Add a nix-darwin config for a m1 mac mini.

Seeing if this is what is causing all my issues with files/directories in the nix store going missing.

nix/configuration/configuration.nix

@@ -36,6 +36,7 @@ in
     ./roles/emacs
     ./roles/emulate_isa
     ./roles/esim
+    ./roles/exfat
     ./roles/firefox
     ./roles/firewall
     ./roles/flux
@@ -117,14 +118,14 @@ in
     nix.settings.experimental-features = [
       "nix-command"
       "flakes"
-      "ca-derivations"
+      # "ca-derivations"
       # "blake3-hashes"
       # "git-hashing"
     ];
     nix.settings.trusted-users = [ "@wheel" ];
     nix.settings.connect-timeout = 5;
-    nix.settings.min-free = 128000000;
-    nix.settings.max-free = 1000000000;
+    nix.settings.min-free = 5 * 1024 * 1024 * 1024; # Kick off garbage collect if space for nix store is less than 5 GiB
+    nix.settings.max-free = 10 * 1024 * 1024 * 1024; # Run that garbage collect until at least 10 GiB are free.
     nix.settings.fallback = true;
     nix.settings.warn-dirty = false;
     nix.settings.fsync-metadata = true;

nix/configuration/flake.lock

@@ -170,11 +170,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1783278211,
-        "narHash": "sha256-/1u+MIQIge+cNPukQoK4Jp8nLuFZRbx4U+MyyxG0RpM=",
+        "lastModified": 1786250497,
+        "narHash": "sha256-OPhVT5n9OyPDZA3mIO6D5jVVvp/QmG8nT5Trb0gouSs=",
         "ref": "refs/heads/main",
-        "rev": "9281ba7e10d362d4edb489d0df0e78936dfe7b58",
-        "revCount": 32,
+        "rev": "0a270dcbdd51baa2895634a3baee29373db8337a",
+        "revCount": 42,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/nix_builder.git"
       },

nix/configuration/hosts/family_disks/distributed_build.nix

@@ -4,16 +4,19 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable = false;
+      enable_build = false;
+      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
     me.distributed_build.machines.hydra = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = true;
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/hydra/default.nix

@@ -129,6 +129,8 @@
     # systemd.user.extraConfig = "DefaultLimitNOFILE=8192";
     # systemd.services."user@11400".serviceConfig.LimitNOFILE = "8192";
 
+    nix.settings.secret-key-files = [ "/persist/manual/nix/nix-cache-key.sec" ];
+
     me.build_in_ram.enable = true;
     me.dont_use_substituters.enable = true;
     me.hydra.enable = true;

nix/configuration/hosts/i_only_boot_zfs/distributed_build.nix

@@ -4,10 +4,19 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
+    me.distributed_build.machines.hydra = {
+      enable_build = false;
+      enable_substituter = true;
+      additional_config = {
+        speedFactor = 2;
+      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+    };
   };
 }

nix/configuration/hosts/odo/default.nix

@@ -94,6 +94,7 @@
     me.emacs_flavor = "full";
     me.emulate_isa.enable = true;
     me.esim.enable = true;
+    me.exfat.enable = true;
     me.firefox.enable = true;
     me.firewall.enable = true;
     me.flux.enable = true;
@@ -164,7 +165,7 @@
     me.zrepl.enable = true;
     me.zsh.enable = true;
 
-    me.sm64ex.enable = true;
+    me.sm64ex.enable = false;
     me.shipwright.enable = false;
     me.ship2harkinian.enable = true;
   };

nix/configuration/hosts/odo/distributed_build.nix

@@ -4,16 +4,19 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable = false;
+      enable_build = true;
+      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
     me.distributed_build.machines.hydra = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = true;
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/odowork/distributed_build.nix

@@ -4,16 +4,19 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable = false;
+      enable_build = false;
+      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
     me.distributed_build.machines.hydra = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = true;
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/quark/default.nix

