summary refs log tree commit diff stats
path: root/system/settings
diff options
context:
space:
mode:
Diffstat (limited to 'system/settings')
-rw-r--r--system/settings/colmena-auto-upgrade.nix255
-rw-r--r--system/settings/configuration/england.nix10
-rw-r--r--system/settings/configuration/nix-linux.nix10
-rw-r--r--system/settings/configuration/nix.nix9
-rw-r--r--system/settings/darwin.nix20
-rw-r--r--system/settings/dev.nix31
-rw-r--r--system/settings/gaming.nix2
-rw-r--r--system/settings/hardware/bluetooth-audio.nix10
-rw-r--r--system/settings/pin.nix14
-rw-r--r--system/settings/programs/nh.nix20
-rw-r--r--system/settings/services/git-server.nix49
-rw-r--r--system/settings/user-interface.nix2
12 files changed, 310 insertions, 122 deletions
diff --git a/system/settings/colmena-auto-upgrade.nix b/system/settings/colmena-auto-upgrade.nix
new file mode 100644
index 00000000..b9b84e88
--- /dev/null
+++ b/system/settings/colmena-auto-upgrade.nix
@@ -0,0 +1,255 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.colmenaAutoUpgrade;
+
+  mainScript =
+    let
+      colmena = "${pkgs.colmena}/bin/colmena";
+      date = "${pkgs.coreutils}/bin/date";
+      readlink = "${pkgs.coreutils}/bin/readlink";
+      shutdown = "${config.systemd.package}/bin/shutdown";
+    in
+    if cfg.allowReboot then
+      ''
+        ${colmena} apply-local boot
+        booted="$(${readlink} /run/booted-system/{initrd,kernel,kernel-modules})"
+        built="$(${readlink} /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
+
+        ${lib.optionalString (cfg.rebootWindow != null) ''
+          current_time="$(${date} +%H:%M)"
+
+          lower="${cfg.rebootWindow.lower}"
+          upper="${cfg.rebootWindow.upper}"
+
+          if [[ "''${lower}" < "''${upper}" ]]; then
+            if [[ "''${current_time}" > "''${lower}" ]] && \
+                [[ "''${current_time}" < "''${upper}" ]]; then
+              do_reboot="true"
+            else
+              do_reboot="false"
+            fi
+          else
+            # lower > upper, so we are crossing midnight (e.g. lower=23h, upper=6h)
+            # we want to reboot if cur > 23h or cur < 6h
+            if [[ "''${current_time}" < "''${upper}" ]] || \
+            [[ "''${current_time}" > "''${lower}" ]]; then
+              do_reboot="true"
+            else
+              do_reboot="false"
+            fi
+          fi
+        ''}
+
+        if [ "''${booted}" = "''${built}" ]; then
+          ${colmena} apply-local switch
+          ${lib.optionalString (cfg.rebootWindow != null) ''
+        elif [ "''${do_reboot}" != true ]; then
+          echo "Outside of configured reboot window, skipping."
+        ''}
+        else
+          ${shutdown} -r +1
+        fi
+      ''
+    else
+      ''
+        ${colmena} apply-local switch
+      ''
+  ;
+in
+{
+  options.services.colmenaAutoUpgrade = {
+    enable = lib.mkEnableOption {
+      default = false;
+      description = "Enable automatic upgrades for Colmena";
+    };
+
+    git = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkEnableOption "Whether to pull the latest changes from the Git repository before upgrading.";
+
+          branch = lib.mkOption {
+            type = lib.types.str;
+            default = "origin/main";
+            description = "Git branch to checkout after fetching";
+          };
+        };
+      };
+    };
+
+    preUpgradeHook = lib.mkOption {
+      type = lib.types.str;
+      default = "";
+      description = "Commands to run before upgrade";
+      example = lib.literalExpression ''
+        $${pkgs.npins}/bin/npins update
+      '';
+    };
+
+    useNixShell = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = ''
+        Whether to run colmena in a nix-shell.
+      '';
+    };
+
+    dates = lib.mkOption {
+      type = lib.types.str;
+      default = "04:40";
+      example = "daily";
+      description = ''
+        How often or when upgrade occurs. For most desktop and server systems
+        a sufficient upgrade frequency is once a day.
+
+        The format is described in
+        {manpage}`systemd.time(7)`.
+      '';
+    };
+
+    allowReboot = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      description = ''
+        Reboot the system into the new generation instead of a switch
+        if the new generation uses a different kernel, kernel modules
+        or initrd than the booted system.
+        See {option}`rebootWindow` for configuring the times at which a reboot is allowed.
+      '';
+    };
+
+    randomizedDelaySec = lib.mkOption {
+      default = "0";
+      type = lib.types.str;
+      example = "45min";
+      description = ''
+        Add a randomized delay before each automatic upgrade.
