flake.lock: Update

Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/5fd852c4155a689098095406500d0ae3d04654a8' (2024-11-14)
  → 'github:nix-community/disko/47bc8dfb6f48d5f66a3cb3a4cece83d8ace1f61a' (2024-11-24)
• Updated input 'firefox':
    'git+https://woof.rip/mikael/firefox.git?ref=refs/heads/main&rev=022ec0becb1ca7b96ddb9bdd046617075357c2cb' (2024-11-17)
  → 'git+https://woof.rip/mikael/firefox.git?ref=refs/heads/main&rev=22fff6832b2828006061d5c8f781ca052f55bdb2' (2024-11-24)
• Updated input 'firefox/neoidiosyn':
    'git+https://woof.rip/mikael/neoidiosyn.git?ref=refs/heads/main&rev=86605e5489fb5045f4dee48de2a69082e17c033b' (2024-11-17)
  → 'git+https://woof.rip/mikael/neoidiosyn.git?ref=refs/heads/main&rev=b7171c109da4f52bf59ad5159ec13ee9246ec28d' (2024-11-24)
• Updated input 'firefox/neoidiosyn/lix':
    'c859d03013.tar.gz?narHash=sha256-bq21I1EjXJa/s5Rra9J9ot2NkPCnI0F5uNPurwYLdpE%3D&rev=c859d03013712b349d82ee6223948d6d03e63a8d' (2024-11-15)
  → '66f6dbda32.tar.gz?narHash=sha256-H7GN4%2B%2Ba4vE49SUNojZx%2BFSk4mmpb2ifJUtJMJHProI%3D&rev=66f6dbda32959dd5cf3a9aaba15af72d037ab7ff' (2024-11-20)
• Updated input 'firefox/neoidiosyn/lix-module':
    '691193879d.tar.gz?narHash=sha256-RNaIu43b9PoXEhW4OqXUNZKY/jezQyCYWwdv1M0VjsA%3D&rev=691193879d96bdfd1e6ab5ebcca2fadc7604cf34' (2024-11-09)
  → 'aa2846680f.tar.gz?narHash=sha256-n6dPGRlMGdL8X5gviA6ZuRfUdbdD5KiNN/BpABA5YT0%3D&rev=aa2846680fa9a2032939d720487942567fd9eb63' (2024-11-18)
• Updated input 'firefox/neoidiosyn/lix-module/flake-utils':
    'github:numtide/flake-utils/c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a' (2024-09-17)
  → 'github:numtide/flake-utils/11707dc2f618dd54ca8739b309ec4fc024de578b' (2024-11-13)
• Updated input 'florp-moderation':
    'git+https://woof.rip/florp/moderation.git?ref=refs/heads/main&rev=32e1061cb2ef3cd0eab0bd99f062a2776a73d459' (2024-11-14)
  → 'git+https://woof.rip/florp/moderation.git?ref=refs/heads/main&rev=81f0a4377c1218d328e7996636a02faf0597efa0' (2024-11-21)
• Updated input 'home-manager':
    'github:nix-community/home-manager/1d0862ee2d7c6f6cd720d6f32213fa425004be10' (2024-11-14)
  → 'github:nix-community/home-manager/a9953635d7f34e7358d5189751110f87e3ac17da' (2024-11-24)
• Updated input 'lix':
    'ad9d06f783.tar.gz?narHash=sha256-hiGtfzxFkDc9TSYsb96Whg0vnqBVV7CUxyscZNhed0U%3D' (2024-10-19)
  → 'ad9d06f783.tar.gz?narHash=sha256-hiGtfzxFkDc9TSYsb96Whg0vnqBVV7CUxyscZNhed0U%3D&rev=ad9d06f7838a25beec425ff406fe68721fef73be' (2024-10-19)
• Updated input 'lix-module':
    '9098ac9576.tar.gz?narHash=sha256-6U0CyPycIBc04hbYy2hBINnVso58n/ZyywY2BD3hu%2Bs%3D' (2024-10-19)
  → '9098ac9576.tar.gz?narHash=sha256-6U0CyPycIBc04hbYy2hBINnVso58n/ZyywY2BD3hu%2Bs%3D&rev=9098ac95768f7006d7e070b88bae76939f6034e6' (2024-10-19)
• Updated input 'nixos-hardware':
    'github:nixos/nixos-hardware/f6581f1c3b137086e42a08a906bdada63045f991' (2024-11-12)
  → 'github:nixos/nixos-hardware/45348ad6fb8ac0e8415f6e5e96efe47dd7f39405' (2024-11-24)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/dc460ec76cbff0e66e269457d7b728432263166c' (2024-11-11)
  → 'github:nixos/nixpkgs/23e89b7da85c3640bbc2173fe04f4bd114342367' (2024-11-19)
• Updated input 'nixvim':
    'github:nix-community/nixvim/be455f7f2714ce3479ae5bb662a03bd450f45793' (2024-11-15)
  → 'github:nix-community/nixvim/a81a03a3f5dcdcdee5cbe831a9f2e81895e92875' (2024-11-24)
• Updated input 'nixvim/git-hooks':
    'github:cachix/git-hooks.nix/cd1af27aa85026ac759d5d3fccf650abe7e1bbf0' (2024-11-11)
  → 'github:cachix/git-hooks.nix/3308484d1a443fc5bc92012435d79e80458fe43c' (2024-11-19)
• Updated input 'nixvim/nix-darwin':
    'github:lnl7/nix-darwin/6c71c49e2448e51ad830ed211024e6d0edc50116' (2024-11-12)
  → 'github:lnl7/nix-darwin/698a62c628c2ec423aa770d8ec0e1d0bcf4fca1a' (2024-11-23)
• Updated input 'nixvim/nuschtosSearch':
    'github:NuschtOS/search/135d202e032be70c93b6d7d53592ef4799d6efde' (2024-11-11)
  → 'github:NuschtOS/search/fe07070f811b717a4626d01fab714a87d422a9e1' (2024-11-18)
• Updated input 'nixvim/nuschtosSearch/flake-utils':
    'github:numtide/flake-utils/c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a' (2024-09-17)
  → 'github:numtide/flake-utils/11707dc2f618dd54ca8739b309ec4fc024de578b' (2024-11-13)
• Updated input 'nixvim/treefmt-nix':
    'github:numtide/treefmt-nix/746901bb8dba96d154b66492a29f5db0693dbfcc' (2024-10-30)
  → 'github:numtide/treefmt-nix/705df92694af7093dfbb27109ce16d828a79155f' (2024-11-22)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/4c91d52db103e757fc25b58998b0576ae702d659' (2024-11-11)
  → 'github:Mic92/sops-nix/53c853fb1a7e4f25f68805ee25c83d5de18dc699' (2024-11-21)
• Removed input 'sops-nix/nixpkgs-stable'
• Updated input 'stylix':
    'github:danth/stylix/5ab1207b2fdeb5a022f2dd7cccf6be760f1b150f' (2024-11-15)
  → 'github:danth/stylix/b667a340730dd3d0596083aa7c949eef01367c62' (2024-11-22)
• Updated input 'stylix/base16':
    'github:SenchoPens/base16.nix/665b3c6748534eb766c777298721cece9453fdae' (2024-02-25)
  → 'github:SenchoPens/base16.nix/153d52373b0fb2d343592871009a286ec8837aec' (2024-11-21)
• Updated input 'stylix/base16/fromYaml':
    'github:SenchoPens/fromYaml/11fbbbfb32e3289d3c631e0134a23854e7865c84' (2023-07-16)
  → 'github:SenchoPens/fromYaml/106af9e2f715e2d828df706c386a685698f3223b' (2024-11-18)

.sops.yaml

@@ -3,6 +3,8 @@ keys:
   - &seras age1ht2wetcyl9rzu45e02pqqwgmyfsfe6y6ygxyuxpfhnkdm62d3pqsg3uqvd
   - &emilia age1pjn7q6qs49jenr40dhsxa8x5g4z6elsh0pk0tc5pxg6pl0nzgc6scakynn
   - &girldick age1r6cmthdk6lhy62wa4pu23l46f5fcqhuu7xrq353pe6c8f0s6ce8s67pdtf
+  - &florp age18vc8rcmczlt3r0ee7jr9s8l3yrkthu8wtypt08eh0eskpkw3dg6qxs7t3t
+  - &crime age1sky8kccyyxe79ws4rew42r94427v2xnphq2vtxvdlw5xl7yzgs2q599yzs
 creation_rules:
   - path_regex: secrets/services/dns-knot.yaml
     key_groups:
@@ -46,3 +48,27 @@ creation_rules:
       - *emily
       age:
       - *girldick
+  - path_regex: secrets/hosts/seras.yaml
+    key_groups:
+    - pgp:
+      - *emily
+      age:
+      - *seras
+  - path_regex: secrets/services/akkoma.yaml
+    key_groups:
+    - pgp:
+      - *emily
+      age:
+      - *florp
+  - path_regex: secrets/restic/zh3485s1.yaml
+    key_groups:
+    - pgp:
+      - *emily
+      age:
+      - *florp
+  - path_regex: secrets/restic/zh3485s2.yaml
+    key_groups:
+    - pgp:
+      - *emily
+      age:
+      - *crime

config/common/default.nix

@@ -1,14 +1,16 @@
-{ config, lib, pkgs, ... }: 
-
-with lib; {
+{ config, inputs, lib, pkgs, ... }: let 
+  inherit (lib) mkDefault;
+in {
   imports = [
     ./kernel.nix
     ./networking.nix
     ./openssh.nix
-    ./users
+    ./users.nix
     ../../modules
+    inputs.lix-module.nixosModules.default
   ];
   environment.systemPackages = with pkgs; [
+    kitty.terminfo
     bat
     dig
     htop
@@ -21,9 +23,8 @@ with lib; {
     man-pages-posix
     unzip
     zip
+    fd
     figlet
-  ] ++ lib.optionals (!config.kyouma.machine-type.container) [
-    kitty.terminfo
   ];
   programs = {
     mtr.enable = true;
@@ -54,16 +55,16 @@ with lib; {
   '';
   users.motdFile = "/var/lib/deployment/motd";
 
-  nix.package = pkgs.nixVersions.latest;
+  nix.package = pkgs.lix.override { enableGC = true; };
   nix.gc.automatic = true;
   nix.gc.options = "--delete-older-than 7d";
   nix.optimise.automatic = true;
-  nix.registry.nixpkgs.to = lib.mkIf (!config.kyouma.machine-type.container) {
+  nix.registry.nixpkgs.to = {
     type = "path";
     path = pkgs.path;
   };
   nix.settings = {
-    experimental-features = [ "nix-command" "flakes" "pipe-operators" ];
+    experimental-features = [ "nix-command" "flakes" "pipe-operator" ];
     trusted-users = [ "root" "@wheel" ];
     substituters = [ "https://cache.kyouma.net" ];
     trusted-public-keys = [ "cache.kyouma.net:Frjwu4q1rnwE/MnSTmX9yx86GNA/z3p/oElGvucLiZg=" ];
@@ -105,6 +106,6 @@ with lib; {
 
   services.fprintd.enable = config.kyouma.machine-type.graphical;
 
-  system.stateVersion = "23.11";
+  system.stateVersion = mkDefault "23.11";
   time.timeZone = mkDefault "CET";
 }

config/common/openssh.nix

@@ -39,7 +39,7 @@ in {
     ];
 
     settings = {
-      PermitRootLogin = "prohibit-password";
+      PermitRootLogin = "no";
 
       PasswordAuthentication = false;
       KbdInteractiveAuthentication = false;

config/common/users.nix

@@ -1,5 +1,5 @@
 { ... }: {
   imports = [
-    ./emily
+    ../users/emily
   ];
 }

config/hosts/_minimal/configuration.nix

@@ -52,7 +52,7 @@
 
     programs.eza = {
       enable = true;
-      icons = true;
+      icons = "auto";
       git = true;
       extraOptions = [
         "--color-scale=all"

config/hosts/build-worker-oci/configuration.nix

@@ -1,15 +0,0 @@
-{ lib, modulesPath, ... }: { 
-  imports = [
-    "${modulesPath}/virtualisation/docker-image.nix"
-    ../../common
-    ../../profiles/builder.nix
-    ../../profiles/headless.nix
-  ];
-
-  networking.hostName = "build-worker-oci";
-  services.resolved.enable = lib.mkForce false;
-  kyouma = {
-    machine-type.container = true;
-    deployment.auto-upgrade.enable = lib.mkForce false;
-  };
-}

config/hosts/crime/configuration.nix

@@ -1,31 +1,31 @@
-{ ... }: {
+{ inputs, ... }: {
   imports = [
     ../../common
+    ../../users/lucy
     ../../profiles/headless.nix
     ../../profiles/kartoffel.nix
     ../../profiles/lxc.nix
+    ../../services/arrs
+    ../../services/jellyfin.nix
     ../../services/nginx.nix
-    ./nginx.nix
+    inputs.oth.nixosModules.default
   ];
-  networking = {
-    hostName = "crime";
-    firewall.allowedTCPPorts = [ 80 443 ];
-    firewall.allowedUDPPorts = [ 443 ];
-  };
+  networking.hostName = "crime";
   systemd.network.networks."98-eth-default" = {
     address = [
-      "2a0f:be01:0:100::1337/128"
-      "2a0f:be01:0:100::1338/128"
+      "2a0f:be01:0:100::b00b:a/128"
     ];
   };
-
-  security.acme.certs = {
-    "fentanyl.trade" = { extraDomainNames = [ "frotti.ng" "watch.kyouma.net" ]; };
-    "crime.kyouma.net" = {};
+  kyouma.nginx.defaultForbidden = "fentanyl.trade";
+  kyouma.restic = {
+    enable = true;
+    remoteUser = "zh3485s2";
+    paths = [
+      "/var/lib/jellyfin"
+      "/var/lib/radarr"
+      "/var/lib/sonarr"
+      "/var/lib/private/prowlarr"
+      "/home"
+    ];
   };
-
-  services.jellyfin.enable = true;
-  services.sonarr.enable = true;
-  services.radarr.enable = true;
-  services.prowlarr.enable = true;
 }

config/hosts/crime/nginx.nix

@@ -1,114 +0,0 @@
-{ pkgs, ... }:
-let 
-  landingPage = pkgs.writeTextDir "index.html" '' 
-    <!DOCTYPE html>
-    <html>
-    <head>
-    <title>crime.kyouma.net</title>
-    <style>
-    body {
-      width: 35em;
-      margin: 0 auto;
-      font-family: Tahoma, Verdana, Arial, sans-serif;
-    }
-    </style>
-    </head>
-    <body>
-    <h1>Welcome to crime.kyouma.net!</h1>
-    <p>If you see this page, the nginx web server is successfully installed and
-    working. Further configuration is required.</p>
-
-    <p>Sonarr
-    <a href="https://crime.kyouma.net/sonarr">crime.kyouma.net/sonarr</a><br/>
-    Radarr
-    <a href="https://crime.kyouma.net/radarr">crime.kyouma.net/radarr</a><br/>
-    Prowlarr
-    <a href="https://crime.kyouma.net/prowlarr">crime.kyouma.net/prowlarr</a></p>
-
-    <p><em>Thank you for using nginx.</em></p>
-    </body>
-    </html>
-    '';
-  extraConfig = ''
-    add_header Strict-Transport-Security    $hsts_header;
-    add_header X-Content-Type-Options       "nosniff" always;
-    add_header X-XSS-Protection             "1; mode=block" always;
-    add_header X-Frame-Options              "SAMEORIGIN" always;
-    add_header Referrer-Policy              "same-origin" always;
-  '';
-  proxyConfig = ''
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
-    proxy_set_header X-Forwarded-Protocol $scheme;
-    proxy_set_header X-Forwarded-Host $http_host;
-  '';
-  jellyAddr = "[::1]";
-  jellyWeb = {
-    forceSSL = true;
-    #http3 = true;
-    #quic = true;
-    inherit extraConfig;
-
-    locations = {
-      "= /".return = "302 https://$host/web/";
-      "/" = {
-        proxyPass = "http://${jellyAddr}:8096";
-        extraConfig = ''
-          ${proxyConfig}
-          proxy_buffering on;
-        '';
-      };
-      "= /web/" = {
-        proxyPass = "http://${jellyAddr}:8096/web/index.html";
-        extraConfig = proxyConfig;
-      };
-      "/socket" = {
-        proxyPass = "http://${jellyAddr}:8096";
-        proxyWebsockets = true;
-        extraConfig = proxyConfig;
-      };
-    };
-  };
-in {
-  services.nginx = {
-    virtualHosts = {
-      "fentanyl.trade" = jellyWeb // {
-        enableACME = true;
-      };
-      "frotti.ng" = jellyWeb // {
-        useACMEHost = "fentanyl.trade";
-      };
-    };
-  };
-  kyouma.nginx.virtualHosts = {
-    "watch.kyouma.net" = { redirectTo = "fentanyl.trade"; };
-    "redirect" = {
-      default = true;
-      reuseport = true;
-      useACMEHost = "fentanyl.trade";
-      extraConfig = ''
-        return 403;
-      '';
-    };
-    "crime.kyouma.net" = {
-      listenAddresses = [ "[2a0f:be01:0:100::1338]" ];
-      locations = {
-        "/".root = landingPage;
-        "/sonarr/" = {
-          proxyPass = "http://127.0.0.1:8989";
-          recommendedProxySettings = true;
-        };
-        "/radarr/" = {
-          proxyPass = "http://127.0.0.1:7878";
-          recommendedProxySettings = true;
-        };
-        "/prowlarr/" = {
-          proxyPass = "http://127.0.0.1:9696";
-          recommendedProxySettings = true;
-        };
-      };
-    };
-  };
-}

config/hosts/emilia/configuration.nix

@@ -7,6 +7,7 @@
     ../../services/nginx.nix
     ../../services/uptime-kuma.nix
     ../../services/vaultwarden.nix
+    ../../services/librespeed.nix
     ./disko.nix
     ./hardware-configuration.nix
   ];
@@ -16,10 +17,8 @@
   kyouma.machine-type.physical = true;
   kyouma.nginx.defaultForbidden = "uptime.kyouma.net";
 
-  networking = {
-    firewall.allowedTCPPorts = [ 80 443 ];
-    hostName = "emilia";
-  };
+  networking.hostName = "emilia";
+
   systemd.network.networks."98-eth-default" = {
     matchConfig.MACAddress = "04:d4:c4:39:73:f6";
     addresses = [

config/hosts/emilia/disko.nix

@@ -62,6 +62,7 @@
             };
           };
           root = {
+            type = "8300";
             size = "100%";
           };
         };

config/hosts/florp/configuration.nix

@@ -0,0 +1,68 @@
+{ lib, config, pkgs, ... }: {
+  imports = [
+    ../../common
+    ../../profiles/headless.nix
+    ../../profiles/kartoffel.nix
+    ../../profiles/lxc.nix
+    ../../services/akkoma
+    ../../services/nginx.nix
+  ];
+  networking = {
+    hostName = "florp";
+    domain = lib.mkForce "social";
+  };
+  systemd.network.networks."98-eth-default" = {
+    address = [
+      "2a0f:be01:0:100::171/128" 
+    ];
+  };
+
+  kyouma.nginx.defaultForbidden = "florp.social";
+  kyouma.restic = let
+    pgBackup = "/var/cache/postgresql.sql";
+  in {
+    enable = true;
+    remoteUser = "zh3485s1";
+    timerConfig = {
+      OnCalendar = "hourly";
+      Persistent = true;
+    };
+    paths = [
+      "/var/lib/akkoma"
+      "/var/lib/secrets"
+      pgBackup
+    ];
+
+    backupPrepareCommand = ''
+      umask 0077
+      rm -f -- ${pgBackup} 
+      ${pkgs.su}/bin/su -c '${lib.getExe' config.services.postgresql.package "pg_dumpall"}' \
+        ${config.services.postgresql.superUser} >${pgBackup}
+    '';
+
+    backupCleanupCommand = ''
+      rm -f -- ${pgBackup}
+    '';
+  };
+
+  services.postgresql.settings = {
+    max_connections = 128;
+    shared_buffers = "4GB";
+    effective_cache_size = "12GB";
+    maintenance_work_mem = "1GB";
+    checkpoint_completion_target = 0.9;
+    wal_buffers = "16MB";
+    default_statistics_target = 100;
+    random_page_cost = 1.1;
+    effective_io_concurrency = 200;
+    work_mem = "34952kB";
+    huge_pages = "try";
+    min_wal_size = "2GB";
+    max_wal_size = "8GB";
+    max_worker_processes = 16;
+    max_parallel_workers_per_gather = 4;
+    max_parallel_workers = 16;
+    max_parallel_maintenance_workers = 4;
+  };
+  system.stateVersion = "24.11";
+}

config/hosts/girldick/configuration.nix

@@ -11,7 +11,6 @@
     domain = lib.mkForce "girldick.gay";
     hostName = "staging";
     nftables.enable = lib.mkForce false;
-    firewall.allowedTCPPorts = [ 80 443 ];
   };
   systemd.network.networks."98-eth-default" = {
     address = [

config/hosts/integra/configuration.nix

@@ -16,6 +16,15 @@
 
   networking.hostName = "integra";
 
+  nix.sshServe.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOOWlYhnummuWZbq3+d0x5A67YvlPvtl7/1Dk4RtNlzf christina@cafkafk.com"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/RmFnel8pcZT9nh7EAfKfAekt3BoEXy0G7G2GTacN/ aprl@computer"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxsX+lEWkHZt9NOvn9yYFP0Z++186LY4b97C4mwj/f2 aprl@whatever"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOpyVefbZLkNVNzdSIlO6x6JohHE1snoHiUB3Qdvl5I2 aprl@idk"
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDVNo871p97NTefP52KYiwuch+FaVScxvcFd9fg0yykySTq7Y5JsxrJQgTnox/oDa0O87OyHD/GHQljAXkqiHpDkExbiGjDmGXJSKReKH061F4FqBnDIwYRzUu9Cxjl4MNqsU0RqLaz4+F42c/L7GROQwjEPUb8JHThRiI5FJnDvvB+oBLBxeyQA4v3O4i8DaDQayTr/XB+aSlhNwKrb6cjjL93AHT1uE53yY5jn4kZX+RiPQhH7rvt9N6E4Yr3CG6nUgRCUS0L66d9yfrq0XAbAVk9F+viV7Nk9qy4MWHtXZ4h0qUlzrGALPgGsCGiLGd4NvEgeCcV4nvxdmevxTSdKlJP75xlmlLVXGyhqCZkTsxm/png2UvDl+p0pLyrgNaNoXPdE0Jbv7C28WX36Nast1QFSMUhexzuOx8OgaOioeXVfK98AouqWb58iPBCvgreUIH/gJhZcnlB/Foo1KSO+fJNH8hAsLH7w0mnKyHhJjkrjjwUqsnpepB3SOLfZTE= aprl@meow"
+    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD0v3tUBNEUxfoOQBFb+N2DUBQDay0iFggUWa9Nd+BtFLOKkz+RRto3eBF0ZiJZVUxv/hLb8m2s45hcMw8agwuPrXMe5085T1fzkvPdKAPZdsT/cCmBi1OsoLjAKBFIdM4lcV0A2cca8hip+/ZPpjFPUWx73/672gAPHU7co7fP8+8CSf9dx+WIeLx3yaYHYZ/th3dB5auX3VjOazS8MojsAorwTUeBoPamHQ5dFeNafhFUL/hhtGkUI1cNHUn3bJd2V7AKTW3UglK7hVgMJPrzVS31OlpcJEf6S5XgKTWdOSwubn1bs5Lt6YYRDU24NV6CGrwKgCJSRxzNMLwpnFKiSXpO8FzkqWHYWyju141hQcFF31aZIV+7YcwEt5ZukLjFOpVtpbSXvJYigOUzGi34P3/OAGshDXjTQjvM8GIir49gx3b2Nwhg0z4UHBkAKZvDDFPHDMJoclvnhITojaAojfC9zmMCO5ZaEsk8yv7c/lWQumzRpfldWF4mwHvhD5kTADbhRdO7WTdX7AaiAYINooToeWKjFe2wn3rFubPUppptqtP03mmvs7vhhgnEVBbGZRJK3GTVk1XcsfF9rDKzewSa+wb4LsBoZtFRhc8cJqHGlKWSNk7dQ04B1atPyNLKGpGoo/UIPxyZ6bSqFVxY3nhz46VZ6z8XWI48z0/fRQ== aprl@uwu"
+  ];
+
   systemd.network.networks."98-eth-default" = {
     matchConfig.Type = "ether";
     matchConfig.Name = "e*";

config/hosts/lain/iso.nix

@@ -1,5 +1,6 @@
 { lib, inputs, ... }: {
   imports = [
+    inputs.sops-nix.nixosModules.sops
     "${inputs.nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
     ./configuration.nix
   ];

config/hosts/ryuuko/configuration.nix

@@ -2,7 +2,6 @@
   imports = [
     inputs.nixos-hardware.nixosModules.lenovo-thinkpad-x1-extreme-gen4
     ../../common
-    ../../profiles/graphical
     ../../profiles/physical.nix
     ./disko.nix
     ./hardware-configuration.nix
@@ -41,7 +40,13 @@
     extraBackends = [ pkgs.utsushi ];
   };
 
