16 changed files with 320 additions and 9 deletions
--- a/configurations.nix
+++ b/configurations.nix
@ -40,7 +40,8 @@ let
    srvos.nixosModules.server

    # srvos.nixosModules.mixins-telegraf
-    # srvos.nixosModules.mixins-terminfo
+    srvos.nixosModules.mixins-trusted-nix-caches
+    srvos.nixosModules.mixins-terminfo

    agenix.nixosModules.default
    ({ pkgs
@ -55,6 +56,11 @@ let
        "nixpkgs=${pkgs.path}"
        "nur=${nur}"
      ];
+
+      environment.systemPackages = [
+        pkgs.kitty.terminfo
+      ];
+
      # TODO: share nixpkgs for each machine to speed up local evaluation.
      #nixpkgs.pkgs = self.inputs.nixpkgs.legacyPackages.${system};

@ -88,7 +94,16 @@ in
          ./hosts/epyc.nix
        ];
      };
+    vieuxtype = nixosSystem {
+      system = "x86_64-linux";
+      modules =
+        commonModules
+        ++ colmenaModules
+        ++ [
+          ./hosts/vieuxtype.nix
+        ];
    };
+  };

  flake.colmena = {
    meta.nixpkgs = import nixpkgs {
@ -101,5 +116,14 @@ in
          ./hosts/epyc.nix
        ];
      };
+    vieuxtype = {
+      system = "x86_64-linux";
+      modules =
+        commonModules
+        ++ [
+          ./hosts/vieuxtype.nix
+        ];
+    };
+
  };
 }
--- a/docs/vieuxtype.lstopo.svg
+++ b/docs/vieuxtype.lstopo.svg
@ -0,0 +1,63 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<svg xmlns='http://www.w3.org/2000/svg' xmlns:xlink='http://www.w3.org/1999/xlink' width='412px' height='462px' viewBox='0 0 412px 462px' version='1.1'>
+	<rect id='Machine_0_rect' class='Machine' x='0' y='0' width='412' height='424' fill='rgb(255,255,255)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='Machine_0_text' class='Machine' font-family='Monospace' x='7' y='17' fill='rgb(0,0,0)' font-size='10px'>Machine (5936MB total)</text>
+	<rect id='Package_0_rect' class='Package' x='7' y='24' width='178' height='255' fill='rgb(210,231,164)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='Package_0_text' class='Package' font-family='Monospace' x='14' y='41' fill='rgb(0,0,0)' font-size='10px'>Package L#0</text>
+	<rect id='L3_0_rect' class='L3' x='14' y='79' width='80' height='24' fill='rgb(255,255,255)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='L3_0_text' class='L3' font-family='Monospace' x='21' y='96' fill='rgb(0,0,0)' font-size='10px'>L3 (16MB)</text>
+	<rect id='L2_0_rect' class='L2' x='14' y='110' width='80' height='24' fill='rgb(255,255,255)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='L2_0_text' class='L2' font-family='Monospace' x='21' y='127' fill='rgb(0,0,0)' font-size='10px'>L2 (4096KB)</text>
+	<rect id='L1d_0_rect' class='L1d' x='14' y='141' width='74' height='24' fill='rgb(255,255,255)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='L1d_0_text' class='L1d' font-family='Monospace' x='21' y='158' fill='rgb(0,0,0)' font-size='10px'>L1d (32KB)</text>
+	<rect id='L1i_0_rect' class='L1i' x='14' y='172' width='74' height='24' fill='rgb(255,255,255)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='L1i_0_text' class='L1i' font-family='Monospace' x='21' y='189' fill='rgb(0,0,0)' font-size='10px'>L1i (32KB)</text>
+	<rect id='Core_0_rect' class='Core' x='14' y='203' width='64' height='69' fill='rgb(190,190,190)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='Core_0_text' class='Core' font-family='Monospace' x='21' y='220' fill='rgb(0,0,0)' font-size='10px'>Core L#0</text>
