Merge weasel and gitea-dump

Proper override for haskell package

madness

Fix nix-serve-ng override

keys.nix

@@ -22,9 +22,8 @@ rec {
     storage    = [ bay lake2 ];
     monitor    = [ hut ];
     login      = [ apex ];
-    services   = [ tent ];
 
-    system     = storage ++ monitor ++ login ++ services;
+    system     = storage ++ monitor ++ login;
     safe       = system ++ compute;
     all        = safe ++ playground;
   };

m/apex/nfs.nix

@@ -7,7 +7,7 @@
     mountdPort = 4002;
     statdPort = 4000;
     exports = ''
-      /home 10.0.40.0/21(rw,async,no_subtree_check,no_root_squash)
+      /home 10.0.40.0/24(rw,async,no_subtree_check,no_root_squash)
       /home 10.106.0.0/24(rw,async,no_subtree_check,no_root_squash)
     '';
   };
@@ -15,19 +15,19 @@
     # Check with `rpcinfo -p`
     extraCommands = ''
       # Accept NFS traffic from compute nodes but not from the outside
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p tcp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p tcp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept
       # Same but UDP
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 111   -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 2049  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4000  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4001  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 4002  -j nixos-fw-accept
-      iptables -A nixos-fw -p udp -s 10.0.40.0/21 --dport 20048 -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 111   -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 2049  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4000  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4001  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 4002  -j nixos-fw-accept
+      iptables -A nixos-fw -p udp -s 10.0.40.0/24 --dport 20048 -j nixos-fw-accept
 
       # Accept NFS traffic from wg0
       iptables -A nixos-fw -p tcp -i wg0 -s 10.106.0.0/24 --dport 111   -j nixos-fw-accept

m/bay/configuration.nix

@@ -35,7 +35,7 @@
         # Accept monitoring requests from hut
         iptables -A nixos-fw -p tcp -s hut -m multiport --dport 9283,9002 -j nixos-fw-accept
         # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
       '';
     };
   };

m/common/base.nix

@@ -7,6 +7,7 @@
     ./base/august-shutdown.nix
     ./base/boot.nix
     ./base/env.nix
+    ./base/fish.nix
     ./base/fs.nix
     ./base/hw.nix
     ./base/net.nix

m/common/base/env.nix

@@ -53,9 +53,22 @@
     VISUAL = "vim";
   };
 
-  programs.bash.promptInit = ''
-    PS1="\h\\$ "
-  '';
+  programs.bash.promptInit = # bash
+    ''
+      if echo "$PATH" | grep -qc '/nix/store'; then
+        # Inside a nix shell, dumb prompt
+        PS1="\h\\$ "
+      elif [ "$TERM" != "dumb" ] ; then
+        PROMPT_COLOR="1;31m"
+        ((UID)) && PROMPT_COLOR="1;32m"
+
+        PS1="\n\[\033[$PROMPT_COLOR\][\[\e]0;\u@\h: \w\a\]\u@\h:\w]\\$\[\033[0m\] "
+
+        if test "$TERM" = "xterm"; then
+          PS1="\[\033]2;\h:\u:\w\007\]$PS1"
+        fi
+      fi
+    '';
 
   time.timeZone = "Europe/Madrid";
   i18n.defaultLocale = "en_DK.UTF-8";

m/common/base/fish.nix

@@ -0,0 +1,3 @@
+{
+  programs.fish.enable = true;
+}

m/common/base/users.nix

@@ -87,6 +87,13 @@
         openssh.authorizedKeys.keys = [
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIIFiqXqt88VuUfyANkZyLJNiuroIITaGlOOTMhVDKjf abonerib@bsc"
         ];
+        shell = pkgs.fish;
+        packages = with pkgs; [
+          fzf
+          jujutsu
+          neovim
+          starship
+        ];
       };
 
       vlopez = {

m/lake2/configuration.nix

@@ -57,7 +57,7 @@
         # Accept monitoring requests from hut
         iptables -A nixos-fw -p tcp -s hut --dport 9002 -j nixos-fw-accept
         # Accept all Ceph traffic from the local network
-        iptables -A nixos-fw -p tcp -s 10.0.40.0/21 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
+        iptables -A nixos-fw -p tcp -s 10.0.40.0/24 -m multiport --dport 3300,6789,6800:7568 -j nixos-fw-accept
       '';
     };
   };

m/tent/configuration.nix

@@ -17,7 +17,6 @@
     ../module/vpn-dac.nix
     ../module/hut-substituter.nix
     ../module/tc1-board.nix
-    ../module/ceph.nix
   ];
 
   # Select the this using the ID to avoid mismatches
@@ -65,13 +64,6 @@
     fsType = "ext4";
   };
 
-  # Mount the NFS home
-  fileSystems."/nfs/home" = {
-    device = "10.106.0.30:/home";
-    fsType = "nfs";
-    options = [ "nfsvers=3" "rsize=1024" "wsize=1024" "cto" "nofail" ];
-  };
-
   # Make a /vault/$USER directory for each user.
   systemd.services.create-vault-dirs = let
     # Take only normal users in tent

m/tent/gitea.nix

@@ -1,7 +1,4 @@
 { config, lib, ... }:
-let
-  cfg = config.services.gitea;
-in
 {
   services.gitea = {
     enable = true;
@@ -9,20 +6,14 @@ in
 
     settings = {
       server = {
-        ROOT_URL = "https://jungle.bsc.es/git/";
-        LOCAL_ROOT_URL = "https://jungle.bsc.es/git/";
         LANDING_PAGE = "explore";
       };
-      metrics.ENABLED = true;
       service = {
-        DISABLE_REGISTRATION = true;
-        REGISTER_MANUAL_CONFIRM = true;
-        ENABLE_NOTIFY_MAIL = true;
       };
       log.LEVEL = "Warn";
 
       mailer = {
-        ENABLED       = true;
+        ENABLED       = false;
         FROM          = "jungle-robot@bsc.es";
         PROTOCOL      = "sendmail";
         SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
@@ -32,14 +23,15 @@ in
 
     dump = {
       enable = false; # Do not enable NixOS module, use our custom systemd script below
-      backupDir = "/vault/backup/gitea";
+      backupDir = "/vault/gitea";
     };
   };
 
-  systemd.services.gitea-backup = let
+  systemd.services.gitea-dump-rotating = let
+    cfg = config.services.gitea;
     exe = lib.getExe cfg.package;
   in {
-    description = "Gitea daily backup";
+    description = "gitea dump rotation";
     after = [ "gitea.service" ];
     path = [ cfg.package ];
 
@@ -60,21 +52,14 @@ in
       name="gitea-dump-$(date +%a).${cfg.dump.type}"
       ${exe} dump --type ${cfg.dump.type} --file - >"$name.tmp"
       mv "$name.tmp" "$name"
-      cp "$name" "/ceph/backup/gitea/$name"
     '';
   };
 
-  # Create also the /ceph directories if needed
-  systemd.tmpfiles.rules = [
-    "d /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
-    "z /ceph/backup/gitea/ 0750 ${cfg.user} ${cfg.group} - -"
-  ];
-
-  systemd.timers.gitea-backup = {
-    description = "Update timer for gitea-backup";
-    partOf = [ "gitea-backup.service" ];
+  systemd.timers.gitea-dump-rotating = {
+    description = "Update timer for gitea-dump-rotating";
+    partOf = [ "gitea-dump-rotating.service" ];
     wantedBy = [ "timers.target" ];
-    timerConfig.OnCalendar = cfg.dump.interval;
+    timerConfig.OnCalendar = config.services.gitea.dump.interval;
   };
 
   # Allow gitea user to send mail

m/weasel/configuration.nix

@@ -1,9 +1,11 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 
 {
   imports = [
     ../common/ssf.nix
     ../module/hut-substituter.nix
+    ./hydra.nix
+    ../tent/gitea.nix
   ];
 
