Update nixpkgs 2025-11-17-02-03

docs/mkdocs.yml

@@ -1,14 +0,0 @@
-docs_dir: pages
-site_name: clerie's nixfiles
-repo_url: https://git.clerie.de/clerie/nixfiles
-repo_name: clerie/nixfiles
-edit_uri: src/branch/master/docs/pages/
-
-theme:
-  name: material
-  features:
-    - content.action.edit
-    - navigation.indexes
-    - navigation.tabs
-  palette:
-    primary: deep purple

docs/pages/Options.md

@@ -1,3 +0,0 @@
-# Options
-
-This page is generated on build time.

docs/pages/Packages.md

@@ -1,3 +0,0 @@
-# Packages
-
-This page is generated on build time.

docs/pages/index.md

@@ -1,6 +0,0 @@
----
-hide:
-  - navigation
----
-
-# Home

flake.lock

@@ -552,6 +552,22 @@
         "type": "github"
       }
     },
+    "nixpkgs-carbon": {
+      "locked": {
+        "lastModified": 1751206202,
+        "narHash": "sha256-VjK8pEv4cfDpCTh4KW1go98kP25j7KdTNEce342Bh/Y=",
+        "owner": "clerie",
+        "repo": "nixpkgs",
+        "rev": "ac4ac98609c1b30c378458ab7207a9a5b5148457",
+        "type": "github"
+      },
+      "original": {
+        "owner": "clerie",
+        "ref": "clerie/always-setup-netdevs",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "nixpkgs-regression": {
       "locked": {
         "lastModified": 1643052045,
@@ -650,11 +666,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1764667669,
-        "narHash": "sha256-7WUCZfmqLAssbDqwg9cUDAXrSoXN79eEEq17qhTNM/Y=",
+        "lastModified": 1762977756,
+        "narHash": "sha256-4PqRErxfe+2toFJFgcRKZ0UI9NSIOJa+7RXVtBhy4KE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "418468ac9527e799809c900eda37cbff999199b6",
+        "rev": "c5ae371f1a6a7fd27823bc500d9390b38c05fa55",
         "type": "github"
       },
       "original": {
@@ -752,6 +768,7 @@
         "nixos-hardware": "nixos-hardware",
         "nixpkgs": "nixpkgs_5",
         "nixpkgs-0dc1c7": "nixpkgs-0dc1c7",
+        "nixpkgs-carbon": "nixpkgs-carbon",
         "nurausstieg": "nurausstieg",
         "rainbowrss": "rainbowrss",
         "scan-to-gpg": "scan-to-gpg",

flake.nix

@@ -1,6 +1,7 @@
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    nixpkgs-carbon.url = "github:clerie/nixpkgs/clerie/always-setup-netdevs";
     # for etesync-dav
     nixpkgs-0dc1c7.url = "github:NixOS/nixpkgs/0dc1c7294c13f5d1dd6eccab4f75d268d7296efe";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";

hosts/carbon/ppp-ncfttb.nix

@@ -60,10 +60,4 @@
     ip46tables -t mangle -A forward-mangle -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
   '';
 
-  networking.firewall.extraCommands = ''
-    # Reject all IPv4 traffic that tries to enter and leave the PPP tunnel
-    iptables -I INPUT -i ppp-ncfttb -j DROP
-    iptables -I OUTPUT -o ppp-ncfttb -j DROP
-  '';
-
 }

hosts/carbon/wg-clerie.nix

@@ -1,10 +1,10 @@
 { ... }:
 
 {
-  # services.wg-clerie = {
-  #   enable = true;
-  #   ipv6s = [ "2a01:4f8:c0c:15f1::8111/128" ];
-  #   ipv4s = [ "10.20.30.111/32" ];
-  #   defaultViaVPN = false;
-  # };
+  services.wg-clerie = {
+    enable = true;
+    ipv6s = [ "2a01:4f8:c0c:15f1::8111/128" ];
+    ipv4s = [ "10.20.30.111/32" ];
+    defaultViaVPN = false;
+  };
 }

hosts/dn42-il-gw1/configuration.nix

@@ -4,8 +4,6 @@
   imports =
     [
       ./hardware-configuration.nix
-
-      ./documentation.nix
     ];
 
   profiles.clerie.mercury-vm.enable = true;
@@ -43,28 +41,6 @@
 
   networking.wireguard.enable = true;
   networking.wireguard.interfaces = {
-    # dn42-router-general-wireguard-key public key:
-    # r38qvXqu26x4f6yUGxg44Ji4db/g2HK7RZwG7Boh+38=
-
-    # darkpoint
-    wg0150 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg0150 fe80::2574/128 peer fe80::150/128
-      '';
-      listenPort = 50150;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "fra.darkpoint.xyz:22574";
-          publicKey = "nfoxTtmJdBdxNR3TmfVLG13KA5E+ZtU+uIGCegxrxxw=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
     # e1mo
     wg0565 = {
       ips = [
@@ -86,45 +62,6 @@
       ];
       privateKeyFile = config.sops.secrets.wg0565.path;
     };
-    # pilz
-    wg0663 = {
-      ips = [
-        "fe80::1111/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg0663 fe80::1111/128 peer fe80::acab/128
-      '';
-      listenPort = 50663;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "dn42.ams1.as214958.net:163";
-          publicKey = "NxHkdwZPVL+3HdrHTFOslUpUckTf0dzEG9qpZ0FTBnA=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
-    # prefixlabs
-    # https://prefixlabs.net/
-    wg1240 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg1240 fe80::2574/128 peer fe80::1240:11/128
-      '';
-      listenPort = 51240;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "de-01.prefixlabs.net:22574";
-          publicKey = "ixeEBfac1BXpjNKbxcgL6Beg9HTgtmq6CjHIfMwNSDw=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.wg1240.path;
-    };
     # fooker
     wg1271 = {
       ips = [
@@ -227,8 +164,6 @@
 
