flake update 09-08-26

.vscode/settings.json

@@ -336,6 +336,8 @@
     "yubioath",
     "yzhang",
     "zeroconf",
+    "zerotier",
+    "zerotierone",
     "zoxide",
     "zram",
     "zstd"

common/global/nix.nix

@@ -31,10 +31,6 @@ in
         "flakes"
         "ca-derivations"
       ];
-      system-features = lib.mkAfter [
-        "gccarch-x86-64-v2"
-        "gccarch-x86-64-v3"
-      ];
       warn-dirty = false;
       flake-registry = ""; # disable global flake registries
       connect-timeout = 10;

common/optional/docker.nix

@@ -17,7 +17,6 @@
     logDriver = "local";
     storageDriver = "overlay2";
     daemon.settings = {
-      live-restore = false;
       experimental = true;
       exec-opts = [ "native.cgroupdriver=systemd" ];
       log-opts = {

common/optional/x86-64-v3.nix

@@ -1,9 +0,0 @@
-{
-  nixpkgs.hostPlatform = {
-    system = "x86_64-linux";
-    gcc = {
-      arch = "x86-64-v3";
-      tune = "generic";
-    };
-  };
-}

common/optional/zfs/snapshot_config.toml

@@ -22,12 +22,6 @@ hourly = 0
 daily = 0
 monthly = 0
 
-["root_pool/nix_build"]
-15_min = 1
-hourly = 0
-daily = 0
-monthly = 0
-
 ["root_pool/var"]
 15_min = 8
 hourly = 24

overlays/default.nix

@@ -15,8 +15,6 @@
     };
   };
 
-  test-exclusions = import ./test-exclusions.nix;
-
   python-env = final: _prev: {
     my_python = final.python314.withPackages (
       ps: with ps; [

overlays/test-exclusions.nix

@@ -1,85 +0,0 @@
-# Test exclusions for the locally rebuilt x86-64-v3 package set.
-#
-# Selecting x86-64-v3 changes every affected derivation, so the normal
-# nixpkgs binary cache cannot be used and upstream test suites run locally.
-# The jeeves builder uses /tmp/nix-builds so filesystem tests run on tmpfs
-# instead of ZFS with normalization=formD and utf8only=on; those tests remain
-# enabled. The remaining workarounds cover UDP readiness, resource-sensitive
-# parser and nested-worker races, and mismatched timeout clocks, plus
-# architecture-dependent floating-point differences whose risk we accept for
-# our workloads. Keep these exceptions visible until their causes are fixed.
-_final: prev: {
-  gnutls = prev.gnutls.overrideAttrs (old: {
-    # This test uses a fixed four-second sleep instead of checking UDP
-    # readiness; the client saw no listener in the x86-64-v3 build.
-    postPatch = (old.postPatch or "") + ''
-      sed '2iexit 77' -i tests/serv-udp.sh
-    '';
-  });
-
-  prometheus = prev.prometheus.overrideAttrs (
-    old:
-    let
-      assets = old.passthru.assets.overrideAttrs (assetsOld: {
-        # CodeMirror's bounded synchronous parser can return an incomplete tree
-        # when these cases run on a heavily loaded builder.
-        postPatch = (assetsOld.postPatch or "") + ''
-          substituteInPlace module/codemirror-promql/src/complete/hybrid.test.ts \
-            --replace-fail "it(value.title, () => {" \
-            "(value.title === 'autocomplete topk params 2' ? it.skip : it)(value.title, () => {"
-          substituteInPlace module/codemirror-promql/src/parser/vector.test.ts \
-            --replace-fail "it(value.binaryExpr, () => {" \
-            "(value.binaryExpr === 'foo * on(test,blub) bar' ? it.skip : it)(value.binaryExpr, () => {"
-        '';
-      });
-    in
-    {
-      postPatch = builtins.replaceStrings [ "${old.passthru.assets}" ] [ "${assets}" ] (
-        builtins.unsafeDiscardStringContext old.postPatch
-      );
-      passthru = old.passthru // {
-        inherit assets;
-      };
-    }
-  );
-
-  pythonPackagesExtensions = prev.pythonPackagesExtensions ++ [
-    (_pythonFinal: pythonPrev: {
-      backrefs = pythonPrev.backrefs.overridePythonAttrs (old: {
-        # regex measures its timeout in process CPU time, while this test used
-        # wall time and could miss the timeout when a busy builder descheduled it.
-        postPatch = (old.postPatch or "") + ''
-          substituteInPlace tests/test_bregex.py \
-            --replace-fail "time.time()" "time.process_time()"
-        '';
-      });
-
-      pytest-xdist = pythonPrev.pytest-xdist.overridePythonAttrs (old: {
-        # The suite exercises its own worker pools. Run the outer suite with one
-        # worker and allow inner workers more time on heavily loaded builders.
-        postPatch = (old.postPatch or "") + ''
-          substituteInPlace testing/test_remote.py \
-            --replace-fail "WAIT_TIMEOUT = 10.0" "WAIT_TIMEOUT = 60.0"
-        '';
-        preCheck = builtins.replaceStrings [ "--numprocesses=$NIX_BUILD_CORES" ] [ "--numprocesses=1" ] (
-          old.preCheck or ""
-        );
-        # This test deliberately crashes workers past the restart limit and
-        # races while checking which replacement message was emitted.
-        disabledTests = (old.disabledTests or [ ]) ++ [
-          "test_max_worker_restart_tests_queued"
-        ];
-      });
-
-      scipy = pythonPrev.scipy.overridePythonAttrs (old: {
-        # x86-64-v3 FFT implementations produce rounding differences outside
-        # these tests' strict tolerances. We accept the numerical-precision
-        # risk for our workloads.
-        disabledTests = (old.disabledTests or [ ]) ++ [
-          "test_roundtrip_float32"
-          "test_roundtrip_scaling"
-        ];
-      });
-    })
-  ];
-}

