treewide: full update in some time

6 files changed, 162 insertions, 84 deletions

diff --git a/nixos/configurations/errol.nix b/nixos/configurations/errol.nix
index defacf3..ef634fb 100644
--- a/nixos/configurations/errol.nix
+++ b/nixos/configurations/errol.nix
@@ -3,13 +3,6 @@
   nixpkgs.hostPlatform.system = "x86_64-linux";
   deploy.enable = true;
 
-  cynerd = {
-    desktop.enable = true;
-    develop = true;
-    gaming = true;
-    openvpn.elektroline = true;
-  };
-
   boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage"];
   boot.kernelModules = ["kvm-amd"];
 
diff --git a/nixos/configurations/lipwig.nix b/nixos/configurations/lipwig.nix
index a02f57c..5277b39 100644
--- a/nixos/configurations/lipwig.nix
+++ b/nixos/configurations/lipwig.nix
@@ -73,62 +73,64 @@
     ];
 
     # Web ######################################################################
-    services.nginx = {
-      enable = true;
-      virtualHosts = {
-        "cynerd.cz" = {
-          forceSSL = true;
-          enableACME = true;
-          locations = {
-            "/".root = ../../web;
-            "/radicale/" = {
-              proxyPass = "http://127.0.0.1:5232/";
-              extraConfig = ''
-                proxy_set_header  X-Script-Name /radicale;
-                proxy_pass_header Authorization;
-              '';
+    services = {
+      nginx = {
+        enable = true;
+        virtualHosts = {
+          "cynerd.cz" = {
+            forceSSL = true;
+            enableACME = true;
+            locations = {
+              "/".root = ../../web;
+              "/radicale/" = {
+                proxyPass = "http://127.0.0.1:5232/";
+                extraConfig = ''
+                  proxy_set_header  X-Script-Name /radicale;
+                  proxy_pass_header Authorization;
+                '';
+              };
             };
           };
-        };
-        "git.cynerd.cz" = {
-          forceSSL = true;
-          useACMEHost = "cynerd.cz";
-          root = "${pkgs.cgit}/cgit";
-          locations."/".tryFiles = "$uri @cgit";
-          locations."@cgit".extraConfig = ''
-            fastcgi_pass unix:${config.services.fcgiwrap.instances.cgit.socket.address};
-            fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
-            fastcgi_param PATH_INFO    $uri;
-            fastcgi_param QUERY_STRING $args;
-            fastcgi_param HTTP_HOST    $server_name;
-          '';
-        };
-        "cloud.cynerd.cz" = {
-          forceSSL = true;
-          useACMEHost = "cynerd.cz";
-        };
-        "grafana.cynerd.cz" = {
-          forceSSL = true;
-          useACMEHost = "cynerd.cz";
-          locations."/" = {
-            proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
-            proxyWebsockets = true;
-            recommendedProxySettings = true;
+          "git.cynerd.cz" = {
+            forceSSL = true;
+            useACMEHost = "cynerd.cz";
+            root = "${pkgs.cgit}/cgit";
+            locations."/".tryFiles = "$uri @cgit";
+            locations."@cgit".extraConfig = ''
+              fastcgi_pass unix:${config.services.fcgiwrap.instances.cgit.socket.address};
+              fastcgi_param SCRIPT_FILENAME ${pkgs.cgit}/cgit/cgit.cgi;
+              fastcgi_param PATH_INFO    $uri;
+              fastcgi_param QUERY_STRING $args;
+              fastcgi_param HTTP_HOST    $server_name;
+            '';
+          };
+          "cloud.cynerd.cz" = {
+            forceSSL = true;
+            useACMEHost = "cynerd.cz";
+          };
+          "grafana.cynerd.cz" = {
+            forceSSL = true;
+            useACMEHost = "cynerd.cz";
+            locations."/" = {
+              proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";
+              proxyWebsockets = true;
+              recommendedProxySettings = true;
+            };
+          };
+          "searx.cynerd.cz" = {
+            forceSSL = true;
+            useACMEHost = "cynerd.cz";
+            locations."/".extraConfig = ''
+              uwsgi_pass "unix:///run/searx/searx.sock";
+              include ${config.services.nginx.package}/conf/uwsgi_params;
+            '';
           };
-        };
-        "searx.cynerd.cz" = {
-          forceSSL = true;
-          useACMEHost = "cynerd.cz";
-          locations."/".extraConfig = ''
-            uwsgi_pass "unix:///run/searx/searx.sock";
-            include ${config.services.nginx.package}/conf/uwsgi_params;
-          '';
         };
       };
-    };
-    services.fcgiwrap.instances.cgit = {
-      process.user = "git";
-      socket = {inherit (config.services.nginx) user group;};
+      fcgiwrap.instances.cgit = {
+        process.user = "git";
+        socket = {inherit (config.services.nginx) user group;};
+      };
     };
     security.acme = {
       acceptTerms = true;
@@ -273,8 +275,8 @@
           license = "agpl3Plus";
         };
         passwords = pkgs.fetchNextcloudApp {
-          url = "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2025.9.0/passwords.tar.gz";
-          hash = "sha256-BMu7TPd6xwa/bSQOgN/wFPnK7AK0KgsUKqSqMatjqqw=";
+          url = "https://git.mdns.eu/api/v4/projects/45/packages/generic/passwords/2025.10.0/passwords-lsr-81.tar.gz";
+          hash = "sha256-6QKbmm804BN5bANcdH1BbG2oy1nBgnLY5CLidPF44Uk=";
           license = "agpl3Plus";
         };
       };
diff --git a/nixos/configurations/ridcully.nix b/nixos/configurations/ridcully.nix
index 3dd9beb..03b615b 100644
--- a/nixos/configurations/ridcully.nix
+++ b/nixos/configurations/ridcully.nix
@@ -1,6 +1,6 @@
 {pkgs, ...}: {
   system.stateVersion = "24.05";
-  nixpkgs.hostPlatform.system = "x86_64-linux";
+  nixpkgs.hostPlatform.config = "x86_64-linux";
   deploy.enable = true;
 
