helix: host photos.sealight.xyz

flake.lock

···
         ]
       },
       "locked": {
-        "lastModified": 1720042825,
-        "narHash": "sha256-A0vrUB6x82/jvf17qPCpxaM+ulJnD8YZwH9Ci0BsAzE=",
+        "lastModified": 1736373539,
+        "narHash": "sha256-dinzAqCjenWDxuy+MqUQq0I4zUSfaCvN9rzuCmgMZJY=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e1391fb22e18a36f57e6999c7a9f966dc80ac073",
+        "rev": "bd65bc3cde04c16755955630b344bc9e35272c56",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-24.05",
+        "ref": "release-24.11",
         "repo": "home-manager",
         "type": "github"
       }
···
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1723938990,
-        "narHash": "sha256-9tUadhnZQbWIiYVXH8ncfGXGvkNq3Hag4RCBEMUk7MI=",
+        "lastModified": 1738277201,
+        "narHash": "sha256-6L+WXKCw5mqnUIExvqkD99pJQ41xgyCk6z/H9snClwk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c42fcfbdfeae23e68fc520f9182dde9f38ad1890",
+        "rev": "666e1b3f09c267afd66addebe80fb05a5ef2b554",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-24.05",
+        "ref": "nixos-24.11",
         "repo": "nixpkgs",
         "type": "github"
       }
···
     },
     "unstable": {
       "locked": {
-        "lastModified": 1723637854,
-        "narHash": "sha256-med8+5DSWa2UnOqtdICndjDAEjxr5D7zaIiK4pn0Q7c=",
+        "lastModified": 1738410390,
+        "narHash": "sha256-xvTo0Aw0+veek7hvEVLzErmJyQkEcRk6PSR4zsRQFEc=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "c3aa7b8938b17aebd2deecf7be0636000d62a2b9",
+        "rev": "3a228057f5b619feb3186e986dbe76278d707b6e",
         "type": "github"
       },
       "original": {

flake.nix

···
 
   inputs = {
     # Nixpkgs
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
     unstable.url = "github:nixos/nixpkgs/nixos-unstable";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
 
···
     # ngipkgs-local.url = "path:/home/anish/usr/ngipkgs";
 
     # Home manager
-    home-manager.url = "github:nix-community/home-manager/release-24.05";
+    home-manager.url = "github:nix-community/home-manager/release-24.11";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
     hardware.url = "github:nixos/nixos-hardware";
 
···
       nixpkgsFor = forAllSystems (system:
         import nixpkgs {
           inherit system;
-          config.allowUnfreePredicate = pkg:
-            builtins.elem (nixpkgs.lib.getName pkg) [
-              "ripcord"
-              "vcv-rack"
-              "SunVox"
-              "renoise"
+          config = {
+            permittedInsecurePackages = [
+              "olm-3.2.16" 
             ];
-          # config.permittedInsecurePackages = [
-          #   "python3.10-django-3.1.14" # Needed for archivebox deployments on curve
-          #   # Check when archive box updates it's dependeny
-          # ];
+            allowUnfreePredicate = pkg:
+              builtins.elem (nixpkgs.lib.getName pkg) [
+                "ripcord"
+                "vcv-rack"
+                "SunVox"
+                "renoise"
+              ];
+          };
           overlays = [
             rust-overlay.overlays.default
             tidalcycles.overlays.default
···
         };
       };
 
-      checks = builtins.mapAttrs
-        (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
+     # checks = builtins.mapAttrs
+     #   (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
     };
 }

home/core/default.nix

···
     ../profiles/cli
     ../profiles/direnv
     ../profiles/git
+    # ../profiles/tmux
   ];
   home.stateVersion = "22.05";
 }

home/profiles/cli/default.nix

···
     less
     gdb
     xxd
-    taskwarrior
+    taskwarrior2
     gnupg
     syncthing
     dijo
···
     fontconfig
     pandoc
     taskwarrior-tui
-    python3Packages.howdoi
     vimwiki-cli
 
