feat: use colima on Lithic

feat: add procps to Darwin baseline
chore: convert from podman to docker
2026-07-07 14:16:27 -05:00 · 2026-07-07 14:15:59 -05:00 · 2026-07-07 14:15:19 -05:00 · 2026-07-07 14:15:17 -05:00 · 2026-07-07 14:14:09 -05:00 · 2026-07-07 14:09:05 -05:00
22 changed files with 314 additions and 223 deletions
@@ -32,10 +32,38 @@ let
  };
 in
 {
-  environment.systemPackages = with pkgs; [
-    agenix
-    pkgs'.hms
-  ];
+  environment = {
+    launchDaemons = {
+      "limit.maxfiles.plist" = {
+        enable = true;
+        text = ''
+        <?xml version="1.0" encoding="UTF-8"?>
+        <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+        <plist version="1.0">
+          <dict>
+            <key>Label</key>
+            <string>limit.maxfiles</string>
+            <key>ProgramArguments</key>
+            <array>
+              <string>launchctl</string>
+              <string>limit</string>
+              <string>maxfiles</string>
+              <string>524288</string>
+              <string>524288</string>
+            </array>
+            <key>RunAtLoad</key>
+            <true/>
+          </dict>
+        </plist>
+        '';
+      };
+    };
+    systemPackages = with pkgs; [
+      agenix
+      pkgs'.hms
+      procps  # Includes tools like `watch`, `kill`, and `ps`
+    ];
+  };