   networking.firewall.allowedUDPPorts = [
     50565 # wg0565
-    51240 # wg1240
-    51241 # wg1241
     51271 # wg1271
     51272 # wg1272
     51280 # wg1280
@@ -257,13 +192,6 @@
     ];
 
     wireguardPeers = [
-      {
-        peerName = "peer_0150";
-        remoteAddress = "fe80::150";
-        interfaceName = "wg0150";
-        remoteAsn = "4242420150";
-        localAddress = "fe80::2574";
-      }
       {
         peerName = "peer_0565";
         remoteAddress = "fe80::565";
@@ -271,20 +199,6 @@
         remoteAsn = "4242420565";
         localAddress = "fe80::2574";
       }
-      {
-        peerName = "peer_0663";
-        remoteAddress = "fe80::acab";
-        interfaceName = "wg0663";
-        remoteAsn = "4242420663";
-        localAddress = "fe80::1111";
-      }
-      {
-        peerName = "peer_1240_de_01";
-        remoteAddress = "fe80::1240:11";
-        interfaceName = "wg1240";
-        remoteAsn = "4242421240";
-        localAddress = "fe80::2574";
-      }
       {
         peerName = "peer_1271_north";
         remoteAddress = "fe80::2";

hosts/dn42-il-gw1/documentation.nix

@@ -1,21 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-
-  services.nginx.enable = true;
-
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  services.nginx.virtualHosts = {
-    "${config.networking.fqdn}" = {
-      enableACME = true;
-      forceSSL = true;
-      root = pkgs.writeTextFile {
-        name = "dn42-router-documentation";
-        text = config.profiles.clerie.dn42-router.htmlDocumentation;
-        destination = "/index.html";
-      };
-    };
-  };
-
-}

