containers/emerald/flake.nix

@@ -39,7 +39,7 @@
         useACMEHost = "lava.moe";
         forceSSL = true;
         locations."/".proxyPass = "http://[${client}]:4533";
-        listenAddresses = config.me.localAddrs;
+        listenAddresses = [ "100.67.2.1" ];
       };
 
       systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" ];

hosts/alyssum/default.nix

@@ -33,12 +33,9 @@
 
     ./filesystem.nix
     ./kernel.nix
-    ./home.syncthing.nix
-    ./immich.nix
     ./networking.nix
-    ./restic.nix
+    ./home.syncthing.nix
     ./samba.nix
-    ./snapper.nix
 
     ../../users/hana
   ];

hosts/alyssum/filesystem.nix

@@ -1,4 +1,4 @@
-{ gcSecrets, ... }:
+{ ... }:
 let
   bind = src: {
     depends = [ "/nix" ];
@@ -32,6 +32,4 @@ in {
     "/persist/.snapshots" = submount "/snap/persist" false;
     "/var/log/journal" = bind "/persist/journal";
   };
-
-  me.binds."${gcSecrets.binds."navi/1a"}" = gcSecrets.binds."navi/1b";
 }

hosts/alyssum/immich.nix

@@ -1,37 +0,0 @@
-{ config, gcSecrets, ... }:
-let
-  fqdn = "photos.lava.moe";
-  shareFqdn = "memo.lava.moe";
-in {
-  services.immich = {
-    enable = true;
-    accelerationDevices = null;
-    settings.server.externalDomain = "https://${shareFqdn}";
-  };
-
-  me.binds."/var/lib/immich" = "/flower/immich";
-  me.binds."/var/lib/immich/encoded-video" = "immich/encoded-video";
-  me.binds."/var/lib/immich/profile" = "immich/profile";
-  me.binds."/var/lib/immich/thumbs" = "immich/thumbs";
-  me.binds."/mnt/immich_external/1/1" = gcSecrets.binds."immich/external/1/1";
-  me.binds."/mnt/immich_external/1/2" = gcSecrets.binds."immich/external/1/2";
-  hardware.graphics.enable = true;
-  users.users.immich.extraGroups = [ "video" "render" ];
-
-  services.nginx.virtualHosts."${fqdn}" = {
-    useACMEHost = "lava.moe";
-    forceSSL = true;
-    listenAddresses = config.me.localAddrs;
-
-    locations."/" = {
-      proxyPass = "http://[::1]:${toString config.services.immich.port}";
-      proxyWebsockets = true;
-      extraConfig = ''
-        client_max_body_size 50000M;
-        proxy_read_timeout   600s;
-        proxy_send_timeout   600s;
-        send_timeout         600s;
-      '';
-    };
-  };
-}

hosts/alyssum/networking.nix

@@ -12,5 +12,4 @@
     defaultGateway = "192.168.1.1";
     nameservers = [ "8.8.8.8" "8.8.4.4" ];
   };
-  me.localAddrs = [ "100.67.2.1" ];
 }

hosts/alyssum/restic.nix

@@ -1,31 +0,0 @@
-{ config, lib, ... }: {
-  age.secrets.restic_env.file = ../../secrets/restic_env.age;
-  age.secrets.restic_pass.file = ../../secrets/restic_pass.age;
-  age.secrets.restic_url.file = ../../secrets/restic_url.age;
-
-  services.restic.backups."flower" = {
-    initialize = true;
-    createWrapper = true;
-    progressFps = 0.016666;
-
-    environmentFile = config.age.secrets.restic_env.path;
-    passwordFile = config.age.secrets.restic_pass.path;
-    repositoryFile = config.age.secrets.restic_url.path;
-
-    paths = ["/flower"];
-    exclude = ["/flower/.snapshots"]
-    ++ builtins.filter (x: lib.strings.hasPrefix "/flower" x) (builtins.attrNames config.me.binds);
-    timerConfig = {
-      # every 6 hours
-      OnCalendar = "*-*-* 00,06,12,18:00:00";
-      Persistent = true;
-    };
-    pruneOpts = [
-      "--keep-last 8"
-      "--keep-daily 7"
-      "--keep-weekly 5"
-      "--keep-monthly 12"
-      "--keep-yearly 75"
-    ];
-  };
-}

hosts/alyssum/snapper.nix

@@ -1,19 +0,0 @@
-{ ... }: {
-  services.snapper = {
-    cleanupInterval = "1h";
-    persistentTimer = true;
-    snapshotInterval = "*-*-* *:00,30:00";
-    configs.home = {
-      FSTYPE = "btrfs";
-      SUBVOLUME = "/flower";
-      TIMELINE_CLEANUP = true;
-      TIMELINE_CREATE = true;
-      TIMELINE_MIN_AGE = "86400";
-      TIMELINE_LIMIT_HOURLY = "24";
-      TIMELINE_LIMIT_DAILY = "7";
-      TIMELINE_LIMIT_WEEKLY = "5";
-      TIMELINE_LIMIT_MONTHLY = "3";
-      TIMELINE_LIMIT_YEARLY = "0";
-    };
-  };
-}

