summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--flake.lock28
-rw-r--r--home.nix106
-rw-r--r--hosts/demiurge/default.nix325
-rw-r--r--hosts/demiurge/hardware.nix8
-rw-r--r--secrets/email_13f0.agebin383 -> 383 bytes
-rw-r--r--secrets/email_vinbiz.age12
-rw-r--r--secrets/email_vineetk.agebin383 -> 383 bytes
-rw-r--r--secrets/hetzner_dns.age15
-rw-r--r--secrets/radicale_users.agebin497 -> 387 bytes
-rw-r--r--secrets/secrets.nix2
-rw-r--r--secrets/wg0_demiurge.age12
-rw-r--r--secrets/wg0_hastur.age13
-rw-r--r--secrets/wg1_demiurge.age13
-rw-r--r--secrets/wg1_hastur.agebin367 -> 367 bytes
-rw-r--r--secrets/wpa_supplicant.agebin1095 -> 1095 bytes
15 files changed, 295 insertions, 239 deletions
diff --git a/flake.lock b/flake.lock
index cb977ab..a76b000 100644
--- a/flake.lock
+++ b/flake.lock
@@ -10,11 +10,11 @@
10 "systems": "systems" 10 "systems": "systems"
11 }, 11 },
12 "locked": { 12 "locked": {
13 "lastModified": 1747575206, 13 "lastModified": 1754433428,
14 "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=", 14 "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
15 "owner": "ryantm", 15 "owner": "ryantm",
16 "repo": "agenix", 16 "repo": "agenix",
17 "rev": "4835b1dc898959d8547a871ef484930675cb47f1", 17 "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
18 "type": "github" 18 "type": "github"
19 }, 19 },
20 "original": { 20 "original": {
@@ -163,11 +163,11 @@
163 ] 163 ]
164 }, 164 },
165 "locked": { 165 "locked": {
166 "lastModified": 1747565775, 166 "lastModified": 1758375677,
167 "narHash": "sha256-B6jmKHUEX1jxxcdoYHl7RVaeohtAVup8o3nuVkzkloA=", 167 "narHash": "sha256-BLtD+6qWz7fQjPk2wpwyXQLGI0E30Ikgf2ppn2nVadI=",
168 "owner": "nix-community", 168 "owner": "nix-community",
169 "repo": "home-manager", 169 "repo": "home-manager",
170 "rev": "97118a310eb8e13bc1b9b12d67267e55b7bee6c8", 170 "rev": "edc7468e12be92e926847cb02418e649b02b59dd",
171 "type": "github" 171 "type": "github"
172 }, 172 },
173 "original": { 173 "original": {
@@ -184,8 +184,8 @@
184 ] 184 ]
185 }, 185 },
186 "locked": { 186 "locked": {
187 "lastModified": 1747191788, 187 "lastModified": 0,
188 "narHash": "sha256-dekVtt/TcNszrnWjNX71pme1ZYUaOAaACu4+c0lx6Yg=", 188 "narHash": "sha256-HhI2VI/EZK0ndPUQALEMQmiU073v3L3dVr2xZgo/86w=",
189 "path": "/data/src/clones/llm/llama.cpp", 189 "path": "/data/src/clones/llm/llama.cpp",
190 "type": "path" 190 "type": "path"
191 }, 191 },
@@ -211,11 +211,11 @@
211 }, 211 },
212 "nixpkgs": { 212 "nixpkgs": {
213 "locked": { 213 "locked": {
214 "lastModified": 1747644487, 214 "lastModified": 1758351571,
215 "narHash": "sha256-0Ub4ws2UGgXAQ7qJ6JEhYOjrrf2Ky/7iEWkyEDkKa/U=", 215 "narHash": "sha256-oX0bC06R9gDaE3Yk3YIlXnSxj7Q0wJb31nKqnSfNpvU=",
216 "owner": "nixos", 216 "owner": "nixos",
217 "repo": "nixpkgs", 217 "repo": "nixpkgs",
218 "rev": "949fb7f3087b8d086fd8c92acfa8412c43cfc116", 218 "rev": "0f3383ef02bc092d2f82afa4e556743c6e6b74d6",
219 "type": "github" 219 "type": "github"
220 }, 220 },
221 "original": { 221 "original": {
@@ -272,11 +272,11 @@
272 }, 272 },
273 "nixpkgs-stable": { 273 "nixpkgs-stable": {
274 "locked": { 274 "locked": {
275 "lastModified": 1747485343, 275 "lastModified": 1751274312,
276 "narHash": "sha256-YbsZyuRE1tobO9sv0PUwg81QryYo3L1F3R3rF9bcG38=", 276 "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
277 "owner": "nixos", 277 "owner": "nixos",
278 "repo": "nixpkgs", 278 "repo": "nixpkgs",
279 "rev": "9b5ac7ad45298d58640540d0323ca217f32a6762", 279 "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
280 "type": "github" 280 "type": "github"
281 }, 281 },
282 "original": { 282 "original": {
diff --git a/home.nix b/home.nix
index a56ea21..ee8c5ba 100644
--- a/home.nix
+++ b/home.nix
@@ -38,26 +38,29 @@ let
38 extraPkgs = pkgs: [ pkgs.icu ]; 38 extraPkgs = pkgs: [ pkgs.icu ];
39 }; 39 };
40 40
41 my-texlive = with pkgs; texlive.withPackages (texlivePackages: with texlivePackages; [ 41 my-texlive =
42 # A minimal base scheme and a common build tool 42 with pkgs;
43 scheme-small 43 texlive.withPackages (
44 latexmk 44 texlivePackages: with texlivePackages; [
45 45 # A minimal base scheme and a common build tool
