From 4bb587f713ddf8d8c6b9e6325e2346d81d67c0fb Mon Sep 17 00:00:00 2001
From: Kleidi Bujari <mail@4kb.net>
Date: Sat, 5 Sep 2026 13:32:08 -0700
Subject: [xnet/gitweb] enable source and about filter

---
 modules/xnet/gitserver/gitweb.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'modules/xnet/gitserver')

diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix
index a9ed7d9..b52b8fc 100644
--- a/modules/xnet/gitserver/gitweb.nix
+++ b/modules/xnet/gitserver/gitweb.nix
@@ -46,8 +46,8 @@ in
         readme=:README.txt
       '';
       settings = {
-        # about-filter = "${pkgs.cgit-pink}/lib/cgit/filters/about-formatting.sh";
-        # source-filter = "${pkgs.cgit-pink}/lib/cgit/filters/syntax-highlighting.py";
+        about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
+        source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
         clone-url = "https://${cfg.hostName}/$CGIT_REPO_URL git@${cfg.hostName}:$CGIT_REPO_URL";
         enable-commit-graph = true;
         enable-http-clone = false;
-- 
cgit v1.3.1


From 811dd787c3f9a6caa7cf0ae4f34d8ae216e3c26d Mon Sep 17 00:00:00 2001
From: Kleidi Bujari <mail@4kb.net>
Date: Sat, 26 Sep 2026 19:45:48 -0700
Subject: [xnet/gitserver] deny bots by default

---
 modules/xnet/gitserver/gitweb.nix | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

(limited to 'modules/xnet/gitserver')

diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix
index b52b8fc..9b3435a 100644
--- a/modules/xnet/gitserver/gitweb.nix
+++ b/modules/xnet/gitserver/gitweb.nix
@@ -38,12 +38,7 @@ in
         mimetype.pdf=application/pdf
         mimetype.png=image/png
         mimetype.svg=image/svg+xml
-        readme=:readme
-        readme=:readme.md
-        readme=:readme.txt
-        readme=:README
-        readme=:README.md
-        readme=:README.txt
+        readme=master:README
       '';
       settings = {
         about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh";
@@ -62,9 +57,11 @@ in
       };
     };
 
-    # services.nginx.virtualHosts."${cfg.gitweb.hostName}" = {
-    #   useACMEHost = "4kb.net";
-    #   addSSL = true;
-    # };
+    services.nginx.virtualHosts."${cfg.hostName}" = {
+      useACMEHost = "4kb.net";
+      forceSSL = true;
+
+      locations."/robots.txt".return = "200 \"User-agent: *\nDisallow: /\n\"";
+    };
   };
 }
-- 
cgit v1.3.1


From 0d15a4d19f7925be328c2d24214a11e5ac541c40 Mon Sep 17 00:00:00 2001
From: Kleidi Bujari <mail@4kb.net>
Date: Sat, 3 Oct 2026 19:56:13 -0700
Subject: nixfmt formatting pass

---
 lib/depot-tools.nix                 | 68 ++++++++++++++-------------
 machines/feneri.nix                 |  5 +-
 machines/iso.nix                    |  5 +-
 machines/natest.nix                 | 92 ++++++++++++++++++++-----------------
 machines/radon/default.nix          |  8 +++-
 machines/radon/pxeboot.nix          | 52 +++++++++++++--------
 modules/xnet/disk.nix               | 34 ++++++++++----
 modules/xnet/gitserver/default.nix  |  7 ++-
 modules/xnet/gitserver/gitweb.nix   |  7 ++-
 modules/xnet/monitoring/default.nix | 37 +++++++++------
 modules/xnet/monitoring/grafana.nix | 33 ++++++++-----
 modules/xnet/nginx.nix              |  5 +-
 modules/xnet/persist.nix            | 59 +++++++++++++-----------
 packages/randpass.nix               |  3 +-
 14 files changed, 255 insertions(+), 160 deletions(-)

