Add an install of nixbsd.

Trust garak's signing key.
Separate enabling distributed build vs substituters.
2026-08-08 16:18:41 -04:00 · 2026-08-07 15:48:09 -04:00 · 2026-08-05 17:54:38 -04:00 · 2026-08-04 21:39:54 -04:00 · 2026-07-28 10:20:18 -04:00 · 2026-07-28 08:22:47 -04:00
20 changed files with 518 additions and 84 deletions
--- a/nix/configuration/flake.lock
+++ b/nix/configuration/flake.lock
@@ -170,11 +170,11 @@
        "rust-overlay": "rust-overlay_2"
      },
      "locked": {
-        "lastModified": 1783278211,
-        "narHash": "sha256-/1u+MIQIge+cNPukQoK4Jp8nLuFZRbx4U+MyyxG0RpM=",
+        "lastModified": 1785893798,
+        "narHash": "sha256-69nKdvM+E/66sj9R2HEK8i0p0TOt/0MSqfXiZjcJ9nI=",
        "ref": "refs/heads/main",
-        "rev": "9281ba7e10d362d4edb489d0df0e78936dfe7b58",
-        "revCount": 32,
+        "rev": "6386febdb81eb1e072ad7cb568019f06618008fe",
+        "revCount": 41,
        "type": "git",
        "url": "https://code.fizz.buzz/talexander/nix_builder.git"
      },
--- a/nix/configuration/hosts/family_disks/distributed_build.nix
+++ b/nix/configuration/hosts/family_disks/distributed_build.nix
@@ -4,16 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = false;
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
    me.distributed_build.machines.hydra = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = true;
      additional_config = {
        speedFactor = 2;
      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
    };
  };
 }
--- a/nix/configuration/hosts/hydra/default.nix
+++ b/nix/configuration/hosts/hydra/default.nix
@@ -129,6 +129,8 @@
    # systemd.user.extraConfig = "DefaultLimitNOFILE=8192";
    # systemd.services."user@11400".serviceConfig.LimitNOFILE = "8192";

+    nix.settings.secret-key-files = [ "/persist/manual/nix/nix-cache-key.sec" ];
+
    me.build_in_ram.enable = true;
    me.dont_use_substituters.enable = true;
    me.hydra.enable = true;
--- a/nix/configuration/hosts/i_only_boot_zfs/distributed_build.nix
+++ b/nix/configuration/hosts/i_only_boot_zfs/distributed_build.nix
@@ -4,10 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
+    me.distributed_build.machines.hydra = {
+      enable_build = false;
+      enable_substituter = true;
+      additional_config = {
+        speedFactor = 2;
+      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+    };
  };
 }
--- a/nix/configuration/hosts/odo/distributed_build.nix
+++ b/nix/configuration/hosts/odo/distributed_build.nix
@@ -4,16 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = false;
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
    me.distributed_build.machines.hydra = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = true;
      additional_config = {
        speedFactor = 2;
      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
    };
  };
 }
--- a/nix/configuration/hosts/odowork/distributed_build.nix
+++ b/nix/configuration/hosts/odowork/distributed_build.nix
@@ -4,16 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = false;
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
    me.distributed_build.machines.hydra = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = true;
      additional_config = {
        speedFactor = 2;
      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
    };
  };
 }
--- a/nix/configuration/hosts/quark/distributed_build.nix
+++ b/nix/configuration/hosts/quark/distributed_build.nix
@@ -3,11 +3,20 @@

  config = {
    me.distributed_build.enable = true;
-    me.distributed_build.machines.hydra = {
-      enable = true;
+    me.distributed_build.machines.quark = {
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
+    me.distributed_build.machines.hydra = {
+      enable_build = false;
+      enable_substituter = true;
+      additional_config = {
+        speedFactor = 2;
+      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+    };
  };
 }
--- a/nix/configuration/hosts/recovery/distributed_build.nix
+++ b/nix/configuration/hosts/recovery/distributed_build.nix
@@ -4,10 +4,19 @@
  config = {
    me.distributed_build.enable = true;
    me.distributed_build.machines.quark = {
-      enable = true;
+      enable_build = false;
+      enable_substituter = false;
      additional_config = {
        speedFactor = 2;
      };
    };
+    me.distributed_build.machines.hydra = {
+      enable_build = false;
+      enable_substituter = true;
+      additional_config = {
+        speedFactor = 2;
+      };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
+    };
  };
 }
--- a/nix/configuration/roles/distributed_build/default.nix
+++ b/nix/configuration/roles/distributed_build/default.nix
@@ -10,7 +10,14 @@

