chore: migrate cube host

hosts/cube/default.nix

@@ -0,0 +1,73 @@
+lib: lib.nixosSystem ({ config, keys, lib, ... }: let
+  inherit (lib) collectNix remove;
+in {
+  imports = collectNix ./. |> remove ./default.nix;
+
+  secrets.id.file           = ./id.age;
+  services.openssh.hostKeys = [{
+    type = "ed25519";
+    path = config.secrets.id.path;
+  }];
+
+  services.openssh.banner = ''
+     _______________________________________
+    / If God doesn't destroy San Francisco, \
+    | He should apologize to Sodom and      |
+    \ Gomorrah.                             /
+     ---------------------------------------
+            \   ^__^
+             \  (oo)\_______
+                (__)\       )\/\
+                    ||----w |
+                    ||     ||
+  '';
+
+  secrets.rgbPassword.file = ./password.rgb.age;
+  users.users              = {
+    root.hashedPasswordFile = config.secrets.rgbPassword.path;
+
+    rgb = {
+      description                 = "RGB";
+      openssh.authorizedKeys.keys = keys.admins;
+      hashedPasswordFile          = config.secrets.rgbPassword.path;
+      isNormalUser                = true;
+      extraGroups                 = [ "wheel" ];
+    };
+
+    backup = {
+      description                 = "Backup";
+      openssh.authorizedKeys.keys = keys.all;
+      hashedPasswordFile          = config.secrets.rgbPassword.path;
+      isNormalUser                = true;
+    };
+  };
+
+  home-manager.users = {
+    root   = {};
+    rgb    = {};
+    backup = {};
+  };
+
+  networking = let
+    interface = "ens18";
+  in {
+    hostName = "cube";
+
+    ipv4.address = "5.255.78.70";
+    ipv4.prefixLength = 24;
+
+    domain = "rgbcu.be";
+
+    defaultGateway = {
+      inherit interface;
+
+      address = "5.255.78.1";
+    };
+  };
+
+  nixpkgs.hostPlatform       = "x86_64-linux";
+  system.stateVersion        = "23.05";
+  home-manager.sharedModules = [{
+    home.stateVersion = "23.11";
+  }];
+})

