feb2025 sprint

14 files changed, 186 insertions, 83 deletions

diff --git a/.gitignore b/.gitignore
index 9fd00ce..381b74d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
-result/
+result
+
 .direnv/
diff --git a/flake.nix b/flake.nix
index 1afc072..700f230 100644
--- a/flake.nix
+++ b/flake.nix
@@ -69,7 +69,7 @@
         lib = nixpkgs.lib;
       });
 
-      machines = filter (m: m != "iso" && m != "xnet")
+      machines = filter (m: m != "xnet")
         (attrNames (readDir ./machines));
     in
     {
diff --git a/machines/iridium/default.nix b/machines/iridium/default.nix
index b492f5b..7f3a272 100644
--- a/machines/iridium/default.nix
+++ b/machines/iridium/default.nix
@@ -1,20 +1,14 @@
-{ lib, inputs, depot, ... }:
+{ inputs, ... }:
 let
   inherit (inputs.nixos-hardware.nixosModules)
     common-cpu-intel
     common-gpu-intel
     ;
-
-  inherit (depot.users.kle)
-    gitKeys
-    ;
 in
 {
   system.stateVersion = "24.11";
   networking.hostName = "iridium";
 
-  users.users.root.initialPassword = "hello";
-
   imports = [ common-cpu-intel common-gpu-intel ];
 
   xnet = {
@@ -32,7 +26,6 @@ in
     gitServer = {
       enable = true;
       gitweb.enable = true;
-      keys = lib.splitString "\n" (builtins.readFile gitKeys);
     };
   };
 }
diff --git a/machines/radon/default.nix b/machines/radon/default.nix
index c87a3d3..e1a62e5 100644
--- a/machines/radon/default.nix
+++ b/machines/radon/default.nix
@@ -1,14 +1,15 @@
-{ lib, inputs, ... }:
+{ inputs, ... }:
 let
-  gitKeys = builtins.fetchurl {
-    url = "https://github.com/kbujari.keys";
-    sha256 = "1kskbiyqvjz1wsmcrgh9v0iryf33y70zk503z0m96wmzdjllmc94";
-  };
 
   inherit (inputs.nixos-hardware.nixosModules)
     common-cpu-intel
     common-gpu-intel
     ;
+
+  interfaces = {
+    bottom = "enp1s0";
+    top = "enp2s0";
+  };
 in
 {
   imports = [
@@ -21,7 +22,22 @@ in
   system.stateVersion = "24.11";
   networking.hostName = "radon";
 
-  users.users.root.initialPassword = "hello";
+  boot.kernel.sysctl = {
+    "net.ipv4.conf.all.forwarding" = true;
+    "net.ipv6.conf.all.forwarding" = true;
+  };
+
+  services.unbound.settings.server = {
+    interface = [ "10.88.88.2" ];
+    access-control = [
+      "10.88.88.0/24 allow"
+    ];
+  };
+
+  networking.firewall.interfaces.plaza = {
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 ];
+  };
 
   users.groups.media.gid = 2000;
 
@@ -37,14 +53,13 @@ in
     };
     net = {
       join = [ "plaza" ];
-      interface = "enp1s0";
+      interface = interfaces.bottom;
       sshd.enable = true;
     };
     nginx.enable = true;
     gitServer = {
       enable = true;
       gitweb.enable = true;
-      keys = lib.splitString "\n" (builtins.readFile gitKeys);
     };
   };
 }
diff --git a/machines/t1/default.nix b/machines/t1/default.nix
index 1a44b07..5a91816 100644
--- a/machines/t1/default.nix
+++ b/machines/t1/default.nix
@@ -14,6 +14,12 @@ in
     common-gpu-amd
   ];
 
+  programs.corectrl = {
+    enable = true;
+    gpuOverclock.enable = true;
+  };
+
+
   system.stateVersion = "24.11";
 
   users.users.kle = kle.nixos;
diff --git a/machines/t480/default.nix b/machines/t480/default.nix
index bfd695d..e726670 100644
--- a/machines/t480/default.nix
+++ b/machines/t480/default.nix
@@ -17,7 +17,6 @@ in
 
   xnet = {
     desktop.enable = true;
-    # users.enable = [ "kle" ];
     disk = {
       enable = true;
       device = "/dev/nvme0n1";
diff --git a/machines/xnet/default.nix b/machines/xnet/default.nix
index 138bd53..808bebc 100644
--- a/machines/xnet/default.nix
+++ b/machines/xnet/default.nix
@@ -1,6 +1,23 @@
-{ pkgs, lib, ... }:
+{ pkgs, lib, config, ... }:
 let
-  inherit (lib) mkDefault;
+  inherit (builtins)
+    fetchurl
+    filter
+    readFile
+    ;
+
+  inherit (lib)
+    mkDefault
+    mkOption
+    types
+    splitString
+    ;
+
+  gitKeys = fetchurl {
+    url = "https://github.com/kbujari.keys";
+    sha256 = "1kskbiyqvjz1wsmcrgh9v0iryf33y70zk503z0m96wmzdjllmc94";
+  };
+
 in
 {
   imports = [
@@ -13,67 +30,81 @@ in
     ./monitoring
   ];
 
