fix flake check

add goldman, the rpi that runs gatekeeper
add atlans laptop ssh key
2026-07-30 19:29:51 +02:00 · 2026-07-30 18:49:39 +02:00 · 2026-06-23 17:14:59 +02:00 · 2026-06-10 17:35:47 +02:00 · 2026-06-06 00:15:42 +02:00 · 2026-06-04 15:24:52 +02:00
13 changed files with 307 additions and 25 deletions
--- a/.gitea/workflows/autoupdate.yml
+++ b/.gitea/workflows/autoupdate.yml
@@ -2,7 +2,7 @@ name: Weekly Flake Update

 on:
    schedule:
-        - cron: "0 0 * * 4"
+        - cron: "0 4 1/14 * *"
    workflow_dispatch:

 permissions:
@@ -89,6 +89,18 @@ jobs:
                grep -q ${{ github.ref_name }} &&
                exit 1 ||
                exit 0
+            - name: close other bump requests
+              run: |
+                for i in $(tea pr -o simple | grep "Automatic Nixpkgs update" | awk '{print $1}')
+                do
+                  if [ "$i" = "" ]
+                  then
+                    echo "No bumps to close"
+                    exit 0
+                  else
+                    tea pr close $i
+                  fi
+                done
            - name: Force push branch
              run: git push --force -u origin nixpkgs_bump_$(date +%Y%m%d)
            - name: Create pull request
--- a/.gitea/workflows/hydra-callback.yml
+++ b/.gitea/workflows/hydra-callback.yml
@@ -0,0 +1,63 @@
+name: Hydra callback
+
+on:
+    pull_request:
+        types: 
+            - opened
+            - synchronize
+        paths:
+          - '**.nix'
+          - flake.lock
+    push:
+        branches:
+          - master
+        paths:
+          - '**.nix'
+          - flake.lock
+
+permissions:
+    contents: write
+
+jobs:
+    on_pr:
+        if: github.event.pull_request
+        runs-on: ubuntu-latest
+        env:
+            NIXPKGS_ALLOW_UNFREE: 1
+        steps:
+            - name: Install sudo
+              run: |
+                  apt-get update
+                  apt-get install -y sudo
+            - name: Set up Nix
+              uses: https://github.com/cachix/install-nix-action@v31
+              with: 
+                github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
+            - name: Find pr number
+              run: |
+                echo PR=$(echo "${{ github.ref }}" | cut -d / -f 3) >> "$GITHUB_ENV"
+            - name: run hydra wait
+              timeout-minutes: 200
+              run: |
+                echo "Running now @ pr no $PR"
+                nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 "$PR"
+
+    on_push:
+        if: github.event.push
+        runs-on: ubuntu-latest
+        env:
+            NIXPKGS_ALLOW_UNFREE: 1
+        steps:
+            - name: Install sudo
+              run: |
+                  apt-get update
+                  apt-get install -y sudo
+            - name: Set up Nix
+              uses: https://github.com/cachix/install-nix-action@v31
+              with: 
+                github_access_token: ${{ secrets.AHTLONS_GITHUB_TOKEN }}
+            - name: run hydra wait
+              timeout-minutes: 200
+              run: |
+                echo "Running now @ master"
+                nix run nixpkgs#hydra-cli -- -H https://hydra.dynamicdiscord.de jobset-wait malobeo2 master
--- a/.hydra/spec.json
+++ b/.hydra/spec.json
@@ -12,7 +12,7 @@
  "type": 0,
  "inputs": {
    "nixexpr": {
-      "value": "https://git.dynamicdiscord.de/ahtlon/infrastructure master",
+      "value": "https://git.dynamicdiscord.de/malobeo/infrastructure master",
      "type": "git",
      "emailresponsible": false
    },
--- a/flake.lock
+++ b/flake.lock
@@ -78,6 +78,29 @@
        "type": "github"
      }
    },
+    "gatekeeper": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ],
+        "pyproject-build-systems": "pyproject-build-systems",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      },
+      "locked": {
+        "lastModified": 1785429358,
+        "narHash": "sha256-uWUZm9iRqPkkNWrgtpsN9GyDQsiz80eHvuE14wOKp+Q=",
+        "ref": "refs/heads/master",
+        "rev": "40312020c8e17c78ac345def6ac95cb1ed8f344f",
+        "revCount": 110,
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.dynamicdiscord.de/malobeo/gatekeeper"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -126,11 +149,11 @@
        "spectrum": "spectrum"
      },
      "locked": {
-        "lastModified": 1772055583,
-        "narHash": "sha256-iPIm1orqkhsxqju6EVODOrV1BmyA5HNTZ8a1o812bFM=",
+        "lastModified": 1780588968,
+        "narHash": "sha256-zQk+GqLO+T9taIl1UUt3swvaOksWJxL7PL8K0+Fc/Hs=",
        "owner": "astro",
        "repo": "microvm.nix",
-        "rev": "f6dcfb7c16cc3775536c825dc0698d4ede13d063",
+        "rev": "4d3fb17437944ea57eef2b9e6108ca777b1209ca",
        "type": "github"