  fonts.packages = with pkgs; [
    dejavu_fonts
@@ -11,6 +11,7 @@ in
    enable = true;
    brews = [
      "bitwarden-cli"
+      "colima"
      "direnv"
      "github-mcp-server"
      {
@@ -37,7 +38,6 @@ in
      "notion"
      "notunes"
      "onlyoffice"
-      "podman-desktop"
      "tabby"
      "zed"
    ];
@@ -31,11 +31,11 @@
        "treefmt-nix": "treefmt-nix"
      },
      "locked": {
-        "lastModified": 1779096866,
-        "narHash": "sha256-8HtF1G7OPMXzo+f+0W+7zwzhuBUSk2EMrOS4ZvFw7+I=",
+        "lastModified": 1780813292,
+        "narHash": "sha256-auBqMf0ROzaSvdO6Ot/vxDzGswZs05sGYOZymi4/aAs=",
        "owner": "nix-community",
        "repo": "buildbot-nix",
-        "rev": "891f2baba218f4365f0c6ef96ea33f9b277f5ed0",
+        "rev": "0c1190ae2c9518d7e7fb631c10a685e2fb83501e",
        "type": "github"
      },
      "original": {
@@ -95,11 +95,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1779036909,
-        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
+        "lastModified": 1780795403,
+        "narHash": "sha256-AkWx4Zt9pQbD/f82Z8N57+d0HGLN/rV3gdMKJTpBPKs=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "56c666e108467d87d13508936aade6d567f2a501",
+        "rev": "6a771120d607dcccb279a27d227650e324815c35",
        "type": "github"
      },
      "original": {
@@ -239,11 +239,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1779125151,
-        "narHash": "sha256-bPHT0oJAHe5a43lkkSGAiCEg/RBqpwv5xsFrcj+Bog8=",
+        "lastModified": 1780885330,
+        "narHash": "sha256-aMA5oAq2Iv467U9s8YOb50DYQT9w0WJbyWqwlzHuLMs=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "fab3fd7327a0ac7a1fae5095bf140377704fac7f",
+        "rev": "4fe95527cbe952713318ada8a4d122e1a6ab120f",
        "type": "github"
      },
      "original": {
@@ -281,11 +281,11 @@
        "systems": "systems_2"
      },
      "locked": {
-        "lastModified": 1778039471,
-        "narHash": "sha256-Arjg44jFcpSqOKK05EIxbKIjhfjou/EGF12COFU+9QA=",
+        "lastModified": 1780375694,
+        "narHash": "sha256-TznzgYVONg28KiSFB2rVdf/eLVIMtEQOxKt13Kzyrp8=",
        "owner": "Infinidoge",
        "repo": "nix-minecraft",
-        "rev": "87611ef4788116de05f851920c5958f0c37d5b05",
+        "rev": "e6f8bec35104ca5955efe73742da58d2823684f7",
        "type": "github"
      },
      "original": {
@@ -300,11 +300,11 @@
        "treefmt-nix": "treefmt-nix_2"
      },
      "locked": {
-        "lastModified": 1778839878,
-        "narHash": "sha256-S2nSP6YWUz8I2uRZuAY93FoAAUa9TiZetLzjBv1n5vk=",
+        "lastModified": 1780922506,
+        "narHash": "sha256-/JsYspjkvMXmtcHjZ9o4+rznCuI5RxruJ228TQN5slY=",
        "owner": "Mic92",
        "repo": "niks3",
-        "rev": "c29f3641de064545d75f00318cd45bea2b4ea1d0",
+        "rev": "1be2c7feaa5f5d99136e148cb9458971b31b5a88",
        "type": "github"
      },
      "original": {
@@ -335,12 +335,15 @@
      }
    },
    "nix-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_4"
+      },
      "locked": {
-        "lastModified": 1779099457,
-        "narHash": "sha256-u73aVD/lUmmT3JV+kPDztl7zPwQKd0eobD1AbJltaGs=",
+        "lastModified": 1780310866,
+        "narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "8792fab9d4a6454a9201675f01326f827ce35ead",
+        "rev": "4ed851c979641e28597a05086332d75cdc9e395f",
        "type": "github"
      },
      "original": {
@@ -382,11 +385,11 @@
    },
    "nixpkgs-lib_2": {
      "locked": {
-        "lastModified": 1778984393,
-        "narHash": "sha256-r755Kh5Q0XBTPNuv9rL2rsUJTq8BDhb+lIwRWhl6yYA=",
+        "lastModified": 1780800655,
+        "narHash": "sha256-eVQuIiDIy24NIAW+yEirKosWHFYAml6dghmevWgruBE=",
        "owner": "nix-community",
        "repo": "nixpkgs.lib",
-        "rev": "0d14a58ab7aa3f513c58ccc9e47e77ffd92be204",
+        "rev": "78afa8e310f34cba09443a5ef2fb47bfd21d294f",
        "type": "github"
      },
      "original": {
@@ -413,11 +416,11 @@
    },
    "nixpkgs_3": {
      "locked": {
-        "lastModified": 1778491576,
-        "narHash": "sha256-9YOHDS9ANGbRmf3DSQ9UCvas3CyYNIBwBkKGQZTLXGY=",
+        "lastModified": 1780475387,
+        "narHash": "sha256-JsufhU/MyfEEJMNmtmW0DY6LbOVIjjPS0zGQpHvgrBY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "1174f92bf37f1a5914be77e1b44482d6fbc75ecc",
+        "rev": "c8560a2e8ad260841c482fe30731087b92f2223e",
        "type": "github"
      },
      "original": {
@@ -429,11 +432,40 @@
    },
    "nixpkgs_4": {
      "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_5": {
+      "locked": {
+        "lastModified": 1780747962,
+        "narHash": "sha256-IX7G1dlKrOqPOImfbo7ADDfV5yU1+j+MRChI3TL4tAA=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "cbb5cf358f50aa6acc9efd6113b7bcfbc352cd73",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_6": {
+      "locked": {
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
        "type": "github"
      },
      "original": {
@@ -443,7 +475,7 @@
        "type": "github"
