kleine fehler behoben

the automatic garbage collection of durruti - which runs inside a
nixos-container - complelty wiped the hosts nix store making basically
all the services fail and the machine unbootable.

.gitea/workflows/eval-hydra-jobs.yml

@@ -0,0 +1,15 @@
+name: "Evaluate Hydra Jobs"
+on:
+  pull_request:
+  push:
+jobs:
+  eval-hydra-jobs:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Install dependencies for Nix setup action
+      run: |
+        apt update -y
+        apt install sudo -y        
+    - uses: cachix/install-nix-action@v27
+    - run: nix eval --no-update-lock-file --accept-flake-config .\#hydraJobs

.gitignore

@@ -3,3 +3,4 @@
 *.log
 result
 *.qcow2
+.direnv/

README.md

@@ -113,6 +113,8 @@ the usage is simple, just run ```grip``` in the same folder as the README.md you
 * [x] malobeo network infrastructure rework
   * [x] request mulvad acc
   * [x] remove freifunk, use openwrt with mulvad configured
+* [ ] evaluate imposing solutions
+    * [ ] pdfarranger
 
 #### external services
 we want to host two services that need a bit more resources, this is a booking system for the room itself and a library system.

flake.lock

@@ -28,16 +28,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1717476296,
-        "narHash": "sha256-ScHe38Tr+TxGURC17kby4mIIxOG3aJvZWXzPM79UnEk=",
+        "lastModified": 1726989464,
+        "narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "095ef64aa3b2ab4a4f1bf07f29997e21e3a5576a",
+        "rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-23.11",
+        "ref": "release-24.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -63,11 +63,11 @@
     },
     "nixlib": {
       "locked": {
-        "lastModified": 1712450863,
-        "narHash": "sha256-K6IkdtMtq9xktmYPj0uaYc8NsIqHuaAoRBaMgu9Fvrw=",
+        "lastModified": 1729386149,
+        "narHash": "sha256-hUP9oxmnOmNnKcDOf5Y55HQ+NnoT0+bLWHLQWLLw9Ks=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "3c62b6a12571c9a7f65ab037173ee153d539905f",
+        "rev": "cce4521b6df014e79a7b7afc58c703ed683c916e",
         "type": "github"
       },
       "original": {
@@ -84,11 +84,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1718025593,
-        "narHash": "sha256-WZ1gdKq/9u1Ns/oXuNsDm+W0salonVA0VY1amw8urJ4=",
+        "lastModified": 1729472750,
+        "narHash": "sha256-s93LPHi5BN7I2xSGNAFWiYb8WRsPvT1LE9ZjZBrpFlg=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "35c20ba421dfa5059e20e0ef2343c875372bdcf3",
+        "rev": "7c60ba4bc8d6aa2ba3e5b0f6ceb9fc07bc261565",
         "type": "github"
       },
       "original": {
@@ -99,11 +99,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1719391814,
-        "narHash": "sha256-zlRvpIUQrxMSOi+1lVFuJNvIJt9LB93c05tYQ1KSdRg=",
+        "lastModified": 1729742320,
+        "narHash": "sha256-u3Of8xRkN//me8PU+RucKA59/6RNy4B2jcGAF36P4jI=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "aab67495e34365045f9dfbe58725cc6fa03607b7",
+        "rev": "e8a2f6d5513fe7b7d15701b2d05404ffdc3b6dda",
         "type": "github"
       },
       "original": {
@@ -131,27 +131,27 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1719099622,
-        "narHash": "sha256-YzJECAxFt+U5LPYf/pCwW/e1iUd2PF21WITHY9B/BAs=",
+        "lastModified": 1729357638,
+        "narHash": "sha256-66RHecx+zohbZwJVEPF7uuwHeqf8rykZTMCTqIrOew4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "5e8e3b89adbd0be63192f6e645e0a54080004924",
+        "rev": "bb8c2cf7ea0dd2e18a52746b2c3a5b0c73b93c22",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "release-23.11",
+        "ref": "release-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1719254875,
-        "narHash": "sha256-ECni+IkwXjusHsm9Sexdtq8weAq/yUyt1TWIemXt3Ko=",
+        "lastModified": 1729665710,
+        "narHash": "sha256-AlcmCXJZPIlO5dmFzV3V2XF6x/OpNWUV8Y/FMPGd8Z4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2893f56de08021cffd9b6b6dfc70fd9ccd51eb60",
+        "rev": "2768c7d042a37de65bb1b5b3268fc987e534c49d",
         "type": "github"
       },
       "original": {
@@ -163,11 +163,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1719253556,
-        "narHash": "sha256-A/76RFUVxZ/7Y8+OMVL1Lc8LRhBxZ8ZE2bpMnvZ1VpY=",
+        "lastModified": 1729449015,
+        "narHash": "sha256-Gf04dXB0n4q0A9G5nTGH3zuMGr6jtJppqdeljxua1fo=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "fc07dc3bdf2956ddd64f24612ea7fc894933eb2e",
+        "rev": "89172919243df199fe237ba0f776c3e3e3d72367",
         "type": "github"
       },
       "original": {
@@ -199,11 +199,11 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1719268571,
-        "narHash": "sha256-pcUk2Fg5vPXLUEnFI97qaB8hto/IToRfqskFqsjvjb8=",
+        "lastModified": 1729695320,
+        "narHash": "sha256-Fm4cGAlaDwekQvYX0e6t0VjT6YJs3fRXtkyuE4/NzzU=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "c2ea1186c0cbfa4d06d406ae50f3e4b085ddc9b3",
+        "rev": "d089e742fb79259b9c4dd9f18e9de1dd4fa3c1ec",
         "type": "github"
       },
       "original": {
@@ -264,11 +264,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1719327780,
-        "narHash": "sha256-dA5mQinY/VKxzhgMz6oPGUXCS660RWAtherW7B0+aAk=",
+        "lastModified": 1729717517,
+        "narHash": "sha256-Gul0Zqy0amouh8Hs8BL/DIKFYD6BmdTo4H8+5K5+mTo=",
         "ref": "refs/heads/master",
-        "rev": "c60fc43f733fb0368529e72f5e07c424b30055fb",
-        "revCount": 15,
+        "rev": "610269a14232c2888289464feb5227e284eef336",
+        "revCount": 27,
         "type": "git",
         "url": "https://git.dynamicdiscord.de/kalipso/tasklist"
       },
@@ -318,11 +318,11 @@
         "systems": "systems_3"
       },
       "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
         "type": "github"
       },
       "original": {

