Sort icons.

ansible/environments/home/host_vars/homeserver

@@ -88,6 +88,6 @@ linfi:
   enabled: true
   zfs_dataset: zmass/unencrypted/vm/linfi
   zfs_mountpoint: /vm/linfi
-  driver_blocklist: "ath if_ath if_ath_pci ath_hal"
+  driver_blocklist: "ath if_ath if_ath_pci ath_hal if_iwm if_iwlwifi"
   pci_blocklist: "6/0/0"
   amd: false

ansible/roles/devfs/files/homeserver_devfs.rules

@@ -17,3 +17,9 @@ add include $devfsrules_hide_all
 add include $devfsrules_unhide_basic
 add include $devfsrules_unhide_login
 add path 'bpf*' unhide
+
+[tajailrand=15]
+add include $devfsrules_hide_all
+add include $devfsrules_unhide_basic
+add include $devfsrules_unhide_login
+add path urandom unhide

ansible/roles/emacs/files/elisp/lang-nix.el

@@ -0,0 +1,22 @@
+(require 'common-lsp)
+(require 'util-tree-sitter)
+
+(use-package nix-mode
+  :mode (("\\.nix\\'" . nix-mode)
+         )
+  :commands nix-mode
+  :hook (
+         (nix-mode . (lambda ()
+                             ;; (eglot-ensure)
+                             ;; (defclass my/eglot-nix (eglot-lsp-server) ()
+                             ;;   :documentation
+                             ;;   "Own eglot server class.")
+
+                             ;; (add-to-list 'eglot-server-programs
+                             ;;              '(nix-mode . (my/eglot-nix "nixd")))
+                             ;; (add-hook 'before-save-hook 'eglot-format-buffer nil 'local)
+                             ))
+         )
+  )
+
+(provide 'lang-nix)

ansible/roles/emacs/files/init.el

@@ -36,4 +36,6 @@
 
 (require 'lang-xml)
 
+(require 'lang-nix)
+
 (load-directory autoload-directory)

ansible/roles/emacs/meta/main.yaml

@@ -7,3 +7,5 @@ dependencies:
     when: 'emacs_flavor == "full"'
   - role: terraform
     when: 'emacs_flavor == "full"'
+  - role: nix
+    when: 'emacs_flavor == "full"'

ansible/roles/firefox/defaults/main.yaml

@@ -28,7 +28,7 @@ firefox_config:
   # Disable that websites can get notifications if you copy, paste, or cut something from a web page, and it lets them know which part of the page had been selected.
   #
   # This breaks copying from BigQuery https://github.com/microsoft/monaco-editor/issues/1540
-  dom.event.clipboardevents.enabled: false
+  # dom.event.clipboardevents.enabled: false
   # Isolates all browser identifier sources (e.g. cookies) to the first party domain, with the goal of preventing tracking across different domains.
   privacy.firstparty.isolate: true
   # Do not preload URLs that auto-complete in the address bar.

ansible/roles/firewall/files/homeserver_pf.conf

@@ -42,6 +42,10 @@ nat pass on restricted_nat proto {tcp, udp} from 10.215.1.217/32 to 10.215.2.2 p
 rdr pass on $ext_if inet proto {tcp, udp} from $not_restricted_nat_v4 to any port 8082 -> 10.215.2.2 port 8082
 nat pass on restricted_nat proto {tcp, udp} from any to 10.215.2.2 port 8082 -> 10.215.2.1
 
+# cloak -> dagger old
+rdr pass on $ext_if inet proto {tcp, udp} from $not_restricted_nat_v4 to any port 8083 -> 10.215.2.2 port 8083
+nat pass on restricted_nat proto {tcp, udp} from any to 10.215.2.2 port 8083 -> 10.215.2.1
+
 # -> sftp
 # TODO: Limit bandwidth for sftp
 rdr pass on $ext_if inet proto {tcp, udp} from $not_jail_nat_v4 to any port 8022 -> 10.215.1.216 port 22

ansible/roles/framework_laptop/tasks/linux.yaml

@@ -96,4 +96,5 @@
   package:
     name:
       - fw-ectool-git
+      - wireless-regdb
     state: present

ansible/roles/jail/files/jails/dagger.conf

@@ -6,6 +6,8 @@ dagger {
     exec.prestart += "/usr/local/bin/jail_netgraph_bridge start cloak ${name} 192.168.1.0/24";
     exec.poststop += "sleep 10; /usr/local/bin/jail_netgraph_bridge stop cloak ${name}";
 
