Update nixpkgs 2025-11-24-02-03

flake.lock

@@ -650,11 +650,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1764950072,
+        "lastModified": 1763678758,
-        "narHash": "sha256-BmPWzogsG2GsXZtlT+MTcAWeDK5hkbGRZTeZNW42fwA=",
+        "narHash": "sha256-+hBiJ+kG5IoffUOdlANKFflTT5nO3FrrR2CA3178Y5s=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f61125a668a320878494449750330ca58b78c557",
+        "rev": "117cc7f94e8072499b0a7aa4c52084fa4e11cc9b",
         "type": "github"
       },
       "original": {

hosts/dn42-il-gw1/configuration.nix

@@ -4,8 +4,6 @@
   imports =
     [
       ./hardware-configuration.nix
-
-      ./documentation.nix
     ];
 
   profiles.clerie.mercury-vm.enable = true;
@@ -43,28 +41,6 @@
 
   networking.wireguard.enable = true;
   networking.wireguard.interfaces = {
-    # dn42-router-general-wireguard-key public key:
-    # r38qvXqu26x4f6yUGxg44Ji4db/g2HK7RZwG7Boh+38=
-
-    # darkpoint
-    wg0150 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg0150 fe80::2574/128 peer fe80::150/128
-      '';
-      listenPort = 50150;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "fra.darkpoint.xyz:22574";
-          publicKey = "nfoxTtmJdBdxNR3TmfVLG13KA5E+ZtU+uIGCegxrxxw=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
     # e1mo
     wg0565 = {
       ips = [
@@ -86,45 +62,6 @@
       ];
       privateKeyFile = config.sops.secrets.wg0565.path;
     };
-    # pilz
-    wg0663 = {
-      ips = [
-        "fe80::1111/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg0663 fe80::1111/128 peer fe80::acab/128
-      '';
-      listenPort = 50663;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "dn42.ams1.as214958.net:163";
-          publicKey = "NxHkdwZPVL+3HdrHTFOslUpUckTf0dzEG9qpZ0FTBnA=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
-    # prefixlabs
-    # https://prefixlabs.net/
-    wg1240 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg1240 fe80::2574/128 peer fe80::1240:11/128
-      '';
-      listenPort = 51240;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "de-01.prefixlabs.net:22574";
-          publicKey = "ixeEBfac1BXpjNKbxcgL6Beg9HTgtmq6CjHIfMwNSDw=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.wg1240.path;
-    };
     # fooker
     wg1271 = {
       ips = [
@@ -183,25 +120,25 @@
       ];
       privateKeyFile = config.sops.secrets.wg1280.path;
     };
-    # c4tg1rl5
+    # lutoma
-    # https://catgirls.systems/peering/
+    wg4719 = {
-    wg1411 = {
       ips = [
-        "fe80::2574/128"
+        #"fe80::1/128"
+        # peer fe80::acab/128
       ];
       postSetup = ''
-      ip addr replace dev wg1411 fe80::2574/128 peer fe80::1411/128
+      ip addr add dev wg4719 fe80::1/128 peer fe80::acab/128
       '';
-      listenPort = 51411;
+      listenPort = 54719;
       allowedIPsAsRoutes = false;
       peers = [
-        #{
+        {
-        #  allowedIPs = [ "fe80::/10" "fd00::/8" ];
+          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-        #  endpoint = "";
+          endpoint = "[2603:c020:8001:ed42::42]:42546";
-        #  publicKey = "";
+          publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ=";
-        #}
+        }
       ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
+      privateKeyFile = config.sops.secrets.wg4719.path;
     };
     # zaphyra
     wg1718 = {
@@ -223,101 +160,15 @@
       ];
       privateKeyFile = config.sops.secrets.wg1718.path;
     };
-    # iedon
-    # https://iedon.net/
-    wg2189 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg2189 fe80::2574/128 peer fe80::2189:e9/128
-      '';
-      listenPort = 52189;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "de-fra.dn42.iedon.net:42463";
-          publicKey = "FHp0OR4UpAS8/Ra0FUNffTk18soUYCa6NcvZdOgxY0k=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
-    # jona / cryne
-    wg3402 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg3402 fe80::2574/128 peer fe80::3402/128
-      '';
-      listenPort = 53402;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "dn42.cryne.me:42574";
-          publicKey = "YsKInIp90is8ysnQDHGoKnz2CqlTMWMZDmQ+vwvN2C0=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
-    # lutoma
-    wg4719 = {
-      ips = [
-        #"fe80::1/128"
-        # peer fe80::acab/128
-      ];
-      postSetup = ''
-      ip addr add dev wg4719 fe80::1/128 peer fe80::acab/128
-      '';
-      listenPort = 54719;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "[2603:c020:8001:ed42::42]:42546";
-          publicKey = "MkVyCgIq0BOStFIu2/Wl91ofFuRvnG3ZqTWFfVs/VlQ=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.wg4719.path;
-    };
-    # tbspace
-    wg6190 = {
-      ips = [
-        "fe80::2574/128"
-      ];
-      postSetup = ''
-      ip addr replace dev wg6190 fe80::2574/128 peer fe80::1299:e/128
-      '';
-      listenPort = 56190;
-      allowedIPsAsRoutes = false;
-      peers = [
-        {
-          allowedIPs = [ "fe80::/10" "fd00::/8" ];
-          endpoint = "dn42.tbspace.de:49168";
-          publicKey = "skvyDl81J8Zu3Ziem+7JKeU4UYLhhWt7gWelg8nEbzQ=";
-        }
-      ];
-      privateKeyFile = config.sops.secrets.dn42-router-general-wireguard-key.path;
-    };
   };
 
