mattermost: remove unsupported edition message from menu

This patch adds explicit requirements for network addresses services to run after and only when udevd service is running. Also depend on virt netdev creation service instead of device

Signed-off-by: Egor Savkin <es@m-labs.hk>

backupdl-module.nix

@@ -0,0 +1,56 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  makeBackup = pkgs.writeScript "make-backupdl" ''
+    #!${pkgs.bash}/bin/bash
+
+    set -e
+
+    export PATH=${pkgs.rsync}/bin:${pkgs.openssh}/bin
+
+    FILENAME=backup-`${pkgs.coreutils}/bin/date +%F`.tar.bz2.gpg
+
+    ssh nixbld.m-labs.hk mlabs-backup > /hdd/backupdl/backupdl/$FILENAME
+    rsync -az nixbld.m-labs.hk:/var/lib/nextcloud/data /hdd/backupdl/nextcloud
+  '';
+
+  cfg = config.services.backupdl;
+in
+{
+  options.services.backupdl = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable backups";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.backupdl = {
+      description = "Nixbld backups download";
+      serviceConfig = {
+        Type = "oneshot";
+        User = "backupdl";
+        Group = "backupdl";
+        ExecStart = "${makeBackup}";
+      };
+    };
+
+    users.users.backupdl = {
+      name = "backupdl";
+      group = "backupdl";
+      description = "Nixbld backups download";
+      isSystemUser = true;
+      createHome = true;
+      home = "/hdd/backupdl";
+      useDefaultShell = true;
+    };
+    users.extraGroups.backupdl = {};
+
+    systemd.timers.backupdl = {
+      description = "Nixbld backups download";
+      wantedBy = [ "timers.target" ];
+      timerConfig.OnCalendar = "wednesday,sunday *-*-* 08:00:00";
+    };
+  };
+}

m-labs-intl/60-tunnels.yaml

@@ -0,0 +1,18 @@
+network:
+   version: 2
+   renderer: networkd
+   ethernets:
+     eth0:
+       addresses:
+       - 5.78.86.156/32
+       - 2a01:4ff:1f0:83de::2/64
+       - 2a01:4ff:1f0:83de::3/64
+       - 2a01:4ff:1f0:83de::4/64
+   tunnels:
+     gre1:
+       mode: gre
+       local: 5.78.86.156
+       remote: 94.190.212.123
+       addresses:
+        - 10.47.3.0/31
+

m-labs-intl/gretun.service

@@ -0,0 +1,14 @@
+[Unit]
+Description=GRE tunnel to the main host
+After=network.target
+
+[Service]
+Type=simple
+User=root
+ExecStart=/root/gretun.sh
+ExecStop=/root/gretun_down.sh
+Restart=on-failure
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

m-labs-intl/gretun.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+/usr/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25 -j DNAT --to-destination 10.47.3.1:25
+/usr/sbin/iptables -A FORWARD -p tcp -d 10.47.3.1/31 --dport 25 -j ACCEPT
+
+/usr/sbin/iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 587 -j DNAT --to-destination 10.47.3.1:587
+/usr/sbin/iptables -A FORWARD -p tcp -d 10.47.3.1/31 --dport 587 -j ACCEPT
+
+/usr/sbin/iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
+/usr/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

m-labs-intl/gretun_down.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+/usr/sbin/iptables -t nat -D PREROUTING -p tcp -i eth0 --dport 25 -j DNAT --to-destination 10.47.3.1:25
+/usr/sbin/iptables -D FORWARD -p tcp -d 10.47.3.1/31 --dport 25 -j ACCEPT
+
+/usr/sbin/iptables -t nat -D PREROUTING -p tcp -i eth0 --dport 587 -j DNAT --to-destination 10.47.3.1:587
+/usr/sbin/iptables -D FORWARD -p tcp -d 10.47.3.1/31 --dport 587 -j ACCEPT
+
+/usr/sbin/iptables -D FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
+/usr/sbin/iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

m-labs-intl/m-labs-intl.com

@@ -0,0 +1,81 @@
+upstream rfq_server {
+    server 127.0.0.1:5000;
+}
+
+server {
+    limit_conn addr 5;
+
+    root /var/www/m-labs-intl.com/html;
+    index index.html index.htm index.nginx-debian.html;
+
+    server_name m-labs-intl.com;
+
+    location / {
+        try_files $uri $uri/ =404;
+    }
+
+    listen [::]:443 ssl ipv6only=on; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/m-labs-intl.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/m-labs-intl.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+server {
+    server_name www.m-labs-intl.com;
+    return 301 https://m-labs-intl.com$request_uri;
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/m-labs-intl.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/m-labs-intl.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+server {
+    server_name hooks.m-labs-intl.com;
+    limit_conn addr 5;
+
+    location /rfq {
+        proxy_pass http://rfq_server/rfq;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 30;
+        proxy_connect_timeout 30;
+        proxy_send_timeout 30;
+    }
+
+    location / {
+        return 418;
+    }
+
+    listen [::]:443 ssl; # managed by Certbot
+    listen 443 ssl; # managed by Certbot
+    ssl_certificate /etc/letsencrypt/live/m-labs-intl.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/m-labs-intl.com/privkey.pem; # managed by Certbot
+    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+server {
+    limit_conn addr 5;
+    if ($host = m-labs-intl.com) {
+        return 301 https://$host$request_uri;
+    } # managed by Certbot
+
+
+    if ($host = www.m-labs-intl.com) {
+        return 301 https://m-labs-intl.com$request_uri;
+    } # managed by Certbot
+
+
+    listen 80;
+    listen [::]:80;
+
+    server_name m-labs-intl.com www.m-labs-intl.com hooks.m-labs-intl.com;
+    return 301 https://$host$request_uri;
+}

m-labs-intl/m-labs.hk.conf

@@ -0,0 +1,34 @@
+
+
+connections {
+  m_labs {
+    version = 2
+    encap = no
+    mobike = no
+    send_certreq = no
+    proposals = aes128gcm128-sha256-prfsha256-curve25519,aes128gcm128-sha256-prfsha256-ecp256
+    local_addrs = 5.78.86.156
+    remote_addrs = 94.190.212.123
+    local {
+      auth = pubkey
+      id = fqdn:m-labs-intl.com
+      pubkeys = m-labs-intl.com
+    }
+    remote {
+      auth = pubkey
+      id = fqdn:m-labs.hk
+      pubkeys = m-labs.hk
+    }
+    children {
+      con1 {
+        mode = transport
+        ah_proposals = sha256-curve25519,sha256-ecp256
+        esp_proposals =
+        local_ts = 5.78.86.156[gre]
+        remote_ts = 94.190.212.123[gre]
+        start_action = start
+        close_action = none
+      }
+    }
+  } 
+}

m-labs-intl/nginx.conf

@@ -0,0 +1,65 @@
+user www-data;
+worker_processes auto;
+pid /run/nginx.pid;
+error_log /var/log/nginx/error.log;
+include /etc/nginx/modules-enabled/*.conf;
+
+events {
+	worker_connections 768;
+	# multi_accept on;
+}
+
+http {
+
+	##
+	# Basic Settings
+	##
+
+	sendfile on;
+	tcp_nopush on;
+	types_hash_max_size 2048;
+	# server_tokens off;
+
+	server_names_hash_bucket_size 64;
+	# server_name_in_redirect off;
+
+	include /etc/nginx/mime.types;
+	default_type application/octet-stream;
+
+	##
+	# SSL Settings
+	##
+
+	ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
+	ssl_prefer_server_ciphers on;
+
+	# Rate limiting
+	limit_conn_zone $binary_remote_addr zone=addr:10m;
+
+	##
+	# Logging Settings
+	##
+
+	access_log /var/log/nginx/access.log;
+
+	##
+	# Gzip Settings
+	##
+
+	gzip on;
+
+	# gzip_vary on;
+	# gzip_proxied any;
+	# gzip_comp_level 6;
+	# gzip_buffers 16 8k;
+	# gzip_http_version 1.1;
+	gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+	##
+	# Virtual Host Configs
+	##
+
+	include /etc/nginx/conf.d/*.conf;
+	include /etc/nginx/sites-enabled/*;
+}
+

m-labs-intl/rfq.service

@@ -0,0 +1,12 @@
+[Unit]
+Description=RFQ service
+After=network.target
+
+[Service]
+Type=simple
+User=rfqserver
+ExecStart=/home/rfqserver/runrfq.sh
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target

m-labs-intl/runrfq.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+export FLASK_DEBUG=0
+export FLASK_MAIL_SERVER=mail.m-labs.hk
+export FLASK_MAIL_PORT=465
+export FLASK_MAIL_USE_SSL=True
+export FLASK_MAIL_USERNAME=sysop-intl@m-labs-intl.com
+export FLASK_MAIL_PASSWORD_FILE=/home/rfqserver/mail.secret
+export FLASK_MAIL_RECIPIENT=sales@m-labs.hk
+export FLASK_MAIL_SENDER=sysop-intl@m-labs-intl.com
+
+cd /home/rfqserver/web2019/server
+source venv/bin/activate
+python3 -m flask --app rfq run --port=5000

m-labs-intl/setup.md

@@ -0,0 +1,99 @@
+# Setup m-labs-intl.com server
+
+```shell
+# Install required packages
+apt install git nginx-full python3 python3.12-venv python3-pip iptables ufw \
+  strongswan strongswan-swanctl strongswan-pki strongswan-libcharon
+snap install --classic certbot
+ln -s /snap/bin/certbot /usr/bin/certbot
+
+# Set up networks (includes GRE)
+cp 60-tunnels.yaml /etc/netplan/
+netplan apply
+
+# set up IPsec-AH connection
+cp m-labs.hk.conf /etc/swanctl/conf.d/
+echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
+sysctl -p
+cp m-labs.hk /etc/swanctl/pubkey/m-labs.hk # get pubkey from nixbld
+pki --gen --type rsa --size 4096 --outform pem > /etc/swanctl/private/m-labs-intl.com
+pki --pub --in /etc/swanctl/private/m-labs-intl.com --outform pem > /etc/swanctl/pubkey/m-labs-intl.com
+cp /etc/swanctl/pubkey/m-labs-intl.com m-labs-intl.com # add it to the nixbld
+systemctl enable strongswan --now
+systemctl restart strongswan
+
+# Set up website
+cp m-labs-intl.com /etc/nginx/sites-available/
+cp nginx.conf /etc/nginx/
+ln -s /etc/nginx/sites-available/m-labs-intl.com /etc/nginx/sites-enabled/
+systemctl enable nginx --now
+service nginx restart
+
+# Issue SSL certificate - website only, the mail is on the HK side
+certbot --nginx
+service nginx restart
+
+# Create a user for automatic website deployment from nixbld
+useradd -m zolaupd
+mkdir -p /var/www/m-labs-intl.com/html
+chown -R zolaupd /var/www/m-labs-intl.com/
+sudo -u zolaupd sh -c '
+  cd /home/zolaupd;
+  mkdir /home/zolaupd/.ssh;
+  echo -n "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP1OJJM8g/1ffxDjN31XKEfGmrYaW03lwpyTa1UGWqVx
+  ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF6R6XK0IiuAKxVKvSABm4m9bfOlvfJcMvTpjenuXUPv" > /home/zolaupd/.ssh/authorized_keys
+  chmod 700 .ssh/
+  chmod 600 .ssh/authorized_keys
+  '
+
+# Create a user for RFQ hooks service
+useradd -m rfqserver
+cp runrfq.sh /home/rfqserver/
+cp mail.secret /home/rfqserver/
+chown rfqserver /home/rfqserver/runrfq.sh
+chmod +x /home/rfqserver/runrfq.sh
+chown rfqserver /home/rfqserver/mail.secret
+
+sudo -u rfqserver sh -c '
+  cd /home/rfqserver;
+  git clone https://git.m-labs.hk/M-Labs/web2019.git;
+  cd web2019;
+  python3 -m venv ./venv;
+  source venv/bin/activate;
+  pip install -r requirements.txt;
+'
+cp rfq.service /etc/systemd/system/
+
+# Automate port forwarding rules creation
+cp gretun.sh /root/gretun.sh
+cp gretun_down.sh /root/gretun_down.sh
+chmod u+x /root/gretun.sh
+chmod u+x /root/gretun_down.sh
+cp gretun.service /etc/systemd/system/
+
+# Enable custom services
+systemctl daemon-reload
+systemctl enable rfq.service --now
+systemctl enable gretun.service --now
+
+# Setup basic firewall rules  
+ufw default deny
+ufw default allow outgoing
+
+ufw allow from 94.190.212.123
+ufw allow from 2001:470:f891:1::/64
+ufw allow from 202.77.7.238
+ufw allow from 2001:470:18:390::2
+ufw allow "Nginx HTTP"
+ufw allow "Nginx HTTPS"
+ufw limit OpenSSH
+ufw allow 25/tcp
+ufw allow 587/tcp
+ufw limit 500,4500/udp
+
+ufw route allow in on gre1 out on eth0
+ufw allow from 10.47.3.0/31
+
+ufw show added
+ufw enable
+```

nixbld-etc-nixos/afws-module.nix

@@ -0,0 +1,66 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  afws = pkgs.callPackage ./afws { inherit pkgs; };
+in
+{
+  options.services.afws = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable AFWS server";
+    };
+    logFile = mkOption {
+      type = types.str;
+      default = "/var/lib/afws/logs/afws.log";
+      description = "Path to the log file";
+    };
+    logBackupCount = mkOption {
+      type = types.int;
+      default = 30;
+      description = "Number of daily log files to keep";
+    };
+  };
+
+  config = mkIf config.services.afws.enable {
+    systemd.services.afws = {
+      description = "AFWS server";
+      wantedBy = [ "multi-user.target" ];
+      preStart = ''
+        mkdir -p "$(dirname ${config.services.afws.logFile})"
+        chown afws:afws "$(dirname ${config.services.afws.logFile})"
+      '';
+      serviceConfig = {
+        User = "afws";
+        Group = "afws";
+        ExecStart = ''
+          ${afws}/bin/afws_server \
+            --log-file ${config.services.afws.logFile} \
+            --log-backup-count ${toString config.services.afws.logBackupCount}
+        '';
+        ExecReload = "${pkgs.coreutils}/bin/kill -USR1 $MAINPID";
+      };
+      path = [ pkgs.nix pkgs.git ];
+    };
+
+    security.acme.certs."afws.m-labs.hk".postRun =
+      ''
+      mkdir -p /var/lib/afws/cert
+      cp cert.pem /var/lib/afws/cert
+      cp key.pem /var/lib/afws/cert
+      chown -R afws:afws /var/lib/afws/cert
+      '';
+    security.acme.certs."afws.m-labs.hk".reloadServices = [ "afws.service" ];
+
+    users.users.afws = {
+      name = "afws";
+      group = "afws";
+      description = "AFWS server user";
+      isSystemUser = true;
+      createHome = false;
+      home = "/var/lib/afws";
+      useDefaultShell = true;
+    };
+    users.extraGroups.afws = {};
+  };
+}

nixbld-etc-nixos/backup-module.nix

@@ -1,29 +1,37 @@
 { config, pkgs, lib, ... }:
 with lib;
 let
+  excludePaths = [
+    "/var/lib/gitea/repositories/*/*.git/archives"
+    "/var/lib/gitea/data/repo-archive"
+    "/var/lib/gitea/data/indexers"
+    "/var/vmail/m-labs.hk/js"
+    "/var/lib/afws/.cache"
+    "/var/lib/mattermost/data/2019*"
+    "/var/lib/mattermost/data/2020*"
+    "/var/lib/mattermost/data/2021*"
+    "/var/lib/mattermost/data/2022*"
+    "/var/lib/mattermost/data/2023*"
+  ];
   makeBackup = pkgs.writeScript "make-backup" ''
-    #!${pkgs.bash}/bin/bash
+    #!${pkgs.bash}/bin/bash -p
 
     set -e
     umask 0077
 
-    FILENAME=backup-`date +%F`.tar.bz2.gpg
-
     DBDUMPDIR=`mktemp -d`
-    pushd $DBDUMPDIR
+    trap "rm -rf $DBDUMPDIR" EXIT
+    cd $DBDUMPDIR
 
