commit e34fc237e405e79dff3fa27f6124a4ec4a2e25ea
parent bd18f4a8f3d5d3d360216bbb01ae83514c28d00c
Author: vin <vin@vineetk.net>
Date: Sat, 20 Sep 2025 22:11:24 -0400
a
Diffstat:
15 files changed, 300 insertions(+), 244 deletions(-)
diff --git a/flake.lock b/flake.lock
@@ -10,11 +10,11 @@
"systems": "systems"
},
"locked": {
- "lastModified": 1747575206,
- "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=",
+ "lastModified": 1754433428,
+ "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
"owner": "ryantm",
"repo": "agenix",
- "rev": "4835b1dc898959d8547a871ef484930675cb47f1",
+ "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
"type": "github"
},
"original": {
@@ -163,11 +163,11 @@
]
},
"locked": {
- "lastModified": 1747565775,
- "narHash": "sha256-B6jmKHUEX1jxxcdoYHl7RVaeohtAVup8o3nuVkzkloA=",
+ "lastModified": 1758375677,
+ "narHash": "sha256-BLtD+6qWz7fQjPk2wpwyXQLGI0E30Ikgf2ppn2nVadI=",
"owner": "nix-community",
"repo": "home-manager",
- "rev": "97118a310eb8e13bc1b9b12d67267e55b7bee6c8",
+ "rev": "edc7468e12be92e926847cb02418e649b02b59dd",
"type": "github"
},
"original": {
@@ -184,8 +184,8 @@
]
},
"locked": {
- "lastModified": 1747191788,
- "narHash": "sha256-dekVtt/TcNszrnWjNX71pme1ZYUaOAaACu4+c0lx6Yg=",
+ "lastModified": 0,
+ "narHash": "sha256-HhI2VI/EZK0ndPUQALEMQmiU073v3L3dVr2xZgo/86w=",
"path": "/data/src/clones/llm/llama.cpp",
"type": "path"
},
@@ -211,11 +211,11 @@
},
"nixpkgs": {
"locked": {
- "lastModified": 1747644487,
- "narHash": "sha256-0Ub4ws2UGgXAQ7qJ6JEhYOjrrf2Ky/7iEWkyEDkKa/U=",
+ "lastModified": 1758351571,
+ "narHash": "sha256-oX0bC06R9gDaE3Yk3YIlXnSxj7Q0wJb31nKqnSfNpvU=",
"owner": "nixos",
"repo": "nixpkgs",
- "rev": "949fb7f3087b8d086fd8c92acfa8412c43cfc116",
+ "rev": "0f3383ef02bc092d2f82afa4e556743c6e6b74d6",
"type": "github"
},
"original": {
@@ -272,11 +272,11 @@
},
"nixpkgs-stable": {
"locked": {
- "lastModified": 1747485343,
- "narHash": "sha256-YbsZyuRE1tobO9sv0PUwg81QryYo3L1F3R3rF9bcG38=",
+ "lastModified": 1751274312,
+ "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
"owner": "nixos",
"repo": "nixpkgs",
- "rev": "9b5ac7ad45298d58640540d0323ca217f32a6762",
+ "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
"type": "github"
},
"original": {
diff --git a/home.nix b/home.nix
@@ -38,26 +38,29 @@ let
extraPkgs = pkgs: [ pkgs.icu ];
};
- my-texlive = with pkgs; texlive.withPackages (texlivePackages: with texlivePackages; [
- # A minimal base scheme and a common build tool
- scheme-small
- latexmk
-
- # Packages from your research paper's preamble
- amsmath
- graphicx
- siunitx
- booktabs
- algorithm2e
- caption
- pslatex
- ec
- microtype
- cite
- url
- xcolor
- hyperref
- ]);
+ my-texlive =
+ with pkgs;
+ texlive.withPackages (
+ texlivePackages: with texlivePackages; [
+ # A minimal base scheme and a common build tool
+ scheme-small
+ latexmk
+
+ # Packages from your research paper's preamble
+ amsmath
+ siunitx
+ booktabs
+ algorithm2e
+ caption
+ pslatex
+ ec
+ microtype
+ cite
+ url
+ xcolor
+ hyperref
+ ]
+ );
in
{
@@ -99,6 +102,7 @@ in
#unzip
#p7zip
ripgrep
+ nixfmt-rfc-style
# X and desktop-related
scrot
@@ -390,20 +394,20 @@ in
mpv = {
enable = true;
- package = pkgs.mpv.override {
