Update packages.

Pods were getting evicted due to disk pressure, so this causes garbage collection to trigger sooner.

nix/configuration/configuration.nix

@@ -246,31 +246,8 @@ in
             glew = (final.glew.override { enableEGL = false; });
           };
         })
-        (final: prev: {
-          fwupd = prev.fwupd.overrideAttrs (
-            finalAttrs: prevAttrs: {
-              version = "2.1.5";
-              src = final.fetchFromGitHub {
-                owner = "fwupd";
-                repo = "fwupd";
-                tag = finalAttrs.version;
-                hash = "sha256-DzQ+N99ZmFRqZc2rN6PSqmoIMXUyrE8Kkn+KnT/AWPc=";
-              };
-            }
-          );
-        })
         (disableTests "onetbb") # oneTBB tests hang forever on machines with a single core (like my build virtual machine) https://github.com/uxlfoundation/oneTBB/issues/1557
         (disableTests "aws-c-common") # aws-c-common tests time out on my build virtual machine but run fine on my laptop.
-
-        # Works but probably sets python2's scipy to be python3:
-        #
-        # (final: prev: {
-        #   pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-        #     (python-final: python-prev: {
-        #       scipy = final.unoptimized.python3Packages.scipy;
-        #     })
-        #   ];
-        # })
       ];
 
     # This option defines the first version of NixOS you have installed on this particular machine,

nix/configuration/flake.lock

@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780894562,
-        "narHash": "sha256-c3430xwxwhHipl3jigUGMMBfpaMylDqytW/kdmB3ZGs=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "24fed06cac83bcc44ac8efbb57cab1a82fa0bedc",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
         "type": "github"
       },
       "original": {
@@ -170,11 +170,11 @@
         "rust-overlay": "rust-overlay_2"
       },
       "locked": {
-        "lastModified": 1783278211,
-        "narHash": "sha256-/1u+MIQIge+cNPukQoK4Jp8nLuFZRbx4U+MyyxG0RpM=",
+        "lastModified": 1785248363,
+        "narHash": "sha256-hx9Cn1vIa/h54t+s3ObO6+Z3xHSA1zc3YVRWxTZcigc=",
         "ref": "refs/heads/main",
-        "rev": "9281ba7e10d362d4edb489d0df0e78936dfe7b58",
-        "revCount": 32,
+        "rev": "0addf91edf82775a0dc5022a81065ef101305e64",
+        "revCount": 38,
         "type": "git",
         "url": "https://code.fizz.buzz/talexander/nix_builder.git"
       },
@@ -185,11 +185,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780749050,
-        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "lastModified": 1785318670,
+        "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5",
         "type": "github"
       },
       "original": {
@@ -199,22 +199,6 @@
         "type": "github"
       }
     },
-    "nixpkgs-google": {
-      "locked": {
-        "lastModified": 1779893571,
-        "narHash": "sha256-wiwMyVCtmjRjlFCe2zaumCE6LRV9GzzN0ZH25NQkbAU=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "45f6cfaa4605b706c870e75bd74bdb5e97eee11e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "45f6cfaa4605b706c870e75bd74bdb5e97eee11e",
-        "type": "github"
-      }
-    },
     "nixpkgs-stable": {
       "locked": {
         "lastModified": 1730741070,
@@ -264,8 +248,7 @@
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
         "nix_builder": "nix_builder",
-        "nixpkgs": "nixpkgs",
-        "nixpkgs-google": "nixpkgs-google"
+        "nixpkgs": "nixpkgs"
       }
     },
     "rust-overlay": {

nix/configuration/flake.nix

@@ -20,7 +20,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-google.url = "github:NixOS/nixpkgs/45f6cfaa4605b706c870e75bd74bdb5e97eee11e";
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v0.4.2";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -39,7 +38,6 @@
     {
       self,
       nixpkgs,
-      nixpkgs-google,
       disko,
       impermanence,
       lanzaboote,
@@ -99,9 +97,6 @@
                       hostPlatform.gcc.arch = "default";
                       hostPlatform.gcc.tune = "default";
                     };
-                    google = import nixpkgs-google {
-                      system = prev.stdenv.hostPlatform.system;
-                    };
                   })
                 ];
               };

nix/configuration/hosts/family_disks/distributed_build.nix

@@ -14,6 +14,7 @@
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/hydra/default.nix

