Merge remote-tracking branch 'github/master'

82 files changed, 296 insertions, 408 deletions

diff --git a/flake.lock b/flake.lock
index 1774af4dd..b11c289b4 100644
--- a/flake.lock
+++ b/flake.lock
@@ -44,6 +44,21 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "locked": {
+        "lastModified": 1676283394,
+        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "hercules-ci-effects": {
       "inputs": {
         "flake-parts": [
@@ -70,7 +85,10 @@
       }
     },
     "nix-writers": {
-      "flake": false,
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs"
+      },
       "locked": {
         "lastModified": 1677612737,
         "narHash": "sha256-UaCKZ4PbMZU6UZH7XNFcjRtd5jheswl66rjZDBfQgp8=",
@@ -87,6 +105,21 @@
     },
     "nixpkgs": {
       "locked": {
+        "lastModified": 1677608380,
+        "narHash": "sha256-k82O23qBAK+43X0KSBjsMYXG2x4kWWXeAmpPTc2KRGY=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "4aba90e89f6d4ac6138939961f62842bd94ec929",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
         "lastModified": 1760878510,
         "narHash": "sha256-K5Osef2qexezUfs0alLvZ7nQFTGS9DL2oTVsIXsqLgs=",
         "owner": "NixOS",
@@ -105,7 +138,7 @@
       "inputs": {
         "buildbot-nix": "buildbot-nix",
         "nix-writers": "nix-writers",
-        "nixpkgs": "nixpkgs"
+        "nixpkgs": "nixpkgs_2"
       }
     },
     "treefmt-nix": {
diff --git a/flake.nix b/flake.nix
index 0b8d875c7..c3a218dcf 100644
--- a/flake.nix
+++ b/flake.nix
@@ -1,10 +1,7 @@
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nix-writers = {
-      url = "git+https://cgit.krebsco.de/nix-writers";
-      flake = false;
-    };
+    nix-writers.url = "git+https://cgit.krebsco.de/nix-writers";
     # disko.url = "github:nix-community/disko";
     # disko.inputs.nixpkgs.follows = "nixpkgs";
     buildbot-nix.url = "github:Mic92/buildbot-nix";
@@ -43,9 +40,21 @@
     };
     overlays.default = import ./krebs/5pkgs/default.nix;
     packages = let
-      packageNames = self.lib.attrNames (self.lib.mapNixDir (x: null) ./krebs/5pkgs/simple);
-      appliedOverlay = (system: self.overlays.default {} (self.inputs.nixpkgs.legacyPackages.${system} // { lib = self.lib; }));
-    in nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ] (system: self.lib.getAttrs packageNames (appliedOverlay system));
+      allNames = self.lib.attrNames (self.lib.mapNixDir (x: null) ./krebs/5pkgs/simple);
+      appliedOverlay = (system:
+        let
+          base = self.inputs.nixpkgs.legacyPackages.${system};
+          # Apply nix-writers overlay with fixpoint so its functions can find each other
+          withWriters = nixpkgs.lib.fix (final: base // nix-writers.overlays.default final base);
+        in self.overlays.default {} (withWriters // { lib = self.lib; }));
+      # Only include derivations in packages output
+      getDerivations = overlay: builtins.listToAttrs (builtins.filter (x: x != null) (map (name:
+        let val = overlay.${name} or null;
+        in if val != null && (val.type or null) == "derivation"
+           then { inherit name; value = val; }
+           else null
+      ) allNames));
+    in nixpkgs.lib.genAttrs [ "x86_64-linux" "aarch64-linux" ] (system: getDerivations (appliedOverlay system));
