i can't remember what caused this...

.direnv/bin/nix-direnv-reload

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+dir="$(realpath $(dirname ${BASH_SOURCE[0]})/../..)"
+_nix_direnv_force_reload=1 direnv exec "$dir" true
+direnv reload
+# direnv reload updates the mtime of .envrc. Also update the timestamp of the
+# profile_rc file to keep track that we actually are up to date.
+touch $dir/.direnv/{nix,flake}-profile-*.rc
+

.envrc

@@ -0,0 +1,2 @@
+export HE_PASSWORD=SuperDuper
+use flake

flake.lock

@@ -451,11 +451,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1704874635,
+        "lastModified": 1710420202,
-        "narHash": "sha256-YWuCrtsty5vVZvu+7BchAxmcYzTMfolSPP5io8+WYCg=",
+        "narHash": "sha256-MvFKESbq4rUWuaf2RKPNYENaSZEw/jaCLo2gU6oREcM=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "3dc440faeee9e889fe2d1b4d25ad0f430d449356",
+        "rev": "878ef7d9721bee9f81f8a80819f9211ad1f993da",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,5 +1,5 @@
 {
-  description = "Your new nix config";
+  description = "Sealight NixOS Config";
 
   inputs = {
     # Nixpkgs
@@ -271,6 +271,7 @@
           hostname = "mossnet.lan";
           autoRollback = false;
           magicRollback = false;
+          remoteBuild = true;
           profiles.system = {
             user = "root";
             path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.box;

home/core/default.nix

@@ -1,7 +1,6 @@
 { self, pkgs, ... }:
 {
   imports = [
-    ../profiles/nvim
     ../profiles/cli
     ../profiles/direnv
     ../profiles/git

home/gui/default.nix

@@ -2,6 +2,7 @@
 {
   imports = [
     ../core
+    ../profiles/nvim
     ../profiles/firefox
     ../profiles/desktop
     ../profiles/email

home/profiles/cli/default.nix

@@ -26,10 +26,12 @@
     iftop
     wget
     curl
-    exa
+    eza 
     bat
     fd
     ncdu
+    du-dust 
+    # dia-cli
     duf
     trash-cli
     nix-index
@@ -216,9 +218,9 @@
     gen-secret = "< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c\${1:-32};echo;";
 
     # modern cli tools 
-    ls = "exa --icons";
+    ls = "eza --icons";
-    l = "exa -l --icons";
+    l = "esa -l --icons";
-    la = "exa -la --icons";
+    la = "eza -la --icons";
     tree = "ls --tree --icons";
     cat = "bat";
     unzip = "aunpack";
@@ -229,14 +231,17 @@
     make-secret = "< /dev/urandom \\tr -dc _A-Za-z0-9 | head -c \${1:-32};echo;";
 
     # task warrior
-    # TODO: make blocked a context?
     t = "task -BLOCKED -idea -backlog"; 
+    tw = "t rc.context:work";
+    # TODO find a reasonable way to manage this from a non-nix managed file in ~/.task/context or something
+    # we can do something like task rc.context:$(cat ~/.task/context) to read context
+    # and write a little script make-context = cat $@ > ~/.task/context or something
     tt = "taskwarrior-tui -r list";
     ti = "task +idea";
     tb = "task +backlog list";
     ttb = "taskwarrior-tui -r backlog";
     tr = "task newest limit:page";
-    tw = "task +wait";
+    twait = "task +wait";
     ta = "task add";
     tai = "task add +idea";
     tn = "task-note";

home/profiles/email/default.nix

@@ -175,7 +175,7 @@
       bind editor ^T complete
 
       # Press A to archive
-      macro index,pager A  "<clear-flag>N<save-message>=/Archive"  "mark message as Archived"
+      macro index,pager A  "<clear-flag><save-message>=/Archive"  "mark message as Archived"
       # Press C to add contact to Khard address book
       macro index,pager C \
       "<pipe-message>khard add-email<return>" \

home/profiles/firefox/default.nix

@@ -21,7 +21,7 @@
       extensions = with pkgs.nur.repos.rycee.firefox-addons; [
         # Find extensions: https://github.com/nix-community/nur-combined/blob/master/repos/rycee/pkgs/firefox-addons/generated-firefox-addons.nix
         ublock-origin
-        wallabagger
+        # wallabagger
         # tree-style-tab
         tridactyl
         promnesia