   networking.firewall.allowedUDPPorts = [
-    50150 # wg0150
     50565 # wg0565
-    50663 # wg0663
-    51240 # wg1240
-    51241 # wg1241
     51271 # wg1271
     51272 # wg1272
     51280 # wg1280
-    51411 # wg1411
-    51718 # wg1718
-    52189 # wg2189
-    53402 # wg3402
     54719 # wg4719
-    56190 # wg6190
+    51718 # wg1718
   ];
 
   profiles.clerie.dn42-router = {
@@ -341,13 +192,6 @@
     ];
 
     wireguardPeers = [
-      {
-        peerName = "peer_0150";
-        remoteAddress = "fe80::150";
-        interfaceName = "wg0150";
-        remoteAsn = "4242420150";
-        localAddress = "fe80::2574";
-      }
       {
         peerName = "peer_0565";
         remoteAddress = "fe80::565";
@@ -355,20 +199,6 @@
         remoteAsn = "4242420565";
         localAddress = "fe80::2574";
       }
-      {
-        peerName = "peer_0663";
-        remoteAddress = "fe80::acab";
-        interfaceName = "wg0663";
-        remoteAsn = "4242420663";
-        localAddress = "fe80::1111";
-      }
-      {
-        peerName = "peer_1240_de_01";
-        remoteAddress = "fe80::1240:11";
-        interfaceName = "wg1240";
-        remoteAsn = "4242421240";
-        localAddress = "fe80::2574";
-      }
       {
         peerName = "peer_1271_north";
         remoteAddress = "fe80::2";
@@ -390,34 +220,6 @@
         remoteAsn = "4242421280";
         localAddress = "fde3:4c0d:2836:ff00::21";
       }
-      {
-        peerName = "peer_1411_de_fsn";
-        remoteAddress = "fe80::1411";
-        interfaceName = "wg1411";
-        remoteAsn = "4242421411";
-        localAddress = "fe80::2574";
-      }
-      {
-        peerName = "peer_1718";
-        remoteAddress = "fe80::6b61";
-        interfaceName = "wg1718";
-        remoteAsn = "4242421718";
-        localAddress = "fe80::2574";
-      }
-      {
-        peerName = "peer_2189_de_fra";
-        remoteAddress = "fe80::2189:e9";
-        interfaceName = "wg2189";
-        remoteAsn = "4242422189";
-        localAddress = "fe80::2574";
-      }
-      {
-        peerName = "peer_3402";
-        remoteAddress = "fe80::3402";
-        interfaceName = "wg3402";
-        remoteAsn = "4242423402";
-        localAddress = "fe80::2574";
-      }
       {
         peerName = "peer_4719";
         remoteAddress = "fe80::acab";
@@ -426,10 +228,10 @@
         localAddress = "fe80::1";
       }
       {
-        peerName = "peer_6190";
+        peerName = "peer_1718";
-        remoteAddress = "fe80::1299:e";
+        remoteAddress = "fe80::6b61";
-        interfaceName = "wg6190";
+        interfaceName = "wg1718";
-        remoteAsn = "76190";
+        remoteAsn = "4242421718";
         localAddress = "fe80::2574";
       }
     ];

