📦 package updates

NOTE: maybe just remove it?

.envrc

@@ -1 +1 @@
-use nix
+use flake

.gitignore

@@ -0,0 +1,7 @@
+/.direnv
+/result
+/.pre-commit-config.yaml
+/node_modules/
+.terraform
+*.tfvars
+*.tfstate*

.sops.yaml

@@ -1,17 +1,19 @@
 keys:
   - &walkah age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
   - &plato age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
-  - &agent age1vc8svd5277rjkgzg7frf04uaa45w3crhfvg628rqyrqmxul3q9nsjz6yxk
-  - &form age1ulmzprdmcd8r0w47a0nrrlg8melkjk6evl2rc54yh6lxkcfas36q6wrsv9
-  - &matter age1lfjkch3pqaq3uwmjxyucpm2tws6llxqqjglj4yn49jkwkf50xvmqrl974e
-  - &purpose age1jnf94uq5ap96vk7nfk3qkr38ylhletc6pskj0ypc470d7gmt0qeqskdy5z
+  - &agent age1pn2hnqvgt7rvfglxddlj3jwrm79rvmutmexkpxv4frdnznlel33qvfy6u5
+  - &form age1mnrl9u8vpdjncge33pg7quakl0qdf5dlfgch87jhrs0wrvup4s0s5xh7ly
+  - &matter age1tt0gwcm03zmpelerpph49knn8f6t8z7aq9una2qys76kf4rwxpnquxkvz3
+  - &purpose age1px55dk5n3whfdyshzyxqmyjvqdmv9au6myx6w67jw3cqp9sdx9rsa6xep9
+  - &socrates age12wakcnv487c5rkgv7z6umzywrqwcy6dgguq0dug6lxp64scjsq6sspkmgz
 creation_rules:
   - path_regex: secrets/[^/]+\.yaml$
     key_groups:
-    - age:
-      - *walkah
-      - *plato
-      - *agent
-      - *form
-      - *matter
-      - *purpose
+      - age:
+          - *walkah
+          - *plato
+          - *agent
+          - *form
+          - *matter
+          - *purpose
+          - *socrates

default.nix

@@ -0,0 +1,14 @@
+(import
+  (
+    let
+      lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+    in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  {
+    src = ./.;
+  }
+).defaultNix

flake.lock

@@ -0,0 +1,418 @@
+{
+  "nodes": {
+    "darwin": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764161084,
+        "narHash": "sha256-HN84sByg9FhJnojkGGDSrcjcbeioFWoNXfuyYfJ1kBE=",
+        "owner": "nix-darwin",
+        "repo": "nix-darwin",
+        "rev": "e95de00a471d07435e0527ff4db092c84998698e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-darwin",
+        "ref": "master",
+        "repo": "nix-darwin",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "pre-commit-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "home-manager": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764603455,
+        "narHash": "sha256-Q70rxlbrxPcTtqWIb9+71rkJESxIOou5isZBvyOieXw=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "effe4c007d6243d9e69ce2242d76a2471c1b8d5c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "libcamera-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1725630279,
+        "narHash": "sha256-KH30jmHfxXq4j2CL7kv18DYECJRp9ECuWNPnqPZajPA=",
+        "owner": "raspberrypi",
+        "repo": "libcamera",
+        "rev": "69a894c4adad524d3063dd027f5c4774485cf9db",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "repo": "libcamera",
+        "rev": "69a894c4adad524d3063dd027f5c4774485cf9db",
+        "type": "github"
+      }
+    },
+    "libpisp-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1724944683,
+        "narHash": "sha256-Fo2UJmQHS855YSSKKmGrsQnJzXog1cdpkIOO72yYAM4=",
+        "owner": "raspberrypi",
+        "repo": "libpisp",
+        "rev": "28196ed6edcfeda88d23cc5f213d51aa6fa17bb3",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "v1.0.7",
+        "repo": "libpisp",
+        "type": "github"
+      }
+    },
+    "nixlib": {
+      "locked": {
+        "lastModified": 1736643958,
+        "narHash": "sha256-tmpqTSWVRJVhpvfSN9KXBvKEXplrwKnSZNAoNPf/S/s=",
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "rev": "1418bc28a52126761c02dd3d89b2d8ca0f521181",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixpkgs.lib",
+        "type": "github"
+      }
+    },
+    "nixos-generators": {
+      "inputs": {
+        "nixlib": "nixlib",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764234087,
+        "narHash": "sha256-NHF7QWa0ZPT8hsJrvijREW3+nifmF2rTXgS2v0tpcEA=",
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "rev": "032a1878682fafe829edfcf5fdfad635a2efe748",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-generators",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1764587062,
+        "narHash": "sha256-hdFa0TAVQAQLDF31cEW3enWmBP+b592OvHs6WVe3D8k=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "c1cb7d097cb250f6e1904aacd5f2ba5ffd8a49ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1736061677,
+        "narHash": "sha256-DjkQPnkAfd7eB522PwnkGhOMuT9QVCZspDpJJYyOj60=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "cbd8ec4de4469333c82ff40d057350c30e9f7d36",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pre-commit-hooks": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "gitignore": "gitignore",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1763988335,
+        "narHash": "sha256-QlcnByMc8KBjpU37rbq5iP7Cp97HvjRP0ucfdh+M4Qc=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "50b9238891e388c9fdc6a5c49e49c42533a1b5ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "raspberry-pi-nix": {
+      "inputs": {
+        "libcamera-src": "libcamera-src",
+        "libpisp-src": "libpisp-src",
+        "nixpkgs": "nixpkgs_2",
+        "rpi-bluez-firmware-src": "rpi-bluez-firmware-src",
+        "rpi-firmware-nonfree-src": "rpi-firmware-nonfree-src",
+        "rpi-firmware-src": "rpi-firmware-src",
+        "rpi-linux-6_12_17-src": "rpi-linux-6_12_17-src",
+        "rpi-linux-6_6_78-src": "rpi-linux-6_6_78-src",
+        "rpi-linux-stable-src": "rpi-linux-stable-src",
+        "rpicam-apps-src": "rpicam-apps-src"
+      },
+      "locked": {
+        "lastModified": 1742223591,
+        "narHash": "sha256-ZNTz8r5jlJ1jvpqf5+aUYgpnYJSVX0iP14doOc1Hm0E=",
+        "owner": "nix-community",
+        "repo": "raspberry-pi-nix",
+        "rev": "3e8100d5e976a6a2be363015cb33463af9ef441a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "raspberry-pi-nix",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "darwin": "darwin",
+        "flake-compat": "flake-compat",
+        "home-manager": "home-manager",
+        "nixos-generators": "nixos-generators",
+        "nixpkgs": "nixpkgs",
+        "pre-commit-hooks": "pre-commit-hooks",
+        "raspberry-pi-nix": "raspberry-pi-nix",
+        "sops-nix": "sops-nix",
+        "systems": "systems"
+      }
+    },
+    "rpi-bluez-firmware-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1708969706,
+        "narHash": "sha256-KakKnOBeWxh0exu44beZ7cbr5ni4RA9vkWYb9sGMb8Q=",
+        "owner": "RPi-Distro",
+        "repo": "bluez-firmware",
+        "rev": "78d6a07730e2d20c035899521ab67726dc028e1c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "RPi-Distro",
+        "ref": "bookworm",
+        "repo": "bluez-firmware",
+        "type": "github"
+      }
+    },
+    "rpi-firmware-nonfree-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1723266537,
+        "narHash": "sha256-T7eTKXqY9cxEMdab8Snda4CEOrEihy5uOhA6Fy+Mhnw=",
+        "owner": "RPi-Distro",
+        "repo": "firmware-nonfree",
+        "rev": "4b356e134e8333d073bd3802d767a825adec3807",
+        "type": "github"
+      },
+      "original": {
+        "owner": "RPi-Distro",
+        "ref": "bookworm",
+        "repo": "firmware-nonfree",
+        "type": "github"
+      }
+    },
+    "rpi-firmware-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1728405098,
+        "narHash": "sha256-4gnK0KbqFnjBmWia9Jt2gveVWftmHrprpwBqYVqE/k0=",
+        "owner": "raspberrypi",
+        "repo": "firmware",
+        "rev": "7bbb5f80d20a2335066a8781459c9f33e5eebc64",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "1.20241008",
+        "repo": "firmware",
+        "type": "github"
+      }
+    },
+    "rpi-linux-6_12_17-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1740765145,
+        "narHash": "sha256-hoCsGc4+RC/2LmxDtswLBL5ZhWlw4vSiL4Vkl39r2MU=",
+        "owner": "raspberrypi",
+        "repo": "linux",
+        "rev": "5985ce32e511f4e8279a841a1b06a8c7d972b386",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "rpi-6.12.y",
+        "repo": "linux",
+        "type": "github"
+      }
+    },
+    "rpi-linux-6_6_78-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1740503700,
+        "narHash": "sha256-Y8+ot4Yi3UKwlZK3ap15rZZ16VZDvmeFkD46+6Ku7bE=",
+        "owner": "raspberrypi",
+        "repo": "linux",
+        "rev": "2e071057fded90e789c0101498e45a1778be93fe",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "rpi-6.6.y",
+        "repo": "linux",
+        "type": "github"
+      }
+    },
+    "rpi-linux-stable-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1728403745,
+        "narHash": "sha256-phCxkuO+jUGZkfzSrBq6yErQeO2Td+inIGHxctXbD5U=",
+        "owner": "raspberrypi",
+        "repo": "linux",
+        "rev": "5aeecea9f4a45248bcf564dec924965e066a7bfd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "stable_20241008",
+        "repo": "linux",
+        "type": "github"
+      }
+    },
+    "rpicam-apps-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1727515047,
+        "narHash": "sha256-qCYGrcibOeGztxf+sd44lD6VAOGoUNwRqZDdAmcTa/U=",
+        "owner": "raspberrypi",
+        "repo": "rpicam-apps",
+        "rev": "a8ccf9f3cd9df49875dfb834a2b490d41d226031",
+        "type": "github"
+      },
+      "original": {
+        "owner": "raspberrypi",
+        "ref": "v1.5.2",
+        "repo": "rpicam-apps",
+        "type": "github"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1764483358,
+        "narHash": "sha256-EyyvCzXoHrbL467YSsQBTWWg4sR96MH1sPpKoSOelB4=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "5aca6ff67264321d47856a2ed183729271107c9c",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,85 @@
+{
+  description = "walkah's little city state";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
+    systems.url = "github:nix-systems/default";
+    raspberry-pi-nix.url = "github:nix-community/raspberry-pi-nix";
+
+    darwin = {
+      url = "github:nix-darwin/nix-darwin/master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    flake-compat = {
+      url = "github:edolstra/flake-compat";
+      flake = false;
+    };
+
+    nixos-generators = {
+      url = "github:nix-community/nixos-generators";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    pre-commit-hooks = {
+      url = "github:cachix/git-hooks.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      self,
+      nixpkgs,
+      pre-commit-hooks,
+      systems,
+      ...
+    }@inputs:
+    let
+      forAllSystems =
+        fn: nixpkgs.lib.genAttrs (import systems) (system: fn system nixpkgs.legacyPackages.${system});
+    in
+    {
+      checks = forAllSystems (
+        system: pkgs:
+        import ./nix/checks.nix {
+          inherit
+            self
+            pkgs
+            pre-commit-hooks
+            system
+            ;
+        }
+      );
+      devShells = forAllSystems (system: pkgs: import ./nix/shells.nix { inherit self pkgs system; });
+      formatter = forAllSystems (_: pkgs: pkgs.nixfmt-tree);
+    }
+    // {
+      hosts = import ./nix/hosts.nix;
+      overlays.default = nixpkgs.lib.composeManyExtensions [ ];
+
+      darwinConfigurations = import ./nix/darwin.nix inputs;
+      nixosConfigurations = import ./nix/nixos.nix inputs;
+
+      nixConfig = {
+        extra-substituters = [
+          "https://walkah.cachix.org"
+          "https://nix-community.cachix.org"
+        ];
+        extra-trusted-public-keys = [
+          "walkah.cachix.org-1:D8cO78JoJC6UPV1ZMgd1V5znpk3jNUERGIeAKN15hxo="
+          "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        ];
+      };
+    };
+}

hosts/aristotle/configuration.nix

@@ -1,68 +0,0 @@
-{ config, pkgs, ... }:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ./rpi-poe.nix
-
-    ../../modules/ipfs/cluster.nix
-    ../../modules/sops
-  ];
-
-  nixpkgs.overlays = [ (import ../../overlays) ];
-
-  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
-  boot.loader.grub.enable = false;
-  # Enables the generation of /boot/extlinux/extlinux.conf
-  boot.loader.generic-extlinux-compatible.enable = false;
-
-  boot.kernelPackages = pkgs.linuxPackages_rpi4;
-  boot.loader.raspberryPi = {
-    enable = true;
-    version = 4;
-  };
-
-  # networking.hostName = "nixos"; # Define your hostname.
-  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-
-  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
-  # Per-interface useDHCP will be mandatory in the future, so this generated config
-  # replicates the default behaviour.
-  networking.useDHCP = false;
-  networking.interfaces.eth0.useDHCP = true;
-  networking.interfaces.wlan0.useDHCP = true;
-  networking.firewall.enable = false;
-
-  # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
-  ];
-
-  environment.systemPackages = with pkgs; [ libraspberrypi ];
-
-  services = {
-    prometheus = {
-      enable = true;
-      port = 9090;
-      exporters = {
-        node = {
-          enable = true;
-          enabledCollectors = [ "systemd" ];
-          openFirewall = true;
-          port = 9100;
-        };
-      };
-    };
-    tailscale = { enable = true; };
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.03"; # Did you read the comment?
-}