-  kyouma.machine-type.portable = true;
+  kyouma = {
+    graphical = {
+      enable = true;
+      compositor = "hyprland";
+    };
+    machine-type.portable = true;
+  };
 
   networking.hostName = "ryuuko";
   networking.firewall.allowedTCPPorts = [ 22000 ];

config/hosts/seras/configuration.nix

@@ -1,6 +1,7 @@
-{ ... }: { 
+{ pkgs, ... }: {
   imports = [
     ../../common
+    ../../users/nil
     ../../profiles/builder.nix
     ../../profiles/headless.nix
     ../../profiles/kartoffel.nix
@@ -11,13 +12,37 @@
   ];
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
-  networking = {
-    hostName = "seras";
-    firewall.allowedTCPPorts = [ 80 443 ];
-  };
+  networking.hostName = "seras";
   systemd.network.networks."98-eth-default" = {
     address = [
       "2a0f:be01:0:100::169/128" 
     ];
   };
+
+  services.postgresql.settings = {
+    max_connections = 200;
+    shared_buffers = "24GB";
+    effective_cache_size = "72GB";
+    maintenance_work_mem = "2GB";
+    checkpoint_completion_target = 0.9;
+    wal_buffers = "16MB";
+    default_statistics_target = 100;
+    random_page_cost = 1.1;
+    effective_io_concurrency = 200;
+    work_mem = "31457kB";
+    huge_pages = "try";
+    min_wal_size = "1GB";
+    max_wal_size = "4GB";
+    max_worker_processes = 32;
+    max_parallel_workers_per_gather = 4;
+    max_parallel_workers = 32;
+    max_parallel_maintenance_workers = 4;
+  };
+
+  kyouma.ooklaserver = {
+    enable = true;
+    openFirewall = true;
+    domain = "speedtest.kyouma.net";
+    settings.openSSL.server.minimumTLSProtocol = "1.3";
+  };
 }

config/hosts/web-dus/configuration.nix

@@ -11,8 +11,7 @@
   networking = {
     hostName = "web-dus";
     nftables.enable = lib.mkForce false;
-    firewall.allowedTCPPorts = [ 80 443 11019 ];
-    firewall.allowedUDPPorts = [ 443 ];
+    firewall.allowedTCPPorts = [ 11019 ];
   };
   systemd.network.networks."98-eth-default" = {
     address = [

config/profiles/builder.nix

@@ -1,21 +1,19 @@
 { lib, pkgs, ... }: {
   kyouma.deployment.auto-upgrade.cache = "daemon";
-  nix.gc.options = lib.mkForce "--delete-older-than 60d";
   nix.settings = {
-    trusted-users = [ "build" ];
+    trusted-users = [ "nix-ssh" ];
     #system-features = [ "nixos-test" "benchmark" "big-parallel" "kvm" ] ++ lib.optionals pkgs.hostPlatform.isx86_64 [ "gccarch-x86-64-v3" ];
   };
   nix.extraOptions = ''
     min-free = ${builtins.toString (16384 * 1024 * 1024)}
     max-free = ${builtins.toString (32768 * 1024 * 1024)}
-    max-substitution-jobs = 20
+    max-substitution-jobs = 30
     max-silent-time = 14400
   '';
-  users.users.build = {
-    isNormalUser = true;
-    shell = pkgs.bash;
-    ignoreShellProgramCheck = true;
-    openssh.authorizedKeys.keys = [
+  nix.sshServe = {
+    enable = true;
+    write = true;
+    keys = [
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA/+iN407+HsfHbbC3tfdA8Yf4TZ08qXQMb4tb/SDAs+ emily@card"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/vCXM3IaxJP9v2Y+xcQrQD2IcffgdzqtWhpMjj9Xl5 hydra@seras"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICT0dGyLUjxFnvqUmex+5xUGQ7D4yGHKo267JgApcq0k root@ryuuko"

config/profiles/graphical/default.nix

@@ -1,218 +0,0 @@
-{ config, pkgs, lib, inputs, ... }: {
-  imports = [
-    inputs.home-manager.nixosModules.home-manager
-    inputs.stylix.nixosModules.stylix
-    ./files.nix
-    ./hyprland.nix
-    ./nixvim.nix
-    ./waybar.nix
-  ];
-
-  kyouma.machine-type.graphical = true;
-
-  boot.plymouth.enable = true;
-
-  security.pam.services.hyprlock = {};
-
-  services.dbus.packages = [ pkgs.gcr ];
-  services.geoclue2.enable = true;
-
-  services.pipewire = {
-    enable = true;
-    alsa.enable = true;
-    pulse.enable = true;
-  };
-
-  services.udisks2.enable = true;
-
-  environment.variables = {
-    CLUTTER_BACKEND = "wayland";
-    GDK_BACKEND = "wayland,x11";
-    MOZ_ENABLE_WAYLAND = "1";
-    QT_QPA_PLATFORM = "wayland;xcb";
-    QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
-    SDL_VIDEODRIVER = "wayland";
-    LIBVA_DRIVER_NAME = "radeonsi";
-    MESA_VK_DEVICE_SELECT = "1002:73df";
-    WLR_DRM_DEVICES = "$HOME/.config/hypr/external-gpu:$HOME/.config/hypr/internal-gpu";
-  };
-  xdg.icons.enable = true;
-  xdg.portal = {
-    enable = true; 
-    wlr.enable = true;
-    configPackages = [ pkgs.xdg-desktop-portal-hyprland ];
-  };
-
-  stylix= {
-    image = pkgs.fetchurl {
-      url = "https://kyouma.net/wallpaper.png";
-      sha256 = "1f46b439a864cd28b8ea93563b4762f1efb2648bae0148fd6b45f3033b10b0e8";
-    };
-    polarity = "dark";
-    #base16Scheme = "${pkgs.base16-schemes}/share/themes/catppuccin-macchiato.yaml";
-    fonts = {
-      sansSerif = {
-        package = pkgs.noto-fonts;
-        name = "Noto Sans";
-      };
-      serif = config.stylix.fonts.sansSerif;
-      monospace = {
-        package = pkgs.jetbrains-mono;
-        name = "JetBrains Mono Regular";
-      };
-      sizes.terminal = 11;
-    };
-    cursor = {
-      package = pkgs.capitaine-cursors;
-      name = "capitaine";
-      size = 24;
-    };
-    targets = {
-      console.enable = false;
-      gnome.enable = true;
-      fish.enable = false;
-    };
-  };
-
-  home-manager.users.emily = {
-    stylix.targets = {
-      hyprland.enable = false;
-      kitty.enable = false;
-      mako.enable = false;
-      rofi.enable = false;
-      swaylock.enable = false;
-      waybar.enable = false;
-      nixvim.enable = false;
-      fish.enable = false;
-    };
-    home.keyboard = {
-      layout = "de";
-      variant = "neo_qwerty";
-    };
-
-    programs.imv.enable = true;
-    
-    programs.wpaperd = {
-      enable = true;
-      settings.default = {
-        path = "/home/emily/Pictures/wallpapers/sylviaritter/";
-        duration = "60m";
-        sorting = "random";
-      };
-    };
-    programs.kitty = {
-      enable = true;
-      font.size = 13;
-      font.name = "JetBrains Mono";
-      settings = {
-        enable_audio_bell = false;
-        scrollback_lines = 65536;
-        remember_window_size = false;
-        initial_window_width = 1200;
-        initial_window_height = 800;
-
-        bold_font = "auto";
-        italic_font = "auto";
-        bold_italic_font = "auto";
-
-        background = "#090312";
-        background_opacity = "0.7";
-      };
-      keybindings = {
-        "shift+right" = "next_tab";
-        "ctrl+l" = "next_tab";
-        "shift+left" = "previous_tab";
-        "ctrl+h" = "previous_tab";
-      };
-    };
-    programs.rofi = {
-      enable = true;
-      package = pkgs.rofi-wayland;
-    };
-    
-    programs.zoxide = {
-      enable = true;
-      options = [ "--cmd cd" ];
-    };
-    programs.fzf.enable = true;
-
-    qt = {
-      enable = true;
-      platformTheme.name = "qtct";
-      style.name = "kvantum-dark";
-      style.package = with pkgs; [
-        libsForQt5.qtstyleplugin-kvantum
-        qt6Packages.qtstyleplugin-kvantum
-        (catppuccin-kvantum.override { accent = "Mauve"; variant = "Macchiato"; })
-      ];
-    };
-    gtk.iconTheme.name = "Adwaita";
-    gtk.iconTheme.package = pkgs.gnome.adwaita-icon-theme;
-
-    services.gammastep = {
-      enable = true;
-      provider = "geoclue2";
-      temperature.day = 6500;
-      temperature.night = 3700;
-      settings.general.adjustment-method = "wayland";
-    };
-    services.mako = {
-      enable = true;
-      anchor = "top-right";
-      backgroundColor = "#24273a";
-      borderColor = "#c6a0f6";
-      borderRadius = 15;
-      borderSize = 2;
-      defaultTimeout = 5000;
-      layer = "overlay";
-      maxIconSize = 48;
-      padding = "15";
-      progressColor = "over #B4A1DB";
-      sort = "-time";
-      textColor = "#cad3f5";
-      extraConfig = ''
-        max-history=100
-        on-button-left=dismiss
-        on-button-right=dismiss-all
-        on-notify=exec ${pkgs.mpv}/bin/mpv /usr/share/sounds/freedesktop/stereo/message.oga
-
-        [urgency=low]
-        border-color=#B4A1DB
-        default-timeout=2000
-
-        [urgency=normal]
-        border-color=#B4A1DB
-        default-timeout=5000
-
-        [urgency=high]
-        border-color=#D04E9D
-        text-color=#D04E9D
-        default-timeout=0
-
-        [category=mpd]
-        border-color=#E49186
-        default-timeout=2000
-        group-by=category
-      '';
-    };
-    services.gpg-agent = {
-      enable = true;
-      enableSshSupport = true;
-      pinentryPackage = pkgs.pinentry-gnome3;
-    };
-    services.syncthing = {
-      enable = true;
-      tray.enable = true;
-      tray.command = "syncthingtray --replace";
-    };
-    services.udiskie = {
-      enable = true;
-      automount = false;
-    };
-    systemd.user.services.syncthingtray.Service = {
-      ExecStartPre = "${pkgs.coreutils-full}/bin/sleep 2";
-      Restart = "on-failure";
-      RestartSec = "1s";
-    };
-  };
-}

config/profiles/graphical/nixvim.nix

@@ -1,219 +0,0 @@
-{ pkgs, inputs, ... }: {
-  home-manager.users.emily.imports = [ 
-    inputs.nixvim.homeManagerModules.nixvim
-  ];
-  home-manager.users.emily.programs.nixvim = {
-    enable = true;
-    extraPlugins = [ 
-      pkgs.vimPlugins.molokai
-      pkgs.vimPlugins.vim-airline-themes
-    ];
-    colorscheme = "molokai";
-    vimAlias = true;
-    highlightOverride.Normal = {
-      ctermbg = "NONE";
-      bg = "NONE";
-    };
-    opts = {
-      number = true;
-      expandtab = true;
-      autoindent = true;
-      mouse = "";
-      encoding = "utf-8";
-      shiftwidth = 2;
-      smartindent = true;
-      tabstop = 2;
-
-      ignorecase = true;
-      incsearch = true;
-      smartcase = true;
-    };
-    keymaps = [
-      {
-        action = "<cmd>Neotree toggle<CR>";
-        key = "<C-n>";
-        mode = "n";
-        options.silent = true;
-      }
-      {
-        action = "<C-\\><C-n>";
-        key = "<esc>";
-        mode = "t";
-      }
-    ];
-    plugins.cmp = {
-      enable = true;
-      settings.sources = [
-        { name = "nvim_lsp"; }
-        { name = "luasnip"; }
-        { name = "buffer"; }
-        { name = "nvim_lua"; }
-        { name = "path"; }
-      ];
-      settings.formatting = {
-        fields = [ "abbr" "kind" "menu" ];
-        format = ''
-          function(_, item)
-            local icons = {
-              Namespace = "󰌗",
-              Text = "󰉿",
-              Method = "󰆧",
-              Function = "󰆧",
-              Constructor = "",
-              Field = "󰜢",
-              Variable = "󰀫",
-              Class = "󰠱",
-              Interface = "",
-              Module = "",
-              Property = "󰜢",
-              Unit = "󰑭",
-              Value = "󰎠",
-              Enum = "",
-              Keyword = "󰌋",
-              Snippet = "",
-              Color = "󰏘",
-              File = "󰈚",
-              Reference = "󰈇",
-              Folder = "󰉋",
-              EnumMember = "",
-              Constant = "󰏿",
-              Struct = "󰙅",
-              Event = "",
-              Operator = "󰆕",
-              TypeParameter = "󰊄",
-              Table = "",
-              Object = "󰅩",
-              Tag = "",
-              Array = "[]",
-              Boolean = "",
-              Number = "",
-              Null = "󰟢",
-              String = "󰉿",
-              Calendar = "",
-              Watch = "󰥔",
-              Package = "",
-              Copilot = "",
-              Codeium = "",
-              TabNine = "",
-            }
-
-            local icon = icons[item.kind] or ""
-            item.kind = string.format("%s %s", icon, item.kind or "")
-            return item
-          end
-        '';
-      };
-      settings.snippet.expand = "function(args) require('luasnip').lsp_expand(args.body) end";
-      settings.window = {
-        completion = {
-          winhighlight = "FloatBorder:CmpBorder,Normal:CmpPmenu,CursorLine:CmpSel,Search:PmenuSel";
-          scrollbar = false;
-          sidePadding = 0;
-          border = [ "╭" "─" "╮" "│" "╯" "─" "╰" "│" ];
-        };
-        documentation = {
-          border = [ "╭" "─" "╮" "│" "╯" "─" "╰" "│" ];
-          winhighlight = "FloatBorder:CmpBorder,Normal:CmpPmenu,CursorLine:CmpSel,Search:PmenuSel";
-        };
-      };
-      settings.mapping = {
-        "<C-n>" = "cmp.mapping.select_next_item()";
-        "<C-p>" = "cmp.mapping.select_prev_item()";
-        "<C-j>" = "cmp.mapping.select_next_item()";
-        "<C-k>" = "cmp.mapping.select_prev_item()";
-        "<C-d>" = "cmp.mapping.scroll_docs(-4)";
-        "<C-f>" = "cmp.mapping.scroll_docs(4)";
-        "<C-Space>" = "cmp.mapping.complete()";
-        "<C-e>" = "cmp.mapping.close()";
-        "<CR>" = "cmp.mapping.confirm({ behavior = cmp.ConfirmBehavior.Insert, select = true })";
-        "<Tab>" = ''
-          cmp.mapping(function(fallback)
-            if cmp.visible() then
-              cmp.select_next_item()
-            elseif require("luasnip").expand_or_jumpable() then
-              vim.fn.feedkeys(vim.api.nvim_replace_termcodes("<Plug>luasnip-expand-or-jump", true, true, true), "")
-            else
-              fallback()
-            end
-          end,{"i","s"})
-        '';
-        "<S-Tab>" = ''
-          cmp.mapping(function(fallback)
-            if cmp.visible() then
-              cmp.select_prev_item()
-            elseif require("luasnip").jumpable(-1) then
-              vim.fn.feedkeys(vim.api.nvim_replace_termcodes("<Plug>luasnip-jump-prev", true, true, true), "")
-            else
-              fallback()
-            end
-          end,{"i","s"})
-        '';
-      };
-    };
-    plugins.lsp = {
-      enable = true;
-      keymaps.lspBuf = {
-        "K" = "hover";
-        "gd" = "definition";
-        "gD" = "references";
-        "gt" = "type_definition";
-        "gi" = "implementation";
-      };
-      servers = {
-        bashls.enable = true;
-        lua-ls.enable = true;
-        nil-ls = {
-          enable = true;
-          settings.formatting.command = [ "nixfmt" "-w" "140" ];
-        };
-        nixd = {
-          enable = false;
-          settings = {
-            eval.depth = 5;
-            eval.workers = 6;
-            formatting.command = [ "nixfmt" "-w" "140" ];
-            options.enable = true;
-          };
-        };
-        ruff-lsp.enable = true;
-        rust-analyzer = {
-          enable = true;
-          installRustc = true;
-          installCargo = true;
-        };
-      };
-    };
-    plugins.none-ls = {
-      enable = true;
-      sources.diagnostics = {
-        pylint.enable = true;
-        statix.enable = true;
-      };
-      sources.formatting = {
-        nixfmt.enable = true;
-        markdownlint.enable = true;
-      };
-    };
-    plugins.neo-tree = {
-      enable = true;
-      closeIfLastWindow = true;
-    };
-    plugins.treesitter = {
-      enable = true;
-      nixGrammars = true;
-      settings.indent.enable = true;
-    };
-    plugins.airline.enable = true;
-    plugins.cmp-buffer.enable = true;
-    plugins.cmp-emoji.enable = true;
-    plugins.cmp-nvim-lsp.enable = true;
-    plugins.cmp-path.enable = true;
-    plugins.cmp_luasnip.enable = true;
-    plugins.luasnip.enable = true;
-    plugins.nvim-autopairs.enable = true;
-    plugins.rainbow-delimiters.enable = true;
-    # Broken
-    plugins.rustaceanvim.enable = false;
-    plugins.treesitter-context.enable = true;
-  };
-}

config/profiles/rpi.nix

@@ -9,10 +9,6 @@
       options snd_bcm2835 enable_headphones=1
     '';
     kernelParams = [ "snd_bcm2835.enable_hdmi=1" ];
-    loader.raspberryPi.firmwareConfig = ''
-      dtparam=audio=on
-      dtparam=krnbt=on
-    '';
   };
   console.enable = false;
 

config/services/akkoma/default.nix

@@ -0,0 +1,342 @@
+{ config, inputs, lib, pkgs, ... }: {
+  imports = [
+    inputs.florp-moderation.nixosModules.default
+    # Moderated instances. See https://woof.rip/florp/moderation for more information.
+    inputs.florp-moderation.nixosModules.florp
+  ];
+  sops.secrets."services/akkoma/mailerPassword" = {
+    sopsFile = ../../../secrets/services/akkoma.yaml;
+  };
+  sops.secrets."services/akkoma/deepl" = {
+    sopsFile = ../../../secrets/services/akkoma.yaml;
+  };
+
+  services.akkoma = {
+    enable = true;
+    extraPackages = let
+      imagemagick = pkgs.imagemagick.override {
+        libheif = pkgs.libheif.overrideAttrs (prevAttrs: {
+          buildInputs = prevAttrs.buildInputs or [ ] ++ [ pkgs.svt-av1 ];
+          cmakeFlags = prevAttrs.cmakeFlags or [ ] ++ [ "-DWITH_SvtEnc=ON" ];
+        });
+      };
+    in with pkgs; [ exiftool ffmpeg-headless imagemagick ];
+
+    extraStatic = let
+      actualFetchzip =
+      {
+        url,
+        hash
+      }: pkgs.runCommandNoCC "${lib.last (lib.splitString "/" url)}" {
+        src = pkgs.fetchurl {
+          inherit url hash;
+        };
+      } ''
+        ${lib.getExe pkgs.unzip} $src -d $out
+        for f in $out/*_256.png; do
+          mv -- "$f" "''${f/_256}"
+        done
+      '';
+    in {
+      "emoji/blobs.gg" = pkgs.akkoma-emoji.blobs_gg;
+
+      "emoji/custom" = pkgs.runCommandNoCC "florp" {
+        src = inputs.florp-branding.packages.${config.nixpkgs.hostPlatform.system}.favicon;
+      } ''
+        mkdir $out
+        cp $src $out/florp.png
+      '';
+
+      "emoji/neodog" = actualFetchzip {
+        url = "https://git.gay/moonrabbits/neodog/raw/commit/6f9eb283b6dcbe507fde1110abab267cb2d73b70/neodog.zip";
+        hash = "sha256-ISyzpRyjHf+4jKrOtHHqH0Qn7CQu5RQSLH/HL/YSdT4=";
+      };
+
+      "emoji/neocat" = actualFetchzip {
+        url = "https://volpeon.ink/emojis/neocat/neocat.zip";
+        hash = "sha256-DZDuk0Djlax504flNWdpqAw+ROLOOVGj0ZvJLyouo7A=";
+      };
+
+      "emoji/neofox" = actualFetchzip {
+        url = "https://volpeon.ink/emojis/neofox/neofox.zip";
+        hash = "sha256-rZUPA7ZvrO8q/lx8XK3IxJ1URLgq0PSh752eWzG+uos=";
+      };
+
+      "emoji/blobhaj" = actualFetchzip {
+        url = "https://web.archive.org/web/20240829143703/https://heatherhorns.com/wp-content/uploads/2022/12/Blobhaj-12-13-2022.zip";
+        hash = "sha256-5l8ozTivCSOomPq+zDD4FWhK5mA/H2qkGs8beuDnp9s=";
+      };
+
+      "static/styles.json" = pkgs.writeText "styles.json" (builtins.toJSON (
+        builtins.fromJSON (builtins.readFile "${pkgs.akkoma-fe-domi}/static/styles.json") // {
+          elly-mod = "/static/themes/elly-mod.json";
+        }
+      ));
+
+      "static/themes/elly-mod.json" = pkgs.writeText "elly-mod.json" (builtins.readFile ./elly-mod.json);
+
+      "static/custom.css" = pkgs.writeText "custom.css" ''
+        .tos-content img, .terms-of-service img {
+          max-width: 100%;
+        }
+      '';
+
+      "static/terms-of-service.html" = inputs.florp-about.packages.${pkgs.system}.default;
+      "images/sylvia-ritter-15012323.avif" = inputs.florp-branding.packages.${pkgs.system}.wallpaper;
+      "images/florp_banner.avif" = inputs.florp-branding.packages.${pkgs.system}.banner;
+      "favicon.png" = inputs.florp-branding.packages.${pkgs.system}.favicon;
+    };
+
+    frontends = {
+      primary = {
+        package = pkgs.akkoma-fe-domi;
+        name = "akkoma-fe";
+        ref = "5f0339ce00";
+      };
+      admin = {
+        package = pkgs.akkoma-admin-fe;
+        name = "admin-fe";
+        ref = "stable";
+      };
+    };
+  };
+  services.akkoma.config = let
+    inherit ((pkgs.formats.elixirConf { }).lib) mkRaw mkAtom;
+
+    mkMapOfPredefinedKeys = set: let
+      string = value: "\"${(lib.escape [ "\\" "#" "\"" ]) value}\"";
+
+      toElixir = value: 
+        if value == null then "nil" else
+        if lib.isString value then string value else
+        if builtins.isBool value then lib.boolToString value else
+        if lib.isInt value || lib.isFloat value then toString value else
+        abort "Not a elixir value ${value}";
+
+      entries = attrs: lib.concatStringsSep ", " (lib.mapAttrsToList (name: value:
+        "${toElixir name}: ${toElixir value}"
+      ) attrs);
+    in mkRaw "%{${entries set}}";
+
+  in {
+    ":pleroma" = {
+      ":instance" = {
+        name = "florp.social";
+        email = "contact@florp.social";
+        notify_email = "noreply@florp.social";
+        description = "Likes are now florps. The timeline goes sideways.";
+        instance_thumbnail = "/instance/thumbnail.avif";
+        limit = 69420;
+        description_limit = 69420;
+        remote_limit = 131072;
+        upload_limit = 256 * 1024 * 1024;
+        avatar_upload_limit = 4 * 1024 * 1024;
+        background_upload_limit = 8 * 1024 * 1024;
+        banner_upload_limit = 8 * 1024 * 1024;
+        registrations_open = true;
+        registration_reason_length = 2048;
+        account_approval_required = true;
+        account_activation_required = true;
+        federating = true;
+        federation_incoming_replies_max_depth = 1024;
+        federation_reachability_timeout_days = 14;
+        allow_relay = true;
+        max_pinned_statuses = 10;
+        max_report_comment_size = 2048;
+        safe_dm_mentions = true;
+        remote_post_retention_days = 365;
+        user_bio_length = 8192;
+        user_name_length = 64;
+        cleanup_attachments = true;
+        local_bubble = [
+          "solitary.social"
+          "donotsta.re"
+          "chaos.social"
+        ];
+      };
+
+      ":emoji".groups = {
+        blobs = "/emoji/blobs.gg/*.png";
+        blobhaj = "/emoji/blobhaj/512w/*.png";
+        neodog = "/emoji/neodog/*.png";
+        neocat = [
+          "/emoji/neocat/*.png"
+          "/emoji/neodog/additional_neocat/*.png"
+        ];
+        neofox = [
+          "/emoji/neofox/*.png"
+          "/emoji/neodog/additional_neofox/*.png"
+        ];
+        Custom = "/emoji/custom/*.png";
+      };
+
+      "Pleroma.Captcha".method = mkRaw "Pleroma.Captcha.Kocaptcha";
+
+      "Pleroma.Web.Endpoint".url.host = "florp.social";
+
+      "Pleroma.Web.Metadata.Providers.Theme".theme_color = "#070F1C";
+
+      "Pleroma.Emails.Mailer" = {
+        enabled = true;
+        adapter = mkRaw "Swoosh.Adapters.SMTP";
+        relay = "mail.kyouma.net";
+        username = "noreply@florp.social";
+        password._secret = config.sops.secrets."services/akkoma/mailerPassword".path;
+        port = 465;
+        ssl = true;
+        auth = mkRaw ":always";
+      };
+
+      ":database".rum_enabled = true;
+
+      ":media_proxy" = {
+        enabled = true;
+        base_url = "https://cache.florp.social";
+        proxy_opts.redirect_on_failure = true;
+        proxy_opts.max_body_length = 64 * 1024 * 1024;
+      };
+
+      ":media_preview_proxy" = {
+        enabled = true;
+        thumbnail_max_width = 1920;
+        thumbnail_max_height = 1080;
+        min_content_length = 128 * 1024;
+      };
+
+      "Pleroma.Upload".base_url = "https://media.florp.social";
+
+      "Pleroma.Upload".filters = map mkRaw [
+        "Pleroma.Upload.Filter.Exiftool.ReadDescription"
+        "Pleroma.Upload.Filter.Exiftool.StripMetadata"
+        "Pleroma.Upload.Filter.Dedupe"
+        "Pleroma.Upload.Filter.AnonymizeFilename"
+      ];
+
+      ":mrf".policies = map mkRaw [
+        "Pleroma.Web.ActivityPub.MRF.MediaProxyWarmingPolicy"
+      ];
+
+      ":mrf_object_age".threshold = 180 * 24 * 3600;
+
+      ":frontend_configurations" = {
+        pleroma_fe = mkMapOfPredefinedKeys {
+          background = "/images/sylvia-ritter-15012323.avif";
+          nsfwCensorImage = "/static/blurhash-overlay.png";
+          collapseMessageWithSubject = true;
+          streaming = true;
+          webPushNotifications = true;
+          useStreamingApi = true;
+          scopeCopy = true;
+          subjectLineBehavior = "masto";
+          alwaysShowSubjectInput = true;
+          postContentType = "text/markdown";
+          modalOnRepeat = true;
+          minimalScopesMode = true;
+          redirectRootNoLogin = "/about";
+          translationLanguage = "en";
+          theme = "elly-mod";
+        };
+      };
+
+      ":restrict_unauthenticated" = {
+        timelines = mkMapOfPredefinedKeys {
+          local = false;
+          federated = false;
+          bubble = true;
+        };
+      };
+
+      ":translator" = {
+        enabled = true;
+        module = mkRaw "Pleroma.Akkoma.Translators.DeepL";
+      };
+
+      ":deepl" = {
+        tier = mkAtom ":free";
+        api_key._secret = config.sops.secrets."services/akkoma/deepl".path;
+      };
+    };
+
+    ":web_push_encryption".":vapid_details" = {
+      subject = "mailto:contact@florp.social";
+    };
+
+    ":joken".":default_signer"._secret = "/var/lib/secrets/akkoma/jwt-signer";
+  };
+  services.postgresql.enable = true;
+  services.postgresql.extraPlugins = [
+    pkgs.postgresql16Packages.rum
+  ];
+  services.nginx = {
+    clientMaxBodySize = "256m";
+    commonHttpConfig = ''
+      access_log off;
+
+      proxy_cache_path /var/cache/nginx/akkoma-media-cache
+        levels= keys_zone=akkoma_media_cache:64m max_size=64g
+        inactive=1y use_temp_path=off;
+    '';
+  };
+  kyouma.nginx.virtualHosts = let
+    proxyCache = ''
+      proxy_cache akkoma_media_cache;
+
+      # Cache objects in slices of 1 MiB
+      slice 1m;
+      proxy_cache_key $host$uri$is_args$args$slice_range;
+      proxy_set_header Range $slice_range;
+
+      # Decouple proxy and upstream responses
+      proxy_buffering on;
+      proxy_cache_lock on;
+      proxy_ignore_client_abort on;
+
+      # Default cache times for various responses
+      proxy_cache_valid 200 1y;
+      proxy_cache_valid 206 301 304 1h;
+
+      # Allow serving of stale items
+      proxy_cache_use_stale error timeout invalid_header updating;
+    '';
+  in {
+    "florp.social" = {
+      serverAliases = map (x: "${x}.florp.social") [ "a" "b" "c" ];
+      locations."/" = {
+        proxyPass = "http://unix:/run/akkoma/socket";
+        proxyWebsockets = true;
+      };
+      locations."^/media(/.*)$".return = "308 https://media.florp.social$1";
+      locations."^/proxy(/.*)$".return = "308 https://cache.florp.social$1";
+      locations."= /api/v1/pleroma/admin/config" = {
+        return = ''200 "\{\"error\":\"You must enable configurable_from_database in your config file.\"\}"'';
+        extraConfig = ''
+          types { } default_type "application/json; charset=utf-8";
+        '';
+      };
+    };
+
+    "media.florp.social" = {
+      useACMEHost = "florp.social";
+      locations."/" = {
+        proxyPass = "http://unix:/run/akkoma/socket";
+        extraConfig = ''
+          rewrite ^(?!/media)(.*)$ /media$1;
+        '' + proxyCache;
+      };
+    };
+    
+    "cache.florp.social" = {
+      useACMEHost = "florp.social";
+      locations."/" = {
+        proxyPass = "http://unix:/run/akkoma/socket";
+        extraConfig = ''
+          rewrite ^(?!/proxy)(.*)$ /proxy$1;
+        '' + proxyCache;
+      };
+    };
+  };
+  security.acme.certs."florp.social".extraDomainNames = [
+    "cache.florp.social"
+    "media.florp.social"
+  ] ++ map (x: "${x}.florp.social") [ "a" "b" "c" ];
+}

