⬆️ version bump

NOTE: maybe just remove it?

.gitignore

@@ -1,5 +1,7 @@
 /.direnv
 /result
 /.pre-commit-config.yaml
-/.devenv/
 /node_modules/
+.terraform
+*.tfvars
+*.tfstate*

.sops.yaml

@@ -1,10 +1,10 @@
 keys:
   - &walkah age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
   - &plato age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
-  - &agent age1vc8svd5277rjkgzg7frf04uaa45w3crhfvg628rqyrqmxul3q9nsjz6yxk
-  - &form age1ulmzprdmcd8r0w47a0nrrlg8melkjk6evl2rc54yh6lxkcfas36q6wrsv9
-  - &matter age1lfjkch3pqaq3uwmjxyucpm2tws6llxqqjglj4yn49jkwkf50xvmqrl974e
-  - &purpose age1jnf94uq5ap96vk7nfk3qkr38ylhletc6pskj0ypc470d7gmt0qeqskdy5z
+  - &agent age1pn2hnqvgt7rvfglxddlj3jwrm79rvmutmexkpxv4frdnznlel33qvfy6u5
+  - &form age1mnrl9u8vpdjncge33pg7quakl0qdf5dlfgch87jhrs0wrvup4s0s5xh7ly
+  - &matter age1tt0gwcm03zmpelerpph49knn8f6t8z7aq9una2qys76kf4rwxpnquxkvz3
+  - &purpose age1px55dk5n3whfdyshzyxqmyjvqdmv9au6myx6w67jw3cqp9sdx9rsa6xep9
   - &socrates age12wakcnv487c5rkgv7z6umzywrqwcy6dgguq0dug6lxp64scjsq6sspkmgz
 creation_rules:
   - path_regex: secrets/[^/]+\.yaml$

Pulumi.dev.yaml

@@ -1,3 +0,0 @@
-config:
-  digitalocean:token:
-    secure: AAABAAVsdUUt74fFhXPNy+qr0l0Ciku2PfjJY43XTfWG3YlseqFUGW3RmpGPk6CyXtkyQu321goZlaoLISy+75t/1tmKzdPzew5N46WfLybPAe7mANOCukPybLqhfKnJxQSgDfvQjw==

Pulumi.yaml

@@ -1,3 +0,0 @@
-name: athens
-runtime: nodejs
-description: city state in the cloud

default.nix

@@ -10,4 +10,5 @@
   )
   {
     src = ./.;
-  }).defaultNix
+  }
+).defaultNix

flake.nix

@@ -3,13 +3,16 @@
 
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
-    nixos-hardware.url = "github:NixOS/nixos-hardware/master";
-    home-manager.url = "github:nix-community/home-manager";
-    flake-utils.url = "github:numtide/flake-utils";
-    deploy-rs.url = "github:serokell/deploy-rs";
+    systems.url = "github:nix-systems/default";
+    raspberry-pi-nix.url = "github:nix-community/raspberry-pi-nix";
 
     darwin = {
-      url = "github:lnl7/nix-darwin/master";
+      url = "github:nix-darwin/nix-darwin/master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    home-manager = {
+      url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -18,208 +21,65 @@
       flake = false;
     };
 
-    sops-nix = {
-      url = "github:Mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-
     nixos-generators = {
       url = "github:nix-community/nixos-generators";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    devenv.url = "github:cachix/devenv/latest";
-
-    # My stuff
-    dotfiles = {
-      url = "github:walkah/dotfiles";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.home-manager.follows = "home-manager";
-      inputs.flake-utils.follows = "flake-utils";
-    };
-
-    workon = {
-      url = "github:walkah/workon";
+    pre-commit-hooks = {
+      url = "github:cachix/git-hooks.nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    fission.url = "github:fission-codes/nix-overlay";
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs =
-    { self
-    , nixpkgs
-    , deploy-rs
-    , darwin
-    , flake-utils
-    , nixos-generators
-    , home-manager
-    , devenv
-    , dotfiles
-    , workon
-    , fission
-    , ...
+    {
+      self,
+      nixpkgs,
+      pre-commit-hooks,
+      systems,
+      ...
     }@inputs:
     let
-      overlays = [
-        (self: _super: {
-          workon = workon.packages.${self.system}.default;
-          devenv = devenv.packages.${self.system}.devenv;
-        })
-        fission.overlay
-      ];
-
-      mkSystem = hostName: system: modules:
-        nixpkgs.lib.nixosSystem {
-          inherit system;
-          modules = [
-            home-manager.nixosModules.home-manager
-            (_: {
-              networking.hostName = hostName;
-              nixpkgs.overlays = overlays;
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-            })
-          ] ++ modules;
-          specialArgs = inputs;
-        };
-      mkDarwin = hostName: system: modules:
-        darwin.lib.darwinSystem {
-          inherit system;
-          modules = [
-            home-manager.darwinModules.home-manager
-            (_: {
-              networking.hostName = hostName;
-              nixpkgs.overlays = overlays;
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-            })
-          ] ++ modules;
-          specialArgs = inputs;
-        };
+      forAllSystems =
+        fn: nixpkgs.lib.genAttrs (import systems) (system: fn system nixpkgs.legacyPackages.${system});
     in
-    flake-utils.lib.eachDefaultSystem
-      (system:
-      let
-        pkgs = nixpkgs.legacyPackages.${system};
-        darwin-local = pkgs.writeScriptBin "darwin-local" ''
-          #!${pkgs.stdenv.shell}
-          nix build .#darwinConfigurations.$(hostname -s).system
-          ./result/sw/bin/darwin-rebuild switch --flake .
-        '';
+    {
+      checks = forAllSystems (
+        system: pkgs:
+        import ./nix/checks.nix {
+          inherit
+            self
+            pkgs
+            pre-commit-hooks
+            system
+            ;
+        }
+      );
+      devShells = forAllSystems (system: pkgs: import ./nix/shells.nix { inherit self pkgs system; });
+      formatter = forAllSystems (_: pkgs: pkgs.nixfmt-tree);
+    }
+    // {
+      hosts = import ./nix/hosts.nix;
+      overlays.default = nixpkgs.lib.composeManyExtensions [ ];
 
-      in
-      {
+      darwinConfigurations = import ./nix/darwin.nix inputs;
+      nixosConfigurations = import ./nix/nixos.nix inputs;
 
-        packages = {
-          digitalocean = nixos-generators.nixosGenerate {
-            system = "x86_64-linux";
-            format = "do";
-            modules = [
-              ./modules/base
-              ./users
-            ];
-          };
-        };
-
-        devShells.default = pkgs.mkShell {
-          name = "athens";
-          buildInputs = [ darwin-local deploy-rs.packages.${system}.deploy-rs pkgs.nixpkgs-fmt pkgs.rnix-lsp pkgs.sops ];
-        };
-
-        formatter = pkgs.nixpkgs-fmt;
-      }) // {
-      nixosConfigurations = {
-        # Aristotle
-        agent = mkSystem "agent" "aarch64-linux" [ ./hosts/aristotle/configuration.nix ];
-        form = mkSystem "form" "aarch64-linux" [ ./hosts/aristotle/configuration.nix ];
-        matter = mkSystem "matter" "aarch64-linux" [ ./hosts/aristotle/configuration.nix ];
-        purpose = mkSystem "purpose" "aarch64-linux" [ ./hosts/aristotle/configuration.nix ];
-
-        plato = mkSystem "plato" "x86_64-linux" [ ./hosts/plato/configuration.nix ];
-        socrates = mkSystem "socrates" "x86_64-linux" [ ./hosts/socrates/configuration.nix ];
-      };
-      darwinConfigurations = {
-        epicurus = mkDarwin "epicurus" "aarch64-darwin" [ ./hosts/epicurus/darwin-configuration.nix ];
-        heraclitus = mkDarwin "heraclitus" "aarch64-darwin" [ ./hosts/heraclitus/darwin-configuration.nix ];
-      };
-      homeConfigurations = {
-        "walkah@epicurus" = dotfiles.homeConfigurations.aarch64-darwin.walkah;
-        "walkah@heraclitus" = dotfiles.homeConfigurations.aarch64-darwin.walkah;
-      };
-
-      deploy.nodes = {
-        agent = {
-          hostname = "agent";
-          sshUser = "root";
-          profiles.system = {
-            user = "root";
-            path = deploy-rs.lib.aarch64-linux.activate.nixos
-              self.nixosConfigurations.agent;
-          };
-        };
-
-        form = {
-          hostname = "form";
-          sshUser = "root";
-          profiles.system = {
-            user = "root";
-            path = deploy-rs.lib.aarch64-linux.activate.nixos
-              self.nixosConfigurations.form;
-          };
-        };
-
-        matter = {
-          hostname = "matter";
-          sshUser = "root";
-          profiles.system = {
-            user = "root";
-            path = deploy-rs.lib.aarch64-linux.activate.nixos
-              self.nixosConfigurations.matter;
-          };
-        };
-
-        purpose = {
-          hostname = "purpose";
-          sshUser = "root";
-          profiles.system = {
-            user = "root";
-            path = deploy-rs.lib.aarch64-linux.activate.nixos
-              self.nixosConfigurations.purpose;
-          };
-        };
-
-        plato = {
-          hostname = "plato";
-          profiles = {
-            system = {
-              user = "root";
-              path = deploy-rs.lib.x86_64-linux.activate.nixos
-                self.nixosConfigurations.plato;
-            };
-            walkah = {
-              user = "walkah";
-              path = deploy-rs.lib.x86_64-linux.activate.home-manager
-                dotfiles.homeConfigurations.x86_64-linux.walkah;
-            };
-          };
-        };
-
-        socrates = {
-          hostname = "socrates";
-          profiles = {
-            system = {
-              user = "root";
-              path = deploy-rs.lib.x86_64-linux.activate.nixos
-                self.nixosConfigurations.socrates;
-            };
-            walkah = {
-              user = "walkah";
-              path = deploy-rs.lib.x86_64-linux.activate.home-manager
-                dotfiles.homeConfigurations.x86_64-linux.walkah;
-            };
-          };
-        };
+      nixConfig = {
+        extra-substituters = [
+          "https://walkah.cachix.org"
+          "https://nix-community.cachix.org"
+        ];
+        extra-trusted-public-keys = [
+          "walkah.cachix.org-1:D8cO78JoJC6UPV1ZMgd1V5znpk3jNUERGIeAKN15hxo="
+          "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        ];
       };
     };
 }

hosts/aristotle/configuration.nix

@@ -1,61 +0,0 @@
-{ pkgs, nixos-hardware, ... }:
-
-{
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    nixos-hardware.nixosModules.raspberry-pi-4
-
-    ../../modules/base
-    ../../modules/ipfs/cluster.nix
-    ../../modules/sops
-  ];
-
-  nixpkgs.overlays = [ (import ../../overlays) ];
-
-  # Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
-  boot.loader.grub.enable = false;
-  # Enables the generation of /boot/extlinux/extlinux.conf
-  boot.loader.generic-extlinux-compatible.enable = false;
-
-  boot.kernelPackages = pkgs.linuxPackages_rpi4;
-  boot.loader.raspberryPi = {
-    enable = true;
-    version = 4;
-  };
-
-  # networking.hostName = "nixos"; # Define your hostname.
-  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
-
-  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
-  # Per-interface useDHCP will be mandatory in the future, so this generated config
-  # replicates the default behaviour.
-  networking.useDHCP = false;
-  networking.interfaces.eth0.useDHCP = true;
-  networking.interfaces.wlan0.useDHCP = true;
-  networking.firewall.enable = false;
-
-  # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
-  ];
-
-  environment.systemPackages = with pkgs; [ libraspberrypi ];
-
-  services = {
-    prometheus = {
-      enable = true;
-      port = 9090;
-      exporters = {
-        node = {
-          enable = true;
-          enabledCollectors = [ "systemd" ];
-          openFirewall = true;
-          port = 9100;
-        };
-      };
-    };
-    tailscale = { enable = true; };
-  };
-}

hosts/epicurus/darwin-configuration.nix

@@ -1,23 +0,0 @@
-{ pkgs, ... }:
-{
-  imports = [
-    ./homebrew.nix
-
-    ../../modules/base/darwin.nix
-    ../../modules/builder
-    ../../modules/dev
-  ];
-
-  # List packages installed in system profile. To search by name, run:
-  # $ nix-env -qaP | grep wget
-  environment.systemPackages = with pkgs; [ emacs-nox ];
-
-  # Use a custom configuration.nix location.
-  # $ darwin-rebuild switch -I darwin-config=$HOME/.config/nixpkgs/darwin/configuration.nix
-  # environment.darwinConfig = "$HOME/.config/nixpkgs/darwin/configuration.nix";
-
-  # Auto upgrade nix package and the daemon service.
-  services.nix-daemon.enable = true;
-
-  services.lorri.enable = true;
-}

hosts/heraclitus/darwin-configuration.nix

@@ -1,36 +0,0 @@
-{ config, pkgs, ... }:
-{
-  imports = [
-    ./homebrew.nix
-
-    ../../modules/base/darwin.nix
-    ../../modules/dev
-    ../../modules/builder
-
-    ../../services/ipfs-darwin.nix
-  ];
-
-  nixpkgs.config.allowBroken = true;
-
-  # List packages installed in system profile. To search by name, run:
-  # $ nix-env -qaP | grep wget
-  # environment.systemPackages = with pkgs; [ emacs ];
-
-  # Auto upgrade nix package and the daemon service.
-  services.nix-daemon.enable = true;
-
-  services.lorri.enable = true;
-  services.ipfs = {
-    enable = true;
-    package = pkgs.kubo_carmirror;
-  };
-
-  system = {
-    defaults = {
-      dock = {
-        autohide = true;
-        orientation = "left";
-      };
-    };
-  };
-}

