Merge branch 'master' into rpi

Flake lock file updates:

• Updated input 'nixos-hardware':
    'github:NixOS/nixos-hardware/a89745edd5f657e2e5be5ed1bea86725ca78d92e' (2023-12-03)
  → 'github:NixOS/nixos-hardware/fa194fc484fd7270ab324bb985593f71102e84d1' (2023-12-04)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/5de0b32be6e85dc1a9404c75131316e4ffbc634c' (2023-12-01)
  → 'github:NixOS/nixpkgs/933d7dc155096e7575d207be6fb7792bc9f34f6d' (2023-12-02)

flake.lock

@@ -4,15 +4,14 @@
       "inputs": {
         "darwin": "darwin",
         "home-manager": "home-manager",
-        "nixpkgs": "nixpkgs",
+        "nixpkgs": "nixpkgs"
-        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1703371241,
+        "lastModified": 1701216516,
-        "narHash": "sha256-f7ZcabJ5iAH2IRfVuI55xSPZ9TbegFzvFxoKtIPNEn8=",
+        "narHash": "sha256-jKSeJn+7hZ1dZdiH1L+NWUGT2i/BGomKAJ54B9kT06Q=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "457669db4259ff69d1ac1183aaa6000420940c1f",
+        "rev": "13ac9ac6d68b9a0896e3d43a082947233189e247",
         "type": "github"
       },
       "original": {
@@ -29,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1700795494,
+        "lastModified": 1673295039,
-        "narHash": "sha256-gzGLZSiOhf155FW7262kdHo2YDeugp3VuIFb4/GGng0=",
+        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "4b9b83d5a92e8c1fbfd8eb27eda375908c11ec4d",
+        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
         "type": "github"
       },
       "original": {
@@ -43,34 +42,14 @@
         "type": "github"
       }
     },
-    "deploy-rs": {
-      "inputs": {
-        "flake-compat": "flake-compat",
-        "nixpkgs": "nixpkgs_2",
-        "utils": "utils"
-      },
-      "locked": {
-        "lastModified": 1703087360,
-        "narHash": "sha256-0VUbWBW8VyiDRuimMuLsEO4elGuUw/nc2WDeuO1eN1M=",
-        "owner": "serokell",
-        "repo": "deploy-rs",
-        "rev": "b709d63debafce9f5645a5ba550c9e0983b3d1f7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "serokell",
-        "repo": "deploy-rs",
-        "type": "github"
-      }
-    },
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1703023593,
+        "lastModified": 1702138393,
-        "narHash": "sha256-M+Cw6vh7xCDmIhyVuEPNmaNVUwpmdFQq8zlsXZTKees=",
+        "narHash": "sha256-2jRm1yzX+gKpSCtdpYt1olIgWVEkJnS7FeK00o9X1ko=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "bad853333d9021e7012adb9b8fbfe7a7003f26bc",
+        "rev": "d2e6cfdd63651ae8168e5905d94138f406580dd6",
         "type": "github"
       },
       "original": {
@@ -79,22 +58,6 @@
         "type": "github"
       }
     },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -103,11 +66,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703113217,
+        "lastModified": 1682203081,
-        "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
+        "narHash": "sha256-kRL4ejWDhi0zph/FpebFYhzqlOBrk0Pl3dzGEKSAlEw=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
+        "rev": "32d3e39c491e2f91152c84f8ad8b003420eab0a1",
         "type": "github"
       },
       "original": {
@@ -123,11 +86,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1703367386,
+        "lastModified": 1702676849,
-        "narHash": "sha256-FMbm48UGrBfOWGt8+opuS+uLBLQlRfhiYXhHNcYMS5k=",
+        "narHash": "sha256-XqcREaTS38/QOsN8fk8PP325/UXHyF9enbP5ZPw5aiA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d5824a76bc6bb93d1dce9ebbbcb09a9b6abcc224",
+        "rev": "aa99c2f4e9847cbb7e46fac0844ea1eb164b3b3a",
         "type": "github"
       },
       "original": {
@@ -139,11 +102,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1702453208,
+        "lastModified": 1701656485,
