intel gpu hardware firmware

flake.lock

@@ -428,11 +428,11 @@
     "nix-secrets": {
       "flake": false,
       "locked": {
-        "lastModified": 1728041293,
+        "lastModified": 1728169228,
-        "narHash": "sha256-ttKGrtU+naTxmlHf4M142MTM4rYc5WWhRzdY1wEO5gE=",
+        "narHash": "sha256-WT6kWWqMQE4KBdziZ/uuJ9sPcVg+6QJoOdBPdKAD0gI=",
         "ref": "refs/heads/master",
-        "rev": "dc659e262931d48bc8499fbfee60d27e40cda9cd",
+        "rev": "e9709bbb9adc91fb6b4dab5b16e15546cc596695",
-        "revCount": 163,
+        "revCount": 165,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },

hosts/common/optional/docker/default.nix

@@ -1,10 +1,26 @@
-{pkgs, ...}: {
+{
-  virtualisation = {
+  pkgs,
-    docker = {
+  inputs,
-      enable = true;
+  ...
-    };
+}: {
-  };
+  imports = [inputs.arion.nixosModules.arion];
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = [
-    docker-compose
+    pkgs.arion
+    pkgs.docker-client
   ];
+
+  virtualisation = {
+    podman = {
+      enable = true;
+      dockerSocket.enable = true;
+      defaultNetwork.settings.dns_enabled = true;
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/containers"
+    ];
+  };
 }

hosts/common/optional/docker/postgres.nix

@@ -1,145 +0,0 @@
-{
-  pkgs,
-  lib,
-  inputs,
-  config,
-  ...
-}: let
-  admin_dbPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/postgres/admin_db/password".path;
-  initScript = pkgs.writeText "init.sh" ''
-    #!/bin/bash
-    function create_user_and_database() {
-      local database=$1
-      local user=$2
-      local extensions=$3
-      echo "### admin user: $POSTGRES_USER ###"
-      echo "  Creating database '$database'"
-      echo "  Creating user  '$user'"
-      psql -v --username "$POSTGRES_USER" -d "$POSTGRES_DB" <<-EOSQL
-          CREATE USER $user;
-          CREATE DATABASE $database;
-          GRANT ALL PRIVILEGES ON DATABASE $database TO $user;
-    EOSQL
-
-    # Loop through extensions and create them
-    for ext in $(echo "$extensions" | tr ',' ' '); do
-      echo "     - Installing extention $ext"
-      psql -v --username "$POSTGRES_USER" -d "$database" -c "CREATE EXTENSION $ext;"
-    done
-    }
-
-    if [ -n "$POSTGRES_MULTIPLE_DATABASES" ]; then
-
-      # Parse the JSON string
-      database_names=$(echo "$POSTGRES_MULTIPLE_DATABASES" | jq -r '.[0] | keys[]')
-      echo "Multiple database creation requested: $(echo "$database_names" | tr "\n" " ")"
-
-      # Loop through each database and create it
-      for db_name in $database_names; do
-        user=$(echo "$POSTGRES_MULTIPLE_DATABASES" | jq -r ".[0] | .''${db_name} | .user")
-        extensions=$(echo "$POSTGRES_MULTIPLE_DATABASES" | jq -r ".[0] | .''${db_name} | .extensions | join(\",\")")
-        create_user_and_database "$db_name" "$user" "$extensions"
-      done
-    fi
-  '';
-
-  pg_hbaConfig = pkgs.writeText "pg_hba.conf" ''
-    none
-  '';
-
-  pgsqlConfig = pkgs.writeText "postgresql.conf" ''
-    listen_addresses = '*'
-    port = 5432
-    max_connections = 100
-    shared_buffers = 24GB
-    work_mem = 1GB
-    maintenance_work_mem = 10GB
-    autovacuum_work_mem = 2GB
-    dynamic_shared_memory_type = posix
-    wal_level = minimal
-    checkpoint_timeout = 60min
-    checkpoint_completion_target = 0.9
-    max_wal_size = 10GB
-    min_wal_size = 80MB
-    max_wal_senders = 0
-    random_page_cost = 1.0
-    effective_cache_size = 25GB
-    jit = off
-    log_line_prefix = '%m [%p] %q%u@%d '
-    log_timezone = 'Etc/UTC'
-    cluster_name = 'postgres-docker'
-    datestyle = 'iso, dmy'
-    timezone = 'Etc/UTC'
-    default_text_search_config = 'pg_catalog.english'
-  '';
-in {
-  sops.secrets = {
-    "software/postgres/admin_db/password" = {};
-  };
-  virtualisation.arion = {
-    backend = "docker";
-    projects = {
-      "db".settings.services."db".service = {
-        restart = "unless-stopped";
-        build.context = "/nix/store";
-        build.dockerfile = builtins.baseNameOf "${pkgs.writeText "pgDockerfile" ''
-          FROM postgres:16
-          # install packages
-          RUN apt-get update \
-              && apt-get install -y --no-install-recommends \
-                  postgresql-16-postgis \
-                  jq \
-              && rm -rf /var/lib/apt/lists/*
-        ''}";
-        command = ["postgres" "-c" "config_file=/etc/postgresql/postgresql.conf"];
-        environment = {
-          POSTGRES_PASSWORD_FILE = admin_dbPasswordFile;
-          POSTGRES_USER = "admin";
-          POSTGRES_DB = "admin_db";
-          PGDATA = "/var/lib/postgresql/data/pgdata";
-          POSTGRES_MULTIPLE_DATABASES = ''
-            [
-              {
-                "osm": {
-                  "user": "gis",
-                  "extensions": [
-                    "hstore",
-                    "postgis"
-                  ]
-                },
-                "bitcoin": {
-                  "user": "satoshi",
-                  "extensions": []
-                },
-                "btc_models": {
-                  "user": "dbt",
-                  "extensions": []
-                },
-                "dev_btc_models": {
-                  "user": "dbt",
-                  "extensions": []
-                }
-              }
-            ]
-          '';
-        };
-        ports = ["5432:5432"];
-        volumes = [
-          # Mount pgdata to external zfs volume
-          "/mnt/postgres:/var/lib/postgresql/data"
-
-          # Mount config files
-          # "${pg_hbaConfig}:/var/lib/postgres/data/pgdata/pg_hba.conf"
-          "${pgsqlConfig}:/etc/postgresql/postgresql.conf"
-
-          # Need to mount secret file
-          "${admin_dbPasswordFile}:${admin_dbPasswordFile}"
-
-          # PG init script to parse json specified in POSTGRES_MULTIPLE_DATABASES
-          # creates databases, users and installs extensions for each database.
-          "${initScript}:/docker-entrypoint-initdb.d/init.sh"
-        ];
-      };
-    };
-  };
-}