      },
      "original": {
@@ -176,12 +199,15 @@
      }
    },
    "nixos-hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2"
+      },
      "locked": {
-        "lastModified": 1771969195,
-        "narHash": "sha256-qwcDBtrRvJbrrnv1lf/pREQi8t2hWZxVAyeMo7/E9sw=",
+        "lastModified": 1781020964,
+        "narHash": "sha256-fS7xTi2j2iso5Hj7RNZLv/acDlCT+fgMVkVk40A7Uco=",
        "owner": "NixOS",
        "repo": "nixos-hardware",
-        "rev": "41c6b421bdc301b2624486e11905c9af7b8ec68e",
+        "rev": "32c2cd9e46286c4eced3dc6b613c659126bf3cca",
        "type": "github"
      },
      "original": {
@@ -209,11 +235,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1771848320,
-        "narHash": "sha256-0MAd+0mun3K/Ns8JATeHT1sX28faLII5hVLq0L3BdZU=",
+        "lastModified": 1780749050,
+        "narHash": "sha256-3av0pIjlOWQ6rDbNOmpUSvbNnJkGORQKKjb4LtCZsIY=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "2fc6539b481e1d2569f25f8799236694180c0993",
+        "rev": "a799d3e3886da994fa307f817a6bc705ae538eeb",
        "type": "github"
      },
      "original": {
@@ -225,11 +251,24 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1771903837,
-        "narHash": "sha256-sdaqdnsQCv3iifzxwB22tUwN/fSHoN7j2myFW5EIkGk=",
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1780952837,
+        "narHash": "sha256-Fwd1+spDtQ0hDyBwme6ufG3n4mY0UrjjFdYHv+G/Hds=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "e764fc9a405871f1f6ca3d1394fb422e0a0c3951",
+        "rev": "e820eb4a444b46a19b2e03e8dfd2359439ff30fe",
        "type": "github"
      },
      "original": {
@@ -239,17 +278,68 @@
        "type": "github"
      }
    },
+    "pyproject-build-systems": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "gatekeeper",
+          "pyproject-nix"
+        ],
+        "uv2nix": [
+          "gatekeeper",
+          "uv2nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776659114,
+        "narHash": "sha256-qapCOQmR++yZSY43dzrp3wCrkOTLpod+ONtJWBk6iKU=",
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "rev": "ffaa2161dd5d63e0e94591f86b54fc239660fb2e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "build-system-pkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1778901413,
+        "narHash": "sha256-GSKXTAnFqRAMlZkJrIPcQMYf+lpMr66K3i60mB9STvc=",
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "rev": "a228447c3e179d477c1b6246ef3efa8cfe3c469a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
    "root": {
      "inputs": {
        "disko": "disko",
        "dns": "dns",
        "ep3-bs": "ep3-bs",
+        "gatekeeper": "gatekeeper",
        "home-manager": "home-manager",
        "mfsync": "mfsync",
        "microvm": "microvm",
        "nixos-generators": "nixos-generators",
        "nixos-hardware": "nixos-hardware",
-        "nixpkgs": "nixpkgs_2",
+        "nixpkgs": "nixpkgs_3",
        "nixpkgs-unstable": "nixpkgs-unstable",
        "sops-nix": "sops-nix",
        "tasklist": "tasklist",
@@ -264,11 +354,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1772048434,
-        "narHash": "sha256-/wA0OaH6kZ/pFA+nXR/tvg5oupOmEDmMS5us79JT60o=",
+        "lastModified": 1780547341,
+        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "334daa7c273dd8bf7a0cd370e4e16022b64e55e9",
+        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
        "type": "github"
      },
      "original": {
@@ -280,11 +370,11 @@
    "spectrum": {
      "flake": false,
      "locked": {
-        "lastModified": 1759482047,
-        "narHash": "sha256-H1wiXRQHxxPyMMlP39ce3ROKCwI5/tUn36P8x6dFiiQ=",
+        "lastModified": 1778940603,
+        "narHash": "sha256-voSM8dZNlaOWN3kbYFky+FNY6fFQOEw0xF+ZMpZKkCQ=",
        "ref": "refs/heads/main",
-        "rev": "c5d5786d3dc938af0b279c542d1e43bce381b4b9",
-        "revCount": 996,
+        "rev": "367dd227f539267eae2b62770b4c17b88ac8c1f1",
+        "revCount": 1265,
        "type": "git",
        "url": "https://spectrum-os.org/git/spectrum"
      },
@@ -445,6 +535,31 @@
        "type": "github"
      }
    },
+    "uv2nix": {
+      "inputs": {
+        "nixpkgs": [
+          "gatekeeper",
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "gatekeeper",
+          "pyproject-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1779269674,
+        "narHash": "sha256-P1LHCRdYpdtHAEzuEsNHrI6d9mVPl5a2fyFDZGHNVbI=",
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "rev": "69aec536f6d1acc415ed2e20299312802aba98c6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pyproject-nix",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    },
    "zineshop": {
      "inputs": {
        "nixpkgs": [
--- a/flake.nix
+++ b/flake.nix
@@ -37,6 +37,11 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };

+    gatekeeper = {
+      url = "git+https://git.dynamicdiscord.de/malobeo/gatekeeper";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+    };
+
    nixos-generators = {
      url = "github:nix-community/nixos-generators";
      inputs.nixpkgs.follows = "nixpkgs";
--- a/machines/goldman/configuration.nix
+++ b/machines/goldman/configuration.nix
@@ -0,0 +1,72 @@
+{ config, pkgs, inputs, modulesPath, ... }:
+
+let
+  sshKeys = import ../ssh_keys.nix;
+in
+{
+  networking.hostName = "goldman"; # Define your hostname.
+  nixpkgs.hostPlatform = { system = "aarch64-linux"; };
+  imports =
+    [ 
+      inputs.gatekeeper.nixosModules.gatekeeper
+      ../modules/malobeo_user.nix
+      #inputs.nixos-hardware.nixosModules.raspberry-pi-3
+      (modulesPath + "/profiles/minimal.nix")
+      #(modulesPath + "/installer/sd-card/sd-image.nix")
+    ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-label/NIXOS_SD";
+      fsType = "ext4";
+    };
+
+  #Try to reduce size
+  documentation.man.enable = false;
+  documentation.nixos.enable = false;
+
+  services.openssh.enable = true;
+  services.openssh.ports = [ 22 ];
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.settings.PermitRootLogin = "prohibit-password";
+  users.users.root.openssh.authorizedKeys.keys = sshKeys.admins;
+
+  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
+  boot.loader.grub.enable = false;
+
+  # Enables the generation of /boot/extlinux/extlinux.conf
+  boot.loader.generic-extlinux-compatible.enable = true;
+
+  networking.dhcpcd.enable = true;
+
+  # Set your time zone.
+  time.timeZone = "Europe/Berlin";
+
+  services = {
+    gatekeeper = {
+      enable = true;
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    htop
+    wget
+    git
+    pciutils
+    nix-tree
+  ];
+
+  services.avahi = {
+    enable = true;
+    nssmdns4 = true;
+    publish = {
+      enable = true;
+      addresses = true;
+      userServices = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  system.stateVersion = "23.05";
+}
+
--- a/machines/hosts.nix
+++ b/machines/hosts.nix
@@ -58,6 +58,15 @@ in
          address = "192.168.1.105";
        };
      };
+
+      goldman = {
+        type = "rpi";
+        network = {
+          local = true;
+          hostId = "16";
+          address = "192.168.1.106";
+        };
+      };
  
      durruti = {
        type = "microvm";
--- a/machines/louise/configuration.nix
+++ b/machines/louise/configuration.nix
@@ -46,6 +46,8 @@
    ];
  };