-        "narHash": "sha256-0wRi9SposfE2wHqjuKt8WO2izKB/ASDOV91URunIqgo=",
+        "narHash": "sha256-xDFormrGCKKGqngHa2Bz1GTeKlFMMjLnHhTDRdMJ1hs=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "7763c6fd1f299cb9361ff2abf755ed9619ef01d6",
+        "rev": "fa194fc484fd7270ab324bb985593f71102e84d1",
         "type": "github"
       },
       "original": {
@@ -154,11 +117,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1703013332,
+        "lastModified": 1677676435,
-        "narHash": "sha256-+tFNwMvlXLbJZXiMHqYq77z/RfmpfpiI3yjL6o/Zo9M=",
+        "narHash": "sha256-6FxdcmQr5JeZqsQvfinIMr0XcTyTuR7EXX0H3ANShpQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "54aac082a4d9bb5bbc5c4e899603abfb76a3f6d6",
+        "rev": "a08d6979dd7c82c4cef0dcc6ac45ab16051c1169",
         "type": "github"
       },
       "original": {
@@ -170,27 +133,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1702272962,
+        "lastModified": 1702346276,
-        "narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
+        "narHash": "sha256-eAQgwIWApFQ40ipeOjVSoK4TEHVd6nbSd9fApiHIw5A=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d",
+        "rev": "cf28ee258fd5f9a52de6b9865cdb93a1f96d09b7",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixpkgs-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1703068421,
-        "narHash": "sha256-WSw5Faqlw75McIflnl5v7qVD/B3S2sLh+968bpOGrWA=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d65bceaee0fb1e64363f7871bc43dc1c6ecad99f",
         "type": "github"
       },
       "original": {
@@ -202,11 +149,10 @@
     "root": {
       "inputs": {
         "agenix": "agenix",
-        "deploy-rs": "deploy-rs",
         "firefox-gnome-theme": "firefox-gnome-theme",
         "home-manager": "home-manager_2",
         "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_2",
         "secrets": "secrets",
         "thunderbird-gnome-theme": "thunderbird-gnome-theme"
       }
@@ -214,11 +160,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1702936962,
+        "lastModified": 1702750793,
-        "narHash": "sha256-uIZ2uPE26JKJ58463ejHMiAOpqBwflyN6tCmZ89vaSQ=",
+        "narHash": "sha256-w4ajlpX4k+9HBgmRhMaWMfHsNEs1M4ncKtJGXZcHqe8=",
         "ref": "refs/heads/master",
-        "rev": "c6db5c3ba8bff0e618fc3e31c9680863c5e53800",
+        "rev": "08e2b6b214e43e8bf3b3db9b7819fd27a1038c86",
-        "revCount": 5,
+        "revCount": 1,
         "type": "git",
         "url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
       },
@@ -227,36 +173,6 @@
         "url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
       }
     },
-    "systems": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
     "thunderbird-gnome-theme": {
       "flake": false,
       "locked": {
@@ -272,24 +188,6 @@
         "repo": "thunderbird-gnome-theme",
         "type": "github"
       }
-    },
-    "utils": {
-      "inputs": {
-        "systems": "systems_2"
-      },
-      "locked": {
-        "lastModified": 1701680307,
-        "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -3,8 +3,8 @@
 
   inputs = {
     nixpkgs.url = "nixpkgs/nixos-23.11";
+    nixos-hardware.url = "github:NixOS/nixos-hardware";
     agenix.url = "github:ryantm/agenix";
-    deploy-rs.url = "github:serokell/deploy-rs";
     home-manager = {
       url = "github:nix-community/home-manager/release-23.11";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -13,7 +13,6 @@
       url = "github:rafaelmardojai/firefox-gnome-theme";
       flake = false;
     };
-    nixos-hardware.url = "github:NixOS/nixos-hardware";
     secrets = {
       url = "git+ssh://git@git.vimium.com/jordan/nix-secrets.git";
       flake = false;
@@ -24,7 +23,7 @@
     };
   };
 
