Add mt7927 driver to quark.

This reverts commit ee4794859a.

nix/configuration/README.org

@@ -1,12 +0,0 @@
-* To-do
-** Perhaps use overlay for /etc for speedup
-#+begin_src nix
-  system.etc.overlay.enable = true;
-#+end_src
-** read https://nixos.org/manual/nixos/stable/
-** Performance for mini pc
-#+begin_src nix
-  security.pam.loginLimits = [
-    { domain = "@users"; item = "rtprio"; type = "-"; value = 1; }
-  ];
-#+end_src

nix/configuration/configuration.nix

@@ -1,16 +1,9 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 
-let
-  alias_nix_pin_revision = pkgs.writeShellScriptBin "nix-pin-revision" ''
-    # Usage: nix-pin-revision nixpkgs 'github:NixOS/nixpkgs/00c21e4c93d963c50d4c0c89bfa84ed6e0694df2'
-    exec nix flake lock --override-input "''${@}"
-  '';
-in
 {
   imports = [
     ./roles/2ship2harkinian
@@ -28,7 +21,6 @@ in
     ./roles/d2
     ./roles/direnv
     ./roles/disko
-    ./roles/displaylink
     ./roles/distributed_build
     ./roles/doas
     ./roles/docker
@@ -37,7 +29,6 @@ in
     ./roles/emacs
     ./roles/emulate_isa
     ./roles/esim
-    ./roles/exfat
     ./roles/firefox
     ./roles/firewall
     ./roles/flux
@@ -56,7 +47,6 @@ in
     ./roles/iso_mount
     ./roles/jujutsu
     ./roles/kanshi
-    ./roles/kernel
     ./roles/kodi
     ./roles/kubernetes
     ./roles/latex
@@ -65,7 +55,6 @@ in
     ./roles/media
     ./roles/memtest86
     ./roles/minimal_base
-    ./roles/mitmproxy
     ./roles/network
     ./roles/nix_index
     ./roles/nix_repl
@@ -120,14 +109,14 @@ in
     nix.settings.experimental-features = [
       "nix-command"
       "flakes"
-      # "ca-derivations"
+      "ca-derivations"
       # "blake3-hashes"
       # "git-hashing"
     ];
     nix.settings.trusted-users = [ "@wheel" ];
     nix.settings.connect-timeout = 5;
-    nix.settings.min-free = 5 * 1024 * 1024 * 1024; # Kick off garbage collect if space for nix store is less than 5 GiB
-    nix.settings.max-free = 10 * 1024 * 1024 * 1024; # Run that garbage collect until at least 10 GiB are free.
+    nix.settings.min-free = 128000000;
+    nix.settings.max-free = 1000000000;
     nix.settings.fallback = true;
     nix.settings.warn-dirty = false;
     nix.settings.fsync-metadata = true;
@@ -143,8 +132,7 @@ in
     # Automatic garbage collection
     nix.gc = lib.mkIf (!config.me.buildingPortable) {
       # Runs nix-collect-garbage --delete-older-than 5d
-      # automatic = true;
-      automatic = false;
+      automatic = true;
       persistent = true;
       dates = "monthly";
       # randomizedDelaySec = "14m";
@@ -152,10 +140,6 @@ in
     };
     nix.settings.auto-optimise-store = !config.me.buildingPortable;
 
-    environment.systemPackages = [
-      alias_nix_pin_revision
-    ];
-
     environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
       hideMounts = true;
       directories = [
@@ -239,42 +223,22 @@ in
         );
       in
       [
-        (disableTests "deno") # Tests use too much disk space
-        (disableOptimizations "libtpms")
+        (disableTests "coreutils")
+        (disableTests "coreutils-full")
+        (disableTests "libuv")
+        (final: prev: {
+          inherit (final.unoptimized) libtpms libjxl;
+        })
         (disableOptimizationsPython3 "scipy")
-        (disableOptimizations "assimp")
-        (disableOptimizations "gsl")
-        (final: prev: {
-          rpcs3 = prev.rpcs3.override {
-            glew = (final.glew.override { enableEGL = false; });
-          };
-        })
-        (disableTests "onetbb") # oneTBB tests hang forever on machines with a single core (like my build virtual machine) https://github.com/uxlfoundation/oneTBB/issues/1557
-        (disableTests "aws-c-common") # aws-c-common tests time out on my build virtual machine but run fine on my laptop.
-        (disableOptimizations "onnxruntime") # QuantizeLinearOpTest test failing.
-        (final: prev: {
-          rpcs3 = prev.rpcs3.overrideAttrs (
-            finalAttrs: prevAttrs: {
-              version = "0.0.42-19843";
-
-              src = final.fetchFromGitHub {
-                owner = "RPCS3";
-                repo = "rpcs3";
-                rev = "6567a5a2f8ab47a89db395d6b47a7b59b23d6960";
-                postCheckout = ''
-                  cd $out/3rdparty
-                  git submodule update --init \
-                    fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \
-                    feralinteractive/feralinteractive wolfssl/wolfssl
-                '';
-                hash = "sha256-a1c1+Ui7XyHFTGEZAgRuJasCzQqr2PZNTlwaDUWVb18=";
-              };
-
-              patches = [ ];
-            }
-          );
-        })
-        (disableTests "ada") # test failing with http url is not idempotent.
+        # Works but probably sets python2's scipy to be python3:
+        #
+        # (final: prev: {
+        #   pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
+        #     (python-final: python-prev: {
+        #       scipy = final.unoptimized.python3Packages.scipy;
+        #     })
+        #   ];
+        # })
       ];
 
     # This option defines the first version of NixOS you have installed on this particular machine,

nix/configuration/flake.lock

@@ -22,11 +22,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
+        "lastModified": 1769524058,
+        "narHash": "sha256-zygdD6X1PcVNR2PsyK4ptzrVEiAdbMqLos7utrMDEWE=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
+        "rev": "71a3fc97d80881e91710fe721f1158d3b96ae14d",
         "type": "github"
       },
       "original": {
@@ -162,34 +162,13 @@
         "type": "github"
       }
     },
-    "nix_builder": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "rust-overlay": "rust-overlay_2"
-      },
-      "locked": {
-        "lastModified": 1788488145,
-        "narHash": "sha256-s1UY+kbLtb+5ye4GnE/HKh0idUQ0iiIkMMtGI7cDRHk=",
-        "ref": "refs/heads/main",
-        "rev": "8b28dfb583e094f52fd6ab70c709cc1981d8853d",
-        "revCount": 46,
-        "type": "git",
-        "url": "https://code.fizz.buzz/talexander/nix_builder.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://code.fizz.buzz/talexander/nix_builder.git"
-      }
-    },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1788752844,
-        "narHash": "sha256-VaWGJ6+cIYN2erfSecbRV+4ljI185Ty2wUrXyvQbgOw=",
+        "lastModified": 1770197578,
+        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "dc5d91f840324650bac8c379428c7037a416959a",
+        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
         "type": "github"
       },
       "original": {
@@ -247,7 +226,6 @@
         "disko": "disko",
         "impermanence": "impermanence",
         "lanzaboote": "lanzaboote",
-        "nix_builder": "nix_builder",
         "nixpkgs": "nixpkgs"
       }
     },
@@ -271,27 +249,6 @@
         "repo": "rust-overlay",
         "type": "github"
       }
-    },
-    "rust-overlay_2": {
-      "inputs": {
-        "nixpkgs": [
-          "nix_builder",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1779506148,
-        "narHash": "sha256-OffE5yuMrSW71zIJNLvtl9MCO6WTAHEjlFPUCvkd/QM=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "d9973e2ab49747fada06ebbe26cda27eb0220cf1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
     }
   },
   "root": "root",

nix/configuration/flake.nix

@@ -28,10 +28,7 @@
       url = "github:nix-community/disko";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    nix_builder = {
-      url = "git+https://code.fizz.buzz/talexander/nix_builder.git";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    mt7927.url = "github:cmspam/mt7927-nixos";
   };
 
   outputs =
@@ -41,7 +38,7 @@
       disko,
       impermanence,
       lanzaboote,
-      nix_builder,
+      mt7927,
       ...
     }:
     let
@@ -73,7 +70,7 @@
         hostname: nodeConfig: format:
         nixpkgs.lib.nixosSystem {
           specialArgs = {
-            inherit self nix_builder;
+            inherit self;
 
             this_nixos_config = self.nixosConfigurations."${hostname}";
 
@@ -83,6 +80,7 @@
             impermanence.nixosModules.impermanence
             lanzaboote.nixosModules.lanzaboote
             disko.nixosModules.disko
+            mt7927.nixosModules.default
             ./configuration.nix
             (./. + "/hosts/${hostname}")
             (./. + "/formats/${format}.nix")

nix/configuration/hosts/family_disks/distributed_build.nix

@@ -4,19 +4,16 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = false;
-      enable_substituter = false;
+      enable = false;
       additional_config = {
         speedFactor = 2;
       };
     };
     me.distributed_build.machines.hydra = {
-      enable_build = false;
-      enable_substituter = true;
+      enable = true;
       additional_config = {
         speedFactor = 2;
       };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/hydra/default.nix

@@ -20,7 +20,7 @@
   config = {
     networking =
       let
-        interface = "enp0s10";
+        interface = "enp0s2";
       in
       {
         # Generate with `head -c4 /dev/urandom | od -A none -t x4`
@@ -129,8 +129,6 @@
     # systemd.user.extraConfig = "DefaultLimitNOFILE=8192";
     # systemd.services."user@11400".serviceConfig.LimitNOFILE = "8192";
 
-    nix.settings.secret-key-files = [ "/persist/manual/nix/nix-cache-key.sec" ];
-
     me.build_in_ram.enable = true;
     me.dont_use_substituters.enable = true;
     me.hydra.enable = true;

nix/configuration/hosts/i_only_boot_zfs/distributed_build.nix

@@ -4,19 +4,10 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = false;
-      enable_substituter = false;
+      enable = true;
       additional_config = {
         speedFactor = 2;
       };
     };
-    me.distributed_build.machines.hydra = {
-      enable_build = false;
-      enable_substituter = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
-    };
   };
 }

nix/configuration/hosts/odo/SELF_BUILD

@@ -5,6 +5,7 @@ IFS=$'\n\t'
 DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 
 : "${JOBS:="1"}"
+: "${NOM:="true"}"
 
 for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
 

nix/configuration/hosts/odo/default.nix

@@ -94,7 +94,6 @@
     me.emacs_flavor = "full";
     me.emulate_isa.enable = true;
     me.esim.enable = true;
-    me.exfat.enable = true;
     me.firefox.enable = true;
     me.firewall.enable = true;
     me.flux.enable = true;
@@ -111,14 +110,12 @@
     me.jujutsu.config = ../../roles/jujutsu/files/jujutsu_config_home.toml;
     me.jujutsu.enable = true;
     me.kanshi.enable = false;
-    me.kernel.enable = true;
     me.kubernetes.enable = true;
     me.latex.enable = true;
     me.launch_keyboard.enable = true;
     me.lvfs.enable = true;
     me.media.enable = true;
     me.memtest.enable = true;
-    me.mitmproxy.enable = true;
     me.network.enable = true;
     me.nix_index.enable = true;
     me.nix_repl.enable = true;
@@ -166,8 +163,8 @@
     me.zrepl.enable = true;
     me.zsh.enable = true;
 
-    me.sm64ex.enable = false;
-    me.shipwright.enable = false;
+    me.sm64ex.enable = true;
+    me.shipwright.enable = true;
     me.ship2harkinian.enable = true;
   };
 }

nix/configuration/hosts/odo/distributed_build.nix

@@ -4,19 +4,16 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = true;
-      enable_substituter = false;
+      enable = false;
       additional_config = {
         speedFactor = 2;
       };
     };
     me.distributed_build.machines.hydra = {
-      enable_build = false;
-      enable_substituter = true;
+      enable = true;
       additional_config = {
         speedFactor = 2;
       };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/odowork/default.nix

