chore: connect buildbot and gitea by tailscale

fix: buildbot domain name
chore: update flake.lock 2026-05-24
2026-05-28 16:57:05 -05:00 · 2026-05-26 07:48:39 -05:00 · 2026-05-24 21:30:35 -05:00 · 2026-05-24 21:25:50 -05:00 · 2026-05-21 13:19:26 -05:00 · 2026-05-20 03:27:45 -05:00
18 changed files with 244 additions and 213 deletions
@@ -1,5 +1,6 @@
 {
  pkgs,
+  pkgs',
  top,
  ...
 }:
@@ -33,7 +34,7 @@ in
 {
  environment.systemPackages = with pkgs; [
    agenix
-    hms
+    pkgs'.hms
  ];

  fonts.packages = with pkgs; [
@@ -41,12 +42,13 @@ in
    nerd-fonts.hack
  ];

-  launchd.daemons.darwin-builder = builder;
+  #launchd.daemons.darwin-builder = builder;

  nix = {
+    #buildMachines = [ { systems = ["aarch64-linux"]; sshUser = "builder"; sshKey = "/etc/nix/builder_ed25519"; hostName = "localhost:31022"; protocol = "ssh-ng"; }];
    enable = true;
    gc.interval.Hour = 3;
-    linux-builder.enable = true;
+    #linux-builder.enable = true;
    settings.auto-optimise-store = false; # Darwin bugs?
  };