hosts/dn42-il-gw1/secrets.json

@@ -1,8 +1,6 @@
 {
-	"dn42-router-general-wireguard-key": "ENC[AES256_GCM,data:z1qOABBiObnWgcJDSnCHCfttJdDXQ3LO+Y/uHblJg49wrxTostamnP6GuvE=,iv:0KTyNqMOLQue8UODWXF2I+sY4pVKVe0aNiVETC9zOzk=,tag:KOzS9HaR6plPA0HlMT8jhQ==,type:str]",
 	"wg0197": "ENC[AES256_GCM,data:1QJ5GXLMLIOj6xNC4sMnShjyB1wqfTkhkPTlLJz6AJxMjA0BsBZvZ1Pdln4=,iv:nVRIQB8/Ged616ELhkGnDyAz6A+3HQ55+yG0vf0f7aQ=,tag:GtI8ICMCih1tN4Xoc+8RdQ==,type:str]",
 	"wg0565": "ENC[AES256_GCM,data:kLgKOGDA+kPDB0SZ/yU7Ax7NYn28LiVT2W6zSsc0APfyoZWW6nF0fUQFv4s=,iv:6zjLGAOROifubQUMxRLvoFzN6GRYob841rzNiVyrt84=,tag:Gh15/ROPYiqqobcJcTzmGQ==,type:str]",
-	"wg1240": "ENC[AES256_GCM,data:ta0FRxhDGeta6TpWghWP2ogqymtiVsnWvuwzOhqhGN6zyK/GYd5b+SgSYAI=,iv:9gxEtK+ZOFj0D/SNWV7GyWHkBXjGgofJPmqcu3CMMKo=,tag:MFE/bhGk6oLeOK4TaEoXgQ==,type:str]",
 	"wg1271": "ENC[AES256_GCM,data:NPcFMxVNpwoPkLsb6NvZVxGxw+Og3RzlYx7TAL9nT95x6I8aDRpOnR5tY5w=,iv:gYuem6vX+jRQvirrt3lZQb5gKnN/z32W/MgmGuzQ/Ks=,tag:I9qZJSNKFEM3Vx4Yugxy1w==,type:str]",
 	"wg1272": "ENC[AES256_GCM,data:LU6jtNkNn2Xs+0OH8cD1HJnbHsNNnqlY83lDFa11/dHwVgdFxMtDXMqIMEc=,iv:/A8rWGR6jExa4ms7jTYC0eZVGCvlKw1I58Co41gw3TU=,tag:tIBRkQzFFpEEzflnDrpcOA==,type:str]",
 	"wg1280": "ENC[AES256_GCM,data:F4KLY6jiZNl52ko32nM0iTER0DyHvaCSmxeYAKB0MLUD8l9u1Ugk6kYZnUc=,iv:XcaxnvxM1kE/ahNFX+BH7Jmr9q2Py1vHHqOjFUqs5O8=,tag:a1up4gGFqyHz2lmDRJl3bA==,type:str]",
@@ -17,8 +15,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3QWdFYjFjTmRVRlV3U3p4\nTSsyc1E0dWtiYjNtVkV2SXJEWkxnTDhLN1Y0Cng4aGlidjhydUVGaFcvK215aGdq\nN0FGajYwa1lPUCsva0tmNkErUGtlOWsKLS0tIG9pLzJEUDA2WWUzd1kzSVZrdVRX\nbUxjQzBCd3p0R1dWTTJaRmZNQjJEUVkKPz6OUQHpYrhRxMdQzpZRR3exVqkG2JvX\nI32PwvbeQK8cgpYwKLGar8U8aiPPm0Y64pID1wedDsNZzLqLOrS3wQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-12-03T20:44:07Z",
-		"mac": "ENC[AES256_GCM,data:GL2GWM7YcGxfKWh9Vt0wm6YqbXTgqskkVHzsTTWqcQWhzbtqyWfFebli77UsDYoCYSR+yiPhi2opF1oMJl6Jr44PtmpPk+WGPUrcjuVDuf0NueaW8j++nzJzSFEnHeTbIg8qNpb9FwapWM0jlHVkGo6RVwVa9E597U/AKdES9ww=,iv:s3ABxKoCcEUOjtnvDGcrJoEiwXC0imLLO0kEXT+/69s=,tag:Vzk6aKDRwD6T60G0pDF9Jw==,type:str]",
+		"lastmodified": "2025-06-10T20:51:10Z",
+		"mac": "ENC[AES256_GCM,data:9lF4HV0oJyGHXdtYdMxR7+ev7JLAQVr6kE55nLoZcrbC92MHJzQpgM9XAhIynvwdAmC7ARd3orCn6eYkQJDdNX0JjMtebsBE+H4B7mEUCz8wtTN0iHS+oHmQxrqjnoSw2uHh9udgqAJa+sd6VGU3t2XUuuKtVHPwzROqVgvas9M=,iv:KT+BlFeXGZQc5pbBX+XOsmKEydUtir1LuPvseDkFeqw=,tag:hlRskY6b5EAZkUYs7ph/JA==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-04-28T09:25:37Z",
@@ -27,6 +25,6 @@
 			}
 		],
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.11.0"
+		"version": "3.10.2"
 	}
 }

hosts/krypton/android.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+
+  services.udev.packages = [
+    pkgs.android-udev-rules
+  ];
+
+}

hosts/krypton/configuration.nix

@@ -5,6 +5,7 @@
     [
       ./hardware-configuration.nix
 
+      ./android.nix
       ./backup.nix
       ./etesync-dav.nix
       #./initrd.nix

modules/default.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ./policyrouting
     ./akne
     ./backup
     ./bijwerken
@@ -13,6 +14,7 @@
     ./nginx-port-forward
     ./nixfiles
     ./update-from-hydra
+    ./wg-clerie
     ./wireguard-initrd
   ];
 }

modules/minecraft-server/default.nix

@@ -42,7 +42,7 @@ let
         default = null;
         description = ''
           Directory to store Minecraft database and other state/data files.
-          When null defaulting to /var/lib/minecraft-server-''${name}
+          When null defaulting to /var/lib/minecraft-server-${name}
         '';
       };
 
@@ -50,7 +50,7 @@ let
         type = types.package;
         default = pkgs.papermc;
         defaultText = "pkgs.papermc";
-        example = literalExpression "pkgs.minecraft-server_1_12_2";
+        example = literalExample "pkgs.minecraft-server_1_12_2";
         description = "Version of minecraft-server to run.";
       };
 

modules/policyrouting/default.nix

@@ -0,0 +1,50 @@
+{ config, lib, ... }:
+
+with lib;
+
+let
+  cfg = config.petabyte.policyrouting;
+
+  ruleOpts = { ... }: {
+    options = {
+      prio = mkOption {
+        type = types.int;
+      };
+      rule = mkOption {
+        type = types.str;
+      };
+    };
+  };
+
+in {
+  options = {
+    petabyte.policyrouting = {
+      enable = mkEnableOption "Declarative Policy-Routing";
+      rules = mkOption {
+        type = with types; listOf (submodule ruleOpts);
+        default = [];
+      };
+      rules6 = mkOption {
+        type = with types; listOf (submodule ruleOpts);
+        default = [];
+      };
+      rules4 = mkOption {
+        type = with types; listOf (submodule ruleOpts);
+        default = [];
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    petabyte.policyrouting.rules = [
+      { rule = "lookup main"; prio = 32000; }
+    ];
+    networking.localCommands = ''
+      set -x
+      ip -6 rule flush
+      ip -4 rule flush
+      ${concatMapStringsSep "\n" ({ prio, rule }: "ip -6 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules6)}
+      ${concatMapStringsSep "\n" ({ prio, rule }: "ip -4 rule add ${rule} prio ${toString prio}") (cfg.rules ++ cfg.rules4)}
+    '';
+  };
+}