@@ -92,7 +92,6 @@
     me.chromium.enable = true;
     me.d2.enable = true;
     me.direnv.enable = true;
-    me.displaylink.enable = true;
     me.doas.enable = true;
     me.docker.enable = false;
     me.dont_use_substituters.enable = true;
@@ -112,7 +111,6 @@
     me.iso_mount.enable = true;
     me.jujutsu.config = ../../roles/jujutsu/files/jujutsu_config_home.toml;
     me.jujutsu.enable = true;
-    me.kernel.enable = true;
     me.latex.enable = true;
     me.launch_keyboard.enable = true;
     me.lvfs.enable = true;

nix/configuration/hosts/odowork/distributed_build.nix

@@ -4,19 +4,16 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = false;
-      enable_substituter = false;
+      enable = false;
       additional_config = {
         speedFactor = 2;
       };
     };
     me.distributed_build.machines.hydra = {
-      enable_build = false;
-      enable_substituter = true;
+      enable = true;
       additional_config = {
         speedFactor = 2;
       };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/quark/default.nix

@@ -11,6 +11,7 @@
     ./hardware-configuration.nix
     ./power_management.nix
     ./waybar.nix
+    ./wifi.nix
   ];
 
   config = {
@@ -104,14 +105,12 @@
     me.jujutsu.config = ../../roles/jujutsu/files/jujutsu_config_home.toml;
     me.jujutsu.enable = true;
     me.kanshi.enable = false;
-    me.kernel.enable = true;
     me.kubernetes.enable = true;
     me.latex.enable = true;
     me.launch_keyboard.enable = true;
     me.lvfs.enable = true;
     me.media.enable = true;
     me.memtest.enable = true;
-    me.mitmproxy.enable = true;
     me.network.enable = true;
     me.nix_index.enable = true;
     me.nix_repl.enable = true;
@@ -160,8 +159,8 @@
     me.zrepl.enable = true;
     me.zsh.enable = true;
 
-    me.sm64ex.enable = false;
-    me.shipwright.enable = false;
+    me.sm64ex.enable = true;
+    me.shipwright.enable = true;
     me.ship2harkinian.enable = true;
   };
 }

nix/configuration/hosts/quark/distributed_build.nix

@@ -3,20 +3,11 @@
 
   config = {
     me.distributed_build.enable = true;
-    me.distributed_build.machines.quark = {
-      enable_build = false;
-      enable_substituter = false;
-      additional_config = {
-        speedFactor = 2;
-      };
-    };
     me.distributed_build.machines.hydra = {
-      enable_build = false;
-      enable_substituter = true;
+      enable = true;
       additional_config = {
         speedFactor = 2;
       };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
     };
   };
 }

nix/configuration/hosts/quark/wifi.nix

@@ -0,0 +1,20 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  imports = [ ];
+
+  config = {
+    hardware.mediatek-mt7927 = {
+      enable = true;
+      enableWifi = true;
+      enableBluetooth = true;
+      # Highly recommended to fix upload speed issues
+      disableAspm = true;
+    };
+  };
+}

nix/configuration/hosts/recovery/distributed_build.nix

@@ -4,19 +4,10 @@
   config = {
     me.distributed_build.enable = true;
     me.distributed_build.machines.quark = {
-      enable_build = false;
-      enable_substituter = false;
+      enable = true;
       additional_config = {
         speedFactor = 2;
       };
     };
-    me.distributed_build.machines.hydra = {
-      enable_build = false;
-      enable_substituter = true;
-      additional_config = {
-        speedFactor = 2;
-      };
-      substituter_url = "ssh-ng://nixworker@ns1.fizz.buzz:65122?compress=true&ssh-key=/persist/manual/ssh/root/keys/id_ed25519&remote-store=local?root=/.disk/root";
-    };
   };
 }

nix/configuration/roles/base/default.nix

@@ -14,12 +14,6 @@ let
   cleanup_temporary_files = (
     patchScriptBin "cleanup_temporary_files" (builtins.readFile ./files/cleanup_temporary_files.bash)
   );
-  decode_jwt = (patchScriptBin "decode_jwt" (builtins.readFile ./files/decode_jwt.bash));
-  git_find_merged_branches = (
-    patchScriptBin "git_find_merged_branches" (builtins.readFile ./files/git_find_merged_branches.bash)
-  );
-  git_fix_author = (patchScriptBin "git_fix_author" (builtins.readFile ./files/git_fix_author.bash));
-  rsync_clone = (patchScriptBin "rsync_clone" (builtins.readFile ./files/rsync_clone.bash));
   alias_rga = pkgs.writeShellScriptBin "rga" ''
     exec ${pkgs.ripgrep}/bin/rg -uuu "''${@}"
   '';
@@ -65,16 +59,8 @@ in
       nix-output-monitor # For better view into nixos-rebuild
       # nix-serve-ng # Serve nix store over http
       cleanup_temporary_files
-      decode_jwt
       jq
       inetutils # For whois
-      git_find_merged_branches
-      git_fix_author
-      rsync_clone
     ];
-
-    # Disable installing documentation.
-    documentation.doc.enable = false;
-    documentation.nixos.enable = false;
   };
 }

nix/configuration/roles/base/files/cleanup_temporary_files.bash

@@ -1,7 +1,4 @@
 #!/usr/bin/env bash
 #
 # Delete temporary files on entire disk
-set -euo pipefail
-IFS=$'\n\t'
-
-exec find / -type f '(' -name '*.orig' -or -name '*~' -or -name '*.core' ')' -delete -print 2>/dev/null
+find / -type f '(' -name '*.orig' -or -name '*~' -or -name '*.core' ')' -delete -print 2>/dev/null

nix/configuration/roles/base/files/decode_jwt.bash

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-#
-# Decode the contents of a JWT
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-exec jq -R 'split(".") | .[0],.[1] | gsub("-"; "+") | gsub("_"; "/") | gsub("%3D"; "=")| @base64d | fromjson'

nix/configuration/roles/base/files/git_find_merged_branches.bash

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-# Find local branches that have been merged
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: ${MAIN_BRANCH:="main"}
-
-git checkout -q ${MAIN_BRANCH} && git for-each-ref refs/heads/ "--format=%(refname:short)" | while read branch; do mergeBase=$(git merge-base ${MAIN_BRANCH} $branch) && [[ $(git cherry ${MAIN_BRANCH} $(git commit-tree $(git rev-parse "$branch^{tree}") -p $mergeBase -m _)) == "-"* ]] && echo "$branch"; done

nix/configuration/roles/base/files/git_fix_author.bash

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-git filter-branch --env-filter '
-WRONG_EMAIL="old@email.foo"
-NEW_NAME="New Name"
-NEW_EMAIL="new@email.bar"
-
-if [ "$GIT_COMMITTER_EMAIL" = "$WRONG_EMAIL" ]
-then
-    export GIT_COMMITTER_NAME="$NEW_NAME"
-    export GIT_COMMITTER_EMAIL="$NEW_EMAIL"
-fi
-if [ "$GIT_AUTHOR_EMAIL" = "$WRONG_EMAIL" ]
-then
-    export GIT_AUTHOR_NAME="$NEW_NAME"
-    export GIT_AUTHOR_EMAIL="$NEW_EMAIL"
-fi
-' --tag-name-filter cat --commit-filter 'git commit-tree -S "$@";' -- --branches --tags

nix/configuration/roles/base/files/rsync_clone.bash

@@ -1,8 +0,0 @@
-#!/usr/bin/env bash
-#
-# Wrapper to set rsync flags for cloning a folder preserving attributes
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-exec rsync -aHAXS "$@"

nix/configuration/roles/displaylink/default.nix

@@ -1,40 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  options.me = {
-    displaylink.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = "Whether we want to install displaylink.";
-    };
-  };
-
-  config = lib.mkIf config.me.displaylink.enable (
-    lib.mkMerge [
-      {
-        environment.systemPackages = with pkgs; [
-          displaylink
-        ];
-
-        allowedUnfree = [ "displaylink" ];
-
-        boot = {
-          extraModulePackages = [ config.boot.kernelPackages.evdi ];
-          initrd.kernelModules = [
-            "evdi"
-          ];
-        };
-      }
-      (lib.mkIf config.me.graphical {
-      })
-    ]
-  );
-}

nix/configuration/roles/distributed_build/default.nix

@@ -10,14 +10,7 @@
 
 let
   make_machine_config = name: {
-    enable_build = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = "Whether we want to use the ${name} machine during distributed builds.";
-    };
-
-    enable_substituter = lib.mkOption {
+    enable = lib.mkOption {
       type = lib.types.bool;
       default = false;
       example = true;
@@ -66,35 +59,25 @@ let
       hostName = lib.mkForce "hydra?remote-store=local?root=/.disk/root";
     };
   };
-  build_machine_list = (
-    map (
-      hostname:
-      (lib.mkIf config.me.distributed_build.machines."${hostname}".enable_build (
-        lib.mkMerge [
+  joined_configs =
+    lib.genAttrs
+      (builtins.filter (hostname: config.me.distributed_build.machines."${hostname}".enable) (
+        builtins.attrNames all_nixos_configs
+      ))
+      (
+        hostname:
+        (lib.mkMerge [
           {
             hostName = hostname;
             sshUser = "nixworker";
             sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
             maxJobs = 1;
             supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
-            protocol = "ssh-ng";
           }
           static_host_configs."${hostname}"
           config.me.distributed_build.machines."${hostname}".additional_config
-        ]
-      ))
-    ) (builtins.attrNames all_nixos_configs)
-  );
-  substituters_list = (
-    map (
-      hostname:
-      (lib.mkIf (
-        config.me.distributed_build.machines."${hostname}".enable_substituter
-        && config.me.distributed_build.machines."${hostname}".substituter_url != null
-      ) (config.me.distributed_build.machines."${hostname}".substituter_url))
-    ) (builtins.attrNames all_nixos_configs)
-  );
-  has_any_substituters = substituters_list != [ ];
+        ])
+      );
 in
 {
   imports = [ ];
@@ -134,17 +117,35 @@ in
           "odo:0S/XKSFjjIrihQ7lbHEIebXk/c/xuoodhm0Gz26YhjA="
           "odowork:zg3UKBAyLy3xtZkL0hMtbxHjxgn5A2QY8NNAgyRT6Yo="
           "quark:Eb6ygkIiVlcUqb5hOjEVIQcfYLpCz40YVYA3/rxrgBc="
-          "hydra:1s4Cy9YJLgw4jWx5jdSCfJmIm0hfya7WEy/EwJYI5Ys="
-          "garak:8nUS6/aHl+FmF518WZlG4DzDToQ3fSNnpHR+aFQmkqc="
         ];
       }
       {
-        nix.buildMachines = build_machine_list;
+        nix.buildMachines = (
+          map (
+            hostname:
+            (lib.mkIf config.me.distributed_build.machines."${hostname}".enable (
+              lib.mkMerge [
+                {
+                  hostName = hostname;
+                  sshUser = "nixworker";
+                  sshKey = "/persist/manual/ssh/root/keys/id_ed25519";
+                  maxJobs = 1;
+                  supportedFeatures = all_nixos_configs."${hostname}".config.me.optimizations.system_features;
+                  protocol = "ssh-ng";
+                }
+                static_host_configs."${hostname}"
+                config.me.distributed_build.machines."${hostname}".additional_config
+              ]
+            ))
+          ) (builtins.attrNames all_nixos_configs)
+        );
       }
-      (lib.mkIf has_any_substituters {
-        nix.settings.substitute = lib.mkForce true;
-        nix.settings.substituters = lib.mkForce substituters_list;
-      })
+      # {
+      #   nix.settings.substitute = lib.mkForce true;
+      #   nix.settings.substituters = lib.mkForce (
+      #     lib.mapAttrsToList (hostname: joined_config: "ssh-ng://${joined_config.hostName}") joined_configs
+      #   );
+      # }
     ]
   );
 }

nix/configuration/roles/emacs/files/emacs/early-init.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (setq gc-cons-threshold (* 128 1024 1024)) ;; 128MiB Increase garbage collection threshold for performance (default 800000)
 ;; Increase amount of data read from processes, default 4k
 (when (version<= "27.0" emacs-version)

nix/configuration/roles/emacs/files/emacs/elisp/base-extensions.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (use-package diminish)
 
