fuji: set kern to latest, make boot les verbose, misc tuning

flake.nix

@@ -65,127 +65,87 @@
     }:
     let
       pkgs = nixpkgs.legacyPackages.x86_64-linux.pkgs;
+      inherit (nixpkgs) lib;
+
+      # Build a host's nixosConfiguration from the shared boilerplate.
+      # Per-host differences are expressed as flags / extraModules rather
+      # than copy-pasted module blocks.
+      mkHost =
+        { hostname            # name of the ./<hostname> and ./home/<hostname> dirs
+        , system ? "x86_64-linux"
+        , homeHost ? hostname # which home/<...> config to use (iso reuses nixy)
+        , packages ? true     # import common/packages.nix
+        , suspend ? true      # import common/suspend.nix
+        , hardware ? true     # import <hostname>/hardware-configuration.nix
+        , sops ? true          # wire sops-nix
+        , hm ? true            # wire home-manager
+        , hmBackup ? true     # set home-manager.backupFileExtension
+        , nixosLib ? nixpkgs.lib  # nixosSystem source (iso uses `nixos`)
+        , extraModules ? [ ]
+        }:
+        nixosLib.nixosSystem {
+          inherit system;
+          modules =
+            [
+              { _module.args = inputs; }
+              { _module.args.system = system; }
+              { nix.registry.nixpkgs.flake = nixpkgs; }
+            ]
+            ++ lib.optional packages ./common/packages.nix
+            ++ lib.optional suspend ./common/suspend.nix
+            ++ [ (./. + "/${hostname}/configuration.nix") ]
+            ++ lib.optional hardware (./. + "/${hostname}/hardware-configuration.nix")
+            ++ lib.optional sops sops-nix.nixosModules.sops
+            ++ lib.optionals hm [
+              home-manager.nixosModules.home-manager
+              {
+                home-manager.useGlobalPkgs = true;
+                home-manager.useUserPackages = true;
+                home-manager.users.akill = import (./home + "/${homeHost}/home.nix");
+                home-manager.extraSpecialArgs = { inherit inputs system; };
+              }
+            ]
+            ++ lib.optional (hm && hmBackup) { home-manager.backupFileExtension = "home_backup"; }
+            ++ extraModules;
+        };
     in
     {
       nixosConfigurations = {
-        nixy = nixpkgs.lib.nixosSystem rec {
+        nixy = mkHost { hostname = "nixy"; };
-          system = "x86_64-linux";
-          modules = [
-            { _module.args = inputs; }
-            { _module.args.system = system; }
-            { nix.registry.nixpkgs.flake = nixpkgs; }
-            ./common/packages.nix
-            ./common/suspend.nix
-            ./nixy/configuration.nix
-            ./nixy/hardware-configuration.nix
-            sops-nix.nixosModules.sops
-            home-manager.nixosModules.home-manager
-            {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users.akill = import ./home/nixy/home.nix;
-              home-manager.extraSpecialArgs = { inherit inputs system; };
-              home-manager.backupFileExtension = "home_backup";
-            }
-          ];
-        };
 
-        fuji = nixpkgs.lib.nixosSystem rec {
+        fuji = mkHost { hostname = "fuji"; };
-          system = "x86_64-linux";
-          modules = [
-            { _module.args = inputs; }
-            { _module.args.system = system; }
-            { nix.registry.nixpkgs.flake = nixpkgs; }
-            ./common/packages.nix
-            ./common/suspend.nix
-            ./fuji/configuration.nix
-            ./fuji/hardware-configuration.nix
-            sops-nix.nixosModules.sops
-            home-manager.nixosModules.home-manager
-            {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users.akill = import ./home/fuji/home.nix;
-              home-manager.extraSpecialArgs = { inherit inputs system; };
-              home-manager.backupFileExtension = "home_backup";
-            }
-          ];
-        };
 
