lon: update nixos-unstable

3e3afe5174c561dee0df6f2c2b2236990146329f
→ 9e83b64f727c88a7711a2c463a7b16eedb69a84c

Last 50 commits:
  de01c86 mihomo-party: use finalAttrs
  1107c1a anubis: refactor, add updateScript, adopt (#415932)
  7f06b11 oxigraph: 0.4.9 -> 0.4.11 (#407506)
  c515a1b melonDS: 1.0rc-unstable-2025-05-15 -> 1.0rc-unstable-2025-05-27 (#411919)
  0385a34 mihomo-party: 1.7.4 -> 1.7.5 (#414906)
  d8f9a63 kubectl-view-allocations: 0.21.2 -> 0.22.0
  06c6ed6 vscode-extensions.shopify.ruby-lsp: 0.9.26 -> 0.9.28
  cf25a00 fedigroups: 0.4.5 -> 0.4.6
  26b303b svix-server: 1.66.0 -> 1.67.0
  3764e73 Feat/build deno package (#407434)
  45fa473 hawkeye: 6.0.4 -> 6.1.1
  9864f07 omekasy: 1.3.1 -> 1.3.3
  2803234 mdbook-admonish: 1.19.0 -> 1.20.0
  6369abb flutter326: drop (#414843)
  526945c Fix Flutter Android builds with Gradle 8.9+ (#412907)
  18a1685 openomf: 0.8.2 -> 0.8.3
  48ad36a eigenlayer: 0.11.2 -> 0.13.1
  77e7c3d gql: 0.38.0 -> 0.39.0
  9568033 python3Packages.pymorphy3: 2.0.3 -> 2.0.4
  6b20615 fwup: 1.12.0 -> 1.13.0
  bcebb4f azahar: 2121.2 -> 2122
  5346da3 python3Packages.google-cloud-tasks: 2.19.2 -> 2.19.3
  cad5eaf smplayer: fix hash after upstream replaced their git tag (#416891)
  b428645 python3Packages.bagit: 1.9b2 -> 1.9.0
  68358a8 terraform-providers.huaweicloud: 1.74.1 -> 1.75.3
  bd1fe9d svix-server: 1.66.0 -> 1.67.0 (#417280)
  b9ca64d autenticacao-gov-pt-bin: init at 13.3.3 (#414318)
  47e4aa2 chromium: Enable v4l2 video decoder for hardware acceleratation on aarch64 (#380546)
  ffcb49c python3Packages.duckduckgo-search: 8.0.2 -> 8.0.4
  06a4195 vscode-extensions.shopify.ruby-lsp: 0.9.26 -> 0.9.28 (#417275)
  757a3d8 mongosh: 2.5.1 -> 2.5.2 (#417236)
  df6d44e edk2: run pre/postInstall hook (#417163)
  5609759 erlang_26: 26.2.5.12 -> 26.2.5.13, erlang_27: 27.3.4 -> 27.3.4.1, erlang_28: 28.0 -> 28.0.1 (#417248)
  f2ebc96 exploitdb: 2025-06-06 -> 2025-06-10
  3876842 python3Packages.ical: 10.0.1 -> 10.0.3
  543b004 exploitdb: 2025-06-10 -> 2025-06-14
  02f4cb4 python313Packages.tencentcloud-sdk-python: 3.0.1400 -> 3.0.1401
  2e3ff8c python3Packages.google-cloud-tasks: 2.19.2 -> 2.19.3 (#417295)
  5f11c71 jellyfin-ffmpeg: 7.1.1-4 -> 7.1.1-6 (#417172)
  93e7341 python3Packages.graphviz: 0.20.3 -> 0.21 (#417019)
  7a80d20 checkov: 3.2.441 -> 3.2.442
  348d33d cdncheck: 1.1.22 -> 1.1.23
  0b2ed99 python313Packages.mcpadapt: 0.1.9 -> 0.1.10
  38a4f59 python313Packages.pybotvac: 0.0.27 -> 0.0.28
  c476747 dart: 3.7.3 -> 3.8.0 (#410532)
  22c4be7 hawkeye: 6.0.4 -> 6.1.1 (#417281)
  dfdafec newcomputermodern: add updateScript; 6.0.0 -> 7.0.2; add `meta.changelog` (#417208)
  a9cfab1 python3Packages.python-ipmi: clean up dependencies (#417116)
  fa08ae8 python3Packages.twitchapi: 4.4.0 -> 4.5.0 (#417112)
  64b695e python3Packages.ua-parser-rs: 0.1.2 -> 0.1.3 (#417084)

