configurations/camelot/default.nix

@@ -53,6 +53,7 @@
     };
   };
 
+  my.server.mollysocket.enable = true;
   my.server.blog.enable = true;
   my.server.papermc.enable = true;
 

configurations/camelot/jellyfin.nix

@@ -24,14 +24,6 @@
     group = "media";
   };
 
-  # Sonarr didn't update their runtime for a while...
-  nixpkgs.config.permittedInsecurePackages = [
-    "aspnetcore-runtime-6.0.36"
-    "aspnetcore-runtime-wrapped-6.0.36"
-    "dotnet-sdk-wrapped-6.0.428"
-    "dotnet-sdk-6.0.428"
-  ];
-
   services.radarr = {
     enable = true;
     openFirewall = true;

configurations/camelot/nextcloud.nix

@@ -12,13 +12,13 @@
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud30;
+    package = pkgs.nextcloud28;
     datadir = "/srv/nextcloud";
     https = true;
     hostName = extraInfo.nextcloudURI;
 
     extraAppsEnable = true;
-    appstoreEnable = false;
+    appstoreEnable = true;
     extraApps = {
       inherit (config.services.nextcloud.package.packages.apps)
         calendar

flake.lock

@@ -184,11 +184,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1733045511,
-        "narHash": "sha256-n8AldXJRNVMm2UZ6yN0HwVxlARY2Cm/uhdOw76tQ0OI=",
+        "lastModified": 1732482255,
+        "narHash": "sha256-GUffLwzawz5WRVfWaWCg78n/HrBJrOG7QadFY6rtV8A=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "4964f3c6fc17ae4578e762d3dc86b10fe890860e",
+        "rev": "a9953635d7f34e7358d5189751110f87e3ac17da",
         "type": "github"
       },
       "original": {
@@ -289,27 +289,27 @@
     },
     "nixpkgs-stable_2": {
       "locked": {
-        "lastModified": 1732981179,
-        "narHash": "sha256-F7thesZPvAMSwjRu0K8uFshTk3ZZSNAsXTIFvXBT+34=",
+        "lastModified": 1731797254,
+        "narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "62c435d93bf046a5396f3016472e8f7c8e2aed65",
+        "rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
-        "ref": "nixos-24.11",
+        "ref": "nixos-24.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1732837521,
-        "narHash": "sha256-jNRNr49UiuIwaarqijgdTR2qLPifxsVhlJrKzQ8XUIE=",
+        "lastModified": 1732014248,
+        "narHash": "sha256-y/MEyuJ5oBWrWAic/14LaIr/u5E0wRVzyYsouYY3W6w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "970e93b9f82e2a0f3675757eb0bfc73297cc6370",
+        "rev": "23e89b7da85c3640bbc2173fe04f4bd114342367",
         "type": "github"
       },
       "original": {

flake.nix

@@ -4,7 +4,7 @@
     # As we have machine using the unstable channel, and other machines using the stable one,
     # we import both, and we will select for each machine which one to use.
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-24.11";
+    nixpkgs-stable.url = "github:NixOS/nixpkgs/nixos-24.05";
     flake-utils.url = "github:numtide/flake-utils";
 
     # Home-manager isn't used for anything except my workstations, which all use the unstable channel.

modules/common/hardware.nix

@@ -7,6 +7,9 @@
 }:
 let
   gpu = config.my.hardware.gpu;
+  hwAccelerationOptionPath = if (machineProps.nixpkgs == "unstable") then "graphics" else "opengl";
+  enable32BitOptionName =
+    if (machineProps.nixpkgs == "unstable") then "enable32Bit" else "driSupport32Bit";
   anyWineUser =
     if machineProps.enableHomeManager then
       (builtins.any (user: user.my.games.wine.enable) (builtins.attrValues config.home-manager.users))
@@ -34,10 +37,11 @@ with lib;
     boot.kernelParams = mkIf (gpu == "intel") [ "i915.enable_guc=2" ];
     services.xserver.videoDrivers = mkIf (gpu == "nvidia") [ "nvidia" ];
 
-    hardware.graphics = {
+    # Small hack as this option path changes between 24.05 and unstable
+    hardware.${hwAccelerationOptionPath} = {
       enable = gpu != null;
 
-      enable32Bit = anyWineUser;
+      "${enable32BitOptionName}" = anyWineUser;
 
       extraPackages = with pkgs; [
         (mkIf (gpu == "intel") intel-media-driver)

modules/server/default.nix

@@ -3,6 +3,7 @@
     ../common
     ./network.nix
     ./nginx.nix
+    ./mollysocket.nix
     ./blog.nix
     ./minecraft.nix
   ];

modules/server/mollysocket.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  config,
+  extraInfo,
+  ...
+}:
+let
+  msConfig = config.services.mollysocket.settings;
+in
+with lib;
+{
+  options.my.server.mollysocket.enable = mkOption {
+    type = types.bool;
+    default = false;
+    description = ''
+      Enable the mollysocket server, allowing UnifiedPush notifications for te Molly app.
+    '';
+  };
+
+  config = mkIf config.my.server.mollysocket.enable {
+    services.mollysocket = {
+      enable = true;
+      settings = {
+        allowed_uuids = [
+          extraInfo.signal.clientUuid
+        ];
+      };
+    };
+
+    services.nginx.virtualHosts.${extraInfo.signal.notificationServerUri} = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations."/" = {
+        recommendedProxySettings = true;
+        proxyWebsockets = true;
+        proxyPass = "http://${msConfig.host}:${builtins.toString msConfig.port}";
+      };
+    };
+  };
+}