test

This reverts commit 789298596b.

.sops.yaml

@@ -4,7 +4,6 @@ keys: # cat /etc/ssh/ssh_host_ed25519_key.pub | ssh-to-age
   - &vps6 age164tyqklwhdm57tfm5u863mdt2xrzrrzac4py8a0j9y6kzqcjy9zsp073t6
   - &vps7 age137x7csalutwvfygvvzpemlsywvdxj3j4z93a50z2sjx03w6zau8q3r5902
   - &nas age19lhcwk37jmvn6z0v4dpdfh0k4u23f76twdjknc0p7atktf37rd7s4t4wj3
-  - &pi3b age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
   - &one age1m7nrxfw22wvp7pj8y9pdl745w95x89uu8dzl9ppsaazweqf2lqms5yshsp
   - &srv1-node0 age1nzetyehldf3gl6pr6mu5d2cv387p8wjqn6wfpll7a3sl8us6n38s0ds633
   - &srv1-node1 age1wj33xt8nj7rhnsenepsf6k3lmq5vk4wn84jwr55qy9cwu05xn5cspg3h7t
@@ -33,11 +32,6 @@ creation_rules:
     - age:
       - *chn
       - *nas
-  - path_regex: devices/pi3b/.*$
-    key_groups:
-    - age:
-      - *chn
-      - *pi3b
   - path_regex: devices/one/.*$
     key_groups:
     - age:

README.md

@@ -0,0 +1,26 @@
+This is my NixOS configuration. I use it to manage:
+* some vps serving some websites and services (misskey, synapse), etc.
+* my laptop (Lenovo R9000P 2023), and my tablet (One Netbook One Mix 4).
+* some cluster for scientific computing (vasp, lammps, etc).
+With the following highlights:
+* All binary is compiled for specific CPU (`-march=xxx`, like that on Gentoo). 
+* All packages and configurations are managed by Nix, as much reproducible as possible.
+
+## Using overlay
+
+An overlay is provided through `outputs.overlays.default`, you could use it in your `configuration.nix` like this:
+
+```nix
+{
+  inputs.chn-nixos.url = "github:CHN-beta/nixos";
+  outputs.nixosConfigurations.my-host = inputs.nixpkgs.lib.nixosSystem
+  {
+    modules = [({pkgs, ...}: { config =
+    {
+      nixpkgs.overlays = [ inputs.chn-nixos.overlays.default ];
+      environment.systemPackages = [ pkgs.localPackages.vasp.intel ];
+    };})];
+  };
+}
+```
+

devices/cross/default.nix

@@ -0,0 +1 @@
+inputs: { imports = inputs.localLib.findModules ./.; }

devices/cross/luks-manual/default.nix

@@ -0,0 +1,22 @@
+inputs:
+let devices =
+{
+  nas =
+  {
+    "/dev/disk/by-uuid/a47f06e1-dc90-40a4-89ea-7c74226a5449".mapper = "root3";
+    "/dev/disk/by-uuid/b3408fb5-68de-405b-9587-5e6fbd459ea2".mapper = "root4";
+    "/dev/disk/by-uuid/a779198f-cce9-4c3d-a64a-9ec45f6f5495" = { mapper = "nix"; ssd = true; };
+  };
+  vps6."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };
+  vps7."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
+};
+in
+{
+  config =
+  {
+    nixos.system.fileSystems.luks.manual =
+      let inherit (inputs.config.nixos.model) hostname;
+      in if devices ? ${hostname} then devices.${hostname} else inputs.lib.mkOptionDefault null;
+    home-manager.users.chn.config.nixos.decrypt = devices;
+  };
+}

devices/cross/wireguard.nix

@@ -0,0 +1,70 @@
+inputs:
+let devices =
+{
+  vps6 =
+  {
+    peers = [ "pc" "nas" "one" "vps7" "srv2-node0" "srv1-node0" ];
+    publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
+    wireguardIp = "192.168.83.1";
+    listenIp = "74.211.99.69";
+    lighthouse = true;
+  };
+  vps7 =
+  {
+    peers = [ "vps6" ];
+    publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
+    wireguardIp = "192.168.83.2";
+    listenIp = "144.126.144.62";
+  };
+  pc =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
+    wireguardIp = "192.168.83.3";
+  };
+  nas =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
+    wireguardIp = "192.168.83.4";
+  };
+  one =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "Hey9V9lleafneEJwTLPaTV11wbzCQF34Cnhr0w2ihDQ=";
+    wireguardIp = "192.168.83.5";
+  };
+  srv2-node0 =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "lNTwQqaR0w/loeG3Fh5qzQevuAVXhKXgiPt6fZoBGFE=";
+    wireguardIp = "192.168.83.7";
+  };
+  srv1-node0 =
+  {
+    peers = [ "vps6" ];
+    behindNat = true;
+    publicKey = "Br+ou+t9M9kMrnNnhTvaZi2oNFRygzebA1NqcHWADWM=";
+    wireguardIp = "192.168.83.9";
+  };
+};
+in
+{
+  config.nixos.services.wireguard = inputs.lib.mkIf (devices ? ${inputs.config.nixos.model.hostname})
+  (
+    let
+      buildConfig = cfg:
+      {
+        inherit (cfg) publicKey wireguardIp;
+        lighthouse = inputs.lib.mkIf (cfg ? lighthouse) cfg.lighthouse;
+        behindNat = inputs.lib.mkIf (cfg ? behindNat) cfg.behindNat;
+        listenIp = inputs.lib.mkIf (cfg ? listenIp) cfg.listenIp;
+      };
+      this = devices.${inputs.config.nixos.model.hostname};
+    in (buildConfig this) // { peers = builtins.map (peer: buildConfig (devices.${peer})) this.peers; }
+  );
+}

devices/nas/default.nix

@@ -24,17 +24,6 @@ inputs:
               };
             };
           };
-          luks.manual =
-          {
-            enable = true;
-            devices =
-            {
-              "/dev/disk/by-uuid/a47f06e1-dc90-40a4-89ea-7c74226a5449".mapper = "root3";
-              "/dev/disk/by-uuid/b3408fb5-68de-405b-9587-5e6fbd459ea2".mapper = "root4";
-              "/dev/disk/by-uuid/a779198f-cce9-4c3d-a64a-9ec45f6f5495" = { mapper = "nix"; ssd = true; };
-            };
-            delayedMount = [ "/" "/nix" ];
-          };
           swap = [ "/nix/swap/swap" ];
           rollingRootfs.waitDevices = [ "/dev/mapper/root4" ];
         };
@@ -46,23 +35,14 @@ inputs:
       hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
       services =
       {
-        snapper.enable = true;
         sshd = {};
         xray.client = { enable = true; dnsmasq.hosts."git.nas.chn.moe" = "127.0.0.1"; };
-        smartd.enable = true;
         beesd.instances =
         {
           root = { device = "/"; hashTableSizeMB = 4096; threads = 4; };
           nix = { device = "/nix"; hashTableSizeMB = 128; };
         };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "xCYRbZEaGloMk7Awr00UR3JcDJy4AzVp4QvGNoyEgFY=";
-          wireguardIp = "192.168.83.4";
-        };
-        misskey.instances.misskey = {};
+        smartd = {};
       };
     };
   };

devices/nas/secrets.yaml

@@ -3,13 +3,7 @@ xray-client:
 acme:
     token: ENC[AES256_GCM,data:OrYgBRU1VPpkpDzYMFHINfPSHsXEKABdZOcgiAiBJKcreBoaSVHUvg==,iv:XIeZPJhzmUi5ZHKBCYN5UA9HWH1K+26SvcIWVrHAYDA=,tag:3F93syLBZjcHwnRRkUEjlw==,type:str]
 wireguard:
-    privateKey: ENC[AES256_GCM,data:VPlB4wSbWqSYw3rYRwfAMa39xrPcPZfz7sV2Cq3rmOhifnUPwggxnA+51do=,iv:utnyrB6Yfe5O94Oq4HDVFm/lQ9ZBoyvUT68r2G2PdwA=,tag:snm01vA+z2yKK8d2i5i2ig==,type:str]
-nginx:
-    maxmind-license: ENC[AES256_GCM,data:ezBawTyn+oPKKy6sQuj2BQXhnO4PTbxYWRpQR9URCxqD7bFlnmWU1Q==,iv:eD4yLDA209x6HFtDaqyj8kRxTImdyZCgOminHWb9vt4=,tag:mx+qPp4L9jHRvL90XH1RwA==,type:str]
-redis:
-    misskey-misskey: ENC[AES256_GCM,data:daHnurnqW0MI2uHd3gNT+ZczmytRdwBSsHGkCwNH9hJFMJW/U56HtjG5ivOQzYprWJ5uzgN98ivocbwzJEAGfg==,iv:aE9kvEErN06FNPPFQNchbmg/+SJCKT3QzCN/JTlZovk=,tag:iMo3MTssxKKT02zi8gCZPA==,type:str]
-postgresql:
-    misskey_misskey: ENC[AES256_GCM,data:QhsmKzYmAV0kGPhtRjTK7npt/Nop5JM9EFPpD8K6KfUJ48w+r+4vTORmERu7D2+fE3XDXxNZeSJg//bGxMmhfg==,iv:qkjkrqepjQ4kbwoaceQSzEP5TjLsiY7ih/ESj5RFpHw=,tag:UtZVW30xcsbGUjU2HjoUvw==,type:str]
+    privateKey: ENC[AES256_GCM,data:H+CDLqfMV5Kcd42LbrU1GpnyJYB1y0bSRBaRR9jNctmlReADRVuvA1y1zLM=,iv:SztfuX+Tm3bO82VfDOjjP2Bmv7IComa1poZfQ48YXVs=,tag:aA35tsgvZQDexSDgD4RjlQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -34,8 +28,8 @@ sops:
             by9Rd0U0bzNiK21BQTNxN1RuQ09DQVkKJmSlzV5ppEkZFljsS17ZWmoI++fz4tJh
             kTdoAStG1zsKASHyZTsmdm3RBDO3qV1KhQC2gC7d4EiwNZngxOOZJg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-05T02:43:05Z"
-    mac: ENC[AES256_GCM,data:NyXFwcVCCRfU+QSJVwov38SzRag1vhgfyQ0xtOheKtK/UaA+2Vqiqatp/lKWeri9ltpw5xWBYQnmE6aBHEkrj5RvoXeho3CUWiSqsB/3COn3FSfXGGJ2M642dnCtWqHfTrGNW7bhq/lBisODvtv+SAs108R5yYXhXWotUs/p+W0=,iv:Wsel2unj5X/dBCwt5sLzHmUIqm9c0uqzzpfnUkxq5cc=,tag:a5/I8GWuUOy4F4lOx9TH+w==,type:str]
+    lastmodified: "2025-01-19T03:04:43Z"
+    mac: ENC[AES256_GCM,data:ns1NlfKruRwlUv4u4J5i/lQmaEo0HVxEWZlauWBFO0AqXxdU9+X+MbufxkqqjbfSryJ3bqBSMdsVUNX87rZGoESWoLLiwLIRuRJTx7jtGppNiHN4LaP95TqliATWZAGZr/xUe2xNUrvgRqSgToT8ah6IxyZblTr1brnUMRTI+Gc=,iv:KbkkbkeJUrgNUmFbqCI2ifk0UDUfPJ80LTRTzaFRA9s=,tag:uKzMN2zURmBzWY4XUnOACg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.2

devices/one/default.nix

@@ -20,24 +20,17 @@ inputs:
           rollingRootfs = {};
         };
         nixpkgs.march = "tigerlake";
-        kernel.variant = "cachyos";
+        # recent kernel make touchscreen not work
+        kernel.variant = "xanmod-lts";
       };
       hardware = { cpus = [ "intel" ]; gpu.type = "intel"; };
       services =
       {
-        snapper.enable = true;
         xray.client.enable = true;
-        smartd.enable = true;
         beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "Hey9V9lleafneEJwTLPaTV11wbzCQF34Cnhr0w2ihDQ=";
-          wireguardIp = "192.168.83.5";
-        };
         sshd = {};
       };
+      virtualization.kvmHost = { enable = true; gui = true; };
       bugs = [ "xmunet" ];
     };
   };

devices/pc/default.nix

@@ -25,35 +25,29 @@ inputs:
           rollingRootfs = {};
         };
         grub.windowsEntries."08D3-10DE" = "Windows";
-        nix =
-        {
-          marches =
-          [
-            "znver2" "znver3" "znver4"
-            # FXSR SAHF XSAVE
-            "sandybridge"
-            # FXSR PREFETCHW RDRND SAHF
-            "silvermont"
-            # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
-            "broadwell"
-            # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
-            "skylake" "cascadelake"
-            # SAHF FXSR XSAVE RDRND LZCNT HLE PREFETCHW SGX MOVDIRI MOVDIR64B AVX512VP2INTERSECT KEYLOCKER
-            "tigerlake"
-            # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
-            # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
-            "alderlake"
-          ];
-        };
-        nixpkgs =
-          { march = "znver4"; cuda = { enable = true; capabilities = [ "8.9" ]; forwardCompat = false; }; };
+        nix.marches =
+        [
+          "znver2" "znver3" "znver4"
+          # FXSR SAHF XSAVE
+          "sandybridge"
+          # FXSR PREFETCHW RDRND SAHF
+          "silvermont"
+          # FXSR HLE LZCNT PREFETCHW RDRND SAHF XSAVE
+          "broadwell"
+          # FXSR HLE LZCNT PREFETCHW RDRND SAHF SGX XSAVE
+          "skylake" "cascadelake"
+          # SAHF FXSR XSAVE RDRND LZCNT HLE PREFETCHW SGX MOVDIRI MOVDIR64B AVX512VP2INTERSECT KEYLOCKER
+          "tigerlake"
+          # AVX-VNNI CLDEMOTE GFNI-SSE HRESET KL LZCNT MOVDIR64B MOVDIRI PCONFIG PREFETCHW PTWRITE RDRND
+          # SERIALIZE SGX WAITPKG WIDEKL XSAVE XSAVEOPT
+          "alderlake"
+        ];
+        nixpkgs = { march = "znver4"; cuda.capabilities = [ "8.9" ]; };
         kernel =
         {
           # TODO: switch to cachyos-lts
-          variant = "cachyos";
+          variant = "xanmod-latest";
           patches = [ "hibernate-progress" ];
-          modules.modprobeConfig =
-            [ "options iwlwifi power_save=0" "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
         };
         sysctl.laptop-mode = 5;
       };
@@ -70,7 +64,6 @@ inputs:
       };
       services =
       {
-        snapper.enable = true;
         samba =
         {
           enable = true;
@@ -111,16 +104,8 @@ inputs:
           };
         };
         nix-serve = { enable = true; hostname = "nix-store.chn.moe"; };
-        smartd.enable = true;
         misskey.instances.misskey.hostname = "xn--qbtm095lrg0bfka60z.chn.moe";
         beesd.instances.root = { device = "/"; hashTableSizeMB = 4096; threads = 4; };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "l1gFSDCeBxyf/BipXNvoEvVvLqPgdil84nmr5q6+EEw=";
-          wireguardIp = "192.168.83.3";
-        };
         gamemode = { enable = true; drmDevice = 0; };
         slurm =
         {
@@ -130,7 +115,7 @@ inputs:
           {
             name = "pc"; address = "127.0.0.1";
             cpu = { cores = 16; threads = 2; };
-            memoryMB = 90112;
+            memoryMB = 80 * 1024;
             gpus."4060" = 1;
           };
           partitions.localhost = [ "pc" ];
@@ -141,7 +126,7 @@ inputs:
         ananicy = {};
         keyd = {};
       };
-      bugs = [ "xmunet" "backlight" "amdpstate" ];
+      bugs = [ "xmunet" "backlight" "amdpstate" "iwlwifi" ];
       packages = { android-studio = {}; mathematica = {}; };
     };
     boot.loader.grub =

devices/pc/secrets/default.yaml

@@ -35,6 +35,11 @@ user:
     zzn: ENC[AES256_GCM,data:xBSve41JclBYQULPN7yV/1Eyo3u+CHAewVetKHwjvl6Te0kk/+aLx6gs8EpOJGmVaiSAdt6F2ayHXUD8RXXpJIOnnEHk88kqbw==,iv:XPxMLvlVtaZvpWnau5Jwlj/5ty5Zyw4F44ix5G64Z84=,tag:uJfWb0PCebdMtxXMfueULQ==,type:str]
 wechat2tg:
     token: ENC[AES256_GCM,data:PrZWR8WiZ7grkpTLqMxwbnkwZttl7n0e1lc1mdHJiFUWq/PqG2wNBC27C58jMg==,iv:02XHhfpN8YPix0REbJDnsBbvCwifbdwBwfuJ2glbvjo=,tag:6aWNqBfwulsjMbl+D6L9vw==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:fqOn2FiLDWZeTUV3hrLIclHTVE0LBDKUW7BK1bRCe0ni5D+hsbM2NdUPWaT4dQ==,iv:j7zQdnz7x7xqVAA882gyCQdjukOLOEvpJ+h5QdS6IP0=,tag:ypeg5xmiqtQ3n+WoF1mNqQ==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:mmofAUxaBCFW,iv:/+bGUlHeNT5WgTtkzxoTFNCE5G+JJcJa6i9Ccbbrf0E=,tag:ax4wPxgSbh+yWd7Gpkapaw==,type:str]
+        hjp: ENC[AES256_GCM,data:T/M4wXMHa8Ko4g==,iv:eGzdteZgYRmIQp3qD79+Mhsvo5e9DL1ezkypnnofL6o=,tag:WjTPnEvU4H4tZG3GccpZrw==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -59,8 +64,8 @@ sops:
             OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
             +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-14T01:12:53Z"
-    mac: ENC[AES256_GCM,data:Ak+LR+PkQG1g9wwlfLtDN2Dm8GdGfbb0qA9Spb3X0LkdCSFLBWqW0Jf88gHB0j/4HszYVaCAUFs+OlTvTjOtboOCTM7tH6z3dd0sU+EMHeK9cPz9kmDlF1LFFhD8dyqytEwq8/xN2MlTmbVoYQvVoGsrD8tP0B9NBPaQiLMPcrQ=,iv:9DthG+HGB3lCxb85YpfitNw2PWYwpdqWTo660gTOUew=,tag:yAH6o3LkGfvKF1UOdgWyyQ==,type:str]
+    lastmodified: "2025-02-25T02:37:11Z"
+    mac: ENC[AES256_GCM,data:JjbAGoJowO96UKmgrEbnovS5T0jko5kqP4jRvG7NwBbxC2l8HETRI6lFgLep9AJYCWj8BK1kPM2FA53RqrACALMl22hjQcQZLnKCI1fHzv8xg112Sw0aP2rT1AouEbVOVqFSsF+Qa6wxVzfoijoqgxnjkBF3c4Dryget2yXEIfY=,iv:R+C1fRI6Wv+w47wZ7Yp03OYX3UQD1eV7wkL9flsZ5eQ=,tag:JnBaUvqbwfBe9Ygl8FkLdQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.2

devices/pi3b/default.nix

@@ -1,42 +0,0 @@
-inputs:
-{
-  config =
-  {
-    nixos =
-    {
-      system =
-      {
-        fileSystems =
-        {
-          mount =
-          {
-            # TODO: reparition
-            vfat."/dev/disk/by-uuid/ABC6-6B3E" = "/boot";
-            btrfs."/dev/disk/by-uuid/c459c6c0-23a6-4ef2-945a-0bfafa9a45b6" =
-              { "/nix/rootfs/current" = "/"; "/nix" = "/nix"; };
-          };
-          swap = [ "/nix/swap/swap" ];
-          rollingRootfs = {};
-        };
-        networking = {};
-        nixpkgs.arch = "aarch64";
-        kernel.variant = "nixos";
-      };
-      services =
-      {
-        # snapper.enable = true;
-        sshd = {};
-        xray.client.enable = true;
-        fail2ban = {};
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "X5SwWQk3JDT8BDxd04PYXTJi5E20mZKP6PplQ+GDnhI=";
-          wireguardIp = "192.168.83.8";
-        };
-        beesd.instances.root = { device = "/"; hashTableSizeMB = 32; };
-      };
-    };
-  };
-}

devices/pi3b/secrets.yaml

@@ -1,33 +0,0 @@
-xray-client:
-    uuid: ENC[AES256_GCM,data:82Xg9VkmkLrKKcZfojA7dHqqMZh45n+eL4T5qZ1z/xy9k0q5,iv:/2j9flBDwjY6JW2mHYo1S2VE+ruu6gxrw8BzSyoiPcc=,tag:iq8wzfIRyq1T18k3vStVGw==,type:str]
-wireguard:
-    privateKey: ENC[AES256_GCM,data:8whySpY/4WPWx2+t7IOgn+qjKCsv+BgRtaAFLrP8L0fV3TJdLob5vwDplHk=,iv:kXTDwOyJNzbjPtlzQqNsXtuk3EXFdF9CAsYkvImbyDE=,tag:tsK9nCMmwEb0c08rJ3Iwyg==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TzU0U2Facm5yWkYrREgw
-            a1Fxc1MxaHYwRWUzUHpsbDBHYVoxb1NKVDAwCjNuUFlabzJ0aWtGMFBQb05nSlRP
-            akwrWDI0QnZBYkFmSUpWZFFnYmQ2aDQKLS0tIGlIQ3lTREN4WXgxV3pNdjdaakF6
-            ZnppV1ZRZzZ5Smt2NGsyRndjTFdnV00KaWVPGLWPnqINH6AHKS/84kuYy/v1v4Tb
-            QdehcMiq5ZF5XLqOX5sMDLu8h96FIklqOSTZNFkzr+s9VYv/UO58rg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1yjgswvexp0x0de0sw4u6hamruzeluxccmx2enxazl6pwhhsr2s9qlxdemq
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyTEZERkRSZUdSN2dySnlI
-            aDFjdXFCWnlJZlpYQmR1WEE2RzdCaVp1WFEwCjd1N1ZpMUExZ0ZBWmFwSHg3RUs4
-            RkRYTjRMWmE5cTA4Z2JJUGgyN05HSmMKLS0tIFpKZmd2Q2k2bnNYK1V2ZnNQNUxH
-            aDU3Vm95ZkpvSTJDMjJEOFY1ZjhrQlUKLdMYiOj6tlzwLpwZsTQVSQ8hHart0ba3
-            NS7+SprzJRb0hQXrvyU6s9zho8dPOw8wiGbscmMXSVS/Kar3eQigmg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-03-28T13:31:33Z"
-    mac: ENC[AES256_GCM,data:fuppF9gFh3O6ZqJRTcVxNqVlz2y5f4xR39JIeInKblh4hNhrdnQg7oh8repoZeXHVRewGeGyxSqzUg+Twy8J+q+d6TSmiDVViD/SHse5rPns2Egt671geF7JmGEB/yKSCbECjGCp0QFgYYEg/vUOaV3v1a0s7LLTE/t2haPIaYc=,iv:f4T7JGxKB3WmEtETuSH7ApKRJ8ptPwZPfspyqc8+vmM=,tag:GF5br+e/p6qHsNCTjfIBCA==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.8.1

devices/srv1/default.nix

@@ -22,9 +22,7 @@ inputs:
       hardware.cpus = [ "intel" ];
       services =
       {
-        snapper.enable = true;
         sshd.passwordAuthentication = true;
-        smartd.enable = true;
         slurm =
         {
           enable = true;
@@ -35,25 +33,25 @@ inputs:
             {
               name = "n0"; address = "192.168.178.1";
               cpu = { sockets = 4; cores = 20; threads = 2; };
-              memoryMB = 122880;
+              memoryMB = 112 * 1024;
             };
             srv1-node1 =
             {
               name = "n1"; address = "192.168.178.2";
               cpu = { sockets = 4; cores = 8; threads = 2; };
-              memoryMB = 30720;
+              memoryMB = 56 * 1024;
             };
             srv1-node2 =
             {
               name = "n2"; address = "192.168.178.3";
               cpu = { sockets = 4; cores = 8; threads = 2; };
-              memoryMB = 61440;
+              memoryMB = 56 * 1024;
             };
             srv1-node3 =
             {
               name = "n3"; address = "192.168.178.4";
               cpu = { sockets = 4; cores = 8; threads = 2; };
-              memoryMB = 38912;
+              memoryMB = 32 * 1024;
             };
           };
           partitions =

devices/srv1/node0/default.nix

@@ -18,14 +18,6 @@ inputs:
       {
         xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno146" ]; };
         beesd.instances.root = { device = "/"; hashTableSizeMB = 512; threads = 4; };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "Br+ou+t9M9kMrnNnhTvaZi2oNFRygzebA1NqcHWADWM=";
-          wireguardIp = "192.168.83.9";
-        };
-        nfs = { root = "/"; exports = [ "/home" ]; accessLimit = "192.168.178.0/24"; };
         xrdp = { enable = true; hostname = [ "srv1.chn.moe" ]; };
         samba =
         {

