update

This reverts commit 41ec08a030.

.envrc

@@ -0,0 +1,8 @@
+if ! has nix_direnv_version || ! nix_direnv_version 2.2.0; then
+  source_url "https://raw.githubusercontent.com/nix-community/nix-direnv/2.2.0/direnvrc" "sha256-5EwyKnkJNQeXrRkYbwwRBcXbibosCJqyIUuz9Xq+LRc="
+fi
+
+nix_direnv_watch_file devenv.nix
+nix_direnv_watch_file devenv.lock
+nix_direnv_watch_file devenv.yaml
+use flake . --impure

.gitignore

@@ -0,0 +1,2 @@
+.direnv
+.devenv

flake.lock

@@ -3,16 +3,18 @@
     "agenix": {
       "inputs": {
         "darwin": "darwin",
+        "home-manager": "home-manager",
         "nixpkgs": [
           "nixpkgs"
-        ]
+        ],
+        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1677969766,
+        "lastModified": 1762618334,
-        "narHash": "sha256-AIp/ZYZMNLDZR/H7iiAlaGpu4lcXsVt9JQpBlf43HRY=",
+        "narHash": "sha256-wyT7Pl6tMFbFrs8Lk/TlEs81N6L+VSybPfiIgzU8lbQ=",
         "owner": "ryantm",
         "repo": "agenix",
-        "rev": "03b51fe8e459a946c4b88dcfb6446e45efb2c24e",
+        "rev": "fcdea223397448d35d9b31f798479227e80183f6",
         "type": "github"
       },
       "original": {
@@ -21,6 +23,60 @@
         "type": "github"
       }
     },
+    "cachix": {
+      "inputs": {
+        "devenv": [
+          "devenv"
+        ],
+        "flake-compat": [
+          "devenv",
+          "flake-compat"
+        ],
+        "git-hooks": [
+          "devenv",
+          "git-hooks"
+        ],
+        "nixpkgs": [
+          "devenv",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1760971495,
+        "narHash": "sha256-IwnNtbNVrlZIHh7h4Wz6VP0Furxg9Hh0ycighvL5cZc=",
+        "owner": "cachix",
+        "repo": "cachix",
+        "rev": "c5bfd933d1033672f51a863c47303fc0e093c2d2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "ref": "latest",
+        "repo": "cachix",
+        "type": "github"
+      }
+    },
+    "copyparty": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765930735,
+        "narHash": "sha256-D+b77dVSjCqTfvZsOw3tXAYo5E+I3T9FeahyfqYKWoI=",
+        "owner": "9001",
+        "repo": "copyparty",
+        "rev": "519bfe1f0b66bf3131105941d0dc704de7c2ec23",
+        "type": "github"
+      },
+      "original": {
+        "owner": "9001",
+        "repo": "copyparty",
+        "type": "github"
+      }
+    },
     "darwin": {
       "inputs": {
         "nixpkgs": [
@@ -29,11 +85,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1673295039,
+        "lastModified": 1744478979,
-        "narHash": "sha256-AsdYgE8/GPwcelGgrntlijMg4t3hLFJFCRF3tL5WVjA=",
+        "narHash": "sha256-dyN+teG9G82G+m+PX/aSAagkC+vUv0SgUw3XkPhQodQ=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "87b9d090ad39b25b2400029c64825fc2a8868943",
+        "rev": "43975d782b418ebf4969e9ccba82466728c2851b",
         "type": "github"
       },
       "original": {
@@ -43,13 +99,91 @@
         "type": "github"
       }
     },
+    "devenv": {
+      "inputs": {
+        "cachix": "cachix",
+        "flake-compat": "flake-compat",
+        "flake-parts": "flake-parts",
+        "git-hooks": "git-hooks",
+        "nix": "nix",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765985825,
+        "narHash": "sha256-Ph+dULhPcnefCb+XyTt1a5Vh3A9DFuEHMIlUXSh3KcQ=",
+        "owner": "cachix",
+        "repo": "devenv",
+        "rev": "51b8b1fc0659b0817dba0f5e40272f86809665ce",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "devenv",
+        "type": "github"
+      }
+    },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1761588595,
+        "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1696426674,
+        "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "devenv",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1760948891,
+        "narHash": "sha256-TmWcdiUUaWk8J4lpjzu4gCGxWY6/Ok7mOK4fIFfBuU4=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "864599284fc7c0ba6357ed89ed5e2cd5040f0c04",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "locked": {
-        "lastModified": 1676283394,
+        "lastModified": 1678901627,
-        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "narHash": "sha256-U02riOqrKKzwjsxc/400XnElV+UtPUQWpANPlyazjH0=",
         "owner": "numtide",
         "repo": "flake-utils",
-        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "rev": "93a2b84fc4b70d9e089d029deacc3583435c2ed6",
         "type": "github"
       },
       "original": {
@@ -73,19 +207,103 @@
         "type": "github"
       }
     },
-    "golink": {
+    "flake-utils_3": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "systems": "systems_3"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "flake-utils_4": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1705309234,
+        "narHash": "sha256-uNRRNRKmJyCRC/8y1RqBkqWBLM034y4qN7EprSdmgyA=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ef2e671c3b0c19053962c07dbda38332dcebf26",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "git-hooks": {
+      "inputs": {
+        "flake-compat": [
+          "devenv",
+          "flake-compat"
+        ],
+        "gitignore": "gitignore",
         "nixpkgs": [
+          "devenv",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1677628298,
+        "lastModified": 1760663237,
-        "narHash": "sha256-1R/bnkbApMANd5m8bY0zUUsXB8vS8X/c+D/rl/jJ0To=",
+        "narHash": "sha256-BflA6U4AM1bzuRMR8QqzPXqh8sWVCNDzOdsxXEguJIc=",
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "rev": "ca5b894d3e3e151ffc1db040b6ce4dcc75d31c37",
+        "type": "github"
+      },
+      "original": {
+        "owner": "cachix",
+        "repo": "git-hooks.nix",
+        "type": "github"
+      }
+    },
+    "gitignore": {
+      "inputs": {
+        "nixpkgs": [
+          "devenv",
+          "git-hooks",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1709087332,
+        "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "gitignore.nix",
+        "type": "github"
+      }
+    },
+    "golink": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "systems": "systems_2"
+      },
+      "locked": {
+        "lastModified": 1765218350,
+        "narHash": "sha256-RPW2sQFaoQdSNPVg6cq94YVbf6SeBCuGnpjMIxtvpbM=",
         "owner": "tailscale",
         "repo": "golink",
-        "rev": "7fa6e009f6b1a0079fd7407b15326ee57161a33d",
+        "rev": "491554abd506a48221631bea0e014ca5c8f53fcd",
         "type": "github"
       },
       "original": {
@@ -97,16 +315,36 @@
     "home-manager": {
       "inputs": {
         "nixpkgs": [
+          "agenix",
           "nixpkgs"
-        ],
+        ]
-        "utils": "utils"
       },
       "locked": {
-        "lastModified": 1679067095,
+        "lastModified": 1745494811,
-        "narHash": "sha256-G2dJQURL/CCi+8RP6jNJG8VqgtzEMCA+6mNodd3VR6E=",
+        "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3239e0b40f242f47bf6c0c37b2fd35ab3e76e370",
+        "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "type": "github"
+      }
+    },
+    "home-manager_2": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1765980955,
+        "narHash": "sha256-rB45jv4uwC90vM9UZ70plfvY/2Kdygs+zlQ07dGQFk4=",
+        "owner": "nix-community",
+        "repo": "home-manager",
+        "rev": "89c9508bbe9b40d36b3dc206c2483ef176f15173",
         "type": "github"
       },
       "original": {
@@ -116,45 +354,24 @@
         "type": "github"
       }
     },
-    "hyprland": {
+    "home-manager_3": {
-      "inputs": {
-        "hyprland-protocols": "hyprland-protocols",
-        "nixpkgs": "nixpkgs",
-        "wlroots": "wlroots",
-        "xdph": "xdph"
-      },
-      "locked": {
-        "lastModified": 1679166084,
-        "narHash": "sha256-yr+alTr1eGjEKpMiD06FTTMP6vaoNwYEZT6mW6dQ5rM=",
-        "owner": "hyprwm",
-        "repo": "Hyprland",
-        "rev": "06244555915339967864292dd0b83cd9732516d8",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "Hyprland",
-        "type": "github"
-      }
-    },
-    "hyprland-protocols": {
       "inputs": {
         "nixpkgs": [
-          "hyprland",
+          "zen-browser",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1671839510,
+        "lastModified": 1765682243,
-        "narHash": "sha256-+PY1qqJfmZzzROgcIY4I7AkCwpnC+qBIYk2eFoA9RWc=",
+        "narHash": "sha256-yeCxFV/905Wr91yKt5zrVvK6O2CVXWRMSrxqlAZnLp0=",
-        "owner": "hyprwm",
+        "owner": "nix-community",
-        "repo": "hyprland-protocols",
+        "repo": "home-manager",
-        "rev": "b8f55e02a328c47ed373133c52483bbfa20a1b75",
+        "rev": "58bf3ecb2d0bba7bdf363fc8a6c4d49b4d509d03",
         "type": "github"
       },
       "original": {
-        "owner": "hyprwm",
+        "owner": "nix-community",
-        "repo": "hyprland-protocols",
+        "repo": "home-manager",
         "type": "github"
       }
     },
@@ -180,29 +397,74 @@
         "url": "https://git.sr.ht/~dpatterbee/i3utils"
       }
     },
-    "nixpkgs": {
+    "nix": {
+      "inputs": {
+        "flake-compat": [
+          "devenv",
+          "flake-compat"
+        ],
+        "flake-parts": [
+          "devenv",
+          "flake-parts"
+        ],
+        "git-hooks-nix": [
+          "devenv",
+          "git-hooks"
+        ],
+        "nixpkgs": [
+          "devenv",
+          "nixpkgs"
+        ],
+        "nixpkgs-23-11": [
+          "devenv"
+        ],
+        "nixpkgs-regression": [
+          "devenv"
+        ]
+      },
       "locked": {
-        "lastModified": 1677676435,
+        "lastModified": 1761648602,
-        "narHash": "sha256-6FxdcmQr5JeZqsQvfinIMr0XcTyTuR7EXX0H3ANShpQ=",
+        "narHash": "sha256-H97KSB/luq/aGobKRuHahOvT1r7C03BgB6D5HBZsbN8=",
-        "owner": "NixOS",
+        "owner": "cachix",
-        "repo": "nixpkgs",
+        "repo": "nix",
-        "rev": "a08d6979dd7c82c4cef0dcc6ac45ab16051c1169",
+        "rev": "3e5644da6830ef65f0a2f7ec22830c46285bfff6",
         "type": "github"
       },
       "original": {
-        "owner": "NixOS",
+        "owner": "cachix",
-        "ref": "nixos-unstable",
+        "ref": "devenv-2.30.6",
-        "repo": "nixpkgs",
+        "repo": "nix",
         "type": "github"
       }
     },
-    "nixpkgs_2": {
+    "nixgl": {
+      "inputs": {
+        "flake-utils": "flake-utils_3",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1678898370,
+        "lastModified": 1762090880,
-        "narHash": "sha256-xTICr1j+uat5hk9FyuPOFGxpWHdJRibwZC+ATi0RbtE=",
+        "narHash": "sha256-fbRQzIGPkjZa83MowjbD2ALaJf9y6KMDdJBQMKFeY/8=",
+        "owner": "guibou",
+        "repo": "nixGL",
+        "rev": "b6105297e6f0cd041670c3e8628394d4ee247ed5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "guibou",
+        "repo": "nixGL",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1765779637,
+        "narHash": "sha256-KJ2wa/BLSrTqDjbfyNx70ov/HdgNBCBBSQP3BIzKnv4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "ac718d02867a84b42522a0ece52d841188208f2c",
+        "rev": "1306659b587dc277866c7b69eb97e5f07864d8c4",
         "type": "github"
       },
       "original": {
@@ -211,71 +473,151 @@
         "type": "indirect"
       }
     },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1751274312,
+        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-24.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1708161998,
+        "narHash": "sha256-6KnemmUorCvlcAvGziFosAVkrlWZGIc6UNT9GUYr0jQ=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "84d981bae8b5e783b3b548de505b22880559515f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-23.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "root": {
       "inputs": {
         "agenix": "agenix",
+        "copyparty": "copyparty",
+        "devenv": "devenv",
         "golink": "golink",
-        "home-manager": "home-manager",
+        "home-manager": "home-manager_2",
-        "hyprland": "hyprland",
         "i3utils": "i3utils",
-        "nixpkgs": "nixpkgs_2"
+        "nixgl": "nixgl",
+        "nixpkgs": "nixpkgs",
+        "nixpkgs-stable": "nixpkgs-stable",
+        "zen-browser": "zen-browser",
+        "zig": "zig"
       }
     },
-    "utils": {
+    "systems": {
       "locked": {
-        "lastModified": 1676283394,
+        "lastModified": 1681028828,
-        "narHash": "sha256-XX2f9c3iySLCw54rJ/CZs+ZK6IQy7GXNY4nSOyu2QG4=",
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "numtide",
+        "owner": "nix-systems",
-        "repo": "flake-utils",
+        "repo": "default",
-        "rev": "3db36a8b464d0c4532ba1c7dda728f4576d6d073",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
         "type": "github"
       },
       "original": {
-        "owner": "numtide",
+        "owner": "nix-systems",
-        "repo": "flake-utils",
+        "repo": "default",
         "type": "github"
       }
     },
-    "wlroots": {
+    "systems_2": {
-      "flake": false,
       "locked": {
-        "host": "gitlab.freedesktop.org",
+        "lastModified": 1681028828,
-        "lastModified": 1677789111,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "narHash": "sha256-dWrk+Q3bLdtFe5rkyaAKWCQJCeE/KFNllcu1DvBC38c=",
+        "owner": "nix-systems",
-        "owner": "wlroots",
+        "repo": "default",
-        "repo": "wlroots",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "rev": "5ae17de23f5fd9bb252a698f3771c840280e2c05",
+        "type": "github"
-        "type": "gitlab"
       },
       "original": {
-        "host": "gitlab.freedesktop.org",
+        "owner": "nix-systems",
-        "owner": "wlroots",
+        "repo": "default",
-        "repo": "wlroots",
+        "type": "github"
-        "type": "gitlab"
       }
     },
-    "xdph": {
+    "systems_3": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_4": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "zen-browser": {
       "inputs": {
-        "hyprland-protocols": [
+        "home-manager": "home-manager_3",
-          "hyprland",
-          "hyprland-protocols"
-        ],
         "nixpkgs": [
-          "hyprland",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1673116118,
+        "lastModified": 1765946036,
-        "narHash": "sha256-eR0yDSkR2XYMesfdRWJs25kAdXET2mbNNHu5t+KUcKA=",
+        "narHash": "sha256-R/qaIkzqm00qBMr8onM6ZZFX49lvsQLZ79adVubqjts=",
-        "owner": "hyprwm",
+        "owner": "0xc000022070",
-        "repo": "xdg-desktop-portal-hyprland",
+        "repo": "zen-browser-flake",
-        "rev": "d479c846531fd0e1d2357c9588b8310a2b859ef2",
+        "rev": "7db019a64483743a8d92319baafbbe71b687d0a1",
         "type": "github"
       },
       "original": {
-        "owner": "hyprwm",
+        "owner": "0xc000022070",
-        "repo": "xdg-desktop-portal-hyprland",
+        "repo": "zen-browser-flake",
+        "type": "github"
+      }
+    },
+    "zig": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "flake-utils": "flake-utils_4",
+        "nixpkgs": "nixpkgs_2"
+      },
+      "locked": {
+        "lastModified": 1764203689,
+        "narHash": "sha256-ivb0SqCptyIxx5g8ryRrUL0xrJhLrJPlvZbZjxVaui0=",
+        "owner": "mitchellh",
+        "repo": "zig-overlay",
+        "rev": "8f7347545dea59b75e40247cc1ed55a42f64dbbf",
+        "type": "github"
+      },
+      "original": {
+        "owner": "mitchellh",
+        "repo": "zig-overlay",
         "type": "github"
       }
     }

flake.nix

@@ -4,76 +4,109 @@
   inputs = {
     nixpkgs.url = "nixpkgs/nixos-unstable";
 
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11";
+
     agenix.url = "github:ryantm/agenix";
     agenix.inputs.nixpkgs.follows = "nixpkgs";
 
-    i3utils.url = "git+https://git.sr.ht/~dpatterbee/i3utils?ref=main";
+    copyparty.url = "github:9001/copyparty";
-    i3utils.inputs.nixpkgs.follows = "nixpkgs";
+    copyparty.inputs.nixpkgs.follows = "nixpkgs";
+
+    devenv.url = "github:cachix/devenv";
+    devenv.inputs.nixpkgs.follows = "nixpkgs";
+
+    golink.url = "github:tailscale/golink";
+    golink.inputs.nixpkgs.follows = "nixpkgs";
 
     home-manager.url = "github:nix-community/home-manager/master";
     home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    hyprland.url = "github:hyprwm/Hyprland";
+    i3utils.url = "git+https://git.sr.ht/~dpatterbee/i3utils?ref=main";
+    i3utils.inputs.nixpkgs.follows = "nixpkgs";
 
-    golink.url = "github:tailscale/golink";
+    nixgl.url = "github:/guibou/nixGL";
-    golink.inputs.nixpkgs.follows = "nixpkgs";
+    nixgl.inputs.nixpkgs.follows = "nixpkgs";
+
+    zen-browser.url = "github:0xc000022070/zen-browser-flake";
+    zen-browser.inputs.nixpkgs.follows = "nixpkgs";
+
+    zig.url = "github:mitchellh/zig-overlay";
   };
 
   outputs = {
     nixpkgs,
+    nixpkgs-stable,
     agenix,
+    copyparty,
+    devenv,
+    golink,
     home-manager,
     i3utils,
-    hyprland,
+    nixgl,
-    golink,
+    zen-browser,
+    zig,
     ...
-  }: let
+  } @ inputs: let
     system = "x86_64-linux";
 
+    overlays = [
+      copyparty.overlays.default
+      golink.overlays.default
+      nixgl.overlay
+      zig.overlays.default
+    ];
+
     pkgs =
       (import nixpkgs {
         inherit system;
         config.allowUnfree = true;
-        overlays = [
+        overlays = overlays;
-          golink.overlay
+        config.permittedInsecurePackages = [
+          "electron-25.9.0"
         ];
       })
       // {
         i3utils = i3utils.packages.${system}.default;
-        hyprland = hyprland.packages."x86_64-linux".default.overrideAttrs (finalAttrs: previousAttrs: {
-                buildInputs = previousAttrs.buildInputs ++ [pkgs.makeWrapper];
-                postInstall = ''
-                  ls -lar $out
-                  wrapProgram $out/bin/Hyprland \
-                    --set LIBVA_DRIVER_NAME nvidia \
-                    --set XDG_SESSION_TYPE wayland \
-                    --set __GLX_VENDOR_LIBRARY_NAME nvidia \
-                    --set WLR_NO_HARDWARE_CURSORS 1
-                '';
-              });
       };
 
     lib = nixpkgs.lib;
 
+    deckSystem = {hostname}:
+      home-manager.lib.homeManagerConfiguration {
+        inherit pkgs;
+        modules = [
+          ./users/deck
+        ];
+        extraSpecialArgs = {
+          inherit hostname;
+        };
+      };
+
     hostSystem = {
       hostname,
       headless,
+      np,
     }:
-      lib.nixosSystem {
+      np.lib.nixosSystem {
         inherit system;
-        inherit pkgs;
+        pkgs = import np {
+          inherit system;
+          config.allowUnfree = true;
+          overlays = overlays;
+          config.permittedInsecurePackages = [
+            "electron-25.9.0"
+            "jujutsu-0.23.0"
+          ];
+        };
 
         modules = [
+          {nixpkgs.overlays = overlays;}
+
           ./hosts/${hostname}/configuration.nix
 
           agenix.nixosModules.default
 
-          hyprland.nixosModules.default
+          copyparty.nixosModules.default
-          {
-            programs.hyprland = {
-              enable = !headless;
-            };
-          }
 
           golink.nixosModules.default
 
@@ -85,10 +118,8 @@
               extraSpecialArgs = {
                 inherit hostname;
                 inherit headless;
+                inherit inputs;
               };
-              sharedModules = [
-                hyprland.homeManagerModules.default
-              ];
             };
           }
         ];
@@ -98,23 +129,64 @@
       dingbox = hostSystem {
         hostname = "dingbox";
         headless = false;
+        np = nixpkgs;
+      };
+      elderbug = hostSystem {
+        hostname = "elderbug";
+        headless = false;
+        np = nixpkgs;
       };
       miniding = hostSystem {
         hostname = "miniding";
         headless = false;
+        np = nixpkgs;
       };
       pingbox = hostSystem {
         hostname = "pingbox";
         headless = false;
+        np = nixpkgs;
       };
       dingserver = hostSystem {
         hostname = "dingserver";
         headless = true;
+        np = nixpkgs;
       };
       bigding = hostSystem {
         hostname = "bigding";
         headless = true;
+        np = nixpkgs;
       };
+      sidon = hostSystem {
+        hostname = "sidon";
+        headless = false;
+        np = nixpkgs;
+      };
+      ranni = hostSystem {
+        hostname = "ranni";
+        headless = false;
+        np = nixpkgs;
+      };
+      leviathan = hostSystem {
+        hostname = "leviathan";
+        headless = true;
+        np = nixpkgs;
+      };
+    };
+    homeConfigurations = {
+      "deck" = deckSystem {
+        hostname = "deck";
+      };
+    };
+
+    devShell.${system} = pkgs.mkShell {
+      packages = [
+        pkgs.alejandra
+        (
+          pkgs.writeScriptBin "tidy" ''
+            alejandra .
+          ''
+        )
+      ];
     };
   };
 }

hosts/bigding/configuration.nix

@@ -3,7 +3,29 @@
   pkgs,
   lib,
   ...
+}: let
+  mkVHost = baseUrl: {
+    service,
+    port,
   }: {
+    name = "${service}.${baseUrl}";
+    value = {
+      listenAddresses = ["100.91.249.54"];
+      extraConfig = ''
+        tls {
+        	dns porkbun {
+        		api_key {env.PORKBUN_API_KEY}
+        		api_secret_key {env.PORKBUN_SECRET_KEY}
+        	}
+        }
+
+         reverse_proxy localhost:${builtins.toString port}
+      '';
+    };
+  };
+
+  mkVHosts = baseUrl: hosts: builtins.listToAttrs (builtins.map (mkVHost baseUrl) hosts);
+in {
   imports = [
     ../common
     ./hardware-configuration.nix
@@ -19,22 +41,38 @@
 
