Update to 24.11

2024-11-15 00:21:33 +01:00 · 2024-11-15 00:21:33 +01:00 · 5f3faa705f
commit 5f3faa705f
parent 9799e221a2
19 changed files with 91 additions and 173 deletions
--- a/flake.lock
+++ b/flake.lock
@ -203,16 +203,16 @@
        ]
      },
      "locked": {
-        "lastModified": 1726989464,
-        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
+        "lastModified": 1731832479,
+        "narHash": "sha256-icDDuYwJ0avTMZTxe1qyU/Baht5JOqw4pb5mWpR+hT0=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
+        "rev": "5056a1cf0ce7c2a08ab50713b6c4af77975f6111",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "master",
        "repo": "home-manager",
        "type": "github"
      }
@ -330,16 +330,16 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1731239293,
-        "narHash": "sha256-q2yjIWFFcTzp5REWQUOU9L6kHdCDmFDpqeix86SOvDc=",
+        "lastModified": 1731858824,
+        "narHash": "sha256-0KhJ6SOyWjx408tsgcoVQFx9nEn55DwrhFbCE49Oyac=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "9256f7c71a195ebe7a218043d9f93390d49e6884",
+        "rev": "7937932921ea34c51c1b586e2505574f6f0be5a7",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "release-24.11",
        "repo": "nixpkgs",
        "type": "github"
      }
--- a/flake.nix
+++ b/flake.nix
@ -10,7 +10,7 @@
    gomod2nix.url = "github:nix-community/gomod2nix";

    home-manager.inputs.nixpkgs.follows = "nixpkgs";
-    home-manager.url = "github:nix-community/home-manager/release-24.05";
+    home-manager.url = "github:nix-community/home-manager/master";

    krops.inputs.flake-utils.follows = "flake-utils";
    krops.inputs.nixpkgs.follows = "nixpkgs";
@ -24,7 +24,7 @@

    nixos-hardware.url = "github:nixos/nixos-hardware/master";

-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/release-24.11";

    nixpkgsMaster.url = "github:NixOS/nixpkgs/master";

--- a/hosts/aluminium/services/dyndns.nix
+++ b/hosts/aluminium/services/dyndns.nix
@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 {
  sops.secrets.duckdns-secret = {
    sopsFile = ../secrets.yaml;
@ -11,6 +11,14 @@
    username = "nouser";
    passwordFile = config.sops.secrets.duckdns-secret.path;
    domains = [ "jalr-k" ];
-    use = "if, if=ppp0";
+    usev4 = "ifv4, ifv4=ppp0";
+    package = pkgs.ddclient.overrideAttrs (p: rec {
+      nativeBuildInputs = p.nativeBuildInputs ++ [ pkgs.makeWrapper ];
+      wrapperPath = pkgs.lib.makeBinPath [ pkgs.iproute2 ];
+      postFixup = ''
+        wrapProgram $out/bin/ddclient \
+          --prefix PATH : "${wrapperPath}"
+      '';
+    });
  };
 }
--- a/hosts/aluminium/services/unifi-controller.nix
+++ b/hosts/aluminium/services/unifi-controller.nix
@ -7,6 +7,7 @@ in
  services.unifi = {
    enable = true;
    unifiPackage = pkgs.unifi8;
+    mongodbPackage = pkgs.mongodb-7_0;
  };
  networking.firewall.interfaces.lechner.allowedTCPPorts = [
    ports.unifi-inform.tcp
--- a/hosts/iron/configuration.nix
+++ b/hosts/iron/configuration.nix
@ -1,7 +1,6 @@
 { inputs, config, pkgs, lib, ... }:
 let
  interfaces = import ./interfaces.nix;
-  zfsKernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
  disks = [
    "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R103837K"
    "ata-Samsung_SSD_870_QVO_8TB_S5SSNG0R103838A"
@ -118,7 +117,6 @@ with lib; {
    '';