   # Select this using the ID to avoid mismatches
@@ -30,4 +32,22 @@
       prefixLength = 24;
     } ];
   };
+
+  services.nix-serve = {
+    enable = true;
+    bindAddress = "0.0.0.0";
+    port = 5000;
+    package = pkgs.haskell.lib.overrideSrc (pkgs.haskell.packages.ghc96.nix-serve-ng.override { nix = pkgs.nixVersions.nix_2_28; }) {
+      src = pkgs.fetchgit {
+        url = "https://jungle.bsc.es/git/abonerib/nix-serve-ng.git";
+        rev = "9c056641300a826db66b66d7e584b2541d38927a";
+        hash = "sha256-y69ZchFiZOU71eyeljcQgLxkLk5JUzZfanq8Yzw4MkI=";
+      };
+      version = "unstable";
+    };
+
+    secretKeyFile = "/var/cache-priv-key.pem";
+    # Public key:
+    # 10.0.40.6:8jBhIdXEBap+Qo+vc1/fnV9vj43A2oDk839EEheRr/U=
+  };
 }

m/weasel/hydra.nix

@@ -0,0 +1,57 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  services.hydra = {
+    enable = true;
+
+    # Wrap hydra so it puts quiet flag every time... This is dumb and annoying,
+    # but i can't override the systemd ExecStart without running into infinite
+    # recursion.
+    package = pkgs.symlinkJoin {
+      name = "hydra-quiet";
+      paths = [ pkgs.hydra ];
+      postBuild = ''
+        for prog in hydra-queue-runner hydra-evaluator ; do
+          prev=$(realpath $out/bin/$prog)
+          rm $out/bin/$prog
+          cat >$out/bin/$prog <<EOF
+        #!/bin/sh
+        args=()
+        for arg in "\$@"; do
+          if [ "\$arg" != "-v" ]; then
+            args+=("\$arg")
+          fi
+        done
+        exec $prev --quiet "\''${args[@]}"
+        EOF
+
+          chmod +x $out/bin/$prog
+        done
+      '';
+    };
+
+    hydraURL = "http://localhost:3001"; # externally visible URL
+    notificationSender = "hydra@jungle.bsc.es"; # e-mail of Hydra service
+    port = 3001;
+    # a standalone Hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
+    buildMachinesFiles = [ ];
+    # you will probably also want, otherwise *everything* will be built from scratch
+    useSubstitutes = true;
+    listenHost = "0.0.0.0"; # Force IPv4
+  };
+
+  systemd.services.hydra-send-stats.enable = lib.mkForce false;
+
+  networking.firewall.allowedTCPPorts = [ config.services.hydra.port ];
+
+  nix.settings.extra-allowed-uris = [
+    "git+ssh://git@bscpm04.bsc.es"
+    "git+ssh://git@gitlab-internal.bsc.es"
+    "https://github.com"
+    "git+ssh://github.com"
+  ];
+}

overlay.nix

@@ -19,11 +19,7 @@ let
     cudainfo = prev.callPackage ./pkgs/cudainfo/default.nix { };
     #extrae = callPackage ./pkgs/extrae/default.nix { }; # Broken and outdated
     gpi-2 = callPackage ./pkgs/gpi-2/default.nix { };
-    intel-apt = callPackage ./pkgs/intel-oneapi/packages.nix { };
     intelPackages_2023 = callPackage ./pkgs/intel-oneapi/2023.nix { };
-    intelPackages_2024 = final.intel-apt.hpckit_2024;
-    intelPackages_2025 = final.intel-apt.hpckit_2025;
-    intelPackages = final.intelPackages_2025;
     jemallocNanos6 = callPackage ./pkgs/nanos6/jemalloc.nix { };
     # FIXME: Extend this to all linuxPackages variants. Open problem, see:
     # https://discourse.nixos.org/t/whats-the-right-way-to-make-a-custom-kernel-module-available/4636
@@ -48,7 +44,6 @@ let
     #nix-wrap = callPackage ./pkgs/nix-wrap/default.nix { };
     nodes = callPackage ./pkgs/nodes/default.nix { };
     nosv = callPackage ./pkgs/nosv/default.nix { };
-    oneMath = callPackage ./pkgs/onemath/default.nix { };
     openmp = callPackage ./pkgs/llvm-ompss2/openmp.nix { monorepoSrc = final.clangOmpss2Unwrapped.src; version = final.clangOmpss2Unwrapped.version; };
     openmpv = final.openmp.override { enableNosv = true; enableOvni = true; };
     osumb = callPackage ./pkgs/osu/default.nix { };
@@ -66,8 +61,6 @@ let
     stdenvClangOmpss2NodesOmpv = final.stdenv.override { cc = final.clangOmpss2NodesOmpv; allowedRequisites = null; };
     tagaspi = callPackage ./pkgs/tagaspi/default.nix { };
     tampi = callPackage ./pkgs/tampi/default.nix { };
-    tasycl = callPackage ./pkgs/tasycl/default.nix { };
-    tasycl-acpp = callPackage ./pkgs/tasycl/default.nix { useIntel = false; };
     upc-qaire-exporter = prev.callPackage ./pkgs/upc-qaire-exporter/default.nix { };
     wxparaver = callPackage ./pkgs/paraver/default.nix { };
   };
@@ -77,8 +70,6 @@ let
     #sigsegv = callPackage ./test/reproducers/sigsegv.nix { };
     hello-c = callPackage ./test/compilers/hello-c.nix { };
     hello-cpp = callPackage ./test/compilers/hello-cpp.nix { };
-    hello-sycl = callPackage ./test/compilers/hello-sycl.nix { };
-    hello-syclompss = callPackage ./test/compilers/icpx-ompss2.nix { };
     lto = callPackage ./test/compilers/lto.nix { };
     asan = callPackage ./test/compilers/asan.nix { };
     intel2023-icx-c   = hello-c.override   { stdenv = final.intelPackages_2023.stdenv; };
@@ -88,13 +79,6 @@ let
     intel2023-ifort   = callPackage ./test/compilers/hello-f.nix {
       stdenv = final.intelPackages_2023.stdenv-ifort;
     };
-    intel2024-icx-c   = hello-c.override   { stdenv = final.intelPackages_2024.stdenv; };
-    intel2025-icx-c   = hello-c.override   { stdenv = final.intelPackages_2025.stdenv; };
-    intel2024-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2024.stdenv; };
-    intel2025-icx-cpp = hello-cpp.override { stdenv = final.intelPackages_2025.stdenv; };
-    # intel2023-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2023; }; # broken
-    intel2024-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2024; };
-    intel2025-sycl    = hello-sycl.override { intelPackages = final.intelPackages_2025; };
     clangOmpss2-lto   = lto.override       { stdenv = final.stdenvClangOmpss2Nanos6; };
     clangOmpss2-asan  = asan.override      { stdenv = final.stdenvClangOmpss2Nanos6; };
     clangOmpss2-task  = callPackage ./test/compilers/ompss2.nix {

pkgs/intel-oneapi/2023.nix

@@ -40,19 +40,45 @@ let
     mpi      = "2021.9.0";
   };
 
-  findMatch = name:
-  let
-    aptPackages = builtins.fromJSON (builtins.readFile ./packages.json);
-    matches = lib.filter (x: name == x.pname) aptPackages;
-    n = lib.length matches;
-    match = builtins.traceVerbose (name + " -- ${builtins.toString n}") (builtins.head matches);
+  aptPackageIndex = stdenv.mkDerivation {
+    name = "intel-oneapi-packages";
+    srcs = [
+      # Run update.sh to update the package lists
+      ./amd64-packages ./all-packages
+    ];
+    phases = [ "installPhase" ];
+    installPhase = ''
+      awk -F': ' '\
+        BEGIN   { print "[ {" } \
+        NR>1 && /^Package: / { print "} {"; } \
+        /: /    { printf "%s = \"%s\";\n", $1, $2 } \
+        END     { print "} ]" }' $srcs > $out
+    '';
+  };
 
