cluster/simulacrum: only run checks on x86_64-linux

cluster/services/c-f32aebf5/default.nix

@@ -0,0 +1,6 @@
+{
+  services.c-f32aebf5 = {
+    nodes.host = [ "VEGAS" ];
+    nixos.host = [ ./host.nix ];
+  };
+}

cluster/services/c-f32aebf5/host.nix

@@ -0,0 +1,203 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cid = "c-f32aebf5";
+  link = config.links.${cid};
+  root = "/var/lib/${cid}";
+  home = "${root}/pfx";
+
+  sptAki =  {
+    release-3_8_0 = pkgs.fetchurl {
+      url = "https://dev.sp-tarkov.com/SPT/Stable-releases/releases/download/3.8.0/RELEASE-SPT-3.8.0-29197-2dd4d91.7z";
+      hash = "sha256-IRMzI+hQkoCmVJXkAV4c/b2l/MtLb98IwDftMbFTlxA=";
+    };
+    update-3_8_1 = pkgs.fetchurl {
+      url = "https://spt-releases.modd.in/SPT-3.8.1-29197-d3ac83e.7z";
+      hash = "sha256-3roQlHgi8CUtLKji2YZLNgo8s92eUv3a+AbKo7VFB2U=";
+    };
+  };
+
+  installSpt = pkgs.writeShellScript "install-spt" ''
+    mkdir spt
+    cd spt
+    ${pkgs.p7zip}/bin/7z x -y ${sptAki.release-3_8_0}
+    ${pkgs.p7zip}/bin/7z x -y ${sptAki.update-3_8_1}
+  '';
+in
+
+{
+  links.${cid} = {
+    protocol = "http";
+    ipv4 = config.reflection.interfaces.primary.addrPublic;
+  };
+
+  users.users.${cid} = {
+    isNormalUser = true;
+    group = cid;
+    inherit home;
+    openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCvaZG+5642/jjqVaFGsS3DK0Jtg1wfMY4Yh20tFKtdcZEsLRy16KSJkPH447vP91pGkx8T+GJ1kXEw4dMR9dOKDwS2qCgHwAQbZ2V+/NNJ56bCzTo+geSc/imrWjiHQUhzPRcTyI6pVi3rVAhzEnAVjcC7a4LnLsIFW8Ill0kF8OR4tHoeDNCNN/0XOgZH4dIT9eQCyw4u5zOaw9W81eTL7K1PLmbAWW1+qd//C6CrpxpxNO/kAnOavkscK1uJSfGRcs7Vb5mKKV2J7Be0vxCVY8C8h1qcYcrzudTs9MbQAgFP00bVcvl/byd5CAccQ2wBfuwUdJBC4MV8HZ152biGds8sdCBDoxyvSqScaBFza0iHAXPEygvfx+gEW9KNssfBoiU50SJgWbQUp9gQoppATg8XHqUI03xUeVBRbTyf7UMd2Qk3slWPEnEXlzvjwKGxyLsI0WKdWtqALgKe7mDn+wDAG15CayACi4kgKkZh3VariRC5Ks17LJdLH67vBvs="
+    ];
+  };
+  users.groups.${cid} = {};
+
+  systemd.services.${cid} = {
+    wantedBy = [ "multi-user.target" ];
+
+    path = [
+      pkgs.jq
+      pkgs.wine64Packages.staging
+      pkgs.tmux
+    ];
+
+    preStart = ''
+      cd ${home}
+      test -e drive_c || wine64 wineboot
+
+      cd drive_c
+      test -e spt || ${installSpt}
+
+      cd spt
+      jq < Aki_Data/Server/configs/http.json > .http-new.json \
+        '.ip = "${link.ipv4}" | .port = ${link.portStr} | .backendIp = "${link.ipv4}" | .backendPort = ${link.portStr}'
+      mv .http-new.json Aki_Data/Server/configs/http.json
+    '';
+
+    script = ''
+      cd ${home}/drive_c/spt
+      tmux new -s 0 -d wine64 Aki.Server.exe
+      exec tmux wait-for stop
+    '';
+
+    environment = {
+      WINEPREFIX = "${home}";
+    };
+
+    restartIfChanged = false;
+
+    serviceConfig = {
+      DynamicUser = true;
+      User = cid;
+      Group = cid;
+      ReadWritePaths = [ home ];
+
+      ExecStop = "${pkgs.wine64Packages.staging}/bin/wineserver --kill";
+      Restart = "on-failure";
+
+      CPUQuota = "75%";
+      MemoryMax = "2G";
+      MemorySwapMax = "2G";
+
+      IPAddressDeny = [
+        "10.0.0.0/8"
+        "100.64.0.0/10"
+        "169.254.0.0/16"
+        "172.16.0.0/12"
+        "192.0.0.0/24"
+        "192.0.2.0/24"
+        "192.168.0.0/16"
+        "198.18.0.0/15"
+        "198.51.100.0/24"
+        "203.0.113.0/24"