      }
    },
-    "nixpkgs_5": {
+    "nixpkgs_7": {
      "locked": {
        "lastModified": 1777207419,
        "narHash": "sha256-V3bmPWAajDiC+1ClDOp55gianW2EyRJSJOyu1RUQibc=",
@@ -461,11 +493,11 @@
    },
    "nixunstable": {
      "locked": {
-        "lastModified": 1778869304,
-        "narHash": "sha256-30sZNZoA1cqF5JNO9fVX+wgiQYjB7HJqqJ4ztCDeBZE=",
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "d233902339c02a9c334e7e593de68855ad26c4cb",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
        "type": "github"
      },
      "original": {
@@ -478,17 +510,15 @@
    "nixvimunstable": {
      "inputs": {
        "flake-parts": "flake-parts_2",
-        "nixpkgs": [
-          "nixunstable"
-        ],
+        "nixpkgs": "nixpkgs_5",
        "systems": "systems_3"
      },
      "locked": {
-        "lastModified": 1779116047,
-        "narHash": "sha256-2BnXm4/BvR5B0CH8nxC4CL+y+Z7woqPbPxKO7IMH85U=",
+        "lastModified": 1780884186,
+        "narHash": "sha256-ueTLp7DofvIZ0BXEWwi8AjP1cCsuEfO445dk6DtmfKc=",
        "owner": "nix-community",
        "repo": "nixvim",
-        "rev": "1367315826ebda2bebbf896029f44ac05df523f5",
+        "rev": "82f2ec369eb597554a71ec82f33922d01b7dba8f",
        "type": "github"
      },
      "original": {
@@ -501,14 +531,14 @@
    "nurpkgs": {
      "inputs": {
        "flake-parts": "flake-parts_3",
-        "nixpkgs": "nixpkgs_4"
+        "nixpkgs": "nixpkgs_6"
      },
      "locked": {
-        "lastModified": 1779124721,
-        "narHash": "sha256-Z1q8QkuHAdkmXh4SItOzViVVFVLb+tzaEaYCTHI2UKk=",
+        "lastModified": 1780927127,
+        "narHash": "sha256-bnqVaMBjXP9yXyn09Y+ffCh+xl15ukiFZKeR5ikXdZM=",
        "owner": "nix-community",
        "repo": "NUR",
-        "rev": "ad57d8faf36bb02c65c90012cd0289daa0b2d9c4",
+        "rev": "537e92f6133a889617f03a84f4d2741c5662f61a",
        "type": "github"
      },
      "original": {
@@ -584,15 +614,16 @@
    },
    "systems_3": {
      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "lastModified": 1774449309,
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
        "owner": "nix-systems",
        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
        "type": "github"
      },
      "original": {
        "owner": "nix-systems",
+        "ref": "future-26.11",
        "repo": "default",
        "type": "github"
      }
@@ -605,11 +636,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
        "type": "github"
      },
      "original": {
@@ -626,11 +657,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1775636079,
-        "narHash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
        "owner": "numtide",
        "repo": "treefmt-nix",
-        "rev": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
        "type": "github"
      },
      "original": {
@@ -641,14 +672,14 @@
    },
    "vsext": {
      "inputs": {
-        "nixpkgs": "nixpkgs_5"
+        "nixpkgs": "nixpkgs_7"
      },
      "locked": {
-        "lastModified": 1779077424,
-        "narHash": "sha256-2nuxPFMR1R3IlV/OlF65qjs2gGjHhASa7U0+8QX0bJg=",
+        "lastModified": 1780892930,
+        "narHash": "sha256-YjT3Kf3tEdh6LK7YtW1d3DP02mH+Cf331Xt8CDuBg9s=",
        "owner": "nix-community",
        "repo": "nix-vscode-extensions",
-        "rev": "b7bde1772cdb20e77381516fbbb5306a621d0965",
+        "rev": "ebd0101b03e316f3a62089335102d47e4bf65d5a",
        "type": "github"
      },
      "original": {
@@ -665,11 +696,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1777732699,
-        "narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
+        "lastModified": 1780765279,
+        "narHash": "sha256-md6QHmlIx40bQkun43M2eT8aav5GURGkXEMFwof6uZs=",
        "owner": "nix-community",
        "repo": "NixOS-WSL",
-        "rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
+        "rev": "3e6d8af994e2a2d31af7a91863d7c0d6e278d951",
        "type": "github"
      },
      "original": {
@@ -27,10 +27,7 @@
    niks3.url = "github:Mic92/niks3";
    nix-hardware.url = "github:nixos/nixos-hardware";
    nixpkgs-lib.url = "github:nix-community/nixpkgs.lib";
-    nixvimunstable = {
-      url = "github:nix-community/nixvim/main";
-      inputs.nixpkgs.follows = "nixunstable";
-    };
+    nixvimunstable.url = "github:nix-community/nixvim/main";
    nixunstable.url = "github:nixos/nixpkgs/nixos-unstable";
    nurpkgs.url = "github:nix-community/NUR";
    vsext.url = "github:nix-community/nix-vscode-extensions";
@@ -65,7 +62,10 @@
          config = {
            allowUnfree = true;
            allowUnfreePredicate = _: true;
-            permittedInsecurePackages = [ "ventoy-1.1.05" ];
+            permittedInsecurePackages = [
+              "ventoy-1.1.05"
+              "electron-39.8.10"
+            ];
          };
        }
      );
@@ -1,5 +1,5 @@
 # vim: set filetype=nushell :
-let servers = [isaiah jeremiah zeke genesis]
+let servers = [isaiah jeremiah zeke genesis hosea]