46 # Packages from your research paper's preamble 46 scheme-small
47 amsmath 47 latexmk
48 graphicx 48
49 siunitx 49 # Packages from your research paper's preamble
50 booktabs 50 amsmath
51 algorithm2e 51 siunitx
52 caption 52 booktabs
53 pslatex 53 algorithm2e
54 ec 54 caption
55 microtype 55 pslatex
56 cite 56 ec
57 url 57 microtype
58 xcolor 58 cite
59 hyperref 59 url
60 ]); 60 xcolor
61 hyperref
62 ]
63 );
61 64
62in 65in
63{ 66{
@@ -99,6 +102,7 @@ in
99 #unzip 102 #unzip
100 #p7zip 103 #p7zip
101 ripgrep 104 ripgrep
105 nixfmt-rfc-style
102 106
103 # X and desktop-related 107 # X and desktop-related
104 scrot 108 scrot
@@ -390,20 +394,20 @@ in
390 394
391 mpv = { 395 mpv = {
392 enable = true; 396 enable = true;
393 package = pkgs.mpv.override { 397 # package = pkgs.mpv.override {
394 archiveSupport = false; 398 # archiveSupport = false;
395 bluraySupport = false; 399 # bluraySupport = false;
396 bs2bSupport = false; 400 # bs2bSupport = false;
397 cacaSupport = false; 401 # cacaSupport = false;
398 cmsSupport = false; 402 # cmsSupport = false;
399 dvdnavSupport = false; 403 # dvdnavSupport = false;
400 javascriptSupport = false; 404 # javascriptSupport = false;
401 pipewireSupport = true; 405 # pipewireSupport = true;
402 pulseSupport = false; 406 # pulseSupport = false;
403 rubberbandSupport = false; 407 # rubberbandSupport = false;
404 waylandSupport = false; 408 # waylandSupport = false;
405 zimgSupport = false; 409 # zimgSupport = false;
406 }; 410 # };
407 411
408 bindings = { 412 bindings = {
409 # I wish there was a more elegant way of setting Anime4K 413 # I wish there was a more elegant way of setting Anime4K
@@ -441,17 +445,18 @@ in
441 }; 445 };
442 hooks = { 446 hooks = {
443 postNew = '' 447 postNew = ''
444 notmuch tag +13f0 -- tag:unread and to:"*@13f0.net" 448 notmuch tag +13f0 -- tag:unread and to:"*@13f0.net"
445 notmuch tag +vineetk -- tag:unread and to:"*@vineetk.net" 449 notmuch tag +vineetk -- tag:unread and to:"*@vineetk.net"
446 notmuch tag +university -- tag:unread and to:"*@floridapoly.edu" 450 notmuch tag +university -- tag:unread and to:vsureshkumar3892@floridapoly.edu
447 notmuch tag +openbsd_announce -inbox -- tag:unread and to:announce@openbsd.org 451 notmuch tag +openbsd_announce -inbox -- tag:unread and to:announce@openbsd.org
448 notmuch tag +openbsd_arm -inbox -- tag:unread and to:arm@openbsd.org 452 notmuch tag +openbsd_arm -inbox -- tag:unread and to:arm@openbsd.org
449 notmuch tag +openbsd_misc -inbox -- tag:unread and to:misc@openbsd.org 453 notmuch tag +gameoftrees -inbox -- tag:unread and to:gameoftrees@openbsd.org
450 notmuch tag +openbsd_ports -inbox -- tag:unread and to:ports@openbsd.org 454 notmuch tag +openbsd_misc -inbox -- tag:unread and to:misc@openbsd.org
451 notmuch tag +openbsd_tech -inbox -- tag:unread and to:tech@openbsd.org 455 notmuch tag +openbsd_ports -inbox -- tag:unread and to:ports@openbsd.org
452 notmuch tag +opensmtpd_misc -inbox -- tag:unread and to:misc@opensmtpd.org 456 notmuch tag +openbsd_tech -inbox -- tag:unread and to:tech@openbsd.org
453 notmuch tag +oss_security -inbox -- tag:unread and to:oss-security@lists.openwall.com 457 notmuch tag +opensmtpd_misc -inbox -- tag:unread and to:misc@opensmtpd.org
454 notmuch tag +tuhs -inbox -- tag:unread and to:tuhs@tuhs.org 458 notmuch tag +oss_security -inbox -- tag:unread and to:oss-security@lists.openwall.com
459 notmuch tag +tuhs -inbox -- tag:unread and to:tuhs@tuhs.org
455 ''; 460 '';
456 preNew = "mbsync -a"; 461 preNew = "mbsync -a";
457 }; 462 };
@@ -573,14 +578,15 @@ in
573 yt-dlp = { 578 yt-dlp = {
574 enable = true; 579 enable = true;
575 settings = { 580 settings = {
576 merge-output-format = "mkv"; 581 format-sort = "res:1440,vcodec:vp9,acodec:opus";
577 embed-subs = true;
578 embed-metadata = true; 582 embed-metadata = true;
583 embed-subs = true;
579 embed-thumbnail = true; 584 embed-thumbnail = true;
585 merge-output-format = "mkv";
580 sub-langs = "en,-livechat"; 586 sub-langs = "en,-livechat";
581 format = "bestvideo[height<=?1440]+bestaudio/best"; 587 no-windows-filenames = true;
582 downloader = "aria2c"; 588 sponsorblock-remove = "sponsor,selfpromo,music_offtopic,-filler,-preview";
