upgrade memory to resolve oom

flesh out attic

TODO keys nginx-port testing

fix key

fix key

.forgejo/workflows/update.yaml

@@ -2,22 +2,20 @@ name: update-dependencies
 
 on:
   workflow_dispatch: # allows manual triggering
-  # FIXME: re-enable when manual run works
-  # schedule:
-  #   - cron: '0 0 1 * *' # monthly
+  schedule:
+    - cron: '0 0 1 * *' # monthly
 
 jobs:
   lockfile:
-    runs-on: native
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
-      - name: Update pins
-        run: nix-shell --run "npins update"
-      - name: Create PR
-        uses: peter-evans/create-pull-request@v7
+      - name: Install Nix
+        uses: cachix/install-nix-action@v31
+      - name: Install npins
+        run: nix profile install 'nixpkgs#npins'
+      - name: Update npins sources
+        uses: getchoo/update-npins@v0
         with:
           token: "${{ secrets.DEPLOY_KEY }}"
-          branch: npins-update
-          commit-message: "npins: update sources"
-          title: "npins: update sources"

default.nix

@@ -10,8 +10,6 @@ let
     gitignore
     ;
   inherit (pkgs) lib;
-  inherit (import sources.flake-inputs) import-flake;
-  inherit ((import-flake { src = ./.; }).inputs) nixops4;
   pre-commit-check =
     (import "${git-hooks}/nix" {
       inherit nixpkgs system;
@@ -57,15 +55,8 @@ in
         };
       in
       [
-        pkgs.npins
-        pkgs.nil
-        (pkgs.callPackage "${sources.agenix}/pkgs/agenix.nix" { })
-        pkgs.openssh
-        pkgs.httpie
-        pkgs.jq
         pkgs.nix-unit
         test-loop
-        nixops4.packages.${system}.default
       ];
   };
 

deployment/check/basic/flake-part.nix

@@ -17,8 +17,6 @@ let
 
 in
 {
-  _class = "flake";
-
   perSystem =
     { pkgs, ... }:
     {

deployment/check/basic/nixosTest.nix

@@ -1,8 +1,6 @@
 { inputs, ... }:
 
 {
-  _class = "nixosTest";
-
   name = "deployment-basic";
 
   nodes.deployer =

deployment/check/cli/flake-part.nix

@@ -21,8 +21,6 @@ let
 
 in
 {
-  _class = "flake";
-
   perSystem =
     { pkgs, ... }:
     {

deployment/check/cli/nixosTest.nix

@@ -7,8 +7,6 @@ let
 in
 
 {
-  _class = "nixosTest";
-
   name = "deployment-cli";
 
   nodes.deployer =

deployment/check/common/deployerNode.nix

@@ -18,8 +18,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   imports = [ ./sharedOptions.nix ];
 
   options.system.extraDependenciesFromModule = mkOption {

deployment/check/common/nixosTest.nix

@@ -42,8 +42,6 @@ let
 
 in
 {
-  _class = "nixosTest";
-
   imports = [
     ./sharedOptions.nix
   ];

deployment/check/common/sharedOptions.nix

@@ -11,7 +11,6 @@ let
   inherit (lib) mkOption types;
 
 in
-# `config` not set and imported from multiple places: no fixed module class
 {
   options = {
     targetMachines = mkOption {

deployment/check/common/targetNode.nix

@@ -12,8 +12,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   imports = [
     (modulesPath + "/profiles/qemu-guest.nix")
     (modulesPath + "/../lib/testing/nixos-test-base.nix")

deployment/check/common/targetResource.nix

@@ -12,8 +12,6 @@ let
 in
 
 {
-  _class = "nixops4Resource";
-
   imports = [ ./sharedOptions.nix ];
 
   options = {

deployment/check/panel/flake-part.nix

@@ -24,8 +24,6 @@ let
 
 in
 {
-  _class = "flake";
-
   perSystem =
     { pkgs, ... }:
     {

deployment/check/panel/nixosTest.nix

@@ -123,8 +123,6 @@ let
 in
 
 {
-  _class = "nixosTest";
-
   name = "deployment-panel";
 