devices/srv1/node0/secrets/default.yaml

@@ -25,6 +25,11 @@ users:
     GROUPIII-2: ENC[AES256_GCM,data:ifWnLx1YEewdviqHK8fdesM3c1m1T4g6twnz1cGv1yc4jit68pQWLrRMivdsM4tUcyU9GKwCaElVlvh+dgyy8EZQPKCbvJX6GA==,iv:T5FWReeZ0QOkGJiNfrVrUBhAhbXxlFQJKqQV2tzw9AQ=,tag:XClXGZDWGuoGxzPW7ne2Pg==,type:str]
     #ENC[AES256_GCM,data:t8QUVYG4v7fE,iv:N8hDAV7wulPHcfnYTXuZRhb9dQPZqKpfMKK1+ITaZTA=,tag:eKMJDOmqoWWQbv/mm3LaAw==,type:comment]
     GROUPIII-3: ENC[AES256_GCM,data:VlAA+g7SRZyhPSl0Gd1KS7dCwNgRA/o+d8anN88A7E8bSE1ckeTSp+J4YrbbUlLasLhliOZ/nDC0rti+hckGCrjMwweMorSIWg==,iv:7u1yNrN7uxHCF1MsJ2qt1jyQ0ZYYCYKUHwRff50P9oI=,tag:3raCWjdButfmcdy8mH25Jw==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:OVbdcyczH4O7TUsTL0fX3fhx9mL+8QQF3b9SIShmH/gwcJ1jy9WtWtx9wHRvFA==,iv:SX/fLPMkqmslHcRlqQQhqwodC0FHhWrpp6GR2eSF/vQ=,tag:0odoc4CpoI6yA08OWxmYRw==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:3XT6iMfK3+Oi,iv:eqDWPQ0uOj/htImZmLyeYgcjLH4/8E5Yx46XJFp4KUc=,tag:7nVlWPnoLRAH0JrNJ2MGFA==,type:str]
+        hjp: ENC[AES256_GCM,data:JWw/yuOu4flIEg==,iv:i5xr1j9XHjY2UNoBMrpH7YiNb6Oeea7yJAZp+LIYQjQ=,tag:r5Jj2kRPZYpX21xpsVyClg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -49,8 +54,8 @@ sops:
             OThDMWRsWnVTbzRGTTZqSDBkNWZJMlEKdQ/ipO7O5OvaGa81c2P7fi1ncufueSzX
             2njlHHz1gJCtjpktYaVvS6KSYtJoI9oNrF0YN5D/3kKW8TicsSGKaA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-29T06:38:23Z"
-    mac: ENC[AES256_GCM,data:n7MVBKCUW4xpIiVO4ysBqlG89LjzpDBx9GJWQTrSenLWV/YrIGUxA6QDlRg7yhqV9ldF9Q7hDve1KHw7OxKRx5ot5OZiD3Bq3TwJfS2DarJ2vi9oc1J+CXXach8gp3m4C4RkPJ/y1i3jB2nRfSw5Z/TtdPMbvGXlHh+hhriAqxM=,iv:tyBcXMZzgeUOgYJtU1XkptPOlNoFwH+4z6xTD89aKOw=,tag:apXU989ZL+D8WhWKFTdXTg==,type:str]
+    lastmodified: "2025-02-25T02:37:29Z"
+    mac: ENC[AES256_GCM,data:TAfa+s7zakHPggKZmnk6/WdffNi/uS872bv6rO9G+oMh6RsTW0YnqtgswjBsqaZkimYJyYaFmf0UfiuMbCXEmPMjRTBagYJ8i3yG4cmPpskZYtDQj/Xh/XkVulb/2v9WTG8IQ8g1FMrH1J6PkK2meqEG11h+3dI66FtmUD47beY=,iv:bfSElvPF53iotTZaQVflArNJ2FMV8ogySyQtr0Yy0FA=,tag:adL3coofeQGlIY+BUpxtMg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.2

devices/srv1/node1/default.nix

@@ -4,17 +4,13 @@ inputs:
   {
     nixos =
     {
-      model.cluster.nodeType = "worker";
       system =
       {
         nixpkgs.march = "broadwell";
         networking.static.eno2 =
           { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
-        fileSystems.mount.nfs."192.168.178.1:/home" = "/home";
       };
       services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
-      packages.packages._prebuildPackages =
-        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
     };
     specialisation.no-share-home.configuration =
     {

devices/srv1/node2/default.nix

@@ -4,7 +4,6 @@ inputs:
   {
     nixos =
     {
-      model.cluster.nodeType = "worker";
       system =
       {
         nixpkgs.march = "broadwell";
@@ -13,20 +12,14 @@ inputs:
           br0 = { ip = "192.168.1.12"; mask = 24; gateway = "192.168.1.1"; dns = "192.168.1.1"; };
           eno2 = { ip = "192.168.178.3"; mask = 24; };
         };
-        fileSystems.mount =
-        {
-          nfs."192.168.178.1:/home" = "/home";
-          btrfs."/dev/disk/by-partlabel/srv1-node2-nodatacow" =
-            { "/nix/nodatacow" = "/nix/nodatacow"; "/nix/backups" = "/nix/backups"; };
-        };
+        fileSystems.mount.btrfs."/dev/disk/by-partlabel/srv1-node2-nodatacow" =
+          { "/nix/nodatacow" = "/nix/nodatacow"; "/nix/backups" = "/nix/backups"; };
       };
       services =
       {
         xray.client.enable = true;
         beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
       };
-      packages.packages._prebuildPackages =
-        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
       virtualization.kvmHost = { enable = true; gui = true; };
     };
     specialisation.no-share-home.configuration =

devices/srv1/node2/secrets/default.yaml

@@ -0,0 +1,52 @@
+xray-client:
+    uuid: ENC[AES256_GCM,data:U+unsiKt9vNo/EXEpLHR0Ny3DxQEwx7a40KmwZDZki7RQEuM,iv:7w90HNM5lfh2VY20AcUEVdu5X2uxqXxR0hARncmMR60=,tag:xIbKc+9SF5LP/tY/XoGYxA==,type:str]
+users:
+    #ENC[AES256_GCM,data:bAA1+Mx9xsFr,iv:5GWh+DyuRydCKm8K1kaiTJIt4ReEugHFnKYfan6RAE4=,tag:VqcWjIMIYhkSj6f/ZclTVw==,type:comment]
+    xll: ENC[AES256_GCM,data:lqzwlETuKuKa2wh+ickMFiWyprcnIBfRBjri+NWoltxib/LWzEEbyetRc4AKyVaBiDhsOTw6MazPNy2mhcAFwb6pM+QKce5ntA==,iv:VaGQux8MJNPZeHwDpM+yJ47XvOul0qRE8xVdSWjYRhY=,tag:rBWdTPmJX9YsP0l1FtVbJw==,type:str]
+    #ENC[AES256_GCM,data:AgppEXaJcXhQ,iv:gI4nUzfy7w9yqaWlT1NYk1cHdErCJsrlilwYSGxxCdw=,tag:/A6zwbvQdhX9MLfAdXIVqw==,type:comment]
+    zem: ENC[AES256_GCM,data:t0rCwed8EzXbEuwTabzSLUd/Gln3YD9IT56JNVHwlodAvFYwtTDJe3cy7K17TmIkL1Nk/hAGzQ2BIZJxaKq7A5pSNIUO1zqMUQ==,iv:jSKCoNKQ5a91kK19w5mE0lJ9lh391ACq64UtLvJ4kLI=,tag:d6+IrgLyCw05vvLcCF5+yQ==,type:str]
+    #ENC[AES256_GCM,data:s39KO3hHcrOK,iv:ICtP2r9JMjcieHZdyHpj5Z1DympJUcHq2jPpjUwSOzM=,tag:Es3YS+mEg5I3SIujfs50jQ==,type:comment]
+    yjq: ENC[AES256_GCM,data:gOc59J2eiND+qJJRwLYvTymfrjWNRWw8IwLxDdS2cSu0yTN5SWF1eEg+tYmDqqhPmXkIlenL8VyIZD2P+Qi+Vi7l1pZMnneRCw==,iv:TsWOmHlClMgpXbNsCyvs+wkTvvKViAooA36+O4eQesk=,tag:jp5ZO9tlCPNTNZXWXCUEeg==,type:str]
+    #ENC[AES256_GCM,data:JmmZl+8nta5Q,iv:qWGS5i+ntmJ9x3HFClVdfypQKqSTUx827OFu/wxx3HQ=,tag:SzvgJtIQb1Z02GDwkAhveQ==,type:comment]
+    gb: ENC[AES256_GCM,data:pgwGyp/QC+h05grD345pJrJefm4NWd0e6mQEzrsqCbjMi9Ak2nUD+K09mIKQJ39NttC+NQZezRmKUJjDBH50s0O69nBlPOJtgA==,iv:ZLm6KUzD8fTq4YpxhdYjtp7bbDjP7Sy+0fnDO0W5GY0=,tag:H2mNHIQvHe+3YzZ9ITVdOg==,type:str]
+    #ENC[AES256_GCM,data:94hwxSaMkbIB,iv:4Xjukoo7rxeu4SWjwFeLo5fwSX6a8mpkTOIpnOnR/Io=,tag:XOjY6ziyDdMNo53NFSjcJQ==,type:comment]
+    wp: ENC[AES256_GCM,data:9/aVAQskZyQrfhVFVHfpdTWDLdoP2ZO7gG6bNcRpOJEBle3V9XqVSwmLViIIysy4XxoR3cym/7WXB96O3C8feK7sbihaRpT+Dg==,iv:WPnDArVKqV7u3EIQ0CMectK1W6gXKOo37oOybyob3As=,tag:1R/0qjRzif4/sTFSs55NuQ==,type:str]
+    #ENC[AES256_GCM,data:RluXnmnn8CAI,iv:OqzKfed5CARE/KKur0GXDpLBqStEva7YVoQMQX4+FnU=,tag:prOaqWk6ARxEKvnhOnCZhw==,type:comment]
+    hjp: ENC[AES256_GCM,data:Tb9vCi68B88UZc/ZVSxEI+esKOLlFcAPAaMk9FDmkBycZmzDjHfkUKCxVcOMtqeNSluVZ/5IFgowaYbk9ncK6yoYTjXjj1Z0lA==,iv:COs+ijt0h+UygyhWDQV23NRd/xBcfeqz6CO7D+xw7t8=,tag:RaIMaGrgHkidB9vqLR6cNw==,type:str]
+    #ENC[AES256_GCM,data:pymPvP+KjTd2,iv:g5tmBMQevuzES9FVlRten8Vzy5nvgamDNPo6Vy018T4=,tag:sMYZAyyAzEyS5CsAyC7xtw==,type:comment]
+    zzn: ENC[AES256_GCM,data:CJ8cOBjblYIc0GoiPnIbbWfYDfpQW5u31R9T/P0/aVuxi6P44wYYH0posVGthR1laqHIlu8bzgeRyTbBYir/Mw1AGokAnFLEPQ==,iv:dJXFcZ9f3xe3rcPzOLd6AMFh6EyJXlv3/+uR2x9XYsw=,tag:4I1WqtloUSXNeQ6AlVPY5g==,type:str]
+    #ENC[AES256_GCM,data:r1Rl1+lfgMad,iv:9RGwiYlePcXZFDxw5uc1yEwZ4N3lStmE1cGmsj5dPls=,tag:yGChsxZtIzDjMUgIkd+PdA==,type:comment]
+    GROUPIII-1: ENC[AES256_GCM,data:IIZpTdr5jpidbxYCQ+fODOHdoWI51upPI3yxYlrAAd+RE62t6PzAvHKFmKPivbHmQS5RZrJXE7zm9JtwiodRmPl0pYLxYNBpFQ==,iv:WQc1pOungm1gEqYPk/MITbjs1l83ikcys47CARRgoFk=,tag:sS2mXDIWl32ZZzDtictv9g==,type:str]
+    #ENC[AES256_GCM,data:VtrWQKVtCHtA,iv:ap/n2HxQ7dgKOA8rIfenv9LOwwAh1na8+I9O/k/wMxs=,tag:Vl03ortuZ5OS2qcBMnc59g==,type:comment]
+    GROUPIII-2: ENC[AES256_GCM,data:fkxYmHEQnCjx/srKBgjreIR0S7mcXyl1h3H80PFsH3A/yCGnJbFCGK1GW1++Q+tziOnEWCTLZ/l9dlPuB5BFSK7iHiVXtkOfVQ==,iv:z6duWl+LFpS5RJnCGxb3yvgHp96uJYoSsAThWrbGYfg=,tag:AKWisEg506eOgdp/4tLU7g==,type:str]
+    #ENC[AES256_GCM,data:e8HuWaLrvHx5,iv:ZKvfRQtOMV6v3MSCDVoPEsxldI+ZRYJBwrKAD8YZzPc=,tag:tPL3IyjC8f+S+6MoMJSd0A==,type:comment]
+    GROUPIII-3: ENC[AES256_GCM,data:if1S/3AxNLkWvDQJom+4EPRBOpkAPNTkEcqHHLAuEJATSNLlIhVLOPgt10cM4LWx2TdG8V2TcZip9qnr4ABHMsPF5vm6Y53r9Q==,iv:Rba0So8DXJrSC88mjwT8j2AVy84TPm0R6AVf2ZmXNBg=,tag:qiSeYLrw/6QJ7vMiPEZ66A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WlJNWmp2VUxpcXR3NE92
+            TnNuLzg0SVZKdmt1cEVZU2FodXZPdmt6Rm5rClhrbDh3SzFlMU9LVFpEZDFLUGZZ
+            d2RBTVNCamNBWFVEVW9FMjYxcUE4Rm8KLS0tIHBwYjlMU2tnUTZweDBYcmZXUC9l
+            OWFUeE9xdldpTUQ3cDFENjU4YUVwSkUKp7yZGpvKMSm6rvsoPbcaqVznL3wzGEXB
+            OGzrmgY083Gyjb5P/0wPY0ShGMWfWQW6vGchoqVuwr4oHKT3APcrIg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRjBjdGFEMjR6QnQ0a3Nz
+            c2lmVWE0bFh3amRULytZOVhYS3dkL2JmRVhVClVQalh1WjJqcWcxT3ZXMWduN3Nl
+            UzdFNXNQUmtaaTVIVVFVYXkyZEFPUncKLS0tIExrTDA0OEJzQklQOHNJZzBJdzJP
+            MVU1UW9lWFJnSTE2aC9ZL0huYURUK3MK5U4cLWRMm+FFo8ATE/OoAcHzYHFMpOtV
+            Q5kbq5PDMdp4qvoM3T4kLsB34oU55HjFvac0pilOhNRrz4xRMQgvoQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-29T06:38:42Z"
+    mac: ENC[AES256_GCM,data:tb6UXalJcNqd1bCJ4pdWQ5lctAXMrwAJsGagNIjtAklVx/0vibEBTvtVdI3CSNA3OuDguyXc/ECGEqlPNpoRq/F5JINfnirEbaBL6KhNkFxaSLVP7mu1u0KH93qhzA2j4jofderpxj+FvOOMVZNuZkrcSPDoufPA/ypY+YaKuu8=,iv:KPyXi7AD6FSmoZKYUDh2zLZnArvdcHau5XZHk8CbwI4=,tag:7T1jUJ7eNkY9VYt2eP+brg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

devices/srv1/node2/secrets/munge.key

@@ -0,0 +1,24 @@
+{
+	"data": "ENC[AES256_GCM,data:04fSLZEkne1LqLZNYpy1tFlKTVUgQNuX9L3cL66FVHD+LqGAyWJGlAnduY+fQMZdDhbBdeEnJKXjyQ2jdDCttuqbPRiJQChtD7ztf+oiP877N143iSY2G245aCjIrAzmFORkGZaQT7nD5oxgCPiLqJzkNPzgjN4HIDsVoYz6jtw=,iv:gTbiJmdXN/62/t53ddfDrYlNLe3AoujT4G03eFQXyZs=,tag:eAYfhXPERqsVKFSkcm+Abw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBb3JtVi92M2JUc3dKVzRt\na1kzNU8ycE1LTmdVZVNFNDNJZmpsTEdCK3hZCjNXajNpcGxXMDJxRjhPMmhFd2la\nZy8xUFZNZXhiVHFtbG9xVmJ3Q2d0NE0KLS0tIDlNWEJqcSsvQTFzc2FxL2F2bVVs\neS9UenMrYXNKbGJVTnZzN3VscWlrRk0K24RHbcTz56GV6AbQt7Yy9+1NClMpQFtk\nf/NO2RYuS0ciHwkJQEw7M48iJuwTSiv1pflXXkNvkl6/I7wPgS/eXw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSjFQbWd4SUhoOExTdnFk\nd3dVVytZaDAyc1F2eUowdmY0azFKbWJ2Z2pZCnhYQWJtVXVjTTRvTlI4SlVyVHh1\nZlBZTlFheVNKdzN5a0RHM3RkTDhzQncKLS0tIFlpbjRUSzdzS3ZuMW8welNRODdR\nWis0ajQrdUNqVWcwMWF4bVlUaWsrc00KfL/zF2RiAanljrNhRT99i2jPvLySMWXx\nEyzYRuTH8ZGXsX4T2VAPjreBt1ahJ/EgBWmCLibEVK62zWfdquAZKg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2024-09-20T05:31:41Z",
+		"mac": "ENC[AES256_GCM,data:7kp2KNU4O1yuBdu7cxzg8BytPWiP8hQ0/mWVKPPn4BXjFleyo8KzLC3XZn9Ovt2fHWiF/4hMreOPIDW1W+8n/DedLa2G+zkHiQDVBCyiLJ+FCELvNPdDwR37RvOJ0Oo3RtQaSK2xBhNwS2Qs1G7DemEGFrWXrZ/SeCG5H6bI4X4=,iv:zGG9jcC3McICjeYZd1aGud+VaUhLXg3J/demAqM4vUM=,tag:RINzMA36WfaTRuEy0cTQKQ==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.0"
+	}
+}

devices/srv1/node3/default.nix

@@ -4,17 +4,13 @@ inputs:
   {
     nixos =
     {
-      model.cluster.nodeType = "worker";
       system =
       {
         nixpkgs.march = "broadwell";
         networking.static.eno2 =
           { ip = "192.168.178.4"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
-        fileSystems.mount.nfs."192.168.178.1:/home" = "/home";
       };
       services.beesd.instances.root = { device = "/"; hashTableSizeMB = 256; threads = 4; };
-      packages.packages._prebuildPackages =
-        [ inputs.topInputs.self.nixosConfigurations.srv1-node0.config.system.build.toplevel ];
     };
     specialisation.no-share-home.configuration =
     {

devices/srv2/default.nix

@@ -18,29 +18,22 @@ inputs:
           swap = [ "/nix/swap/swap" ];
           rollingRootfs = {};
         };
-        nixpkgs.cuda =
-        {
-          enable = true;
-          capabilities =
-          [
-            # p5000 p400
-            "6.1"
-            # 2080 Ti
-            "7.5"
-            # 3090
-            "8.6"
-            # 4090
-            "8.9"
-          ];
-          forwardCompat = false;
-        };
+        nixpkgs.cuda.capabilities =
+        [
+          # p5000 p400
+          "6.1"
+          # 2080 Ti
+          "7.5"
+          # 3090
+          "8.6"
+          # 4090
+          "8.9"
+        ];
       };
-      hardware.gpu.type = "nvidia";
+      hardware.gpu = { type = "nvidia"; nvidia.open = false; };
       services =
       {
-        snapper.enable = true;
         sshd = { passwordAuthentication = true; groupBanner = true; };
-        smartd.enable = true;
         slurm =
         {
           enable = true;
@@ -51,15 +44,15 @@ inputs:
             {
               name = "n0"; address = "192.168.178.1";
               cpu = { sockets = 2; cores = 22; threads = 2; };
-              memoryMB = 122880;
+              memoryMB = 240 * 1024;
               gpus."4090" = 1;
             };
             srv2-node1 =
             {
               name = "n1"; address = "192.168.178.2";
               cpu = { cores = 16; threads = 2; };
-              memoryMB = 94208;
-              gpus = { "p5000" = 1; "3090" = 1; "4090" = 1; };
+              memoryMB = 80 * 1024;
+              gpus = { "3090" = 1; "4090" = 1; };
             };
           };
           partitions =
@@ -73,15 +66,15 @@ inputs:
           {
             cpuQueues =
             [
-              { name = "n0"; mpiThreads = 8; openmpThreads = 10; }
+              { name = "n0"; mpiThreads = 8; openmpThreads = 5; }
               { name = "n1"; mpiThreads = 3; openmpThreads = 4; }
             ];
-            gpuIds = [ "4090" "3090" "p5000" ];
+            gpuIds = [ "4090" "3090" ];
             gpuPartition = "all";
           };
         };
       };
-      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" ];
+      user.users = [ "chn" "xll" "zem" "yjq" "gb" "wp" "hjp" "wm" "lly" "yxf" "hss" "zzn" ];
     };
   };
 }

devices/srv2/node0/default.nix

@@ -9,36 +9,26 @@ inputs:
       system =
       {
         nixpkgs.march = "skylake";
-        # TODO: configure network
-        # networking.static =
-        # {
-        #   eno145 = { ip = "192.168.1.10"; mask = 24; gateway = "192.168.1.1"; };
-        #   eno146 = { ip = "192.168.178.1"; mask = 24; };
-        # };
+        networking =
+        {
+          static.eno2 = { ip = "192.168.178.1"; mask = 24; };
+          wireless = [ "457的5G" ];
+        };
       };
       services =
       {
-        xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno146" ]; };  # TODO: listen on shared port
-        beesd.instances.root = { device = "/"; hashTableSizeMB = 16384; threads = 4; };
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "lNTwQqaR0w/loeG3Fh5qzQevuAVXhKXgiPt6fZoBGFE=";
-          wireguardIp = "192.168.83.7";
-        };
+        xray.client = { enable = true; dnsmasq.extraInterfaces = [ "eno2" ]; };
+        beesd.instances.root = { device = "/"; hashTableSizeMB = 16384; loadAverage = 8;  };
         xrdp = { enable = true; hostname = [ "srv2.chn.moe" ]; };
         samba = { enable = true; hostsAllowed = ""; shares = { home.path = "/home"; root.path = "/"; }; };
-        nfs = { root = "/"; exports = [ "/home" ]; accessLimit = "192.168.178.0/24"; };
         groupshare = {};
         hpcstat = {};
+        ollama = {};
       };
     };
-    # TODO: these netowrk settings should be changed
     # allow other machine access network by this machine
-    systemd.network.networks."10-eno146".networkConfig.IPMasquerade = "both";
+    systemd.network.networks."10-eno2".networkConfig.IPMasquerade = "both";
     # without this, tproxy does not work
-    # TODO: why?
-    networking.firewall.trustedInterfaces = [ "eno146" ];
+    networking.firewall.trustedInterfaces = [ "eno2" ];
   };
 }