hosts/heraclitus/homebrew.nix

@@ -1,66 +0,0 @@
-_:
-
-{
-  homebrew = {
-    taps = [
-      "homebrew/cask"
-      "homebrew/cask-drivers"
-      "homebrew/cask-fonts"
-      "homebrew/cask-versions"
-      "homebrew/services"
-    ];
-
-    brews = [ "coreutils" "fontconfig" ];
-
-    casks = [
-      "1password"
-      "bartender"
-      "beeper"
-      "brave-browser"
-      "bunch"
-      "calibre"
-      "discord"
-      "docker"
-      "element"
-      "fantastical"
-      "figma"
-      "firefox"
-      "firefox-developer-edition"
-      "font-jetbrains-mono"
-      "font-jetbrains-mono-nerd-font"
-      "google-chrome"
-      "gpg-suite"
-      "hazel"
-      "iterm2"
-      "logi-options-plus"
-      "logseq"
-      "loom"
-      "microsoft-edge"
-      "minecraft"
-      "obsidian"
-      "plexamp"
-      "raycast"
-      "signal"
-      "slack"
-      "sonos"
-      "spotify"
-      "stats"
-      "steam"
-      "syncthing"
-      "synology-drive"
-      "todoist"
-      "visual-studio-code"
-      "zoom"
-    ];
-
-    masApps = {
-      OnePasswordSafari = 1569813296;
-      Bumpr = 1166066070;
-      DayOne = 1055511498;
-      Drafts = 1435957248;
-      HomeAssistant = 1099568401;
-      Tailscale = 1475387142;
-      Xcode = 497799835;
-    };
-  };
-}

hosts/plato/configuration.nix

@@ -1,174 +0,0 @@
-{ config, pkgs, ... }: {
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ../../users
-
-    ../../modules/base
-    ../../modules/coredns
-    ../../modules/drone
-    ../../modules/drone/runner-docker.nix
-    ../../modules/gitea
-    ../../modules/matrix
-    ../../modules/minecraft
-    ../../modules/postgresql
-    ../../modules/sops
-    ../../modules/traefik
-  ];
-
-  # Use the systemd-boot EFI boot loader.
-  boot.loader.systemd-boot.enable = true;
-  boot.loader.systemd-boot.configurationLimit = 3;
-  boot.loader.efi.canTouchEfiVariables = true;
-  boot.tmp.cleanOnBoot = true;
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
-
-  nixpkgs.config.allowUnfree = true;
-  nixpkgs.overlays = [ (import ../../overlays) ];
-
-  nix.extraOptions = ''
-    experimental-features = nix-command flakes
-  '';
-
-  # Set your time zone.
-  time.timeZone = "America/Toronto";
-
-  networking.hostName = "plato"; # Define your hostname.
-  networking.useDHCP = false;
-  networking.interfaces.enp10s0.useDHCP = true;
-  networking.interfaces.enp9s0.useDHCP = true;
-
-  security.sudo.wheelNeedsPassword = false;
-
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC5spf4diguK+w7iYLFr565++6DjHukWfvpN2ru9dCRk nixbuild"
-  ];
-
-  system.autoUpgrade.enable = false;
-  environment.systemPackages = with pkgs; [ pinentry weechat ];
-
-  fileSystems."/mnt/downloads" = {
-    device = "192.168.6.100:/volume1/Downloads";
-    fsType = "nfs";
-  };
-  fileSystems."/mnt/music" = {
-    device = "192.168.6.100:/volume1/Music";
-    fsType = "nfs";
-  };
-  fileSystems."/mnt/video" = {
-    device = "192.168.6.100:/volume1/Video";
-    fsType = "nfs";
-  };
-
-  power.ups = {
-    enable = true;
-    mode = "standalone";
-    ups."cyberpower" = {
-      description = "Cyberpower EC650LCD";
-      driver = "usbhid-ups";
-      port = "auto";
-    };
-  };
-
-  programs.gnupg.agent = {
-    enable = true;
-    enableSSHSupport = true;
-    pinentryFlavor = "curses";
-  };
-
-  # Enable the OpenSSH daemon.
-  services.openssh.enable = true;
-
-  services.tailscale = {
-    enable = true;
-    useRoutingFeatures = "server";
-  };
-
-  virtualisation.docker = {
-    enable = true;
-    # Clean docker images periodically
-    autoPrune = {
-      enable = true;
-      flags = [ "--all" ];
-    };
-  };
-
-  # Open ports in the firewall.
-  # networking.firewall.allowedTCPPorts = [ ... ];
-  # networking.firewall.allowedUDPPorts = [ ... ];
-  # Or disable the firewall altogether.
-  networking.firewall.enable = false;
-
-  walkah.coredns = { enable = true; };
-  services = {
-    borgbackup.jobs."borgbase" = {
-      paths = [
-        "/var/lib"
-        "/var/backup"
-      ];
-      exclude = [
-        # very large paths
-        "/var/lib/docker"
-        "/var/lib/postgresql"
-        "/var/lib/systemd"
-      ];
-      repo = "qxflzs92@qxflzs92.repo.borgbase.com:repo";
-      encryption = {
-        mode = "repokey-blake2";
-        passCommand = "cat /root/borgbackup/passphrase";
-      };
-      environment.BORG_RSH = "ssh -i /root/borgbackup/ssh_key";
-      compression = "auto,lzma";
-      startAt = "daily";
-    };
-    grafana = {
-      enable = true;
-      settings = {
-        server = {
-          domain = "plato.walkah.lab";
-          http_port = 2342;
-          http_addr = "0.0.0.0";
-        };
-      };
-    };
-    prometheus = {
-      enable = true;
-      port = 9090;
-      exporters = {
-        node = {
-          enable = true;
-          enabledCollectors = [ "systemd" ];
-          port = 9100;
-        };
-      };
-
-      scrapeConfigs = [
-        {
-          job_name = "node";
-          static_configs = [{
-            targets = [
-              "plato:9100"
-              "agent:9100"
-              "form:9100"
-              "matter:9100"
-              "purpose:9100"
-              "socrates:9100"
-            ];
-          }];
-        }
-        {
-          job_name = "coredns";
-          static_configs = [{ targets = [ "plato:9153" ]; }];
-        }
-        {
-          job_name = "ipfs";
-          metrics_path = "/debug/metrics/prometheus";
-          static_configs = [{
-            targets = [ "agent:5001" "form:5001" "matter:5001" "purpose:5001" ];
-          }];
-        }
-      ];
-    };
-  };
-}

index.ts

@@ -1,17 +0,0 @@
-import * as digitalocean from "@pulumi/digitalocean";
-
-const socrates = new digitalocean.Droplet("socrates", {
-  backups: true,
-  image: "72067660",
-  ipv6: true,
-  monitoring: true,
-  name: "socrates",
-  privateNetworking: true,
-  region: digitalocean.Region.TOR1,
-  size: digitalocean.DropletSlug.DropletS8VCPU16GB,
-  vpcUuid: "392caea6-dc7f-11e8-b1a9-3cfdfea9ee58",
-}, {
-  protect: true,
-});
-
-export const socratesIP = socrates.ipv4Address;

modules/base/default.nix

@@ -1,28 +0,0 @@
-{ pkgs, ... }: {
-
-  imports = [ ./common.nix ];
-
-  environment.systemPackages = with pkgs; [
-    inetutils
-    vim
-  ];
-
-  nix = {
-    gc = {
-      persistent = true;
-      dates = "weekly";
-    };
-
-    settings = {
-      auto-optimise-store = true;
-
-      trusted-users = [ "root" "walkah" ];
-    };
-  };
-
-  programs = {
-    mosh.enable = true;
-  };
-
-  system.stateVersion = "23.05";
-}

modules/builder/default.nix

@@ -1,11 +0,0 @@
-_:
-{
-  nix.distributedBuilds = true;
-  nix.buildMachines = [{
-    hostName = "plato";
-    systems = [ "x86_64-linux" "aarch64-linux" ];
-    maxJobs = 12;
-    speedFactor = 2;
-    supportedFeatures = [ "nixos-test" "benchmark" "big-parallel" "kvm" ];
-  }];
-}

modules/dev/default.nix

@@ -1,45 +0,0 @@
-{ pkgs, ... }:
-
-{
-  environment.systemPackages = with pkgs; [
-    emacs
-
-    # Cloud 
-    awscli2
-    pulumi-bin
-
-    # Elixir
-    elixir
-    elixir_ls
-
-    # Git / CI
-    drone-cli
-    mr
-    tea
-
-    # Golang
-    go
-    gopls
-
-    # Nix
-    cachix
-    devenv
-    niv
-    nixfmt
-    nixpkgs-fmt
-    rnix-lsp
-
-    # Node/JS
-    deno
-    nodejs
-    yarn
-
-    # Rust
-    rustup
-
-    # My stuff
-    workon
-    fission-cli
-    carmirror
-  ];
-}

modules/ipfs/gateway.nix

@@ -1,62 +0,0 @@
-{ pkgs, ... }:
-
-let
-  peers = [
-    {
-      ID = "12D3KooWMQSgdfa4tUrDhkFx4zP3ZpgT1ryj9KH5RGUae62Vsc7y";
-      Addrs = [ "/ip4/100.95.167.126/tcp/4001" ];
-    }
-    {
-      ID = "12D3KooWMqSiDukubKNKrK7J4PaF3mfNnZFVAd3Lh7qj3Y3e5bcN";
-      Addrs = [ "/ip4/100.87.220.71/tcp/4001" ];
-
-    }
-    {
-      ID = "12D3KooWGmNRyqP969QbyP8NLVRZNK2i6yCcP6N6N2r2DCG4H34v";
-      Addrs = [ "/ip4/100.126.255.109/tcp/4001" ];
-
-    }
-    {
-      ID = "12D3KooWFkR8nsG5pzffoAfMzmwBcSakXxnogVa6inRxUbpfN5ua";
-      Addrs = [ "/ip4/100.74.59.80/tcp/4001" ];
-
-    }
-  ];
-in
-{
-  imports = [ ./default.nix ];
-
-  environment.systemPackages = with pkgs; [ ipfs-migrator ];
-
-  networking.firewall = {
-    allowedTCPPorts = [ 4001 ];
-    allowedUDPPorts = [ 4001 ];
-  };
-  services = {
-    kubo = {
-      enable = true;
-      settings = {
-        Peering = { Peers = peers; };
-        Swarm = { AddrFilters = null; };
-      };
-    };
-    nginx = {
-      # IPFS Gateway
-      virtualHosts."walkah.cloud" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = { proxyPass = "http://127.0.0.1:8080"; };
-      };
-
-      # Hosted Sites
-      virtualHosts."walkah.net" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = { proxyPass = "http://127.0.0.1:8080"; };
-        serverAliases = [
-          "www.walkah.net"
-        ];
-      };
-    };
-  };
-}

modules/matrix/nginx.nix

@@ -1,39 +0,0 @@
-{ pkgs, ... }:
-
-{
-  services.nginx = {
-    enable = true;
-    virtualHosts = {
-      "matrix.walkah.chat" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = { proxyPass = "http://100.111.208.75:8008"; };
-      };
-
-      "walkah.chat" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."= /.well-known/matrix/server".extraConfig =
-          let server = { "m.server" = "matrix.walkah.chat:443"; };
-          in
-          ''
-            default_type application/json;
-            add_header Access-Control-Allow-Origin *;
-            return 200 '${builtins.toJSON server}';
-          '';
-        locations."= /.well-known/matrix/client".extraConfig =
-          let
-            client = {
-              "m.homeserver" = { "base_url" = "https://matrix.walkah.chat"; };
-            };
-          in
-          ''
-            default_type application/json;
-            add_header Access-Control-Allow-Origin *;
-            return 200 '${builtins.toJSON client}';
-          '';
-        locations."/" = { root = pkgs.element-web; };
-      };
-    };
-  };
-}

modules/minecraft/proxy.nix

@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-let
-  dest_ip = "100.111.208.75";
-in
-{
-  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
-  networking.firewall.allowedTCPPorts = [ 25565 ];
-
-  networking.firewall.extraCommands = ''
-    IPTABLES=${pkgs.iptables}/bin/iptables
-    "$IPTABLES" -t nat -A PREROUTING -p tcp --dport 25565 -j DNAT --to-destination ${dest_ip}:25565
-    "$IPTABLES" -t nat -A POSTROUTING -o tailscale0 -j MASQUERADE
-  '';
-}

modules/postgresql/default.nix

@@ -1,39 +0,0 @@
-{ pkgs, config, ... }: {
-  services = {
-    postgresql = {
-      enable = true;
-      package = pkgs.postgresql_14;
-    };
-
-    postgresqlBackup = {
-      enable = true;
-    };
-  };
-
-  # Postgres upgrades: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading
-  environment.systemPackages = [
-    (pkgs.writeScriptBin "upgrade-pg-cluster" ''
-      set -eux
-      # XXX it's perhaps advisable to stop all services that depend on postgresql
-      systemctl stop postgresql
-
-      # XXX replace `<new version>` with the psqlSchema here
-      export NEWDATA="/var/lib/postgresql/14"
-
-      # XXX specify the postgresql package you'd like to upgrade to
-      export NEWBIN="${pkgs.postgresql_14}/bin"
-
-      export OLDDATA="${config.services.postgresql.dataDir}"
-      export OLDBIN="${config.services.postgresql.package}/bin"
-
-      install -d -m 0700 -o postgres -g postgres "$NEWDATA"
-      cd "$NEWDATA"
-      sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
-
-      sudo -u postgres $NEWBIN/pg_upgrade \
-        --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
-        --old-bindir $OLDBIN --new-bindir $NEWBIN \
-        "$@"
-    '')
-  ];
-}

