Weekly flake update: 2025-10-11 03:33 UTC

sudo-rs
gallery-dl reads secrets on runtime
2025-10-10 21:33:27 -06:00 · 2025-10-09 23:42:38 -06:00 · 2025-10-09 23:23:26 -06:00 · 2025-10-09 23:10:00 -06:00 · 2025-10-09 23:01:01 -06:00 · 2025-10-06 03:54:05 -06:00
7 changed files with 85 additions and 51 deletions
--- a/config/base.nix
+++ b/config/base.nix
@@ -47,7 +47,7 @@
  };
  security = {
    polkit.enable = true;
-    sudo = {
+    sudo-rs = {
      enable = true;
      wheelNeedsPassword = false;
    };
--- a/dotfiles/gallery-dl.nix
+++ b/dotfiles/gallery-dl.nix
@@ -4,7 +4,7 @@
    cookies = [
      "firefox"
      "/home/jawz/.librewolf/jawz"
-      "gcr_4"
+      "gnomekeyring"
    ];
    retries = 10;
    sleep-request = 0;
@@ -13,8 +13,8 @@
      directory = [ ];
    };
    bluesky = {
+      limit-rate = "400k-1M";
      username = "blablablamagic.bsky.social";
-      password = "{env[GALLERY_DL_BLUESKY_PASSWORD]}";
      reposts = false;
      videos = true;
      directory = [ "{author['handle']}" ];
@@ -30,8 +30,6 @@
    };
    flickr = {
      size-max = "Original";
-      access-token = "{env[GALLERY_DL_FLICKR_ACCESS_TOKEN]}";
-      access-token-secret = "{env[GALLERY_DL_FLICKR_ACCESS_TOKEN_SECRET]}";
      directory = [
        "{category}"
        "{owner[username]}"
@@ -49,8 +47,9 @@
      ];
    };
    instagram = {
+      limit-rate = "200k-300k";
      browser = "firefox:linux";
-      user-agent = "Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0";
+      user-agent = "Mozilla/5.0 (X11; Linux x86_64; rv:143.0) Gecko/20100101 Firefox/143.0";
      sleep = "66-123";
      sleep-request = "66-123";
      parent-directory = true;
@@ -71,6 +70,7 @@
      ];
    };
    kemonoparty = {
+      limit-rate = "200k-300k";
      retries = 10;
      timeout = 5;
      filename = "{id}_{filename}.{extension}";
@@ -84,19 +84,15 @@
      "{title}"
    ];
    tumblr = {
-      access-token = "{env[GALLERY_DL_TUMBLR_ACCESS_TOKEN]}";
-      access-token-secret = "{env[GALLERY_DL_TUMBLR_ACCESS_TOKEN_SECRET]}";
      external = true;
      inline = true;
      posts = "all";
      reblogs = false;
      parent-directory = true;
-      api-key = "{env[GALLERY_DL_TUMBLR_API_KEY]}";
-      api-secret = "{env[GALLERY_DL_TUMBLR_API_SECRET]}";
      directory = [ "{blog_name}" ];
    };
    deviantart = {
-      refresh-token = "{env[GALLERY_DL_DEVIANTART_REFRESH_TOKEN]}";
+      limit-rate = "200k-300k";
      include = "gallery,scraps";
      flat = true;
      original = true;
@@ -116,6 +112,7 @@
      ];
    };
    patreon = {
+      limit-rate = "400k-1M";
      filename = "{filename}.{num}.{extension}";
      browser = "firefox";
      directory = [
@@ -139,7 +136,6 @@
    reddit = {
      user-agent = "Python:gallery-dl:v1.0 (by /u/captainjawz)";
      client-id = "T7nZ6WZ3_onJWBhLP8r08g";
-      refresh-token = "{env[GALLERY_DL_REDDIT_REFRESH_TOKEN]}";
      parent-directory = true;
      directory = [ "{author}" ];
    };
