Setup remote encoder

flake.nix

@@ -13,16 +13,13 @@
       url = "github:ryantm/agenix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-
-    minegrub-theme.url = "github:Lxtharia/minegrub-theme";
   };
 
   outputs =
     inputs@{
       nixpkgs,
       home-manager,
       agenix,
-      minegrub-theme,
       ...
     }:
     let
@@ -34,6 +31,9 @@
         inherit system;
         config = {
           allowUnfree = true;
+          permittedInsecurePackages = [
+            "broadcom-sta-6.30.223.271-57-6.12.43"
+          ];
         };
       };
 
@@ -46,7 +46,6 @@
 
       commonModules = [
         # home-manager.nixosModules.home-manager
-        inputs.minegrub-theme.nixosModules.default
         agenix.nixosModules.default
       ];
     in
@@ -66,8 +65,11 @@
         remote-encoder = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           specialArgs = sharedArgs;
-          modules = commonModules ++ [
+          modules = [
+            "${nixpkgs}/nixos/modules/installer/cd-dvd/iso-image.nix"
             {
+              image.fileName = "nixos-remote-encoder.iso";
+
               nixpkgs.pkgs = stable-pkgs;
             }
             ./remote-encoder

remote-encoder/default.nix

@@ -2,6 +2,7 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running ‘nixos-help’).
 # Just testing something
+# ffmpeg -f decklink -i 'DeckLink Mini Recorder 4K'     -c:v libx264 -preset ultrafast -tune zerolatency     -pix_fmt yuv420p -profile:v high -level 4.2     -b:v 25M -maxrate 25M -bufsize 25M     -g 50 -keyint_min 50 -sc_threshold 0     -c:a aac -ar 48000 -b:a 128k     -muxdelay 0 -muxpreload 0     -f mpegts "srt://host.moir.xyz:6969?streamid=publish:zenith&latency=125&pkt_size=1316"
 
 {
   inputs,
@@ -14,6 +15,31 @@
 let
   locale = "en_GB.UTF-8";
   timezone = "Europe/London";
+
+  decklink-sdk = pkgs.callPackage ../blackmagic/decklink-sdk.nix { };
+
+  ffmpeg-decklink = pkgs.ffmpeg.overrideAttrs (oldAttrs: {
+    configureFlags = oldAttrs.configureFlags ++ [
+      "--enable-nonfree"
+      "--enable-decklink"
+    ];
+    nativeBuildInputs = oldAttrs.nativeBuildInputs or [ ] ++ [
+      pkgs.makeWrapper
+    ];
+    buildInputs = oldAttrs.buildInputs ++ [
+      pkgs.blackmagic-desktop-video
+      decklink-sdk
+    ];
+
+    postFixup = ''
+      patchelf --add-rpath ${pkgs.libGL}/lib $lib/lib/libavcodec.so
+      patchelf --add-rpath ${pkgs.libGL}/lib $lib/lib/libavutil.so
+
+      wrapProgram $bin/bin/ffmpeg \
+        --prefix LD_LIBRARY_PATH : ${pkgs.blackmagic-desktop-video}/lib
+    '';
+
+  });
 in
 {
   nix.settings.experimental-features = [
@@ -22,22 +48,12 @@ in
   ];
   nix.settings.trusted-users = [ "broadcast" ];
 
-  # Bootloader.
-  boot.loader = {
-    efi = {
-      canTouchEfiVariables = true;
-    };
-    grub = {
-      efiSupport = true;
-      device = lib.mkDefault "nodev";
-      minegrub-theme = {
-        enable = true;
-        splash = "100% flakes!";
-        background = "background_options/1.8  - [Classic Minecraft].png";
-        boot-options-count = 4;
-      };
-    };
-  };
+  boot.kernelModules = [ "wl" ];
+  hardware.enableRedistributableFirmware = true;
+  boot.extraModulePackages = with pkgs.linuxPackages; [ broadcom_sta ];
+
+  isoImage.makeEfiBootable = true;
+  isoImage.makeUsbBootable = true;
 
   environment.enableAllTerminfo = true;
 
@@ -55,10 +71,31 @@ in
   ];
 
   networking.hostName = "ystv-remote-encoder"; # Define your hostname.
-  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
 
   networking.networkmanager.enable = true;
 