home/profiles/nvim/default.nix

@@ -148,9 +148,9 @@ in
     # kitaab zettel
     kz = "cd ~/kitaab/vimwiki; vim -c :VimwikiIndex -c :ZettelNew; cd $OLDPWD";
     # kitaab recents
-    kr = "cd /home/anish/kitaab/vimwiki; exa --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
+    kr = "cd /home/anish/kitaab/vimwiki; eza --sort=modified --reverse | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
     # kitaab get by tagged
-    kt = "cd /home/anish/kitaab/vimwiki; exa *_index.wiki | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
+    kt = "cd /home/anish/kitaab/vimwiki; eza *_index.wiki | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./{}';cd $OLDPWD";
     # List files that have no links in them
     ku = "cd /home/anish/kitaab/;vim  ./vimwiki/$(python3 poonam/main.py report --titles=false | tail -n +4 | fzf --preview 'bat --style=numbers --color=always --terminal-width -1 ./vimwiki/{}');cd $OLDPWD";
   };
@@ -804,7 +804,7 @@ in
         }
       } 
       -- You gotta run :SCNvimGenerateAssets for this first
-      require("luasnip").add_snippets("supercollider", require("scnvim/utils").get_snippets())
+      -- require("luasnip").add_snippets("supercollider", require("scnvim/utils").get_snippets())
 
       -- zen mode
       require('zen-mode').setup{

home/profiles/task/default.nix

@@ -9,7 +9,7 @@
     # this way, we get a copy of the file, and we make sure it's writable
     ".taskrc".source = ./taskrc;
     ".taskrc".executable = true;
-    ".taskrc".onChange = "cp ~/.taskrc ~/.taskrc2;rm ~/.taskrc;mv ~/.taskrc2 ~/.taskrc;chmod +w ~/.taskrc";
+    # ".taskrc".onChange = "cp ~/.taskrc ~/.taskrc2;rm ~/.taskrc;mv ~/.taskrc2 ~/.taskrc;chmod +w ~/.taskrc";
     ".task/keys/ca.cert".source = ./ca.cert;
     ".task/keys/public.cert".source = ./public.cert;
 

home/profiles/task/taskrc

@@ -82,6 +82,11 @@ report.every.filter=(status:pending limit:0)
 report.every.labels=ID,Active,Deps,P,Project,Tag,Recur,S,Due,Until,Description
 report.every.columns=id,start.age,depends,priority,project,tags,recur,scheduled.countdown,due.relative,until.remaining,description
 
+report.poms.filter=(status:pending -idea -backlog -BLOCKED)
+report.poms.labels=UUID,ID,Project,Tag,Description
+report.poms.columns=uuid,id,project,tags,description
+report.poms.sort=start+,urgency+
+
 # Urgency
 urgency.user.project.wait.coefficient=-10.0
 urgency.user.project.craft.coefficient=1.9

hosts/box/default.nix

@@ -7,7 +7,7 @@
     ../profiles/taskd
     ../profiles/shaarli
     ../profiles/dns
-    ../profiles/monitoring
+    # ../profiles/monitoring
     ../profiles/nfs
     ../profiles/gonic
     ../profiles/headphones 
@@ -22,9 +22,10 @@
     ../profiles/grasp
     # ../profiles/archivebox
     # ../profiles/woodpecker-agent
-    ../profiles/jellyfin
+    # ../profiles/jellyfin
     ../profiles/ulogger-server
     ../profiles/photoprism
+    #../profiles/postgres_upgrade_script
   ];
 
   # Backups

hosts/curve/default.nix

@@ -20,6 +20,12 @@
   # import profiling tools
   programs.systemtap.enable = true;
 
+  virtualisation.docker.enable = true;
+  virtualisation.docker.storageDriver = "btrfs";
+  environment.systemPackages = with pkgs; [
+    docker-compose  
+  ];
+
   # Speed up boot by removing dependency on network 
   systemd = {
     targets.network-online.wantedBy = pkgs.lib.mkForce [ ]; # Normally ["multi-user.target"]
@@ -87,7 +93,7 @@
   #virtualisation.docker.enable = true;
   boot.blacklistedKernelModules = [ "qcserial" ];
   # Used for packer Capsul
-  users.users.anish.extraGroups = [ "adbusers" "wheel" "plugdev" "libvertd" ];
+  users.users.anish.extraGroups = [ "adbusers" "wheel" "plugdev" "libvertd" "docker" ];
   virtualisation.libvirtd.enable = true;
   hardware.keyboard.zsa.enable = true;
   services.udev.extraRules = ''