583 downloader-args = "aria2c:'-c -x8 -s8 -k1M'"; 589 sponsorblock-mark = "filler,preview,intro,outro";
584 }; 590 };
585 }; 591 };
586 592
diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix
index c53c3eb..f3259df 100644
--- a/hosts/demiurge/default.nix
+++ b/hosts/demiurge/default.nix
@@ -21,6 +21,7 @@
21 allowUnfreePredicate = 21 allowUnfreePredicate =
22 pkg: 22 pkg:
23 builtins.elem (lib.getName pkg) [ 23 builtins.elem (lib.getName pkg) [
24 "open-webui"
24 "steam" 25 "steam"
25 "steam-unwrapped" 26 "steam-unwrapped"
26 ]; 27 ];
@@ -42,16 +43,14 @@
42 super.usbutils 43 super.usbutils
43 ]; 44 ];
44 nativeBuildInputs = old.nativeBuildInputs ++ [ super.makeWrapper ]; 45 nativeBuildInputs = old.nativeBuildInputs ++ [ super.makeWrapper ];
45 postInstall = 46 postInstall = (old.postInstall or "") + ''
46 (old.postInstall or "") 47 wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${
47 + '' 48 super.lib.makeBinPath [
48 wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${ 49 super.android-tools
49 super.lib.makeBinPath [ 50 super.usbutils
50 super.android-tools 51 ]
51 super.usbutils 52 }"
52 ] 53 '';
53 }"
54 '';
55 }); 54 });
56 }) 55 })
57 ]; 56 ];
@@ -60,7 +59,7 @@
60 # decrypt agenix secrets 59 # decrypt agenix secrets
61 age.secrets = { 60 age.secrets = {
62 wg0_demiurge.file = ../../secrets/wg0_demiurge.age; 61 wg0_demiurge.file = ../../secrets/wg0_demiurge.age;
63 wg1_demiurge.file = ../../secrets/wg0_demiurge.age; 62 wg1_demiurge.file = ../../secrets/wg1_demiurge.age;
64 }; 63 };
65 64
66 # boot options 65 # boot options
@@ -70,17 +69,23 @@
70 "net.ipv6.conf.all.forwarding" = true; 69 "net.ipv6.conf.all.forwarding" = true;
71 }; 70 };
72 71
73 kernelPackages = pkgs.linuxPackages_6_13; 72 kernelPackages = pkgs.linuxPackages_6_12;
74 73
75 loader = { 74 loader = {
76 systemd-boot.enable = true; 75 systemd-boot.enable = true;
77 efi.canTouchEfiVariables = true; 76 efi.canTouchEfiVariables = true;
78 }; 77 };
79 78
80 zfs.extraPools = [ 79 supportedFilesystems = [ "zfs" ];
81 "data_wd" 80
82 "data" 81 zfs = {
83 ]; 82 devNodes = "/dev/disk/by-partuuid";
83 extraPools = [
84 "data_nvme"
85 "data_wd"
86 ];
87 forceImportRoot = false;
88 };
84 }; 89 };
85 90
86 # disable wifi and open some ports 91 # disable wifi and open some ports
@@ -88,6 +93,9 @@
88 hostName = "demiurge"; 93 hostName = "demiurge";
89 hostId = "cafebabe"; 94 hostId = "cafebabe";
90 95
96 # I like my ethX/wlanX names
97 usePredictableInterfaceNames = false;
98
91 wireless.enable = false; 99 wireless.enable = false;
92 100
93 firewall = { 101 firewall = {
@@ -99,59 +107,80 @@
99 allowedUDPPorts = [ 51413 ]; 107 allowedUDPPorts = [ 51413 ];
100 }; 108 };
101 109
102 wg-quick.interfaces = { 110 interfaces.eth0 = {
111 ipv4.addresses = [
112 {
113 address = "192.168.1.2";
114 prefixLength = 24;
115 }
116 ];
117 };
118 defaultGateway = {
119 address = "192.168.1.1";
120 interface = "eth0";
121 };
122
123 wireguard.interfaces = {
103 # mullvad 124 # mullvad
104 wg0 = { 125 wg0 = {
105 address = [ 126 ips = [
106 "10.68.117.111/32" 127 "10.68.117.111/32"
107 "fc00:bbbb:bbbb:bb01::5:756e/128" 128 "fc00:bbbb:bbbb:bb01::5:756e/128"
108 ]; 129 ];
109 privateKeyFile = config.age.secrets.wg0_demiurge.path; 130 privateKeyFile = config.age.secrets.wg0_demiurge.path;
110 131
111 postUp = "ip route add 45.134.142.206 dev eth0"; 132 postSetup = ''
112 postDown = "ip route del 45.134.142.206 dev eth0"; 133 ip route add 45.134.142.206 via 192.168.1.1
134 ip route add default via 45.134.142.206
135 '';
136 postShutdown = ''
137 ip route del default via 45.134.142.206
138 ip route del 45.134.142.206 via 192.168.1.1
139 '';
113 140
114 peers = [{ 141 peers = [
142 {
115 allowedIPs = [ 143 allowedIPs = [
116 "0.0.0.0/0" 144 "0.0.0.0/0"
117 "::0/0" 145 "::0/0"
118 ]; 146 ];
119 endpoint = "45.134.142.206:51820"; 147 endpoint = "45.134.142.206:51820";
120 publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw="; 148 publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw=";
121 }]; 149 }
150 ];
122 }; 151 };
123 152
124 # epistemia 153 # epistemia
125 wg1 = { 154 wg1 = {
