@cryptotaxi247 / infra / commits / bde1ee0f

hydra-proxy: switch to iocaine

This gets out of the legitimate users way and supports ai-robots.txt for matching bots and allows ASN wide bans all in one.

Martin Weinelt committed Jun 18, 2026 at 01:58 UTC bde1ee0f11f4ff5a3f80c0fbac7ac55098cfd100
8 files changed +392 -142
build/hydra-proxy.nix
+86 -22
@@ -1,30 +1,83 @@
1 {
2 config,
3 + lib,
4 pkgs,
5 + inputs,
6 ...
7 }:
8
9 {
10 + imports = [
11 + inputs.nixocaine.nixosModules.default
12 + ];
13 +
14 networking.firewall.allowedTCPPorts = [
15 80
16 443
17 ];
18
13 - services.anubis.instances."hydra-server" = {
14 - settings = {
15 - TARGET = "http://127.0.0.1:3000";
16 - BIND = ":3001";
17 - BIND_NETWORK = "tcp";
18 - METRICS_BIND = ":9001";
19 - METRICS_BIND_NETWORK = "tcp";
19 + services.iocaine = {
20 + enable = true;
21 + config = {
22 + handler.default.config = {
23 + "ai-robots-txt-path" = inputs.ai-robots-txt;
24 + sources = {
25 + "training-corpus" = [
26 + (pkgs.fetchurl {
27 + name = "1984_djvu.txt";
28 + url = "https://archive.org/download/GeorgeOrwells1984/1984_djvu.txt";
29 + hash = "sha256-9R1PTa8yDtkfH+4rU5BF62ee73irhd3VYX1QB5KU+ZU=";
30 + })
31 + (pkgs.fetchurl {
32 + name = "brave-new-world.txt";
33 + url = "https://archive.org/download/ost-english-brave_new_world_aldous_huxley/Brave_New_World_Aldous_Huxley_djvu.txt";
34 + hash = "sha256-6WkaO/3zQIezGzJDp4QjglikiTZTxgo0P4MEff2mdcY=";
35 + })
36 + ];
37 + "wordlists" = [
38 + (pkgs.fetchurl {
39 + name = "words.txt";
40 + url = "https://git.savannah.gnu.org/cgit/miscfiles.git/plain/web2";
41 + hash = "sha256-KSmJWrP+x4xpY+vly7NJP+T8nhHroJWlInh7ivxTqGM=";
42 + })
43 + ];
44 + };
45 + unwanted-asns = {
46 + db-path = inputs.geolite2-asn-mmdb;
47 + list = map toString [
48 + 45102 # ALIBABA-CN-NET
49 + 45899 # VNPT-AS-VN
50 + 132203 # TENCENT-NET-AP-CN
51 + ];
52 + };
53 + };
54 + server.default = {
55 + bind = "/run/iocaine/default.sock";
56 + unix-socket-access = "group";
57 + mode = "http";
58 + use = {
59 + handler-from = "default";
60 + metrics = "metrics";
61 + };
62 + };
63 + server.metrics = {
64 + bind = "[::]:42042";
65 + mode = "prometheus";
66 + };
67 };
68 };
69
70 networking.firewall.extraInputRules = ''
24 - ip6 saddr $prometheus_inet6 tcp dport 9001 accept
25 - ip saddr $prometheus_inet4 tcp dport 9001 accept
71 + ip6 saddr $prometheus_inet6 tcp dport { 9001, 42042 } accept
72 + ip saddr $prometheus_inet4 tcp dport { 9001, 42042 } accept
73 '';
74
75 + # Kill the hard dependency on iocaine
76 + systemd.services.nginx = {
77 + requires = lib.mkForce [ ];
78 + after = lib.mkForce [ "network.target" ];
79 + };
80 +
81 services.nginx = {
82 enable = true;
83 enableReload = true;
@@ -42,16 +95,6 @@
95 '';
96
97 appendHttpConfig = ''
45 - map $request_uri $backend {
46 - default anubis;
47 -
48 - # downloads (e.g. distrobuilder for lxc/incus images)
49 - ~^/build/\d+/download/ hydra-server;
50 - ~^/build/\d+/download-by-type/ hydra-server;
51 - ~^/job/[^/]+/[^/]+/[^/]+/latest/download/ hydra-server;
52 - ~^/job/[^/]+/[^/]+/[^/]+/latest/download-by-type/file/ hydra-server;