@@ -129,6 +129,8 @@
     # systemd.user.extraConfig = "DefaultLimitNOFILE=8192";
     # systemd.services."user@11400".serviceConfig.LimitNOFILE = "8192";
 
+    nix.settings.secret-key-files = [ "/persist/manual/nix/nix-cache-key.sec" ];
+
     me.build_in_ram.enable = true;
     me.dont_use_substituters.enable = true;
     me.hydra.enable = true;

nix/configuration/hosts/odo/distributed_build.nix

@@ -14,6 +14,7 @@
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/odowork/distributed_build.nix

@@ -14,6 +14,7 @@
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/quark/distributed_build.nix

@@ -8,6 +8,7 @@
       additional_config = {
         speedFactor = 2;
       };
+      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/roles/distributed_build/default.nix

@@ -59,25 +59,16 @@ let
       hostName = lib.mkForce "hydra?remote-store=local?root=/.disk/root";
     };
   };
-  joined_configs =
-    lib.genAttrs
-      (builtins.filter (hostname: config.me.distributed_build.machines."${hostname}".enable) (
-        builtins.attrNames all_nixos_configs
-      ))
-      (
-        hostname:
-        (lib.mkMerge [
-          {
-            hostName = hostname;
-            sshUser = "nixworker";
-            sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
-            maxJobs = 1;
-            supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
-          }
-          static_host_configs."${hostname}"
-          config.me.distributed_build.machines."${hostname}".additional_config
-        ])
-      );
+  substituters_list = (
+    map (
+      hostname:
+      (lib.mkIf (
+        config.me.distributed_build.machines."${hostname}".enable
+        && config.me.distributed_build.machines."${hostname}".substituter_url != null
+      ) (config.me.distributed_build.machines."${hostname}".substituter_url))
+    ) (builtins.attrNames all_nixos_configs)
+  );
+  has_any_substituters = substituters_list != [ ];
 in
 {
   imports = [ ];
@@ -117,6 +108,7 @@ in
           "odo:0S/XKSFjjIrihQ7lbHEIebXk/c/xuoodhm0Gz26YhjA="
           "odowork:zg3UKBAyLy3xtZkL0hMtbxHjxgn5A2QY8NNAgyRT6Yo="
           "quark:Eb6ygkIiVlcUqb5hOjEVIQcfYLpCz40YVYA3/rxrgBc="
+          "hydra:1s4Cy9YJLgw4jWx5jdSCfJmIm0hfya7WEy/EwJYI5Ys="
         ];
       }
       {
@@ -140,12 +132,10 @@ in
           ) (builtins.attrNames all_nixos_configs)
         );
       }
-      # {
-      #   nix.settings.substitute = lib.mkForce true;
-      #   nix.settings.substituters = lib.mkForce (
-      #     lib.mapAttrsToList (hostname: joined_config: "ssh-ng://${joined_config.hostName}") joined_configs
-      #   );
-      # }
+      (lib.mkIf has_any_substituters {
+        nix.settings.substitute = lib.mkForce true;
+        nix.settings.substituters = lib.mkForce substituters_list;
+      })
     ]
   );
 }

nix/configuration/roles/gcloud/default.nix

@@ -18,7 +18,7 @@
   };
 
   config = lib.mkIf config.me.gcloud.enable {
-    environment.systemPackages = with pkgs.google; [
+    environment.systemPackages = with pkgs; [
       (google-cloud-sdk.withExtraComponents [ google-cloud-sdk.components.gke-gcloud-auth-plugin ])
     ];
 

nix/configuration/roles/hydra/default.nix

@@ -83,7 +83,10 @@
           "worker2_update"
           "family_disks"
           "family_disks_update"
-          # "nixbsd" # Disabled due to onetbb tests hanging on one-cpu machines.
+          "nixbsd"
+          "nix_builder_develop"
+          "organic_develop"
+          "natter_develop"
         ];
         build_flags = lib.concatMap (target: [
           "--target"

nix/configuration/roles/hydra/files/nix_builder.toml

@@ -67,98 +67,98 @@ output_directory = "/home/nixworker/persist/nix_builder"
 [[targets]]
   name = "controller0"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller0.vm_iso"
 