hosts/curve/hardware-configuration.nix

@@ -5,37 +5,34 @@
 
 {
   imports =
-    [
+    [ (modulesPath + "/installer/scan/not-detected.nix")
-      (modulesPath + "/installer/scan/not-detected.nix")
     ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" "rtsx_pci_sdmmc" ];
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
   boot.initrd.kernelModules = [ "dm-snapshot" ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/boot" =
-    {
-      device = "/dev/disk/by-uuid/2C41-3DAA";
-      fsType = "vfat";
-    };
-
   fileSystems."/" =
-    {
+    { device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
-      device = "/dev/disk/by-uuid/a4ae2855-10b9-49f3-adb0-acd82b74eeb9";
       fsType = "btrfs";
       options = [ "subvol=root" ];
     };
 
   fileSystems."/home" =
-    {
+    { device = "/dev/disk/by-uuid/e1268753-4f18-4e6f-8edb-d4724ad8eb4a";
-      device = "/dev/disk/by-uuid/a4ae2855-10b9-49f3-adb0-acd82b74eeb9";
       fsType = "btrfs";
       options = [ "subvol=home" ];
     };
 
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/8244-A184";
+      fsType = "vfat";
+    };
+
   swapDevices =
-    [{ device = "/dev/disk/by-uuid/23658926-6ffa-42dc-8915-a6479c385e0b"; }];
+    [ { device = "/dev/disk/by-uuid/e220fea6-cf3b-4687-bfe1-9cf6d3ba57f7"; }
+    ];
 
   # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
   # (the default) this is the recommended approach. When using systemd-networkd it's
@@ -46,6 +43,5 @@
   # networking.interfaces.wlp3s0.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  # hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