hosts/cube/forgejo/default.nix

@@ -0,0 +1,161 @@
+{ self, config, lib, pkgs, ... }: let
+  inherit (config.networking) domain;
+  inherit (lib) const enabled genAttrs head merge mkForce;
+
+  fqdn = "git.${domain}";
+
+  port = 8001;
+in {
+  secrets.forgejoPasswordRunner = {
+    file  = ./password.runner.age;
+    owner = "forgejo";
+  };
+  secrets.forgejoPasswordMail = {
+    file  = self + /modules/mail/password.plain.age;
+    owner = "forgejo";
+  };
+
+  services.postgresql = let
+    users = [ "forgejo" ];
+  in {
+    ensureDatabases = users;
+    ensureUsers     = map users (name: {
+      inherit name;
+
+      ensureDBOwnership = true;
+    });
+  };
+
+  services.restic.backups = genAttrs config.services.restic.hosts <| const {
+    paths = [ "/var/lib/gitea-runner"  "/var/lib/forgejo" ];
+  };
+
+  users.groups.gitea-runner = {};
+  users.users.gitea-runner  = {
+    extraGroups  = [ "docker" ];
+    group        = "gitea-runner";
+    home         = "/var/lib/gitea-runner";
+    isSystemUser = true;
+  };
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-actions-runner;
+
+    instances.runner-01 = enabled {
+      name = "runner-01";
+      url  = fqdn;
+
+      labels = [
+        "debian-latest:docker://node:18-bullseye"
+        "ubuntu-latest:docker://node:18-bullseye"
+        "act:docker://ghcr.io/catthehacker/ubuntu:act-latest"
+      ];
+
+      tokenFile = config.secrets.forgejoPasswordRunner.path;
+
+      settings = {
+        cache.enabled     = true;
+        capacity          = 4;
+        container.network = "host";
+      };
+
+      hostPackages = [
+        pkgs.bash
+        pkgs.uutils-coreutils-noprefix
+        pkgs.curl
+        pkgs.gitMinimal
+        pkgs.sudo
+        pkgs.wget
+      ];
+    };
+  };
+
+  services.openssh.settings.AcceptEnv = mkForce "SHELLS COLOTERM GIT_PROTOCOL";
+
+  services.forgejo = enabled {
+    lfs = enabled;
+
+    secrets.mailer.PASSWD = config.secrets.forgejoPasswordMail.path;
+
+    database = {
+      socket = "/run/postgresql";
+      type   = "postgres";
+    };
+
+    settings = let
+      description = "RGBCube's Forge of Shitty Software";
+    in {
+      default.APP_NAME = description;
+
+      actions = {
+        ENABLED             = true;
+        DEFAULT_ACTIONS_URL = "https://${fqdn}";
+      };
+
+      attachment.ALLOWED_TYPES = "*/*";
+
+      cache.ENABLED = true;
+
+      mailer = {
+        ENABLED = true;
+
+        PROTOCOL  = "smtps";
+        SMTP_ADDR = self.disk.mailserver.fqdn;
+        USER      = "git@${domain}";
+      };
+
+      other = {
+        SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
+        SHOW_FOOTER_VERSION            = false;
+      };
+
+      packages.ENABLED = false;
+
+      repository = {
+        DEFAULT_BRANCH      = "master";
+        DEFAULT_MERGE_STYLE = "rebase-merge";
+        DEFAULT_REPO_UNITS  = "repo.code, repo.issues, repo.pulls, repo.actions";
+
+        DEFAULT_PUSH_CREATE_PRIVATE = false;
+        ENABLE_PUSH_CREATE_ORG      = true;
+        ENABLE_PUSH_CREATE_USER     = true;
+
+        DISABLE_STARS = true;
+      };
+
+      "repository.upload" = {
+        FILE_MAX_SIZE = 100;
+        MAX_FILES = 10;
+      };
+
+      server = {
+        DOMAIN       = domain;
+        ROOT_URL     = "https://${fqdn}/";
+        LANDING_PAGE = "/explore";
+
+        HTTP_ADDR = "::1";
+        HTTP_PORT = port;
+
+        SSH_PORT = head config.services.openssh.ports;
+
+        DISABLE_ROUTER_LOG = true;
+      };
+
+      service.DISABLE_REGISTRATION = true;
+
+      session = {
+        COOKIE_SECURE = true;
+        SAME_SITE     = "strict";
+      };
+
+      "ui.meta" = {
+        AUTHOR      = description;
+        DESCRIPTION = description;
+      };
+    };
+  };
+
+  services.nginx.virtualHosts.${fqdn} = merge config.nginx.sslTemplate {
+    locations."/".proxyPass = "http://[::1]:${toString port}";
+  };
+}

hosts/cube/forgejo/password.runner.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 +rZ0Tw w2DgM8xAXzEYvEPHwf2SKgG6UThGCsC9O5GJtBEmESA
+ID5KL9YemWr93wy66VQzgzoidMSR9TQKZYgNJp6WAoc
+-> ssh-ed25519 CzqbPQ U1lCAlt/cyCwbo4VaEv7edcwGdEGzdHRSoDjvYyWkxI
+JWVcb5a3iNeJv75AHNHr/9nU6pE6SnmS/5N+oZbl/cg
+--- qBV+LTrheqYtuHtzeDpZTPa96P1Q91wcf7pMcIKBzFM
+¢5öïÐÉÿ§û=†¾gòãhÁS+îažºÿ•—ߪ‰Ä‹Ý<E280B9>_YeE
+iBºæ5UWo"ÊJZ#(ríï`LàZÈüVŠúÅ