@@ -162,7 +158,6 @@
    ];
    baraag.directory = [ "{account[username]}" ];
    pixiv = {
-      refresh-token = "{env[GALLERY_DL_PIXIV_REFRESH_TOKEN]}";
      directory = [ "{user[account]} - {user[id]}" ];
      ugoira = true;
      favorite.directory = [
@@ -196,6 +191,7 @@
      ];
    };
    readcomiconline = {
+      limit-rate = "400k-1M";
      chapter-reverse = true;
      quality = "hq";
      captcha = "wait";
--- a/flake.lock
+++ b/flake.lock
@@ -215,11 +215,11 @@
        "nixpkgs-lib": "nixpkgs-lib"
      },
      "locked": {
-        "lastModified": 1756770412,
-        "narHash": "sha256-+uWLQZccFHwqpGqr2Yt5VsW/PbeJVTn9Dk6SHWhNRPw=",
+        "lastModified": 1759362264,
+        "narHash": "sha256-wfG0S7pltlYyZTM+qqlhJ7GMw2fTF4mLKCIVhLii/4M=",
        "owner": "hercules-ci",
        "repo": "flake-parts",
-        "rev": "4524271976b625a4a605beefd893f270620fd751",
+        "rev": "758cf7296bee11f1706a574c77d072b8a7baa881",
        "type": "github"
      },
      "original": {
@@ -473,11 +473,11 @@
        "xdph": "xdph"
      },
      "locked": {
-        "lastModified": 1759530922,
-        "narHash": "sha256-9NgZKpibALekGTPDc2O8lP8vFealQSZkXe+L+S7MMZU=",
+        "lastModified": 1760143218,
+        "narHash": "sha256-OhJPROcRcwBkjOKkXr/f3/7wuSjhAIqr8WfmEUF9Uuo=",
        "owner": "hyprwm",
        "repo": "Hyprland",
-        "rev": "76d998743ac10e712238c1016db4d8e8d16f1049",
+        "rev": "d599513d4a72d66ac62ffdedc41d6653fa81b39e",
        "type": "github"
      },
      "original": {
@@ -620,11 +620,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759490926,
-        "narHash": "sha256-7IbZGJ5qAAfZsGhBHIsP8MBsfuFYS0hsxYHVkkeDG5Q=",
+        "lastModified": 1759619523,
+        "narHash": "sha256-r1ed7AR2ZEb2U8gy321/Xcp1ho2tzn+gG1te/Wxsj1A=",
        "owner": "hyprwm",
        "repo": "hyprutils",
-        "rev": "94cce794344538c4d865e38682684ec2bbdb2ef3",
+        "rev": "3df7bde01efb3a3e8e678d1155f2aa3f19e177ef",
        "type": "github"
      },
      "original": {
@@ -666,11 +666,11 @@
        "sudoku-solver": "sudoku-solver"
      },
      "locked": {
-        "lastModified": 1759462273,
-        "narHash": "sha256-eQVmWzWE9gzLSqEkvURyYoqLmDeiokGbQGkYvQ58kVc=",
+        "lastModified": 1760073554,
+        "narHash": "sha256-Ydqg/9lpoha2vgspjviqeRh6/tsWN+pZcUxn1ZyrFZM=",
        "ref": "refs/heads/master",
-        "rev": "9ab256ded797f78c9e411fe186dde9410be3049d",
-        "revCount": 107,
+        "rev": "5c13b806a094f3605e2da70e133551848ad8d9a9",
+        "revCount": 109,
        "type": "git",
        "url": "https://git.servidos.lat/jawz/scripts.git"
      },
@@ -687,11 +687,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759455985,
-        "narHash": "sha256-8qDv7NXH3fj1CDXed7c7vJLtrRKDZSo0x6TaWSfelVg=",
+        "lastModified": 1760146997,
+        "narHash": "sha256-x2sF8Q4tWz3DI166s+KFDXySrK+cN+/YEd3DfhnhBLQ=",
        "owner": "fufexan",
        "repo": "nix-gaming",
-        "rev": "eb5ab503cbd3cb386e8d85a55a9faed73ec7dc37",