hosts/development/mirlo/docker-compose.nix

@@ -0,0 +1,337 @@
+# Auto-generated using compose2nix v0.1.6.
+{ pkgs, lib, ... }:
+
+{
+  # Runtime
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings = {
+      # Required for container networking to be able to use names.
+      dns_enabled = true;
+    };
+  };
+  virtualisation.oci-containers.backend = "podman";
+
+  # Containers
+  virtualisation.oci-containers.containers."blackbird-api" = {
+    image = "";
+    environment = {
+      API_DOMAIN = "http://localhost:3000";
+      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
+      JWT_SECRET = "test1234";
+      MEDIA_LOCATION = "./data/media/";
+      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
+      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
+      MINIO_HOST = "minio";
+      MINIO_PORT = "9000";
+      MINIO_ROOT_PASSWORD = "password";
+      MINIO_ROOT_USER = "blackbird";
+      NODE_ENV = "development";
+      PORT = "3000";
+      POSTGRES_LOCAL_MACHINE_PORT = "5434";
+      POSTGRES_PASSWORD = "nomads";
+      POSTGRES_USER = "nomads";
+      REACT_APP_API_DOMAIN = "http://localhost:3000";
+      REDIS_HOST = "redis";
+      REDIS_PASSWORD = "password";
+      REDIS_PORT = "6379";
+      REFRESH_TOKEN_SECRET = "test1234";
+      STATIC_MEDIA_HOST = "http://localhost:3000";
+      STRIPE_KEY = "";
+    };
+    volumes = [
+      "/home/anish/.ssh:/root/.ssh:rw"
+      "/home/anish/usr/mirlo:/var/www/api:rw"
+      "/home/anish/usr/mirlo/data/media/downloadCache:/data/media/downloadCache:rw"
+      "/home/anish/usr/mirlo/data/media/incoming:/data/media/incoming:rw"
+    ];
+    ports = [
+      "3000:3000/tcp"
+    ];
+    cmd = [ "/bin/sh" "-c" "yarn && yarn migrate:deploy && yarn dev:api" ];
+    dependsOn = [
+      "blackbird-minio"
+      "blackbird-pgsql"
+      "blackbird-redis"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=api"
+      "--network=mirlo-api-network"
+      "--network=mirlo-redis-network"
+    ];
+  };
+  systemd.services."podman-blackbird-api" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+    };
+    after = [
+      "podman-network-mirlo-api-network.service"
+      "podman-network-mirlo-redis-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-api-network.service"
+      "podman-network-mirlo-redis-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    unitConfig.UpheldBy = [
+      "podman-blackbird-minio.service"
+      "podman-blackbird-pgsql.service"
+      "podman-blackbird-redis.service"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."blackbird-background" = {
+    image = "";
+    environment = {
+      API_DOMAIN = "http://localhost:3000";
+      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
+      JWT_SECRET = "test1234";
+      MEDIA_LOCATION = "./data/media/";
+      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
+      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
+      MINIO_HOST = "minio";
+      MINIO_PORT = "9000";
+      MINIO_ROOT_PASSWORD = "password";
+      MINIO_ROOT_USER = "blackbird";
+      NODE_ENV = "development";
+      PORT = "3000";
+      POSTGRES_LOCAL_MACHINE_PORT = "5434";
+      POSTGRES_PASSWORD = "nomads";
+      POSTGRES_USER = "nomads";
+      REACT_APP_API_DOMAIN = "http://localhost:3000";
+      REDIS_HOST = "redis";
+      REDIS_PASSWORD = "password";
+      REDIS_PORT = "6379";
+      REFRESH_TOKEN_SECRET = "test1234";
+      STATIC_MEDIA_HOST = "http://localhost:3000";
+      STRIPE_KEY = "";
+    };
+    volumes = [
+      "/home/anish/.ssh:/root/.ssh:rw"
+      "/home/anish/usr/mirlo:/var/www/api:rw"
+      "/home/anish/usr/mirlo/data/media/processing:/data/media/processing:rw"
+    ];
+    dependsOn = [
+      "blackbird-api"
+      "blackbird-minio"
+      "blackbird-pgsql"
+      "blackbird-redis"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=background"
+      "--network=mirlo-api-network"
+      "--network=mirlo-redis-network"
+    ];
+  };
+  systemd.services."podman-blackbird-background" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+    };
+    after = [
+      "podman-network-mirlo-api-network.service"
+      "podman-network-mirlo-redis-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-api-network.service"
+      "podman-network-mirlo-redis-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    unitConfig.UpheldBy = [
+      "podman-blackbird-api.service"
+      "podman-blackbird-minio.service"
+      "podman-blackbird-pgsql.service"
+      "podman-blackbird-redis.service"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."blackbird-minio" = {
+    image = "minio/minio";
+    environment = {
+      API_DOMAIN = "http://localhost:3000";
+      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
+      JWT_SECRET = "test1234";
+      MEDIA_LOCATION = "./data/media/";
+      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
+      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
+      MINIO_HOST = "minio";
+      MINIO_PORT = "9000";
+      MINIO_ROOT_PASSWORD = "password";
+      MINIO_ROOT_USER = "blackbird";
+      PORT = "3000";
+      POSTGRES_LOCAL_MACHINE_PORT = "5434";
+      POSTGRES_PASSWORD = "nomads";
+      POSTGRES_USER = "nomads";
+      REACT_APP_API_DOMAIN = "http://localhost:3000";
+      REDIS_HOST = "redis";
+      REDIS_PASSWORD = "password";
+      REDIS_PORT = "6379";
+      REFRESH_TOKEN_SECRET = "test1234";
+      STATIC_MEDIA_HOST = "http://localhost:3000";
+      STRIPE_KEY = "";
+    };
+    volumes = [
+      "/home/anish/usr/mirlo/data/minio_storage:/data:rw"
+    ];
+    ports = [
+      "9000:9000/tcp"
+      "9001:9001/tcp"
+    ];
+    cmd = [ "server" "--console-address" ":9001" "/data" ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=minio"
+      "--network=mirlo-api-network:alias=minio"
+    ];
+  };
+  systemd.services."podman-blackbird-minio" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "no";
+    };
+    after = [
+      "podman-network-mirlo-api-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-api-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."blackbird-pgsql" = {
+    image = "postgres:14-alpine";
+    environment = {
+      API_DOMAIN = "http://localhost:3000";
+      DATABASE_URL = "postgresql://nomads:nomads@pgsql:5432/nomads?schema=public";
+      JWT_SECRET = "test1234";
+      MEDIA_LOCATION = "./data/media/";
+      MEDIA_LOCATION_DOWNLOAD_CACHE = "/data/media/downloadCache";
+      MEDIA_LOCATION_INCOMING = "/data/media/incoming";
+      MINIO_HOST = "minio";
+      MINIO_PORT = "9000";
+      MINIO_ROOT_PASSWORD = "password";
+      MINIO_ROOT_USER = "blackbird";
+      PORT = "3000";
+      POSTGRES_LOCAL_MACHINE_PORT = "5434";
+      POSTGRES_PASSWORD = "nomads";
+      POSTGRES_USER = "nomads";
+      REACT_APP_API_DOMAIN = "http://localhost:3000";
+      REDIS_HOST = "redis";
+      REDIS_PASSWORD = "password";
+      REDIS_PORT = "6379";
+      REFRESH_TOKEN_SECRET = "test1234";
+      STATIC_MEDIA_HOST = "http://localhost:3000";
+      STRIPE_KEY = "";
+    };
+    volumes = [
+      "/home/anish/usr/mirlo/data/pgsql:/var/lib/postgresql/data:rw"
+      "/home/anish/usr/mirlo/data/pgsql_backups:/backups:rw"
+    ];
+    ports = [
+      "5432:5432/tcp"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=pgsql"
+      "--network=mirlo-api-network:alias=pgsql"
+    ];
+  };
+  systemd.services."podman-blackbird-pgsql" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "no";
+    };
+    after = [
+      "podman-network-mirlo-api-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-api-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+  virtualisation.oci-containers.containers."blackbird-redis" = {
+    image = "redis";
+    ports = [
+      "6379:6379/tcp"
+    ];
+    cmd = [ "redis-server" "--appendonly" "yes" "--requirepass " ];
+    log-driver = "journald";
+    extraOptions = [
+      "--network-alias=redis"
+      "--network=mirlo-redis-network"
+    ];
+  };
+  systemd.services."podman-blackbird-redis" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 500 "always";
+    };
+    after = [
+      "podman-network-mirlo-redis-network.service"
+    ];
+    requires = [
+      "podman-network-mirlo-redis-network.service"
+    ];
+    partOf = [
+      "podman-compose-mirlo-root.target"
+    ];
+    wantedBy = [
+      "podman-compose-mirlo-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."podman-network-mirlo-api-network" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-api-network";
+    };
+    script = ''
+      podman network inspect mirlo-api-network || podman network create mirlo-api-network --opt isolate=true
+    '';
+    partOf = [ "podman-compose-mirlo-root.target" ];
+    wantedBy = [ "podman-compose-mirlo-root.target" ];
+  };
+  systemd.services."podman-network-mirlo-redis-network" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "${pkgs.podman}/bin/podman network rm -f mirlo-redis-network";
+    };
+    script = ''
+      podman network inspect mirlo-redis-network || podman network create mirlo-redis-network --opt isolate=true
+    '';
+    partOf = [ "podman-compose-mirlo-root.target" ];
+    wantedBy = [ "podman-compose-mirlo-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-mirlo-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

