feat: list systemd services

feat: data-crypted

.github/FUNDING.yml

@@ -1,3 +1,3 @@
 github: ryan4yin
 patreon: ryan4yin
-custom: ["https://buymeacoffee.com/ryan4yin", "https://afdian.net/a/ryan4yin"]
+custom: ["https://buymeacoffee.com/ryan4yin"]

.gitignore

@@ -3,3 +3,4 @@ result/
 .direnv/
 .DS_Store
 .pre-commit-config.yaml
+logs/

.typos.toml

@@ -10,4 +10,5 @@ extend-ignore-re = [
   "iterm2",
   "iHgEIBYKACAWIQSizQe9ljFEyyclWmtVhZllwnQrSwUCZZ1T9wIdAAAKCRBVhZll", # crypto keys
   "noice", # noice.nvim
+  "crypted-nixos",
 ]

Justfile

@@ -1,57 +1,85 @@
 # just is a command runner, Justfile is very similar to Makefile, but simpler.
 
-# use nushell for shell commands
+# Use nushell for shell commands
+# To usage this justfile, you need to enter a shell with just & nushell installed:
+# 
+#   nix shell nixpkgs#just nixpkgs#nushell
 set shell := ["nu", "-c"]
 
+utils_nu := absolute_path("utils.nu")
+
 ############################################################################
 #
 #  Common commands(suitable for all machines)
 #
 ############################################################################
 
-# Remote deployment via colmena
+# List all the just commands
-col tag:
+default:
-  colmena apply --on '@{{tag}}' --verbose --show-trace
+    @just --list
-
-local name mode="default":
-  use utils.nu *; \
-  nixos-switch {{name}} {{mode}}
 
 # Run eval tests
+[group('nix')]
 test:
   nix eval .#evalTests --show-trace --print-build-logs --verbose
 
-# update all the flake inputs
+# Update all the flake inputs
+[group('nix')]
 up:
   nix flake update
 
 # Update specific input
 # Usage: just upp nixpkgs
+[group('nix')]
 upp input:
   nix flake update {{input}}
 
 # List all generations of the system profile
+[group('nix')]
 history:
   nix profile history --profile /nix/var/nix/profiles/system
 
 # Open a nix shell with the flake
+[group('nix')]
 repl:
   nix repl -f flake:nixpkgs
 
 # remove all generations older than 7 days
+# on darwin, you may need to switch to root user to run this command
+[group('nix')]
 clean:
   sudo nix profile wipe-history --profile /nix/var/nix/profiles/system  --older-than 7d
 
 # Garbage collect all unused nix store entries
+[group('nix')]
 gc:
-  # garbage collect all unused nix store entries
+  # garbage collect all unused nix store entries(system-wide)
-  sudo nix store gc --debug
+  sudo nix-collect-garbage --delete-older-than 7d
-  sudo nix-collect-garbage --delete-old
+  # garbage collect all unused nix store entries(for the user - home-manager)
+  # https://github.com/LnL7/nix-darwin/issues/237
+  nix-collect-garbage --delete-older-than 7d
 
-# Remove all reflog entries and prune unreachable objects
+# Enter a shell session which has all the necessary tools for this flake
-gitgc:
+[linux]
-  git reflog expire --expire-unreachable=now --all
+[group('nix')]
-  git gc --prune=now
+shell:
+  nix shell nixpkgs#git nixpkgs#neovim nixpkgs#colmena
+
+# Enter a shell session which has all the necessary tools for this flake
+[macos]
+[group('nix')]
+shell:
+  nix shell nixpkgs#git nixpkgs#neovim
+
+[group('nix')]
+fmt:
+  # format the nix files in this repo
+  nix fmt
+
+# Show all the auto gc roots in the nix store
+[group('nix')]
+gcroot:
+  ls -al /nix/var/nix/gcroots/auto/
 
 ############################################################################
 #
@@ -60,24 +88,32 @@ gitgc:
 ############################################################################
 
 [linux]
+[group('desktop')]
 i3 mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
   nixos-switch ai-i3 {{mode}}
 
 [linux]
+[group('desktop')]
 hypr mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
   nixos-switch ai-hyprland {{mode}}
 
 
 [linux]
+[group('desktop')]
 s-i3 mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
   nixos-switch shoukei-i3 {{mode}}
 
 [linux]
+[group('desktop')]
 s-hypr mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
   nixos-switch shoukei-hyprland {{mode}}
 
 ############################################################################
@@ -87,31 +123,39 @@ s-hypr mode="default":
 ############################################################################
 
 [macos]
+[group('desktop')]
 darwin-set-proxy:
   sudo python3 scripts/darwin_set_proxy.py
   sleep 1sec
 
 [macos]
+[group('desktop')]
 darwin-rollback:
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
   darwin-rollback
 
 # Deploy to harmonica(macOS host)
 [macos]
+[group('desktop')]
 ha mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
-  darwin-build "harmonica" {{mode}}; \
+  use {{utils_nu}} *;
+  darwin-build "harmonica" {{mode}};
   darwin-switch "harmonica" {{mode}}
 
 # Depoly to fern(macOS host)
 [macos]
+[group('desktop')]
 fe mode="default": darwin-set-proxy
-  use utils.nu *; \
+  #!/usr/bin/env nu
-  darwin-build "fern" {{mode}}; \
+  use {{utils_nu}} *;
+  darwin-build "fern" {{mode}};
   darwin-switch "fern" {{mode}}
 
 # Reload yabai and skhd(macOS)
 [macos]
+[group('desktop')]
 yabai-reload:
   launchctl kickstart -k "gui/502/org.nixos.yabai";
   launchctl kickstart -k "gui/502/org.nixos.skhd"; 
@@ -122,34 +166,67 @@ yabai-reload:
 #
 ############################################################################
 
+# Remote deployment via colmena
+[linux]
+[group('homelab')]
+col tag:
+  colmena apply --on '@{{tag}}' --verbose --show-trace
+
+[linux]
+[group('homelab')]
+local name mode="default":
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
+  nixos-switch {{name}} {{mode}}
+
 # Build and upload a vm image
+[linux]
+[group('homelab')]
 upload-vm name mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *;
   upload-vm {{name}} {{mode}}
 
 # Deploy all the KubeVirt nodes(Physical machines running KubeVirt)
+[linux]
+[group('homelab')]
 lab:
   colmena apply --on '@virt-*' --verbose --show-trace
 
+[linux]
+[group('homelab')]
 shoryu:
   colmena apply --on '@kubevirt-shoryu' --verbose --show-trace
 
+[linux]
+[group('homelab')]
 shoryu-local mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
   nixos-switch kubevirt-shoryu {{mode}}
 
+[linux]
+[group('homelab')]
 shushou:
   colmena apply --on '@kubevirt-shushou' --verbose --show-trace
 
+[linux]
+[group('homelab')]
 shushou-local mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
   nixos-switch kubevirt-shushou {{mode}}
 
+[linux]
+[group('homelab')]
 youko:
   colmena apply --on '@kubevirt-youko' --verbose --show-trace
 
+[linux]
+[group('homelab')]
 youko-local mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
   nixos-switch kubevirt-youko {{mode}}
 
 ############################################################################
@@ -159,31 +236,49 @@ youko-local mode="default":
 ############################################################################
 
 # Build and upload a vm image
+[linux]
+[group('homelab')]
 upload-idols mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
   upload-vm aquamarine {{mode}}
   upload-vm ruby {{mode}}
   upload-vm kana {{mode}}
 
+[linux]
+[group('homelab')]
 aqua:
   colmena apply --on '@aqua' --verbose --show-trace
 
+[linux]
+[group('homelab')]
 aqua-local mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
   nixos-switch aquamarine {{mode}}
 
+[linux]
+[group('homelab')]
 ruby:
   colmena apply --on '@ruby' --verbose --show-trace
 
+[linux]
+[group('homelab')]
 ruby-local mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
   nixos-switch ruby {{mode}}
 
+[linux]
+[group('homelab')]
 kana:
   colmena apply --on '@kana' --verbose --show-trace
 
+[linux]
+[group('homelab')]
 kana-local mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
+  use {{utils_nu}} *; 
   nixos-switch kana {{mode}}
 
 ############################################################################
@@ -193,90 +288,49 @@ kana-local mode="default":
 ############################################################################
 
 # Build and upload a vm image
-upload-k3s mode="default":
+[linux]
-  use utils.nu *; \
+[group('homelab')]
-  upload-vm k3s-prod-1-master-1 {{mode}}; \
+upload-k3s-prod mode="default":
-  upload-vm k3s-prod-1-master-2 {{mode}}; \
+  #!/usr/bin/env nu
-  upload-vm k3s-prod-1-master-3 {{mode}}; \
+  use {{utils_nu}} *; 
-  upload-vm k3s-prod-1-worker-1 {{mode}}; \
+  upload-vm k3s-prod-1-master-1 {{mode}}; 
-  upload-vm k3s-prod-1-worker-2 {{mode}}; \
+  upload-vm k3s-prod-1-master-2 {{mode}}; 
+  upload-vm k3s-prod-1-master-3 {{mode}}; 
+  upload-vm k3s-prod-1-worker-1 {{mode}}; 
+  upload-vm k3s-prod-1-worker-2 {{mode}}; 
   upload-vm k3s-prod-1-worker-3 {{mode}};
 
+[linux]
+[group('homelab')]
 upload-k3s-test mode="default":
-  use utils.nu *; \
+  #!/usr/bin/env nu
-  upload-vm k3s-test-1-master-1 {{mode}}; \
+  use {{utils_nu}} *; 
-  upload-vm k3s-test-1-master-2 {{mode}}; \
+  upload-vm k3s-test-1-master-1 {{mode}}; 
+  upload-vm k3s-test-1-master-2 {{mode}}; 
   upload-vm k3s-test-1-master-3 {{mode}};
 
-k3s:
+[linux]
-  colmena apply --on '@k3s-*' --verbose --show-trace
+[group('homelab')]
-
+k3s-prod:
-master:
+  colmena apply --on '@k3s-prod-*' --verbose --show-trace
-  colmena apply --on '@k3s-prod-1-master-*' --verbose --show-trace
-
-worker:
-  colmena apply --on '@k3s-prod-1-worker-*' --verbose --show-trace
 
+[linux]
+[group('homelab')]
 k3s-test:
   colmena apply --on '@k3s-test-*' --verbose --show-trace
 
 ############################################################################
 #
-#  RISC-V related commands
+#  Neovim related commands
 #
 ############################################################################
 
-riscv:
+[group('neovim')]
-  colmena apply --on '@riscv' --verbose --show-trace
-
-nozomi:
-  colmena apply --on '@nozomi' --verbose --show-trace
-
-yukina:
-  colmena apply --on '@yukina' --verbose --show-trace
-
-############################################################################
-#
-# Aarch64 related commands
-#
-############################################################################
-
-rakushun:
-  colmena apply --on '@rakushun' --build-on-target --verbose --show-trace
-
-rakushun-local mode="default":
-  use utils.nu *; \
-  nixos-switch rakushun {{mode}}
-
-suzu-set-proxy:
-  ip route del default via 192.168.5.1
-  ip route add default via 192.168.5.178
-
-suzu-unset-proxy:
-  ip route del default via 192.168.5.178
-  ip route add default via 192.168.5.1
-
-suzu-local mode="default":
-  use utils.nu *; \
-  nixos-switch suzu {{mode}}
-
-############################################################################
-#
-#  Misc, other useful commands
-#
-############################################################################
-
-fmt:
-  # format the nix files in this repo
-  nix fmt
-
-path:
-   $env.PATH | split row ":"
-
 nvim-test:
   rm -rf $"($env.HOME)/.config/nvim"
   rsync -avz --copy-links --chmod=D2755,F744 home/base/tui/editors/neovim/nvim/ $"($env.HOME)/.config/nvim/"
 
+[group('neovim')]
 nvim-clean:
   rm -rf $"($env.HOME)/.config/nvim"
 
@@ -284,45 +338,78 @@ nvim-clean:
 # Emacs related commands
 # =================================================
 
-emacs-plist-path := "~/Library/LaunchAgents/org.nix-community.home.emacs.plist"
+[group('emacs')]
-
-reload-emacs-cmd := if os() == "macos" {
-    "launchctl unload " + emacs-plist-path
-    + "\n"
-    + "launchctl load " + emacs-plist-path
-    + "\n"
-    + "tail -f ~/Library/Logs/emacs-daemon.stderr.log"
-  } else {
-    "systemctl --user restart emacs.service"
-    + "\n"
-    + "systemctl --user status emacs.service"
-  }
-
 emacs-test:
   rm -rf $"($env.HOME)/.config/doom"
   rsync -avz --copy-links --chmod=D2755,F744 home/base/tui/editors/emacs/doom/ $"($env.HOME)/.config/doom/"
   doom clean
   doom sync
 
+[group('emacs')]
 emacs-clean:
   rm -rf $"($env.HOME)/.config/doom/"
 
+[group('emacs')]
 emacs-purge:
   doom purge
   doom clean
   doom sync
 
+[linux]
+[group('emacs')]
 emacs-reload:
   doom sync
-  {{reload-emacs-cmd}}
+  systemctl --user restart emacs.service
+  systemctl --user status emacs.service
 
 
+emacs-plist-path := "~/Library/LaunchAgents/org.nix-community.home.emacs.plist"
+
+[macos]
+[group('emacs')]
+emacs-reload:
+  doom sync
+  launchctl unload {{emacs-plist-path}}
+  launchctl load {{emacs-plist-path}}
+  tail -f ~/Library/Logs/emacs-daemon.stderr.log
+
 # =================================================
 #
-# Kubernetes related commands
+# Other useful commands
 #
 # =================================================
 
+[group('common')]
+path:
+   $env.PATH | split row ":"
 
+[linux]
+[group('common')]
+penvof pid:
+  sudo cat $"/proc/($pid)/environ" | tr '\0' '\n'
+
+# Remove all reflog entries and prune unreachable objects
+[group('git')]
+ggc:
+  git reflog expire --expire-unreachable=now --all
+  git gc --prune=now
+
+# Amend the last commit without changing the commit message
+[group('git')]
+game:
+  git commit --amend -a --no-edit
+
+# Delete all failed pods
+[group('k8s')]
 del-failed:
   kubectl delete pod --all-namespaces --field-selector="status.phase==Failed"
+
+[linux]
+[group('services')]
+list-inactive:
+  systemctl list-units -all --state=inactive
+
+[linux]
+[group('services')]
+list-failed:
+  systemctl list-units -all --state=failed

README.md

@@ -14,8 +14,8 @@
   </a>
 </p>
 
-> My configuration is becoming more and more complex, and it will be difficult for beginners to
+> My configuration is becoming more and more complex, and **it will be difficult for beginners to
-> read. If you are new to NixOS and want to know how I use NixOS, I would recommend you to take a
+> read**. If you are new to NixOS and want to know how I use NixOS, I would recommend you to take a
 > look at the [ryan4yin/nix-config/releases](https://github.com/ryan4yin/nix-config/releases) first,
 > **checkout to some simpler older versions, such as
 > [i3-kickstarter](https://github.com/ryan4yin/nix-config/tree/i3-kickstarter), which will be much
@@ -31,6 +31,9 @@ This repository is home to the nix code that builds my systems:
 
 See [./hosts](./hosts) for details of each host.
 
+See [./Virtual-Machine.md](./Virtual-Machine.md) for details of how to create & manage KubeVirt's
+Virtual Machine from this flake.
+
 ## Why NixOS & Flakes?
 
 Nix allows for easy-to-manage, collaborative, reproducible deployments. This means that once

Virtual-Machine.md

@@ -1,13 +1,17 @@
 ## How to create & managage KubeVirt's Virtual Machine from this flake?
 
-Use `aquamarine` as an example, we can create a virtual machine with the following command:
+Use `aquamarine` as an example, first build and upload the virtual machine's qcow2 image to the file
+server:
 
 ```shell
 just upload-vm aquamarine
 ```
 
 Then create the virtual machine by creating a yaml file at
-[ryan4yin/k8s-gitops](https://github.com/ryan4yin/k8s-gitops/tree/main/vms)
+[ryan4yin/k8s-gitops](https://github.com/ryan4yin/k8s-gitops/tree/main/vms), set the
+`spec.dataVolumeTemplates[0].source.http.url` to the uploaded file's URL, and fluxcd will
+automatically apply the changes, then a virtual machine named `aquamarine` will be created in the
+KubeVirt cluster.
 
 Once the virtual machine `aquamarine` is created, we can deploy updates to it with the following
 commands:

flake.nix

@@ -12,18 +12,16 @@
 
   # the nixConfig here only affects the flake itself, not the system configuration!
   # for more information, see:
-  #     https://nixos-and-flakes.thiscute.world/nixos-with-flakes/add-custom-cache-servers
+  #     https://nixos-and-flakes.thiscute.world/nix-store/add-binary-cache-servers
   nixConfig = {
     # substituers will be appended to the default substituters when fetching packages
     extra-substituters = [
       "https://anyrun.cachix.org"
-      "https://hyprland.cachix.org"
       "https://nix-gaming.cachix.org"
       # "https://nixpkgs-wayland.cachix.org"
     ];
     extra-trusted-public-keys = [
       "anyrun.cachix.org-1:pqBobmOjI7nKlsUMV25u9QHa9btJK65/C8vnO3p346s="
-      "hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
       "nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
       # "nixpkgs-wayland.cachix.org-1:3lwxaILxMRkVhehr5StQprHdEo4IrE8sRho9R9HOLYA="
     ];
@@ -36,9 +34,9 @@
     # which represents the GitHub repository URL + branch/commit-id/tag.
 
