trajto(reciproka-web): konverti al floko

resolves #13

flake.nix

@@ -8,18 +8,16 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
     hakyll-skeleton = {
-      flake = false;
-      url = git+https://reciproka.dev/reciproka/hakyll-skeleton/?ref=consensus;
-    };
-    reciproka-web = {
-      flake = false;
-      url = git+https://reciproka.dev/reciproka/reciproka-web/?ref=consensus;
+      url = "git+https://reciproka.dev/reciproka/hakyll-skeleton/?ref=consensus";
+      inputs.nixpkgs.follows = "nixpkgs";
     };
+    reciproka-web.url = "git+https://reciproka.dev/reciproka/reciproka-web/?ref=consensus";
     resrok-web = {
       flake = false;
       url = git+https://reciproka.dev/resrok/resrok-web/?ref=consensus;
     };
-    nixpkgs.url = github:NixOS/nixpkgs/?ref=nixos-23.11;
+    nix.url = github:NixOS/nix/?ref=2.24.6;
+    nixpkgs.url = github:NixOS/nixpkgs/?ref=nixos-24.05;
     nixpkgsUnstable.url = github:NixOS/nixpkgs/?ref=nixos-unstable;
     utils.url = "github:numtide/flake-utils";
     voc-web = {

hardware/raspberry_pi_3_model_B.nix

@@ -24,6 +24,7 @@
     loader = {
       generic-extlinux-compatible = {
         enable = true; # Enables the generation of /boot/extlinux/extlinux.conf
+        configurationLimit = 5;
       };
       grub = {
         enable = false; # NixOS wants to enable GRUB by default.
@@ -31,7 +32,6 @@
       raspberryPi = {
         enable = false;
         version = 3;
-        uboot.enable = true;
         firmwareConfig = ''
           arm_64bit=1            # Force kernel loading system to assume a 64-bit kernel
           display_auto_detect=1  # Enable auto detection of screen resolution

nixos/hosts/flemming/default.nix

@@ -15,6 +15,7 @@
 }: {
   imports = [
     ../../../networks/pi3B_rack.nix
+    ../../../profiles/hakyll-skeleton.nix
   ];
 
   # Comment out deployment when building the SD Image.

nixos/hosts/hollows/default.nix

@@ -0,0 +1,25 @@
+# NixOS configuration for flemming
+#
+# Andy Flemming, AKA Slackbastard is the psuedonym of an Australian anarchist
+# who hosts Yeah Nah Pasaran on radio 3CR and documents fascism and its
+# grave diggers in Australia
+#
+# https://en.wikipedia.org/wiki/Andy_Fleming_(activist)
+# https://slackbastard.anarchobase.com/
+# https://www.3cr.org.au/yeahnahpasaran
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = [
+    ../../../networks/pi3B_rack.nix
+  ];
+
+  # Comment out deployment when building the SD Image.
+  deployment.targetHost = "10.42.0.203";
+  networking.hostName = "hollows"; # Define your hostname.
+
+  system.stateVersion = "22.05"; # The version of NixOS originally installed
+}

nixos/hosts/toscano/configuration.nix

@@ -13,7 +13,6 @@
 }: {
   imports = [
     ../../../networks/linode.nix
-    ../../../profiles/hakyll-skeleton.nix
     ../../../profiles/reciproka-web.nix
     ../../../profiles/reciproka-forgejo.nix
     ../../../profiles/resrok-web.nix

outputs.nix

@@ -4,6 +4,7 @@
   reciproka-web,
   ragenix,
   colmena,
+  nix,
   nixpkgs,
   nixpkgsUnstable,
   resrok-web,
@@ -17,6 +18,7 @@ in {
   devShell =
     pkgs.callPackage
     ./shell.nix {
+      inherit (nix.packages."${pkgs.system}") nix;
       inherit (ragenix.packages."${pkgs.system}") ragenix;
       inherit (colmena.packages."${pkgs.system}") colmena;
       inherit (nixpkgsUnstable.legacyPackages."${pkgs.system}") alejandra;
@@ -32,22 +34,29 @@ in {
         overlays = [];
       };
     };
+    defaults = {pkgs, ...}: {
+      imports = [
+        ragenix.nixosModules.default
+      ];
+    };
     flemming = {
       imports = [
         ./nixos/hosts/flemming
-        ragenix.nixosModules.default
+      ];
+    };
+    hollows = {
+      imports = [
+        ./nixos/hosts/hollows
       ];
     };
     pred = {
       imports = [
         ./nixos/hosts/pred
-        ragenix.nixosModules.default
       ];
     };
     toscano = {
       imports = [
         ./nixos/hosts/toscano/configuration.nix
-        ragenix.nixosModules.default
       ];
     };
   };

