nixos/services: add default website on nginx

nixos/services: disable nginx proxy buffering
nixos/impermanence: remove ssh host key persistence
2026-05-04 04:55:58 +02:00 · 2026-05-04 04:55:40 +02:00 · 2026-05-03 22:24:33 -04:00 · 2026-05-03 22:18:49 -04:00 · 2026-05-03 22:18:49 -04:00 · 2026-05-03 22:18:49 -04:00
26 changed files with 157 additions and 701 deletions
@@ -1 +0,0 @@
-use flake
@@ -1,4 +1,3 @@
 # Nix
-/*.qcow2
-/.direnv
 /result
+/*.qcow2
@@ -21,5 +21,5 @@ in
  map (user: {
    name = "dns/tuxcord.net/${user.name}.tuxcord.net.key.age";
    value.publicKeys = [ tuxcord-ca ] ++ getSSHKeys user.name;
-  }) (builtins.filter (user: user.value.ddns or false) (attrsToList users))
+  }) (builtins.filter (user: user.value.options.ddns or false) (attrsToList users))
 )
@@ -1,12 +0,0 @@
-{{template "base/head" .}}
-<div role="main" aria-label="{{if .IsSigned}}{{ctx.Locale.Tr "dashboard"}}{{else}}{{ctx.Locale.Tr "home"}}{{end}}"
-   class="page-content home tw-mb-8 tw-px-8 center" style="height: 100%; flex-direction: column; display: flex; align-items: center; justify-content: space-around;">
-   <img width="500" height="500" src="{{AssetUrlPrefix}}/images/full-logo.svg" alt="{{ctx.Locale.Tr "logo"}}">
-   <div class="hero">
-      <h1 class="ui icon header title">
-         {{AppName}}
-      </h1>
-      <!-- <h2>My own gitea server 😎</h2> -->
-   </div>
-</div>
-{{template "base/footer" .}}
@@ -1,51 +0,0 @@
-@import "/assets/css/theme-forgejo-dark.css";
-
-/* :root { */
-/*   --is-dark-theme: true; */
-
-/*   --accent-color: 221, 85, 85; */
-/*   /1* #d55 *1/ */
-/*   --gitea-color-primary-dark-4: 221, 85, 85; */
-/*   --accent-color-secondary: 96, 72, 10; */
-/*   --accent-color-hover: 170, 68, 68; */
-/*   --color-primary: rgb(var(--accent-color)); */
-/*   --color-secondary: rgb(var(--accent-color-secondary)); */
-/*   --button-color: rgb(var(--accent-color)); */
-/*   --button-color-hover: rgb(var(--accent-color-hover)); */
-/* } */
-
-:root {
-  --is-dark-theme: true;
-
-  --color-primary: #d162a4;
-  --color-primary-contrast: #fff;
-  --color-primary-dark-1: #ba3283;
-  --color-primary-dark-2: #b55690;
-  --color-primary-dark-3: #ac2c79;
-  --color-primary-dark-4: #a30262;
-  --color-primary-dark-5: #8a0253;
-  --color-primary-dark-6: #710144;
-  --color-primary-dark-7: #570135;
-  --color-primary-light-1: #d776af;
-  --color-primary-light-2: #dd89bb;
-  --color-primary-light-3: #e29dc6;
-  --color-primary-light-4: #e8b1d2;
-  --color-primary-light-5: #eec5dd;
-  --color-primary-light-6: #f4d8e9;
-  --color-primary-light-7: #f9ecf4;
-  --color-primary-alpha-10: #d162a419;
-  --color-primary-alpha-20: #d162a433;
-  --color-primary-alpha-30: #d162a44b;
-  --color-primary-alpha-40: #d162a466;
-  --color-primary-alpha-50: #d162a480;
-  --color-primary-alpha-60: #d162a499;
-  --color-primary-alpha-70: #d162a4b3;
-  --color-primary-alpha-80: #d162a4cc;
-  --color-primary-alpha-90: #d162a4e1;
-}
-
-.navbar-left > #navbar-logo.item,
-.navbar-right > #navbar-logo.item,
-.navbar-mobile-right > #navbar-logo.item {
-  padding: 3px;
-}
@@ -1,24 +1,21 @@
 rec {
-  toList = x: if builtins.isList x then x else [ x ];
+  users = import ./users.nix;

