From 64b4274d9b7ed3aeadcd85c7331bc8b6207827d9 Mon Sep 17 00:00:00 2001 From: mikl Date: Wed, 15 Jul 2026 21:35:38 +0300 Subject: [PATCH 1/7] poppy: add python313 and uv to home/cli.nix System python is 3.9 (macOS), too old for telegram-mcp (needs >=3.10). Added python313 and uv via home-manager. Also staged home/pay.nix which was untracked and blocked nix builds. --- home/cli.nix | 4 +++ home/pay.nix | 76 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 80 insertions(+) create mode 100644 home/pay.nix diff --git a/home/cli.nix b/home/cli.nix index d43946e..693686b 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -43,6 +43,10 @@ # x402 / MPP agentic payments CLI (Solana Foundation) (pkgs.callPackage ./pay.nix {}) + + # Python (системный 3.9 macOS — слишком старый; ставим 3.13 через nix) + python313 + uv ]; # TODO: global npm/pnpm packages not managed by nix for now diff --git a/home/pay.nix b/home/pay.nix new file mode 100644 index 0000000..2c4f884 --- /dev/null +++ b/home/pay.nix @@ -0,0 +1,76 @@ +# pay — official Solana Foundation CLI for x402 / MPP payments. +# Source: https://github.com/solana-foundation/pay (Rust, but we use upstream prebuilt binaries) +# +# Not in nixpkgs yet (fresh project). This derivation fetches the upstream +# prebuilt binary tarball per platform. Update `version` + hashes on bump. +{ + stdenv, + fetchurl, + lib, + system ? builtins.currentSystem, +}: +let + version = "0.21.0"; + tag = "pay-v${version}"; + + # platform -> (tarball name, sha256 of the tarball) + # Only fill hashes for platforms you actually target; others fall through to meta.broken. + srcInfo = + { + "aarch64-darwin" = { + name = "pay-aarch64-apple-darwin.tar.gz"; + hash = "11c96191145381fea9c938969c14bbd6424bcdf51ef119374c4905fb51d0e265"; + }; + "x86_64-darwin" = { + name = "pay-x86_64-apple-darwin.tar.gz"; + hash = lib.fakeSha256; # fill if needed + }; + "aarch64-linux" = { + name = "pay-aarch64-unknown-linux-gnu.tar.gz"; + hash = lib.fakeSha256; # fill if needed + }; + "x86_64-linux" = { + name = "pay-x86_64-unknown-linux-gnu.tar.gz"; + hash = lib.fakeSha256; # fill if needed + }; + } + .${system} or (throw "pay: no prebuilt binary for system ${system}"); +in +stdenv.mkDerivation { + pname = "pay"; + inherit version; + + src = fetchurl { + url = "https://github.com/solana-foundation/pay/releases/download/${tag}/${srcInfo.name}"; + # hex sha256 (verified locally for aarch64-darwin tarball) + sha256 = srcInfo.hash; + }; + + sourceRoot = "."; + + # tarball contains a single prebuilt `pay` binary at its root. + dontConfigure = true; + dontBuild = true; + + installPhase = '' + runHook preInstall + install -Dm555 pay $out/bin/pay + runHook postInstall + ''; + + # Upstream prebuilt; we trust the platform toolchain, no further stripping/patching needed. + dontStrip = true; + dontPatchELF = true; + + meta = { + description = "Solana Foundation CLI for x402 / MPP agentic API payments"; + homepage = "https://pay.sh/"; + license = lib.licenses.mit; + mainProgram = "pay"; + # Known-good prebuilts; add hashes above to enable more platforms. + platforms = lib.platforms.darwin ++ lib.platforms.linux; + badPlatforms = [ + # explicit hashes still fakeHash -> nix will fail to build on these, which is fine + ]; + }; +} From 37b1ac80db917ae09593e97866c69657f539e2a5 Mon Sep 17 00:00:00 2001 From: mikl Date: Thu, 16 Jul 2026 02:13:40 +0300 Subject: [PATCH 2/7] feat(home): add lem CLI via flake input --- flake.lock | 22 ++++++++++++++++++++++ flake.nix | 11 ++++++++++- home/cli.nix | 5 ++++- 3 files changed, 36 insertions(+), 2 deletions(-) diff --git a/flake.lock b/flake.lock index 58bc92c..c7b39ce 100644 --- a/flake.lock +++ b/flake.lock @@ -79,6 +79,27 @@ "type": "github" } }, + "lem": { + "inputs": { + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1784155885, + "narHash": "sha256-mxWkLAuof3qbIKj5J5BHgZ53t9usg37FaduL+L55XRQ=", + "ref": "master", + "rev": "b5d1403635e2f6d32a19fdee2d0d793571d04d1c", + "revCount": 4, + "type": "git", + "url": "ssh://git@git.iscg.dev:2222/mikl/lem.git" + }, + "original": { + "ref": "master", + "type": "git", + "url": "ssh://git@git.iscg.dev:2222/mikl/lem.git" + } + }, "nix-darwin": { "inputs": { "nixpkgs": [ @@ -119,6 +140,7 @@ "inputs": { "arion": "arion", "home-manager": "home-manager", + "lem": "lem", "nix-darwin": "nix-darwin", "nixpkgs": "nixpkgs", "sops-nix": "sops-nix" diff --git a/flake.nix b/flake.nix index 5be75f6..e66840d 100644 --- a/flake.nix +++ b/flake.nix @@ -23,10 +23,17 @@ url = "github:hercules-ci/arion"; inputs.nixpkgs.follows = "nixpkgs"; }; + + # Personal CLIs built from own repos + lem = { + # ssh fetch via flake; ssh key available to nix-daemon. Private repo. + url = "git+ssh://git@git.iscg.dev:2222/mikl/lem.git?ref=master"; + inputs.nixpkgs.follows = "nixpkgs"; + }; }; outputs = - { self, nixpkgs, nix-darwin, home-manager, sops-nix, arion, ... }: + { self, nixpkgs, nix-darwin, home-manager, sops-nix, arion, lem, ... }: let mkNixos = hostname: nixpkgs.lib.nixosSystem { @@ -45,6 +52,7 @@ # Серверные хосты используют минимульный home (headless). # Десктоп-хосты (если появятся) могут переопределить users.mikl. users.mikl = import ./home/server.nix; + extraSpecialArgs = { inputs = self.inputs; }; }; } ]; @@ -62,6 +70,7 @@ useUserPackages = true; backupFileExtension = "backup"; users.mikl = import ./home; + extraSpecialArgs = { inputs = self.inputs; }; }; } ]; diff --git a/home/cli.nix b/home/cli.nix index 693686b..22f70e6 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }: +{ pkgs, inputs, ... }: { # Universal CLI tools for all hosts home.packages = with pkgs; [ @@ -47,6 +47,9 @@ # Python (системный 3.9 macOS — слишком старый; ставим 3.13 через nix) python313 uv + + # Personal CLIs (from own flake inputs) + inputs.lem.packages.${pkgs.system}.default ]; # TODO: global npm/pnpm packages not managed by nix for now From fcb6f67cab2a781e1d521db96d760769d7201c8a Mon Sep 17 00:00:00 2001 From: mikl Date: Thu, 16 Jul 2026 02:15:02 +0300 Subject: [PATCH 3/7] feat(home): add lem CLI via flake input (ssh-fetched private repo) --- flake.lock | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/flake.lock b/flake.lock index c7b39ce..a2e7ec8 100644 --- a/flake.lock +++ b/flake.lock @@ -86,11 +86,11 @@ ] }, "locked": { - "lastModified": 1784155885, - "narHash": "sha256-mxWkLAuof3qbIKj5J5BHgZ53t9usg37FaduL+L55XRQ=", + "lastModified": 1784157266, + "narHash": "sha256-wRs7/KNxLTZpW/tYJg62dk8IvkT6BM4cmMUl4m8jWrc=", "ref": "master", - "rev": "b5d1403635e2f6d32a19fdee2d0d793571d04d1c", - "revCount": 4, + "rev": "691458497c8e965be38ac06084b72d7a0167e541", + "revCount": 5, "type": "git", "url": "ssh://git@git.iscg.dev:2222/mikl/lem.git" }, From 0fe7665072bbe71eb8b4b469a65ff090f8cc6e48 Mon Sep 17 00:00:00 2001 From: mikl Date: Thu, 16 Jul 2026 13:16:50 +0300 Subject: [PATCH 4/7] poppy: add weekly nix GC launchd agent (delete-older-than 14d) nix.gc.automatic requires