-  outputs = inputs @ { self, nixpkgs, agenix, deploy-rs, home-manager, nixos-hardware, secrets, ... }:
+  outputs = inputs @ { self, nixpkgs, agenix, home-manager, secrets, ... }:
     let
       nixpkgsForSystem = system: inputs.nixpkgs;
       overlays = [
@@ -36,7 +35,7 @@
         home-manager.nixosModule
         ./modules
       ];
-      nixosSystem = { system, name, extraModules ? [] }:
+      nixosSystem = system: name:
         let
           nixpkgs = nixpkgsForSystem system;
           lib = (import nixpkgs { inherit overlays system; }).lib;
@@ -58,29 +57,16 @@
                 };
               })
             ./hosts/${name}
-          ] ++ extraModules;
+          ];
         };
-    in
-    {
       nixosConfigurations = {
-        atlas = nixosSystem { system = "x86_64-linux"; name = "atlas"; };
+        atlas = nixosSystem "x86_64-linux" "atlas";
-        eos = nixosSystem { system = "x86_64-linux"; name = "eos"; };
+        eos = nixosSystem "x86_64-linux" "eos";
-        helios = nixosSystem { system = "x86_64-linux"; name = "helios"; };
+        helios = nixosSystem "x86_64-linux" "helios";
-        odyssey = nixosSystem { system = "x86_64-linux"; name = "odyssey"; };
+        odyssey = nixosSystem "x86_64-linux" "odyssey";
-        pi = nixosSystem { system = "aarch64-linux"; name = "pi"; extraModules = [ nixos-hardware.nixosModules.raspberry-pi-4 ]; };
+        pi = nixosSystem "aarch64-linux" "pi";
       };
-
+    in
-      deploy.nodes.pi = {
+    { inherit nixosConfigurations; };
-        hostname = "10.0.1.191";
-        sshUser = "root";
-
-        profiles.system = {
-          user = "root";
-          path = deploy-rs.lib.aarch64-linux.activate.nixos self.nixosConfigurations.pi;
-        };
-      };
-
-      # checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
-    };
 }
 

hosts/new.md

@@ -1,30 +0,0 @@
-# Steps to add a new host
-
-1. Generate an SSH host key to be used for secrets
-`ssh-keygen -t ed25519 -f /tmp/ssh_host_ed25519_key -C ""`
-1. Go to borgmatic.com, add the generated SSH key and create a new
-repository
-1. Add a new host entry to nix-secrets/secrets.nix
-1. Generate a repository passphrase in nix-secrets
-1. Commit nix-secrets and run `nix flake update` in nix-config
-1. Add a README.md and default.nix suited to the host
-1. Define (or generate with `nixos-generate-config`) a
-hardware-configuration.nix
-1. Define the disk layout to be used by disko
-1. Commit nix-config
-1. Boot the NixOS installer
-1. Copy the generated SSH host key to `/etc/ssh`
-1. Run `nix run github:nix-community/nixos-anywhere -- --flake .#<hostname> root@<ip address>`
-
-## Post install
-> The backup and Tailscale modules won't work until the following steps are
-> completed.
-
-1. Run `sudo borgmatic init --encryption repokey-blake2`
-1. Restart `borgmatic`
-1. Run `sudo tailscale up --login-server https://headscale.vimium.net`
-1. Visit the URL, then SSH onto `vps1` and run
-`headscale --user mesh nodes register --key <key>`
-1. (Optionally) Give the Tailscale node a friendly name with
-`headscale node rename -i <index> <hostname>`
-

hosts/odyssey/default.nix

@@ -25,8 +25,6 @@
 
   virtualisation.libvirtd.enable = true;
   virtualisation.lxd.enable = true;
-  # Work around https://github.com/NixOS/nixpkgs/issues/263359
-  networking.firewall.trustedInterfaces = [ "lxdbr0" "virbr0" ];
 
   users.defaultUserShell = pkgs.zsh;
 