 let
  make_machine_config = name: {
-    enable = lib.mkOption {
+    enable_build = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = "Whether we want to use the ${name} machine during distributed builds.";
+    };
+
+    enable_substituter = lib.mkOption {
      type = lib.types.bool;
      default = false;
      example = true;
@@ -59,25 +66,35 @@ let
      hostName = lib.mkForce "hydra?remote-store=local?root=/.disk/root";
    };
  };
-  joined_configs =
-    lib.genAttrs
-      (builtins.filter (hostname: config.me.distributed_build.machines."${hostname}".enable) (
-        builtins.attrNames all_nixos_configs
-      ))
-      (
-        hostname:
-        (lib.mkMerge [
+  build_machine_list = (
+    map (
+      hostname:
+      (lib.mkIf config.me.distributed_build.machines."${hostname}".enable_build (
+        lib.mkMerge [
          {
            hostName = hostname;
            sshUser = "nixworker";
            sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
            maxJobs = 1;
            supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
+            protocol = "ssh-ng";
          }
          static_host_configs."${hostname}"
          config.me.distributed_build.machines."${hostname}".additional_config
-        ])
-      );
+        ]
+      ))
+    ) (builtins.attrNames all_nixos_configs)
+  );
+  substituters_list = (
+    map (
+      hostname:
+      (lib.mkIf (
+        config.me.distributed_build.machines."${hostname}".enable_substituter
+        && config.me.distributed_build.machines."${hostname}".substituter_url != null
+      ) (config.me.distributed_build.machines."${hostname}".substituter_url))
+    ) (builtins.attrNames all_nixos_configs)
+  );
+  has_any_substituters = substituters_list != [ ];
 in
 {
  imports = [ ];
@@ -117,35 +134,17 @@ in
          "odo:0S/XKSFjjIrihQ7lbHEIebXk/c/xuoodhm0Gz26YhjA="
          "odowork:zg3UKBAyLy3xtZkL0hMtbxHjxgn5A2QY8NNAgyRT6Yo="
          "quark:Eb6ygkIiVlcUqb5hOjEVIQcfYLpCz40YVYA3/rxrgBc="
+          "hydra:1s4Cy9YJLgw4jWx5jdSCfJmIm0hfya7WEy/EwJYI5Ys="
+          "garak:8nUS6/aHl+FmF518WZlG4DzDToQ3fSNnpHR+aFQmkqc="
        ];
      }
      {
-        nix.buildMachines = (
-          map (
-            hostname:
-            (lib.mkIf config.me.distributed_build.machines."${hostname}".enable (
-              lib.mkMerge [
-                {
-                  hostName = hostname;
-                  sshUser = "nixworker";
-                  sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
-                  maxJobs = 1;
-                  supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
-                  protocol = "ssh-ng";
-                }
-                static_host_configs."${hostname}"
-                config.me.distributed_build.machines."${hostname}".additional_config
-              ]
-            ))
-          ) (builtins.attrNames all_nixos_configs)
-        );
+        nix.buildMachines = build_machine_list;
      }
-      # {
-      #   nix.settings.substitute = lib.mkForce true;
-      #   nix.settings.substituters = lib.mkForce (
-      #     lib.mapAttrsToList (hostname: joined_config: "ssh-ng://${joined_config.hostName}") joined_configs
-      #   );
-      # }
+      (lib.mkIf has_any_substituters {
+        nix.settings.substitute = lib.mkForce true;
+        nix.settings.substituters = lib.mkForce substituters_list;
+      })
    ]
  );
 }
--- a/nix/configuration/roles/hydra/default.nix
+++ b/nix/configuration/roles/hydra/default.nix
@@ -83,7 +83,10 @@
          "worker2_update"
          "family_disks"
          "family_disks_update"
-          # "nixbsd" # Disabled due to onetbb tests hanging on one-cpu machines.
+          "nixbsd"
+          "nix_builder_develop"
+          "organic_develop"
+          "natter_develop"
        ];
        build_flags = lib.concatMap (target: [
          "--target"
--- a/nix/configuration/roles/hydra/files/nix_builder.toml
+++ b/nix/configuration/roles/hydra/files/nix_builder.toml
@@ -67,98 +67,98 @@ output_directory = "/home/nixworker/persist/nix_builder"
 [[targets]]
  name = "controller0"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "controller0.vm_iso"

