hippocampus: headscale: change localaddress

Flake lock file updates:

• Updated input 'home-manager':
    'github:nix-community/home-manager/6cee0821577643e0b34e2c5d9a90d0b1b5cdca70' (2026-02-07)
  → 'github:nix-community/home-manager/2de7205ce6e10b031151033e69b7ef89708dc282' (2026-04-13)
• Updated input 'lix-module':
    'b90bf629bb.tar.gz?narHash=sha256-YMLrcBpf0TR5r/eaqm8lxzFPap2TxCor0ZGcK3a7%2Bb8%3D' (2025-01-18)
  → 'b90bf629bb.tar.gz?narHash=sha256-YMLrcBpf0TR5r/eaqm8lxzFPap2TxCor0ZGcK3a7%2Bb8%3D&rev=b90bf629bbd835e61f1317b99e12f8c831017006' (2025-01-18)
• Updated input 'me-emacs':
    'git+https://git.syzygial.cc/Syzygial/EmacsConfig.git?ref=refs/heads/master&rev=a82da456bdd9064a0395252935a66c8e2864a4db' (2026-01-20)
  → 'git+https://git.syzygial.cc/Syzygial/EmacsConfig.git?ref=refs/heads/master&rev=cce76e2f8f4372dd3391a76daa53c1a89b89bc40' (2026-03-03)
• Updated input 'microvm':
    'github:astro/microvm.nix/68c9f9c6ca91841f04f726a298c385411b7bfcd5' (2026-02-05)
  → 'github:astro/microvm.nix/c0a53823dbf7eb166c2fa7dc2d1e0d6cb2be7562' (2026-04-12)
• Updated input 'microvm/spectrum':
    'git+https://spectrum-os.org/git/spectrum?ref=refs/heads/main&rev=c5d5786d3dc938af0b279c542d1e43bce381b4b9' (2025-10-03)
  → 'git+https://spectrum-os.org/git/spectrum?ref=refs/heads/main&rev=fe39e122d898f66e89ffa17d4f4209989ccb5358' (2026-02-27)
• Updated input 'nix-darwin':
    'github:LnL7/nix-darwin/0d7874ef7e3ba02d58bebb871e6e29da36fa1b37' (2026-02-04)
  → 'github:LnL7/nix-darwin/06648f4902343228ce2de79f291dd5a58ee12146' (2026-04-01)
• Updated input 'nixpkgs':
    'github:NixOS/nixpkgs/00c21e4c93d963c50d4c0c89bfa84ed6e0694df2' (2026-02-04)
  → 'github:NixOS/nixpkgs/4c1018dae018162ec878d42fec712642d214fdfa' (2026-04-09)
• Updated input 'sops-nix':
    'github:Mic92/sops-nix/17eea6f3816ba6568b8c81db8a4e6ca438b30b7c' (2026-02-03)
  → 'github:Mic92/sops-nix/d4971dd58c6627bfee52a1ad4237637c0a2fb0cd' (2026-04-13)
• Updated input 'sops-nix/nixpkgs':
    'github:NixOS/nixpkgs/6308c3b21396534d8aaeac46179c14c439a89b8a' (2026-01-30)
  → 'github:NixOS/nixpkgs/13043924aaa7375ce482ebe2494338e058282925' (2026-04-11)