python/installer/__main__.py

@@ -176,21 +176,6 @@ def create_zfs_datasets() -> None:
     run_output(("zfs", "create", "root_pool/home"))
     run_output(("zfs", "create", "-o", "reservation=1G", "root_pool/var"))
     run_output(("zfs", "create", "-o", "compression=zstd-9", "-o", "reservation=10G", "root_pool/nix"))
-    run_output(
-        (
-            "zfs",
-            "create",
-            "-o",
-            "sync=disabled",
-            "-o",
-            "redundant_metadata=some",
-            "-o",
-            "normalization=none",
-            "-o",
-            "utf8only=off",
-            "root_pool/nix_build",
-        )
-    )
     datasets = run_output(("zfs", "list", "-o", "name"))
 
     expected_datasets = {
@@ -198,7 +183,6 @@ def create_zfs_datasets() -> None:
         "root_pool/home",
         "root_pool/var",
         "root_pool/nix",
-        "root_pool/nix_build",
     }
     missing_datasets = expected_datasets.difference(datasets.splitlines())
     if missing_datasets:
@@ -264,7 +248,6 @@ def create_nix_hardware_file(mnt_dir: str, disks: Sequence[str], encrypt: str |
         '    "/home" = {\n      device = "root_pool/home";\n      fsType = "zfs";\n    };\n\n'
         '    "/var" = {\n      device = "root_pool/var";\n      fsType = "zfs";\n    };\n\n'
         '    "/nix" = {\n      device = "root_pool/nix";\n      fsType = "zfs";\n    };\n\n'
-        '    "/nix/var/nix/builds" = {\n      device = "root_pool/nix_build";\n      fsType = "zfs";\n    };\n\n'
         '    "/boot" = {\n'
         f'      device = "/dev/disk/by-uuid/{get_boot_drive_id(disks[0])}";\n'
         '      fsType = "vfat";\n      options = [\n        "fmask=0077"\n'
@@ -287,7 +270,6 @@ def install_nixos(mnt_dir: str, disks: Sequence[str], encrypt: str | None) -> No
     run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/home", f"{mnt_dir}/home"))
     run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/var", f"{mnt_dir}/var"))
     run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/nix", f"{mnt_dir}/nix"))
-    run_output(("mount", "-o", "X-mount.mkdir", "-t", "zfs", "root_pool/nix_build", f"{mnt_dir}/nix/var/nix/builds"))
 
     for disk in disks:
         run_output(("mkfs.vfat", "-n", "EFI", f"{disk}-part1"))

systems/bob/default.nix

@@ -3,6 +3,7 @@
   imports = [
     "${inputs.self}/users/math"
     "${inputs.self}/users/richie"
+    "${inputs.self}/users/steve"
     "${inputs.self}/common/global"
     "${inputs.self}/common/optional/docker.nix"
     "${inputs.self}/common/optional/monitoring-agent.nix"
@@ -13,7 +14,7 @@
     "${inputs.self}/common/optional/systemd-boot.nix"
     "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
+    "${inputs.self}/common/optional/yubikey.nix"
     "${inputs.self}/common/optional/zfs"
     ./hardware.nix
     ./syncthing.nix

systems/bob/hardware.nix

@@ -50,11 +50,6 @@
       fsType = "zfs";
     };
 