53 - }
54 -
98 limit_req_zone $binary_remote_addr zone=hydra-server:8m rate=2r/s;
99 limit_req_status 429;
100 '';
@@ -61,7 +104,7 @@
104 '';
105
106 upstreams = {
64 - anubis.servers."127.0.0.1:3001" = { };
107 + iocaine.servers."unix:${config.services.iocaine.config.server.default.bind}" = { };
108 hydra-server.servers."127.0.0.1:3000" = { };
109 };
110
@@ -86,12 +129,33 @@
129 Allow: /$
130 '';
131
132 + locations."/" = {
133 + proxyPass = "http://iocaine";
134 + extraConfig = ''
135 + # allow nginx to intercept non-200 responses
136 + proxy_intercept_errors on;
137 +
138 + # optionally retry upstream on certain failures
139 + proxy_next_upstream error timeout;
140 +
141 + # treat 421 as a special fallback condition
142 + # treat 502 when iocaine is down
143 + error_page 421 502 = @hydra;
144 +
145 + # discard the noise
146 + access_log off;
147 +
148 + # don't spend time compressing garbage
149 + gzip off;
150 + '';
151 + };
152 +
153 locations."~ ^/job/[^/]+/[^/]+/metrics/metric/" = {
154 proxyPass = "http://hydra-server";
155 };
156
93 - locations."/" = {
94 - proxyPass = "http://$backend";
157 + locations."@hydra" = {
158 + proxyPass = "http://hydra-server";
159 extraConfig = ''
160 limit_req zone=hydra-server burst=7;
161 '';
build/mimas/default.nix
-1
@@ -5,7 +5,6 @@
5 ../hydra-proxy.nix
6 ../hydra-queue-runner.nix
7 ./boot.nix
8 - ./firewall.nix
8 ./network.nix
9 ];
10
build/mimas/firewall.nix deleted
-82
@@ -1,82 +0,0 @@
1 -{
2 - pkgs,
3 - lib,
4 - inputs,
5 - ...
6 -}:
7 -
8 -let
9 - blockedAutNums = [
10 - 45102 # ALIBABA-CN-NET
11 - 45899 # VNPT-AS-VN
12 - 132203 # TENCENT-NET-AP-CN
13 - ];
14 -in
15 -
16 -{
17 - networking.nftables = {
18 - tables."abuse" = {
19 - family = "inet";
20 - content = ''
21 - set ipv4blocks {
22 - type ipv4_addr;
23 - flags interval;
24 - auto-merge;
25 - }
26 - set ipv6blocks {
27 - type ipv6_addr;
28 - auto-merge;
29 - flags interval;
30 - }
31 - chain input-abuse {
32 - type filter hook input priority filter - 5;
33 -
34 - ip saddr @ipv4blocks tcp dport 443 counter drop;
35 - ip6 saddr @ipv6blocks tcp dport 443 counter drop;
36 - }
37 - '';
38 - };
39 - };
40 -
41 - systemd.services.nft-prefix-import = {
42 - wants = [ "network-online.target" ];
43 - after = [ "network-online.target" ];
44 - wantedBy = [ "multi-user.target" ];
45 - path = with pkgs; [ nftables ];
46 - environment.USER_AGENT = "NixOS.org Infrastructure - infra@nixos.org";
47 - serviceConfig = {
48 - Type = "oneshot";
49 - AmbientCapabilities = [ "CAP_NET_ADMIN" ];
50 - DynamicUser = true;
51 - User = "nft-asblock";
52 - Group = "nft-asblock";
53 - ExecStart = toString (
54 - [
55 - (lib.getExe inputs.nft-prefix-import.packages.${pkgs.stdenv.hostPlatform.system}.default)
56 - "--table"
57 - "abuse"
58 - "--ipv4set"
59 - "ipv4blocks"
60 - "--ipv6set"
61 - "ipv6blocks"
62 - ]
63 - ++ blockedAutNums
64 - );
65 - RestrictAddressFamilies = [
66 - "AF_NETLINK"
67 - "AF_INET"
68 - "AF_INET6"
69 - ];
70 - StateDirectory = "nft-prefix-import";
71 - WorkingDirectory = "/var/lib/nft-prefix-import";
72 - };
73 - };
74 -
75 - systemd.timers.nft-prefix-import = {
