Update nixpkgs 2025-08-31-01-03

flake.lock

@@ -404,26 +404,6 @@
         "url": "https://git.clerie.de/clerie/mitel_ommclient2.git"
       }
     },
-    "mu5001tool": {
-      "inputs": {
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1757627777,
-        "narHash": "sha256-NGUqHQ+/BaUhjgSYQauTihTtNyhhnQRMJ8t7ZSPNpmk=",
-        "ref": "refs/heads/main",
-        "rev": "b7b0f0d5191433bca1377f7d818b800627a83fda",
-        "revCount": 9,
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/mu5001tool.git"
-      },
-      "original": {
-        "type": "git",
-        "url": "https://git.clerie.de/clerie/mu5001tool.git"
-      }
-    },
     "nix2container": {
       "flake": false,
       "locked": {
@@ -666,11 +646,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1760284886,
+        "lastModified": 1756542300,
-        "narHash": "sha256-TK9Kr0BYBQ/1P5kAsnNQhmWWKgmZXwUQr4ZMjCzWf2c=",
+        "narHash": "sha256-tlOn88coG5fzdyqz6R93SQL5Gpq+m/DsWpekNFhqPQk=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "cf3f5c4def3c7b5f1fc012b3d839575dbe552d43",
+        "rev": "d7600c775f877cd87b4f5a831c28aa94137377aa",
         "type": "github"
       },
       "original": {
@@ -763,7 +743,6 @@
         "hydra": "hydra",
         "lix": "lix_2",
         "lix-module": "lix-module",
-        "mu5001tool": "mu5001tool",
         "nixos-exporter": "nixos-exporter",
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_5",

flake.nix

@@ -40,10 +40,6 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     fieldpoc.url = "git+https://git.clerie.de/clerie/fieldpoc.git";
-    mu5001tool = {
-      url = "git+https://git.clerie.de/clerie/mu5001tool.git";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     nixos-exporter = {
       url = "git+https://git.clerie.de/clerie/nixos-exporter.git";
       inputs.nixpkgs.follows = "nixpkgs";

flake/inputs-overlay.nix

@@ -5,7 +5,6 @@
 , chaosevents
 , harmonia
 , hydra
-, mu5001tool
 , nurausstieg
 , rainbowrss
 , scan-to-gpg
@@ -26,8 +25,6 @@ final: prev: {
     harmonia;
   inherit (hydra.packages.${final.system})
     hydra;
-  inherit (mu5001tool.packages.${final.system})
-    mu5001tool;
   inherit (nurausstieg.packages.${final.system})
     nurausstieg;
   inherit (rainbowrss.packages.${final.system})

hosts/astatine/configuration.nix

@@ -4,10 +4,6 @@
   imports =
     [
       ./hardware-configuration.nix
-
-      ./grafana.nix
-      ./mu5001tool.nix
-      ./prometheus.nix
     ];
 
   profiles.clerie.network-fallback-dhcp.enable = true;
@@ -22,16 +18,6 @@
     terminal_output serial
   ";
 
-  sops.secrets.monitoring-htpasswd = {
-    owner = "nginx";
-    group = "nginx";
-  };
-  services.nginx = {
-    enable = true;
-  };
-
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
   profiles.clerie.wg-clerie = {
     enable = true;
     ipv6s = [ "2a01:4f8:c0c:15f1::8108/128" ];

hosts/astatine/grafana.nix

@@ -1,45 +0,0 @@
-{ config, ... }:
-{
-  services.grafana = {
-    enable  = true;
-    settings = {
-      server = {
-        domain = "grafana.astatine.net.clerie.de";
-        root_url = "https://grafana.astatine.net.clerie.de";
-        http_port = 3001;
-        http_addr = "::1";
-      };
-      "auth.anonymous" = {
-        enabled = true;
-      };
-    };
-
-    provision = {
-      enable = true;
-      datasources.settings.datasources = [
-        {
-          type = "prometheus";
-          name = "Prometheus";
-          url = "http://[::1]:9090";
-          isDefault = true;
-        }
-      ];
-    };
-  };
-
-  services.nginx = {
-    virtualHosts = {
-      "grafana.astatine.net.clerie.de" = {
-        enableACME = true;
-        forceSSL   = true;
-        basicAuthFile = config.sops.secrets.monitoring-htpasswd.path;
-        locations."/".proxyPass = "http://[::1]:3001/";
-        locations."= /api/live/ws" = {
-          proxyPass = "http://[::1]:3001";
-          proxyWebsockets = true;
-        };
-      };
-    };
-  };
-
-}