- archiveSupport = false;
- bluraySupport = false;
- bs2bSupport = false;
- cacaSupport = false;
- cmsSupport = false;
- dvdnavSupport = false;
- javascriptSupport = false;
- pipewireSupport = true;
- pulseSupport = false;
- rubberbandSupport = false;
- waylandSupport = false;
- zimgSupport = false;
- };
+ # package = pkgs.mpv.override {
+ # archiveSupport = false;
+ # bluraySupport = false;
+ # bs2bSupport = false;
+ # cacaSupport = false;
+ # cmsSupport = false;
+ # dvdnavSupport = false;
+ # javascriptSupport = false;
+ # pipewireSupport = true;
+ # pulseSupport = false;
+ # rubberbandSupport = false;
+ # waylandSupport = false;
+ # zimgSupport = false;
+ # };
bindings = {
# I wish there was a more elegant way of setting Anime4K
@@ -441,17 +445,18 @@ in
};
hooks = {
postNew = ''
- notmuch tag +13f0 -- tag:unread and to:"*@13f0.net"
- notmuch tag +vineetk -- tag:unread and to:"*@vineetk.net"
- notmuch tag +university -- tag:unread and to:"*@floridapoly.edu"
- notmuch tag +openbsd_announce -inbox -- tag:unread and to:announce@openbsd.org
- notmuch tag +openbsd_arm -inbox -- tag:unread and to:arm@openbsd.org
- notmuch tag +openbsd_misc -inbox -- tag:unread and to:misc@openbsd.org
- notmuch tag +openbsd_ports -inbox -- tag:unread and to:ports@openbsd.org
- notmuch tag +openbsd_tech -inbox -- tag:unread and to:tech@openbsd.org
- notmuch tag +opensmtpd_misc -inbox -- tag:unread and to:misc@opensmtpd.org
- notmuch tag +oss_security -inbox -- tag:unread and to:oss-security@lists.openwall.com
- notmuch tag +tuhs -inbox -- tag:unread and to:tuhs@tuhs.org
+ notmuch tag +13f0 -- tag:unread and to:"*@13f0.net"
+ notmuch tag +vineetk -- tag:unread and to:"*@vineetk.net"
+ notmuch tag +university -- tag:unread and to:vsureshkumar3892@floridapoly.edu
+ notmuch tag +openbsd_announce -inbox -- tag:unread and to:announce@openbsd.org
+ notmuch tag +openbsd_arm -inbox -- tag:unread and to:arm@openbsd.org
+ notmuch tag +gameoftrees -inbox -- tag:unread and to:gameoftrees@openbsd.org
+ notmuch tag +openbsd_misc -inbox -- tag:unread and to:misc@openbsd.org
+ notmuch tag +openbsd_ports -inbox -- tag:unread and to:ports@openbsd.org
+ notmuch tag +openbsd_tech -inbox -- tag:unread and to:tech@openbsd.org
+ notmuch tag +opensmtpd_misc -inbox -- tag:unread and to:misc@opensmtpd.org
+ notmuch tag +oss_security -inbox -- tag:unread and to:oss-security@lists.openwall.com
+ notmuch tag +tuhs -inbox -- tag:unread and to:tuhs@tuhs.org
'';
preNew = "mbsync -a";
};
@@ -573,14 +578,15 @@ in
yt-dlp = {
enable = true;
settings = {
- merge-output-format = "mkv";
- embed-subs = true;
+ format-sort = "res:1440,vcodec:vp9,acodec:opus";
embed-metadata = true;
+ embed-subs = true;
embed-thumbnail = true;
+ merge-output-format = "mkv";
sub-langs = "en,-livechat";
- format = "bestvideo[height<=?1440]+bestaudio/best";
- downloader = "aria2c";
- downloader-args = "aria2c:'-c -x8 -s8 -k1M'";
+ no-windows-filenames = true;
+ sponsorblock-remove = "sponsor,selfpromo,music_offtopic,-filler,-preview";
+ sponsorblock-mark = "filler,preview,intro,outro";
};
};
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
@@ -21,6 +21,7 @@
allowUnfreePredicate =
pkg:
builtins.elem (lib.getName pkg) [
+ "open-webui"