+  networking.networkmanager.ensureProfiles = {
+    profiles = {
+      "mydevices-wifi" = {
+        connection = {
+          id = "mydevices-wifi";
+          type = "wifi";
+          autoconnect = true;
+        };
+        wifi = {
+          ssid = "mydevices";
+          mode = "infrastructure";
+        };
+        wifi-security = {
+          key-mgmt = "wpa-psk";
+          # This is not really a secret as just knowing this provides no access to the network
+          # Any devices using this must be registered on mydevices
+          psk = "connectme";
+        };
+      };
+    };
+  };
+
   time.timeZone = "${timezone}";
 
   # Select internationalisation properties
@@ -87,7 +124,15 @@ in
       "docker"
     ];
     ignoreShellProgramCheck = true;
-    shell = pkgs.zsh;
+    hashedPassword = "$y$j9T$Z6/JnpXpDqRCvgFs6O/Fq0$aVgg./1VNie8Gy7EKh0auuNp3e/NwEqjdJSmDuLLrJ/";
+    shell = pkgs.bashInteractive;
+  };
+
+  users.users.root.hashedPassword = "$y$j9T$uphD.j1c70afhycuLzw0B1$4xwBe7QHAgEfJHtXQIXtFiQTVuMSDPnwvHsQKFmtai8";
+
+  services.getty = {
+    autologinOnce = true;
+    autologinUser = "broadcast";
   };
 
   environment.systemPackages = with pkgs; [
@@ -96,8 +141,37 @@ in
     curl
     dig
     speedtest-cli
+    ffmpeg-decklink
+    bashInteractive
+
+    cacert
+
+    blackmagic-desktop-video
   ];
 
+  systemd.services.decklink-srt-stream = {
+    enable = true;
+    description = "Stream DeckLink input to MediaMTX over SRT";
+    after = [ "network-online.target" ];
+    wants = [ "network-online.target" ];
+    wantedBy = [ "multi-user.target" ];
+
+    serviceConfig = {
+      ExecStart = ''
+        ${ffmpeg-decklink}/bin/ffmpeg -f decklink -i 'DeckLink Mini Recorder 4K'
+          -c:v libx264 -preset ultrafast -tune zerolatency
+          -pix_fmt yuv420p -profile:v high -level 4.2
+          -b:v 25M -maxrate 25M -bufsize 25M
+          -g 50 -keyint_min 50 -sc_threshold 0
+          -c:a aac -ar 48000 -b:a 128k
+          -muxdelay 0 -muxpreload 0
+          -f mpegts "srt://host.moir.xyz:6969?streamid=publish:zenith&latency=125&pkt_size=1316"
+      '';
+      Restart = "always";
+      RestartSec = "5s";
+    };
+  };
+
   services.openssh = {
     enable = true;
     settings.PasswordAuthentication = false;
@@ -106,6 +180,8 @@ in
 
   system.stateVersion = "25.05";
 
+  hardware.decklink.enable = true;
+
   services.pulseaudio.enable = false;
   security.rtkit.enable = true;
   services.pipewire = {

secrets/secrets.nix

@@ -0,0 +1,14 @@
+let
+  ops = {
+    nix-builder = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM32qDHEY8Aswp8/mbs7JPgtduHNcTdR7zRR7c9vbjpZ ops@nix-builder";
+  };
+  archessmn = {
+    helios = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKbv0CfhD/1mE+OORtFtHcj9PA3Gal6S/+czXp82B0t archessmn@helios";
+  };
+in
+{
+  "wifi-mydevices-password.age".publicKeys = [
+    ops.nix-builder
+    archessmn.helios
+  ];
+}

secrets/wifi-mydevices-password.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 nJW4zQ h5OA3v6/1ffSr5F4YQVEOtk2BmOqTag3IaXX+2W3Skg
+1/jlCSo3v5IpAl2Ey/hWCd/aRYH3uzFoIgbqxi8LaaA
+-> ssh-ed25519 Kn/Vww yB9VeYhw0xNm78QyCCHiHMdZnesM25hA+bnv6uuMfRk
+0lavCUlqDnoWqbCnncS4s8KTqn/v3Q7r5l3w5fQaXO0
+--- aswuBu8o8zY0aG8KVGHZ1fRnmPJknkn5usI7rTqdg6s
+cq��܃Kbџ�%_J�|���3�Bh~�����2��JZ�|#-	O&�2@�Gs�]