commit 6a433c9c28f479e727d8e36a6fd84f4d212b7e74
parent a71faf3d9ee1cca8eca1b36658aa7c8c3ad52350
Author: mtmn <miro@haravara.org>
Date: Mon, 6 Apr 2026 20:14:43 +0200
feat: install harmonia, add store/builder, misc
Diffstat:
16 files changed, 287 insertions(+), 20 deletions(-)
diff --git a/.gitattributes b/.gitattributes
@@ -3,7 +3,7 @@ modules/services/filestash.nix filter=git-crypt diff=git-crypt
modules/mixins/secrets.nix filter=git-crypt diff=git-crypt
# hosts
-hosts/void/overlays/* filter=git-crypt diff=git-crypt
+hosts/void/overlays/config/shell/rc/* filter=git-crypt diff=git-crypt
hosts/nixaran/* filter=git-crypt diff=git-crypt
hosts/work/* filter=git-crypt diff=git-crypt
diff --git a/flake.lock b/flake.lock
@@ -224,18 +224,17 @@
"tools": {
"flake": false,
"locked": {
- "lastModified": 1775211609,
- "narHash": "sha256-30bmeRPr1dFwjcgtLZaHl36dtjRn3lIer1piSC1ySPk=",
- "ref": "refs/heads/master",
- "rev": "eb162916e0520824983022d79d4ca5483f499a8a",
- "revCount": 839,
+ "lastModified": 1775502308,
+ "narHash": "sha256-p4Mep5ay8YEao1gpADPb9jhTscbdQSOfnn5lI0eKphU=",
+ "ref": "refs/heads/main",
+ "rev": "d6246299905365cef213d21916013b56a24df9a0",
+ "revCount": 26,
"type": "git",
- "url": "ssh://forgejo@haravara.org/miro/tools.git"
+ "url": "ssh://git@codeberg.org/mtmn/tools.git"
},
"original": {
- "ref": "refs/heads/master",
"type": "git",
- "url": "ssh://forgejo@haravara.org/miro/tools.git"
+ "url": "ssh://git@codeberg.org/mtmn/tools.git"
}
},
"utils": {
diff --git a/flake.nix b/flake.nix
@@ -28,7 +28,7 @@
};
tools = {
- url = "git+ssh://forgejo@haravara.org/miro/tools.git?ref=refs/heads/master";
+ url = "git+ssh://git@codeberg.org/mtmn/tools.git";
flake = false;
};
};
@@ -57,6 +57,19 @@
specialArgs = specialArgs // {inherit username;};
modules =
[
+ {
+ nix.settings = {
+ substituters = [
+ "https://cache.nixos.org"
+ "ssh-ng://root@nixaran:468?compress=true&max-connections=4"
+ ];
+ trusted-public-keys = [
+ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+ "nixaran:d63/FF1RnBYzFggx+wvp4SVtGmemzR1tlaRrh0Msf4M="
+ ];
+ netrc-file = ./secrets/netrc;
+ };
+ }
inputs.agenix.nixosModules.default
(hostDir + "/configuration.nix")
]
@@ -81,7 +94,24 @@
home-manager.lib.homeManagerConfiguration {
pkgs = nixpkgs.legacyPackages.${host.system};
extraSpecialArgs = specialArgs // {inherit username homeDirectory;};
- modules = [./home.nix] ++ (config.pkgSets or []);
+ modules =
+ [
+ {
+ nix.settings = {
+ substituters = [
+ "https://cache.nixos.org"
+ "ssh-ng://root@nixaran:468?compress=true&max-connections=4"
+ ];
+ trusted-public-keys = [
+ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+ "nixaran:d63/FF1RnBYzFggx+wvp4SVtGmemzR1tlaRrh0Msf4M="
+ ];
+ netrc-file = ./secrets/netrc;
+ };
+ }
+ ./home.nix
+ ]
+ ++ (config.pkgSets or []);
}
))
user.configs)
@@ -136,6 +166,8 @@
bandeno = import ./modules/services/bandeno.nix;
headscale = import ./modules/services/headscale.nix;
searxng = import ./modules/services/searxng.nix;
+ harmonia = import ./modules/services/harmonia.nix;
+ static = import ./modules/services/static.nix;
};
deploy = {
diff --git a/home.nix b/home.nix
@@ -32,6 +32,18 @@
nix = {
package = pkgs.nix;
distributedBuilds = true;
+ buildMachines = [
+ {
+ hostName = "nixaran";
+ sshUser = "root";
+ protocol = "ssh-ng";
+ sshKey = "/home/miro/.ssh/id_ed25519";
+ systems = ["x86_64-linux" "i686-linux"];
+ maxJobs = 1;
+ speedFactor = 1;
+ supportedFeatures = ["big-parallel"];
+ }
+ ];
settings = {
auto-optimise-store = true;
warn-dirty = false;
diff --git a/hosts/nixaran/configuration.nix b/hosts/nixaran/configuration.nix
Binary files differ.