"steam"
"steam-unwrapped"
];
@@ -42,16 +43,14 @@
super.usbutils
];
nativeBuildInputs = old.nativeBuildInputs ++ [ super.makeWrapper ];
- postInstall =
- (old.postInstall or "")
- + ''
- wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${
- super.lib.makeBinPath [
- super.android-tools
- super.usbutils
- ]
- }"
- '';
+ postInstall = (old.postInstall or "") + ''
+ wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${
+ super.lib.makeBinPath [
+ super.android-tools
+ super.usbutils
+ ]
+ }"
+ '';
});
})
];
@@ -60,7 +59,7 @@
# decrypt agenix secrets
age.secrets = {
wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
- wg1_demiurge.file = ../../secrets/wg0_demiurge.age;
+ wg1_demiurge.file = ../../secrets/wg1_demiurge.age;
};
# boot options
@@ -70,17 +69,23 @@
"net.ipv6.conf.all.forwarding" = true;
};
- kernelPackages = pkgs.linuxPackages_6_13;
+ kernelPackages = pkgs.linuxPackages_6_12;
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
- zfs.extraPools = [
- "data_wd"
- "data"
- ];
+ supportedFilesystems = [ "zfs" ];
+
+ zfs = {
+ devNodes = "/dev/disk/by-partuuid";
+ extraPools = [
+ "data_nvme"
+ "data_wd"
+ ];
+ forceImportRoot = false;
+ };
};
# disable wifi and open some ports
@@ -88,6 +93,9 @@
hostName = "demiurge";
hostId = "cafebabe";
+ # I like my ethX/wlanX names
+ usePredictableInterfaceNames = false;
+
wireless.enable = false;
firewall = {
@@ -99,59 +107,80 @@
allowedUDPPorts = [ 51413 ];
};
- wg-quick.interfaces = {
+ interfaces.eth0 = {
+ ipv4.addresses = [
+ {
+ address = "192.168.1.2";
+ prefixLength = 24;
+ }
+ ];
+ };
+ defaultGateway = {
+ address = "192.168.1.1";
+ interface = "eth0";
+ };
+
+ wireguard.interfaces = {
# mullvad
wg0 = {
- address = [
+ ips = [
"10.68.117.111/32"
"fc00:bbbb:bbbb:bb01::5:756e/128"
];
privateKeyFile = config.age.secrets.wg0_demiurge.path;
- postUp = "ip route add 45.134.142.206 dev eth0";
- postDown = "ip route del 45.134.142.206 dev eth0";
+ postSetup = ''
+ ip route add 45.134.142.206 via 192.168.1.1
+ ip route add default via 45.134.142.206
+ '';
+ postShutdown = ''
+ ip route del default via 45.134.142.206
+ ip route del 45.134.142.206 via 192.168.1.1
+ '';
- peers = [{
+ peers = [
+ {
allowedIPs = [
"0.0.0.0/0"
"::0/0"
];
endpoint = "45.134.142.206:51820";
publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
- }];
+ }
+ ];
};
# epistemia
wg1 = {
- address = [
+ ips = [
"10.0.13.2/24"
"fd00:b0ba:cafe:babe::2/64"
];
privateKeyFile = config.age.secrets.wg1_demiurge.path;
listenPort = 51820;
- fwMark = 51821;
- MTU = 1420;
-
- table = false;
- postUp = ''
-PostUp = ip rule add from 10.0.13.0/24 lookup main pref 31000
-PostUp = ip rule add from all fwmark 51821 lookup 51821 pref 32000
-PostUp = ip route add default via 192.168.1.1 dev eth0 table 51821
-
-# NAT iphonebob and allow traffic between peers (when routing through demiurge)
-PostUp = iptables -F FORWARD
-PostUp = iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
-PostUp = iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT
-PostUp = iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT
-PostUp = iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+ fwMark = "51821";
+ mtu = 1420;
+
+ #table = "Off";
+ postSetup = ''