-    "/nix/var/nix/builds" = {
-      device = "root_pool/nix_build";
-      fsType = "zfs";
-    };
-
     "/var" = {
       device = "root_pool/var";
       fsType = "zfs";

systems/bob/snapshot_config.toml

@@ -22,12 +22,6 @@ hourly = 0
 daily = 0
 monthly = 0
 
-["root_pool/nix_build"]
-15_min = 1
-hourly = 0
-daily = 0
-monthly = 0
-
 ["root_pool/models"]
 15_min = 4
 hourly = 24

systems/brain/default.nix

@@ -9,7 +9,6 @@
     "${inputs.self}/common/optional/systemd-boot.nix"
     "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
     "${inputs.self}/common/optional/zfs"
     ./docker
     ./hardware.nix

systems/brain/hardware.nix

@@ -53,11 +53,6 @@
       fsType = "zfs";
     };
 
-    "/nix/var/nix/builds" = {
-      device = "root_pool/nix_build";
-      fsType = "zfs";
-    };
-
     "/boot" = {
       device = "/dev/disk/by-uuid/12CE-A600";
       fsType = "vfat";

systems/jeeves/containers.nix

@@ -1,71 +0,0 @@
-{ pkgs, ... }:
-let
-  vars = import ./vars.nix;
-in
-{
-  virtualisation.docker.daemon.settings."data-root" = "${vars.containers}/docker";
-
-  # nixos-container hardcodes its state directory to /var/lib/nixos-containers,
-  # so route it to the shared container dataset with a bind mount.
-  fileSystems."/var/lib/nixos-containers" = {
-    device = "${vars.containers}/nixos-containers";
-    fsType = "none";
-    options = [ "bind" ];
-  };
-
-  systemd.services = {
-    prepare-docker-storage = {
-      description = "Create Docker storage directory";
-      requiredBy = [ "docker.service" ];
-      before = [ "docker.service" ];
-      requires = [ "zfs-mount.service" ];
-      after = [ "zfs-mount.service" ];
-      path = [
-        pkgs.coreutils
-        pkgs.util-linux
-      ];
-
-      unitConfig = {
-        DefaultDependencies = false;
-        RequiresMountsFor = [ "/nix" ];
-      };
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-
-      script = ''
-        mountpoint -q ${vars.containers}
-        install -d -m 0710 ${vars.containers}/docker
-      '';
-    };
-
-    prepare-nixos-container-storage = {
-      description = "Create NixOS container storage directory";
-      requiredBy = [ "var-lib-nixos\\x2dcontainers.mount" ];
-      before = [ "var-lib-nixos\\x2dcontainers.mount" ];
-      requires = [ "zfs-mount.service" ];
-      after = [ "zfs-mount.service" ];
-      path = [
-        pkgs.coreutils
-        pkgs.util-linux
-      ];
-
-      unitConfig = {
-        DefaultDependencies = false;
-        RequiresMountsFor = [ "/nix" ];
-      };
-
-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
-      };
-
-      script = ''
-        mountpoint -q ${vars.containers}
-        install -d -m 0755 ${vars.containers}/nixos-containers
-      '';
-    };
-  };
-}

systems/jeeves/default.nix

@@ -4,8 +4,10 @@ let
 in
 {
   imports = [
+    "${inputs.self}/users/dov"
     "${inputs.self}/users/math"
     "${inputs.self}/users/richie"
+    "${inputs.self}/users/steve"
     "${inputs.self}/common/global"
     "${inputs.self}/common/optional/docker.nix"
     "${inputs.self}/common/optional/monitoring-agent.nix"
@@ -13,12 +15,10 @@ in
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/tailscale.nix"
     "${inputs.self}/common/optional/update.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
     "${inputs.self}/common/optional/zfs"
     ./monitoring
     ./docker
     ./services
-    ./containers.nix
     ./hardware.nix
     ./networking
     ./programs.nix
@@ -35,6 +35,14 @@ in
       path = ./snapshot_config.toml;
       EnvironmentFile = "${vars.secrets}/services/snapshot_manager";
     };
+
+    zerotierone = {
+      enable = true;
+      joinNetworks = [
+        "e4da7455b2ae64ca"
+        "a09acf02330d37b9"
+      ];
+    };
   };
 
   users.groups = {

systems/jeeves/hardware.nix

@@ -96,11 +96,6 @@ in
       fsType = "zfs";
     };
 
-    "/nix/var/nix/builds" = {
-      device = "root_pool/nix_build";
-      fsType = "zfs";
-    };
-
     "/var" = {
       device = "root_pool/var";
       fsType = "zfs";

systems/jeeves/runners/nix_builder.nix

@@ -1,7 +1,8 @@
 {
   config,
   lib,
-  pkgs,
+  outputs,
+  utils,
   ...
 }:
 
