chore: add build tools

Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work
challenge that protects web services from AI crawlers and scrapers.

darwin/baseline.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  pkgs',
   top,
   ...
 }:
@@ -33,7 +34,7 @@ in
 {
   environment.systemPackages = with pkgs; [
     agenix
-    hms
+    pkgs'.hms
   ];
 
   fonts.packages = with pkgs; [
@@ -41,12 +42,13 @@ in
     nerd-fonts.hack
   ];
 
-  launchd.daemons.darwin-builder = builder;
+  #launchd.daemons.darwin-builder = builder;
 
   nix = {
+    #buildMachines = [ { systems = ["aarch64-linux"]; sshUser = "builder"; sshKey = "/etc/nix/builder_ed25519"; hostName = "localhost:31022"; protocol = "ssh-ng"; }];
     enable = true;
     gc.interval.Hour = 3;
-    linux-builder.enable = true;
+    #linux-builder.enable = true;
     settings.auto-optimise-store = false; # Darwin bugs?
   };
 

darwin/default.nix

@@ -19,6 +19,7 @@ let
       specialArgs = {
         inherit metadata top;
         inherit (top) self;
+        pkgs' = top.self.packages.${system};
       };
       modules = [
         {

flake.lock

@@ -31,11 +31,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1778391342,
+        "lastModified": 1779096866,
-        "narHash": "sha256-7FVIfUHdQEB6HM+gUPLJVaL7ABrqlnMxS/pO+vNvjd8=",
+        "narHash": "sha256-8HtF1G7OPMXzo+f+0W+7zwzhuBUSk2EMrOS4ZvFw7+I=",
         "owner": "nix-community",
         "repo": "buildbot-nix",
-        "rev": "0bedd1aafd1653858d5f1e0f08eba3d7ec397dff",
+        "rev": "891f2baba218f4365f0c6ef96ea33f9b277f5ed0",
         "type": "github"
       },
       "original": {
@@ -95,11 +95,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1777780666,
+        "lastModified": 1779036909,
-        "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=",
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
         "type": "github"
       },
       "original": {
@@ -239,11 +239,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778954430,
+        "lastModified": 1779507042,
-        "narHash": "sha256-oaNyOr05lblaQdtbkbN1wO0b2KLIL2O1LkmwDgdQp4I=",
+        "narHash": "sha256-7wOwi8B6D0BYsieZCnHZZj2sNUzgJhLoIVSfkwB7lxQ=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "26aaab785b0bab4af60a2c42b22760fa906ef22a",
+        "rev": "509ed3c603349a9d43de9e2ae6613baea6bd5b34",
         "type": "github"
       },
       "original": {
@@ -281,11 +281,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1778039471,
+        "lastModified": 1779508581,
-        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
+        "narHash": "sha256-qZjcS4jRe0pUv4ZAFCyr7ELFrb3LPLr+5u8LHRZjMVQ=",
         "owner": "Infinidoge",
         "repo": "nix-minecraft",
-        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
+        "rev": "e13397b445bb0dcb390f90126914113ec5dd5afe",
         "type": "github"
       },
       "original": {
@@ -300,11 +300,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1778839878,
+        "lastModified": 1779223902,
-        "narHash": "sha256-S2nSP6YWUz8I2uRZuAY93FoAAUa9TiZetLzjBv1n5vk=",
+        "narHash": "sha256-qQogttCU2zOyK7MN85yPaUxxN2u0BN9zabfO4X7FwNg=",
         "owner": "Mic92",
         "repo": "niks3",
-        "rev": "c29f3641de064545d75f00318cd45bea2b4ea1d0",
+        "rev": "1db826ca990cb3dead5c033bcfba4bf68ce9fc05",
         "type": "github"
       },
       "original": {
@@ -336,11 +336,11 @@
     },
     "nix-hardware": {
       "locked": {
-        "lastModified": 1778945272,