+ ip rule add from 10.0.13.0/24 lookup main pref 31000
+ ip rule add from all fwmark 51821 lookup 51821 pref 32000
+ ip route replace default via 192.168.1.1 dev eth0 table 51821
+
+ # NAT iphonebob and allow traffic between peers (when routing through demiurge)
+ ${pkgs.iptables}/bin/iptables -F FORWARD
+ ${pkgs.iptables}/bin/iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+ ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT
+ ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
'';
- preDown = ''
-PreDown = ip rule del from all fwmark 51821 lookup 51821 pref 32000
-PreDown = ip rule del from 10.0.13.0/24 lookup main pref 31000
-PreDown = ip route flush table 51821
+ preShutdown = ''
+ ip rule del from all fwmark 51821 lookup 51821 pref 32000
+ ip rule del from 10.0.13.0/24 lookup main pref 31000
+ ip route flush table 51821
-PreDown = iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
-PreDown = iptables -F FORWARD
+ ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+ ${pkgs.iptables}/bin/iptables -F FORWARD
'';
peers = [
@@ -191,7 +220,7 @@ PreDown = iptables -F FORWARD
];
persistentKeepalive = 25;
publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
- }
+ }
];
};
};
@@ -231,7 +260,7 @@ PreDown = iptables -F FORWARD
packages = with pkgs; [
alvr
bs-manager
- (llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; })
+ #(llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; })
#(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
];
};
@@ -300,37 +329,26 @@ PreDown = iptables -F FORWARD
services = {
# dns
unbound = {
- enable = true;
+ enable = false;
settings = {
- server = {
- interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ];
- access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ];
-
- hide-identity = yes;
- hide-version = yes;
-
- # Synthesize NXDOMAINs from DNSSEC NSEC chains.
- # https://tools.ietf.org/html/rfc8198
- aggressive-nsec = no;
-
- local-zone = "saklas.epistemia." redirect;
- local-data = "saklas.epistemia. 86400 IN A 10.0.13.1";
- local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1";
- local-zone = "demiurge.epistemia." redirect;
- local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2";
- local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2";
- local-zone = "hastur.epistemia." redirect;
- local-data = "hastur.epistemia. 86400 IN A 10.0.13.3";
- local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3";
- local-zone = "iphonebob.epistemia." redirect;
- local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4";
- local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4";
- local-zone = "lab.epistemia." redirect;
- local-data = "lab.epistemia. 86400 IN A 10.0.13.5";
- local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5";
- local-zone = "paraclete.epistemia." redirect;
- local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6";
- local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6";
+ server = {
+ interface = [
+ "127.0.0.1"
+ "10.0.13.2"
+ "fd00:b0ba:cafe:babe::2"
+ "::1"
+ ];
+ access-control = [
+ "0.0.0.0/0 allow"
+ "::0/0 allow"
+ ];
+
+ hide-identity = true;
+ hide-version = true;
+
+ # Synthesize NXDOMAINs from DNSSEC NSEC chains.