flake.lock

@@ -94,11 +94,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770476834,
-        "narHash": "sha256-cyxgVsNfHnJ4Zn6G1EOzfTXbjTy7Ds9zMOsZaX7VZWs=",
+        "lastModified": 1776114641,
+        "narHash": "sha256-VJMt3n9zGRzupzvlhcKIz4SpWflKh0rWfYTgmkmun0Q=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "6cee0821577643e0b34e2c5d9a90d0b1b5cdca70",
+        "rev": "2de7205ce6e10b031151033e69b7ef89708dc282",
         "type": "github"
       },
       "original": {
@@ -135,7 +135,7 @@
         "narHash": "sha256-YMLrcBpf0TR5r/eaqm8lxzFPap2TxCor0ZGcK3a7+b8=",
         "rev": "b90bf629bbd835e61f1317b99e12f8c831017006",
         "type": "tarball",
-        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/b90bf629bbd835e61f1317b99e12f8c831017006.tar.gz"
+        "url": "https://git.lix.systems/api/v1/repos/lix-project/nixos-module/archive/b90bf629bbd835e61f1317b99e12f8c831017006.tar.gz?rev=b90bf629bbd835e61f1317b99e12f8c831017006"
       },
       "original": {
         "type": "tarball",
@@ -150,11 +150,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1768875255,
-        "narHash": "sha256-H2fNon/y6RH+PlMxGY6X/7Qvty+LVCrjCkw8Ee15Iis=",
+        "lastModified": 1772550819,
+        "narHash": "sha256-K6TvujvSSv+pDPAXqdabd7g9wFIkOdvHOeeFohou42A=",
         "ref": "refs/heads/master",
-        "rev": "a82da456bdd9064a0395252935a66c8e2864a4db",
-        "revCount": 89,
+        "rev": "cce76e2f8f4372dd3391a76daa53c1a89b89bc40",
+        "revCount": 94,
         "type": "git",
         "url": "https://git.syzygial.cc/Syzygial/EmacsConfig.git"
       },
@@ -171,11 +171,11 @@
         "spectrum": "spectrum"
       },
       "locked": {
-        "lastModified": 1770310890,
-        "narHash": "sha256-lyWAs4XKg3kLYaf4gm5qc5WJrDkYy3/qeV5G733fJww=",
+        "lastModified": 1775996588,
+        "narHash": "sha256-klBp+NIkJJtFHKFEHaMqwDHSK09UufDL6RJoxUZOL5Q=",
         "owner": "astro",
         "repo": "microvm.nix",
-        "rev": "68c9f9c6ca91841f04f726a298c385411b7bfcd5",
+        "rev": "c0a53823dbf7eb166c2fa7dc2d1e0d6cb2be7562",
         "type": "github"
       },
       "original": {
@@ -191,11 +191,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1770184146,
-        "narHash": "sha256-DsqnN6LvXmohTRaal7tVZO/AKBuZ02kPBiZKSU4qa/k=",
+        "lastModified": 1775037210,
+        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
         "owner": "LnL7",
         "repo": "nix-darwin",
-        "rev": "0d7874ef7e3ba02d58bebb871e6e29da36fa1b37",
+        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
         "type": "github"
       },
       "original": {
@@ -223,11 +223,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1770197578,
-        "narHash": "sha256-AYqlWrX09+HvGs8zM6ebZ1pwUqjkfpnv8mewYwAo+iM=",
+        "lastModified": 1775710090,
+        "narHash": "sha256-ar3rofg+awPB8QXDaFJhJ2jJhu+KqN/PRCXeyuXR76E=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00c21e4c93d963c50d4c0c89bfa84ed6e0694df2",
+        "rev": "4c1018dae018162ec878d42fec712642d214fdfa",
         "type": "github"
       },
       "original": {
@@ -239,11 +239,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1769740369,
-        "narHash": "sha256-xKPyJoMoXfXpDM5DFDZDsi9PHArf2k5BJjvReYXoFpM=",
+        "lastModified": 1775888245,
+        "narHash": "sha256-nwASzrRDD1JBEu/o8ekKYEXm/oJW6EMCzCRdrwcLe90=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6308c3b21396534d8aaeac46179c14c439a89b8a",
+        "rev": "13043924aaa7375ce482ebe2494338e058282925",
         "type": "github"
       },
       "original": {
@@ -270,11 +270,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1770145881,
-        "narHash": "sha256-ktjWTq+D5MTXQcL9N6cDZXUf9kX8JBLLBLT0ZyOTSYY=",
+        "lastModified": 1776119890,
+        "narHash": "sha256-Zm6bxLNnEOYuS/SzrAGsYuXSwk3cbkRQZY0fJnk8a5M=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "17eea6f3816ba6568b8c81db8a4e6ca438b30b7c",
+        "rev": "d4971dd58c6627bfee52a1ad4237637c0a2fb0cd",
         "type": "github"
       },
       "original": {
@@ -286,11 +286,11 @@
     "spectrum": {
       "flake": false,
       "locked": {
-        "lastModified": 1759482047,
-        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "lastModified": 1772189877,
+        "narHash": "sha256-i1p90Rgssb//aNiTDFq46ZG/fk3LmyRLChtp/9lddyA=",
         "ref": "refs/heads/main",
-        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
-        "revCount": 996,
+        "rev": "fe39e122d898f66e89ffa17d4f4209989ccb5358",
+        "revCount": 1255,
         "type": "git",
         "url": "https://spectrum-os.org/git/spectrum"
       },

machines/hippocampus/configuration.nix

@@ -39,6 +39,7 @@
   nixpkgs.config.permittedInsecurePackages = [
     "nodejs-14.21.3"
     "openssl-1.1.1w"
+    "olm-3.2.16"
   ];
   nix.gc = {
     automatic = true;
@@ -89,7 +90,7 @@
   services.printing.enable = true;
 