@@ -159,7 +159,7 @@
     me.zrepl.enable = true;
     me.zsh.enable = true;
 
-    me.sm64ex.enable = true;
+    me.sm64ex.enable = false;
     me.shipwright.enable = false;
     me.ship2harkinian.enable = true;
   };

nix/configuration/hosts/quark/distributed_build.nix

@@ -3,11 +3,20 @@
 
   config = {
     me.distributed_build.enable = true;
-    me.distributed_build.machines.hydra = {
-      enable = true;
+    me.distributed_build.machines.quark = {
+      enable_build = false;
+      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
+    me.distributed_build.machines.hydra = {
+      enable_build = false;
+      enable_substituter = true;
+      additional_config = {
+        speedFactor = 2;
+      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+    };
   };
 }

nix/configuration/hosts/recovery/distributed_build.nix

@@ -4,10 +4,19 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = false;
       additional_config = {
         speedFactor = 2;
       };
     };
+    me.distributed_build.machines.hydra = {
+      enable_build = false;
+      enable_substituter = true;
+      additional_config = {
+        speedFactor = 2;
+      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+    };
   };
 }

nix/configuration/roles/distributed_build/default.nix

@@ -10,7 +10,14 @@
 
 let
   make_machine_config = name: {
-    enable = lib.mkOption {
+    enable_build = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to use the ${name} machine during distributed builds.";
+    };
+
+    enable_substituter = lib.mkOption {
       type = lib.types.bool;
       default = false;
       example = true;
@@ -59,25 +66,35 @@ let
       hostName = lib.mkForce "hydra?remote-store=local?root=/.disk/root";
     };
   };
-  joined_configs =
-    lib.genAttrs
-      (builtins.filter (hostname: config.me.distributed_build.machines."${hostname}".enable) (
-        builtins.attrNames all_nixos_configs
-      ))
-      (
+  build_machine_list = (
+    map (
       hostname:
-        (lib.mkMerge [
+      (lib.mkIf config.me.distributed_build.machines."${hostname}".enable_build (
+        lib.mkMerge [
           {
             hostName = hostname;
             sshUser = "nixworker";
             sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
             maxJobs = 1;
             supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
+            protocol = "ssh-ng";
           }
           static_host_configs."${hostname}"
           config.me.distributed_build.machines."${hostname}".additional_config
-        ])
+        ]
+      ))
+    ) (builtins.attrNames all_nixos_configs)
   );
+  substituters_list = (
+    map (
+      hostname:
+      (lib.mkIf (
+        config.me.distributed_build.machines."${hostname}".enable_substituter
+        && config.me.distributed_build.machines."${hostname}".substituter_url != null
+      ) (config.me.distributed_build.machines."${hostname}".substituter_url))
+    ) (builtins.attrNames all_nixos_configs)
+  );
+  has_any_substituters = substituters_list != [ ];
 in
 {
   imports = [ ];
@@ -117,35 +134,17 @@ in
           "odo:0S/XKSFjjIrihQ7lbHEIebXk/c/xuoodhm0Gz26YhjA="
           "odowork:zg3UKBAyLy3xtZkL0hMtbxHjxgn5A2QY8NNAgyRT6Yo="
           "quark:Eb6ygkIiVlcUqb5hOjEVIQcfYLpCz40YVYA3/rxrgBc="
+          "hydra:1s4Cy9YJLgw4jWx5jdSCfJmIm0hfya7WEy/EwJYI5Ys="
+          "garak:8nUS6/aHl+FmF518WZlG4DzDToQ3fSNnpHR+aFQmkqc="
         ];
       }
       {
-        nix.buildMachines = (
-          map (
-            hostname:
-            (lib.mkIf config.me.distributed_build.machines."${hostname}".enable (
-              lib.mkMerge [
-                {
-                  hostName = hostname;
-                  sshUser = "nixworker";
-                  sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
-                  maxJobs = 1;
-                  supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
-                  protocol = "ssh-ng";
+        nix.buildMachines = build_machine_list;
       }
-                static_host_configs."${hostname}"
-                config.me.distributed_build.machines."${hostname}".additional_config
-              ]
-            ))
-          ) (builtins.attrNames all_nixos_configs)
-        );
-      }
-      # {
-      #   nix.settings.substitute = lib.mkForce true;
-      #   nix.settings.substituters = lib.mkForce (
-      #     lib.mapAttrsToList (hostname: joined_config: "ssh-ng://${joined_config.hostName}") joined_configs
-      #   );
-      # }
+      (lib.mkIf has_any_substituters {
+        nix.settings.substitute = lib.mkForce true;
+        nix.settings.substituters = lib.mkForce substituters_list;
+      })
     ]
   );
 }