hosts/cube/grafana/default.nix

@@ -0,0 +1,86 @@
+{ self, config, lib, ... }: let
+  inherit (config.networking) domain;
+  inherit (lib) const enabled genAttrs merge;
+
+  fqdn = "metrics.${domain}";
+
+  port = 8000;
+in {
+  secrets.grafanaPassword = {
+    file  = ./password.age;
+    owner = "grafana";
+  };
+  secrets.grafanaPasswordMail = {
+    file  = self + /modules/mail/password.plain.age;
+    owner = "grafana";
+  };
+
+  services.postgresql = let
+    users = [ "grafana" ];
+  in {
+    ensureDatabases = users;
+    ensureUsers     = map users (name: {
+      inherit name;
+
+      ensureDBOwnership = true;
+    });
+  };
+
+  services.restic.backups = genAttrs config.services.restic.hosts <| const {
+    paths = [ "/var/lib/grafana" ];
+  };
+
+  systemd.services.grafana = {
+    after    = [ "postgresql.service" ];
+    requires = [ "postgresql.service" ];
+  };
+
+  services.grafana = enabled {
+    provision = enabled;
+
+    settings = {
+      analytics.reporting_enabled = false;
+
+      database.host = "/run/postgresql";
+      database.type = "postgres";
+      database.user = "grafana";
+
+      server.domain    = fqdn;
+      server.http_addr = "[::1]";
+      server.http_port = port;
+
+      users.default_theme = "system";
+    };
+
+    settings.security = {
+      admin_email    = "metrics@${domain}";
+      admin_password = "$__file{${config.secrets.grafanaPassword.path}}";
+      admin_user     = "admin";
+
+      cookie_secure    = true;
+      disable_gravatar = true;
+
+      disable_initial_admin_creation = true; # Just in case.
+    };
+
+    settings.smtp = {
+      enabled = true;
+
+      password        = "$__file{${config.secrets.grafanaPasswordMail.path}}";
+      startTLS_policy = "MandatoryStartTLS";
+
+      ehlo_identity = "metrics@${domain}";
+      from_address  = "metrics@${domain}";
+      from_name     = "Metrics";
+      host          = "${self.disk.mailserver.fqdn}:${toString self.disk.services.postfix.relayPort}";
+    };
+  };
+
+  services.nginx.virtualHosts.${fqdn} = merge config.nginx.sslTemplate {
+    locations."/" = {
+      proxyPass       = "http://[::1]:${toString port}";
+      proxyWebsockets = true;
+    };
+  };
+}
+

hosts/cube/hardware.nix

@@ -0,0 +1,23 @@
+{ lib, modulesPath, ... }: let
+  inherit (lib) enabled;
+in {
+  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
+
+  boot.loader.grub = enabled {
+    device = "/dev/vda";
+  };
+
+  boot.initrd.availableKernelModules = [
+    "ata_piix"
+    "sr_mod"
+    "uhci_hcd"
+    "virtio_blk"
+    "virtio_pci"
+  ];
+
+  fileSystems."/" = {
+    device  = "/dev/disk/by-label/root";
+    fsType  = "ext4";
+    options = [ "noatime" ];
+  };
+}