hosts/astatine/mu5001tool.nix

@@ -1,18 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-{
-
-  systemd.services."mu5001tool" = {
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      DynamicUser = true;
-      LoadCredential = "zte-hypermobile-5g-password:${config.sops.secrets."zte-hypermobile-5g-password".path}";
-      Restart = "on-failure";
-      RestartSec = "15s";
-    };
-    script = ''
-      ${lib.getExe pkgs.mu5001tool} --password-file ''${CREDENTIALS_DIRECTORY}/zte-hypermobile-5g-password prometheus-exporter --listen-port 9242
-    '';
-  };
-
-}

hosts/astatine/prometheus.nix

@@ -1,46 +0,0 @@
-{ config, ... }:
-
-{
-  services.prometheus = {
-    enable = true;
-    enableReload = true;
-    listenAddress = "[::1]";
-    scrapeConfigs = [
-      {
-        job_name = "prometheus";
-        scrape_interval = "20s";
-        scheme = "http";
-        static_configs = [
-          {
-            targets = [
-              "[::1]:9090"
-            ];
-          }
-        ];
-      }
-      {
-        job_name = "mu5001tool";
-        scrape_interval = "20s";
-        static_configs = [
-          {
-            targets = [
-              "[::1]:9242"
-            ];
-          }
-        ];
-      }
-    ];
-  };
-
-  services.nginx = {
-    virtualHosts = {
-      "prometheus.astatine.net.clerie.de" = {
-        enableACME = true;
-        forceSSL   = true;
-        basicAuthFile = config.sops.secrets.monitoring-htpasswd.path;
-        locations."/".proxyPass = "http://[::1]:9090/";
-      };
-    };
-  };
-
-}

hosts/astatine/secrets.json

@@ -1,17 +1,19 @@
 {
 	"wg-clerie": "ENC[AES256_GCM,data:DbchcO6GTmSFyoHrRAkfu2flaKYrQHPk+rIerekYO4Cto9sqaWLgaSigpS8=,iv:no1xNRVqsKzAN6ssYA0Ir+utOM9tg8OBUT9PY2v0HPA=,tag:lZj1wEPFWHaf52N7YHEQKQ==,type:str]",
 	"wg-monitoring": "ENC[AES256_GCM,data:dTKKeieaGvECkHUpATLorhOgr9Re5CAH25y1WTcSqJZDsvnwD4CBbqMv2QQ=,iv:u1n1wyAW5aNcVYfGN8BmrEhIhtA3EfRDBNu65IdBZMI=,tag:RJYgOpel9uy6dC72MmqS5A==,type:str]",
-	"monitoring-htpasswd": "ENC[AES256_GCM,data:0uQ+Gwedi9kTaOzrwVzkNkS9qL0Dwmph1leK2sj/TndfSn3yaq7ur7ZHoPjWUl5Oy1poxU2rIUxWHajYC0n3yHv2AuGT,iv:FyH4MHcgW5iHkAsahNFtshnqqPOMlukg8aYfhcN9onw=,tag:q3BsnyKLrKYi/xDP6GmSkA==,type:str]",
-	"zte-hypermobile-5g-password": "ENC[AES256_GCM,data:lqxQICmWYwMejn8=,iv:TPYOs/cL/ETw7Ee0+YG/+Fhd7ASi0kr4rDLEiste+2Y=,tag:6O6AXIHkIjPm7hJVC4Y/1g==,type:str]",
 	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
 		"age": [
 			{
 				"recipient": "age1fffvnazdv3ys9ww8v4g832hv5nkvnk6d728syerzvpgskfmfkq8q00whpv",
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMQUF5dkRwdXRmUkJ1SXN5\nLzdOVkhWYUJGdFd4Qklsa1BXeVZlTGx0eDE0ClZmYWNLMEVzaVVXWGkwQUt5ZHF5\nS1c5OU9PWjBTelM5R2phNFdVNncxUUkKLS0tIDlwSXFyZWNVT1dtdGU5dVFSRHNE\nUUpJZHJZRTd6TnBUU2dCWW90UTRVb0UKCWrHWmQTNhez16wgEKj4EQA4+UBRmGQn\n+NHSjBCMBmmTdHb05nENYVK515Z0T/60+9N3VlNyHWS9IgC3mZRUBg==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-09-08T21:03:41Z",
+		"lastmodified": "2024-04-21T16:03:13Z",
-		"mac": "ENC[AES256_GCM,data:ztS/Z6mn8hFAPsks2evJRJFocw/3oz22O2HeSEkY7Mu+bfNvClsJuvuTbnDadB0IwKiLDFWRMGs/UPFmNP6J/euro4cFHDWXopdXg7eDFGDoJDKIg4fBUtofdXIqWvDoQ9LeZNvc5Z4EEQYhs3LwFnAU0x15acwIIxr5TB9l8g8=,iv:WVjavmcrEs2CyYTfoTTP44c9TqFubUdE+PBN2jRPR+s=,tag:fBXzU69Q9MwD3o/Nyu5OZA==,type:str]",
+		"mac": "ENC[AES256_GCM,data:fA8fhOZbX30TYgwZXB7sQDNmck0JRDyAnEXf5nCYtli/Qvs78fTs4DdC08VOpOni8uAVARkFsGSo6Fjo/MpTSDVA8VNYZig/we/bWF+LQlEMCmiqwOI1R6eQ3GPxcRXltlO2aPPlT9BpLwIVZjGGjIsmjpVE8xjkCbLUUqj+UxY=,iv:fHLyw96QLVRrAQky2kR7TDDxf8CNXDV9lVQ5RETzJEI=,tag:y+cG9u3d6vCUmPyNMDRWpA==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-04-21T16:02:41Z",

