chore: update flake.lock 2026-05-10

chore: update pre-commit
fix: use proper runs-on for updates
2026-05-10 07:09:51 +00:00 · 2026-05-10 01:48:45 -05:00 · 2026-05-10 01:47:34 -05:00 · 2026-05-10 01:42:28 -05:00 · 2026-05-07 08:28:44 -05:00 · 2026-04-30 17:18:36 -05:00
99 changed files with 854 additions and 1787 deletions
@@ -1,13 +1,13 @@
 name: Update flake.lock
-on:
+"on":
  schedule:
    - cron: "0 0 * * 0"  # Every Sunday at midnight UTC
  workflow_dispatch:
 jobs:
  update-flake-lock:
-    runs-on: [bare-metal, nix-latest]
+    runs-on: nix-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -1,23 +0,0 @@
 stages:
  - eval
  - build
  - push
 "Evaluate for builds":
  stage: eval
  tags:
    - kubernetes
  image: "$CI_REGISTRY/greg/ci-images/builder:latest"
  artifacts:
    paths:
      - gitlab-ci-continue.yml
  script: nix run ".#gen-build" > gitlab-ci-continue.yml
 "Trigger builds":
  stage: build
  trigger:
    include:
      - artifact: gitlab-ci-continue.yml
        job: "Evaluate for builds"
  variables:
    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
@@ -17,7 +17,7 @@ repos:
      - id: mixed-line-ending
      - id: trailing-whitespace
  - repo: https://github.com/adrienverge/yamllint.git
-    rev: v1.37.1
+    rev: v1.38.0
    hooks:
      - id: yamllint
        args:
@@ -30,8 +30,9 @@ repos:
              comments: false
              comments-indentation: false
              document-start: false
              line-length: false
  - repo: https://github.com/NixOS/nixfmt
-    rev: v1.1.0
+    rev: v1.2.0
    hooks:
      - id: nixfmt-nix
  - repo: https://github.com/astro/deadnix
@@ -1,23 +1,32 @@
 {
  lib,
  pkgs,
  top,
  ...
 }:
 let
-  builder-config = {
+  system = builtins.replaceStrings [ "darwin" ] [ "linux" ] pkgs.stdenv.hostPlatform.system;
-    darwin-aarch-builder = top.self.nixosConfigurations.builder-aarch;
+  builderConfig = top.nixunstable.lib.nixosSystem {
-    darwin-x86-builder = top.self.nixosConfigurations.builder-x86;
+    inherit system;
    modules = [
      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
      {
        virtualisation = {
          host.pkgs = pkgs;
          darwin-builder = {
            workingDirectory = "/var/lib/darwin-builder";
            hostPort = 22;
          };
        };
      }
    ];
  };
-  builder = arch: let
+  builder = {
-    b = builder-config."darwin-${arch}-builder";
+    command = "${builderConfig.config.system.build.macos-builder-installer}/bin/create-builder";
  in {
    command = "${b.config.system.build.macos-builder-installer}/bin/create-builder";
    serviceConfig = {
      KeepAlive = true;
      RunAtLoad = true;
-      StandardOutPath = "/var/log/builder-vm-${arch}.log";
+      StandardOutPath = "/var/log/builder-vm-${system}.log";
-      StandardErrorPath = "/var/log/builder-vm-${arch}.stderr.log";
+      StandardErrorPath = "/var/log/builder-vm-${system}.stderr.log";
    };
  };
 in
@@ -32,23 +41,12 @@ in
    nerd-fonts.hack
  ];
-  #launchd.daemons = lib.genAttrs' [ "x86" "aarch" ] (arch: lib.nameValuePair "builder-${arch}-machine" (builder arch));
+  launchd.daemons.darwin-builder = builder;
  nix = {
    enable = true;
    buildMachines = [
      {
        hostName = "ssh-ng://builder@localhost";
        system = "aarch64-linux";
        maxJobs = 4;
        supportedFeatures = [
          "kvm"
          "benchmarch"
          "big-parallel"
        ];
      }
    ];
    gc.interval.Hour = 3;
    linux-builder.enable = true;
    settings.auto-optimise-store = false; # Darwin bugs?
  };
@@ -37,11 +37,4 @@ let
      ++ lib.optionals (builtins.pathExists ./hosts/${name}) [ ./hosts/${name} ];
    };
 in
-(
+(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) (name: mac { inherit name; }))
  lib.genAttrs
    (builtins.attrNames (builtins.readDir ./hosts))
    (
      name:
      mac { inherit name; }
    )
 )
@@ -0,0 +1 @@
 gregory
@@ -31,6 +31,7 @@ in
      "bitwarden"
      "bruno"
      "chromium"
      "claude"
      "dbeaver-community"
      "ghostty"
      "firefox"
@@ -1 +1 @@
-gregs-MacBook-Pro-16-inch-Nov-2024/
+lithic/
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ ... }:
 let
  username = "greg";
 in
@@ -25,19 +25,17 @@
    },
    "buildbot": {
      "inputs": {
        "flake-parts": "flake-parts",
        "hercules-ci-effects": "hercules-ci-effects",
        "nixpkgs": [
          "nixunstable"
        ],
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1775969270,
+        "lastModified": 1778391342,
-        "narHash": "sha256-uu+DFoqMI2g2E+QE6EQfVc4g/jibNSnVobSUhxFr20o=",
+        "narHash": "sha256-7FVIfUHdQEB6HM+gUPLJVaL7ABrqlnMxS/pO+vNvjd8=",
        "owner": "nix-community",
        "repo": "buildbot-nix",
-        "rev": "df9ff85cf20cedeae2f231dc2997d2e8ca5810cf",
+        "rev": "0bedd1aafd1653858d5f1e0f08eba3d7ec397dff",
        "type": "github"
      },
      "original": {
@@ -46,36 +44,12 @@
        "type": "github"
      }
    },
    "charts": {
      "inputs": {
        "flake-utils": "flake-utils",
        "haumea": "haumea",
        "nix-kube-generators": "nix-kube-generators",
        "nixpkgs": "nixpkgs",
        "pyproject-build-systems": "pyproject-build-systems",
        "pyproject-nix": "pyproject-nix",
        "uv2nix": "uv2nix"
      },
      "locked": {
        "lastModified": 1776048063,
        "narHash": "sha256-OxHZn20MRW71OfYCoaYpZV/gKTna6A3Uvi8F4nsdCdU=",
        "owner": "nix-community",
        "repo": "nixhelm",
        "rev": "b9e8749fe567ea2087184a6d658ad313a7f8272a",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "nixhelm",
        "type": "github"
      }
    },
    "colmena": {
      "inputs": {
        "flake-compat": "flake-compat",
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
        "nix-github-actions": "nix-github-actions",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs",
        "stable": "stable"
      },
      "locked": {
@@ -121,11 +95,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775037210,
+        "lastModified": 1777780666,
-        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
+        "narHash": "sha256-8wURyQMdDkGUarSTKOGdCuFfYiwa3HbzwscUfn3STDE=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
+        "rev": "8c62fba0854ba15c8917aed18894dbccb48a3777",
        "type": "github"
      },
      "original": {
@@ -152,6 +126,22 @@
      }
    },
    "flake-compat_2": {
      "flake": false,
      "locked": {
        "lastModified": 1747046372,
        "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=",
        "owner": "edolstra",
        "repo": "flake-compat",
        "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885",
        "type": "github"
      },
      "original": {
        "owner": "edolstra",
        "repo": "flake-compat",
        "type": "github"
      }
    },
    "flake-compat_3": {
      "flake": false,
      "locked": {
        "lastModified": 1767039857,
@@ -169,17 +159,14 @@
    },
    "flake-parts": {
      "inputs": {
-        "nixpkgs-lib": [
+        "nixpkgs-lib": "nixpkgs-lib"
          "buildbot",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1775087534,
+        "lastModified": 1777988971,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "narHash": "sha256-qIoWPDs+0/8JecyYgE3gpKQxW/4bLW/gp45vow9ioCQ=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "0678d8986be1661af6bb555f3489f2fdfc31f6ff",
        "type": "github"
      },
      "original": {
@@ -190,14 +177,17 @@
    },
    "flake-parts_2": {
      "inputs": {
-        "nixpkgs-lib": "nixpkgs-lib"
+        "nixpkgs-lib": [
          "nixvimunstable",
          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1775087534,
+        "lastModified": 1777932387,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "narHash": "sha256-nUYVPiqrzr36ThiQOAr5MKeGHDBSDM3OFWkz0uDjOvc=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "71a3a77326609675e9f8b51084cf23d5d1945899",
        "type": "github"
      },
      "original": {
@@ -207,27 +197,6 @@
      }
    },
    "flake-parts_3": {
      "inputs": {
        "nixpkgs-lib": [
          "nixvimunstable",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1772408722,
        "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
        "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3",
        "type": "github"
      },
      "original": {
        "owner": "hercules-ci",
        "repo": "flake-parts",
        "type": "github"
      }
    },
    "flake-parts_4": {
      "inputs": {
        "nixpkgs-lib": [
          "nurpkgs",
@@ -249,24 +218,6 @@
      }
    },
    "flake-utils": {
      "inputs": {
        "systems": "systems_2"
      },
      "locked": {
        "lastModified": 1731533236,
        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
        "owner": "numtide",
        "repo": "flake-utils",
        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
        "type": "github"
      },
      "original": {
        "owner": "numtide",
        "repo": "flake-utils",
        "type": "github"
      }
    },
    "flake-utils_2": {
      "locked": {
        "lastModified": 1659877975,
        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
@@ -281,53 +232,6 @@
        "type": "github"
      }
    },
    "haumea": {
      "inputs": {
        "nixpkgs": [
          "charts",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1685133229,
        "narHash": "sha256-FePm/Gi9PBSNwiDFq3N+DWdfxFq0UKsVVTJS3cQPn94=",
        "owner": "nix-community",
        "repo": "haumea",
        "rev": "34dd58385092a23018748b50f9b23de6266dffc2",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "ref": "v0.2.2",
        "repo": "haumea",
        "type": "github"
      }
    },
    "hercules-ci-effects": {
      "inputs": {
        "flake-parts": [
          "buildbot",
          "flake-parts"
        ],
        "nixpkgs": [
          "buildbot",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1773550609,
        "narHash": "sha256-neu7ixXHjV3LobVjOndkL97u+6UF6Yoh+CUnzX7kUBQ=",
        "owner": "hercules-ci",
        "repo": "hercules-ci-effects",
        "rev": "554f6ed448ca74c00aa2371cde901ae1e73005b9",
        "type": "github"
      },
      "original": {
        "owner": "hercules-ci",
        "repo": "hercules-ci-effects",
        "type": "github"
      }
    },
    "hmunstable": {
      "inputs": {
        "nixpkgs": [
@@ -335,11 +239,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1776046499,
+        "lastModified": 1778365864,
-        "narHash": "sha256-Wzc4nn07/0RL21ypPHRzNDQZcjhIC8LaYo7QJQjM5T4=",
+        "narHash": "sha256-ImoT/wqmgMImf2dAC+E0MverAdA4QXsedOeES9B7Ezw=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "287f84846c1eb3b72c986f5f6bebcff0bd67440d",
+        "rev": "2f419037039a152448c5f4ae9494154753d1b399",
        "type": "github"
      },
      "original": {
@@ -370,6 +274,26 @@
        "type": "github"
      }
    },
    "minecraft": {
      "inputs": {
        "flake-compat": "flake-compat_2",
        "nixpkgs": "nixpkgs_2",
        "systems": "systems_2"
      },
      "locked": {
        "lastModified": 1778039471,
        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
        "owner": "Infinidoge",
        "repo": "nix-minecraft",
        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
        "type": "github"
      },
      "original": {
        "owner": "Infinidoge",
        "repo": "nix-minecraft",
        "type": "github"
      }
    },
    "nix-github-actions": {
      "inputs": {
        "nixpkgs": [
@@ -393,11 +317,11 @@
    },
    "nix-hardware": {
      "locked": {
-        "lastModified": 1775490113,
+        "lastModified": 1778143761,
-        "narHash": "sha256-2ZBhDNZZwYkRmefK5XLOusCJHnoeKkoN95hoSGgMxWM=",
+        "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "c775c2772ba56e906cbeb4e0b2db19079ef11ff7",
+        "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871",
        "type": "github"
      },
      "original": {
@@ -406,53 +330,7 @@
        "type": "github"
      }
    },
    "nix-kube-generators": {
      "locked": {
        "lastModified": 1762437901,
        "narHash": "sha256-5yuJODagAq+aMXQAT2c0gfXKLqapmA6eUHR33jKNHuU=",
        "owner": "farcaller",
        "repo": "nix-kube-generators",
        "rev": "810dcf792081790648ba9ae705b9a2286115ace8",
        "type": "github"
      },
      "original": {
        "owner": "farcaller",
        "repo": "nix-kube-generators",
        "type": "github"
      }
    },
    "nixpkgs": {
      "locked": {
        "lastModified": 1767767207,
        "narHash": "sha256-Mj3d3PfwltLmukFal5i3fFt27L6NiKXdBezC1EBuZs4=",
        "owner": "NixOS",
        "repo": "nixpkgs",
        "rev": "5912c1772a44e31bf1c63c0390b90501e5026886",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs-lib": {
      "locked": {
        "lastModified": 1774748309,
        "narHash": "sha256-+U7gF3qxzwD5TZuANzZPeJTZRHS29OFQgkQ2kiTJBIQ=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "rev": "333c4e0545a6da976206c74db8773a1645b5870a",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "type": "github"
      }
    },
    "nixpkgs_2": {
      "locked": {
        "lastModified": 1750134718,
        "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=",
@@ -468,13 +346,44 @@
        "type": "github"
      }
    },
-    "nixpkgs_3": {
+    "nixpkgs-lib": {
      "locked": {
-        "lastModified": 1775710090,
+        "lastModified": 1777168982,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
        "type": "github"
      }
    },
    "nixpkgs_2": {
      "locked": {
        "lastModified": 1769461804,
        "narHash": "sha256-msG8SU5WsBUfVVa/9RPLaymvi5bI8edTavbIq3vRlhI=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "bfc1b8a4574108ceef22f02bafcf6611380c100d",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
        "ref": "nixos-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
    "nixpkgs_3": {
      "locked": {
        "lastModified": 1777954456,
        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
        "owner": "nixos",
        "repo": "nixpkgs",
        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
        "type": "github"
      },
      "original": {
@@ -486,27 +395,27 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1766025857,
+        "lastModified": 1777207419,
-        "narHash": "sha256-Lav5jJazCW4mdg1iHcROpuXqmM94BWJvabLFWaJVJp0=",
+        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "def3da69945bbe338c373fddad5a1bb49cf199ce",
+        "rev": "a7ecea3deccfbdbf22945a89984fcc5a169da8aa",
        "type": "github"
      }
    },
    "nixunstable": {
      "locked": {
-        "lastModified": 1775710090,
+        "lastModified": 1777954456,
-        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
+        "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
+        "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1",
        "type": "github"
      },
      "original": {
@@ -518,18 +427,18 @@
    },
    "nixvimunstable": {
      "inputs": {
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_2",
        "nixpkgs": [
          "nixunstable"
        ],
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1776079266,
+        "lastModified": 1777991353,
-        "narHash": "sha256-JXxmLRI18Ne4VAUzZKeVqjtMOWT6uWHk12jJQ+7UWgA=",
+        "narHash": "sha256-DFwjggMV+nzCZpwK6Obxj9F+P59rbLVowGqHETfctBk=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "306d2772d6647b7cde8388318042f5b95c2ce2b8",
+        "rev": "7986a276960b4dfaed9bb2c3c438b5ba71ae08f1",
        "type": "github"
      },
      "original": {
@@ -541,15 +450,15 @@
    },
    "nurpkgs": {
      "inputs": {
-        "flake-parts": "flake-parts_4",
+        "flake-parts": "flake-parts_3",
        "nixpkgs": "nixpkgs_3"
      },
      "locked": {
-        "lastModified": 1776114134,
+        "lastModified": 1778395809,
-        "narHash": "sha256-A5P8S73XZKnuqDjwJ7dYbE3FthF4GVk76f8pwwa+wsg=",