-        nixy_iso = nixos.lib.nixosSystem rec {
+        nixy_iso = mkHost {
-          system = "x86_64-linux";
+          hostname = "nixy";
-          modules = [
+          hardware = false;
-            { _module.args = inputs; }
+          nixosLib = nixos.lib;
-            { _module.args.system = system; }
+          extraModules = [
-            { nix.registry.nixpkgs.flake = nixpkgs; }
             { isoImage.squashfsCompression = "gzip -Xcompression-level 1"; }
-            ./common/packages.nix
-            ./common/suspend.nix
-            ./nixy/configuration.nix
             "${nixos}/nixos/modules/installer/cd-dvd/installation-cd-minimal-new-kernel-no-zfs.nix"
-            sops-nix.nixosModules.sops
-            home-manager.nixosModules.home-manager
-            {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users.akill = import ./home/nixy/home.nix;
-              home-manager.extraSpecialArgs = { inherit inputs system; };
-              home-manager.backupFileExtension = "home_backup";
-            }
           ];
         };
 
-        mediabox = nixpkgs.lib.nixosSystem rec {
+        mediabox = mkHost {
-          system = "x86_64-linux";
+          hostname = "mediabox";
-          modules = [
+          hmBackup = false;
-            { _module.args = inputs; }
+          extraModules = [ ./modules/qbittorrent.nix ];
-            { _module.args.system = system; }
-            { nix.registry.nixpkgs.flake = nixpkgs; }
-            ./common/packages.nix
-            ./common/suspend.nix
-            ./mediabox/configuration.nix
-            ./mediabox/hardware-configuration.nix
-            ./modules/qbittorrent.nix
-            sops-nix.nixosModules.sops
-            home-manager.nixosModules.home-manager
-            {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users.akill = import ./home/mediabox/home.nix;
-              home-manager.extraSpecialArgs = { inherit inputs system; };
-            }
-          ];
         };
 
-        blue = nixpkgs.lib.nixosSystem rec {
+        blue = mkHost {
-          system = "x86_64-linux";
+          hostname = "blue";
-          modules = [
+          suspend = false;
-            { _module.args = inputs; }
+          sops = false;
-            { _module.args.system = system; }
+          hmBackup = false;
-            { nix.registry.nixpkgs.flake = nixpkgs; }
-            ./blue/configuration.nix
-            ./blue/hardware-configuration.nix
-            ./common/packages.nix
-            home-manager.nixosModules.home-manager
-            {
-              home-manager.useGlobalPkgs = true;
-              home-manager.useUserPackages = true;
-              home-manager.users.akill = import ./home/blue/home.nix;
-              home-manager.extraSpecialArgs = { inherit inputs system; };
-            }
-          ];
         };
 
-        magpie = nixpkgs.lib.nixosSystem rec {
+        magpie = mkHost {
+          hostname = "magpie";
           system = "aarch64-linux";
-          modules = [
+          packages = false;
-            { _module.args = inputs; }
+          suspend = false;
-            { _module.args.system = system; }
+          hm = false;
-            { nix.registry.nixpkgs.flake = nixpkgs; }
+          extraModules = [
-            ./magpie/configuration.nix
-            ./magpie/hardware-configuration.nix
             simple-nixos-mailserver.nixosModule
-            sops-nix.nixosModules.sops
             (builtins.toPath "${nixpkgs}/nixos/modules/profiles/qemu-guest.nix")
           ];
         };

fuji/configuration.nix

@@ -10,7 +10,7 @@ let
   USER = "akill";
 in
 {
-  imports = [ ];
+  imports = [ ./wireguard.nix ];
 
   system = {
     stateVersion = "23.05";
@@ -29,22 +29,6 @@ in
         group = config.users.users.nobody.group;
       };
 
-      "wg_privkey" = {
-        sopsFile = ./secrets/wg_privkey.yaml;
-      };
-
-      "wg_preshared/nixy" = {
-        sopsFile = ../common/secrets/wg_preshared.yaml;
-      };
-
-      "wg_privkey_proton" = {
-        sopsFile = ./secrets/wg_privkey_proton.yaml;
-      };
-
-      "wg_endpoint_proton" = {
-        sopsFile = ./secrets/wg_privkey_proton.yaml;
-      };
-
       "borgbase_enc_key" = {
         sopsFile = ./secrets/borgbase_enc_key.yaml;
         owner = config.users.users.${USER}.name;
@@ -58,6 +42,8 @@ in
   };
 
   nix = {
+    daemonCPUSchedPolicy = "idle";
+    daemonIOSchedClass = "idle";
     optimise.automatic = true;
     gc.automatic = true;
     gc.options = "--delete-older-than 7d";
@@ -81,9 +67,15 @@ in
     '';
     blacklistedKernelModules = [ ];
 