 ;; Eglot recommends pulling the latest of the standard libraries it

nix/configuration/roles/emacs/files/emacs/elisp/base-functions.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 ;; ========== Function to reload current file =================
 
 (defun reload-file ()
@@ -12,9 +11,10 @@
   "Run a command using the current buffer as stdin and replacing its contents if the command succeeds with the stdout from the command. This is useful for code formatters."
   (let (
         (stdout-buffer (generate-new-buffer "tmp-stdout" t))
+        (full-cmd (append '(call-process-region nil nil cmd nil stdout-buffer nil) args))
         )
     (unwind-protect
-        (let ((exit-status (apply #'call-process-region nil nil cmd nil (list stdout-buffer nil) nil args)))
+        (let ((exit-status (eval full-cmd)))
           (if (eq exit-status 0)
               (save-excursion
                 (replace-buffer-contents stdout-buffer)
@@ -31,9 +31,10 @@
   "Run a command using the current buffer as stdin and replacing its contents if the command succeeds with the stdout from the command. This is useful for code formatters. This version only replaces the buffer contents if the command output some text."
   (let (
         (stdout-buffer (generate-new-buffer "tmp-stdout" t))
+        (full-cmd (append '(call-process-region nil nil cmd nil stdout-buffer nil) args))
         )
     (unwind-protect
-        (let ((exit-status (apply #'call-process-region nil nil cmd nil (list stdout-buffer nil) nil args)))
+        (let ((exit-status (eval full-cmd)))
           (if (eq exit-status 0)
               (if (> (buffer-size stdout-buffer) 0)
                   (save-excursion
@@ -54,9 +55,10 @@
   (let (
         (default-directory (or dir default-directory))
         (stdout-buffer (generate-new-buffer "tmp-stdout" t))
+        (full-cmd (append '(call-process cmd nil (list stdout-buffer nil) nil) args))
         )
     (unwind-protect
-        (let ((exit-status (condition-case nil (apply #'call-process cmd nil (list stdout-buffer nil) nil args) (file-missing nil))))
+        (let ((exit-status (condition-case nil (eval full-cmd) (file-missing nil))))
           (if (eq exit-status 0)
               (progn
                 (with-current-buffer stdout-buffer

nix/configuration/roles/emacs/files/emacs/elisp/base-global-keys.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 ;; Add your keys here, as such
 
 ;; Disable the suspend frame hotkeys

nix/configuration/roles/emacs/files/emacs/elisp/base-theme.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 ;; Set theme
 (load-theme 'tango-dark t)
 (set-face-attribute 'default nil :background "black")

nix/configuration/roles/emacs/files/emacs/elisp/base.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (package-initialize)
 (use-package use-package
   :custom

nix/configuration/roles/emacs/files/emacs/elisp/common-lsp.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (use-package eglot
   ;; This is an emacs built-in but we're pulling the latest version
   :pin gnu

nix/configuration/roles/emacs/files/emacs/elisp/lang-bash.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'util-tree-sitter)
 
 (use-package bash-ts-mode

nix/configuration/roles/emacs/files/emacs/elisp/lang-c.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)
 

nix/configuration/roles/emacs/files/emacs/elisp/lang-cmake.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 
 (use-package cmake-mode

nix/configuration/roles/emacs/files/emacs/elisp/lang-d2.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (defun d2-format-buffer ()
   "Run prettier."
   (interactive)

nix/configuration/roles/emacs/files/emacs/elisp/lang-dockerfile.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (use-package dockerfile-ts-mode
   :pin manual
   :mode (

nix/configuration/roles/emacs/files/emacs/elisp/lang-go.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)
 

nix/configuration/roles/emacs/files/emacs/elisp/lang-javascript.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)
 

nix/configuration/roles/emacs/files/emacs/elisp/lang-lua.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (defun lua-format-buffer ()
   "Run stylua."
   (interactive)

nix/configuration/roles/emacs/files/emacs/elisp/lang-markdown.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (use-package markdown-mode
   :ensure t
   :commands (markdown-mode gfm-mode)

nix/configuration/roles/emacs/files/emacs/elisp/lang-nft.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (use-package nftables-mode
   :commands nftables-mode
   )

nix/configuration/roles/emacs/files/emacs/elisp/lang-nix.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)
 

nix/configuration/roles/emacs/files/emacs/elisp/lang-org.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'color)
 (let ((bg (face-attribute 'default :background)))
   (use-package org

nix/configuration/roles/emacs/files/emacs/elisp/lang-python.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)
 

nix/configuration/roles/emacs/files/emacs/elisp/lang-rust.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)
 

nix/configuration/roles/emacs/files/emacs/elisp/lang-terraform.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (require 'common-lsp)
 (require 'util-tree-sitter)
 

nix/configuration/roles/emacs/files/emacs/elisp/lang-xml.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (defun xml-fmt ()
   "Run xmllint --format."
   (run-command-on-buffer "xmllint" "--format" "-")

nix/configuration/roles/emacs/files/emacs/elisp/lang-yaml.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (defun yaml-format-buffer ()
   "Run prettier."
   (interactive)

nix/configuration/roles/emacs/files/emacs/elisp/util-flymake.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (use-package flymake
   :pin manual
   :ensure nil

nix/configuration/roles/emacs/files/emacs/elisp/util-tree-sitter.el

@@ -1,5 +1,3 @@
-;; -*- lexical-binding: t; -*-
-
 ;; (add-to-list 'major-mode-remap-alist '(c-mode . c-ts-mode))
 
 (use-package treesit
@@ -15,8 +13,6 @@
   ;;   :custom
   ;;   (treesit-font-lock-level 3)
   (setq treesit-font-lock-level 4)
-  ;; (setq treesit-auto-install-grammar t)
-  ;; (setq treesit-enabled-modes t)
   )
 
 (provide 'util-tree-sitter)

nix/configuration/roles/emacs/files/emacs/elisp/util-vertico.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (defun my/minibuffer-delete (arg)
   "When looking for files, go up an entire directory with the backspace button if theres no text after the directory."
   (interactive "p")

nix/configuration/roles/emacs/files/emacs/init.el

@@ -1,4 +1,3 @@
-;; -*- lexical-binding: t; -*-
 (add-to-list 'load-path (concat user-emacs-directory "elisp"))
 
 (require 'base)

nix/configuration/roles/exfat/default.nix

@@ -1,26 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  options.me = {
-    exfat.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = "Whether we want to install exfat.";
-    };
-  };
-
-  config = lib.mkIf config.me.exfat.enable {
-    # boot.supportedFilesystems = [ "exfat" ];
-    environment.systemPackages = with pkgs; [
-      exfatprogs
-    ];
-  };
-}

nix/configuration/roles/firefox/default.nix

@@ -20,7 +20,7 @@
   config = lib.mkIf (config.me.firefox.enable && config.me.graphical) {
     programs.firefox = {
       enable = true;
-      package = (pkgs.wrapFirefox (pkgs.firefox-unwrapped.override { withPipewire = true; }) { });
+      package = (pkgs.wrapFirefox (pkgs.firefox-unwrapped.override { pipewireSupport = true; }) { });
       languagePacks = [ "en-US" ];
       preferences = {
         # "identity.sync.tokenserver.uri": "https://ffsync.fizz.buzz/token/1.0/sync/1.5";
@@ -134,7 +134,7 @@
       users.talexander = {
         directories = [
           {
-            directory = ".config/mozilla";
+            directory = ".mozilla";
             user = "talexander";
             group = "talexander";
             mode = "0700";

nix/configuration/roles/firewall/default.nix

@@ -24,16 +24,7 @@
     networking.firewall.allowedUDPPorts = [
       5353 # mDNS
     ];
-
-    # networking.firewall.enable = true;
-    # networking.nftables.enable = true;
-
     # Or disable the firewall altogether.
-    networking.firewall.enable = false;
-
-    # Debugging
-    # networking.firewall.logRefusedConnections = true;
-    # networking.firewall.logRefusedPackets = true;
-    # networking.firewall.logReversePathDrops = true;
+    # networking.firewall.enable = false;
   };
 }

nix/configuration/roles/graphics/default.nix

@@ -34,7 +34,7 @@
         environment.systemPackages = with pkgs; [
           mesa-demos # for glxgears
           vulkan-tools # for vkcube
-          xeyes # to test which windows are using x11
+          xorg.xeyes # to test which windows are using x11
         ];
         hardware.graphics.enable = true;
         # hardware.graphics.enable32Bit = true;

nix/configuration/roles/hydra/default.nix

@@ -2,10 +2,56 @@
   config,
   lib,
   pkgs,
-  nix_builder,
   ...
 }:
 
+let
+  # patchScriptBin =
+  #   {
+  #     filename,
+  #     contents,
+  #     path ? [ ],
+  #   }:
+  #   ((pkgs.writeScriptBin filename contents).overrideAttrs (old: {
+  #     buildInputs = [ pkgs.makeWrapper ];
+  #     buildCommand = "${old.buildCommand}\n patchShebangs $out\nwrapProgram $out/bin/${filename} --prefix PATH : ${lib.makeBinPath path}";
+  #   }));
+  nix_builder = pkgs.rustPlatform.buildRustPackage rec {
+    pname = "nix_builder";
+    version = "0.0.0";
+
+    src = pkgs.fetchgit {
+      url = "https://code.fizz.buzz/talexander/nix_builder.git";
+      # tag = version;
+      rev = "606832f505a1ccc9702cd12c236c3188f9282e82";
+      hash = "sha256-WHvnkCIPDBw0BnrQMnBpmwmYuhlxR4FfkoNWw2DY6XE=";
+      leaveDotGit = false;
+    };
+
+    cargoLock = {
+      lockFile = "${src}/Cargo.lock";
+    };
+
+    meta = with lib; {
+      description = "A builder of nix configs for a build server.";
+      homepage = "https://code.fizz.buzz/talexander/nix_builder";
+      license = licenses.bsd0;
+      maintainers = [ ];
+    };
+
+    nativeBuildInputs = [ pkgs.makeWrapper ];
+
+    postInstall = ''
+      wrapProgram $out/bin/nix-builder --prefix PATH : ${
+        lib.makeBinPath [
+          pkgs.git
+          pkgs.nix
+          pkgs.nixos-rebuild
+        ]
+      }
+    '';
+  };
+in
 {
   imports = [ ];
 
@@ -20,7 +66,7 @@
 
   config = lib.mkIf config.me.hydra.enable {
     environment.systemPackages = with pkgs; [
-      nix_builder.packages.x86_64-linux.default
+      nix_builder
       sqlite # For manually inspecting the database.
     ];
 
@@ -58,70 +104,33 @@
       };
     };
 
-    systemd.services."build-cache" =
-      let
-        enabled_targets = [
-          "wip"
-          "odo"
-          "odo_update"
-          "odowork"
-          "odowork_update"
-          "quark"
-          "quark_update"
-          "hydra"
-          "hydra_update"
-          "controller0"
-          "controller0_update"
-          "controller1"
-          "controller1_update"
-          "controller2"
-          "controller2_update"
-          "worker0"
-          "worker0_update"
-          "worker1"
-          "worker1_update"
-          "worker2"
-          "worker2_update"
-          "family_disks"
-          "family_disks_update"
-          "nixbsd"
-          "nix_builder_develop"
-          "organic_develop"
-          "natter_develop"
-        ];
-        build_flags = lib.concatMap (target: [
-          "--target"
-          (lib.escapeShellArg target)
-        ]) enabled_targets;
-      in
-      {
-        script = ''
-          set -euo pipefail
-          IFS=$'\n\t'
-          DIR="$( cd "$( dirname "''${BASH_SOURCE[0]}" )" && pwd )"
+    systemd.services."build-cache" = {
+      script = ''
+        set -euo pipefail
+        IFS=$'\n\t'
+        DIR="$( cd "$( dirname "''${BASH_SOURCE[0]}" )" && pwd )"
 