   ## The panel's module sets `nixpkgs.overlays` which clashes with
@@ -157,6 +155,7 @@ in
           SECRET_KEY = dummyFile;
         };
         port = panelPort;
+        nixops4Package = inputs.nixops4.packages.${pkgs.system}.default;
 
         deployment = {
           flake = "/run/fedipanel/flake";

deployment/data-model-test.nix

@@ -11,8 +11,6 @@ let
     }).config;
 in
 {
-  _class = "nix-unit";
-
   test-eval = {
     expr =
       let

deployment/data-model.nix

@@ -7,8 +7,6 @@ let
 in
 with types;
 {
-  _class = "nixops4Deployment";
-
   options = {
     runtime-environments = mkOption {
       description = "Collection of runtime environments into which applications can be deployed";

deployment/default.nix

@@ -67,8 +67,6 @@ let
   cfg = config.deployment;
 in
 {
-  _class = "nixops4Deployment";
-
   options = {
     deployment = lib.mkOption {
       description = ''

deployment/flake-part.nix

@@ -1,6 +1,4 @@
 {
-  _class = "flake";
-
   imports = [
     ./check/basic/flake-part.nix
     ./check/cli/flake-part.nix

deployment/options.nix

@@ -17,8 +17,6 @@ let
   inherit (lib) types mkOption;
 in
 {
-  _class = "nixops4Deployment";
-
   options = {
     enable = lib.mkEnableOption "Fediversity configuration";
     domain = mkOption {

flake.nix

@@ -11,7 +11,7 @@
     let
       sources = import ./npins;
       inherit (import sources.flake-inputs) import-flake;
-      inherit (sources) git-hooks;
+      inherit (sources) git-hooks agenix;
       # XXX(@fricklerhandwerk): this atrocity is required to splice in a foreign Nixpkgs via flake-parts
       # XXX - this is just importing a flake
       nixpkgs = import-flake { src = sources.nixpkgs; };
@@ -43,7 +43,7 @@
           ];
 
           imports = [
-            "${git-hooks}/flake-module.nix"
+            (import "${git-hooks}/flake-module.nix")
             inputs.nixops4.modules.flake.default
 
             ./deployment/flake-part.nix
@@ -54,6 +54,7 @@
             {
               pkgs,
               lib,
+              inputs',
               ...
             }:
             {
@@ -72,6 +73,21 @@
                   trim-trailing-whitespace.enable = true;
                   shellcheck.enable = true;
                 };
+
+              devShells.default = pkgs.mkShell {
+                packages = [
+                  pkgs.npins
+                  pkgs.nil
+                  (pkgs.callPackage "${agenix}/pkgs/agenix.nix" { })
+                  pkgs.openssh
+                  pkgs.httpie
+                  pkgs.jq
+                  # exposing this env var as a hack to pass info in from form
+                  (inputs'.nixops4.packages.default.overrideAttrs {
+                    impureEnvVars = [ "DEPLOYMENT" ];
+                  })
+                ];
+              };
             };
         }
       );

infra/common/nixos/default.nix

@@ -5,8 +5,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   imports = [
     ./hardware.nix
     ./networking.nix

infra/common/nixos/hardware.nix

@@ -1,8 +1,6 @@
 { modulesPath, ... }:
 
 {
-  _class = "nixos";
-
   imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
 
   boot = {

infra/common/nixos/networking.nix

@@ -1,64 +1,63 @@
 { config, lib, ... }:
 
 let
-  inherit (lib) mkDefault mkIf mkMerge;
+  inherit (lib) mkDefault;
 
 in
 {
-  _class = "nixos";
-
   config = {
     services.openssh = {
       enable = true;
       settings.PasswordAuthentication = false;
     };
 
-    networking = mkMerge [
-      {
-        hostName = config.fediversityVm.name;
-        domain = config.fediversityVm.domain;
+    networking = {
+      hostName = config.fediversityVm.name;
+      domain = config.fediversityVm.domain;
 
-        ## REVIEW: Do we actually need that, considering that we have static IPs?
-        useDHCP = mkDefault true;
+      ## REVIEW: Do we actually need that, considering that we have static IPs?
+      useDHCP = mkDefault true;
 
