.forgejo/workflows/update.yaml

@@ -1,32 +1,12 @@
 on: [push]
-
 jobs:
-  # Source: https://github.com/isabelroses/dotfiles/tree/main/.github/workflows
+  format:
-  update-lockfile:
+    runs-on: nix
-    runs-on: ubuntu-latest
-
     steps:
-      - name: Checkout
+      - run: nix --experimental-features 'nix-command flakes' fmt
-        uses: actions/checkout@v4
+  build:
-
+    runs-on: nix
-      - name: Install Nix
+    steps:
-        uses: DeterminateSystems/nix-installer-action@main
+      - run: nix --experimental-features 'nix-command flakes' flake update
-        with:
+      - run: nixos-rebuild --experimental-features 'nix-command flakes' build --flake .#Haven
-          logger: pretty
+      - run: nixos-rebuild --experimental-features 'nix-command flakes' build --flake .#Khanda
-
-#      - name: Update Lockfile
-#        uses: DeterminateSystems/update-flake-lock@main
-#        id: update
-#        with:
-#          pr-title: "chore(deps): flake inputs"
-#          commit-msg: "chore(deps): flake inputs"
-#          token: ${{ secrets.GITHUB_TOKEN }}
-
-#  build:
-#    runs-on: nix
-#    steps:
-#      - run: nix-env -iA nixpkgs.nodejs_20
-#      - uses: actions/checkout@v4
-#      - run: nix --experimental-features 'nix-command flakes' flake update
-#      - run: nixos-rebuild --experimental-features 'nix-command flakes' build --flake .#Haven
-#      - run: nixos-rebuild --experimental-features 'nix-command flakes' build --flake .#Khanda

flake.lock

@@ -33,27 +33,6 @@
         "type": "github"
       }
     },
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1715070411,
-        "narHash": "sha256-5CNvkH0Nf7yMwgKhjUNg/lUK40C7DXB4zKOuA2jVO90=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "4677f6c53482a8b01ee93957e3bdd569d51261d6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "v1.6.1",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -239,11 +218,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1717036776,
+        "lastModified": 1716506851,
-        "narHash": "sha256-joKTxvywYlKspGGKOIXho6oRbggOPyayEqAyuZCavO0=",
+        "narHash": "sha256-fzY708SyfHwLOFrg5ZU0fXW9mNdvRvqz64jg97vvpJM=",
         "ref": "refs/heads/main",
-        "rev": "b4b38e6b5fe18da9464f291ae5fbf2ea9acb9ccb",
+        "rev": "18fa4a89e208cb8e881f5f71c75bbd4c1c2fd37d",
-        "revCount": 86,
+        "revCount": 83,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/nixos-module"
       },
@@ -271,26 +250,26 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1717092160,
+        "lastModified": 1716827240,
-        "narHash": "sha256-dype0zRMyP94Uo8YC1vWQ6lkvXLYMep6+Xo7AW4K9cs=",
+        "narHash": "sha256-0LHXNvx7KEsn3j9w/4VtQiEWKrqJmmWn1k/169x/N04=",
-        "ref": "42ddf14d36d9fab1eb070f51fdf1991d1a21dde9",
+        "ref": "refs/heads/main",
-        "rev": "42ddf14d36d9fab1eb070f51fdf1991d1a21dde9",
+        "rev": "f8a243d7e9db4689bcfc7726df75d5725daf4b60",
-        "revCount": 42,
+        "revCount": 40,
         "type": "git",
-        "url": "file:./nix-secrets"
+        "url": "file:///home/aires/Development/nix-configuration/nix-secrets"
       },
       "original": {
         "type": "git",
-        "url": "file:./nix-secrets"
+        "url": "file:///home/aires/Development/nix-configuration/nix-secrets"
       }
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1717000136,
+        "lastModified": 1716588418,
-        "narHash": "sha256-MyFE1416Wsb9UxTNiHTGoOvtUl5JuCftj4EBfz9oPHU=",
+        "narHash": "sha256-3EpFUFlZjE+UkBlSXp2lC65ysgUmpAHl13kjh45+et0=",
         "ref": "master",
-        "rev": "2575b7552f52b34dadb08f140326fbbd19056355",
+        "rev": "80736f76ded618a54dce2db319247aeb902ce795",
-        "revCount": 1685,
+        "revCount": 1683,
         "type": "git",
         "url": "https://code.8bitbuddhism.com/aires/nixos-hardware"
       },
@@ -334,11 +313,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1717144377,
+        "lastModified": 1716542732,
-        "narHash": "sha256-F/TKWETwB5RaR8owkPPi+SPJh83AQsm6KrQAlJ8v/uA=",
+        "narHash": "sha256-0Y9fRr0CUqWT4KgBITmaGwlnNIGMYuydu2L8iLTfHU4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "805a384895c696f802a9bf5bf4720f37385df547",
+        "rev": "d12251ef6e8e6a46e05689eeccd595bdbd3c9e60",
         "type": "github"
       },
       "original": {
@@ -381,7 +360,6 @@
     },
     "root": {
       "inputs": {
-        "disko": "disko",
         "home-manager": "home-manager",
         "lanzaboote": "lanzaboote",
         "lix": "lix",

