format && add nix-serve for caching

.gitea/workflows/deploy.yaml

@@ -12,6 +12,10 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - uses: cachix/install-nix-action@v31
+        with:
+          extra_nix_config: |
+            extra-trusted-public-keys = localhost:TiRpr2LzamX/MCKBUmFlZ8inWz94QWGL88fMEHg9Kgc=
+            extra-substituters = http://localhost:5000
       - uses: actions/checkout@v4
       - name: Install SSH key
         uses: shimataro/ssh-key-action@v2

flake.nix

@@ -86,6 +86,7 @@
           }:
           {
             imports = [
+              agenix.nixosModules.default
               ./hosts/${name}/configuration.nix
               ./hosts/${name}/hardware-configuration.nix
             ]
@@ -125,7 +126,10 @@
           default = pkgs.mkShell {
             # The Nix packages provided in the environment
             # Add any you need here
-            packages = with pkgs; [ colmena.packages.${pkgs.system}.colmena ];
+            packages = with pkgs; [
+              colmena.packages.${pkgs.stdenv.system}.colmena
+              agenix.packages.${pkgs.stdenv.system}.agenix
+            ];
 
             # Set any environment variables for your dev shell
             env = { };

hosts/sin/copyparty.nix

@@ -1,4 +1,9 @@
-{ inputs, pkgs, config, ... }:
+{
+  inputs,
+  pkgs,
+  config,
+  ...
+}:
 {
   imports = [ inputs.copyparty.nixosModules.default ];
   nixpkgs.overlays = [ inputs.copyparty.overlays.default ];

hosts/sin/coredns/default.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   services.coredns = {
     enable = false;
     config = ''

hosts/sin/flake.nix

@@ -14,7 +14,15 @@
   };
 
   # Flake outputs
-    outputs = inputs@{ self, nixpkgs, disko, unstable, agenix, ... }:
+  outputs =
+    inputs@{
+      self,
+      nixpkgs,
+      disko,
+      unstable,
+      agenix,
+      ...
+    }:
     let
       # The systems supported for this flake
       supportedSystems = [
@@ -22,9 +30,14 @@
       ];
 
       # Helper to provide system-specific attributes
-      forEachSupportedSystem = f: nixpkgs.lib.genAttrs supportedSystems (system: f {
+      forEachSupportedSystem =
+        f:
+        nixpkgs.lib.genAttrs supportedSystems (
+          system:
+          f {
             pkgs = import nixpkgs { inherit system; };
-      });
+          }
+        );
     in
     {
       nixosConfigurations.zimablade = nixpkgs.lib.nixosSystem {
@@ -40,15 +53,21 @@
         };
       };
 
-      devShells = forEachSupportedSystem ({ pkgs }: {
+      devShells = forEachSupportedSystem (
+        { pkgs }:
+        {
           default = pkgs.mkShell {
             # The Nix packages provided in the environment
             # Add any you need here
-          packages = with pkgs; [ pkgs.disko nixos-anywhere ];
+            packages = with pkgs; [
+              pkgs.disko
+              nixos-anywhere
+            ];
 
             # Add any shell logic you want executed any time the environment is activated
             shellHook = '''';
           };
-      });
+        }
+      );
     };
 }

hosts/sin/glances.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   services.glances = {
     enable = true;
     openFirewall = true;

hosts/sin/hardware-configuration.nix

@@ -1,14 +1,27 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "usb_storage" "usbhid" "sd_mod" "sdhci_pci" ];
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "usb_storage"
+    "usbhid"
+    "sd_mod"
+    "sdhci_pci"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];

hosts/sin/homepage.nix

@@ -116,6 +116,8 @@
                 url = "udp://minecraft.shobu.fr:25565";
               };
             };
+          }
+          {
             "reclamation" = {
               description = "bring back your world to life";
               widget = {
@@ -123,7 +125,6 @@
                 url = "udp://minecraft.shobu.fr:43001";
               };
             };
-
           }
         ];
       }

hosts/sin/jellyfin.nix

@@ -1,6 +1,8 @@
-{pkgs, inputs, ...}: let
+{ pkgs, inputs, ... }:
+let
   unstable = import inputs.unstable { system = pkgs.system; };
-in {
+in
+{
   nixpkgs.config.packageOverrides = pkgs: {
     vaapiIntel = pkgs.vaapiIntel.override { enableHybridCodec = true; };
   };
@@ -27,16 +29,41 @@ in {
     extraGroups = [ "jellyfin" ];
   };
 