@@ -19,6 +19,7 @@ let
      specialArgs = {
        inherit metadata top;
        inherit (top) self;
+        pkgs' = top.self.packages.${system};
      };
      modules = [
        {
@@ -25,19 +25,17 @@
    },
    "buildbot": {
      "inputs": {
-        "flake-parts": "flake-parts",
-        "hercules-ci-effects": "hercules-ci-effects",
        "nixpkgs": [
          "nixunstable"
        ],
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1776626072,
-        "narHash": "sha256-NF6x9h74mrA0Acl1JHWwuSSrwzyTm3KyV8a85QUqTW0=",
+        "lastModified": 1779096866,
+        "narHash": "sha256-8HtF1G7OPMXzo+f+0W+7zwzhuBUSk2EMrOS4ZvFw7+I=",
        "owner": "nix-community",
        "repo": "buildbot-nix",
-        "rev": "f298855ee69709374a25ae9543ad11bd549d7b8b",
+        "rev": "891f2baba218f4365f0c6ef96ea33f9b277f5ed0",
        "type": "github"
      },
      "original": {
@@ -97,11 +95,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775037210,
-        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
+        "lastModified": 1779036909,
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
        "type": "github"
      },
      "original": {
@@ -161,17 +159,14 @@
    },
    "flake-parts": {
      "inputs": {
-        "nixpkgs-lib": [
-          "buildbot",
-          "nixpkgs"
-        ]
+        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
        "type": "github"
      },
      "original": {
@@ -182,14 +177,17 @@
    },
    "flake-parts_2": {
      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
+        "nixpkgs-lib": [
+          "nixvimunstable",
+          "nixpkgs"
+        ]
      },
      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
        "type": "github"
      },
      "original": {
@@ -199,27 +197,6 @@
      }
    },
    "flake-parts_3": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nixvimunstable",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_4": {
      "inputs": {
        "nixpkgs-lib": [
          "nurpkgs",
@@ -255,31 +232,6 @@
        "type": "github"
      }
    },
-    "hercules-ci-effects": {
-      "inputs": {
-        "flake-parts": [
-          "buildbot",
-          "flake-parts"
-        ],
-        "nixpkgs": [
-          "buildbot",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1776380511,
-        "narHash": "sha256-3A2B8k6YCuzt5pT/CQEltUghtE6heSlk2tMYkg/fUWI=",
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "rev": "4a80b7e95a298b7bb4418c0a2b55fe95a662c377",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "hercules-ci-effects",
-        "type": "github"
-      }
-    },
    "hmunstable": {
      "inputs": {
        "nixpkgs": [
@@ -287,11 +239,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776904464,
-        "narHash": "sha256-sBUCj7/4d3Hoevpu3oQp8ccJNA1EDeVmFi1F8O6VJro=",
+        "lastModified": 1779507042,
+        "narHash": "sha256-7wOwi8B6D0BYsieZCnHZZj2sNUzgJhLoIVSfkwB7lxQ=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "667b3c47325441e6a444faaf405bba76ec70338a",
+        "rev": "509ed3c603349a9d43de9e2ae6613baea6bd5b34",
        "type": "github"
      },
      "original": {
@@ -329,11 +281,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1777001712,
-        "narHash": "sha256-9JX9msZU1NvHzjKM24PRorP76Ge8GBy6LAkJKA21mlY=",
+        "lastModified": 1779508581,
+        "narHash": "sha256-qZjcS4jRe0pUv4ZAFCyr7ELFrb3LPLr+5u8LHRZjMVQ=",
        "owner": "Infinidoge",
        "repo": "nix-minecraft",
-        "rev": "394d3bfd943458baf29e4798bc9b256d824a3bb9",
+        "rev": "e13397b445bb0dcb390f90126914113ec5dd5afe",
        "type": "github"
      },
      "original": {
@@ -348,11 +300,11 @@
        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1778431771,
-        "narHash": "sha256-5cOjpGIdh1D3vsoOA8r21ACJBMulhg240MRaBNTbPLI=",
+        "lastModified": 1779223902,
+        "narHash": "sha256-qQogttCU2zOyK7MN85yPaUxxN2u0BN9zabfO4X7FwNg=",
        "owner": "Mic92",
        "repo": "niks3",
-        "rev": "2fd07c218b5575e30b7e62da56e6ddd6899f59db",
+        "rev": "1db826ca990cb3dead5c033bcfba4bf68ce9fc05",
        "type": "github"
      },
      "original": {
@@ -384,11 +336,11 @@
    },
    "nix-hardware": {
      "locked": {
-        "lastModified": 1776830795,
-        "narHash": "sha256-PAfvLwuHc1VOvsLcpk6+HDKgMEibvZjCNvbM1BJOA7o=",
+        "lastModified": 1779258371,
+        "narHash": "sha256-j1iZsLy6oFApqR1oiDmHhvkwxXqcNi0aoSJj643LuwU=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "72674a6b5599e844c045ae7449ba91f803d44ebc",
+        "rev": "c97bc4d15bd3473dd095e8e8ba57330ab1943a77",
        "type": "github"
      },
      "original": {
@@ -415,11 +367,11 @@
    },
    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1774748309,
-        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
+        "lastModified": 1777168982,