devices/srv2/node0/secrets/default.yaml

@@ -1,26 +1,38 @@
+acme:
+    token: ENC[AES256_GCM,data:Wb7Gons3HCMK5WGIZpG4XrrqZ5G6bymjuKMW6IUjLiK0CIXFz/ARNg==,iv:zc4BgHcc+O7SHQbJkff11fBwgsd+TFtvSEGJ/qrzVo4=,tag:K+Nu9kenTtTnin4+hDCdWA==,type:str]
+nginx:
+    maxmind-license: ENC[AES256_GCM,data:FPVSD8otQMNpbESNEHXCfQjB/zi3OVwZoyLijUtnHQlQzec7KVSiGw==,iv:DkkwCqvRmcFHQIXseh2fycCxZboJMYhHPu67GddenY4=,tag:iHEC8r5GcuB1QcZ5Uf8Skw==,type:str]
 xray-client:
-    uuid: ENC[AES256_GCM,data:U+unsiKt9vNo/EXEpLHR0Ny3DxQEwx7a40KmwZDZki7RQEuM,iv:7w90HNM5lfh2VY20AcUEVdu5X2uxqXxR0hARncmMR60=,tag:xIbKc+9SF5LP/tY/XoGYxA==,type:str]
+    uuid: ENC[AES256_GCM,data:j2R0UtfS/es2A+Ic+Kq6FZJSqXlA/Q8tGkuAIX0ZdTsV4hGk,iv:Ovpr49isIJRdUyM3jxgiT+9Sc+qTF6ZnkKUwxIq6KUs=,tag:2VRSkiPNWaOmCqLJti8Bzw==,type:str]
+wireguard:
+    privateKey: ENC[AES256_GCM,data:0Vw9NVs/Kxc52zUlmeAPFeOG8msdL0YopjhzFKRWhv6+kfb+SFObOP8EJ2M=,iv:KgIZIawbnN+1sIcMjNECkdtujPbg7yQktKVc25SXavI=,tag:b79oZP+GZKmM3OVFshvFhg==,type:str]
 users:
-    #ENC[AES256_GCM,data:bAA1+Mx9xsFr,iv:5GWh+DyuRydCKm8K1kaiTJIt4ReEugHFnKYfan6RAE4=,tag:VqcWjIMIYhkSj6f/ZclTVw==,type:comment]
-    xll: ENC[AES256_GCM,data:lqzwlETuKuKa2wh+ickMFiWyprcnIBfRBjri+NWoltxib/LWzEEbyetRc4AKyVaBiDhsOTw6MazPNy2mhcAFwb6pM+QKce5ntA==,iv:VaGQux8MJNPZeHwDpM+yJ47XvOul0qRE8xVdSWjYRhY=,tag:rBWdTPmJX9YsP0l1FtVbJw==,type:str]
-    #ENC[AES256_GCM,data:AgppEXaJcXhQ,iv:gI4nUzfy7w9yqaWlT1NYk1cHdErCJsrlilwYSGxxCdw=,tag:/A6zwbvQdhX9MLfAdXIVqw==,type:comment]
-    zem: ENC[AES256_GCM,data:t0rCwed8EzXbEuwTabzSLUd/Gln3YD9IT56JNVHwlodAvFYwtTDJe3cy7K17TmIkL1Nk/hAGzQ2BIZJxaKq7A5pSNIUO1zqMUQ==,iv:jSKCoNKQ5a91kK19w5mE0lJ9lh391ACq64UtLvJ4kLI=,tag:d6+IrgLyCw05vvLcCF5+yQ==,type:str]
-    #ENC[AES256_GCM,data:s39KO3hHcrOK,iv:ICtP2r9JMjcieHZdyHpj5Z1DympJUcHq2jPpjUwSOzM=,tag:Es3YS+mEg5I3SIujfs50jQ==,type:comment]
-    yjq: ENC[AES256_GCM,data:gOc59J2eiND+qJJRwLYvTymfrjWNRWw8IwLxDdS2cSu0yTN5SWF1eEg+tYmDqqhPmXkIlenL8VyIZD2P+Qi+Vi7l1pZMnneRCw==,iv:TsWOmHlClMgpXbNsCyvs+wkTvvKViAooA36+O4eQesk=,tag:jp5ZO9tlCPNTNZXWXCUEeg==,type:str]
-    #ENC[AES256_GCM,data:JmmZl+8nta5Q,iv:qWGS5i+ntmJ9x3HFClVdfypQKqSTUx827OFu/wxx3HQ=,tag:SzvgJtIQb1Z02GDwkAhveQ==,type:comment]
-    gb: ENC[AES256_GCM,data:pgwGyp/QC+h05grD345pJrJefm4NWd0e6mQEzrsqCbjMi9Ak2nUD+K09mIKQJ39NttC+NQZezRmKUJjDBH50s0O69nBlPOJtgA==,iv:ZLm6KUzD8fTq4YpxhdYjtp7bbDjP7Sy+0fnDO0W5GY0=,tag:H2mNHIQvHe+3YzZ9ITVdOg==,type:str]
-    #ENC[AES256_GCM,data:94hwxSaMkbIB,iv:4Xjukoo7rxeu4SWjwFeLo5fwSX6a8mpkTOIpnOnR/Io=,tag:XOjY6ziyDdMNo53NFSjcJQ==,type:comment]
-    wp: ENC[AES256_GCM,data:9/aVAQskZyQrfhVFVHfpdTWDLdoP2ZO7gG6bNcRpOJEBle3V9XqVSwmLViIIysy4XxoR3cym/7WXB96O3C8feK7sbihaRpT+Dg==,iv:WPnDArVKqV7u3EIQ0CMectK1W6gXKOo37oOybyob3As=,tag:1R/0qjRzif4/sTFSs55NuQ==,type:str]
-    #ENC[AES256_GCM,data:RluXnmnn8CAI,iv:OqzKfed5CARE/KKur0GXDpLBqStEva7YVoQMQX4+FnU=,tag:prOaqWk6ARxEKvnhOnCZhw==,type:comment]
-    hjp: ENC[AES256_GCM,data:Tb9vCi68B88UZc/ZVSxEI+esKOLlFcAPAaMk9FDmkBycZmzDjHfkUKCxVcOMtqeNSluVZ/5IFgowaYbk9ncK6yoYTjXjj1Z0lA==,iv:COs+ijt0h+UygyhWDQV23NRd/xBcfeqz6CO7D+xw7t8=,tag:RaIMaGrgHkidB9vqLR6cNw==,type:str]
-    #ENC[AES256_GCM,data:pymPvP+KjTd2,iv:g5tmBMQevuzES9FVlRten8Vzy5nvgamDNPo6Vy018T4=,tag:sMYZAyyAzEyS5CsAyC7xtw==,type:comment]
-    zzn: ENC[AES256_GCM,data:CJ8cOBjblYIc0GoiPnIbbWfYDfpQW5u31R9T/P0/aVuxi6P44wYYH0posVGthR1laqHIlu8bzgeRyTbBYir/Mw1AGokAnFLEPQ==,iv:dJXFcZ9f3xe3rcPzOLd6AMFh6EyJXlv3/+uR2x9XYsw=,tag:4I1WqtloUSXNeQ6AlVPY5g==,type:str]
-    #ENC[AES256_GCM,data:r1Rl1+lfgMad,iv:9RGwiYlePcXZFDxw5uc1yEwZ4N3lStmE1cGmsj5dPls=,tag:yGChsxZtIzDjMUgIkd+PdA==,type:comment]
-    GROUPIII-1: ENC[AES256_GCM,data:IIZpTdr5jpidbxYCQ+fODOHdoWI51upPI3yxYlrAAd+RE62t6PzAvHKFmKPivbHmQS5RZrJXE7zm9JtwiodRmPl0pYLxYNBpFQ==,iv:WQc1pOungm1gEqYPk/MITbjs1l83ikcys47CARRgoFk=,tag:sS2mXDIWl32ZZzDtictv9g==,type:str]
-    #ENC[AES256_GCM,data:VtrWQKVtCHtA,iv:ap/n2HxQ7dgKOA8rIfenv9LOwwAh1na8+I9O/k/wMxs=,tag:Vl03ortuZ5OS2qcBMnc59g==,type:comment]
-    GROUPIII-2: ENC[AES256_GCM,data:fkxYmHEQnCjx/srKBgjreIR0S7mcXyl1h3H80PFsH3A/yCGnJbFCGK1GW1++Q+tziOnEWCTLZ/l9dlPuB5BFSK7iHiVXtkOfVQ==,iv:z6duWl+LFpS5RJnCGxb3yvgHp96uJYoSsAThWrbGYfg=,tag:AKWisEg506eOgdp/4tLU7g==,type:str]
-    #ENC[AES256_GCM,data:e8HuWaLrvHx5,iv:ZKvfRQtOMV6v3MSCDVoPEsxldI+ZRYJBwrKAD8YZzPc=,tag:tPL3IyjC8f+S+6MoMJSd0A==,type:comment]
-    GROUPIII-3: ENC[AES256_GCM,data:if1S/3AxNLkWvDQJom+4EPRBOpkAPNTkEcqHHLAuEJATSNLlIhVLOPgt10cM4LWx2TdG8V2TcZip9qnr4ABHMsPF5vm6Y53r9Q==,iv:Rba0So8DXJrSC88mjwT8j2AVy84TPm0R6AVf2ZmXNBg=,tag:qiSeYLrw/6QJ7vMiPEZ66A==,type:str]
+    #ENC[AES256_GCM,data:FP1Mr1TmRI4L,iv:3K4LMbOQPvF1ORWNyaXDoC5MXn3yColR4eKs9sm9y5s=,tag:f3guTegVXw1A6aqolKQnqA==,type:comment]
+    xll: ENC[AES256_GCM,data:CAEd+usnLKoQZ+0PLEiJfbZpz2pyn+I/edC2KbNXBXZPAgT7IDENMnSQyxme899KqRVL4nLrtHs82aA8+kl/dE+QYSTCFVVuHg==,iv:Hs8rb0Iu5Xw74p9/cL2gWfPLh61VaLzIltKUSjRFZjc=,tag:/u5vI0oTMQbNoCEzhcWqOw==,type:str]
+    #ENC[AES256_GCM,data:UIns0CnC/QmJ,iv:Gn4XDPcdTyDLXAgGq7qwayrN206Gx7JsJ3V9G+4bTyA=,tag:FITVs8Tgkiq1XoS8joXM1Q==,type:comment]
+    zem: ENC[AES256_GCM,data:znpGuS8LVxaztnwQlIwu3hykWRBUtQvOsniLaOasXDbw9lHGX8lwwYJuCE+0I14HmiZK/RrrouIwfAfcjZQzPyjJ/SRoOG1Vyg==,iv:YXHX43y99/w9102vhsvFLVOUtJmuRnLVLu+ywfn9URY=,tag:AzsmkXOyX7y/D+ndteuMmA==,type:str]
+    #ENC[AES256_GCM,data:6vMItERptBsX,iv:G0sDjEfLciheMxTZbeLIbWKlimPD1ANIk/VVdhQifXA=,tag:oR9FEdVx6W+0uDeKfb37iw==,type:comment]
+    yjq: ENC[AES256_GCM,data:sGPQ0xALULREnhzl9g/V91M5osMglsSps6R4gYn5OZc/4xVC1phF3qajVN3YMOr7kKgkHbF2Rjm6/2vuK0k1iYZnFswUAmFlmw==,iv:5vG1hn7SlX6HCpas2BgxBSwWqLby8OCxcH3EKNvceIc=,tag:TVwFBAuosKnEOZecq1phXw==,type:str]
+    #ENC[AES256_GCM,data:ALHxkRABA+ll,iv:r1IDiHLFcTdLID3q16zrLTavAwQfddC7bXMKcFZFveI=,tag:4Pd0/Q1BmH4gJjaM4hbqqQ==,type:comment]
+    gb: ENC[AES256_GCM,data:z4CrtdmdLJJ0qZzr7qvihnluJQgjtciX56KdEmtemiRu0llEJk9qz6a23aJ7m40Sfc38elF1/LsvjOuBOC87+BVkKDCj76phag==,iv:WrFVxkr3snmqDXZx5kAYCLp7ixEIzxoT7El3rV7Ovqg=,tag:iExf2Y/HObHQrKMTRvqn7A==,type:str]
+    #ENC[AES256_GCM,data:XfNExliq7noL,iv:K+rFlZHF1oY5rsTzaO0mgxiE1VlKdtPTifAaesg321k=,tag:Dja8NmPWZdJkf/J/96/wAw==,type:comment]
+    wp: ENC[AES256_GCM,data:yjMDez28pJUo6riIHypQQgjGFbuLwy87eG4ek/+Li2w8b4Cm5JckRvs26o+S0blfICc8WqIqEJGakT2wVBE5O1jGfniKn3PhTA==,iv:dOA318XRd2EXxmTIlk6GhlAR/FBpbKkbPJJCXTwFCxM=,tag:9MkXNUuAoplAzE+4eJpr0w==,type:str]
+    #ENC[AES256_GCM,data:YGcTkNCeu3m7,iv:jYmVrfRFwQoX1XxeSzS23wRMAD/AnzYBXQjI76Ke2FE=,tag:WJfSmjdggzPojDcJ6GzP+A==,type:comment]
+    hjp: ENC[AES256_GCM,data:0R5SfBFKuLGurwINnTj31FOrwwfY9bqVS1rG/a0HqIYd+Ui8/2ffFBx0Et+tYIqcxXEJpGbvse43V0naNKmFKlLanfcy9YV/Hg==,iv:mpAUmcVHWWLoreEsG9ha09jxte8mQCLt/A7nm04iX9Y=,tag:bia9pjL0MAcs9vj1gKCVCQ==,type:str]
+    #ENC[AES256_GCM,data:Q3TFPjvcDmKh,iv:eZ1NXGQr9HogxWa46T26WL63nvqho2/KSji8Dgse76o=,tag:iSGPRMCMolp7LVFjJGPotg==,type:comment]
+    lly: ENC[AES256_GCM,data:tP/NtJcMUtZPvuAqoM6KhCMybhsTxKSq4WWW3SBzQ/O0FmUXhECQc5CQnI4J9PlalP7Ug+uUQzeBMnHN84pkKNIeHVJhqjU8Zw==,iv:7TPPuSfXypSRnnhuy8LJSXIB+KB+3vWV0G7AbCZpB6s=,tag:iSLgRxOHgUolByFyvwltNQ==,type:str]
+mariadb:
+    slurm: ENC[AES256_GCM,data:9wLQ1zF/kDaiw0s3UaRpiHgmngU7u6hwyqpddSjev0+Z0v58Q2oiJtK8vn+2VlSxx5ACfqEFbzp0PZYAxd575w==,iv:q9JTkgDymOwkbZ/PaxRAAQrtO96QmGgZcQuLTFCMoS4=,tag:dwOHlOTgZqT/1jQ+oGf7UQ==,type:str]
+hpcstat:
+    key: ENC[AES256_GCM,data:+Z7MRDkLLdUqDwMrkafFKkBjeCkw+zgRoAoiVEwrr+LY0uMeW8nNYoaYrfz6Ig8CMCDgX3n/DMb0ibUeN32j3HShQIStbtUxRPGpQMyH+ealbvgskGriTFpST4VPyQxNACkUpq/e+sh2CmLbKkSxhamkjKOXwsfqrBlgVbEkp7u7HkWGuAaYL1oPGt0Q94fWXwH0UVhRYZYQ2iFA/S6SEZY8gxaTIGDKUdWU9+fOHzPQ5WfhxtKYU4p4ydyfYsAt6ffqnPSx/SI72GsUCOJ4981JX8TuvnEzx3gQLVFYheK6NibTWCy6eODbvguieVOTHSvCPTrHmoP12lHVWU2kKzLwv70Jl7sXyzKHYROG0D+/z/4DKlNeotKM/IA0q2cST08/lwSKN7WDDmrt+O6xXhvwby28ZYKEsSvvrfV+VIKzHPl84ZKbUEX5xv/GHc3THfznUvKKz5PzDiqrkjCkEt5PRMsVW9A6MU1+QEUr+sXLLtcUd2CCL87c8CpwNHJx1us6vJ4ji1gu0PGoT+60,iv:yU6j9W2Hs2D34uHMJqqPFbNy2pNEZY2kzXoNdhPMSmA=,tag:TNvEfMVrhu7HrNxY8qe5mg==,type:str]
+telegram:
+    token: ENC[AES256_GCM,data:dCDqQhNiuIGJAdbun2uwCBV1smrpvKvwi5AGOs+QWK0ANNVBoSHuUNPeNH2Ivg==,iv:Vcp/OPW8IRPHlqumPxYAfVLtZbdG3rB8VeXM34xBYSk=,tag:vKMihlMdwrPY0XKErtgwIA==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:NoWnuxCZGkQx,iv:9eSyerth1oOTWJFdOeB1zL2QrXoPv+X2LTUDQZuxdkg=,tag:Ep66od22bQffeL41ff5a2w==,type:str]
+        hjp: ENC[AES256_GCM,data:+a6dMGEnrX5Dug==,iv:2l8TbmBNOB7nRfh9UoQi0S6CMRIYFeab6P3+8V8pwW0=,tag:AK4Rtu3N0o7Rqy0sjNe0EQ==,type:str]
+wireless:
+    #ENC[AES256_GCM,data:xrg3Wxj/ghbWgg==,iv:6stu7voI5no2Y3YmnMrvTS8hev3eqjoWAyD5zTgyehc=,tag:cxkS7y7S1oM+/SJmlT10fw==,type:comment]
+    457的5G: ENC[AES256_GCM,data:QjHlyGU4JIYymyh41T+c33T3EOpbqDOoD3U+v6/BzjlWLLeZQXU2hwPCVh4fi2bwn7yNkp4ygAYmFPVPZWoT1A==,iv:Tc6Guzsn5hkjWH6UWSb1KlfWCBXIi2OWdn/wttmCXnQ=,tag:FhyH6JmjSTuqSeFy+GyQhg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -30,23 +42,23 @@ sops:
         - recipient: age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3WlJNWmp2VUxpcXR3NE92
-            TnNuLzg0SVZKdmt1cEVZU2FodXZPdmt6Rm5rClhrbDh3SzFlMU9LVFpEZDFLUGZZ
-            d2RBTVNCamNBWFVEVW9FMjYxcUE4Rm8KLS0tIHBwYjlMU2tnUTZweDBYcmZXUC9l
-            OWFUeE9xdldpTUQ3cDFENjU4YUVwSkUKp7yZGpvKMSm6rvsoPbcaqVznL3wzGEXB
-            OGzrmgY083Gyjb5P/0wPY0ShGMWfWQW6vGchoqVuwr4oHKT3APcrIg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0Rmc2Ull1WFB4Smh3c0Zl
+            emlTNGJKZkpIK2JFeUNVeUcrR2FzRXRQZHlvCkhzMHpzYmZRZ0M0cXdRVi8wZmp6
+            ZDRZQ2FkOWt6M0lrdjBHa3VTWXBDKzgKLS0tIGtJbTRRelg1VVk2QStwdzlFM1g4
+            M1JOd1g3cVdjUFRhZ0FxcWphZXZJbkkKFXDtJVoi+qIrXp6cznevuZ+peBiRRITP
+            rrplqLiYsNIGKmKYtRIUu8WXDZ2q2CJ8Z+pka3W3H/U+m957hBDWyw==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy
+        - recipient: age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWRjBjdGFEMjR6QnQ0a3Nz
-            c2lmVWE0bFh3amRULytZOVhYS3dkL2JmRVhVClVQalh1WjJqcWcxT3ZXMWduN3Nl
-            UzdFNXNQUmtaaTVIVVFVYXkyZEFPUncKLS0tIExrTDA0OEJzQklQOHNJZzBJdzJP
-            MVU1UW9lWFJnSTE2aC9ZL0huYURUK3MK5U4cLWRMm+FFo8ATE/OoAcHzYHFMpOtV
-            Q5kbq5PDMdp4qvoM3T4kLsB34oU55HjFvac0pilOhNRrz4xRMQgvoQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsSHdka3FPQUYrcXQzcTFo
+            a000TUllT0MvUzk5ZzVFbXZheG9ZVTM2S253CkE5VW9tQktvL2pMWFoxcnFjTGpr
+            Z0p1RjZWRGpSZ01TdTZRcEJXM2NOUkUKLS0tIC9rNmNzWitMdEd5dXQvdWlELzhM
+            M0xoL1dQR0kvMWpzN0RMNWVCTFQxNFUKj9LPjBo5NGOrGYNvu8qZ13PLYjLEWllU
+            LARzEn4XgkeHckouwvxZYMCx7WxmAruRWaOvnxTIczzSNP7wIrqnkA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-09-29T06:38:42Z"
-    mac: ENC[AES256_GCM,data:tb6UXalJcNqd1bCJ4pdWQ5lctAXMrwAJsGagNIjtAklVx/0vibEBTvtVdI3CSNA3OuDguyXc/ECGEqlPNpoRq/F5JINfnirEbaBL6KhNkFxaSLVP7mu1u0KH93qhzA2j4jofderpxj+FvOOMVZNuZkrcSPDoufPA/ypY+YaKuu8=,iv:KPyXi7AD6FSmoZKYUDh2zLZnArvdcHau5XZHk8CbwI4=,tag:7T1jUJ7eNkY9VYt2eP+brg==,type:str]
+    lastmodified: "2025-02-25T02:36:44Z"
+    mac: ENC[AES256_GCM,data:VF48FNkamR6RPowHxQxlgRNQZqCGbHvO5d1mk3Tj0WW99wMFIo4wrH4i000lGlUGXWhuPlYcxHtDzP6/984fBKYvHg1Q0a/x1cXB812lvWNhDQZwpIG8lvr2AQyKYYYFMcpgxk8GZFRd4eY7evlVIfW2gqyUZflRbZzTmKCa2f4=,iv:ndLQpwtO6rPNuQdBU/MSTtVderU9H14jTJs0vClQl4A=,tag:h4lQ8JYVBoxhO9S+ncpVxQ==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.2

devices/srv2/node0/secrets/munge.key

@@ -1,5 +1,5 @@
 {
-	"data": "ENC[AES256_GCM,data:04fSLZEkne1LqLZNYpy1tFlKTVUgQNuX9L3cL66FVHD+LqGAyWJGlAnduY+fQMZdDhbBdeEnJKXjyQ2jdDCttuqbPRiJQChtD7ztf+oiP877N143iSY2G245aCjIrAzmFORkGZaQT7nD5oxgCPiLqJzkNPzgjN4HIDsVoYz6jtw=,iv:gTbiJmdXN/62/t53ddfDrYlNLe3AoujT4G03eFQXyZs=,tag:eAYfhXPERqsVKFSkcm+Abw==,type:str]",
+	"data": "ENC[AES256_GCM,data:Um00c+kry3QrHEZVdlUws+gGGvtPKh8WzkpT6CHL7uwHRUWc+5E0bvlwXFJTkmPdGOOV2Jx9fGvSKpQb1/MPJhMhpCAw5n69QIRjVVURZcvVVFrl+eNO2sf/h2GTFvKRAtlcNAh7cvjkpiB3r+S7mRYSI914B7w8GLTdRFvtqYo=,iv:gk7S1SiA0iBAfpXLhhPJuexolP6w1XAd8M2H+sqqmoM=,tag:O8Eoa4LjEo14H/+1W5rcgQ==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -8,17 +8,17 @@
 		"age": [
 			{
 				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBBb3JtVi92M2JUc3dKVzRt\na1kzNU8ycE1LTmdVZVNFNDNJZmpsTEdCK3hZCjNXajNpcGxXMDJxRjhPMmhFd2la\nZy8xUFZNZXhiVHFtbG9xVmJ3Q2d0NE0KLS0tIDlNWEJqcSsvQTFzc2FxL2F2bVVs\neS9UenMrYXNKbGJVTnZzN3VscWlrRk0K24RHbcTz56GV6AbQt7Yy9+1NClMpQFtk\nf/NO2RYuS0ciHwkJQEw7M48iJuwTSiv1pflXXkNvkl6/I7wPgS/eXw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWYmNFOFlnbm1FdXdGWUNr\nOGN3THhDUyt4SDVzcHY5dEYrSWsrQm1UOFJvCmhXaWFlcC8wazROaXZzcm9tUnFM\nQlphZ0x6c0RhbzY0aGVFbXdOa1BHbG8KLS0tIHF2YUNTVnZ3Z25FSnFlTEdmdXhE\nb3Z2UEp1c2UrOUp3NEdNcE5HSFptbzAKWGSTwv6xUNs/f+p0Bhpzg8zZ7EVK8kMm\no13fru2Cnqrw8Cj0zfx+7LODpBVzo03fLYKqZ6kbPZGa12ihk+fD4g==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
-				"recipient": "age16e7ykphshal6qhwfvat698hl48s8yr0jvzh27ecdyfh5uk7t9u6s753jgy",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxSjFQbWd4SUhoOExTdnFk\nd3dVVytZaDAyc1F2eUowdmY0azFKbWJ2Z2pZCnhYQWJtVXVjTTRvTlI4SlVyVHh1\nZlBZTlFheVNKdzN5a0RHM3RkTDhzQncKLS0tIFlpbjRUSzdzS3ZuMW8welNRODdR\nWis0ajQrdUNqVWcwMWF4bVlUaWsrc00KfL/zF2RiAanljrNhRT99i2jPvLySMWXx\nEyzYRuTH8ZGXsX4T2VAPjreBt1ahJ/EgBWmCLibEVK62zWfdquAZKg==\n-----END AGE ENCRYPTED FILE-----\n"
+				"recipient": "age1l4stuz0vr7gs7pqwjrmezam44702jp2vmqaqyxw0l0r42kf9updq4dfhrw",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKRVMrenM2Q1ZheFVPc2Rz\nYVd6UGoxbkpSQlZsNFN1dmIzSkl6SERwaTBRCjlHV3MvTEpxbDY4OHZjeUd5NmRF\nRmc1NzVCMTA0bDhwajNlMWZKTlNKK2cKLS0tIHRZZ0cxY2dwV21iRDlmeE5UZkM4\nK1dKV24yY3FKV2J3U2VzZWt2QnBSTHcKn8mq+1RnJG/nBbH2mAFpSFSTHDWvMqJj\nsziW9lK0cH6bPxhcpDO4oG8K08bdGHUVGtx2Zk81CDqzfamlMzzG2Q==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2024-09-20T05:31:41Z",
-		"mac": "ENC[AES256_GCM,data:7kp2KNU4O1yuBdu7cxzg8BytPWiP8hQ0/mWVKPPn4BXjFleyo8KzLC3XZn9Ovt2fHWiF/4hMreOPIDW1W+8n/DedLa2G+zkHiQDVBCyiLJ+FCELvNPdDwR37RvOJ0Oo3RtQaSK2xBhNwS2Qs1G7DemEGFrWXrZ/SeCG5H6bI4X4=,iv:zGG9jcC3McICjeYZd1aGud+VaUhLXg3J/demAqM4vUM=,tag:RINzMA36WfaTRuEy0cTQKQ==,type:str]",
+		"lastmodified": "2024-03-09T07:59:38Z",
+		"mac": "ENC[AES256_GCM,data:zNh6Cioh4+r0+nx04yLqeQShozxl7bLLKSmwodnmHtVQVlOTjj5sDLMEAAmrj1Ym2KrBPJOgdm34Sl6AbsmiBLxzDcBKe6J68Y/LHIeaPkToRKpmoy9I9a177w0KzFXgNaU2ieH71egD+nf8JmGG61hDjpiJRpx1Lwxb16Bn+Xs=,iv:QxiUYymiGuH0EBwEhyg5gDzkSKvGhq0+0wERNEJ71UM=,tag:N1Nn9X9vrghwwJWC3kituA==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.0"
+		"version": "3.8.1"
 	}
 }

devices/srv2/node1/default.nix

@@ -4,15 +4,12 @@ inputs:
   {
     nixos =
     {
-      model.cluster.nodeType = "worker";
       hardware.cpus = [ "amd" ];
       system =
       {
         nixpkgs.march = "znver3";
-        # TODO: network
-        # networking.static.eno2 =
-        #   { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
-        fileSystems.mount.nfs."192.168.178.1:/home" = "/home";
+        networking.static.enp58s0 =
+          { ip = "192.168.178.2"; mask = 24; gateway = "192.168.178.1"; dns = "192.168.178.1"; };
       };
       services.beesd.instances.root = { device = "/"; hashTableSizeMB = 512; };
     };
@@ -22,9 +19,8 @@ inputs:
       nixos.system.fileSystems.mount.nfs = inputs.lib.mkForce null;
       system.nixos.tags = [ "no-share-home" ];
     };
-    # TODO: network
-    # boot.initrd.systemd.network.networks."10-eno2" = inputs.config.systemd.network.networks."10-eno2";
+    boot.initrd.systemd.network.networks."10-enp58s0" = inputs.config.systemd.network.networks."10-enp58s0";
     # make slurm sub process to be able to communicate with the master
-    # networking.firewall.trustedInterfaces = [ "eno2" ];
+    networking.firewall.trustedInterfaces = [ "enp58s0" ];
   };
 }

devices/srv2/node1/secrets/default.yaml

@@ -23,13 +23,6 @@ users:
     zzn: ENC[AES256_GCM,data:/CSffToFJiBotXZ5rPkz0UNgI/iC0ftusPF2Ce6Of3XckjpCcikWj6n3ahJ24XsWQjp3EvacOiBorh+Kg16LjCEl0P2RMIitTQ==,iv:u9IFdp/jw7ehTshPzQVssLeh33iBYCPjSyJSLsc5EVo=,tag:/KXgmU7dcTKG8C4Y7NcMhw==,type:str]
     #ENC[AES256_GCM,data:TN/ycWtGSCNY,iv:pSilXx4zKs53XX/L0+QFbwv13rutQG11sU0EgVhaJEA=,tag:L+MpcYYlsMnSpS1JQdnwIQ==,type:comment]
     lly: ENC[AES256_GCM,data:XkRaNI0SqooptH/OexBCzZ4RYvA3s7qXbpCtLVidJ4pZU/o7EHlIcvMbeRxqdujhXNQ+vbS3o7CmhwJK2JVVPCCVsd6k0gMDdw==,iv:v/2mgDuR+/lb8mtyv6sn4Z9XXnuDoXkT0DeNQ7850fU=,tag:T8xxo9C7kFSNlLDjEaZK0Q==,type:str]
-mariadb:
-    slurm: ENC[AES256_GCM,data:qQMD8SKNmxb3PdScXNqppF9zkX7dV5i7rvljvZuhiI5zLnu77qYCHBW6ymh0mrY14N9NjxmQZhZWX/H8TvBlcg==,iv:J5N3LjCYW3QmuEkMBpl7qvPFW1Z9ZoPLkj45jKcIW9U=,tag:Tl+ld07+lVkmzt7f/f2MqQ==,type:str]
-hpcstat:
-    key: ENC[AES256_GCM,data:POK329h/joF7WdSBwSE1EkYH/pZ9X+wiTKcVWLZjmh7gM9d7HONbN/PqsYNFTHJVR0GgysqpLEcPN2OFGs/SSeH86o04cAdjAVznKZgt1Q34QGYy6b+io15P3lbmK0kTKmeGt5qEhGkBh6BVBoSyqbKAknvUqJ17ZkL17kyRaKffm3Zais7keEJCFdyRF6oSz2kl2CvEmKNWPWDdO9EpgqgYlm9mwu95/k9Hx5eyUjiFpxc3fdFTESGbe0ZYAqKQ0eLFfLLorQp0pAzxCbbxIzZEgyxjzkICXKa1n7Zz6h1ON2Rsqq0Q4hEYJdWGLtvOH/VLVxvNWjW4Er6i3lWGhZRiDDrxLErQGONI+X7QqbneFCnMCZGln3pAfNtOr+KX58ij/egyzmb7bKZrARqnm+X+/I/L0+VS1PfDdLP53GaX7mfKYpcH6z7O2F/zjpuXQTV8njs64YlvgyYXsCaghEUBzehsruwRsBEkTIb4R2AlqItpbesMnNNUJ4Cr/B7Bw6O+gHeJ+oK4ZPBYbgso,iv:B2eWjydl8m8nbcPw2fZfxCnj57utWM9ABj2eJ1pRKWQ=,tag:5W9ZwVSJvm1KvZnf/E5Tug==,type:str]
-telegram:
-    token: ENC[AES256_GCM,data:Mu7guAFUu+UoHvo/h1blcI6Kg3mvng6zNc/HKXuCdf73ujziK0mXwPcf7t7d/w==,iv:BkA4d0OJ4lTD7csZJQHcDnYe7SYcFbwRVYOQAWOQ2lQ=,tag:GuJ4z5pe2znTY3xNT2WF+w==,type:str]
-    chat: ENC[AES256_GCM,data:OC8ElUPmfsVL,iv:WgZMJP2ugZbqZyihdNtL1xMH8u9VpLNzO8DGpDL4w4k=,tag:u4cKABikuMUbCIm5zCnk6A==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -54,8 +47,8 @@ sops:
             ZDNHUjE2QVlCV3p0NHdKYW5IMHVBZzQKkZtfyvfroOntg3yRjMw4jQHiQj8eaB2h
             IeIHfW4y01mmVT2ofbtB0xYpjcl4gtUlQ8X3tn5iJ9P8gcVo0G598A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-10-26T12:26:52Z"
-    mac: ENC[AES256_GCM,data:TiF/QAh6Y8Xn+3B1rlg+FvZFJ4fGP+szvvopbiEzO6AWBYp8dcD6MmaZstVzJL1BrRIQ3GENcq7EVyfZMWQlW8aRsVF/RrWOSpAKI1tiWDl+10Ov3zjr+Q8sFYTfblWXYH7Tq9pcWBChj1Kj88Ri5xRRfJTuelQoL0igHQBwfFM=,iv:ikzexH8P3CYu7SrRXwWd1Ar3+PEXSSjSVj5E3jwcZyQ=,tag:i5/F33/KcDJVQ4ceYtRErQ==,type:str]
+    lastmodified: "2025-01-11T12:43:41Z"
+    mac: ENC[AES256_GCM,data:exCwRlOqvMRvqStZfI0P1nXE9KX0GxVGhPD4PEkDXhm35CtFXJj6toZyJqHUt9XrrlW6NHzXbQszeHV0/EmdItJK3HupRMopetBTSBmkH3FpuCrD8QZ4Ukm60ZQq1YiAlgE+HqOGhz+eYvUI9WPwci05Hi3Ea/a7ASsE3UWyc9Q=,iv:BX26ZpZGVsYUkZu//hD1Go18T+UWpGCChHFGFMUHmJE=,tag:0RvkrXGBc1ZN3MqaNHOHGA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.2

