turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

hosts/freun-dev/configuration.nix

@@ -20,6 +20,8 @@ in
         "flakes"
       ];
       auto-optimise-store = true;
+      min-free = 5 * 1024 * 1024 * 1024;
+      max-free = 10 * 1024 * 1024 * 1024;
     };
     gc = {
       automatic = true;
@@ -28,6 +30,8 @@ in
     };
   };
 
+  services.journald.extraConfig = "SystemMaxUse=500M";
+
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
   boot.binfmt.emulatedSystems = [ "x86_64-linux" ];
@@ -164,6 +168,8 @@ in
     "builder"
   ];
 
+  modules.tempBuildStorage.enable = true;
+
   # List packages installed in system profile. To search, run:
   # $ nix search wget
   environment.systemPackages = with pkgs; [

hosts/freun-dev/secrets.nix

@@ -58,5 +58,9 @@
         file = ../../secrets/invidious.age;
         owner = config.systemd.services.invidious.serviceConfig.User;
       };
+      "grafana/secret-key" = lib.mkIf config.services.grafana.enable {
+        file = ../../secrets/grafana/secret-key.age;
+        owner = config.systemd.services.grafana.serviceConfig.User;
+      };
     };
 }

hosts/freun-dev/services.nix

@@ -120,6 +120,7 @@ in
           user = smtp.username;
           from_address = smtp.from;
         };
+        security.secret_key = "$__file{${secrets."grafana/secret-key".path}}";
       };
     };
 
@@ -327,14 +328,6 @@ in
       subdomain = "irc";
     };
 
-    sillytavern = {
-      enable = true;
-      subdomain = "st";
-      listen = true;
-      whitelist = false;
-      port = 3100;
-    };
-
     nginx.virtualHosts."isarepomaa.com" = {
       forceSSL = true;
       enableACME = true;