-  nameValuePair = name: value: { inherit name value; };
-
-  mapAttrsToList = f: attrs: builtins.attrValues (builtins.mapAttrs f attrs);
+  adminSSHKeys = builtins.concatLists (
+    map (user: getSSHKeys user.name) (
+      builtins.filter (user: user.value.options.admin or false) (attrsToList users)
+    )
+  );

  attrsToList = mapAttrsToList nameValuePair;
+  mapAttrsToList = f: attrs: builtins.attrValues (builtins.mapAttrs f attrs);
+  nameValuePair = name: value: { inherit name value; };
+  toList = x: if builtins.isList x then x else [ x ];

  getSSHKeys =
    username:
    if (builtins.hasAttr "ssh" users.${username}) then
      toList users.${username}.ssh
    else
-      builtins.warn "user ${username} declared without ssh keys" [ ];
-
-  users = import ./users.nix;
-
-  adminSSHKeys = builtins.concatLists (
-    map (user: getSSHKeys user.name) (
-      builtins.filter (user: user.value.admin or false) (attrsToList users)
-    )
-  );
+      builtins.warn "user ${username} declared without ssh key" [ ];
 }
@@ -1,19 +1,23 @@
 {
  error = {
    ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDzdpxex2GlFVf5G2qsh3Ixa/XCMjnbq4JSTmAev7WYJ error.nointernet@gmail.com";
-    admin = true;
-    ddns = true;
+    options = {
+      admin = true;
+      ddns = true;
+    };
  };

  javalsai = {
    ssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDFjavnLqxIzFLIUpUWDOwhlYeoII4Qk1/9e0yWWxD/P";
-    admin = true;
-    ddns = true;
+    options = {
+      admin = true;
+      ddns = true;
+    };
  };

  max = {
    ssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDxVfJhzPDZ108UjB3Vj/akzlzYn27kyAw29AuYAr7gvG5vrqhLUYYmK8t+ZVWVpc1g6cK7OF1oUn2E5Qfmy6wqyZQXftAZ4OcRS0MB71W1bAcRq3rGe6KQDm8RSEeygX+zO+2Z6zQmVWgPr/I+JFQZ8wiWdP8X8djqTRdhqUD+SR3ZgTcnY3aLmeB/I56rcZQ3lKIeg/pEsyQ8weptlV0rTWamna6Z7Nw48VwWNSI+6EqfW2/4/edm0Ue8jMNqNZ0yx+kHJbudPgZgSR1SiR2rqlEEUaiQJQQV3VdY4DhGm7143ZSKUxyKlfTuQ7qR1zSIg6f5V71A37ik9YiSbBlOZO86swR4qHESoMNf608IuqRt2NdALHwozFPUCu16qnhu5JTk8twSAzrAhOk5zWQj1LYMoQEBhcFSmwir/1gE71NSjYtqXGVAdfkVmZ4uqG5+a1D7H3VXWOqu/j839M045O1ZBY6X3lKDsEJ1Z1+LCl/NojWnvPtJUHYI6+SdQ6k=";
-    admin = true;
+    options.admin = true;
  };

  vectorum = {
@@ -99,15 +99,22 @@ in

    extraHosts =
      let
-        subdomains = [ "git" ];
-
-        inherit (config.networking) fqdn;
-        hosts = [ fqdn ] ++ map (sub: "${sub}.${fqdn}") subdomains;
+        subdomains = [
+          ""
+          ".git"
+        ];
      in
-      lib.concatMapStrings (host: ''
-        127.0.0.1 ${host}
-        ::1 ${host}
-      '') hosts;
+      builtins.foldl' (
+        hosts-acc: domain-prefix:
+        let
+          host = "${domain-prefix}${config.networking.fqdn}";
+        in
+        hosts-acc
+        + ''
+          127.0.0.1 ${host}
+          ::1 ${host}
+        ''
+      ) "" subdomains;
  };

  virtualisation.podman.enable = true;
@@ -15,10 +15,7 @@
      "xhci_pci"
    ];