(limited to 'modules/xnet/gitserver')

diff --git a/lib/depot-tools.nix b/lib/depot-tools.nix
index 7c2fc6b..8e5a16e 100644
--- a/lib/depot-tools.nix
+++ b/lib/depot-tools.nix
@@ -1,7 +1,8 @@
-{ inputs
-, systems
-, nixpkgs ? inputs.nixpkgs
-, ...
+{
+  inputs,
+  systems,
+  nixpkgs ? inputs.nixpkgs,
+  ...
 }:
 
 let
@@ -27,30 +28,25 @@ let
 
       # Get paths to directories
       onlyDirs = filterAttrs (_name: type: type == "directory") entries;
-      dirPaths = mapAttrs
-        (name: type: {
-          path = path + "/${name}";
-          inherit type;
-        })
-        onlyDirs;
+      dirPaths = mapAttrs (name: type: {
+        path = path + "/${name}";
+        inherit type;
+      }) onlyDirs;
 
       # Get paths to nix files, where the name is the basename of the file without the .nix extension
-      nixPaths = removeAttrs
-        (mapAttrs'
-          (
-            name: type:
-              let
-                nixName = match "(.*)\\.nix" name;
-              in
-              {
-                name = if type == "directory" || nixName == null then "__junk" else (head nixName);
-                value = {
-                  path = path + "/${name}";
-                  type = type;
-                };
-              }
-          )
-          entries) [ "__junk" ];
+      nixPaths = removeAttrs (mapAttrs' (
+        name: type:
+        let
+          nixName = match "(.*)\\.nix" name;
+        in
+        {
+          name = if type == "directory" || nixName == null then "__junk" else (head nixName);
+          value = {
+            path = path + "/${name}";
+            type = type;
+          };
+        }
+      ) entries) [ "__junk" ];
 
       combined = dirPaths // nixPaths;
     in
@@ -61,9 +57,9 @@ let
     system:
     let
       # Resolve the packages for each input.
-      perSystem = mapAttrs
-        (_: flake: flake.legacyPackages.${system} or { } // flake.packages.${system} or { })
-        inputs;
+      perSystem = mapAttrs (
+        _: flake: flake.legacyPackages.${system} or { } // flake.packages.${system} or { }
+      ) inputs;
 
       # Handle nixpkgs specially.
       pkgs =
@@ -78,7 +74,17 @@ let
 
       flake = inputs.self;
     in
-    makeScope callPackageWith (_: { inherit inputs perSystem flake pkgs system; })
+    makeScope callPackageWith (_: {
+      inherit
+        inputs
+        perSystem
+        flake
+        pkgs
+        system
+        ;
+    })
   );
 in
-{ inherit importDir systemArgs; }
+{
+  inherit importDir systemArgs;
+}
diff --git a/machines/feneri.nix b/machines/feneri.nix
index a638642..e75738b 100644
--- a/machines/feneri.nix
+++ b/machines/feneri.nix
@@ -35,7 +35,10 @@
     certs."4kb.net" = {
       dnsProvider = "porkbun";
       environmentFile = "/var/secrets/porkbun";
-      extraDomainNames = [ "*.4kb.net" "*.web.4kb.net" ];
+      extraDomainNames = [
+        "*.4kb.net"
+        "*.web.4kb.net"
+      ];
       group = "nginx";
       reloadServices = [ "nginx.service" ];
     };
diff --git a/machines/iso.nix b/machines/iso.nix
index d3ca992..5550841 100644
--- a/machines/iso.nix
+++ b/machines/iso.nix
@@ -6,7 +6,10 @@
 
   nixpkgs.hostPlatform.system = "x86_64-linux";
   nix.settings = {
-    experimental-features = [ "nix-command" "flakes" ];
+    experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
   };
 
   environment.systemPackages = with pkgs; [
diff --git a/machines/natest.nix b/machines/natest.nix
index fa8f1d5..c4937d6 100644
--- a/machines/natest.nix
+++ b/machines/natest.nix
@@ -1,4 +1,10 @@
-{ config, modulesPath, pkgs, lib, ... }:
+{
+  config,
+  modulesPath,
+  pkgs,
+  lib,
+  ...
+}:
 