flake.nix

@@ -26,7 +26,6 @@
 
     # Hardware configurations
     nixos-hardware.url = "git+https://code.8bitbuddhism.com/aires/nixos-hardware?ref=master";
-    #nixos-hardware.url = "git+https://github.com/NixOS/nixos-hardware?ref=master";
 
     # Home-manager
     home-manager = {
@@ -36,7 +35,7 @@
 
     # "Secrets management"
     nix-secrets = {
-      url = "git+file:./nix-secrets";
+      url = "git+file:///home/aires/Development/nix-configuration/nix-secrets";
       flake = false;
     };
 
@@ -105,7 +104,6 @@
           system = "x86_64-linux";
           modules = defaultModules ++ [
             nixos-hardware.nixosModules.common-cpu-intel
-            nixos-hardware.nixosModules.common-gpu-intel
             ./hosts/Dimaga
           ];
         };
@@ -114,7 +112,6 @@
           system = "x86_64-linux";
           modules = defaultModules ++ [
             nixos-hardware.nixosModules.common-cpu-amd-pstate
-            nixos-hardware.nixosModules.common-gpu-amd
             ./hosts/Haven
           ];
         };

hosts/Haven/default.nix

@@ -19,6 +19,7 @@ in
   imports = [ ./hardware-configuration.nix ];
 
   system.stateVersion = "24.05";
+  system.autoUpgrade.enable = lib.mkForce false;
 
   host = {
     role = "server";
@@ -50,7 +51,6 @@ in
         enable = true;
         home = "/storage/services/airsonic-advanced";
       };
-      autoUpgrade.pushUpdates = true;
       boinc.enable = true;
       cache = {
         enable = false; # Disable for now
@@ -114,41 +114,4 @@ in
 
   # Allow Haven to be a build target for other architectures (mainly ARM64)
   boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-  # Automatically update Flake configuration for other hosts to use
-  systemd.services."nixos-update-flake" = {
-    serviceConfig = {
-      Type = "oneshot";
-      User = config.users.users.aires.name;
-    };
-    path = with pkgs; [
-      # Courtesy of https://discourse.nixos.org/t/how-to-use-other-packages-binary-in-systemd-service-configuration/14363
-      coreutils
-      gnutar
-      xz.bin
-      gzip
-      git
-      config.nix.package.out
-      openssh
-    ];
-    script = ''
-      set -eu
-      cd ${config.secrets.nixConfigFolder}
-      git pull --recurse-submodules
-      nix flake update
-      git add flake.lock
-      git diff --quiet && git diff --staged --quiet || git commit -am "Update flake.lock" && git push	# Courtesy of https://stackoverflow.com/a/40255467
-    '';
-  };
-
-  systemd.timers."nixos-update-flake-timer" = {
-    wants = [ "network-online.target" ];
-    after = [ "network-online.target" ];
-    wantedBy = [ "timers.target" ];
-    timerConfig = {
-      OnCalendar = "daily";
-      Persistent = "true";
-      Unit = "nixos-update-flake.service";
-    };
-  };
 }

