git: Blame-ignore nixfmt commit

Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/0257e44f4ad472b54f19a6dd1615aee7fa48ed49' (2024-08-05)
  → 'github:nix-community/disko/276a0d055a720691912c6a34abb724e395c8e38a' (2024-08-15)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/0ab9c4c1e0cab782fcde00ec2b32436abfd2a6d4' (2024-08-05)
  → 'github:nixos/nixpkgs/1cbd3d585263dc620c483e138d352a39b9f0e3ec' (2024-08-17)
• Updated input 'nixpkgs-unstable':
    'github:nixos/nixpkgs/41d21a82c38e226e234e16f4ff213b3fcf85e6e9' (2024-08-05)
  → 'github:nixos/nixpkgs/abcef4da4ebb72240bddc370a27263627e64877f' (2024-08-18)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/eb34eb588132d653e4c4925d862f1e5a227cc2ab' (2024-07-27)
  → 'github:Mic92/sops-nix/be0eec2d27563590194a9206f551a6f73d52fa34' (2024-08-12)

.git-blame-ignore-revs

@@ -1,6 +1,9 @@
 # Run this command to always ignore formatting commits in `git blame`
 # git config blame.ignoreRevsFile .git-blame-ignore-revs
 
+# Switch to nixfmt formatting
+04f7a7ef1d38906163afc9cddfa8ce2b0ebf3b45
+
 # Switch to nixpkgs-fmt formatting
 fd138d45e6a2cad89fead6e9f246ba282070d6b7
 

configuration/default.nix

@@ -1,10 +1,12 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, modulesPath
+  lib,
-, flake-inputs
+  modulesPath,
-, ...
+  flake-inputs,
-}: {
+  ...
+}:
+{
   imports = [
     flake-inputs.disko.nixosModules.disko
     flake-inputs.sops-nix.nixosModules.sops
@@ -24,7 +26,7 @@
     ./services/nextcloud.nix
     ./services/webserver.nix
     ./services/wireguard.nix
-    ./services/starbound.nix
+    # ./services/starbound.nix -- Not currently used
     ./services/postgres.nix
     ./nginx.nix
     ./sops.nix
@@ -49,12 +51,12 @@
     settings.trusted-users = [ "@wheel" ];
   };
 
-  nixpkgs.config.allowUnfreePredicate = pkg:
-    builtins.elem (lib.getName pkg) [ "steam-original" "steam-runtime" "steam-run" "steamcmd" ];
-
   # Optimization for minecraft servers, see:
   # https://bugs.mojang.com/browse/MC-183518
-  boot.kernelParams = [ "highres=off" "nohz=off" ];
+  boot.kernelParams = [
+    "highres=off"
+    "nohz=off"
+  ];
 
   networking = {
     usePredictableInterfaceNames = false;

configuration/hardware-specific/hetzner/default.nix

@@ -25,9 +25,7 @@
         };
       }
       # IPv6
-      {
+      { addressConfig.Address = "2a01:4f8:10b:3c85::2/64"; }
-        addressConfig.Address = "2a01:4f8:10b:3c85::2/64";
-      }
     ];
 
     networkConfig = {

configuration/hardware-specific/hetzner/disko.nix

@@ -19,7 +19,10 @@
         };
       };
 
-      mountOptions = [ "compress=zstd" "noatime" ];
+      mountOptions = [
+        "compress=zstd"
+        "noatime"
+      ];
     in
     {
       sda = {
@@ -54,7 +57,15 @@
                 type = "btrfs";
                 # Hack to get multi-device btrfs going
                 # See https://github.com/nix-community/disko/issues/99
-                extraArgs = [ "-d" "raid1" "-m" "raid1" "--runtime-features" "quota" "/dev/sda3" ];
+                extraArgs = [
+                  "-d"
+                  "raid1"
+                  "-m"
+                  "raid1"
+                  "--runtime-features"
+                  "quota"
+                  "/dev/sda3"
+                ];
                 subvolumes = {
                   "/volume" = { };
                   "/volume/root" = {

configuration/hardware-specific/vm.nix

@@ -1,4 +1,5 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   users.users.tlater.password = "insecure";
 
   # Disable graphical tty so -curses works

configuration/nginx.nix

@@ -1,7 +1,5 @@
-{ config
+{ config, lib, ... }:
-, lib
+{
-, ...
-}: {
   services.nginx = {
     enable = true;
     recommendedTlsSettings = true;
@@ -26,26 +24,23 @@
       # Override the default, just keep fewer logs
       nginx.rotate = 6;
     }
-    // lib.mapAttrs'
+    // lib.mapAttrs' (
-      (virtualHost: _:
+      virtualHost: _:
-        lib.nameValuePair "/var/log/nginx/${virtualHost}/access.log" {
+      lib.nameValuePair "/var/log/nginx/${virtualHost}/access.log" {
-          frequency = "daily";
+        frequency = "daily";
-          rotate = 2;
+        rotate = 2;
-          compress = true;
+        compress = true;
-          delaycompress = true;
+        delaycompress = true;
-          su = "${config.services.nginx.user} ${config.services.nginx.group}";
+        su = "${config.services.nginx.user} ${config.services.nginx.group}";
-          postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
+        postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
-        })
+      }
-      config.services.nginx.virtualHosts;
+    ) config.services.nginx.virtualHosts;
 
-  systemd.tmpfiles.rules =
+  systemd.tmpfiles.rules = lib.mapAttrsToList (
-    lib.mapAttrsToList
+    virtualHost: _:
-      (
+    #
-        virtualHost: _:
+    "d /var/log/nginx/${virtualHost} 0750 ${config.services.nginx.user} ${config.services.nginx.group}"
-          #
+  ) config.services.nginx.virtualHosts;
-          "d /var/log/nginx/${virtualHost} 0750 ${config.services.nginx.user} ${config.services.nginx.group}"
-      )
-      config.services.nginx.virtualHosts;
 
   security.acme = {
     defaults.email = "tm@tlater.net";
@@ -61,8 +56,8 @@
 
   services.backups.acme = {
     user = "acme";
-    paths =
+    paths = lib.mapAttrsToList (
-      lib.mapAttrsToList (virtualHost: _: "/var/lib/acme/${virtualHost}")
+      virtualHost: _: "/var/lib/acme/${virtualHost}"
-        config.services.nginx.virtualHosts;
+    ) config.services.nginx.virtualHosts;
   };
 }

configuration/services/afvalcalendar.nix

@@ -1,7 +1,5 @@
-{ pkgs
+{ pkgs, config, ... }:
-, config
+{
-, ...
-}: {
   systemd.services.afvalcalendar = {
     description = "Enschede afvalcalendar -> ical converter";
     wantedBy = [ "multi-user.target" ];
@@ -25,16 +23,23 @@
       ProtectKernelModules = true;
       ProtectKernelLogs = true;
       ProtectControlGroups = true;
-      RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+      RestrictAddressFamilies = [
+        "AF_UNIX"
+        "AF_INET"
+        "AF_INET6"
+      ];
       RestrictNamespaces = true;
       LockPersonality = true;
       MemoryDenyWriteExecute = true;
       RestrictRealtime = true;
       RestrictSUIDSGID = true;
       SystemCallArchitectures = "native";
-      SystemCallFilter = [ "@system-service" "~@privileged @resources @setuid @keyring" ];
+      SystemCallFilter = [
+        "@system-service"
+        "~@privileged @resources @setuid @keyring"
+      ];
 
-      Umask = 0002;
+      Umask = 2;
       SupplementaryGroups = "afvalcalendar-hosting";
 