+        "240.0.0.0/4"
+        "100::/64"
+        "2001:2::/48"
+        "2001:db8::/32"
+        "fc00::/7"
+        "fe80::/10"
+      ];
+      IPAddressAllow = lib.unique config.networking.nameservers;
+    };
+  };
+
+  systemd.services."${cid}-backup" = {
+    startAt = "04:00";
+
+    script = ''
+      cd ${home}/drive_c/spt/user
+      tarball=".profiles-backup-$(date +%s).tar"
+      final="profiles-backup-$(date +%Y-%m-%d-%H:%M:%S).tar.xz"
+      ${pkgs.gnutar}/bin/tar cvf "$tarball" profiles/
+      ${pkgs.xz}/bin/xz -9 "$tarball"
+      mv "''${tarball}.xz" "$final"
+      ${pkgs.rotate-backups}/bin/rotate-backups -S yes -q --daily 30 --weekly 12 -I 'profiles-backup-*.tar.xz' .
+    '';
+
+    unitConfig.ConditionPathExists = "${home}/drive_c/spt/user";
+
+    serviceConfig = {
+      Type = "oneshot";
+      DynamicUser = true;
+      User = cid;
+      Group = cid;
+      ReadWritePaths = [ home ];
+      PrivateNetwork = true;
+    };
+  };
+
+  systemd.services."${cid}-auto-restart" = {
+    startAt = "05:00";
+
+    script = ''
+      echo -n "Service status: "
+      if ! systemctl is-active '${cid}.service'; then
+        echo Service not active.
+        exit
+      fi
+
+      for i in {1..120}; do
+        if test "$(${pkgs.iproute2}/bin/ss -H -tn 'cgroup = /sys/fs/cgroup/system.slice/${cid}.service' | wc -l)" != 0; then
+          echo Service in use.
+          exit
+        fi
+        sleep 1
+      done
+
+      echo Restarting service...
+      systemctl restart --no-block '${cid}.service'
+    '';
+
+    unitConfig.ConditionPathExists = "${home}/drive_c/spt";
+
+    serviceConfig = {
+      Type = "oneshot";
+    };
+  };
+  systemd.services."${cid}-control" = {
+    script = ''
+      if test -e ${home}/drive_c/spt/control/restart; then
+        echo Action: restart
+        trap 'rm -f ${home}/drive_c/spt/control/restart' EXIT
+        systemctl restart ${cid}.service
+      elif test -e ${home}/drive_c/spt/control/shutdown; then
+        echo Action: stop
+        systemctl stop ${cid}.service
+      else
+        echo Action: start
+        systemctl start ${cid}.service
+      fi
+    '';
+
+    unitConfig.ConditionPathExists = "${home}/drive_c/spt/control";
+
+    serviceConfig = {
+      Type = "oneshot";
+    };
+  };
+
+  systemd.paths."${cid}-control" = {
+    wantedBy = [ "paths.target" ];
+    pathConfig.PathChanged = "${home}/drive_c/spt/control";
+  };
+
+  services.openssh.extraConfig = ''
+    Match User ${cid}
+      ChrootDirectory ${root}
+      ForceCommand internal-sftp -d /pfx/drive_c
+      AllowTcpForwarding no
+      X11Forwarding no
+      PasswordAuthentication no
+  '';
+
+  networking.firewall.allowedTCPPorts = [ link.port ];
+}

cluster/services/hercules-ci-multi-agent/common.nix

@@ -1,4 +1,4 @@
-{ cluster, config, depot, lib, ... }:
+{ cluster, depot, lib, ... }:
 
 let
   inherit (cluster.config.services.hercules-ci-multi-agent) nodes secrets;
@@ -40,19 +40,8 @@ in
     settings = {
       clusterJoinTokenPath = secrets."clusterJoinToken-${org}".path;
       binaryCachesPath = secrets.cacheConfig.path;
-      concurrentTasks = lib.pipe config.reflection.hardware.cpu.cores [
-        (lib.flip builtins.div 2)
-        builtins.floor
-        (lib.max 2)
-      ];
     };
   });
 
