From e34fc237e405e79dff3fa27f6124a4ec4a2e25ea Mon Sep 17 00:00:00 2001 From: vin Date: Sat, 20 Sep 2025 22:11:24 -0400 Subject: a --- flake.lock | 28 ++-- home.nix | 106 ++++++++------- hosts/demiurge/default.nix | 325 ++++++++++++++++++++++++++------------------ hosts/demiurge/hardware.nix | 8 +- secrets/email_13f0.age | Bin 383 -> 383 bytes secrets/email_vinbiz.age | 12 +- secrets/email_vineetk.age | Bin 383 -> 383 bytes secrets/hetzner_dns.age | 15 +- secrets/radicale_users.age | Bin 497 -> 387 bytes secrets/secrets.nix | 2 +- secrets/wg0_demiurge.age | 12 +- secrets/wg0_hastur.age | 13 +- secrets/wg1_demiurge.age | 13 +- secrets/wg1_hastur.age | Bin 367 -> 367 bytes secrets/wpa_supplicant.age | Bin 1095 -> 1095 bytes 15 files changed, 295 insertions(+), 239 deletions(-) diff --git a/flake.lock b/flake.lock index cb977ab..a76b000 100644 --- a/flake.lock +++ b/flake.lock @@ -10,11 +10,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1747575206, - "narHash": "sha256-NwmAFuDUO/PFcgaGGr4j3ozG9Pe5hZ/ogitWhY+D81k=", + "lastModified": 1754433428, + "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=", "owner": "ryantm", "repo": "agenix", - "rev": "4835b1dc898959d8547a871ef484930675cb47f1", + "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d", "type": "github" }, "original": { @@ -163,11 +163,11 @@ ] }, "locked": { - "lastModified": 1747565775, - "narHash": "sha256-B6jmKHUEX1jxxcdoYHl7RVaeohtAVup8o3nuVkzkloA=", + "lastModified": 1758375677, + "narHash": "sha256-BLtD+6qWz7fQjPk2wpwyXQLGI0E30Ikgf2ppn2nVadI=", "owner": "nix-community", "repo": "home-manager", - "rev": "97118a310eb8e13bc1b9b12d67267e55b7bee6c8", + "rev": "edc7468e12be92e926847cb02418e649b02b59dd", "type": "github" }, "original": { @@ -184,8 +184,8 @@ ] }, "locked": { - "lastModified": 1747191788, - "narHash": "sha256-dekVtt/TcNszrnWjNX71pme1ZYUaOAaACu4+c0lx6Yg=", + "lastModified": 0, + "narHash": "sha256-HhI2VI/EZK0ndPUQALEMQmiU073v3L3dVr2xZgo/86w=", "path": "/data/src/clones/llm/llama.cpp", "type": "path" }, @@ -211,11 +211,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1747644487, - "narHash": "sha256-0Ub4ws2UGgXAQ7qJ6JEhYOjrrf2Ky/7iEWkyEDkKa/U=", + "lastModified": 1758351571, + "narHash": "sha256-oX0bC06R9gDaE3Yk3YIlXnSxj7Q0wJb31nKqnSfNpvU=", "owner": "nixos", "repo": "nixpkgs", - "rev": "949fb7f3087b8d086fd8c92acfa8412c43cfc116", + "rev": "0f3383ef02bc092d2f82afa4e556743c6e6b74d6", "type": "github" }, "original": { @@ -272,11 +272,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1747485343, - "narHash": "sha256-YbsZyuRE1tobO9sv0PUwg81QryYo3L1F3R3rF9bcG38=", + "lastModified": 1751274312, + "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=", "owner": "nixos", "repo": "nixpkgs", - "rev": "9b5ac7ad45298d58640540d0323ca217f32a6762", + "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674", "type": "github" }, "original": { diff --git a/home.nix b/home.nix index a56ea21..ee8c5ba 100644 --- a/home.nix +++ b/home.nix @@ -38,26 +38,29 @@ let extraPkgs = pkgs: [ pkgs.icu ]; }; - my-texlive = with pkgs; texlive.withPackages (texlivePackages: with texlivePackages; [ - # A minimal base scheme and a common build tool - scheme-small - latexmk - - # Packages from your research paper's