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
+        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
        "type": "github"
      },
      "original": {
@@ -430,11 +382,11 @@
    },
    "nixpkgs-lib_2": {
      "locked": {
-        "lastModified": 1778379128,
-        "narHash": "sha256-+yjPmoKsTqe/FQHriXzIfI0ELuEt3+1LXc0BE8nU/Yc=",
+        "lastModified": 1778984393,
+        "narHash": "sha256-r755Kh5Q0XBTPNuv9rL2rsUJTq8BDhb+lIwRWhl6yYA=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "e361b0ff94723bc94283566dc2a13a46f07eaf5c",
+        "rev": "0d14a58ab7aa3f513c58ccc9e47e77ffd92be204",
        "type": "github"
      },
      "original": {
@@ -461,11 +413,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1777929473,
-        "narHash": "sha256-TpVPahLM+DGWN+L/k2okrIsrjTfKLjC1xVAy1zX4G0s=",
+        "lastModified": 1779142197,
+        "narHash": "sha256-Fypu3KtYQ+ZXL91CZIGqS3ZKwrMH6GOSPCtJ07W3ecU=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "69710ea485067ba4ff64681ebde9bcc87f897dec",
+        "rev": "d4d6b67b138722feb847a75760a430943c33f4ef",
        "type": "github"
      },
      "original": {
@@ -477,11 +429,11 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1776548001,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
+        "lastModified": 1779508470,
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
        "type": "github"
      },
      "original": {
@@ -493,27 +445,27 @@
    },
    "nixpkgs_5": {
      "locked": {
-        "lastModified": 1766025857,
-        "narHash": "sha256-Lav5jJazCW4mdg1iHcROpuXqmM94BWJvabLFWaJVJp0=",
+        "lastModified": 1777207419,
+        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
        "type": "github"
      }
    },
    "nixunstable": {
      "locked": {
-        "lastModified": 1776548001,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
+        "lastModified": 1779508470,
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
        "type": "github"
      },
      "original": {
@@ -525,18 +477,18 @@
    },
    "nixvimunstable": {
      "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_2",
        "nixpkgs": [
          "nixunstable"
        ],
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1776830812,
-        "narHash": "sha256-L2q0bpa6evlzE4IfIQ7JWqhTAuINggUSIxMmOAxUsCg=",
+        "lastModified": 1779554657,
+        "narHash": "sha256-qjLcUp7DBpmSUL+nVjLymp2nEvAzeKKoAVDCRgZYxFk=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "53aad7a9aaadaec21d740117ba0f0531b9a9b3cd",
+        "rev": "1a380f12453ba97ad8cc9c60f223afb1cb8bace8",
        "type": "github"
      },
      "original": {
@@ -548,15 +500,15 @@
    },
    "nurpkgs": {
      "inputs": {
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_3",
        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1776910402,
-        "narHash": "sha256-SvRshrmzz9SmiiflE+Ph2RQ2YJkmQRpluebVt94mHPQ=",
+        "lastModified": 1779579389,
+        "narHash": "sha256-YbWzWejE/QRBLQN9VKBL66byuTFPvncQgiv4NC25lN4=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "b3ab759ea8da0d514dbbcb89e269fd59676a92ae",
+        "rev": "65439f69b3bcf6b26b8a7c92c26bd09066fdf9c5",
        "type": "github"
      },
      "original": {
@@ -571,7 +523,7 @@
        "buildbot": "buildbot",
        "colmena": "colmena",
        "darwin": "darwin_2",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts",
        "hmunstable": "hmunstable",
        "minecraft": "minecraft",
        "niks3": "niks3",
@@ -692,11 +644,11 @@
        "nixpkgs": "nixpkgs_5"
      },
      "locked": {
-        "lastModified": 1776828494,
-        "narHash": "sha256-gQ5+syn8ndyF/+c5g5ZpeAScNKhkTF4/63JsO2hqGHo=",
+        "lastModified": 1779507994,
+        "narHash": "sha256-vw/u69n4vPibpWNUVkbwlfVHQukg3xcuKoHwCXJkOvc=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "ea6764d22ff5478f5db39ede57eeafc70d14e8e6",
+        "rev": "375f9dc68aa90ccff57891af5dfe1d5fb2a9b20a",
        "type": "github"
      },
      "original": {
@@ -713,11 +665,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776910211,
-        "narHash": "sha256-0ku3gW8bZ9TTpEU2fQw86oU6ZLT2vF6pacF+cLaf7VY=",
+        "lastModified": 1777732699,
+        "narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "4e6cad241baa0115a7aae8c55b04c166da4997c9",
+        "rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
        "type": "github"
      },
      "original": {
@@ -86,6 +86,7 @@
                  self
                  top
                  ;
+                pkgs' = top.self.packages.x86_64-linux;
              };
            };
          }
@@ -20,3 +20,4 @@ builds:
      # to build at home
      - homeConfigurations."gregory.hellings-mbp"
      - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
+      - homeConfigurations.ivr
@@ -13,25 +13,23 @@
    includes = [ "config.local" ];
    enableDefaultConfig = false;

