modules.system.fileSystems.luks: split

devices/nas/default.nix

@@ -24,7 +24,7 @@ inputs:
               };
             };
           };
-          decrypt.manual =
+          luks.manual =
           {
             enable = true;
             devices =

devices/pc/default.nix

@@ -13,7 +13,7 @@ inputs:
             vfat."/dev/disk/by-uuid/7A60-4232" = "/boot";
             btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
           };
-          decrypt.auto =
+          luks.auto =
           {
             "/dev/disk/by-uuid/4c73288c-bcd8-4a7e-b683-693f9eed2d81" = { mapper = "root1"; ssd = true; };
             "/dev/disk/by-uuid/4be45329-a054-4c20-8965-8c5b7ee6b35d" =

devices/srv1/node0/default.nix

@@ -6,7 +6,6 @@ inputs:
     {
       system =
       {
-        nix = { marches = [ "cascadelake" "broadwell" ]; remote.slave.enable = true; };
         nixpkgs.march = "cascadelake";
         networking.networkd.static =
         {
@@ -17,11 +16,7 @@ inputs:
       };
       services =
       {
-        xray.client =
-        {
-          enable = true;
-          dnsmasq.extraInterfaces = [ "eno146" ];
-        };
+        xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno146" ]; };
         beesd.instances.root = { device = "/"; hashTableSizeMB = 512; threads = 4; };
         wireguard =
         {
@@ -30,33 +25,13 @@ inputs:
           publicKey = "Br+ou+t9M9kMrnNnhTvaZi2oNFRygzebA1NqcHWADWM=";
           wireguardIp = "192.168.83.9";
         };
+        nfs = { root = "/"; exports = "/home"; accessLimit = "192.168.178.0/24"; };
       };
       packages.packages._prebuildPackages =
         [ inputs.topInputs.self.nixosConfigurations.srv1-node1.pkgs.localPackages.vasp.intel ];
     };
-    services.nfs.server =
-    {
-      enable = true;
-      exports = 
-      ''
-        / 192.168.178.0/24(rw,no_root_squash,fsid=0,sync,crossmnt)
-        /home 192.168.178.0/24(rw,no_root_squash,sync,crossmnt)
-      '';
-    };
-    networking =
-    {
-      firewall.allowedTCPPorts = [ 2049 ];
-    };
+    # allow other machine access network by this machine
     systemd.network.networks."10-eno146".networkConfig.IPMasquerade = "both";
-    services.rpcbind.enable = true;
-    fileSystems =
-    {
-      "/nix/share/home" =
-      {
-        device = "/home";
-        options = [ "rbind" ];
-      };
-    };
     # without this, tproxy does not work
     # TODO: why?
     networking.firewall.trustedInterfaces = [ "eno146" ];

devices/srv1/node1/default.nix

@@ -13,24 +13,19 @@ inputs:
           eno2 = { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
         };
         cluster.nodeType = "worker";
-        initrd.sshd.enable = true;
-        nix.remote.slave.enable = true;
       };
       services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
       packages.packages._prebuildPackages =
         [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
     };
-    specialisation =
+    specialisation.no-share-home.configuration =
     {
-      no-share-home.configuration =
+      nixos =
       {
-        nixos =
-        {
-          services.slurm.enable = inputs.lib.mkForce false;
-          system.cluster.nodeType = inputs.lib.mkForce "master";
-        };
-        system.nixos.tags = [ "no-share-home" ];
+        services.slurm.enable = inputs.lib.mkForce false;
+        system.cluster.nodeType = inputs.lib.mkForce "master";
       };
+      system.nixos.tags = [ "no-share-home" ];
     };
     fileSystems = inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType == "worker")
     {
@@ -50,5 +45,7 @@ inputs:
       "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
     };
     services.rpcbind.enable = true;
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
   };
 }

devices/srv1/node2/default.nix

@@ -17,17 +17,14 @@ inputs:
       packages.packages._prebuildPackages =
         [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
     };
-    specialisation =
+    specialisation.no-share-home.configuration =
     {
-      no-share-home.configuration =
+      nixos =
       {
-        nixos =
-        {
-          services.slurm.enable = inputs.lib.mkForce false;
-          system.cluster.nodeType = inputs.lib.mkForce "master";
-        };
-        system.nixos.tags = [ "no-share-home" ];
+        services.slurm.enable = inputs.lib.mkForce false;
+        system.cluster.nodeType = inputs.lib.mkForce "master";
       };
+      system.nixos.tags = [ "no-share-home" ];
     };
     fileSystems = inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType == "worker")
     {
@@ -47,5 +44,7 @@ inputs:
       "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
     };
     services.rpcbind.enable = true;
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
   };
 }