profiles/hakyll-skeleton.nix

@@ -6,8 +6,8 @@
   ...
 }: let
   flake = builtins.getFlake (toString ../.);
-  hakyll-skeleton = import flake.inputs.hakyll-skeleton {};
-  webdomain = "skeleton.reciproka.co";
+  hakyll-skeleton = flake.inputs.hakyll-skeleton.packages."${pkgs.system}".default;
+  webdomain = "skeleton.reciproka.dev";
 in {
   environment.sessionVariables = {
     LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";

profiles/reciproka-forgejo.nix

@@ -19,12 +19,12 @@ in {
     httpPort = 3002; # Provided unique port
     rootUrl = "https://reciproka.dev/"; # Root web URL
     settings = let
+      DEFAULT.APP_NAME = "Reciproka Kolektivo: Forgejo Service"; # Give the site a name
       server = {
         DOMAIN = "reciproka.dev"; # Domain name
         HTTP_PORT = 3002; # Provided unique port
         ROOT_URL = "https://reciproka.dev/"; # Root web URL
       };
-      service.DISABLE_REGISTRATION = true;
     in {
       mailer = {
         ENABLED = true;
@@ -34,6 +34,7 @@ in {
         DEFAULT_BRANCH = "consensus";
       };
       service = {
+        DISABLE_REGISTRATION = true;
         REGISTER_EMAIL_CONFIRM = true;
       };
       "markup.restructuredtext" = {
@@ -73,11 +74,7 @@ in {
     ensureUsers = [
       {
         name = "forgejo"; # Ensure the database user persists
-        ensurePermissions = {
-          # Ensure the database permissions persist
-          "DATABASE forgejo" = "ALL PRIVILEGES";
-          "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
-        };
+        ensureDBOwnership = true;
       }
     ];
     package = pkgs.postgresql_16;

profiles/reciproka-web.nix

@@ -6,8 +6,8 @@
   ...
 }: let
   flake = builtins.getFlake (toString ../.);
-  reciproka-web = import flake.inputs.reciproka-web {};
-  webdomain = "reciproka.co";
+  reciproka-web = flake.inputs.reciproka-web.packages."${pkgs.system}".default;
+  webdomain = "reciproka.net";
 in {
   environment.sessionVariables = {
     LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
@@ -29,6 +29,13 @@ in {
       "www.${webdomain}" = {
         # Respect our elders :-)
         locations."/".extraConfig = "return 301 $scheme://${webdomain}$request_uri;";
+        enableACME = true; # Use ACME certs
+        forceSSL = true; # Force SSL
+      };
+      "reciproka.co" = {
+        locations."/".extraConfig = "return 301 $scheme://${webdomain}$request_uri;";
+        enableACME = true; # Use ACME certs
+        forceSSL = true; # Force SSL
       };
     };
   };
@@ -36,10 +43,9 @@ in {
   security.acme = {
     acceptTerms = true;
     certs = {
-      "${webdomain}" = {
-        email = "admin@${webdomain}";
-        #group = "matrix-synapse";
-      };
+      "${webdomain}" = {email = "admin@${webdomain}";};
+      "www.${webdomain}" = {email = "admin@${webdomain}";};
+      "reciproka.co" = {email = "admin@${webdomain}";};
     };
   };
 