 def par-map [ items: list, c: closure ] {
  let results = $items | par-each -k $c
@@ -12,15 +12,15 @@ def --env unlock [] {
    }
 }

-def rebuild [] {
+def rebuild [ $target: string = "switch" ] {
    if (uname | get operating-system) == "Darwin" {
-        sudo darwin-rebuild switch
+        sudo darwin-rebuild $target
    } else {
        let hostname = uname | get nodename
        let build = ^nom build --keep-going $"/etc/nixos#nixosConfigurations.($hostname).config.system.build.toplevel"
        if $env.LAST_EXIT_CODE == 0 {
            nvd diff /run/current-system result
-            run0 result/bin/switch-to-configuration switch
+            run0 result/bin/switch-to-configuration $target
        } else {
            print "Error during build"
        }
@@ -69,13 +69,6 @@ def dc [ $cmd: string = "sh" ] {
    }
 }

-def claude [ ] {
-    unlock
-    $env.GITLAB_TOKEN = ^bw get item 7d3da4e9-5f9a-49d0-8e14-b39c010a4001 | from json | get fields | find claudeapi | get value
-    #$env.ANTHROPIC_API_KEY = ^bw get item e122fd08-3506-4f21-9c6a-b42b00fe5be1 | from json | get login.password
-    ^claude
-}
-
 if ("/usr/local/bin" | path exists) {
    $env.PATH = $env.PATH | append "/usr/local/bin"
 }
@@ -13,25 +13,23 @@
    includes = [ "config.local" ];
    enableDefaultConfig = false;

-    matchBlocks =
+    settings =
      let
        nas = {
-          user = "admin";
+          User = "admin";
        };
        owned = {
-          user = "greg";
+          User = "greg";
        };
      in
      {
        inherit nas;

        "*" = {
-          dynamicForwards = [ { port = 10240; } ];
-          serverAliveInterval = 60;
-          extraOptions = {
-            LogLevel = "error";
-            SetEnv = "TERM=xterm-256color";
-          };
+          DynamicForward = [ "10240" ];
+          ServerAliveInterval = 60;
+          LogLevel = "error";
+          SetEnv = { TERM = "xterm-256color"; };
        };

        "10.42.1.4" = lib.hm.dag.entryBefore [ "10.42.*" ] nas;
@@ -41,46 +39,46 @@
        "chronicles.thehellings.lan" = lib.hm.dag.entryBefore [ "*.thehellings.lan" ] nas;

        gh = {
-          user = "git";
-          hostname = "github.com";
+          User = "git";
+          Hostname = "github.com";
        };
        "src" = {
-          user = "git";
-          hostname = "jeremiah.shire-zebra.ts.net";
-          port = 32222;
+          User = "git";
+          Hostname = "jeremiah.shire-zebra.ts.net";
+          Port = 32222;
        };
        srcpub = {
-          user = "git";
-          hostname = "src.thehellings.com";
-          port = 2222;
+          User = "git";
+          Hostname = "src.thehellings.com";
+          Port = 2222;
        };
        ivr = {
-          user = "git";
-          hostname = "gitlab.com";
+          User = "git";
+          Hostname = "gitlab.com";
        };

        "ivr.thehellings.lan" = lib.hm.dag.entryBefore [ "ivr" ] {
-          user = "gregory.hellings";
+          User = "gregory.hellings";
        };

        "*.thehellings.lan" = owned;
        "10.42.*" = owned;

        "host.crosswire.org crosswire" = {
-          hostname = "host.crosswire.org";
-          user = "ghellings";
+          Hostname = "host.crosswire.org";
+          User = "ghellings";
        };

        fedpeople = {
-          hostname = "fedorapeople.org";
-          user = "greghellings";
+          Hostname = "fedorapeople.org";
+          User = "greghellings";
        };

        "src.fedoraproject.org pkgs.fedoraproject.org" = {
-          user = "greghellings";
+          User = "greghellings";
        };