preamble - amsmath - graphicx - siunitx - booktabs - algorithm2e - caption - pslatex - ec - microtype - cite - url - xcolor - hyperref - ]); + my-texlive = + with pkgs; + texlive.withPackages ( + texlivePackages: with texlivePackages; [ + # A minimal base scheme and a common build tool + scheme-small + latexmk + + # Packages from your research paper's preamble + amsmath + siunitx + booktabs + algorithm2e + caption + pslatex + ec + microtype + cite + url + xcolor + hyperref + ] + ); in { @@ -99,6 +102,7 @@ in #unzip #p7zip ripgrep + nixfmt-rfc-style # X and desktop-related scrot @@ -390,20 +394,20 @@ in mpv = { enable = true; - package = pkgs.mpv.override { - archiveSupport = false; - bluraySupport = false; - bs2bSupport = false; - cacaSupport = false; - cmsSupport = false; - dvdnavSupport = false; - javascriptSupport = false; - pipewireSupport = true; - pulseSupport = false; - rubberbandSupport = false; - waylandSupport = false; - zimgSupport = false; - }; + # package = pkgs.mpv.override { + # archiveSupport = false; + # bluraySupport = false; + # bs2bSupport = false; + # cacaSupport = false; + # cmsSupport = false; + # dvdnavSupport = false; + # javascriptSupport = false; + # pipewireSupport = true; + # pulseSupport = false; + # rubberbandSupport = false; + # waylandSupport = false; + # zimgSupport = false; + # }; bindings = { # I wish there was a more elegant way of setting Anime4K @@ -441,17 +445,18 @@ in }; hooks = { postNew = '' - notmuch tag +13f0 -- tag:unread and to:"*@13f0.net" - notmuch tag +vineetk -- tag:unread and to:"*@vineetk.net" - notmuch tag +university -- tag:unread and to:"*@floridapoly.edu" - notmuch tag +openbsd_announce -inbox -- tag:unread and to:announce@openbsd.org - notmuch tag +openbsd_arm -inbox -- tag:unread and to:arm@openbsd.org - notmuch tag +openbsd_misc -inbox -- tag:unread and to:misc@openbsd.org - notmuch tag +openbsd_ports -inbox -- tag:unread and to:ports@openbsd.org - notmuch tag +openbsd_tech -inbox -- tag:unread and to:tech@openbsd.org - notmuch tag +opensmtpd_misc -inbox -- tag:unread and to:misc@opensmtpd.org - notmuch tag +oss_security -inbox -- tag:unread and to:oss-security@lists.openwall.com - notmuch tag +tuhs -inbox -- tag:unread and to:tuhs@tuhs.org + notmuch tag +13f0 -- tag:unread and to:"*@13f0.net" + notmuch tag +vineetk -- tag:unread and to:"*@vineetk.net" + notmuch tag +university -- tag:unread and to:vsureshkumar3892@floridapoly.edu + notmuch tag +openbsd_announce -inbox -- tag:unread and to:announce@openbsd.org + notmuch tag +openbsd_arm -inbox -- tag:unread and to:arm@openbsd.org + notmuch tag +gameoftrees -inbox -- tag:unread and to:gameoftrees@openbsd.org + notmuch tag +openbsd_misc -inbox -- tag:unread and to:misc@openbsd.org + notmuch tag +openbsd_ports -inbox -- tag:unread and to:ports@openbsd.org + notmuch tag +openbsd_tech -inbox -- tag:unread and to:tech@openbsd.org + notmuch tag +opensmtpd_misc -inbox -- tag:unread and to:misc@opensmtpd.org + notmuch tag +oss_security -inbox -- tag:unread and to:oss-security@lists.openwall.com + notmuch tag +tuhs -inbox -- tag:unread and to:tuhs@tuhs.org ''; preNew = "mbsync -a"; }; @@ -573,14 +578,15 @@ in yt-dlp = { enable = true; settings = { - merge-output-format = "mkv"; - embed-subs = true; + format-sort = "res:1440,vcodec:vp9,acodec:opus"; embed-metadata = true; + embed-subs = true; embed-thumbnail = true; + merge-output-format = "mkv"; sub-langs = "en,-livechat"; - format = "bestvideo[height<=?1440]+bestaudio/best"; - downloader = "aria2c"; - downloader-args = "aria2c:'-c -x8 -s8 -k1M'"; + no-windows-filenames = true; + sponsorblock-remove = "sponsor,selfpromo,music_offtopic,-filler,-preview"; + sponsorblock-mark = "filler,preview,intro,outro"; }; }; diff --git a/hosts/demiurge/default.nix b/hosts/demiurge/default.nix index c53c3eb..f3259df 100644 --- a/hosts/demiurge/default.nix +++ b/hosts/demiurge/default.nix @@ -21,6 +21,7 @@ allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ + "open-webui" "steam" "steam-unwrapped" ]; @@ -42,16 +43,14 @@ super.usbutils ]; nativeBuildInputs = old.nativeBuildInputs ++ [ super.makeWrapper ]; - postInstall = - (old.postInstall or "") - + '' - wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${ - super.lib.makeBinPath [ - super.android-tools - super.usbutils - ] - }" - ''; + postInstall = (old.postInstall or "") + '' + wrapProgram $out/bin/alvr_dashboard --prefix PATH : "${ + super.lib.makeBinPath [ + super.android-tools + super.usbutils + ] + }" + ''; }); }) ]; @@ -60,7 +59,7 @@ # decrypt agenix secrets age.secrets = { wg0_demiurge.file = ../../secrets/wg0_demiurge.age; - wg1_demiurge.file = ../../secrets/wg0_demiurge.age; + wg1_demiurge.file = ../../secrets/wg1_demiurge.age; }; # boot options @@ -70,17 +69,23 @@ "net.ipv6.conf.all.forwarding" = true; }; - kernelPackages = pkgs.linuxPackages_6_13; + kernelPackages = pkgs.linuxPackages_6_12; loader = { systemd-boot.enable = true; efi.canTouchEfiVariables = true; }; - zfs.extraPools = [ - "data_wd" - "data" - ]; + supportedFilesystems = [ "zfs" ]; + + zfs = { + devNodes = "/dev/disk/by-partuuid"; + extraPools = [ + "data_nvme" + "data_wd" + ]; + forceImportRoot = false; + }; }; # disable wifi and open some ports @@ -88,6 +93,9 @@ hostName = "demiurge"; hostId = "cafebabe"; + # I like my ethX/wlanX names + usePredictableInterfaceNames = false; + wireless.enable = false; firewall = { @@ -99,59 +107,80 @@ allowedUDPPorts = [ 51413 ]; }; - wg-quick.interfaces = { + interfaces.eth0 = { + ipv4.addresses = [ + { + address = "192.168.1.2"; + prefixLength = 24; + } + ]; + }; + defaultGateway = { + address = "192.168.1.1"; + interface = "eth0"; + }; + + wireguard.interfaces = { # mullvad wg0 = { - address = [ + ips = [ "10.68.117.111/32" "fc00:bbbb:bbbb:bb01::5:756e/128" ]; privateKeyFile = config.age.secrets.wg0_demiurge.path; - postUp = "ip route add 45.134.142.206 dev eth0"; - postDown = "ip route del 45.134.142.206 dev eth0"; + postSetup = '' + ip route add 45.134.142.206 via 192.168.1.1 + ip route add default via 45.134.142.206 + ''; + postShutdown = '' + ip route del default via 45.134.142.206 + ip route del 45.134.142.206 via 192.168.1.1 + ''; - peers = [{ + peers = [ + { allowedIPs = [ "0.0.0.0/0" "::0/0" ]; endpoint = "45.134.142.206:51820"; publicKey = "H5t7PsMDnUAHrR8D2Jt3Mh6N6w43WmCzrOHShlEU+zw="; - }]; + } + ]; }; # epistemia wg1 = { - address = [ + ips = [ "10.0.13.2/24" "fd00:b0ba:cafe:babe::2/64" ]; privateKeyFile = config.age.secrets.wg1_demiurge.path; listenPort = 51820; - fwMark = 51821; - MTU = 1420; - - table = false; - postUp = '' -PostUp = ip rule add from 10.0.13.0/24 lookup main pref 31000 -PostUp = ip rule add from all fwmark 51821 lookup 51821 pref 32000 -PostUp = ip route add default via 192.168.1.1 dev eth0 table 51821 - -# NAT iphonebob and allow traffic between peers (when routing through demiurge) -PostUp = iptables -F FORWARD -PostUp = iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE -PostUp = iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT -PostUp = iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT -PostUp = iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT + fwMark = "51821"; + mtu = 1420; + + #table = "Off"; + postSetup = '' + ip rule add from 10.0.13.0/24 lookup main pref 31000 + ip rule add from all fwmark 51821 lookup 51821 pref 32000 + ip route replace default via 192.168.1.1 dev eth0 table 51821 + + # NAT iphonebob and allow traffic between peers (when routing through demiurge) + ${pkgs.iptables}/bin/iptables -F FORWARD + ${pkgs.iptables}/bin/iptables -t nat -I POSTROUTING 1 -s 10.0.13.4/32 -o wg0 -j MASQUERADE + ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg1 -j ACCEPT + ${pkgs.iptables}/bin/iptables -A FORWARD -i wg1 -o wg0 -j ACCEPT + ${pkgs.iptables}/bin/iptables -A FORWARD -i wg0 -o wg1 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ''; - preDown = '' -PreDown = ip rule del from all fwmark 51821 lookup 51821 pref 32000 -PreDown = ip rule del from 10.0.13.0/24 lookup main pref 31000 -PreDown = ip route flush table 51821 + preShutdown = '' + ip rule del from all fwmark 51821 lookup 51821 pref 32000 + ip rule del from 10.0.13.0/24 lookup main pref 31000 + ip route flush table 51821 -PreDown = iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE -PreDown = iptables -F FORWARD + ${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -s 10.0.13.4/32 -o wg0 -j MASQUERADE + ${pkgs.iptables}/bin/iptables -F FORWARD ''; peers = [ @@ -191,7 +220,7 @@ PreDown = iptables -F FORWARD ]; persistentKeepalive = 25; publicKey = "iMDEwvXjPAlQH8ZCmP63FM5ICYIFIX5XIyGxjnXoNVE="; - } + } ]; }; }; @@ -231,7 +260,7 @@ PreDown = iptables -F FORWARD packages = with pkgs; [ alvr bs-manager - (llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; }) + #(llama-cpp.packages.x86_64-linux.rocm.override { useVulkan = true; }) #(vllm.override { cudaSupport = false; rocmSupport = true; gpuTargets = [ "gfx906" "gfx1100" ]; }) ]; }; @@ -300,37 +329,26 @@ PreDown = iptables -F FORWARD services = { # dns unbound = { - enable = true; + enable = false; settings = { - server = { - interface = [ "127.0.0.1" "10.0.13.2" "fd00:b0ba:cafe:babe::2" "::1" ]; - access-control = [ "0.0.0.0/0 allow" "::0/0 allow" ]; - - hide-identity = yes; - hide-version = yes; - - # Synthesize NXDOMAINs from DNSSEC NSEC chains. - # https://tools.ietf.org/html/rfc8198 - aggressive-nsec = no; - - local-zone = "saklas.epistemia." redirect; - local-data = "saklas.epistemia. 86400 IN A 10.0.13.1"; - local-data = "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1"; - local-zone = "demiurge.epistemia." redirect; - local-data = "demiurge.epistemia. 