modules/wg-clerie/default.nix

@@ -0,0 +1,94 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.services.wg-clerie;
+in
+
+{
+  options = {
+    services.wg-clerie = {
+      enable = mkEnableOption "VPN for public static IP";
+      privateKeyFile = mkOption {
+        type = with types; nullOr str;
+        default = null;
+        description = "Path to file containing private key for wireguard interface";
+      };
+      ipv6s = mkOption {
+        type = with types; listOf str;
+        default = [];
+        description = "IPv6 interface addresses";
+      };
+      ipv4s = mkOption {
+        type = with types; listOf str;
+        default = [];
+        description = "IPv4 interface addresses";
+      };
+      defaultViaVPN = mkOption {
+        type = types.bool;
+        default = true;
+        description = "Use VPN default route for a protocol, if that protocol is unavailable in the underlay";
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.iproute2.enable = true;
+    networking.iproute2.rttablesExtraConfig = ''
+      200 wg-clerie
+    '';
+
+    petabyte.policyrouting = {
+      enable = true;
+      rules6 = (concatMap (ip: [
+        { rule = "from ${ip} lookup wg-clerie"; prio = 19000; }
+        { rule = "from ${ip} unreachable"; prio = 19001; }
+      ]) cfg.ipv6s) ++ [
+        # Do not reach VPN server via VPN
+        { rule = "to 2a01:4f8:c0c:15f1::1/128 ipproto udp dport 51820 lookup main"; prio = 20000; }
+        { rule = "to 2a01:4f8:c0c:15f1::1/128 ipproto udp dport 51820 unreachable"; prio = 20001; }
+        # Try direct routing first, fallback to VPN
+        { rule = "lookup main"; prio = 21000; }
+      ] ++ (if cfg.defaultViaVPN then [
+        { rule = "lookup wg-clerie"; prio = 21001; }
+      ] else []) ++ [
+        { rule = "unreachable"; prio = 22000; }
+      ];
+      rules4 = (concatMap (ip: [
+        { rule = "from ${ip} lookup wg-clerie"; prio = 19000; }
+        { rule = "from ${ip} unreachable"; prio = 19001; }
+      ]) cfg.ipv4s) ++ [
+        # Do not reach VPN server via VPN
+        { rule = "to 78.47.183.82/32 ipproto udp dport 51820 lookup main"; prio = 20000; }
+        { rule = "to 78.47.183.82/32 ipproto udp dport 51820 unreachable"; prio = 20001; }
+        # Try direct routing first, fallback to VPN
+        { rule = "lookup main"; prio = 21000; }
+      ] ++ (if cfg.defaultViaVPN then [
+        { rule = "lookup wg-clerie"; prio = 21001; }
+      ] else []) ++ [
+        { rule = "unreachable"; prio = 22000; }
+      ];
+    };
+
+    networking.wireguard.enable = true;
+    networking.wireguard.interfaces = {
+      wg-clerie = {
+        privateKeyFile = if cfg.privateKeyFile != null then cfg.privateKeyFile else
+          config.sops.secrets.wg-clerie.path;
+        ips = cfg.ipv6s ++ cfg.ipv4s;
+        table = "wg-clerie";
+        peers = [
+          {
+            # Fallback to legacy IP if there is no route to VPN server
+            endpoint = "$(ip route get 2a01:4f8:c0c:15f1::1 ipproto udp dport 51820 &>/dev/null && echo '[2a01:4f8:c0c:15f1::1]:51820' || echo '78.47.183.82:51820')";
+            persistentKeepalive = 25;
+            dynamicEndpointRefreshSeconds = 5;
+            allowedIPs = [ "0.0.0.0/0" "::/0" "10.20.30.0/24" "2a01:4f8:c0c:15f1::/113" ];
+            publicKey = "2p1Jqs3bkXbXHFWE6vp1yxHIFoUaZQEARS2nJzbkuBA=";
+          }
+        ];
+      };
+    };
+  };
+}

pkgs/ds-lite-dhcpcd-hook/ds-lite-dhcpcd-hook.sh

@@ -83,7 +83,7 @@ if TUNNEL_INTERFACE_CONFIG="$(ip --json link show "${TUNNEL_INTERFACE_NAME}")";
 	if [[ "${TUNNEL_INTERFACE_ORIGIN_ADDRESS}" != "${WAN_INTERFACE_ADDRESS}" || "${TUNNEL_INTERFACE_REMOTE_ADDRESS}" != "${AFTR_ADDRESS}" || "${TUNNEL_INTERFACE_OPERSTATE}" != "UNKNOWN" ]]; then
 		log_tunnel "Bad configuration, fixing tunnel parameter"
 