     # Official NixOS package source, using nixos's unstable branch by default
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
     nixpkgs-unstable.url = "github:nixos/nixpkgs/nixos-unstable-small";
-    # nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.05";
 
     # for macos
     nixpkgs-darwin.url = "github:nixos/nixpkgs/nixpkgs-24.05-darwin";
@@ -50,8 +48,8 @@
 
     # home-manager, used for managing user configuration
     home-manager = {
-      url = "github:nix-community/home-manager/release-24.05";
+      url = "github:nix-community/home-manager/master";
-      # url = "github:nix-community/home-manager/master";
+      # url = "github:nix-community/home-manager/release-24.05";
 
       # The `follows` keyword in inputs is used for inheritance.
       # Here, `inputs.nixpkgs` of home-manager is kept consistent with the `inputs.nixpkgs` of the current flake,
@@ -60,17 +58,12 @@
     };
 
     lanzaboote = {
-      url = "github:nix-community/lanzaboote/v0.3.0";
+      url = "github:nix-community/lanzaboote/v0.4.1";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
     impermanence.url = "github:nix-community/impermanence";
 
-    hyprland = {
-      url = "github:hyprwm/Hyprland/v0.39.1";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     # community wayland nixpkgs
     # nixpkgs-wayland.url = "github:nix-community/nixpkgs-wayland";
     # anyrun - a wayland launcher
@@ -108,19 +101,11 @@
 
     nuenv.url = "github:DeterminateSystems/nuenv";
 
-    daeuniverse.url = "github:daeuniverse/flake.nix";
-    # daeuniverse.url = "github:daeuniverse/flake.nix/exp";
-
     haumea = {
       url = "github:nix-community/haumea/v0.2.2";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    microvm = {
-      url = "github:astro/microvm.nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     ########################  Some non-flake repositories  #########################################
 
     # doom-emacs is a configuration framework for GNU Emacs.
@@ -153,12 +138,5 @@
       url = "github:ryan4yin/nur-packages";
       # inputs.nixpkgs.follows = "nixpkgs";
     };
-
-    # riscv64 SBCs
-    nixos-licheepi4a.url = "github:ryan4yin/nixos-licheepi4a";
-    # nixos-jh7110.url = "github:ryan4yin/nixos-jh7110";
-
-    # aarch64 SBCs
-    nixos-rk3588.url = "github:ryan4yin/nixos-rk3588";
   };
 }

home/base/core/container.nix

@@ -5,17 +5,23 @@
   ...
 }: {
   home.packages = with pkgs; [
-    skopeo
     docker-compose
     dive # explore docker layers
     lazydocker # Docker terminal UI.
+    skopeo # copy/sync images between registries and local storage
+    go-containerregistry # provides `crane` & `gcrane`, it's similar to skopeo
 
     kubectl
+    kubectx
+    kubebuilder
     istioctl
+    clusterctl # for kubernetes cluster-api
     kubevirt # virtctl
     kubernetes-helm
     fluxcd
     argocd
+
+    ko # build go project to container image
   ];
 
   programs = {

home/base/core/core.nix

@@ -10,7 +10,7 @@
     gnupg
     gnumake
 
-    # Morden cli tools, replacement of grep/sed/...
+    # Modern cli tools, replacement of grep/sed/...
 
     # Interactively filter its input using fuzzy searching, not limit to filenames.
     fzf

home/base/core/shells/config.nu

@@ -115,6 +115,33 @@ $env.config = {
   # buffer_editor: "emacs" # command that will be used to edit the current line buffer with ctrl+o, if unset fallback to $env.EDITOR and $env.VISUAL
   bracketed_paste: true # enable bracketed paste, currently useless on windows
   edit_mode: emacs # emacs, vi
-  shell_integration: true # enables terminal markers and a workaround to arrow keys stop working issue
+  shell_integration: {
+        # osc2 abbreviates the path if in the home_dir, sets the tab/window title, shows the running command in the tab/window title
+        osc2: true
+        # osc7 is a way to communicate the path to the terminal, this is helpful for spawning new tabs in the same directory
+        osc7: true
+        # osc8 is also implemented as the deprecated setting ls.show_clickable_links, it shows clickable links in ls output if your terminal supports it. show_clickable_links is deprecated in favor of osc8
+        osc8: true
+        # osc9_9 is from ConEmu and is starting to get wider support. It's similar to osc7 in that it communicates the path to the terminal
+        osc9_9: false
+        # osc133 is several escapes invented by Final Term which include the supported ones below.
+        # 133;A - Mark prompt start
+        # 133;B - Mark prompt end
+        # 133;C - Mark pre-execution
+        # 133;D;exit - Mark execution finished with exit code
+        # This is used to enable terminals to know where the prompt is, the command is, where the command finishes, and where the output of the command is
+        osc133: true
+        # osc633 is closely related to osc133 but only exists in visual studio code (vscode) and supports their shell integration features
+        # 633;A - Mark prompt start
+        # 633;B - Mark prompt end
+        # 633;C - Mark pre-execution
+        # 633;D;exit - Mark execution finished with exit code
+        # 633;E - NOT IMPLEMENTED - Explicitly set the command line with an optional nonce
+        # 633;P;Cwd=<path> - Mark the current working directory and communicate it to the terminal
+        # and also helps with the run recent menu in vscode
+        osc633: true
+        # reset_application_mode is escape \x1b[?1l and was added to help ssh work better
+        reset_application_mode: true
+    }
   render_right_prompt_on_last_line: false # true or false to enable or disable right prompt to be rendered on last line of the prompt.
 }

home/base/core/shells/default.nix

@@ -1,4 +1,4 @@
-let
+{pkgs-unstable, ...}: let
   shellAliases = {
     k = "kubectl";
 
@@ -11,6 +11,7 @@ in {
 
   programs.nushell = {
     enable = true;
+    package = pkgs-unstable.nushell;
     configFile.source = ./config.nu;
     inherit shellAliases;
   };

home/base/core/yazi.nix

@@ -11,6 +11,12 @@
     # Changing working directory when exiting Yazi
     enableBashIntegration = true;
     enableNushellIntegration = true;
+    settings = {
+      manager = {
+        show_hidden = true;
+        sort_dir_first = true;
+      };
+    };
   };
 
   xdg.configFile."yazi/theme.toml".source = "${nur-ryan4yin.packages.${pkgs.system}.catppuccin-yazi}/mocha.toml";

home/base/gui/dev-tools.nix

@@ -3,5 +3,8 @@
     mitmproxy # http/https proxy tool
     insomnia # REST client
     wireshark # network analyzer
+
+    # IDEs
+    jetbrains.idea-community
   ];
 }

home/base/tui/cloud/default.nix

@@ -24,6 +24,11 @@
 
     # aliyun
     aliyun-cli
+    # digitalocean
+    doctl
+    # google cloud
+    google-cloud-sdk
+
     # cloud tools that nix do not have cache for.
     terraform
     terraformer # generate terraform configs from existing cloud resources

home/base/tui/dev-tools.nix

@@ -41,6 +41,7 @@
     # Automatically trims your branches whose tracking remote refs are merged or gone
     # It's really useful when you work on a project for a long time.
     git-trim
+    gitleaks
 
     # need to run `conda-install` before using it
     # need to run `conda-shell` before using command `conda`

home/base/tui/editors/Structured-Editing.md

@@ -5,7 +5,7 @@
 - paredit/[lispy](https://github.com/doomemacs/doomemacs/tree/master/modules/editor/lispy): too
   complex.
 - [evil-cleverparens](https://github.com/emacs-evil/evil-cleverparens): simple and useful.
-- [parinfer(par-in-fer)](https://shaunlebron.github.io/parinfer/): morden, simple, elegant and
+- [parinfer(par-in-fer)](https://shaunlebron.github.io/parinfer/): modern, simple, elegant and
   useful, but works not well with some other completion plugins...
   - to make parinfer works, you should disable sexp & smartparens in any lisp mode.
 

home/base/tui/editors/helix/README.md

@@ -20,7 +20,7 @@ Use `:tutor` in helix to start the tutorial.
    1. Helix: delete 2 word: `2w` then `x`. You can always see what you're selecting before you apply
       the action.
    2. Neovim: delete 2 word: `d`. then `2w`. No visual feedback before you apply the action.
-1. Helix - Morden builtin features: LSP, tree-sitter, fuzzy finder, multi cursors, surround and
+1. Helix - Modern builtin features: LSP, tree-sitter, fuzzy finder, multi cursors, surround and
    more.
    1. They're all available in Neovim too, but you need to find and use the right plugins manually,
       which takes time and effort.
@@ -30,7 +30,7 @@ Use `:tutor` in helix to start the tutorial.
    1. Personally I'm glad to take a look at a Rust codebase, but not a VimScript/Lua codebase.
 1. Neovim have a very activate plugin ecosystem, and it's easy to find plugins for almost
    everything.
-   1. Helix is still new, and it even do have a stable plugin system yet. A PR to add a plugin
+   1. Helix is still new, and it even don't have a stable plugin system yet. A PR to add a plugin
       system is still envolving: <https://github.com/helix-editor/helix/pull/8675>
 1. Neovim has integrated terminal, and it's very powerful. It's quite similar to VSCode's integrated
    terminal. I use it a lot.

home/base/tui/editors/neovim/README.md

@@ -88,14 +88,17 @@ plugin.
 ### Window Navigation
 
 - Switch between windows: `<Ctrl> + h/j/k/l`
-- Resize windows: `<Ctrl> + Up/Down/Left/Right`
+- Resize windows: `<Ctrl> + Up/Down/Left/Right` (`<Ctrl-w> + -/+/</>`)
   - Note: On macOS, conflicts with system shortcuts
   - Disable in System Preferences -> Keyboard -> Shortcuts -> Mission Control
 
 ### Splitting and Buffers
 
-| | Action | Shortcut | | --------------------- | ------------- | | Horizontal Split | `\` | |
+| Action           | Shortcut      |
-Vertical Split | `\|` | | Close Buffer | `<Space> + c` |
+| ---------------- | ------------- |
+| Horizontal Split | `\`           |
+| Vertical Split   | `\|`          |
+| Close Buffer     | `<Space> + c` |
 
 ### Editing and Formatting
 
@@ -109,7 +112,18 @@ Vertical Split | `\|` | | Close Buffer | `<Space> + c` |
 | Comment Line(support multiple lines)                  | `<Space> + /`  |
 | Open filepath/URL at cursor(neovim's builtin command) | `gx`           |
 | Find files by name (fzf)                              | `<Space> + ff` |
+| Find files by name (include hidden files)             | `<Space> + fF` |
 | Grep string in files (ripgrep)                        | `<Space> + fw` |
+| Grep string in files (include hidden files)           | `<Space> + fW` |
+
+### Git
+
+| Action                     | Shortcut        |
+| -------------------------- | --------------- |
+| Git Commits (repository)   | `:<Space> + gc` |
+| Git Commits (current file) | `:<Space> + gC` |
+| Git Branches               | `:<Space> + gb` |
+| Git Status                 | `:<Space> + gt` |
 
 ### Sessions
 
@@ -160,9 +174,10 @@ Provided by mini.surround plugin.
 ### Miscellaneous
 
 | Action                            |                 |
-| --------------------- | --------------- |
+| --------------------------------- | --------------- |
 | Show all Yank History             | `:<Space> + yh` |
 | Show undo history                 | `:<Space> + uh` |
+| Show the path of the current file | `:!echo $%`     |
 
 ## Additional Resources
 

home/base/tui/editors/neovim/default.nix

@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  pkgs-unstable,
   ...
 }:
 ###############################################################################
@@ -25,13 +26,37 @@ in {
   programs = {
     neovim = {
       enable = true;
+      package = pkgs-unstable.neovim-unwrapped;
 
       defaultEditor = true;
       viAlias = true;
       vimAlias = true;
 
-      # currently we use lazy.nvim as neovim's package manager, so comment this one.
+      # These environment variables are needed to build and run binaries
-      # Install packages that will compile locally or download FHS binaries via Nix!
+      # with external package managers like mason.nvim.
+      #
+      # LD_LIBRARY_PATH is also needed to run the non-FHS binaries downloaded by mason.nvim.
+      # it will be set by nix-ld, so we do not need to set it here again.
+      extraWrapperArgs = with pkgs; [
+        # LIBRARY_PATH is used by gcc before compilation to search directories
+        # containing static and shared libraries that need to be linked to your program.
+        "--suffix"
+        "LIBRARY_PATH"
+        ":"
+        "${lib.makeLibraryPath [stdenv.cc.cc zlib]}"
+
+        # PKG_CONFIG_PATH is used by pkg-config before compilation to search directories
+        # containing .pc files that describe the libraries that need to be linked to your program.
+        "--suffix"
+        "PKG_CONFIG_PATH"
+        ":"
+        "${lib.makeSearchPathOutput "dev" "lib/pkgconfig" [stdenv.cc.cc zlib]}"
+      ];
+
+      # Currently we use lazy.nvim as neovim's package manager, so comment this one.
+      #
+      # NOTE: These plugins will not be used by astronvim by default!
+      # We should install packages that will compile locally or download FHS binaries via Nix!
       # and use lazy.nvim's `dir` option to specify the package directory in nix store.
       # so that these plugins can work on NixOS.
       #
@@ -40,6 +65,8 @@ in {
       plugins = with pkgs.vimPlugins; [
         # search all the plugins using https://search.nixos.org/packages
         telescope-fzf-native-nvim
+
+        nvim-treesitter.withAllGrammars
       ];
     };
   };

home/base/tui/editors/neovim/nvim/lua/plugins/astrolsp.lua

@@ -3,7 +3,6 @@
 -- NOTE: We highly recommend setting up the Lua Language Server (`:LspInstall lua_ls`)
 --       as this provides autocomplete and documentation while editing
 
-
 ---@type LazySpec
 return {
   "AstroNvim/astrolsp",
@@ -42,40 +41,51 @@ return {
       -- end
     },
     -- enable servers that you already have installed without mason
+    -- https://github.com/neovim/nvim-lspconfig/blob/master/doc/server_configurations.md
     servers = {
-      ---- Frontend & NodeJS
+      ---- Data & Configuration Languages
+      "jsonls", -- json language server
+      "jsonnet_ls", -- jsonnet language server
+      "yamlls", -- yaml language server
+      "taplo", -- toml language server
+      "dagger", -- cuelsp - cue language server
+      "terraformls", -- terraform hcl
+      "marksman", -- markdown ls
+      "nickel_ls", -- nickel language server
+      "nil_ls", -- nix language server
+      "bufls", -- protocol buffer language server
+      "dockerls", -- dockerfile
+      "cmake", -- cmake language server
+      "sqls", -- sql language server
+
+      ---- General Purpose Languages
+      "clangd", -- c/c++
+      "gopls", -- go
+      "jdtls", -- java language server, provides only basic features
+      "rust_analyzer", -- rust
+      "pyright", -- python
+      "ruff_lsp", -- extremely fast Python linter and code transformation
+      -- "julials", -- julia language server
+      -- "zls", -- zig language server
+      "lua_ls", -- lua
+      "bashls", -- bash
+      "nushell", -- nushell language server
+
+      ---- Web Development
       "tsserver", -- typescript/javascript language server
       "tailwindcss", -- tailwindcss language server
       "html", -- html language server
       "cssls", -- css language server
       "prismals", -- prisma language server
       "volar", -- vue language server
-      ---- Configuration Language
+
-      "marksman", -- markdown ls
+      ---- Lisp Like
-      "jsonls", -- json language server
-      "yamlls", -- yaml language server
-      "taplo", -- toml language server
-      ---- Backend
-      "lua_ls", -- lua
-      "gopls", -- go
-      "rust_analyzer", -- rust
-      "pyright", -- python
-      "ruff_lsp", -- extremely fast Python linter and code transformation
-      "jdtls", -- java
-      "nil_ls", -- nix language server
-      "bufls", -- protocol buffer language server
-      "zls", -- zig language server
-      ---- HDL
-      "verible", -- verilog language server
-      ---- Operation & Cloud Nativautoindente
-      "bashls", -- bash
-      "cmake", -- cmake language server
-      "clangd", -- c/c++
-      "dockerls", -- dockerfile
-      "jsonnet_ls", -- jsonnet language server
-      "terraformls", -- terraform hcl
-      "nushell", -- nushell language server
       "scheme_langserver", -- scheme language server
+      "elixirls", -- elixir language server
+      -- "clojure_lsp", -- clojure language server"
+
+      ---- Circuit Design
+      "verible", -- verilog language server
     },
     -- customize language server configuration options passed to `lspconfig`
     ---@diagnostic disable: missing-fields

home/base/tui/editors/neovim/nvim/lua/plugins/mason.lua

@@ -1,4 +1,7 @@
 -- Customize Mason plugins
+--
+-- NOTE: Issue - mason.nvim does not support NixOS:
+-- https://github.com/williamboman/mason.nvim/issues/428
 