flake.nix

@@ -2,7 +2,6 @@
   description = "malobeo infrastructure";
 
   inputs = {
-    utils.url = "github:numtide/flake-utils";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
@@ -10,6 +9,10 @@
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
     mfsync.url = "github:k4lipso/mfsync";
 
+    utils = {
+      url = "github:numtide/flake-utils";
+    };
+
     tasklist = {
       url = "git+https://git.dynamicdiscord.de/kalipso/tasklist";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -26,7 +29,7 @@
     };
 
     home-manager=  {
-      url = "github:nix-community/home-manager/release-23.11";
+      url = "github:nix-community/home-manager/release-24.05";
       inputs = {
         nixpkgs.follows = "nixpkgs";
       };

machines/configuration.nix

@@ -74,16 +74,4 @@ in
       ./lucia/hardware_configuration.nix
     ];
   };
-
-  sdImageLucia = nixosSystem {
-    system = "aarch64-linux";
-    specialArgs.inputs = inputs;
-    modules = defaultModules ++ [
-      "${nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix"
-      ./lucia/configuration.nix
-      {
-        sdImage.compressImage = false;
-      }
-    ];
-  };
 }

machines/durruti/configuration.nix

@@ -4,8 +4,6 @@ with lib;
 
 {
   sops.defaultSopsFile = ./secrets.yaml;
-  sops.secrets.ep3bsDb = {};
-  sops.secrets.ep3bsMail = {};
 
   boot.isContainer = true;
   networking = {
@@ -28,8 +26,17 @@ with lib;
     ../modules/malobeo_user.nix
     ../modules/sshd.nix
     ../modules/minimal_tools.nix
+    ../modules/autoupdate.nix
   ];
 
+  malobeo.autoUpdate = {
+    enable = true;
+    url = "https://hydra.dynamicdiscord.de";
+    project = "malobeo";
+    jobset = "infrastructure";
+    cacheurl = "https://cache.dynamicdiscord.de";
+  };
+
   services.malobeo-tasklist.enable = true;
 
   services.ep3-bs = {
@@ -54,6 +61,17 @@ with lib;
     };
   };
 
+  sops.secrets.ep3bsDb = {
+    owner = config.services.ep3-bs.user;
+    key = "ep3bsDb";
+  };
+
+  sops.secrets.ep3bsMail = {
+    owner = config.services.ep3-bs.user;
+    key = "ep3bsMail";
+  };
+
+
   system.stateVersion = "22.11"; # Did you read the comment?
 }
 

machines/louise/configuration.nix

@@ -8,8 +8,17 @@
       ../modules/malobeo_user.nix
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
+      ../modules/autoupdate.nix
     ];
 
