fix acme on nixos-vps

flake.nix

@@ -174,36 +174,27 @@
 
     outputsBuilder = channels: let
       pkgs = channels.unstable;
-      # FIXME: nixos-rebuild with --flake flag doesn't work with doas
       rebuild = pkgs.writeShellScriptBin "rebuild" ''
         if [[ -z $1 ]]; then
           echo "Usage: $(basename $0) {switch|boot|test}"
         else
-          # doas nix-shell -p git --run "nixos-rebuild --flake . $@"
-          \sudo nixos-rebuild --flake . $@
+          doas nixos-rebuild --flake . $@
         fi
       '';
-      update-vscode = pkgs.writeShellScriptBin "update-vscode" ''
-        ./scripts/vscode_update_extensions.sh > ./profiles/applications/vscode/extensions.nix
-      '';
       upgrade = pkgs.writeShellScriptBin "upgrade" ''
         cp flake.lock flake.lock.bak && nix flake update
         if [[ "$1" == "zfs" ]]; then
           ./scripts/gen-patch-zen.sh
         fi
       '';
-      upgrade-hyprland = pkgs.writeShellScriptBin "upgrade-hyprland" ''
-        cp flake.lock flake.lock.bak
-        nix flake lock --update-input hyprland
-      '';
     in {
       devShells = {
         default = pkgs.mkShell {
           name = "aliases";
           packages = with pkgs; [
-            rebuild update-vscode upgrade upgrade-hyprland
-            nixfmt-rfc-style nixpkgs-fmt statix vulnix deadnix git deploy-rs
-            fup-repl ssh-to-pgp sops
+            rebuild upgrade
+            nixfmt-rfc-style nixpkgs-fmt statix vulnix
+            deadnix git deploy-rs fup-repl ssh-to-pgp sops
           ];
         };
         ci = pkgs.mkShell {

machines/Home-Hypervisor/backups.nix

@@ -23,9 +23,9 @@
           password-file = config.sops.secrets.rustic-nas-pass.path;
           options = {
             root = label;
-            bucket = "rustic-backups";
-            region = "de-fra";
-            endpoint = "https://c5c0.fra2.idrivee2-53.com";
+            bucket = "ataraxia-rustic-backups";
+            region = "eu-central-003";
+            endpoint = "https://s3.eu-central-003.backblazeb2.com";
           };
         };
         backup = {

machines/Home-Hypervisor/hardware-configuration.nix

@@ -54,8 +54,8 @@
     };
 
   fileSystems."/var/lib/podman" =
-    { device = "rpool/persistent/podman";
-      fsType = "zfs"; options = [ "zfsutil" "X-mount.mkdir" ];
+    { device = "/dev/zvol/rpool/vol/podman";
+      fsType = "xfs"; options = [ "X-mount.mkdir" ];
     };
 
   fileSystems."/var/lib/nixos-containers" =
@@ -103,7 +103,7 @@
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
     networking.hostId = "a9408846";
     boot.zfs.devNodes = "/dev/disk/by-id";
-    boot.supportedFilesystems = [ "zfs" ];
+    boot.supportedFilesystems = [ "xfs" "zfs" ];
     boot.initrd.luks.devices."cryptroot".device = "/dev/disk/by-partuuid/465cbfbb-73b8-4129-9904-9fabcc5db368";
     boot.initrd.luks.devices."cryptboot".device = "/dev/disk/by-partuuid/74f2b810-c7ff-471d-9829-7a3ef05c8c0e";
 }

machines/NixOS-VPS/services/backups.nix

@@ -22,9 +22,9 @@
           password-file = config.sops.secrets.rustic-vps-pass.path;
           options = {
             root = label;
-            bucket = "rustic-backups";
-            region = "de-fra";
-            endpoint = "https://c5c0.fra2.idrivee2-53.com";
+            bucket = "ataraxia-rustic-backups";
+            region = "eu-central-003";
+            endpoint = "https://s3.eu-central-003.backblazeb2.com";
           };
         };
         repository.options = {