nix.enable=true, but poppy uses the Determinate nix installer (nix.enable=false). Define a launchd user agent directly that runs nix-collect-garbage --delete-older-than 14d weekly at Sun 03:00. --- hosts/poppy/default.nix | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index cf6ccb3..ca63f44 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -20,6 +20,25 @@ nixpkgs.config.allowUnfree = true; nix.enable = false; + # Автоматический сбор мусора: удалять пути старше 14 дней, по ночам в 3:00. + # nix.gc не работает с nix.enable=false, поэтому launchd-агент напрямую. + launchd.user.agents.nix-gc = { + serviceConfig = { + Label = "local.nix.gc"; + ProgramArguments = [ + "/nix/var/nix/profiles/default/bin/nix-collect-garbage" + "--delete-older-than" + "14d" + ]; + StartCalendarInterval = { + Weekday = 0; + Hour = 3; + }; + StandardOutPath = "/tmp/nix-gc.log"; + StandardErrorPath = "/tmp/nix-gc.log"; + }; + }; + users.users.mikl = { home = "/Users/mikl"; shell = pkgs.zsh; From ebfdb3e186d4e53a12d433abe0b29bc5ec60a865 Mon Sep 17 00:00:00 2001 From: mikl Date: Sat, 25 Jul 2026 14:41:49 +0300 Subject: [PATCH 5/7] poppy: add android-tools (adb for Pixel) --- hosts/poppy/default.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/poppy/default.nix b/hosts/poppy/default.nix index ca63f44..4eee9c8 100644 --- a/hosts/poppy/default.nix +++ b/hosts/poppy/default.nix @@ -44,7 +44,7 @@ shell = pkgs.zsh; }; - environment.systemPackages = [ pkgs.vim ]; + environment.systemPackages = [ pkgs.vim pkgs.android-tools ]; # Apply default apps via duti on activation system.activationScripts.defaultApps.text = '' From c8f6ee04e838ef47eb03c6bce6b974e4e5c21998 Mon Sep 17 00:00:00 2001 From: mikl Date: Sun, 26 Jul 2026 21:20:33 +0300 Subject: [PATCH 6/7] poppy/cli: add matrix-commander-rs (Matrix CLI client for agent) --- home/cli.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/home/cli.nix b/home/cli.nix index 22f70e6..bb078b9 100644 --- a/home/cli.nix +++ b/home/cli.nix @@ -40,6 +40,7 @@ yt-dlp # скачивание с YouTube и 1000+ сайтов (эталонный CLI) transmission_4 # BitTorrent: transmission-daemon + -remote + -create/show/edit CLI tools himalaya # IMAP/SMTP/JMAP почтовый CLI (JSON-вывод для агента) + matrix-commander-rs # Matrix CLI клиент (E2E, JSON-вывод, для агента) # x402 / MPP agentic payments CLI (Solana Foundation) (pkgs.callPackage ./pay.nix {}) From 3d2f4172a51ed920cb783a350f35058c19915465 Mon Sep 17 00:00:00 2001 From: mikl Date: Tue, 28 Jul 2026 13:08:14 +0300 Subject: [PATCH 7/7] heather/caddy: add /files/* static file_server on iscg.dev MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Для раздачи временных файлов (например v2RayTun.zip) прямой https-ссылкой. handle_path stripает /files/ prefix, file_server раздаёт из /var/www/files/. Не конфликтует с matrix (использует /_matrix/*, /.well-known/matrix). --- hosts/heather/caddy.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hosts/heather/caddy.nix b/hosts/heather/caddy.nix index d53e2b7..99f02ba 100644 --- a/hosts/heather/caddy.nix +++ b/hosts/heather/caddy.nix @@ -61,6 +61,13 @@ in { # Matrix tuwunel (homeserver) "iscg.dev".extraConfig = '' + # Static file sharing (https://iscg.dev/files/). + # handle_path stripает /files/ prefix → file_server ищет в root. + # Не конфликтует с matrix (использует /_matrix/*, /.well-known/matrix). + handle_path /files/* { + root * /var/www/files + file_server + } reverse_proxy 127.0.0.1:8008 encode zstd gzip '';