lon.lock

@@ -195,10 +195,10 @@
       "type": "Git",
       "fetchType": "git",
       "branch": "dgnum",
-      "revision": "44ccf96bd73c1bbbbcc849cb0f2e0d1f5f75f934",
+      "revision": "fd4ba193ea3eda529ac27b43b206e9e3618b1975",
       "url": "https://git.hubrecht.ovh/hubrecht/nix-modules",
-      "hash": "sha256-mkrCWowrCje3/TuAG0eAJplrtlz1hYmusSFn93/Ccok=",
-      "lastModified": 1749629064,
+      "hash": "sha256-O/lMCM0qKkd+TBV43Fp9uG3aEbDSc2lI3a5TetNYs0w=",
+      "lastModified": 1749739595,
       "submodules": false
     },
     "nix-pkgs": {
@@ -257,9 +257,9 @@
       "owner": "NixOS",
       "repo": "nixpkgs",
       "branch": "nixos-unstable",
-      "revision": "ee930f9755f58096ac6e8ca94a1887e0534e2d81",
-      "url": "https://github.com/NixOS/nixpkgs/archive/ee930f9755f58096ac6e8ca94a1887e0534e2d81.tar.gz",
-      "hash": "sha256-Kh9K4taXbVuaLC0IL+9HcfvxsSUx8dPB5s5weJcc9pc="
+      "revision": "9e83b64f727c88a7711a2c463a7b16eedb69a84c",
+      "url": "https://github.com/NixOS/nixpkgs/archive/9e83b64f727c88a7711a2c463a7b16eedb69a84c.tar.gz",
+      "hash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI="
     },
     "proxmox-nixos": {
       "type": "Git",

machines/nixos/compute01/_configuration.nix

@@ -28,6 +28,7 @@ lib.extra.mkConfig {
     "mastodon"
     # "netbox"
     "nextcloud"
+    "nimbolus"
     "ollama-proxy"
     "opengist"
     "outline"

machines/nixos/compute01/nimbolus/default.nix

@@ -0,0 +1,43 @@
+# SPDX-FileCopyrightText: 2025 Lubin Bailly <lubin@dgnum.eu>
+#
+# SPDX-License-Identifier: EUPL-1.2
+
+{
+  pkgs,
+  sources,
+  config,
+  ...
+}:
+let
+  host = "nimbolus.dgnum.eu";
+  port = 9008;
+in
+{
+  imports = [ ./module.nix ];
+  services.nimbolus-tf = {
+    enable = true;
+    package = (import sources.kat-pkgs { inherit pkgs; }).nimbolus-tf-backend;
+    settings = {
+      LISTEN_ADDR = "127.0.0.1:${toString port}";
+
+      STORAGE_BACKEND = "s3";
+      STORAGE_S3_ENDPOINT = "s3.dgnum.eu";
+      STORAGE_S3_USE_SSL = "true";
+      STORAGE_S3_BUCKET = "nimbolus-dgnum";
+      STORAGE_S3_ACCESS_KEY = "GKefa111701f349de3988f0010";
+
+      # TODO: configure openBAO
+      # AUTH_BASIC_ENABLED = "false";
+      # AUTH_JWT_OIDC_ISSUER_URL = "https://vault.dgnum.eu/v1/identity/oidc";
+    };
+
+    credentials = {
+      KMS_KEY_FILE = config.age.secrets."nimbolus-kms_key".path;
+      STORAGE_S3_SECRET_KEY_FILE = config.age.secrets."nimbolus-s3_secret".path;
+    };
+  };
+
+  dgn-web.simpleProxies.nimbolus = {
+    inherit host port;
+  };
+}

machines/nixos/compute01/nimbolus/module.nix

@@ -0,0 +1,104 @@
+# SPDX-FileCopyrightText: 2025 Lubin Bailly <lubin@dgnum.eu>
+#
+# SPDX-License-Identifier: EUPL-1.2
+
+{
+  lib,
+  config,
+  sources,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    getExe
+    mapAttrsToList
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    mkOption
+    ;
+  inherit (lib.types)
+    attrsOf
+    path
+    str
+    ;
+
+  cfg = config.services.nimbolus-tf;
+in
+{
+  options.services.nimbolus-tf = {
+    enable = mkEnableOption "the nimbolus terraform http backend";
+    package = mkPackageOption (import sources.kat-pkgs { inherit pkgs; }) "nimbolus-tf-backend" {
+      pkgsText = "kat-pkgs";
+    };
+    user = mkOption {
+      type = str;
+      description = ''
+        User used by the nimbolus server.
+      '';
+      default = "nimbolus";
+    };
+    group = mkOption {
+      type = str;
+      description = ''
+        Group used by the nimbolus server.
+      '';
+      default = "nimbolus";
+    };
+    settings = mkOption {
+      type = attrsOf str;
+      default = { };
+      description = ''
+        Environment variables for nimbolus configuration.
+      '';
+    };
+    credentials = mkOption {
+      type = attrsOf path;
+      default = { };
+      description = ''
+        Files to pass by systemd LoadCredentials.
+      '';
+    };
+  };
+  config = mkIf cfg.enable {
+    systemd.services.nimbolus-tf = {
+      description = "Nimbolus terraform http backend";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart = getExe cfg.package;
+        Environment =
+          mapAttrsToList (name: value: "${name}=${value}") cfg.settings
+          ++ mapAttrsToList (name: _: "${name}=%d/${name}") cfg.credentials;
+        LoadCredential = mapAttrsToList (name: file: "${name}:${file}") cfg.credentials;
+
+        StateDirectory = "nimbolus-tf";
+        StateDirectoryMode = "0700";
+        WorkingDirectory = "/var/lib/nimbolus-tf";
+
+        # Hardening
+        DynamicUser = true;
+        CapabilityBoundingSet = "";
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        RestrictNamespaces = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        ProtectHome = true;
+        ProtectProc = "noaccess";
+        ProcSubset = "pid";
+        PrivateUsers = true;
+        UMask = "0077";
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = "AF_INET AF_INET6";
+        SystemCallFilter = "~@clock @cpu-emulation @debug @module @mount @obsolete @privileged @raw-io @reboot @resources @swap";
+        MemoryDenyWriteExecute = true;
+        SystemCallArchitectures = "native";
+      };
+    };
+  };
+}