devices/srv2/node1/secrets/munge.key

@@ -1,5 +1,5 @@
 {
-	"data": "ENC[AES256_GCM,data:YOWJQ16lYMKebzSyCcJ+N8x1iqD9Ml1cm07sTwSe0dE/OHtAyhasJ9qbg8wBhhtm0fjl5S5cNh6KxqGzb/0BSfMPIhii72gBdnPgjSWyVFatKM3Egqn4dUk96RlbUMWvPzWMGmleUGedWu7gUIHP2kgbfl94Whqpe1ozgb7qoxg=,iv:R+TguIqtcXQXiAL/vVgkZAWCCdvAV9rYwaTTszgDqE4=,tag:MlAcThDJjCglpJhK2HIjxg==,type:str]",
+	"data": "ENC[AES256_GCM,data:fkOaCmCk6e8KTUq9zvhYPL6o24Vcja909NoKl7CIy+8H1D2bX31JEa42D0CfLFxvkA/kVcUehVbwL9Ax0ufBa33O73VrTggU9u4qolgpjmibIINXlQrl1MtEQu66MHpq971czzTCACGHz27/cUCUU2wBZWCCv9Zyk22OJgzDgYs=,iv:cDAcl4w4MKERttP4Bv7TZ701jSHVMquSqj6HqyyQ1sU=,tag:aSm/gR7zWYMZN8Iu6VEf6w==,type:str]",
 	"sops": {
 		"kms": null,
 		"gcp_kms": null,
@@ -8,15 +8,15 @@
 		"age": [
 			{
 				"recipient": "age19ax6vm3pv8rph5tq3mmehd9sy9jk823tw8svsd790r0lkslycquqvlwz9m",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOMnJ4TVkyWGtmeTZvZk1h\ndnZKU1FyM1lsYktKZnRhekR3bm9PMXphV1FvCjhOY21iV3g2SXVTL0FLQUhFa0Ni\nYnJsenZldUk4anRvbStlemZzQUx2RUUKLS0tIGFVanY3QzRzV0REdUYxbnBtS1My\nemtCdG9tMUhuTkFDalRNMzJaVEZHOVUK3sfaYjScNEyJnuwTKtIlzJzNqf4dz6ea\nmgtijiKjFl7LVo08XRKz7Ry0/s5nawrh0yT64MGOoz+zT3Lu5BPRpw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVTnkwcE9RWHdrOEdyaW8v\nbUxiQ0pmcW1ha1E3ZkRmaWpqYWFXUm5NVVZRCkVHT2xhbnQ2MkFiczdPRktaRTlI\nT0lhcDdOd2hoeHZMM1RnVWdiUHpoZ1UKLS0tIGxZaDdMNW5LNU9DWkt1ZHJlQ3M1\nTi9GaFEyMFFYLzFyL05kaEVQTDB6Vk0KUlNgX2N8n9NsLJuFflkH92EbxnMp37dg\nArhpRuUXscHZ62Z9eR3cgXwfFTAYzYBhL0M6uE/jwfDEV3jw9fNyaQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			},
 			{
 				"recipient": "age1hnarptkze0ujpp05dqr8uma04cxg9zqcx68qgpks5uf5l6rpk5gqhh8wxg",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCNTVLQTVwUkNucjNVMVht\nQ0wyaWFMc2c5NGlQZHl6REQya2NYM3pXeEFvCm9JWmM0Zkg1V0JzSlJGMUNOdmJ3\nTFBSSVFNSzRMaDFlV082dTAwbEg1eHMKLS0tIG1PL3ZHNFljdXAzNGZVTU5CL2Z0\nSFJmbitSaTZtY05OQ2xmVStubnAyMmMKJKwjJLyQKk0l24vRYuN8Qa8mksOkMrOc\nFUKcJjJ4faucBAPLohHFVrbzfDLu4BhIN3mCXKSydKCaRqXlz57FHw==\n-----END AGE ENCRYPTED FILE-----\n"
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwTjcvWVcxSWRVdHp3amtj\nVk54dTdRZUdXaGFuUTRLNVk2Uk5xWkx6WlRFCkxHUlhoTlJOTnN0TjhNZHFIV0tY\nQi9kUFh3R2lZYm9UdWFGZmFKZDFQdFUKLS0tIFo3b1IrNGFZaVVYZXpTYlFiVjNo\nV3QwU1RRaFExOXlnUmdJMlFmQmZJdm8Kzs/5XnsdYfJvLMCS/Uidwz7zQ2AphqRb\nWD+ua4DLsGIzVDCFzkuVcROBrJC8zkI8PGSd0pgFiV8zUKwEbyHG3w==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-01-07T12:12:40Z",
-		"mac": "ENC[AES256_GCM,data:NDi9LQINjtSO0qJe37WPbAyRlEgaGvxP8jrEwzd/3gQoR1zSvaBa9+IerAxCCZc9pJFVzq6FVQ4Yw8AH+dkigdMep5KL6JCtYLTqLDhohuW9REKfev6BapILfMNr2o6wyrzo+uZsbvtfq356yMVclFUtZKX8xDnGpvdUBQaTm0s=,iv:ffKwGh1zOL7wcJ1W9jbmvubXJQENZmRj58WNFRLiDtc=,tag:A7Tuvu+F1knhLwdkxJfXgQ==,type:str]",
+		"lastmodified": "2025-01-11T12:46:25Z",
+		"mac": "ENC[AES256_GCM,data:qqwInEypo5r5bCu8r2x/CHdLxFZRxjlBfvSdhO9DeINGOtPB33WvjNei3UiuqROKWIa6tOpXSjz4jUdhI88aA4lip6JUPu4rfat/GaJDP6FjtDqtKuBoZRv1YG1QY1cAuENjzi30092rZNhC1vnh38IjmcyHffM2phgkG2JRmL0=,iv:f1BbcrBH6YmEODUh6SM16LiJH85/MU5GhW4hpy9k0yE=,tag:/c0/783cQ1c4oJ0Rfcw+Mg==,type:str]",
 		"pgp": null,
 		"unencrypted_suffix": "_unencrypted",
 		"version": "3.9.2"

devices/vps6/default.nix

@@ -16,12 +16,6 @@ inputs:
               "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
             };
           };
-          luks.manual =
-          {
-            enable = true;
-            devices."/dev/disk/by-uuid/4f8aca22-9ec6-4fad-b21a-fd9d8d0514e8" = { mapper = "root"; ssd = true; };
-            delayedMount = [ "/" ];
-          };
           swap = [ "/nix/swap/swap" ];
           rollingRootfs = {};
         };
@@ -34,7 +28,6 @@ inputs:
       };
       services =
       {
-        snapper.enable = true;
         sshd = {};
         xray.server = { serverName = "vps6.xserver.chn.moe"; userNumber = 22; };
         frpServer = { enable = true; serverName = "frp.chn.moe"; };
@@ -51,15 +44,7 @@ inputs:
             [ "nix-store" "xn--qbtm095lrg0bfka60z" ]))
           // (builtins.listToAttrs (builtins.map
             (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.vps7.chn.moe"; })
-            [
-              "xn--s8w913fdga" "synapse" "syncv3.synapse" "matrix" "syncv3.matrix"
-              "send" "api" "git" "grafana" "peertube"
-            ]))
-          // (builtins.listToAttrs (builtins.map
-            (site: { name = "${site}.chn.moe"; value.upstream.address = "wireguard.nas.chn.moe"; })
-            [
-              "misskey"
-            ]));
+            [ "xn--s8w913fdga" "misskey" "synapse" "matrix" "send" "api" "git" "grafana" "peertube" ]));
           applications =
           {
             element.instances."element.chn.moe" = {};
@@ -75,15 +60,6 @@ inputs:
         httpua = {};
         mirism.enable = true;
         fail2ban = {};
-        wireguard =
-        {
-          enable = true;
-          peers = [ "pc" "nas" "one" "vps7" "srv2-node0" "pi3b" "srv1-node0" ];
-          publicKey = "AVOsYUKQQCvo3ctst3vNi8XSVWo1Wh15066aHh+KpF4=";
-          wireguardIp = "192.168.83.1";
-          listenIp = "74.211.99.69";
-          lighthouse = true;
-        };
         beesd.instances.root = { device = "/"; hashTableSizeMB = 64; };
       };
     };

devices/vps6/secrets.yaml

@@ -66,7 +66,8 @@ wireguard:
     privateKey: ENC[AES256_GCM,data:4DKPPqQkjb33rQzFIz863A2arDRQA9AivWFBaWTf0xXDX4hWvJFiIlJQfvE=,iv:0R2TH3CMxHgwVjojzjE2Gnp8SXonmBDLWF7hB33NiX0=,tag:vgtV8JkuCdspleN/SvgIqQ==,type:str]
 telegram:
     token: ENC[AES256_GCM,data:LskBPmXZk3hRZ2bChXZjmRzzGd2A2GKrUZMknCDXTpTzOdP/RDibRvgI75HLWg==,iv:9lJKuGLD5HuQinWvvAvwWFAvEJofUGkJsxKNpqZrGmI=,tag:pTmTOlsYIY6Uqd69AtrnBA==,type:str]
-    chat: ENC[AES256_GCM,data:0ehCIvd7sBFc,iv:OwdiIoPrt/e1YgsCrYcqqMYhsJuEtKW2pSKNVxahMV4=,tag:ig2CfQxwzv2ppIutU6371w==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:5kjoZ4G/NYRG,iv:jGMjDxKUJACTbC2SraMzKsXpC3QSIePJZSsjZ+8JG+c=,tag:dD8SPgIM/+VcmAd3fcZw8g==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -91,8 +92,8 @@ sops:
             ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
             ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-14T12:02:33Z"
-    mac: ENC[AES256_GCM,data:2iQLMkj/qg+TQodFXqCaSOhj1G2NGGr1ZEDewDm/6H2zteppgEw4vRls5GPUrxTQnC22NHKqih7REWa0Xv7L4eALkxrVYqWkPVcxvlt1RauW8XrW1JJhhLj+E/52AKqOxGd1CviuyyQS2M2cZzk1t3gNDpSZ8YdmhjYPUHk2SCA=,iv:imFhB5A4LZYhE3NqIbQazMqBzEtdv/c6r7DcY9yJqKE=,tag:eRTl/1vbmI3YsLLEyFyIAg==,type:str]
+    lastmodified: "2025-02-25T02:32:20Z"
+    mac: ENC[AES256_GCM,data:mP+N/m77jBS1mQ4CsdRNZ38Z2da8BK00OqU+7q7LHxBpBzw+T9wQRQJ1esEq4cfTK8QLujJNZaFTixFHvo5a/mi0peymvdh4w+m5m9ph2UyKqcaRe+qt6MUuavkJYv86jBUxohnDAhPHmkXQOcgOGF1p7d47K08zUXqzOx4SETI=,iv:U5g1lMN5yzusKUPAfi+pZj7TAxnw8HEorMStDwnfnaU=,tag:nE4J/N4cjs0wyO+S6sY4Pw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.2

devices/vps7/default.nix

@@ -16,12 +16,6 @@ inputs:
               "/dev/mapper/root" = { "/nix" = "/nix"; "/nix/rootfs/current" = "/"; };
             };
           };
-          luks.manual =
-          {
-            enable = true;
-            devices."/dev/disk/by-uuid/db48c8de-bcf7-43ae-a977-60c4f390d5c4" = { mapper = "root"; ssd = true; };
-            delayedMount = [ "/" ];
-          };
           swap = [ "/nix/swap/swap" ];
           rollingRootfs = {};
         };
@@ -33,10 +27,10 @@ inputs:
       };
       services =
       {
-        snapper.enable = true;
         sshd = {};
-        rsshub.enable = true;
-        misskey.instances.misskey.hostname = "xn--s8w913fdga.chn.moe";
+        rsshub = {};
+        misskey.instances =
+          { misskey.hostname = "xn--s8w913fdga.chn.moe"; misskey-old = { port = 9727; redis.port = 3546; }; };
         synapse.instances =
         {
           synapse.matrixHostname = "synapse.chn.moe";
@@ -48,20 +42,12 @@ inputs:
         nextcloud = {};
         freshrss.enable = true;
         send = {};
-        huginn.enable = true;
+        huginn = {};
         fz-new-order = {};
         httpapi.enable = true;
         gitea = { enable = true; ssh = {}; };
-        grafana.enable = true;
+        grafana = {};
         fail2ban = {};
-        wireguard =
-        {
-          enable = true;
-          peers = [ "vps6" ];
-          publicKey = "n056ppNxC9oECcW7wEbALnw8GeW7nrMImtexKWYVUBk=";
-          wireguardIp = "192.168.83.2";
-          listenIp = "144.126.144.62";
-        };
         xray.server = { serverName = "xserver.vps7.chn.moe"; userNumber = 4; };
         docker = {};
         peertube = {};

devices/vps7/secrets.yaml

@@ -3,11 +3,12 @@ acme:
 nginx:
     detectAuth:
         chn: ENC[AES256_GCM,data:Gk0TTbnFcsvIgoDcen6B8w==,iv:kvyvygw9zDwaiTQ2vPFTHQex0EWDFg8M8U22AConQFM=,tag:ewAZ/nXxmTOhDAjW/A2OnA==,type:str]
-        led: ENC[AES256_GCM,data:Owax7cyp,iv:NCEKyicVCYZNgxJzlO90heUmwPjfXbZEcyXX09XQKI4=,tag:WMTCVMVCD9sJgAhRUsqvYg==,type:str]
+        led: ENC[AES256_GCM,data:Vb2p9v7U,iv:xJcKgvbc0KAP31uTpFiYlpvPoEHMWH3VkEqqyINKcyk=,tag:X2R+CHFj4N4i7cAK88IoSA==,type:str]
     maxmind-license: ENC[AES256_GCM,data:9aW4QR3K6S+eTqzIjVlNEwkG0wZ4u5jgRfe7CMwRlJlK4AmcS6c45Q==,iv:cPTN1K4Aag5sohGbCQUZHYTvcwAL7AhF+rrY3OvXGPs=,tag:d9GGUMHnfzRz9Cf2U+dBfw==,type:str]
 redis:
     rsshub: ENC[AES256_GCM,data:uPnZIjbnRRoWIHlWkZNZkMpIb3Ujnnpb+AisVSVGFv4sfDAuDlAjt39pRdnWkCXJPqtXjJzQ+FeT34cqxTf8Bg==,iv:/jcyAHkxByFnbkmCAYQwda2QRmhW7L/ICoLuCgsVLCI=,tag:M5Q+dh/Bn7FiNpqQGYus4Q==,type:str]
     misskey-misskey: ENC[AES256_GCM,data:OHjt9o+m++NT5aaFbwBT/wSMdUdgf4zscd/JxjCo5HDhC3WeWMJV7z//kATI5Dg4BWAhvPlL02Vrly4RraIzLw==,iv:sQB4/D2SsOuDR3bTrmlNg7o+6ehFznDsqVc3BX9pK20=,tag:tcwTBt/JhyW8ZTAIWIkWBA==,type:str]
+    misskey-misskey-old: ENC[AES256_GCM,data:amUqMycdXUFvjg66pXKnlZqiESBYMci0k8iYzj824SaEqHl3Nq/I0TjYX++xEUg+RGYyTIcSaj96HUANTKpc1A==,iv:ND1mQLHxltRlOdpJ80ywheGo6hkl7OgRyk9TguJMuTw=,tag:dhCCwnCOnyT2iXdEMK0szg==,type:str]
     nextcloud: ENC[AES256_GCM,data:jwN/CqwkU/5Rd6w75/bV2Yej9b0CoxZaiJEcZXFx+9XUPY3Xg1tQdEr1SALG8xzOEdoL6WBVs14NvrrL25GeTQ==,iv:p5+0AB52QqScJwMhNIrM/7HAcRPdD9Z8xV6uwIDOwIg=,tag:f1XbNDDRXvGl/dkV9Wp2Ug==,type:str]
     send: ENC[AES256_GCM,data:IGxj3cgp+fQBdupfK+IgPEQSPuXdM9LRSLGSATNIkzUWC6sQw1aaKTDuRc8cU2BG6quthRwuWnK/F7k3KrUi8Q==,iv:LI9MkaF4e47FPUyL7AXZpO+CdgF91ScdiqjrE8PZjJ4=,tag:eNugln5M0AhU1xmVWFN7Aw==,type:str]
     synapse-synapse: ENC[AES256_GCM,data:8CVbcN2FG4mRT4PnlOGsS7tDfS+6ojIJFvq2EwItxn1gg2Ghd/Bmx+5tS/Do2FrYp/Xiv1EqucomM50r5bXnmg==,iv:TT7zBKQ4M10XYVCn5aeSu9IqjrIEHHazPUCOTmgRAU0=,tag:0+Q9hZMBVDj1TnHj3xoTBA==,type:str]
@@ -15,6 +16,7 @@ redis:
     peertube: ENC[AES256_GCM,data:cN+cClNV1JD+Z1Wlp07MY7BmLr/EZYZZt04mxKKKN8RG1ZSMGykbc3hd00E14ubhCittJXSPbIWyO63lCGGEPg==,iv:3z1BR0j26LGfXwDDPYU/i8Qx/7529KKoar+xGZanirI=,tag:g/NSGDE1iEYJ1MStrV3rpg==,type:str]
 postgresql:
     misskey_misskey: ENC[AES256_GCM,data:lRbSz7bbiWEdK/cRD41fLvFJF4WYsclKHVykFcU3LIz9vnKlR3VdczzznVqpT7JvG6OUi+TmipJii+0KzXHtdA==,iv:8sBKgVwuDJdThup0KQ6cnAV5O2liwVra1yIpDHVfpMI=,tag:DyUpaHai8ZUyllvZBUm8sg==,type:str]
+    misskey_misskey_old: ENC[AES256_GCM,data:Wwtd+hKI0s7m3PbEPHbnSyTsCkW0x8SYHUiCYuNSNCG8i4RAmiAbONNFfWN2hXnmTmRK79Tx/3GR+L0KMzmNGQ==,iv:BekTELToPQXUdZHyNtkuqKyZeez+moI6k907P7NhA3Q=,tag:A5YB0WIa1RkDCtzeBhiuyA==,type:str]
     synapse_synapse: ENC[AES256_GCM,data:lzaggyuXM1XwsRxFHslsP89r8wEcgi6LNfbcm+pFWj6WLO8y8WaQIdOkiF3D2ToKDwcw5XgSGSt/VAk6lv+GeA==,iv:8WOL3jze797Wz9kSRq7YpY8OS1TBMqHYhfgZlluJlic=,tag:utNhs1AMbGthp6M2c0x67g==,type:str]
     vaultwarden: ENC[AES256_GCM,data:Uz8GJMaLUTQ9pQbZyZLWS4bL5wmt9RvbAwNctAIDt9JrV3FaXxgKjE0MJSGklS55yj/Z/wbO6RCuCK2AWR2VKw==,iv:7hA8YcB88M1qCV8EhFYpHbfPmAZ/7xNqvTMJYZ/UcAY=,tag:mkDHJYmRoYZ/Ct0UmOp9FA==,type:str]
     nextcloud: ENC[AES256_GCM,data:5UpYSMsZgUgEJHg0ou9Z1RTE+YFFUKuXwPtc6L5XxD4GNo8Gd3CvcQSNGAol+5DtyPKF3q1+ZgtScWGrqU1RyA==,iv:Zfm+Oa4eON8WiJzYUkMFawafDwo9pOnOpWkwHYLIKkk=,tag:4ECMla1dFfCrn7lILwWFNA==,type:str]
@@ -30,6 +32,7 @@ rsshub:
     youtube-refresh-token: ENC[AES256_GCM,data:pnXQ1euCdix2H7IxudmUUcpxc2OUhciKT8OcGV89c/EpoXHgx1+eLxwY5rRszroWwjge9M001RGHngvD/ny3phfWAwYmIzMJxun2f7JCPe7ybMesWmPSkiqVBss1Zfic1uB8mNM/yw==,iv:8p8/vATY8F3YuGA1TtjekiuaKOMnQyTMjrwDBJaK4VU=,tag:/jVg9FDOuLMNrupgrywpBQ==,type:str]
     twitter-auth-token: ENC[AES256_GCM,data:65SbHggbYtfSfaaxJxRgD6+HpOX4vIfjnVZmOAZ9illPMYOu9MIchQ==,iv:49UuC8n6AGj1skuHzQX39Q/QuKlB9IxogIfiiy1GBnw=,tag:Rq6b0H9UFVZ19tU8ZeelRg==,type:str]
     bilibili-cookie: ENC[AES256_GCM,data:58nO7ADu2oH/OgLJNYrEEzhf1J0zt8EpuygnSANkGXJju5oSmtM7WLnaMEjC96q14OTTA9QLiFVsbxiFY1eUnraA5W7g7+6CYRXVRZaxz91D/dhKzHGTMjB/LynnNqEIc6liONlcHbyjZNQ+WIqPtjVpCKMN7Mi8cv81/cFX/1GqAwncgDD2oXh1hMPOVY4dYcGKuOG0GjlY6RgOgTPqU3HawQjnoWQjPF+lq2rnWD5HP9ZTxOYa7hm2GgPrxkq1fkRrq+kKYeDh+6M7VLDcm5Fpf+biq6F8fZWzmw4NlVZT9BG0vJFa,iv:vxYXg9Yg9qIWFQXtwTYa4Ds0KSxZYg3M6xdtXKbdaig=,tag:TzCPehk9w+BL4wwgDc1CPg==,type:str]
+    zhihu-cookies: ENC[AES256_GCM,data:DgpvRB7IuRe1KuPFqhCbtyFrC02AUlaA9UWS+d8ix0nweItXwZrkqC03lXQY7nJr54H3SfKXNhtUp4nJmV2hqNQOqekrXVsKrG++UmcAr5Ciw1lTmilqM220igJ9YwiHxtsZrWgp4sTPlTTQIFu5xrGnvlSntBjXAjzStTk1R4XRmLV427QuKbNNQ5MjPXS1PYrtN0d4/qXLx74pNd9ZsNd9F4V0E75Zt6vKE8F7aA==,iv:5Lu/HD8Iw655pg84eFs2eEQS68QqA99uMBHlgelZvrI=,tag:Pnd7VWIAgNt+1vo+vyWDpQ==,type:str]
 mail:
     bot: ENC[AES256_GCM,data:j4Y5oYeVt0sd2z2Qwuqisw==,iv:wasQCTqEMAyttbn1zm9oKck6QiByom+F7ZIMDUse9Gc=,tag:92O4ka6f0I9qnlnVy2dltA==,type:str]
 synapse:
@@ -88,7 +91,8 @@ wireguard:
     privateKey: ENC[AES256_GCM,data:TS+toaJRgAvC78XVwTciXe2IG8++vaqXVCi/u/8Aej6qq1B9Cb6f20cp5K0=,iv:T/NkLvcYiWzIDG3jWtuhe/sH2GT4z5f0xdUGbSL901I=,tag:qN7YokFBj3Kbbx4ijHTRnw==,type:str]
 telegram:
     token: ENC[AES256_GCM,data:Mr6KrAzYoDXA+dPT3oXqK2wm9ahTjZ5GVE/iRPsmcM+S2MABT+8ramyHz9oIFw==,iv:nIZ8rpSxz2GwMbDQFfG3xauMQjiriZ1oxFMrEQeH7sQ=,tag:y5U1T1vV/mmdE/CeaeTR8g==,type:str]
-    chat: ENC[AES256_GCM,data:8w/0EI64a1dC,iv:dHu9JHcUY7QPd9YBKXnrRXQB2K6jpnLrSFs+1IJmkio=,tag:3ucN3uNnBxxRF+cbLsa1nQ==,type:str]
+    user:
+        chn: ENC[AES256_GCM,data:75gj6MtpqZzq,iv:HekPpI2oJtD2UnbmQnTMXV0UwFzxdBKO5b2LpIcFSw4=,tag:bRFAeDk/YFivDAoNc5vwdA==,type:str]
 xray-server:
     clients:
         #ENC[AES256_GCM,data:aAZS,iv:Z+iJG7yC6HJeNdKCCpsZSc9Ny7kAt6GYfXUtZozMb4A=,tag:iMfwjqqmLvu5a8YpF7a0zQ==,type:comment]
@@ -127,8 +131,8 @@ sops:
             SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
             HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-13T03:06:27Z"
-    mac: ENC[AES256_GCM,data:aIgKGuyrNWt2etXCtqHXxXwLSTkGhX3wk9NcHXv4u/rkZ3wUz8iJv24whMIN+ZFhQmNV1TLuPncd/O6bYra1YmG0FXSyBkgfQdVbCAR7ys1yXpdz00zcC7zMqm3CeNui89DZH27P5z6cDtNG4Z/dLz6lpln/ummYcdcb+/7KbZQ=,iv:Gl8turVRflUOB3PWqLfwU4JPoy0k9zLKir4CKB9628s=,tag:aJ8PDOfn/XBeklIlSkC2vg==,type:str]
+    lastmodified: "2025-02-25T02:32:05Z"
+    mac: ENC[AES256_GCM,data:MnL2eu1sUS6RnWKJhi0Z3A/x4Qaw8Fgov1PdpkBMHuJVBvmcnT1w8AbsxbOZZMd2bp20NWIzosKXBNuoAJzQx+Mtigtw2mnAzs9zcLhHu6e7OvCDVQ3o9FUEz43V59VzLCDpyj2zvzFanPa9h/Aw6WTs2Qu16xaUB1FVFRzxYfg=,iv:FYNyF2KEWDbCDMTI5XCSeGOE4KSIFjX5VUqT20JMxCs=,tag:NcYVt8jtfAljJhs8m8gYFw==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.1
+    version: 3.9.2