+    consoleLogLevel = 3;
     initrd.compressor = "zstd";
+    initrd.verbose = false;
     initrd.kernelModules = [ ];
     initrd.systemd.enable = true;
+    initrd.luks.devices."cryptroot" = {
+      allowDiscards = true;
+      bypassWorkqueues = true;
+    };
     binfmt.emulatedSystems = [
       "wasm32-wasi"
       "x86_64-windows"
@@ -91,8 +83,10 @@ in
     kernelParams = [
       "xe.force_probe=a7a0"
       "i915.force_probe=!a7a0"
+      "quiet"
+      "udev.log_level=3"
     ];
-    #kernelPackages = pkgs.linuxPackages_latest;
+    kernelPackages = pkgs.linuxPackages_latest;
     kernel.sysctl = {
       "net.core.default_qdisc" = "fq";
       "net.ipv4.tcp_congestion_control" = "bbr";
@@ -110,12 +104,18 @@ in
       "net.ipv4.conf.default.send_redirects" = 0;
       "net.ipv6.conf.all.accept_redirects" = 0;
       "net.ipv6.conf.default.accept_redirects" = 0;
+      # zram tuning (recommended by upstream zram docs)
+      "vm.swappiness" = 180;
+      "vm.page-cluster" = 0;
+      "vm.watermark_boost_factor" = 0;
+      "vm.watermark_scale_factor" = 125;
     };
     loader.efi.canTouchEfiVariables = true;
     loader.systemd-boot = {
       editor = false;
       enable = true;
       memtest86.enable = true;
+      configurationLimit = 10;
     };
     nixStoreMountOpts = [ "ro" ];
     supportedFilesystems = [
@@ -193,21 +193,6 @@ in
       };
     };
 
-    wireguard.interfaces = {
-      wg0 = {
-        ips = [ "10.100.0.6/24" ];
-        privateKeyFile = config.sops.secrets."wg_privkey".path;
-        peers = [
-          {
-            publicKey = builtins.readFile ../magpie/wg_pubkey;
-            presharedKeyFile = config.sops.secrets."wg_preshared/nixy".path;
-            allowedIPs = [ "10.100.0.0/24" ];
-            endpoint = "5.75.229.224:51820";
-            persistentKeepalive = 25;
-          }
-        ];
-      };
-    };
   };
 
   time.timeZone = "Europe/Sarajevo";
@@ -279,6 +264,11 @@ in
     sway.enable = true;
   };
 
+  xdg.portal = {
+    enable = true;
+    wlr.enable = true;
+  };
+
   documentation.dev.enable = true;
 
   systemd = {
@@ -305,103 +295,6 @@ in
         };
       };
 