76 - wantedBy = [ "timers.target" ];
77 - timerConfig = {
78 - OnCalendar = "0/6:00";
79 - RandomizedDelaySec = 3600;
80 - };
81 - };
82 -}
build/pluto/prometheus/default.nix
+1 -1
@@ -3,13 +3,13 @@
3 {
4 imports = [
5 ./alertmanager.nix
6 - ./exporters/anubis.nix
6 ./exporters/blackbox.nix
7 ./exporters/channel.nix
8 ./exporters/domain.nix
9 ./exporters/fastly.nix
10 ./exporters/github.nix
11 ./exporters/hydra.nix
12 + ./exporters/iocaine.nix
13 ./exporters/json.nix
14 ./exporters/matrix-synapse.nix
15 ./exporters/nixos.nix
build/pluto/prometheus/exporters/anubis.nix deleted
-16
@@ -1,16 +0,0 @@
1 -{
2 - services.prometheus = {
3 - scrapeConfigs = [
4 - {
5 - job_name = "anubis";
6 - static_configs = [
7 - {
8 - targets = [
9 - "hydra.nixos.org:9001"
10 - ];
11 - }
12 - ];
13 - }
14 - ];
15 - };
16 -}
build/pluto/prometheus/exporters/iocaine.nix new
+8
@@ -0,0 +1,8 @@
1 +{
2 + services.prometheus.scrapeConfigs = [
3 + {
4 + job_name = "iocaine";
5 + static_configs = [ { targets = [ "mimas.nixos.org:42042" ]; } ];
6 + }
7 + ];
8 +}
flake.lock
+286 -15
@@ -23,6 +23,52 @@
23 "type": "github"
24 }
25 },
26 + "ai-robots-txt": {
27 + "flake": false,
28 + "locked": {
29 + "narHash": "sha256-GbIph7PtJYtDMNewcAO372/lVKFrtS6Mr89vRmuBe0Y=",
30 + "type": "file",
31 + "url": "https://github.com/ai-robots-txt/ai.robots.txt/raw/refs/heads/main/robots.json"
32 + },
33 + "original": {
34 + "type": "file",
35 + "url": "https://github.com/ai-robots-txt/ai.robots.txt/raw/refs/heads/main/robots.json"
36 + }
37 + },
38 + "avalanche": {
39 + "inputs": {
40 + "nixpkgs": [
41 + "nixocaine",
42 + "nam-shub-of-enki",
43 + "nixpkgs"
44 + ],
45 + "nixpkgs-2505": "nixpkgs-2505",
46 + "pre-commit-hooks": [
47 + "nixocaine",
48 + "nam-shub-of-enki",
49 + "pre-commit-hooks"
50 + ],
51 + "systems": "systems_4",
52 + "treefmt-nix": [
53 + "nixocaine",
54 + "nam-shub-of-enki",
55 + "treefmt-nix"
56 + ]
57 + },
58 + "locked": {
59 + "lastModified": 1765198317,
60 + "narHash": "sha256-IQoB7lK8cJzWG3hEZrPe0Zoa8/1LRwcgTSoX9mpr20E=",
61 + "ref": "refs/heads/main",
62 + "rev": "01af515b690125cb0b636a86ab95cace3c0cc8c6",
63 + "revCount": 160,
64 + "type": "git",
65 + "url": "https://git.madhouse-project.org/algernon/avalanche.git"
66 + },
67 + "original": {
68 + "type": "git",
69 + "url": "https://git.madhouse-project.org/algernon/avalanche.git"
70 + }
71 + },
72 "blobs": {
73 "flake": false,
74 "locked": {
@@ -147,6 +193,22 @@
193 }
194 },
195 "flake-compat_2": {
196 + "flake": false,
197 + "locked": {
198 + "lastModified": 1761588595,
199 + "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
200 + "owner": "edolstra",
201 + "repo": "flake-compat",
202 + "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
203 + "type": "github"
204 + },
205 + "original": {
206 + "owner": "edolstra",
207 + "repo": "flake-compat",
208 + "type": "github"
209 + }
210 + },
211 + "flake-compat_3": {
212 "flake": false,
213 "locked": {
214 "lastModified": 1767039857,
@@ -240,13 +302,25 @@
302 "url": "https://cyberchaos.dev/e1mo/freescout-nix-flake.git"
303 }
304 },
305 + "geolite2-asn-mmdb": {