 ---@type LazySpec
 return {

home/base/tui/editors/neovim/nvim/lua/plugins/treesitter.lua

@@ -3,6 +3,10 @@
 ---@type LazySpec
 return {
   "nvim-treesitter/nvim-treesitter",
+  dependencies = {
+    -- NOTE: additional parser
+    { "nushell/tree-sitter-nu" }, -- nushell scripts
+  },
   opts = function(_, opts)
     opts.incremental_selection = {
       enable = true,
@@ -13,48 +17,26 @@ return {
         node_decremental = "<bs>", -- Backspace
       },
     }
-    opts.ignore_install = { "gotmpl" }
+    opts.ignore_install = { "gotmpl", "wing" }
 
     -- add more things to the ensure_installed table protecting against community packs modifying it
+    -- https://github.com/nvim-treesitter/nvim-treesitter/tree/master
     opts.ensure_installed = require("astrocore").list_insert_unique(opts.ensure_installed, {
-      -- neovim
+      -- please add only the tree-sitters that are not available in nixpkgs here
-      "vim",
+
-      "lua",
+      "just",
-      -- operation & cloud native
+      "kdl",
-      "dockerfile",
-      "hcl",
-      "jsonnet",
-      "regex",
-      "terraform",
-      "nix",
       "csv",
-      -- other programming language
+      "xml",
+
+      ---- Misc
       "diff",
+      "git_config",
+      "git_rebase",
       "gitignore",
       "gitcommit",
-      "latex",
+      "gitattributes",
-      "sql",
+      "ssh_config",
-      -- Lisp like
-      "fennel",
-      "clojure",
-      "commonlisp",
-      -- customized languages:
-      "scheme",
     })
-
-    -- add support for scheme
-    local parser_config = require("nvim-treesitter.parsers").get_parser_configs()
-    parser_config.scheme = {
-      install_info = {
-        url = "https://github.com/6cdh/tree-sitter-scheme", -- local path or git repo
-        files = { "src/parser.c" },
-        -- optional entries:
-        branch = "main", -- default branch in case of git repo if different from master
-        generate_requires_npm = false, -- if stand-alone parser without npm dependencies
-        requires_generate_from_grammar = false, -- if folder contains pre-generated src/parser.c
-      },
-    }
-    -- use scheme parser for filetypes: scm
-    vim.treesitter.language.register("scheme", "scm")
   end,
 }

home/base/tui/editors/packages.nix

@@ -5,7 +5,48 @@
     '';
   };
 
-  home.packages = with pkgs; [
+  home.packages = with pkgs; (
+    # -*- Data & Configuration Languages -*-#
+    [
+      #-- nix
+      nil
+      # rnix-lsp
+      # nixd
+      statix # Lints and suggestions for the nix programming language
+      deadnix # Find and remove unused code in .nix source files
+      alejandra # Nix Code Formatter
+
+      #-- nickel lang
+      nickel
+
+      #-- json like
+      # terraform  # install via brew on macOS
+      terraform-ls
+      jsonnet
+      jsonnet-language-server
+      taplo # TOML language server / formatter / validator
+      nodePackages.yaml-language-server
+      actionlint # GitHub Actions linter
+
+      #-- dockerfile
+      hadolint # Dockerfile linter
+      nodePackages.dockerfile-language-server-nodejs
+
+      #-- markdown
+      marksman # language server for markdown
+      glow # markdown previewer
+      pandoc # document converter
+      hugo # static site generator
+
+      #-- sql
+      sqlfluff
+
+      #-- protocol buffer
+      buf # linting and formatting
+    ]
+    ++
+    #-*- General Purpose Languages -*-#
+    [
       #-- c/c++
       cmake
       cmake-language-server
@@ -13,6 +54,7 @@
       checkmake
       # c/c++ compiler, required by nvim-treesitter!
       gcc
+      gdb
       # c/c++ tools with clang-tools, the unwrapped version won't
       # add alias like `cc` and `c++`, so that it won't conflict with gcc
       # llvmPackages.clang-unwrapped
@@ -20,7 +62,7 @@
       lldb
 
       #-- python
-    nodePackages.pyright # python language server
+      pyright # python language server
       (python311.withPackages (
         ps:
           with ps; [
@@ -53,14 +95,6 @@
       cargo # rust package manager
       rustfmt
 
-    #-- nix
-    nil
-    # rnix-lsp
-    # nixd
-    statix # Lints and suggestions for the nix programming language
-    deadnix # Find and remove unused code in .nix source files
-    alejandra # Nix Code Formatter
-
       #-- golang
       go
       gomodifytags
@@ -75,6 +109,10 @@
       gradle
       maven
       spring-boot-cli
+      jdt-language-server
+
+      #-- zig
+      zls
 
       #-- lua
       stylua
@@ -84,8 +122,9 @@
       nodePackages.bash-language-server
       shellcheck
       shfmt
-
+    ]
-    #-- javascript/typescript --#
+    #-*- Web Development -*-#
+    ++ [
       nodePackages.nodejs
       nodePackages.typescript
       nodePackages.typescript-language-server
@@ -93,45 +132,24 @@
       nodePackages.vscode-langservers-extracted
       nodePackages."@tailwindcss/language-server"
       emmet-ls
-
+    ]
-    # -- Lisp like Languages
+    # -*- Lisp like Languages -*-#
+    ++ [
       guile
       racket-minimal
       fnlfmt # fennel
-
+    ]
-    #-- Others
+    ++ [
-    taplo # TOML language server / formatter / validator
-    nodePackages.yaml-language-server
-    sqlfluff # SQL linter
-    actionlint # GitHub Actions linter
-    buf # protoc plugin for linting and formatting
       proselint # English prose linter
 
-    #-- Misc
-    tree-sitter # common language parser/highlighter
-    nodePackages.prettier # common code formatter
-    marksman # language server for markdown
-    glow # markdown previewer
-    fzf
-    pandoc # document converter
-    hugo # static site generator
-
-    #-- Optional Requirements:
-    gdu # disk usage analyzer, required by AstroNvim
-    (ripgrep.override {withPCRE2 = true;}) # recursively searches directories for a regex pattern
-
-    #-- CloudNative
-    nodePackages.dockerfile-language-server-nodejs
-    # terraform  # install via brew on macOS
-    terraform-ls
-    jsonnet
-    jsonnet-language-server
-    hadolint # Dockerfile linter
-
-    #-- zig
-    zls
       #-- verilog / systemverilog
       verible
-    gdb
+
-  ];
+      #-- Optional Requirements:
+      nodePackages.prettier # common code formatter
+      fzf
+      gdu # disk usage analyzer, required by AstroNvim
+      (ripgrep.override {withPCRE2 = true;}) # recursively searches directories for a regex pattern
+    ]
+  );
 }

home/base/tui/encryption/README.md

@@ -16,7 +16,7 @@ using a Cloud provider for key management.
 Both age, Sops & GnuPG provide asymmetric encryption, which is useful for encrypting files for a
 specific user.
 
-For morden use, age is recommended, as it use [AEAD encryption function -
+For modern use, age is recommended, as it use [AEAD encryption function -
 ChaCha20-Poly1305][age Format v1], If you do not want to manage the keys by yourself, Sops is
 recommended, as it use KMS for key management.
 

home/base/tui/gpg/README.md

@@ -104,7 +104,7 @@ one keypair, or a keyring/keychain(which contains multiple sub key-pairs).
 
 Let's generate a keypair interactively:
 