-    kernelModules = [
-      "kvm-amd"
-      "kvm-intel"
-    ];
+    kernelModules = [ "kvm-intel" ];
  };

  hardware = {
@@ -1,14 +1,11 @@
 {
-  imports = [
-    ./storage.nix
-  ];
+  acme = {
+    enable = true;
+    rfc2136.nameserver = "tuxcord.net";
+  };

-  networking.fqdn = "nix.tuxcord.net";
-
-  acme.rfc2136.nameserver = "tuxcord.net";
  dns.enable = true;
-
-  services.getty.autologinUser = "root";
+  networking.fqdn = "nix.tuxcord.net";

  time.timeZone = "Europe/Madrid";
 }
@@ -1,6 +0,0 @@
-{
-  fileSystems."/" = {
-    device = "/dev/vda";
-    fsType = "ext4";
-  };
-}
@@ -32,7 +32,6 @@
        device = "/dev/xvda2";
        fsType = "btrfs";
        options = [ "subvol=@persist" ] ++ defaultOptions;
-        neededForBoot = true;
      };
    };
 }
@@ -1,12 +1,6 @@
 {
-  imports = [
-    ./storage.nix
-  ];
-
-  networking.fqdn = "tuxcord.test";
-
  acme.enable = false;
  dns.enable = true;

-  services.getty.autologinUser = "root";
+  networking.fqdn = "tuxcord.test";
 }
@@ -1,6 +0,0 @@
-{
-  fileSystems."/" = {
-    device = "/dev/vda";
-    fsType = "ext4";
-  };
-}
@@ -55,6 +55,8 @@
    };
  };