hosts/aristotle/rpi-poe.nix

@@ -1,109 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  hardware = {
-    deviceTree = {
-      filter = "bcm2711-rpi-*.dtb";
-      overlays = [{
-        name = "rpi-poe";
-        dtsText = ''
-          /*
-           * Overlay for the Raspberry Pi POE HAT.
-           */
-          /dts-v1/;
-          /plugin/;
-
-          / {
-            compatible = "brcm,bcm2711";
-
-          	fragment@0 {
-          		target-path = "/";
-          		__overlay__ {
-          			fan0: rpi-poe-fan@0 {
-          				compatible = "raspberrypi,rpi-poe-fan";
-          				firmware = <&firmware>;
-          				cooling-min-state = <0>;
-          				cooling-max-state = <4>;
-          				#cooling-cells = <2>;
-          				cooling-levels = <0 1 10 100 255>;
-          				status = "okay";
-          			};
-          		};
-          	};
-
-          	fragment@1 {
-          		target = <&cpu_thermal>;
-          		__overlay__ {
-          			trips {
-          				trip0: trip0 {
-          					temperature = <40000>;
-          					hysteresis = <2000>;
-          					type = "active";
-          				};
-          				trip1: trip1 {
-          					temperature = <45000>;
-          					hysteresis = <2000>;
-          					type = "active";
-          				};
-          				trip2: trip2 {
-          					temperature = <50000>;
-          					hysteresis = <2000>;
-          					type = "active";
-          				};
-          				trip3: trip3 {
-          					temperature = <55000>;
-          					hysteresis = <5000>;
-          					type = "active";
-          				};
-          			};
-          			cooling-maps {
-          				map0 {
-          					trip = <&trip0>;
-          					cooling-device = <&fan0 0 1>;
-          				};
-          				map1 {
-          					trip = <&trip1>;
-          					cooling-device = <&fan0 1 2>;
-          				};
-          				map2 {
-          					trip = <&trip2>;
-          					cooling-device = <&fan0 2 3>;
-          				};
-          				map3 {
-          					trip = <&trip3>;
-          					cooling-device = <&fan0 3 4>;
-          				};
-          			};
-          		};
-          	};
-
-          	fragment@2 {
-          		target-path = "/__overrides__";
-          		__overlay__ {
-          			poe_fan_temp0 =		<&trip0>,"temperature:0";
-          			poe_fan_temp0_hyst =	<&trip0>,"hysteresis:0";
-          			poe_fan_temp1 =		<&trip1>,"temperature:0";
-          			poe_fan_temp1_hyst =	<&trip1>,"hysteresis:0";
-          			poe_fan_temp2 =		<&trip2>,"temperature:0";
-          			poe_fan_temp2_hyst =	<&trip2>,"hysteresis:0";
-          			poe_fan_temp3 =		<&trip3>,"temperature:0";
-          			poe_fan_temp3_hyst =	<&trip3>,"hysteresis:0";
-          		};
-          	};
-
-          	__overrides__ {
-          		poe_fan_temp0 =		<&trip0>,"temperature:0";
-          		poe_fan_temp0_hyst =	<&trip0>,"hysteresis:0";
-          		poe_fan_temp1 =		<&trip1>,"temperature:0";
-          		poe_fan_temp1_hyst =	<&trip1>,"hysteresis:0";
-          		poe_fan_temp2 =		<&trip2>,"temperature:0";
-          		poe_fan_temp2_hyst =	<&trip2>,"hysteresis:0";
-          		poe_fan_temp3 =		<&trip3>,"temperature:0";
-          		poe_fan_temp3_hyst =	<&trip3>,"hysteresis:0";
-          	};
-          };
-        '';
-      }];
-    };
-  };
-}

hosts/epicurus/darwin-configuration.nix

@@ -1,66 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  dotfiles = builtins.fetchTarball
-    "https://github.com/walkah/dotfiles/archive/main.tar.gz";
-
-in
-{
-  imports = [
-    <home-manager/nix-darwin>
-    ./homebrew.nix
-    ../../modules/builder
-  ];
-
-  # List packages installed in system profile. To search by name, run:
-  # $ nix-env -qaP | grep wget
-  environment.systemPackages = with pkgs; [ emacs-nox vim ghc go gopls niv rustup stack ];
-
-  # Use a custom configuration.nix location.
-  # $ darwin-rebuild switch -I darwin-config=$HOME/.config/nixpkgs/darwin/configuration.nix
-  # environment.darwinConfig = "$HOME/.config/nixpkgs/darwin/configuration.nix";
-
-  # Auto upgrade nix package and the daemon service.
-  services.nix-daemon.enable = true;
-
-  users.nix.configureBuildUsers = true;
-  users.users.walkah = {
-    home = "/Users/walkah";
-    shell = pkgs.zsh;
-  };
-
-  home-manager.users.walkah = import "${dotfiles}/home.nix";
-
-  nix = {
-    package = pkgs.nix;
-
-    trustedUsers = [ "root" "@wheel" ];
-
-    extraOptions = ''
-      extra-platforms = x86_64-darwin aarch64-darwin
-      experimental-features = nix-command flakes
-    '';
-  };
-
-  nixpkgs.config.packageOverrides = pkgs: {
-    haskellPackages = pkgs.haskellPackages.override {
-      overrides = self: super: {
-        niv = pkgs.haskell.lib.overrideCabal super.niv (drv: {
-          enableSeparateBinOutput = false;
-        });
-      };
-    };
-  };
-
-  services.lorri.enable = true;
-
-  programs = {
-    zsh = {
-      enable = true;
-      promptInit = "";
-    };
-  };
-
-  # Used for backwards compatibility, please read the changelog before changing.
-  # $ darwin-rebuild changelog
-  system.stateVersion = 4;
-}

hosts/epicurus/homebrew.nix

@@ -1,45 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  homebrew = {
-    enable = true;
-    brewPrefix = "/opt/homebrew/bin";
-    autoUpdate = true;
-    cleanup = "zap";
-    global = {
-      brewfile = true;
-      noLock = true;
-    };
-
-    taps = [
-      "homebrew/cask"
-      "homebrew/cask-drivers"
-      "homebrew/cask-fonts"
-      "homebrew/services"
-    ];
-
-    brews = [ "code-server" "coreutils" "mosh" ];
-
-    casks = [
-      "1password"
-      "alfred"
-      "docker"
-      "font-jetbrains-mono"
-      "font-jetbrains-mono-nerd-font"
-      "gpg-suite"
-      "ipfs"
-      "keybase"
-      "plex-media-server"
-      "stats"
-      "syncthing"
-      "synology-drive"
-    ];
-
-    masApps = {
-      Bumpr = 1166066070;
-      Magnet = 441258766;
-      Tailscale = 1475387142;
-      Xcode = 497799835;
-    };
-  };
-}

hosts/plato/configuration.nix

@@ -1,169 +0,0 @@
-{ config, pkgs, ... }:
-
-let
-  dotfiles = builtins.fetchTarball
-    "https://github.com/walkah/dotfiles/archive/main.tar.gz";
-in
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    <home-manager/nixos>
-
-    ../../modules/coredns
-    ../../modules/code-server
-    ../../modules/gitea
-    ../../modules/home-assistant
-    ../../modules/matrix
-    ../../modules/sops
-  ];
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.cleanTmpDir = true;
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.overlays = [ (import ../../overlays) ];
-
-  # Set your time zone.
-  time.timeZone = "America/Toronto";
-
-  networking.hostName = "plato"; # Define your hostname.
-  networking.useDHCP = false;
-  networking.interfaces.enp10s0.useDHCP = true;
-  networking.interfaces.enp9s0.useDHCP = true;
-
-  security.sudo.wheelNeedsPassword = false;
-
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC5spf4diguK+w7iYLFr565++6DjHukWfvpN2ru9dCRk nixbuild"
-  ];
-  users.users.walkah = {
-    isNormalUser = true;
-    extraGroups = [ "wheel" "docker" ];
-    shell = pkgs.zsh;
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM8YMax7PGIrcPNIHkpuNRFgn3HJK6Wepm+ycZWO6jfR walkah@walkah-ipadpro11"
-    ];
-  };
-  home-manager.users.walkah = import "${dotfiles}/home.nix";
-
-  system.autoUpgrade.enable = false;
-  environment.systemPackages = with pkgs; [ docker-compose pinentry weechat ];
-
-  fileSystems."/mnt/downloads" = {
-    device = "192.168.6.100:/volume1/Downloads";
-    fsType = "nfs";
-  };
-  fileSystems."/mnt/music" = {
-    device = "192.168.6.100:/volume1/Music";
-    fsType = "nfs";
-  };
-  fileSystems."/mnt/video" = {
-    device = "192.168.6.100:/volume1/Video";
-    fsType = "nfs";
-  };
-
-  power.ups = {
-    enable = true;
-    mode = "standalone";
-    ups."cyberpower" = {
-      description = "Cyberpower EC650LCD";
-      driver = "usbhid-ups";
-      port = "auto";
-    };
-  };
-
-  programs.mosh.enable = true;
-  programs.zsh = {
-    enable = true;
-    promptInit = "";
-  };
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-    pinentryFlavor = "curses";
-  };
-
-  # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
-
-  services.tailscale.enable = true;
-  services.keybase.enable = true;
-
-  virtualisation.docker = {
-    enable = true;
-    # Clean docker images periodically
-    autoPrune = {
-      enable = true;
-      flags = [ "--all" ];
-    };
-  };
-
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  networking.firewall.enable = false;
-
-  walkah.coredns = { enable = true; };
-
-  services = {
-    grafana = {
-      enable = true;
-      domain = "plato.walkah.lab";
-      port = 2342;
-      addr = "0.0.0.0";
-    };
-    prometheus = {
-      enable = true;
-      port = 9090;
-      exporters = {
-        node = {
-          enable = true;
-          enabledCollectors = [ "systemd" ];
-          port = 9100;
-        };
-      };
-
-      scrapeConfigs = [
-        {
-          job_name = "node";
-          static_configs = [{
-            targets = [
-              "plato:9100"
-              "agent:9100"
-              "form:9100"
-              "matter:9100"
-              "purpose:9100"
-              "socrates:9100"
-            ];
-          }];
-        }
-        {
-          job_name = "coredns";
-          static_configs = [{ targets = [ "plato:9153" ]; }];
-        }
-        {
-          job_name = "ipfs";
-          metrics_path = "/debug/metrics/prometheus";
-          static_configs = [{
-            targets = [ "agent:5001" "form:5001" "matter:5001" "purpose:5001" ];
-          }];
-        }
-      ];
-    };
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "20.09"; # Did you read the comment?
-}

hosts/plato/hardware-configuration.nix

@@ -1,37 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules = [
-    "uhci_hcd"
-    "ehci_pci"
-    "ahci"
-    "xhci_pci"
-    "firewire_ohci"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" "wl" ];
-  boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/ea3c68ac-e822-4b71-a8f5-65d9e452a3c2";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/FB06-AB48";
-    fsType = "vfat";
-  };
-
-  swapDevices =
-    [{ device = "/dev/disk/by-uuid/3a812874-3def-4e46-b20d-cd55fa7bdd5f"; }];
-
-}

hosts/socrates/configuration.nix

@@ -1,89 +0,0 @@
-{ pkgs, ... }:
-
-let
-  dotfiles = builtins.fetchTarball
-    "https://github.com/walkah/dotfiles/archive/main.tar.gz";
-in {
-  imports = [
-    ./hardware-configuration.nix
-    ./networking.nix # generated at runtime by nixos-infect
-    <home-manager/nixos>
-
-    ../../modules/coredns
-    ../../modules/code-server/nginx.nix
-    ../../modules/gitea/nginx.nix
-    ../../modules/home-assistant/nginx.nix
-    ../../modules/ipfs/gateway.nix
-    ../../modules/matrix/nginx.nix
-  ];
-
-  nixpkgs.overlays = [ (import ../../overlays) ];
-
-  boot.cleanTmpDir = true;
-
-  # Set your time zone.
-  time.timeZone = "America/Toronto";
-
-  networking.hostName = "socrates";
-  networking.firewall.allowPing = true;
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-  networking.firewall.trustedInterfaces = [ "tailscale0" ];
-
-  security.sudo.wheelNeedsPassword = false;
-
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
-  ];
-  users.users = {
-    walkah = {
-      extraGroups = [ "wheel" "docker" ];
-      isNormalUser = true;
-      shell = pkgs.zsh;
-      openssh.authorizedKeys.keys = [
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM8YMax7PGIrcPNIHkpuNRFgn3HJK6Wepm+ycZWO6jfR walkah@walkah-ipadpro11"
-      ];
-    };
-  };
-  home-manager.users.walkah = import "${dotfiles}/home.nix";
-
-  system.autoUpgrade.enable = false;
-  environment.systemPackages = with pkgs; [ ];
-
-  programs.mosh.enable = true;
-  programs.zsh.enable = true;
-
-  security.acme.acceptTerms = true;
-  security.acme.defaults.email = "walkah@walkah.net";
-
-  walkah.coredns = {
-    enable = true;
-    addr = "100.103.57.96";
-  };
-
-  services = {
-    nginx = {
-      enable = true;
-      recommendedTlsSettings = true;
-      recommendedOptimisation = true;
-      recommendedGzipSettings = true;
-      recommendedProxySettings = true;
-    };
-    openssh = { enable = true; };
-    prometheus = {
-      enable = true;
-      port = 9090;
-      listenAddress = "100.103.57.96";
-      exporters = {
-        node = {
-          enable = true;
-          enabledCollectors = [ "systemd" ];
-          openFirewall = true;
-          port = 9100;
-          listenAddress = "100.103.57.96";
-        };
-      };
-    };
-    tailscale = { enable = true; };
-  };
-}

hosts/socrates/hardware-configuration.nix

@@ -1,6 +0,0 @@
-{ ... }:
-{
-  imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ];
-  boot.loader.grub.device = "/dev/vda";
-  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
-}

modules/builder/default.nix

@@ -1,11 +0,0 @@
-{ config, lib, pkgs, ... }:
-{
-  nix.distributedBuilds = true;
-  nix.buildMachines = [{
-    hostName = "plato";
-    systems = [ "x86_64-linux" "aarch64-linux" ];
-    maxJobs = 12;
-    speedFactor = 2;
-    supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
-  }];
-}

modules/gitea/default.nix

@@ -1,41 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let cfg = config.services.gitea;
-in {
-  users.users.git = {
-    description = "Gitea Service";
-    home = cfg.stateDir;
-    useDefaultShell = true;
-    group = "git";
-    isSystemUser = true;
-  };
-  users.groups.git = { };
-
-  services.gitea = {
-    enable = true;
-    user = "git";
-    domain = "walkah.dev";
-    appName = "walkah forge";
-    rootUrl = "https://walkah.dev/";
-    httpAddress = "0.0.0.0";
-    httpPort = 8003;
-    log.level = "Error";
-    lfs.enable = true;
-
-    disableRegistration = true;
-    cookieSecure = true;
-
-    settings = {
-      other.SHOW_FOOTER_VERSION = false;
-      repository.DEFAULT_BRANCH = "main";
-      server.SSH_DOMAIN = "git.walkah.dev";
-    };
-
-    dump.enable = false;
-
-    database = {
-      type = "postgres";
-      user = "git";
-    };
-  };
-}

modules/home-assistant/default.nix

@@ -1,15 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  # Use the docker container because it's officially supported.
-  virtualisation.oci-containers = {
-    containers = {
-      home-assistant = {
-        image = "ghcr.io/home-assistant/home-assistant:2022.2.8";
-        volumes =
-          [ "/var/lib/hass:/config" "/etc/localtime:/etc/localtime:ro" ];
-        extraOptions = [ "--privileged" "--network=host" ];
-      };
-    };
-  };
-}

modules/home-assistant/postgresql.nix

@@ -1,13 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services = {
-    postgresql = {
-      ensureDatabases = [ "hass" ];
-      ensureUsers = [{
-        name = "hass";
-        ensurePermissions = { "DATABASE hass" = "ALL PRIVILEGES"; };
-      }];
-    };
-  };
-}

modules/ipfs/default.nix

@@ -1,26 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services = {
-    ipfs = {
-      enable = true;
-      apiAddress = "/ip4/0.0.0.0/tcp/5001";
-      gatewayAddress = "/ip4/0.0.0.0/tcp/8080";
-      swarmAddress = [
-        "/ip4/0.0.0.0/tcp/4001"
-        "/ip6/::/tcp/4001"
-        "/ip4/0.0.0.0/udp/4001/quic"
-        "/ip6/::/udp/4001/quic"
-      ];
-      extraConfig = {
-        Addresses = {
-          Announce = [ ];
-          NoAnnounce = [ ];
-        };
-        API = { HTTPHeaders = { Access-Control-Allow-Origin = [ "*" ]; }; };
-        Discovery = { MDNS = { Enabled = true; }; };
-        Routing = { Type = "dht"; };
-      };
-    };
-  };
-}