hosts/krypton/programs.nix

@@ -11,8 +11,6 @@
     signal-desktop
     dino
     fractal
-    tuba
-    flare-signal
 
     tio
     xournalpp
@@ -25,7 +23,6 @@
     wireshark
     tcpdump
     nmap
-    pkgs."http.server"
 
     kdePackages.okular
     chromium-incognito

hosts/storage-2/em.nix

@@ -11,28 +11,7 @@ with lib;
   };
   users.groups.data-em = {};
 
-  users.users.data-em-mp3 = {
-    group = "data-em-mp3";
-    home = "/data/em-mp3";
-    useDefaultShell = true;
-    isSystemUser = true;
-  };
-  users.groups.data-em-mp3 = {};
-
   systemd.tmpfiles.rules = [
     "d /data/em - data-em data-em - -"
-    "d /data/em-mp3 - data-em-mp3 data-em-mp3 - -"
   ];
-
-  systemd.services.convert-flac-dir-to-mp3 = {
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = "${lib.getExe pkgs.convert-flac-dir-to-mp3} /data/em /data/em-mp3";
-      StateDirectory = "convert-flac-dir-to-mp3";
-      WorkingDirectory = "/var/lib/convert-flac-dir-to-mp3";
-      User = "data-em-mp3";
-      Group = "data-em-mp3";
-    };
-    startAt = "*-*-* 03:47:00";
-  };
 }

hosts/storage-2/mixcloud.nix

@@ -53,23 +53,17 @@ in {
     "mixcloud.clerie.de" = {
       enableACME = true;
       forceSSL = true;
-      basicAuthFile = config.sops.secrets.mixcloud-htpasswd.path;
       locations."/" = {
         alias = "/data/mixcloud/";
+        basicAuthFile = config.sops.secrets.mixcloud-htpasswd.path;
         extraConfig = ''
           autoindex on;
           autoindex_exact_size off;
         '';
       };
-      locations."/api/" = {
-        alias = "/data/mixcloud/";
-        extraConfig = ''
-          autoindex on;
-          autoindex_format json;
-        '';
-      };
       locations."/media/" = {
         alias = "/data/media/";
+        basicAuthFile = config.sops.secrets.mixcloud-htpasswd.path;
         extraConfig = ''
           autoindex on;
           autoindex_exact_size off;

pkgs/build-support/writePythonScript.nix

@@ -1,7 +1,6 @@
 {
   python3,
-  makeWrapper,
+  writeTextFile,
-  runCommand,
   lib,
 }:
 
@@ -10,7 +9,6 @@
   text,
   runtimePackages ? ps: [],
   pythonPackage ? python3,
-  runtimeInputs ? [],
   meta ? {},
   passthru ? {},
   derivationArgs ? {},
@@ -20,17 +18,13 @@ let
 
   pythonWithPackages = pythonPackage.withPackages runtimePackages;
 
-in runCommand name ({
+in writeTextFile {
-  passAsFile = [ "text" ] ++ (derivationArgs.passAsFile or []);
+  inherit
-
+    name
-  meta = {
+    meta
-    mainProgram = name;
+    passthru
-  } // meta // (derivationArgs.meta or {});
+    derivationArgs
-
+    ;
-  passthru = passthru // (derivationArgs.passthru or {});
-
-  nativeBuildInputs = [ makeWrapper ] ++ (derivationArgs.nativeBuildInputs or []);
-
   executable = true;
   destination = "/bin/${name}";
   allowSubstitutes = true;
@@ -40,17 +34,4 @@ in runCommand name ({
 