modules/traefik/default.nix

@@ -1,53 +0,0 @@
-{ config, ... }:
-
-{
-  services.traefik = {
-    enable = true;
-    group = "docker";
-    staticConfigOptions = {
-      api = {
-        dashboard = true;
-        insecure = true;
-      };
-      certificatesResolvers = {
-        myresolver = {
-          acme = {
-            email = "walkah@walkah.net";
-            storage = "/var/lib/traefik/acme.json";
-            dnsChallenge = {
-              provider = "cloudflare";
-            };
-          };
-        };
-      };
-      entryPoints = {
-        web = {
-          address = ":80";
-          http = {
-            redirections = {
-              entryPoint = {
-                to = "websecure";
-                scheme = "https";
-              };
-            };
-          };
-        };
-        websecure = {
-          address = ":443";
-        };
-      };
-      providers = {
-        docker = { };
-      };
-    };
-  };
-  systemd.services.traefik = {
-    serviceConfig = {
-      EnvironmentFile = config.sops.secrets.traefik.path;
-    };
-  };
-
-  sops.secrets.traefik = {
-    owner = "traefik";
-  };
-}

nix/checks.nix

@@ -0,0 +1,15 @@
+{
+  system,
+  pre-commit-hooks,
+  ...
+}:
+{
+  pre-commit-check = pre-commit-hooks.lib.${system}.run {
+    src = ./.;
+    hooks = {
+      deadnix.enable = true;
+      nixfmt-rfc-style.enable = true;
+      statix.enable = true;
+    };
+  };
+}

nix/darwin.nix

@@ -0,0 +1,29 @@
+{
+  self,
+  darwin,
+  home-manager,
+  ...
+}:
+let
+  mkDarwin =
+    hostName: modules:
+    let
+      hostSystem = self.hosts.${hostName}.system;
+    in
+    darwin.lib.darwinSystem {
+      system = hostSystem;
+      modules = [
+        home-manager.darwinModules.home-manager
+        (_: {
+          networking.hostName = hostName;
+          nixpkgs.overlays = [ self.overlays.default ];
+        })
+      ]
+      ++ modules;
+      specialArgs = { inherit home-manager; };
+    };
+in
+{
+  epicurus = mkDarwin "epicurus" [ ./hosts/epicurus/darwin-configuration.nix ];
+  heraclitus = mkDarwin "heraclitus" [ ./hosts/heraclitus/darwin-configuration.nix ];
+}

nix/hosts.nix

@@ -0,0 +1,49 @@
+{
+  socrates = {
+    type = "nixos";
+    address = "100.103.57.96";
+    system = "x86_64-linux";
+    sshUser = "walkah";
+  };
+  plato = {
+    type = "nixos";
+    address = "100.111.208.75";
+    system = "x86_64-linux";
+    sshUser = "walkah";
+  };
+  agent = {
+    type = "nixos";
+    address = "100.103.219.26";
+    system = "aarch64-linux";
+    sshUser = "root";
+  };
+  form = {
+    type = "nixos";
+    address = "100.104.247.27";
+    system = "aarch64-linux";
+    sshUser = "root";
+  };
+  matter = {
+    type = "nixos";
+    address = "100.95.77.67";
+    system = "aarch64-linux";
+    sshUser = "root";
+  };
+  purpose = {
+    type = "nixos";
+    address = "100.117.49.15";
+    system = "aarch64-linux";
+    sshUser = "root";
+  };
+  epicurus = {
+    type = "darwin";
+    address = "100.75.26.104";
+    system = "aarch64-darwin";
+    sshUser = "walkah";
+  };
+  heraclitus = {
+    type = "darwin";
+    address = "100.72.149.31";
+    system = "aarch64-darwin";
+  };
+}

nix/hosts/aristotle/configuration.nix

@@ -0,0 +1,75 @@
+{ pkgs, raspberry-pi-nix, ... }:
+
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ../../modules/base/nixos.nix
+    raspberry-pi-nix.nixosModules.raspberry-pi
+    ../../modules/ipfs/cluster.nix
+    ../../modules/k3s/agent.nix
+    ../../modules/sops
+  ];
+
+  # See: https://github.com/NixOS/nixos-hardware/issues/858
+  boot.initrd.systemd.tpm2.enable = false;
+
+  boot.kernelParams = [
+    "cgroup_enable=memory"
+    "cgroup_enable=cpuset"
+    "cgroup_memory=1"
+  ];
+
+  raspberry-pi-nix.board = "bcm2711";
+  hardware.raspberry-pi.config = {
+    all = {
+      dt-overlays = {
+        rpi-poe = {
+          enable = true;
+          params = {
+            poe_fan_temp0 = {
+              enable = true;
+              value = 50000;
+            };
+            poe_fan_temp1 = {
+              enable = true;
+              value = 60000;
+            };
+            poe_fan_temp2 = {
+              enable = true;
+              value = 70000;
+            };
+            poe_fan_temp3 = {
+              enable = true;
+              value = 80000;
+            };
+          };
+        };
+      };
+    };
+  };
+
+  time.timeZone = "America/Toronto";
+  networking = {
+    # networking.hostName = "nixos"; # Define your hostname.
+    # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+    # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+    # Per-interface useDHCP will be mandatory in the future, so this generated config
+    # replicates the default behaviour.
+    useDHCP = false;
+    interfaces.eth0.useDHCP = true;
+    interfaces.wlan0.useDHCP = true;
+    firewall.enable = false;
+  };
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    libraspberrypi
+    raspberrypi-eeprom
+  ];
+  security.sudo.wheelNeedsPassword = false;
+}

nix/hosts/aristotle/hardware-configuration.nix

@@ -6,14 +6,10 @@
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
 
-  boot.initrd.availableKernelModules = [ "usbhid" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
   fileSystems."/" = {
     device = "/dev/disk/by-label/NIXOS_SD";
     fsType = "ext4";
+    options = [ "noatime" ];
   };
 
   swapDevices = [ ];

nix/hosts/epicurus/darwin-configuration.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  imports = [
+    ./homebrew.nix
+
+    ../../modules/base/darwin.nix
+    ../../modules/builder
+    ../../modules/dev
+  ];
+}

nix/hosts/epicurus/homebrew.nix

@@ -4,27 +4,30 @@ _:
   homebrew = {
     taps = [
       "homebrew/cask"
-      "homebrew/cask-drivers"
-      "homebrew/cask-fonts"
       "homebrew/services"
     ];
 
-    brews = [ "code-server" "coreutils" "mosh" ];
+    brews = [
+      "btop"
+      "code-server"
+      "coreutils"
+      "mas"
+      "mosh"
+    ];
 
     casks = [
       "1password"
-      "docker"
+      "docker-desktop"
       "font-jetbrains-mono"
       "font-jetbrains-mono-nerd-font"
       "gpg-suite"
       "plex-media-server"
       "stats"
-      "syncthing"
       "synology-drive"
+      "tailscale-app"
     ];
 
     masApps = {
-      Tailscale = 1475387142;
       Xcode = 497799835;
     };
   };

nix/hosts/heraclitus/darwin-configuration.nix

@@ -0,0 +1,19 @@
+{ ... }:
+{
+  imports = [
+    ./homebrew.nix
+
+    ../../modules/base/darwin.nix
+    ../../modules/dev
+    ../../modules/builder
+  ];
+
+  system = {
+    defaults = {
+      dock = {
+        autohide = true;
+        orientation = "left";
+      };
+    };
+  };
+}

nix/hosts/heraclitus/homebrew.nix

@@ -0,0 +1,106 @@
+_:
+
+{
+  homebrew = {
+    taps = [
+      "homebrew/cask"
+      "homebrew/services"
+      "walkah/tap"
+      "1password/tap"
+      "d12frosted/emacs-plus"
+      "dracula/install"
+      "heroku/brew"
+    ];
+
+    brews = [
+      "asdf"
+      "argocd"
+      "cmake"
+      "cocoapods"
+      "coreutils"
+      {
+        name = "emacs-plus";
+        args = [ "--with-c9rgreen-sonoma-icon" ];
+      }
+      "fontconfig"
+      "gcc"
+      "gh"
+      "helm"
+      "heroku"
+      "ipfs"
+      "kind"
+      "kubernetes-cli"
+      "kustomize"
+      "libtool"
+      "mas"
+      "mr"
+      "ollama"
+      "opentofu"
+      "podman"
+      "r"
+      "ripgrep"
+      "tea"
+      "terminal-notifier"
+      "watchman"
+    ];
+
+    casks = [
+      "1password"
+      "1password-cli"
+      "actual"
+      "android-studio"
+      "arc"
+      "balenaetcher"
+      "beeper"
+      "brave-browser"
+      "bruno"
+      "bunch"
+      "calibre"
+      "claude"
+      "discord"
+      "docker-desktop"
+      "dracula-xcode"
+      "element"
+      "fantastical"
+      "figma"
+      "firefox@developer-edition"
+      "font-jetbrains-mono"
+      "font-jetbrains-mono-nerd-font"
+      "ghostty"
+      "google-chrome"
+      "gpg-suite"
+      "hazel"
+      "jordanbaird-ice"
+      "logi-options+"
+      "logitech-camera-settings"
+      "microsoft-edge"
+      "minecraft"
+      "obsidian"
+      "opal-composer"
+      "plexamp"
+      "raycast"
+      "rstudio"
+      "slack"
+      "sonos"
+      "spotify"
+      "stats"
+      "steam"
+      "synology-drive"
+      "tailscale-app"
+      "todoist-app"
+      "visual-studio-code"
+      "zen"
+      "zoom"
+      "zulu@17"
+    ];
+
+    masApps = {
+      OnePasswordSafari = 1569813296;
+      Bumpr = 1166066070;
+      DayOne = 1055511498;
+      Drafts = 1435957248;
+      HomeAssistant = 1099568401;
+      Xcode = 497799835;
+    };
+  };
+}

nix/hosts/plato/configuration.nix

@@ -0,0 +1,217 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  automount_opts = "uid=1000,gid=1000,x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+  inherit (config.sops) secrets;
+in
+{
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ../../modules/base/nixos.nix
+
+    ../../modules/coredns
+    ../../modules/drone
+    ../../modules/drone/runner-docker.nix
+    ../../modules/gitea
+    ../../modules/k3s/server.nix
+    ../../modules/matrix
+    ../../modules/minecraft
+    ../../modules/postgresql
+    ../../modules/sops
+  ];
+  boot = {
+    binfmt.emulatedSystems = [ "aarch64-linux" ];
+    loader = {
+      efi.canTouchEfiVariables = true;
+      systemd-boot = {
+        # Use the systemd-boot EFI boot loader.
+        enable = true;
+        configurationLimit = 3;
+      };
+    };
+    tmp.cleanOnBoot = true;
+  };
+
+  # Set your time zone.
+  time.timeZone = "America/Toronto";
+  networking = {
+    hostName = "plato"; # Define your hostname.
+    useDHCP = false;
+    interfaces = {
+      enp10s0.useDHCP = true;
+      enp9s0.useDHCP = true;
+    };
+
+    # Open ports in the firewall.
+    # networking.firewall.allowedTCPPorts = [ ... ];
+    # networking.firewall.allowedUDPPorts = [ ... ];
+    # Or disable the firewall altogether.
+    firewall.enable = false;
+  };
+
+  security.sudo.wheelNeedsPassword = false;
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC5spf4diguK+w7iYLFr565++6DjHukWfvpN2ru9dCRk nixbuild"
+  ];
+
+  environment.systemPackages = with pkgs; [
+    cifs-utils
+    pinentry
+    weechat
+  ];
+  fileSystems = {
+    "/mnt/downloads" = {
+      device = "//parthenon/Downloads";
+      fsType = "cifs";
+      options = [
+        "${automount_opts},credentials=${secrets.filesystems-parthenon.path}"
+      ];
+    };
+
+    "/mnt/music" = {
+      device = "//parthenon/Music";
+      fsType = "cifs";
+      options = [
+        "${automount_opts},credentials=${secrets.filesystems-parthenon.path}"
+      ];
+    };
+    "/mnt/video" = {
+      device = "//parthenon/Video";
+      fsType = "cifs";
+      options = [
+        "${automount_opts},credentials=${secrets.filesystems-parthenon.path}"
+      ];
+    };
+  };
+
+  nixpkgs.config.allowInsecurePredicate =
+    pkg:
+    builtins.elem (lib.getName pkg) [
+      "broadcom-sta" # aka “wl”
+    ];
+
+  power.ups = {
+    enable = true;
+    mode = "netserver";
+    ups."cyberpower" = {
+      description = "Cyberpower EC650LCD";
+      driver = "usbhid-ups";
+      port = "auto";
+    };
+    upsd = {
+      enable = true;
+      listen = [
+        { address = "0.0.0.0"; }
+      ];
+    };
+    users.upsmon = {
+      passwordFile = secrets.upsmon.path;
+      upsmon = "primary";
+    };
+
+    upsmon.monitor."cyberpower".user = "upsmon";
+  };
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  sops.secrets = {
+    filesystems-parthenon = { };
+    upsmon = { };
+  };
+
+  services = {
+    borgbackup.jobs."borgbase" = {
+      paths = [
+        "/var/backup"
+      ];
+      repo = "ssh://h7ug55o3@h7ug55o3.repo.borgbase.com/./repo";
+      encryption = {
+        mode = "repokey-blake2";
+        passCommand = "cat /root/borgbackup/passphrase";
+      };
+      environment.BORG_RSH = "ssh -i /root/borgbackup/ssh_key";
+      compression = "auto,lzma";
+      startAt = "daily";
+    };
+
+    grafana = {
+      enable = true;
+      settings = {
+        server = {
+          domain = "plato.walkah.lab";
+          http_port = 2342;
+          http_addr = "0.0.0.0";
+        };
+      };
+    };
+    prometheus = {
+      scrapeConfigs = [
+        {
+          job_name = "node";
+          static_configs = [
+            {
+              targets = [
+                "plato:9100"
+                "agent:9100"
+                "form:9100"
+                "matter:9100"
+                "purpose:9100"
+                "socrates:9100"
+              ];
+            }
+          ];
+        }
+        {
+          job_name = "coredns";
+          static_configs = [ { targets = [ "plato:9153" ]; } ];
+        }
+        {
+          job_name = "ipfs";
+          metrics_path = "/debug/metrics/prometheus";
+          static_configs = [
+            {
+              targets = [
+                "agent:5001"
+                "form:5001"
+                "matter:5001"
+                "purpose:5001"
+              ];
+            }
+          ];
+        }
+      ];
+    };
+    tailscale = {
+      useRoutingFeatures = "server";
+    };
+  };
+
+  walkah.coredns = {
+    enable = true;
+  };
+
+  virtualisation.docker = {
+    enable = true;
+    # Clean docker images periodically
+    autoPrune = {
+      enable = true;
+      flags = [ "--all" ];
+    };
+    daemon.settings = {
+      dns = [
+        "1.1.1.1"
+        "1.0.0.1"
+      ];
+    };
+  };
+}