hosts/cube/matrix/default.nix

@@ -0,0 +1,136 @@
+{ config, lib, ... }: let
+  inherit (config.networking) domain;
+  inherit (lib) const enabled genAttrs merge strings;
+
+  pathSite = "/var/www/site";
+
+  domainChat = "chat.${domain}";
+  domainSync = "sync.${domain}";
+
+  wellKnownResponse = data: ''
+    default_type application/json;
+    add_header Access-Control-Allow-Origin *;
+    return 200 '${strings.toJSON data}';
+  '';
+
+  configClient."m.homeserver".base_url        = "https://${domainChat}";
+  configClient."org.matrix.msc3575.proxy".url = "https://${domainSync}";
+
+  configServer."m.server" = "${domainChat}:443";
+
+  configWellKnownResponse.locations = {
+    "= /.well-known/matrix/client".extraConfig = wellKnownResponse configClient;
+    "= /.well-known/matrix/server".extraConfig = wellKnownResponse configServer;
+  };
+
+  configNotFoundLocation = {
+    locations."/".extraConfig = "return 404;";
+
+    extraConfig                  = "error_page 404 /404.html;";
+    locations."/404".extraConfig = "internal;";
+
+    locations."/assets/".extraConfig = "return 301 https://${domain}$request_uri;";
+  };
+
+  portSynapse = 8002;
+  portSync    = 8003;
+in {
+  secrets.matrixSecret = {
+    file  = ./password.secret.age;
+    owner = "matrix-synapse";
+  };
+  secrets.matrixSyncPassword = {
+    file  = ./password.sync.age;
+    owner = "matrix-synapse";
+  };
+
+  services.postgresql = let
+    users = [ "matrix-synapse" "matrix-sliding-sync" ];
+  in {
+    ensureDatabases = users;
+    ensureUsers     = map users (name: {
+      inherit name;
+
+      ensureDBOwnership = true;
+    });
+  };
+
+  services.restic.backups = genAttrs config.services.restic.hosts <| const {
+    paths = [ "/var/lib/matrix-synapse"  "/var/lib/matrix-sliding-sync" ];
+  };
+
+  services.matrix-synapse = enabled {
+    withJemalloc = true;
+
+    configureRedisLocally  = true;
+    settings.redis.enabled = true;
+
+    extras = [ "postgres" "url-preview" "user-search" ];
+
+    log.root.level = "WARNING"; # Shut the fuck up.
+
+    settings = {
+      server_name = domain;
+      # We are not setting web_client_location since the root is not accessible
+      # from the outside web at all. Only /_matrix is reverse proxied to.
+
+      database.name  = "psycopg2";
+
+      report_stats = false;
+
+      enable_metrics = true;
+      metrics_flags.known_servers = true;
+
+      expire_access_token = true;
+      url_preview_enabled = true;
+
+      # Trusting Matrix.org.
+      suppress_key_server_warning = true;
+    };
+
+    # Sets registration_shared_secret.
+    extraConfigFiles = [ config.secrets.matrixSecret.path ];
+
+    settings.listeners = [{
+      port = portSynapse;
+
+      bind_addresses = [ "::1" ];
+      tls            = false;
+      type           = "http";
+      x_forwarded    = true;
+
+      resources = [{
+        compress = false;
+        names    = [ "client" "federation" ];
+      }];
+    }];
+  };
+
+  services.nginx.virtualHosts.${domain} = configWellKnownResponse;
+
+  services.nginx.virtualHosts.${domainChat} = merge config.nginx.sslTemplate configWellKnownResponse configNotFoundLocation {
+    root = "${pathSite}";
+
+    locations."/_matrix".proxyPass         = "http://[::1]:${toString portSynapse}";
+    locations."/_synapse/client".proxyPass = "http://[::1]:${toString portSynapse}";
+  };
+
+  services.matrix-sliding-sync = enabled {
+    environmentFile = config.age.secrets.matrixSyncPassword.path;
+    settings        = {
+      SYNCV3_SERVER   = "https://${domainChat}";
+      SYNCV3_DB       = "postgresql:///matrix-sliding-sync?host=/run/postgresql";
+      SYNCV3_BINDADDR = "[::1]:${toString portSync}";
+    };
+  };
+
+  services.nginx.virtualHosts.${domainSync} = merge config.nginx.sslTemplate configNotFoundLocation {
+    root = pathSite;
+
+    locations."~ ^/(client/|_matrix/client/unstable/org.matrix.msc3575/sync)"
+      .proxyPass = "http://[::1]:${toString portSynapse}";
+
+    locations."~ ^(\\/_matrix|\\/_synapse\\/client)"
+      .proxyPass = "http://[::1]:${toString portSync}";
+  };
+}

hosts/cube/matrix/password.secret.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 +rZ0Tw JrLJgFemnQUQpZ+SYnEs0gVfPYmLyVM0ibPzLa9UKU0
+rZ9DtsOexcUGuPc4Rlfj9u0cbqU4z5R4M9MuKPyL/Zk
+-> ssh-ed25519 CzqbPQ 5NibbW1CERCv8QTAuz5zeKxue1j23FyvQJn1ppjkXWg
+oN12GPJsxJzRMrzUp34oLO0SvwT+Ed8CLCRqCtU0LrY
+--- Y+OUAHyQ0irtOVcLDx1WvyIwp5VdkM2wqqhmeCMok6A
+\Š{Z_?›’ËçÁqŽ—74ºŒÚðX˦+äƒd^‚$š4ä`B”3öûøŸ(êé^ãRi)$WÏÑ­yX=-"<$X$Ž¨<C5BD>ñâð:@Ì´ŸˆXHXgq
޹ʤOÈ	¾v›ž‘„Ó	<[çúŸo&ÜCUÁíkWð|³e_ªÌº’