-        ## Disable the default firewall and use nftables instead, with a custom
-        ## Procolix-made ruleset.
-        firewall.enable = false;
-        nftables = {
-          enable = true;
-          rulesetFile = ./nftables-ruleset.nft;
+      interfaces = {
+        eth0 = {
+          ipv4 = {
+            addresses = [
+              {
+                inherit (config.fediversityVm.ipv4) address prefixLength;
+              }
+            ];
+          };
+          ipv6 = {
+            addresses = [
+              {
+                inherit (config.fediversityVm.ipv6) address prefixLength;
+              }
+            ];
+          };
         };
-      }
+      };
 
-      ## IPv4
-      (mkIf config.fediversityVm.ipv4.enable {
-        interfaces.${config.fediversityVm.ipv4.interface}.ipv4.addresses = [
-          { inherit (config.fediversityVm.ipv4) address prefixLength; }
-        ];
-        defaultGateway = {
-          address = config.fediversityVm.ipv4.gateway;
-          interface = config.fediversityVm.ipv4.interface;
-        };
-        nameservers = [
-          "95.215.185.6"
-          "95.215.185.7"
-        ];
-      })
+      defaultGateway = {
+        address = config.fediversityVm.ipv4.gateway;
+        interface = "eth0";
+      };
+      defaultGateway6 = {
+        address = config.fediversityVm.ipv6.gateway;
+        interface = "eth0";
+      };
 
-      ## IPv6
-      (mkIf config.fediversityVm.ipv6.enable {
-        interfaces.${config.fediversityVm.ipv6.interface}.ipv6.addresses = [
-          { inherit (config.fediversityVm.ipv6) address prefixLength; }
-        ];
-        defaultGateway6 = {
-          address = config.fediversityVm.ipv6.gateway;
-          interface = config.fediversityVm.ipv6.interface;
-        };
-        nameservers = [
-          "2a00:51c0::5fd7:b906"
-          "2a00:51c0::5fd7:b907"
-        ];
-      })
-    ];
+      nameservers = [
+        "95.215.185.6"
+        "95.215.185.7"
+        "2a00:51c0::5fd7:b906"
+        "2a00:51c0::5fd7:b907"
+      ];
+
+      firewall.enable = false;
+      nftables = {
+        enable = true;
+        rulesetFile = ./nftables-ruleset.nft;
+      };
+    };
   };
 }

infra/common/nixos/users.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixos";
-
   users.users = {
     procolix = {
       isNormalUser = true;

infra/common/options.nix

@@ -6,8 +6,6 @@ let
 
 in
 {
-  # `config` not set and imported from multiple places: no fixed module class
-
   options.fediversityVm = {
 
     ##########################################################################
@@ -91,17 +89,6 @@ in
     };
 
     ipv4 = {
-      enable = mkOption {
-        default = true;
-      };
-
-      interface = mkOption {
-        description = ''
-          The interface that carries the machine's IPv4 network.
-        '';
-        default = "eth0";
-      };
-
       address = mkOption {
         description = ''
           The IP address of the machine, version 4. It will be injected as a
@@ -127,17 +114,6 @@ in
     };
 
     ipv6 = {
-      enable = mkOption {
-        default = true;
-      };
-
-      interface = mkOption {
-        description = ''
-          The interface that carries the machine's IPv6 network.
-        '';
-        default = "eth0";
-      };
-
       address = mkOption {
         description = ''
           The IP address of the machine, version 6. It will be injected as a

infra/common/resource.nix

@@ -18,8 +18,6 @@ let
 
 in
 {
-  _class = "nixops4Resource";
-
   imports = [ ./options.nix ];
 
   fediversityVm.hostPublicKey = mkDefault keys.systems.${config.fediversityVm.name};

infra/flake-part.nix

@@ -159,8 +159,6 @@ let
 
 in
 {
-  _class = "flake";
-
   ## - Each normal or test machine gets a NixOS configuration.
   ## - Each normal or test machine gets a VM options entry.
   ## - Each normal machine gets a deployment.

machines/dev/fedi200/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 200;
     proxmox = "fediversity";

machines/dev/fedi201/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 201;
     proxmox = "fediversity";

machines/dev/fedi201/fedipanel.nix

@@ -6,8 +6,6 @@ let
   name = "panel";
 in
 {
-  _class = "nixos";
-
   imports = [
     (import ../../../panel { }).module
   ];

machines/dev/vm02116/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 2116;
     proxmox = "procolix";

machines/dev/vm02116/forgejo.nix

@@ -5,8 +5,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   services.forgejo = {
     enable = true;
 

machines/dev/vm02187/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 2187;
     proxmox = "procolix";

machines/dev/vm02187/wiki.nix

@@ -1,8 +1,6 @@
 { config, ... }:
 