     (pkgs.writeScriptBin "jq-repl" ''

home/profiles/desktop/default.nix

···
     paper-icon-theme
     papirus-icon-theme
     libsForQt5.qtstyleplugin-kvantum
-    qt5ct
+    libsForQt5.qt5ct
     gtk-engine-murrine
     gtk_engines
     maim

home/profiles/nvim/default.nix

···
       zls
       gopls
       gcc
-      nodePackages_latest.pyright
+      pyright
       shellcheck
       proselint
       statix

home/profiles/tmux/default.nix

···
+{
+  home.file.".tmux.confg".source = ./tmux.conf
+}

home/profiles/tmux/tmux.conf

···
+set -g base-index 1
+setw -g pane-base-index 1
+
+# https://old.reddit.com/r/tmux/comments/mesrci/tmux_2_doesnt_seem_to_use_256_colors/
+set -g default-terminal "xterm-256color"
+set -ga terminal-overrides ",*256col*:Tc"
+set -ga terminal-overrides '*:Ss=\E[%p1%d q:Se=\E[ q'
+set-environment -g COLORTERM "truecolor"
+
+# Mouse works as expected
+set-option -g mouse on
+# easy-to-remember split pane commands
+bind | split-window -h -c "#{pane_current_path}"
+bind - split-window -v -c "#{pane_current_path}"
+
+# don't rename windows automatically
+set-option -g allow-rename off
+
+# DESIGN TWEAKS
+
+# don't do anything when a 'bell' rings
+set -g visual-activity off
+set -g visual-bell off
+set -g visual-silence off
+setw -g monitor-activity off
+set -g bell-action none
+
+# clock mode
+setw -g clock-mode-colour yellow
+
+# copy mode
+setw -g mode-style 'fg=black bg=green bold'
+
+# panes
+set -g pane-border-style 'fg=green'
+set -g pane-active-border-style 'fg=yellow'
+
+# statusbar
+set -g status-position bottom
+set -g status-justify left
+set -g status-style 'fg=green'
+
+set -g status-left ''
+set -g status-left-length 10
+
+set -g status-right-style 'fg=black bg=yellow'
+set -g status-right '%Y-%m-%d %H:%M '
+set -g status-right-length 50
+
+setw -g window-status-current-style 'fg=black bg=green'
+setw -g window-status-current-format ' #I #W #F '
+
+setw -g window-status-style 'fg=green bg=black'
+setw -g window-status-format ' #I #[fg=white]#W #[fg=yellow]#F '
+
+setw -g window-status-bell-style 'fg=yellow bg=green bold'
+
+# messages
+set -g message-style 'fg=yellow bg=green bold'

hosts/box/configuration.nix

···
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
   networking.firewall.allowedTCPPorts = [ 22 ];
-  sound.enable = false;
 
   programs.gnupg.agent.enable = true;
   programs.gnupg.agent.pinentryPackage = pkgs.pinentry-curses;

hosts/box/default.nix

···
     # ../profiles/monitoring
     ../profiles/nfs
     ../profiles/gonic
-    # ../profiles/headphones # TODO broken on 23.11, see: https://github.com/rembo10/headphones/issues/3320
+    ../profiles/headphones 
     ../profiles/radicale
     # ../profiles/seafile # waiting for https://github.com/NixOS/nixpkgs/pull/249523 to be merged
     ../profiles/syncthing
···
     # ../profiles/woodpecker-agent
     # ../profiles/jellyfin
     ../profiles/ulogger-server
-    ../profiles/photoprism # Replace with immich
+    ../profiles/immich
+    ../profiles/jacket
     ../profiles/gpodder
+    ../profiles/transmission
     #../profiles/postgres_upgrade_script
   ];
 
···
   age.secrets.borg-password.file = "${self}/secrets/borg-password.age";
   services.postgresqlBackup = {
     enable = true;
-    databases = [ "wallabag" "photoprism" "ulogger" ];
+    databases = [ "wallabag" "immich" "ulogger" ];
     location = "/var/backup/postgresql";
   };
   mossnet.backup = {
···
     # seafile
   };
 