   # Use the GRUB 2 boot loader.
   boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
   boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
 
   networking = {
     hostName = "bigding";
     interfaces.ens3.useDHCP = true;
 
-    firewall.interfaces = {
+    firewall = {
+      allowedTCPPorts = [80 8448 443];
+      allowedTCPPortRanges = [
+        {
+          from = 12500;
+          to = 12515;
+        }
+      ];
+      allowedUDPPortRanges = [
+        {
+          from = 12500;
+          to = 12515;
+        }
+      ];
+      interfaces = {
         "tailscale0" = {
           allowedUDPPorts = [41641];
         };
       };
     };
+  };
+
+  services.tailscale.permitCertUid = "caddy";
 
   services.syncthing = {
-    extraOptions = {
+    settings = {
       gui = {
         insecureSkipHostcheck = true;
       };
@@ -42,6 +80,105 @@
     guiAddress = "localhost:8387";
   };
 
+  users.groups."media".name = "media";
+
+  age.secrets = {
+    caddy_porkbun_api_env.file = ../../secrets/caddy_porkbun_api_env.age;
+  };
+
+  services.sabnzbd = {
+    enable = true;
+    group = "media";
+  };
+
+  services.radarr = {
+    enable = true;
+    group = "media";
+  };
+
+  services.caddy = {
+    enable = true;
+    enableReload = false;
+    environmentFile = config.age.secrets.caddy_porkbun_api_env.path;
+    package = pkgs.caddy.withPlugins {
+      plugins = ["github.com/caddy-dns/porkbun@v0.2.1"];
+      hash = "sha256-X8QbRc2ahW1B5niV8i3sbfpe1OPYoaQ4LwbfeaWvfjg=";
+    };
+    logFormat = "level INFO";
+    virtualHosts =
+      (mkVHosts "broccoli.town" [
+        {
+          service = "radarr";
+          port = 7878;
+        }
+        {
+          service = "sonarr";
+          port = 8989;
+        }
+        {
+          service = "sab";
+          port = 8085;
+        }
+        {
+          service = "transmission";
+          port = 9091;
+        }
+      ])
+      // {
+        "danielpatterson.dev" = {
+          extraConfig = ''
+            header {
+            	proof proven.lol/de4a14
+            }
+            root * /srv/site/danielpatterson.dev
+            encode zstd gzip
+            file_server
+          '';
+        };
+        "movies.danielpatterson.dev" = {
+          extraConfig = ''
+            reverse_proxy localhost:8096
+          '';
+        };
+        "git.broccoli.town" = {
+          extraConfig = ''
+            reverse_proxy localhost:3030
+          '';
+        };
+      };
+  };
+
+  # containers.radarr = {
+  #   autoStart = false;
+  #   bindMounts = {
+  #     "/data" = {
+  #       hostPath = "/var/media";
+  #       mountPoint = "/data";
+  #       isReadOnly = false;
+  #     };
+  #   };
+  #   forwardPorts = [
+  #     {
+  #       containerPort = 7878;
+  #       hostPort = 7979;
+  #     }
+  #   ];
+  #   config = {config, pkgs, lib, ...}: {
+  #     services.radarr = {
+  #       enable = true;
+  #     };
+  #   };
+  # };
+
+  services.sonarr = {
+    enable = true;
+    group = "media";
+  };
+
+  services.prowlarr = {
+    enable = true;
+  };
+
   environment.systemPackages = with pkgs; [
     helix
     kitty # For terminfo

hosts/common/default.nix

@@ -4,15 +4,23 @@
   lib,
   ...
 }: let
-  mkUser = userName: {
+  mkUser = {
+    userName,
+    uid,
+  }: {
     isNormalUser = true;
     home = "/home/${userName}";
     initialPassword = "password";
-    extraGroups = ["wheel" "networkmanager" "docker" "video" "syncthing"];
+    extraGroups = ["wheel" "networkmanager" "docker" "video" "syncthing" "audio" "media"];
-    shell = pkgs.nushell;
+    uid = uid;
+    group = "users";
+    shell = pkgs.zsh;
   };
 
-  defaultUser = "daniel";
+  defaultUser = {
+    userName = "daniel";
+    uid = 1000;
+  };
 in {
   # Use the systemd-boot EFI boot loader.
   boot.kernelPackages = pkgs.linuxPackages_latest;
@@ -21,18 +29,17 @@ in {
 
   # nix flakes compatibility
   nix = {
+    settings.trusted-users = [
+      "root"
+      "daniel"
+    ];
     extraOptions = ''
       experimental-features = nix-command flakes
       warn-dirty = false
     '';
+  };
 
-    settings = {
+  security.sudo.wheelNeedsPassword = false;
-      substituters = [
-        "https://hyprland.cachix.org"
-      ];
-      trusted-public-keys = ["hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="];
-    };
-  };
 
   # Set time zone.
   time.timeZone = "Europe/London";
@@ -41,21 +48,23 @@ in {
     defaultLocale = "en_GB.UTF-8";
   };
 
-  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
-  # Per-interface useDHCP will be mandatory in the future, so this generated config
-  # replicates the default behaviour.
-  networking.useDHCP = false;
-
   console = {
     useXkbConfig = true;
   };
 
   virtualisation.docker.enable = true;
+  virtualisation.podman.enable = true;
 
   hardware.cpu.intel.updateMicrocode = true;
 
-  users.users."${defaultUser}" = mkUser defaultUser;
+  users.users."${defaultUser.userName}" = mkUser defaultUser;
-  xdg.portal.wlr.enable = true;
+
+  users.groups."users" = {
+    gid = 100;
+  };
+
+  xdg.portal.wlr.enable = lib.mkDefault true;
+  xdg.portal.config.common.default = "*";
 
   # List packages installed in system profile. To search, run:
   # $ nix search wget
@@ -65,11 +74,13 @@ in {
     firefox
     fzf
     gcc
+    ghostty
     git
     htop
     helix
+    jujutsu
+    jq
     nnn
-    nushell
     ripgrep
     wget
     zsh
@@ -84,18 +95,21 @@ in {
   networking.firewall.trustedInterfaces = ["tailscale0"];
 
   programs.zsh.enable = true;
+  programs.nm-applet.enable = true;
 
   services = {
     openssh.enable = true;
 
     syncthing = {
       enable = true;
-      user = defaultUser;
+      user = defaultUser.userName;
-      dataDir = "/home/${defaultUser}";
+      dataDir = "/home/${defaultUser.userName}";
+      overrideDevices = false;
+      overrideFolders = false;
     };
 
     tailscale = {
-      enable = true;
+      enable = lib.mkDefault true;
     };
   };
 }

hosts/common/graphical/default.nix

@@ -1,19 +1,32 @@
 {
   config,
   pkgs,
+  lib,
   inputs,
   ...
 }: {
   security.pam.services.gdm.enableGnomeKeyring = true;
   # Enable the X11 windowing system.
-  hardware.opengl.driSupport32Bit = true;
+  hardware.graphics.enable32Bit = true;
   hardware.bluetooth.enable = true;
-  hardware.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
-  services.blueman.enable = true;
+  services.blueman.enable = lib.mkDefault true;
-  networking.networkmanager.enable = true;
-  programs.nm-applet.enable = true;
   programs.partition-manager.enable = true;
 
+  networking = {
+    networkmanager.enable = true;
+
+    firewall.checkReversePath = "loose";
+  };
+
+  systemd.services.NetworkManager-wait-online = {
+    serviceConfig = {
+      ExecStart = ["" "${pkgs.networkmanager}/bin/nm-online -q"];
+    };
+  };
+
+  security.pam.services.swaylock = {};
+
   age.secrets = {
     age_identity = {
       file = ../../../secrets/age_identity.age;
@@ -25,12 +38,52 @@
     };
   };
 
-  fonts.fonts = with pkgs; [
+  fonts = {
-    (nerdfonts.override {fonts = ["Iosevka"]; })
+    packages = with pkgs; [
+      fraunces
+      noto-fonts
+      noto-fonts-cjk-sans
+      noto-fonts-color-emoji
+      nerd-fonts.iosevka
+      monocraft
+      source-code-pro
+      ubuntu-classic
     ];
 
+    fontDir.enable = true;
+  };
+
+  programs = {
+    sway.enable = true;
+
+    steam = {
+      enable = true;
+    };
+
+    thunar.enable = true;
+  };
+
   services = {
     gnome.gnome-keyring.enable = true;
+    libinput = {
+      enable = true;
+      mouse = {
+        accelProfile = "flat";
+        accelSpeed = "1";
+      };
+    };
+
+    displayManager.sddm = {
+      enable = true;
+      package = lib.mkDefault pkgs.kdePackages.sddm;
+      wayland.enable = true;
+      # extraPackages = with pkgs; [(catppuccin-sddm.override {flavor = "macchiato";})];
+      theme = "maldives";
+    };
+
+    # desktopManager.plasma6 = {
+    #   enable = true;
+    # };
 
     pipewire = {
       enable = true;
@@ -50,7 +103,7 @@
       ];
       extraRules = ''
         # Raspberry Pi Picoprobe
-SUBSYSTEM="usb", ATTRS{idVendor}=="2e8a", ATTRS{idProduct}=="0003", MODE="0666"
+        # SUBSYSTEM="usb", ATTRS{idVendor}=="2e8a", ATTRS{idProduct}=="0003", MODE="0666"
       '';
     };
 
@@ -58,21 +111,7 @@ SUBSYSTEM="usb", ATTRS{idVendor}=="2e8a", ATTRS{idProduct}=="0003", MODE="0666"
 
     xserver = {
       enable = true;
-      layout = "gb";
+      xkb.layout = "gb";
-
-      libinput = {
-        enable = true;
-        mouse = {
-          accelProfile = "flat";
-          accelSpeed = "1";
-        };
-      };
-
-      displayManager = {
-        gdm = {
-          enable = true;
-        };
-      };
     };
   };
 }

hosts/dingbox/hardware-configuration.nix

@@ -1,34 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = ["xhci_pci" "ehci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = ["kvm-intel"];
-  boot.extraModulePackages = [];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/1c0e1988-4420-4485-bf16-ffb8ec854c69";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/F5EA-A9CB";
-    fsType = "vfat";
-  };
-
-  swapDevices = [];
-
-  # high-resolution display
-  hardware.video.hidpi.enable = lib.mkDefault true;
-}

hosts/dingserver/configuration.nix

@@ -1,41 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: {
-  imports = [
-    # Include the results of the hardware scan.
-    ../common
-    ./hardware-configuration.nix
-    ./tmux.nix
-  ];
-
-  # Force disable the common boot loader
-  boot.loader.systemd-boot.enable = lib.mkForce false;
-  boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
-
-  # Use the GRUB 2 boot loader.
-  boot.loader.grub.enable = true;
-  boot.loader.grub.version = 2;
-  boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
-
-  networking = {
-    hostName = "dingserver";
-    interfaces.ens3.useDHCP = true;
-
-    firewall.interfaces = {
-      "tailscale0" = {
-        allowedUDPPorts = [41641];
-      };
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    helix
-    kitty # For terminfo
-    lazygit
-  ];
-
-  system.stateVersion = "21.11"; # Did you read the comment?
-}

hosts/dingserver/hardware-configuration.nix

@@ -1,28 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [
-    (modulesPath + "/profiles/qemu-guest.nix")
-  ];
-
-  boot.initrd.availableKernelModules = ["ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = [];
-  boot.extraModulePackages = [];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/f91229ad-de6b-49ad-8858-e49fea85e8a1";
-    fsType = "ext4";
-  };
-
-  swapDevices = [];
-
-  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/dingserver/tmux.nix

@@ -1,42 +0,0 @@
-{...}: {
-  programs.tmux = {
-    enable = true;
-    keyMode = "vi";
-    terminal = "tmux-256color";
-    escapeTime = 0;
-    baseIndex = 1;
-    historyLimit = 10000;
-    clock24 = true;
-    extraConfig = ''
-      unbind-key -a -T prefix
-      unbind-key -a -T root
-      unbind-key -a -T copy-mode
-      unbind-key -a -T copy-mode-vi
-
-      set -g prefix M-w
-
-      bind q detach
-      bind : command-prompt
-      bind c new-window
-      bind -T root MouseDown1Status select-window -t =
-
-      bind space copy-mode
-      bind -T copy-mode-vi Escape send-keys -X cancel
-
-      bind -T copy-mode-vi Escape send -X cancel
-      bind -T copy-mode-vi k send -X cursor-up
-      bind -T copy-mode-vi j send -X cursor-down
-      bind -T copy-mode-vi h send -X cursor-left
-      bind -T copy-mode-vi l send -X cursor-right
-
-      bind -T copy-mode-vi Space send -X begin-selection
-      bind -T copy-mode-vi y send -X copy-selection-no-clear
-      bind -T copy-mode-vi Enter send -X copy-selection-and-cancel
-
-      set -g mouse on
-      bind -n WheelUpPane copy-mode -e
-      bind -T copy-mode-vi WheelUpPane send -X -N 5 scroll-up
-      bind -T copy-mode-vi WheelDownPane send -X -N 5 scroll-down
-    '';
-  };
-}

hosts/elderbug/configuration.nix

@@ -12,7 +12,7 @@
     ../common
     ../common/graphical
 
-    (import ../../modules).dingbox
+    (import ../../modules).elderbug
   ];
 
   services.xserver = {
@@ -27,11 +27,14 @@
 
   environment.sessionVariables.NIXOS_OZONE_WL = "1";
 
+  security.pam.u2f = {
+    enable = true;
+  };
+
   hardware.nvidia.modesetting.enable = true;
 
-  networking.hostName = "dingbox"; # Define your hostname.
+  networking.hostName = "elderbug"; # Define your hostname.
-  networking.interfaces.enp5s0.useDHCP = true;
+  networking.interfaces.enp6s0.useDHCP = true;
-  networking.interfaces.wlp6s0.useDHCP = true;
 
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
@@ -39,5 +42,5 @@
   # this value at the release version of the first install of this system.
   # Before changing this value read the documentation for this option
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.05"; # Did you read the comment?
+  system.stateVersion = "23.05"; # Did you read the comment?
 }

hosts/elderbug/hardware-configuration.nix

@@ -0,0 +1,42 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["xhci_pci" "ehci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-intel"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/1abab84b-47d7-45bb-b31d-e5668f545d7f";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/1F77-6B2D";
+    fsType = "vfat";
+  };
+
+  swapDevices = [];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  # networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp6s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp7s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/leviathan/configuration.nix

@@ -0,0 +1,181 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  zfsCompatibleKernelPackages =
+    lib.filterAttrs (
+      name: kernelPackages:
+        (builtins.match "linux_[0-9]+_[0-9]+" name)
+        != null
+        && (builtins.tryEval kernelPackages).success
+        && (!kernelPackages.${config.boot.zfs.package.kernelModuleAttribute}.meta.broken)
+    )
+    pkgs.linuxKernel.packages;
+  latestKernelPackage = lib.last (
+    lib.sort (a: b: (lib.versionOlder a.kernel.version b.kernel.version)) (
+      builtins.attrValues zfsCompatibleKernelPackages
+    )
+  );
+in {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+
+    ../common
+    (import ../../modules).leviathan
+  ];
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+  boot.kernelPackages = lib.mkForce latestKernelPackage;
+  boot.supportedFilesystems = ["zfs"];
+
+  networking = {
+    useDHCP = false;
+    hostName = "leviathan";
+    hostId = "abcd1234";
+    interfaces.enp1s0.useDHCP = true;
+
+    nameservers = [
+      "1.1.1.1"
+    ];
+
+    firewall.allowedTCPPorts = [8000 8123 8095];
+  };
+
+  environment.systemPackages = with pkgs; [
+    helix
+    kitty # For terminfo
+    lazygit
+  ];
+
+  containers.radarr = {
+    autoStart = true;
+    bindMounts = {
+      "/data" = {
+        hostPath = "/store/media";
+        mountPoint = "/store/media";
+        isReadOnly = false;
+      };
+    };
+    config = {
+      config,
+      pkgs,
+      lib,
+      ...
+    }: {
+      services.radarr = {
+        enable = true;
+        user = "root";
+        group = "root";
+      };
+      system.stateVersion = "24.11";
+    };
+  };
+
+  services.openssh.settings.PermitRootLogin = "yes";
+
+  security.rtkit.enable = true;
+
+  users.groups."media".name = "media";
+
+  services = {
+    copyparty = {
+      enable = true;
+      settings = {
+        i = "100.64.214.3";
+      };
+      accounts = {
+      };
+      volumes = {
+        "/" = {
+          path = "/srv/copyparty";
+          access = {
+            rw = "*";
+          };
+        };
+      };
+    };
+
+    jellyfin = {
+      enable = true;
+      group = "media";
+    };
+
+    music-assistant = {
+      enable = true;
+      providers = [
+        "builtin_player"
+        "chromecast"
+        "hass"
+        "hass_players"
+        "soundcloud"
+        "spotify"
+        "spotify_connect"
+        "ytmusic"
+      ];
+    };
+
+    pipewire = {
+      enable = true;
+      pulse.enable = true;
+      alsa.enable = true;
+      alsa.support32Bit = true;
+      wireplumber.enable = true;
+    };
+  };
+
+  programs.virt-manager.enable = true;
+
+  virtualisation = {
+    libvirtd = {
+      enable = true;
+      allowedBridges = ["br0"];
+    };
+
+    oci-containers = {
+      backend = "podman";
+      containers.homeassistant = {
+        volumes = ["home-assistant:/config"];
+        environment.TZ = "Europe/Berlin";
+        image = "ghcr.io/home-assistant/home-assistant:2025.10.2";
+        extraOptions = [
+          # Use the host network namespace for all sockets
+          "--network=host"
+          # Pass devices into the container, so Home Assistant can discover and make use of them
+          "--device=/dev/ttyUSB0:/dev/ttyUSB0"
+        ];
+      };
+    };
+  };
+
+  # systemd.services.libvirt-default-network = {
+  #   description = "Start libvirt bridge network";
+  #   after = ["libvirtd.service"];
+  #   wantedBy = ["multi-user.target"];
+  #   serviceConfig = {
+  #     Type = "oneshot";
+  #     RemainAfterExit = true;
+  #     ExecStart = "${pkgs.libvirt}/bin/virsh net-start bridged-network";
+  #     ExecStop = "${pkgs.libvirt}/bin/virsh net-destroy bridged-network";
+  #     User = "root";
+  #   };
+  # };
+
+  # systemd.services.libvirt-home-assistant = {
+  #   description = "Start home assistant VM";
+  #   after = ["libvirt-default-network.service"];
+  #   wantedBy = ["multi-user.target"];
+  #   serviceConfig = {
+  #     Type = "oneshot";
+  #     RemainAfterExit = true;
+  #     ExecStart = "${pkgs.libvirt}/bin/virsh start hass";
+  #     ExecStop = "${pkgs.libvirt}/bin/virsh destroy hass";
+  #     User = "root";
+  #   };
+  # };
+
+  system.stateVersion = "25.05"; # Did you read the comment?
+}

hosts/leviathan/hardware-configuration.nix

@@ -0,0 +1,67 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-intel"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "zpool/root";
+    fsType = "zfs";
+    options = ["zfsutil"];
+  };
+
+  fileSystems."/nix" = {
+    device = "zpool/nix";
+    fsType = "zfs";
+    options = ["zfsutil"];
+  };
+
+  fileSystems."/var" = {
+    device = "zpool/var";
+    fsType = "zfs";
+    options = ["zfsutil"];
+  };
+
+  fileSystems."/home" = {
+    device = "zpool/home";
+    fsType = "zfs";
+    options = ["zfsutil"];
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/95BF-1B15";
+    fsType = "vfat";
+    options = ["fmask=0022" "dmask=0022"];
+  };
+
+  swapDevices = [
+    {
+      device = "/dev/disk/by-partuuid/db6bcd05-29fb-470a-aeba-f9f2648564af";
+      randomEncryption = true;
+    }
+  ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/miniding/configuration.nix