-  nix.settings.cores = lib.pipe config.reflection.hardware.cpu.cores [
-    (builtins.mul 0.75)
-    builtins.floor
-    (lib.max 1)
-  ];
-
   users.groups.hercules-ci-agent.members = map (org: "hci-${org}") (lib.attrNames nodes);
 }

cluster/services/idm/client.nix

@@ -27,7 +27,7 @@ in
     mode = "0755";
     text = ''
       #!/bin/sh
-      exec ${config.services.kanidm.package}/bin/kanidm_ssh_authorizedkeys "$@"
+      exec ${pkgs.kanidm}/bin/kanidm_ssh_authorizedkeys "$@"
     '';
   };
 
@@ -57,10 +57,10 @@ in
   environment.systemPackages = let
     idmAlias = pkgs.runCommand "kanidm-idm-alias" {} ''
       mkdir -p $out/bin
-      ln -s ${config.services.kanidm.package}/bin/kanidm $out/bin/idm
+      ln -s ${pkgs.kanidm}/bin/kanidm $out/bin/idm
       mkdir -p $out/share/bash-completion/completions
       cat >$out/share/bash-completion/completions/idm.bash <<EOF
-      source ${config.services.kanidm.package}/share/bash-completion/completions/kanidm.bash
+      source ${pkgs.kanidm}/share/bash-completion/completions/kanidm.bash
       complete -F _kanidm -o bashdefault -o default idm
       EOF
     '';

cluster/services/irc/irc-host.nix

@@ -90,7 +90,7 @@ in {
   security.pam.services.ngircd = {
     text = ''
       # verify IRC users via IDM
-      auth required ${config.services.kanidm.package}/lib/pam_kanidm.so 
+      auth required ${pkgs.kanidm}/lib/pam_kanidm.so 
     '';
   };
   systemd.services.ngircd = {

