a

2 files changed, 193 insertions, 140 deletions

diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index c53c3eb..f3259df 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -21,6 +21,7 @@
       allowUnfreePredicate =
         pkg:
         builtins.elem (lib.getName pkg) [
+          "open-webui"
           "steam"
           "steam-unwrapped"
         ];
@@ -42,16 +43,14 @@
             super.usbutils
           ];
           nativeBuildInputs = old.nativeBuildInputs ++ [ super.makeWrapper ];
-          postInstall =
-            (old.postInstall or "")
-            + ''
-              wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${
-                super.lib.makeBinPath [
-                  super.android-tools
-                  super.usbutils
-                ]
-              }"
-            '';
+          postInstall = (old.postInstall or "") + ''
+            wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${
+              super.lib.makeBinPath [
+                super.android-tools
+                super.usbutils
+              ]
+            }"
+          '';
         });
       })
     ];
@@ -60,7 +59,7 @@
   # decrypt agenix secrets
   age.secrets = {
     wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
-    wg1_demiurge.file = ../../secrets/wg0_demiurge.age;
+    wg1_demiurge.file = ../../secrets/wg1_demiurge.age;
   };
 
   # boot options
@@ -70,17 +69,23 @@
       "net.ipv6.conf.all.forwarding" = true;
     };
 
-    kernelPackages = pkgs.linuxPackages_6_13;
+    kernelPackages = pkgs.linuxPackages_6_12;
 
     loader = {
       systemd-boot.enable = true;
       efi.canTouchEfiVariables = true;
     };
 
-    zfs.extraPools = [
-      "data_wd"
-      "data"
-    ];
+    supportedFilesystems = [ "zfs" ];
+
+    zfs = {
+      devNodes = "/dev/disk/by-partuuid";
+      extraPools = [
+        "data_nvme"
+        "data_wd"
+      ];
+      forceImportRoot = false;
+    };
   };
 
   # disable wifi and open some ports
@@ -88,6 +93,9 @@
     hostName = "demiurge";
     hostId = "cafebabe";
 
+    # I like my ethX/wlanX names
+    usePredictableInterfaceNames = false;
+
     wireless.enable = false;
 
     firewall = {
@@ -99,59 +107,80 @@
       allowedUDPPorts = [ 51413 ];
     };
 
-    wg-quick.interfaces = {
+    interfaces.eth0 = {
+      ipv4.addresses = [
+        {
+          address = "192.168.1.2";
+          prefixLength = 24;
+        }
+      ];
+    };
+    defaultGateway = {
+      address = "192.168.1.1";
+      interface = "eth0";
+    };
+
+    wireguard.interfaces = {
       # mullvad
       wg0 = {
-        address = [
+        ips = [
           "10.68.117.111/32"
           "fc00:bbbb:bbbb:bb01::5:756e/128"
         ];
         privateKeyFile = config.age.secrets.wg0_demiurge.path;
 
-        postUp = "ip route add 45.134.142.206 dev eth0";
-        postDown = "ip route del 45.134.142.206 dev eth0";
+        postSetup = ''
+                ip route add 45.134.142.206 via 192.168.1.1
+                ip route add default via 45.134.142.206
+        '';
+        postShutdown = ''
+                ip route del default via 45.134.142.206
+                ip route del 45.134.142.206 via 192.168.1.1
+        '';
 
-        peers = [{
+        peers = [
+          {
             allowedIPs = [
               "0.0.0.0/0"
               "::0/0"
             ];
             endpoint = "45.134.142.206:51820";
             publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
-        }];
+          }
+        ];
       };
 
       # epistemia
       wg1 = {
-        address = [
+        ips = [
           "10.0.13.2/24"
           "fd00:b0ba:cafe:babe::2/64"
         ];
         privateKeyFile = config.age.secrets.wg1_demiurge.path;
         listenPort = 51820;
-        fwMark = 51821;
-        MTU = 1420;
-
-        table = false;
-        postUp = ''
-PostUp = ip rule add from 10.0.13.0/24 lookup main pref 31000
-PostUp = ip rule add from all fwmark 51821 lookup 51821 pref 32000
-PostUp = ip route add default via 192.168.1.1 dev eth0 table 51821
-
-# NAT iphonebob and allow traffic between peers (when routing through demiurge)
-PostUp = iptables -F FORWARD
-PostUp = iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
-PostUp = iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT
-PostUp = iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT
-PostUp = iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+        fwMark = "51821";
+        mtu = 1420;
+
+        #table = "Off";
+        postSetup = ''
+          ip rule add from 10.0.13.0/24 lookup main pref 31000
+          ip rule add from all fwmark 51821 lookup 51821 pref 32000
+          ip route replace default via 192.168.1.1 dev eth0 table 51821
+
+          # NAT iphonebob and allow traffic between peers (when routing through demiurge)
+          ${pkgs.iptables}/bin/iptables -F FORWARD
+          ${pkgs.iptables}/bin/iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+          ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT
+          ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
         '';
-        preDown = ''
-PreDown = ip rule del from all fwmark 51821 lookup 51821 pref 32000
-PreDown = ip rule del from 10.0.13.0/24 lookup main pref 31000
-PreDown = ip route flush table 51821
+        preShutdown = ''
+          ip rule del from all fwmark 51821 lookup 51821 pref 32000
+          ip rule del from 10.0.13.0/24 lookup main pref 31000
+          ip route flush table 51821
 