diff --git a/hosts/void/default.nix b/hosts/void/default.nix
@@ -27,6 +27,7 @@
ninja
cmake
moor
+ watchman
];
mpd = with pkgs; [
@@ -116,6 +117,7 @@
wget
whois
xh
+ bandwhich
];
bpf = with pkgs; [
diff --git a/hosts/void/overlays/config/shell/rc/void b/hosts/void/overlays/config/shell/rc/void
Binary files differ.
diff --git a/hosts/void/overlays/config/shell/void b/hosts/void/overlays/config/shell/void
Binary files differ.
diff --git a/hosts/void/overlays/default.nix b/hosts/void/overlays/default.nix
Binary files differ.
diff --git a/modules/mixins/dotfiles/config/shell/rc/aliased-short-names b/modules/mixins/dotfiles/config/shell/rc/aliased-short-names
@@ -115,7 +115,7 @@ alias matchamix='matchakey --mixxx ~/.mixxx/mixxxdb.sqlite'
alias datamix='datasette serve $HOME/.mixxx/mixxxdb.sqlite --setting sql_time_limit_ms 50000'
alias nd='nix develop'
-alias hms='nh home switch ~/src/nix'
+alias hms='backup nix && nh home switch ~/src/nix'
alias amsp='mpva https://radio.stereoscenic.com/asp-s --no-resume-playback'
alias nts1='mpva https://stream-relay-geo.ntslive.net/stream --no-resume-playback'
@@ -128,7 +128,7 @@ alias sr='speedread -w 400'
alias chop='perl -pe chop'
alias chomp='perl -pe chomp'
-alias cfp='source ./hack/creds-from-pass'
+alias scr='source ./hack/creds-from-pass'
alias cej='just check'
alias dpj='just deploy'
diff --git a/modules/services/bazel-cache.nix b/modules/services/bazel-cache.nix
@@ -63,11 +63,6 @@ in {
services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
reverse_proxy ${cfg.listenAddress}:${toString cfg.port}
- handle {
- basic_auth {
- ${cfg.basicAuthUser} ${cfg.basicAuthHash}
- }
- }
'';
};
}
diff --git a/modules/services/dex.nix b/modules/services/dex.nix
@@ -57,8 +57,8 @@ in {
enablePasswordDB = true;
expiry = {
- signingKeys = "24h";
- idTokens = "24h";
+ signingKeys = "72h";
+ idTokens = "72h";
};
staticPasswords = [
diff --git a/modules/services/harmonia.nix b/modules/services/harmonia.nix
@@ -0,0 +1,107 @@
+{
+ config,
+ lib,
+ ...