@@ -1,33 +0,0 @@
-# Edit this configuration file to define what should be installed on
-# your system.  Help is available in the configuration.nix(5) man page
-# and in the NixOS manual (accessible by running ‘nixos-help’).
-{
-  config,
-  pkgs,
-  ...
-}: {
-  imports = [
-    # Include the results of the hardware scan.
-    ./hardware-configuration.nix
-    ../common
-    ../common/graphical
-  ];
-
-  networking = {
-    hostName = "miniding";
-    interfaces.wlp2s0.useDHCP = true;
-  };
-
-  # Enable the X11 windowing system.
-  services.xserver = {
-    dpi = 144;
-  };
-
-  # This value determines the NixOS release from which the default
-  # settings for stateful data, like file locations and database versions
-  # on your system were taken. It‘s perfectly fine and recommended to leave
-  # this value at the release version of the first install of this system.
-  # Before changing this value read the documentation for this option
-  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "21.05"; # Did you read the comment?
-}

hosts/miniding/hardware-configuration.nix

@@ -1,31 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-  ];
-
-  boot.initrd.availableKernelModules = ["xhci_pci" "ahci" "usb_storage" "sd_mod"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = ["kvm-intel"];
-  boot.extraModulePackages = [];
-
-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/6a362ee7-854b-4a5b-8989-e65af01b9b99";
-    fsType = "ext4";
-  };
-
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/C103-FFC1";
-    fsType = "vfat";
-  };
-
-  swapDevices = [];
-}

hosts/pingbox/configuration.nix

@@ -22,19 +22,33 @@
 
   hardware.acpilight.enable = lib.mkDefault true;
 
-  hardware.opengl = {
+  hardware.graphics = {
     enable = true;
     extraPackages = with pkgs; [
       intel-media-driver
-      vaapiIntel
+      intel-vaapi-driver
     ];
   };
 
+  programs.kdeconnect.enable = true;
+
+  programs.niri.enable = true;
+
+  # programs.virt-manager.enable = true;
+
+  # users.groups.libvirtd.members = ["daniel"];
+
+  # virtualisation.libvirtd.enable = true;
+
+  # virtualisation.spiceUSBRedirection.enable = true;
+
   networking = {
     hostName = "pingbox";
     interfaces.wlp170s0.useDHCP = true;
   };
 
+  environment.pathsToLink = [ "/share/xdg-desktop-portal" "/share/applications" ];
+
   services = {
     fprintd.enable = true;
 
@@ -47,21 +61,20 @@
         PCIE_ASPM_ON_BAT = "powersupersave";
       };
     };
-
-    xserver = {
-      dpi = 144;
-
-      videoDrivers = ["intel"];
-      deviceSection = ''
-        Option "DRI" "2"
-        Option "TearFree" "true"
-      '';
-
     libinput.touchpad = {
       naturalScrolling = true;
       horizontalScrolling = false;
       tapping = true;
     };
+
+    xserver = {
+      dpi = 144;
+
+      videoDrivers = ["modesetting"];
+      deviceSection = ''
+        Option "DRI" "2"
+        Option "TearFree" "true"
+      '';
     };
 
     logind = {

hosts/pingbox/hardware-configuration.nix

@@ -29,14 +29,8 @@
 
   swapDevices = [];
 
-  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
-  # Per-interface useDHCP will be mandatory in the future, so this generated config
-  # replicates the default behaviour.
-  networking.useDHCP = lib.mkDefault false;
   networking.interfaces.wlp170s0.useDHCP = lib.mkDefault true;
 
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
   hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-  # high-resolution display
-  hardware.video.hidpi.enable = lib.mkDefault true;
 }

hosts/ranni/configuration.nix

@@ -0,0 +1,346 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  mkVHost = baseUrl: {
+    service,
+    port,
+  }: {
+    name = "${service}.${baseUrl}";
+    value = {
+      listenAddresses = ["100.76.159.53"];
+      extraConfig = ''
+        tls {
+        	dns porkbun {
+        		api_key {env.PORKBUN_API_KEY}
+        		api_secret_key {env.PORKBUN_SECRET_KEY}
+        	}
+        }
+
+         reverse_proxy localhost:${builtins.toString port}
+      '';
+    };
+  };
+
+  mkVHosts = baseUrl: hosts: builtins.listToAttrs (builtins.map (mkVHost baseUrl) hosts);
+
+  zfsCompatibleKernelPackages =
+    lib.filterAttrs (
+      name: kernelPackages:
+        (builtins.match "linux_[0-9]+_[0-9]+" name)
+        != null
+        && (builtins.tryEval kernelPackages).success
+        && (!kernelPackages.${config.boot.zfs.package.kernelModuleAttribute}.meta.broken)
+    )
+    pkgs.linuxKernel.packages;
+
+  latestKernelPackage = lib.last (
+    lib.sort (a: b: (lib.versionOlder a.kernel.version b.kernel.version)) (
+      builtins.attrValues zfsCompatibleKernelPackages
+    )
+  );
+in {
+  imports = [
+    ../common
+    ./hardware-configuration.nix
+
+    (import ../../modules).ranni
+  ];
+
+  boot.kernelPackages = lib.mkForce latestKernelPackage;
+
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    efiSupport = false;
+    devices = ["/dev/disk/by-id/ata-ST4000NM0245-1Z2107_ZC1A059L" "/dev/disk/by-id/ata-ST4000NM0245-1Z2107_ZC19X508"];
+    copyKernels = true;
+  };
+  boot.supportedFilesystems = ["zfs"];
+  boot.swraid.enable = true;
+  boot.kernelParams = ["boot.shell_on_fail"];
+
+  hardware.graphics = {
+    enable = true;
+    extraPackages = with pkgs; [
+      intel-media-driver
+      vaapiIntel
+    ];
+  };
+
+  networking = {
+    hostName = "ranni";
+    hostId = "00000001";
+
+    useDHCP = false;
+
+    interfaces."enp0s31f6" = {
+      ipv4.addresses = [
+        {
+          address = "95.216.12.238";
+          # Hetzner requires /32, see:
+          #     https://docs.hetzner.com/robot/dedicated-server/network/net-config-debian-ubuntu/#ipv4.
+          # NixOS automatically sets up a route to the gateway
+          # (but only because we set "networking.defaultGateway.interface" below), see
+          #     https://github.com/NixOS/nixops/pull/1032#issuecomment-2763497444
+          prefixLength = 32;
+        }
+      ];
+
+      ipv6.addresses = [
+        {
+          address = "2a01:4f9:2a:d05::1";
+          prefixLength = 64;
+        }
+      ];
+    };
+
+    defaultGateway = {
+      address = "95.216.12.193";
+      # Interface must be given for Hetzner networking to work, see comment above.
+      interface = "enp0s31f6";
+    };
+
+    defaultGateway6 = {
+      address = "fe80::1";
+      interface = "enp0s31f6";
+    };
+
+    nameservers = [
+      # cloudflare
+      "1.1.1.1"
+      "2606:4700:4700::1111"
+      "2606:4700:4700::1001"
+      # google
+      "8.8.8.8"
+      "2001:4860:4860::8888"
+      "2001:4860:4860::8844"
+    ];
+
+    firewall = {
+      allowedTCPPorts = [80 8448 443];
+      allowedTCPPortRanges = [
+        {
+          from = 12500;
+          to = 12515;
+        }
+      ];
+      allowedUDPPortRanges = [
+        {
+          from = 12500;
+          to = 12515;
+        }
+      ];
+      interfaces = {
+        "tailscale0" = {
+          allowedUDPPorts = [41641];
+        };
+      };
+    };
+  };
+
+  services.tailscale.permitCertUid = "caddy";
+
+  services.syncthing = {
+    settings = {
+      gui = {
+        insecureSkipHostcheck = true;
+      };
+    };
+    guiAddress = "localhost:8387";
+  };
+
+  services = {
+    jellyfin.enable = true;
+    jellyfin.group = "media";
+  };
+
+  users.groups."media".name = "media";
+
+  age.secrets = {
+    caddy_porkbun_api_env.file = ../../secrets/caddy_porkbun_api_env.age;
+    danflix_hetzner_storage_box_pub_key.file = ../../secrets/danflix_hetzner_storage_box_pub_key.age;
+    danflix_rclone_config.file = ../../secrets/danflix_rclone_config.age;
+  };
+
+  services.sabnzbd = {
+    enable = true;
+    group = "media";
+  };
+
+  containers.radarr = {
+    autoStart = true;
+    bindMounts = {
+      "/data" = {
+        hostPath = "/var/media";
+        mountPoint = "/var/media";
+        isReadOnly = false;
+      };
+    };
+    config = {
+      config,
+      pkgs,
+      lib,
+      ...
+    }: {
+      services.radarr = {
+        enable = true;
+        user = "root";
+        group = "root";
+      };
+      system.stateVersion = "24.11";
+    };
+  };
+
+  # containers.radarr-small = {
+  #   autoStart = true;
+  #   bindMounts = {
+  #     "/data" = {
+  #       hostPath = "/var/media";
+  #       mountPoint = "/var/media";
+  #       isReadOnly = false;
+  #     };
+  #   };
+  #   forwardPorts = [
+  #     {
+  #       containerPort = 7878;
+  #       hostPort = 7979;
+  #     }
+  #   ];
+  #   config = {
+  #     config,
+  #     pkgs,
+  #     lib,
+  #     ...
+  #   }: {
+  #     environment.systemPackages = with pkgs; [
+  #       ghostty
+  #       helix
+  #     ];
+  #     services.radarr = {
+  #       enable = true;
+  #       user = "root";
+  #       group = "root";
+  #     };
+  #     system.stateVersion = "24.11";
+  #   };
+  # };
+
+  containers.sonarr = {
+    autoStart = true;
+    bindMounts = {
+      "/data" = {
+        hostPath = "/var/media";
+        mountPoint = "/var/media";
+        isReadOnly = false;
+      };
+    };
+    config = {
+      config,
+      pkgs,
+      lib,
+      ...
+    }: {
+      services.sonarr = {
+        enable = true;
+        user = "root";
+        group = "root";
+      };
+      system.stateVersion = "24.11";
+    };
+  };
+
+  containers.lidarr = {
+    autoStart = true;
+    bindMounts = {
+      "/var/media" = {
+        hostPath = "/var/media";
+        mountPoint = "/var/media";
+        isReadOnly = false;
+      };
+    };
+    config = {
+      config,
+      pkgs,
+      lib,
+      ...
+    }: {
+      services.lidarr = {
+        enable = true;
+        user = "root";
+        group = "root";
+      };
+      system.stateVersion = "24.11";
+    };
+  };
+
+  services.prowlarr = {
+    enable = true;
+  };
+
+  services.caddy = {
+    enable = true;
+    enableReload = false;
+    environmentFile = config.age.secrets.caddy_porkbun_api_env.path;
+    package = pkgs.caddy.withPlugins {
+      plugins = ["github.com/caddy-dns/porkbun@v0.3.1"];
+      hash = "sha256-sa+L2YoTM1ZfhfowoCZwmggrUsqw0NmGWRK45TevxFo=";
+    };
+    logFormat = "level INFO";
+    virtualHosts =
+      (mkVHosts "broccoli.town" [
+        {
+          service = "radarr";
+          port = 7878;
+        }
+        {
+          service = "sonarr";
+          port = 8989;
+        }
+        {
+          service = "sab";
+          port = 8085;
+        }
+        {
+          service = "lidarr";
+          port = 8686;
+        }
+      ])
+      // {
+        "http://ranni:8085" = {
+          listenAddresses = ["100.76.159.53"];
+
+          extraConfig = ''
+            reverse_proxy localhost:8085
+          '';
+        };
+        "http://ranni:8384" = {
+          listenAddresses = ["100.76.159.53"];
+
+          extraConfig = ''
+            reverse_proxy localhost:8387
+          '';
+        };
+        "movies.danielpatterson.dev" = {
+          extraConfig = ''
+            reverse_proxy localhost:8096
+          '';
+        };
+        "git.broccoli.town" = {
+          extraConfig = ''
+            reverse_proxy localhost:3030
+          '';
+        };
+      };
+  };
+
+  environment.systemPackages = with pkgs; [
+    helix
+    kitty # For terminfo
+    lazygit
+  ];
+
+  system.stateVersion = "24.11"; # Did you read the comment?
+}

hosts/ranni/hardware-configuration.nix

@@ -0,0 +1,58 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["ahci" "sd_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-intel"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "root_pool/root/nixos";
+    fsType = "zfs";
+  };
+
+  fileSystems."/home" = {
+    device = "root_pool/home";
+    fsType = "zfs";
+  };
+
+  fileSystems."/var/lib/postgres" = {
+    device = "root_pool/postgres";
+    fsType = "zfs";
+  };
+
+  fileSystems."/var/media" = {
+    device = "root_pool/media";
+    fsType = "zfs";
+  };
+
+  fileSystems."/boot/efi" = {
+    device = "/dev/disk/by-uuid/555A-CAFA";
+    fsType = "vfat";
+    options = ["fmask=0022" "dmask=0022"];
+  };
+
+  swapDevices = [];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+  boot.swraid.enable = true;
+}

hosts/sidon/configuration.nix

@@ -0,0 +1,67 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ../common
+    ../common/graphical
+
+    (import ../../modules).sidon
+  ];
+
+  boot.kernelPackages = lib.mkDefault pkgs.linuxPackages_6_8;
+
+  services.xserver = {
+    dpi = 144;
+  };
+
+  boot.loader.systemd-boot.enable = false;
+  boot.loader.grub = {
+    enable = true;
+    device = "nodev";
+    useOSProber = true;
+    efiSupport = true;
+  };
+
+  time.hardwareClockInLocalTime = true;
+
+  environment.sessionVariables.NIXOS_OZONE_WL = "1";
+
+  environment.systemPackages = with pkgs; [
+    wlr-randr
+  ];
+
+  specialisation = {
+    niri.configuration = {
+      programs.niri.enable = true;
+    };
+    plasma.configuration = {
+      boot.loader.systemd-boot.sortKey = "default";
+      services.blueman.enable = false;
+      services.desktopManager.plasma6.enable = true;
+    };
+  };
+
+  security.pam.u2f = {
+    enable = true;
+  };
+
+  hardware.graphics.enable = true;
+
+  networking.hostName = "sidon"; # Define your hostname.
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "23.05"; # Did you read the comment?
+}

hosts/sidon/hardware-configuration.nix

@@ -0,0 +1,46 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usbhid"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-amd"];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/1abab84b-47d7-45bb-b31d-e5668f545d7f";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/1F77-6B2D";
+    fsType = "vfat";
+  };
+
+  swapDevices = [];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.br-06c6ce3e0c6d.useDHCP = lib.mkDefault true;
+  # networking.interfaces.br-e024580aae91.useDHCP = lib.mkDefault true;
+  # networking.interfaces.docker0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.eno1.useDHCP = lib.mkDefault true;
+  # networking.interfaces.tailscale0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlp8s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

modules/backups/bigding/default.nix

@@ -0,0 +1,44 @@
+{
+  pkgs,
+  config,
+  ...
+}: {
+  age.secrets = {
+    bigding_backup_s3_creds.file = ../../../secrets/bigding_backup_s3_creds.age;
+    bigding_backup_repo_password.file = ../../../secrets/bigding_backup_repo_password.age;
+  };
+
+  services.restic.backups = {
+    "system" = {
+      initialize = true;
+      passwordFile = config.age.secrets.bigding_backup_repo_password.path;
+      timerConfig = {
+        OnCalendar = "02:00";
+      };
+      repository = "s3:s3.eu-central-003.backblazeb2.com/bigding-backup";
+      environmentFile = config.age.secrets.bigding_backup_s3_creds.path;
+
+      paths = [
+        "/etc/group"
+        "/etc/machine-id"
+        "/etc/NetworkManager/system-connections"
+        "/etc/passwd"
+        "/etc/subgid"
+        "/home"
+        "/root"
+        "/var/lib/prometheus2"
+        "/var/lib/jellyfin"
+        "/var/lib/fail2ban"
+        "/var/lib/matrix-synapse"
+        "/var/lib/golink"
+        "/var/lib/tailscale"
+        "/var/lib/caddy"
+        "/var/backup"
+      ];
+
+      backupPrepareCommand = ''
+        ${pkgs.postgresql_16}/bin/pg_dumpall --clean -U postgres | ${pkgs.zstd}/bin/zstd --rsyncable > /var/backup/pgdump.sql.zst
+      '';
+    };
+  };
+}

modules/caddy/Caddyfile

@@ -0,0 +1,109 @@
+{
+	log {
+		level ERROR
+	}
+	# admin off
+	servers {
+		metrics
+	}
+}
+
+matrix.broccoli.town {
+	reverse_proxy /_matrix/* http://localhost:8008
+	reverse_proxy /_synapse/client/* http://localhost:8008
+}
+
+syncv3.broccoli.town {
+	reverse_proxy http://localhost:8009
+}
+
+broccoli.town:8448 {
+	reverse_proxy http://localhost:8008
+}
+
+radarr.broccoli.town {
+	bind 100.91.249.54
+
+	tls {
+		dns porkbun {
+			api_key {env.PORKBUN_API_KEY}
+			api_secret_key {env.PORKBUN_SECRET_KEY}
+		}
+	}
+
+	reverse_proxy http://localhost:7878
+}
+
+sab.broccoli.town {
+	bind 100.91.249.54
+
+	tls {
+		dns porkbun {
+			api_key {env.PORKBUN_API_KEY}
+			api_secret_key {env.PORKBUN_SECRET_KEY}
+		}
+	}
+
+	reverse_proxy http://localhost:8085
+}
+
+sonarr.broccoli.town {
+	bind 100.91.249.54
+
+	tls {
+		dns porkbun {
+			api_key {env.PORKBUN_API_KEY}
+			api_secret_key {env.PORKBUN_SECRET_KEY}
+		}
+	}
+
+	reverse_proxy localhost:8989
+}
+
+transmission.broccoli.town {
+	bind 100.91.249.54
+
+	tls {
+		dns porkbun {
+			api_key {env.PORKBUN_API_KEY}
+			api_secret_key {env.PORKBUN_SECRET_KEY}
+		}
+	}
+
+	reverse_proxy localhost:9091
+}
+
+danielpatterson.dev {
+	header {
+		proof proven.lol/de4a14
+	}
+	root * /srv/site/danielpatterson.dev
+	encode zstd gzip
+	file_server
+}
+
+movies.danielpatterson.dev {
+	reverse_proxy localhost:8096
+}
+
+elixir.danielpatterson.dev {
+	reverse_proxy localhost:8080
+}
+
+git.broccoli.town {
+	reverse_proxy localhost:3030
+}
+
+http://bigding:8384 {
+	bind 100.91.249.54
+
+	reverse_proxy localhost:8387
+}
+
+http://bigding {
+	bind 100.91.249.54
+
+	handle_path /prometheus/* {
+		reverse_proxy localhost:9090
+	}
+}

modules/caddy/default.nix

@@ -1,102 +1,20 @@
 {
   pkgs,
   lib,
+  config,
   ...
 }: {
   networking.firewall.allowedTCPPorts = [80 8448 443];
 
-  services.tailscale.permitCertUid = "caddy";
-
   services.caddy = {
+    package = pkgs.caddy.withPlugins {
+      plugins = ["github.com/caddy-dns/porkbun@v0.2.1"];
+      hash = "sha256-X8QbRc2ahW1B5niV8i3sbfpe1OPYoaQ4LwbfeaWvfjg=";
+    };
     enable = true;
-    virtualHosts = {
+    enableReload = false;
-      "http://metrics.town" = {
+    adapter = "caddyfile";
-        extraConfig = ''
+    environmentFile = config.age.secrets.caddy_porkbun_api_env.path;
-          reverse_proxy http://localhost:3000
+    configFile = ./Caddyfile;
-        '';
-      };
-
-      "matrix.broccoli.town" = {
-        extraConfig = ''
-          reverse_proxy /_matrix/* http://localhost:8008
-          reverse_proxy /_synapse/client/* http://localhost:8008
-        '';
-      };
-
-      "broccoli.town:8448" = {
-        extraConfig = ''
-          reverse_proxy http://localhost:8008
-        '';
-      };
-
-      "broccoli.town" = {
-        extraConfig = ''
-          header /.well-known/* "Access-Control-Allow-Origin" "*"
-          respond /.well-known/matrix/client "{\"m.homeserver\": {\"base_url\": \"https://broccoli.town\"}}"
-
-          reverse_proxy /_matrix/* http://localhost:8008
-          reverse_proxy /_synapse/client/* http://localhost:8008
-
-          redir / https://chat.broccoli.town
-        '';
-      };
-
-      "chat.broccoli.town" = {
-        extraConfig = ''
-          header {
-            X-Frame-Options "SAMEORIGIN"
-            X-XSS-Protection "1; mode=block"
-            X-Content-Type-Options "nosniff"
-            X-Robots-Tag "noindex, noarchive, nofollow"
-          }
-          root * ${
-            pkgs.element-web.override {
-              conf = {
-                default_server_config."m.homeserver" = {
-                  "base_url" = "https://broccoli.town";
-                  "server_name" = "broccoli.town";
-                };
-              };
-            }
-          }
-          file_server
-        '';
-      };
-
-      "danielpatterson.dev" = {
-        extraConfig = ''
-          root * /srv/site/danielpatterson.dev
-          encode zstd gzip
-          file_server
-        '';
-      };
-
-      "movies.danielpatterson.dev" = {
-        extraConfig = ''
-          reverse_proxy localhost:8096
-        '';
-      };
-
-      "elixir.danielpatterson.dev" = {
-        extraConfig = ''
-          reverse_proxy localhost:8080
-        '';
-      };
-
-      "http://bigding:8384" = {
-        extraConfig = ''
-          reverse_proxy localhost:8387
-        '';
-      };
-
-      "bigding.squirrel-clownfish.ts.net" = {
-        extraConfig = ''
-          tls {
-            get_certificate tailscale
-          }
-          reverse_proxy localhost:9091
-        '';
-      };
-    };
   };
 }

modules/default.nix

@@ -1,11 +1,15 @@
 {
   bigding = {
     imports = [
-      ./caddy
+      ./backups/bigding
+      # ./caddy
       ./dungflix
+      ./fail2ban
+      ./gitea
+      ./golink
+      ./livebook
       ./monitoring
       ./synapse
-      ./golink
     ];
   };
 