+  fileSystems."/persist".neededForBoot = true;
+
  environment.persistence."/persist" = {
    enable = true;
    hideMounts = true;
@@ -3,7 +3,7 @@
    ./acme.nix
    ./dns.nix
    ./fail2ban.nix
-    ./forgejo.nix
+    ./gitea.nix
    ./host.nix
    ./nginx.nix
    ./snapper.nix
@@ -1,125 +0,0 @@
-{ config, pkgs, ... }:
-let
-  inherit (config.networking) fqdn;
-
-  acmeEnabled = config.acme.enable;
-
-  themeName = "tuxcord";
-  forgejoPublic = pkgs.linkFarm "forgejo-public" [
-    {
-      name = "assets/css/theme-${themeName}.css";
-      path = ../../assets/forgejo/theme.css;
-    }
-    {
-      name = "assets/img";
-      path = makeForgejoImages {
-        big = ../../assets/branding/logo.svg;
-        small = ../../assets/branding/logo-head.svg;
-        rasterWidth = 1024;
-      };
-    }
-    {
-      name = "assets/images/full-logo.svg";
-      path = ../../assets/branding/logo.svg;
-    }
-  ];
-  forgejoTemplates = ../../assets/forgejo/templates;
-
-  makeForgejoImages =
-    {
-      big,
-      small,
-      rasterWidth,
-    }:
-    pkgs.stdenv.mkDerivation rec {
-      name = "forgejo-images";
-
-      srcs = [
-        big
-        small
-      ];
-      unpackPhase = "true";
-
-      buildInputs = with pkgs; [
-        inkscape
-      ];
-
-      # https://forgejo.org/docs/next/contributor/customization/#changing-the-logo
-      buildPhase = ''
-        mkdir -p $out
-
-        cp "${big}" $out/logo.svg
-        inkscape -w ${toString rasterWidth} ${big} -o $out/logo.png
-
-        cp "${small}" $out/favicon.svg
-        inkscape -w ${toString rasterWidth} ${small} -o $out/favicon.png
-      '';
-    };
-in
-{
-  services.forgejo = {
-    enable = true;
-
-    database.type = "mysql";
-
-    lfs.enable = true;
-
-    settings = {
-      DEFAULT = {
-        APP_NAME = "TuxCord Code Forge";
-      };
-
-      server = {
-        DOMAIN = fqdn;
-        ROOT_URL = "${if acmeEnabled then "https" else "http"}://${fqdn}/";
-        HTTP_PORT = 3000;
-      };
-
-      service = {
-        DISABLE_REGISTRATION = true;
-        REQUIRE_SIGNIN_VIEW = false;
-      };
-
-      repository = {
-        ENABLE_PUSH_CREATE_USER = true;
-        ENABLE_PUSH_CREATE_ORG = true;
-        DEFAULT_BRANCH = "main";
-      };
-
-      ui = {
-        DEFAULT_THEME = themeName;
-      };
-
-      # TODO: once we have email setup this would be nice
-      mailer.ENABLED = true;
-
-      actions = {
-        ENABLED = true;
-        # DEFAULT_ACTIONS_URL = "github";
-      };
-    };
-  };
-
-  systemd.services.forgejo-branding = {
-    enable = true;
-
-    wantedBy = [ "forgejo.service" ];
-    before = [ "forgejo.service" ];
-
-    serviceConfig = {
-      Type = "oneshot";
-      ExecStart = pkgs.writeShellScript "forgejo-branding.oneshot" ''
-        ${pkgs.rsync}/bin/rsync -rl --chown forgejo:forgejo --delete ${forgejoPublic}/ ${config.services.forgejo.customDir}/public
-        ${pkgs.rsync}/bin/rsync -rl --chown forgejo:forgejo --delete ${forgejoTemplates}/ ${config.services.forgejo.customDir}/templates
-      '';
-    };
-  };
-
-  environment.persistence."/persist".directories = [
-    {
-      directory = config.services.forgejo.stateDir;
-      group = "forgejo";
-      user = "forgejo";
-    }
-  ];
-}
@@ -0,0 +1,40 @@
+{ config, ... }:
+let
+  inherit (config.networking) fqdn;
+
+  acmeEnabled = config.acme.enable;
+in
+{
+  services.gitea = {
+    enable = true;
+
+    appName = "TuxCord Gitea";
+    database.type = "mysql";
+
+    lfs.enable = true;
+
+    settings = {
+      server = {
+        DOMAIN = fqdn;
+        ROOT_URL = "${if acmeEnabled then "https" else "http"}://${fqdn}/";
+        HTTP_PORT = 3000;
+      };
+
+      service = {
+        DISABLE_REGISTRATION = true;
+        REQUIRE_SIGNIN_VIEW = false;
+      };
+
+      repository = {
+        ENABLE_PUSH_CREATE_USER = true;
+        ENABLE_PUSH_CREATE_ORG = true;
+        DEFAULT_BRANCH = "main";
+      };
+
+      # ui.DEFAULT_THEME = "...";
+
+      # TODO: once we have email setup this would be nice
+      mailer.ENABLED = true;
+    };
+  };
+}
@@ -3,20 +3,13 @@ let
  inherit (config.networking) fqdn;

  mkVhost =
-    attrs: locations:
+    attrs:
    let
      acmeEnabled = config.acme.enable;
    in
    {
      forceSSL = acmeEnabled;
      useACMEHost = if acmeEnabled then fqdn else null;
-
-      locations = {
-        "= /robots.txt" = {
-          alias = disallowedRobotsTxt;
-        };
-      }
-      // locations;
    }
    // attrs;

@@ -28,19 +21,6 @@ let
      proxy_request_buffering off;
    '';
  };
-
-  mkSsi = webRoot: {
-    root = webRoot;
-
-    extraConfig = ''
-      ssi on;
-    '';
-  };
-
-  disallowedRobotsTxt = builtins.toFile "robots.txt" ''
-    User-agent: *
-    Disallow: /
-  '';
 in
 {
  services.nginx = {
@@ -52,15 +32,21 @@ in
    recommendedGzipSettings = true;
    recommendedOptimisation = true;