+        The delay will be chosen between zero and this value.
+        This value must be a time span in the format specified by
+        {manpage}`systemd.time(7)`
+      '';
+    };
+
+    fixedRandomDelay = lib.mkOption {
+      default = false;
+      type = lib.types.bool;
+      example = true;
+      description = ''
+        Make the randomized delay consistent between runs.
+        This reduces the jitter between automatic upgrades.
+        See {option}`randomizedDelaySec` for configuring the randomized delay.
+      '';
+    };
+
+    rebootWindow = lib.mkOption {
+      description = ''
+        Define a lower and upper time value (in HH:MM format) which
+        constitute a time window during which reboots are allowed after an upgrade.
+        This option only has an effect when {option}`allowReboot` is enabled.
+        The default value of `null` means that reboots are allowed at any time.
+      '';
+      default = null;
+      example = {
+        lower = "01:00";
+        upper = "05:00";
+      };
+      type =
+        with lib.types;
+        nullOr (submodule {
+          options = {
+            lower = lib.mkOption {
+              description = "Lower limit of the reboot window";
+              type = lib.types.strMatching "[[:digit:]]{2}:[[:digit:]]{2}";
+              example = "01:00";
+            };
+
+            upper = lib.mkOption {
+              description = "Upper limit of the reboot window";
+              type = lib.types.strMatching "[[:digit:]]{2}:[[:digit:]]{2}";
+              example = "05:00";
+            };
+          };
+        });
+    };
+
+    persistent = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
+      example = false;
+      description = ''
+        Takes a boolean argument. If true, the time when the service
+        unit was last triggered is stored on disk. When the timer is
+        activated, the service unit is triggered immediately if it
+        would have been triggered at least once during the time when
+        the timer was inactive. Such triggering is nonetheless
+        subject to the delay imposed by RandomizedDelaySec=. This is
+        useful to catch up on missed runs of the service when the
+        system was powered down.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.colmena-auto-upgrade = {
+      description = "Upgrade nixos with colmena";
+
+      restartIfChanged = false;
+      unitConfig.X-StopOnRemoval = false;
+
+      serviceConfig.Type = "oneshot";
+
+      environment =
+        config.nix.envVars
+        // {
+          inherit (config.environment.sessionVariables) NIX_PATH;
+          HOME = "/root";
+        }
+        // config.networking.proxy.envVars;
+
+      path = with pkgs; [
+        coreutils
+        gnutar
+        xz.bin
+        gzip
+        gitMinimal
+        colmena
+        config.nix.package.out
+        config.programs.ssh.package
+      ];
+
+      serviceConfig.WorkingDirectory = "/etc/nixos";
+      script =
+        let
+          git = "${pkgs.gitMinimal}/bin/git";
+          nix-shell = "${pkgs.nix}/bin/nix-shell";
+        in
+        ''
+          ${lib.optionalString cfg.git.enable
+            ''
+            ${git} fetch --prune
+            ${git} checkout ${cfg.git.branch}
+            ''
+          }
+
+          ${cfg.preUpgradeHook}
+
+          ${if cfg.useNixShell then ''
+            ${nix-shell} --run "${pkgs.writeShellScript "colmena-auto-upgrade" mainScript}"
+          ''
+          else mainScript
+          }
+        '';
+      startAt = cfg.dates;
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+    };
+
+    systemd.timers.colmena-auto-upgrade = {
+      timerConfig = {
+        RandomizedDelaySec = cfg.randomizedDelaySec;
+        FixedRandomDelay = cfg.fixedRandomDelay;
+        Persistent = cfg.persistent;
+      };
+    };
+  };
+}
diff --git a/system/settings/configuration/england.nix b/system/settings/configuration/england.nix
deleted file mode 100644
index 1323b292..00000000
--- a/system/settings/configuration/england.nix
+++ /dev/null
@@ -1,10 +0,0 @@
-{ config
-, pkgs
-, ...
-}: {
-  time.timeZone = "Europe/London";
-  services.redshift = {
-    latitude = 52.2394;
-    longitude = -0.9416;
-  };
-}
diff --git a/system/settings/configuration/nix-linux.nix b/system/settings/configuration/nix-linux.nix
index e11b0389..1c26bc7e 100644
--- a/system/settings/configuration/nix-linux.nix
+++ b/system/settings/configuration/nix-linux.nix
@@ -1,5 +1,4 @@
 { config
-, lib
 , pkgs
 , ...
 }: {
@@ -11,20 +10,11 @@
     settings = {
       auto-optimise-store = true;
     };
-    daemonCPUSchedPolicy = "idle";
-    daemonIOSchedClass = "idle";
   };
 