       ReadWritePaths = "/srv/afvalcalendar";

configuration/services/backups.nix

@@ -1,29 +1,35 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
 let
   inherit (lib) types optional singleton;
-  mkShutdownScript = service:
+  mkShutdownScript =
+    service:
     pkgs.writeShellScript "backup-${service}-shutdown" ''
       if systemctl is-active --quiet '${service}'; then
         touch '/tmp/${service}-was-active'
         systemctl stop '${service}'
       fi
     '';
-  mkRestartScript = service:
+  mkRestartScript =
+    service:
     pkgs.writeShellScript "backup-${service}-restart" ''
       if [ -f '/tmp/${service}-was-active' ]; then
         rm '/tmp/${service}-was-active'
         systemctl start '${service}'
       fi
     '';
-  writeScript = name: packages: text:
+  writeScript =
-    lib.getExe (pkgs.writeShellApplication {
+    name: packages: text:
-      inherit name text;
+    lib.getExe (
-      runtimeInputs = packages;
+      pkgs.writeShellApplication {
-    });
+        inherit name text;
+        runtimeInputs = packages;
+      }
+    );
 
   # *NOT* a TOML file, for some reason quotes are interpreted
   # *literally
@@ -49,85 +55,87 @@ in
       description = lib.mdDoc ''
         Configure restic backups with a specific tag.
       '';
-      type = types.attrsOf (types.submodule ({ config
+      type = types.attrsOf (
-                                             , name
+        types.submodule (
-                                             , ...
+          { config, name, ... }:
-                                             }: {
+          {
-        options = {
+            options = {
-          user = lib.mkOption {
+              user = lib.mkOption {
-            type = types.str;
+                type = types.str;
-            description = ''
+                description = ''
-              The user as which to run the backup.
+                  The user as which to run the backup.
-            '';
+                '';
-          };
+              };
-          paths = lib.mkOption {
+              paths = lib.mkOption {
-            type = types.listOf types.str;
+                type = types.listOf types.str;
-            description = ''
+                description = ''
-              The paths to back up.
+                  The paths to back up.
-            '';
+                '';
-          };
+              };
-          tag = lib.mkOption {
+              tag = lib.mkOption {
-            type = types.str;
+                type = types.str;
-            description = ''
+                description = ''
-              The restic tag to mark the backup with.
+                  The restic tag to mark the backup with.
-            '';
+                '';
-            default = name;
+                default = name;
-          };
+              };
-          preparation = {
+              preparation = {
-            packages = lib.mkOption {
+                packages = lib.mkOption {
-              type = types.listOf types.package;
+                  type = types.listOf types.package;
-              default = [ ];
+                  default = [ ];
-              description = ''
+                  description = ''
-                The list of packages to make available in the
+                    The list of packages to make available in the
-                preparation script.
+                    preparation script.
-              '';
+                  '';
-            };
+                };
-            text = lib.mkOption {
+                text = lib.mkOption {
-              type = types.nullOr types.str;
+                  type = types.nullOr types.str;
-              default = null;
+                  default = null;
-              description = ''
+                  description = ''
-                The preparation script to run before the backup.
+                    The preparation script to run before the backup.
 
-                This should include things like database dumps and
+                    This should include things like database dumps and
-                enabling maintenance modes. If a service needs to be
+                    enabling maintenance modes. If a service needs to be
-                shut down for backups, use `pauseServices` instead.
+                    shut down for backups, use `pauseServices` instead.
-              '';
+                  '';
-            };
+                };
-          };
+              };
-          cleanup = {
+              cleanup = {
-            packages = lib.mkOption {
+                packages = lib.mkOption {
-              type = types.listOf types.package;
+                  type = types.listOf types.package;
-              default = [ ];
+                  default = [ ];
-              description = ''
+                  description = ''
-                The list of packages to make available in the
+                    The list of packages to make available in the
-                cleanup script.
+                    cleanup script.
-              '';
+                  '';
-            };
+                };
-            text = lib.mkOption {
+                text = lib.mkOption {
-              type = types.nullOr types.str;
+                  type = types.nullOr types.str;
-              default = null;
+                  default = null;
-              description = ''
+                  description = ''
-                The cleanup script to run after the backup.
+                    The cleanup script to run after the backup.
 
-                This should do things like cleaning up database dumps
+                    This should do things like cleaning up database dumps
-                and disabling maintenance modes.
+                    and disabling maintenance modes.
-              '';
+                  '';
-            };
+                };
-          };
+              };
-          pauseServices = lib.mkOption {
+              pauseServices = lib.mkOption {
-            type = types.listOf types.str;
+                type = types.listOf types.str;
-            default = [ ];
+                default = [ ];
-            description = ''
+                description = ''
-              The systemd services that need to be shut down before
+                  The systemd services that need to be shut down before
-              the backup can run. Services will be restarted after the
+                  the backup can run. Services will be restarted after the
-              backup is complete.
+                  backup is complete.
 
-              This is intended to be used for services that do not
+                  This is intended to be used for services that do not
-              support hot backups.
+                  support hot backups.
-            '';
+                '';
-          };
+              };
-        };
+            };
-      }));
+          }
+        )
+      );
     };
   };
 
@@ -164,58 +172,68 @@ in
           };
         };
       }
-      // lib.mapAttrs'
+      // lib.mapAttrs' (
-        (name: backup:
+        name: backup:
-          lib.nameValuePair "backup-${name}" {
+        lib.nameValuePair "backup-${name}" {
-            # Don't want to restart mid-backup
+          # Don't want to restart mid-backup
-            restartIfChanged = false;
+          restartIfChanged = false;
 
-            environment =
+          environment = resticEnv // {
-              resticEnv
+            RESTIC_CACHE_DIR = "%C/backup-${name}";
-              // {
+          };
-                RESTIC_CACHE_DIR = "%C/backup-${name}";
-              };
 
-            path = with pkgs; [
+          path = with pkgs; [
-              coreutils
+            coreutils
-              openssh
+            openssh
-              rclone
+            rclone
-              restic
+            restic
+          ];
+
+          # TODO(tlater): If I ever add more than one repo, service
+          # shutdown/restarting will potentially break if multiple
+          # backups for the same service overlap. A more clever
+          # sentinel file with reference counts would probably solve
+          # this.
+          serviceConfig = {
+            User = backup.user;
+            Group = "backup";
+            RuntimeDirectory = "backup-${name}";
+            CacheDirectory = "backup-${name}";
+            CacheDirectoryMode = "0700";
+            PrivateTmp = true;
+
+            ExecStart = [
+              (lib.concatStringsSep " " (
+                [
+                  "${pkgs.restic}/bin/restic"
+                  "backup"
+                  "--tag"
+                  name
+                ]
+                ++ backup.paths
+              ))
             ];
 
-            # TODO(tlater): If I ever add more than one repo, service
+            ExecStartPre =
-            # shutdown/restarting will potentially break if multiple
+              map (service: "+${mkShutdownScript service}") backup.pauseServices
-            # backups for the same service overlap. A more clever
+              ++ singleton (
-            # sentinel file with reference counts would probably solve
+                writeScript "backup-${name}-repo-init" [ ] ''
-            # this.
-            serviceConfig = {
-              User = backup.user;
-              Group = "backup";
-              RuntimeDirectory = "backup-${name}";
-              CacheDirectory = "backup-${name}";
-              CacheDirectoryMode = "0700";
-              PrivateTmp = true;
-
-              ExecStart = [
-                (lib.concatStringsSep " " ([ "${pkgs.restic}/bin/restic" "backup" "--tag" name ] ++ backup.paths))
-              ];
-
-              ExecStartPre =
-                map (service: "+${mkShutdownScript service}") backup.pauseServices
-                ++ singleton (writeScript "backup-${name}-repo-init" [ ] ''
                   restic snapshots || restic init
-                '')
+                ''
-                ++ optional (backup.preparation.text != null)
+              )
-                  (writeScript "backup-${name}-prepare" backup.preparation.packages backup.preparation.text);
+              ++ optional (backup.preparation.text != null) (
+                writeScript "backup-${name}-prepare" backup.preparation.packages backup.preparation.text
+              );
 