 {
   imports = [
@@ -19,7 +25,11 @@
   fileSystems = {
     "/" = {
       fsType = "tmpfs";
-      options = [ "defaults" "mode=755" "size=2G" ];
+      options = [
+        "defaults"
+        "mode=755"
+        "size=2G"
+      ];
     };
     "/boot" = {
       device = "/dev/disk/by-partlabel/boot";
@@ -43,54 +53,52 @@
     let
       inherit (pkgs.stdenv.hostPlatform) efiArch;
     in
-      {
-        name = "image";
-        partitions.esp = {
-          repartConfig = {
-            Format = "vfat";
-            Label = "boot";
-            SizeMinBytes = "256M";
-            Type = "esp";
-          };
-          contents = {
-            "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
-              "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+    {
+      name = "image";
+      partitions.esp = {
+        repartConfig = {
+          Format = "vfat";
+          Label = "boot";
+          SizeMinBytes = "256M";
+          Type = "esp";
+        };
+        contents = {
+          "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source =
+            "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
 
-            # "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
-            #   "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
+          # "/EFI/Linux/${config.system.boot.loader.ukiFile}".source =
+          #   "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
 
-            "/EFI/nixos/${config.system.boot.loader.kernelFile}.efi".source =
-              "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}";
+          "/EFI/nixos/${config.system.boot.loader.kernelFile}.efi".source =
+            "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}";
 
-            "/EFI/nixos/${config.system.boot.loader.initrdFile}.efi".source =
-              "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
+          "/EFI/nixos/${config.system.boot.loader.initrdFile}.efi".source =
+            "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
 
-            "/loader/entries/nixos.conf".source =
-              pkgs.writeText "default-entry.conf" ''
-                title Coolio
-                linux /EFI/nixos/${config.system.boot.loader.kernelFile}.efi
-                initrd /EFI/nixos/${config.system.boot.loader.initrdFile}.efi
-                options init=${config.system.build.toplevel}/init root=fstab loglevel=4
-              '';
+          "/loader/entries/nixos.conf".source = pkgs.writeText "default-entry.conf" ''
+            title Coolio
+            linux /EFI/nixos/${config.system.boot.loader.kernelFile}.efi
+            initrd /EFI/nixos/${config.system.boot.loader.initrdFile}.efi
+            options init=${config.system.build.toplevel}/init root=fstab loglevel=4
+          '';
 
-            "/loader/loader.conf".source =
-              pkgs.writeText "loader.conf" ''
-                timeout 5
-                console-mode keep
-              '';
-          };
+          "/loader/loader.conf".source = pkgs.writeText "loader.conf" ''
+            timeout 5
+            console-mode keep
+          '';
         };
-        partitions.nix-store = {
-          storePaths = [ config.system.build.toplevel ];
-          nixStorePrefix = "/";
-          repartConfig = {
-            Format = "ext4";
-            Label = "nix-store";
-            SizeMinBytes = "4G";
-            Type = "linux-generic";
-          };
+      };
+      partitions.nix-store = {
+        storePaths = [ config.system.build.toplevel ];
+        nixStorePrefix = "/";
+        repartConfig = {
+          Format = "ext4";
+          Label = "nix-store";
+          SizeMinBytes = "4G";
+          Type = "linux-generic";
         };
       };
+    };
 