-  i18n.defaultLocale = mkDefault "en_US.UTF-8";
-  time.timeZone = mkDefault "America/Toronto";
-
-  nix = {
-    settings = {
-      auto-optimise-store = true;
-      experimental-features = [ "nix-command" "flakes" ];
-      warn-dirty = false;
-
-      # timeout fast from binary cache
-      connect-timeout = 5;
-    };
-    gc = {
-      automatic = true;
-      options = mkDefault "--delete-older-than 30d";
+  options.xnet = {
+    pubKeys = mkOption {
+      type = types.listOf types.str;
+      default = filter (s: s != "")
+        (splitString "\n" (readFile gitKeys));
     };
   };
 
-  documentation = {
-    doc.enable = mkDefault false;
-    info.enable = mkDefault false;
-  };
+  config = {
+    i18n.defaultLocale = mkDefault "en_US.UTF-8";
+    time.timeZone = mkDefault "America/Toronto";
 
-  users.mutableUsers = false;
+    nix = {
+      settings = {
+        auto-optimise-store = true;
+        experimental-features = [ "nix-command" "flakes" ];
+        warn-dirty = false;
 
-  security.sudo = {
-    execWheelOnly = true;
-    extraConfig = "Defaults lecture = never";
-  };
+        # timeout fast from binary cache
+        connect-timeout = 5;
+      };
+      gc = {
+        automatic = true;
+        options = mkDefault "--delete-older-than 30d";
+      };
+    };
 
-  programs.ssh = {
-    knownHosts = {
-      "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
-      "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
-      "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
-      "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
+    documentation = {
+      doc.enable = mkDefault false;
+      info.enable = mkDefault false;
     };
-    extraConfig = ''
-      Host github
-        HostName github.com
-        User git
-        PreferredAuthentications publickey
 
-      Host ee
-        HostName pascal.ee.ryerson.ca
-        User kbujari
-    '';
-  };
+    users.mutableUsers = false;
+    users.users.root = {
+      openssh.authorizedKeys.keys = config.xnet.pubKeys;
+      initialPassword = "hello";
+    };
+
+    security.sudo = {
+      execWheelOnly = true;
+      extraConfig = "Defaults lecture = never";
+    };
+
+    programs.ssh = {
+      knownHosts = {
+        "github.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl";
+        "gitlab.com".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf";
+        "git.sr.ht".publicKey = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60";
+        "pascal.ee.ryerson.ca".publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc";
+      };
+      extraConfig = ''
+        Host github
+          HostName github.com
+          User git
+          PreferredAuthentications publickey
 
-  programs.git = {
-    enable = true;
-    config = {
-      init.defaultBranch = "master";
-      fetch.prune = true;
-      core.excludesFile = pkgs.writeText "gitignore" ''
-        # dev shell caching
-        .direnv/
-        .envrc
+        Host ee
+          HostName pascal.ee.ryerson.ca
+          User kbujari
       '';
-      push.default = "upstream";
-      push.autoSetupRemote = true;
+    };
+
+    programs.git = {
+      enable = true;
+      config = {
+        init.defaultBranch = "master";
+        fetch.prune = true;
+        core.excludesFile = pkgs.writeText "gitignore" ''
+          # dev shell caching
+          .direnv/
+          .envrc
+        '';
+        push.default = "upstream";
+        push.autoSetupRemote = true;
+      };
     };
   };
 }
diff --git a/machines/xnet/gitserver/default.nix b/machines/xnet/gitserver/default.nix
index da83f73..2152ebd 100644
--- a/machines/xnet/gitserver/default.nix
+++ b/machines/xnet/gitserver/default.nix
@@ -18,11 +18,6 @@ in
       default = "/persist/repo/git";
       description = "Directory where repos will be stored.";
     };
-
-    keys = mkOption {
-      type = types.listOf types.str;
-      description = "SSH public keys used for git operations.";
-    };
   };
 
   config = mkIf cfg.enable {
@@ -34,7 +29,7 @@ in
       homeMode = "755";
       createHome = true;
       shell = "${pkgs.git}/bin/git-shell";
-      openssh.authorizedKeys.keys = cfg.keys;
+      openssh.authorizedKeys.keys = config.xnet.pubKeys;
     };
 