-              # TODO(tlater): Add repo pruning/checking
+            # TODO(tlater): Add repo pruning/checking
-              ExecStopPost =
+            ExecStopPost =
-                map (service: "+${mkRestartScript service}") backup.pauseServices
+              map (service: "+${mkRestartScript service}") backup.pauseServices
-                ++ optional (backup.cleanup.text != null)
+              ++ optional (backup.cleanup.text != null) (
-                  (writeScript "backup-${name}-cleanup" backup.cleanup.packages backup.cleanup.text);
+                writeScript "backup-${name}-cleanup" backup.cleanup.packages backup.cleanup.text
-            };
+              );
-          })
+          };
-        config.services.backups;
+        }
+      ) config.services.backups;
 
     systemd.timers =
       {
@@ -227,18 +245,18 @@ in
           # of the backup jobs.
         };
       }
-      // lib.mapAttrs'
+      // lib.mapAttrs' (
-        (name: backup:
+        name: backup:
-          lib.nameValuePair "backup-${name}" {
+        lib.nameValuePair "backup-${name}" {
-            wantedBy = [ "timers.target" ];
+          wantedBy = [ "timers.target" ];
-            timerConfig = {
+          timerConfig = {
-              OnCalendar = "Wednesday 02:30:00 UTC";
+            OnCalendar = "Wednesday 02:30:00 UTC";
-              RandomizedDelaySec = "1h";
+            RandomizedDelaySec = "1h";
-              FixedRandomDelay = true;
+            FixedRandomDelay = true;
-              Persistent = true;
+            Persistent = true;
-            };
+          };
-          })
+        }
-        config.services.backups;
+      ) config.services.backups;
 
     users = {
       # This user is only used to own the ssh key, because apparently

configuration/services/battery-manager.nix

@@ -1,10 +1,6 @@
-{ config
+{ config, flake-inputs, ... }:
-, flake-inputs
+{
-, ...
+  imports = [ flake-inputs.sonnenshift.nixosModules.default ];
-}: {
-  imports = [
-    flake-inputs.sonnenshift.nixosModules.default
-  ];
 
   services.batteryManager = {
     enable = true;

configuration/services/conduit.nix

@@ -1,7 +1,8 @@
-{ pkgs
+{
-, config
+  pkgs,
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
 let
   inherit (lib.strings) concatMapStringsSep;
@@ -18,6 +19,13 @@ in
       server_name = domain;
       database_backend = "rocksdb";
 
+      # Set up delegation: https://docs.conduit.rs/delegation.html#automatic-recommended
+      # This is primarily to make sliding sync work
+      well_known = {
+        client = "https://${domain}";
+        server = "${domain}:443";
+      };
+
       turn_uris =
         let
           address = "${config.services.coturn.realm}:${toString config.services.coturn.listening-port}";
@@ -35,28 +43,30 @@ in
   systemd.services.heisenbridge =
     let
       replaceSecretBin = "${pkgs.replace-secret}/bin/replace-secret";
-      registrationFile = builtins.toFile "heisenbridge-registration.yaml" (builtins.toJSON {
+      registrationFile = builtins.toFile "heisenbridge-registration.yaml" (
-        id = "heisenbridge";
+        builtins.toJSON {
-        url = "http://127.0.0.1:9898";
+          id = "heisenbridge";
-        as_token = "@AS_TOKEN@";
+          url = "http://127.0.0.1:9898";
-        hs_token = "@HS_TOKEN@";
+          as_token = "@AS_TOKEN@";
-        rate_limited = false;
+          hs_token = "@HS_TOKEN@";
-        sender_localpart = "heisenbridge";
+          rate_limited = false;
-        namespaces = {
+          sender_localpart = "heisenbridge";
-          users = [
+          namespaces = {
-            {
+            users = [
-              regex = "@irc_.*";
+              {
-              exclusive = true;
+                regex = "@irc_.*";
-            }
+                exclusive = true;
-            {
+              }
-              regex = "@heisenbridge:.*";
+              {
-              exclusive = true;
+                regex = "@heisenbridge:.*";
-            }
+                exclusive = true;
-          ];
+              }
-          aliases = [ ];
+            ];
-          rooms = [ ];
+            aliases = [ ];
-        };
+            rooms = [ ];
-      });
+          };
+        }
+      );
 
       # TODO(tlater): Starting with systemd 253 it will become possible
       # to do the credential setup as part of ExecStartPre/preStart
@@ -107,7 +117,7 @@ in
         RestrictRealtime = true;
         ProtectProc = "invisible";
         ProcSubset = "pid";
-        UMask = 0077;
+        UMask = 77;
 
         # For the identd port
         # CapabilityBoundingSet = ["CAP_NET_BIND_SERVICE"];
@@ -127,9 +137,7 @@ in
     use-auth-secret = true;
     static-auth-secret-file = config.sops.secrets."turn/secret".path;
     realm = turn-realm;
-    relay-ips = [
+    relay-ips = [ "116.202.158.55" ];
-      "116.202.158.55"
-    ];
 
     # SSL config
     #
@@ -230,28 +238,15 @@ in
           proxy_buffering off;
         '';
       };
-
+      "/.well-known/matrix" = {
-      # Add Element X support
+        proxyPass = "http://${cfg.settings.global.address}:${toString cfg.settings.global.port}";
-      # TODO(tlater): Remove when no longer required: https://github.com/vector-im/element-x-android/issues/1085
-      "=/.well-known/matrix/client" = {
-        alias = pkgs.writeText "well-known-matrix-client" (builtins.toJSON {
-          "m.homeserver".base_url = "https://${domain}";
-          "org.matrix.msc3575.proxy".url = "https://${domain}";
-        });
-
-        extraConfig = ''
-          default_type application/json;
-          add_header Access-Control-Allow-Origin "*";
-        '';
       };
     };
   };
 
   services.backups.conduit = {
     user = "root";
-    paths = [
+    paths = [ "/var/lib/private/matrix-conduit/" ];
-      "/var/lib/private/matrix-conduit/"
-    ];
     # Other services store their data in conduit, so no other services
     # need to be shut down currently.
     pauseServices = [ "conduit.service" ];

configuration/services/fail2ban.nix

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   services.fail2ban = {
     enable = true;
     extraPackages = [ pkgs.ipset ];

configuration/services/foundryvtt.nix

@@ -1,7 +1,9 @@
-{ lib
+{
-, config
+  lib,
-, flake-inputs
+  config,
-, ...
+  flake-inputs,
+  pkgs,
+  ...
 }:
 let
   domain = "foundryvtt.${config.services.nginx.domain}";
@@ -15,6 +17,7 @@ in
     minifyStaticFiles = true;
     proxySSL = true;
     proxyPort = 443;
+    package = flake-inputs.foundryvtt.packages.${pkgs.system}.foundryvtt_11;
   };
 
   # Want to start it manually when I need it, not have it constantly
@@ -38,9 +41,7 @@ in
 
   services.backups.foundryvtt = {
     user = "foundryvtt";
-    paths = [
+    paths = [ config.services.foundryvtt.dataDir ];
-      config.services.foundryvtt.dataDir
-    ];
     pauseServices = [ "foundryvtt.service" ];
   };
 }

configuration/services/gitea.nix

@@ -1,7 +1,8 @@
-{ pkgs
+{
-, config
+  pkgs,
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
 let
   domain = "gitea.${config.services.nginx.domain}";
@@ -34,9 +35,7 @@ in
       secretPath = config.sops.secrets."forgejo/metrics-token".path;
       runConfig = "${config.services.forgejo.customDir}/conf/app.ini";
     in
-    [
+    [ "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'" ];
-      "+${replaceSecretBin} '#metricstoken#' '${secretPath}' '${runConfig}'"
-    ];
 