-    virtualHosts = {
-      "${fqdn}" = mkVhost { default = true; } {
-        "/" = mkSsi "${self.pins.website}/web-root";
-      };
+    virtualHosts."${fqdn}" = mkVhost {
+      default = true;

-      "git.${fqdn}" = mkVhost { } {
-        "/" = mkProxy config.services.forgejo.settings.server.HTTP_PORT;
+      locations."/" = {
+        root = "${self.pins.website}/web-root";
+
+        extraConfig = ''
+          ssi on;
+        '';
      };
    };
+
+    virtualHosts."git.${fqdn}" = mkVhost {
+      locations."/" = mkProxy config.services.gitea.settings.server.HTTP_PORT;
+    };
  };

  networking.firewall.allowedTCPPorts = [
@@ -1,11 +1,9 @@
-{ config, ... }:
 {
  services.openssh = {
    enable = true;

    settings = {
      ClientAliveInterval = 300;
-      X11Forwarding = true;

      KbdInteractiveAuthentication = false;
      PasswordAuthentication = false;
@@ -13,5 +11,5 @@
    };
  };

-  networking.firewall.allowedTCPPorts = config.services.openssh.ports;
+  networking.firewall.allowedTCPPorts = [ 22 ];
 }
@@ -11,30 +11,35 @@ let
    "wheel"
  ];

-  mkUser = name: uid: admin: {
-    users.users.${name} = {
-      inherit uid;
-      isNormalUser = true;
-      extraGroups = lib.optionals admin adminGroups;
-      openssh.authorizedKeys.keys = self.lib.getSSHKeys name;
-    };
+  mkUser =
+    name: uid: options:
+    let
+      admin = options.admin or false;
+    in
+    {
+      users.users.${name} = {
+        inherit uid;
+        isNormalUser = true;
+        extraGroups = lib.optionals admin adminGroups;
+        openssh.authorizedKeys.keys = self.lib.getSSHKeys name;
+      };

-    systemd.slices."user-${builtins.toString uid}".sliceConfig = {
-      CPUQuota = "50%";
-      CPUWeight = "10";
-      IOAccounting = true;
-      IOWeight = "10";
-      MemoryMax = "2G";
-      MemorySwapMax = "1G";
-      TasksMax = "100";
+      systemd.slices."user-${builtins.toString uid}".sliceConfig = {
+        CPUQuota = "50%";
+        CPUWeight = "10";
+        IOAccounting = true;
+        IOWeight = "10";
+        MemoryMax = "2G";
+        MemorySwapMax = "1G";
+        TasksMax = "100";
+      };
    };
-  };
 in
 lib.recursiveUpdate
  (builtins.foldl'
    (attrs: user: {
      options = lib.recursiveUpdate attrs.options (
-        mkUser user.name attrs.uid (user.value.admin or false)
+        mkUser user.name attrs.uid (user.value.options or { })
      );
      uid = attrs.uid + 1;
    })
@@ -45,21 +50,8 @@ lib.recursiveUpdate
    (lib.attrsToList users)
  ).options
  {
-    users = {
-      motd = ''
-                  __                                          __                      __
-        ---------/\ \__                                      /\ \                    /\ \__
-        ---------\ \ ,_\  __  __  __  _   ___    ___   _ __  \_\ \        ___      __\ \ ,_\
-        ----------\ \ \/ /\ \/\ \/\ \/'\ /'___\ / __`\/\`'__\/'_` \      /'_ `\  /'__`\ \ \/
-        -----------\ \ \_\ \ \_\ \/>  <//\ \__//\ \L\ \ \ \//\ \L\ \  __/\ \/\ \/\  __/\ \ \_
-        ------------\ \__\\ \____//\_/\_\ \____\ \____/\ \_\\ \___,_\/\_\ \_\ \_\ \____\\ \__\
-        -------------\/__/ \/___/ \//\/_/\/____/\/___/  \/_/ \/__,_ /\/_/\/_/\/_/\/____/ \/__/
-                                                    A friendly Linux community - est. July 2023
-      '';
-
-      users.root = {
-        initialPassword = "tuxcord";
-        openssh.authorizedKeys.keys = self.lib.adminSSHKeys;
-      };
+    users.users.root = {
+      initialPassword = "tuxcord";
+      openssh.authorizedKeys.keys = self.lib.adminSSHKeys;
    };
  }
@@ -9,15 +9,8 @@
 */
 # Generated by npins. Do not modify; will be overwritten regularly
 let
-  # Backwards-compatibly make something that previously didn't take any arguments take some
-  # The function must return an attrset, and will unfortunately be eagerly evaluated
-  # Same thing, but it catches eval errors on the default argument so that one may still call it with other arguments
-  mkFunctor =
-    fn:
-    let
-      e = builtins.tryEval (fn { });
-    in
-    (if e.success then e.value else { error = fn { }; }) // { __functor = _self: fn; };
+  data = builtins.fromJSON (builtins.readFile ./sources.json);
+  version = data.version;

