commit 1d75b88f4ecb5f5ba1ae680f19cb6fddc10e0a18
parent ffd3fd681a8e32d204f67be11db2486efcbbbbd5
Author: mtmn <miro@haravara.org>
Date: Tue, 14 Apr 2026 10:19:10 +0200
Merge branch 'master' of ssh://codeberg.org/mtmn/nix
Diffstat:
18 files changed, 123 insertions(+), 103 deletions(-)
diff --git a/flake.lock b/flake.lock
@@ -30,11 +30,11 @@
"nixpkgs": "nixpkgs"
},
"locked": {
- "lastModified": 1776073939,
- "narHash": "sha256-7EN8Gi+QOSotHfuJBsu6fv9UHmCMRJUaHTHjAHsKkto=",
+ "lastModified": 1776099912,
+ "narHash": "sha256-KCbdRYnR1Osvx5ZG1EOhX693OCwXBj/7DkWaDmWBBPs=",
"ref": "refs/heads/master",
- "rev": "1e6c54e9c2e7f92435dc852a8eb4a5d1d1c13555",
- "revCount": 52,
+ "rev": "e1c9d15025b992888b433826346c2c3a37410c32",
+ "revCount": 59,
"type": "git",
"url": "ssh://git@codeberg.org/mtmn/corpus.git"
},
@@ -100,6 +100,7 @@
"original": {
"owner": "serokell",
"repo": "deploy-rs",
+ "rev": "77c906c0ba56aabdbc72041bf9111b565cdd6171",
"type": "github"
}
},
@@ -389,11 +390,11 @@
"tools": {
"flake": false,
"locked": {
- "lastModified": 1775935958,
- "narHash": "sha256-OSC7fpM0ux0ZAGI0vwtv/4qpi0fieUgTpt3KIXDvkFI=",
+ "lastModified": 1776076416,
+ "narHash": "sha256-R+6oAOXA41vM7mgO7b7OYUGmiox+4sCbM6awd+JK88Y=",
"ref": "refs/heads/main",
- "rev": "b1122f41f73f313149b37471686d8d841abe96d6",
- "revCount": 27,
+ "rev": "8bf35f488b18b0e0b24b13c51920932021bf8029",
+ "revCount": 28,
"type": "git",
"url": "ssh://git@codeberg.org/mtmn/tools.git"
},
diff --git a/flake.nix b/flake.nix
@@ -15,7 +15,7 @@
};
deploy-rs = {
- url = "github:serokell/deploy-rs";
+ url = "github:serokell/deploy-rs/77c906c0ba56aabdbc72041bf9111b565cdd6171";
inputs.nixpkgs.follows = "nixpkgs";
};
@@ -67,11 +67,9 @@
nix.settings = {
substituters = [
"https://cache.nixos.org"
- "https://attic.saatana.cat/central"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
- "central:ljdT0TbVb3yqnBZt1dsWvxvkebyaZqyFEJBFaowLy6c="
];
};
}
@@ -105,11 +103,9 @@
nix.settings = {
substituters = [
"https://cache.nixos.org"
- "https://attic.saatana.cat/central"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
- "central:ljdT0TbVb3yqnBZt1dsWvxvkebyaZqyFEJBFaowLy6c="
];
};
}
@@ -165,18 +161,16 @@
"couchdb"
"oauth2-proxy"
"storage-box"
- "bazel-cache"
"shirt-linkener"
"bandeno"
"headscale"
"searxng"
- "attic"
"static"
"miniflux"
"corpus"
+ "corpus-pstmn"
"napkins"
"listenbrainz-mpd"
- "redlib"
]
importService
// {
diff --git a/home.nix b/home.nix
@@ -43,11 +43,9 @@
experimental-features = ["nix-command" "flakes"];
substituters = [
"https://cache.nixos.org"
- "https://attic.saatana.cat/central"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
- "central:ljdT0TbVb3yqnBZt1dsWvxvkebyaZqyFEJBFaowLy6c="
];
};
gc = {
diff --git a/hosts/nixaran/configuration.nix b/hosts/nixaran/configuration.nix
Binary files differ.