+}: let
+ cfg = config.services.haravara.harmonia;
+in {
+ options.services.haravara.harmonia = {
+ enable = lib.mkEnableOption "Harmonia Nix binary cache";
+ domain = lib.mkOption {
+ type = lib.types.str;
+ description = "Domain name for the Harmonia cache";
+ };
+ authLabel = lib.mkOption {
+ type = lib.types.nullOr lib.types.str;
+ default = null;
+ description = "The auth snippet to import";
+ };
+ signKeyPaths = lib.mkOption {
+ type = lib.types.listOf lib.types.path;
+ default = [];
+ description = "Paths to signing key files for the binary cache";
+ };
+ enableCompression = lib.mkOption {
+ type = lib.types.bool;
+ default = false;
+ description = "Enable transparent compression with zstd";
+ };
+ priority = lib.mkOption {
+ type = lib.types.int;
+ default = 30;
+ description = "Binary cache priority advertised in /nix-cache-info";
+ };
+ port = lib.mkOption {
+ type = lib.types.port;
+ default = 5000;
+ description = "Port for Harmonia to listen on";
+ };
+ basicAuth = lib.mkOption {
+ type = lib.types.nullOr (lib.types.submodule {
+ options = {
+ user = lib.mkOption {
+ type = lib.types.str;
+ description = "Basic auth username";
+ };
+ hash = lib.mkOption {
+ type = lib.types.str;
+ description = "Basic auth password hash (Caddy-compatible)";
+ };
+ };
+ });
+ default = null;
+ description = "Basic auth configuration";
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ services.harmonia.cache = {
+ enable = false;
+ inherit (cfg) signKeyPaths;
+ settings = {
+ bind = "127.0.0.1:${toString cfg.port}";
+ workers = 4;
+ max_connection_rate = 256;
+ priority = cfg.priority;
+ enable_compression = cfg.enableCompression;
+ };
+ };
+
+ services.caddy.virtualHosts."${cfg.domain}".extraConfig =
+ (lib.optionalString (cfg.basicAuth != null) ''
+ basic_auth {
+ ${cfg.basicAuth.user} ${cfg.basicAuth.hash}
+ }
+ '')
+ + ''
+ # Handle Nix cache requests
+ @nix_cache_paths {
+ path /nix-cache-info
+ path *.narinfo
+ path *.nar
+ path /serve/*
+ }
+
+ handle @nix_cache_paths {
+ reverse_proxy 127.0.0.1:${toString cfg.port}
+ }
+
+ # Optional: serve package content directly
+ @serve_paths {
+ path_regexp ^/serve/(?P<hash>[a-z0-9]+)/.*
+ }
+
+ handle @serve_paths {
+ reverse_proxy 127.0.0.1:${toString cfg.port}
+ }
+ '';
+
+ nix.settings.allowed-users = ["harmonia"];
+
+ systemd.tmpfiles.rules =
+ [
+ "d /var/lib/harmonia 0750 harmonia harmonia -"
+ ]
+ ++ (map (keyPath: "f ${keyPath} 0400 harmonia harmonia -") cfg.signKeyPaths);
+ };
+}
diff --git a/modules/services/static.nix b/modules/services/static.nix
@@ -0,0 +1,92 @@
+{
+ config,
+ lib,
+ ...
+}: let
+ cfg = config.services.haravara.static;
+
+ staticFiles = ../../static;
+in {
+ options.services.haravara.static = {
+ enable = lib.mkEnableOption "Static site assets deployment";
+ # Map of domain name -> directory name under static/
+ domains = lib.mkOption {
+ type = lib.types.attrsOf (lib.types.submodule {
+ options = {
+ dir = lib.mkOption {
+ type = lib.types.str;
+ description = "Directory name in static folder";
+ };
+ hasMine = lib.mkOption {
+ type = lib.types.bool;
+ default = false;
+ description = "Whether to handle the ~m/mine directory mapping";
+ };
+ hasRedirect = lib.mkOption {
+ type = lib.types.bool;
+ default = false;
+ description = "Whether to redirect / to the base domain";
+ };
+ hasShortener = lib.mkOption {
+ type = lib.types.bool;
+ default = false;
+ description = "Whether to handle /s/ shortener proxy";