-    ${config.services.mysql.package}/bin/mysqldump --single-transaction flarum > flarum.sql
-    ${pkgs.sudo}/bin/sudo -u mattermost ${config.services.postgresql.package}/bin/pg_dump mattermost > mattermost.sql
+    ${config.services.mysql.package}/bin/mysqldump --user=root --single-transaction flarum > flarum.sql
+    ${config.services.postgresql.package}/bin/pg_dump mattermost > mattermost.sql
+    ${config.services.postgresql.package}/bin/pg_dump rt5 > rt.sql
+    ${config.services.postgresql.package}/bin/pg_dump gitea > gitea.sql
 
-    ${pkgs.gnutar}/bin/tar cf - --exclude "/var/lib/gitea/repositories/*/*.git/archives" /etc/nixos /var/lib/gitea flarum.sql mattermost.sql | \
+    exec 6< /etc/nixos/secret/backup-passphrase
+    ${pkgs.gnutar}/bin/tar cf - ${lib.concatMapStringsSep " " (p: "--exclude \"${p}\"") excludePaths} /etc/nixos /var/vmail /var/lib/hedgedoc /var/lib/gitea /var/lib/afws /var/lib/mattermost/data /var/www/193thz flarum.sql mattermost.sql rt.sql gitea.sql | \
         ${pkgs.bzip2}/bin/bzip2 | \
-        ${pkgs.gnupg}/bin/gpg --symmetric --batch --passphrase-file /etc/nixos/secret/backup-passphrase | \
-        ${pkgs.rclone}/bin/rclone rcat --config /etc/nixos/secret/rclone.conf dropbox:$FILENAME
-
-    popd
-    rm -rf $DBDUMPDIR
-
-    echo Backup done
+        ${pkgs.gnupg}/bin/gpg --symmetric --batch --passphrase-fd 6
   '';
   cfg = config.services.mlabs-backup;
 in
@@ -37,20 +45,20 @@ in
   };
 
   config = mkIf cfg.enable {
-    systemd.services.mlabs-backup = {
-      description = "M-Labs backup";
-      serviceConfig = {
-        Type = "oneshot";
-        User = "root";
-        Group = "root";
-        ExecStart = "${makeBackup}";
-      };
+    users.extraGroups.backupdl = { };
+    users.extraUsers.backupdl = {
+      isNormalUser = true;
+      extraGroups = ["backupdl" "nextcloud"];
+      openssh.authorizedKeys.keys = [
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCbH+l0FIBTPdUKOS9H5OOT5ro/nljKLsiCTzTzublCScdPPmCNy27ORbLgNHX5Ughlug5wr2rAIU9AexV+L71V5MeVHUWDfKgRsNIpUTtY6wpJkAP7r1ipk2kTWc/sxhrxyPea62cohmy1dOeLlwXO6U8FnsiZfYKmgjZ8wuTo6ixDB8krXsAZ8VY/bj5WFcXqeW8GF1Qjpel7HgpCpj3HIUyC63uwIyUoYe+cgnhjzNLbRYdU9Yx2iqcUCwEUX2cMdz5VX+xbLkL8CWcuiMFg6TFo+CUPFtuA/kVzHcZ4Pa3BiilL3rf7oXlIXGN12JVsN+caX7j2weVqm2b5u5eVsyDxiLx1KA37ukq92CYAAdOuKE+saMPsLuOn+Qd9B6D5oYnYgsWg460uEGgwczwOTXLAZTT5wrwRaKIE+ezKqtRP+Tz7l2IEixulyj1MUR+XpSwECZXiFJx5DGofwzxcd2kWnNOPBReDkHv0At5ZLNIrLuxFMz2L6UXbqvHwEu8= backupdl@minipc"
+      ];
     };
-
-    systemd.timers.mlabs-backup = {
-      description = "M-Labs backup";
-      wantedBy = [ "timers.target" ];
-      timerConfig.OnCalendar = "weekly";
+    security.wrappers.mlabs-backup = {
+      source = makeBackup;
+      setuid = true;
+      owner = "root";
+      group = "backupdl";
+      permissions = "g+x";
     };
   };
 }

nixbld-etc-nixos/flarum/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  php,
+  fetchFromGitHub,
+  fetchpatch,
+}:
+
+php.buildComposerProject (finalAttrs: {
+  pname = "flarum";
+  version = "1.8.1";
+
+  src = fetchFromGitHub {
+    owner = "flarum";
+    repo = "flarum";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-kigUZpiHTM24XSz33VQYdeulG1YI5s/M02V7xue72VM=";
+  };
+
+  patches = [
+    # Add useful extensions from https://github.com/FriendsOfFlarum
+    # Extensions included: fof/upload, fof/polls, fof/subscribed
+    ./fof-extensions.patch
+  ];
+
+  composerLock = ./composer.lock;
+  composerStrictValidation = false;
+  vendorHash = "sha256-GLE5ZtzZmQ8YbitV6LG744QHoGxlj5TfC5wP2a3eFpU=";
+
+  meta = with lib; {
+    changelog = "https://github.com/flarum/framework/blob/main/CHANGELOG.md";
+    description = "Flarum is a delightfully simple discussion platform for your website";
+    homepage = "https://github.com/flarum/flarum";
+    license = lib.licenses.mit;
+    maintainers = with maintainers; [
+      fsagbuya
+      jasonodoom
+    ];
+  };
+})

nixbld-etc-nixos/flarum/fof-extensions.patch

@@ -0,0 +1,16 @@
+diff --git a/composer.json b/composer.json
+index c63b5f8..5ad1186 100644
+--- a/composer.json
++++ b/composer.json
+@@ -37,7 +37,10 @@
+         "flarum/sticky": "*",
+         "flarum/subscriptions": "*",
+         "flarum/suspend": "*",
+-        "flarum/tags": "*"
++        "flarum/tags": "*",
++        "fof/polls": "*",
++        "fof/subscribed": "*",
++        "fof/upload": "*"
+     },
+     "config": {
+         "preferred-install": "dist",

nixbld-etc-nixos/gitea-home.tmpl

@@ -3,7 +3,7 @@
 	<div class="ui stackable middle very relaxed page grid">
 		<div class="sixteen wide center aligned centered column">
 			<div>
-				<img class="logo" width="220" height="220" src="{{StaticUrlPrefix}}/img/logo.svg"/>
+				<img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
 			</div>
 			<div class="hero">
 				<h1 class="ui icon header title">
@@ -15,7 +15,7 @@
 	<div class="ui stackable middle very relaxed page grid">
 		<div class="sixteen wide center column">
 			<p class="large">
-				Welcome! This Gitea instance is here to support projects related to <a href="https://m-labs.hk">M-Labs</a>. You may want to browse the <a href="https://git.m-labs.hk/M-Labs/">M-Labs organization</a> where many projects are located. If you would like an account (we give them to anyone who wants to contribute on projects related to Sinara, ARTIQ, nMigen, etc.), simply write a short email to sb@m-***.hk stating the username you would like to have.
+				Welcome! This Gitea instance is here to support projects related to <a href="https://m-labs.hk">M-Labs</a>. You may want to browse the <a href="https://git.m-labs.hk/M-Labs/">M-Labs organization</a> where many projects are located. If you would like an account (we give them to anyone who wants to contribute on projects related to Sinara, ARTIQ, nMigen, etc.), simply write a short email to sb@m-labs.hk stating the username you would like to have.
 			</p>
 		</div>
 	</div>

nixbld-etc-nixos/gitea-signin.tmpl

@@ -2,9 +2,9 @@
 <div class="page-content user signin{{if .LinkAccountMode}} icon{{end}}">
 	{{template "user/auth/signin_navbar" .}}
 	<div class="ui middle very relaxed page grid">
-		<div class="ui container column">
+		<div class="ui container column fluid">
 			{{template "user/auth/signin_inner" .}}
-	        To get an account (also available to external contributors), simply write to sb@m-***s.hk.
+			To get an account (also available to external contributors), simply write to sb@m-labs.hk.
 		</div>
 	</div>
 </div>

nixbld-etc-nixos/hydra-hack-allowed-uris.patch

@@ -1,13 +0,0 @@
-diff --git a/src/hydra-eval-jobs/hydra-eval-jobs.cc b/src/hydra-eval-jobs/hydra-eval-jobs.cc
-index 934bf42e..48f2d248 100644
---- a/src/hydra-eval-jobs/hydra-eval-jobs.cc
-+++ b/src/hydra-eval-jobs/hydra-eval-jobs.cc
-@@ -281,6 +281,8 @@ int main(int argc, char * * argv)
-            to the environment. */
-         evalSettings.restrictEval = true;
- 
-+        evalSettings.allowedUris = {"https://github.com/m-labs/misoc.git"};
-+
-         /* When building a flake, use pure evaluation (no access to
-            'getEnv', 'currentSystem' etc. */
-         evalSettings.pureEval = myArgs.flake;

nixbld-etc-nixos/hydra-msys2.patch

@@ -0,0 +1,122 @@
+diff --git a/src/root/product-list.tt b/src/root/product-list.tt
+index 4d545b3e..6049c2a6 100644
+--- a/src/root/product-list.tt
++++ b/src/root/product-list.tt
+@@ -162,6 +162,11 @@
+             <img src="[% c.uri_for("/static/images/iso.png") %]" alt="ISO" />
+           </td>
+           <td>ISO-9660 CD/DVD image</td>
++        [% CASE "msys2" %]
++          <td>
++            <img src="[% c.uri_for("/static/images/msys2.svg") %]" alt="MSYS2" width="32" height="32" />
++          </td>
++          <td>MSYS2 package</td>
+         [% CASE "binary-dist" %]
+           <td>
+             <img src="[% c.uri_for("/static/images/binary-dist.png") %]" alt="Binary distribution" />
+diff --git a/src/root/static/images/msys2.svg b/src/root/static/images/msys2.svg
+new file mode 100644
+index 00000000..46baff50
+--- /dev/null
++++ b/src/root/static/images/msys2.svg
+@@ -0,0 +1,100 @@
++<?xml version="1.0" encoding="UTF-8" standalone="no"?>
++<!-- Created with Inkscape (http://www.inkscape.org/) -->
++
++<svg
++   width="36.777081mm"
++   height="36.777081mm"
++   viewBox="0 0 36.77708 36.777081"
++   version="1.1"
++   id="svg8"
++   inkscape:version="1.1.1 (3bf5ae0d25, 2021-09-20)"
++   sodipodi:docname="msys2_logo.svg"
++   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
++   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
++   xmlns="http://www.w3.org/2000/svg"
++   xmlns:svg="http://www.w3.org/2000/svg"
++   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
++   xmlns:cc="http://creativecommons.org/ns#"
++   xmlns:dc="http://purl.org/dc/elements/1.1/">
++  <defs
++     id="defs2" />
++  <sodipodi:namedview
++     id="base"
++     pagecolor="#ffffff"
++     bordercolor="#666666"
++     borderopacity="1.0"
++     inkscape:pageopacity="0.0"
++     inkscape:pageshadow="2"
++     inkscape:zoom="3.959798"
++     inkscape:cx="121.34457"
++     inkscape:cy="27.274119"
++     inkscape:document-units="mm"
++     inkscape:current-layer="layer1"
++     showgrid="false"
++     fit-margin-top="0"
++     fit-margin-left="0"
++     fit-margin-right="0"
++     fit-margin-bottom="0"
++     inkscape:window-width="2560"
++     inkscape:window-height="1371"
++     inkscape:window-x="0"
++     inkscape:window-y="32"
++     inkscape:window-maximized="1"
++     inkscape:pagecheckerboard="true" />
++  <metadata
++     id="metadata5">
++    <rdf:RDF>
++      <cc:Work
++         rdf:about="">
++        <dc:format>image/svg+xml</dc:format>
++        <dc:type
++           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
++      </cc:Work>
++    </rdf:RDF>
++  </metadata>
++  <g
++     inkscape:label="Layer 1"
++     inkscape:groupmode="layer"
++     id="layer1"
++     transform="translate(-122.70998,-169.48973)">
++    <rect
++       style="fill:#894c84;fill-opacity:1;stroke-width:0"
++       id="rect946"
++       width="36.777081"
++       height="36.777081"
++       x="122.70998"
++       y="169.48973" />
++    <path
++       style="fill:#d35e64;fill-opacity:1;stroke-width:0.133635"
++       d="m 142.72948,201.89184 c -0.32408,-0.25492 -0.35455,-0.35395 -0.3187,-1.03567 l 0.0396,-0.75379 h 0.45908 c 0.44506,0 0.45934,0.0163 0.46772,0.53453 l 0.009,0.53454 0.70308,0.0405 c 0.53885,0.031 0.7217,-0.008 0.78281,-0.16735 0.15971,-0.41619 -0.10726,-0.89779 -0.98636,-1.77935 -0.49365,-0.49504 -1.03351,-1.07713 -1.19967,-1.29353 -0.38599,-0.50269 -0.40844,-1.38334 -0.0467,-1.83013 0.23417,-0.28918 0.35554,-0.31548 1.45595,-0.31548 1.36938,0 1.67817,0.15986 1.80376,0.93383 0.11523,0.71006 -0.0673,1.20433 -0.44479,1.20433 -0.26632,0 -0.34178,-0.0979 -0.46372,-0.60136 -0.13305,-0.54937 -0.1843,-0.60509 -0.59283,-0.64461 -0.24596,-0.0238 -0.58921,-0.008 -0.76279,0.036 -0.59536,0.14942 -0.37642,0.57816 0.95393,1.86806 l 1.26953,1.23092 v 0.90178 c 0,1.37811 -0.0436,1.41874 -1.52348,1.41874 -1.06598,0 -1.29877,-0.0409 -1.60514,-0.28187 z"
++       id="path3828"
++       inkscape:connector-curvature="0" />
++    <path
++       style="fill:#d35e64;fill-opacity:1;stroke-width:0.133635"
++       d="m 148.05027,204.08841 c 0.0471,-0.28134 0.11947,-1.05275 0.16076,-1.71424 0.0703,-1.12643 0.0353,-1.35529 -0.55133,-3.60814 -0.34453,-1.32299 -0.6573,-2.54073 -0.69504,-2.70611 -0.0594,-0.26014 -0.0147,-0.30067 0.33149,-0.30067 0.22006,0 0.46737,0.081 0.54957,0.18007 0.0822,0.099 0.30254,0.86578 0.48964,1.70385 0.41743,1.86975 0.45345,1.99148 0.58914,1.99148 0.15912,0 0.35622,-0.563 0.74822,-2.13717 0.38958,-1.56447 0.48518,-1.73823 0.9564,-1.73823 0.39274,0 0.46132,-0.43504 -0.70121,4.4477 -0.46869,1.96849 -0.93011,3.74249 -1.02539,3.94223 -0.11781,0.24694 -0.29559,0.37716 -0.55559,0.40696 -0.37406,0.0429 -0.38048,0.0327 -0.29666,-0.46773 z"
++       id="path3830"
++       inkscape:connector-curvature="0" />
++    <path
++       style="fill:#d35e64;fill-opacity:1;stroke-width:0.133635"
++       d="m 155.37958,199.87478 -0.001,1.04324 c 0,0 0.0415,0.99571 -0.10812,1.13694 -0.15218,0.14363 -0.72994,0.11875 -1.5324,0.11875 -1.39413,0 -1.4684,-0.0143 -1.66996,-0.32193 -0.14282,-0.21797 -0.19775,-0.55241 -0.17012,-1.03567 0.0397,-0.69411 0.0518,-0.71373 0.43989,-0.71373 0.2965,0 0.40947,0.0687 0.43951,0.26726 0.13121,0.86712 0.13264,0.86863 0.81803,0.86863 1.33065,0 1.18669,-0.7429 -0.41998,-2.16732 -0.98712,-0.87515 -1.3045,-1.34704 -1.30163,-1.93531 0.005,-1.02426 0.44219,-1.37639 1.70885,-1.37639 1.4449,0 1.89746,0.36739 1.89746,1.54037 0,0.85 -0.80733,1.01376 -0.94108,0.1909 -0.113,-0.69515 -0.21979,-0.79583 -0.84414,-0.79583 -0.59087,0 -0.88668,0.17572 -0.88861,0.52786 -5.3e-4,0.11392 0.5857,0.76291 1.30294,1.44221"
++       id="path3832"
++       inkscape:connector-curvature="0"
++       sodipodi:nodetypes="ccssccscsccsssscc" />
++    <path
++       inkscape:connector-curvature="0"
++       id="path3826"
++       d="m 125.15872,195.23965 c -0.30592,-0.19939 -0.0836,-0.86189 0.8607,-2.56497 1.58255,-2.85415 5.22198,-10.62008 6.75854,-14.42159 0.91204,-2.25643 0.98557,-2.83541 0.41825,-3.29345 -0.30201,-0.24384 -0.34148,-0.33999 -0.22153,-0.53956 0.44174,-0.73497 2.98816,-1.05046 4.06353,-0.50346 1.1982,0.60947 1.74884,2.08184 2.47139,6.60826 0.57628,3.61017 1.00176,6.0369 1.0809,6.16495 0.21334,0.34519 0.63685,-0.49885 2.24466,-4.47355 2.25297,-5.56961 3.24559,-7.35862 4.41748,-7.9617 0.51912,-0.26714 0.89922,-0.34492 1.8995,-0.38866 1.60332,-0.0701 1.6509,-0.0327 1.64898,1.29653 -0.002,1.7237 -0.0807,1.96599 -0.76359,2.3662 -1.27599,0.74779 -2.16809,2.00702 -2.17,3.06305 -0.003,1.44987 1.07869,1.89961 2.0727,0.86208 0.20781,-0.2169 0.42671,-0.39436 0.48646,-0.39436 0.0597,0 0.10898,0.55626 0.10941,1.23612 5.2e-4,0.67987 0.0579,1.58514 0.12779,2.01171 0.14392,0.87871 0.16421,0.83597 -1.8354,3.86646 -1.11067,1.68327 -1.20806,1.92146 -0.90836,2.22164 0.18169,0.18198 0.60193,0.22609 2.48831,0.26119 l 2.26971,0.0422 0.55893,0.7403 c 0.68294,0.90455 0.72637,1.39945 0.1851,2.10909 -0.49391,0.64756 -1.48498,1.35585 -2.16303,1.54588 -0.98995,0.27744 -2.22523,-0.26803 -3.29926,-1.45686 -1.37797,-1.52525 -1.99486,-3.94203 -2.17991,-8.54021 -0.0642,-1.59436 -0.13883,-2.29481 -0.24099,-2.26075 -0.0814,0.0271 -0.99576,2.00431 -2.03189,4.39371 -3.28691,7.57995 -3.68415,8.28612 -4.54018,8.07127 -0.53578,-0.13448 -1.34919,-1.06203 -1.9102,-2.17825 -1.10951,-2.20757 -1.73511,-5.05031 -2.03723,-9.25721 -0.0871,-1.21273 -0.20858,-2.26094 -0.26996,-2.32935 -0.13588,-0.15144 -0.58442,0.82294 -2.08397,4.52711 -2.01481,4.97699 -2.79643,6.54288 -3.82036,7.65371 -0.87044,0.94432 -3.13721,1.88044 -3.68648,1.52243 z"
++       style="fill:#f9f9f9;stroke-width:0.133635" />
++    <g
++       id="g957"
++       transform="translate(36.843901,36.777081)"
++       style="fill:#999999">
++      <path
++         style="fill:#999999;fill-opacity:1;stroke-width:0.264583"
++         d="m 118.48002,154.38963 c -0.21263,-0.77937 -0.60053,-0.53763 -3.77862,-0.53763 -4.23812,0 -4.51001,0.21718 -2.65413,-2.44723 2.45703,-3.52744 3.4906,-5.92399 2.80851,-6.96499 -0.4719,-0.72022 -1.01247,-0.62449 -1.92709,0.34127 -0.84859,0.89603 -1.86894,0.41779 -1.86894,-0.95587 0,-2.01205 2.80561,-3.99992 5.38938,-3.9922 1.61399,0.005 2.43642,0.4039 3.21581,1.56044 1.12027,1.66236 0.73145,3.8557 -1.134,6.39695 -1.54383,2.10311 -0.73385,3.61259 0.95572,1.78109 1.46292,-1.68793 1.55952,0.86073 1.49098,1.70283 -0.2309,2.69619 -2.07701,4.65709 -2.49762,3.11534 z"
++         id="path961"
++         inkscape:connector-curvature="0"
++         sodipodi:nodetypes="sscccscccccs" />
++    </g>
++  </g>
++</svg>