dns/config.yaml

@@ -0,0 +1,14 @@
+providers:
+  config:
+    class: octodns.provider.yaml.YamlProvider
+    directory: ./config
+  cloudflare:
+    class: octodns_cloudflare.CloudflareProvider
+    token: env/CLOUDFLARE_TOKEN
+    pagerules: false
+zones:
+  '*':
+    sources:
+      - cloudflare
+    targets:
+      - config

dns/config/chn.moe.yaml

@@ -0,0 +1,186 @@
+? ''
+: - type: A
+    value: 74.211.99.69
+  - type: MX
+    values:
+    - exchange: tuesday.mxrouting.net.
+      preference: 10
+    - exchange: tuesday-relay.mxrouting.net.
+      preference: 20
+  - type: TXT
+    value: v=spf1 include:mxlogin.com -all
+'*.vps4':
+  type: CNAME
+  value: vps4.chn.moe.
+'*.xsession':
+  type: CNAME
+  value: vps3.chn.moe.
+_xlog-challenge.xlog:
+  type: TXT
+  value: chn
+api:
+  type: CNAME
+  value: autoroute.chn.moe.
+autoroute:
+  type: NS
+  values:
+  - ns1.huaweicloud-dns.cn.
+  - ns1.huaweicloud-dns.com.
+  - ns1.huaweicloud-dns.net.
+  - ns1.huaweicloud-dns.org.
+blog:
+  type: CNAME
+  value: vps6.chn.moe.
+catalog:
+  type: CNAME
+  value: vps6.chn.moe.
+coturn:
+  type: CNAME
+  value: vps6.chn.moe.
+element:
+  type: CNAME
+  value: vps6.chn.moe.
+freshrss:
+  type: CNAME
+  value: vps7.chn.moe.
+frp:
+  type: CNAME
+  value: vps6.chn.moe.
+git:
+  type: CNAME
+  value: autoroute.chn.moe.
+grafana:
+  type: CNAME
+  value: autoroute.chn.moe.
+huginn:
+  type: CNAME
+  value: vps7.chn.moe.
+initrd.nas:
+  type: A
+  value: 192.168.1.2
+initrd.vps6:
+  type: CNAME
+  value: vps6.chn.moe.
+initrd.vps7:
+  type: CNAME
+  value: vps7.chn.moe.
+mail:
+  type: CNAME
+  value: tuesday.mxrouting.net.
+matrix:
+  type: CNAME
+  value: autoroute.chn.moe.
+misskey:
+  type: CNAME
+  value: vps6.chn.moe.
+nas:
+  type: A
+  value: 192.168.1.2
+nextcloud:
+  type: CNAME
+  value: vps7.chn.moe.
+nix-store:
+  type: CNAME
+  value: vps6.chn.moe.
+office:
+  type: A
+  value: 210.34.16.60
+peertube:
+  type: CNAME
+  value: autoroute.chn.moe.
+photoprism:
+  type: CNAME
+  value: vps7.chn.moe.
+rsshub:
+  type: CNAME
+  value: vps7.chn.moe.
+send:
+  type: CNAME
+  value: autoroute.chn.moe.
+srv1:
+  type: A
+  value: 59.77.36.250
+srv2:
+  type: CNAME
+  value: office.chn.moe.
+ssh.git:
+  type: CNAME
+  value: vps7.chn.moe.
+sticker:
+  type: CNAME
+  value: vps6.chn.moe.
+synapse:
+  type: CNAME
+  value: autoroute.chn.moe.
+synapse-admin:
+  type: CNAME
+  value: vps6.chn.moe.
+ua:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: CNAME
+  value: vps6.chn.moe.
+vaultwarden:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: CNAME
+  value: vps7.chn.moe.
+vps6:
+  type: A
+  value: 74.211.99.69
+vps6.xserver:
+  type: CNAME
+  value: vps6.chn.moe.
+vps7:
+  type: A
+  value: 144.126.144.62
+webdav:
+  type: CNAME
+  value: vps7.chn.moe.
+webmail:
+  type: CNAME
+  value: tuesday.mxrouting.net.
+wireguard.nas:
+  type: A
+  value: 192.168.83.4
+wireguard.one:
+  type: A
+  value: 192.168.83.5
+wireguard.pc:
+  type: A
+  value: 192.168.83.3
+wireguard.srv1:
+  type: A
+  value: 192.168.83.9
+wireguard.srv2:
+  type: A
+  value: 192.168.83.7
+wireguard.vps6:
+  type: A
+  value: 192.168.83.1
+wireguard.vps7:
+  type: A
+  value: 192.168.83.2
+www:
+  type: CNAME
+  value: vps3.chn.moe.
+x._domainkey:
+  type: TXT
+  value: v=DKIM1\; k=rsa\; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAv6xvkOMNYyOlY5mCjyL+Wx9PIWljb7WKLurGNnPNrKOrmSKQBAOwKOgv6SWABsuQMSZnoi33QVrqL2pFrGwAnPbhmQSesdAQW/D2ktaTp6iaRCT2eZTGz+dNdi9HCk1Uzkee8hU7L7KZISnNhvOrbBYbaICOwJWVYjk8hqSbIgyhK90IsTmrs9S4E5PSGxLjJ
+    Cpo0X0DPTtPD4ipH7kHnnD5DRO3fkxCvMAuWbnnt5+iUn/NuFQSC//dMqzs+IklBzZWdm/3n3GijkI5XK9rxnvg8V2/bk7SzJy7qeuLJPgbQgVDHCcIJKR0Ugl6CxpqQ8Jvcf0X0AtixVoVEWoyFQIDAQAB
+xlog:
+  type: CNAME
+  value: xlog.autoroute.chn.moe.
+xsession.vps7:
+  type: CNAME
+  value: vps7.chn.moe.
+铜锣湾:
+  type: CNAME
+  value: autoroute.chn.moe.
+铜锣湾实验室:
+  type: CNAME
+  value: vps6.chn.moe.

dns/config/mirism.one.yaml

@@ -0,0 +1,3 @@
+entry:
+  type: CNAME
+  value: vps6.chn.moe.

dns/config/nekomia.moe.yaml

@@ -0,0 +1,3 @@
+? ''
+: type: ALIAS
+  value: vps6.chn.moe.

flake.lock

@@ -25,11 +25,11 @@
     "blog": {
       "flake": false,
       "locked": {
-        "lastModified": 1733321482,
-        "narHash": "sha256-xSEMEFZQFdyYEQi9cK6wNqvqSSMbsGvqEA+mtyUC7QQ=",
+        "lastModified": 1740487529,
+        "narHash": "sha256-DuEKkIU1LwT6iA9SZtXgAaL1Hx73bk2f4hLxKxTJV+0=",
         "ref": "refs/heads/public",
-        "rev": "91de30ed2cedf45ba1dc1962f853994e4bb8f5d2",
-        "revCount": 10,
+        "rev": "af59d95111b08f5d566d44ffb84a4dd32cf7fd79",
+        "revCount": 19,
         "type": "git",
         "url": "https://git.chn.moe/chn/blog-public.git"
       },
@@ -224,11 +224,11 @@
     "fancy-motd": {
       "flake": false,
       "locked": {
-        "lastModified": 1736229765,
-        "narHash": "sha256-EJGrEfuno6p7aDNcfo5SNGK0ytMZV7mA3zxrOHsK+Sw=",
+        "lastModified": 1736588104,
+        "narHash": "sha256-+gMuluff5fySXAPz1V8f2IfRsOvJY4QOf58Bsn8O+UE=",
         "owner": "CHN-beta",
         "repo": "fancy-motd",
-        "rev": "75e6dc700589ac43c7de5a8f92c6909bd6ca4eb7",
+        "rev": "9b01e6f007538a80c66d24a765df052984b88e95",
         "type": "github"
       },
       "original": {
@@ -588,15 +588,15 @@
     },
     "impermanence": {
       "locked": {
-        "lastModified": 1731242966,
-        "narHash": "sha256-B3C3JLbGw0FtLSWCjBxU961gLNv+BOOBC6WvstKLYMw=",
-        "owner": "nix-community",
+        "lastModified": 1736844146,
+        "narHash": "sha256-6eS83yDdY/Rwebm0ViqfWXtVgnNW6xk4EbEmf3uCZb8=",
+        "owner": "CHN-beta",
         "repo": "impermanence",
-        "rev": "3ed3f0eaae9fcc0a8331e77e9319c8a4abd8a71a",
+        "rev": "6436d81394a3b83ff32e57de08d5adab2177ce7f",
         "type": "github"
       },
       "original": {
-        "owner": "nix-community",
+        "owner": "CHN-beta",
         "repo": "impermanence",
         "type": "github"
       }
@@ -655,6 +655,22 @@
         "type": "github"
       }
     },
+    "mac-style": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1717900224,
+        "narHash": "sha256-tYB4fJ87UnYczaW8/w32cBzbwCw1+IDHp8BnHSyqNNg=",
+        "owner": "SergioRibera",
+        "repo": "s4rchiso-plymouth-theme",
+        "rev": "856bf3b7d239f995e4e9dde8458b9823cf0e96e4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "SergioRibera",
+        "repo": "s4rchiso-plymouth-theme",
+        "type": "github"
+      }
+    },
     "matplotplusplus": {
       "flake": false,
       "locked": {
@@ -674,11 +690,11 @@
     "misskey": {
       "flake": false,
       "locked": {
-        "lastModified": 1732375939,
-        "narHash": "sha256-ZlyBBJniDJ8yS3ALMQ9gfsVUDTzp/U4Pr3SOtE5FttY=",
+        "lastModified": 1738981864,
+        "narHash": "sha256-7tl+1vlk5FAWd9z5VIVxF90KvuhxAeJEn1tLuKNTNdk=",
         "ref": "refs/heads/chn-mod",
-        "rev": "bb3ae0b9c84126dada9ce7e13a42962a8889eba8",
-        "revCount": 26357,
+        "rev": "c557842f90fa618fa72f6cca6e719cfbbdaf1f10",
+        "revCount": 26500,
         "submodules": true,
         "type": "git",
         "url": "https://github.com/CHN-beta/misskey"
@@ -858,11 +874,11 @@
     "nixos-wallpaper": {
       "flake": false,
       "locked": {
-        "lastModified": 1715952274,
-        "narHash": "sha256-i2L4L9mV/wOl6QV+d8pyLZUHS+QIFJN5lYuQrP+CSjk=",
+        "lastModified": 1738512779,
+        "narHash": "sha256-481mZgrJ4OgXLh1Jz2I5+P+x55nd/4qMfHaBCYEpa0E=",
         "ref": "refs/heads/main",
-        "rev": "1ad78b20b21c9f4f7ba5f4c897f74276763317eb",
-        "revCount": 1,
+        "rev": "293d281e645c464e986b4dca78e03b1f8c53ca0a",
+        "revCount": 2,
         "type": "git",
         "url": "https://git.chn.moe/chn/nixos-wallpaper.git"
       },
@@ -873,11 +889,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1734506497,
-        "narHash": "sha256-QUO9YrOn10xSfc4Ov84GqbQclQPZwi4SPZC644HdNDc=",
+        "lastModified": 1740535747,
+        "narHash": "sha256-7GtX5FHZE2k+2jVK6wMNvDTkYUksXJaLsUZ3U89IA0g=",
         "owner": "CHN-beta",
         "repo": "nixpkgs",
-        "rev": "94a86525c9e4fe0221191f6d6aa01d6186e0628b",
+        "rev": "022a396dc97e656a7680e24a0fa0953ef98aa8bc",
         "type": "github"
       },
       "original": {
@@ -963,6 +979,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-unstable": {
+      "locked": {
+        "lastModified": 1739698908,
+        "narHash": "sha256-7LBhwsoOLw6WPsjIQ86n9BXuQTnXlW7PjoIM5n9JwbU=",
+        "owner": "CHN-beta",
+        "repo": "nixpkgs",
+        "rev": "12fbbac87857a29aac1f5f0a97f86d5bca1b43ef",
+        "type": "github"
+      },
+      "original": {
+        "owner": "CHN-beta",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nu-scripts": {
       "flake": false,
       "locked": {
@@ -1084,6 +1116,22 @@
         "type": "github"
       }
     },
+    "octodns-cloudflare": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1736639669,
+        "narHash": "sha256-5k6w5e5U1sr7qBJ2tXbmAJi/BMe6qT2W6x53vDEO4xs=",
+        "owner": "octodns",
+        "repo": "octodns-cloudflare",
+        "rev": "51c34b65b3405adeca395c0bba8b1b97af672f9d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "octodns",
+        "repo": "octodns-cloudflare",
+        "type": "github"
+      }
+    },
     "openxlsx": {
       "flake": false,
       "locked": {
@@ -1223,6 +1271,7 @@
         "impermanence": "impermanence",
         "lepton": "lepton",
         "lmod": "lmod",
+        "mac-style": "mac-style",
         "matplotplusplus": "matplotplusplus",
         "misskey": "misskey",
         "mumax": "mumax",
@@ -1235,9 +1284,11 @@
         "nixpkgs": "nixpkgs",
         "nixpkgs-23.05": "nixpkgs-23.05",
         "nixpkgs-23.11": "nixpkgs-23.11",
+        "nixpkgs-unstable": "nixpkgs-unstable",
         "nu-scripts": "nu-scripts",
         "nur-linyinfeng": "nur-linyinfeng",
         "nur-xddxdd": "nur-xddxdd",
+        "octodns-cloudflare": "octodns-cloudflare",
         "openxlsx": "openxlsx",
         "plasma-manager": "plasma-manager",
         "pocketfft": "pocketfft",
@@ -1262,11 +1313,11 @@
     "rsshub": {
       "flake": false,
       "locked": {
-        "lastModified": 1734135595,
-        "narHash": "sha256-D0mAiHuAFLMBZvBzspbqAlqXXdhYG45fhrYVkCdmA48=",
+        "lastModified": 1737621586,
+        "narHash": "sha256-3rlojj//tAVCdPz9NkkgsSQqxe9478ExOL1LyH4spPM=",
         "owner": "DIYgod",
         "repo": "RSSHub",
-        "rev": "3a8d34ee3f8cc38907296e74e923754297e249d4",
+        "rev": "62a61e5e7945d539bf89175c96bac2b4ab148bba",
         "type": "github"
       },
       "original": {

flake.nix

@@ -6,6 +6,7 @@
     nixpkgs.url = "github:CHN-beta/nixpkgs/nixos-24.11";
     "nixpkgs-23.11".url = "github:CHN-beta/nixpkgs/nixos-23.11";
     "nixpkgs-23.05".url = "github:CHN-beta/nixpkgs/nixos-23.05";
+    nixpkgs-unstable.url = "github:CHN-beta/nixpkgs/nixos-unstable";
     home-manager = { url = "github:nix-community/home-manager/release-24.11"; inputs.nixpkgs.follows = "nixpkgs"; };
     sops-nix = { url = "github:Mic92/sops-nix"; inputs.nixpkgs.follows = "nixpkgs"; };
     nix-index-database = { url = "github:Mic92/nix-index-database"; inputs.nixpkgs.follows = "nixpkgs"; };
@@ -15,7 +16,7 @@
       url = "github:nix-community/nix-vscode-extensions?rev=7aa26ebccf778efe880fda1290db9c1da56ffa4f";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    impermanence.url = "github:nix-community/impermanence";
+    impermanence.url = "github:CHN-beta/impermanence";
     qchem = { url = "github:Nix-QChem/NixOS-QChem/master"; inputs.nixpkgs.follows = "nixpkgs"; };
     plasma-manager =
     {
@@ -70,6 +71,8 @@
     highfive = { url = "git+https://github.com/CHN-beta/HighFive?submodules=1"; flake = false; };
     stickerpicker = { url = "github:maunium/stickerpicker"; flake = false; };
     fancy-motd = { url = "github:CHN-beta/fancy-motd"; flake = false; };
+    octodns-cloudflare = { url = "github:octodns/octodns-cloudflare"; flake = false; };
+    mac-style = { url = "github:SergioRibera/s4rchiso-plymouth-theme"; flake = false; };
   };
 
   outputs = inputs: let localLib = import ./flake/lib.nix inputs.nixpkgs.lib; in

flake/dev.nix

@@ -7,7 +7,7 @@
     CMAKE_EXPORT_COMPILE_COMMANDS = "1";
     hardeningDisable = [ "all" ];
   };
-  hpcstat = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  hpcstat = pkgs.mkShell.override { stdenv = pkgs.gcc14Stdenv; }
   {
     inputsFrom = [ (pkgs.localPackages.hpcstat.override { version = null; }) ];
     packages = [ pkgs.clang-tools_18 ];
@@ -48,4 +48,11 @@
     packages = [ pkgs.clang-tools_18 ];
     CMAKE_EXPORT_COMPILE_COMMANDS = "1";
   };
+  info = pkgs.mkShell.override { stdenv = pkgs.clang18Stdenv; }
+  {
+    inputsFrom = [ pkgs.localPackages.info ];
+    packages = [ pkgs.clang-tools_18 ];
+    CMAKE_EXPORT_COMPILE_COMMANDS = "1";
+    hardeningDisable = [ "all" ];
+  };
 }

flake/nixos.nix

@@ -1,6 +1,6 @@
 { inputs, localLib }:
 let
-  machine = [ "nas" "pc" "pi3b" "vps6" "vps7" "one" ];
+  machine = [ "nas" "pc" "vps6" "vps7" "one" ];
   cluster = { srv1 = 4; srv2 = 2; };
 in builtins.listToAttrs
 (
@@ -10,13 +10,14 @@ in builtins.listToAttrs
       name = system;
       value = inputs.nixpkgs.lib.nixosSystem
       {
-        system = let arch.pi3b = "aarch64-linux"; in arch.${system} or "x86_64-linux";
+        system = "x86_64-linux";
         specialArgs = { topInputs = inputs; inherit localLib; };
         modules = localLib.mkModules
         [
           { config = { nixpkgs.overlays = [ inputs.self.overlays.default ]; nixos.model.hostname = system; }; }
           ../modules
           ../devices/${system}
+          ../devices/cross
         ];
       };
     })
@@ -44,6 +45,7 @@ in builtins.listToAttrs
               ../modules
               ../devices/${cluster.name}
               ../devices/${cluster.name}/${node}
+              ../devices/cross
             ];
           };
         })

flake/packages.nix

@@ -24,7 +24,7 @@
       stdenv = pkgs.pkgsStatic.gcc14Stdenv;
     };
   chn-bsub = pkgs.pkgsStatic.localPackages.chn-bsub;
-  blog = pkgs.callPackage inputs.blog { inherit (inputs) hextra; };
+  blog = pkgs.localPackages.blog;
   vaspberry = pkgs.pkgsStatic.localPackages.vaspberry.override
   {
     gfortran = pkgs.pkgsStatic.gfortran;

flake/src.nix

@@ -36,4 +36,17 @@
       sha256 = "18gsw2850ig1mg4spp39i0ygfcwx0lqnamysn5whiax22m8d5z67";
     };
   };
+  huginn = pkgs.dockerTools.pullImage
+  {
+    imageName = "ghcr.io/huginn/huginn";
+    imageDigest = "sha256:fdaa76b95534f3c3a799d527821681dd61b8b6fc24de0a7e109fc665b627f115";
+    sha256 = "062c18360asnzl610n11vd46621cvkj26ay21l82f16r12k4qzwy";
+    finalImageName = "huginn/huginn";
+    finalImageTag = "latest";
+  };
+  misskey =
+  {
+    "https://github.com/aiscript-dev/aiscript-languageserver/releases/download/0.1.6/aiscript-dev-aiscript-languageserver-0.1.6.tgz" = "0092d5r67bhf4xkvrdn4a2rm1drjzy7b5sw8mi7hp4pqvpc20ylr";
+    "https://github.com/misskey-dev/tabler-icons/archive/refs/tags/3.29.0-mi.1913+5921534bc.tar.gz" = "1snwwcgxwlp9jwlq6pj4q0mypzp0c7b28m49mcwvr6dzq9vlpy2s";
+  };
 }

modules/bugs/default.nix

@@ -1,28 +1,38 @@
 inputs:
-  let
-    inherit (inputs.localLib) stripeTabs;
-    inherit (builtins) map attrNames;
-    inherit (inputs.lib) mkMerge mkIf mkOption types;
-    bugs =
+let bugs =
+{
+  # suspend & hibernate do not use platform
+  suspend-hibernate-no-platform.systemd.sleep.extraConfig =
+  ''
+    SuspendState=freeze
+    HibernateMode=shutdown
+  '';
+  # xmunet use old encryption
+  xmunet.nixpkgs.config.packageOverrides = pkgs: { wpa_supplicant = pkgs.wpa_supplicant.overrideAttrs
+    (attrs: { patches = attrs.patches ++ [ ./xmunet.patch ];}); };
+  backlight.boot.kernelParams = [ "nvidia.NVreg_RegistryDwords=EnableBrightnessControl=1" ];
+  amdpstate.boot.kernelParams = [ "amd_pstate=active" ];
+  iwlwifi =
+  {
+    nixos.system.kernel.modules.modprobeConfig =
+      [ "options iwlwifi power_save=0" "options iwlmvm power_scheme=1" "options iwlwifi uapsd_disable=1" ];
+    systemd.services = let modprobe = "${inputs.pkgs.kmod}/bin/modprobe"; in
     {
-      # suspend & hibernate do not use platform
-      suspend-hibernate-no-platform.systemd.sleep.extraConfig =
-      ''
-        SuspendState=freeze
-        HibernateMode=shutdown
-      '';
-      # xmunet use old encryption
-      xmunet.nixpkgs.config.packageOverrides = pkgs: { wpa_supplicant = pkgs.wpa_supplicant.overrideAttrs
-        (attrs: { patches = attrs.patches ++ [ ./xmunet.patch ];}); };
-      backlight.boot.kernelParams = [ "nvidia.NVreg_RegistryDwords=EnableBrightnessControl=1" ];
-      amdpstate.boot.kernelParams = [ "amd_pstate=active" ];
+      load-iwlwifi = rec
+        { wantedBy = [ "hibernate.target" ]; before = wantedBy; script = "${modprobe} iwlwifi iwlmvm"; };
+      unload-iwlwifi = rec
+        { wantedBy = [ "hibernate.target" ]; after = wantedBy; script = "${modprobe} -r iwlwifi iwlmvm"; };
     };
-  in
-    {
-      options.nixos.bugs = mkOption
-      {
-        type = types.listOf (types.enum (attrNames bugs));
-        default = [];
-      };
-      config = mkMerge (map (bug: mkIf (builtins.elem bug inputs.config.nixos.bugs) bugs.${bug}) (attrNames bugs));
-    }
+  };
+};
+in
+{
+  options.nixos.bugs = inputs.lib.mkOption
+  {
+    type = inputs.lib.types.listOf (inputs.lib.types.enum (builtins.attrNames bugs));
+    default = [];
+  };
+  config = inputs.lib.mkMerge (builtins.map
+    (bug: inputs.lib.mkIf (builtins.elem bug inputs.config.nixos.bugs) bugs.${bug})
+    (builtins.attrNames bugs));
+}

modules/default.nix

@@ -1,46 +1,40 @@
-inputs:
-  let
-    inherit (inputs) topInputs;
-    inherit (inputs.localLib) mkModules;
-  in
-  {
-    imports = mkModules
-    [
-      topInputs.home-manager.nixosModules.home-manager
-      topInputs.sops-nix.nixosModules.sops
-      topInputs.nix-index-database.nixosModules.nix-index
-      topInputs.nur-xddxdd.nixosModules.setupOverlay
-      topInputs.impermanence.nixosModules.impermanence
-      topInputs.nix-flatpak.nixosModules.nix-flatpak
-      topInputs.chaotic.nixosModules.default
-      { config.chaotic.nyx.overlay.onTopOf = "user-pkgs"; }
-      topInputs.catppuccin.nixosModules.catppuccin
-      topInputs.aagl.nixosModules.default
-      (inputs:
+inputs: let inherit (inputs) topInputs; in
+{
+  imports = inputs.localLib.mkModules
+  [
+    topInputs.home-manager.nixosModules.home-manager
+    topInputs.sops-nix.nixosModules.sops
+    topInputs.nix-index-database.nixosModules.nix-index
+    topInputs.impermanence.nixosModules.impermanence
+    topInputs.nix-flatpak.nixosModules.nix-flatpak
+    topInputs.chaotic.nixosModules.default
+    { config.chaotic.nyx.overlay.onTopOf = "user-pkgs"; }
+    topInputs.catppuccin.nixosModules.catppuccin
+    topInputs.aagl.nixosModules.default
+    (inputs:
+    {
+      config =
       {
-        config =
-        {
-          nixpkgs.overlays =
-          [
-            topInputs.qchem.overlays.default
-            topInputs.bscpkgs.overlays.default
-            topInputs.aagl.overlays.default
-            (final: prev:
-            {
-              nix-vscode-extensions = topInputs.nix-vscode-extensions.extensions."${prev.system}";
-              nur-xddxdd = topInputs.nur-xddxdd.overlays.default final prev;
-              nur-linyinfeng = (topInputs.nur-linyinfeng.overlays.default final prev).linyinfeng;
-              firefox-addons = (import "${topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
-              inherit (import topInputs.gricad { pkgs = final; }) intel-oneapi intel-oneapi-2022;
-            })
-          ];
-          home-manager.sharedModules =
-          [
-            topInputs.plasma-manager.homeManagerModules.plasma-manager
-            topInputs.catppuccin.homeManagerModules.catppuccin
-          ];
-        };
-      })
-      ./hardware ./packages ./system ./virtualization ./services ./bugs ./user ./model.nix
-    ];
-  }
+        nixpkgs.overlays =
+        [
+          topInputs.qchem.overlays.default
+          topInputs.bscpkgs.overlays.default
+          topInputs.aagl.overlays.default
+          topInputs.nur-xddxdd.overlays.inSubTree
+          (final: prev:
+          {
+            nix-vscode-extensions = topInputs.nix-vscode-extensions.extensions.${prev.system};
+            nur-linyinfeng = (topInputs.nur-linyinfeng.overlays.default final prev).linyinfeng;
+            firefox-addons = (import "${topInputs.rycee}" { inherit (prev) pkgs; }).firefox-addons;
+            inherit (import topInputs.gricad { pkgs = final; }) intel-oneapi intel-oneapi-2022;
+          })
+        ];
+        home-manager.sharedModules =
+        [
+          topInputs.plasma-manager.homeManagerModules.plasma-manager
+          topInputs.catppuccin.homeManagerModules.catppuccin
+        ];
+      };
+    })
+  ] ++ (inputs.localLib.findModules ./.);
+}