@@ -15,10 +19,18 @@
     ];
   };
 
+  elderbug = {};
+
+  sidon = {};
+
   pingbox = {
+  };
+
+  ranni = {
     imports = [
-      ./postgres
       ./gitea
     ];
   };
+
+  leviathan = {};
 }

modules/dungflix/default.nix

@@ -3,31 +3,24 @@
   config,
   ...
 }: let
-  mountdir = "/var/media/dungflix";
+  mountdir = "/var/media/danflix";
-
-  rclone_config = pkgs.writeText "" ''
-    [dungflix]
-    type = b2
-
-    [dungflix-vault]
-    type = crypt
-    remote = dungflix:dungflix-bucket
-  '';
 in {
   age.secrets = {
-    dungflix_bucket_account_id.file = ../../secrets/dungflix_bucket_account_id.age;
+    danflix_hetzner_storage_box_pub_key.file = ../../secrets/danflix_hetzner_storage_box_pub_key.age;
-    dungflix_bucket_account_key.file = ../../secrets/dungflix_bucket_account_key.age;
+    danflix_rclone_config.file = ../../secrets/danflix_rclone_config.age;
-    dungflix_crypt_remote_obscured_pass.file = ../../secrets/dungflix_crypt_remote_obscured_pass.age;
   };
 
   services = {
     jellyfin.enable = true;
+    jellyfin.group = "media";
 
     transmission = {
       enable = true;
+      package = pkgs.transmission_3;
+      webHome = pkgs.transmission_3 + /share/transmission/web;
       settings = {
         rpc-host-whitelist-enable = true;
-        rpc-host-whitelist = "bigding.squirrel-clownfish.ts.net";
+        rpc-host-whitelist = "bigding.squirrel-clownfish.ts.net,bigding";
       };
     };
   };
@@ -40,35 +33,37 @@ in {
     MemoryMax = "1G";
   };
 
-  systemd.services.dungflix-mount = {
+  systemd.services.danflix-mount = {
-    description = "Mount the Backblaze B2 media store";
+    description = "Mount the Hetzner Storage Box media store";
     wantedBy = ["multi-user.target"];
-    path = [pkgs.fuse];
+    path = [pkgs.fuse3];
     preStart = ''
       mkdir -p -m 777 ${mountdir}
     '';
+    environment = {
+      "RCLONE_SFTP_KEY_FILE" = config.age.secrets.danflix_hetzner_storage_box_pub_key.path;
+    };
     script = ''
-      export RCLONE_B2_ACCOUNT=''$(cat ${config.age.secrets.dungflix_bucket_account_id.path})
+      ${pkgs.rclone}/bin/rclone --config="${config.age.secrets.danflix_rclone_config.path}" mount danflix-union: ${mountdir} \
-      export RCLONE_B2_KEY=''$(cat ${config.age.secrets.dungflix_bucket_account_key.path})
-      export RCLONE_CRYPT_PASSWORD=''$(cat ${config.age.secrets.dungflix_crypt_remote_obscured_pass.path})
-      ${pkgs.rclone}/bin/rclone --config="${rclone_config}" mount dungflix-vault: ${mountdir} \
-        --transfers 32 \
          --vfs-cache-mode full \
          --vfs-cache-max-age 336h \
-        --vfs-cache-max-size 200G \
+         --vfs-cache-max-size 60G \
          --allow-other \
          --no-modtime \
          --rc \
+         --sftp-concurrency 8 \
+         --checkers 4 \
+         --rc-addr=localhost:5572 \
          --rc-no-auth \
-        -vv
+         -v
     '';
     postStart = ''
       sleep 5
-      ${pkgs.rclone}/bin/rclone --config="${rclone_config}" rc vfs/refresh recursive=true _async=true
+      ${pkgs.rclone}/bin/rclone --config="${config.age.secrets.danflix_rclone_config.path}" rc vfs/refresh recursive=true _async=true
     '';
     postStop = ''
       sleep 3
-      fusermount -u ${mountdir}
+      ${pkgs.fuse3}/bin/fusermount -u ${mountdir}
     '';
     serviceConfig = {
       Restart = "on-failure";

modules/fail2ban/default.nix

@@ -0,0 +1,13 @@
+{...}: {
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    ignoreIP = [
+      "127.0.0.1/8"
+      "10.0.0.0/8"
+      "172.16.0.0/12"
+      "192.168.0.0/16"
+      "8.8.8.8"
+    ];
+  };
+}

modules/gitea/default.nix

@@ -1,15 +1,53 @@
-{ config, pkgs, ... }:
 {
+  config,
+  pkgs,
+  ...
+}: {
+  age.secrets = {
+    sendmail_email_key_gitea = {
+      file = ../../secrets/sendmail_email_key_gitea.age;
+      owner = "gitea";
+      group = "gitea";
+    };
+  };
+
   services.gitea = {
     enable = true;
-    appName = "My awesome Gitea server"; # Give the site a name
+    appName = "The Broccoli Patch";
     database = {
       type = "sqlite3";
     };
+    dump = {
+      enable = true;
+      type = "tar.zst";
+      file = "gitea.tar.zst";
+      backupDir = "/var/backup";
+      interval = "01:30";
+    };
     settings = {
+      server = {
+        ROOT_URL = "https://git.broccoli.town/";
+        HTTP_PORT = 3030;
+        HTTP_ADDR = "127.0.0.1";
+        DOMAIN = "git.broccoli.town";
+      };
       service = {
+        REGISTER_EMAIL_CONFIRM = true;
         DISABLE_REGISTRATION = true;
+        ENABLE_NOTIFY_MAIL = true;
+        DEFAULT_KEEP_EMAIL_PRIVATE = true;
+      };
+      repository = {
+        ENABLE_PUSH_CREATE_USER = true;
+      };
+      mailer = {
+        ENABLED = true;
+        FROM = "gitea@broccoli.town";
+        SMTP_ADDR = "smtp.sendgrid.net";
+        SMTP_PORT = 587;
+        USER = "apikey";
       };
     };
+    mailerPasswordFile = config.age.secrets.sendmail_email_key_gitea.path;
   };
 }

modules/golink/default.nix

@@ -1,6 +1,4 @@
-{
+{...}: {
-  ...
-}: {
   services.golink = {
     enable = true;
 

modules/livebook/default.nix

@@ -0,0 +1,14 @@
+{config, ...}: {
+  virtualisation.oci-containers = {
+    backend = "docker";
+    containers = {
+      "livebook" = {
+        image = "ghcr.io/livebook-dev/livebook";
+        ports = ["8080:8080" "8081:8081"];
+        volumes = ["/home/daniel/livebook/data:/data"];
+        user = "${toString config.users.users."daniel".uid}:${toString config.users.groups."users".gid}";
+        environmentFiles = ["/home/daniel/.livebook_env"];
+      };
+    };
+  };
+}

modules/monitoring/default.nix

@@ -6,7 +6,12 @@
 }: {
   services.grafana = {
     enable = true;
-    settings = {};
+    settings = {
+      server = {
+        http_addr = "127.0.0.1";
+        http_port = 3033;
+      };
+    };
   };
 
   services.prometheus = {
@@ -24,6 +29,15 @@
           }
         ];
       }
+      {
+        job_name = "caddy";
+        scrape_interval = "15s";
+        static_configs = [
+          {
+            targets = ["localhost:2019"];
+          }
+        ];
+      }
     ];
   };
 }

modules/synapse/default.nix

@@ -7,22 +7,20 @@
   fqdn = "matrix.broccoli.town";
 in {
   services.postgresql = {
-    enable = true;
+    enable = false;
+    package = pkgs.postgresql_16;
     ensureUsers = [
-      {
-        name = "matrix-synapse";
-        ensurePermissions = {
-          "DATABASE synapse" = "ALL PRIVILEGES";
-        };
-      }
     ];
+    authentication = ''
+      local all all trust
+    '';
     ensureDatabases = [
       "synapse"
     ];
   };
 
   services.matrix-synapse = {
-    enable = true;
+    enable = false;
     settings = {
       enable_metrics = true;
       server_name = "broccoli.town";

scripts/selecthover

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+CURSORPOS=$(hyprctl cursorpos -j)
+
+X_POS=$(jq '.x' <<< $CURSORPOS)
+Y_POS=$(jq '.y' <<< $CURSORPOS)
+
+ACTIVE_WORKSPACE=$(hyprctl activeworkspace -j | jq '.id')
+
+hyprctl clients -j | jq "$(cat << EOF
+  .[] |
+  select(.workspace.id == $ACTIVE_WORKSPACE) |
+  select(
+    .at[0] <= $X_POS
+    and .at[1] <= $Y_POS
+    and (.at[0] + .size[0] >= $X_POS)
+    and (.at[1] + .size[1] >= $Y_POS)
+  ) | .pid
+EOF
+)" | tail -n 1
+

scripts/swayutils

@@ -0,0 +1,48 @@
+#!/bin/sh
+
+function move {
+	CURR_WORKSPACE=$(swaymsg -t get_workspaces | jq -r '. | map(select(.focused == true)) | .[0].name')
+
+	echo $CURR_WORKSPACE
+
+	case $1 in
+		"next")
+			NEW_WORKSPACE=$(expr ${CURR_WORKSPACE} + 1)
+		;;
+		"prev")
+			[ ${CURR_WORKSPACE} -eq 1 ] && exit 0
+			NEW_WORKSPACE=$(expr ${CURR_WORKSPACE} - 1)
+		;;
+	esac
+
+	swaymsg "move container to workspace ${NEW_WORKSPACE}"
+	swaymsg "workspace ${NEW_WORKSPACE}"
+}
+
+function focus {
+	CURR_WORKSPACE=$(swaymsg -t get_workspaces | jq -r '. | map(select(.focused == true)) | .[0].name')
+
+	echo $CURR_WORKSPACE
+
+	case $1 in
+		"next")
+			NEW_WORKSPACE=$(expr ${CURR_WORKSPACE} + 1)
+		;;
+		"prev")
+			[ ${CURR_WORKSPACE} -eq 1 ] && exit 0
+			NEW_WORKSPACE=$(expr ${CURR_WORKSPACE} - 1)
+		;;
+	esac
+
+	swaymsg "workspace ${NEW_WORKSPACE}"
+}
+
+case $1 in
+	"move")
+		move $2
+		;;
+
+	"focus")
+		focus $2
+		;;
+esac

secrets/bigding_backup_repo_password.age

@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-ed25519 eYYv1Q EAZDNmNVPn4csM/YdGJFlORxQDMMtO5Dn7x2XfFRaFU
+vuduGWTaLD//qz0GlOdArY7i4n3Uhwi4+nFr4jj8P3Y
+-> ssh-ed25519 Bp5IaA XOy6sVXfaDVKhN81OZOtVlroHKIxpKgMwnJxcQ+i8Gs
+dxXJCjBLmLru9L/sJEBmp8wA563MBc4nZYhXkE5P3zY
+-> ssh-ed25519 T/DpgA XKdq7MGI+Gl+NYrwuMBPs0Wy4Z2/ewdItW3YhgEW/xY
+SSeYZXSqY+FOv4A6+oxKgu2CzUI8DPEXiI2iMDXCkS4
+-> ssh-ed25519 qMgRFg 6uBriCnYizzXcQ9Sj+PBHHHKajsBICdErIAN/m5zCwM
+HiNfRVS3omZA9UopFXXlK7KzaLU5q78/murhClxw3Hk
+-> ssh-ed25519 dMZXNw R7mVtYIYqYGRJ6T1u07eStvfXJPZRT/0yOc0a2haFAo
+JNzKXxhW+MxJKCSlI6lJqpCbR3QYI+FAHlnXUpzW5pk
+-> ssh-ed25519 +shbwg zIiwiExg9YyJ4ihqr10WPRv0deNFjj2on6EFFTnSFSU
+WYem7R3Mwi8OBZPOqd/m0v+A8k9HUC0+e7BwlTbdIQc
+-> ssh-ed25519 70Nt2Q VacvBAJYuKDhLKpoDsdoFtPB9po/Bq/lC6EKG7C3oSg
+DrifwWRcqhHjt/yAcDrxKEPpY3ceL5VJy3BNPH7v4q8
+--- vwailf0HFStDtxF94IGxV1jHWyhLjagTFAROxkCqnv4
+<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>P<><1F>6<EFBFBD><36>i<EFBFBD>bɿ<62><C9BF>
\

secrets/bigding_backup_s3_creds.age

@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 eYYv1Q s6gPZA/ZEuwYS5Bi+xbSPS0p3v4I5u5l3fyV9OlZKk8
+Gy8aXFeM/Rsxoevdg6+yNA5Z00eBhWSU9d8YVPOSM0U
+-> ssh-ed25519 Bp5IaA UAI6l3EjanPqPwiSDVRRDgdAbDV1rrhDBs04BFlOinc
+v4UWes0gOqJy6HosZQ8/yqx68x4DLIL9RA3fEKi8PLQ
+-> ssh-ed25519 T/DpgA CBy65h4QW/WIwf0FgbHqozqixKe2vsBKr34gorqhsBo
+BJzaZ8BuPFlY3BAdqgn8SuqK2AcDnBhx5wJ8N02Wf4M
+-> ssh-ed25519 qMgRFg i9Z+qD7U2uy1uqbRhecD7OdK9vQU65ynUeSkktOgjBs
+rLFOAfWD5Z07EH/Wk+eG0+QpSBJXrn99UGTtAfdtQL0
+-> ssh-ed25519 dMZXNw 4KKkxVh48JQ0RwJbAzuvsNIyJqBujwbI4IgXa0dwjEs
+s9l2PmQVghLW0IBY2wWrACjNKggKgBl445/anfCiqv4
+-> ssh-ed25519 +shbwg hY/Ug6N/cSqpTkID+NGEPq5VFFZsD/6pj8R2n7YLNng
+AIe+oNND1F4HCFhkIDnyCO/QzW8UqvuCZ+C+pskOP04
+-> ssh-ed25519 70Nt2Q 03k/+/zGVGwBhrY3aDepKa/qI7taJeT5k0aMRkOl1xI
+Pjp17x4BIGlHfH03HoymYc7ngBlFhjHmg3cClxZwv5k
+--- KB6upBqymAgaEUmoZ43yY69RMRKP/0ut4N+5jnorXro
+1܇;<3B>Xθ<58>
<01>duU\$<24>,<2C>Ƌ<EFBFBD><12>E^Ri<52>D<EFBFBD><44>
<01><>BL<42>
<06>Ͱ!<21>K8<4B><38>z<EFBFBD>Y<0B>I<EFBFBD>"<0B>y2<16><><EFBFBD>E<EFBFBD>+
+<EFBFBD><EFBFBD>h<EFBFBD><EFBFBD>Y<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>tD<EFBFBD>
+6 <20>x<EFBFBD><78><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><<3C><><EFBFBD><EFBFBD>9<EFBFBD><39><EFBFBD><EFBFBD>FԖ[fb<66><62>C<EFBFBD>

secrets/caddy_porkbun_api_env.age

@@ -0,0 +1,20 @@
+age-encryption.org/v1
+-> ssh-ed25519 eYYv1Q HLv7VwiVXzh/uYmcwjMa0eZw7sJ+QDd1O2pKELLwi3s
+Gv05590x4magr/A8oi1yAwFrwEZ5VXK1jFl8ojLabng
+-> ssh-ed25519 Bp5IaA yuIBqQ+wKpMH9tOOXG8sWF8dVrElBtAAtIFv27XiZlU
++LYw0xUKS8340E0e3B9z3ijydbM/EJk4jEXqToOl4Uk
+-> ssh-ed25519 T/DpgA ZVI8HGiPa0L8ACjz3L/qCFjShimO2xlF1iEJ8D+VNUo
+jUqRKYaNLzNUAHj3U7lGEhJjHYp6Zge3pX9ogv7OTzs
+-> ssh-ed25519 qMgRFg kWK3YMixuoNaCLvfqvxkIyVt7X/Fe1RnTU+9LgxyH3I
+lv4DI+XrKOU89bdR1VEFv7BtMMKOaQCVkG1ntENDhOQ
+-> ssh-ed25519 dMZXNw +A8bV+j+yrc6PurfbawA1cXwJFoW+SK7IMZvE62TkH4
+fvawY41qd1/mj6yvYcl3j0hOEhao+rCyCVSOki8Xh2E
+-> ssh-ed25519 +shbwg kbmKDfoo+Vh5EBxENBHfrBjP1cW9YjOEhPnMSSrspQU
+2n0w1x/ZdpZBSJteCjNnleA3Am6xukaXGieBtfINYxk
+-> ssh-ed25519 70Nt2Q F17IHEPl6iZKRIwRkZbtE9ekNobZf3uF8E47gZzM5QE
+2poTmZo+Tkpsq0f5SigLajIaw3Ug+roWvkRZIJRd7vA
+-> ssh-ed25519 YAvvLw 33rh0onpSuvq5RBZIOdb9vHKqxqFBYMVZ9tRQlwB9A0
+FbALwt60o6hj4B/fPlVqBKOW9BPv04H+z2/mz+3pYK8
+--- 1OPzsgbGklGa39hKcitpdDhUAhiy3U83PSh1OKNHP9Y
+9<EFBFBD>XM<>PH<05><1D>1<><31>Y<EFBFBD>,M<>L<EFBFBD><4C><EFBFBD><EFBFBD><EFBFBD><EFBFBD>b<><62>2<EFBFBD>ɍR<C98D><03><><EFBFBD>0<EFBFBD>3<EFBFBD><33>5<EFBFBD>^h⫍
+<EFBFBD><EFBFBD><EFBFBD>rix[d<><64>M<EFBFBD><0C>6<1B>l<EFBFBD><6C>;P,<2C>nX6@N~<7E><>iȃ<69>i2<69><32><16>o<EFBFBD><6F>

secrets/danflix_env_file.age

@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 eYYv1Q ffwMqZJLmL0Liq7hbLi6VxlOWs4MGYEXwQfzlz8UIk8
+NOEzAl0dtRjKu7Fa+M2lK+hKA01nGJI7rLsp5wY23s4
+-> ssh-ed25519 Bp5IaA mAvPbcRrBFeNx5KDi3Wvg2znSKoDQRprRU87UEtGolw
+wavKPW0pceKtNEPjrpm6ME4dL83iY51NEcNXPBqiTGQ
+-> ssh-ed25519 T/DpgA AuNVM6nulH1/4XILIBaIeg5R27hi7EPZLwIj3Sd6eRs
+knPUWlIyEQTCaAWcH+BaZMscQxUu6GKDi0a51d/TeXg
+-> ssh-ed25519 qMgRFg KnjOL8+AX0gSSPaQFR/ucRTWEHRo0QeM5txuThx9J1w
+4el7Eftb87dy4GQaH4F9jA2EunXUcAKHQFWU9lM3v2E
+-> ssh-ed25519 dMZXNw XnrQPPNB1xad7t/AOgU5TXhtEeXf1AV3ZbIti+DvMmE
+x62z4ZbXCeN7HBn4MiSkBRKaoTC9hitf9Ktft0Eez1U
+-> ssh-ed25519 +shbwg uTTR1Lf7Y2EQsYTGEskjRAJlm275xI3I/2fTTW7tpBw
+QRFcEq6HKXdhsINrNc5JWi7YbjSPW6Tzg5AqVP0++4E
+-> ssh-ed25519 70Nt2Q nkKIu9WgEsb0Oi76oyrCoONYQcBcY+wtaRmYH6HrshU
+QO9qDH13wV9SRXjbEzauxreuK4Zs85MhEq5WNf2F88o
+-> ssh-ed25519 YAvvLw el91vp7yefRCnRSi9X21I0hPxiQJQG2vmHQcq3Rggi0
+MeGFtkqNuvQyelHePKBN5R3kI9HvWBJKzYeUJaw6XwU
+--- RW3q/KPRYhBZOBU7HhHRwPhV14LtOkClG1l43BvujGA
+:}*<2A><><06>Rj1<6A>t<EFBFBD><74><EFBFBD>OwЙ<77>[I{<7B>g֣Dh<44><0E><>=<3D><><EFBFBD>DRS0ߐB[<5B><><EFBFBD><13><>!%<25><0C>[<5B>R!<21><><EFBFBD><EFBFBD>=&<26>T<EFBFBD><54>'M`d<><64><EFBFBD><EFBFBD>E<EFBFBD><45><EFBFBD><7F><EFBFBD><EFBFBD>ԙ<EFBFBD>=(d<><64><EFBFBD>޳#<23><><EFBFBD>Z<EFBFBD>Q<EFBFBD>49<34>a\<5C>p<EFBFBD><70><06>+P2(<28>p<EFBFBD><70><04><>Z%<25>$<24><>ޙC<>wS<77>F<EFBFBD><46><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ư<EFBFBD>|kD<6B><44>ҡzH<7A><48>V8<56><38>Q<EFBFBD>Un<55>X1}Nj<4E>˄?<1C><0F><><EFBFBD>|