-  users.users.sonarr.extraGroups = ["jellyfin" "radarr" "transmission" "starr"];
-  users.users.radarr.extraGroups = ["jellyfin" "sonarr" "transmission" "starr"];
-  users.users.bazarr.extraGroups = ["jellyfin" "sonarr" "transmission" "starr" "radarr"];
-  users.users.lidarr.extraGroups = ["jellyfin" "starr" "transmission"];
-  
-  users.users.shobu.extraGroups = [ "jellyfin" "starr" "transmission" "radarr" "sonarr" ];
+  users.users.sonarr.extraGroups = [
+    "jellyfin"
+    "radarr"
+    "transmission"
+    "starr"
+  ];
+  users.users.radarr.extraGroups = [
+    "jellyfin"
+    "sonarr"
+    "transmission"
+    "starr"
+  ];
+  users.users.bazarr.extraGroups = [
+    "jellyfin"
+    "sonarr"
+    "transmission"
+    "starr"
+    "radarr"
+  ];
+  users.users.lidarr.extraGroups = [
+    "jellyfin"
+    "starr"
+    "transmission"
+  ];
 
+  users.users.shobu.extraGroups = [
+    "jellyfin"
+    "starr"
+    "transmission"
+    "radarr"
+    "sonarr"
+  ];
 
   users.groups = {
-    starr = {};
+    starr = { };
   };
 
   services = {

hosts/sin/luks-btrfs-raid.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   disko.devices = {
     disk = {
       # Devices will be mounted and formatted in alphabetical order, and btrfs can only mount raids

hosts/sin/matrix.nix

@@ -1,4 +1,4 @@
-{pkgs, config, ...}:
+{ pkgs, config, ... }:
 {
   users.users = {
     postgres = {
@@ -26,7 +26,10 @@
     '';
   };
 
-  networking.firewall.allowedTCPPorts = [ 8008 8448 ];
+  networking.firewall.allowedTCPPorts = [
+    8008
+    8448
+  ];
 
   services.matrix-synapse = {
     enable = true;
@@ -39,13 +42,16 @@
       listeners = [
         {
           port = 8008;
-          bind_addresses = ["0.0.0.0"];
+          bind_addresses = [ "0.0.0.0" ];
           type = "http";
           tls = false;
           x_forwarded = true;
           resources = [
             {
-              names = [ "client" "federation" ];
+              names = [
+                "client"
+                "federation"
+              ];
               compress = true;
             }
           ];

hosts/sin/secrets.nix

@@ -1,4 +1,5 @@
-{...}: {
+{ ... }:
+{
   age.secrets = {
     # captcha = {
     #   file = ./secrets/matrix_captcha.age;

hosts/thea/configuration.nix

@@ -2,19 +2,26 @@
 # your system. Help is available in the configuration.nix(5) man page, on
 # https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
 
-{ config, lib, pkgs, nodes, ... }:let
+{
+  config,
+  lib,
+  pkgs,
+  nodes,
+  ...
+}:
+let
   sin-address = "192.168.1.14";
 in
 
 {
-  imports =
-    [
+  imports = [
     ./nginx.nix
     # ./striped
     # ./cybercoffee
     ./ollama.nix
     ./minecraft.nix
-      # ./shares.nix
+    ./secrets
+    ./nix-serve.nix
   ];
 
   # Use the systemd-boot EFI boot loader.
@@ -37,18 +44,23 @@ in
       enable = true;
       internalInterfaces = [ "enp1s0" ];
       externalInterface = "enp1s0";
-      forwardPorts = [ {
+      forwardPorts = [
+        {
           # TODO refactor this in the gitea/n100 module
           sourcePort = nodes.sin.config.services.gitea.settings.server.SSH_PORT;
           proto = "tcp";
           destination = "${sin-address}:22";
-      } ];
+        }
+      ];
     };
   };
 
   time.timeZone = "Europe/Paris";
 
-  nix.settings.experimental-features = [ "nix-command" "flakes" ];
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
   nixpkgs.config.allowUnfree = true;
 
   users.users.n100 = {
@@ -57,14 +69,17 @@ in
     packages = with pkgs; [
     ];
 
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
+    ];
   };
 
   users.users.root = {
-    openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKsu+4S+BHmypQTq2IR9y+ihvbF7sXbBznKtIjVAeHJ1 shobu@nixos"
+    ];
   };
 
-
   environment.systemPackages = with pkgs; [
     lunarvim
     wget
@@ -112,4 +127,3 @@ in
   system.stateVersion = "24.11"; # Did you read the comment?
 
