updates: nixpkgs, home-manager, plasma-manager

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749178927,
-        "narHash": "sha256-bXcEx1aZUNm5hMLVJeuofcOrZyOiapzvQ7K36HYK3YQ=",
+        "lastModified": 1760130406,
+        "narHash": "sha256-GKMwBaFRw/C1p1VtjDz4DyhyzjKUWyi1K50bh8lgA2E=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "91287a0e9d42570754487b7e38c6697e15a9aab2",
+        "rev": "d305eece827a3fe317a2d70138f53feccaf890a1",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1747663185,
-        "narHash": "sha256-Obh50J+O9jhUM/FgXtI3he/QRNiV9+J53+l+RlKSaAk=",
+        "lastModified": 1751903740,
+        "narHash": "sha256-PeSkNMvkpEvts+9DjFiop1iT2JuBpyknmBUs0Un0a4I=",
         "owner": "nix-community",
         "repo": "nixos-generators",
-        "rev": "ee07ba0d36c38e9915c55d2ac5a8fb0f05f2afcc",
+        "rev": "032decf9db65efed428afd2fa39d80f7089085eb",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1748929857,
-        "narHash": "sha256-lcZQ8RhsmhsK8u7LIFsJhsLh/pzR9yZ8yqpTzyGdj+Q=",
+        "lastModified": 1760038930,
+        "narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "c2a03962b8e24e669fb37b7df10e7c79531ff1a4",
+        "rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
         "type": "github"
       },
       "original": {
@@ -82,11 +82,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1748196248,
-        "narHash": "sha256-1iHjsH6/5UOerJEoZKE+Gx1BgAoge/YcnUsOA4wQ/BU=",
+        "lastModified": 1759321049,
+        "narHash": "sha256-8XkU4gIrLT2DJZWQyvsP5woXGZF5eE/7AnKfwQkiwYU=",
         "owner": "nix-community",
         "repo": "plasma-manager",
-        "rev": "b7697abe89967839b273a863a3805345ea54ab56",
+        "rev": "205dcfd4a30d4a5d1b4f28defee69daa7c7252cd",
         "type": "github"
       },
       "original": {
@@ -111,11 +111,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746643487,
-        "narHash": "sha256-dcB/DArJObCvqE/ZEdQSDW2BZMeDyF83Se5KPfJvz60=",
+        "lastModified": 1753137768,
+        "narHash": "sha256-bCQ8IHak1hF38amAgz2YKIEwteU5eAkgoC0fwfoRxO0=",
         "owner": "Platonic-Systems",
         "repo": "secrix",
-        "rev": "4c64203fa5b377953b1fb6d5388187df8b60c6d5",
+        "rev": "f783b038ee639a589affcf3c612187dafcfa0476",
         "type": "github"
       },
       "original": {

flake.nix

@@ -31,12 +31,25 @@
 
       home-manager.useGlobalPkgs = true;
       home-manager.useUserPackages = true;
-      home-manager.sharedModules = [ plasma-manager.homeManagerModules.plasma-manager ];
+      home-manager.sharedModules = [ plasma-manager.homeModules.plasma-manager ];
 
       home-manager.users.cazzzer = import file;
       # Optionally, use home-manager.extraSpecialArgs to pass
       # arguments to home.nix
     };
+
+    mkRouter = hostFile: nixpkgs.lib.nixosSystem {
+      system = "x86_64-linux";
+      modules = [
+        secrix.nixosModules.default
+        ./modules
+        ./modules/router
+        ./hosts/common.nix
+        hostFile
+        ./users/cazzzer
+        (hmModule ./home/common.nix)
+      ];
+    };
   in
   {
     apps.x86_64-linux.secrix = secrix.secrix self;
@@ -77,17 +90,9 @@
           (hmModule ./home/cazzzer-pc.nix)
         ];
       };
-      router = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = [
-          secrix.nixosModules.default
-          ./modules
-          ./hosts/common.nix
-          ./hosts/router
-          ./users/cazzzer
-          (hmModule ./home/common.nix)
-        ];
-      };
+      router = mkRouter ./hosts/router;
+      router-1 = mkRouter ./hosts/router-1;
+      router-2 = mkRouter ./hosts/router-2;
     };
     # https://github.com/nix-community/nixos-generators?tab=readme-ov-file#using-in-a-flake
     packages.x86_64-linux = {

hosts/Yura-PC/hardware-configuration.nix

@@ -18,6 +18,11 @@
       fsType = "zfs";
     };
 