 [[targets]]
  name = "controller0_update"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "controller0.vm_iso"
  update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"

 [[targets]]
  name = "controller1"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "controller1.vm_iso"

 [[targets]]
  name = "controller1_update"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "controller1.vm_iso"
  update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"

 [[targets]]
  name = "controller2"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "controller2.vm_iso"

 [[targets]]
  name = "controller2_update"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "controller2.vm_iso"
  update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"

 [[targets]]
  name = "worker0"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "worker0.vm_iso"

 [[targets]]
  name = "worker0_update"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "worker0.vm_iso"
  update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"

 [[targets]]
  name = "worker1"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "worker1.vm_iso"

 [[targets]]
  name = "worker1_update"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "worker1.vm_iso"
  update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"

 [[targets]]
  name = "worker2"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "worker2.vm_iso"

 [[targets]]
  name = "worker2_update"
  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
  path = "nix/kubernetes"
  attr = "worker2.vm_iso"
  update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"

 # TODO: Add steam deck

@@ -178,9 +178,30 @@ output_directory = "/home/nixworker/persist/nix_builder"
  update = true
  update_branch = "nix_update"

-# [[targets]]
-#   name = "nixbsd"
-#   repo = "https://github.com/nixos-bsd/nixbsd.git"
-#   revision = "828ff7a3c4ee91f548de65a963fca40eaedb171c"
-#   path = "."
-#   attr = "base.vmClosureInfo"
+[[targets]]
+  name = "nixbsd"
+  repo = "https://github.com/nixos-bsd/nixbsd.git"
+  revision = "2b512eda58e6d77378bd20d6027802b158942e24"
+  path = "."
+  attr = "base.vmClosureInfo"
+
+[[targets]]
+  name = "nix_builder_develop"
+  repo = "https://code.fizz.buzz/talexander/nix_builder.git"
+  branch = "main"
+  path = "."
+  attr = "devShells.x86_64-linux.default"
+
+[[targets]]
+  name = "organic_develop"
+  repo = "https://code.fizz.buzz/talexander/organic.git"
+  branch = "main"
+  path = "."
+  attr = "devShells.x86_64-linux.default"
+
+[[targets]]
+  name = "natter_develop"
+  repo = "https://code.fizz.buzz/talexander/natter.git"
+  branch = "main"
+  path = "."
+  attr = "devShells.x86_64-linux.default"
--- a/nix/configuration/roles/network/default.nix
+++ b/nix/configuration/roles/network/default.nix
@@ -56,6 +56,7 @@ in
    # TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
    networking.extraHosts = ''
      127.0.0.1 ${config.networking.hostName}.home.arpa
+      127.0.0.3 metadata.google.internal
      10.216.1.32		homeserver
      fdfd:5e8a:ee2d::1:32	homeserver
      10.216.1.6		media
@@ -67,7 +68,15 @@ in
      10.217.1.1		drmario
      10.217.2.1		mrmanager
      fdfd:5e8a:ee2d::2:2 mrmanager
+      172.16.16.1		unifi
+      172.16.16.231		plug1
+      172.16.16.232		plug2
+      172.16.16.233		plug3
+      172.16.16.234		plug4
+      172.16.16.235		temperature1
+      172.16.16.236		temperature2
      172.16.16.245		turtle
+      172.16.16.250		sauna
      172.16.16.251		stream
    '';

--- a/nix/configuration/roles/podman/default.nix
+++ b/nix/configuration/roles/podman/default.nix
@@ -50,6 +50,23 @@
      DOCKER_HOST = "unix://$XDG_RUNTIME_DIR/podman/podman.sock";
    };