diff --git a/justfile b/justfile
@@ -12,7 +12,7 @@ deadnix:
deploy host="nixaran":
@backup nix
- nix run --fallback github:serokell/deploy-rs .#{{ host }} 2>&1 | grep -vE "unknown flake output '(deploy|configData)'"
+ nix run --inputs-from . github:serokell/deploy-rs .#{{ host }} 2>&1 | grep -vE "unknown flake output '(deploy|configData)'"
update:
nix flake update
@@ -21,7 +21,7 @@ install host:
./hack/install_anywhere {{ host }}
diff host="nixaran":
- nix run github:serokell/deploy-rs -- --dry-activate .#{{ host }} 2>&1 | grep -vE "unknown flake output '(deploy|configData)'"
+ nix run --inputs-from . github:serokell/deploy-rs -- --dry-activate .#{{ host }} 2>&1 | grep -vE "unknown flake output '(deploy|configData)'"
local:
nh home switch "$(git rev-parse --show-toplevel)"
diff --git a/modules/mixins/dotfiles/config/newsraft/feeds b/modules/mixins/dotfiles/config/newsraft/feeds
@@ -433,3 +433,4 @@ https://www.youtube.com/feeds/videos.xml?channel_id=UCS0N5baNlQWJCUrhCEo8WlA Ben
https://www.youtube.com/feeds/videos.xml?channel_id=UC3S8vxwRfqLBdIhgRlDRVzw stacksmashing
https://www.youtube.com/feeds/videos.xml?channel_id=UCd3dNckv1Za2coSaHGHl5aA TJ DeVries
https://www.youtube.com/feeds/videos.xml?channel_id=UCaTznQhurW5AaiYPbhEA-KA Molly Rocket
+https://www.youtube.com/feeds/videos.xml?channel_id=UC3azLjQuz9s5qk76KEXaTvA suckerpinch
diff --git a/modules/mixins/dotfiles/config/sccache/config b/modules/mixins/dotfiles/config/sccache/config
@@ -0,0 +1,6 @@
+[cache.s3]
+bucket = "sccache"
+endpoint = "https://estri.saatana.cat"
+region = "us-east-1"
+use_ssl = true
+no_credentials = false
diff --git a/modules/mixins/dotfiles/home/cargo/config.toml b/modules/mixins/dotfiles/home/cargo/config.toml
@@ -1,4 +1,6 @@
[build]
+rustc-wrapper = "sccache"
+incremental = false
rustflags = ["-C", "target-cpu=native", "-C", "link-arg=-fuse-ld=mold"]
[profile.release]
diff --git a/modules/nixos/base.nix b/modules/nixos/base.nix
@@ -13,12 +13,10 @@
substituters = [
"https://cache.nixos.org"
"https://nix-community.cachix.org"
- "https://attic.saatana.cat/central"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
- "central:ljdT0TbVb3yqnBZt1dsWvxvkebyaZqyFEJBFaowLy6c="
];
};
gc = {
@@ -26,7 +24,6 @@
dates = "weekly";
options = "--delete-older-than 30d";
};
- # Pin nixpkgs to the flake version for consistency
registry.nixpkgs.flake = inputs.nixpkgs;
};
diff --git a/modules/services/attic.nix b/modules/services/attic.nix
@@ -30,6 +30,10 @@ in {
type = lib.types.path;
description = "Path to environment file with ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64 and AWS credentials";
};
+ signingKeyFile = lib.mkOption {
+ type = lib.types.path;
+ description = "Path to the Nix signing private key file (generated with nix-store --generate-binary-cache-key)";
+ };
port = lib.mkOption {
type = lib.types.port;
default = 7381;
@@ -56,6 +60,9 @@ in {
endpoint = cfg.s3Endpoint;
region = cfg.s3Region;
};
+ signing = {
+ signing-key-paths = [cfg.signingKeyFile];
+ };
};
environmentFile = cfg.credentialsFile;
};
diff --git a/modules/services/corpus-pstmn.nix b/modules/services/corpus-pstmn.nix
@@ -0,0 +1,5 @@
+import ./mk-corpus.nix {
+ optionName = "corpusPstmn";
+ defaultPort = 8322;
+ defaultSecretFile = ../../secrets/corpus-pstmn.age;
+}
diff --git a/modules/services/corpus.nix b/modules/services/corpus.nix
@@ -1,65 +1,5 @@
-{
- config,
- lib,
- pkgs,
- inputs,
- ...
-}: let
- cfg = config.services.haravara.corpus;
-in {
- options.services.haravara.corpus = {
- enable = lib.mkEnableOption "Scorpus - ListenBrainz frontend";
-
- port = lib.mkOption {
- type = lib.types.port;
- default = 8321;
- };
-
- domain = lib.mkOption {
- type = lib.types.str;
- };
-
- dataDir = lib.mkOption {
- type = lib.types.str;
- default = "/var/lib/corpus";
- };
- };
-
- config = lib.mkIf cfg.enable {
- age.secrets.corpus = {
- file = ../../secrets/corpus.age;
- owner = "corpus";
- };
-
- systemd.services.corpus = {
- description = "Scorpus - ListenBrainz frontend";
- wantedBy = ["multi-user.target"];
- after = ["network.target"];
-
- environment = {
- PORT = toString cfg.port;
- DATABASE_FILE = "${cfg.dataDir}/corpus.db";
- };
-
- serviceConfig = {
- ExecStart = "${inputs.corpus.packages.${pkgs.stdenv.hostPlatform.system}.default}/bin/scorpus-server";
- EnvironmentFile = config.age.secrets.corpus.path;
- Restart = "always";
- User = "corpus";
- Group = "corpus";
- StateDirectory = "corpus";
- WorkingDirectory = cfg.dataDir;
- };
- };
-
- users.users.corpus = {
- isSystemUser = true;
- group = "corpus";
- };
- users.groups.corpus = {};
-
- services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
- reverse_proxy 127.0.0.1:${toString cfg.port}
- '';
- };
+import ./mk-corpus.nix {
+ optionName = "corpus";
+ defaultPort = 8321;
+ defaultSecretFile = ../../secrets/corpus.age;
}
diff --git a/modules/services/mk-corpus.nix b/modules/services/mk-corpus.nix
@@ -0,0 +1,79 @@
+{
+ optionName,
+ defaultPort,
+ defaultSecretFile,
+}: {
+ config,
+ lib,
+ pkgs,
+ inputs,
+ ...