306 + "flake": false,
307 + "locked": {
308 + "narHash": "sha256-xT8tiSfo4dBFmm3hybo9WtN6U7cI7IDs3kMy1wVcLi4=",
309 + "type": "file",
310 + "url": "https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-ASN.mmdb"
311 + },
312 + "original": {
313 + "type": "file",
314 + "url": "https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-ASN.mmdb"
315 + }
316 + },
317 "git-hooks": {
318 "inputs": {
319 "flake-compat": [
320 "simple-nixos-mailserver",
321 "flake-compat"
322 ],
249 - "gitignore": "gitignore",
323 + "gitignore": "gitignore_2",
324 "nixpkgs": [
325 "simple-nixos-mailserver",
326 "nixpkgs"
@@ -267,6 +341,28 @@
341 }
342 },
343 "gitignore": {
344 + "inputs": {
345 + "nixpkgs": [
346 + "nixocaine",
347 + "pre-commit-hooks",
348 + "nixpkgs"
349 + ]
350 + },
351 + "locked": {
352 + "lastModified": 1709087332,
353 + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
354 + "owner": "hercules-ci",
355 + "repo": "gitignore.nix",
356 + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
357 + "type": "github"
358 + },
359 + "original": {
360 + "owner": "hercules-ci",
361 + "repo": "gitignore.nix",
362 + "type": "github"
363 + }
364 + },
365 + "gitignore_2": {
366 "inputs": {
367 "nixpkgs": [
368 "simple-nixos-mailserver",
@@ -338,24 +434,70 @@
434 "type": "github"
435 }
436 },
341 - "nft-prefix-import": {
437 + "iocaine-unstable": {
438 "inputs": {
439 "nixpkgs": [
344 - "nixpkgs-unstable"
440 + "nixocaine",
441 + "nixpkgs"
442 + ],
443 + "pre-commit-hooks": [
444 + "nixocaine",
445 + "pre-commit-hooks"
446 + ],
447 + "systems": "systems_3",
448 + "treefmt-nix": [
449 + "nixocaine",
450 + "treefmt-nix"
451 ]
452 },
453 "locked": {
348 - "lastModified": 1776724431,
349 - "narHash": "sha256-DeYqrWkCV2gf9oTowzylf0ucCPHnqFUOVSj/mVILno0=",
350 - "owner": "mweinelt",
351 - "repo": "nft-prefix-import",
352 - "rev": "8ec33fedf8f5e020e85a2d36dc1768be6819cfc4",
353 - "type": "github"
454 + "lastModified": 1779742069,
455 + "narHash": "sha256-adsQuSL4F1mfSsUtLwdgUtHVYessBM31tlBU8Rbbst4=",
456 + "ref": "iocaine-3.x",
457 + "rev": "5521356167c61e6119777535fd92c8ee23be3483",
458 + "revCount": 771,
459 + "type": "git",
460 + "url": "https://git.madhouse-project.org/iocaine/iocaine"
461 },
462 "original": {
356 - "owner": "mweinelt",
357 - "repo": "nft-prefix-import",
358 - "type": "github"
463 + "ref": "iocaine-3.x",
464 + "type": "git",
465 + "url": "https://git.madhouse-project.org/iocaine/iocaine"
466 + }
467 + },
468 + "nam-shub-of-enki": {
469 + "inputs": {
470 + "avalanche": "avalanche",
471 + "iocaine": [
472 + "nixocaine",
473 + "iocaine-unstable"
474 + ],
475 + "nixpkgs": [
476 + "nixocaine",
477 + "nixpkgs"
478 + ],
479 + "pre-commit-hooks": [
480 + "nixocaine",
481 + "pre-commit-hooks"
482 + ],
483 + "treefmt-nix": [
484 + "nixocaine",
485 + "treefmt-nix"
486 + ]
487 + },
488 + "locked": {
489 + "lastModified": 1780092888,
490 + "narHash": "sha256-B27esenlgT5jjh3kjCEn+xxsTDiiTRhu9ZXUxQZ7mZw=",
491 + "ref": "main",
492 + "rev": "a67cce7cef81d95d35b0f58f2848dfec9f5e20c7",
493 + "revCount": 331,
494 + "type": "git",