   nixpkgs.config.allowUnfree = true;
 
   system.autoUpgrade = {
     enable = true;
-    flags = [ "--max-jobs" "2" ];
-  };
-  systemd.services.nixos-upgrade = {
-    script = pkgs.lib.mkForce ''
-      ${pkgs.nix}/bin/nix-channel --update
-      ${config.system.build.nixos-rebuild}/bin/nixos-rebuild boot --no-build-output ${toString config.system.autoUpgrade.flags}
-    '';
   };
 }
diff --git a/system/settings/configuration/nix.nix b/system/settings/configuration/nix.nix
index 105efaae..ad4e762c 100644
--- a/system/settings/configuration/nix.nix
+++ b/system/settings/configuration/nix.nix
@@ -1,24 +1,27 @@
-{ config
-, lib
+{ inputs
 , pkgs
+, lib
 , ...
 }: {
+  imports = [ ../pin.nix ];
   nix = {
+    package = pkgs.lix;
     settings = {
       cores = lib.mkDefault 0;
       use-xdg-base-directories = true;
       keep-outputs = true;
       keep-derivations = true;
-      experimental-features = "nix-command flakes";
       warn-dirty = false;
       substituters = [
         "https://nix-community.cachix.org"
         "https://binarycache.alanpearce.eu"
+        "https://cache.lix.systems"
       ];
 
       trusted-public-keys = [
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
         "binarycache.alanpearce.eu:ZwqO3XMuajPictjwih8OY2+RXnOKpjZEZFHJjGSxAI4="
+        "cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o="
       ];
     };
 
diff --git a/system/settings/darwin.nix b/system/settings/darwin.nix
index 0f507a31..233c5b17 100644
--- a/system/settings/darwin.nix
+++ b/system/settings/darwin.nix
@@ -7,7 +7,6 @@
     ./configuration/nix.nix
   ];
   services.nix-daemon = {
-    enable = true;
     enableSocketListener = true;
   };
 
@@ -16,9 +15,7 @@
     [ "/run/current-system/sw" "/nix/var/nix/profiles/default" ]
   ];
 
-  environment.darwinConfig = "$HOME/.config/nixpkgs/darwin-configuration.nix";
   nix = {
-    daemonIOLowPriority = true;
     settings.extra-platforms = "aarch64-darwin x86_64-darwin";
 
     settings.trusted-users = [ "@admin" ];
@@ -28,23 +25,6 @@
     allowUnfree = true;
   };
 