hosts/helix/default.nix

@@ -11,6 +11,7 @@
     # ../profiles/mount-mossnet
     ../profiles/freshrss
     ../profiles/microbin
+    # ../profiles/postgres_upgrade_script
   ];
 
   # Capsul specific
@@ -27,11 +28,11 @@
     privateKeyFile = "/run/agenix/helix-wg";
   };
 
-  services.postgresql.package = pkgs.postgresql_11;
+  services.postgresql.package = pkgs.postgresql_15;
   services.postgresqlBackup = {
     # TODO needs working wireguard to box
     enable = false;
-    databases = [ "gitea" "freshrss" "woodpecker" ];
+    databases = [ "gitea" "freshrss"  ]; # "woodpecker"
     location = "/mnt/two/postgres";
   };
 
@@ -41,7 +42,7 @@
     paths = [
       "/var/lib/gitea"
       "/var/lib/freshrss"
-      "/var/lib/woodpecker"
+      # "/var/lib/woodpecker"
       "/var/lib/microbin"
     ];
 

hosts/profiles/core/default.nix

@@ -32,7 +32,7 @@ in
   };
 
   environment.systemPackages = with pkgs; [
-    pinentry_gnome
+    pinentry-gnome
     cached-nix-shell
   ];
 

hosts/profiles/desktop/default.nix

@@ -99,7 +99,7 @@ in
     papirus-icon-theme
     calendar-cli
     wyrd
-    tic-80
+    # tic-80
     ytfzf
     yt-dlp
   ];
@@ -123,9 +123,12 @@ in
     };
     xserver = {
       enable = true;
-      xkb.layout = "us,dvorak";
+      # TODO should be xkb.layout
+      layout = "us";
+      # xkb.variant = "dvorak";
       desktopManager.wallpaper.mode = "fill";
       displayManager = {
+        # startx.enable = true;
         defaultSession = "none+bspwm";
         sessionCommands = ''
           ${pkgs.xorg.xrdb}/bin/xrdb -merge <<EOF

hosts/profiles/freshrss/default.nix

@@ -17,13 +17,14 @@
 
   services.postgresql = {
     enable = true; # Ensure postgresql is enabled
-    authentication = ''
+    # authentication = ''
-      local freshrss all ident map=freshrss-users
+    #   local freshrss all ident map=freshrss-users
-    '';
+    # '';
-    identMap = # Map the freshrss user to postgresql
+    # identMap = # Map the freshrss user to postgresql
-      ''
+    #   ''
-        freshrss-users freshrss freshrss
+    #     freshrss-users freshrss freshrss
-      '';
+    #     freshrss-users postgres freshrss
+    #   '';
     ensureDatabases = [ "freshrss" ];
     ensureUsers = [{ 
       name = "freshrss"; 

