flake.lock: Update

Flake lock file updates:

• Updated input 'disko':
    'github:nix-community/disko/0d510fe40b56ed74907a021d7e1ffd0042592914' (2024-08-12)
  → 'github:nix-community/disko/276a0d055a720691912c6a34abb724e395c8e38a' (2024-08-15)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/a781ff33ae258bbcfd4ed6e673860c3e923bf2cc' (2024-08-10)
  → 'github:NixOS/nixpkgs/c3d4ac725177c030b1e289015989da2ad9d56af0' (2024-08-15)
• Updated input 'nixpkgs-unstable':
    'github:NixOS/nixpkgs/5e0ca22929f3342b19569b21b2f3462f053e497b' (2024-08-09)
  → 'github:NixOS/nixpkgs/c3aa7b8938b17aebd2deecf7be0636000d62a2b9' (2024-08-14)
• Updated input 'nixvim':
    'github:nix-community/nixvim/fe5ca4919c07c06fd75b7f6d247f95b1030ae095' (2024-08-10)
  → 'github:nix-community/nixvim/0b6aa80acbcb8387f2a4affb3dd22960ac2899aa' (2024-08-13)
• Updated input 'nixvim/treefmt-nix':
    'github:numtide/treefmt-nix/768acdb06968e53aa1ee8de207fd955335c754b7' (2024-07-30)
  → 'github:numtide/treefmt-nix/349de7bc435bdff37785c2466f054ed1766173be' (2024-08-12)
• Updated input 'plasma-manager':
    'github:nix-community/plasma-manager/b3b9d4ce20d75319c20a7faada08ad9135a1f008' (2024-08-12)
  → 'github:nix-community/plasma-manager/8726ecaa8b8c06910ef31abced57bf08a59730a1' (2024-08-16)

