privatevoid.net/depot
1
1
Fork 0
Code Issues 25 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

Merge pull request #119 from privatevoid-net/pr-flake-update

Browse source 
`flake.lock`: Update
This commit is contained in:
hercules-ci[bot] 2025-02-06 18:21:33 +00:00 • committed by GitHub
commit e7d430fe7b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
17 changed files with 1812 additions and 104 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
cluster/services/consul/ready.nix
View file

@ -49,6 +49,7 @@ in
DynamicUser = true;
TimeoutStartSec = "5m";
Type = "oneshot";
StartLimitBurst = 25;
};
};
}

1
cluster/services/fbi/host.nix
View file

@ -30,6 +30,7 @@ with depot.lib.nginx;
};
sonarr = {
enable = true;
package = depot.packages.sonarr5;
};
prowlarr = {
enable = true;

22
cluster/services/matrix/bridges/discord.nix
View file

@ -1,22 +0,0 @@
{ cluster, depot, ... }:
let
inherit (depot.lib.meta) domain;
in
{
services.matrix-appservice-discord = {
enable = true;
environmentFile = cluster.config.services.matrix.secrets.discordAppServiceToken.path;
settings = {
bridge = {
inherit domain;
homeserverUrl = "https://matrix.${domain}:443";
disablePresence = false;
disableTypingNotifications = false;
disableDeletionForwarding = false;
enableSelfServiceBridging = true;
disableReadReceipts = false;
disableJoinLeaveNotifications = true;
};
};
};
}

1
cluster/services/matrix/default.nix
View file

@ -10,7 +10,6 @@
homeserver = [
./homeserver.nix
./coturn.nix
./bridges/discord.nix
];
static = [
./federation.nix

5
cluster/services/matrix/homeserver.nix
View file

@ -77,9 +77,6 @@ in {
# HACK: upstream has a weird assertion that doesn't work with our HAProxy setup
# this host gets overridden by dbConfigOut
database = lib.recursiveUpdate dbConfig.database { args.host = "_patroni.local"; };
app_service_config_files = [
"/etc/synapse/discord-registration.yaml"
];
turn_uris = let
combinations = lib.cartesianProduct {
proto = [ "udp" "tcp" ];
@ -115,7 +112,7 @@ in {
};
};
systemd.services = lib.mkMerge [
(lib.genAttrs [ "coturn" "matrix-appservice-discord" "matrix-synapse" ] (_: {
(lib.genAttrs [ "coturn" "matrix-synapse" ] (_: {
serviceConfig = {
Slice = "communications.slice";
};

2
cluster/services/patroni/simulacrum/test.nix
View file

@ -108,6 +108,8 @@ in
clients[0].succeed(f"{setEnv} consul kv delete --recurse services/incandescence/providers/patroni/formulae/database/existingdb")
clients[0].succeed(f"{setEnv} consul kv delete --recurse services/incandescence/providers/patroni/formulae/user/existinguser")
for client in clients:
node.systemctl("start locksmith.service")
for node in nodes:
node.systemctl("restart incandescence-patroni.target")
clients[0].succeed("[[ $(psql -h ${link.ipv4} -p ${link.portStr} -U postgres --tuples-only --csv --command=\"SELECT pg_roles.rolname FROM pg_database JOIN pg_roles ON pg_database.datdba = pg_roles.oid WHERE pg_database.datname = 'existingdb'\") == existinguser ]]")