nixbld-etc-nixos/hydra-restrictdist.patch

@@ -1,32 +0,0 @@
-diff --git src/lib/Hydra/Controller/Root.pm src/lib/Hydra/Controller/Root.pm
-index a9b0d558..71869ba0 100644
---- a/src/lib/Hydra/Controller/Root.pm
-+++ b/src/lib/Hydra/Controller/Root.pm
-@@ -19,6 +19,11 @@ use Net::Prometheus;
- # Put this controller at top-level.
- __PACKAGE__->config->{namespace} = '';
- 
-+sub isRedistRestricted {
-+  my ($path) = @_;
-+
-+  return index($path, "-RESTRICTDIST-") >= 0;
-+}
- 
- sub noLoginNeeded {
-   my ($c) = @_;
-@@ -319,6 +324,7 @@ sub nar :Local :Args(1) {
-         $path = $Nix::Config::storeDir . "/$path";
- 
-         gone($c, "Path " . $path . " is no longer available.") unless isValidPath($path);
-+        notFound($c, "Redistribution restricted") if isRedistRestricted($path);
- 
-         $c->stash->{current_view} = 'NixNAR';
-         $c->stash->{storePath} = $path;
-@@ -368,6 +374,7 @@ sub narinfo :LocalRegex('^([a-z0-9]+).narinfo$') :Args(0) {
-             setCacheHeaders($c, 60 * 60);
-             return;
-         }
-+        notFound($c, "Redistribution restricted") if isRedistRestricted($path);
- 
-         $c->stash->{storePath} = $path;
-         $c->forward('Hydra::View::NARInfo');

nixbld-etc-nixos/mattermost-remove-free-banner.patch

@@ -0,0 +1,210 @@
+diff --git webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_team_edition.tsx webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_team_edition.tsx
+index 9af4fc7354..60ae3160e8 100644
+--- webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_team_edition.tsx
++++ webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_team_edition.tsx
+@@ -9,10 +9,6 @@ import Logo from 'components/common/svg_images_components/logo_dark_blue_svg';
+ const ProductBrandingTeamEditionContainer = styled.div`
+     display: flex;
+     align-items: center;
+-
+-    > * + * {
+-        margin-left: 8px;
+-    }
+ `;
+ 
+ const StyledLogo = styled(Logo)`
+@@ -21,23 +17,6 @@ const StyledLogo = styled(Logo)`
+     }
+ `;
+ 
+-const Badge = styled.div`
+-    display: flex;
+-    align-self: center;
+-    padding: 2px 6px;
+-    position: relative;
+-    top: 1px;
+-    border-radius: var(--radius-s);
+-    margin-left: 12px;
+-    background: rgba(var(--sidebar-text-rgb), 0.08);
+-    color: rgba(var(--sidebar-text-rgb), 0.75);
+-    font-family: 'Open Sans', sans-serif;
+-    font-size: 10px;
+-    font-weight: 600;
+-    letter-spacing: 0.025em;
+-    line-height: 16px;
+-`;
+-
+ const ProductBrandingTeamEdition = (): JSX.Element => {
+     return (
+         <ProductBrandingTeamEditionContainer tabIndex={0}>
+@@ -45,7 +24,6 @@ const ProductBrandingTeamEdition = (): JSX.Element => {
+                 width={116}
+                 height={20}
+             />
+-            <Badge>{'FREE EDITION'}</Badge>
+         </ProductBrandingTeamEditionContainer>
+     );
+ };
+diff --git webapp/channels/src/components/header_footer_route/header.scss webapp/channels/src/components/header_footer_route/header.scss
+index e7c76f9861..2841858f44 100644
+--- webapp/channels/src/components/header_footer_route/header.scss
++++ webapp/channels/src/components/header_footer_route/header.scss
+@@ -39,23 +39,6 @@
+                 width: 170px;
+                 fill: var(--center-channel-color);
+             }
+-
+-            .freeBadge {
+-                position: relative;
+-                top: 1px;
+-                display: flex;
+-                align-self: center;
+-                padding: 2px 6px;
+-                border-radius: var(--radius-s);
+-                margin-left: 12px;
+-                background: rgba(var(--center-channel-color-rgb), 0.08);
+-                color: rgba(var(--center-channel-color-rgb), 0.75);
+-                font-family: 'Open Sans', sans-serif;
+-                font-size: 10px;
+-                font-weight: 600;
+-                letter-spacing: 0.025em;
+-                line-height: 16px;
+-            }
+         }
+     }
+ 
+@@ -77,12 +60,6 @@
+             margin-top: 12px;
+         }
+     }
+-
+-    &.has-free-banner.has-custom-site-name {
+-        .header-back-button {
+-            bottom: -20px;
+-        }
+-    }
+ }
+ 
+ @media screen and (max-width: 699px) {
+diff --git webapp/channels/src/components/header_footer_route/header.tsx webapp/channels/src/components/header_footer_route/header.tsx
+index 8cd1d8a624..55554fb0ad 100644
+--- webapp/channels/src/components/header_footer_route/header.tsx
++++ webapp/channels/src/components/header_footer_route/header.tsx
+@@ -25,33 +25,15 @@ const Header = ({alternateLink, backButtonURL, onBackButtonClick}: HeaderProps)
+ 
+     const ariaLabel = SiteName || 'Mattermost';
+ 
+-    let freeBanner = null;
+-    if (license.IsLicensed === 'false') {
+-        freeBanner = <><Logo/><span className='freeBadge'>{'FREE EDITION'}</span></>;
+-    }
+-
+     let title: React.ReactNode = SiteName;
+     if (title === 'Mattermost') {
+-        if (freeBanner) {
+-            title = '';
+-        } else {
+-            title = <Logo/>;
+-        }
++        title = <Logo/>;
+     }
+ 
+     return (
+-        <div className={classNames('hfroute-header', {'has-free-banner': freeBanner, 'has-custom-site-name': title})}>
++        <div className={classNames('hfroute-header', {'has-custom-site-name': title})}>
+             <div className='header-main'>
+                 <div>
+-                    {freeBanner &&
+-                        <Link
+-                            className='header-logo-link'
+-                            to='/'
+-                            aria-label={ariaLabel}
+-                        >
+-                            {freeBanner}
+-                        </Link>
+-                    }
+                     {title &&
+                         <Link
+                             className='header-logo-link'
+diff --git webapp/channels/src/components/widgets/menu/menu_items/menu_start_trial.tsx webapp/channels/src/components/widgets/menu/menu_items/menu_start_trial.tsx
+index 35646539c4..fbdbb39710 100644
+--- webapp/channels/src/components/widgets/menu/menu_items/menu_start_trial.tsx
++++ webapp/channels/src/components/widgets/menu/menu_items/menu_start_trial.tsx
+@@ -1,42 +1,17 @@
+ // Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+ // See LICENSE.txt for license information.
+ 
+-import React from 'react';
+-import {useIntl} from 'react-intl';
+ import {useSelector} from 'react-redux';
+-import styled from 'styled-components';
+ 
+ import {getLicense} from 'mattermost-redux/selectors/entities/general';
+ 
+-import ExternalLink from 'components/external_link';
+-
+-import {LicenseLinks} from 'utils/constants';
+-
+ import './menu_item.scss';
+ 
+-const FreeVersionBadge = styled.div`
+-     position: relative;
+-     top: 1px;
+-     display: flex;
+-     padding: 2px 6px;
+-     border-radius: var(--radius-s);
+-     margin-bottom: 6px;
+-     background: rgba(var(--center-channel-color-rgb), 0.08);
+-     color: rgba(var(--center-channel-color-rgb), 0.75);
+-     font-family: 'Open Sans', sans-serif;
+-     font-size: 10px;
+-     font-weight: 600;
+-     letter-spacing: 0.025em;
+-     line-height: 16px;
+-`;
+-
+ type Props = {
+     id: string;
+ }
+ 
+ const MenuStartTrial = (props: Props): JSX.Element | null => {
+-    const {formatMessage} = useIntl();
+-
+     const license = useSelector(getLicense);
+     const isCurrentLicensed = license?.IsLicensed;
+ 
+@@ -44,33 +19,7 @@ const MenuStartTrial = (props: Props): JSX.Element | null => {
+         return null;
+     }
+ 
+-    return (
+-        <li
+-            className={'MenuStartTrial'}
+-            role='menuitem'
+-            id={props.id}
+-        >
+-            <FreeVersionBadge>{'FREE EDITION'}</FreeVersionBadge>
+-            <div className='editionText'>
+-                {formatMessage(
+-                    {
+-                        id: 'navbar_dropdown.versionText',
+-                        defaultMessage: 'This is the free <link>unsupported</link> edition of Mattermost.',
+-                    },
+-                    {
+-                        link: (msg: React.ReactNode) => (
+-                            <ExternalLink
+-                                location='menu_start_trial.unsupported-link'
+-                                href={LicenseLinks.UNSUPPORTED}
+-                            >
+-                                {msg}
+-                            </ExternalLink>
+-                        ),
+-                    },
+-                )}
+-            </div>
+-        </li>
+-    );
++    return null;
+ };
+ 
+ export default MenuStartTrial;

nixbld-etc-nixos/named/193thz.com

@@ -0,0 +1,29 @@
+$TTL 7200
+
+@						SOA	ns.193thz.com. sb.m-labs.hk. (
+							2024060201
+							7200
+							3600
+							86400
+							600)
+
+
+						NS		ns.193thz.com.
+						NS		ns1.he.net.
+
+						A		94.190.212.123
+						A		202.77.7.238
+						AAAA	2001:470:18:390::2
+						MX		10 mail.m-labs.hk.
+						TXT		"v=spf1 mx a:router.alt.m-labs.hk -all"
+						TXT		"google-site-verification=5eIjLyhM_siRg5Fc2Z3AMSbheH0JFOn5iR3TCEXakqU"
+						CAA		0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1758987512"
+
+
+ns						A		94.190.212.123
+ns						AAAA	2001:470:18:390::2
+
+mail._domainkey			TXT	"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC9T0cONxGXeyETE0bJ6NJVGT58fVFrfb+WxQhMskCN/mJhODyDTkRCjzE8ZnKhZGjkFZNG+PoSZlW+kpSS1LvMwzQpMRaH4zAzIexffR0l7rJR1MuQiVMsfGWpO2SLEuN74L2qH8SUBHZjrRpeSaFxwQm+prIOzZe5wTZStt/6qQIDAQAB"
+_dmarc					TXT	"v=DMARC1; p=none"
+
+www						CNAME	@

nixbld-etc-nixos/named/200-29.98.206.103.in-addr.arpa

@@ -0,0 +1,20 @@
+$TTL 7200
+
+@						SOA	NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G. sb.m-labs.hk. (
+							2024060201
+							7200
+							3600
+							86400
+							600)
+
+
+						NS		NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G.
+						NS		ns1.he.net.
+						CAA		0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1758987512"
+
+200	PTR	router.alt.m-labs.hk.
+201	PTR	stewardship1.alt.m-labs.hk.
+202	PTR	stewardship2.alt.m-labs.hk.
+203	PTR	atse.alt.m-labs.hk.
+204	PTR	nasty-gareth.alt.m-labs.hk.
+205	PTR	zynq.alt.m-labs.hk.

