Merge pull request 'add verifier service' (#90) from feature/verify into main

Reviewed-on: #90

.github/settings.yml

@@ -4,60 +4,44 @@ repository:
 
     # The name of the repository. Changing this will rename the repository
     name: nix-dotfiles
-
     # A short description of the repository that will show up on GitHub
     description: RAD-Dev Infra
-
     # A URL with more information about the repository
     # homepage: "https://nix-community.org"
 
     # A comma-separated list of topics to set on the repository
     topics: "nixos"
-
     # Either `true` to make the repository private, or `false` to make it public.
     private: false
-
     # Either `true` to enable issues for this repository, `false` to disable them.
     has_issues: true
-
     # Either `true` to enable projects for this repository, or `false` to disable them.
     # If projects are disabled for the organization, passing `true` will cause an API error.
     has_projects: true
-
     # Either `true` to enable the wiki for this repository, `false` to disable it.
     has_wiki: false
-
     # Either `true` to enable downloads for this repository, `false` to disable them.
     has_downloads: false
-
     # Updates the default branch for this repository.
     default_branch: main
-
     # Either `true` to allow squash-merging pull requests, or `false` to prevent
     # squash-merging.
     allow_squash_merge: true
-
     # Either `true` to allow merging pull requests with a merge commit, or `false`
     # to prevent merging pull requests with merge commits.
     allow_merge_commit: false
-
     # Either `true` to allow rebase-merging pull requests, or `false` to prevent
     # rebase-merging.
     allow_rebase_merge: true
-
     # Either `true` to enable automatic deletion of branches on merge, or `false` to disable
     delete_branch_on_merge: true
-
     # Either `true` to enable automated security fixes, or `false` to disable
     # automated security fixes.
     enable_automated_security_fixes: true
-
     # Either `true` to enable vulnerability alerts, or `false` to disable
     # vulnerability alerts.
     enable_vulnerability_alerts: true
-
     allow_auto_merge: true
-
 # Labels: define labels for Issues and Pull Requests
 #
 labels:
@@ -104,29 +88,16 @@ labels:
     - name: automated
       color: '#42b528'
       description: PR was automatically generated (through a bot or CI/CD)
-
 # Milestones: define milestones for Issues and Pull Requests
 milestones:
     - title: Go-Live
       description: >-
-      All requirements for official go-live:
+        All requirements for official go-live: - Automated testing via Hydra/Actions - Automated deployments via Hydra/Actions - 90+% testing coverage - Functional formatter with custom rules - palatine-hill is fully stable, enough so that jeeves can be migrated
-      - Automated testing via Hydra/Actions
-      - Automated deployments via Hydra/Actions
-      - 90+% testing coverage
-      - Functional formatter with custom rules
-      - palatine-hill is fully stable, enough so that jeeves can be migrated
       # The state of the milestone. Either `open` or `closed`
       state: open
     - title: Jeeves Migration
       description: >-
-      Test common use-cases for Jeeves
+        Test common use-cases for Jeeves - Quadro GPU support - Multi-GPU support - Plex support - Docker support - ZFS support
-      - Quadro GPU support
-      - Multi-GPU support
-      - Plex support
-      - Docker support
-      - ZFS support
-
-
 # Collaborators: give specific users access to this repository.
 # See https://docs.github.com/en/rest/reference/repos#add-a-repository-collaborator for available options
 collaborators:
@@ -150,7 +121,6 @@ teams:
 # * `maintain` - Recommended for project managers who need to manage the repository without access to sensitive or destructive actions.
 # * `triage` - Recommended for contributors who need to proactively manage issues and pull requests without write access.
 # permission: admin
-
 branches:
     # gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/nix-community/infra/branches/master/protection
 
@@ -165,7 +135,6 @@ branches:
     # `Maximum pull requests to merge`: 5
     # `Only merge non-failing pull requests`: true
     # `Consider check failed after`: 60 minutes
-
     - name: main
       # https://docs.github.com/en/rest/reference/repos#update-branch-protection
       # Branch Protection settings. Set to null to disable

.github/workflows/cache-merge.yml

@@ -1,86 +0,0 @@
-name: Nix CI
-on:
-  push:
-    # don't run on tags, run on commits
-    # https://github.com/orgs/community/discussions/25615
-    tags-ignore:
-      - "**"
-    branches:
-      - main
-  merge_group:
-  schedule:
-    - cron: 0 0 * * *
-  workflow_dispatch:
-
-jobs:
-  # Merge similar `individual` caches
-  # Purge `individual` caches and old `common` caches
-  # Save new `common` caches
-  merge-similar-caches:
-    name: Merge similar caches
-    strategy:
-      matrix:
-        os:
-          - [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Checkout this repo
-        uses: actions/checkout@v4
-
-      - name: Install nix
-        uses: https://github.com/DeterminateSystems/nix-installer-action@main
-
-      - uses: nix-community/cache-nix-action@v6
-        name: create and purge common cache
-        with:
-          primary-key: similar-cache-${{ matrix.os }}-common-${{ hashFiles('flake.lock') }}
-          # if no hit on the primary key, restore individual caches that match `ci.yaml`
-          restore-prefixes-all-matches: |
-            similar-cache-${{ matrix.os }}-individual-${{ hashFiles('flake.lock', '*.nix') }}
-          # do purge caches
-          purge: true
-          # purge old versions of the `common` cache and any versions of individual caches
-          purge-prefixes: |
-            similar-cache-${{ matrix.os }}-common-
-          # created more than 0 seconds ago relative to the start of the `Post Restore` phase
-          purge-created: 0
-          # except the version with the `primary-key`, if it exists
-          purge-primary-key: never
-
-      - uses: nix-community/cache-nix-action@v6
-        name: purge some individual caches
-        with:
-          primary-key: similar-cache-${{ matrix.os }}-common-${{ hashFiles('flake.lock') }}
-          # if no hit on the primary key, restore individual caches that match `ci.yaml`
-          restore-prefixes-all-matches: |
-            similar-cache-${{ matrix.os }}-individual-${{ hashFiles('flake.lock', '*.nix') }}
-          # do purge caches
-          purge: true
-          # purge old versions of the `common` cache and any versions of individual caches
-          purge-prefixes: |
-            similar-cache-${{ matrix.os }}-individual-
-          # created more than 0 seconds ago relative to the start of the `Post Restore` phase
-          purge-created: 259200
-          # except the version with the `primary-key`, if it exists
-          purge-primary-key: never
-
-  # Check that the `common` cache is restored correctly
-  merge-similar-caches-check:
-    name: Check a `common` cache is restored correctly
-    needs: merge-similar-caches
-    strategy:
-      matrix:
-        os:
-          - [ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-      - name: Checkout this repo
-        uses: actions/checkout@v4
-
-      - name: Install nix
-        uses: https://github.com/DeterminateSystems/nix-installer-action@main
-
-      - name: Restore Nix store
-      - uses: nix-community/cache-nix-action@v6
-        with:
-          primary-key: similar-cache-${{ matrix.os }}-common-${{ hashFiles('flake.lock') }}

.github/workflows/flake-health-checks.yml

@@ -5,26 +5,12 @@ on:
     pull_request:
         branches: ["main"]
     merge_group:
-
 jobs:
     health-check:
         name: "Perform Nix flake checks"
-    runs-on: ${{ matrix.os }}
+        runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        os: [ubuntu-latest]
         steps:
             - uses: DeterminateSystems/nix-installer-action@main
-
-      - name: Restore Nix store
-        id: restore
-        uses: nix-community/cache-nix-action@v6
-        with:
-          # save a new cache every time `ci.yaml` changes
-          primary-key: similar-cache-${{ matrix.os }}-individual-${{ hashFiles('flake.lock', '*.nix') }}
-          # otherwise, restore a common cache if and only if it matches the current `ci.yaml`
-          restore-prefixes-first-match: similar-cache-${{ matrix.os }}-common-
-
             - name: Setup Attic cache
               uses: ryanccn/attic-action@v0
               with:
@@ -32,59 +18,24 @@ jobs:
                 cache: ${{ secrets.ATTIC_CACHE }}
                 token: ${{ secrets.ATTIC_TOKEN }}
                 skip-push: "true"
-
             - uses: actions/checkout@v4
-
             - run: nix flake check --accept-flake-config
-
             - run: nix ./utils/attic-push.bash
-
+    # build-checks:
-  build-checks:
+    #     name: "Build nix outputs"
-    name: "Build nix outputs"
+    #     runs-on: ubuntu-latest
-    runs-on: ${{ matrix.os }}
+    #     steps:
-    strategy:
+    #         - uses: DeterminateSystems/nix-installer-action@main
-      matrix:
+    #         - name: Setup Attic cache
-        os: [ubuntu-latest]
+    #           uses: ryanccn/attic-action@v0
-    steps:
+    #           with:
-      - uses: DeterminateSystems/nix-installer-action@main
+    #             endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-
+    #             cache: ${{ secrets.ATTIC_CACHE }}
-      - name: Restore Nix store
+    #             token: ${{ secrets.ATTIC_TOKEN }}
-        id: restore
+    #             skip-push: "true"
-        uses: nix-community/cache-nix-action@v6
+    #         - uses: actions/checkout@v4
-        with:
+    #         - name: Build all outputs
-          # save a new cache every time `ci.yaml` changes
+    #           run: nix run git+https://nayeonie.com/ahuston-0/flake-update-diff -- --build .
-          primary-key: similar-cache-${{ matrix.os }}-individual-${{ hashFiles('flake.lock', '*.nix') }}
+    #         - name: Push to Attic
-          # otherwise, restore a common cache if and only if it matches the current `ci.yaml`
+    #           run: nix ./utils/attic-push.bash
-          restore-prefixes-first-match: similar-cache-${{ matrix.os }}-common-
+    #           continue-on-error: true
-
-      - name: Setup Attic cache
-        uses: ryanccn/attic-action@v0
-        with:
-          endpoint: ${{ secrets.ATTIC_ENDPOINT }}
-          cache: ${{ secrets.ATTIC_CACHE }}
-          token: ${{ secrets.ATTIC_TOKEN }}
-          skip-push: "true"
-
-      - uses: actions/checkout@v4
-
-      - name: Build all outputs
-        run: nix run git+https://nayeonie.com/ahuston-0/flake-update-diff -- --build .
-
-      - name: Push to Attic
-        run: nix ./utils/attic-push.bash
-        continue-on-error: true
-
-      - name: Save Nix store
-        if: steps.restore.outputs.hit == 'false'
-        uses: nix-community/cache-nix-action@v6
-        with:
-          # save a new cache every time `ci.yaml` changes
-          primary-key: similar-cache-${{ matrix.os }}-individual-${{ hashFiles('flake.lock', '*.nix') }}
-          # do purge caches
-          purge: true
-          # purge all versions of the individual cache
-          purge-prefixes: similar-cache-${{ matrix.os }}-individual-
-          # created more than 0 seconds ago relative to the start of the `Post Restore` phase
-          purge-created: 0
-          # except the version with the `primary-key`, if it exists
-          purge-primary-key: never

.github/workflows/flake-update.yml

@@ -7,23 +7,12 @@ on:
 jobs:
     update_lockfile:
         runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main' # ensure workflow_dispatch only runs on main
+        #if: github.ref == 'refs/heads/main' # ensure workflow_dispatch only runs on main
         steps:
             - name: Checkout repository
               uses: actions/checkout@v4
-
             - name: Install nix
               uses: https://github.com/DeterminateSystems/nix-installer-action@main
-
-      - name: Restore Nix store
-        id: restore
-        uses: nix-community/cache-nix-action@v6
-        with:
-          # save a new cache every time `ci.yaml` changes
-          primary-key: similar-cache-${{ matrix.os }}-individual-${{ hashFiles('flake.lock', '*.nix') }}
-          # otherwise, restore a common cache if and only if it matches the current `ci.yaml`
-          restore-prefixes-first-match: similar-cache-${{ matrix.os }}-common-
-
             - name: Setup Attic cache
               uses: ryanccn/attic-action@v0
               with:
@@ -31,10 +20,8 @@ jobs:
                 cache: ${{ secrets.ATTIC_CACHE }}
                 token: ${{ secrets.ATTIC_TOKEN }}
                 skip-push: "true"
-
             - name: Get pre-snapshot of evaluations
               run: nix ./utils/eval-to-drv.sh pre
-
             - name: Update flake.lock
               id: update
               run: |
@@ -49,22 +36,15 @@ jobs:
                 echo "EOF" >> $GITHUB_ENV
 
                 rm update.log
-
             - name: Get post-snapshot of evaluations
               run: nix ./utils/eval-to-drv.sh post
-
             - name: Calculate diff
               run: nix ./utils/diff-evals.sh
-
+            - name: Read file contents
-      - name: Read diff into environment
+              id: read_file
-        run: |
+              uses: guibranco/github-file-reader-action-v2@latest
-          delimiter="$(openssl rand -hex 8)"
+              with:
-          {
+                path: "post-diff"
-          echo "POSTDIFF<<${delimiter}"
-          cat post-diff
-          echo "${delimiter}"
-          } >> $GITHUB_ENV
-
             - name: Write PR body template
               uses: https://github.com/DamianReeves/write-file-action@v1.3
               with:
@@ -77,7 +57,7 @@ jobs:
                     ```
 
                     ```
-            {{ env.POSTDIFF }}
+                    ${{ steps.read_file.outputs.contents }}
                     ```
 