-          NIX_REMOTE='local?root=/.disk/root' RUST_BACKTRACE=1 RUST_LOG=nix_builder=DEBUG ${nix_builder.packages.x86_64-linux.default}/bin/nix-builder clean --config ${./files/nix_builder.toml}
-          NIX_REMOTE='local?root=/.disk/root' RUST_BACKTRACE=1 RUST_LOG=nix_builder=DEBUG ${nix_builder.packages.x86_64-linux.default}/bin/nix-builder build --config ${./files/nix_builder.toml} ${builtins.concatStringsSep " " build_flags}
-        '';
-        restartIfChanged = false;
-        serviceConfig = {
-          Type = "simple";
-          User = "nixworker";
-          # restartIfChanged = false;
-          # RemainAfterExit = true; # Prevents the service from automatically starting on rebuild. See https://discourse.nixos.org/t/how-to-prevent-custom-systemd-service-from-restarting-on-nixos-rebuild-switch/43431
-          LimitNOFILE = 8192;
-        };
+        NIX_REMOTE='local?root=/.disk/root' RUST_BACKTRACE=1 RUST_LOG=nix_builder=DEBUG ${nix_builder}/bin/nix-builder build --config ${./files/nix_builder.toml} --target odo --target odo_update --target odowork --target odowork_update --target quark --target quark_update --target hydra --target hydra_update --target controller0 --target controller0_update --target controller1 --target controller1_update --target controller2 --target controller2_update --target worker0 --target worker0_update --target worker1 --target worker1_update --target worker2 --target worker2_update --target family_disks --target family_disks_update --target nixbsd
+      '';
+      restartIfChanged = false;
+      serviceConfig = {
+        Type = "simple";
+        User = "nixworker";
+        # restartIfChanged = false;
+        # RemainAfterExit = true; # Prevents the service from automatically starting on rebuild. See https://discourse.nixos.org/t/how-to-prevent-custom-systemd-service-from-restarting-on-nixos-rebuild-switch/43431
+        LimitNOFILE = 8192;
       };
+    };
 
     # TODO: This should move into nix-builder so we can only run clean when builds are passing. Otherwise partial builds will lose progress.
     # TODO: In nix-builder maybe include setting to auto delete to make room during builds if we run out of space, just in case builds are failing for a long time and prevent cleanup from running.
-    # systemd.timers."clean-cache" = {
-    #   wantedBy = [ "timers.target" ];
-    #   timerConfig = {
-    #     OnCalendar = "*-*-01 02:00:00 America/New_York";
-    #     Unit = "clean-cache.service";
-    #   };
-    # };
+    systemd.timers."clean-cache" = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "*-*-01 02:00:00 America/New_York";
+        Unit = "clean-cache.service";
+      };
+    };
 
     systemd.services."clean-cache" = {
       script = ''

nix/configuration/roles/hydra/files/nix_builder.toml

@@ -1,12 +1,5 @@
 output_directory = "/home/nixworker/persist/nix_builder"
 
-[[targets]]
-  name = "wip"
-  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "wip"
-  path = "nix/configuration"
-  attr = "nixosConfigurations.odo.config.system.build.toplevel"
-
 [[targets]]
   name = "odo"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
@@ -74,112 +67,112 @@ output_directory = "/home/nixworker/persist/nix_builder"
 [[targets]]
   name = "controller0"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "controller0.vm_iso"
 
 [[targets]]
   name = "controller0_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "controller0.vm_iso"
   update = true
-  update_branch = "nix_update"
+  update_branch = "kubernetes_update"
 
 [[targets]]
   name = "controller1"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "controller1.vm_iso"
 
 [[targets]]
   name = "controller1_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "controller1.vm_iso"
   update = true
-  update_branch = "nix_update"
+  update_branch = "kubernetes_update"
 
 [[targets]]
   name = "controller2"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "controller2.vm_iso"
 
 [[targets]]
   name = "controller2_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "controller2.vm_iso"
   update = true
-  update_branch = "nix_update"
+  update_branch = "kubernetes_update"
 
 [[targets]]
   name = "worker0"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "worker0.vm_iso"
 
 [[targets]]
   name = "worker0_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "worker0.vm_iso"
   update = true
-  update_branch = "nix_update"
+  update_branch = "kubernetes_update"
 
 [[targets]]
   name = "worker1"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "worker1.vm_iso"
 
 [[targets]]
   name = "worker1_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "worker1.vm_iso"
   update = true
-  update_branch = "nix_update"
+  update_branch = "kubernetes_update"
 
 [[targets]]
   name = "worker2"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "worker2.vm_iso"
 
 [[targets]]
   name = "worker2_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "kubernetes"
   path = "nix/kubernetes"
   attr = "worker2.vm_iso"
   update = true
-  update_branch = "nix_update"
+  update_branch = "kubernetes_update"
 
 # TODO: Add steam deck
 
 [[targets]]
   name = "family_disks"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "family_disks"
   path = "nix/configuration"
   attr = "nixosConfigurations.family_disks.config.system.build.toplevel"
 
 [[targets]]
   name = "family_disks_update"
   repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nix"
+  branch = "family_disks"
   path = "nix/configuration"
   attr = "nixosConfigurations.family_disks.config.system.build.toplevel"
   update = true
@@ -187,28 +180,7 @@ output_directory = "/home/nixworker/persist/nix_builder"
 
 [[targets]]
   name = "nixbsd"
-  repo = "https://code.fizz.buzz/talexander/machine_setup.git"
-  branch = "nixbsd"
-  path = "nix/nixbsd"
-  attr = "computer.vm"
-
-[[targets]]
-  name = "nix_builder_develop"
-  repo = "https://code.fizz.buzz/talexander/nix_builder.git"
-  branch = "main"
+  repo = "https://github.com/nixos-bsd/nixbsd.git"
+  revision = "828ff7a3c4ee91f548de65a963fca40eaedb171c"
   path = "."
-  attr = "devShells.x86_64-linux.default"
-
-[[targets]]
-  name = "organic_develop"
-  repo = "https://code.fizz.buzz/talexander/organic.git"
-  branch = "main"
-  path = "."
-  attr = "devShells.x86_64-linux.default"
-
-[[targets]]
-  name = "natter_develop"
-  repo = "https://code.fizz.buzz/talexander/natter.git"
-  branch = "main"
-  path = "."
-  attr = "devShells.x86_64-linux.default"
+  attr = "base.vmClosureInfo"

nix/configuration/roles/kernel/default.nix

@@ -1,175 +0,0 @@
-# Check current config:
-#   nix build '/persist/machine_setup/nix/configuration#nixosConfigurations.hydra.pkgs.linux_me.configfile'
-#   cat $(nix eval --raw '/persist/machine_setup/nix/configuration#nixosConfigurations.hydra.pkgs.linux_me.configfile') | less
-
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  preemption_type = with lib.kernel; {
-    full = {
-      PREEMPT_DYNAMIC = yes;
-      PREEMPT = yes;
-      PREEMPT_LAZY = lib.mkForce no;
-    };
-    lazy = {
-      PREEMPT_DYNAMIC = yes;
-      PREEMPT = no;
-      PREEMPT_LAZY = yes;
-    };
-  };
-  tick_hz =
-    with lib.kernel;
-    {
-      "1000" = {
-        HZ_1000 = yes;
-        HZ = freeform "1000";
-      };
-    }
-    // lib.genAttrs [ "100" "250" "300" "500" "600" "750" ] (hz: {
-      HZ_1000 = no;
-      "HZ_${hz}" = yes;
-      HZ = freeform hz;
-    });
-  performance_governor = with lib.kernel; {
-    default = {
-      CPU_FREQ_DEFAULT_GOV_SCHEDUTIL = yes;
-    };
-    performance = {
-      CPU_FREQ_DEFAULT_GOV_SCHEDUTIL = no;
-      CPU_FREQ_DEFAULT_GOV_PERFORMANCE = yes;
-    };
-  };
-  tick_rate = with lib.kernel; {
-    # Always tick at the hz frequency.
-    periodic = {
-      NO_HZ_IDLE = no;
-      NO_HZ_FULL = no;
-      NO_HZ = no;
-      NO_HZ_COMMON = no;
-      HZ_PERIODIC = yes;
-    };
-    # Idle - Do not disturb the CPU when idle. This can save power but increase latency.
-    idle = {
-      HZ_PERIODIC = no;
-      NO_HZ_FULL = no;
-      NO_HZ_IDLE = yes;
-      NO_HZ = yes;
-      NO_HZ_COMMON = yes;
-    };
-    # Full dyntick system (tickless) - The kernel tries to shut down the tick whenever possible.
-    tickless = {
-      HZ_PERIODIC = no;
-      NO_HZ_IDLE = no;
-      NO_HZ_FULL = yes;
-      NO_HZ = yes;
-      NO_HZ_COMMON = yes;
-      CONTEXT_TRACKING = yes;
-    };
-  };
-  huge_page = with lib.kernel; {
-    always = {
-      TRANSPARENT_HUGEPAGE_MADVISE = no;
-      TRANSPARENT_HUGEPAGE_ALWAYS = yes;
-    };
-    madvise = {
-      TRANSPARENT_HUGEPAGE_ALWAYS = no;
-      TRANSPARENT_HUGEPAGE_MADVISE = yes;
-    };
-  };
-  common_config = with lib.kernel; {
-    # Google's BBRv3 TCP congestion Control
-    TCP_CONG_BBR = yes;
-    DEFAULT_BBR = yes;
-  };
-  flavors = {
-    server = lib.mkMerge [
-      preemption_type.lazy
-      tick_hz."300"
-      performance_governor.default
-      tick_rate.tickless
-      huge_page.madvise
-    ];
-    interactive =
-      with lib.kernel;
-      lib.mkMerge [
-        {
-          # Enable RCU Lazy - Reduces power consumption when idle or lightly loaded. Useful for battery-powered devices like laptops.
-          RCU_LAZY = yes;
-        }
-        preemption_type.lazy
-        tick_hz."300"
-        performance_governor.default
-        tick_rate.tickless
-        huge_page.madvise
-      ];
-  };
-in
-{
-  imports = [ ];
-
-  options.me = {
-    kernel.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = "Whether we want to install kernel.";
-    };
-
-    kernel.version = lib.mkOption {
-      type = lib.types.str;
-      # default = "linux"; # LTS
-      default = "linux_7_2"; # LTS
-      example = "linux_6_18";
-      description = "What version of the kernl should we use.";
-    };
-
-    kernel.flavor = lib.mkOption {
-      type = lib.types.str;
-      default = "interactive";
-      example = "server";
-      description = "What type of kernel should be built.";
-    };
-  };
-
-  config = lib.mkIf config.me.kernel.enable (
-    lib.mkMerge [
-      {
-        boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_me;
-      }
-      (lib.mkIf (!config.me.optimizations.enable) {
-        nixpkgs.overlays = [
-          (final: prev: {
-            linux_me = final."${config.me.kernel.version}";
-          })
-        ];
-      })
-      (lib.mkIf (config.me.optimizations.enable) {
-        nixpkgs.overlays = [
-          (
-            final: prev:
-            let
-              addConfig =
-                additionalConfig: pkg:
-                pkg.override (oldconfig: {
-                  structuredExtraConfig = lib.mkMerge ([ pkg.structuredExtraConfig ] ++ additionalConfig);
-                  # stdenv = pkgs.llvmPackages_latest.stdenv;
-                  # stdenv = pkgs.clangStdenv;
-                });
-            in
-            {
-              linux_me = addConfig ([
-                common_config
-                flavors."${config.me.kernel.flavor}"
-              ]) final."${config.me.kernel.version}";
-            }
-          )
-        ];
-      })
-    ]
-  );
-}

nix/configuration/roles/latex/default.nix

@@ -25,8 +25,8 @@
     nixpkgs.overlays = [
       (final: prev: {
         tex = (
-          pkgs.texliveSmall.withPackages (
-            ps: with ps; [
+          pkgs.texlive.combine {
+            inherit (pkgs.texlive)
               scheme-basic
               dvisvgm
               dvipng # for preview and export as html in org-mode
@@ -44,8 +44,8 @@
               upquote # emacs org-mode pdf export
               lineno # emacs org-mode pdf export
               beamer # emacs org-mode presentation pdf export
-            ]
-          )
+              ;
+          }
         );
       })
     ];

nix/configuration/roles/minimal_base/default.nix

@@ -19,7 +19,6 @@
 
   config = lib.mkIf config.me.minimal_base.enable {
     me.doas.enable = true;
-    me.kernel.enable = true;
     me.network.enable = true;
     me.nvme.enable = true;
     me.ssh.enable = true;

nix/configuration/roles/mitmproxy/default.nix

@@ -1,25 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  options.me = {
-    mitmproxy.enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      example = true;
-      description = "Whether we want to install mitmproxy.";
-    };
-  };
-
-  config = lib.mkIf config.me.mitmproxy.enable {
-    environment.systemPackages = with pkgs; [
-      mitmproxy
-    ];
-  };
-}

nix/configuration/roles/network/default.nix

@@ -6,8 +6,6 @@
 }:
 