config/services/akkoma/elly-mod.json

@@ -0,0 +1,529 @@
+{
+  "_pleroma_theme_version": 2,
+  "name": "elly's theme (mod)",
+  "theme": {
+    "themeEngineVersion": 3,
+    "shadows": {
+      "panel": [
+        {
+          "color": "#000000",
+          "x": "1",
+          "y": "2",
+          "blur": "6",
+          "spread": 0,
+          "alpha": 0.6
+        }
+      ],
+      "topBar": [
+        {
+          "x": 0,
+          "y": 0,
+          "blur": 4,
+          "spread": 0,
+          "color": "#000000",
+          "alpha": 0.6
+        }
+      ],
+      "popup": [
+        {
+          "x": 2,
+          "y": 2,
+          "blur": 3,
+          "spread": 0,
+          "color": "#000000",
+          "alpha": 0.5
+        }
+      ],
+      "avatar": [
+        {
+          "x": 0,
+          "y": 1,
+          "blur": 8,
+          "spread": 0,
+          "color": "#000000",
+          "alpha": 0.7
+        }
+      ],
+      "avatarStatus": [],
+      "panelHeader": [
+        {
+          "color": "#ffffff",
+          "x": 0,
+          "y": "40",
+          "blur": "40",
+          "spread": "-40",
+          "inset": true,
+          "alpha": "0.1"
+        }
+      ],
+      "button": [
+        {
+          "color": "#ffffff",
+          "x": 0,
+          "y": "0",
+          "blur": "0",
+          "spread": "1",
+          "alpha": "0.15",
+          "inset": true
+        },
+        {
+          "color": "#000000",
+          "x": "1",
+          "y": "1",
+          "blur": "1",
+          "spread": 0,
+          "alpha": "0.3",
+          "inset": false
+        }
+      ],
+      "buttonHover": [
+        {
+          "color": "#318cbc",
+          "x": 0,
+          "y": "0",
+          "blur": 0,
+          "spread": "1",
+          "alpha": 1,
+          "inset": true
+        },
+        {
+          "color": "#000000",
+          "x": "1",
+          "y": "1",
+          "blur": "1",
+          "spread": 0,
+          "alpha": "0.3",
+          "inset": false
+        }
+      ],
+      "buttonPressed": [
+        {
+          "color": "#bebebe",
+          "x": 0,
+          "y": 0,
+          "blur": "0",
+          "spread": "50",
+          "alpha": 0.5,
+          "inset": true
+        },
+        {
+          "color": "#ffffff",
+          "x": 0,
+          "y": "0",
+          "blur": 0,
+          "spread": "1",
+          "alpha": 0.2,
+          "inset": true
+        },
+        {
+          "color": "#000000",
+          "x": "1",
+          "y": "1",
+          "blur": 0,
+          "spread": 0,
+          "alpha": "0.3",
+          "inset": false
+        }
+      ],
+      "input": [
+        {
+          "color": "#FFFFFF",
+          "x": 0,
+          "y": "0",
+          "blur": 0,
+          "spread": "1",
+          "alpha": "0.2",
+          "inset": true
+        }
+      ]
+    },
+    "colors": {
+      "underlay": "#000000",
+      "bg": "#070e1b",
+      "fg": "#31363b",
+      "cRed": "#c42d38",
+      "cGreen": "#22b325",
+      "cOrange": "#d7d720",
+      "cBlue": "#ffffff",
+      "accent": "#3daee9",
+      "link": "#318cbc",
+      "text": "#bebebe",
+      "badgeNotification": "#024297",
+      "badgeNotificationText": "#ffffff",
+      "alertNeutral": "#bebebe",
+      "alertNeutralText": "#ffffff",
+      "alertPopupNeutral": "#bebebe",
+      "alertPopupNeutralText": "#000000",
+      "alertSuccess": "#22b325",
+      "alertSuccessText": "#ffffff",
+      "alertPopupSuccess": "#22b325",
+      "alertPopupSuccessText": "#000000",
+      "alertWarning": "#d7d720",
+      "alertWarningText": "#ffffff",
+      "alertPopupWarning": "#d7d720",
+      "alertPopupWarningText": "#000000",
+      "alertError": "#ff090f",
+      "alertErrorText": "#bebebe",
+      "alertPopupError": "#ff090f",
+      "alertPopupErrorText": "#ffffff",
+      "panel": "#0d1a31",
+      "panelText": "#bebebe",
+      "alertNeutralPanelText": "#ffffff",
+      "alertSuccessPanelText": "#ffffff",
+      "alertWarningPanelText": "#ffffff",
+      "alertErrorPanelText": "#bebebe",
+      "fgText": "#bebebe",
+      "topBar": "#0d1a31",
+      "topBarText": "#bebebe",
+      "input": "#18223d",
+      "inputTopbarText": "#bebebe",
+      "inputPanelText": "#bebebe",
+      "inputText": "#bebebe",
+      "btn": "#18223d",
+      "btnText": "#bebebe",
+      "btnTopBarText": "#bebebe",
+      "btnDisabled": "#0c121c",
+      "btnDisabledTopBarText": "#393d45",
+      "btnPanelText": "#bebebe",
+      "btnDisabledPanelText": "#393d45",
+      "btnDisabledText": "#393d45",
+      "btnToggled": "#1b1d1f",
+      "btnToggledTopBarText": "#bebebe",
+      "btnToggledPanelText": "#bebebe",
+      "btnToggledText": "#bebebe",
+      "btnPressed": "#1b1d1f",
+      "btnPressedTopBarText": "#bebebe",
+      "btnPressedTopBar": "#1b1d1f",
+      "btnPressedPanelText": "#bebebe",
+      "btnPressedPanel": "#1b1d1f",
+      "btnPressedText": "#bebebe",
+      "tabActiveText": "#bebebe",
+      "tabText": "#bebebe",
+      "tab": "#1b1d1f",
+      "fgLink": "#543fe7",
+      "topBarLink": "#bebebe",
+      "panelLink": "#38a5ed",
+      "panelFaint": "#bebebe",
+      "icon": "#63666d",
+      "poll": "#1d4f6e",
+      "pollText": "#bebebe",
+      "border": "#363c41",
+      "postCyantext": "#ffffff",
+      "postGreentext": "#22b325",
+      "postLink": "#3daee9",
+      "lightText": "#f2f2f2",
+      "popover": "#070e1b",
+      "selectedMenuPopover": "#0d1930",
+      "highlight": "#0d1930",
+      "highlightText": "#bebebe",
+      "selectedMenu": "#0d1930",
+      "selectedMenuText": "#bebebe",
+      "selectedMenuPopoverIcon": "#666c77",
+      "highlightLink": "#3daee9",
+      "selectedMenuLink": "#3daee9",
+      "selectedMenuPopoverLink": "#3daee9",
+      "selectedMenuPopoverText": "#bebebe",
+      "faintLink": "#3daee9",
+      "highlightFaintLink": "#3daee9",
+      "selectedMenuFaintLink": "#3daee9",
+      "selectedMenuPopoverFaintLink": "#3daee9",
+      "faint": "#bebebe",
+      "highlightFaintText": "#bebebe",
+      "selectedMenuFaintText": "#bebebe",
+      "selectedMenuPopoverFaintText": "#bebebe",
+      "highlightLightText": "#f2f2f2",
+      "selectedMenuLightText": "#f2f2f2",
+      "selectedMenuPopoverLightText": "#f2f2f2",
+      "selectedMenuIcon": "#666c77",
+      "selectedPost": "#0d1930",
+      "selectedPostText": "#bebebe",
+      "selectedPostIcon": "#666c77",
+      "selectedPostLink": "#3daee9",
+      "selectedPostFaintLink": "#3daee9",
+      "highlightPostLink": "#3daee9",
+      "selectedPostPostLink": "#3daee9",
+      "selectedPostLightText": "#f2f2f2",
+      "selectedPostFaintText": "#bebebe",
+      "popoverText": "#bebebe",
+      "popoverIcon": "#63666d",
+      "popoverLink": "#3daee9",
+      "postFaintLink": "#3daee9",
+      "popoverPostFaintLink": "#3daee9",
+      "popoverFaintLink": "#3daee9",
+      "popoverFaintText": "#bebebe",
+      "popoverPostLink": "#3daee9",
+      "popoverLightText": "#f2f2f2",
+      "highlightIcon": "#666c77",
+      "highlightPostFaintLink": "#3daee9",
+      "profileTint": "#070e1b",
+      "profileBg": "#03070f",
+      "wallpaper": "#050a13"
+    },
+    "opacity": {
+      "underlay": 0.15,
+      "bg": 0.85,
+      "alert": 0.5,
+      "alertPopup": 0.95,
+      "panel": 0.75,
+      "input": 0.9,
+      "btn": 0.9,
+      "faint": 0.5,
+      "border": 0.55,
+      "popover": 1,
+      "profileTint": 0.5
+    },
+    "radii": {
+      "btn": "3",
+      "input": "4",
+      "checkbox": "1",
+      "panel": "3",
+      "avatar": "4",
+      "avatarAlt": "4",
+      "tooltip": 2,
+      "attachment": "3"
+    },
+    "fonts": {
+      "interface": {
+        "family": "sans-serif"
+      },
+      "input": {
+        "family": "inherit"
+      },
+      "post": {
+        "family": "inherit"
+      },
+      "postCode": {
+        "family": "monospace"
+      }
+    }
+  },
+  "source": {
+    "themeEngineVersion": 3,
+    "fonts": {},
+    "shadows": {
+      "panel": [
+        {
+          "x": "1",
+          "y": "2",
+          "blur": "6",
+          "spread": 0,
+          "color": "#000000",
+          "alpha": 0.6
+        }
+      ],
+      "button": [
+        {
+          "x": 0,
+          "y": "0",
+          "blur": "0",
+          "spread": "1",
+          "color": "#ffffff",
+          "alpha": "0.15",
+          "inset": true
+        },
+        {
+          "x": "1",
+          "y": "1",
+          "blur": "1",
+          "spread": 0,
+          "color": "#000000",
+          "alpha": "0.3",
+          "inset": false
+        }
+      ],
+      "panelHeader": [
+        {
+          "x": 0,
+          "y": "40",
+          "blur": "40",
+          "spread": "-40",
+          "inset": true,
+          "color": "#ffffff",
+          "alpha": "0.1"
+        }
+      ],
+      "buttonHover": [
+        {
+          "x": 0,
+          "y": "0",
+          "blur": 0,
+          "spread": "1",
+          "color": "--link",
+          "alpha": 1,
+          "inset": true
+        },
+        {
+          "x": "1",
+          "y": "1",
+          "blur": "1",
+          "spread": 0,
+          "color": "#000000",
+          "alpha": "0.3",
+          "inset": false
+        }
+      ],
+      "buttonPressed": [
+        {
+          "x": 0,
+          "y": 0,
+          "blur": "0",
+          "spread": "50",
+          "color": "--faint",
+          "alpha": 0.5,
+          "inset": true
+        },
+        {
+          "x": 0,
+          "y": "0",
+          "blur": 0,
+          "spread": "1",
+          "color": "#ffffff",
+          "alpha": 0.2,
+          "inset": true
+        },
+        {
+          "x": "1",
+          "y": "1",
+          "blur": 0,
+          "spread": 0,
+          "color": "#000000",
+          "alpha": "0.3",
+          "inset": false
+        }
+      ],
+      "input": [
+        {
+          "x": 0,
+          "y": "0",
+          "blur": 0,
+          "spread": "1",
+          "color": "#FFFFFF",
+          "alpha": "0.2",
+          "inset": true
+        }
+      ]
+    },
+    "opacity": {
+      "bg": "0.85",
+      "border": "0.55",
+      "panel": "0.75",
+      "btn": "0.9",
+      "input": "0.9"
+    },
+    "colors": {
+      "bg": "#070e1b",
+      "fg": "#31363b",
+      "text": "#bebebe",
+      "underlay": "#000000",
+      "link": "#318cbc",
+      "accent": "#3daee9",
+      "faint": "#bebebe",
+      "faintLink": "#3daee9",
+      "postFaintLink": "#3daee9",
+      "cBlue": "#ffffff",
+      "cRed": "#c42d38",
+      "cGreen": "#22b325",
+      "cOrange": "#d7d720",
+      "highlight": "#0d1930",
+      "highlightLightText": "#f2f2f2",
+      "highlightPostLink": "#3daee9",
+      "highlightFaintText": "#bebebe",
+      "highlightFaintLink": "#3daee9",
+      "highlightPostFaintLink": "#3daee9",
+      "highlightText": "#bebebe",
+      "highlightLink": "#3daee9",
+      "highlightIcon": "#666c77",
+      "popover": "#070e1b",
+      "popoverLightText": "#f2f2f2",
+      "popoverPostLink": "#3daee9",
+      "popoverFaintText": "#bebebe",
+      "popoverFaintLink": "#3daee9",
+      "popoverPostFaintLink": "#3daee9",
+      "popoverText": "#bebebe",
+      "popoverLink": "#3daee9",
+      "popoverIcon": "#63666d",
+      "selectedPost": "#0d1930",
+      "selectedPostFaintText": "#bebebe",
+      "selectedPostLightText": "#f2f2f2",
+      "selectedPostPostLink": "#3daee9",
+      "selectedPostFaintLink": "#3daee9",
+      "selectedPostText": "#bebebe",
+      "selectedPostLink": "#3daee9",
+      "selectedPostIcon": "#666c77",
+      "selectedMenu": "#0d1930",
+      "selectedMenuLightText": "#f2f2f2",
+      "selectedMenuFaintText": "#bebebe",
+      "selectedMenuFaintLink": "#3daee9",
+      "selectedMenuText": "#bebebe",
+      "selectedMenuLink": "#3daee9",
+      "selectedMenuIcon": "#666c77",
+      "selectedMenuPopover": "#0d1930",
+      "selectedMenuPopoverLightText": "#f2f2f2",
+      "selectedMenuPopoverFaintText": "#bebebe",
+      "selectedMenuPopoverFaintLink": "#3daee9",
+      "selectedMenuPopoverText": "#bebebe",
+      "selectedMenuPopoverLink": "#3daee9",
+      "selectedMenuPopoverIcon": "#666c77",
+      "lightText": "#f2f2f2",
+      "postLink": "#3daee9",
+      "border": "#363c41",
+      "poll": "#1d4f6e",
+      "pollText": "#bebebe",
+      "icon": "#63666d",
+      "fgText": "#bebebe",
+      "fgLink": "#543fe7",
+      "panel": "#0d1a31",
+      "panelText": "#bebebe",
+      "panelFaint": "#bebebe",
+      "panelLink": "#38a5ed",
+      "topBar": "#0d1a31",
+      "topBarText": "#bebebe",
+      "topBarLink": "#bebebe",
+      "tab": "#1b1d1f",
+      "tabText": "#bebebe",
+      "tabActiveText": "#bebebe",
+      "btn": "#18223d",
+      "btnText": "#bebebe",
+      "btnPanelText": "#bebebe",
+      "btnTopBarText": "#bebebe",
+      "btnPressed": "#1b1d1f",
+      "btnPressedText": "#bebebe",
+      "btnPressedPanel": "#1b1d1f",
+      "btnPressedPanelText": "#bebebe",
+      "btnPressedTopBar": "#1b1d1f",
+      "btnPressedTopBarText": "#bebebe",
+      "btnToggled": "#1b1d1f",
+      "btnToggledText": "#bebebe",
+      "btnToggledPanelText": "#bebebe",
+      "btnToggledTopBarText": "#bebebe",
+      "btnDisabled": "#0c121c",
+      "btnDisabledText": "#393d45",
+      "btnDisabledPanelText": "#393d45",
+      "btnDisabledTopBarText": "#393d45",
+      "input": "#18223d",
+      "inputText": "#bebebe",
+      "inputPanelText": "#bebebe",
+      "inputTopbarText": "#bebebe",
+      "alertError": "#ff090f",
+      "alertErrorText": "#bebebe",
+      "alertErrorPanelText": "#bebebe",
+      "alertWarning": "#d7d720",
+      "alertWarningText": "#ffffff",
+      "alertWarningPanelText": "#ffffff",
+      "alertNeutral": "#bebebe",
+      "alertNeutralText": "#ffffff",
+      "alertNeutralPanelText": "#ffffff",
+      "badgeNotification": "#024297",
+      "badgeNotificationText": "#ffffff"
+    },
+    "radii": {
+      "btn": "3",
+      "input": "4",
+      "checkbox": "1",
+      "panel": "3",
+      "avatar": "4",
+      "avatarAlt": "4",
+      "attachment": "3"
+    }
+  }
+}

config/services/arrs/default.nix

@@ -0,0 +1,55 @@
+{ lib, pkgs, ... }: {
+
+  services = {
+    prowlarr.enable = true;
+  } // lib.genAttrs [ "sonarr" "radarr" ] (_: {
+    enable = true;
+  });
+  systemd.services = lib.genAttrs [ "radarr" "sonarr" ] (_: {
+    wants = [ "mnt-mezzomix.mount" ];
+  });
+
+  systemd.mounts = lib.singleton {
+    description = "rclone mount";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" "radarr.service" "sonarr.service" ];
+
+    where = "/mnt/mezzomix";
+    what = "mezzomix@otos.feralhosting.com:private/rtorrent/data";
+    type = "fuse.sshfs";
+    options = "umask=0000,idmap=user,_netdev,rw,nosuid,allow_other,default_permissions,follow_symlinks,reconnect,max_conns=10,identityfile=/etc/keys/ssh_host_ed25519_key";
+  };
+  systemd.automounts = lib.singleton {
+    name = "mnt-mezzomix.automount";
+    where = "/mnt/mezzomix";
+    wantedBy = [ "multi-user.target" ];
+
+    automountConfig.TimeoutIdleSec = 0;
+  };
+  environment.systemPackages = [ pkgs.sshfs ];
+  programs.ssh.ciphers = [ "aes256-ctr" ];
+
+
+  kyouma.nginx.virtualHosts = {
+    "crime.kyouma.net" = {
+      verifyClientCert = true;
+      disableHttp3 = true;
+      locations = {
+        "/".root = pkgs.writeTextDir "index.html" (builtins.readFile ./landingPage.html);
+        "/sonarr/" = {
+          proxyPass = "http://127.0.0.1:8989";
+          recommendedProxySettings = true;
+        };
+        "/radarr/" = {
+          proxyPass = "http://127.0.0.1:7878";
+          recommendedProxySettings = true;
+        };
+        "/prowlarr/" = {
+          proxyPass = "http://127.0.0.1:9696";
+          recommendedProxySettings = true;
+        };
+      };
+    };
+  };
+  security.acme.certs."crime.kyouma.net" = {};
+}

config/services/arrs/landingPage.html

@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>crime.kyouma.net</title>
+<style>
+body {
+  width: 35em;
+  margin: 0 auto;
+  font-family: Tahoma, Verdana, Arial, sans-serif;
+}
+</style>
+</head>
+<body>
+<h1>Welcome to crime.kyouma.net!</h1>
+<p>If you see this page, the nginx web server is successfully installed and
+working. Further configuration is required.</p>
+
+<p>Sonarr
+<a href="https://crime.kyouma.net/sonarr">crime.kyouma.net/sonarr</a><br/>
+Radarr
+<a href="https://crime.kyouma.net/radarr">crime.kyouma.net/radarr</a><br/>
+Prowlarr
+<a href="https://crime.kyouma.net/prowlarr">crime.kyouma.net/prowlarr</a></p>
+
+<p><em>Thank you for using nginx.</em></p>
+</body>
+</html>

config/services/forgejo.nix

@@ -5,6 +5,7 @@
   };
   services.forgejo = {
     enable = true;
+    package = pkgs.forgejo;
     secrets.mailer.PASSWD = config.sops.secrets."services/forgejo/mailerPassword".path;
     database = {
       createDatabase = true;

config/services/hydra/default.nix

@@ -1,6 +1,7 @@
-{ config, ... }: {
+{ config, inputs, lib, ... }: {
   imports = [
     ./nix-config.nix
+    inputs.hydra.nixosModules.hydra
   ];
   sops.secrets."services/hydra/signKey" = {
     owner = "hydra-queue-runner";
@@ -18,8 +19,9 @@
   };
   kyouma.deployment.auto-upgrade.cache = "daemon";
 