  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
  range =
@@ -28,6 +21,7 @@ let

  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
+  concatMapStrings = f: list: concatStrings (map f list);
  concatStrings = builtins.concatStringsSep "";

  # If the environment variable NPINS_OVERRIDE_${name} is set, then use
@@ -54,90 +48,41 @@ let

  mkSource =
    name: spec:
-    {
-      pkgs ? null,
-    }:
    assert spec ? type;
    let
-      # Unify across builtin and pkgs fetchers.
-      # `fetchGit` requires a wrapper because of slight API differences.
-      fetchers =
-        if pkgs == null then
-          {
-            inherit (builtins) fetchTarball fetchurl;
-            # Frustratingly, due to flakes and `fetchTree`, `fetchGit`
-            # has a different signature than the other builtin
-            # fetchers
-            fetchGit = args: (builtins.fetchGit args).outPath;
-          }
-        else
-          {
-            fetchTarball =
-              {
-                url,
-                sha256,
-              }:
-              pkgs.fetchzip {
-                inherit url sha256;
-                extension = "tar";
-              };
-            inherit (pkgs) fetchurl;
-            fetchGit =
-              {
-                url,
-                submodules,
-                rev,
-                name,
-                lfs,
-                narHash,
-              }:
-              pkgs.fetchgit {
-                inherit url rev name lfs;
-                fetchSubmodules = submodules;
-                hash = narHash;
-              };
-          };
-
      path =
        if spec.type == "Git" then
-          mkGitSource fetchers spec
+          mkGitSource spec
        else if spec.type == "GitRelease" then
-          mkGitSource fetchers spec
+          mkGitSource spec
        else if spec.type == "PyPi" then
-          mkPyPiSource fetchers spec
+          mkPyPiSource spec
        else if spec.type == "Channel" then
-          mkChannelSource fetchers spec
-        else if spec.type == "Url" || spec.type == "MutableUrl" then
-          mkUrlSource fetchers spec
-        else if spec.type == "Container" then
-          mkContainerSource pkgs spec
+          mkChannelSource spec
+        else if spec.type == "Tarball" then
+          mkTarballSource spec
        else
          builtins.throw "Unknown source type ${spec.type}";
    in
    spec // { outPath = mayOverride name path; };

  mkGitSource =
-    {
-      fetchTarball,
-      fetchGit,
-      ...
-    }:
    {
      repository,
      revision,
      url ? null,
      submodules,
      hash,
-      lfs,
+      branch ? null,
      ...
    }:
    assert repository ? type;
    # At the moment, either it is a plain git repository (which has an url), or it is a GitHub/GitLab repository
    # In the latter case, there we will always be an url to the tarball
    if url != null && !submodules then
-      fetchTarball {
+      builtins.fetchTarball {
        inherit url;
-        sha256 = hash;
+        sha256 = hash; # FIXME: check nix version & use SRI hashes
      }
    else
      let
@@ -148,8 +93,6 @@ let
            "https://github.com/${repository.owner}/${repository.repo}.git"
          else if repository.type == "GitLab" then
            "${repository.server}/${repository.repo_path}.git"
-          else if repository.type == "Forgejo" then
-            "${repository.server}/${repository.owner}/${repository.repo}.git"
          else
            throw "Unrecognized repository type ${repository.type}";
        urlToName =
@@ -164,96 +107,40 @@ let
          "${if matched == null then "source" else builtins.head matched}${appendShort}";
        name = urlToName url revision;
      in
-      fetchGit {
+      builtins.fetchGit {
        rev = revision;
-        narHash = hash;
-
-        inherit name submodules url lfs;
+        inherit name;
+        # hash = hash;
+        inherit url submodules;
      };