   # Enable sound with pipewire.
-  hardware.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
   security.rtkit.enable = true;
   services.pipewire = {
     enable = true;
@@ -125,7 +126,8 @@
   environment.systemPackages = with pkgs; [
     firefox
 
-    screen
+    tmux
+    tio
     btop
     htop
     

machines/hippocampus/modules/containerHeadscale.nix

@@ -25,6 +25,8 @@
         authKeyFile = "/var/tailauth";
         extraUpFlags = ["--login-server" "${authServer}"];
       };
+      # Resolves https://github.com/NixOS/nixpkgs/issues/430756
+      systemd.services.tailscaled-autoconnect.serviceConfig.Type = lib.mkForce "simple";
     };
   };
 
@@ -59,19 +61,19 @@ in {
   };
 
   config = {
-    networking.bridges = {
-      "br0" = {
-        interfaces = [];
-      };
-    };
-    networking.interfaces.br0.ipv4.addresses = [{
-      address = "10.0.0.1";
-      prefixLength = 24;
-    }];
+#    networking.bridges = {
+#      "br0" = {
+#        interfaces = [];
+#      };
+#    };
+#    networking.interfaces.br0.ipv4.addresses = [{
+#      address = "10.0.0.1";
+#      prefixLength = 24;
+#    }];
     networking.nat = {
       enable = true;
       # Check for hostBridge use vb instead of ve
-      internalInterfaces = (map (n: "vb-${n}") (attrNames cfg.containers)) ++ ["br0"];
+      internalInterfaces = (map (n: "ve-${n}") (attrNames cfg.containers));
       externalInterface = "enp0s25";
       enableIPv6 = true;
     };

machines/hippocampus/oci/Wireguard.ContainerFile

@@ -1,5 +1,17 @@
 FROM alpine:3.16
-RUN apk add --no-cache bash wireguard-tools jq curl git ncurses
+RUN apk add --no-cache bash jq curl git ncurses \
+    bc \
+    coredns \
+    grep \
+    iproute2 \
+    iptables \
+    ip6tables \
+    iputils \
+    kmod \
+    net-tools \
+    nftables \
+    openresolv \
+    wireguard-tools
 RUN git clone https://github.com/pia-foss/manual-connections /manual-connections
 WORKDIR /manual-connections
-CMD bash -c "/manual-connections/run_setup.sh && watch -n 60 curl ip.me"
+CMD bash -c "/manual-connections/run_setup.sh && watch -n 1800 curl ip.me"

machines/hippocampus/oci/jelly.nix

@@ -31,7 +31,7 @@
             "radarr"
             "jellyseerr"
             "bazarr"
-            "readarr"
+            # "readarr"
             "prowlarr"
           ];
           environment = {
@@ -220,26 +220,26 @@
           ];
         };
 
-        readarr = {
-          image = "linuxserver/readarr:nightly";
-          volumes = [
-            "${dataDir}:/data"
-            "${configDir}/readarr:/config"
-          ];
-          ports = [
-            "8787:8787"
-          ];
-          environment = baseEnv // {
-            
-          };
-          extraOptions = [
-            "--pull=newer"
-            "--network" "container:wireguard"
-          ];
-          dependsOn = [
-            "prowlarr"
-          ];
-        };
+#        readarr = {
+#          image = "linuxserver/readarr:nightly";
+#          volumes = [
+#            "${dataDir}:/data"
+#            "${configDir}/readarr:/config"
+#          ];
+#          ports = [
+#            "8787:8787"
+#          ];
+#          environment = baseEnv // {
+#            
+#          };
+#          extraOptions = [
+#            "--pull=newer"
+#            "--network" "container:wireguard"
+#          ];
+#          dependsOn = [
+#            "prowlarr"
+#          ];
+#        };
 
         prowlarr = {
           image = "linuxserver/prowlarr:nightly";