 # Alternative DNS servers:
-# "194.242.2.2#doh.mullvad.net"
-# "2a07:e340::2#doh.mullvad.net"
 # "1.0.0.1#cloudflare-dns.com"
 # "1.1.1.1#cloudflare-dns.com"
 # "2606:4700:4700::1001#cloudflare-dns.com"
@@ -16,10 +14,6 @@
 # "8.8.8.8#dns.google"
 # "2001:4860:4860::8844#dns.google"
 # "2001:4860:4860::8888#dns.google"
-# "9.9.9.10#dns10.quad9.net"
-# "149.112.112.10#dns10.quad9.net"
-# "2620:fe::10#dns10.quad9.net"
-# "2620:fe::fe:10#dns10.quad9.net"
 
 let
   patchScriptBin =
@@ -45,10 +39,8 @@ in
     networking.dhcpcd.enable = lib.mkDefault false;
     networking.useDHCP = lib.mkDefault false;
     networking.nameservers = [
-      "9.9.9.10#dns10.quad9.net"
-      "149.112.112.10#dns10.quad9.net"
-      "2620:fe::10#dns10.quad9.net"
-      "2620:fe::fe:10#dns10.quad9.net"
+      "194.242.2.2#doh.mullvad.net"
+      "2a07:e340::2#doh.mullvad.net"
     ];
     services.resolved = {
       enable = true;
@@ -64,7 +56,6 @@ in
     # TODO: The 127.0.0.1 address should probably be moved to a host-specific file.
     networking.extraHosts = ''
       127.0.0.1 ${config.networking.hostName}.home.arpa
-      127.0.0.3 metadata.google.internal
       10.216.1.32		homeserver
       fdfd:5e8a:ee2d::1:32	homeserver
       10.216.1.6		media
@@ -76,15 +67,7 @@ in
       10.217.1.1		drmario
       10.217.2.1		mrmanager
       fdfd:5e8a:ee2d::2:2 mrmanager
-      172.16.16.1		unifi
-      172.16.16.231		plug1
-      172.16.16.232		plug2
-      172.16.16.233		plug3
-      172.16.16.234		plug4
-      172.16.16.235		temperature1
-      172.16.16.236		temperature2
       172.16.16.245		turtle
-      172.16.16.250		sauna
       172.16.16.251		stream
     '';
 

nix/configuration/roles/optimized_build/default.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   ...
 }:
 
@@ -48,13 +49,65 @@
   };
 
   config = lib.mkMerge [
+    (lib.mkIf (!config.me.optimizations.enable) (
+      lib.mkMerge [
+        {
+          boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_18;
+          # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux;
+        }
+      ]
+    ))
     (lib.mkIf config.me.optimizations.enable (
       lib.mkMerge [
         {
+          boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_me;
+
           nixpkgs.hostPlatform = {
             gcc.arch = config.me.optimizations.arch;
             gcc.tune = config.me.optimizations.arch;
           };
+
+          nixpkgs.overlays = [
+            (
+              final: prev:
+              let
+                addConfig =
+                  additionalConfig: pkg:
+                  pkg.override (oldconfig: {
+                    structuredExtraConfig = pkg.structuredExtraConfig // additionalConfig;
+                  });
+              in
+              {
+                linux_me = addConfig {
+                  # Full preemption
+                  PREEMPT = lib.mkOverride 60 lib.kernel.yes;
+                  PREEMPT_VOLUNTARY = lib.mkOverride 60 lib.kernel.no;
+
+                  # Google's BBRv3 TCP congestion Control
+                  TCP_CONG_BBR = lib.kernel.yes;
+                  DEFAULT_BBR = lib.kernel.yes;
+
+                  # Preemptive Full Tickless Kernel at 300Hz
+                  HZ = lib.kernel.freeform "300";
+                  HZ_300 = lib.kernel.yes;
+                  HZ_1000 = lib.kernel.no;
+                } prev.linux_6_18; # or prev.linux
+              }
+            )
+            (final: prev: {
+              inherit (final.unoptimized)
+                assimp
+                binaryen
+                gsl
+                rapidjson
+                ffmpeg-headless
+                ffmpeg
+                pipewire
+                chromaprint
+                gtkmm
+                ;
+            })
+          ];
         }
       ]
     ))

nix/configuration/roles/podman/default.nix

@@ -34,9 +34,7 @@
     # Write config files in /etc/containers
     virtualisation.containers.enable = true;
     # By default this includes "quay.io" which leads to prompting for which registry to download from.
-    virtualisation.containers.registries.settings = {
-      unqualified-search-registries = [ "docker.io" ];
-    };
+    virtualisation.containers.registries.search = [ "docker.io" ];
     virtualisation = {
       podman = {
         enable = true;
@@ -52,23 +50,6 @@
       DOCKER_HOST = "unix://$XDG_RUNTIME_DIR/podman/podman.sock";
     };
 
-    # Increase subuid / subgid to support running buildkit-rootless
-    # ref: https://github.com/moby/buildkit/issues/3297
-    users.users.talexander = {
-      subUidRanges = [
-        {
-          startUid = 100000;
-          count = 262144; # default = 65536
-        }
-      ];
-      subGidRanges = [
-        {
-          startGid = 100000;
-          count = 262144; # default = 65536
-        }
-      ];
-    };
-
     environment.persistence."/state" = lib.mkIf (config.me.mountPersistence) {
       hideMounts = true;
       directories = [

nix/configuration/roles/recovery/default.nix

@@ -29,7 +29,7 @@
       }
       (lib.mkIf config.me.graphical {
         environment.systemPackages = with pkgs; [
-          #ddrescueview
+          ddrescueview
         ];
       })
     ]

nix/configuration/roles/rpcs3/default.nix

@@ -38,7 +38,7 @@ in
           };
         };
         Miscellaneous = {
-          "Pause emulation on RPCS3 focus loss" = false;
+          "Pause emulation on RPCS3 focus loss" = true;
           "Start games in fullscreen mode" = true;
           "Pause Emulation During Home Menu" = false; # true makes the home menu slow
         };
@@ -53,11 +53,6 @@ in
       rpcs3
     ];
 
-    allowedUnfree = [
-      "rpcs3"
-      "corefonts"
-    ];
-
     security.pam.loginLimits = [
       {
         domain = "@wheel";
@@ -73,10 +68,6 @@ in
       }
     ];
 
-    fonts.packages = with pkgs; [
-      corefonts # Needed for Arial, otherwise launching games fails.
-    ];
-
     me.install.user.talexander.file = {
       ".config/rpcs3/config.yml" = lib.mkIf (config.me.rpcs3.config != null) {
         source = rpcs3_config_yaml;
@@ -88,10 +79,6 @@ in
         # Demon's Souls per-game config.
         source = ./files/config_BLUS30443.yml;
       };
-      ".config/rpcs3/custom_configs/config_BLUS30421.yml" = {
-        # The Lord of the Rings The War in the North per-game config.
-        source = ./files/config_BLUS30421.yml;
-      };
       ".config/rpcs3/patches/patch.yml" = {
         # All of the available patches.
         source = ./files/patch.yml;

nix/configuration/roles/rpcs3/files/config_BLUS30421.yml

@@ -1,14 +0,0 @@
-Core:
-  SPU Block Size: Safe
-Video:
-  Write Color Buffers: true
-  Minimum Scalable Dimension: 640
-Net:
-  Internet enabled: Connected
-  IP address: 0.0.0.0
-  Bind address: 0.0.0.0
-  DNS address: 8.8.8.8
-  IP swap list: ""
-  UPNP Enabled: false
-  PSN status: RPCN
-  PSN Country: us

nix/configuration/roles/shikane/default.nix

@@ -37,9 +37,6 @@ in
     me.install.user.talexander.file = {
       ".config/shikane/config.toml" = {
         source = ./files/config.toml;
-        # Shikane opens with write permissions, so we need a regular file, not a symlink to the nix store.
-        method = "overwrite";
-        mode = "0644";
       };
     };
   };

nix/configuration/roles/sm64ex/default.nix

@@ -18,10 +18,7 @@
   };
 
   config = lib.mkIf (config.me.sm64ex.enable && config.me.graphical) {
-    allowedUnfree = [
-      "sm64ex"
-      "baserom.us.z64"
-    ];
+    allowedUnfree = [ "sm64ex" ];
 
     environment.systemPackages = with pkgs; [
       sm64ex

nix/configuration/roles/sound/default.nix

@@ -30,7 +30,7 @@
           # If you want to use JACK applications, uncomment this
           #jack.enable = true;
 
-          extraLadspaPackages = [ pkgs.rnnoise-plugin.ladspa ];
+          extraLv2Packages = [ pkgs.rnnoise-plugin ];
           configPackages = [
             (pkgs.writeTextDir "share/pipewire/pipewire.conf.d/99-input-denoising.conf" ''
               context.modules = [
@@ -43,7 +43,7 @@
                               {
                                   type = ladspa
                                   name = rnnoise
-                                  plugin = "librnnoise_ladspa"
+                                  plugin = "${pkgs.rnnoise-plugin}/lib/ladspa/librnnoise_ladspa.so"
                                   label = noise_suppressor_mono
                                   control = {
                                       "VAD Threshold (%)" = 50.0

nix/configuration/roles/sway/screenshot.nix

@@ -26,7 +26,7 @@ let
           # Maybe add --audio flag? can optionally specify specific device name from `@pactl@ list sources | @grep@ Name`
           bindsym $mod+Shift+print exec @wl-screenrec@ -g "$(@slurp@)" --codec av1 -f "$HOME/$(date +'screencast_%Y-%m-%d-%H%M%S.mkv')"
           bindsym Shift+print exec @wl-screenrec@ --codec av1 -f "$HOME/$(date +'screencast_%Y-%m-%d-%H%M%S.mkv')"
-          bindsym $mod+ctrl+Shift+print exec pkill -SIGINT -f @wl-screenrec@
+          bindsym $mod+ctrl+Shift+print exec pkill -SIGINT @wl-screenrec@
           # Need to make a hotkey to end the recording
         '';
   };

nix/configuration/roles/thunderbolt/default.nix

@@ -21,18 +21,5 @@
     environment.systemPackages = with pkgs; [
       bolt # For boltctl
     ];
-
-    services.hardware.bolt.enable = true;
-
-    # Trust all thunderbolt devices
-    # services.udev.packages = [
-    #   (pkgs.writeTextFile {
-    #     name = "removable";
-    #     text = ''
-    #       ACTION=="add", SUBSYSTEM=="thunderbolt", ATTR{authorized}=="0", ATTR{authorized}="1"
-    #     '';
-    #     destination = "/etc/udev/rules.d/99-removable.rules";
-    #   })
-    # ];
   };
 }

nix/configuration/roles/vscode/default.nix

@@ -121,12 +121,6 @@ in
             group = "talexander";
             mode = "0755";
           }
-          {
-            directory = ".vscode-shared";
-            user = "talexander";
-            group = "talexander";
-            mode = "0755";
-          }
         ];
       };
     };

nix/configuration/roles/wine/default.nix

@@ -20,9 +20,8 @@
   config = lib.mkIf (config.me.wine.enable && config.me.graphical) {
     environment.systemPackages = with pkgs; [
       # wineWowPackages.stable # supports 32 + 64 bit
-      wineWow64Packages.waylandFull # Supports 32 + 64 bit with native wayland support.
+      wineWowPackages.waylandFull # Supports 32 + 64 bit with native wayland support.
       # winetricks
-      # lutris
     ];
   };
 }

nix/configuration/roles/zfs/default.nix

@@ -44,9 +44,6 @@ in
 
     boot.zfs.devNodes = "/dev/disk/by-partuuid";
 