     ${text}
   '';
-} // (
+}
-  builtins.removeAttrs derivationArgs [ "passAsFile" "meta" "passthru" "nativeBuildInputs" ]
-))
-''
-mkdir -p $out/bin
-
-target=$out/bin/${lib.escapeShellArg name}
-
-cp "$textPath" "$target"
-
-chmod +x "$target"
-
-wrapProgram "$target" --prefix PATH : "${lib.makeBinPath runtimeInputs}"
-''

pkgs/convert-flac-dir-to-mp3/convert-flac-dir-to-mp3.py

@@ -1,109 +0,0 @@
-#!/usr/bin/env python
-
-import argparse
-from pathlib import Path
-from progress.bar import Bar
-import shutil
-import subprocess
-
-def files_and_dirs_for_directory(path):
-    filepaths = []
-    dirpaths = []
-
-    for dirpath, dirnames, filenames in path.walk():
-        dirpaths.append(dirpath)
-
-        for filename in filenames:
-            filepath = dirpath / filename
-            filepaths.append(filepath)
-
-    return set(filepaths), set(dirpaths)
-
-def make_paths_relative(paths, relative_to_path):
-    return set(path.relative_to(relative_to_path) for path in paths)
-
-def replace_suffix(path, suffix):
-    return path.with_name(path.stem + suffix)
-
-def convert_filepath(path):
-    if path.suffix == ".flac":
-        return replace_suffix(path, ".mp3")
-
-    return path
-
-def ffmpeg_flac_to_mp3(in_path, out_path):
-    print("")
-    subprocess.run(["ffmpeg", "-hide_banner", "-loglevel", "warning", "-stats", "-i", in_path, "-ab", "320k", "-map_metadata", "0", "-id3v2_version", "3", out_path], check=True)
-    print("")
-
-if __name__ == "__main__":
-
-    parser = argparse.ArgumentParser(prog="convert-flac-dir-to-mp3")
-    parser.add_argument("from_dir", type=Path)
-    parser.add_argument("to_dir", type=Path)
-
-    args = parser.parse_args()
-
-    from_path = args.from_dir.absolute()
-    to_path = args.to_dir.absolute()
-
-    if not from_path.exists():
-        raise Exception("from_path does not exist")
-
-    if not to_path.exists():
-        raise Exception("to_path does not exist")
-
-    if not from_path.is_dir():
-        raise Exception("from_path is not a directory")
-
-    if not to_path.is_dir():
-        raise Exception("to_path is not a directory")
-
-    print(f"Converting {from_path} to {to_path}…")
-
-    from_filepaths, from_dirpaths = files_and_dirs_for_directory(from_path)
-    to_filepaths, to_dirpaths = files_and_dirs_for_directory(to_path)
-
-
-    relative_from_filepaths = make_paths_relative(from_filepaths, from_path)
-    relative_to_filepaths = make_paths_relative(to_filepaths, to_path)
-
-    converted_from_filepaths = set(convert_filepath(filepath) for filepath in relative_from_filepaths)
-
-    filepaths_missing_in_to_path = converted_from_filepaths - relative_to_filepaths
-
-
-    relative_from_dirpaths = make_paths_relative(from_dirpaths, from_path)
-    relative_to_dirpaths = make_paths_relative(to_dirpaths, to_path)
-
-    dirpaths_missing_in_to_path = relative_from_dirpaths - relative_to_dirpaths
-
-    print(f"Missing {len(filepaths_missing_in_to_path)} files and {len(dirpaths_missing_in_to_path)} directories")
-
-    if len(dirpaths_missing_in_to_path) > 0:
-        for dirpath in Bar("Creating directories").iter(dirpaths_missing_in_to_path):
-            (to_path / dirpath).mkdir(parents=True, exist_ok=True)
-
-    if len(filepaths_missing_in_to_path) > 0:
-        for filepath in Bar("Creating files").iter(filepaths_missing_in_to_path):
-            if filepath in relative_from_filepaths:
-                # Just copy the file
-                shutil.copy(from_path / filepath, to_path / filepath)
-            elif filepath.suffix == ".mp3" and replace_suffix(filepath, ".flac") in relative_from_filepaths:
-                # Convert from flac
-                print("")
-                print(f"Converting {to_path / filepath}…")
-
-                # Tempfile for ffmpeg
-                tmpfilepath = filepath.with_name(".~" + filepath.name)
-                (to_path / tmpfilepath).unlink(missing_ok=True)
-
-                print(f"Using tempfile for ffmpeg {to_path / tmpfilepath}…")
-
-                # Convert
-                ffmpeg_flac_to_mp3(from_path / replace_suffix(filepath, ".flac"), to_path / tmpfilepath)
-
-                # Rename tempfile
-                (to_path / tmpfilepath).rename(to_path / filepath)
-            else:
-                raise Exception("Unable to figure out how to get {to_path / filepath} from {from_path}")