   boot.loader.systemd-boot = {
     enable = true;
diff --git a/machines/radon/default.nix b/machines/radon/default.nix
index c77db03..f3e4ff0 100644
--- a/machines/radon/default.nix
+++ b/machines/radon/default.nix
@@ -1,4 +1,10 @@
-{ inputs, flake, pkgs, config, ... }:
+{
+  inputs,
+  flake,
+  pkgs,
+  config,
+  ...
+}:
 let
   interfaces = {
     bottom = "enp1s0";
diff --git a/machines/radon/pxeboot.nix b/machines/radon/pxeboot.nix
index 4655990..0b5df13 100644
--- a/machines/radon/pxeboot.nix
+++ b/machines/radon/pxeboot.nix
@@ -3,30 +3,42 @@ let
   installer = lib.nixosSystem {
     system = "x86_64-linux";
     modules = [
-      ({ config, pkgs, lib, modulesPath, ... }: {
-        imports = [
-          (modulesPath + "/installer/netboot/netboot-minimal.nix")
-          (modulesPath + "/installer/cd-dvd/channel.nix")
-        ];
+      (
+        {
+          config,
+          pkgs,
+          lib,
+          modulesPath,
+          ...
+        }:
+        {
+          imports = [
+            (modulesPath + "/installer/netboot/netboot-minimal.nix")
+            (modulesPath + "/installer/cd-dvd/channel.nix")
+          ];
 
-        services.openssh = {
-          enable = true;
-          openFirewall = true;
-          settings = {
-            PasswordAuthentication = false;
-            KbdInteractiveAuthentication = false;
+          services.openssh = {
+            enable = true;
+            openFirewall = true;
+            settings = {
+              PasswordAuthentication = false;
+              KbdInteractiveAuthentication = false;
+            };
           };
-        };
 
-        nix.settings = {
-          experimental-features = [ "nix-command" "flakes" ];
-        };
+          nix.settings = {
+            experimental-features = [
+              "nix-command"
+              "flakes"
+            ];
+          };
 
-        users.users.root.openssh.authorizedKeys.keys = [
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9"
-          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd"
-        ];
-      })
+          users.users.root.openssh.authorizedKeys.keys = [
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9"
+            "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd"
+          ];
+        }
+      )
     ];
   };
 
diff --git a/modules/xnet/disk.nix b/modules/xnet/disk.nix
index 82e9c87..e6835f4 100644
--- a/modules/xnet/disk.nix
+++ b/modules/xnet/disk.nix
@@ -1,4 +1,9 @@
-{ config, lib, modulesPath, inputs, ... }:
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
 let
   cfg = config.xnet.disk;
   commonOpts = {
@@ -11,12 +16,16 @@ let
     "com.sun:auto-snapshot" = "false";
   };
 
-  inherit (lib) mkOption mkDefault mkIf types;
+  inherit (lib)
+    mkOption
+    mkDefault
+    mkIf
+    types
+    ;
 in
 {
   imports = [
     (modulesPath + "/installer/scan/not-detected.nix")
-    inputs.disko.nixosModules.default
   ];
 
   options.xnet.disk = {
@@ -33,8 +42,7 @@ in
   };
 
   config = mkIf cfg.enable {
-    networking.hostId = builtins.substring 0 8
-      (builtins.hashString "md5" config.networking.hostName);
+    networking.hostId = builtins.substring 0 8 (builtins.hashString "md5" config.networking.hostName);
 
     services.zfs = {
       autoScrub.enable = true;
@@ -46,8 +54,14 @@ in
     zramSwap.enable = mkDefault true;
 
     boot = {
-      kernelParams = [ "nohibernate" "elevator=none" ];
-      supportedFilesystems = [ "vfat" "zfs" ];
+      kernelParams = [
+        "nohibernate"
+        "elevator=none"
+      ];
+      supportedFilesystems = [
+        "vfat"
+        "zfs"
+      ];
       zfs.devNodes = mkDefault "/dev/disk/by-partuuid";
       loader = {
         systemd-boot.enable = true;
@@ -94,7 +108,11 @@ in
     disko.devices = {
       nodev."/" = {
         fsType = "tmpfs";
-        mountOptions = [ "defaults" "size=2G" "mode=755" ];
+        mountOptions = [
+          "defaults"
+          "size=2G"
+          "mode=755"
+        ];
       };
 