-> Now in 2024, GnuPG 2.4.1 defaults to ECC algorithm (9) and Curve 25519 for ECC, which is morden
+> Now in 2024, GnuPG 2.4.1 defaults to ECC algorithm (9) and Curve 25519 for ECC, which is modern
 > and safe, I would recommend to use these defaults directly.
 
 ```bash

home/base/tui/shell.nix

@@ -31,9 +31,9 @@ in {
       use ${nu_scripts}/share/nu_scripts/custom-completions/cargo/cargo-completions.nu *
       use ${nu_scripts}/share/nu_scripts/custom-completions/zellij/zellij-completions.nu *
       # alias
-      use ${nu_scripts}/share/nu_scripts/aliases/git/git-aliases.nu *
+      # use ${nu_scripts}/share/nu_scripts/aliases/git/git-aliases.nu *
       use ${nu_scripts}/share/nu_scripts/aliases/eza/eza-aliases.nu *
-      # use ${nu_scripts}/share/nu_scripts/aliases/bat/bat-aliases.nu *
+      use ${nu_scripts}/share/nu_scripts/aliases/bat/bat-aliases.nu *
     '';
   };
 }

home/linux/gui/base/gtk.nix

@@ -45,7 +45,7 @@
 
     theme = {
       # https://github.com/catppuccin/gtk
-      name = "Catppuccin-Macchiato-Compact-Pink-Dark";
+      name = "catppuccin-macchiato-pink-compact";
       package = pkgs.catppuccin-gtk.override {
         # https://github.com/NixOS/nixpkgs/blob/nixos-23.05/pkgs/data/themes/catppuccin-gtk/default.nix
         accents = ["pink"];

home/linux/gui/base/note-taking.nix

@@ -1,5 +1,5 @@
-{pkgs, ...}: {
+{pkgs-stable, ...}: {
-  home.packages = with pkgs; [
+  home.packages = with pkgs-stable; [
     # https://joplinapp.org/help/
     joplin # joplin-cli
     joplin-desktop

home/linux/gui/hyprland/conf/scripts/startup

@@ -1,5 +1,9 @@
 #!/usr/bin/env bash
 
+## Fix anyrun
+## https://github.com/anyrun-org/anyrun/issues/153
+ln -s $XDG_RUNTIME_DIR/hypr /tmp/hypr
+
 ## Autostart Programs
 
 # Kill already running process

home/linux/gui/hyprland/values/hyprland.nix

@@ -1,11 +1,10 @@
 {
   pkgs,
   lib,
-  hyprland,
   nur-ryan4yin,
   ...
 }: let
-  package = hyprland.packages.${pkgs.system}.hyprland;
+  package = pkgs.hyprland;
 in {
   # NOTE:
   # We have to enable hyprland/i3's systemd user service in home-manager,
@@ -30,7 +29,10 @@ in {
     };
     extraConfig = builtins.readFile ../conf/hyprland.conf;
     # gammastep/wallpaper-switcher need this to be enabled.
-    systemd.enable = true;
+    systemd = {
+      enable = true;
+      variables = ["--all"];
+    };
   };
 
   # NOTE: this executable is used by greetd to start a wayland session when system boot up

hosts/12kingdoms-rakushun/Disk-and-Installation.md

@@ -1,157 +0,0 @@
-# Rakushun - Disk and Installation
-
-Disk layout:
-
-```bash
-[ryan@rakushun:~]$ lsblk
-NAME        MAJ:MIN RM  SIZE RO TYPE  MOUNTPOINTS
-sda           8:0    1 58.6G  0 disk
-└─sda1        8:1    1  487M  0 part
-mtdblock0    31:0    0   16M  0 disk
-zram0       254:0    0    0B  0 disk
-nvme0n1     259:0    0  1.8T  0 disk
-├─nvme0n1p1 259:1    0  630M  0 part  /boot
-└─nvme0n1p2 259:2    0  1.8T  0 part
-  └─encrypted 253:0    0  1.8T  0 crypt /tmp
-                                      /swap
-                                      /snapshots
-                                      /home/ryan/tmp
-                                      /home/ryan/nix-config
-                                      /home/ryan/go
-                                      /home/ryan/codes
-                                      /home/ryan/.ssh
-                                      /home/ryan/.local/state
-                                      /home/ryan/.npm
-                                      /home/ryan/.local/share
-                                      /home/ryan/.conda
-                                      /etc/ssh
-                                      /etc/nix/inputs
-                                      /etc/secureboot
-                                      /etc/agenix
-                                      /etc/NetworkManager/system-connections
-                                      /etc/machine-id
-                                      /nix/store
-                                      /var/log
-                                      /var/lib
-                                      /nix
-                                      /persistent
-
-[ryan@rakushun:~]$ df -Th
-Filesystem          Type      Size  Used Avail Use% Mounted on
-devtmpfs            devtmpfs  785M     0  785M   0% /dev
-tmpfs               tmpfs     7.7G     0  7.7G   0% /dev/shm
-tmpfs               tmpfs     3.9G  6.8M  3.9G   1% /run
-tmpfs               tmpfs     7.7G  1.9M  7.7G   1% /run/wrappers
-none                tmpfs     4.0G   48K  4.0G   1% /
-/dev/mapper/crypted btrfs     1.9T   19G  1.8T   2% /persistent
-/dev/mapper/crypted btrfs     1.9T   19G  1.8T   2% /nix
-/dev/mapper/crypted btrfs     1.9T   19G  1.8T   2% /snapshots
-/dev/mapper/crypted btrfs     1.9T   19G  1.8T   2% /swap
-/dev/mapper/crypted btrfs     1.9T   19G  1.8T   2% /tmp
-/dev/nvme0n1p1      vfat      629M   96M  534M  16% /boot
-tmpfs               tmpfs     1.6G  4.0K  1.6G   1% /run/user/1000
-```
-
-CPU info:
-
-```bash
-[ryan@rakushun:~]$ lscpu
-Architecture:           aarch64
-  CPU op-mode(s):       32-bit, 64-bit
-  Byte Order:           Little Endian
-CPU(s):                 8
-  On-line CPU(s) list:  0-7
-Vendor ID:              ARM
-  Model name:           Cortex-A55
-    Model:              0
-    Thread(s) per core: 1
-    Core(s) per socket: 4
-    Socket(s):          1
-    Stepping:           r2p0
-    CPU(s) scaling MHz: 67%
-    CPU max MHz:        1800.0000
-    CPU min MHz:        408.0000
-    BogoMIPS:           48.00
-    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm lrcpc dcpop asimddp
-  Model name:           Cortex-A76
-    Model:              0
-    Thread(s) per core: 1
-    Core(s) per socket: 2
-    Socket(s):          2
-    Stepping:           r4p0
-    CPU(s) scaling MHz: 18%
-    CPU max MHz:        2256.0000
-    CPU min MHz:        408.0000
-    BogoMIPS:           48.00
-    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm lrcpc dcpop asimddp
-Caches (sum of all):
-  L1d:                  384 KiB (8 instances)
-  L1i:                  384 KiB (8 instances)
-  L2:                   2.5 MiB (8 instances)
-  L3:                   3 MiB (1 instance)
-```
-
-## How to install NixOS on Orange Pi 5 Plus
-
-### 1. Prepare a USB LUKS key
-
-Generate LUKS keyfile to encrypt the root partition, it's used by disko.
-
-```bash
-# partition the usb stick
-DEV=/dev/sdX
-parted ${DEV} -- mklabel gpt
-parted ${DEV} -- mkpart OPI5P_DSC fat32 0% 512MB
-mkfs.fat -F 32 -n OPI5P_DSC ${DEV}1
-
-# Generate a keyfile from the true random number generator
-KEYFILE=./orangepi5plus-luks-keyfile
-dd bs=512 count=64 iflag=fullblock if=/dev/random of=$KEYFILE
-
-# copy the keyfile and token to the usb stick
-KEYFILE=./orangepi5plus-luks-keyfile
-DEVICE=/dev/disk/by-label/OPI5P_DSC
-# seek=128 skip N obs-sized output blocks to avoid overwriting the filesystem header
-dd bs=512 count=64 iflag=fullblock seek=128 if=$KEYFILE of=$DEVICE
-```
-
-### 2. Partition the SSD & install NixOS via disko
-
-First, follow
-[UEFI - ryan4yin/nixos-rk3588](https://github.com/ryan4yin/nixos-rk3588/blob/main/UEFI.md) to
-install UEFI bootloader and boot into NixOS live environment via a USB stick.
-
-Then, run the following commands:
-
-```bash
-# transfer the nix-config to the target machine
-rsync -avzP ~/nix-config rk@<ip-addr>:/home/rk/
-
-# login via ssh
-ssh rk@<ip-addr>
-
-cd ~/nix-config/hosts/12kingdoms_rakushun
-# 1. change the disk device path in ./disko-fs.nix to the disk you want to use
-# 2. partition & format the disk via disko
-sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko -- --mode disko ./disko-fs.nix
-
-
-cd ~/nix-config
-# install nixos
-sudo nixos-install --root /mnt --flake .#rakushun --no-root-password --show-trace --verbose
-
-# enter into the installed system, check password & users
-# `su ryan` => `sudo -i` => enter ryan's password => successfully login
-# if login failed, check the password you set in install-1, and try again
-nixos-enter
-
-# NOTE: DO NOT skip this step!!!
-# copy the essential files into /persistent
-# otherwise the / will be cleared and data will lost
-## NOTE: impermanence just create links from / to /persistent
-##       We need to copy files into /persistent manually!!!
-mv /etc/machine-id /persistent/etc/
-mv /etc/ssh /persistent/etc/
-mkdir -p /persistent/home/ryan
-chown -R ryan:ryan /persistent/home/ryan
-```

hosts/12kingdoms-rakushun/README.md

@@ -1,40 +0,0 @@
-# Rakushun - Orange Pi 5 Plus
-
-LUKS encrypted SSD for NixOS, on Orange Pi 5 Plus.
-
-Host running storage, operation and maintenance related services:
-
-1. Storage such as git server, file server/browser, torrent downloader,, etc.
-1. Backup or sync my personal data to cloud or NAS.
-   - For safety, those data should be encrypted before sending to the cloud or my NAS.
-1. Collect and monitor the metrics/logs of my homelab.
-
-## Showcases
-
-![](../../_img/2024-03-07_orangepi5plus_rakushun.webp)
-
-## Features
-
-Services:
-
-1. prometheus + alertmanager + grafana + loki: Monitor the metrics/logs of my homelab.
-1. restic: Backup my personal data to cloud or NAS.
-1. synthing: Sync file between android/macbook/PC and NAS.
-1. gitea: Self-hosted git service.
-1. sftpgo: SFTP server.
-1. transmission & AriaNg: Torrent downloader and HTTP downloader
-1. alist/filebrower: File browser for local/SMB/Cloud
-
-All the services assumes a reverse proxy to be setup in the front, they are all listening on
-localhost, and a caddy service is listening on the local network interface and proxy the requests to
-the services.
-
-TODO: create a private PKI for caddy, to achieve end-to-end encryption between caddy and the
-services.
-
-## Misc
-
-```bash
-# copy closure to another arm64 machine
-nix-copy-closure --to root@suzu  /run/current-system
-```

hosts/12kingdoms-rakushun/default.nix

@@ -1,38 +0,0 @@
-{
-  mylib,
-  disko,
-  nixos-rk3588,
-  myvars,
-  ...
-}:
-#############################################################
-#
-#  Suzu - Orange Pi 5 Plus, RK3588 + 16GB RAM
-#
-#############################################################
-let
-  hostName = "rakushun"; # Define your hostname.
-in {
-  imports =
-    (mylib.scanPaths ./.)
-    ++ [
-      # import the rk3588 module, which contains the configuration for bootloader/kernel/firmware
-      nixos-rk3588.nixosModules.orangepi5plus.core
-      disko.nixosModules.default
-    ];
-
-  networking = {
-    inherit hostName;
-    inherit (myvars.networking) defaultGateway nameservers;
-    inherit (myvars.networking.hostsInterface.${hostName}) interfaces;
-    networkmanager.enable = false;
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.05"; # Did you read the comment?
-}

hosts/12kingdoms-rakushun/disko-fs.nix

@@ -1,111 +0,0 @@
-{
-  # required by impermanence
-  fileSystems."/persistent".neededForBoot = true;
-
-  disko.devices = {
-    nodev."/" = {
-      fsType = "tmpfs";
-      mountOptions = [
-        "size=4G"
-        "defaults"
-        # set mode to 755, otherwise systemd will set it to 777, which cause problems.
-        # relatime: Update inode access times relative to modify or change time.
-        "mode=755"
-      ];
-    };
-
-    # TODO: rename to main
-    disk.sda = {
-      type = "disk";
-      # When using disko-install, we will overwrite this value from the commandline
-      device = "/dev/nvme0n1"; # The device to partition
-      content = {
-        type = "gpt";
-        partitions = {
-          # The EFI & Boot partition
-          ESP = {
-            size = "630M";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-              mountOptions = [
-                "defaults"
-              ];
-            };
-          };
-          # The root partition
-          luks = {
-            size = "100%";
-            content = {
-              type = "luks";
-              name = "encrypted";
-              settings = {
-                keyFile = "/dev/disk/by-label/OPI5P_DSC"; # The keyfile is stored on a USB stick
-                # The maximum size of the keyfile is 8192 KiB
-                # type `cryptsetup --help` to see the compiled-in key and passphrase maximum sizes
-                keyFileSize = 512 * 64; # match the `bs * count` of the `dd` command
-                keyFileOffset = 512 * 128; # match the `bs * skip` of the `dd` command
-                fallbackToPassword = true;
-                allowDiscards = true;
-              };
-              # Whether to add a boot.initrd.luks.devices entry for the specified disk.
-              initrdUnlock = true;
-
-              # encrypt the root partition with luks2 and argon2id, will prompt for a passphrase, which will be used to unlock the partition.
-              # cryptsetup luksFormat
-              extraFormatArgs = [
-                "--type luks2"
-                "--cipher aes-xts-plain64"
-                "--hash sha512"
-                "--iter-time 5000"
-                "--key-size 256"
-                "--pbkdf argon2id"
-                # use true random data from /dev/random, will block until enough entropy is available
-                "--use-random"
-              ];
-              extraOpenArgs = [
-                "--timeout 10"
-              ];
-              content = {
-                type = "btrfs";
-                extraArgs = ["-f"]; # Force override existing partition
-                subvolumes = {
-                  # mount the top-level subvolume at /btr_pool
-                  # it will be used by btrbk to create snapshots
-                  "/" = {
-                    mountpoint = "/btr_pool";
-                    # btrfs's top-level subvolume, internally has an id 5
-                    # we can access all other subvolumes from this subvolume.
-                    mountOptions = ["subvolid=5"];
-                  };
-                  "@nix" = {
-                    mountpoint = "/nix";
-                    mountOptions = ["compress-force=zstd:1" "noatime"];
-                  };
-                  "@persistent" = {
-                    mountpoint = "/persistent";
-                    mountOptions = ["compress-force=zstd:1" "noatime"];
-                  };
-                  "@tmp" = {
-                    mountpoint = "/tmp";
-                    mountOptions = ["compress-force=zstd:1" "noatime"];
-                  };
-                  "@snapshots" = {
-                    mountpoint = "/snapshots";
-                    mountOptions = ["compress-force=zstd:1" "noatime"];
-                  };
-                  "@swap" = {
-                    mountpoint = "/swap";
-                    swap.swapfile.size = "16384M";
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/12kingdoms-rakushun/hardware-configuration.nix

@@ -1,39 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.loader = {
-    # depending on how you configured your disk mounts, change this to /boot or /boot/efi.
-    efi.efiSysMountPoint = "/boot/";
-    efi.canTouchEfiVariables = true;
-    # do not use systemd-boot here, it has problems when running `nixos-install`
-    grub = {
-      device = "nodev";
-      efiSupport = true;
-    };
-  };
-  # clear /tmp on boot to get a stateless /tmp directory.
-  boot.tmp.cleanOnBoot = true;
-
-  boot.initrd.availableKernelModules = ["nvme" "usbhid" "usb_storage"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = [];
-  boot.extraModulePackages = [];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enP3p49s0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enP4p65s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
-}

hosts/12kingdoms-rakushun/homepage/README.md

@@ -1 +0,0 @@
-# Homepage for my Homelab

hosts/12kingdoms-rakushun/homepage/default.nix

@@ -1,25 +0,0 @@
-{pkgs, ...}: let
-  configDir = "/var/lib/homepage-dashboard";
-in {
-  # https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/misc/homepage-dashboard.nix
-  services.homepage-dashboard = {
-    enable = true;
-    listenPort = 4401;
-    openFirewall = false;
-  };
-  systemd.services.homepage-dashboard.environment = {
-    HOMEPAGE_CONFIG_DIR = configDir;
-
-    # 1. The value of env var HOMEPAGE_VAR_XXX will replace {{HOMEPAGE_VAR_XXX}} in any config
-    # HOMEPAGE_VAR_XXX_APIKEY = "myapikey";
-    # 2. The value of env var HOMEPAGE_FILE_XXX must be a file path,
-    # the contents of which will be used to replace {{HOMEPAGE_FILE_XXX}} in any config
-  };
-  # Install the homepage-dashboard configuration files
-  system.activationScripts.installHomepageDashboardConfig = ''
-    mkdir -p ${configDir}
-    ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F600 ${./config}/ ${configDir}/
-
-    ${pkgs.systemdMinimal}/bin/systemctl restart homepage-dashboard
-  '';
-}

hosts/12kingdoms-rakushun/impermanence.nix

@@ -1,75 +0,0 @@
-{
-  impermanence,
-  pkgs,
-  ...
-}: {
-  imports = [
-    impermanence.nixosModules.impermanence
-  ];
-
-  environment.systemPackages = [
-    # `sudo ncdu -x /`
-    pkgs.ncdu
-  ];
-
-  # There are two ways to clear the root filesystem on every boot:
-  ##  1. use tmpfs for /
-  ##  2. (btrfs/zfs only)take a blank snapshot of the root filesystem and revert to it on every boot via:
-  ##     boot.initrd.postDeviceCommands = ''
-  ##       mkdir -p /run/mymount
-  ##       mount -o subvol=/ /dev/disk/by-uuid/UUID /run/mymount
-  ##       btrfs subvolume delete /run/mymount
-  ##       btrfs subvolume snapshot / /run/mymount
-  ##     '';
-  #
-  #  See also https://grahamc.com/blog/erase-your-darlings/
-
-  # NOTE: impermanence only mounts the directory/file list below to /persistent
-  # If the directory/file already exists in the root filesystem, you should
-  # move those files/directories to /persistent first!
-  environment.persistence."/persistent" = {
-    # sets the mount option x-gvfs-hide on all the bind mounts
-    # to hide them from the file manager
-    hideMounts = true;
-    directories = [
-      "/etc/NetworkManager/system-connections"
-      "/etc/ssh"
-      "/etc/nix/inputs"
-      "/etc/secureboot" # lanzaboote - secure boot
-      # my secrets
-      "/etc/agenix/"