80
flake.lock generated
View file

@ -10,11 +10,11 @@
"systems": "systems"
},
"locked": {
"lastModified": 1723293904,
"narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
"lastModified": 1736955230,
"narHash": "sha256-uenf8fv2eG5bKM8C/UvFaiJMZ4IpUFaQxk9OH5t/1gA=",
"owner": "ryantm",
"repo": "agenix",
"rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
"rev": "e600439ec4c273cf11e06fe4d9d906fb98fa097c",
"type": "github"
},
"original": {
@ -39,11 +39,11 @@
]
},
"locked": {
"lastModified": 1730906442,
"narHash": "sha256-tBuyb8jWBSHHgcIrOfiyQJZGY1IviMzH2V74t7gWfgI=",
"lastModified": 1738524606,
"narHash": "sha256-hPYEJ4juK3ph7kbjbvv7PlU1D9pAkkhl+pwx8fZY53U=",
"owner": "zhaofengli",
"repo": "attic",
"rev": "d0b66cf897e4d55f03d341562c9821dc4e566e54",
"rev": "ff8a897d1f4408ebbf4d45fa9049c06b3e1e3f4e",
"type": "github"
},
"original": {
@ -117,11 +117,11 @@
]
},
"locked": {
"lastModified": 1728330715,
"narHash": "sha256-xRJ2nPOXb//u1jaBnDP56M7v5ldavjbtR6lfGqSvcKg=",
"lastModified": 1735644329,
"narHash": "sha256-tO3HrHriyLvipc4xr+Ewtdlo7wM1OjXNjlWRgmM7peY=",
"owner": "numtide",
"repo": "devshell",
"rev": "dd6b80932022cea34a019e2bb32f6fa9e494dfef",
"rev": "f7795ede5b02664b57035b3b757876703e2c3eac",
"type": "github"
},
"original": {
@ -214,11 +214,11 @@
]
},
"locked": {
"lastModified": 1730504689,
"narHash": "sha256-hgmguH29K2fvs9szpq2r3pz2/8cJd2LPS+b4tfNFCwE=",
"lastModified": 1738453229,
"narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
"owner": "hercules-ci",
"repo": "flake-parts",
"rev": "506278e768c2a08bec68eb62932193e341f55c90",
"rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
"type": "github"
},
"original": {
@ -304,11 +304,11 @@
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1723736589,
"narHash": "sha256-/Vdg5ZKtP71ZEKVV6JXlrOEu0CM2Flcs+nwDmWRzgjQ=",
"lastModified": 1736919270,
"narHash": "sha256-cGd3JaoHeN7g+qLrvvwR+1RbJ0oTJp3LiHDL3OlJJUg=",
"owner": "hercules-ci",
"repo": "hercules-ci-agent",
"rev": "c303cc8e437c0fd26b9452472e7df5aa374e9177",
"rev": "cae08186393d9736f2b3a5d30b2c7efe5569e337",
"type": "github"
},
"original": {
@ -327,11 +327,11 @@
]
},
"locked": {
"lastModified": 1730903510,
"narHash": "sha256-mnynlrPeiW0nUQ8KGZHb3WyxAxA3Ye/BH8gMjdoKP6E=",
"lastModified": 1738237977,
"narHash": "sha256-oJN/yvRL7G0WlR/hTkQIjFbPkzCV+sFnNB/38Tb9RL4=",
"owner": "hercules-ci",
"repo": "hercules-ci-effects",
"rev": "b89ac4d66d618b915b1f0a408e2775fe3821d141",
"rev": "6d1b6d5d59758b4f5f05745f774fc13cdc59da43",
"type": "github"
},
"original": {
@ -369,11 +369,11 @@
"nixpkgs": "nixpkgs_2"
},
"locked": {
"lastModified": 1721084841,
"narHash": "sha256-zWajCfHFqPa3Z72DHcxBUq4bmcCu1lpEKUbZZewpYOE=",
"lastModified": 1736693502,
"narHash": "sha256-v4pmfHApR11CNLVMko9uqDU3jYFYrNkEYB/5gLf7ubY=",
"owner": "hyprspace",
"repo": "hyprspace",
"rev": "b54fd70812b98994630cfa6aac17ad7c2be9b468",
"rev": "a5957e485ff0c2e9133e7da5408ec1273681688e",
"type": "github"
},
"original": {
@ -451,11 +451,11 @@
},
"nix-filter": {
"locked": {
"lastModified": 1730207686,
"narHash": "sha256-SCHiL+1f7q9TAnxpasriP6fMarWE5H43t25F5/9e28I=",
"lastModified": 1731533336,
"narHash": "sha256-oRam5PS1vcrr5UPgALW0eo1m/5/pls27Z/pabHNy2Ms=",
"owner": "numtide",
"repo": "nix-filter",
"rev": "776e68c1d014c3adde193a18db9d738458cd2ba4",
"rev": "f7653272fd234696ae94229839a99b73c9ab7de0",
"type": "github"
},
"original": {
@ -500,11 +500,11 @@
]
},
"locked": {
"lastModified": 1731271232,
"narHash": "sha256-HSNUAfhtG/A2hnrzPMT3asZZ2Wb3dAmedOr1VzptOCg=",
"rev": "1eb19dd804a83d99c497118af8ab781eee569c65",
"lastModified": 1733338937,
"narHash": "sha256-rciw6KIBxnH4utK+7B0bnhexz+hFJ53YE4xAPvPS/SE=",
"rev": "09416ef0230295a5645532874a662a798e14087b",
"type": "tarball",
"url": "https://forge.privatevoid.net/api/v1/repos/max/nix-super/archive/1eb19dd804a83d99c497118af8ab781eee569c65.tar.gz"
"url": "https://forge.privatevoid.net/api/v1/repos/max/nix-super/archive/09416ef0230295a5645532874a662a798e14087b.tar.gz"
},
"original": {
"type": "tarball",
@ -513,11 +513,11 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1719848872,
"narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=",
"lastModified": 1736798957,
"narHash": "sha256-qwpCtZhSsSNQtK4xYGzMiyEDhkNzOCz/Vfu4oL2ETsQ=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8",
"rev": "9abb87b552b7f55ac8916b6fc9e5cb486656a2f3",
"type": "github"
},
"original": {
@ -529,11 +529,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1714076141,
"narHash": "sha256-Drmja/f5MRHZCskS6mvzFqxEaZMeciScCTFxWVLqWEY=",
"lastModified": 1735834308,
"narHash": "sha256-dklw3AXr3OGO4/XT1Tu3Xz9n/we8GctZZ75ZWVqAVhk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "7bb2ccd8cdc44c91edba16c48d2c8f331fb3d856",
"rev": "6df24922a1400241dae323af55f30e4318a6ca65",
"type": "github"
},
"original": {
@ -561,11 +561,11 @@
},
"nixpkgs_4": {
"locked": {
"lastModified": 1730785428,
"narHash": "sha256-Zwl8YgTVJTEum+L+0zVAWvXAGbWAuXHax3KzuejaDyo=",
"lastModified": 1738758495,
"narHash": "sha256-CZ8T4vP3ag2hwkpSZjatxJb55ouszvmnWw09qxGW9TU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "4aa36568d413aca0ea84a1684d2d46f55dbabad7",
"rev": "ceaea203f3ae1787b1bd13f021f686391696fc5b",
"type": "github"
},
"original": {
@ -582,11 +582,11 @@
]
},
"locked": {
"lastModified": 1726560853,
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {

10
modules/nixpkgs-config/default.nix
View file

@ -1,9 +1,15 @@
{ depot, lib, ... }:
{ depot, lib, pkgs, ... }:
{
imports = [
depot.inputs.nixpkgs.nixosModules.readOnlyPkgs
];
nixpkgs.overlays = lib.mkForce [];
options.nixpkgs.system = lib.mkOption {
type = lib.types.str;
default = pkgs.system;
readOnly = true;
};
config.nixpkgs.overlays = lib.mkForce [];
}

1
packages/checks/s3ql-upgrade.nix
View file

@ -56,7 +56,6 @@ testers.runNixOSTest {
machine.succeed("echo HelloWorld > /srv/test/hello/world.txt")
with subtest("should upgrade"):
machine.succeed("systemctl stop remote-storage-test.service")
machine.succeed("/run/current-system/specialisation/upgrade/bin/switch-to-configuration test")
machine.wait_for_unit("remote-storage-test.service")
machine.succeed("systemctl is-active remote-storage-test.service")

31
packages/patched-derivations.nix
View file

@ -2,6 +2,13 @@ let
tools = import ./lib/tools.nix;
pins = import ./sources;
acceptVulnerabilities = drv:
assert drv.meta ? knownVulnerabilities && builtins.length drv.meta.knownVulnerabilities > 0;
drv.overrideAttrs (old: {
meta = old.meta // {
knownVulnerabilities = [];
};
});
in with tools;
super: rec {
acme-dns = patch super.acme-dns "patches/base/acme-dns";
@ -19,7 +26,7 @@ super: rec {
};
jitsi-meet-insecure = let
olm-insecure = assert builtins.length super.olm.meta.knownVulnerabilities > 0; super.olm.overrideAttrs (o: { meta = o.meta // { knownVulnerabilities = []; }; });
olm-insecure = acceptVulnerabilities super.olm;
in super.jitsi-meet.override { olm = olm-insecure; };
jre17_standard = let
@ -55,4 +62,26 @@ super: rec {
super.python3Packages.systemd
];
});
sonarr5 = let
version = "5.0.0.12";
src = super.fetchFromGitHub {
owner = "Sonarr";
repo = "Sonarr";
tag = "v${version}";
hash = "sha256-Pw+dvXNp0kQSwK+y3xZzcDivy45zgpqfZe1OUM8GOqY=";
};
in super.sonarr.override {
buildDotnetModule = args: super.buildDotnetModule (args // {
inherit version src;
nugetDeps = ./servers/sonarr/deps.json;
dotnet-sdk = super.dotnetCorePackages.sdk_8_0;
dotnet-runtime = super.dotnetCorePackages.aspnetcore_8_0;
dotnetFlags = map (builtins.replaceStrings ["net6.0" super.sonarr.version] ["net8.0" version]) args.dotnetFlags;
});
fetchYarnDeps = args: super.fetchYarnDeps (args // {
yarnLock = "${src}/yarn.lock";
hash = "sha256-ckaU3me5fGcOhK0m8BzMWaXc+zPpYyu+GhUHLts9edY=";
});
};
}