+    devfs_ruleset = 15;
+    mount.devfs;
     mount.fstab = "/etc/fstab.${name}";
 
     exec.start += "/bin/sh /etc/rc";

ansible/roles/media/files/cast_file_vaapi

@@ -4,7 +4,23 @@ set -euo pipefail
 IFS=$'\n\t'
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
+: ${VIDEO_BITRATE:="1M"} # Only for encoding modes targeting bitrate
+: ${AUDIO_BITRATE:="192k"}
 
+############## Setup #########################
+
+function die {
+    local status_code="$1"
+    shift
+    (>&2 echo "${@}")
+    exit "$status_code"
+}
+
+function log {
+    (>&2 echo "${@}")
+}
+
+############## Program #########################
 
 function main {
     local cmd
@@ -12,28 +28,10 @@ function main {
     shift
     if [ "$cmd" = "copy" ]; then
         copy "${@}"
-    elif [ "$cmd" = "av1" ]; then
-        av1 "${@}"
-    elif [ "$cmd" = "stream_software_h264" ]; then
-        stream_software_h264 "${@}"
-    elif [ "$cmd" = "stream_hardware_h264" ]; then
-        stream_hardware_h264 "${@}"
-    elif [ "$cmd" = "preprocess_software_h264" ]; then
-        preprocess_software_h264 "${@}"
-    elif [ "$cmd" = "preprocess_hardware_h264" ]; then
-        preprocess_hardware_h264 "${@}"
-    elif [ "$cmd" = "vp9" ]; then
-        vp9 "${@}"
-    elif [ "$cmd" = "preprocess_hardware_vp9" ]; then
-        preprocess_hardware_vp9 "${@}"
-    elif [ "$cmd" = "vp8" ]; then
-        vp8 "${@}"
-    elif [ "$cmd" = "software_vp8" ]; then
-        software_vp8 "${@}"
-    elif [ "$cmd" = "preprocess_h264" ]; then
-        preprocess_h264 "${@}"
-    elif [ "$cmd" = "preprocess_vp8" ]; then
-        preprocess_vp8 "${@}"
+    elif [ "$cmd" = "convert" ]; then
+        convert "${@}"
+    elif [ "$cmd" = "stream" ]; then
+        stream "${@}"
     elif [ "$cmd" = "webcam" ]; then
         webcam "${@}"
     elif [ "$cmd" = "encode_webcam" ]; then
@@ -64,286 +62,106 @@ function copy {
         "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
 }
 
-
-
-function av1 {
-    # local additional_flags=()
-    # additional_flags+=(--profile "$PROFILE")
-    # (cd "$DIR/../" && cargo build --no-default-features "${additional_flags[@]}")
-
-    local destination_type="$1" # "stream" or "preprocess"
-    local acceleration_type="$2" # "software" or "hardware"
-    # shift 2
-
+function convert {
     local args=()
+    local acceleration_type="$1" # "software" or "hardware"
+    local codec="$2" # "h264" or "av1"
+    local file_to_cast="$3"
+    local file_to_save="$4"
 
-    if [ "$destination_type" == "stream" ]; then
-        args+=(-re -stream_loop -1)
-    elif [ "$destination_type" == "preproces" ]; then
+
+
+    # Verify parameters
+
+
+    if [ "$acceleration_type" == "software" ]; then
+        true
+    elif [ "$acceleration_type" == "hardware" ]; then
         true
     else
-        (>&2 echo "Unknown destination type: $destination_type")
-        exit 1
+        die 1 "Unknown acceleration type: $acceleration_type"
     fi
 