secrets/danflix_storage_box_crypt_pw.age

@@ -0,0 +1,17 @@
+age-encryption.org/v1
+-> ssh-ed25519 eYYv1Q DkvqMZR4rAohR1WJlrCf+scaLWmNnx4mrrpgcqD7gmc
+nwqDls/jnivUBmxLzYdcGnWSpKa8DsvSyK0liIQ+wEY
+-> ssh-ed25519 Bp5IaA czaim73JnR6W+IxYafvYffYH1gKeHNYG3ADk6Ca2vDk
+LaGtGNeIlTl3h0W550q96FxVI7Fck/eZ0x6S+9kEW78
+-> ssh-ed25519 T/DpgA uvJRphdkclhfMX+9LgBhgy1cftqwFuq3+5sfJiDdIic
+745R5UFsFjnqrqObeNyAAXSbEqjjb9dabvUROrV+gRk
+-> ssh-ed25519 qMgRFg wNQxgCkIj1siNkJs9LfOd3KEx0fAvulACdL750boti8
+bR8o6gcCL4HdElSbRrjrilphwGtYaAxTNV/L3nMBw/4
+-> ssh-ed25519 dMZXNw yKvxiUeyY/sXlQWbMNFoR3LUEkIVRxVq8Si5BHRQw20
+KpBldK1O/1BcZ09GouMWPtKbzWwChlATGvRlTZ/JPWk
+-> ssh-ed25519 +shbwg z6bYYoy9SkF1LSVHpPJXujhF7lH8jsB6hOg908elpmc
+et4d4F1Aid7f1TKcoEGrHOOScgBwgSwGyRAsjtxYKkk
+-> ssh-ed25519 70Nt2Q wqR+O1nWUqC2vCjSCF1/JWerZ9njpYbBrXusm0A2xzU
+cBoOmd7wIX7DhsiDKiC/xc4k1ieiJ4MB/gNShGax9d4
+--- zJ+CdN6Qu8l0+5tCDKz0ZZLwhthLZD3DmWfgL536eS4
+<EFBFBD>	@V <20><><15>]-<2D><1E>pe<03>d}r1<72><31><EFBFBD>I_9<5F><<3C>=<3D><><EFBFBD><EFBFBD>Z<EFBFBD>@<40><><EFBFBD><EFBFBD><EFBFBD><12>n<1A>3<EFBFBD>ў<><D19E>*e<><65><EFBFBD><07>}<7D>-<2D><>:B<><42><EFBFBD>KX<4B>

secrets/dungflix_bucket_account_key.age

@@ -1,20 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 eYYv1Q NfUs85CEft9jTh44fnAnN/PcdOQ2mdEByoNkyUCNrWQ
-MvA9BA3RoV2DRovXvlJzbY1E5lXdNSvkV82gtNCh6PA
--> ssh-ed25519 Bp5IaA lSrjQhwuY8ZiwVC82azl8rqN0/WasK4ZGRq9ohWDAVQ
-CPBY/Eq7MJ6Em+h6ro3HtfRqn9gn5BR3z//dA+SHjxw
--> ssh-ed25519 T/DpgA cv9z3Ihe/GydTPMSXXiNFxNFQwVYyZBDO1TVGCygoAo
-t4yCcPpM2Z7sqN55GbXUuLE0hvD7jXU1dCqOHcDT400
--> ssh-ed25519 qMgRFg jAcoxq4wyu8rYQGrt/rKUFSwp0Hz4QL4asEuJdA6nl0
-K+bqqoheMofX+iwcZYCE4Y558m/kzqUHyieaDQ8jJgw
--> ssh-ed25519 dMZXNw imeVQpYX9guxDPulzYYeHedYxZsmTngy+jgpQulRo1Y
-kpYgC6nzrhZsXkYHAl1273fwZ345towB1K84riX+Y+Q
--> ssh-ed25519 GzHGXw fgC690PsBF/lgRF9zwZqhvRkrK9Pm65tcZUWKzxookE
-haaWg3MNhKl1+CodRS+4MzwRVsKgVaox/Kf2YnmBNVY
--> ssh-ed25519 70Nt2Q 46a4VTEFv80jOpVl/54J3sJhBUS4G1XqrAoPReb3gjs
-ihr26HDZ40F6WJEqJmQgkjAUnnrz0Tc0ck26yLW0wOY
--> @c_kw-grease Au)%'xOy C/ A$Rd
-X7eu3QrQyKDn
---- pqgV/pzN+qsLtrbL2382/1056D925Ko5y5Oe3vwWmoc
-<EFBFBD><EFBFBD><EFBFBD>h<EFBFBD>3<>|<7C><><EFBFBD>wzb<7A><62>I<EFBFBD>0/<2F>:U<>.m
(/<<3C>x<EFBFBD>P<03><><19><>o<EFBFBD><19><>U0<>\
-<EFBFBD>'p;

secrets/dungflix_crypt_remote_obscured_pass.age

@@ -1,21 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 eYYv1Q IGdoQqDAFgxgWVlqEpZJvG9gE2KCKoXpMmvburw8Fhk
-66QE8kwl63xnvYj7nwmT6qR6Jj8fCfrzf/iAB7U+AU4
--> ssh-ed25519 Bp5IaA n3lgDi3bCV0t/TOjqdsNTRxnAlCs0GxoPPjpnaeIrzQ
-Ip98hCbmz4W8+NY85DWv/nHHmLANfwo0rNaI2N6N0kQ
--> ssh-ed25519 T/DpgA VGDYHrof8rh7WTZ3DOrTIVcfyKkVbLJTL8bDDSfS4C8
-3o3A3jfTL8L0dbpv9Xe3Oy93U3XkkjhRX0tqQtSZDtw
--> ssh-ed25519 qMgRFg Jchcic5fvRBviRtbdUyMl76Ea0aGW/7tRWkTt2habAg
-91DpFYKWqA4rawbzkEEkLNRay352vkuU0srVBwYFkco
--> ssh-ed25519 dMZXNw Sa+BZdY+YLrlQkX7G7VSF/k6oVAVo17zSgXbq1OiqR8
-xu894gtzqTFNDyvzwtejNw3WkMnVQLcpIaVF0CgVODI
--> ssh-ed25519 GzHGXw 2WNPWILkiCseWMN5GHpfNs9T566GV6dUxqse+YVXTSA
-W1MT/CHcZKefKb+7UK8PWwDP0cDCOU1JKpiXTk0vY10
--> ssh-ed25519 70Nt2Q QnL9dyxLSG64ncFRCoLOEWtBI1y0qRDj0a0TESW4bXY
-kHHQA72guLb7YYbU7/CTawylq1uNzcgNRwpS2z2WzeA
--> hg3-grease
-O2O1JT79k6zrpiuexN5i/1eP5cTzjOPjHS3BCvprA/JxSxUNrV+a1RFFmLb6OTad
-8cR0wG66tw6xaYQLvxWiKCzh2AqXkQ
---- tkk6rwRnFGtrrl6Z0kDoqS/NPV4hFhlKvwJ52zGuy+U
-B<><42><EFBFBD>]$So<><6F>e(kV8ca<63><61><EFBFBD>LG<4C><47>(<28>ȗF<C897><10><><EFBFBD>Y<EFBFBD>mɒ<6D>h<EFBFBD><68>1<10>ď<13>y<15><><EFBFBD><18>L<EFBFBD><1F>ѩzJ!gD<67>{
n<>U
-<EFBFBD>N0<1A>

secrets/dungflix_crypt_remote_pass.age

@@ -1,19 +0,0 @@
-age-encryption.org/v1
--> ssh-ed25519 eYYv1Q HzNRL7zq6Lrum/2tHKjacsv1Y0LlXmgOZNWLXAk2lWg
-no6sDeinVG3TPu3UVOEDauVrHqmJGzMgHB6Dr6UNrDE
--> ssh-ed25519 Bp5IaA 9UvpQHut2BFiXIkR+q1A/Ik4AYvwghddk9Fi5+rw4mM
-Zs/ggJfYh/epVFRiJEnvICceCnlZBifeGLRDI/Eosj0
--> ssh-ed25519 T/DpgA k40Cb32UbfjsApxi0ccO4u8xP12uWpTot02BSCUvP08
-LfXJLsRtNklus14Pg3TsDt9MMbRi9SrH7uvefK9Hxso
--> ssh-ed25519 qMgRFg iS9incss6tduf58gxdA8R5dqnwpXFy9PB8ZwNVWbvyc
-e4KTD8Z4fUeaLAiqKGQXi/AIkyjlYEUNraHSB+TFhiM
--> ssh-ed25519 dMZXNw DKMC+uCWkUEOF2fFL6o41UuggAzcWHwM5TwYzw+5sjQ
-zu/YdI+pzudPH7azRqwmDvf81m48EZYK9c3UcVPTaVI
--> ssh-ed25519 GzHGXw OX7ylQzBuyzErkhOpiUrBPhlGx/TrAgK5KuI6yEo4EY
-DxeylfaVBkDEWxxRz3KCr5UZsREfqXwoAnC5tAdyFL4
--> ssh-ed25519 70Nt2Q pcGNeTUV7utxnH5a4H78YOvr8cpORGkQ7p8hh569zz4
-STlbScxYbWXV3B8T+2PSiLfGkjKudkXwkRG67ZHlwtE
--> s-grease
-FHLY7TFsme9Wd43MaAzpXiolSX0
---- b2uVM8dc8IXnmG4fb/DjApdEJ3yngTDN8d7J0mbYYYw
-B<EFBFBD>љ<><13><>V<><56><EFBFBD><19><>EM<45><4D>N<EFBFBD>M<EFBFBD>=ݫ<>?]<5D><>A%
<01><><EFBFBD><EFBFBD><EFBFBD>5<05>2/<2F>Xv5`[

secrets/gitea_actions_runner_token.age

@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 eYYv1Q NT/I7M2advY0rxFGH1wf2fS6131Ey2WsO+0lbHt0RTI
+S8P3ev5JgbIAYTBLsX5HCTeaf2aGUc5FpceG6RruVec
+-> ssh-ed25519 Bp5IaA DUNGRltZxtHuQISWvpdwN7NE9oWK/jYzyNuCNY9BwlM
+q+B+BSRscrB05a2vzIOllHgwwsAw5ksjhaWyj2voqRU
+-> ssh-ed25519 T/DpgA wqIIQl4g4DnpH9hBoQGfmP8fTIYipkybPQOWP4NmKTM
+3aitfrlKD4HXik+pELBz3TiM7ktfpoKXcoiP2zbaS1M
+-> ssh-ed25519 qMgRFg 0RJ2GTE21a2FgZgKZnb4i+70lmZdzqIHBAqyy6uZK1o
+pecEVAN7+Y6dEXpY1Xz/SPWi1MVZx3rH9+YC0JUmNfo
+-> ssh-ed25519 dMZXNw eSSiM/impi/GBNv8zzOzTnRwoR68mvr6o24kai6IDUw
+VnJgTwJACdcsCgGzavaTn7bvb2VR9lvoJrEuQbx/aFs
+-> ssh-ed25519 +shbwg uZaKYv0qROENTDHPlBT+LssNVFsA+BJznONnM0ap3Xg
+6shNfpwayPdm0rmiKxmgSSQTt68fP2HxLrNC/thpvxs
+-> ssh-ed25519 70Nt2Q OHAh0XRwfpYbeGs6MtOO1qx4FtmTN3B/IfYjhXIGlAg
+hzJxbNQJZxmAeGhisVfTmzgR+P2mDDegackb5z7psFc
+-> ssh-ed25519 YAvvLw 4ZznIEadBPmHkN/i4+P2xiGrIfaLe9J8va/xuQY8slE
+k1BgyixkYxJxbKi/GxCHi15sAEjhzI/29oxrT56qtPo
+--- HHCsUeX+Y2A6NkA2c0RfShW/DylAZkbEGMiR6lpht18
+<EFBFBD>rS;<3B><>?HƊpiPF<50>Lu.2@JN<4A>,v<><76><EFBFBD>xK<><4B><EFBFBD>cʱ<63>e<EFBFBD><65>zR<7A>8d<38><64>V<EFBFBD>\<5C> <20>)<29><<08>^4<>j<EFBFBD><6A>$<24>c<EFBFBD>﷦<17><><EFBFBD>F<EFBFBD>+

secrets/rclone_password1.age

@@ -1,20 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 eYYv1Q 6I/C6kd0F8pPX1bIZ8f5ZTyddBqnLz835S/Q3o4ocVE
+-> ssh-ed25519 eYYv1Q DqaKeDDz87lxpd5vMK4bcnq/3S7V116rZ6TdWMHNMjI
-/dhM7FwPWEzyQCcUCw0CdCyt1J5oz0Ly7em7yZGxs2k
+XUe76IIiS6vZ+WuX/geMimGr6VBQvZCU0xgGV+Juhh8
--> ssh-ed25519 Bp5IaA bnm7aVEatMbr76zpxqUCyCzEqn9ArmdwkjteA+auAQc
+-> ssh-ed25519 Bp5IaA T1I5f0biigGMBg4YXGZF3WiY1X1N+3fh1zbwo/8UuHM
-pLVxYtYdBVeCp3dMp9LTTLX/CLDUyBAv23hi7Aj4pD8
+oksdQ76Ag6LpXy8cfezQPOxxvy/qZkzhmTy9sqNItqw
--> ssh-ed25519 T/DpgA mE97Fpws6KenlNQ8Hs/Csi0dY4GvB0z8LcwCmsM7PDA
+-> ssh-ed25519 T/DpgA 9qc1fni0oFqFeE3l0pCAdHyMtn+pPOnH23rn8qVbPFE
-N9Ap8u8qeeukvDM30pxwRok+pjs5i9Z/lQylOkaNTAs
+2POXvcfNW2zXzBu7QCbGEw4pqGj8aTrHIfczPWl5RpI
--> ssh-ed25519 qMgRFg G0qEsVQNj0Z7rCglx81fmUr09AGbjJpgxW9UWmjGZh4
+-> ssh-ed25519 qMgRFg q9M8wnO9MsaWpM941pwVaFF2RwKeON2cW+n8s8uRDBA
-sgLx9+u+JAP9dH0F+xptRUQWJxRzL0ACTW/fbxyJ9ZE
+R9fwzp6S4L8cFXaFi5Du+GcQickV0+SOU/b7Q8Nyrfc
--> ssh-ed25519 dMZXNw 8OuNPpD/GBa/UnxLTyTbiH02GTl+ZgL2/X9m8fR/FHg
+-> ssh-ed25519 dMZXNw Aphy90he30P6uyIJdvpiegBncnBNIoMpahg2XYrOPCU
-M+Qaldh0wGRFO4kiNyuw/ui0LsaNBqORfmbbuPFQcpA
+1BroEQo4SHy11PwVcTluq7XM7DZql+LfZX4DxWCPHBY
--> ssh-ed25519 GzHGXw jNvSCxiYW4psZhdiFk36jXQigcFijAqfhjSi0YUT6y4
+-> ssh-ed25519 +shbwg XX8o4B57nZ5teIicWs1LJysdM/irTe3wUpegSia2P2E
-SqHCmEEUseX8XjOEH/QdFi8jX/6DyNGgm6yOHf5tEJM
+Wh+vzzl2f+vO7KNIex/UY4wcEtmq7NG0z4I5OtUfiGM
--> ssh-ed25519 70Nt2Q D9lDPhjAJ6ntkg2VAys7MU3honDEAFzk+n3FPsjoARs
+-> ssh-ed25519 GzHGXw 5rV4pXv5FpnOAGUkLcmFUnUwJv2xqh6NkbNUsPOhtlE
-8F4p2DcD/JyxKZuzLMuuumY+0yAQjsAQfQhqvtbn/CY
+wMHuKNeCXcz8e3zG1RaLQA6hKo7Cg/E6h7FfLUkQKuQ
--> j6O-grease v A$M=
+-> ssh-ed25519 70Nt2Q N3MFptnU524HZBZrmzsHtATJWT/H2xegBQMr+0NS134
-l9GAg+AXTZEc44390C60kR5df+XK283KeRlPR+JAthfe7MvF/NJ4cqF5TlqZo0AU
+Ta1AszHsbQhzqqPfCePaOB8fT1OJQMzpoPCAKDM9J2E
-AHmkD0k
+--- VkzSldNpvwIE4KGzPt+CVOHsXylmJ/L3KdjMlPgVfVI
---- mUKNXFOZ36jA7vuAB+7CbAVrV6lYuUeKnOt8TJz/QR8
+<EFBFBD><EFBFBD><EFBFBD>X<EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ae<08><11><>?
0<><30><EFBFBD><EFBFBD>h<EFBFBD><15>zT<7A><54>x"<22><> <20>l<EFBFBD>P<EFBFBD><12><><02><><EFBFBD>Ӄ<EFBFBD><D383><EFBFBD>Q`<60><><EFBFBD>C<EFBFBD><43><EFBFBD>p<1D>2<EFBFBD><32>#35<33><35>
-<EFBFBD><EFBFBD>Ė:<3A>1<EFBFBD><11>&9İ<39><C4B0>-<15><>?<3F><>4.<2E><><EFBFBD><0B>!ex<><78>I<EFBFBD>%<25>j<EFBFBD>O<EFBFBD>C5e%p<>N<EFBFBD>I<18><><EFBFBD>G<EFBFBD><47><EFBFBD><10><><EFBFBD>;<3B><><EFBFBD>`6

secrets/rclone_password2.age

@@ -1,20 +1,20 @@
 age-encryption.org/v1
--> ssh-ed25519 eYYv1Q LZwJmlO0K8OZBQcBp2KiirS6dOi0MI4QL3KZJAbSlSA
+-> ssh-ed25519 eYYv1Q RIMmsWmolEIOQUGgoIQRlmjTWqDLQYInJbPVeB7f/wU
-VN9IF2McXP7T576+HMnC/H8rBQPeuiFViCXKYVTYGxM
+06vZZhfXi1zqHznmbub9/wqsE8XvTlULe181cCz1oFc
--> ssh-ed25519 Bp5IaA V9hkpjVVQlfB7jHbxHWcrDtXBAFsQdZM+wq8XB8hrHM
+-> ssh-ed25519 Bp5IaA LdaP3AOLKqGe3ala1UGFf0e7EThr9ptn4qUYzYSktz8
-40DsgVRpRxwnhTuc+KY9W5DAP2er4f4gwUS3XFSsP1Y
+c/6py1I4vJOtmoNRjm/99nlWax+J5pdMhh1GUzpIsMQ
--> ssh-ed25519 T/DpgA YyovZ4r5p2Y0b0YMB3ybtj7RGa6YJIaCQvS4N8ACy30
+-> ssh-ed25519 T/DpgA xvmg2ZQwPzUM9J6C0ggBPoRbW5R0w92unR3+W6dyo0M
-bdWFxWQcgIbNspUSwtiytErZ105fQtvTmNazsprzVpU
+lNDyhV3PBS56HDXrTECTdcHUVb2rSNA3GsirYdxjhN4
--> ssh-ed25519 qMgRFg I3+nfZVN7qNUUDpoLt7/lrlhH1dacQAoMyTeLbypD1s
+-> ssh-ed25519 qMgRFg OLu/nzVnSnB6PdI5ZO0Nfp0Ga8ekWa5sWmqXhwYQ5VQ
-SJspcVYfX6HuRH9lsAsnt8FR/n3J99Bax1dj/CC4dnA
+x2LlyRBvB0Pw2yYi43KXeHUgJQ25OQEIX65L8wmcXz4
--> ssh-ed25519 dMZXNw 8rZ8Z/3IM9mkI2K/SuHsga96jsZ50Mw1nGiR3IGQVwc
+-> ssh-ed25519 dMZXNw m3ydHsFKsxmbA3e6jcLVoZV60Y+OLmoOb4d05DQQsDU
-CDzSdHl+xQktP8p5enfaKS9zxJaTdf6YcgXbVbQMrmc
+MDOCsqlPc9rR3d0+sDbv0tPxr+hX3Kpc+E2HfZo87uo
--> ssh-ed25519 GzHGXw dP0X4HBhvAMw+6JoA0jT76jyjyykrzHwSvYub6Rskmg
+-> ssh-ed25519 +shbwg eQnubQCP4+mjipTkxIrIEZ8rboOy2A/T5MWLe4Txz0w
-2wgzuGKxv8SFz1DrMfAsHcvtprOqWEo8mporTPwhrVE
+Y6GEm6UZDegoPuUXxbK/LkrqZBY86rHt475anCnoFxg
--> ssh-ed25519 70Nt2Q 5FfUOwKURR9Zv/uXaqWDzQF7Ms0xkdINA1Rz02tZ4Cs
+-> ssh-ed25519 GzHGXw Z8Ut75VgG0ttf2LLjgfUb9TbxpW8nfSTLvx7FJoXDA0
-+MqPawyZvwCZUEcN2/5nZt/Zwf59jm8h0BFsHyWUX9k
+pjfgN5XokETssMCbolQ0nr2+4sTa1C0+oxg4IUIEgVw
--> n<90Kr$R-grease 2
+-> ssh-ed25519 70Nt2Q Vmm5Dw+N8OVT9JawsVnYoC1FIOX7bKEb54Gb1cYMFC8
-uQ51BhliS5bfdIO2YS68nlf4lS5oVSfqXFIGoVhHO0cwuh6cckL4aqNim/S3uNRf
+/FNGoN4CbLahBtxj8zaNRjE7wM/3hXVJSFsfP0AJxc8
-/J/a482wMBY2gchhnG2qyhH/UF8
+--- HOnH0WA6bQZ0y9HEjgzmOo+P3hRosz1fM5tRVrYZ09A
---- 3UkEGyyoK/ejTo6/0rB8BvzBt0P/JnqubGZUIIjF+eY
+<EFBFBD>,<2C>
-<EFBFBD>A9Q}<>[<5B><><EFBFBD><EFBFBD><EFBFBD>,Hf<>-<2D>{^<5E><>@^<5E><><EFBFBD><EFBFBD>nb@<40><><EFBFBD><EFBFBD>C<EFBFBD><43>#d<>}X1<58><31><EFBFBD><EFBFBD>n<EFBFBD>+
+<EFBFBD>9<EFBFBD><1A><03>Or4<72><34><EFBFBD><EFBFBD>ǔխ<17>H<>ě7<C49B>pkR<1E>+m<><0B>w<16>RS<02>)<29>&

secrets/secrets.nix

@@ -4,7 +4,8 @@ let
   user3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0Ps8eEFIkLe863bisGvSIVXZqedp9z5AC8RKyvZtcA me@danielpatterson.dev";
   user4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjVwYfjyZ7kd7idwfGNtS62VKAc34WIsjQvypMe0d8N dingserver";
   user5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMZKWq5v1xkK2d7D4lmwDKjdAHbWd+agXQCuMyjkzDEh daniel@dingserver";
-  users = [user1 user2 user3 user4 user5];
+  user6 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIISn5FKNwsQtesuWbxSu8k+3o5inlDphDahq8URyGxzc daniel@ranni";
+  users = [user1 user2 user3 user4 user5 user6];
 
