From 2454b38c235d710550cf9968c9e0d190d4cd01bc Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Tue, 1 Sep 2026 13:09:24 -0700 Subject: [nixos/xnet] remove inputs dependency from xnet inputs is inherently a flake feature and pkgs.path works just as well. --- modules/xnet/default.nix | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'modules') diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix index 28edf60..e646c02 100644 --- a/modules/xnet/default.nix +++ b/modules/xnet/default.nix @@ -3,7 +3,6 @@ lib, config, flake, - inputs, ... }: let @@ -47,7 +46,7 @@ in time.timeZone = mkDefault "US/Pacific"; nix = { - nixPath = mkForce [ "nixpkgs=${inputs.nixpkgs}" ]; + nixPath = mkForce [ "nixpkgs=${pkgs.path}" ]; settings = { auto-optimise-store = true; experimental-features = [ @@ -65,7 +64,7 @@ in options = mkDefault "--delete-older-than 30d"; }; registry = { - nixpkgs.flake = inputs.nixpkgs; + nixpkgs.flake = pkgs.path; depot.flake = flake; }; }; -- cgit v1.3.1 From bb3fc34e8adee94e8bed82a33da139b9fefd79a7 Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Sat, 5 Sep 2026 12:55:01 -0700 Subject: [xnet] add srcweb git remote --- modules/xnet/default.nix | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'modules') diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix index e646c02..8885db5 100644 --- a/modules/xnet/default.nix +++ b/modules/xnet/default.nix @@ -121,6 +121,11 @@ in Host ee HostName pascal.ee.ryerson.ca User kbujari + + Host src + HostName src.web.4kb.net + User git + PreferredAuthentications publickey ''; }; -- cgit v1.3.1 From 531afa134dd204b61cb506a425959dcf68949c9d Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Sat, 5 Sep 2026 13:20:52 -0700 Subject: [nixos/sshd] fix pubkey accepted types and hostkey location --- modules/sshd.nix | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) (limited to 'modules') diff --git a/modules/sshd.nix b/modules/sshd.nix index 6afec3f..421ab7f 100644 --- a/modules/sshd.nix +++ b/modules/sshd.nix @@ -33,7 +33,7 @@ in startWhenNeeded = true; openFirewall = true; hostKeys = lib.singleton { - path = "/persist/certs/ssh/ssh_host_ed25519_key"; + path = "/var/lib/sshd/ssh_host_ed25519_key"; type = "ed25519"; }; settings = { @@ -41,6 +41,7 @@ in X11Forwarding = false; PermitRootLogin = "prohibit-password"; PasswordAuthentication = mkDefault false; + KbdInteractiveAuthentication = false; # Ciphers = [ "chacha20-poly1305@openssh.com" ]; # Macs = [ "hmac-sha2-512-etm@openssh.com" ]; # KexAlgorithms = [ "curve25519-sha256@libssh.org" ]; @@ -50,15 +51,14 @@ in "-f AUTHPRIV" "-l INFO" ]; - # extraConfig = - # let - # pubkeyTypes = lib.strings.concatStringsSep "," [ - # "sk-ssh-ed25519-cert-v01@openssh.com" - # "ssh-ed25519-cert-v01@openssh.com" - # "ssh-ed25519" - # ]; - # in - # "PubkeyAcceptedKeyTypes ${pubkeyTypes}"; + extraConfig = + let + pubkeyTypes = lib.strings.concatStringsSep "," [ + "sk-ssh-ed25519@openssh.com" + "ssh-ed25519" + ]; + in + "PubkeyAcceptedKeyTypes ${pubkeyTypes}"; }; users.users.root.openssh.authorizedKeys.keys = [ -- cgit v1.3.1 From 4bb587f713ddf8d8c6b9e6325e2346d81d67c0fb Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Sat, 5 Sep 2026 13:32:08 -0700 Subject: [xnet/gitweb] enable source and about filter --- modules/xnet/gitserver/gitweb.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'modules') diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix index a9ed7d9..b52b8fc 100644 --- a/modules/xnet/gitserver/gitweb.nix +++ b/modules/xnet/gitserver/gitweb.nix @@ -46,8 +46,8 @@ in readme=:README.txt ''; settings = { - # about-filter = "${pkgs.cgit-pink}/lib/cgit/filters/about-formatting.sh"; - # source-filter = "${pkgs.cgit-pink}/lib/cgit/filters/syntax-highlighting.py"; + about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh"; + source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py"; clone-url = "https://${cfg.hostName}/$CGIT_REPO_URL git@${cfg.hostName}:$CGIT_REPO_URL"; enable-commit-graph = true; enable-http-clone = false; -- cgit v1.3.1 From 811dd787c3f9a6caa7cf0ae4f34d8ae216e3c26d Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Sat, 26 Sep 2026 19:45:48 -0700 Subject: [xnet/gitserver] deny bots by default --- modules/xnet/gitserver/gitweb.nix | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) (limited to 'modules') diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix index b52b8fc..9b3435a 100644 --- a/modules/xnet/gitserver/gitweb.nix +++ b/modules/xnet/gitserver/gitweb.nix @@ -38,12 +38,7 @@ in mimetype.pdf=application/pdf mimetype.png=image/png mimetype.svg=image/svg+xml - readme=:readme - readme=:readme.md - readme=:readme.txt - readme=:README - readme=:README.md - readme=:README.txt + readme=master:README ''; settings = { about-filter = "${pkgs.cgit}/lib/cgit/filters/about-formatting.sh"; @@ -62,9 +57,11 @@ in }; }; - # services.nginx.virtualHosts."${cfg.gitweb.hostName}" = { - # useACMEHost = "4kb.net"; - # addSSL = true; - # }; + services.nginx.virtualHosts."${cfg.hostName}" = { + useACMEHost = "4kb.net"; + forceSSL = true; + + locations."/robots.txt".return = "200 \"User-agent: *\nDisallow: /\n\""; + }; }; } -- cgit v1.3.1 From 16918d62b34b7e4d7817837057b88acb44e4f63c Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Sat, 3 Oct 2026 19:56:13 -0700 Subject: enable flake-less machine builds --- default.nix | 10 +- machines/t1.nix | 37 ++-- modules/desktop.nix | 489 ++++++++++++++++++++++++----------------------- modules/users.nix | 29 ++- modules/xnet/default.nix | 6 +- 5 files changed, 298 insertions(+), 273 deletions(-) (limited to 'modules') diff --git a/default.nix b/default.nix index 3c167c9..dafe54f 100644 --- a/default.nix +++ b/default.nix @@ -7,6 +7,11 @@ let inherit (lock.nodes.nixpkgs.locked) rev; inherit (lock.nodes.nixpkgs.original) ref; }; + + disko = builtins.fetchTarball { + url = "https://github.com/nix-community/disko/archibe/${lock.nodes.disko.locked.rev}tar.gz"; + sha256 = lock.nodes.disko.locked.narHash; + }; in { pkgs ? import defaultNixpkgs { }, @@ -64,8 +69,11 @@ let entry.path nixosModules.xnet nixosModules.disk - # nixosModules.network + nixosModules.desktop + nixosModules.network nixosModules.sshd + nixosModules.users + ("${disko}/module.nix") ]; }; in diff --git a/machines/t1.nix b/machines/t1.nix index b443da5..d8d749b 100644 --- a/machines/t1.nix +++ b/machines/t1.nix @@ -1,22 +1,6 @@ -{ - flake, - pkgs, - perSystem, - ... -}: +{ pkgs, ... }: -let - inherit (import flake.outputs.nixosModules.users { inherit perSystem pkgs; }) - kle - ; -in { - imports = [ - flake.outputs.nixosModules.disk - flake.outputs.nixosModules.desktop - flake.outputs.nixosModules.network - ]; - hardware = { cpu.amd.updateMicrocode = true; enableRedistributableFirmware = true; @@ -31,9 +15,17 @@ in }; }; - nixpkgs.hostPlatform = "x86_64-linux"; + depot = { + desktop.enable = true; + users.kle.enable = true; + net = { + v6Token = "::beef"; + sshd.enable = true; + sshd.publish = true; + }; + }; - users.users.kle = kle; + nixpkgs.hostPlatform = "x86_64-linux"; xnet = { disk = { @@ -42,12 +34,6 @@ in }; }; - depot.net = { - v6Token = "::beef"; - sshd.enable = true; - sshd.publish = true; - }; - # depot.disk = { # enable = true; # device = "/dev/nvme0n1"; @@ -80,7 +66,6 @@ in environment.shellAliases.b = "${pkgs.ddcutil}/bin/ddcutil setvcp 10"; boot.kernelModules = [ "i2c-dev" ]; - environment.systemPackages = with pkgs; [ ddcutil prismlauncher diff --git a/modules/desktop.nix b/modules/desktop.nix index 894a7db..747c302 100644 --- a/modules/desktop.nix +++ b/modules/desktop.nix @@ -1,283 +1,298 @@ -{ lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let - inherit (lib) mkDefault; + cfg = config.depot.desktop; + + inherit (lib) mkIf mkDefault mkEnableOption; inherit (builtins) listToAttrs; in { - environment.systemPackages = with pkgs; [ - audacious - brightnessctl - foot - fuzzel - imv - man-pages - man-pages-posix - mpv - playerctl - pop-icon-theme - pwvucontrol - swaybg - swayidle - swaylock - tigervnc - wl-clipboard - xeyes - xwayland-satellite - zathura + options.depot.desktop.enable = mkEnableOption "depot desktop"; - # Spell checking - aspell - aspellDicts.en - aspellDicts.en-science - aspellDicts.en-computers + config = mkIf cfg.enable { + environment.systemPackages = with pkgs; [ + audacious + brightnessctl + foot + fuzzel + imv + man-pages + man-pages-posix + mpv + playerctl + pop-icon-theme + pwvucontrol + swaybg + swayidle + swaylock + tigervnc + wl-clipboard + xeyes + xwayland-satellite + zathura - hunspell - hunspellDicts.en-us - ]; + # Spell checking + aspell + aspellDicts.en + aspellDicts.en-science + aspellDicts.en-computers - documentation = { - dev.enable = true; - doc.enable = true; - info.enable = true; - man.enable = true; - }; + hunspell + hunspellDicts.en-us + ]; - security.rtkit.enable = true; - services.pipewire = { - enable = true; - pulse.enable = true; - alsa.enable = true; - }; + documentation = { + dev.enable = true; + doc.enable = true; + info.enable = true; + man.enable = true; + }; - services.emacs = { - enable = true; - defaultEditor = true; - package = with pkgs; (emacsPackagesFor emacs).emacsWithPackages - (epkgs: [ epkgs.mu4e epkgs.treesit-grammars.with-all-grammars ]); - }; + security.rtkit.enable = true; + services.pipewire = { + enable = true; + pulse.enable = true; + alsa.enable = true; + }; - # Build nix derivations on disk rather than in /tmp which is mounted - # in RAM, otherwise large closures fail to build due to lack of - # space. Since desktops are used as dev machines, this option lives - # here rather than on a more general module. - systemd.services.nix-daemon.environment.TMPDIR = "/nix/tmp"; + services.emacs = { + enable = true; + defaultEditor = true; + package = + with pkgs; + (emacsPackagesFor emacs).emacsWithPackages (epkgs: [ + epkgs.mu4e + epkgs.treesit-grammars.with-all-grammars + ]); + }; - # Make sure the directory for evaluating large closures exists for - # the nix daemon. - systemd.tmpfiles.rules = [ "d /nix/tmp 755 root root - -" ]; + # Build nix derivations on disk rather than in /tmp which is mounted + # in RAM, otherwise large closures fail to build due to lack of + # space. Since desktops are used as dev machines, this option lives + # here rather than on a more general module. + systemd.services.nix-daemon.environment.TMPDIR = "/nix/tmp"; - systemd.packages = with pkgs; [ mako ]; - systemd.user.services = - let - afterGraphical = ExecStart: { - enable = true; - after = [ "graphical-session.target" ]; - partOf = [ "graphical-session.target" ]; - wantedBy = [ "graphical-session.target" ]; - serviceConfig = { - inherit ExecStart; - Type = "simple"; + # Make sure the directory for evaluating large closures exists for + # the nix daemon. + systemd.tmpfiles.rules = [ "d /nix/tmp 755 root root - -" ]; + + systemd.packages = with pkgs; [ mako ]; + systemd.user.services = + let + afterGraphical = ExecStart: { + enable = true; + after = [ "graphical-session.target" ]; + partOf = [ "graphical-session.target" ]; + wantedBy = [ "graphical-session.target" ]; + serviceConfig = { + inherit ExecStart; + Type = "simple"; + }; }; - }; - in - { - udiskie = afterGraphical "${pkgs.udiskie}/bin/udiskie"; - swayidle = - let - swaylock = lib.concatStringsSep " " [ - "${pkgs.swaylock}/bin/swaylock" - "--color 2b3328" - "--indicator-caps-lock" - "--ignore-empty-password" - "--daemonize" - ]; - in - afterGraphical ( - pkgs.writeShellScript "start-swayidle" '' - ${pkgs.swayidle}/bin/swayidle -w \ - timeout 601 '${pkgs.niri}/bin/niri msg action power-off-monitors' \ - timeout 600 '${swaylock}' \ - before-sleep '${swaylock}' - '' - ); + in + { + udiskie = afterGraphical "${pkgs.udiskie}/bin/udiskie"; + swayidle = + let + swaylock = lib.concatStringsSep " " [ + "${pkgs.swaylock}/bin/swaylock" + "--color 2b3328" + "--indicator-caps-lock" + "--ignore-empty-password" + "--daemonize" + ]; + in + afterGraphical ( + pkgs.writeShellScript "start-swayidle" '' + ${pkgs.swayidle}/bin/swayidle -w \ + timeout 601 '${pkgs.niri}/bin/niri msg action power-off-monitors' \ + timeout 600 '${swaylock}' \ + before-sleep '${swaylock}' + '' + ); - waybar = { - partOf = [ "graphical-session.target" ]; - wantedBy = [ "graphical-session.target" ]; - after = [ "graphical-session.target" ]; + waybar = { + partOf = [ "graphical-session.target" ]; + wantedBy = [ "graphical-session.target" ]; + after = [ "graphical-session.target" ]; - path = with pkgs; [ - pwvucontrol - ]; + path = with pkgs; [ + pwvucontrol + ]; - serviceConfig = { - Type = "exec"; - ExecStart = "${pkgs.waybar}/bin/waybar"; - ExecReload = "kill -SIGUSR2 $MAINPID"; - Restart = "on-failure"; + serviceConfig = { + Type = "exec"; + ExecStart = "${pkgs.waybar}/bin/waybar"; + ExecReload = "kill -SIGUSR2 $MAINPID"; + Restart = "on-failure"; + }; }; }; - }; - qt = { - enable = true; - style = "adwaita-dark"; - platformTheme = "gnome"; - }; + qt = { + enable = true; + style = "adwaita-dark"; + platformTheme = "gnome"; + }; - fonts = { - # Expose system fonts in case something non-standard needs them - fontDir.enable = true; - packages = with pkgs; [ - ibm-plex - iosevka - nerd-fonts.symbols-only - ]; + fonts = { + # Expose system fonts in case something non-standard needs them + fontDir.enable = true; + packages = with pkgs; [ + ibm-plex + iosevka + nerd-fonts.symbols-only + ]; - fontconfig.defaultFonts = { - serif = [ "IBM Plex Serif" ]; - sansSerif = [ "IBM Plex Sans" ]; - monospace = [ "IBM Plex Mono" ]; + fontconfig.defaultFonts = { + serif = [ "IBM Plex Serif" ]; + sansSerif = [ "IBM Plex Sans" ]; + monospace = [ "IBM Plex Mono" ]; + }; }; - }; - - environment.etc."xdg/user-dirs.defaults".text = '' - DOWNLOAD=/tmp/downloads - ''; - environment.sessionVariables = { - MOZ_ENABLE_WAYLAND = 1; - MOZ_USE_XINPUT2 = 1; - MOZ_WEBRENDER = 1; - QT_QPA_PLATFORM = "wayland;xcb"; - }; + environment.etc."xdg/user-dirs.defaults".text = '' + DOWNLOAD=/tmp/downloads + ''; - programs = { - niri.enable = true; - direnv.enable = true; - fish = { - enable = true; - interactiveShellInit = '' - # disable greeting - set fish_greeting - ''; + environment.sessionVariables = { + MOZ_ENABLE_WAYLAND = 1; + MOZ_USE_XINPUT2 = 1; + MOZ_WEBRENDER = 1; + QT_QPA_PLATFORM = "wayland;xcb"; }; - # GTK settings - dconf = { - enable = true; - profiles.user.databases = [ - { - lockAll = true; - settings = { - "org/gnome/desktop/interface" = { - color-scheme = "prefer-dark"; - gtk-font-name = "Sans Serif 10"; - icon-theme = "Pop"; - theme-name = "Adwaita"; + programs = { + niri.enable = true; + direnv.enable = true; + fish = { + enable = true; + interactiveShellInit = '' + # disable greeting + set fish_greeting + ''; + }; + + # GTK settings + dconf = { + enable = true; + profiles.user.databases = [ + { + lockAll = true; + settings = { + "org/gnome/desktop/interface" = { + color-scheme = "prefer-dark"; + gtk-font-name = "Sans Serif 10"; + icon-theme = "Pop"; + theme-name = "Adwaita"; + }; }; - }; - } - ]; + } + ]; + }; }; - }; - hardware.bluetooth = { - enable = true; - powerOnBoot = true; - settings = { - General = { - Experimental = true; - }; - Policy = { - AutoEnable = true; + hardware.bluetooth = { + enable = true; + powerOnBoot = true; + settings = { + General = { + Experimental = true; + }; + Policy = { + AutoEnable = true; + }; }; }; - }; - services.blueman.enable = true; + services.blueman.enable = true; - # Helper for managing dotfiles - environment.shellAliases.dots = "git --git-dir=$HOME/.local/cfg/ --work-tree=$HOME"; + # Helper for managing dotfiles + environment.shellAliases.dots = "git --git-dir=$HOME/.local/cfg/ --work-tree=$HOME"; - # Enable modifying keyboard firmware - hardware.keyboard.qmk.enable = true; + # Enable modifying keyboard firmware + hardware.keyboard.qmk.enable = true; - security.polkit.enable = true; + security.polkit.enable = true; - services = { - gnome.gnome-keyring.enable = true; - upower.enable = true; - pcscd.enable = true; - udev.packages = with pkgs; [ yubikey-personalization ]; - udisks2 = { - enable = true; - mountOnMedia = true; + services = { + gnome.gnome-keyring.enable = true; + upower.enable = true; + pcscd.enable = true; + udev.packages = with pkgs; [ yubikey-personalization ]; + udisks2 = { + enable = true; + mountOnMedia = true; + }; }; - }; - programs.firefox = { - enable = true; - preferences = { - # Enable hardware transcoding - "media.ffmpeg.vaapi.enabled" = true; + programs.firefox = { + enable = true; + preferences = { + # Enable hardware transcoding + "media.ffmpeg.vaapi.enabled" = true; - # Disable controlling media with keyboard - "media.hardwaremediakeys.enabled" = false; - # Enable legacy compact mode - "browser.compactmode.show" = true; - "browser.uidensity" = 1; + # Disable controlling media with keyboard + "media.hardwaremediakeys.enabled" = false; + # Enable legacy compact mode + "browser.compactmode.show" = true; + "browser.uidensity" = 1; - # Disable ctrl+q closing browser - "browser.quitShortcut.disabled" = true; + # Disable ctrl+q closing browser + "browser.quitShortcut.disabled" = true; - # Hardcode theme to dark mode - "ui.systemUsesDarkTheme" = 1; - }; - policies = { - DefaultDownloadDirectory = "/tmp/firefox"; - DisableTelemetry = true; - DisableFirefoxStudies = true; - EnableTrackingProtection = { - Value = true; - Locked = true; - Cryptomining = true; - Fingerprinting = true; + # Hardcode theme to dark mode + "ui.systemUsesDarkTheme" = 1; }; - DisableAccounts = true; - DisableFirefoxAccounts = true; - DisableFirefoxScreenshots = true; - DisablePocket = true; - DisplayBookmarksToolbar = "never"; - DisplayMenuBar = "default-off"; - DontCheckDefaultBrowser = true; - Homepage = { - URL = "about:blank"; - StartPage = "homepage"; - }; - HttpsOnlyMode = "enabled"; - DNSOverHTTPS = false; - NewTabPage = false; - OfferToSaveLogins = false; - PasswordManagerEnabled = false; - SearchBar = "unified"; - SearchEngines.Default = "DuckDuckGo"; - SearchSuggestEnabled = false; - ExtensionSettings = - let - extension = shortId: uuid: { - name = uuid; - value = { - install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi"; - installation_mode = "force_installed"; + policies = { + DefaultDownloadDirectory = "/tmp/firefox"; + DisableTelemetry = true; + DisableFirefoxStudies = true; + EnableTrackingProtection = { + Value = true; + Locked = true; + Cryptomining = true; + Fingerprinting = true; + }; + DisableAccounts = true; + DisableFirefoxAccounts = true; + DisableFirefoxScreenshots = true; + DisablePocket = true; + DisplayBookmarksToolbar = "never"; + DisplayMenuBar = "default-off"; + DontCheckDefaultBrowser = true; + Homepage = { + URL = "about:blank"; + StartPage = "homepage"; + }; + HttpsOnlyMode = "enabled"; + DNSOverHTTPS = false; + NewTabPage = false; + OfferToSaveLogins = false; + PasswordManagerEnabled = false; + SearchBar = "unified"; + SearchEngines.Default = "DuckDuckGo"; + SearchSuggestEnabled = false; + ExtensionSettings = + let + extension = shortId: uuid: { + name = uuid; + value = { + install_url = "https://addons.mozilla.org/en-US/firefox/downloads/latest/${shortId}/latest.xpi"; + installation_mode = "force_installed"; + }; }; - }; - in - listToAttrs [ - (extension "ublock-origin" "uBlock0@raymondhill.net") - (extension "bitwarden-password-manager" "{446900e4-71c2-419f-a6a7-df9c091e268b}") - (extension "darkreader" "addon@darkreader.org") - ]; + in + listToAttrs [ + (extension "ublock-origin" "uBlock0@raymondhill.net") + (extension "bitwarden-password-manager" "{446900e4-71c2-419f-a6a7-df9c091e268b}") + (extension "darkreader" "addon@darkreader.org") + ]; + }; }; }; } diff --git a/modules/users.nix b/modules/users.nix index e21c085..d3e7cb4 100644 --- a/modules/users.nix +++ b/modules/users.nix @@ -1,7 +1,17 @@ -{ pkgs, ... }: +{ + config, + pkgs, + lib, + ... +}: let + cfg = config.depot.users; + inherit (builtins) - attrValues; + attrValues + ; + + inherit (lib) mkIf mkEnableOption; keys = { t480 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd"; @@ -9,13 +19,23 @@ let }; in { - kle = { + options.depot.users.kle.enable = mkEnableOption "kle user"; + + config.users.users.kle = mkIf cfg.kle.enable { initialHashedPassword = "$6$R4dDhaftX.vapGMd$.An36hlp3DXfkIC7bPZ0MDPo6Zvpk8JRrhy2LES.lZZj6JDa74oJkcMW3DCsIySvLJxOPXSShos0TpgJ/w0fH/"; isNormalUser = true; shell = pkgs.fish; home = "/persist/usr/kle"; createHome = true; - extraGroups = [ "wheel" "users" "networkmanager" "video" "kvm" "i2c" "dialout" ]; + extraGroups = [ + "wheel" + "users" + "networkmanager" + "video" + "kvm" + "i2c" + "dialout" + ]; packages = with pkgs; [ btop curl @@ -29,6 +49,7 @@ in rsync sshfs tree + watchman zip # passwords diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix index 8885db5..67bbbe5 100644 --- a/modules/xnet/default.nix +++ b/modules/xnet/default.nix @@ -2,7 +2,6 @@ pkgs, lib, config, - flake, ... }: let @@ -63,10 +62,7 @@ in automatic = true; options = mkDefault "--delete-older-than 30d"; }; - registry = { - nixpkgs.flake = pkgs.path; - depot.flake = flake; - }; + # registry.nixpkgs.flake = pkgs.path; }; documentation = { -- cgit v1.3.1 From 0d15a4d19f7925be328c2d24214a11e5ac541c40 Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Sat, 3 Oct 2026 19:56:13 -0700 Subject: nixfmt formatting pass --- lib/depot-tools.nix | 68 ++++++++++++++------------- machines/feneri.nix | 5 +- machines/iso.nix | 5 +- machines/natest.nix | 92 ++++++++++++++++++++----------------- machines/radon/default.nix | 8 +++- machines/radon/pxeboot.nix | 52 +++++++++++++-------- modules/xnet/disk.nix | 34 ++++++++++---- modules/xnet/gitserver/default.nix | 7 ++- modules/xnet/gitserver/gitweb.nix | 7 ++- modules/xnet/monitoring/default.nix | 37 +++++++++------ modules/xnet/monitoring/grafana.nix | 33 ++++++++----- modules/xnet/nginx.nix | 5 +- modules/xnet/persist.nix | 59 +++++++++++++----------- packages/randpass.nix | 3 +- 14 files changed, 255 insertions(+), 160 deletions(-) (limited to 'modules') diff --git a/lib/depot-tools.nix b/lib/depot-tools.nix index 7c2fc6b..8e5a16e 100644 --- a/lib/depot-tools.nix +++ b/lib/depot-tools.nix @@ -1,7 +1,8 @@ -{ inputs -, systems -, nixpkgs ? inputs.nixpkgs -, ... +{ + inputs, + systems, + nixpkgs ? inputs.nixpkgs, + ... }: let @@ -27,30 +28,25 @@ let # Get paths to directories onlyDirs = filterAttrs (_name: type: type == "directory") entries; - dirPaths = mapAttrs - (name: type: { - path = path + "/${name}"; - inherit type; - }) - onlyDirs; + dirPaths = mapAttrs (name: type: { + path = path + "/${name}"; + inherit type; + }) onlyDirs; # Get paths to nix files, where the name is the basename of the file without the .nix extension - nixPaths = removeAttrs - (mapAttrs' - ( - name: type: - let - nixName = match "(.*)\\.nix" name; - in - { - name = if type == "directory" || nixName == null then "__junk" else (head nixName); - value = { - path = path + "/${name}"; - type = type; - }; - } - ) - entries) [ "__junk" ]; + nixPaths = removeAttrs (mapAttrs' ( + name: type: + let + nixName = match "(.*)\\.nix" name; + in + { + name = if type == "directory" || nixName == null then "__junk" else (head nixName); + value = { + path = path + "/${name}"; + type = type; + }; + } + ) entries) [ "__junk" ]; combined = dirPaths // nixPaths; in @@ -61,9 +57,9 @@ let system: let # Resolve the packages for each input. - perSystem = mapAttrs - (_: flake: flake.legacyPackages.${system} or { } // flake.packages.${system} or { }) - inputs; + perSystem = mapAttrs ( + _: flake: flake.legacyPackages.${system} or { } // flake.packages.${system} or { } + ) inputs; # Handle nixpkgs specially. pkgs = @@ -78,7 +74,17 @@ let flake = inputs.self; in - makeScope callPackageWith (_: { inherit inputs perSystem flake pkgs system; }) + makeScope callPackageWith (_: { + inherit + inputs + perSystem + flake + pkgs + system + ; + }) ); in -{ inherit importDir systemArgs; } +{ + inherit importDir systemArgs; +} diff --git a/machines/feneri.nix b/machines/feneri.nix index a638642..e75738b 100644 --- a/machines/feneri.nix +++ b/machines/feneri.nix @@ -35,7 +35,10 @@ certs."4kb.net" = { dnsProvider = "porkbun"; environmentFile = "/var/secrets/porkbun"; - extraDomainNames = [ "*.4kb.net" "*.web.4kb.net" ]; + extraDomainNames = [ + "*.4kb.net" + "*.web.4kb.net" + ]; group = "nginx"; reloadServices = [ "nginx.service" ]; }; diff --git a/machines/iso.nix b/machines/iso.nix index d3ca992..5550841 100644 --- a/machines/iso.nix +++ b/machines/iso.nix @@ -6,7 +6,10 @@ nixpkgs.hostPlatform.system = "x86_64-linux"; nix.settings = { - experimental-features = [ "nix-command" "flakes" ]; + experimental-features = [ + "nix-command" + "flakes" + ]; }; environment.systemPackages = with pkgs; [ diff --git a/machines/natest.nix b/machines/natest.nix index fa8f1d5..c4937d6 100644 --- a/machines/natest.nix +++ b/machines/natest.nix @@ -1,4 +1,10 @@ -{ config, modulesPath, pkgs, lib, ... }: +{ + config, + modulesPath, + pkgs, + lib, + ... +}: { imports = [ @@ -19,7 +25,11 @@ fileSystems = { "/" = { fsType = "tmpfs"; - options = [ "defaults" "mode=755" "size=2G" ]; + options = [ + "defaults" + "mode=755" + "size=2G" + ]; }; "/boot" = { device = "/dev/disk/by-partlabel/boot"; @@ -43,54 +53,52 @@ let inherit (pkgs.stdenv.hostPlatform) efiArch; in - { - name = "image"; - partitions.esp = { - repartConfig = { - Format = "vfat"; - Label = "boot"; - SizeMinBytes = "256M"; - Type = "esp"; - }; - contents = { - "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source = - "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi"; + { + name = "image"; + partitions.esp = { + repartConfig = { + Format = "vfat"; + Label = "boot"; + SizeMinBytes = "256M"; + Type = "esp"; + }; + contents = { + "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source = + "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi"; - # "/EFI/Linux/${config.system.boot.loader.ukiFile}".source = - # "${config.system.build.uki}/${config.system.boot.loader.ukiFile}"; + # "/EFI/Linux/${config.system.boot.loader.ukiFile}".source = + # "${config.system.build.uki}/${config.system.boot.loader.ukiFile}"; - "/EFI/nixos/${config.system.boot.loader.kernelFile}.efi".source = - "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}"; + "/EFI/nixos/${config.system.boot.loader.kernelFile}.efi".source = + "${config.system.build.kernel}/${config.system.boot.loader.kernelFile}"; - "/EFI/nixos/${config.system.boot.loader.initrdFile}.efi".source = - "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}"; + "/EFI/nixos/${config.system.boot.loader.initrdFile}.efi".source = + "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}"; - "/loader/entries/nixos.conf".source = - pkgs.writeText "default-entry.conf" '' - title Coolio - linux /EFI/nixos/${config.system.boot.loader.kernelFile}.efi - initrd /EFI/nixos/${config.system.boot.loader.initrdFile}.efi - options init=${config.system.build.toplevel}/init root=fstab loglevel=4 - ''; + "/loader/entries/nixos.conf".source = pkgs.writeText "default-entry.conf" '' + title Coolio + linux /EFI/nixos/${config.system.boot.loader.kernelFile}.efi + initrd /EFI/nixos/${config.system.boot.loader.initrdFile}.efi + options init=${config.system.build.toplevel}/init root=fstab loglevel=4 + ''; - "/loader/loader.conf".source = - pkgs.writeText "loader.conf" '' - timeout 5 - console-mode keep - ''; - }; + "/loader/loader.conf".source = pkgs.writeText "loader.conf" '' + timeout 5 + console-mode keep + ''; }; - partitions.nix-store = { - storePaths = [ config.system.build.toplevel ]; - nixStorePrefix = "/"; - repartConfig = { - Format = "ext4"; - Label = "nix-store"; - SizeMinBytes = "4G"; - Type = "linux-generic"; - }; + }; + partitions.nix-store = { + storePaths = [ config.system.build.toplevel ]; + nixStorePrefix = "/"; + repartConfig = { + Format = "ext4"; + Label = "nix-store"; + SizeMinBytes = "4G"; + Type = "linux-generic"; }; }; + }; boot.loader.systemd-boot = { enable = true; diff --git a/machines/radon/default.nix b/machines/radon/default.nix index c77db03..f3e4ff0 100644 --- a/machines/radon/default.nix +++ b/machines/radon/default.nix @@ -1,4 +1,10 @@ -{ inputs, flake, pkgs, config, ... }: +{ + inputs, + flake, + pkgs, + config, + ... +}: let interfaces = { bottom = "enp1s0"; diff --git a/machines/radon/pxeboot.nix b/machines/radon/pxeboot.nix index 4655990..0b5df13 100644 --- a/machines/radon/pxeboot.nix +++ b/machines/radon/pxeboot.nix @@ -3,30 +3,42 @@ let installer = lib.nixosSystem { system = "x86_64-linux"; modules = [ - ({ config, pkgs, lib, modulesPath, ... }: { - imports = [ - (modulesPath + "/installer/netboot/netboot-minimal.nix") - (modulesPath + "/installer/cd-dvd/channel.nix") - ]; + ( + { + config, + pkgs, + lib, + modulesPath, + ... + }: + { + imports = [ + (modulesPath + "/installer/netboot/netboot-minimal.nix") + (modulesPath + "/installer/cd-dvd/channel.nix") + ]; - services.openssh = { - enable = true; - openFirewall = true; - settings = { - PasswordAuthentication = false; - KbdInteractiveAuthentication = false; + services.openssh = { + enable = true; + openFirewall = true; + settings = { + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + }; }; - }; - nix.settings = { - experimental-features = [ "nix-command" "flakes" ]; - }; + nix.settings = { + experimental-features = [ + "nix-command" + "flakes" + ]; + }; - users.users.root.openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd" - ]; - }) + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP7T2uWJFUu8aFZZgQusGKyEMocb2pKbHLDad2eIJus9" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEOw8YEbHsKy38JHp9W1wcxxZgWCDgnabOXccZUN5ddd" + ]; + } + ) ]; }; diff --git a/modules/xnet/disk.nix b/modules/xnet/disk.nix index 82e9c87..e6835f4 100644 --- a/modules/xnet/disk.nix +++ b/modules/xnet/disk.nix @@ -1,4 +1,9 @@ -{ config, lib, modulesPath, inputs, ... }: +{ + config, + lib, + modulesPath, + ... +}: let cfg = config.xnet.disk; commonOpts = { @@ -11,12 +16,16 @@ let "com.sun:auto-snapshot" = "false"; }; - inherit (lib) mkOption mkDefault mkIf types; + inherit (lib) + mkOption + mkDefault + mkIf + types + ; in { imports = [ (modulesPath + "/installer/scan/not-detected.nix") - inputs.disko.nixosModules.default ]; options.xnet.disk = { @@ -33,8 +42,7 @@ in }; config = mkIf cfg.enable { - networking.hostId = builtins.substring 0 8 - (builtins.hashString "md5" config.networking.hostName); + networking.hostId = builtins.substring 0 8 (builtins.hashString "md5" config.networking.hostName); services.zfs = { autoScrub.enable = true; @@ -46,8 +54,14 @@ in zramSwap.enable = mkDefault true; boot = { - kernelParams = [ "nohibernate" "elevator=none" ]; - supportedFilesystems = [ "vfat" "zfs" ]; + kernelParams = [ + "nohibernate" + "elevator=none" + ]; + supportedFilesystems = [ + "vfat" + "zfs" + ]; zfs.devNodes = mkDefault "/dev/disk/by-partuuid"; loader = { systemd-boot.enable = true; @@ -94,7 +108,11 @@ in disko.devices = { nodev."