flake.lock

@@ -8,11 +8,11 @@
       },
       "locked": {
         "dir": "pkgs/firefox-addons",
-        "lastModified": 1750392203,
+        "lastModified": 1749614614,
-        "narHash": "sha256-rJU+WeeLxDinRWEGXw5OT4tToIAO8zy/ULFVWHhLp/Q=",
+        "narHash": "sha256-/193T5cui6RiXWn+bqKDwNt4A1zRYjzTI2g1XLrxVRk=",
         "owner": "rycee",
         "repo": "nur-expressions",
-        "rev": "09e3cfed476fc06384610a7e6027df221fc93bd3",
+        "rev": "78ce8a0ab9e72a4127472e6343a92a33fbd12691",
         "type": "gitlab"
       },
       "original": {
@@ -43,11 +43,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1749398372,
+        "lastModified": 1748821116,
-        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "narHash": "sha256-F82+gS044J1APL0n4hH50GYdPRv/5JWm34oCJYmVKdE=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+        "rev": "49f0870db23e8c1ca0b5259734a02cd9e1e371a1",
         "type": "github"
       },
       "original": {
@@ -118,11 +118,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750304462,
+        "lastModified": 1749628652,
-        "narHash": "sha256-Mj5t4yX05/rXnRqJkpoLZTWqgStB88Mr/fegTRqyiWc=",
+        "narHash": "sha256-f8jDF4G9m7pPySeQc6KskqMgtcJq6X1o2CytMx66qAE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "863842639722dd12ae9e37ca83bcb61a63b36f6c",
+        "rev": "450f06ec3cd0d86f67db58a7245db8848773e895",
         "type": "github"
       },
       "original": {
@@ -148,17 +148,22 @@
     },
     "nil": {
       "inputs": {
+        "flake-utils": [
+          "nvf",
+          "flake-utils"
+        ],
         "nixpkgs": [
           "nvf",
           "nixpkgs"
-        ]
+        ],
+        "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1750047244,
+        "lastModified": 1741118843,
-        "narHash": "sha256-vluLARrk4485npdyHOj8XKr0yk6H22pNf+KVRNL+i/Y=",
+        "narHash": "sha256-ggXU3RHv6NgWw+vc+HO4/9n0GPufhTIUjVuLci8Za8c=",
         "owner": "oxalica",
         "repo": "nil",
-        "rev": "870a4b1b5f12004832206703ac15aa85c42c247b",
+        "rev": "577d160da311cc7f5042038456a0713e9863d09e",
         "type": "github"
       },
       "original": {
@@ -169,11 +174,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1750083401,
+        "lastModified": 1749195551,
-        "narHash": "sha256-ynqbgIYrg7P1fAKYqe8I/PMiLABBcNDYG9YaAP/d/C4=",
+        "narHash": "sha256-W5GKQHgunda/OP9sbKENBZhMBDNu2QahoIPwnsF6CeM=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "61837d2a33ccc1582c5fabb7bf9130d39fee59ad",
+        "rev": "4602f7e1d3f197b3cb540d5accf5669121629628",
         "type": "github"
       },
       "original": {
@@ -184,11 +189,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1750365781,
+        "lastModified": 1749285348,
-        "narHash": "sha256-XE/lFNhz5lsriMm/yjXkvSZz5DfvKJLUjsS6pP8EC50=",
+        "narHash": "sha256-frdhQvPbmDYaScPFiCnfdh3B/Vh81Uuoo0w5TkWmmjU=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "08f22084e6085d19bcfb4be30d1ca76ecb96fe54",
+        "rev": "3e3afe5174c561dee0df6f2c2b2236990146329f",
         "type": "github"
       },
       "original": {
@@ -215,11 +220,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1750215678,
+        "lastModified": 1749174413,
-        "narHash": "sha256-Rc/ytpamXRf6z8UA2SGa4aaWxUXRbX2MAWIu2C8M+ok=",
+        "narHash": "sha256-urN9UMK5cd1dzhR+Lx0xHeTgBp2MatA5+6g9JaxjuQs=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "5395fb3ab3f97b9b7abca147249fa2e8ed27b192",
+        "rev": "6ad174a6dc07c7742fc64005265addf87ad08615",
         "type": "github"
       },
       "original": {
@@ -255,11 +260,11 @@
         "systems": "systems_2"
       },
       "locked": {
-        "lastModified": 1750279337,
+        "lastModified": 1749631819,
-        "narHash": "sha256-K8+lSoyfVIwPpKjPvCQsCWL59VI3XSbgbYdPUkTTaA8=",
+        "narHash": "sha256-iy7UuA2I0DaKEUMncTQNFg0bYDX7sa5WCRQTrIWqmEU=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "787678dd731e0246d42ca70b758ae0ac35bd48e2",
+        "rev": "2a2b5e2790b41eadc42758fd6c4d62b7af64f17c",
         "type": "github"
       },
       "original": {
@@ -304,6 +309,28 @@
         "stable": "stable"
       }
     },
+    "rust-overlay": {
+      "inputs": {
+        "nixpkgs": [
+          "nvf",
+          "nil",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1741055476,
+        "narHash": "sha256-52vwEV0oS2lCnx3c/alOFGglujZTLmObit7K8VblnS8=",
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "rev": "aefb7017d710f150970299685e8d8b549d653649",
+        "type": "github"
+      },
+      "original": {
+        "owner": "oxalica",
+        "repo": "rust-overlay",
+        "type": "github"
+      }
+    },
     "snowfall-lib": {
       "inputs": {
         "flake-compat": "flake-compat",
@@ -331,11 +358,11 @@
         "nixpkgs": "nixpkgs_3"
       },
       "locked": {
-        "lastModified": 1750119275,
+        "lastModified": 1749592509,
-        "narHash": "sha256-Rr7Pooz9zQbhdVxux16h7URa6mA80Pb/G07T4lHvh0M=",
+        "narHash": "sha256-VunQzfZFA+Y6x3wYi2UE4DEQ8qKoAZZCnZPUlSoqC+A=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
+        "rev": "50754dfaa0e24e313c626900d44ef431f3210138",
         "type": "github"
       },
       "original": {
@@ -346,11 +373,11 @@
     },
     "stable": {
       "locked": {
-        "lastModified": 1750330365,
+        "lastModified": 1749488106,
-        "narHash": "sha256-hJ7XMNVsTnnbV2NPmStCC07gvv5l2x7+Skb7hyUzazg=",
+        "narHash": "sha256-b9GIWdF/8jKpCC5JIMgDLZgwe8cEbty2fyTyo1eDFfI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d883b6213afa179b58ba8bace834f1419707d0ad",
+        "rev": "8fe3e32e7f210522377c3bcff80931a3284ace6a",
         "type": "github"
       },
       "original": {