+    if [ "$codec" == "h264" ]; then
+        true
+    elif [ "$codec" == "av1" ]; then
+        true
+    else
+        die 1 "Unknown codec: $codec"
+    fi
+
+
+
+    # Build command
+
+
+
     if [ "$acceleration_type" == "software" ]; then
         true
     elif [ "$acceleration_type" == "hardware" ]; then
         args+=(-vaapi_device /dev/dri/renderD128)
-    else
-        (>&2 echo "Unknown acceleration type: $acceleration_type")
-        exit 1
     fi
 
     args+=(-i "$file_to_cast")
 
+    if [ "$codec" == "h264" ]; then
         if [ "$acceleration_type" == "software" ]; then
             args+=(-c:v h264)
+            args+=(-profile:v high)
+            args+=(-b:v "$VIDEO_BITRATE")
         elif [ "$acceleration_type" == "hardware" ]; then
             args+=(-vf 'format=nv12|vaapi,hwupload')
             args+=(-c:v h264_vaapi)
-    else
-        (>&2 echo "Unknown acceleration type: $acceleration_type")
-        exit 1
+            args+=(-profile:v high)
+            args+=(-b:v "$VIDEO_BITRATE")
+        fi
+    elif [ "$codec" == "av1" ]; then
+        if [ "$acceleration_type" == "software" ]; then
+            args+=(-c:v libsvtav1)
+            args+=(-preset 4) # [0-13] default 10, lower = higher quality / slower encode
+            args+=(-crf 20) # [0-63] default 35, lower = higher quality / larger file
+            # Parameters: https://gitlab.com/AOMediaCodec/SVT-AV1/-/blob/master/Docs/Parameters.md
+            # fast-decode [0-2] default 0 (off), higher = faster decode
+            # tune [0-2] default 1, Specifies whether to use PSNR or VQ as the tuning metric [0 = VQ, 1 = PSNR, 2 = SSIM]
+            # film-grain-denoise, setting to 0 uses the original frames instead of denoising the film grain
+            args+=(-svtav1-params "fast-decode=1:film-grain-denoise=0")
+        elif [ "$acceleration_type" == "hardware" ]; then
+            # -c:v av1_amf -quality quality
+            args+=(-vf 'format=nv12|vaapi,hwupload')
+            args+=(-c:v av1_vaapi)
+            args+=(-b:v "$VIDEO_BITRATE")
+        fi
     fi
 
-    args+=(-b:v 2M)
-    args+=(-profile:v high)
+
+
+    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
     args+=(-bf 0)
     args+=(-strict -2)
     args+=(-c:a opus)
     args+=(-ac 2)
-    args+=(-b:a 320k)
+    args+=(-b:a "$AUDIO_BITRATE")
     args+=(-ar 48000)
+    args+=("$file_to_save")
+    set -x
+    </dev/null exec ffmpeg "${args[@]}"
+}
+
+function stream {
+    local args=()
+    local acceleration_type="$1" # "software" or "hardware"
+    local codec="$2" # "h264" or "av1"
+
+    local USERNAME="$3"
+    local PASSWORD="$4"
+    local file_to_cast="$5"
+
+
+    args+=(-re -stream_loop -1)
 