devices/srv1/node3/default.nix

@@ -17,17 +17,14 @@ inputs:
       packages.packages._prebuildPackages =
         [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
     };
-    specialisation =
+    specialisation.no-share-home.configuration =
     {
-      no-share-home.configuration =
+      nixos =
       {
-        nixos =
-        {
-          services.slurm.enable = inputs.lib.mkForce false;
-          system.cluster.nodeType = inputs.lib.mkForce "master";
-        };
-        system.nixos.tags = [ "no-share-home" ];
+        services.slurm.enable = inputs.lib.mkForce false;
+        system.cluster.nodeType = inputs.lib.mkForce "master";
       };
+      system.nixos.tags = [ "no-share-home" ];
     };
     fileSystems = inputs.lib.mkIf (inputs.config.nixos.system.cluster.nodeType == "worker")
     {
@@ -47,5 +44,7 @@ inputs:
       "mount.nfs4" = "${inputs.pkgs.nfs-utils}/bin/mount.nfs4";
     };
     services.rpcbind.enable = true;
+    # make slurm sub process to be able to communicate with the master
+    networking.firewall.trustedInterfaces = [ "eno2" ];
   };
 }

devices/surface/default.nix

@@ -14,7 +14,7 @@ inputs:
             vfat."/dev/disk/by-uuid/4596-D670" = "/boot";
             btrfs."/dev/mapper/root1" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
           };
-          decrypt.auto =
+          luks.auto =
           {
             "/dev/disk/by-uuid/eda0042b-ffd5-47d1-b828-4cf99d744c9f" = { mapper = "root1"; ssd = true; };
             "/dev/disk/by-uuid/41d83848-f3dd-4b2f-946f-de1d2ae1cbd4" = { mapper = "swap"; ssd = true; };

devices/vps4/default.nix

@@ -16,7 +16,7 @@ inputs:
               "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
             };
           };
-          decrypt.manual =
+          luks.manual =
           {
             enable = true;
             devices."/dev/disk/by-uuid/bf7646f9-496c-484e-ada0-30335da57068" = { mapper = "root"; ssd = true; };

devices/vps6/default.nix

@@ -16,7 +16,7 @@ inputs:
               "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
             };
           };
-          decrypt.manual =
+          luks.manual =
           {
             enable = true;
             devices."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };

devices/vps7/default.nix

@@ -16,7 +16,7 @@ inputs:
               "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
             };
           };
-          decrypt.manual =
+          luks.manual =
           {
             enable = true;
             devices."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };

flake/packages.nix

@@ -11,8 +11,16 @@
       openssh = (pkgs.pkgsStatic.openssh.override { withLdns = false; etcDir = null; }).overrideAttrs
         (prev: { doCheck = false; patches = prev.patches ++ [ ../packages/hpcstat/openssh.patch ];});
       duc = pkgs.pkgsStatic.duc.override { enableCairo = false; cairo = null; pango = null; };
+      # pkgsStatic.clangStdenv have a bug
+      # https://github.com/NixOS/nixpkgs/issues/177129
+      biu = pkgs.pkgsStatic.localPackages.biu.override { stdenv = pkgs.pkgsStatic.gcc14Stdenv; };
     in pkgs.pkgsStatic.localPackages.hpcstat.override
-      { inherit openssh duc; standalone = true; version = inputs.self.rev or "dirty"; };
+    {
+      inherit openssh duc biu;
+      standalone = true;
+      version = inputs.self.rev or "dirty";
+      stdenv = pkgs.pkgsStatic.gcc14Stdenv;
+    };
   chn-bsub = pkgs.pkgsStatic.localPackages.chn-bsub;
   blog = pkgs.callPackage inputs.blog { inherit (inputs) hextra; };
 }

modules/packages/firefox.nix

@@ -24,7 +24,8 @@ inputs:
           programs.firefox =
           {
             enable = true;
-            nativeMessagingHosts = with inputs.pkgs; [ plasma-browser-integration uget-integrator firefoxpwa ];
+            nativeMessagingHosts = with inputs.pkgs;
+              [ kdePackages.plasma-browser-integration uget-integrator firefoxpwa ];
             # TODO: use fixed-version of plugins
             policies.DefaultDownloadDirectory = "\${home}/Downloads";
             profiles.default =