-PreDown = iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
-PreDown = iptables -F FORWARD
+          ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
+          ${pkgs.iptables}/bin/iptables -F FORWARD
         '';
 
         peers = [
@@ -191,7 +220,7 @@ PreDown = iptables -F FORWARD
             ];
             persistentKeepalive = 25;
             publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
-          }          
+          }
         ];
       };
     };
@@ -231,7 +260,7 @@ PreDown = iptables -F FORWARD
       packages = with pkgs; [
         alvr
         bs-manager
-        (llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; })
+        #(llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; })
         #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
       ];
     };
@@ -300,37 +329,26 @@ PreDown = iptables -F FORWARD
   services = {
     # dns
     unbound = {
-      enable = true;
+      enable = false;
       settings = {
-              server = {
-                interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ];
-          access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ];
-
-                hide-identity = yes;
-                hide-version = yes;
-
-                # Synthesize NXDOMAINs from DNSSEC NSEC chains.
-                # https://tools.ietf.org/html/rfc8198
-                aggressive-nsec = no;
-
-                local-zone = "saklas.epistemia." redirect;
-                local-data = "saklas.epistemia. 86400 IN A 10.0.13.1";
-                local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1";
-                local-zone = "demiurge.epistemia." redirect;
-                local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2";
-                local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2";
-                local-zone = "hastur.epistemia." redirect;
-                local-data = "hastur.epistemia. 86400 IN A 10.0.13.3";
-                local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3";
-                local-zone = "iphonebob.epistemia." redirect;
-                local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4";
-                local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4";
-                local-zone = "lab.epistemia." redirect;
-                local-data = "lab.epistemia. 86400 IN A 10.0.13.5";
-                local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5";
-                local-zone = "paraclete.epistemia." redirect;
-                local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6";
-                local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6";
+        server = {
+          interface = [
+            "127.0.0.1"
+            "10.0.13.2"
+            "fd00:b0ba:cafe:babe::2"
+            "::1"
+          ];
+          access-control = [
+            "0.0.0.0/0 allow"
+            "::0/0 allow"
+          ];
+
+          hide-identity = true;
+          hide-version = true;
+
+          # Synthesize NXDOMAINs from DNSSEC NSEC chains.
+          # https://tools.ietf.org/html/rfc8198
+          aggressive-nsec = false;
         };
 
         # hagezi for dns-based adblocking (in addition to others)
@@ -341,13 +359,40 @@ PreDown = iptables -F FORWARD
         };
 
         # go through mullvad for regular dns queries
-              forward-zone = {
-                name = ".";
-                forward-addr = [ "100.64.0.3" ];
+        forward-zone = {
+          name = ".";
+          forward-addr = [ "100.64.0.3" ];
         };
+
+        local-data = [
+          "demiurge.epistemia. 86400 IN A 10.0.13.2"
+          "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2"
+          "hastur.epistemia. 86400 IN A 10.0.13.3"
+          "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3"
+          "iphonebob.epistemia. 86400 IN A 10.0.13.4"
+          "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4"
+          "lab.epistemia. 86400 IN A 10.0.13.5"
+          "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5"
+          "paraclete.epistemia. 86400 IN A 10.0.13.6"
+          "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6"
+          "saklas.epistemia. 86400 IN A 10.0.13.1"
+          "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1"
+        ];
+
+        local-zone = [
+          "\"demiurge.epistemia.\" redirect"
+          "\"hastur.epistemia.\" redirect"
+          "\"iphonebob.epistemia.\" redirect"
+          "\"lab.epistemia.\" redirect"
+          "\"paraclete.epistemia.\" redirect"
+          "\"saklas.epistemia.\" redirect"
+        ];
       };
     };
 
+    # automatically scrub zfs pools (every week by default)
+    zfs.autoScrub.enable = true;
+
     # media server
     jellyfin = {
       enable = true;
@@ -415,7 +460,10 @@ PreDown = iptables -F FORWARD
     nginx = {
       enable = true;
 
-      defaultListenAddresses = [ "10.0.13.2" "fd00:b0ba:cafe:babe::2" ];
+      defaultListenAddresses = [
+        "10.0.13.2"
+        "fd00:b0ba:cafe:babe::2"
+      ];
 