machines/hippocampus/riscv.nix

@@ -1,6 +1,7 @@
 { config, pkgs, lib, ... }: {
+  # TODO: rename to emulation?
   boot.binfmt.emulatedSystems = [
-    "riscv64-linux"
+    "riscv64-linux" "aarch64-linux"
   ];
   boot.binfmt.preferStaticEmulators = true;
 }

machines/hippocampus/secrets/pass.yaml

@@ -1,6 +1,6 @@
 nextcloud:
-    adminPass: ENC[AES256_GCM,data:D2SAD/Somvw8abIm0KX4fWRfuQ==,iv:Y7K14yZZFcu97KVBd0219hwnGY4LEX2DNxxulSegr/8=,tag:aRJAlz1xvQxWodcE2bZLdQ==,type:str]
-    s3secret: ENC[AES256_GCM,data:lIVuiZMh376MSuu13UPCu49Q64bVbk+WM/CUEIGzV0Q=,iv:J2vHalppWEupWK07zXsMoiH6avmpsgg0Cqcc7EkZVV4=,tag:pxKwiaH5SZa8Vh71gLGQWw==,type:str]
+    adminPass: ENC[AES256_GCM,data:Tz34/CW22LYNtwDNoPHq0cINRg==,iv:eSw22XtTpODEreJKSK6mM0jZWAB6qLqANYF7KesNGso=,tag:4Zp7hTv3oArx+nDIEdA7Jw==,type:str]
+    s3secret: ENC[AES256_GCM,data:hv3SLDs6YW5KInUBFUPXImqwnZqjegXOv7hQFtuWI48=,iv:39R8crx5/3xdK0s8/yNMwSib2yDQcfOVg0PA7GhdiXA=,tag:J8YT12onk7DOFL7Z9OEYYQ==,type:str]
 jellyfin-pia: ENC[AES256_GCM,data:hOgUAr47FMd2QgzgXBeqv41Paqy6zn6tyWVDbF1JtqcTog/zZC4=,iv:opnxrycFszAhuMARcP48gKF6eL1ERNgWS68wO+s4CIM=,tag:fqimxKdTAh55ANKD3bp46w==,type:str]
 ddclient: ENC[AES256_GCM,data:a31MKnoEZXrj/s8z3+MP9jhQ5/sBjljZphXBJsWj5GU=,iv:YHKCartadDQa59aUf9Fw/KgdgMgsqsVLDAIh/KeqehQ=,tag:hUaUqjcX75xw6eC9axtQmw==,type:str]
 anki: ENC[AES256_GCM,data:hUBKr/s1DDorlmbHDUvHtVSumw==,iv:Ekjt6dsncinHhM+dV/mxOjErBQpgKtPOVbmwGRy9XOE=,tag:zvfV9z3QROgsk4eznmxqDw==,type:str]
@@ -19,6 +19,7 @@ tuwunelreg: ENC[AES256_GCM,data:5NJL1W6iVEwLwAUGlmCOHgVzV+9aLMrp8OXu8uVUw3SpCR5f
 coturn-secret: ENC[AES256_GCM,data:9lPM14VVk/VlmYPy4XgIaKDQgRKcoaCaszcaETCBQMmMIGSuq+G2aHqa8dtXf6Tg/Llcza+VROZYBuC9bsFwoEDtcbhFoE9S7OKrJ8bWDDI1AGTwP3j9tgExvmd0HMyqkNrb3l1cPj4/CLcSlZxxWcYVWZL2sSzKpqhKNXGeYCM=,iv:zckUJK+F95lVKZz/XoD4nmuC14FiIU1gIxe5U4abvrg=,tag:nSPxlCMS4QXBvkb6jn4EQg==,type:str]
 lk-jwt: ENC[AES256_GCM,data:6EXQbXUWsXzYwHU+KYh8FfVKoMScrbX/ITx/x128UdU1r0PmqEZ39TewmDUSlNlMsaWYRffNd8lmfF3sPZDOZzL/jNJNaTSqUKy8cPX8XF+LJqq08ZDWihvgKjcyHy6BORpe07fGp6v/otJW9XE9qujJ2QC/0MA+dJpckpfibaswfWwkL2BfmDfcq2H8Tudohg==,iv:Rm5uWOKGBKlnivGkxWokpG1YR1dxeTV+cVrDZ/3i8yE=,tag:bSeOZ7SEelDIeSGTdzRVng==,type:str]