-    matchBlocks =
+    settings =
      let
        nas = {
-          user = "admin";
+          User = "admin";
        };
        owned = {
-          user = "greg";
+          User = "greg";
        };
      in
      {
        inherit nas;

        "*" = {
-          dynamicForwards = [ { port = 10240; } ];
-          serverAliveInterval = 60;
-          extraOptions = {
-            LogLevel = "error";
-            SetEnv = "TERM=xterm-256color";
-          };
+          DynamicForward = [ "10240" ];
+          ServerAliveInterval = 60;
+          LogLevel = "error";
+          SetEnv = { TERM = "xterm-256color"; };
        };

        "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -41,46 +39,46 @@
        "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;

        gh = {
-          user = "git";
-          hostname = "github.com";
+          User = "git";
+          Hostname = "github.com";
        };
        "src" = {
-          user = "git";
-          hostname = "jeremiah.shire-zebra.ts.net";
-          port = 32222;
+          User = "git";
+          Hostname = "jeremiah.shire-zebra.ts.net";
+          Port = 32222;
        };
        srcpub = {
-          user = "git";
-          hostname = "src.thehellings.com";
-          port = 2222;
+          User = "git";
+          Hostname = "src.thehellings.com";
+          Port = 2222;
        };
        ivr = {
-          user = "git";
-          hostname = "gitlab.com";
+          User = "git";
+          Hostname = "gitlab.com";
        };

        "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          user = "gregory.hellings";
+          User = "gregory.hellings";
        };

        "*.thehellings.lan" = owned;
        "10.42.*" = owned;

        "host.crosswire.org crosswire" = {
-          hostname = "host.crosswire.org";
-          user = "ghellings";
+          Hostname = "host.crosswire.org";
+          User = "ghellings";
        };

        fedpeople = {
-          hostname = "fedorapeople.org";
-          user = "greghellings";
+          Hostname = "fedorapeople.org";
+          User = "greghellings";
        };

        "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          user = "greghellings";
+          User = "greghellings";
        };

-        "127.*".extraOptions = {
+        "127.*" = {
          PubkeyAcceptedAlgorithms = "+ssh-rsa";
          HostkeyAlgorithms = "+ssh-rsa";
        };
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:

 {
  greg = {
@@ -36,4 +36,13 @@
      settings.SKIP_HOST_UPDATE = true;
    };
  };
+  xdg.desktopEntries = {
+    prismlauncher = {
+      name = "Prism Launcher - Minecraft";
+      actions.minecraft = {
+        name = "Minecraft";
+        exec = lib.getExe pkgs.prismlauncher;
+      };
+    };
+  };
 }
@@ -62,6 +62,7 @@
          serverProperties = {
            allow-flight = true;
            motd = "Maya's Minecraft World";
+            online-mode = true;
          };
          whitelist = { };

@@ -128,8 +129,8 @@
                # Better storage engines
                # https://www.curseforge.com/minecraft/mc-mods/refined-storage
                refined-storage = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/8032/790/refinedstorage-fabric-3.0.0-beta.8.jar";
-                  hash = "sha256-XY5I+sw5JlWnKK/hPUOJsk2gnmqH4Iygq+aooN27NJY=";
+                  url = "https://mediafilez.forgecdn.net/files/8086/588/refinedstorage-fabric-3.0.0.jar";
+                  hash = "sha256-LuOF0aYQon78AQeD5fQ8OXHCnekfa+PNKpH7cqimFNs=";
                };
                # https://www.curseforge.com/minecraft/mc-mods/storage-drawers
                #storagedrawers = pkgs.fetchurl {
@@ -115,10 +115,15 @@ in
                "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
                "\tIN\tNS\t${config.networking.hostName}"
              ];
-              makeHost = host: "${host.name}\tIN\tA\t${host.address}";
+              makeHost =
+                host:
+                [ "${host.name}\tIN\tA\t${host.address}" ]
+                ++ lib.map (a: "${a}\tIN\tA\t${host.address}") (
+                  if builtins.hasAttr "aliases" host then host.aliases else [ ]
+                );
            in
            pkgs.writeText "${domain}" (
-              builtins.concatStringsSep "\n" (preamble ++ (lib.map makeHost hosts) ++ [ "" ])
+              builtins.concatStringsSep "\n" (preamble ++ (lib.flatten (lib.map makeHost hosts)) ++ [ "" ])
            );
        in
        lib.mapAttrs
@@ -142,12 +142,12 @@ in
            updateOutputs = false;
          };
        };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net";
+        domain = "${config.networking.hostName}.shire-zebra.ts.net:8010";
        evalMaxMemorySize = 8192;
        evalWorkerCount = 4;
        gitea = {
          enable = true;
-          instanceUrl = "https://src.thehellings.com";
+          instanceUrl = "https://gitea.shire-zebra.ts.net";
          oauthId = "7ec9107d-379b-47c8-870f-1191956d0500";
          oauthSecretFile = config.age.secrets.gitea-oauthSecret.path;
          tokenFile = config.age.secrets.gitea-oauthToken.path;
@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:

 let
  srcDomain = "src.thehellings.com";
@@ -6,15 +6,23 @@ let
 in
 {
  greg.proxies."${srcDomain}" = {
-    target = "https://gitea.shire-zebra.ts.net";
+    target = "http://unix:${config.services.anubis.instances.git.settings.BIND}";
    ssl = true;
    genAliases = false;
    extraConfig = ''
-      proxy_ssl_verify off;
-      proxy_ssl_server_name on;
-      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Forwarded-Ssl on;
+      #proxy_ssl_verify off;
+      #proxy_ssl_server_name on;
+
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Http-Version $server_protocol;
+      proxy_set_header User-Agent $http_user_agent;
      client_max_body_size 100000m;
+
+      #proxy_set_header Host $host;
+      #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      #proxy_set_header X-Forwarded-Proto $scheme;
+      #proxy_set_header X-Forwarded-Ssl on;
+
      # Ultimate AI Block List v1.7 20250924
      # https://perishablepress.com/ultimate-ai-block-list/

@@ -87,6 +95,44 @@ in

  networking.firewall.allowedTCPPorts = [ sshPort ];

+  services = {
+    anubis = {
+      instances = {
+        git = {
+          enable = true;
+          settings = {
+            BIND = "/run/anubis/anubis-git/anubis.sock";
+            COOKIE_DOMAIN = "thehellings.com";
+            SERVE_ROBOTS_TXT = true;
+            TARGET = "https://gitea.shire-zebra.ts.net/";
+          };
+        };
+      };
+    };
+
+    haproxy = {
+      enable = true;
+      config = ''
+        global
+          daemon
+          maxconn 20
+
+        defaults
+          timeout connect 500s
+          timeout client 500s
+          timeout server 1h
+
+        listen gitsshd
+          bind *:${toString sshPort}
+          timeout client 1h
+          mode tcp
+          server git-isaiah isaiah.shire-zebra.ts.net:32222
+          server git-jeremiah jeremiah.shire-zebra.ts.net:32222
+          server git-zeke zeke.shire-zebra.ts.net:32222
+      '';
+    };
+  };
+
  systemd.services = {
    haproxy = {
      after = [
@@ -98,25 +144,5 @@ in
    };
  };