modules/nixos/apps/steam/default.nix

@@ -25,7 +25,6 @@ in
 
       extraPackages = with pkgs; [
         steamtinkerlaunch
-        proton-ge-bin
       ];
     };
 

modules/nixos/services/paperless/default.nix

@@ -1,79 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  namespace,
-  ...
-}:
-with lib;
-with lib.${namespace};
-let
-  cfg = config.${namespace}.services.paperless;
-in
-{
-  options.${namespace}.services.paperless = {
-    enable = mkEnableOption "Paperless";
-    nginx = {
-      enable = mkEnableOption "Enable nginx for this service." // {
-        default = true;
-      };
-    };
-
-    package = mkOption {
-      description = "The package of Paperless to use.";
-      type = types.package;
-      default = pkgs.paperless-ngx;
-    };
-
-    port = mkOption {
-      description = "The port to serve Paperless on.";
-      type = types.nullOr types.int;
-      default = 28981;
-    };
-
-    domain = mkOption {
-      description = "The domain to serve Paperless on.";
-      type = types.nullOr types.str;
-      default = "paperless.stahl.sh";
-    };
-
-  };
-  config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = [
-      80
-      443
-    ];
-
-    services.paperless = {
-      enable = true;
-      port = cfg.port;
-      package = cfg.package;
-      dataDir = "/data/paperless";
-      consumptionDirIsPublic = true;
-      settings = {
-        PAPERLESS_OCR_LANGUAGE = "deu+eng";
-        PAPERLESS_OCR_USER_ARGS = {
-          optimize = 1;
-          pdfa_image_compression = "lossless";
-        };
-        PAPERLESS_DBHOST = ""; # Ensure sqlite database
-        PAPERLESS_URL = "https://${cfg.domain}";
-      };
-    };
-
-    awesome-flake.services.acme.enable = mkIf cfg.nginx.enable true;
-
-    services.nginx = mkIf cfg.nginx.enable {
-      enable = true;
-
-      virtualHosts."${cfg.domain}" = {
-        forceSSL = true;
-        useACMEHost = "stahl.sh";
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
-          recommendedProxySettings = true;
-        };
-      };
-    };
-  };
-}