nix/hosts/plato/hardware-configuration.nix

@@ -5,21 +5,25 @@
 
 {
   imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
-
-  boot.initrd.availableKernelModules = [
-    "uhci_hcd"
-    "ehci_pci"
-    "ahci"
-    "xhci_pci"
-    "firewire_ohci"
-    "usb_storage"
-    "usbhid"
-    "sd_mod"
-    "sr_mod"
-  ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-intel" "wl" ];
-  boot.extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
+  boot = {
+    initrd.availableKernelModules = [
+      "uhci_hcd"
+      "ehci_pci"
+      "ahci"
+      "xhci_pci"
+      "firewire_ohci"
+      "usb_storage"
+      "usbhid"
+      "sd_mod"
+      "sr_mod"
+    ];
+    initrd.kernelModules = [ ];
+    kernelModules = [
+      "kvm-intel"
+      "wl"
+    ];
+    extraModulePackages = [ config.boot.kernelPackages.broadcom_sta ];
+  };
 
   fileSystems."/" = {
     device = "/dev/disk/by-uuid/ea3c68ac-e822-4b71-a8f5-65d9e452a3c2";
@@ -31,7 +35,6 @@
     fsType = "vfat";
   };
 
-  swapDevices =
-    [{ device = "/dev/disk/by-uuid/3a812874-3def-4e46-b20d-cd55fa7bdd5f"; }];
+  swapDevices = [ { device = "/dev/disk/by-uuid/3a812874-3def-4e46-b20d-cd55fa7bdd5f"; } ];
 
 }

nix/hosts/socrates/configuration.nix

@@ -1,9 +1,9 @@
-{ pkgs, ... }: {
+{ pkgs, ... }:
+{
   imports = [
     ./hardware-configuration.nix
     ./networking.nix # generated at runtime by nixos-infect
-    ../../users
-    ../../modules/base
+    ../../modules/base/nixos.nix
 
     ../../modules/akkoma
     ../../modules/akkoma/nginx.nix
@@ -18,35 +18,43 @@
     ../../modules/sops
   ];
 
-  nixpkgs.overlays = [ (import ../../overlays) ];
-
   boot.tmp.cleanOnBoot = true;
 
   # Set your time zone.
   time.timeZone = "America/Toronto";
 
-  networking.hostName = "socrates";
-  networking.firewall.allowPing = true;
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-  networking.firewall.trustedInterfaces = [ "tailscale0" ];
-  networking.firewall.checkReversePath = "loose";
-
-  nix = {
-    settings.trusted-users = [ "@wheel" "root" ];
+  networking = {
+    hostName = "socrates";
+    firewall = {
+      allowPing = true;
+      allowedTCPPorts = [
+        80
+        443
+      ];
+      trustedInterfaces = [ "tailscale0" ];
+      checkReversePath = "loose";
+    };
   };
 
-  security.sudo.wheelNeedsPassword = false;
+  nix = {
+    settings.trusted-users = [
+      "@wheel"
+      "root"
+    ];
+  };
+
+  security = {
+    sudo.wheelNeedsPassword = false;
+    acme.acceptTerms = true;
+    acme.defaults.email = "walkah@walkah.net";
+  };
 
   users.users.root.openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
   ];
 
-  system.autoUpgrade.enable = false;
   environment.systemPackages = with pkgs; [ ipfs-migrator ];
 
-  security.acme.acceptTerms = true;
-  security.acme.defaults.email = "walkah@walkah.net";
-
   walkah.coredns = {
     enable = true;
     addr = "100.103.57.96";
@@ -60,21 +68,5 @@
       recommendedGzipSettings = true;
       recommendedProxySettings = true;
     };
-    openssh = { enable = true; };
-    prometheus = {
-      enable = true;
-      port = 9090;
-      listenAddress = "100.103.57.96";
-      exporters = {
-        node = {
-          enable = true;
-          enabledCollectors = [ "systemd" ];
-          openFirewall = true;
-          port = 9100;
-          listenAddress = "100.103.57.96";
-        };
-      };
-    };
-    tailscale = { enable = true; };
   };
 }

nix/hosts/socrates/hardware-configuration.nix

@@ -2,5 +2,8 @@
 {
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
   boot.loader.grub.device = "/dev/vda";
-  fileSystems."/" = { device = "/dev/vda1"; fsType = "ext4"; };
+  fileSystems."/" = {
+    device = "/dev/vda1";
+    fsType = "ext4";
+  };
 }

nix/hosts/socrates/networking.nix

@@ -1,4 +1,5 @@
-{ lib, ... }: {
+{ lib, ... }:
+{
   # This file was populated at runtime with the networking
   # details gathered from the active system.
   networking = {
@@ -28,14 +29,18 @@
             prefixLength = 64;
           }
         ];
-        ipv4.routes = [{
-          address = "167.99.176.1";
-          prefixLength = 32;
-        }];
-        ipv6.routes = [{
-          address = "2604:a880:cad:d0::1";
-          prefixLength = 32;
-        }];
+        ipv4.routes = [
+          {
+            address = "167.99.176.1";
+            prefixLength = 32;
+          }
+        ];
+        ipv6.routes = [
+          {
+            address = "2604:a880:cad:d0::1";
+            prefixLength = 32;
+          }
+        ];
       };
 
     };

nix/modules/akkoma/default.nix

@@ -41,9 +41,15 @@ in
           };
 
           "Pleroma.Web.Endpoint" = {
-            secret_key_base = { _secret = secrets.akkoma-secret-key-base.path; };
-            signing_salt = { _secret = secrets.akkoma-signing-salt.path; };
-            live_view.signing_salt = { _secret = secrets.akkoma-signing-salt.path; };
+            secret_key_base = {
+              _secret = secrets.akkoma-secret-key-base.path;
+            };
+            signing_salt = {
+              _secret = secrets.akkoma-signing-salt.path;
+            };
+            live_view.signing_salt = {
+              _secret = secrets.akkoma-signing-salt.path;
+            };
             url = {
               host = "walkah.social";
               scheme = "https";
@@ -57,12 +63,18 @@ in
         };
         ":web_push_encryption" = {
           ":vapid_details" = {
-            private_key = { _secret = secrets.akkoma-vapid-private-key.path; };
-            public_key = { _secret = secrets.akkoma-vapid-public-key.path; };
+            private_key = {
+              _secret = secrets.akkoma-vapid-private-key.path;
+            };
+            public_key = {
+              _secret = secrets.akkoma-vapid-public-key.path;
+            };
           };
         };
         ":joken" = {
-          ":default_signer" = { _secret = secrets.akkoma-joken-signer.path; };
+          ":default_signer" = {
+            _secret = secrets.akkoma-joken-signer.path;
+          };
         };
       };
       nginx = null; # doing this manually
@@ -77,24 +89,23 @@ in
       databases = [ "akkoma" ];
     };
   };
-
-  sops.secrets.akkoma-secret-key-base = {
-    owner = akkoma.user;
-  };
-
-  sops.secrets.akkoma-signing-salt = {
-    owner = akkoma.user;
-  };
-
-  sops.secrets.akkoma-vapid-private-key = {
-    owner = akkoma.user;
-  };
-
-  sops.secrets.akkoma-vapid-public-key = {
-    owner = akkoma.user;
-  };
-
-  sops.secrets.akkoma-joken-signer = {
-    owner = akkoma.user;
+  sops = {
+    secrets = {
+      akkoma-secret-key-base = {
+        owner = akkoma.user;
+      };
+      akkoma-signing-salt = {
+        owner = akkoma.user;
+      };
+      akkoma-vapid-private-key = {
+        owner = akkoma.user;
+      };
+      akkoma-vapid-public-key = {
+        owner = akkoma.user;
+      };
+      akkoma-joken-signer = {
+        owner = akkoma.user;
+      };
+    };
   };
 }

nix/modules/akkoma/nginx.nix

@@ -1,5 +1,4 @@
-_:
-{
+_: {
   services.nginx = {
     enable = true;
     virtualHosts = {

nix/modules/base/common.nix

@@ -13,18 +13,17 @@ _:
     settings = {
       substituters = [
         "https://walkah.cachix.org"
+        "https://nix-community.cachix.org"
+        "https://cache.garnix.io"
       ];
 
       trusted-public-keys = [
         "walkah.cachix.org-1:D8cO78JoJC6UPV1ZMgd1V5znpk3jNUERGIeAKN15hxo="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
       ];
     };
   };
 
-  programs = {
-    zsh = {
-      enable = true;
-      promptInit = "";
-    };
-  };
+  programs.zsh.enable = true;
 }

nix/modules/base/darwin.nix

@@ -1,9 +1,13 @@
-{ pkgs, ... }: {
+{ ... }:
+{
 
-  imports = [ ./common.nix ];
+  imports = [
+    ./common.nix
+    ../../users
+  ];
 
   nix = {
-    configureBuildUsers = true;
+    enable = true;
 
     extraOptions = ''
       extra-platforms = x86_64-darwin aarch64-darwin
@@ -15,9 +19,13 @@
         Minute = 16;
         Weekday = 6;
       };
+      options = "--delete-older-than 30d";
     };
     settings = {
-      trusted-users = [ "root" "@admin" ];
+      trusted-users = [
+        "root"
+        "@admin"
+      ];
     };
   };
 
@@ -41,20 +49,8 @@
     };
   };
 
-  nixpkgs.config.packageOverrides = pkgs: {
-    haskellPackages = pkgs.haskellPackages.override {
-      overrides = _self: super: {
-        niv = pkgs.haskell.lib.overrideCabal super.niv (_drv: {
-          enableSeparateBinOutput = false;
-        });
-      };
-    };
+  system = {
+    primaryUser = "walkah";
+    stateVersion = 4;
   };
-
-  users.users.walkah = {
-    home = "/Users/walkah";
-    shell = pkgs.zsh;
-  };
-
-  system.stateVersion = 4;
 }

nix/modules/base/nixos.nix

@@ -0,0 +1,63 @@
+{ config, pkgs, ... }:
+{
+
+  imports = [
+    ./common.nix
+    ../monitoring
+    ../../users
+  ];
+
+  documentation = {
+    enable = false;
+  };
+
+  environment.systemPackages = with pkgs; [
+    btop
+    htop
+    inetutils
+    vim
+  ];
+
+  nix = {
+    gc = {
+      persistent = true;
+      dates = "weekly";
+      options = "--delete-older-than 30d";
+    };
+
+    settings = {
+      auto-optimise-store = true;
+
+      trusted-users = [
+        "root"
+        "walkah"
+      ];
+    };
+  };
+
+  programs = {
+    mosh.enable = true;
+  };
+
+  services = {
+    openssh.enable = true;
+    tailscale = {
+      enable = true;
+      extraSetFlags = [ "--webclient" ];
+    };
+  };
+
+  system = {
+    autoUpgrade = {
+      enable = true;
+      flake = "github:walkah/athens#${config.networking.hostName}";
+      dates = "hourly";
+      flags = [
+        "--option"
+        "tarball-ttl"
+        "0"
+      ];
+    };
+    stateVersion = "23.05";
+  };
+}

nix/modules/builder/default.nix

@@ -0,0 +1,23 @@
+_: {
+  nix = {
+    distributedBuilds = true;
+    buildMachines = [
+      {
+        hostName = "plato";
+        systems = [
+          "x86_64-linux"
+          "aarch64-linux"
+        ];
+        maxJobs = 6;
+        supportedFeatures = [
+          "benchmark"
+          "big-parallel"
+          "kvm"
+        ];
+      }
+    ];
+    extraOptions = ''
+      builders-use-substitutes = true
+    '';
+  };
+}

nix/modules/code-server/nginx.nix

@@ -8,7 +8,7 @@ _:
         forceSSL = true;
         enableACME = true;
         locations."/" = {
-          proxyPass = "http://100.66.26.116:8080";
+          proxyPass = "http://100.75.26.104:8080";
           proxyWebsockets = true;
         };
       };

nix/modules/coredns/default.nix

@@ -1,7 +1,8 @@
 { config, lib, ... }:
 with lib;
 