flake.lock

@@ -10,11 +10,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1722339003,
+        "lastModified": 1718371084,
-        "narHash": "sha256-ZeS51uJI30ehNkcZ4uKqT4ZDARPyqrHADSKAwv5vVCU=",
+        "narHash": "sha256-abpBi61mg0g+lFFU0zY4C6oP6fBwPzbHPKBGw676xsA=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "3f1dae074a12feb7327b4bf43cbac0d124488bb7",
+        "rev": "3a56735779db467538fb2e577eda28a9daacaca6",
         "type": "github"
       },
       "original": {
@@ -40,11 +40,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722472866,
+        "lastModified": 1717279440,
-        "narHash": "sha256-GJIz4M5HDB948Ex/8cPvbkrNzl/eKUE7/c21JBu4lb8=",
+        "narHash": "sha256-kH04ReTjxOpQumgWnqy40vvQLSnLGxWP6RF3nq5Esrk=",
         "owner": "zhaofengli",
         "repo": "attic",
-        "rev": "e127acbf9a71ebc0c26bc8e28346822e0a6e16ba",
+        "rev": "717cc95983cdc357bc347d70be20ced21f935843",
         "type": "github"
       },
       "original": {
@@ -113,16 +113,19 @@
     },
     "devshell": {
       "inputs": {
+        "flake-utils": [
+          "repin-flake-utils"
+        ],
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1722113426,
+        "lastModified": 1717408969,
-        "narHash": "sha256-Yo/3loq572A8Su6aY5GP56knpuKYRvM2a1meP9oJZCw=",
+        "narHash": "sha256-Q0OEFqe35fZbbRPPRdrjTUUChKVhhWXz3T9ZSKmaoVY=",
         "owner": "numtide",
         "repo": "devshell",
-        "rev": "67cce7359e4cd3c45296fb4aaf6a19e2a9c757ae",
+        "rev": "1ebbe68d57457c8cae98145410b164b5477761f4",
         "type": "github"
       },
       "original": {
@@ -194,11 +197,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1722555600,
+        "lastModified": 1719994518,
-        "narHash": "sha256-XOQkdLafnb/p9ij77byFQjDf5m5QYl9b2REiVClC+x4=",
+        "narHash": "sha256-pQMhCCHyQGRzdfAkdJ4cIWiw+JNuWsTX7f0ZYSyz0VY=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "8471fe90ad337a8074e957b69ca4d0089218391d",
+        "rev": "9227223f6d922fee3c7b190b2cc238a99527bbb7",
         "type": "github"
       },
       "original": {
@@ -268,11 +271,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1720223941,
+        "lastModified": 1719398431,
-        "narHash": "sha256-QDbU8LZzcUSqBp1CBqDj/f5Wd/sdgQ8pZwRWueoMUL4=",
+        "narHash": "sha256-p6cC+0/c6GCBPtBkSnaOrhwLWl+uyoWYl/dReg+jcsk=",
         "owner": "hercules-ci",
         "repo": "hercules-ci-agent",
-        "rev": "2e10fb21fc2e07edf40763b73443e5934bd40947",
+        "rev": "c37b2ada2dd001bc4be6771bcdea680b0b93fb94",
         "type": "github"
       },
       "original": {
@@ -333,11 +336,11 @@
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
-        "lastModified": 1721084841,
+        "lastModified": 1721065874,
-        "narHash": "sha256-zWajCfHFqPa3Z72DHcxBUq4bmcCu1lpEKUbZZewpYOE=",
+        "narHash": "sha256-WqIRfqqQwcSrJNPVRxbvCG6uZvKNuPruBL85VcnESRA=",
         "owner": "hyprspace",
         "repo": "hyprspace",
-        "rev": "b54fd70812b98994630cfa6aac17ad7c2be9b468",
+        "rev": "76a3f73a42c2f9bbeb4c56afa4b30a98a283b79f",
         "type": "github"
       },
       "original": {
@@ -393,17 +396,19 @@
     },
     "nar-serve": {
       "inputs": {
+        "flake-utils": [
+          "repin-flake-utils"
+        ],
         "nixpkgs": [
           "nixpkgs"
-        ],
+        ]
-        "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1722409392,
+        "lastModified": 1716758395,
-        "narHash": "sha256-8QuMS00EutmqzAIPxyJEPxM8EHiWlSKs6E2Htoh3Kes=",
+        "narHash": "sha256-yM/ICgmMxUAk/feKojy/Jul8jh4OaVBhQoIChA6Vvq8=",
         "owner": "numtide",
         "repo": "nar-serve",
-        "rev": "9d0eff868d328fe67c60c26c8ba50e0b9d8de867",
+        "rev": "a1458804bb1ab9f1a44101e56a010ca95b8e8309",
         "type": "github"
       },
       "original": {
@@ -456,11 +461,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1719848872,
+        "lastModified": 1719254875,
-        "narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=",
+        "narHash": "sha256-ECni+IkwXjusHsm9Sexdtq8weAq/yUyt1TWIemXt3Ko=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8",
+        "rev": "2893f56de08021cffd9b6b6dfc70fd9ccd51eb60",
         "type": "github"
       },
       "original": {
@@ -504,11 +509,11 @@
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1722539632,
+        "lastModified": 1720107418,
-        "narHash": "sha256-g4L+I8rDl7RQy5x8XcEMqNO49LFhrHTzVBqXtG2+FGo=",
+        "narHash": "sha256-KPxjth7cCwNeTV9jJ90lPu8b/wMi3hcAnUbZ5NzogjA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "f2d6c7123138044e0c68902268bd8f37dd7e2fa7",
+        "rev": "d586b644539e41fafcee09f9b40a6552252dbdb4",
         "type": "github"
       },
       "original": {
@@ -587,7 +592,7 @@
         "nix-super": "nix-super",
         "nixpkgs": "nixpkgs_4",
         "repin-flake-utils": "repin-flake-utils",
-        "systems": "systems_3"
+        "systems": "systems_2"
       }
     },
     "systems": {
@@ -606,21 +611,6 @@
       }
     },
     "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_3": {
       "locked": {
         "lastModified": 1683988522,
         "narHash": "sha256-cAVqq+Mjx4EiWovT7rwbwncX5QBnhNsqwsgyg+eeYrg=",

flake.nix

@@ -62,6 +62,7 @@
       url = "github:numtide/nar-serve";
       inputs = {
         nixpkgs.follows = "nixpkgs";
+        flake-utils.follows = "repin-flake-utils";
       };
     };
 