nixbld-etc-nixos/named/m-labs-intl.com

@@ -0,0 +1,30 @@
+$TTL 7200
+
+@						SOA	ns.m-labs-intl.com. sb.m-labs.hk. (
+							2024101401
+							7200
+							3600
+							86400
+							600)
+
+
+						NS		ns.m-labs-intl.com.
+						NS		ns1.he.net.
+						NS		ns1.qnetp.net.
+
+						A		5.78.86.156
+						AAAA	2a01:4ff:1f0:83de::1
+						MX		10 mail.m-labs-intl.com.
+						TXT		"v=spf1 mx -all"
+						TXT		"google-site-verification=BlQd5_5wWW7calKC7bZA0GdoxR8-zj4gwJEg9sGJ3l8"
+						CAA		0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1768317117"
+
+ns						A		94.190.212.123
+ns						AAAA	2001:470:18:390::2
+
+mail					A		5.78.86.156
+mail._domainkey			IN	TXT	"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDJVPuhSGXghO7ib8Em/Se3jfCCIJK5g4zn5pGZ3/e0I0f+zGHMuvwpjkAKf6eSmo/AAXEaco28pDi3qE5xfV512AJsORCfPoPFyNhLsj/qtri6hc5KVSWW0Ja3MSFBINDCaX78c7PXPY+3jJJGpwSBDLjdxj9AQwtfiCVlH4qE/QIDAQAB"
+_dmarc					TXT		"v=DMARC1; p=none"
+
+www						CNAME	@
+hooks					CNAME	@

nixbld-etc-nixos/named/m-labs.hk

@@ -0,0 +1,53 @@
+$TTL 7200
+
+@						SOA	NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G. sb.m-labs.hk. (
+							2024080501
+							7200
+							3600
+							86400
+							600)
+
+
+						NS		NS.XN--WBTZ5WPQAJ35CFXC.XN--J6W193G.
+						NS		ns1.qnetp.net.
+						NS		ns1.he.net.
+
+						A		94.190.212.123
+						A		202.77.7.238
+						AAAA	2001:470:18:390::2
+						MX		10 mail.m-labs.hk.
+						TXT		"v=spf1 mx a:router.alt.m-labs.hk -all"
+						TXT		"google-site-verification=Tf_TEGZLG7-2BE70hMjLnzjDZ1qUeUZ6vxzbl1sagT8"
+						CAA		0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1758987512"
+
+
+mail					A		94.190.212.123
+mail					A		202.77.7.238
+mail					AAAA	2001:470:18:390::2
+mail._domainkey			TXT		"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCl38A/Z0IInVU157qzrWgMfYm2iDHoWZsTyiiOoZdT7kHMzS/M2OMXMt7r5g1/7pCPClsGUDJvKGqVMmjJuPleMyKHwpGeT92qDNEFpt6ahneap/oYx5eBYM/vGcgmleNxyIoBHsptaZvqD4vCEFaC22f8UL5QAgQD3wCH3FwlpQIDAQAB"
+_dmarc					TXT		"v=DMARC1; p=none"
+
+lab						CNAME	@
+www						CNAME	@
+nixbld					CNAME	@
+msys2					CNAME	@
+conda					CNAME	@
+afws					CNAME	@
+git						CNAME	@
+chat					CNAME	@
+hooks					CNAME	@
+forum					CNAME	@
+perso					CNAME	@
+rt						CNAME	@
+files					CNAME	@
+docs					CNAME	@
+
+rpi-1					AAAA	2001:470:f891:1:dea6:32ff:fe8a:6a93
+rpi-4					AAAA	2001:470:f891:1:dea6:32ff:fe14:fce9
+
+router.alt				A		103.206.98.200
+stewardship1.alt		A		103.206.98.201
+stewardship2.alt		A		103.206.98.202
+atse.alt				A		103.206.98.203
+nasty-gareth.alt		A		103.206.98.204
+zynq.alt				A		103.206.98.205

nixbld-etc-nixos/named/m-labs.ph

@@ -0,0 +1,28 @@
+$TTL 7200
+
+@						SOA	ns1.m-labs.ph. sb.m-labs.hk. (
+							2024060201
+							7200
+							3600
+							86400
+							600)
+
+
+						NS		ns1.m-labs.ph.
+						NS		ns1.he.net.
+
+						A		94.190.212.123
+						A		202.77.7.238
+						AAAA	2001:470:18:390::2
+						MX		10 mail.m-labs.hk.
+						TXT		"v=spf1 mx a:router.alt.m-labs.hk -all"
+						TXT		"google-site-verification=g2k8M1fhbYOPs4C37SeGCfNlD6paWcexamji1DXrp0o"
+						CAA		0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1758987512"
+
+ns1						A		94.190.212.123
+ns1						AAAA	2001:470:18:390::2
+
+mail._domainkey			TXT		"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPUlkoA4Gucsin6P5LSohSOpPbpOELkbKDz9MmB4Zzj4QdcQNtMzU3Uis8WZwVXknQ/6URoDdTa4aR8+PwMi5fjKpLM8ZAnnHJHYebZPDRq6lQo3VGdaCu9NhdjYwFhvK9VRyhwI9i7DUptdLsu/OzbgTlCdWQTOr+MFEkYwmxLQIDAQAB"
+_dmarc					TXT		"v=DMARC1; p=none"
+
+www						CNAME	@

nixbld-etc-nixos/named/malloctech.fr

@@ -0,0 +1,23 @@
+$TTL 7200
+
+@						SOA	ns.malloctech.fr. sb.m-labs.hk. (
+							2024060201
+							7200
+							3600
+							86400
+							600)
+
+
+						NS		ns.malloctech.fr.
+						NS		ns1.he.net.
+
+						MX		10 mail.m-labs.hk.
+						TXT		"v=spf1 mx a:router.alt.m-labs.hk -all"
+						TXT		"google-site-verification=LALF-fafTnmkL-18m3CzwFjSwEV1C7NeKexiNfMYsOw"
+						CAA		0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1758987512"
+
+ns						A		94.190.212.123
+ns						AAAA	2001:470:18:390::2
+
+mail._domainkey			TXT	"v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC+Op2B9cdVxwyweChOBJtk4LGkLUfxunI3a7sSL0aVnntfPWkKgY7zTL8iOJaqdt/DkkvOz++HEsn3AzleXsdibaTC9x6kgrMVgkrsYOKA4bWDLJiUfgq7vvRMdkw6rOqlJp9+faXKIKwtMG9Ckd1+rHBsaFwe7EE0coLbhGZaQQIDAQAB"
+_dmarc					TXT	"v=DMARC1; p=none"

nixbld-etc-nixos/nix-3-networked-derivations.patch

@@ -1,82 +0,0 @@
-diff -Naur /nix/store/32wd1lrf55ymaz1aysrqffpxfgkwl6m4-source/src/libstore/build/local-derivation-goal.cc nix3/src/libstore/build/local-derivation-goal.cc
---- /nix/store/32wd1lrf55ymaz1aysrqffpxfgkwl6m4-source/src/libstore/build/local-derivation-goal.cc	1970-01-01 08:00:01.000000000 +0800
-+++ nix3/src/libstore/build/local-derivation-goal.cc	2021-04-24 16:29:52.493166702 +0800
-@@ -395,6 +395,8 @@
-     additionalSandboxProfile = parsedDrv->getStringAttr("__sandboxProfile").value_or("");
- #endif
- 
-+    networked = parsedDrv->getBoolAttr("__networked");
-+
-     /* Are we doing a chroot build? */
-     {
-         auto noChroot = parsedDrv->getBoolAttr("__noChroot");
-@@ -412,7 +414,7 @@
-         else if (settings.sandboxMode == smDisabled)
-             useChroot = false;
-         else if (settings.sandboxMode == smRelaxed)
--            useChroot = !(derivationIsImpure(derivationType)) && !noChroot;
-+            useChroot = !allowNetwork() && !(derivationIsImpure(derivationType)) && !noChroot;
-     }
- 
-     auto & localStore = getLocalStore();
-@@ -623,7 +625,7 @@
-                 "nogroup:x:65534:\n", sandboxGid()));
- 
-         /* Create /etc/hosts with localhost entry. */
--        if (!(derivationIsImpure(derivationType)))
-+        if (!allowNetwork() && !(derivationIsImpure(derivationType)))
-             writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
- 
-         /* Make the closure of the inputs available in the chroot,
-@@ -810,7 +812,7 @@
-            us.
-         */
- 
--        if (!(derivationIsImpure(derivationType)))
-+        if (!allowNetwork() && !(derivationIsImpure(derivationType)))
-             privateNetwork = true;
- 
-         userNamespaceSync.create();
-@@ -1066,7 +1068,7 @@
-        to the builder is generally impure, but the output of
-        fixed-output derivations is by definition pure (since we
-        already know the cryptographic hash of the output). */
--    if (derivationIsImpure(derivationType)) {
-+    if (allowNetwork() || derivationIsImpure(derivationType)) {
-         for (auto & i : parsedDrv->getStringsAttr("impureEnvVars").value_or(Strings()))
-             env[i] = getEnv(i).value_or("");
-     }
-@@ -1702,7 +1704,7 @@
-             /* Fixed-output derivations typically need to access the
-                network, so give them access to /etc/resolv.conf and so
-                on. */
--            if (derivationIsImpure(derivationType)) {
-+            if (allowNetwork() || derivationIsImpure(derivationType)) {
-                 // Only use nss functions to resolve hosts and
-                 // services. Don’t use it for anything else that may
-                 // be configured for this system. This limits the
-@@ -1943,7 +1945,7 @@
- 
-                 sandboxProfile += "(import \"sandbox-defaults.sb\")\n";
- 
--                if (derivationIsImpure(derivationType))
-+                if (allowNetwork() || derivationIsImpure(derivationType))
-                     sandboxProfile += "(import \"sandbox-network.sb\")\n";
- 
-                 /* Add the output paths we'll use at build-time to the chroot */
-diff -Naur /nix/store/32wd1lrf55ymaz1aysrqffpxfgkwl6m4-source/src/libstore/build/local-derivation-goal.hh nix3/src/libstore/build/local-derivation-goal.hh
---- /nix/store/32wd1lrf55ymaz1aysrqffpxfgkwl6m4-source/src/libstore/build/local-derivation-goal.hh	1970-01-01 08:00:01.000000000 +0800
-+++ nix3/src/libstore/build/local-derivation-goal.hh	2021-04-24 16:35:23.060968488 +0800
-@@ -40,6 +40,12 @@
- 
-     Path chrootRootDir;
- 
-+    bool networked;
-+    bool allowNetwork()
-+    {
-+        return derivationIsFixed(drv->type()) || networked;
-+    }
-+
-     /* RAII object to delete the chroot directory. */
-     std::shared_ptr<AutoDelete> autoDelChroot;
- 

nixbld-etc-nixos/nix-networked-derivations.diff

@@ -1,83 +0,0 @@
-diff -Naur nix-2.3.10.orig/src/libstore/build.cc nix-2.3.10/src/libstore/build.cc
---- nix-2.3.10.orig/src/libstore/build.cc	1970-01-01 08:00:01.000000000 +0800
-+++ nix-2.3.10/src/libstore/build.cc	2021-04-24 16:17:08.778875340 +0800
-@@ -840,9 +840,16 @@
-     /* Whether this is a fixed-output derivation. */
-     bool fixedOutput;
- 
-+    bool networked;
-+
-     /* Whether to run the build in a private network namespace. */
-     bool privateNetwork = false;
- 
-+    bool allowNetwork()
-+    {
-+        return fixedOutput || networked;
-+    }
-+
-     typedef void (DerivationGoal::*GoalState)();
-     GoalState state;
- 
-@@ -1181,6 +1188,8 @@
- {
-     trace("have derivation");
- 
-+    fixedOutput = drv->isFixedOutput();
-+
-     retrySubstitution = false;
- 
-     for (auto & i : drv->outputs)
-@@ -1197,6 +1206,8 @@
- 
-     parsedDrv = std::make_unique<ParsedDerivation>(drvPath, *drv);
- 
-+    networked = parsedDrv->getBoolAttr("__networked");
-+
-     /* We are first going to try to create the invalid output paths
-        through substitutes.  If that doesn't work, we'll build
-        them. */
-@@ -1932,7 +1943,7 @@
-         else if (settings.sandboxMode == smDisabled)
-             useChroot = false;
-         else if (settings.sandboxMode == smRelaxed)
--            useChroot = !fixedOutput && !noChroot;
-+            useChroot = !allowNetwork() && !noChroot;
-     }
- 
-     if (worker.store.storeDir != worker.store.realStoreDir) {
-@@ -2109,7 +2120,7 @@
-                 "nogroup:x:65534:\n") % sandboxGid).str());
- 
-         /* Create /etc/hosts with localhost entry. */
--        if (!fixedOutput)
-+        if (!allowNetwork())
-             writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
- 
-         /* Make the closure of the inputs available in the chroot,
-@@ -2323,7 +2334,7 @@
-            us.
-         */
- 
--        if (!fixedOutput)
-+        if (!allowNetwork())
-             privateNetwork = true;
- 
-         userNamespaceSync.create();
-@@ -2534,7 +2545,7 @@
-        to the builder is generally impure, but the output of
-        fixed-output derivations is by definition pure (since we
-        already know the cryptographic hash of the output). */
--    if (fixedOutput) {
-+    if (allowNetwork()) {
-         for (auto & i : parsedDrv->getStringsAttr("impureEnvVars").value_or(Strings()))
-             env[i] = getEnv(i);
-     }
-@@ -2823,7 +2834,7 @@
-             /* Fixed-output derivations typically need to access the
-                network, so give them access to /etc/resolv.conf and so
-                on. */
--            if (fixedOutput) {
-+            if (allowNetwork()) {
-                 ss.push_back("/etc/resolv.conf");
- 
-                 // Only use nss functions to resolve hosts and

nixbld-etc-nixos/nix-networked-derivations.patch

@@ -0,0 +1,80 @@
+diff --git a/src/libstore/unix/build/local-derivation-goal.cc b/src/libstore/unix/build/local-derivation-goal.cc
+index 2a09e3dd4..7dc03855f 100644
+--- a/src/libstore/unix/build/local-derivation-goal.cc
++++ b/src/libstore/unix/build/local-derivation-goal.cc
+@@ -197,6 +197,8 @@ Goal::Co LocalDerivationGoal::tryLocalBuild()
+ 
+     assert(derivationType);
+ 
++    networked = parsedDrv->getBoolAttr("__networked");
++
+     /* Are we doing a chroot build? */
+     {
+         auto noChroot = parsedDrv->getBoolAttr("__noChroot");
+@@ -214,7 +216,7 @@ Goal::Co LocalDerivationGoal::tryLocalBuild()
+         else if (settings.sandboxMode == smDisabled)
+             useChroot = false;
+         else if (settings.sandboxMode == smRelaxed)
+-            useChroot = derivationType->isSandboxed() && !noChroot;
++            useChroot = !networked && derivationType->isSandboxed() && !noChroot;
+     }
+ 
+     auto & localStore = getLocalStore();
+@@ -737,7 +739,7 @@ void LocalDerivationGoal::startBuilder()
+                 "nogroup:x:65534:\n", sandboxGid()));
+ 
+         /* Create /etc/hosts with localhost entry. */
+-        if (derivationType->isSandboxed())
++        if (!networked && derivationType->isSandboxed())
+             writeFile(chrootRootDir + "/etc/hosts", "127.0.0.1 localhost\n::1 localhost\n");
+ 
+         /* Make the closure of the inputs available in the chroot,
+@@ -938,7 +940,7 @@ void LocalDerivationGoal::startBuilder()
+            us.
+         */
+ 
+-        if (derivationType->isSandboxed())
++        if (!networked && derivationType->isSandboxed())
+             privateNetwork = true;
+ 
+         userNamespaceSync.create();
+@@ -1177,7 +1179,7 @@ void LocalDerivationGoal::initEnv()
+        to the builder is generally impure, but the output of
+        fixed-output derivations is by definition pure (since we
+        already know the cryptographic hash of the output). */
+-    if (!derivationType->isSandboxed()) {
++    if (networked || !derivationType->isSandboxed()) {
+         auto & impureEnv = settings.impureEnv.get();
+         if (!impureEnv.empty())
+             experimentalFeatureSettings.require(Xp::ConfigurableImpureEnv);
+@@ -1851,7 +1853,7 @@ void LocalDerivationGoal::runChild()
+             /* Fixed-output derivations typically need to access the
+                network, so give them access to /etc/resolv.conf and so
+                on. */
+-            if (!derivationType->isSandboxed()) {
++            if (networked || !derivationType->isSandboxed()) {
+                 // Only use nss functions to resolve hosts and
+                 // services. Don’t use it for anything else that may
+                 // be configured for this system. This limits the
+@@ -2083,7 +2085,7 @@ void LocalDerivationGoal::runChild()
+                 #include "sandbox-defaults.sb"
+                 ;
+ 
+-            if (!derivationType->isSandboxed())
++            if (networked || !derivationType->isSandboxed())
+                 sandboxProfile +=
+                     #include "sandbox-network.sb"
+                     ;
+diff --git a/src/libstore/unix/build/local-derivation-goal.hh b/src/libstore/unix/build/local-derivation-goal.hh
+index bf25cf2a6..28f8c1e95 100644
+--- a/src/libstore/unix/build/local-derivation-goal.hh
++++ b/src/libstore/unix/build/local-derivation-goal.hh
+@@ -83,6 +83,8 @@ struct LocalDerivationGoal : public DerivationGoal
+      */
+     Path chrootRootDir;
+ 
++    bool networked;
++
+     /**
+      * RAII object to delete the chroot directory.
+      */

nixbld-etc-nixos/rfq/src/rfq/__init__.py

@@ -14,6 +14,13 @@ from werkzeug.middleware.proxy_fix import ProxyFix
 
 load_dotenv()
 