hosts/profiles/gitea/default.nix

@@ -46,13 +46,14 @@
   environment.systemPackages = [ pkgs.pandoc ];
   services.postgresql = {
     enable = true; # Ensure postgresql is enabled
-    authentication = ''
+    # authentication = ''
-      local gitea all ident map=gitea-users
+    #   local gitea all ident map=gitea-users
-    '';
+    # '';
-    identMap = # Map the gitea user to postgresql
+    # identMap = # Map the gitea user to postgresql
-      ''
+    #   ''
-        gitea-users gitea gitea
+    #     gitea-users gitea gitea
-      '';
+    #     gitea-users postgres gitea
+    #   '';
     ensureDatabases = [ "gitea" ];
     ensureUsers = [{ 
       name = "gitea"; 

hosts/profiles/microbin/default.nix

@@ -1,8 +1,8 @@
 { config, lib, pkgs, ... }:
 {
   services.microbin.enable = true;
-  services.microbin.hostname = "bin.sealight.xyz";
+  services.microbin.settings.PUBLIC_PATH = "bin.sealight.xyz"; 
-  services.microbin.port = 4949;
+  services.microbin.settings.MICROBIN_PORT = 4949;
   networking.firewall.allowedTCPPorts = [ 4949 ];
   services.nginx.virtualHosts."bin.sealight.xyz" = {
     enableACME = true;

hosts/profiles/music/default.nix

@@ -16,7 +16,7 @@
     orca-c
     supercollider
     dirt
-    sunvox
+    # sunvox
     vcv-rack
     lmms
     bespokesynth

hosts/profiles/postgres_upgrade_script/default.nix

@@ -6,13 +6,12 @@
       # TODO it's perhaps advisable to stop all services that depend on postgresql
       systemctl stop postgresql
 
-      # TODO replace `<new version>` with the psqlSchema here
       # The schema can be found by running:
-      # nix-instantiate '<nixpkgs>' --eval -A postgresql_14.psqlSchema
+      # nix eval --raw nixpkgs#postgresql_15.psqlSchema
-      export NEWDATA="/var/lib/postgresql/<new version>"
+      export NEWDATA="/var/lib/postgresql/15"
 
       # TODO specify the postgresql package you'd like to upgrade to
-      export NEWBIN="${pkgs.postgresql_14}/bin"
+      export NEWBIN="${pkgs.postgresql_15}/bin"
 
       export OLDDATA="${config.services.postgresql.dataDir}"
       export OLDBIN="${config.services.postgresql.package}/bin"

hosts/profiles/ulogger-server/default.nix

@@ -6,7 +6,7 @@
     ensureDatabases = [ "ulogger" ];
     ensureUsers = [{
       name = "ulogger";
-      nsureDBOwnership = true;
+      ensureDBOwnership = true;
     }];
   };
 

hosts/profiles/wallabag/default.nix

@@ -25,7 +25,8 @@
   services.wallabag = {
     enable = true;
     hostName = "read.mossnet.lan";
-    package = pkgs.wallabag;
+    package = pkgs.my-wallabag;
+    dataDir = "/var/lib/wallabag";
     conf = ''
       # This file is a "template" of what your parameters.yml file should look like
       parameters:
@@ -42,7 +43,7 @@
           # with PostgreSQL and SQLite, you must set "utf8"
           database_charset: utf8
 
-          domain_name: http://read.mossnet.lan/
+          domain_name: http://read.mossnet.lan
           server_name: "mossnet wallabag instance"
 
           mailer_dsn: null://

install-yubikey.sh

@@ -19,7 +19,7 @@ cc -O3 -I$(nix-build "<nixpkgs>" --no-build-output -A openssl.dev)/include -L$(n
 
 # Yubikey Setup
 SLOT=2
-ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
+# ykpersonalize -"$SLOT" -ochal-resp -ochal-hmac
 SALT_LENGTH=16
 salt="$(dd if=/dev/random bs=1 count=$SALT_LENGTH 2>/dev/null | rbtohex)"
 k_user=PASSWORDCHANGEMEPLAEASES 

modules/nixos/default.nix

@@ -9,5 +9,5 @@
   wireguard = import ./wireguard.nix;
   backup = import ./backup.nix;
   ulogger-server = import ./ulogger.nix;
-  # microbin = import ./microbin.nix; includide in 23.11
+  # microbin = import ./microbin.nix; # includide in 23.11
 }

modules/nixos/wallabag.nix

@@ -26,7 +26,7 @@ let
   console = pkgs.writeShellScriptBin "wallabag-console" ''
     export WALLABAG_DATA="${cfg.dataDir}"
     cd "${cfg.dataDir}"
-    ${pkgs.php}/bin/php ${pkgs.wallabag}/bin/console --env=prod $@
+    ${pkgs.php}/bin/php ${cfg.package}/bin/console --env=prod $@
   '';
 
 in
@@ -166,11 +166,11 @@ in
       forceSSL = false;
       root = "${cfg.package}/web";
 