-		ip tunnel change "${TUNNEL_INTERFACE_NAME}" mode ipip6 local "${WAN_INTERFACE_ADDRESS}" remote "${AFTR_ADDRESS}" encaplimit none
+		ip tunnel change "${TUNNEL_INTERFACE_NAME}" mode ipip6 local "${WAN_INTERFACE_ADDRESS}" remote "${AFTR_ADDRESS}"
 		ip link set "$TUNNEL_INTERFACE_NAME" up
 	else
 		log_tunnel "Tunnel already configured"
@@ -91,7 +91,7 @@ if TUNNEL_INTERFACE_CONFIG="$(ip --json link show "${TUNNEL_INTERFACE_NAME}")";
 else
 	log_tunnel "Setting up DS-Lite tunnel"
 
-	ip tunnel add "${TUNNEL_INTERFACE_NAME}" mode ipip6 local "${WAN_INTERFACE_ADDRESS}" remote "${AFTR_ADDRESS}" encaplimit none
+	ip tunnel add "${TUNNEL_INTERFACE_NAME}" mode ipip6 local "${WAN_INTERFACE_ADDRESS}" remote "${AFTR_ADDRESS}"
 	ip link set "$TUNNEL_INTERFACE_NAME" up
 fi
 

pkgs/nixfiles-docs-generate-options-md/default.nix

@@ -1,8 +0,0 @@
-{
-  pkgs,
-}:
-
-pkgs.clerie-build-support.writePythonScript {
-  name = "nixfiles-docs-generate-options-md";
-  text = builtins.readFile ./nixfiles-docs-generate-options-md.py;
-}

pkgs/nixfiles-docs-generate-options-md/nixfiles-docs-generate-options-md.py

@@ -1,63 +0,0 @@
-#!/usr/bin/env python3
-
-import argparse
-import json
-from pathlib import Path
-
-parser = argparse.ArgumentParser(prog="generate-options-docs.py")
-parser.add_argument("options_json_file", type=Path)
-
-args = parser.parse_args()
-
-module_options = json.loads(args.options_json_file.read_text())
-
-print("""---
-hide:
-  - navigation
----
-
-# Options
-
-""")
-
-def format_option_value(option_value):
-    if not isinstance(option_value, dict):
-        option_value = {
-                "_type": "literalExpression",
-                "text": str(option_value),
-        }
-
-    match option_value["_type"]:
-        case "literalExpression":
-            if "\n" in option_value["text"]:
-                return f"```\n{option_value['text']}\n```"
-            else:
-                return f"```\n{option_value['text']}\n```"
-
-        case "literalMD":
-            return option_value["text"]
-        case other_value_type:
-            raise Exception(f"Unhandle option value type {other_value_type}")
-
-
-def print_option(option):
-    print(f"## `{option['name']}`")
-    print("")
-    if "description" in option and option["description"] is not None:
-        print(option['description'])
-        print("")
-    if "type" in option:
-        print("**Type:**")
-        print(f"`{option['type']}`")
-        print("")
-    if "default" in option:
-        print(f"**Default:**")
-        print(format_option_value(option['default']))
-        print("")
-    if "example" in option:
-        print(f"**Example:**")
-        print(format_option_value(option['example']))
-        print("")
-
-for option in module_options:
-    print_option(option)

pkgs/nixfiles-docs-generate-pkgs-md/default.nix

@@ -1,8 +0,0 @@
-{
-  pkgs,
-}:
-
-pkgs.clerie-build-support.writePythonScript {
-  name = "nixfiles-docs-generate-pkgs-md";
-  text = builtins.readFile ./nixfiles-docs-generate-pkgs-md.py;
-}

pkgs/nixfiles-docs-generate-pkgs-md/nixfiles-docs-generate-pkgs-md.py

@@ -1,30 +0,0 @@
-#!/usr/bin/env python3
-
-import argparse
-import json
-from pathlib import Path
-
-parser = argparse.ArgumentParser(prog="generate-pkgs-docs.py")
-parser.add_argument("pkgs_json_file", type=Path)
-
-args = parser.parse_args()
-
-packages = json.loads(args.pkgs_json_file.read_text())
-
-print("""---
-hide:
-  - navigation
----
-
-# Packages
-
-""")
-
-for package in packages:
-    print(f"## {package['name']}")
-    print("")
-    print("* Build status: "
-          f"[x86_64-linux](https://hydra.clerie.de/job/nixfiles/nixfiles/packages.x86_64-linux.{package['name']}) | "
-          f"[aarch64-linux](https://hydra.clerie.de/job/nixfiles/nixfiles/packages.aarch64-linux.{package['name']})"
-          )
-    print("")

pkgs/nixfiles-docs-options/default.nix

@@ -1,26 +0,0 @@
-{
-  lib,
-  writeText,
-  ...
-}:
-
-let
-  evaluatedModules = lib.evalModules {
-    modules = [
-      ../../modules
-      ../../profiles
-      {
-        _module.check = false;
-      }
-    ];
-  };
-
-in
-
-writeText "options.json" (
-  builtins.toJSON (
-    lib.filter (opt: !opt.internal && !(lib.head opt.loc == "_module")) (
-      lib.optionAttrSetToDocList evaluatedModules.options
-    )
-  )
-)