modules/ipfs/gateway.nix

@@ -1,48 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  peers = [
-    {
-      ID = "12D3KooWMQSgdfa4tUrDhkFx4zP3ZpgT1ryj9KH5RGUae62Vsc7y";
-      Addrs = [ "/ip4/100.95.167.126/tcp/4001" ];
-    }
-    {
-      ID = "12D3KooWMqSiDukubKNKrK7J4PaF3mfNnZFVAd3Lh7qj3Y3e5bcN";
-      Addrs = [ "/ip4/100.87.220.71/tcp/4001" ];
-
-    }
-    {
-      ID = "12D3KooWGmNRyqP969QbyP8NLVRZNK2i6yCcP6N6N2r2DCG4H34v";
-      Addrs = [ "/ip4/100.126.255.109/tcp/4001" ];
-
-    }
-    {
-      ID = "12D3KooWFkR8nsG5pzffoAfMzmwBcSakXxnogVa6inRxUbpfN5ua";
-      Addrs = [ "/ip4/100.74.59.80/tcp/4001" ];
-
-    }
-  ];
-in {
-  imports = [ ./default.nix ];
-
-  networking.firewall = {
-    allowedTCPPorts = [ 4001 ];
-    allowedUDPPorts = [ 4001 ];
-  };
-  services = {
-    ipfs = {
-      enable = true;
-      extraConfig = {
-        Peering = { Peers = peers; };
-        Swarm = { AddrFilters = null; };
-      };
-    };
-    nginx = {
-      virtualHosts."walkah.cloud" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = { proxyPass = "http://127.0.0.1:8080"; };
-      };
-    };
-  };
-}

modules/matrix/default.nix

@@ -1,49 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services = {
-    postgresql = {
-      enable = true;
-      initialScript = pkgs.writeText "synapse-init.sql" ''
-        CREATE ROLE "matrix-synapse";
-        CREATE DATABASE "matrix" WITH OWNER "matrix-synapse"
-            TEMPLATE template0
-            ENCODING 'UTF8'
-            LC_COLLATE = "C"
-            LC_CTYPE = "C";
-      '';
-    };
-
-    matrix-synapse = {
-      enable = true;
-      server_name = "walkah.chat";
-      public_baseurl = "https://matrix.walkah.chat";
-      enable_metrics = true;
-      enable_registration = false;
-      database_type = "psycopg2";
-      database_args = { database = "matrix"; };
-      listeners = [{
-        port = 8008;
-        type = "http";
-        tls = false;
-        x_forwarded = true;
-        resources = [{
-          compress = false;
-          names = [ "client" "federation" ];
-        }];
-      }];
-      extraConfigFiles = [
-        config.sops.secrets.matrix-registration-secret.path
-      ];
-
-      account_threepid_delegates = {
-        email = "https://vector.im";
-        msisdn = "https://vector.im";
-      };
-    };
-  };
-
-  sops.secrets.matrix-registration-secret = { 
-    owner = "matrix-synapse";
-  };
-}

modules/matrix/nginx.nix

@@ -1,36 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-{
-  services.nginx = {
-    enable = true;
-    virtualHosts = {
-      "matrix.walkah.chat" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = { proxyPass = "http://plato:8008"; };
-      };
-
-      "walkah.chat" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."= /.well-known/matrix/server".extraConfig =
-          let server = { "m.server" = "matrix.walkah.chat:443"; };
-          in ''
-            default_type application/json;
-            add_header Access-Control-Allow-Origin *;
-            return 200 '${builtins.toJSON server}';
-          '';
-        locations."= /.well-known/matrix/client".extraConfig = let
-          client = {
-            "m.homeserver" = { "base_url" = "https://matrix.walkah.chat"; };
-          };
-        in ''
-          default_type application/json;
-          add_header Access-Control-Allow-Origin *;
-          return 200 '${builtins.toJSON client}';
-        '';
-        locations."/" = { root = pkgs.element-web; };
-      };
-    };
-  };
-}

modules/sops/default.nix

@@ -1,9 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  sources = import ../../nix/sources.nix;
-in
-{
-  imports = [ "${sources.sops-nix}/modules/sops" ];
-  sops.defaultSopsFile = ../../secrets/secrets.yaml;
-}

nix/checks.nix

@@ -0,0 +1,15 @@
+{
+  system,
+  pre-commit-hooks,
+  ...
+}:
+{
+  pre-commit-check = pre-commit-hooks.lib.${system}.run {
+    src = ./.;
+    hooks = {
+      deadnix.enable = true;
+      nixfmt-rfc-style.enable = true;
+      statix.enable = true;
+    };
+  };
+}

nix/darwin.nix

@@ -0,0 +1,29 @@
+{
+  self,
+  darwin,
+  home-manager,
+  ...
+}:
+let
+  mkDarwin =
+    hostName: modules:
+    let
+      hostSystem = self.hosts.${hostName}.system;
+    in
+    darwin.lib.darwinSystem {
+      system = hostSystem;
+      modules = [
+        home-manager.darwinModules.home-manager
+        (_: {
+          networking.hostName = hostName;
+          nixpkgs.overlays = [ self.overlays.default ];
+        })
+      ]
+      ++ modules;
+      specialArgs = { inherit home-manager; };
+    };
+in
+{
+  epicurus = mkDarwin "epicurus" [ ./hosts/epicurus/darwin-configuration.nix ];
+  heraclitus = mkDarwin "heraclitus" [ ./hosts/heraclitus/darwin-configuration.nix ];
+}

nix/hosts.nix

@@ -0,0 +1,49 @@
+{
+  socrates = {
+    type = "nixos";
+    address = "100.103.57.96";
+    system = "x86_64-linux";
+    sshUser = "walkah";
+  };
+  plato = {
+    type = "nixos";
+    address = "100.111.208.75";
+    system = "x86_64-linux";
+    sshUser = "walkah";
+  };
+  agent = {
+    type = "nixos";
+    address = "100.103.219.26";
+    system = "aarch64-linux";
+    sshUser = "root";
+  };
+  form = {
+    type = "nixos";
+    address = "100.104.247.27";
+    system = "aarch64-linux";
+    sshUser = "root";
+  };
+  matter = {
+    type = "nixos";
+    address = "100.95.77.67";
+    system = "aarch64-linux";
+    sshUser = "root";
+  };
+  purpose = {
+    type = "nixos";
+    address = "100.117.49.15";
+    system = "aarch64-linux";
+    sshUser = "root";
+  };
+  epicurus = {
+    type = "darwin";
+    address = "100.75.26.104";
+    system = "aarch64-darwin";
+    sshUser = "walkah";
+  };
+  heraclitus = {
+    type = "darwin";
+    address = "100.72.149.31";
+    system = "aarch64-darwin";
+  };
+}

nix/hosts/aristotle/configuration.nix

@@ -0,0 +1,75 @@
+{ pkgs, raspberry-pi-nix, ... }:
+
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ../../modules/base/nixos.nix
+    raspberry-pi-nix.nixosModules.raspberry-pi
+    ../../modules/ipfs/cluster.nix
+    # ../../modules/k3s/agent.nix
+    ../../modules/sops
+  ];
+
+  # See: https://github.com/NixOS/nixos-hardware/issues/858
+  boot.initrd.systemd.tpm2.enable = false;
+
+  boot.kernelParams = [
+    "cgroup_enable=memory"
+    "cgroup_enable=cpuset"
+    "cgroup_memory=1"
+  ];
+
+  raspberry-pi-nix.board = "bcm2711";
+  hardware.raspberry-pi.config = {
+    all = {
+      dt-overlays = {
+        rpi-poe = {
+          enable = true;
+          params = {
+            poe_fan_temp0 = {
+              enable = true;
+              value = 50000;
+            };
+            poe_fan_temp1 = {
+              enable = true;
+              value = 60000;
+            };
+            poe_fan_temp2 = {
+              enable = true;
+              value = 70000;
+            };
+            poe_fan_temp3 = {
+              enable = true;
+              value = 80000;
+            };
+          };
+        };
+      };
+    };
+  };
+
+  time.timeZone = "America/Toronto";
+  networking = {
+    # networking.hostName = "nixos"; # Define your hostname.
+    # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+    # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+    # Per-interface useDHCP will be mandatory in the future, so this generated config
+    # replicates the default behaviour.
+    useDHCP = false;
+    interfaces.eth0.useDHCP = true;
+    interfaces.wlan0.useDHCP = true;
+    firewall.enable = false;
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    libraspberrypi
+    raspberrypi-eeprom
+  ];
+  security.sudo.wheelNeedsPassword = false;
+}

nix/hosts/aristotle/hardware-configuration.nix

@@ -1,19 +1,15 @@
 # Do not modify this file!  It was generated by ‘nixos-generate-config’
 # and may be overwritten by future invocations.  Please make changes
 # to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
+{ lib, modulesPath, ... }:
 
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [ "usbhid" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
   fileSystems."/" = {
     device = "/dev/disk/by-label/NIXOS_SD";
     fsType = "ext4";
+    options = [ "noatime" ];
   };
 
   swapDevices = [ ];

nix/hosts/epicurus/darwin-configuration.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports = [
+    ./homebrew.nix
+
+    ../../modules/base/darwin.nix
+    ../../modules/builder
+    ../../modules/dev
+  ];
+}

nix/hosts/epicurus/homebrew.nix

@@ -0,0 +1,34 @@
+_:
+
+{
+  homebrew = {
+    taps = [
+      "homebrew/cask"
+      "homebrew/services"
+    ];
+
+    brews = [
+      "btop"
+      "code-server"
+      "coreutils"
+      "mas"
+      "mosh"
+    ];
+
+    casks = [
+      "1password"
+      "docker-desktop"
+      "font-jetbrains-mono"
+      "font-jetbrains-mono-nerd-font"
+      "gpg-suite"
+      "plex-media-server"
+      "stats"
+      "synology-drive"
+      "tailscale-app"
+    ];
+
+    masApps = {
+      Xcode = 497799835;
+    };
+  };
+}

nix/hosts/heraclitus/darwin-configuration.nix

@@ -0,0 +1,19 @@
+{ ... }:
+{
+  imports = [
+    ./homebrew.nix
+
+    ../../modules/base/darwin.nix
+    ../../modules/dev
+    ../../modules/builder
+  ];
+
+  system = {
+    defaults = {
+      dock = {
+        autohide = true;
+        orientation = "left";
+      };
+    };
+  };
+}

nix/hosts/heraclitus/homebrew.nix

@@ -0,0 +1,107 @@
+_:
+
+{
+  homebrew = {
+    taps = [
+      "homebrew/cask"
+      "homebrew/services"
+      "walkah/tap"
+      "1password/tap"
+      "d12frosted/emacs-plus"
+      "dracula/install"
+      "heroku/brew"
+    ];
+
+    brews = [
+      "act"
+      "asdf"
+      "argocd"
+      "cmake"
+      "cocoapods"
+      "coreutils"
+      {
+        name = "emacs-plus";
+        args = [ "--with-c9rgreen-sonoma-icon" ];
+      }
+      "fontconfig"
+      "gcc"
+      "gh"
+      "helm"
+      "heroku"
+      "ipfs"
+      "kind"
+      "kubernetes-cli"
+      "kustomize"
+      "libtool"
+      "mas"
+      "mr"
+      "ollama"
+      "opentofu"
+      "podman"
+      "podman-compose"
+      "r"
+      "ripgrep"
+      "tea"
+      "terminal-notifier"
+      "watchman"
+    ];
+
+    casks = [
+      "1password"
+      "1password-cli"
+      "actual"
+      "android-studio"
+      "arc"
+      "balenaetcher"
+      "beeper"
+      "brave-browser"
+      "bunch"
+      "calibre"
+      "claude"
+      "discord"
+      "dracula-xcode"
+      "element"
+      "fantastical"
+      "figma"
+      "firefox@developer-edition"
+      "font-jetbrains-mono"
+      "font-jetbrains-mono-nerd-font"
+      "ghostty"
+      "google-chrome"
+      "gpg-suite"
+      "hazel"
+      "jordanbaird-ice@beta"
+      "logi-options+"
+      "logitech-camera-settings"
+      "microsoft-edge"
+      "minecraft"
+      "obsidian"
+      "opal-composer"
+      "plexamp"
+      "podman-desktop"
+      "raycast"
+      "rstudio"
+      "slack"
+      "sonos"
+      "spotify"
+      "stats"
+      "steam"
+      "synology-drive"
+      "tailscale-app"
+      "todoist-app"
+      "visual-studio-code"
+      "zen"
+      "zoom"
+      "zulu@17"
+    ];
+
+    masApps = {
+      OnePasswordSafari = 1569813296;
+      Bumpr = 1166066070;
+      DayOne = 1055511498;
+      Drafts = 1435957248;
+      HomeAssistant = 1099568401;
+      Xcode = 497799835;
+    };
+  };
+}