 }
-

hosts/thea/cybercoffee/default.nix

@@ -1,4 +1,4 @@
-{pkgs, ...}:
+{ pkgs, ... }:
 {
   imports = [
     ./halflife.nix

hosts/thea/cybercoffee/halflife.nix

@@ -1,2 +1 @@
-
-{...}: {}
+{ ... }: { }

hosts/thea/flake.nix

@@ -12,7 +12,8 @@
   };
 
   # Flake outputs
-  outputs = inputs@{
+  outputs =
+    inputs@{
       self,
       nixpkgs,
       nix-minecraft,

hosts/thea/hardware-configuration.nix

@@ -1,46 +1,60 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
 
 {
-  imports =
-    [ (modulesPath + "/installer/scan/not-detected.nix")
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
   ];
 
-  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "sd_mod" "sdhci_pci" ];
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "ahci"
+    "sd_mod"
+    "sdhci_pci"
+  ];
   boot.initrd.kernelModules = [ ];
   boot.kernelModules = [ "kvm-intel" ];
   boot.extraModulePackages = [ ];
 
-  fileSystems."/" =
-    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
     fsType = "btrfs";
     options = [ "subvol=root" ];
   };
 
-  fileSystems."/nix" =
-    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+  fileSystems."/nix" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
     fsType = "btrfs";
     options = [ "subvol=nix" ];
   };
 
-  fileSystems."/home" =
-    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+  fileSystems."/home" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
     fsType = "btrfs";
     options = [ "subvol=home" ];
   };
 
-  fileSystems."/swap" =
-    { device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
+  fileSystems."/swap" = {
+    device = "/dev/disk/by-uuid/09c733e4-b0df-4416-977b-50d9feb225fc";
     fsType = "btrfs";
     options = [ "subvol=swap" ];
   };
 
-  fileSystems."/boot" =
-    { device = "/dev/disk/by-uuid/D1B9-8019";
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/D1B9-8019";
     fsType = "vfat";
-      options = [ "fmask=0077" "dmask=0077" ];
+    options = [
+      "fmask=0077"
+      "dmask=0077"
+    ];
   };
 
   swapDevices = [ ];

hosts/thea/nix-serve.nix

@@ -0,0 +1,12 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+{
+  services.nix-serve = {
+    enable = true;
+    secretKeyFile = config.age.secrets.cache-privkey.path;
+  };
+}

hosts/thea/ollama.nix

@@ -1,4 +1,5 @@
-{inputs, ...}: {
+{ inputs, ... }:
+{
   # virtualisation.docker = {
   #   enable = true;
   #   storageDriver = "btrfs";

hosts/thea/ressources/cache/pubkey.pem

@@ -0,0 +1 @@
+localhost:TiRpr2LzamX/MCKBUmFlZ8inWz94QWGL88fMEHg9Kgc=

hosts/thea/secrets/cache-privkey.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 EVanKw DJoF2jaBg5Z2tF8NOqAXbNK3pODj8vEmgQ2bs3iaV0I
+rO+6V0JmPnygEqsnblNwhZBHmsAjLaWgdNd/l2veeYg
+-> ssh-ed25519 /uqj4A WW3yjXkYtKbXrANeNCctcNZTNg31LAm3wpaVCXsroA4
+fF1mt83MNX5aHpukk2t0vE49wEwiqOlRxMoAxouYJVQ
+--- cHVG1C71ko8ZNUMRoaLkw6zmAAjVvPaS5j/hr/P7Xoc
+Áq <EFBFBD>c6ªXHNm5.0šÌ<EFBFBD>²ô-âa¶Ä—!¦k]áÚi§‘Bæ†ÚŠù÷]”ãÖR2›èñ†ñj_ƒ²QzHºDCዲ¡!¨dÿË°bUB®¥îµS›€=fwÿÌ›
+›ËÁsö†ò<E280A0>Ä0)¢Á”*€ªKÙÅO¾ÂÈî§Ð½

hosts/thea/secrets/default.nix

@@ -0,0 +1,9 @@
+{ ... }:
+{
+  age.secrets = {
+    cache-privkey = {
+      file = ./cache-privkey.age;
+      mode = "700";
+    };
+  };
+}

hosts/thea/shares.nix

@@ -1,4 +1,5 @@
-{...}: let
+{ ... }:
+let
   sin-address = "192.168.1.14";
 in
 {

hosts/thea/striped/back.nix

@@ -1,7 +1,8 @@
-{inputs, ...}:
+{ inputs, ... }:
 let
   striped-back = inputs.striped-back;
-in {
+in
+{
   imports = [
     striped-back.nixosModules.default
   ];
@@ -17,7 +18,7 @@ in {
     socket.enable = true;
 
     settings.django = {
-      allowed-hosts = ["striped-api.shobu.fr"];
+      allowed-hosts = [ "striped-api.shobu.fr" ];
       debug = true;
       databases = {
         default = {

hosts/thea/striped/default.nix

@@ -1,4 +1,5 @@
-{striped-back, striped-front, ...}:{
+{ striped-back, striped-front, ... }:
+{
   imports = [
     ./back.nix
   ];

modules/gitea/sin/default.nix

@@ -1,6 +1,8 @@
-{lib, ...}: let
+{ lib, ... }:
+let
   ssh_port = 24658;
-in {
+in
+{
   services = {
     gitea = {
       enable = true;