pkgs/nixfiles-docs-pkgs/default.nix

@@ -1,19 +0,0 @@
-{
-  lib,
-  pkgs,
-  writeText,
-}:
-
-let
-
-  pkgNames = builtins.filter (attrName: attrName != "nixfiles-docs-pkgs") (builtins.attrNames (import ../../pkgs/overlay.nix null null));
-  pkgsDocs = builtins.map (pkgName: {
-    name = pkgName;
-    meta = pkgs."${pkgName}".meta;
-  }) pkgNames;
-
-in
-
-writeText "pkgs.json" (
-  builtins.toJSON pkgsDocs
-)

pkgs/nixfiles-docs/default.nix

@@ -1,35 +0,0 @@
-{
-  stdenv,
-  mkdocs-material,
-  nixfiles-docs-generate-options-md,
-  nixfiles-docs-generate-pkgs-md,
-  nixfiles-docs-options,
-  nixfiles-docs-pkgs,
-}:
-
-stdenv.mkDerivation {
-  name = "nixfiles-docs";
-
-  src = ../../docs;
-
-  buildInputs = [
-    mkdocs-material
-    nixfiles-docs-generate-options-md
-    nixfiles-docs-generate-pkgs-md
-  ];
-
-  buildPhase = ''
-    nixfiles-docs-generate-options-md ${nixfiles-docs-options} > pages/Options.md
-    nixfiles-docs-generate-pkgs-md ${nixfiles-docs-pkgs} > pages/Packages.md
-    python3 -m mkdocs build
-  '';
-
-  installPhase = ''
-    mkdir -p $out
-    cp -r ./site/* $out/
-
-    mkdir -p $out/nix-support
-    echo "doc manual $out" >> $out/nix-support/hydra-build-products
-  '';
-}
-

pkgs/overlay.nix

@@ -27,11 +27,6 @@ final: prev: {
   "http.server" = final.callPackage ./http.server {};
   nix-remove-result-links = final.callPackage ./nix-remove-result-links {};
   nixfiles-auto-install = final.callPackage ./nixfiles/nixfiles-auto-install.nix {};
-  nixfiles-docs = final.python3.pkgs.callPackage ./nixfiles-docs {};
-  nixfiles-docs-generate-pkgs-md = final.callPackage ./nixfiles-docs-generate-pkgs-md {};
-  nixfiles-docs-generate-options-md = final.callPackage ./nixfiles-docs-generate-options-md {};
-  nixfiles-docs-pkgs = final.callPackage ./nixfiles-docs-pkgs {};
-  nixfiles-docs-options = final.callPackage ./nixfiles-docs-options {};
   nixfiles-generate-config = final.callPackage ./nixfiles/nixfiles-generate-config.nix {};
   nixfiles-generate-backup-secrets = final.callPackage ./nixfiles/nixfiles-generate-backup-secrets.nix {};
   nixfiles-update-ssh-host-keys = final.callPackage ./nixfiles/nixfiles-update-ssh-host-keys.nix {};

pkgs/well-known-ssh-known-hosts/well-known-ssh-known-hosts

@@ -28,12 +28,3 @@ codeberg.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTY
 codeberg.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8hZi7K1/2E2uBX8gwPRJAHvRAob+3Sn+y2hxiEhN0buv1igjYFTgFO2qQD8vLfU/HT/P/rqvEeTvaDfY1y/vcvQ8+YuUYyTwE2UaVU5aJv89y6PEZBYycaJCPdGIfZlLMmjilh/Sk8IWSEK6dQr+g686lu5cSWrFW60ixWpHpEVB26eRWin3lKYWSQGMwwKv4LwmW3ouqqs4Z4vsqRFqXJ/eCi3yhpT+nOjljXvZKiYTpYajqUC48IHAxTWugrKe1vXWOPxVXXMQEPsaIRc2hpK+v1LmfB7GnEGvF1UAKnEZbUuiD9PBEeD5a1MZQIzcoPWCrTxipEpuXQ5Tni4mN
 # SHA256:mIlxA9k46MmM6qdJOdMnAQpzGxF4WIVVL+fj+wZbw0g
 codeberg.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVIC02vnjFyL+I4RHfvIGNtOgJMe769VTF1VR4EB3ZB
-
-# Gnome Gitlab
-# From: ssh-keyscan ssh.gitlab.gnome.org
-# SHA256:WRRpoWo7szMzwlkYFeLoj0UItmVHfAI+r+hFgzwGARg
-ssh.gitlab.gnome.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCmUnZ33O26kvhcmc6k1T8xlL3yJjeNt3gphvW9/5u/CO0z5G8PGr2km4jUhStuPJR9m77LrdCF5Ywm26hsBnoxK+1zMs7YTjriiGt4r0Q5btQS5J5zFAV6aYJEmCbQz/23n8+w9Jx3hPVS8A3VE9Vd52S+5DMeIQY8QR3LPpROyCIpkR425sN0D0VjRUAH0hn61zS8N1+Pw5te2ULbBriBB9cub2n1GBCsZ2ErX1ernwKffOz/fbi5mpGbGLlJabLBm81/AiNk6NLZWTAZiNZjztxRySZFSpSzGF54kttIePxNC1x9AtW4KMaIzjVK2DIrFONyZYiEX47ox5TXlc7VQaBICUoTrR91wpb5xl2HPKP4MvFqUAzubU2V8r91ISXrnJyfwDrSB7L9Jwg6B6pN+acIttC4gOFGTJg9qanmLxtonSpwv/NaLehI1+D4LR9Or+e8jjtKSc6vu8+ghqAni3XHoT9uSmt1UPd89dOhqbpk8Hc3KTubUC3WIjGnotE=
-# SHA256:TiA9po6nO6jFso7wQNy4xLlth10lIfjv1dxuDabVIqw
-ssh.gitlab.gnome.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBH8NuGQ3ArFGochlv6TKXhMhsgIwG743e93pLkAQTzfgds0g0k6QBimb40zavVjITjytiSaQsf+KncJgUjYd98o=
-# SHA256:Y9G4dWiIfi53LR3InJWsIbv4lekUHonq/HrqTTm/rcw
-ssh.gitlab.gnome.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHG6b3deoYMPwKEu9Sj+y6MBHYYUKQiAnta/go3aNv7R