nix/hosts/plato/configuration.nix

@@ -0,0 +1,227 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  automount_opts = "uid=1000,gid=1000,x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+  inherit (config.sops) secrets;
+in
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ../../modules/base/nixos.nix
+
+    ../../modules/coredns
+    ../../modules/drone
+    ../../modules/drone/runner-docker.nix
+    ../../modules/gitea
+    # ../../modules/k3s/server.nix
+    ../../modules/matrix
+    ../../modules/minecraft
+    ../../modules/postgresql
+    ../../modules/sops
+  ];
+  boot = {
+    binfmt.emulatedSystems = [ "aarch64-linux" ];
+    loader = {
+      efi.canTouchEfiVariables = true;
+      systemd-boot = {
+        # Use the systemd-boot EFI boot loader.
+        enable = true;
+        configurationLimit = 3;
+      };
+    };
+    tmp.cleanOnBoot = true;
+  };
+
+  # Set your time zone.
+  time.timeZone = "America/Toronto";
+  networking = {
+    hostName = "plato"; # Define your hostname.
+    useDHCP = false;
+    interfaces = {
+      enp10s0.useDHCP = true;
+      enp9s0.useDHCP = true;
+    };
+
+    # Open ports in the firewall.
+    # networking.firewall.allowedTCPPorts = [ ... ];
+    # networking.firewall.allowedUDPPorts = [ ... ];
+    # Or disable the firewall altogether.
+    firewall.enable = false;
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC5spf4diguK+w7iYLFr565++6DjHukWfvpN2ru9dCRk nixbuild"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    cifs-utils
+    pinentry-curses
+    weechat
+  ];
+  fileSystems = {
+    "/mnt/downloads" = {
+      device = "//parthenon/Downloads";
+      fsType = "cifs";
+      options = [
+        "${automount_opts},credentials=${secrets.filesystems-parthenon.path}"
+      ];
+    };
+
+    "/mnt/music" = {
+      device = "//parthenon/Music";
+      fsType = "cifs";
+      options = [
+        "${automount_opts},credentials=${secrets.filesystems-parthenon.path}"
+      ];
+    };
+    "/mnt/video" = {
+      device = "//parthenon/Video";
+      fsType = "cifs";
+      options = [
+        "${automount_opts},credentials=${secrets.filesystems-parthenon.path}"
+      ];
+    };
+  };
+
+  nixpkgs.config.allowInsecurePredicate =
+    pkg:
+    builtins.elem (lib.getName pkg) [
+      "broadcom-sta" # aka “wl”
+    ];
+
+  power.ups = {
+    enable = true;
+    mode = "netserver";
+    ups."cyberpower" = {
+      description = "Cyberpower EC650LCD";
+      driver = "usbhid-ups";
+      port = "auto";
+    };
+    upsd = {
+      enable = true;
+      listen = [
+        { address = "0.0.0.0"; }
+      ];
+    };
+    users.upsmon = {
+      passwordFile = secrets.upsmon.path;
+      upsmon = "primary";
+    };
+
+    upsmon.monitor."cyberpower".user = "upsmon";
+  };
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  sops.secrets = {
+    filesystems-parthenon = { };
+    upsmon = { };
+  };
+
+  services = {
+    avahi = {
+      enable = true;
+      nssmdns4 = true;
+
+      publish = {
+        enable = true;
+        userServices = true;
+      };
+    };
+
+    borgbackup.jobs."borgbase" = {
+      paths = [
+        "/var/backup"
+      ];
+      repo = "ssh://h7ug55o3@h7ug55o3.repo.borgbase.com/./repo";
+      encryption = {
+        mode = "repokey-blake2";
+        passCommand = "cat /root/borgbackup/passphrase";
+      };
+      environment.BORG_RSH = "ssh -i /root/borgbackup/ssh_key";
+      compression = "auto,lzma";
+      startAt = "daily";
+    };
+
+    grafana = {
+      enable = true;
+      settings = {
+        server = {
+          domain = "plato.walkah.lab";
+          http_port = 2342;
+          http_addr = "0.0.0.0";
+        };
+      };
+    };
+    prometheus = {
+      scrapeConfigs = [
+        {
+          job_name = "node";
+          static_configs = [
+            {
+              targets = [
+                "plato:9100"
+                "agent:9100"
+                "form:9100"
+                "matter:9100"
+                "purpose:9100"
+                "socrates:9100"
+              ];
+            }
+          ];
+        }
+        {
+          job_name = "coredns";
+          static_configs = [ { targets = [ "plato:9153" ]; } ];
+        }
+        {
+          job_name = "ipfs";
+          metrics_path = "/debug/metrics/prometheus";
+          static_configs = [
+            {
+              targets = [
+                "agent:5001"
+                "form:5001"
+                "matter:5001"
+                "purpose:5001"
+              ];
+            }
+          ];
+        }
+      ];
+    };
+    tailscale = {
+      useRoutingFeatures = "server";
+    };
+  };
+
+  walkah.coredns = {
+    enable = true;
+  };
+
+  virtualisation.docker = {
+    enable = true;
+    # Clean docker images periodically
+    autoPrune = {
+      enable = true;
+      flags = [ "--all" ];
+    };
+    daemon.settings = {
+      dns = [
+        "1.1.1.1"
+        "1.0.0.1"
+      ];
+    };
+  };
+}

nix/hosts/plato/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+  boot = {
+    initrd.availableKernelModules = [
+      "uhci_hcd"
+      "ehci_pci"
+      "ahci"
+      "xhci_pci"
+      "firewire_ohci"
+      "usb_storage"
+      "usbhid"
+      "sd_mod"
+      "sr_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [
+      "kvm-intel"
+      "wl"
+    ];
+    extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/ea3c68ac-e822-4b71-a8f5-65d9e452a3c2";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/FB06-AB48";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ { device = "/dev/disk/by-uuid/3a812874-3def-4e46-b20d-cd55fa7bdd5f"; } ];
+
+}

nix/hosts/socrates/configuration.nix

@@ -0,0 +1,72 @@
+{ pkgs, ... }:
+{
+  imports = [
+    ./hardware-configuration.nix
+    ./networking.nix # generated at runtime by nixos-infect
+    ../../modules/base/nixos.nix
+
+    ../../modules/akkoma
+    ../../modules/akkoma/nginx.nix
+    ../../modules/coredns
+    ../../modules/code-server/nginx.nix
+    ../../modules/drone/nginx.nix
+    ../../modules/gitea/nginx.nix
+    ../../modules/home-assistant/nginx.nix
+    ../../modules/ipfs/gateway.nix
+    ../../modules/matrix/nginx.nix
+    ../../modules/minecraft/proxy.nix
+    ../../modules/sops
+  ];
+
+  boot.tmp.cleanOnBoot = true;
+
+  # Set your time zone.
+  time.timeZone = "America/Toronto";
+
+  networking = {
+    hostName = "socrates";
+    firewall = {
+      allowPing = true;
+      allowedTCPPorts = [
+        80
+        443
+      ];
+      trustedInterfaces = [ "tailscale0" ];
+      checkReversePath = "loose";
+    };
+  };
+
+  nix = {
+    settings.trusted-users = [
+      "@wheel"
+      "root"
+    ];
+  };
+
+  security = {
+    sudo.wheelNeedsPassword = false;
+    acme.acceptTerms = true;
+    acme.defaults.email = "walkah@walkah.net";
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
+  ];
+
+  environment.systemPackages = with pkgs; [ kubo-migrator ];
+
+  walkah.coredns = {
+    enable = true;
+    addr = "100.103.57.96";
+  };
+
+  services = {
+    nginx = {
+      enable = true;
+      recommendedTlsSettings = true;
+      recommendedOptimisation = true;
+      recommendedGzipSettings = true;
+      recommendedProxySettings = true;
+    };
+  };
+}

nix/hosts/socrates/hardware-configuration.nix

@@ -0,0 +1,9 @@
+{ modulesPath, ... }:
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  boot.loader.grub.device = "/dev/vda";
+  fileSystems."/" = {
+    device = "/dev/vda1";
+    fsType = "ext4";
+  };
+}

nix/hosts/socrates/networking.nix

@@ -1,4 +1,5 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   # This file was populated at runtime with the networking
   # details gathered from the active system.
   networking = {
@@ -28,14 +29,18 @@
             prefixLength = 64;
           }
         ];
-        ipv4.routes = [{
-          address = "167.99.176.1";
-          prefixLength = 32;
-        }];
-        ipv6.routes = [{
-          address = "2604:a880:cad:d0::1";
-          prefixLength = 32;
-        }];
+        ipv4.routes = [
+          {
+            address = "167.99.176.1";
+            prefixLength = 32;
+          }
+        ];
+        ipv6.routes = [
+          {
+            address = "2604:a880:cad:d0::1";
+            prefixLength = 32;
+          }
+        ];
       };
 
     };

nix/modules/akkoma/default.nix

@@ -0,0 +1,111 @@
+{ config, pkgs, ... }:
+
+let
+  inherit (config.services) akkoma;
+  inherit (config.sops) secrets;
+  inherit ((pkgs.formats.elixirConf { }).lib) mkRaw;
+in
+{
+  services = {
+    akkoma = {
+      enable = true;
+      config = {
+        ":pleroma" = {
+          ":instance" = {
+            name = "walkah.social";
+            email = "walkah@walkah.net";
+            notify_email = "walkah@walkah.net";
+            description = "James Walker's personal Akkoma instance";
+            registrations_open = false;
+            invites_enabled = true;
+            federating = true;
+            federation_incoming_replies_max_depth = null;
+            allow_relay = true;
+            safe_dm_mentions = true;
+            external_user_synchronization = true;
+            cleanup_attachments = true;
+          };
+          ":media_proxy" = {
+            enabled = false;
+            redirect_on_failure = true;
+          };
+
+          "Pleroma.Repo" = {
+            adapter = mkRaw "Ecto.Adapters.Postgres";
+            socket_dir = "/run/postgresql";
+            username = config.services.akkoma.user;
+            database = "akkoma";
+
+            prepare = mkRaw ":named";
+            parameters.plan_cache_mode = "force_custom_plan";
+          };
+
+          "Pleroma.Web.Endpoint" = {
+            secret_key_base = {
+              _secret = secrets.akkoma-secret-key-base.path;
+            };
+            signing_salt = {
+              _secret = secrets.akkoma-signing-salt.path;
+            };
+            live_view.signing_salt = {
+              _secret = secrets.akkoma-signing-salt.path;
+            };
+            url = {
+              host = "walkah.social";
+              scheme = "https";
+              port = 443;
+            };
+            http = {
+              ip = "127.0.0.1";
+              port = 4000;
+            };
+          };
+        };
+        ":web_push_encryption" = {
+          ":vapid_details" = {
+            private_key = {
+              _secret = secrets.akkoma-vapid-private-key.path;
+            };
+            public_key = {
+              _secret = secrets.akkoma-vapid-public-key.path;
+            };
+          };
+        };
+        ":joken" = {
+          ":default_signer" = {
+            _secret = secrets.akkoma-joken-signer.path;
+          };
+        };
+      };
+      nginx = null; # doing this manually
+    };
+
+    postgresql = {
+      enable = true;
+    };
+
+    postgresqlBackup = {
+      enable = true;
+      databases = [ "akkoma" ];
+    };
+  };
+  sops = {
+    secrets = {
+      akkoma-secret-key-base = {
+        owner = akkoma.user;
+      };
+      akkoma-signing-salt = {
+        owner = akkoma.user;
+      };
+      akkoma-vapid-private-key = {
+        owner = akkoma.user;
+      };
+      akkoma-vapid-public-key = {
+        owner = akkoma.user;
+      };
+      akkoma-joken-signer = {
+        owner = akkoma.user;
+      };
+    };
+  };
+}

nix/modules/akkoma/nginx.nix

@@ -0,0 +1,15 @@
+_: {
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "walkah.social" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:4000";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+}

nix/modules/base/common.nix

@@ -0,0 +1,29 @@
+_:
+
+{
+  nix = {
+    extraOptions = ''
+      experimental-features = nix-command flakes
+    '';
+
+    gc = {
+      automatic = true;
+    };
+
+    settings = {
+      substituters = [
+        "https://walkah.cachix.org"
+        "https://nix-community.cachix.org"
+        "https://cache.garnix.io"
+      ];
+
+      trusted-public-keys = [
+        "walkah.cachix.org-1:D8cO78JoJC6UPV1ZMgd1V5znpk3jNUERGIeAKN15hxo="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+      ];
+    };
+  };
+
+  programs.zsh.enable = true;
+}

nix/modules/base/darwin.nix

@@ -0,0 +1,56 @@
+{ ... }:
+{
+
+  imports = [
+    ./common.nix
+    ../../users
+  ];
+
+  nix = {
+    enable = true;
+
+    extraOptions = ''
+      extra-platforms = x86_64-darwin aarch64-darwin
+    '';
+
+    gc = {
+      interval = {
+        Hour = 3;
+        Minute = 16;
+        Weekday = 6;
+      };
+      options = "--delete-older-than 30d";
+    };
+    settings = {
+      trusted-users = [
+        "root"
+        "@admin"
+      ];
+    };
+  };
+
+  environment.etc = {
+    "sudoers.d/walkah".text = ''
+      walkah   ALL = (ALL) NOPASSWD: ALL
+    '';
+  };
+
+  homebrew = {
+    enable = true;
+    brewPrefix = "/opt/homebrew/bin";
+    global = {
+      brewfile = true;
+      lockfiles = false;
+    };
+    onActivation = {
+      autoUpdate = true;
+      cleanup = "zap";
+      upgrade = true;
+    };
+  };
+
+  system = {
+    primaryUser = "walkah";
+    stateVersion = 4;
+  };
+}

nix/modules/base/nixos.nix

@@ -0,0 +1,63 @@
+{ config, pkgs, ... }:
+{
+
+  imports = [
+    ./common.nix
+    ../monitoring
+    ../../users
+  ];
+
+  documentation = {
+    enable = false;
+  };
+
+  environment.systemPackages = with pkgs; [
+    btop
+    htop
+    inetutils
+    vim
+  ];
+
+  nix = {
+    gc = {
+      persistent = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+
+    settings = {
+      auto-optimise-store = true;
+
+      trusted-users = [
+        "root"
+        "walkah"
+      ];
+    };
+  };
+
+  programs = {
+    mosh.enable = true;
+  };
+
+  services = {
+    openssh.enable = true;
+    tailscale = {
+      enable = true;
+      extraSetFlags = [ "--webclient" ];
+    };
+  };
+
+  system = {
+    autoUpgrade = {
+      enable = true;
+      flake = "github:walkah/athens#${config.networking.hostName}";
+      dates = "hourly";
+      flags = [
+        "--option"
+        "tarball-ttl"
+        "0"
+      ];
+    };
+    stateVersion = "23.05";
+  };
+}

nix/modules/builder/default.nix

@@ -0,0 +1,23 @@
+_: {
+  nix = {
+    distributedBuilds = true;
+    buildMachines = [
+      {
+        hostName = "plato";
+        systems = [
+          "x86_64-linux"
+          "aarch64-linux"
+        ];
+        maxJobs = 6;
+        supportedFeatures = [
+          "benchmark"
+          "big-parallel"
+          "kvm"
+        ];
+      }
+    ];
+    extraOptions = ''
+      builders-use-substitutes = true
+    '';
+  };
+}

nix/modules/code-server/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+{ pkgs, ... }:
 
 {
   environment.systemPackages = with pkgs; [ code-server ];

nix/modules/code-server/nginx.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+_:
 
 {
   services.nginx = {
@@ -8,7 +8,7 @@
         forceSSL = true;
         enableACME = true;
         locations."/" = {
-          proxyPass = "http://epicurus:8080";
+          proxyPass = "http://100.75.26.104:8080";
           proxyWebsockets = true;
         };
       };

nix/modules/coredns/default.nix

@@ -1,8 +1,10 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
 with lib;
 
-let cfg = config.walkah.coredns;
-in {
+let
+  cfg = config.walkah.coredns;
+in
+{
   options.walkah.coredns = {
     enable = mkEnableOption "";
     addr = mkOption {
@@ -17,6 +19,7 @@ in {
       enable = true;
       config = ''
         . {
+          bind 127.0.0.1
           bind ${cfg.addr}
           prometheus ${cfg.addr}:9153
           log
@@ -36,7 +39,7 @@ in {
     };
 
     networking = {
-      nameservers = [ "100.111.208.75" "100.103.57.96" ];
+      nameservers = [ "127.0.0.1" ];
       search = [ "walkah.lab" ];
     };
   };

nix/modules/coredns/walkah.lab.zone

@@ -1,6 +1,6 @@
 $ORIGIN walkah.lab.
 @       3600 IN SOA plato.walkah.lab. walkah.walkah.net. (
-        2021070700 ; serial
+        2023091000 ; serial
         7200       ; refresh (2 hours)
         3600       ; retry (1 hour)
         1209600    ; expire (2 weeks)
@@ -10,10 +10,10 @@ $ORIGIN walkah.lab.
 socrates        IN A    100.103.57.96
 plato           IN A    100.111.208.75
 ; aristotle
-agent           IN A    100.95.167.126
-form            IN A    100.87.220.71
-matter          IN A    100.126.255.109
-purpose         IN A    100.74.59.80
+agent           IN A    100.103.219.26
+form            IN A    100.104.247.27
+matter          IN A    100.95.77.67
+purpose         IN A    100.117.49.15
 