-let cfg = config.walkah.coredns;
+let
+  cfg = config.walkah.coredns;
 in
 {
   options.walkah.coredns = {

nix/modules/coredns/walkah.lab.zone

@@ -1,6 +1,6 @@
 $ORIGIN walkah.lab.
 @       3600 IN SOA plato.walkah.lab. walkah.walkah.net. (
-        2021070700 ; serial
+        2023091000 ; serial
         7200       ; refresh (2 hours)
         3600       ; retry (1 hour)
         1209600    ; expire (2 weeks)
@@ -10,10 +10,10 @@ $ORIGIN walkah.lab.
 socrates        IN A    100.103.57.96
 plato           IN A    100.111.208.75
 ; aristotle
-agent           IN A    100.95.167.126
-form            IN A    100.87.220.71
-matter          IN A    100.126.255.109
-purpose         IN A    100.74.59.80
+agent           IN A    100.103.219.26
+form            IN A    100.104.247.27
+matter          IN A    100.95.77.67
+purpose         IN A    100.117.49.15
 
 parthenon       IN A    100.106.65.39
-epicurus        IN A    100.66.26.116
+epicurus        IN A    100.75.26.104

nix/modules/dev/default.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+
+{
+  environment.systemPackages = with pkgs; [
+    # Nix
+    cachix
+    nixd
+    nixf
+    nixfmt-rfc-style
+  ];
+}

nix/modules/drone/default.nix

@@ -1,4 +1,5 @@
-{ pkgs, config, ... }: {
+{ pkgs, config, ... }:
+{
   sops.secrets.drone = {
     owner = "drone";
   };
@@ -9,9 +10,7 @@
       ensureUsers = [
         {
           name = "drone";
-          ensurePermissions = {
-            "DATABASE drone" = "ALL PRIVILEGES";
-          };
+          ensureDBOwnership = true;
         }
       ];
     };

nix/modules/drone/runner-docker.nix

@@ -1,4 +1,5 @@
-{ pkgs, config, ... }: {
+{ pkgs, config, ... }:
+{
   systemd.services.drone-runner-docker = {
     wantedBy = [ "multi-user.target" ];
     serviceConfig = {

nix/modules/drone/runner-exec.nix

@@ -36,14 +36,14 @@
         "/etc/passwd:/etc/passwd"
         "/etc/group:/etc/group"
         "/nix/var/nix/profiles/system/etc/nix:/etc/nix"
-        "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt"
-        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
         "${
-          builtins.toFile "ssh_config" ''
-            Host eve.thalheim.io
-              ForwardAgent yes
-          ''
-        }:/etc/ssh/ssh_config"
+          config.environment.etc."ssl/certs/ca-certificates.crt".source
+        }:/etc/ssl/certs/ca-certificates.crt"
+        "${config.environment.etc."ssh/ssh_known_hosts".source}:/etc/ssh/ssh_known_hosts"
+        "${builtins.toFile "ssh_config" ''
+          Host eve.thalheim.io
+            ForwardAgent yes
+        ''}:/etc/ssh/ssh_config"
         "/etc/machine-id"
         # channels are dynamic paths in the nix store, therefore we need to bind mount the whole thing
         "/nix/"

nix/modules/gitea/default.nix

@@ -1,6 +1,7 @@
 { config, ... }:
 
-let cfg = config.services.gitea;
+let
+  cfg = config.services.gitea;
 in
 {
   users.users.git = {
@@ -20,9 +21,15 @@ in
       lfs.enable = true;
 
       settings = {
-        log = { LEVEL = "Error"; };
-        other = { SHOW_FOOTER_VERSION = false; };
-        repository = { DEFAULT_BRANCH = "main"; };
+        log = {
+          LEVEL = "Error";
+        };
+        other = {
+          SHOW_FOOTER_VERSION = false;
+        };
+        repository = {
+          DEFAULT_BRANCH = "main";
+        };
         server = {
           DOMAIN = "walkah.dev";
           HTTP_ADDR = "0.0.0.0";
@@ -30,17 +37,32 @@ in
           ROOT_URL = "https://walkah.dev/";
           SSH_DOMAIN = "git.walkah.dev";
         };
-        service = { DISABLE_REGISTRATION = true; };
-        session = { COOKIE_SECURE = true; };
+        service = {
+          DISABLE_REGISTRATION = true;
+        };
+        session = {
+          COOKIE_SECURE = true;
+        };
       };
 
       dump.enable = false;
 
       database = {
+        createDatabase = false;
         type = "postgres";
+        name = "gitea";
+        socket = "/run/postgresql";
         user = "git";
       };
     };
+    postgresql = {
+      ensureDatabases = [ "gitea" ];
+      ensureUsers = [
+        {
+          name = "git";
+        }
+      ];
+    };
     postgresqlBackup.databases = [ "gitea" ];
   };
 }

nix/modules/ipfs/cluster.nix

@@ -3,13 +3,17 @@
 {
   imports = [
     ./default.nix
-    ../../services/ipfs-cluster.nix
   ];
 
   services = {
     kubo = {
       enable = true;
       settings = {
+        Discovery = {
+          MDNS = {
+            Enabled = true;
+          };
+        };
         Swarm = {
           AddrFilters = null;
           ConnMgr = {

nix/modules/ipfs/default.nix

@@ -1,8 +1,6 @@
-{ pkgs, ... }:
+_:
 
 {
-  environment.systemPackages = with pkgs; [ ipfs-migrator ];
-
   services = {
     kubo = {
       enable = true;
@@ -19,9 +17,14 @@
             "/ip6/::/udp/4001/quic"
           ];
         };
-        API = { HTTPHeaders = { Access-Control-Allow-Origin = [ "*" ]; }; };
-        Discovery = { MDNS = { Enabled = true; }; };
-        Routing = { Type = "dht"; };
+        API = {
+          HTTPHeaders = {
+            Access-Control-Allow-Origin = [ "*" ];
+          };
+        };
+        Routing = {
+          Type = "dht";
+        };
       };
     };
   };

nix/modules/ipfs/gateway.nix

@@ -0,0 +1,79 @@
+{ pkgs, ... }:
+
+let
+  peers = [
+    {
+      ID = "12D3KooWEVoGdqsakyi3bgE8ivvRzcgTjiirFNS2FbUMw6HSjZF9";
+      Addrs = [ "/ip4/100.103.219.26/tcp/4001" ];
+    }
+    {
+      ID = "12D3KooWC5ncgKeJV2G6QBdGMkT2gLbeviaDxpYR7V6NVTsma3C5";
+      Addrs = [ "/ip4/100.104.247.27/tcp/4001" ];
+
+    }
+    {
+      ID = "12D3KooW9xeqfnnNWafiDkLXWjC5YdUnBrG5tJDd3tnm86kqVwhA";
+      Addrs = [ "/ip4/100.95.77.67/tcp/4001" ];
+
+    }
+    {
+      ID = "12D3KooWLYPckqA4JACJ4vioWc4tYuPjmfLMbgviECnWqazjSgK9";
+      Addrs = [ "/ip4/100.117.49.15/tcp/4001" ];
+
+    }
+  ];
+in
+{
+  imports = [ ./default.nix ];
+
+  environment.systemPackages = with pkgs; [ ipfs-migrator ];
+
+  environment.etc = {
+    "ipfs/denylists/badbits.deny".source = ./badbits.deny;
+  };
+
+  networking.firewall = {
+    allowedTCPPorts = [ 4001 ];
+    allowedUDPPorts = [ 4001 ];
+  };
+  services = {
+    kubo = {
+      enable = true;
+      settings = {
+        Discovery = {
+          MDNS = {
+            Enabled = false;
+          };
+        };
+        Peering = {
+          Peers = peers;
+        };
+        Swarm = {
+          AddrFilters = null;
+        };
+      };
+    };
+    nginx = {
+      # IPFS Gateway
+      virtualHosts."walkah.cloud" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8080";
+        };
+      };
+
+      # Hosted Sites
+      virtualHosts."walkah.net" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:8080";
+        };
+        serverAliases = [
+          "www.walkah.net"
+        ];
+      };
+    };
+  };
+}

nix/modules/k3s/agent.nix

@@ -0,0 +1,12 @@
+_:
+let
+  hosts = import ../../hosts.nix;
+in
+{
+  imports = [ ./common.nix ];
+
+  services.k3s = {
+    role = "agent";
+    serverAddr = "https://${hosts.plato.address}:6443";
+  };
+}

nix/modules/k3s/common.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+let
+  hostname = config.networking.hostName;
+  hosts = import ../../hosts.nix;
+in
+{
+  services.k3s = {
+    enable = true;
+    tokenFile = config.sops.secrets.k3s-token.path;
+    extraFlags = [
+      "--node-external-ip=${hosts.${hostname}.address}"
+    ];
+  };
+  sops.secrets.k3s-token = {
+    owner = "root";
+    mode = "0400";
+  };
+}

nix/modules/k3s/server.nix

@@ -0,0 +1,7 @@
+{
+  imports = [ ./common.nix ];
+  services.k3s = {
+    role = "server";
+    clusterInit = true;
+  };
+}

nix/modules/matrix/default.nix

@@ -1,10 +1,6 @@
 { config, pkgs, ... }:
 
 {
-  environment.systemPackages = with pkgs; [
-    matrix-synapse-tools.synadm
-  ];
-
   services = {
     postgresql = {
       enable = true;
@@ -17,7 +13,10 @@
             LC_CTYPE = "C";
       '';
     };
-    postgresqlBackup.databases = [ "matrix" ];
+    postgresqlBackup.databases = [
+      "matrix"
+      "matrix-syncv3"
+    ];
 
     matrix-synapse = {
       enable = true;
@@ -28,21 +27,30 @@
         enable_registration = false;
         database = {
           name = "psycopg2";
-          args = { database = "matrix"; };
+          args = {
+            database = "matrix";
+          };
         };
-        listeners = [{
-          bind_addresses = [
-            "0.0.0.0"
-          ];
-          port = 8008;
-          type = "http";
-          tls = false;
-          x_forwarded = true;
-          resources = [{
-            compress = false;
-            names = [ "client" "federation" ];
-          }];
-        }];
+        listeners = [
+          {
+            bind_addresses = [
+              "0.0.0.0"
+            ];
+            port = 8008;
+            type = "http";
+            tls = false;
+            x_forwarded = true;
+            resources = [
+              {
+                compress = false;
+                names = [
+                  "client"
+                  "federation"
+                ];
+              }
+            ];
+          }
+        ];
       };
       extraConfigFiles = [
         config.sops.secrets.matrix-registration-secret.path

nix/modules/matrix/nginx.nix

@@ -0,0 +1,64 @@
+_:
+
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "matrix.walkah.chat" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/_matrix" = {
+          proxyPass = "http://100.111.208.75:8008";
+        };
+        locations."/_synapse/client" = {
+          proxyPass = "http://100.111.208.75:8008";
+        };
+      };
+
+      "syncv3.walkah.chat" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://100.111.208.75:8088";
+        };
+      };
+
+      "walkah.chat" = {
+        forceSSL = true;
+        enableACME = true;
+        locations = {
+          "= /.well-known/matrix/server".extraConfig =
+            let
+              server = {
+                "m.server" = "matrix.walkah.chat:443";
+              };
+            in
+            ''
+              default_type application/json;
+              add_header Access-Control-Allow-Origin *;
+              return 200 '${builtins.toJSON server}';
+            '';
+          "= /.well-known/matrix/client".extraConfig =
+            let
+              client = {
+                "m.homeserver" = {
+                  "base_url" = "https://matrix.walkah.chat";
+                };
+                "org.matrix.msc3575.proxy" = {
+                  "url" = "https://syncv3.walkah.chat";
+                };
+              };
+            in
+            ''
+              default_type application/json;
+              add_header Access-Control-Allow-Origin *;
+              return 200 '${builtins.toJSON client}';
+            '';
+          # "/" = {
+          #   root = pkgs.element-web;
+          # };
+        };
+      };
+    };
+  };
+}

nix/modules/minecraft/default.nix

@@ -20,6 +20,8 @@ _: {
       walkahj = "7209094c-b3ef-4c89-b8cd-0aef7c1d57a6";
       puffpuffpassion = "72e0d040-fa54-47e8-a6e7-162fdaa0cac5";
       rafadoodle = "9a7c860e-e269-4c38-b2f7-ca5533c27e98";
+      camylamb = "c9fcbfa1-89da-4cf9-97fe-b9e5290a4eb4";
+      shortychark = "3f420f61-867f-4651-a849-d2e54f8c220d";
     };
   };
 }

nix/modules/minecraft/proxy.nix

@@ -0,0 +1,32 @@
+_:
+let
+  dest_ip = "100.111.208.75";
+  dest_port = 25565;
+in
+{
+  networking = {
+    firewall = {
+      enable = true;
+      allowedTCPPorts = [ dest_port ];
+    };
+    nat = {
+      enable = true;
+      internalInterfaces = [ "tailscale0" ];
+      externalInterface = "eth0";
+      forwardPorts = [
+        {
+          sourcePort = dest_port;
+          proto = "tcp";
+          destination = "${dest_ip}:${toString dest_port}";
+        }
+      ];
+    };
+  };
+
+  services = {
+    tailscale = {
+      useRoutingFeatures = "server";
+      extraUpFlags = [ "--stateful-filtering=false" ];
+    };
+  };
+}

nix/modules/monitoring/default.nix

@@ -0,0 +1,17 @@
+_:
+
+{
+  services = {
+    prometheus = {
+      enable = true;
+      port = 9090;
+      exporters = {
+        node = {
+          enable = true;
+          enabledCollectors = [ "systemd" ];
+          port = 9100;
+        };
+      };
+    };
+  };
+}