@@ -11,122 +12,6 @@ let
   cfg = config.services.nix_builder;
   runnerUsername = "gitea-runner";
   runnerUserid = 601;
-  runnerLabels = [
-    "self-hosted:host"
-    "nixos:host"
-  ];
-  containerConfig =
-    {
-      config,
-      pkgs,
-      lib,
-      ...
-    }:
-    let
-      runnerConfigFile = (pkgs.formats.yaml { }).generate "gitea-runner.yaml" { };
-      registerRunner = pkgs.writeShellApplication {
-        name = "register-gitea-runner";
-        runtimeInputs = [
-          pkgs.coreutils
-          pkgs.hostname
-          config.services.gitea-actions-runner.package
-        ];
-        text = builtins.readFile ./register_gitea_runner.sh;
-      };
-    in
-    {
-      networking = {
-        hostName = "nix-builder";
-        useDHCP = lib.mkDefault true;
-        interfaces.eth0.useDHCP = true;
-        # Ensure containers don't inherit the host's stub resolver (127.0.0.53) which was causing issues
-        useHostResolvConf = false;
-      };
-      nix.settings = {
-        system-features = lib.mkAfter [
-          "gccarch-x86-64-v2"
-          "gccarch-x86-64-v3"
-        ];
-        trusted-substituters = [
-          "https://cache.nixos.org"
-          "https://cache.tmmworkshop.com"
-          "https://nix-community.cachix.org"
-        ];
-        substituters = [
-          "https://cache.nixos.org/?priority=2&want-mass-query=true"
-          "https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
-          "https://nix-community.cachix.org/?priority=10&want-mass-query=true"
-        ];
-        trusted-public-keys = [
-          "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-          "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
-          "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        ];
-        experimental-features = [
-          "flakes"
-          "nix-command"
-        ];
-        sandbox = true;
-        allowed-users = [ runnerUsername ];
-        trusted-users = [
-          "root"
-          runnerUsername
-        ];
-      };
-      users = {
-        users.${runnerUsername} = {
-          isSystemUser = true;
-          group = runnerUsername;
-          uid = runnerUserid;
-        };
-        groups.${runnerUsername}.gid = runnerUserid;
-      };
-      services.gitea-actions-runner.instances.builder = {
-        enable = true;
-        name = "jeeves-nix-builder";
-        url = "http://192.168.99.14:6443/";
-        labels = runnerLabels;
-        tokenFile = "/run/secrets/gitea-runners/registration-token";
-        settings.runner.timeout = "12h";
-        hostPackages = with pkgs; [
-          bash
-          coreutils
-          curl
-          gawk
-          gitMinimal
-          gnused
-          my_python
-          nix
-          nixfmt
-          nixos-rebuild
-          nodejs
-          treefmt
-          wget
-        ];
-      };
-      systemd.services."gitea-runner-builder" = {
-        serviceConfig = {
-          DynamicUser = mkForce false;
-          User = mkForce runnerUsername;
-          Group = mkForce runnerUsername;
-          ExecStartPre = mkForce [
-            "${getExe registerRunner} builder http://192.168.99.14:6443/ ${runnerConfigFile} ${escapeShellArgs runnerLabels}"
-          ];
-        };
-      };
-      system.stateVersion = "24.05";
-    };
-  sharedContainerPath =
-    (import "${pkgs.path}/nixos/lib/eval-config.nix" {
-      modules = [
-        {
-          boot.isNspawnContainer = true;
-          nixpkgs.pkgs = pkgs;
-        }
-        containerConfig
-      ];
-      system = null;
-    }).config.system.build.toplevel;
 in
 {
   options.services.nix_builder = {
@@ -163,11 +48,9 @@ in
     containers = mapAttrs (
       name: containerCfg:
       mkIf containerCfg.enable {
-        path = sharedContainerPath;
         autoStart = true;
         privateNetwork = true;
         hostBridge = cfg.bridgeName;
-        extraFlags = [ "--hostname=${name}" ];
         bindMounts = {
           host-nix = {
             mountPoint = "/host-nix/var/nix/daemon-socket";
@@ -185,6 +68,93 @@ in
             isReadOnly = false;
           };
         };
+        config =
+          {
+            config,
+            pkgs,
+            lib,
+            ...
+          }:
+          {
+            networking = {
+              useDHCP = lib.mkDefault true;
+              interfaces.eth0.useDHCP = true;
+              # Ensure containers don't inherit the host's stub resolver (127.0.0.53) which was causing issues
+              useHostResolvConf = false;
+            };
+            nix.settings = {
+              trusted-substituters = [
+                "https://cache.nixos.org"
+                "https://cache.tmmworkshop.com"
+                "https://nix-community.cachix.org"
+              ];
+              substituters = [
+                "https://cache.nixos.org/?priority=2&want-mass-query=true"
+                "https://cache.tmmworkshop.com/?priority=2&want-mass-query=true"
+                "https://nix-community.cachix.org/?priority=10&want-mass-query=true"
+              ];
+              trusted-public-keys = [
+                "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
+                "cache.tmmworkshop.com:jHffkpgbmEdstQPoihJPYW9TQe6jnQbWR2LqkNGV3iA="
+                "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+              ];
+              experimental-features = [
+                "flakes"
+                "nix-command"
+              ];
+              sandbox = true;
+              allowed-users = [ "gitea-runner" ];
+              trusted-users = [
+                "root"
+                "gitea-runner"
+              ];
+            };
+            nixpkgs = {
+              overlays = builtins.attrValues outputs.overlays;
+              config.allowUnfree = true;
+            };
+            users = {
+              users.${runnerUsername} = {
+                isSystemUser = true;
+                group = runnerUsername;
+                uid = runnerUserid;
+              };
+              groups.${runnerUsername}.gid = runnerUserid;
+            };
+            services.gitea-actions-runner.instances.${name} = {
+              enable = true;
+              name = "jeeves-${name}";
+              url = "http://192.168.99.14:6443/";
+              labels = [
+                "self-hosted:host"
+                "nixos:host"
+              ];
+              tokenFile = "/run/secrets/gitea-runners/registration-token";
+              hostPackages = with pkgs; [
+                bash
+                coreutils
+                curl
+                gawk
+                gitMinimal
+                gnused
+                my_python
+                nix
+                nixfmt
+                nixos-rebuild
+                nodejs
+                treefmt
+                wget
+              ];
+            };
+            systemd.services."gitea-runner-${utils.escapeSystemdPath name}" = {
+              serviceConfig = {
+                DynamicUser = mkForce false;
+                User = mkForce runnerUsername;
+                Group = mkForce runnerUsername;
+              };
+            };
+            system.stateVersion = "24.05";
+          };
       }
     ) cfg.containers;
 