   # dingbox
   system1 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKvWmwFd0xZcF0HcyhmemvT5Q8rHOW/fQ56IoLSVAljv root@nixos";
@@ -14,7 +15,9 @@ let
   system3 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMzy0KqakqljVqgA4lvfTt65cikgPOKFvBXF0WS0LxGP root@pingbox";
   # bigding
   system4 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINxzzoExkmb0kP+6OS2omcoa8xe1ETc+FAhU5gBuBUDR root@bigding";
-  systems = [system1 system2 system3 system4];
+  # ranni
+  system5 = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII8aTDf4ue+ug3acFaN/3oU2UddC2WKFdj/QV/78b5jB root@ranni";
+  systems = [system1 system2 system3 system4 system5];
 in {
   "rclone_password1.age".publicKeys = users ++ [system2 system4];
   "rclone_password2.age".publicKeys = users ++ [system2 system4];
@@ -24,4 +27,14 @@ in {
   "dungflix_crypt_remote_pass.age".publicKeys = users ++ [system2 system4];
   "age_identity.age".publicKeys = users ++ [system1 system3];
   "minisign_private_key.age".publicKeys = users ++ [system1 system3];
+  "bigding_backup_s3_creds.age".publicKeys = users ++ [system4];
+  "bigding_backup_repo_password.age".publicKeys = users ++ [system4];
+  "sendmail_email_key_gitea.age".publicKeys = users ++ [system4 system5];
+  "gitea_actions_runner_token.age".publicKeys = users ++ [system4 system5];
+  "danflix_hetzner_storage_box_pub_key.age".publicKeys = users ++ [system4 system5];
+  "danflix_storage_box_crypt_pw.age".publicKeys = users ++ [system4];
+  "danflix_storage_box_crypt_obscured_pw.age".publicKeys = users ++ [system4];
+  "danflix_env_file.age".publicKeys = users ++ [system4 system5];
+  "danflix_rclone_config.age".publicKeys = users ++ [system4 system5];
+  "caddy_porkbun_api_env.age".publicKeys = users ++ [system4 system5];
 }

users/configs/desktop/default.nix

@@ -0,0 +1,15 @@
+{config, ...}: {
+  imports = [
+    # ./i3
+    # ./i3status-rust
+    # ./polybar
+    ./fuzzel
+    ./niri
+    ./river
+    ./sway
+    ./tofi
+    ./waybar
+  ];
+
+  programs.zen-browser.enable = true;
+}

users/configs/desktop/fuzzel/default.nix

@@ -0,0 +1,19 @@
+{pkgs, ...}: {
+  programs.fuzzel = {
+    enable = true;
+    settings = {
+      main = {
+        include = "${./green.ini}";
+
+        font = "Iosevka Nerd Font Propo:size=16";
+
+        width = 60;
+        lines = 15;
+      };
+      border = {
+        width = 3;
+        radius = 15;
+      };
+    };
+  };
+}

users/configs/desktop/fuzzel/green.ini

@@ -0,0 +1,12 @@
+[colors]
+background=24273add
+text=cad3f5ff
+prompt=b8c0e0ff
+placeholder=8087a2ff
+input=cad3f5ff
+match=a6da95ff
+selection=5b6078ff
+selection-text=cad3f5ff
+selection-match=a6da95ff
+counter=8087a2ff
+border=a6da95ff

users/configs/desktop/i3/default.nix

@@ -64,7 +64,7 @@ in {
             fonts = {
               size = 11.0;
             };
-            statusCommand = "${pkgs.i3status-rust}/bin/i3status-rs /home/daniel/.config/i3status-rust/config-main.toml";
+            # statusCommand = "${pkgs.i3status-rust}/bin/i3status-rs /home/daniel/.config/i3status-rust/config-main.toml";
             position = "top";
           }
         ];
@@ -205,14 +205,14 @@ in {
         modifier = mod;
 
         startup = [
-          {
+          # {
-            command = "$HOME/bin/scripts/flower";
+          #   command = "$HOME/bin/scripts/flower";
-            always = true;
+          #   always = true;
-          }
+          # }
-          {
+          # {
-            command = "feh --bg-fill $HOME/wallpapers/wallpaper.jpg";
+          #   command = "feh --bg-fill $HOME/wallpapers/wallpaper.jpg";
-            always = false;
+          #   always = false;
-          }
+          # }
         ];
 
         terminal = "kitty";

users/configs/desktop/niri/config.kdl

@@ -0,0 +1,539 @@
+// This config is in the KDL format: https://kdl.dev
+// "/-" comments out the following node.
+// Check the wiki for a full description of the configuration:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Overview
+
+// Input device configuration.
+// Find the full list of options on the wiki:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Input
+input {
+    keyboard {
+        xkb {
+            // You can set rules, model, layout, variant and options.
+            // For more information, see xkeyboard-config(7).
+
+            // For example:
+            // layout "us,ru"
+            // options "grp:win_space_toggle,compose:ralt,ctrl:nocaps"
+            layout "gb"
+            options "caps:escape"
+        }
+    }
+
+    // Next sections include libinput settings.
+    // Omitting settings disables them, or leaves them at their default values.
+    touchpad {
+        // off
+        tap
+        // dwt
+        // dwtp
+        natural-scroll
+        scroll-factor 0.5
+        accel-speed 0.05
+        accel-profile "adaptive"
+        // scroll-method "two-finger"
+        // disabled-on-external-mouse
+    }
+
+    mouse {
+        // off
+        // natural-scroll
+        accel-speed 0.2
+        accel-profile "flat"
+        // scroll-method "no-scroll"
+    }
+
+    trackpoint {
+        // off
+        // natural-scroll
+        // accel-speed 0.2
+        // accel-profile "flat"
+        // scroll-method "on-button-down"
+        // scroll-button 273
+        // middle-emulation
+    }
+
+    // Uncomment this to make the mouse warp to the center of newly focused windows.
+    // warp-mouse-to-focus
+
+    // Focus windows and outputs automatically when moving the mouse into them.
+    // Setting max-scroll-amount="0%" makes it work only on windows already fully on screen.
+    focus-follows-mouse max-scroll-amount="0%"
+}
+
+// You can configure outputs by their name, which you can find
+// by running `niri msg outputs` while inside a niri instance.
+// The built-in laptop monitor is usually called "eDP-1".
+// Find more information on the wiki:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Outputs
+// Remember to uncomment the node by removing "/-"!
+output "eDP-1" {
+    // Uncomment this line to disable this output.
+    // off
+
+    // Resolution and, optionally, refresh rate of the output.
+    // The format is "<width>x<height>" or "<width>x<height>@<refresh rate>".
+    // If the refresh rate is omitted, niri will pick the highest refresh rate
+    // for the resolution.
+    // If the mode is omitted altogether or is invalid, niri will pick one automatically.
+    // Run `niri msg outputs` while inside a niri instance to list all outputs and their modes.
+    // mode "1920x1080@120.030"
+
+    // You can use integer or fractional scale, for example use 1.5 for 150% scale.
+    scale 1.33
+
+    // Transform allows to rotate the output counter-clockwise, valid values are:
+    // normal, 90, 180, 270, flipped, flipped-90, flipped-180 and flipped-270.
+    transform "normal"
+
+    // Position of the output in the global coordinate space.
+    // This affects directional monitor actions like "focus-monitor-left", and cursor movement.
+    // The cursor can only move between directly adjacent outputs.
+    // Output scale and rotation has to be taken into account for positioning:
+    // outputs are sized in logical, or scaled, pixels.
+    // For example, a 3840×2160 output with scale 2.0 will have a logical size of 1920×1080,
+    // so to put another output directly adjacent to it on the right, set its x to 1920.
+    // If the position is unset or results in an overlap, the output is instead placed
+    // automatically.
+    // position x=1280 y=0
+}
+
+output "DP-3" {
+    scale 1.33
+    position x=0 y=600
+}
+
+output "HDMI-A-1" {
+    scale 1.33
+    transform "90"
+    position x=2880 y=0
+}
+
+// Settings that influence how windows are positioned and sized.
+// Find more information on the wiki:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Layout
+layout {
+    // Set gaps around windows in logical pixels.
+    gaps 12
+
+    // When to center a column when changing focus, options are:
+    // - "never", default behavior, focusing an off-screen column will keep at the left
+    //   or right edge of the screen.
+    // - "always", the focused column will always be centered.
+    // - "on-overflow", focusing a column will center it if it doesn't fit
+    //   together with the previously focused column.
+    center-focused-column "never"
+
+    // You can customize the widths that "switch-preset-column-width" (Mod+R) toggles between.
+    preset-column-widths {
+        // Proportion sets the width as a fraction of the output width, taking gaps into account.
+        // For example, you can perfectly fit four windows sized "proportion 0.25" on an output.
+        // The default preset widths are 1/3, 1/2 and 2/3 of the output.
+        proportion 0.33333
+        proportion 0.5
+        proportion 0.66667
+
+        // Fixed sets the width in logical pixels exactly.
+        // fixed 1920
+    }
+
+    // You can also customize the heights that "switch-preset-window-height" (Mod+Shift+R) toggles between.
+    // preset-window-heights { }
+
+    // You can change the default width of the new windows.
+    default-column-width { proportion 0.5; }
+    // If you leave the brackets empty, the windows themselves will decide their initial width.
+    // default-column-width {}
+
+    // By default focus ring and border are rendered as a solid background rectangle
+    // behind windows. That is, they will show up through semitransparent windows.
+    // This is because windows using client-side decorations can have an arbitrary shape.
+    //
+    // If you don't like that, you should uncomment `prefer-no-csd` below.
+    // Niri will draw focus ring and border *around* windows that agree to omit their
+    // client-side decorations.
+    //
+    // Alternatively, you can override it with a window rule called
+    // `draw-border-with-background`.
+
+    // You can change how the focus ring looks.
+    focus-ring {
+        // Uncomment this line to disable the focus ring.
+        // off
+
+        // How many logical pixels the ring extends out from the windows.
+        width 6
+
+        // Colors can be set in a variety of ways:
+        // - CSS named colors: "red"
+        // - RGB hex: "#rgb", "#rgba", "#rrggbb", "#rrggbbaa"
+        // - CSS-like notation: "rgb(255, 127, 0)", rgba(), hsl() and a few others.
+
+        // Color of the ring on the active monitor.
+        // active-color "#7fc8ff"
+
+        // Color of the ring on inactive monitors.
+        // inactive-color "#505050"
+
+        // You can also use gradients. They take precedence over solid colors.
+        // Gradients are rendered the same as CSS linear-gradient(angle, from, to).
+        // The angle is the same as in linear-gradient, and is optional,
+        // defaulting to 180 (top-to-bottom gradient).
+        // You can use any CSS linear-gradient tool on the web to set these up.
+        // Changing the color space is also supported, check the wiki for more info.
+        //
+        active-gradient from="#f00f" to="#0f0f" angle=45 in="oklch longer hue"
+
+        // You can also color the gradient relative to the entire view
+        // of the workspace, rather than relative to just the window itself.
+        // To do that, set relative-to="workspace-view".
+        //
+        // inactive-gradient from="#505050" to="#808080" angle=45 relative-to="workspace-view"
+    }
+
+    // You can also add a border. It's similar to the focus ring, but always visible.
+    border {
+        // The settings are the same as for the focus ring.
+        // If you enable the border, you probably want to disable the focus ring.
+        off
+
+        width 4
+        active-color "#ffc87f"
+        inactive-color "#505050"
+
+        // active-gradient from="#ffbb66" to="#ffc880" angle=45 relative-to="workspace-view"
+        // inactive-gradient from="#505050" to="#808080" angle=45 relative-to="workspace-view"
+    }
+
+    // Struts shrink the area occupied by windows, similarly to layer-shell panels.
+    // You can think of them as a kind of outer gaps. They are set in logical pixels.
+    // Left and right struts will cause the next window to the side to always be visible.
+    // Top and bottom struts will simply add outer gaps in addition to the area occupied by
+    // layer-shell panels and regular gaps.
+    struts {
+        // left 64
+        // right 64
+        // top 64
+        // bottom 64
+    }
+}
+
+// Add lines like this to spawn processes at startup.
+// Note that running niri as a session supports xdg-desktop-autostart,
+// which may be more convenient to use.
+// See the binds section below for more spawn examples.
+// spawn-at-startup "alacritty" "-e" "fish"
+spawn-at-startup "dbus-update-activation-environment" "--systemd" "DISPLAY" "WAYLAND_DISPLAY" "XDG_CURRENT_DESKTOP"
+spawn-at-startup "systemctl" "--user" "import-environment" "PATH" "DISPLAY" "WAYLAND_DISPLAY"
+
+spawn-at-startup "waybar"
+spawn-at-startup "xwayland-satellite"
+
+environment {
+    DISPLAY ":0"
+}
+
+// Uncomment this line to ask the clients to omit their client-side decorations if possible.
+// If the client will specifically ask for CSD, the request will be honored.
+// Additionally, clients will be informed that they are tiled, removing some client-side rounded corners.
+// This option will also fix border/focus ring drawing behind some semitransparent windows.
+// After enabling or disabling this, you need to restart the apps for this to take effect.
+// prefer-no-csd
+
+// You can change the path where screenshots are saved.
+// A ~ at the front will be expanded to the home directory.
+// The path is formatted with strftime(3) to give you the screenshot date and time.
+screenshot-path "~/Pictures/Screenshots/Screenshot from %Y-%m-%d %H-%M-%S.png"
+
+// You can also set this to null to disable saving screenshots to disk.
+// screenshot-path null
+
+// Animation settings.
+// The wiki explains how to configure individual animations:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Animations
+animations {
+    // Uncomment to turn off all animations.
+    // off
+
+    // Slow down all animations by this factor. Values below 1 speed them up instead.
+    // slowdown 3.0
+}
+
+// Window rules let you adjust behavior for individual windows.
+// Find more information on the wiki:
+// https://github.com/YaLTeR/niri/wiki/Configuration:-Window-Rules
+
+// Work around WezTerm's initial configure bug
+// by setting an empty default-column-width.
+window-rule {
+    // This regular expression is intentionally made as specific as possible,
+    // since this is the default config, and we want no false positives.
+    // You can get away with just app-id="wezterm" if you want.
+    match app-id=r#"^org\.wezfurlong\.wezterm$"#
+    default-column-width {}
+}
+
+// Open the Firefox picture-in-picture player as floating by default.
+window-rule {
+    // This app-id regular expression will work for both:
+    // - host Firefox (app-id is "firefox")
+    // - Flatpak Firefox (app-id is "org.mozilla.firefox")
+    match app-id=r#"firefox$"# title="^Picture-in-Picture$"
+    open-floating true
+}
+
+// Example: block out two password managers from screen capture.
+// (This example rule is commented out with a "/-" in front.)
+/-window-rule {
+    match app-id=r#"^org\.keepassxc\.KeePassXC$"#
+    match app-id=r#"^org\.gnome\.World\.Secrets$"#
+
+    block-out-from "screen-capture"
+
+    // Use this instead if you want them visible on third-party screenshot tools.
+    // block-out-from "screencast"
+}
+
+// Example: enable rounded corners for all windows.
+// (This example rule is commented out with a "/-" in front.)
+window-rule {
+    geometry-corner-radius 12
+    clip-to-geometry true
+}
+
+binds {
+    // Keys consist of modifiers separated by + signs, followed by an XKB key name
+    // in the end. To find an XKB name for a particular key, you may use a program
+    // like wev.
+    //
+    // "Mod" is a special modifier equal to Super when running on a TTY, and to Alt
+    // when running as a winit window.
+    //
+    // Most actions that you can bind here can also be invoked programmatically with
+    // `niri msg action do-something`.
+
+    // Mod-Shift-/, which is usually the same as Mod-?,
+    // shows a list of important hotkeys.
+    Mod+Shift+Slash { show-hotkey-overlay; }
+
+    // Suggested binds for running programs: terminal, app launcher, screen locker.
+    Mod+T { spawn "ghostty"; }
+    // Mod+D { spawn "tofi-drun" "--drun-launch=true"; }
+    Mod+D { spawn "fuzzel"; }
+    Mod+Escape { spawn "swaylock" "-i" "~/wallpapers/lock.png"; }
+
+    // You can also use a shell. Do this if you need pipes, multiple commands, etc.
+    // Note: the entire command goes as a single argument in the end.
+    // Mod+T { spawn "bash" "-c" "notify-send hello && exec alacritty"; }
+
+    // Example volume keys mappings for PipeWire & WirePlumber.
+    // The allow-when-locked=true property makes them work even when the session is locked.
+    XF86AudioRaiseVolume allow-when-locked=true { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "5%+"; }
+    XF86AudioLowerVolume allow-when-locked=true { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "5%-"; }
+    XF86AudioMute        allow-when-locked=true { spawn "wpctl" "set-mute" "@DEFAULT_AUDIO_SINK@" "toggle"; }
+    XF86AudioMicMute     allow-when-locked=true { spawn "wpctl" "set-mute" "@DEFAULT_AUDIO_SOURCE@" "toggle"; }
+    XF86AudioPrev        allow-when-locked=true { spawn "playerctl" "previous"; }
+    XF86AudioPlay        allow-when-locked=true { spawn "playerctl" "play-pause"; }
+    XF86AudioNext        allow-when-locked=true { spawn "playerctl" "next"; }
+
+    XF86MonBrightnessUp   allow-when-locked=true { spawn "xbacklight" "-inc" "10"; }
+    XF86MonBrightnessDown allow-when-locked=true { spawn "xbacklight" "-dec" "10"; }
+
+    Mod+Q { close-window; }
+
+    Mod+Left  { focus-column-left; }
+    Mod+Down  { focus-window-down; }
+    Mod+Up    { focus-window-up; }
+    Mod+Right { focus-column-right; }
+    Mod+H     { focus-column-left; }
+    Mod+J     { focus-window-down; }
+    Mod+K     { focus-window-up; }
+    Mod+L     { focus-column-right; }
+
+    Mod+Ctrl+Left  { move-column-left; }
+    Mod+Ctrl+Down  { move-window-down; }
+    Mod+Ctrl+Up    { move-window-up; }
+    Mod+Ctrl+Right { move-column-right; }
+    Mod+Ctrl+H     { move-column-left; }
+    Mod+Ctrl+J     { move-window-down; }
+    Mod+Ctrl+K     { move-window-up; }
+    Mod+Ctrl+L     { move-column-right; }
+
+    // Alternative commands that move across workspaces when reaching
+    // the first or last window in a column.
+    // Mod+J     { focus-window-or-workspace-down; }
+    // Mod+K     { focus-window-or-workspace-up; }
+    // Mod+Ctrl+J     { move-window-down-or-to-workspace-down; }
+    // Mod+Ctrl+K     { move-window-up-or-to-workspace-up; }
+
+    Mod+Home { focus-column-first; }
+    Mod+End  { focus-column-last; }
+    Mod+Ctrl+Home { move-column-to-first; }
+    Mod+Ctrl+End  { move-column-to-last; }
+
+    Mod+Shift+Left  { focus-monitor-left; }
+    Mod+Shift+Down  { focus-monitor-down; }
+    Mod+Shift+Up    { focus-monitor-up; }
+    Mod+Shift+Right { focus-monitor-right; }
+    Mod+Shift+H     { focus-monitor-left; }
+    Mod+Shift+J     { focus-monitor-down; }
+    Mod+Shift+K     { focus-monitor-up; }
+    Mod+Shift+L     { focus-monitor-right; }
+
+    Mod+Shift+Ctrl+Left  { move-column-to-monitor-left; }
+    Mod+Shift+Ctrl+Down  { move-column-to-monitor-down; }
+    Mod+Shift+Ctrl+Up    { move-column-to-monitor-up; }
+    Mod+Shift+Ctrl+Right { move-column-to-monitor-right; }
+    Mod+Shift+Ctrl+H     { move-column-to-monitor-left; }
+    Mod+Shift+Ctrl+J     { move-column-to-monitor-down; }
+    Mod+Shift+Ctrl+K     { move-column-to-monitor-up; }
+    Mod+Shift+Ctrl+L     { move-column-to-monitor-right; }
+
+    // Alternatively, there are commands to move just a single window:
+    // Mod+Shift+Ctrl+Left  { move-window-to-monitor-left; }
+    // ...
+
+    // And you can also move a whole workspace to another monitor:
+    // Mod+Shift+Ctrl+Left  { move-workspace-to-monitor-left; }
+    // ...
+
+    Mod+Page_Down      { focus-workspace-down; }
+    Mod+Page_Up        { focus-workspace-up; }
+    Mod+U              { focus-workspace-down; }
+    Mod+I              { focus-workspace-up; }
+    Mod+Ctrl+Page_Down { move-column-to-workspace-down; }
+    Mod+Ctrl+Page_Up   { move-column-to-workspace-up; }
+    Mod+Ctrl+U         { move-column-to-workspace-down; }
+    Mod+Ctrl+I         { move-column-to-workspace-up; }
+
+    // Alternatively, there are commands to move just a single window:
+    // Mod+Ctrl+Page_Down { move-window-to-workspace-down; }
+    // ...
+
+    Mod+Shift+Page_Down { move-workspace-down; }
+    Mod+Shift+Page_Up   { move-workspace-up; }
+    Mod+Shift+U         { move-workspace-down; }
+    Mod+Shift+I         { move-workspace-up; }
+
+    // You can bind mouse wheel scroll ticks using the following syntax.
+    // These binds will change direction based on the natural-scroll setting.
+    //
+    // To avoid scrolling through workspaces really fast, you can use
+    // the cooldown-ms property. The bind will be rate-limited to this value.
+    // You can set a cooldown on any bind, but it's most useful for the wheel.
+    Mod+WheelScrollDown      cooldown-ms=150 { focus-workspace-down; }
+    Mod+WheelScrollUp        cooldown-ms=150 { focus-workspace-up; }
+    Mod+Ctrl+WheelScrollDown cooldown-ms=150 { move-column-to-workspace-down; }
+    Mod+Ctrl+WheelScrollUp   cooldown-ms=150 { move-column-to-workspace-up; }
+
+    Mod+WheelScrollRight      { focus-column-right; }
+    Mod+WheelScrollLeft       { focus-column-left; }
+    Mod+Ctrl+WheelScrollRight { move-column-right; }
+    Mod+Ctrl+WheelScrollLeft  { move-column-left; }
+
+    // Usually scrolling up and down with Shift in applications results in
+    // horizontal scrolling; these binds replicate that.
+    Mod+Shift+WheelScrollDown      { focus-column-right; }
+    Mod+Shift+WheelScrollUp        { focus-column-left; }
+    Mod+Ctrl+Shift+WheelScrollDown { move-column-right; }
+    Mod+Ctrl+Shift+WheelScrollUp   { move-column-left; }
+
+    // Similarly, you can bind touchpad scroll "ticks".
+    // Touchpad scrolling is continuous, so for these binds it is split into
+    // discrete intervals.
+    // These binds are also affected by touchpad's natural-scroll, so these
+    // example binds are "inverted", since we have natural-scroll enabled for
+    // touchpads by default.
+    // Mod+TouchpadScrollDown { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.02+"; }
+    // Mod+TouchpadScrollUp   { spawn "wpctl" "set-volume" "@DEFAULT_AUDIO_SINK@" "0.02-"; }
+
+    // You can refer to workspaces by index. However, keep in mind that
+    // niri is a dynamic workspace system, so these commands are kind of
+    // "best effort". Trying to refer to a workspace index bigger than
+    // the current workspace count will instead refer to the bottommost
+    // (empty) workspace.
+    //
+    // For example, with 2 workspaces + 1 empty, indices 3, 4, 5 and so on
+    // will all refer to the 3rd workspace.
+    Mod+1 { focus-workspace 1; }
+    Mod+2 { focus-workspace 2; }
+    Mod+3 { focus-workspace 3; }
+    Mod+4 { focus-workspace 4; }
+    Mod+5 { focus-workspace 5; }
+    Mod+6 { focus-workspace 6; }
+    Mod+7 { focus-workspace 7; }
+    Mod+8 { focus-workspace 8; }
+    Mod+9 { focus-workspace 9; }
+    Mod+Ctrl+1 { move-column-to-workspace 1; }
+    Mod+Ctrl+2 { move-column-to-workspace 2; }
+    Mod+Ctrl+3 { move-column-to-workspace 3; }
+    Mod+Ctrl+4 { move-column-to-workspace 4; }
+    Mod+Ctrl+5 { move-column-to-workspace 5; }
+    Mod+Ctrl+6 { move-column-to-workspace 6; }
+    Mod+Ctrl+7 { move-column-to-workspace 7; }
+    Mod+Ctrl+8 { move-column-to-workspace 8; }
+    Mod+Ctrl+9 { move-column-to-workspace 9; }
+
+    // Alternatively, there are commands to move just a single window:
+    // Mod+Ctrl+1 { move-window-to-workspace 1; }
+
+    // Switches focus between the current and the previous workspace.
+    // Mod+Tab { focus-workspace-previous; }
+
+    // The following binds move the focused window in and out of a column.
+    // If the window is alone, they will consume it into the nearby column to the side.
+    // If the window is already in a column, they will expel it out.
+    Mod+BracketLeft  { consume-or-expel-window-left; }
+    Mod+BracketRight { consume-or-expel-window-right; }
+
+    // Consume one window from the right to the bottom of the focused column.
+    Mod+Comma  { consume-window-into-column; }
+    // Expel the bottom window from the focused column to the right.
+    Mod+Period { expel-window-from-column; }
+
+    Mod+R { switch-preset-column-width; }
+    Mod+Shift+R { switch-preset-window-height; }
+    Mod+Ctrl+R { reset-window-height; }
+    Mod+F { maximize-column; }
+    Mod+Shift+F { fullscreen-window; }
+    Mod+C { center-column; }
+
+    // Finer width adjustments.
+    // This command can also:
+    // * set width in pixels: "1000"
+    // * adjust width in pixels: "-5" or "+5"
+    // * set width as a percentage of screen width: "25%"
+    // * adjust width as a percentage of screen width: "-10%" or "+10%"
+    // Pixel sizes use logical, or scaled, pixels. I.e. on an output with scale 2.0,
+    // set-column-width "100" will make the column occupy 200 physical screen pixels.
+    Mod+Minus { set-column-width "-10%"; }
+    Mod+Equal { set-column-width "+10%"; }
+
+    // Finer height adjustments when in column with other windows.
+    Mod+Shift+Minus { set-window-height "-10%"; }
+    Mod+Shift+Equal { set-window-height "+10%"; }
+
+    // Move the focused window between the floating and the tiling layout.
+    Mod+V       { toggle-window-floating; }
+    Mod+Shift+V { switch-focus-between-floating-and-tiling; }
+
+    // Actions to switch layouts.
+    // Note: if you uncomment these, make sure you do NOT have
+    // a matching layout switch hotkey configured in xkb options above.
+    // Having both at once on the same hotkey will break the switching,
+    // since it will switch twice upon pressing the hotkey (once by xkb, once by niri).
+    // Mod+Space       { switch-layout "next"; }
+    // Mod+Shift+Space { switch-layout "prev"; }
+
+    Print { screenshot; }
+    Ctrl+Print { screenshot-screen; }
+    Alt+Print { screenshot-window; }
+
+    // The quit action will show a confirmation dialog to avoid accidental exits.
+    Mod+Shift+E { quit; }
+    Ctrl+Alt+Delete { quit; }
+
+    // Powers off the monitors. To turn them back on, do any input like
+    // moving the mouse or pressing any other key.
+    Mod+Shift+P { power-off-monitors; }
+}