machines/NixOS-VPS/services/synapse.nix

@@ -28,9 +28,12 @@ let
   ];
   cert-fqdn = "matrix.ataraxiadev.com";
 in {
-  imports = with inputs.self; [ customProfiles.acme ];
-  security.acme.certs = {
-    ${cert-fqdn} = {
+  security.acme = {
+    acceptTerms = true;
+    defaults.server = "https://acme-v02.api.letsencrypt.org/directory";
+    defaults.email = "admin@ataraxiadev.com";
+    defaults.renewInterval = "weekly";
+    certs.${cert-fqdn} = {
       webroot = "/var/lib/acme/acme-challenge";
       extraDomainNames = [
         "element.ataraxiadev.com"

modules/rustic-postgresql.nix

@@ -50,9 +50,9 @@ with lib;
               password-file = config.sops.secrets.rustic-postgresql-pass.path;
               options = {
                 root = backup.dbName;
-                bucket = "postgresql-backups";
-                region = "de-fra";
-                endpoint = "https://c5c0.fra2.idrivee2-53.com";
+                bucket = "ataraxia-postgresql-backups";
+                region = "eu-central-003";
+                endpoint = "https://s3.eu-central-003.backblazeb2.com";
               };
             };
             backup = {

profiles/security/vlock.nix

@@ -3,24 +3,6 @@
   security.sudo = {
     enable = true;
     extraRules = [{
-      users = [ config.mainuser ];
-      commands = [{
-        command = "/run/current-system/sw/bin/nixos-rebuild";
-        options = [ "SETENV" "NOPASSWD" ];
-      } {
-        command = "/run/current-system/sw/bin/nix";
-        options = [ "SETENV" "NOPASSWD" ];
-      } {
-        command = "/run/current-system/sw/bin/nix-shell";
-        options = [ "SETENV" "NOPASSWD" ];
-      } {
-        command = "/run/current-system/sw/bin/extra-container";
-        options = [ "SETENV" "NOPASSWD" ];
-      } {
-        command = "/run/current-system/sw/bin/chown ${config.mainuser} /tmp/.X11-unix";
-        options = [ "SETENV" "NOPASSWD" ];
-      }];
-    } {
       users = [ "deploy" ];
       commands = [{
         command = "ALL";
@@ -44,6 +26,11 @@
       noPass = true;
       keepEnv = true;
       cmd = "/run/current-system/sw/bin/tlp-stat";
+    } {
+      users = [ config.mainuser ];
+      noPass = true;
+      keepEnv = true;
+      cmd = "/run/current-system/sw/bin/nixos-rebuild";
     }];
   };
 }

profiles/servers/media-stack/default.nix

@@ -34,7 +34,6 @@ in {
       "${backend}-jackett.service"
       "${backend}-jellyfin.service"
       "${backend}-kavita.service"
-      "${backend}-kavitaemail.service"
       "${backend}-lidarr.service"
       "${backend}-medusa.service"
       "${backend}-qbittorrent.service"

profiles/servers/minio.nix

@@ -114,7 +114,7 @@ in {
         "obsidian-kpoxa"
       ]; in map (bucket: {
         source = "minio:${bucket}";
-        target = "idrive:minio-${bucket}";
+        target = "backblaze:ataraxia-minio-${bucket}";
       }) buckets;
   };
 }

profiles/workspace/git.nix

@@ -1,4 +1,7 @@
-{ config, ... }: {
+{ config, pkgs, ... }: let
+  git-conf = config.home-manager.users.${config.mainuser}.programs.git;
+in {
+  environment.systemPackages = [ git-conf.package pkgs.git-lfs ];
   home-manager.users.${config.mainuser} = {
     programs.git = {
       enable = true;

profiles/workspace/hyprland/default.nix

@@ -272,7 +272,7 @@ in with config.deviceSpecific; with lib; {
           windowrule=opaque,virt-manager
           windowrulev2=opaque,class:^(.*winbox64.exe)$
           windowrulev2=tile,class:^(.*winbox64.exe)$
-          windowrulev2=tile,class:^(starrail.exe)$
+          windowrulev2=opaque,class:^(starrail.exe)$
 