+	<rect id='PU_0_rect' class='PU' x='21' y='227' width='50' height='38' fill='rgb(255,255,255)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='PU_0_text' class='PU' font-family='Monospace' x='28' y='244' fill='rgb(0,0,0)' font-size='10px'>PU L#0</text>
+	<text id='PU_0_text_1' class='PU' font-family='Monospace' x='37' y='258' fill='rgb(0,0,0)' font-size='10px'>P#0</text>
+	<rect id='NUMANode_0_rect' class='NUMANode' x='14' y='48' width='164' height='24' fill='rgb(239,223,222)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='NUMANode_0_text' class='NUMANode' font-family='Monospace' x='21' y='65' fill='rgb(0,0,0)' font-size='10px'>NUMANode L#0 P#0 (5936MB)</text>
+	<rect id='HostBridge_0_rect' class='HostBridge' x='192' y='24' width='7' height='7' fill='rgb(255,255,255)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<line id='HostBridge_0_line' class='HostBridge' x1='199' y1='27' x2='206' y2='27' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<line id='HostBridge_0_line_2' class='HostBridge' x1='206' y1='27' x2='230' y2='27' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<line id='HostBridge_0_line_3' class='HostBridge' x1='206' y1='103' x2='230' y2='103' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<line id='HostBridge_0_line_4' class='HostBridge' x1='206' y1='134' x2='230' y2='134' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<line id='HostBridge_0_line_5' class='HostBridge' x1='206' y1='165' x2='230' y2='165' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<line id='HostBridge_0_line_6' class='HostBridge' x1='206' y1='241' x2='230' y2='241' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<line id='HostBridge_0_line_7' class='HostBridge' x1='206' y1='303' x2='230' y2='303' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<line id='HostBridge_0_line_8' class='HostBridge' x1='206' y1='365' x2='230' y2='365' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<line id='HostBridge_0_line_1' class='HostBridge' x1='206' y1='27' x2='206' y2='365' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<rect id='PCI_0_rect' class='PCI' x='230' y='24' width='82' height='69' fill='rgb(190,210,149)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='PCI_0_text' class='PCI' font-family='Monospace' x='237' y='41' fill='rgb(0,0,0)' font-size='10px'>PCI 00:01.1</text>
+	<rect id='Block_0_rect' class='Block' x='237' y='48' width='68' height='38' fill='rgb(222,222,222)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='Block_0_text' class='Block' font-family='Monospace' x='244' y='65' fill='rgb(0,0,0)' font-size='10px'>Block sr0</text>
+	<text id='Block_0_text_1' class='Block' font-family='Monospace' x='244' y='79' fill='rgb(0,0,0)' font-size='10px'>541 MB</text>
+	<rect id='PCI_1_rect' class='PCI' x='230' y='100' width='80' height='24' fill='rgb(190,210,149)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='PCI_1_text' class='PCI' font-family='Monospace' x='237' y='117' fill='rgb(0,0,0)' font-size='10px'>PCI 00:02.0</text>
+	<rect id='PCI_2_rect' class='PCI' x='230' y='131' width='80' height='24' fill='rgb(190,210,149)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='PCI_2_text' class='PCI' font-family='Monospace' x='237' y='148' fill='rgb(0,0,0)' font-size='10px'>PCI 00:03.0</text>
+	<rect id='PCI_3_rect' class='PCI' x='230' y='162' width='82' height='69' fill='rgb(190,210,149)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='PCI_3_text' class='PCI' font-family='Monospace' x='237' y='179' fill='rgb(0,0,0)' font-size='10px'>PCI 00:05.0</text>
