This repository has no description
flake.lock: update
author
lassulus
date
(Jul 29, 2026, 10:10 AM CEST)
commit
c50421d1
c50421d1d1094839c89c8a1c235be4edb8657f14
parent
753df966
753df966a7dcab031135ee21b13418a3f30556cd
+159
-26
+26
-26
flake.lock
+26
-26
flake.lock
···
66
66
"treefmt-nix": "treefmt-nix"
67
67
},
68
68
"locked": {
69
-
"lastModified": 1785164739,
70
-
"narHash": "sha256-gnUgb9zinrp8qzDo0H0NCJo3gz+xKwPhN9VKT8VpJz4=",
69
+
"lastModified": 1785269027,
70
+
"narHash": "sha256-8fXnTOcaRxALWV6hYZkQsHUKdwjp5hZ+5f53FuCtvbg=",
71
71
"ref": "refs/heads/main",
72
-
"rev": "3d5e36241c6694f84b17b1f3cbd23caf4fb4fe81",
73
-
"revCount": 14930,
72
+
"rev": "b93f5fd95b1326fd0649dba8d320172de6ba2c48",
73
+
"revCount": 14947,
74
74
"type": "git",
75
75
"url": "https://git.clan.lol/clan/clan-core"
76
76
},
···
119
119
]
120
120
},
121
121
"locked": {
122
-
"lastModified": 1785129133,
123
-
"narHash": "sha256-u8/FbuNgd2qIFEQGV9/lbR3CmYSinpaDXn8N2lXqnA4=",
124
-
"rev": "f0fbe70e13c97136d3072af3c49042a0eeaca362",
122
+
"lastModified": 1785164666,
123
+
"narHash": "sha256-iEEjCFvjxcXX7BYUBgdrr1BV22wqZ5Sz3odW9nwx28g=",
124
+
"rev": "4968c89809a66fac8c8e419d30835b82a23aadda",
125
125
"type": "tarball",
126
-
"url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/f0fbe70e13c97136d3072af3c49042a0eeaca362.tar.gz"
126
+
"url": "https://git.clan.lol/api/v1/repos/clan/data-mesher/archive/4968c89809a66fac8c8e419d30835b82a23aadda.tar.gz"
127
127
},
128
128
"original": {
129
129
"type": "tarball",
···
401
401
"uv2nix": "uv2nix"
402
402
},
403
403
"locked": {
404
-
"lastModified": 1785168757,
405
-
"narHash": "sha256-1KVG3QH8dyI0y4AhJHCCjt4bTD42PCOLyZ+9rOtq0bM=",
404
+
"lastModified": 1785309650,
405
+
"narHash": "sha256-cGhtueeGs88BuS39+me0eQtEa809v+yDBm+frkkRsYM=",
406
406
"owner": "nousresearch",
407
407
"repo": "hermes-agent",
408
-
"rev": "2b0fb72acae67f51652de5c51db556bc15a68f0e",
408
+
"rev": "cbecd72e976a59e4c4b8277086abaa59ab3dc510",
409
409
"type": "github"
410
410
},
411
411
"original": {
···
447
447
"treefmt-nix": "treefmt-nix_3"
448
448
},
449
449
"locked": {
450
-
"lastModified": 1785145739,
451
-
"narHash": "sha256-qX/t+D9uVsMw32Za6oXcgXWn6d2HGZqEzMlZWnVQ4GM=",
450
+
"lastModified": 1785310375,
451
+
"narHash": "sha256-Sr9wUAR42LhIwz+YZrdEol6nvx44lTJHnI8M3On+LDQ=",
452
452
"owner": "numtide",
453
453
"repo": "llm-agents.nix",
454
-
"rev": "259abb89d0a0d3ba685987053ad344534a5d6600",
454
+
"rev": "7857ba4ead57db64c35f3cbd1c704862b5e719e8",
455
455
"type": "github"
456
456
},
457
457
"original": {
···
494
494
]
495
495
},
496
496
"locked": {
497
-
"lastModified": 1781761792,
498
-
"narHash": "sha256-rCPytmKNjctLloB6UgK5CRrHSwV4b0ygxtJLPPp8R14=",
497
+
"lastModified": 1784500460,
498
+
"narHash": "sha256-UvORnAxTRHax7RG74W8Z2t4GvIkX6AjJ5kk0QlwZomo=",
499
499
"owner": "nix-darwin",
500
500
"repo": "nix-darwin",
501
-
"rev": "a1fa429e945becaf60468600daf649be4ba0350c",
501
+
"rev": "57a3171f94705599a2499248ca5758d5eb47c0e0",
502
502
"type": "github"
503
503
},
504
504
"original": {
···
622
622
"nixpkgs": "nixpkgs"
623
623
},
624
624
"locked": {
625
-
"lastModified": 1784723954,
626
-
"narHash": "sha256-1CfD8ZUjCkTgjsneLZ/lxCHhgDfqxxE7/GX0MmsgiqA=",
625
+
"lastModified": 1785232496,
626
+
"narHash": "sha256-65EQYIRRpTdpH8lUiB6Mvo5uBkG60aBIzAJuALfx+O0=",