    boot = {
-      kernelPackages = zfsKernelPackages;
      kernel.sysctl = {
        "net.ipv6.conf.all.forwarding" = 1;
      };
--- a/hosts/iron/services/dyndns.nix
+++ b/hosts/iron/services/dyndns.nix
@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 let
  interfaces = import ../interfaces.nix;
 in
@ -14,7 +14,15 @@ in
    username = "nouser";
    passwordFile = config.sops.secrets.duckdns-secret.path;
    domains = [ "jalr-bw" ];
-    use = "if, if=${interfaces.wan}";
-    #usev6=ifv6, ifv6=enp3s4
+    usev4 = "ifv4, ifv4=${interfaces.wan}";
+    usev6 = "ifv6, ifv6=${interfaces.wan}";
+    package = pkgs.ddclient.overrideAttrs (p: rec {
+      nativeBuildInputs = p.nativeBuildInputs ++ [ pkgs.makeWrapper ];
+      wrapperPath = pkgs.lib.makeBinPath [ pkgs.iproute2 ];
+      postFixup = ''
+        wrapProgram $out/bin/ddclient \
+          --prefix PATH : "${wrapperPath}"
+      '';
+    });
  };
 }
--- a/hosts/iron/services/navidrome.nix
+++ b/hosts/iron/services/navidrome.nix
@ -18,14 +18,14 @@ let
    if [ -e "''$password_encryption_key_file" ]; then
      export ND_PASSWORDENCRYPTIONKEY="$(cat "''$password_encryption_key_file")"
    fi
-    exec ${pkgs.navidrome}/bin/navidrome --configfile ${configFile}
+    exec ${config.services.navidrome.package}/bin/navidrome --configfile ${configFile}
  '';
 in
 {
  services.navidrome.enable = true;
  systemd.services.navidrome = {
    serviceConfig = {
-      ExecStart = lib.mkForce "${utils.systemdUtils.lib.makeJobScript "navidrome-start" script} %d";
+      ExecStart = lib.mkForce "${pkgs.writeShellScript "navidrome-start" script} %d";
    } // lib.attrsets.optionalAttrs (passwordEncryptionKeyFile != null) {
      LoadCredential = "PasswordEncryptionKey:${passwordEncryptionKeyFile}";
    };
--- a/hosts/iron/services/radicale.nix
+++ b/hosts/iron/services/radicale.nix
@ -54,14 +54,5 @@ in
        level = "warning";
      };
    };
-    # Apply fix https://github.com/Kozea/Radicale/issues/1485
-    package = pkgs.radicale.overrideAttrs (p: {
-      src = pkgs.fetchFromGitHub {
-        owner = "Kozea";
-        repo = "Radicale";
-        rev = "5146537915f0cb397ae4ef53fe8a4f91fac5d972";
-        sha256 = "DRNiY665MHqmXAeGs39N3YfTAV0SEjzUNf3Nfk+kKvk=";
-      };
-    });
  };
 }
--- a/hosts/iron/services/unifi-controller.nix
+++ b/hosts/iron/services/unifi-controller.nix
@ -8,6 +8,7 @@ in
  services.unifi = {
    enable = true;
    unifiPackage = pkgs.unifi8;
+    mongodbPackage = pkgs.mongodb-7_0;
  };
  networking.firewall.interfaces."${interfaces.lan}".allowedTCPPorts = [
    ports.unifi-http.tcp
--- a/hosts/magnesium/configuration.nix
+++ b/hosts/magnesium/configuration.nix
@ -24,16 +24,14 @@
      ];
      routes = [
        {
-          routeConfig.Destination = "172.31.1.1";
+          Destination = "172.31.1.1";
        }
        {
-          routeConfig = {
-            Gateway = "172.31.1.1";
-            GatewayOnLink = true;
-          };
+          Gateway = "172.31.1.1";
+          GatewayOnLink = true;
        }
        {
-          routeConfig.Gateway = "fe80::1";
+          Gateway = "fe80::1";
        }
      ];
    };
--- a/hosts/magnesium/services/forgejo.nix
+++ b/hosts/magnesium/services/forgejo.nix
@ -12,7 +12,7 @@ in
  services.forgejo = {
    enable = true;
    lfs.enable = true;
-    mailerPasswordFile = config.sops.secrets.forgejo-mail.path;
+    secrets.mailer.PASSWD = config.sops.secrets.forgejo-mail.path;
    settings = {
      DEFAULT.APP_NAME = "jalr's git";
      avatar.DISABLE_GRAVATAR = true;
--- a/hosts/weinturm-pretix-prod/configuration.nix
+++ b/hosts/weinturm-pretix-prod/configuration.nix
@ -20,16 +20,14 @@
      ];
      routes = [
        {
-          routeConfig.Destination = "172.31.1.1";
+          Destination = "172.31.1.1";
        }
        {
-          routeConfig = {
-            Gateway = "172.31.1.1";
-            GatewayOnLink = true;
-          };
+          Gateway = "172.31.1.1";
+          GatewayOnLink = true;
        }
        {
-          routeConfig.Gateway = "fe80::1";
+          Gateway = "fe80::1";
        }
      ];
    };
--- a/modules/matrix/mautrix-signal.nix
+++ b/modules/matrix/mautrix-signal.nix
@ -4,133 +4,47 @@ let
  cfg = config.jalr.matrix;
  synapseCfg = config.services.matrix-synapse.settings;
  dataDir = "/var/lib/mautrix-signal";
-  registrationFile = "${dataDir}/signal-registration.yaml";
-  settings = {
-    homeserver = {
-      address = synapseCfg.public_baseurl;
-      domain = synapseCfg.server_name;
-    };
-    appservice = rec {
-      hostname = "127.0.0.1";
-      port = cfg.mautrix-signal.port;
-      address = "http://${hostname}:${toString port}";
-      provisioning.shared_secret = "disable";
-      database = "sqlite:///${dataDir}/mautrix-signal.db";
-    };
-    bridge = {
-      encryption = {
-        allow = true;
-        default = true;
-      };
-      verification_levels = {
-        receive = "cross-signed-tofu";
-        send = "cross-signed-tofu";
-        share = "cross-signed-tofu";
-      };
-    };
-    logging = {
-      version = 1;
-      min_level = "info";
-      writers = lib.singleton {
-        type = "stdout";
-        format = "pretty-colored";
-        time_format = " ";
-      };
-    };
-  } // cfg.mautrix-signal.settings;
-  settingsFormat = pkgs.formats.json { };
-  settingsFile = "${dataDir}/config.json";
-  settingsFileUnsubstituted =
-    settingsFormat.generate "mautrix-signal-config.json" settings;
 in
 lib.mkIf cfg.mautrix-signal.enable {
-  systemd.services.mautrix-signal = {
-    description = "mautrix-signal, A Matrix-Signal puppeting bridge.";
-    wantedBy = [ "multi-user.target" ];
-    wants = [ "network-online.target" ] ++ cfg.mautrix-signal.serviceDependencies;
-    after = [ "network-online.target" ] ++ cfg.mautrix-signal.serviceDependencies;
-
-    environment.HOME = dataDir;
-    preStart = ''
-      # substitute the settings file by environment variables
-      # in this case read from EnvironmentFile
-      test -f '${settingsFile}' && rm -f '${settingsFile}'
-      old_umask=$(umask)
-      umask 0177
-      ${pkgs.envsubst}/bin/envsubst \
-        -o '${settingsFile}' \
-        -i '${settingsFileUnsubstituted}'
-
-      cp '${settingsFile}' '${settingsFile}.tmp'
-      umask $old_umask
-
-      # generate the appservice's registration file if absent
-      if [ ! -f '${registrationFile}' ]; then
-        ${pkgs.mautrix-signal}/bin/mautrix-signal \
-          --generate-registration \
-          --config='${settingsFile}.tmp' \
-          --registration='${registrationFile}'
-      fi
-
-      umask 0177
-        ${pkgs.yq}/bin/yq -s '.[0].appservice.as_token = .[1].as_token
-          | .[0].appservice.hs_token = .[1].hs_token
-          | .[0]' '${settingsFile}' '${registrationFile}' \
-          > '${settingsFile}.tmp'
-      mv '${settingsFile}.tmp' '${settingsFile}'
-      umask $old_umask
-    '';
-    serviceConfig = {
-      Type = "exec";
-      User = "mautrix-signal";
-      #EnvironmentFile = cfg.environmentFile;
-      WorkingDirectory = dataDir;
-      StateDirectory = lib.mkIf (dataDir == "/var/lib/mautrix-signal") "mautrix-signal";
-      ExecStart = ''
-        ${pkgs.mautrix-signal}/bin/mautrix-signal \
-          --config='${settingsFile}' \
-          --no-update
-      '';
-      Restart = "on-failure";
-      RestartSec = "30s";
-
-      ReadWritePaths = dataDir;
-      NoNewPrivileges = true;
-      MemoryDenyWriteExecute = true;
-      PrivateDevices = true;
-      PrivateTmp = true;
-      #ProtectHome = true;
-      ProtectSystem = "strict";
-      ProtectControlGroups = true;
-      RestrictSUIDSGID = true;
-      RestrictRealtime = true;
-      LockPersonality = true;
-      ProtectKernelLogs = true;
-      ProtectKernelTunables = true;
-      ProtectHostname = true;
-      ProtectKernelModules = true;
-      PrivateUsers = true;
-      ProtectClock = true;
-      SystemCallArchitectures = "native";
-      SystemCallErrorNumber = "EPERM";
-      SystemCallFilter = "@system-service";
-    };
-    restartTriggers = [ settingsFileUnsubstituted ];
+  services.mautrix-signal = {
+    enable = true;
+    registerToSynapse = true;
+    settings = {
+      homeserver = {
+        address = synapseCfg.public_baseurl;
+        domain = synapseCfg.server_name;
+      };
+      appservice = rec {
+        hostname = "127.0.0.1";
+        port = cfg.mautrix-signal.port;
+        address = "http://${hostname}:${toString port}";
+        provisioning.shared_secret = "disable";
+        database = "sqlite:///${dataDir}/mautrix-signal.db";
+      };
+      bridge = {
+        encryption = {
+          allow = true;
+          default = true;
+        };
+        verification_levels = {
+          receive = "cross-signed-tofu";
+          send = "cross-signed-tofu";
+          share = "cross-signed-tofu";
+        };
+      };
+      logging = {
+        version = 1;
+        min_level = "info";
+        writers = lib.singleton {
+          type = "stdout";
+          format = "pretty-colored";
+          time_format = " ";
+        };
+      };
+    } // cfg.mautrix-signal.settings;
  };