nix/configuration/roles/exfat/default.nix

@@ -0,0 +1,26 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  options.me = {
+    exfat.enable = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to install exfat.";
+    };
+  };
+
+  config = lib.mkIf config.me.exfat.enable {
+    # boot.supportedFilesystems = [ "exfat" ];
+    environment.systemPackages = with pkgs; [
+      exfatprogs
+    ];
+  };
+}

nix/configuration/roles/hydra/default.nix

@@ -61,6 +61,7 @@
     systemd.services."build-cache" =
       let
         enabled_targets = [
+          "wip"
           "odo"
           "odo_update"
           "odowork"
@@ -83,7 +84,10 @@
           "worker2_update"
           "family_disks"
           "family_disks_update"
-          # "nixbsd" # Disabled due to onetbb tests hanging on one-cpu machines.
+          "nixbsd"
+          "nix_builder_develop"
+          "organic_develop"
+          "natter_develop"
         ];
         build_flags = lib.concatMap (target: [
           "--target"

nix/configuration/roles/hydra/files/nix_builder.toml

@@ -1,5 +1,12 @@
 output_directory = "/home/nixworker/persist/nix_builder"
 
+[[targets]]
+  name = "wip"
+  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
+  branch = "wip"
+  path = "nix/configuration"
+  attr = "nixosConfigurations.odo.config.system.build.toplevel"
+
 [[targets]]
   name = "odo"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
@@ -67,98 +74,98 @@ output_directory = "/home/nixworker/persist/nix_builder"
 [[targets]]
   name = "controller0"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller0.vm_iso"
 
 [[targets]]
   name = "controller0_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller0.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "controller1"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller1.vm_iso"
 
 [[targets]]
   name = "controller1_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller1.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "controller2"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller2.vm_iso"
 
 [[targets]]
   name = "controller2_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller2.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "worker0"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker0.vm_iso"
 
 [[targets]]
   name = "worker0_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker0.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "worker1"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker1.vm_iso"
 
 [[targets]]
   name = "worker1_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker1.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "worker2"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker2.vm_iso"
 
 [[targets]]
   name = "worker2_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker2.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 # TODO: Add steam deck
 
@@ -178,9 +185,30 @@ output_directory = "/home/nixworker/persist/nix_builder"
   update = true
   update_branch = "nix_update"
 
-# [[targets]]
-#   name = "nixbsd"
-#   repo = "https://github.com/nixos-bsd/nixbsd.git"
-#   revision = "828ff7a3c4ee91f548de65a963fca40eaedb171c"
-#   path = "."
-#   attr = "base.vmClosureInfo"
+[[targets]]
+  name = "nixbsd"
+  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
+  branch = "nixbsd"
+  path = "nix/nixbsd"
+  attr = "computer.vm"
+
+[[targets]]
+  name = "nix_builder_develop"
+  repo = "https://code.fizz.buzz/talexander/nix_builder.git"
+  branch = "main"
+  path = "."
+  attr = "devShells.x86_64-linux.default"
+
+[[targets]]
+  name = "organic_develop"
+  repo = "https://code.fizz.buzz/talexander/organic.git"
+  branch = "main"
+  path = "."
+  attr = "devShells.x86_64-linux.default"
+
+[[targets]]
+  name = "natter_develop"
+  repo = "https://code.fizz.buzz/talexander/natter.git"
+  branch = "main"
+  path = "."
+  attr = "devShells.x86_64-linux.default"