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
@@ -525,7 +573,7 @@ PreDown = iptables -F FORWARD
                   }
                 ];
               };
-            };
+            }
           ];
         };
 
@@ -555,66 +603,65 @@ PreDown = iptables -F FORWARD
         };
       };
 
-      # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt)
       wireplumber = {
         enable = true;
         extraConfig."50-smartfilters-airpods.conf".text = ''
-        {
-          "monitor.bluez.rules" : [
-          # When a BlueZ device is detected we set an identifying property that the smart filter will match.
-          # (This fragment adds nothing by default; we're using a policy to match target.node later.)
-        ],
-
-        "policy.rules" : [
-          # The core smart filter matching is done by matching the target.node properties
-          # WirePlumber's smart filters will look for filter.smart.target (set below).
-        ],
-
-        "policy" : {
-          "smart_filters" : {
-            "rules" : [
+            {
+              "monitor.bluez.rules" : [
+              # When a BlueZ device is detected we set an identifying property that the smart filter will match.
+              # (This fragment adds nothing by default; we're using a policy to match target.node later.)
+            ],
+
+            "policy.rules" : [
+              # The core smart filter matching is done by matching the target.node properties
+              # WirePlumber's smart filters will look for filter.smart.target (set below).
+            ],
+
+            "policy" : {
+              "smart_filters" : {
+                "rules" : [
+                  {
+                    "matches" : [
+                      { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
+                    ],
+                    "actions" : {
+                      # If target device matches, set the 'target.node' metadata for smart filters to use
+                      "update-metadata" : {
+                        "target.node" : { "name" : "bluez_output.*AirPods.*" }
+                      }
+                    }
+                  }
+                ]
+              }
+            },
+
+            "endpoint.rules" : [
               {
                 "matches" : [
-                  { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
+                  { "node.name" : "peq-airpods-pro-2-sink" }
                 ],
                 "actions" : {
-                  # If target device matches, set the 'target.node' metadata for smart filters to use
-                  "update-metadata" : {
-                    "target.node" : { "name" : "bluez_output.*AirPods.*" }
+                  "update-props" : {
+                    # Mark this WF sink as intended for a specific target device.
+                    # WirePlumber will use filter.smart.target to identify which device to chain to.
+                    "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
+                  }
+                }
+              },
+              {
+                "matches" : [
+                  { "node.name" : "peq-he5xx-sink" }
+                ],
+                "actions" : {
+                  "update-props" : {
+                    # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules.
+                    "filter.smart.target" : {}
                   }
                 }
               }
             ]
           }
-        },
-
-        "endpoint.rules" : [
-          {
-            "matches" : [
-              { "node.name" : "peq-airpods-pro-2-sink" }
-            ],
-            "actions" : {
-              "update-props" : {
-                # Mark this WF sink as intended for a specific target device.
-                # WirePlumber will use filter.smart.target to identify which device to chain to.
-                "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
-              }
-            }
-          },
-          {
-            "matches" : [
-              { "node.name" : "peq-he5xx-sink" }
-            ],
-            "actions" : {
-              "update-props" : {
-                # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules.
-                "filter.smart.target" : {}
-              }
-            }
-          }
-        ]
-      }
-      '';
+        '';
       };
     };
 
@@ -1106,10 +1153,22 @@ PreDown = iptables -F FORWARD
   };
 
   # extra systemd stuff
-  systemd.services.nginx = {
-    after = [ "wg-quick@wg1.service" ];
-    requires = [ "wg-quick@wg1.service" ];
-    serviceConfig.Type = lib.mkForce "idle";
+  systemd.services = {
+    nginx = {
+      after = [ "wireguard-wg1.service" ];
+      requires = [ "wireguard-wg1.service" ];
+      serviceConfig.Type = lib.mkForce "idle";
+    };
+
+    wireguard-wg0 = {
+      after = [ "network-addresses-eth0.service" ];
+      requires = [ "network-addresses-eth0.service" ];
+    };
+
+    wireguard-wg1 = {
+      after = [ "wireguard-wg0.service" ];
+      requires = [ "wireguard-wg0.service" ];
+    };
   };
 
   # create caches and use mandoc
diff --git a/hosts/demiurge/hardware.nix b/hosts/demiurge/hardware.nix
index 21d7ab3..5fa707c 100644
--- a/hosts/demiurge/hardware.nix
+++ b/hosts/demiurge/hardware.nix
@@ -51,14 +51,8 @@
     options = [ "zfsutil" ];
   };
 
-  fileSystems."/data" = {
-    device = "nvme_warm";
-    fsType = "zfs";
-    options = [ "zfsutil" ];
-  };
-
   fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/1C01-EE5C";
+    device = "/dev/disk/by-uuid/B259-F128";
     fsType = "vfat";
     options = [
       "fmask=0022"