+  malobeo.autoUpdate = {
+    enable = true;
+    url = "https://hydra.dynamicdiscord.de";
+    project = "malobeo";
+    jobset = "infrastructure";
+    cacheurl = "https://cache.dynamicdiscord.de";
+  };
+
   boot.loader.systemd-boot.enable = true;
 
   hardware.sane.enable = true; #scanner support
@@ -43,8 +52,16 @@
   services.printing.enable = true;
   services.printing.drivers = [
     (pkgs.writeTextDir "share/cups/model/brother5350.ppd" (builtins.readFile ../modules/BR5350_2_GPL.ppd))
+    pkgs.gutenprint
+    pkgs.gutenprintBin
+    pkgs.brlaser
+    pkgs.brgenml1lpr 
+    pkgs.brgenml1cupswrapper
   ];
 
+  # needed for printing drivers
+  nixpkgs.config.allowUnfree = true; 
+
   services.acpid.enable = true;
 
   networking.hostName = "louise";

machines/lucia/configuration.nix

@@ -7,6 +7,7 @@ in
   imports =
     [ # Include the results of the hardware scan.
       ../modules/malobeo_user.nix
+      ./file_server.nix
     ];
 
   sops.defaultSopsFile = ./secrets.yaml;
@@ -173,7 +174,7 @@ in
     mpv
     ncmpcpp
     ncpamixer
-    pulseaudio
+    # pulseaudio
     vim
     htop
     wget
@@ -182,19 +183,19 @@ in
     nix-tree
   ];
 
-  hardware.pulseaudio = {
-    enable = true;
-    systemWide = true;
-    tcp = {
-      enable = true;
-      anonymousClients.allowedIpRanges = [
-        "127.0.0.0/8"
-        "192.168.1.0/24"
-      ];
-    };
+  #hardware.pulseaudio = {
+  #  enable = true;
+  #  systemWide = true;
+  #  tcp = {
+  #    enable = true;
+  #    anonymousClients.allowedIpRanges = [
+  #      "127.0.0.0/8"
+  #      "192.168.1.0/24"
+  #    ];
+  #  };
 
-    zeroconf.publish.enable = true;
-  };
+  #  zeroconf.publish.enable = true;
+  #};
 
   services.avahi = {
     enable = true;

machines/lucia/file_server.nix

@@ -0,0 +1,36 @@
+{
+  #automount mit udisks2
+    #siehe udevadm monitor
+    #bash-script?
+    #user-oder root mount
+  #systemd-automount villeicht
+    fileSystems = {
+      "/mnt/extHdd0" = {               #statisches mounten ist am einfachsten aber kein hotplug möglich
+        device = "/dev/disk/by-uuid/"; #noch ausfüllen
+        fsType = "ext4";               #zfs wäre hier cool
+        options = [ "users" "nofail" ];
+      };
+      "/exports/extHdd0" = {
+        device = "/mnt/extHdd0";
+        fsType = "none";
+      };
+    };
+
+    users.groups = { nfs = {gid = 1003; }; }; #erstelle nfs user und gruppe für isolation
+    users.users.nfs = {
+      isSystemUser = true;
+      group = "nfs";
+      uid = 1003;
+    };
+    users.users.malobeo.extraGroups = [ "nfs" ];
+    
+    systemd.tmpfiles.rules = [ "d /export 0775 nfs nfs -" ]; #erstelle nfs ordner
+
+    services.nfs.server = {
+      enable = true;
+      exports = ''
+        /export 192.168.1.0/24(ro, nohide, no_subtree_check, async, all_squash, anonuid=1003, anongid=1003)
+      '';
+    };
+    networking.firewall.allowedTCPPorts = [ 2049 ]; #wir benutzen NfsV4 hoffentlich
+}