 {
-  _class = "nixos";
-
   services.phpfpm.pools.mediawiki.phpOptions = ''
     upload_max_filesize = 1024M;
     post_max_size = 1024M;

machines/operator/test01/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7001;
     proxmox = "fediversity";

machines/operator/test02/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7002;
     proxmox = "fediversity";

machines/operator/test03/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7003;
     proxmox = "fediversity";

machines/operator/test04/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7004;
     proxmox = "fediversity";

machines/operator/test05/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7005;
     proxmox = "fediversity";

machines/operator/test06/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7006;
     proxmox = "fediversity";

machines/operator/test11/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7011;
     proxmox = "fediversity";

machines/operator/test12/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7012;
     proxmox = "fediversity";

machines/operator/test13/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7013;
     proxmox = "fediversity";

machines/operator/test14/default.nix

@@ -1,6 +1,4 @@
 {
-  _class = "nixops4Resource";
-
   fediversityVm = {
     vmId = 7014;
     proxmox = "fediversity";

panel/default.nix

@@ -22,12 +22,12 @@ in
       manage
 
       # NixOps4 and its dependencies
-      pkgs.nixops4
+      # FIXME: grab NixOps4 and add it here
       pkgs.nix
       pkgs.openssh
     ];
     env = {
-      DEPLOYMENT_FLAKE = toString ../.;
+      DEPLOYMENT_FLAKE = ../.;
       DEPLOYMENT_NAME = "test";
       NPINS_DIRECTORY = toString ../npins;
       CREDENTIALS_DIRECTORY = toString ./.credentials;

panel/nix/configuration.nix

@@ -76,8 +76,6 @@ in
 #       https://git.dgnum.eu/mdebray/djangonix/
 #       unlicensed at the time of writing, but surely worth taking some inspiration from...
 {
-  _class = "nixos";
-
   options.services.${name} = {
     enable = mkEnableOption "Service configuration for `${name}`";
     production = mkOption {
@@ -147,7 +145,6 @@ in
         NixOps4 from the package's npins-based code, we will have to do with
         this workaround.
       '';
-      default = pkgs.nixops4;
     };
 
     deployment = {

panel/nix/overlay.nix

@@ -8,17 +8,4 @@ let
 in
 {
   python3 = prev.lib.attrsets.recursiveUpdate prev.python3 { pkgs = extraPython3Packages; };
-  nixops4 =
-    let
-      sources = import ../../npins;
-      inherit (import sources.flake-inputs) import-flake;
-      inherit
-        (import-flake {
-          src = ../../.;
-        })
-        inputs
-        ;
-      inherit (inputs) nixops4;
-    in
-    nixops4.packages.${prev.system}.default;
 }

panel/nix/package.nix

@@ -60,8 +60,6 @@ let
     ];
 in
 python3.pkgs.buildPythonPackage {
-  _class = "package";
-
   pname = name;
   inherit (pyproject.project) version;
   pyproject = true;

panel/nix/python-packages/django-pydantic-field/default.nix

@@ -8,8 +8,6 @@
 }:
 
 buildPythonPackage rec {
-  _class = "package";
-
   pname = "django-pydantic-field";
   version = "v0.3.12";
   pyproject = true;

panel/nix/python-packages/drf-pydantic/default.nix

@@ -10,8 +10,6 @@
 }:
 
 buildPythonPackage rec {
-  _class = "package";
-
   pname = "drf-pydantic";
   version = "v2.7.1";
   pyproject = true;

panel/nix/tests.nix

@@ -13,6 +13,7 @@ let
       secrets = {
         SECRET_KEY = pkgs.writeText "SECRET_KEY" "secret";
       };
+      nixops4Package = pkgs.hello; # FIXME: actually pass NixOps4
     };
 
     virtualisation = {

services/default.nix

@@ -6,8 +6,8 @@
 }:
 {
   tests = {
-    mastodon = pkgs.nixosTest ./tests/mastodon.nix;
-    pixelfed-garage = pkgs.nixosTest ./tests/pixelfed-garage.nix;
-    peertube = pkgs.nixosTest ./tests/peertube.nix;
+    mastodon = import ./tests/mastodon.nix { inherit pkgs; };
+    pixelfed-garage = import ./tests/pixelfed-garage.nix { inherit pkgs; };
+    peertube = import ./tests/peertube.nix { inherit pkgs; };
   };
 }