-      "netns@" = {
-        description = "%I network namespace";
-        before = [ "network.target" ];
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
-          ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
-        };
-      };
-
-      "wg_proton" = {
-        description = "wg network interface";
-        bindsTo = [ "netns@wg.service" ];
-        requires = [ "network-online.target" ];
-        wants = [ "dnscrypt-proxy_proton.service" ];
-        after = [ "netns@wg.service" ];
-        before = [ "dnscrypt-proxy_proton.service" ];
-        serviceConfig = {
-          Type = "oneshot";
-          RemainAfterExit = true;
-          ExecStart = pkgs.writers.writeBash "wg-up" ''
-            set -e
-            ENDPOINT_IP=$(${pkgs.coreutils-full}/bin/cat "${config.sops.secrets."wg_endpoint_proton".path}")
-            ${pkgs.iproute2}/bin/ip link add proton_wg type wireguard
-            ${pkgs.iproute2}/bin/ip link set proton_wg netns wg
-            ${pkgs.iproute2}/bin/ip -n wg address add 10.2.0.2/32 dev proton_wg
-            ${pkgs.iproute2}/bin/ip netns exec wg \
-              ${pkgs.wireguard-tools}/bin/wg set "proton_wg" private-key "${
-                config.sops.secrets."wg_privkey_proton".path
-              }"
-            ${pkgs.iproute2}/bin/ip netns exec wg \
-              ${pkgs.wireguard-tools}/bin/wg set "proton_wg" peer "g6DkXWKI/68RsLjROIwCEcyB/ZhyK5Q7OWcz1TtqER0=" \
-                endpoint "$ENDPOINT_IP:51820" \
-                persistent-keepalive "25" \
-                allowed-ips "0.0.0.0/0"
-            ${pkgs.iproute2}/bin/ip -n wg link set lo up
-            ${pkgs.iproute2}/bin/ip -n wg link set proton_wg up
-            ${pkgs.iproute2}/bin/ip -n wg route add default dev proton_wg
-          '';
-          ExecStop = pkgs.writers.writeBash "wg-down" ''
-            ${pkgs.iproute2}/bin/ip -n wg route del default dev proton_wg
-            ${pkgs.iproute2}/bin/ip -n wg link del proton_wg
-          '';
-        };
-      };
-
-      "dnscrypt-proxy_proton" = {
-        description = "DNSCrypt-proxy client proton";
-        wants = [
-          "network-online.target"
-          "nss-lookup.target"
-        ];
-        before = [ "nss-lookup.target" ];
-        after = [ "wg_proton.service" ];
-        partOf = [ "wg_proton.service" ];
-        serviceConfig = {
-          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
-          CacheDirectory = "dnscrypt-proxy";
-          DynamicUser = true;
-          ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy -config ${config.services.dnscrypt-proxy.configFile}";
-          LockPersonality = true;
-          LogsDirectory = "dnscrypt-proxy";
-          MemoryDenyWriteExecute = true;
-          NetworkNamespacePath = "/var/run/netns/wg";
-          NonBlocking = true;
-          NoNewPrivileges = true;
-          PrivateDevices = true;
-          ProtectClock = true;
-          ProtectControlGroups = true;
-          ProtectHome = true;
-          ProtectHostname = true;
-          ProtectKernelLogs = true;
-          ProtectKernelModules = true;
-          ProtectKernelTunables = true;
-          ProtectSystem = "strict";
-          Restart = "always";
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-          ];
-          RestrictNamespaces = true;
-          RestrictRealtime = true;
-          RuntimeDirectory = "dnscrypt-proxy";
-          StateDirectory = "dnscrypt-proxy";
-          SystemCallArchitectures = "native";
-          SystemCallFilter = [
-            "@system-service"
-            "@chown"
-            "~@aio"
-            "~@keyring"
-            "~@memlock"
-            "~@setuid"
-            "~@timer"
-          ];
-        };
-      };
     };
 
     coredump.enable = false;
@@ -418,12 +311,17 @@ in
     envfs.enable = true;
     fstrim.enable = true;
     fwupd.enable = true;
+    journald.storage = "volatile";
     ntp.enable = true;
     openssh.enable = true;
     power-profiles-daemon.enable = false;
     printing.enable = true;
-    userborn.enable = true;
+    scx = {
+      enable = true;
+      scheduler = "scx_lavd";
+    };
     upower.enable = lib.mkForce false;
+    userborn.enable = true;
 
     greetd = {
       enable = true;