-  # needed so that nix-darwin can activate the system as root
-  security.sudo.extraConfig = ''
-    Defaults	env_keep += "NIX_PATH"
-  '';
-
-  services.lorri.enable = true;
-  launchd.user.agents.lorri = {
-    serviceConfig = {
-      RunAtLoad = lib.mkForce false;
-      Sockets = {
-        daemon = {
-          SockPathName = "${(builtins.getEnv "HOME")}/Library/Caches/com.github.target.lorri.lorri.lorri/daemon.socket";
-        };
-      };
-    };
-  };
-
   environment.launchDaemons = {
     "limit.maxfiles.plist" = {
       text = ''
diff --git a/system/settings/dev.nix b/system/settings/dev.nix
index b1817914..c0937ec0 100644
--- a/system/settings/dev.nix
+++ b/system/settings/dev.nix
@@ -24,18 +24,15 @@
           '';
         };
         # need to test forwarding behaviour
-        "https://alanpearce.localhost" = {
+        "alanpearce.localhost" = {
           logFormat = "output discard";
           serverAliases = [
-            "http://alanpearce.localhost"
-
             # remember to update /etc/hosts
-            "https://alanpearce.test"
-            "http://alanpearce.test"
+            "alanpearce.test"
           ];
           extraConfig = ''
             ${local_tls}
-            reverse_proxy http://alanpearce.test:8080 {
+            reverse_proxy http://alanpearce.localhost:8080 {
               transport http {
                 dial_timeout 1s
                 compression off
@@ -54,6 +51,28 @@
             }
           '';
         };
+        "perplexica-backend.localhost" = {
+          logFormat = "output discard";
+          extraConfig = ''
+            reverse_proxy http://localhost:8339 {
+              transport http {
+                dial_timeout 1s
+                compression off
+              }
+            }
+          '';
+        };
+        "perplexica.localhost" = {
+          logFormat = "output discard";
+          extraConfig = ''
+            reverse_proxy http://localhost:8338 {
+              transport http {
+                dial_timeout 1s
+                compression off
+              }
+            }
+          '';
+        };
       };
   };
 }
diff --git a/system/settings/gaming.nix b/system/settings/gaming.nix
index d11d5a3c..2ba1fb33 100644
--- a/system/settings/gaming.nix
+++ b/system/settings/gaming.nix
@@ -23,7 +23,7 @@
     enable = true;
     enable32Bit = true;
   };
-  hardware.pulseaudio.support32Bit = true;
+  services.pulseaudio.support32Bit = true;
   services.pipewire.alsa.support32Bit = true;
 