495 + "url": "https://git.madhouse-project.org/iocaine/nam-shub-of-enki"
496 + },
497 + "original": {
498 + "ref": "main",
499 + "type": "git",
500 + "url": "https://git.madhouse-project.org/iocaine/nam-shub-of-enki"
501 }
502 },
503 "nix": {
@@ -413,6 +555,31 @@
555 "type": "github"
556 }
557 },
558 + "nixocaine": {
559 + "inputs": {
560 + "iocaine-unstable": "iocaine-unstable",
561 + "nam-shub-of-enki": "nam-shub-of-enki",
562 + "nixpkgs": [
563 + "nixpkgs"
564 + ],
565 + "pre-commit-hooks": "pre-commit-hooks",
566 + "systems": "systems_5",
567 + "treefmt-nix": "treefmt-nix"
568 + },
569 + "locked": {
570 + "lastModified": 1780214096,
571 + "narHash": "sha256-x+TVoQeuSbl2URUoACzuopGBeHyc8V5ckD6BMeiJAZk=",
572 + "ref": "refs/heads/main",
573 + "rev": "6f27e771479281986b303e64515b07238a3694b6",
574 + "revCount": 152,
575 + "type": "git",
576 + "url": "https://git.madhouse-project.org/iocaine/nixocaine"
577 + },
578 + "original": {
579 + "type": "git",
580 + "url": "https://git.madhouse-project.org/iocaine/nixocaine"
581 + }
582 + },
583 "nixos-channel-scripts": {
584 "inputs": {
585 "nixpkgs": [
@@ -449,6 +616,22 @@
616 "type": "github"
617 }
618 },
619 + "nixpkgs-2505": {
620 + "locked": {
621 + "lastModified": 1764939437,
622 + "narHash": "sha256-4TLFHUwXraw9Df5mXC/vCrJgb50CRr3CzUzF0Mn3CII=",
623 + "owner": "NixOS",
624 + "repo": "nixpkgs",
625 + "rev": "00d2457e2f608b4be6fe8b470b0a36816324b0ae",
626 + "type": "github"
627 + },
628 + "original": {
629 + "owner": "NixOS",
630 + "ref": "nixos-25.05",
631 + "repo": "nixpkgs",
632 + "type": "github"
633 + }
634 + },
635 "nixpkgs-swh": {
636 "inputs": {
637 "nixpkgs": [
@@ -522,6 +705,29 @@
705 "type": "github"
706 }
707 },
708 + "pre-commit-hooks": {
709 + "inputs": {
710 + "flake-compat": "flake-compat_2",
711 + "gitignore": "gitignore",
712 + "nixpkgs": [
713 + "nixocaine",
714 + "nixpkgs"
715 + ]
716 + },
717 + "locked": {
718 + "lastModified": 1765911976,
719 + "narHash": "sha256-t3T/xm8zstHRLx+pIHxVpQTiySbKqcQbK+r+01XVKc0=",
720 + "owner": "cachix",
721 + "repo": "pre-commit-hooks.nix",
722 + "rev": "b68b780b69702a090c8bb1b973bab13756cc7a27",
723 + "type": "github"
724 + },
725 + "original": {
726 + "owner": "cachix",
727 + "repo": "pre-commit-hooks.nix",
728 + "type": "github"
729 + }
730 + },
731 "rfc39": {
732 "inputs": {
733 "nixpkgs": [
@@ -545,15 +751,17 @@
751 "root": {
752 "inputs": {
753 "agenix": "agenix",
754 + "ai-robots-txt": "ai-robots-txt",
755 "colmena": "colmena",
756 "darwin": "darwin_2",
757 "disko": "disko",
758 "flake-parts": "flake-parts",
759 "flake-utils": "flake-utils",
760 "freescout": "freescout",
761 + "geolite2-asn-mmdb": "geolite2-asn-mmdb",
762 "hydra": "hydra",
555 - "nft-prefix-import": "nft-prefix-import",
763 "nix": "nix",
764 + "nixocaine": "nixocaine",
765 "nixos-channel-scripts": "nixos-channel-scripts",
766 "nixpkgs": "nixpkgs",
767 "nixpkgs-swh": "nixpkgs-swh",
@@ -564,13 +772,13 @@
772 "simple-nixos-mailserver": "simple-nixos-mailserver",
773 "sops-nix": "sops-nix",
774 "srvos": "srvos",
567 - "treefmt-nix": "treefmt-nix"
775 + "treefmt-nix": "treefmt-nix_2"
776 }
777 },