systems/jeeves/runners/register_gitea_runner.sh

@@ -1,36 +0,0 @@
-#!/usr/bin/env bash
-
-legacy_instance_dir="$STATE_DIRECTORY/$(hostname)"
-instance_dir="$STATE_DIRECTORY/$1"
-runner_url="$2"
-runner_config_file="$3"
-shift 3
-runner_labels="$(IFS=,; printf '%s' "$*")"
-
-if [ ! -e "$instance_dir" ] && [ -d "$legacy_instance_dir" ]; then
-  mv "$legacy_instance_dir" "$instance_dir"
-fi
-
-mkdir -vp "$instance_dir"
-cd "$instance_dir" || exit 1
-
-token_hash_file="$instance_dir/.token-hash"
-token_hash_current="$(printf '%s' "$TOKEN" | sha256sum | cut -d' ' -f1)"
-token_hash_stored="$(cat "$token_hash_file" 2>/dev/null || echo "")"
-labels_file="$instance_dir/.labels"
-labels_wanted="$(printf '%s\n' "$@" | sort)"
-labels_current="$(cat "$labels_file" 2>/dev/null || echo 0)"
-
-if [ ! -e "$instance_dir/.runner" ] || [ "$labels_wanted" != "$labels_current" ] || [ "$token_hash_current" != "$token_hash_stored" ]; then
-  rm -v "$instance_dir/.runner" || true
-
-  gitea-runner register --no-interactive \
-    --instance "$runner_url" \
-    --token "$TOKEN" \
-    --name "jeeves-$(hostname)" \
-    --labels "$runner_labels" \
-    --config "$runner_config_file"
-
-  printf '%s' "$token_hash_current" > "$token_hash_file"
-  printf '%s\n' "$labels_wanted" > "$labels_file"
-fi

systems/jeeves/scripts/zfs.sh

@@ -17,7 +17,6 @@ sudo zpool create scratch -o ashift=12 -O acltype=posixacl -O atime=off -O dnode
 # media datasets
 sudo zfs create media/temp -o sync=disabled -o redundant_metadata=none
 sudo zfs create media/secure -o encryption=aes-256-gcm -o keyformat=hex -o keylocation=file:///root/zfs.key
-sudo zfs create media/secure/containers -o mountpoint=/zfs/media/containers -o compression=lz4 -o sync=disabled -o redundant_metadata=some -o normalization=none -o utf8only=off
 sudo zfs create media/secure/docker -o compression=zstd-9
 sudo zfs create media/secure/github-runners -o compression=zstd-9 -o sync=disabled
 sudo zfs create media/secure/notes -o copies=2

systems/jeeves/services/gitea.nix

@@ -19,7 +19,6 @@ in
       actions = {
         ENABLED = true;
         DEFAULT_ACTIONS_URL = "github";
-        ENDLESS_TASK_TIMEOUT = "12h";
       };
       service.DISABLE_REGISTRATION = true;
       server = {

systems/jeeves/snapshot_config.toml

@@ -23,12 +23,6 @@ hourly = 0
 daily = 0
 monthly = 0
 
-["root_pool/nix_build"]
-15_min = 1
-hourly = 0
-daily = 0
-monthly = 0
-
 ["root_pool/var"]
 15_min = 8
 hourly = 24
@@ -66,12 +60,6 @@ daily = 30
 monthly = 12
 