hosts/Khanda/hardware-configuration.nix

@@ -43,6 +43,11 @@
         "surface_kbd"
         "pinctrl_tigerlake"
       ];
+
+      luks.devices."luks-bd1fe396-6740-4e7d-af2c-26ca9a3031f1" = {
+        device = "/dev/disk/by-uuid/bd1fe396-6740-4e7d-af2c-26ca9a3031f1";
+        crypttabExtraOpts = [ "tpm2-device=auto" ];
+      };
     };
 
     kernelModules = [
@@ -63,6 +68,22 @@
     extraModulePackages = [ ];
   };
 
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-uuid/b34afd29-94ff-421b-bb96-8497951abf58";
+      fsType = "btrfs";
+      options = [ "subvol=@,compress=zstd" ];
+    };
+
+    "/boot" = {
+      device = "/dev/disk/by-uuid/DD2A-9C83";
+      fsType = "vfat";
+    };
+  };
+
+  # TODO: Disable once DIsko is up and running
+  swapDevices = [ { device = "/dev/disk/by-uuid/8c2519d9-3e47-4aa1-908d-98b1aa8b909d"; } ];
+
   networking = {
     useDHCP = lib.mkDefault true;
     hostName = "Khanda";
@@ -82,7 +103,7 @@
   # boot.kernelPackages = lib.mkForce pkgs.linuxPackages_latest;
 
   # Disk management
-  disko.enableConfig = true; # Disable while testing
+  disko.enableConfig = false; # Disable while testing
   disko.devices = {
     disk = {
       nvme0n1 = {
@@ -133,7 +154,7 @@
                       mountpoint = "/nix";
                     };
                     "/swap" = {
-                      mountpoint = "/.swap";
+                      mountpoint = "/.swapvol";
                       swap.swapfile.size = "8G";
                     };
                     "/log" = {

hosts/Shura/bluetooth/vitrix-pdp-pro-params

@@ -1,42 +0,0 @@
-[General]
-Name=Victrix Pro BFG
-Appearance=0x03c4
-AddressType=public
-SupportedTechnologies=LE;
-Trusted=true
-Blocked=false
-WakeAllowed=true
-Services=00001800-0000-1000-8000-00805f9b34fb;00001801-0000-1000-8000-00805f9b34fb;0000180a-0000-1000-8000-00805f9b34fb;0000180f-0000-1000-8000-00805f9b34fb;00001812-0000-1000-8000-00805f9b34fb;00001813-0000-1000-8000-00805f9b34fb;f95a48e6-a721-11e9-a2a3-022ae2dbcce4;
-
-[LongTermKey]
-Key=F12268049C72EA0561E2E77DEA02AC12
-Authenticated=0
-EncSize=16
-EDiv=29996
-Rand=5139827239406697411
-
-[PeripheralLongTermKey]
-Key=CC60B7A9080383302B61EC2127E0D5CD
-Authenticated=0
-EncSize=16
-EDiv=59630
-Rand=6653202288716901387
-
-[SlaveLongTermKey]
-Key=CC60B7A9080383302B61EC2127E0D5CD
-Authenticated=0
-EncSize=16
-EDiv=59630
-Rand=6653202288716901387
-
-[DeviceID]
-Source=2
-Vendor=3695
-Product=587
-Version=768
-
-[ConnectionParameters]
-MinInterval=6
-MaxInterval=6
-Latency=0
-Timeout=300

hosts/Shura/default.nix

@@ -15,9 +15,6 @@ let
   mano-touchpad-bluetooth = pkgs.writeText "info" (
     builtins.readFile ./bluetooth/mano-touchpad-bluetooth-params
   );
-  vitrix-pdp-pro-bluetooth = pkgs.writeText "info" (
-    builtins.readFile ./bluetooth/vitrix-pdp-pro-params
-  );
 