-        "127.*".extraOptions = {
+        "127.*" = {
          PubkeyAcceptedAlgorithms = "+ssh-rsa";
          HostkeyAlgorithms = "+ssh-rsa";
        };
@@ -23,6 +23,7 @@
    mattermost-desktop
    minio-client
    mumble
+    nix-index
    pre-commit
    prismlauncher
    restic
@@ -1,5 +1,6 @@
 {
  pkgs,
+  pkgs',
  lib,
  username,
  ...
@@ -20,6 +21,7 @@
      claude-code
      direnv
      home-manager
+      pkgs'.dockerCompat
      python3Packages.ipython
      just
      glab
@@ -36,18 +38,22 @@
      ".pip/pip.conf".text = ''
        [global]
        retries = 1
-        index-url = https://pypi.python.org/simple
+        index-url = https://pypi.python.org/
        extra-index-url =
-            https://pypidev.ivrtechnology.com/simple/
+            https://pypidev.ivrtechnology.com/
      '';
      ".config/uv/uv.toml".text = ''
        index-strategy = "unsafe-first-match"
        [[index]]
-        url = "https://pypidev.ivrtechnology.com/simple/"
+        url = "https://pypidev.ivrtechnology.com/"
        name = "pypidev"
        ignore-error-codes = [403]
      '';
    };
+    sessionVariables = {
+      BW_GITLAB_ITEM = "7d3da4e9-5f9a-49d0-8e14-b39c010a4001";
+      BW_ANTHROPIC_ITEM = "e122fd08-3506-4f21-9c6a-b42b00fe5be1";
+    };
    username = username;
    homeDirectory = "/Users/${username}";
  };
@@ -1,5 +1,6 @@
 {
  pkgs,
+  pkgs',
  lib,
  ...
 }:
@@ -26,12 +27,17 @@ in
      ansible
      awscli2
      cargo
+      clippy
      direnv
+      docker
+      docker-compose
+      docker-buildx
+      go
      home-manager
      just
      mcp-grafana
+      nil
      nixVersions.stable
-      podman
      poetry
      pre-commit
      (pulumi.withPackages (
@@ -45,6 +51,7 @@ in
      ))
      python
      rustc
+      rustfmt
      terraform
    ];
  };
@@ -22,6 +22,7 @@ let
    #"1.0.0.1" # Cloudflare
    #"149.112.112.112" # Quad 9
    metadata.infra.gw # Currently using our UniFi router for DNS as well
+    "100.100.100.100"
  ];
 in
 {
@@ -132,7 +133,7 @@ in
            file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain;
          })
          {
-            "shire-zebra.ts.net" = "tailscale";
+            #"shire-zebra.ts.net" = "tailscale";
            "nebula.thehellings.com" = "nebula";
            nebula = "nebula";
            "thehellings.lan" = "lan";
@@ -1,70 +0,0 @@
-{
-  lib,
-  metadata,
-  pkgs,
-  ...
-}:
-let
-  ips = lib.filterAttrs (_k: v: v ? "ip" && v.ip != null) metadata.hosts;
-  tps = lib.filterAttrs (_k: v: v ? "ts" && v.ts != null) metadata.hosts;
-  get = field: set: lib.mapAttrsToList (_k: v: v.${field}) set;
-  getTS = get "ts" tps;
-  getIP = get "ip" ips;
-  whitelists = builtins.concatStringsSep "," (
-    [
-      "localhost"
-      "127.0.0.1"
-    ]
-    ++ getTS
-    ++ getIP
-  );
-in
-{
-  services = {
-    prowlarr = {
-      enable = true;
-      dataDir = "/arr/prowlarr";
-      openFirewall = true;
-    };
-    radarr = {
-      enable = true;
-      openFirewall = true;
-    };
-    transmission = {
-      enable = true;
-      openPeerPorts = true;
-      openRPCPort = true;
-      package = pkgs.transmission_4;
-      settings = {
-        download-dir = "/arr/transmission/downloads";
-        rpc-bind-address = "0.0.0.0";
-        rpc-host-whitelist = whitelists;
-        rpc-host-whitelist-enabled = false;
-        rpc-whitelist = whitelists;
-        rpc-whitelist-enabled = false;
-        watch-dir-enabled = true;
-        watch-dir = "/arr/transmission/incoming";
-      };
-    };
-  };
-
-  systemd.mounts =
-    let
-      nfs = name: {
-        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
-        type = "nfs";
-        name = "${name}.mount";
-        where = "/${name}";
-        requires = [ "tailscaled-autoconnect.service" ];
-        after = [ "tailscaled-autoconnect.service" ];
-        wantedBy = [ "multi-user.target" ];
-        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
-      };
-    in
-    [
-      (nfs "arr")
-      (nfs "music")
-      (nfs "photos")
-      (nfs "video")
-    ];
-}
@@ -18,7 +18,6 @@ in
 {
  imports = [
    # Include the results of the hardware scan.
-    ./arr.nix
    ./hardware-configuration.nix
    top.niks3.nixosModules.niks3
  ];
@@ -200,6 +199,25 @@ in
    };
  };