+}: let
+ cfg = config.services.haravara.${optionName};
+in {
+ options.services.haravara.${optionName} = {
+ enable = lib.mkEnableOption "Corpus - ListenBrainz frontend";
+
+ port = lib.mkOption {
+ type = lib.types.port;
+ default = defaultPort;
+ };
+
+ domain = lib.mkOption {
+ type = lib.types.str;
+ };
+
+ dataDir = lib.mkOption {
+ type = lib.types.str;
+ default = "/var/lib/corpus";
+ };
+
+ databaseFile = lib.mkOption {
+ type = lib.types.str;
+ default = "${cfg.dataDir}/corpus.db";
+ };
+
+ secretFile = lib.mkOption {
+ type = lib.types.path;
+ default = defaultSecretFile;
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ age.secrets.${optionName} = {
+ file = cfg.secretFile;
+ owner = "corpus";
+ };
+
+ systemd.services.${optionName} = {
+ description = "Corpus - ListenBrainz frontend";
+ wantedBy = ["multi-user.target"];
+ after = ["network.target"];
+
+ environment = {
+ PORT = toString cfg.port;
+ DATABASE_FILE = cfg.databaseFile;
+ };
+
+ serviceConfig = {
+ ExecStart = "${inputs.corpus.packages.${pkgs.stdenv.hostPlatform.system}.default}/bin/corpus-server";
+ EnvironmentFile = config.age.secrets.${optionName}.path;
+ Restart = "always";
+ User = "corpus";
+ Group = "corpus";
+ StateDirectory = "corpus";
+ WorkingDirectory = cfg.dataDir;
+ };
+ };
+
+ users.users.corpus = {
+ isSystemUser = true;
+ group = "corpus";
+ };
+ users.groups.corpus = {};
+
+ services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
+ reverse_proxy 127.0.0.1:${toString cfg.port}
+ '';
+ };
+}
diff --git a/modules/services/storage-box.nix b/modules/services/storage-box.nix
@@ -69,9 +69,6 @@ in {
++ lib.optionals config.services.haravara.monitoring.enable [
"d ${cfg.mountPoint}/nixaran/victoriametrics - - - -"
]
- ++ lib.optionals config.services.haravara.bazel-cache.enable [
- "d ${cfg.mountPoint}/nixaran/bazel-cache 0750 bazel-remote bazel-remote -"
- ]
++ lib.optionals config.services.haravara.seaweedfs.enable [
"d ${cfg.mountPoint}/seanix 0755 seaweedfs storage-users -"
"d ${cfg.mountPoint}/seanix/master 0755 seaweedfs storage-users -"
@@ -118,14 +115,6 @@ in {
options = ["bind" "nofail"];
depends = [cfg.mountPoint];
};
- }
- // lib.optionalAttrs config.services.haravara.bazel-cache.enable {
- "/var/lib/bazel-cache" = {
- device = "${cfg.mountPoint}/nixaran/bazel-cache";
- fsType = "none";
- options = ["bind" "nofail" "_netdev"];
- depends = ["${cfg.mountPoint}"];
- };
};
systemd.services = let
@@ -151,10 +140,6 @@ in {
victoriametrics.after = ["var-lib-victoriametrics.mount"];
victoriametrics.requires = ["var-lib-victoriametrics.mount"];
})
- (lib.mkIf config.services.haravara.bazel-cache.enable {
- bazel-remote.after = ["var-lib-bazel\\x2dcache.mount"];
- bazel-remote.requires = ["var-lib-bazel\\x2dcache.mount"];
- })
];
};
}
diff --git a/secrets.nix b/secrets.nix
@@ -12,10 +12,15 @@ in {
"secrets/couchdb-admin-pass.age".publicKeys = allKeys;
"secrets/searx-secret-key.age".publicKeys = allKeys;
"secrets/headscale-api-key.age".publicKeys = allKeys;
- "secrets/attic-credentials.age".publicKeys = allKeys;
"secrets/miniflux-secrets.age".publicKeys = allKeys;
"secrets/listenbrainz-token.age".publicKeys = allKeys;
"secrets/mpd-host.age".publicKeys = allKeys;
"secrets/scorpus.age".publicKeys = allKeys;
+<<<<<<< HEAD
"secrets/corpus.age".publicKeys = allKeys;
+||||||| dfd7511
+=======
+ "secrets/corpus.age".publicKeys = allKeys;
+ "secrets/corpus-pstmn.age".publicKeys = allKeys;
+>>>>>>> 944c589117f33b05e5b2c43c0bbad43f6977f0fc
}
diff --git a/secrets/attic-credentials.age b/secrets/attic-credentials.age
Binary files differ.
diff --git a/secrets/corpus-pstmn.age b/secrets/corpus-pstmn.age
Binary files differ.
diff --git a/secrets/netrc.age b/secrets/netrc.age
Binary files differ.