   systemd = {
diff --git a/system/settings/hardware/bluetooth-audio.nix b/system/settings/hardware/bluetooth-audio.nix
index d368cb29..29a38acf 100644
--- a/system/settings/hardware/bluetooth-audio.nix
+++ b/system/settings/hardware/bluetooth-audio.nix
@@ -6,10 +6,10 @@
     bluetooth = {
       package = pkgs.bluezFull;
     };
-    pulseaudio = {
-      extraModules = with pkgs; [
-        pulseaudio-modules-bt
-      ];
-    };
+  };
+  services.pulseaudio = {
+    extraModules = with pkgs; [
+      pulseaudio-modules-bt
+    ];
   };
 }
diff --git a/system/settings/pin.nix b/system/settings/pin.nix
new file mode 100644
index 00000000..2ff2e773
--- /dev/null
+++ b/system/settings/pin.nix
@@ -0,0 +1,14 @@
+let
+  inherit (import ../../sources.nix) sources;
+in
+{
+  nix = {
+    nixPath = [
+      "nixpkgs=flake:nixpkgs"
+    ];
+    registry.nixpkgs.to = {
+      type = "path";
+      path = sources.nixpkgs;
+    };
+  };
+}
diff --git a/system/settings/programs/nh.nix b/system/settings/programs/nh.nix
deleted file mode 100644
index 10738de0..00000000
--- a/system/settings/programs/nh.nix
+++ /dev/null
@@ -1,20 +0,0 @@
-{ config, ... }: {
-  programs.nh =
-    let
-      flake = builtins.toString ../../..;
-    in
-    {
-      enable = true;
-      os = {
-        inherit flake;
-      };
-      home = {
-        inherit flake;
-      };
-      clean = {
-        enable = true;
-        extraArgs = "--keep-since 14d";
-      };
-    };
-  nix.gc.automatic = !config.programs.nh.clean.enable;
-}
diff --git a/system/settings/services/git-server.nix b/system/settings/services/git-server.nix
index 1560e8f5..5919ab87 100644
--- a/system/settings/services/git-server.nix
+++ b/system/settings/services/git-server.nix
@@ -27,6 +27,7 @@ let
     nixfiles = [ "sourcehut" ];
     searchix = [ "sourcehut" ];
     website = [ "sourcehut" ];
+    homestead = [ "sourcehut" ];
     nix-packages = [ "sourcehut" "github" ];
     zola-bearblog = [ "sourcehut" "codeberg" ];
   };
@@ -77,7 +78,7 @@ in
   };
   services.gitolite = {
     enable = true;
-    adminPubkey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII8VIII+598QOBxi/52O1Kb19RdUdX0aZmS1/dNoyqc5 alan@hetzner.strongbox";
+    adminPubkey = "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBHYUyDdw92TNXguAxcmcmZmn/7ECGdRp6ckjxU+5zCw3BCnsS5+xEvHBVnnFdJRoH2XpfMeJjE+fi67zFVhlbn4= root@secretive.marvin";
     extraGitoliteRc = ''
       $RC{UMASK} = 0027;
       $RC{LOG_EXTRA} = 0;
@@ -151,6 +152,7 @@ in
           @git_http_backend path_regexp "^.*/(HEAD|info/refs|objects/info/[^/]+|git-upload-pack)$"
           handle @git_http_backend {
             reverse_proxy ${fcgisocket} {
+              request_buffers 4k
               transport fastcgi {
                 env SCRIPT_FILENAME ${pkgs.git}/libexec/git-core/git-http-backend
                 env GIT_PROJECT_ROOT ${repos}
@@ -223,51 +225,6 @@ in
       };
   };
 