modules/nixos/services/restic/default.nix

@@ -36,8 +36,7 @@ in
         repositoryFile = "/run/secrets/restic_url";
         paths = [
           "/home"
-          "/var/lib"
+          "/var/lib/caddy"
-          "/data"
         ];
         timerConfig = {
           OnCalendar = "00:10";

modules/nixos/system/fwupd/default.nix

@@ -1,21 +0,0 @@
-{
-  config,
-  lib,
-  namespace,
-  ...
-}:
-with lib;
-with lib.${namespace};
-let
-  cfg = config.${namespace}.system.fwupd;
-in
-{
-  options.${namespace}.system.fwupd = with types; {
-    enable = mkBoolOpt false "Whether or not to enable fwupd.";
-  };
-
-  config = mkIf cfg.enable {
-    services.fwupd.enable = true;
-  };
-
-}

modules/nixos/virtualisation/podman/invidious/config/sql/annotations.sql

@@ -0,0 +1,12 @@
+-- Table: public.annotations
+
+-- DROP TABLE public.annotations;
+
+CREATE TABLE IF NOT EXISTS public.annotations
+(
+  id text NOT NULL,
+  annotations xml,
+  CONSTRAINT annotations_id_key UNIQUE (id)
+);
+
+GRANT ALL ON TABLE public.annotations TO current_user;

modules/nixos/virtualisation/podman/invidious/config/sql/channel_videos.sql

@@ -0,0 +1,30 @@
+-- Table: public.channel_videos
+
+-- DROP TABLE public.channel_videos;
+
+CREATE TABLE IF NOT EXISTS public.channel_videos
+(
+  id text NOT NULL,
+  title text,
+  published timestamp with time zone,
+  updated timestamp with time zone,
+  ucid text,
+  author text,
+  length_seconds integer,
+  live_now boolean,
+  premiere_timestamp timestamp with time zone,
+  views bigint,
+  CONSTRAINT channel_videos_id_key UNIQUE (id)
+);
+
+GRANT ALL ON TABLE public.channel_videos TO current_user;
+
+-- Index: public.channel_videos_ucid_idx
+
+-- DROP INDEX public.channel_videos_ucid_idx;
+
+CREATE INDEX IF NOT EXISTS channel_videos_ucid_idx
+  ON public.channel_videos
+  USING btree
+  (ucid COLLATE pg_catalog."default");
+

modules/nixos/virtualisation/podman/invidious/config/sql/channels.sql

@@ -0,0 +1,25 @@
+-- Table: public.channels
+
+-- DROP TABLE public.channels;
+
+CREATE TABLE IF NOT EXISTS public.channels
+(
+  id text NOT NULL,
+  author text,
+  updated timestamp with time zone,
+  deleted boolean,
+  subscribed timestamp with time zone,
+  CONSTRAINT channels_id_key UNIQUE (id)
+);
+
+GRANT ALL ON TABLE public.channels TO current_user;
+
+-- Index: public.channels_id_idx
+
+-- DROP INDEX public.channels_id_idx;
+
+CREATE INDEX IF NOT EXISTS channels_id_idx
+  ON public.channels
+  USING btree
+  (id COLLATE pg_catalog."default");
+

modules/nixos/virtualisation/podman/invidious/config/sql/nonces.sql

@@ -0,0 +1,22 @@
+-- Table: public.nonces
+
+-- DROP TABLE public.nonces;
+
+CREATE TABLE IF NOT EXISTS public.nonces
+(
+  nonce text,
+  expire timestamp with time zone,
+  CONSTRAINT nonces_id_key UNIQUE (nonce)
+);
+
+GRANT ALL ON TABLE public.nonces TO current_user;
+
+-- Index: public.nonces_nonce_idx
+
+-- DROP INDEX public.nonces_nonce_idx;
+
+CREATE INDEX IF NOT EXISTS nonces_nonce_idx
+  ON public.nonces
+  USING btree
+  (nonce COLLATE pg_catalog."default");
+

modules/nixos/virtualisation/podman/invidious/config/sql/playlist_videos.sql

@@ -0,0 +1,19 @@
+-- Table: public.playlist_videos
+
+-- DROP TABLE public.playlist_videos;
+
+CREATE TABLE IF NOT EXISTS public.playlist_videos
+(
+    title text,
+    id text,
+    author text,
+    ucid text,
+    length_seconds integer,
+    published timestamptz,
+    plid text references playlists(id),
+    index int8,
+    live_now boolean,
+    PRIMARY KEY (index,plid)
+);
+
+GRANT ALL ON TABLE public.playlist_videos TO current_user;