hosts/cube/matrix/password.sync.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 +rZ0Tw txU8aL7ixRa9bTrV+FR5Vs8UrZ/JCNNblezCm/NJLWE
+9ucwZW0qvCAc5EilV1B9XC+OA5Ro3FS6KBLGKT6NArI
+-> ssh-ed25519 CzqbPQ 5DDlTXg4RIYcTcusedLRkuK3dbtccfQ0HiVFUH5B5XQ
+6dW9qE5UMpOSohXIu559wBnPnOrTG/mqtrWvsy5CqYw
+--- UO+CkdYt44UO16Yv3+sCJ5IoM2D+Pus7jEPbRFwGyKU
+bs¶X¤
+Pßt<C39F>å \Twêâ¸ÝŸq{±ÐÑó:ùlö<6C>¶9%˜ç(BdÃ]Øõhº<68>ǹÓ|Üþ…SþM¨ÆQ}¼ÿ^Œ<>/quüŒ]‡oXE@"Ü‘¨”ÝŸ|ÐH}«\p©åó€­Þìmd«›

hosts/cube/nextcloud/default.nix

@@ -0,0 +1,118 @@
+ { config, lib, pkgs, ... }: let
+  inherit (config.networking) domain;
+  inherit (lib) const enabled genAttrs mkAfter;
+
+  fqdn = "cloud.${domain}";
+
+  packageNextcloud = pkgs.nextcloud29;
+in {
+  secrets.nextcloudPassword = {
+    file  = ./password.age;
+    owner = "nextcloud";
+  };
+  secrets.nextcloudPasswordExporter = {
+    file  = ./password.age;
+    owner = "nextcloud-exporter";
+  };
+
+  services.prometheus.exporters.nextcloud = enabled {
+    listenAddress = "[::]";
+
+    username     = "admin";
+    url          = "https://${fqdn}";
+    passwordFile = config.secrets.nextcloudPasswordExporter.path;
+  };
+
+  services.postgresql = let
+    users = [ "nextcloud" ];
+  in {
+    ensureDatabases = users;
+    ensureUsers     = map users (name: {
+      inherit name;
+
+      ensureDBOwnership = true;
+    });
+  };
+
+  services.restic.backups = genAttrs config.services.restic.hosts <| const {
+    paths = [ "/var/lib/nextcloud" ];
+  };
+
+  systemd.services.nextcloud-setup = {
+    after    = [ "postgresql.service" ];
+    requires = [ "postgresql.service" ];
+
+    script = mkAfter ''
+      nextcloud-occ theming:config name "RGBCube's Depot"
+      nextcloud-occ theming:config slogan "RGBCube's storage of insignificant data."
+
+      nextcloud-occ theming:config color "#000000"
+      nextcloud-occ theming:config background backgroundColor
+
+      nextcloud-occ theming:config logo ${./icon.gif}
+    '';
+  };
+
+  services.nextcloud = enabled {
+    package  = packageNextcloud;
+
+    hostName = fqdn;
+    https    = true;
+
+    configureRedis = true;
+
+    config.adminuser     = "admin";
+    config.adminpassFile = config.secrets.nextcloudPassword.path;
+
+    config.dbhost = "/run/postgresql";
+    config.dbtype = "pgsql";
+
+    settings = {
+      default_phone_region = "TR";
+
+      # Even with manual SMTP configuration, Nextcloud fails to communicate properly
+      # and fails to send mail. PHP moment?
+      # mail_smtphost     = "::1"; # FIXME: Will need to use SMTP.
+      # mail_smtpmode     = "sendmail";
+      # mail_from_address = "cloud";
+
+      maintenance_window_start = 1;
+
+      # No clue why it was syslog.
+      # What are the NixOS module authors on?
+      log_type = "file";
+    };
+
+    settings.enabledPreviewProviders = [
+      "OC\\Preview\\BMP"
+      "OC\\Preview\\GIF"
+      "OC\\Preview\\JPEG"
+      "OC\\Preview\\Krita"
+      "OC\\Preview\\MarkDown"
+      "OC\\Preview\\MP3"
+      "OC\\Preview\\OpenDocument"
+      "OC\\Preview\\PNG"
+      "OC\\Preview\\TXT"
+      "OC\\Preview\\XBitmap"
+      "OC\\Preview\\HEIC"
+    ];
+
+    phpOptions = {
+      "opcache.interned_strings_buffer" = "16";
+      output_buffering                  = "off";
+    };
+
+    extraAppsEnable = true;
+    extraApps       = {
+      inherit (packageNextcloud.packages.apps)
+        bookmarks calendar contacts deck
+        forms impersonate mail # groupfolders impersonate mail
+        maps notes polls previewgenerator; # tasks;
+        # Add: files_markdown files_texteditor memories news
+    };
+
+    nginx.recommendedHttpHeaders = true;
+  };
+
+  services.nginx.virtualHosts.${fqdn} = config.ngnixSslTemplate;
+}