 [[targets]]
   name = "controller0_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller0.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "controller1"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller1.vm_iso"
 
 [[targets]]
   name = "controller1_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller1.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "controller2"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller2.vm_iso"
 
 [[targets]]
   name = "controller2_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "controller2.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "worker0"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker0.vm_iso"
 
 [[targets]]
   name = "worker0_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker0.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "worker1"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker1.vm_iso"
 
 [[targets]]
   name = "worker1_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker1.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 [[targets]]
   name = "worker2"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker2.vm_iso"
 
 [[targets]]
   name = "worker2_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "kubernetes"
+  branch = "nix"
   path = "nix/kubernetes"
   attr = "worker2.vm_iso"
   update = true
-  update_branch = "kubernetes_update"
+  update_branch = "nix_update"
 
 # TODO: Add steam deck
 
@@ -178,9 +178,30 @@ output_directory = "/home/nixworker/persist/nix_builder"
   update = true
   update_branch = "nix_update"
 
-# [[targets]]
-#   name = "nixbsd"
-#   repo = "https://github.com/nixos-bsd/nixbsd.git"
-#   revision = "828ff7a3c4ee91f548de65a963fca40eaedb171c"
-#   path = "."
-#   attr = "base.vmClosureInfo"
+[[targets]]
+  name = "nixbsd"
+  repo = "https://github.com/nixos-bsd/nixbsd.git"
+  revision = "2b512eda58e6d77378bd20d6027802b158942e24"
+  path = "."
+  attr = "base.vmClosureInfo"
+
+[[targets]]
+  name = "nix_builder_develop"
+  repo = "https://code.fizz.buzz/talexander/nix_builder.git"
+  branch = "main"
+  path = "."
+  attr = "devShells.x86_64-linux.default"
+
+[[targets]]
+  name = "organic_develop"
+  repo = "https://code.fizz.buzz/talexander/organic.git"
+  branch = "main"
+  path = "."
+  attr = "devShells.x86_64-linux.default"
+
+[[targets]]
+  name = "natter_develop"
+  repo = "https://code.fizz.buzz/talexander/natter.git"
+  branch = "main"
+  path = "."
+  attr = "devShells.x86_64-linux.default"

nix/configuration/roles/latex/default.nix

@@ -25,8 +25,8 @@
     nixpkgs.overlays = [
       (final: prev: {
         tex = (
-          pkgs.texlive.combine {
-            inherit (pkgs.texlive)
+          pkgs.texliveSmall.withPackages (
+            ps: with ps; [
               scheme-basic
               dvisvgm
               dvipng # for preview and export as html in org-mode
@@ -44,8 +44,8 @@
               upquote # emacs org-mode pdf export
               lineno # emacs org-mode pdf export
               beamer # emacs org-mode presentation pdf export
-              ;
-          }
+            ]
+          )
         );
       })
     ];

nix/configuration/roles/network/default.nix

@@ -56,6 +56,7 @@ in
     # TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
     networking.extraHosts = ''
       127.0.0.1 ${config.networking.hostName}.home.arpa
+      127.0.0.3 metadata.google.internal
       10.216.1.32		homeserver
       fdfd:5e8a:ee2d::1:32	homeserver
       10.216.1.6		media
@@ -67,7 +68,15 @@ in
       10.217.1.1		drmario
       10.217.2.1		mrmanager
       fdfd:5e8a:ee2d::2:2 mrmanager
+      172.16.16.1		unifi
+      172.16.16.231		plug1
+      172.16.16.232		plug2
+      172.16.16.233		plug3
+      172.16.16.234		plug4
+      172.16.16.235		temperature1
+      172.16.16.236		temperature2
       172.16.16.245		turtle
+      172.16.16.250		sauna
       172.16.16.251		stream
     '';
 

nix/configuration/roles/podman/default.nix

@@ -50,6 +50,23 @@
       DOCKER_HOST = "unix://$XDG_RUNTIME_DIR/podman/podman.sock";
     };
 