+    # Increase subuid / subgid to support running buildkit-rootless
+    # ref: https://github.com/moby/buildkit/issues/3297
+    users.users.talexander = {
+      subUidRanges = [
+        {
+          startUid = 100000;
+          count = 262144; # default = 65536
+        }
+      ];
+      subGidRanges = [
+        {
+          startGid = 100000;
+          count = 262144; # default = 65536
+        }
+      ];
+    };
+
    environment.persistence."/state" = lib.mkIf (config.me.mountPersistence) {
      hideMounts = true;
      directories = [
--- a/nix/configuration/roles/wine/default.nix
+++ b/nix/configuration/roles/wine/default.nix
@@ -20,8 +20,9 @@
  config = lib.mkIf (config.me.wine.enable && config.me.graphical) {
    environment.systemPackages = with pkgs; [
      # wineWowPackages.stable # supports 32 + 64 bit
-      wineWowPackages.waylandFull # Supports 32 + 64 bit with native wayland support.
+      wineWow64Packages.waylandFull # Supports 32 + 64 bit with native wayland support.
      # winetricks
+      # lutris
    ];
  };
 }
--- a/nix/kubernetes/flake.lock
+++ b/nix/kubernetes/flake.lock
@@ -22,11 +22,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1780290312,
-        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
        "owner": "nix-community",
        "repo": "disko",
-        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
        "type": "github"
      },
      "original": {
@@ -164,11 +164,11 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1780749050,
-        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "lastModified": 1784120854,
+        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
        "type": "github"
      },
      "original": {
--- a/nix/kubernetes/keys/package/deploy-script/package.nix
+++ b/nix/kubernetes/keys/package/deploy-script/package.nix
@@ -66,6 +66,12 @@ let
        group = "26";
        mode = "0755";
      }
+      {
+        path = "manual-pv/ncps-psql";
+        owner = "26";
+        group = "26";
+        mode = "0755";
+      }
      # {
      #   path = "manual-pv/gitea";
      #   owner = "1000";
--- a/nix/kubernetes/keys/package/mrmanager-repo-secrets/package.nix
+++ b/nix/kubernetes/keys/package/mrmanager-repo-secrets/package.nix
@@ -63,6 +63,7 @@ let
              username = builtins.readFile "${./secrets/flux-system/registry-credentials/username}";
              password = builtins.readFile "${./secrets/flux-system/registry-credentials/password}";
              email = builtins.readFile "${./secrets/flux-system/registry-credentials/email}";
+              address = builtins.readFile "${./secrets/flux-system/registry-credentials/address}";
            })
            // {
              # "__annotations" = {
@@ -103,6 +104,11 @@ let
        "homepage-staging" = {
          "oauth2-env" = oauth2_env { dex_id = "homepage-staging"; };
        };
+        "nix-pull-through-cache" = {
+          "auth" = {
+            "CACHE_GET_TOKEN" = (builtins.readFile "${./secrets/nix-pull-through-cache/auth/CACHE_GET_TOKEN}");
+          };
+        };
        "tekton-gateway" = {
          "oauth2-env" = oauth2_env { dex_id = "tekton"; };
        };
@@ -125,6 +131,9 @@ let
          "harbor-plain" = {
            "config.json" = (builtins.readFile "${./secrets/webhook-bridge/harbor-plain/config.json}");
          };
+          "nix-pull-through-cache" = {
+            "CACHE_GET_TOKEN" = (builtins.readFile "${./secrets/nix-pull-through-cache/auth/CACHE_GET_TOKEN}");
+          };
        };
      };
  encrypted_secrets = (
@@ -199,14 +208,19 @@ let
      username,
      password,
      email,
+      address,
    }:
    let
    in
    {
      "__type" = "kubernetes.io/dockerconfigjson";
      ".dockerconfigjson" = builtins.toJSON {
-        inherit username password email;
-        "auth" = toBase64 "${username}:${password}";
+        auths = {
+          "${address}" = {
+            inherit username password email;
+            "auth" = toBase64 "${username}:${password}";
+          };
+        };
      };
    };
  ## dex
--- a/nix/kubernetes/roles/kubelet/default.nix
+++ b/nix/kubernetes/roles/kubelet/default.nix
@@ -48,6 +48,12 @@ let
      "fd00:3e42:e349::10"
    ];
    imageMaximumGCAge = "24h"; # Delete unused images after 1 day.
+    imageGCHighThresholdPercent = 80;
+    imageGCLowThresholdPercent = 70;
+    evictionHard = {
+      "nodefs.available" = "5%";
+      "imagefs.available" = "10%";
+    };