hosts/dn42-il-gw1/documentation.nix

@@ -1,21 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-
-  services.nginx.enable = true;
-
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  services.nginx.virtualHosts = {
-    "${config.networking.fqdn}" = {
-      enableACME = true;
-      forceSSL = true;
-      root = pkgs.writeTextFile {
-        name = "dn42-router-documentation";
-        text = config.profiles.clerie.dn42-router.htmlDocumentation;
-        destination = "/index.html";
-      };
-    };
-  };
-
-}

hosts/dn42-il-gw1/secrets.json

@@ -1,8 +1,6 @@
 {
-	"dn42-router-general-wireguard-key": "ENC[AES256_GCM,data:z1qOABBiObnWgcJDSnCHCfttJdDXQ3LO+Y/uHblJg49wrxTostamnP6GuvE=,iv:0KTyNqMOLQue8UODWXF2I+sY4pVKVe0aNiVETC9zOzk=,tag:KOzS9HaR6plPA0HlMT8jhQ==,type:str]",
 	"wg0197": "ENC[AES256_GCM,data:1QJ5GXLMLIOj6xNC4sMnShjyB1wqfTkhkPTlLJz6AJxMjA0BsBZvZ1Pdln4=,iv:nVRIQB8/Ged616ELhkGnDyAz6A+3HQ55+yG0vf0f7aQ=,tag:GtI8ICMCih1tN4Xoc+8RdQ==,type:str]",
 	"wg0565": "ENC[AES256_GCM,data:kLgKOGDA+kPDB0SZ/yU7Ax7NYn28LiVT2W6zSsc0APfyoZWW6nF0fUQFv4s=,iv:6zjLGAOROifubQUMxRLvoFzN6GRYob841rzNiVyrt84=,tag:Gh15/ROPYiqqobcJcTzmGQ==,type:str]",
-	"wg1240": "ENC[AES256_GCM,data:ta0FRxhDGeta6TpWghWP2ogqymtiVsnWvuwzOhqhGN6zyK/GYd5b+SgSYAI=,iv:9gxEtK+ZOFj0D/SNWV7GyWHkBXjGgofJPmqcu3CMMKo=,tag:MFE/bhGk6oLeOK4TaEoXgQ==,type:str]",
 	"wg1271": "ENC[AES256_GCM,data:NPcFMxVNpwoPkLsb6NvZVxGxw+Og3RzlYx7TAL9nT95x6I8aDRpOnR5tY5w=,iv:gYuem6vX+jRQvirrt3lZQb5gKnN/z32W/MgmGuzQ/Ks=,tag:I9qZJSNKFEM3Vx4Yugxy1w==,type:str]",
 	"wg1272": "ENC[AES256_GCM,data:LU6jtNkNn2Xs+0OH8cD1HJnbHsNNnqlY83lDFa11/dHwVgdFxMtDXMqIMEc=,iv:/A8rWGR6jExa4ms7jTYC0eZVGCvlKw1I58Co41gw3TU=,tag:tIBRkQzFFpEEzflnDrpcOA==,type:str]",
 	"wg1280": "ENC[AES256_GCM,data:F4KLY6jiZNl52ko32nM0iTER0DyHvaCSmxeYAKB0MLUD8l9u1Ugk6kYZnUc=,iv:XcaxnvxM1kE/ahNFX+BH7Jmr9q2Py1vHHqOjFUqs5O8=,tag:a1up4gGFqyHz2lmDRJl3bA==,type:str]",
@@ -17,8 +15,8 @@
 				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3QWdFYjFjTmRVRlV3U3p4\nTSsyc1E0dWtiYjNtVkV2SXJEWkxnTDhLN1Y0Cng4aGlidjhydUVGaFcvK215aGdq\nN0FGajYwa1lPUCsva0tmNkErUGtlOWsKLS0tIG9pLzJEUDA2WWUzd1kzSVZrdVRX\nbUxjQzBCd3p0R1dWTTJaRmZNQjJEUVkKPz6OUQHpYrhRxMdQzpZRR3exVqkG2JvX\nI32PwvbeQK8cgpYwKLGar8U8aiPPm0Y64pID1wedDsNZzLqLOrS3wQ==\n-----END AGE ENCRYPTED FILE-----\n"
 			}
 		],
-		"lastmodified": "2025-12-03T20:44:07Z",
+		"lastmodified": "2025-06-10T20:51:10Z",
-		"mac": "ENC[AES256_GCM,data:GL2GWM7YcGxfKWh9Vt0wm6YqbXTgqskkVHzsTTWqcQWhzbtqyWfFebli77UsDYoCYSR+yiPhi2opF1oMJl6Jr44PtmpPk+WGPUrcjuVDuf0NueaW8j++nzJzSFEnHeTbIg8qNpb9FwapWM0jlHVkGo6RVwVa9E597U/AKdES9ww=,iv:s3ABxKoCcEUOjtnvDGcrJoEiwXC0imLLO0kEXT+/69s=,tag:Vzk6aKDRwD6T60G0pDF9Jw==,type:str]",
+		"mac": "ENC[AES256_GCM,data:9lF4HV0oJyGHXdtYdMxR7+ev7JLAQVr6kE55nLoZcrbC92MHJzQpgM9XAhIynvwdAmC7ARd3orCn6eYkQJDdNX0JjMtebsBE+H4B7mEUCz8wtTN0iHS+oHmQxrqjnoSw2uHh9udgqAJa+sd6VGU3t2XUuuKtVHPwzROqVgvas9M=,iv:KT+BlFeXGZQc5pbBX+XOsmKEydUtir1LuPvseDkFeqw=,tag:hlRskY6b5EAZkUYs7ph/JA==,type:str]",
 		"pgp": [
 			{
 				"created_at": "2024-04-28T09:25:37Z",
@@ -27,6 +25,6 @@
 			}
 		],
 		"unencrypted_suffix": "_unencrypted",
-		"version": "3.11.0"
+		"version": "3.10.2"
 	}
 }