-  services.hydra = {
+  services.hydra-dev = {
     enable = true;
+    package = inputs.hydra.packages.${config.nixpkgs.hostPlatform.system}.hydra;
     hydraURL = "https://hydra.kyouma.net";
     listenHost = "localhost";
     notificationSender = "hydra@hydra.kyouma.net";
@@ -28,18 +30,24 @@
     extraConfig = ''
       server_store_uri = https://cache.kyouma.net
       binary_cache_public_uri = https://cache.kyouma.net
-      evaluator_workers = 8
-      evaluator_max_memory_size = 16384
+      evaluator_workers = 1
+      evaluator_max_memory_size = 4096
+      max_output_size = ${builtins.toString (24 * 1024 * 1024 * 1024)}
     '';
   };
   services.harmonia = {
     enable = true;
-    signKeyPath = config.sops.secrets."services/hydra/signKey".path;
+    signKeyPaths = lib.singleton config.sops.secrets."services/hydra/signKey".path;
     settings = {
       bind = "[::1]:5555";
     };
   };
 
+  systemd.services.hydra-evaluator.serviceConfig = {
+    MemoryHigh = "150G";
+    MemoryMax = "155G";
+  };
+
   kyouma.nginx.defaultForbidden = "hydra.kyouma.net";
   kyouma.nginx.virtualHosts = {
     "hydra.kyouma.net".locations."/".proxyPass = "http://localhost:3000";

config/services/hydra/nix-config.nix

@@ -1,42 +1,45 @@
-{ config, ... }: {
-  nix.buildMachines = [
+{ config, lib, ... }: {
+  nix.buildMachines = let
+    base = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+  in [
     {
       hostName = "localhost";
-      sshUser = "hydra-queue-runner";
-      maxJobs = 20;
-      speedFactor = 17;
+      protocol = null;
+      maxJobs = 0;
+      speedFactor = 0;
       systems = [ "x86_64-linux" ];
-      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
-      sshKey = config.sops.secrets."services/hydra/id_ed25519_hydra".path;
+      supportedFeatures = base;
     }
     {
       hostName = "integra.kyouma.net";
-      sshUser = "build";
+      sshUser = "nix-ssh";
       maxJobs = 2;
       speedFactor = 4;
       systems = [ "aarch64-linux" ];
-      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
+      supportedFeatures = base;
       sshKey = config.sops.secrets."services/hydra/id_ed25519_hydra".path;
     }
     {
-      hostName = "build-worker-03.nyantec.com";
-      sshUser = "nix-ssh";
-      maxJobs = 4;
-      speedFactor = 18;
-      systems = [ "x86_64-linux" "riscv64-linux" ];
-      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-x86-64" "gccarch-x86-64-v2" "gccarch-x86-64-v3" ];
+      hostName = "schrodinger.kyouma.net";
+      sshUser = "root";
+      maxJobs = 0;
+      speedFactor = 20;
+      systems = [ "riscv64-linux" ];
+      supportedFeatures = base ++ [ "gccarch-rv64imac" "gccarch-rv64imacfd" "gccarch-rv64gc" ];
       sshKey = config.sops.secrets."services/hydra/id_ed25519_hydra".path;
     }
-    {
-      hostName = "build-worker-04.nyantec.com";
-      sshUser = "nix-ssh";
-      maxJobs = 4;
-      speedFactor = 18;
-      systems = [ "x86_64-linux" "riscv64-linux" ];
-      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-x86-64" "gccarch-x86-64-v2" "gccarch-x86-64-v3" ];
+  ] ++ lib.forEach (lib.range 0 11) (num: {
+      hostName = "build-worker-${lib.fixedWidthNumber 2 num}";
+      sshUser = "root";
+      maxJobs = 2;
+      speedFactor = 20;
+      systems = [ "i686-linux" "x86_64-linux" ];
+      supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "gccarch-x86-64" "gccarch-x86-64-v2" "gccarch-x86-64-v3" ];
       sshKey = config.sops.secrets."services/hydra/id_ed25519_hydra".path;
-    }
-  ];
+  });
+  nixpkgs.config.allowUnsupportedSystem = true;
+  nix.distributedBuilds = true;
+  nix.gc.automatic = lib.mkForce false;
   nix.settings = {
     allowed-uris = [
       "github:"
@@ -45,13 +48,35 @@
       "https://"
     ];
   };
-  users.users.hydra-queue-runner.openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/vCXM3IaxJP9v2Y+xcQrQD2IcffgdzqtWhpMjj9Xl5 hydra@seras"
-  ];
   programs.ssh = {
-    knownHosts."build-worker-03.nyantec.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGqTY74c5g15DSNPNM2Wdr5jAwS7BFgX1XRnhtGOnJc";
-    knownHosts."build-worker-04.nyantec.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOq+5I+nlAN2lJoOtoXrYEDuZ/TMPMa43pIlablYigK";
-    knownHosts."integra.kyouma.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBwEQiSfaDrUAwgul4mktusBPcIVxI4pLNDh9DPopVU";
-    knownHosts."localhost".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPNVavo3YHVsrYwXRVISu7kDoknn+5inFGySn4azlB8P";
+    knownHosts = {
+      "build-worker-03.nyantec.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGqTY74c5g15DSNPNM2Wdr5jAwS7BFgX1XRnhtGOnJc";
+      "build-worker-04.nyantec.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOq+5I+nlAN2lJoOtoXrYEDuZ/TMPMa43pIlablYigK";
+      "integra.kyouma.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBwEQiSfaDrUAwgul4mktusBPcIVxI4pLNDh9DPopVU";
+      "schrodinger.kyouma.net".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKo7vZ6lS1wx76YsbAdhOsGcc20YMAW52ep8SZ/FCHDp";
+      "lab.nyantec.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIUePtVPtBK+CYosufbaGiMT4EVanti4V5t2Wg0g/Fy4";
+      "localhost".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPNVavo3YHVsrYwXRVISu7kDoknn+5inFGySn4azlB8P";
+      "[build-worker-kyoumanet.fly.dev]:2200".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJUGzlilikAUfUGKXVCoTeDvPRoWUgDDkNU5WaRUBzls";
+      "[build-worker-kyoumanet.fly.dev]:2201".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDL2M97UBHg9aUfjDUxzmzg1r0ga0m3/stummBVwuEAB";
+      "[build-worker-kyoumanet.fly.dev]:2202".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOTwVKL0P0chPM2Gz23rbT94844+w1CGJdCaZdzfjThz";
+      "[build-worker-kyoumanet.fly.dev]:2203".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAjy2eZGJQeAYy0+fLgW9jiS0jVY2LInY0NDMnzCvvKp";
+      "[build-worker-kyoumanet.fly.dev]:2204".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN72OyD9LYy4hq0WZ7ie5RPV+G54UreEJiA/RubjGoe9";
+      "[build-worker-kyoumanet.fly.dev]:2205".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICNh1o1I98XrI2XmOI6Q0aHPfyLCIQwKkKOxGUUeXL9v";
+      "[build-worker-kyoumanet.fly.dev]:2206".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGf0kxGgwOG9KhUhvxxTSiQC5YikrzZXKDgSpBw33qN4";
+      "[build-worker-kyoumanet.fly.dev]:2207".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL9z95a6Fn/dB+iNigEYpuJdBnBwCkIZYaKHcFbGP+RY";
+      "[build-worker-kyoumanet.fly.dev]:2208".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAk+FNMhTfAVqk3MfLp4QiG/i5ti53DlpnC0q+sOvU9O";
+      "[build-worker-kyoumanet-cdg.fly.dev]:2209".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJGlQD/3fLn/Kyb7v0RIycHRcArGi75jURj803EMpW0S";
+      "[build-worker-kyoumanet-cdg.fly.dev]:2210".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMQm1FSGBGdCR5f8MvBvdKM0M4yIQVnH1po7hHO5T1qz";
+      "[build-worker-kyoumanet-cdg.fly.dev]:2211".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINlH+v2ZlcDQY3itw4b7aRbwRTqDsTE0R5Ua3vF0VaGr";
+    }; 
+    extraConfig = ''
+      Host machine-0008.cloud-v.co
+        Hostname machine.cloud-v.co
+        Port 20008
+    '' + lib.concatLines (lib.forEach (lib.range 0 11) (num: ''
+      Host build-worker-${lib.fixedWidthNumber 2 num}
+        Hostname build-worker-kyoumanet${lib.optionalString (num > 8) "-cdg"}.fly.dev
+        Port 22${lib.fixedWidthNumber 2 num}
+    ''));
   };
 }

config/services/jellyfin.nix

@@ -0,0 +1,34 @@
+{ lib, ... }: {
+
+  services.jellyfin.enable = true;
+
+  kyouma.nginx.virtualHosts = {
+    "watch.kyouma.net".redirectTo = "fentanyl.trade";
+    "fentanyl.trade" = {
+      serverAliases = lib.singleton "frotti.ng";
+      locations = {
+        "= /".return = "302 https://$host/web/";
+        "/" = {
+          proxyPass = "http://[::1]:8096";
+          recommendedProxySettings = true;
+          extraConfig = ''
+            proxy_buffering on;
+          '';
+        };
+        "= /web/" = {
+          proxyPass = "http://[::1]:8096";
+          recommendedProxySettings = true;
+        };
+        "/socket" = {
+          proxyPass = "http://[::1]:8096";
+          recommendedProxySettings = true;
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+  security.acme.certs."fentanyl.trade".extraDomainNames = [ 
+    "frotti.ng"
+    "watch.kyouma.net"
+  ];
+}

config/services/librespeed.nix

@@ -0,0 +1,8 @@
+{ ... }: {
+  services.librespeed = {
+    enable = true;
+    openFirewall = true;
+    domain = "speed.kyouma.net";
+    frontend.enable = true;
+  };
+}

config/services/nginx.nix

@@ -1,4 +1,6 @@
-{ config, lib, ... }: with lib; {
+{ config, lib, pkgs, ... }: let 
+  inherit (lib) mkDefault;
+in {
   kyouma.deployment.tags = [ "web" ];
   security.dhparams.enable = true;
   security.dhparams.params.nginx = {};
@@ -9,9 +11,11 @@
       email = "noc@kyouma.net";
     };
   };
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  networking.firewall.allowedUDPPorts = [ 443 ];
   services.nginx = {
     enable = true;
-    #package = pkgs.nginxQuic;
+    package = mkDefault pkgs.nginxQuic;
     
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
@@ -32,7 +36,14 @@
       add_header X-XSS-Protection 		      "1; mode=block" always;
       add_header X-Frame-Options 		        "SAMEORIGIN" always;
       add_header Referrer-Policy 		        "same-origin" always;
+      add_header Alt-Svc                    'h3=":443"; ma=7776000; persist=1, h2=":443"; ma=7776000; persist=1';
       #add_header Content-Security-Policy    "script-src 'self'; object-src 'none'; base-uri 'none';" always;
     '';
+    eventsConfig = ''
+      multi_accept on;
+    '';
+    appendConfig = ''
+      worker_processes auto;
+    '';
   };
 }

config/services/vaultwarden.nix

@@ -5,14 +5,14 @@
   };
   sops.secrets."services/vaultwarden/basicAuth" = {
     sopsFile = ../../secrets/services/vaultwarden.yaml;
-    owner = "vaultwarden";
+    owner = "nginx";
   };
   services.vaultwarden = {
     enable = true;
     environmentFile = config.sops.secrets."services/vaultwarden/environmentFile".path;
     backupDir = "/var/backup/bitwarden_rs";
     config = {
-      DOMAIN = "https://staging.vault.kyouma.net";
+      DOMAIN = "https://vault.kyouma.net";
       DATABASE_MAX_CONNS = 15;
       WEB_VAULT_ENABLED = true;
       WEBSOCKET_ADDRESS = "::1";
@@ -33,10 +33,10 @@
       SMTP_SECURITY = "starttls";
       SMTP_PORT = 587;
       ROCKET_ADDRESS = "::1";
-      ROCKET_PORT = "8222";
+      ROCKET_PORT = 8222;
     };
   };
-  kyouma.nginx.virtualHosts."staging.vault.kyouma.net" = {
+  kyouma.nginx.virtualHosts."vault.kyouma.net" = {
     locations."/" = {
       proxyPass = "http://[::1]:8222";
       proxyWebsockets = true;
@@ -46,5 +46,5 @@
       basicAuthFile = config.sops.secrets."services/vaultwarden/basicAuth".path;
     };
   };
-  security.acme.certs."staging.vault.kyouma.net" = {};
+  security.acme.certs."vault.kyouma.net" = {};
 }

config/users/emily/default.nix

@@ -12,7 +12,7 @@
     ];
   };
   nixpkgs.config.permittedInsecurePackages = [
-    "electron-25.9.0"
+    "jitsi-meet-1.0.8043"
   ];
 
   home-manager.useGlobalPkgs = true;
@@ -23,6 +23,7 @@
       whois
       htop
       restic
+      fend
     ] ++ lib.optionals config.kyouma.machine-type.graphical [
       linux-manual
       colmena
@@ -36,6 +37,9 @@
       pavucontrol
       signal-desktop
       element-desktop
+      firefox
+      # currently broken
+      #inputs.firefox.packages.${pkgs.system}.firefox
       
       nixfmt-classic
       wl-clipboard
@@ -61,7 +65,7 @@
 
     programs.eza = {
       enable = true;
-      icons = true;
+      icons = "auto";
       git = true;
       extraOptions = [
         "--color-scale=all"

config/users/lucy/default.nix

@@ -0,0 +1,78 @@
+{ inputs, pkgs, ... }: {
+  imports = [
+    inputs.home-manager.nixosModules.home-manager
+  ];
+
+  users.users.lucy = {
+    isNormalUser = true;
+    shell = pkgs.fish;
+    ignoreShellProgramCheck = true;
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIId7XvwEHtC9KdGg4Bn+XE+yyBp7/dRToJX9T56mM7ln kosaki@kosaki"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAZH8HwE1OxVAArRpc3+c7foYJ/WYjp4BqUyuab9yQyl emilia@emilia"
+    ];
+  };
+
+  home-manager.useGlobalPkgs = true;
+  home-manager.users.lucy = {
+    home.stateVersion = "24.11";
+
+    home.packages = with pkgs; [
+      whois
+      htop
+      restic
+      fend
+    ];
+    fonts.fontconfig.enable = true;
+
+    programs.bat.enable = true;
+    programs.gpg.enable = true;
+    programs.ripgrep.enable = true;
+
+    programs.tmux = {
+      enable = true;
+      prefix = "M-w";
+      clock24 = true;
+      extraConfig = ''
+        # unbind keys
+        unbind-key C-b
+
+        # new prefix
+        bind-key M-w send-prefix
+
+        # selection via vim keys
+        bind-key -r	h select-pane -L
+        bind-key -r	j select-pane -D
+        bind-key -r	k select-pane -U
+        bind-key -r	l select-pane -R
+
+        # resize aswell
+        bind-key -r	C-h resize-pane -L 5
+        bind-key -r	C-j resize-pane -D 5
+        bind-key -r	C-k resize-pane -U 5
+        bind-key -r	C-l resize-pane -R 5
+
+        bind-key	g split-window
+        bind-key	v split-window -h
+      '';
+    };
+
+    programs.eza = {
+      enable = true;
+      icons = "auto";
+      git = true;
+      extraOptions = [
+        "--color-scale=all"
+        "--color-scale-mode=gradient"
+        "--group-directories-first"
+      ];
+    };
+    programs.fish = {
+      enable = true;
+      interactiveShellInit = ''
+        set -U fish_greeting
+      '';
+    };
+  };
+}

config/users/nil/default.nix

@@ -0,0 +1,49 @@
+{ inputs, pkgs, ... }: {
+  imports = [
+    inputs.home-manager.nixosModules.home-manager 
+  ];
+
+  users.users.nil = {
+    isNormalUser = true;
+    shell = pkgs.fish;
+    ignoreShellProgramCheck = true;
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAICczPHRwY9MAwDGlcB0QgMOJjcpLJhVU3covrW9RBS62AAAABHNzaDo="
+    ];
+  };
+
+  home-manager.useGlobalPkgs = true;
+  home-manager.users.nil = {
+    home.stateVersion = "24.11";
+
+    home.packages = with pkgs; [
+      whois
+      htop
+      restic
+      fend
+    ];
+    fonts.fontconfig.enable = true;
+
+    programs.bat.enable = true;
+    programs.gpg.enable = true;
+    programs.ripgrep.enable = true;
+
+    programs.eza = {
+      enable = true;
+      icons = "auto";
+      git = true;
+      extraOptions = [
+        "--color-scale=all"
+        "--color-scale-mode=gradient"
+        "--group-directories-first"
+      ];
+    };
+    programs.fish = {
+      enable = true;
+      interactiveShellInit = ''
+        set -U fish_greeting
+      '';
+    };
+  };
+}

flake.nix

@@ -7,7 +7,6 @@
     attic = {
       url = "github:zhaofengli/attic";
       inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-utils.follows = "flake-utils";
     };
     disko = {
       url = "github:nix-community/disko";
@@ -20,22 +19,42 @@
     };
     fernglas = {
       url = "github:wobcom/fernglas";
-      #inputs.nixpkgs.follows = "nixpkgs";
       inputs.flake-utils.follows = "flake-utils";
     };
+    firefox = {
+      url = "git+https://woof.rip/mikael/firefox.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    florp-about = {
+      url = "git+https://woof.rip/florp/about.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    florp-branding = {
+      url = "git+https://woof.rip/florp/branding.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    florp-moderation = {
+      url = "git+https://woof.rip/florp/moderation.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     home-manager = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    iceshrimp = {
-      url = "git+https://iceshrimp.dev/iceshrimp/packaging";
-      inputs.nixpkgs.follows = "nixpkgs";
+    hydra = {
+      url = "git+https://git.lix.systems/lix-project/hydra?ref=main&rev=799441dcf6d595efb0def686ca0815aef398627b";
+      inputs.lix.follows = "lix";
     };
     kyouma-www = {
       url = "git+https://woof.rip/emily/kyouma-net.git";
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.flake-utils.follows = "flake-utils";
     };
+    lix.url = "https://git.lix.systems/lix-project/lix/archive/2.91.1.tar.gz";
+    lix-module = {
+      url = "https://git.lix.systems/lix-project/nixos-module/archive/2.91.1-1.tar.gz";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     nixos-needsreboot = {
       url = "github:thefossguy/nixos-needsreboot";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -45,6 +64,11 @@
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.home-manager.follows = "home-manager";
     };
+    oth = {
+      url = "git+ssh://forgejo@woof.rip/emily/oth.git";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-utils.follows = "flake-utils";
+    };
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -64,10 +88,6 @@
       "cache.kyouma.net:Frjwu4q1rnwE/MnSTmX9yx86GNA/z3p/oElGvucLiZg="
     ];
     builders-use-substitutes = true;
-    builders = ''
-      ssh://build@seras.kyouma.net x86_64-linux - 40 40 nixos-test,benchmark,big-parallel,kvm
-      ssh://build@integra.kyouma.net aarch64-linux - 4 8 nixos-test,benchmark,big-parallel,kvm
-    '';
   };
 
   outputs = { self, nixpkgs, flake-utils, ... }@inputs: let
@@ -109,7 +129,6 @@
     };
     images = {
       lain = self.nixosConfigurations.lain-minimal.config.system.build.sdImage;
-      build-worker-oci = self.nixosConfigurations.build-worker-oci.config.system.build.tarball;
     };
 
     overlays = {
@@ -133,14 +152,18 @@
     };
   in {
     packages = shinyflakes.mapPackages (pkgs) {
-#      newhost = pkgs.stdenv.mkDerivation {
-#        name = "newhost";
+#      newHost = pkgs.writeShellApplication {
+#        name = "update-flyio";
+#        text = ''
+#        '';
 #      };
     };
-#    apps = rec {
-#      newhost = self.packages.${system}.newhost;
-#      default = newhost;
-#    };
+    apps = {
+      update-build-worker = {
+        type = "app";
+        program = ./pkgs/build-worker-oci/update.sh;
+      };
+    };
     devShells.default = pkgs.mkShell {
       packages = [ pkgs.colmena pkgs.sops ];
     };

modules/default.nix

@@ -1,8 +1,5 @@
-{ ... }: {
-  imports = [
-    ./deployment
-    ./machine-type
-    ./nginx
-    ./update-nixfiles
-  ];
+{ lib, ... }: let
+  mapModules = builtins.attrNames (lib.filterAttrs (_: type: type == "directory") (builtins.readDir ./.));
+in {
+  imports = builtins.map (dir: ./${dir}) mapModules;
 }