           windowrule=opaque,.*jellyfin.*
         '' ''

scripts/vscode_update_extensions.sh

@@ -1,90 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p curl jq unzip
-# shellcheck shell=bash
-set -eu -o pipefail
-
-# can be added to your configuration with the following command and snippet:
-# $ ./pkgs/applications/editors/vscode/extensions/update_installed_exts.sh > extensions.nix
-#
-# packages = with pkgs;
-#   (vscode-with-extensions.override {
-#     vscodeExtensions = map
-#       (extension: vscode-utils.buildVscodeMarketplaceExtension {
-#         mktplcRef = {
-#          inherit (extension) name publisher version sha256;
-#         };
-#       })
-#       (import ./extensions.nix).extensions;
-#   })
-# ]
-
-# Helper to just fail with a message and non-zero exit code.
-function fail() {
-    echo "$1" >&2
-    exit 1
-}
-
-# Helper to clean up after ourselves if we're killed by SIGINT.
-function clean_up() {
-    TDIR="${TMPDIR:-/tmp}"
-    echo "Script killed, cleaning up tmpdirs: $TDIR/vscode_exts_*" >&2
-    rm -Rf "$TDIR/vscode_exts_*"
-}
-
-function get_vsixpkg() {
-    N="$1.$2"
-
-    # Create a tempdir for the extension download.
-    EXTTMP=$(mktemp -d -t vscode_exts_XXXXXXXX)
-
-    URL="https://$1.gallery.vsassets.io/_apis/public/gallery/publisher/$1/extension/$2/latest/assetbyname/Microsoft.VisualStudio.Services.VSIXPackage"
-
-    # Quietly but delicately curl down the file, blowing up at the first sign of trouble.
-    curl --silent --show-error --retry 3 --fail -X GET -o "$EXTTMP/$N.zip" "$URL"
-    # Unpack the file we need to stdout then pull out the version
-    VER=$(jq -r '.version' <(unzip -qc "$EXTTMP/$N.zip" "extension/package.json"))
-    # Calculate the SHA
-    SHA=$(nix-hash --flat --base32 --type sha256 "$EXTTMP/$N.zip")
-
-    # Clean up.
-    rm -Rf "$EXTTMP"
-    # I don't like 'rm -Rf' lurking in my scripts but this seems appropriate.
-
-    cat <<-EOF
-  {
-    name = "$2";
-    publisher = "$1";
-    version = "$VER";
-    sha256 = "$SHA";
-  }
-EOF
-}
-
-# See if we can find our `code` binary somewhere.
-if [ $# -ne 0 ]; then
-    CODE=$1
-else
-    CODE=$(command -v code || command -v codium)
-fi
-
-if [ -z "$CODE" ]; then
-    # Not much point continuing.
-    fail "VSCode executable not found"
-fi
-
-# Try to be a good citizen and clean up after ourselves if we're killed.
-trap clean_up SIGINT
-
-# Begin the printing of the nix expression that will house the list of extensions.
-printf '{ extensions = [\n'
-
-# Note that we are only looking to update extensions that are already installed.
-for i in $($CODE --list-extensions)
-do
-    OWNER=$(echo "$i" | cut -d. -f1)
-    EXT=$(echo "$i" | cut -d. -f2)
-
-    get_vsixpkg "$OWNER" "$EXT"
-done
-# Close off the nix expression.
-printf '];\n}'