+        "lastModified": 1779258371,
-        "narHash": "sha256-Aipz0UiBhE2a1FYJrNc2y+5vKWo5QVkhmaIJk3/ls+g=",
+        "narHash": "sha256-j1iZsLy6oFApqR1oiDmHhvkwxXqcNi0aoSJj643LuwU=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "379c1f274f0fa354d012f0600806de54e79f29b5",
+        "rev": "c97bc4d15bd3473dd095e8e8ba57330ab1943a77",
         "type": "github"
       },
       "original": {
@@ -382,11 +382,11 @@
     },
     "nixpkgs-lib_2": {
       "locked": {
-        "lastModified": 1778379128,
+        "lastModified": 1778984393,
-        "narHash": "sha256-+yjPmoKsTqe/FQHriXzIfI0ELuEt3+1LXc0BE8nU/Yc=",
+        "narHash": "sha256-r755Kh5Q0XBTPNuv9rL2rsUJTq8BDhb+lIwRWhl6yYA=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "e361b0ff94723bc94283566dc2a13a46f07eaf5c",
+        "rev": "0d14a58ab7aa3f513c58ccc9e47e77ffd92be204",
         "type": "github"
       },
       "original": {
@@ -413,11 +413,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1778491576,
+        "lastModified": 1779142197,
-        "narHash": "sha256-9YOHDS9ANGbRmf3DSQ9UCvas3CyYNIBwBkKGQZTLXGY=",
+        "narHash": "sha256-Fypu3KtYQ+ZXL91CZIGqS3ZKwrMH6GOSPCtJ07W3ecU=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1174f92bf37f1a5914be77e1b44482d6fbc75ecc",
+        "rev": "d4d6b67b138722feb847a75760a430943c33f4ef",
         "type": "github"
       },
       "original": {
@@ -429,11 +429,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1778869304,
+        "lastModified": 1779508470,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
         "type": "github"
       },
       "original": {
@@ -461,11 +461,11 @@
     },
     "nixunstable": {
       "locked": {
-        "lastModified": 1778869304,
+        "lastModified": 1779508470,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "narHash": "sha256-Ap9KJX+5xHIn3bPIpfNgT6MEXdAECECwo4/rmlQD74M=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "29916453413845e54a65b8a1cf996842300cd299",
         "type": "github"
       },
       "original": {
@@ -484,11 +484,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1778906310,
+        "lastModified": 1779554657,
-        "narHash": "sha256-LqASEJRtLuKRBJd9051T1KMAEaYvsVrc6m64jhD6xbw=",
+        "narHash": "sha256-qjLcUp7DBpmSUL+nVjLymp2nEvAzeKKoAVDCRgZYxFk=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "06cace835d7ee727852ac789e3dcd42fc2fd360e",
+        "rev": "1a380f12453ba97ad8cc9c60f223afb1cb8bace8",
         "type": "github"
       },
       "original": {
@@ -504,11 +504,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1778975705,
+        "lastModified": 1779579389,
-        "narHash": "sha256-DweZZ/JO7AxbQ9+caW8Jt8L5MtjMvVWpKDS+MAiWN8E=",
+        "narHash": "sha256-YbWzWejE/QRBLQN9VKBL66byuTFPvncQgiv4NC25lN4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "25081c3d50352c88e7502e2a1c76fda8560b2b41",
+        "rev": "65439f69b3bcf6b26b8a7c92c26bd09066fdf9c5",
         "type": "github"
       },
       "original": {
@@ -644,11 +644,11 @@
         "nixpkgs": "nixpkgs_5"
       },
       "locked": {
-        "lastModified": 1778902753,
+        "lastModified": 1779507994,
-        "narHash": "sha256-4tgJmu6sc6F6y+igJfh+kG0t2U1T2cDwfhz5hC0W2Tg=",
+        "narHash": "sha256-vw/u69n4vPibpWNUVkbwlfVHQukg3xcuKoHwCXJkOvc=",
         "owner": "nix-community",
         "repo": "nix-vscode-extensions",
-        "rev": "5df06838c483ad33aa5fb1448b9ba9de665930a1",
+        "rev": "375f9dc68aa90ccff57891af5dfe1d5fb2a9b20a",
         "type": "github"
       },
       "original": {