-    apthost = "https://apt.repos.intel.com/oneapi/";
+  aptPackages = import aptPackageIndex;
+
+  apthost = "https://apt.repos.intel.com/oneapi/";
+
+  getSum = pkgList: name:
+  let
+    matches = lib.filter (x: name == x.Package) pkgList;
+    #n = lib.length matches;
+    #match = builtins.trace (name + " -- ${builtins.toString n}") (lib.elemAt matches 0);
+    match = lib.elemAt matches 0;
   in
-    {
-      url = apthost + match.filename;
-      sha256 = match.sha256;
-    };
+    match.SHA256;
+
+  getUrl = pkgList: name:
+  let
+    matches = lib.filter (x: name == x.Package) pkgList;
+    #match = assert lib.length matches == 1; lib.elemAt matches 0;
+    n = lib.length matches;
+    match =
+      #builtins.trace (name + " -- n=${builtins.toString n}")
+      (lib.elemAt matches 0);
+  in
+    apthost + match.Filename;
 
   uncompressDebs = debs: name: stdenv.mkDerivation {
     name = name;
@@ -72,7 +98,10 @@ let
 
   joinDebs = name: names:
   let
-    debs = builtins.map (x: builtins.fetchurl (findMatch x)) names;
+    urls = builtins.map (x: getUrl aptPackages x) names;
+    sums = builtins.map (x: getSum aptPackages x) names;
+    getsrc = url: sha256: builtins.fetchurl { inherit url sha256; };
+    debs = lib.zipListsWith getsrc urls sums;
   in
     uncompressDebs debs "${name}-source";
 
@@ -441,7 +470,7 @@ let
     '';
   };
 
-  ifort-wrapper = wrapIntel {
+  ifort-wrapper = wrapIntel rec {
     cc = intel-compiler-fortran;
     mygcc = gcc;
     extraBuild = ''

pkgs/intel-oneapi/packages.nix

@@ -1,297 +0,0 @@
-{
-  lib,
-  stdenv,
-  callPackage,
-  dpkg,
-  fetchurl,
-
-  sqlite,
-  elfutils,
-}:
-
-let
-  inherit (builtins)
-    attrNames
-    attrValues
-    concatMap
-    elem
-    filter
-    fromJSON
-    getAttr
-    groupBy
-    head
-    isNull
-    listToAttrs
-    map
-    mapAttrs
-    readFile
-    replaceStrings
-    splitVersion
-    ;
-  inherit (lib)
-    converge
-    findFirst
-    groupBy'
-    hasPrefix
-    optional
-    pipe
-    take
-    toInt
-    toList
-    versionAtLeast
-    versionOlder
-    ;
-
-  aptData = fromJSON (readFile ./packages.json);
-
-  # Compare versions in debian control file syntax
-  # See: https://www.debian.org/doc/debian-policy/ch-relationships.html#syntax-of-relationship-fields
-  #
-  # NOTE: this is not a proper version comparison
-  #
-  # A proper version solver, should aggregate dependencies with the same name
-  # and compute the constraint (e.g. a (>= 2) a (<< 5) -> 2 <= a << 5)
-  #
-  # But in the intel repo, there are no such "duplicated" dependencies to specify
-  # upper limits, which leads to issues when intel-hpckit-2021 depends on things
-  # like intel-basekit >= 2021.1.0-2403 and we end up installing the newest
-  # basekit instead of the one from 2021.
-  #
-  # To mitigate this, >= is set to take the latest version with matching major
-  # and minor (only revision and patch are allowed to change)
-  compareVersions =
-    got: kind: want:
-    let
-      g0 = take 2 (splitVersion got);
-      w0 = take 2 (splitVersion want);
-    in
-    if isNull want then
-      true
-    else if kind == "=" then
-      got == want
-    else if kind == "<<" then
-      versionOlder got want
-    else if kind == "<=" then
-      versionAtLeast want got
-    else if kind == ">>" then
-      versionOlder want got
-    else if kind == ">=" then
-      (g0 == w0) && versionAtLeast got want # always match major version
-    else
-      throw "unknown operation: ${kind}";
-
-  findMatching =
-    {
-      pname,
-      kind,
-      version,
-    }:
-    findFirst (x: pname == x.pname && compareVersions x.version kind version) null aptData;
-
-  isIntel = pkg: (hasPrefix "intel-" pkg.pname);
-
-  expandDeps =
-    pkg: (map findMatching (filter isIntel pkg.dependencies)) ++ (optional (pkg.size != 0) pkg);
-
-  # get the oldest by major version. If they have the same major version, take
-  # the newest. This prevents most issues with resolutions
-  # versionOlder b a -> true if b is older than a (b `older` a)
-  getNewerInMajor =
-    a: b:
-    let
-      va = a.version;
-      vb = b.version;
-      va0 = head (splitVersion va);
-      vb0 = head (splitVersion vb);
-    in
-    if isNull a then
-      b
-    else if va0 != vb0 then
-      if va0 > vb0 then b else a
-    else if versionOlder vb va then
-      a
-    else
-      b;
-  removeDups = l: attrValues (groupBy' getNewerInMajor null (getAttr "provides") l);
-
-  _resolveDeps = converge (l: removeDups (concatMap expandDeps l));
-  resolveDeps =
-    pkg:
-    let
-      deps = _resolveDeps (toList pkg);
-      namedDeps = (map (x: "${x.pname}-${x.version}") deps);
-    in
-    builtins.traceVerbose (builtins.deepSeq namedDeps namedDeps) deps;
-
-  blacklist = [
-    "intel-basekit-env"
-    "intel-basekit-getting-started"
-    "intel-hpckit-env"
-    "intel-hpckit-getting-started"
-    "intel-oneapi-advisor"
-    "intel-oneapi-common-licensing"
-    "intel-oneapi-common-oneapi-vars"
-    "intel-oneapi-common-vars"
-    "intel-oneapi-compiler-cpp-eclipse-cfg"
-    "intel-oneapi-compiler-dpcpp-eclipse-cfg"
-    "intel-oneapi-condaindex"
-    "intel-oneapi-dev-utilities-eclipse-cfg"
-    "intel-oneapi-dpcpp-ct-eclipse-cfg"
-    "intel-oneapi-eclipse-ide"
-    "intel-oneapi-hpc-toolkit-getting-started"
-    "intel-oneapi-icc-eclipse-plugin-cpp"
-    "intel-oneapi-vtune"
-    "intel-oneapi-vtune-eclipse-plugin-vtune"
-  ];
-
-  isInBlacklist = pkg: elem pkg.provides blacklist;
-  removeBlacklist = filter (e: !(isInBlacklist e));
-
-  dpkgExtractAll =
-    pname: version:
-    { srcs, deps }:
-    stdenv.mkDerivation {
-      inherit pname version srcs;
-
-      nativeBuildInputs = [ dpkg ];
-      phases = [ "installPhase" ];
-
-      passthru = { inherit deps; };
-
-      installPhase = ''
-        mkdir -p $out
-        for src in $srcs; do
-          echo "Unpacking $src"
-          dpkg -x $src $out
-        done
-      '';
-    };
-
-  apthost = "https://apt.repos.intel.com/oneapi/";
-  fetchDeb =
-    p:
-    fetchurl {
-      url = apthost + p.filename;
-      inherit (p) sha256;
-    };
-
-  buildIntel =
-    pkg:
-    pipe pkg [
-      resolveDeps
-      removeBlacklist
-      (l: {
-        srcs = map fetchDeb l;
-        deps = l;
-      })
-      (dpkgExtractAll "${pkg.provides}-extracted" pkg.version)
-    ];
-
-  findHpcKit =
-    year:
-    findMatching {
-      pname = "intel-hpckit";
-      kind = "<<";
-      version = toString (year + 1);
-    };
-  years = map toInt (attrNames components);
-
-  patchIntel = callPackage ./patch_intel.nix { };
-
-  # Version information for each hpckit. This is used to normalize the paths
-  # so that files are in $out/{bin,lib,include...} instead of all over the place
-  # in $out/opt/intel/oneapi/*/*/{...}.
-  #
-  # The most important is the compiler component, which is used to build the
-  # stdenv for the hpckit.
-  #
-  # NOTE: this have to be manually specified, so we can avoid IFD. To add a
-  # new version, add a new field with an empty attrset, (e.g. "2026" = {}; ),
-  # build hpckit_2026.unpatched and use the values from
-  # result/opt/intel/oneapi/* to populate the attrset.
-  #
-  # WARN: if there are more than one version in the folders of the unpatched
-  # components, our dependency resolution hacks have probably failed and the
-  # package set may be broken.
-  components = {
-    "2025" = {
-      ishmem = "1.4";
-      pti = "0.13";
-      tcm = "1.4";
-      umf = "0.11";
-
-      ccl = "2021.16";
-      compiler = "2025.2";
-      dal = "2025.8";
-      debugger = "2025.2";
-      dev-utilities = "2025.2";
-      dnnl = "2025.2";
-      dpcpp-ct = "2025.2";
-      dpl = "2022.9";
-      ipp = "2022.2";
-      ippcp = "2025.2";
-      mkl = "2025.2";
-      mpi = "2021.16";
-      tbb = "2022.2";
-    };
-    "2024" = {
-      tcm = "1.1";
-
-      ccl = "2021.13";
-      compiler = "2024.2";
-      dal = "2024.6";
-      debugger = "2024.2";
-      dev-utilities = "2024.2";
-      diagnostics = "2024.2";
-      dnnl = "2024.2";
-      dpcpp-ct = "2024.2";
-      dpl = "2022.6";
-      ipp = "2021.12";
-      ippcp = "2021.12";
-      mkl = "2024.2";
-      mpi = "2021.13";
-      tbb = "2021.13";
-
-      extraPackages = [
-        sqlite
-        elfutils
-      ];
-    };
-  };
-
-  replaceDots = replaceStrings [ "." ] [ "_" ];
-
-in
-lib.recurseIntoAttrs (
-  listToAttrs (
-    map (
-      year:
-      let
-        year_str = toString year;
-      in
-      {
-        name = "hpckit_${year_str}";
-        value = patchIntel {
-          unpatched = buildIntel (findHpcKit year);
-          components = components.${year_str};
-        };
-      }
-    ) years
-  )
-)
-// {
-  apt = pipe aptData [
-    (groupBy (p: replaceDots p.provides))
-    (mapAttrs (
-      _: l:
-      listToAttrs (
-        map (pkg: {
-          name = replaceDots ("v" + pkg.version);
-          value = pkg;
-        }) l
-      )
-    ))
-  ];
-
-  inherit resolveDeps patchIntel buildIntel;
-}