fuji/wireguard.nix

@@ -0,0 +1,149 @@
+{ config
+, pkgs
+, lib
+, ...
+}:
+{
+  sops.secrets = {
+    "wg_privkey" = {
+      sopsFile = ./secrets/wg_privkey.yaml;
+    };
+
+    "wg_preshared/nixy" = {
+      sopsFile = ../common/secrets/wg_preshared.yaml;
+    };
+
+    "wg_privkey_proton" = {
+      sopsFile = ./secrets/wg_privkey_proton.yaml;
+    };
+
+    "wg_endpoint_proton" = {
+      sopsFile = ./secrets/wg_privkey_proton.yaml;
+    };
+  };
+
+  # Personal mesh: dials into the magpie hub (10.100.0.0/24)
+  networking.wireguard.interfaces = {
+    wg0 = {
+      ips = [ "10.100.0.6/24" ];
+      privateKeyFile = config.sops.secrets."wg_privkey".path;
+      peers = [
+        {
+          publicKey = builtins.readFile ../magpie/wg_pubkey;
+          presharedKeyFile = config.sops.secrets."wg_preshared/nixy".path;
+          allowedIPs = [ "10.100.0.0/24" ];
+          endpoint = "5.75.229.224:51820";
+          persistentKeepalive = 25;
+        }
+      ];
+    };
+  };
+
+  systemd = {
+    services = {
+      # ProtonVPN split tunnel: proton_wg lives inside the `wg` network
+      # namespace; anything that should egress over Proton is launched
+      # with `ip netns exec wg ...`.
+      "netns@" = {
+        description = "%I network namespace";
+        before = [ "network.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = "${pkgs.iproute2}/bin/ip netns add %I";
+          ExecStop = "${pkgs.iproute2}/bin/ip netns del %I";
+        };
+      };
+
+      "wg_proton" = {
+        description = "wg network interface";
+        bindsTo = [ "netns@wg.service" ];
+        requires = [ "network-online.target" ];
+        wants = [ "dnscrypt-proxy_proton.service" ];
+        after = [ "netns@wg.service" ];
+        before = [ "dnscrypt-proxy_proton.service" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = pkgs.writers.writeBash "wg-up" ''
+            set -e
+            ENDPOINT_IP=$(${pkgs.coreutils-full}/bin/cat "${config.sops.secrets."wg_endpoint_proton".path}")
+            ${pkgs.iproute2}/bin/ip link add proton_wg type wireguard
+            ${pkgs.iproute2}/bin/ip link set proton_wg netns wg
+            ${pkgs.iproute2}/bin/ip -n wg address add 10.2.0.2/32 dev proton_wg
+            ${pkgs.iproute2}/bin/ip netns exec wg \
+              ${pkgs.wireguard-tools}/bin/wg set "proton_wg" private-key "${
+                config.sops.secrets."wg_privkey_proton".path
+              }"
+            ${pkgs.iproute2}/bin/ip netns exec wg \
+              ${pkgs.wireguard-tools}/bin/wg set "proton_wg" peer "${lib.fileContents ../common/wg_pubkey_proton}" \
+                endpoint "$ENDPOINT_IP:51820" \
+                persistent-keepalive "25" \
+                allowed-ips "0.0.0.0/0"
+            ${pkgs.iproute2}/bin/ip -n wg link set lo up
+            ${pkgs.iproute2}/bin/ip -n wg link set proton_wg up
+            ${pkgs.iproute2}/bin/ip -n wg route add default dev proton_wg
+          '';
+          ExecStop = pkgs.writers.writeBash "wg-down" ''
+            ${pkgs.iproute2}/bin/ip -n wg route del default dev proton_wg
+            ${pkgs.iproute2}/bin/ip -n wg link del proton_wg
+          '';
+        };
+      };
+
+      "dnscrypt-proxy_proton" = {
+        description = "DNSCrypt-proxy client proton";
+        wants = [
+          "network-online.target"
+          "nss-lookup.target"
+        ];
+        before = [ "nss-lookup.target" ];
+        after = [ "wg_proton.service" ];
+        partOf = [ "wg_proton.service" ];
+        serviceConfig = {
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+          CacheDirectory = "dnscrypt-proxy";
+          DynamicUser = true;
+          ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy -config ${config.services.dnscrypt-proxy.configFile}";
+          LockPersonality = true;
+          LogsDirectory = "dnscrypt-proxy";
+          MemoryDenyWriteExecute = true;
+          NetworkNamespacePath = "/var/run/netns/wg";
+          NonBlocking = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectSystem = "strict";
+          Restart = "always";
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RuntimeDirectory = "dnscrypt-proxy";
+          StateDirectory = "dnscrypt-proxy";
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "@chown"
+            "~@aio"
+            "~@keyring"
+            "~@memlock"
+            "~@setuid"
+            "~@timer"
+          ];
+        };
+      };
+    };
+
+    # Don't bring wg0 up at boot
+    targets."wireguard-wg0".wantedBy = lib.mkForce [ ];
+  };
+}

home/common/sway.nix

@@ -96,6 +96,7 @@ in
       bars = [ ];
       startup = [
         { command = "exec ${quickshell_bar}/bin/quickshell-bar"; }
+        { command = "swaymsg 'workspace 1; layout tabbed'"; }
       ];
 
       keybindings = {

home/common/zsh.nix

@@ -17,7 +17,7 @@
 
   programs.zsh = {
     autocd = true;
-    enableCompletion = true;
+    enableCompletion = false;
     defaultKeymap = "viins";
     dotDir = config.home.homeDirectory;
 