-parthenon       IN A    100.106.65.40
-epicurus        IN A    100.66.26.116
+parthenon       IN A    100.106.65.39
+epicurus        IN A    100.75.26.104

nix/modules/dev/default.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    # Nix
+    cachix
+    nixd
+    nixf
+    nixfmt-rfc-style
+  ];
+}

nix/modules/drone/default.nix

@@ -0,0 +1,47 @@
+{ pkgs, config, ... }:
+{
+  sops.secrets.drone = {
+    owner = "drone";
+  };
+
+  services = {
+    postgresql = {
+      ensureDatabases = [ "drone" ];
+      ensureUsers = [
+        {
+          name = "drone";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+    postgresqlBackup.databases = [ "drone" ];
+  };
+
+  systemd.services.drone = {
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      EnvironmentFile = [
+        config.sops.secrets.drone.path
+      ];
+      Environment = [
+        "DRONE_GITEA_SERVER=https://walkah.dev"
+        "DRONE_DATABASE_DATASOURCE=postgres:///drone?host=/run/postgresql"
+        "DRONE_DATABASE_DRIVER=postgres"
+        "DRONE_SERVER_HOST=https://drone.walkah.dev"
+        "DRONE_SERVER_PORT=:3030"
+        "DRONE_SERVER_PROTO=https"
+        "DRONE_USER_CREATE=username:walkah,admin:true"
+      ];
+      ExecStart = "${pkgs.drone}/bin/drone-server";
+      User = "drone";
+      Group = "drone";
+    };
+  };
+
+  users.users.drone = {
+    isSystemUser = true;
+    createHome = true;
+    group = "drone";
+  };
+  users.groups.drone = { };
+}

nix/modules/drone/nginx.nix

@@ -1,14 +1,14 @@
-{ config, lib, pkgs, ... }:
+_:
 
 {
   services.nginx = {
     enable = true;
     virtualHosts = {
-      "walkah.dev" = {
+      "drone.walkah.dev" = {
         forceSSL = true;
         enableACME = true;
         locations."/" = {
-          proxyPass = "http://plato:8003";
+          proxyPass = "http://100.111.208.75:3030";
           proxyWebsockets = true;
         };
       };

nix/modules/drone/runner-docker.nix

@@ -0,0 +1,23 @@
+{ pkgs, config, ... }:
+{
+  systemd.services.drone-runner-docker = {
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Environment = [
+      ];
+      EnvironmentFile = [
+        config.sops.secrets.drone.path
+      ];
+      ExecStart = "${pkgs.drone-runner-docker}/bin/drone-runner-docker";
+      User = "drone-runner-docker";
+      Group = "drone-runner-docker";
+    };
+  };
+
+  users.users.drone-runner-docker = {
+    isSystemUser = true;
+    group = "drone-runner-docker";
+    extraGroups = [ "docker" ];
+  };
+  users.groups.drone-runner-docker = { };
+}

nix/modules/drone/runner-exec.nix

@@ -0,0 +1,65 @@
+{ pkgs, config, ... }:
+{
+  nix.settings.allowed-users = [ "drone-runner-exec" ];
+  systemd.services.drone-runner-exec = {
+    wantedBy = [ "multi-user.target" ];
+    # might break deployment
+    restartIfChanged = false;
+    confinement.enable = true;
+    confinement.packages = [
+      pkgs.git
+      pkgs.gnutar
+      pkgs.bash
+      pkgs.nix
+      pkgs.gzip
+    ];
+    path = [
+      pkgs.git
+      pkgs.gnutar
+      pkgs.bash
+      pkgs.nix
+      pkgs.gzip
+    ];
+    serviceConfig = {
+      Environment = [
+        "DRONE_RUNNER_CAPACITY=10"
+        "CLIENT_DRONE_RPC_HOST=127.0.0.1:3030"
+        "NIX_REMOTE=daemon"
+        "PAGER=cat"
+      ];
+      BindPaths = [
+        "/nix/var/nix/daemon-socket/socket"
+        "/run/nscd/socket"
+        "/var/lib/drone"
+      ];
+      BindReadOnlyPaths = [
+        "/etc/passwd:/etc/passwd"
+        "/etc/group:/etc/group"
+        "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
+        "${
+          config.environment.etc."ssl/certs/ca-certificates.crt".source
+        }:/etc/ssl/certs/ca-certificates.crt"
+        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
+        "${builtins.toFile "ssh_config" ''
+          Host eve.thalheim.io
+            ForwardAgent yes
+        ''}:/etc/ssh/ssh_config"
+        "/etc/machine-id"
+        # channels are dynamic paths in the nix store, therefore we need to bind mount the whole thing
+        "/nix/"
+      ];
+      EnvironmentFile = [
+        config.sops.secrets.drone.path
+      ];
+      ExecStart = "${pkgs.drone-runner-exec}/bin/drone-runner-exec";
+      User = "drone-runner-exec";
+      Group = "drone-runner-exec";
+    };
+  };
+
+  users.users.drone-runner-exec = {
+    isSystemUser = true;
+    group = "drone-runner-exec";
+  };
+  users.groups.drone-runner-exec = { };
+}

nix/modules/gitea/default.nix

@@ -0,0 +1,68 @@
+{ config, ... }:
+
+let
+  cfg = config.services.gitea;
+in
+{
+  users.users.git = {
+    description = "Gitea Service";
+    home = cfg.stateDir;
+    useDefaultShell = true;
+    group = "git";
+    isSystemUser = true;
+  };
+  users.groups.git = { };
+
+  services = {
+    gitea = {
+      enable = true;
+      user = "git";
+      appName = "walkah forge";
+      lfs.enable = true;
+
+      settings = {
+        log = {
+          LEVEL = "Error";
+        };
+        other = {
+          SHOW_FOOTER_VERSION = false;
+        };
+        repository = {
+          DEFAULT_BRANCH = "main";
+        };
+        server = {
+          DOMAIN = "walkah.dev";
+          HTTP_ADDR = "0.0.0.0";
+          HTTP_PORT = 8003;
+          ROOT_URL = "https://walkah.dev/";
+          SSH_DOMAIN = "git.walkah.dev";
+        };
+        service = {
+          DISABLE_REGISTRATION = true;
+        };
+        session = {
+          COOKIE_SECURE = true;
+        };
+      };
+
+      dump.enable = false;
+
+      database = {
+        createDatabase = false;
+        type = "postgres";
+        name = "gitea";
+        socket = "/run/postgresql";
+        user = "git";
+      };
+    };
+    postgresql = {
+      ensureDatabases = [ "gitea" ];
+      ensureUsers = [
+        {
+          name = "git";
+        }
+      ];
+    };
+    postgresqlBackup.databases = [ "gitea" ];
+  };
+}

nix/modules/gitea/nginx.nix

@@ -0,0 +1,20 @@
+_:
+
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "walkah.dev" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.111.208.75:8003";
+          proxyWebsockets = true;
+          extraConfig = ''
+            client_max_body_size 0;
+          '';
+        };
+      };
+    };
+  };
+}

nix/modules/home-assistant/nginx.nix

@@ -1,4 +1,4 @@
-{ config, lib, pkgs, ... }:
+_:
 
 {
   services.nginx = {
@@ -8,7 +8,7 @@
         forceSSL = true;
         enableACME = true;
         locations."/" = {
-          proxyPass = "http://plato:8123";
+          proxyPass = "http://100.72.37.46:8123";
           proxyWebsockets = true;
         };
       };

nix/modules/ipfs/cluster.nix

@@ -1,15 +1,19 @@
-{ config, lib, pkgs, ... }:
+{ config, ... }:
 
 {
   imports = [
     ./default.nix
-    ../../services/ipfs-cluster.nix
   ];
 
   services = {
-    ipfs = {
+    kubo = {
       enable = true;
-      extraConfig = {
+      settings = {
+        Discovery = {
+          MDNS = {
+            Enabled = true;
+          };
+        };
         Swarm = {
           AddrFilters = null;
           ConnMgr = {

nix/modules/ipfs/default.nix

@@ -0,0 +1,31 @@
+_:
+
+{
+  services = {
+    kubo = {
+      enable = true;
+      settings = {
+        Addresses = {
+          Announce = [ ];
+          API = "/ip4/0.0.0.0/tcp/5001";
+          Gateway = "/ip4/0.0.0.0/tcp/8080";
+          NoAnnounce = [ ];
+          Swarm = [
+            "/ip4/0.0.0.0/tcp/4001"
+            "/ip6/::/tcp/4001"
+            "/ip4/0.0.0.0/udp/4001/quic"
+            "/ip6/::/udp/4001/quic"
+          ];
+        };
+        API = {
+          HTTPHeaders = {
+            Access-Control-Allow-Origin = [ "*" ];
+          };
+        };
+        Routing = {
+          Type = "dht";
+        };
+      };
+    };
+  };
+}

nix/modules/ipfs/gateway.nix

@@ -0,0 +1,79 @@
+{ pkgs, ... }:
+
+let
+  peers = [
+    {
+      ID = "12D3KooWEVoGdqsakyi3bgE8ivvRzcgTjiirFNS2FbUMw6HSjZF9";
+      Addrs = [ "/ip4/100.103.219.26/tcp/4001" ];
+    }
+    {
+      ID = "12D3KooWC5ncgKeJV2G6QBdGMkT2gLbeviaDxpYR7V6NVTsma3C5";
+      Addrs = [ "/ip4/100.104.247.27/tcp/4001" ];
+
+    }
+    {
+      ID = "12D3KooW9xeqfnnNWafiDkLXWjC5YdUnBrG5tJDd3tnm86kqVwhA";
+      Addrs = [ "/ip4/100.95.77.67/tcp/4001" ];
+
+    }
+    {
+      ID = "12D3KooWLYPckqA4JACJ4vioWc4tYuPjmfLMbgviECnWqazjSgK9";
+      Addrs = [ "/ip4/100.117.49.15/tcp/4001" ];
+
+    }
+  ];
+in
+{
+  imports = [ ./default.nix ];
+
+  environment.systemPackages = with pkgs; [ kubo-migrator ];
+
+  environment.etc = {
+    "ipfs/denylists/badbits.deny".source = ./badbits.deny;
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 4001 ];
+    allowedUDPPorts = [ 4001 ];
+  };
+  services = {
+    kubo = {
+      enable = true;
+      settings = {
+        Discovery = {
+          MDNS = {
+            Enabled = false;
+          };
+        };
+        Peering = {
+          Peers = peers;
+        };
+        Swarm = {
+          AddrFilters = null;
+        };
+      };
+    };
+    nginx = {
+      # IPFS Gateway
+      virtualHosts."walkah.cloud" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8080";
+        };
+      };
+
+      # Hosted Sites
+      virtualHosts."walkah.net" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8080";
+        };
+        serverAliases = [
+          "www.walkah.net"
+        ];
+      };
+    };
+  };
+}

nix/modules/k3s/agent.nix

@@ -0,0 +1,12 @@
+_:
+let
+  hosts = import ../../hosts.nix;
+in
+{
+  imports = [ ./common.nix ];
+
+  services.k3s = {
+    role = "agent";
+    serverAddr = "https://${hosts.plato.address}:6443";
+  };
+}

nix/modules/k3s/common.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+let
+  hostname = config.networking.hostName;
+  hosts = import ../../hosts.nix;
+in
+{
+  services.k3s = {
+    enable = true;
+    tokenFile = config.sops.secrets.k3s-token.path;
+    extraFlags = [
+      "--node-external-ip=${hosts.${hostname}.address}"
+    ];
+  };
+  sops.secrets.k3s-token = {
+    owner = "root";
+    mode = "0400";
+  };
+}

nix/modules/k3s/server.nix

@@ -0,0 +1,7 @@
+{
+  imports = [ ./common.nix ];
+  services.k3s = {
+    role = "server";
+    clusterInit = true;
+  };
+}

nix/modules/matrix/default.nix

@@ -0,0 +1,64 @@
+{ config, pkgs, ... }:
+
+{
+  services = {
+    postgresql = {
+      enable = true;
+      initialScript = pkgs.writeText "synapse-init.sql" ''
+        CREATE ROLE "matrix-synapse";
+        CREATE DATABASE "matrix" WITH OWNER "matrix-synapse"
+            TEMPLATE template0
+            ENCODING 'UTF8'
+            LC_COLLATE = "C"
+            LC_CTYPE = "C";
+      '';
+    };
+    postgresqlBackup.databases = [
+      "matrix"
+      "matrix-syncv3"
+    ];
+
+    matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = "walkah.chat";
+        public_baseurl = "https://matrix.walkah.chat";
+        enable_metrics = true;
+        enable_registration = false;
+        database = {
+          name = "psycopg2";
+          args = {
+            database = "matrix";
+          };
+        };
+        listeners = [
+          {
+            bind_addresses = [
+              "0.0.0.0"
+            ];
+            port = 8008;
+            type = "http";
+            tls = false;
+            x_forwarded = true;
+            resources = [
+              {
+                compress = false;
+                names = [
+                  "client"
+                  "federation"
+                ];
+              }
+            ];
+          }
+        ];
+      };
+      extraConfigFiles = [
+        config.sops.secrets.matrix-registration-secret.path
+      ];
+    };
+  };
+
+  sops.secrets.matrix-registration-secret = {
+    owner = "matrix-synapse";
+  };
+}

nix/modules/matrix/nginx.nix

@@ -0,0 +1,64 @@
+_:
+
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "matrix.walkah.chat" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/_matrix" = {
+          proxyPass = "http://100.111.208.75:8008";
+        };
+        locations."/_synapse/client" = {
+          proxyPass = "http://100.111.208.75:8008";
+        };
+      };
+
+      "syncv3.walkah.chat" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.111.208.75:8088";
+        };
+      };
+
+      "walkah.chat" = {
+        forceSSL = true;
+        enableACME = true;
+        locations = {
+          "= /.well-known/matrix/server".extraConfig =
+            let
+              server = {
+                "m.server" = "matrix.walkah.chat:443";
+              };
+            in
+            ''
+              default_type application/json;
+              add_header Access-Control-Allow-Origin *;
+              return 200 '${builtins.toJSON server}';
+            '';
+          "= /.well-known/matrix/client".extraConfig =
+            let
+              client = {
+                "m.homeserver" = {
+                  "base_url" = "https://matrix.walkah.chat";
+                };
+                "org.matrix.msc3575.proxy" = {
+                  "url" = "https://syncv3.walkah.chat";
+                };
+              };
+            in
+            ''
+              default_type application/json;
+              add_header Access-Control-Allow-Origin *;
+              return 200 '${builtins.toJSON client}';
+            '';
+          # "/" = {
+          #   root = pkgs.element-web;
+          # };
+        };
+      };
+    };
+  };
+}

nix/modules/minecraft/default.nix

@@ -0,0 +1,27 @@
+_: {
+
+  services.minecraft-server = {
+    enable = true;
+    eula = true;
+    declarative = true;
+
+    # see here for more info: https://minecraft.gamepedia.com/Server.properties#server.properties
+    serverProperties = {
+      server-port = 25565;
+      enable-query = true;
+      gamemode = "survival";
+      motd = "Vanilla Survival";
+      max-players = 20;
+      white-list = true;
+    };
+
+    # Grab UUIDs from https://mcuuid.net/
+    whitelist = {
+      walkahj = "7209094c-b3ef-4c89-b8cd-0aef7c1d57a6";
+      puffpuffpassion = "72e0d040-fa54-47e8-a6e7-162fdaa0cac5";
+      rafadoodle = "9a7c860e-e269-4c38-b2f7-ca5533c27e98";
+      camylamb = "c9fcbfa1-89da-4cf9-97fe-b9e5290a4eb4";
+      shortychark = "3f420f61-867f-4651-a849-d2e54f8c220d";
+    };
+  };
+}