pkgs/intel-oneapi/patch_intel.nix

@@ -1,191 +0,0 @@
-{
-  stdenv,
-  stdenvNoCC,
-  lib,
-  symlinkJoin,
-  autoPatchelfHook,
-  wrapCCWith,
-  overrideCC,
-  gcc,
-  hwloc,
-  libelf,
-  libgcc,
-  libffi_3_3,
-  libpsm2,
-  libuuid,
-  libxml2,
-  numactl,
-  ocl-icd,
-  openssl,
-  python3,
-  rdma-core,
-  ucx,
-  zlib,
-}:
-
-lib.makeOverridable (
-  {
-    unpatched,
-    components ? { },
-    extraPackages ? components.extraPackages or [ ],
-  }:
-
-  let
-    inherit (builtins)
-      attrValues
-      filter
-      mapAttrs
-      removeAttrs
-      ;
-
-    __components = removeAttrs components [ "extraPackages" ];
-    _components = __components;
-    # _components = lib.traceSeqN 2 {
-    #   inherit unpatched __components;
-    #   deps = builtins.map (x: "${x.pname}-${x.version}") unpatched.deps;
-    # } __components;
-
-    wrapIntel =
-      cc:
-      let
-        targetConfig = stdenv.targetPlatform.config;
-      in
-      (wrapCCWith {
-        inherit cc;
-
-        nixSupport = {
-          cc-ldflags = [
-            "-L${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}"
-            "-L${gcc.cc.lib}/lib"
-            "-L${libgcc.out}/lib"
-            "-L${cc}/lib"
-          ];
-          cc-cflags = [
-            "--gcc-toolchain=${gcc.cc}"
-            "-isystem \"${cc.original}/lib/clang/*/include\""
-            "-isystem ${cc}/include"
-            "-isystem ${cc}/include/intel64"
-            "-isystem ${gcc.cc}/lib/gcc/${targetConfig}/${gcc.version}/include"
-          ];
-          libcxx-cxxflags = [
-            # "--gcc-toolchain=${gcc.cc}"
-            "-isystem ${gcc.cc}/include/c++/${gcc.version}"
-            "-isystem ${gcc.cc}/include/c++/${gcc.version}/${targetConfig}"
-          ];
-        };
-
-        extraBuildCommands = ''
-          # FIXME: We should find a better way to modify the PATH instead of using
-          # this ugly hack. See https://jungle.bsc.es/git/rarias/bscpkgs/issues/9
-          echo 'path_backup="${gcc.cc}/bin:$path_backup"' >>$out/nix-support/cc-wrapper-hook
-
-          # Disable hardening by default
-          echo "" > $out/nix-support/add-hardening.sh
-
-          wrap icx  $wrapper $ccPath/icx
-          wrap icpx $wrapper $ccPath/icpx
-          wrap ifx  $wrapper $ccPath/ifx
-
-          ln -s $out/bin/icpx $out/bin/c++
-          ln -s $out/bin/icx  $out/bin/cc
-
-          sed -i 's/.*isCxx=0/isCxx=1/' $out/bin/icpx
-
-          # Use this to detect when a compiler subprocess is called
-          # from icpx (--fsycl-host-compiler)
-          echo 'export NIX_CC_WRAPPER_INTEL=1' >>$out/nix-support/cc-wrapper-hook
-
-          # oneMath looks for sycl libraries in bin/../lib
-          ln -s ${cc}/lib $out/lib
-          ln -s ${cc}/include $out/include
-        '';
-      }).overrideAttrs
-        (old: {
-          installPhase = old.installPhase + ''
-            export named_cc="icx"
-            export named_cxx="icpx"
-            export named_fc="ifx"
-          '';
-        });
-
-  in
-  stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = lib.removeSuffix "-extracted" unpatched.pname;
-    inherit (unpatched) version;
-    src = unpatched;
-
-    phases = [
-      "installPhase"
-      "fixupPhase"
-    ];
-    buildInputs = [
-      libffi_3_3
-      libelf
-      libxml2
-      hwloc
-      numactl
-      libuuid
-      libpsm2
-      zlib
-      ocl-icd
-      rdma-core
-      ucx
-      openssl
-      python3
-      stdenv.cc.cc.lib
-    ]
-    ++ extraPackages;
-
-    autoPatchelfIgnoreMissingDeps = [
-      "libhwloc.so.5"
-      "libcuda.so.1"
-      "libze_loader.so.1"
-    ];
-
-    # There are broken symlinks that go outside packages, ignore them
-    dontCheckForBrokenSymlinks = true;
-
-    nativeBuildInputs = [ autoPatchelfHook ];
-    installPhase = ''
-      cp -r $src/opt/intel/oneapi/ $out
-    '';
-
-    passthru =
-      let
-        pkgs = mapAttrs (
-          folder: version:
-          let
-            original = "${finalAttrs.finalPackage}/${folder}/${version}";
-          in
-          symlinkJoin {
-            pname = "intel-${folder}";
-            inherit version;
-            paths = [ original ];
-            passthru = { inherit original; };
-          }
-        ) _components;
-      in
-      pkgs
-      // {
-        inherit unpatched;
-        pkgs = lib.recurseIntoAttrs pkgs;
-        components = _components;
-
-        # This contains all packages properly symlinked into toplevel directories
-        # in $out.
-        #
-        # NOTE: there are clashes with packages that have symlinks outside their
-        # scope (libtcm and env/vars.sh)
-        all = symlinkJoin {
-          pname = finalAttrs.finalPackage.pname + "-symlinked";
-          inherit (finalAttrs.finalPackage) version;
-          paths = filter lib.isDerivation (attrValues finalAttrs.finalPackage.pkgs);
-        };
-
-        stdenv = overrideCC stdenv finalAttrs.finalPackage.cc;
-
-        cc = wrapIntel finalAttrs.finalPackage.pkgs.compiler;
-      };
-
-  })
-)

pkgs/intel-oneapi/process.jq

@@ -1,29 +0,0 @@
-#!/usr/bin/env -S jq -f
-
-def extract_fields: {
-        pname : .Package,
-        version : .Version,
-        provides : .Package | sub("[0-9.-]*$"; ""),
-        filename : .Filename,
-        size : ."Installed-Size" | tonumber,
-        sha256 : .SHA256,
-        dependencies : .Depends,
-    } ;
-
-# parses dependencies into a list of [{.pname, .kind, .version}]
-# some dependencies do not have a version specified, in which case, kind = version = null
-#
-# example dependencies:
-# intel-oneapi-common-vars (>= 2023.0.0-25325), intel-oneapi-common-licensing-2023.0.0
-
-def split_dependencies : map(try(.dependencies |= split(",\\s?"; "")) // .dependencies |= []) ;
-
-def match_version : capture("(?<pname>[a-zA-Z0-9_\\-.]*) *(\\((?<kind>[<>=]*) *(?<version>.*)\\))?"; "") ;
-
-def parse_dependencies : map_values(.dependencies.[] |= match_version) ;
-
-def sort_version_decreasing : sort_by(.version | split("[-.]"; "") | map(tonumber)) | reverse ;
-
-map(extract_fields) | split_dependencies | parse_dependencies | sort_version_decreasing
-
-# [.[] | select(.pname == "intel-hpckit") | .version]