     lib = import (self.outPath + "/lib/pure.nix") { lib = nixpkgs.lib; };
   };
 }
diff --git a/kartei/default.nix b/kartei/default.nix
index 046efdd7b..7624807a0 100644
--- a/kartei/default.nix
+++ b/kartei/default.nix
@@ -1,15 +1,15 @@
-{ config, lib, ... }: let
+{ lib, ... }@arg: let
   removeTemplate =
     # TODO don't remove during CI
     lib.flip builtins.removeAttrs ["template"];
 in {
-  config =
-    lib.mkMerge
+  imports =
       (lib.mapAttrsToList
         (name: _type: let
           path = ./. + "/${name}";
         in {
-          krebs = import path { inherit config lib; };
+          _file = toString path;
+          krebs = import path arg;
         })
         (removeTemplate
           (lib.filterAttrs
diff --git a/kartei/tv/default.nix b/kartei/tv/default.nix
index e81bdd32b..848646510 100644
--- a/kartei/tv/default.nix
+++ b/kartei/tv/default.nix
@@ -1,29 +1,22 @@
-{ config, lib, ... }@attrs: let
-  inherit (builtins)
-    getAttr head mapAttrs match pathExists readDir readFile typeOf;
-  inherit (lib)
-    const hasAttrByPath mapAttrs' mkDefault mkIf optionalAttrs removeSuffix
-    toList;
-  slib = import ../../lib/pure.nix { inherit lib; };
+{ config, lib, ... }: let
+  slib = lib.slib or (import ../../lib/pure.nix { inherit lib; });
+
+  extend = x: f: {
+    lambda = lib.recursiveUpdate x (f x);
+    set = lib.recursiveUpdate x f;
+  }.${builtins.typeOf f};
 in {
   dns.providers = {
     "viljetic.de" = "regfish";
   };
   hosts =
-    mapAttrs
-      (hostName: hostFile: let
-        hostSource = import hostFile;
-        hostConfig = getAttr (typeOf hostSource) {
-          lambda = hostSource attrs;
-          set = hostSource;
-        };
-      in slib.evalSubmodule slib.types.host [
-        hostConfig
+    builtins.mapAttrs
+      (hostName: lib.flip (builtins.foldl' extend) [
         {
           name = hostName;
           owner = config.krebs.users.tv;
         }
-        (optionalAttrs (hasAttrByPath ["nets" "retiolum"] hostConfig) {
+        (hostConfig: lib.optionalAttrs (lib.hasAttrByPath ["nets" "retiolum"] hostConfig) {
           nets.retiolum = {
             ip6.addr =
               (slib.krebs.genipv6 "retiolum" "tv" { inherit hostName; }).address;
@@ -31,29 +24,31 @@ in {
         })
         (let
           pubkey-path = ./wiregrill + "/${hostName}.pub";
-        in optionalAttrs (pathExists pubkey-path) {
+        in lib.optionalAttrs (builtins.pathExists pubkey-path) {
           nets.wiregrill = {
             aliases = [
               "${hostName}.w"
             ];
             ip6.addr =
               (slib.krebs.genipv6 "wiregrill" "tv" { inherit hostName; }).address;
-            wireguard.pubkey = readFile pubkey-path;
+            wireguard.pubkey = builtins.readFile pubkey-path;
           };
         })
-        (host: mkIf (host.config.ssh.pubkey != null) {
-          ssh.privkey = mapAttrs (const mkDefault) {
-            path = "${config.krebs.secret.directory}/ssh.id_${host.config.ssh.privkey.type}";
-            type = head (toList (builtins.match "ssh-([^ ]+) .*" host.config.ssh.pubkey));
+        (hostConfig: lib.optionalAttrs (hostConfig.ssh.pubkey or null != null) {
+          ssh.privkey = builtins.mapAttrs (lib.const lib.mkDefault) rec {