modules/services/nfs.nix

@@ -0,0 +1,29 @@
+inputs:
+{
+  options.nixos.services.nfs = let inherit (inputs.lib) mkOption types; in mkOption
+  {
+    type = types.nullOr (types.submodule { options =
+    {
+      root = mkOption { type = types.nonEmptyStr; };
+      exports = mkOption { type = types.listOf types.nonEmptyStr; };
+      accessLimit = mkOption { type = types.nonEmptyStr; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) nfs; in inputs.lib.mkIf (nfs != null)
+  {
+    services =
+    {
+      rpcbind.enable = true;
+      nfs.server =
+      {
+        enable = true;
+        exports = "${nfs.root} ${nfs.accessLimit}(rw,no_root_squash,fsid=0,sync,crossmnt)"
+          + builtins.concatStringsSep "\n" (builtins.map
+            (export: "${export} ${nfs.accessLimit}(rw,no_root_squash,sync,crossmnt)")
+            nfs.exports);
+      };
+    };
+    networking.firewall.allowedTCPPorts = [ 2049 ];
+  };
+}

modules/system/fileSystems/default.nix

@@ -1,5 +1,6 @@
 inputs:
 {
+  imports = inputs.localLib.findModules ./.;
   options.nixos.system.fileSystems = let inherit (inputs.lib) mkOption types; in
   {
     mount =
@@ -9,41 +10,6 @@ inputs:
       # device.subvol = mountPoint;
       btrfs = mkOption { type = types.attrsOf (types.attrsOf types.nonEmptyStr); default = {}; };
     };
-    decrypt =
-    {
-      auto = mkOption
-      {
-        type = types.attrsOf (types.submodule
-        {
-          options =
-          {
-            mapper = mkOption { type = types.nonEmptyStr; };
-            ssd = mkOption { type = types.bool; default = false; };
-            before = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
-          };
-        });
-        default = {};
-      };
-      manual =
-      {
-        enable = mkOption { type = types.bool; default = false; };
-        devices = mkOption
-        {
-          type = types.attrsOf (types.submodule
-          {
-            options =
-            {
-              mapper = mkOption { type = types.nonEmptyStr; };
-              ssd = mkOption { type = types.bool; default = false; };
-            };
-          });
-          default = {};
-        };
-        keyFile = mkOption
-          { type = types.path; default = ./. + "/${inputs.config.nixos.system.networking.hostname}.key"; };
-        delayedMount = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
-      };
-    };
     # generate using: sudo mdadm --examine --scan
     mdadm = mkOption { type = types.nullOr types.lines; default = null; };
     swap = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
@@ -117,87 +83,6 @@ inputs:
           )
           (attrsToList fileSystems.mount.btrfs)));
       }
-      # decrypt.auto
-      (
-        mkIf (fileSystems.decrypt.auto != null)
-        {
-          boot.initrd =
-          {
-            luks.devices = (listToAttrs (map
-              (
-                device:
-                {
-                  name = device.value.mapper;
-                  value =
-                  {
-                    device = device.name;
-                    allowDiscards = device.value.ssd;
-                    bypassWorkqueues = device.value.ssd;
-                    crypttabExtraOpts = [ "fido2-device=auto" "x-initrd.attach" ];
-                  };
-                }
-              )
-              (attrsToList fileSystems.decrypt.auto)));
-            systemd.services =
-              let
-                createService = device:
-                {
-                  name = "systemd-cryptsetup@${device.value.mapper}";
-                  value =
-                  {
-                    before = map (device: "systemd-cryptsetup@${device}.service") device.value.before;
-                    overrideStrategy = "asDropin";
-                  };
-                };
-              in
-                listToAttrs (map createService
-                  (builtins.filter (device: device.value.before != null) (attrsToList fileSystems.decrypt.auto)));
-          };
-        }
-      )
-      # decrypt.manual
-      (
-        mkIf (fileSystems.decrypt.manual.enable)
-        {
-          boot.initrd =
-          {
-            luks.forceLuksSupportInInitrd = true;
-            systemd =
-            {
-              extraBin =
-              {
-                cryptsetup = "${inputs.pkgs.cryptsetup.bin}/bin/cryptsetup";
-                usbip = "${inputs.config.boot.kernelPackages.usbip}/bin/usbip";
-                sed = "${inputs.pkgs.gnused}/bin/sed";
-                awk = "${inputs.pkgs.gawk}/bin/awk";
-                decrypt = inputs.pkgs.writeShellScript "decrypt"
-                ''
-                  modprobe vhci-hcd
-                  busid=$(usbip list -r 127.0.0.1 | head -n4 | tail -n1 | awk '{print $1}' | sed 's/://')
-                  usbip attach -r 127.0.0.1 -b $busid
-                  ${concatStringsSep "\n" (map
-                    (device: ''systemd-cryptsetup attach ${device.value.mapper} ${device.name} "" fido2-device=auto''
-                      + (if device.value.ssd then ",discard" else ""))
-                    (attrsToList fileSystems.decrypt.manual.devices))}
-                '';
-              };
-              services.wait-manual-decrypt =
-              {
-                wantedBy = [ "initrd-root-fs.target" ];
-                before = [ "roll-rootfs.service" ];
-                unitConfig.DefaultDependencies = false;
-                serviceConfig.Type = "oneshot";
-                script = concatStringsSep "\n" (map
-                  (device: "while [ ! -e /dev/mapper/${device.value.mapper} ]; do sleep 1; done")
-                  (attrsToList fileSystems.decrypt.manual.devices));
-              };
-            };
-          };
-          fileSystems = listToAttrs (map
-            (mount: { name = mount; value.options = [ "x-systemd.device-timeout=48h" ]; })
-            fileSystems.decrypt.manual.delayedMount);
-        }
-      )
       # mdadm
       (
         mkIf (fileSystems.mdadm != null)