                     Auto-generated by [update.yml][1] with the help of
@@ -85,19 +65,16 @@ jobs:
 
                     [1]: https://nayeonie.com/ahuston-0/nix-dotfiles/src/branch/main/.github/workflows/flake-update.yml
                     [2]: https://forgejo.stefka.eu/jiriks74/create-pull-request
-
             - name: Generate PR body
               uses: pedrolamas/handlebars-action@v2.4.0 # v2.4.0
               with:
                 files: "pr_body.template"
                 output-filename: "pr_body.md"
-
             - name: Save PR body
               id: pr_body
               uses: juliangruber/read-file-action@v1
               with:
                 path: "pr_body.md"
-
             - name: Remove temporary files
               run: |
                 rm pr_body.template
@@ -105,7 +82,6 @@ jobs:
                 rm pre.json
                 rm post.json
                 rm post-diff
-
             - name: Create Pull Request
               id: create-pull-request
               # uses: https://forgejo.stefka.eu/jiriks74/create-pull-request@7174d368c2e4450dea17b297819eb28ae93ee645
@@ -119,31 +95,14 @@ jobs:
                     automated: Update `flake.lock`
 
                     ${{ steps.pr_body.outputs.content }}
-
                 branch: update-flake-lock
                 delete-branch: true
                 pr-labels: | # Labels to be set on the PR
                     dependencies
                     automated
-
             - name: Push to Attic
               run: nix ./utils/attic-push.bash
               continue-on-error: true
-
-      - name: Save Nix store
-        uses: nix-community/cache-nix-action@v6
-        with:
-          # save a new cache every time `ci.yaml` changes
-          primary-key: similar-cache-${{ matrix.os }}-individual-${{ hashFiles('flake.lock', '*.nix') }}
-          # do purge caches
-          purge: true
-          # purge all versions of the individual cache
-          purge-prefixes: similar-cache-${{ matrix.os }}-individual-
-          # created more than 0 seconds ago relative to the start of the `Post Restore` phase
-          purge-created: 0
-          # except the version with the `primary-key`, if it exists
-          purge-primary-key: never
-
             - name: Print PR number
               run: |
                 echo "Pull request number is ${{ steps.create-pull-request.outputs.pull-request-number }}."

.github/workflows/lock-health-checks.yml

@@ -5,7 +5,6 @@ on:
     pull_request:
         branches: ["main"]
     merge_group:
-
 jobs:
     health-check:
         name: "Check health of `flake.lock`"

.github/workflows/nix-fmt.yml

@@ -5,7 +5,6 @@ on:
     pull_request:
         branches: ["main"]
     merge_group:
-
 jobs:
     health-check:
         name: "Perform Nix format checks"

.sops.yaml

@@ -1,7 +1,6 @@
 keys:
     # The PGP keys in keys/
     - &admin_alice 5EFFB75F7C9B74EAA5C4637547940175096C1330
-
     # Generate AGE keys from SSH keys with:
     #   ssh-keygen -A
     #   nix-shell -p ssh-to-age --run 'cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age'
@@ -11,10 +10,8 @@ keys:
     #- &palatine-hill age1z8q02wdp0a2ep5uuffgfeqlfam4ztl95frhw5qhnn6knn0rrmcnqk5evej
     - &palatine-hill age1qw5k8h72k3fjg5gmlxx8q8gwlc2k6n6u08d8hdzpm2pk9r0fnfxsmw33nh
     # cspell:enable
-
 servers: &servers
     - *palatine-hill
-
 # add new users by executing: sops users/<user>/secrets.yaml
 # then have someone already in the repo run the below
 #
@@ -29,14 +26,12 @@ creation_rules:
             - *palatine-hill
             - *artemision
             - *artemision-home
-
     - path_regex: systems/palatine-hill/secrets.*\.yaml$
       key_groups:
         - pgp:
             - *admin_alice
           age:
             - *palatine-hill
-
     - path_regex: systems/artemision/secrets.*\.yaml$
       key_groups:
         - pgp:

.vscode/settings.json

@@ -1,5 +1,7 @@
 {
-  "cSpell.enableFiletypes": ["nix"],
+  "cSpell.enableFiletypes": [
+    "nix"
+  ],
   "cSpell.words": [
     "aarch",
     "abmlevel",

README.md

@@ -14,9 +14,7 @@ to onboard a new user or system.
 
 Although we are not actively looking for new members to join in on this repo,
 we are not strictly opposed. Please reach out to
-[@ahuston-0](https://github.com/ahuston-0) or
+[@ahuston-0](https://nayeonie.com/ahuston-0) for further information.
-[@RichieCahill](https://github.com/RichieCahill)
-for further information.
 
 ## Repo Structure
 

docs/CONTRIBUTING.md

@@ -40,12 +40,12 @@ and will eventually trip a check when merging to main.
 | Branch Name      | Use Case                                                                                                                                                                                                                      |
 |------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | main             | protected branch which all machines pull from, do not try to push directly                                                                                                                                                    |
-| feature/\<item\> | \<item\> is a new feature added to the repo, for personal or common use                                                                                                                                                       |
+| feature/\<item> | \<item> is a new feature added to the repo, for personal or common use                                                                                                                                                       |
-| fixup/\<item\>   | \<item\> is a non-urgent bug, PRs merging from these branches should be merged when possible, but are not considered mission-critical                                                                                         |
+| fixup/\<item>   | \<item> is a non-urgent bug, PRs merging from these branches should be merged when possible, but are not considered mission-critical                                                                                         |
-| hotfix/\<item\>  | \<item\> is a mission-critical bug, either affecting all users or a breaking change on a user's machines. These PRs should be reviewed ASAP. This is automatically subject to the [Critical Issues](#critical-issues) process |
+| hotfix/\<item>  | \<item> is a mission-critical bug, either affecting all users or a breaking change on a user's machines. These PRs should be reviewed ASAP. This is automatically subject to the [Critical Issues](#critical-issues) process |
-| urgent/\<item\>  | Accepted as an alias for the above, due to dev's coming from multiple standards and the criticality of these issues                                                                                                           |
+| urgent/\<item>  | Accepted as an alias for the above, due to dev's coming from multiple standards and the criticality of these issues                                                                                                           |
-| exp/\<item\>     | \<item\> is a non-critical experiment. This is used for shipping around potential new features or fixes to multiple branches                                                                                                  |
+| exp/\<item>     | \<item> is a non-critical experiment. This is used for shipping around potential new features or fixes to multiple branches                                                                                                  |
-| merge/\<item\>   | \<item\> is a temporary branch and should never be merged directly to main. This is solely used for addressing merge conflicts which are too complex to be merged directly on branch                                          |
+| merge/\<item>   | \<item> is a temporary branch and should never be merged directly to main. This is solely used for addressing merge conflicts which are too complex to be merged directly on branch                                          |
 
 ### Review Process
 
@@ -107,8 +107,7 @@ rules.
 We allow secrets to be embedded in the repository using `sops-nix`. As part of
 the process everything is encrypted, however adding a new user is a change
 that every existing SOPS user needs to participate in. Please reach out to
-[@ahuston-0](https://github.com/ahuston-0) or
+[@ahuston-0](https://nayeonie.com/ahuston-0) or if you are interested
-[@RichieCahill](https://github.com/RichieCahill) if you are interested
 in using secrets on your machines.
 
 ## CI/CD

docs/sample-setup.sh

@@ -54,8 +54,6 @@ if [ $PROCEED != "Y" ]; then
   lsblk -ao NAME,FSTYPE,FSSIZE,FSUSED,SIZE,MOUNTPOINT
 fi
 
-
-
 if [ $CREATEPARTS = "Y" ]; then
   # Create partition table
   sudo parted "/dev/$DRIVE" -- mklabel gpt
@@ -123,7 +121,7 @@ fi
 DOTS="/mnt/root/dotfiles"
 GC="git -C $DOTS"
 sudo mkdir -p "$DOTS" || echo "directory $DOTS already exists"
-sudo $GC clone https://github.com/RAD-Development/nix-dotfiles.git .
+sudo $GC clone https://nayeonie.com/ahuston-0/nix-dotfiles.git .
 sudo $GC checkout "$FEATUREBRANCH"
 
 # Create ssh keys
@@ -181,4 +179,4 @@ Host github.com
         IdentityFile /root/.ssh/id_ed25519_ghdeploy
 EOF
 printf "%s" "$SSHCONFIG" | sudo tee /root/.ssh/config
-sudo "$GC" remote set-url origin 'git@github.com:RAD-Development/nix-dotfiles.git'
+sudo "$GC" remote set-url origin 'ssh://gitea@nayeonie.com:2222/ahuston-0/nix-dotfiles.git'