nix/configuration/roles/network/default.nix

@@ -56,6 +56,7 @@ in
     # TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
     networking.extraHosts = ''
       127.0.0.1 ${config.networking.hostName}.home.arpa
+      127.0.0.3 metadata.google.internal
       10.216.1.32		homeserver
       fdfd:5e8a:ee2d::1:32	homeserver
       10.216.1.6		media
@@ -67,7 +68,15 @@ in
       10.217.1.1		drmario
       10.217.2.1		mrmanager
       fdfd:5e8a:ee2d::2:2 mrmanager
+      172.16.16.1		unifi
+      172.16.16.231		plug1
+      172.16.16.232		plug2
+      172.16.16.233		plug3
+      172.16.16.234		plug4
+      172.16.16.235		temperature1
+      172.16.16.236		temperature2
       172.16.16.245		turtle
+      172.16.16.250		sauna
       172.16.16.251		stream
     '';
 

nix/configuration/roles/podman/default.nix

@@ -50,6 +50,23 @@
       DOCKER_HOST = "unix://$XDG_RUNTIME_DIR/podman/podman.sock";
     };
 
+    # Increase subuid / subgid to support running buildkit-rootless
+    # ref: https://github.com/moby/buildkit/issues/3297
+    users.users.talexander = {
+      subUidRanges = [
+        {
+          startUid = 100000;
+          count = 262144; # default = 65536
+        }
+      ];
+      subGidRanges = [
+        {
+          startGid = 100000;
+          count = 262144; # default = 65536
+        }
+      ];
+    };
+
     environment.persistence."/state" = lib.mkIf (config.me.mountPersistence) {
       hideMounts = true;
       directories = [

nix/configuration/roles/rpcs3/default.nix

@@ -81,6 +81,10 @@ in
         # Demon's Souls per-game config.
         source = ./files/config_BLUS30443.yml;
       };
+      ".config/rpcs3/custom_configs/config_BLUS30421.yml" = {
+        # The Lord of the Rings The War in the North per-game config.
+        source = ./files/config_BLUS30421.yml;
+      };
       ".config/rpcs3/patches/patch.yml" = {
         # All of the available patches.
         source = ./files/patch.yml;

nix/configuration/roles/rpcs3/files/config_BLUS30421.yml

@@ -0,0 +1,14 @@
+Core:
+  SPU Block Size: Safe
+Video:
+  Write Color Buffers: true
+  Minimum Scalable Dimension: 640
+Net:
+  Internet enabled: Connected
+  IP address: 0.0.0.0
+  Bind address: 0.0.0.0
+  DNS address: 8.8.8.8
+  IP swap list: ""
+  UPNP Enabled: false
+  PSN status: RPCN
+  PSN Country: us

nix/configuration/roles/wine/default.nix

@@ -20,8 +20,9 @@
   config = lib.mkIf (config.me.wine.enable && config.me.graphical) {
     environment.systemPackages = with pkgs; [
       # wineWowPackages.stable # supports 32 + 64 bit
-      wineWowPackages.waylandFull # Supports 32 + 64 bit with native wayland support.
+      wineWow64Packages.waylandFull # Supports 32 + 64 bit with native wayland support.
       # winetricks
+      # lutris
     ];
   };
 }

nix/kubernetes/configuration.nix

@@ -41,7 +41,7 @@
     nix.settings.experimental-features = [
       "nix-command"
       "flakes"
-      "ca-derivations"
+      # "ca-derivations"
       # "blake3-hashes"
       # "git-hashing"
     ];