profiles/common-nix/default.nix

@@ -32,8 +32,8 @@ in {
 
     nix.gc = lib.mkDefault {
       automatic = true;
-      dates = "daily";
-      options = "--delete-older-than 16d";
+      dates = "weekly";
+      options = "--delete-older-than 30d";
     };
 
 

profiles/common-ssh/default.nix

@@ -2,33 +2,13 @@
 
 with lib;
 
-let
-
-  cfg = config.profiles.clerie.common-ssh;
-
-  knownHostsFiles = [
-    "/etc/ssh/ssh_known_hosts"
-  ] ++ cfg.knownHostsFiles;
-
-in {
+{
 
   options.profiles.clerie.common-ssh = {
     enable = mkEnableOption "Common ssh config";
-    knownHostsFiles = mkOption {
-      type = with types; listOf str;
-      default = [];
-      description = "List of paths to ssh known hosts files";
-    };
   };
 
-  config = mkIf cfg.enable {
-
-    assertions = [
-      {
-        assertion = config.programs.ssh.knownHostsFiles == [];
-        message = "profiles.clerie.common-ssh sets a custom set of global known hosts file that is incompatible with the settings from the official NixOS module, use profiles.clerie.common-ssh.knownHostsFiles instead";
-      }
-    ];
+  config = mkIf config.profiles.clerie.common-ssh.enable {
 
     services.openssh.enable = true;
     services.openssh.settings = {
@@ -41,16 +21,11 @@ in {
       { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
     ];
 
-    profiles.clerie.common-ssh.knownHostsFiles = [
+    programs.ssh.knownHostsFiles = [
       (pkgs.clerie-ssh-known-hosts + "/known_hosts")
       (pkgs.fem-ssh-known-hosts + "/known_hosts")
       (pkgs.well-known-ssh-known-hosts + "/known_hosts")
     ];
 
-    programs.ssh.extraConfig = ''
-      Host *
-      GlobalKnownHostsFile ${builtins.concatStringsSep " " knownHostsFiles}
-    '';
-
   };
 }

profiles/common-webserver/default.nix

@@ -53,8 +53,10 @@ in {
           default = true;
           rejectSSL = true;
           locations."/" = {
-            # Terminate connection without response
-            return = ''444'';
+            return = ''200 "Some piece of infrastructure\n"'';
+            extraConfig = ''
+              types { } default_type "text/plain; charset=utf-8";
+            '';
           };
         };
       };

profiles/desktop/fonts.nix

@@ -11,7 +11,7 @@ with lib;
       roboto
       roboto-mono
       noto-fonts
-      noto-fonts-color-emoji
+      noto-fonts-emoji
       comfortaa
     ] ++ (if pkgs ? "noto-fonts-cjk-sans" then [ pkgs.noto-fonts-cjk-sans ] else [ pkgs.noto-fonts-cjk ]);
 

profiles/desktop/gnome.nix

@@ -34,7 +34,6 @@ with lib;
       evolution
       gnome-terminal
       gnome-tweaks
-      gnome-decoder # scan qr codes
     ];
 
     services.gnome.evolution-data-server.enable = true;

profiles/desktop/power.nix

@@ -8,7 +8,7 @@ with lib;
 
     boot.resumeDevice = lib.optionalString ((lib.length config.swapDevices) > 0) (lib.head config.swapDevices).device;
     services.logind = {
-      settings.Login.HandleLidSwitch = "suspend-then-hibernate";
+      lidSwitch = "suspend-then-hibernate";
     };
     systemd.sleep.extraConfig = ''
       HibernateDelaySec=30m

profiles/dn42-router/default.nix

@@ -11,9 +11,6 @@ let
   bgp6Table = 2342;
 
 in {
-  imports = [
-    ./documentation.nix
-  ];
 
   options.profiles.clerie.dn42-router = {
     enable = mkEnableOption "DN42 router base config";
@@ -96,10 +93,6 @@ in {
       type = types.str;
       default = "";
     };
-    htmlDocumentation = mkOption {
-      type = types.str;
-      description = "This option is set by the module itself and contains the documentation for this router setup";
-    };
   };
 