+        "narHash": "sha256-Jl3fg2TTQpFEFR4Xg9wdrNEohWIZI2jrLPO84ctFfPc=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "29213f0bac84452593991be2f443b7f392ebec22",
+        "rev": "4d723c32ac8ccbf63f6f201c95195fae1ac1d11c",
        "type": "github"
      },
      "original": {
@@ -558,65 +467,15 @@
        "type": "github"
      }
    },
    "pyproject-build-systems": {
      "inputs": {
        "nixpkgs": [
          "charts",
          "nixpkgs"
        ],
        "pyproject-nix": [
          "charts",
          "pyproject-nix"
        ],
        "uv2nix": [
          "charts",
          "uv2nix"
        ]
      },
      "locked": {
        "lastModified": 1763662255,
        "narHash": "sha256-4bocaOyLa3AfiS8KrWjZQYu+IAta05u3gYZzZ6zXbT0=",
        "owner": "pyproject-nix",
        "repo": "build-system-pkgs",
        "rev": "042904167604c681a090c07eb6967b4dd4dae88c",
        "type": "github"
      },
      "original": {
        "owner": "pyproject-nix",
        "repo": "build-system-pkgs",
        "type": "github"
      }
    },
    "pyproject-nix": {
      "inputs": {
        "nixpkgs": [
          "charts",
          "nixpkgs"
        ]
      },
      "locked": {
        "lastModified": 1764134915,
        "narHash": "sha256-xaKvtPx6YAnA3HQVp5LwyYG1MaN4LLehpQI8xEdBvBY=",
        "owner": "pyproject-nix",
        "repo": "pyproject.nix",
        "rev": "2c8df1383b32e5443c921f61224b198a2282a657",
        "type": "github"
      },
      "original": {
        "owner": "pyproject-nix",
        "repo": "pyproject.nix",
        "type": "github"
      }
    },
    "root": {
      "inputs": {
        "agenix": "agenix",
        "buildbot": "buildbot",
        "charts": "charts",
        "colmena": "colmena",
        "darwin": "darwin_2",
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts",
        "hmunstable": "hmunstable",
        "minecraft": "minecraft",
        "nix-hardware": "nix-hardware",
        "nixunstable": "nixunstable",
        "nixvimunstable": "nixvimunstable",
@@ -707,41 +566,16 @@
        "type": "github"
      }
    },
    "uv2nix": {
      "inputs": {
        "nixpkgs": [
          "charts",
          "nixpkgs"
        ],
        "pyproject-nix": [
          "charts",
          "pyproject-nix"
        ]
      },
      "locked": {
        "lastModified": 1767701098,
        "narHash": "sha256-CJhKZnWb3gumR9oTRjFvCg/6lYTGbZRU7xtvcyWIRwU=",
        "owner": "pyproject-nix",
        "repo": "uv2nix",
        "rev": "9d357f0d2ce6f5f35ec7959d7e704452352eb4da",
        "type": "github"
      },
      "original": {
        "owner": "pyproject-nix",
        "repo": "uv2nix",
        "type": "github"
      }
    },
    "vsext": {
      "inputs": {
        "nixpkgs": "nixpkgs_4"
      },
      "locked": {
-        "lastModified": 1776051332,
+        "lastModified": 1778384975,
-        "narHash": "sha256-u17gFUARTdA9ZtODdrep0QyIAaGNHjKscFLkB/jFTQQ=",
+        "narHash": "sha256-+27MJizhdJGXTl3jzNKnGU3C+fJJBcTsBQb6PtS5vBE=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "81915eb135b9b56b691a34e432768a349531b951",
+        "rev": "5d9f84ecc813690afdd4b35c896904fc02ab6cac",
        "type": "github"
      },
      "original": {
@@ -752,17 +586,17 @@
    },
    "wsl": {
      "inputs": {
-        "flake-compat": "flake-compat_2",
+        "flake-compat": "flake-compat_3",
        "nixpkgs": [
          "nixunstable"
        ]
      },
      "locked": {
-        "lastModified": 1774972752,
+        "lastModified": 1777732699,
-        "narHash": "sha256-DnLIpFxznohpLkIFs390uZ0gxwkVyhtknhKNu+lQJK8=",
+        "narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "d97e078f4788cddb8d11c3c99f72a4bb9ddec221",
+        "rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
        "type": "github"
      },
      "original": {
@@ -13,9 +13,6 @@
      url = "github:nix-community/buildbot-nix";
      inputs.nixpkgs.follows = "nixunstable";
    };
    charts = {
      url = "github:nix-community/nixhelm";
    };
    colmena.url = "github:zhaofengli/colmena";
    darwin = {
      url = "github:lnl7/nix-darwin/master";
@@ -26,6 +23,7 @@
      url = "github:nix-community/home-manager/master";
      inputs.nixpkgs.follows = "nixunstable";
    };
    minecraft.url = "github:Infinidoge/nix-minecraft";
    nix-hardware.url = "github:nixos/nixos-hardware";
    nixvimunstable = {
      url = "github:nix-community/nixvim/main";
@@ -50,6 +48,7 @@
        top.nixvimunstable.overlays.default
        top.nurpkgs.overlays.default
        top.vsext.overlays.default
        top.minecraft.overlay
      ];
      metadata = builtins.fromJSON (builtins.readFile ./network.json);
      systems = [
@@ -68,6 +67,7 @@
          };
        }
      );
      lib' = import ./lib { inherit (top.nixunstable) lib; };
    in
    top.flake-parts.lib.mkFlake { inputs = top; } {
      inherit systems;
@@ -79,6 +79,7 @@
              nixpkgs = imported_packages.x86_64-linux;
              specialArgs = {
                inherit
                  lib'
                  metadata
                  self
                  top
@@ -115,7 +116,7 @@
        nixosConfigurations = (
          import ./hosts {
-            inherit top metadata;
+            inherit top metadata lib';
            nixpkgs = imported_packages;
          }
        );
@@ -1,24 +1,30 @@
 builds:
-  exclude:
+  # Exclude most things, as I locally build x86_64-linux and aarch64-linux
-    - "homeConfigurations.*"
+  - exclude:
-    - "nixosConfigurations.*"
+      - "homeConfigurations.*"
-    - "packages.*"
+      - "nixosConfigurations.*"
-    # bitwarden-cli package is broken on aarch64-darwin
+      - "packages.*"
-    - "packages.aarch64-darwin.img-bitwarden"
+      # bitwarden-cli package is broken on aarch64-darwin
-    # kmod-31 is not a thing on Darwin
+      - "packages.aarch64-darwin.img-bitwarden"
-    - "packages.aarch64-darwin.qemu-hook"
+      # kmod-31 is not a thing on Darwin
-    - "packages.aarch64-darwin.vfio_shutdown"
+      - "packages.aarch64-darwin.qemu-hook"
-    - "packages.aarch64-darwin.vfio_startup"
+      - "packages.aarch64-darwin.vfio_shutdown"
-    # This one is a bit of a beast and shouldn't take up Garnix time
+      - "packages.aarch64-darwin.vfio_startup"
-    - "packages.aarch64-darwin.zim"
+      # This one is a bit of a beast and shouldn't take up Garnix time
-    # These are just images which I will build when
+      - "packages.aarch64-darwin.zim"
-    # I feel like it
+      # These are just images which I will build when
-    - "devShells.*"
+      # I feel like it
-  include:
+      - "devShells.*"
-    - "packages.aarch64-darwin.*"
+    include:
-    - homeConfigurations.exodus
+      - "packages.aarch64-darwin.*"
-    - darwinConfigurations.MacBook-Pro
+      - darwinConfigurations.MacBook-Pro
-    - darwinConfigurations.MacBook-Prolocal
+      - darwinConfigurations.MacBook-Prolocal
-    - darwinConfigurations.li
+      - darwinConfigurations.li
-    - nixosConfigurations.builder-x86
+  # Some specific includes which are not specific enough to override the rules
-    - nixosConfigurations.builder-aarch
+  # above, due to the intrepretation of the glob excludes, but which I still
  # need included
  - include:
      # These are Mac homeConfigurations, which I do not have the infra
      # to build at home
      - homeConfigurations."gregory.hellings-mbp"
      - homeConfigurations.gregs-MacBook-Pro-16-inch-Nov-2024
@@ -1,5 +1,5 @@
 # vim: set filetype=nushell :
-let servers = [isaiah jeremiah zeke genesis vm-gitlab]
+let servers = [isaiah jeremiah zeke genesis]
 def par-map [ items: list, c: closure ] {
  let results = $items | par-each -k $c
@@ -71,6 +71,8 @@ def dc [ $cmd: string = "sh" ] {
 def claude [ ] {
    unlock
    $env.GITLAB_TOKEN = ^bw get item 7d3da4e9-5f9a-49d0-8e14-b39c010a4001 | from json | get fields | find claudeapi | get value
    #$env.ANTHROPIC_API_KEY = ^bw get item e122fd08-3506-4f21-9c6a-b42b00fe5be1 | from json | get login.password
    ^claude
 }
@@ -26,6 +26,7 @@
      nixcopy = "nix copy --to \"s3://binary-cache/?profile=default&endpoint=nas.home%3A9000&scheme=http\"";
      r = "run0";
      updateScript = "nix-shell maintainers/scripts/update.nix --argstr package";
      p = "${lib.getExe pkgs.podman-tui}";
      # General
      k = "kubectl";
@@ -5,7 +5,7 @@
  # This allows things like SSH in distrobox to read the config file just fine
  home.file.".ssh/config" = {
    target = ".ssh/config_source";
-    onChange = ''cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config'';
+    onChange = "cat ~/.ssh/config_source > ~/.ssh/config && chmod 600 ~/.ssh/config";
  };
  programs.ssh = {
    enable = true;
@@ -12,7 +12,7 @@
      dig
      jqp
      kubernetes-helm
-      iamb
+      #iamb
      lazyssh
      rainfrog
      tenere
@@ -38,11 +38,6 @@ def _ivr2(args):
    vpn("gregory_hellings@ra.ivrtechnology.com", "IVR Technology")
 aliases['ivr2'] = _ivr2
 def _glrestart(args):
    sudo nixos-container run gitlab -- systemctl restart gitlab
    sudo nixos-container run gitlab -- systemctl restart nginx
 aliases['glrestart'] = _glrestart
 def _aws_creds(args):
    $AWS_ACCESS_KEY_ID=$(bw get username "AWS Access Key")
    $AWS_SECRET_ACCESS_KEY=$(bw get password "AWS Access Key")
@@ -10,7 +10,8 @@ let
    let
      inherit (metadata.hosts.${host}) system;
      pkgs = nixpkgs.${system};
-      username = if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
+      username =
        if builtins.hasAttr "user" metadata.hosts.${host} then metadata.hosts.${host}.user else "greg";
    in
    top.hmunstable.lib.homeManagerConfiguration {
      inherit pkgs;
@@ -31,8 +32,4 @@ let
      };
    };
 in
-(
+(lib.genAttrs (builtins.attrNames (builtins.readDir ./hosts)) user)
  lib.genAttrs
    (builtins.attrNames (builtins.readDir ./hosts))
    user
 )
@@ -22,7 +22,7 @@ in
    top.agenix.homeManagerModules.default
    ./baseline
  ]
-  ++ lib.optionals (builtins.pathExists ./hosts/${host}) [ ./hosts/${host} ];
+  ++ lib.optionals (builtins.pathExists ./hosts/${host}/default.nix) [ ./hosts/${host} ];
  age = {
    identityPaths = [ "${homeDirectory}/.ssh/id_ed25519" ];
@@ -24,6 +24,7 @@
    minio-client
    mumble
    pre-commit
    prismlauncher
    restic
    restic-browser
    tea
@@ -22,11 +22,11 @@
      home-manager
      python3Packages.ipython
      just
      glab
      go
      gopls
      mariadb
      nixVersions.stable
      pipenv-ivr
      pre-commit
      python311
      python3Packages.flake8
@@ -41,9 +41,11 @@
            https://pypidev.ivrtechnology.com/simple/
      '';
      ".config/uv/uv.toml".text = ''
        index-strategy = "unsafe-first-match"
        [[index]]
        url = "https://pypidev.ivrtechnology.com/simple/"
        name = "pypidev"
        ignore-error-codes = [403]
      '';
    };
    username = username;
@@ -4,9 +4,11 @@
  ...
 }:
 let
-  python = pkgs.python312.withPackages (p: with p; [
+  python = pkgs.python312.withPackages (
-    ipython
+    p: with p; [
-  ]);
+      ipython
    ]
  );
 in
 {
  # Disables hitting local cache
@@ -27,11 +29,23 @@ in
      direnv
      home-manager
      just
      mcp-grafana
      nixVersions.stable
      podman
      poetry
      pre-commit
-      pulumi
+      (pulumi.withPackages (
        p: with p; [
          pulumi-aws-native
          pulumi-command
          pulumi-go
          pulumi-nodejs
          pulumi-python
        ]
      ))
      python
      rustc
      terraform
    ];
  };
@@ -1,7 +0,0 @@
 { pkgs, ... }:
 {
  greg.vscodium.enable = false;
  home.packages = with pkgs; [ brew ];
 }
@@ -53,9 +53,25 @@
  # Network Manager pulls in too many deps
  networking = {
    extraHosts =
      let
        onNetwork =
          attr: _k: v:
          (builtins.hasAttr attr v) && v.${attr} != null;
        getIPs =
          attr: domain:
          (lib.mapAttrsToList (host: v: "${builtins.getAttr attr v} ${host}.${domain}") (
            lib.filterAttrs (onNetwork attr) metadata.hosts
          ));
      in
      builtins.concatStringsSep "\n" (
        (getIPs "ts" "shire-zebra.ts.net")
        ++ (getIPs "nebulaIp" "nebula.thehellings.com")
        ++ (getIPs "nebulaIp" "nebula")
        ++ (getIPs "ip" "thehellings.lan")
      );
    search = [
-      "thehellings.lan"
+      "nebula.thehellings.com"
      "home"
    ];
    networkmanager.enable = false;
  };
@@ -114,17 +130,23 @@
    };
  };
-  security.sudo.extraRules = [
+  security = {
-    {
+    sudo-rs = {
-      users = [ "greg" ];
+      enable = true;
-      commands = [
+      extraRules = [
        {
-          command = "ALL";
+          users = [ "greg" ];
-          options = [ "NOPASSWD" ];
+          commands = [
            {
              command = "ALL";
              options = [ "NOPASSWD" ];
            }
          ];
        }
      ];
-    }
+    };
-  ];
+    sudo.enable = false;
  };
  # Define a user account. Don't forget to set a password with ‘passwd’.
  users.users.greg = {
@@ -1,5 +1,6 @@
 {
  top,
  lib',
  metadata,
  nixpkgs,
 }:
@@ -18,7 +19,7 @@ let
    channel.lib.nixosSystem {
      pkgs = nixpkgs.${system};
      specialArgs = {
-        inherit metadata top;
+        inherit metadata top lib';
      };
      modules = [
        {
@@ -44,16 +45,6 @@ in
    })
  )
 )
 // (lib.genAttrs
  (builtins.attrNames (lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./vm)))
  (
    name:
    (unstable {
      inherit name;
      extraMods = [ ./vm/${name} ];
    })
  )
 )
 // {
  # nix build '.#nixosConfigurations.wsl.config.system.build.installer'
  #nixos = wsl { name = "wsl"; };
@@ -62,26 +53,4 @@ in
  #  name = "wsl";
  #  system = "aarch64-linux";
  #};
  builder-aarch = lib.nixosSystem {
    system = "aarch64-linux";
    modules = [
      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
      {
        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
        boot.loader.grub.devices = [ "/dev/vda" ];
      }
    ];
  };
  builder-x86 = lib.nixosSystem {
    system = "x86_64-linux";
    modules = [
      "${top.nixunstable}/nixos/modules/profiles/nix-builder-vm.nix"
      {
        virtualisation.host.pkgs = import top.nixunstable { system = "aarch64-darwin"; };
        boot.loader.grub.devices = [ "/dev/vda" ];
      }
    ];
  };
 }
@@ -18,7 +18,11 @@
  boot = {
    loader = {
-      systemd-boot.enable = true;
+      systemd-boot = {
        enable = true;
        memtest86.enable = true;
        netbootxyz.enable = true;
      };
      efi.canTouchEfiVariables = true;
    };
    binfmt.emulatedSystems = [
@@ -39,10 +43,6 @@
      enable = true;
      tags = [ "mobile" ];
    };
    runner = {
      enable = true;
      qemu = true;
    };
  };
  hardware = {
@@ -2,48 +2,18 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
-{ lib, pkgs, ... }:
+{ top, pkgs, ... }:
 let
  adblockUpdate = pkgs.writeShellApplication {
    name = "adblock-update";
    runtimeInputs = with pkgs; [
      curl
      gnused
      systemd
    ];
    text = ''
      curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
      curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
      # Custom domains that I need to preserve for some reason
      for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com" "click.discord.com"; do
       	sed -i -e "/''${f}/d" /etc/adblock_hosts  # Blocks Trelly content for house investors
      done
      systemctl restart dnsmasq
    '';
  };
 in
 {
  imports = [
    # Include the results of the hardware scan.
    ./hardware-configuration.nix
    ./networking.nix
    top.minecraft.nixosModules.minecraft-servers
  ];
  greg = {
    home = true;
    gnome.enable = false;
    nebula = {
      enable = true;
      # genesis IS the routing node for the home LAN — it does not route through itself.
      # Override the module default (which points at genesis) to avoid a routing loop.
      unsafeRoutes = [ ];
      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
      routesSubnet = "10.42.0.0/16";
    };
    proxies = {
    };
  };
@@ -67,20 +37,109 @@ in
  networking.hostName = "genesis"; # Define your hostname.