hosts/dandelion/default.nix

@@ -34,7 +34,6 @@
 
     ./filesystem.nix
     ./kernel.nix
-    ./immich-proxy.nix
     ./networking.nix
     ./nginx.nix
 

hosts/dandelion/immich-proxy.nix

@@ -1,26 +0,0 @@
-{ config, ... }:
-let
-  fqdn = "photos.lava.moe";
-  shareFqdn = "memo.lava.moe";
-in {
-  services.immich-public-proxy = {
-    enable = true;
-    immichUrl = "https://${fqdn}";
-  };
-
-  services.nginx.virtualHosts."${shareFqdn}" = {
-    useACMEHost = "lava.moe";
-    forceSSL = true;
-
-    locations."/" = {
-      proxyPass = "http://[::1]:${toString config.services.immich-public-proxy.port}";
-      proxyWebsockets = true;
-      extraConfig = ''
-        client_max_body_size 50000M;
-        proxy_read_timeout   600s;
-        proxy_send_timeout   600s;
-        send_timeout         600s;
-      '';
-    };
-  };
-}

modules/options.nix

@@ -49,9 +49,5 @@ in {
       type = with lib.types; attrsOf str;
       default = {};
     };
-
-    localAddrs = lib.mkOption {
-      type = with lib.types; listOf str;
-    };
   };
 }

modules/system/tailscale.nix

@@ -10,7 +10,4 @@
     openFirewall = true;
     useRoutingFeatures = if config.me.environment == "headless" then "both" else "client";
   };
-  systemd.services.tailscaled.serviceConfig.LogFilterPatterns = [
-    "~magicsock.*does not know about peer.*removing route"
-  ];
 }

modules/user/git.nix

@@ -11,7 +11,6 @@
       core.abbrev = 11;
       safe.directory = "/home/rin/Projects/flakes";
       init.defaultBranch = "master";
-      push.autoSetupRemote = true;
     };
   };
 }

secrets.nix

@@ -12,10 +12,6 @@ in {
   "secrets/passwd_smbkujira.age".publicKeys = [ alyssum rin ];
   "secrets/wpa_conf.age".publicKeys = [ alyssum blossom rin ];
 
-  "secrets/restic_env.age".publicKeys = [ alyssum dandelion rin ];
-  "secrets/restic_pass.age".publicKeys = [ alyssum dandelion rin ];
-  "secrets/restic_url.age".publicKeys = [ alyssum dandelion rin ];
-
   "secrets/acme_dns.age".publicKeys = [ alyssum dandelion hazel rin ];
   "secrets/navidrome_env.age".publicKeys = [ alyssum dandelion rin ];
   "secrets/slskd_env.age".publicKeys = [ anemone dandelion rin ];

secrets/restic_env.age

@@ -1,10 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 kOMSPw CYNG6K56RVMY5KP3vTczaCG9DVL3Ryv7QtqRzrdONh4
-VKH43RjHzP2TcyK8bEO8pZzZZeXqNXEDNq4JCkhMXlQ
--> ssh-ed25519 bRFqeQ AmuEljYrO5qqhaJQONYxQZTlaid2qNt+kktiMRDSKl4
-u+KzYFuEx+UCBfdcpup0fbEp1vGMP24nE3MwvcjhTSc
--> ssh-ed25519 U9FXlg IKN6gdqtD0FDOBk5vXuLD7AYuRtCGsIe5CYMJwyvcG4
-f5lkALvyjz1X94JmnG4u9kZ0S1TgZeBv+uxumFPChzQ
---- 3LBfI6E7NfSK1F42/cQkUzrpry6OWCeW/67YOpZe00k
-8Ä<EFBFBD>gé†Òî9(<Ý9OT.L_C2ûXT¿1Lô‡=¨3ÓÞØWCÓo¾ze?4ƒsUÁ.Ã<zø¤ëI…ºèyŠÔÕ,bPü?žžå(Òb»¬?7„é„dÕƒU€*-<Ãò줯aDÖ<44>‰±éþ^,?3¼Ü	ðE²ább«
-vHÇ

secrets/restic_url.age

@@ -1,9 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 kOMSPw l9/BY4rhuzGl/MRKjJ6Hyz2AGpsIZlDojQhSzJ8IxzY
-tEGqxZOEWHZvTazrDoC4uTOyuT7fgRKXxumxpjdE89o
--> ssh-ed25519 bRFqeQ XQ1wRRwOP1bIiEX/Dh4tkHB3vF1OdZcLNTtVVM1oWgU
-S6qXQsPNY0bGaUz+iLoJ0GBL26FtM4h/sgxqvIwOS3g
--> ssh-ed25519 U9FXlg pmY+R/M38tLi1dq2ll9FDv6uaGv8XlkE99NoAemtlGY
-FGZodar5ESxmOZYDZ0F8P1FXNzkEpqT6jyJgzY5wLc0
---- ig7eZey8XraBclyUEJRv1lJUyiOjqsfGc8Q+jjbAuvQ
-e˜Ä¶Š@‰zYþäö¶µtÒÁØ÷Vï4%s29>§íªéÿé–‡(<28>y8Â% ªj|PÓѨ:»©<C2BB>:å-˜Y´I±Òä )C̹ÝI%
yÙ¸:îLC¯f¨q_