modules/nixos/virtualisation/podman/invidious/config/sql/playlists.sql

@@ -0,0 +1,29 @@
+-- Type: public.privacy
+
+-- DROP TYPE public.privacy;
+
+CREATE TYPE public.privacy AS ENUM
+(
+    'Public',
+    'Unlisted',
+    'Private'
+);
+
+-- Table: public.playlists
+
+-- DROP TABLE public.playlists;
+
+CREATE TABLE IF NOT EXISTS public.playlists
+(
+    title text,
+    id text primary key,
+    author text,
+    description text,
+    video_count integer,
+    created timestamptz,
+    updated timestamptz,
+    privacy privacy,
+    index int8[]
+);
+
+GRANT ALL ON public.playlists TO current_user;

modules/nixos/virtualisation/podman/invidious/config/sql/session_ids.sql

@@ -0,0 +1,23 @@
+-- Table: public.session_ids
+
+-- DROP TABLE public.session_ids;
+
+CREATE TABLE IF NOT EXISTS public.session_ids
+(
+  id text NOT NULL,
+  email text,
+  issued timestamp with time zone,
+  CONSTRAINT session_ids_pkey PRIMARY KEY (id)
+);
+
+GRANT ALL ON TABLE public.session_ids TO current_user;
+
+-- Index: public.session_ids_id_idx
+
+-- DROP INDEX public.session_ids_id_idx;
+
+CREATE INDEX IF NOT EXISTS session_ids_id_idx
+  ON public.session_ids
+  USING btree
+  (id COLLATE pg_catalog."default");
+

modules/nixos/virtualisation/podman/invidious/config/sql/users.sql

@@ -0,0 +1,29 @@
+-- Table: public.users
+
+-- DROP TABLE public.users;
+
+CREATE TABLE IF NOT EXISTS public.users
+(
+  updated timestamp with time zone,
+  notifications text[],
+  subscriptions text[],
+  email text NOT NULL,
+  preferences text,
+  password text,
+  token text,
+  watched text[],
+  feed_needs_update boolean,
+  CONSTRAINT users_email_key UNIQUE (email)
+);
+
+GRANT ALL ON TABLE public.users TO current_user;
+
+-- Index: public.email_unique_idx
+
+-- DROP INDEX public.email_unique_idx;
+
+CREATE UNIQUE INDEX IF NOT EXISTS email_unique_idx
+  ON public.users
+  USING btree
+  (lower(email) COLLATE pg_catalog."default");
+

modules/nixos/virtualisation/podman/invidious/config/sql/videos.sql

@@ -0,0 +1,23 @@
+-- Table: public.videos
+
+-- DROP TABLE public.videos;
+
+CREATE UNLOGGED TABLE IF NOT EXISTS public.videos
+(
+  id text NOT NULL,
+  info text,
+  updated timestamp with time zone,
+  CONSTRAINT videos_pkey PRIMARY KEY (id)
+);
+
+GRANT ALL ON TABLE public.videos TO current_user;
+
+-- Index: public.id_idx
+
+-- DROP INDEX public.id_idx;
+
+CREATE UNIQUE INDEX IF NOT EXISTS id_idx
+  ON public.videos
+  USING btree
+  (id COLLATE pg_catalog."default");
+

modules/nixos/virtualisation/podman/invidious/default.nix

@@ -0,0 +1,83 @@
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
+with lib;
+with lib.${namespace};
+let
+  cfg = config.${namespace}.container.invidious;
+in
+{
+  options.${namespace}.container.invidious = {
+    enable = mkEnableOption "Invidious";
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [
+      3000
+    ];
+
+    sops.secrets.invidious-db = {
+      format = "dotenv";
+      sopsFile = ../../../../../secrets/invidious-db.env;
+      key = "";
+    };
+
+    sops.secrets.invidious-config = {
+      mode = "666";
+      format = "yaml";
+      sopsFile = ../../../../../secrets/invidious-config.yaml;
+      key = "";
+    };
+
+    security.unprivilegedUsernsClone = true;
+
+    virtualisation = {
+      podman = {
+        enable = true;
+        autoPrune = {
+          enable = true;
+          dates = "weekly";
+          flags = [ "--all" ];
+        };
+        defaultNetwork.settings = {
+          dns_enabled = true;
+        };
+      };
+    };
+
+    virtualisation.oci-containers.containers = {
+      invidious = {
+        image = "quay.io/invidious/invidious:latest";
+        hostname = "invidious";
+        volumes = [ "/run/secrets/invidious-config:/invidious/config/config.yml" ];
+        ports = [
+          "192.168.10.3:3000:3000"
+          "[fd00:192:168:10::3]:3000:3000"
+        ];
+        dependsOn = [ "invidious-db" ];
+      };
+      signature-helper = {
+        image = "quay.io/invidious/inv-sig-helper:latest";
+        hostname = "signature-helper";
+        cmd = [
+          "--tcp"
+          "0.0.0.0:12999"
+        ];
+      };
+      invidious-db = {
+        image = "docker.io/library/postgres:14";
+        hostname = "invidious-db";
+        volumes = [
+          "postgresdata:/var/lib/postgresql/data"
+          "${config.flakeRoot}/modules/nixos/virtualisation/podman/invidious/config/sql:/config/sql"
+          "${config.flakeRoot}/modules/nixos/virtualisation/podman/invidious/init-invidious-db.sh:/docker-entrypoint-initdb.d/init-invidious-db.sh"
+        ];
+        environmentFiles = [ /run/secrets/invidious-db ];
+      };
+    };
+  };
+
+}