@@ -52,7 +50,7 @@
     };
   };
 
-  age.secrets."passwords/services/borg/odyssey-passphrase" = {
+  age.secrets."odyssey-passphrase" = {
     file = "${inputs.secrets}/passwords/services/borg/odyssey-passphrase.age";
   };
 
@@ -66,7 +64,7 @@
         { label = "borgbase"; path = "ssh://iqwu22oq@iqwu22oq.repo.borgbase.com/./repo"; }
       ];
       storage = {
-        encryption_passcommand = "cat ${config.age.secrets."passwords/services/borg/odyssey-passphrase".path}";
+        encryption_passcommand = "cat ${config.age.secrets.odyssey-passphrase.path}";
         ssh_command = "ssh -i /etc/ssh/ssh_host_ed25519_key";
       };
       retention = {
@@ -86,10 +84,6 @@
       browsers = {
         firefox.enable = true;
       };
-      gaming.emulators = {
-        ps2.enable = true;
-        psp.enable = true;
-      };
       media.graphics = {
         modeling.enable = true;
         raster.enable = true;

hosts/pi/README.md

@@ -11,7 +11,7 @@ Raspberry Pi 4
 ### Disks
 Device | Partitions _(filesystem, usage)_
 --- | ---
-SD card | `/dev/mmcblk0` (ext4, NixOS Root)
+SD card | `/dev/sda1` (ext4, NixOS Root)
 
 ### Networks
 - DHCP on `10.0.1.0/24` subnet.

hosts/pi/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
   imports = [
@@ -11,12 +11,13 @@
   hardware = {
     raspberry-pi."4" = {
       apply-overlays-dtmerge.enable = true;
-      audio.enable = false;
+      audio = false;
-      fkms-3d.enable = false;
+      fkms-3d.enable = true;
-      xhci.enable = false;
+      xhci.enable = true;
     };
     deviceTree = {
       enable = true;
+      filter = "*rpi-4-*.dtb";
       overlays = [
         { name = "hifiberry-digi-pro"; dtboFile = "${pkgs.device-tree_rpi.overlays}/hifiberry-digi-pro.dtbo"; }
       ];
@@ -28,9 +29,10 @@
   };
 
   sound.enable = true;
+  console.enable = false;
 
   age.secrets."passwords/networks.age" = {
-    file = "${inputs.secrets}/passwords/networks.age";
+    file = "../../secrets/passwords/networks.age";
   };
 
   networking = {
@@ -53,90 +55,21 @@
     systemWide = true;
   };
 
-  virtualisation.oci-containers = {
+  services.shairport-sync = {
-    backend = "podman";
-    containers.homeassistant = {
-      volumes = [ "home-assistant:/config" ];
-      environment.TZ = config.time.timeZone;
-      image = "ghcr.io/home-assistant/home-assistant:stable";
-      extraOptions = [
-        "--network=host"
-        "--device=/dev/ttyUSB0:/dev/ttyUSB0"
-      ];
-    };
-  };
-
-  services.mosquitto = {
     enable = true;
-    listeners = [{
+    group = [ "pipewire" ];
-      port = 1883;
+    openFirewall = true;
-      settings = {
-        allow_anonymous = true;
-      };
-    }];
-  };
-
-  age.secrets."files/services/zigbee2mqtt/secret.yaml" = {
-    file = "${inputs.secrets}/files/services/zigbee2mqtt/secret.yaml.age";
-    path = "${config.services.zigbee2mqtt.dataDir}/secret.yaml";
-    owner = "zigbee2mqtt";
-    group = "zigbee2mqtt";
   };
 