profiles/common-nix/default.nix

@@ -32,8 +32,8 @@ in {
 
     nix.gc = lib.mkDefault {
       automatic = true;
-      dates = "daily";
+      dates = "weekly";
-      options = "--delete-older-than 16d";
+      options = "--delete-older-than 30d";
     };
 
 

profiles/common-ssh/default.nix

@@ -2,33 +2,13 @@
 
 with lib;
 
-let
+{
-
-  cfg = config.profiles.clerie.common-ssh;
-
-  knownHostsFiles = [
-    "/etc/ssh/ssh_known_hosts"
-  ] ++ cfg.knownHostsFiles;
-
-in {
 
   options.profiles.clerie.common-ssh = {
     enable = mkEnableOption "Common ssh config";
-    knownHostsFiles = mkOption {
-      type = with types; listOf str;
-      default = [];
-      description = "List of paths to ssh known hosts files";
-    };
   };
 
-  config = mkIf cfg.enable {
+  config = mkIf config.profiles.clerie.common-ssh.enable {
-
-    assertions = [
-      {
-        assertion = config.programs.ssh.knownHostsFiles == [];
-        message = "profiles.clerie.common-ssh sets a custom set of global known hosts file that is incompatible with the settings from the official NixOS module, use profiles.clerie.common-ssh.knownHostsFiles instead";
-      }
-    ];
 
     services.openssh.enable = true;
     services.openssh.settings = {
@@ -41,16 +21,11 @@ in {
       { type = "ed25519"; path = "/etc/ssh/ssh_host_ed25519_key"; }
     ];
 
-    profiles.clerie.common-ssh.knownHostsFiles = [
+    programs.ssh.knownHostsFiles = [
       (pkgs.clerie-ssh-known-hosts + "/known_hosts")
       (pkgs.fem-ssh-known-hosts + "/known_hosts")
       (pkgs.well-known-ssh-known-hosts + "/known_hosts")
     ];
 
-    programs.ssh.extraConfig = ''
-      Host *
-      GlobalKnownHostsFile ${builtins.concatStringsSep " " knownHostsFiles}
-    '';
-
   };
 }

profiles/common-webserver/default.nix

@@ -53,8 +53,10 @@ in {
           default = true;
           rejectSSL = true;
           locations."/" = {
-            # Terminate connection without response
+            return = ''200 "Some piece of infrastructure\n"'';
-            return = ''444'';
+            extraConfig = ''
+              types { } default_type "text/plain; charset=utf-8";
+            '';
           };
         };
       };

profiles/desktop/gnome.nix

@@ -34,7 +34,6 @@ with lib;
       evolution
       gnome-terminal
       gnome-tweaks
-      gnome-decoder # scan qr codes
     ];
 
     services.gnome.evolution-data-server.enable = true;

profiles/dn42-router/default.nix

@@ -11,9 +11,6 @@ let
   bgp6Table = 2342;
 
 in {
-  imports = [
-    ./documentation.nix
-  ];
 
   options.profiles.clerie.dn42-router = {
     enable = mkEnableOption "DN42 router base config";
@@ -96,10 +93,6 @@ in {
       type = types.str;
       default = "";
     };
-    htmlDocumentation = mkOption {
-      type = types.str;
-      description = "This option is set by the module itself and contains the documentation for this router setup";
-    };
   };
 