flake.nix

@@ -86,6 +86,7 @@
                   self
                   top
                   ;
+                pkgs' = top.self.packages.x86_64-linux;
               };
             };
           }

garnix.yaml

@@ -20,3 +20,4 @@ builds:
       # to build at home
       - homeConfigurations."gregory.hellings-mbp"
       - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
+      - homeConfigurations.ivr

home/baseline/ssh.nix

@@ -13,25 +13,23 @@
     includes = [ "config.local" ];
     enableDefaultConfig = false;
 
-    matchBlocks =
+    settings =
       let
         nas = {
-          user = "admin";
+          User = "admin";
         };
         owned = {
-          user = "greg";
+          User = "greg";
         };
       in
       {
         inherit nas;
 
         "*" = {
-          dynamicForwards = [ { port = 10240; } ];
+          DynamicForward = [ "10240" ];
-          serverAliveInterval = 60;
+          ServerAliveInterval = 60;
-          extraOptions = {
+          LogLevel = "error";
-            LogLevel = "error";
+          SetEnv = { TERM = "xterm-256color"; };
-            SetEnv = "TERM=xterm-256color";
-          };
         };
 
         "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -41,46 +39,46 @@
         "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;
 
         gh = {
-          user = "git";
+          User = "git";
-          hostname = "github.com";
+          Hostname = "github.com";
         };
         "src" = {
-          user = "git";
+          User = "git";
-          hostname = "jeremiah.shire-zebra.ts.net";
+          Hostname = "jeremiah.shire-zebra.ts.net";
-          port = 32222;
+          Port = 32222;
         };
         srcpub = {
-          user = "git";
+          User = "git";
-          hostname = "src.thehellings.com";
+          Hostname = "src.thehellings.com";
-          port = 2222;
+          Port = 2222;
         };
         ivr = {
-          user = "git";
+          User = "git";
-          hostname = "gitlab.com";
+          Hostname = "gitlab.com";
         };
 
         "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          user = "gregory.hellings";
+          User = "gregory.hellings";
         };
 
         "*.thehellings.lan" = owned;
         "10.42.*" = owned;
 
         "host.crosswire.org crosswire" = {
-          hostname = "host.crosswire.org";
+          Hostname = "host.crosswire.org";
-          user = "ghellings";
+          User = "ghellings";
         };
 
         fedpeople = {
-          hostname = "fedorapeople.org";
+          Hostname = "fedorapeople.org";
-          user = "greghellings";
+          User = "greghellings";
         };
 
         "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          user = "greghellings";
+          User = "greghellings";
         };
 
-        "127.*".extraOptions = {
+        "127.*" = {
           PubkeyAcceptedAlgorithms = "+ssh-rsa";
           HostkeyAlgorithms = "+ssh-rsa";
         };

home/hosts/exodus/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ lib, pkgs, ... }:
 
 {
   greg = {
@@ -36,4 +36,13 @@
       settings.SKIP_HOST_UPDATE = true;
     };
   };
+  xdg.desktopEntries = {
+    prismlauncher = {
+      name = "Prism Launcher - Minecraft";
+      actions.minecraft = {
+        name = "Minecraft";
+        exec = lib.getExe pkgs.prismlauncher;
+      };
+    };
+  };
 }

home/hosts/gregory.hellings-mbp/default.nix

@@ -36,14 +36,14 @@
       ".pip/pip.conf".text = ''
         [global]
         retries = 1
-        index-url = https://pypi.python.org/simple
+        index-url = https://pypi.python.org/
         extra-index-url =
-            https://pypidev.ivrtechnology.com/simple/
+            https://pypidev.ivrtechnology.com/
       '';
       ".config/uv/uv.toml".text = ''
         index-strategy = "unsafe-first-match"
         [[index]]
-        url = "https://pypidev.ivrtechnology.com/simple/"
+        url = "https://pypidev.ivrtechnology.com/"
         name = "pypidev"
         ignore-error-codes = [403]
       '';