     users.groups.git = { };
diff --git a/machines/xnet/net/default.nix b/machines/xnet/net/default.nix
index 9673792..8258ea6 100644
--- a/machines/xnet/net/default.nix
+++ b/machines/xnet/net/default.nix
@@ -59,6 +59,7 @@ in
 {
   imports = [
     ./sshd.nix
+    ./dns.nix
   ];
 
   options.xnet.net = {
@@ -76,6 +77,9 @@ in
   };
 
   config = mkIf ((length cfg.join) > 0) {
+    # networkd will handle this
+    networking.useDHCP = false;
+
     systemd.network =
       let
         name = config.networking.hostName;
diff --git a/machines/xnet/net/dns.nix b/machines/xnet/net/dns.nix
new file mode 100644
index 0000000..579d6aa
--- /dev/null
+++ b/machines/xnet/net/dns.nix
@@ -0,0 +1,39 @@
+{ ... }: {
+  services.resolved.enable = false;
+
+  services.unbound = {
+    enable = true;
+    settings.server = {
+      interface = [ "127.0.0.1" ];
+      access-control = [
+        "0.0.0.0/0 refuse"
+        "127.0.0.0/8 allow"
+      ];
+
+      private-domain = [ ];
+      private-address = [ ];
+
+      harden-glue = true;
+      harden-dnssec-stripped = true;
+      use-caps-for-id = false;
+      prefetch = true;
+      edns-buffer-size = 1232;
+      hide-identity = true;
+      hide-version = true;
+      tls-system-cert = true;
+    };
+
+    settings.forward-zone = [{
+      name = ".";
+      forward-tls-upstream = true;
+      forward-addr = [
+        "9.9.9.9#dns.quad9.net"
+        "149.112.112.112#dns.quad9.net"
+      ];
+    }];
+  };
+
+  networking = {
+    nameservers = [ "::1" ];
+  };
+}
diff --git a/machines/xnet/net/sshd.nix b/machines/xnet/net/sshd.nix
index b7cacc2..9d7976e 100644
--- a/machines/xnet/net/sshd.nix
+++ b/machines/xnet/net/sshd.nix
@@ -22,10 +22,10 @@ in
         type = "ed25519";
       }];
       settings = {
-        UsePAM = true;
+        UsePAM = false;
         X11Forwarding = false;
-        PermitRootLogin = "yes";
-        # PasswordAuthentication = false;
+        PermitRootLogin = "prohibit-password";
+        PasswordAuthentication = false;
         Ciphers = [ "chacha20-poly1305@openssh.com" ];
         Macs = [ "hmac-sha2-512-etm@openssh.com" ];
         KexAlgorithms = [ "curve25519-sha256@libssh.org" ];
diff --git a/mod/code/cses/problems/1071.cpp b/mod/code/cses/problems/1071.cpp
new file mode 100644
index 0000000..778cc86
--- /dev/null
+++ b/mod/code/cses/problems/1071.cpp
@@ -0,0 +1,19 @@
+#include <iostream>
+#include <tuple>
+#include <vector>
+
+using ull = unsigned long long;
+
+int main() {
+  int n;
+  std::cin >> n;
+
+  while (n--) {
+    ull x, y;
+    std::cin >> y >> x;
+
+    auto area = y * y;
+    auto perimeter = y + y + 1;
+    auto max = area + perimeter;
+  }
+}
diff --git a/mod/tools/typst/default.nix b/mod/tools/typst/default.nix
index 5f809d6..dc3eab2 100644
--- a/mod/tools/typst/default.nix
+++ b/mod/tools/typst/default.nix
@@ -28,6 +28,7 @@ in
       depotPackages
     ];
 
-    shellHook = "alias typst='export XDG_DATA_HOME=${depotPackages}/share:$XDG_DATA_HOME'";
+    # shellHook = "export TYPST_PACKAGE_PATH=${depotPackages}/share";
+    shellHook = "alias typst='XDG_DATA_HOME=${depotPackages}/share typst'";
   };
 }
diff --git a/mod/users/kle/default.nix b/mod/users/kle/default.nix
index 6f1cda2..d8fd3a2 100644
--- a/mod/users/kle/default.nix
+++ b/mod/users/kle/default.nix
@@ -28,7 +28,7 @@ in
     shell = pkgs.fish;
     home = "/persist/usr/kle";
     createHome = true;
-    extraGroups = [ "wheel" "users" "networkmanager" "video" ];
+    extraGroups = [ "wheel" "users" "networkmanager" "video" "corectrl" ];
     packages = with pkgs; [
       # utilities
       btop