pkgs/convert-flac-dir-to-mp3/default.nix

@@ -1,8 +0,0 @@
-{ pkgs, ... }:
-
-pkgs.clerie-build-support.writePythonScript {
-  name = "convert-flac-dir-to-mp3";
-  runtimePackages = ps: with ps; [ progress ];
-  runtimeInputs = [ pkgs.ffmpeg-headless ];
-  text = builtins.readFile ./convert-flac-dir-to-mp3.py;
-}

pkgs/curl-timings/curl-timings.sh

@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-
-curl -w "Request to %{url}
-
-time_namelookup: %{time_namelookup}s
-time_connect: %{time_connect}s
-time_appconnect: %{time_appconnect}s
-time_pretransfer: %{time_pretransfer}s
-time_starttransfer: %{time_starttransfer}s
-time_posttransfer: %{time_posttransfer}s
-time_queue: %{time_queue}s
-time_redirect: %{time_redirect}s
-time_starttransfer: %{time_starttransfer}s
-
-time_total: %{time_total}s
-" -o /dev/null -s "$@"

pkgs/curl-timings/default.nix

@@ -1,12 +0,0 @@
-{
-  curl,
-  writeShellApplication,
-}:
-
-writeShellApplication {
-  name = "curl-timings";
-  text = builtins.readFile ./curl-timings.sh;
-  runtimeInputs = [
-    curl
-  ];
-}

pkgs/grow-last-partition-and-filesystem/default.nix

@@ -1,6 +1,5 @@
 {
   e2fsprogs,
-  gptfdisk,
   jq,
   parted,
   writeShellApplication,
@@ -11,7 +10,6 @@ writeShellApplication {
   text = builtins.readFile ./grow-last-partition-and-filesystem.sh;
   runtimeInputs = [
     e2fsprogs
-    gptfdisk
     jq
     parted
   ];

pkgs/grow-last-partition-and-filesystem/grow-last-partition-and-filesystem.sh

@@ -11,9 +11,6 @@ fi
 
 DEVICE="$1"
 
-echo "Move GTP backup header to end of disk"
-sgdisk "${DEVICE}" --move-second-header
-
 PARTITIONDATA="$(parted --script --json --fix "${DEVICE}" print)"
 PARTNUMBER="$(echo "${PARTITIONDATA}" | jq -r '.disk.partitions | last | .number')"
 PARTNAME="$(echo "${PARTITIONDATA}" | jq -r '.disk.partitions | last | .name')"

pkgs/http.server/default.nix

@@ -1,14 +0,0 @@
-{
-  python3,
-  writeShellApplication,
-}:
-
-writeShellApplication {
-  name = "http.server";
-  text = ''
-    python3 -m http.server "$@"
-  '';
-  runtimeInputs = [
-    python3
-  ];
-}

pkgs/overlay.nix

@@ -12,8 +12,6 @@ final: prev: {
   clerie-sops-edit = final.callPackage ./clerie-sops/clerie-sops-edit.nix {};
   clerie-update-nixfiles = final.callPackage ./clerie-update-nixfiles/clerie-update-nixfiles.nix {};
   chromium-incognito = final.callPackage ./chromium-incognito {};
-  convert-flac-dir-to-mp3 = final.callPackage ./convert-flac-dir-to-mp3 {};
-  curl-timings = final.callPackage ./curl-timings {};
   factorio-launcher = final.callPackage ./factorio-launcher {};
   feeds-dir = final.callPackage ./feeds-dir {};
   generate-blocked-prefixes = final.callPackage ./generate-blocked-prefixes {};
@@ -22,7 +20,6 @@ final: prev: {
   git-pp = final.callPackage ./git-pp {};
   git-show-link = final.callPackage ./git-show-link {};
   grow-last-partition-and-filesystem = final.callPackage ./grow-last-partition-and-filesystem {};
-  "http.server" = final.callPackage ./http.server {};
   nix-remove-result-links = final.callPackage ./nix-remove-result-links {};
   nixfiles-auto-install = final.callPackage ./nixfiles/nixfiles-auto-install.nix {};
   nixfiles-generate-config = final.callPackage ./nixfiles/nixfiles-generate-config.nix {};