+  fileSystems."/nix" =
+    { device = "zroot/data/nix";
+      fsType = "zfs";
+    };
+
   fileSystems."/boot" =
     { device = "/dev/disk/by-uuid/970C-6A15";
       fsType = "vfat";

hosts/common-desktop.nix

@@ -7,7 +7,7 @@
     "sysrq_always_enabled=1"
   ];
 
-  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_14;
+  boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_16;
   boot.loader = {
     efi.canTouchEfiVariables = true;
     timeout = 3;
@@ -24,6 +24,9 @@
 
   # Enable networking
   networking.networkmanager.enable = true;
+  networking.networkmanager.plugins = [
+    pkgs.networkmanager-openvpn
+  ];
 
   # Enable the X11 windowing system.
   # You can disable this if you're only using the Wayland session.
@@ -58,7 +61,7 @@
   programs.git.enable = true;
   programs.git.lfs.enable = true;
   # https://nixos.wiki/wiki/Git
-  programs.git.package = pkgs.git.override { withLibsecret = true; };
+  programs.git.package = pkgs.git.override { withLibsecret = true; doInstallCheck = false; };
   programs.lazygit.enable = true;
   programs.neovim.enable = true;
   programs.wireshark.enable = true;
@@ -107,6 +110,7 @@
     jq
     ldns
     mediainfo
+    powertop
     rbw
     restic
     resticprofile
@@ -141,6 +145,7 @@
     android-studio
     rustup
     zed-editor
+    package-version-server # for zed
   ] ++ [
     # Python
     python3
@@ -163,5 +168,8 @@
     # Gleam
     gleam
     beamMinimal26Packages.erlang
+    
+    # Racket
+    racket
   ];
 }

hosts/router-1/default.nix

@@ -0,0 +1,24 @@
+{
+  imports = [
+    ../hw-vm.nix
+  ];
+
+  router = {
+    enableDesktop = false;
+    enableDhcpClient = false;
+    wanMAC = "bc:24:11:af:bd:84";
+    lanMAC = "bc:24:11:38:b1:91";
+    wanLL = "fe80::be24:11ff:feaf:bd84";
+    lanLL = "fe80::be24:11ff:fe38:b191";
+    defaultToken = 251;
+
+    pdFromWan = "fd46:fbbe:ca55:100";
+    wanAddr4 = "192.168.1.63";
+    wanGw4 = "192.168.1.254";
+  };
+
+  networking.hostName = "grouty";
+
+  # override hw-vm.nix default
+  networking.useDHCP = false;
+}

hosts/router-2/default.nix

@@ -0,0 +1,24 @@
+{
+  imports = [
+    ../hw-vm.nix
+  ];
+
+  router = {
+    enableDesktop = false;
+    enableDhcpClient = false;
+    wanMAC = "bc:24:11:bc:db:c1";
+    lanMAC = "bc:24:11:19:2a:96";
+    wanLL = "fe80::be24:11ff:febc:dbc1";
+    lanLL = "fe80::be24:11ff:fe19:2a96";
+    defaultToken = 252;
+
+    pdFromWan = "fd46:fbbe:ca55:100";
+    wanAddr4 = "192.168.1.64";
+    wanGw4 = "192.168.1.254";
+  };
+
+  networking.hostName = "grouta";
+
+  # override hw-vm.nix default
+  networking.useDHCP = false;
+}

hosts/router/default.nix

@@ -1,16 +1,18 @@
 {
   imports = [
-    ../../modules/router
     ./hardware-configuration.nix
     ./private.nix
   ];
 
   router = {
     enableDesktop = false;
+    enableDhcpClient = true;
     wanMAC = "bc:24:11:4f:c9:c4";
     lanMAC = "bc:24:11:83:d8:de";
     wanLL = "fe80::be24:11ff:fe4f:c9c4";
     lanLL = "fe80::be24:11ff:fe83:d8de";
     defaultToken = 1;
   };
+
+  networking.hostName = "grouter";
 }

modules/opts/kb-input/default.nix

@@ -45,7 +45,7 @@ in {
       enable = true;
       type = "fcitx5";
       fcitx5.waylandFrontend = true;
-      fcitx5.plasma6Support = true;
+      # fcitx5.plasma6Support = true;
       fcitx5.addons = [ pkgs.fcitx5-mozc ];
     };
   };

modules/router/default.nix

@@ -30,8 +30,6 @@ in
   boot.kernelPackages = pkgs.linuxKernel.packages.linux_6_12;
   boot.growPartition = true;
 