secrets/fiscalvelvetpoet.age

@@ -1,17 +1,21 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFAvWjlQZyB4MEY0
-aUltV21JME9tcFBhRzhJQ1VqUEtyaFZwT1Rsc0pnUkhTbnVxUm1rCjFXZUNtMVV5
-YzFwSzVwMlZmZEFLempSS3RyVXhxUXBPMDJFZ1ZCMnNyeVUKLT4gc3NoLWVkMjU1
-MTkgUWQwZXBRIEhoOXN0NkVuaDdhOEhrcjh2ZzNTRUNwclFNQ29CeTBsMmRtV3Jy
-SFc1Z28KcGRJL1VIZnZaYm4wWURuU1VwSDVyQUZWMjlQeDZqVCtLRlZWTW5PSytM
-dwotPiBzc2gtZWQyNTUxOSBmNVRoQWcgREIzQkNUcVY2bUNwckU5SjBYMVZFQkpF
-TG1FVVJmd1RPRFRpQjZ6bjV3SQpoNVA5TkJ5MWVoTzUydG85M2YxbWM3b0lPbDJl
-UnZ0U1BiejRQU2xIZlRrCi0+ICxuQXgnZC1ncmVhc2UgIXxMTFZpPXYKLzdCaWhl
-WXlXSFgrT0hYampkRkl0Z0dBQzhNR0pYR3hRNTdncDBJbGZKd2F1Y0wvM0g4bGJs
-NUwvUUpwL2Vycgp3ZjBGRXpRNVB5ZU50OWdacWx3blhSSnBBQQotLS0gejhLWElM
-ZVNxNG9jY2loek9PWStadm5XdVJ3c0N2Nk4wald6Y3BkcUV4ZwptbI7LcKE5OKmc
-GZKvX5TfnEwLVTzTzN0Ns4HIZwwnErRxwlXDbbX1LnAxgcO0ZRXd1xAxXTsz/s53
-IycJiQkPPCYynSV3OcYyQmXUxqXI0/fNFURjBvUWwrlI7aKfh8dOTbi6AtbDam8R
-RdTw0H0os2NWH0p7KlqrVKo9vfkMekssfDS0OW/kFBj8tNKn82cP88pMqca7MwEQ
-uMZ5Bn8kow==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFAvWjlQZyBSMUhj
+Zk9XdkxaZkpXYkF3K2lpbkR5dmZYYzJhUi9UanpBVEI1S2IvZXhNCnpyT09mZHNv
+YktCcUd5Y2w1bnNNajFjaWl6Um9yWFpUTkFGdjRINnZFRW8KLT4gc3NoLWVkMjU1
+MTkgUWQwZXBRIHE3RXdLUC82TVNJdHIvU2xnWGF1QktCZGkxbFhsT0dxVDRZZWgy
+aVBUbDQKUkxqdTc5ZlhQaG5OOXhtSVBlR2FCR2c3ZGR2cnFUWnN0WkQxRDRlWlg1
+YwotPiBzc2gtZWQyNTUxOSB1N1ozancgR2pTOVZ5cGpmdzMzT1ZYelAwTTI1TVpG
+QUdlZ0xBZEo4NkpoZlZEVGlFTQpFelJDQ0RKaFFsVlRESERmMWJIQjZJcmh1QzBI
+VFU3QmZGZ2JKcFMyNmJrCi0+IHNzaC1lZDI1NTE5IFpEOGxNdyBYSHdCdXJRTUVI
+eDFJZHRHY2JhUTRha1JNRFg5c3ppbVo0OGdQSXdPOUdJCjBFSTVpd2JWd2xkTjZx
+VDVuMlVHb1Z1aEhYU2kxWkpwV2hJUDZQRzNkckUKLT4gc3NoLWVkMjU1MTkgZjVU
+aEFnIG1zay9zeUFtd3dkOTJQUFR6S0ZnUm9jbmQ0TkJQU2pJTTYrMmNEaE5KeTAK
+WXN2OFM2anNYYXF6Wk9rUnFjQzNGSjdhTGFyVDhhd1dORWxRaUpuRG9XUQotPiBe
+d3pXUTxFLWdyZWFzZSBvVT16IFw3Oz02IGQ/ZFVjQS4KVnBKTVc0YzR3SEhaOS80
+bzE1NXMxaHh1QStNaXZ4eGZrbDdrV0k5YW5rQTdKbGJsbzZsRzFLMi9veTAKLS0t
+IGdEblEzcTdkcWVFVURycTJsTUl5MHEySUdTRTJub1hMVnJNekMxQTAxTGcKot0G
+3I1FgBm5Hw3MkQXfRdX6FgzAAEmH0t+v8R087u7vDbzVFVwVWGm4qQuHTwYNa1Yu
+5gcM8LAg9N/ZV6Mc7+OlqKoKTs6S+VhphfbuDPrwJZUJT/OO30MgEdgemZ+JtQoA
+O5str1O/0MBTQRyqJglcIjD2rPQcl9cZQupvJeaTOkdoLQ3Pv8aUrZBg3yHg6JX4
+N5siGxgv/NfGcpCvkUM=
 -----END AGE ENCRYPTED FILE-----