modules/system/fileSystems/luks/default.nix

@@ -0,0 +1,80 @@
+inputs:
+{
+  options.nixos.system.fileSystems.luks = let inherit (inputs.lib) mkOption types; in
+  {
+    auto = mkOption
+    {
+      type = types.attrsOf (types.submodule { options =
+      {
+        mapper = mkOption { type = types.nonEmptyStr; };
+        ssd = mkOption { type = types.bool; default = false; };
+        before = mkOption { type = types.nullOr (types.listOf types.nonEmptyStr); default = null; };
+      };});
+      default = {};
+    };
+    manual =
+    {
+      enable = mkOption { type = types.bool; default = false; };
+      devices = mkOption
+      {
+        type = types.attrsOf (types.submodule { options =
+        {
+          mapper = mkOption { type = types.nonEmptyStr; };
+          ssd = mkOption { type = types.bool; default = false; };
+        };});
+        default = {};
+      };
+      delayedMount = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
+    };
+  };
+  config = let inherit (inputs.config.nixos.system.fileSystem) luks; in inputs.lib.mkMerge
+  [
+    (inputs.lib.mkIf (luks.auto != null) { boot.initrd =
+    {
+      luks.devices = (builtins.listToAttrs (builtins.map
+        (device:
+        {
+          name = device.value.mapper;
+          value =
+          {
+            device = device.name;
+            allowDiscards = device.value.ssd;
+            bypassWorkqueues = device.value.ssd;
+            crypttabExtraOpts = [ "fido2-device=auto" "x-initrd.attach" ];
+          };
+        })
+        (inputs.localLib.attrsToList luks.auto)));
+      systemd.services = builtins.listToAttrs (builtins.map
+        (device:
+        {
+          name = "systemd-cryptsetup@${device.value.mapper}";
+          value =
+          {
+            before = map (device: "systemd-cryptsetup@${device}.service") device.value.before;
+            overrideStrategy = "asDropin";
+          };
+        })
+        (builtins.filter (device: device.value.before != null) (inputs.localLib.attrsToList luks.auto)));
+    };})
+    (inputs.lib.mkIf luks.manual.enable
+    {
+      boot.initrd =
+      {
+        luks.forceLuksSupportInInitrd = true;
+        systemd.services.wait-manual-decrypt =
+        {
+          wantedBy = [ "initrd-root-fs.target" ];
+          before = [ "roll-rootfs.service" ];
+          unitConfig.DefaultDependencies = false;
+          serviceConfig.Type = "oneshot";
+          script = builtins.concatStringsSep "\n" (builtins.map
+            (device: "while [ ! -e /dev/mapper/${device.value.mapper} ]; do sleep 1; done")
+            (inputs.localLib.attrsToList luks.manual.devices));
+        };
+      };
+      fileSystems = builtins.listToAttrs (builtins.map
+        (mount: { name = mount; value.options = [ "x-systemd.device-timeout=48h" ]; })
+        luks.manual.delayedMount);
+    })
+  ];
+}

