flake: add ufo as submodule

.gitmodules

@@ -0,0 +1,6 @@
+[submodule "nixpkgs"]
+	path = nixpkgs
+	url = https://github.com/CHN-beta/nixpkgs.git
+[submodule "packages/ufo"]
+	path = packages/ufo
+	url = https://git.chn.moe/chn/ufo.git

flake.lock

@@ -1161,19 +1161,14 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1767530756,
-        "narHash": "sha256-8Li3OLnzc406/gOe+Sgu0bHoedzibvIJ77bk3/EOMqw=",
-        "owner": "CHN-beta",
-        "repo": "nixpkgs",
-        "rev": "d7f3d87456d890459fac2f3e3723340d60de10bb",
-        "type": "github"
+        "path": "nixpkgs",
+        "type": "path"
       },
       "original": {
-        "owner": "CHN-beta",
-        "ref": "nixos-25.11",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
+        "path": "nixpkgs",
+        "type": "path"
+      },
+      "parent": []
     },
     "nixvirt": {
       "inputs": {
@@ -1496,7 +1491,6 @@
         "sticker": "sticker",
         "stickerpicker": "stickerpicker",
         "tgbot-cpp": "tgbot-cpp",
-        "ufo": "ufo",
         "v-sim": "v-sim",
         "vaspberry": "vaspberry",
         "winapps": "winapps",
@@ -1782,24 +1776,6 @@
         "type": "github"
       }
     },
-    "ufo": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1767597695,
-        "lfs": true,
-        "narHash": "sha256-JNCSBKjslaT4kjMCWCImN1iS9ZRwfCN4GpP7dWECdas=",
-        "ref": "refs/heads/main",
-        "rev": "19736049c9e117c642f3f0a5e81af5cf2a40b392",
-        "revCount": 86,
-        "type": "git",
-        "url": "https://git.chn.moe/chn/ufo.git"
-      },
-      "original": {
-        "lfs": true,
-        "type": "git",
-        "url": "https://git.chn.moe/chn/ufo.git"
-      }
-    },
     "v-sim": {
       "flake": false,
       "locked": {

flake.nix

@@ -3,7 +3,8 @@
 
   inputs =
   {
-    nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-25.11";
+    self.submodules = true;
+    nixpkgs.url = ./nixpkgs;
     nixpkgs-2505.url = "github:CHN-beta/nixpkgs/nixos-25.05";
     nixpkgs-2411.url = "github:CHN-beta/nixpkgs/nixos-24.11";
     nixpkgs-2311.url = "github:CHN-beta/nixpkgs/nixos-23.11";
@@ -53,7 +54,6 @@
     pocketfft = { url = "github:mreineck/pocketfft"; flake = false; };
     blog = { url = "git+https://git.chn.moe/chn/blog-public.git?lfs=1"; flake = false; };
     vaspberry = { url = "github:Infant83/VASPBERRY"; flake = false; };
-    ufo = { url = "git+https://git.chn.moe/chn/ufo.git?lfs=1"; flake = false; };
     stickerpicker = { url = "github:maunium/stickerpicker"; flake = false; };
     fancy-motd = { url = "github:CHN-beta/fancy-motd"; flake = false; };
     mac-style = { url = "github:SergioRibera/s4rchiso-plymouth-theme?lfs=1"; flake = false; };

modules/services/gitea.nix

@@ -57,16 +57,21 @@ inputs:
           "cron.gc_lfs" = { ENABLED = true; SCHEDULE = "@monthly"; NUMBER_TO_CHECK_PER_REPO = 0; };
         };
       };
-      anubis.instances.gitea.settings =
-      {
-        OG_PASSTHROUGH = true;
-        TARGET = "http://127.0.0.1:3002";
-        BIND_NETWORK = "tcp";
-        BIND = "127.0.0.1:3003";
-        WEBMASTER_EMAIL = "chn@chn.moe";
-        SERVE_ROBOTS_TXT = true;
-        METRICS_BIND = "/run/anubis/anubis-gitea/anubis-metrics.sock";
-      };
+      # prevent AI web crawlers
+      # https://her.esy.fun/posts/0031-how-i-protect-my-forgejo-instance-from-ai-web-crawlers/index.html
+      nginx.virtualHosts."https:${gitea.hostname}".locations."/".extraConfigPre =
+      ''
+        if ($http_user_agent ~* "git/|git-lfs/") {
+              set $bypass_cookie 1;
+        }
+        if ($cookie_Yogsototh_opens_the_door = "1") {
+              set $bypass_cookie 1;
+        }
+        if ($bypass_cookie != 1) {
+          add_header Content-Type text/html always;
+          return 418 '<script>document.cookie = "Yogsototh_opens_the_door=1; Path=/;"; window.location.reload();</script>';
+        }
+      '';
     };
     nixos =
     {
@@ -78,7 +83,7 @@ inputs:
       };
       services =
       {
-        nginx.https.${gitea.hostname}.location."/".proxy.upstream = "http://127.0.0.1:3003";
+        nginx.https.${gitea.hostname}.location."/".proxy.upstream = "http://127.0.0.1:3002";
         postgresql.instances.gitea = {};
       };
     };

packages/default.nix

@@ -72,7 +72,7 @@ inputs: rec
   sqlite-orm = inputs.pkgs.callPackage ./sqlite-orm.nix { src = inputs.topInputs.sqlite-orm; };
   mkPnpmPackage = inputs.pkgs.callPackage ./mkPnpmPackage.nix {};
   sbatch-tui = inputs.pkgs.callPackage ./sbatch-tui { inherit biu; };
-  ufo = inputs.pkgs.callPackage inputs.topInputs.ufo { inherit biu matplotplusplus; tbb = inputs.pkgs.tbb_2022; };
+  ufo = inputs.pkgs.callPackage ./ufo { inherit biu matplotplusplus; tbb = inputs.pkgs.tbb_2022; };
   chn-bsub = inputs.pkgs.callPackage ./chn-bsub { inherit biu; };
   py4vasp = inputs.pkgs.python3Packages.callPackage ./py4vasp.nix { src = inputs.topInputs.py4vasp; };
   pocketfft = inputs.pkgs.callPackage ./pocketfft.nix { src = inputs.topInputs.pocketfft; };