126 address = [ 155 ips = [
127 "10.0.13.2/24" 156 "10.0.13.2/24"
128 "fd00:b0ba:cafe:babe::2/64" 157 "fd00:b0ba:cafe:babe::2/64"
129 ]; 158 ];
130 privateKeyFile = config.age.secrets.wg1_demiurge.path; 159 privateKeyFile = config.age.secrets.wg1_demiurge.path;
131 listenPort = 51820; 160 listenPort = 51820;
132 fwMark = 51821; 161 fwMark = "51821";
133 MTU = 1420; 162 mtu = 1420;
134 163
135 table = false; 164 #table = "Off";
136 postUp = '' 165 postSetup = ''
137PostUp = ip rule add from 10.0.13.0/24 lookup main pref 31000 166 ip rule add from 10.0.13.0/24 lookup main pref 31000
138PostUp = ip rule add from all fwmark 51821 lookup 51821 pref 32000 167 ip rule add from all fwmark 51821 lookup 51821 pref 32000
139PostUp = ip route add default via 192.168.1.1 dev eth0 table 51821 168 ip route replace default via 192.168.1.1 dev eth0 table 51821
140 169
141# NAT iphonebob and allow traffic between peers (when routing through demiurge) 170 # NAT iphonebob and allow traffic between peers (when routing through demiurge)
142PostUp = iptables -F FORWARD 171 ${pkgs.iptables}/bin/iptables -F FORWARD
143PostUp = iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE 172 ${pkgs.iptables}/bin/iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE
144PostUp = iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT 173 ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT
145PostUp = iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT 174 ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT
146PostUp = iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 175 ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
147 ''; 176 '';
148 preDown = '' 177 preShutdown = ''
149PreDown = ip rule del from all fwmark 51821 lookup 51821 pref 32000 178 ip rule del from all fwmark 51821 lookup 51821 pref 32000
150PreDown = ip rule del from 10.0.13.0/24 lookup main pref 31000 179 ip rule del from 10.0.13.0/24 lookup main pref 31000
151PreDown = ip route flush table 51821 180 ip route flush table 51821
152 181
153PreDown = iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE 182 ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE
154PreDown = iptables -F FORWARD 183 ${pkgs.iptables}/bin/iptables -F FORWARD
155 ''; 184 '';
156 185
157 peers = [ 186 peers = [
@@ -191,7 +220,7 @@ PreDown = iptables -F FORWARD
191 ]; 220 ];
192 persistentKeepalive = 25; 221 persistentKeepalive = 25;
193 publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE="; 222 publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE=";
194 } 223 }
195 ]; 224 ];
196 }; 225 };
197 }; 226 };
@@ -231,7 +260,7 @@ PreDown = iptables -F FORWARD
231 packages = with pkgs; [ 260 packages = with pkgs; [
232 alvr 261 alvr
233 bs-manager 262 bs-manager
234 (llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; }) 263 #(llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; })
235 #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; }) 264 #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; })
236 ]; 265 ];
237 }; 266 };
@@ -300,37 +329,26 @@ PreDown = iptables -F FORWARD
300 services = { 329 services = {
301 # dns 330 # dns
302 unbound = { 331 unbound = {
303 enable = true; 332 enable = false;
304 settings = { 333 settings = {
305 server = { 334 server = {
306 interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ]; 335 interface = [
307 access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ]; 336 "127.0.0.1"
308 337 "10.0.13.2"
309 hide-identity = yes; 338 "fd00:b0ba:cafe:babe::2"
310 hide-version = yes; 339 "::1"
311 340 ];
312 # Synthesize NXDOMAINs from DNSSEC NSEC chains. 341 access-control = [
313 # https://tools.ietf.org/html/rfc8198 342 "0.0.0.0/0 allow"
314 aggressive-nsec = no; 343 "::0/0 allow"
315 344 ];
316 local-zone = "saklas.epistemia." redirect; 345
317 local-data = "saklas.epistemia. 86400 IN A 10.0.13.1"; 346 hide-identity = true;
318 local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1"; 347 hide-version = true;
319 local-zone = "demiurge.epistemia." redirect; 348
320 local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2"; 349 # Synthesize NXDOMAINs from DNSSEC NSEC chains.