   # Set up SSL
   services.nginx.virtualHosts."${domain}" =

configuration/services/metrics/exporters.nix

@@ -1,7 +1,8 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
+  ...
 }:
 let
   yaml = pkgs.formats.yaml { };
@@ -20,9 +21,7 @@ in
               "tlater.com"
             ];
           in
-          [
+          [ "--config=${yaml.generate "domains.yml" conf}" ];
-            "--config=${yaml.generate "domains.yml" conf}"
-          ];
       };
 
       # System statistics
@@ -51,26 +50,21 @@ in
         listenAddress = "127.0.0.1";
         group = "nginx";
 
-        settings.namespaces =
+        settings.namespaces = lib.mapAttrsToList (name: virtualHost: {
-          lib.mapAttrsToList
+          inherit name;
-            (name: virtualHost: {
+          metrics_override.prefix = "nginxlog";
-              inherit name;
+          namespace_label = "vhost";
-              metrics_override.prefix = "nginxlog";
-              namespace_label = "vhost";
 
-              format = lib.concatStringsSep " " [
+          format = lib.concatStringsSep " " [
-                "$remote_addr - $remote_user [$time_local]"
+            "$remote_addr - $remote_user [$time_local]"
-                ''"$request" $status $body_bytes_sent''
+            ''"$request" $status $body_bytes_sent''
-                ''"$http_referer" "$http_user_agent"''
+            ''"$http_referer" "$http_user_agent"''
-                ''rt=$request_time uct="$upstream_connect_time"''
+            ''rt=$request_time uct="$upstream_connect_time"''
-                ''uht="$upstream_header_time" urt="$upstream_response_time"''
+            ''uht="$upstream_header_time" urt="$upstream_response_time"''
-              ];
+          ];
 
-              source.files = [
+          source.files = [ "/var/log/nginx/${name}/access.log" ];
-                "/var/log/nginx/${name}/access.log"
+        }) config.services.nginx.virtualHosts;
-              ];
-            })
-            config.services.nginx.virtualHosts;
       };
     };
 
@@ -86,7 +80,11 @@ in
             requires = [ "fail2ban.service" ];
             serviceConfig = {
               Group = "fail2ban";
-              RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+              RestrictAddressFamilies = [
+                "AF_UNIX"
+                "AF_INET"
+                "AF_INET6"
+              ];
               ExecStart = lib.concatStringsSep " " [
                 "${pkgs.local.prometheus-fail2ban-exporter}/bin/fail2ban-prometheus-exporter"
                 "--collector.f2b.socket=/var/run/fail2ban/fail2ban.sock"

configuration/services/metrics/grafana.nix

@@ -42,6 +42,12 @@ in
     forceSSL = true;
     useACMEHost = "tlater.net";
     enableHSTS = true;
-    locations."/".proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
+    locations = {
+      "/".proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
+      "/api/live" = {
+        proxyWebsockets = true;
+        proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
+      };
+    };
   };
 }

configuration/services/metrics/options.nix

@@ -1,7 +1,8 @@
-{ pkgs
+{
-, config
+  pkgs,
-, lib
+  config,
-, ...
+  lib,
+  ...
 }:
 let
   inherit (lib) types mkOption mkDefault;
@@ -11,87 +12,94 @@ in
   options = {
     services.prometheus = {
       extraExporters = mkOption {
-        type = types.attrsOf (types.submodule {
+        type = types.attrsOf (
-          options = {
+          types.submodule {
-            port = mkOption {
+            options = {
-              type = types.int;
+              port = mkOption {
-              description = "The port on which this exporter listens.";
+                type = types.int;
+                description = "The port on which this exporter listens.";
+              };
+              listenAddress = mkOption {
+                type = types.str;
+                default = "127.0.0.1";
+                description = "Address to listen on.";
+              };
+              serviceOpts = mkOption {
+                type = types.attrs;
+                description = "An attrset to be merged with the exporter's systemd service.";
+              };
             };
-            listenAddress = mkOption {
+          }
-              type = types.str;
+        );
-              default = "127.0.0.1";
-              description = "Address to listen on.";
-            };
-            serviceOpts = mkOption {
-              type = types.attrs;
-              description = "An attrset to be merged with the exporter's systemd service.";
-            };
-          };
-        });
       };
     };
 
     services.victoriametrics.scrapeConfigs = mkOption {
-      type = types.attrsOf (types.submodule ({ name
+      type = types.attrsOf (
-                                             , self
+        types.submodule (
-                                             , ...
+          { name, self, ... }:
-                                             }: {
+          {
-        options = {
+            options = {
-          job_name = mkOption {
+              job_name = mkOption {
-            type = types.str;
+                type = types.str;
-            default = name;
+                default = name;
-          };
-
-          extraSettings = mkOption {
-            type = types.anything;
-            description = ''
-              Other settings to set for this scrape config.
-            '';
-            default = { };
-          };
-
-          targets = mkOption {
-            type = types.listOf types.str;
-            description = lib.mdDoc ''
-              Addresses scrape targets for this config listen on.
-
-              Shortcut for `static_configs = lib.singleton {targets = [<targets>];}`
-            '';
-            default = [ ];
-          };
-
-          static_configs = mkOption {
-            default = [ ];
-            type = types.listOf (types.submodule {
-              options = {
-                targets = mkOption {
-                  type = types.listOf types.str;
-                  description = lib.mdDoc ''
-                    The addresses scrape targets for this config listen on.
-
-                    Must in `listenAddress:port` format.
-                  '';
-                };
-                labels = mkOption {
-                  type = types.attrsOf types.str;
-                  description = lib.mdDoc ''
-                    Labels to apply to all targets defined for this static config.
-                  '';
-                  default = { };
-                };
               };
-            });
+
-          };
+              extraSettings = mkOption {
-        };
+                type = types.anything;
-      }));
+                description = ''
+                  Other settings to set for this scrape config.
+                '';
+                default = { };
+              };
+
+              targets = mkOption {
+                type = types.listOf types.str;
+                description = lib.mdDoc ''
+                  Addresses scrape targets for this config listen on.
+
+                  Shortcut for `static_configs = lib.singleton {targets = [<targets>];}`
+                '';
+                default = [ ];
+              };
+
+              static_configs = mkOption {
+                default = [ ];
+                type = types.listOf (
+                  types.submodule {
+                    options = {
+                      targets = mkOption {
+                        type = types.listOf types.str;
+                        description = lib.mdDoc ''
+                          The addresses scrape targets for this config listen on.
+
+                          Must in `listenAddress:port` format.
+                        '';
+                      };
+                      labels = mkOption {
+                        type = types.attrsOf types.str;
+                        description = lib.mdDoc ''
+                          Labels to apply to all targets defined for this static config.
+                        '';
+                        default = { };
+                      };
+                    };
+                  }
+                );
+              };
+            };
+          }
+        )
+      );
     };
   };
 
   config = {
     systemd.services = lib.mkMerge [
-      (lib.mapAttrs'
+      (lib.mapAttrs' (
-        (name: exporter:
+        name: exporter:
-          lib.nameValuePair "prometheus-${name}-exporter" (lib.mkMerge [
+        lib.nameValuePair "prometheus-${name}-exporter" (
+          lib.mkMerge [
             {
               # Shamelessly copied from upstream because the upstream
               # module is an intractable mess
@@ -117,7 +125,10 @@ in
               serviceConfig.ProtectKernelTunables = true;
               serviceConfig.ProtectSystem = mkDefault "strict";
               serviceConfig.RemoveIPC = true;
-              serviceConfig.RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+              serviceConfig.RestrictAddressFamilies = [
+                "AF_INET"
+                "AF_INET6"
+              ];
               serviceConfig.RestrictNamespaces = true;
               serviceConfig.RestrictRealtime = true;
               serviceConfig.RestrictSUIDSGID = true;
@@ -125,8 +136,9 @@ in
               serviceConfig.UMask = "0077";
             }
             exporter.serviceOpts
-          ]))
+          ]
-        config.services.prometheus.extraExporters)
+        )
+      ) config.services.prometheus.extraExporters)
 