-    if [ "$destination_type" == "stream" ]; then
     args+=(-f rtsp)
     args+=(-rtsp_transport tcp)
     args+=("rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch")
-    elif [ "$destination_type" == "preproces" ]; then
-        args+=("$file_to_save")
-    else
-        (>&2 echo "Unknown destination type: $destination_type")
-        exit 1
-    fi
-}
-
-function stream_software_h264 {
-    local file_to_cast
-    file_to_cast="$3"
-
-    local USERNAME PASSWORD
-    USERNAME="$1"
-    PASSWORD="$2"
-
-    set -x
-
-    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
-    </dev/null exec ffmpeg \
-               -re \
-               -stream_loop -1 \
-               -i "$file_to_cast" \
-               -c:v h264 \
-               -b:v 2M \
-               -profile:v high \
-               -bf 0 \
-               -strict -2 \
-               -c:a opus \
-               -ac 2 \
-               -b:a 320k \
-               -ar 48000 \
-               -f rtsp \
-               -rtsp_transport tcp \
-               "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
-}
-
-function stream_hardware_h264 {
-    local file_to_cast
-    file_to_cast="$3"
-
-    local USERNAME PASSWORD
-    USERNAME="$1"
-    PASSWORD="$2"
-
-    set -x
-
-    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
-    </dev/null exec ffmpeg \
-               -re \
-               -stream_loop -1 \
-               -vaapi_device /dev/dri/renderD128 \
-               -i "$file_to_cast" \
-               -vf 'format=nv12|vaapi,hwupload' \
-               -c:v h264_vaapi \
-               -b:v 2M \
-               -profile:v high \
-               -bf 0 \
-               -strict -2 \
-               -c:a opus \
-               -ac 2 \
-               -b:a 320k \
-               -ar 48000 \
-               -f rtsp \
-               -rtsp_transport tcp \
-               "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
-}
-
-function preprocess_software_h264 {
-    local file_to_cast file_to_save
-    file_to_cast="$1"
-    file_to_save="$2"
-
-    set -x
-
-    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
-    </dev/null exec ffmpeg \
-               -i "$file_to_cast" \
-               -c:v h264 \
-               -b:v 2M \
-               -profile:v high \
-               -bf 0 \
-               -strict -2 \
-               -c:a opus \
-               -ac 2 \
-               -b:a 320k \
-               -ar 48000 \
-               "$file_to_save"
-}
-
-function preprocess_hardware_h264 {
-    local file_to_cast file_to_save
-    file_to_cast="$1"
-    file_to_save="$2"
-
-    set -x
-
-    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
-    </dev/null exec ffmpeg \
-               -vaapi_device /dev/dri/renderD128 \
-               -i "$file_to_cast" \
-               -vf 'format=nv12,hwupload' \
-               -c:v h264_vaapi \
-               -b:v 2M \
-               -profile:v high \
-               -bf 0 \
-               -strict -2 \
-               -c:a opus \
-               -ac 2 \
-               -b:a 320k \
-               -ar 48000 \
-               "$file_to_save"
-}
-
-function vp9 {
-    local file_to_cast
-    file_to_cast="$3"
-
-    local USERNAME PASSWORD
-    USERNAME="$1"
-    PASSWORD="$2"
-
-    set -x
-
-    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
-    </dev/null exec ffmpeg \
-        -re \
-        -stream_loop -1 \
-        -init_hw_device vaapi=foo:/dev/dri/renderD128 \
-        -hwaccel vaapi \
-        -hwaccel_output_format vaapi \
-        -hwaccel_device foo \
-        -i "$file_to_cast" \
-        -filter_hw_device foo \
-        -vf 'format=nv12|vaapi,hwupload' \
-        -c:v vp9_vaapi \
-        -bf 0 \
-        -strict -2 \
-        -c:a opus \
-        -b:a 320k \
-        -ar 48000 \
-        -f rtsp \
-        -rtsp_transport tcp \
-        "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
-}
-
-function preprocess_hardware_vp9 {
-    local file_to_cast file_to_save
-    file_to_cast="$1"
-    file_to_save="$2"
-
-    set -x
-
-    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
-    </dev/null exec ffmpeg \
-        -init_hw_device vaapi=foo:/dev/dri/renderD128 \
-        -hwaccel vaapi \
-        -hwaccel_output_format vaapi \
-        -hwaccel_device foo \
-        -i "$file_to_cast" \
-        -filter_hw_device foo \
-        -vf 'format=nv12|vaapi,hwupload' \
-        -c:v vp9_vaapi \
-        -bf 0 \
-        -strict -2 \
-        -c:a opus \
-        -b:a 320k \
-        -ar 48000 \
-        "$file_to_save"
-}
-
-function software_vp8 {
-    local USERNAME PASSWORD
-    USERNAME="$1"
-    PASSWORD="$2"
-
-    local file_to_cast
-    file_to_cast="$3"
-
-    set -x
-
-    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
-    # -strict -2 :: Enable support for experimental codecs like opus.
-    # -b:v 2M :: Target 2 megabit/s
-    # -crf 10 :: Target a quality level and adjust bitrate accordingly. This should be preferred, but ideally both should be used.
-    </dev/null exec ffmpeg \
-        -re \
-        -stream_loop -1 \
-        -i "$file_to_cast" \
-        -c:v vp8 \
-        -b:v 2M \
-        -crf 10 \
-        -bf 0 \
-        -c:a opus \
-        -b:a 320k \
-        -ar 48000 \
-        -strict -2 \
-        -f rtsp \
-        -rtsp_transport tcp \
-        "rtsp://$USERNAME:$PASSWORD@172.16.16.251:8554/fetch"
-}
-
-function preprocess_vp8 {
-    local file_to_cast file_to_save
-    file_to_cast="$1"
-    file_to_save="$2"
-
-    set -x
-
-    # -bf 0 :: Disable b-frames because webrtc doesn't support h264 streams with b-frames.
-    # -strict -2 :: Enable support for experimental codecs like opus.
-    # -b:v 2M :: Target 2 megabit/s
-    # -crf 10 :: Target a quality level and adjust bitrate accordingly. This should be preferred, but ideally both should be used.
-    </dev/null exec ffmpeg \
-        -i "$file_to_cast" \
-        -c:v vp8 \
-        -b:v 2M \
-        -crf 10 \
-        -bf 0 \
-        -c:a opus \
-        -b:a 320k \
-        -ar 48000 \
-        -strict -2 \
-        "$file_to_save"
 }
 