321 local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2"; 350 # https://tools.ietf.org/html/rfc8198
322 local-zone = "hastur.epistemia." redirect; 351 aggressive-nsec = false;
323 local-data = "hastur.epistemia. 86400 IN A 10.0.13.3";
324 local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3";
325 local-zone = "iphonebob.epistemia." redirect;
326 local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4";
327 local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4";
328 local-zone = "lab.epistemia." redirect;
329 local-data = "lab.epistemia. 86400 IN A 10.0.13.5";
330 local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5";
331 local-zone = "paraclete.epistemia." redirect;
332 local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6";
333 local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6";
334 }; 352 };
335 353
336 # hagezi for dns-based adblocking (in addition to others) 354 # hagezi for dns-based adblocking (in addition to others)
@@ -341,13 +359,40 @@ PreDown = iptables -F FORWARD
341 }; 359 };
342 360
343 # go through mullvad for regular dns queries 361 # go through mullvad for regular dns queries
344 forward-zone = { 362 forward-zone = {
345 name = "."; 363 name = ".";
346 forward-addr = [ "100.64.0.3" ]; 364 forward-addr = [ "100.64.0.3" ];
347 }; 365 };
366
367 local-data = [
368 "demiurge.epistemia. 86400 IN A 10.0.13.2"
369 "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2"
370 "hastur.epistemia. 86400 IN A 10.0.13.3"
371 "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3"
372 "iphonebob.epistemia. 86400 IN A 10.0.13.4"
373 "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4"
374 "lab.epistemia. 86400 IN A 10.0.13.5"
375 "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5"
376 "paraclete.epistemia. 86400 IN A 10.0.13.6"
377 "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6"
378 "saklas.epistemia. 86400 IN A 10.0.13.1"
379 "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1"
380 ];
381
382 local-zone = [
383 "\"demiurge.epistemia.\" redirect"
384 "\"hastur.epistemia.\" redirect"
385 "\"iphonebob.epistemia.\" redirect"
386 "\"lab.epistemia.\" redirect"
387 "\"paraclete.epistemia.\" redirect"
388 "\"saklas.epistemia.\" redirect"
389 ];
348 }; 390 };
349 }; 391 };
350 392
393 # automatically scrub zfs pools (every week by default)
394 zfs.autoScrub.enable = true;
395
351 # media server 396 # media server
352 jellyfin = { 397 jellyfin = {
353 enable = true; 398 enable = true;
@@ -415,7 +460,10 @@ PreDown = iptables -F FORWARD
415 nginx = { 460 nginx = {
416 enable = true; 461 enable = true;
417 462
418 defaultListenAddresses = [ "10.0.13.2" "fd00:b0ba:cafe:babe::2" ]; 463 defaultListenAddresses = [
464 "10.0.13.2"
465 "fd00:b0ba:cafe:babe::2"
466 ];
419 467
420 recommendedGzipSettings = true; 468 recommendedGzipSettings = true;
421 recommendedOptimisation = true; 469 recommendedOptimisation = true;
@@ -525,7 +573,7 @@ PreDown = iptables -F FORWARD
525 } 573 }
526 ]; 574 ];
527 }; 575 };
528 }; 576 }
529 ]; 577 ];
530 }; 578 };
531 579
@@ -555,66 +603,65 @@ PreDown = iptables -F FORWARD
555 }; 603 };
556 }; 604 };
557 605
558 # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt)
559 wireplumber = { 606 wireplumber = {
560 enable = true; 607 enable = true;
561 extraConfig."50-smartfilters-airpods.conf".text = '' 608 extraConfig."50-smartfilters-airpods.conf".text = ''
562 { 609 {
563 "monitor.bluez.rules" : [ 610 "monitor.bluez.rules" : [
564 # When a BlueZ device is detected we set an identifying property that the smart filter will match. 611 # When a BlueZ device is detected we set an identifying property that the smart filter will match.
565 # (This fragment adds nothing by default; we're using a policy to match target.node later.) 612 # (This fragment adds nothing by default; we're using a policy to match target.node later.)
566 ], 613 ],
567 614
568 "policy.rules" : [ 615 "policy.rules" : [
569 # The core smart filter matching is done by matching the target.node properties 616 # The core smart filter matching is done by matching the target.node properties
570 # WirePlumber's smart filters will look for filter.smart.target (set below). 617 # WirePlumber's smart filters will look for filter.smart.target (set below).