86400 IN A 10.0.13.2"; - local-data = "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2"; - local-zone = "hastur.epistemia." redirect; - local-data = "hastur.epistemia. 86400 IN A 10.0.13.3"; - local-data = "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3"; - local-zone = "iphonebob.epistemia." redirect; - local-data = "iphonebob.epistemia. 86400 IN A 10.0.13.4"; - local-data = "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4"; - local-zone = "lab.epistemia." redirect; - local-data = "lab.epistemia. 86400 IN A 10.0.13.5"; - local-data = "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5"; - local-zone = "paraclete.epistemia." redirect; - local-data = "paraclete.epistemia. 86400 IN A 10.0.13.6"; - local-data = "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6"; + server = { + interface = [ + "127.0.0.1" + "10.0.13.2" + "fd00:b0ba:cafe:babe::2" + "::1" + ]; + access-control = [ + "0.0.0.0/0 allow" + "::0/0 allow" + ]; + + hide-identity = true; + hide-version = true; + + # Synthesize NXDOMAINs from DNSSEC NSEC chains. + # https://tools.ietf.org/html/rfc8198 + aggressive-nsec = false; }; # hagezi for dns-based adblocking (in addition to others) @@ -341,13 +359,40 @@ PreDown = iptables -F FORWARD }; # go through mullvad for regular dns queries - forward-zone = { - name = "."; - forward-addr = [ "100.64.0.3" ]; + forward-zone = { + name = "."; + forward-addr = [ "100.64.0.3" ]; }; + + local-data = [ + "demiurge.epistemia. 86400 IN A 10.0.13.2" + "demiurge.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::2" + "hastur.epistemia. 86400 IN A 10.0.13.3" + "hastur.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::3" + "iphonebob.epistemia. 86400 IN A 10.0.13.4" + "iphonebob.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::4" + "lab.epistemia. 86400 IN A 10.0.13.5" + "lab.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::5" + "paraclete.epistemia. 86400 IN A 10.0.13.6" + "paraclete.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::6" + "saklas.epistemia. 86400 IN A 10.0.13.1" + "saklas.epistemia. 86400 IN AAAA fd00:b0ba:cafe:babe::1" + ]; + + local-zone = [ + "\"demiurge.epistemia.\" redirect" + "\"hastur.epistemia.\" redirect" + "\"iphonebob.epistemia.\" redirect" + "\"lab.epistemia.\" redirect" + "\"paraclete.epistemia.\" redirect" + "\"saklas.epistemia.\" redirect" + ]; }; }; + # automatically scrub zfs pools (every week by default) + zfs.autoScrub.enable = true; + # media server jellyfin = { enable = true; @@ -415,7 +460,10 @@ PreDown = iptables -F FORWARD nginx = { enable = true; - defaultListenAddresses = [ "10.0.13.2" "fd00:b0ba:cafe:babe::2" ]; + defaultListenAddresses = [ + "10.0.13.2" + "fd00:b0ba:cafe:babe::2" + ]; recommendedGzipSettings = true; recommendedOptimisation = true; @@ -525,7 +573,7 @@ PreDown = iptables -F FORWARD } ]; }; - }; + } ]; }; @@ -555,66 +603,65 @@ PreDown = iptables -F FORWARD }; }; - # TODO run nixfmt to fix indenting of below (can't right now because on gentoo without nixfmt) wireplumber = { enable = true; extraConfig."50-smartfilters-airpods.conf".text = '' - { - "monitor.bluez.rules" : [ - # When a BlueZ device is detected we set an identifying property that the smart filter will match. - # (This fragment adds nothing by