+mail_password_file = getenv("FLASK_MAIL_PASSWORD_FILE")
+if mail_password_file is not None:
+    with open(mail_password_file, "r") as f:
+        mail_password = f.read().strip()
+else:
+    mail_password = None
+
 app = Flask(__name__)
 app.config.update(
     DEBUG=getenv("FLASK_DEBUG") == "True",
@@ -22,7 +29,7 @@ app.config.update(
     MAIL_USE_SSL=getenv("FLASK_MAIL_USE_SSL"),
     MAIL_DEBUG=False,
     MAIL_USERNAME=getenv("FLASK_MAIL_USERNAME"),
-    MAIL_PASSWORD=getenv("FLASK_MAIL_PASSWORD"),
+    MAIL_PASSWORD=mail_password,
     MAIL_RECIPIENT=getenv("FLASK_MAIL_RECIPIENT"),
     MAIL_SENDER=getenv("FLASK_MAIL_SENDER")
 )

nixbld-etc-nixos/rfq/uwsgi-config.nix

@@ -7,13 +7,13 @@ in {
   pythonPackages = self: [ pkg ];
   module = "rfq:app";
   env = [
-    "FLASK_MAIL_SERVER=ssl.serverraum.org"
+    "FLASK_MAIL_SERVER=mail.m-labs.hk"
     "FLASK_MAIL_PORT=465"
     "FLASK_MAIL_USE_SSL=True"
-    "FLASK_MAIL_USERNAME=sales@m-labs.hk"
-    "FLASK_MAIL_PASSWORD=${import /etc/nixos/secret/sales_password.nix}"
+    "FLASK_MAIL_USERNAME=sysop@m-labs.hk"
+    "FLASK_MAIL_PASSWORD_FILE=/etc/nixos/secret/rfqpassword"
     "FLASK_MAIL_RECIPIENT=sales@m-labs.hk"
-    "FLASK_MAIL_SENDER=sales@m-labs.hk"
+    "FLASK_MAIL_SENDER=sysop@m-labs.hk"
   ];
   socket = "${config.services.uwsgi.runDir}/uwsgi-rfq.sock";
   # allow access from nginx

nixbld-etc-nixos/rt.nix

@@ -19,14 +19,9 @@ let
       Set($Timezone, '${cfg.timeZone}');
 
       Set($DatabaseType, 'Pg');
-      Set($DatabaseHost, 'localhost');
-      Set($DatabaseUser, 'rt_user');
+      Set($DatabaseHost, '/run/postgresql');
+      Set($DatabaseUser, 'rt');
       Set($DatabaseName, 'rt5');
-      # Read database password from file
-      open my $fh, '<', '${cfg.dbPasswordFile}' or die 'Can\'t open file $!';
-      my $dbpw = do { local $/; <$fh> };
-      $dbpw =~ s/^\s+|\s+$//g;
-      Set($DatabasePassword, $dbpw);
 
       # System (Logging)
       Set($LogToSTDERR, undef); # Don't log twice
@@ -35,7 +30,7 @@ let
       Set($OwnerEmail, '${cfg.ownerEmail}');
       Set($MaxAttachmentSize, 15360000);
       Set($CheckMoreMSMailHeaders, 1);
-      Set($RTAddressRegexp, '^(helpdesk|sales)\@(m-labs.hk)$');
+      Set($RTAddressRegexp, '^(helpdesk)\@(m-labs.hk|m-labs-intl.com)$');
       Set($LoopsToRTOwner, 0);
 
       # System (Outgoing mail)
@@ -93,6 +88,7 @@ let
 
       # Web Interface (Transaction display)
       Set($MaxInlineBody, 0);
+      Set($SuppressInlineTextFiles, 1);
 
       # Web Interface (Administrative interface)
       Set($ShowRTPortal, 0);
@@ -153,13 +149,6 @@ in {
       type = str;
     };
 
-    dbPasswordFile = mkOption {
-      description = "File containing the database password";
-      type = str;
-      default = "/etc/nixos/secret/rtpasswd";
-      internal = true;
-    };
-
     domain = mkOption {
       description = "Which domain RT is running on";
       type = str;
@@ -244,8 +233,6 @@ in {
 
           PrivateNetwork = false;
           MemoryDenyWriteExecute = false;
-
-          ReadOnlyPaths = [ cfg.dbPasswordFile ];
         };
 
         environment = {
@@ -271,6 +258,7 @@ in {
             LogsDirectory = "rt/";
           };
 
+          after = [ "postgresql.service" ];
           wantedBy = [ "multi-user.target" ];
         };
       }
@@ -298,6 +286,7 @@ in {
 
     users.users.rt = {
       isSystemUser = true;
+      group = "rt";
     };
     users.groups.rt = {};
 

nixbld-etc-nixos/secret_permissions.txt

@@ -7,7 +7,5 @@
 -rw------- 1 uwsgi        uwsgi          mattermost-github-integration.py
 -rw------- 1 nginx        nginx          muninpasswd
 -rw-rw---- 1 hydra        hydra          nixbld.m-labs.hk-1
--rw-rw---- 1 hydra        hydra          nix_id_rsa
--rw------- 1 root         root           rclone.conf
 -rw------- 1 root         root           wifi_password.nix
 -rw------- 1 sb           users          wifi_ext_password.nix

nixops/any-nix-shell.nix

@@ -1,27 +0,0 @@
-{ lib, stdenv, fetchFromGitHub, makeWrapper }:
-
-stdenv.mkDerivation rec {
-  pname = "any-nix-shell";
-  version = "1.2.1";
-
-  src = fetchFromGitHub {
-    owner = "haslersn";
-    repo = "any-nix-shell";
-    rev = "v${version}";
-    sha256 = "0q27rhjhh7k0qgcdcfm8ly5za6wm4rckh633d0sjz87faffkp90k";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -r bin $out
-    wrapProgram $out/bin/any-nix-shell --prefix PATH ":" $out/bin
-  '';
-
-  meta = with lib; {
-    description = "fish and zsh support for nix-shell";
-    license = licenses.mit;
-    homepage = "https://github.com/haslersn/any-nix-shell";
-    maintainers = with maintainers; [ haslersn ];
-  };
-}

nixops/athena-hardware-configuration.nix

@@ -0,0 +1,45 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/89463254-b38d-45db-92b6-0f7d92a44f47";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/F84B-ACC5";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp86s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  system.stateVersion = "23.11";
+}

nixops/avscan-module.nix

@@ -0,0 +1,45 @@
+{ config, pkgs, lib, ... }:
+with lib;
+let
+  avscan = pkgs.writeScript "avscan" ''
+    #!${pkgs.bash}/bin/bash
+
+    for user in $(cut -d":" -f1 /etc/passwd); do
+      if [ -d "/home/$user" ]; then
+          nice -15 ${pkgs.sudo}/bin/sudo -u $user ${pkgs.clamav}/bin/clamscan --recursive --quiet --infected /home/$user
+      fi
+    done
+  '';
+  cfg = config.services.avscan;
+in
+{
+  options.services.avscan = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Enable antivirus scan";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.clamav.updater.enable = true;
+    services.clamav.updater.interval = "daily";
+    services.clamav.updater.frequency = 1;
+
+    systemd.services.avscan = {
+      description = "Antivirus scan";
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        Group = "root";
+        ExecStart = "${avscan}";
+      };
+    };
+
+    systemd.timers.avscan = {
+      description = "Antivirus scan";
+      wantedBy = [ "timers.target" ];
+      timerConfig.OnCalendar = "Mon *-*-* 13:00:00";
+    };
+  };
+}

nixops/chiron-hardware-configuration.nix

@@ -18,13 +18,18 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/060C-8772";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
 
-  nix.maxJobs = lib.mkDefault 16;
+  nix.settings.max-jobs = lib.mkDefault 16;
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  system.stateVersion = "19.03";
 }

nixops/cnc-hardware-configuration.nix

@@ -1,29 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports =
-    [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
-    ];
-
-  boot.initrd.availableKernelModules = [ "ata_generic" "uhci_hcd" "ehci_pci" "ahci" "usb_storage" "usbhid" "floppy" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/35d9c50c-e479-43a9-8324-b8ded5b71844";
-      fsType = "ext4";
-    };
-
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/d8480389-c558-4c46-a58f-00207315dbdd"; }
-    ];
-
-  nix.maxJobs = lib.mkDefault 2;
-
-  boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
-  boot.loader.grub.device = "/dev/sda";
-
-  services.xserver.videoDrivers = ["intel"];
-}