   cynerd = {
@@ -12,12 +12,13 @@
     };
   };
 
-  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "usb_storage"];
+  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod"];
   boot.kernelModules = ["kvm-amd"];
 
   hardware.cpu.amd.updateMicrocode = true;
   services.hardware.openrgb.motherboard = "amd";
 
+
   cynerd.autounlock = {
     "encroot" = "/dev/disk/by-uuid/bc7d2ba4-6e04-4c49-b40c-3aecd1a86c71";
     "enchdd" = "/dev/disk/by-uuid/7fee3cda-efa0-47cd-8832-fdead9a7e6db";
@@ -63,8 +64,9 @@
     wait-online.enable = false;
   };
 
-  environment.systemPackages = [
-    pkgs.nvtopPackages.amd
+  environment.systemPackages = with pkgs; [
+    nvtopPackages.amd
+    sbctl
   ];
 
   services.syncthing = {
@@ -74,4 +76,10 @@
 
   # Force nix to use less jobs
   nix.settings.max-jobs = 4;
+
+  # Cover case when we are running out of memory
+  zramSwap = {
+    enable = true;
+    memoryPercent = 50;
+  };
 }
diff --git a/nixos/configurations/spt-omnia.nix b/nixos/configurations/spt-omnia.nix
index 8449f0d..c13956b 100644
--- a/nixos/configurations/spt-omnia.nix
+++ b/nixos/configurations/spt-omnia.nix
@@ -15,7 +15,6 @@ in {
       lanIP = hosts.omnia;
       staticLeases = {
         "a8:a1:59:10:32:c4" = hosts.errol;
-        "70:85:c2:4a:59:f2" = hosts.ridcully;
         "7c:b0:c2:bb:9c:ca" = hosts.albert;
         "4c:d5:77:0d:85:d9" = hosts.binky;
         "b8:27:eb:57:a2:31" = hosts.mpd;
diff --git a/nixos/configurations/zd-mox.nix b/nixos/configurations/zd-mox.nix
index a6f327c..3796af0 100644
--- a/nixos/configurations/zd-mox.nix
+++ b/nixos/configurations/zd-mox.nix
@@ -14,17 +14,11 @@ in {
       wan = "pppoe-wan";
       lanIP = hosts.mox;
       staticLeases = {
+        "70:85:c2:4a:59:f2" = hosts.ridcully;
+        "f8:dc:7a:79:00:e6" = hosts.tc;
         "4c:d5:77:0d:85:d9" = hosts.binky;
       };
     };
-    wifiAP.zd = {
-      enable = false;
-      qca988x = {
-        interface = "wlp1s0";
-        bssids = config.secrets.wifiMacs.zd-mox.qca988x;
-        channel = 36;
-      };
-    };
     wireguard = true;
     monitoring.speedtest = true;
   };
@@ -50,27 +44,27 @@ in {
   networking.useDHCP = false;
   systemd.network = {
     netdevs = {
-      "end2.848" = {
+      "end0.848" = {
         netdevConfig = {
           Kind = "vlan";
-          Name = "end2.848";
+          Name = "end0.848";
         };
         vlanConfig.Id = 848;
       };
     };
     networks = {
-      "end2" = {
-        matchConfig.Name = "end2";
-        networkConfig.VLAN = ["end2.848"];
+      "end0" = {
+        matchConfig.Name = "end0";
+        networkConfig.VLAN = ["end0.848"];
       };
-      "end2.848" = {
-        matchConfig.Name = "end2.848";
-        networkConfig.BindCarrier = "end2";
+      "end0.848" = {
+        matchConfig.Name = "end0.848";
+        networkConfig.BindCarrier = "end0";