nix/modules/postgresql/default.nix

@@ -0,0 +1,45 @@
+{ pkgs, config, ... }:
+{
+  services = {
+    postgresql = {
+      enable = true;
+      package = pkgs.postgresql_14;
+    };
+
+    postgresqlBackup = {
+      enable = true;
+    };
+  };
+
+  # Postgres upgrades: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading
+  environment.systemPackages = [
+    (
+      let
+        # XXX specify the postgresql package you'd like to upgrade to.
+        # Do not forget to list the extensions you need.
+        newPostgres = pkgs.postgresql_15;
+      in
+      pkgs.writeScriptBin "upgrade-pg-cluster" ''
+        set -eux
+        # XXX it's perhaps advisable to stop all services that depend on postgresql
+        systemctl stop postgresql
+
+        export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
+
+        export NEWBIN="${newPostgres}/bin"
+
+        export OLDDATA="${config.services.postgresql.dataDir}"
+        export OLDBIN="${config.services.postgresql.package}/bin"
+
+        install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+        cd "$NEWDATA"
+        sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
+
+        sudo -u postgres $NEWBIN/pg_upgrade \
+          --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+          --old-bindir $OLDBIN --new-bindir $NEWBIN \
+          "$@"
+      ''
+    )
+  ];
+}

nix/nixos.nix

@@ -0,0 +1,38 @@
+{
+  self,
+  nixpkgs,
+  home-manager,
+  raspberry-pi-nix,
+  sops-nix,
+  ...
+}:
+let
+  mkSystem =
+    hostName: modules:
+    let
+      hostSystem = self.hosts.${hostName}.system;
+    in
+    nixpkgs.lib.nixosSystem {
+      modules = [
+        home-manager.nixosModules.home-manager
+        (_: {
+          networking.hostName = hostName;
+          nixpkgs.overlays = [ self.overlays.default ];
+          nixpkgs.config.allowUnfree = true;
+        })
+        { nixpkgs.hostPlatform = hostSystem; }
+      ]
+      ++ modules;
+      specialArgs = { inherit raspberry-pi-nix sops-nix; };
+    };
+in
+{
+  # Aristotle
+  agent = mkSystem "agent" [ ./hosts/aristotle/configuration.nix ];
+  form = mkSystem "form" [ ./hosts/aristotle/configuration.nix ];
+  matter = mkSystem "matter" [ ./hosts/aristotle/configuration.nix ];
+  purpose = mkSystem "purpose" [ ./hosts/aristotle/configuration.nix ];
+
+  plato = mkSystem "plato" [ ./hosts/plato/configuration.nix ];
+  socrates = mkSystem "socrates" [ ./hosts/socrates/configuration.nix ];
+}

nix/secrets/secrets.yaml

@@ -0,0 +1,85 @@
+matrix-registration-secret: ENC[AES256_GCM,data:Sn3pGBq4U3Tgw0pYaetnBLRiNdFGnMxAxyfrxhF9kFDMFijKSy9XBj71M5XxV4shYQyPvu2WDnPR1YvyoQVlv8cEoXhX7++JlYsp/2ZfKIzp4iMxh24z57Cw8vg=,iv:/zxlIeI9gWWCHbejYgz8pjjOrukKome0/bmcXuG3/yE=,tag:3fc3c96H3pO1FUO7p3T4gw==,type:str]
+ipfs-cluster-secret: ENC[AES256_GCM,data:fmZ1USrJlR8fbulr1Kn8LDkMl/c6OkIN5M5q4X0MLO77K8zPwTXm0+M8ZHfq36rnuxBV0gsTiYBn47DSQLaDkONOPuEu99EGuIYZ9qZQVaZ/RC12ej6bpHaaX3m3j48szOXwJdoyDWlP32ZFanMznO8+EwAz5ccNV03ck/Rh/qpq9pWt/QjNhqtAkwFkooGB0aWRdHlillsB/SGQJk/moweIQk3qz2Ya4cN21Cxfssd08TDacjNCUekIgZ/xuXV7j8dCV/qiAOJEfaHn,iv:bAEDTTeQvg+sE67nEuSZhxqJBZVXFRNIPOZGkPYy9dY=,tag:82eBLePaqu7tYu0MtefMOQ==,type:str]
+drone: ENC[AES256_GCM,data:UKh2qyZq5eTiEpdbGve+fCQZzSx/j+wUv9eHT/ToU9b51rwA7XJQC4g3rvljBL9X7DFVVdsWOdG6y1eRGImdelJ5hwxa8oK5CBpaGLGjd9+Hm8SS+Q+PAFDW6fdsPtDDgK5jjykcIlJ7u9mjCffFsCGw3UWfHxnniCnIba9e499XU+VR6l96U3oGOsrr0XO/d2zwrOm3mvXQL1P3cE+se4/UDKrdABGfKWyGqZ9xgi6Q7PTSmRv4AtpwpgF1URBvPVqs6yoexWetksLv+Xk5H50EeucbMOA+oUSJ06fUMECFRF9thRrdUbtK,iv:CiZz6NSksNMGmZxWS7uE69O6UnvTkRWbeBwC1bUqR9o=,tag:qcLmseQgkjMVv2uNXPFHzw==,type:str]
+akkoma-secret-key-base: ENC[AES256_GCM,data:OQBGkyjhDeNz40bBMMqLU7S6s4r6CtatOxJ5RNdba5m5NQO+JJ5/sEuOjJrJ29oRGjHFYwmUcAB9vptWdGZdcA==,iv:oYh9fh12cNYJOgC8DAxyYxw8dp1Fmd1CijNpgmn/AV8=,tag:E9W/5TWPjIgjE3o/QAky0A==,type:str]
+akkoma-signing-salt: ENC[AES256_GCM,data:KtOdcHM8XLY=,iv:RXvLlSyPzK6HYFxwyKEnDw1llmfNC5ambqvGiAkVxnA=,tag:LLna293WAYoBlr0j3U6zkg==,type:str]
+akkoma-vapid-private-key: ENC[AES256_GCM,data:D8Dh53yOgKrcsttJ36xyV1locXBV2BB2EG/rOfIctCbOItdsodtpMCAwRg==,iv:xzheaTo0b3szYGvZmc3ucPi9lYXJStznAUyWNQ9TATE=,tag:tHV5DUFuvq2F9yRFmHrQXQ==,type:str]
+akkoma-vapid-public-key: ENC[AES256_GCM,data:HnUAyTq7dwa+A9L1X3YyxkiJ71BoZis5TdEPHJZkFRoiU5ZYu21xJW4R1H8xsCUDTaFTKLzdSNImVStIg1A+ex6UXLvsJwqM55P8ZnUm87V5KIsCimEm,iv:vVNoYubajEgqZIg6j9k6HjY/j4ib8A7MHGWPrJnkpCw=,tag:GBr2z4EGbn5vmFMWtY013w==,type:str]
+akkoma-joken-signer: ENC[AES256_GCM,data:6GbXC7teDXxr0z7eBLm9EvJv59Bvd1FqRuBGntAH9YzM79MVUMsx4JnCZ+bPR9hLiIVgITeAc5djk2tiJewh6w==,iv:q7A8f7kocb1Go7acFkVSxdmhObPxpGlfbPgfrOXHEjg=,tag:lS4UNS1ivVZdmm8AMS/1MQ==,type:str]
+filesystems-parthenon: ENC[AES256_GCM,data:dYO+QjvWhR3oXrDfAEaUvTLx147NIDFcPUa7p3Jv558ynqmmEnVZ3+fVMUQVIw==,iv:ASmXqNA8/TZvSRo31CFAzt6StsZzZpVFvz15LN5+QmQ=,tag:Wx6kDCXqZ1iSmxpggBKVxA==,type:str]
+upsmon: ENC[AES256_GCM,data:Rlqkhh7w8S9jD3mwUdkt3g==,iv:hiMkbAhea1f6r5gGTRw49ebepMtTYBVyH+bHwp/T61Q=,tag:cbaxIDuD4JNeCC5MiMGl6w==,type:str]
+k3s-token: ENC[AES256_GCM,data:dyyFY/ruyCfAdQmmdD1eDPKhBWkbgElbFQgMjGALrM8OeTXRiiV18AwG1ZGtw+j3CBmladwBf0+gcfC0ojKHlA==,iv:j4IOIZegDMJik6shOhUZGyI0N8TD1yMDcOacArgM05Q=,tag:t91uRzF8RgxLF/f2M+9Wgg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOT3gyL29ETGNYSTNBMHhx
+            RUVNRmdpZm9TZTdJNTJCOSt5blZ3T2JLVlhVCldaTjhaanBrWTVIOWJQQ1VJUTUw
+            alJuRjhOU2wxWEF1RG0vZE9LVU1JcHMKLS0tIGF0VlRDeldsSFFZNzVHaWJGTUtC
+            WlhMcDM3RlF5Y3FkRXczbWNHQWNrVjAKx77NlnVTab75G2QTiuEmAyI10m2ZbMjc
+            IyVWoRabZY96J/HYiZaURZY5Aq10Opa9vTp0xXL0FxLwF0Bclr7J+Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzY3hRcjZsZDBjb1FtWElx
+            ODV3Q0g2Q0QveEUrMkRIZlJSbDBBdjlHZ25ZCmxvcngwN1V4RkJLL1NzWkw4bjNF
+            OXdXMlo1KzZIV3BtUWtXOGdzQ1l1RnMKLS0tIFJjY3JtOHNwTldrM0dqbnkvSThM
+            QW0zMzJtMzNSaEJldzJITDAvZExtcFUKTovVFKkl40WdXOji8xWKZ8eZcEXU64uz
+            4K7fqyhchzu+PB1xVMYeSahIYTh2oZGSKXi8nnTBwz2cPLJmy/8Biw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1pn2hnqvgt7rvfglxddlj3jwrm79rvmutmexkpxv4frdnznlel33qvfy6u5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKYlZtbC9sSXhzYUU2bnBZ
+            ZmpKUk5BcHdGbTJ3b0xhRTVxMXIxOXJYSmpNCkdWQ3hJV0t0OVcwNmYwaVh5V3VJ
+            ellsaGRyNnVEaTkxUFNReG4yTUprQUkKLS0tIHNqdjdmQjh3cHlwb0M2bGk0b2NG
+            eGV5Vk54dzNWSlFGTWc1akxHUmhiQ28KzAs/krsXZxcRQpefv5ncqbZ6D9Mr8HDl
+            9Ir35JL2HhZv3wtMUK9TQVINmbPiPGf9mzVoiCQ7Nq9J80wzt/A53Q==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1mnrl9u8vpdjncge33pg7quakl0qdf5dlfgch87jhrs0wrvup4s0s5xh7ly
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTeDI0QXE4L0tBWDd3dmVI
+            TlN3RlBNYjNCUkZMWGUwVEtkZHU4UTVYdWw4CnMvT09sU0EyVllSM1VSRXhsL2FF
+            NnVGQ0hyRTFjdjBWSjVpNXNuc3I4RTAKLS0tIEIveW00Ky9jbnozTGZqZk4zeEdp
+            ZnBaRUJMSy9sSTIwUzR0U1JsRFhJWnMKOyIeYJquwLWqmLVqMNRCLK1U/10ILBEu
+            FX+kU8c5qrpsSoMjNfy/h9QCF/5u+9CV/9wHw2HONN0CAwWlYrDgdw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1tt0gwcm03zmpelerpph49knn8f6t8z7aq9una2qys76kf4rwxpnquxkvz3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6a2JmV1hQb0FHekpzVWVL
+            d1RzdEoxVmZWQ25XT2hkYmtESFIrNFc1N1Y0Cmx4dEZrRnhDZDlGRXJPVGRpa0l5
+            akhKR3dlTS9SblFrTndBakVIemwrRFEKLS0tICsraW83aFlvRzRKVHdQcjhLUjFB
+            K29DeVBqWUs0ejRUVUd2SkpVYzd1UEkK0/AHkZ7gKouHi26nsZsr4CpmDu+jbKx6
+            BA7VAwCI0nBP5sOgNXbsmYhgyAlaz28tybNXV+QzCnJiyTXhZM5F8w==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1px55dk5n3whfdyshzyxqmyjvqdmv9au6myx6w67jw3cqp9sdx9rsa6xep9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiS1BMUFU5T05PM2Z1Zk96
+            N3FYTWp3bWtwMDZ4QVdVMEVLaTFueE9Od1JJCjdtMUNRa1JGWUkxRTZueS9vSGdx
+            NG9TVHF5T3lYbUZxa1FWY2RldHV1ZVkKLS0tIHNqbEZlSk9zR1FpWmNMQy8rayt6
+            SStpZHdKZGN0NGNieldPY2JTcnJ4ZW8Kz5u/fJjkwi8vJh3CB7K0S7+b9gzOhsvW
+            +0lfMGT+Dtbchq8O1wsCoBfe8I5kV2QlXJxTU7o4BASFKfNzX9E4gA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age12wakcnv487c5rkgv7z6umzywrqwcy6dgguq0dug6lxp64scjsq6sspkmgz
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVa2pHd2dvNHBwcW85SnNy
+            aSt4ZElQdGZLMW5GNnIyc2NxY1J2MEk1c0RjCmJiMEY5cklnWVVHN25ST2JSWEhT
+            WWcvVG9TRVlVdWFzcjhENFZCMUhXVHMKLS0tIFpWcURkWFExU200TlR1N2NIak4z
+            WlZuY2ExWWJ1VzBpY2kzaUZCcVJMZHcKoqKBQEe+3UnAhqbc7Nq8zgEVoFFjryaY
+            c8ALKqMIaMjAeA8ZU4ZTIu13pMYcJ+gAlPATt0vmsTn0Q0XIiudpJQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-10T18:41:36Z"
+    mac: ENC[AES256_GCM,data:nAUaEMxYGZc+hzeFo2sjQNBPuVw9GKjDAL9R9uJl9ySWNOLtSjl150qkAYjfqfIpsiyRtnSBfP1UxvKHjbAv5Fu9Bmkv+1rv6T8d9nK541DrT1IJ/F/sdw+Vqf/xJss1pvZLP/KhLT5wfvyPrk3VeKWx5f7BI/VzCsU1MNukZdY=,iv:ooxqCvIogeyXiHC10BJUYu9PCTZr/bnUJHiUzg2bjw4=,tag:Wt+vmIVPmlTOxAQ6rHnxdg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