-  networking.hostName = "grouter";
-
   # Enable the X11 windowing system.
   # You can disable this if you're only using the Wayland session.
   services.xserver.enable = false;
@@ -78,6 +76,7 @@ in
     starship
     tealdeer
     transcrypt
+    wakeonlan
     waypipe
     whois
     wireguard-tools

modules/router/dns.nix

@@ -80,11 +80,14 @@ in
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.p4}.12"
       "|etappi.${sysdomain}^$dnsrewrite=${ifs.lan.ulaPrefix}::12:1"
 
+      "|hass.${domain}^$dnsrewrite=${ifs.lan.ulaAddr}"
+
       # Lab DNS rewrites
       "||lab.${domain}^$dnsrewrite=etappi.${sysdomain}"
 
       # Allowed exceptions
       "@@||googleads.g.doubleclick.net"
+      "@@||stats.grafana.org"
     ]
       # Alpina DNS rewrites
       ++ map (host: "${host}${domain}^$dnsrewrite=debbi.${sysdomain}") alpinaDomains;

modules/router/firewall.nix

@@ -56,6 +56,12 @@ in
               udp . 45608 : ${vars.extra.opnsense.addr4} . 45608,
               udp . 35848 : ${vars.extra.opnsense.addr4} . 35848,
               udp . 48425 : ${vars.extra.opnsense.addr4} . 48425,
+              # Amnezia VPN server
+              udp . 37138 : ${vars.extra.amnezia.addr4} . 37138,
+              # Minecruft server
+              tcp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
+              udp . 25565 : ${vars.extra.minecruft.addr4} . 25565,
+              udp . 24454 : ${vars.extra.minecruft.addr4} . 24454,
           }
       }
 

modules/router/ifconfig.nix

@@ -1,5 +1,6 @@
 { config, lib, pkgs, ... }:
 let
+  cfg = config.router;
   vars = import ./vars.nix config;
   links = vars.links;
   ifs = vars.ifs;
@@ -57,7 +58,7 @@ in
   # https://github.com/systemd/systemd/issues/22571
   # https://github.com/systemd/systemd/issues/22571#issuecomment-2094905496
   # https://gist.github.com/csamsel/0f8cca3b2e64d7e4cc47819ec5ba9396
-  networking.dhcpcd.enable = true;
+  networking.dhcpcd.enable = cfg.enableDhcpClient;
   networking.dhcpcd.allowInterfaces = [ ifs.wan.name ];
   networking.dhcpcd.extraConfig = ''
     debug

modules/router/opts.nix

@@ -8,30 +8,36 @@ with lib;
       enableDesktop = mkOption {
         type = types.bool;
         default = false;
-        description = "Enable desktop environment";
+        description = "Enable desktop environment for debugging";
+      };
+
+      enableDhcpClient = mkOption {
+        type = types.bool;
+        default = false;
+        description = "Enable DHCP client (should only be set on the main router)";
       };
 
       wanMAC = mkOption {
         type = types.str;
-        default = "bc:24:11:4f:c9:c4";
+        example = "bc:24:11:4f:c9:c4";
         description = "WAN interface MAC address";
       };
 
       lanMAC = mkOption {
         type = types.str;
-        default = "bc:24:11:83:d8:de";
+        example = "bc:24:11:83:d8:de";
         description = "LAN interface MAC address";
       };
 
       wanLL = mkOption {
           type = types.str;
-          default = "fe80::be24:11ff:fe4f:c9c4";
+          example = "fe80::be24:11ff:fe4f:c9c4";
           description = "WAN IPv6 link-local address";
       };
 
       lanLL = mkOption {
           type = types.str;
-          default = "fe80::be24:11ff:fe83:d8de";
+          example = "fe80::be24:11ff:fe83:d8de";
           description = "LAN IPv6 link-local address";
       };
 