       zpool.zroot = {
diff --git a/modules/xnet/gitserver/default.nix b/modules/xnet/gitserver/default.nix
index 2152ebd..2bd471a 100644
--- a/modules/xnet/gitserver/default.nix
+++ b/modules/xnet/gitserver/default.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.xnet.gitServer;
   inherit (lib) mkOption mkIf types;
diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix
index 9b3435a..f7a8bc7 100644
--- a/modules/xnet/gitserver/gitweb.nix
+++ b/modules/xnet/gitserver/gitweb.nix
@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.xnet.gitServer.gitweb;
   inherit (lib) mkOption mkIf types;
diff --git a/modules/xnet/monitoring/default.nix b/modules/xnet/monitoring/default.nix
index eed4963..20566d3 100644
--- a/modules/xnet/monitoring/default.nix
+++ b/modules/xnet/monitoring/default.nix
@@ -9,7 +9,6 @@ in
 {
   imports = [ ./grafana.nix ];
 
-
   config = {
     services.prometheus = {
       enable = config.xnet.monitoring.hostGrafana;
@@ -19,7 +18,10 @@ in
         node = {
           enable = true;
           openFirewall = true;
-          enabledCollectors = [ "processes" "systemd" ];
+          enabledCollectors = [
+            "processes"
+            "systemd"
+          ];
         };
 
         # systemd = {
@@ -39,20 +41,29 @@ in
 
       scrapeConfigs =
         let
-          hosts = [ "iridium" "radon" ];
+          hosts = [
+            "iridium"
+            "radon"
+          ];
         in
-        [{
-          job_name = "node";
-          static_configs = [{
-            targets = map (h: "${h}:${toString exporters.node.port}") hosts;
-          }];
-        }
+        [
+          {
+            job_name = "node";
+            static_configs = [
+              {
+                targets = map (h: "${h}:${toString exporters.node.port}") hosts;
+              }
+            ];
+          }
           {
             job_name = "smartctl";
-            static_configs = [{
-              targets = map (h: "${h}:${toString exporters.smartctl.port}") hosts;
-            }];
-          }];
+            static_configs = [
+              {
+                targets = map (h: "${h}:${toString exporters.smartctl.port}") hosts;
+              }
+            ];
+          }
+        ];
     };
   };
 }
diff --git a/modules/xnet/monitoring/grafana.nix b/modules/xnet/monitoring/grafana.nix
index e95318d..a8712f0 100644
--- a/modules/xnet/monitoring/grafana.nix
+++ b/modules/xnet/monitoring/grafana.nix
@@ -1,4 +1,9 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
   inherit (lib) mkOption mkIf types;
 
@@ -18,18 +23,22 @@ in
   config = mkIf hostGrafana {
     services.grafana.provision = {
       enable = true;
-      datasources.settings.datasources = [{
-        name = "Prometheus";
-        type = "prometheus";
-        url = "http://localhost:9090";
-        access = "proxy";
-        editable = false;
-      }];
+      datasources.settings.datasources = [
+        {
+          name = "Prometheus";
+          type = "prometheus";
+          url = "http://localhost:9090";
+          access = "proxy";
+          editable = false;
+        }
+      ];
 
-      dashboards.settings.providers = [{
-        name = "Fetched Dashboards";
-        options.path = "/etc/grafana/dashboards";
-      }];
+      dashboards.settings.providers = [
+        {
+          name = "Fetched Dashboards";
+          options.path = "/etc/grafana/dashboards";
+        }
+      ];
     };
 
     environment.etc = {
diff --git a/modules/xnet/nginx.nix b/modules/xnet/nginx.nix
index eadd794..3e6ca7c 100644
--- a/modules/xnet/nginx.nix
+++ b/modules/xnet/nginx.nix
@@ -14,7 +14,10 @@ in
   };
 
   config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
+    networking.firewall.allowedTCPPorts = [
+      80
+      443
+    ];
 