machines/nixos/compute01/secrets/secrets.nix

@@ -25,6 +25,8 @@
     "netbox-environment_file"
     "nextcloud-adminpass_file"
     "nextcloud-s3_secret_file"
+    "nimbolus-kms_key"
+    "nimbolus-s3_secret"
     "opengist-environment_file"
     "outline-oidc_client_secret_file"
     "outline-smtp_password_file"

modules/nixos/default.nix

@@ -37,8 +37,9 @@
       "dgn-web"
       "django-apps"
       "extranix"
-      "openbao"
       "forgejo-multiuser-nix-runners"
+      "openbao"
+      "systemd-notify"
     ])
     ++ [
       "${sources.agenix}/modules/age.nix"
@@ -52,7 +53,6 @@
         "services/forgejo-nix-runners"
         "services/nginx-sni"
         "services/reaction"
-        "services/systemd-notify"
         "services/victorialogs"
         "services/victoriametrics"
       ]

modules/nixos/dgn-notify/default.nix

@@ -54,19 +54,16 @@ in
     };
 
     services.systemd-notify = {
-      enable = true;
-      command = builtins.toString (
-        pkgs.writeShellScript "sendmail" ''
-          ${pkgs.msmtp}/bin/sendmail -i -t <<ERRMAIL
-          To: admins+monitoring@dgnum.eu, ${emails}
-          Subject: [$HOSTNAME] Systemd failure: $1
-          Content-Transfer-Encoding: 8bit
-          Content-Type: text/plain; charset=UTF-8
+      mail = pkgs.writeShellScript "sendmail" ''
+        ${pkgs.msmtp}/bin/sendmail -i -t <<ERRMAIL
+        To: admins+monitoring@dgnum.eu, ${emails}
+        Subject: [$HOSTNAME] Systemd failure: $1
+        Content-Transfer-Encoding: 8bit
+        Content-Type: text/plain; charset=UTF-8
 
-          $(systemctl status --full "$1")
-          ERRMAIL
-        ''
-      );
+        $(systemctl status --full "$1")
+        ERRMAIL
+      '';
     };
     age-secrets.sources = [ ./. ];
   };

modules/nixos/systemd-notify.nix

@@ -0,0 +1,49 @@
+# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
+#
+# SPDX-License-Identifier: EUPL-1.2
+
+{ config, lib, ... }:
+
+let
+  inherit (lib)
+    getExe
+    mapAttrs'
+    mapAttrsToList
+    mkOption
+    mkForce
+    nameValuePair
+    ;
+  inherit (lib.types) attrsOf package submodule;
+
+  cfg = config.services.systemd-notify;
+in
+
+{
+  options.services.systemd-notify = mkOption {
+    type = attrsOf package;
+    description = ''
+      Commands to execute when a systemd unit fails.
+      Attrs keys will be the unit name and attrs value is the command that
+      will be run with the name of the failed unit as an argument.
+    '';
+    default = { };
+  };
+
+  options.systemd.services = mkOption {
+    type = attrsOf (submodule {
+      config.onFailure = mapAttrsToList (name: _: "${name}@%n.service") cfg;
+    });
+  };
+
+  config.systemd.services = mapAttrs' (
+    name: script:
+    nameValuePair "${name}@" {
+      description = "Run ${name} script on service failures.";
+      onFailure = mkForce [ ]; # Avoid recursive failures
+      serviceConfig = {
+        ExecStart = "${getExe script} %i";
+        Type = "oneshot";
+      };
+    }
+  ) cfg;
+}