 function webcam {

ansible/roles/media/tasks/linux.yaml

@@ -1,3 +1,5 @@
+# Maybe install https://github.com/alexheretic/ab-av1 to find good crf values for encoding
+
 - name: Build aur packages
   register: buildaur
   become_user: "{{ build_user.name }}"

ansible/roles/network/files/main.conf

@@ -1,3 +1,6 @@
 [General]
 EnableNetworkConfiguration=true
 # AddressRandomization=network
+
+# Needed for Qualcomm WCN785x
+ControlPortOverNL80211=false

ansible/roles/nix/tasks/common.yaml

@@ -0,0 +1,55 @@
+# - name: Create directories
+#   file:
+#     name: "{{ item }}"
+#     state: directory
+#     mode: 0755
+#     owner: root
+#     group: wheel
+#   loop:
+#     - /foo/bar
+
+# - name: Install scripts
+#   copy:
+#     src: "files/{{ item.src }}"
+#     dest: "{{ item.dest }}"
+#     mode: 0755
+#     owner: root
+#     group: wheel
+#   loop:
+#     - src: foo.bash
+#       dest: /usr/local/bin/foo
+
+# - name: Install Configuration
+#   copy:
+#     src: "files/{{ item.src }}"
+#     dest: "{{ item.dest }}"
+#     mode: 0600
+#     owner: root
+#     group: wheel
+#   loop:
+#     - src: foo.conf
+#       dest: /usr/local/etc/foo.conf
+
+# - name: Clone Source
+#   git:
+#     repo: "https://foo.bar/baz.git"
+#     dest: /foo/bar
+#     version: "v1.0.2"
+#     force: true
+#   diff: false
+
+- import_tasks: tasks/freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/linux.yaml
+  when: 'os_flavor == "linux"'
+
+- include_tasks:
+    file: tasks/peruser.yaml
+    apply:
+      become: yes
+      become_user: "{{ initialize_user }}"
+  when: users is defined
+  loop: "{{ users | dict2items | community.general.json_query('[?value.initialize==`true`].key') }}"
+  loop_control:
+    loop_var: initialize_user