secrets/rustic.yaml

@@ -1,20 +1,18 @@
-rustic-backups-s3-env: ENC[AES256_GCM,data:XrZoIYUauOwK/YNItn7OziLEBYXXekgOE3nVLJjzMc7k698uZcYvRHEfQCq5lvH/110BIL11AJumQcfBnG6lYTqjBs56vlJvbh7olsNACX5ZyDR/qYXkfSqcO61JfZufQVAvlag=,iv:Wx5xBQdDRolB6NsuoDlw1JGYk5YrG28unblo8hDea14=,tag:++cKr0a4Ep4mbENVaA3P3A==,type:str]
-rustic-postgresql-s3-env: ENC[AES256_GCM,data:Jdfx3PT4cXMyZTJBXOp/bBcD5QBPucTONT2WctGSIUUGKz/OKb+U8OX9FKTmXlWHiXZctMMj2NJkuueihsJHFmcDPZT5lmh8Y0E4j0sB6anUHcPEJyXfl1TAIteErsmeu90Lsy4=,iv:ugQXfGMjiwX4s1GFHhW0R9vPRmWUELmMiUOQGPWqidI=,tag:DcVQCKHskliy9itMMT3ZAA==,type:str]
-rclone-rustic-backups: ENC[AES256_GCM,data:78Ch7VVk/9rPy8pTQCTmuSSXWVKlNwlaTxnrM4yBi8/AQ6B4QJYQr1ibtxbgFs4aGHMddJbARLILT9afzXVF3dwyZ5490v8b+6NmGQ/ECdLpQ3LUGWzQHSkTQRib8s2ks2v3XC7AAzUr4hNdXHxL4/11WrKIL5wJyn2YP/KngQoIjijkpzoAoKZgr9cTZDSQ3FsnDv6WlQ4lTneRSkssFmHrytgFWEj/EXTqeZo5/2E7GrqFC161iO/p6+ZM9dNFoSsLxj4SI5gF2HsUChZbDfMyMdzYCHTt,iv:a1Vgs89rKIDJ//CCN94F3rzUSBtbrBB9fB8nZpFacTg=,tag:Y4QA6YKOUAWN5uhnG2C95Q==,type:str]
-rclone-postgresql-backups: ENC[AES256_GCM,data:rEINBfZezX3YSfQQhYm9JsgHOZE4c4us3dl5FvgZv2L+uIsoVVSNt0gr6My/nk19hL7IGY1I7ab2YgEwKE3w4rV3wpZ6+lCAucNM2YvGXWoqpvOvhH0YGfASA7yOSDaLZ69zL07UGX0WK2Z2dDrLOEz8NJsPbOn55XvDXVwjtR1o3R7j7bLKUHgcm8S/JGF0IQXvJWBN/WQzF66rFjNf0SxReEfa/mYLr3w+qdBpRVsZ3yiXQrvFUWj9GNS3FYfG6wro5SLGLuX7hDkGE+KiKv7j0cuMkphlQu0IyQ==,iv:NodSsCEPz6dMfSbHKE3sIfehaZ7cD3tq3gVtTceHmrg=,tag:lBDzO4QmOGyUBX5aAm2TYA==,type:str]
+rustic-backups-s3-env: ENC[AES256_GCM,data:XTUTtAmjBiy5mdlwT53Z9IDycs0s069182Emd0M6TSpPScqce3kxoN+hH8vgaOLU0b1jF3d9pkO0PpwfnUr2IkMpTd7ZKHeqHbYzS4gpKFnkQMhDexHLFBrQIfBrTbCGzspl83q5ksU9ENuY+sdkKXBhn99ja2mAFdfOVyNRttVNwKuv5/e8Bh0ySyTkogOgLyttLWo+pqKuvBP96BvSLOiGqfYBMgZU6uncg4YbdmOWPnvnTRPWHwIAyyXOSv56Sw36XfBkCBhZk2fmDRVJyRkuFthkhb6b2LkxhWFofilJupGTaQUHuZ3Efq9+eS5n1zOnudL7Gp7MmaQ4Hz3tQnzML16pJW1UcyT11uvWl8Zz5h+VlwJAfM7VNVaOs2FjEEy5imcUWurhIgRcrKHYc3mKNk5XYuvCI93aX9/LKEyeGQ==,iv:sPwKIYu/RyZQHYmz7aSYFhmx2ZqlH+RHRbdkOHGCa1s=,tag:eD5vRFkwEw4i97UQyRk6Hw==,type:str]