   # Use gremlin user's monitor configuration for GDM (desktop monitor primary). See https://discourse.nixos.org/t/gdm-monitor-configuration/6356/4
   monitorsXmlContent = builtins.readFile ./monitors.xml;
@@ -78,7 +75,6 @@ in
     "L+ /var/lib/bluetooth/AC:50:DE:9F:AB:88/00:0E:DD:72:2F:0C/info - - - - ${shure-aonic-bluetooth}"
     "L+ /var/lib/bluetooth/AC:50:DE:9F:AB:88/F4:6A:D7:3A:16:75/info - - - - ${xbox-elite-bluetooth}"
     "L+ /var/lib/bluetooth/AC:50:DE:9F:AB:88/F8:5D:3C:7D:9A:00/info - - - - ${mano-touchpad-bluetooth}"
-    "L+ /var/lib/bluetooth/AC:50:DE:9F:AB:88/00:34:30:47:37:AB/info - - - - ${vitrix-pdp-pro-bluetooth}"
   ];
 
   # Configure the virtual machine created by nixos-rebuild build-vm

hosts/Shura/hardware-configuration.nix

@@ -66,6 +66,13 @@
     };
   };
 
+  swapDevices = [
+    {
+      device = "/swap/swapfile";
+      size = 16384;
+    }
+  ];
+
   networking = {
     # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
     # (the default) this is the recommended approach. When using systemd-networkd it's
@@ -79,73 +86,4 @@
   };
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-
-  # Disk management
-  disko.enableConfig = false; # Disable while testing
-  disko.devices = {
-    disk = {
-      nvme0n1 = {
-        type = "disk";
-        device = "";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              priority = 1;
-              name = "ESP";
-              label = "boot";
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-              };
-            };
-            luks = {
-              size = "100%";
-              label = "nixos";
-              content = {
-                type = "luks";
-                name = "cryptroot";
-                settings = {
-                  allowDiscards = true;
-                  crypttabExtraOpts = ["tpm2-device=auto"];
-                };
-                content = {
-                  type = "btrfs";
-                  extraArgs = [ "-f" ]; # Override existing partition
-                  # Subvolumes must set a mountpoint in order to be mounted,
-                  # unless their parent is mounted
-                  subvolumes = {
-                    # Subvolume name is different from mountpoint
-                    "/root" = {
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                      mountpoint = "/";
-                    };
-                    "/home" = {
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                      mountpoint = "/home";
-                    };
-                    "/nix" = {
-                      mountOptions = [ "compress=zstd" "noatime" ];
-                      mountpoint = "/nix";
-                    };
-                    "/swap" = {
-                      mountpoint = "/.swap";
-                      swap.swapfile.size = "16G";
-                    };
-                    "/log" = {
-                      mountpoint = "/var/log";
-                      mountOptions = ["compress=zstd" "noatime"];
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
 }

modules/base/programs.nix

@@ -17,7 +17,7 @@
 
     nh = {
       enable = true;
-      flake = "${config.secrets.nixConfigFolder}";
+      flake = "${config.users.users.aires.home}/Development/nix-configuration";
 
       # Alternative garbage collection system to nix.gc.automatic
       clean = {

modules/base/system.nix

@@ -26,6 +26,15 @@
     };
   };
 
+  # Configure automatic updates
+  system.autoUpgrade = {
+    enable = true;
+    flake = "${config.users.users.aires.home}/Development/nix-configuration";
+    dates = "daily";
+    allowReboot = false;
+    operation = "switch";
+  };
+
   services = {
     # Enable fwupd (firmware updater)
     fwupd.enable = true;