 dawarich_smtp: ENC[AES256_GCM,data:v4VU5XGGR2rLfQZsMvbXCA==,iv:jD3EFKab7/oxxqX6O1Mfz5tA/xUOGEaBtMsHnENouBQ=,tag:JWyrensx9v97blQv49jsLQ==,type:str]
+mautrix-discord: ENC[AES256_GCM,data:LzRUuwdYs4HJfeSm9iKPNaGkx5Fqs0gPBdEhv0hbEANHw2Dsg/yioS5jWc8FymhVbO3L3lfpd+TJGH5dSRqU5cTcTJO34CyBLU+Y+bkbneI+Ri0ngfCEuuNpBjyvQhHrba1YskcgvUuHPMJejFPbfPKu7B+GNznI6mZUJmN6jvO7BweY2bTeC2zURMmMjcoNEcdDUhhlSRpOK/EUVZF3LE+MwBKz/WTJbtEi22wO+x/dIg3z8SLwZRSuUYwumZ7YyQAUHDJz/7Qy5u0uzMmAAY3WpQUICg8DykenndeXST2AopG4EsBazS9GwPX60Ri4MEnnPKNXSNHy0dH+NsuCnqNCIouOpraS3yobTaI7oJIPZoKTWoJWU2Xsh0pktdzyJbJf3kpal0lQkPbD4i31LQeJJbiPPXiouhKeaSKd2LcueGIWBgMD12phZ0Vk2t4S90oN25fByvfF9clviBKbJo/wrWTO2EeQpnrqOD9B1w6ZBowIxXwPUnfNP52sjKRjCWXakO/rSzLQs2DzXT7hN3cMdNsmHxGlIWlLDEHJIpcr49vIzHkCXZc8n412taBNxMRqLHRGFpB0Cjw9CelmZ8cnXOUbSzV06ahOeuJT2Gn+CwefAZSXtiZCnqqpb2758W1Xdw4VReenGyj6TIfTDbo5rfM2elbP/LOxf3obLRpyC4MQkqyo8geT3FjjYFXTc1jN7P/ma8U1YMdZaxdNwUxi1iVB28PhaJ60BMz7UYQW9QfmY24rX0TBaL2OKu4bSh1zeaZm7QbW0LCjBm1A08Pg8nYPZVobjfWXbCIYmsjGhH3T2/BLqqhfth+q3Oswqybi35AQR9EeSJ+tZWyCgHsPWgM8KCGyynqf8xvczSUeCro6MNQ5Jzw=,iv:Bo0FRzCPMFokZsRPwUg0vP+Azo6nr4sTkrU6O++lucU=,tag:zYPEZUkILsQTljLil5Yq5w==,type:str]
 sops:
     age:
         - recipient: age1crymppz88etsdjpckmtdhr397x5xg5wv8jt6tcj23gt2snq73pzs04fuve
@@ -30,7 +31,7 @@ sops:
             RVUzMlFya3Z0amdTUTJ5YjFRck5kZzQKoWZzExqzPRpQPL4CdqBalc1/dYtjBH6J
             LGR0oImfOWlIJwcaJLv/fc470UvXHHwIji9v/pbV7xMkgMjlJthaYg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-02-16T00:04:12Z"
-    mac: ENC[AES256_GCM,data:W17ieIGhzDXcjT8xJn72K0274QN9FcMOXdB4YWeSAyxSwRmwUkuF9NzbAWZ8rH/Yva8mUgOh+OC1x4xavHI5UGBsSoUk+q9vevRd13qVE328o3JW0ZRsi3PunpmmzEYoz//z3UUxpepgcBKGTui8Fj1z5tOoNtXfEtxnHv/JY0w=,iv:8TSc+cMa+bbFqoPObnBE5KUhysmZnr1iTksc4tvUcDw=,tag:6LxuWGLQv7fSpJN0spuQ5Q==,type:str]
+    lastmodified: "2026-03-24T01:33:31Z"
+    mac: ENC[AES256_GCM,data:9DI2psMKIl3mM6oBWeNHLrl+e5UY/uvE0P/Y9T2sRMVHUmbo5dmr7yCxDoQ/t6EJKUKURqh1ESH9QNqAWULJRQvMabOt+fSZwjP+d8F8cR1pAEmeIpYfnbJslvrz1uhlvdcc+HYdM9BVYJ3BC3QgQk49qhU03Mum2Vn9iHwD+FA=,iv:GNSrYPdYEnA6VoNY2OJvCdxbBasjAk2UrifumTgspJ4=,tag:uUtlcGookPmvwkDI9i2arg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.11.0