-
-      "/var/log"
-      "/var/lib"
-    ];
-    files = [
-      "/etc/machine-id"
-    ];
-
-    # the following directories will be passed to /persistent/home/$USER
-    users.ryan = {
-      directories = [
-        "codes"
-        "nix-config"
-        "tmp"
-
-        {
-          directory = ".ssh";
-          mode = "0700";
-        }
-
-        # neovim / remmina / flatpak / ...
-        ".local/share"
-        ".local/state"
-
-        # language package managers
-        ".npm"
-        ".conda" # generated by `conda-shell`
-        "go"
-      ];
-      files = [
-        ".config/nushell/history.txt"
-      ];
-    };
-  };
-}

hosts/12kingdoms-rakushun/oci-containers/dashy/default.nix

@@ -1,26 +0,0 @@
-{
-  # Replace dashy with gethomepage, because dashy is too slow to start/reload.
-
-  # # Install the dashy configuration file instead of symlink it
-  # system.activationScripts.installDashyConfig = ''
-  #   install -Dm 600 ${./dashy_conf.yml} /etc/dashy/dashy_conf.yml
-  # '';
-  #
-  # # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/virtualisation/oci-containers.nix
-  # virtualisation.oci-containers.containers = {
-  #   # check its logs via `journalctl -u podman-dashy`
-  #   dashy = {
-  #     hostname = "dashy";
-  #     image = "lissy93/dashy:latest";
-  #     ports = ["127.0.0.1:4000:80"];
-  #     environment = {
-  #       "NODE_ENV" = "production";
-  #     };
-  #     volumes = [
-  #       "/etc/dashy/dashy_conf.yml:/app/public/conf.yml"
-  #     ];
-  #     autoStart = true;
-  #     # cmd = [];
-  #   };
-  # };
-}

hosts/12kingdoms-rakushun/uptime-kuma.nix

@@ -1,12 +0,0 @@
-{
-  # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/monitoring/uptime-kuma.nix
-  services.uptime-kuma = {
-    enable = true;
-    # https://github.com/louislam/uptime-kuma/wiki/Environment-Variables
-    settings = {
-      "UPTIME_KUMA_HOST" = "127.0.0.1";
-      "UPTIME_KUMA_PORT" = "3350";
-      "DATA_DIR" = "/var/lib/uptime-kuma/";
-    };
-  };
-}

hosts/12kingdoms-shoukei/hardware-configuration.nix

@@ -44,7 +44,7 @@
   boot.tmp.cleanOnBoot = true;
   boot.initrd = {
     # unlocked luks devices via a keyfile or prompt a passphrase.
-    luks.devices."encrypted-nixos" = {
+    luks.devices."crypted-nixos" = {
       device = "/dev/nvme0n1p4";
       # the keyfile(or device partition) that should be used as the decryption key for the encrypted device.
       # if not specified, you will be prompted for a passphrase instead.

hosts/12kingdoms-suzu/Disk-and-installation.md

@@ -1,156 +0,0 @@
-# Suzu - Disk and Installation
-
-Disk layout:
-
-```bash
-[ryan@suzu:~]$ lsblk
-NAME        MAJ:MIN RM   SIZE RO TYPE  MOUNTPOINTS
-sda           8:0    1  58.6G  0 disk
-└─sda1        8:1    1   486M  0 part
-mtdblock0    31:0    0    16M  0 disk
-zram0       254:0    0     0B  0 disk
-nvme0n1     259:0    0 238.5G  0 disk
-├─nvme0n1p1 259:1    0   630M  0 part  /boot
-└─nvme0n1p2 259:2    0 237.9G  0 part
-  └─encrypted 253:0    0 237.8G  0 crypt /tmp
-                                       /snapshots
-                                       /swap
-                                       /home/ryan/tmp
-                                       /home/ryan/nix-config
-                                       /home/ryan/go
-                                       /home/ryan/.local/state
-                                       /home/ryan/codes
-                                       /home/ryan/.npm
-                                       /home/ryan/.ssh
-                                       /home/ryan/.local/share
-                                       /etc/ssh
-                                       /home/ryan/.conda
-                                       /etc/secureboot
-                                       /etc/agenix
-                                       /etc/nix/inputs
-                                       /etc/NetworkManager/system-connections
-                                       /nix/store
-                                       /var/log
-                                       /var/lib
-                                       /nix
-                                       /persistent
-
-[ryan@suzu:~]$ df -Th
-Filesystem          Type      Size  Used Avail Use% Mounted on
-devtmpfs            devtmpfs  383M     0  383M   0% /dev
-tmpfs               tmpfs     3.8G     0  3.8G   0% /dev/shm
-tmpfs               tmpfs     1.9G  6.2M  1.9G   1% /run
-tmpfs               tmpfs     3.8G  1.9M  3.8G   1% /run/wrappers
-none                tmpfs     2.0G   48K  2.0G   1% /
-/dev/mapper/crypted btrfs     238G   11G  226G   5% /persistent
-/dev/mapper/crypted btrfs     238G   11G  226G   5% /nix
-/dev/mapper/crypted btrfs     238G   11G  226G   5% /swap
-/dev/mapper/crypted btrfs     238G   11G  226G   5% /snapshots
-/dev/mapper/crypted btrfs     238G   11G  226G   5% /tmp
-/dev/nvme0n1p1      vfat      629M   86M  543M  14% /boot
-tmpfs               tmpfs     766M  4.0K  766M   1% /run/user/1000
-```
-
-CPU info:
-
-```bash
-[ryan@suzu:~]$ lscpu
-Architecture:           aarch64
-  CPU op-mode(s):       32-bit, 64-bit
-  Byte Order:           Little Endian
-CPU(s):                 8
-  On-line CPU(s) list:  0-7
-Vendor ID:              ARM
-  Model name:           Cortex-A55
-    Model:              0
-    Thread(s) per core: 1
-    Core(s) per socket: 4
-    Socket(s):          1
-    Stepping:           r2p0
-    CPU(s) scaling MHz: 56%
-    CPU max MHz:        1800.0000
-    CPU min MHz:        408.0000
-    BogoMIPS:           48.00
-    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm lrcpc dcpop asimddp
-  Model name:           Cortex-A76
-    Model:              0
-    Thread(s) per core: 1
-    Core(s) per socket: 2
-    Socket(s):          2
-    Stepping:           r4p0
-    CPU(s) scaling MHz: 18%
-    CPU max MHz:        2256.0000
-    CPU min MHz:        408.0000
-    BogoMIPS:           48.00
-    Flags:              fp asimd evtstrm aes pmull sha1 sha2 crc32 atomics fphp asimdhp cpuid asimdrdm lrcpc dcpop asimddp
-Caches (sum of all):
-  L1d:                  384 KiB (8 instances)
-  L1i:                  384 KiB (8 instances)
-  L2:                   2.5 MiB (8 instances)
-  L3:                   3 MiB (1 instance)
-```
-
-## How to install NixOS on Orange Pi 5
-
-### 1. Prepare a USB LUKS key
-
-Generate LUKS keyfile to encrypt the root partition, it's used by disko.
-
-```bash
-# partition the usb stick
-DEV=/dev/sdX
-parted ${DEV} -- mklabel gpt
-parted ${DEV} -- mkpart primary 2M 512MB
-mkfs.fat -F 32 -n OPI5_DSC ${DEV}1
-
-
-# Generate a keyfile from the true random number generator
-KEYFILE=./orangepi5-luks-keyfile
-dd bs=512 count=64 iflag=fullblock if=/dev/random of=$KEYFILE
-
-# copy the keyfile and token to the usb stick
-KEYFILE=./orangepi5-luks-keyfile
-DEVICE=/dev/disk/by-label/OPI5_DSC
-# seek=128 skip N obs-sized output blocks to avoid overwriting the filesystem header
-dd bs=512 count=64 iflag=fullblock seek=128 if=$KEYFILE of=$DEVICE
-```
-
-### 2. Partition the SSD & install NixOS via disko
-
-First, follow
-[UEFI - ryan4yin/nixos-rk3588](https://github.com/ryan4yin/nixos-rk3588/blob/main/UEFI.md) to
-install UEFI bootloader and boot into NixOS live environment via a USB stick.
-
-Then, run the following commands:
-
-```bash
-# login via ssh
-ssh rk@<ip-addr>
-
-git clone https://github.com/ryan4yin/nix-config.git
-
-cd ~/nix-config/hosts/12kingdoms_suzu
-# 1. change the disk device path in ./disko-fs.nix to the disk you want to use
-# 2. partition & format the disk via disko
-sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko -- --mode disko ./disko-fs.nix
-
-
-cd ~/nix-config
-# install nixos
-sudo nixos-install --root /mnt --flake .#suzu --no-root-password --show-trace --verbose
-
-# enter into the installed system, check password & users
-# `su ryan` => `sudo -i` => enter ryan's password => successfully login
-# if login failed, check the password you set in install-1, and try again
-nixos-enter
-
-# NOTE: DO NOT skip this step!!!
-# copy the essential files into /persistent
-# otherwise the / will be cleared and data will lost
-## NOTE: impermanence just create links from / to /persistent
-##       We need to copy files into /persistent manually!!!
-mv /etc/machine-id /persistent/etc/
-mv /etc/ssh /persistent/etc/
-mkdir -p /persistent/home/ryan
-chown -R ryan:ryan /persistent/home/ryan
-```

hosts/12kingdoms-suzu/README.md

@@ -1,34 +0,0 @@
-# Suzu - Orange Pi 5
-
-LUKS encrypted SSD for NixOS, on Orange Pi 5.
-
-## TODOs
-
-- [ ] Add support for BGP routing.
-  - [Comparing Open Source BGP Stacks](https://elegantnetwork.github.io/posts/comparing-open-source-bgp-stacks/)
-  - [`services.frr.*` - search.nixos.org](https://search.nixos.org/options?channel=unstable&query=services.frr)
-
-## Showcases
-
-![](../../_img/2024-03-07_orangepi5_suzu.webp)
-
-## Features
-
-Micro VMs:
-
-1. suzi: dae router(transparent proxy, dhcp)
-1. mitsuha: tailscale gateway(sub router)
-
-Services:
-
-1. OCI Containers: to run some servides that's not available in NixOS.
-1. ddns
-1. uptime-kuma: uptime monitoring
-1. excalidraw/DDTV/owncast/jitsi-meet/...
-
-All the services assumes a reverse proxy to be setup in the front, they are all listening on
-localhost, and a caddy service is listening on the local network interface and proxy the requests to
-the services.
-
-TODO: create a private PKI for caddy, to achieve end-to-end encryption between caddy and the
-services.

hosts/12kingdoms-suzu/default.nix

@@ -1,34 +0,0 @@
-{
-  disko,
-  nixos-rk3588,
-  mylib,
-  ...
-}:
-#############################################################
-#
-#  Suzu - Orange Pi 5 Plus, RK3588 + 16GB RAM
-#
-#  https://github.com/astro/microvm.nix
-#
-#############################################################
-let
-  hostName = "suzu"; # Define your hostname.
-in {
-  imports =
-    (mylib.scanPaths ./.)
-    ++ [
-      # import the rk3588 module, which contains the configuration for bootloader/kernel/firmware
-      nixos-rk3588.nixosModules.orangepi5plus.core
-      disko.nixosModules.default
-    ];
-
-  networking = {inherit hostName;};
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "24.05"; # Did you read the comment?
-}

hosts/12kingdoms-suzu/disko-fs.nix

@@ -1,111 +0,0 @@
-{
-  # required by impermanence
-  fileSystems."/persistent".neededForBoot = true;
-
-  disko.devices = {
-    nodev."/" = {
-      fsType = "tmpfs";
-      mountOptions = [
-        "size=2G"
-        "defaults"
-        # set mode to 755, otherwise systemd will set it to 777, which cause problems.
-        # relatime: Update inode access times relative to modify or change time.
-        "mode=755"
-      ];
-    };
-
-    # TODO: rename to main
-    disk.sda = {
-      type = "disk";
-      # When using disko-install, we will overwrite this value from the commandline
-      device = "/dev/nvme0n1"; # The device to partition
-      content = {
-        type = "gpt";
-        partitions = {
-          # The EFI & Boot partition
-          ESP = {
-            size = "630M";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-              mountOptions = [
-                "defaults"
-              ];
-            };
-          };
-          # The root partition
-          luks = {
-            size = "100%";
-            content = {
-              type = "luks";
-              name = "encrypted";
-              settings = {
-                keyFile = "/dev/disk/by-label/OPI5_DSC"; # The keyfile is stored on a USB stick
-                # The maximum size of the keyfile is 8192 KiB
-                # type `cryptsetup --help` to see the compiled-in key and passphrase maximum sizes
-                keyFileSize = 512 * 64; # match the `bs * count` of the `dd` command
-                keyFileOffset = 512 * 128; # match the `bs * skip` of the `dd` command
-                fallbackToPassword = true;
-                allowDiscards = true;
-              };
-              # Whether to add a boot.initrd.luks.devices entry for the specified disk.
-              initrdUnlock = true;
-
-              # encrypt the root partition with luks2 and argon2id, will prompt for a passphrase, which will be used to unlock the partition.
-              # cryptsetup luksFormat
-              extraFormatArgs = [
-                "--type luks2"
-                "--cipher aes-xts-plain64"
-                "--hash sha512"
-                "--iter-time 5000"
-                "--key-size 256"
-                "--pbkdf argon2id"
-                # use true random data from /dev/random, will block until enough entropy is available
-                "--use-random"
-              ];
-              extraOpenArgs = [
-                "--timeout 10"
-              ];
-              content = {
-                type = "btrfs";
-                extraArgs = ["-f"]; # Force override existing partition
-                subvolumes = {
-                  # mount the top-level subvolume at /btr_pool
-                  # it will be used by btrbk to create snapshots
-                  "/" = {
-                    mountpoint = "/btr_pool";
-                    # btrfs's top-level subvolume, internally has an id 5
-                    # we can access all other subvolumes from this subvolume.
-                    mountOptions = ["subvolid=5"];
-                  };
-                  "@nix" = {
-                    mountpoint = "/nix";
-                    mountOptions = ["compress-force=zstd:1" "noatime"];
-                  };
-                  "@persistent" = {
-                    mountpoint = "/persistent";
-                    mountOptions = ["compress-force=zstd:1" "noatime"];
-                  };
-                  "@tmp" = {
-                    mountpoint = "/tmp";
-                    mountOptions = ["compress-force=zstd:1" "noatime"];
-                  };
-                  "@snapshots" = {
-                    mountpoint = "/snapshots";
-                    mountOptions = ["compress-force=zstd:1" "noatime"];
-                  };
-                  "@swap" = {
-                    mountpoint = "/swap";
-                    swap.swapfile.size = "8192M";
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/12kingdoms-suzu/hardware-configuration.nix

@@ -1,39 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.loader = {
-    # depending on how you configured your disk mounts, change this to /boot or /boot/efi.
-    efi.efiSysMountPoint = "/boot/";
-    efi.canTouchEfiVariables = true;
-    # do not use systemd-boot here, it has problems when running `nixos-install`
-    grub = {
-      device = "nodev";
-      efiSupport = true;
-    };
-  };
-  # clear /tmp on boot to get a stateless /tmp directory.
-  boot.tmp.cleanOnBoot = true;
-
-  boot.initrd.availableKernelModules = ["nvme" "usbhid" "usb_storage"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = [];
-  boot.extraModulePackages = [];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enP3p49s0.useDHCP = lib.mkDefault true;
-  # networking.interfaces.enP4p65s0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
-}

hosts/12kingdoms-suzu/impermanence.nix

@@ -1,75 +0,0 @@
-{
-  impermanence,
-  pkgs,
-  ...
-}: {
-  imports = [
-    impermanence.nixosModules.impermanence
-  ];
-
-  environment.systemPackages = [
-    # `sudo ncdu -x /`
-    pkgs.ncdu
-  ];
-
-  # There are two ways to clear the root filesystem on every boot:
-  ##  1. use tmpfs for /
-  ##  2. (btrfs/zfs only)take a blank snapshot of the root filesystem and revert to it on every boot via:
-  ##     boot.initrd.postDeviceCommands = ''
-  ##       mkdir -p /run/mymount
-  ##       mount -o subvol=/ /dev/disk/by-uuid/UUID /run/mymount
-  ##       btrfs subvolume delete /run/mymount
-  ##       btrfs subvolume snapshot / /run/mymount
-  ##     '';
-  #
-  #  See also https://grahamc.com/blog/erase-your-darlings/
-
-  # NOTE: impermanence only mounts the directory/file list below to /persistent
-  # If the directory/file already exists in the root filesystem, you should
-  # move those files/directories to /persistent first!
-  environment.persistence."/persistent" = {
-    # sets the mount option x-gvfs-hide on all the bind mounts
-    # to hide them from the file manager
-    hideMounts = true;
-    directories = [
-      "/etc/NetworkManager/system-connections"
-      "/etc/ssh"
-      "/etc/nix/inputs"
-      "/etc/secureboot" # lanzaboote - secure boot
-      # my secrets
-      "/etc/agenix/"
-
-      "/var/log"
-      "/var/lib"
-    ];
-    files = [
-      "/etc/machine-id"
-    ];
-
-    # the following directories will be passed to /persistent/home/$USER
-    users.ryan = {
-      directories = [
-        "codes"
-        "nix-config"
-        "tmp"
-
-        {
-          directory = ".ssh";
-          mode = "0700";
-        }
-
-        # neovim / remmina / flatpak / ...
-        ".local/share"
-        ".local/state"
-
-        # language package managers
-        ".npm"
-        ".conda" # generated by `conda-shell`
-        "go"
-      ];
-      files = [
-        ".config/nushell/history.txt"
-      ];
-    };
-  };
-}

hosts/12kingdoms-suzu/microvm/README.md

@@ -1,45 +0,0 @@
-# microvm.nix
-
-## Commands
-
-> https://github.com/astro/microvm.nix/blob/main/doc/src/microvm-command.md
-
-```bash
-# list vm
-microvm -l
-
-# update vm
-microvm -u my-microvm
-
-
-# show logs of a vm
-journalctl -u microvm@my-microvm -n 50
-
-# stop vm
-systemctl stop microvm@$NAME
-
-# remove vm
-rm -rf /var/lib/microvms/$NAME
-
-# Run a MicroVM in foreground(for testing)
-# You have to stop the vm before running this command!
-microvm -r my-microvm
-
-# Stop a MicroVM that is running in foreground
-## 1. run `sudo shutdown -h now` in the vm
-## 2. run `systemctl stop microvm@my-microvm` in the host
-```
-
-## VM's pros compared to container
-
-1. VM has its own kernel, so it can use a fullfeatured kernel or customise the kernel's
-   configuration, without affecting the host.
-1. VM use a fullfeatured init system, so it can run services like a real machine.
-1. VM can use a fullfeatured network stack, so it can run network services like a real machine. it's
