1 files changed, 186 insertions, 91 deletions

diff --git a/accounts/gkleen@sif/systemd.nix b/accounts/gkleen@sif/systemd.nix
index 119d8cc3..51671b20 100644
--- a/accounts/gkleen@sif/systemd.nix
+++ b/accounts/gkleen@sif/systemd.nix
@@ -6,7 +6,7 @@ let
   cfg = config.home-manager.users.${userName};
 
   autossh-socks-script = pkgs.writeScript "autossh" ''
-    #!${pkgs.zsh}/bin/zsh -xe
+    #!${lib.getExe pkgs.zsh} -xe
 
     host="''${1%:*}"
     port="''${1#*:}"
@@ -15,31 +15,29 @@ let
     cmd=()
 
     if [[ -n "''${SSHPASS_SECRET}" ]]; then
-      cmd+=(${pkgs.sshpassSecret}/bin/sshpass-secret)
+      cmd+=(${lib.getExe' pkgs.sshpassSecret "sshpass-secret"})
       cmd+=("''${(@s/:/)SSHPASS_SECRET}")
       cmd+=(--)
     fi
 
-    cmd+=(${pkgs.openssh}/bin/ssh -vN -D localhost:''${port} "''${host}")
+    cmd+=(${lib.getExe' pkgs.openssh "ssh"} -vN -D 127.0.0.1:''${port} "''${host}")
 
     ( exec -a "''${cmd[1]}" -- ''${cmd} ) &
     pid=$!
 
     newpid=""
     i=200
-    while ! newpid=$(${pkgs.lsof}/bin/lsof -Pi @localhost:"''${port}" -sTCP:LISTEN -t); do
+    while ! newpid=$(${lib.getExe pkgs.lsof} -Pi @localhost:"''${port}" -sTCP:LISTEN -t); do
       if ! kill -0 "''${pid}"; then
         wait "''${pid}"
         exit $?
       fi
       [[ "''${i}" -gt 0 ]] || exit 1
       i=$((''${i} - 1))
-      ${pkgs.coreutils}/bin/sleep 0.1
+      ${lib.getExe' pkgs.coreutils "sleep"} 0.1
     done
 
-    ${config.systemd.package}/bin/systemd-notify --ready
-
-    wait "''${pid}" "''${newpid}"
+    ${lib.getExe' config.systemd.package "systemd-notify"} --pid=''${newpid} --ready
   '';
 in {
   tmpfiles.rules = [
@@ -48,11 +46,11 @@ in {
   ];
 
   services = {
-    sync-keepass = {
+    "sync-keepass@" = {
       Service = {
         Type = "oneshot";
         WorkingDirectory = "~";
-        ExecStart = toString (pkgs.writers.writePython3 "sync-keepass" {
+        ExecStart = "${pkgs.writers.writePython3 "sync-keepass" {
           libraries = with pkgs.python3Packages; [ python-dateutil ];
         } ''
           import json
@@ -61,13 +59,13 @@ in {
           from datetime import datetime
           from dateutil.tz import tzlocal
           from dateutil.parser import isoparse
-          from sys import stderr
+          from sys import stderr, argv
 
 
-          remote_fs = 'surtr'
-          remote_file = 'store.kdbx'
-          target_file = expanduser('~/store.kdbx')
-          meta_file = expanduser('~/.store.kdbx.json')
+          remote_fs = 'surtr' if argv[1] == 'store.kdbx' else 'mathcloud'
+          remote_file = argv[1]
+          target_file = expanduser(f'~/{argv[1]}')
+          meta_file = expanduser(f'~/.{argv[1]}.json')
 