-  systemd = {
+  services = {
-    services.adblock-update = {
+    minecraft-servers = {
-      after = [ "network-online.target" ];
+      enable = true;
-      requires = [ "network-online.target" ];
+      eula = true;
-      script = lib.getExe adblockUpdate;
+      openFirewall = true;
-      serviceConfig.Type = "oneshot";
+
-    };
+      servers = {
-    timers.adblock-update = {
+        maya = {
-      wantedBy = [ "multi-user.target" ];
+          enable = true;
-      after = [ "network-online.target" ];
+          operators = {
-      requires = [ "network-online.target" ];
+            Almec = {
-      timerConfig = {
+              bypassesPlayerLimit = true;
-        OnCalendar = "daily";
+              uuid = "7884dc5a-ae21-43d5-9506-a934d59be19a";
-        Unit = "adblock-update.service";
+            };
          };
          package = pkgs.fabricServers.fabric.override { jre_headless = pkgs.openjdk25_headless; };
          serverProperties = {
            allow-flight = true;
            motd = "Maya's Minecraft World";
          };
          whitelist = { };
          jvmOpts = "-Xms4092M -Xmx4092M";
          symlinks = {
            mods = pkgs.linkFarmFromDrvs "mods" (
              builtins.attrValues {
                # Health info
                appleskin = pkgs.fetchurl {
                  url = "https://cdn.modrinth.com/data/EsAfCjCV/versions/HwaLJe3v/appleskin-fabric-mc26.1-3.0.9.jar";
                  hash = "sha256-iNCycR/oxqFpbPGfIcfgfWOm7PzPiIu5AmBWb8asTb4=";
                };
                # Needed by survivalfly
                balm = pkgs.fetchurl {
                  url = "https://mediafilez.forgecdn.net/files/7959/843/balm-fabric-26.1.2-26.1.2.4.jar";
                  hash = "sha256-zDtDxkxOftpW0wUIap7l6abGCjXNczwrF2wLZDztyA0=";
                };
                # Adds more diverse biomes
                # https://www.curseforge.com/minecraft/mc-mods/biomes-o-plenty
                biomes = pkgs.fetchurl {
                  url = "https://mediafilez.forgecdn.net/files/7977/180/BiomesOPlenty-fabric-26.1.2-26.1.2.0.3.jar";
                  hash = "sha256-0aPtsRep0ftbkKqbp69PgUnNJyOBLY9vcPsB1mhOy/M=";
                };
                # Automation engines
                # https://www.curseforge.com/minecraft/mc-mods/create
                #create = pkgs.fetchurl {
                #  url = "https://mediafilez.forgecdn.net/files/7963/363/create-1.21.1-6.0.10.jar";
                #  hash = "sha256-74f+Vwnxuh9bi7IKKSW1r7RmnheP1ti/EMFndZ7v43o=";
                #};
                fabric_api = pkgs.fetchurl {
                  url = "https://cdn.modrinth.com/data/P7dR8mSH/versions/tnmuHGZA/fabric-api-0.146.1%2B26.1.2.jar";
                  hash = "sha256-8Jy/xmxRtw4z4GJ+38wwbXHVn4NGYp4w/mFvW9cmvKg=";
                };
                # Required by biomes-o-plenty
                # https://www.curseforge.com/minecraft/mc-mods/glitchcore
                glitchcore = pkgs.fetchurl {
                  url = "https://mediafilez.forgecdn.net/files/7975/608/GlitchCore-fabric-26.1.2-26.1.2.0.0.jar";
                  hash = "sha256-IDz+TblWvgt4UxFg3L3DhFMEESoX7y5cTOvXhyccQm8=";
                };
                # Tooltips
                # https://www.curseforge.com/minecraft/mc-mods/jade/
                jade = pkgs.fetchurl {
                  url = "https://mediafilez.forgecdn.net/files/7886/518/Jade-mc26.1-Fabric-26.0.8.jar";
                  hash = "sha256-Pc3R5eO4Jf+94mNMPtY/vvpbomp+S+qnAUAVbQk1r2Y=";
                };
                # Gives info on crafting recipes
                # https://www.curseforge.com/minecraft/mc-mods/jei
                jei = pkgs.fetchurl {
                  url = "https://mediafilez.forgecdn.net/files/7920/925/jei-26.1.2-fabric-29.5.0.26.jar";
                  hash = "sha256-7nF7fXYPIg9the/mxi6pUYEmKtosZO6yL2b0Dgf8+fI=";
                };
                # Machines
                # https://www.curseforge.com/minecraft/mc-mods/mekanism
                #mekanism = pkgs.fetchurl {
                #  url = "https://mediafilez.forgecdn.net/files/7904/58/Mekanism-1.21.1-10.7.19.85.jar";
                #  hash = "sha256-AE28nzEG9NGSrqoe4RkN0W7JyoBZ7T0JO4ADT0xXT0M=";
                #};
                # Shows installed mods
                modmenu = pkgs.fetchurl {
                  url = "https://cdn.modrinth.com/data/mOgUt4GM/versions/jvjwXH6l/modmenu-18.0.0-alpha.8.jar";
                  hash = "sha256-u0gtCOVAnNxyHcslo+y9l/jCGsFb+U/Y8soiUilhZDA=";
                };
                # Better storage engines
                # https://www.curseforge.com/minecraft/mc-mods/refined-storage
                refined-storage = pkgs.fetchurl {
                  url = "https://mediafilez.forgecdn.net/files/7961/605/refinedstorage-fabric-3.0.0-beta.5.jar";
                  hash = "sha256-UiXNrGw/giCZAnCjFzFc9k4mrq6deTtL6Z00arSUFOU=";
                };
                survivalfly = pkgs.fetchurl {
                  url = "https://mediafilez.forgecdn.net/files/7870/312/survivalfly-1.3_fabric-mc26.1.1.jar";
                  hash = "sha256-Kai4wSxckpXbs1yLp8wJ4BmmjNkdDbeqerqWGIz3+Zk=";
                };
                # Also needed by biomes
                # https://www.curseforge.com/minecraft/mc-mods/terrablender-fabric
                terrablender = pkgs.fetchurl {
                  url = "https://mediafilez.forgecdn.net/files/7933/873/TerraBlender-fabric-26.1.2-26.1.2.0.1.jar";
                  hash = "sha256-lUrkmMIod54Qj78H0rzT4EYoEeiBG7w6sVOJlRvsnQ4=";
                };
              }
            );
          };
        };
      };
    };
  };
@@ -22,8 +22,6 @@
 # VMs
 10.42.4.1 matrix matrix.thehellings.lan
 #10.42.4.2 vm-jellyfin vm-jellyfin.thehellings.lan
 10.42.4.3 git gitlab git.thehellings.lan gitlab.thehellings.lan
 # VIP
 10.42.5.1 longhorn.cluster matrix.cluster pgadmin.cluter postgres.cluster immich.cluster
@@ -37,7 +35,6 @@
 100.88.91.27 dns.home
 100.70.99.91 exodus.home exodus.shire-zebra.ts.net
 100.96.198.104 genesis.home genesis.shire-zebra.ts.net smart.home zwave.home nixcache.home gitcache.home dashy.home uptime.home speed.home
 100.117.28.111 gitlab.home gitlab.shire-zebra.ts.net gitlab.thehellings.lan registry.thehellings.lan git.thehellings.lan
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net grafana.home
 100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes longhorn.kubernetes
 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes immich.kubernetes postgres.kubernetes buildbot.home
@@ -1,7 +1,9 @@
 {
  config,
-  pkgs,
+  lib,
  lib',
  metadata,
  pkgs,
  ...
 }:
 let
@@ -9,7 +11,6 @@ let
  lanIP = metadata.hosts.${config.networking.hostName}.ip;
  iot = "enp2s0";
  iotIP = "192.168.66.250";
  #routerIP = metadata.infra.gw;
  extraHosts = builtins.readFile ./net/hosts;
  proxyPort = 3128;
@@ -24,9 +25,20 @@ let
  ];
 in
 {
-  greg.tailscale = {
+  greg = {
-    enable = true;
+    nebula = {
-    tags = [ "home" ];
+      enable = true;
      # genesis IS the routing node for the home LAN — it does not route through itself.
      # Override the module default (which points at genesis) to avoid a routing loop.
      unsafeRoutes = [ ];
      # genesis routes the home LAN (10.42.0.0/16) into the Nebula overlay.
      # Sign genesis's cert with -subnets '10.42.0.0/16' (see secrets/nebula/README.md).
      routesSubnet = "10.42.0.0/16";
    };
    tailscale = {
      enable = true;
      tags = [ "home" ];
    };
  };
  # Really, why do I still have to force-disable this crap?
@@ -84,33 +96,43 @@ in
    #########
    # dnsmasq config
    ########
-    dnsmasq = {
+    bind = {
      enable = true;
-      settings = {
+      cacheNetworks = [
-        domain = "thehellings.lan";
+        metadata.infra.lan
-        expand-hosts = true;
+        metadata.infra.tailscale
-        log-queries = true;
+        metadata.infra.nebula
-        no-hosts = true; # Do not read /etc/hosts, which makes genesis resolve to 127.0.0.2
+        "127.0.0.0/8"
-        addn-hosts = "/etc/adblock_hosts";
+      ];
-        hostsdir = "/etc/hosts.d/";
+      zones =
-        server = dnsServers;
+        let
-      };
+          makeZoneFile =
-    };
+            hosts: domain:
-
+            let
-    prometheus.exporters = {
+              preamble = [
-      dnsmasq.enable = true;
+                "$ORIGIN\t${domain}."
-      blackbox = {
+                "$TTL\t1h"
-        enable = true;
+                "@\tIN\tSOA\t${config.networking.hostName}\tgreg@thehellings.com (1 1m 1m 1m 1m)"
-        openFirewall = true;
+                "\tIN\tNS\t${config.networking.hostName}"
-        configFile = pkgs.writeText "blackbox.yml" ''
+              ];
-          modules:
+              makeHost = host: "${host.name}\tIN\tA\t${host.address}";
-            icmp:
+            in
-              prober: icmp
+            pkgs.writeText "${domain}" (
-              timeout: 5s
+              builtins.concatStringsSep "\n" (preamble ++ (lib.map makeHost hosts) ++ [ "" ])
-              icmp:
+            );
-                preferred_ip_protocol: ip4
+        in
-        '';
+        lib.mapAttrs
-      };
+          (domain: net: {
            master = true;
            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
          })
          {
            "shire-zebra.ts.net" = "tailscale";
            "nebula.thehellings.com" = "nebula";
            nebula = "nebula";
            "thehellings.lan" = "lan";
            lan = "lan";
          };
    };
  }; # End of services configuration
@@ -43,10 +43,6 @@
      tags = [ "home" ];
    };
    remote-builder.enable = true;
    runner = {
      enable = true;
      qemu = true;
    };
    gitea-runner = {
      enable = true;
      extraLabels = [ "bare-metal:host" ];
@@ -22,8 +22,6 @@ in
  ];
  age.secrets = {
    runner-reg.file = ../../../secrets/gitlab/nixos-qemu-shell.age;
    gitea-buildbotWorkersFile = mk ../../../secrets/gitea/buildbotWorkersFile.age;
    gitea-oauthToken = mk ../../../secrets/gitea/oauthToken.age;
    gitea-oauthSecret = mk ../../../secrets/gitea/oauthSecret.age;
@@ -95,11 +93,6 @@ in
      tags = [ "home" ];
    };
    remote-builder.enable = true;
    runner = {
      enable = true;
      threads = 3;
      qemu = true;
    };
  };
  hardware = {
@@ -66,20 +66,4 @@
      immichUrl = "https://immich.shire-zebra.ts.net";
    };
  };
  security.sudo.extraRules = [
    {
      users = [ "gitlab-runner" ];
      commands = [
        {
          command = "/run/current-system/sw/bin/systemctl";
          options = [ "NOPASSWD" ];
        }
        {
          command = "/run/current-system/sw/bin/podman";
          options = [ "NOPASSWD" ];
        }
      ];
    }
  ];
 }
@@ -13,7 +13,7 @@
  services.nextcloud = {
    enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud33;
    appstoreEnable = true;
    hostName = "next.${config.networking.domain}";
    https = true;
@@ -24,7 +24,6 @@ in
  virtualisation.oci-containers = {
    backend = "podman";
    containers."homepage" = {
      # needs explicit port to match what gitlab-runner sees when pulling
      image = "registry.thehellings.com:443/greg/homepage/gregs-homepage:latest";
      ports = [ "${homepage}:80" ];
    };
@@ -28,10 +28,6 @@
    };
    nebula.enable = true;
    remote-builder.enable = true;
    runner = {
      enable = true;
      vbox = false;
    };
    tailscale = {
      enable = true;
      tags = [ "home" ];
@@ -35,10 +35,11 @@
      device = "/dev/nvme0n1p1";
      fsType = "auto";
    };
-    #"/mnt/disk1" = {
+    "/mnt/disk1" = {
-    #device = "/dev/disk/by-uuid/0bb64e76-8811-499a-b60e-cc97808f2b0e";
+      device = "/dev/disk/by-uuid/bd04e868-034e-46e8-84ae-cd7347448bbd";
-    #fsType = "btrfs";
+      fsType = "xfs";
-    #};
+      options = [ "nofail" ];
    };
  };
  swapDevices = [ ];
@@ -1,273 +0,0 @@
 # Edit this configuration file to define what should be installed on
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 {
  config,
  pkgs,
  lib,
  ...