default; we're using a policy to match target.node later.) - ], - - "policy.rules" : [ - # The core smart filter matching is done by matching the target.node properties - # WirePlumber's smart filters will look for filter.smart.target (set below). - ], - - "policy" : { - "smart_filters" : { - "rules" : [ + { + "monitor.bluez.rules" : [ + # When a BlueZ device is detected we set an identifying property that the smart filter will match. + # (This fragment adds nothing by default; we're using a policy to match target.node later.) + ], + + "policy.rules" : [ + # The core smart filter matching is done by matching the target.node properties + # WirePlumber's smart filters will look for filter.smart.target (set below). + ], + + "policy" : { + "smart_filters" : { + "rules" : [ + { + "matches" : [ + { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } } + ], + "actions" : { + # If target device matches, set the 'target.node' metadata for smart filters to use + "update-metadata" : { + "target.node" : { "name" : "bluez_output.*AirPods.*" } + } + } + } + ] + } + }, + + "endpoint.rules" : [ { "matches" : [ - { "device.props" : { "bluez5.device.name" : "AirPods Pro 2" } } + { "node.name" : "peq-airpods-pro-2-sink" } ], "actions" : { - # If target device matches, set the 'target.node' metadata for smart filters to use - "update-metadata" : { - "target.node" : { "name" : "bluez_output.*AirPods.*" } + "update-props" : { + # Mark this WF sink as intended for a specific target device. + # WirePlumber will use filter.smart.target to identify which device to chain to. + "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" } + } + } + }, + { + "matches" : [ + { "node.name" : "peq-he5xx-sink" } + ], + "actions" : { + "update-props" : { + # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules. + "filter.smart.target" : {} } } } ] } - }, - - "endpoint.rules" : [ - { - "matches" : [ - { "node.name" : "peq-airpods-pro-2-sink" } - ], - "actions" : { - "update-props" : { - # Mark this WF sink as intended for a specific target device. - # WirePlumber will use filter.smart.target to identify which device to chain to. - "filter.smart.target" : { "bluez5.device.name" : "AirPods Pro 2" } - } - } - }, - { - "matches" : [ - { "node.name" : "peq-he5xx-sink" } - ], - "actions" : { - "update-props" : { - # He5xx is a generic filter (no specific bluez target) — it could be matched by other rules. - "filter.smart.target" : {} - } - } - } - ] - } - ''; + ''; }; }; @@ -1106,10 +1153,22 @@ PreDown = iptables -F FORWARD }; # extra systemd stuff - systemd.services.nginx = { - after = [ "wg-quick@wg1.service" ]; - requires = [ "wg-quick@wg1.service" ]; - serviceConfig.Type = lib.mkForce "idle"; + systemd.services = { + nginx = { + after = [ "wireguard-wg1.service" ]; + requires = [ "wireguard-wg1.service" ]; + serviceConfig.Type = lib.mkForce "idle"; + }; + + wireguard-wg0 = { + after = [ "network-addresses-eth0.service" ]; + requires = [ "network-addresses-eth0.service" ]; + }; + + wireguard-wg1 = { + after = [ "wireguard-wg0.service" ]; + requires = [ "wireguard-wg0.service" ]; + }; }; # create caches and use mandoc diff --git a/hosts/demiurge/hardware.nix b/hosts/demiurge/hardware.nix index 21d7ab3..5fa707c 100644 --- a/hosts/demiurge/hardware.nix +++ b/hosts/demiurge/hardware.nix @@ -51,14 +51,8 @@ options = [ "zfsutil" ]; }; - fileSystems."