flake.lock

@@ -107,11 +107,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723080788,
+        "lastModified": 1723685519,
-        "narHash": "sha256-C5LbM5VMdcolt9zHeLQ0bYMRjUL+N+AL5pK7/tVTdes=",
+        "narHash": "sha256-GkXQIoZmW2zCPp1YFtAYGg/xHNyFH/Mgm79lcs81rq0=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ffc1f95f6c28e1c6d1e587b51a2147027a3e45ed",
+        "rev": "276a0d055a720691912c6a34abb724e395c8e38a",
         "type": "github"
       },
       "original": {
@@ -233,11 +233,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722857853,
+        "lastModified": 1723202784,
-        "narHash": "sha256-3Zx53oz/MSIyevuWO/SumxABkrIvojnB7g9cimxkhiE=",
+        "narHash": "sha256-qbhjc/NEGaDbyy0ucycubq4N3//gDFFH3DOmp1D3u1Q=",
         "owner": "cachix",
         "repo": "git-hooks.nix",
-        "rev": "06939f6b7ec4d4f465bf3132a05367cccbbf64da",
+        "rev": "c7012d0c18567c889b948781bc74a501e92275d1",
         "type": "github"
       },
       "original": {
@@ -459,11 +459,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1723175592,
+        "lastModified": 1723637854,
-        "narHash": "sha256-M0xJ3FbDUc4fRZ84dPGx5VvgFsOzds77KiBMW/mMTnI=",
+        "narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e0ca22929f3342b19569b21b2f3462f053e497b",
+        "rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",
         "type": "github"
       },
       "original": {
@@ -490,11 +490,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1723282977,
+        "lastModified": 1723688146,
-        "narHash": "sha256-oTK91aOlA/4IsjNAZGMEBz7Sq1zBS0Ltu4/nIQdYDOg=",
+        "narHash": "sha256-sqLwJcHYeWLOeP/XoLwAtYjr01TISlkOfz+NG82pbdg=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a781ff33ae258bbcfd4ed6e673860c3e923bf2cc",
+        "rev": "c3d4ac725177c030b1e289015989da2ad9d56af0",
         "type": "github"
       },
       "original": {
@@ -517,11 +517,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1722925293,
+        "lastModified": 1723536338,
-        "narHash": "sha256-saXm5dd/e3PMsYTEcp1Qbzifm3KsZtNFkrWjmLhXHGE=",
+        "narHash": "sha256-1bSEOtZBsAeCkg5vdDbDgOT3z91K8L/KE2s7J9hLYHw=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "170df9814c3e41d5a4d6e3339e611801b1f02ce2",
+        "rev": "0b6aa80acbcb8387f2a4affb3dd22960ac2899aa",
         "type": "github"
       },
       "original": {
@@ -541,11 +541,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1723232379,
+        "lastModified": 1723804780,
-        "narHash": "sha256-F4Y3f9305aHGWKqAd3s2GyNRONdpDBuNuK4TCSdaHz8=",
+        "narHash": "sha256-uuiu1UAfYr2Lo+5Ul6eA0UIYouoPvH9aIfYbq7wVF6c=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "22bea90404c5ff6457913a03c1a54a3caa5b1c57",
+        "rev": "8726ecaa8b8c06910ef31abced57bf08a59730a1",
         "type": "github"
       },
       "original": {
@@ -576,11 +576,11 @@
     "secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1723385164,
+        "lastModified": 1723415003,
-        "narHash": "sha256-/z4nBwpHsGWl1gmGv7FQQgoOcPwUaVzL7rfjI5nTOLg=",
+        "narHash": "sha256-zSzDvI0sHayG5se7ALXhJhl41tConoWYbdqeow6OmBo=",
         "ref": "refs/heads/master",
-        "rev": "b47efe67031e12a2d5560b94fdb4de7dca3df80c",
+        "rev": "db951141cab2de0b4176f4f6fc42a50b30dd3950",
-        "revCount": 24,
+        "revCount": 26,
         "type": "git",
         "url": "ssh://git@git.vimium.com/jordan/nix-secrets.git"
       },
@@ -658,11 +658,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722330636,
+        "lastModified": 1723454642,
-        "narHash": "sha256-uru7JzOa33YlSRwf9sfXpJG+UAV+bnBEYMjrzKrQZFw=",
+        "narHash": "sha256-S0Gvsenh0II7EAaoc9158ZB4vYyuycvMGKGxIbERNAM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "768acdb06968e53aa1ee8de207fd955335c754b7",
+        "rev": "349de7bc435bdff37785c2466f054ed1766173be",
         "type": "github"
       },
       "original": {

flake.nix

@@ -112,7 +112,12 @@
         magicRollback = true;
         autoRollback = true;
         sshUser = "root";
-        nodes = lib.genAttrs [ "mail" "pi" "skycam" "vps1" ] mkDeployNode;
+        nodes = lib.genAttrs [
+          "mail"
+          # "pi"
+          # "skycam"
+          "vps1"
+        ] mkDeployNode;
       };
 
       checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) inputs.deploy-rs.lib;

hosts/desktop.nix

@@ -6,7 +6,7 @@
   ];
 
   nixpkgs.overlays = [
-    (import ../overlays/gnome)
+    (import ../overlays/gnome.nix)
   ];
 
   services.printing.enable = true;

hosts/skycam/default.nix

@@ -55,7 +55,7 @@
   '';
 
   nixpkgs.overlays = [
-    (import ./../../overlays/libcamera)
+    (import ./../../overlays/libcamera.nix)
   ];
 
   networking = {

hosts/vps1/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, self, ... }:
+{ config, lib, ... }:
 
 {
   imports = [
@@ -37,91 +37,43 @@
     groups = {
       jellyfin = { };
     };
+    extraGroups.acme.members = [ "kanidm" "nginx" ];
   };
 
   services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
 
-  services.postgresql = {
+  security.acme.certs."auth.vimium.com" = {
-    ensureUsers = [
+    postRun = "systemctl restart kanidm.service";
-      {
+    group = "acme";
-        name = "zitadel";
-        ensureDBOwnership = true;
-        ensureClauses = {
-          superuser = true;
-        };
-      }
-    ];
-    ensureDatabases = [ "zitadel" ];
   };
 