 }:
 let
  registryPort = 5000;
  vpnIp = "100.117.28.111";
 in
 {
  imports = [
    ./hardware-configuration.nix
  ];
  age.secrets =
    let
      cfg = n: {
        file = ../../../secrets/gitlab/${n}.age;
        owner = "gitlab";
        group = "gitlab";
        mode = "0444";
      };
    in
    {
      gitlab-secret = cfg "secret";
      gitlab-otp = cfg "otp";
      gitlab-db = cfg "db";
      gitlab-db-password = cfg "db-password";
      gitlab-jws = cfg "jws";
      gitlab-key = cfg "key";
      gitlab-cert = cfg "cert";
      gitlab-salt = cfg "salt";
      gitlab-primary-key = cfg "primary-key";
      gitlab-deterministic-key = cfg "deterministic-key";
      minio_access_key_id = {
        file = ../../../secrets/minio_access_key_id.age;
        owner = "gitlab";
        group = "gitlab";
        mode = "0444";
      };
      minio_secret_access_key = {
        file = ../../../secrets/minio_secret_access_key.age;
        owner = "gitlab";
        group = "gitlab";
        mode = "0444";
      };
    };
  greg = {
    backup.jobs.nas-backup = {
      src = "/var/gitlab/state/backup/";
      dest = "gitlab";
    };
    home = true;
    tailscale = {
      enable = true;
      tags = [ "home" ];
    };
  };
  networking = {
    hostName = "gitlab"; # Define your hostname.
    firewall.allowedTCPPorts = [
      80
      registryPort
    ];
  };
  services = {
    gitlab = {
      enable = true;
      backup = {
        keepTime = 288;
        startAt = [ "03:00" ];
      };
      databaseHost = "postgres.kubernetes";
      databaseName = "gitlab";
      databaseUsername = "gitlab";
      databasePasswordFile = config.age.secrets.gitlab-db-password.path;
      databaseCreateLocally = false;
      extraConfig = {
        registry.port = null;
        gitlab = {
          trustedProxies = [
            "${vpnIp}/32" # The system itself
            "100.109.86.8/32" # Public server's IP
          ];
        };
        object_store = {
          enabled = true;
          proxy_download = true; # Tell them to reach out to object storage themselves!
          connection = {
            provider = "AWS";
            endpoint = "http://s3.thehellings.lan:9000";
            region = "us-east-1";
            aws_access_key_id = {
              _secret = config.age.secrets.minio_access_key_id.path;
            };
            aws_secret_access_key = {
              _secret = config.age.secrets.minio_secret_access_key.path;
            };
            path_style = true; # True for MinIO
            aws_signature_version = 2;
          };
          #storage_options = ...;
          objects = builtins.listToAttrs (
            builtins.map
              (
                x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }
              )
              [
                "artifacts"
                "ci_secure_files"
                "dependency_proxy"
                "external_diffs"
                "lfs"
                "packages"
                "pages"
                "terraform_state"
                "uploads"
              ]
          );
        };
      };
      host = "src.thehellings.com";
      https = true;
      initialRootEmail = "greg@thehellings.com";
      initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
      pages = {
        enable = true;
        settings.pages-domain = "pages.thehellings.com";
      };
      port = 443;
      puma = {
        threadsMax = 6;
        threadsMin = 2;
        workers = 6;
      };
      redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
      registry = {
        enable = true;
        certFile = config.age.secrets.gitlab-cert.path;
        keyFile = config.age.secrets.gitlab-key.path;
        externalAddress = "registry.thehellings.com";
        externalPort = 443;
      };
      secrets = {
        activeRecordDeterministicKeyFile = config.age.secrets.gitlab-deterministic-key.path;
        activeRecordPrimaryKeyFile = config.age.secrets.gitlab-primary-key.path;
        activeRecordSaltFile = config.age.secrets.gitlab-salt.path;
        dbFile = config.age.secrets.gitlab-db.path;
        jwsFile = config.age.secrets.gitlab-jws.path;
        otpFile = config.age.secrets.gitlab-otp.path;
        secretFile = config.age.secrets.gitlab-secret.path;
      };
    };
    nginx = {
      enable = true;
      clientMaxBodySize = "25000m";
      virtualHosts = {
        "vm-gitlab.shire-zebra.ts.net" = {
          listen = [
            {
              addr = "0.0.0.0";
              port = 443;
              ssl = true;
            }
          ];
          locations."/" = {
            proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
            recommendedProxySettings = true;
          };
          extraConfig = ''
            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
            client_max_body_size 10000m ;
          '';
        };
        "registry" = {
          listen = [
            {
              addr = "0.0.0.0";
              port = registryPort;
              ssl = true;
            }
          ];
          locations."/" = {
            proxyPass = "http://127.0.0.1:4567/";
            recommendedProxySettings = true;
          };
          extraConfig = ''
            ssl_certificate /etc/certs/vm-gitlab.shire-zebra.ts.net.crt ;
            ssl_certificate_key /etc/certs/vm-gitlab.shire-zebra.ts.net.key ;
            client_max_body_size 25000m ;
          '';
          serverAliases = [
            "vm-gitlab.shire-zebra.ts.net"
          ];
        };
      };
    };
    openssh.enable = true;
    postgresql.enable = true;
    qemuGuest.enable = true;
    redis.servers.gitlab = {
      enable = true;
    };
    #resolved.enable = true;
  };
  # Do not start nginx until we have tailscaled up and running, so it can bind
  # to the 100.* addresses
  systemd = {
    services = {
      certRefresh =
        let
          script = pkgs.writeShellApplication {
            name = "cert-refresh";
            runtimeInputs = [ pkgs.tailscale ];
            text = ''
              cd /etc/certs
              tailscale cert vm-gitlab.shire-zebra.ts.net
              chown nginx ./*
              systemctl reload nginx
            '';
          };
        in
        {
          script = lib.getExe script;
          serviceConfig = {
            Type = "oneshot";
            User = "root";
          };
        };
      nginx = rec {
        after = [ "network-online.target" ];
        requires = [ "network-online.target" ];
        wants = after;
        serviceConfig = {
          RestartMaxDelaySec = "30s";
          RestartSteps = "5";
        };
      };
      tailscaled.partOf = [ "network-online.target" ];
    };
    timers = {
      "cert-refresh" = {
        wantedBy = [ "cert-refresh.service" ];
        timerConfig = {
          OnCalendar = "monthly";
          Persistent = true;
        };
      };
    };
  };
  system.stateVersion = lib.mkForce "24.11";
 }
@@ -1,58 +0,0 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
 {
  lib,
  modulesPath,
  ...
 }:
 {
  imports = [
    (modulesPath + "/profiles/qemu-guest.nix")
  ];
  # Bootloader.
  boot = {
    extraModulePackages = [ ];
    initrd = {
      availableKernelModules = [
        "uhci_hcd"
        "ehci_pci"
        "ahci"
        "virtio_pci"
        "virtio_scsi"
        "sd_mod"
        "sr_mod"
      ];
      kernelModules = [ ];
    };
    loader = {
      efi.canTouchEfiVariables = true;
      systemd-boot.enable = true;
    };
  };
  fileSystems."/" = {
    device = lib.mkDefault "/dev/disk/by-uuid/1fdbe86e-ce6f-4af3-a876-aec35731adab";
    fsType = "ext4";
  };
  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/1E6A-C3BB";
    fsType = "vfat";
    options = [
      "fmask=0077"
      "dmask=0077"
    ];
  };
  swapDevices = [ ];
  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
  # (the default) this is the recommended approach. When using systemd-networkd it's
  # still possible to use this option, but it's recommended to use it in conjunction
  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
  networking.useDHCP = lib.mkDefault true;
  # networking.interfaces.enp6s18.useDHCP = lib.mkDefault true;
 }
@@ -0,0 +1,24 @@
 { lib, ... }:
 {
  hostsByNet =
    net: hosts:
    let
      netAttr =
        {
          lan = "ip";
          nebula = "nebulaIp";
          tailscale = "ts";
        }
        .${net};
    in
    lib.mapAttrsToList
      (name: value: {
        inherit name;
        address = builtins.getAttr netAttr value;
      })
      (
        lib.filterAttrs (
          _host: settings: (builtins.hasAttr netAttr settings) && (builtins.getAttr netAttr settings) != null
        ) hosts
      );
 }
@@ -40,7 +40,7 @@ metadata:
        },
        {
          "path": "/mnt/disk1",
-          "allowScheduling": false,
+          "allowScheduling": true,
          "tags": ["hdd", "large"]
        }
      ]
@@ -21,9 +21,6 @@ spec:
    spec:
      containers:
        - name: bitwarden-cli
          # Since my gitlab instance depends on the database hosted in k3s, and
          # the database depends on this image, I need a way to bootstrap the
          # system if # I am doing disaster recovery. And this is it.
          image: "ghcr.io/greg-hellings/nixos-config/img-bitwarden:latest"
          #image: >-
          #  registry.thehellings.com/greg/nixos-config/img-bitwarden:latest
@@ -1,32 +1,21 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: kubernetes-dashboard
+  name: headlamp
 spec:
-  url: https://kubernetes.github.io/dashboard/
+  url: "https://kubernetes-sigs.github.io/headlamp/"
  interval: "24h"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: kubernetes-dashboard
+  name: headlamp
 spec:
  interval: "24h"
  chart:
    spec:
-      chart: kubernetes-dashboard
+      chart: headlamp
      sourceRef:
        kind: HelmRepository
-        name: kubernetes-dashboard
+        name: headlamp
      interval: "24h"
  values:
    app:
      settings:
        global:
          clusterName: Hellings Home
          itemsPerPage: 25
      ingress:
        enabled: true
        hosts:
          - dashboard.shire-zebra.ts.net
        ingressClassName: tailscale
@@ -0,0 +1,14 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: dashboard-tailscale
 spec:
  ingressClassName: tailscale
  defaultBackend:
    service:
      name: headlamp
      port:
        number: 3001
  tls:
    - hosts:
        - headlamp
@@ -4,3 +4,4 @@ resources:
  - namespace.yaml
  - chart.yaml
  - user.yaml
  - ingress.yaml
@@ -1,89 +0,0 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
  name: immich
 spec:
  imageName: "ghcr.io/corentingiraud/cnpg-pgvector-vectorchord:16-migration"
  #imageName: "ghcr.io/tensorchord/cloudnative-pgvecto.rs:16-v0.3.0"
  #postgresUID: 1
  instances: 1
  storage:
    size: 60Gi
  primaryUpdateStrategy: unsupervised
  postgresql:
    shared_preload_libraries:
      - vectors.so
      - vchord.so
  bootstrap:
    recovery:
      source: origin
    # initdb:
    #   database: immich
    #   owner: immich
    #   secret:
    #     name: postgres-user-immich
    #   dataChecksums: true
    #   postInitApplicationSQL:
    #     - ALTER SYSTEM SET search_path TO "$user", public, vectors;
    #     - SET search_path TO "$user", public, vectors;
    #     - CREATE EXTENSION IF NOT EXISTS "cube";
    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance";
    #     - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
  externalClusters:
    - name: origin
      plugin:
        name: barman-cloud.cloudnative-pg.io
        parameters:
          barmanObjectName: k3sbackup-objectstore
          serverName: pgvector
  managed:
    roles:
      - name: immich
        ensure: present
        comment: Immich DB user
        login: true
        superuser: true
        passwordSecret:
          name: postgres-user-immich
  plugins:
    - name: barman-cloud.cloudnative-pg.io
      isWALArchiver: true
      parameters:
        barmanObjectName: k3sbackup-objectstore
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: Database
 metadata:
  name: database-immich
 spec:
  name: immich
  owner: immich
  cluster:
    name: immich
  extensions:
    - name: vectors
      ensure: present
    - name: vectorchord
      ensure: present
    - name: cube
      ensure: present
    - name: earthdistance
      ensure: present
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup
 metadata:
  name: immich-backup
 spec:
  immediate: true # Create one when this is added to the cluster
  schedule: "0 2 0 * * *" # 1AM, nightly
  backupOwnerReference: self
  cluster:
    name: immich
  method: plugin
  pluginConfiguration:
    name: barman-cloud.cloudnative-pg.io
@@ -14,14 +14,12 @@ spec:
      - 100.88.91.27 # dns?