flake.lock

@@ -5,11 +5,11 @@
         "fromYaml": "fromYaml"
       },
       "locked": {
-        "lastModified": 1732200724,
+        "lastModified": 1745523430,
-        "narHash": "sha256-+R1BH5wHhfnycySb7Sy5KbYEaTJZWm1h+LW1OtyhiTs=",
+        "narHash": "sha256-EAYWV+kXbwsH+8G/8UtmcunDeKwLwSOyfcmzZUkWE/c=",
         "owner": "SenchoPens",
         "repo": "base16.nix",
-        "rev": "153d52373b0fb2d343592871009a286ec8837aec",
+        "rev": "58bfe2553d937d8af0564f79d5b950afbef69717",
         "type": "github"
       },
       "original": {
@@ -69,20 +69,17 @@
     },
     "firefox-addons": {
       "inputs": {
-        "flake-utils": [
-          "flake-utils"
-        ],
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1740974607,
+        "lastModified": 1745752599,
-        "narHash": "sha256-YbAnhXYYOjG8OHX7v4BGj/tDQiFgkwe4JsqCjbFYjB0=",
+        "narHash": "sha256-vX5uq4wv7FeNeeFtsTPXQ9n2hd92NFXI+u9sg1K8OhA=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "093c063a23aa38f31082a554f03899127750aee3",
+        "rev": "0388c30f59e860307b2ef0ba93f38d2e525a153e",
         "type": "gitlab"
       },
       "original": {
@@ -95,11 +92,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1739223196,
+        "lastModified": 1744642301,
-        "narHash": "sha256-vAxN2f3rvl5q62gQQjZGVSvF93nAsOxntuFz+e/655w=",
+        "narHash": "sha256-5A6LL7T0lttn1vrKsNOKUk9V0ittdW0VEqh6AtefxJ4=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "a89108e6272426f4eddd93ba17d0ea101c34fb21",
+        "rev": "59e3de00f01e5adb851d824cf7911bd90c31083a",
         "type": "github"
       },
       "original": {
@@ -127,11 +124,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1740872218,
+        "lastModified": 1743550720,
-        "narHash": "sha256-ZaMw0pdoUKigLpv9HiNDH2Pjnosg7NBYMJlHTIsHEUo=",
+        "narHash": "sha256-hIshGgKZCgWh6AYJpJmRgFdR3WUbkY04o82X05xqQiY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3876f6b87db82f33775b1ef5ea343986105db764",
+        "rev": "c621e8422220273271f52058f618c94e405bb0f5",
         "type": "github"
       },
       "original": {
@@ -232,11 +229,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737465171,
+        "lastModified": 1742649964,
-        "narHash": "sha256-R10v2hoJRLq8jcL4syVFag7nIGE7m13qO48wRIukWNg=",
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "9364dc02281ce2d37a1f55b6e51f7c0f65a75f17",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
         "type": "github"
       },
       "original": {
@@ -312,11 +309,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740845322,
+        "lastModified": 1745810134,
-        "narHash": "sha256-AXEgFj3C0YJhu9k1OhbRhiA6FnDr81dQZ65U3DhaWpw=",
+        "narHash": "sha256-WfnYH/i7DFzn4SESQfWviXiNUZjohZhzODqLwKYHIPI=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "fcac3d6d88302a5e64f6cb8014ac785e08874c8d",
+        "rev": "be7cf1709b469a2a2c62169172a167d1fed3509f",
         "type": "github"
       },
       "original": {
@@ -325,6 +322,27 @@
         "type": "github"
       }
     },
+    "hydra": {
+      "inputs": {
+        "nix": "nix",
+        "nix-eval-jobs": "nix-eval-jobs",
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1744212707,
+        "narHash": "sha256-hl9t+RAEO2Jc1lVsR4OvbwG5LTyDo0wkZZ4s7zUGsxU=",
+        "ref": "add-gitea-pulls",
+        "rev": "33a935e8ef44e07c709328235ed48c4b4de03483",
+        "revCount": 4364,
+        "type": "git",
+        "url": "https://nayeonie.com/ahuston-0/hydra"
+      },
+      "original": {
+        "ref": "add-gitea-pulls",
+        "type": "git",
+        "url": "https://nayeonie.com/ahuston-0/hydra"
+      }
+    },
     "hyprland-contrib": {
       "inputs": {
         "nixpkgs": [
@@ -332,11 +350,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740923452,
+        "lastModified": 1743417258,
-        "narHash": "sha256-iQNkVG0368H3kiwSYSs1N6sU7GhHSmx0b9y+Z+eO1+c=",
+        "narHash": "sha256-YItzk1pj8Kz+b7VlC9zN1pSZ6CuX35asYy3HuMQ3lBQ=",
         "owner": "hyprwm",
         "repo": "contrib",
-        "rev": "6f0d5e16c534aeda47d99b4d20bb2a22bfc60c23",
+        "rev": "bc2ad24e0b2e66c3e164994c4897cd94a933fd10",
         "type": "github"
       },
       "original": {
@@ -345,6 +363,59 @@
         "type": "github"
       }
     },
+    "nix": {
+      "inputs": {
+        "flake-compat": [
+          "hydra"
+        ],
+        "flake-parts": [
+          "hydra"
+        ],
+        "git-hooks-nix": [
+          "hydra"
+        ],
+        "nixpkgs": [
+          "hydra",
+          "nixpkgs"
+        ],
+        "nixpkgs-23-11": [
+          "hydra"
+        ],
+        "nixpkgs-regression": [
+          "hydra"
+        ]
+      },
+      "locked": {
+        "lastModified": 1744030329,
+        "narHash": "sha256-r+psCOW77vTSTNbxTVrYHeh6OgB0QukbnyUVDwg8s4I=",
+        "owner": "NixOS",
+        "repo": "nix",
+        "rev": "a4962f73b5fc874d4b16baef47921daf349addfc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "2.28-maintenance",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "nix-eval-jobs": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1744018595,
+        "narHash": "sha256-v5n6t49X7MOpqS9j0FtI6TWOXvxuZMmGsp2OfUK5QfA=",
+        "owner": "nix-community",
+        "repo": "nix-eval-jobs",
+        "rev": "cba718bafe5dc1607c2b6761ecf53c641a6f3b21",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-eval-jobs",
+        "type": "github"
+      }
+    },
     "nix-index-database": {
       "inputs": {
         "nixpkgs": [
@@ -352,11 +423,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740886574,
+        "lastModified": 1745725746,
-        "narHash": "sha256-jN6kJ41B6jUVDTebIWeebTvrKP6YiLd1/wMej4uq4Sk=",
+        "narHash": "sha256-iR+idGZJ191cY6NBXyVjh9QH8GVWTkvZw/w+1Igy45A=",
         "owner": "Mic92",
         "repo": "nix-index-database",
-        "rev": "26a0f969549cf4d56f6e9046b9e0418b3f3b94a5",
+        "rev": "187524713d0d9b2d2c6f688b81835114d4c2a7c6",
         "type": "github"
       },
       "original": {
@@ -388,11 +459,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740947705,
+        "lastModified": 1742568034,
-        "narHash": "sha256-Co2kAD2SZalOm+5zoxmzEVZNvZ17TyafuFsD46BwSdY=",
+        "narHash": "sha256-QaMEhcnscfF2MqB7flZr+sLJMMYZPnvqO4NYf9B4G38=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "507911df8c35939050ae324caccc7cf4ffb76565",
+        "rev": "42ee229088490e3777ed7d1162cb9e9d8c3dbb11",
         "type": "github"
       },
       "original": {
@@ -403,11 +474,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1740646007,
+        "lastModified": 1745503349,
-        "narHash": "sha256-dMReDQobS3kqoiUCQIYI9c0imPXRZnBubX20yX/G5LE=",
+        "narHash": "sha256-bUGjvaPVsOfQeTz9/rLTNLDyqbzhl0CQtJJlhFPhIYw=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "009b764ac98a3602d41fc68072eeec5d24fc0e49",
+        "rev": "f7bee55a5e551bd8e7b5b82c9bc559bc50d868d1",
         "type": "github"
       },
       "original": {
@@ -426,11 +497,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741017582,
+        "lastModified": 1745287769,
-        "narHash": "sha256-2tscHztx6UxqeQTK0U1kLM74+6mSzROMNYJpKRDLMPM=",
+        "narHash": "sha256-vgeZETvHBUMqm/fy2lQOm8tWrllqUC0nHglrXxKmAO0=",
         "owner": "SuperSandro2000",
         "repo": "nixos-modules",
-        "rev": "c7c9219eb6ff26c203d22ba733e9e988499290f0",
+        "rev": "a361718a47791401a2825dcd41550e9332fb2e20",
         "type": "github"
       },
       "original": {
@@ -441,44 +512,63 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1740981371,
+        "lastModified": 1743987495,
-        "narHash": "sha256-Up7YlXIupmT7fEtC4Oj676M91INg0HAoamiswAsA3rc=",
+        "narHash": "sha256-46T2vMZ4/AfCK0Y2OjlFzJPxmdpP8GtsuEqSSJv3oe4=",
-        "owner": "nixos",
+        "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "1d2fe0135f360c970aee1d57a53f816f3c9bddae",
+        "rev": "db8f4fe18ce772a9c8f3adf321416981c8fe9371",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
+        "owner": "NixOS",
-        "ref": "nixos-unstable-small",
+        "ref": "nixos-24.11-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1740872140,
+        "lastModified": 1743296961,
-        "narHash": "sha256-3wHafybyRfpUCLoE8M+uPVZinImg3xX+Nm6gEfN3G8I=",
+        "narHash": "sha256-b1EdN3cULCqtorQ4QeWgLMrd5ZGOjLSLemfa00heasc=",
-        "type": "tarball",
+        "owner": "nix-community",
-        "url": "https://github.com/NixOS/nixpkgs/archive/6d3702243441165a03f699f64416f635220f4f15.tar.gz"
+        "repo": "nixpkgs.lib",
+        "rev": "e4822aea2a6d1cdd36653c134cacfd64c97ff4fa",
+        "type": "github"
       },
       "original": {
-        "type": "tarball",
+        "owner": "nix-community",
-        "url": "https://github.com/NixOS/nixpkgs/archive/6d3702243441165a03f699f64416f635220f4f15.tar.gz"
+        "repo": "nixpkgs.lib",
+        "type": "github"
       }
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1735563628,
+        "lastModified": 1745742390,
-        "narHash": "sha256-OnSAY7XDSx7CtDoqNh8jwVwh4xNL/2HaJxGjryLWzX8=",
+        "narHash": "sha256-1rqa/XPSJqJg21BKWjzJZC7yU0l/YTVtjRi0RJmipus=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b134951a4c9f3c995fd7be05f3243f8ecd65d798",
+        "rev": "26245db0cb552047418cfcef9a25da91b222d6c7",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1745818722,
+        "narHash": "sha256-WSWGBO5YIMdwDP4d01093HFqZJO89Jy6iLr6dr7Fzug=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "a80e6503506a17b2443e98686e89a0fa74b02f1c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }
@@ -493,11 +583,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1740408283,
+        "lastModified": 1745459908,
-        "narHash": "sha256-2xECnhgF3MU9YjmvOkrRp8wRFo2OjjewgCtlfckhL5s=",
+        "narHash": "sha256-bWqgohVf/py9EW3bLS/dYbenD2p9N2/Qsw1+CJk1S04=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "496a4a11162bdffb9a7b258942de138873f019f7",
+        "rev": "dbc4ba3233b2bf951521177bf0ee0a7679959035",
         "type": "github"
       },
       "original": {
@@ -517,11 +607,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740915799,
+        "lastModified": 1742649964,
-        "narHash": "sha256-JvQvtaphZNmeeV+IpHgNdiNePsIpHD5U/7QN5AeY44A=",
+        "narHash": "sha256-DwOTp7nvfi8mRfuL1escHDXabVXFGT1VlPD1JHrtrco=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "42b1ba089d2034d910566bf6b40830af6b8ec732",
+        "rev": "dcf5072734cb576d2b0c59b2ac44f5050b5eac82",
         "type": "github"
       },
       "original": {
@@ -537,12 +627,13 @@
         "flake-parts": "flake-parts",
         "flake-utils": "flake-utils",
         "home-manager": "home-manager",
+        "hydra": "hydra",
         "hyprland-contrib": "hyprland-contrib",
         "nix-index-database": "nix-index-database",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
         "nixos-modules": "nixos-modules",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs_2",
         "nixpkgs-stable": "nixpkgs-stable",
         "pre-commit-hooks": "pre-commit-hooks",
         "rust-overlay": "rust-overlay",
@@ -559,11 +650,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1740969088,
+        "lastModified": 1745807802,
-        "narHash": "sha256-BajboqzFnDhxVT0SXTDKVJCKtFP96lZXccBlT/43mao=",
+        "narHash": "sha256-Aary9kzSx9QFgfK1CDu3ZqxhuoyHvf0F71j64gXZebA=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "20fdb02098fdda9a25a2939b975abdd7bc03f62d",
+        "rev": "9a6045615437787dfb9c1a3242fd75c6b6976b6b",
         "type": "github"
       },
       "original": {
@@ -579,11 +670,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1739262228,
+        "lastModified": 1745310711,
-        "narHash": "sha256-7JAGezJ0Dn5qIyA2+T4Dt/xQgAbhCglh6lzCekTVMeU=",
+        "narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "07af005bb7d60c7f118d9d9f5530485da5d1e975",
+        "rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
         "type": "github"
       },
       "original": {
@@ -620,11 +711,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1740959323,
+        "lastModified": 1745618823,
-        "narHash": "sha256-UtSKsLCWwA4wPFm7mgl33qeu8sj0on9Hyt3YhDWWkAM=",
+        "narHash": "sha256-WGKSI0+CY3Ep2YnRASmBRU8oMIvTW4ngFyjA0dVcKgQ=",
         "owner": "danth",
         "repo": "stylix",
-        "rev": "489833b201a84488c6b4371a261fdbcafa6abcb6",
+        "rev": "11ceb2fde1901dc227421bbbef2d0800339f5126",
         "type": "github"
       },
       "original": {
@@ -700,11 +791,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1740351358,
+        "lastModified": 1744974599,
-        "narHash": "sha256-Hdk850xgAd3DL8KX0AbyU7tC834d3Lej1jOo3duWiOA=",
+        "narHash": "sha256-Fg+rdGs5FAgfkYNCs74lnl8vkQmiZVdBsziyPhVqrlY=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "a1bc2bd89e693e7e3f5764cfe8114e2ae150e184",
+        "rev": "28c26a621123ad4ebd5bbfb34ab39421c0144bdd",
         "type": "github"
       },
       "original": {
@@ -716,11 +807,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1740272597,
+        "lastModified": 1745111349,
-        "narHash": "sha256-/etfUV3HzAaLW3RSJVwUaW8ULbMn3v6wbTlXSKbcoWQ=",
+        "narHash": "sha256-udV+nHdpqgkJI9D0mtvvAzbqubt9jdifS/KhTTbJ45w=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "b6c7f46c8718cc484f2db8b485b06e2a98304cd0",
+        "rev": "e009f18a01182b63559fb28f1c786eb027c3dee9",
         "type": "github"
       },
       "original": {
@@ -780,11 +871,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1730615238,
+        "lastModified": 1743305055,
-        "narHash": "sha256-u/ZGtyEUvAkFOBgLo2YldOx0GKjE3/esWpWruRD376E=",
+        "narHash": "sha256-NIsi8Dno9YsOLUUTrLU4p+hxYeJr3Vkg1gIpQKVTaDs=",
         "owner": "Toqozz",
         "repo": "wired-notify",
-        "rev": "1632418aa15889343028261663e81d8b5595860e",
+        "rev": "75d43f54a02b15f2a15f5c1a0e1c7d15100067a6",
         "type": "github"
       },
       "original": {

flake.nix

@@ -15,9 +15,11 @@
     trusted-public-keys = [
       "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-      "nix-cache:trR+y5nwpQHR4hystoogubFmp97cewkjWeqqbygRQRs="
+      "nix-cache:grGRsHhqNDhkEuTODvHJXYmoCClntC+U8XAJQzwMaZM="
     ];
     trusted-users = [ "root" ];
+    allow-import-from-derivation = true;
+    fallback = true;
   };
 
   inputs = {
@@ -26,7 +28,8 @@
     nixos-hardware.url = "github:NixOS/nixos-hardware";
     #nixpkgs.url = "github:nuschtos/nuschtpkgs/nixos-unstable";
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable-small";
-    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.05";
+    #nixpkgs.url = "github:nixos/nixpkgs/1d2fe0135f360c970aee1d57a53f816f3c9bddae?narHash=sha256-Up7YlXIupmT7fEtC4Oj676M91INg0HAoamiswAsA3rc%3D";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11";
     systems.url = "github:nix-systems/default";
 
     # attic = {
@@ -57,6 +60,13 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
+    hydra = {
+      url = "git+https://nayeonie.com/ahuston-0/hydra?ref=add-gitea-pulls";
+      # inputs = {
+      #   nixpkgs.follows = "nixpkgs";
+      # };
+    };
+
     hyprland-contrib = {
       url = "github:hyprwm/contrib";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -127,7 +137,7 @@
       systems = [
         "x86_64-linux"
         # disable arm for now as hydra isn't set up for it
-        # "aarch64-linux"
+        # "aarch64-linuxa
       ];
 
       forEachSystem = lib.genAttrs systems;
@@ -143,13 +153,13 @@
           lib = self;
         }
       );
-      inherit (lib.rad-dev.systems) genSystems getImages;
+      inherit (lib.adev.systems) genSystems getImages;
       inherit (self) outputs; # for hydra
     in
     rec {
       inherit lib; # for allowing use of custom functions in nix repl
 
