turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

hosts/apu/configuration.nix

@@ -263,7 +263,7 @@
     host = "0.0.0.0";
     port = 8282;
     secretKeyFile = config.age.secrets.invidious-companion.path;
-    binaryHash = "sha256-nZXKpExKCc2zgSdVT3qo05NyFdpM9H9NJB5UWo+MVWI=";
+    binaryHash = "sha256-RU18Zt/dSMVF/hLeAg+J3BrmDUnO7L4mv/+g7A91WL8=";
   };
 
   networking.firewall = {

hosts/freun-dev/configuration.nix

@@ -20,6 +20,8 @@ in
         "flakes"
       ];
       auto-optimise-store = true;
+      min-free = 5 * 1024 * 1024 * 1024;
+      max-free = 10 * 1024 * 1024 * 1024;
     };
     gc = {
       automatic = true;
@@ -28,6 +30,8 @@ in
     };
   };
 
+  services.journald.extraConfig = "SystemMaxUse=500M";
+
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.binfmt.emulatedSystems = [ "x86_64-linux" ];
@@ -164,6 +168,8 @@ in
     "builder"
   ];
 
+  modules.tempBuildStorage.enable = true;
+
   # List packages installed in system profile. To search, run:
   # $ nix search wget
   environment.systemPackages = with pkgs; [

hosts/freun-dev/secrets.nix

@@ -58,5 +58,9 @@
         file = ../../secrets/invidious.age;
         owner = config.systemd.services.invidious.serviceConfig.User;
       };
+      "grafana/secret-key" = lib.mkIf config.services.grafana.enable {
+        file = ../../secrets/grafana/secret-key.age;
+        owner = config.systemd.services.grafana.serviceConfig.User;
+      };
     };
 }

hosts/freun-dev/services.nix

@@ -120,6 +120,7 @@ in
           user = smtp.username;
           from_address = smtp.from;
         };
+        security.secret_key = "$__file{${secrets."grafana/secret-key".path}}";
       };
     };
 
@@ -327,14 +328,6 @@ in
       subdomain = "irc";
     };
 
-    sillytavern = {
-      enable = true;
-      subdomain = "st";
-      listen = true;
-      whitelist = false;
-      port = 3100;
-    };
-
     nginx.virtualHosts."isarepomaa.com" = {
       forceSSL = true;
       enableACME = true;

hosts/radish/containers.nix

@@ -13,7 +13,6 @@
       enable = true;
       autoPrune.enable = true;
       defaultNetwork.settings.dns_enabled = true;
-      package = pkgs-unstable.podman;
       dockerCompat = true;
     };
   };

hosts/radish/desktop.nix

@@ -1,4 +1,4 @@
-{ pkgs-unstable, ... }:
+{ lib, pkgs-unstable, ... }:
 {
   services.displayManager.gdm.enable = true;
   services.desktopManager.gnome.enable = true;
@@ -24,7 +24,7 @@
   services.pipewire = {
     enable = true;
     alsa.enable = true;
-    alsa.support32Bit = true;
+    alsa.support32Bit = lib.mkForce false;
     pulse.enable = true;
     jack.enable = true;
   };

hosts/turny/configuration.nix

@@ -4,6 +4,7 @@
 
 {
   pkgs,
+  lib,
   ssh,
   config,
   inputs,
@@ -57,10 +58,10 @@ in
   # Select internationalisation properties.
   i18n.defaultLocale = "en_US.UTF-8";
 
-  # Define a user account. Don't forget to set a password with ‘passwd’.
+  # Define a user account. Don't forget to set a password with 'passwd'.
   users.users.jokke = {
     isNormalUser = true;
-    extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
+    extraGroups = [ "wheel" ]; # Enable 'sudo' for the user.
     packages = [ pkgs.nh ];
     openssh.authorizedKeys.keys = [ ssh.publicKeys.yubikey ];
     initialPassword = "changeme";
@@ -74,7 +75,7 @@ in
     wget
     htop
     git
-    inputs.turny.packages.${stdenv.hostPlatform.system}.default
+    alsa-utils
   ];
 