+        "rev": "ad505387568d024654da88fef03d9c5319cba92f",
        "type": "github"
      },
      "original": {
@@ -787,11 +787,11 @@
    },
    "nixpkgs-small": {
      "locked": {
-        "lastModified": 1759499817,
-        "narHash": "sha256-a4OoPmarWnVUfroI/ZFFtybpwnxjfL3rO5lNCEOVK5E=",
+        "lastModified": 1760081104,
+        "narHash": "sha256-n9NgHBtZgLrT1FtJ2W9AvVKM7bXWBgqw/is739m72WQ=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "b160419b1b40637913ff7204b375e259319c42d9",
+        "rev": "872106a411643f96e2c9576d247cf96e7c8c1b97",
        "type": "github"
      },
      "original": {
@@ -803,11 +803,11 @@
    },
    "nixpkgs-unstable": {
      "locked": {
-        "lastModified": 1759381078,
-        "narHash": "sha256-gTrEEp5gEspIcCOx9PD8kMaF1iEmfBcTbO0Jag2QhQs=",
+        "lastModified": 1760038930,
+        "narHash": "sha256-Oncbh0UmHjSlxO7ErQDM3KM0A5/Znfofj2BSzlHLeVw=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "7df7ff7d8e00218376575f0acdcc5d66741351ee",
+        "rev": "0b4defa2584313f3b781240b29d61f6f9f7e0df3",
        "type": "github"
      },
      "original": {
@@ -819,11 +819,11 @@
    },
    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1759439645,
-        "narHash": "sha256-oiAyQaRilPk525Z5aTtTNWNzSrcdJ7IXM0/PL3CGlbI=",
+        "lastModified": 1759994382,
+        "narHash": "sha256-wSK+3UkalDZRVHGCRikZ//CyZUJWDJkBDTQX1+G77Ow=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "879bd460b3d3e8571354ce172128fbcbac1ed633",
+        "rev": "5da4a26309e796daa7ffca72df93dbe53b8164c7",
        "type": "github"
      },
      "original": {
@@ -862,11 +862,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759591752,
-        "narHash": "sha256-jp1vZ+XKusYThPr2fBD+eqNACAXUDKyiC/M3tB8NNPc=",
+        "lastModified": 1760150127,
+        "narHash": "sha256-McDmxx/bruodgHLD4sFIl0fKkEkNj5VE3DglImfslrk=",
        "owner": "nix-community",
        "repo": "nur",
-        "rev": "38a31b2183210fe4aebf48c232ed89cc624456d5",
+        "rev": "886a5646695563cbae3c1e10369c6070c7645e73",
        "type": "github"
      },
      "original": {
@@ -968,11 +968,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1759188042,
-        "narHash": "sha256-f9QC2KKiNReZDG2yyKAtDZh0rSK2Xp1wkPzKbHeQVRU=",
+        "lastModified": 1759635238,
+        "narHash": "sha256-UvzKi02LMFP74csFfwLPAZ0mrE7k6EiYaKecplyX9Qk=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "9fcfabe085281dd793589bdc770a2e577a3caa5d",
+        "rev": "6e5a38e08a2c31ae687504196a230ae00ea95133",
        "type": "github"
      },
      "original": {
--- a/hosts/workstation/configuration.nix
+++ b/hosts/workstation/configuration.nix
@@ -137,7 +137,7 @@ in
    };
    protonmail-bridge = {
      enable = true;
-      path = [ pkgs.gcr_4 ];
+      path = [ pkgs.gnome-keyring ];
    };
    ollama = {
      enable = true;
--- a/modules/servers/stash.nix
+++ b/modules/servers/stash.nix
@@ -1,7 +1,31 @@
-{ lib, config, ... }:
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
 let
  cfg = config.my.servers.stash;
+  cfgS = config.services.stash;
  setup = import ../factories/mkserver.nix { inherit lib config; };
+  stashPythonFHS = pkgs.buildFHSEnv {
+    name = "stash-python-fhs";
+    targetPkgs =
+      pkgs:
+      builtins.attrValues {
+        inherit (pkgs)
+          python3
+          gcc
+          glibc
+          ;
+        inherit (pkgs.python3Packages)
+          pip
+          virtualenv
+          ;
+        inherit (pkgs.stdenv.cc.cc) lib;
+      };
+    runScript = "bash";
+  };
 in
 {
  options.my.servers.stash = setup.mkOptions "stash" "xxx" 9999;
@@ -29,5 +53,19 @@ in
        ];
      };
    };
+    systemd.services.stash = {
+      environment = {
+        PYTHONPATH = "/var/lib/stash/venv/lib/python3.12/site-packages";
+        LD_LIBRARY_PATH = "${pkgs.stdenv.cc.cc.lib}/lib:${pkgs.glibc}/lib:${pkgs.zlib}/lib:${pkgs.libffi}/lib:${pkgs.openssl}/lib";
+      };
+      serviceConfig = {
+        BindReadOnlyPaths = lib.mkForce [ ];
+        BindPaths = lib.mkIf (cfgS.settings != { }) (map (stash: "${stash.path}") cfgS.settings.stash);
+      };
+    };
+    users.users.stash = {
+      isSystemUser = true;
+      packages = [ stashPythonFHS ];
+    };
  };
 }
--- a/modules/shell/multimedia.nix
+++ b/modules/shell/multimedia.nix
@@ -19,7 +19,7 @@
          embed-thumbnail = true;
          embed-subs = true;
          sub-langs = "all";
-          cookies-from-browser = "firefox+gcr_4:/home/jawz/.librewolf/jawz";
+          cookies-from-browser = "firefox+gnomekeyring:/home/jawz/.librewolf/jawz";
        };
      };
      gallery-dl = {
--- a/secrets/gallery.yaml
+++ b/secrets/gallery.yaml
@@ -1,5 +1,5 @@
 gallery-dl:
-    secrets: ENC[AES256_GCM,data:5K9B7XZ3dOL1BIXLUvlE5D9xLkKkagvh2mMkFtd+6gJUJqPDwerp9QDcATeqiJLz54DGB1JI6podlCm8N3qVbA3aMHroSiAd2YaldqvLkh76vGDhfI6pAfYWmjLYR7KR/Qy5sy7qhkNmvhwV34JiqXMdfDaWDE9y9Zgqq3lyS/8mYixNh0sz9Pc7ohcIHpwVNcESxaPW9BCpzHOwhtZKqqgLTUrHCyO14YR1+hB+nGXnmtaFcFVDjb0ctHsgL8+R5Kw1oAE7s8fM+ghnKNqPusSVomTaNIQI8VMbk0YQyPsHn9zKEocjUEpwX7WdWmNLNjuYl29+NnJS7VCSOsZmqhNlKJMIvQ3v19UNIQG5/hB3QlBIlEr615W8l5q8jdD+twzufGkEnCIfZzn+T9UDijNlmZhK19lhOpF+mdi7vpzyJFrIK0JfFfRYnyvXOHIcDKK4rsMFTT8U04WM9PpYrUxWDmMMlAZsJ+Jj6d0jpRYsoB4C5ODKRa5V27wnhp9DQiQOAqvfYnUtCAFnFEqVu7qaa5WcQhG211Nhdcpvtyp/8sDXgZBTT/E8JTtG8YbSNUZxw3xE7fyp4Bdnb+bxbdcgVRGkFwZShu2qWF1Ckj4Lr2xzaBu+fGtUDqPnMq0PgQeRIVP/NsbtavrlISWhB5Ctw4QSRvGMTi5JqvhmLEWi5wvimYzt91aGj2tm/k8AOTtwwjK4iZyWKxE1PsjwmKwiEJZvTRKLTySxomqHDg1TOKGmAcJK/wCG7kO9ETp+yZxv1Sv3L7ZeCfyzM4fupRiPytbIMfeJsq6PxTpJGlD7lDC0EXUjRKV8JD8vnP91F0HXoZQ3tyb27/1BmZ/nSx3iGcmXhlV7eLgLS3MIpBChjget8d7oE4NnxBGrX8YoVFJzAUH5UawVNFHa3y/rKqUsS51vn0Q0Wxl+uK3KtK90TdML6VNW8HywWiNer5tbIY+Kl6I=,iv:4Sa8LyNhp2EyarQpQ19jJZFUAINmfuw3EnUVhiYGCJg=,tag:o5rLdUbGjao+SJ9Cqtr+jA==,type:str]