machines/hippocampus/servers/private/grafana.nix

@@ -2,7 +2,7 @@
 
 {
   services.grafana = {
-    enable = true;
+    enable = false;
 
     settings.server = {
       http_addr = "0.0.0.0";

machines/hippocampus/servers/private/miniio.nix

@@ -5,8 +5,9 @@
     autoStart = true;
 
     privateNetwork = true;
-    hostBridge = "br0";
-    localAddress = "10.0.0.${toString (10+n)}/24";
+    #hostBridge = "br0";
+    hostAddress = "10.${toString (10+n)}.0.0";
+    localAddress = "10.${toString (10+n)}.0.1";
     
     # If true it registers a new node very time
     # need to find where it stores the state

machines/hippocampus/servers/public/dawarich.nix

@@ -27,11 +27,11 @@
     ${config.services.dawarich.localDomain} = {
       extraConfig = ''
         reverse_proxy localhost:${toString config.services.dawarich.webPort}
-	encode brotli {
-          match {
-	    content_type text/css text/plain text/xml text/x-component text/javascript application/x-javascript application/javascript application/json application/manifest+json application/vnd.api+json application/xml application/xhtml+xml application/rss+xml application/atom+xml application/vnd.ms-fontobject application/x-font-ttf application/x-font-opentype application/x-font-truetype image/svg+xml image/x-icon image/vnd.microsoft.icon font/ttf font/eot font/otf font/opentype
-	  }
-	}
+#	encode brotli {
+#          match {
+#	    content_type text/css text/plain text/xml text/x-component text/javascript application/x-javascript application/javascript application/json application/manifest+json application/vnd.api+json application/xml application/xhtml+xml application/rss+xml application/atom+xml application/vnd.ms-fontobject application/x-font-ttf application/x-font-opentype application/x-font-truetype image/svg+xml image/x-icon image/vnd.microsoft.icon font/ttf font/eot font/otf font/opentype
+#	  }
+#	}
       '';
     };
   };  

machines/hippocampus/servers/public/dawarich/0001-build-ffi-gem.diff

@@ -15,4 +15,4 @@ index d45a7657..d0a7b750 100644
 +    ffi (1.17.2)
      foreman (0.90.0)
        thor (~> 1.4)
-     fugit (1.11.1)
+     fugit (1.11.1)

machines/hippocampus/servers/public/dawarich/0002-openssl-hotfix.diff

@@ -29,4 +29,4 @@ index a32eb801..b2fc45bc 100644
 +  openssl
    parallel
    pg
-   prometheus_exporter
+   prometheus_exporter

machines/hippocampus/servers/public/dawarich/sources.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.1.0",
-  "hash": "sha256-oL1XLBaSYCeP+Fn+6BlGMEgCTkwZhT1VZNamrcRXrgI=",
+  "version": "1.2.0",
+  "hash": "sha256-6NlqeiG+kjpSVpg8JFvqZPvCoigzjIcF1Ru/AdMwShg=",
   "npmHash": "sha256-doBsDBsO7npHs/jyeg4xWzdauWoK6dPe8z+97IP2zxI="
 }