-  services.haproxy = {
-    enable = true;
-    config = ''
-      global
-        daemon
-        maxconn 20
-
-      defaults
-        timeout connect 500s
-        timeout client 500s
-        timeout server 1h
-
-      listen gitsshd
-        bind *:${toString sshPort}
-        timeout client 1h
-        mode tcp
-        server git-isaiah isaiah.shire-zebra.ts.net:32222
-        server git-jeremiah jeremiah.shire-zebra.ts.net:32222
-        server git-zeke zeke.shire-zebra.ts.net:32222
-    '';
-  };
+  users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
 }
@@ -2,12 +2,24 @@
 # them by the following commands:
 # nix run nixpkgs.matrix-synapse
 # register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
-{ config, lib, ... }:
+{ config, ... }:
 let
  domain = "${config.networking.domain}";
  fqdn = "matrix.${domain}";
 in
 {
+  greg.proxies."${fqdn}" = {
+    extraConfig = ''
+      error_log /var/log/nginx/debug.log debug;
+      proxy_ssl_verify off;
+      proxy_ssl_server_name on;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Forwarded-Ssl on;
+    '';
+    genAliases = false;
+    ssl = true;
+    target = "https://matrix.shire-zebra.ts.net";
+  };
  services.nginx = {
    virtualHosts = {
      # Server the '.well-known' files to find the Matrix API server
@@ -44,36 +56,6 @@ in
            return 200 '${builtins.toJSON client}';
          '';
      };
-
-      # Reverse proxy in front of the actual Matrix server
-      "${fqdn}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        extraConfig = ''
-          error_log /var/log/nginx/debug.log debug;
-        '';
-
-        # Not the appropriate place for the chat client
-        locations =
-          (builtins.listToAttrs (
-            builtins.map
-              (
-                val:
-                lib.nameValuePair "/_${val}" {
-                  proxyPass = "https://matrix.shire-zebra.ts.net";
-                }
-              )
-              [
-                "matrix"
-                "synapse"
-                "dendrite"
-              ]
-          ))
-          // {
-            "/".extraConfig = "return 404;";
-          };
-      };
    };
  };

@@ -34,10 +34,5 @@ in
      ssl = true;
      genAliases = false;
    };
-    "doubles.thehellings.com" = {
-      target = "http://localhost:8081";
-      ssl = true;
-      genAliases = false;
-    };
  };
 }
@@ -15,6 +15,7 @@
      (name: value: {
        inherit name;
        address = builtins.getAttr netAttr value;
+        aliases = lib.optionals (builtins.hasAttr "aliases" value) (builtins.getAttr "aliases" value);
      })
      (
        lib.filterAttrs (
@@ -66,8 +66,8 @@ spec:
          APP_NAME: "Gitea: Greg's Cup of Git"
          RUN_MODE: dev
        server:
-          DOMAIN: "thehellings.com"
-          ROOT_URL: "https://src.thehellings.com"
+          DOMAIN: "shire-zebra.ts.net"
+          ROOT_URL: "https://gitea.shire-zebra.ts.net"
          SSH_PORT: "2222"
        database:
          DB_TYPE: postgres
@@ -119,6 +119,53 @@ spec:
        cpu: "100m"
        memory: "2Gi"