secrets/forgejo.age

@@ -1,12 +1,13 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFAvWjlQZyBTdmph
-NDNlY24xZXBSc2w2ZjN5K3l6YXkyNXhiK1g3djdwK3g4MmdrOEdZClU4UWt4Z0U2
-NkRLYWxqL05vbEpQVkk2RXFRTlBWWHBQd2JjYWtZZFVIS3cKLT4gc3NoLWVkMjU1
-MTkgZjVUaEFnIEl0RGoxVlVzKzhabkJuU010NG1yNEN6U2l0S3EvSHBvWDNIcDlm
-WG9jQTQKMExHeXN0eHVtRVhhMHN0UDZrNXl0MVlsUkJzaXdBeEU4cE5vTjVqSTVF
-bwotPiBuMFhTMy1ncmVhc2UgdVxmMG0rID1IMDx9IEB9RgpaQnNDaElQZ0x6K1ht
-WjYvWlNPUmcvdVExWFpnbk1HNWt0Rm5Za0dHTmdLVm9nZm8vNnhNdldLS040bUQ3
-dUZXCjdCT1ZCZwotLS0gZk1paHJBbUlJRzJUU3dqYlE3Z1hwYXd2YmlHUmtCbENB
-L2d3cGh0UldWbwpD4cbpEnC0tJAGBF7MpnYC9PsCg/JltTzUA6zbMDUWtsozxG1z
-2PkX1DKolXm01W2qeTQl2p5mlFk=
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFAvWjlQZyBuMjdR
+ZzN1QTRIend1TWhLSDZzQ0JQUG9tZFdGZUo4QUljV3pnaEdDR1VzCi9PRXFnTDlD
+NFhtYW4reHphUFFqUVBDd2pxY2liOXgwRUlIZzcvZTdWWTAKLT4gc3NoLWVkMjU1
+MTkgZjVUaEFnIGRvQUFSMzFzVmZLT0Z4SlczNmdicThCYklBbisvcmlzejI4b3Jm
+ZVRTVmsKWDlKTkV6STJaSEVDL0tMVmMvcUt0L3pOS0xXU281bjRXSkJDSXloLzZE
+OAotPiBVLWdyZWFzZSBCZTMgM01ZIEd0OWcKdnMvd0FJOEhmQTdTcElld0JsNXdD
+bS9hWUtHam1PR0tyTmowck1rVEEzZXc0QjhWNjVNZVU0anRCS1lrMkRtVApQcVdV
+djJORHppTEFib1VLOC9LbG5OdWhNdEZKWGJyQ3Z6dUFTOEw5WjZsT2E4SDRSSUlK
+aEpWRUNYRlZTdwotLS0geFBJK21QRGZxd3lZRjZRanhDeFRDTTd6T1p2UGhiNXBm
+NnhaWkptcDFsYwqWryUWy5DtJHpelFVJu9DnS2rUS9JVnjIHCj2MNYrs6f5cxzZP
+4+CUjz1Agu+ODFUvsl/ccIvcaS0=
 -----END AGE ENCRYPTED FILE-----