hosts/cube/nextcloud/password.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 +rZ0Tw B5yow6s83Ij7ymJ4DVisL/Q58+tewqii8SLknj+WDCI
+lkD9VftG4FA8sIztdrlCfaiaaSiKIEThT8gvGPuYvto
+-> ssh-ed25519 CzqbPQ eHxowar9M2Zw7DheC9Cj2jwtCFKuPHJiNTGNtJOc2Ek
+2LMp4JqjbKbW1Sglf06h7ZtPTA0+qxNj8QJbz7drH1k
+--- kCW5Y/0JPRigRjj3CNpr4ruLsG1f5tBXoEX1eVKjB7Q
+M“¯£p¿íX1øùä&<0C>r‡€C
x	3N5Þ‘6‰æÖ5>W9W

hosts/cube/podman.nix

@@ -0,0 +1,15 @@
+{ lib, ... }: let
+  inherit (lib) enabled;
+in {
+  virtualisation.podman = enabled {
+    dockerCompat = true;
+    dockerSocket = enabled;
+
+    defaultNetwork.settings.dns_enabled = true;
+
+    autoPrune = enabled {
+      dates = "weekly";
+      flags = [ "--all" ];
+    };
+  };
+}

hosts/cube/postgresql.nix

@@ -0,0 +1,114 @@
+{ config, lib, pkgs, ... }: let
+  inherit (lib) const enabled genAttrs mkForce mkOverride;
+in {
+  environment.systemPackages = [
+    config.services.postgresql.package
+  ];
+
+  services.prometheus.exporters.postgres = enabled {
+    listenAddress       = "[::]";
+    runAsLocalSuperUser = true;
+  };
+
+  services.restic.backups = genAttrs config.services.restic.hosts <| const {
+    paths = [ "/tmp/postgresql-dump.sql.gz" ];
+
+    backupPrepareCommand = ''
+      ${config.services.postgresql.package}/bin/pg_dumpall --clean \
+      | ${lib.getExe pkgs.gzip} --rsyncable \
+      > /tmp/postgresql-dump.sql.gz
+    '';
+
+    backupCleanupCommand = ''
+      rm /tmp/postgresql-dump.sql.gz
+    '';
+  };
+
+  services.postgresql = enabled {
+    package = pkgs.postgresql_14;
+
+    enableJIT = true;
+
+    initdbArgs    = [ "--locale=C" "--encoding=UTF8" ];
+    initialScript = pkgs.writeText "grant-root-perms" ''
+      GRANT pg_read_all_data  TO root;
+      GRANT pg_write_all_data TO root;
+    '';
+
+    authentication = mkOverride 10 ''
+      # Type Database DBUser Authentication
+      local  all      all    peer
+    '';
+
+    ensureUsers = map [ "postgres" "root" ] (name: {
+      inherit name;
+
+      ensureClauses = {
+        createdb    = true;
+        createrole  = true;
+        login       = true;
+        replication = true;
+        superuser   = true;
+      };
+    });
+
+    settings = {
+      listen_addresses = mkForce "";
+
+      # Generated by <https://pgconfigurator.cybertec.at/>
+      max_connections                = 100;
+      superuser_reserved_connections = 3;
+
+      # Memory Settings
+      shared_buffers           = "1024 MB";
+      work_mem                 = "32 MB";
+      maintenance_work_mem     = "320 MB";
+      huge_pages               = "off";
+      effective_cache_size     = "3 GB";
+      effective_io_concurrency = 1; # Concurrent IO only really activated if OS supports posix_fadvise function.
+      random_page_cost         = 4; # Speed of random disk access relative to sequential access (1.0).
+
+      # Monitoring