+	<rect id='Block_1_rect' class='Block' x='237' y='186' width='68' height='38' fill='rgb(222,222,222)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='Block_1_text' class='Block' font-family='Monospace' x='244' y='203' fill='rgb(0,0,0)' font-size='10px'>Block sda</text>
+	<text id='Block_1_text_1' class='Block' font-family='Monospace' x='244' y='217' fill='rgb(0,0,0)' font-size='10px'>40 GB</text>
+	<rect id='PCI_4_rect' class='PCI' x='230' y='238' width='82' height='55' fill='rgb(190,210,149)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='PCI_4_text' class='PCI' font-family='Monospace' x='237' y='255' fill='rgb(0,0,0)' font-size='10px'>PCI 00:12.0</text>
+	<rect id='Net_2_rect' class='Net' x='237' y='262' width='68' height='24' fill='rgb(222,222,222)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='Net_2_text' class='Net' font-family='Monospace' x='244' y='279' fill='rgb(0,0,0)' font-size='10px'>Net ens18</text>
+	<rect id='PCI_5_rect' class='PCI' x='230' y='300' width='82' height='55' fill='rgb(190,210,149)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='PCI_5_text' class='PCI' font-family='Monospace' x='237' y='317' fill='rgb(0,0,0)' font-size='10px'>PCI 00:13.0</text>
+	<rect id='Net_3_rect' class='Net' x='237' y='324' width='68' height='24' fill='rgb(222,222,222)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='Net_3_text' class='Net' font-family='Monospace' x='244' y='341' fill='rgb(0,0,0)' font-size='10px'>Net ens19</text>
+	<rect id='PCI_6_rect' class='PCI' x='230' y='362' width='82' height='55' fill='rgb(190,210,149)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='PCI_6_text' class='PCI' font-family='Monospace' x='237' y='379' fill='rgb(0,0,0)' font-size='10px'>PCI 00:14.0</text>
+	<rect id='Net_4_rect' class='Net' x='237' y='386' width='68' height='24' fill='rgb(222,222,222)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='Net_4_text' class='Net' font-family='Monospace' x='244' y='403' fill='rgb(0,0,0)' font-size='10px'>Net ens20</text>
+	<rect id='Misc_0_rect' class='Misc' x='319' y='24' width='86' height='24' fill='rgb(255,255,255)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='Misc_0_text' class='Misc' font-family='Monospace' x='326' y='41' fill='rgb(0,0,0)' font-size='10px'>MemoryModule</text>
+	<rect id='anon_rect' x='0' y='424' width='412' height='38' fill='rgb(255,255,255)' stroke='rgb(0,0,0)' stroke-width='1'/>
+	<text id='anon_text' font-family='Monospace' x='7' y='441' fill='rgb(0,0,0)' font-size='10px'>Host: vieuxtype</text>
+	<text id='anon_text_1' font-family='Monospace' x='7' y='455' fill='rgb(0,0,0)' font-size='10px'>Date: Mon 05 Jun 2023 08:15:31 PM CEST</text>
+</svg>
--- a/docs/vieuxtype.md
+++ b/docs/vieuxtype.md
@ -0,0 +1,83 @@
+# vieuxtype
+
+```
+System:    Host: vieuxtype Kernel: 6.1.31 x86_64 bits: 64 compiler: gcc v: 12.2.0 
+           parameters: initrd=\efi\nixos\mf13ryz0gl48s8672gzg80lvq9yd8189-initrd-linux-6.1.31-initrd.efi 
+           init=/nix/store/5c8yhqcmf24d61m99cpqc3ffjma90cxs-nixos-system-vieuxtype-23.05.553.e7603eba51f/init 
+           console=ttyS0,115200 panic=30 boot.panic_on_fail loglevel=4 
+           Console: N/A Distro: NixOS 23.05 (Stoat) 
+Machine:   Type: Kvm System: QEMU product: Standard PC (i440FX + PIIX, 1996) v: pc-i440fx-7.2 
+           serial: N/A Chassis: type: 1 v: pc-i440fx-7.2 serial: N/A 
+           Mobo: N/A model: N/A serial: N/A UEFI: EFI Development Kit II / OVMF v: 3.20230228-2 
+           date: 04/04/2023 
+Memory:    RAM: total: 5.8 GiB used: 820.6 MiB (13.8%) 
+           Array-1: capacity: 6 GiB slots: 1 EC: Multi-bit ECC max-module-size: 6 GiB note: est. 