machines/hippocampus/servers/public/dawarich/update.sh

@@ -0,0 +1,40 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p bundix curl jq nix-update nix-prefetch-github prefetch-npm-deps gnused
+set -e
+set -o pipefail
+
+OWNER="Freika"
+REPO="dawarich"
+
+old_version=$(nix-instantiate --eval -A 'dawarich.version' default.nix | tr -d '"')
+version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/$OWNER/$REPO/releases/latest" | jq -r ".tag_name")
+
+echo "Updating to $version"
+
+if [[ "$old_version" == "$version" ]]; then
+    echo "Already up to date!"
+    exit 0
+fi
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+echo "Fetching source code $REVISION"
+JSON=$(nix-prefetch-github "$OWNER" "$REPO" --rev "refs/tags/$version" 2>/dev/null)
+HASH=$(echo "$JSON" | jq -r .hash)
+
+cat > "$SCRIPT_DIR/sources.json" << EOF
+{
+  "version": "$version",
+  "hash": "$HASH",
+  "npmHash": "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
+}
+EOF
+
+SOURCE_DIR="$(nix-build --no-out-link -A dawarich.src)"
+
+echo "Creating gemset.nix"
+bundix --lockfile="$SOURCE_DIR/Gemfile.lock" --gemfile="$SOURCE_DIR/Gemfile" --gemset="$SCRIPT_DIR/gemset.nix"
+nixfmt "$SCRIPT_DIR/gemset.nix"
+
+NPM_HASH="$(prefetch-npm-deps "$SOURCE_DIR/package-lock.json" 2>/dev/null)"
+sed -i "s;sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=;$NPM_HASH;g" "$SCRIPT_DIR/sources.json"

machines/hippocampus/servers/public/headscale.nix

@@ -6,6 +6,7 @@
     enable = true;
     # 7000 port addresses are for internal network
     port = 7000;
+    address = "0.0.0.0"; # Access within nixos-containers
     settings = {
       server_url = "https://headscale.syzygial.cc";
       # TODO: Generate keys??
@@ -40,7 +41,7 @@
   services.caddy.virtualHosts = {
     "headscale.syzygial.cc" = {
       extraConfig = ''
-        reverse_proxy localhost:7000
+        reverse_proxy 0.0.0.0:7000
       '';
     };
   };

machines/hippocampus/servers/public/matrix/bots/discord.nix

@@ -9,11 +9,12 @@ in {
     ensureDatabases = [
       mautrix-discord-user
     ];
-    ensureUsers = {
-      "${mautrix-discord-user}" = {
+    ensureUsers = [
+      {
+        name = "${mautrix-discord-user}";
         ensureDBOwnership = true;
-      };
-    };
+      }
+    ];
   };
   services.mautrix-discord = {
     enable = true;
@@ -72,7 +73,7 @@ in {
         #   .System - Whether the user is an official system user
         #   .Webhook - Whether the user is a webhook and is not an application
         #   .Application - Whether the user is an application
-        displayname_template = "{{if .Webhook}}Webhook{{else}}{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}{{end}}";
+        displayname_template = "{{if .Webhook}}Webhook{{else}}{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}{{end}} (Discord DM)";
         # Displayname template for Discord channels (bridged as rooms, or spaces when type=4).
         # Available variables:
         #   .Name - Channel name, or user displayname (pre-formatted with displayname_template) in DMs.
@@ -172,9 +173,6 @@ in {
           # The bridge supports MSC3860 media download redirects and will use them if the requester supports it.
           # Optionally, you can force redirects and not allow proxying at all by setting this to false.
           allow_proxy = true;
-          # Matrix server signing key to make the federation tester pass, same format as synapse's .signing.key file.
-          # This key is also used to sign the mxc:// URIs to ensure only the bridge can generate them.
-          server_key = "$MAUTRIX_DISCORD_APPSERVICE_DIRECT_MEDIA";
         };
         # Settings for converting animated stickers.
         animated_sticker = {
@@ -194,7 +192,7 @@ in {
         };
         # Servers to always allow double puppeting from
         double_puppet_server_map = {
-          example.com = "https://example.com";
+          "glia.club" = "https://glia.club";
         };
         # Allow using double puppeting from any server with a valid client .well-known file.
         double_puppet_allow_discovery = false;
@@ -204,7 +202,7 @@ in {
         # instead of users having to find an access token and run `login-matrix`
         # manually.
         login_shared_secret_map = {
-          example.com = "foobar";
+          "glia.club" = "as_token:$MAUTRIX_DISCORD_DOUBLE_PUPPET";
         };
 
         # The prefix for commands. Only required in non-management rooms.
@@ -336,38 +334,38 @@ in {
             # You should not enable this option unless you understand all the implications.
             disable_device_change_key_rotation = false;
           };
+        };
 