 # media
-["media/secure/containers"]
-15_min = 2
-hourly = 0
-daily = 0
-monthly = 0
-
 ["media/temp"]
 15_min = 2
 hourly = 0

systems/jeeves/vars.nix

@@ -5,7 +5,6 @@ let
 in
 {
   inherit zfs_media zfs_storage zfs_scratch;
-  containers = "${zfs_media}/containers";
   database = "${zfs_media}/database";
   docker = "${zfs_media}/docker";
   docker_configs = "${zfs_media}/docker/configs";

systems/portal-1/default.nix

@@ -10,12 +10,13 @@
     "${inputs.self}/users/richie"
     "${inputs.self}/common/global"
     "${inputs.self}/common/optional/tailscale.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
     ./disk-config.nix
     ./haproxy
     ./monitoring.nix
   ];
 
+  nixpkgs.hostPlatform = "x86_64-linux";
+
   boot = {
     # Avoid consuming the VM's limited memory for /tmp.
     tmp.useTmpfs = false;

systems/rhapsody-in-green/default.nix

@@ -9,7 +9,6 @@
     "${inputs.self}/common/optional/syncthing_base.nix"
     "${inputs.self}/common/optional/systemd-boot.nix"
     "${inputs.self}/common/optional/tailscale.nix"
-    "${inputs.self}/common/optional/x86-64-v3.nix"
     "${inputs.self}/common/optional/yubikey.nix"
     "${inputs.self}/common/optional/zfs"
     ./hardware.nix

systems/rhapsody-in-green/hardware.nix

@@ -34,22 +34,14 @@
       device = "root_pool/root";
       fsType = "zfs";
     };
-
     "/home" = {
       device = "root_pool/home";
       fsType = "zfs";
     };
-
-    "/nix/var/nix/builds" = {
-      device = "root_pool/nix_build";
-      fsType = "zfs";
-    };
-
     "/var" = {
       device = "root_pool/var";
       fsType = "zfs";
     };
-
     "/boot" = {
       device = "/dev/disk/by-uuid/12CE-A600";
       fsType = "vfat";

users/dov/default.nix

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  ...
+}:
+{
+
+  users = {
+    users.dov = {
+      isNormalUser = true;
+
+      shell = pkgs.zsh;
+      group = "dov";
+      openssh.authorizedKeys.keys = [
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCoSBmMfvp6aThkrfkLQ4TDwZJD0HCC0lsTIRNREIAWeduNkVFdkO3T1SMLmCKJ+zlL9xziNBEqB8NFl4TabAhptIGlKgTOc8C9eDaPQMQV8PB/4DxZhCt7O2qb4Vfcz82IHPtdwwaIsGpssgh81mQ4tPtP8BI0TluRBy+2v095s20j+PYRGrAXJtOWpVY9zaXxEJ8dXDhHDF2xzxvUcwu9NsoY8t+4/ZJ1mrTTG+eGp5gLAKnSVhAGgsmqCY577Nkso1jSzKer1XcCiaGIedpLuTzmUbOFFEVhhTSy+Ki1NLEcjGW2e6Vyg5Pm8VGN75MqyDZsi5igv9Grxq62EHQ4mFea9rns48B74O/bNQ1OoLVO9u/HwdLCgBTZzptrCmNwML6kBWrmCogoH3ueVbHwDCW5kTTMBCoVV+HaZ+qDWu7xZVx49MuCK29QGZj/IrN0N7h78KL0NYajdei87R0mcmWGP0YaJTdCQ4iKi9c77BUYQp+Qpqt+mnIX0cgjQOU= dkruger@kzin" # cspell:disable-line
+      ];
+      extraGroups = [
+        "audio"
+        "video"
+        "users"
+      ];
+      uid = 1004;
+    };
+
+    groups.dov.gid = 1004;
+  };
+}

users/dov/home/cli/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./direnv.nix
+    ./git.nix
+    ./zsh.nix
+  ];
+
+  programs.starship.enable = true;
+}

users/dov/home/cli/direnv.nix

@@ -0,0 +1,8 @@
+{
+
+  programs.direnv = {
+    enable = true;
+    enableZshIntegration = true;
+    nix-direnv.enable = true;
+  };
+}