   services.zigbee2mqtt = {
     enable = true;
-    dataDir = "/var/lib/zigbee2mqtt";
     settings = {
       homeassistant = true;
       frontend = true;
-      device_options = {
+      permit_join = true;
-        retain = true;
-      };
-      serial = {
-        port = "/dev/serial/by-id/usb-Silicon_Labs_Sonoff_Zigbee_3.0_USB_Dongle_Plus_0001-if00-port0";
-      };
-      advanced = {
-        channel = 20;
-        network_key = "!secret.yaml network_key";
-        pan_id = 13001;
-        ext_pan_id = [ 79 1 73 47 250 136 124 222 ];
-      };
-      mqtt = {
-        version = 5;
-        server = "mqtt://localhost:1883";
-      };
     };
   };
 
-  age.secrets."passwords/services/borg/pi-passphrase" = {
-    file = "${inputs.secrets}/passwords/services/borg/pi-passphrase.age";
-  };
-
-  services.borgmatic = {
-    enable = true;
-    settings = {
-      source_directories = [
-        "/var/lib/mosquitto"
-        "/var/lib/zigbee2mqtt"
-      ];
-      repositories = [
-        { label = "borgbase"; path = "ssh://qcw86s11@qcw86s11.repo.borgbase.com/./repo"; }
-      ];
-      storage = {
-        encryption_passcommand = "cat ${config.age.secrets."passwords/services/borg/pi-passphrase".path}";
-        ssh_command = "ssh -i /etc/ssh/ssh_host_ed25519_key";
-      };
-      retention = {
-        keep_daily = 7;
-        keep_weekly = 4;
-        keep_monthly = 6;
-      };
-    };
-  };
-
-  # Without this override, `cat` is unavailable for `encryption_passcommand`
-  systemd.services.borgmatic.confinement.fullUnit = true;
-
   environment.systemPackages = with pkgs; [
     libraspberrypi
     raspberrypi-eeprom

hosts/pi/hardware-configuration.nix

@@ -2,23 +2,10 @@
 
 {
   imports = [
-    (modulesPath + "/installer/sd-card/sd-image-aarch64.nix")
+    <nixos-hardware/raspberry-pi/4>
   ];
 
-  boot = {
+  boot.cleanTmpDir = true;
-    # Stop ZFS kernel being built
-    supportedFilesystems = lib.mkForce [ "btrfs" "cifs" "f2fs" "jfs" "ntfs" "reiserfs" "vfat" "xfs" ];
-    tmp.cleanOnBoot = true;
-  };
-
-  # Fix missing modules
-  # https://github.com/NixOS/nixpkgs/issues/154163
-  nixpkgs.overlays = [
-    (final: super: {
-      makeModulesClosure = x:
-        super.makeModulesClosure (x // { allowMissing = true; });
-    })
-  ];
 
   fileSystems = {
     "/" = {

modules/desktop/gnome.nix

@@ -200,9 +200,7 @@ in {
       tokei
       tree
       wl-clipboard
-    ] ++ (if config.virtualisation.podman.enable then [
+    ];
-      pods
-    ] else []);
 
     home.services.gpg-agent.pinentryFlavor = "gnome3";
   };

modules/options.nix

@@ -1,4 +1,4 @@
-{ config, options, lib, home-manager, inputs, ... }:
+{ config, options, lib, home-manager, ... }:
 
 with lib;
 {
@@ -29,7 +29,6 @@ with lib;
   };
 
   config = {
-    age.secrets."passwords/users/jordan".file = "${inputs.secrets}/passwords/users/jordan.age";
     user =
       let user = builtins.getEnv "USER";
           name = if elem user [ "" "root" ] then "jordan" else user;
@@ -42,7 +41,6 @@ with lib;
         openssh.authorizedKeys.keys = [
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILVHTjsyMIV4THNw6yz0OxAxGnC+41gX72UrPqTzR+OS jordan@vimium.com"
         ];
-        hashedPasswordFile = config.age.secrets."passwords/users/jordan".path;
         home = "/home/${name}";
         group = "users";
         uid = 1000;