           upload_time = None
           our_last_upload_time = None
@@ -117,22 +115,14 @@ in {
               do_upload()
           elif upload_time is not None and (mod_time is None or upload_time > mod_time) and (our_last_upload_time is None or upload_time > our_last_upload_time):  # noqa: E501
               do_download()
-        '');
+        ''} \"%I\"";
         Environment = [ "RCLONE_PASSWORD_COMMAND=\"${pkgs.coreutils}/bin/cat ${config.sops.secrets.gkleen-rclone.path}\"" "PATH=${pkgs.rclone}/bin" ];
       };
     };
     emacs = {
       Unit = {
-        After = ["graphical-session-pre.target"];
-      };
-    };
-    dunst = {
-      Service = {
-        ExecStart = lib.mkForce "${cfg.services.dunst.package}/bin/dunst";
-        Restart = "always";
-      };
-      Install = {
-        WantedBy = ["graphical-session.target"];
+        After = [ "graphical-session.target" ];
+        BindsTo = [ "graphical-session.target" ];
       };
     };
     keepassxc = {
@@ -144,8 +134,8 @@ in {
         Environment = [ "QT_QPA_PLATFORM=wayland" ];
       };
       Unit = {
-        Requires = ["graphical-session-pre.target"];
-        After = ["graphical-session-pre.target"];
+        After = [ "graphical-session.target" ];
+        BindsTo = [ "graphical-session.target" ];
       };
     };
     mpris-proxy = {
@@ -154,7 +144,7 @@ in {
       Service.ExecStart = "${pkgs.bluez}/bin/mpris-proxy";
       Install.WantedBy = [ "default.target" ];
     };
-    "autossh-socks@proxy.mathw0h:8119" = {
+    "autossh-socks@proxy.ssh.math.lmu.de:8119" = {
       Service = {
         Type = "notify";
         NotifyAccess = "all";
@@ -162,7 +152,7 @@ in {
         Restart = "always";
         RestartSec = "23s";
         ExecStart = "${autossh-socks-script} \"%I\"";
-        Environment = [ "SSHPASS_SECRET=gkleen@mathw0g.math.lmu.de" ];
+        Environment = [ "SSHPASS_SECRET=gkleen@ssh.math.lmu.de" ];
       };
       Unit = {
         StopWhenUnneeded = true;
@@ -181,11 +171,56 @@ in {
       };
       Unit = {
         StopWhenUnneeded = true;
+        StartLimitInterval = "2s";
+        StartLimitBurst = 25;
       };
     };
-    swayidle = {
+    "autossh-socks@proxy.mathw0h:8123" = {
       Service = {
-        RuntimeDirectory = "swayidle";
+        Type = "notify";
+        NotifyAccess = "all";
+        WorkingDirectory = "~";
+        Restart = "always";
+        RestartSec = "23s";
+        ExecStart = "${autossh-socks-script} \"%I\"";
+        Environment = [ "SSHPASS_SECRET=gkleen@mathw0h.mathinst.loc" ];
+      };
+      Unit = {
+        StopWhenUnneeded = true;
+        StartLimitInterval = "180s";
+        StartLimitBurst = 7;
+      };
+    };
+    "autossh-socks@proxy.mathw0e:8125" = {
+      Service = {
+        Type = "notify";
+        NotifyAccess = "all";
+        WorkingDirectory = "~";
+        Restart = "always";
+        RestartSec = "23s";
+        ExecStart = "${autossh-socks-script} \"%I\"";
+        Environment = [ "SSHPASS_SECRET=gkleen@mathw0e.mathinst.loc" ];
+      };
+      Unit = {
+        StopWhenUnneeded = true;
+        StartLimitInterval = "180s";
+        StartLimitBurst = 7;
+      };
+    };
+    "autossh-socks@proxy.cip04:8127" = {
+      Service = {
+        Type = "notify";
+        NotifyAccess = "all";
+        WorkingDirectory = "~";
+        Restart = "always";
+        RestartSec = "23s";
+        ExecStart = "${autossh-socks-script} \"%I\"";
+        Environment = [ "SSHPASS_SECRET=gkleen@cip04.cipmath.loc" ];