modules/graphical/default.nix

@@ -0,0 +1,238 @@
+{ config, pkgs, lib, inputs, ... }:
+let 
+  cfg = config.kyouma.graphical;
+in {
+  options = {
+    kyouma.graphical = {
+      enable = lib.mkEnableOption "graphical profile";
+      compositor = lib.mkOption {
+        type = with lib.types; nullOr (enum [ "hyprland" "niri" ]);
+        default = null;
+      };
+    };
+  };
+
+  imports = [
+    inputs.stylix.nixosModules.stylix
+    ./files.nix
+    ./hyprland.nix
+    ./waybar-hyprland.nix
+    ./hyprlock.nix
+    ./nixvim.nix
+  ];
+
+  config = lib.mkIf cfg.enable {
+  
+    kyouma.machine-type.graphical = true;
+  
+    boot.plymouth.enable = true;
+  
+    security.pam.services.hyprlock = {};
+  
+    services.dbus.packages = [ pkgs.gcr ];
+    services.geoclue2.enable = true;
+  
+    services.pipewire = {
+      enable = true;
+      alsa.enable = true;
+      pulse.enable = true;
+    };
+  
+    services.udisks2.enable = true;
+  
+    environment.variables = {
+      CLUTTER_BACKEND = "wayland";
+      GDK_BACKEND = "wayland,x11";
+      MOZ_ENABLE_WAYLAND = "1";
+      QT_QPA_PLATFORM = "wayland;xcb";
+      QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
+      SDL_VIDEODRIVER = "wayland";
+      LIBVA_DRIVER_NAME = "radeonsi";
+      MESA_VK_DEVICE_SELECT = "1002:73df";
+      WLR_DRM_DEVICES = "$HOME/.config/hypr/external-gpu:$HOME/.config/hypr/internal-gpu";
+    };
+    xdg.icons.enable = true;
+    xdg.portal = {
+      enable = true; 
+      wlr.enable = true;
+      configPackages = [ (if cfg.compositor == "hyprland" 
+        then pkgs.xdg-desktop-portal-hyprland 
+        else pkgs.xdg-desktop-portal-wlr
+      ) ];
+    };
+  
+    stylix= {
+      image = pkgs.fetchurl {
+        url = "https://kyouma.net/wallpaper.png";
+        sha256 = "1f46b439a864cd28b8ea93563b4762f1efb2648bae0148fd6b45f3033b10b0e8";
+      };
+      polarity = "dark";
+      #base16Scheme = "${pkgs.base16-schemes}/share/themes/catppuccin-macchiato.yaml";
+      fonts = {
+        sansSerif = {
+          package = pkgs.noto-fonts;
+          name = "Noto Sans";
+        };
+        serif = config.stylix.fonts.sansSerif;
+        monospace = {
+          package = pkgs.jetbrains-mono;
+          name = "JetBrains Mono Regular";
+        };
+        sizes.terminal = 11;
+      };
+      cursor = {
+        package = pkgs.capitaine-cursors;
+        name = "capitaine";
+        size = 24;
+      };
+      targets = {
+        console.enable = false;
+        gnome.enable = true;
+        fish.enable = false;
+      };
+    };
+  
+    home-manager.users.emily = {
+      stylix.targets = {
+        hyprland.enable = false;
+        sway.enable = false;
+        kitty.enable = false;
+        mako.enable = false;
+        rofi.enable = false;
+        swaylock.enable = false;
+        waybar.enable = false;
+        nixvim.enable = false;
+        fish.enable = false;
+      };
+      home.keyboard = {
+        layout = "de";
+        variant = "neo_qwerty";
+      };
+  
+      programs.imv.enable = true;
+      
+      programs.wpaperd = {
+        enable = true;
+        settings.default = {
+          path = "/home/emily/Pictures/wallpapers/sylviaritter/";
+          duration = "60m";
+          sorting = "random";
+        };
+      };
+      programs.kitty = {
+        enable = true;
+        font.size = 13;
+        font.name = "JetBrains Mono";
+        settings = {
+          enable_audio_bell = false;
+          scrollback_lines = 65536;
+          remember_window_size = false;
+          initial_window_width = 1200;
+          initial_window_height = 800;
+  
+          bold_font = "auto";
+          italic_font = "auto";
+          bold_italic_font = "auto";
+  
+          background = "#090312";
+          background_opacity = "0.7";
+        };
+        keybindings = {
+          "shift+right" = "next_tab";
+          "ctrl+l" = "next_tab";
+          "shift+left" = "previous_tab";
+          "ctrl+h" = "previous_tab";
+        };
+      };
+      programs.rofi = {
+        enable = true;
+        package = pkgs.rofi-wayland;
+      };
+      
+      programs.zoxide = {
+        enable = true;
+        options = [ "--cmd cd" ];
+      };
+      programs.fzf.enable = true;
+  
+      qt = {
+        enable = true;
+        platformTheme.name = "qtct";
+        style.name = "kvantum-dark";
+        style.package = with pkgs; [
+          libsForQt5.qtstyleplugin-kvantum
+          qt6Packages.qtstyleplugin-kvantum
+          (catppuccin-kvantum.override { accent = "mauve"; variant = "macchiato"; })
+        ];
+      };
+      gtk.iconTheme.name = "Adwaita";
+      gtk.iconTheme.package = pkgs.gnome.adwaita-icon-theme;
+  
+      services.gammastep = {
+        enable = true;
+        provider = "geoclue2";
+        temperature.day = 6500;
+        temperature.night = 3700;
+        settings.general.adjustment-method = "wayland";
+      };
+      services.mako = {
+        enable = true;
+        anchor = "top-right";
+        backgroundColor = "#24273a";
+        borderColor = "#c6a0f6";
+        borderRadius = 15;
+        borderSize = 2;
+        defaultTimeout = 5000;
+        layer = "overlay";
+        maxIconSize = 48;
+        padding = "15";
+        progressColor = "over #B4A1DB";
+        sort = "-time";
+        textColor = "#cad3f5";
+        extraConfig = ''
+          max-history=100
+          on-button-left=dismiss
+          on-button-right=dismiss-all
+          on-notify=exec ${pkgs.mpv}/bin/mpv /usr/share/sounds/freedesktop/stereo/message.oga
+  
+          [urgency=low]
+          border-color=#B4A1DB
+          default-timeout=2000
+  
+          [urgency=normal]
+          border-color=#B4A1DB
+          default-timeout=5000
+  
+          [urgency=high]
+          border-color=#D04E9D
+          text-color=#D04E9D
+          default-timeout=0
+  
+          [category=mpd]
+          border-color=#E49186
+          default-timeout=2000
+          group-by=category
+        '';
+      };
+      services.gpg-agent = {
+        enable = true;
+        enableSshSupport = true;
+        pinentryPackage = pkgs.pinentry-gnome3;
+      };
+      services.syncthing = {
+        enable = true;
+        tray.enable = true;
+        tray.command = "syncthingtray --replace";
+      };
+      services.udiskie = {
+        enable = true;
+        automount = false;
+      };
+      systemd.user.services.syncthingtray.Service = {
+        ExecStartPre = "${pkgs.coreutils-full}/bin/sleep 2";
+        Restart = "on-failure";
+        RestartSec = "1s";
+      };
+    };
+  };
+}

modules/graphical/files.nix

@@ -1,5 +1,5 @@
-{ config, pkgs, ... }: {
-  home-manager.users.emily = {
+{ config, lib, pkgs, ... }: {
+  config.home-manager.users.emily = lib.mkIf config.kyouma.graphical.enable {
     home.file.".local/bin/hypr/playerctl.sh" = let
       playerctl = "${pkgs.playerctl}/bin/playerctl";
       title = "$(${playerctl} metadata --format '{{markup_escape(title)}}')"; 
@@ -19,7 +19,7 @@
         fi
       '';
     };
-    home.file."./local/bin/hypr/colorpicker.sh" = {
+    home.file.".local/bin/hypr/colorpicker.sh" = {
       enable = true;
       executable = true;
       source = pkgs.writeShellApplication {
@@ -28,7 +28,7 @@
         runtimeInputs = with pkgs; [ coreutils grim slurp imagemagick_light wl-clipboard libnotify ];
       };
     };
-    home.file."./local/bin/hypr/rofi_powermenu.sh" = {
+    home.file.".local/bin/hypr/rofi_powermenu.sh" = {
       enable = true;
       executable = true;
       source = pkgs.writeShellApplication {
@@ -37,7 +37,7 @@
         runtimeInputs = with pkgs; [ rofi hyprlock coreutils-full toybox xdg-user-dirs ];
       };
     };
-    home.file."./local/bin/hypr/rofi_screenshot.sh" = {
+    home.file.".local/bin/hypr/rofi_screenshot.sh" = {
       enable = true;
       executable = true;
       source = pkgs.writeShellApplication {
@@ -46,7 +46,7 @@
         runtimeInputs = with pkgs; [ coreutils grim hyprland imv slurp wl-clipboard libnotify pulseaudio toybox rofi xdg-user-dirs ];
       };
     };
-    home.file."./local/bin/hypr/screenshot.sh" = {
+    home.file.".local/bin/hypr/screenshot.sh" = {
       enable = true;
       executable = true;
       source = pkgs.writeShellApplication {

modules/graphical/hyprland.nix

@@ -1,57 +1,5 @@
-{ pkgs, ... }: {
-  home-manager.users.emily = {
-    programs.hyprlock = {
-      enable = true;
-      settings = {
-        general = {
-          hide_cursor = true;
-          disable_loading_bar = true;
-        };
-        background = [{
-          path = "screenshot";
-          #path = "$HOME/Pictures/wallpapers/lockscreen.png";
-          blur_passes = 3;
-          contrast = 1.25;
-        }];
-        input-field = [{
-          size = "250, 60";
-          outline_thickness = 2;
-          dots_size = 0.2;
-          dots_spacing = 0.2; 
-          dots_center = true;
-          outer_color = "rgba(0, 0, 0, 0)";
-          inner_color = "rgba(0, 0, 0, 0.5)";
-          font_color = "rgb(200, 200, 200)";
-          fade_on_empty = true;
-          fade_timeout = 5000;
-          font_family = "JetBrains Mono Nerd Font Mono";
-          fail_text = "<i>$FAIL <b>$ATTEMPTS</b></i>";
-          position = "0, 200";
-          halign = "center"; 
-          valign = "bottom"; 
-        }];
-        label = [{
-          text = "cmd[update:250] date +%X";
-          color = "rgba(255, 255, 255, 0.6)";
-          font_size = "100";
-          font_family = "JetBrains Mono Nerd Font Mono ExtraBold";
-          position = "0, -300";
-          halign = "center";
-          valign = "top";
-        }];
-      };
-    };
-    services.swayidle =
-    let 
-      hyprlock = "pidof hyprlock || ${pkgs.hyprlock}/bin/hyprlock";
-    in {
-      enable = true;
-      systemdTarget = "hyprland-session.target";
-      events = [
-        { event = "before-sleep"; command = hyprlock; }
-        { event = "lock"; command = hyprlock; }
-      ];
-    };
+{ config, inputs, lib, pkgs, ... }: {
+  config.home-manager.users.emily = lib.mkIf (config.kyouma.graphical.compositor == "hyprland") {
     wayland.windowManager.hyprland = {
       enable = true;
       settings = let
@@ -61,6 +9,8 @@
         notifysend = "${pkgs.libnotify}/bin/notify-send";
         dolphin = "${pkgs.libsForQt5.dolphin}/bin/dolphin";
         firefox = "${pkgs.firefox}/bin/firefox";
+        # currently broken
+        #firefox = "${inputs.firefox.packages.${pkgs.system}.firefox}/bin/firefox";
         brightnessctl = "${pkgs.brightnessctl}/bin/brightnessctl";
         screenshot = "~/.local/bin/hypr/screenshot.sh";
         rofi = "${pkgs.rofi-wayland}/bin/rofi";
@@ -170,8 +120,8 @@
           "eDP-1, 3840x2400@60, 0x0, 1, bitdepth, 10"
           #"eDP-1, 2560x1600@60, 0x0, 1, bitdepth, 10"
           #"eDP-1, 1920x1200@60, 0x0, 1, bitdepth, 10"
-          "desc:Dell Inc. AW3225QF FXK2YZ3, 3840x2160@120,5280x0,1, bitdepth,10, vrr,2"
-          "desc:GIGA-BYTE TECHNOLOGY CO. LTD. AORUS AD27QD 19320B000455, 2560x1440@144,3840x-350,1, bitdepth,10, transform,1"
+          "desc:Dell Inc. AW3225QF FXK2YZ3, 3840x2160@240,5280x0,1, bitdepth,10, vrr,2"
+          "desc:GIGA-BYTE TECHNOLOGY CO. LTD. AORUS AD27QD 19320B000455, 2560x1440@144,3840x-280,1, bitdepth,10, transform,1"
           ",preferred,auto,1"
         ];
         workspace = [

modules/graphical/hyprlock.nix

@@ -0,0 +1,56 @@
+{ config, lib, pkgs, ... }: {
+  config.home-manager.users.emily = lib.mkIf config.kyouma.graphical.enable {
+    programs.hyprlock = {
+      enable = true;
+      settings = {
+        general = {
+          hide_cursor = true;
+          disable_loading_bar = true;
+        };
+        background = [{
+          path = "screenshot";
+          #path = "$HOME/Pictures/wallpapers/lockscreen.png";
+          blur_passes = 3;
+          contrast = 1.25;
+        }];
+        input-field = [{
+          size = "250, 60";
+          outline_thickness = 2;
+          dots_size = 0.2;
+          dots_spacing = 0.2; 
+          dots_center = true;
+          outer_color = "rgba(0, 0, 0, 0)";
+          inner_color = "rgba(0, 0, 0, 0.5)";
+          font_color = "rgb(200, 200, 200)";
+          fade_on_empty = true;
+          fade_timeout = 5000;
+          font_family = "JetBrains Mono Nerd Font Mono";
+          fail_text = "<i>$FAIL <b>$ATTEMPTS</b></i>";
+          position = "0, 200";
+          halign = "center"; 
+          valign = "bottom"; 
+        }];
+        label = [{
+          text = "cmd[update:250] date +%X";
+          color = "rgba(255, 255, 255, 0.6)";
+          font_size = "100";
+          font_family = "JetBrains Mono Nerd Font Mono ExtraBold";
+          position = "0, -300";
+          halign = "center";
+          valign = "top";
+        }];
+      };
+    };
+    services.swayidle =
+    let 
+      hyprlock = "pidof hyprlock || ${pkgs.hyprlock}/bin/hyprlock";
+    in {
+      enable = true;
+      systemdTarget = "${config.kyouma.graphical.compositor}-session.target";
+      events = [
+        { event = "before-sleep"; command = hyprlock; }
+        { event = "lock"; command = hyprlock; }
+      ];
+    };
+  };
+}

modules/graphical/nixvim.nix

@@ -0,0 +1,220 @@
+{ config, lib, pkgs, inputs, ... }: {
+  config = lib.mkIf config.kyouma.graphical.enable {
+    home-manager.users.emily.imports = [
+      inputs.nixvim.homeManagerModules.nixvim
+    ];
+    home-manager.users.emily.programs.nixvim = {
+      enable = true;
+      extraPlugins = [
+        pkgs.vimPlugins.molokai
+        pkgs.vimPlugins.vim-airline-themes
+      ];
+      colorscheme = "molokai";
+      vimAlias = true;
+      highlightOverride.Normal = {
+        ctermbg = "NONE";
+        bg = "NONE";
+      };
+      opts = {
+        number = true;
+        expandtab = true;
+        autoindent = true;
+        mouse = "";
+        encoding = "utf-8";
+        shiftwidth = 2;
+        smartindent = true;
+        tabstop = 2;
+        ignorecase = true;
+        incsearch = true;
+        smartcase = true;
+      };
+      keymaps = [
+        {
+          action = "<cmd>Neotree toggle<CR>";
+          key = "<C-n>";
+          mode = "n";
+          options.silent = true;
+        }
+        {
+          action = "<C-\\><C-n>";
+          key = "<esc>";
+          mode = "t";
+        }
+      ];
+      plugins.cmp = {
+        enable = true;
+        settings.sources = [
+          { name = "nvim_lsp"; }
+          { name = "luasnip"; }
+          { name = "buffer"; }
+          { name = "nvim_lua"; }
+          { name = "path"; }
+        ];
+        settings.formatting = {
+          fields = [ "abbr" "kind" "menu" ];
+          format = ''
+            function(_, item)
+              local icons = {
+                Namespace = "󰌗",
+                Text = "󰉿",
+                Method = "󰆧",
+                Function = "󰆧",
+                Constructor = "",
+                Field = "󰜢",
+                Variable = "󰀫",
+                Class = "󰠱",
+                Interface = "",
+                Module = "",
+                Property = "󰜢",
+                Unit = "󰑭",
+                Value = "󰎠",
+                Enum = "",
+                Keyword = "󰌋",
+                Snippet = "",
+                Color = "󰏘",
+                File = "󰈚",
+                Reference = "󰈇",
+                Folder = "󰉋",
+                EnumMember = "",
+                Constant = "󰏿",
+                Struct = "󰙅",
+                Event = "",
+                Operator = "󰆕",
+                TypeParameter = "󰊄",
+                Table = "",
+                Object = "󰅩",
+                Tag = "",
+                Array = "[]",
+                Boolean = "",
+                Number = "",
+                Null = "󰟢",
+                String = "󰉿",
+                Calendar = "",
+                Watch = "󰥔",
+                Package = "",
+                Copilot = "",
+                Codeium = "",
+                TabNine = "",
+              }
+
+              local icon = icons[item.kind] or ""
+              item.kind = string.format("%s %s", icon, item.kind or "")
+              return item
+            end
+          '';
+        };
+        settings.snippet.expand = "function(args) require('luasnip').lsp_expand(args.body) end";
+        settings.window = {
+          completion = {
+            winhighlight = "FloatBorder:CmpBorder,Normal:CmpPmenu,CursorLine:CmpSel,Search:PmenuSel";
+            scrollbar = false;
+            sidePadding = 0;
+            border = [ "╭" "─" "╮" "│" "╯" "─" "╰" "│" ];
+          };
+          documentation = {
+            border = [ "╭" "─" "╮" "│" "╯" "─" "╰" "│" ];
+            winhighlight = "FloatBorder:CmpBorder,Normal:CmpPmenu,CursorLine:CmpSel,Search:PmenuSel";
+          };
+        };
+        settings.mapping = {
+          "<C-n>" = "cmp.mapping.select_next_item()";
+          "<C-p>" = "cmp.mapping.select_prev_item()";
+          "<C-j>" = "cmp.mapping.select_next_item()";
+          "<C-k>" = "cmp.mapping.select_prev_item()";
+          "<C-d>" = "cmp.mapping.scroll_docs(-4)";
+          "<C-f>" = "cmp.mapping.scroll_docs(4)";
+          "<C-Space>" = "cmp.mapping.complete()";
+          "<C-e>" = "cmp.mapping.close()";
+          "<CR>" = "cmp.mapping.confirm({ behavior = cmp.ConfirmBehavior.Insert, select = true })";
+          "<Tab>" = ''
+            cmp.mapping(function(fallback)
+              if cmp.visible() then
+                cmp.select_next_item()
+              elseif require("luasnip").expand_or_jumpable() then
+                vim.fn.feedkeys(vim.api.nvim_replace_termcodes("<Plug>luasnip-expand-or-jump", true, true, true), "")
+              else
+                fallback()
+              end
+            end,{"i","s"})
+          '';
+          "<S-Tab>" = ''
+            cmp.mapping(function(fallback)
+              if cmp.visible() then
+                cmp.select_prev_item()
+              elseif require("luasnip").jumpable(-1) then
+                vim.fn.feedkeys(vim.api.nvim_replace_termcodes("<Plug>luasnip-jump-prev", true, true, true), "")
+              else
+                fallback()
+              end
+            end,{"i","s"})
+          '';
+        };
+      };
+      plugins.lsp = {
+        enable = true;
+        keymaps.lspBuf = {
+          "K" = "hover";
+          "gd" = "definition";
+          "gD" = "references";
+          "gt" = "type_definition";
+          "gi" = "implementation";
+        };
+        servers = {
+          bashls.enable = true;
+          lua_ls.enable = true;
+          nil_ls = {
+            enable = true;
+            settings.formatting.command = [ "nixfmt" "-w" "140" ];
+          };
+          nixd = {
+            enable = false;
+            settings = {
+              eval.depth = 5;
+              eval.workers = 6;
+              formatting.command = [ "nixfmt" "-w" "140" ];
+              options.enable = true;
+            };
+          };
+          ruff_lsp.enable = true;
+          rust_analyzer = {
+            enable = true;
+            installRustc = true;
+            installCargo = true;
+          };
+        };
+      };
+      plugins.none-ls = {
+        enable = true;
+        sources.diagnostics = {
+          pylint.enable = true;
+        };
+        sources.formatting = {
+          nixfmt.enable = true;
+          markdownlint.enable = true;
+        };
+      };
+      plugins.neo-tree = {
+        enable = true;
+        closeIfLastWindow = true;
+      };
+      plugins.treesitter = {
+        enable = true;
+        nixGrammars = true;
+        settings.indent.enable = true;
+      };
+      plugins.airline.enable = true;
+      plugins.cmp-buffer.enable = true;
+      plugins.cmp-emoji.enable = true;
+      plugins.cmp-nvim-lsp.enable = true;
+      plugins.cmp-path.enable = true;
+      plugins.cmp_luasnip.enable = true;
+      plugins.luasnip.enable = true;
+      plugins.nvim-autopairs.enable = true;
+      plugins.rainbow-delimiters.enable = true;
+      plugins.web-devicons.enable = true;
+      # Broken
+      plugins.rustaceanvim.enable = false;
+      plugins.treesitter-context.enable = true;
+    };
+  };
+}

modules/graphical/waybar-hyprland.nix

@@ -1,5 +1,5 @@
-{ pkgs, ... }: {
-  home-manager.users.emily = {
+{ config, lib, pkgs, ... }: {
+  config.home-manager.users.emily = lib.mkIf config.kyouma.graphical.enable {
     programs.waybar = {
       enable = true; 
       style = ./files/waybar-style.css;