+rustic-postgresql-s3-env: ENC[AES256_GCM,data:m0G4G+i3fJo34rUGnQ0HOsA1GlOpLnJXDJltXFM5URUFaK1Jh5pGnOsYAiU2410enKafdf5eneW31j9r2GWmEFOoX89+yLmQxe22YnfLcFfaBdskVeaz/6HY2FK5euwdy70ZPNb05uYaS1QXPABJCS8p2APjx9bcz4MPSGgN6Ed/h7NdEU1FXgEfQZj9cysoVN9Qf3zYP4oqTBFVq11bV1yj0dsBMxHmY92aAdwUJWqjk4w2vi90zYxWNYk5PzNCh7qURtfmfNTHfEy55umbDayWjxZAsNgGOtxUsArUNSIU12GeBx7VCxepbNbDiej9fNnNqYvYnRspscag5w0oHSPa8a/qPY+R/imKqLU15xCG2EfnBm310zPyI9o/lgiU9Ua8z4cfuU5FcKr7ICIr5OdupiWy6aC1KYhkBZVViXEz3A==,iv:Hu9Bbynj5D9k2Rj0NWYZuuHQzcrauGyMmPex+T+VKIg=,tag:IAXAGK//SW890ZBKkUr8gw==,type:str]
 rustic-nas-pass: ENC[AES256_GCM,data:uDiQQRxlpBfbwihXDR32aGjP41iZ,iv:qx6FJEllahkP9BPYFFfv9LHnnVTOl6B7Jv9OSfNkPok=,tag:MBUT77ccG/acr/U/X2zrCA==,type:str]
 rustic-vps-pass: ENC[AES256_GCM,data:LMdVK6j/TV9JLAxwWUtIfF//nf6r,iv:PjOYcNeLjlRx6uoZo+jr0oA9N60NJNNPloc9fc44raw=,tag:AjOzsfVIhDCb5a5D3yIdUA==,type:str]
 rustic-postgresql-pass: ENC[AES256_GCM,data:oUHakvIPSwkNy1lkQ4k14+CWIofO,iv:v3EFeZCkFyeY/ADK8vqYvAD0XDmnQFIq6XGd9B8jvXY=,tag:6+kGWMq+9iVLSf5p/TIp8g==,type:str]
 rustic-minio-secret-key: ENC[AES256_GCM,data:Jkn0mHcLFWS/euPCYtEF3hXN4Jx8PHZHA3RtZiMshuZdZTv0Y+tHteZB2i27Ka+u,iv:R2FEEhe+EoqFDQYbLJ3hrb+ENVvsP2c++WA0z3QQrxA=,tag:bifjyNyNouUhFGV6SpAg7Q==,type:str]
-rclone-s3-sync: ENC[AES256_GCM,data:xM7ufaVNhuLPKCU1XYCA7PGinrkPLeTYSH6zx1di6/Vnq8YjgD6X2F3SUxX/zi0LAe0y5SuP0QpOkPq9jF1wnuKojPRK4xOqurURdIztQnDtF1CP3slWzx5CjDYLdkPWpOm6LWuMA+84ghxfFjA/mb4hbpg8W90avrYd+8uyOYIiHxFSC27n6kuIRjWERxgcVth+8tK2gSyEC3Y2P+jodA1Yqxt++exFMaM53KDhFE9W5Z9uBOZTFI0CeRHkJWOnbRw6ArtAm8XuWaRCvbLf0PCr4ULdzO+POpebSI3F9HK983omaCYbqm37Cnvn7EFECatMLLcx3EHBNXHkzDGEDosUAp2HCB1dFiL2H444SIxDLcA9uqgsts8VfwbHbmy1Nh2jJ7nUhykPbmg17FWlXwGJoY9izLP/jbuGroiBgEPliorbvzYwxybudDJsamvdO9XDdqUIblHlXyWZLqNl2d7PS4Gom6YZ6Xdkf8Ffpq87EUOWC+Ey7q2rOsnwatANyjDIKQB2fMZ5zIYPntOBJ4tsjPqVvjXLA7O/bRjmD9Acy2OPyiXtw7mwtT32upUyZxHpCjp1zIYM,iv:2pXnmuz+Lrv/7p6CsqAElRovFdERV03VMA+X7vQF+Gw=,tag:mZbTfZRih4inCGrHdeH6EQ==,type:str]