machines/modules/autoupdate.nix

@@ -0,0 +1,139 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+  cfg = config.malobeo.autoUpdate;
+in
+{
+  options.malobeo.autoUpdate = {
+    enable = mkOption {
+      description = ''
+        Enables a timer that periodically checks a hydra instance for the last build of the local system, and switches to it if it is different.
+  
+        Also enables periodical /nix/store GC.
+      '';
+      type = types.bool;
+      default = false;
+    };
+
+    # https://hydra.dynamicdiscord.de/job/malobeo/infrastructure/louise/latest
+    url = mkOption {
+      description = lib.mdDoc ''
+        Url to your hydra instace. like https://hydra.example.de
+      '';
+      type = types.str;
+      default = "";
+    };
+
+    project = mkOption {
+      description = lib.mdDoc ''
+        Name of the project at the hydra instace
+      '';
+      type = types.str;
+      default = "";
+    };
+
+    jobset = mkOption {
+      description = lib.mdDoc ''
+        Name of the jobset at the hydra instace
+      '';
+      type = types.str;
+      default = "";
+    };
+
+    cacheurl = mkOption {
+      description = lib.mdDoc ''
+        Url of the binary cache
+      '';
+      type = types.str;
+      default = cfg.url;
+    };
+  };
+
+  config = {
+    # the presence of this .service file signifies that the system is
+    # autoupdate-enabled. it is checked to prevent autoupdating back
+    # to a system without autoupdate when deploying with autoupdate
+    # for the first time.
+    systemd.services.autoupdate = lib.mkIf config.malobeo.autoUpdate.enable {
+      wantedBy = [ "multi-user.target" ];
+      path = with pkgs; [ nix nettools curl jq ];
+      serviceConfig = {
+        Type = "oneshot";
+        # switch-to-configuration may not return. HACK: cap running
+        # time so that the timer can be scheduled again.
+        TimeoutStartSec = "30min";
+      };
+      script = ''
+        OLD=$(readlink /run/current-system)
+        echo Current system: $(basename $OLD)
+        NEW=$(curl -sLH "Accept: application/json" ${cfg.url}/job/${cfg.project}/${cfg.jobset}/${config.networking.hostName}/latest | jq -er .buildoutputs.out.path)
+        if [ -z "$NEW" ] || [ "$NEW" = "null" ]; then
+          echo "Unable to obtain updated system"
+          exit 1
+        fi
+        echo New system: $(basename $NEW)
+
+        if [ "$OLD" != "$NEW" ]; then
+          echo "Fetching new system built by ${cfg.url}/job/${cfg.project}/${cfg.jobset}"
+          # this should fetch the new system from the binary cache
+          nix copy --from ${cfg.cacheurl} "$NEW"
+          if [ -e "$NEW/etc/systemd/system/autoupdate.timer" ]; then
+            echo "Switch to the new system..."
+            nix-env -p /nix/var/nix/profiles/system --set $NEW
+            "$NEW/bin/switch-to-configuration" switch
+          else
+            echo "New system is not yet autoupdate-enabled. Refusing to switch into a dead end."
+          fi
+        else
+          echo "No update required"
+        fi
+      '';
+      # don't let the switch kill this service, aborting the switch
+      restartIfChanged = false;
+      unitConfig.X-StopOnRemoval = false;
+      # create timer
+      startAt = "hourly";
+    };
+
+    nix = {
+      # Show a diff when activating a new system except for microvms which handle this seperately
+      #diffSystem = config.malobeo.deployment.server or "" == "";
+      #TODO: THIS WIPES HOSTS NIX STORE FROM WITHIN NIXOS-CONTAINER
+      #gc = lib.mkIf config.malobeo.autoUpdate.enable {
+      #  automatic = true;
+      #  randomizedDelaySec = "6h";
+      #  options = "--delete-older-than 21d";
+      #};
+    };
+
+    environment.systemPackages = [ (
+      # Provide a manual updating script that fetches the latest
+      # updated+built system from Hydra
+      pkgs.writeScriptBin "update-from-hydra" ''
+        #! ${pkgs.runtimeShell} -e
+
+        OLD=$(readlink /run/current-system)
+        echo Current system: $(basename $OLD)
+        NEW=$(curl -sLH "Accept: application/json" ${cfg.url}/job/${cfg.project}/${cfg.jobset}/${config.networking.hostName}/latest | ${pkgs.jq}/bin/jq -er .buildoutputs.out.path)
+        if [ -z "$NEW" ] || [ "$NEW" = "null" ]; then
+          echo "Unable to obtain updated system"
+          exit 1
+        fi
+        echo New system: $(basename $NEW)
+
+        if [ "$OLD" != "$NEW" ]; then
+          echo "Fetching new system built by ${cfg.url}/job/${cfg.project}/${cfg.jobset}"
+          # this should fetch the new system from the binary cache
+          nix copy --from ${cfg.cacheurl} "$NEW"
+          echo "Switch to the new system..."
+          nix-env -p /nix/var/nix/profiles/system --set $NEW
+          "$NEW/bin/switch-to-configuration" switch
+        else
+          echo "No update required"
+        fi
+      ''
+    ) ];
+  };
+}

outputs.nix

@@ -36,26 +36,4 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
       nixpkgs.lib.mapAttrs getBuildEntry self.nixosConfigurations
 
       );
-
-      #lucia = self.nixosConfigurations.lucia.config.system.build.toplevel;
-    
-
-    #images.lucia_base_image = nixosConfigurations.lucia.config.system.build.sdImage;
-
-    #packages.x86_64-linux = {
-    #  lucia_base_img = nixos-generators.nixosGenerate {
-    #    system = "aarch64-linux";
-    #    modules = [
-    #      #"${nixpkgs}/nixos/modules/installer/sd-card/sd-image-raspberrypi.nix"
-    #      ./machines/modules/sshd.nix
-    #      {
-    #        nixpkgs.config.allowUnsupportedSystem = true;
-    #        nixpkgs.crossSystem.system = "aarch64-linux";
-    #        networking.dhcpcd.enable = true;
-    #      }
-    #    ];
-
-    #    format = "sd-aarch64-installer";
-    #  };
-    #};
 }