       };
       "pppoe-wan" = {
         matchConfig.Name = "pppoe-wan";
         networkConfig = {
-          BindCarrier = "end2.848";
+          BindCarrier = "end0.848";
           DHCP = "ipv6";
           IPv6AcceptRA = "no";
           DHCPPrefixDelegation = "yes";
@@ -105,7 +99,7 @@ in {
   services.pppd = {
     enable = true;
     peers."wan".config = ''
-      plugin pppoe.so end2.848
+      plugin pppoe.so end0.848
       ifname pppoe-wan
       lcp-echo-interval 1
       lcp-echo-failure 5
@@ -117,7 +111,7 @@ in {
     '';
   };
   systemd.services."pppd-wan" = {
-    after = ["sys-subsystem-net-devices-end2.848.device"];
+    after = ["sys-subsystem-net-devices-end0.848.device"];
     partOf = ["systemd-networkd.service"];
   };
   # TODO limit NSS clamping to just pppoe-wan
@@ -125,4 +119,25 @@ in {
     tcp flags syn tcp option maxseg size set rt mtu comment "Needed for PPPoE to fix IPv4"
     iifname {"home", "wg"} oifname {"home", "wg"} accept
   '';
+
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "zd.cynerd.cz" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://${hosts.one0}:8123";
+          proxyWebsockets = true;
+          recommendedProxySettings = true;
+        };
+      };
+    };
+  };
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "cynerd+acme@email.cz";
+    certs."zd.cynerd.cz" = {};
+  };
+  networking.firewall.allowedTCPPorts = [80 443];
 }
diff --git a/nixos/configurations/zd-one0.nix b/nixos/configurations/zd-one0.nix
new file mode 100644
index 0000000..98d9691
--- /dev/null
+++ b/nixos/configurations/zd-one0.nix
@@ -0,0 +1,61 @@
+_: {
+  system.stateVersion = "25.11";
+  deploy = {
+    enable = true;
+    ssh.host = "zd-one0";
+  };
+
+  cynerd = {
+    openwrtone = true;
+    #switch = {
+    #  enable = true;
+    #  lanAddress = "10.8.12.10/24";
+    #  lanGateway = config.cynerd.hosts.spt.omnia;
+    #};
+    #wifiAP.zd = {
+    #  enable = false;
+    #  qca988x = {
+    #    interface = "wlp1s0";
+    #    bssids = config.secrets.wifiMacs.zd-mox.qca988x;
+    #    channel = 36;
+    #  };
+    #};
+  };
+
+  boot.initrd.availableKernelModules = ["dm-mod"];
+  boot.consoleLogLevel = 7;
+
+  services = {
+    journald.extraConfig = ''
+      SystemMaxUse=8G
+    '';
+
+    btrfs.autoScrub = {
+      enable = true;
+      fileSystems = ["/"];
+    };
+
+    fail2ban = {
+      enable = true;
+      ignoreIP = ["10.8.0.0/24" "10.8.1.0/24" "10.8.2.0/24"];
+    };
+  };
+
+  networking.useDHCP = false;
+  networking.useNetworkd = true;
+
+  systemd.network = {
+    networks = {
+      "eth0" = {
+        matchConfig.Name = "eth0";
+        networkConfig = {
+          Address = "10.8.2.10/24";
+          Gateway = "10.8.2.1";
+          DNS = "1.1.1.1";
+          IPv6AcceptRA = "yes";
+        };
+      };
+    };
+    wait-online.anyInterface = true;
+  };
+}