ansible/roles/nix/tasks/freebsd.yaml

@@ -0,0 +1,5 @@
+# - name: Install packages
+#   package:
+#     name:
+#       - foo
+#     state: present

ansible/roles/nix/tasks/linux.yaml

@@ -0,0 +1,21 @@
+# - name: Build aur packages
+#   register: buildaur
+#   become_user: "{{ build_user.name }}"
+#   command: "aurutils-sync --no-view {{ item }}"
+#   args:
+#     creates: "/var/cache/pacman/custom/{{ item }}-*.pkg.tar.*"
+#   loop:
+#     - nixd
+
+# - name: Update cache
+#   when: buildaur.changed
+#   pacman:
+#     name: []
+#     state: present
+#     update_cache: true
+
+# - name: Install packages
+#   package:
+#     name:
+#       - nixd
+#     state: present

ansible/roles/nix/tasks/main.yaml

@@ -0,0 +1,2 @@
+- import_tasks: tasks/common.yaml
+  # when: foo is defined

ansible/roles/nix/tasks/peruser.yaml

@@ -0,0 +1,29 @@
+- include_role:
+    name: per_user
+
+# - name: Create directories
+#   file:
+#     name: "{{ account_homedir.stdout }}/{{ item }}"
+#     state: directory
+#     mode: 0700
+#     owner: "{{ account_name.stdout }}"
+#     group: "{{ group_name.stdout }}"
+#   loop:
+#     - ".config/foo"
+
+# - name: Copy files
+#   copy:
+#     src: "files/{{ item.src }}"
+#     dest: "{{ account_homedir.stdout }}/{{ item.dest }}"
+#     mode: 0600
+#     owner: "{{ account_name.stdout }}"
+#     group: "{{ group_name.stdout }}"
+#   loop:
+#     - src: foo.conf
+#       dest: .config/foo/foo.conf
+
+- import_tasks: tasks/peruser_freebsd.yaml
+  when: 'os_flavor == "freebsd"'
+
+- import_tasks: tasks/peruser_linux.yaml
+  when: 'os_flavor == "linux"'

ansible/roles/poudriere/files/poudriere.d/currentznver4-default-framework-make.conf

@@ -33,6 +33,7 @@ OPTIONS_SET+=STATIC LTO
 
 .if ${.CURDIR:M*/editors/emacs*}
 OPTIONS_SET+=NATIVECOMP PGTK
+OPTIONS_UNSET+=XPM
 .endif
 
 .if ${.CURDIR:M*/www/firefox*}

ansible/roles/waybar/files/waybar_scripts/waybar_night_mode.bash

@@ -8,7 +8,7 @@ DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 SLEEP_INTERVAL=${SLEEP_INTERVAL:-30}
 
 # ◓◒●◌◎
-# 🟠🟡🟢🟣🟤
+# 🔴🔵🟠🟡🟢🟣🟤
 # 🟥🟦🟧🟨🟩🟪🟫
 # ☀☯⭐🌝🌞⏾
 # 🌑🌓🌗🌕
@@ -42,7 +42,7 @@ function main {
     local night_mode_icon night_mode_text night_mode_class
     night_mode_mode="auto"
     night_mode_class=""
-    wlsunset -l 40.7 -L -74.0 &
+    wlsunset -S 07:00 -s 22:00 &
     wlsunset_pid=$!
 
     while true; do

ansible/roles/zfs/tasks/linux.yaml

@@ -1,7 +1,8 @@
 - name: Install packages
   package:
     name:
-      - linux-lts-headers
+      # - linux-lts-headers
+      - linux-headers
     state: present
 
 - name: Check trusted gpg keys
@@ -26,7 +27,7 @@
   args:
     creates: "/var/cache/pacman/custom/{{ item }}-*.pkg.tar.*"
   loop:
-    - zfs-dkms
+    - zfs-dkms-git
     - zfs-utils
 
 - name: Update cache
@@ -39,7 +40,7 @@
 - name: Install packages
   package:
     name:
-      - zfs-dkms
+      - zfs-dkms-git
       - zfs-utils
     state: present