       {
         vmagent-scrape-exporters =
@@ -134,24 +146,25 @@ in
             listenAddress = config.services.victoriametrics.listenAddress;
             vmAddr = (lib.optionalString (lib.hasPrefix ":" listenAddress) "127.0.0.1") + listenAddress;
             promscrape = yaml.generate "prometheus.yml" {
-              scrape_configs = lib.mapAttrsToList
+              scrape_configs = lib.mapAttrsToList (
-                (_: scrape:
+                _: scrape:
-                  lib.recursiveUpdate
+                lib.recursiveUpdate {
-                    {
+                  inherit (scrape) job_name;
-                      inherit (scrape) job_name;
+                  static_configs =
-                      static_configs =
+                    scrape.static_configs
-                        scrape.static_configs
+                    ++ lib.optional (scrape.targets != [ ]) { targets = scrape.targets; };
-                        ++ lib.optional (scrape.targets != [ ]) { targets = scrape.targets; };
+                } scrape.extraSettings
-                    }
+              ) config.services.victoriametrics.scrapeConfigs;
-                    scrape.extraSettings)
-                config.services.victoriametrics.scrapeConfigs;
             };
           in
           {
             enable = true;
             path = [ pkgs.victoriametrics ];
             wantedBy = [ "multi-user.target" ];
-            after = [ "network.target" "victoriametrics.service" ];
+            after = [
+              "network.target"
+              "victoriametrics.service"
+            ];
             serviceConfig = {
               ExecStart = [
                 (lib.concatStringsSep " " [
@@ -180,7 +193,10 @@ in
               ProtectKernelTunables = true;
               ProtectSystem = "strict";
               RemoveIPC = true;
-              RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+              RestrictAddressFamilies = [
+                "AF_INET"
+                "AF_INET6"
+              ];
               RestrictNamespaces = true;
               RestrictRealtime = true;
               RestrictSUIDSGID = true;
@@ -195,19 +211,15 @@ in
 
     services.victoriametrics.scrapeConfigs =
       let
-        allExporters =
+        allExporters = lib.mapAttrs (name: exporter: { inherit (exporter) listenAddress port; }) (
-          lib.mapAttrs
+          (lib.filterAttrs (
-            (name: exporter: {
+            _: exporter: builtins.isAttrs exporter && exporter.enable
-              inherit (exporter) listenAddress port;
+          ) config.services.prometheus.exporters)
-            })
+          // config.services.prometheus.extraExporters
-            ((lib.filterAttrs (_: exporter: builtins.isAttrs exporter && exporter.enable)
+        );
-              config.services.prometheus.exporters)
-            // config.services.prometheus.extraExporters);
       in
-      lib.mapAttrs
+      lib.mapAttrs (_: exporter: {
-        (_: exporter: {
+        targets = [ "${exporter.listenAddress}:${toString exporter.port}" ];
-          targets = [ "${exporter.listenAddress}:${toString exporter.port}" ];
+      }) allExporters;
-        })
-        allExporters;
   };
 }

configuration/services/metrics/victoriametrics.nix

@@ -1,9 +1,8 @@
-{ config, ... }: {
+{ config, ... }:
+{
   config.services.victoriametrics = {
     enable = true;
-    extraOptions = [
+    extraOptions = [ "-storage.minFreeDiskSpaceBytes=5GB" ];
-      "-storage.minFreeDiskSpaceBytes=5GB"
-    ];
 
     scrapeConfigs = {
       forgejo = {

configuration/services/nextcloud.nix

@@ -1,12 +1,14 @@
-{ pkgs
+{
-, config
+  pkgs,
-, ...
+  config,
+  lib,
+  ...
 }:
 let
   # Update pending on rewrite of nextcloud news, though there is an
   # alpha to switch to if it becomes necessary:
   # https://github.com/nextcloud/news/issues/2610
-  nextcloud = pkgs.nextcloud27;
+  nextcloud = pkgs.nextcloud28;
   hostName = "nextcloud.${config.services.nginx.domain}";
 in
 {
@@ -14,6 +16,20 @@ in
     inherit hostName;
 
     package = nextcloud;
+    phpPackage = lib.mkForce (
+      pkgs.php.override {
+        packageOverrides = final: prev: {
+          extensions = prev.extensions // {
+            pgsql = prev.extensions.pgsql.overrideAttrs (old: {
+              configureFlags = [ "--with-pgsql=${config.services.postgresql.package}" ];
+            });
+            pdo_pgsql = prev.extensions.pdo_pgsql.overrideAttrs (old: {
+              configureFlags = [ "--with-pdo-pgsql=${config.services.postgresql.package}" ];
+            });
+          };
+        };
+      }
+    );
     enable = true;
     maxUploadSize = "2G";
     https = true;
@@ -38,7 +54,14 @@ in
     };
 
     extraApps = {
-      inherit (pkgs.local) bookmarks calendar contacts cookbook news notes;
+      inherit (pkgs.local)
+        bookmarks
+        calendar
+        contacts
+        cookbook
+        news
+        notes
+        ;
     };
   };
 

configuration/services/postgres.nix

@@ -1,4 +1,5 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   services.postgresql = {
     package = pkgs.postgresql_14;
     enable = true;

configuration/services/starbound.nix

@@ -1,7 +1,4 @@
-{ pkgs
+{ pkgs, lib, ... }:
-, lib
-, ...
-}:
 let
   inherit (lib) concatStringsSep;
 in
@@ -114,9 +111,7 @@ in
 
   services.backups.starbound = {
     user = "root";
-    paths = [
+    paths = [ "/var/lib/private/starbound/storage/universe/" ];
-      "/var/lib/private/starbound/storage/universe/"
-    ];
     pauseServices = [ "starbound.service" ];
   };
 }

configuration/services/wireguard.nix

@@ -1,4 +1,5 @@
-{ config, ... }: {
+{ config, ... }:
+{
   # iptables needs to permit forwarding from wg0 to wg0
   networking.firewall.extraCommands = ''
     iptables -A FORWARD -i wg0 -o wg0 -j ACCEPT