modules/librespeed/default.nix

@@ -0,0 +1,408 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.librespeed;
+in
+{
+  options.services.librespeed =
+    let
+      inherit (lib) mkOption types;
+    in
+    {
+      enable = lib.mkEnableOption "LibreSpeed server";
+      package = lib.mkPackageOption pkgs "librespeed-rust" { };
+      domain = mkOption {
+        description = ''
+          If not `null`, this will add an entry to `services.librespeed.servers` and
+          configure librespeed to use TLS.
+        '';
+        default = null;
+        type = with types; nullOr nonEmptyStr;
+      };
+      downloadIPDB = mkOption {
+        description = ''
+          Whether to download the IP info database before starting librespeed.
+          Disable this if you want to use the Go implementation.
+        '';
+        default = !(cfg.secrets ? "ipinfo_api_key");
+        defaultText = lib.literalExpression ''!(cfg.secrets ? "ipinfo_api_key")'';
+        type = types.bool;
+      };
+      openFirewall = mkOption {
+        description = ''
+          Whether to open the firewall for the specified port.
+        '';
+        default = false;
+        type = types.bool;
+      };
+      secrets = mkOption {
+        description = ''
+          Attribute set of filesystem paths.
+          The contents of the specified paths will be read at service start time and merged with the attributes provided in `settings`.
+        '';
+        default = { };
+        type = with types; nullOr (attrsOf path);
+      };
+      settings = mkOption {
+        description = ''
+          LibreSpeed configuration written as Nix expression.
+          All values set to `null` will be excluded from the evaluated config.
+          This is useful if you want to omit certain defaults when using a different LibreSpeed implementation.
+
+          See [github.com/librespeed][librespeed] for configuration help.
+
+          [librespeed]: https://github.com/librespeed/speedtest-rust
+        '';
+        default = { };
+        type =
+          with types;
+          nullOr (
+            attrsOf (oneOf [
+              (nullOr bool)
+              int
+              str
+              package
+            ])
+          );
+      };
+      frontend = {
+        enable = lib.mkEnableOption ''
+          Enables the LibreSpeed frontend and adds a nginx virtual host if
+          not explicetly disabled and `services.librespeed.domain` is not `null`.
+        '';
+        contactEmail = mkOption {
+          description = "Email address listed in the privacy policy.";
+          default =
+            if (cfg.domain != null) then "webmaster@${cfg.domain}" else "webmaster@${config.networking.fqdn}";
+          defaultText = lib.literalExpression ''
+            if (config.services.librespeed.domain != null) then
+              "webmaster@''${config.services.librespeed.domain}"
+            else
+              "webmaster@''${config.networking.fqdn}";
+          '';
+          type = types.str;
+        };
+        pageTitle = mkOption {
+          description = "Title of the webpage.";
+          default = "LibreSpeed";
+          type = types.str;
+        };
+        useNginx = mkOption {
+          description = ''
+            Configure nginx for the LibreSpeed frontend.
+            This will only create a virtual host for the frontend and won't proxy all requests because
+            the reported upload and download speeds are inaccurate if proxied.
+          '';
+          default = cfg.domain != null;
+          defaultText = lib.literalExpression "config.services.librespeed.domain != null";
+          type = types.bool;
+        };
+        settings = mkOption {
+          description = ''
+            Override default settings of the speedtest web client.
+            See [speedtest_worker.js][link] for a list of possible values.
+
+            [link]: https://github.com/librespeed/speedtest/blob/master/speedtest_worker.js#L39
+          '';
+          default = {
+            telemetry_level = "basic";
+          };
+          type =
+            with types;
+            nullOr (
+              attrsOf (oneOf [
+                bool
+                int
+                str
+                float
+              ])
+            );
+        };
+        servers = mkOption {
+          description = "LibreSpeed servers that should apper in the server list.";
+          type = types.listOf (
+            types.submodule {
+              options =
+                let
+                  inherit (types) nonEmptyStr;
+                in
+                {
+                  name = mkOption {
+                    description = "Name shown in the server list.";
+                    type = nonEmptyStr;
+                  };
+                  server = mkOption {
+                    description = "URL to the server. You may use `//` instead of `http://` or `https://`.";
+                    type = nonEmptyStr;
+                  };
+                  dlURL = mkOption {
+                    description = ''
+                      URL path to download test on this server.
+                      Append `.php` to the default value if the server uses the php implementation.
+                    '';
+                    default = "backend/garbage";
+                    type = nonEmptyStr;
+                  };
+                  ulURL = mkOption {
+                    description = ''
+                      URL path to upload test on this server.
+                      Append `.php` to the default value if the server uses the php implementation.
+                    '';
+                    default = "backend/empty";
+                    type = nonEmptyStr;
+                  };
+                  pingURL = mkOption {
+                    description = ''
+                      URL path to latency/jitter test on this server.
+                      Append `.php` to the default value if the server uses the php implementation.
+                    '';
+                    default = "backend/empty";
+                    type = nonEmptyStr;
+                  };
+                  getIpURL = mkOption {
+                    description = ''
+                      URL path to IP lookup on this server.
+                      Append `.php` to the default value if the server uses the php implementation.
+                    '';
+                    default = "backend/getIP";
+                    type = nonEmptyStr;
+                  };
+                };
+            }
+          );
+        };
+      };
+    };
+  config = lib.mkIf cfg.enable (
+    let
+      librespeedAssets =
+        pkgs.runCommand "librespeed-assets"
+          (
+            let
+              mapValue =
+                arg:
+                if (lib.isBool arg) then
+                  lib.boolToString arg
+                else if ((lib.isInt arg) || (lib.isFloat arg)) then
+                  toString arg
+                else
+                  "\"${lib.escape [ "\"" ] (toString arg)}\"";
+
+              mapSettings = lib.pipe cfg.frontend.settings [
+                (lib.mapAttrs (name: val: "  s.setParameter(\"${lib.escape [ "\"" ] name}\",${mapValue val});"))
+                (lib.attrValues)
+                (lib.concatLines)
+              ];
+            in
+            {
+              preferLocal = true;
+
+              serversList = ''
+                function get_servers() {
+                  return ${builtins.toJSON cfg.frontend.servers}
+                }
+                function override_settings () {
+                ${mapSettings}
+                }
+              '';
+            }
+          )
+          ''
+            cp -r ${pkgs.librespeed-rust}/assets $out
+            chmod 666 $out/servers_list.js
+            cat >$out/servers_list.js <<<"$serversList"
+            substitute ${pkgs.librespeed-rust}/assets/index.html $out/index.html \
+              --replace-fail "s.setParameter(\"telemetry_level\",\"basic\"); //enable telemetry" "override_settings();" \
+              --replace-fail "LibreSpeed Example" ${lib.escapeShellArg (lib.escapeXML cfg.frontend.pageTitle)} \
+              --replace-fail "PUT@YOUR_EMAIL.HERE" ${lib.escapeShellArg (lib.escapeXML cfg.frontend.contactEmail)} \
+              --replace-fail "TO BE FILLED BY DEVELOPER" ${lib.escapeShellArg (lib.escapeXML cfg.frontend.contactEmail)}
+          '';
+    in
+    {
+      assertions = [
+        {
+          assertion = cfg.frontend.useNginx -> cfg.domain != null;
+          message = ''
+            `services.librespeed.frontend.useNginx` requires `services.librespeed.frontend.domain` to be set.
+          '';
+        }
+      ];
+
+      networking.firewall = lib.mkIf cfg.openFirewall {
+        allowedTCPPorts = [ cfg.settings.listen_port ];
+      };
+      services.nginx.virtualHosts = lib.mkIf (cfg.frontend.enable && cfg.frontend.useNginx) {
+        ${cfg.domain} = {
+          locations."/".root = librespeedAssets;
+          locations."= /servers.json".return = "200 '${builtins.toJSON cfg.frontend.servers}'";
+          locations."/backend/".return = "301 https://$host:${toString cfg.settings.listen_port}$request_uri";
+          enableACME = true;
+          forceSSL = true;
+        };
+      };
+      security.acme.certs = lib.mkIf (cfg.domain != null) {
+        ${cfg.domain} = {
+          reloadServices = [ "librespeed.service" ];
+          webroot = "/var/lib/acme/acme-challenge";
+        };
+      };
+
+      services.librespeed.frontend.servers = lib.mkIf (cfg.frontend.enable && (cfg.domain != null)) [
+        {
+          name = cfg.domain;
+          server = "//${cfg.domain}:${toString cfg.settings.listen_port}";
+        }
+      ];
+
+      services.librespeed.settings =
+        let
+          inherit (lib) mkDefault mkIf;
+        in
+        {
+          assets_path =
+            if (cfg.frontend.enable && !cfg.frontend.useNginx) then
+              librespeedAssets
+            else
+              pkgs.writeTextDir "index.html" "";
+
+          bind_address = mkDefault "::";
+          listen_port = mkDefault 8989;
+          base_url = mkDefault "backend";
+          worker_threads = mkDefault "auto";
+
+          database_type = mkDefault "none";
+          database_file = mkDefault "/var/lib/librespeed/speedtest.sqlite";
+
+          #librespeed-rust will fail to start if the following config parameters are omitted.
+          ipinfo_api_key = mkIf (!cfg.secrets ? "ipinfo_api_key") "";
+          stats_password = mkIf (!cfg.secrets ? "stats_password") "";
+          tls_cert_file =
+            if (cfg.domain != null) then
+              (mkDefault "/run/credentials/librespeed.service/cert.pem")
+            else
+              (mkDefault "");
+          tls_key_file =
+            if (cfg.domain != null) then
+              (mkDefault "/run/credentials/librespeed.service/key.pem")
+            else
+              (mkDefault "");
+
+          enable_tls = mkDefault (cfg.domain != null);
+        };
+
+      systemd.services =
+        let
+          configFile =
+            let
+              mapValue =
+                arg:
+                if (lib.isBool arg) then
+                  lib.boolToString arg
+                else if (lib.isInt arg) then
+                  toString arg
+                else
+                  "\"${lib.escape [ "\"" ] (toString arg)}\"";
+            in
+            with lib;
+            pipe cfg.settings [
+              (filterAttrs (_: val: val != null))
+              (mapAttrs (name: val: "${name}=${mapValue val}"))
+              (attrValues)
+              (concatLines)
+              (pkgs.writeText "${cfg.package.name}-config.toml")
+            ];
+        in
+        {
+          librespeed-secrets = lib.mkIf (cfg.secrets != { }) {
+            description = "LibreSpeed secret helper";
+
+            ExecStart =
+              let
+                script = pkgs.writeShellApplication {
+                  name = "librespeed-secrets";
+                  runtimeInputs = [ pkgs.coreutils ];
+                  text =
+                    ''
+                      cp ${configFile} ''${RUNTIME_DIRECTORY%%:*}/config.toml
+                    ''
+                    + lib.pipe cfg.secrets [
+                      (lib.mapAttrs (
+                        name: file: ''
+                          cat >>''${RUNTIME_DIRECTORY%%:*}/config.toml <<EOF
+                          ${name}="$(<${lib.escapeShellArg file})"
+                          EOF
+                        ''
+                      ))
+                      (lib.concatLines lib.attrValues)
+                    ];
+                };
+              in
+              lib.getExe script;
+
+            serviceConfig = {
+              Type = "oneshot";
+              RemainAfterExit = true;
+              RuntimeDirectory = "librespeed";
+              UMask = "u=rw";
+            };
+          };
+          librespeed = {
+            description = "LibreSpeed server daemon";
+            wantedBy = [ "multi-user.target" ];
+            wants = [ "network-online.target" ];
+            requires = lib.optionals (cfg.secrets != { }) [ "librespeed-secrets.service" ];
+
+            serviceConfig = {
+              Type = "simple";
+              Restart = "always";
+
+              DynamicUser = true;
+
+              LoadCredential = lib.mkIf (cfg.domain != null) [
+                "cert.pem:${config.security.acme.certs.${cfg.domain}.directory}/cert.pem"
+                "key.pem:${config.security.acme.certs.${cfg.domain}.directory}/key.pem"
+              ];
+
+              ExecStartPre = lib.mkIf cfg.downloadIPDB "${lib.getExe cfg.package} --update-ipdb";
+              ExecStart = "${lib.getExe cfg.package} -c ${
+                if (cfg.secrets == { }) then configFile else "\${RUNTIME_DIRECTORY%%:*}/config.toml"
+              }";
+              WorkingDirectory = "/var/cache/librespeed";
+              RuntimeDirectory = "librespeed";
+              RuntimeDirectoryPreserve = true;
+              StateDirectory = "librespeed";
+              CacheDirectory = "librespeed";
+              SyslogIdentifier = "librespeed";
+
+              ReadOnlyPaths = [ cfg.package ];
+              RestrictSUIDSGID = true;
+              RestrictNamespaces = true;
+              PrivateTmp = true;
+              PrivateDevices = true;
+              PrivateUsers = true;
+              ProtectHostname = true;
+              ProtectClock = true;
+              ProtectKernelTunables = true;
+              ProtectKernelModules = true;
+              ProtectKernelLogs = true;
+              ProtectControlGroups = true;
+              ProtectSystem = "strict";
+              ProtectHome = true;
+              ProtectProc = "invisible";
+              SystemCallArchitectures = "native";
+              SystemCallFilter = "@system-service";
+              SystemCallErrorNumber = "EPERM";
+              LockPersonality = true;
+              NoNewPrivileges = true;
+            };
+          };
+        };
+    }
+  );
+
+  meta.maintainers = with lib.maintainers; [ snaki ];
+}

modules/machine-type/default.nix

@@ -38,11 +38,6 @@ in {
       default = false;
       description = mdDoc "Mark machine as portable.";
     };
-    container = mkOption {
-      type = types.bool;
-      default = false;
-      description = mdDoc "Mark machine as container image.";
-    };
   };
   config = {
     assertions = [

modules/nginx/default.nix

@@ -2,28 +2,40 @@
   cfg = config.kyouma.nginx;
   extraConfig = ''
     add_header Strict-Transport-Security 	$hsts_header;
-    #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
-    add_header X-Content-Type-Options 	"nosniff" always;
-    add_header X-XSS-Protection 		"1; mode=block" always;
-    add_header X-Frame-Options 		"SAMEORIGIN" always;
-    add_header Referrer-Policy 		"same-origin" always;
+    add_header Alt-Svc                    'h3=":443"; ma=7776000; persist=1, h2=":443"; ma=7776000; persist=1';
+    #add_header Content-Security-Policy   "script-src 'self'; object-src 'none'; base-uri 'none';" always;
+    add_header X-Content-Type-Options 	  "nosniff" always;
+    add_header X-XSS-Protection 		      "1; mode=block" always;
+    add_header X-Frame-Options 		        "SAMEORIGIN" always;
+    add_header Referrer-Policy 		        "same-origin" always;
   '';
   createHost = vhostName: vhostCfg: {
-    extraConfig = (lib.optionalString (builtins.hasAttr "extraConfig" vhostCfg) vhostCfg.extraConfig) + "\n" + extraConfig;
+    extraConfig = lib.optionalString (vhostCfg ? "extraConfig") (
+      vhostCfg.extraConfig + "\n" + extraConfig
+    ) + lib.optionalString (
+      if (vhostCfg ? "verifyClientCert") then 
+        vhostCfg.verifyClientCert
+      else false
+    ) ''
+      ssl_client_certificate ${./kyouma_Root_CA.pem};
+      ssl_verify_client on;
+      ssl_verify_depth 1;
+    '';
     forceSSL = true;
-    #kTLS = true;
-    #http3 = true;
-    #quic = true; 
   } //
-  lib.optionalAttrs (!(builtins.hasAttr "useACMEHost" vhostCfg)) {
+  lib.optionalAttrs (!(vhostCfg ? "useACMEHost")) {
     enableACME = true;
   } //
-  lib.optionalAttrs (builtins.hasAttr "redirectTo" vhostCfg) {
+  lib.optionalAttrs (vhostCfg ? "redirectTo") {
     enableACME = false;
     useACMEHost = vhostCfg.redirectTo;
     globalRedirect = vhostCfg.redirectTo;
   } //
-  (builtins.removeAttrs vhostCfg [ "redirectTo" "extraConfig" ]);
+  lib.optionalAttrs (!vhostCfg ? "disableHttp3") {
+    http3 = true;
+    quic = true; 
+  } //
+  (builtins.removeAttrs vhostCfg [ "redirectTo" "extraConfig" "verifyClientCert" "disableHttp3" ]);
 
 in {
   options = {
@@ -38,17 +50,21 @@ in {
   };
   config = {
     services.nginx.virtualHosts = lib.optionalAttrs (cfg.virtualHosts != null) (
-      builtins.mapAttrs (createHost) cfg.virtualHosts) //
-      lib.optionalAttrs (cfg.defaultForbidden != null) {
-        "redirect" = {
-          default = true;
-          forceSSL = true;
-          reuseport = true;
-          useACMEHost = cfg.defaultForbidden;
-          extraConfig = ''
-            return 403;
-          '';
-        };
+      builtins.mapAttrs (createHost) cfg.virtualHosts
+    ) // lib.optionalAttrs (cfg.defaultForbidden != null) {
+      "redirect" = {
+        quic = true;
+        http3 = true;
+        # reuseport has to be specified on the quic listener
+        # when using worker_processes auto;
+        reuseport = true;
+        default = true;
+        forceSSL = true;
+        useACMEHost = cfg.defaultForbidden;
+        extraConfig = ''
+          return 403;
+        '';
       };
+    };
   };
 }

modules/nginx/kyouma_Root_CA.pem

@@ -0,0 +1,192 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number:
+            47:94:9e:44:65:f4:61:f8:aa:b3:c1:7b:86:38:21:d9:88:a5:88:f0
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=kyouma Root CA
+        Validity
+            Not Before: Jun 21 14:02:26 2024 GMT
+            Not After : Jun 21 14:02:26 2044 GMT
+        Subject: CN=kyouma Root CA
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (7680 bit)
+                Modulus:
+                    00:f9:d0:a3:4b:d9:77:e3:ec:b4:46:8e:3f:1f:a4:
+                    39:22:60:d8:ad:e9:1e:fe:ad:17:f8:30:d6:f6:fa:
+                    e9:62:f7:36:25:07:e9:6c:83:91:42:0f:e2:53:f1:
+                    ca:70:da:26:7d:bf:bb:1d:d5:4d:5e:99:82:99:39:
+                    97:f3:c3:7d:f9:0d:08:e8:d4:ae:fc:45:88:98:8e:
+                    a3:bc:2a:bd:16:67:32:59:08:59:eb:a8:de:a6:a7:
+                    77:9d:f9:1a:c6:7f:76:92:3d:d7:56:74:2b:a3:5a:
+                    97:8f:05:ab:3b:dc:92:61:2e:7f:95:b1:5c:04:da:
+                    1e:2e:b9:de:7b:16:b2:85:b4:b4:5a:48:34:9a:bb:
+                    18:0d:0a:0a:34:91:f8:8f:f3:79:46:a6:c4:ee:aa:
+                    93:88:03:cf:43:a2:ba:1e:bc:65:f1:78:d8:ce:d8:
+                    2b:fb:db:33:d6:37:ad:d4:9d:44:38:ff:b5:0d:dc:
+                    08:61:2c:fb:f0:86:b2:ef:ff:a8:4f:63:28:13:49:
+                    f8:21:4e:cb:22:98:54:de:e7:b4:e2:b6:14:c9:c5:
+                    59:04:82:04:a2:39:3c:61:f5:91:99:ff:ac:6e:80:
+                    9a:d2:22:7d:51:fb:ad:a3:6a:4c:14:a8:e3:28:d9:
+                    22:ac:c8:3d:34:17:5a:40:ce:8d:3c:52:e7:e1:e9:
+                    d4:75:0d:3f:b8:dd:d3:d2:56:25:92:fa:75:87:81:
+                    fe:59:4a:82:53:d5:e7:03:39:c0:07:84:73:70:d0:
+                    fc:fe:3f:06:e0:f9:0f:59:22:74:05:13:65:58:5a:
+                    a8:1d:7b:52:4f:47:ed:be:26:57:47:49:57:d5:7f:
+                    34:c7:3c:0f:55:d4:17:57:8a:0e:bb:f5:3a:c7:77:
+                    f1:7d:06:49:a9:a8:dd:18:0e:a2:97:52:c8:49:e5:
+                    39:c7:31:5d:07:c3:58:ed:8e:ae:c7:7c:1b:db:8d:
+                    dc:a0:c3:e3:f5:c0:98:35:cf:fc:92:a0:a6:f3:0f:
+                    b1:18:95:c0:01:eb:1d:96:8d:02:7b:9a:dc:29:5d:
+                    59:f1:2a:dc:53:0e:6b:2b:6b:5d:36:03:a1:bd:e4:
+                    e6:b4:1f:5a:66:67:13:4a:2c:7f:56:c9:75:5c:fe:
+                    42:20:24:51:18:bb:ea:30:12:8f:88:d1:ad:fe:eb:
+                    59:92:8d:1e:be:ff:3e:6e:f2:5a:d9:8c:20:f4:35:
+                    ed:bc:01:47:21:d3:10:b9:5d:fe:6a:8e:e0:a3:e3:
+                    e5:6f:ac:8b:fc:61:d0:75:a8:a3:92:1f:2c:cc:c1:
+                    15:17:36:3b:05:ab:58:76:be:63:9d:30:5d:ed:7d:
+                    83:0c:b7:24:8f:10:a8:90:02:ee:68:81:05:cd:d9:
+                    4f:2e:cc:ef:97:62:d1:75:6b:82:f3:d0:34:56:d3:
+                    59:7e:d9:d3:7d:93:ce:1b:17:de:fd:18:4b:e6:50:
+                    72:77:88:60:dd:ff:5e:95:05:61:fe:d8:31:dd:34:
+                    1e:e1:6d:61:1e:80:73:05:3e:3b:22:c2:34:07:48:
+                    9b:0e:06:8d:a6:81:c4:4d:e9:4d:5d:df:e1:04:cd:
+                    5b:85:6e:b2:12:aa:1b:cd:bd:4e:7e:53:ea:59:49:
+                    af:11:70:b3:11:87:0f:af:2f:99:ce:e9:69:db:6d:
+                    d0:5a:14:1a:95:2f:2f:db:bf:36:62:e1:99:ff:7c:
+                    b8:b9:5c:4e:79:33:61:ee:db:4b:6f:40:7d:49:b2:
+                    6e:e1:65:9d:f6:45:fe:27:14:24:82:5d:f6:a4:38:
+                    01:ac:47:54:da:b6:02:c1:ad:79:71:b6:93:64:ec:
+                    a4:06:7b:d6:5e:1c:da:7f:40:16:47:65:47:24:2a:
+                    8b:77:32:49:89:c4:9f:26:d4:f9:a6:ba:e6:42:aa:
+                    74:fd:7e:1e:d1:75:95:5c:5c:d8:d4:bb:75:05:79:
+                    10:7a:df:5a:2b:69:9b:75:28:cb:b5:4e:48:3e:a3:
+                    aa:21:04:95:8f:62:3b:46:2f:07:d0:9e:1c:50:9b:
+                    3d:ba:6d:1f:c2:a0:41:7f:47:43:57:ef:92:31:47:
+                    4a:a2:91:65:43:5c:c1:2b:fd:26:2d:be:41:a7:98:
+                    7a:8f:52:89:5f:81:ff:48:7d:04:2a:b8:4d:50:91:
+                    f5:af:18:33:44:f2:55:5f:68:87:33:d8:e6:4f:5d:
+                    b9:92:ca:06:51:f3:e0:b1:5b:6f:a0:52:fe:6e:98:
+                    22:01:5f:c2:fb:45:59:02:67:62:6f:74:2b:79:62:
+                    e7:5a:13:a8:db:fd:a2:64:b1:0b:49:2f:f4:61:35:
+                    a0:b6:12:2c:ec:24:19:9f:0c:14:85:05:b5:e1:c1:
+                    9e:4e:87:a4:88:c9:79:65:1d:12:ac:89:e6:bc:ed:
+                    6b:58:90:fd:95:40:3f:2e:ba:ff:b8:52:5d:60:98:
+                    32:b9:20:38:a5:08:da:a1:fc:38:89:3c:f1:de:38:
+                    cf:60:d8:69:a1:4b:88:51:f7:31:b8:fc:56:dc:56:
+                    3a:7a:39:c5:03:23:2a:8f:fa:ab:92:7a:b6:37:da:
+                    c1:9f:55:e7:31:b1:c5:be:31:60:08:c2:33:30:ec:
+                    cf
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                7B:C0:C6:7B:04:C4:66:0C:CD:32:FF:B0:6F:E1:D9:51:FD:1C:EE:B7
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+    Signature Algorithm: sha256WithRSAEncryption
+    Signature Value:
+        58:b3:2d:00:8e:c2:72:5b:ed:91:8e:3c:98:66:6a:e4:61:c3:
+        0f:d1:51:98:0c:64:79:3d:01:ac:8a:38:7f:af:fc:80:31:83:
+        86:a8:79:b9:0f:18:6d:2e:3a:ef:0a:c0:b1:30:39:7e:a4:3d:
+        ed:4e:35:3e:9e:f1:a3:29:dd:cc:01:1e:62:6b:ed:5b:77:31:
+        b3:4c:91:1d:69:70:20:44:87:e0:37:17:a0:ba:c4:e5:57:c5:
+        90:1a:f2:1e:0d:ac:aa:30:11:c3:da:1c:3f:3a:28:b5:6d:12:
+        ac:45:b6:6c:f0:b2:b2:6e:f0:55:33:8e:29:10:ac:9e:61:ac:
+        35:ec:ed:c7:e3:51:c2:86:52:10:7a:9c:f6:22:5d:65:65:18:
+        62:b7:e9:6e:be:64:46:db:dc:15:45:eb:1a:42:45:83:d7:aa:
+        dd:63:24:4a:ed:b9:d5:35:86:27:22:33:6a:26:4b:32:0a:15:
+        75:18:19:58:e9:6b:b4:84:ac:00:a3:78:d3:9d:7d:25:3c:5e:
+        51:7f:01:ca:90:d1:40:2b:d2:45:e1:4f:fb:6e:8d:2e:cc:04:
+        07:34:07:91:c6:8c:4f:a5:e4:7d:dd:78:0f:b0:9d:01:9d:6e:
+        89:16:6d:3a:94:dd:38:57:bc:49:c2:e1:b5:aa:54:8f:d1:8b:
+        13:db:35:2f:d1:80:5e:45:fb:53:60:61:d5:c3:e1:9c:21:60:
+        a3:83:34:e6:9e:bc:86:70:fe:36:8b:35:55:28:e0:f4:b0:81:
+        ed:37:59:0e:7a:f6:a7:66:a1:b6:36:45:30:95:c8:80:d6:40:
+        a9:12:bf:47:b1:33:09:fa:89:d4:9f:c2:57:75:6a:47:dd:87:
+        3f:b3:d1:3d:13:bc:5e:82:ea:5f:3a:dc:46:35:1e:1f:83:40:
+        1c:1d:5e:ba:37:18:a3:75:2f:60:a7:84:67:9b:79:17:ad:fb:
+        2a:5b:d8:84:5d:f2:ff:cc:81:4c:08:e4:17:ec:b7:cf:ac:4c:
+        0f:91:8a:4c:fa:91:ed:24:39:f9:04:3a:18:b0:b1:c3:57:ed:
+        9b:f1:cf:ab:bf:07:f1:52:ef:57:de:0a:76:e7:e4:c4:5f:69:
+        93:71:0c:d4:3f:23:12:55:8c:3d:e6:79:b3:3c:5e:86:ac:1f:
+        5e:7f:ec:96:d8:da:4d:c9:40:32:ee:b5:cb:6e:86:27:49:45:
+        e6:89:30:80:fa:ba:ef:21:42:92:ba:f8:a7:51:16:61:04:13:
+        da:87:ac:c5:9c:c0:19:55:80:2d:4a:32:bb:30:12:0b:49:15:
+        ec:1e:5b:23:d4:d2:a3:4e:c6:22:19:bc:e2:ba:23:67:88:4c:
+        54:d0:bf:10:61:91:d9:eb:f7:d7:bc:89:ee:83:0d:a3:2c:81:
+        a4:c2:38:58:c3:50:b7:fe:3f:f2:bc:a2:f0:52:9d:04:1f:c2:
+        85:bd:d6:06:77:30:7b:90:3d:29:92:dc:41:a9:40:4b:bb:7c:
+        b7:91:07:65:2b:03:af:e4:a0:18:ab:a5:76:00:bc:10:e8:21:
+        41:c7:d7:53:80:41:21:67:af:fe:d1:9d:14:4c:a9:7e:16:1d:
+        4b:61:a4:f4:b1:e8:88:fe:c4:f1:60:3e:6d:d5:a9:90:14:3e:
+        95:5d:7d:f0:7b:1e:af:5f:80:63:a8:ce:b1:a7:a1:b2:9a:10:
+        f7:d9:e7:00:fa:33:d7:61:c9:35:b1:c2:c9:60:0b:a5:1d:08:
+        a8:b2:1d:56:15:b8:b9:5e:36:b3:df:6a:76:6c:5e:9d:a7:e5:
+        54:dc:1a:6c:c3:34:f2:c2:c6:ee:7a:68:49:a3:41:d6:54:34:
+        78:c9:2b:d2:d2:52:94:23:35:d7:c4:bf:c6:e0:21:18:4f:7a:
+        7a:be:e8:ab:34:fa:f7:4d:1a:4b:3c:37:e9:5f:1c:76:b1:6d:
+        96:70:f5:f5:db:b4:15:ba:2c:71:25:80:b3:98:4a:d3:1a:8d:
+        0e:69:24:de:e3:0c:38:64:82:6e:54:d1:74:47:e5:e5:69:b1:
+        c1:04:12:72:8a:3f:71:c0:9f:dc:db:ba:0e:e8:3d:52:4a:23:
+        56:04:9b:8c:eb:4f:62:19:7f:f5:bd:1e:48:d9:7f:89:84:3c:
+        8d:f5:67:21:d6:81:ee:5a:cd:fa:c2:53:60:a0:97:1e:80:a2:
+        dc:96:89:e6:99:d9:9d:48:23:a0:07:9a:02:06:29:04:eb:03:
+        79:06:6b:a0:41:98:d2:8f:2d:b4:e3:cb:c2:5e:78:74:a1:92:
+        29:c9:7d:07:03:ca:3f:8c:f5:71:f0:c4:7d:6a:1b:ac:33:37:
+        4f:03:54:44:46:b6:76:1c:55:8a:7d:7b:e5:58:4e:a9:f8:e1:
+        fe:7b:f3:a2:f8:e6:3b:e0:0b:5d:47:a8:b7:aa:f8:f3:c0:65:
+        b0:e4:1c:22:8f:9e:b9:d1:8f:a6:4a:a4:28:6f:6c:27:31:49:
+        58:c0:4d:80:3b:e3:e2:22:aa:ec:4e:ba:a5:0d:9e:b8:17:8c:
+        6b:4e:2d:37:6a:cc:f3:2d:0d:6b:34:b4:00:eb:ce:31:0e:a5:
+        c4:85:cd:1e:16:0b
+-----BEGIN CERTIFICATE-----
+MIIIgjCCBKqgAwIBAgIUR5SeRGX0Yfiqs8F7hjgh2YiliPAwDQYJKoZIhvcNAQEL
+BQAwGTEXMBUGA1UEAwwOa3lvdW1hIFJvb3QgQ0EwHhcNMjQwNjIxMTQwMjI2WhcN
+NDQwNjIxMTQwMjI2WjAZMRcwFQYDVQQDDA5reW91bWEgUm9vdCBDQTCCA+IwDQYJ
+KoZIhvcNAQEBBQADggPPADCCA8oCggPBAPnQo0vZd+PstEaOPx+kOSJg2K3pHv6t
+F/gw1vb66WL3NiUH6WyDkUIP4lPxynDaJn2/ux3VTV6Zgpk5l/PDffkNCOjUrvxF
+iJiOo7wqvRZnMlkIWeuo3qand535GsZ/dpI911Z0K6Nal48FqzvckmEuf5WxXATa
+Hi653nsWsoW0tFpINJq7GA0KCjSR+I/zeUamxO6qk4gDz0Oiuh68ZfF42M7YK/vb
+M9Y3rdSdRDj/tQ3cCGEs+/CGsu//qE9jKBNJ+CFOyyKYVN7ntOK2FMnFWQSCBKI5
+PGH1kZn/rG6AmtIifVH7raNqTBSo4yjZIqzIPTQXWkDOjTxS5+Hp1HUNP7jd09JW
+JZL6dYeB/llKglPV5wM5wAeEc3DQ/P4/BuD5D1kidAUTZVhaqB17Uk9H7b4mV0dJ
+V9V/NMc8D1XUF1eKDrv1Osd38X0GSamo3RgOopdSyEnlOccxXQfDWO2Orsd8G9uN
+3KDD4/XAmDXP/JKgpvMPsRiVwAHrHZaNAnua3CldWfEq3FMOaytrXTYDob3k5rQf
+WmZnE0osf1bJdVz+QiAkURi76jASj4jRrf7rWZKNHr7/Pm7yWtmMIPQ17bwBRyHT
+ELld/mqO4KPj5W+si/xh0HWoo5IfLMzBFRc2OwWrWHa+Y50wXe19gwy3JI8QqJAC
+7miBBc3ZTy7M75di0XVrgvPQNFbTWX7Z032TzhsX3v0YS+ZQcneIYN3/XpUFYf7Y
+Md00HuFtYR6AcwU+OyLCNAdImw4GjaaBxE3pTV3f4QTNW4VushKqG829Tn5T6llJ
+rxFwsxGHD68vmc7padtt0FoUGpUvL9u/NmLhmf98uLlcTnkzYe7bS29AfUmybuFl
+nfZF/icUJIJd9qQ4AaxHVNq2AsGteXG2k2TspAZ71l4c2n9AFkdlRyQqi3cySYnE
+nybU+aa65kKqdP1+HtF1lVxc2NS7dQV5EHrfWitpm3Uoy7VOSD6jqiEElY9iO0Yv
+B9CeHFCbPbptH8KgQX9HQ1fvkjFHSqKRZUNcwSv9Ji2+QaeYeo9SiV+B/0h9BCq4
+TVCR9a8YM0TyVV9ohzPY5k9duZLKBlHz4LFbb6BS/m6YIgFfwvtFWQJnYm90K3li
+51oTqNv9omSxC0kv9GE1oLYSLOwkGZ8MFIUFteHBnk6HpIjJeWUdEqyJ5rzta1iQ
+/ZVAPy66/7hSXWCYMrkgOKUI2qH8OIk88d44z2DYaaFLiFH3Mbj8VtxWOno5xQMj
+Ko/6q5J6tjfawZ9V5zGxxb4xYAjCMzDszwIDAQABo0IwQDAdBgNVHQ4EFgQUe8DG
+ewTEZgzNMv+wb+HZUf0c7rcwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMC
+AQYwDQYJKoZIhvcNAQELBQADggPBAFizLQCOwnJb7ZGOPJhmauRhww/RUZgMZHk9
+AayKOH+v/IAxg4aoebkPGG0uOu8KwLEwOX6kPe1ONT6e8aMp3cwBHmJr7Vt3MbNM
+kR1pcCBEh+A3F6C6xOVXxZAa8h4NrKowEcPaHD86KLVtEqxFtmzwsrJu8FUzjikQ
+rJ5hrDXs7cfjUcKGUhB6nPYiXWVlGGK36W6+ZEbb3BVF6xpCRYPXqt1jJErtudU1
+hiciM2omSzIKFXUYGVjpa7SErACjeNOdfSU8XlF/AcqQ0UAr0kXhT/tujS7MBAc0
+B5HGjE+l5H3deA+wnQGdbokWbTqU3ThXvEnC4bWqVI/RixPbNS/RgF5F+1NgYdXD
+4ZwhYKODNOaevIZw/jaLNVUo4PSwge03WQ569qdmobY2RTCVyIDWQKkSv0exMwn6
+idSfwld1akfdhz+z0T0TvF6C6l863EY1Hh+DQBwdXro3GKN1L2CnhGebeRet+ypb
+2IRd8v/MgUwI5Bfst8+sTA+Rikz6ke0kOfkEOhiwscNX7Zvxz6u/B/FS71feCnbn
+5MRfaZNxDNQ/IxJVjD3mebM8XoasH15/7JbY2k3JQDLutctuhidJReaJMID6uu8h
+QpK6+KdRFmEEE9qHrMWcwBlVgC1KMrswEgtJFeweWyPU0qNOxiIZvOK6I2eITFTQ
+vxBhkdnr99e8ie6DDaMsgaTCOFjDULf+P/K8ovBSnQQfwoW91gZ3MHuQPSmS3EGp
+QEu7fLeRB2UrA6/koBirpXYAvBDoIUHH11OAQSFnr/7RnRRMqX4WHUthpPSx6Ij+
+xPFgPm3VqZAUPpVdffB7Hq9fgGOozrGnobKaEPfZ5wD6M9dhyTWxwslgC6UdCKiy
+HVYVuLleNrPfanZsXp2n5VTcGmzDNPLCxu56aEmjQdZUNHjJK9LSUpQjNdfEv8bg
+IRhPenq+6Ks0+vdNGks8N+lfHHaxbZZw9fXbtBW6LHElgLOYStMajQ5pJN7jDDhk
+gm5U0XRH5eVpscEEEnKKP3HAn9zbug7oPVJKI1YEm4zrT2IZf/W9HkjZf4mEPI31
+ZyHWge5azfrCU2Cglx6AotyWieaZ2Z1II6AHmgIGKQTrA3kGa6BBmNKPLbTjy8Je
+eHShkinJfQcDyj+M9XHwxH1qG6wzN08DVERGtnYcVYp9e+VYTqn44f5786L45jvg
+C11HqLeq+PPAZbDkHCKPnrnRj6ZKpChvbCcxSVjATYA74+IiquxOuqUNnrgXjGtO
+LTdqzPMtDWs0tADrzjEOpcSFzR4WCw==
+-----END CERTIFICATE-----