+    secrets: ENC[AES256_GCM,data:mU3qzDzrn2Q0AhMnrJAsxvpz3FECLl45RFmyvoWEMaoW52vKE62o8gUl2rWmihNrsR0YTxmjmxj2Ey0eoRHbH+SSg78GbveKxwqGS/SWxEY3Nr45p4h/rdgDFUcFBqSIOKuJxGSMLHiprAjET7h0NWbRAUL9QPVnAPT41YeZyiaZS5Y1hpvpMxlQF1XrPYgrBR35ZnraTdcYDhPf/UBnhWxQLsOLs4SKD6Bzy1OEjk6tkajhv3ZKrcbp3S1BGrirTm/WNZTEHqiTGiXQAirmY2BmF0YkkDCVWgTMCRc9o54k7KDw8WDRuZcGso7Gh6h0jkgppnjuRGyfUkFXa3bsfni47Ct0XFhUyJvzcG3juRYAAEdOj8Pgc2tF483hxmfzE19TEYC+4hxVpCfmJb//v8M01bsRLIR4eP0EMl5IkvomC7xSiUq1TqBhD6AMgmz2LthFoTIpCEgMNxzhpMf+zppxjfnDPDPZhkzed317HLEAuxAcLfzc+6ZV1gDZ+HUArR3+I3Z/dSwi5wh247c74Qi/sc41fZuhqtPTjeO6Ag2sn5zw28QF/vTkRMWyVqARiBHGkeE5MJjc24eMqZceWSGDwtxqX22kNTyU0ELUeNq94Mynqq4YcCp4bdk/2R/3eRM9ZQLGC0KvdmIizeVq5PI0t1RfdRupLHm8U0AWOpnB1Osxz1Xoab/1npOQABdEEPm+wWq3jIPyDOxtWUjW3EjrYaOnz/6GF0Wme9g7sMkfGC80Uvz3nxNVAT7eqp6bVcnlpGW/zTAbZe8UXBdmL7rjkO/CR5GhI+VOczVobzkkZPLFU5Fi4HqfPyQjXRufFWYjw5XO3hFs9T4hO3z5tl601B/TxGmV+hL0JOJQyZpYEryWxU5ScANAfHdZyPAJVoIm3udj5K1Ry4CIVBE0ltCZ489Kr4KjP4ZhvPMdb3KlNYuR6MJwwi6O85OTqaQAujeKeqk=,iv:eNSqKEW5kxINC4MKuWos1OLQ7f7821ot5JoN7fMFZXw=,tag:JkppEJr3O4aQR415MM5fqg==,type:str]
 sops:
    age:
        - recipient: age1lufn6t35gs4wgevyr2gud4eec7lvkn7pgnnv4tja64ww3hef7gqq8fas37
@@ -38,7 +38,7 @@ sops:
            d0YvYk8vNitDbzNCQ1VqS20xUWx6ZDgK+kIRATTtC0Vd7/uPf8E4pIans79Ksh6J
            Y77+owFFw1AvQ3KvaI7QVfKW61MzxI+S1bWqI3ZNOJ19Qv4ZoVhnVg==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-10-02T18:11:48Z"
-    mac: ENC[AES256_GCM,data:qKoRMXroUtMaH1yrgNQxUPX8FpUmLmNU29zyzfnKkmiLoPsWNsogHxNVkqosyvbW0y0w6XnQh4OrSd4FF3fi8ZuJfk54jDWO7jlXFRk+07OobPgngYvNXLw76BNkXnAtxcduV2cTuSY6XwnwE0LtxFDmkM8N/AxIC8jhKkGQtwY=,iv:n3yBotpOggFvSUnboAG1L7pJMMi1PfV8KsSHN3/Li8c=,tag:4D5TqqroQBZNKUYol/ZCHg==,type:str]
+    lastmodified: "2025-10-10T05:09:54Z"
+    mac: ENC[AES256_GCM,data:N/BwfrwWcnot36Kn6RFZjjpUIluzq5Upy5iVVV4XSs+/0PYdlZGytjoAB+E3gXyPsLZ93UqI0A9/5KbfXBuR2oY2F7iKsu5puzgyYWa0Gl2z9YcPnyDnk1dj7Ne77xJlqR9YquGzFKF8QdqFXFA9cdE3b/1usTFhP26oxofMXs0=,iv:Iz/LzS8yeKQgDiGchYdKNymBeekhopJtBWaQGOwRZlE=,tag:hMRwxJlKR21W7otW01GmGw==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.10.2
+    version: 3.11.0
Author	SHA1	Message	Date
NixOS Builder Bot	360fe268f8	Weekly flake update: 2025-10-11 03:33 UTC	2025-10-10 21:33:27 -06:00
Danilo Reyes	efb98d6d54	sudo-rs All checks were successful Weekly NixOS Build & Cache / build-and-cache (push) Successful in 8m39s Details	2025-10-09 23:42:38 -06:00
Danilo Reyes	d3ec0a04b7	gallery-dl reads secrets on runtime	2025-10-09 23:23:26 -06:00
Danilo Reyes	9eadbb08ab	fixed indentation of secrets	2025-10-09 23:10:00 -06:00
Danilo Reyes	350fc82be9	new keyring isnt compatible with proton yet	2025-10-09 23:01:01 -06:00
NixOS Builder Bot	823c4be1e7	Weekly flake update: 2025-10-06 09:54 UTC	2025-10-06 03:54:05 -06:00
Danilo Reyes	a09d10ab90	replaced stash readonly paths with normal binds All checks were successful Weekly NixOS Build & Cache / build-and-cache (push) Successful in 23m49s Details	2025-10-05 13:12:07 -06:00
Danilo Reyes	84737df99b	fix to have stash plugins work	2025-10-04 19:46:04 -06:00
Danilo Reyes	3746abd6ec	rate limits + reverted keyring	2025-10-04 11:14:31 -06:00