users/configs/desktop/niri/default.nix

@@ -0,0 +1,5 @@
+{...}: {
+  home.file = {
+    ".config/niri/config.kdl".source = ./config.kdl;
+  };
+}

users/configs/desktop/river/default.nix

@@ -0,0 +1,79 @@
+{
+  config,
+  lib,
+  pkgs,
+  hostname,
+  ...
+}: {
+  home.packages = with pkgs; [
+    wlr-randr
+  ];
+  wayland.windowManager.river = {
+    enable = false;
+    package = pkgs.river.overrideAttrs (finalAttrs: previousAttrs: {
+      version = "2024-11-04";
+
+      src = pkgs.fetchFromGitea {
+        domain = "codeberg.org";
+        owner = "river";
+        repo = "river";
+        rev = "14e941bae16b1ca478c32198c131c4297157f888";
+        hash = "sha256-uACc9Cb1tSw3I0fMlEMX74NfU+Tg3It74tb+nc51AZ4=";
+        fetchSubmodules = true;
+      };
+
+      buildInputs =
+        (pkgs.lib.lists.remove pkgs.wlroots_0_16 previousAttrs.buildInputs)
+        ++ [
+          pkgs.wlroots
+          pkgs.makeWrapper
+        ];
+
+      postInstall =
+        previousAttrs.postInstall
+        + ''
+          wrapProgram "$out/bin/river" --set WLR_NO_HARDWARE_CURSORS 1 --set WLR_RENDERER vulkan
+        '';
+    });
+
+    extraConfig =
+      (builtins.readFile ./${hostname})
+      + ''
+        riverctl map normal $MAINMOD D spawn 'tofi-drun --drun-launch=true'
+        riverctl map normal $MAINMOD Return spawn 'kitty'
+        riverctl map normal $MAINMOD+Shift p exit
+        riverctl map normal $MAINMOD q close
+        riverctl map normal $MAINMOD escape spawn 'swaylock -i ~/wallpapers/lock.png'
+
+        riverctl map normal $MAINMOD l focus-view next
+        riverctl map normal $MAINMOD h focus-view previous
+
+        riverctl map normal $MAINMOD m swap next
+        riverctl map normal $MAINMOD COMMA swap previous
+
+        riverctl map -repeat normal None XF86AudioLowerVolume spawn 'wpctl set-volume -l 1.0 @DEFAULT_AUDIO_SINK@ 5%-'
+        riverctl map -repeat normal None XF86AudioRaiseVolume spawn 'wpctl set-volume -l 1.0 @DEFAULT_AUDIO_SINK@ 5%+'
+        riverctl map normal None XF86AudioMute spawn 'wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle'
+
+        riverctl map -repeat normal None XF86MonBrightnessUp spawn 'xbacklight -inc 10'
+        riverctl map -repeat normal None XF86MonBrightnessDown spawn 'xbacklight -dec 10'
+
+        riverctl spawn rivertile
+        riverctl default-layout rivertile
+
+        riverctl input 'pointer-2362-628-PIXA3854:00_093A:0274_Touchpad' accel-profile flat
+        riverctl input 'pointer-2362-628-PIXA3854:00_093A:0274_Touchpad' natural-scroll enabled
+        riverctl input 'pointer-2362-628-PIXA3854:00_093A:0274_Touchpad' tap enabled
+
+        riverctl keyboard-layout -options caps:escape gb
+
+        for i in $(seq 1 9); do
+          tags=$((1 << ($i - 1)))
+
+          riverctl map normal $MAINMOD $i set-focused-tags $tags
+
+          riverctl map normal $MAINMOD+Shift $i toggle-view-tags $tags
+        done
+      '';
+  };
+}

users/configs/desktop/river/pingbox

@@ -0,0 +1,3 @@
+MAINMOD="Super"
+
+wlr-randr --output eDP-1 --scale 1.33

users/configs/desktop/river/sidon

@@ -0,0 +1,3 @@
+MAINMOD="Control+Alt+Shift"
+
+wlr-randr --output DP-2 --pos 0,0 --output HDMI-A-2 --pos 3840,0

users/configs/desktop/sway/default.nix

@@ -0,0 +1,194 @@
+{
+  config,
+  lib,
+  pkgs,
+  hostname,
+  ...
+}: let
+  mod = "Mod4";
+  hyper = "Control+Shift+Mod1";
+in {
+  home = {
+    file = {
+      "bin/swayutils" = {
+        source = ../../../../scripts/swayutils;
+        executable = true;
+      };
+    };
+  };
+
+  services.swaync = {
+    enable = true;
+  };
+
+  wayland.windowManager.sway = {
+    enable = true;
+    extraConfigEarly = ''
+      exec systemctl --user import-environment PATH
+    '';
+    config = {
+      startup = [
+        {command = "swaybg -i ~/wallpapers/wallpaper.jpg";}
+      ];
+      bars = [
+        {
+          command = "waybar";
+        }
+      ];
+      input = {
+        "*" = {
+          xkb_layout = "gb";
+          xkb_options = "caps:escape";
+          tap = "enabled";
+          natural_scroll =
+            if hostname == "sidon"
+            then "disabled"
+            else "enabled";
+        };
+        "type:pointer" = {
+          accel_profile = "flat";
+          natural_scroll = "disabled";
+          pointer_accel = "0.1";
+        };
+        "type:touchpad" = {
+          scroll_factor = "0.5";
+          natural_scroll = "enabled";
+        };
+      };
+      output =
+        if hostname == "sidon"
+        then {
+          DP-3 = {
+            position = "0 600";
+            scale = "1.33";
+          };
+          HDMI-A-1 = {
+            position = "2880 0";
+            scale = "1.33";
+            transform = "270";
+          };
+        }
+        else {
+          eDP-1 = {
+            scale = "1.33";
+          };
+          DP-3 = {
+            position = "0 0";
+            scale = "1.33";
+          };
+          DP-4 = {
+            position = "2880 0";
+            scale = "1.33";
+          };
+          HDMI-A-1 = {
+            position = "2880 0";
+            scale = "1.33";
+          };
+        };
+      workspaceOutputAssign = [
+        {
+          output = "HDMI-A-1";
+          workspace = "1";
+        }
+        {
+          output = "DP-3";
+          workspace = "2";
+        }
+      ];
+      modifier = mod;
+      keybindings = {
+        "${mod}+Return" = "exec ghostty";
+        "${mod}+q" = "kill";
+        "${mod}+d" = "exec tofi-drun --drun-launch=true";
+        "${hyper}+Return" = "exec ghostty";
+        "${hyper}+q" = "kill";
+        "${hyper}+d" = "exec tofi-drun --drun-launch=true";
+        "${mod}+Delete" = "exit";
+
+        "${mod}+Shift+s" = "exec grim -g \"$(slurp)\"";
+
+        "${mod}+Shift+Space" = "floating toggle";
+        "${hyper}+Shift+Space" = "floating toggle";
+        "${mod}+Space" = "focus mode_toggle";
+        # "${hyper}+Space" = "focus mode_toggle";
+
+        "${mod}+h" = "focus left";
+        "${mod}+j" = "focus down";
+        "${mod}+k" = "focus up";
+        "${mod}+l" = "focus right";
+
+        "${hyper}+h" = "focus left";
+        "${hyper}+j" = "focus down";
+        "${hyper}+k" = "focus up";
+        "${hyper}+l" = "focus right";
+
+        "${mod}+Left" = "movewindow left";
+        "${mod}+Up" = "movewindow up";
+        "${mod}+Down" = "movewindow down";
+        "${mod}+Right" = "movewindow right";
+
+        "${hyper}+Left" = "movewindow left";
+        "${hyper}+Up" = "movewindow up";
+        "${hyper}+Down" = "movewindow down";
+        "${hyper}+Right" = "movewindow right";
+
+        "${mod}+Shift+h" = "exec ${config.home.homeDirectory}/bin/swayutils move prev";
+        "${mod}+Shift+l" = "exec ${config.home.homeDirectory}/bin/swayutils move next";
+
+        "${mod}+Control+h" = "exec ${config.home.homeDirectory}/bin/swayutils focus prev";
+        "${mod}+Control+l" = "exec ${config.home.homeDirectory}/bin/swayutils focus next";
+
+        "${hyper}+u" = "exec ${config.home.homeDirectory}/bin/swayutils move prev";
+        "${hyper}+i" = "exec ${config.home.homeDirectory}/bin/swayutils move next";
+
+        "${hyper}+m" = "exec ${config.home.homeDirectory}/bin/swayutils focus prev";
+        "${hyper}+Comma" = "exec ${config.home.homeDirectory}/bin/swayutils focus next";
+
+        "${hyper}+y" = "move left";
+        "${hyper}+o" = "move right";
+
+        "${mod}+Tab" = "workspace back_and_forth";
+        "${hyper}+Tab" = "workspace back_and_forth";
+
+        "${mod}+b" = "split h";
+        "${mod}+v" = "split v";
+
+        "${hyper}+b" = "split h";
+        "${hyper}+v" = "split v";
+
+        "${mod}+p" = "scratchpad show, resize set 80 ppt 80ppt, move position center";
+        "${hyper}+p" = "scratchpad show, resize set 80 ppt 80ppt, move position center";
+
+        "${mod}+Escape" = "exec swaylock -i ~/wallpapers/lock.png";
+        "${hyper}+Escape" = "exec swaylock -i ~/wallpapers/lock.png";
+
+        "${hyper}+f" = "fullscreen toggle";
+
+        "XF86AudioLowerVolume" = "exec wpctl set-volume -l 1.0 @DEFAULT_AUDIO_SINK@ 5%-";
+        "XF86AudioMute" = "exec wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
+        "XF86AudioRaiseVolume" = "exec wpctl set-volume -l 1.0 @DEFAULT_AUDIO_SINK@ 5%+";
+
+        "XF86MonBrightnessUp" = "exec xbacklight -inc 10";
+        "XF86MonBrightnessDown" = "exec xbacklight -dec 10";
+        "XF86AudioPrev" = "exec playerctl previous";
+        "XF86AudioPlay" = "exec playerctl play-pause";
+        "XF86AudioNext" = "exec playerctl next";
+
+        "${mod}+Shift+0" = "move container to workspace 0";
+        "${mod}+Shift+1" = "move container to workspace 1";
+        "${mod}+Shift+2" = "move container to workspace 2";
+        "${mod}+Shift+3" = "move container to workspace 3";
+        "${mod}+Shift+4" = "move container to workspace 4";
+        "${mod}+Shift+5" = "move container to workspace 5";
+        "${mod}+Shift+6" = "move container to workspace 6";
+        "${mod}+Shift+7" = "move container to workspace 7";
+        "${mod}+Shift+8" = "move container to workspace 8";
+        "${mod}+Shift+9" = "move container to workspace 9";
+      };
+    };
+    extraConfig = ''
+      bindgesture swipe:3:right exec ${config.home.homeDirectory}/bin/swayutils focus prev
+      bindgesture swipe:3:left exec ${config.home.homeDirectory}/bin/swayutils focus next
+    '';
+  };
+}

users/configs/desktop/tofi/default.nix

@@ -0,0 +1,24 @@
+{pkgs, ...}: {
+  home.packages = with pkgs; [
+    tofi
+  ];
+
+  home.file.".config/tofi/config".text = ''
+    font = ${pkgs.iosevka}/share/fonts/truetype/iosevka-regular.ttf
+    font-size = 16
+    hint-font = false
+
+    text-color = #cad3f5
+    background-color = #24273a
+
+    selection-color = #24273a
+    selection-background = #a6da95
+
+    outline-width = 0
+    border-width = 3
+    border-color = #a6da95
+
+    corner-radius = 15
+
+  '';
+}