-          # Settings for provisioning API
-          provisioning = {
-            # Prefix for the provisioning API paths.
-            prefix = "/_matrix/provision";
-            # Shared secret for authentication. If set to "generate", a random secret will be generated,
-            # or if set to "disable", the provisioning API will be disabled.
-            shared_secret = "generate";
-            # Enable debug API at /debug with provisioning authentication.
-            debug_endpoints = false;
-          };
+        # Settings for provisioning API
+        provisioning = {
+          # Prefix for the provisioning API paths.
+          prefix = "/_matrix/provision";
+          # Shared secret for authentication. If set to "generate", a random secret will be generated,
+          # or if set to "disable", the provisioning API will be disabled.
+          shared_secret = "generate";
+          # Enable debug API at /debug with provisioning authentication.
+          debug_endpoints = false;
+        };
 
-          # Permissions for using the bridge.
-          # Permitted values:
-          #    relay - Talk through the relaybot (if enabled), no access otherwise
-          #     user - Access to use the bridge to chat with a Discord account.
-          #    admin - User level and some additional administration tools
-          # Permitted keys:
-          #        * - All Matrix users
-          #   domain - All users on that homeserver
-          #     mxid - Specific user
-          permissions = {
-            "*" = "relay";
-            "glia.club" = "user";
-            "@admin:glia.club" = "admin";
-            "@cyborgpotato:glia.club" = "admin";
-          };
+        # Permissions for using the bridge.
+        # Permitted values:
+        #    relay - Talk through the relaybot (if enabled), no access otherwise
+        #     user - Access to use the bridge to chat with a Discord account.
+        #    admin - User level and some additional administration tools
+        # Permitted keys:
+        #        * - All Matrix users
+        #   domain - All users on that homeserver
+        #     mxid - Specific user
+        permissions = {
+          "*" = "relay";
+          "glia.club" = "user";
+          "@admin:glia.club" = "admin";
+          "@cyborgpotato:glia.club" = "admin";
         };
       };
       appservice = {
         # The address that the homeserver can use to connect to this appservice.
-        address = "http://localhost:${config.services.mautrix-discord.settings.appservice.port}";
+        address = "http://localhost:${toString config.services.mautrix-discord.settings.appservice.port}";
 
         # The hostname and port where this appservice should listen.
         hostname = "0.0.0.0";
@@ -430,7 +428,7 @@ in {
   services.caddy.virtualHosts = {
     "${config.services.mautrix-discord.settings.bridge.direct_media.server_name}" = {
       extraConfig = ''
-        reverse_proxy localhost:${config.services.mautrix-discord.settings.appservice.port}
+        reverse_proxy localhost:${toString config.services.mautrix-discord.settings.appservice.port}
       '';
     };
   };

machines/hippocampus/servers/public/matrix/server.nix

@@ -30,6 +30,9 @@
           client = "https://glia.club";
           server = "glia.club:443";
         };
+
+        # TODO: Configure more in detail/for safety:
+        url_preview_domain_contains_allowlist = ["*"];
       };
     };
   };

machines/hippocampus/servers/public/nextcloud.nix

@@ -13,7 +13,7 @@ in {
   
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud32;
+    package = pkgs.nextcloud33;
     hostName = "localhost";
     settings = {
       trusted_domains = [
@@ -41,7 +41,7 @@ in {
       objectstore.s3 = {
         enable = true;
         bucket = "nextcloud";
-        autocreate = false;
+        verify_bucket_exists = false;
         key = "nextcloud";
         secretFile = config.sops.secrets."nextcloud/s3secret".path;
         region = "us-east-1";
@@ -78,7 +78,7 @@ in {
       ffmpeg_7-headless
       # required for recognize app
       nodejs_20 # runtime and installation requirement
-      nodejs_20.pkgs.node-pre-gyp # installation requirement
+      node-pre-gyp # installation requirement
       util-linux # runtime requirement for taskset
     ];
   };

machines/hippocampus/servers/public/tandoor.nix

@@ -10,10 +10,12 @@ in {
       SECRET_KEY = config.sops.secrets.tandoor-secret.path;
       DB_ENGINE = "django.db.backends.postgresql";
       POSTGRES_HOST = "127.0.0.1";
-      POSTGRES_PORT = config.services.postgresql.port;
+      POSTGRES_PORT = config.services.postgresql.settings.port;
       POSTGRES_USER = tandoor_user;
       POSTGRES_DB = tandoor_user;
+      MEDIA_ROOT = "/var/lib/tandoor-recipes/media";
       ENABLE_SIGNUP = "1";
+      ALLOWED_HOSTS = "tandoor.syzygial.cc";
     };
   };