turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

modules/default.nix

@@ -11,6 +11,7 @@
     ./vlans.nix
     ./firewall.nix
     ./storage-box-mounts.nix
+    ./temp-build-storage.nix
     ./services
     inputs.agenix.nixosModules.default
   ];

modules/services/default.nix

@@ -26,7 +26,6 @@
     ./weechat.nix
     ./hledger-web.nix
     ./glance.nix
-    ./sillytavern.nix
     ./nqptp.nix
     ./actual.nix
     ./voidauth.nix

modules/services/dhcp-dns-sync/dhcp-leases-to-unbound.cr

@@ -86,18 +86,17 @@ def get_leases(interface : String, networkctl_path : String? = nil) : Array(Leas
   cmd = networkctl_path ? "#{networkctl_path}" : "networkctl"
   args = ["status", interface, "--json=short"]
 
-  Process.run(cmd, args, output: Process::Redirect::Pipe, error: Process::Redirect::Pipe) do |process|
-    result = process.wait
-    output = process.output.to_s
+  process = Process.new(cmd, args, output: Process::Redirect::Pipe, error: Process::Redirect::Pipe)
+  output = process.output.gets_to_end
+  error = process.error.gets_to_end
+  result = process.wait
 
-    unless result.success?
-      error = process.error.to_s
-      raise "networkctl failed (exit code #{result.exit_code}): #{error.empty? ? output : error}"
-    end
-
-    status = NetworkStatus.from_json(output)
-    status.dhcp_server.try(&.leases) || [] of Lease
+  unless result.success?
+    raise "networkctl failed (exit code #{result.exit_code}): #{error.empty? ? output : error}"
   end
+
+  status = NetworkStatus.from_json(output)
+  status.dhcp_server.try(&.leases) || [] of Lease
 end
 
 def write_if_changed(content : String, path : String) : Bool
@@ -154,12 +153,12 @@ def reload_unbound(unbound_control_path : String?)
   cmd = unbound_control_path ? "#{unbound_control_path}" : "unbound-control"
   puts "Reloading Unbound..."
 
-  Process.run(cmd, ["reload"], output: Process::Redirect::Pipe, error: Process::Redirect::Pipe) do |process|
-    result = process.wait
+  process = Process.new(cmd, ["reload"], output: Process::Redirect::Pipe, error: Process::Redirect::Pipe)
+  error = process.error.gets_to_end
+  result = process.wait
 
-    unless result.success?
-      raise "unbound reload failed (exit code #{result.exit_code}): #{process.error}"
-    end
+  unless result.success?
+    raise "unbound reload failed (exit code #{result.exit_code}): #{error}"
   end
 
   puts "Unbound reloaded successfully."

modules/services/sillytavern.nix

@@ -1,28 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.sillytavern;
-  fqdn = "${cfg.subdomain}.${config.networking.domain}";
-in
-{
-  options.services.sillytavern = {
-    subdomain = lib.mkOption {
-      type = lib.types.str;
-      default = "sillytavern";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.webserver = {
-      enable = lib.mkDefault true;
-      vHosts.${fqdn} = {
-        tailscaleAuth = true;
-        proxyBuffering = false;
-        locations."/".proxyPort = cfg.port;
-      };
-    };
-  };
-}

modules/temp-build-storage.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.modules.tempBuildStorage;
+in
+{
+  options.modules.tempBuildStorage = {
+    enable = lib.mkEnableOption "temporary build storage volume";
+
+    device = lib.mkOption {
+      type = lib.types.str;
+      default = "/dev/sdb";
+      description = "Block device to mount for temporary nix build storage.";
+    };
+
+    mountPoint = lib.mkOption {
+      type = lib.types.str;
+      default = "/mnt/build";
+      description = "Mount point for the temporary build storage.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    fileSystems.${cfg.mountPoint} = {
+      device = cfg.device;
+      fsType = "ext4";
+      options = [
+        "nofail"
+        "defaults"
+      ];
+    };
+
+    nix.settings.build-dir = cfg.mountPoint;
+  };
+}