   # Enable the OpenSSH daemon.
@@ -88,11 +89,158 @@ in
     allInterfaces = [ "ssh" ];
   };
 
+  # Enable audio (ALSA)
+  hardware.alsa.enable = true;
+
+  # Complete config.txt settings: boot-critical u-boot lines plus SPI enable.
+  # The configtxt module generates the full config.txt, overriding the
+  # hardcoded one in sd-image-aarch64.nix which ignores these settings.
+  hardware.raspberry-pi.configtxt.settings = {
+    pi3 = {
+      kernel = "u-boot-rpi3.bin";
+      core_freq = 250;
+    };
+    pi02 = {
+      kernel = "u-boot-rpi3.bin";
+    };
+    pi4 = {
+      kernel = "u-boot-rpi4.bin";
+      enable_gic = true;
+      armstub = "armstub8-gic.bin";
+    };
+    all = {
+      arm_64bit = true;
+      enable_uart = true;
+      avoid_warnings = true;
+      dtparam = [
+        "audio=on"
+        "spi=on"
+      ];
+    };
+  };
+
+  # Use the configtxt module's generated config.txt when building SD images
+  sdImage.populateFirmwareCommands = let
+    inherit (config.hardware.raspberry-pi.configtxt) file;
+  in ''
+    (cd ${pkgs.raspberrypifw}/share/raspberrypi/boot && cp bootcode.bin fixup*.dat start*.elf $NIX_BUILD_TOP/firmware/)
+
+    cp ${file} firmware/config.txt
+
+    cp ${pkgs.ubootRaspberryPi3_64bit}/u-boot.bin firmware/u-boot-rpi3.bin
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2710-rpi-2-b.dtb firmware/
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2710-rpi-3-b.dtb firmware/
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2710-rpi-3-b-plus.dtb firmware/
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2710-rpi-cm3.dtb firmware/
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2710-rpi-zero-2.dtb firmware/
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2710-rpi-zero-2-w.dtb firmware/
+
+    cp ${pkgs.ubootRaspberryPi4_64bit}/u-boot.bin firmware/u-boot-rpi4.bin
+    cp ${pkgs.raspberrypi-armstubs}/armstub8-gic.bin firmware/armstub8-gic.bin
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2711-rpi-4-b.dtb firmware/
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2711-rpi-400.dtb firmware/
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2711-rpi-cm4.dtb firmware/
+    cp ${pkgs.raspberrypifw}/share/raspberrypi/boot/bcm2711-rpi-cm4s.dtb firmware/
+  '';
+
+  # Load SPI and GPIO kernel modules so /dev/spidev* and /dev/gpiomem exist
+  boot.kernelModules = [
+    "spi_bcm2835"
+    "bcm2835_gpiomem"
+  ];
+
+  # Use the firmware-passed device tree (with dtparam/dtoverlay applied)
+  # instead of u-boot loading a fresh DTB from FDTDIR
+  boot.loader.generic-extlinux-compatible.useGenerationDeviceTree = false;
+
+  # Mount the firmware partition so config.txt is accessible and can be
+  # updated on deploys. The sd-image module defaults to noauto; we need it
+  # mounted so the activation script can sync config.txt.
+  fileSystems."/boot/firmware".options = [
+    "nofail"
+    "defaults"
+  ];
+
+  # Sync the generated config.txt to the firmware partition on each deploy
+  # so dtparam/dtoverlay changes take effect without reflashing the SD card.
+  system.activationScripts.syncConfigTxt = {
+    text = ''
+      if mountpoint -q /boot/firmware; then
+        cp -f ${config.hardware.raspberry-pi.configtxt.file} /boot/firmware/config.txt
+      fi
+    '';
+  };
+
+  # Turny service
+  systemd.services.turny = {
+    description = "Turny Spotify RFID Controller";
+    documentation = [ "https://github.com/repomaa/turny" ];
+    after = [
+      "network.target"
+      "sound.target"
+    ];
+    wants = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = lib.getExe inputs.turny.packages.${pkgs.stdenv.hostPlatform.system}.default;
+      User = "turny";
+      Group = "turny";
+      WorkingDirectory = "/var/lib/turny";
+      Restart = "always";
+      RestartSec = 10;
+      RestartPreventExitStatus = 23;
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectSystem = "strict";
+      ProtectHome = true;
+      ReadWritePaths = [ "/var/lib/turny" ];
+      ProtectKernelTunables = false;
+      ProtectKernelModules = true;
+      ProtectControlGroups = true;
+      LimitNOFILE = 1024;
+      MemoryAccounting = true;
+      MemoryMax = "100M";
+      StandardOutput = "journal";
+      StandardError = "journal";
+      SyslogIdentifier = "turny";
+    };
+    environment = {
+      RUST_LOG = "info";
+      RUST_BACKTRACE = "1";
+    };
+  };
+
+  users.users.turny = {
+    isSystemUser = true;
+    group = "turny";
+    extraGroups = [
+      "gpio"
+      "spi"
+      "audio"
+    ];
+    home = "/var/lib/turny";
+    createHome = true;
+  };
+  users.groups.turny = { };
+  users.groups.gpio = { };
+  users.groups.spi = { };
+
+  # Udev rules for GPIO and SPI access
+  services.udev.extraRules = ''
+    SUBSYSTEM=="gpio", GROUP="gpio", MODE="0660"
+    SUBSYSTEM=="gpiomem", GROUP="gpio", MODE="0660"
+    SUBSYSTEM=="gpio", ACTION=="add", RUN+="${lib.getExe' pkgs.coreutils "sh"} -c 'chgrp gpio /sys/class/gpio/export /sys/class/gpio/unexport; chmod 0660 /sys/class/gpio/export /sys/class/gpio/unexport'"
+    SUBSYSTEM=="spidev", GROUP="spi", MODE="0660"
+  '';
+
   # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It's perfectly fine and recommended to leave
+  # settings for stateful data, like user locations and database versions
+  # on the system were taken. It's perfectly fine and recommended to leave
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "25.05"; # Did you read the comment?
+
+  sdImage.compressImage = false;
 }

hosts/turny/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM3To9DeTGzwiQN+uqNWZXKzGG1BJnLvYRgLm0/iI92Y turny