home/hosts/lithic/default.nix

@@ -26,12 +26,16 @@ in
       ansible
       awscli2
       cargo
+      clippy
       direnv
+      go
       home-manager
       just
       mcp-grafana
+      nil
       nixVersions.stable
       podman
+      podman-compose
       poetry
       pre-commit
       (pulumi.withPackages (
@@ -45,6 +49,7 @@ in
       ))
       python
       rustc
+      rustfmt
       terraform
     ];
   };

hosts/unstable/genesis/default.nix

@@ -62,6 +62,7 @@
           serverProperties = {
             allow-flight = true;
             motd = "Maya's Minecraft World";
+            online-mode = true;
           };
           whitelist = { };
 
@@ -128,8 +129,8 @@
                 # Better storage engines
                 # https://www.curseforge.com/minecraft/mc-mods/refined-storage
                 refined-storage = pkgs.fetchurl {
-                  url = "https://mediafilez.forgecdn.net/files/8032/790/refinedstorage-fabric-3.0.0-beta.8.jar";
+                  url = "https://mediafilez.forgecdn.net/files/8086/588/refinedstorage-fabric-3.0.0.jar";
-                  hash = "sha256-XY5I+sw5JlWnKK/hPUOJsk2gnmqH4Iygq+aooN27NJY=";
+                  hash = "sha256-LuOF0aYQon78AQeD5fQ8OXHCnekfa+PNKpH7cqimFNs=";
                 };
                 # https://www.curseforge.com/minecraft/mc-mods/storage-drawers
                 #storagedrawers = pkgs.fetchurl {

hosts/unstable/genesis/networking.nix

@@ -22,6 +22,7 @@ let
     #"1.0.0.1" # Cloudflare
     #"149.112.112.112" # Quad 9
     metadata.infra.gw # Currently using our UniFi router for DNS as well
+    "100.100.100.100"
   ];
 in
 {
@@ -115,10 +116,15 @@ in
                 "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
                 "\tIN\tNS\t${config.networking.hostName}"
               ];
-              makeHost = host: "${host.name}\tIN\tA\t${host.address}";
+              makeHost =
+                host:
+                [ "${host.name}\tIN\tA\t${host.address}" ]
+                ++ lib.map (a: "${a}\tIN\tA\t${host.address}") (
+                  if builtins.hasAttr "aliases" host then host.aliases else [ ]
+                );
             in
             pkgs.writeText "${domain}" (
-              builtins.concatStringsSep "\n" (preamble ++ (lib.map makeHost hosts) ++ [ "" ])
+              builtins.concatStringsSep "\n" (preamble ++ (lib.flatten (lib.map makeHost hosts)) ++ [ "" ])
             );
         in
         lib.mapAttrs
@@ -127,7 +133,7 @@ in
             file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
           })
           {
-            "shire-zebra.ts.net" = "tailscale";
+            #"shire-zebra.ts.net" = "tailscale";
             "nebula.thehellings.com" = "nebula";
             nebula = "nebula";
             "thehellings.lan" = "lan";

