ writeShellApplication {
     coreutils
     curl
     gnutar
+    inetutils
     nix
   ];
   text = ''
-    dir="$(mktemp -d)"
-    cd "''${dir}"
-
-    # Install nix-darwin
-    nix-build https://github.com/LnL7/nix-darwin/archive/master.tar.gz -A installer
-    ./result/bin/darwin-installer
-
     # Get my configuration
-    mkdir -p ~/.config/darwin
+    cd /etc/nix-darwin
-    cd ~/.config/darwin
-    curl -O -L https://github.com/greg-hellings/nixos-config/archive/refs/heads/main.tar.gz
-    tar xvzf main.tar.gz --strip-components 1
 
     # Build NixOS for this system
-    pushd "''${dir}"
+    nix --extra-experimental-features "nix-command flakes" build ".#darwinConfigurations.$(hostname -s).system"
-    nix build "''${HOME}/.config/darwin#darwinConfigurations.$(hostname -s).system"
+    sudo mv /etc/bashrc /etc/bashrc.before-nix-darwin
-    ./result/sw/bin/darwin-rebuild switch --flake ~/.config/darwin
+    sudo mv /etc/zshrc /etc/zshrc.before-nix-darwin
-    popd
+    sudo ./result/sw/bin/darwin-rebuild switch --flake .
-    rm -r "''${dir}"
   '';
 }

secrets/gitlab/db-password.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg Eh2E7tXjZj6ydDOSsFD8UKMjSjLWW6YZg/5bzcdMaSU
-0vXZ9AGU3N8Jbep6TRijGKoo89jK0yauG1LmErtdT70
--> ssh-ed25519 8UnW5Q UxbfpTqUcjkdevd0WwFtUxifEtDvedj8l+V2wFVjThw
-6aYQDmzFj1fin7G7e0cUCn55PBU8bDolkw4l+5A25qY
--> ssh-ed25519 UFfTmg Dfm/r13wimRQT2hQSWKhyr14BZliLrLGn/sZq3G3yTY
-qzZLiowHu+HnSY31yXBOFPEYn2lJSJ5MyWvKSe2QZcI
--> ssh-ed25519 xNtnoA AltIha0Z9BqZY4V8LOzCcr5KPWAvoNoyktReER3Glgs
-ac51BT1NGldAn6N/s7KEkNrRLhmntwx09SguGdZRR5o
--> ssh-ed25519 aY2AXA EmE9Bjzme13LSSMZDnJsPFvpXGamtc/H3DOziP+d+Cg
-VN5z1+EzLF6N232QwkO5TT5Kf9NpoPDL2T50qCpCfgc
--> ssh-ed25519 AQhf1g Z3Ezie7ikLb/8u+iNALI8x327lFqLN1NRIqHLfjqNFs
-QQDDH6Dio4zc0FCsLDRWl3ywaEdkp4zwGG+Iaegmi3I