+            path = "${config.krebs.secret.directory}/ssh.id_${type}";
+            type = builtins.head (lib.toList (builtins.match "ssh-([^ ]+) .*" hostConfig.ssh.pubkey));
           };
         })
       ])
-      (mapAttrs'
+      (lib.mapAttrs'
         (name: type: {
-          name = removeSuffix ".nix" name;
-          value = ./hosts + "/${name}";
+          name = lib.removeSuffix ".nix" name;
+          value = lib.toFunction (import (./hosts + "/${name}")) {
+            inherit config lib slib;
+          };
         })
-        (readDir ./hosts));
+        (builtins.readDir ./hosts));
   sitemap = {
     "http://cgit.krebsco.de" = {
       desc = "Git repositories";
@@ -70,21 +65,21 @@ in {
     };
     mv-ni = {
       mail = "mv@ni.r";
-      pubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod";
+      pubkey = builtins.readFile (./ssh + "/mv@vod.id_ed25519.pub");
     };
     tv = {
       mail = "tv@nomic.r";
-      pgp.pubkeys.default = readFile ./pgp/CBF89B0B.asc;
-      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAEAQDFR//RnCvEZAt0F6ExDsatKZ/DDdifanuSL360mqOhaFieKI34RoOwfQT9T+Ga52Vh5V2La6esvlph686EdgzeKLvDoxEwFM9ZYFBcMrNzu4bMTlgE7YUYw5JiORyXNfznBGnme6qpuvx9ibYhUyiZo99kM8ys5YrUHrP2JXQJMezDFZHxT4GFMOuSdh/1daGoKKD6hYL/jEHX8CI4E3BSmKK6ygYr1fVX0K0Tv77lIi5mLXucjR7CytWYWYnhM6DC3Hxpv2zRkPgf3k0x/Y1hrw3V/r0Me5h90pd2C8pFaWA2ZoUT/fmyVqvx1tZPYToU/O2dMItY0zgx2kR0yD+6g7Aahz3R+KlXkV8k5c8bbTbfGnZWDR1ZlbLRM9Yt5vosfwapUD90MmVkpmR3wUkO2sUKi80QfC7b4KvSDXQ+MImbGxMaU5Bnsq1PqLN95q+uat3nlAVBAELkcx51FlE9CaIS65y4J7FEDg8BE5JeuCNshh62VSYRXVSFt8bk3f/TFGgzC8OIo14BhVmiRQQ503Z1sROyf5xLX2a/EJavMm1i2Bs2TH6ROKY9z5Pz8hT5US0r381V8oG7TZyLF9HTtoy3wCYsgWA5EmLanjAsVU2YEeAA0rxzdtYP8Y2okFiJ6u+M4HQZ3Wg3peSodyp3vxdYce2vk4EKeqEFuuS82850DYb7Et7fmp+wQQUT8Q/bMO0DreWjHoMM5lE4LJ4ME6AxksmMiFtfo/4Fe2q9D+LAqZ+ANOcv9M+8Rn6ngiYmuRNd0l/a02q1PEvO6vTfXgcl4f7Z1IULHPEaDNZHCJS1K5RXYFqYQ6OHsTmOm7hnwaRAS97+VFMo1i5uvTx9nYaAcY7yzq3Ckfb67dMBKApGOpJpkvPgfrP7bgBO5rOZXM1opXqVPb09nljAhhAhyCTh1e/8+mJrBo0cLQ/LupQzVxGDgm3awSMPxsZAN45PSWz76zzxdDa1MMo51do+VJHfs7Wl0NcXAQrniOBYL9Wqt0qNkn1gY5smkkISGeQ/vxNap4MmzeZE7b5fpOy+2fpcRVQLpc4nooQzJvSVTFz+25lgZ6iHf45K87gQFMIAri1Pf/EDDpL87az+bRWvWi+BA2kMe1kf+Ay1LyMz8r+g51H0ma0bNFh6+fbWMfUiD9JCepIObclnUJ4NlWfcgHxTf17d/4tl6z4DTcLpCCk8Da77JouSHgvtcRbRlFV1OfhWZLXUsrlfpaQTiItv6TGIr3k7+7b66o3Qw/GQVs5GmYifaIZIz8n8my4XjkaMBd0SZfBzzvFjHMq6YUP9+SbjvReqofuoO+5tW1wTYZXitFFBfwuHlXm6w77K5QDBW6olT7pat41/F5eGxLcz tv@wu";
+      pgp.pubkeys.default = builtins.readFile ./pgp/CBF89B0B.asc;
+      pubkey = builtins.readFile (./ssh + "/tv@wu.id_rsa.pub");
       uid = 1337; # TODO use default and document what has to be done (for vv)
     };
     tv-nomic = {
       inherit (config.krebs.users.tv) mail;
-      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3dYR/n4Yw8OsYmfR2rSUG7o10G6AqOlSJHuHSEmANbMkqjiWl1TnpORtt5bAktyAGI4vWf9vhNEnxuIqGXWSV+3yCd7yfBHR1m0Y9QSw6blQ0xc1venl3JU0kpEyJfUn8a9cdXlnRiS0MP1gcsN7Zk8cqBELJYJajkSEnsT4eVaU5/wdnyzUO1fk8D8tFBJbF/tsWDLJPu4P18rpxq4wZgA2qmyHoVDEVlrz2OYcziXT6gpG0JGnToteaNg9ok5QavEYFpp8P+k1AacrBjc1PAb4MaMX1nfkSyaZwSqLdH35XkNRgPhVVmqZ5PlG3VeNpPSwpdcKi8P3zH1xG9g6Usx1SAyvcoAyGHdOwmFuA2tc1HgYEiQ+OsPrHZHujBOOZsKTN9+IZHScCAe+UmUcK413WEZKPs8PeFjf1gQAoDXb55JpksxLAnC/SQOl4FhkctIAXxr12ALlyt9UFPzIoj/Nj2MpFzGSlf653fTFmnMbQ8+GICc4TUpqx5GELZhfQuprBTv/55a9zKvM4B8XT3Bn9olQzMQIXEjXb3WUVFDDNWeNydToorYn1wG3ZWQ+3f0IlqRicWO7Q9BRj1Lp5rcUCb+naJ48tGY6HFUZ1Kz/0x458GDFvUd8mCJjqqmeSkUEeZd0xet5tVFg/bYoSslEqPF6pz7V3ruJMSdYxnQ== tv@nomic #2";