users/dov/home/cli/git.nix

@@ -0,0 +1,15 @@
+{
+  programs.git = {
+    enable = true;
+    signing.format = null;
+    settings = {
+      user = {
+        email = "dov.kruger@gmail.com";
+        name = "Dov Kruger";
+      };
+      pull.rebase = true;
+      color.ui = true;
+    };
+    lfs.enable = true;
+  };
+}

users/dov/home/cli/zsh.nix

@@ -0,0 +1,27 @@
+{
+  programs.zsh = {
+    enable = true;
+    syntaxHighlighting.enable = true;
+    history.size = 10000;
+    oh-my-zsh = {
+      enable = true;
+      plugins = [
+        "git"
+        "docker"
+        "docker-compose"
+        "colored-man-pages"
+        "rust"
+        "systemd"
+        "tmux"
+        "ufw"
+        "z"
+      ];
+    };
+    shellAliases = {
+      "lrt" = "eza --icons -lsnew";
+      "ls" = "eza";
+      "ll" = "eza --long --group";
+      "la" = "eza --all";
+    };
+  };
+}

users/dov/home/global.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  imports = [
+    ./cli
+    ./programs.nix
+    ./ssh_config.nix
+  ];
+
+  programs = {
+    home-manager.enable = true;
+    git.enable = true;
+  };
+
+  home = {
+    username = "dov";
+    homeDirectory = "/home/${config.home.username}";
+    stateVersion = "24.05";
+    sessionVariables = {
+      FLAKE = "$HOME/dotfiles";
+    };
+  };
+}

users/dov/home/programs.nix

@@ -0,0 +1,56 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    # cli
+    bat
+    btop
+    eza
+    fd
+    ffmpegthumbnailer
+    fzf
+    git
+    gnupg
+    imagemagick
+    jq
+    ncdu
+    ouch
+    p7zip
+    poppler
+    rar
+    ripgrep
+    starship
+    tmux
+    unzip
+    yazi
+    zoxide
+    # system info
+    hwloc
+    lynis
+    pciutils
+    smartmontools
+    usbutils
+    # networking
+    iperf3
+    nmap
+    wget
+    # python
+    ruff
+    uv
+    # nodejs
+    nodejs
+    # Rust packages
+    trunk
+    wasm-pack
+    cargo-watch
+    cargo-generate
+    cargo-audit
+    cargo-update
+    # nix
+    nix-init
+    nix-output-monitor
+    nix-prefetch
+    nix-tree
+    nixfmt
+    treefmt
+  ];
+}

users/dov/home/ssh_config.nix

@@ -0,0 +1,6 @@
+{
+  programs.ssh = {
+    enable = true;
+    enableDefaultConfig = false;
+  };
+}

users/dov/systems/jeeves.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ../home/global.nix
+  ];
+}

users/math/home/programs.nix

@@ -3,17 +3,54 @@
   home.packages = with pkgs; [
     # cli
     bat
+    btop
+    eza
+    fd
+    ffmpegthumbnailer
     fzf
     git
+    gnupg
+    imagemagick
     jq
     ncdu
-    fastfetch
+    ouch
     p7zip
+    poppler
     rar
+    ripgrep
+    starship
+    tmux
     unzip
+    yazi
     zoxide
+    # system info
+    hwloc
+    lynis
+    pciutils
+    smartmontools
+    usbutils
+    # networking
+    iperf3
+    nmap
+    wget
     # python
     ruff
     uv
+    # nodejs
+    nodejs
+    # Rust packages
+    trunk
+    wasm-pack
+    cargo-watch
+    cargo-generate
+    cargo-audit
+    cargo-update
+    # nix
+    nix-init
+    nix-output-monitor
+    nix-prefetch
+    nix-tree
+    nixfmt
+    treefmt
   ];
 }

users/richie/home/gui/default.nix

@@ -1,12 +1,12 @@
-{ pkgs, ... }:
+{ inputs, pkgs, ... }:
 {
   imports = [
-    ./comms.nix
+    "${inputs.self}/users/shared/comms.nix"
+    "${inputs.self}/users/shared/games.nix"
+    "${inputs.self}/users/shared/sweet.nix"
     ./firefox
-    ./games.nix
     ./kitty.nix
     ./llm_tools.nix
-    ./sweet.nix
     ./t3_code
     ./vscode
   ];

users/richie/home/programs.nix

@@ -3,14 +3,21 @@
   home.packages = with pkgs; [
     # cli
     bat
+    fd
+    ffmpegthumbnailer
     fzf
     git
+    gnupg
+    imagemagick
     jq
     ncdu
     fastfetch
+    ouch
     p7zip
+    poppler
     rar
     unzip
+    yazi
     zoxide
     # Home Assistant
     esphome
@@ -28,6 +35,8 @@
     # python
     ruff
     uv
+    # nodejs
+    nodejs
     # Rust packages
     bacon
     cargo
@@ -42,6 +51,9 @@
     rustfmt
     trunk
     wasm-pack
+    # cpp
+    clang-tools
+    clang_20
     # nix
     nix-init
     nix-output-monitor
@@ -49,5 +61,6 @@
     nix-tree
     nixfmt
     treefmt
+    codebase-memory-mcp
   ];
 }