-    # Do not force import your root pool during boot. Force importing would be useful if the pool had been imported by a different machine most recently.
-    boot.zfs.forceImportRoot = false;
-
     services.zfs = {
       autoScrub = {
         enable = true;

nix/kubernetes/.gitignore

@@ -1 +0,0 @@
-result

nix/kubernetes/README.org

@@ -1,132 +0,0 @@
-* To-do
-** Perhaps use overlay for /etc for speedup
-#+begin_src nix
-  system.etc.overlay.enable = true;
-#+end_src
-** read https://nixos.org/manual/nixos/stable/
-** Performance for mini pc
-#+begin_src nix
-  security.pam.loginLimits = [
-    { domain = "@users"; item = "rtprio"; type = "-"; value = 1; }
-  ];
-#+end_src
-* IP Ranges
-|                                | IPv4                        | IPv6                                    |
-|--------------------------------+-----------------------------+-----------------------------------------|
-| Pod                            | 10.200.0.0/16               | 2620:11f:7001:7:ffff:eeee::/96          |
-| Service                        | 10.197.0.0/16               | fd00:3e42:e349::/112                    |
-| Node                           | 10.215.1.0/24               | 2620:11f:7001:7:ffff:ffff:0ad7:0100/120 |
-| Load Balancer                  | 74.80.180.139-74.80.180.142 | 2620:11f:7001:7:ffff:dddd::/96          |
-| Load Balancer Private (unused) | 10.198.0.0/16               | fd9c:0bd5:22a4::/112                    |
-| PowerDNS from inside cluster   | 10.215.1.211                |                                         |
-* Healthcheck
-** Check cilium status
-#+begin_src bash
-  kubectl -n kube-system exec ds/cilium -- cilium-dbg status --verbose
-  kubectl -n kube-system exec ds/cilium -- cilium-dbg status | grep KubeProxyReplacement
-#+end_src
-** Check connectivity
-#+begin_src bash
-  cilium connectivity test
-#+end_src
-** Show dropped packets
-#+begin_src bash
-  kubectl -n kube-system exec ds/cilium -- cilium-dbg monitor --type drop
-#+end_src
-** Show dropped packets for a specific pod
-#+begin_src bash
-  kubectl -n kube-system exec ds/cilium -- hubble observe --since 30s --pod cnpg-system/cnpg-controller-manager-84d498b97-q5m4n --type drop
-#+end_src
-** Install flux
-#+begin_src bash
-  nix shell 'nixpkgs#fluxcd'
-
-  flux bootstrap git \
-    --url=ssh://git@<host>/<org>/<repository> \
-    --branch=main \
-    --private-key-file=<path/to/private.key> \
-    --password=<key-passphrase> \
-    --path=clusters/my-cluster
-#+end_src
-
-#+begin_src bash
-  nix shell 'nixpkgs#kubernetes-helm'
-
-  helm template --dry-run=server flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
-    --namespace flux-system \
-    --create-namespace
-#+end_src
-
-#+begin_src text
-  apiVersion: fluxcd.controlplane.io/v1
-  kind: FluxInstance
-  metadata:
-    name: flux
-    namespace: flux-system
-    annotations:
-      fluxcd.controlplane.io/reconcileEvery: "1h"
-      fluxcd.controlplane.io/reconcileTimeout: "5m"
-  spec:
-    distribution:
-      version: "2.x"
-      registry: "ghcr.io/fluxcd"
-      artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"
-    components:
-      - source-controller
-      - kustomize-controller
-      - helm-controller
-      - notification-controller
-      - image-reflector-controller
-      - image-automation-controller
-    cluster:
-      type: kubernetes
-      size: medium
-      multitenant: false
-      networkPolicy: true
-      domain: "cluster.local"
-    kustomize:
-      patches:
-        - target:
-            kind: Deployment
-          patch: |
-            - op: replace
-              path: /spec/template/spec/nodeSelector
-              value:
-                kubernetes.io/os: linux
-            - op: add
-              path: /spec/template/spec/tolerations
-              value:
-                - key: "CriticalAddonsOnly"
-                  operator: "Exists"
-    sync:
-      kind: OCIRepository
-      url: "oci://ghcr.io/my-org/my-fleet-manifests"
-      ref: "latest"
-      path: "clusters/my-cluster"
-      pullSecret: "ghcr-auth"
-#+end_src
-
-#+begin_src text
-  apiVersion: fluxcd.controlplane.io/v1
-  kind: FluxInstance
-  metadata:
-    name: flux
-    namespace: flux-system
-  spec:
-    distribution:
-      version: "2.7.x"
-      registry: "ghcr.io/fluxcd"
-    sync:
-      kind: GitRepository
-      url: "ssh://git@10.215.1.210:22/repos/mrmanager"
-      ref: "refs/heads/nix"
-      path: "clusters/my-cluster"
-      pullSecret: "flux-system"
-#+end_src
-
-#+begin_src bash
-  flux create secret git flux-system \
-    --url=https://gitlab.com/my-org/my-fleet.git \
-    --username=git \
-    --password=$GITLAB_TOKEN
-#+end_src

nix/kubernetes/configuration.nix

@@ -1,153 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-
-{
-  imports = [
-    ./roles/boot
-    ./roles/cilium
-    ./roles/containerd
-    ./roles/control_plane
-    ./roles/debugging
-    ./roles/doas
-    ./roles/dont_use_substituters
-    ./roles/etcd
-    ./roles/firewall
-    ./roles/image_based_appliance
-    ./roles/iso
-    ./roles/kernel
-    ./roles/kube_apiserver
-    ./roles/kube_controller_manager
-    ./roles/kube_proxy
-    ./roles/kube_scheduler
-    ./roles/kubelet
-    ./roles/kubernetes
-    ./roles/minimal_base
-    ./roles/network
-    ./roles/nvme
-    ./roles/optimized_build
-    ./roles/ssh
-    ./roles/sshd
-    ./roles/user
-    ./roles/worker_node
-    ./roles/zsh
-    ./util/install_files
-    ./util/unfree_polyfill
-  ];
-
-  config = {
-    nix.settings.experimental-features = [
-      "nix-command"
-      "flakes"
-      # "ca-derivations"
-      # "blake3-hashes"
-      # "git-hashing"
-    ];
-    nix.settings.trusted-users = [ "@wheel" ];
-
-    hardware.enableRedistributableFirmware = true;
-
-    # Keep outputs so we can build offline.
-    nix.settings.keep-outputs = true;
-    nix.settings.keep-derivations = true;
-
-    # Automatic garbage collection
-    nix.gc = lib.mkIf (!config.me.buildingPortable) {
-      # Runs nix-collect-garbage --delete-older-than 5d
-      automatic = true;
-      persistent = true;
-      dates = "monthly";
-      # randomizedDelaySec = "14m";
-      options = "--delete-older-than 30d";
-    };
-    nix.settings.auto-optimise-store = !config.me.buildingPortable;
-
-    # Disable installing documentation.
-    documentation.doc.enable = false;
-    documentation.nixos.enable = false;
-
-    environment.persistence."/persist" = lib.mkIf (config.me.mountPersistence) {
-      hideMounts = true;
-      directories = [
-        "/var/lib/nixos" # Contains user information (uids/gids)
-        "/var/lib/systemd" # Systemd state directory for random seed, persistent timers, core dumps, persist hardware state like backlight and rfkill
-        "/var/log/journal" # Logs, alternatively set `services.journald.storage = "volatile";` to write to /run/log/journal
-      ];
-      files = [
-        "/etc/machine-id" # Systemd unique machine id "otherwise, the system journal may fail to list earlier boots, etc"
-      ];
-    };
-
-    # Write a list of the currently installed packages to /etc/current-system-packages
-    # environment.etc."current-system-packages".text =
-    #   let
-    #     packages = builtins.map (p: "${p.name}") config.environment.systemPackages;
-    #     sortedUnique = builtins.sort builtins.lessThan (lib.unique packages);
-    #     formatted = builtins.concatStringsSep "\n" sortedUnique;
-    #   in
-    #   formatted;
-
-    # nixpkgs.overlays = [
-    #   (final: prev: {
-    #     foot = throw "foo";
-    #   })
-    # ];
-
-    nixpkgs.overlays =
-      let
-        disableTests = (
-          package_name:
-          (final: prev: {
-            "${package_name}" = prev."${package_name}".overrideAttrs (old: {
-              doCheck = false;
-              doInstallCheck = false;
-            });
-          })
-        );
-      in
-      [
-        # (final: prev: {
-        #   imagemagick = prev.imagemagick.overrideAttrs (old: rec {
-        #     # 7.1.2-6 seems to no longer exist, so use 7.1.2-7
-        #     version = "7.1.2-7";
-
-        #     src = final.fetchFromGitHub {
-        #       owner = "ImageMagick";
-        #       repo = "ImageMagick";
-        #       tag = version;
-        #       hash = "sha256-9ARCYftoXiilpJoj+Y+aLCEqLmhHFYSrHfgA5DQHbGo=";
-        #     };
-        #   });
-        # })
-        # (final: prev: {
-        #   grub2 = (final.callPackage ./package/grub { });
-        # })
-        (final: prev: {
-          inherit (final.unoptimized)
-            libtpms
-            ;
-        })
-      ];
-
-    # This option defines the first version of NixOS you have installed on this particular machine,
-    # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
-    #
-    # Most users should NEVER change this value after the initial install, for any reason,
-    # even if you've upgraded your system to a new NixOS release.
-    #
-    # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
-    # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
-    # to actually do that.
-    #
-    # This value being lower than the current NixOS release does NOT mean your system is
-    # out of date, out of support, or vulnerable.
-    #
-    # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
-    # and migrated your data accordingly.
-    #
-    # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
-    system.stateVersion = "24.11"; # Did you read the comment?
-  };
-}