secrets/root.age

@@ -1,16 +1,22 @@
 -----BEGIN AGE ENCRYPTED FILE-----
-YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFAvWjlQZyBXTG1K
-OE15S2ZkZXd6RTc5R3JZeGU0YjF2TVhLOE1jYW1TWDRFSFdadkVzCmQ5TXUvb2d3
-ZldYcEdhYnFuVzVLcXozakNDOXUrdFNweGpBRVF5cUVLU28KLT4gc3NoLWVkMjU1
-MTkgUWQwZXBRIG0wNk1YYzdUSE1WS1RJanBJK1IvZUpxaC9NVHp0Z2JyRkJxSlEy
-VnhJRW8KVUxDNTJ1cXNLRXFDcFZtMk9Lb2NFaVhsWENCSHhDbjh3c1dBMnlnRytm
-WQotPiBzc2gtZWQyNTUxOSBmNVRoQWcgajU4b1R2blEzaUovTkFJcHBkV01OWTVN
-cVlROVY3V2szUTJkbnh1cnpHUQpZbVVXaGpDaWdNcEJhVjNxa3BOaThDbnEyWGdQ
-R3BXL21Cb0FmU2NQMHJVCi0+IFlFOWEtZ3JlYXNlIF9Ud3hhIDh7IF80Pi8KMWhF
-dWszMTVpNDNaQU1KZUx4ZVhtc0xuVFBQUGVQSzUrUjF5NjdBd0xhbnJ0U3VveHJv
-TGRDWmdQVUlZVWlvagptUmYwRlNHSWxJYUEvZwotLS0gSGhiMkN3eWFRQnNnaWNN
-NFVySCs5R1NGelg4ckx1S09HcDBaVGZUZlpJNApJ6FRxoquBSUxeI/k7qfrV1TFN
-KjENnVJPTQ+toUC0nsZnsseJbcudpbZbkihaObqqAsDuB2gvWiyNMuBbDLAGgjRz
-oYJTSO9LLXLINo/oQOdVaASuviMrtZy/zOVYkQCKdlUo4EouFLYnJ2k6KWUCUXcp
-CrMAZv/DU/uetOr1JYKaRxsvIn8j92PHOkkuh7oGb7UpXpxlrRWDiemTe3qfiw==
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IFAvWjlQZyBsWm9s
+UzB6bzM2VU9IR3Y2MUcrdmtJTk1nM3h0VFV4WFNaaU9pZ0pHMWxBClpiRDZ3VVU1
+VkE5SHhJZXc4RGJOenY3Qzc1eXN6Y1M2d1ZnU1dIbHFvQUUKLT4gc3NoLWVkMjU1
+MTkgUWQwZXBRIGVCZURhelZkTFpoRldaVlZoZzVBenBjbEROUlIrTERnN2VpNmhP
+dVFNSDQKNXNWNU5iOGRBV3ZMVzdSVXRPSTkvQzJpblVsbERJekM0VHdnbEwyd0tG
+VQotPiBzc2gtZWQyNTUxOSB1N1ozancgY2pvTllQbytTbDBZaHlSbVFxa2ZYbmFt
+OTlvYTQrMUcybVdJd2gxb2Jsbwo4RXBLMkdYSFY3aHYxSGZnS0h4S21ablBueFBz
+L2JFaEhaYWR5VFFNQzhVCi0+IHNzaC1lZDI1NTE5IFpEOGxNdyBDZGNmblJIWGtx
+QWhEeldzVGZmUWJ6anM4Y2hTT0tpUVNpNDVyRDJRQ240Clk2bmpCVlI4RWduRS80
+cVRVWWwycDdtdVpFS25BSDAzOEh5YUcxdW9GclkKLT4gc3NoLWVkMjU1MTkgZjVU
+aEFnIDZBbXVIQVdoaVl6TlZXR1FmeEtwL0hBNWc4c0lvSFlQTzZVc1VJZ09PMXcK
+VnhFVVg4eTZiRU1YbUhxUzJrYXRUeWpVVFdOSWpUNHNvUWZCRXd1U3Y3VQotPiBB
+IW9WfGMlLWdyZWFzZQo2WmhadWt6cFZ3S2FONDFIWUFPWWpMOXFRT1d2alNPajVI
+aUJrdmVVT1J1OHA3Uy9LMjdadSs4RnhldGNxWGNtCitJSHhKSlhnMzI0UDdtSFBX
+T0tuY0NvRkI5Q0F6YkJmSHI3aFlReHJORVNLL1RJMkI5QUt5NllmcGcKLS0tIGFQ
+YXpDdDhnR05PaGQ0WEdVd2hMUURnRmtnbDVvWkt0ZDNtaVhxT0ZIbFUKcYbxjmgx
+v7X82tsU3fuTUo9l2q3HmHECwKlvyqsXyyJst+/jJgANfE7/tHm0t6Dm4fPgBvdN
+0AqTDx1p7PLvfQhMuhD2G9mHGLwcom3xUOI8h6JkMCv+bojWD9RCEB+wsAwfCzVV
+pStMrMl6copsy1/E4yXkkm+kBgIMFeGzQvRyZ+UCri0rjzsGFQWEgUgD3fFcNJIq
+HCYi0uW970YK2qI=
 -----END AGE ENCRYPTED FILE-----

secrets/secrets.nix

@@ -11,9 +11,10 @@ let
   users = [fiscalvelvetpoet];
 
   flemming = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK16f3Fjj0BY9vjtXahezMAP3I329hHEQXCceRTkr+Yu";
+  hollows = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGB8EUbqoarM4GmPgE2DBF4z/L6wVNc+lF27Z83XDUz";
   pred = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMK5BOK1ldtZ+SV4QxfNm/PfOLOWv3/VHf/JbdMMoMzw";
   toscano = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGWcukRkNUQUbgXQle8q9xszDZOnDf3BVpPSFgycJVVE";
-  systems = [flemming toscano];
+  systems = [flemming hollows pred toscano];
 in {
   "root.age".publicKeys = ops ++ systems;
   "fiscalvelvetpoet.age".publicKeys = [fiscalvelvetpoet] ++ systems;

shell.nix

@@ -4,6 +4,7 @@
   alejandra,
   mkShell,
   colmena,
+  nix,
 }:
 with pkgs;
   mkShell {