627
627
"owner": "nixos",
628
628
"repo": "nixos-hardware",
629
-
"rev": "a017f5b72210026af5b3ac5949f08d94380a6fbd",
629
+
"rev": "2e790b0a6be8ec2b76174ac0931b8ff11919ec98",
630
630
"type": "github"
631
631
},
632
632
"original": {
···
645
645
]
646
646
},
647
647
"locked": {
648
-
"lastModified": 1784545776,
649
-
"narHash": "sha256-aU4ftMXSp6Y4Q5iKzSoJdUQcVP5UA4aDQp2DalAJNJE=",
648
+
"lastModified": 1785242276,
649
+
"narHash": "sha256-sJI/6nAkckPii1HUCNj4XwPV6E7CZ9t75WX/XQvSyG8=",
650
650
"owner": "simple-nixos-mailserver",
651
651
"repo": "nixos-mailserver",
652
-
"rev": "a0e427dd77c7d985394bab609c1bc0bbd4d6dd1f",
652
+
"rev": "d4165c1dc93aa7bb3019e5a90960c121e228cad5",
653
653
"type": "gitlab"
654
654
},
655
655
"original": {
···
1168
1168
]
1169
1169
},
1170
1170
"locked": {
1171
-
"lastModified": 1784703227,
1172
-
"narHash": "sha256-zIZ8BIL+azvCabKak9GeZ1SZmjTq0f10bXmOY3GG/JI=",
1171
+
"lastModified": 1785177581,
1172
+
"narHash": "sha256-9Z4l080DSrHMxoQTZTpVsML2h6JDuB9lDwHPsLd9BrQ=",
1173
1173
"owner": "lassulus",
1174
1174
"repo": "wrappers",
1175
-
"rev": "090771334cbc7bb5fee07045328e49054151ea80",
1175
+
"rev": "f57bc81aa9669871343341b13aa175c8927b6a74",
1176
1176
"type": "github"
1177
1177
},
1178
1178
"original": {
+130
2configs/iroh-relay/default.nix
+130
2configs/iroh-relay/default.nix
···
1
+
let
2
+
domain = "relay.lassul.us";
3
+
# Plain HTTP/WS on loopback only; nginx terminates TLS in front of it.
4
+
httpPort = 3340;
5
+
# QUIC address discovery. Public UDP, and the one part nginx cannot proxy,
6
+
# so the relay reads the ACME cert itself. 7842 is iroh's
7
+
# DEFAULT_RELAY_QUIC_PORT -- clients derive it from the relay url and expect
8
+
# it there, so do not move it without telling every client.
9
+
quicPort = 7842;
10
+
certGroup = "irohrelaycert";
11
+
12
+
configFile = (
13
+
pkgs:
14
+
pkgs.writeText "iroh-relay.toml" ''
15
+
enable_relay = true
16
+
http_bind_addr = "127.0.0.1:${toString httpPort}"
17
+
18
+
# The whole reason to run our own relay: QAD tells an endpoint its own NAT
19
+
# mapping, which is what makes hole punching work. Without it this is just
20
+
# a data relay and peers never upgrade to direct. Requires TLS.
21
+
enable_quic_addr_discovery = true
22
+
23
+
enable_metrics = true
24
+
metrics_bind_addr = "127.0.0.1:9096"
25
+
26
+
[tls]
27
+
hostname = "${domain}"
28
+
quic_bind_addr = "[::]:${toString quicPort}"
29
+
30
+
# `Reloading` re-reads the cert from disk periodically, so ACME renewals are
31
+
# picked up without a restart. `LetsEncrypt` is not usable here: it wants to
32
+
# own port 80 for the challenge, which nginx already has.
33
+
cert_mode = "Reloading"
34
+
manual_cert_path = "/var/lib/acme/${domain}/fullchain.pem"
35
+
manual_key_path = "/var/lib/acme/${domain}/key.pem"
36
+
37
+
# Serve the relay's HTTP/WS side as plain HTTP so nginx can reverse-proxy
38
+
# it; the cert above is then used only by the QUIC listener. "dangerous"
39
+
# overstates it here: the plaintext hop is loopback, nginx does real TLS on
40
+
# 443, and relayed payloads are already end-to-end encrypted between iroh
41
+
# endpoints -- the relay only ever sees ciphertext.
42
+
dangerous_http_only = true
43
+
''
44
+
);
45
+
in
46
+
{
47
+
pkgs,
48
+
...