+      pubkey = builtins.readFile (./ssh + "/tv@nomic.id_rsa.pub");
     };
     tv-xu = {
       inherit (config.krebs.users.tv) mail;
-      pubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC/3nkqxe8YrDVt615n96A7iC3vvwsiqgpsBYC/bhwfBHu1bAtBmTWVqSKDIdwg7p8TQpIKtAgZ3IJT3BlrnVTeR4RIviLjHjYWW1NBhm+nXi+heThgi5fLciE3lVLVsy5X9Kc1ZPLgLa1In0REOanwbueOD0ESN1yKIDwUUdczw/o3dLDMzanqFHKuSSN4o9Ex2x+MRj9eLsb706s4VSYMo3lirRCJeAOGv1C7Xg1cuepdhIeJsq9aF7vSy15c0nCkWwr8zdY7pbMPYCe5zvIEymZ0UowZ5HQ3NmIZnYDxa4E1PFjDczHdQbVmmGMI80grNwMsHzQ6bynHSPXDoLf4WodXlhS0+9Ju5QavDT6uqZ9uhDBuWC8QNgWUMIJnEaTBFyA0OI1akl8Q2RLC+qnNf5IwItSq+GDwEsB2ZJNW3kOk1kNiCUrBafRYpPaFeP97wzzP4uYlBKAr2SOLrrkf7NFEdw2ihxhDMNnps/ErRJ8U0zdpmalw8mItGyqRULpHjk/wN00rYOdBIhW3G3QJuVgtGnWtGCBG5x70EfMiSEXPD3YSsVVsgKD+v8qr+YiilRRD+N3gaHhiOWA6HgxRNul/P4llk0ktTpb9LoHk2+oooTH5ZuuT/8yF8J4stZt7EIOH+mSOAXG1z0BwnEkQu7pVKwu/oOZpGJTvBrGwww== tv@xu";
+      pubkey = builtins.readFile (./ssh + "/tv@xu.id_rsa.pub");
     };
     vv = {
       mail = "vv@mu.r";
diff --git a/kartei/tv/hosts/ne.nix b/kartei/tv/hosts/ne.nix
new file mode 100644
index 000000000..584d7c433
--- /dev/null
+++ b/kartei/tv/hosts/ne.nix
@@ -0,0 +1,39 @@
+{ config, ... }: {
+  extraZones = {
+    "krebsco.de" = ''
+      @ 60 IN MX 5 ne
+      ne 60 IN A ${config.krebs.hosts.ne.nets.internet.ip4.addr}
+      ne 60 IN AAAA ${config.krebs.hosts.ne.nets.internet.ip6.addr}
+      tv 300 IN NS ne
+    '';
+  };
+  nets = {
+    internet = {
+      aliases = [
+        "ne.i"
+      ];
+      ip4 = {
+        addr = "159.195.31.38";
+      };
+      ip6 = {
+        addr = "2a0a:4cc0:c1:5eb0::1";
+        prefixLength = 64;
+      };
+      ssh.port = 11423;
+    };
+    mycelium = {
+      aliases = [
+        "ne.m"
+      ];
+      ip6.addr = "45f:fa21:4bdd:a758:8091:947d:fe84:fac3";
+    };
+    retiolum = {
+      aliases = [
+        "ne.r"
+      ];
+    };
+    wiregrill = {
+      ip4.addr = "10.244.3.2";
+    };
+  };
+}
diff --git a/kartei/tv/hosts/ni.nix b/kartei/tv/hosts/ni.nix
index d64874d9c..3e3d81c37 100644
--- a/kartei/tv/hosts/ni.nix
+++ b/kartei/tv/hosts/ni.nix
@@ -1,6 +1,4 @@
-{ config, lib, ... }: let
-  slib = import ../../../lib/pure.nix { inherit lib; };
-in {
+{ config, lib, slib, ... }: {
   extraZones = {
     "krebsco.de" = ''
       ni          60 IN A ${config.krebs.hosts.ni.nets.internet.ip4.addr}
@@ -18,13 +16,12 @@ in {
   };
   nets = {
     internet = {
-      ip4 = rec {
+      ip4 = {
         addr = "185.162.251.237";
-        prefix = "${addr}/32";
       };
-      ip6 = rec {
+      ip6 = {
         addr = "2a03:4000:1a:cf::1";
-        prefix = "${addr}/64";
+        prefixLength = 64;
       };
       aliases = [
         "ni.i"
diff --git a/kartei/tv/ssh/mv@vod.id_ed25519.pub b/kartei/tv/ssh/mv@vod.id_ed25519.pub
new file mode 100644
index 000000000..7b7d2e260
--- /dev/null
+++ b/kartei/tv/ssh/mv@vod.id_ed25519.pub
@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGer9e2+Lew7vnisgBbsFNECEIkpNJgEaqQqgb9inWkQ mv@vod
diff --git a/kartei/tv/ssh/tv