nix/kubernetes/flake.lock

@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780290312,
-        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
         "type": "github"
       },
       "original": {
@@ -164,11 +164,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780749050,
-        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "lastModified": 1784120854,
+        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
         "type": "github"
       },
       "original": {

nix/kubernetes/keys/package/deploy-script/package.nix

@@ -66,6 +66,12 @@ let
         group = "26";
         mode = "0755";
       }
+      {
+        path = "manual-pv/ncps-psql";
+        owner = "26";
+        group = "26";
+        mode = "0755";
+      }
       # {
       #   path = "manual-pv/gitea";
       #   owner = "1000";

nix/kubernetes/keys/package/mrmanager-repo-secrets/package.nix

@@ -63,6 +63,7 @@ let
               username = builtins.readFile "${./secrets/flux-system/registry-credentials/username}";
               password = builtins.readFile "${./secrets/flux-system/registry-credentials/password}";
               email = builtins.readFile "${./secrets/flux-system/registry-credentials/email}";
+              address = builtins.readFile "${./secrets/flux-system/registry-credentials/address}";
             })
             // {
               # "__annotations" = {
@@ -103,6 +104,11 @@ let
         "homepage-staging" = {
           "oauth2-env" = oauth2_env { dex_id = "homepage-staging"; };
         };
+        "nix-pull-through-cache" = {
+          "auth" = {
+            "CACHE_GET_TOKEN" = (builtins.readFile "${./secrets/nix-pull-through-cache/auth/CACHE_GET_TOKEN}");
+          };
+        };
         "tekton-gateway" = {
           "oauth2-env" = oauth2_env { dex_id = "tekton"; };
         };
@@ -125,6 +131,9 @@ let
           "harbor-plain" = {
             "config.json" = (builtins.readFile "${./secrets/webhook-bridge/harbor-plain/config.json}");
           };
+          "nix-pull-through-cache" = {
+            "CACHE_GET_TOKEN" = (builtins.readFile "${./secrets/nix-pull-through-cache/auth/CACHE_GET_TOKEN}");
+          };
         };
       };
   encrypted_secrets = (
@@ -199,16 +208,21 @@ let
       username,
       password,
       email,
+      address,
     }:
     let
     in
     {
       "__type" = "kubernetes.io/dockerconfigjson";
       ".dockerconfigjson" = builtins.toJSON {
+        auths = {
+          "${address}" = {
             inherit username password email;
             "auth" = toBase64 "${username}:${password}";
           };
         };
+      };
+    };
   ## dex
   get_dex_config =
     client_id:

nix/kubernetes/roles/kubelet/default.nix

@@ -48,6 +48,12 @@ let
       "fd00:3e42:e349::10"
     ];
     imageMaximumGCAge = "24h"; # Delete unused images after 1 day.
+    imageGCHighThresholdPercent = 80;
+    imageGCLowThresholdPercent = 70;
+    evictionHard = {
+      "nodefs.available" = "5%";
+      "imagefs.available" = "10%";
+    };
   };
   kubelet_config_file = (to_yaml_file "kubelet-config.yaml" kubelet_config);
 in

nix/nix-darwin/flake.lock

@@ -0,0 +1,49 @@
+{
+  "nodes": {
+    "nix-darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785389976,
+        "narHash": "sha256-0tLW8Ff5yt8AH97jw4ZpFJ0OCJ122zIlgWGDmOfU/VU=",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "rev": "15abb8c98f336cd8bd840d71059adebabe60bf04",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-darwin",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1786348146,
+        "narHash": "sha256-we5zDEFfn8TgzeWKjKDMIjeQZ59omEPl23NIF+13/ys=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "d482ef84049d9b7276b83a06e4e4d76983830097",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nix-darwin": "nix-darwin",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