-   very useful for hosting some network services(such as tailscale, dae, etc).
-
-## FAQ
-
-### 1. enter the vm without ssh
-
-[Enter running machine as systemd service](https://github.com/astro/microvm.nix/issues/123)

hosts/12kingdoms-suzu/microvm/default.nix

@@ -1,35 +0,0 @@
-{
-  myvars,
-  mylib,
-  daeuniverse,
-  agenix,
-  microvm,
-  mysecrets,
-  nuenv,
-  ...
-}: {
-  imports = [
-    # Include the microvm host module
-    microvm.nixosModules.host
-  ];
-
-  microvm.vms = {
-    suzi = {
-      autostart = true;
-      restartIfChanged = true;
-
-      specialArgs = {inherit myvars mylib daeuniverse agenix mysecrets nuenv;};
-
-      config.imports = [./suzi];
-    };
-
-    mitsuha = {
-      autostart = true;
-      restartIfChanged = true;
-
-      specialArgs = {inherit myvars mylib nuenv;};
-
-      config.imports = [./mitsuha];
-    };
-  };
-}

hosts/12kingdoms-suzu/microvm/mitsuha/default.nix

@@ -1,67 +0,0 @@
-{mylib, ...}: {
-  imports =
-    (mylib.scanPaths ./.)
-    ++ [
-      ../../../../modules/nixos/base/ssh.nix
-      ../../../../modules/nixos/base/user-group.nix
-      ../../../../modules/base.nix
-    ];
-
-  microvm = {
-    mem = 1024; # RAM allocation in MB
-    vcpu = 1; # Number of Virtual CPU cores
-
-    interfaces = [
-      {
-        type = "tap";
-        id = "vm-mitsuha"; # should be prefixed with "vm-"
-        mac = "02:00:00:00:00:02"; # Unique MAC address
-      }
-    ];
-
-    # Block device images for persistent storage
-    # microvm use tmpfs for root(/), so everything else
-    # is ephemeral and will be lost on reboot.
-    #
-    # you can check this by running `df -Th` & `lsblk` in the VM.
-    volumes = [
-      {
-        mountPoint = "/var";
-        image = "var.img";
-        size = 512;
-      }
-      {
-        mountPoint = "/etc";
-        image = "etc.img";
-        size = 50;
-      }
-    ];
-
-    # shares can not be set to `neededForBoot = true;`
-    # so if you try to use a share in boot script(such as system.activationScripts), it will fail!
-    shares = [
-      {
-        # It is highly recommended to share the host's nix-store
-        # with the VMs to prevent building huge images.
-        # a host's /nix/store will be picked up so that no
-        # squashfs/erofs will be built for it.
-        #
-        # by this way, /nix/store is readonly in the VM,
-        # and thus the VM can't run any command that modifies
-        # the store. such as nix build, nix shell, etc...
-        # if you want to run nix commands in the VM, see
-        # https://github.com/astro/microvm.nix/blob/main/doc/src/shares.md#writable-nixstore-overlay
-        tag = "ro-store"; # Unique virtiofs daemon tag
-        proto = "virtiofs"; # virtiofs is faster than 9p
-        source = "/nix/store";
-        mountPoint = "/nix/.ro-store";
-      }
-    ];
-
-    hypervisor = "qemu";
-    # Control socket for the Hypervisor so that a MicroVM can be shutdown cleanly
-    socket = "control.socket";
-  };
-
-  system.stateVersion = "24.05";
-}

hosts/12kingdoms-suzu/microvm/mitsuha/networking.nix

@@ -1,19 +0,0 @@
-{myvars, ...}: let
-  hostName = "mitsuha";
-  inherit (myvars.networking) mainGateway nameservers;
-  inherit (myvars.networking.hostsAddr.${hostName}) ipv4;
-
-  ipv4WithMask = "${ipv4}/24";
-in {
-  systemd.network.enable = true;
-
-  systemd.network.networks."20-lan" = {
-    matchConfig.Type = "ether";
-    networkConfig = {
-      Address = [ipv4WithMask];
-      Gateway = mainGateway;
-      DNS = nameservers;
-      DHCP = "no";
-    };
-  };
-}

hosts/12kingdoms-suzu/microvm/mitsuha/tailscale.nix

@@ -1,42 +0,0 @@
-{pkgs, ...}:
-# =============================================================
-#
-# Tailscale - your own private network(VPN) that uses WireGuard
-#
-# It's open source and free for personal use,
-# and it's really easy to setup and use.
-# Tailscale has great client coverage for Linux, windows, Mac, android, and iOS.
-# Tailscale is more mature and stable compared to other alternatives such as netbird/netmaker.
-# Maybe I'll give netbird/netmaker a try when they are more mature, but for now, I'm sticking with Tailscale.
-#
-# How to use:
-#  1. Create a Tailscale account at https://login.tailscale.com
-#  2. Login via `tailscale login`
-#  3. join into your Tailscale network via `tailscale up --advertise-routes 192.168.5.0/24`
-#  4. If you prefer automatic connection to Tailscale, use the `authKeyFile` option` in the config below.
-#
-# Status Data:
-#   `journalctl -u tailscaled` shows tailscaled's logs
-#   logs indicate that tailscale store its data in /var/lib/tailscale
-#   which is already persistent across reboots(via impermanence.nix)
-#
-# References:
-# https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/networking/tailscale.nix
-#
-# =============================================================
-{
-  # make the tailscale command usable to users
-  environment.systemPackages = [pkgs.tailscale];
-
-  # enable the tailscale service
-  services.tailscale = {
-    enable = true;
-    port = 41641;
-    interfaceName = "tailscale0";
-    # allow the Tailscale UDP port through the firewall
-    openFirewall = true;
-    useRoutingFeatures = "server";
-    extraUpFlags = "--advertise-routes 192.168.5.0/24";
-    # authKeyFile = "/var/lib/tailscale/authkey";
-  };
-}

hosts/12kingdoms-suzu/microvm/suzi/README.md

@@ -1,48 +0,0 @@
-# Dae - NixOS Router
-
-A router(IPv4 only) with a transparent proxy to bypass the G|F|W.
-
-NOTE: dae do not provides a http/socks5 proxy server, so a v2ray server is running on
-[idols_kana](../idols_kana/proxy.nix) to provides a http/socks5 proxy service.
-
-## Troubleshooting
-
-### Can not access the global internet
-
-1. Check whether the subscription url is accessible.
-   - If not, then you need to get a new subscription url and update the `dae`'s configuration.
-1. Check the `dae` service's log by `journalctl -u dae -n 1000`.
-
-### DNS cannot be resolved
-
-1. `sudo systemctl stop dae`, then try to resolve the domain name again.
-   - If it works, the problem is caused by `dae` service.
-   - check dae's log by `journalctl -u dae -n 1000`
-1. DNS & DHCP is provided by `dnsmasq` service, check the configuration of `dnsmasq`.
-
-### DHCP cannot be obtained
-
-1. `ss -tunlp`, check if `dnsmasq` is running and listening on udp port 67.
-1. `journalctl -u dnsmasq -n 1000` to check the log of `dnsmasq`.
-1. Request a new IP address by disconnect and reconnect one of your devices' wifi.
-1. `nix shell nixpkgs#dhcpdump` and then `sudo dhcpdump -i br-lan`, check if the DHCP request is
-   received by `dnsmasq`.
-   1. The server listens on UDP port number 67, and the client listens on UDP port number 68.
-   1. DHCP operations fall into four phases:
-      1. Server **discovery**: The DHCP client broadcasts a DHCPDISCOVER message on the network
-         subnet using the destination address 255.255.255.255 (limited broadcast) or the specific
-         subnet broadcast address (directed broadcast).
-      1. IP lease **offer**: When a DHCP server receives a DHCPDISCOVER message from a client, which
-         is an IP address lease request, the DHCP server reserves an IP address for the client and
-         makes a lease offer by sending a DHCPOFFER message to the client.
-      1. IP lease **request**: In response to the DHCP offer, the client replies with a DHCPREQUEST
-         message, broadcast to the server,[a] requesting the offered address.
-      1. IP lease **acknowledgement**: When the DHCP server receives the DHCPREQUEST message from
-         the client, it sends a DHCPACK packet to the client, which includes the lease duration and
-         any other configuration information that the client might have requested.
-   1. So if you see only `DISCOVER` messages, the dhsmasq is not working properly.
-
-## References
-
-- <https://github.com/ghostbuster91/blogposts/blob/main/router2023-part2/main.md>
-- <https://github.com/ghostbuster91/nixos-router>

hosts/12kingdoms-suzu/microvm/suzi/config.dae

@@ -1,320 +0,0 @@
-# https://github.com/daeuniverse/dae/discussions/81
-# https://github.com/daeuniverse/dae/blob/main/example.dae
-
-# load all dae files placed in ./config.d/
-include {
-    config.d/*.dae
-}
-global {
-    ##### Software options.
-
-    # tproxy port to listen on. It is NOT a HTTP/SOCKS port, and is just used by eBPF program.
-    # In normal case, you do not need to use it.
-    tproxy_port: 12345
-
-    # Set it true to protect tproxy port from unsolicited traffic. Set it false to allow users to use self-managed
-    # iptables tproxy rules.
-    tproxy_port_protect: true
-
-    # If not zero, traffic sent from dae will be set SO_MARK. It is useful to avoid traffic loop with iptables tproxy
-    # rules.
-    so_mark_from_dae: 1
-
-    # Log level: error, warn, info, debug, trace.
-    log_level: info
-
-    # Disable waiting for network before pulling subscriptions.
-    disable_waiting_network: false
-
-
-    ##### Interface and kernel options.
-
-    # The LAN interface to bind. Use it if you want to proxy LAN.
-    # Multiple interfaces split by ",".
-    lan_interface: br-lan
-
-    # The WAN interface to bind. Use it if you want to proxy localhost.
-    # Multiple interfaces split by ",". Use "auto" to auto detect.
-    # 
-    # Disable this to avoid problems with the proxy server that prevent the subscription link from being updated
-    # wan_interface: auto
-
-    # Automatically configure Linux kernel parameters like ip_forward and send_redirects. Check out
-    # https://github.com/daeuniverse/dae/blob/main/docs/en/user-guide/kernel-parameters.md to see what will dae do.
-    auto_config_kernel_parameter: false
-
-    ##### Node connectivity check.
-
-    # Host of URL should have both IPv4 and IPv6 if you have double stack in local.
-    # First is URL, others are IP addresses if given.
-    # Considering traffic consumption, it is recommended to choose a site with anycast IP and less response.
-    #tcp_check_url: 'http://cp.cloudflare.com'
-    tcp_check_url: 'http://cp.cloudflare.com,1.1.1.1,2606:4700:4700::1111'
-
-    # The HTTP request method to `tcp_check_url`. Use 'HEAD' by default because some server implementations bypass
-    # accounting for this kind of traffic.
-    tcp_check_http_method: HEAD
-
-    # This DNS will be used to check UDP connectivity of nodes. And if dns_upstream below contains tcp, it also be used to check
-    # TCP DNS connectivity of nodes.
-    # First is URL, others are IP addresses if given.
-    # This DNS should have both IPv4 and IPv6 if you have double stack in local.
-    #udp_check_dns: 'dns.google.com:53'
-    udp_check_dns: 'dns.google.com:53,8.8.8.8,2001:4860:4860::8888'
-
-    check_interval: 30s
-
-    # Group will switch node only when new_latency <= old_latency - tolerance.
-    check_tolerance: 50ms
-
-
-    ##### Connecting options.
-
-    # Optional values of dial_mode are:
-    # 1. "ip". Dial proxy using the IP from DNS directly. This allows your ipv4, ipv6 to choose the optimal path
-    #       respectively, and makes the IP version requested by the application meet expectations. For example, if you
-    #       use curl -4 ip.sb, you will request IPv4 via proxy and get a IPv4 echo. And curl -6 ip.sb will request IPv6.
-    #       This may solve some weird full-cone problem if your are be your node support that. Sniffing will be disabled
-    #       in this mode.
-    # 2. "domain". Dial proxy using the domain from sniffing. This will relieve DNS pollution problem to a great extent
-    #       if have impure DNS environment. Generally, this mode brings faster proxy response time because proxy will
-    #       re-resolve the domain in remote, thus get better IP result to connect. This policy does not impact routing.
-    #       That is to say, domain rewrite will be after traffic split of routing and dae will not re-route it.
-    # 3. "domain+". Based on domain mode but do not check the reality of sniffed domain. It is useful for users whose
-    #       DNS requests do not go through dae but want faster proxy response time. Notice that, if DNS requests do not
-    #       go through dae, dae cannot split traffic by domain.
-    # 4. "domain++". Based on domain+ mode but force to re-route traffic using sniffed domain to partially recover
-    #       domain based traffic split ability. It doesn't work for direct traffic and consumes more CPU resources.
-    dial_mode: domain
-
-    # Allow insecure TLS certificates. It is not recommended to turn it on unless you have to.
-    allow_insecure: false
-
-    # Timeout to waiting for first data sending for sniffing. It is always 0 if dial_mode is ip. Set it higher is useful
-    # in high latency LAN network.
-    sniffing_timeout: 100ms
-
-    # TLS implementation. tls is to use Go's crypto/tls. utls is to use uTLS, which can imitate browser's Client Hello.
-    tls_implementation: tls
-
-    # The Client Hello ID for uTLS to imitate. This takes effect only if tls_implementation is utls.
-    # See more: https://github.com/daeuniverse/dae/blob/331fa23c16/component/outbound/transport/tls/utls.go#L17
-    utls_imitate: chrome_auto
-}
-
-# See https://github.com/daeuniverse/dae/blob/main/docs/en/configuration/dns.md for full examples.
-dns {
-    # For example, if ipversion_prefer is 4 and the domain name has both type A and type AAAA records, the dae will only
-    # respond to type A queries and response empty answer to type AAAA queries.
-    ipversion_prefer: 4
-
-    # Give a fixed ttl for domains. Zero means that dae will request to upstream every time and not cache DNS results
-    # for these domains.
-    #fixed_domain_ttl {
-    #    ddns.example.org: 10
-    #    test.example.org: 3600
-    #}
-
-    upstream {
-        # Value can be scheme://host:port, where the scheme can be tcp/udp/tcp+udp.
-        # If host is a domain and has both IPv4 and IPv6 record, dae will automatically choose
-        # IPv4 or IPv6 to use according to group policy (such as min latency policy).
-        # Please make sure DNS traffic will go through and be forwarded by dae, which is REQUIRED for domain routing.
-        # If dial_mode is "ip", the upstream DNS answer SHOULD NOT be polluted, so domestic public DNS is not recommended.
-
-        alidns: 'udp://223.5.5.5:53'
-        googledns: 'tcp+udp://8.8.8.8:53'
-    }
-    routing {
-        # According to the request of dns query, decide to use which DNS upstream.
-        # Match rules from top to bottom.
-        request {
-            # Lookup China mainland domains using alidns, otherwise googledns.
-            qname(geosite:cn) -> alidns
-            # fallback is also called default.
-            fallback: googledns
-
-            # other custom rules
-            qname(full:analytics.google.com) -> googledns # do not block google analytics(console)
-            qname(regex: '.+\.nixos.org$') -> googledns
-            qname(geosite:category-ads) -> reject
-            qname(geosite:category-ads-all) -> reject
-            qtype(aaaa) -> reject
-            qname(regex: '.+\.linkedin$') -> googledns
-        }
-
-        # According to the response of dns query, decide to accept or re-lookup using another DNS upstream.
-        # Match rules from top to bottom.
-        response {
-            # Trusted upstream. Always accept its result.
-            upstream(googledns) -> accept
-
-            # Possibly polluted(domain resolved to a private ip), re-lookup using googledns.
-            ip(geoip:private) && !qname(geosite:cn) -> googledns
-
-            fallback: accept
-        }
-    }
-}
-
-# Node group (outbound).
-group {
-    proxy {
-        filter: name(keyword: 'Hong Kong')
-        filter: name(keyword: '香港')
-        filter: name(keyword: 'Singapore')
-        filter: name(keyword: '新加坡')
-        # Filter nodes and give a fixed latency offset to archive latency-based failover.
-        # In this example, there is bigger possibility to choose US node even if original latency of US node is higher.
-        filter: name(keyword: 'USA') [add_latency: -500ms]
-        filter: name(keyword: '美国') [add_latency: -500ms]
-        filter: name(keyword: 'UK') [add_latency: -300ms]
-        # filter: name(keyword: '英国') [add_latency: -300ms]
-        # filter: name(keyword: 'Japan') [add_latency: 300ms]
-        # filter: name(keyword: '日本') [add_latency: 300ms]
-
-        # Other filters:
-        #   Filter nodes from the global node pool defined by the subscription and node section above.
-        #     filter: subtag(regex: '^my_', another_sub) && !name(keyword: 'ExpireAt:')
-        #   Filter nodes from the global node pool defined by tag.
-        #     filter: name('node_a','node_b')
-
-        # Select the node with min average of the last 10 latencies from the group for every connection.
-        policy: min_avg10
-        # Other policies:
-        #   random         - Randomly select a node from the group for every connection.
-        #   fixed(0)       - Select the first node from the group for every connection.
-        #   min            - Select the node with min last latency from the group for every connection.
-        #   min_moving_avg - Select the node with min moving average of latencies from the group for every connection.
-    }
-
-    media {
-        filter: name(keyword: 'Hong Kong')
-        filter: name(keyword: '香港')
-        filter: name(keyword: 'Singapore')
-        filter: name(keyword: '新加坡')
-        filter: name(keyword: 'USA') [add_latency: -500ms]
-        filter: name(keyword: '美国') [add_latency: -500ms]
-        filter: name(keyword: 'UK') [add_latency: -300ms]
-        filter: name(keyword: '英国') [add_latency: -300ms]
-        filter: name(keyword: 'Japan') [add_latency: 300ms]
-        filter: name(keyword: '日本') [add_latency: 300ms]
-
-        policy: min_avg10
-    }
-
-    ssh-proxy {
-        filter: name(keyword: 'UK')
-        filter: name(keyword: '英国')
-        policy: min_avg10
-    }
-
-    sg {
-        filter: name(keyword: 'Singapore')