571 ], 618 ],
572 619
573 "policy" : { 620 "policy" : {
574 "smart_filters" : { 621 "smart_filters" : {
575 "rules" : [ 622 "rules" : [
623 {
624 "matches" : [
625 { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } }
626 ],
627 "actions" : {
628 # If target device matches, set the 'target.node' metadata for smart filters to use
629 "update-metadata" : {
630 "target.node" : { "name" : "bluez_output.*AirPods.*" }
631 }
632 }
633 }
634 ]
635 }
636 },
637
638 "endpoint.rules" : [
576 { 639 {
577 "matches" : [ 640 "matches" : [
578 { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } } 641 { "node.name" : "peq-airpods-pro-2-sink" }
579 ], 642 ],
580 "actions" : { 643 "actions" : {
581 # If target device matches, set the 'target.node' metadata for smart filters to use 644 "update-props" : {
582 "update-metadata" : { 645 # Mark this WF sink as intended for a specific target device.
583 "target.node" : { "name" : "bluez_output.*AirPods.*" } 646 # WirePlumber will use filter.smart.target to identify which device to chain to.
647 "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
648 }
649 }
650 },
651 {
652 "matches" : [
653 { "node.name" : "peq-he5xx-sink" }
654 ],
655 "actions" : {
656 "update-props" : {
657 # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules.
658 "filter.smart.target" : {}
584 } 659 }
585 } 660 }
586 } 661 }
587 ] 662 ]
588 } 663 }
589 }, 664 '';
590
591 "endpoint.rules" : [
592 {
593 "matches" : [
594 { "node.name" : "peq-airpods-pro-2-sink" }
595 ],
596 "actions" : {
597 "update-props" : {
598 # Mark this WF sink as intended for a specific target device.
599 # WirePlumber will use filter.smart.target to identify which device to chain to.
600 "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" }
601 }
602 }
603 },
604 {
605 "matches" : [
606 { "node.name" : "peq-he5xx-sink" }
607 ],
608 "actions" : {
609 "update-props" : {
610 # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules.
611 "filter.smart.target" : {}
612 }
613 }
614 }
615 ]
616 }
617 '';
618 }; 665 };
619 }; 666 };
620 667
@@ -1106,10 +1153,22 @@ PreDown = iptables -F FORWARD
1106 }; 1153 };
1107 1154
1108 # extra systemd stuff 1155 # extra systemd stuff
1109 systemd.services.nginx = { 1156 systemd.services = {
1110 after = [ "wg-quick@wg1.service" ]; 1157 nginx = {
1111 requires = [ "wg-quick@wg1.service" ]; 1158 after = [ "wireguard-wg1.service" ];
1112 serviceConfig.Type = lib.mkForce "idle"; 1159 requires = [ "wireguard-wg1.service" ];
1160 serviceConfig.Type = lib.mkForce "idle";
1161 };
1162
1163 wireguard-wg0 = {
1164 after = [ "network-addresses-eth0.service" ];
1165 requires = [ "network-addresses-eth0.service" ];
1166 };
1167
1168 wireguard-wg1 = {
1169 after = [ "wireguard-wg0.service" ];
1170 requires = [ "wireguard-wg0.service" ];
1171 };
1113 }; 1172 };
1114 1173
1115 # create caches and use mandoc 1174 # create caches and use mandoc
diff --git a/hosts/demiurge/hardware.nix b/hosts/demiurge/hardware.nix
index 21d7ab3..5fa707c 100644
--- a/hosts/demiurge/hardware.nix
+++ b/hosts/demiurge/hardware.nix
@@ -51,14 +51,8 @@
51 options = [ "zfsutil" ]; 51 options = [ "zfsutil" ];
52 }; 52 };
53 53
54 fileSystems."/data" = {
55 device = "nvme_warm";
56 fsType = "zfs";
57 options = [ "zfsutil" ];
58 };
59
60 fileSystems."/boot" = { 54 fileSystems."/boot" = {