modules/hardware/default.nix

@@ -24,7 +24,7 @@ inputs:
           printing =
           {
             enable = true;
-            drivers = inputs.lib.mkIf (inputs.config.nixos.system.nixpkgs.arch == "x86_64") [ inputs.pkgs.cnijfilter2 ];
+            drivers = [ inputs.pkgs.cnijfilter2 ];
             # TODO: remove in next update
             browsed.enable = false;
           };

modules/hardware/gpu.nix

@@ -22,6 +22,7 @@ inputs:
         busId = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
       };
       driver = mkOption { type = types.enum [ "production" "latest" "beta" ]; default = "production"; };
+      open = mkOption { type = types.bool; default = true; };
     };
   };
   config = let inherit (inputs.config.nixos.hardware) gpu; in inputs.lib.mkIf (gpu.type != null) (inputs.lib.mkMerge
@@ -61,7 +62,7 @@ inputs:
             dynamicBoost.enable = inputs.lib.mkIf gpu.nvidia.dynamicBoost true;
             nvidiaSettings = true;
             package = inputs.config.boot.kernelPackages.nvidiaPackages.${gpu.nvidia.driver};
-            open = true; # TODO: remove when 560 is stable
+            inherit (gpu.nvidia) open;
             prime.allowExternalGpu = true;
           };
         };

modules/model.nix

@@ -3,7 +3,7 @@ inputs:
   options.nixos.model = let inherit (inputs.lib) mkOption types; in
   {
     hostname = mkOption { type = types.nonEmptyStr; };
-    type = mkOption { type = types.enum [ "minimal" "desktop" "server" ]; default = "minimal"; };
+    type = mkOption { type = types.enum [ "vps" "desktop" "server" ]; default = "vps"; };
     private = mkOption { type = types.bool; default = false; };
     cluster = mkOption
     {
@@ -21,12 +21,5 @@ inputs:
     { networking.hostName = model.hostname; }
     (inputs.lib.mkIf (model.cluster != null)
       { nixos.model.hostname = "${model.cluster.clusterName}-${model.cluster.nodeName}"; })
-    # TODO: remove it
-    {
-      systemd.services = inputs.lib.mkIf (model.cluster.nodeType or null == "worker") (builtins.listToAttrs
-        (builtins.map
-          (user: { name = "home-manager-${inputs.utils.escapeSystemdPath user}"; value.enable = false; })
-          inputs.config.nixos.user.users));
-    }
   ];
 }

modules/packages/desktop/default.nix

@@ -52,20 +52,20 @@ inputs:
           # download
           qbittorrent nur-xddxdd.baidupcs-go wgetpaste onedrive onedrivegui rclone
           # editor
-          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq
+          typora appflowy notion-app-enhanced joplin-desktop standardnotes logseq obsidian
           # news
-          fluent-reader rssguard newsflash newsboat
+          fluent-reader rssguard newsflash newsboat follow
           # nix tools
           nixpkgs-fmt appimage-run nixd nix-serve node2nix nix-prefetch-github prefetch-npm-deps nix-prefetch-docker
           nix-template nil pnpm-lock-export bundix
           # instant messager
           element-desktop telegram-desktop discord zoom-us slack nur-linyinfeng.wemeet nheko
-          fluffychat signal-desktop qq nur-xddxdd.wechat-uos cinny-desktop
+          fluffychat signal-desktop qq nur-xddxdd.wechat-uos-sandboxed cinny-desktop
           # browser
           google-chrome tor-browser microsoft-edge
           # office
           crow-translate zotero pandoc libreoffice-qt texliveFull poppler_utils pdftk pdfchain davinci-resolve
-          ydict texstudio panoply pspp
+          ydict texstudio panoply pspp paperwork
           # matplot++ needs old gnuplot
           inputs.pkgs."pkgs-23.11".gnuplot
           # math, physics and chemistry

modules/packages/lammps.nix

@@ -8,7 +8,7 @@ inputs:
   config = let inherit (inputs.config.nixos.packages) lammps; in inputs.lib.mkIf (lammps != null)
   {
     nixos.packages.packages._packages =
-      let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null;
+      let cuda = let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null;
       in
         if cuda then [((inputs.pkgs.lammps.override { stdenv = inputs.pkgs.cudaPackages.backendStdenv; })
           .overrideAttrs (prev:

modules/packages/mumax.nix

@@ -5,7 +5,7 @@ inputs:
     type = types.nullOr (types.submodule {});
     default =
       if (builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ])
-        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null)
+        && (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
       then {}
       else null;
   };

modules/packages/server.nix

@@ -10,7 +10,7 @@ inputs:
       [
         # basic tools
         beep dos2unix gnugrep pv tmux screen parallel tldr cowsay jq yq zellij ipfetch localPackages.pslist
-        fastfetch reptyr duc ncdu progress libva-utils ksh neofetch dateutils
+        fastfetch reptyr duc ncdu progress libva-utils ksh neofetch dateutils kitty
         # lsxx
         pciutils usbutils lshw util-linux lsof dmidecode lm_sensors hwloc acpica-tools
         # top
@@ -22,26 +22,26 @@ inputs:
         # file manager
         tree eza trash-cli lsd broot file xdg-ninja mlocate
         # compress
-        pigz upx unzip zip lzip p7zip
+        pigz upx unzip zip lzip p7zip rar
         # file system management
         sshfs e2fsprogs duperemove compsize exfatprogs
         # disk management
-        smartmontools hdparm megacli gptfdisk
+        smartmontools hdparm gptfdisk megacli
         # encryption and authentication
-        apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool
+        apacheHttpd openssl ssh-to-age gnupg age sops pam_u2f yubico-piv-tool libfido2
         # networking
         ipset iptables iproute2 dig nettools traceroute tcping-go whois tcpdump nmap inetutils wireguard-tools
         # nix tools
         nix-output-monitor nix-tree ssh-to-age nix-inspect
         # development
         gdb try inputs.topInputs.plasma-manager.packages.${inputs.pkgs.system}.rc2nix rr hexo-cli gh nix-init hugo
+        (octodns.withProviders (_: [ localPackages.octodns-cloudflare ]))
         # stupid things
         toilet lolcat localPackages.stickerpicker graph-easy
         # office
         pdfgrep ffmpeg-full # todo-txt-cli 
       ]
-        ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ])
-        ++ (inputs.lib.optional (inputs.config.nixos.system.nixpkgs.arch == "x86_64") rar);
+        ++ (with inputs.config.boot.kernelPackages; [ cpupower usbip ]);
       _pythonPackages = [(pythonPackages: with pythonPackages;
       [
         openai python-telegram-bot fastapi-cli pypdf2 pandas matplotlib plotly gunicorn redis jinja2

modules/packages/ssh.nix

@@ -153,9 +153,11 @@ inputs:
             extraOptions.AddKeysToAgent = "yes";
           };
           "wireguard.jykang" = jykang // { host = "wireguard.jykang"; proxyJump = "wireguard.srv2"; };
+          srv1-node0 = { host = "srv1-node0"; hostname = "srv1.chn.moe"; };
           srv1-node1 = { host = "srv1-node1"; hostname = "192.168.178.2"; proxyJump = "srv1"; };
           srv1-node2 = { host = "srv1-node2"; hostname = "192.168.178.3"; proxyJump = "srv1"; };
           srv1-node3 = { host = "srv1-node3"; hostname = "192.168.178.4"; proxyJump = "srv1"; };
+          srv2-node0 = { host = "srv2-node0"; hostname = "srv2.chn.moe"; };
           srv2-node1 = { host = "srv2-node1"; hostname = "192.168.178.2"; proxyJump = "srv2"; };
         };
       };

modules/packages/vasp.nix

@@ -14,7 +14,7 @@ inputs:
       (
         [ localPackages.vasp.intel localPackages.vasp.vtst localPackages.vaspkit wannier90 ]
           ++ (inputs.lib.optional
-            (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.enable && cuda.capabilities != null)
+            (let inherit (inputs.config.nixos.system.nixpkgs) cuda; in cuda.capabilities or null != null)
             localPackages.vasp.nvidia)
       );
       _pythonPackages = [(_: [ localPackages.py4vasp ])];

modules/packages/zsh/default.nix

@@ -4,72 +4,86 @@ inputs:
     { type = types.nullOr (types.submodule {}); default = {}; };
   config = let inherit (inputs.config.nixos.packages) zsh; in inputs.lib.mkIf (zsh != null)
   {
-    nixos.user.sharedModules = [(home-inputs: { config.programs =
-    {
-      zsh =
+    nixos.user.sharedModules = [(home-inputs: { config.programs = inputs.lib.mkMerge
+    [
+      # general config
       {
-        enable = true;
-        initExtraBeforeCompInit =
-        ''
-          # p10k instant prompt
-          P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
-          [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
-          HYPHEN_INSENSITIVE="true"
-          export PATH=~/bin:$PATH
-          function br
-          {
-            local cmd cmd_file code
-            cmd_file=$(mktemp)
-            if broot --outcmd "$cmd_file" "$@"; then
-              cmd=$(<"$cmd_file")
-              command rm -f "$cmd_file"
-              eval "$cmd"
-            else
-              code=$?
-              command rm -f "$cmd_file"
-              return "$code"
-            fi
-          }
-          alias todo="todo.sh"
-        '';
-        plugins =
-        [
-          {
-            file = "powerlevel10k.zsh-theme";
-            name = "powerlevel10k";
-            src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
-          }
-          { file = "p10k.zsh"; name = "powerlevel10k-config"; src = ./p10k-config; }
-          {
-            name = "zsh-lsd";
-            src = inputs.pkgs.fetchFromGitHub
-            {
-              owner = "z-shell";
-              repo = "zsh-lsd";
-              rev = "65bb5ac49190beda263aae552a9369127961632d";
-              hash = "sha256-JSNsfpgiqWhtmGQkC3B0R1Y1QnDKp9n0Zaqzjhwt7Xk=";
-            };
-          }
-        ];
-        history =
+        zsh =
         {
-          path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
-          extended = true;
-          save = 100000000;
-          size = 100000000;
+          enable = true;
+          history =
+          {
+            path = "${home-inputs.config.xdg.dataHome}/zsh/zsh_history";
+            extended = true;
+            save = 100000000;
+            size = 100000000;
+          };
+          syntaxHighlighting.enable = true;
+          autosuggestion.enable = true;
+          enableCompletion = true;
+          oh-my-zsh =
+          {
+            enable = true;
+            plugins = [ "git" "colored-man-pages" "extract" "history-substring-search" "autojump" ];
+            theme = inputs.lib.mkDefault "clean";
+          };
+          # ensure ~/.zlogin exists
+          loginExtra = " ";
         };
-      };
-      # set bash history file path, avoid overwriting zsh history
-      bash = { enable = true; historyFile =  "${home-inputs.config.xdg.dataHome}/bash/bash_history"; };
-    };})];
-    programs.zsh =
-    {
-      enable = true;
-      syntaxHighlighting.enable = true;
-      autosuggestions.enable = true;
-      enableCompletion = true;
-      ohMyZsh =
-        { enable = true; plugins = [ "git" "colored-man-pages" "extract" "history-substring-search" "autojump" ]; };
-    };
+        # set bash history file path, avoid overwriting zsh history
+        bash = { enable = true; historyFile =  "${home-inputs.config.xdg.dataHome}/bash/bash_history"; };
+      }
+      # config for root and chn
+      {
+        zsh = inputs.lib.mkIf (builtins.elem home-inputs.config.home.username [ "chn" "root" ])
+        {
+          plugins =
+          [
+            {
+              file = "powerlevel10k.zsh-theme";
+              name = "powerlevel10k";
+              src = "${inputs.pkgs.zsh-powerlevel10k}/share/zsh-powerlevel10k";
+            }
+            { file = "p10k.zsh"; name = "powerlevel10k-config"; src = ./p10k-config; }
+            {
+              name = "zsh-lsd";
+              src = inputs.pkgs.fetchFromGitHub
+              {
+                owner = "z-shell";
+                repo = "zsh-lsd";
+                rev = "65bb5ac49190beda263aae552a9369127961632d";
+                hash = "sha256-JSNsfpgiqWhtmGQkC3B0R1Y1QnDKp9n0Zaqzjhwt7Xk=";
+              };
+            }
+          ];
+          initExtraBeforeCompInit =
+          ''
+            # p10k instant prompt
+            P10K_INSTANT_PROMPT="$XDG_CACHE_HOME/p10k-instant-prompt-''${(%):-%n}.zsh"
+            [[ ! -r "$P10K_INSTANT_PROMPT" ]] || source "$P10K_INSTANT_PROMPT"
+            HYPHEN_INSENSITIVE="true"
+            export PATH=~/bin:$PATH
+            function br
+            {
+              local cmd cmd_file code
+              cmd_file=$(mktemp)
+              if broot --outcmd "$cmd_file" "$@"; then
+                cmd=$(<"$cmd_file")
+                command rm -f "$cmd_file"
+                eval "$cmd"
+              else
+                code=$?
+                command rm -f "$cmd_file"
+                return "$code"
+              fi
+            }
+            alias todo="todo.sh"
+          '';
+          oh-my-zsh.theme = "";
+        };
+      }
+    ];})];
+    environment.pathsToLink = [ "/share/zsh" ];
+    programs.zsh.enable = true;
   };
 }

modules/services/beesd.nix

@@ -55,5 +55,6 @@ inputs:
       IOWeight = 1;
       Nice = 19;
     };
+    nixos.packages.packages._packages = [ inputs.pkgs.bees ];
   };
 }

modules/services/default.nix

@@ -3,18 +3,20 @@ inputs:
   imports = inputs.localLib.findModules ./.;
   options.nixos.services = let inherit (inputs.lib) mkOption types; in
   {
-    smartd.enable = mkOption { type = types.bool; default = false; };
-    noisetorch.enable = mkOption { type = types.bool; default = inputs.config.nixos.model.type == "desktop"; };
+    smartd = mkOption
+    {
+      type = types.nullOr (types.submodule {});
+      default = if builtins.elem inputs.config.nixos.model.type [ "desktop" "server" ] then {} else null;
+    };
+    noisetorch = mkOption
+    {
+      type = types.nullOr (types.submodule {});
+      default = if inputs.config.nixos.model.type == "desktop" then {} else null;
+    };
   };
-  config =
-    let
-      inherit (inputs.lib) mkMerge mkIf;
-      inherit (inputs.localLib) stripeTabs attrsToList;
-      inherit (inputs.config.nixos) services;
-      inherit (builtins) map listToAttrs toString;
-    in mkMerge
-    [
-      (mkIf services.smartd.enable { services.smartd.enable = true; })
-      (mkIf services.noisetorch.enable { programs.noisetorch.enable = true; })
-    ];
+  config = let inherit (inputs.config.nixos.services) smartd noisetorch; in inputs.lib.mkMerge
+  [
+    (inputs.lib.mkIf (smartd != null) { services.smartd.enable = true; })
+    (inputs.lib.mkIf (noisetorch != null) { programs.noisetorch.enable = true; })
+  ];
 }

modules/services/docker.nix

@@ -2,39 +2,29 @@ inputs:
 {
   options.nixos.services.docker = let inherit (inputs.lib) mkOption types; in mkOption
     { type = types.nullOr (types.submodule {}); default = null; };
-  config = let inherit (inputs.config.nixos.services) docker; in inputs.lib.mkMerge
-  [
-    (
-      inputs.lib.mkIf (docker != null)
-      {
-        virtualisation.docker =
-        {
-          enable = true;
-          rootless =
-          {
-            enable = true;
-            setSocketVariable = true;
-            daemon.settings =
-            {
-              features.buildkit = true;
-              # dns 127.0.0.1 make docker not work
-              dns = [ "1.1.1.1" ];
-              # prevent create btrfs subvol
-              storage-driver = "overlay2";
-            };
-          };
-        };
-        hardware.nvidia-container-toolkit.enable = inputs.lib.mkIf inputs.config.nixos.system.nixpkgs.cuda.enable true;
-      }
-    )
-    # some docker settings should be set unconditionally, as some services depend on them
+  config = let inherit (inputs.config.nixos.services) docker; in inputs.lib.mkIf (docker != null)
+  {
+    virtualisation.docker =
     {
-      virtualisation.docker =
+      enable = true;
+      # prevent create btrfs subvol
+      storageDriver = "overlay2";
+      daemon.settings.dns = [ "1.1.1.1" ];
+      rootless =
       {
-        # prevent create btrfs subvol
-        storageDriver = "overlay2";
-        daemon.settings.dns = [ "1.1.1.1" ];
+        enable = true;
+        setSocketVariable = true;
+        daemon.settings =
+        {
+          features.buildkit = true;
+          # dns 127.0.0.1 make docker not work
+          dns = [ "1.1.1.1" ];
+          # prevent create btrfs subvol
+          storage-driver = "overlay2";
+        };
       };
-    }
-  ];
+    };
+    hardware.nvidia-container-toolkit.enable = inputs.lib.mkIf (inputs.config.nixos.system.nixpkgs.cuda != null) true;
+    networking.firewall.trustedInterfaces = [ "docker0" ];
+  };
 }

modules/services/gitea.nix

@@ -43,7 +43,8 @@ inputs:
           SMTP_PORT = 465;
           USER = "bot@chn.moe";
         };
-        service.REGISTER_MANUAL_CONFIRM = true;
+        service.DISABLE_REGISTRATION = true;
+        security.LOGIN_REMEMBER_DAYS = 365;
       };
     };
     nixos.services =
@@ -51,22 +52,16 @@ inputs:
       nginx =
       {
         enable = true;
-        https."${gitea.hostname}".location =
+        https.${gitea.hostname}.location =
         {
           "/".proxy.upstream = "http://127.0.0.1:3002";
           "/robots.txt".static.root =
-            let
-              robotsFile = inputs.pkgs.fetchurl
-              {
-                url = "https://gitea.com/robots.txt";
-                sha256 = "144c5s3la4a85c9lygcnxhbxs3w5y23bkhhqx69fbp9yiqyxdkk2";
-              };
-              robotsDir = inputs.pkgs.runCommand "robots.txt" {}
-              ''
-                mkdir -p $out
-                cp ${robotsFile} $out/robots.txt
-              '';
-            in "${robotsDir}";
+            let robotsFile = inputs.pkgs.fetchurl
+            {
+              url = "https://gitea.com/robots.txt";
+              sha256 = "144c5s3la4a85c9lygcnxhbxs3w5y23bkhhqx69fbp9yiqyxdkk2";
+            };
+            in "${inputs.pkgs.runCommand "robots.txt" {} "mkdir -p $out; cp ${robotsFile} $out/robots.txt"}";
         };
       };
       postgresql.instances.gitea = {};

modules/services/grafana.nix

@@ -1,17 +1,18 @@
 inputs:
 {
-  options.nixos.services.grafana = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.grafana = let inherit (inputs.lib) mkOption types; in mkOption
   {
-    enable = mkOption { type = types.bool; default = false; };
-    hostname = mkOption { type = types.str; default = "grafana.chn.moe"; };
-  };
-  config =
-    let
-      inherit (inputs.config.nixos.services) grafana;
-      inherit (inputs.lib) mkIf;
-    in mkIf grafana.enable
+    type = types.nullOr (types.submodule { options =
     {
-      services.grafana =
+      hostname = mkOption { type = types.str; default = "grafana.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) grafana; in inputs.lib.mkIf (grafana != null)
+  {
+    services =
+    {
+      grafana =
       {
         enable = true;
         declarativePlugins = with inputs.pkgs.grafanaPlugins; [];
@@ -44,24 +45,58 @@ inputs:
             password = "$__file{${inputs.config.sops.secrets."grafana/db".path}}";
           };
         };
-      };
-      nixos.services =
-      {
-        nginx =
+        provision =
         {
           enable = true;
-          https."${grafana.hostname}".location."/".proxy =
-            { upstream = "http://127.0.0.1:3001"; websocket = true; };
+          datasources.settings =
+          {
+            # prune = true;
+            datasources =
+            [{
+              name = "Prometheus";
+              type = "prometheus";
+              access = "proxy";
+              url = "http://localhost:9090";
+              editable = false;
+            }];
+          };
         };
-        postgresql.instances.grafana = {};
       };
-      sops.secrets = let owner = inputs.config.systemd.services.grafana.serviceConfig.User; in
+      prometheus =
       {
-        "grafana/mail" = { owner = owner; key = "mail/bot"; };
-        "grafana/secret".owner = owner;
-        "grafana/chn".owner = owner;
-        "grafana/db" = { owner = owner; key = "postgresql/grafana"; };
-        "mail/bot" = {};
+        enable = true;
+        exporters =
+        {
+          node = { enable = true; enabledCollectors = [ "systemd" ]; };
+        };
+        scrapeConfigs =
+        [{
+          job_name = "lapetus";
+          static_configs =
+            [{ targets = [ "127.0.0.1:${toString inputs.config.services.prometheus.exporters.node.port}" ]; }];
+        }];
+        extraFlags = [ "--storage.tsdb.max-block-chunk-segment-size=16MB" ];
       };
     };
+    nixos.services =
+    {
+      nginx =
+      {
+        enable = true;
+        https.${grafana.hostname}.location."/".proxy =
+          { upstream = "http://127.0.0.1:3001"; websocket = true; };
+      };
+      postgresql.instances.grafana = {};
+    };
+    sops.secrets = let owner = inputs.config.systemd.services.grafana.serviceConfig.User; in
+    {
+      "grafana/mail" = { owner = owner; key = "mail/bot"; };
+      "grafana/secret".owner = owner;
+      "grafana/chn".owner = owner;
+      "grafana/db" = { owner = owner; key = "postgresql/grafana"; };
+      "mail/bot" = {};
+    };
+    environment.persistence."/nix/nodatacow".directories =
+      [{ directory = "/var/lib/prometheus2"; user = "prometheus"; group = "prometheus"; mode = "0700"; }];
+  };
 }

modules/services/hpcstat.nix

@@ -16,7 +16,7 @@ inputs:
             curl = "${inputs.pkgs.curl}/bin/curl";
             cat = "${inputs.pkgs.coreutils}/bin/cat";
             token = inputs.config.sops.secrets."telegram/token".path;
-            chat = inputs.config.sops.secrets."telegram/chat".path;
+            chat = inputs.config.sops.secrets."telegram/user/chn".path;
             date = "${inputs.pkgs.coreutils}/bin/date";
             hpcstat = "${inputs.pkgs.localPackages.hpcstat}/bin/hpcstat";
             ssh = "${inputs.pkgs.openssh}/bin/ssh -i ${key} -o StrictHostKeyChecking=no"
@@ -76,7 +76,7 @@ inputs:
         calenders =
         {
           finishjob = "*-*-* *:*:00";
-          backupdb = "*-*-* *:00/10:00";
+          backupdb = "*-*-* 00/8:00:00";
           diskstat = "*-*-* 03/12:00:00";
         };
       in
@@ -108,7 +108,7 @@ inputs:
     sops.secrets =
     {
       "telegram/token" = { group = "telegram"; mode = "0440"; };
-      "telegram/chat" = { group = "telegram"; mode = "0440"; };
+      "telegram/user/chn" = { group = "telegram"; mode = "0440"; };
       "hpcstat/key" = { owner = "hpcstat"; group = "hpcstat"; };
     };
     users =

modules/services/httpapi.nix

@@ -36,10 +36,10 @@ inputs:
             let
               placeholder = inputs.config.sops.placeholder;
               request = "https://api.telegram.org/bot${placeholder."telegram/token"}"
-                + "/sendMessage?chat_id=${placeholder."telegram/chat"}&text=";
+                + "/sendMessage?chat_id=${placeholder."telegram/user/chn"}&text=";
             in ''<?php print file_get_contents("${request}".urlencode($_GET["message"])); ?>'';
         };
-        secrets = { "telegram/token" = {}; "telegram/chat" = {}; };
+        secrets = { "telegram/token" = {}; "telegram/user/chn" = {}; };
       };
       systemd.tmpfiles.rules = [ "d /srv/api 0700 nginx nginx" "Z /srv/api - nginx nginx" ];
     };