hosts/unstable/hosea/arr.nix

@@ -1,70 +0,0 @@
-{
-  lib,
-  metadata,
-  pkgs,
-  ...
-}:
-let
-  ips = lib.filterAttrs (_k: v: v ? "ip" && v.ip != null) metadata.hosts;
-  tps = lib.filterAttrs (_k: v: v ? "ts" && v.ts != null) metadata.hosts;
-  get = field: set: lib.mapAttrsToList (_k: v: v.${field}) set;
-  getTS = get "ts" tps;
-  getIP = get "ip" ips;
-  whitelists = builtins.concatStringsSep "," (
-    [
-      "localhost"
-      "127.0.0.1"
-    ]
-    ++ getTS
-    ++ getIP
-  );
-in
-{
-  services = {
-    prowlarr = {
-      enable = true;
-      dataDir = "/arr/prowlarr";
-      openFirewall = true;
-    };
-    radarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    transmission = {
-      enable = true;
-      openPeerPorts = true;
-      openRPCPort = true;
-      package = pkgs.transmission_4;
-      settings = {
-        download-dir = "/arr/transmission/downloads";
-        rpc-bind-address = "0.0.0.0";
-        rpc-host-whitelist = whitelists;
-        rpc-host-whitelist-enabled = false;
-        rpc-whitelist = whitelists;
-        rpc-whitelist-enabled = false;
-        watch-dir-enabled = true;
-        watch-dir = "/arr/transmission/incoming";
-      };
-    };
-  };
-
-  systemd.mounts =
-    let
-      nfs = name: {
-        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
-        type = "nfs";
-        name = "${name}.mount";
-        where = "/${name}";
-        requires = [ "tailscaled-autoconnect.service" ];
-        after = [ "tailscaled-autoconnect.service" ];
-        wantedBy = [ "multi-user.target" ];
-        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
-      };
-    in
-    [
-      (nfs "arr")
-      (nfs "music")
-      (nfs "photos")
-      (nfs "video")
-    ];
-}

hosts/unstable/hosea/default.nix

@@ -18,7 +18,6 @@ in
 {
   imports = [
     # Include the results of the hardware scan.
-    ./arr.nix
     ./hardware-configuration.nix
     top.niks3.nixosModules.niks3
   ];
@@ -200,6 +199,25 @@ in
     };
   };
 
+  systemd.mounts =
+    let
+      nfs = name: {
+        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
+        type = "nfs";
+        name = "${name}.mount";
+        where = "/${name}";
+        requires = [ "tailscaled-autoconnect.service" ];
+        after = [ "tailscaled-autoconnect.service" ];
+        wantedBy = [ "multi-user.target" ];
+        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
+      };
+    in
+    [
+      (nfs "music")
+      (nfs "photos")
+      (nfs "video")
+    ];
+
   # After first deploy: create a Grafana service account + API token for Klaatu
   # via the Grafana UI, then encrypt it: agenix -e secrets/grafana-api-token.age
   age.secrets.grafana-api-token = {

hosts/unstable/jeremiah/default.nix

@@ -142,12 +142,12 @@ in
             updateOutputs = false;
           };
         };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net";
+        domain = "${config.networking.hostName}.shire-zebra.ts.net:8010";
         evalMaxMemorySize = 8192;
         evalWorkerCount = 4;
         gitea = {
           enable = true;
-          instanceUrl = "https://src.thehellings.com";
+          instanceUrl = "https://gitea.shire-zebra.ts.net";
           oauthId = "7ec9107d-379b-47c8-870f-1191956d0500";
           oauthSecretFile = config.age.secrets.gitea-oauthSecret.path;
           tokenFile = config.age.secrets.gitea-oauthToken.path;

hosts/unstable/linode/git.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 
 let
   srcDomain = "src.thehellings.com";
@@ -6,15 +6,23 @@ let
 in
 {
   greg.proxies."${srcDomain}" = {
-    target = "https://gitea.shire-zebra.ts.net";
+    target = "http://unix:${config.services.anubis.instances.git.settings.BIND}";
     ssl = true;
     genAliases = false;
     extraConfig = ''
-      proxy_ssl_verify off;
+      #proxy_ssl_verify off;
-      proxy_ssl_server_name on;
+      #proxy_ssl_server_name on;
-      proxy_set_header X-Forwarded-Proto $scheme;
+
-      proxy_set_header X-Forwarded-Ssl on;
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Http-Version $server_protocol;
+      proxy_set_header User-Agent $http_user_agent;
       client_max_body_size 100000m;
+
+      #proxy_set_header Host $host;
+      #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      #proxy_set_header X-Forwarded-Proto $scheme;
+      #proxy_set_header X-Forwarded-Ssl on;
+
       # Ultimate AI Block List v1.7 20250924
       # https://perishablepress.com/ultimate-ai-block-list/
 