1692
packages/servers/sonarr/deps.json Normal file
View file

File diff suppressed because it is too large Load diff

28
packages/sources/sources.json
View file

@ -9,10 +9,10 @@
},
"pre_releases": false,
"version_upper_bound": null,
"version": "v3.2.0",
"revision": "9ecb233763048c730d24ddacecc8c002d3c8fc89",
"url": "https://api.github.com/repos/cinnyapp/cinny/tarball/v3.2.0",
"hash": "17ndz0x5zws2y533c3wa80mhk0k5n1d4il9agv04aglpd75vn1n0"
"version": "v4.2.3",
"revision": "a142630ff970e47303fb0aeff0f7cad6f6fbdaf3",
"url": "https://api.github.com/repos/cinnyapp/cinny/tarball/v4.2.3",
"hash": "1dh1kxfkl69l6dmwria60s37qnbip4yz29n3l5jfw4lz218i1186"
},
"excalidraw": {
"type": "Git",
@ -22,9 +22,9 @@
"repo": "excalidraw"
},
"branch": "master",
"revision": "04668d8263b35bf76f1390b25abeeed4181820f6",
"url": "https://github.com/excalidraw/excalidraw/archive/04668d8263b35bf76f1390b25abeeed4181820f6.tar.gz",
"hash": "10vxvyzx5nw2f0ykw3ng5lh2hiy6nrgpdqiypmcq9caxi6qn7h11"
"revision": "302664e500c7f2ee44a1f107d8f4680c0254305b",
"url": "https://github.com/excalidraw/excalidraw/archive/302664e500c7f2ee44a1f107d8f4680c0254305b.tar.gz",
"hash": "02a9jy73lqgmb8h2zcs37h932gzxg7ky2pvb65wd7kcqrcybpp6n"
},
"searxng": {
"type": "Git",
@ -34,9 +34,9 @@
"repo": "searxng"
},
"branch": "master",
"revision": "39aaac40d63d53555b7fc12d56f0825c85ecf567",
"url": "https://github.com/searxng/searxng/archive/39aaac40d63d53555b7fc12d56f0825c85ecf567.tar.gz",
"hash": "0bhlh28n7p36v1q67xqmzxz6icm7kqgqxiyz806swfzykp9hfzxg"
"revision": "6324a9752a2b21a1dcb709c7fb643e361189163e",
"url": "https://github.com/searxng/searxng/archive/6324a9752a2b21a1dcb709c7fb643e361189163e.tar.gz",
"hash": "0b2wy613mds5xl5pqizrb8ncbhk1m8xcbnnsycqks1vypyvr00q4"
},
"stevenblack-hosts": {
"type": "GitRelease",
@ -47,10 +47,10 @@
},
"pre_releases": false,
"version_upper_bound": null,
"version": "3.14.82",
"revision": "73ef1823bb9b76d6cbde5d349e82eed0d5dcb4cb",
"url": "https://api.github.com/repos/StevenBlack/hosts/tarball/3.14.82",
"hash": "1f3d1m27xph8canm7ll0c2fbh6gzf4pfqmrbhix1fg2hxz1pwbqm"
"version": "3.15.15",
"revision": "a39424667f67c4f9836126fefa2fb25fe83839b6",
"url": "https://api.github.com/repos/StevenBlack/hosts/tarball/3.15.15",
"hash": "0kpha475jsw8fbq2z1mn4m94a6a5skgmkia0q6w8sh8lba30y9y3"
}
},
"version": 2

1
packages/system-filter.nix
View file

@ -5,6 +5,7 @@
keycloak = [ "x86_64-linux" ];
prometheus-jitsi-exporter = [ "aarch64-linux" ];
searxng = [ "x86_64-linux" ];
sonarr5 = [ "x86_64-linux" ];
tempo = [ "x86_64-linux" ];
};
}