   config = mkIf config.profiles.clerie.dn42-router.enable {

profiles/dn42-router/documentation.nix

@@ -1,88 +0,0 @@
-{ config, lib, ... }:
-
-with lib;
-
-let
-
-  cfg = config.profiles.clerie.dn42-router;
-
-in {
-
-  profiles.clerie.dn42-router.htmlDocumentation = ''
-    <!DOCTYPE html>
-    <html lang="en">
-      <head>
-      </head>
-      <body>
-        <h1>${config.networking.fqdn}</h1>
-
-        <p>This is a router in the <a href="https://wiki.dn42.us/">experimental decentralized network dn42</a>.</p>
-
-        <p>If you like to peer, please drop me an email to <a href="mailto:dn42@clerie.de">dn42@clerie.de</a>.</p>
-
-        <p>Happy peering!</p>
-
-        <h2>Router Information</h2>
-
-        <ul>
-          <li>ASN: <code>AS4242422574</code></li>
-          <li>Loopback IP: <code>${cfg.loopbackIp}</code></li>
-          <li>Router ID: <code>${cfg.routerId}</code></li>
-        </ul>
-
-        <h2>Wireguard Peers</h2>
-
-        <table>
-        ${concatMapStringsSep "\n" (peer: ''
-          <tr>
-            <td>${peer.peerName}</td>
-            <td><a href="https://explorer.burble.com/#/aut-num/AS${peer.remoteAsn}">AS${peer.remoteAsn}</a></td>
-            <td>
-              <details>
-                <summary>Peering config</summary>
-                <ul>
-                  <li>Local Endpoint: <code>${config.networking.fqdn}:???</code></li>
-                  <li>Local Address: <code>${peer.localAddress}</code></li>
-                  <li>Local ASN: <code>AS4242422574</code></li>
-                </ul>
-                <ul>
-                  <li>Remote Endpoint: <code>???</code></li>
-                  <li>Remote Address: <code>${peer.remoteAddress}</code></li>
-                  <li>Remote ASN: <code>AS${peer.remoteAsn}</code></li>
-                </ul>
-              </details>
-            </td>
-            <td><a href="https://map.iedon.net/#${peer.remoteAsn}">[Map]</a></td>
-          </tr>
-        '') cfg.wireguardPeers}
-        </table>
-
-        <h2>BGP Peers</h2>
-
-        <table>
-        ${concatMapStringsSep "\n" (peer: ''
-          <tr>
-            <td>${peer.peerName}</td>
-            <td>AS${peer.remoteAsn}</td>
-            <td>
-              <details>
-                <summary>Peering config</summary>
-                <ul>
-                  <li>Local Address: <code>${peer.localAddress}</code></li>
-                  <li>Local ASN: <code>AS4242422574</code></li>
-                </ul>
-                <ul>
-                  <li>Remote Address: <code>${peer.remoteAddress}</code></li>
-                  <li>Remote ASN: <code>AS${peer.remoteAsn}</code></li>
-                </ul>
-              </details>
-            </td>
-            <td><a href="https://map.iedon.net/#${peer.remoteAsn}">[Map]</a></td>
-          </tr>
-        '') cfg.bgpPeers}
-        </table>
-      </body>
-    </html>
-  '';
-
-}

profiles/ds-lite/default.nix

@@ -92,7 +92,6 @@ in {
         RuntimeDirectory = "ds-lite-dhcpcd";
 
         ExecStart = "${pkgs.ds-lite-dhcpcd}/bin/dhcpcd --ipv6only --nobackground --config ${dsLiteDhcpcdConfigFile} --script ${dsLiteDhcpcdHookWrapperFile}";
-        ExecReload = "${pkgs.ds-lite-dhcpcd}/bin/dhcpcd --ipv6only --nobackground --config ${dsLiteDhcpcdConfigFile} --script ${dsLiteDhcpcdHookWrapperFile} --rebind";
 
         Restart = "always";
         AmbientCapabilities = [

profiles/firefox/default.nix

@@ -12,6 +12,8 @@ with lib;
 
     programs.firefox.enable = true;
 
+    programs.firefox.package = pkgs.firefox-wayland;
+
     programs.firefox.policies = {
       AutofillAddressEnabled = false;
       AutofillCreditCardEnabled = false;

profiles/hetzner-storage-box-client/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 
 with lib;
 
@@ -10,9 +10,9 @@ with lib;
 
   config = mkIf config.profiles.clerie.hetzner-storage-box-client.enable {
 
-    profiles.clerie.common-ssh.knownHostsFiles = [
-      (pkgs.copyPathToStore ./hetzner-storage-box-ssh_known_hosts)
-    ];
+   programs.ssh.knownHostsFiles = [
+     ./hetzner-storage-box-ssh_known_hosts
+   ];
 
  };
 

profiles/router/default.nix

@@ -11,10 +11,8 @@ with lib;
   config = mkIf config.profiles.clerie.router.enable {
 
     environment.systemPackages = with pkgs; [
-      conntrack-tools
-      iptstate # show conntrack table
-      tcpdump
       wireguard-tools
+      tcpdump
     ];
   
     boot.kernel.sysctl = {