nix/kubernetes/flake.lock

@@ -1,256 +0,0 @@
-{
-  "nodes": {
-    "crane": {
-      "locked": {
-        "lastModified": 1731098351,
-        "narHash": "sha256-HQkYvKvaLQqNa10KEFGgWHfMAbWBfFp+4cAgkut+NNE=",
-        "owner": "ipetkov",
-        "repo": "crane",
-        "rev": "ef80ead953c1b28316cc3f8613904edc2eb90c28",
-        "type": "github"
-      },
-      "original": {
-        "owner": "ipetkov",
-        "repo": "crane",
-        "type": "github"
-      }
-    },
-    "disko": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1781152676,
-        "narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
-        "owner": "nix-community",
-        "repo": "disko",
-        "rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "disko",
-        "type": "github"
-      }
-    },
-    "flake-compat": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1696426674,
-        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
-        "type": "github"
-      },
-      "original": {
-        "owner": "edolstra",
-        "repo": "flake-compat",
-        "type": "github"
-      }
-    },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1730504689,
-        "narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "506278e768c2a08bec68eb62932193e341f55c90",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "gitignore": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "pre-commit-hooks-nix",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709087332,
-        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "gitignore.nix",
-        "type": "github"
-      }
-    },
-    "home-manager": {
-      "inputs": {
-        "nixpkgs": [
-          "impermanence",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1768598210,
-        "narHash": "sha256-kkgA32s/f4jaa4UG+2f8C225Qvclxnqs76mf8zvTVPg=",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "c47b2cc64a629f8e075de52e4742de688f930dc6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "type": "github"
-      }
-    },
-    "impermanence": {
-      "inputs": {
-        "home-manager": "home-manager",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769548169,
-        "narHash": "sha256-03+JxvzmfwRu+5JafM0DLbxgHttOQZkUtDWBmeUkN8Y=",
-        "owner": "nix-community",
-        "repo": "impermanence",
-        "rev": "7b1d382faf603b6d264f58627330f9faa5cba149",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "repo": "impermanence",
-        "type": "github"
-      }
-    },
-    "lanzaboote": {
-      "inputs": {
-        "crane": "crane",
-        "flake-compat": "flake-compat",
-        "flake-parts": "flake-parts",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "pre-commit-hooks-nix": "pre-commit-hooks-nix",
-        "rust-overlay": "rust-overlay"
-      },
-      "locked": {
-        "lastModified": 1737639419,
-        "narHash": "sha256-AEEDktApTEZ5PZXNDkry2YV2k6t0dTgLPEmAZbnigXU=",
-        "owner": "nix-community",
-        "repo": "lanzaboote",
-        "rev": "a65905a09e2c43ff63be8c0e86a93712361f871e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-community",
-        "ref": "v0.4.2",
-        "repo": "lanzaboote",
-        "type": "github"
-      }
-    },
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1788752844,
-        "narHash": "sha256-VaWGJ6+cIYN2erfSecbRV+4ljI185Ty2wUrXyvQbgOw=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "dc5d91f840324650bac8c379428c7037a416959a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs-stable": {
-      "locked": {
-        "lastModified": 1730741070,
-        "narHash": "sha256-edm8WG19kWozJ/GqyYx2VjW99EdhjKwbY3ZwdlPAAlo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "d063c1dd113c91ab27959ba540c0d9753409edf3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-24.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "pre-commit-hooks-nix": {
-      "inputs": {
-        "flake-compat": [
-          "lanzaboote",
-          "flake-compat"
-        ],
-        "gitignore": "gitignore",
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ],
-        "nixpkgs-stable": "nixpkgs-stable"
-      },
-      "locked": {
-        "lastModified": 1731363552,
-        "narHash": "sha256-vFta1uHnD29VUY4HJOO/D6p6rxyObnf+InnSMT4jlMU=",
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "rev": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "cachix",
-        "repo": "pre-commit-hooks.nix",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "disko": "disko",
-        "impermanence": "impermanence",
-        "lanzaboote": "lanzaboote",
-        "nixpkgs": "nixpkgs"
-      }
-    },
-    "rust-overlay": {
-      "inputs": {
-        "nixpkgs": [
-          "lanzaboote",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1731897198,
-        "narHash": "sha256-Ou7vLETSKwmE/HRQz4cImXXJBr/k9gp4J4z/PF8LzTE=",
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "rev": "0be641045af6d8666c11c2c40e45ffc9667839b5",
-        "type": "github"
-      },
-      "original": {
-        "owner": "oxalica",
-        "repo": "rust-overlay",
-        "type": "github"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

nix/kubernetes/flake.nix

@@ -1,183 +0,0 @@
-# Get a repl for this flake
-#   nix repl --expr "builtins.getFlake \"$PWD\""
-
-# TODO maybe use `nix eval --raw .#odo.iso.outPath`
-
-#
-# Install on a new machine:
-#
-# Set
-#   me.disko.enable = true;
-#   me.disko.offline.enable = true;
-#
-# Run
-#   doas disko --mode destroy,format,mount hosts/recovery/disk-config.nix
-#   doas nixos-install --substituters "http://10.0.2.2:8080?trusted=1 https://cache.nixos.org/" --flake ".#recovery"
-
-{
-  description = "My system configuration";
-
-  inputs = {
-    impermanence = {
-      url = "github:nix-community/impermanence";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    lanzaboote = {
-      url = "github:nix-community/lanzaboote/v0.4.2";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    disko = {
-      url = "github:nix-community/disko";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-  };
-
-  outputs =
-    {
-      self,
-      nixpkgs,
-      disko,
-      impermanence,
-      lanzaboote,
-      ...
-    }:
-    let
-      forAllSystems =
-        func:
-        builtins.listToAttrs (
-          map (system: {
-            name = system;
-            value = func system;
-          }) nixpkgs.lib.systems.flakeExposed
-        );
-      nodes = {
-        controller0 = {
-          system = "x86_64-linux";
-        };
-        controller1 = {
-          system = "x86_64-linux";
-        };
-        controller2 = {
-          system = "x86_64-linux";
-        };
-        worker0 = {
-          system = "x86_64-linux";
-        };
-        worker1 = {
-          system = "x86_64-linux";
-        };
-        worker2 = {
-          system = "x86_64-linux";
-        };
-      };
-      nixosConfigs = builtins.mapAttrs (
-        hostname: nodeConfig: format:
-        nixpkgs.lib.nixosSystem {
-          specialArgs = {
-            inherit self;
-
-            this_nixos_config = self.nixosConfigurations."${hostname}";
-
-            all_nixos_configs = self.nixosConfigurations;
-          };
-          modules = [
-            impermanence.nixosModules.impermanence
-            lanzaboote.nixosModules.lanzaboote
-            disko.nixosModules.disko
-            ./configuration.nix
-            (./. + "/hosts/${hostname}")
-            (./. + "/formats/${format}.nix")
-            {
-              config = {
-                nixpkgs.hostPlatform.system = nodeConfig.system;
-                nixpkgs.overlays = [
-                  (final: prev: {
-                    # stable = nixpkgs-stable.legacyPackages."${prev.stdenv.hostPlatform.system}";
-                    unoptimized = import nixpkgs {
-                      system = prev.stdenv.hostPlatform.system;
-                      hostPlatform.gcc.arch = "default";
-                      hostPlatform.gcc.tune = "default";
-                    };
-                  })
-                ];
-              };
-            }
-            (
-              {
-                config,
-                lib,
-                pkgs,
-                ...
-              }:
-              let
-                nix-self-repl = pkgs.writeShellScriptBin "nix-self-repl" ''
-                  source /etc/set-environment
-                  nix repl --expr 'builtins.getFlake "${self}"'
-                '';
-                # If we wanted the current version of a flake then we'd just launch
-                #   nix repl
-                # and then run:
-                #   :lf /path/to/flake
-              in
-              {
-                config = {
-                  environment.systemPackages = lib.mkIf config.nix.enable [ nix-self-repl ];
-                };
-              }
-            )
-          ];
-        }
-      ) nodes;
-      installerConfig =
-        hostname: nodeConfig:
-        nixpkgs.lib.nixosSystem {
-          specialArgs = {
-            targetSystem = self.nixosConfigurations."${hostname}";
-          };
-          modules = [
-            ./formats/installer.nix
-            (
-              {
-                config,
-                lib,
-                pkgs,
-                ...
-              }:
-              let
-                nix-self-repl = pkgs.writeShellScriptBin "nix-self-repl" ''
-                  source /etc/set-environment
-                  nix repl --expr 'builtins.getFlake "${self}"'
-                '';
-                # If we wanted the current version of a flake then we'd just launch
-                #   nix repl
-                # and then run:
-                #   :lf /path/to/flake
-              in
-              {
-                config = {
-                  environment.systemPackages = lib.mkIf config.nix.enable [ nix-self-repl ];
-                };
-              }
-            )
-            ({ nixpkgs.hostPlatform.system = nodeConfig.system; })
-          ];
-        };
-    in
-    {
-      nixosConfigurations = (builtins.mapAttrs (name: value: value "toplevel") nixosConfigs);
-    }
-    // {
-      packages = (
-        forAllSystems (
-          system:
-          (builtins.mapAttrs (hostname: nodeConfig: {
-            iso = (nixosConfigs."${hostname}" "iso").config.system.build.isoImage;
-            vm_iso = (nixosConfigs."${hostname}" "vm_iso").config.system.build.isoImage;
-            sd = (nixosConfigs."${hostname}" "sd").config.system.build.sdImage;
-            installer = (installerConfig hostname nodes."${hostname}").config.system.build.isoImage;
-          }) (nixpkgs.lib.attrsets.filterAttrs (hostname: nodeConfig: nodeConfig.system == system) nodes))
-        )
-      );
-    };
-}

nix/kubernetes/formats/installer.nix

@@ -1,74 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  modulesPath,
-  targetSystem,
-  ...
-}:
-let
-  installer = pkgs.writeShellApplication {
-    name = "installer";
-    runtimeInputs = with pkgs; [
-      # clevis
-      dosfstools
-      e2fsprogs
-      gawk
-      nixos-install-tools
-      util-linux
-      config.nix.package
-    ];
-    text = ''
-      set -euo pipefail
-
-      ${targetSystem.config.system.build.diskoScript}
-
-      nixos-install --no-channel-copy --no-root-password --option substituters "" --system ${targetSystem.config.system.build.toplevel}
-    '';
-  };
-  installerFailsafe = pkgs.writeShellScript "failsafe" ''
-    ${lib.getExe installer} || echo "ERROR: Installation failure!"
-    sleep 3600
-  '';
-in
-{
-  imports = [
-    (modulesPath + "/installer/cd-dvd/iso-image.nix")
-    (modulesPath + "/profiles/all-hardware.nix")
-  ];
-
-  # boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux_6_17;
-  # boot.zfs.package = pkgs.zfs_unstable;
-  boot.kernelPackages = pkgs.linuxPackagesFor pkgs.linux;
-  boot.kernelParams = [
-    "quiet"
-    "systemd.unit=getty.target"
-  ];
-  boot.supportedFilesystems.zfs = true;
-  boot.initrd.systemd.enable = true;
-
-  networking.hostId = "04581ecf";
-
-  isoImage.makeEfiBootable = true;
-  isoImage.makeUsbBootable = true;
-  isoImage.squashfsCompression = "zstd -Xcompression-level 15";
-
-  environment.systemPackages = [
-    installer
-  ];
-
-  systemd.services."getty@tty1" = {
-    overrideStrategy = "asDropin";
-    serviceConfig = {
-      ExecStart = [
-        ""
-        installerFailsafe
-      ];
-      Restart = "no";
-      StandardInput = "null";
-    };
-  };
-
-  # system.stateVersion = lib.mkDefault lib.trivial.release;
-  system.stateVersion = "24.11";
-}

nix/kubernetes/formats/iso.nix

@@ -1,36 +0,0 @@
-{
-  config,
-  lib,
-  modulesPath,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/cd-dvd/iso-image.nix")
-  ];
-
-  config = {
-    isoImage.makeEfiBootable = true;
-    isoImage.makeUsbBootable = true;
-
-    networking.dhcpcd.enable = true;
-    networking.useDHCP = true;
-
-    me.buildingPortable = true;
-    me.disko.enable = true;
-    me.disko.offline.enable = true;
-    me.mountPersistence = lib.mkForce false;
-    # me.optimizations.enable = lib.mkForce false;
-
-    # Not doing image_based_appliance because this might be an install ISO, in which case we'd need nix to do the install.
-    # me.image_based_appliance.enable = true;
-
-    # TODO: Should I use this instead of doing a mkIf for the disk config?
-    # disko.enableConfig = false;
-
-    # Faster image generation for testing/development.
-    isoImage.squashfsCompression = "zstd -Xcompression-level 15";
-  };
-}