/" = { fsType = "tmpfs"; - mountOptions = [ "defaults" "size=2G" "mode=755" ]; + mountOptions = [ + "defaults" + "size=2G" + "mode=755" + ]; }; zpool.zroot = { diff --git a/modules/xnet/gitserver/default.nix b/modules/xnet/gitserver/default.nix index 2152ebd..2bd471a 100644 --- a/modules/xnet/gitserver/default.nix +++ b/modules/xnet/gitserver/default.nix @@ -1,4 +1,9 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let cfg = config.xnet.gitServer; inherit (lib) mkOption mkIf types; diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix index 9b3435a..f7a8bc7 100644 --- a/modules/xnet/gitserver/gitweb.nix +++ b/modules/xnet/gitserver/gitweb.nix @@ -1,4 +1,9 @@ -{ config, lib, pkgs, ... }: +{ + config, + lib, + pkgs, + ... +}: let cfg = config.xnet.gitServer.gitweb; inherit (lib) mkOption mkIf types; diff --git a/modules/xnet/monitoring/default.nix b/modules/xnet/monitoring/default.nix index eed4963..20566d3 100644 --- a/modules/xnet/monitoring/default.nix +++ b/modules/xnet/monitoring/default.nix @@ -9,7 +9,6 @@ in { imports = [ ./grafana.nix ]; - config = { services.prometheus = { enable = config.xnet.monitoring.hostGrafana; @@ -19,7 +18,10 @@ in node = { enable = true; openFirewall = true; - enabledCollectors = [ "processes" "systemd" ]; + enabledCollectors = [ + "processes" + "systemd" + ]; }; # systemd = { @@ -39,20 +41,29 @@ in scrapeConfigs = let - hosts = [ "iridium" "radon" ]; + hosts = [ + "iridium" + "radon" + ]; in - [{ - job_name = "node"; - static_configs = [{ - targets = map (h: "${h}:${toString exporters.node.port}") hosts; - }]; - } + [ + { + job_name = "node"; + static_configs = [ + { + targets = map (h: "${h}:${toString exporters.node.port}") hosts; + } + ]; + } { job_name = "smartctl"; - static_configs = [{ - targets = map (h: "${h}:${toString exporters.smartctl.port}") hosts; - }]; - }]; + static_configs = [ + { + targets = map (h: "${h}:${toString exporters.smartctl.port}") hosts; + } + ]; + } + ]; }; }; } diff --git a/modules/xnet/monitoring/grafana.nix b/modules/xnet/monitoring/grafana.nix index e95318d..a8712f0 100644 --- a/modules/xnet/monitoring/grafana.nix +++ b/modules/xnet/monitoring/grafana.nix @@ -1,4 +1,9 @@ -{ config, pkgs, lib, ... }: +{ + config, + pkgs, + lib, + ... +}: let inherit (lib) mkOption mkIf types; @@ -18,18 +23,22 @@ in config = mkIf hostGrafana { services.grafana.provision = { enable = true; - datasources.settings.datasources = [{ - name = "Prometheus"; - type = "prometheus"; - url = "http://localhost:9090"; - access = "proxy"; - editable = false; - }]; + datasources.settings.datasources = [ + { + name = "Prometheus"; + type = "prometheus"; + url = "http://localhost:9090"; + access = "proxy"; + editable = false; + } + ]; - dashboards.settings.providers = [{ - name = "Fetched Dashboards"; - options.path = "/etc/grafana/dashboards"; - }]; + dashboards.settings.providers = [ + { + name = "Fetched Dashboards"; + options.path = "/etc/grafana/dashboards"; + } + ]; }; environment.etc = { diff --git a/modules/xnet/nginx.nix b/modules/xnet/nginx.nix index eadd794..3e6ca7c 100644 --- a/modules/xnet/nginx.nix +++ b/modules/xnet/nginx.nix @@ -14,7 +14,10 @@ in }; config = mkIf cfg.enable { - networking.firewall.allowedTCPPorts = [ 80 443 ]; + networking.firewall.allowedTCPPorts = [ + 80 + 443 + ]; services.nginx = { enable = true; diff --git a/modules/xnet/persist.nix b/modules/xnet/persist.nix index 10eb883..5e69bae 100644 --- a/modules/xnet/persist.nix +++ b/modules/xnet/persist.nix @@ -10,39 +10,42 @@ let in { options.xnet.persist = mkOption { - type = types.listOf (types.either - types.str - (types.submodule { - options = { - path = mkOption { - type = types.str; - description = "Path to persist"; - }; - user = mkOption { - type = types.nullOr types.str; - default = null; - description = "User ID to set on the persisted directory"; - }; - group = mkOption { - type = types.nullOr types.str; - default = null; - description = "Group ID to set on the persisted directory"; - }; + type = types.listOf ( + types.either types.str ( + types.submodule { + options = { + path = mkOption { + type = types.str; + description = "Path to persist"; + }; + user = mkOption { + type = types.nullOr types.str; + default = null; + description = "User ID to set on the persisted directory"; + }; + group = mkOption { + type = types.nullOr types.str; + default = null; + description = "Group ID to set on the persisted directory"; + }; - mode = mkOption { - type = types.nullOr types.str; - default = null; - description = "Permissions to set"; + mode = mkOption { + type = types.nullOr types.str; + default = null; + description = "Permissions to set"; + }; }; - }; - })); + } + ) + ); default = [ ]; description = "Automatically persisted state."; }; config.systemd.tmpfiles.rules = let - mkEntry = entry: + mkEntry = + entry: let path = if isString entry then entry else entry.path; user = if isString entry then "-" else entry.user; @@ -53,7 +56,11 @@ in link = "L+ ${path} - - - - /persist${path}"; perm = "Z ${mode} ${user} ${group} - -"; in - [ dent link perm ]; + [ + dent + link + perm + ]; entries = map mkEntry config.xnet.persist; in diff --git a/packages/randpass.nix b/packages/randpass.nix index ef8fe91..4cb5128 100644 --- a/packages/randpass.nix +++ b/packages/randpass.nix @@ -4,5 +4,4 @@ { writeShellScriptBin, ... }: -writeShellScriptBin "randpass" - ''tr -dc '[:alnum:]' Date: Sat, 3 Oct 2026 22:05:36 -0700 Subject: bump nixpkgs again and fix other flake refs --- flake.lock | 8 ++++---- machines/feneri.nix | 33 +++++++++++++++++++++++++++++---- machines/t1.nix | 1 + modules/desktop.nix | 2 -- modules/disk.nix | 2 -- modules/network.nix | 5 ++++- modules/xnet/default.nix | 8 ++++++-- 7 files changed, 44 insertions(+), 15 deletions(-) (limited to 'modules') diff --git a/flake.lock b/flake.lock index 615c445..62d1fb2 100644 --- a/flake.lock +++ b/flake.lock @@ -23,11 +23,11 @@ }, "nixpkgs": { "locked": { - "lastModified": 1790822859, - "narHash": "sha256-VBA0QerzzmL+4wxgtwiCdiLwLpJg2/9xOxhgO3BRJQA=", - "rev": "c59305bab2065cfecc4944690d9eedbb56f3a9fa", + "lastModified": 1791048980, + "narHash": "sha256-u3KCLxsnf1622GdFccg8hmkEIutOZ1h4pvia5ERjIuI=", + "rev": "a7868a727837f3c09cee2ce0ca671c76b1589fed", "type": "tarball", - "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1083223.c59305bab206/nixexprs.tar.zst" + "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1084968.a7868a727837/nixexprs.tar.zst" }, "original": { "type": "tarball", diff --git a/machines/feneri.nix b/machines/feneri.nix index e75738b..605159e 100644 --- a/machines/feneri.nix +++ b/machines/feneri.nix @@ -1,9 +1,7 @@ -{ flake, modulesPath, ... }: +{ config, modulesPath, ... }: { imports = [ - # flake.outputs.nixosModules.disk - # flake.outputs.nixosModules.network (modulesPath + "/profiles/qemu-guest.nix") (modulesPath + "/virtualisation/qemu-guest-agent.nix") ]; @@ -44,5 +42,32 @@ }; }; - networking.hostName = "feneri"; + services.hydra = { + enable = true; + hydraURL = "https://hydra.web.4kb.net"; + notificationSender = "hydra@localhost"; + buildMachinesFiles = []; + useSubstitutes = true; + }; + + services.nginx.virtualHosts."hydra.web.4kb.net" = { + useACMEHost = "4kb.net"; + forceSSL = true; + + locations."/".proxyPass = "http://localhost:${toString config.services.hydra.port}"; + }; + + nix.settings.allowed-uris = [ + "git+https://github.com/NixOS/nixpkgs/" + "https://channels.nixos.org/" + "https://releases.nixos.org/nixos/" + ]; + + systemd.services.hydra-notify.enable = false; + + networking = { + hostName = "feneri"; + domain = "4kb.net"; + useDHCP = false; + }; } diff --git a/machines/t1.nix b/machines/t1.nix index d8d749b..3a46494 100644 --- a/machines/t1.nix +++ b/machines/t1.nix @@ -19,6 +19,7 @@ desktop.enable = true; users.kle.enable = true; net = { + enable = true; v6Token = "::beef"; sshd.enable = true; sshd.publish = true; diff --git a/modules/desktop.nix b/modules/desktop.nix index 747c302..b098020 100644 --- a/modules/desktop.nix +++ b/modules/desktop.nix @@ -38,8 +38,6 @@ in # Spell checking aspell aspellDicts.en - aspellDicts.en-science - aspellDicts.en-computers hunspell hunspellDicts.en-us diff --git a/modules/disk.nix b/modules/disk.nix index bf4a9a8..a8f7fbf 100644 --- a/modules/disk.nix +++ b/modules/disk.nix @@ -61,7 +61,6 @@ in kernelParams = [ "nohibernate" "elevator=none" - "rd.systemd.unit=rescue.target" ]; supportedFilesystems = [ "vfat" @@ -145,7 +144,6 @@ in ''; }; - boot.initrd.systemd.emergencyAccess = true; boot.initrd.systemd.initrdBin = [ pkgs.cloud-utils pkgs.util-linux diff --git a/modules/network.nix b/modules/network.nix index 8264102..e9383c2 100644 --- a/modules/network.nix +++ b/modules/network.nix @@ -3,6 +3,8 @@ let cfg = config.depot.net; inherit (lib) mkOption + mkEnableOption + mkIf types ; @@ -27,6 +29,7 @@ in ]; options.depot.net = { + enable = mkEnableOption "depot networking"; v6Token = mkOption { type = types.str; default = "eui64"; @@ -34,7 +37,7 @@ in }; }; - config = { + config = mkIf cfg.enable { # networkd handles this networking.useDHCP = false; diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix index 67bbbe5..415fc0b 100644 --- a/modules/xnet/default.nix +++ b/modules/xnet/default.nix @@ -45,14 +45,15 @@ in time.timeZone = mkDefault "US/Pacific"; nix = { - nixPath = mkForce [ "nixpkgs=${pkgs.path}" ]; settings = { auto-optimise-store = true; + nix-path = mkForce [ "nixpkgs=${pkgs.path}" ]; experimental-features = [ "nix-command" "flakes" "pipe-operators" ]; + warn-dirty = false; # timeout fast from binary cache @@ -62,7 +63,7 @@ in automatic = true; options = mkDefault "--delete-older-than 30d"; }; - # registry.nixpkgs.flake = pkgs.path; + registry.nixpkgs.flake.outPath = "path:${pkgs.path}"; }; documentation = { @@ -99,6 +100,9 @@ in "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFmWInQNT6EoU1NtUYzTs5jtpfbO/m6yvCckOiEGjvDc"; }; extraConfig = '' + Host * + SetEnv TERM=xterm-256color + Host github HostName github.com User git -- cgit v1.3.1 From 27db59cac4f3c3e7a1e4187a5f56d4ec61895c5a Mon Sep 17 00:00:00 2001 From: Kleidi Bujari Date: Sat, 3 Oct 2026 22:05:36 -0700 Subject: cv change --- machines/feneri.nix | 17 ++++ modules/xnet/default.nix | 2 +- modules/xnet/gitserver/gitweb.nix | 1 + packages/misc/cv/cv.typ | 174 ++++++++++++-------------------------- 4 files changed, 74 insertions(+), 120 deletions(-) (limited to 'modules') diff --git a/machines/feneri.nix b/machines/feneri.nix index 605159e..edd0922 100644 --- a/machines/feneri.nix +++ b/machines/feneri.nix @@ -27,6 +27,23 @@ sshd.enable = true; }; + systemd.network = { + enable = true; + networks."30-wan" = { + matchConfig = { + Type = "ether"; + MACAddress = "8a:33:83:f4:b1:80"; + }; + linkConfig.RequiredForOnline = true; + networkConfig.Description = "WAN"; + address = [ "152.53.193.118/22" "2a0a:4cc0:2000:bfbf::1/64" ]; + routes = [ + { Gateway = "152.53.192.1"; } + { Gateway = "fe80::1"; } + ]; + }; + }; + security.acme = { acceptTerms = true; defaults.email = "certs@4kb.net"; diff --git a/modules/xnet/default.nix b/modules/xnet/default.nix index 415fc0b..020accb 100644 --- a/modules/xnet/default.nix +++ b/modules/xnet/default.nix @@ -63,7 +63,7 @@ in automatic = true; options = mkDefault "--delete-older-than 30d"; }; - registry.nixpkgs.flake.outPath = "path:${pkgs.path}"; + registry.nixpkgs.flake.outPath = pkgs.path; }; documentation = { diff --git a/modules/xnet/gitserver/gitweb.nix b/modules/xnet/gitserver/gitweb.nix index f7a8bc7..6473183 100644 --- a/modules/xnet/gitserver/gitweb.nix +++ b/modules/xnet/gitserver/gitweb.nix @@ -58,6 +58,7 @@ in root-desc = "What I cannot create, I do not understand"; root-title = cfg.hostName; section-from-path = true; + scan-hidden-path = true; snapshots = "tar.gz tar.bz2 zip"; }; }; diff --git a/packages/misc/cv/cv.typ b/packages/misc/cv/cv.typ index c4ddba6..df70f67 100644 --- a/packages/misc/cv/cv.typ +++ b/packages/misc/cv/cv.typ @@ -1,156 +1,92 @@ #set document(author: "Kleidi