49
+
}:
50
+
{
51
+
# Self-hosted iroh relay.
52
+
#
53
+
# A relay supplies the two things a relay-free iroh endpoint cannot get for
54
+
# itself: QUIC address discovery (learning its own NAT mapping) and a
55
+
# signalling path to coordinate hole punching. Measured from a double-NATed
56
+
# host, relayed configs hole-punched to direct in ~80ms with 0 failures over
57
+
# 30 runs, while the relay-free config failed 100% of the time.
58
+
#
59
+
# Running our own also fixes the throughput floor: n0's public relays
60
+
# rate-limit to ~0.9 Mbps, which is fine for keystrokes and miserable for
61
+
# anything larger when hole punching fails.
62
+
#
63
+
# Clients opt in with `RelayMode::Custom`, e.g.
64
+
# iroh-bench --config dht-selfrelay --relay-url https://relay.lassul.us
65
+
# dumbpipe listen-tcp --relay-url https://relay.lassul.us (patched build)
66
+
67
+
# nginx owns 80/443 and the ACME challenge, so it fetches the cert and the
68
+
# relay only reads it. A dedicated group keeps that read as narrow as
69
+
# possible; nginx must be a member to serve the vhost. Same pattern as
70
+
# mailserver.nix's `lasscert`.
71
+
security.acme.certs.${domain}.group = certGroup;
72
+
users.groups.${certGroup}.members = [ "nginx" ];
73
+
74
+
services.nginx.virtualHosts.${domain} = {
75
+
enableACME = true;
76
+
forceSSL = true;
77
+
# One location covers every route the relay serves: `/relay` (the websocket
78
+
# clients ride), `/ping` and `/generate_204` (net_report latency probes,
79
+
# which is how a client picks its nearest relay out of a map).
80
+
locations."/" = {
81
+
proxyPass = "http://127.0.0.1:${toString httpPort}";
82
+
proxyWebsockets = true;
83
+
# Relay connections are long-lived and idle whenever a pair has upgraded
84
+
# to a direct path; nginx's default 60s read timeout would tear them down
85
+
# and force clients back through a reconnect.
86
+
extraConfig = ''
87
+
proxy_read_timeout 1d;
88
+
proxy_send_timeout 1d;
89
+
'';
90
+
};
91
+
};
92
+
93
+
systemd.services.iroh-relay = {
94
+
description = "iroh relay (${domain})";
95
+
wantedBy = [ "multi-user.target" ];
96
+
after = [
97
+
"network-online.target"
98
+
"nginx.service"
99
+
];
100
+
wants = [ "network-online.target" ];
101
+
102
+
serviceConfig = {
103
+
ExecStart = "${pkgs.iroh-relay}/bin/iroh-relay --config-path ${configFile pkgs}";
104
+
Restart = "always";
105
+
RestartSec = 5;
106
+
107
+
DynamicUser = true;
108
+
# Read access to /var/lib/acme/${domain}. Works with DynamicUser: systemd
109
+
# adds the transient user to the group at start.
110
+
SupplementaryGroups = [ certGroup ];
111
+
112
+
# ProtectSystem=strict only remounts read-only, so reading the cert is
113
+
# still fine.
114
+
ProtectSystem = "strict";
115
+
ProtectHome = true;
116
+
PrivateTmp = true;
117
+
NoNewPrivileges = true;
118
+
ProtectKernelTunables = true;
119
+
ProtectControlGroups = true;
120
+
RestrictAddressFamilies = [
121
+
"AF_INET"
122
+
"AF_INET6"
123
+
];
124
+
};
125
+
};
126
+
127
+
# Only the QAD listener needs a hole punched; the relay's HTTP side is
128
+
# reached through nginx on 443, which is already open.
129
+
networking.firewall.allowedUDPPorts = [ quicPort ];
130
+
}
+3
machines/neoprism/config.nix
+3
machines/neoprism/config.nix