@@ -87,6 +95,44 @@ in
 
   networking.firewall.allowedTCPPorts = [ sshPort ];
 
+  services = {
+    anubis = {
+      instances = {
+        git = {
+          enable = true;
+          settings = {
+            BIND = "/run/anubis/anubis-git/anubis.sock";
+            COOKIE_DOMAIN = "thehellings.com";
+            SERVE_ROBOTS_TXT = true;
+            TARGET = "https://gitea.shire-zebra.ts.net/";
+          };
+        };
+      };
+    };
+
+    haproxy = {
+      enable = true;
+      config = ''
+        global
+          daemon
+          maxconn 20
+
+        defaults
+          timeout connect 500s
+          timeout client 500s
+          timeout server 1h
+
+        listen gitsshd
+          bind *:${toString sshPort}
+          timeout client 1h
+          mode tcp
+          server git-isaiah isaiah.shire-zebra.ts.net:32222
+          server git-jeremiah jeremiah.shire-zebra.ts.net:32222
+          server git-zeke zeke.shire-zebra.ts.net:32222
+      '';
+    };
+  };
+
   systemd.services = {
     haproxy = {
       after = [
@@ -98,25 +144,5 @@ in
     };
   };
 
-  services.haproxy = {
+  users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
-    enable = true;
-    config = ''
-      global
-        daemon
-        maxconn 20
-
-      defaults
-        timeout connect 500s
-        timeout client 500s
-        timeout server 1h
-
-      listen gitsshd
-        bind *:${toString sshPort}
-        timeout client 1h
-        mode tcp
-        server git-isaiah isaiah.shire-zebra.ts.net:32222
-        server git-jeremiah jeremiah.shire-zebra.ts.net:32222
-        server git-zeke zeke.shire-zebra.ts.net:32222
-    '';
-  };
 }

hosts/unstable/linode/matrix.nix

@@ -2,12 +2,24 @@
 # them by the following commands:
 # nix run nixpkgs.matrix-synapse
 # register_new_matrix_user -k "B9EoPr2WV9hzwc7uL2Sx1JmvCeKDEOGCpB0uginQcQtEH4wzRtkSIdo7lltrjSQa" http://localhost:8448
-{ config, lib, ... }:
+{ config, ... }:
 let
   domain = "${config.networking.domain}";
   fqdn = "matrix.${domain}";
 in
 {
+  greg.proxies."${fqdn}" = {
+    extraConfig = ''
+      error_log /var/log/nginx/debug.log debug;
+      proxy_ssl_verify off;
+      proxy_ssl_server_name on;
+      proxy_set_header X-Forwarded-Proto $scheme;
+      proxy_set_header X-Forwarded-Ssl on;
+    '';
+    genAliases = false;
+    ssl = true;
+    target = "https://matrix.shire-zebra.ts.net";
+  };
   services.nginx = {
     virtualHosts = {
       # Server the '.well-known' files to find the Matrix API server
@@ -44,36 +56,6 @@ in
             return 200 '${builtins.toJSON client}';
           '';
       };
-
-      # Reverse proxy in front of the actual Matrix server
-      "${fqdn}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        extraConfig = ''
-          error_log /var/log/nginx/debug.log debug;
-        '';
-
-        # Not the appropriate place for the chat client
-        locations =
-          (builtins.listToAttrs (
-            builtins.map
-              (
-                val:
-                lib.nameValuePair "/_${val}" {
-                  proxyPass = "https://matrix.shire-zebra.ts.net";
-                }
-              )
-              [
-                "matrix"
-                "synapse"
-                "dendrite"
-              ]
-          ))
-          // {
-            "/".extraConfig = "return 404;";
-          };
-      };
     };
   };
 