Bujari", title: "Kleidi's Resume!") #set text(size: 10pt, lang: "en", ligatures: false) -#set page(margin: 1in, paper: "us-letter") +#set page(paper: "us-letter") -#show link: underline #set par(justify: true) -#show heading.where(level: 1): it => [ - #set text(weight: 700, size: 20pt) - #pad(it.body) -] - #show heading.where(level: 2): it => [ - #pad(top: 5pt, bottom: -10pt, [#smallcaps(it.body)]) - #line(length: 100%, stroke: 0.5pt) + #pad(top: 8pt, bottom: 5pt, [#smallcaps(it.body)]) ] -#let generic-headline( - left: "", - right: "", - description: "", -) = [#strong(left), #description #h(1fr) #right] +#let item( + place: "", + title: "", + dates: "", + descr: "", +) = stack( + dir: ttb, + grid( + columns: (0.5fr, 1fr), + dates, + stack(dir: ttb, spacing: 6pt, place, title, descr) + ), + v(0.75em) +) #let dates-helper(from: "", to: "") = from + " " + $dash.em$ + " " + to -#let edu( - institution: "", - dates: "", - degree: "", -) = generic-headline( - left: institution, - description: degree, - right: dates, +#stack( + dir: ttb, + spacing: 1em, + [= Kleidi Bujari], + link("mailto:kleidi@4kb.net"), ) -#let work( - title: "", - dates: "", - company: "", -) = generic-headline( - left: company, - description: title, - right: dates, -) - -= Kleidi Bujari - -#( - link("mailto:kleidi@4kb.net"), - link("https://github.com/kbujari")[github.com/kbujari], - link("http://kleidi.ca")[kleidi.ca], -).join(" | ") +== Work Experience -== Experience - -#work( - company: "Meta", - title: "Production Software Engineer", - dates: dates-helper(from: "Aug 2025", to: "Present"), +#item( + place: [Tesla (#link("https://tesla.com")[tesla.com])], + title: "Senior Software Engineer, Distributed Systems", + dates: dates-helper(from: "Sep 2026", to: "present"), + descr: "Developer tooling and build infrastructure" ) -- Analyzed Linux schedulers for Erlang/BEAM workloads, - building kernel scheduler observability used across Meta. -- Led team designing scalable AWS/EKS infrastructure fighting internet censorship and poor network conditions. -- Built runtime type-checking for trillions of WhatsApp packets, - solving entire class of account ID problems. -- Primary oncall for WhatsApp distributed system, - improving reliability and mentoring engineers in debugging. - -#work( - company: "Toronto Metropolitan University", - title: "Graduate Research Assistant", - dates: dates-helper(from: "May 2024", to: "Sep 2024"), +#item( + place: [Meta (#link("https://meta.com")[meta.com])], + title: "Production Software Engineer", + dates: dates-helper(from: "Aug 2025", to: "Aug 2026"), + descr: "Type-checkers and distributed system reliability." ) -- Organized webhosting and data analytics for a film release, - with thousands of concurrent visitors. -- Built transformation pipeline for hundreds of media files, - using unix primitives to parallelize workload. - -#work( - company: "Canadian Broadcasting Corporation", - title: "Systems Engineering Intern", - dates: dates-helper(from: "May 2023", to: "Apr 2024"), +#item( + place: [Toronto Metropolitan University (#link("https://torontomu.ca")[torontomu.ca])], + title: "Graduate Research Assistant", + dates: dates-helper(from: "May 2024", to: "Sep 2024"), + descr: "Fast content delivery for documents and media." ) -- Built custom PXE-based provisioning for hundreds of devices on network, - eliminating manual configuration. -- Architected VM cluster for 2024 Olympics handling all Canadian broadcasts, - saving \$250k+ with reused hardware. - -#work( - company: "WSP Canada", - title: "Student Engineer", - dates: dates-helper(from: "May", to: "Aug") + ", 2021, 2022", +#item( + place: [Canadian Broadcasting Corporation (#link("https://cbc.ca")[cbc.ca])], + title: "Systems Engineering Intern", + dates: dates-helper(from: "May 2023", to: "May 2024"), + descr: "Datacenter bringup and SDN automation." ) -- Validated large scale electrical distribution for power consumption and cost efficiency. -- Extended internal databases with compression and deduplication, - reclaiming terabytes of storage. - -== Selected Projects - -*Custom Linux Distribution* --- -Designed entire Linux distribution used for hosting production servers, -daily desktop use, and embedded programming on a Raspberry Pi. -Using NixOS, it supports enabling only required functionality at build time. -Features systemd, -an in-memory root filesystem, -ZFS persistent storage with backups, -and extremely hardened networking. - -*Distributed Compute Cluster* --- -Bare-metal Kubernetes cluster managed with GitOps to be completely reproducible. -Uses Cilium CNI for fast eBPF networking and BGP load balancing, -FluxCD for cluster management, -and CEPH distributed storage for stateful workloads. -Air-gapped, automated cluster provisioning with custom PXEBOOT images. - -*ICER Compressor* --- -Image compression library written in Rust, -designed for deep-space communication. -Hand tuned for speed and portability by using only integer arithmetic, -no heap allocations, and no standard library by default. -Achieves practically instant compressions, even on microprocessors. - == Education -#edu( - institution: "Toronto Metropolitan University", - dates: dates-helper(from: "Sep 2020", to: "Apr 2025"), - degree: "B. Eng, Computer Engineering", +#item( + place: "Toronto Metropolitan University", + dates: dates-helper(from: "2020", to: "2025"), + title: "Bachelors of Engineering, Computer Engineering", ) -- *Relevant Coursework*: - Data Structures, FPGA Programming, Compilers, Computer Networks -- *Extracurriculars*: - Student-led robotics design team, - teaching assistant for micro-processor courses. +== Selected Projects + +- *Depot*: Custom systemd-based Linux distribution built on nixpkgs. +- *Hint*: Interpreted language and package manager written in Haskell. == Skills - *Languages*: #( - "Rust", "Haskell", - "C++", + "Rust", "Erlang", - "Nix", - "Scheme", + "C++", + "Python" ).join(", ") - *Technologies*: #( - "Distributed Systems", "Compilers", + "Distributed Systems", + "Build Systems", "Virtualization", - "Reproducible Builds", ).join(", ") -- cgit v1.3.1