hosts/common/optional/nixos-containers/jellyfin.nix

@@ -0,0 +1,75 @@
+{
+  lib,
+  pkgs,
+  ...
+}: let
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  container_name = "jellyfin";
+  container_ip = "10.0.10.6";
+in {
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${container_name}"
+    ];
+  };
+
+  networking.nat.enable = true;
+  networking.nat.internalInterfaces = ["ve-+"];
+  networking.nat.externalInterface = "br0";
+
+  containers.postgres = {
+    autoStart = true;
+    privateNetwork = true;
+    hostBridge = "br0";
+    nixpkgs = pkgs.path;
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: {
+      networking = {
+        defaultGateway = "10.0.10.1";
+        interfaces.eth0.ipv4.addresses = [
+          {
+            "address" = "${container_ip}";
+            "prefixLength" = 24;
+          }
+        ];
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [
+            5432
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      services.jellyfin = {
+        enable = true;
+        openFirewall = true;
+      };
+
+      environment.systemPackages = [
+        pkgs.jellyfin
+        pkgs.jellyfin-web
+        pkgs.jellyfin-ffmpeg
+        pkgs.lsof
+      ];
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users.root = {
+        openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

hosts/common/optional/nixos-containers/nix-bitcoin.nix

@@ -9,7 +9,9 @@
   bitcoin-rpcpassword-public = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/bitcoind/bitcoin-rpcpassword-public".path;
   bitcoin-HMAC-privileged = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/bitcoind/bitcoin-HMAC-privileged".path;
   bitcoin-HMAC-public = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/bitcoind/bitcoin-HMAC-public".path;
-  pubKeys = lib.filesystem.listFilesRecursive ../users/keys;
+  container_name = "bitcoin-node";
+  container_ip = "10.0.10.5";
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
 in {
   sops.secrets = {
     "software/bitcoind/bitcoin-rpcpassword-privileged" = {};
@@ -18,14 +20,18 @@ in {
     "software/bitcoind/bitcoin-HMAC-public" = {};
   };
 
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${container_name}"
+    ];
+  };
+
   networking.nat.enable = true;
   networking.nat.internalInterfaces = ["ve-+"];
   networking.nat.externalInterface = "br0";
-  # networking.firewall.enable = true;
-  # networking.firewall.allowedTCPPorts = [80 443 22];
-  # networking.firewall.trustedInterfaces = ["ve-btcnode"];
 
-  containers.bitcoin-node = {
+  containers.${container_name} = {
     autoStart = true;
     privateNetwork = true;
     hostBridge = "br0";
@@ -65,14 +71,6 @@ in {
       };
     };
 
-    # forwardPorts = [
-    #   {
-    #     containerPort = 50001;
-    #     hostPort = 50001;
-    #     protocol = "tcp";
-    #   }
-    # ];
-
     config = {
       pkgs,
       lib,
@@ -88,7 +86,7 @@ in {
       ];
       networking = {
         defaultGateway = "10.0.10.1";
-        interfaces.eth0.ipv4.addresses = [ { "address" = "10.0.10.4"; "prefixLength" = 24; } ];
+        interfaces.eth0.ipv4.addresses = [ { "address" = "${container_ip}"; "prefixLength" = 24; } ];
         firewall = {
           enable = true;
           allowedTCPPorts = [
@@ -105,18 +103,8 @@ in {
 
       services.resolved.enable = true;
 