   config = mkIf config.profiles.clerie.dn42-router.enable {

profiles/dn42-router/documentation.nix

@@ -1,88 +0,0 @@
-{ config, lib, ... }:
-
-with lib;
-
-let
-
-  cfg = config.profiles.clerie.dn42-router;
-
-in {
-
-  profiles.clerie.dn42-router.htmlDocumentation = ''
-    <!DOCTYPE html>
-    <html lang="en">
-      <head>
-      </head>
-      <body>
-        <h1>${config.networking.fqdn}</h1>
-
-        <p>This is a router in the <a href="https://wiki.dn42.us/">experimental decentralized network dn42</a>.</p>
-
-        <p>If you like to peer, please drop me an email to <a href="mailto:dn42@clerie.de">dn42@clerie.de</a>.</p>
-
-        <p>Happy peering!</p>
-
-        <h2>Router Information</h2>
-
-        <ul>
-          <li>ASN: <code>AS4242422574</code></li>
-          <li>Loopback IP: <code>${cfg.loopbackIp}</code></li>
-          <li>Router ID: <code>${cfg.routerId}</code></li>
-        </ul>
-
-        <h2>Wireguard Peers</h2>
-
-        <table>
-        ${concatMapStringsSep "\n" (peer: ''
-          <tr>
-            <td>${peer.peerName}</td>
-            <td><a href="https://explorer.burble.com/#/aut-num/AS${peer.remoteAsn}">AS${peer.remoteAsn}</a></td>
-            <td>
-              <details>
-                <summary>Peering config</summary>
-                <ul>
-                  <li>Local Endpoint: <code>${config.networking.fqdn}:???</code></li>
-                  <li>Local Address: <code>${peer.localAddress}</code></li>
-                  <li>Local ASN: <code>AS4242422574</code></li>
-                </ul>
-                <ul>
-                  <li>Remote Endpoint: <code>???</code></li>
-                  <li>Remote Address: <code>${peer.remoteAddress}</code></li>
-                  <li>Remote ASN: <code>AS${peer.remoteAsn}</code></li>
-                </ul>
-              </details>
-            </td>
-            <td><a href="https://map.iedon.net/#${peer.remoteAsn}">[Map]</a></td>
-          </tr>
-        '') cfg.wireguardPeers}
-        </table>
-
-        <h2>BGP Peers</h2>
-
-        <table>
-        ${concatMapStringsSep "\n" (peer: ''
-          <tr>
-            <td>${peer.peerName}</td>
-            <td>AS${peer.remoteAsn}</td>
-            <td>
-              <details>
-                <summary>Peering config</summary>
-                <ul>
-                  <li>Local Address: <code>${peer.localAddress}</code></li>
-                  <li>Local ASN: <code>AS4242422574</code></li>
-                </ul>
-                <ul>
-                  <li>Remote Address: <code>${peer.remoteAddress}</code></li>
-                  <li>Remote ASN: <code>AS${peer.remoteAsn}</code></li>
-                </ul>
-              </details>
-            </td>
-            <td><a href="https://map.iedon.net/#${peer.remoteAsn}">[Map]</a></td>
-          </tr>
-        '') cfg.bgpPeers}
-        </table>
-      </body>
-    </html>
-  '';
-
-}

profiles/ds-lite/default.nix

@@ -92,7 +92,6 @@ in {
         RuntimeDirectory = "ds-lite-dhcpcd";
 
         ExecStart = "${pkgs.ds-lite-dhcpcd}/bin/dhcpcd --ipv6only --nobackground --config ${dsLiteDhcpcdConfigFile} --script ${dsLiteDhcpcdHookWrapperFile}";
-        ExecReload = "${pkgs.ds-lite-dhcpcd}/bin/dhcpcd --ipv6only --nobackground --config ${dsLiteDhcpcdConfigFile} --script ${dsLiteDhcpcdHookWrapperFile} --rebind";
 
         Restart = "always";
         AmbientCapabilities = [

profiles/hetzner-storage-box-client/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 
 with lib;
 
@@ -10,9 +10,9 @@ with lib;
 
   config = mkIf config.profiles.clerie.hetzner-storage-box-client.enable {
 
-    profiles.clerie.common-ssh.knownHostsFiles = [
+   programs.ssh.knownHostsFiles = [
-      (pkgs.copyPathToStore ./hetzner-storage-box-ssh_known_hosts)
+     ./hetzner-storage-box-ssh_known_hosts
-    ];
+   ];
 
  };