pkgs/intel-oneapi/toJson.awk

@@ -1,29 +0,0 @@
-#!/usr/bin/env -S awk -f
-
-BEGIN   {
-    FS=": "
-
-    prev_empty=1
-    t="  "
-
-    print "[ {"
-}
-
-!NF { # empty line, update separator so next non empty line closes the dict
-    prev_empty=1
-    t="},\n{ "
-    next # skip line (we won't match anything else)
-}
-
-{
-    printf t "\"%s\" : \"%s\"\n", $1, $2
-
-    if (prev_empty) {
-        # we were the first after a group of empty lines, following ones have to
-        # have a comma
-        prev_empty=0
-        t=", "
-    }
-}
-
-END     { print "} ]" }

pkgs/intel-oneapi/update.sh

@@ -1,11 +1,4 @@
 #!/bin/sh
 
-out_64=$(mktemp intel-api.64.XXXXXX)
-out_all=$(mktemp intel-api.all.XXXXXX)
-trap 'rm -f "$out_64" "$out_all"' EXIT INT HUP
-
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o "$out_64"
-curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o "$out_all"
-
-# NOTE: we use `jq -r tostring` to minify the json (3.2Mb -> 2.3Mb)
-cat "$out_64" "$out_all" | ./toJson.awk | ./process.jq | jq -r tostring >packages.json
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-amd64/Packages -o amd64-packages
+curl https://apt.repos.intel.com/oneapi/dists/all/main/binary-all/Packages -o all-packages

pkgs/llvm-ompss2/default.nix

@@ -3,7 +3,6 @@
 , lib
 , gcc
 , clangOmpss2Unwrapped
-, writeShellScript
 , openmp ? null
 , wrapCCWith
 , llvmPackages_latest
@@ -38,7 +37,10 @@ let
   inherit gcc;
   cc = clangOmpss2Unwrapped;
   gccVersion = with versions; let v = gcc.version; in concatStringsSep "." [(major v) (minor v) (patch v)];
-
+in wrapCCWith {
+  inherit cc bintools;
+  # extraPackages adds packages to depsTargetTargetPropagated
+  extraPackages = optional (openmp != null) openmp;
   extraBuildCommands = ''
     echo "-target ${targetConfig}" >> $out/nix-support/cc-cflags
     echo "-B${gcc.cc}/lib/gcc/${targetConfig}/${gccVersion}" >> $out/nix-support/cc-cflags
@@ -55,50 +57,14 @@ let
     echo "--gcc-toolchain=${gcc}" >> $out/nix-support/cc-cflags
 
     wrap clang++  $wrapper $ccPath/clang++
+
+  '' + optionalString (openmp != null) ''
+    echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
+  '' + optionalString (ompss2rt != null) ''
+    echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
+    echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
+  '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
+    echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
   '';
+}
 
-  envExports = lib.optionalString (openmp != null) ''
-      echo "export OPENMP_RUNTIME=${ompname}" >> $out/nix-support/cc-wrapper-hook
-    '' + optionalString (ompss2rt != null) ''
-      echo "export OMPSS2_RUNTIME=${rtname}" >> $out/nix-support/cc-wrapper-hook
-      echo "export ${homevar}=${ompss2rt}"   >> $out/nix-support/cc-wrapper-hook
-    '' + optionalString (ompss2rt != null && ompss2rt.pname == "nodes") ''
-      echo "export NOSV_HOME=${ompss2rt.nosv}" >> $out/nix-support/cc-wrapper-hook
-    '';
-
-  extraPackages = optional (openmp != null) openmp;
-
-  wrappedCC = wrapCCWith {
-    # extraPackages adds packages to depsTargetTargetPropagated
-    inherit cc bintools extraPackages;
-    extraBuildCommands = extraBuildCommands + envExports;
-  };
-
-  resetIntelCCFlags = let tconf = builtins.replaceStrings ["-"] ["_"] targetConfig;
-  in writeShellScript "remove-intel.sh" ''
-    if [ "''${NIX_CC_WRAPPER_INTEL:-0}" = 1 ]; then
-      unset NIX_CFLAGS_COMPILE_${tconf}
-      unset NIX_CC_WRAPPER_FLAGS_SET_${tconf}
-
-      if (( "''${NIX_DEBUG:-0}" >= 1 )); then
-        echo "ompss2: cleaned NIX_CFLAGS_COMPILE_${tconf} (invokation from intel compiler detected)"
-      fi
-    fi
-  '';
-
-  intelExtraBuildCommands = ''
-    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang
-    sed -i 's|# Flirting.*|source ${resetIntelCCFlags}\n\n&|' $out/bin/clang++
-  '';
-
-  wrappedCCIntel = wrapCCWith {
-    inherit cc bintools extraPackages;
-    # extraPackages adds packages to depsTargetTargetPropagated
-    extraBuildCommands = intelExtraBuildCommands + envExports;
-  };
-
-in wrappedCC.overrideAttrs (oldAttrs: {
-    passthru = oldAttrs.passthru // {
-      forIcpx = wrappedCCIntel;
-    };
-  })

pkgs/onemath/default.nix

@@ -1,91 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  cmake,
-  withCFlags,
-  intelPackages,
-
-  mklSupport ? true,
-
-  config,
-
-  cudaSupport ? config.cudaSupport,
-  cudaPackages ? { },
-
-  rocmSupport ? config.rocmSupport,
-  hipTargets ? null, # only one target at a time supported
-  rocmPackages ? { },
-}:
-
-let
-  # rocmSupport is not enough, we need a specific target
-  enableHip = rocmSupport && hipTargets != null;
-
-  stdenv = withCFlags (lib.optionals cudaSupport [
-    "--cuda-path=${cudaPackages.cudatoolkit}"
-  ]) intelPackages.stdenv;
-in
-
-# at least one backend has to be enabled
-assert mklSupport || cudaSupport || enableHip;
-
-stdenv.mkDerivation rec {
-  pname = "oneMath";
-  version = "0.8";
-
-  src = fetchFromGitHub {
-    owner = "uxlfoundation";
-    repo = "oneMath";
-    rev = "v${version}";
-    sha256 = "sha256-xK8lKI3oqKlx3xtvdScpMq+HXAuoYCP0BZdkEqnJP5o=";
-  };
-
-  cmakeFlags = [
-    (lib.cmakeBool "ENABLE_MKLCPU_BACKEND" mklSupport)
-    (lib.cmakeBool "ENABLE_MKLGPU_BACKEND" mklSupport)
-
-    (lib.cmakeBool "ENABLE_CUBLAS_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CUFFT_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CURAND_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CUSOLVER_BACKEND" cudaSupport)
-    (lib.cmakeBool "ENABLE_CUSPARSE_BACKEND" cudaSupport)
-
-    (lib.cmakeBool "ENABLE_ROCBLAS_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCFFT_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCSOLVER_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCRAND_BACKEND" enableHip)
-    (lib.cmakeBool "ENABLE_ROCSPARSE_BACKEND" enableHip)
-
-    (lib.cmakeBool "BUILD_FUNCTIONAL_TESTS" false)
-    (lib.cmakeBool "BUILD_EXAMPLES" false)
-  ]
-  ++ lib.optionals enableHip [
-    (lib.cmakeFeature "HIP_TARGETS" hipTargets)
-  ];
-
-  nativeBuildInputs = [ cmake ];
-  buildInputs =
-    lib.optionals (mklSupport) [
-      intelPackages.mkl
-      intelPackages.tbb
-    ]
-    ++ lib.optionals (enableHip) [
-      rocmPackages.rocmPath
-      rocmPackages.rocblas
-      rocmPackages.rocfft
-      rocmPackages.rocsolver
-      rocmPackages.rocrand
-      rocmPackages.rocsparse
-    ]
-    ++ lib.optionals (cudaSupport) [
-      (lib.getDev cudaPackages.cuda_cudart)
-      cudaPackages.cudatoolkit
-
-      cudaPackages.libcublas
-      cudaPackages.libcurand
-      cudaPackages.libcufft
-      cudaPackages.libcusparse
-      cudaPackages.libcusolver
-    ];
-
-}