-      #hydraJobs = import ./hydra/jobs.nix { inherit inputs outputs systems; };
+      hydraJobs = import ./hydra/jobs.nix { inherit inputs outputs systems; };
       formatter = forEachSystem (system: nixpkgs.legacyPackages.${system}.nixfmt-rfc-style);
 
       nixosConfigurations = genSystems inputs outputs src (src + "/systems");

hydra/jobsets.nix

@@ -19,7 +19,6 @@ let
 
   prs = readJSONFile pulls;
   refs = readJSONFile branches;
-  repo = "RAD-Development/nix-dotfiles";
 
   # template for creating a job
   makeJob =
@@ -28,6 +27,7 @@ let
       keepnr ? 3,
       description,
       flake,
+      enabled ? 1,
     }:
     {
       inherit
@@ -35,8 +35,8 @@ let
         flake
         schedulingshares
         keepnr
+        enabled
         ;
-      enabled = 1;
       type = 1;
       hidden = false;
       checkinterval = 300; # every 5 minutes
@@ -44,7 +44,9 @@ let
       emailoverride = "";
     };
 
-  # Create a hydra job for a branch
+  giteaHost = "ssh://gitea@nayeonie.com:2222";
+  repo = "ahuston-0/nix-dotfiles";
+  # # Create a hydra job for a branch
   jobOfRef =
     name:
     { ref, ... }:
@@ -55,7 +57,7 @@ let
         name = builtins.replaceStrings [ "/" ] [ "-" ] "branch-${name}";
         value = makeJob {
           description = "Branch ${name}";
-          flake = "git+ssh://git@github.com/${repo}?ref=${ref}";
+          flake = "git+${giteaHost}/${repo}?ref=${ref}";
         };
       };
 
@@ -64,7 +66,8 @@ let
     name = if info.draft then "draft-${id}" else "pr-${id}";
     value = makeJob {
       description = "PR ${id}: ${info.title}";
-      flake = "git+ssh://git@github.com/${info.head.repo.full_name}?ref=${info.head.ref}";
+      flake = "git+${giteaHost}/${repo}?ref=${info.head.ref}";
+      enabled = info.state == "open";
     };
   };
 

hydra/spec.json

@@ -1,7 +1,7 @@
 {
   "enabled": 1,
   "hidden": false,
-  "description": "RAD Development infrastructure",
+  "description": "ahuston-0's personal server infra",
   "nixexprinput": "nixexpr",
   "nixexprpath": "hydra/jobsets.nix",
   "checkinterval": 60,
@@ -12,7 +12,7 @@
   "type": 0,
   "inputs": {
     "nixexpr": {
-      "value": "https://github.com/RAD-Development/nix-dotfiles main",
+      "value": "ssh://gitea@nayeonie.com:2222/ahuston-0/nix-dotfiles.git main",
       "type": "git",
       "emailresponsible": false
     },
@@ -22,13 +22,13 @@
       "emailresponsible": false
     },
     "pulls": {
-      "type": "githubpulls",
+      "type": "giteapulls",
-      "value": "RAD-Development nix-dotfiles",
+      "value": "nayeonie.com ahuston-0 nix-dotfiles https",
       "emailresponsible": false
     },
     "branches": {
-      "type": "github_refs",
+      "type": "gitea_refs",
-      "value": "RAD-Development nix-dotfiles heads -",
+      "value": "nayeonie.com ahuston-0 nix-dotfiles heads https -",
       "emailresponsible": false
     }
   }

lib/default.nix

@@ -1,7 +1,7 @@
 { lib, ... }:
 {
-  # create rad-dev namespace for lib
+  # create adev namespace for lib
-  rad-dev = rec {
+  adev = rec {
     systems = import ./systems.nix { inherit lib; };
     container-utils = import ./container-utils.nix { inherit lib; };
 

lib/systems.nix

@@ -176,7 +176,7 @@ rec {
           (configPath + "/configuration.nix")
         ]
         ++ modules
-        ++ (lib.rad-dev.fileList (src + "/modules"))
+        ++ (lib.adev.fileList (src + "/modules"))
         ++ genWrapper sops genSops args
         ++ genWrapper home genHome args
         ++ genWrapper true genUsers args
@@ -222,7 +222,7 @@ rec {
             // import configPath { inherit inputs; }
           );
         }
-      ) (lib.rad-dev.lsdir path)
+      ) (lib.adev.lsdir path)
     );
 
   # gets all the images of a specified format

modules/autopull.nix

@@ -61,7 +61,7 @@ in
     lib.mkIf cfg.enable {
       environment.systemPackages =
         [ pkgs.git ]
-        ++ lib.optionals (lib.any (ssh-key: ssh-key != "") (lib.rad-dev.mapGetAttr "ssh-key" repos)) [
+        ++ lib.optionals (lib.any (ssh-key: ssh-key != "") (lib.adev.mapGetAttr "ssh-key" repos)) [
           pkgs.openssh
         ];
 

modules/kub_net.nix

@@ -1,10 +1,10 @@
 { lib, config, ... }:
 let
-  cfg = config.services.rad-dev.k3s-net;
+  cfg = config.services.adev.k3s-net;
 in
 {
   options = {
-    services.rad-dev.k3s-net = {
+    services.adev.k3s-net = {
       enable = lib.mkOption {
         default = false;
         example = true;

modules/update.nix

@@ -10,10 +10,25 @@
   };
 
   system.autoUpgrade = {
-    enable = lib.mkDefault false;
+    enable = lib.mkDefault true;
     flags = [ "--accept-flake-config" ];
     randomizedDelaySec = "1h";
     persistent = true;
-    flake = "github:RAD-Development/nix-dotfiles";
+    flake = "git+ssh://nayeonie.com/ahuston-0/nix-dotfiles.git";
+  };
+
+  services.nix-verify = {
+    daily = {
+      enable = true;
+      verify-contents = false;
+      verify-trust = false;
+    };
+    weekly = {
+      enable = true;
+      verify-contents = true;
+      verify-trust = false;
+      frequency = "1week";
+      randomized-delay-sec = "6hour";
+    };
   };
 }

modules/verify.nix

@@ -0,0 +1,110 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.nix-verify;
+
+  verify-type =
+    with lib.types;
+    attrsOf (
+      submodule (
+        { name, ... }:
+        {
+          options = {
+            enable = lib.mkEnableOption "verify status of nix store";
+
+            service-name = lib.mkOption {
+              type = lib.types.str;
+              description = "the name of the systemd service. ${name} by default";
+              default = name;
+            };
+
+            verify-contents = lib.mkEnableOption "verify contents of nix store";
+
+            verify-trust = lib.mkEnableOption "verify if each path is trusted";
+
+            signatures-needed = lib.mkOption {
+              type = lib.types.int;
+              description = "number of signatures needed when verifying trust. Not needed if verify-trust is disabled or not set.";
+              default = -1;
+            };
+
+            frequency = lib.mkOption {
+              type = lib.types.str;
+              description = "systemd-timer compatible time between pulls";
+              default = "1day";
+            };
+
+            randomized-delay-sec = lib.mkOption {
+              type = lib.types.str;
+              description = "systemd-timer compatible time randomized delay";
+              default = "0";
+            };
+          };
+        }
+      )
+    );
+in
+{
+  options = {
+    services.nix-verify = lib.mkOption {
+      type = verify-type;
+      default = { };
+    };
+  };
+
+  config =
+    let
+      verifiers = lib.filterAttrs (_: { enable, ... }: enable) cfg;
+    in
+    {
+      systemd.services = lib.mapAttrs' (
+        _:
+        {
+          service-name,
+          verify-contents,
+          verify-trust,
+          signatures-needed,
+          ...
+        }:
+        lib.nameValuePair "nix-verifiers@${service-name}" {
+          requires = [ "multi-user.target" ];
+          after = [ "multi-user.target" ];
+          description =
+            "Verify nix store (verify-contents: ${lib.boolToString verify-contents}, verify-trust: "
+            + "${lib.boolToString verify-trust}, signatures-needed: ${builtins.toString signatures-needed})";
+          serviceConfig = {
+            Type = "oneshot";
+            User = "root";
+            ExecStart =
+              "${config.nix.package}/bin/nix store verify --all "
+              + lib.optionalString (!verify-contents) "--no-contents "
+              + lib.optionalString (!verify-trust) "--no-trust "
+              + lib.optionalString (signatures-needed >= 0) "--sigs-needed ${signatures-needed}";
+          };
+        }
+      ) verifiers;
+
+      systemd.timers = lib.mapAttrs' (
+        _:
+        {
+          service-name,
+          frequency,
+          randomized-delay-sec,
+          ...
+        }:
+        lib.nameValuePair "nix-verifiers@${service-name}" {
+          wantedBy = [ "timers.target" ];
+          timerConfig = {
+            OnBootSec = frequency;
+            OnUnitActiveSec = frequency;
+            RandomizedDelaySec = randomized-delay-sec;
+            Unit = "nix-verifiers@${service-name}.service";
+          };
+        }
+      ) verifiers;
+    };
+}

modules/yubikey.nix

@@ -5,11 +5,11 @@
   ...
 }:
 let
-  cfg = config.services.rad-dev.yubikey;
+  cfg = config.services.adev.yubikey;
 in
 {
   options = {
-    services.rad-dev.yubikey = {
+    services.adev.yubikey = {
       enable = lib.mkEnableOption "enable yubikey defaults";
       enable-desktop-app = lib.mkEnableOption "installs desktop application";
     };

shell.nix

@@ -38,13 +38,17 @@ forEachSystem (
     };
 
     # constructs a custom shell with commonly used utilities
-    rad-dev = pkgs.mkShell {
+    adev = pkgs.mkShell {
       packages = with pkgs; [
         deadnix
         pre-commit
         treefmt
         statix
         nixfmt-rfc-style
+        jsonfmt
+        mdformat
+        shfmt
+        yamlfmt
       ];
     };
   in
@@ -52,7 +56,7 @@ forEachSystem (
     default = pkgs.mkShell {
       inputsFrom = [
         pre-commit
-        rad-dev
+        adev
         sops
       ];
     };

systems/artemision/configuration.nix

@@ -32,7 +32,7 @@
   };
 
   boot = {
-    kernelPackages = lib.mkForce pkgs.linuxPackages_6_6;
+    #kernelPackages = lib.mkForce pkgs.linuxPackages_6_6;
     useSystemdBoot = true;
     default = true;
   };
@@ -75,7 +75,7 @@
     fprintd.enable = lib.mkForce false;
     openssh.enable = lib.mkForce false;
 
-    rad-dev.yubikey = {
+    adev.yubikey = {
       enable = true;
       enable-desktop-app = true;
     };
@@ -83,11 +83,14 @@
 
   users.users.alice.extraGroups = [ "calibre-web" ];
 
-  system.autoUpgrade.enable = false;
   system.stateVersion = "24.05";
 
   programs.adb.enable = true;
 
+  environment.variables = {
+    "KWIN_DRM_NO_DIRECT_SCANOUT" = "1";
+  };
+
   sops = {
     defaultSopsFile = ./secrets.yaml;
     #secrets = {

systems/artemision/desktop.nix

@@ -7,6 +7,7 @@
     hyprland = {
       enable = true;
       xwayland.enable = true;
+      withUWSM = true;
     };
     hyprlock.enable = true;
     gnupg.agent = {

systems/artemision/programs.nix

@@ -18,8 +18,6 @@
     croc
     deadnix
     direnv
-    discord
-    discord-canary
     easyeffects
     eza
     fanficfare
@@ -44,6 +42,7 @@
     kitty
     kubectl
     kubernetes-helm
+    libreoffice-fresh
     libtool
     lsof
     lynis

systems/palatine-hill/attic/default.nix

@@ -62,58 +62,58 @@
 
   # borrowing from https://github.com/Shawn8901/nix-configuration/blob/4b8d1d44f47aec60feb58ca7b7ab5ed000506e90/modules/nixos/private/hydra.nix
   # configured default webstore for this on root user separately
-  # systemd = {
+  systemd = {
-  #   services = {
+    services = {
-  #     attic-watch-store = {
+      attic-watch-store = {
-  #       wantedBy = [ "multi-user.target" ];
+        wantedBy = [ "multi-user.target" ];
-  #       after = [
+        after = [
-  #         "network-online.target"
+          "network-online.target"
-  #         "docker.service"
+          "docker.service"
-  #         "atticd.service"
+          "atticd.service"
-  #       ];
+        ];
-  #       requires = [
+        requires = [
-  #         "network-online.target"
+          "network-online.target"
-  #         "docker.service"
+          "docker.service"
-  #         "atticd.service"
+          "atticd.service"
-  #       ];
+        ];
-  #       description = "Upload all store content to binary cache";
+        description = "Upload all store content to binary cache";
-  #       serviceConfig = {
+        serviceConfig = {
-  #         User = "root";
+          User = "root";
-  #         Restart = "always";
+          Restart = "always";
-  #         ExecStart = "${pkgs.attic-client}/bin/attic watch-store cache-nix-dot";
+          ExecStart = "${pkgs.attic-client}/bin/attic watch-store nix-cache";
-  #       };
+        };
-  #     };
+      };
-  #     attic-sync-hydra = {
+      attic-sync-hydra = {
-  #       after = [
+        after = [
-  #         "network-online.target"
+          "network-online.target"
-  #         "docker.service"
+          "docker.service"
-  #         "atticd.service"
+          "atticd.service"
-  #       ];
+        ];
-  #       requires = [
+        requires = [
-  #         "network-online.target"
+          "network-online.target"
-  #         "docker.service"
+          "docker.service"
-  #         "atticd.service"
+          "atticd.service"
-  #       ];
+        ];
-  #       description = "Force resync of hydra derivations with attic";
+        description = "Force resync of hydra derivations with attic";
-  #       serviceConfig = {
+        serviceConfig = {
-  #         Type = "oneshot";
+          Type = "oneshot";
-  #         User = "root";
+          User = "root";
-  #         ExecStart = "${config.nix.package}/bin/nix ${./sync-attic.bash}";
+          ExecStart = "${config.nix.package}/bin/nix ${./sync-attic.bash}";
-  #       };
+        };
-  #     };
+      };
-  #   };
+    };
 