nix/shells.nix

@@ -0,0 +1,23 @@
+{
+  system,
+  pkgs,
+  self,
+  ...
+}:
+{
+  default = pkgs.mkShell {
+    name = "athens";
+    buildInputs = with pkgs; [
+      deadnix
+      doctl
+      nixd
+      nixf
+      nixpkgs-fmt
+      opentofu
+      statix
+      sops
+    ];
+
+    inherit (self.checks.${system}.pre-commit-check) shellHook;
+  };
+}

nix/users/default.nix

@@ -0,0 +1,5 @@
+{ ... }:
+
+{
+  imports = [ ./walkah ];
+}

nix/users/walkah/default.nix

@@ -0,0 +1,27 @@
+{ lib, pkgs, ... }:
+
+{
+  users.users.walkah = {
+    home = if pkgs.stdenv.isDarwin then "/Users/walkah" else "/home/walkah";
+    shell = pkgs.zsh;
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM8YMax7PGIrcPNIHkpuNRFgn3HJK6Wepm+ycZWO6jfR walkah@walkah-ipadpro11"
+    ];
+  }
+  // lib.optionalAttrs pkgs.stdenv.isLinux {
+    extraGroups = [
+      "wheel"
+      "docker"
+    ];
+    group = "walkah";
+    isNormalUser = true;
+  };
+  users.groups.walkah = { };
+
+  home-manager = {
+    useGlobalPkgs = true;
+    useUserPackages = true;
+    users.walkah = import ./home.nix;
+  };
+}

nix/users/walkah/home.nix

@@ -0,0 +1,30 @@
+{ lib, pkgs, ... }:
+{
+  home = {
+    packages = with pkgs; [
+      chezmoi
+      bat
+      direnv
+      eza
+      fd
+      fzf
+      git
+      htop
+      jq
+      starship
+      tmux
+    ];
+
+    activation.chezmoi = lib.hm.dag.entryAfter [ "installPackages" ] ''
+      export SSL_CERT_FILE="${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+      export PATH="${pkgs.git}/bin:${pkgs.openssh}/bin:$PATH"
+      if [ ! -d $HOME/.local/share/chezmoi ]; then
+        $DRY_RUN_CMD ${pkgs.chezmoi}/bin/chezmoi init --apply walkah/dotfiles
+      else
+        $DRY_RUN_CMD ${pkgs.chezmoi}/bin/chezmoi update --apply
+      fi
+    '';
+
+    stateVersion = "24.05";
+  };
+}

package.json

@@ -1,11 +0,0 @@
-{
-    "name": "athens",
-    "main": "index.ts",
-    "devDependencies": {
-        "@types/node": "^16"
-    },
-    "dependencies": {
-        "@pulumi/pulumi": "^3.0.0",
-        "@pulumi/digitalocean": "^4.0.0"
-    }
-}

secrets/secrets.yaml

@@ -1,83 +0,0 @@
-matrix-registration-secret: ENC[AES256_GCM,data:Sn3pGBq4U3Tgw0pYaetnBLRiNdFGnMxAxyfrxhF9kFDMFijKSy9XBj71M5XxV4shYQyPvu2WDnPR1YvyoQVlv8cEoXhX7++JlYsp/2ZfKIzp4iMxh24z57Cw8vg=,iv:/zxlIeI9gWWCHbejYgz8pjjOrukKome0/bmcXuG3/yE=,tag:3fc3c96H3pO1FUO7p3T4gw==,type:str]
-ipfs-cluster-secret: ENC[AES256_GCM,data:fmZ1USrJlR8fbulr1Kn8LDkMl/c6OkIN5M5q4X0MLO77K8zPwTXm0+M8ZHfq36rnuxBV0gsTiYBn47DSQLaDkONOPuEu99EGuIYZ9qZQVaZ/RC12ej6bpHaaX3m3j48szOXwJdoyDWlP32ZFanMznO8+EwAz5ccNV03ck/Rh/qpq9pWt/QjNhqtAkwFkooGB0aWRdHlillsB/SGQJk/moweIQk3qz2Ya4cN21Cxfssd08TDacjNCUekIgZ/xuXV7j8dCV/qiAOJEfaHn,iv:bAEDTTeQvg+sE67nEuSZhxqJBZVXFRNIPOZGkPYy9dY=,tag:82eBLePaqu7tYu0MtefMOQ==,type:str]
-drone: ENC[AES256_GCM,data:UKh2qyZq5eTiEpdbGve+fCQZzSx/j+wUv9eHT/ToU9b51rwA7XJQC4g3rvljBL9X7DFVVdsWOdG6y1eRGImdelJ5hwxa8oK5CBpaGLGjd9+Hm8SS+Q+PAFDW6fdsPtDDgK5jjykcIlJ7u9mjCffFsCGw3UWfHxnniCnIba9e499XU+VR6l96U3oGOsrr0XO/d2zwrOm3mvXQL1P3cE+se4/UDKrdABGfKWyGqZ9xgi6Q7PTSmRv4AtpwpgF1URBvPVqs6yoexWetksLv+Xk5H50EeucbMOA+oUSJ06fUMECFRF9thRrdUbtK,iv:CiZz6NSksNMGmZxWS7uE69O6UnvTkRWbeBwC1bUqR9o=,tag:qcLmseQgkjMVv2uNXPFHzw==,type:str]
-traefik: ENC[AES256_GCM,data:SEjgraDDpdJnaOEZVi/0Vtr3J/jQ3zC2kZaMmMRKhRd77EkXC6eeSbOaORv30QSXcfipm8INT45TKZfRSdbnoV6XbgAqLyLmef3LkmMt+eA=,iv:bbns12ZiqeBha0eWEARMixFfPDHzF8PBjUEeEdkwf6Q=,tag:ft2k2CQk7VmfWiGhhyHVfQ==,type:str]
-akkoma-secret-key-base: ENC[AES256_GCM,data:OQBGkyjhDeNz40bBMMqLU7S6s4r6CtatOxJ5RNdba5m5NQO+JJ5/sEuOjJrJ29oRGjHFYwmUcAB9vptWdGZdcA==,iv:oYh9fh12cNYJOgC8DAxyYxw8dp1Fmd1CijNpgmn/AV8=,tag:E9W/5TWPjIgjE3o/QAky0A==,type:str]
-akkoma-signing-salt: ENC[AES256_GCM,data:KtOdcHM8XLY=,iv:RXvLlSyPzK6HYFxwyKEnDw1llmfNC5ambqvGiAkVxnA=,tag:LLna293WAYoBlr0j3U6zkg==,type:str]
-akkoma-vapid-private-key: ENC[AES256_GCM,data:D8Dh53yOgKrcsttJ36xyV1locXBV2BB2EG/rOfIctCbOItdsodtpMCAwRg==,iv:xzheaTo0b3szYGvZmc3ucPi9lYXJStznAUyWNQ9TATE=,tag:tHV5DUFuvq2F9yRFmHrQXQ==,type:str]
-akkoma-vapid-public-key: ENC[AES256_GCM,data:HnUAyTq7dwa+A9L1X3YyxkiJ71BoZis5TdEPHJZkFRoiU5ZYu21xJW4R1H8xsCUDTaFTKLzdSNImVStIg1A+ex6UXLvsJwqM55P8ZnUm87V5KIsCimEm,iv:vVNoYubajEgqZIg6j9k6HjY/j4ib8A7MHGWPrJnkpCw=,tag:GBr2z4EGbn5vmFMWtY013w==,type:str]
-akkoma-joken-signer: ENC[AES256_GCM,data:6GbXC7teDXxr0z7eBLm9EvJv59Bvd1FqRuBGntAH9YzM79MVUMsx4JnCZ+bPR9hLiIVgITeAc5djk2tiJewh6w==,iv:q7A8f7kocb1Go7acFkVSxdmhObPxpGlfbPgfrOXHEjg=,tag:lS4UNS1ivVZdmm8AMS/1MQ==,type:str]
-sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
-    age:
-        - recipient: age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPZlFKbFY4YjNnN3hhNTNw
-            V1N0ZVh6ZDJrSng4M1pBMWxqZTJmcUJLWUdNCm55K2RpVSs0NHNGK1F4K28xTk9q
-            UHVESitPSEs2eEZCT3RreWpVam80ZmMKLS0tIHJ4Q3pHOFVTOStBUGprR0FvRHhl
-            VzhmT3BzYy8veHhaZUtUSmxCZDh5V1kKsjFBNoqtUD44d8ImP/DcvS+gBkQJi/Vt
-            0NlkRRhWndFGss6gkcf7aIObHw9kAlU6RsspJt5Wte6ZLHj3eATkfA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTbVlQY1kzb3RxZG90RWlG
-            eUNBZlZPNUhEZXBqcFFUdTVXWUgyOFllMjB3Cm9lS09tdXZuYmpzUWJDSnI1OTlG
-            NDBlcWFBSDg3UnB2YVlMRUduTXZsaUUKLS0tIFkwTWxRNnVER3g1VVYzbURKM2ha
-            b09tcStFNWlrRVdBSFhZMVRaYkFGSE0KeHfPNNADsP6v0H9PihaKEDXWjun8ORsb
-            uQKLTz8wKTUk8JIFfY1g5iUqNxG+XvOQrSx/8Cepz+h/2sn3sAcaXw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1vc8svd5277rjkgzg7frf04uaa45w3crhfvg628rqyrqmxul3q9nsjz6yxk
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuWFYzS1B1NVZBZDFNTXRv
-            TS9EOUd5Umw2c2pmUmhzb0ViUUsrZTBNQ0JnClZvajN4ODNYME11aXFiSmxZUlV3
-            eDlhTWFxSkF1UWlGVS9jZkk2SmlsKzQKLS0tIGE0TmNucGNiV2VJV1FnZmw4TEJy
-            aHpTLzdFeGZ6MVkzTmRjZit0U1I0Zk0Kd6DJlpqsqwwlAXC8Tl0AhijCQ8gHtFwX
-            VeTC0PsUdMxEoTq3mg4aM0M5AML4txDKRpFH4XkH9G6lgU9hNebXUA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ulmzprdmcd8r0w47a0nrrlg8melkjk6evl2rc54yh6lxkcfas36q6wrsv9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyS21pT3U4R3pjU255QVdV
-            NXgrTDhVT3IvVVQ4N051TkdFT3NJMWozRFhvCnloNmRROTdMZHpkSDB6L25vVWlX
-            RWNTM2czYmNKcUI5NTVZdmwvRWhmQ00KLS0tIElJTmI4aC9xVHk4dHF4cWtEQ0RQ
-            VTJzUUtIaklZVVVNS3JLOWZSbXJYWDgKHcnC1EQ9qSfCgnoNPUa1/fTWJd8zhSAA
-            +5aMUt6Ff4FF3I3e+CIbbTHZdpjgLoO3BgAYFMwn7iImjGDYTuSHQA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1lfjkch3pqaq3uwmjxyucpm2tws6llxqqjglj4yn49jkwkf50xvmqrl974e
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiR1JnZzhpQzdYTll5cFhQ
-            em83Zjh0TjhIZmhRd3hHTVkwendPNzFNMUZJClNqb08vQjVTdjgvblN2YTJsOGZM
-            VU1udXh1NmFOS284ZFJQanNQN1JGbUkKLS0tICtla1RRdHo0TE54bm1YUGJ0R3Jw
-            WTdQMXdFMFJidTFyY3o3a080MUU0c3MKtG/7ruQyF9g++O3YHAhJO8MzflCtjYw3
-            HgzCF68X14ow/47/oKOPjlM19L8lO4a/sDtQ5RevDWn/+RQLY8mUlQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1jnf94uq5ap96vk7nfk3qkr38ylhletc6pskj0ypc470d7gmt0qeqskdy5z
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPKzB6a0pyUTRWeExLaUFu
-            NzlsaEFDNFdkUFZQbmFiTDRObFIrZjBmd1dnCnBqa2l5N01CZ3Voay9vTTgyRmtk
-            V0JYM3NwVVlBVWwxS2o1QVpKSE9SRk0KLS0tIGNaWGxoczh0UG4wOGY1azlnWEtm
-            VGh2SVVSMDh5VnBoOWc1Mi92R1hPLzAKaCkUGHbc1rR6vMZX97cqH4OLhyM+MmMc
-            jPJ2pbrmdZwjHmBVhZUHb+Ow8x8lyERW6Z1mbr1F6eEd5of6dVJ23w==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age12wakcnv487c5rkgv7z6umzywrqwcy6dgguq0dug6lxp64scjsq6sspkmgz
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4UzQ0OFBPZ1BFY0VGSHNF
-            V0tpTFZIdkVtbHE2RkVSZ2lqYi95eGwzbW5jCm9BS0tLZDhwRGhIRExNTjVvVDNy
-            RzUwWmdBMEUyMUpQSWhKK21ZWUNPeEUKLS0tIG9KdlpXaDFLckVhVlBQaWJxeVJm
-            dFZacUhiZDFxK0xZMDJJeCtQUmtuSGcKVz2TOsyw5F4mpFgbZnkWPjQPB7nSKkzd
-            96r8RHs8CrlSpBUP6TG6Q+Tz77G1XIgcZrN9EVyYCQB7zOukIdZ5zw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-03-19T01:51:10Z"
-    mac: ENC[AES256_GCM,data:dIOL/ovDcGbgLNFSNmlR/rneEcVtUQi0wGzLoJpzv3sT23DsiyXm4WZVShIz+Kjxsu6rFsRnqO6yGfHvA9aDE0Iz0DGPm4AgLl2pRq+cgPoTuZRnKptwLLNcCKXxWu74g0bBn6/PirYFcEK3hZN9gejA6910lFrHpsPdmiWVu94=,iv:HaBxBIpS+JWsKg38TuQP9VbsYYGKQjpq1UYWvxAC/MA=,tag:GrI57dalcj/sOwdX7I6lbA==,type:str]
-    pgp: []
-    unencrypted_suffix: _unencrypted
-    version: 3.7.3