@@ -43,17 +49,20 @@ with lib;
 
       wanAddr4 = mkOption {
         type = types.str;
+        example = "192.168.1.61";
         description = "WAN IPv4 address";
       };
 
       wanGw4 = mkOption {
         type = types.str;
+        example = "192.168.1.254";
         description = "WAN IPv4 gateway";
       };
 
       pdFromWan = mkOption {
         type = types.str;
-        description = "IPv6 prefix delegation from WAN";
+        example = "2001:db8:0:000";
+        description = "IPv6 prefix delegation from ISP (/60)";
       };
     };
   };

modules/router/services.nix

@@ -58,27 +58,36 @@ in
     enable = true;
     package = pkgs.caddy.withPlugins {
       plugins = [ "github.com/caddy-dns/cloudflare@v0.2.1" ];
-      hash = "sha256-Gsuo+ripJSgKSYOM9/yl6Kt/6BFCA6BuTDvPdteinAI=";
+      hash = "sha256-XwZ0Hkeh2FpQL/fInaSq+/3rCLmQRVvwBM0Y1G1FZNU=";
     };
-    virtualHosts."grouter.${domain}".extraConfig = ''
+    virtualHosts."*.${domain}".extraConfig = ''
       encode
       tls {
           dns cloudflare {env.CF_API_KEY}
           resolvers 1.1.1.1
       }
-      @grafana path /grafana /grafana/*
-      handle @grafana {
-          reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
-      }
-      redir /adghome /adghome/
-      handle_path /adghome/* {
-          reverse_proxy localhost:${toString config.services.adguardhome.port}
-          basic_auth {
-              Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
+
+      @grouter host grouter.${domain}
+      handle @grouter {
+          @grafana path /grafana /grafana/*
+          handle @grafana {
+              reverse_proxy localhost:${toString config.services.grafana.settings.server.http_port}
+          }
+          redir /adghome /adghome/
+          handle_path /adghome/* {
+              reverse_proxy localhost:${toString config.services.adguardhome.port}
+              basic_auth {
+                  Bob $2a$14$HsWmmzQTN68K3vwiRAfiUuqIjKoXEXaj9TOLUtG2mO1vFpdovmyBy
+              }
+          }
+          handle /* {
+              reverse_proxy localhost:${toString config.services.glance.settings.server.port}
           }
       }
-      handle /* {
-          reverse_proxy localhost:${toString config.services.glance.settings.server.port}
+
+      @hass host hass.${domain}
+      handle @hass {
+          reverse_proxy homeassistant.4.lab.l.cazzzer.com:8123
       }
     '';
   };

modules/router/vars.nix

@@ -77,7 +77,7 @@ rec {
       p4_ = "${p4}.20";                  # .0/24
       p6_ = "${pdFromWan}0";             # ::/64 managed by Att box
       ulaPrefix_ = "${ulaPrefix}:0020";  # ::/64
-      ip6Token_ = "::1:1";  # override ipv6 for lan20, since the Att box uses ::1 here
+      ip6Token_ = "::1:${toString cfg.defaultToken}";  # override ipv6 for lan20, since the Att box uses ::1 here
     };
     lan30 = mkIfConfig {
       name_ = "${lan.name}.30";
@@ -135,5 +135,7 @@ rec {
         }
       ];
     };
+    amnezia.addr4 = "${ifs.lan10.p4}.31";
+    minecruft.addr4 = "${ifs.lan.p4}.11";
   };
 }

users/cazzzer/default.nix

@@ -5,7 +5,7 @@
     isNormalUser = true;
     description = "Yura";
     group = "cazzzer";
-    extraGroups = [ "wheel" ]
+    extraGroups = [ "wheel" "dialout" ]
       ++ lib.optionals config.networking.networkmanager.enable [ "networkmanager" ]
       ++ lib.optionals config.virtualisation.docker.enable [ "docker" ]
       ++ lib.optionals config.programs.wireshark.enable [ "wireshark" ]