-  programs.ssh = with pkgs; {
-    knownHostsFiles = [
-      (writeText "github.keys" ''
-        # github.com:22 SSH-2.0-babeld-05989c77
-        # github.com:22 SSH-2.0-babeld-05989c77
-        # github.com:22 SSH-2.0-babeld-05989c77
-        # github.com:22 SSH-2.0-babeld-05989c77
-        # github.com:22 SSH-2.0-babeld-05989c77
-        github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
-        github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
-        github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
-      '')
-      (writeText "gitlab.keys" ''
-        # gitlab.com:22 SSH-2.0-GitLab-SSHD
-        # gitlab.com:22 SSH-2.0-GitLab-SSHD
-        # gitlab.com:22 SSH-2.0-GitLab-SSHD
-        # gitlab.com:22 SSH-2.0-GitLab-SSHD
-        # gitlab.com:22 SSH-2.0-GitLab-SSHD
-        gitlab.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCsj2bNKTBSpIYDEGk9KxsGh3mySTRgMtXL583qmBpzeQ+jqCMRgBqB98u3z++J1sKlXHWfM9dyhSevkMwSbhoR8XIq/U0tCNyokEi/ueaBMCvbcTHhO7FcwzY92WK4Yt0aGROY5qX2UKSeOvuP4D6TPqKF1onrSzH9bx9XUf2lEdWT/ia1NEKjunUqu1xOB/StKDHMoX4/OKyIzuS0q/T1zOATthvasJFoPrAjkohTyaDUz2LN5JoH839hViyEG82yB+MjcFV5MU3N1l1QL3cVUCh93xSaua1N85qivl+siMkPGbO5xR/En4iEY6K2XPASUEMaieWVNTRCtJ4S8H+9
-        gitlab.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFSMqzJeV9rUzU4kWitGjeR4PWSa29SPqJ1fVkhtj3Hw9xjLVXVYrU9QlYWrOLXBpQ6KWjbjTDTdDkoohFzgbEY=
-        gitlab.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAfuCHKVTjquxvt6CM6tdG4SLp1Btn/nOeHHE5UOzRdf
-      '')
-      (writeText "codeberg.keys" ''
-        # codeberg.org:22 SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u2
-        # codeberg.org:22 SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u2
-        # codeberg.org:22 SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u2
-        # codeberg.org:22 SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u2
-        # codeberg.org:22 SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u2
-        codeberg.org ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8hZi7K1/2E2uBX8gwPRJAHvRAob+3Sn+y2hxiEhN0buv1igjYFTgFO2qQD8vLfU/HT/P/rqvEeTvaDfY1y/vcvQ8+YuUYyTwE2UaVU5aJv89y6PEZBYycaJCPdGIfZlLMmjilh/Sk8IWSEK6dQr+g686lu5cSWrFW60ixWpHpEVB26eRWin3lKYWSQGMwwKv4LwmW3ouqqs4Z4vsqRFqXJ/eCi3yhpT+nOjljXvZKiYTpYajqUC48IHAxTWugrKe1vXWOPxVXXMQEPsaIRc2hpK+v1LmfB7GnEGvF1UAKnEZbUuiD9PBEeD5a1MZQIzcoPWCrTxipEpuXQ5Tni4mN
-        codeberg.org ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBL2pDxWr18SoiDJCGZ5LmxPygTlPu+cCKSkpqkvCyQzl5xmIMeKNdfdBpfbCGDPoZQghePzFZkKJNR/v9Win3Sc=
-        codeberg.org ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIVIC02vnjFyL+I4RHfvIGNtOgJMe769VTF1VR4EB3ZB
-      '')
-      (writeText "sr.ht.keys" ''
-        # git.sr.ht:22 SSH-2.0-OpenSSH_9.6
-        # git.sr.ht:22 SSH-2.0-OpenSSH_9.6
-        # git.sr.ht:22 SSH-2.0-OpenSSH_9.6
-        # git.sr.ht:22 SSH-2.0-OpenSSH_9.6
-        # git.sr.ht:22 SSH-2.0-OpenSSH_9.6
-        git.sr.ht ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDZ+l/lvYmaeOAPeijHL8d4794Am0MOvmXPyvHTtrqvgmvCJB8pen/qkQX2S1fgl9VkMGSNxbp7NF7HmKgs5ajTGV9mB5A5zq+161lcp5+f1qmn3Dp1MWKp/AzejWXKW+dwPBd3kkudDBA1fa3uK6g1gK5nLw3qcuv/V4emX9zv3P2ZNlq9XRvBxGY2KzaCyCXVkL48RVTTJJnYbVdRuq8/jQkDRA8lHvGvKI+jqnljmZi2aIrK9OGT2gkCtfyTw2GvNDV6aZ0bEza7nDLU/I+xmByAOO79R1Uk4EYCvSc1WXDZqhiuO2sZRmVxa0pQSBDn1DB3rpvqPYW+UvKB3SOz
-        git.sr.ht ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCj6y+cJlqK3BHZRLZuM+KP2zGPrh4H66DacfliU1E2DHAd1GGwF4g1jwu3L8gOZUTIvUptqWTkmglpYhFp4Iy4=
-        git.sr.ht ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZvRd4EtM7R+IHVMWmDkVU3VLQTSwQDSAvW0t2Tkj60
-      '')
-    ];
-  };
-
   systemd.services = concatMapAttrs createMirrorService mirrors;
   systemd.paths = concatMapAttrs createMirrorPath mirrors;
   systemd.targets.git-mirroring = {
diff --git a/system/settings/user-interface.nix b/system/settings/user-interface.nix
index 27f1d9aa..a1d31c3b 100644
--- a/system/settings/user-interface.nix
+++ b/system/settings/user-interface.nix
@@ -6,7 +6,7 @@
   documentation.info.enable = true;
 
   environment.systemPackages = with pkgs; [
-    epdfview
+    qpdfview
 
     lxappearance
     lxrandr
generated by cgit-pink 1.4.1 (git 2.36.1) at 2025-03-15 21:15:31 +0000