+           Device-1: DIMM 0 size: 6 GiB speed: N/A type: RAM detail: other bus-width: Unknown 
+           total: Unknown manufacturer: QEMU part-no: Not Specified serial: Not Specified 
+PCI Slots: Message: No PCI Slot data found. 
+CPU:       Info: Single Core model: Common KVM bits: 64 type: MCP arch: Netburst Presler 
+           family: F (15) model-id: 6 stepping: 1 microcode: 1 cache: L2: 16 MiB 
+           flags: lm nx pae sse sse2 sse3 bogomips: 5199 
+           Speed: 2600 MHz min/max: N/A base/boost: 2000/2000 Core speed (MHz): 1: 2600 
+           Vulnerabilities: Type: itlb_multihit status: KVM: VMX unsupported 
+           Type: l1tf mitigation: PTE Inversion 
+           Type: mds 
+           status: Vulnerable: Clear CPU buffers attempted, no microcode; SMT Host state unknown 
+           Type: meltdown mitigation: PTI 
+           Type: mmio_stale_data status: Unknown: No mitigations 
+           Type: retbleed status: Not affected 
+           Type: spec_store_bypass status: Vulnerable 
+           Type: spectre_v1 mitigation: usercopy/swapgs barriers and __user pointer sanitization 
+           Type: spectre_v2 
+           mitigation: Retpolines, STIBP: disabled, RSB filling, PBRSB-eIBRS: Not affected 
+           Type: srbds status: Not affected 
+           Type: tsx_async_abort status: Not affected 
+Graphics:  Device-1: vendor: Red Hat driver: bochs-drm v: N/A alternate: bochs bus-ID: 00:02.0 
+           chip-ID: 1234:1111 class-ID: 0300 
+           Display: server: No display server data found. Headless machine? tty: N/A 
+           Message: Advanced graphics data unavailable in console for root. 
+Audio:     Message: No device data found. 
+Network:   Device-1: Intel 82371AB/EB/MB PIIX4 ACPI vendor: Red Hat Qemu virtual machine 
+           type: network bridge driver: piix4_smbus v: N/A modules: i2c_piix4 port: 10c0 
+           bus-ID: 00:01.3 chip-ID: 8086:7113 class-ID: 0680 
+           Device-2: Red Hat Virtio network driver: virtio-pci v: 1 modules: virtio_pci port: 10e0 
+           bus-ID: 00:12.0 chip-ID: 1af4:1000 class-ID: 0200 
+           IF: ens18 state: up speed: -1 duplex: unknown mac: da:3e:b0:11:ae:0a 
+           IP v4: 169.254.129.42/16 type: noprefixroute scope: global broadcast: 169.254.255.255 
+           IP v6: 2a01:e0a:5f9:9681:33ba:55f5:6e55:beef/64 type: temporary dynamic scope: global 
+           IP v6: 2a01:e0a:5f9:9681:d83e:b0ff:fe11:ae0a/64 type: dynamic mngtmpaddr scope: global 
+           IP v6: 2a01:e0a:5f9:9681:a498:fffb:e48d:299/64 scope: global 
+           IP v6: fe80::d83e:b0ff:fe11:ae0a/64 scope: link 
+           Device-3: Red Hat Virtio network driver: virtio-pci v: 1 modules: virtio_pci port: 1400 
+           bus-ID: 00:13.0 chip-ID: 1af4:1000 class-ID: 0200 
+           IF: ens19 state: up speed: -1 duplex: unknown mac: 72:38:5f:a6:82:5a 
+           IP v4: 10.32.64.196/20 type: dynamic noprefixroute scope: global 
+           broadcast: 10.32.79.255 
+           IP v6: fe80::7038:5fff:fea6:825a/64 scope: link 
+           Device-4: Red Hat Virtio network driver: virtio-pci v: 1 modules: virtio_pci port: 1420 
+           bus-ID: 00:14.0 chip-ID: 1af4:1000 class-ID: 0200 
+           IF: ens20 state: up speed: -1 duplex: unknown mac: 8e:38:09:a2:8c:9e 
+           IP v4: 10.32.64.224/20 type: dynamic noprefixroute scope: global 
+           broadcast: 10.32.79.255 
+           IP v6: fe80::8c38:9ff:fea2:8c9e/64 scope: link 
+           IF-ID-1: tailscale0 state: unknown speed: -1 duplex: full mac: N/A 
+           IP v6: fe80::7d4f:3369:71cc:66d5/64 virtual: stable-privacy scope: link 
+           WAN IP: 82.65.118.1 
+Drives:    Local Storage: total: 40 GiB used: 10.33 GiB (25.8%) 