+  systemd.mounts =
+    let
+      nfs = name: {
+        what = "nas1.shire-zebra.ts.net:/mnt/all/${name}";
+        type = "nfs";
+        name = "${name}.mount";
+        where = "/${name}";
+        requires = [ "tailscaled-autoconnect.service" ];
+        after = [ "tailscaled-autoconnect.service" ];
+        wantedBy = [ "multi-user.target" ];
+        mountConfig.Options = "_netdev,noexec,timeo=50,retrans=5,soft";
+      };
+    in
+    [
+      (nfs "music")
+      (nfs "photos")
+      (nfs "video")
+    ];
+
  # After first deploy: create a Grafana service account + API token for Klaatu
  # via the Grafana UI, then encrypt it: agenix -e secrets/grafana-api-token.age
  age.secrets.grafana-api-token = {
@@ -142,12 +142,12 @@ in
            updateOutputs = false;
          };
        };
-        domain = "${config.networking.hostName}.shire-zebra.ts.net";
+        domain = "${config.networking.hostName}.shire-zebra.ts.net:8010";
        evalMaxMemorySize = 8192;
        evalWorkerCount = 4;
        gitea = {
          enable = true;
-          instanceUrl = "https://src.thehellings.com";
+          instanceUrl = "https://gitea.shire-zebra.ts.net";
          oauthId = "7ec9107d-379b-47c8-870f-1191956d0500";
          oauthSecretFile = config.age.secrets.gitea-oauthSecret.path;
          tokenFile = config.age.secrets.gitea-oauthToken.path;
@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:

 let
  srcDomain = "src.thehellings.com";
@@ -6,15 +6,23 @@ let
 in
 {
  greg.proxies."${srcDomain}" = {
-    target = "https://gitea.shire-zebra.ts.net";
+    target = "http://unix:${config.services.anubis.instances.git.settings.BIND}";
    ssl = true;
    genAliases = false;
    extraConfig = ''
-      proxy_ssl_verify off;
-      proxy_ssl_server_name on;
-      proxy_set_header X-Forwarded-Proto $scheme;
-      proxy_set_header X-Forwarded-Ssl on;
+      #proxy_ssl_verify off;
+      #proxy_ssl_server_name on;
+
+      proxy_set_header X-Real-IP $remote_addr;
+      proxy_set_header X-Http-Version $server_protocol;
+      proxy_set_header User-Agent $http_user_agent;
      client_max_body_size 100000m;
+
+      #proxy_set_header Host $host;
+      #proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+      #proxy_set_header X-Forwarded-Proto $scheme;
+      #proxy_set_header X-Forwarded-Ssl on;
+
      # Ultimate AI Block List v1.7 20250924
      # https://perishablepress.com/ultimate-ai-block-list/

@@ -87,6 +95,44 @@ in

  networking.firewall.allowedTCPPorts = [ sshPort ];

+  services = {
+    anubis = {
+      instances = {
+        git = {
+          enable = true;
+          settings = {
+            BIND = "/run/anubis/anubis-git/anubis.sock";
+            COOKIE_DOMAIN = "thehellings.com";
+            SERVE_ROBOTS_TXT = true;
+            TARGET = "https://gitea.shire-zebra.ts.net/";
+          };
+        };
+      };
+    };
+
+    haproxy = {
+      enable = true;
+      config = ''
+        global
+          daemon
+          maxconn 20
+
+        defaults
+          timeout connect 500s
+          timeout client 500s
+          timeout server 1h
+
+        listen gitsshd
+          bind *:${toString sshPort}
+          timeout client 1h
+          mode tcp
+          server git-isaiah isaiah.shire-zebra.ts.net:32222
+          server git-jeremiah jeremiah.shire-zebra.ts.net:32222
+          server git-zeke zeke.shire-zebra.ts.net:32222
+      '';
+    };
+  };
+
  systemd.services = {
    haproxy = {
      after = [
@@ -98,25 +144,5 @@ in
    };
  };

-  services.haproxy = {
-    enable = true;
-    config = ''
-      global
-        daemon
-        maxconn 20
-
-      defaults
-        timeout connect 500s
-        timeout client 500s
-        timeout server 1h
-
-      listen gitsshd
-        bind *:${toString sshPort}
-        timeout client 1h
-        mode tcp
-        server git-isaiah isaiah.shire-zebra.ts.net:32222
-        server git-jeremiah jeremiah.shire-zebra.ts.net:32222
-        server git-zeke zeke.shire-zebra.ts.net:32222
-    '';
-  };
+  users.users.nginx.extraGroups = [ config.users.groups.anubis.name ];
 }
@@ -15,7 +15,7 @@ spec:
  chart:
    spec:
      chart: gitea
-      version: "12.5.3"
+      version: "12.6.0"
      sourceRef:
        kind: HelmRepository
        name: gitea-repository
@@ -35,7 +35,7 @@ spec:
      storageClass: longhorn-default

    image:
-      tag: "1.25.5"
+      tag: "1.26.2"