flake.lock

@@ -7,11 +7,11 @@
         "utils": "utils"
       },
       "locked": {
-        "lastModified": 1711973905,
+        "lastModified": 1718194053,
-        "narHash": "sha256-UFKME/N1pbUtn+2Aqnk+agUt8CekbpuqwzljivfIme8=",
+        "narHash": "sha256-FaGrf7qwZ99ehPJCAwgvNY5sLCqQ3GDiE/6uLhxxwSY=",
         "owner": "serokell",
         "repo": "deploy-rs",
-        "rev": "88b3059b020da69cbe16526b8d639bd5e0b51c8b",
+        "rev": "3867348fa92bc892eba5d9ddb2d7a97b9e127a8a",
         "type": "github"
       },
       "original": {
@@ -27,11 +27,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1714103775,
+        "lastModified": 1723685519,
-        "narHash": "sha256-kcBiIrmqzt3bNTr2GMBfAyA+on8BEKO1iKzzDFQZkjI=",
+        "narHash": "sha256-GkXQIoZmW2zCPp1YFtAYGg/xHNyFH/Mgm79lcs81rq0=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "285e26465a0bae510897ca04da26ce6307c652b4",
+        "rev": "276a0d055a720691912c6a34abb724e395c8e38a",
         "type": "github"
       },
       "original": {
@@ -47,11 +47,11 @@
         "pyproject-nix": "pyproject-nix"
       },
       "locked": {
-        "lastModified": 1702457430,
+        "lastModified": 1719685993,
-        "narHash": "sha256-8NQiXtYCOiC7XFayy6GPGDudCBrPROry3mfWjpdVj5g=",
+        "narHash": "sha256-04gy1icwnGO3ZXF6r96yBm/C0PNPzeLxA/8xzzq0dBI=",
         "owner": "nix-community",
         "repo": "dream2nix",
-        "rev": "262198033e23e9ee832f0cc8133d38f07598f555",
+        "rev": "1b5e01219a32324c8f6889fe1f4db933ec7932f6",
         "type": "github"
       },
       "original": {
@@ -69,11 +69,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1704003651,
+        "lastModified": 1719815435,
-        "narHash": "sha256-bA3d4E1CX5G7TVbKwJOm9jZfVOGOPp6u5CKEUzNsE8E=",
+        "narHash": "sha256-K2xFp142onP35jcx7li10xUxNVEVRWjAdY8DSuR7Naw=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "c6d82e087ac96f24b90c5787a17e29a72566c2b4",
+        "rev": "ebfe2c639111d7e82972a12711206afaeeda2450",
         "type": "github"
       },
       "original": {
@@ -157,11 +157,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1712623723,
+        "lastModified": 1722661736,
-        "narHash": "sha256-jPD5+M+QPyMRk52zfFMIeHdv7yXYJ/yNGqwS0PhYF+E=",
+        "narHash": "sha256-0lujsK40JV/2PlqCjhZMGpHKL4vDKzJcnkFJYnG1WZA=",
         "owner": "reckenrode",
         "repo": "nix-foundryvtt",
-        "rev": "6025615b431170558c3c13f16b549fc0126425e1",
+        "rev": "699a175398410688214615a9d977354e9ef98d2d",
         "type": "github"
       },
       "original": {
@@ -210,59 +210,59 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1713638189,
+        "lastModified": 1721524707,
-        "narHash": "sha256-q7APLfB6FmmSMI1Su5ihW9IwntBsk2hWNXh8XtSdSIk=",
+        "narHash": "sha256-5NctRsoE54N86nWd0psae70YSLfrOek3Kv1e8KoXe/0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "74574c38577914733b4f7a775dd77d24245081dd",
+        "rev": "556533a23879fc7e5f98dd2e0b31a6911a213171",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1714253743,
+        "lastModified": 1723957280,
-        "narHash": "sha256-mdTQw2XlariysyScCv2tTE45QSU9v/ezLcHJ22f0Nxc=",
+        "narHash": "sha256-J08Yqf2IJ73y7myI69qEKsQ048ibweG6FeJeCxbIdB4=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "58a1abdbae3217ca6b702f03d3b35125d88a2994",
+        "rev": "abcef4da4ebb72240bddc370a27263627e64877f",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "nixos-unstable-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1718208800,
+        "lastModified": 1723920526,
-        "narHash": "sha256-US1tAChvPxT52RV8GksWZS415tTS7PV42KTc2PNDBmc=",
+        "narHash": "sha256-USs6A60raDKZ/8BEpqja1XjZIsRzADX+NtWKH6wIxIw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "cc54fb41d13736e92229c21627ea4f22199fee6b",
+        "rev": "1cbd3d585263dc620c483e138d352a39b9f0e3ec",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.05-small",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1702272962,
+        "lastModified": 1719468428,
-        "narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
+        "narHash": "sha256-vN5xJAZ4UGREEglh3lfbbkIj+MPEYMuqewMn4atZFaQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d",
+        "rev": "1e3deb3d8a86a870d925760db1a5adecc64d329d",
         "type": "github"
       },
       "original": {
@@ -281,11 +281,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1713333471,
+        "lastModified": 1718252448,
-        "narHash": "sha256-sIVQKOXzruxtTYiBRHZa8UQH+CSIa9K5MZlY6vavYfA=",
+        "narHash": "sha256-xZZBdKqe1ByITzvx65pVgGQ5jeb73MybjgrcfI84lEo=",
         "owner": "berberman",
         "repo": "nvfetcher",
-        "rev": "2a824322dc6a755ffda83a13b948d42304521e4d",
+        "rev": "fa7609950023462c6f91c425de7610c0bb6b86ba",
         "type": "github"
       },
       "original": {
@@ -375,11 +375,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1703965384,
+        "lastModified": 1719760370,
-        "narHash": "sha256-3iyouqkBvhh/E48TkBlt4JmmcIEyfQwY7pokKBx9WNg=",
+        "narHash": "sha256-fsxAuW6RxKZYjAP3biUC6C4vaYFhDfWv8lp1Tmx3ZCY=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "e872f5085cf5b0e44558442365c1c033d486eff2",
+        "rev": "ea7fdada6a0940b239ddbde2048a4d7dac1efe1e",
         "type": "github"
       },
       "original": {
@@ -442,11 +442,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1713892811,
+        "lastModified": 1723501126,
-        "narHash": "sha256-uIGmA2xq41vVFETCF1WW4fFWFT2tqBln+aXnWrvjGRE=",
+        "narHash": "sha256-N9IcHgj/p1+2Pvk8P4Zc1bfrMwld5PcosVA0nL6IGdE=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "f1b0adc27265274e3b0c9b872a8f476a098679bd",
+        "rev": "be0eec2d27563590194a9206f551a6f73d52fa34",
         "type": "github"
       },
       "original": {
@@ -523,11 +523,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1704840002,
+        "lastModified": 1719851829,
-        "narHash": "sha256-ik2LeuRjcnRXwBLoRSOyGEMXscE+coO8G79IFhZhdJk=",
+        "narHash": "sha256-M5miiIbiwP4uArTyeIr/RKA857rP14AEJUe11AZsKAc=",
         "ref": "refs/heads/master",
-        "rev": "d14f50c8dcc8ab30a5e5fa907b392ac0df6c7b52",
+        "rev": "4a099f27a27f4107ceb14969e2158eaabebcf1d4",
-        "revCount": 73,
+        "revCount": 74,
         "type": "git",
         "url": "https://gitea.tlater.net/tlaternet/tlaternet.git"
       },

flake.nix

@@ -2,8 +2,8 @@
   description = "tlater.net host configuration";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05-small";
-    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
     disko = {
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -33,16 +33,27 @@
   };
 
   outputs =
-    { self
+    {
-    , nixpkgs
+      self,
-    , sops-nix
+      nixpkgs,
-    , nvfetcher
+      sops-nix,
-    , deploy-rs
+      nvfetcher,
-    , ...
+      deploy-rs,
-    } @ inputs:
+      ...
+    }@inputs:
     let
       system = "x86_64-linux";
       pkgs = nixpkgs.legacyPackages.${system};
+
+      vm = nixpkgs.lib.nixosSystem {
+        inherit system;
+        specialArgs.flake-inputs = inputs;
+
+        modules = [
+          ./configuration
+          ./configuration/hardware-specific/vm.nix
+        ];
+      };
     in
     {
       ##################
@@ -74,7 +85,12 @@
           };
 
           sshUser = "tlater";
-          sshOpts = [ "-p" "2222" "-o" "ForwardAgent=yes" ];
+          sshOpts = [
+            "-p"
+            "2222"
+            "-o"
+            "ForwardAgent=yes"
+          ];
         };
       };
 
@@ -83,6 +99,12 @@
       #########
       checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
 