nix/modules/minecraft/proxy.nix

@@ -0,0 +1,32 @@
+_:
+let
+  dest_ip = "100.111.208.75";
+  dest_port = 25565;
+in
+{
+  networking = {
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ dest_port ];
+    };
+    nat = {
+      enable = true;
+      internalInterfaces = [ "tailscale0" ];
+      externalInterface = "eth0";
+      forwardPorts = [
+        {
+          sourcePort = dest_port;
+          proto = "tcp";
+          destination = "${dest_ip}:${toString dest_port}";
+        }
+      ];
+    };
+  };
+
+  services = {
+    tailscale = {
+      useRoutingFeatures = "server";
+      extraUpFlags = [ "--stateful-filtering=false" ];
+    };
+  };
+}

nix/modules/monitoring/default.nix

@@ -0,0 +1,17 @@
+_:
+
+{
+  services = {
+    prometheus = {
+      enable = true;
+      port = 9090;
+      exporters = {
+        node = {
+          enable = true;
+          enabledCollectors = [ "systemd" ];
+          port = 9100;
+        };
+      };
+    };
+  };
+}

nix/modules/postgresql/default.nix

@@ -0,0 +1,45 @@
+{ pkgs, config, ... }:
+{
+  services = {
+    postgresql = {
+      enable = true;
+      package = pkgs.postgresql_14;
+    };
+
+    postgresqlBackup = {
+      enable = true;
+    };
+  };
+
+  # Postgres upgrades: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading
+  environment.systemPackages = [
+    (
+      let
+        # XXX specify the postgresql package you'd like to upgrade to.
+        # Do not forget to list the extensions you need.
+        newPostgres = pkgs.postgresql_15;
+      in
+      pkgs.writeScriptBin "upgrade-pg-cluster" ''
+        set -eux
+        # XXX it's perhaps advisable to stop all services that depend on postgresql
+        systemctl stop postgresql
+
+        export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
+
+        export NEWBIN="${newPostgres}/bin"
+
+        export OLDDATA="${config.services.postgresql.dataDir}"
+        export OLDBIN="${config.services.postgresql.package}/bin"
+
+        install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+        cd "$NEWDATA"
+        sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
+
+        sudo -u postgres $NEWBIN/pg_upgrade \
+          --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+          --old-bindir $OLDBIN --new-bindir $NEWBIN \
+          "$@"
+      ''
+    )
+  ];
+}

nix/modules/sops/default.nix

@@ -0,0 +1,6 @@
+{ sops-nix, ... }:
+
+{
+  imports = [ sops-nix.nixosModules.sops ];
+  sops.defaultSopsFile = ../../secrets/secrets.yaml;
+}

nix/nixos.nix

@@ -0,0 +1,38 @@
+{
+  self,
+  nixpkgs,
+  home-manager,
+  raspberry-pi-nix,
+  sops-nix,
+  ...
+}:
+let
+  mkSystem =
+    hostName: modules:
+    let
+      hostSystem = self.hosts.${hostName}.system;
+    in
+    nixpkgs.lib.nixosSystem {
+      modules = [
+        home-manager.nixosModules.home-manager
+        (_: {
+          networking.hostName = hostName;
+          nixpkgs.overlays = [ self.overlays.default ];
+          nixpkgs.config.allowUnfree = true;
+        })
+        { nixpkgs.hostPlatform = hostSystem; }
+      ]
+      ++ modules;
+      specialArgs = { inherit raspberry-pi-nix sops-nix; };
+    };
+in
+{
+  # Aristotle
+  agent = mkSystem "agent" [ ./hosts/aristotle/configuration.nix ];
+  form = mkSystem "form" [ ./hosts/aristotle/configuration.nix ];
+  matter = mkSystem "matter" [ ./hosts/aristotle/configuration.nix ];
+  purpose = mkSystem "purpose" [ ./hosts/aristotle/configuration.nix ];
+
+  plato = mkSystem "plato" [ ./hosts/plato/configuration.nix ];
+  socrates = mkSystem "socrates" [ ./hosts/socrates/configuration.nix ];
+}

nix/overlays/default.nix

@@ -0,0 +1 @@
+_self: _super: { }

nix/secrets/secrets.yaml

@@ -0,0 +1,85 @@
+matrix-registration-secret: ENC[AES256_GCM,data:Sn3pGBq4U3Tgw0pYaetnBLRiNdFGnMxAxyfrxhF9kFDMFijKSy9XBj71M5XxV4shYQyPvu2WDnPR1YvyoQVlv8cEoXhX7++JlYsp/2ZfKIzp4iMxh24z57Cw8vg=,iv:/zxlIeI9gWWCHbejYgz8pjjOrukKome0/bmcXuG3/yE=,tag:3fc3c96H3pO1FUO7p3T4gw==,type:str]
+ipfs-cluster-secret: ENC[AES256_GCM,data:fmZ1USrJlR8fbulr1Kn8LDkMl/c6OkIN5M5q4X0MLO77K8zPwTXm0+M8ZHfq36rnuxBV0gsTiYBn47DSQLaDkONOPuEu99EGuIYZ9qZQVaZ/RC12ej6bpHaaX3m3j48szOXwJdoyDWlP32ZFanMznO8+EwAz5ccNV03ck/Rh/qpq9pWt/QjNhqtAkwFkooGB0aWRdHlillsB/SGQJk/moweIQk3qz2Ya4cN21Cxfssd08TDacjNCUekIgZ/xuXV7j8dCV/qiAOJEfaHn,iv:bAEDTTeQvg+sE67nEuSZhxqJBZVXFRNIPOZGkPYy9dY=,tag:82eBLePaqu7tYu0MtefMOQ==,type:str]
+drone: ENC[AES256_GCM,data:UKh2qyZq5eTiEpdbGve+fCQZzSx/j+wUv9eHT/ToU9b51rwA7XJQC4g3rvljBL9X7DFVVdsWOdG6y1eRGImdelJ5hwxa8oK5CBpaGLGjd9+Hm8SS+Q+PAFDW6fdsPtDDgK5jjykcIlJ7u9mjCffFsCGw3UWfHxnniCnIba9e499XU+VR6l96U3oGOsrr0XO/d2zwrOm3mvXQL1P3cE+se4/UDKrdABGfKWyGqZ9xgi6Q7PTSmRv4AtpwpgF1URBvPVqs6yoexWetksLv+Xk5H50EeucbMOA+oUSJ06fUMECFRF9thRrdUbtK,iv:CiZz6NSksNMGmZxWS7uE69O6UnvTkRWbeBwC1bUqR9o=,tag:qcLmseQgkjMVv2uNXPFHzw==,type:str]
+akkoma-secret-key-base: ENC[AES256_GCM,data:OQBGkyjhDeNz40bBMMqLU7S6s4r6CtatOxJ5RNdba5m5NQO+JJ5/sEuOjJrJ29oRGjHFYwmUcAB9vptWdGZdcA==,iv:oYh9fh12cNYJOgC8DAxyYxw8dp1Fmd1CijNpgmn/AV8=,tag:E9W/5TWPjIgjE3o/QAky0A==,type:str]
+akkoma-signing-salt: ENC[AES256_GCM,data:KtOdcHM8XLY=,iv:RXvLlSyPzK6HYFxwyKEnDw1llmfNC5ambqvGiAkVxnA=,tag:LLna293WAYoBlr0j3U6zkg==,type:str]
+akkoma-vapid-private-key: ENC[AES256_GCM,data:D8Dh53yOgKrcsttJ36xyV1locXBV2BB2EG/rOfIctCbOItdsodtpMCAwRg==,iv:xzheaTo0b3szYGvZmc3ucPi9lYXJStznAUyWNQ9TATE=,tag:tHV5DUFuvq2F9yRFmHrQXQ==,type:str]
+akkoma-vapid-public-key: ENC[AES256_GCM,data:HnUAyTq7dwa+A9L1X3YyxkiJ71BoZis5TdEPHJZkFRoiU5ZYu21xJW4R1H8xsCUDTaFTKLzdSNImVStIg1A+ex6UXLvsJwqM55P8ZnUm87V5KIsCimEm,iv:vVNoYubajEgqZIg6j9k6HjY/j4ib8A7MHGWPrJnkpCw=,tag:GBr2z4EGbn5vmFMWtY013w==,type:str]
+akkoma-joken-signer: ENC[AES256_GCM,data:6GbXC7teDXxr0z7eBLm9EvJv59Bvd1FqRuBGntAH9YzM79MVUMsx4JnCZ+bPR9hLiIVgITeAc5djk2tiJewh6w==,iv:q7A8f7kocb1Go7acFkVSxdmhObPxpGlfbPgfrOXHEjg=,tag:lS4UNS1ivVZdmm8AMS/1MQ==,type:str]
+filesystems-parthenon: ENC[AES256_GCM,data:dYO+QjvWhR3oXrDfAEaUvTLx147NIDFcPUa7p3Jv558ynqmmEnVZ3+fVMUQVIw==,iv:ASmXqNA8/TZvSRo31CFAzt6StsZzZpVFvz15LN5+QmQ=,tag:Wx6kDCXqZ1iSmxpggBKVxA==,type:str]
+upsmon: ENC[AES256_GCM,data:Rlqkhh7w8S9jD3mwUdkt3g==,iv:hiMkbAhea1f6r5gGTRw49ebepMtTYBVyH+bHwp/T61Q=,tag:cbaxIDuD4JNeCC5MiMGl6w==,type:str]
+k3s-token: ENC[AES256_GCM,data:dyyFY/ruyCfAdQmmdD1eDPKhBWkbgElbFQgMjGALrM8OeTXRiiV18AwG1ZGtw+j3CBmladwBf0+gcfC0ojKHlA==,iv:j4IOIZegDMJik6shOhUZGyI0N8TD1yMDcOacArgM05Q=,tag:t91uRzF8RgxLF/f2M+9Wgg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOT3gyL29ETGNYSTNBMHhx
+            RUVNRmdpZm9TZTdJNTJCOSt5blZ3T2JLVlhVCldaTjhaanBrWTVIOWJQQ1VJUTUw
+            alJuRjhOU2wxWEF1RG0vZE9LVU1JcHMKLS0tIGF0VlRDeldsSFFZNzVHaWJGTUtC
+            WlhMcDM3RlF5Y3FkRXczbWNHQWNrVjAKx77NlnVTab75G2QTiuEmAyI10m2ZbMjc
+            IyVWoRabZY96J/HYiZaURZY5Aq10Opa9vTp0xXL0FxLwF0Bclr7J+Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzY3hRcjZsZDBjb1FtWElx
+            ODV3Q0g2Q0QveEUrMkRIZlJSbDBBdjlHZ25ZCmxvcngwN1V4RkJLL1NzWkw4bjNF
+            OXdXMlo1KzZIV3BtUWtXOGdzQ1l1RnMKLS0tIFJjY3JtOHNwTldrM0dqbnkvSThM
+            QW0zMzJtMzNSaEJldzJITDAvZExtcFUKTovVFKkl40WdXOji8xWKZ8eZcEXU64uz
+            4K7fqyhchzu+PB1xVMYeSahIYTh2oZGSKXi8nnTBwz2cPLJmy/8Biw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1pn2hnqvgt7rvfglxddlj3jwrm79rvmutmexkpxv4frdnznlel33qvfy6u5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKYlZtbC9sSXhzYUU2bnBZ
+            ZmpKUk5BcHdGbTJ3b0xhRTVxMXIxOXJYSmpNCkdWQ3hJV0t0OVcwNmYwaVh5V3VJ
+            ellsaGRyNnVEaTkxUFNReG4yTUprQUkKLS0tIHNqdjdmQjh3cHlwb0M2bGk0b2NG
+            eGV5Vk54dzNWSlFGTWc1akxHUmhiQ28KzAs/krsXZxcRQpefv5ncqbZ6D9Mr8HDl
+            9Ir35JL2HhZv3wtMUK9TQVINmbPiPGf9mzVoiCQ7Nq9J80wzt/A53Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mnrl9u8vpdjncge33pg7quakl0qdf5dlfgch87jhrs0wrvup4s0s5xh7ly
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTeDI0QXE4L0tBWDd3dmVI
+            TlN3RlBNYjNCUkZMWGUwVEtkZHU4UTVYdWw4CnMvT09sU0EyVllSM1VSRXhsL2FF
+            NnVGQ0hyRTFjdjBWSjVpNXNuc3I4RTAKLS0tIEIveW00Ky9jbnozTGZqZk4zeEdp
+            ZnBaRUJMSy9sSTIwUzR0U1JsRFhJWnMKOyIeYJquwLWqmLVqMNRCLK1U/10ILBEu
+            FX+kU8c5qrpsSoMjNfy/h9QCF/5u+9CV/9wHw2HONN0CAwWlYrDgdw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1tt0gwcm03zmpelerpph49knn8f6t8z7aq9una2qys76kf4rwxpnquxkvz3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6a2JmV1hQb0FHekpzVWVL
+            d1RzdEoxVmZWQ25XT2hkYmtESFIrNFc1N1Y0Cmx4dEZrRnhDZDlGRXJPVGRpa0l5
+            akhKR3dlTS9SblFrTndBakVIemwrRFEKLS0tICsraW83aFlvRzRKVHdQcjhLUjFB
+            K29DeVBqWUs0ejRUVUd2SkpVYzd1UEkK0/AHkZ7gKouHi26nsZsr4CpmDu+jbKx6
+            BA7VAwCI0nBP5sOgNXbsmYhgyAlaz28tybNXV+QzCnJiyTXhZM5F8w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1px55dk5n3whfdyshzyxqmyjvqdmv9au6myx6w67jw3cqp9sdx9rsa6xep9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiS1BMUFU5T05PM2Z1Zk96
+            N3FYTWp3bWtwMDZ4QVdVMEVLaTFueE9Od1JJCjdtMUNRa1JGWUkxRTZueS9vSGdx
+            NG9TVHF5T3lYbUZxa1FWY2RldHV1ZVkKLS0tIHNqbEZlSk9zR1FpWmNMQy8rayt6
+            SStpZHdKZGN0NGNieldPY2JTcnJ4ZW8Kz5u/fJjkwi8vJh3CB7K0S7+b9gzOhsvW
+            +0lfMGT+Dtbchq8O1wsCoBfe8I5kV2QlXJxTU7o4BASFKfNzX9E4gA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age12wakcnv487c5rkgv7z6umzywrqwcy6dgguq0dug6lxp64scjsq6sspkmgz
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVa2pHd2dvNHBwcW85SnNy
+            aSt4ZElQdGZLMW5GNnIyc2NxY1J2MEk1c0RjCmJiMEY5cklnWVVHN25ST2JSWEhT
+            WWcvVG9TRVlVdWFzcjhENFZCMUhXVHMKLS0tIFpWcURkWFExU200TlR1N2NIak4z
+            WlZuY2ExWWJ1VzBpY2kzaUZCcVJMZHcKoqKBQEe+3UnAhqbc7Nq8zgEVoFFjryaY
+            c8ALKqMIaMjAeA8ZU4ZTIu13pMYcJ+gAlPATt0vmsTn0Q0XIiudpJQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-10T18:41:36Z"
+    mac: ENC[AES256_GCM,data:nAUaEMxYGZc+hzeFo2sjQNBPuVw9GKjDAL9R9uJl9ySWNOLtSjl150qkAYjfqfIpsiyRtnSBfP1UxvKHjbAv5Fu9Bmkv+1rv6T8d9nK541DrT1IJ/F/sdw+Vqf/xJss1pvZLP/KhLT5wfvyPrk3VeKWx5f7BI/VzCsU1MNukZdY=,iv:ooxqCvIogeyXiHC10BJUYu9PCTZr/bnUJHiUzg2bjw4=,tag:Wt+vmIVPmlTOxAQ6rHnxdg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