services/fediversity/default.nix

@@ -6,8 +6,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   imports = [
     ./garage
     ./mastodon

services/fediversity/garage/default.nix

@@ -97,8 +97,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   imports = [ ./options.nix ];
 
   config = mkIf config.fediversity.garage.enable {

services/fediversity/garage/options.nix

@@ -5,8 +5,6 @@ let
 in
 
 {
-  _class = "nixos";
-
   options.fediversity.garage = {
     enable = mkEnableOption "Enable a Garage server on the machine";
 

services/fediversity/mastodon/default.nix

@@ -11,8 +11,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   imports = [ ./options.nix ];
 
   config = mkMerge [

services/fediversity/mastodon/options.nix

@@ -1,8 +1,6 @@
 { config, lib, ... }:
 
 {
-  _class = "nixos";
-
   options.fediversity.mastodon =
     (import ../sharedOptions.nix {
       inherit config lib;

services/fediversity/peertube/default.nix

@@ -5,8 +5,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   imports = [ ./options.nix ];
 
   config = mkMerge [

services/fediversity/peertube/options.nix

@@ -6,8 +6,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   options.fediversity.peertube =
     (import ../sharedOptions.nix {
       inherit config lib;

services/fediversity/pixelfed/default.nix

@@ -15,8 +15,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   imports = [ ./options.nix ];
 
   config = mkMerge [

services/fediversity/pixelfed/options.nix

@@ -1,8 +1,6 @@
 { config, lib, ... }:
 
 {
-  _class = "nixos";
-
   options.fediversity.pixelfed =
     (import ../sharedOptions.nix {
       inherit config lib;

services/fediversity/sharedOptions.nix

@@ -14,8 +14,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   enable = mkEnableOption "Enable a ${serviceDocName} server on the machine";
 
   s3AccessKeyFile = mkOption {

services/tests/mastodon.nix

@@ -42,7 +42,7 @@ let
       '';
 in
 
-{
+pkgs.nixosTest {
   name = "mastodon";
 
   nodes = {

services/tests/peertube.nix

@@ -161,7 +161,7 @@ let
   '';
 in
 
-{
+pkgs.nixosTest {
   name = "peertube";
 
   nodes = {

services/tests/pixelfed-garage.nix

@@ -114,7 +114,7 @@ let
         ${seleniumQuit}'';
 
 in
-{
+pkgs.nixosTest {
   name = "test-pixelfed-garage";
 
   nodes = {

services/tests/rebuildableTest.nix

@@ -127,8 +127,6 @@ let
       preOverride = pkgs.nixosTest (
         test
         // {
-          _class = "nixosTest";
-
           interactive = (test.interactive or { }) // {
             # no need to // with test.interactive.nodes here, since we are iterating
             # over all of them, and adding back in the config via `imports`

services/vm/garage-vm.nix

@@ -10,8 +10,6 @@ let
 
 in
 {
-  _class = "nixos";
-
   imports = [ (modulesPath + "/virtualisation/qemu-vm.nix") ];
 
   fediversity.garage.enable = true;

services/vm/interactive-vm.nix

@@ -1,8 +1,6 @@
 # customize nixos-rebuild build-vm to be a bit more convenient
 { pkgs, ... }:
 {
-  _class = "nixos";
-
   # let us log in
   users.mutableUsers = false;
   users.users.root.hashedPassword = "";

services/vm/mastodon-vm.nix

@@ -6,7 +6,6 @@
   ...
 }:
 {
-  _class = "nixos";
 
   imports = [ (modulesPath + "/virtualisation/qemu-vm.nix") ];
 

services/vm/peertube-vm.nix

@@ -5,8 +5,6 @@
 }:
 
 {
-  _class = "nixos";
-
   imports = [ (modulesPath + "/virtualisation/qemu-vm.nix") ];
 
   fediversity = {

services/vm/pixelfed-vm.nix

@@ -11,8 +11,6 @@ let
 in
 
 {
-  _class = "nixos";
-
   imports = [ (modulesPath + "/virtualisation/qemu-vm.nix") ];
 
   fediversity = {