     services.nginx = {
       enable = true;
diff --git a/modules/xnet/persist.nix b/modules/xnet/persist.nix
index 10eb883..5e69bae 100644
--- a/modules/xnet/persist.nix
+++ b/modules/xnet/persist.nix
@@ -10,39 +10,42 @@ let
 in
 {
   options.xnet.persist = mkOption {
-    type = types.listOf (types.either
-      types.str
-      (types.submodule {
-        options = {
-          path = mkOption {
-            type = types.str;
-            description = "Path to persist";
-          };
-          user = mkOption {
-            type = types.nullOr types.str;
-            default = null;
-            description = "User ID to set on the persisted directory";
-          };
-          group = mkOption {
-            type = types.nullOr types.str;
-            default = null;
-            description = "Group ID to set on the persisted directory";
-          };
+    type = types.listOf (
+      types.either types.str (
+        types.submodule {
+          options = {
+            path = mkOption {
+              type = types.str;
+              description = "Path to persist";
+            };
+            user = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = "User ID to set on the persisted directory";
+            };
+            group = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = "Group ID to set on the persisted directory";
+            };
 
-          mode = mkOption {
-            type = types.nullOr types.str;
-            default = null;
-            description = "Permissions to set";
+            mode = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = "Permissions to set";
+            };
           };
-        };
-      }));
+        }
+      )
+    );
     default = [ ];
     description = "Automatically persisted state.";
   };
 
   config.systemd.tmpfiles.rules =
     let
-      mkEntry = entry:
+      mkEntry =
+        entry:
         let
           path = if isString entry then entry else entry.path;
           user = if isString entry then "-" else entry.user;
@@ -53,7 +56,11 @@ in
           link = "L+ ${path} - - - - /persist${path}";
           perm = "Z ${mode} ${user} ${group} - -";
         in
-        [ dent link perm ];
+        [
+          dent
+          link
+          perm
+        ];
 
       entries = map mkEntry config.xnet.persist;
     in
diff --git a/packages/randpass.nix b/packages/randpass.nix
index ef8fe91..4cb5128 100644
--- a/packages/randpass.nix
+++ b/packages/randpass.nix
@@ -4,5 +4,4 @@
 
 { writeShellScriptBin, ... }:
 
-writeShellScriptBin "randpass"
-  ''tr -dc '[:alnum:]' </dev/urandom | head -c "''${1:-14}"''
+writeShellScriptBin "randpass" ''tr -dc '[:alnum:]' </dev/urandom | head -c "''${1:-14}"''
-- 
cgit v1.3.1


From 27db59cac4f3c3e7a1e4187a5f56d4ec61895c5a Mon Sep 17 00:00:00 2001
From: Kleidi Bujari <mail@4kb.net>
Date: Sat, 3 Oct 2026 22:05:36 -0700
Subject: cv change

---
 machines/feneri.nix               |  17 ++++
 modules/xnet/default.nix          |   2 +-
 modules/xnet/gitserver/gitweb.nix |   1 +
 packages/misc/cv/cv.typ           | 174 ++++++++++++--------------------------
 4 files changed, 74 insertions(+), 120 deletions(-)

(limited to 'modules/xnet/gitserver')

diff --git a/machines/feneri.nix b/machines/feneri.nix
index 605159e..edd0922 100644
--- a/machines/feneri.nix
+++ b/machines/feneri.nix
@@ -27,6 +27,23 @@
     sshd.enable = true;
   };
 
+  systemd.network = {
+    enable = true;
+    networks."30-wan" = {
+      matchConfig = {
+        Type = "ether";
+        MACAddress = "8a:33:83:f4:b1:80";
+      };
+      linkConfig.RequiredForOnline = true;
+      networkConfig.Description = "WAN";
+      address = [ "152.53.193.118/22" "2a0a:4cc0:2000:bfbf::1/64" ];
+      routes = [
+        { Gateway = "152.53.192.1"; }
+        { Gateway = "fe80::1"; }
+      ];
+    };
+  };
+
   security.acme = {
     acceptTerms = true;
     defaults.email = "certs@4kb.net";
diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix
index 415fc0b..020accb 100644
--- a/modules/xnet/default.nix
+++ b/modules/xnet/default.nix
@@ -63,7 +63,7 @@ in
         automatic = true;
         options = mkDefault "--delete-older-than 30d";
       };
-      registry.nixpkgs.flake.outPath = "path:${pkgs.path}";
+      registry.nixpkgs.flake.outPath = pkgs.path;
     };
 