nix/shells.nix

@@ -0,0 +1,23 @@
+{
+  system,
+  pkgs,
+  self,
+  ...
+}:
+{
+  default = pkgs.mkShell {
+    name = "athens";
+    buildInputs = with pkgs; [
+      deadnix
+      doctl
+      nixd
+      nixf
+      nixpkgs-fmt
+      opentofu
+      statix
+      sops
+    ];
+
+    inherit (self.checks.${system}.pre-commit-check) shellHook;
+  };
+}

nix/sources.json

@@ -1,50 +0,0 @@
-{
-    "home-manager": {
-        "branch": "master",
-        "description": "Manage a user environment using Nix  [maintainer=@rycee] ",
-        "homepage": "https://nix-community.github.io/home-manager/",
-        "owner": "nix-community",
-        "repo": "home-manager",
-        "rev": "2116fe6b50a5118d56f1f443cccf024abee9de40",
-        "sha256": "12fh1fblrwrdpw9fl7hvfqw3a0x247ns99m29vihcnygz23rlrzv",
-        "type": "tarball",
-        "url": "https://github.com/nix-community/home-manager/archive/2116fe6b50a5118d56f1f443cccf024abee9de40.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "niv": {
-        "branch": "master",
-        "description": "Easy dependency management for Nix projects",
-        "homepage": "https://github.com/nmattia/niv",
-        "owner": "nmattia",
-        "repo": "niv",
-        "rev": "9cb7ef336bb71fd1ca84fc7f2dff15ef4b033f2a",
-        "sha256": "1ajyqr8zka1zlb25jx1v4xys3zqmdy3prbm1vxlid6ah27a8qnzh",
-        "type": "tarball",
-        "url": "https://github.com/nmattia/niv/archive/9cb7ef336bb71fd1ca84fc7f2dff15ef4b033f2a.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "nixpkgs": {
-        "branch": "nixpkgs-unstable",
-        "description": "Nix Packages collection",
-        "homepage": "",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "19574af0af3ffaf7c9e359744ed32556f34536bd",
-        "sha256": "0v3c4r8v40jimicdxqvxnzmdypnafm2baam7z131zk6ljhb8jpg9",
-        "type": "tarball",
-        "url": "https://github.com/NixOS/nixpkgs/archive/19574af0af3ffaf7c9e359744ed32556f34536bd.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    },
-    "sops-nix": {
-        "branch": "master",
-        "description": "Atomic secret provisioning for NixOS based on sops",
-        "homepage": "",
-        "owner": "Mic92",
-        "repo": "sops-nix",
-        "rev": "fc22eff3205e9742c1b0fd229c267bf237f0c43e",
-        "sha256": "1as85yrx6c5ihgpqakvb43pky9iqf178kz39a0i8rrvxv9px2lm0",
-        "type": "tarball",
-        "url": "https://github.com/Mic92/sops-nix/archive/fc22eff3205e9742c1b0fd229c267bf237f0c43e.tar.gz",
-        "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
-    }
-}

nix/sources.nix

@@ -1,174 +0,0 @@
-# This file has been generated by Niv.
-
-let
-
-  #
-  # The fetchers. fetch_<type> fetches specs of type <type>.
-  #
-
-  fetch_file = pkgs: name: spec:
-    let
-      name' = sanitizeName name + "-src";
-    in
-      if spec.builtin or true then
-        builtins_fetchurl { inherit (spec) url sha256; name = name'; }
-      else
-        pkgs.fetchurl { inherit (spec) url sha256; name = name'; };
-
-  fetch_tarball = pkgs: name: spec:
-    let
-      name' = sanitizeName name + "-src";
-    in
-      if spec.builtin or true then
-        builtins_fetchTarball { name = name'; inherit (spec) url sha256; }
-      else
-        pkgs.fetchzip { name = name'; inherit (spec) url sha256; };
-
-  fetch_git = name: spec:
-    let
-      ref =
-        if spec ? ref then spec.ref else
-          if spec ? branch then "refs/heads/${spec.branch}" else
-            if spec ? tag then "refs/tags/${spec.tag}" else
-              abort "In git source '${name}': Please specify `ref`, `tag` or `branch`!";
-    in
-      builtins.fetchGit { url = spec.repo; inherit (spec) rev; inherit ref; };
-
-  fetch_local = spec: spec.path;
-
-  fetch_builtin-tarball = name: throw
-    ''[${name}] The niv type "builtin-tarball" is deprecated. You should instead use `builtin = true`.
-        $ niv modify ${name} -a type=tarball -a builtin=true'';
-
-  fetch_builtin-url = name: throw
-    ''[${name}] The niv type "builtin-url" will soon be deprecated. You should instead use `builtin = true`.
-        $ niv modify ${name} -a type=file -a builtin=true'';
-
-  #
-  # Various helpers
-  #
-
-  # https://github.com/NixOS/nixpkgs/pull/83241/files#diff-c6f540a4f3bfa4b0e8b6bafd4cd54e8bR695
-  sanitizeName = name:
-    (
-      concatMapStrings (s: if builtins.isList s then "-" else s)
-        (
-          builtins.split "[^[:alnum:]+._?=-]+"
-            ((x: builtins.elemAt (builtins.match "\\.*(.*)" x) 0) name)
-        )
-    );
-
-  # The set of packages used when specs are fetched using non-builtins.
-  mkPkgs = sources: system:
-    let
-      sourcesNixpkgs =
-        import (builtins_fetchTarball { inherit (sources.nixpkgs) url sha256; }) { inherit system; };
-      hasNixpkgsPath = builtins.any (x: x.prefix == "nixpkgs") builtins.nixPath;
-      hasThisAsNixpkgsPath = <nixpkgs> == ./.;
-    in
-      if builtins.hasAttr "nixpkgs" sources
-      then sourcesNixpkgs
-      else if hasNixpkgsPath && ! hasThisAsNixpkgsPath then
-        import <nixpkgs> {}
-      else
-        abort
-          ''
-            Please specify either <nixpkgs> (through -I or NIX_PATH=nixpkgs=...) or
-            add a package called "nixpkgs" to your sources.json.
-          '';
-
-  # The actual fetching function.
-  fetch = pkgs: name: spec:
-
-    if ! builtins.hasAttr "type" spec then
-      abort "ERROR: niv spec ${name} does not have a 'type' attribute"
-    else if spec.type == "file" then fetch_file pkgs name spec
-    else if spec.type == "tarball" then fetch_tarball pkgs name spec
-    else if spec.type == "git" then fetch_git name spec
-    else if spec.type == "local" then fetch_local spec
-    else if spec.type == "builtin-tarball" then fetch_builtin-tarball name
-    else if spec.type == "builtin-url" then fetch_builtin-url name
-    else
-      abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}";
-
-  # If the environment variable NIV_OVERRIDE_${name} is set, then use
-  # the path directly as opposed to the fetched source.
-  replace = name: drv:
-    let
-      saneName = stringAsChars (c: if isNull (builtins.match "[a-zA-Z0-9]" c) then "_" else c) name;
-      ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}";
-    in
-      if ersatz == "" then drv else
-        # this turns the string into an actual Nix path (for both absolute and
-        # relative paths)
-        if builtins.substring 0 1 ersatz == "/" then /. + ersatz else /. + builtins.getEnv "PWD" + "/${ersatz}";
-
-  # Ports of functions for older nix versions
-
-  # a Nix version of mapAttrs if the built-in doesn't exist
-  mapAttrs = builtins.mapAttrs or (
-    f: set: with builtins;
-    listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set))
-  );
-
-  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295
-  range = first: last: if first > last then [] else builtins.genList (n: first + n) (last - first + 1);
-
-  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257
-  stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1));
-
-  # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269
-  stringAsChars = f: s: concatStrings (map f (stringToCharacters s));
-  concatMapStrings = f: list: concatStrings (map f list);
-  concatStrings = builtins.concatStringsSep "";
-
-  # https://github.com/NixOS/nixpkgs/blob/8a9f58a375c401b96da862d969f66429def1d118/lib/attrsets.nix#L331
-  optionalAttrs = cond: as: if cond then as else {};
-
-  # fetchTarball version that is compatible between all the versions of Nix
-  builtins_fetchTarball = { url, name ? null, sha256 }@attrs:
-    let
-      inherit (builtins) lessThan nixVersion fetchTarball;
-    in
-      if lessThan nixVersion "1.12" then
-        fetchTarball ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; }))
-      else
-        fetchTarball attrs;
-
-  # fetchurl version that is compatible between all the versions of Nix
-  builtins_fetchurl = { url, name ? null, sha256 }@attrs:
-    let
-      inherit (builtins) lessThan nixVersion fetchurl;
-    in
-      if lessThan nixVersion "1.12" then
-        fetchurl ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; }))
-      else
-        fetchurl attrs;
-
-  # Create the final "sources" from the config
-  mkSources = config:
-    mapAttrs (
-      name: spec:
-        if builtins.hasAttr "outPath" spec
-        then abort
-          "The values in sources.json should not have an 'outPath' attribute"
-        else
-          spec // { outPath = replace name (fetch config.pkgs name spec); }
-    ) config.sources;
-
-  # The "config" used by the fetchers
-  mkConfig =
-    { sourcesFile ? if builtins.pathExists ./sources.json then ./sources.json else null
-    , sources ? if isNull sourcesFile then {} else builtins.fromJSON (builtins.readFile sourcesFile)
-    , system ? builtins.currentSystem
-    , pkgs ? mkPkgs sources system
-    }: rec {
-      # The sources, i.e. the attribute set of spec name to spec
-      inherit sources;
-
-      # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers
-      inherit pkgs;
-    };
-
-in
-mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); }

nix/users/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  imports = [ ./walkah ];
+}

nix/users/walkah/default.nix

@@ -0,0 +1,27 @@
+{ lib, pkgs, ... }:
+
+{
+  users.users.walkah = {
+    home = if pkgs.stdenv.isDarwin then "/Users/walkah" else "/home/walkah";
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM8YMax7PGIrcPNIHkpuNRFgn3HJK6Wepm+ycZWO6jfR walkah@walkah-ipadpro11"
+    ];
+  }
+  // lib.optionalAttrs pkgs.stdenv.isLinux {
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    group = "walkah";
+    isNormalUser = true;
+  };
+  users.groups.walkah = { };
+
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    users.walkah = import ./home.nix;
+  };
+}

nix/users/walkah/home.nix

@@ -0,0 +1,30 @@
+{ lib, pkgs, ... }:
+{
+  home = {
+    packages = with pkgs; [
+      chezmoi
+      bat
+      direnv
+      eza
+      fd
+      fzf
+      git
+      htop
+      jq
+      starship
+      tmux
+    ];
+
+    activation.chezmoi = lib.hm.dag.entryAfter [ "installPackages" ] ''
+      export SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+      export PATH="${pkgs.git}/bin:${pkgs.openssh}/bin:$PATH"
+      if [ ! -d $HOME/.local/share/chezmoi ]; then
+        $DRY_RUN_CMD ${pkgs.chezmoi}/bin/chezmoi init --apply walkah/dotfiles
+      else
+        $DRY_RUN_CMD ${pkgs.chezmoi}/bin/chezmoi update --apply
+      fi
+    '';
+
+    stateVersion = "24.05";
+  };
+}

ops/aristotle.nix

@@ -1,39 +0,0 @@
-{
-  network = { description = "RPi 4 cluster"; };
-
-  agent = { config, pkgs, ... }: {
-    imports = [ ../hosts/aristotle/configuration.nix ];
-    networking.hostName = "agent";
-    nixpkgs.system = "aarch64-linux";
-
-    deployment.targetHost = "agent";
-    deployment.targetUser = "root";
-  };
-
-  form = { config, pkgs, ... }: {
-    imports = [ ../hosts/aristotle/configuration.nix ];
-    networking.hostName = "form";
-    nixpkgs.system = "aarch64-linux";
-
-    deployment.targetHost = "form";
-    deployment.targetUser = "root";
-  };
-
-  matter = { config, pkgs, ... }: {
-    imports = [ ../hosts/aristotle/configuration.nix ];
-    networking.hostName = "matter";
-    nixpkgs.system = "aarch64-linux";
-
-    deployment.targetHost = "matter";
-    deployment.targetUser = "root";
-  };
-
-  purpose = { config, pkgs, ... }: {
-    imports = [ ../hosts/aristotle/configuration.nix ];
-    networking.hostName = "purpose";
-    nixpkgs.system = "aarch64-linux";
-
-    deployment.targetHost = "purpose";
-    deployment.targetUser = "root";
-  };
-}

ops/plato.nix

@@ -1,12 +0,0 @@
-{
-  network = { description = "Main dev server"; };
-
-  plato = { config, pkgs, ... }: {
-    imports = [ ../hosts/plato/configuration.nix ];
-    networking.hostName = "plato";
-    nixpkgs.system = "x86_64-linux";
-
-    deployment.targetHost = "plato";
-    deployment.targetUser = "root";
-  };
-}

ops/socrates.nix

@@ -1,12 +0,0 @@
-{
-  network = { description = "Digital Ocean droplet"; };
-
-  socrates = { config, pkgs, ... }: {
-    imports = [ ../hosts/socrates/configuration.nix ];
-    networking.hostName = "socrates";
-    nixpkgs.system = "x86_64-linux";
-
-    deployment.targetHost = "socrates";
-    deployment.targetUser = "root";
-  };
-}