+    # Anubis anti-crawler sidecar
+    # Anubis listens on :8080 and proxies to Gitea at http://localhost:3000
+    # Ingress is updated to route to the anubis port instead of http
+    extraContainers:
+      - name: anubis
+        image: ghcr.io/techarohq/anubis:latest
+        imagePullPolicy: Always
+        env:
+          - name: BIND
+            value: ":8080"
+          - name: DIFFICULTY
+            value: "4"
+          - name: METRICS_BIND
+            value: ":9090"
+          - name: POLICY_FNAME
+            value: "/etc/anubis/policy.yaml"
+          - name: SERVE_ROBOTS_TXT
+            value: "true"
+          - name: TARGET
+            value: "http://localhost:3000"
+        volumeMounts:
+          - name: anubis-policy
+            mountPath: /etc/anubis
+            readOnly: true
+        resources:
+          limits:
+            cpu: "750m"
+            memory: "256Mi"
+          requests:
+            cpu: "250m"
+            memory: "256Mi"
+        securityContext:
+          runAsUser: 1000
+          runAsGroup: 1000
+          runAsNonRoot: true
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+              - ALL
+          seccompProfile:
+            type: RuntimeDefault
+
+    extraVolumes:
+      - name: anubis-policy
+        configMap:
+          name: anubis-policy
+
    strategy:
      type: RollingUpdate
      rollingUpdate:
@@ -19,6 +19,7 @@ spec:
        kind: HelmRepository
        name: mariadb-operator
      interval: "1h"
+      version: "26.3.0"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -33,6 +34,7 @@ spec:
        kind: HelmRepository
        name: mariadb-operator
      interval: "1h"
+      version: "26.3.0"
  dependsOn:
    - name: mariadb-operator-crds
    - name: longhorn
@@ -11,6 +11,7 @@ spec:
        kind: HelmRepository
        name: mariadb-operator
      interval: "1h"
+      version: "26.3.0"
  dependsOn:
    - name: mariadb-operator-crds
    - name: mariadb-operator
@@ -13,7 +13,8 @@
      "ip": "10.42.1.4",
      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
      "external": true,
-      "ts": "100.119.228.115"
+      "ts": "100.119.228.115",
+      "aliases": [ "s3" ]
    },
    "exodus": {
      "ip": null,
@@ -56,6 +57,12 @@
      "external": true,
      "system": "x86_64-linux"
    },
+    "gitea": {
+      "external": true,
+      "system": "x86_64-linux",
+      "ts": "100.64.232.81",
+      "ip": "10.42.5.1"
+    },
    "gregory.hellings-mbp": {
      "external": true,
      "system": "aarch64-darwin",
Author	SHA1	Message	Date
Greg Hellings	69651258d6	chore: connect buildbot and gitea by tailscale	2026-05-28 16:57:05 -05:00
Greg Hellings	53c491f537	fix: buildbot domain name	2026-05-26 07:48:39 -05:00
klaatuandGreg Hellings	a8ccb1b6ba	chore: update flake.lock 2026-05-24 buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build started. Details	2026-05-24 21:30:35 -05:00
rootandGreg Hellings	e6217401f9	feat(gitea): add Anubis anti-crawler proxy buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work challenge that protects web services from AI crawlers and scrapers.	2026-05-24 21:25:50 -05:00
Greg Hellings	d97fb37f0e	chore: update SSH config for home-manager updates buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Update flake.lock / update-flake-lock (push) Successful in 1m46s Details Update manifest chart versions / update-manifests (push) Successful in 29s Details	2026-05-21 13:19:26 -05:00
Greg Hellings	75e71f9ce9	fix: get Matrix running again buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-effects Build done. Details buildbot/nix-build Build done. Details	2026-05-20 03:27:45 -05:00
Greg Hellings	19540ea1da	chore: update mariadb-operator version	2026-05-20 03:26:37 -05:00
Greg Hellings	431f78f8af	fix: enable minio access for gitea backups	2026-05-19 23:48:34 -05:00
Greg Hellings	95eea6fc26	fix: enable s3 DNS aliases	2026-05-19 23:47:42 -05:00
greg	387a34ffff	Merge pull request 'chore: update flake.lock 2026-05-18' (#23 ) from auto/update-flake-lock-20260518 into main buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Reviewed-on: https://src.thehellings.com/greg/nixos/pulls/23 Reviewed-by: klaatu <klaatu@thehellings.com>	2026-05-19 15:16:50 +00:00
greg	37a833887b	Merge branch 'main' into auto/update-flake-lock-20260518 buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done. Details	2026-05-19 07:53:55 +00:00
Greg Hellings	a69fc4240a	chore: build IVR home config buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-05-19 02:40:33 -05:00
Greg Hellings	15c586fbdb	fix: build failures on darwin buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-05-19 02:37:25 -05:00
klaatu	2daf74d134	chore: update flake.lock 2026-05-18 buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-hms Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-genesis Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-exodus Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-isaiah Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-icdm-root Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-iso Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-zeke Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-jeremiah Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-linode Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-zeke Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-jeremiah Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-exodus Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-proxmoxtemplate Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done. Details buildbot/nix-build Build done. Details	2026-05-18 17:58:09 +00:00
Greg Hellings	1934787e80	chore: create desktop entry for prismlauncher buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-05-18 12:45:52 -05:00
Greg Hellings	2a476a7bfe	chore: update refined-storage to release	2026-05-18 12:45:34 -05:00
Greg Hellings	e94137ecbf	fix: enable colmena building with new overlays	2026-05-18 12:45:04 -05:00
Greg Hellings	d22f543043	chore: update niks3 pin to fix mega file problem	2026-05-18 12:44:34 -05:00