-  #   timers = {
+    timers = {
-  #     attic-sync-hydra = {
+      attic-sync-hydra = {
-  #       wantedBy = [ "timers.target" ];
+        wantedBy = [ "timers.target" ];
-  #       timerConfig = {
+        timerConfig = {
-  #         OnBootSec = 600;
+          OnBootSec = 600;
-  #         OnUnitActiveSec = 86400;
+          OnUnitActiveSec = 86400;
-  #         Unit = "attic-sync-hydra.service";
+          Unit = "attic-sync-hydra.service";
-  #       };
+        };
-  #     };
+      };
-  #   };
+    };
-  # };
+  };
 
   sops = {
     secrets = {

systems/palatine-hill/attic/sync-attic.bash

@@ -6,5 +6,5 @@ sync_directories=(
 )
 
 for dir in "${sync_directories[@]}"; do
-    find "$dir"  -regex ".*\.drv$" -exec attic push cache-nix-dot '{}' \;
+  find "$dir" -regex ".*\.drv$" -exec attic push nix-cache '{}' \;
 done

systems/palatine-hill/configuration.nix

@@ -17,8 +17,8 @@
     ./minio.nix
     ./networking.nix
     ./nextcloud.nix
-    ./samba.nix
     ./postgresql.nix
+    ./samba.nix
     ./zfs.nix
   ];
 

systems/palatine-hill/docker/act-runner.nix

@@ -6,6 +6,7 @@
 let
   vars = import ../vars.nix;
   act_path = vars.primary_act;
+  act_config_path = ./act_config.yaml;
 in
 {
   virtualisation.oci-containers.containers = {
@@ -20,7 +21,7 @@ in
       };
       ports = [ "8088:8088" ];
       volumes = [
-        "${act_path}/stable-latest-main/config.yaml:/config.yaml"
+        "${act_config_path}:/config.yaml"
         "${act_path}/stable-latest-main/data:/data"
         "/var/run/docker.sock:/var/run/docker.sock"
       ];
@@ -42,7 +43,7 @@ in
         "com.centurylinklabs.watchtower.scope" = "act-runner";
       };
       volumes = [
-        "${act_path}/stable-latest-1/config.yaml:/config.yaml"
+        "${./act_config.yaml}:/config.yaml"
         "${act_path}/stable-latest-1/data:/data"
         "/var/run/docker.sock:/var/run/docker.sock"
       ];
@@ -64,7 +65,7 @@ in
         "com.centurylinklabs.watchtower.scope" = "act-runner";
       };
       volumes = [
-        "${act_path}/stable-latest-2/config.yaml:/config.yaml"
+        "${act_config_path}:/config.yaml"
         "${act_path}/stable-latest-2/data:/data"
         "/var/run/docker.sock:/var/run/docker.sock"
       ];
@@ -75,72 +76,6 @@ in
       environmentFiles = [ config.sops.secrets."docker/act-runner".path ];
       log-driver = "local";
     };
-
-    act-stable-latest-3 = {
-      image = "gitea/act_runner:latest";
-      extraOptions = [
-        "--stop-signal=SIGINT"
-      ];
-      labels = {
-        "com.centurylinklabs.watchtower.enable" = "true";
-        "com.centurylinklabs.watchtower.scope" = "act-runner";
-      };
-      volumes = [
-        "${act_path}/stable-latest-3/config.yaml:/config.yaml"
-        "${act_path}/stable-latest-3/data:/data"
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ];
-      environment = {
-        CONFIG_FILE = "/config.yaml";
-        GITEA_RUNNER_NAME = "stable-latest-3";
-      };
-      environmentFiles = [ config.sops.secrets."docker/act-runner".path ];
-      log-driver = "local";
-    };
-
-    act-stable-latest-4 = {
-      image = "gitea/act_runner:latest";
-      extraOptions = [
-        "--stop-signal=SIGINT"
-      ];
-      labels = {
-        "com.centurylinklabs.watchtower.enable" = "true";
-        "com.centurylinklabs.watchtower.scope" = "act-runner";
-      };
-      volumes = [
-        "${act_path}/stable-latest-4/config.yaml:/config.yaml"
-        "${act_path}/stable-latest-4/data:/data"
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ];
-      environment = {
-        CONFIG_FILE = "/config.yaml";
-        GITEA_RUNNER_NAME = "stable-latest-4";
-      };
-      environmentFiles = [ config.sops.secrets."docker/act-runner".path ];
-      log-driver = "local";
-    };
-
-    act-stable-latest-5 = {
-      image = "gitea/act_runner:latest";
-      extraOptions = [
-        "--stop-signal=SIGINT"
-      ];
-      labels = {
-        "com.centurylinklabs.watchtower.enable" = "true";
-        "com.centurylinklabs.watchtower.scope" = "act-runner";
-      };
-      volumes = [
-        "${act_path}/stable-latest-5/config.yaml:/config.yaml"
-        "${act_path}/stable-latest-5/data:/data"
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ];
-      environment = {
-        CONFIG_FILE = "/config.yaml";
-        GITEA_RUNNER_NAME = "stable-latest-5";
-      };
-      environmentFiles = [ config.sops.secrets."docker/act-runner".path ];
-      log-driver = "local";
-    };
   };
 
   systemd = {
@@ -168,7 +103,9 @@ in
     "docker/act-runner" = {
       owner = "root";
       restartUnits = [
+        "docker-act-stable-latest-main.service"
         "docker-act-stable-latest-1.service"
+        "docker-act-stable-latest-2.service"
       ];
     };
   };

systems/palatine-hill/docker/act_config.yaml

@@ -0,0 +1,95 @@
+# Example configuration file, it's safe to copy this as the default config file without any modification.
+# You don't have to copy this file to your instance,
+# just run `./act_runner generate-config > config.yaml` to generate a config file.
+log:
+    # The level of logging, can be trace, debug, info, warn, error, fatal
+    level: debug
+runner:
+    # Where to store the registration result.
+    file: .runner
+    # Execute how many tasks concurrently at the same time.
+    capacity: 1
+    # Extra environment variables to run jobs.
+    envs:
+        A_TEST_ENV_NAME_1: a_test_env_value_1
+        A_TEST_ENV_NAME_2: a_test_env_value_2
+    # Extra environment variables to run jobs from a file.
+    # It will be ignored if it's empty or the file doesn't exist.
+    env_file: .env
+    # The timeout for a job to be finished.
+    # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+    # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+    timeout: 3h
+    # The timeout for the runner to wait for running jobs to finish when shutting down.
+    # Any running jobs that haven't finished after this timeout will be cancelled.
+    shutdown_timeout: 30m
+    # Whether skip verifying the TLS certificate of the Gitea instance.
+    insecure: false
+    # The timeout for fetching the job from the Gitea instance.
+    fetch_timeout: 5s
+    # The interval for fetching the job from the Gitea instance.
+    fetch_interval: 2s
+    # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+    # Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
+    # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
+    # If it's empty when registering, it will ask for inputting labels.
+    # If it's empty when execute `daemon`, will use labels in `.runner` file.
+    labels:
+        - "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
+        - "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
+        - "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
+        #cache:
+    # Enable cache server to use actions/cache.
+    #enabled: true
+    # The directory to store the cache data.
+    # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+    #dir: ""
+    # The host of the cache server.
+    # It's not for the address to listen, but the address to connect from job containers.
+    # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+    #host: ""
+    # The port of the cache server.
+    # 0 means to use a random available port.
+    #port: 0
+    # The external cache server URL. Valid only when enable is true.
+    # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+    # The URL should generally end with "/".
+    #external_server: ""
+container:
+    # Specifies the network to which the container will connect.
+    # Could be host, bridge or the name of a custom network.
+    # If it's empty, act_runner will create a network automatically.
+    network: ""
+    # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+    privileged: false
+    # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+    options:
+    # The parent directory of a job's working directory.
+    # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
+    # If the path starts with '/', the '/' will be trimmed.
+    # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
+    # If it's empty, /workspace will be used.
+    workdir_parent:
+    # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+    # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+    # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+    # valid_volumes:
+    #   - data
+    #   - /src/*.json
+    # If you want to allow any volume, please use the following configuration:
+    # valid_volumes:
+    #   - '**'
+    valid_volumes: []
+    # overrides the docker client host with the specified one.
+    # If it's empty, act_runner will find an available docker host automatically.
+    # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+    # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+    docker_host: ""
+    # Pull docker image(s) even if already present
+    force_pull: true
+    # Rebuild docker image(s) even if already present
+    force_rebuild: false
+host:
+    # The parent directory of a job's working directory.
+    # If it's empty, $HOME/.cache/act/ will be used.
+    workdir_parent:

systems/palatine-hill/docker/archiveteam.nix

@@ -122,7 +122,7 @@ let
     cmd = lib.splitString " " "--concurrent 6 AmAnd0";
 
   };
-  inherit (lib.rad-dev.container-utils) createTemplatedContainers;
+  inherit (lib.adev.container-utils) createTemplatedContainers;
 
   vars = import ../vars.nix;
   at_path = vars.primary_archiveteam;

systems/palatine-hill/docker/default.nix

@@ -31,47 +31,47 @@
     default-address-pools = [
       {
         base = "169.254.2.0/23";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.4.0/22";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.8.0/21";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.16.0/20";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.32.0/19";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.64.0/18";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.128.0/18";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.192.0/19";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.224.0/20";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.240.0/21";
-        size = "28";
+        size = 28;
       }
       {
         base = "169.254.248.0/22";
-        size = "28";
+        size = 28;
       }
     ];
     mtu = 9000;

systems/palatine-hill/docker/minecraft.nix

@@ -9,31 +9,31 @@ let
     divinejourney = "dj.alicehuston.xyz";
     rlcraft = "rlcraft.alicehuston.xyz";
     arcanum-institute = "arcanum.alicehuston.xyz";
-    bcg-plus = "bcg.alicehuston.xyz";
+    # bcg-plus = "bcg.alicehuston.xyz";
   };
 
   defaultServer = "rlcraft";
 
-  defaultEnv = {
+  # defaultEnv = {
-    EULA = "true";
+  #   EULA = "true";
-    TYPE = "AUTO_CURSEFORGE";
+  #   TYPE = "AUTO_CURSEFORGE";
-    STOP_SERVER_ANNOUNCE_DELAY = "120";
+  #   STOP_SERVER_ANNOUNCE_DELAY = "120";
-    STOP_DURATION = "600";
+  #   STOP_DURATION = "600";
-    SYNC_CHUNK_WRITES = "false";
+  #   SYNC_CHUNK_WRITES = "false";
-    USE_AIKAR_FLAGS = "true";
+  #   USE_AIKAR_FLAGS = "true";
-    MEMORY = "8GB";
+  #   MEMORY = "8GB";
-    ALLOW_FLIGHT = "true";
+  #   ALLOW_FLIGHT = "true";
-    MAX_TICK_TIME = "-1";
+  #   MAX_TICK_TIME = "-1";
-  };
+  # };
 
-  defaultOptions = [
+  # defaultOptions = [
-    "--stop-signal=SIGTERM"
+  #   "--stop-signal=SIGTERM"
-    "--stop-timeout=1800"
+  #   "--stop-timeout=1800"
-    "--network=minecraft-net"
+  #   "--network=minecraft-net"
-  ];
+  # ];
 