@@ -116,6 +116,13 @@
         RPS1="{{$BUBBLEWRAP_DIR}}"
       fi
 
+      autoload -Uz compinit
+      if [[ -n $(print -r -- ~/.zcompdump(Nmh-24)) ]]; then
+        compinit -C
+      else
+        compinit
+      fi
+
       # Recompile .zcompdump if stale
       if [[ -f ~/.zcompdump && ( ! -f ~/.zcompdump.zwc || ~/.zcompdump -nt ~/.zcompdump.zwc ) ]]; then
         zcompile ~/.zcompdump

home/fuji/home.nix

@@ -43,8 +43,8 @@ in
   };
   qt = {
     enable = true;
-    style.name = "adwaita-dark";
+    style.name = "breeze";
-    platformTheme.name = "gtk";
+    platformTheme.name = "kde6";
   };
 
   fonts.fontconfig.enable = true;
@@ -182,12 +182,12 @@ in
       };
 
       settings = {
-        # Workaround for QtWebEngine screen flicker/flash on Wayland+Intel
         qt.args = [
-          "disable-gpu-compositing"
+          "ignore-gpu-blocklist"
-          "enable-features=VaapiVideoDecoder,VaapiVideoEncoder"
+          "disable-gpu-memory-buffer-video-frames=false"
+          "enable-features=VaapiIgnoreDriverChecks,VaapiVideoDecoder,AcceleratedVideoDecoder,AcceleratedVideoDecodeLinuxGL,AcceleratedVideoEncoder,Vulkan,DefaultANGLEVulkan,VulkanFromANGLE,FluentOverlayScrollbar,MiddleClickAutoscroll"
         ];
-        colors.webpage.preferred_color_scheme = "dark";
+
         content.notifications.enabled = false;
         content.pdfjs = true;
         content.webgl = false;
@@ -209,6 +209,9 @@ in
         tabs.width = "12%";
         zoom.default = "125%";
       };
+      extraConfig = ''
+        c.qt.environ = {"QTWEBENGINE_FORCE_USE_GBM": "0"}
+      '';
     };
 
     git = {
@@ -285,11 +288,6 @@ in
             ${pkgs.coreutils}/bin/rm $ALL_IMGS
         '';
       in
-        /*
-        refresh_i3status = pkgs.writeShellScriptBin "refresh_i3status" ''
-          ${pkgs.coreutils}/bin/sleep 1 && ${pkgs.procps}/bin/pkill -USR1 i3status-rs
-        '';
-        */
       {
         enable = true;
         events = {

home/fuji/home_packages.nix

@@ -98,6 +98,7 @@ in
       kdePackages.kdegraphics-thumbnailers
       kdePackages.kdenlive
       kdePackages.okular
+      kdePackages.yakuake
       kicad
       kodi-wayland
       komikku

magpie/configuration.nix

@@ -195,6 +195,27 @@
     };
   };
 
+  services.inventree = {
+    enable = true;
+    domain = "inventree.project-cloud.net";
+    adminPasswordFile = config.sops.secrets."inventree_admin_pw".path;
+    database.createLocally = true; # local postgresql db + user
+    settings = {
+      INVENTREE_SITE_URL = "https://inventree.project-cloud.net";
+      INVENTREE_DEBUG = "False";
+    };
+  };
+
+  services.part-db = {
+    enable = true;
+    virtualHost = "parts.project-cloud.net";
+    enableNginx = true;
+    enablePostgresql = true;
+    settings = {
+      DEFAULT_URL = "https://parts.project-cloud.net";
+    };
+  };
+
   services.nginx = {
     enable = true;
     recommendedGzipSettings = true;
@@ -241,6 +262,20 @@
 
     virtualHosts.${config.mailserver.fqdn}.enableACME = true;
 
+    virtualHosts."inventree.project-cloud.net" = {
+      quic = true;
+      http3 = true;
+      forceSSL = true;
+      enableACME = true;
+    };
+
+    virtualHosts."parts.project-cloud.net" = {
+      quic = true;
+      http3 = true;
+      forceSSL = true;
+      enableACME = true;
+    };
+
     virtualHosts."stats.project-cloud.net" = {
       quic = true;
       http3 = true;
@@ -328,6 +363,8 @@
     RestrictAddressFamilies = [ "AF_NETLINK" ];
     ProtectSystem = lib.mkForce false;
   };
+  systemd.services.part-db-migrate.environment.LD_PRELOAD = lib.mkForce "";
+  systemd.services.phpfpm-part-db.environment.LD_PRELOAD = lib.mkForce "";
 
   security.acme = {
     acceptTerms = true;
@@ -336,10 +373,20 @@
 
   security.sudo.execWheelOnly = true;
 