+ # https://tools.ietf.org/html/rfc8198
+ aggressive-nsec = false;
};
# hagezi for dns-based adblocking (in addition to others)
@@ -341,13 +359,40 @@ PreDown = iptables -F FORWARD
};
# go through mullvad for regular dns queries
- forward-zone = {
- name = ".";
- forward-addr = [ "100.64.0.3" ];
+ forward-zone = {
+ name = ".";
+ forward-addr = [ "100.64.0.3" ];
};
+
+ local-data = [
+ "demiurge.epistemia. 86400 IN A 10.0.13.2"
+ "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2"
+ "hastur.epistemia. 86400 IN A 10.0.13.3"
+ "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3"
+ "iphonebob.epistemia. 86400 IN A 10.0.13.4"
+ "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4"
+ "lab.epistemia. 86400 IN A 10.0.13.5"
+ "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5"
+ "paraclete.epistemia. 86400 IN A 10.0.13.6"
+ "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6"
+ "saklas.epistemia. 86400 IN A 10.0.13.1"
+ "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1"
+ ];
+
+ local-zone = [
+ "\"demiurge.epistemia.\" redirect"
+ "\"hastur.epistemia.\" redirect"
+ "\"iphonebob.epistemia.\" redirect"
+ "\"lab.epistemia.\" redirect"
+ "\"paraclete.epistemia.\" redirect"
+ "\"saklas.epistemia.\" redirect"
+ ];
};
};
+ # automatically scrub zfs pools (every week by default)
+ zfs.autoScrub.enable = true;
+
# media server
jellyfin = {
enable = true;
@@ -415,7 +460,10 @@ PreDown = iptables -F FORWARD
nginx = {
enable = true;
- defaultListenAddresses = [ "10.0.13.2" "fd00:b0ba:cafe:babe::2" ];
+ defaultListenAddresses = [
+ "10.0.13.2"
+ "fd00:b0ba:cafe:babe::2"
+ ];
recommendedGzipSettings = true;
recommendedOptimisation = true;
@@ -525,7 +573,7 @@ PreDown = iptables -F FORWARD
}
];
};
- };
+ }
];
};
@@ -555,66 +603,65 @@ PreDown = iptables -F FORWARD
};
};
- # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt)
wireplumber = {
enable = true;
extraConfig."50-smartfilters-airpods.conf".text = ''
- {
- "monitor.bluez.rules" : [
- # When a BlueZ device is detected we set an identifying property that the smart filter will match.
- # (This fragment adds nothing by default; we're using a policy to match target.node later.)
- ],
-
- "policy.rules" : [
- # The core smart filter matching is done by matching the target.node properties
- # WirePlumber's smart filters will look for filter.smart.target (set below).
- ],
-
- "policy" : {
- "smart_filters" : {
- "rules" : [
+ {
+ "monitor.bluez.rules" : [
+ # When a BlueZ device is detected we set an identifying property that the smart filter will match.
+ # (This fragment adds nothing by default; we're using a policy to match target.node later.)
+ ],
+
+ "policy.rules" : [
+ # The core smart filter matching is done by matching the target.node properties
+ # WirePlumber's smart filters will look for filter.smart.target (set below).
+ ],
+
+ "policy" : {
+ "smart_filters" : {
+ "rules" : [
+ {
+ "matches" : [
+ { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
+ ],
+ "actions" : {
+ # If target device matches, set the 'target.node' metadata for smart filters to use
+ "update-metadata" : {
+ "target.node" : { "name" : "bluez_output.*AirPods.*" }
+ }
+ }
+ }
+ ]
+ }
+ },
+
+ "endpoint.rules" : [
{
"matches" : [
- { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
+ { "node.name" : "peq-airpods-pro-2-sink" }
],
"actions" : {
- # If target device matches, set the 'target.node' metadata for smart filters to use
- "update-metadata" : {
- "target.node" : { "name" : "bluez_output.*AirPods.*" }
+ "update-props" : {
+ # Mark this WF sink as intended for a specific target device.
+ # WirePlumber will use filter.smart.target to identify which device to chain to.
+ "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
+ }
+ }
+ },
+ {
+ "matches" : [
+ { "node.name" : "peq-he5xx-sink" }
+ ],
+ "actions" : {
+ "update-props" : {
+ # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules.