pkgs/tasycl/default.nix

@@ -1,87 +0,0 @@
-{
-  lib,
-  stdenv,
-  autoconf,
-  automake,
-  autoreconfHook,
-  boost,
-  fetchFromGitHub,
-  gnumake,
-  libtool,
-  withCFlags,
-
-  useIntel ? true,
-  adaptivecpp ? null,
-  intelPackages ? null,
-
-  useGit ? false,
-  gitUrl ? "git@gitlab-internal.bsc.es:task-awareness/tasycl/tasycl.git",
-  gitBranch ? "main",
-  gitCommit ? "78f98dcf60a66e0eaa3b4ebcf55be076bec64825",
-}:
-
-assert !useIntel -> adaptivecpp != null;
-assert useIntel -> intelPackages != null;
-
-let
-  variant = if useIntel then "intel" else "acpp";
-
-  syclStdenv = withCFlags [ "-O3" ] (if useIntel then intelPackages.stdenv else stdenv);
-
-  release = rec {
-    version = "2.1.0";
-    src = fetchFromGitHub {
-      owner = "bsc-pm";
-      repo = "tasycl";
-      rev = version;
-      hash = "sha256-0kXnb0lHeQNHR27GTLbJ8xbiICLU8k2+FqEnnFSrzzo=";
-    };
-  };
-
-  git = rec {
-    version = src.shortRev;
-    src = builtins.fetchGit {
-      url = gitUrl;
-      ref = gitBranch;
-      rev = gitCommit;
-    };
-  };
-
-  source = if (useGit) then git else release;
-
-in
-
-syclStdenv.mkDerivation {
-  pname = "tasycl-${variant}";
-  inherit (source) src version;
-
-  enableParallelBuilding = true;
-  separateDebugInfo = true;
-
-  nativeBuildInputs = [
-    autoreconfHook
-    automake
-    autoconf
-    libtool
-    gnumake
-  ];
-
-  buildInputs = [
-    boost
-  ];
-
-  configureFlags = lib.optionals (!useIntel) [
-    "CXX=${lib.getExe adaptivecpp}"
-  ];
-
-  # add symlinks so we can explicitly link with tasycl-intel / tasycl-acpp
-  postInstall = ''
-    pushd $out/lib
-    for i in libtasycl* ; do
-      ln -s "$i" "''\${i/tasycl/tasycl-${variant}}"
-    done
-    popd
-  '';
-
-  hardeningDisable = [ "all" ];
-}

secrets/ceph-user.age

@@ -1,29 +1,25 @@
 age-encryption.org/v1
--> ssh-ed25519 AY8zKw Crgof1PMHzv3jBw8VeJAst6FKSoyqPFdANFpf79CAgo
-7fagE5BmlWdTsdY/i3RbExu1KBcjW1LQXbYwu6chxlk
--> ssh-ed25519 sgAamA tGRCaK8mjvz65YziXjRcjMOHIRoyGNJFzBEEbivXPDo
-YLzE5a3J81r+gzkfZIeh9gS+mXzMooC82tBbZ+C3C8o
--> ssh-ed25519 HY2yRg +vhO1/vdGPM1JnZRsvVnViFWaFWUZ7MIqvWdePivkxA
-2K+JdN82DTeGh9QwZBTaghg8C5BCLoEsOgTCM64PU28
--> ssh-ed25519 fw2Xhg NHDn0dq32I/AVdUZlpzBX6retlEYEUipde7A9R90qW4
-SJO78ooqEwfHlBRW+YCzgSQJb1JHNo8jz37t3qvLClE
--> ssh-ed25519 G5LX5w d4HfLzI2623artkR2FIfRJgr5yb2BKZJUWqPnwOWDCk
-Kh50QESJZSjaJPyp3xroHGn0fD5pPNEYgKkDdqxGpjs
--> ssh-ed25519 tcumPQ wQyOKtT15Qezs3cyv5/xxIPVD7Jyk6N6ZLkfxxBHLTo
-rKlRBjJdfDVT6U8211+ssFF8yY9yRs1u3GhCSvsw2oE
--> ssh-ed25519 JJ1LWg 98tF1MdA244xNny4w3RnMFuubf4WcuQaZf2bN2Uq8Qc
-MA1Xh1H9vHisVYdqkxNeBkngtn8cYuT2eSimvooIXYo
--> ssh-ed25519 cDBabA imJ0rXLQETELP7yo3sArhqA9nJwY+S6gkC7tA7CJsQA
-pKMHW/KDAoEj5ZD64VKekg6et9hlS2PKSgDw3eB3eu8
--> ssh-ed25519 WY7yGw +2g5021/02HvLxLqq42ynr6qKgOKJ3J5GgB1a1bmFXg
-fYvj52R6bM6ngPOZ2lwVezTJnx+8LJBbdnaapKKbyd0
--> ssh-ed25519 cK5kHw fLZ6yF3NggJ724rjYqhs5ZZh1xUExuK+ITAyqONluzk
-NS9OMX70XEHrbPQnmC4KB/eoiHChIb8DwDLYJiwOLUU
--> ssh-ed25519 CAWG4Q tVduE/wMzdfS+DjNbU3Q4blNhL/A63IehNSZGJkJjD0
-jEBB5zG+gLA/88YF+KqWQsNH7lfCsWNvAkrgfbescFs
--> ssh-ed25519 xA739A ZhFvev77I+YOl1YSHKn2ZcEvGoLjWOILufjd4q/k8HM
-YXEtHHtjPQlgZW60zHgHm7CLI6vYiRo+AM8QERL9tCg
--> ssh-ed25519 MSF3dg 9DvLNheBU1vlfW2zNNxBrGnJ6k4P5ox7s+OGKlgRdyQ
-wseHfLGHz0huNi5sZsNOfeNkm6Kjjx0SZ8lK4/oXtUQ
---- bnJE+14onuSla0XmckD4z/wChWGZh6exbkcbyhcmNYU
-<EFBFBD><EFBFBD>t<>N猈<><10>U<EFBFBD>w▮i2<69><32>-<2D>iV'(<1E>IF<49><46>	S<><53>xs/s<><73>	<09><>NDm<44>Q<EFBFBD><51><EFBFBD>o<EFBFBD><6F><EFBFBD><EFBFBD>wZv<7F><76>.\
+-> ssh-ed25519 AY8zKw /gmhFOFqOs8IobAImvQVKeM5Y6k0FpuR61/Cu5drVVI
+g9FXJg2oIoien0zJ70FWHwSTM8SBwbpS188S3Swj7EM
+-> ssh-ed25519 sgAamA opPjlWPhSiI0Rd5l7kd204S5FXFLcQcQftyKb7MDmnU
+3XrRDVnglCP+vBwvfd1rP5gHttsGDHyXwbf10a8/kKY
+-> ssh-ed25519 HY2yRg QKZbubM76C3tobPoyCFDRclA9Pzb2fC7s4WOoIgdORc
+K5kckU0KhQFTE6SikJXFJgM41Tco5+VqOsaG0qLrY1Q
+-> ssh-ed25519 fw2Xhg +ohqts8dLFjvdHxrGHcOGxU0dm+V3N//giljHkobpDM
+jR/UzGrfS9lrJ/VeolKLxfzeJAf2fIB2pdIn/6ukqNk
+-> ssh-ed25519 tcumPQ 3DPkDPIQQSVtXSLzIRETsIyXQ0k1o18Evn6vf+l/6R8
+bLXF62OmJjnOT1vvgq3+AcOKKSG5NonrK5EqCVc0Mwo
+-> ssh-ed25519 JJ1LWg 2Wefc7eLolMU5InEmCNTq21Mf71mI0a2N1HgDrlHvy4
+qXFW9CQBnrzubZ0mzS0Io2WGRrwGBkmeYndBTcZn/fM
+-> ssh-ed25519 cDBabA oiH36AoIt/fFFYgnoxtH7OoetP+2/wjtn8qo3RJDSHc
+qKmkxy1aZGP4ZwC0iH7n7hiJ0+rFQYvjQb5O1a1Z0r4
+-> ssh-ed25519 cK5kHw bX3RtO5StMejUYWAaA37fjHA5nO7Xs1vWDQk3yOjs2o
+Egxmcf8FKAd+E5hMLmhV1yQsCo5rJyUazf1szOvpTAM
+-> ssh-ed25519 CAWG4Q oKqqRDJH0w8lsoQBQk0w8PO+z5gFNmSaGBUSumvDp1I
+m1zWp9MfViAmtpbJhqOHraIokDaPKb0DvvO4vAGCTWI
+-> ssh-ed25519 xA739A G26kPOz6sbFATs+KAr7gbDvji13eA1smFusQAOJXMwA
+Sppvz7A103kZoNxoGsd6eXeCvVh7mBE2MRwLFj9O1dY
+-> ssh-ed25519 MSF3dg 55ekNcp+inbUd+GQ/VZ7BoBASaJ8YDqF74CVXy1PUxQ
+aTHLLAbzQPWWld/OT3BKebc6FcmsqMTaWCPBGm1UHic
+--- mVkAMnI9XQhS3fMiFuuXP/yLR9wEG9+Rr8pA4Uc0avY
+<04>DU <20><>s<EFBFBD><73><EFBFBD><EFBFBD>j<EFBFBD><6A>M<EFBFBD><4D>$<24>[<5B>M<EFBFBD><4D><EFBFBD><03>[_<>K7s<37>ju<>v<EFBFBD>D<EFBFBD>4<EFBFBD>g<EFBFBD><67>܄3<>Gn<47><6E><EFBFBD> ɽ<>P<EFBFBD>7~rZs<><73>