nixops/common-users.nix

@@ -3,16 +3,16 @@
 {
   root = {
     openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyPk5WyFoWSvF4ozehxcVBoZ+UHgrI7VW/OoQfFFwIQe0qvetUZBMZwR2FwkLPAMZV8zz1v4EfncudEkVghy4P+/YVLlDjqDq9zwZnh8Nd/ifu84wmcNWHT2UcqnhjniCdshL8a44memzABnxfLLv+sXhP2x32cJAamo5y6fukr2qLp2jbXzR+3sv3klE0ruUXis/BR1lLqNJEYP8jB6fLn2sLKinnZPfn6DwVOk10mGeQsdME/eGl3phpjhODH9JW5V2V5nJBbC0rBnq+78dyArKVqjPSmIcSy72DEIpTctnMEN1W34BGrnsDd5Xd/DKxKxHKTMCHtZRwLC2X0NWN"
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCMALVC8RDTHec+PC8y1s3tcpUAODgq6DEzQdHDf/cyvDMfmCaPiMxfIdmkns5lMa03hymIfSmLUF0jFFDc7biRp7uf9AAXNsrTmplHii0l0McuOOZGlSdZM4eL817P7UwJqFMxJyFXDjkubhQiX6kp25Kfuj/zLnupRCaiDvE7ho/xay6Jrv0XLz935TPDwkc7W1asLIvsZLheB+sRz9SMOb9gtrvk5WXZl5JTOFOLu+JaRwQLHL/xdcHJTOod7tqHYfpoC5JHrEwKzbhTOwxZBQBfTQjQktKENQtBxXHTe71rUEWfEZQGg60/BC4BrRmh4qJjlJu3v4VIhC7SSHn1"
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBF/YybP+fQ0J+bNqM5Vgx5vDmVqVWsgUdF1moUxghv7d73GZAFaM6IFBdrXTAa33AwnWwDPMrTgP1V6SXBkb3ciJo/lD1urJGbydbSI5Ksq9d59wvOeANvyWYrQw6+eqTQ=="
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBDf6+TFaUtITiiU7b6DOiT4/C8fzCq70j9DGnNyo/+5bS7ffRezTS0AqqltHQs9/lbjUbtP+Iil7RUGF0o0X6v5y/Gt/GdV9QR+Nv1mJCF1KVOeMKm/vB0jjN+ncwHU+BA=="
     ];
   };
   sb = {
     isNormalUser = true;
     extraGroups = ["wheel" "plugdev" "dialout" "libvirtd"];
     openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCyPk5WyFoWSvF4ozehxcVBoZ+UHgrI7VW/OoQfFFwIQe0qvetUZBMZwR2FwkLPAMZV8zz1v4EfncudEkVghy4P+/YVLlDjqDq9zwZnh8Nd/ifu84wmcNWHT2UcqnhjniCdshL8a44memzABnxfLLv+sXhP2x32cJAamo5y6fukr2qLp2jbXzR+3sv3klE0ruUXis/BR1lLqNJEYP8jB6fLn2sLKinnZPfn6DwVOk10mGeQsdME/eGl3phpjhODH9JW5V2V5nJBbC0rBnq+78dyArKVqjPSmIcSy72DEIpTctnMEN1W34BGrnsDd5Xd/DKxKxHKTMCHtZRwLC2X0NWN"
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCMALVC8RDTHec+PC8y1s3tcpUAODgq6DEzQdHDf/cyvDMfmCaPiMxfIdmkns5lMa03hymIfSmLUF0jFFDc7biRp7uf9AAXNsrTmplHii0l0McuOOZGlSdZM4eL817P7UwJqFMxJyFXDjkubhQiX6kp25Kfuj/zLnupRCaiDvE7ho/xay6Jrv0XLz935TPDwkc7W1asLIvsZLheB+sRz9SMOb9gtrvk5WXZl5JTOFOLu+JaRwQLHL/xdcHJTOod7tqHYfpoC5JHrEwKzbhTOwxZBQBfTQjQktKENQtBxXHTe71rUEWfEZQGg60/BC4BrRmh4qJjlJu3v4VIhC7SSHn1"
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBF/YybP+fQ0J+bNqM5Vgx5vDmVqVWsgUdF1moUxghv7d73GZAFaM6IFBdrXTAa33AwnWwDPMrTgP1V6SXBkb3ciJo/lD1urJGbydbSI5Ksq9d59wvOeANvyWYrQw6+eqTQ=="
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBDf6+TFaUtITiiU7b6DOiT4/C8fzCq70j9DGnNyo/+5bS7ffRezTS0AqqltHQs9/lbjUbtP+Iil7RUGF0o0X6v5y/Gt/GdV9QR+Nv1mJCF1KVOeMKm/vB0jjN+ncwHU+BA=="
     ];
   };
   rj = {
@@ -33,74 +33,89 @@
       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBPsv4UMEFV0UHeHdA9R3sC+qoMxrqhcuFqwqWMI4AF/lixwcbRyA8QKiu/7R22m2u6pp+Zk6hYqcxdgClI4uN2oQhVjJX6wEgfT94vC/67OKJI/NNVsR8G0lr0ufCo4Lbw=="
     ];
   };
-  harry = {
-    isNormalUser = true;
-    extraGroups = ["plugdev" "dialout" "wireshark" "libvirtd"];
-    openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBDcPNCgtdz8erFPRrAwCr4JrkeYXJUUvoRBgP0X2HlzJgDe1Inuo6sC6CGcO3IXbf4MwVA9XEp8BYPHARVeEHhufg/0wnIABLx2GcK99yxOLDUe4h/3YwtqvOcqHEsDx7w=="
-    ];
-  };
-  pca006132 = {
-    isNormalUser = true;
-    extraGroups = ["plugdev" "dialout" "wireshark"];
-    openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBE/sPOOiw3843+rrcYV2pOVkffNc1xsOgnuCUmy1Fa2VF8x9kqmgQv61sxsuKRkKKoinvqrASxLkWVd6nkiiDuEISibEXs8r1BwuT05cS7RkEhCakSMZ6y/iqOtjt2bx+A=="
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCrC43AF/aHv9NHormDMw18m/iE3luNc4CIwgPgTClly4b9yRyQGhm4mKkKix07fP9SfdyvUPPrYhwoHhf0zGkfFNE26FIG2Bul9UkZVP3ygnIXHD7sKUJP7Ra4UID6Naf3Mr2Dckh7rAiw8WN2QB+oO2tni3PyceEOdu8OoEsmSu8qusJFVhnaoYJyQflgGl3bFUZkhaf1JKQmv9C92sfKQkrfSNb2dNrc3Oe1uP5VokhLhjsOoDWyJ45a7ru6lr4/Co5sF9xX59cOOBU+ktiOakDI8NLI5AO7R0dCKLW55wUnml5boeCV45p1MPXVEznX8IM6kRgOhVx3fnd0TqV5M8xeY0dk7aTWTFSkIz82xHhKFbce5xx+9MFrlvUgHYVpbIUQTq6HS6cLZEeWHDLuUqbRFB4J7UfieiRZfxWw74Tgyq+HlvlNg/cVn0nhouq6+sY6QI9MGbwbEnjkD5KbSUHUCSeLgNc8pb0RxLkAqPGh8QkYrb6Nudl8HjWfIuZFGrRhcGBySt/oaYUDrUg5VNA98FjQL2QfKRVepvpGgUEGW6eZK9IrYz1Ct30Sb65QujUMRuDnWq1CeulAXCZQHc32wOrHRkMEUdhfOgNojZRTGduPayHXoDq7XB249D2VjH/vEuiLfWNLr+rabGyMUPpQaDypeBgOsUTbceKbDw=="
-    ];
-    shell = pkgs.zsh;
-  };
   occheung = {
     isNormalUser = true;
-    extraGroups = ["plugdev" "dialout" "wireshark"];
+    extraGroups = ["plugdev" "dialout"];
     openssh.authorizedKeys.keys = [
       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBPEvmWmxpFpMgp5fpjKud8ev0cyf/+X5fEpQt/YD/+u4mbvZYPE300DLqQ0h/qjgvaGMz1ndf4idYnRdy+plJEC/+hmlRW5NlcpAr3S/LYAisacgKToFVl+MlBo+emS9Ig=="
     ];
   };
-  ak = {
-    isNormalUser = true;
-    openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBLTzNGqfswE9QF28fuSzpTFAKs4gXQA1LcRsB9WVoYxcLMoqqEAmzEqqzIAQFocMLZHB4A0YnSK9wKDdRWYjKRAfqKfWb/2b5w1OLaYz+Idho8KAOYxDfhXusYPq7Z9/rA=="
-    ];
-  };
-  ychenfo = {
-    isNormalUser = true;
-    extraGroups = ["plugdev" "dialout"];
-    openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBJDEHOerlYRjkTaaa9HLLjTRuLAkPdhcRiizUkmANKgKdO17xZ7Or05dAGeeivv+TEmJShSK0EljhGv/+pTHrf/L0d7pExSjyb0m08iYb8gLCoQVx7hcFLIGiYnNoLab9g=="
-    ];
-  };
-  geekzjk = {
-    isNormalUser = true;
-    extraGroups = ["plugdev" "dialout"];
-    openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBJkGRYVmOXvPSne2xUYbC8XyotTQ4pr6dwR7IiRgOSHqwm6ECHRtjMM2hneI+lBv91YCg/l5WXE111dNXw6vniBIEqjrErz3MmjEZ5aFJI6l9KiyJ4zueRubuUyBVevaEw=="
-    ];
-  };
   spaqin = {
     isNormalUser = true;
     extraGroups = ["plugdev" "dialout"];
     openssh.authorizedKeys.keys = [
       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBOtmlQmIK/cEUkcwA/y9jC4AohjoEmikerpxzPhZZtOcENidN/vFum58jIcSxBvjHnILOzhfCTeLvbvGbQOFE53a7FOyEHmIzXRKS86Mg5bPHUBJxRSq9MjulGZXES3HOQ=="
     ];
+    shell = pkgs.zsh;
   };
-  therobs12 = {
+  srayman89 = {
     isNormalUser = true;
+    extraGroups = ["plugdev" "dialout" "libvirtd"];
     openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBGKbLMWCWrcUIVDKc7wrkn1Oo1PCH3K0HWIXnPjgASqKdzrNkgrHcg8UsXS0tLKtoYWbWisVUU+V05p6RKMOP7TP6hc2xoVRov6fBMuKHnVJbR9BAkn3O2EaJ7Rlo0y8aQ=="
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBMoGOV9HoFkm6S6zMfOc8ivUcGzKFxuqpmOXKQtg2nn5Kh6ByMuuAHFlvKISILBaWgXN8lPQN9VjLuXV93oG4Pe7u8EVw20IGbA6RZ4Pnnr1xQBESPbye+72taLvyQlxGA=="
     ];
   };
-  ciciwu = {
+  esavkin = {
+    isNormalUser = true;
+    extraGroups = ["plugdev" "dialout" "libvirtd" "wireshark"];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBLDJI4GFLBmScbeR8Jh4Gi8A/2nuGlYtFTJVT+Es/bzdiPRk8DLG62T0hyRR+8LfHjbrCsDuYFNztT8hHGXd7h3xp3y2X7ArkJo8xUK5QxGd5D2Zn4ANfZTTVkoGlEHbFA=="
+    ];
+  };
+  flo = {
     isNormalUser = true;
     extraGroups = ["plugdev" "dialout"];
     openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBIzRznRnbyIfo64IVlZNS6ZisPNYKoIeadkXz0dhvp4RBzOKbIOj/9wVbtmMvbScuDJw79dSk0cviaTU8hfMfSplzm3iZGqX4N4JWPtPQAu28e3P6Cu89AiKKjT3dUM50Q=="
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBF4ZYNBYqJPQCKBYjMatFj5eGMyzh/X2TSraJEG6XBdg3jnJ3WcsOd7sm+vx+o9Y1EJ2kvwW/Vy9c3OYVU2U45njox//sKtt8Eyzszws3EYJqHQ6KAwXtW9ao4aamRtK3Q=="
     ];
   };
-  stevefan1999 = {
+  srenblad = {
     isNormalUser = true;
-    extraGroups = ["plugdev" "dialout" "wireshark"];
+    extraGroups = ["plugdev" "dialout"];
     openssh.authorizedKeys.keys = [
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBCxQXT1Qd9ysrCAgJl+81UpiL7/32CzYXvZeByG7MatJ1o2DOBZmm5r4GEwz2F9bRc/KIc9UyurX0jWS6O5FhAYLg4ekCrm5bvLEgl8py4Cd+VZY8wM3nQGyDTFQzeg4lQ=="
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBLoMzO8XIkUTKUC0R05EmXn3V6gm2oMvXhh+j68G9TDBeb8x0WFkz16NPclsXdMcb2dFhtLmxUHwB5L4zWSuyYkqr0YRrtly3uwXe5Wnyz1ZAkxoq7YjQlanWSri11U8xw=="
+    ];
+  };
+  linuswck = {
+    isNormalUser = true;
+    extraGroups = ["plugdev" "dialout" "wireshark" "libvirtd"];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBAFYwmik6/xY1vb9aKBOpKklKOwSJJ0PEgNwWNULghZGJ0g4CTk04LXLSMYBm1SW74df8YMgaE/eoidq6smN6hKIgo8s3qPQGZAi4UXffMs2ciqXNa/zZcCu3PyZvyksxA=="
+    ];
+  };
+  morgan = {
+    isNormalUser = true;
+    extraGroups = ["plugdev" "dialout" "wireshark" "libvirtd"];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBDXMbJEPn0mM2Bgt6eMAd+c0J5oPSvquZG+BxKdUf0qbeQldRaoB26NHMZnLte/fS00U/cqStLWDiwtEvH5WlbbawsMBymm65zbWMByebXhBDjdr6a1kkOFcKJvAL9qVBQ=="
+    ];
+  };
+  atse = {
+    isNormalUser = true;
+    extraGroups = ["plugdev" "dialout"];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBJHMX1YDnBPQfZyGVtc93u4TIFWqnHEe6WB/eTeiOjFulitXzGfhsODZ08GzTi2+YKk7spRiPKNwRPTKFuW2PPe3Xig8b75qRMIeIVX3b7e0i6xP85eg4jdiz0LD2YGUHQ=="
+    ];
+  };
+  derppening = {
+    isNormalUser = true;
+    extraGroups = ["plugdev" "dialout"];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBOKwN4ui94QfouYYlkI1lc3WgtjURVYLTdAizJIBnY3dNRNblAiuvTD4pQ+LEI+eOTg4SnQz1NeqH4YOQhbT5+/nZojvGTb3UVN13ZYND+Gci3DdqB2mwIYop7kMXwHgLQ=="
+    ];
+  };
+  therobs12 = {
+    isNormalUser = true;
+    extraGroups = ["plugdev" "dialout"];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBK1tUg7TtceARRnGI80Ai5kNFolFfZ++LH9v1UoRCiJdxeQWPdNYO0Gj7+ejJvgZXwvN4yHGgcZHraEml4Mj/dKrEMFygfuYLDRmXtPFwX6TNMrWlxMhPzuNY+yCaxlqYg=="
+    ];
+  };
+  abdul = {
+    isNormalUser = true;
+    extraGroups = ["plugdev" "dialout"];
+    openssh.authorizedKeys.keys = [
+      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBONzKWn65erPM2xBCe9Dcw8dHRQCJmvzwhX72iHE1xVlAr7UcB1PMOjEB25MFfV/kCIFS5UB5wuoPvq+/oZ3EXiFjmQtsb669KN6MkZNyDqP5Y2W8gR1wVa/ZLfH4HynHg=="
     ];
   };
 
@@ -111,12 +126,4 @@
       "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBGChLocYJi8XcSJkIjT2Olm3jPGjtRq5aORa5G9F3OqmjCfvav9Q5+2Mc64XqHtNTffnJuDe4gv+lVJatC0URvPs2HyxXmxRK0jgkkLSUsV2SYLlgMqHW3jsrdh6wKBmkg=="
     ];
   };
-  tom = {
-    isNormalUser = true;
-    extraGroups = ["plugdev" "dialout"];
-    openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDMviQek/1Wj525Y5QQb3fXimJ9srOgWJNBxKKB5xfOzEzlU/MQr49sUSyq1+wUXOc2lHjQQb4aNbs8QyzhgynvlZZ4C/scFXLv83V8SFd8fXb8YiJ5OXBCxiHAZWJF/99kxQNeLvp3qvU+hWG3nLHd6NDTbyqG+EIEaZkJsVbdCzL/ERUbCZPNkfgY5zv62i9zR8XJtt77lyCprOs4q27wD+FplkjN3skeWJYr0F+yuf2DEC1ZrOS1uYHVgPlOZRSQq8qtWr4K4ZMrFJ0Ul7Qzj/GjtqH59QZFcVgoHJhlSM5MUNn863IKuLPmHOsTYqA57bPj+vulMZwt63Qw0ehpVZnUo3MZjfI/fS5Ox8c0B+7/JmGXxQVe+mQ6feg24h3C3+npzI6VbGXr09+ka36d7bRDJdY6/LEhQZTiwXrwOxstFjbEucGDPFx0rsqDxPeQ77mA0GQw2J/hYr6kc+KDIipclxqq6tE6LEYaAzeiTePU+QSutLsOzEpXezY3vINd/Tp8oySQBliseKsByPV8m37egTHheLNbVvh6a4sfhm68MGDYNBAKGHyMpnnDf/G1PVf97wq0YpQWoCrYNbp7QQZST0UjEk8hARnI/UuZtkYOaube0lcO0zaMUtmX8Qq4dq+RMblcwjWVsqExljFNEhjJqRRY7ZfpJ5OdeiXFLQ=="
-      "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBJ+FieYdkTS3BomeEVp7SMGD3HYDzdQHKi1WgqiFF5c3CYjFiwc/W/NrsCavEkLM9GrLKS1OKxHlG6gpsMGxiHuidoK7NDd3NhHL2jJFzH7haFktJ5DrkfRPPi4QPscZPg=="
-    ];
-  };
 }

nixops/demeter-hardware-configuration.nix

@@ -0,0 +1,46 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/c7fa9c3e-56ca-4258-a49c-3f064efbd58c";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/76A2-F01F";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp86s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  system.stateVersion = "23.05";
+}

nixops/desktop.nix

@@ -2,7 +2,7 @@
 
 { config, pkgs, ... }:
 let
-  m-labs = import (fetchTarball https://nixbld.m-labs.hk/channel/custom/artiq/full/artiq-full/nixexprs.tar.xz) { inherit pkgs; };
+  artiq = builtins.getFlake git+https://github.com/m-labs/artiq.git;
 in
 {
   deployment.targetHost = host;
@@ -10,19 +10,36 @@ in
   nix.nixPath = [ "nixpkgs=${pkgs.path}" ];
   programs.command-not-found.dbPath = "${pkgs.path}/programs.sqlite";
 
+  boot.loader.systemd-boot.memtest86.enable = true;
+  boot.loader.grub.memtest86.enable = true;
+  boot.kernel.sysctl."kernel.dmesg_restrict" = false;
+
   imports =
     [
       (./. + "/${host}-hardware-configuration.nix")
+      ./avscan-module.nix
     ];
   nixpkgs.config.packageOverrides = super: let self = super.pkgs; in {
+    libp11 = super.libp11.override({ openssl = super.openssl_1_1; });
     pam_p11 = super.pam_p11.overrideAttrs(oa: {
-      patchPhase = oa.patchPhase or "" + ''
-          substituteInPlace src/match_openssh.c --replace \
-            '"%s/.ssh/authorized_keys", pw->pw_dir)' \
-            '"/etc/ssh/authorized_keys.d/%s", pw->pw_name)'
+      patches = [];
+      postPatch = ''
+        substituteInPlace src/match_openssh.c --replace \
+          '"%s/.ssh/authorized_keys", pw->pw_dir)' \
+          '"/etc/ssh/authorized_keys.d/%s", pw->pw_name)'
         '';
     });
+    gnome = super.gnome // {
+       gnome-keyring = super.gnome.gnome-keyring.overrideAttrs(oa: {
+          configureFlags = oa.configureFlags ++ ["--disable-ssh-agent"];
+        });
+    };
   };
+  nixpkgs.config.permittedInsecurePackages = [
+    "openssl-1.1.1w"
+  ];
+
+  boot.binfmt.emulatedSystems = [ "armv7l-linux" ];
 
   networking.hostName = host;
   networking.firewall.allowedTCPPorts = [ 1883 ];
@@ -35,35 +52,50 @@ in
   nixpkgs.config.allowUnfree = true;
   environment.systemPackages = with pkgs; [
     opensc yubikey-manager yubikey-manager-qt yubico-piv-tool
-    wget vim gitAndTools.gitFull sshfs firefox chromium thunderbird hexchat
+    wget vim gitAndTools.gitFull sshfs
+    firefox
+    thunderbird
+    chromium
     usbutils pciutils uhubctl file lm_sensors audacious acpi
     gimp imagemagick
-    (python3.withPackages(ps: with ps; [ numpy scipy matplotlib qtconsole regex ]))
+    (python3.withPackages(ps: with ps; [ numpy scipy matplotlib qtconsole regex jinja2 ]))
+    texlive.combined.scheme-full
     mosh psmisc libreoffice-fresh
-    gtkwave telnet unzip zip gnupg
-    gnome3.gnome-tweaks
+    inkscape
+    xournal
+    xsane
+    gtkwave unzip zip gnupg
+    gnome-tweaks
+    ghex
     jq sublime3 rink qemu_kvm
-    tmux xc3sprog m-labs.openocd screen gdb minicom picocom tigervnc
+    tmux screen gdb minicom picocom
+    artiq.packages.x86_64-linux.openocd-bscanspi
+    xc3sprog
+    gqrx
     emacs bat ripgrep
-    xpra
-    rust-analyzer
-    (vscode-with-extensions.override {
-      vscodeExtensions = [
-        vscode-extensions.matklad.rust-analyzer
-      ];
-    })
+    guake
+    vscodium
+    waypipe
     virt-manager spice-gtk
-    (callPackage ./any-nix-shell.nix {})
+    kicad
+    any-nix-shell
   ];
   programs.wireshark.enable = true;
   programs.wireshark.package = pkgs.wireshark;
   virtualisation.libvirtd.enable = true;
-  virtualisation.libvirtd.qemuOvmf = true;
-  security.wrappers.spice-client-glib-usb-acl-helper.source = "${pkgs.spice-gtk}/bin/spice-client-glib-usb-acl-helper";
+  virtualisation.libvirtd.qemu.ovmf.enable = true;
+  security.wrappers.spice-client-glib-usb-acl-helper = {
+    source = "${pkgs.spice-gtk}/bin/spice-client-glib-usb-acl-helper";
+    owner = "root";
+    group = "root";
+    setuid = true;
+  };
+
+  services.avscan.enable = true;
 
   services.openssh.enable = true;
-  services.openssh.forwardX11 = true;
-  services.openssh.passwordAuthentication = false;
+  services.openssh.authorizedKeysInHomedir = false;
+  services.openssh.settings.PasswordAuthentication = false;
   services.openssh.extraConfig =
     ''
     StreamLocalBindUnlink yes
@@ -76,7 +108,6 @@ in
     PKCS11Provider "${pkgs.opensc}/lib/opensc-pkcs11.so"
     '';
   programs.ssh.startAgent = true;
-  services.gnome.gnome-keyring.enable = pkgs.lib.mkForce false;
   programs.ssh.agentPKCS11Whitelist = "${pkgs.opensc}/lib/opensc-pkcs11.so";
   security.pam.p11.enable = true;
 
@@ -96,31 +127,21 @@ in
   };
   services.avahi = {
     enable = true;
-    nssmdns = true;
+    nssmdns4 = true;
   };
 
-  # Enable sound.
-  sound.enable = true;
-  hardware.pulseaudio = {
-    enable = true;
-    extraModules = [ pkgs.pulseaudio-modules-bt ];
-    package = pkgs.pulseaudioFull;
-  };
+  hardware.graphics.enable32Bit = true;
 