+           ID-1: /dev/sda maj-min: 8:0 vendor: QEMU model: HARDDISK size: 40 GiB block-size: 
+           physical: 512 B logical: 512 B speed: <unknown> serial: drive-scsi0 rev: 2.5+ 
+           scheme: GPT 
+           SMART: no 
+Partition: ID-1: / raw-size: 11.5 GiB size: 11.22 GiB (97.55%) used: 10.27 GiB (91.6%) fs: ext4 
+           block-size: 4096 B dev: /dev/sda1 maj-min: 8:1 
+           ID-2: /boot raw-size: 511 MiB size: 510 MiB (99.80%) used: 54.9 MiB (10.8%) fs: vfat 
+           block-size: 512 B dev: /dev/sda3 maj-min: 8:3 
+Swap:      Kernel: swappiness: 60 (default) cache-pressure: 100 (default) 
+           ID-1: swap-1 type: partition size: 8 GiB used: 0 KiB (0.0%) priority: -2 dev: /dev/sda2 
+           maj-min: 8:2 
+Sensors:   Message: No sensor data found. Is lm-sensors configured? 
+Info:      Processes: 107 Uptime: N/A wakeups: 1 Init: systemd v: 253 target: multi-user.target 
+           tool: systemctl Compilers: gcc: 12.2.0 Packages: 899 nix-default: 9 nix-sys: 881 
+           lib: 155 nix-usr: 9 lib: 3 Client: Sudo v: 1.9.13p3 inxi: 3.3.04 
+```
+![hardware topology](vieuxtype.lstopo.svg)
--- a/hosts/epyc.nix
+++ b/hosts/epyc.nix
@ -2,6 +2,7 @@
  imports = [
    ../modules/ipmi-supermicro.nix
    ../modules/hardware/supermicro-H12SSL-i.nix
+    ../modules/iperf-server.nix
  ];

  networking.hostName = "epyc";
--- a/hosts/vieuxtype.nix
+++ b/hosts/vieuxtype.nix
@ -0,0 +1,28 @@
+{
+  imports = [
+    ../modules/hardware/vm.nix
+    ../modules/gitea.nix
+    ../modules/tailscale.nix
+    ../modules/users/yvan.nix
+  ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/fe1d2e0d-9210-4a2d-b584-d1e131747ea3";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/8782-7801";
+    fsType = "vfat";
+  };
+
+  swapDevices =
+    [{ device = "/dev/disk/by-uuid/c9511ddb-e41f-436c-ad1f-9b587ed0ba11"; }];
+
+  networking.hostName = "vieuxtype";
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # simd.arch = "znver3";
+  system.stateVersion = "23.05";
+}
--- a/modules/builder.nix
+++ b/modules/builder.nix
@ -4,6 +4,7 @@
    home = "/home/nix";
    openssh.authorizedKeys.keys = [
      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAZpEtSfB0GDwcELc5/AKNiBZJV9OVfQ0BMFzBlF+8Yd raito@everywhere"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA3hCOyFwuoCLt5W9e9yQSwj9I+VspB0kNNHsoFngbgZ raito@thors"
    ];
    uid = 5001;
  };
--- a/modules/gitea.nix
+++ b/modules/gitea.nix
@ -0,0 +1,34 @@
+{ ... }: {
+  services.gitea = {
+    enable = true;
+    appName = "Newtype's Git";
+    mailerPasswordFile = "/var/lib/secrets/gitea/mailpw";
+    settings = {
+      server = {
+        ROOT_URL = "https://git.newtype.fr";
+        DOMAIN = "git.newtype.fr";
+      };
+      service.DISABLE_REGISTRATION = true;
+      session.COOKIE_SECURE = true;
+      mailer = {
+        ENABLED = true;
+        HOST = "mail.gandi.net:465";
+        USER = "git@newtype.fr";
+        FROM = "Newtype's Git <git@newtype.fr>";
+        IS_TLS_ENABLED = true;
+      };
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."git.newtype.fr" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = { proxyPass = "http://127.0.0.1:3000"; };
+    };
+  };
+
+  security.acme.certs = { "git.newtype.fr".email = "contact@newtype.fr"; };
+  security.acme.acceptTerms = true;
+}
--- a/modules/hardware/vm.nix
+++ b/modules/hardware/vm.nix
@ -0,0 +1,14 @@
+{ lib, modulesPath, ... }: {
+  imports = [ "${modulesPath}/profiles/qemu-guest.nix" ];
+
+  boot.initrd.availableKernelModules =
+    [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  services.qemuGuest.enable = true;
+
+  # VMs are noisy for this type of thing usually.