+rclone-s3-sync: ENC[AES256_GCM,data:oBDntYhuThzmImRgpBSsgqDwXs4+wJxAOZKH3vlKfH+9CXYNI1ks92t8Ywr/wltikvXiVbKuztY7Iuqe4Mkl0K9onYYcmrMDqyuLXRV/WPXNaAwyOyFUS17dxcqoyG51T0zzb1l4LH+GTrLw7m7RD7y7XFU/uidAUuBnQHAQpu8xRI/5PLcSaae+KfmoJGpZBX4BawXMHzRKKo462Muw/1FbBQpC0ERvTd34oSke32+Ni3MNdg/nOVyczYIQ+TPNhtgiSNXFJFPaXWMrIh29jhyJv7M2k4nYzNzb3A2miGCxWRDNy7bxZTDeVLgJUZT3KJNyb8BGLhu2v54WSbm01I1pP+//xYSZI0JER4fCZpdGodr2TV6u7YOyVxa1pZ7C7O9T/dd2O9NbgQY1Azc9MhiIXZnT58j72SNvhDNtCloM50R0LYmagCj2alP3Z4W7L+BdtaU58hWFCM2P8EIYbPkz8wK4/i1XARvZU9i+cRWZCoKi+yi0cV2yKOYlFEW0RmO9G3rC6a31YITwfpHhQw9IFuZXwdwZdf4OIuw12BIXfeUQJWqIl4QRSnOSzCggSZngwhoq/r46Oh2Jn9xXuVO6Hlod8pGyxKovO9bGQl3ioIU/KAhKp88k/BDS7YM4HhAEPNjvsSZgRGf21G7Z4ypi6a2grMTGgIKbOA3KEe2CKrSEVq7JRF5m1uAPJ2zrgbBrSwI0qkhGfn+SERMVtyzkIvTQkEQJ/g==,iv:jWhHLIccl1Pgr55xEMd2ED8FS3pvRjnuugMJ0sHnuW4=,tag:upgyBz2AA2zhidFIkcVrpw==,type:str]
 sops:
     kms: []
     gcp_kms: []
     azure_kv: []
     hc_vault: []
     age: []
-    lastmodified: "2024-02-04T12:24:39Z"
-    mac: ENC[AES256_GCM,data:frEvsfMhwVE6cusyS5hc3IAopdqGjooiPwbPbYEgUTiu4xRSqdkf0g4Ue9m3oK/zfm7gxRsvf+7HQ25J4bChhwOU6QGHzpVozpaipc0gS1Bxut4QfSytKM6fnkKJcn3nkMudosjBmPTU51AFqziFQmV5OMaeuiqipin31nWyZKk=,iv:ZcTBndDwp86X2VMQ3Y3Rk0KYHtzuK+ZRmAxs7Y2cyU8=,tag:mXoy18OqrLrg2KiUvw7QjQ==,type:str]
+    lastmodified: "2024-02-13T18:54:38Z"
+    mac: ENC[AES256_GCM,data:dfaHOR6j9haR9MofGrfeHpIK9+wXbEYG9O2R8258ifncOPrAFHggHUxdgeX5L7wSQ2IUuTw11FzbFiNSAT0sH9nIXwPLtO1N4MJAzC/XE1e5b2ZIBVTmJAAL3wH0dKpLExA1kMGRrLmTcIGUiGTDwgn86wxlUf92bAA/oycb5cQ=,iv:mwtkiGzOJTobMPLxsGtEIzDjmAR+4Forvg5KFFnmpCk=,tag:fR+8skvaHBKnwZ0tXigodw==,type:str]
     pgp:
         - created_at: "2024-02-06T20:12:53Z"
           enc: |-