      - 100.80.99.48 # exodus
      - 100.88.91.27 # genesis
      - 100.117.28.111 # gitlab
      - 100.68.203.1 # hosea
      - 100.84.183.79 # isaiah
      - 100.102.186.39 # jeremiah
      - 100.90.74.19 # zeke
      - 100.115.57.8 # linode
      - 100.65.5.38 # matrix
      #- 100.127.55.22 # jellyfin
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRouteTCP
@@ -4,8 +4,6 @@ resources:
  - namespace.yaml
  - secrets.yaml
  - postgres-cluster.yaml
  - postgres-gitlab.yaml
  - postgres-pgadmin.yaml
  - postgres-matrix.yaml
  - immich.yaml
  - ingress.yaml
@@ -11,13 +11,6 @@ spec:
  managed:
    roles:
      - name: gitlab
        ensure: present
        comment: Gitlab user
        login: true
        superuser: false
        passwordSecret:
          name: postgres-user-gitlab
      - name: pgadmin
        ensure: present
        comment: PG Admin user
@@ -1,9 +0,0 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Database
 metadata:
  name: database-gitlab
 spec:
  name: gitlab
  owner: gitlab
  cluster:
    name: postgres
@@ -1,39 +1,5 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: postgres-user-gitlab
  namespace: db
 spec:
  target:
    name: postgres-user-gitlab
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        username: |-
          {{ .username }}
        password: |-
          {{ .password }}
  data:
    - secretKey: username
      sourceRef:
        storeRef:
          name: bitwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
        property: username
    - secretKey: password
      sourceRef:
        storeRef:
          name: bitwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 5282ad16-c2dc-49d3-8fb3-b2e9012bab57
        property: password
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: postgres-user-matrix
  namespace: db
@@ -133,37 +99,3 @@ spec:
      remoteRef:
        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
        property: password
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: postgres-user-immich
  namespace: db
 spec:
  target:
    name: postgres-user-immich
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        username: |-
          {{ .username }}
        password: |-
          {{ .password }}
  data:
    - secretKey: username
      sourceRef:
        storeRef:
          name: bitwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
        property: username
    - secretKey: password
      sourceRef:
        storeRef:
          name: bitwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
        property: password
@@ -15,7 +15,7 @@ spec:
  chart:
    spec:
      chart: gitea
-      version: "12.5.0"
+      version: "12.5.3"
      sourceRef:
        kind: HelmRepository
        name: gitea-repository
@@ -35,7 +35,7 @@ spec:
      storageClass: longhorn-default
    image:
-      tag: "1.25.4"
+      tag: "1.25.5"
    replicaCount: 1
@@ -76,4 +76,3 @@ spec:
                    secretKeyRef:
                      name: gitea-config
                      key: minio_secret
@@ -13,10 +13,10 @@ spec:
          USER={{ .dbuser }}
          PASSWD="""{{ .dbpass }}"""
        storage: |-
-          MINIO_ACCESS_KEY_ID={{ .minio_key }}
+          MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
-          MINIO_SECRET_ACCESS_KEY={{ .minio_secret }}
+          MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
-        minio_key: "{{ .minio_nas1_key }}"
+        #minio_key: "{{ .minio_nas1_key }}"
-        minio_secret: "{{ .minio_nas1_secret }}"
+        #minio_secret: "{{ .minio_nas1_secret }}"
  secretStoreRef:
    name: bitwarden-login
    kind: ClusterSecretStore
@@ -1,64 +0,0 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: gitlab-runner
 spec:
  interval: "24h"
  url: https://charts.gitlab.io
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: gitlab-runner
 spec:
  interval: 10m
  chart:
    spec:
      chart: gitlab-runner
      version: "0.83.1"
      sourceRef:
        kind: HelmRepository
        name: gitlab-runner
      interval: "1h"
  dependsOn:
    - name: external-secrets
      namespace: external-secrets
    - name: tailscae
      namespace: tailscale
  values:
    crds:
      create: true
    includeCRDs: true
    gitlabUrl: https://src.thehellings.com
    runners:
      secret: gitlab-runner
    imagePullSecrets:
      - name: image-pull-secrets
    rbac:
      create: true
    serviceAccount:
      create: true
    metrics:
      enabled: true
    extraEnv:
      CACHE_TYPE: s3
      CACHE_SHARED: "true"
      CACHE_S3_BUCKET_NAME: gitlab-runner-cache
      CACHE_S3_INSECURE: "true"
    extraEnvFrom:
      PACKER_GITHUB_API_TOKEN:
        secretKeyRef:
          name: gitlab-runner
          key: PACKER_GITHUB_API_TOKEN
      CACHE_S3_SERVER_ADDRESS:
        secretKeyRef:
          name: gitlab-runner
          key: CACHE_S3_SERVER_ADDRESS
      CACHE_S3_ACCESS_KEY:
        secretKeyRef:
          name: s3-access
          key: username
      CACHE_S3_SECRET_KEY:
        secretKeyRef:
          name: s3-access
          key: password
@@ -1,6 +0,0 @@
 namespace: gitlab-runner
 resources:
  - namespace.yaml
  - secrets.yaml
  - chart.yaml
@@ -1,4 +0,0 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: gitlab-runner
@@ -1,101 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: gitlab-runner
  namespace: gitlab-runner
 spec:
  secretStoreRef:
    name: bitwarden-fields
    kind: ClusterSecretStore
  target:
    name: gitlab-runner
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        runner-registration-token: ""
        runner-token: "{{ .runnerToken }}"
        PACKER_GITHUB_API_TOKEN: "{{ .PACKER_GITHUB_API_TOKEN }}"
        CACHE_S3_SERVER_ADDRESS: "{{ .CACHE_S3_SERVER_ADDRESS }}"
  data:
    - secretKey: runnerToken
      remoteRef:
        key: &key 53719920-b100-4355-8c80-b2f9002fad22
        property: CI_SERVER_TOKEN
    - secretKey: PACKER_GITHUB_API_TOKEN
      remoteRef:
        key: *key
        property: PACKER_GITHUB_API_TOKEN
    - secretKey: CACHE_S3_SERVER_ADDRESS
      remoteRef:
        key: *key
        property: CACHE_S3_SERVER_ADDRESS
        # Includes
        # CI_SERVER_TOKEN
        # PACKER_GITHUB_API_TOKEN
        # CACHE_S3_SERVER_ADDRESS
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: s3-access
  namespace: gitlab-runner
 spec:
  secretStoreRef:
    name: bitwarden-login
    kind: ClusterSecretStore
  target:
    name: s3-access
    deletionPolicy: Delete
  data:
    - secretKey: username
      remoteRef:
        key: &key 04dd39c2-268d-4a33-aa4c-b1550166139f
        property: username
    - secretKey: password
      remoteRef:
        key: *key
        property: password
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: image-pull-secrets
  namespace: gitlab-runner
 spec:
  secretStoreRef:
    name: bitwarden-login
    kind: ClusterSecretStore
  target:
    deletionPolicy: Delete
    template:
      type: kubernetes.io/dockerconfigjson
      data:
        .dockerconfigjson: >-
          {
            "auths": {
              "https://index.docker.io/v1/": {
                "username": "{{ .user }}",
                "password": "{{ .password }}",
                "email": "greg.hellings@gmail.com",
                "auth": "{{ .auth }}"
              }
            }
          }
  data:
    - secretKey: user
      remoteRef:
        key: &key f560ae38-368c-4e58-898c-aeb90012d597
        property: username
    - secretKey: password
      remoteRef:
        key: *key
        property: password
    - secretKey: auth
      sourceRef:
        storeRef:
          name: bitwarden-fields
          kind: ClusterSecretStore
      remoteRef:
        key: *key
        property: auth
@@ -0,0 +1,36 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: external-secrets
 ---
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: external-secrets
  namespace: external-secrets
 spec:
  interval: "24h"
  url: "https://charts.external-secrets.io/"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: external-secrets
  namespace: external-secrets
 spec:
  interval: 10m
  chart:
    spec:
      chart: external-secrets
      version: "2.3.0"
      sourceRef:
        kind: HelmRepository
        name: external-secrets
      interval: "1h"
  values:
    crds:
      create: true
    includeCRDs: true
    webhook:
      certManager:
        enable: true
@@ -1,3 +1,6 @@
 resources:
  - kyverno.yaml
  - external-secrets.yaml
  - tailscale.yaml
  - longhorn.yaml # Needed for storage
  - traefik.yaml
@@ -0,0 +1,40 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: kyverno-system
 ---
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: kyverno
  namespace: kyverno-system
 spec:
  interval: "24h"
  url: "https://kyverno.github.io/kyverno/"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: kyverno
  namespace: kyverno-system
 spec:
  interval: 10m
  chart:
    spec:
      chart: kyverno
      version: "3.7.1"
      sourceRef:
        kind: HelmRepository
        name: kyverno
      interval: "1h"
  values:
    admissionController:
      replicas: 3
    backgroundController:
      replicas: 3
    cleanupController:
      replicas: 2
    reportsController:
      replicas: 2
    crds:
      install: true
@@ -19,10 +19,15 @@ metadata:
  namespace: longhorn-system
 spec:
  interval: 10m
  dependsOn:
    - name: tailscale
      namespace: tailscale
    - name: kyverno
      namespace: kyverno-system
  chart:
    spec:
      chart: longhorn
-      version: "1.10.2"
+      version: "1.11.1"
      sourceRef:
        kind: HelmRepository
        name: longhorn
@@ -1,3 +1,36 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: tailscale
 ---
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: tailscale
  namespace: tailscale
 spec:
  interval: "24h"
  url: "https://pkgs.tailscale.com/helmcharts"
 ---
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: tailscale
  namespace: tailscale
 spec:
  interval: 10m
  dependsOn:
    - name: external-secrets
      namespace: external-secrets
  chart:
    spec:
      chart: tailscale-operator
      version: "1.96.5"
      sourceRef:
        kind: HelmRepository
        name: tailscale
      interval: "1h"
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
@@ -32,9 +32,9 @@ spec:
        containers:
          main:
            image:
-              tag: v2.4.1
+              tag: v2.7.5
            env:
-              DB_HOSTNAME: immich-rw.db.svc.cluster.local
+              DB_HOSTNAME: immich-rw
              DB_DATABASE_NAME: immich
              DB_USERNAME:
                valueFrom:
@@ -0,0 +1,161 @@
 apiVersion: postgresql.cnpg.io/v1
 kind: Cluster
 metadata:
  name: immich
 spec:
  imageName: "ghcr.io/tensorchord/cloudnative-vectorchord:18"
  #postgresUID: 1
  instances: 1
  storage:
    size: 60Gi
  primaryUpdateStrategy: unsupervised
  postgresql:
    shared_preload_libraries:
      - vchord.so
  bootstrap:
    # Use these with the name "immich-1" to restore from the backups
    recovery:
      source: origin
    # Use these two lines in order to restore from the other database,
    # once it has restored from the WALs
    #pg_basebackup:
    #  source: restore
    # Use this block to bootstrap the cluster, if you don't have backups.
    # What are you doing without backups, you chump?!
    # initdb:
    #   database: immich
    #   owner: immich
    #   secret:
    #     name: postgres-user-immich
    #   dataChecksums: true
    #   postInitApplicationSQL:
    #     - ALTER SYSTEM SET search_path TO "$user", public, vectors;
    #     - SET search_path TO "$user", public, vectors;
    #     - CREATE EXTENSION IF NOT EXISTS "cube";
    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance";
    #     - GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO "immich";
  externalClusters:
    - name: origin
      plugin:
        name: barman-cloud.cloudnative-pg.io
        parameters:
          barmanObjectName: k3sbackup-objectstore
          serverName: immich
    - name: restore
      connectionParameters:
        host: immich-1-rw
        user: streaming_replica
        sslmode: verify-full
      sslCert:
        name: immich-1-replication
        key: tls.crt
      sslKey:
        name: immich-1-replication
        key: tls.key
      sslRootCert:
        name: immich-1-ca
        key: ca.crt
  managed:
    roles:
      - name: immich
        ensure: present
        comment: Immich DB user
        login: true
        superuser: true
        passwordSecret:
          name: postgres-user-immich
  plugins:
    - name: barman-cloud.cloudnative-pg.io
      isWALArchiver: true
      parameters:
        barmanObjectName: k3sbackup-objectstore
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: Database
 metadata:
  name: database-immich
 spec:
  name: immich
  owner: immich
  cluster:
    name: immich
  extensions:
    - name: vectors
      ensure: present
    - name: vectorchord
      ensure: present
    - name: cube
      ensure: present
    - name: earthdistance
      ensure: present
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: k3sbackup-externalsecret
 spec:
  target:
    name: k3sbackup-secret
    deletionPolicy: Delete
    template:
      type: Opaque
      data:
        username: |-
          {{ .username }}
        password: |-
          {{ .password }}
  data:
    - secretKey: username
      sourceRef:
        storeRef:
          name: bitwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
        property: username
    - secretKey: password
      sourceRef:
        storeRef:
          name: bitwarden-login
          kind: ClusterSecretStore
      remoteRef:
        key: 685b29c6-9264-4e60-ba4a-b2ea005a5d7b
        property: password
 ---
 apiVersion: barmancloud.cnpg.io/v1
 kind: ObjectStore
 metadata:
  name: k3sbackup-objectstore
 spec:
  configuration:
    destinationPath: "s3://k3sbackup/postgres"
    endpointURL: "http://chronicles.thehellings.lan:9000/"
    s3Credentials:
      accessKeyId:
        name: k3sbackup-secret
        key: username
      secretAccessKey:
        name: k3sbackup-secret
        key: password
    wal:
      compression: gzip
  retentionPolicy: "30d"
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup
 metadata:
  name: immich-backup
 spec:
  immediate: false # Create one when this is added to the cluster
  schedule: "0 2 0 * * *" # 1AM, nightly
  backupOwnerReference: self
  cluster:
    name: immich
  method: plugin
  pluginConfiguration:
    name: barman-cloud.cloudnative-pg.io
@@ -2,8 +2,9 @@ namespace: immich
 resources:
  - namespace.yaml
  - chart.yaml
  - postgres-user-secret.yaml
  - database.yaml
  - chart.yaml
  - pvc.yaml
  - ingress.yaml
  - backup.yaml
@@ -7,7 +7,6 @@ resources:
  - mariadb-operator
  - databases
  - matrix
  #- gitlab-runner
  - immich
  - monitoring
  - pinchflat
@@ -158,6 +158,8 @@ in
                  "https://thehellings.com"
                else
                  "https://kuma.shire-zebra.ts.net/";
              "devtools.debugger.remote-enabled" = true;
              "devtools.debugger.remote-port" = 9222;
              "doh-rollout.doorhanger-decision" = "UIDisabled";
              "doh-rollout.doneFirstRun" = true;
              "signon.rememberSignons" = false;
@@ -9,6 +9,7 @@
 let
  builderHosts = lib.filterAttrs (_n: v: (builtins.hasAttr "builder" v) && v.builder) metadata.hosts;
  cfg = config.greg.nix;
  hostname = x: if cfg.cache then "${x}.shire-zebra.ts.net" else "${x}.thehellings.lan";
 in
 {
  options.greg.nix = {
@@ -22,7 +23,7 @@ in
    programs.ssh.extraConfig = builtins.concatStringsSep "\n" (
      lib.map (x: ''
        Host ${x}-builder
-          Hostname ${x}.shire-zebra.ts.net
+          Hostname ${hostname x}
          User remote-builder-user
      '') (lib.attrNames builderHosts)
    );
@@ -57,12 +58,17 @@ in
          "gregory.hellings"
        ]; # For home and for work machines
        substituters =
-          (if cfg.cache then [
+          (
-            #"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
+            if cfg.cache then
-            "http://nas1.shire-zebra.ts.net:8080/default"
+              [
-          ] else [
+                #"http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
-            "http://nas1.thehellings.lan:8080/default"
+                "http://nas1.shire-zebra.ts.net:8080/default"
-          ])
+              ]
            else
              [
                "http://nas1.thehellings.lan:8080/default"
              ]
          )
          ++ [
            "https://ai.cachix.org"
            "https://nixpkgs-python.cachix.org"
@@ -0,0 +1,35 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 let
  cfg = config.greg.adblockUpdate;
 in
 {
  options.greg.adblockUpdate = {
    enable = lib.mkEnableOption "Enable auto-update of block list";
  };
  config = lib.mkIf cfg.enable {
    systemd = {
      services.adblock-update = {
        after = [ "network-online.target" ];
        requires = [ "network-online.target" ];
        script = lib.getExe pkgs.adblockUpdate;
        serviceConfig.Type = "oneshot";
      };
      timers.adblock-update = {
        wantedBy = [ "multi-user.target" ];
        after = [ "network-online.target" ];
        requires = [ "network-online.target" ];
        timerConfig = {
          OnCalendar = "daily";
          Unit = "adblock-update.service";
        };
      };
    };
  };
 }
@@ -4,12 +4,12 @@
 {
  imports = [
    ./adblock-update.nix
    ./albyhub.nix
    ./backup.nix
    ./ceph.nix
    ./db.nix
    ./gitea-runner.nix
    ./gitlab-runner.nix
    ./gnome.nix
    ./home.nix
    ./kde.nix
@@ -45,22 +45,27 @@ in
        "debian-latest:docker://node:25-trixie"
        "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
        "ubuntu-26.04:docker://docker.gitea.com/runner-images:ubuntu-26.04"
        "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
        "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
        "ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
        "ubuntu-full-26.04:docker://ghcr.io/catthehacker/ubuntu:full-26.04"
        "ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
        "ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
        "ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
        "ubuntu-act-26.04:docker://ghcr.io/catthehacker/ubuntu:act-26.04"
        "ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
        "ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
        "ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
        "ubuntu-runner-26.04:docker://ghcr.io/catthehacker/ubuntu:runner-26.04"
        "ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
        "ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
        "ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
        "ubuntu-rust-26.04:docker://ghcr.io/catthehacker/ubuntu:rust-26.04"
        "ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
        "ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
@@ -1,82 +0,0 @@
 {
  config,
  lib,
  pkgs,
  ...
 }:
 let
  cfg = config.greg.runner;
  environmentVariables = {
    EFI_DIR = "${pkgs.OVMF.fd}/FV/";
    STORAGE_URL = "s3.thehellings.lan:9000";
  };
  runnerCfg = file: {
    inherit environmentVariables;
    authenticationTokenConfigFile = file;
    executor = "shell";
    limit = cfg.threads;
  };
 in
 # We want exactly one of these to be true, but not both. Neither can both be false
 {
  options.greg.runner = {
    enable = lib.mkEnableOption "Enable as a gitlab-runner with both libvirt and virtualbox";
    threads = lib.mkOption {
      default = 5;
      type = lib.types.int;
      description = "The maximum number of concurrent jobs";
    };
    qemu = lib.mkEnableOption "Enable the qemu host (mutually exclusive with vbox)";
    vbox = lib.mkEnableOption "Enable the vbox host (mutually exclusive with qemu)";
  };
  config = lib.mkIf cfg.enable ({
    # assertions = [
    #   {
    #     assertion = cfg.qemu || cfg.vbox && (cfg.qemu != cfg.vbox);
    #     message = "You must enable exactly one of qemu or vbox";
    #   }
    # ];
    # Shared configurations
    age.secrets = {
      qemu.file = ../../secrets/gitlab/nixos-qemu-shell.age;
      vbox.file = ../../secrets/gitlab/nixos-vbox-shell.age;
    };
    services.gitlab-runner = {
      enable = false;
      settings.concurrent = cfg.threads;
      services = {
        qemu = lib.mkIf cfg.qemu (runnerCfg config.age.secrets.qemu.path);
        vbox = lib.mkIf cfg.vbox (runnerCfg config.age.secrets.vbox.path);
      };
    };
    systemd.services.gitlab-runner = {
      serviceConfig = {
        DevicePolicy = lib.mkForce "auto";
        User = "root";
        DynamicUser = lib.mkForce false;
      };
    };
    users.extraGroups.vboxusers.members = lib.optional cfg.vbox "greg";
    virtualisation = {
      libvirtd = lib.mkIf cfg.qemu {
        enable = true;
        allowedBridges = [
          "br0"
          "virbr0"
        ];
        onBoot = "ignore"; # only restart VMs labeled 'autostart'
      };
      virtualbox.host = lib.mkIf cfg.vbox {
        enable = true;
        enableExtensionPack = true;
      };
    };
  });
 }
@@ -2,14 +2,13 @@
  config,
  lib,
  pkgs,
  top,
  ...