+      };
+      Unit = {
+        StopWhenUnneeded = true;
+        StartLimitInterval = "180s";
+        StartLimitBurst = 7;
       };
     };
     psi-notify = {
@@ -193,8 +228,8 @@ in {
         WantedBy = ["graphical-session.target"];
       };
       Unit = {
-        Requires = ["graphical-session-pre.target"];
-        After = ["graphical-session-pre.target"];
+        After = [ "graphical-session.target" ];
+        PartOf = [ "graphical-session.target" ];
       };
       Service = {
         ExecStart = lib.getExe pkgs.psi-notify;
@@ -207,6 +242,7 @@ in {
     gtklock = {
       Unit = {
         Requisite = ["graphical-session.target"];
+        After = [ "graphical-session.target" ];
         PartOf = ["graphical-session.target"];
       };
       Service = {
@@ -214,53 +250,55 @@ in {
         RuntimeDirectory = "gtklock";
         CacheDirectory = "gtklock";
         ExecStartPre = [
-          "${pkgs.libsForQt5.qt5.qttools.bin}/bin/qdbus org.keepassxc.KeePassXC.MainWindow /keepassxc org.keepassxc.KeePassXC.MainWindow.lockAllDatabases"
-          "${config.systemd.package}/bin/systemctl --user stop gpg-agent.service"
-          (pkgs.writeShellScript "generate-css" ''
-            set -x
-            export PATH="${lib.makeBinPath [cfg.programs.wpaperd.package pkgs.jq pkgs.coreutils pkgs.imagemagick pkgs.findutils]}:$PATH"
-
-            declare -A monitors
-            monitors=()
-            while IFS= read -r entry; do
-                path=$(jq -r ".path" <<<"$entry")
-                [[ -z "$path" || ! -f "$path" ]] && continue
-                blurred_path="$CACHE_DIRECTORY"/"$(b2sum -l 128 <<<"$path" | cut -d' ' -f1)"."''${path##*.}"
-                monitor=$(jq -r ".display" <<<"$entry")
-                if [[ ! -f "$blurred_path" ]]; then
-                    mkdir -p "$(dirname "$blurred_path")"
-                    magick "$path" -filter Gaussian -resize 6.25% -define filter:sigma=2.5 -resize 1600% "$blurred_path" &
-                fi
-                monitors+=([$monitor]="$blurred_path")
-            done < <(wpaperctl all-wallpapers -j | jq -c ".[]")
-            wait
+          "-${lib.getExe' pkgs.libsForQt5.qt5.qttools.bin "qdbus"} org.keepassxc.KeePassXC.MainWindow /keepassxc org.keepassxc.KeePassXC.MainWindow.lockAllDatabases"
+          "-${lib.getExe' config.systemd.package "systemctl"} --user stop gpg-agent.service"
+          "-${lib.getExe pkgs.playerctl} -a pause"
+          "-${lib.getExe (pkgs.writeShellApplication {
+            name = "generate-css";
+            runtimeInputs = with pkgs; [cfg.services.wpaperd.package jq coreutils imagemagick findutils];
+            text = ''
+              declare -A monitors
+              monitors=()
+              while IFS= read -r entry; do
+                  path=$(jq -r ".path" <<<"$entry")
+                  [[ -z "$path" || ! -f "$path" ]] && continue
+                  blurred_path="$CACHE_DIRECTORY"/"$(b2sum -l 128 <<<"$path" | cut -d' ' -f1)"."''${path##*.}"
+                  monitor=$(jq -r ".display" <<<"$entry")
+                  if [[ ! -f "$blurred_path" ]]; then
+                      mkdir -p "$(dirname "$blurred_path")"
+                      magick "$path" -filter Gaussian -resize 6.25% -define filter:sigma=2.5 -resize 1600% "$blurred_path" &
+                  fi
+                  monitors+=([$monitor]="$blurred_path")
+              done < <(wpaperctl all-wallpapers -j | jq -c ".[]")
+              # wait
 