-  age.secrets."files/services/zitadel/masterkey" = {
+  services.kanidm = let
-    file = "${self.inputs.secrets}/files/services/zitadel/masterkey.age";
+    baseDomain = "vimium.com";
-    owner = "zitadel";
+    domain = "auth.${baseDomain}";
-    group = "zitadel";
+    uri = "https://${domain}";
-  };
+  in {
-
+    enableClient = true;
-  systemd.services.zitadel = {
+    enableServer = true;
-    requires = [ "postgresql.service" ];
+    clientSettings = {
-    after = [ "postgresql.service" ];
+      inherit uri;
-  };
-
-  services.zitadel = {
-    enable = true;
-    masterKeyFile = config.age.secrets."files/services/zitadel/masterkey".path;
-    settings = {
-      Database.postgres = {
-        Host = "/run/postgresql";
-        Port = 5432;
-        Database = "zitadel";
-        User = {
-          Username = "zitadel";
-          SSL.Mode = "disable";
-        };
-        Admin = {
-          ExistingDatabase = "zitadel";
-          Username = "zitadel";
-          SSL.Mode = "disable";
-        };
-      };
-      ExternalDomain = "id.vimium.com";
-      ExternalPort = 443;
-      ExternalSecure = true;
-      Machine = {
-        Identification = {
-          Hostname.Enabled = true;
-          PrivateIp.Enabled = false;
-          Webhook.Enabled = false;
-        };
-      };
-      Port = 8081;
-      WebAuthNName = "Vimium";
     };
-    steps.FirstInstance = {
+    serverSettings = {
-      InstanceName = "Vimium";
+      bindaddress = "[::1]:3013";
-      Org.Name = "Vimium";
+      ldapbindaddress = "[::1]:636";
-      Org.Human = {
+      domain = baseDomain;
-        UserName = "jordan@vimium.com";
+      origin = uri;
-        FirstName = "Jordan";
+      tls_chain = "${config.security.acme.certs.${domain}.directory}/full.pem";
-        LastName = "Holt";
+      tls_key = "${config.security.acme.certs.${domain}.directory}/key.pem";
-        Email = {
-          Address = "jordan@vimium.com";
-          Verified = true;
-        };
-        Password = "Password1!";
-        PasswordChangeRequired = true;
-      };
-      LoginPolicy.AllowRegister = false;
     };
   };
 
-  services.nginx.virtualHosts."id.vimium.com" = {
+  services.nginx.virtualHosts = {
-    enableACME = true;
+    "auth.vimium.com" = {
-    forceSSL = true;
+      useACMEHost = "auth.vimium.com";
-    locations."/" = {
+      forceSSL = true;
-      extraConfig = ''
+      locations."/" = {
-        grpc_pass grpc://localhost:${builtins.toString config.services.zitadel.settings.Port};
+        proxyPass = "https://[::1]:3013";
-        grpc_set_header Host $host:$server_port;
+      };
-      '';
     };
   };
 

modules/databases/postgresql.nix

@@ -17,7 +17,6 @@ in {
   config = lib.mkIf cfg.enable {
     services.postgresql = {
       enable = true;
-      enableJIT = true;
       initdbArgs = [
         "--allow-group-access"
         "--encoding=UTF8"

modules/services/nginx/default.nix

@@ -118,8 +118,12 @@ in {
           serverAliases = [ "www.jdholt.com" ];
           extraConfig = nginxErrorPages + nginxEdgeHeaders + nginxStrictHeaders;
           locations."/skycam/snapshot.jpg" = {
-            proxyPass = "http://skycam.mesh.vimium.net:8080/snapshot";
             extraConfig = ''
+              set $backend "skycam.mesh.vimium.net:8080";
+
+              resolver 100.100.100.100;
+
+              proxy_pass http://$backend/snapshot;
               proxy_cache skycam_cache;
               proxy_cache_valid any 10s;
               proxy_ignore_headers Cache-Control Expires Set-Cookie;