+      shared_preload_libraries = "pg_stat_statements"; # Per statement resource usage stats.
+      track_io_timing          = "on";                 # Measure exact block IO times.
+      track_functions          = "pl";                 # Track execution times of pl-language procedures if any.
+
+      # Replication
+      wal_level          = "replica";
+      max_wal_senders    = 0;
+      synchronous_commit = "on";
+
+      # Checkpointing
+      checkpoint_timeout           = "15 min";
+      checkpoint_completion_target = 0.9;
+      max_wal_size                 = "1024 MB";
+      min_wal_size                 = "512 MB";
+
+      # WAL writing
+      wal_compression        = "on";
+      wal_buffers            = -1; # auto-tuned by Postgres till maximum of segment size (16MB by default).
+      wal_writer_delay       = "200ms";
+      wal_writer_flush_after = "1MB";
+
+      # Background writer
+      bgwriter_delay          = "200ms";
+      bgwriter_lru_maxpages   = 100;
+      bgwriter_lru_multiplier = 2.0;
+      bgwriter_flush_after    = 0;
+
+      # Parallel queries
+      max_worker_processes             = 2;
+      max_parallel_workers_per_gather  = 1;
+      max_parallel_maintenance_workers = 1;
+      max_parallel_workers             = 2;
+      parallel_leader_participation    = "on";
+
+      # Advanced features
+      enable_partitionwise_join      = "on";
+      enable_partitionwise_aggregate = "on";
+      jit                            = "on";
+      max_slot_wal_keep_size         = "1000 MB";
+      track_wal_io_timing            = "on";
+    };
+  };
+}

hosts/cube/prometheus.nix

@@ -0,0 +1,42 @@
+{ self, config, lib, ... }: let
+  inherit (lib) enabled filterAttrs flatten mapAttrsToList;
+in {
+  services.grafana.provision.datasources.settings = {
+    datasources = [{
+      name = "Prometheus";
+      type = "prometheus";
+      url  = "http://[::1]:${toString config.services.prometheus.port}";
+
+      orgId = 1;
+    }];
+
+    deleteDatasources = [{
+      name  = "Prometheus";
+      orgId = 1;
+    }];
+  };
+
+  services.prometheus = enabled {
+    listenAddress = "[::]";
+    retentionTime = "1w";
+
+    scrapeConfigs = let
+      configToScrapeConfig = hostName: { hostConfig, ... }:
+        hostConfig.services.prometheus.exporters
+        |> filterAttrs (exporterName: exporterConfig:
+          exporterName != "minio" &&
+          exporterName != "unifi-poller" &&
+          exporterConfig.enable or false)
+        |> mapAttrsToList (exporterName: exporterConfig: {
+          job_name = "${exporterName}-${hostName}";
+
+          static_configs = [{
+            targets = [ "${hostName}:${toString exporterConfig.port}" ];
+          }];
+        });
+
+    in self.nixosConfigurations
+    |> mapAttrsToList configToScrapeConfig
+    |> flatten;
+  };
+}

hosts/disk/default.nix

@@ -40,8 +40,8 @@ in {
   in {
     hostName = "disk";
 