-  vars = import ../vars.nix;
+  # vars = import ../vars.nix;
-  minecraft_path = "${vars.primary_games}/minecraft";
+  # minecraft_path = "${vars.primary_games}/minecraft";
 in
 {
   virtualisation.oci-containers.containers = {
@@ -46,7 +46,7 @@ in
       cmd = [
         (
           "--mapping=mc.alicehuston.xyz=${defaultServer}:25565"
-          + (lib.rad-dev.mapAttrsToString (hostname: url: "," + url + "=" + hostname + ":25565") servers)
+          + (lib.adev.mapAttrsToString (hostname: url: "," + url + "=" + hostname + ":25565") servers)
         )
       ];
     };
@@ -67,24 +67,24 @@ in
     #   log-driver = "local";
     #   environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
     # };
-    bcg-plus = {
+    # bcg-plus = {
-      image = "itzg/minecraft-server:java17";
+    #   image = "itzg/minecraft-server:java17";
-      volumes = [
+    #   volumes = [
-        "${minecraft_path}/bcg-plus/modpacks:/modpacks:ro"
+    #     "${minecraft_path}/bcg-plus/modpacks:/modpacks:ro"
-        "${minecraft_path}/bcg-plus/data:/data"
+    #     "${minecraft_path}/bcg-plus/data:/data"
-      ];
+    #   ];
-      hostname = "bcg-plus";
+    #   hostname = "bcg-plus";
-      environment = defaultEnv // {
+    #   environment = defaultEnv // {
-        VERSION = "1.17";
+    #     VERSION = "1.17";
-        CF_SLUG = "bcg";
+    #     CF_SLUG = "bcg";
-        DIFFICULTY = "normal";
+    #     DIFFICULTY = "normal";
-        DEBUG = "true";
+    #     DEBUG = "true";
-        # ENABLE_COMMAND_BLOCK = "true";
+    #     # ENABLE_COMMAND_BLOCK = "true";
-      };
+    #   };
-      extraOptions = defaultOptions;
+    #   extraOptions = defaultOptions;
-      log-driver = "local";
+    #   log-driver = "local";
-      environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
+    #   environmentFiles = [ config.sops.secrets."docker/minecraft".path ];
-    };
+    # };
   };
 
   sops = {

systems/palatine-hill/docker/nextcloud.nix

@@ -100,7 +100,7 @@ in
       };
       "docker/collabora" = {
         owner = "www-data";
-        restartUnits = [ "docker-collabora.service" ];
+        restartUnits = [ "docker-collabora-code.service" ];
       };
     };
   };

systems/palatine-hill/hydra.nix

@@ -1,7 +1,6 @@
 {
   config,
-  lib,
+  inputs,
-  pkgs,
   ...
 }:
 let
@@ -43,6 +42,7 @@ in
   services = {
     hydra = {
       enable = true;
+      package = inputs.hydra.packages.x86_64-linux.hydra;
       hydraURL = "https://hydra.alicehuston.xyz";
       smtpHost = "alicehuston.xyz";
       notificationSender = "hydra@alicehuston.xyz";

systems/palatine-hill/postgresql.nix

@@ -19,6 +19,9 @@ in
       enable = true;
       enableJIT = true;
       package = pkgs.postgresql_16;
+      configurePgStatStatements = true;
+      enableAllPreloadedLibraries = true;
+      preloadAllExtensions = true;
       identMap = ''
         # ArbitraryMapName systemUser DBUser
            superuser_map      root      postgres
@@ -28,13 +31,126 @@ in
       '';
 
       # initialScript = config.sops.secrets."postgres/init".path;
-      ensureDatabases = [ "atticd" ];
+      ensureDatabases = [
+        "atticd"
+        "alice"
+      ];
       ensureUsers = [
         {
           name = "atticd";
           ensureDBOwnership = true;
         }
+        {
+          name = "alice";
+          ensureDBOwnership = true;
+          ensureClauses = {
+            superuser = true;
+            login = true;
+            createrole = true;
+            createdb = true;
+            replication = true;
+          };
+        }
       ];
+      # Thank you NotAShelf
+      # https://github.com/NotAShelf/nyx/blob/d407b4d6e5ab7f60350af61a3d73a62a5e9ac660/modules/core/roles/server/system/services/databases/postgresql.nix#L74
+      # commented out statements are likely overriden by pgtune settings
+      # https://pgtune.leopard.in.ua/?dbVersion=17&osType=linux&dbType=web&cpuNum=64&totalMemory=8&totalMemoryUnit=GB&connectionNum=1024&hdType=hdd
+      settings = {
+        # Connectivity;
+        # max_connections = 100;
+        superuser_reserved_connections = 3;
+
+        # Memory Settings;
+        #shared_buffers = "1024 MB";
+        #work_mem = "32 MB";
+        #maintenance_work_mem = "320 MB";
+        #huge_pages = "off";
+        #effective_cache_size = "2 GB";
+        #effective_io_concurrency = 100; # concurrent IO only really activated if OS supports posix_fadvise function;
+        #random_page_cost = 1.25; # speed of random disk access relative to sequential access (1.0);
+
+        # Monitoring;
+        #shared_preload_libraries = "pg_stat_statements,auto_explain"; # per statement resource usage stats & log explain statements for slow queries
+        track_io_timing = "on"; # measure exact block IO times;
+        track_functions = "pl"; # track execution times of pl-language procedures if any;
+        # Replication;
+        wal_level = "replica"; # consider using at least "replica";
+        max_wal_senders = 0;
+        synchronous_commit = "on";
+
+        # Checkpointing: ;
+        checkpoint_timeout = "15 min";
+        #checkpoint_completion_target = 0.9;
+        #max_wal_size = "1024 MB";
+        #min_wal_size = "512 MB";
+
+        # WAL writing;
+        wal_compression = "on";
+        wal_buffers = -1; # auto-tuned by Postgres till maximum of segment size (16MB by default);
+        wal_writer_delay = "200ms";
+        wal_writer_flush_after = "1MB";
+
+        # Background writer;
+        bgwriter_delay = "200ms";
+        bgwriter_lru_maxpages = 100;
+        bgwriter_lru_multiplier = 2.0;
+        bgwriter_flush_after = 0;
+
+        # Parallel queries: ;
+        #max_worker_processes = 6;
+        #max_parallel_workers_per_gather = 3;
+        #max_parallel_maintenance_workers = 3;
+        #max_parallel_workers = 6;
+        parallel_leader_participation = "on";
+
+        # Advanced features ;
+        enable_partitionwise_join = "on";
+        enable_partitionwise_aggregate = "on";
+        jit = "on";
+
+        jit_above_cost = 100000;
+        jit_inline_above_cost = 150000;
+        jit_optimize_above_cost = 500000;
+
+        # log slow queries
+        log_min_duration_statement = 100;
+        "auto_explain.log_min_duration" = 100;
+
+        # logging configuration
+        log_connections = true;
+        log_statement = "all";
+        logging_collector = true;
+        log_disconnections = true;
+
+        # from pgtune
+        # DB Version: 17
+        # OS Type: linux
+        # DB Type: web
+        # Total Memory (RAM): 8 GB
+        # CPUs num: 64
+        # Connections num: 1024
+        # Data Storage: hdd
+
+        max_connections = 1024;
+        shared_buffers = "2GB";
+        effective_cache_size = "6GB";
+        maintenance_work_mem = "512MB";
+        checkpoint_completion_target = 0.9;
+        #wal_buffers = "16MB"; allow auto-tuning as per above
+        default_statistics_target = 100;
+        random_page_cost = 4;
+        effective_io_concurrency = 2;
+        work_mem = "512kB";
+        huge_pages = "off";
+        min_wal_size = "1GB";
+        max_wal_size = "4GB";
+        max_worker_processes = 64;
+        max_parallel_workers_per_gather = 4;
+        max_parallel_workers = 64;
+        max_parallel_maintenance_workers = 4;
+
+      };
 
       refreshCollation = true;
       vacuumAnalyzeTimer.enable = true;
@@ -48,6 +164,7 @@ in
           "hydra-send-stats"
           "hydra-server"
           "atticd"
+          "gitea"
         ];
       };
     };

systems/palatine-hill/secrets.yaml

@@ -27,6 +27,8 @@ acme:
     dnsimple: ENC[AES256_GCM,data:37FKyBibFtXZgI4EduJQ0z8F+shBc5Q6YlLa3YkVPh9XuJVS20eybi75bfJxiozcZ9d+YRaqcbkBQCSdFOCotDU=,iv:oq3JjqbfAm2C4jcL1lvUb2EOmnwlR07vPoO8H0BmydQ=,tag:E3NO/jMElL6Q817666gIyg==,type:str]
 server-validation:
     webhook: ENC[AES256_GCM,data:Lwqy4UhyFutpXjai7EJPKp8MDlI+ayDna4T8jluvC6qkeJ7o1UaaDCOsgLy4Fw7LC77tXhJtkcmep9w37JaiHp2CoDOfy2iAaq8o9CCSi/a0zqMJx+HdZYZNemvmpc6E/be0K+JDrFZLbjr3unSpCidQ3whccC6XyY013R12swN3bFZIu1gtzXCgUZ4U,iv:pVbrRwH3ziu4+R5BfimPV7N71QmyerJEc9M5K4eofOc=,tag:zNrCXrIioQWPEPVz/wMDpQ==,type:str]
+typhon:
+    hashedPassword: ENC[AES256_GCM,data:gMyY8gxUn3HzycQRu2cminqRFWghqWcjzZzTxAQZ5PJqn604iSwDiVdr7icHB7drJfCAfsE7L4oKRJgxaIAE32043oOkb2T7DDH8y2jxMzqmZCfbvrfMI4wdfRTHGqzxb6X/aZ5ai2rr1Q==,iv:4EsTo/lQld0o9iktDX9gobMlPUCitx1i9wn8EL16sIs=,tag:FgVDRHk2glDwpC/mprrPqQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -42,8 +44,8 @@ sops:
             cXNZWmZqd0R0SmhINExscHBKWmxvblUKEFEQvt/zQFARba4S8vHz/1SoKdKg69At
             LZ58XQGOmlGbBhPr7EzYQ2XSY4flWbnnD174cmCR8DNFm15DsNA5fw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-04T04:53:14Z"
+    lastmodified: "2025-03-26T05:47:58Z"
-    mac: ENC[AES256_GCM,data:MCucwVPGRMA/hGYS7mwSppkZAQ3wjHJnyeSvSI8YOOD0Xq7mvkMSvKctFHl6h4Cx3ubRvVHf5j35/NQxb+/VhhCPAHWDbqq9O2N0aWhAeybCu0IjruKrJhs76KsXJnNZ9REQQnS1/TNquuvj9FCoqDnrQcFs7M0KJ5m3eUU2h2k=,iv:ZJGJ8CTA8K5FnoKtbogleksB8wDcZtknO07M07Dmpsc=,tag:GMUXJD4U8KQgy9rvzEAMuw==,type:str]
+    mac: ENC[AES256_GCM,data:ZP9HglMmn9FDv6/vtQAxz/qP76QniPqM6bzMQVvVU/OhDmjuneGKZY7d1Es7LC9o5qmJ+T3Dh3/bkmuRdgdnd2TO6iuvM++DEPxwnoHis+0lbMxv5a6ibzvoXXm2CrL4HPETqLKbLahGJRmDNgnkCEWxAs16zrqe5kgDpD53R5c=,iv:DcCXNGyb41ToV9uSnrnrl0dWiw2pvykM8z86Yk814P4=,tag:T9PFl48qABwBSy7vIhSmLA==,type:str]
     pgp:
         - created_at: "2024-11-28T18:56:39Z"
           enc: |-

systems/palatine-hill/typhon.nix

@@ -0,0 +1,17 @@
+{ config, ... }:
+
+let
+  vars = import ./vars.nix;
+  typhon_path = vars.primary_typhon;
+in
+{
+  services.typhon = {
+    enable = true;
+    hashedPasswordFile = config.sops.secrets."typhon/hashedPassword".path;
+    home = typhon_path;
+  };
+
+  sops.secrets = {
+    "typhon/hashedPassword".owner = "root";
+  };
+}

treefmt.toml

@@ -12,3 +12,21 @@ command = "nixfmt"
 #options = []
 # Glob pattern of files to include
 includes = [ "*.nix" ]
+
+[formatter.jsonfmt]
+command = "jsonfmt"
+excludes = []
+includes = ["*.json"]
+options = ["-w"]
+
+[formatter.shfmt]
+command = "shfmt"
+excludes = []
+includes = ["*.sh", "*.bash", "*.envrc", "*.envrc.*"]
+options = ["-i", "2", "-s", "-w"]
+
+[formatter.yamlfmt]
+command = "yamlfmt"
+excludes = []
+includes = ["*.yaml", "*.yml"]
+options = ["-formatter","indent=4"]

users/alice/home.nix

@@ -16,6 +16,7 @@
       ./home/gammastep.nix
       ./home/doom
       ./home/hypr
+      ./home/waybar.nix
       ./non-server.nix
     ];
 
@@ -79,7 +80,6 @@
       # doom emacs dependencies
       fd
       ripgrep
-      ruff-lsp
       pyright
 
       # audit
@@ -89,6 +89,9 @@
       nodejs_20
       nodePackages.prettier
       treefmt
+
+      gocryptfs
+      awscli2
     ];
   };
 

users/alice/home/doom/custom.el

@@ -22,3 +22,6 @@
 
 (setq! lsp-nix-nil-max-mem 20000)
 (setq! lsp-nix-nil-formatter ["nixfmt"])
+;; (add-hook 'python-mode-hook (lambda ()
+;;                                 (require 'sphinx-doc)
+;;                                 (sphinx-doc-mode t)))

users/alice/home/doom/packages.el

@@ -80,3 +80,10 @@
 
 (package! pacdiff.el
   :recipe (:host github :repo "fbrosda/pacdiff.el" :files ("pacdiff.el" "README.org" "LICENSE")))
+
+;;(package! python-docstring-mode
+;;  :recipe (:host github :repo "glyph/python-docstring-mode" :files ("python-docstring.el" "docstring_wrap.py")))
+
+;;(package! sphinx-doc)
+
+;; https://github.com/glyph/python-docstring-mode.git

users/alice/home/hypr/default.nix

@@ -8,6 +8,7 @@
 {
   xdg.configFile = {
     "hypr/hyprland.conf".source = ./hyprland.conf;
+    "hypr/show-hide.sh".source = ./show-hide.sh;
   };
 
   imports = [

users/alice/home/hypr/hypridle.nix

@@ -18,14 +18,14 @@
       listener = [
         {
           timeout = 150; # 2.5min.
-          on-timeout = "brightnessctl -s set 1"; # set monitor backlight to minimum, avoid 0 on OLED monitor.
+          on-timeout = "${pkgs.brightnessctl}/bin/brightnessctl -s set 1"; # set monitor backlight to minimum, avoid 0 on OLED monitor.
-          on-resume = "brightnessctl -r"; # monitor backlight restore.
+          on-resume = "${pkgs.brightnessctl}/bin/brightnessctl -r"; # monitor backlight restore.
         }
         # turn off keyboard backlight, comment out this section if you dont have a keyboard backlight.
         {
           timeout = 150; # 2.5min.
-          on-timeout = "brightnessctl -sd rgb:kbd_backlight set 0"; # turn off keyboard backlight.
+          on-timeout = "${pkgs.brightnessctl}/bin/brightnessctl -sd rgb:kbd_backlight set 0"; # turn off keyboard backlight.
-          on-resume = "brightnessctl -rd rgb:kbd_backlight"; # turn on keyboard backlight.
+          on-resume = "${pkgs.brightnessctl}/bin/brightnessctl -rd rgb:kbd_backlight"; # turn on keyboard backlight.
         }
         {
           timeout = 300; # 5min

users/alice/home/hypr/hyprland.conf

@@ -22,6 +22,9 @@ monitor=,preferred,auto,auto
 # exec-once = waybar & hyprpaper & firefox
 exec-once = wired &
 