hosts/unstable/linode/nginx.nix

@@ -34,10 +34,5 @@ in
       ssl = true;
       genAliases = false;
     };
-    "doubles.thehellings.com" = {
-      target = "http://localhost:8081";
-      ssl = true;
-      genAliases = false;
-    };
   };
 }

lib/default.nix

@@ -15,6 +15,7 @@
       (name: value: {
         inherit name;
         address = builtins.getAttr netAttr value;
+        aliases = lib.optionals (builtins.hasAttr "aliases" value) (builtins.getAttr "aliases" value);
       })
       (
         lib.filterAttrs (

manifests/gitea/chart.yaml

@@ -15,7 +15,7 @@ spec:
   chart:
     spec:
       chart: gitea
-      version: "12.5.3"
+      version: "12.6.0"
       sourceRef:
         kind: HelmRepository
         name: gitea-repository
@@ -35,7 +35,7 @@ spec:
       storageClass: longhorn-default
 
     image:
-      tag: "1.25.5"
+      tag: "1.26.2"
 
     replicaCount: 1
 
@@ -66,8 +66,8 @@ spec:
           APP_NAME: "Gitea: Greg's Cup of Git"
           RUN_MODE: dev
         server:
-          DOMAIN: "thehellings.com"
+          DOMAIN: "shire-zebra.ts.net"
-          ROOT_URL: "https://src.thehellings.com"
+          ROOT_URL: "https://gitea.shire-zebra.ts.net"
           SSH_PORT: "2222"
         database:
           DB_TYPE: postgres

manifests/helm/longhorn.yaml

@@ -27,7 +27,7 @@ spec:
   chart:
     spec:
       chart: longhorn
-      version: "1.11.1"
+      version: "1.11.2"
       sourceRef:
         kind: HelmRepository
         name: longhorn

manifests/mariadb-operator/chart.yaml

@@ -19,6 +19,7 @@ spec:
         kind: HelmRepository
         name: mariadb-operator
       interval: "1h"
+      version: "26.3.0"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -33,6 +34,7 @@ spec:
         kind: HelmRepository
         name: mariadb-operator
       interval: "1h"
+      version: "26.3.0"
   dependsOn:
     - name: mariadb-operator-crds
     - name: longhorn

manifests/mariadb-operator/databases.yaml

@@ -11,6 +11,7 @@ spec:
         kind: HelmRepository
         name: mariadb-operator
       interval: "1h"
+      version: "26.3.0"
   dependsOn:
     - name: mariadb-operator-crds
     - name: mariadb-operator

modules/hm/gui/bookmarks.nix

@@ -399,16 +399,24 @@
         name = "Media";
         bookmarks = [
           {
-            name = "Prowlarr";
+            name = "Flaresolverr";
-            url = "https://hosea.shire-zebra.ts.net:9696/";
+            url = "http://nas1.shire-zebra.ts.net:30098";
           }
           {
-            name = "Transmission";
+            name = "Prowlarr";
-            url = "https://hosea.shire-zebra.ts.net:9091/";
+            url = "http://nas1.shire-zebra.ts.net:30050/";
+          }
+          {
+            name = "Sonarr (TV)";
+            url = "http://nas1.shire-zebra.ts.net:30113/";
           }
           {
             name = "Radarr (Movies)";
-            url = "https://hosea.shire-zebra.ts.net:7878/";
+            url = "http://nas1.shire-zebra.ts.net:30025/";
+          }
+          {
+            name = "Transmission";
+            url = "http://nas1.shire-zebra.ts.net:30096/";
           }
         ];
       }

network.json

@@ -13,7 +13,8 @@
       "ip": "10.42.1.4",
       "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
       "external": true,
-      "ts": "100.119.228.115"
+      "ts": "100.119.228.115",
+      "aliases": ["s3"]
     },
     "exodus": {
       "ip": null,