-      extraConfig = ''
+      # extraConfig = ''
-        add_header X-Frame-Options SAMEORIGIN;
+      #   add_header X-Frame-Options SAMEORIGIN;
-        add_header X-Content-Type-Options nosniff;
+      #   add_header X-Content-Type-Options nosniff;
-        add_header X-XSS-Protection "1; mode=block";
+      #   add_header X-XSS-Protection "1; mode=block";
-      '';
+      # '';
 
       locations."/" = {
         tryFiles = "$uri /app.php$is_args$args";
@@ -179,25 +179,19 @@ in
       locations."/assets".root = "${cfg.dataDir}/web";
 
       locations."~ ^/app\\.php(/|$)" = {
-        fastcgiParams = {
+        # fastcgiParams = {
-          SCRIPT_FILENAME = "$realpath_root$fastcgi_script_name";
+        #   SCRIPT_FILENAME = "$realpath_root$fastcgi_script_name";
-          DOCUMENT_ROOT = "$realpath_root";
+        #   DOCUMENT_ROOT = "$realpath_root";
-        };
+        # };
         extraConfig = ''
           fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket};
-          include ${config.services.nginx.package}/conf/fastcgi_params;
+          fastcgi_split_path_info ^(.+\.php)(/.*)$;
-          include ${config.services.nginx.package}/conf/fastcgi.conf;
+          include ${pkgs.nginx}/conf/fastcgi_params;
+          fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name;
+          fastcgi_param DOCUMENT_ROOT ${cfg.package}/web;
+          fastcgi_read_timeout 120;
           internal;
         '';
-        # extraConfig = ''
-        #   fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket};
-        #   fastcgi_split_path_info ^(.+\.php)(/.*)$;
-        #   include ${pkgs.nginx}/conf/fastcgi_params;
-        #   fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name;
-        #   fastcgi_param DOCUMENT_ROOT ${cfg.package}/web;
-        #   fastcgi_read_timeout 120;
-        #   internal;
-        # '';
       };
 
       locations."~ /(?!app)\\.php$" = {

mount-crypted.sh

@@ -1,9 +1,21 @@
 #!/usr/bin/env bash
+
+# nix-shell https://github.com/sgillespie/nixos-yubikey-luks/archive/master.tar.gz
+
+rbtohex() {
+    ( od -An -vtx1 | tr -d ' \n' )
+}
+
+hextorb() {
+    ( tr '[:lower:]' '[:upper:]' | sed -e 's/\([0-9A-F]\{2\}\)/\\\\\\x\1/gI'| xargs printf )
+}
+
 key_length=512
-iterations="$(head -n 2 /boot/crypted-storage/default)"
+iterations=1000000
-salt="$(head -n 1 /boot/crypted-storage/default)"
+salt="$(head -n 1 /mnt/crypt-storage/default)"
 chal="$(echo -n $salt | openssl dgst -binary -sha512 | rbtohex)"
 resp="$(ykchalresp -2 -x $chal 2>/dev/null)"
-user_key="$(read -s)"
+user_key=
+read -r user_key
 luks_key="$(echo -n $user_key | pbkdf2-sha512 $(($key_length / 8)) $iterations $resp | rbtohex)"
 echo -n $luks_key | hextorb | sudo cryptsetup luksOpen /dev/sda2 crypted --key-file=-

pkgs/default.nix

@@ -8,4 +8,6 @@
   kobopatch = pkgs.callPackage ./kobopatch.nix { };
   my-mautrix-discord = pkgs.callPackage ./mautrix-discord.nix { }; # Handled by matrix-appservices input
   ulogger-server = pkgs.callPackage ./ulogger.nix { };
+  my-wallabag = pkgs.callPackage ./wallabag.nix { };
+  mautrix-slack = pkgs.callPackage ./mautrix-slack.nix { }; 
 }

pkgs/koboutils.nix

@@ -4,7 +4,7 @@ buildGoModule rec {
   name = "koboutils";
   version = "git_2020-04-08";
 