61 device = "/dev/disk/by-uuid/1C01-EE5C"; 55 device = "/dev/disk/by-uuid/B259-F128";
62 fsType = "vfat"; 56 fsType = "vfat";
63 options = [ 57 options = [
64 "fmask=0022" 58 "fmask=0022"
diff --git a/secrets/email_13f0.age b/secrets/email_13f0.age
index 7fb7410..5430245 100644
--- a/secrets/email_13f0.age
+++ b/secrets/email_13f0.age
Binary files differ
diff --git a/secrets/email_vinbiz.age b/secrets/email_vinbiz.age
index 041f2e9..1759259 100644
--- a/secrets/email_vinbiz.age
+++ b/secrets/email_vinbiz.age
@@ -1,7 +1,7 @@
1age-encryption.org/v1 1age-encryption.org/v1
2-> ssh-ed25519 AaF/mQ XcNpUXvbz6PsCgeEZMf1+yMrjIipzsesAKO+EssReTw 2-> ssh-ed25519 AaF/mQ wh3j/RdgUlB4N9ELW4nj7HNFIpBJjlHdjAq0IblREyo
3EcDIICNjeS3KKev0qK/0v7V/86QdOWYNaTyFDFE435I 39KBAruMKWSX36w64FQdJ/MO6xQN7rdW8VqsDD8nZYZI
4-> ssh-ed25519 hc2ELA rO5kM81Uk4G5bowyCzGUZdBvqxvcNctjdrD1+Tfk8VY 4-> ssh-ed25519 hc2ELA n8fCpvkGsZQpOJ6q8v82/NT8RPD35FVc6Vxn/yrdhlc
51ef+BiIAJFFKpNAPb2QHHzrxTAyNyj7Hc/nArculdsc 5AFFEH8EHZmauCrJGINblMqVJFHxE6e+XQjWUjowngok
6--- TrgPJhsRCmQuOl9m51XUHnhV+pBlbj0iYgzXUojgjTw 6--- kESRP7l0kqMovGR7QMFSKUtaUN/NPA82WYd9dBtKP2U
7cm/(,{W}yxAՙT^\#W-ČO4dϑd[Ce0 .v\q& \ No newline at end of file 72kZHXSQ]<&|`V=(`vSC ;00Rd!?Eu}yiXov˦b&!‚ \ No newline at end of file
diff --git a/secrets/email_vineetk.age b/secrets/email_vineetk.age
index c42b4a6..f2fdc81 100644
--- a/secrets/email_vineetk.age
+++ b/secrets/email_vineetk.age
Binary files differ
diff --git a/secrets/hetzner_dns.age b/secrets/hetzner_dns.age
index 10b86d9..6413b31 100644
--- a/secrets/hetzner_dns.age
+++ b/secrets/hetzner_dns.age
@@ -1,10 +1,7 @@
1age-encryption.org/v1 1age-encryption.org/v1
2-> ssh-ed25519 AaF/mQ hK2xroga7vLhQxaIBFaP+nrJF8KIxrFaST2RdVedBEI 2-> ssh-ed25519 AaF/mQ YL7+ucBetoT2UoL9qjF9DJteCiMtFdasQsCewT1BD10
3vzgZ49FsgITyEUwwpMJllIohNE2BHpf634e6NUnuLyM 37Ul9wBD8q0+C2+EDXtIf1EJZiQILTAyKBDBBZLymwGc
4-> ssh-ed25519 F30WWA vtiebrA6nc2DhyBGpFKUKv/PZhC89mfw4VJi5JEHekg 4-> ssh-ed25519 hc2ELA SRY6T7u+UPyVrXIMYe33XJCx9kufjKBQiEaa+b+G21k
5LeeJAKYlywoNoTsbdCWoe+xGN4DDtBq/Zx2jjF5AXos 5iurQl6gJUqlA2l7NYfWgmjSMiSYNwSmp2eYxfLwAg1o
6-> ssh-ed25519 hc2ELA AYBEPYt0guu6DkCTq/DFPAuhDbyb0xlD/Q3YRD9r0TE 6--- lBjJlPWS++Wn8DuZVtPscOhY+oydziGsy3EmCSDk6b4
7t7r0IU70rRLIYuUiSbypwIBiwrkeeDbSr9A8rC57AUo 7X|J=cF >c-`,#M/ue]Agx|\*^m:Qc[1 \ No newline at end of file
8--- YFPGnH20/JpT0vHriDFL3ZGHDElBuU6JU4ygDK87JQs
9tjR堸}X%x "
10Ick ܇kR܏"ps$i;BVl8< \ No newline at end of file
diff --git a/secrets/radicale_users.age b/secrets/radicale_users.age
index 21091c1..0278c6a 100644
--- a/secrets/radicale_users.age
+++ b/secrets/radicale_users.age
Binary files differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index c1c6978..0d46c6d 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -2,7 +2,7 @@ let
2 vin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"; 2 vin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge";
3 users = [ vin ]; 3 users = [ vin ];
4 4
5 demiurge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICXDBcX7hXJCaKDRNaIAfycU83Y2J+uEB4wcALBOQpse"; 5 demiurge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBcyABhvBR+UR6PhEmd7ygJqUPeytK6IyljypxkQbZW";
6 hastur = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2ZUuPSPpIRULzMscBo5DJmA0UbFtG0jaANuzHo5aSQ"; 6 hastur = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2ZUuPSPpIRULzMscBo5DJmA0UbFtG0jaANuzHo5aSQ";