-  users.users.mautrix-signal = {
-    isSystemUser = true;
-    group = "mautrix-signal";
-    home = dataDir;
-    description = "mautrix-signal bridge user";
-  };
-
-  users.groups.mautrix-signal = { };
-
  services.signald = {
    enable = true;
-    group = "mautrix-signal";
  };
-
-  jalr.matrix.synapse.app_service_config."mautrix-signal" = "/var/lib/mautrix-signal/signal-registration.yaml";
 }
--- a/modules/matrix/mautrix-whatsapp.nix
+++ b/modules/matrix/mautrix-whatsapp.nix
@ -7,6 +7,7 @@ in
 lib.mkIf cfg.mautrix-whatsapp.enable {
  services.mautrix-whatsapp = {
    enable = true;
+    registerToSynapse = true;
    settings = {
      homeserver = {
        address = synapseCfg.public_baseurl;
@ -50,6 +51,4 @@ lib.mkIf cfg.mautrix-whatsapp.enable {
      };
    } // cfg.mautrix-whatsapp.settings;
  };
-
-  jalr.matrix.synapse.app_service_config."mautrix-whatsapp" = "/var/lib/mautrix-whatsapp/whatsapp-registration.yaml";
 }
--- a/modules/nix.nix
+++ b/modules/nix.nix
@ -1,4 +1,4 @@
-{ config, lib, pkgs, inputs, system, ... }:
+{ lib, pkgs, inputs, system, ... }:

 {
  nix = {
@ -14,7 +14,6 @@
      experimental-features = [
        "nix-command"
        "flakes"
-        "repl-flake"
      ];
      trusted-users = [ "@wheel" ];
      auto-optimise-store = true;
@ -35,8 +34,12 @@

  systemd.services.nix-daemon.serviceConfig.OOMScoreAdjust = 250;

-  nixpkgs.overlays = with inputs; [
-    self.overlays.default
+  nixpkgs.config.permittedInsecurePackages = [
+    "olm-3.2.16"
+  ];
+
+  nixpkgs.overlays = [
+    inputs.self.overlays.default
    (final: prev: {
      master = import inputs.nixpkgsMaster {
        inherit system;
--- a/modules/pipewire.nix
+++ b/modules/pipewire.nix
@ -1,7 +1,6 @@
 { config, lib, pkgs, ... }:

 lib.mkIf config.jalr.gui.enable {
-  sound.enable = true;
  hardware.pulseaudio.enable = false;

  # FIXME
--- a/modules/sway.nix
+++ b/modules/sway.nix
@ -7,7 +7,7 @@ lib.mkIf (config.jalr.gui.enable && config.jalr.gui.desktop == "sway") {
    wrapperFeatures.gtk = true;
  };

-  hardware.opengl.enable = true;
+  hardware.graphics.enable = true;

  security.polkit.enable = true;

--- a/pkgs/fpvout/default.nix
+++ b/pkgs/fpvout/default.nix
@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
  nativeBuildInputs = with pkgs; [
    cmake
    pkg-config
-    libusb
+    libusb1
  ];

  installPhase = ''
--- a/users/jalr/modules/gui.nix
+++ b/users/jalr/modules/gui.nix
@ -15,7 +15,7 @@ lib.mkIf nixosConfig.jalr.gui.enable {
    streamlink
    supersonic-wayland
    vlc
-    xdg_utils
+    xdg-utils
  ];

  services.kanshi = {