--> ssh-ed25519 mOmPfg mSW3OSIm9/8myqUxEJlsf0LT7vCO9i6/D3WkWKCD7l4
-U6TkEVyzxnb+9B2wLeEkQ4g6w5s31Q30/Q4ehQplf3c
--> ssh-ed25519 YJiRbw Gs9VBwzEPr1QA1PcaQUCUwS+jwXYVniqe5TaZBjrJmQ
-rFS24MN8bzA+vj6/sJHuEC4yYglpf0OJT0GgUVm0HTs
--> ssh-ed25519 0/WsKg MbcckXyUg5JfGafnhidk4dH6mEuhZOPac4YncYeYOR4
-oeFwgCrjDPauQSCgE1Q1/Smz6SI44TVfuNH0oP9WcdM
--> ssh-ed25519 Nl/5yA 9xL4/5nxpciN9HFFO/X3xQ1oMe+EvLohnI6631amwhw
-n4As363EPOxuzN5f5RNuUrlEDFgmhVvjtEosQKTPVII
--> ssh-ed25519 GdLgCQ P+jwMHdoS74jIdGQjOx4sDngWs+zxNpnzSgrDXD7Vkk
-NuGd8agrw/8PT+dw9RirCYATZRPnF5rKDSfyDaJ17iw
--> ssh-ed25519 tOH/HQ u7gM8oYWpfFFW54TqoisGDEeX5MKxaVxT+ozl4miF0I
-avmdzbzCSDv4ovYMMmqx//G5FVEuz+hOJpr9/49w1Rk
--> ssh-ed25519 FpzvfQ 3bDfVBMNavjfMFaKO8C5VvXiDMQxfB4WYp9mJ1LnIQI
-bl1KwNL5M8gJlqE/R5/lY7UlLOgeftiwinyC8yDb71A
--> ssh-ed25519 kdPvzQ 2Y9lCbnjBhF3N0BTzhBqxJ/NDe7Z9/Vpkd8bbL29D0k
-pL4VMb6jnQv4bwt5SjcORlTWsvSWOhTNZXNYEkCZH5E
--> ssh-ed25519 onmXpg 2Nw16oXRct8XDRqs6TRiOK6tBk9kNZcR2VDLy9GvOkM
-N95+6Ia9lpbKenojMDDAuLrT4cqjENsWzrwplcBKiUs
--> ssh-ed25519 CnhD0g j7udTMCoQHrqYnH/mxGgRzor7RaTm2HjaSwuoVQqCGw
-ivg32RGKKCqe2yBjq58ym8shWlrYNfcvuK7xy1F2mmg
--> ssh-ed25519 4ep2UA bBdPC5asgGcu60Y/i0yVKvAQc9U+7Jruik0xT8rDUA0
-ul6uiMBstdXVVmuIpgsZPSt6MQiyklPGYSbxOTLndeQ
---- 5mAFqAG9hgU00QxYRKkhNl3fJ1KwDevvTnUhf0xYUog
-TW"	ȧ]h|nÁdÇ„Œô¡QFWv¬à©»®¨oµiÅZÂSŸŽ‡ÑG–í`|Д "�¬ó8n}:Î:ú6”

secrets/gitlab/db.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg KMaYb+ubBiCqBKr08lmrIhiuNcvH/WnnEDYYvdgnvgk
-lJM8dGwT3LYvI9NtPZOzY94bFhk6sxO6F4NCMJBDBuA
--> ssh-ed25519 8UnW5Q rUXfXe6S1jgTfJJGhT3NfIGhvYaf4aUAuD7wAa5GaxU
-OCe5kE+IM1MHqMPfLpgO5spYxDm1SDp5euubLkOF6K4
--> ssh-ed25519 UFfTmg 8ZIBc9wr/hoQE/ItltZhSbqlZ3qEQMyLajy0cORbOQo
-DocUbgXT5m8CgExF1ICAJv+Nu4rBogwaYz5vJKNRQhs
--> ssh-ed25519 xNtnoA x0uU0K78XzA9yYXg+jR6MIJASRxsJ9eMZctm276tP08
-SGZYFFkfbQpLVqV9OUQMMbOmv+0qNS3bO7IkWWjqohE