+ "filter.smart.target" : {}
}
}
}
]
}
- },
-
- "endpoint.rules" : [
- {
- "matches" : [
- { "node.name" : "peq-airpods-pro-2-sink" }
- ],
- "actions" : {
- "update-props" : {
- # Mark this WF sink as intended for a specific target device.
- # WirePlumber will use filter.smart.target to identify which device to chain to.
- "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
- }
- }
- },
- {
- "matches" : [
- { "node.name" : "peq-he5xx-sink" }
- ],
- "actions" : {
- "update-props" : {
- # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules.
- "filter.smart.target" : {}
- }
- }
- }
- ]
- }
- '';
+ '';
};
};
@@ -1106,10 +1153,22 @@ PreDown = iptables -F FORWARD
};
# extra systemd stuff
- systemd.services.nginx = {
- after = [ "wg-quick@wg1.service" ];
- requires = [ "wg-quick@wg1.service" ];
- serviceConfig.Type = lib.mkForce "idle";
+ systemd.services = {
+ nginx = {
+ after = [ "wireguard-wg1.service" ];
+ requires = [ "wireguard-wg1.service" ];
+ serviceConfig.Type = lib.mkForce "idle";
+ };
+
+ wireguard-wg0 = {
+ after = [ "network-addresses-eth0.service" ];
+ requires = [ "network-addresses-eth0.service" ];
+ };
+
+ wireguard-wg1 = {
+ after = [ "wireguard-wg0.service" ];
+ requires = [ "wireguard-wg0.service" ];
+ };
};
# create caches and use mandoc
diff --git a/hosts/demiurge/hardware.nix b/hosts/demiurge/hardware.nix
@@ -51,14 +51,8 @@
options = [ "zfsutil" ];
};
- fileSystems."/data" = {
- device = "nvme_warm";
- fsType = "zfs";
- options = [ "zfsutil" ];
- };
-
fileSystems."/boot" = {
- device = "/dev/disk/by-uuid/1C01-EE5C";
+ device = "/dev/disk/by-uuid/B259-F128";
fsType = "vfat";
options = [
"fmask=0022"
diff --git a/secrets/email_13f0.age b/secrets/email_13f0.age
Binary files differ.
diff --git a/secrets/email_vinbiz.age b/secrets/email_vinbiz.age
@@ -1,7 +1,7 @@
age-encryption.org/v1
--> ssh-ed25519 AaF/mQ XcNpUXvbz6PsCgeEZMf1+yMrjIipzsesAKO+EssReTw
-EcDIICNjeS3KKev0qK/0v7V/86QdOWYNaTyFDFE435I
--> ssh-ed25519 hc2ELA rO5kM81Uk4G5bowyCzGUZdBvqxvcNctjdrD1+Tfk8VY
-1ef+BiIAJFFKpNAPb2QHHzrxTAyNyj7Hc/nArculdsc
---- TrgPJhsRCmQuOl9m51XUHnhV+pBlbj0iYgzXUojgjTw
-cm/(,{W}yxAՙT^\# W-ČO4dϑd [Ce0 .v\ q&
-\ No newline at end of file
+-> ssh-ed25519 AaF/mQ wh3j/RdgUlB4N9ELW4nj7HNFIpBJjlHdjAq0IblREyo
+9KBAruMKWSX36w64FQdJ/MO6xQN7rdW8VqsDD8nZYZI
+-> ssh-ed25519 hc2ELA n8fCpvkGsZQpOJ6q8v82/NT8RPD35FVc6Vxn/yrdhlc
+AFFEH8EHZmauCrJGINblMqVJFHxE6e+XQjWUjowngok
+--- kESRP7l0kqMovGR7QMFSKUtaUN/NPA82WYd9dBtKP2U
+2kZHXSQ ]<&|`V=(`vSC ;00Rd!揦?Eu}yiXov˦b&!