-            cp --no-preserve=mode ${pkgs.writeText "gtklock.css" ''
-              #window-box {
-                padding: 64px;
-                /* border: 1px solid black; */
-                border-radius: 4px;
-                box-shadow: rgba(0, 0, 0, 0.8) 0px 4px 12px;
-                /* background-color: white; */
-                background-color: rgba(0, 0, 0, 0.5);
+              cp --no-preserve=mode ${pkgs.writeText "gtklock.css" ''
+                #window-box {
+                  padding: 64px;
+                  /* border: 1px solid black; */
+                  border-radius: 4px;
+                  box-shadow: rgba(0, 0, 0, 0.8) 0px 4px 12px;
+                  /* background-color: white; */
+                  background-color: rgba(0, 0, 0, 0.5);
+                }
+              ''} "$RUNTIME_DIRECTORY"/style.css
+              for monitor in "''${!monitors[@]}"; do
+              cat >>"$RUNTIME_DIRECTORY"/style.css <<EOF
+              window#''${monitor} {
+                background-image: url("''${monitors[$monitor]}");
+                background-repeat: no-repeat;
+                background-size: 100% 100%;
+                background-origin: content-box;
               }
-            ''} "$RUNTIME_DIRECTORY"/style.css
-            for monitor in "''${!monitors[@]}"; do
-            cat >>"$RUNTIME_DIRECTORY"/style.css <<EOF
-            window#''${monitor} {
-              background-image: url("''${monitors[$monitor]}");
-              background-repeat: no-repeat;
-              background-size: 100% 100%;
-              background-origin: content-box;
-            }
-            EOF
-            done
-          '')
+              EOF
+              done
+            '';
+          })}"
         ];
         NotifyAccess = "all";
         ExecStart = ''${lib.getExe pkgs.gtklock} -s "''${RUNTIME_DIRECTORY}/style.css" -L ${pkgs.writeShellScript "after-lock" ''
-          ${cfg.wayland.windowManager.hyprland.package}/bin/hyprctl dispatch dpms off
-          ${config.systemd.package}/bin/systemd-notify --ready
+          ${lib.getExe cfg.programs.niri.package} msg action power-off-monitors
+          ${lib.getExe' config.systemd.package "systemd-notify"} --ready
         ''}'';
       };
     };
@@ -308,38 +346,82 @@ in {
         ExecStopPost = "${pkgs.coreutils}/bin/rm -rfv \"$CACHE_DIRECTORY\"";
       };
     };
-    wpaperd = {
-      Install = {
-        WantedBy = ["graphical-session.target"];
+    # wpaperd = {
+    #   Install = {
+    #     WantedBy = ["graphical-session.target"];
+    #   };
+    #   Unit = {
+    #     After = [ "graphical-session.target" ];
+    #     PartOf = [ "graphical-session.target" ];
+    #   };
+    #   Service = {
+    #     ExecStart = lib.getExe cfg.services.wpaperd.package;
+    #     Type = "simple";
+    #     Restart = "always";
+    #     RestartSec = "2s";
+    #   };
+    # };
+    xembed-sni-proxy = {
+      Unit = {
+        PartOf = lib.mkForce ["tray.target"];
       };
+    };
+    poweralertd = {
       Unit = {
-        BindsTo = ["graphical-session-pre.target"];
-        After = ["graphical-session-pre.target"];
+        After = ["graphical-session.target"];
       };
-      Service = {
-        ExecStart = lib.getExe cfg.programs.wpaperd.package;
-        Type = "simple";
-        Restart = "always";
-        RestartSec = "2s";
+    };
+    network-manager-applet = {
+      Unit = {
+        PartOf = lib.mkForce ["tray.target"];
+      };
+    };
+    udiskie = {
+      Unit = {
+        PartOf = lib.mkForce ["tray.target"];
+      };
+    };
+    blueman-applet = {
+      Unit = {
+        PartOf = lib.mkForce ["tray.target"];
+      };
+      Install = {
+        WantedBy = lib.mkForce ["tray.target"];
       };
     };
   } // listToAttrs (map ({host, port}: nameValuePair "proxy-to-autossh-socks@${toString port}" {
       Unit = {
-        Requires = ["autossh-socks@${host}:${toString (port + 1)}.service" "proxy-to-autossh-socks@${toString port}.socket"];
+        BindsTo = ["autossh-socks@${host}:${toString (port + 1)}.service" "proxy-to-autossh-socks@${toString port}.socket"];
         After = ["autossh-socks@${host}:${toString (port + 1)}.service" "proxy-to-autossh-socks@${toString port}.socket"];
       };
       Service = {
-        ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd --exit-idle-time=10s localhost:${toString (port + 1)}";
+        ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd --exit-idle-time=60s 127.0.0.1:${toString (port + 1)}";
+        Restart = "always";
+        RestartSec = "23s";
       };
-  }) [{ host = "proxy.mathw0h"; port = 8118; } { host = "proxy.vidhar"; port = 8120; }]);
+  }) [{ host = "proxy.ssh.math.lmu.de"; port = 8118; } { host = "proxy.vidhar"; port = 8120; } { host = "proxy.mathw0h"; port = 8122; } { host = "proxy.mathw0e"; port = 8124; } { host = "proxy.cip04"; port = 8126; }]);
   sockets = listToAttrs (map (port: nameValuePair "proxy-to-autossh-socks@${toString port}" {
     Socket = {
       ListenStream = "%I";
+      TriggerLimitIntervalSec = 0;
+      PollLimitIntervalSec = "180s";
+      PollLimitBurst = 6;
     };
     Install = {
       WantedBy = ["default.target"];
     };
-  }) [8118 8120]) // {
+  }) [8118 8122 8124 8126]) // {
+    "proxy-to-autossh-socks@8120" = {
+      Socket = {
+        ListenStream = "%I";
+        TriggerLimitIntervalSec = 0;
+        PollLimitIntervalSec = "2s";
+        PollLimitBurst = 20;
+      };
+      Install = {
+        WantedBy = ["default.target"];
+      };
+    };
     "yt-dlp" = {
       Socket = {
         SocketMode = "0600";
@@ -353,7 +435,7 @@ in {
     };
   };
   timers = {
-    sync-keepass = {
+    "sync-keepass@store.kdbx" = {
       Timer = {
         OnActiveSec = "1m";
         OnUnitActiveSec = "1m";
@@ -363,6 +445,16 @@ in {
         WantedBy = ["default.target"];
       };
     };
+    "sync-keepass@rz.kdbx" = {
+      Timer = {
+        OnActiveSec = "1d";
+        OnUnitActiveSec = "1d";
+      };
+
+      Install = {
+        WantedBy = ["default.target"];
+      };
+    };
   };
   targets = {
     graphical-session = {
@@ -373,6 +465,9 @@ in {
     };
     tray = {
       Unit = {
+        PartOf = [ "graphical-session.target" ];
+        # Requires = [ "waybar.service" ];
+        After = [ "graphical-session.target" ]; # "waybar.service" ];
         Wants = ["blueman-applet.service" "udiskie.service" "network-manager-applet.service"];
       };
     };