secrets/gitlab-runner-docker-token.age

@@ -1,13 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 HY2yRg eHM55QsHK1ca9b5nP3EoVUZYu0w2d4B5tkilNK0j/lw
-6Na6lkMe0fOd7+vNP1fLIaVEQDUw5m65Wh8jUH1I6C0
--> ssh-ed25519 cK5kHw 0ekhoBYwF7OSWwn4P5f/J4gXb9UHJAWGKV0yI7HCzzE
-2Q+Tt5jXAB9ip9jf1z+jeM4FSiqd1w5DNtbqtacuOcM
--> ssh-ed25519 CAWG4Q Jmw4v9efOFXHjjNky96q/d6vGBP5dNM4wK9zoGrwOh8
-u5I17wcIq8/2ARWckDXsYckhfX0jWE4AEm5mip/KHws
--> ssh-ed25519 xA739A 10pPeC2YG9DJzaQlt7p+fGo27VDiL2dN6JmvY2npcUw
-4aRV8DekYeL9HagGWgOSjlYnPKmYdKZH8Aw4lRdm+r8
--> ssh-ed25519 MSF3dg hDwIE3Su6cN3sq2E5v/oy6vTNfxTT1ZPts85//gIhwY
-aoiaGjQYJB1ededhIuVBCKDRLIOVThWz1pSTvg65J3Y
---- OYPAGb5U/nwLOIV5VchSvxhChjNnwzbEgU9glSkWCl4
-<EFBFBD>=<EFBFBD><EFBFBD><EFBFBD>c<EFBFBD>WȟJSaІ&<26><1F>ቧ)E<><0B> C<><43>J~u<>c<63><7F>2<EFBFBD><32>v<EFBFBD><76><EFBFBD><03><>s<EFBFBD><73><EFBFBD>vf<76><10><>X7(<28>~<7E><1A>=XCi;<3B>״<EFBFBD>\ߢ<><DFA2><EFBFBD>ܣ<EFBFBD><10><><07>ɳCe<43>D;;X*<2A>3<EFBFBD>i<EFBFBD><69>r<EFBFBD>Em<45><6D><
+-> ssh-ed25519 HY2yRg U2KQWviZIVNemm9e8h7H+eOzoYNxXgLLS3hsZLMAuGk
+6n5dH1McNzk3rscP4v2pqZYDWtUFMd15rZsEd/mqIFM
+-> ssh-ed25519 cK5kHw Ebrj/cpz1cFWAYAV9OxgyyH85OEMUnfUIV66p7jaoFY
+6J7hWqODtS/fIF4BpxhxbrxZq5vbolvbLqRKqazT02M
+-> ssh-ed25519 CAWG4Q mXqoQH9ycHF7u0y8mazCgynHxNLxTnrmQHke+2a5QCc
+mq6PdSF+KOqthuXwzTCsOQsi5KG0z1wHUck+bSTyOBY
+-> ssh-ed25519 xA739A TADeswueqDEroZWLjMw3RDNwVQ2xRD+JUMVZENovn0M
+KFlnSjVFbjc+ZsbY8Ed7edC5B01TJGzd/dSryiLArPc
+-> ssh-ed25519 MSF3dg Pq+ZD8AqJGDHDbd4PO1ngNFST8+6C2ghZkO/knKzzEc
+wyiL/u38hdQMokmfTsBrY7CtYwc+31FG4EDaqVEn31U
+--- 1z4cOipayh0zYkvasEVEvGreajegE/dqBV7b6E7aFh0
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD>R<EFBFBD>@<40>/i<>I'<27><><EFBFBD>Nx<4E>r"<1D>`<1E>O<EFBFBD><4F><EFBFBD>y<><79>8<EFBFBD><38> \/<2F><>I<19><17>D<EFBFBD>`<60>ߓ<EFBFBD><DF93><EFBFBD><1E><04>uy<75><79><EFBFBD>:9Lt<4C><1D><><EFBFBD>؋<EFBFBD><D88B><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>AU<41><55><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>`<60>;<3B>q8<71>GLU#<23>i<EFBFBD>y<EFBFBD><79>i<03>ڜ

secrets/vpn-dac-login.age

@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 G5LX5w /9lcJOXC9CN02+XLswUaJ0H7jU6Xhjd8Xg4+KY0l1Vc
-fCLzsLc9zrocM8SHOKyZwt6eUEr8r1WLug9RLi63KU0
--> ssh-ed25519 cK5kHw 1qza6h2NRSs4g8LYdFU7E+Dn1CgdtCU7DPdYInP1GwM
-/6uk7pTFkNTRTI7nA+x4y4CyOBVQVXX2lnpOg3ktPe4
--> ssh-ed25519 CAWG4Q o+vyzcejSaNVYPSGzzOdzaqPByZ6zA1uaJf4KOg+wQA
-wfZmWrDSfRV8C+Hu+SeZDcomf/qigBqxuQK77SfnuEo
--> ssh-ed25519 xA739A +rBsOC+IBE3lmc/pfrziftLIqMSyaGMsggRjC5Pqwl0
-xa7ulLz2+YC3g2hu7e9XhRYDIUb2sriaaigJRYF2oB8
--> ssh-ed25519 MSF3dg TK6PmKjjQt8ni0mJLCt7P41lUsgimlj3o5Q6n3N+DE4
-ne+s3ctcg8cBjY06LY2lrW7wcxomvKHxu6MlirEA8Kg
---- eorg2ckkUZ1Ogi4iTTg2MoiVBwl1F0RCmH2D8N1d1So
-<EFBFBD><EFBFBD><EFBFBD>8<1C><><EFBFBD><EFBFBD><EFBFBD><12>i<17>$]K<>J=2Z<1D><>ӼF<D3BC>][<14><><EFBFBD>8<EFBFBD><38>ޤ<12>	<09>=<3D><>
LD/<2F>gz
+-> ssh-ed25519 G5LX5w SRJhNenoQXbT1FgX3TMPnVH5P6oe2eHot+M1YsEjsEk
+hfTSLgKi98Eh7JK5o7x2POpTEtQlQCpEa3keUFYCuME
+-> ssh-ed25519 cK5kHw z5TwWJTkvx7HztjXHJW/aCOtOfPrQaLP0gyIT7rXcyU
+b4NCpHfasgvkLLr+6LcWUl60p59aSNnfp3bl2OFYXo0
+-> ssh-ed25519 CAWG4Q 4VpS1/OnFe8nxcQbRTKNhjsh/ZQ5cbhSMXwK/jjQ+3o
+WF9wvOkqVml4UcEzyzeumKuUwCwwr2zvKLMg+PCB8nk
+-> ssh-ed25519 xA739A 67FhuJ070jBVMt/xbKHWhfri6iIm0FyaFvzQabsvFBM
+1G5/913dDv/r/6p1x/c5YiUnZzrX/LvIj33KW+PN0KU
+-> ssh-ed25519 MSF3dg Bj/yB4N2wkyHCHC22tcjjJAA4ebSamN0Z4UVX3ZnryI
+6D/ZgTs+j+MGDAbPU5zyK0i9zN6tQy68IcOnQZ27mYg
+--- 169erk3ICSYLs4FPEuXCn7QlekWhsmSn0Lr+/R14I5Q
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD><05>ҽ3<D2BD>s<EFBFBD>
+w<EFBFBD><EFBFBD>4D<EFBFBD><EFBFBD>b.<2E><><EFBFBD>"|<7C><><EFBFBD>)"<22><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>;<3B>.<2E>ɫ7)<29>LeC<05>=S؟