-  i18n.inputMethod = {
-    enabled = "fcitx";
-    fcitx.engines = with pkgs.fcitx-engines; [ table-extra m17n ];
-  };
-  fonts.fonts = [ pkgs.noto-fonts pkgs.noto-fonts-cjk pkgs.noto-fonts-emoji pkgs.noto-fonts-extra pkgs.emacs-all-the-icons-fonts ];
+  fonts.packages = [ pkgs.noto-fonts pkgs.noto-fonts-cjk-sans pkgs.noto-fonts-emoji pkgs.noto-fonts-extra pkgs.emacs-all-the-icons-fonts ];
 
   # Enable the X11 windowing system.
   services.xserver.enable = true;
-  services.xserver.layout = "us";
-  services.xserver.xkbOptions = "eurosign:e";
+  services.xserver.xkb.layout = "us";
+  services.xserver.xkb.options = "eurosign:e";
 
   services.xserver.displayManager.gdm.enable = true;
   services.xserver.desktopManager.gnome.enable = true;
-  environment.gnome.excludePackages = [ pkgs.epiphany pkgs.gnome3.geary ];
+  environment.gnome.excludePackages = [ pkgs.epiphany ];
 
   systemd.suppressedSystemUnits = [
       "hibernate.target"
@@ -136,6 +157,7 @@ in
 
   hardware.bluetooth.enable = true;
 
+  programs.zsh.enable = true;
   programs.fish.enable = true;
   programs.fish.promptInit = ''
     any-nix-shell fish --info-right | source
@@ -145,21 +167,14 @@ in
   users.extraGroups.plugdev = { };
   users.extraUsers = import ./common-users.nix { inherit pkgs; };
   security.sudo.wheelNeedsPassword = false;
-  services.udev.packages = [ m-labs.openocd ];
+  services.udev.packages = [ artiq.packages.x86_64-linux.openocd-bscanspi ];
   services.udev.extraRules = (import ./extra-udev.nix);
 
-  nix.binaryCachePublicKeys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
-  nix.binaryCaches = ["https://nixbld.m-labs.hk" "https://cache.nixos.org"];
-  nix.sandboxPaths = ["/opt"];
+  nix.settings.trusted-public-keys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
+  nix.settings.substituters = ["https://nixbld.m-labs.hk?priority=10"];
+  nix.settings.extra-sandbox-paths = ["/opt"];
 
-  nix.package = pkgs.nixUnstable;
   nix.extraOptions = ''
-    experimental-features = nix-command flakes
+    experimental-features = nix-command flakes impure-derivations
   '';
-
-  # This value determines the NixOS release with which your system is to be
-  # compatible, in order to avoid breaking some software such as database
-  # servers. You should change this only after NixOS release notes say you
-  # should.
-  system.stateVersion = "19.03"; # Did you read the comment?
 }

nixops/device-tree-module.nix

@@ -1,67 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.hardware.deviceTree;
-in {
-  options = {
-      hardware.deviceTree = {
-        enable = mkOption {
-          default = pkgs.stdenv.hostPlatform.platform.kernelDTB or false;
-          type = types.bool;
-          description = ''
-            Build device tree files. These are used to describe the
-            non-discoverable hardware of a system.
-          '';
-        };
-
-        base = mkOption {
-          default = "${config.boot.kernelPackages.kernel}/dtbs";
-          defaultText = "\${config.boot.kernelPackages.kernel}/dtbs";
-          example = literalExample "pkgs.device-tree_rpi";
-          type = types.path;
-          description = ''
-            The path containing the base device-tree (.dtb) to boot. Contains
-            device trees bundled with the Linux kernel by default.
-          '';
-        };
-
-        name = mkOption {
-          default = null;
-          example = "some-dtb.dtb";
-          type = types.nullOr types.str;
-          description = ''
-            The name of an explicit dtb to be loaded, relative to the dtb base.
-            Useful in extlinux scenarios if the bootloader doesn't pick the
-            right .dtb file from FDTDIR.
-          '';
-        };
-
-        overlays = mkOption {
-          default = [];
-          example = literalExample
-            "[\"\${pkgs.device-tree_rpi.overlays}/w1-gpio.dtbo\"]";
-          type = types.listOf types.path;
-          description = ''
-            A path containing device tree overlays (.dtbo) to be applied to all
-            base device-trees.
-          '';
-        };
-
-        package = mkOption {
-          default = null;
-          type = types.nullOr types.path;
-          internal = true;
-          description = ''
-            A path containing the result of applying `overlays` to `base`.
-          '';
-        };
-      };
-  };
-
-  config = mkIf (cfg.enable) {
-    hardware.deviceTree.package = if (cfg.overlays != [])
-      then pkgs.deviceTree.applyOverlays cfg.base cfg.overlays else cfg.base;
-  };
-}

nixops/device-tree-pkg.nix

@@ -1,17 +0,0 @@
-{ lib, stdenvNoCC, dtc, findutils }:
-
-with lib; {
-  applyOverlays = (base: overlays: stdenvNoCC.mkDerivation {
-    name = "device-tree-overlays";
-    nativeBuildInputs = [ dtc findutils ];
-    buildCommand = let
-      quotedDtbos = concatMapStringsSep " " (o: "\"${toString o}\"") (toList overlays);
-    in ''
-      for dtb in $(find ${base} -name "*.dtb" ); do
-        outDtb=$out/$(realpath --relative-to "${base}" "$dtb")
-        mkdir -p "$(dirname "$outDtb")"
-        fdtoverlay -o "$outDtb" -i "$dtb" ${quotedDtbos};
-      done
-    '';
-  });
-}

nixops/experimental-users.nix

@@ -1,10 +0,0 @@
-{ pkgs, ... }:
-
-{
-  creotech = {
-    isNormalUser = true;
-    openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCz2zz2tzQS+jzORA+D/KiVFCXNBV9xwQRAblnyUaUODje62t3/22b/60btrl2GvtPh2MAoZ7GBjbR85WZFUJ2MvLVSyTWfVnB5bjsi2o4se+TN0xCtoZJCWQG9H6wYfXMrc9gY98in6zxxTI4qUENGV/1qQpURgpFd9aUVmA8biz53DA7In2oongImhCz6gDf+eZw2iaBjrtYqzPanMWvIKlCfTcfc71RqdHSpChcGUEmtq1fXmyoyqgAHd0xEoMq7sJR89IdQ+rGND5vXCbqvS8MhYpwNjlYRCMJWgMhcf4tK5diOHH9pIj+aIgfTq60E3K+uAz+bIqiTVB5N46kx"
-    ];
-  };
-}

nixops/extra-udev.nix

@@ -1,11 +1,4 @@
 ''
-# leaf maple
-SUBSYSTEM=="usb", ATTRS{idVendor}=="1eaf", ATTRS{idProduct}=="0003", MODE="0660", GROUP="plugdev"
-SUBSYSTEM=="usb", ATTRS{idVendor}=="1eaf", ATTRS{idProduct}=="0004", MODE="0660", GROUP="plugdev"
-# STM32 devkit
-SUBSYSTEM=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="374e", MODE="0660", GROUP="plugdev"
-# glasgow
-SUBSYSTEM=="usb", ATTRS{idVendor}=="20b7", ATTRS{idProduct}=="9db1", MODE="0660", GROUP="plugdev"
 # hackrf
 SUBSYSTEM=="usb", ATTRS{idVendor}=="1d50", ATTRS{idProduct}=="6089", MODE="0660", GROUP="plugdev"
 # bladerf
@@ -25,6 +18,10 @@ SUBSYSTEM=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="df11", MODE="0660"
 # Renkforce USB hub with power control
 SUBSYSTEM=="usb", ATTRS{idVendor}=="2109", ATTRS{idProduct}=="0812", MODE="0660", GROUP="plugdev"
 SUBSYSTEM=="usb", ATTRS{idVendor}=="2109", ATTRS{idProduct}=="2812", MODE="0660", GROUP="plugdev"
-# Shenzhen logic analyzer
+# LibreVNA
+SUBSYSTEM=="usb", ATTRS{idVendor}=="0483", ATTRS{idProduct}=="4121", MODE="0660", GROUP="plugdev"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="1209", ATTRS{idProduct}=="4121", MODE="0660", GROUP="plugdev"
+# DSLogic
 SUBSYSTEM=="usb", ATTRS{idVendor}=="2a0e", ATTRS{idProduct}=="0020", MODE="0660", GROUP="plugdev"
+SUBSYSTEM=="usb", ATTRS{idVendor}=="2a0e", ATTRS{idProduct}=="0034", MODE="0660", GROUP="plugdev"
 ''

nixops/franz-hardware-configuration.nix

@@ -10,10 +10,10 @@
 
   boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelPackages = pkgs.linuxPackages_latest;
   boot.kernelModules = [ "kvm-intel" ];
   boot.blacklistedKernelModules = [ "iwlwifi" ];
   boot.extraModulePackages = [ ];
+  boot.kernelParams = ["intel_idle.max_cstate=1"];
 
   fileSystems."/" =
     { device = "/dev/disk/by-uuid/37e69920-a60d-4cb0-ae2f-b812f7a35dc8";
@@ -23,6 +23,7 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/A33B-F001";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
@@ -31,4 +32,8 @@
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  system.stateVersion = "21.05";
 }

nixops/hera-hardware-configuration.nix

@@ -18,23 +18,18 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/8C30-F6DC";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
 
-  nix.maxJobs = lib.mkDefault 16;
+  nix.settings.max-jobs = lib.mkDefault 16;
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  virtualisation.libvirtd.allowedBridges = [ "virbr0" "br0" ];
-  networking.bridges = {
-    br0 = {
-      interfaces = [ "eno1" ];
-    };
-  };
-  networking.networkmanager.enable = false;
-  networking.useDHCP = false;
-  networking.interfaces.br0.useDHCP = true;
+  hardware.cpu.intel.updateMicrocode = true;
+
+  system.stateVersion = "19.03";
 }

nixops/hestia-hardware-configuration.nix

@@ -18,13 +18,18 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/E085-5F21";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
 
-  nix.maxJobs = lib.mkDefault 16;
+  nix.settings.max-jobs = lib.mkDefault 16;
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  system.stateVersion = "19.03";
 }

nixops/juno-hardware-configuration.nix

@@ -1,30 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  imports =
-    [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
-    ];
-
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ehci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
-  boot.extraModulePackages = [ ];
-
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/62a38d9c-452c-4648-be12-6131e95b8276";
-      fsType = "ext4";
-    };
-
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/88F6-46F2";
-      fsType = "vfat";
-    };
-
-  swapDevices = [ ];
-
-  nix.maxJobs = lib.mkDefault 8;
-  powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
-
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-}

nixops/jupiter-hardware-configuration.nix

@@ -0,0 +1,43 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/315af039-6799-43ac-8999-7da69a6fbd1e";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/45B7-790E";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp86s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = true;
+  
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  
+  system.stateVersion = "24.05";
+}

nixops/light.nix

@@ -1,142 +0,0 @@
-{ host }:
-
-{ config, pkgs, ... }:
-let
-  m-labs = import (fetchTarball https://nixbld.m-labs.hk/channel/custom/artiq/full/artiq-full/nixexprs.tar.xz) { inherit pkgs; };
-in
-{
-  deployment.targetHost = host;
-  deployment.hasFastConnection = true;
-  nix.nixPath = [ "nixpkgs=${pkgs.path}" ];
-  programs.command-not-found.dbPath = "${pkgs.path}/programs.sqlite";
-
-  imports =
-    [
-      (./. + "/${host}-hardware-configuration.nix")
-    ];
-  nixpkgs.config.packageOverrides = super: let self = super.pkgs; in {
-    pam_p11 = super.pam_p11.overrideAttrs(oa: {
-      patchPhase = oa.patchPhase or "" + ''
-          substituteInPlace src/match_openssh.c --replace \
-            '"%s/.ssh/authorized_keys", pw->pw_dir)' \
-            '"/etc/ssh/authorized_keys.d/%s", pw->pw_name)'
-        '';
-    });
-  };
-
-  networking.hostName = host;
-
-  time.timeZone = "Asia/Hong_Kong";
-
-  # List packages installed in system profile. To search, run:
-  # $ nix search wget
-  documentation.enable = false;
-  nixpkgs.config.allowUnfree = true;
-  environment.systemPackages = with pkgs; [
-    opensc
-    wget vim git firefox usbutils pciutils file lm_sensors acpi
-    gimp imagemagick
-    evince
-    (python3.withPackages(ps: with ps; [ numpy scipy ]))
-    psmisc
-    telnet unzip zip gnupg
-    sublime3 rink
-    tmux screen tigervnc
-    (callPackage ./any-nix-shell.nix {})
-  ];
-  programs.wireshark.enable = true;
-
-  services.openssh.enable = true;
-  services.openssh.forwardX11 = true;
-  services.openssh.passwordAuthentication = false;
-  services.openssh.extraConfig =
-    ''
-    StreamLocalBindUnlink yes
-    '';
-  programs.mosh.enable = true;
-
-  services.pcscd.enable = true;
-  programs.ssh.extraConfig =
-    ''
-    PKCS11Provider "${pkgs.opensc}/lib/opensc-pkcs11.so"
-    '';
-  programs.ssh.startAgent = true;
-  programs.ssh.agentPKCS11Whitelist = "${pkgs.opensc}/lib/opensc-pkcs11.so";
-  security.pam.p11.enable = true;
-
-  # Enable CUPS to print documents.
-  services.printing = {
-    enable = true;
-    extraConf =
-      ''
-      Browsing Off
-      BrowseLocalProtocols none
-      '';
-    browsedConf =
-      ''
-      BrowseRemoteProtocols none
-      BrowseProtocols none
-      '';
-  };
-  services.avahi = {
-    enable = true;
-    nssmdns = true;
-  };
-
-  # Enable sound.
-  sound.enable = true;
-  hardware.pulseaudio = {
-    enable = true;
-    extraModules = [ pkgs.pulseaudio-modules-bt ];
-    package = pkgs.pulseaudioFull;
-  };
-
-  i18n.inputMethod = {
-    enabled = "fcitx";
-    fcitx.engines = with pkgs.fcitx-engines; [ table-extra m17n ];
-  };
-  fonts.fonts = [ pkgs.noto-fonts pkgs.noto-fonts-cjk pkgs.noto-fonts-emoji pkgs.noto-fonts-extra ];
-
-  # Enable the X11 windowing system.
-  services.xserver.enable = true;
-  services.xserver.layout = "us";
-  services.xserver.xkbOptions = "eurosign:e";
-
-  services.xserver.displayManager.lightdm.enable = true;
-  services.xserver.desktopManager.xfce.enable = true;
-
-  systemd.suppressedSystemUnits = [
-      "hibernate.target"
-      "suspend.target"
-      "suspend-then-hibernate.target"
-      "sleep.target"
-      "hybrid-sleep.target"
-      "systemd-hibernate.service"
-      "systemd-hybrid-sleep.service"
-      "systemd-suspend.service"
-      "systemd-suspend-then-hibernate.service"
-  ];
-
-  programs.fish.enable = true;
-  programs.fish.promptInit = ''
-    any-nix-shell fish --info-right | source
-  '';
-  users.mutableUsers = false;
-  users.defaultUserShell = pkgs.fish;
-  users.extraGroups.plugdev = { };
-  users.extraUsers = import ./common-users.nix { inherit pkgs; };
-  
-  security.sudo.wheelNeedsPassword = false;
-  services.udev.packages = [ m-labs.openocd ];
-  services.udev.extraRules = (import ./extra-udev.nix);
-
-  nix.binaryCachePublicKeys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
-  nix.binaryCaches = ["https://nixbld.m-labs.hk" "https://cache.nixos.org"];
-  nix.sandboxPaths = ["/opt"];
-
-  # This value determines the NixOS release with which your system is to be
-  # compatible, in order to avoid breaking some software such as database
-  # servers. You should change this only after NixOS release notes say you
-  # should.
-  system.stateVersion = "19.03"; # Did you read the comment?
-}

nixops/nixops.nix

@@ -1,17 +1,22 @@
 {
+  network.storage.legacy = {
+     databasefile = "~/.nixops/deployments.nixops";
+  };
+
   network.enableRollback = true;
 
   rpi-1 = import ./rpi.nix { host = "rpi-1"; rpi4 = true; };
-  rpi-2 = import ./rpi.nix { host = "rpi-2"; rpi4 = false; experimental-users = true; };
-  rpi-3 = import ./rpi.nix { host = "rpi-3"; rpi4 = true; };
   rpi-4 = import ./rpi.nix { host = "rpi-4"; rpi4 = true; };
-  rpi-ext = import ./rpi-server.nix { host = "rpi-ext"; rpi4 = true; };
-  juno = import ./desktop.nix { host = "juno"; };
   zeus = import ./desktop.nix { host = "zeus"; };
   hera = import ./desktop.nix { host = "hera"; };
   hestia = import ./desktop.nix { host = "hestia"; };
   chiron = import ./desktop.nix { host = "chiron"; };
   old-nixbld = import ./desktop.nix { host = "old-nixbld"; };
   franz = import ./desktop.nix { host = "franz"; };
-  cnc = import ./light.nix { host = "cnc"; };
+  demeter = import ./desktop.nix { host = "demeter"; };
+  vulcan = import ./desktop.nix { host = "vulcan"; };
+  rc = import ./desktop.nix { host = "rc"; };
+  athena = import ./desktop.nix { host = "athena"; };
+  jupiter = import ./desktop.nix { host = "jupiter"; };
+  saturn = import ./desktop.nix { host = "saturn"; };
 }

nixops/old-nixbld-hardware-configuration.nix

@@ -8,31 +8,27 @@
     [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix>
     ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usbhid" ];
   boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" ];
+  boot.kernelModules = [ "kvm-amd" ];
   boot.extraModulePackages = [ ];
 
   fileSystems."/" =
-    { device = "/dev/disk/by-uuid/e8aa18dc-70de-440c-885f-652a123acb15";
+    { device = "/dev/disk/by-uuid/69b15848-1cfc-4e3e-91de-1df0d2fc7a80";
       fsType = "ext4";
     };
 
   fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/19DD-B26F";
+    { device = "/dev/disk/by-uuid/D0A3-DDAE";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
-  swapDevices =
-    [ { device = "/dev/disk/by-uuid/86b091d2-9e61-4938-bcd9-6417e69a98b3"; }
-    ];
-
-  nix.maxJobs = lib.mkDefault 12;
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+  hardware.cpu.amd.updateMicrocode = true;
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
 