    replicaCount: 1

@@ -66,8 +66,8 @@ spec:
          APP_NAME: "Gitea: Greg's Cup of Git"
          RUN_MODE: dev
        server:
-          DOMAIN: "thehellings.com"
-          ROOT_URL: "https://src.thehellings.com"
+          DOMAIN: "shire-zebra.ts.net"
+          ROOT_URL: "https://gitea.shire-zebra.ts.net"
          SSH_PORT: "2222"
        database:
          DB_TYPE: postgres
@@ -15,8 +15,8 @@ spec:
        storage: |-
          MINIO_ACCESS_KEY_ID={{ .minio_nas1_key }}
          MINIO_SECRET_ACCESS_KEY={{ .minio_nas1_secret }}
-        minio_key: "{{ .minio_nas1_key }}"
-        minio_secret: "{{ .minio_nas1_secret }}"
+        #minio_key: "{{ .minio_nas1_key }}"
+        #minio_secret: "{{ .minio_nas1_secret }}"
  secretStoreRef:
    name: bitwarden-login
    kind: ClusterSecretStore
@@ -27,7 +27,7 @@ spec:
  chart:
    spec:
      chart: longhorn
-      version: "1.11.1"
+      version: "1.11.2"
      sourceRef:
        kind: HelmRepository
        name: longhorn
@@ -77,6 +77,7 @@ in