2
packages/web-apps/cinny/default.nix
View file

@ -11,7 +11,7 @@ let
src = fetchzip {
name = "cinny-tarball-${version}";
url = "https://github.com/${repo.owner}/${repo.repo}/releases/download/${cinny.version}/cinny-${cinny.version}.tar.gz";
sha256 = "sha256-4mOMVwwoR8NJVD7kikXAEN3kUAoH5hYHz0md0LYX7bo=";
sha256 = "sha256-T2XKSR59lZoazTN0boQhBOYZTac/a+K1OZrgeKwsbvU=";
};
buildCommand = ''

2
packages/web-apps/excalidraw/default.nix
View file

@ -27,7 +27,7 @@ let
offlineCache = fetchYarnDeps {
name = "excalidraw-yarn-cache-${builtins.hashString "sha256" (builtins.readFile "${excalidraw}/yarn.lock")}";
yarnLock = src + "/yarn.lock";
hash = "sha256-iEk6yh+2sQkm/oucAGj16x/SpKc1WqXYtYTos82R0bQ=";
hash = "sha256-SthMtDZtGGTVRYYRHIPUbQe8ixZ9XSFMAl35MMN4JHY=";
};
configurePhase = ''

3
packages/web-apps/searxng/default.nix
View file

@ -50,6 +50,9 @@ toPythonModule (buildPythonApplication rec {
fasttext-predict
pybind11
pytomlpp
msgspec
typer
isodate
(callPackage ./deps/chompjs.nix {})
];

34
patches/base/kanidm/unixd-authenticated.patch
View file

@ -1,5 +1,5 @@
diff --git a/unix_integration/resolver/src/idprovider/kanidm.rs b/unix_integration/resolver/src/idprovider/kanidm.rs
index 63cedb4d5..35c45fb0e 100644
index d0a6a8159..7ebc0449d 100644
--- a/unix_integration/resolver/src/idprovider/kanidm.rs
+++ b/unix_integration/resolver/src/idprovider/kanidm.rs
@@ -7,6 +7,7 @@ use kanidm_proto::internal::OperationError;
@ -10,7 +10,7 @@ index 63cedb4d5..35c45fb0e 100644
use tokio::sync::{broadcast, Mutex};
use kanidm_lib_crypto::CryptoPolicy;
@@ -38,6 +39,8 @@ struct KanidmProviderInternal {
@@ -39,6 +40,8 @@ struct KanidmProviderInternal {
hmac_key: HmacKey,
crypto_policy: CryptoPolicy,
pam_allow_groups: BTreeSet<String>,
@ -19,7 +19,7 @@ index 63cedb4d5..35c45fb0e 100644
}
pub struct KanidmProvider {
@@ -102,6 +105,19 @@ impl KanidmProvider {
@@ -103,6 +106,19 @@ impl KanidmProvider {
.map(|GroupMap { local, with }| (local, Id::Name(with)))
.collect();
@ -39,7 +39,7 @@ index 63cedb4d5..35c45fb0e 100644
Ok(KanidmProvider {
inner: Mutex::new(KanidmProviderInternal {
state: CacheState::OfflineNextCheck(now),
@@ -109,6 +125,8 @@ impl KanidmProvider {
@@ -110,6 +126,8 @@ impl KanidmProvider {
hmac_key,
crypto_policy,
pam_allow_groups,
@ -48,16 +48,16 @@ index 63cedb4d5..35c45fb0e 100644
}),
map_group,
})
@@ -256,7 +274,11 @@ impl KanidmProviderInternal {
}
async fn attempt_online(&mut self, _tpm: &mut tpm::BoxedDynTpm, now: SystemTime) -> bool {
- match self.client.auth_anonymous().await {
+ let auth_method = match (&self.auth_name, &self.auth_password) {
+ (Some(name), Some(password)) => self.client.auth_simple_password(name, password).await,
+ _ => self.client.auth_anonymous().await
+ };
+ match auth_method {
Ok(_uat) => {
self.state = CacheState::Online;
true
@@ -262,7 +280,11 @@ impl KanidmProviderInternal {
let mut max_attempts = 3;
while max_attempts > 0 {
max_attempts -= 1;
- match self.client.auth_anonymous().await {
+ let auth_method = match (&self.auth_name, &self.auth_password) {
+ (Some(name), Some(password)) => self.client.auth_simple_password(name, password).await,
+ _ => self.client.auth_anonymous().await
+ };
+ match auth_method {
Ok(_uat) => {
debug!("provider is now online");
self.state = CacheState::Online;