-  services.xserver.videoDrivers = [ "nvidia" ];
-  services.xserver.displayManager.gdm.wayland = false;
+  system.stateVersion = "22.05";
 }

nixops/rc-hardware-configuration.nix

@@ -0,0 +1,50 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "sd_mod" "rtsx_usb_sdmmc" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/348c924c-1d86-44ff-84af-2594f414e7d0";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/1BDC-44BB";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  fileSystems."/opt" =
+    { device = "/dev/disk/by-uuid/cf0f51b6-7b95-4c74-9390-37dc4c86f32b";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  system.stateVersion = "23.11";
+}

nixops/rpi-server.nix

@@ -1,148 +0,0 @@
-{ host, rpi4 }:
-
-{ config, pkgs, ... }:
-{
-  deployment.targetHost = host;
-  deployment.hasFastConnection = true;
-  nix.nixPath = [ "nixpkgs=${pkgs.path}" ];
-  programs.command-not-found.dbPath = "${pkgs.path}/programs.sqlite";
-  nixpkgs.system = "aarch64-linux";
-
-  boot.loader.grub.enable = false;
-  boot.loader.generic-extlinux-compatible.enable = true;
-  boot.loader.raspberryPi = pkgs.lib.mkIf rpi4 {
-    enable = true;
-    version = 4;
-  };
-  boot.kernelParams = ["cma=64M"]; # work around https://github.com/raspberrypi/linux/issues/3208
-  boot.kernelPackages = if rpi4 then pkgs.linuxPackages_rpi4 else pkgs.linuxPackages_rpi3;
-  boot.initrd.includeDefaultModules = false;
-
-  # work around https://github.com/NixOS/nixpkgs/issues/125354
-  disabledModules = [ "hardware/device-tree.nix" ];
-  imports = [ ./device-tree-module.nix ];
-  nixpkgs.config.packageOverrides = super: let self = super.pkgs; in {
-    deviceTree = super.callPackage ./device-tree-pkg.nix {};
-  };
-  hardware.deviceTree.enable = true;
-  hardware.deviceTree.base = pkgs.device-tree_rpi;
-  hardware.deviceTree.overlays = [ "${pkgs.device-tree_rpi.overlays}/rpi-poe.dtbo" ];
-
-
-  fileSystems = {
-    "/" = {
-      device = "/dev/disk/by-label/NIXOS_SD";
-      fsType = "ext4";
-    };
-  };
-
-  services.openssh.enable = true;
-  services.openssh.passwordAuthentication = false;
-  services.openssh.extraConfig =
-    ''
-    StreamLocalBindUnlink yes
-    '';
-  programs.mosh.enable = true;
-
-  networking.hostName = host;
-  time.timeZone = "Asia/Hong_Kong";
-
-  hardware.enableRedistributableFirmware = true;
-  services.hostapd = {
-    enable        = true;
-    interface     = "wlan0";
-    hwMode        = "g";
-    ssid          = "M-Labs-ext";
-    wpaPassphrase = (import /etc/nixos/secret/wifi_ext_password.nix);
-    extraConfig   = ''
-      ieee80211d=1
-      country_code=HK
-      ieee80211n=1
-      wmm_enabled=1
-      auth_algs=1
-      wpa_key_mgmt=WPA-PSK
-      rsn_pairwise=CCMP
-    '';
-  };
-  networking.interfaces.eth0 = {
-    ipv4.addresses = [{
-      address = "192.168.1.30";
-      prefixLength = 24;
-    }];
-    ipv6.addresses = [{
-      address = "2001:470:f821:1:dea6:32ff:fe95:2fcf";
-      prefixLength = 64;
-    }];
-    ipv4.routes = [{
-      address = "0.0.0.0";
-      prefixLength = 0;
-      via = "192.168.1.1";
-    }];
-    ipv6.routes = [{
-      address = "::";
-      prefixLength = 0;
-      via = "fe80::523e:aaff:fe0c:e49d";
-    }];
-  };
-  networking.interfaces.wlan0 = {
-    ipv4.addresses = [{
-      address = "192.168.13.1";
-      prefixLength = 24;
-    }];
-    ipv6.addresses = [{
-      address = "2001:470:f821:3::";
-      prefixLength = 64;
-    }];
-  };
-  services.dnsmasq = {
-    enable = true;
-    servers = ["192.168.1.1#53"];
-    extraConfig = ''
-      interface=wlan0
-      bind-interfaces
-      dhcp-range=192.168.13.10,192.168.13.254,24h
-      enable-ra
-      dhcp-range=::,constructor:wlan0,ra-only
-      no-resolv
-    '';
-  };
-  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-  boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = "1";
-  boot.kernel.sysctl."net.ipv6.conf.default.forwarding" = "1";
-
-  users.extraGroups.plugdev = { };
-  users.mutableUsers = false;
-  users.defaultUserShell = pkgs.fish;
-  users.extraUsers = import ./common-users.nix { inherit pkgs; };
-  security.sudo.wheelNeedsPassword = false;
-  services.udev.extraRules = (import ./extra-udev.nix);
-
-  documentation.enable = false;
-  environment.systemPackages = with pkgs; [
-    psmisc wget vim git sshfs usbutils lm_sensors file telnet mosh tmux
-    imagemagick
-  ];
-  programs.fish.enable = true;
-
-  services.avahi.enable = true;
-  services.avahi.publish.enable = true;
-  services.avahi.publish.userServices = true;
-  services.printing.enable = true;
-  services.printing.drivers = [ pkgs.hplip ];
-  services.printing.browsing = true;
-  services.printing.listenAddresses = [ "192.168.1.30:631" "192.168.13.1:631" ];
-  services.printing.defaultShared = true;
-  hardware.sane.enable = true;
-  hardware.sane.extraBackends = [ pkgs.hplip ];
-  systemd.sockets.cups.wants = [ "network-setup.service" ];
-  systemd.sockets.cups.after = [ "network-setup.service" ];
-  systemd.sockets.cups.wantedBy = [ "multi-user.target" ];
-  systemd.services.cups.wantedBy = [ "multi-user.target" ];
-
-  networking.firewall.allowedTCPPorts = [ 631 ];
-  networking.firewall.interfaces.wlan0.allowedUDPPorts = [ 53 67 ];
-
-  nix.binaryCachePublicKeys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
-  nix.binaryCaches = ["https://cache.nixos.org" "https://nixbld.m-labs.hk"];
-  nix.trustedUsers = ["root" "nix"];
-}

nixops/rpi.nix

@@ -2,7 +2,7 @@
 
 { config, pkgs, ... }:
 let
-  m-labs = import (fetchTarball https://nixbld.m-labs.hk/channel/custom/artiq/full/artiq-full/nixexprs.tar.xz) { inherit pkgs; };
+  artiq = builtins.getFlake git+https://github.com/m-labs/artiq.git;
 in
 {
   deployment.targetHost = host;
@@ -14,19 +14,8 @@ in
   boot.loader.grub.enable = false;
   boot.loader.generic-extlinux-compatible.enable = true;
   boot.kernelParams = if rpi4 then ["cma=64M"] else []; # work around https://github.com/raspberrypi/linux/issues/3208
-  boot.kernelPackages = if rpi4 then pkgs.linuxPackages_rpi4 else pkgs.linuxPackages_rpi3;
   boot.initrd.includeDefaultModules = false;
-
-  # work around https://github.com/NixOS/nixpkgs/issues/125354
-  disabledModules = [ "hardware/device-tree.nix" ];
-  imports = [ ./device-tree-module.nix ];
-  nixpkgs.config.packageOverrides = super: let self = super.pkgs; in {
-    deviceTree = super.callPackage ./device-tree-pkg.nix {};
-  };
-  hardware.deviceTree.enable = true;
-  hardware.deviceTree.base = pkgs.device-tree_rpi;
-  hardware.deviceTree.overlays = [ "${pkgs.device-tree_rpi.overlays}/rpi-poe.dtbo" ];
-
+  boot.kernel.sysctl."kernel.dmesg_restrict" = false;
 
   fileSystems = {
     "/" = {
@@ -36,8 +25,9 @@ in
   };
 
   services.openssh.enable = true;
-  services.openssh.passwordAuthentication = false;
-  services.openssh.gatewayPorts = "clientspecified";
+  services.openssh.authorizedKeysInHomedir = false;
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.settings.GatewayPorts = "clientspecified";
   services.openssh.extraConfig =
     ''
     StreamLocalBindUnlink yes
@@ -46,38 +36,40 @@ in
 
   networking.hostName = host;
 
-  networking.firewall.allowedTCPPorts = if host == "rpi-2" then [ 6000 ] else [];
-
   time.timeZone = "Asia/Hong_Kong";
 
   users.extraGroups.plugdev = { };
   users.mutableUsers = false;
   users.defaultUserShell = pkgs.fish;
-  users.extraUsers = (import ./common-users.nix { inherit pkgs; }) //
-    (pkgs.lib.optionalAttrs experimental-users (import ./experimental-users.nix { inherit pkgs; })) // {
-    nix = {
-      isNormalUser = true;
-    };
+  users.extraUsers = (import ./common-users.nix { inherit pkgs; }) // {
     nixbld = {
       isNormalUser = true;
       extraGroups = ["plugdev" "dialout"];
       openssh.authorizedKeys.keys = [
-        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCxqGdllmXCeadFvqhpWpPfeh/sSiORxCJQO6wCEnkctoYYn9chegj5tXz5dm7WvXQt73pFMytyXBXKidMMXpW2pTxLXVt3tV2rWf1MspznyMHND1xJTXZzPvmF3YiwMvJ2UkLCiW0ixlKn4z30rcsC+jn+aunNo8lsRCNeIIhHpe1JollM05w2YXE0/BUXTXDpqBXWPPvs0GdsSecwWMMhwvVQAFyms1aSevEPADrHa6Zbk8+MnS5FMFrPiJc8RSEsPkG0OOsAG1gWFyKqT5nXHpgcK1AjO5YOlBKfj//b8yLppP3BRmvnulnAJ9+uscWfzxi3cdofgcl4sT/J16Dh hydra-queue-runner@nixbld"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGJGICdNM9mHHAa1Cxk9Wz3YLkIEeqrIQGxM0aoy1g5O"
       ];
     };
   };
   security.sudo.wheelNeedsPassword = false;
-  services.udev.packages = [ m-labs.openocd ];
+  services.udev.packages = [ artiq.packages.aarch64-linux.openocd-bscanspi ];
   services.udev.extraRules = (import ./extra-udev.nix);
 
   documentation.enable = false;
   environment.systemPackages = with pkgs; [
-    psmisc wget vim git sshfs usbutils uhubctl lm_sensors file telnet mosh tmux xc3sprog m-labs.openocd screen gdb minicom picocom
+    psmisc wget vim git sshfs usbutils uhubctl lm_sensors file mosh tmux
+    artiq.packages.aarch64-linux.openocd-bscanspi
+    xc3sprog
+    screen gdb minicom picocom
   ];
+  programs.zsh.enable = true;
   programs.fish.enable = true;
   programs.wireshark.enable = true;
 
-  nix.binaryCachePublicKeys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
-  nix.binaryCaches = ["https://cache.nixos.org" "https://nixbld.m-labs.hk"];
-  nix.trustedUsers = ["root" "nix" "sb"];
+  nix.settings.trusted-public-keys = ["nixbld.m-labs.hk-1:5aSRVA5b320xbNvu30tqxVPXpld73bhtOeH6uAjRyHc="];
+  nix.settings.substituters = ["https://nixbld.m-labs.hk?priority=10"];
+  nix.settings.trusted-users = ["root" "sb"];
+
+  nix.extraOptions = ''
+    experimental-features = nix-command flakes impure-derivations
+  '';
 }

nixops/saturn-hardware-configuration.nix

@@ -0,0 +1,43 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "ahci" "nvme" "usbhid" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/51d521ec-4807-4b71-8a89-116b89f72d2e";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/877D-AF6A";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp86s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = true;
+  
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  
+  system.stateVersion = "24.05";
+}

nixops/vulcan-hardware-configuration.nix

@@ -0,0 +1,41 @@
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/67168ae0-6448-4b40-b278-406290224b4f";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/8F4B-AD84";
+      fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+  
+  system.stateVersion = "23.05";
+}

nixops/zeus-hardware-configuration.nix

@@ -18,13 +18,18 @@
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/91B4-E546";
       fsType = "vfat";
+      options = [ "fmask=0022" "dmask=0022" ];
     };
 
   swapDevices = [ ];
 
-  nix.maxJobs = lib.mkDefault 16;
+  nix.settings.max-jobs = lib.mkDefault 16;
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
 
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
+
+  hardware.cpu.intel.updateMicrocode = true;
+
+  system.stateVersion = "19.03";
 }

remote-ipsec.txt

@@ -0,0 +1,49 @@
+connections {
+  bypass-ipsec {
+    remote_addrs = 127.0.0.1
+    children {
+      bypass-isakmp-v4 {
+        local_ts = 0.0.0.0/0[udp/isakmp]
+        remote_ts = 0.0.0.0/0[udp/isakmp]
+        mode = pass
+        start_action = trap
+      }
+      bypass-isakmp-v6 {
+        local_ts = ::/0[udp/isakmp]
+        remote_ts = ::/0[udp/isakmp]
+        mode = pass
+        start_action = trap
+      }
+    }
+  }
+  m_labs {
+    version = 2
+    encap = no
+    mobike = no
+    send_certreq = no
+    proposals = aes128gcm128-sha256-prfsha256-curve25519,aes128gcm128-sha256-prfsha256-ecp256
+    local_addrs = 103.206.98.1
+    remote_addrs = 94.190.212.123
+    local {
+      auth = pubkey
+      id = fqdn:igw0.hkg.as150788.net
+      pubkeys = igw0.hkg.as150788.net
+    }
+    remote {
+      auth = pubkey
+      id = fqdn:m-labs.hk
+      pubkeys = m-labs.hk
+    }
+    children {
+      con1 {
+        mode = transport
+        ah_proposals = sha256-curve25519,sha256-ecp256
+        esp_proposals =
+        local_ts = 103.206.98.1[gre]
+        remote_ts = 94.190.212.123[gre]
+        start_action = none
+        close_action = none
+      }
+    }
+  }
+}