     documentation = {
diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix
index f7a8bc7..6473183 100644
--- a/modules/xnet/gitserver/gitweb.nix
+++ b/modules/xnet/gitserver/gitweb.nix
@@ -58,6 +58,7 @@ in
         root-desc = "What I cannot create, I do not understand";
         root-title = cfg.hostName;
         section-from-path = true;
+        scan-hidden-path = true;
         snapshots = "tar.gz tar.bz2 zip";
       };
     };
diff --git a/packages/misc/cv/cv.typ b/packages/misc/cv/cv.typ
index c4ddba6..df70f67 100644
--- a/packages/misc/cv/cv.typ
+++ b/packages/misc/cv/cv.typ
@@ -1,156 +1,92 @@
 #set document(author: "Kleidi Bujari", title: "Kleidi's Resume!")
 #set text(size: 10pt, lang: "en", ligatures: false)
-#set page(margin: 1in, paper: "us-letter")
+#set page(paper: "us-letter")
 
-#show link: underline
 #set par(justify: true)
 
-#show heading.where(level: 1): it => [
-  #set text(weight: 700, size: 20pt)
-  #pad(it.body)
-]
-
 #show heading.where(level: 2): it => [
-  #pad(top: 5pt, bottom: -10pt, [#smallcaps(it.body)])
-  #line(length: 100%, stroke: 0.5pt)
+  #pad(top: 8pt, bottom: 5pt, [#smallcaps(it.body)])
 ]
 
-#let generic-headline(
-  left: "",
-  right: "",
-  description: "",
-) = [#strong(left), #description #h(1fr) #right]
+#let item(
+    place: "",
+    title: "",
+    dates: "",
+    descr: "",
+) = stack(
+    dir: ttb,
+    grid(
+        columns: (0.5fr, 1fr),
+        dates,
+        stack(dir: ttb, spacing: 6pt, place, title, descr)
+    ),
+    v(0.75em)
+)
 
 #let dates-helper(from: "", to: "") = from + " " + $dash.em$ + " " + to
 
-#let edu(
-  institution: "",
-  dates: "",
-  degree: "",
-) = generic-headline(
-  left: institution,
-  description: degree,
-  right: dates,
+#stack(
+    dir: ttb,
+    spacing: 1em,
+    [= Kleidi Bujari],
+    link("mailto:kleidi@4kb.net"),
 )
 
-#let work(
-  title: "",
-  dates: "",
-  company: "",
-) = generic-headline(
-  left: company,
-  description: title,
-  right: dates,
-)
-
-= Kleidi Bujari
-
-#(
-  link("mailto:kleidi@4kb.net"),
-  link("https://github.com/kbujari")[github.com/kbujari],
-  link("http://kleidi.ca")[kleidi.ca],
-).join("  |  ")
+== Work Experience
 
-== Experience
-
-#work(
-  company: "Meta",
-  title: "Production Software Engineer",
-  dates: dates-helper(from: "Aug 2025", to: "Present"),
+#item(
+    place: [Tesla (#link("https://tesla.com")[tesla.com])],
+    title: "Senior Software Engineer, Distributed Systems",
+    dates: dates-helper(from: "Sep 2026", to: "present"),
+    descr: "Developer tooling and build infrastructure"
 )
 
-- Analyzed Linux schedulers for Erlang/BEAM workloads,
-  building kernel scheduler observability used across Meta.
-- Led team designing scalable AWS/EKS infrastructure fighting internet censorship and poor network conditions.
-- Built runtime type-checking for trillions of WhatsApp packets,
-  solving entire class of account ID problems.
-- Primary oncall for WhatsApp distributed system,
-  improving reliability and mentoring engineers in debugging.
-
-#work(
-  company: "Toronto Metropolitan University",
-  title: "Graduate Research Assistant",
-  dates: dates-helper(from: "May 2024", to: "Sep 2024"),
+#item(
+    place: [Meta (#link("https://meta.com")[meta.com])],
+    title: "Production Software Engineer",
+    dates: dates-helper(from: "Aug 2025", to: "Aug 2026"),
+    descr: "Type-checkers and distributed system reliability."
 )
 