--> ssh-ed25519 aY2AXA D5xP6cDYNLUsGeLgLO2x2gkBzfPByR58G2PjjGs/rxA
-wiqNVVjyQPnZop7q0PXmOOw7cJr8WKQVl1mk7zL+/cM
--> ssh-ed25519 AQhf1g MJuVLCVIdZ7fKnXVvtJvSLriX1Q+2u20Y+aNI7N75hM
-EocXr6NlaanErb3Nmc9R+3DSdfoCAyHa5gDYzBX+xJk
--> ssh-ed25519 mOmPfg wbQrmVm8CEeAHpJIjCyFI7Mfhn3i9bER7FppanAneTQ
-jAvjziCLYUl//6ZlZ5d3gE1ONRjhEnPLTabvTJEhFg4
--> ssh-ed25519 YJiRbw 6ZAb7+mWKPCkYZrpcW1g1JoL9Q72rWwLIEZJtPx4ayY
-WtKeYr7wxCVisATDyejwnasFcVRtGa175wJoXNzhyKk
--> ssh-ed25519 0/WsKg yyQBUeYAFIJUuH6xsMYztjO8zeswUWFCgqiNoMqxijY
-y5azJJfyU9NgyY8kuIoWRfY1kMJUzgxx8UtqJ3XBNvI
--> ssh-ed25519 Nl/5yA Ffb3McX/NVo56cJXA51n9yrpeSTvD5/0S9n7ObeYrXA
-Wg1EhU0nk/Wh3Jf3+LY6dVLXBNbAM8miuC8gYdabIwY
--> ssh-ed25519 GdLgCQ x/k3xO9fHAPFeOdeAwgWVNqWtU9u6RVXXNUnhUXk1B8
-aNeOSmnUILJTjof6+7sN8h2zA+pqBmU6cpmD81xcmtw
--> ssh-ed25519 tOH/HQ ZEBu38T0q6tZkZSZIbGc3Kn9acTGqSbquPC6xlXt90o
-LPvS9dVaPUiE5nxVV8LsAjfRdyKBNmCwGTxOcyCxWMA
--> ssh-ed25519 FpzvfQ iU+7myrJIbc+xbVZf7OxGSBy7Vq+FqItVYECvrvV7V4
-YkMvBRDnkGf+zznWTVSbFbR/2BaqOT1ja7piiyRL+uM
--> ssh-ed25519 kdPvzQ cuzIgrPaJK1SY4soXT2lQkF8Ji7GZq+ihH2vYmbyDXY
-E7cA3PDHBsqm7Z9SbflHXQXMzv7B0uxYR4UQv9NHZ70
--> ssh-ed25519 onmXpg aNcwAfrg7CfnC9Whp/qjikADbZzeSVM0m+kLkjExg1A
-1RWx1F4Q6zA91UHxBmvuxqABv+mZZwNayAVAz0EqGQg
--> ssh-ed25519 CnhD0g LrFzQX5UKZAizqYkDCT/k6CWdFZYFqPguyLjgfcfQ2U
-O7Ta5mpAcLI2XswerqtW2fC0evmy/gdSQqLgW7L99zo
--> ssh-ed25519 4ep2UA 8B0v6mE+hB0iKaZNrkvdlI4E2y4lWNR4zJ8oJS75jR0
-l5M6WSWKGuHMCiL5V5PCyDfFCElGNmR5UIkXRivSl5Y
---- 1PM/nhbi3rtn26S1rtNwUT97plbJJvHOmPNzIYAsK4w
-W'SàeÚäß>pÎ_­Çª´vcHN›×9¥Å¡àè6�L,_ž[
3Ì
_ìaØí¬¤Õ¦‚>¶¯D0Þ„lô‡F4.Ó’‰µ5±:�úà�0ò±É

secrets/gitlab/jws.age

@@ -1,37 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 87huqg 3CNYW4sCTBsHWQaRdsyRomLXQ5V9jjzV+V9vHcKtqjc
-ZjGxC8Fqddlzmdd4uZxQWs9aAut+COJ9zWXZFQvRdG8
--> ssh-ed25519 8UnW5Q rgmZ4hwUDXX8VdQQWxZn5NO70j4IuJ1l9aD6uXjAWiE