modules/services/huginn.nix

@@ -1,65 +1,58 @@
 inputs:
 {
-  options.nixos.services.huginn = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.huginn = let inherit (inputs.lib) mkOption types; in mkOption
   {
-    enable = mkOption { type = types.bool; default = false; };
-    hostname = mkOption { type = types.nonEmptyStr; default = "huginn.chn.moe"; };
-  };
-  config =
-    let
-      inherit (inputs.lib) mkIf;
-      inherit (inputs.config.nixos.services) huginn;
-    in mkIf huginn.enable
+    type = types.nullOr (types.submodule { options =
     {
-      virtualisation.oci-containers.containers.huginn =
+      hostname = mkOption { type = types.str; default = "huginn.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) huginn; in inputs.lib.mkIf (huginn != null)
+  {
+    virtualisation.oci-containers.containers.huginn =
+    {
+      image = "huginn/huginn:5a1509b51188e0d16868be893c983d6fcfd232a5";
+      imageFile = inputs.topInputs.self.src.huginn;
+      ports = [ "127.0.0.1:3000:3000/tcp" ];
+      extraOptions = [ "--add-host=host.docker.internal:host-gateway" ];
+      environmentFiles = [ inputs.config.sops.templates."huginn/env".path ];
+    };
+    sops =
+    {
+      templates."huginn/env".content = let placeholder = inputs.config.sops.placeholder; in
+      ''
+        MYSQL_PORT_3306_TCP_ADDR=host.docker.internal
+        HUGINN_DATABASE_NAME=huginn
+        HUGINN_DATABASE_USERNAME=huginn
+        HUGINN_DATABASE_PASSWORD=${placeholder."mariadb/huginn"}
+        DOMAIN=${huginn.hostname}
+        RAILS_ENV=production
+        FORCE_SSL=true
+        INVITATION_CODE=${placeholder."huginn/invitationCode"}
+        SMTP_DOMAIN=mail.chn.moe
+        SMTP_USER_NAME=bot@chn.moe
+        SMTP_PASSWORD="${placeholder."mail/bot"}"
+        SMTP_SERVER=mail.chn.moe
+        SMTP_SSL=true
+        EMAIL_FROM_ADDRESS=bot@chn.moe
+        TIMEZONE=Beijing
+        DO_NOT_CREATE_DATABASE=true
+      '';
+      secrets = { "huginn/invitationCode" = {}; "mail/bot" = {}; };
+    };
+    nixos =
+    {
+      services =
       {
-        image = "huginn/huginn:5a1509b51188e0d16868be893c983d6fcfd232a5";
-        imageFile = inputs.pkgs.dockerTools.pullImage
+        nginx =
         {
-          imageName = "ghcr.io/huginn/huginn";
-          imageDigest = "sha256:6f7a5b41457b94490210221a8bd3aae32d4ebfc2652f97c14919aa8036d7294e";
-          sha256 = "1ha6c6bwdpdl98cwwxw5fan0j77ylgaziidqhnyh6anpzq35f540";
-          finalImageName = "huginn/huginn";
-          finalImageTag = "5a1509b51188e0d16868be893c983d6fcfd232a5";
-        };
-        ports = [ "127.0.0.1:3000:3000/tcp" ];
-        extraOptions = [ "--add-host=host.docker.internal:host-gateway" ];
-        environmentFiles = [ inputs.config.sops.templates."huginn/env".path ];
-      };
-      sops =
-      {
-        templates."huginn/env".content = let placeholder = inputs.config.sops.placeholder; in
-        ''
-          MYSQL_PORT_3306_TCP_ADDR=host.docker.internal
-          HUGINN_DATABASE_NAME=huginn
-          HUGINN_DATABASE_USERNAME=huginn
-          HUGINN_DATABASE_PASSWORD=${placeholder."mariadb/huginn"}
-          DOMAIN=${huginn.hostname}
-          RAILS_ENV=production
-          FORCE_SSL=true
-          INVITATION_CODE=${placeholder."huginn/invitationCode"}
-          SMTP_DOMAIN=mail.chn.moe
-          SMTP_USER_NAME=bot@chn.moe
-          SMTP_PASSWORD="${placeholder."mail/bot"}"
-          SMTP_SERVER=mail.chn.moe
-          SMTP_SSL=true
-          EMAIL_FROM_ADDRESS=bot@chn.moe
-          TIMEZONE=Beijing
-          DO_NOT_CREATE_DATABASE=true
-        '';
-        secrets = { "huginn/invitationCode" = {}; "mail/bot" = {}; };
-      };
-      nixos =
-      {
-        services =
-        {
-          nginx =
-          {
-            enable = true;
-            https."${huginn.hostname}".location."/".proxy = { upstream = "http://127.0.0.1:3000"; websocket = true; };
-          };
-          mariadb.instances.huginn = {};
+          enable = true;
+          https.${huginn.hostname}.location."/".proxy = { upstream = "http://127.0.0.1:3000"; websocket = true; };
         };
+        mariadb.instances.huginn = {};
+        docker = {};
       };
     };
+  };
 }

modules/services/misskey.nix

@@ -4,137 +4,131 @@ inputs:
   {
     type = types.attrsOf (types.submodule { options =
     {
-      autoStart = mkOption { type = types.bool; default = true; };
       port = mkOption { type = types.ints.unsigned; default = 9726; };
       redis.port = mkOption { type = types.ints.unsigned; default = 3545; };
       hostname = mkOption { type = types.nonEmptyStr; default = "misskey.chn.moe"; };
     };});
     default = {};
   };
-  config =
-    let
-      inherit (inputs.config.nixos.services) misskey;
-      inherit (inputs.localLib) attrsToList;
-      inherit (inputs.lib) mkMerge mkIf;
-      inherit (builtins) map listToAttrs toString replaceStrings filter;
-    in
-    {
-      systemd = mkMerge (map
-        (instance:
-        {
-          services."misskey-${instance.name}" = rec
-          {
-            enable = instance.value.autoStart;
-            description = "misskey ${instance.name}";
-            after = [ "network.target" "redis-misskey-${instance.name}.service" "postgresql.service" ];
-            requires = after;
-            wantedBy = [ "multi-user.target" ];
-            environment.MISSKEY_CONFIG_YML = inputs.config.sops.templates."misskey/${instance.name}.yml".path;
-            serviceConfig = rec
-            {
-              User = inputs.config.users.users."misskey-${instance.name}".name;
-              Group = inputs.config.users.users."misskey-${instance.name}".group;
-              WorkingDirectory = "/var/lib/misskey/${instance.name}/work";
-              ExecStart = "${WorkingDirectory}/bin/misskey";
-              CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-              AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-              Restart = "always";
-            };
-          };
-          tmpfiles.rules = let dir = "/var/lib/misskey/${instance.name}/files"; owner = "misskey-${instance.name}"; in
-            [ "d ${dir} 0700 ${owner} ${owner}" "Z ${dir} - ${owner} ${owner}" ];
-        })
-        (attrsToList misskey.instances));
-      fileSystems = mkMerge (map
-        (instance:
-        {
-          "/var/lib/misskey/${instance.name}/work" =
-          {
-            device = "${inputs.pkgs.localPackages.misskey}";
-            options = [ "bind" "private" "x-gvfs-hide" "X-fstrim.notrim" ];
-          };
-          "/var/lib/misskey/${instance.name}/work/files" =
-          {
-            device = "/var/lib/misskey/${instance.name}/files";
-            options = [ "bind" "private" "x-gvfs-hide" "X-fstrim.notrim" ];
-          };
-        })
-        (attrsToList misskey.instances));
-      sops.templates = listToAttrs (map
-        (instance:
-        {
-          name = "misskey/${instance.name}.yml";
-          value =
-          {
-            content =
-              let
-                placeholder = inputs.config.sops.placeholder;
-                redis = inputs.config.nixos.services.redis.instances."misskey-${instance.name}";
-              in
-              ''
-                url: https://${instance.value.hostname}/
-                port: ${toString instance.value.port}
-                db:
-                  host: 127.0.0.1
-                  port: 5432
-                  db: misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}
-                  user: misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}
-                  pass: ${placeholder."postgresql/misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}"}
-                  extra:
-                    statement_timeout: 600000
-                dbReplications: false
-                redis:
-                  host: 127.0.0.1
-                  port: ${toString redis.port}
-                  pass: ${placeholder."redis/misskey-${instance.name}"}
-                id: 'aid'
-                proxyBypassHosts:
-                  - api.deepl.com
-                  - api-free.deepl.com
-                  - www.recaptcha.net
-                  - hcaptcha.com
-                  - challenges.cloudflare.com
-                proxyRemoteFiles: true
-                signToActivityPubGet: true
-                maxFileSize: 1073741824
-              '';
-            owner = inputs.config.users.users."misskey-${instance.name}".name;
-          };
-        })
-        (attrsToList misskey.instances));
-      users = mkMerge (map
-        (instance:
-        {
-          users."misskey-${instance.name}" =
-          {
-            uid = inputs.config.nixos.user.uid."misskey-${instance.name}";
-            group = "misskey-${instance.name}";
-            home = "/var/lib/misskey/${instance.name}";
-            createHome = true;
-            isSystemUser = true;
-          };
-          groups."misskey-${instance.name}".gid = inputs.config.nixos.user.gid."misskey-${instance.name}";
-        })
-        (attrsToList misskey.instances));
-      nixos.services =
+  config = let inherit (inputs.config.nixos.services) misskey; in
+  {
+    systemd = inputs.lib.mkMerge (builtins.map
+      (instance:
       {
-        redis.instances = listToAttrs (map
-          (instance: { name = "misskey-${instance.name}"; value.port = instance.value.redis.port; })
-          (attrsToList misskey.instances));
-        postgresql.instances = listToAttrs (map
-          (instance: { name = "misskey_${replaceStrings [ "-" ] [ "_" ] instance.name}"; value = {}; })
-          (attrsToList misskey.instances));
-        nginx =
+        services."misskey-${instance.name}" = rec
         {
-          enable = mkIf (misskey.instances != {}) true;
-          https = listToAttrs (map
-            (instance: with instance.value;
-            {
-              name = hostname;
-              value.location."/".proxy = { upstream = "http://127.0.0.1:${toString port}"; websocket = true; };
-            })
-            (attrsToList misskey.instances));
+          description = "misskey ${instance.name}";
+          after = [ "network.target" "redis-misskey-${instance.name}.service" "postgresql.service" ];
+          requires = after;
+          wantedBy = [ "multi-user.target" ];
+          environment.MISSKEY_CONFIG_YML = inputs.config.sops.templates."misskey/${instance.name}.yml".path;
+          serviceConfig = rec
+          {
+            User = "misskey-${instance.name}";
+            Group = "misskey-${instance.name}";
+            WorkingDirectory = "/var/lib/misskey/${instance.name}/work";
+            ExecStart = "${WorkingDirectory}/bin/misskey";
+            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+            AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+            Restart = "always";
+          };
         };
+        tmpfiles.rules = let dir = "/var/lib/misskey/${instance.name}/files"; owner = "misskey-${instance.name}"; in
+          [ "d ${dir} 0700 ${owner} ${owner}" "Z ${dir} - ${owner} ${owner}" ];
+      })
+      (inputs.localLib.attrsToList misskey.instances));
+    fileSystems = inputs.lib.mkMerge (builtins.map
+      (instance:
+      {
+        "/var/lib/misskey/${instance.name}/work" =
+        {
+          device = "${inputs.pkgs.localPackages.misskey}";
+          options = [ "bind" "private" "x-gvfs-hide" "X-fstrim.notrim" ];
+        };
+        "/var/lib/misskey/${instance.name}/work/files" =
+        {
+          device = "/var/lib/misskey/${instance.name}/files";
+          options = [ "bind" "private" "x-gvfs-hide" "X-fstrim.notrim" ];
+        };
+      })
+      (inputs.localLib.attrsToList misskey.instances));
+    sops.templates = builtins.listToAttrs (builtins.map
+      (instance:
+      {
+        name = "misskey/${instance.name}.yml";
+        value =
+        {
+          content =
+            let
+              placeholder = inputs.config.sops.placeholder;
+              redis = inputs.config.nixos.services.redis.instances."misskey-${instance.name}";
+            in
+            ''
+              url: https://${instance.value.hostname}/
+              port: ${toString instance.value.port}
+              db:
+                host: 127.0.0.1
+                port: 5432
+                db: misskey_${builtins.replaceStrings [ "-" ] [ "_" ] instance.name}
+                user: misskey_${builtins.replaceStrings [ "-" ] [ "_" ] instance.name}
+                pass: ${placeholder."postgresql/misskey_${builtins.replaceStrings [ "-" ] [ "_" ] instance.name}"}
+                extra:
+                  statement_timeout: 600000
+              dbReplications: false
+              redis:
+                host: 127.0.0.1
+                port: ${builtins.toString redis.port}
+                pass: ${placeholder."redis/misskey-${instance.name}"}
+              id: 'aid'
+              proxyBypassHosts:
+                - api.deepl.com
+                - api-free.deepl.com
+                - www.recaptcha.net
+                - hcaptcha.com
+                - challenges.cloudflare.com
+              proxyRemoteFiles: true
+              signToActivityPubGet: true
+              maxFileSize: 1073741824
+              fulltextSearch:
+                provider: sqlPgroonga
+            '';
+          owner = "misskey-${instance.name}";
+        };
+      })
+      (inputs.localLib.attrsToList misskey.instances));
+    users = inputs.lib.mkMerge (builtins.map
+      (instance:
+      {
+        users."misskey-${instance.name}" =
+        {
+          uid = inputs.config.nixos.user.uid."misskey-${instance.name}";
+          group = "misskey-${instance.name}";
+          home = "/var/lib/misskey/${instance.name}";
+          createHome = true;
+          isSystemUser = true;
+        };
+        groups."misskey-${instance.name}".gid = inputs.config.nixos.user.gid."misskey-${instance.name}";
+      })
+      (inputs.localLib.attrsToList misskey.instances));
+    nixos.services =
+    {
+      redis.instances = builtins.listToAttrs (builtins.map
+        (instance: { name = "misskey-${instance.name}"; value.port = instance.value.redis.port; })
+        (inputs.localLib.attrsToList misskey.instances));
+      postgresql.instances = builtins.listToAttrs (builtins.map
+        (instance: { name = "misskey_${builtins.replaceStrings [ "-" ] [ "_" ] instance.name}"; value = {}; })
+        (inputs.localLib.attrsToList misskey.instances));
+      nginx =
+      {
+        enable = inputs.lib.mkIf (misskey.instances != {}) true;
+        https = builtins.listToAttrs (builtins.map
+          (instance: with instance.value;
+          {
+            name = hostname;
+            value.location."/".proxy = { upstream = "http://127.0.0.1:${toString port}"; websocket = true; };
+          })
+          (inputs.localLib.attrsToList misskey.instances));
       };
     };
+  };
 }

modules/services/nginx/applications/blog.nix

@@ -8,6 +8,6 @@ inputs:
   config = let inherit (inputs.config.nixos.services.nginx.applications) blog; in inputs.lib.mkIf (blog != null)
     {
       nixos.services.nginx.https."blog.chn.moe".location."/".static =
-        { root = builtins.toString inputs.topInputs.self.packages.x86_64-linux.blog; index = [ "index.html" ]; };
+        { root = "${inputs.pkgs.localPackages.blog}"; index = [ "index.html" ]; };
     };
 }

modules/services/nginx/applications/sticker/web/packs/index.json

@@ -2,7 +2,18 @@
   "packs": [
     "Mare_by_WuMingv2Bot.json",
     "line_191054124446_by_moe_sticker_bot.json",
-    "Sakurada_Shiro.json"
+    "Sakurada_Shiro.json",
+    "loli_DaiSi_by_WuMingv2Bot.json",
+    "listentoweiwei_by_WuMingv2Bot.json",
+    "csaexi.json",
+    "wechat_transfer_zhcn.json",
+    "teamtimothy_bilibili.json",
+    "line26158619ac0d_by_moe_sticker_bot.json",
+    "LINE_nachonekodayo.json",
+    "zhehelima.json",
+    "TheDonaldTrump.json",
+    "line_173195293297_by_moe_sticker_bot.json",
+    "line261586194a0d_by_moe_sticker_bot.json"
   ],
   "homeserver_url": "https://matrix.chn.moe"
 }

modules/services/ollama.nix

@@ -6,10 +6,8 @@ inputs:
   {
     services =
     {
-      ollama.enable = true;
-      open-webui =
-        { enable = true; package = inputs.pkgs.genericPackages.open-webui; environment.WEBUI_AUTH = "False"; };
-      nextjs-ollama-llm-ui.enable = true;
+      ollama = { enable = true; package = inputs.pkgs.pkgs-unstable.ollama; };
+      open-webui = { enable = true; environment.WEBUI_AUTH = "False"; package = inputs.pkgs.pkgs-unstable.open-webui; };
     };
     nixos.packages.packages._packages = [ inputs.pkgs.oterm ];
   };

modules/services/postgresql.nix

@@ -22,7 +22,8 @@ inputs:
       postgresql =
       {
         enable = true;
-        package = inputs.pkgs.postgresql_15;
+        package = inputs.pkgs.postgresql_17;
+        extensions = ps: with ps; [ pgroonga ];
         enableTCPIP = true;
         authentication = "host all all 0.0.0.0/0 md5";
         settings =

modules/services/rsshub.nix

@@ -1,82 +1,73 @@
 inputs:
 {
-  options.nixos.services.rsshub = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.rsshub = let inherit (inputs.lib) mkOption types; in mkOption
   {
-    enable = mkOption { type = types.bool; default = false; };
-    port = mkOption { type = types.ints.unsigned; default = 5221; };
-    hostname = mkOption { type = types.nonEmptyStr; default = "rsshub.chn.moe"; };
-  };
-  config =
-    let
-      inherit (inputs.config.nixos.services) rsshub;
-      inherit (inputs.lib) mkIf;
-      inherit (builtins) map listToAttrs toString;
-    in mkIf rsshub.enable
+    type = types.nullOr (types.submodule { options =
     {
-      systemd =
+      hostname = mkOption { type = types.nonEmptyStr; default = "rsshub.chn.moe"; };
+    };});
+    default = null;
+  };
+  config = let inherit (inputs.config.nixos.services) rsshub; in inputs.lib.mkIf (rsshub != null)
+  {
+    systemd =
+    {
+      services.rsshub =
       {
-        services.rsshub =
+        description = "rsshub";
+        after = [ "network.target" "redis-rsshub.service" ];
+        requires = [ "redis-rsshub.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig =
         {
-          description = "rsshub";
-          after = [ "network.target" "redis-rsshub.service" ];
-          requires = [ "redis-rsshub.service" ];
-          wantedBy = [ "multi-user.target" ];
-          serviceConfig =
-          {
-            User = inputs.config.users.users.rsshub.name;
-            Group = inputs.config.users.users.rsshub.group;
-            EnvironmentFile = inputs.config.sops.templates."rsshub/env".path;
-            WorkingDirectory = "${inputs.pkgs.localPackages.rsshub}";
-            ExecStart = "${inputs.pkgs.localPackages.rsshub}/bin/rsshub";
-            CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
-            AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
-          };
-          restartTriggers = [ inputs.config.sops.templates."rsshub/env".content ];
-        };
-        tmpfiles.rules = [ "d /var/cache/rsshub 0700 rsshub rsshub" ];
-      };
-      sops =
-      {
-        templates."rsshub/env".content =
-          let
-            placeholder = inputs.config.sops.placeholder;
-            redis = inputs.config.nixos.services.redis.instances.rsshub;
-          in
-          ''
-            PORT=${toString rsshub.port}
-            CACHE_TYPE=redis
-            REDIS_URL='redis://:${placeholder."redis/rsshub"}@127.0.0.1:${toString redis.port}'
-            PIXIV_REFRESHTOKEN='${placeholder."rsshub/pixiv-refreshtoken"}'
-            YOUTUBE_KEY='${placeholder."rsshub/youtube-key"}'
-            YOUTUBE_CLIENT_ID='${placeholder."rsshub/youtube-client-id"}'
-            YOUTUBE_CLIENT_SECRET='${placeholder."rsshub/youtube-client-secret"}'
-            YOUTUBE_REFRESH_TOKEN='${placeholder."rsshub/youtube-refresh-token"}'
-            TWITTER_AUTH_TOKEN='${placeholder."rsshub/twitter-auth-token"}'
-            XDG_CONFIG_HOME='/var/cache/rsshub/chromium'
-            XDG_CACHE_HOME='/var/cache/rsshub/chromium'
-            BILIBILI_COOKIE_data0='${placeholder."rsshub/bilibili-cookie"}'
-          '';
-        secrets = (listToAttrs (map (secret: { name = "rsshub/${secret}"; value = {}; })
-        [
-          "pixiv-refreshtoken"
-          "youtube-key" "youtube-client-id" "youtube-client-secret" "youtube-refresh-token"
-          "twitter-auth-token"
-          "bilibili-cookie"
-        ]));
-      };
-      users =
-      {
-        users.rsshub = { uid = inputs.config.nixos.user.uid.rsshub; group = "rsshub"; isSystemUser = true; };
-        groups.rsshub.gid = inputs.config.nixos.user.gid.rsshub;
-      };
-      nixos.services =
-      {
-        redis.instances.rsshub.port = 7116;
-        nginx =
-        {
-          enable = true;
-          https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:${toString rsshub.port}";
+          User = "rsshub";
+          Group = "rsshub";
+          EnvironmentFile = inputs.config.sops.templates."rsshub/env".path;
+          WorkingDirectory = "${inputs.pkgs.localPackages.rsshub}";
+          ExecStart = "${inputs.pkgs.localPackages.rsshub}/bin/rsshub";
+          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
         };
+        restartTriggers = [ inputs.config.sops.templates."rsshub/env".content ];
       };
+      tmpfiles.rules = [ "d /var/cache/rsshub 0700 rsshub rsshub" ];
     };
+    sops =
+    {
+      templates."rsshub/env".content = let placeholder = inputs.config.sops.placeholder; in
+      ''
+        PORT=5221
+        CACHE_TYPE=redis
+        REDIS_URL='redis://:${placeholder."redis/rsshub"}@127.0.0.1:7116'
+        PIXIV_REFRESHTOKEN='${placeholder."rsshub/pixiv-refreshtoken"}'
+        YOUTUBE_KEY='${placeholder."rsshub/youtube-key"}'
+        YOUTUBE_CLIENT_ID='${placeholder."rsshub/youtube-client-id"}'
+        YOUTUBE_CLIENT_SECRET='${placeholder."rsshub/youtube-client-secret"}'
+        YOUTUBE_REFRESH_TOKEN='${placeholder."rsshub/youtube-refresh-token"}'
+        TWITTER_AUTH_TOKEN='${placeholder."rsshub/twitter-auth-token"}'
+        ZHIHU_COOKIES='${placeholder."rsshub/zhihu-cookies"}'
+        XDG_CONFIG_HOME='/var/cache/rsshub/chromium'
+        XDG_CACHE_HOME='/var/cache/rsshub/chromium'
+        BILIBILI_COOKIE_data0='${placeholder."rsshub/bilibili-cookie"}'
+      '';
+      secrets = (builtins.listToAttrs (builtins.map (secret: { name = "rsshub/${secret}"; value = {}; })
+      [
+        "pixiv-refreshtoken"
+        "youtube-key" "youtube-client-id" "youtube-client-secret" "youtube-refresh-token"
+        "twitter-auth-token"
+        "bilibili-cookie"
+        "zhihu-cookies"
+      ]));
+    };
+    users =
+    {
+      users.rsshub = { uid = inputs.config.nixos.user.uid.rsshub; group = "rsshub"; isSystemUser = true; };
+      groups.rsshub.gid = inputs.config.nixos.user.gid.rsshub;
+    };
+    nixos.services =
+    {
+      redis.instances.rsshub.port = 7116;
+      nginx = { enable = true; https.${rsshub.hostname}.location."/".proxy.upstream = "http://127.0.0.1:5221"; };
+    };
+  };
 }

modules/services/send.nix

@@ -29,7 +29,7 @@ inputs:
       nginx =
       {
         enable = true;
-        https."${send.hostname}".location."/".proxy = { upstream = "http://127.0.0.1:1443"; websocket = true; };
+        https.${send.hostname}.location."/".proxy = { upstream = "http://127.0.0.1:1443"; websocket = true; };
       };
       redis.instances.send = { user = "root"; port = 9184; };
     };

modules/services/slurm.nix

@@ -51,8 +51,8 @@ inputs:
               let
                 inherit (inputs.config.nixos.system.nixpkgs) cuda;
                 inherit (inputs.pkgs.cudaPackages) cuda_nvml_dev;
-                additionalInputs = inputs.lib.optionals cuda.enable [ cuda_nvml_dev cuda_nvml_dev.lib ];
-                additionalFlags = inputs.lib.optional cuda.enable "-L${cuda_nvml_dev.lib}/lib/stubs";
+                additionalInputs = inputs.lib.optionals (cuda != null) [ cuda_nvml_dev cuda_nvml_dev.lib ];
+                additionalFlags = inputs.lib.optional (cuda != null) "-L${cuda_nvml_dev.lib}/lib/stubs";
               in
               {
                 buildInputs = prev.buildInputs or [] ++ additionalInputs;
@@ -138,6 +138,9 @@ inputs:
             # record more info
             JobAcctGatherType=jobacct_gather/cgroup
             AccountingStorageTRES=gres/gpu
+
+            # append to output file
+            JobFileAppend=1
           '';
           extraConfigPaths =
             let gpus = slurm.node.${inputs.config.nixos.model.hostname}.gpus or null;
@@ -151,10 +154,11 @@ inputs:
           extraCgroupConfig =
           ''
             ConstrainCores=yes
-            ConstrainDevices=yes
             ConstrainRAMSpace=yes
             ConstrainSwapSpace=yes
             AllowedSwapSpace=20
+            # this make job hang, not sure why
+            # ConstrainDevices=yes
           '';
         };
         munge = { enable = true; password = inputs.config.sops.secrets."munge.key".path; };
@@ -178,7 +182,7 @@ inputs:
       networking.firewall =
         let config = inputs.lib.mkIf slurm.setupFirewall [ 6818 ];
         in { allowedTCPPorts = config; allowedUDPPorts = config; };
-      environment.sessionVariables.SLURM_HINT = "nomultithread";
+      environment.sessionVariables = { SLURM_HINT = "nomultithread"; SLURM_UNBUFFEREDIO = "1"; };
     }
     # master 配置
     (inputs.lib.mkIf (slurm.master == inputs.config.nixos.model.hostname)
@@ -197,22 +201,56 @@ inputs:
             StorageLoc=slurm
           '';
         };
+        extraConfig =
+          ''
+            PrologSlurmctld=${inputs.config.security.wrapperDir}/slurm-info
+            EpilogSlurmctld=${inputs.config.security.wrapperDir}/slurm-info
+          '';
+      };
+      systemd =
+      {
+        services.slurmctld.after = [ "suid-sgid-wrappers.service" ];
+        tmpfiles.rules = [ "d /var/log/slurmctld 700 slurm slurm" ];
+      };
+      sops =
+      {
+        secrets = { "slurm/db" = { owner = "slurm"; key = "mariadb/slurm"; }; }
+          // builtins.listToAttrs (builtins.map (n: { name = "telegram/${n}"; value = {}; })
+            [ "token" "user/chn" "user/hjp" ]);
+        templates."info.yaml" =
+        {
+          owner = "slurm";
+          content = let inherit (inputs.config.sops) placeholder; in builtins.toJSON
+          {
+            token = placeholder."telegram/token";
+            user =  builtins.listToAttrs (builtins.map (n: { name = n; value = placeholder."telegram/user/${n}"; })
+              [ "chn" "hjp" ]);
+            slurmConf = "${inputs.config.services.slurm.etcSlurm}/slurm.conf";
+          };
+        };
+      };
+      security.wrappers.info =
+      {
+        source =
+          let info = inputs.pkgs.localPackages.info.override
+          {
+            slurm = inputs.config.services.slurm.package;
+            configFile = inputs.config.sops.templates."info.yaml".path;
+          };
+          in "${info}/bin/info";
+        program = "slurm-info";
+        owner = "slurm";
+        group = "slurm";
+        permissions = "544";
+        capabilities = "cap_setuid,cap_setgid+ep";
       };
-      systemd.tmpfiles.rules = [ "d /var/log/slurmctld 700 slurm slurm" ];
-      sops.secrets."slurm/db" = { owner = "slurm"; key = "mariadb/slurm"; };
       nixos =
       {
         packages.packages._packages = [ inputs.pkgs.localPackages.sbatch-tui ];
         user.sharedModules = [{ home.packages =
         [
           (inputs.pkgs.writeShellScriptBin "sbatch"
-          ''
-            if [ "$#" -eq 0 ]; then
-              sbatch-tui
-            else
-              /run/current-system/sw/bin/sbatch "$@"
-            fi
-          '')
+            ''if [ "$#" -eq 0 ]; then sbatch-tui; else /run/current-system/sw/bin/sbatch "$@"; fi'')
         ];}];
         services.mariadb = { enable = true; instances.slurm = {}; };
       };

modules/services/snapper.nix

@@ -1,11 +1,11 @@
 inputs:
 {
-  options.nixos.services.snapper = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.snapper = let inherit (inputs.lib) mkOption types; in mkOption
   {
-    enable = mkOption { type = types.bool; default = false; };
-    configs = mkOption { type = types.attrsOf types.nonEmptyStr; default.persistent = "/nix/persistent"; };
+    type = types.nullOr (types.attrsOf types.nonEmptyStr);
+    default.persistent = "/nix/persistent";
   };
-  config = let inherit (inputs.config.nixos.services) snapper; in inputs.lib.mkIf snapper.enable
+  config = let inherit (inputs.config.nixos.services) snapper; in inputs.lib.mkIf (snapper != null)
   {
     services.snapper.configs = builtins.listToAttrs (builtins.map
       (config:
@@ -24,6 +24,6 @@ inputs:
           TIMELINE_LIMIT_YEARLY = 0;
         };
       })
-      (inputs.localLib.attrsToList snapper.configs));
+      (inputs.localLib.attrsToList snapper));
   };
 }

modules/services/sshd/banner.txt

@@ -1,10 +1,10 @@
-                   ░▒▓█▓▒░      ░▒▓█▓▒░▒▓███████▓▒░  
+                       ░▒▓█▓▒░      ░▒▓█▓▒░▒▓███████▓▒░  
+                      ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
+                     ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
+                    ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
+                   ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
                   ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-                 ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-                ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-               ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-              ░▒▓█▓▒░      ░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 
-             ░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
+                 ░▒▓████████▓▒░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░
 