-  environment.memoryAllocator.provider = "jemalloc";
+  #environment.memoryAllocator.provider = "jemalloc";
 
   systemd.coredump.enable = false;
 
+  # The upstream part-db module points APP_SHARE_DIR at /var/lib/part-db/share
+  # (where Symfony writes its cache pools) but never creates it, so every cache
+  # write fails and pages fall into a recompute storm that eventually 502s.
+  systemd.tmpfiles.settings."part-db-share"."/var/lib/part-db/share".d = {
+    mode = "0750";
+    user = "part-db";
+    group = "part-db";
+  };
+
+
   sops = {
     age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
     secrets = {
@@ -347,6 +394,10 @@
       "borgbase_enc_key".sopsFile = ./secrets/borgbase_enc_key.yaml;
       "borgbase_ssh_key".sopsFile = ./secrets/borgbase_ssh_key.yaml;
       "gitea_mail_pw_hash".sopsFile = ./secrets/gitea_mail_pw_hash.yaml;
+      "inventree_admin_pw" = {
+        sopsFile = ./secrets/inventree_admin_pw.yaml;
+        owner = config.users.users.inventree.name;
+      };
       "miniflux_env".sopsFile = ./secrets/miniflux.yaml;
       "wg_preshared/nixy".sopsFile = ../common/secrets/wg_preshared.yaml;
       "wg_preshared/workstation".sopsFile = ../common/secrets/wg_preshared.yaml;

magpie/secrets/inventree_admin_pw.yaml

@@ -0,0 +1,25 @@
+inventree_admin_pw: ENC[AES256_GCM,data:HWjIhHhzLyBxvRdZm2VMANf49qu29n3A,iv:UGvzypdH6RFzBqNG3XRewlszCFhRciZAl1LLkBPtuzU=,tag:poBopBDDkfcLF2iM9z8DjQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvYytXMlgzTUtxcm5LcXJ3
+            VURETHIvRTlIaWx6eVhoRFlhdGl5UGRGYVNjClM4UzRKMFRnNzljK0t6emZOYXJt
+            RkJiYlBPNTRTaEgrMVVkb0xZWFlYRGsKLS0tIGxRZ2UyaDE2Ly9CVUF3Q1JMWGJV
+            eUNDZ0JsRUdUcHJqNTBNVkFjaGZnK3cKgy79yyoUOI34Ixdy2v0tG510LD300GoE
+            JgpJnem9BQiDJmu6+hrJJRKhVONrnZwkOj3GRz1TQX9fglo956rLPg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age153y8mz6gqy5t54q4fnrdvjj4v5ls9cgp3hhpd2hzf5tvkcnncf6q4xns0j
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhRVdwam1jaFYvTGpFeGpx
+            b0FMcVNoMDRKWldDUk9PZmdkQ1pEZUJzVWxNCnhmeis4RENCT1hYcVFYV0R5eGlD
+            WVg5R3RFR0VvZ1VrbW5qTVBSd0VwQUkKLS0tIDJUYURneDE2UFpvQzJ0alZPbit4
+            Q29UTFQvQVdRTUxFS3VsbXVuVUhMOTQKxPuwQc5w0sgJ1/pU1aOOZt7tZRO0mSAo
+            XqDN732B0N9vjIG/3bVg+EBpgP4+1OQ5z+06zg9lhyAq6DwS1GXQnA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1geqqmsnng2e9sja6uxxmtlwlm4c6e5v6ch3l3yjenstq6tjq4fusr0305s
+    lastmodified: "2026-06-16T20:36:07Z"
+    mac: ENC[AES256_GCM,data:4/psCipXWIN9PoGK/ueemgPKzgcFxaeQy4tXZ3nXCStvvBxisyF+l9tf4wM/F25CzPezPQtTex2jqFDreVnznO3ksX6T9PD7lssOqH0wM0PuhNzs8/93CPyJYaRr3OgtVGdu7k0SlGuWH1Dv8QNsEacCSLL3aaHNgFDwdA53Jng=,iv:+N2bk73kjZjHztDGB37dWZUVIw7UxGNK2Nd9vx5+0eA=,tag:KoYWRJ+LYCJK3oJVuJVcQA==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.1