+\ No newline at end of file
diff --git a/secrets/email_vineetk.age b/secrets/email_vineetk.age
Binary files differ.
diff --git a/secrets/hetzner_dns.age b/secrets/hetzner_dns.age
@@ -1,10 +1,7 @@
age-encryption.org/v1
--> ssh-ed25519 AaF/mQ hK2xroga7vLhQxaIBFaP+nrJF8KIxrFaST2RdVedBEI
-vzgZ49FsgITyEUwwpMJllIohNE2BHpf634e6NUnuLyM
--> ssh-ed25519 F30WWA vtiebrA6nc2DhyBGpFKUKv/PZhC89mfw4VJi5JEHekg
-LeeJAKYlywoNoTsbdCWoe+xGN4DDtBq/Zx2jjF5AXos
--> ssh-ed25519 hc2ELA AYBEPYt0guu6DkCTq/DFPAuhDbyb0xlD/Q3YRD9r0TE
-t7r0IU70rRLIYuUiSbypwIBiwrkeeDbSr9A8rC57AUo
---- YFPGnH20/JpT0vHriDFL3ZGHDElBuU6JU4ygDK87JQs
-tjR堸}X%x"
-Ick ܇kR"ps$i;BVl8 <
-\ No newline at end of file
+-> ssh-ed25519 AaF/mQ YL7+ucBetoT2UoL9qjF9DJteCiMtFdasQsCewT1BD10
+7Ul9wBD8q0+C2+EDXtIf1EJZiQILTAyKBDBBZLymwGc
+-> ssh-ed25519 hc2ELA SRY6T7u+UPyVrXIMYe33XJCx9kufjKBQiEaa+b+G21k
+iurQl6gJUqlA2l7NYfWgmjSMiSYNwSmp2eYxfLwAg1o
+--- lBjJlPWS++Wn8DuZVtPscOhY+oydziGsy3EmCSDk6b4
+X|J=cF >c-`,#M/ue]Agx|\*^m:Qc[1
+\ No newline at end of file
diff --git a/secrets/radicale_users.age b/secrets/radicale_users.age
Binary files differ.
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
@@ -2,7 +2,7 @@ let
vin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge";
users = [ vin ];
- demiurge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICXDBcX7hXJCaKDRNaIAfycU83Y2J+uEB4wcALBOQpse";
+ demiurge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBcyABhvBR+UR6PhEmd7ygJqUPeytK6IyljypxkQbZW";
hastur = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2ZUuPSPpIRULzMscBo5DJmA0UbFtG0jaANuzHo5aSQ";
saklas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM7RCmfdgJKPnaBi336ZcvDWboxPj8lTtW1eDTN5qR2R";
systems = [
diff --git a/secrets/wg0_demiurge.age b/secrets/wg0_demiurge.age
@@ -1,7 +1,7 @@
age-encryption.org/v1
--> ssh-ed25519 AaF/mQ yqsS5z6keZjZRc2WECiDtrIQ81uy9dPNuC+4JL4QGgQ
-PZfc4aEh3zIexIpLjcJjtPmXN7nFNFPzUcsjwNj1GtI
--> ssh-ed25519 F30WWA lK3glF0i1Z8i16YF+Pc7AlJjEk3zETFt6HYBrzHntFk
-hsh9wGSi08ZFGUzF8nl3aT3EqMmciGTDjvfxW9FXNKA
---- 5SHG64tPuD9a4EfWVs8RteQTpBcNR9ZiLKvuUukraZI
-k] !ax ^ OLOb^93@h) Vx˲-"!AR