modules/ooklaserver/default.nix

@@ -0,0 +1,169 @@
+{ config, lib, pkgs, ... }: 
+let
+  cfg = config.kyouma.ooklaserver;
+in {
+  options = {
+    kyouma.ooklaserver = let 
+      inherit (lib) mkOption types;
+    in {
+      enable = lib.mkEnableOption "ookla speedtest server";
+      package = lib.mkPackageOption pkgs "ooklaserver" {};
+      domain = mkOption {
+        description = "Domain to use.";
+        default = null;
+        type = with types; nullOr nonEmptyStr;
+      };
+      openFirewall = mkOption {
+        description = "Whether to open the firewall for the specified ports.";
+        default = false;
+        type = types.bool;
+      };
+      tcpPorts = mkOption {
+        description = ''
+          The server listens on TCP port 5060 and 8080 by default. These ports are required for
+          speedtest.net servers, although more can be added.
+        '';
+        default = [ 5060 8080 ];
+        type = with types; listOf port;
+      };
+      udpPorts = mkOption {
+        description = ''
+          The server listens on UDP port 5060 and 8080 by default. These ports are required for
+          speedtest.net servers, although more can be added.
+        '';
+        default = [ 5060 8080 ];
+        type = with types; listOf port;
+      };
+      settings = mkOption {
+        description = ''
+          OoklaServer configuration written as Nix expression.
+          Comma seperated values should be written as list.
+        '';
+        default = {};
+        type = with lib.types; let 
+          valueType = nullOr (oneOf [
+            bool
+            int
+            str
+            (attrsOf valueType)
+            (listOf (oneOf [ port str ]))
+          ]);
+        in valueType;
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    security.acme.certs.${cfg.domain} = {
+      reloadServices = [ "ooklaserver.service" ];
+      webroot = "/var/lib/acme/acme-challenge";
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedUDPPorts = cfg.udpPorts;
+      allowedTCPPorts = cfg.tcpPorts;
+    };
+
+    kyouma.ooklaserver.settings = let
+      inherit (lib) mkDefault;
+    in {
+      OoklaServer = {
+        inherit (cfg) tcpPorts udpPorts;
+        enableAutoUpdate = false;
+        ssl.useLetsEncrypt = false;
+        useIPv6 = mkDefault true;
+        allowedDomains = mkDefault [ "*.ookla.com" "*.speedtest.net" ];
+        userAgentFilterEnabled = mkDefault true;
+        workerThreadPool = {
+          capacity = mkDefault 30000;
+          stackSizeBytes = mkDefault 102400;
+        };
+        ipTracking = {
+          gcIntervalMinutes = mkDefault 5;
+          maxIdleAgeMinutes = mkDefault 35;
+          slidingWindowBucketLengthMinutes = mkDefault 5;
+          metricTopIpCount = mkDefault 5;
+          maxConnPerIp = mkDefault 500;
+          maxConnPerBucketPerIp = mkDefault 20000;
+        };
+        clientAuthToken.denyInvalid = mkDefault true;
+        websocket.frameSizeLimitBytes = mkDefault 5242880;
+        http.maxHeadersSize = mkDefault 65536;
+      };
+      openSSL.server = {
+        certificateFile = "/run/credentials/${config.systemd.services.ooklaserver.name}/cert.pem";
+        privateKeyFile = "/run/credentials/${config.systemd.services.ooklaserver.name}/key.pem";
+        minimumTLSProtocol = mkDefault "1.2";
+      };
+      logging.loggers.app = {
+        name = mkDefault "Application";
+        channel = {
+          class = mkDefault "ConsoleChannel";
+          pattern = mkDefault "[%p] %t";
+        };
+        level = mkDefault "information";
+      };
+    };
+
+    systemd.services.ooklaserver = let 
+      configFile = let
+        anyToString = arg: if (lib.isBool arg) then
+          lib.boolToString arg
+        else if (lib.isList arg) then 
+          lib.concatStringsSep "," (map (val: toString val) arg)
+        else toString arg;
+      in
+        with lib; lib.pipe cfg.settings [
+        (mapAttrsRecursive (path: val: "${concatStringsSep "." path} = ${anyToString val}"))
+        (collect isString)
+        (concatLines)
+        (pkgs.writeTextDir "bin/OoklaServer.properties")
+      ];
+      packageWithCfg = pkgs.symlinkJoin {
+        name = "${cfg.package.name}-with-config";
+        paths = [ cfg.package configFile ];
+      };
+    in {
+      description = "Ookla speedtest server daemon";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        Restart = "always";
+
+        User = "ooklaserver";
+        Group = "ooklaserver";
+        DynamicUser = true;
+
+        LoadCredential = [
+          "cert.pem:${config.security.acme.certs.${cfg.domain}.directory}/cert.pem"
+          "key.pem:${config.security.acme.certs.${cfg.domain}.directory}/key.pem"
+        ];
+        ExecStart = "${packageWithCfg}/bin/OoklaServer"; 
+        WorkingDirectory = packageWithCfg;
+        SyslogIdentifier = "ooklaserver";
+
+        ReadOnlyPaths = [ packageWithCfg ];
+        RestrictSUIDSGID = true;
+        RestrictNamespaces = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectSystem = "strict";
+        ProtectHome = true;
+        ProtectProc = "invisible";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "@system-service";
+        SystemCallErrorNumber = "EPERM";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+      };
+    };
+  };
+}

modules/restic/default.nix

@@ -0,0 +1,72 @@
+{ config, lib, options, pkgs, ... }: let
+  cfg = config.kyouma.restic;
+in {
+  options.kyouma.restic = let
+    inherit (lib) mkOption types;
+  in {
+    inherit (options.services.restic.backups.type.getSubOptions [])
+      timerConfig backupPrepareCommand backupCleanupCommand;
+    enable = lib.mkEnableOption "Enable restic backup";
+    paths = mkOption {
+      description = "paths to backup";
+      type = with types; listOf path;
+      default = [];
+    };
+    pruneOpts = mkOption {
+      description = "paths to backup";
+      type = with types; listOf str;
+      default = [
+        "--keep-hourly 24"
+        "--keep-daily 14"
+        "--keep-weekly 8"
+        "--keep-monthly 12"
+      ];
+    };
+    remote = mkOption {
+      description = "restic remote to use";
+      type = types.nonEmptyStr;
+      default = "zh3485.rsync.net";
+    };
+    remoteUser = mkOption {
+      description = "remote ssh user";
+      type = types.nonEmptyStr;
+      default = "";
+    };
+    user = mkOption {
+      description = "user who runs the backup job";
+      type = types.nonEmptyStr;
+      default = "root";
+    };
+    repo = mkOption {
+      description = "restic repo";
+      type = types.nonEmptyStr;
+      default = "${config.networking.hostName}-backup";
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    sops.secrets."restic/${cfg.remoteUser}/password" = {
+      sopsFile = ../../secrets/restic/${cfg.remoteUser}.yaml;
+    };
+    sops.secrets."restic/${cfg.remoteUser}/id_ed25519" = {
+      sopsFile = ../../secrets/restic/${cfg.remoteUser}.yaml;
+    };
+
+    services.restic.backups."${config.networking.hostName}-${cfg.remote}" = {
+      inherit (cfg) paths user pruneOpts timerConfig backupPrepareCommand backupCleanupCommand;
+      initialize = true;
+      repository = "sftp:${cfg.remoteUser}@${cfg.remote}:${cfg.repo}";
+      passwordFile = config.sops.secrets."restic/${cfg.remoteUser}/password".path;
+      extraBackupArgs = [
+        "--compression=max"
+        "--pack-size=128"
+        "--read-concurrency=8"
+      ];
+      extraOptions = let
+        knownHost = pkgs.writeText "${cfg.remote}-known-host" (builtins.readFile ./${cfg.remote}/ssh_host_ed25519_key.pub);
+        sshKey = config.sops.secrets."restic/${cfg.remoteUser}/id_ed25519".path;
+      in [
+        "sftp.command='ssh ${cfg.remoteUser}@${cfg.remote} -i ${sshKey} -o UserKnownHostsFile=${knownHost} -s sftp'"
+      ];
+    };
+  }; 
+}

modules/restic/zh3485.rsync.net/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+zh3485.rsync.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJtclizeBy1Uo3D86HpgD3LONGVH0CJ0NT+YfZlldAJd

pkgs/akkoma-admin-fe/default.nix

@@ -0,0 +1,7 @@
+{
+  akkoma-frontends 
+}:
+
+akkoma-frontends.admin-fe.overrideAttrs {
+  patches = [ ./disable-options.patch ];
+}

pkgs/akkoma-admin-fe/disable-options.patch

@@ -0,0 +1,12 @@
+diff --git a/config/prod.env.js b/config/prod.env.js
+index 7acb93a2..ea500e99 100644
+--- a/config/prod.env.js
++++ b/config/prod.env.js
+@@ -2,6 +2,6 @@ module.exports = {
+   NODE_ENV: '"production"',
+   ENV_CONFIG: '"prod"',
+   BASE_API: '"https://api-prod"',
+-  DISABLED_FEATURES: '[""]',
++  DISABLED_FEATURES: '["settings","media-proxy-cache","relays"]',
+   ASSETS_PUBLIC_PATH: '/pleroma/admin/'
+ }

pkgs/akkoma-fe-domi/default.nix

@@ -0,0 +1,53 @@
+{
+  akkoma-frontends,
+  fetchFromGitea,
+  fetchYarnDeps
+}: 
+akkoma-frontends.akkoma-fe.overrideAttrs (let
+  src = fetchFromGitea {
+    domain = "git.sakamoto.pl";
+    owner = "domi";
+    repo = "akkoma-fe";
+    rev = "5f0339ce005ccb12365128089edb5fd77f60841b";
+    hash = "sha256-AHmJyOFmQZXmNMMsp8ONm9Itns1H/idEKl8+sxn2RSA=";
+  };
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    hash = "sha256-7WB6nmxNckMdftKds2OgD2kClvCCT/I5vmthV0jrkSs=";
+  };
+in {
+  version = "unstable-2024-07-20";
+  pname = "akkoma-fe-domi";
+  inherit src offlineCache;
+  postPatch = ''
+    # Build scripts assume to be used within a Git repository checkout
+    substituteInPlace src/modules/instance.js \
+      --replace-fail "widenTimeline: true" 'widenTimeline: "50%"' 
+
+    substituteInPlace src/modules/config.js \
+      --replace-fail "streaming: false" "streaming: true" \
+      --replace-fail "useStreamingApi: false" "useStreamingApi: true" \
+      --replace-fail "webPushNotifications: false" "webPushNotifications: true" \
+      --replace-fail "postLanguage: undefined" 'postLanguage: "en"'
+
+    substituteInPlace src/i18n/en.json \
+      --replace-fail "meow" "florp" \
+      --replace-fail "Meow" "Florp"
+
+    sed -E -i '/^let commitHash =/,/;$/clet commitHash = "${builtins.substring 0 7 src.rev}";' \
+      build/webpack.prod.conf.js
+  '';
+
+  configurePhase = ''
+    runHook preConfigure
+
+    export HOME="$(mktemp -d)"
+
+    yarn config --offline set yarn-offline-mirror ${offlineCache}
+    fixup-yarn-lock yarn.lock
+
+    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
+
+    runHook postConfigure
+  '';
+})

pkgs/build-worker-oci/ams/fly.toml

@@ -0,0 +1,158 @@
+app = 'build-worker-kyoumanet'
+primary_region = 'ams'
+
+[build]
+  image = 'registry.fly.io/build-worker-kyoumanet:latest'
+
+[processes]
+  bw-00 = '/entrypoint.sh'
+  bw-01 = '/entrypoint.sh'
+  bw-02 = '/entrypoint.sh'
+  bw-03 = '/entrypoint.sh'
+  bw-04 = '/entrypoint.sh'
+  bw-05 = '/entrypoint.sh'
+  bw-06 = '/entrypoint.sh'
+  bw-07 = '/entrypoint.sh'
+  bw-08 = '/entrypoint.sh'
+
+[[mounts]]
+  source = 'bw00'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-00']
+
+[[mounts]]
+  source = 'bw01'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-01']
+
+[[mounts]]
+  source = 'bw02'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-02']
+
+[[mounts]]
+  source = 'bw03'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-03']
+
+[[mounts]]
+  source = 'bw04'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-04']
+
+[[mounts]]
+  source = 'bw05'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-05']
+
+[[mounts]]
+  source = 'bw06'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-06']
+
+[[mounts]]
+  source = 'bw07'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-07']
+
+[[mounts]]
+  source = 'bw08'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-08']
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-00']
+
+  [[services.ports]]
+    port = 2200
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-01']
+
+  [[services.ports]]
+    port = 2201
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-02']
+
+  [[services.ports]]
+    port = 2202
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-03']
+
+  [[services.ports]]
+    port = 2203
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-04']
+
+  [[services.ports]]
+    port = 2204
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-05']
+
+  [[services.ports]]
+    port = 2205
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-06']
+
+  [[services.ports]]
+    port = 2206
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-07']
+
+  [[services.ports]]
+    port = 2207
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-08']
+
+  [[services.ports]]
+    port = 2208
+
+[[restart]]
+  policy = 'never'
+
+[[vm]]
+  size = 'performance-16x'
+  memory = '96GB'

pkgs/build-worker-oci/cdg/fly.toml

@@ -0,0 +1,67 @@
+# fly.toml app configuration file generated for build-worker-kyoumanet-cdg on 2024-11-21T00:31:54+01:00
+#
+# See https://fly.io/docs/reference/configuration/ for information about how to use this file.
+#
+
+app = 'build-worker-kyoumanet-cdg'
+primary_region = 'cdg'
+
+[build]
+  image = 'registry.fly.io/build-worker-kyoumanet:latest'
+
+[processes]
+  bw-09 = '/entrypoint.sh'
+  bw-10 = '/entrypoint.sh'
+  bw-11 = '/entrypoint.sh'
+
+[[mounts]]
+  source = 'bw09'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-09']
+
+[[mounts]]
+  source = 'bw10'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-10']
+
+[[mounts]]
+  source = 'bw11'
+  destination = '/mnt/data'
+  initial_size = '256GB'
+  processes = ['bw-11']
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-09']
+
+  [[services.ports]]
+    port = 2209
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-10']
+
+  [[services.ports]]
+    port = 2210
+
+[[services]]
+  protocol = 'tcp'
+  internal_port = 2222
+  auto_stop_machines = 'off'
+  processes = ['bw-11']
+
+  [[services.ports]]
+    port = 2211
+
+[[restart]]
+  policy = 'never'
+
+[[vm]]
+  size = 'performance-16x'
+  memory = '96GB'