-- Organized webhosting and data analytics for a film release,
-  with thousands of concurrent visitors.
-- Built transformation pipeline for hundreds of media files,
-  using unix primitives to parallelize workload.
-
-#work(
-  company: "Canadian Broadcasting Corporation",
-  title: "Systems Engineering Intern",
-  dates: dates-helper(from: "May 2023", to: "Apr 2024"),
+#item(
+    place: [Toronto Metropolitan University (#link("https://torontomu.ca")[torontomu.ca])],
+    title: "Graduate Research Assistant",
+    dates: dates-helper(from: "May 2024", to: "Sep 2024"),
+    descr: "Fast content delivery for documents and media."
 )
 
-- Built custom PXE-based provisioning for hundreds of devices on network,
-  eliminating manual configuration.
-- Architected VM cluster for 2024 Olympics handling all Canadian broadcasts,
-  saving \$250k+ with reused hardware.
-
-#work(
-  company: "WSP Canada",
-  title: "Student Engineer",
-  dates: dates-helper(from: "May", to: "Aug") + ", 2021, 2022",
+#item(
+    place: [Canadian Broadcasting Corporation (#link("https://cbc.ca")[cbc.ca])],
+    title: "Systems Engineering Intern",
+    dates: dates-helper(from: "May 2023", to: "May 2024"),
+    descr: "Datacenter bringup and SDN automation."
 )
 
-- Validated large scale electrical distribution for power consumption and cost efficiency.
-- Extended internal databases with compression and deduplication,
-  reclaiming terabytes of storage.
-
-== Selected Projects
-
-*Custom Linux Distribution* ---
-Designed entire Linux distribution used for hosting production servers,
-daily desktop use, and embedded programming on a Raspberry Pi.
-Using NixOS, it supports enabling only required functionality at build time.
-Features systemd,
-an in-memory root filesystem,
-ZFS persistent storage with backups,
-and extremely hardened networking.
-
-*Distributed Compute Cluster* ---
-Bare-metal Kubernetes cluster managed with GitOps to be completely reproducible.
-Uses Cilium CNI for fast eBPF networking and BGP load balancing,
-FluxCD for cluster management,
-and CEPH distributed storage for stateful workloads.
-Air-gapped, automated cluster provisioning with custom PXEBOOT images.
-
-*ICER Compressor* ---
-Image compression library written in Rust,
-designed for deep-space communication.
-Hand tuned for speed and portability by using only integer arithmetic,
-no heap allocations, and no standard library by default.
-Achieves practically instant compressions, even on microprocessors.
-
 == Education
 
-#edu(
-  institution: "Toronto Metropolitan University",
-  dates: dates-helper(from: "Sep 2020", to: "Apr 2025"),
-  degree: "B. Eng, Computer Engineering",
+#item(
+    place: "Toronto Metropolitan University",
+    dates: dates-helper(from: "2020", to: "2025"),
+    title: "Bachelors of Engineering, Computer Engineering",
 )
 
-- *Relevant Coursework*:
-  Data Structures, FPGA Programming, Compilers, Computer Networks
-- *Extracurriculars*:
-  Student-led robotics design team,
-  teaching assistant for micro-processor courses.
+== Selected Projects
+
+- *Depot*: Custom systemd-based Linux distribution built on nixpkgs.
+- *Hint*: Interpreted language and package manager written in Haskell.
 
 == Skills
 
 - *Languages*: #(
-    "Rust",
     "Haskell",
-    "C++",
+    "Rust",
     "Erlang",
-    "Nix",
-    "Scheme",
+    "C++",
+    "Python"
   ).join(", ")
 - *Technologies*: #(
-    "Distributed Systems",
     "Compilers",
+    "Distributed Systems",
+    "Build Systems",
     "Virtualization",
-    "Reproducible Builds",
   ).join(", ")
-- 
cgit v1.3.1