-    ipv4 = "23.164.232.40";
-    ipv6 = "2602:f9f7::40";
+    ipv4.address = "23.164.232.40";
+    ipv6.address = "2602:f9f7::40";
 
     domain = "rgbcu.be";
 

hosts/disk/password.floppy.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 spFFQA pJguGLlB7R7iXrGfwKabGxmryMrfY57yvfaCytZG/Fs
-1USXbjiteoTrs7+KEFPTMVBNHpBWFXyHi/iLxFL7tls
--> ssh-ed25519 CzqbPQ IbK7nvEUn324R2zHDJzfgMV/FDqwLCU/jGZLSjrG4FY
-naDshlcyrpvgLQydqxAXg/hhfFAFov568p163F7wrZ4
---- MTj/7Zs1N348gDK+G1p01d6EZ21JzpPJnlaUc1ChcBo
-*°<>òluçM¹â=&Á÷à³Z<C2B3>¾›·
×ü0•ï!<21>¶A3eí\ÙB0“ÎVêýÚš¢¦í¢R‹; \6Ö¹®¡ío’÷^ZRÎ}_³›­ç%~›kÑ ™»Ão¹Œž$³O¸$É^…Aâ*¦Ù
+-> ssh-ed25519 spFFQA YsTLrDcLvotgvQQJCD6DBH33gYQ9AqYaGcr190cG3TI
+3q4i1UfAG7EnjhIxZaeQWQY8vcJr6JK7/LM3yP2Gao0
+-> ssh-ed25519 CzqbPQ e8RuAwnyVxk0Yuh7xHcrGYhhBH7GOJkJMxrIzgIcny8
+RCoXTagYrg7uX/XG9UCY794a4d+ClM8vYbkZCw6Sw0Q
+--- 62b4Fu14qheY/e7ffDWERVQIrLrxl9yKdVWmuMD+ZSA
+<02>“†ù|aלóp6Â}ßÛ[ª<>TÛUË>ÔÊŽ{ÂV#‘7À"ë	ûSû’óÓ<C3B3>M·¼žOúFæ“1¸ÿ) ‚3Ò@7Ì5ï°Ö‹>KtuŸõž°­Õ2$Ü<>¤ÞW…"½Ñv

hosts/nine/default.nix

@@ -40,8 +40,8 @@ in {
   in {
     hostName = "nine";
 
-    ipv4 = "152.53.2.105";
-    ipv6 = "2a0a:4cc0:0:12d9::";
+    ipv4.address = "152.53.2.105";
+    ipv6.address = "2a0a:4cc0:0:12d9::";
 
     domain = "rgbcu.be";
 

hosts/nine/password.seven.age

@@ -1,7 +1,7 @@
 age-encryption.org/v1
--> ssh-ed25519 dASlBQ jbiIxrysHZ21MCvz4L+lbmi3GMH32ZRy+q/pNBkSqW0
-j2j3uQhWnvrCRNg0+cSwCz3/NNhQ3845h2bzCWMv3kQ
--> ssh-ed25519 CzqbPQ u1JW2+Ti8JtHDLgvDFcKwVPPzSSQvNru4OOEMdGGhlQ
-4AWUfqUzfT35ijv7rlqdnm0CGWOC4zQIpCWI+JYVWY4
---- CtfGHevr6FqzOYK/REhFlxAy08LOgt+3+DJz9tZPNp0
-CB1D§˵Q¾C"¥îûB¼‚œ…<‰¬æ*ãø1UèÙp¦ù–¿EâÝ6No¨G–´½ªó½N¿ŸQú>Ÿ	Ðô?ÛU#£¥59\Øp­H\°q‰Ç+²å¢DYkÉ`k¢Ï‡uO½M
+-> ssh-ed25519 dASlBQ QgmiZTOwtv6WXw/1tqHg53H7lH/ZYSYN932+desFFQo
+p/1V5QZ9vrCOSvoSBKIPoIKAUXjdYXhovZkvRam2Yb0
+-> ssh-ed25519 CzqbPQ 7AN7/Dm9Iv4hQEELZyxKk74kJuDzv/veAHcPj3P3a0g
+miUBnlLKmwsbY/OirayxJO3VQrdn/6HDGwONlMoKWlQ
+--- trEYZUoukCFgpo/LwUW+0/ggQ0X0Chyyx/0TXRgsF58
+0zšÐÏ”³žUT“ÖúWÒª*ÌÄÄLt<4C>0SÖš‹ÐÁXø¶,«Ö1¤>5¬²»e‡sdK¨µE‰Uâ'ÈðžÅ|Á‰¨ŠžA"¬Q{„?ÕªjóðÆÅ}´‰ÃÔ}ª¸4^â&šå(<28>9È}