-        filter: name(keyword: '新加坡')
-        policy: min_avg10
-    }
-
-    usa {
-        filter: name(keyword: 'USA')
-        filter: name(keyword: '美国')
-        policy: min_avg10
-    }
-}
-
-# See https://github.com/daeuniverse/dae/blob/main/docs/en/configuration/routing.md for full examples.
-# Pname has the highest priority, so should be placed in the front.
-# Priority of other rules is the same as the order of the rules defined in this file.
-routing {
-    ### Preset rules.
-
-    # Network managers in localhost should be direct to 
-    # avoid false negative network connectivity check when binding to WAN.
-    pname(NetworkManager) -> direct
-    pname(systemd-networkd) -> direct
-
-    # Put it in the front to prevent broadcast, multicast and other packets that should be sent to the LAN from being
-    # forwarded by the proxy.
-    # "dip" means destination IP.
-    dip(224.0.0.0/3, 'ff00::/8') -> direct
-
-    # This line allows you to access private addresses directly instead of via your proxy. If you really want to access
-    # private addresses in your proxy host network, modify the below line.
-    dip(geoip:private) -> direct
-
-    # --- Core rules ---#
-
-    # Disable HTTP3(QUIC) because it usually consumes too much cpu/mem resources.
-    l4proto(udp) && dport(443) -> block
-
-    # Direct access to all Chinese mainland-related IP addresses
-    dip(geoip:cn) -> direct
-    domain(geosite:cn) -> direct
-
-    # Block ads
-    domain(full:analytics.google.com) -> proxy  # do not block google analytics(console)
-    domain(geosite:category-ads) -> block
-    domain(geosite:category-ads-all) -> block
-
-    # DNS
-    dip(8.8.8.8, 8.8.4.4) -> proxy
-    dip(223.5.5.5, 223.6.6.6) -> direct
-    domain(full:dns.alidns.com) -> direct
-    domain(full:dns.googledns.com) -> proxy
-    domain(full:dns.opendns.com) -> proxy
-
-    # --- Rules for other commonly used sites ---#
-
-    # SSH - tcp port 22 is blocked by many proxy servers.
-    dport(22) && !dip(geoip:cn) && !domain(geosite:cn) -> ssh-proxy
-
-    ### OpenAI
-    domain(geosite:openai) -> sg
-    domain(regex:'.+\.openai$') -> sg
-
-    ### Media
-    domain(geosite:netflix) -> media
-
-    ### Proxy
-    domain(suffix: linkedin.com) -> proxy
-    domain(keyword:'linkedin') -> proxy
-    domain(regex:'.+\.linkedin\.com$') -> proxy
-    domain(regex:'.+\.quay\.io$') -> proxy
-    domain(regex:'.+\.notion\.so$') -> proxy
-    domain(regex:'.+\.amazon\.com$') -> proxy
-    domain(regex:'.+\.oracle\.com$') -> proxy
-    domain(regex:'.+\.docker\.com$') -> proxy
-    domain(regex:'.+\.kubernetes\.io$') -> proxy
-    domain(regex:'.+\.nixos\.org$') -> proxy
-
-    domain(geosite:microsoft) -> proxy
-    domain(geosite:linkedin) -> proxy
-    domain(geosite:twitter) -> proxy
-    domain(geosite:telegram) -> proxy
-    domain(geosite:google) -> proxy
-    domain(geosite:apple) -> proxy
-    domain(geosite:category-container) -> proxy
-    domain(geosite:category-dev) -> proxy
-    domain(geosite:google-scholar) -> proxy
-    domain(geosite:category-scholar-!cn) -> proxy
-
-    ### Direct
-    domain(regex:'.+\.edu\.cn$') -> direct
-    domain(keyword:'baidu') -> direct
-    domain(keyword:'bilibili') -> direct
-    domain(keyword:'taobao') -> direct
-    domain(keyword:'alibabadns') -> direct
-    domain(keyword:'alicdn') -> direct
-    domain(keyword:'tbcache') -> direct
-    domain(keyword:'zhihu') -> direct
-    domain(keyword:'douyu') -> direct
-    domain(geosite:cloudflare-cn) -> direct
-
-    # --- Fallback rules ---#
-
-    # Access all other foreign sites
-    domain(geosite:geolocation-!cn) -> proxy
-    !dip(geoip:cn) -> proxy
-
-    fallback: direct
-}

hosts/12kingdoms-suzu/microvm/suzi/dae.nix

@@ -1,61 +0,0 @@
-{
-  config,
-  pkgs,
-  daeuniverse,
-  ...
-}:
-# https://github.com/daeuniverse/flake.nix
-let
-  daeConfigPath = "/etc/dae/config.dae";
-  subscriptionConfigPath = "/etc/dae/config.d/subscription.dae";
-in {
-  imports = [
-    daeuniverse.nixosModules.dae
-  ];
-
-  # dae - eBPF-based Linux high-performance transparent proxy.
-  services.dae = {
-    enable = true;
-    package = daeuniverse.packages.${pkgs.system}.dae;
-    disableTxChecksumIpGeneric = false;
-    configFile = daeConfigPath;
-    assets = with pkgs; [v2ray-geoip v2ray-domain-list-community];
-    # alternatively, specify assets dir
-    # assetsPath = "/etc/dae";
-    openFirewall = {
-      enable = true;
-      port = 12345;
-    };
-  };
-
-  systemd.services.dae.serviceConfig = {
-    Restart = "on-failure";
-    RestartSec = 10;
-  };
-
-  # dae supports two types of subscriptions: base64 encoded proxies, and sip008.
-  # subscription can be a url return the subscription, or a file path that contains the subscription.
-  #
-  # Nix decrypt and merge my dae's base config and subscription config here.
-  # the subscription config is something like:
-  #   ```
-  #   subscription {
-  #     'https://www.example.com/subscription/link'
-  #     'https://example.com/no_tag_link'
-  #   }
-  #   node {
-  #     # Support socks5, http, https, ss, ssr, vmess, vless, trojan, trojan-go, tuic, juicity
-  #     node_a: 'trojan://'
-  #     node_b: 'trojan://'
-  #     node_c: 'vless://'
-  #     node_d: 'vless://'
-  #     node_e: 'vmess://'
-  #     node_f: 'tuic://'
-  #     node_h: 'juicity://'
-  #   }
-  #   ```
-  system.activationScripts.installDaeConfig = ''
-    install -Dm 600 ${./config.dae} ${daeConfigPath}
-    install -Dm 600 ${config.age.secrets."dae-subscription.dae".path} ${subscriptionConfigPath}
-  '';
-}

hosts/12kingdoms-suzu/microvm/suzi/default.nix

@@ -1,70 +0,0 @@
-{mylib, ...}: {
-  imports =
-    (mylib.scanPaths ./.)
-    ++ [
-      ../../../../secrets/nixos.nix
-      ../../../../modules/nixos/base/ssh.nix
-      ../../../../modules/nixos/base/user-group.nix
-      ../../../../modules/base.nix
-    ];
-
-  modules.secrets.server.network.enable = true;
-
-  microvm = {
-    mem = 1024; # RAM allocation in MB
-    vcpu = 1; # Number of Virtual CPU cores
-
-    interfaces = [
-      {
-        type = "tap";
-        id = "vm-suzi"; # should be prefixed with "vm-"
-        mac = "02:00:00:00:00:01"; # unique MAC address
-      }
-    ];
-
-    # Block device images for persistent storage
-    # microvm use tmpfs for root(/), so everything else
-    # is ephemeral and will be lost on reboot.
-    #
-    # you can check this by running `df -Th` & `lsblk` in the VM.
-    volumes = [
-      {
-        mountPoint = "/var";
-        image = "var.img";
-        size = 512;
-      }
-      {
-        mountPoint = "/etc";
-        image = "etc.img";
-        size = 50;
-      }
-    ];
-
-    # shares can not be set to `neededForBoot = true;`
-    # so if you try to use a share in boot script(such as system.activationScripts), it will fail!
-    shares = [
-      {
-        # It is highly recommended to share the host's nix-store
-        # with the VMs to prevent building huge images.
-        # a host's /nix/store will be picked up so that no
-        # squashfs/erofs will be built for it.
-        #
-        # by this way, /nix/store is readonly in the VM,
-        # and thus the VM can't run any command that modifies
-        # the store. such as nix build, nix shell, etc...
-        # if you want to run nix commands in the VM, see
-        # https://github.com/astro/microvm.nix/blob/main/doc/src/shares.md#writable-nixstore-overlay
-        tag = "ro-store"; # Unique virtiofs daemon tag
-        proto = "virtiofs"; # virtiofs is faster than 9p
-        source = "/nix/store";
-        mountPoint = "/nix/.ro-store";
-      }
-    ];
-
-    hypervisor = "qemu";
-    # Control socket for the Hypervisor so that a MicroVM can be shutdown cleanly
-    socket = "control.socket";
-  };
-
-  system.stateVersion = "24.05";
-}

hosts/12kingdoms-suzu/microvm/suzi/networking.nix

@@ -1,180 +0,0 @@
-{
-  lib,
-  myvars,
-  ...
-}: let
-  hostName = "suzi";
-  inherit (myvars.networking) mainGateway nameservers;
-  inherit (myvars.networking.hostsAddr.${hostName}) ipv4;
-
-  ipv4WithMask = "${ipv4}/24";
-  dhcpRange = {
-    start = "192.168.5.5";
-    end = "192.168.5.99";
-  };
-in {
-  boot.kernel.sysctl = {
-    # https://github.com/ghostbuster91/blogposts/blob/main/router2023-part2/main.md
-    # https://github.com/daeuniverse/dae/blob/main/docs/en/user-guide/kernel-parameters.md
-    # forward network packets that are not destined for the interface on which they were received
-    "net.ipv4.conf.all.forwarding" = true;
-    "net.ipv6.conf.all.forwarding" = true;
-    "net.ipv4.conf.br-lan.rp_filter" = 1;
-    "net.ipv4.conf.br-lan.send_redirects" = 0;
-  };
-
-  # Docker uses iptables internally to setup NAT for containers.
-  # This module disables the ip_tables kernel module, which is required for nftables to work.
-  # So make sure to disable docker here.
-  virtualisation.docker.enable = lib.mkForce false;
-  networking = {
-    useNetworkd = true;
-
-    useDHCP = false;
-    networkmanager.enable = false;
-    wireless.enable = false; # Enables wireless support via wpa_supplicant.
-    # No local firewall.
-    nat.enable = false;
-    firewall.enable = false;
-
-    # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/networking/nftables.nix
-    nftables = {
-      enable = true;
-      # Check the applied rules with `nft -a list ruleset`.
-      # Since this is a internal bypass router, we don't need to do NAT & can forward all traffic.
-      ruleset = ''
-        # Check out https://wiki.nftables.org/ for better documentation.
-        # Table for both IPv4 and IPv6.
-        table inet filter {
-          chain input {
-            type filter hook input priority 0;
-
-            # accept any localhost traffic
-            iifname lo accept
-
-            # accept any lan traffic
-            iifname br-lan accept
-
-            # count and drop any other traffic
-            counter drop
-          }
-
-          # Allow all outgoing connections.
-          chain output {
-            type filter hook output priority 0;
-            accept
-          }
-
-          # Allow all forwarding all traffic.
-          chain forward {
-            type filter hook forward priority 0;
-            accept
-          }
-        }
-      '';
-    };
-  };
-
-  # https://nixos.wiki/wiki/Systemd-networkd
-  systemd.network = {
-    netdevs = {
-      # Create the bridge interface
-      "20-br-lan" = {
-        netdevConfig = {
-          Kind = "bridge";
-          Name = "br-lan";
-        };
-      };
-    };
-    # This is a bypass router, so we do not need a wan interface here.
-    networks = {
-      "30-lan0" = {
-        # match the interface by type
-        matchConfig.Type = "ether";
-        # Connect to the bridge
-        networkConfig = {
-          Bridge = "br-lan";
-          ConfigureWithoutCarrier = true;
-        };
-        linkConfig.RequiredForOnline = "enslaved";
-      };
-      # Configure the bridge device we just created
-      "40-br-lan" = {
-        matchConfig.Name = "br-lan";
-        address = [
-          # configure addresses including subnet mask
-          ipv4WithMask # forwards all traffic to the gateway except for the router address itself
-        ];
-        routes = [
-          # forward all traffic to the main gateway
-          {routeConfig.Gateway = mainGateway;}
-        ];
-        bridgeConfig = {};
-        linkConfig.RequiredForOnline = "routable";
-      };
-    };
-  };
-
-  # resolved is conflict with dnsmasq
-  services.resolved.enable = false;
-  services.dnsmasq = {
-    enable = true;
-    # resolve local queries (add 127.0.0.1 to /etc/resolv.conf)
-    resolveLocalQueries = true; # may be conflict with dae, disable this.
-    alwaysKeepRunning = true;
-    # https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=tree
-    settings = {
-      # upstream DNS servers
-      server = nameservers;
-      # forces dnsmasq to try each query with each server strictly
-      # in the order they appear in the config.
-      strict-order = true;
-
-      # Never forward plain names (without a dot or domain part)
-      domain-needed = true;
-      # Never forward addresses in the non-routed address spaces(e.g. private IP).
-      bogus-priv = true;
-      # don't needlessly read /etc/resolv.conf which only contains the localhost addresses of dnsmasq itself.
-      no-resolv = true;
-
-      # Cache dns queries.
-      cache-size = 1000;
-
-      dhcp-range = ["${dhcpRange.start},${dhcpRange.end},24h"];
-      interface = "br-lan";
-      dhcp-sequential-ip = true;
-      dhcp-option = [
-        # Override the default route supplied by dnsmasq, which assumes the
-        # router is the same machine as the one running dnsmasq.
-        "option:router,${ipv4}"
-        "option:dns-server,${ipv4}"
-      ];
-
-      # local domains
-      local = "/lan/";
-      domain = "lan";
-      expand-hosts = true;
-
-      # don't use /etc/hosts
-      no-hosts = true;
-      address = [
-        # "/surfer.lan/192.168.10.1"
-      ];
-    };
-  };
-
-  # monitoring with prometheus
-  # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/monitoring/prometheus/exporters/dnsmasq.nix
-  services.prometheus.exporters.dnsmasq = {
-    enable = true;
-    listenAddress = "0.0.0.0";
-    port = 9153;
-    openFirewall = false;
-    leasesPath = "/var/lib/dnsmasq/dnsmasq.leases";
-  };
-
-  # The service irqbalance is useful as it assigns certain IRQ calls to specific CPUs instead of
-  # letting the first CPU core to handle everything.
-  # This is supposed to increase performance by hitting CPU cache more often.
-  services.irqbalance.enable = false;
-}

hosts/12kingdoms-suzu/networking.nix

@@ -1,45 +0,0 @@
-{myvars, ...}: let
-  hostName = "suzu";
-  inherit (myvars.networking) mainGateway nameservers;
-  inherit (myvars.networking.hostsAddr.${hostName}) iface ipv4;
-
-  ipv4WithMask = "${ipv4}/24";
-in {
-  boot.kernel.sysctl = {
-    # forward network packets that are not destined for the interface on which they were received
-    "net.ipv4.conf.all.forwarding" = true;
-    "net.ipv6.conf.all.forwarding" = true;
-  };
-
-  networking.useNetworkd = true;
-  systemd.network.enable = true;
-
-  # A bridge to link all VM's TAP interfaces into local network.
-  # https://github.com/astro/microvm.nix/blob/main/doc/src/simple-network.md
-  systemd.network.networks."10-lan" = {
-    # match on the main interface and all VM interfaces
-    matchConfig.Name = [iface "vm-*"];
-    networkConfig = {
-      Bridge = "br0";
-    };
-  };
-
-  systemd.network.netdevs."br0" = {
-    netdevConfig = {
-      Name = "br0";
-      Kind = "bridge";
-    };
-  };
-
-  # Add ipv4 address to the bridge.
-  systemd.network.networks."10-lan-bridge" = {
-    matchConfig.Name = "br0";
-    networkConfig = {
-      Address = [ipv4WithMask];
-      Gateway = mainGateway;
-      DNS = nameservers;
-      IPv6AcceptRA = true;
-    };
-    linkConfig.RequiredForOnline = "routable";
-  };
-}

hosts/README.md

@@ -2,26 +2,19 @@
 
 1. `12kingdoms`:
    1. `shoukei`: NixOS on Macbook Pro 2020 Intel i5, 13.3-inch, 16G RAM + 512G SSD.
-   1. `suzu`: Orange Pi 5, RK3588s(4xA76 + 4xA55), GPU(4Cores, Mail-G610), NPU(6Tops@int8), 8G RAM +
-      256G SSD.
-      1. Network related services running via microvm.nix, such as router(transparent proxy - dae),
-         tailscale subrouter, etc.
-   1. `rakushun`: Orange Pi 5 Plus, RK3588(4xA76 + 4xA55), GPU(4Cores, Mail-G610), NPU(6Tops@int8),
-      16G RAM + 2T SSD.
-      1. Monitoring(prometheus, grafana, exporters), CI/CD(gitea, runner), homepage, file browser,
-         and other services.
 1. `darwin`(macOS)
    1. `fern`: MacBook Pro 2022 13-inch M2 16G, mainly for business.
    1. `harmonica`: MacBook Pro 2020 13-inch i5 16G, for personal use.
-1. `k8s`: My Kubernetes Clusters
+1. `k8s`: My Kubevirt & Kubernetes Clusters
 1. `idols`
    1. `ai`: My main computer, with NixOS + I5-13600KF + RTX 4090 GPU, for gaming & daily use.
-   2. `aquamarine`: Not used now.
+   2. `aquamarine`: Kubevirt Virtual Machine.
+      - Monitoring(prometheus, grafana, exporters), CI/CD(gitea, runner), homepage, file browser,
+        and other services.
    3. `ruby`: Not used now.
    4. `kana`: Not used now.
-1. `rolling_girls`: My RISCV64 hosts.
+1. Other aarch64/riscv64 SBCs:
-   1. `nozomi`: Lichee Pi 4A, TH1520(4xC910@2.0G), 16GB RAM + 32G eMMC + 128G SD Card.
+   [ryan4yin/nixos-config-sbc](https://github.com/ryan4yin/nixos-config-sbc)
-   2. `yukina`: Milk-V Mars, JH7110(4xU74@1.5 GHz), 4G RAM + No eMMC + 64G SD Card.
 
 ## How to add a new host
 

hosts/idols-ai/README.md

@@ -40,7 +40,7 @@ zram0             253:0    0 15.6G  0 disk  [SWAP]
 nvme0n1           259:0    0  1.8T  0 disk
 ├─nvme0n1p1       259:2    0  598M  0 part  /boot
 └─nvme0n1p2       259:3    0  1.8T  0 part
-  └─encrypted-nixos 254:0    0  1.8T  0 crypt /tmp
+  └─crypted-nixos 254:0    0  1.8T  0 crypt /tmp
                                             /swap/swapfile
                                             /swap
                                             /snapshots

hosts/idols-ai/default.nix

@@ -41,12 +41,10 @@ in {
   };
   virtualisation.docker.enableNvidia = true; # for nvidia-docker
 
-  hardware.opengl = {
+  hardware.graphics = {
     enable = true;
-    # if hardware.opengl.driSupport is enabled, mesa is installed and provides Vulkan for supported hardware.
-    driSupport = true;
     # needed by nvidia-docker
-    driSupport32Bit = true;
+    enable32Bit = true;
   };
 
   # This value determines the NixOS release from which the default

hosts/idols-ai/hardware-configuration.nix

@@ -45,7 +45,7 @@
 
   boot.initrd = {
     # unlocked luks devices via a keyfile or prompt a passphrase.
-    luks.devices."encrypted-nixos" = {
+    luks.devices."crypted-nixos" = {
       # NOTE: DO NOT use device name here(like /dev/sda, /dev/nvme0n1p2, etc), use UUID instead.
       # https://github.com/ryan4yin/nix-config/issues/43
       device = "/dev/disk/by-uuid/a21ca82a-9ee6-4e5c-9d3f-a93e84e4e0f4";

hosts/idols-aquamarine/README.md