 }:
 let
  cfg = config.greg.kubernetes;
  cert-manager = pkgs.fetchurl {
-    url = "https://github.com/cert-manager/cert-manager/releases/download/v1.18.2/cert-manager.yaml";
+    url = "https://github.com/cert-manager/cert-manager/releases/download/v1.20.2/cert-manager.yaml";
-    sha256 = "0vx1nfyhl0rzb6psfxplq8pfp18mrrdk83n8rj2ph8q6r15vcih5";
+    sha256 = "sha256-HOEcrpEq3sxp5rtiNDX6/J7SFQX57/+YvXHXuA8B2x8=";
  };
  flux = pkgs.fetchurl {
    url = "https://github.com/fluxcd/flux2/releases/download/v2.7.2/install.yaml";
@@ -86,43 +85,6 @@ in
    services = {
      k3s = {
        enable = true;
        autoDeployCharts = {
          external-secrets = {
            inherit (top.charts.chartsMetadata.external-secrets.external-secrets) repo version;
            enable = true;
            name = top.charts.chartsMetadata.external-secrets.external-secrets.chart;
            hash = "sha256-dPuUWthwN6L0jdAKRpkDtDedGyDUxUlJrwkvUNwLsrU=";
            createNamespace = true;
            targetNamespace = "external-secrets";
            values = {
              crds.create = true;
              includeCRDs = true;
            };
          };
          kyverno = {
            inherit (top.charts.chartsMetadata.kyverno.kyverno) repo version;
            enable = true;
            name = top.charts.chartsMetadata.kyverno.kyverno.chart;
            hash = "sha256-sNdFEupwfnYSo2iGqKwTadPtXfcbyM1kuisavpiGUyU=";
            createNamespace = true;
            targetNamespace = "kyverno-system";
            values = {
              admissionController.replicas = 3;
              backgroundController.replicas = 3;
              cleanupController.replicas = 2;
              reportsController.replicas = 2;
              crds.install = true;
            };
          };
          tailscale = {
            inherit (top.charts.chartsMetadata.tailscale.tailscale-operator) repo version;
            enable = true;
            name = top.charts.chartsMetadata.tailscale.tailscale-operator.chart;
            hash = "sha256-BtZ24mCT2GMHE9iR+2xuIkB+4m1r2OC3WLkY3jC3i3I=";
            createNamespace = true;
            targetNamespace = "tailscale";
          };
        };
        extraFlags = [
          "--cluster-cidr=10.211.0.0/16"
          "--service-cidr=10.221.0.0/16"
@@ -138,7 +100,6 @@ in
          cert-manager.source = cert-manager;
          flux.source = flux;
          node-annotations.source = ../../manifests/auto/nodes.yaml;
          operator-oauth.source = ../../manifests/auto/operator-oauth.yaml;
        };
        role = if cfg.agentOnly then "agent" else "server";
        serverAddr = lib.mkIf (
@@ -54,7 +54,7 @@ with lib;
                target = mkOption {
                  type = types.str;
-                  description = ''The destination that is being proxied.'';
+                  description = "The destination that is being proxied.";
                  example = "http://localhost:8080";
                };
@@ -57,6 +57,7 @@ with lib;
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLOqwbp4hFYkiJpokh9i2RToa/6tQcwthDNQH69tyBF root@vm-matrix.thehellings.lan"
        # Mac
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBT5BFHQz1I5k/zkLQNLjL77EaqfdpRiF2Ci4eS9LMDK gregory.hellings@jude.thehellings.lan"
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPVlMoN2pkKRRwKNuMbMczki5ybR34wvjdgDNlgR74Wh greg@gregs-MacBook-Pro-16-inch-Nov-2024"
      ];
      homeMode = "500";
      isNormalUser = true;
@@ -18,7 +18,6 @@ with lib;
        devices = {
          chronicles.id = "7FI6Y3M-C7YQEDI-IB345L6-RKLXMB6-AEIV57Y-3J2RCXQ-MK6QRNK-EINPXAE";
          genesis.id = "YDTH4SD-GUAC5AA-SSYWYPZ-YMJW5LK-LE7PZKJ-GV2UJFZ-CU7LZAD-GTYWCQK";
          gitlab.id = "GKNOZWI-CNC2Q2F-R5GGGDX-RYFGHK4-CCC37LC-GVOEMJI-46QPC6G-AWFEOQE";
          linode.id = "IJMMXPR-WNALZBD-FMJH5W5-WV7XGJY-HLJTKGT-5TKHJIH-75LT56D-UUZCYQE";
        };
        options = {
@@ -2,8 +2,11 @@
  "infra": {
    "dns": "10.42.1.5",
    "gw": "10.42.1.1",
    "lan": "10.42.0.0/16",
    "netmask": "255.255.0.0",
-    "prefix": "16"
+    "nebula": "10.157.0.0/16",
    "prefix": "16",
    "tailscale": "100.64.0.0/10"
  },
  "hosts": {
    "chronicles": {
@@ -77,6 +80,10 @@
      "external": true,
      "system": "aarch64-darwin"
    },
    "lithic": {
      "external": true,
      "system": "aarch64-darwin"
    },
    "linode": {
      "ip": null,
      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMv9Zud3kZOl86gtmkn+uj3D4kiXWDPtyUL02VVLNR4Q",
@@ -85,13 +92,17 @@
      "tags": ["public", "server"],
      "nebulaIp": "10.157.0.1"
    },
    "ivr": {
      "external": true,
      "system": "aarch64-darwin"
    },
    "MacBook-Pro.local": {
      "external": true,
-      "system": "aarc64-darwin"
+      "system": "aarch64-darwin"
    },
    "MacBook-Prolocal.local": {
      "external": true,
-      "system": "aarc64-darwin"
+      "system": "aarch64-darwin"
    },
    "nas1": {
      "external": true,
@@ -102,13 +113,14 @@
      "external": true,
      "system": "x86_64-linux"
    },
    "printer": {
      "external": true,
      "ip": "10.42.1.3"
    },
    "proxmoxtemplate": {
      "external": true,
      "system": "x86_64-linux"
    },
    "gitlab": {
      "system": "x86_64-linux"
    },
    "wsl": {
      "external": true,
      "system": "aarch64-linux"
@@ -10,7 +10,6 @@ final: prev:
      in
      {
        daikinone = cp ./daikinone.nix { };
        xonsh-apipenv = cp ./xonsh-apipenv.nix { };
      }
    )
  ];
@@ -25,7 +24,6 @@ final: prev:
    withBDplus = true;
  };
  handbrake = prev.handbrake.override { libbluray = final.libbluray-custom; };
  pipenv-ivr = prev.callPackage ./pipenv.nix { };
  OVMFFull = prev.OVMFFull.override {
    secureBoot = true;
    msVarsTemplate = true;
@@ -1,92 +0,0 @@
 {
  lib,
  stdenv,
  python3,
  fetchFromGitHub,
  installShellFiles,
 }:
 let
  runtimeDeps =
    ps:
    with ps;
    [
      certifi
      pysocks
      setuptools
      (pip.overridePythonAttrs {
        dependencies = [ ps.pysocks ];
      })
      virtualenv
      virtualenv-clone
    ]
    ++ lib.optionals stdenv.hostPlatform.isAndroid [ pyjnius ];
  pythonEnv = python3.withPackages runtimeDeps;
 in
 python3.pkgs.buildPythonApplication rec {
  pname = "pipenv";
  version = "2023.11.15";
  format = "pyproject";
  src = fetchFromGitHub {
    owner = "pypa";
    repo = "pipenv";
    rev = "refs/tags/v${version}";
    hash = "sha256-kxwyws22xJkqBy/hXXcAPHZR2NgZHbmwZr9vYqce434=";
  };
  env.LC_ALL = "en_US.UTF-8";
  nativeBuildInputs = with python3.pkgs; [
    installShellFiles
    setuptools
    wheel
  ];
  postPatch = ''
    # pipenv invokes python in a subprocess to create a virtualenv
    # and to call setup.py.
    # It would use sys.executable, which in our case points to a python that
    # does not have the required dependencies.
    substituteInPlace pipenv/utils/virtualenv.py \
      --replace "sys.executable" "'${pythonEnv.interpreter}'"
  '';
  propagatedBuildInputs = runtimeDeps python3.pkgs;
  preCheck = ''
    export HOME="$TMPDIR"
  '';
  nativeCheckInputs = with python3.pkgs; [
    mock
    pytestCheckHook
    pytest-xdist
    pytz
    requests
  ];
  disabledTests = [
    "test_convert_deps_to_pip"
    "test_download_file"
  ];
  disabledTestPaths = [ "tests/integration" ];
  postInstall = ''
    installShellCompletion --cmd pipenv \
      --bash <(_PIPENV_COMPLETE=bash_source $out/bin/pipenv) \
      --zsh <(_PIPENV_COMPLETE=zsh_source $out/bin/pipenv) \
      --fish <(_PIPENV_COMPLETE=fish_source $out/bin/pipenv)
  '';
  meta = with lib; {
    description = "Python Development Workflow for Humans";
    license = licenses.mit;
    platforms = platforms.all;
    maintainers = with maintainers; [ berdario ];
  };
 }
@@ -1,31 +0,0 @@
 {
  lib,
  buildPythonPackage,
  fetchFromGitHub,
  toPythonModule,
  pipenv,
  setuptools,
 }:
 buildPythonPackage rec {
  pname = "xonsh-apipenv";
  version = "0.6.0";
  pyproject = true;
  src = fetchFromGitHub {
    owner = "greg-hellings";
    repo = "xontrib-apipenv";
    rev = version;
    hash = "sha256-Wa8iev0ow1oh95tPCv5tAJUMBYiStWms8I31WbVcOok=";
  };
  dependencies = [ (toPythonModule pipenv) ];
  build-system = [ setuptools ];
  meta = with lib; {
    description = "Auto pipenv support for Xonsh";
    homepage = "https://github.com/greg-hellings/xontrib-apipenv";
    license = licenses.mit;
    maintainers = [ ];
  };
 }
@@ -0,0 +1,21 @@
 {
  writeShellApplication,
  curl,
  gnused,
 }:
 writeShellApplication {
  name = "adblock-update";
  runtimeInputs = [
    curl
    gnused
  ];
  text = ''
    curl -s https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts | sed '1,33d' > /etc/adblock_hosts
    curl -s https://adaway.org/hosts.txt | sed '1,24d' | sed 's/127.0.0.1/0.0.0.0/' >> /etc/adblock_hosts
    # Custom domains that I need to preserve for some reason
    for f in "segment.com" "segment.io" "branch.io" "dev.visualwebsiteoptimizer.com" "click.discord.com"; do
     	sed -i -e "/''${f}/d" /etc/adblock_hosts  # Blocks Trelly content for house investors
    done
  '';
 }
@@ -12,6 +12,7 @@ in
  #iso = top.self.nixosConfigurations.iso.config.system.build.isoImage;
  #iso-beta = self.nixosConfigurations.iso-beta.config.system.build.isoImage;
  aacs = c ./aacs.nix { };
  adblock_update = c ./adblock_update.nix { };
  brew = c ./homebrew.nix { };
  create_ssl = c ./create_ssl.nix { };
  gcc-tune = c ./gcc-tune.nix { };
@@ -1,37 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 87huqg Eh2E7tXjZj6ydDOSsFD8UKMjSjLWW6YZg/5bzcdMaSU
 0vXZ9AGU3N8Jbep6TRijGKoo89jK0yauG1LmErtdT70
 -> ssh-ed25519 8UnW5Q UxbfpTqUcjkdevd0WwFtUxifEtDvedj8l+V2wFVjThw
 6aYQDmzFj1fin7G7e0cUCn55PBU8bDolkw4l+5A25qY
 -> ssh-ed25519 UFfTmg Dfm/r13wimRQT2hQSWKhyr14BZliLrLGn/sZq3G3yTY
 qzZLiowHu+HnSY31yXBOFPEYn2lJSJ5MyWvKSe2QZcI
 -> ssh-ed25519 xNtnoA AltIha0Z9BqZY4V8LOzCcr5KPWAvoNoyktReER3Glgs
 ac51BT1NGldAn6N/s7KEkNrRLhmntwx09SguGdZRR5o
 -> ssh-ed25519 aY2AXA EmE9Bjzme13LSSMZDnJsPFvpXGamtc/H3DOziP+d+Cg
 VN5z1+EzLF6N232QwkO5TT5Kf9NpoPDL2T50qCpCfgc
 -> ssh-ed25519 AQhf1g Z3Ezie7ikLb/8u+iNALI8x327lFqLN1NRIqHLfjqNFs
 QQDDH6Dio4zc0FCsLDRWl3ywaEdkp4zwGG+Iaegmi3I
 -> ssh-ed25519 mOmPfg mSW3OSIm9/8myqUxEJlsf0LT7vCO9i6/D3WkWKCD7l4
 U6TkEVyzxnb+9B2wLeEkQ4g6w5s31Q30/Q4ehQplf3c
 -> ssh-ed25519 YJiRbw Gs9VBwzEPr1QA1PcaQUCUwS+jwXYVniqe5TaZBjrJmQ
 rFS24MN8bzA+vj6/sJHuEC4yYglpf0OJT0GgUVm0HTs