  mkPyPiSource =
-    { fetchurl, ... }:
-    {
-      url,
-      hash,
-      ...
-    }:
-    fetchurl {
+    { url, hash, ... }:
+    builtins.fetchurl {
      inherit url;
      sha256 = hash;
    };

  mkChannelSource =
-    { fetchTarball, ... }:
-    {
-      url,
-      hash,
-      ...
-    }:
-    fetchTarball {
+    { url, hash, ... }:
+    builtins.fetchTarball {
      inherit url;
      sha256 = hash;
    };

-  mkUrlSource =
-    {
-      fetchTarball,
-      fetchurl,
-      ...
-    }:
+  mkTarballSource =
    {
      url,
+      locked_url ? url,
      hash,
-      unpack,
      ...
    }:
-    (if unpack then fetchTarball else fetchurl) {
-      inherit url;
+    builtins.fetchTarball {
+      url = locked_url;
      sha256 = hash;
    };
-
-  mkContainerSource =
-    pkgs:
-    {
-      image_name,
-      image_tag,
-      image_digest,
-      hash,
-      ...
-    }:
-    if pkgs == null then
-      builtins.throw "container sources require passing in a Nixpkgs value: https://github.com/andir/npins/blob/master/README.md#using-the-nixpkgs-fetchers"
-    else
-      pkgs.dockerTools.pullImage {
-        imageName = image_name;
-        imageDigest = image_digest;
-        finalImageTag = image_tag;
-        hash = hash;
-      };
-
 in
-mkFunctor (
-  {
-    input ? ./sources.json,
-  }:
-  let
-    data =
-      if builtins.isPath input then
-        # while `readFile` will throw an error anyways if the path doesn't exist,
-        # we still need to check beforehand because *our* error can be caught but not the one from the builtin
-        # See: <https://git.lix.systems/lix-project/lix/issues/1098>
-        if builtins.pathExists input then
-          builtins.fromJSON (builtins.readFile input)
-        else
-          throw "Input path ${toString input} does not exist"
-      else if builtins.isAttrs input then
-        input
-      else
-        throw "Unsupported input type ${builtins.typeOf input}, must be a path or an attrset";
-    version = data.version;
-  in
-  if version == 8 then
-    builtins.mapAttrs (name: spec: mkFunctor (mkSource name spec)) data.pins
-  else
-    throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
-)
+if version == 5 then
+  builtins.mapAttrs mkSource data.pins
+else
+  throw "Unsupported format version ${toString version} in sources.json. Try running `npins upgrade`"
@@ -8,11 +8,10 @@
      },
      "branch": "main",
      "submodules": false,
-      "lfs": true,
-      "revision": "b18dd7b863644debb0a843a5b21bb490bfe7d048",
+      "revision": "a9f523c268062c0c4a8167b719be15e3e4b3ef88",
      "url": null,
-      "hash": "sha256-xYH9RXYZDVotUW8fKIEC9u0GJeEg2nV/23aQlEyeQso="
+      "hash": "0ql14xjz0prvy3rdx6zkbpsjxvx40ivdzrwzdgfsk07jg07aki05"
    }
  },
-  "version": 8
+  "version": 5
 }
@@ -2,26 +2,6 @@
 {
  perSystem =
    { pkgs, ... }:
-    let
-      npins' = pkgs.npins.overrideAttrs (
-        final: old: {
-          src = pkgs.fetchFromGitHub {
-            owner = "javalsai";
-            repo = "npins";
-            rev = "f3def7dfeecc16884cb0601f6c904d5142f47383";
-            hash = "sha256-ejeOGmDw+D4KddFJ5OAPradqoS+p2eAhhS4fOLQOWOk=";
-          };