-\ No newline at end of file
+-> ssh-ed25519 AaF/mQ 8mtbBEikYRatTBx3ulZV4KeSsiH7OIw/GrDtbF9pWyU
+liYjeeUNddFsDfT68D/EacHK1zSVGIHDZXP5X1sMDFc
+-> ssh-ed25519 8fETJg +XTbKFpXPrlNSLKf7eZWQMNhx+hlTpwFvSiBYoKYVXk
+78D/CEvi739R7pfbcXXBl8CS8vFFD7rSZ99nqdxk3c0
+--- QJPOO68vtmqgaHk4yZ0mOx8psnKf9V7154pJo7kCgD4
+Y<: _!=jeOmꛢMGyӿ(҈us#18g22OQ9!4jODЬ
+\ No newline at end of file
diff --git a/secrets/wg0_hastur.age b/secrets/wg0_hastur.age
@@ -1,8 +1,7 @@
age-encryption.org/v1
--> ssh-ed25519 AaF/mQ 56BWU8ca94VnN9a2XS9MyMECcA2NnUvclaIgzsAasGw
-4ym2vDPFta3Jjp1ZEmGg+4QjtfqCv98crJmFFJxK4Wk
--> ssh-ed25519 CQpZUw 8T0BdKSFpFj9j8wfe2h9s1uvweGDlJYmLaBaF1h+31A
-JV2ckgV8Hg6EYx44Uh0XF3FvZf6T5bnRULT+5pCueLw
---- jB4Nfx/RnFtL0sOSc0mfZ3a98IsDl03dAj0SqqqZoz0
-oR-ɨKlЍlg a!RĝX)_Tě
-nclyV2!Yqkpjois|
-\ No newline at end of file
+-> ssh-ed25519 AaF/mQ wP+33FStqbBWU/Y6/+IH/xp63Db32bBjdg1eHmlqxhw
+tvItMKy4hkhyyQP7ZSUafbYShslrAufUDvgpowZDhvQ
+-> ssh-ed25519 CQpZUw cNpihxkJx0SNeOJoyiLXxljIJHPDtxp+PQU7WRh8KS8
+y77XLusUoW8i1qPb4v9EFv/YLCif+mwIiRVwjANlLL0
+--- mFeHPan7I2otyM9Eg0Ww5WQoU8m0maNjWe0zXhK9ks8
+-y4&]d,q(Zxj=!92ib<Pyd~j>yG#͜gk5F
+\ No newline at end of file
diff --git a/secrets/wg1_demiurge.age b/secrets/wg1_demiurge.age
@@ -1,7 +1,8 @@
age-encryption.org/v1
--> ssh-ed25519 AaF/mQ MX+cICKRHIB8NaZ6+Kdz6wmhGQHgzNthVe4BiFp3V2c
-pZa2tCwE4YRTS/4kTdlu5DrHNFePU8BiDNXZI0Uaeg0
--> ssh-ed25519 F30WWA UfyQtZSmrl9pw9FVNCxGOo0ICIglS9Q4sDRTg/1PXTw
-Sd6q4jECTtdRfGbgeAf/AniX5gw64ZZ/PrESAlst5tg
---- YkDaRa81QgMNVefXmDCPv2OdDI1BtMO4AhixPoKx2Os
-8ח/-p>т^?A$<>|!0Mu-Az m/g!;tᙌǙ!ݎ
-\ No newline at end of file
+-> ssh-ed25519 AaF/mQ s5k0xBJHij3zt4XcBnYCRLTr3fMS917cDJFJE7kqu1g
+pcW+ATcSqS1xfBoIax6T5Z8cyKThDvXltYVpX71uqcs
+-> ssh-ed25519 8fETJg KHNOh1VCLvANjtqspWLDcbkyoGP/r0EyYLPzUdNzWXk
+XvA4LzN96uMoCD0ZLffCFBNVKgYaZ420X8uLGW9yWnc
+--- 4uATkKlQIj3nvgtQ0spcODHVsyzFbY1hRryq3gkKnso
+Y*["X~Oaji*i) Pw(qH
+r9C^1j_xMHiEh}nF
+\ No newline at end of file
diff --git a/secrets/wg1_hastur.age b/secrets/wg1_hastur.age
Binary files differ.
diff --git a/secrets/wpa_supplicant.age b/secrets/wpa_supplicant.age
Binary files differ.