+exec-once = wired
+exec-once = systemctl --user start polkit-gnome-authentication-agent-1.service
+
 # Source a file (multi-file configs)
 # source = ~/.config/hypr/myColors.conf
 
@@ -207,3 +210,7 @@ bind = $mainMod, P, exec, bwm
 
 # lock screen
 bind = $mainMod, L, exec, loginctl lock-session
+# hide active window
+bind = $mainMod,H,exec,/home/alice/config/hypr/hide_unhide_window.sh h
+# show hide window
+bind = $mainMod,I,exec,/home/alice/config/hypr/hide_unhide_window.sh s

users/alice/home/hypr/hyprlock.nix

@@ -11,7 +11,8 @@
     settings = {
       general = {
         immediate_render = true;
-        no_fade_in = true;
+        # disabling as config doesn't exist
+        #no_fade_in = true;
       };
       background = {
         monitor = "";
@@ -54,7 +55,8 @@
         dots_spacing = 0.15; # Scale of dots' absolute size, -1.0 - 1.0
         dots_center = false;
         dots_rounding = -1; # -1 default circle, -2 follow input-field rounding
-        dots_fade_time = 200; # Milliseconds until a dot fully fades in
+        # disabling as config doesn't exist
+        # dots_fade_time = 200; # Milliseconds until a dot fully fades in
         dots_text_format = ""; # Text character used for the input indicator. Leave empty for a rectangle that will be rounded via dots_rounding (default).
         # disabling due to stylix
         # outer_color = "rgb(151515)";
@@ -70,7 +72,8 @@
         #fail_color = "rgb(204, 34, 34)"; # if authentication failed, changes outer_color and fail message color
         fail_text = "<i>$FAIL <b>($ATTEMPTS)</b></i>"; # can be set to empty
         fail_timeout = 2000; # milliseconds before fail_text and fail_color disappears
-        fail_transition = 300; # transition time in ms between normal outer_color and fail_color
+        # disabling as config doesn't exist
+        #fail_transition = 300; # transition time in ms between normal outer_color and fail_color
         capslock_color = -1;
         numlock_color = -1;
         bothlock_color = -1; # when both locks are active. -1 means don't change outer color (same for above)

users/alice/home/hypr/show-hide.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+stack_file="/tmp/hide_window_pid_stack.txt"
+
+function hide_window() {
+  pid=$(hyprctl activewindow -j | jq '.pid')
+  hyprctl dispatch movetoworkspacesilent "88,pid:$pid"
+  echo "$pid" >>$stack_file
+}
+
+function show_window() {
+  pid=$(tail -1 $stack_file && sed -i '$d' $stack_file)
+  [ -z "$pid" ] && exit
+
+  current_workspace=$(hyprctl activeworkspace -j | jq '.id')
+  hyprctl dispatch movetoworkspacesilent "$current_workspace,pid:$pid"
+}
+
+if [ -n "$1" ]; then
+  if [ "$1" == "h" ]; then
+    hide_window >>/dev/null
+  else
+    show_window >>/dev/null
+  fi
+fi

users/alice/home/waybar.json

@@ -0,0 +1,40 @@
+[
+  {
+    "height": 20,
+    "layer": "top",
+    "position": "top",
+    "output": [
+      "eDP-2",
+      "eDP-1",
+      "HDMI-0",
+      "DP-0"
+    ],
+    "hyprland/workspaces": {
+      "active-only": true,
+      "all-outputs": false,
+      "show-special": true,
+      "move-to-monitor": true,
+      "format": "{icon} {windows}",
+      "format-window-separator": " ",
+      "format-icons": {
+        "1": "󰎤",
+        "2": "󰎧",
+        "3": "󰎪",
+        "default": "",
+        "empty": "󱓼",
+        "urgent": "󱨇"
+      },
+      "persistent-workspaces": {
+        "1": "HDMI-0"
+      },
+      "on-scroll-down": "hyprctl dispatch workspace e-1",
+      "on-scroll-up": "hyprctl dispatch workspace e+1",
+      "window-rewrite": {
+        "title<Steam>": ""
+      },
+      "window-rewrite-default": "",
+      "window-rewrite-separator": " ",
+      "sort-by": "number"
+    }
+  }
+]

users/alice/home/waybar.nix

@@ -2,6 +2,6 @@
 lib.mkIf (!machineConfig.server) {
   programs.waybar = {
     enable = true;
-    #settings = builtins.fromJSON (import ./waybar.json);
+    settings = builtins.fromJSON (builtins.readFile ./waybar.json);
   };
 }

users/alice/home/zsh.nix

@@ -4,7 +4,6 @@
   programs.zsh = {
 
     enable = true;
-    # autosuggestion.enable = true;
     oh-my-zsh = {
       enable = true;
       plugins = [

users/alice/non-server.nix

@@ -64,5 +64,6 @@
     zathura
     obsidian
     libreoffice-qt-fresh
+    wlr-randr
   ];
 }