      programs.firefox = {
        enable = true; # (!pkgs.stdenv.hostPlatform.isDarwin);
+        configPath = if pkgs.stdenv.hostPlatform.isDarwin then "${config.home.homeDirectory}/Library/Application Support/Firefox" else "${config.xdg.configHome}/mozilla/firefox";
        package = pkgs.firefox-bin;
        policies = {
          DisableAppUpdate = true;
@@ -316,6 +316,26 @@
                name = "Buildbot";
                url = "http://jeremiah.shire-zebra.ts.net:8010/";
              }
+              {
+                name = "Garage WebUI";
+                url = "http://nas1.shire-zebra.ts.net:30186/";
+              }
+              {
+                name = "Garage RPC";
+                url = "http://nas1.shire-zebra.ts.net:30187/";
+              }
+              {
+                name = "Garage S3 API";
+                url = "http://nas1.shire-zebra.ts.net:30188/";
+              }
+              {
+                name = "Garage S3 Web";
+                url = "http://nas1.shire-zebra.ts.net:30189/";
+              }
+              {
+                name = "Garage Admin";
+                url = "http://nas1.shire-zebra.ts.net:30190/";
+              }
            ];
          }
          {
@@ -399,16 +419,24 @@
        name = "Media";
        bookmarks = [
          {
-            name = "Prowlarr";
-            url = "https://hosea.shire-zebra.ts.net:9696/";
+            name = "Flaresolverr";
+            url = "http://nas1.shire-zebra.ts.net:30098";
          }
          {
-            name = "Transmission";
-            url = "https://hosea.shire-zebra.ts.net:9091/";
+            name = "Prowlarr";
+            url = "http://nas1.shire-zebra.ts.net:30050/";
+          }
+          {
+            name = "Sonarr (TV)";
+            url = "http://nas1.shire-zebra.ts.net:30113/";
          }
          {
            name = "Radarr (Movies)";
-            url = "https://hosea.shire-zebra.ts.net:7878/";
+            url = "http://nas1.shire-zebra.ts.net:30025/";
+          }
+          {
+            name = "Deluge";
+            url = "http://nas1.shire-zebra.ts.net:30038/";
          }
        ];
      }
@@ -14,6 +14,7 @@ let
    url = "https://github.com/fluxcd/flux2/releases/download/v2.7.2/install.yaml";
    sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ=";
  };
+  keepaliveIp = "10.42.5.1";
 in
 {
  options.greg = {
@@ -95,6 +96,7 @@ in
          "--supervisor-metrics=true"
          "--tls-san ${config.networking.hostName}.thehellings.lan"
          "--tls-san ${config.networking.hostName}.shire-zebra.ts.net"
+          "--tls-san ${keepaliveIp}"
        ];
        manifests = {
          cert-manager.source = cert-manager;
@@ -116,7 +118,7 @@ in
          state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP";
          virtualIps = [
            {
-              addr = "10.42.5.1/16";
+              addr = "${keepaliveIp}/16";
              dev = cfg.vipInterface;
            }
          ];
@@ -14,7 +14,7 @@
      "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS",
      "external": true,
      "ts": "100.119.228.115",
-      "aliases": [ "s3" ]
+      "aliases": ["s3"]
    },
    "exodus": {
      "ip": null,
@@ -122,6 +122,21 @@
      "external": true,
      "system": "x86_64-linux"
    },
+    "pve2": {
+      "external": true,
+      "ip": "10.42.1.15",
+      "system": "x86_64-linux"
+    },
+    "pve3": {
+      "external": true,
+      "ip": "10.42.1.16",
+      "system": "x86_64-linux"
+    },
+    "pve4": {
+      "external": true,
+      "ip": "10.42.1.17",
+      "system": "x86_64-linux"
+    },
    "wsl": {
      "external": true,
      "system": "aarch64-linux"
@@ -16,6 +16,12 @@ let
    adblock_update = c ./adblock_update.nix { };
    brew = c ./homebrew.nix { };
    create_ssl = c ./create_ssl.nix { };
+    dockerCompat = pkgs.runCommand "docker-compat" {
+      nativeBuildInputs  = [];
+    } ''
+      mkdir -p $out/bin
+      ln -s ${pkgs.podman}/bin/podman $out/bin/docker
+    '';
    gcc-tune = c ./gcc-tune.nix { };
    #gen-build = c ./gen-build { };
    hms = c ./hms { };
Author	SHA1	Message	Date
Greg Hellings	a145f6ca43	feat: use colima on Lithic buildbot/nix-eval Build done. (10 warnings) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-07-07 14:16:27 -05:00
Greg Hellings	f77f46c4e5	feat: add procps to Darwin baseline	2026-07-07 14:15:59 -05:00
Greg Hellings	c2ea5ff472	chore: convert from podman to docker	2026-07-07 14:15:19 -05:00
Greg Hellings	0e972936d3	chore: update macOS settings	2026-07-07 14:15:17 -05:00
Greg Hellings	b35004a3ad	chore: add ulimit raise to Darwin	2026-07-07 14:14:09 -05:00
Greg Hellings	d7e98290c3	chore: add new pve hosts buildbot/nix-eval Build done. (10 warnings) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-07-07 14:09:05 -05:00
Greg Hellings	f5922887bf	chore: clean up IP name duplication	2026-07-07 14:08:48 -05:00
Greg Hellings	879230dca7	feat: add nix-index to Exodus	2026-06-26 11:08:43 -05:00
Greg Hellings	1c7e2ff268	feat: rebuild optional targets	2026-06-24 12:49:32 -05:00
Greg Hellings	b324ee5352	chore: update bookmarks	2026-06-15 22:43:24 -05:00
Greg Hellings	d21cbcb85d	feat: podman compat also on mbp buildbot/nix-eval Build done. (10 warnings) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-06-11 13:13:43 -05:00
Greg Hellings	6a0c87b77d	feat: add dockerCompat package from podman buildbot/nix-eval Build done. (10 warnings) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-06-11 09:20:19 -05:00
Greg Hellings	db5ef17dba	chore: bump flake version buildbot/nix-eval Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-proxmoxtemplate Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-genesis Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-icdm-root Build done. Details buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done. Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-06-08 11:28:56 -05:00
Greg Hellings	251f2804c6	chore: transmission to deluge	2026-06-08 11:18:12 -05:00
Greg Hellings	c8951f6da8	chore: add build tools buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-06-05 10:39:41 -05:00
Greg Hellings	394c2c2aba	chore: arr to NAS buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-06-04 13:31:26 -05:00
Greg Hellings	bb7a01f758	fix: point directly to pypi, not through simple buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-06-04 10:24:49 -05:00
Greg Hellings	a6b46f9c74	chore: remove unused anubis container buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details	2026-06-03 21:02:00 -05:00
Greg Hellings	e865d0832e	chore: update longhorn and gitea versions	2026-06-01 15:56:06 -05:00
Greg Hellings	307dbbe044	fix: do not claim mastery of TS net buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build started. Details	2026-05-30 00:24:36 -05:00
Greg Hellings	69651258d6	chore: connect buildbot and gitea by tailscale	2026-05-28 16:57:05 -05:00
Greg Hellings	53c491f537	fix: buildbot domain name	2026-05-26 07:48:39 -05:00
klaatuandGreg Hellings	a8ccb1b6ba	chore: update flake.lock 2026-05-24 buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build started. Details	2026-05-24 21:30:35 -05:00
rootandGreg Hellings	e6217401f9	feat(gitea): add Anubis anti-crawler proxy buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work challenge that protects web services from AI crawlers and scrapers.	2026-05-24 21:25:50 -05:00
Greg Hellings	d97fb37f0e	chore: update SSH config for home-manager updates buildbot/nix-eval Build done. (1 warning) Details buildbot/nix-build Build done. Details buildbot/nix-effects Build done. Details Update flake.lock / update-flake-lock (push) Successful in 1m46s Details Update manifest chart versions / update-manifests (push) Successful in 29s Details	2026-05-21 13:19:26 -05:00