  };
  kubelet_config_file = (to_yaml_file "kubelet-config.yaml" kubelet_config);
 in
--- a/nix/nixbsd/flake.lock
+++ b/nix/nixbsd/flake.lock
@@ -0,0 +1,209 @@
+{
+  "nodes": {
+    "cppnix": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "git-hooks-nix": "git-hooks-nix",
+        "nixpkgs": [
+          "nixbsd",
+          "nixpkgs"
+        ],
+        "nixpkgs-23-11": "nixpkgs-23-11",
+        "nixpkgs-regression": "nixpkgs-regression"
+      },
+      "locked": {
+        "lastModified": 1781190364,
+        "narHash": "sha256-uP1AYpXYHdzmuz+a4AcScRIHa1uy7l9ObZovS0OqN70=",
+        "owner": "nixos",
+        "repo": "nix",
+        "rev": "ce9fda43e5cb8d2f6c57c7240d05d10ad0415799",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "locked": {
+        "lastModified": 1733328505,
+        "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=",
+        "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec",
+        "revCount": 69,
+        "type": "tarball",
+        "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.1.0/01948eb7-9cba-704f-bbf3-3fa956735b52/source.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nixbsd",
+          "cppnix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778716662,
+        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "git-hooks-nix": {
+      "inputs": {
+        "flake-compat": [
+          "nixbsd",
+          "cppnix"
+        ],
+        "gitignore": [
+          "nixbsd",
+          "cppnix"
+        ],
+        "nixpkgs": [
+          "nixbsd",
+          "cppnix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778507602,
+        "narHash": "sha256-kTwur1wV+01SdqskVMSo6JMEpg71ps3HpbFY2GsflKs=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "61ab0e80d9c7ab14c256b5b453d8b3fb0189ba0a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "mini-tmpfiles": {
+      "inputs": {
+        "nixpkgs": [
+          "nixbsd",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1742754557,
+        "narHash": "sha256-nGxgiNhA94eSl8jcQwCboJ5Ed132z8yrFdOoT+rf8bE=",
+        "owner": "nixos-bsd",
+        "repo": "mini-tmpfiles",
+        "rev": "534ee577692c7092fdcd035f89bc29b663c6f9ca",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos-bsd",
+        "repo": "mini-tmpfiles",
+        "type": "github"
+      }
+    },
+    "nixbsd": {
+      "inputs": {
+        "cppnix": "cppnix",
+        "flake-compat": "flake-compat_2",
+        "mini-tmpfiles": "mini-tmpfiles",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1783703343,
+        "narHash": "sha256-kt38BGQYWXUtNgTV/hCx0tf8IZJFuEGE3/IYoRutha4=",
+        "owner": "nixos-bsd",
+        "repo": "nixbsd",
+        "rev": "2b512eda58e6d77378bd20d6027802b158942e24",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos-bsd",
+        "repo": "nixbsd",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1783693695,
+        "narHash": "sha256-4eOaoE0Z2OR28W/vdzp1H9Qkl84ajh7tdVsfNwTuG5U=",
+        "rev": "dc29ee8fa098c86053cc8ef25594738f28be5b6b",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable-small/nixos-26.11pre1032146.dc29ee8fa098/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable-small/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs-23-11": {
+      "locked": {
+        "lastModified": 1717159533,
+        "narHash": "sha256-oamiKNfr2MS6yH64rUn99mIZjc45nGJlj9eGth/3Xuw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a62e6edd6d5e1fa0329b8653c801147986f8d446",
+        "type": "github"
+      }
+    },
+    "nixpkgs-regression": {
+      "locked": {
+        "lastModified": 1643052045,
+        "narHash": "sha256-uGJ0VXIhWKGXxkeNnq4TvV3CIOkUJ3PAoLZ3HMzNVMw=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "215d4d0fd80ca5163643b03a33fde804a29cc1e2",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixbsd": "nixbsd",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
--- a/nix/nixbsd/flake.nix
+++ b/nix/nixbsd/flake.nix
@@ -0,0 +1,111 @@
+# nix build .#computer.vm
+# result/bin/run-nixbsd-base-vm
+{
+  description = "NixBSD Flake";
+
+  inputs = {
+    nixpkgs.url = "https://channels.nixos.org/nixos-unstable-small/nixexprs.tar.xz";
+    # nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixbsd = {
+      url = "github:nixos-bsd/nixbsd";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      nixbsd,
+      ...
+    }@inputs:
+    let
+      forAllSystems =
+        func:
+        builtins.listToAttrs (
+          map (system: {