-  services.transmission = {
-    enable = true;
-    settings = {
-      rpc.bind-address = "0.0.0.0";
-      download-dir = "/mnt/two/new-music";
-    };
-  };
-  services.nginx.virtualHosts."transmission.mossnet.lan" = {
-    enableACME = false;
-    forceSSL = false;
-
-    locations."/" = {
-      extraConfig = ''
-        proxy_pass http://localhost:9091/;
-        proxy_set_header X-Forwarded-Host $host;
-      '';
-    };
-  };
 
   services.nginx.virtualHosts."mast.mossnet.lan" = {
     enableACME = false;

hosts/curve/configuration.nix

···
   #   keyMap = "us";
   # };
 
-  sound.enable = true;
-
   services.libinput.enable = true;
 }

hosts/helix/configuration.nix

···
 
   # Enable the OpenSSH daemon.
   services.openssh.enable = true;
-  sound.enable = false;
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
   # This value determines the NixOS release with which your system is to be

hosts/helix/default.nix

···
     privateKeyFile = "/run/agenix/helix-wg";
   };
 
+  # Reverse proxy for immich
+  services.nginx.virtualHosts."photos.sealight.xyz" = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://10.0.69.4:8567;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+      '';
+    };
+  };
+
   services.postgresql.package = pkgs.postgresql_15;
   services.postgresqlBackup = {
     # TODO needs working wireguard to box

hosts/lituus/configuration.nix

···
   # networking.proxy.default = "http://user:password@proxy:port/";
   # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
 
-  sound.enable = false;
-
   # Define a user account. Don't forget to set a password with ‘passwd’.
   # This value determines the NixOS release with which your system is to be
   # compatible, in order to avoid breaking some software such as database

hosts/profiles/desktop/default.nix

···
     #unstable.sublime-music
     # olm-3.2.16 is now insecure
     # some reason I can't set insecure packages that will be respected
-    nheko
+    # nheko
     unstable.signal-desktop
     unstable.tuba
     unstable.newsflash

hosts/profiles/headphones/default.nix

···
     enable = true;
     host = "0.0.0.0";
     port = 8181;
-    package = "${pkgs.unstable.headphones}";
     user = "headphones";
     group = "audio";
     dataDir = "/data/music";

hosts/profiles/immich/default.nix

···
+{ ... }:
+{
+  services.immich = {
+    enable = true;
+    database = {
+      enable = true;
+    };
+    host = "0.0.0.0";
+    port = 8567;
+    mediaLocation = "/data/photos";
+    externalDomain = "https://photos.sealight.xyz";
+  };
+  services.nginx.virtualHosts."photos.mossnet.lan" = {
+    enableACME = false;
+    forceSSL = false;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://127.0.0.1:8567/;
+      '';
+    };
+  };
+}

hosts/profiles/jacket/default.nix

···
+{ config, lib, pkgs, ... }:
+{
+  services.jackett = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 8011;
+    user = "jackett";
+    group = "transmission";
+  };
+  services.nginx.virtualHosts."jackett.mossnet.lan" = {
+    enableACME = false;
+    forceSSL = false;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://127.0.0.1:8011/;
+      '';
+    };
+  };
+  services.lidarr = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 8012;
+    user = "lidarr";
+    group = "transmission";
+  };
+  services.nginx.virtualHosts."lidarr.mossnet.lan" = {
+    enableACME = false;
+    forceSSL = false;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://127.0.0.1:8012/;
+      '';
+    };
+  };
+}

hosts/profiles/matrix/mautrix-services.nix

···
     homeserverURL = "https://sealight.xyz/";
     homeserverDomain = "sealight.xyz";
     services = {
-      whatsapp = {
-        port = 29183;
-        format = "mautrix-go";
-        package = pkgs.mautrix-whatsapp;
-      };
+      # whatsapp = {
+      #   port = 29183;
+      #   format = "mautrix-go";
+      #   package = pkgs.mautrix-whatsapp;
+      # };
 
-      discord = {
-        port = 29188;
-        format = "mautrix-go";
-        package = pkgs.my-mautrix-discord;
-      };
+      # discord = {
+      #   port = 29188;
+      #   format = "mautrix-go";
+      #   package = pkgs.unstable.mautrix-discord;
+      # };
 