services/ipfs-cluster.nix

@@ -1,124 +0,0 @@
-## From https://github.com/NixOS/nixpkgs/pull/100871
-{ config, lib, pkgs, options, ... }:
-with lib;
-let
-  cfg = config.services.ipfs-cluster;
-
-  # secret is by envvar, not flag
-  initFlags = toString [
-    (optionalString (cfg.initPeers != [ ]) "--peers")
-    (lib.strings.concatStringsSep "," cfg.initPeers)
-  ];
-in
-{
-
-  ###### interface
-
-  options = {
-
-    services.ipfs-cluster = {
-
-      enable = mkEnableOption
-        "Pinset orchestration for IPFS - requires ipfs daemon to be useful";
-
-      user = mkOption {
-        type = types.str;
-        default = "ipfs";
-        description = "User under which the ipfs-cluster daemon runs.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "ipfs";
-        description = "Group under which the ipfs-cluster daemon runs.";
-      };
-
-      consensus = mkOption {
-        type = types.enum [ "raft" "crdt" ];
-        description = "Consensus protocol - 'raft' or 'crdt'. https://cluster.ipfs.io/documentation/guides/consensus/";
-      };
-
-      dataDir = mkOption {
-        type = types.str;
-        default = "/var/lib/ipfs-cluster";
-        description = "The data dir for ipfs-cluster.";
-      };
-
-      initPeers = mkOption {
-        type = types.listOf types.str;
-        default = [ ];
-        description = "Peer addresses to initialize with on first run.";
-      };
-
-      openSwarmPort = mkOption {
-        type = types.bool;
-        description = "Open swarm port, secured by the cluster secret. This does not expose the API or proxy. https://cluster.ipfs.io/documentation/guides/security/";
-      };
-
-      secretFile = mkOption {
-        type = types.nullOr types.path;
-        default = null;
-        description = ''
-          File containing the cluster secret in the format of EnvironmentFile as described by
-          <citerefentry><refentrytitle>systemd.exec</refentrytitle>
-          <manvolnum>5</manvolnum></citerefentry>. For example:
-          <programlisting>
-          CLUSTER_SECRET=<replaceable>...</replaceable>
-          </programlisting>
-
-          if null, a new secret will be generated on first run.
-          A secret in the correct format can also be generated by: openssl rand -hex 32
-        '';
-      };
-    };
-  };
-
-  ###### implementation
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.ipfs-cluster ];
-
-
-    systemd.tmpfiles.rules =
-      [ "d '${cfg.dataDir}' - ${cfg.user} ${cfg.group} - -" ];
-
-    systemd.services.ipfs-cluster-init = {
-      path = [ "/run/wrappers" pkgs.ipfs-cluster ];
-      environment.IPFS_CLUSTER_PATH = cfg.dataDir;
-      wantedBy = [ "default.target" ];
-
-      serviceConfig = {
-        # "" clears exec list (man systemd.service -> execStart)
-        ExecStart = [
-          ""
-          "${pkgs.ipfs-cluster}/bin/ipfs-cluster-service init --consensus ${cfg.consensus} ${initFlags}"
-        ];
-        Type = "oneshot";
-        RemainAfterExit = true;
-        User = cfg.user;
-        Group = cfg.group;
-      } // optionalAttrs (cfg.secretFile != null) {
-        EnvironmentFile = cfg.secretFile;
-      };
-      unitConfig.ConditionDirectoryNotEmpty = "!${cfg.dataDir}";
-    };
-
-    systemd.services.ipfs-cluster = {
-      environment.IPFS_CLUSTER_PATH = cfg.dataDir;
-      wantedBy = [ "multi-user.target" ];
-
-      wants = [ "ipfs-cluster-init.service" ];
-      after = [ "ipfs-cluster-init.service" ];
-
-      serviceConfig = {
-        ExecStart =
-          [ "" "${pkgs.ipfs-cluster}/bin/ipfs-cluster-service daemon" ];
-        User = cfg.user;
-        Group = cfg.group;
-      } // optionalAttrs (cfg.secretFile != null) {
-        EnvironmentFile = cfg.secretFile;
-      };
-    };
-    networking.firewall.allowedTCPPorts = mkIf cfg.openSwarmPort [ 9094 9096 ];
-  };
-}

services/ipfs-darwin.nix

@@ -1,48 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-  cfg = config.services.ipfs;
-in
-{
-  options = {
-    services.ipfs = {
-      enable = mkEnableOption "Enable kubo on darwin";
-
-      package = mkOption {
-        type = types.package;
-        default = pkgs.kubo_carmirror;
-        defaultText = literalExpression "pkgs.kubo";
-        description = "The package to use for kubo";
-      };
-
-      logFile = mkOption {
-        type = types.nullOr types.path;
-        default = "/var/tmp/ipfs.log";
-        description = "Absolute path to log stderr / stdout";
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
-
-    launchd.user.agents.ipfs = {
-      path = [ cfg.package ];
-      script = ''
-        if ! test -e $HOME/.ipfs/version; then
-          ${cfg.package}/bin/ipfs init
-        fi
-        ${cfg.package}/bin/ipfs daemon --migrate
-      '';
-      serviceConfig = {
-        KeepAlive = true;
-        RunAtLoad = true;
-        ProcessType = "Background";
-        StandardErrorPath = cfg.logFile;
-        StandardOutPath = cfg.logFile;
-      };
-    };
-  };
-}

shell.nix

@@ -10,4 +10,5 @@
   )
   {
     src = ./.;
-  }).shellNix
+  }
+).shellNix

terraform/.terraform.lock.hcl

@@ -0,0 +1,49 @@
+# This file is maintained automatically by "tofu init".
+# Manual edits may be lost in future updates.
+
+provider "registry.opentofu.org/cloudflare/cloudflare" {
+  version     = "4.52.0"
+  constraints = "~> 4.0"
+  hashes = [
+    "h1:Pi5M+GeoMSN2eJ6QnIeXjBf19O+rby/74CfB2ocpv20=",
+    "zh:19be1a91c982b902c42aba47766860dfa5dc151eed1e95fd39ca642229381ef0",
+    "zh:1de451c4d1ecf7efbe67b6dace3426ba810711afdd644b0f1b870364c8ae91f8",
+    "zh:352b4a2120173298622e669258744554339d959ac3a95607b117a48ee4a83238",
+    "zh:3c6f1346d9154afbd2d558fabb4b0150fc8d559aa961254144fe1bc17fe6032f",
+    "zh:4c4c92d53fb535b1e0eff26f222bbd627b97d3b4c891ec9c321268676d06152f",
+    "zh:53276f68006c9ceb7cdb10a6ccf91a5c1eadd1407a28edb5741e84e88d7e29e8",
+    "zh:7925a97773948171a63d4f65bb81ee92fd6d07a447e36012977313293a5435c9",
+    "zh:7dfb0a4496cfe032437386d0a2cd9229a1956e9c30bd920923c141b0f0440060",
+    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
+    "zh:8d4aa79f0a414bb4163d771063c70cd991c8fac6c766e685bac2ee12903c5bd6",
+    "zh:a67540c13565616a7e7e51ee9366e88b0dc60046e1d75c72680e150bd02725bb",
+    "zh:a936383a4767f5393f38f622e92bf2d0c03fe04b69c284951f27345766c7b31b",
+    "zh:d4887d73c466ff036eecf50ad6404ba38fd82ea4855296b1846d244b0f13c380",
+    "zh:e9093c8bd5b6cd99c81666e315197791781b8f93afa14fc2e0f732d1bb2a44b7",
+    "zh:efd3b3f1ec59a37f635aa1d4efcf178734c2fcf8ddb0d56ea690bec342da8672",
+  ]
+}
+
+provider "registry.opentofu.org/digitalocean/digitalocean" {
+  version     = "2.49.2"
+  constraints = "~> 2.0"
+  hashes = [
+    "h1:JzS2Y+M1FEMa7/wbKqiCsLSfcUC/HAg9Cq+3HeJuZgo=",
+    "zh:0fdf521cd264fa17ade903673a96e30b017da1970950d7566d8efaeb7eeaa051",
+    "zh:1457402e4c5e588e1fc7dc4f360e994c06ab84b4822186e5d67cccef80d817de",
+    "zh:1b5f1e524cc74c8c9bfe214950972c054ddb24424b396b2c25a932938408dde5",
+    "zh:293f45fbed53f41b18b4212dee571617cd2968793aedb477958a0b01d640cfbc",
+    "zh:316dd02bc81d6aeea5fd38c0fe6819fc13696a5f239111e93f9c9730491c2df4",
+    "zh:32fa7a2a88a50f93025d9ece6b7d755e5c7931fc14f8336341c0939616224523",
+    "zh:52a977f7ecd480ca03a4a6821afa2de893966a8baa38834b1570ec2ae5b71ec9",
+    "zh:8c733467ff87aa98495a1c8cdb83d6c6fbaa93a329ff6611ef8ff11d86801321",
+    "zh:93352fe00a2ada0f188e8669c61283b708a602e10aa7d5ddda9302b24b47fe14",
+    "zh:9357cf59572b21c4b9d85c6cb22facf9d82cf037f8674b884b3a7be66a06f598",
+    "zh:a3286ecb621e052fba29c26737b093329c5bcd99d7d7c8fc470ce4695b129abd",
+    "zh:b66b7b8e37c3614a3e4083b118e6d0de63b90029471a94e5cbb7f44c6d36330d",
+    "zh:d06dd42935819ea454516edd24f980ca6c1e18ebb3c3e47f8ff4f4ef68fb06e4",
+    "zh:d89490c30f3e4f097d71af5075b126e5ec13983f3072275a5c0c468bf0df8a57",
+    "zh:de7d8114938c52920426ae94451edb26ba98583712545c480a69308506ec6a72",
+    "zh:f6a55d865a3f4ec3a79359bd30e4ef6e2742f1e02a1d934e44b41b092155fc45",
+  ]
+}

terraform/cloudflare_dns.tf

@@ -0,0 +1,17 @@
+locals {
+  account_id = "273a4698f673c012fd50161e46ceafdb"
+}
+
+resource "cloudflare_zone" "walkah_codes" {
+  account_id = local.account_id
+  zone       = "walkah.codes"
+}
+
+resource "cloudflare_record" "walkah_codes" {
+  zone_id = cloudflare_zone.walkah_codes.id
+  name    = "walkah.codes"
+  type    = "A"
+  proxied = true
+  content = digitalocean_droplet.socrates.ipv4_address
+}
+

terraform/digitalocean_droplets.tf

@@ -0,0 +1,9 @@
+
+resource "digitalocean_droplet" "socrates" {
+  name       = "socrates"
+  image      = "72067660"
+  size       = "s-8vcpu-16gb"
+  backups    = true
+  ipv6       = true
+  monitoring = true
+}

terraform/main.tf

@@ -0,0 +1,21 @@
+terraform {
+  required_version = ">= 1.8.0"
+
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "~> 4.0"
+    }
+    digitalocean = {
+      source  = "digitalocean/digitalocean"
+      version = "~> 2.0"
+    }
+  }
+}
+
+provider "cloudflare" {
+  api_token = var.cloudflare_token
+}
+provider "digitalocean" {
+  token = var.do_token
+}

terraform/variables.tf

@@ -0,0 +1,6 @@
+variable "cloudflare_token" {
+  type = string
+}
+variable "do_token" {
+  type = string
+}

tsconfig.json

@@ -1,18 +0,0 @@
-{
-    "compilerOptions": {
-        "strict": true,
-        "outDir": "bin",
-        "target": "es2016",
-        "module": "commonjs",
-        "moduleResolution": "node",
-        "sourceMap": true,
-        "experimentalDecorators": true,
-        "pretty": true,
-        "noFallthroughCasesInSwitch": true,
-        "noImplicitReturns": true,
-        "forceConsistentCasingInFileNames": true
-    },
-    "files": [
-        "index.ts"
-    ]
-}

users/default.nix

@@ -1,5 +0,0 @@
-{ ... }:
-
-{
-  imports = [ ./walkah.nix ];
-}

users/walkah.nix

@@ -1,13 +0,0 @@
-{ pkgs, ... }:
-
-{
-  users.users.walkah = {
-    isNormalUser = true;
-    shell = pkgs.zsh;
-    extraGroups = [ "wheel" "docker" ];
-    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ0mE4MyMnfd1b2nlBJT7kpZ6Vov+ILuGNfzdp5ZBNQe walkah@walkah.net"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM8YMax7PGIrcPNIHkpuNRFgn3HJK6Wepm+ycZWO6jfR walkah@walkah-ipadpro11"
-    ];
-  };
-}