 -> ssh-ed25519 0/WsKg MbcckXyUg5JfGafnhidk4dH6mEuhZOPac4YncYeYOR4
 oeFwgCrjDPauQSCgE1Q1/Smz6SI44TVfuNH0oP9WcdM
 -> ssh-ed25519 Nl/5yA 9xL4/5nxpciN9HFFO/X3xQ1oMe+EvLohnI6631amwhw
 n4As363EPOxuzN5f5RNuUrlEDFgmhVvjtEosQKTPVII
 -> ssh-ed25519 GdLgCQ P+jwMHdoS74jIdGQjOx4sDngWs+zxNpnzSgrDXD7Vkk
 NuGd8agrw/8PT+dw9RirCYATZRPnF5rKDSfyDaJ17iw
 -> ssh-ed25519 tOH/HQ u7gM8oYWpfFFW54TqoisGDEeX5MKxaVxT+ozl4miF0I
 avmdzbzCSDv4ovYMMmqx//G5FVEuz+hOJpr9/49w1Rk
 -> ssh-ed25519 FpzvfQ 3bDfVBMNavjfMFaKO8C5VvXiDMQxfB4WYp9mJ1LnIQI
 bl1KwNL5M8gJlqE/R5/lY7UlLOgeftiwinyC8yDb71A
 -> ssh-ed25519 kdPvzQ 2Y9lCbnjBhF3N0BTzhBqxJ/NDe7Z9/Vpkd8bbL29D0k
 pL4VMb6jnQv4bwt5SjcORlTWsvSWOhTNZXNYEkCZH5E
 -> ssh-ed25519 onmXpg 2Nw16oXRct8XDRqs6TRiOK6tBk9kNZcR2VDLy9GvOkM
 N95+6Ia9lpbKenojMDDAuLrT4cqjENsWzrwplcBKiUs
 -> ssh-ed25519 CnhD0g j7udTMCoQHrqYnH/mxGgRzor7RaTm2HjaSwuoVQqCGw
 ivg32RGKKCqe2yBjq58ym8shWlrYNfcvuK7xy1F2mmg
 -> ssh-ed25519 4ep2UA bBdPC5asgGcu60Y/i0yVKvAQc9U+7Jruik0xT8rDUA0
 ul6uiMBstdXVVmuIpgsZPSt6MQiyklPGYSbxOTLndeQ
 --- 5mAFqAG9hgU00QxYRKkhNl3fJ1KwDevvTnUhf0xYUog
 TW"	È§]h|nÁdÇ„Œô¡QFWv¬à©»®¨oµiÅZÂSŸŽ‡ÑG–í`|Ð” "�¬ó8n}:Î:ú6”
@@ -1,37 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 87huqg KMaYb+ubBiCqBKr08lmrIhiuNcvH/WnnEDYYvdgnvgk
 lJM8dGwT3LYvI9NtPZOzY94bFhk6sxO6F4NCMJBDBuA
 -> ssh-ed25519 8UnW5Q rUXfXe6S1jgTfJJGhT3NfIGhvYaf4aUAuD7wAa5GaxU
 OCe5kE+IM1MHqMPfLpgO5spYxDm1SDp5euubLkOF6K4
 -> ssh-ed25519 UFfTmg 8ZIBc9wr/hoQE/ItltZhSbqlZ3qEQMyLajy0cORbOQo
 DocUbgXT5m8CgExF1ICAJv+Nu4rBogwaYz5vJKNRQhs
 -> ssh-ed25519 xNtnoA x0uU0K78XzA9yYXg+jR6MIJASRxsJ9eMZctm276tP08
 SGZYFFkfbQpLVqV9OUQMMbOmv+0qNS3bO7IkWWjqohE
 -> ssh-ed25519 aY2AXA D5xP6cDYNLUsGeLgLO2x2gkBzfPByR58G2PjjGs/rxA
 wiqNVVjyQPnZop7q0PXmOOw7cJr8WKQVl1mk7zL+/cM
 -> ssh-ed25519 AQhf1g MJuVLCVIdZ7fKnXVvtJvSLriX1Q+2u20Y+aNI7N75hM
 EocXr6NlaanErb3Nmc9R+3DSdfoCAyHa5gDYzBX+xJk
 -> ssh-ed25519 mOmPfg wbQrmVm8CEeAHpJIjCyFI7Mfhn3i9bER7FppanAneTQ
 jAvjziCLYUl//6ZlZ5d3gE1ONRjhEnPLTabvTJEhFg4
 -> ssh-ed25519 YJiRbw 6ZAb7+mWKPCkYZrpcW1g1JoL9Q72rWwLIEZJtPx4ayY
 WtKeYr7wxCVisATDyejwnasFcVRtGa175wJoXNzhyKk
 -> ssh-ed25519 0/WsKg yyQBUeYAFIJUuH6xsMYztjO8zeswUWFCgqiNoMqxijY
 y5azJJfyU9NgyY8kuIoWRfY1kMJUzgxx8UtqJ3XBNvI
 -> ssh-ed25519 Nl/5yA Ffb3McX/NVo56cJXA51n9yrpeSTvD5/0S9n7ObeYrXA
 Wg1EhU0nk/Wh3Jf3+LY6dVLXBNbAM8miuC8gYdabIwY
 -> ssh-ed25519 GdLgCQ x/k3xO9fHAPFeOdeAwgWVNqWtU9u6RVXXNUnhUXk1B8
 aNeOSmnUILJTjof6+7sN8h2zA+pqBmU6cpmD81xcmtw
 -> ssh-ed25519 tOH/HQ ZEBu38T0q6tZkZSZIbGc3Kn9acTGqSbquPC6xlXt90o
 LPvS9dVaPUiE5nxVV8LsAjfRdyKBNmCwGTxOcyCxWMA
 -> ssh-ed25519 FpzvfQ iU+7myrJIbc+xbVZf7OxGSBy7Vq+FqItVYECvrvV7V4
 YkMvBRDnkGf+zznWTVSbFbR/2BaqOT1ja7piiyRL+uM
 -> ssh-ed25519 kdPvzQ cuzIgrPaJK1SY4soXT2lQkF8Ji7GZq+ihH2vYmbyDXY
 E7cA3PDHBsqm7Z9SbflHXQXMzv7B0uxYR4UQv9NHZ70
 -> ssh-ed25519 onmXpg aNcwAfrg7CfnC9Whp/qjikADbZzeSVM0m+kLkjExg1A
 1RWx1F4Q6zA91UHxBmvuxqABv+mZZwNayAVAz0EqGQg
 -> ssh-ed25519 CnhD0g LrFzQX5UKZAizqYkDCT/k6CWdFZYFqPguyLjgfcfQ2U
 O7Ta5mpAcLI2XswerqtW2fC0evmy/gdSQqLgW7L99zo
 -> ssh-ed25519 4ep2UA 8B0v6mE+hB0iKaZNrkvdlI4E2y4lWNR4zJ8oJS75jR0
 l5M6WSWKGuHMCiL5V5PCyDfFCElGNmR5UIkXRivSl5Y
 --- 1PM/nhbi3rtn26S1rtNwUT97plbJJvHOmPNzIYAsK4w
 W'SàeÚäß>pÎ_Çª´vcHN›×9¥Å¡àè6�L,_ž[3Ì␍_ìaØí¬¤Õ¦‚>¶¯D0Þ„lô‡F4.Ó’‰µ5±:�Ãºà�0ò±É
@@ -1,37 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 87huqg 3CNYW4sCTBsHWQaRdsyRomLXQ5V9jjzV+V9vHcKtqjc
 ZjGxC8Fqddlzmdd4uZxQWs9aAut+COJ9zWXZFQvRdG8
 -> ssh-ed25519 8UnW5Q rgmZ4hwUDXX8VdQQWxZn5NO70j4IuJ1l9aD6uXjAWiE
 SfmW+u09bGEP164j1awAoGpvchg9UZS7tgtSdLeepB8
 -> ssh-ed25519 UFfTmg MPZCtrzXXzusawPkfZ+fBWepH7MZihKXlz9ztfp/bBU
 RkLU9HPTJjyiaRczJU3sYMT0RT+oSvL3TozGRxOZM6s
 -> ssh-ed25519 xNtnoA HqhyTh67Yww4wHVR9i5+K7388nvAYwkPr1T95Sn3WDk
 entg7nxJXWqq+N0LMUwv+psL+O6ivZjnGo+KbgKthxM
 -> ssh-ed25519 aY2AXA XTpM0SssYVVEtnWPCfooazXvVccdO4IX+Zmp7dxoDUY
 mz6v4rzOpLT4fu+XYC5BwkXndNoBbEpazUt2wh0tutk
 -> ssh-ed25519 AQhf1g bUAsCyBen89j8JqUV3qAVTZ5QrxluYOmUO7D68Sd50k
 14ebyL+xFEK8NMBzxAArVaxCPZwBPLNBLdalC9TGB/I
 -> ssh-ed25519 mOmPfg Mv+p2kGC4PunQGSVD28emoEDra/ohZHK/xxTQVhafTM
 gUrUjDQCxMfgcjWkbGWmi1A2GF5X07pUKdZuuaXWdcE
 -> ssh-ed25519 YJiRbw 0jxrJSU71zCnF1bDUieGOsc/TAeR9gv/1ks2kPN2sD0
 yho+rheLys+ET7uKrrlsljQZQ8VuUnzg5eUj7gVMgAk
 -> ssh-ed25519 0/WsKg yxsm0H6tRCron9th/e9KfX+zFl5T3DH0/B602ak0s28
 kkmfbZ1SyXLJxlM/EeBRJEf0Rb+15w3nXZEZ35xuCug
 -> ssh-ed25519 Nl/5yA IoFwKIz+jrNUm4PB3wX5okeqtPKANPP+/lcZaJ+mZ00
 0ChPqTpzLCCz7die5lgOnO+Yz8JQIqjTX5oLwXv/IbU
 -> ssh-ed25519 GdLgCQ Fo9YJGiJMTpnhRQKd2cQ7XfQXLvOQ8+V5rlZvqOhWgQ
 Lhie4dV3210DbNvbkBWFStgycrH3xgE3tt5PYF0OjEU
 -> ssh-ed25519 tOH/HQ 7BXNJ/wYMc9HIswKCTkXQF42UXKXCCqcD7/RQINx5g0
 G2HbqhnEuoCGmuowye/EWQJ1UWojp1cFLoyu6b5AaGA
 -> ssh-ed25519 FpzvfQ l5jORObNye/4CGt9D0pkP7CAqhWZPPlEhCSmuc5JxVE
 5P/S8vQEzlYgXcM+TxlQnlyO6fK0lUkxBElfTZ8dR14
 -> ssh-ed25519 kdPvzQ rbwguFPeDqBJye6fzNAR+zqo3vA13o8VBqTDMtq/xF0
 0wjGYDkSgeB1H4GvjFfM5HIxCFs1s6R/6US0TFv/o0I
 -> ssh-ed25519 onmXpg GB5Hi8wAOxRaoyzcDuHK96+JNd/zfBdmR6oJdpYkmi8
 svDcX5tYRR8IzuQi36TpxqKu/vKiDj290e1Hx/RoBAs
 -> ssh-ed25519 CnhD0g 4vM1+uQTV/dYAbYP7Nsj9DZFjFVc1yFqNzKxWyz1OWQ
 G7ifv77YIefxMqK1vSEzxPCxQaf8Sd2cdpyoy3DxGZg
 -> ssh-ed25519 4ep2UA V+2q8xrX8eAQzuNV8Se/BUtut4EbkRsy/svnbRVO1TM
 WYJTqLxIqFC3a4z3UtMp4z7CAXEZ2NJUGzxftIvgoeQ
 --- t27r1Bedv2MW11oCtfWXl0ijG9/aiiWMdEbgymIqdSY
 §66^¹‹�§ÌVUÃuï6°â$	ÜQ[a²U�W*©Ò&s9Iª23HœR÷ÖOJŠüÒ§É)CXeRýÅ½Xi¾6yØB:b<tWÓ¹nÀ>\+ûî
@@ -1,37 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 87huqg 6Yf7i221QUp6qN/CZOSjHzaycZUgAGSwTRjlKZ8Pw3g
 xQWKonF6dDP5hXg3tFNPim6zb6XxcJ7T96+YQ16ziMo
 -> ssh-ed25519 8UnW5Q 8dkjCC6pl0z5l/ZB/M3JC9eUOyB6WipF08rJB7Sa40I
 kVuyfXIBCR1iu6tp/a8CBOQcXHv0Pvn/7PXuFvpnKQo
 -> ssh-ed25519 UFfTmg Sa/x4f5tvvQjI1ZdEhklMIimXiDkId/6nXJwlo5z3Gs
 jXkH3gVRv7f1dsZMdVDHMh2BQ5Or66eIrwfoHm/C/Os
 -> ssh-ed25519 xNtnoA GueQcHnvRtnftKkVehS9GeL4YVe6PonxbY6hMGdGhmc
 lM3gdP9edOI2mBJrHnD91g7R1ucR4xP3IfDLLrMeizY
 -> ssh-ed25519 aY2AXA 42K0aTzZIKipmq7d8XGGgyIMB/dJALos4AZsl4tQaBo
 /k8yNXeksAXy7EzNVXQTGNJ18lVc7SxJDJhr9E5F15Q
 -> ssh-ed25519 AQhf1g ql3uiFEScr0CbIALP0oD3+X56ti/egAjj4T6usJfkjM
 S3ZgjLc0ALm1PsSgxqAYECRDzqRF9BOCGZhT95Nin2c
 -> ssh-ed25519 mOmPfg 70rXi96dEVYo+Vb0ekr0POh1RWWVE7QcySWIHmfNol4
 iGuntLq8pBbrOpdrfrhSfBHpnPxadDD0F28yeyFehmA
 -> ssh-ed25519 YJiRbw 0e6SH2cQmLZStVR8zMixESrCnHFGiuFNvY5rr5cKgkQ
 mQDjego0IL9bATA5BkNjWhMRj+zwgjyZsrDDnV+d/5Y
 -> ssh-ed25519 0/WsKg 0kLNpZmoY18kHQHcnfmcl9jbCuXhCwHObsUtSXK7IlA
 P73mC2PUI4LODn+0c5UBZvDmUqb4nuvNq07aqI5oR/I
 -> ssh-ed25519 Nl/5yA bVpuj8uhAEKFTD04b3irvAJWcNOdFQzaUY/5LlyT8BY
 wLUHnoHvzRiYGd7WlYBamPzbsKnUYOxLgoQbp0f4S1Y
 -> ssh-ed25519 GdLgCQ 9m6Y7d3PFFeOw7DngkZIFqBl86lL20cBr+IiNMTc4XE
 I9cHA5tTpUeTkglotot2aBetRhJrpTHEl629/I6GImA
 -> ssh-ed25519 tOH/HQ yH4uXFXonl3GdB6qNMI1Bai9Dm7TAjbuHkpipGQJC0Y
 E7WK4YWwR+CzoO3827NhburCB0O6U8ioFZrvlnzvm+c
 -> ssh-ed25519 FpzvfQ qKBmiRCSDG1P/ijVqIv3vMI/3k3Owf4faDzh0DBKMWE
 cAbGPLI6b1+2juLbY/eB8zr2/1hKPD/G++igdkWF06c
 -> ssh-ed25519 kdPvzQ cCSoUaZSwYd03DAblZp8lVF1KqKgH/0Tgm9EnveJ80E
 FcLYsv9JmE9RuK+080kJxSj+/5trUIj0EDPf75bl/BU
 -> ssh-ed25519 onmXpg h2aRUyrSFBupqLERDanFEVXReOut4Y94aq7EVmj4JgM
 yfDYFFI6p/M4bWcvHBSFe449WDg/0FlCCGeFkGgUWNk
 -> ssh-ed25519 CnhD0g amEQyS8R7p/qJIlKNOdsHgukKMCVj1ypsPqWTsnuoCk
 +ZRH39P3lLs0W7S5iuLPBs9UIPmp7tw/gXvJhhPXahg
 -> ssh-ed25519 4ep2UA hjodTPrxShfnJJpHLK7qD4f4m+jR2Pc43s3bRASoHg0
 GXiO0cSAG/aes2yqq9abdWqKH/9ZIk04TAVdiLpg1uY
 --- JGKP15sCEBNrbkcbzcQmkNjSUvyuONGaM2SiRGK3WW4
 €ãÀUíñfÏ2&YìmŽ�k*¶Ü£c4�T”Ê«?„ÒÎ.\<í	ÇX²z,—Ó©þNþhXRðÉ16À¬áhþürˆ1‚ÆMŽÔfJVùØÜÎí¡Rvç*
@@ -1,37 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 87huqg pxinVlRwRapBcR4go0sPkLXzqQoGfqnXy2xFdTsiclo
 iik2P9JMR6rE7Dz7eACovjT6OCG07AD6kxbuAmKrPqw
 -> ssh-ed25519 8UnW5Q 2dDafRkl6O3JY4dg1fEF0OVAAkHTXxOvn7L0wyeJmXw
 0tj+wY2S8G26Lpvn6wWGxx888VRNqvHC0+d7pfaZqDI
 -> ssh-ed25519 UFfTmg 4pP9ht7a/ZcQkpZTacUBK0euaUbI6z13l74vpjpDgS8
 1kiQcsgUBhc5wDAzQqeHHtaNBQ0NgOa/nWzdvKqjgKM
 -> ssh-ed25519 xNtnoA is0caVhVtHiGINKHJaXYn018HtF78KcXGzlGYnRhehY
 BBe830cvdSS4WHn+2AGZ4SuxspBaVErw1Pu95d9Zw5o
 -> ssh-ed25519 aY2AXA VDMqxKqzMo1BrcSnc26pkXhlisxnfo0jEKyKKQ70sl4
 km1hfV+9sx2WDtDQMdA1Q2KdQ3lw/nmaUAOL0v4bQe4
 -> ssh-ed25519 AQhf1g ye8KsZ7/Qmmo3gMmTRxCRux+0X/TDIkMfJfwEF56CwM
 ZWTF/Wl3G1pVPIxCBoLpq4eWuf4pcKSoQM7+p7vsJOg
 -> ssh-ed25519 mOmPfg d5I0xYKepGdgVQ4f9A0+FLwxA0XRpyjpZ4YQoQ12/2Q
 e9O2/ROORHHuDhnZgn0KegO8QqXNycBu06ZD00qIZRk
 -> ssh-ed25519 YJiRbw oydLfhPROsG3AIjcaSR/3rRXJCnljtQ33t7p2OFMYSY
 Q+7cbIZ+E2S591aIB/zcDmOnPHto3zxRlEYwRejOTjM
 -> ssh-ed25519 0/WsKg RFPRDaH1bWOqy9T+IfTkeehB+b1xr+3VzHnMJy1ezAE
 DRxwHAcJ5g7aryUFiE9YzgMBXGlwCrzfspeB9ZLZCto
 -> ssh-ed25519 Nl/5yA XBWei39hiN3SKNmXUKkv2ve5Us78lRLq4qsdQ5uoXTY
 HSiYWXkHhsT9aVJBVYJn7lAU6mkuDoO4pZj4TKHs3CM
 -> ssh-ed25519 GdLgCQ FmskZXs0zQizSLjetVFUeekOB5MffZQu34kgzhpdX04
 b1P7JaVmwPqPQZohFHmDoe9n6WtSvOBD3/Puon7N81Q
 -> ssh-ed25519 tOH/HQ MrCEOqQbdQktOmeC4sEEy7vX6SjhqunMpmnZ+ogDahU
 XDxLRZ2aiaEnq+t12SgSCbv3ZZclkJFmeFX47TzM38M
 -> ssh-ed25519 FpzvfQ MlDNZs1/L8sAdDv0iAHiAKHC0ORn1XnS5st6l7Nd3kg
 kcZEp5WRPtZATThbThjiSLU21Xmfu6BwiB03kTUOTRE
 -> ssh-ed25519 kdPvzQ dUWPf++1B9TU3jpaC3O2aFXCMlF4YvzZCAjASc5Rjwo
 5Hg9oalicLh09YSb7FokQSqkBcLMZ3ePGnzKCMCjjcE
 -> ssh-ed25519 onmXpg 9WQusW0nfo/gUChf6plb3xQLAdu8Zdovlt+SHFFP+Fk
 RYHWttktn30aUkTSpRiY6jvVp6kZGDru6Ce7FWpYUmE
 -> ssh-ed25519 CnhD0g etVMbgOUosTxt5J+oO2z4f4Zaf9XmzKZKiYzyRON0Eo
 bjo0/trYvXCNG4nFSl4VmKke2Dr2sJvD2Ps3KVnz9K0
 -> ssh-ed25519 4ep2UA W9MEIlu/M1bQQFT/F0ns78lBvyVonXBpCSQysMV0hyc
 oH3V4KxWtL2eJvqxjxKcd/pGgaNilwxStNpKo29wPFs
 --- +nY/B5L7D+piJGp7RbzbFeAw3EM0X5QJ6aEAlaVU1Mo
 #°y¬‡!c*WåÀ␍èÈ4R2,ˆÇ^ë ˜`m¨~Ã¥$Ç‡óü�ÏíÌs»*pÚ.+L‰þ{]=uš¡Sö™øç 
@@ -1,37 +0,0 @@
 age-encryption.org/v1
 -> ssh-ed25519 87huqg WtxBR7tl7c5kqqNY5RZrQIthLIG58hZx/ngR8cYdURs
 G7+mhXcqFOdOioKJFdykwOrakVbhtK5efxtisd11yw8
 -> ssh-ed25519 8UnW5Q s8GNXAmhc1a+luGrtXDj/AvIm+YwIpZwKyKhkFx6dSU
 AvE+KIJzNJxSWHOCqp7lt3yqal7lt0EyqzvFlOi93qI
 -> ssh-ed25519 UFfTmg a2kAjGgd44RH5l782bx+ZE5kyoOychrl0HNR4CMNtCM
 4fzO1n99/S4hjrKGUPcQ6RDfNOp03hW9TSLvXm9Gmvk
 -> ssh-ed25519 xNtnoA AQHswbi52dxuyx0xcNQszHZiqmWYet408Vk4xwdAAWE
 TbtKqouXNL4ibrA/5ysqRukgrlVpQva0qBYW+lNg/lg
 -> ssh-ed25519 aY2AXA am3EZYO/A2NgPgSfXmv4oBWG31Ylneo5aAhE3fxyrDA
 FD87d17FaaP4Zxc6bUW7EPOdlNbpZW6nL2SLL3pvuzs
 -> ssh-ed25519 AQhf1g lpI5cpau4ld8sKIeL2rUzvfMgoKpYFL3K1x05tI0hAo
 9FS6CCEh+ozunq1b+wb6/4XJTDD4a/FclmfEPXJ17bM
 -> ssh-ed25519 mOmPfg Na+4qv+953ioMI8SBAqWkZoiOFwddLrQbQ9ht8OQ4HM
 0Wy3e5+Qbu/A/vTX9c87c0AWB0d/oCB16b73OZ/QvAE
 -> ssh-ed25519 YJiRbw y0sOGLFgINIwTMOvwHbf2UF7CmtjeQh78CauAbdpKTQ