nix/kubernetes/formats/sd.nix

@@ -1,32 +0,0 @@
-{
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/sd-card/sd-image.nix")
-  ];
-
-  config = {
-    isoImage.makeEfiBootable = true;
-    isoImage.makeUsbBootable = true;
-
-    boot.loader.grub.enable = false;
-    boot.loader.generic-extlinux-compatible.enable = true;
-
-    # TODO: image based appliance?
-
-    # TODO: Maybe this?
-    # fileSystems = {
-    #   "/" = {
-    #     device = "/dev/disk/by-label/NIXOS_SD";
-    #     fsType = "ext4";
-    #     options = [
-    #       "noatime"
-    #       "norelatime"
-    #     ];
-    #   };
-    # };
-  };
-}

nix/kubernetes/formats/toplevel.nix

@@ -1 +0,0 @@
-{ }

nix/kubernetes/formats/vm_iso.nix

@@ -1,22 +0,0 @@
-{
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/cd-dvd/iso-image.nix")
-    (modulesPath + "/profiles/qemu-guest.nix") # VirtIO kernel modules
-  ];
-
-  config = {
-    isoImage.makeEfiBootable = true;
-    isoImage.makeUsbBootable = true;
-
-    networking.dhcpcd.enable = true;
-    networking.useDHCP = true;
-
-    me.image_based_appliance.enable = true;
-  };
-}

nix/kubernetes/functions/to_yaml.nix

@@ -1,24 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-let
-  to_yaml_file =
-    file_name: contents:
-    let
-      settingsFormat = pkgs.formats.yaml { };
-      yaml_file = settingsFormat.generate file_name contents;
-    in
-    yaml_file;
-  to_yaml =
-    file_name: contents:
-    let
-      settingsFormat = pkgs.formats.yaml { };
-      yaml_file = settingsFormat.generate file_name contents;
-      yaml_content = builtins.readFile yaml_file;
-    in
-    yaml_content;
-in
-{
-  inherit to_yaml to_yaml_file;
-}

nix/kubernetes/hosts/controller0/DEPLOY_BOOT

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=controller0
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild boot --flake "$DIR/../../#controller0" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/kubernetes/hosts/controller0/DEPLOY_SWITCH

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=controller0
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild switch --flake "$DIR/../../#controller0" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/kubernetes/hosts/controller0/ISO

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#controller0.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/kubernetes/hosts/controller0/SELF_BOOT

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild boot --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#controller0" --log-format internal-json -v "${@}" |& nom --json

nix/kubernetes/hosts/controller0/SELF_BUILD

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild build --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#controller0" --log-format internal-json -v "${@}" |& nom --json

nix/kubernetes/hosts/controller0/SELF_SWITCH

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nixos-rebuild switch --show-trace --sudo --max-jobs "$JOBS" --flake "$DIR/../../#controller0" --log-format internal-json -v "${@}" |& nom --json

nix/kubernetes/hosts/controller0/VM_ISO

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#controller0.vm_iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/kubernetes/hosts/controller0/default.nix

@@ -1,130 +0,0 @@
-# MANUAL: On client machines generate signing keys:
-#   nix-store --generate-binary-cache-key some-name /persist/manual/nix/nix-cache-key.sec /persist/manual/nix/nix-cache-key.pub
-#
-# Trust other machines and add the substituters:
-#   nix.binaryCachePublicKeys = [ "some-name:AzNW1MOlkNEsUAXS1jIFZ1QCFKXjV+Y/LrF37quAZ1A=" ];
-#   nix.binaryCaches = [ "https://test.example/nix-cache" ];
-
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    ./hardware-configuration.nix
-    ./vm_disk.nix
-  ];
-
-  config = {
-    networking =
-      let
-        interface = "enp0s10";
-      in
-      {
-        # Generate with `head -c4 /dev/urandom | od -A none -t x4`
-        hostId = "769e1349";
-
-        hostName = "controller0"; # Define your hostname.
-
-        interfaces = {
-          "${interface}" = {
-            ipv4.addresses = [
-              {
-                address = "10.215.1.221";
-                prefixLength = 24;
-              }
-            ];
-
-            ipv6.addresses = [
-              {
-                address = "2620:11f:7001:7:ffff:ffff:0ad7:01dd";
-                prefixLength = 64;
-              }
-            ];
-          };
-        };
-        defaultGateway = "10.215.1.1";
-        defaultGateway6 = {
-          # address = "2620:11f:7001:7::1";
-          address = "2620:11f:7001:7:ffff:ffff:0ad7:0101";
-          inherit interface;
-        };
-
-        dhcpcd.enable = lib.mkForce false;
-        useDHCP = lib.mkForce false;
-      };
-
-    time.timeZone = "America/New_York";
-    i18n.defaultLocale = "en_US.UTF-8";
-
-    me.boot.enable = true;
-    me.boot.secure = false;
-    me.mountPersistence = true;
-    boot.loader.timeout = lib.mkForce 0; # We can always generate a new ISO if we need to access other boot options.
-
-    me.optimizations = {
-      enable = true;
-      arch = "znver4";
-      # build_arch = "x86-64-v3";
-      system_features = [
-        "gccarch-znver4"
-        "gccarch-skylake"
-        "gccarch-kabylake"
-        # "gccarch-alderlake" missing WAITPKG
-        "gccarch-x86-64-v3"
-        "gccarch-x86-64-v4"
-        "benchmark"
-        "big-parallel"
-        "kvm"
-        "nixos-test"
-      ];
-    };
-
-    # Mount tmpfs at /tmp
-    boot.tmp.useTmpfs = true;
-
-    # Enable TRIM
-    # services.fstrim.enable = lib.mkDefault true;
-
-    # nix.optimise.automatic = true;
-    # nix.optimise.dates = [ "03:45" ];
-    # nix.optimise.persistent = true;
-
-    environment.systemPackages = with pkgs; [
-      htop
-    ];
-
-    # nix.sshServe.enable = true;
-    # nix.sshServe.keys = [ "ssh-dss AAAAB3NzaC1k... bob@example.org" ];
-
-    me.etcd.cluster_name = "put-a-nix-on-it";
-    me.etcd.internal_ip = [
-      # "10.215.1.221"
-      "[2620:11f:7001:7:ffff:ffff:0ad7:01dd]"
-    ];
-    me.etcd.initial_cluster = [
-      # "controller0=https://10.215.1.221:2380" # 2620:11f:7001:7:ffff:ffff:0ad7:01dd
-      # "controller1=https://10.215.1.222:2380" # 2620:11f:7001:7:ffff:ffff:0ad7:01de
-      # "controller2=https://10.215.1.223:2380" # 2620:11f:7001:7:ffff:ffff:0ad7:01df
-      "controller0=https://[2620:11f:7001:7:ffff:ffff:0ad7:01dd]:2380" # 10.215.1.221
-      "controller1=https://[2620:11f:7001:7:ffff:ffff:0ad7:01de]:2380" # 10.215.1.222
-      "controller2=https://[2620:11f:7001:7:ffff:ffff:0ad7:01df]:2380" # 10.215.1.223
-    ];
-
-    me.kube_apiserver.internal_ip = "2620:11f:7001:7:ffff:ffff:0ad7:01dd";
-    # me.kube_apiserver.external_ip = "74.80.180.138";
-    me.kube_apiserver.external_ip = "2620:11f:7001:7:ffff:ffff:0ad7:01dd";
-    me.kube_apiserver.etcd_services = [
-      "https://[2620:11f:7001:7:ffff:ffff:0ad7:01dd]:2379" # 10.215.1.221
-      "https://[2620:11f:7001:7:ffff:ffff:0ad7:01de]:2379" # 10.215.1.222
-      "https://[2620:11f:7001:7:ffff:ffff:0ad7:01df]:2379" # 10.215.1.223
-    ];
-
-    me.control_plane.enable = true;
-    me.dont_use_substituters.enable = true;
-    me.etcd.enable = true;
-    me.minimal_base.enable = true;
-  };
-}

nix/kubernetes/hosts/controller0/hardware-configuration.nix

@@ -1,31 +0,0 @@
-{
-  config,
-  lib,
-  modulesPath,
-  ...
-}:
-
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  config = {
-    boot.initrd.availableKernelModules = [
-      "nvme"
-      "xhci_pci"
-      "thunderbolt"
-    ];
-    boot.initrd.kernelModules = [ ];
-    boot.kernelModules = [ ];
-    boot.extraModulePackages = [ ];
-
-    # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-    # (the default) this is the recommended approach. When using systemd-networkd it's
-    # still possible to use this option, but it's recommended to use it in conjunction
-    # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-    # networking.useDHCP = lib.mkDefault true;
-    # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
-    # networking.interfaces.wlp58s0.useDHCP = lib.mkDefault true;
-  };
-}

nix/kubernetes/hosts/controller0/vm_disk.nix

@@ -1,94 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  config = {
-    # Mount the local disk
-    fileSystems = lib.mkIf config.me.mountPersistence {
-      "/.disk" = lib.mkForce {
-        device = "/dev/nvme0n1p1";
-        fsType = "ext4";
-        options = [
-          "noatime"
-          "discard"
-        ];
-        neededForBoot = true;
-      };
-
-      "/.persist" = lib.mkForce {
-        device = "bind9p";
-        fsType = "9p";
-        options = [
-          "noatime"
-          "trans=virtio"
-          "version=9p2000.L"
-          "cache=mmap"
-          "msize=512000"
-          # "noauto"
-          # "x-systemd.automount"
-        ];
-        neededForBoot = true;
-      };
-
-      "/persist" = {
-        fsType = "none";
-        device = "/.persist/persist";
-        options = [
-          "bind"
-          "rw"
-        ];
-        depends = [
-          "/.persist/persist"
-        ];
-        neededForBoot = true;
-      };
-
-      "/state" = {
-        fsType = "none";
-        device = "/.persist/state";
-        options = [
-          "bind"
-          "rw"
-        ];
-        depends = [
-          "/.persist/state"
-        ];
-        neededForBoot = true;
-      };
-
-      "/k8spv" = lib.mkForce {
-        device = "k8spv";
-        fsType = "9p";
-        options = [
-          "noatime"
-          "trans=virtio"
-          "version=9p2000.L"
-          "cache=mmap"
-          "msize=512000"
-          # "noauto"
-          # "x-systemd.automount"
-        ];
-        neededForBoot = true;
-      };
-
-      "/disk" = {
-        fsType = "none";
-        device = "/.disk/persist";
-        options = [
-          "bind"
-          "rw"
-        ];
-        depends = [
-          "/.disk/persist"
-        ];
-        neededForBoot = true;
-      };
-    };
-  };
-}

nix/kubernetes/hosts/controller1/DEPLOY_BOOT

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=controller1
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild boot --flake "$DIR/../../#controller1" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/kubernetes/hosts/controller1/DEPLOY_SWITCH

@@ -1,13 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-TARGET=controller1
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-
-nixos-rebuild switch --flake "$DIR/../../#controller1" --target-host "$TARGET" --build-host "$TARGET" --sudo --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json

nix/kubernetes/hosts/controller1/ISO

@@ -1,10 +0,0 @@
-#!/usr/bin/env bash
-#
-set -euo pipefail
-IFS=$'\n\t'
-DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-
-: "${JOBS:="1"}"
-
-for f in /persist/manual/manual_add_to_store/*; do nix-store --add-fixed sha256 "$f"; done
-nix build --extra-experimental-features nix-command --extra-experimental-features flakes "$DIR/../..#controller1.iso" --max-jobs "$JOBS" --log-format internal-json -v "${@}" |& nom --json