pkgs/build-worker-oci/default.nix

@@ -0,0 +1,100 @@
+# I hate this so much aaa
+{
+  callPackage,
+  dockerTools,
+  openssh,
+  bash,
+  gnused,
+  util-linux,
+}:
+
+dockerTools.buildLayeredImage {
+  name = "build-worker-oci";
+  tag = "latest";
+
+  fromImage = callPackage ./source.nix {};
+
+  maxLayers = 110;
+
+  passthru.updateScript = ./update.sh;
+
+  enableFakechroot = true;
+
+  contents = [ openssh util-linux bash gnused ];
+
+  config.Cmd = [ "/entrypoint.sh" ];
+
+  fakeRootCommands = ''
+    mkdir -p /root
+    cat <<EOF > /root/nix.conf
+    build-users-group = nixbld
+    experimental-features = nix-command flakes
+    sandbox = true
+    substituters = https://cache.kyouma.net https://cache.nixos.org
+    trusted-public-keys = cache.kyouma.net:Frjwu4q1rnwE/MnSTmX9yx86GNA/z3p/oElGvucLiZg= cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
+    max-substitution-jobs = 20
+    max-silent-time = 14400
+    min-free = ${builtins.toString (49152 * 1024 * 1024)}
+    max-free = ${builtins.toString (65536 * 1024 * 1024)}
+    system-features = benchmark big-parallel kvm nixos-test uid-range gccarch-x86-64 gccarch-x86-64-v2 gccarch-x86-64-v3
+    EOF
+
+    mkdir -p /root/.ssh
+    cat <<EOF > /root/.ssh/authorized_keys
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA/+iN407+HsfHbbC3tfdA8Yf4TZ08qXQMb4tb/SDAs+ emily@card
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK397sBHLS66snWNPtmjUy7qZxRJh54N0RRXogKODudl nix@muon
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/vCXM3IaxJP9v2Y+xcQrQD2IcffgdzqtWhpMjj9Xl5 hydra@seras
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICT0dGyLUjxFnvqUmex+5xUGQ7D4yGHKo267JgApcq0k root@ryuuko
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIDTwCSWYODyvTJxwB6Rahuy0j6s/YYwtQta8bjzG/We root@ryuuko-arch
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM/RmFnel8pcZT9nh7EAfKfAekt3BoEXy0G7G2GTacN/ aprl@computer
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxsX+lEWkHZt9NOvn9yYFP0Z++186LY4b97C4mwj/f2 aprl@whatever
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOpyVefbZLkNVNzdSIlO6x6JohHE1snoHiUB3Qdvl5I2 aprl@idk
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDVNo871p97NTefP52KYiwuch+FaVScxvcFd9fg0yykySTq7Y5JsxrJQgTnox/oDa0O87OyHD/GHQljAXkqiHpDkExbiGjDmGXJSKReKH061F4FqBnDIwYRzUu9Cxjl4MNqsU0RqLaz4+F42c/L7GROQwjEPUb8JHThRiI5FJnDvvB+oBLBxeyQA4v3O4i8DaDQayTr/XB+aSlhNwKrb6cjjL93AHT1uE53yY5jn4kZX+RiPQhH7rvt9N6E4Yr3CG6nUgRCUS0L66d9yfrq0XAbAVk9F+viV7Nk9qy4MWHtXZ4h0qUlzrGALPgGsCGiLGd4NvEgeCcV4nvxdmevxTSdKlJP75xlmlLVXGyhqCZkTsxm/png2UvDl+p0pLyrgNaNoXPdE0Jbv7C28WX36Nast1QFSMUhexzuOx8OgaOioeXVfK98AouqWb58iPBCvgreUIH/gJhZcnlB/Foo1KSO+fJNH8hAsLH7w0mnKyHhJjkrjjwUqsnpepB3SOLfZTE= aprl@meow
+    ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQD0v3tUBNEUxfoOQBFb+N2DUBQDay0iFggUWa9Nd+BtFLOKkz+RRto3eBF0ZiJZVUxv/hLb8m2s45hcMw8agwuPrXMe5085T1fzkvPdKAPZdsT/cCmBi1OsoLjAKBFIdM4lcV0A2cca8hip+/ZPpjFPUWx73/672gAPHU7co7fP8+8CSf9dx+WIeLx3yaYHYZ/th3dB5auX3VjOazS8MojsAorwTUeBoPamHQ5dFeNafhFUL/hhtGkUI1cNHUn3bJd2V7AKTW3UglK7hVgMJPrzVS31OlpcJEf6S5XgKTWdOSwubn1bs5Lt6YYRDU24NV6CGrwKgCJSRxzNMLwpnFKiSXpO8FzkqWHYWyju141hQcFF31aZIV+7YcwEt5ZukLjFOpVtpbSXvJYigOUzGi34P3/OAGshDXjTQjvM8GIir49gx3b2Nwhg0z4UHBkAKZvDDFPHDMJoclvnhITojaAojfC9zmMCO5ZaEsk8yv7c/lWQumzRpfldWF4mwHvhD5kTADbhRdO7WTdX7AaiAYINooToeWKjFe2wn3rFubPUppptqtP03mmvs7vhhgnEVBbGZRJK3GTVk1XcsfF9rDKzewSa+wb4LsBoZtFRhc8cJqHGlKWSNk7dQ04B1atPyNLKGpGoo/UIPxyZ6bSqFVxY3nhz46VZ6z8XWI48z0/fRQ== aprl@uwu
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAAl3/krXJeCcDEJXRuzOdCOrJLG7b6MRqC+a9Xux3mW vika@hydrangea
+    ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQjTy9qqHcs5vgTz+iMAiNNMqdyGtOhEpnpJCReEFfZ vika@rafflesia
+    sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAINAgFdk78I4zssUGsAIV01zefLBpwc1W7hfTobbG80XLAAAABHNzaDo= vika@nitrokey
+    EOF
+
+    cat <<EOF > /root/.ssh/environment
+    PATH=/root/.nix-profile/bin:/nix/var/nix/profiles/default/bin:/nix/var/nix/profiles/default/sbin
+    EOF
+
+    cat <<EOF > /root/sshd_config
+    AcceptEnv GIT_PROTOCOL
+    AuthenticationMethods publickey
+    AuthorizedPrincipalsFile none
+    Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
+    GatewayPorts no
+    HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,sk-ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com
+    KbdInteractiveAuthentication no
+    KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org
+    LogLevel INFO
+    Macs umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
+    PasswordAuthentication no
+    PermitRootLogin prohibit-password
+    PermitUserEnvironment yes
+    PrintMotd no
+    PubkeyAcceptedAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519,sk-ssh-ed25519-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com
+    StreamLocalBindUnlink yes
+    StrictModes yes
+    UseDns no
+    UsePAM no
+    X11Forwarding no
+    Banner none
+    AddressFamily any
+    Port 2222
+
+    Subsystem sftp ${openssh}/libexec/sftp-server
+    AuthorizedKeysFile %h/.ssh/authorized_keys /etc/ssh/authorized_keys.d/%u
+    HostKey /mnt/data/ssh/ssh_host_ed25519_key
+    EOF
+    
+    mkdir -p /etc/keys
+    mkdir -p /var/empty
+    mkdir -p /var/log
+
+    cp ${./entrypoint.sh} /entrypoint.sh
+    chmod +x /entrypoint.sh
+  '';
+}

pkgs/build-worker-oci/entrypoint.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+cat /etc/passwd > /root/passwd
+rm -f /etc/passwd
+cp /root/passwd /etc/passwd
+echo "sshd:x:498:65534::/var/empty:/run/current-system/sw/bin/nologin" >> /etc/passwd
+cat /etc/shadow > /root/shadow
+rm -f /etc/shadow
+cp /root/shadow /etc/shadow
+/bin/sed -i "s/root:!/root:*/g" /etc/shadow
+
+[[ ! -d "/mnt/data/ssh" ]] && mkdir -p /mnt/data/ssh
+if [[ "$(ls /mnt/data/ssh/*_key)" = "" ]]; then
+  ssh-keygen -t "ed25519" -f "/mnt/data/ssh/ssh_host_ed25519_key" -N ""
+fi
+
+[[ ! -d "/mnt/data/nix-store" ]] && mkdir -p /mnt/data/nix-store
+[[ ! -d "/mnt/data/workdir" ]] && mkdir -p /mnt/data/workdir
+[[ ! -d "/mnt/data/tmp" ]] && mkdir -p /mnt/data/tmp
+
+rm -rf /mnt/data/nix-store/*
+
+rm -f /etc/nix/nix.conf
+cp /root/nix.conf /etc/nix/nix.conf
+
+/bin/mount -t overlay overlay -o lowerdir=/nix,upperdir=/mnt/data/nix-store,workdir=/mnt/data/workdir /nix
+/bin/mount --bind /mnt/data/tmp /tmp
+
+/root/.nix-profile/bin/sshd -D -f /root/sshd_config

pkgs/build-worker-oci/source.nix

@@ -0,0 +1,11 @@
+{
+  dockerTools,
+}:
+
+dockerTools.pullImage {
+  imageName = "nixos/nix";
+  imageDigest = "sha256:133a1607deea14a02c2bc0850e275ed135814235a1147f68967afee261caea2b";
+  sha256 = "0602a59g14l1jiqfffz14hcp982qaqczi5f0ylvv0h9pp2pqrqs5";
+  finalImageName = "nixos/nix";
+  finalImageTag = "latest";
+}

pkgs/build-worker-oci/update.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p skopeo nix-prefetch-docker
+
+set -euo pipefail
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    *)
+      echo "Unknown option $1"
+      exit 1
+    ;;
+  esac
+done
+
+IMAGE=$(nix-prefetch-docker --image-name nixos/nix --image-tag latest --arch amd64 --os linux)
+
+cat > ./pkgs/build-worker-oci/source.nix << EOF
+{
+  dockerTools,
+}:
+
+dockerTools.pullImage ${IMAGE}
+EOF
+
+nix build .\#packages.x86_64-linux.build-worker-oci
+
+skopeo --insecure-policy copy docker-archive:"result" \
+  docker://registry.fly.io/build-worker-kyoumanet:latest --dest-creds x:"$(flyctl auth token)" --format v2s2
+
+rm "result"
+
+fly deploy

pkgs/librespeed-go/default.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+let
+  version = "1.1.5";
+  src = fetchFromGitHub {
+    owner = "librespeed";
+    repo = "speedtest-go";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-ywGrodl/mj/WB25F0TKVvaV0PV4lgc+KEj0x/ix9HT8=";
+  };
+in
+buildGoModule {
+  pname = "librespeed-go";
+  inherit version src;
+
+  vendorHash = "sha256-ev5TEv8u+tx7xIvNaK8b5iq2XXF6I37Fnrr8mb+N2WM=";
+
+  ldflags = [ "-w" "-s" ];
+
+  postInstall = ''
+    cp -r web/assets $out/
+  '';
+
+  meta = {
+    description = "A very lightweight speed test implementation in Go.";
+    homepage = "https://github.com/librespeed/speedtest-go";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ snaki ];
+    mainProgram = "speedtest";
+  };
+}

pkgs/librespeed-rust/default.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+let
+  # https://github.com/librespeed/speedtest-rust/pull/7
+  version = "unstable-2024-09-28";
+  src = fetchFromGitHub {
+    owner = "librespeed";
+    repo = "speedtest-rust";
+    rev = "a74f25d07da3eb665ce806e015c537264f7254c9";
+    hash = "sha256-+G1DFHQONXXg/5apSBlBkRvuLT4qCJaeFnQSLWt0CD0=";
+  };
+in
+rustPlatform.buildRustPackage {
+  pname = "librespeed-rust";
+  inherit version src;
+
+  cargoLock.lockFile = "${src}/Cargo.lock";
+
+  # error: linker `aarch64-linux-gnu-gcc` not found
+  postPatch = ''
+    rm .cargo/config.toml
+  '';
+
+  postInstall = ''
+    cp -r assets $out/
+  '';
+
+  meta = {
+    description = "A very lightweight speed test implementation in Rust.";
+    homepage = "https://github.com/librespeed/speedtest-rust";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ snaki ];
+    mainProgram = "librespeed-rs";
+  };
+}

pkgs/overlay.nix

@@ -2,4 +2,14 @@ final: prev: {
   nyastodon = final.callPackage ./nyastodon/default.nix {};
   upgrade-system = final.callPackage ./upgrade-system/default.nix {};
   update-nixfiles = final.callPackage ./update-nixfiles/default.nix {};
+  build-worker-oci = final.callPackage ./build-worker-oci/default.nix {};
+  librespeed-rust = final.callPackage ./librespeed-rust/default.nix {};
+  librespeed-go = final.callPackage ./librespeed-go/default.nix {};
+  akkoma-fe-domi = final.callPackage ./akkoma-fe-domi/default.nix {};
+  akkoma-admin-fe = final.callPackage ./akkoma-admin-fe/default.nix {};
+  nginxQuic = prev.nginxQuic.override { 
+    withSlice = true;
+    # Use zlib because zlib-ng uses larger buffers then nginx preallocates.
+    zlib = final.zlib;
+  };
 }

pkgs/update-nixfiles/update-nixfiles.sh

@@ -22,19 +22,37 @@ merge_theirs () {
 
 test_build () {
   local build_jobs
-  build_jobs="$(curl --fail -s -L -H "Accept: application/json" "${JOBSET_URL}/latest-eval" | jq -r ".builds | .[]")"
+
+  sleep 30
+
+  build_jobs="$(curl --fail -s -L -H "Accept: application/json" "${JOBSET_URL}/evals" | jq -r ".evals | max_by(.id) | .builds | .[]")"
   for build in ${build_jobs}; do 
     local build_status
+
     while true; do
       local build_finished
       build_finished="$(curl --fail -s -L -H "Accept: application/json" "${HYDRA_URL}/build/${build}" | jq -r ".finished")"
       [[ ${build_finished} == 1 ]] && break
       sleep 5
     done
+
     build_status="$(curl --fail -s -L -H "Accept: application/json" "${HYDRA_URL}/build/${build}" | jq -r ".buildstatus")"
-    [[ $build_status != 0 ]] && echo "Build ${build} failed" && exit 1
+    [[ $build_status != 0 ]] &&
+      echo "Build ${build} failed" &&
+      exit 1
     echo "Build ${build} was successful"
   done
+
+# Idk why this is broken someone should fix me
+#  local last_error
+#  local now
+#
+#  last_error="$(curl --fail -s -L -H "Accept: application/json" "${JOBSET_URL}" | jq -r ".errortime")"
+#  now="$(date +%s)"
+#
+#  [[ $last_error -gt $now ]] &&
+#    echo "Evaluation error encountered at $(date +%Y-%m-%d-%H:%M:%S --date="@${last_error}")" &&
+#    exit 1
 }
 
 wait_for_hydra () {
@@ -42,16 +60,18 @@ wait_for_hydra () {
   local hydra_rev
   local counter
   counter=0
-  git_rev="$(gitin rev-parse update-inputs)"
-  while true; do
-    hydra_rev="$(curl -s -L -H "Accept: application/json" "${JOBSET_URL}/latest-eval" | jq -r .flake | sed -E "s/.+&rev=(.*)/\1/g")"
+  git_rev="$(git -C "${1}/nixfiles" rev-parse update-inputs)"
+  while [[ $counter -lt 180 ]]; do
+    counter=$((counter +1))
+    hydra_rev="$(curl -s -L -H "Accept: application/json" "${2}/evals" | jq -r '.evals | max_by(.id) | .flake' | sed -E "s/.+&rev=(.*)/\1/g")"
     if [[ "${git_rev}" == "${hydra_rev}" ]]; then
       echo "Hydra got new commit"
       break
     fi
-    sleep 30
+    sleep 5
   done
-  if [[ $counter -ge 30 ]]; then 
+
+  if [[ $counter -ge 180 ]]; then
     echo "Hydra no workey"
     exit 1
   fi
@@ -87,7 +107,7 @@ gitin push origin update-inputs
 
 echo "Waiting for hydra to get new commit"
 export -f wait_for_hydra
-timeout 4h bash -c wait_for_hydra
+timeout 4h bash -c "wait_for_hydra ${ROOT} ${JOBSET_URL}"
 
 echo "Testing if all build jobs completed successfully"
 test_build

secrets/restic/zh3485s1.yaml

@@ -0,0 +1,35 @@
+restic:
+    zh3485s1:
+        password: ENC[AES256_GCM,data:lDDSSqUH3pewpMA+6SNwGwRz95MBjeaD6I3RWUQNBFXsw/W9RoIY85AcRXxCl7CW,iv:NFF6uCs2FolMe9cgPkoAFmbWdXG2SuVRtoOyQXouEAU=,tag:UeC49xFwFkMh0Wi8p9reFw==,type:str]
+        id_ed25519: ENC[AES256_GCM,data:fe2CAKWSrEOvEPZgGhbigw+DEnDUGtTXEj7nuGaH5enMGDvd7QtRlDYLkM+g9zKrRJ46e2nM6btUZVqqx4rJiUbjJ5B/cBzb259CTxKGgHeMj/cYXPypamIEKFwUrloxzrgxH5JIOoUvj9Ny1P1UPIB//B5Z1Uunqmdqd2XoiAtDwZ/hvyuOfdFyUkKmOnCdF4pheMRXZ6Z51N4f09OIwuZ/xC4LQYAVB2lyycOgrvefPA5YYabMd23yEXn6v/BiP1TWbSInTHvz6Rii2WYqYO3ORCfi1pvWe15kSrTsT9zYRzLvZi5TD+4FMhLmIttZB2OXK7X+h6cHtej7X+v6HKhMKHNJhukRUP7DpcZ0+ArBEdw2j+H7C4q8NdR9rk4we7WpdQlY7tGpJvEzSis+P/Jph/tkzx6xXpKiOeOAXgQUS41qcAy7gmZj7CdsulerUHcfDy4a0y1OEuDmoYW420cGGYOCB9BlvYQbaDhyv5AMSL8sMZfm7mX5qXliE7ZQc20ggKoY2MKH6RjnT8pQhMBWo/NW13PPBDIL,iv:1+aopW183ir5XHMKcDons24A/E61mLuyJGrQTRpPXdE=,tag:s1w+HZdktM0H9FUrz097Cw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age18vc8rcmczlt3r0ee7jr9s8l3yrkthu8wtypt08eh0eskpkw3dg6qxs7t3t
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQeWpKYktzVE1tMkpGU1c5
+            akZZdlBkeFQyUmUrOHZxTGE2V1FUVmV3cG5VCmZvTG1JTS9SUTk1aVl6TnBPQ1Fh
+            clRDTmQzQUJxWlYyV2dmVXNyTDJ2K0kKLS0tIHA3S0dsQzRxRWF4RFdSSzh1aXI5
+            ZFQvWFhZTndubkxaRVh3YXl0V25ZcUEK0/wV9i01kRkphrseSBqAL9f8tUlUtJDO
+            PUZL2Em/QjNEnXJaxxR612ONA94ptK9bsqzRJV5RtGqDwd+oAnr13Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-08T13:41:02Z"
+    mac: ENC[AES256_GCM,data:tMatUcv/jbvQ1URp6DrUyuiB9+rgCCdOxEVcM0NBiV5P9DGWE1hWytky4yPE9nFUOWLI7m4nTSEXHuT4yT3LkBd1Ndzhm5wQ0NEAVnZ6Sj7YOQI5CS1q95sviJBv57PBkaajHDNeSJX2hEQeR4qJFUR4fu0hIwadyzeunP/kfKE=,iv:gXRAg4cN43ocQMZm0lL8AnrbDtK+TKGchWpd/TYhnjA=,tag:+HqYuDWjoTdv+CWrJmuwxA==,type:str]
+    pgp:
+        - created_at: "2024-11-08T13:31:55Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D1GtNSlou/HkSAQdALVqRZ2qzjR86mEE/MHAR5H3gmIukchY/NSvGg1Ggfmsw
+            uZhnl5puGOO579ItHXbk+BYwBS2koL7jyhnX8E9zmM3d3SZHwzx0mk79fr2jLFj6
+            0l4BLrhhcpUtzfje4/SeTgWFRIA68ON/PUTmW2Lgclh9OpQfbbousFS/JMvvdHaT
+            /3uJEww5MKMPlqWqK7w7z6iwIITRKH0vzQoIZ3hVcDKtKOJrJ/1bWcJorFsazxvT
+            =KZPf
+            -----END PGP MESSAGE-----
+          fp: B04F01A7A98A13020C39B4A68AB7B773A214ACE5
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

secrets/restic/zh3485s2.yaml

@@ -0,0 +1,35 @@
+restic:
+    zh3485s2:
+        password: ENC[AES256_GCM,data:GAesjt8CMFKuZk30vJTS7kH0cSg/p6NQCOU9udcVbVCurnUdqjKqZp97KnCcmA/A,iv:bf7trphHgzFzI3Pza8dDOgmKcHsBURsXEHtw0KpGQ7s=,tag:zE1WXaptcqBQMqgk+6SRqQ==,type:str]
+        id_ed25519: ENC[AES256_GCM,data:hRViIdnq9VNjjqD/X6tERHsCAuxF723bh+oES/Va5KVBJdsEK2LYXWxRQV6/dpYGnmSBNJ2q4eJS0iz2kjfNUTXg1DQZ0uuxSDbhOcKQ+ksE99VrU3Go7196gXQ+rsCuRht6vzgGzIoTcMVDlA+lvJ2EAB0o7EhK4qcKI0pRHziy4/i0JgLJKc2Xw7WwAZajyUToRrroi+oh3LRJiN0+L3B13RWNBDMxfVgSH5KERhPjU40VteKNyXg9YnZxiqRMTmDmpAu/fogXwIDgnfRuWBoDgPsHeSWVN/0IpfEegoXnmdYUGk9vKQmXNJ5z7vj6oIaz8Zuk9PfPaKZHrsUGkPZqBJydvfcUpH74+sn3idDJdQ92mYIn6rorabt6QtN9bbtULmtOU/R7wvZkRSn3SmvR6uo/xShs1pkwGa1oidn8atfoMMYnR973wvuGlDZwFGy0ZJD+Mc108U7o0U153/MervsxxZ3eIpzgmRol+TjoSJINQoPNPHsj6nx65MNfJd+AFw35h5jKUag4xKaPXS5ew/wDCqZ1PFYG,iv:P8VtAFoL0CcO7m7S60JardB95MUWYiABDOUZhLhXEzo=,tag:fLniekA0lMx6wW3u4NZPKQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1sky8kccyyxe79ws4rew42r94427v2xnphq2vtxvdlw5xl7yzgs2q599yzs
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByUnFUQlhzYTdyblNOWUt3
+            V0daclVOZ0hlSmlJTHlKRDd5eThVSzVOVWh3CkpiaGNJd0hCMlk3MVdsdnY0TVJM
+            MEtKUXFnSlAwQ0kzd1M0eVA1WG1Bb2sKLS0tIFAvVklzZldkOFpCNHV4YnQ2SDA3
+            OW5TcVlqV0p4RThBRGlyaHkreEFMY28KPdgR9WCByJaLZcNophcfW7+7NU9MuI3E
+            bfWEFgqZLTdAg8y7s/M6ZAyjciflclxVnY8mTIhnERD+ZHHi++z1XA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-13T12:51:05Z"
+    mac: ENC[AES256_GCM,data:t/gg9SqDfrU+eKU9yw2R7ahLQY6pTgsRVFNk7K+zxTBiqUG2Rx0wm0bclkrkSKeHAVSJkc8OOWJvvRCMxaE980mknPM6721xNDV90Pt0ZsJvFXdOYKIaPQHC29klJKO60lsMsuup3BiF94O8+wIavLvYuc3jKFcaA4b9xAPRveM=,iv:TJhR1NzPVYIysghFAbjWB5lBpMhhkvwJdszkWGSLDPI=,tag:TCnewzN2qwFyG4Xio2JatQ==,type:str]
+    pgp:
+        - created_at: "2024-11-13T12:49:09Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D1GtNSlou/HkSAQdArN4L/MZSZoKwk/RKgA56OQMyt7IhW15qa7+Utie4/TQw
+            0xKauGLJEMp7cnpmEvpBW8sy3hZRj1K4vLv2NKHzoXBuWGBer1Hf+CDZJ71ta6J9
+            0l4B9f4L9AIRHO3ncb4IPyVprr+sFyhVJJAI7bo9mbFUqH0yfM5EmFiXWg5d9zO6
+            NfXbbfpW4ISEXFa//SuVl3h/HHxwDd83qA13OnhrlCjjwPfdA32kKM3CS/81JHNd
+            =4L7O
+            -----END PGP MESSAGE-----
+          fp: B04F01A7A98A13020C39B4A68AB7B773A214ACE5
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

secrets/services/akkoma.yaml

@@ -0,0 +1,35 @@
+services:
+    akkoma:
+        mailerPassword: ENC[AES256_GCM,data:kNep5V0HVr17bEIY2/AbwRUPqkfHKf9xnOnYi5sMJ+STWjVrQf+AzdueJTAf9Nym,iv:Usmu0uM5ev60Ui8h9zLUcDDJIHNSxAFtMq5LyLwmAsA=,tag:fNIhB8LGJwWO3zzQWgm68A==,type:str]
+        deepl: ENC[AES256_GCM,data:JVJkCm6UFUlownU/oRTmZ5o85mPv935Hj56JcXCt3PwNmx1kQbyj,iv:UzvGgVter1/9U8g/HQ2FfWNviD0KgWRLnW9fzgfGDag=,tag:q65bd26xFQ6Av71hy8u2fA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age18vc8rcmczlt3r0ee7jr9s8l3yrkthu8wtypt08eh0eskpkw3dg6qxs7t3t
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1NGRYOHFVSXBNdjlpVDhF
+            V0g2ZkRiZnR6UElvWEZKUWxHSjZySlJadHlvCmpBdzBPRklkOVltZWwzNlNrc0pC
+            bG9kU3phNmFKNGkwek94Y2hZcjZCNW8KLS0tIFFqM0VTQXRuODAva0Rkc2xvWFB4
+            VTQ3RExKY093VG8vOThCczRzY2tpY2cKJOv0yVl9Zody0mjtytyjCXpe5V3NsReA
+            /Dqr6V9Hjuf3u0fjMHAjE6hDPGVH5t5NYLkNDeaGHNTaAd5dnhfprg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-10-31T16:57:58Z"
+    mac: ENC[AES256_GCM,data:VJpsLBdnle6bP6ALxLS2eTOEbiHJbNc5D+pvsoJulI9VODtBk0p1VvJv9ilToxh4oiwctMmCKSO4R9NyuZUqoqwwlYtW6tFDITBA2eg/iu/uQjcuuKLC+fFGdtnTpZcShUyMds3qi8Z8Iegk2sSMLk5QXCE2QhMUQ50VN4TXF2c=,iv:rOF34iqckOJMAVm+3RDSdlrJh4hgnyiTut3SM1e0w0E=,tag:cMjMkKkN8UFWGQqQfWBUnA==,type:str]
+    pgp:
+        - created_at: "2024-11-04T20:52:58Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4D1GtNSlou/HkSAQdApk/nEYcccQBCzFwC+hZbMio0s37LJuK6ceSLW786Sjsw
+            90ggzfOg63e92cyqYxvbKqtCgVHHU/9RmKdsSZM+rFcR3XpzWw0ke10WjZNW0lU5
+            0l4BuP1sPvP7Z+kxWlITnYl4SPKxVhSmYtAdGbceiGUo36jtpi9vkziuPmyrGttM
+            t1PNZ9gjGVyNw96rRg9bgXCSvJo2FfMx8GeArj1yuO3+bkkbDm7mFrbF6fMQN3JE
+            =Q9iO
+            -----END PGP MESSAGE-----
+          fp: B04F01A7A98A13020C39B4A68AB7B773A214ACE5
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1