users/steve/default.nix

@@ -0,0 +1,44 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+let
+  ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
+in
+{
+
+  users = {
+    users.steve = {
+      isNormalUser = true;
+
+      shell = pkgs.zsh;
+      group = "steve";
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJH03VzDbUhzfhvwD+OsYh6GobODYaI9jdNdzWQoqFsp matth@Jove" # cspell:disable-line
+      ];
+      extraGroups = [
+        "audio"
+        "video"
+        "wheel"
+        "users"
+      ]
+      ++ ifTheyExist [
+        "dialout"
+        "docker"
+        "hass"
+        "libvirtd"
+        "networkmanager"
+        "plugdev"
+        "scanner"
+        "transmission"
+        "uaccess"
+        "wireshark"
+      ];
+      uid = 1005;
+    };
+
+    groups.steve.gid = 1005;
+  };
+  home-manager.users.steve = import ./systems/${config.networking.hostName}.nix;
+}

users/steve/home/cli/default.nix

@@ -0,0 +1,9 @@
+{
+  imports = [
+    ./direnv.nix
+    ./git.nix
+    ./zsh.nix
+  ];
+
+  programs.starship.enable = true;
+}

users/steve/home/cli/direnv.nix

@@ -0,0 +1,8 @@
+{
+
+  programs.direnv = {
+    enable = true;
+    enableZshIntegration = true;
+    nix-direnv.enable = true;
+  };
+}

users/steve/home/cli/git.nix

@@ -0,0 +1,15 @@
+{
+  programs.git = {
+    enable = true;
+    signing.format = null;
+    settings = {
+      user = {
+        email = "matthew.michal11@gmail.com";
+        name = "Matthew Michal";
+      };
+      pull.rebase = true;
+      color.ui = true;
+    };
+    lfs.enable = true;
+  };
+}

users/steve/home/cli/zsh.nix

@@ -0,0 +1,28 @@
+{
+  programs.zsh = {
+    enable = true;
+    syntaxHighlighting.enable = true;
+    history.size = 10000;
+    oh-my-zsh = {
+      enable = true;
+      plugins = [
+        "git"
+        "docker"
+        "docker-compose"
+        "colored-man-pages"
+        "rust"
+        "systemd"
+        "tmux"
+        "ufw"
+        "z"
+      ];
+    };
+    shellAliases = {
+      "lrt" = "eza --icons -lsnew";
+      "ls" = "eza";
+      "ll" = "eza --long --group";
+      "la" = "eza --all";
+
+    };
+  };
+}

users/steve/home/global.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+{
+  imports = [
+    ./cli
+    ./programs.nix
+    ./ssh_config.nix
+  ];
+
+  programs = {
+    home-manager.enable = true;
+    git.enable = true;
+  };
+
+  home = {
+    username = "steve";
+    homeDirectory = "/home/${config.home.username}";
+    stateVersion = "24.05";
+    sessionVariables = {
+      FLAKE = "$HOME/dotfiles";
+    };
+  };
+}

users/steve/home/programs.nix

@@ -0,0 +1,56 @@
+{ pkgs, ... }:
+{
+  home.packages = with pkgs; [
+    # cli
+    bat
+    btop
+    eza
+    fd
+    ffmpegthumbnailer
+    fzf
+    git
+    gnupg
+    imagemagick
+    jq
+    ncdu
+    ouch
+    p7zip
+    poppler
+    rar
+    ripgrep
+    starship
+    tmux
+    unzip
+    yazi
+    zoxide
+    # system info
+    hwloc
+    lynis
+    pciutils
+    smartmontools
+    usbutils
+    # networking
+    iperf3
+    nmap
+    wget
+    # python
+    ruff
+    uv
+    # nodejs
+    nodejs
+    # Rust packages
+    trunk
+    wasm-pack
+    cargo-watch
+    cargo-generate
+    cargo-audit
+    cargo-update
+    # nix
+    nix-init
+    nix-output-monitor
+    nix-prefetch
+    nix-tree
+    nixfmt
+    treefmt
+  ];
+}

users/steve/home/ssh_config.nix

@@ -0,0 +1,6 @@
+{
+  programs.ssh = {
+    enable = true;
+    enableDefaultConfig = false;
+  };
+}

users/steve/systems/bob.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ../home/global.nix
+  ];
+}

users/steve/systems/jeeves.nix

@@ -0,0 +1,5 @@
+{
+  imports = [
+    ../home/global.nix
+  ];
+}