@@ -69,6 +70,7 @@
       url = "github:numtide/devshell";
       inputs = {
         nixpkgs.follows = "nixpkgs";
+        flake-utils.follows = "repin-flake-utils";
       };
     };
     

hosts/VEGAS/default.nix

@@ -16,11 +16,6 @@ tools: rec {
     };
   };
 
-  hardware = {
-    cpu.cores = 8;
-    memory.gb = 64;
-  };
-
   hyprspace = {
     enable = true;
     id = "QmYs4xNBby2fTs8RnzfXEk161KD4mftBfCiR8yXtgGPj4J";

hosts/checkmate/default.nix

@@ -17,11 +17,6 @@ tools: rec {
     };
   };
 
-  hardware = {
-    cpu.cores = 1;
-    memory.gb = 1;
-  };
-
   hyprspace = {
     enable = true;
     id = "12D3KooWL84sAtq1QTYwb7gVbhSNX5ZUfVt4kgYKz8pdif1zpGUh";

hosts/grail/default.nix

@@ -16,11 +16,6 @@ tools: rec {
     };
   };
 
-  hardware = {
-    cpu.cores = 4;
-    memory.gb = 8;
-  };
-
   hyprspace = {
     enable = true;
     id = "12D3KooWN31twBvdEcxz2jTv4tBfPe3mkNueBwDJFCN4xn7ZwFbi";

hosts/options/default.nix

@@ -9,7 +9,6 @@ let
       ./hour/interfaces.nix
       ./hour/nixos.nix
       ./hour/ssh.nix
-      ./hour/hardware.nix
     ];
   };
 

hosts/options/hour/hardware.nix

@@ -1,18 +0,0 @@
-{ lib, ... }:
-with lib;
-
-{
-  options.hardware = {
-    cpu = {
-      cores = mkOption {
-        type = types.ints.unsigned;
-      };
-    };
-    memory = {
-      gb = mkOption {
-        type = types.ints.unsigned;
-      };
-    };
-  };
-}
-

hosts/prophet/default.nix

@@ -17,11 +17,6 @@ tools: rec {
     };
   };
 
-  hardware = {
-    cpu.cores = 4;
-    memory.gb = 24;
-  };
-
   hyprspace = {
     enable = true;
     id = "QmbrAHuh4RYcyN9fWePCZMVmQjbaNXtyvrDCWz4VrchbXh";

hosts/thunderskin/default.nix

@@ -17,11 +17,6 @@ tools: rec {
     };
   };
 
-  hardware = {
-    cpu.cores = 1;
-    memory.gb = 1;
-  };
-
   hyprspace = {
     enable = true;
     id = "12D3KooWB9AUPorFoACkWbphyargRBV9osJsYuQDumtQ85j7Aqmg";

packages/shadows.nix

@@ -9,7 +9,11 @@
 
     options.shadows = lib.mkOption {
       type = with lib.types; lazyAttrsOf package;
-      default = { };
+      default = {
+        inherit (self'.packages)
+          kanidm
+        ;
+      };
     };
   };
 }

packages/tools/npins/default.nix

@@ -21,7 +21,7 @@ in rustPlatform.buildRustPackage rec {
   inherit (src) version;
   src = passthru.mkSource sources.npins;
 
-  cargoHash = "sha256-aIpGTTLQ+HfLf5i4VON7Rq1xNl4rA+7TZ5yF1Ov8lmc=";
+  cargoSha256 = "0rwnzkmx91cwcz9yw0rbbqv73ba6ggim9f4qgz5pgy6h696ld2k8";
 
   buildInputs = lib.optional stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ Security ]);
   nativeBuildInputs = [ makeWrapper ];

patches/base/s3ql/remove-ssl-monkeypatch.patch

@@ -1,12 +0,0 @@
-diff --git a/tests/t0_http.py b/tests/t0_http.py
-index 66ed564f..36bebab1 100755
---- a/tests/t0_http.py
-+++ b/tests/t0_http.py
-@@ -289,7 +289,6 @@ def do_GET(self):
- 
-     # We don't *actually* want to establish SSL, that'd be
-     # to complex for our mock server
--    monkeypatch.setattr('ssl.match_hostname', lambda x, y: True)
-     conn = HTTPConnection(
-         test_host,
-         test_port,