+            name = system;
+            value = func system;
+          }) nixpkgs.lib.systems.flakeExposed
+        );
+      makeImage =
+        buildPlatform: conf:
+        let
+          extended = conf.extendModules {
+            modules = [
+              {
+                config.nixpkgs.buildPlatform = buildPlatform;
+              }
+            ];
+          };
+        in
+        extended.config.system.build
+        // {
+          # appease `nix flake show`
+          type = "derivation";
+          name = "system-build";
+
+          closureInfo = extended.pkgs.closureInfo {
+            rootPaths = [ extended.config.system.build.toplevel.drvPath ];
+          };
+          vmClosureInfo = extended.pkgs.closureInfo {
+            rootPaths = [ extended.config.system.build.vm.drvPath ];
+          };
+          system = extended.config.system.build.toplevel;
+          inherit (extended) pkgs config;
+        };
+    in
+    {
+      nixosConfigurations.computer = nixbsd.lib.nixbsdSystem {
+        system = "x86_64-freebsd";
+        modules = [
+          (
+            { config, lib, ... }:
+            {
+              nixpkgs.hostPlatform = "x86_64-freebsd";
+              networking.hostName = "computer";
+
+              users.users.root.initialPassword = "toor";
+
+              # Don't make me wait for an address...
+              networking.dhcpcd.wait = "background";
+
+              users.users.talexander = {
+                isNormalUser = true;
+                description = "me";
+                extraGroups = [ "wheel" ];
+                inherit (config.users.users.root) initialPassword;
+              };
+
+              services.sshd.enable = true;
+              boot.loader.stand-freebsd.enable = true;
+
+              fileSystems."/" = {
+                device = "/dev/gpt/nixos";
+                fsType = "ufs";
+              };
+
+              fileSystems."/boot" = {
+                device = "/dev/msdosfs/ESP";
+                fsType = "msdosfs";
+              };
+
+              virtualisation.vmVariant.virtualisation.diskImage = "./${config.system.name}.qcow2";
+
+              system.stateVersion = "26.11";
+            }
+          )
+        ];
+      };
+
+      packages = forAllSystems (
+        system:
+        nixpkgs.lib.mapAttrs (name: makeImage system) self.nixosConfigurations
+        // {
+          tools =
+            nixpkgs.legacyPackages.${system}.callPackages "${nixbsd}/modules/installer/tools/package.nix"
+              { };
+        }
+      );
+    };
+}
Author	SHA1	Message	Date
Tom Alexander	1fc31fbfea	Add an install of nixbsd.	2026-08-08 16:18:41 -04:00
Tom Alexander	d4dc7e1f59	Trust garak's signing key.	2026-08-07 15:48:09 -04:00
Tom Alexander	3c17d56664	Separate enabling distributed build vs substituters.	2026-08-05 17:54:38 -04:00
Tom Alexander	adff9fcd29	Update nix_builder to support tar in the flake lockfile.	2026-08-04 21:39:54 -04:00
Tom Alexander	649e4033fd	Update nix_builder to record the revisions of the flake inputs.	2026-07-28 10:20:18 -04:00
Tom Alexander	1b38004e03	Add more hosts to /etc/hosts.	2026-07-28 08:22:47 -04:00
Tom Alexander	d8ef4356a0	Enable some more builds in nix_builder.	2026-07-23 20:25:42 -04:00
Tom Alexander	5dd5f2e4e0	Fix docker credential generation.	2026-07-23 20:08:40 -04:00
Tom Alexander	84e8983974	Update nix_builder.	2026-07-18 23:30:39 -04:00
Tom Alexander	24f4a8c2d9	Tweak the containerd garbage collect threshold on kubelets. Pods were getting evicted due to disk pressure, so this causes garbage collection to trigger sooner.	2026-07-18 13:59:56 -04:00
Tom Alexander	a3cdaa9128	Increase subuid/subgid range to support running buildkit inside podman.	2026-07-18 08:42:02 -04:00
Tom Alexander	51295a23dc	Enable the build VM as a substituter. This should enable me to have local build jobs without rebuilding stuff that already exists on the build VM server.	2026-07-18 08:41:11 -04:00
Tom Alexander	11d8b93551	Add an /etc/hosts entry for google's metadata server. gcloud was reaching out to this address which was causing delays. Pointing it to localhost to speed the failure up.	2026-07-14 11:53:38 -04:00
Tom Alexander	40b8742a80	Add nix pull-through cache secrets.	2026-07-13 20:35:11 -04:00
Tom Alexander	32080e0e01	Add chown for nix pull through cache database.	2026-07-12 17:25:12 -04:00
Tom Alexander	41668506cd	Retire the kubernetes branch now that it is merged into nix.	2026-07-06 18:28:58 -04:00