-SfmW+u09bGEP164j1awAoGpvchg9UZS7tgtSdLeepB8
--> ssh-ed25519 UFfTmg MPZCtrzXXzusawPkfZ+fBWepH7MZihKXlz9ztfp/bBU
-RkLU9HPTJjyiaRczJU3sYMT0RT+oSvL3TozGRxOZM6s
--> ssh-ed25519 xNtnoA HqhyTh67Yww4wHVR9i5+K7388nvAYwkPr1T95Sn3WDk
-entg7nxJXWqq+N0LMUwv+psL+O6ivZjnGo+KbgKthxM
--> ssh-ed25519 aY2AXA XTpM0SssYVVEtnWPCfooazXvVccdO4IX+Zmp7dxoDUY
-mz6v4rzOpLT4fu+XYC5BwkXndNoBbEpazUt2wh0tutk
--> ssh-ed25519 AQhf1g bUAsCyBen89j8JqUV3qAVTZ5QrxluYOmUO7D68Sd50k
-14ebyL+xFEK8NMBzxAArVaxCPZwBPLNBLdalC9TGB/I
--> ssh-ed25519 mOmPfg Mv+p2kGC4PunQGSVD28emoEDra/ohZHK/xxTQVhafTM
-gUrUjDQCxMfgcjWkbGWmi1A2GF5X07pUKdZuuaXWdcE
--> ssh-ed25519 YJiRbw 0jxrJSU71zCnF1bDUieGOsc/TAeR9gv/1ks2kPN2sD0
-yho+rheLys+ET7uKrrlsljQZQ8VuUnzg5eUj7gVMgAk
--> ssh-ed25519 0/WsKg yxsm0H6tRCron9th/e9KfX+zFl5T3DH0/B602ak0s28
-kkmfbZ1SyXLJxlM/EeBRJEf0Rb+15w3nXZEZ35xuCug
--> ssh-ed25519 Nl/5yA IoFwKIz+jrNUm4PB3wX5okeqtPKANPP+/lcZaJ+mZ00
-0ChPqTpzLCCz7die5lgOnO+Yz8JQIqjTX5oLwXv/IbU
--> ssh-ed25519 GdLgCQ Fo9YJGiJMTpnhRQKd2cQ7XfQXLvOQ8+V5rlZvqOhWgQ
-Lhie4dV3210DbNvbkBWFStgycrH3xgE3tt5PYF0OjEU
--> ssh-ed25519 tOH/HQ 7BXNJ/wYMc9HIswKCTkXQF42UXKXCCqcD7/RQINx5g0
-G2HbqhnEuoCGmuowye/EWQJ1UWojp1cFLoyu6b5AaGA
--> ssh-ed25519 FpzvfQ l5jORObNye/4CGt9D0pkP7CAqhWZPPlEhCSmuc5JxVE
-5P/S8vQEzlYgXcM+TxlQnlyO6fK0lUkxBElfTZ8dR14
--> ssh-ed25519 kdPvzQ rbwguFPeDqBJye6fzNAR+zqo3vA13o8VBqTDMtq/xF0
-0wjGYDkSgeB1H4GvjFfM5HIxCFs1s6R/6US0TFv/o0I
--> ssh-ed25519 onmXpg GB5Hi8wAOxRaoyzcDuHK96+JNd/zfBdmR6oJdpYkmi8
-svDcX5tYRR8IzuQi36TpxqKu/vKiDj290e1Hx/RoBAs
--> ssh-ed25519 CnhD0g 4vM1+uQTV/dYAbYP7Nsj9DZFjFVc1yFqNzKxWyz1OWQ
-G7ifv77YIefxMqK1vSEzxPCxQaf8Sd2cdpyoy3DxGZg
--> ssh-ed25519 4ep2UA V+2q8xrX8eAQzuNV8Se/BUtut4EbkRsy/svnbRVO1TM
-WYJTqLxIqFC3a4z3UtMp4z7CAXEZ2NJUGzxftIvgoeQ
---- t27r1Bedv2MW11oCtfWXl0ijG9/aiiWMdEbgymIqdSY
-§66^¹‹�§ÌVUÃuï6°â$	ÜQ[a²U�W*©Ò&s9Iª23HœR÷ÖOJŠüÒ§É)CXeRýŽXi¾6yØB:b<tWÓ­¹nÀ>\+ûî