+  nixpkgs.config.permittedInsecurePackages = [ "electron-39.8.10" ];
+
  services.tor = {
    enable = true;
    client.enable = true;
--- a/machines/modules/malobeo/gitea_translator.nix
+++ b/machines/modules/malobeo/gitea_translator.nix
@@ -55,7 +55,7 @@ in

      serviceConfig = {
        ExecStart = ''
-          ${pkgs.python3}/bin/python3 ${inputs.self + /scripts/gitea_hydra_server.py} \
+          ${pkgs.python3}/bin/python3 ${../../../scripts/gitea_hydra_server.py} \
            --baseurl ${cfg.baseurl} \
            --owner ${cfg.owner} \
            --repo ${cfg.repo} \
@@ -75,4 +75,4 @@ in
      };
    };
  };
-}
+}
--- a/machines/nextcloud/configuration.nix
+++ b/machines/nextcloud/configuration.nix
@@ -63,6 +63,7 @@ in
    settings = {
      trusted_domains = [ "cloud.malobeo.org" "cloud.hq.malobeo.org" ];
      trusted_proxies = [ hosts.malobeo.hosts.fanny.network.address ];
+      overwriteprotocol = "https";
      "maintenance_window_start" = "1";
      "default_phone_region" = "DE";
    };
--- a/machines/pretalx/configuration.nix
+++ b/machines/pretalx/configuration.nix
@@ -1,4 +1,4 @@
-{ config, self, lib, pkgs,  ... }:
+{ config, self, lib, pkgs, inputs,  ... }:

 with lib;

@@ -58,6 +58,7 @@ in

  services.pretalx = {
    enable = true;
+    package = inputs.nixpkgs-unstable.legacyPackages."x86_64-linux".pretalx;
    celery.extraArgs = [
      "--concurrency=${toString config.microvm.vcpu}"
    ];
--- a/machines/ssh_keys.nix
+++ b/machines/ssh_keys.nix
@@ -4,6 +4,7 @@
   "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCxgcjNOYbza3+RfANFDXy7HXNRFlkpDOAcGyB7MKshiVlbPByWRSjfZa0BeRNjpeCd8QkIodKUzqYOCOrc8ad3kiNbdLRcDz57A5xSLD3ynakoWJo0AmJjT3Ta1JJj8inNwwykR0ig5//SrtsZb9HkWJDAF017MokM2r8AWPE1QzcQdh93kojXcgTHrJHzEqgKbEGDEk37f1RvZG4umEFeqdK2FvS5isPa7P9X7hyyoDC8bvEy7xfaDrToJAoXon6r79taxH8UWIvy//xsU0NBLYK2eE4RQe2AjF6Ri+CybI6y1SsHOvyh4nNKWlfUOEL6UnIulRn/LXFOKCJi7xuoTeJXS0+w1DNEuiGosVNXPSKbUm/eDBVnb8Iyep9wmygSZayN82xL5lRlG3Mn45ttecqfm2SJkmduBA5qXcTdDPe/lXTZaVO9tbiIcJfUgd3ttEu2+6YjLn74D965PlovzvR6EhbVUZ8IkOAt4VmuTkXIdm8SCS7jzhsiKeUXoZ4rfa375zi79SIPuIkoMasj6d16wcYOeFIUIMFFccfQ9jQjr9NTSXC2dd7sfbI9I9mF7eRQSsUdSwpP8WH1b+M1MxTbdhEUdPwpOLviTTIuk8E8K8DQDZIcOOh38mCDpyoh02nwfRxlyoYVsKAHIQH02dHTvYEa3/pMsRwGc9W1Ow== kalipso@desktop"
   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINQg6a2EGmq+i9lfwU+SRMQ8MGN3is3VS6janzl9qOHo quaseb67@hzdr.de"
   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKaEcGaSKU0xC5qCwzj2oCLLG4PYjWHZ7/CXHw4urVk atlan@nixos"
+   "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDi8yxrMZoXEy7e8/MZeyihOARU2tN0TpJTUX55UO31B atlan@argon"
 ];
 backup = [
  "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDIGryhnXdmbGObONG88K+c9zeduMrwtoLHwzMDZg3UXB+Cnq2FXWOrlLZxA+95VUgHpyGZiykJmzeWrKhldDlDeGGd8QCCLeuliiOgXADTYjWaVfhd+6arPZrK2VtqqsguvH40gW1xfoGAOmAT4WFnxWxIaEip0V2u6NOoKTiH9I3bz2Qe4lfJvPXig+XwCXcukXd6XUkDFYDpiw8XNV3X7pqTus5d2RYR97bAhIYZZQ6h50ZpTY8N0lFh4RY5yfx8BhxJW3tfoi9uZvVuPx7dGPsZsSniENFPMNz3UwHGitTJMr4088cJrAGgd5lyFuLouiHiM2JMGA0wx9wWTbWJEwTLaTVQK9gSJf857ndV2zCh9vKlfko4w9bQgqxKg4U/mY8dXX1E7D51nD2ci8Ed+ZG+NEneFLyZhLsD82GkBY+YovA+4xm/pcx+hBhlyqGNxI8v+Jh+JhEyD/ZLgJfq3ZMbGIGsTiDwZ2flLLxImHHEoDoT6PHU6hDhPDJu560="
--- a/outputs.nix
+++ b/outputs.nix
@@ -118,6 +118,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
      users.imports = [ ./machines/modules/malobeo/users.nix ];
      backup.imports = [ ./machines/modules/malobeo/backup.nix ];
      printing.imports = [ ./machines/modules/malobeo/printing.nix ];
+      gitea-translator.imports = [ ./machines/modules/malobeo/gitea_translator.nix ];
    };

    hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (
Author	SHA1	Message	Date
ahtlon	3d31a8a690	fix flake check	2026-07-30 19:29:51 +02:00
ahtlon	9f7b2bd3d5	add goldman, the rpi that runs gatekeeper	2026-07-30 18:49:39 +02:00
Ahtlon	e01718263d	add atlans laptop ssh key	2026-06-23 17:14:59 +02:00
ahtlon	017e2ca556	[Update] update and allow EOL electron	2026-06-10 17:35:47 +02:00
ahtlon	c31a576fbd	I might be stupid...	2026-06-06 00:15:42 +02:00
ahtlon	34db721709	[workflow] fix autoupdate not running -.-	2026-06-04 15:24:52 +02:00
ahtlon	9c55854987	Update every 14 days; close previous prs	2026-05-05 11:38:48 +02:00
ahtlon	8e7c9141c2	Automatic Nixpkgs update (#156 ) Date: Thu Apr 30 00:03:28 UTC 2026 Evaluation warnings: evaluation warning: cloud-hypervisor supports systemd-notify via vsock, but `microvm.vsock.cid` must be set to enable this. evaluation warning: 'system' has been renamed to/replaced by 'stdenv.hostPlatform.system' Co-authored-by: malobot <malobot@systemli.org> Reviewed-on: malobeo/infrastructure#156 Co-authored-by: ahtlon <git@ahtlon.de> Co-committed-by: ahtlon <git@ahtlon.de>	2026-05-05 11:11:20 +02:00
ahtlon	ea2ba8637b	[pretalx] pin package to unstable to fix security problem	2026-04-29 20:53:30 +02:00
kalipso	c40d84ba4d	[nextcloud] overwriteprotocol https	2026-04-14 13:14:34 +02:00
malobot	bd859dd40d	Update flake.lock	2026-03-26 10:59:37 +01:00
ahtlon	3ccd73788c	[gitea] add timeout and run on master	2026-03-26 10:31:09 +01:00
ahtlon	b2fc2d126f	Add hydra callback	2026-03-25 10:41:53 +01:00
ahtlon	bf3f4db1b2	[hydra] forgot to change repo	2026-03-16 20:58:45 +01:00
kalipso	f4614f2887	[modules] do not reference self within modules if it gets included in other flakes 'self' references to that flake, instead of malobeo	2026-03-16 20:52:14 +01:00
kalipso	07d7f3b882	[modules] add gitea translator	2026-03-16 20:42:26 +01:00