modules/nixos/virtualisation/podman/invidious/init-invidious-db.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -eou pipefail
+
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/channels.sql
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/videos.sql
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/channel_videos.sql
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/users.sql
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/session_ids.sql
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/nonces.sql
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/annotations.sql
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/playlists.sql
+psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" < config/sql/playlist_videos.sql

modules/nixos/virtualisation/podman/technitium/default.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  config,
+  namespace,
+  ...
+}:
+with lib;
+with lib.${namespace};
+let
+  cfg = config.${namespace}.container.technitium;
+in
+{
+  options.${namespace}.container.technitium = {
+    enable = mkEnableOption "Technitium";
+  };
+
+  config = mkIf cfg.enable {
+    virtualisation.oci-containers.containers.technitium = {
+      image = "technitium/dns-server";
+      hostname = "blarm-dns";
+      ports = [
+        "192.168.1.202:5380:5380"
+        "192.168.1.202:53:53"
+        "192.168.1.202:53:53/udp"
+        "[fd00:192:168:1::202]:53:53"
+        "[fd00:192:168:1::202]:53:53/udp"
+        "[fd00:192:168:1::202]:5380:5380"
+      ];
+      volumes = [ "config:/etc/dns" ];
+    };
+  };
+}

overlays/cinny/default.nix

@@ -8,16 +8,16 @@ final: prev: {
   awesome-flake = (prev.awesome-flake or { }) // {
     cinny = prev.cinny-unwrapped.overrideAttrs (_old: rec {
       pname = "cinny-unwrapped";
-      version = "325144d8b2ca53c32fc6e1eace0603968a5ddc40";
+      version = "2025-06-11-15-30";
 
       src = final.fetchFromGitHub {
         owner = "GigiaJ";
         repo = "cinny";
-        rev = version;
+        rev = "1b281fe37b29e4b4a36d8bc3007a9abf2240ffff";
-        hash = "sha256-822P12rzSLzje7KuBF2RB70SPdfCaHZaPV/1Nr4CCnY=";
+        hash = "sha256-3DKFOuFR7qYSvWsE/kAnaES/T9CFGNpmmOutE4o6vb4=";
       };
 
-      npmDepsHash = "sha256-pP7JH/K9QSqyUVg0UFTDzZvRoL5CeP5pudv83eHVoTo=";
+      npmDepsHash = "sha256-Z7GP3aorCnII7KfWajR8L+otiBxYC+uaMSYWcgmnZjw=";
       npmDeps = final.fetchNpmDeps {
         inherit src;
         name = "${pname}-${version}-npm-deps";

overlays/prisma/default.nix

@@ -1,13 +0,0 @@
-{
-  channels,
-  inputs,
-  ...
-}:
-
-final: prev: {
-  prisma = prev.prisma.overrideAttrs (_old: rec {
-    pname = "prisma";
-
-    meta.mainProgram = "prisma";
-  });
-}

systems/x86_64-linux/blarm/default.nix

@@ -59,8 +59,7 @@ with lib.${namespace};
       linkwarden = enabled;
       forgejo = enabled;
       searxng = enabled;
-      #immich = enabled; # We wait for the proper version to be in nixpkgs
+      immich = enabled;
-      paperless = enabled;
     };
 
     #container.invidious = enabled;

systems/x86_64-linux/bodenheizung/default.nix

@@ -72,7 +72,6 @@ with lib.${namespace};
 
     system = {
       tmpfs = enabled;
-      fwupd = enabled;
       fonts = {
         enable = true;
         emoji = true;