       ░▒▓██████▓▒░░▒▓███████▓▒░ ░▒▓██████▓▒░░▒▓█▓▒░░▒▓█▓▒░▒▓███████▓▒░  
     ░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░▒▓█▓▒░░▒▓█▓▒░ 

modules/services/sshd/default.nix

@@ -33,7 +33,11 @@ inputs:
       {
         packages.packages._packages =
           [ (inputs.pkgs.fancy-motd.overrideAttrs { src = inputs.topInputs.fancy-motd; }) ];
-        user.sharedModules = [(home-inputs: { config.programs.zsh.loginExtra = "motd"; })];
+        user.sharedModules = [(home-inputs: { config.programs.zsh.loginExtra =
+        ''
+          [ -f /etc/fancy-motd/banner ] && lolcat -f /etc/fancy-motd/banner
+          motd
+        '';})];
       };
       # generate from https://patorjk.com/software/taag with font "BlurVision ASCII"
       # generate using `toilet -f wideterm -F border "InAlGaN / SiC"`

modules/services/synapse.nix

@@ -195,6 +195,8 @@ inputs:
                 ];
                 max_image_pixels = "32M";
                 dynamic_thumbnails = false;
+                # this is required for displaying thumbnails in sticker widgets
+                enable_authenticated_media = false;
               });
           };
           secrets = (listToAttrs (map

modules/services/wechat2tg.nix

@@ -44,5 +44,6 @@ inputs:
       '';
       secrets."wechat2tg/token" = {};
     };
+    nixos.services.docker = {};
   };
 }

modules/services/wireguard.nix

@@ -1,91 +1,58 @@
 inputs:
 {
-  options.nixos.services.wireguard = let inherit (inputs.lib) mkOption types; in
+  options.nixos.services.wireguard = let inherit (inputs.lib) mkOption types; in mkOption
   {
-    enable = mkOption { type = types.bool; default = false; };
-    # wg genkey | wg pubkey
-    publicKey = mkOption { type = types.nonEmptyStr; };
-    lighthouse = mkOption { type = types.bool; default = false; };
-    behindNat = mkOption
-    {
-      type = types.bool;
-      default = inputs.config.nixos.services.xray.client.enable;
-    };
-    listenIp = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
-    # if the host is behind xray, it should listen on another port, to make xray succeffully listen on 51820
-    listenPort = mkOption
-    {
-      type = types.ints.unsigned;
-      default = if inputs.config.nixos.services.wireguard.behindNat then 51821 else 51820;
-    };
-    wireguardIp = mkOption { type = types.nonEmptyStr; };
-    peers = mkOption { type = types.nonEmptyListOf types.nonEmptyStr; default = []; };
+    type = types.nullOr (types.submodule (submoduleInputs: { options =
+      let generalOption =
+      {
+        publicKey = mkOption { type = types.nonEmptyStr; };
+        lighthouse = mkOption { type = types.bool; default = false; };
+        behindNat = mkOption { type = types.bool; default = false; };
+        listenIp = mkOption { type = types.nullOr types.nonEmptyStr; default = null; };
+        wireguardIp = mkOption { type = types.nonEmptyStr; };
+      };
+      in generalOption
+        // { peers = mkOption { type = types.nonEmptyListOf (types.submodule { options = generalOption; }); }; };
+    }));
+    default = null;
   };
-  config =
-    let
-      inherit (inputs.lib) mkIf mkMerge;
-      inherit (inputs.config.nixos.services) wireguard;
-      inherit (builtins) map toString listToAttrs filter;
-    in mkIf wireguard.enable (mkMerge
+  config = let inherit (inputs.config.nixos.services) wireguard; in inputs.lib.mkIf (wireguard != null)
+  {
+    assertions =
     [
       {
-        assertions =
-        [{
-          assertion = !wireguard.behindNat -> wireguard.listenIp != null;
-          message = "wireguard.listenIp should be not null when behindNat is false.";
-        }];
+        assertion = !wireguard.behindNat -> wireguard.listenIp != null;
+        message = "wireguard.listenIp should not be null when behindNat is false.";
       }
       {
-        networking =
-        {
-          firewall =
-          {
-            allowedUDPPorts = inputs.lib.mkIf (!wireguard.behindNat) [ wireguard.listenPort ];
-            trustedInterfaces = [ "wireguard" ];
-          };
-          wireguard.interfaces.wireguard =
-          {
-            ips = [ "${wireguard.wireguardIp}/24" ];
-            inherit (wireguard) listenPort;
-            privateKeyFile = inputs.config.sops.secrets."wireguard/privateKey".path;
-            peers = map
-              (peer:
-              {
-                publicKey = peer.publicKey;
-                allowedIPs = [ (if peer.lighthouse then "192.168.83.0/24" else "${peer.wireguardIp}/32") ];
-                endpoint = mkIf (!peer.behindNat) "${peer.listenIp}:${builtins.toString peer.listenPort}";
-                persistentKeepalive = mkIf peer.lighthouse 5;
-              })
-              (map
-                (peer: inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard)
-                wireguard.peers);
-          };
-        };
-        sops.secrets."wireguard/privateKey" = {};
-        # somehow fix wireguard connection
-        systemd.services = mkIf wireguard.behindNat (listToAttrs (map
+        assertion = inputs.config.nixos.services.xray.client.enable -> wireguard.behindNat;
+        message = "Wireguard is behind NAT when xray client is enabled.";
+      }
+    ];
+    networking =
+    {
+      firewall =
+      {
+        allowedUDPPorts = inputs.lib.mkIf (!wireguard.behindNat) [ 51820 ];
+        trustedInterfaces = [ "wireguard" ];
+      };
+      wireguard.interfaces.wireguard =
+      {
+        ips = [ "${wireguard.wireguardIp}/24" ];
+        # if the host is behind xray, it should listen on another port, to make xray succeffully listen on 51820
+        listenPort = inputs.localLib.mkConditional wireguard.behindNat 51821 51820;
+        privateKeyFile = inputs.config.sops.secrets."wireguard/privateKey".path;
+        peers = builtins.map
           (peer:
           {
-            name = "wireguard-ping-${peer.name}";
-            value =
-            {
-              description = "ping ${peer.name}";
-              after = [ "network.target" ];
-              wantedBy = [ "multi-user.target" ];
-              serviceConfig =
-              {
-                ExecStart = "${inputs.pkgs.iputils}/bin/ping -i 5 ${peer.value.wireguardIp}";
-                Restart = "always";
-              };
-            };
+            inherit (peer) publicKey;
+            allowedIPs = [ (if peer.lighthouse then "192.168.83.0/24" else "${peer.wireguardIp}/32") ];
+            endpoint = inputs.lib.mkIf (!peer.behindNat) "${peer.listenIp}:51820";
+            persistentKeepalive = inputs.lib.mkIf peer.lighthouse 5;
           })
-          (filter (peer: !peer.value.behindNat) (map
-            (peer:
-            {
-              name = peer;
-              value = inputs.topInputs.self.nixosConfigurations.${peer}.config.nixos.services.wireguard;
-            })
-            wireguard.peers))));
-      }
-    ]);
+          wireguard.peers;
+      };
+    };
+    sops.secrets."wireguard/privateKey" = {};
+  };
 }

modules/services/xray.nix

@@ -458,7 +458,7 @@ inputs:
             (map (n: { name = "xray-server/clients/user${toString n}"; value = {}; }) userList)
             // (builtins.listToAttrs (map
               (name: { name = "telegram/${name}"; value = { group = "telegram"; mode = "0440"; }; })
-              [ "token" "chat" ]))
+              [ "token" "user/chn" ]))
             // { "xray-server/private-key" = {}; };
         };
         systemd =
@@ -490,7 +490,7 @@ inputs:
                   sed = "${inputs.pkgs.gnused}/bin/sed";
                   cat = "${inputs.pkgs.coreutils}/bin/cat";
                   token = inputs.config.sops.secrets."telegram/token".path;
-                  chat = inputs.config.sops.secrets."telegram/chat".path;
+                  chat = inputs.config.sops.secrets."telegram/user/chn".path;
                 in
                 ''
                   message='${inputs.config.nixos.model.hostname} xray:\n'
@@ -539,8 +539,8 @@ inputs:
           nginx =
           {
             enable = true;
-            transparentProxy.map."${xray.server.serverName}" = 4726;
-            https."${xray.server.serverName}" =
+            transparentProxy.map.${xray.server.serverName} = 4726;
+            https.${xray.server.serverName} =
             {
               listen.main = { proxyProtocol = false; addToTransparentProxy = false; };
               location."/".return.return = "400";

modules/system/default.nix

@@ -16,6 +16,15 @@ inputs:
     {
       supportedFilesystems = [ "ntfs" "nfs" "nfsv4" ];
       # consoleLogLevel = 7;
+      plymouth =
+      {
+        enable = true;
+        theme = "mac-style";
+        themePackages = [(inputs.pkgs.callPackage inputs.topInputs.mac-style {})];
+      };
+      kernelParams = inputs.lib.mkIf
+        (builtins.elem inputs.config.nixos.system.grub.installDevice [ "efi" "efiRemovable" ])
+        [ "plymouth.use-simpledrm" ];
     };
     hardware = { enableAllFirmware = true; bluetooth.enable = true; sensor.iio.enable = true; };
     environment =

modules/system/fileSystems/cluster.nix

@@ -0,0 +1,36 @@
+inputs:
+{
+  config = inputs.lib.mkMerge
+  [
+    # for cluster master, export NFS
+    (inputs.lib.mkIf (inputs.config.nixos.model.cluster.nodeType or null == "master")
+      { nixos.services.nfs = { root = "/"; exports = [ "/nix/persistent/home" ]; accessLimit = "192.168.178.0/24"; }; })
+    # for cluster worker, mount nfs, disable some home manager files
+    (inputs.lib.mkIf (inputs.config.nixos.model.cluster.nodeType or null == "worker")
+      { nixos.system.fileSystems.mount.nfs."192.168.178.1:/nix/persistent/home" = "/remote/home"; })
+    # 将一部分由 home-manager 生成软链接的文件改为直接挂载，以兼容集群的设置
+    {
+      home-manager.users = builtins.listToAttrs (builtins.map
+        (user:
+        {
+          name = user;
+          value.config.home.file = builtins.listToAttrs (builtins.map
+            (file: { name = file; value.enable = false; })
+            [ ".zshrc" ".zshenv" ".profile" ".bashrc" ".bash_profile" ".zlogin" ]);
+        })
+        inputs.config.nixos.user.users);
+      systemd.mounts = builtins.concatLists (builtins.map
+        (user: builtins.map
+          (file:
+          {
+            what = "${inputs.config.home-manager.users.${user}.home.file.${file}.source}";
+            where = "/home/${user}/${file}";
+            options = "bind";
+            wantedBy = [ "local-fs.target" ];
+          })
+          [ ".zshrc" ".zshenv" ".profile" ".bashrc" ".bash_profile" ".zlogin" ]
+        )
+        inputs.config.nixos.user.users);
+    }
+  ];
+}

modules/system/fileSystems/default.nix

@@ -25,8 +25,6 @@ inputs:
     {
       type = types.nullOr (types.submodule { options =
       {
-        device = mkOption { type = types.nonEmptyStr; default = inputs.config.fileSystems."/".device; };
-        path = mkOption { type = types.nonEmptyStr; default = "/nix/rootfs"; };
         waitDevices = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
       };});
       default = null;
@@ -113,24 +111,25 @@ inputs:
           serviceConfig.Type = "oneshot";
           script =
             let
-              inherit (fileSystems.rollingRootfs) device path waitDevices;
+              device = inputs.config.fileSystems."/".device;
               waitDevice = builtins.concatStringsSep "\n" (builtins.map
-                (device: "while ! [ -e ${device} ]; do sleep 1; done") (waitDevices ++ [ device ]));
+                (device: "while ! [ -e ${device} ]; do sleep 1; done")
+                (fileSystems.rollingRootfs.waitDevices ++ [ device ]));
             in
             ''
               while ! lsmod | grep -q btrfs; do sleep 1; done
               ${waitDevice}
               mount ${device} /mnt -m
-              if [ -f /mnt${path}/current/.timestamp ]
+              if [ -f /mnt/nix/rootfs/current/.timestamp ]
               then
-                timestamp=$(cat /mnt${path}/current/.timestamp)
-                subvolid=$(btrfs subvolume show /mnt${path}/current | grep 'Subvolume ID:' | awk '{print $NF}')
-                mv /mnt${path}/current /mnt${path}/$timestamp-$subvolid
-                btrfs property set -ts /mnt${path}/$timestamp-$subvolid ro true
+                timestamp=$(cat /mnt/nix/rootfs/current/.timestamp)
+                subvolid=$(btrfs subvolume show /mnt/nix/rootfs/current | grep 'Subvolume ID:' | awk '{print $NF}')
+                mv /mnt/nix/rootfs/current /mnt/nix/rootfs/$timestamp-$subvolid
+                btrfs property set -ts /mnt/nix/rootfs/$timestamp-$subvolid ro true
               fi
-              btrfs subvolume create /mnt${path}/current
-              chattr +C /mnt${path}/current
-              echo $(date '+%Y%m%d%H%M%S') > /mnt${path}/current/.timestamp
+              [ -d /mnt/nix/rootfs/current ] || btrfs subvolume create /mnt/nix/rootfs/current
+              chattr +C /mnt/nix/rootfs/current
+              echo $(date '+%Y%m%d%H%M%S') > /mnt/nix/rootfs/current/.timestamp
               umount /mnt
             '';
         };

modules/system/fileSystems/impermanence.nix

@@ -0,0 +1,79 @@
+inputs:
+{
+  config.environment.persistence = inputs.lib.mkMerge
+  [
+    # generic settings
+    {
+      "/nix/persistent" =
+      {
+        hideMounts = true;
+        directories =
+        [
+          "/var/db" "/var/lib" "/var/log" "/var/spool" "/var/backup" "/srv"
+          { directory = "/var/lib/docker/volumes"; mode = "0710"; }
+        ];
+        files = [ "/etc/machine-id" ]
+          ++ (builtins.concatLists (builtins.map
+            (suf: builtins.map (f: "/etc/ssh/ssh_host_${f}_key${suf}") [ "ed25519" "rsa" ])
+            [ "" ".pub" ]));
+      };
+      "/nix/rootfs/current" =
+      {
+        hideMounts = true;
+        directories = [ { directory = "/var/lib/docker"; mode = "0710"; } "/var/lib/flatpak" ]
+          ++ builtins.map (f: "/var/lib/systemd/${f}") [ "linger" "coredump" "backlight" ];
+      };
+      "/nix/nodatacow" =
+      {
+        hideMounts = true;
+        directories =
+          [{ directory = "/var/log/journal"; user = "root"; group = "systemd-journal"; mode = "u=rwx,g=rx+s,o=rx"; }]
+          ++ inputs.lib.optional inputs.config.nixos.virtualization.kvmHost.enable
+            { directory = "/var/lib/libvirt/images"; mode = "0711"; };
+      };
+    }
+    # 挂载 /home/user
+    # 对于集群的工作节点，挂载 /remote/user 到 /home/user
+    # 对于桌面用途的 chn，不需要挂载
+    # 对于其它情况，则挂载 /nix/persistent/home/user 到 /home/user
+    {
+      "${if inputs.config.nixos.model.cluster.nodeType or null == "worker" then "/remote" else "/nix/persistent"}" =
+      {
+        hideMounts = true;
+        directories = builtins.map
+          (user: { directory = "/home/${user}"; inherit user; group = user; mode = "0700"; })
+          (builtins.filter
+            (user: !(user == "chn" && inputs.config.nixos.model.type == "desktop"))
+            inputs.config.nixos.user.users);
+      };
+    }
+    # 挂载更详细的目录
+    # 对于任何情况，`.cache` 都应该在重启后丢失
+    {
+      "/nix/rootfs/current".users = builtins.listToAttrs (builtins.map
+        (user: { name = user; value.directories = [ ".cache" ]; })
+        inputs.config.nixos.user.users);
+    }
+    # 对于桌面用途的 chn，有一些需要 persist 的目录
+    (inputs.lib.mkIf (inputs.config.nixos.model.type == "desktop")
+    {
+      "/nix/persistent".users.chn.directories =
+      [
+        "bin" "Desktop" "Documents" "Downloads" "Music" "Pictures" "repo" "share" "Public" "Videos" ".config"
+        ".local/share" ".ecdata" { directory = ".mozilla/firefox/default"; mode = "0700"; } ".steam" ".vscode" ".zotero"
+        "Zotero"
+      ];
+    })
+    # 对于集群的工作节点，挂载一些本来由 home-manager 生成的文件，以及一些用来存放 home-manager 生成文件的目录
+    # impermanence 挂载来自 nix store 的文件会导致家目录的权限错误，在 cluster.nix 中直接使用 systemd.mounts 来挂载
+    (inputs.lib.mkIf (inputs.config.nixos.model.cluster.nodeType or null == "worker")
+    {
+      "/nix/persistent".users = builtins.listToAttrs (builtins.map
+        (user: { name = user; value.directories = [ ".config" ".local" ".ssh" ".mozilla" ]; })
+        inputs.config.nixos.user.users);
+      "/nix/rootfs/current".users = builtins.listToAttrs (builtins.map
+        (user: { name = user; value.directories = [ ".zsh" ".yubico" ]; })
+        inputs.config.nixos.user.users);
+    })
+  ];
+}

modules/system/fileSystems/luks.nix

@@ -12,19 +12,14 @@ inputs:
       };});
       default = {};
     };
-    manual =
+    manual = mkOption
     {
-      enable = mkOption { type = types.bool; default = false; };
-      devices = mkOption
+      type = types.nullOr (types.attrsOf (types.submodule { options =
       {
-        type = types.attrsOf (types.submodule { options =
-        {
-          mapper = mkOption { type = types.nonEmptyStr; };
-          ssd = mkOption { type = types.bool; default = false; };
-        };});
-        default = {};
-      };
-      delayedMount = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
+        mapper = mkOption { type = types.nonEmptyStr; };
+        ssd = mkOption { type = types.bool; default = false; };
+      };}));
+      default = null;
     };
   };
   config = let inherit (inputs.config.nixos.system.fileSystems) luks; in inputs.lib.mkMerge
@@ -56,7 +51,7 @@ inputs:
         })
         (builtins.filter (device: device.value.before != null) (inputs.localLib.attrsToList luks.auto)));
     };})
-    (inputs.lib.mkIf luks.manual.enable
+    (inputs.lib.mkIf (luks.manual != null)
     {
       boot.initrd =
       {
@@ -71,7 +66,7 @@ inputs:
             serviceConfig.Type = "oneshot";
             script = builtins.concatStringsSep "\n" (builtins.map
               (device: "while [ ! -e /dev/mapper/${device.value.mapper} ]; do sleep 1; done")
-              (inputs.localLib.attrsToList luks.manual.devices));
+              (inputs.localLib.attrsToList luks.manual));
           };
           extraBin.cryptsetup = "${inputs.pkgs.cryptsetup}/bin/cryptsetup";
         };

modules/system/fileSystems/nfs.nix

@@ -10,7 +10,19 @@ inputs:
       (device:
       {
         name = device.value;
-        value = { device = device.name; fsType = "nfs"; neededForBoot = true; };
+        value =
+        {
+          device = device.name;
+          fsType = "nfs4";
+          neededForBoot = true;
+          options =
+          [
+            # when try to mount at startup, wait 15 minutes before giving up
+            "retry=15" "x-systemd.device-timeout=15min"
+            # sync every seconds
+            "actimeo=1"
+          ];
+        };
       })
       (inputs.localLib.attrsToList nfs));
     boot.initrd =

modules/system/grub.nix

@@ -2,7 +2,7 @@ inputs:
 {
   options.nixos.system.grub = let inherit (inputs.lib) mkOption types; in
   {
-    timeout = mkOption { type = types.int; default = if inputs.config.nixos.model.type == "server" then 15 else 5; };
+    timeout = mkOption { type = types.int; default = 15; };
     windowsEntries = mkOption { type = types.attrsOf types.nonEmptyStr; default = {}; };
     # "efi" using efi, "efiRemovable" using efi with install grub removable, or dev path like "/dev/sda" using bios
     installDevice = mkOption { type = types.str; default = "efi"; };
@@ -30,7 +30,7 @@ inputs:
     {
       boot.loader.grub =
       {
-        memtest86.enable = inputs.lib.mkIf (inputs.config.nixos.system.nixpkgs.arch == "x86_64") true;
+        memtest86.enable = true;
         extraFiles = inputs.lib.mkIf (builtins.elem grub.installDevice [ "efi" "efiRemovable" ])
           { "shell.efi" = "${inputs.pkgs.genericPackages.edk2-uefi-shell}/shell.efi"; };
         extraEntries = inputs.lib.mkMerge (builtins.concatLists

modules/system/gui.nix

@@ -20,6 +20,7 @@ inputs:
         sessionVariables.GTK_USE_PORTAL = "1";
         persistence."/nix/rootfs/current".directories =
           [{ directory = "/var/lib/sddm"; user = "sddm"; group = "sddm"; mode = "0700"; }];
+        systemPackages = with inputs.pkgs; [ waybar ];
       };
       xdg.portal.extraPortals = builtins.map (p: inputs.pkgs."xdg-desktop-portal-${p}") [ "gtk" "wlr" ];
       i18n.inputMethod =
@@ -29,7 +30,17 @@ inputs:
         fcitx5.addons = builtins.map (p: inputs.pkgs."fcitx5-${p}")
           [ "rime" "chinese-addons" "mozc" "nord" "material-color" ];
       };
-      programs.dconf.enable = true;
+      programs =
+      {
+        dconf.enable = true;
+        hyprland = { enable = true; withUWSM = true; };
+        # waybar should not be pull in by graphical-session.target
+        waybar.enable = false;
+        iio-hyprland.enable = true;
+        hyprlock.enable = true;
+        uwsm.enable = true;
+      };
+      
     })
     # prefer gui or not
     (inputs.localLib.mkConditional (builtins.elem inputs.config.nixos.model.type [ "desktop" ])

modules/system/impermanence.nix

@@ -1,54 +0,0 @@
-inputs:
-{
-  config =
-  {
-    environment.persistence =
-    {
-      "/nix/persistent" =
-      {
-        hideMounts = true;
-        directories =
-        [
-          "/var/db"
-          "/var/lib"
-          "/var/log"
-          "/var/spool"
-          "/var/backup"
-          { directory = "/var/lib/docker/volumes"; mode = "0710"; }
-          "/srv"
-        ];
-        files =
-        [
-          "/etc/machine-id"
-          "/etc/ssh/ssh_host_ed25519_key.pub"
-          "/etc/ssh/ssh_host_ed25519_key"
-          "/etc/ssh/ssh_host_rsa_key.pub"
-          "/etc/ssh/ssh_host_rsa_key"
-        ];
-      };
-      "/nix/rootfs/current" =
-      {
-        hideMounts = true;
-        directories =
-        [
-          "/var/lib/systemd/linger"
-          "/var/lib/systemd/coredump"
-          "/var/lib/systemd/backlight"
-          { directory = "/var/lib/docker"; mode = "0710"; }
-          "/var/lib/flatpak"
-        ];
-      };
-      "/nix/nodatacow" =
-      {
-        hideMounts = true;
-        directories =
-          [{ directory = "/var/log/journal"; user = "root"; group = "systemd-journal"; mode = "u=rwx,g=rx+s,o=rx"; }]
-          ++ (
-            if inputs.config.nixos.virtualization.kvmHost.enable then
-              [{ directory = "/var/lib/libvirt/images"; mode = "0711"; }]
-            else []
-          );
-      };
-    };
-  };
-}