 FjQigm97STgQnCzvKJTHfmIc1dd5ipECzi/0mCG2x1A
 -> ssh-ed25519 0/WsKg rpxWL89TERJ3QVc7eU/aKTt4hkEXuwaCsGLxc/MWVmM
 ywI9bG65CcNTtWizrPL56jE3kF0bkM+3Y4JY8d8FY8M
 -> ssh-ed25519 Nl/5yA tawS9A4aoCw63qALl3cnNLXEpHafDqQTwcfkfk6BOVQ
 FcJYQu54IgibrjK8TMK+MijSxylmIITv60jHhi4xrq4
 -> ssh-ed25519 GdLgCQ HazAqkEjG3n/zJ1OKI30EtVjuLh7N1ThOlI/KUOZF0k
 YJNWVPWB+2ega6CPQd4VX7dKwt+/jsd6zgwujO/rep0
 -> ssh-ed25519 tOH/HQ BD4L9RxVDyhrGs314dbl85VKVWwG8gV+mUo9il6c3Wg
 SNG3HFG0rEXasfabMWxzOS7hU0H64a4jz93hJhVHLIw
 -> ssh-ed25519 FpzvfQ OuagwUFjEkdwuE7CvhxG6rX4cHhULqJiiXe8A0YkjAk
 XZxhnisJC9vin1t5EBkAYk2UFvGiqhkQAwtW+MD/ZUQ
 -> ssh-ed25519 kdPvzQ INs91qrXdBsMfPq4rFlqXBOaAH/YGNB3krOzl6+UNhA
 0cZTjvo84WMFDLo9MOhRt/tY3xfBLl9WKVapgA2ecRg
 -> ssh-ed25519 onmXpg mIwVuIwLVOHfs81bmScGFc+ztwYLoL7nXtw79lGhW2U
 SYgy4giBk8C+OrOj5TGCyn0Bh/jWciT1mtUTsu5B6T4
 -> ssh-ed25519 CnhD0g 080GDLh3bH6ils+v/Yh2wTM5mNTiLDKeOGAEtvLC0x8
 IHMimypNNW5BYk0rJhlrLS5pcVXiAsgSrcWE9jflQBg
 -> ssh-ed25519 4ep2UA SyPq6Akc95C785pmpa0jn/FUDDXIw/W5StmtbPKk7mE
 lxa5YbmvxvO1OPmT6BHSRWw+VYZL5irA2Hxrl3bbTwo
 --- oPPMefKWvJVhcKuSHDg9Lk34q9+GKM4LHU5ejAp9hTU
 �Ï6IÁ’Õ!üòE‹k7WzŒypš˜?ÍÎ3_ ïÄ[UD²g¡åÅM)ÃÏ\á[+Ž£i”™gâµh¶4HÎ
@@ -8,14 +8,12 @@ let
  # jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0 root@jude";
  # isaiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHleYKtfV4W1Z63Ysu9w5Rbglqlz4F92YcZoMkucoTNf";
  # genesis = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEI9jbTPmEWQ0F2bLYmnIOLmBnag1fkKxHRjz3X8lB/k root@genesis";
  # gitlab = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC7hesFWwlmSbWPJWUiF8fIppy5a83yXw84O0Ytz+Zyq";
  # hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz";
  # jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0";
  # matrix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMIbvNNYrsT9sSBSwIL9c0LiHDaOiztlTJZAGgTDGUHq root@vm-matrix";
  # exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3";
  # systems = [
  #   gitlab
  #   genesis
  #   linode
  #   jude
@@ -36,7 +34,6 @@ let
    )
  );
  user_gitlab = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEwX8DZRRbZ+Iwo90dROg/61lisazAAGK/W8aqWfWcJr greg@nixos";
  user_genesis_virt = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFWPSFQT0AH77wrwRhiskcBS0w4ZakBRdJywYYBsnm3S greg@genesis";
  user_ivr = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe gregory.hellings@ls23003";
  user_jude = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude";
@@ -48,7 +45,6 @@ let
  user_exodus = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC189EnvWjNUp3xSzPMAtw85oQEsvP1tQR1TK640nLx6 greg@exodus";
  users = [
    user_gitlab
    user_genesis_virt
    user_ivr
    user_jude
@@ -104,23 +100,6 @@ in
  "gitea/workerPassword.age".publicKeys = everyone;
  "gitea/runner-isaiah-podman.age".publicKeys = everyone;
  "gitlab/secret.age".publicKeys = everyone;
  "gitlab/otp.age".publicKeys = everyone;
  "gitlab/db.age".publicKeys = everyone;
  "gitlab/db-password.age".publicKeys = everyone;
  "gitlab/jws.age".publicKeys = everyone;
  # openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.crt -days 365 -nodes -subj '/CN=issuer'
  # Then pipe the resulting files to agenix -e <foo>
  "gitlab/key.age".publicKeys = everyone;
  "gitlab/cert.age".publicKeys = everyone;
  "gitlab/salt.age".publicKeys = everyone;
  "gitlab/primary-key.age".publicKeys = everyone;
  "gitlab/deterministic-key.age".publicKeys = everyone;
  "gitlab/nixos-qemu-shell.age".publicKeys = everyone;
  "gitlab/nixos-vbox-shell.age".publicKeys = everyone;
  "gitlab/kubernetes-k3s-local.age".publicKeys = everyone;
  "gitlab/linode-deployer-runner-reg.age".publicKeys = everyone;
  "acme_password.age".publicKeys = everyone;
  "ca/intermediate_key.age".publicKeys = everyone;
  "ca/root_key.age".publicKeys = everyone;
Author	SHA1	Message	Date
klaatu	371b50d0c3	chore: update flake.lock 2026-05-10 buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-zim Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details buildbot/nix-build Build done. Details	2026-05-10 07:09:51 +00:00
Greg Hellings	10d6f85b5e	chore: update pre-commit buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Update manifest chart versions / update-manifests (push) Successful in 3s Details	2026-05-10 01:48:45 -05:00
Greg Hellings	85cdfce6a9	fix: use proper runs-on for updates	2026-05-10 01:47:34 -05:00
Greg Hellings	e62757cf1c	chore: add Ubuntu 26.04 to matrix	2026-05-10 01:42:28 -05:00
Greg Hellings	a1fb195bf4	chore: add podman-tui and other goodies buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Update flake.lock / update-flake-lock (push) Failing after 4s Details	2026-05-07 08:28:44 -05:00
Greg Hellings	9eb9fdec6c	chore: try allowing nix darwin builds buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Update flake.lock / update-flake-lock (push) Failing after 3s Details Update manifest chart versions / update-manifests (push) Successful in 4s Details	2026-04-30 17:18:36 -05:00
Greg Hellings	a8323e2396	fix: unstick macOS builds for libdrm missing buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 16:13:36 -05:00
Greg Hellings	855ab6e277	chore: try forcing build of linux-builder packages buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 16:08:23 -05:00
Greg Hellings	2932e9e335	chore: remove vm-gitlab which is no longer in use	2026-04-30 16:06:58 -05:00
Greg Hellings	4940550c62	chore: enable linux-builder on Mac buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 14:42:55 -05:00
Greg Hellings	258934a46b	chore: update Claude code usage	2026-04-30 14:42:29 -05:00
Greg Hellings	2476be3799	chore: make builder hostname more accessible buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 10:09:18 -05:00
Greg Hellings	08111e7a8a	chore: add ssh key to remote-builder config	2026-04-30 10:08:57 -05:00
Greg Hellings	99cc8efea0	chore: add builders to darwin baseline buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-30 09:43:46 -05:00
Greg Hellings	09198fda28	Merge branch 'main' of srcpub:greg/nixos	2026-04-30 09:40:34 -05:00
Greg Hellings	e16886c62c	chore: add mcp-grafana to li	2026-04-30 09:40:25 -05:00
Greg Hellings	c939d67cb6	chore: allow genesis to use its own DNS buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-29 16:11:20 -05:00
Greg Hellings	600aa885d4	chore: add minecraft server	2026-04-29 16:10:31 -05:00
Greg Hellings	8efd97599a	chore: remove exodus, which is x86 linux buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-29 13:20:04 -05:00
Greg Hellings	686df31049	chore: make garnix builds an array buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-29 13:14:55 -05:00
Greg Hellings	c3e3ca84a2	chore: cleanup unused packages on Darwin buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-29 13:02:12 -05:00
Greg Hellings	f8cc47614f	chore: remove unused genesis config bits buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.aarch64-darwin.pkg-adblock_update Build done. Details buildbot/nix-build Build done. Details Update flake.lock / update-flake-lock (push) Failing after 8s Details Update manifest chart versions / update-manifests (push) Successful in 4s Details	2026-04-24 18:56:10 -05:00
Greg Hellings	904754e059	fix: re-enable scheduling on Zeke disk replacement buildbot/nix-eval Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-04-24 06:46:29 -05:00
Greg Hellings	673f9b1f8b	chore: expose credentials to Claude buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-setup-ssh Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-jeremiah Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-icdm-root Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-linode Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-exodus Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.hm-zeke Build done. Details buildbot/nix-build Build done. Details	2026-04-22 21:59:30 -05:00
Greg Hellings	993385f1db	chore: update flake pins	2026-04-22 21:59:16 -05:00
Greg Hellings	088c1a0033	chore: add new uuid for zeke buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-zim Build done. Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details	2026-04-22 21:01:42 -05:00
Greg Hellings	fcba03f3d0	chore: update Gitea to latest. buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-zim Build done. Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details	2026-04-22 20:36:03 -05:00
Greg Hellings	8ba503ca5d	chore: upgrade Immich db to PG 18	2026-04-21 16:22:21 -05:00
Greg Hellings	3b78dfec41	chore: add printer to network	2026-04-20 16:18:20 -05:00
Greg Hellings	8509fff746	chore: upgrade from dnsmasq to bind	2026-04-19 01:04:41 -05:00
Greg Hellings	fb4c6966af	chore: upgrade Nextcloud to 33 buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-zim Build done. Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details Update manifest chart versions / update-manifests (push) Successful in 20s Details Update flake.lock / update-flake-lock (push) Failing after 15s Details	2026-04-17 16:01:36 -05:00
Greg Hellings	ec8c826565	chore: fix building buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.pkg-zim Build done. Details buildbot/nix-build Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details	2026-04-17 15:54:48 -05:00
Greg Hellings	e84e03cd05	chore: move charts into manifests	2026-04-17 15:43:57 -05:00
Greg Hellings	2a81d137a8	chore: add linode to new home buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.aarch64-darwin Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux Build done. Details buildbot/nix-build gitea:greg/nixos#checks.aarch64-linux Build done. Details buildbot/nix-build Build done. Details	2026-04-17 18:42:41 +00:00
Greg Hellings	70934153ac	chore: update lock and links	2026-04-16 13:00:36 -05:00
Greg Hellings	db475b232f	Merge branch 'main' of srcpub:greg/nixos	2026-04-15 13:56:51 -05:00
Greg Hellings	32a75d84cc	chore: update locks and add pulumi plugins buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux Build done. Details buildbot/nix-build gitea:greg/nixos#checks.aarch64-linux Build done. Details buildbot/nix-build gitea:greg/nixos#checks.aarch64-darwin Build done. Details buildbot/nix-build Build done. Details	2026-04-15 08:53:28 -05:00
Greg Hellings	640552e260	Revert "chore: update flake pins" This reverts commit `6d1490bd28`.	2026-04-13 17:35:21 -05:00
Greg Hellings	b37f597eaa	chore: fix pathing	2026-04-13 17:35:01 -05:00