nix/nix-darwin/flake.nix

@@ -0,0 +1,128 @@
+# Initial install:
+#   Install nix: https://github.com/nixOS/nix-installer
+#   sudo nix run nix-darwin -- switch --flake .#garak
+#
+# Update after that:
+#   sudo darwin-rebuild switch --flake .#garak
+#
+# Manual:
+#   Install rosetta to run x86_64 programs:
+#   softwareupdate --install-rosetta --agree-to-license
+#
+#   Install homebrew for installing graphical apps:
+#   /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+{
+  description = "nix-darwin system flake";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    nix-darwin.url = "github:nix-darwin/nix-darwin/master";
+    nix-darwin.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = inputs@{ self, nix-darwin, nixpkgs }:
+  let
+    configuration = { pkgs, ... }: {
+      # List packages installed in system profile. To search by name, run:
+      # $ nix-env -qaP | grep wget
+      environment.systemPackages =
+        [
+          pkgs.tmux
+          pkgs.htop
+          pkgs.git
+        ];
+
+      # Necessary for using flakes on this system.
+      nix.settings.experimental-features = "nix-command flakes";
+
+      # Enable alternative shell support in nix-darwin.
+      # programs.fish.enable = true;
+
+      # Set Git commit hash for darwin-version.
+      system.configurationRevision = self.rev or self.dirtyRev or null;
+
+      # Used for backwards compatibility, please read the changelog before changing.
+      # $ darwin-rebuild changelog
+      system.stateVersion = 6;
+
+      # The platform the configuration will be used on.
+      nixpkgs.hostPlatform = "aarch64-darwin";
+
+      # Identifies which user some settings apply to.
+      system.primaryUser = "talexander";
+
+      # Enable Linux VM for building Linux binaries.
+      #
+      # Test with:
+      #   nix build --impure --expr '(with import <nixpkgs> { system = "aarch64-linux"; }; runCommand "foo" {} "uname -a > $out")'
+      nix.linux-builder.enable = true;
+
+      # system.defaults.CustomUserPreferences = {
+      #   "com.apple.desktopservices" = {
+      #     # Do not write .DS_Store files to external volumes
+      #     DSDontWriteNetworkStores = true;
+      #     DSDontWriteUSBStores = true;
+      #   };
+      #   "com.apple.screensaver" = {
+      #     # Ask for password when returning from screensaver
+      #     askForPassword = 1;
+      #     askForPasswordDelay = 0;
+      #   };
+      #   "com.apple.SoftwareUpdate" = {
+      #     AutomaticCheckEnabled = true;
+      #     # Download updates in the background
+      #     AutomaticDownload = 1;
+      #   };
+      # };
+
+      # Use homebrew to install graphical apps from casks.
+      # homebrew = {
+      #   enable = false;
+
+      #   casks = [
+      #     "firefox"
+      #   ];
+      # };
+
+      # system.defaults = {
+      #   dock = {
+      #     autohide = true;
+      #   };
+      # };
+
+      environment.variables = {
+        TERMINFO_DIRS = ["${pkgs.alacritty.terminfo.outPath}/share/terminfo"];
+      };
+
+      power = {
+        sleep = {
+          # sudo pmset -a displaysleep 10 sleep 0 disksleep 10
+          # Other options to consider: lowpowermode 0 standby 0 hibernatemode 0 powernap 0
+          #
+          # Defaults:
+          #   standby              0
+          #   Sleep On Power Button 1
+          #   autorestartatconnect 0
+          #   autorestart          0
+          #   powernap             1
+          #   networkoversleep     0
+          #   disksleep            10
+          #   sleep                1
+          #   ttyskeepawake        1
+          #   displaysleep         10
+          #   tcpkeepalive         1
+          #   womp                 1
+          #
+          computer = "never";
+          display = 10;
+          harddisk = 10;
+        };
+      };
+    };
+  in
+  {
+    darwinConfigurations."garak" = nix-darwin.lib.darwinSystem {
+      modules = [ configuration ];
+    };
+  };
+}