-      signal = {
-        port = 29184;
-        format = "mautrix-python";
-        package = pkgs.unstable.mautrix-signal;
-        serviceConfig = {
-          StateDirectory = [ "matrix-as-signal" "signald" ];
-          SupplementaryGroups = [ "signald" ];
-          TimeoutStopSec = 1; # work around the service ignoring SIGTERM, see https://gitlab.com/coffeetables/nix-matrix-appservices/-/issues/12
-          User = lib.mkForce config.services.signald.user;
-          Group = lib.mkForce config.services.signald.group;
-        };
-        settings.signal = {
-          socket_path = config.services.signald.socketPath;
-          outgoing_attachment_dir = "/var/lib/signald/tmp";
-        };
-      };
+      # signal = {
+      #   port = 29184;
+      #   format = "mautrix-python";
+      #   package = pkgs.unstable.mautrix-signal;
+      #   serviceConfig = {
+      #     StateDirectory = [ "matrix-as-signal" "signald" ];
+      #     SupplementaryGroups = [ "signald" ];
+      #     TimeoutStopSec = 1; # work around the service ignoring SIGTERM, see https://gitlab.com/coffeetables/nix-matrix-appservices/-/issues/12
+      #     User = lib.mkForce config.services.signald.user;
+      #     Group = lib.mkForce config.services.signald.group;
+      #   };
+      #   settings.signal = {
+      #     socket_path = config.services.signald.socketPath;
+      #     outgoing_attachment_dir = "/var/lib/signald/tmp";
+      #   };
+      # };
     };
   };
 }

hosts/profiles/music/default.nix

···
     # Plugins
     helm
     # surge
-    distrho
+    # distrho
     orca-c
     supercollider
     dirt

hosts/profiles/transmission/beet-import.sh

···
+#!/usr/bin/env bash
+
+beet import -ql "$TR_TORRENT_DIR"

hosts/profiles/transmission/default.nix

···
+{ pkgs, ... }:
+{
+  services.transmission = {
+    enable = true;
+    settings = {
+      rpc-enabled = true;
+      rpc-bind-address = "0.0.0.0";
+      rpc-whitelist-enabled = false;
+      script-torrent-done-enabled = true;
+      # Normally, I would write this into the homedir with home-manager
+      # And explictly set the dir to be the output of the home-manager location
+      # But this seems better, if it'll work?
+      script-torrent-done-filename = pkgs.writeShellScript "beet-import.sh" ''
+#!/usr/bin/env bash
+
+beet import -ql "$TR_TORRENT_DIR"
+      '';
+      rpc-url = "/transmission/rpc/";
+      download-dir = "/mnt/two/new-music";
+    };
+  };
+  services.nginx.virtualHosts."transmission.mossnet.lan" = {
+    enableACME = false;
+    forceSSL = false;
+
+    locations."/" = {
+      extraConfig = ''
+        proxy_pass http://localhost:9091/;
+        proxy_set_header X-Forwarded-Host $host;
+      '';
+    };
+  };
+}

pkgs/default.nix

···
   tic-80 = pkgs.callPackage ./tic-80.nix { };
   fennel-ls = pkgs.callPackage ./fennel-ls.nix { };
   # kobopatch = pkgs.callPackage ./kobopatch.nix { };
-  my-mautrix-discord = pkgs.callPackage ./mautrix-discord.nix { }; # Handled by matrix-appservices input
+  # my-mautrix-discord = pkgs.callPackage ./mautrix-discord.nix { }; # Handled by matrix-appservices input
   ulogger-server = pkgs.callPackage ./ulogger.nix { };
   # Wallabag is now an overlay
   # TODO: we still use the patch from this folder though
   my-wallabag = pkgs.callPackage ./wallabag.nix { };
-  mautrix-slack = pkgs.callPackage ./mautrix-slack.nix { }; 
+  # mautrix-slack = pkgs.callPackage ./mautrix-slack.nix { }; 
   gpodder2go = pkgs.callPackage ./gpodder2go.nix { }; 
 }

pkgs/tic-80.nix

···
     mesa_glu
     mesa_glu
     freeglut
-  ] ++ lib.optional stdenv.isLinux alsaLib;
+  ] ++ lib.optional stdenv.isLinux alsa-lib;
 
   configurePhase = ''
     echo [DIRECTORY] $(pwd)