/data" = { - device = "nvme_warm"; - fsType = "zfs"; - options = [ "zfsutil" ]; - }; - fileSystems."/boot" = { - device = "/dev/disk/by-uuid/1C01-EE5C"; + device = "/dev/disk/by-uuid/B259-F128"; fsType = "vfat"; options = [ "fmask=0022" diff --git a/secrets/email_13f0.age b/secrets/email_13f0.age index 7fb7410..5430245 100644 Binary files a/secrets/email_13f0.age and b/secrets/email_13f0.age differ diff --git a/secrets/email_vinbiz.age b/secrets/email_vinbiz.age index 041f2e9..1759259 100644 --- a/secrets/email_vinbiz.age +++ b/secrets/email_vinbiz.age @@ -1,7 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 AaF/mQ XcNpUXvbz6PsCgeEZMf1+yMrjIipzsesAKO+EssReTw -EcDIICNjeS3KKev0qK/0v7V/86QdOWYNaTyFDFE435I --> ssh-ed25519 hc2ELA rO5kM81Uk4G5bowyCzGUZdBvqxvcNctjdrD1+Tfk8VY -1ef+BiIAJFFKpNAPb2QHHzrxTAyNyj7Hc/nArculdsc ---- TrgPJhsRCmQuOl9m51XUHnhV+pBlbj0iYgzXUojgjTw -cm/(,{W}yxAՙT^\#W-ČO4dϑd[Ce0 .v\q& \ No newline at end of file +-> ssh-ed25519 AaF/mQ wh3j/RdgUlB4N9ELW4nj7HNFIpBJjlHdjAq0IblREyo +9KBAruMKWSX36w64FQdJ/MO6xQN7rdW8VqsDD8nZYZI +-> ssh-ed25519 hc2ELA n8fCpvkGsZQpOJ6q8v82/NT8RPD35FVc6Vxn/yrdhlc +AFFEH8EHZmauCrJGINblMqVJFHxE6e+XQjWUjowngok +--- kESRP7l0kqMovGR7QMFSKUtaUN/NPA82WYd9dBtKP2U +2kZHXSQ]<&|`V=(`vSC ;00Rd!揦?Eu}yiXov˦b&!‚ \ No newline at end of file diff --git a/secrets/email_vineetk.age b/secrets/email_vineetk.age index c42b4a6..f2fdc81 100644 Binary files a/secrets/email_vineetk.age and b/secrets/email_vineetk.age differ diff --git a/secrets/hetzner_dns.age b/secrets/hetzner_dns.age index 10b86d9..6413b31 100644 --- a/secrets/hetzner_dns.age +++ b/secrets/hetzner_dns.age @@ -1,10 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 AaF/mQ hK2xroga7vLhQxaIBFaP+nrJF8KIxrFaST2RdVedBEI -vzgZ49FsgITyEUwwpMJllIohNE2BHpf634e6NUnuLyM --> ssh-ed25519 F30WWA vtiebrA6nc2DhyBGpFKUKv/PZhC89mfw4VJi5JEHekg -LeeJAKYlywoNoTsbdCWoe+xGN4DDtBq/Zx2jjF5AXos --> ssh-ed25519 hc2ELA AYBEPYt0guu6DkCTq/DFPAuhDbyb0xlD/Q3YRD9r0TE -t7r0IU70rRLIYuUiSbypwIBiwrkeeDbSr9A8rC57AUo ---- YFPGnH20/JpT0vHriDFL3ZGHDElBuU6JU4ygDK87JQs -tjR堸}X%x " -Ick ܇kR܏"ps$i;BVl8< \ No newline at end of file +-> ssh-ed25519 AaF/mQ YL7+ucBetoT2UoL9qjF9DJteCiMtFdasQsCewT1BD10 +7Ul9wBD8q0+C2+EDXtIf1EJZiQILTAyKBDBBZLymwGc +-> ssh-ed25519 hc2ELA SRY6T7u+UPyVrXIMYe33XJCx9kufjKBQiEaa+b+G21k +iurQl6gJUqlA2l7NYfWgmjSMiSYNwSmp2eYxfLwAg1o +--- lBjJlPWS++Wn8DuZVtPscOhY+oydziGsy3EmCSDk6b4 +X|J=cF >c-`,#M/ue]Agx|\*^m:Qc[1 \ No newline at end of file diff --git a/secrets/radicale_users.age b/secrets/radicale_users.age index 21091c1..0278c6a 100644 Binary files a/secrets/radicale_users.age and b/secrets/radicale_users.age differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index c1c6978..0d46c6d 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -2,7 +2,7 @@ let vin = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEvM0xCLziR+ZT/SYE1aZM6dklbw4fEC17TWqbADIZRH kou@demiurge"; users = [ vin ]; - demiurge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICXDBcX7hXJCaKDRNaIAfycU83Y2J+uEB4wcALBOQpse"; + demiurge = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJBcyABhvBR+UR6PhEmd7ygJqUPeytK6IyljypxkQbZW"; hastur = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN2ZUuPSPpIRULzMscBo5DJmA0UbFtG0jaANuzHo5aSQ"; saklas = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM7RCmfdgJKPnaBi336ZcvDWboxPj8lTtW1eDTN5qR2R"; systems = [ diff --git a/secrets/wg0_demiurge.age b/secrets/wg0_demiurge.age index 11f2561..85d6e3d 100644 --- a/secrets/wg0_demiurge.age +++ b/secrets/wg0_demiurge.age @@ -1,7 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 AaF/mQ yqsS5z6keZjZRc2WECiDtrIQ81uy9dPNuC+4JL4QGgQ -PZfc4aEh3zIexIpLjcJjtPmXN7nFNFPzUcsjwNj1GtI --> ssh-ed25519 F30WWA lK3glF0i1Z8i16YF+Pc7AlJjEk3zETFt6HYBrzHntFk -hsh9wGSi08ZFGUzF8nl3aT3EqMmciGTDjvfxW9FXNKA ---- 5SHG64tPuD9a4EfWVs8RteQTpBcNR9ZiLKvuUukraZI -k] !ax^OLOb^93@h)Vx˲-"!AR \ No newline at end of file +-> ssh-ed25519 AaF/mQ 8mtbBEikYRatTBx3ulZV4KeSsiH7OIw/GrDtbF9pWyU +liYjeeUNddFsDfT68D/EacHK1zSVGIHDZXP5X1sMDFc +-> ssh-ed25519 8fETJg +XTbKFpXPrlNSLKf7eZWQMNhx+hlTpwFvSiBYoKYVXk +78D/CEvi739R7pfbcXXBl8CS8vFFD7rSZ99nqdxk3c0 +--- QJPOO68vtmqgaHk4yZ0mOx8psnKf9V7154pJo7kCgD4 +Y<: _!=jeOmꛢMGy ӿ(҈us#18g22OQ9!4jODЬ \ No newline at end of file diff --git a/secrets/wg0_hastur.age b/secrets/wg0_hastur.age index 83079cf..b58442e 100644 --- a/secrets/wg0_hastur.age +++ b/secrets/wg0_hastur.age @@ -1,8 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 AaF/mQ 56BWU8ca94VnN9a2XS9MyMECcA2NnUvclaIgzsAasGw -4ym2vDPFta3Jjp1ZEmGg+4QjtfqCv98crJmFFJxK4Wk --> ssh-ed25519 CQpZUw 8T0BdKSFpFj9j8wfe2h9s1uvweGDlJYmLaBaF1h+31A -JV2ckgV8Hg6EYx44Uh0XF3FvZf6T5bnRULT+5pCueLw ---- jB4Nfx/RnFtL0sOSc0mfZ3a98IsDl03dAj0SqqqZoz0 -oR-ɨKlЍlg a!RĝX)_Tě -nclyV2!Yqkpjois| \ No newline at end of file +-> ssh-ed25519 AaF/mQ wP+33FStqbBWU/Y6/+IH/xp63Db32bBjdg1eHmlqxhw +tvItMKy4hkhyyQP7ZSUafbYShslrAufUDvgpowZDhvQ +-> ssh-ed25519 CQpZUw cNpihxkJx0SNeOJoyiLXxljIJHPDtxp+PQU7WRh8KS8 +y77XLusUoW8i1qPb4v9EFv/YLCif+mwIiRVwjANlLL0 +--- mFeHPan7I2otyM9Eg0Ww5WQoU8m0maNjWe0zXhK9ks8 +-y޸4&]d,q(Zxj=!92ibyG #͜gk5F \ No newline at end of file diff --git a/secrets/wg1_demiurge.age b/secrets/wg1_demiurge.age index b9bbbff..42e254c 100644 --- a/secrets/wg1_demiurge.age +++ b/secrets/wg1_demiurge.age @@ -1,7 +1,8 @@ age-encryption.org/v1 --> ssh-ed25519 AaF/mQ MX+cICKRHIB8NaZ6+Kdz6wmhGQHgzNthVe4BiFp3V2c -pZa2tCwE4YRTS/4kTdlu5DrHNFePU8BiDNXZI0Uaeg0 --> ssh-ed25519 F30WWA UfyQtZSmrl9pw9FVNCxGOo0ICIglS9Q4sDRTg/1PXTw -Sd6q4jECTtdRfGbgeAf/AniX5gw64ZZ/PrESAlst5tg ---- YkDaRa81QgMNVefXmDCPv2OdDI1BtMO4AhixPoKx2Os -8ח/-p>т^?A$<>|!0M u-Azm/g!;tᙌǙ!ݎ \ No newline at end of file +-> ssh-ed25519 AaF/mQ s5k0xBJHij3zt4XcBnYCRLTr3fMS917cDJFJE7kqu1g +pcW+ATcSqS1xfBoIax6T5Z8cyKThDvXltYVpX71uqcs +-> ssh-ed25519 8fETJg KHNOh1VCLvANjtqspWLDcbkyoGP/r0EyYLPzUdNzWXk +XvA4LzN96uMoCD0ZLffCFBNVKgYaZ420X8uLGW9yWnc +--- 4uATkKlQIj3nvgtQ0spcODHVsyzFbY1hRryq3gkKnso +Y*["X~Oaji*i) Pw(qH +r9C ^1j_xMHiEh}nF \ No newline at end of file diff --git a/secrets/wg1_hastur.age b/secrets/wg1_hastur.age index 62841ca..197c2fb 100644 Binary files a/secrets/wg1_hastur.age and b/secrets/wg1_hastur.age differ diff --git a/secrets/wpa_supplicant.age b/secrets/wpa_supplicant.age index f7a08ec..310e36f 100644 Binary files a/secrets/wpa_supplicant.age and b/secrets/wpa_supplicant.age differ -- cgit v1.2.3