overlays/default.nix

@@ -1 +0,0 @@
-self: super: { }

secrets/secrets.yaml

@@ -1,67 +0,0 @@
-matrix-registration-secret: ENC[AES256_GCM,data:Sn3pGBq4U3Tgw0pYaetnBLRiNdFGnMxAxyfrxhF9kFDMFijKSy9XBj71M5XxV4shYQyPvu2WDnPR1YvyoQVlv8cEoXhX7++JlYsp/2ZfKIzp4iMxh24z57Cw8vg=,iv:/zxlIeI9gWWCHbejYgz8pjjOrukKome0/bmcXuG3/yE=,tag:3fc3c96H3pO1FUO7p3T4gw==,type:str]
-ipfs-cluster-secret: ENC[AES256_GCM,data:Z9i7ZLhlXw4m8myNUSiY5ej2/6UIwCwIe0bvbCttVLdv8cAHwzR2f22poKD6KnPBe9yaym+X3YtrHTCM4pVIbiSzMsHwYZ00vRQi35ZmYg==,iv:9PBz/olzA4X7JEL1xG8ACUaH1WDHSzApzlG5q0ZqSYk=,tag:9I4PGf91MHAKNeG4fVKIow==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXNkhRdXhFTVkxVTNVTlhK
-            d0xiQ3VmcURreWFzVGxVb0RPK2RNMGVob2g0CnBkZzF4U0FrWVVVbW03Umliby9P
-            djNUKzFWbW0xR1QyOUh3d2g5SjNsUW8KLS0tIGRhamZvOERxUmxDdDNHM1ZUbzdZ
-            UjJUQS9vL2ZkQ3NCd1VwLzRMQS9Xc0EKKcGxURwN3ejTk41W/q5VVrhalPO4GOdr
-            JvdxH7OIn+u/8KNNXgKOPV8Iss35Mu4geSh1zJXPVf+YhTZNq8C2jQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTkxOWEo0Nk9iMy8zUGFP
-            endwS2NQQWJnVmo3RTNyYiszMndtSGNZUjFJCmZzUTZidmNWVGxVWDduUldMaXV4
-            SnZTMTZaU3FUNFpwbjBTQk94azhRZ2sKLS0tIDU1R1cwZDJQZW5qcXkyLzZIQitV
-            ZUptMXcvcXhkNUdRZDc2WmF3c2tLeXMKnicAN5U1KO/vhJxGgv/oHGPJ4mEoVogL
-            Gv5RTCKMwfHgdEHOUPbq/kPz0eTc9R57XsfhA7DHpgZAxo86gZNqOg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1vc8svd5277rjkgzg7frf04uaa45w3crhfvg628rqyrqmxul3q9nsjz6yxk
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNcjdmckwyVVJkQXpScTU2
-            WWt1MHFhTExxbCtwT1ZGWlZRZ3orRmZpYUZjCmNySmRVWkV4TEIyU09SUXNLdGFZ
-            VjN5RFhwelFvVW1PR04rQ3NyU0trVHcKLS0tIDVZZGt5TnZNU21PbE9PZVVtTUdI
-            eXhsWlkwa3l2Zk9KTkc0dzZpajFxVmcKTmhGMdS0Uq32P5I+X+8h4ve/KHvHWA/a
-            Juu+VjGRe7hm0pWOutDQPbL6o8l+wij2ugDsNy3LKHbWs4lM5VZEHg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ulmzprdmcd8r0w47a0nrrlg8melkjk6evl2rc54yh6lxkcfas36q6wrsv9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5MFRGVllUM0R2VXB0bmtj
-            dXV2bDFvbmpjTktZRlpKUXRPMXdwdmRxL3o4Cmg2WjRFdTgydkd5OHp2dS9TRlhG
-            Y29NOUVEeXptYWhzMGVJOENrTjdpdUEKLS0tIEZzOGlsWGJPMitkTVpwTC82Uzdh
-            NDhRVGQweXhEdFk4bHQxOWFOSmxNYVkKlb9KvHfUnM7uApzed5zvFPh7X8QMbdE/
-            VSlmccOG1zlbstbr4mU/Xu+52FMBsp8UEkK29y07uhZQEh/txI9Wwg==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1lfjkch3pqaq3uwmjxyucpm2tws6llxqqjglj4yn49jkwkf50xvmqrl974e
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSWRSdGUvRnFuZUtPcG9T
-            N3FsWldiOTBLUXQ0SHd1UTk2T3ArNkpaN3l3CnBtN1o0SGY5S1Z3WnVhcVYrRUYr
-            S0htZUh3RlQvYkV4Rmg2b3NPOFdCQkkKLS0tIEVUdVNxRnFZVlFKd3R4d1dCZk9N
-            cHo2empQdDd4TTZJckczdzU3YVJZeW8K0tFG5fMFiVqAw0HqEV3F8yV6tLV/XY2e
-            R8Rp2kAcPvBNdHZ52oKyGZNgblg5uia4mBjbvB8iXkX/z8Bddo/vCQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1jnf94uq5ap96vk7nfk3qkr38ylhletc6pskj0ypc470d7gmt0qeqskdy5z
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwYk5PazQ2U2ZiYU03K28v
-            elhtQjllbThwOE5Ockd4S1B6Z1AvNmNjcXlrCmZyTzMyUWFmcEZGazRWTG40bmJI
-            TXkvOXpWVW1TYkcxckRtT3N6Y1BuZEUKLS0tIDBPRkJ0M3Y2T1NxN0RtbW1aNUhL
-            alB4LzZGSTJmUEt0TFBkUTdzR1pOOTQKG8T65JhLKx602YnEmG/Gqi/rY8X/9XgF
-            61ejhZ1DucTrM3sfUKjTFwaNVJLJgGEoPRioZW0SJkckjm5NNlutLw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2021-11-16T01:39:44Z"
-    mac: ENC[AES256_GCM,data:fDm9ReOiKh0QpKXxL+1BBj8Ewa0rGNeeacRr2L2IWeb51i6KhE+9q/9s6/x3m1z9NcR3BFrdw/yhOakYjcfrMiBtgZMwkJ+17KieKrgPz95lKD/udZeiemlimUQZn6E2HuTj8lGRw1mJLGdlSgZrAtTKYzuUezcvqtX/zmMahmw=,iv:ju81TbXRZRhGI6oGn2NSpXCMnK7PtcaHH8RmDAOjP8k=,tag:z8pt/6a1WXVOB3hndZPGJw==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.1

services/ipfs-cluster.nix

@@ -1,122 +0,0 @@
-## From https://github.com/NixOS/nixpkgs/pull/100871
-{ config, lib, pkgs, options, ... }:
-with lib;
-let
-  cfg = config.services.ipfs-cluster;
-  opt = options.services.ipfs-cluster;
-
-  # secret is by envvar, not flag
-  initFlags = toString [
-    (optionalString (cfg.initPeers != [ ]) "--peers")
-    (lib.strings.concatStringsSep "," cfg.initPeers)
-  ];
-in {
-
-  ###### interface
-
-  options = {
-
-    services.ipfs-cluster = {
-
-      enable = mkEnableOption
-        "Pinset orchestration for IPFS - requires ipfs daemon to be useful";
-
-      user = mkOption {
-        type = types.str;
-        default = "ipfs";
-        description = "User under which the ipfs-cluster daemon runs.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "ipfs";
-        description = "Group under which the ipfs-cluster daemon runs.";
-      };
-
-      consensus = mkOption {
-        type = types.enum [ "raft" "crdt" ];
-        description = "Consensus protocol - 'raft' or 'crdt'. https://cluster.ipfs.io/documentation/guides/consensus/";
-      };
-
-      dataDir = mkOption {
-        type = types.str;
-        default = "/var/lib/ipfs-cluster";
-        description = "The data dir for ipfs-cluster.";
-      };
-
-      initPeers = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        description = "Peer addresses to initialize with on first run.";
-      };
-
-      openSwarmPort = mkOption {
-        type = types.bool;
-        description = "Open swarm port, secured by the cluster secret. This does not expose the API or proxy. https://cluster.ipfs.io/documentation/guides/security/";
-      };
-
-      secretFile = mkOption {
-        type = types.nullOr types.path;
-        default = null;
-        description = ''
-          File containing the cluster secret in the format of EnvironmentFile as described by
-          <citerefentry><refentrytitle>systemd.exec</refentrytitle>
-          <manvolnum>5</manvolnum></citerefentry>. For example:
-          <programlisting>
-          CLUSTER_SECRET=<replaceable>...</replaceable>
-          </programlisting>
-
-          if null, a new secret will be generated on first run.
-          A secret in the correct format can also be generated by: openssl rand -hex 32
-        '';
-      };
-    };
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.ipfs-cluster ];
-
-
-    systemd.tmpfiles.rules =
-      [ "d '${cfg.dataDir}' - ${cfg.user} ${cfg.group} - -" ];
-
-    systemd.services.ipfs-cluster-init = {
-      path = [ "/run/wrappers" pkgs.ipfs-cluster ];
-      environment.IPFS_CLUSTER_PATH = cfg.dataDir;
-      wantedBy = [ "default.target" ];
-
-      serviceConfig = {
-        # "" clears exec list (man systemd.service -> execStart)
-        ExecStart = [
-          ""
-          "${pkgs.ipfs-cluster}/bin/ipfs-cluster-service init --consensus ${cfg.consensus} ${initFlags}"
-        ];
-        Type = "oneshot";
-        RemainAfterExit = true;
-        User = cfg.user;
-        Group = cfg.group;
-        } // optionalAttrs (cfg.secretFile != null) {
-          EnvironmentFile = cfg.secretFile;
-        };
-      unitConfig.ConditionDirectoryNotEmpty = "!${cfg.dataDir}";
-    };
-
-    systemd.services.ipfs-cluster = {
-      environment.IPFS_CLUSTER_PATH = cfg.dataDir;
-      wantedBy = [ "multi-user.target" ];
-
-      wants = [ "ipfs-cluster-init.service" ];
-      after = [ "ipfs-cluster-init.service" ];
-
-      serviceConfig = {
-        ExecStart =
-          [ "" "${pkgs.ipfs-cluster}/bin/ipfs-cluster-service daemon" ];
-        User = cfg.user;
-        Group = cfg.group;
-      };
-    };
-    networking.firewall.allowedTCPPorts = mkIf cfg.openSwarmPort [ 9096 ];
-  };
-}

shell.nix

@@ -1,19 +1,14 @@
-let
-  sources = import ./nix/sources.nix;
-  pkgs = import sources.nixpkgs {
-    overlays = [ (import ./overlays) ];
-    config = { };
-  };
-in
-pkgs.mkShell {
-  name = "athens";
-  buildInputs = [
-    pkgs.age
-    pkgs.morph
-    pkgs.sops
-  ];
-
-  shellHook = ''
-    export NIX_PATH="nixpkgs=${sources.nixpkgs}:home-manager=${sources.home-manager}:."
-  '';
-}
+(import
+  (
+    let
+      lock = builtins.fromJSON (builtins.readFile ./flake.lock);
+    in
+    fetchTarball {
+      url = "https://github.com/edolstra/flake-compat/archive/${lock.nodes.flake-compat.locked.rev}.tar.gz";
+      sha256 = lock.nodes.flake-compat.locked.narHash;
+    }
+  )
+  {
+    src = ./.;
+  }
+).shellNix

terraform/.terraform.lock.hcl

@@ -0,0 +1,49 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/cloudflare/cloudflare" {
+  version     = "4.52.0"
+  constraints = "~> 4.0"
+  hashes = [
+    "h1:Pi5M+GeoMSN2eJ6QnIeXjBf19O+rby/74CfB2ocpv20=",
+    "zh:19be1a91c982b902c42aba47766860dfa5dc151eed1e95fd39ca642229381ef0",
+    "zh:1de451c4d1ecf7efbe67b6dace3426ba810711afdd644b0f1b870364c8ae91f8",
+    "zh:352b4a2120173298622e669258744554339d959ac3a95607b117a48ee4a83238",
+    "zh:3c6f1346d9154afbd2d558fabb4b0150fc8d559aa961254144fe1bc17fe6032f",
+    "zh:4c4c92d53fb535b1e0eff26f222bbd627b97d3b4c891ec9c321268676d06152f",
+    "zh:53276f68006c9ceb7cdb10a6ccf91a5c1eadd1407a28edb5741e84e88d7e29e8",
+    "zh:7925a97773948171a63d4f65bb81ee92fd6d07a447e36012977313293a5435c9",
+    "zh:7dfb0a4496cfe032437386d0a2cd9229a1956e9c30bd920923c141b0f0440060",
+    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
+    "zh:8d4aa79f0a414bb4163d771063c70cd991c8fac6c766e685bac2ee12903c5bd6",
+    "zh:a67540c13565616a7e7e51ee9366e88b0dc60046e1d75c72680e150bd02725bb",
+    "zh:a936383a4767f5393f38f622e92bf2d0c03fe04b69c284951f27345766c7b31b",
+    "zh:d4887d73c466ff036eecf50ad6404ba38fd82ea4855296b1846d244b0f13c380",
+    "zh:e9093c8bd5b6cd99c81666e315197791781b8f93afa14fc2e0f732d1bb2a44b7",
+    "zh:efd3b3f1ec59a37f635aa1d4efcf178734c2fcf8ddb0d56ea690bec342da8672",
+  ]
+}
+
+provider "registry.opentofu.org/digitalocean/digitalocean" {
+  version     = "2.49.2"
+  constraints = "~> 2.0"
+  hashes = [
+    "h1:JzS2Y+M1FEMa7/wbKqiCsLSfcUC/HAg9Cq+3HeJuZgo=",
+    "zh:0fdf521cd264fa17ade903673a96e30b017da1970950d7566d8efaeb7eeaa051",
+    "zh:1457402e4c5e588e1fc7dc4f360e994c06ab84b4822186e5d67cccef80d817de",
+    "zh:1b5f1e524cc74c8c9bfe214950972c054ddb24424b396b2c25a932938408dde5",
+    "zh:293f45fbed53f41b18b4212dee571617cd2968793aedb477958a0b01d640cfbc",
+    "zh:316dd02bc81d6aeea5fd38c0fe6819fc13696a5f239111e93f9c9730491c2df4",
+    "zh:32fa7a2a88a50f93025d9ece6b7d755e5c7931fc14f8336341c0939616224523",
+    "zh:52a977f7ecd480ca03a4a6821afa2de893966a8baa38834b1570ec2ae5b71ec9",
+    "zh:8c733467ff87aa98495a1c8cdb83d6c6fbaa93a329ff6611ef8ff11d86801321",
+    "zh:93352fe00a2ada0f188e8669c61283b708a602e10aa7d5ddda9302b24b47fe14",
+    "zh:9357cf59572b21c4b9d85c6cb22facf9d82cf037f8674b884b3a7be66a06f598",
+    "zh:a3286ecb621e052fba29c26737b093329c5bcd99d7d7c8fc470ce4695b129abd",
+    "zh:b66b7b8e37c3614a3e4083b118e6d0de63b90029471a94e5cbb7f44c6d36330d",
+    "zh:d06dd42935819ea454516edd24f980ca6c1e18ebb3c3e47f8ff4f4ef68fb06e4",
+    "zh:d89490c30f3e4f097d71af5075b126e5ec13983f3072275a5c0c468bf0df8a57",
+    "zh:de7d8114938c52920426ae94451edb26ba98583712545c480a69308506ec6a72",
+    "zh:f6a55d865a3f4ec3a79359bd30e4ef6e2742f1e02a1d934e44b41b092155fc45",
+  ]
+}

terraform/cloudflare_dns.tf

@@ -0,0 +1,17 @@
+locals {
+  account_id = "273a4698f673c012fd50161e46ceafdb"
+}
+
+resource "cloudflare_zone" "walkah_codes" {
+  account_id = local.account_id
+  zone       = "walkah.codes"
+}
+
+resource "cloudflare_record" "walkah_codes" {
+  zone_id = cloudflare_zone.walkah_codes.id
+  name    = "walkah.codes"
+  type    = "A"
+  proxied = true
+  content = digitalocean_droplet.socrates.ipv4_address
+}
+

terraform/digitalocean_droplets.tf

@@ -0,0 +1,9 @@
+
+resource "digitalocean_droplet" "socrates" {
+  name       = "socrates"
+  image      = "72067660"
+  size       = "s-8vcpu-16gb"
+  backups    = true
+  ipv6       = true
+  monitoring = true
+}

terraform/main.tf

@@ -0,0 +1,21 @@
+terraform {
+  required_version = ">= 1.8.0"
+
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4.0"
+    }
+    digitalocean = {
+      source  = "digitalocean/digitalocean"
+      version = "~> 2.0"
+    }
+  }
+}
+
+provider "cloudflare" {
+  api_token = var.cloudflare_token
+}
+provider "digitalocean" {
+  token = var.do_token
+}

terraform/variables.tf

@@ -0,0 +1,6 @@
+variable "cloudflare_token" {
+  type = string
+}
+variable "do_token" {
+  type = string
+}