@@ -1,3 +1,24 @@
 # Idols - Aquamarine
 
-TODO
+Storage, operation and maintenance related services are running on this host:
+
+1. Storage such as git server, file server/browser, torrent downloader,, etc.
+1. Backup or sync my personal data to cloud or NAS.
+   - For safety, those data should be encrypted before sending to the cloud or my NAS.
+1. Collect and monitor the metrics/logs of my homelab.
+
+## Features
+
+Services:
+
+1. prometheus + alertmanager + grafana + loki: Monitor the metrics/logs of my homelab.
+1. restic: Backup my personal data to cloud or NAS.
+1. synthing: Sync file between android/macbook/PC and NAS.
+1. gitea: Self-hosted git service.
+1. sftpgo: SFTP server.
+1. transmission & AriaNg: Torrent downloader and HTTP downloader
+1. alist/filebrower: File browser for local/SMB/Cloud
+
+All the services assumes a reverse proxy to be setup in the front, they are all listening on
+localhost, and a caddy service is listening on the local network interface and proxy the requests to
+the services.

hosts/idols-aquamarine/caddy.nix

@@ -17,7 +17,7 @@ in {
     # Reload Caddy instead of restarting it when configuration file changes.
     enableReload = true;
     user = "caddy"; # User account under which caddy runs.
-    dataDir = "/var/lib/caddy";
+    dataDir = "/data/apps/caddy";
     logDir = "/var/log/caddy";
 
     # Additional lines of configuration appended to the global config section of the Caddyfile.
@@ -31,12 +31,12 @@ in {
     # Dashboard
     virtualHosts."home.writefor.fun".extraConfig = ''
       ${hostCommonConfig}
-      reverse_proxy http://localhost:4401
+      reverse_proxy http://localhost:54401
     '';
 
     # https://caddyserver.com/docs/caddyfile/directives/file_server
     virtualHosts."file.writefor.fun".extraConfig = ''
-      root * /var/lib/caddy/fileserver/
+      root * /data/apps/caddy/fileserver/
       ${hostCommonConfig}
       file_server browse {
         hide .git
@@ -64,7 +64,7 @@ in {
     # Monitoring
     virtualHosts."uptime-kuma.writefor.fun".extraConfig = ''
       encode zstd gzip
-      reverse_proxy http://localhost:3350
+      reverse_proxy http://localhost:53350
     '';
     virtualHosts."grafana.writefor.fun".extraConfig = ''
       encode zstd gzip
@@ -83,15 +83,15 @@ in {
 
   # Create Directories
   systemd.tmpfiles.rules = [
-    "d /var/lib/caddy/fileserver/ 0755 caddy caddy"
+    "d /data/apps/caddy/fileserver/ 0755 caddy caddy"
     # directory for virtual machine's images
-    "d /var/lib/caddy/fileserver/vms 0755 caddy caddy"
+    "d /data/apps/caddy/fileserver/vms 0755 caddy caddy"
   ];
 
-  # Add all my wallpapers into /var/lib/caddy/fileserver/wallpapers
+  # Add all my wallpapers into /data/apps/caddy/fileserver/wallpapers
   # Install the homepage-dashboard configuration files
   system.activationScripts.installCaddyWallpapers = ''
-    mkdir -p /var/lib/caddy/fileserver/wallpapers
+    mkdir -p /data/apps/caddy/fileserver/wallpapers
-    ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F644 ${wallpapers}/ /var/lib/caddy/fileserver/wallpapers/
+    ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F644 ${wallpapers}/ /data/apps/caddy/fileserver/wallpapers/
   '';
 }

hosts/idols-aquamarine/default.nix

@@ -1,4 +1,10 @@
-{myvars, ...}:
+{
+  mylib,
+  myvars,
+  pkgs,
+  disko,
+  ...
+}:
 #############################################################
 #
 #  Aquamarine - A NixOS VM running on Proxmox/KubeVirt
@@ -7,7 +13,10 @@
 let
   hostName = "aquamarine"; # Define your hostname.
 in {
-  imports = [
+  imports =
+    (mylib.scanPaths ./.)
+    ++ [
+      disko.nixosModules.default
     ];
 
   # supported file systems, so we can mount any removable disks with these filesystems
@@ -15,17 +24,22 @@ in {
     "ext4"
     "btrfs"
     "xfs"
+    #"zfs"
+    "ntfs"
     "fat"
     "vfat"
     "exfat"
   ];
 
-  # boot.kernelModules = ["kvm-amd"];
+  boot.kernelPackages = pkgs.linuxPackages_latest;
-  # boot.extraModprobeConfig = "options kvm_amd nested=1"; # for amd cpu
+  boot.kernelModules = ["kvm-amd"];
+  boot.extraModprobeConfig = "options kvm_amd nested=1"; # for amd cpu
 
   networking = {
     inherit hostName;
-    inherit (myvars.networking) nameservers;
+    inherit (myvars.networking) defaultGateway nameservers;
+    inherit (myvars.networking.hostsInterface.${hostName}) interfaces;
+    networkmanager.enable = false;
   };
 
   # This value determines the NixOS release from which the default

hosts/idols-aquamarine/disko-fs.nix

@@ -0,0 +1,112 @@
+# auto disk partitioning:
+#   nix run github:nix-community/disko -- --mode disko ./disko-fs.nix
+let
+  cryptKeyFile = "/etc/agenix/hdd-luks-crypt-key";
+  unlockDisk = "data-encrypted";
+in {
+  fileSystems."/data/fileshare/public".depends = ["/data/fileshare"];
+
+  # By adding this crypttab entry, the disk will be unlocked by systemd-cryptsetup@xxx.service at boot time.
+  # This systemd service is running after agenix, so that the keyfile is already available.
+  environment.etc = {
+    "crypttab".text = ''
+      ${unlockDisk} /dev/disk/by-partlabel/disk-${unlockDisk}-luks ${cryptKeyFile} luks,discard,keyfile-size=32768,keyfile-offset=65536
+    '';
+  };
+
+  disko.devices = {
+    disk.data-encrypted = {
+      type = "disk";
+      device = "/dev/disk/by-id/ata-WDC_WD40EZRZ-22GXCB0_WD-WCC7K7VV9613";
+      content = {
+        type = "gpt";
+        partitions = {
+          luks = {
+            size = "100%";
+            content = {
+              type = "luks";
+              name = "data-encrypted";
+              settings = {
+                keyFile = cryptKeyFile;
+                # The maximum size of the keyfile is 8192 KiB
+                # type `cryptsetup --help` to see the compiled-in key and passphrase maximum sizes
+                # to generate a key file:
+                #    dd bs=512 count=1024 iflag=fullblock if=/dev/random of=./hdd-luks-crypt-key
+                keyFileSize = 512 * 64; # match the `bs * count` of the `dd` command
+                keyFileOffset = 512 * 128; # match the `bs * skip` of the `dd` command
+                fallbackToPassword = true;
+                allowDiscards = true;
+              };
+              # Whether to add a boot.initrd.luks.devices entry for the specified disk.
+              # The keyfile do not exist before agenix decrypts its data, do we have to disable this option.
+              # Otherwise, the initrd will fail to unlock the disk, which causes the boot process to fail.
+              initrdUnlock = false;
+
+              # encrypt the root partition with luks2 and argon2id, will prompt for a passphrase, which will be used to unlock the partition.
+              # cryptsetup luksFormat
+              extraFormatArgs = [
+                "--type luks2"
+                "--cipher aes-xts-plain64"
+                "--hash sha512"
+                "--iter-time 5000"
+                "--key-size 256"
+                "--pbkdf argon2id"
+                # use true random data from /dev/random, will block until enough entropy is available
+                "--use-random"
+              ];
+              extraOpenArgs = [
+                "--timeout 10"
+              ];
+              content = {
+                type = "btrfs";
+                extraArgs = ["-f"]; # Force override existing partition
+                subvolumes = {
+                  "@apps" = {
+                    mountpoint = "/data/apps";
+                    mountOptions = [
+                      "compress-force=zstd:1"
+                      # https://www.freedesktop.org/software/systemd/man/latest/systemd.mount.html
+                      "nofail"
+                    ];
+                  };
+                  "@fileshare" = {
+                    mountpoint = "/data/fileshare";
+                    mountOptions = ["compress-force=zstd:1" "noatime" "nofail"];
+                  };
+                  "@backups" = {
+                    mountpoint = "/data/backups";
+                    mountOptions = ["compress-force=zstd:1" "noatime" "nofail"];
+                  };
+                  "@snapshots" = {
+                    mountpoint = "/data/apps-snapshots";
+                    mountOptions = ["compress-force=zstd:1" "noatime" "nofail"];
+                  };
+                };
+              };
+            };
+          };
+        };
+      };
+    };
+    disk.data-public = {
+      type = "disk";
+      device = "/dev/disk/by-id/ata-WDC_WD40EJRX-89T1XY0_WD-WCC7K0XDCZE6";
+      content = {
+        type = "gpt";
+        partitions.data-fileshare = {
+          size = "100%";
+          content = {
+            type = "btrfs";
+            # extraArgs = ["-f"]; # Override existing partition
+            subvolumes = {
+              "@persistent" = {
+                mountpoint = "/data/fileshare/public";
+                mountOptions = ["compress-force=zstd:1" "nofail"];
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/idols-aquamarine/gitea.nix

@@ -5,7 +5,7 @@ in {
     enable = true;
     user = "gitea";
     group = "gitea";
-    stateDir = "/var/lib/gitea";
+    stateDir = "/data/apps/gitea";
     appName = "Ryan Yin's Gitea Service";
     lfs.enable = true;
     # Enable a timer that runs gitea dump to generate backup-files of the current gitea database and repositories.
@@ -27,7 +27,10 @@ in {
       };
       # one of "Trace", "Debug", "Info", "Warn", "Error", "Critical"
       log.LEVEL = "Info";
-      session.COOKIE_SECURE = false;
+      # Marks session cookies as "secure" as a hint for browsers to only send them via HTTPS.
+      session.COOKIE_SECURE = true;
+      # NOTE: The first registered user will be the administrator,
+      # so this parameter should NOT be set before the first user registers!
       service.DISABLE_REGISTRATION = true;
 
       # "cron.sync_external_users" = {

hosts/idols-aquamarine/grafana/default.nix

@@ -5,7 +5,7 @@
 }: {
   services.grafana = {
     enable = true;
-    dataDir = "/var/lib/grafana";
+    dataDir = "/data/apps/grafana";
     # DeclarativePlugins = with pkgs.grafanaPlugins; [ grafana-piechart-panel ];
     settings = {
       server = {

hosts/idols-aquamarine/oci-containers/homepage/config/services.yaml

@@ -1,56 +1,62 @@
 ---
 # For configuration options and examples, please see:
 # https://gethomepage.dev/latest/configs/services
+#
+# Icons:
+#   1. .png/.svg: will be referenced from https://github.com/walkxcode/dashboard-icons
+#   2. mdi-XXX:   https://pictogrammers.com/library/mdi/
+#   3. si-XXX:    https://simpleicons.org/
 
 - KubeVirt 虚拟化集群:
     - KubeVirt-Shoryu:
-        icon: si-kubevirt
+        icon: mdi-server
         description: "CPU: R7-5825U / MEM: 64G / DISK: 1T"
-        href: http://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.181:9100
+        href: https://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.181:9100
-        siteMonitor: http://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.181:9100
+        siteMonitor: https://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.181:9100
     - KubeVirt-Shushou:
-        icon: si-kubevirt
+        icon: mdi-server
         description: "CPU: R9-5900HX / MEM: 64G / DISK: 1T"
-        href: http://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.182:9100
+        href: https://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.182:9100
-        siteMonitor: http://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.182:9100
+        siteMonitor: https://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.182:9100
     - KubeVirt-Youko:
-        icon: si-kubevirt
+        icon: mdi-server
         description: "CPU: R5-5625U / MEM: 32G / DISK: 512G+4T*2"
-        href: http://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.183:9100
+        href: https://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.183:9100
-        siteMonitor: http://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.183:9100
+        siteMonitor: https://grafana.writefor.fun/d/rYdddlPWk/node-exporter-full?orgId=1&var-node=192.168.5.183:9100
     - LongHorn-Storage:
-        icon: si-longhorn
+        icon: longhorn.svg
         href: http://longhorn.writefor.fun/
     - Victoria-Metrics:
         icon: si-victoriametrics
         href: http://vm.writefor.fun/
     - KubeVirt-Grafana:
-        icon: si-grafana
+        icon: grafana.svg
         href: http://k8s-grafana.writefor.fun/
 
 - Homelab Monitoring:
     - Grafana:
-        icon: si-grafana
+        icon: grafana.svg
-        href: http://grafana.writefor.fun
+        href: https://grafana.writefor.fun
         description: Data visualised on dashboards
-        siteMonitor: http://grafana.writefor.fun
+        siteMonitor: https://grafana.writefor.fun
     - Prometheus Dashboard:
-        icon: si-prometheus
+        icon: prometheus.svg
-        href: http://prometheus.writefor.fun
+        href: https://prometheus.writefor.fun
         description: Monitoring - Prometheus
-        siteMonitor: http://prometheus.writefor.fun
+        siteMonitor: https://prometheus.writefor.fun
     - Uptime Kuma:
-        icon: si-uptimekuma
+        icon: uptime-kuma.svg
-        href: http://uptime-kuma.writefor.fun
+        href: https://uptime-kuma.writefor.fun
         description: Uptime Checking
-        siteMonitor: http://uptime-kuma.writefor.fun
+        siteMonitor: https://uptime-kuma.writefor.fun
 
 - Homelab Applications:
     - SFTPGO:
         icon: sftpgo.png
-      href: "http://sftpgo.writefor.fun/web/admin/folders"
+        href: "https://sftpgo.writefor.fun/web/admin/folders"
         description: WebDAV & SFTP server
-      siteMonitor: http://sftpgo.writefor.fun/
+        siteMonitor: https://sftpgo.writefor.fun/
+#
 # - Kubernetes Monitoring:
 #     # TODO: Update this
 #     - Emby:

hosts/idols-aquamarine/oci-containers/homepage/config/settings.yaml

@@ -21,10 +21,10 @@ providers:
 
 background:
   image: https://file.writefor.fun/wallpapers/rolling-girls.png
-  blur: sm # sm, "", md, xl... see https://tailwindcss.com/docs/backdrop-blur
+  blur: sm # 模糊 - sm, "", md, xl... see https://tailwindcss.com/docs/backdrop-blur
-  saturate: 90 # 0, 50, 100... see https://tailwindcss.com/docs/backdrop-saturate
+  saturate: 90 # 色彩饱和度 - 0, 50, 100... see https://tailwindcss.com/docs/backdrop-saturate
   brightness: 90 # 0, 50, 75... see https://tailwindcss.com/docs/backdrop-brightness
-  opacity: 85 # 0-100
+  opacity: 25 # 透明度 - 0-100
 
 theme: dark # or light
 
@@ -32,7 +32,7 @@ theme: dark # or light
 # slate, gray, zinc, neutral, stone, amber,
 # yellow, lime, green, emerald, teal, cyan,
 # sky, blue, indigo, violet, purple, fuchsia, pink, rose, red, white
-color: indigo
+color: slate
 
 # make all cards in a row the same height.
 useEqualHeights: true
@@ -40,31 +40,20 @@ useEqualHeights: true
 # Groups and its layout
 # Groups Name should match the name defined in your services.yaml or widgets.yaml
 layout:
+  Homelab Monitoring:
+    icon: mdi-monitor-dashboard
+    initiallyCollapsed: false # collapsed by default
+    tab: Main
+    style: row
+    columns: 3
+
+  Homelab Applications:
+    icon: si-homepage
+    tab: Main
+
   KubeVirt 虚拟化集群:
-    icon: si-kubevirt
+    icon: si-kubernetes
-    tab: First
+    tab: KubeVirt
-
-  Group A:
-    initiallyCollapsed: true # collapsed by default
-    tab: First
-    style: row
-    columns: 4
-
-  Second Service Group:
-    useEqualHeights: true # overrides global setting
-    tab: Second
-    columns: 4
-
-  Third Service Group:
-    tab: Third
-    style: row
-
-  Bookmark Group on Fourth Tab:
-    tab: Fourth
-
-  Service Group on every Tab:
-    style: row
-    columns: 4
 
 # https://gethomepage.dev/latest/configs/services/#icons
 # iconStyle: theme # optional, defaults to gradient

hosts/idols-aquamarine/oci-containers/homepage/default.nix

@@ -0,0 +1,41 @@
+{
+  config,
+  pkgs,
+  ...
+}: let
+  user = "homepage";
+  configDir = "/data/apps/homepage-dashboard";
+in {
+  users.groups.${user} = {};
+  users.users.${user} = {
+    group = user;
+    home = configDir;
+    isSystemUser = true;
+  };
+
+  # Install the homepage-dashboard configuration files
+  system.activationScripts.installHomepageDashboardConfig = ''
+    mkdir -p ${configDir}
+    ${pkgs.rsync}/bin/rsync -avz --chmod=D2755,F644 ${./config}/ ${configDir}/
+    chown -R ${user}:${user} ${configDir}
+  '';
+
+  # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/virtualisation/oci-containers.nix
+  virtualisation.oci-containers.containers = {
+    # check its logs via `journalctl -u podman-homepage`
+    homepage = {
+      hostname = "homepage";
+      image = "ghcr.io/gethomepage/homepage:latest";
+      ports = ["127.0.0.1:54401:3000"];
+      # https://github.com/louislam/uptime-kuma/wiki/Environment-Variables
+      environment = {
+        # "PUID" = config.users.users.${user}.uid;
+        # "PGID" = config.users.groups.${user}.gid;
+      };
+      volumes = [
+        "${configDir}:/app/config"
+      ];
+      autoStart = true;
+    };
+  };
+}

hosts/idols-aquamarine/oci-containers/uptime-kuma/default.nix

@@ -0,0 +1,35 @@
+{config, ...}: let
+  user = "kuma";
+  dataDir = "/data/apps/uptime-kuma";
+in {
+  users.groups.${user} = {};
+  users.users.${user} = {
+    group = user;
+    home = dataDir;
+    isSystemUser = true;
+  };
+
+  # Create Directories
+  systemd.tmpfiles.rules = [
+    "d ${dataDir} 0755 ${user} ${user}"
+  ];
+
+  # https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/virtualisation/oci-containers.nix
+  virtualisation.oci-containers.containers = {
+    # check its logs via `journalctl -u podman-homepage`
+    uptime-kuma = {
+      hostname = "uptime-kuma";
+      image = "louislam/uptime-kuma:1";
+      ports = ["127.0.0.1:53350:3001"];
+      # https://github.com/louislam/uptime-kuma/wiki/Environment-Variables
+      environment = {
+        # "PUID" = config.users.users.${user}.uid;
+        # "PGID" = config.users.groups.${user}.gid;
+      };
+      volumes = [
+        "${dataDir}:/app/data"
+      ];
+      autoStart = true;
+    };
+  };
+}