+    # Increase subuid / subgid to support running buildkit-rootless
+    # ref: https://github.com/moby/buildkit/issues/3297
+    users.users.talexander = {
+      subUidRanges = [
+        {
+          startUid = 100000;
+          count = 262144; # default = 65536
+        }
+      ];
+      subGidRanges = [
+        {
+          startGid = 100000;
+          count = 262144; # default = 65536
+        }
+      ];
+    };
+
     environment.persistence."/state" = lib.mkIf (config.me.mountPersistence) {
       hideMounts = true;
       directories = [

nix/configuration/roles/wine/default.nix

@@ -20,8 +20,9 @@
   config = lib.mkIf (config.me.wine.enable && config.me.graphical) {
     environment.systemPackages = with pkgs; [
       # wineWowPackages.stable # supports 32 + 64 bit
-      wineWowPackages.waylandFull # Supports 32 + 64 bit with native wayland support.
+      wineWow64Packages.waylandFull # Supports 32 + 64 bit with native wayland support.
       # winetricks
+      # lutris
     ];
   };
 }

nix/kubernetes/flake.lock

@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780290312,
-        "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=",
+        "lastModified": 1781152676,
+        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "115e5211780054d8a890b41f0b7734cafad54dfe",
+        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
         "type": "github"
       },
       "original": {
@@ -164,11 +164,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780749050,
-        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
+        "lastModified": 1784120854,
+        "narHash": "sha256-KesHgItiZPgGX740axSiQLcIQ8D24MDqNpkKYWIek8k=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
+        "rev": "753cc8a3a87467296ddd1fa93f0cc3e81120ee46",
         "type": "github"
       },
       "original": {

nix/kubernetes/keys/package/deploy-script/package.nix

@@ -66,6 +66,12 @@ let
         group = "26";
         mode = "0755";
       }
+      {
+        path = "manual-pv/ncps-psql";
+        owner = "26";
+        group = "26";
+        mode = "0755";
+      }
       # {
       #   path = "manual-pv/gitea";
       #   owner = "1000";

nix/kubernetes/keys/package/mrmanager-repo-secrets/package.nix

@@ -63,6 +63,7 @@ let
               username = builtins.readFile "${./secrets/flux-system/registry-credentials/username}";
               password = builtins.readFile "${./secrets/flux-system/registry-credentials/password}";
               email = builtins.readFile "${./secrets/flux-system/registry-credentials/email}";
+              address = builtins.readFile "${./secrets/flux-system/registry-credentials/address}";
             })
             // {
               # "__annotations" = {
@@ -103,6 +104,11 @@ let
         "homepage-staging" = {
           "oauth2-env" = oauth2_env { dex_id = "homepage-staging"; };
         };
+        "nix-pull-through-cache" = {
+          "auth" = {
+            "CACHE_GET_TOKEN" = (builtins.readFile "${./secrets/nix-pull-through-cache/auth/CACHE_GET_TOKEN}");
+          };
+        };
         "tekton-gateway" = {
           "oauth2-env" = oauth2_env { dex_id = "tekton"; };
         };
@@ -125,6 +131,9 @@ let
           "harbor-plain" = {
             "config.json" = (builtins.readFile "${./secrets/webhook-bridge/harbor-plain/config.json}");
           };
+          "nix-pull-through-cache" = {
+            "CACHE_GET_TOKEN" = (builtins.readFile "${./secrets/nix-pull-through-cache/auth/CACHE_GET_TOKEN}");
+          };
         };
       };
   encrypted_secrets = (
@@ -199,14 +208,19 @@ let
       username,
       password,
       email,
+      address,
     }:
     let
     in
     {
       "__type" = "kubernetes.io/dockerconfigjson";
       ".dockerconfigjson" = builtins.toJSON {
-        inherit username password email;
-        "auth" = toBase64 "${username}:${password}";
+        auths = {
+          "${address}" = {
+            inherit username password email;
+            "auth" = toBase64 "${username}:${password}";
+          };
+        };
       };
     };
   ## dex

nix/kubernetes/roles/kubelet/default.nix

@@ -48,6 +48,12 @@ let
       "fd00:3e42:e349::10"
     ];
     imageMaximumGCAge = "24h"; # Delete unused images after 1 day.
+    imageGCHighThresholdPercent = 80;
+    imageGCLowThresholdPercent = 70;
+    evictionHard = {
+      "nodefs.available" = "5%";
+      "imagefs.available" = "10%";
+    };
   };
   kubelet_config_file = (to_yaml_file "kubelet-config.yaml" kubelet_config);
 in