+ };
+ };
+ });
+ };
+ };
+
+ config = lib.mkIf cfg.enable {
+ users.users.caddy.extraGroups = ["storage-users"];
+
+ systemd.tmpfiles.rules =
+ [
+ "d /var/lib/haravara/static 0755 caddy caddy -"
+ ]
+ ++ (lib.concatLists (lib.mapAttrsToList (_: opt:
+ [
+ "d /var/lib/haravara/static/${opt.dir} 0755 caddy caddy -"
+ "L+ /var/lib/haravara/static/${opt.dir}/index.html - - - - ${staticFiles}/${opt.dir}/index.html"
+ ]
+ ++ lib.optionals opt.hasMine [
+ "d /var/lib/haravara/static/${opt.dir}/mine 0755 caddy caddy -"
+ "L+ /var/lib/haravara/static/${opt.dir}/mine/tempo.html - - - - ${staticFiles}/${opt.dir}/mine/tempo.html"
+ # Special case for avatar which might not exist in all dirs, but we link it if it's there
+ "L+ /var/lib/haravara/static/${opt.dir}/mine/avatar.jpg - - - - ${staticFiles}/${opt.dir}/mine/avatar.jpg"
+ ]
+ ++ lib.optionals (opt.dir != "") [
+ "L+ /var/lib/haravara/static/${opt.dir}/hello.jpg - - - - ${staticFiles}/${opt.dir}/hello.jpg"
+ ])
+ cfg.domains));
+
+ services.caddy.virtualHosts =
+ lib.mapAttrs (domain: opt: {
+ extraConfig =
+ ''
+ root * /var/lib/haravara/static/${opt.dir}
+ ''
+ + lib.optionalString opt.hasMine ''
+ # Map ~m to the physical 'mine' directory
+ handle /~m/* {
+ uri strip_prefix /~m
+ file_server {
+ root /var/lib/haravara/static/${opt.dir}/mine
+ }
+ }
+ ''
+ + ''
+ file_server
+ ''
+ + lib.optionalString opt.hasShortener ''
+ handle /s/* {
+ reverse_proxy localhost:8721
+ }
+ ''
+ + lib.optionalString opt.hasRedirect ''
+ redir / https://${lib.concatStringsSep "." (lib.drop 1 (lib.splitString "." domain))}
+ '';
+ })
+ cfg.domains;
+ };
+}
diff --git a/modules/services/storage-box.nix b/modules/services/storage-box.nix
@@ -69,6 +69,12 @@ in {
++ lib.optionals config.services.haravara.monitoring.enable [
"d ${cfg.mountPoint}/nixaran/victoriametrics - - - -"
]
+ ++ lib.optionals config.services.haravara.harmonia.enable [
+ "d ${cfg.mountPoint}/nixaran/harmonia 0750 harmonia harmonia -"
+ ]
+ ++ lib.optionals config.services.haravara.bazel-cache.enable [
+ "d ${cfg.mountPoint}/nixaran/bazel-cache 0750 bazel-remote bazel-remote -"
+ ]
++ lib.optionals config.services.haravara.seaweedfs.enable [
"d ${cfg.mountPoint}/seanix 0755 seaweedfs storage-users -"
"d ${cfg.mountPoint}/seanix/master 0755 seaweedfs storage-users -"
@@ -114,6 +120,20 @@ in {
options = ["bind" "nofail"];
depends = [cfg.mountPoint];
};
+ }
+ // lib.optionalAttrs config.services.haravara.harmonia.enable {
+ "/var/lib/harmonia" = {
+ device = "${cfg.mountPoint}/nixaran/harmonia";
+ options = ["bind" "nofail" "_netdev"];
+ depends = ["${cfg.mountPoint}"];
+ };
+ }
+ // lib.optionalAttrs config.services.haravara.bazel-cache.enable {
+ "/var/lib/bazel-cache" = {
+ device = "${cfg.mountPoint}/nixaran/bazel-cache";
+ options = ["bind" "nofail" "_netdev"];
+ depends = ["${cfg.mountPoint}"];
+ };
};
systemd.services = let
@@ -139,6 +159,14 @@ in {
victoriametrics.after = ["var-lib-victoriametrics.mount"];
victoriametrics.requires = ["var-lib-victoriametrics.mount"];
})
+ (lib.mkIf config.services.haravara.harmonia.enable {
+ harmonia.after = ["var-lib-harmonia.mount"];
+ harmonia.requires = ["var-lib-harmonia.mount"];
+ })
+ (lib.mkIf config.services.haravara.bazel-cache.enable {
+ bazel-remote.after = ["var-lib-bazel\\x2dcache.mount"];
+ bazel-remote.requires = ["var-lib-bazel\\x2dcache.mount"];
+ })
];
};
}
diff --git a/secrets/netrc b/secrets/netrc
Binary files differ.