778 "simple-nixos-mailserver": {
779 "inputs": {
780 "blobs": "blobs",
573 - "flake-compat": "flake-compat_2",
781 + "flake-compat": "flake-compat_3",
782 "git-hooks": "git-hooks",
783 "nixpkgs": [
784 "nixpkgs"
@@ -661,7 +869,70 @@
869 "type": "github"
870 }
871 },
872 + "systems_3": {
873 + "locked": {
874 + "lastModified": 1681028828,
875 + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
876 + "owner": "nix-systems",
877 + "repo": "default",
878 + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
879 + "type": "github"
880 + },
881 + "original": {
882 + "id": "systems",
883 + "type": "indirect"
884 + }
885 + },
886 + "systems_4": {
887 + "locked": {
888 + "lastModified": 1681028828,
889 + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
890 + "owner": "nix-systems",
891 + "repo": "default",
892 + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
893 + "type": "github"
894 + },
895 + "original": {
896 + "id": "systems",
897 + "type": "indirect"
898 + }
899 + },
900 + "systems_5": {
901 + "locked": {
902 + "lastModified": 1681028828,
903 + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
904 + "owner": "nix-systems",
905 + "repo": "default",
906 + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
907 + "type": "github"
908 + },
909 + "original": {
910 + "id": "systems",
911 + "type": "indirect"
912 + }
913 + },
914 "treefmt-nix": {
915 + "inputs": {
916 + "nixpkgs": [
917 + "nixocaine",
918 + "nixpkgs"
919 + ]
920 + },
921 + "locked": {
922 + "lastModified": 1766000401,
923 + "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
924 + "owner": "numtide",
925 + "repo": "treefmt-nix",
926 + "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
927 + "type": "github"
928 + },
929 + "original": {
930 + "owner": "numtide",
931 + "repo": "treefmt-nix",
932 + "type": "github"
933 + }
934 + },
935 + "treefmt-nix_2": {
936 "inputs": {
937 "nixpkgs": [
938 "nixpkgs-unstable"
flake.nix
+11 -5
@@ -12,6 +12,14 @@
12 inputs.nixpkgs.follows = "nixpkgs";
13 };
14
15 + ai-robots-txt.url = "https://github.com/ai-robots-txt/ai.robots.txt/raw/refs/heads/main/robots.json";
16 + ai-robots-txt.flake = false;
17 +
18 + # This is https://github.com/P3TERX/GeoLite.mmdb
19 + # Atlernative https://github.com/sapics/ip-location-db
20 + geolite2-asn-mmdb.url = "https://github.com/P3TERX/GeoLite.mmdb/raw/download/GeoLite2-ASN.mmdb";
21 + geolite2-asn-mmdb.flake = false;
22 +
23 nix = {
24 #url = "github:NixOS/nix/2.34-maintenance";
25 # TMP S3 upload abortions: https://github.com/NixOS/nix/pull/15949
@@ -31,6 +39,9 @@
39 inputs.nixpkgs.follows = "nixpkgs";
40 };
41
42 + nixocaine.url = "git+https://git.madhouse-project.org/iocaine/nixocaine";
43 + nixocaine.inputs.nixpkgs.follows = "nixpkgs";
44 +
45 rfc39 = {
46 url = "github:NixOS/rfc39";
47 inputs.nixpkgs.follows = "nixpkgs";
@@ -78,11 +89,6 @@
89 inputs.nixpkgs.follows = "nixpkgs";
90 };
91
81 - nft-prefix-import = {
82 - url = "github:mweinelt/nft-prefix-import";
83 - inputs.nixpkgs.follows = "nixpkgs-unstable";
84 - };
85 -
92 srvos = {
93 url = "github:numtide/srvos";
94 inputs.nixpkgs.follows = "nixpkgs";