users/alice/secrets.yaml

@@ -2,17 +2,15 @@ alice:
     user-password: ENC[AES256_GCM,data:+cM85X1vapqfQdJ+Dv6YvT5qHlvsmaXPRbvKRHtCkPT3wdw4f7tLHLFmvWnak7CRezI00PxVEtCZL5mqLyN2HaU4OqIk/9fgqczIzemwBlMGJt+ndwG4oqBqE0ymtzmy8MA59wonRqoxzYKQfAGQsprdCIovrg==,iv:BtSDBgvQeZdTY1KUClnt9V8qHcS/gouaaQw342tk4Sg=,tag:T7tzyKuCo83s78ca7f4KDQ==,type:str]
     #ENC[AES256_GCM,data:6+dLs8opC27IrHJCPfL2c7KiLbaQTqI6oRKpIZLR4+P9gTupziAhCm/G7RY01gVPSgxdBpJ6L4xVbcMEg9hDKBMI4naF9arNrFsV6WXNc+LA5BYyT9L9G1nDea8fPFYDSF2537eLgLqWNE1WSsUOrz/WOxbE6g==,iv:AxsdKmGz6qEYlWY08q/2hqsm0EXaqodwD/7OJg4FAIY=,tag:EgfL3I1VBXtFgIdTOW5eBA==,type:comment]
     #ENC[AES256_GCM,data:vUMcowHjlQA0RWflfaQhZKkalO39epYi6N9PPW8=,iv:6DFqHlQR+mi+ZkfMUhlhwvpMwnxXNfQV6+sYgPzSj4I=,tag:Pz1zJayscGckPO8Q2ZVb4g==,type:comment]
-    gha-hydra-token: ENC[AES256_GCM,data:rYDYIn7MAF4pSZQj+Nln2z9J+AxvuSzumthL86njpKETutArrw+9iX2hHJt5t513NHH03tMtZOFqM60/pzWg4YXVQOSpQmq8QOelD7qCdfCr4Z2QSeOHqXqwKy21iWtoVbxOXWunVxLzkWMJrpHkpVsiBA75Nv66ftKEjN80QNGik6xQE1iPsCB2JHeqYNIr8gtPkCr7H5Pt4yBBO/1rsyONrbNlwmzVX78eqXxmc43XOiNVjEsk8ekJxJ9mn5S6JcPNehBcnZA0kWAIxvtDIPYKnz4YBIXoilBbjgytXL8nw3PkEX27x5yeg9KfxPxO/4CGoi5wfKsYuEynBdWbHtj6a3H0AvA9KIZzktTRNJFU3ZW8UveSCXY4YHl0NREJ8kbIUgkkE7PWeyzGenGFTPMahTA0rKSa+tWPQ1c00lvo9VS3/7pfeJfZEKS7R2xBaEDZrfffHyB5PLTQOGpWl5y40wTn4HdBlyQwoREvobOaKVZEyWtVvJcUeHDPepgEHGVDzwyTelX8Btb6ZNA0Fur8xvpkLZcLmMhbvCdkjq84ztJ36nQQ5JZthecyqcZTWPyfWtPeoUPVIaxn31oLjwsriDwdQmID6twTjC9PT8nBZD/u0JebOCdeYf8fm9q49SaN2w/ZMdSRWucHUsRXeN9O149vYoOqR28H+8v/tYJdqofJpHKrIBs=,iv:GcEV6f4rqkrpCafeaLNMqqU/vBNE0xHbqokL2gMXHYw=,tag:sCHvUgq1w8npedjIAninrA==,type:str]
+    gha-hydra-token: ENC[AES256_GCM,data:CXdOiW9oYaVj4oqfiXSz9O9xIsB5ZyUac2WFSFD1ankZpnmQpv9TwolJxb6h8r+UM7Q9QzCCWk7KHe80lolZhpHa79bpcj+wt9v51ydj0Zy+3sufHS+JnGwmqBbw6dVqJ2uBr4nW2NADzHEbG8N367uKYEq2vazB4y02JiopXL8DHsYcx+Z4u7GJC/gYbpm9vnt8OVdYmfYRQ9BGSiaJOghDzpmCisEZdLpCLXM3cULn8yVUXIFWx8yF/6JrWN+myeoZiUFCL2sZmeSIswFg9kwBKXIsjBrz+EDXZzDCEr88UrEJ0j2+egsrG9BNlstVwC8oscYdbXWmYUdsCBNVxK3xjJYm9gDdSyo0DfSvTzK1t+/s9L1zC8uqj2TXYdVd6QyH2TRXxiPeNLYClRHT2UljymSpIVXOn/Okuo7dte+ZZqZVndT1lwK//2y8V3Hng+5wixfFFsQAd5oJzfraRSnM+RLZtjI3TMoyc5no3pVwV6zsCqRd2nvr7gieXUMWtSLb6YrM6tvhRpeiieYUqQ8NwHV0Avqco0I838o5yywVGSnUflGxnwYoGQIX70qoTcxNPGuiiiqSynh64e3nrlC9xN6EWuFpUNVfkBibZNRi+EyDAhK7LKwiPbL2z919N54vyzzoWA1KUFqxow+JsX+Q8rpnfJtag44F5qFt3/Be5PIMYVU7acXTiVJvM3cKPMQIBPXpQFX5OshwGhttGFuB53aWPHCzlhT4NDQbcZ/rLQ3bcytVpnH55WWze0Oe0zUZYGFc/rV9Fc4QjhR7/8pAi9kGUlKy2MYBamjmnCWlOnHPIQQLpPs/oiW+,iv:KL2P3O8Fnbn56hLX8PWIrigoPTBfIvMUpizKy3C3RIA=,tag:G0M/9iT9IWUSJ5ktUc/g5A==,type:str]
     wakatime-api-key: ENC[AES256_GCM,data:ITu5pRySYGCJ6q9IQ35NfpGX2FyIJRYHGDeBiq0btzIrqitxcFox1Vc=,iv:HsXpyFHV7dG5qORk26BtD+kFo4Jdq2c4fozMpoqyDfU=,tag:uaQoXvvYqNfmRXVDVH8AoQ==,type:str]
-    attic-nix-cache-creator: ENC[AES256_GCM,data:P0iBdy4IYrxcq7v4wTgwwZvAfVdRFo08pi0zvpY9cP9BDCwbBnp+3qDKWL29rC7OxsaLtmRkvPmbkF3ZX3Yu5OaptwVg2Xi0vNqhk3gu5Fdj8ygPigB0ZtimkfWv1QkctoVoXKXuLv6Xd4XKPCWOOIekWlJsBRcyfyzkyFURkU9tBBkXyEAWItho/J8hJr6r00eA3EN4rTe8Ge+PGpfTfpZVpnoGrC35xPnGLq19+b44DectHDTkMZrZKxiCaVIgKUZDLaFgi6a6PsX+L1HQAIZukXJu3m4BPdvzzby+zgX24pVJOYjAUB2BwO9jUlMS6+7qo0p6k01uLicryfKx/ajdAHcy39tFHX7naA4JriC2/FgI2HlFGp0Lc+g0pfdCYwLs5QBfRaOHyrbFWUDG,iv:OBrgnewqBaug00ygAXs0eFs3LqcHqo1EW96N5I38A0o=,tag:V+Gn47O6AH1RwL9qJLpAkw==,type:str]
+    attic-nix-cache-creator: ENC[AES256_GCM,data:ygWuPJfFZQVHtJ83DfB7VB84PNF0knLkOwD4A67NMNp8pU9pA9lI56RSyKDkFd+qYRBSeEXSepbSOA+BhvQaCZiVEiao3LBlh7/6Sp5ni+Rdt3hGKcd+JRQyedEmTkg9h8NbtR6LvI90EiMhyVg6WLCzlGAtFFBcSvIqssrC/KDHCjd4uMzXeW23wUB40dU1PpwkLPtcNVvIzgxqYRsRPFOXZxGxQYGpBWtzDveqgmeLwavhU481wHfCwqpyXJZflbR+UzWdr+zbmSFdJadlLdHeooNGvRC+av0MK4YMCCgu1Em34IeawpiesFhhj/IVGa2xQWjXE0MF3SDLvlh5yMqNPodTZ7FAEZgD7rTYIbaH8JHiYbgI6v7/ANPcFqw2eKT7wVP8cTL1yPedcZcU,iv:J7JYA98NHxM0tExfUdjkir6/+tkOkPLMBNdjXBP9fbA=,tag:WaCWmrzLgr9lDUL+jxeMNA==,type:str]
-    attic-nix-cache-reader: ENC[AES256_GCM,data:DWIkRri3lHJOVXIAbHWJL7cCV4FHjB91bbpPAib/5ZDKap3xjnxUjwswc7wjO1hCoV3+gmep1a64kma6MJts4bcAug5bPyrrPy//rVpCYvSbSmbPz5k4sW5GLU/Sf4NyBevsQo9KRrphpoSUQEFQB27vabYDjjkB051/qJo1B9B7nqmrSyd3np4YdyHAgUiMyJt0oqx8nXySz3XZU+DIM8/OhMZILpnEWIgyP2K7j8JNNpZZJ5sD/icUy6Vba/4LcKjtmYtfQ+HO1soyF6aMiQSjhp7fzJHktwa9kgB3oDzIg3KyCJYS2RNW7mW9Dd1T,iv:fvhGFU22KgknMpJbOkA3v29bKzRVX6hi7V7xJgSUjPg=,tag:TjGSUl0XXS7jlhP/NG4cvQ==,type:str]
+    attic-nix-cache-reader: ENC[AES256_GCM,data:78jJJh332XvFx29HxNW7CULMNMsQ2xMTCIIk5oX5AimBoFXXVH7z9EGFbDimwfaYlsPK6xuU+9mnCnhCjCoGFRX9GQbW+Z2D9TGMsBfe3eztbWlcJ++EkWSCbHKEIGKTF13aRGrKRIOjIy9Gl3qZt4BnZtQPFMOzQO8u80M116u3w4ttqz9rzaIrXWB6GIMI5lWF5rQe5ML1vDgvL2KNMNkPAAm5O1Fv887woVcqxbPhiNhJGXBSiPZpe3PG8wP6z0GTe/GhMTPCOlVJIdsxKnEaRaTSAtVazFos5zSMvLYYrbj6ISoS9tEQ6bFMy6xl,iv:dGDSTtsQlwElerRXpT97uapzOh766bysZTQMjUEEJnM=,tag:OQOYmQqKywdSjUUXnELdpQ==,type:str]
-    attic-nix-cache-writer: ENC[AES256_GCM,data:vxSeys7EJDyatZFpeyxeDzaKGqDtm3atpVly6+BPHUFTrlLaVl86roGZjpBB9wwOMuP007qJNva0HQcTONbSyNw/snUU5JpaFWLT87Eu81V8gdulzHwm61caQ4A/e1ylKkdtwalNymBSyWi9b+SOWXTgralrg9L3OHw+nVuZaAi8QXF2ImLoZ2vXl7MGNXParflV2KK2uqfRatDZMbSSFipT0tQpkNTBTA6l8woILK3BKrHdYq+D8n4EmRowSuMWuN1uknyctb4+Ap3AeBITvyJjKejocQ9qK9plP6CChiC4Z1mmt/HOrfXYXiJO+Va64rOYRywMga8=,iv:bAx7iR24dpIOudkiFOc/xmIG73rcaMDdhWjiBO4BsBM=,tag:gtTyldhdRV97YJREG5lPjA==,type:str]
+    attic-nix-cache-writer: ENC[AES256_GCM,data:IIrGw+MtZEZqJdNGPryN5xKg7UOP+0kjzpthhyRdQz0P3yS/vThSaV+VuduQq5WgnaNjXLA6LBU+cufmVmvrkeTkZ281976sLTbYzrPCW/hCy1+w7qdv6vauaFsLqtnmWlHNwCIkXbUvQWq56WvP6m1PuYaUIFYn3SUprQ1du+X0buK1FUOhSH4HXfiqpNJOomLhok9M0Tyzn8yK5Fn1dzmJ8tsgBczzhWeZzsj4TuksFLV2r6NXzeQp2jWQkxv39Eg6Lf+0eaHxWQFR4s2uKYzwdsDOnpSmUgXFTzVB6RGAEpasKkVZ2NfG4GeUKBFPDVJoR6ilLZA=,iv:e58OGCbgLIIzKfBALtrsYmWg9Gp0nySNYsJ3X5IWp4I=,tag:bnwBipVK3BSOizg8twQ4lQ==,type:str]
-    attic-nix-cache-admin: ENC[AES256_GCM,data:OP02nJTo0cx8M9cR+P7cpI1gEXCKqXWehlaL+dYGwGSUnQ6iSC25vpdZ5SSnjyhiBZe+VnYld+b5PO+OOt7NMGxVvQ0zcuvrG7qfhEpIfGrbx9S9cEV2eAMchG/Hua609MUTbFYKvpwWw6tFZD2dYYQv2gXI7mYSeN0Tw4i2x1f/+cKDtV+ak+UHRgEe/f5OdE8v5I6dRXUQGVOBSRAQkfYDFuI2JUz4oNJsz66YkdMtgudhqWi4mekODD3v2Gcg/zAv1PogaHaIH1BHNvLQ/DsNVcvLsnTb6inM3cTCyPpHcx+VwPO7g9kYNV8xcCRkAIvX6aFzRVT0tJcEXFWStMnKS8nr8HoKFQ==,iv:ftmN3jK5qa6SwrSyhhL3PZls2hTG6xGa0LW7ycdkYxQ=,tag:TQCELzJQjsMfAJseZ7tB4w==,type:str]
+    attic-nix-cache-admin: ENC[AES256_GCM,data:xHJGeU4EUn1HRy2nIValiJ6iLZnYmmT6Njv/cGMh15Q0hJXKNBSsi8f0mAfLI7EX+GaC299VKh2uTlU25jptrAvogLxNJIc+LZBLsSkyGE/ojqqevHMKmZ/6eciLZRQL5ey9TM3V9HHyDOhGaFgdfawtwg/vyvbV13lZBKpqneAX9T3gPRuKRjV4/Uc/5cUckiOF8bQ50xVFN8Cql9HgGDJEGWgg4XUTPu5eYspof2EN63pYvU7wg6HD2begeLDvqc2/i2DIcsc0wqc5DgkY/dH2YtcssBtU8AR9vKpl+HmH/wvt6dfaEyZ7hF7ITGwWnOO6H2ko3SjYRfHkFK3XDmm1YRRjfkptnw==,iv:BdVgNyZ1azl5tKfH+RTeXuNV/rYY6hPvrareKlIXSeQ=,tag:/ar87eAjMod4TmQXoerNBQ==,type:str]
+    gitea-actions-token: ENC[AES256_GCM,data:QTEPMAh1RWWJ/O3yhkQkEBTdVL8XhIRGCDbiM0lLjfILKF4SpSJ2sA==,iv:mBaaB1JHb2KVc9n2pdeX4pSMvb7q5z3joMT7rR5Whgs=,tag:ef+58SI4AUeqUsk3RVDsRQ==,type:str]
+    gitea-pr-token: ENC[AES256_GCM,data:ybTya4X2wd65pNFSGbQkg73lu66GNtSba4yf8J6tT8XkuOtfvtBS4g==,iv:39mJiAlw4kud4l06jOpxOCRumChE/5q8IBNsPHG1rMc=,tag:MEvHD2b9E3fVHLlz7haNyw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1qw5k8h72k3fjg5gmlxx8q8gwlc2k6n6u08d8hdzpm2pk9r0fnfxsmw33nh
           enc: |
@@ -41,8 +39,8 @@ sops:
             ZERFTlFyNjhOb3VCaW43ZXFHT1Vxc0UK7YV+BU7dCEOZxpqkQA394eDsnthvorj6
             7bqrCdeU+6DU7DmFs6++BrNO2tx8vvOa1im+ZGrM/gZAJdv/7R2d6Q==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-26T04:17:36Z"
+    lastmodified: "2025-04-07T23:43:57Z"
-    mac: ENC[AES256_GCM,data:BJ5d3iqdIBwqtnYOYfmsFqnJDXz67uzJ4UKWrjVUEgr4Nc95tE8mEyV40poZk/wAJGJMSDdRhsPmZI4H1xztkjkTsUCUJ2rR+SZ6gP1VhSEXu7bSvv63+bnajZQi9kZrfN0EZN8TLzzVHVvSVHcNEfbq9STWkZq6zCk9E2cUfhk=,iv:MQ/lQkNi/S3bfz1PegcVfwy06RsxdQwZIU6sdOjkhgU=,tag:l5tK1SUwjTolliPkbfNDHg==,type:str]
+    mac: ENC[AES256_GCM,data:ygQzxSpGJqXwkOq7jGDeflA2FTSSxnre/PXm0LxmxzQQW5s7LeIVSI75fMqWir0WU3Pi/xroYGEWjpCG6JvxV5RiJycTONk8VE7c3jtw3AbrHSS0b1K5tJ+Sf+q3rHJFWWk/COrPk8IsRFNb+taqH4jnaH3AAVNo5u0C1CHKMes=,iv:FO2GVDXE8SjjA81/9cDwc+dX8kJ2oHt5kqkhNBuMb54=,tag:hgzRAmsh32SCvJEvKyV+vg==,type:str]
     pgp:
         - created_at: "2024-09-05T06:10:22Z"
           enc: |-
@@ -57,4 +55,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 5EFFB75F7C9B74EAA5C4637547940175096C1330
     unencrypted_suffix: _unencrypted
-    version: 3.9.3
+    version: 3.10.1

utils/attic-push.bash

@@ -6,16 +6,20 @@
 set -e
 
 # retrieve all paths under 2G
-nix_paths=$(nix path-info --json --all --closure-size \
+# nix_paths=$(nix path-info --json --all --closure-size \
-  | jq 'map_values(.closureSize | select(. < 2e9)) | to_entries | sort_by(.value)' \
+#   | jq 'map_values(.closureSize | select(. < 2e9)) | to_entries | sort_by(.value)' \
-  | jq 'map(.key) | join("\n")' | sed -E -e 's/\\n/\n/g;s/^"//g;s/"$//g')
+#   | jq 'map(.key) | join("\n")' | sed -E -e 's/\\n/\n/g;s/^"//g;s/"$//g')
+
+# retrieve all paths
+nix_paths=$(nix path-info --json --all --closure-size |
+  jq 'map_values(.closureSize | select(true)) | to_entries | sort_by(.value)' |
+  jq 'map(.key) | join("\n")' | sed -E -e 's/\\n/\n/g;s/^"//g;s/"$//g')
 
 readarray -t nix_path_array < <(echo "$nix_paths")
 
 batchsize=1000
 
-for((i=0; i < ${#nix_path_array[@]}; i+=batchsize))
+for ((i = 0; i < ${#nix_path_array[@]}; i += batchsize)); do
-do
   part=("${nix_path_array[@]:i:batchsize}")
 
   attic push nix-cache "${part[@]}"

utils/sops-mergetool-new.sh

@@ -2,7 +2,10 @@
 
 # Rename CLI parameters to friendlier names
 # https://git-scm.com/docs/gitattributes#_defining_a_custom_merge_driver
-base="$1"; local_="$2"; remote="$3"; merged="$4"
+base="$1"
+local_="$2"
+remote="$3"
+merged="$4"
 
 # Load the mergetool scripts
 TOOL_MODE=merge
@@ -62,4 +65,3 @@ run_merge_tool "${mergetool}" true
 
 # Re-encrypt content
 sops --encrypt "$merged_decrypted" >"$merged"
-

utils/sops-mergetool.sh

@@ -6,7 +6,10 @@ set -x
 
 # Rename our variables to friendlier equivalents
 # https://git-scm.com/docs/gitattributes#_defining_a_custom_merge_driver
-base="$1"; local_="$2"; remote="$3"; merged="$4"
+base="$1"
+local_="$2"
+remote="$3"
+merged="$4"
 
 echo "$base"
 echo "$local_"
@@ -18,7 +21,7 @@ echo "$merged"
 mergetool="$(git config --get merge.tool)"
 GIT_DIR="$(git --exec-path)"
 if test "$mergetool" = ""; then
-  echo "No default \`merge.tool\` was set for \`git\`. Please set one via \`git config --set merge.tool <tool>\`" 1>&2
+  echo 'No default `merge.tool` was set for `git`. Please set one via `git config --set merge.tool <tool>`' 1>&2
   exit 1
 fi
 
@@ -83,4 +86,3 @@ set -eu
 
 # Re-encrypt content
 sops --encrypt "$merged_decrypted" >"$merged"
-