-
-          cargoHash = null;
-          cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
-            src = final.src;
-            hash = "sha256-mG4UClFBgiWBraWQ12N3CSyapaIpuXI9F8wQGwh/ooQ=";
-          };
-
-          cargoBuildFeatures = [ ];
-        }
-      );
-    in
    {
      devShells.default = pkgs.mkShell {
        name = "configuration.nix";
@@ -53,7 +33,7 @@
          jujutsu
          nix-output-monitor
          nixfmt
-          npins'
+          npins
          parted
          smartmontools
          statix
Author	SHA1	Message	Date
javalsai	a78752607f	nixos/services: add default website on nginx Check / Nix flake (push) Failing after 9s Details Lint / Nix expressions (push) Failing after 12s Details	2026-05-04 04:55:58 +02:00
javalsai	e0bd689d4f	nixos/services: disable nginx proxy buffering	2026-05-04 04:55:40 +02:00
ErrorNoInternet	a18a871eb3	nixos/impermanence: remove ssh host key persistence Check / Nix flake (push) Failing after 10s Details Lint / Nix expressions (push) Failing after 12s Details The SSH host key files are already defined in the OpenSSH module, so there is no need to persist them with impermanence.nix.	2026-05-03 22:24:33 -04:00
ErrorNoInternet	ac5fe801a9	shells: remove neovim Check / Nix flake (push) Failing after 9s Details Lint / Nix expressions (push) Failing after 11s Details Some users may be using self-contained Neovim executables.	2026-05-03 22:18:49 -04:00
ErrorNoInternet	d2ad014c23	agenix: import initial user dns keys	2026-05-03 22:18:49 -04:00
ErrorNoInternet	b431300f49	treewide: create global user list	2026-05-03 22:18:49 -04:00
javalsai	7218ed9bce	docs: add sections and fix typos/errors	2026-05-03 22:18:49 -04:00
ErrorNoInternet	fbbb83bf52	treewide: initialize npins	2026-05-03 22:18:48 -04:00
ErrorNoInternet	0479f0d441	treewide: refactor code	2026-05-03 21:12:36 -04:00
javalsai	e939c28c9c	nixos/security: add acme through dns challenge few side refactors of this: - no more `dns.domain`, it all must rely on `fqdn`, prevents inconsistencies. - also added an specific host `tuxcord-acmetest` that uses the key zone for `nix.tuxcord.net` to test certificate pulling.	2026-05-03 21:11:07 -04:00
javalsai	455753a192	docs: document installation, secrets, and setup steps	2026-05-03 21:11:07 -04:00
javalsai	967af49d7d	nixos/services: make dns configuration easier	2026-05-03 21:11:07 -04:00
javalsai	e5a38b15ee	nixos/service: add dns (bind named server)	2026-05-03 20:36:49 -04:00
javalsai	6b2c8d482c	nixos/programs: add bind utils	2026-05-03 20:36:49 -04:00
javalsai	dd7ad60710	nixos/services: add gitea server Check / Nix flake (push) Failing after 9s Details Lint / Nix expressions (push) Failing after 10s Details	2026-05-04 01:56:34 +02:00
javalsai	fd18ae4a78	nixos/services: add nginx base configuration	2026-05-04 01:56:34 +02:00
javalsai	d7deaa187c	nixos/networking: add own fqdn to extraHosts	2026-05-04 01:56:34 +02:00
javalsai	c6d66902bb	nixos/hosts: add tuxcord-vm host configuration	2026-05-04 01:56:34 +02:00
ErrorNoInternet	4704a887fa	nixos: separate openssh firewall port	2026-05-04 01:56:34 +02:00
javalsai	eaaffcc289	lib/ssh: add more ssh keys	2026-05-04 01:56:32 +02:00