-      services.openssh = {
-        enable = true;
-        settings.PasswordAuthentication = false;
-      };
-
-      nix-bitcoin.generateSecrets = true;
-
-      users.users.root = {
-        openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
-      };
-
       # node services here
+      nix-bitcoin.generateSecrets = true;
       services = {
         tor = {
           enable = true;
@@ -165,6 +153,16 @@ in {
         electrs.enable = true;
         mempool-frontend.enable = true;
       };
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users.root = {
+        openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+      };
+
       system.stateVersion = "24.05";
     };
   };

hosts/common/optional/nixos-containers/postgres.nix

@@ -0,0 +1,113 @@
+{
+  inputs,
+  lib,
+  config,
+  pkgs,
+  ...
+}: let
+  postgresPasswordPath = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/postgres/postgres/password".path;
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  container_name = "postgres";
+  container_ip = "10.0.10.5";
+in {
+  sops.secrets = {
+    "software/postgres/postgres/password" = {
+    };
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${container_name}"
+    ];
+  };
+
+  networking.nat.enable = true;
+  networking.nat.internalInterfaces = ["ve-+"];
+  networking.nat.externalInterface = "br0";
+
+  containers.postgres = {
+    autoStart = true;
+    privateNetwork = true;
+    hostBridge = "br0";
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/var/lib/postgresql" = {
+        hostPath = "/media/main-ssd/postgresql";
+        isReadOnly = false;
+      };
+    };
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: {
+      networking = {
+        defaultGateway = "10.0.10.1";
+        interfaces.eth0.ipv4.addresses = [
+          {
+            "address" = "${container_ip}";
+            "prefixLength" = 24;
+          }
+        ];
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [
+            5432
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      environment.systemPackages = with pkgs; [
+        lsof
+      ];
+
+      services.postgresql = {
+        enable = true;
+        enableJIT = true;
+        package = pkgs.postgresql_16;
+        extraPlugins = with pkgs.postgresql_16.pkgs; [ postgis ];
+        settings = {
+          max_worker_processes = "12";
+          max_parallel_workers = "8";
+          max_parallel_workers_per_gather = "4";
+          max_connections = "100";
+          autovacuum_work_mem = "2GB";
+          shared_buffers = "32GB";
+          work_mem = "0.32GB";
+          maintenance_work_mem = "64MB";
+        };
+        authentication = pkgs.lib.mkOverride 10 ''
+          #type database  DBuser  auth-method
+          local all       all     trust
+        '';
+      };
+
+      systemd.services.postgresql.postStart = ''
+        $PSQL -tA <<'EOF'
+          DO $$
+          DECLARE password TEXT;
+          BEGIN
+            password := trim(both from replace(pg_read_file('${postgresPasswordPath}'), E'\n', '''));
+            EXECUTE format('ALTER ROLE postgres WITH PASSWORD '''%s''';', password);
+          END $$;
+        EOF
+      '';
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users.root = {
+        openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

hosts/common/users/sam/default.nix

@@ -24,6 +24,7 @@ in {
       "scanner"
       "lp"
       "docker"
+      "podman"
     ];
   };
 

hosts/semita/default.nix

@@ -47,8 +47,8 @@ in {
     ../common/optional/nfs-mounts/homeshare.nix
     ../common/optional/printing.nix
     ../common/optional/docker
-    ../common/optional/docker/postgres.nix
+    ../common/optional/nixos-containers/nix-bitcoin.nix
-    ../common/optional/nix-bitcoin.nix
+    ../common/optional/nixos-containers/postgres.nix
   ];
 
   fileSystems."/media/main-ssd" = {
@@ -85,6 +85,23 @@ in {
     pkgs.sof-firmware
   ];
 
+  nixpkgs.config.packageOverrides = pkgs: {
+    vaapiIntel = pkgs.vaapiIntel.override {enableHybridCodec = true;};
+  };
+
+  hardware.opengl = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver
+      intel-vaapi-driver
+      vaapiVdpau
+      libvdpau-va-gl
+      intel-compute-runtime
+      vpl-gpu-rt
+      intel-media-sdk
+    ];
+  };
+
   networking = {
     hostName = "semita";
     nameservers = ["10.0.10.60" "10.0.10.1" "8.8.8.8"];
@@ -103,19 +120,6 @@ in {
         }
       ];
     };
-    # interfaces.br0 = {
-    #   useDHCP = false;
-    #   ipv4.addresses = [
-    #     {
-    #       address = "10.0.10.3";
-    #       prefixLength = 24;
-    #     }
-    #   ];
-    # };
-    # defaultGateway = {
-    #   address = "10.0.10.1";
-    #   interface = "eth0";
-    # };
   };
 
   services.libinput.enable = true;