+  nix.settings.max-jobs = lib.mkDefault 1;
+}
--- a/modules/hosts.nix
+++ b/modules/hosts.nix
@ -37,11 +37,14 @@ in
      )
        "Please add network configuration for ${config.networking.hostName}. None found in ${./hosts.nix}";

-    # usually, for each host there is a hostname.dse.in.tum.de and hostname.r domain
+    # usually, for each host there is a hostname.infra.newtype.fr
    networking.newtype.hosts = {
      epyc = {
        ipv6 = "2001:470:ca5e:dee:587c:7a50:f36c:cae8";
      };
+      vieuxtype = {
+        ipv6 = "2a01:e0a:5f9:9681:a498:fffb:e48d:299";
+      };
    };
  };
 }
--- a/modules/iperf-server.nix
+++ b/modules/iperf-server.nix
@ -0,0 +1,6 @@
+{ ... }: {
+  services.iperf3 = {
+    enable = true;
+    openFirewall = true;
+  };
+}
--- a/modules/nix-daemon.nix
+++ b/modules/nix-daemon.nix
@ -24,11 +24,19 @@ in

  config = {
    warnings = lib.optionals (config.simd.arch == null) [ "Please set simd.arch for ${config.networking.hostName}" ];
+    # Allow more open files for non-root users to run NixOS VM tests.
+    security.pam.loginLimits = [
+      { domain = "*"; item = "nofile"; type = "-"; value = "20480"; }
+    ];

    nix = {
+      # Garbage-collect often
      gc.automatic = true;
-      gc.dates = "03:15";
-      gc.options = "--delete-older-than 30d";
+      gc.dates = "*:45";
+      gc.options = ''--max-freed "$((128 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
+
+      # Randomize GC to avoid thundering herd effects.
+      gc.randomizedDelaySec = "1800";

      # 2.11, 2.12 suffers from a bug with remote builders…
      package = pkgs.nixVersions.nix_2_13;
--- a/modules/packages.nix
+++ b/modules/packages.nix
@ -1,4 +1,7 @@
 { pkgs, ... }: {
+  # documentation.dev.enable = true;
+  # environment.extraOutputsToInstall = [ "info" "man" "devman" ];
+
  # this extends the list from:
  # https://github.com/numtide/srvos/blob/master/server.nix#L10
  environment.systemPackages = with pkgs; [
@ -34,6 +37,23 @@
    usbutils

    ipmitool
+
+    (neovim.override {
+      viAlias = true;
+      vimAlias = true;
+      configure = {
+        packages.myPlugins = with pkgs.vimPlugins; {
+          start = [ vim-lastplace vim-nix ];
+          opt = [ ];
+        };
+      };
+    })
+
    # tries to default to soft-float due to out-dated cc-rs
  ] ++ lib.optional (!stdenv.hostPlatform.isRiscV) bandwhich;
+
+  programs.vim.defaultEditor = true;
+  environment.variables = { EDITOR = "nvim"; };
+  programs.mosh.enable = true;
+  programs.tmux.enable = true;
 }
--- a/modules/tailscale.nix
+++ b/modules/tailscale.nix
@ -0,0 +1,5 @@
+{ config, ... }: {
+  services.tailscale.enable = true;
+  networking.firewall.checkReversePath = "loose";