modules/user/chn/default.nix

@@ -68,7 +68,8 @@ inputs:
                   (builtins.map (system: builtins.concatStringsSep "\n"
                     [
                       "decrypt-${system.name}() {"
-                      "  key=$(${cat} ${system.value.keyFile} | ${gpg} --decrypt)"
+                      "  key=$(${cat} ${inputs.topInputs.self}/modules/system/fileSystems/luks/${system.name}.key \\"
+                      "    | ${gpg} --decrypt)"
                       (builtins.concatStringsSep "\n" (builtins.map
                         (device: "  echo $key | ${ssh} root@initrd.${system.name}.chn.moe cryptsetup luksOpen "
                           + (if device.value.ssd then "--allow-discards " else "")

packages/biu/test/serialize.cpp

@@ -2,6 +2,7 @@
 
 int main()
 {
+  using namespace biu::literals;
   struct student
   {
     int number;

packages/hpcstat/CMakeLists.txt

@@ -12,10 +12,9 @@ endif()
 
 set(HPCSTAT_VERSION "unknown" CACHE STRING "Version of the hpcstat")
 
-find_package(Boost REQUIRED COMPONENTS headers filesystem)
+find_package(Boost REQUIRED COMPONENTS url)
 find_package(SqliteOrm REQUIRED)
 find_package(nlohmann_json REQUIRED)
-find_package(range-v3 REQUIRED)
 find_package(date REQUIRED)
 find_package(httplib REQUIRED)
 find_package(termcolor REQUIRED)
@@ -27,9 +26,8 @@ add_executable(hpcstat src/main.cpp src/env.cpp src/keys.cpp src/ssh.cpp src/sql
 # target_compile_features(hpcstat PRIVATE cxx_std_26)
 target_compile_options(hpcstat PRIVATE "-std=c++26")
 target_include_directories(hpcstat PRIVATE ${PROJECT_SOURCE_DIR}/include)
-target_link_libraries(hpcstat PRIVATE Boost::headers Boost::filesystem sqlite_orm::sqlite_orm
-  nlohmann_json::nlohmann_json range-v3::range-v3 date::date date::date-tz httplib::httplib
-  termcolor::termcolor biu::biu OpenXLSX::OpenXLSX)
+target_link_libraries(hpcstat PRIVATE Boost::url sqlite_orm::sqlite_orm nlohmann_json::nlohmann_json date::date
+  date::date-tz httplib::httplib termcolor::termcolor biu::biu OpenXLSX::OpenXLSX)
 target_compile_definitions(hpcstat PRIVATE HPCSTAT_VERSION="${HPCSTAT_VERSION}")
 
 install(TARGETS hpcstat RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR})

packages/hpcstat/src/main.cpp

@@ -53,23 +53,20 @@ int main(int argc, const char** argv)
             double percent = disk_stat->Total / 800 * 100;
             auto color = percent > 95 ? termcolor::red<char> :
               percent > 80 ? termcolor::yellow<char> : termcolor::green<char>;
-            auto bgcolor = percent > 95 ? termcolor::on_red<char> :
-              percent > 80 ? termcolor::on_yellow<char> : termcolor::on_green<char>;
-            std::cout
-              << color << "disk usage: " << termcolor::reset
-              << bgcolor << termcolor::white
-                << "{:.1f}% ({:.1f}GB / ~800GB)"_f(percent, disk_stat->Total) << termcolor::reset
-              << color << " (estimated, counted at {})\n"_f(disk_stat->Time) << termcolor::reset;
+            // 设置背景色后有时会难以辨认，因此只设置前景色
+            std::cout << color
+              << "disk usage: {:.1f}% ({:.1f}GB / ~800GB) (estimated, counted at {})\n"_f
+                (percent, disk_stat->Total, disk_stat->Time);
             if (percent > 80)
             {
-              std::cout << color << "Top 3 directories owned by teacher:\n";
+              std::cout << "Top 3 directories owned by teacher:\n";
               for (auto& [name, size] : disk_stat->Teacher | ranges::views::take(3))
                 std::cout << "  {:.1f}GB {}\n"_f(size, name);
-              std::cout << color << "Top 3 directories owned by student:\n";
+              std::cout << "Top 3 directories owned by student:\n";
               for (auto& [name, size] : disk_stat->Student | ranges::views::take(3))
                 std::cout << "  {:.1f}GB {}\n"_f(size, name);
-              std::cout << termcolor::reset;
             }
+            std::cout << termcolor::reset;
           }
         }
       }