secrets/wg-fox.age

@@ -1,13 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 cDBabA So/Tqwdwd7G0PbE4RwH2qDrNcdqTkhFjF4IJrLKKpkM
-MEA5dzlUeFXm3pa+ndxrcE0ZWdO00Xf98+Q8U9LZ+cQ
--> ssh-ed25519 cK5kHw sCHD/hHBOfMBUQXkLG3MBPNC4ebLOXW37OlF/C8FEjU
-4TFbKoy23Ic2vteXZ02fMrFxyb4NxyWaSo5I8dn48mI
--> ssh-ed25519 CAWG4Q KYGPAXTx8H5cBC3YIBxi5B7OeF15C9rEIPFCcG0vEDw
-9LC2Zvp1Oiau1/hfPf+nJknl6BUSr+lzTn6TozZNxJg
--> ssh-ed25519 xA739A hpvNBHPgYRtUx0HyUAdCW8s7QTmGyPXwzRHb8qYoeG0
-QkUZINY7Fr7HpyY6lbIMcP+hGO3oCmLL6N+yDN4weyk
--> ssh-ed25519 MSF3dg P9TmEfXS+hyxsbVKja58UWAFpad0ZS3LhwrMkLnSNAY
-hiHuh7HhoYwHi2KFbCczXJoF3On9eqjD1Wsp9Q1NW/w
---- SN3peoDvjXuD/Q4DdebQFam1CE22NyGZlMmnKyCTuX8
-s<0F><><14><>&׳֦<D7B3><D6A6><EFBFBD><EFBFBD>
}<7D>#In0&<26><1F>{<7B>1<EFBFBD><31>.
+-> ssh-ed25519 cDBabA heyW9/cxgwFX9IexQIXjAQDWGQPNcMXcArQp2Rxsqx4
+o9MQ7EH8PDDjsJdpH9F3Xq2zUoaDAJQlfFmYucSFs6Y
+-> ssh-ed25519 cK5kHw Sza4pos7K3qW3omEeyidI/jszJNf9smemSZnUJfCIww
+D6vazXki7hIYraIuSiGPS+FPbkFUwHhHWDf52OhEIMg
+-> ssh-ed25519 CAWG4Q YexIHueOIMmIN8JIDyNUOKBkyz/k18HqV3hTXh48KlM
+xh8UJzzWT6ByN+Dpn4JrMNsjGC/uc/v6LynwjBDz9NQ
+-> ssh-ed25519 xA739A KySG3TXdqfCMUkVEDGa74B0op745s3XGYxFLyAXSQAc
+5EI/yb5ctW9Qu18bHm3/sK97kwGcKzzmWvPSCWm89XA
+-> ssh-ed25519 MSF3dg MNxnNj0fHmri8ophexXPNjRUBUWrzcuk5S1mucxUMTE
+GVFWXtISEU8ZmlwL4nh4weAgfGrt2GHX0DTzbpS6zg8
+--- UdrqkYG2ZApAuwdZeNhC50NP2rkD/Ol6y8nJa4RHx7Y
+<EFBFBD>ܻ<EFBFBD>m(<28><><EFBFBD>><3E>H<48>Y87<><37>G<0F>+*<12><><EFBFBD><EFBFBD>9V<>.<2E><><EFBFBD><EFBFBD><03><><EFBFBD>p<EFBFBD>Oo<4F>=+哇<>P0<50><30>{<7B>)<29><17><><EFBFBD><EFBFBD>><3E>z3P^
+u

test/compilers/hello-sycl.nix

@@ -1,62 +0,0 @@
-{
-  intelPackages,
-  writeText,
-  strace,
-}:
-
-let
-  stdenv = intelPackages.stdenv;
-  hello_sycl = writeText "hello.cpp" ''
-    #include <sycl/sycl.hpp>
-
-    class hello_world;
-
-    int main(int argc, char** argv) try {
-        auto device_selector = sycl::default_selector_v;
-
-        sycl::queue queue(device_selector);
-
-        std::cout << "Running on: "
-                  << queue.get_device().get_info<sycl::info::device::name>()
-                  << std::endl;
-
-        queue.submit([&] (sycl::handler& cgh) {
-            auto os = sycl::stream{128, 128, cgh};
-            cgh.single_task<hello_world>([=]() {
-                os << "Hello World! (on device)\n";
-            });
-        });
-
-        return 0;
-    } catch (sycl::exception &e) {
-        std::cout << "SYCL exception: " << e.what() << std::endl;
-        return 0; // we expect to fail since no devices should be available;
-    }
-  '';
-in
-
-stdenv.mkDerivation {
-  version = "0.0.1";
-  name = "hello-sycl";
-  buildInputs = [
-    stdenv
-    strace
-  ];
-  src = hello_sycl;
-  dontUnpack = true;
-  dontConfigure = true;
-  NIX_DEBUG = 0;
-  buildPhase = ''
-    cp $src hello.cpp
-    set -x
-    echo CXX=$CXX
-    command -v $CXX
-    $CXX -fsycl hello.cpp -o hello
-    ./hello
-    set +x
-  '';
-
-  installPhase = ''
-    touch $out
-  '';
-}

test/compilers/icpx-ompss2.nix

@@ -1,81 +0,0 @@
-{
-  writeText,
-  intelPackages,
-  nodes,
-  nosv,
-  clangOmpss2Nodes,
-  strace,
-}:
-
-let
-  hello_cpp = writeText "hello.cpp" ''
-    #include <cstdio>
-    #include <sycl/sycl.hpp>
-
-    int main(int argc, char** argv) try {
-        sycl::queue queue;
-
-        std::cout << "Running on: "
-                  << queue.get_device().get_info<sycl::info::device::name>()
-                  << std::endl;
-
-        #pragma oss task
-        queue.submit([&] (sycl::handler& cgh) {
-            auto os = sycl::stream{128, 128, cgh};
-            cgh.single_task<class hello_world>([=]() {
-                os << "Hello World! (on device)\n";
-            });
-        }).wait();
-
-        return 0;
-    } catch (sycl::exception &e) {
-        std::cout << "SYCL exception: " << e.what() << std::endl;
-        return 0; // we expect to fail since no devices should be available;
-    }
-
-  '';
-in
-
-intelPackages.stdenv.mkDerivation {
-  version = "0.0.1";
-  name = "hello-syclompss";
-
-  src = hello_cpp;
-
-  nativeBuildInputs = [
-    strace
-    nodes
-    nosv
-  ];
-
-  dontUnpack = true;
-  dontConfigure = true;
-
-  # NODES requires access to /sys/devices to request NUMA information
-  requiredSystemFeatures = [ "sys-devices" ];
-
-  env.NODES_HOME = nodes;
-
-  NIX_DEBUG = 1;
-  buildPhase = ''
-    cp $src hello.cpp
-    set -x
-    echo CXX=$CXX
-    echo NODES_HOME=$NODES_HOME
-    command -v $CXX
-
-    icpx -Wno-deprecated-declarations -fsycl \
-        -fsycl-host-compiler=${clangOmpss2Nodes.forIcpx}/bin/clang++ \
-        -fsycl-host-compiler-options='-Wno-deprecated-declarations -fompss-2=libnodes' \
-        -lnodes -lnosv \
-        $NODES_HOME/lib/nodes-main-wrapper.o \
-        hello.cpp -o hello
-
-    ./hello
-    set +x
-  '';
-
-  installPhase = ''
-    touch $out
-  '';
-}