+  networking.firewall.allowedUDPPorts = [ config.services.tailscale.port ];
+}
--- a/modules/users/admins.nix
+++ b/modules/users/admins.nix
@ -13,7 +13,6 @@ in
        isNormalUser = true;
        home = "/home/raito";
        inherit extraGroups;
-        shell = "/run/current-system/sw/bin/zsh";
        uid = 1000;
        openssh.authorizedKeys.keyFiles = [ ./keys/raito.keys ];
      };
@ -23,7 +22,6 @@ in
        isNormalUser = true;
        home = "/home/luj";
        inherit (config.users.users.raito) extraGroups;
-        shell = "/run/current-system/sw/bin/zsh";
        uid = 1001;
        openssh.authorizedKeys.keyFiles = [ ./keys/luj.keys ];
      };
@ -33,7 +31,6 @@ in
        isNormalUser = true;
        home = "/home/gdd";
        inherit (config.users.users.raito) extraGroups;
-        shell = "/run/current-system/sw/bin/zsh";
        uid = 1002;
        openssh.authorizedKeys.keyFiles = [ ./keys/gdd.keys ];
      };
@ -43,7 +40,6 @@ in
        isNormalUser = true;
        home = "/home/akechi";
        inherit (config.users.users.raito) extraGroups;
-        shell = "/run/current-system/sw/bin/zsh";
        uid = 1003;
        openssh.authorizedKeys.keyFiles = [ ./keys/akechi.keys ];
      };
@ -53,7 +49,6 @@ in
        isNormalUser = true;
        home = "/home/tomate";
        inherit (config.users.users.raito) extraGroups;
-        shell = "/run/current-system/sw/bin/zsh";
        uid = 1004;
        openssh.authorizedKeys.keyFiles = [ ./keys/tomate.keys ];
      };
--- a/modules/users/yvan.nix
+++ b/modules/users/yvan.nix
@ -0,0 +1,17 @@
+{ ... }: {
+  users.users.yvan = {
+    isNormalUser = true;
+    home = "/home/yvan";
+    description = "Yvan's account";
+    extraGroups = [ "wheel" "www-data" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCdMWQ1D9VJNrIzvgU8QMQwhy7Q/OFI9JNLpo/Kr0uXCeZBtSn9eMzZa88Q8gDaHnlc/BlTnlSomWP/S9u8+j21d+rXgDyPgJUqMjGBxFo4lZue3DlACXKQcwWXiNlGQKFPzSNBN62N3cRwm1R7Won9xVwedS4UnxsXbOGHkBnajQx40Ej3WRVBVbSjKKGaZKKCNO5hfistRP7RtqhwxYK7D/CyOfwnIUuBAnC3QYDYDph7SD2E5OX3rKwPDPnei0zaIMMXyFrMtv/czYOsisOud2H/VX0vipQh59qji/ZNSE31LemF4VcvC1307JX3uEwSfVWiBsWGPGfc/epQ4ixl yvan@X230" # Yvan's X230
+    ];
+  };
+
+  services.mastodon = {
+    enable = true;
+    smtp = { host = "mail.gandi.net"; fromAddress = "yvan@sraka.xyz"; };
+    localDomain = "sraka.xyz";
+  };
+}
--- a/modules/zsh.nix
+++ b/modules/zsh.nix
@ -5,4 +5,13 @@
  programs.zsh.interactiveShellInit = ''
    source ${pkgs.zsh-nix-shell}/share/zsh-nix-shell/nix-shell.plugin.zsh
  '';
+
+  programs.zsh = {
+    autosuggestions.enable = true;
+    promptInit = ''
+      source ${pkgs.grml-zsh-config}/etc/zsh/zshrc
+    '';
+  };
+
+  users.defaultUserShell = pkgs.zsh;
 }