+      ###########################
+      # Garbage collection root #
+      ###########################
+
+      packages.${system}.default = vm.config.system.build.vm;
+
       ###################
       # Utility scripts #
       ###################
@@ -93,15 +115,6 @@
           type = "app";
           program =
             let
-              vm = nixpkgs.lib.nixosSystem {
-                inherit system;
-                specialArgs.flake-inputs = inputs;
-
-                modules = [
-                  ./configuration
-                  ./configuration/hardware-specific/vm.nix
-                ];
-              };
             in
             (pkgs.writeShellScript "" ''
               ${vm.config.system.build.vm.outPath}/bin/run-testvm-vm
@@ -137,10 +150,11 @@
       # Development environment #
       ###########################
       devShells.${system}.default = nixpkgs.legacyPackages.${system}.mkShell {
-        sopsPGPKeyDirs = [ "./keys/hosts/" "./keys/users/" ];
+        sopsPGPKeyDirs = [
-        nativeBuildInputs = [
+          "./keys/hosts/"
-          sops-nix.packages.${system}.sops-import-keys-hook
+          "./keys/users/"
         ];
+        nativeBuildInputs = [ sops-nix.packages.${system}.sops-import-keys-hook ];
 
         packages = with pkgs; [
           sops-nix.packages.${system}.sops-init-gpg-key

modules/default.nix

@@ -1,5 +1 @@
-{
+{ imports = [ ./nginxExtensions.nix ]; }
-  imports = [
-    ./nginxExtensions.nix
-  ];
-}

modules/nginxExtensions.nix

@@ -1,8 +1,10 @@
-{ config
+{
-, pkgs
+  config,
-, lib
+  pkgs,
-, ...
+  lib,
-}: {
+  ...
+}:
+{
   options = {
     services.nginx.domain = lib.mkOption {
       type = lib.types.str;
@@ -12,10 +14,8 @@
     services.nginx.virtualHosts =
       let
         extraVirtualHostOptions =
-          { name
+          { name, config, ... }:
-          , config
+          {
-          , ...
-          }: {
             options = {
               enableHSTS = lib.mkEnableOption "Enable HSTS";
 
@@ -40,9 +40,7 @@
             };
           };
       in
-      lib.mkOption {
+      lib.mkOption { type = lib.types.attrsOf (lib.types.submodule extraVirtualHostOptions); };
-        type = lib.types.attrsOf (lib.types.submodule extraVirtualHostOptions);
-      };
   };
 
   config = {
@@ -51,11 +49,11 @@
       let
         confirm = ''[[ "tlater.net" = ${config.services.nginx.domain} ]]'';
       in
-      lib.mapAttrs'
+      lib.mapAttrs' (
-        (cert: _:
+        cert: _:
-          lib.nameValuePair "acme-${cert}" {
+        lib.nameValuePair "acme-${cert}" {
-            serviceConfig.ExecCondition = ''${pkgs.runtimeShell} -c '${confirm}' '';
+          serviceConfig.ExecCondition = ''${pkgs.runtimeShell} -c '${confirm}' '';
-          })
+        }
-        config.security.acme.certs;
+      ) config.security.acme.certs;
   };
 }

pkgs/_sources_nextcloud/generated.json

@@ -7,11 +7,11 @@
         "passthru": null,
         "pinned": false,
         "src": {
-            "sha256": "sha256-JXNQNnWXoii71QhtKktuEBEIqzmONVetULBhpSjM9xo=",
+            "sha256": "sha256-V4zZsAwPn8QiCXEDqOgNFHaXqMOcHMpMbJ1Oz3Db0pc=",
             "type": "tarball",
-            "url": "https://github.com/nextcloud/bookmarks/releases/download/v13.1.3/bookmarks-13.1.3.tar.gz"
+            "url": "https://github.com/nextcloud/bookmarks/releases/download/v14.2.4/bookmarks-14.2.4.tar.gz"
         },
-        "version": "13.1.3"
+        "version": "14.2.4"
     },
     "calendar": {
         "cargoLocks": null,
@@ -21,11 +21,11 @@
         "passthru": null,
         "pinned": false,
         "src": {
-            "sha256": "sha256-hZfjWAMi/0qs5xMMgOlcoSXG6kcZ2aeDaez+NqSZFKI=",
+            "sha256": "sha256-sipXeyOL4OhENz7V2beFeSYBAoFZdCWtqftIy0lsqEY=",
             "type": "tarball",
-            "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.6.7/calendar-v4.6.7.tar.gz"
+            "url": "https://github.com/nextcloud-releases/calendar/releases/download/v4.7.15/calendar-v4.7.15.tar.gz"
         },
-        "version": "v4.6.7"
+        "version": "v4.7.15"
     },
     "contacts": {
         "cargoLocks": null,
@@ -49,11 +49,11 @@
         "passthru": null,
         "pinned": false,
         "src": {
-            "sha256": "sha256-TE/w8SgyIPaGl5wZUAsG234nxoPj25QoRPF3zjbMoRk=",
+            "sha256": "sha256-a8ekMnEzudHGiqHF53jPtgsVTOTc2QLuPg6YtTw5h68=",
             "type": "tarball",
-            "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.10.5/Cookbook-0.10.5.tar.gz"
+            "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.1/Cookbook-0.11.1.tar.gz"
         },
-        "version": "0.10.5"
+        "version": "0.11.1"
     },
     "news": {
         "cargoLocks": null,
@@ -63,11 +63,11 @@
         "passthru": null,
         "pinned": false,
         "src": {
-            "sha256": "sha256-cfJkKRNSz15L4E3w1tnEb+t4MrVwVzb8lb6vCOA4cK4=",
+            "sha256": "sha256-AhTZGQCLeNgsRBF5w3+Lf9JtNN4D1QncB5t+odU+XUc=",
             "type": "tarball",
-            "url": "https://github.com/nextcloud/news/releases/download/24.0.0/news.tar.gz"
+            "url": "https://github.com/nextcloud/news/releases/download/25.0.0-alpha8/news.tar.gz"
         },
-        "version": "24.0.0"
+        "version": "25.0.0-alpha8"
     },
     "notes": {
         "cargoLocks": null,
@@ -77,10 +77,10 @@
         "passthru": null,
         "pinned": false,
         "src": {
-            "sha256": "sha256-ydpxatwuZUz7XIgK8FMklZlxNQklpsP8Uqpxvt3iK0k=",
+            "sha256": "sha256-A3QNWGWeC2OcZngMrh9NpYbU5qp5x9xiDcRfB9cRXBo=",
             "type": "tarball",
-            "url": "https://github.com/nextcloud/notes/releases/download/v4.10.0/notes.tar.gz"
+            "url": "https://github.com/nextcloud-releases/notes/releases/download/v4.10.1/notes-v4.10.1.tar.gz"
         },
-        "version": "v4.10.0"
+        "version": "v4.10.1"
     }
 }