7 saklas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM7RCmfdgJKPnaBi336ZcvDWboxPj8lTtW1eDTN5qR2R"; 7 saklas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM7RCmfdgJKPnaBi336ZcvDWboxPj8lTtW1eDTN5qR2R";
8 systems = [ 8 systems = [
diff --git a/secrets/wg0_demiurge.age b/secrets/wg0_demiurge.age
index 11f2561..85d6e3d 100644
--- a/secrets/wg0_demiurge.age
+++ b/secrets/wg0_demiurge.age
@@ -1,7 +1,7 @@
1age-encryption.org/v1 1age-encryption.org/v1
2-> ssh-ed25519 AaF/mQ yqsS5z6keZjZRc2WECiDtrIQ81uy9dPNuC+4JL4QGgQ 2-> ssh-ed25519 AaF/mQ 8mtbBEikYRatTBx3ulZV4KeSsiH7OIw/GrDtbF9pWyU
3PZfc4aEh3zIexIpLjcJjtPmXN7nFNFPzUcsjwNj1GtI 3liYjeeUNddFsDfT68D/EacHK1zSVGIHDZXP5X1sMDFc
4-> ssh-ed25519 F30WWA lK3glF0i1Z8i16YF+Pc7AlJjEk3zETFt6HYBrzHntFk 4-> ssh-ed25519 8fETJg +XTbKFpXPrlNSLKf7eZWQMNhx+hlTpwFvSiBYoKYVXk
5hsh9wGSi08ZFGUzF8nl3aT3EqMmciGTDjvfxW9FXNKA 578D/CEvi739R7pfbcXXBl8CS8vFFD7rSZ99nqdxk3c0
6--- 5SHG64tPuD9a4EfWVs8RteQTpBcNR9ZiLKvuUukraZI 6--- QJPOO68vtmqgaHk4yZ0mOx8psnKf9V7154pJo7kCgD4
7k] !ax^OLOb^93@h)Vx˲-"!AR \ No newline at end of file 7Y<: _!=jeOmMGy ӿ(҈us#18g22OQ9!4jODЬ \ No newline at end of file
diff --git a/secrets/wg0_hastur.age b/secrets/wg0_hastur.age
index 83079cf..b58442e 100644
--- a/secrets/wg0_hastur.age
+++ b/secrets/wg0_hastur.age
@@ -1,8 +1,7 @@
1age-encryption.org/v1 1age-encryption.org/v1
2-> ssh-ed25519 AaF/mQ 56BWU8ca94VnN9a2XS9MyMECcA2NnUvclaIgzsAasGw 2-> ssh-ed25519 AaF/mQ wP+33FStqbBWU/Y6/+IH/xp63Db32bBjdg1eHmlqxhw
34ym2vDPFta3Jjp1ZEmGg+4QjtfqCv98crJmFFJxK4Wk 3tvItMKy4hkhyyQP7ZSUafbYShslrAufUDvgpowZDhvQ
4-> ssh-ed25519 CQpZUw 8T0BdKSFpFj9j8wfe2h9s1uvweGDlJYmLaBaF1h+31A 4-> ssh-ed25519 CQpZUw cNpihxkJx0SNeOJoyiLXxljIJHPDtxp+PQU7WRh8KS8
5JV2ckgV8Hg6EYx44Uh0XF3FvZf6T5bnRULT+5pCueLw 5y77XLusUoW8i1qPb4v9EFv/YLCif+mwIiRVwjANlLL0
6--- jB4Nfx/RnFtL0sOSc0mfZ3a98IsDl03dAj0SqqqZoz0 6--- mFeHPan7I2otyM9Eg0Ww5WQoU8m0maNjWe0zXhK9ks8
7oR-ɨKlЍlg a!RĝX)_Tě 7-y޸4&]d,q(Zxj=!92ib<Pyd~j>yG #͜gk5F \ No newline at end of file
8nclyV2!Yqkpjois| \ No newline at end of file
diff --git a/secrets/wg1_demiurge.age b/secrets/wg1_demiurge.age
index b9bbbff..42e254c 100644
--- a/secrets/wg1_demiurge.age
+++ b/secrets/wg1_demiurge.age
@@ -1,7 +1,8 @@
1age-encryption.org/v1 1age-encryption.org/v1
2-> ssh-ed25519 AaF/mQ MX+cICKRHIB8NaZ6+Kdz6wmhGQHgzNthVe4BiFp3V2c 2-> ssh-ed25519 AaF/mQ s5k0xBJHij3zt4XcBnYCRLTr3fMS917cDJFJE7kqu1g
3pZa2tCwE4YRTS/4kTdlu5DrHNFePU8BiDNXZI0Uaeg0 3pcW+ATcSqS1xfBoIax6T5Z8cyKThDvXltYVpX71uqcs
4-> ssh-ed25519 F30WWA UfyQtZSmrl9pw9FVNCxGOo0ICIglS9Q4sDRTg/1PXTw 4-> ssh-ed25519 8fETJg KHNOh1VCLvANjtqspWLDcbkyoGP/r0EyYLPzUdNzWXk
5Sd6q4jECTtdRfGbgeAf/AniX5gw64ZZ/PrESAlst5tg 5XvA4LzN96uMoCD0ZLffCFBNVKgYaZ420X8uLGW9yWnc
6--- YkDaRa81QgMNVefXmDCPv2OdDI1BtMO4AhixPoKx2Os 6--- 4uATkKlQIj3nvgtQ0spcODHVsyzFbY1hRryq3gkKnso
78ח/-p>т^?A$<>|!0M u-Azm/g!;tᙌǙ!ݎ \ No newline at end of file 7Y*["X~Oaji*i) Pw(qH
8r9C ^1j_xMHiEh}nF \ No newline at end of file
diff --git a/secrets/wg1_hastur.age b/secrets/wg1_hastur.age
index 62841ca..197c2fb 100644
--- a/secrets/wg1_hastur.age
+++ b/secrets/wg1_hastur.age
Binary files differ
diff --git a/secrets/wpa_supplicant.age b/secrets/wpa_supplicant.age
index f7a08ec..310e36f 100644
--- a/secrets/wpa_supplicant.age
+++ b/secrets/wpa_supplicant.age
Binary files differ
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-03 05:17:01 +0000