modules/services/autoupgrade.nix

@@ -1,108 +0,0 @@
-# Run automatic updates. Replaces system.autoUpgrade.
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.host.services.autoUpgrade;
-
-  # List of packages to include in each service's $PATH
-  pathPkgs = with pkgs; [
-    # Courtesy of https://discourse.nixos.org/t/how-to-use-other-packages-binary-in-systemd-service-configuration/14363
-    coreutils
-    git
-    gnutar
-    gzip
-    config.nix.package.out
-    nh
-    config.programs.ssh.package
-    sudo
-    xz.bin
-  ];
-in
-{
-  options = {
-    host.services.autoUpgrade = {
-      enable = lib.mkOption {
-        default = true;
-        type = lib.types.bool;
-        description = "Enables automatic system updates.";
-      };
-      pushUpdates = lib.mkEnableOption (
-        lib.mdDoc "Updates the flake.lock file and pushes it back to the repo."
-      );
-    };
-  };
-
-  config = lib.mkMerge [
-    (lib.mkIf cfg.enable {
-      # Pull and apply updates.
-      systemd.services."nixos-upgrade" = {
-        serviceConfig = {
-          Type = "oneshot";
-          User = "root";
-        };
-        path = pathPkgs;
-        script = ''
-          cd ${config.secrets.nixConfigFolder}
-          # Check if there are changes from Git.
-          echo "Pulling latest version..."
-          sudo -u aires git fetch
-          sudo -u aires git diff --quiet --exit-code main origin/main || true
-          # If we have changes (git diff returns 1), pull changes and run the update
-          if [ $? -eq 1 ]; then
-            echo "Updates found, running nixos-rebuild..."
-            sudo -u aires git pull --recurse-submodules
-            nh os switch
-          else
-            echo "No updates found. Exiting."
-          fi
-        '';
-      };
-      systemd.timers."nixos-upgrade-timer" = {
-        wants = [ "network-online.target" ];
-        after = [ "network-online.target" ];
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          OnCalendar = "daily";
-          Persistent = "true";
-          Unit = "nixos-upgrade.service";
-        };
-      };
-    })
-    (lib.mkIf cfg.pushUpdates {
-      # Automatically update Flake configuration for other hosts to use
-      systemd.services."nixos-upgrade-flake" = {
-        serviceConfig = {
-          Type = "oneshot";
-          User = config.users.users.aires.name;
-        };
-        path = pathPkgs;
-        # Git diffing strategy courtesy of https://stackoverflow.com/a/40255467
-        script = ''
-          set -eu
-          cd ${config.secrets.nixConfigFolder}
-          # Make sure we're up-to-date
-          echo "Pulling the latest version..."
-          git pull --recurse-submodules
-          nix flake update --commit-lock-file
-          git push
-        '';
-      };
-
-      systemd.timers."nixos-upgrade-flake-timer" = {
-        wants = [ "network-online.target" ];
-        after = [ "network-online.target" ];
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          OnCalendar = "daily";
-          Persistent = "true";
-          Unit = "nixos-upgrade-flake.service";
-        };
-      };
-    })
-  ];
-}

modules/services/forgejo.nix

@@ -72,13 +72,11 @@ in
           labels = [
             "nix:docker://nixos/nix" # Shoutout to Icewind 1991 for this syntax: https://icewind.nl/entry/gitea-actions-nix/
             "debian:docker://node:20-bullseye"
-            "ubuntu-latest:docker://ubuntu:latest"
           ];
           settings = {
             # For an example of configuring in Nix: https://git.clan.lol/clan/clan-infra/src/branch/main/modules/web01/gitea/actions-runner.nix
             # For an example of the different options available: https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml
-            container.options = "-v /nix:/nix";
+            container.validVolumes = "**";
-            container.validVolumes = [ "/nix" ];
           };
         };
       };
@@ -98,12 +96,6 @@ in
       };
     };
 
-    # Allow containers to make DNS queries (https://www.reddit.com/r/NixOS/comments/199f16j/why_dont_my_podman_containers_have_internet_access/)
-    networking.firewall.interfaces.podman4 = {
-      allowedTCPPorts = [ 53 ];
-      allowedUDPPorts = [ 53 ];
-    };
-
     systemd.services = {
       nginx.wants = [ config.systemd.services.forgejo.name ];
     } // lib.optionalAttrs (!cfg.autostart) { forgejo.wantedBy = lib.mkForce [ ]; };

nix-secrets

@@ -1 +1 @@
-Subproject commit 42ddf14d36d9fab1eb070f51fdf1991d1a21dde9
+Subproject commit f8a243d7e9db4689bcfc7726df75d5725daf4b60