pkgs/_sources_nextcloud/generated.nix

@@ -3,18 +3,18 @@
 {
   bookmarks = {
     pname = "bookmarks";
-    version = "13.1.3";
+    version = "14.2.4";
     src = fetchTarball {
-      url = "https://github.com/nextcloud/bookmarks/releases/download/v13.1.3/bookmarks-13.1.3.tar.gz";
+      url = "https://github.com/nextcloud/bookmarks/releases/download/v14.2.4/bookmarks-14.2.4.tar.gz";
-      sha256 = "sha256-JXNQNnWXoii71QhtKktuEBEIqzmONVetULBhpSjM9xo=";
+      sha256 = "sha256-V4zZsAwPn8QiCXEDqOgNFHaXqMOcHMpMbJ1Oz3Db0pc=";
     };
   };
   calendar = {
     pname = "calendar";
-    version = "v4.6.7";
+    version = "v4.7.15";
     src = fetchTarball {
-      url = "https://github.com/nextcloud-releases/calendar/releases/download/v4.6.7/calendar-v4.6.7.tar.gz";
+      url = "https://github.com/nextcloud-releases/calendar/releases/download/v4.7.15/calendar-v4.7.15.tar.gz";
-      sha256 = "sha256-hZfjWAMi/0qs5xMMgOlcoSXG6kcZ2aeDaez+NqSZFKI=";
+      sha256 = "sha256-sipXeyOL4OhENz7V2beFeSYBAoFZdCWtqftIy0lsqEY=";
     };
   };
   contacts = {
@@ -27,26 +27,26 @@
   };
   cookbook = {
     pname = "cookbook";
-    version = "0.10.5";
+    version = "0.11.1";
     src = fetchTarball {
-      url = "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.10.5/Cookbook-0.10.5.tar.gz";
+      url = "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.1/Cookbook-0.11.1.tar.gz";
-      sha256 = "sha256-TE/w8SgyIPaGl5wZUAsG234nxoPj25QoRPF3zjbMoRk=";
+      sha256 = "sha256-a8ekMnEzudHGiqHF53jPtgsVTOTc2QLuPg6YtTw5h68=";
     };
   };
   news = {
     pname = "news";
-    version = "24.0.0";
+    version = "25.0.0-alpha8";
     src = fetchTarball {
-      url = "https://github.com/nextcloud/news/releases/download/24.0.0/news.tar.gz";
+      url = "https://github.com/nextcloud/news/releases/download/25.0.0-alpha8/news.tar.gz";
-      sha256 = "sha256-cfJkKRNSz15L4E3w1tnEb+t4MrVwVzb8lb6vCOA4cK4=";
+      sha256 = "sha256-AhTZGQCLeNgsRBF5w3+Lf9JtNN4D1QncB5t+odU+XUc=";
     };
   };
   notes = {
     pname = "notes";
-    version = "v4.10.0";
+    version = "v4.10.1";
     src = fetchTarball {
-      url = "https://github.com/nextcloud/notes/releases/download/v4.10.0/notes.tar.gz";
+      url = "https://github.com/nextcloud-releases/notes/releases/download/v4.10.1/notes-v4.10.1.tar.gz";
-      sha256 = "sha256-ydpxatwuZUz7XIgK8FMklZlxNQklpsP8Uqpxvt3iK0k=";
+      sha256 = "sha256-A3QNWGWeC2OcZngMrh9NpYbU5qp5x9xiDcRfB9cRXBo=";
     };
   };
 }

pkgs/_sources_pkgs/generated.json

@@ -13,6 +13,7 @@
             "name": null,
             "rev": "v0.10.1",
             "sha256": "sha256-zGEhDy3uXIbvx4agSA8Mx7bRtiZZtoDZGbNbHc9L+yI=",
+            "sparseCheckout": [],
             "type": "git",
             "url": "https://gitlab.com/hectorjsmith/fail2ban-prometheus-exporter"
         },

pkgs/_sources_pkgs/generated.nix

@@ -10,6 +10,7 @@
       fetchSubmodules = false;
       deepClone = false;
       leaveDotGit = false;
+      sparseCheckout = [ ];
       sha256 = "sha256-zGEhDy3uXIbvx4agSA8Mx7bRtiZZtoDZGbNbHc9L+yI=";
     };
   };

pkgs/afvalcalendar/default.nix

@@ -1,19 +1,12 @@
-{ pkgs
+{ pkgs, rustPlatform, ... }:
-, rustPlatform
-, ...
-}:
 rustPlatform.buildRustPackage {
   pname = "afvalcalendar";
   version = "0.1.0";
   src = ./.;
 
-  nativeBuildInputs = with pkgs; [
+  nativeBuildInputs = with pkgs; [ pkg-config ];
-    pkg-config
-  ];
 
-  buildInputs = with pkgs; [
+  buildInputs = with pkgs; [ openssl ];
-    openssl
-  ];
 
   cargoHash = "sha256-JXx6aUKdKbUTBCwlBw5i1hZy8ofCfSrhLCwFzqdA8cI=";
 }

pkgs/default.nix

@@ -1,7 +1,4 @@
-{ pkgs
+{ pkgs, lib }:
-, lib
-,
-}:
 let
   inherit (builtins) fromJSON mapAttrs readFile;
   inherit (pkgs) callPackage;
@@ -13,7 +10,7 @@ in
   };
   afvalcalendar = callPackage ./afvalcalendar { };
 }
-  // (
+// (
   # Add nextcloud apps
   let
     mkNextcloudApp = pkgs.callPackage ./mkNextcloudApp.nix { };

pkgs/mkNextcloudApp.nix

@@ -1,7 +1,5 @@
-{ fetchNextcloudApp
+{ fetchNextcloudApp, lib }:
-, lib
+source:
-,
-}: source:
 fetchNextcloudApp {
   url = source.src.url;
   sha256 = source.src.sha256;

pkgs/nextcloud-apps.toml

@@ -1,12 +1,10 @@
 [bookmarks]
-# src.github = "nextcloud/bookmarks"
+src.github = "nextcloud/bookmarks"
 src.prefix = "v"
-src.manual = "v13.1.3"
 fetch.tarball = "https://github.com/nextcloud/bookmarks/releases/download/v$ver/bookmarks-$ver.tar.gz"
 
 [calendar]
-# src.github = "nextcloud-releases/calendar"
+src.github = "nextcloud-releases/calendar"
-src.manual = "v4.6.7"
 fetch.tarball = "https://github.com/nextcloud-releases/calendar/releases/download/$ver/calendar-$ver.tar.gz"
 
 [contacts]
@@ -15,17 +13,16 @@ src.manual = "v5.5.3"
 fetch.tarball = "https://github.com/nextcloud-releases/contacts/releases/download/$ver/contacts-$ver.tar.gz"
 
 [cookbook]
-# src.github = "christianlupus-nextcloud/cookbook-releases"
+src.github = "christianlupus-nextcloud/cookbook-releases"
 src.prefix = "v"
-src.manual = "0.10.5"
 fetch.tarball = "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v$ver/Cookbook-$ver.tar.gz"
 
 [news]
+# Update manually until angular rewrite is done
 # src.github = "nextcloud/news"
-# Update to 25 when angular rewrite is done/the alpha when I need to switch to nextcloud 28+
+src.manual = "25.0.0-alpha8"
-src.manual = "24.0.0"
 fetch.tarball = "https://github.com/nextcloud/news/releases/download/$ver/news.tar.gz"
 
 [notes]
-src.github = "nextcloud/notes"
+src.github = "nextcloud-releases/notes"
-fetch.tarball = "https://github.com/nextcloud/notes/releases/download/$ver/notes.tar.gz"
+fetch.tarball = "https://github.com/nextcloud-releases/notes/releases/download/$ver/notes-$ver.tar.gz"

pkgs/prometheus/fail2ban-exporter.nix

@@ -1,7 +1,4 @@
-{ buildGoModule
+{ buildGoModule, sources }:
-, sources
-,
-}:
 buildGoModule {
   inherit (sources.prometheus-fail2ban-exporter) pname src version;
   vendorHash = "sha256-5o8p5p0U/c0WAIV5dACnWA3ThzSh2tt5LIFMb59i9GY=";

pkgs/starbound/default.nix

@@ -1,19 +1,21 @@
-{ stdenv
+{
-, lib
+  stdenv,
-, makeWrapper
+  lib,
-, patchelf
+  makeWrapper,
-, steamPackages
+  patchelf,
-, replace-secret
+  steamPackages,
-,
+  replace-secret,
 }:
 let
   # Use the directory in which starbound is installed so steamcmd
   # doesn't have to be reinstalled constantly (we're using DynamicUser
   # with StateDirectory to persist this).
-  steamcmd = steamPackages.steamcmd.override {
+  steamcmd = steamPackages.steamcmd.override { steamRoot = "/var/lib/starbound/.steamcmd"; };
-    steamRoot = "/var/lib/starbound/.steamcmd";
+  wrapperPath = lib.makeBinPath [
-  };
+    patchelf
-  wrapperPath = lib.makeBinPath [ patchelf steamcmd replace-secret ];
+    steamcmd
+    replace-secret
+  ];
 in
 stdenv.mkDerivation {
   name = "starbound-update-script";