-  vendorSha256 = "1hqvizvbc29yib6awmvlklxkq7j8c0d32gxsipdiwhkh79xbd6wq";
+  vendorha256 = "1hqvizvbc29yib6awmvlklxkq7j8c0d32gxsipdiwhkh79xbd6wq";
   deleteVendor = true;
 
   src = fetchFromGitHub {

pkgs/mautrix-slack.nix

@@ -0,0 +1,29 @@
+{ lib, buildGoModule, fetchFromGitHub, olm }:
+
+buildGoModule rec {
+  pname = "mautrix-discord";
+  version = "unstable-2022-11-04";
+
+  src = fetchFromGitHub {
+    owner = "mautrix";
+    repo = "slack";
+    rev = "4530ff397d08d93b673cd71da4c2a75d969ca0df";
+    hash = "";
+  };
+
+  buildInputs = [ olm ];
+
+  vendorHash = "sha256-yday2mSnPwuhXWkCG4XY7qoBl3DXHcSvzBoZbjgYz/c=";
+
+  ldflags = [ "-s" "-w" ]; # https://github.com/NixOS/nixpkgs/issues/177698
+
+  doCheck = false; # No tests available
+
+  meta = with lib; {
+    homepage = "https://go.mau.fi/mautrix-slack";
+    description = "Matrix to Slack hybrid puppeting/relaybot bridge";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ ];
+  };
+}
+

pkgs/tic-80.nix

@@ -10,7 +10,7 @@ pkgs.stdenv.mkDerivation rec {
   };
   buildInputs = with pkgs; [
     gcc
-    pkgconfig
+    pkg-config
     autoconf
     automake
     libtool
@@ -27,7 +27,7 @@ pkgs.stdenv.mkDerivation rec {
     gtk3-x11
     cmake
     cmakeCurses
-    elementary-cmake-modules
+    # elementary-cmake-modules
     extra-cmake-modules
     libglvnd
     mesa_glu

pkgs/wallabag-data.patch

@@ -0,0 +1,26 @@
+diff --git a/app/AppKernel.php b/app/AppKernel.php
+index 61b734e06..d25d1aaa3 100644
+--- a/app/AppKernel.php
++++ b/app/AppKernel.php
+@@ -62,14 +62,19 @@ class AppKernel extends Kernel
+         return $bundles;
+     }
+ 
++    public function getProjectDir()
++    {
++        return getenv('WALLABAG_DATA') ?: dirname(__DIR__);
++    }
++
+     public function getCacheDir()
+     {
+-        return dirname(__DIR__) . '/var/cache/' . $this->getEnvironment();
++        return $this->getProjectDir() . '/var/cache/' . $this->getEnvironment();
+     }
+ 
+     public function getLogDir()
+     {
+-        return dirname(__DIR__) . '/var/logs';
++        return $this->getProjectDir() . '/var/logs';
+     }
+ 
+     public function registerContainerConfiguration(LoaderInterface $loader)

pkgs/wallabag.nix

@@ -0,0 +1,57 @@
+{ lib
+, stdenv
+, fetchurl
+}:
+
+# Point the environment variable $WALLABAG_DATA to a data directory
+# that contains the folder `app` which must be a clone of
+# wallabag's configuration files with your customized `parameters.yml`.
+# In practice you need to copy `${pkgs.wallabag}/app` and the
+# customizzed `parameters.yml` to $WALLABAG_DATA.
+# These need to be updated every package upgrade.
+#
+# After a package upgrade, empty the `var/cache` folder or unexpected
+# error will occur.
+
+let
+  pname = "wallabag";
+  version = "2.6.8";
+in
+stdenv.mkDerivation {
+  inherit pname version;
+
+  # Release tarball includes vendored files
+  src = fetchurl {
+    url = "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz";
+    hash = "sha256-pmQXafqpd5rTwBIYG9NnwIIPta6Ek7iYaPaHvz1s550=";
+  };
+
+  patches = [
+    ./wallabag-data.patch # exposes $WALLABAG_DATA
+  ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    cp -R * $out/
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "wallabag is a self hostable application for saving web pages";
+    longDescription = ''
+      wallabag is a self-hostable PHP application allowing you to not
+      miss any content anymore. Click, save and read it when you can.
+      It extracts content so that you can read it when you have time.
+    '';
+    license = licenses.mit;
+    homepage = "http://wallabag.org";
+    changelog = "https://github.com/wallabag/wallabag/releases/tag/${version}";
+    maintainers = with maintainers; [ schneefux ];
+    platforms = platforms.all;
+  };
+}