users/configs/desktop/waybar/config.json

@@ -0,0 +1,92 @@
+{
+	"layer": "top",
+	"modules-left": [
+		"niri/workspaces",
+		"sway/workspaces",
+		"sway/window"
+	],
+	"modules-center": [
+		"clock"
+	],
+	"modules-right": [
+		"backlight",
+		"pulseaudio/slider",
+		"pulseaudio",
+		"network",
+		"battery",
+		"tray"
+	],
+	"wlr/taskbar": {
+		"format": "{icon} {title}"
+	},
+	"network": {
+		"tooltip-format": "{ipaddr}",
+		"format-wifi": "{icon} {essid}",
+		"format-ethernet": "󰈀 {ifname}",
+		"format-icons": [
+			"󰤯",
+			"󰤟",
+			"󰤢",
+			"󰤥",
+			"󰤨"
+		]
+	},
+	"battery": {
+		"format": "{icon} {capacity}%",
+		"format-charging": " {capacity}%",
+		"format-icons": [
+			"",
+			"",
+			"",
+			"",
+			""
+		]
+	},
+	"backlight": {
+		"format": "{percent}% {icon}",
+		"format-icons": [
+			"󰹐",
+			"󱩎",
+			"󱩏",
+			"󱩐",
+			"󱩑",
+			"󱩒",
+			"󱩓",
+			"󱩔",
+			"󱩕",
+			"󱩖",
+			"󰛨"
+		]
+	},
+	"sway/workspaces": {
+		"format": "{icon}",
+		"format-icons": {
+			"urgent": "",
+			"active": "",
+			"default": ""
+		},
+		"disable-scroll-wraparound": true,
+		"disable-markup": false,
+		"persistent-workspaces": {
+			"DP-2": ["sidebar"],
+			"HDMI-A-2": [2,3,4,5,6]
+		}
+	},
+	"clock": {
+		"interval": 1,
+		"format-alt": "{:%a, %d. %b  %H:%M:%S}"
+	},
+	"pulseaudio": {
+		"format": "{icon} {volume}%",
+		"format-muted": "󰖁 MUTED",
+		"format-icons": {
+			"default": [
+				"󰕿",
+				"󰖀",
+				"󰕾"
+			]
+		},
+		"max-volume": 100,
+		"on-click": "pavucontrol"
+	}
+}

users/configs/desktop/waybar/default.nix

@@ -10,5 +10,8 @@
     settings = {
       main = lib.importJSON ./config.json;
     };
+    style = ./style.css;
   };
+
+  home.file.".config/waybar/macchiato.css".source = ./macchiato.css;
 }

users/configs/desktop/waybar/macchiato.css

@@ -0,0 +1,37 @@
+/*
+*
+* Catppuccin Mocha palette
+* Maintainer: rubyowo
+*
+*/
+
+@define-color base   #24273a;
+@define-color mantle #1e2030;
+@define-color crust  #181926;
+
+@define-color text     #cad3f5;
+@define-color subtext0 #a5adcb;
+@define-color subtext1 #b8c0e0;
+
+@define-color surface0 #363a4f;
+@define-color surface1 #494d64;
+@define-color surface2 #5b6078;
+
+@define-color overlay0 #6e738d;
+@define-color overlay1 #8087a2;
+@define-color overlay2 #939ab7;
+
+@define-color blue      #8aadf4;
+@define-color lavender  #b7bdf8;
+@define-color sapphire  #7dc4e4;
+@define-color sky       #91d7e3;
+@define-color teal      #8bd5ca;
+@define-color green     #a6da95;
+@define-color yellow    #eed49f;
+@define-color peach     #f5a97f;
+@define-color maroon    #ee99a0;
+@define-color red       #ed8796;
+@define-color mauve     #c6a0f6;
+@define-color pink      #f5bde6;
+@define-color flamingo  #f0c6c6;
+@define-color rosewater #f4dbd6;

users/configs/desktop/waybar/style.css

@@ -0,0 +1,77 @@
+@import "macchiato.css";
+
+* {
+  border: none;
+  border-radius: 0;
+  min-height: 10px;
+  font-family: "Iosevka Nerd Font Propo", "Font Awesome";
+  font-size: 16px;
+  min-height: 0;
+}
+
+window#waybar {
+  margin-top: 5px;
+  background: @base;
+  color: @text;
+}
+
+#window {
+  margin-left: 20px;
+}
+
+#workspaces button {
+  padding: 0 5px;
+  color: @text;
+  border-bottom: 2px solid @base;
+}
+
+#workspaces button label {
+  font-size: 10px;
+}
+
+#workspaces button:hover {
+  box-shadow: inherit;
+  text-shadow: inherit;
+
+  background: @surface0;
+  border-color: @surface1;
+}
+
+#workspaces button.focused {
+  color: @green;
+  background: @surface1;
+  border-color: currentcolor;
+}
+
+#battery.charging {
+  color: @base;
+  background: @green;
+}
+
+#battery.discharging {
+  color: @base;
+  background: @yellow;
+}
+
+#tray, #battery, #backlight, #pulseaudio, #network {
+  padding: 0 5px;
+}
+
+#network.ethernet, #network.wifi {
+  color: @base;
+  background: @blue;
+}
+
+#network.disabled, #network.disconnected {
+  color: @base;
+  background: @red;
+}
+
+#pulseaudio {
+  color: @base;
+  background: @green;
+}
+
+#pulseaudio.muted {
+  background: @red;
+}

users/configs/system/default.nix

@@ -0,0 +1,10 @@
+{
+  imports = [
+    ./ghostty
+    ./helix
+    ./kitty
+    ./nb
+    ./nvim
+    ./wezterm
+  ];
+}

users/configs/system/ghostty/default.nix

@@ -0,0 +1,47 @@
+{
+  pkgs,
+  lib,
+  hostname,
+  ...
+}: {
+  programs.ghostty = {
+    enable = true;
+    settings = {
+      font-family = "Iosevka Nerd Font";
+      font-size = 12;
+
+      theme = "Catppuccin Macchiato";
+
+      cursor-style = "block";
+
+      shell-integration-features = "no-cursor";
+      window-theme = "ghostty";
+      window-decoration = if hostname == "pingbox" then "none" else "auto";
+      working-directory = "home";
+
+      unfocused-split-opacity = 1;
+
+      keybind = [
+        "ctrl+shift+enter>ctrl+shift+h=new_split:left"
+        "ctrl+shift+enter>ctrl+shift+l=new_split:right"
+        "ctrl+shift+enter>ctrl+shift+k=new_split:up"
+        "ctrl+shift+enter>ctrl+shift+j=new_split:down"
+        "ctrl+shift+enter>h=new_split:left"
+        "ctrl+shift+enter>l=new_split:right"
+        "ctrl+shift+enter>k=new_split:up"
+        "ctrl+shift+enter>j=new_split:down"
+
+        "ctrl+shift+f=toggle_split_zoom"
+        "alt+enter=toggle_split_zoom"
+        "ctrl+shift+h=goto_split:left"
+        "ctrl+shift+l=goto_split:right"
+        "ctrl+shift+k=goto_split:top"
+        "ctrl+shift+j=goto_split:bottom"
+
+        "ctrl+shift+m=toggle_tab_overview"
+
+        "ctrl+shift+alt+r=reset"
+      ];
+    };
+  };
+}

users/configs/system/helix/config/config.toml

@@ -0,0 +1,22 @@
+theme = "catppuccin_custom"
+
+[editor]
+cursorline = true
+bufferline = "always"
+
+[editor.cursor-shape]
+insert = "bar"
+
+[editor.lsp]
+auto-signature-help = false
+
+[keys.normal.space]
+"space" = "file_picker"
+
+[keys.normal.space.b]
+d = ":buffer-close"
+b = "buffer_picker"
+
+[keys.normal]
+L = "goto_next_buffer"
+H = "goto_previous_buffer"

users/configs/system/helix/config/themes/catppuccin_custom.toml

@@ -0,0 +1,10 @@
+inherits = "catppuccin_macchiato"
+
+"namespace" = { fg = "yellow" }
+
+"variable.other.member" = "peach"
+
+"string.special.symbol" = { fg = "flamingo" }
+"string.special" = { fg = "pink" }
+
+"attribute" = { fg = "teal", modifiers = ["italic"] }

users/configs/system/kitty/catppuccin.conf

@@ -0,0 +1,81 @@
+# vim:ft=kitty
+
+## name:     Catppuccin Kitty Macchiato
+## author:   Catppuccin Org
+## license:  MIT
+## upstream: https://github.com/catppuccin/kitty/blob/main/macchiato.conf
+## blurb:    Soothing pastel theme for the high-spirited!
+
+
+
+# The basic colors
+foreground              #CAD3F5
+background              #24273A
+selection_foreground    #24273A
+selection_background    #F4DBD6
+
+# Cursor colors
+cursor                  #F4DBD6
+cursor_text_color       #24273A
+
+# URL underline color when hovering with mouse
+url_color               #F4DBD6
+
+# Kitty window border colors
+active_border_color     #B7BDF8
+inactive_border_color   #6E738D
+bell_border_color       #EED49F
+
+# OS Window titlebar colors
+wayland_titlebar_color system
+macos_titlebar_color system
+
+# Tab bar colors
+active_tab_foreground   #181926
+active_tab_background   #C6A0F6
+inactive_tab_foreground #CAD3F5
+inactive_tab_background #1E2030
+tab_bar_background      #181926
+tab_bar_margin_color    #181926
+
+# Colors for marks (marked text in the terminal)
+mark1_foreground #24273A
+mark1_background #B7BDF8
+mark2_foreground #24273A
+mark2_background #C6A0F6
+mark3_foreground #24273A
+mark3_background #7DC4E4
+
+# The 16 terminal colors
+
+# black
+color0 #494D64
+color8 #5B6078
+
+# red
+color1 #ED8796
+color9 #ED8796
+
+# green
+color2  #A6DA95
+color10 #A6DA95
+
+# yellow
+color3  #EED49F
+color11 #EED49F
+
+# blue
+color4  #8AADF4
+color12 #8AADF4
+
+# magenta
+color5  #F5BDE6
+color13 #F5BDE6
+
+# cyan
+color6  #8BD5CA
+color14 #8BD5CA
+
+# white
+color7  #B8C0E0
+color15 #A5ADCB

users/configs/system/kitty/default.nix

@@ -0,0 +1,102 @@
+{
+  pkgs,
+  lib,
+  hostname,
+  ...
+}: let
+  wrap_gl = program: let
+    name = lib.strings.getName program.name;
+  in
+    pkgs.symlinkJoin {
+      name = name;
+      paths = [
+        (pkgs.writeShellScriptBin name ''
+          ${pkgs.nixgl.nixGLIntel}/bin/nixGLIntel ${program}/bin/${name} $@
+        '')
+        program
+      ];
+    };
+
+  package =
+    if hostname == "deck"
+    then (wrap_gl pkgs.kitty)
+    else pkgs.kitty;
+in {
+  home.file.".config/kitty/catppuccin.conf" = {
+    source = ./catppuccin.conf;
+  };
+
+  home.shellAliases = {
+    s = "kitty +kitten ssh";
+  };
+
+  programs.kitty = {
+    enable = true;
+    font = {
+      name = "Iosevka Nerd Font";
+    };
+    package = package;
+    keybindings = {
+      # Windows/Panes
+      "kitty_mod+enter" = "new_window_with_cwd";
+
+      "kitty_mod+h" = "neighboring_window left";
+      "kitty_mod+j" = "neighboring_window down";
+      "kitty_mod+k" = "neighboring_window up";
+      "kitty_mod+l" = "neighboring_window right";
+
+      "kitty_mod+r" = "start_resizing_window";
+
+      # Layouts
+      "kitty_mod+n" = "goto_layout tall:full_size=${
+        if hostname == "pingbox"
+        then "1"
+        else "2"
+      }";
+      "kitty_mod+m" = "goto_layout fat";
+
+      # Tabs
+      "kitty_mod+t" = "new_tab";
+      "kitty_mod+w" = "close_tab";
+      "kitty_mod+f" = "toggle_layout stack";
+
+      "kitty_mod+left" = "previous_tab";
+      "kitty_mod+right" = "next_tab";
+
+      # Clipboard
+      "ctrl+shift+c" = "copy_to_clipboard";
+      "ctrl+shift+v" = "paste_from_clipboard";
+
+      # Font Size
+      "kitty_mod+equal" = "change_font_size current +2.0";
+      "kitty_mod+minus" = "change_font_size current -2.0";
+      "kitty_mod+backspace" = "change_font_size current 0";
+    };
+    settings = {
+      "include" = "catppuccin.conf";
+      "scrollback_lines" = 50000;
+
+      "shell_integration" = "enabled no-cursor";
+
+      "allow_remote_control" = "yes";
+
+      "cursor_shape" = "underline";
+      "cursor_blink_interval" = 0;
+
+      "disable_ligatures" = "always";
+
+      "enabled_layouts" = "tall,fat,stack";
+
+      "enable_audio_bell" = "no";
+
+      "tab_bar_margin_width" = "10";
+      "tab_bar_margin_height" = "0 1";
+
+      "tab_bar_edge" = "top";
+      "tab_bar_style" = "powerline";
+      "tab_powerline_style" = "slanted";
+
+      "clear_all_shortcuts" = "yes";
+    };
+  };
+}

users/configs/system/nb/default.nix

@@ -0,0 +1,12 @@
+{pkgs, ...}: {
+  home.packages = with pkgs; [
+    ack
+    bat
+    imagemagick
+    nb
+    nmap
+    pandoc
+    ripgrep
+    w3m
+  ];
+}

users/configs/system/nushell/env.nu

@@ -58,7 +58,7 @@ let-env NU_PLUGIN_DIRS = [
     ($nu.config-path | path dirname | path join 'plugins')
 ]
 
-let-env EDITOR = "hx"
+let-env EDITOR = "nvim"
 
 # To add entries to PATH (on Windows you might use Path), you can use the following pattern:
 # let-env PATH = ($env.PATH | split row (char esep) | prepend '/some/path')

users/configs/system/nvim/default.nix

@@ -0,0 +1,20 @@
+{pkgs, ...}: let
+  nvim = pkgs.stdenv.mkDerivation {
+    name = "nvim";
+    src = pkgs.fetchFromGitea {
+      domain = "git.broccoli.town";
+      owner = "dp";
+      repo = "nvim";
+      rev = "c25c1db32f9a6e441e142553cc7a4774e3293c64";
+      hash = "sha256-dxFHAO1f9AL95llgi1b+A0Is9BXemq/7Ab6mFj/XcM0=";
+    };
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r * $out/
+      rm $out/lazy-lock.json
+    '';
+  };
+in {
+  programs.neovim.enable = true;
+}

users/configs/system/wezterm/default.nix

@@ -0,0 +1,11 @@
+{
+  pkgs,
+  lib,
+  hostname,
+  ...
+}: {
+  programs.wezterm = {
+    enable = true;
+    enableZshIntegration = true;
+  };
+}

users/daniel/configs/desktop/default.nix

@@ -1,19 +0,0 @@
-{config, ...}: {
-  imports = [
-    # ./i3
-    # ./i3status-rust
-    # ./polybar
-    ./hyprland
-    ./waybar
-  ];
-
-
-  home.file = {
-    ".age/age.txt" = {
-      source = config.lib.file.mkOutOfStoreSymlink "/run/agenix/age_identity";
-    };
-    ".minisign/minisign.key" = {
-      source = config.lib.file.mkOutOfStoreSymlink "/run/agenix/minisign_private_key";
-    };
-  };
-}

users/daniel/configs/desktop/hyprland/default.nix

@@ -1,32 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  hostname,
-  ...
-}: {
-  home.packages = with pkgs; [
-    swaybg
-  ];
-
-  home.file = {
-    ".config/hypr/macchiato.conf" = {
-      source = ./macchiato.conf;
-    };
-  };
-
-  wayland.windowManager.hyprland = {
-    enable = true;
-    package = pkgs.hyprland;
-    xwayland = {
-      enable = true;
-      hidpi = true;
-    };
-    nvidiaPatches = true;
-    extraConfig = (builtins.readFile ./${hostname}.conf) + (builtins.readFile ./hyprland.conf);
-  };
-
-  services.mako = {
-    enable = true;
-  };
-}

users/daniel/configs/desktop/hyprland/dingbox.conf

@@ -1,7 +0,0 @@
-monitor=,preferred,auto,1.25
-
-$mainMod = CTRL + SHIFT + ALT
-
-bind = $mainMod + SUPER, Q, exit,
-bind = $mainMod, M, workspace, -1
-bind = $mainMod, comma, workspace, +1

users/daniel/configs/desktop/hyprland/hyprland.conf

@@ -1,157 +0,0 @@
-# See https://wiki.hyprland.org/Configuring/Keywords/ for more
-
-# Execute your favorite apps at launch
-exec-once = waybar
-exec-once = swaybg -i ~/wallpapers/wallpaper.jpg
-
-# Source a file (multi-file configs)
-# source = ~/.config/hypr/myColors.conf
-source = ./macchiato.conf
-
-# For all categories, see https://wiki.hyprland.org/Configuring/Variables/
-input {
-    kb_layout = gb
-    kb_variant =
-    kb_model =
-    kb_options = caps:escape
-    kb_rules =
-
-    follow_mouse = 2
-
-    touchpad {
-        natural_scroll = yes
-        middle_button_emulation = yes
-        scroll_factor = 0.5
-    }
-
-    accel_profile = flat
-    sensitivity = 0.5 # -1.0 - 1.0, 0 means no modification.
-}
-
-general {
-    # See https://wiki.hyprland.org/Configuring/Variables/ for more
-
-    gaps_in = 5
-    gaps_out = 10
-    border_size = 2
-    col.active_border = $green
-    col.inactive_border = rgba(595959aa)
-
-    layout = dwindle
-}
-
-decoration {
-    # See https://wiki.hyprland.org/Configuring/Variables/ for more
-
-    rounding = 10
-    blur = yes
-    blur_size = 3
-    blur_passes = 1
-    blur_new_optimizations = on
-
-    drop_shadow = yes
-    shadow_range = 4
-    shadow_render_power = 3
-    col.shadow = rgba(1a1a1aee)
-}
-
-animations {
-    enabled = yes
-
-    # Some default animations, see https://wiki.hyprland.org/Configuring/Animations/ for more
-
-    bezier = myBezier, 0.05, 0.9, 0.1, 1.05
-
-    animation = windows, 1, 3, myBezier
-    animation = windowsOut, 1, 3, default, popin 80%
-    animation = border, 1, 3, default
-    animation = borderangle, 1, 3, default
-    animation = fade, 1, 3, default
-    animation = workspaces, 1, 3, default
-}
-
-dwindle {
-    # See https://wiki.hyprland.org/Configuring/Dwindle-Layout/ for more
-    pseudotile = yes # master switch for pseudotiling. Enabling is bound to mainMod + P in the keybinds section below
-    preserve_split = yes # you probably want this
-}
-
-master {
-    # See https://wiki.hyprland.org/Configuring/Master-Layout/ for more
-    new_is_master = true
-}
-
-gestures {
-    # See https://wiki.hyprland.org/Configuring/Variables/ for more
-    workspace_swipe = off
-}
-
-# Example per-device config
-# See https://wiki.hyprland.org/Configuring/Keywords/#executing for more
-device:epic mouse V1 {
-    sensitivity = -0.5
-}
-
-# Example windowrule v1
-# windowrule = float, ^(kitty)$
-# Example windowrule v2
-# windowrulev2 = float,class:^(kitty)$,title:^(kitty)$
-# See https://wiki.hyprland.org/Configuring/Window-Rules/ for more
-
-# Example binds, see https://wiki.hyprland.org/Configuring/Binds/ for more
-bind = $mainMod, return, exec, kitty
-bind = $mainMod, Q, killactive, 
-bind = $mainMod, D, exec, wofi --show drun
-bind = $mainMod SHIFT, S, exec, grim -g $(slurp)
-
-# Move focus with mainMod + vim keys
-bind = $mainMod, H, movefocus, l
-bind = $mainMod, L, movefocus, r
-bind = $mainMod, K, movefocus, u
-bind = $mainMod, J, movefocus, d
-
-# Move focus with mainMod + vim keys
-bind = $mainMod, left, movewindow, l
-bind = $mainMod, right, movewindow, r
-bind = $mainMod, up, movewindow, u
-bind = $mainMod, down, movewindow, d
-
-# Switch workspaces with mainMod + [0-9]
-bind = $mainMod, 1, workspace, 1
-bind = $mainMod, 2, workspace, 2
-bind = $mainMod, 3, workspace, 3
-bind = $mainMod, 4, workspace, 4
-bind = $mainMod, 5, workspace, 5
-bind = $mainMod, 6, workspace, 6
-bind = $mainMod, 7, workspace, 7
-bind = $mainMod, 8, workspace, 8
-bind = $mainMod, 9, workspace, 9
-bind = $mainMod, 0, workspace, 10
-
-# Move active window to a workspace with mainMod + SHIFT + [0-9]
-bind = $mainMod SHIFT, 1, movetoworkspace, 1
-bind = $mainMod SHIFT, 2, movetoworkspace, 2
-bind = $mainMod SHIFT, 3, movetoworkspace, 3
-bind = $mainMod SHIFT, 4, movetoworkspace, 4
-bind = $mainMod SHIFT, 5, movetoworkspace, 5
-bind = $mainMod SHIFT, 6, movetoworkspace, 6
-bind = $mainMod SHIFT, 7, movetoworkspace, 7
-bind = $mainMod SHIFT, 8, movetoworkspace, 8
-bind = $mainMod SHIFT, 9, movetoworkspace, 9
-bind = $mainMod SHIFT, 0, movetoworkspace, 10
-
-bind = $mainMod, U, movetoworkspace, -1
-bind = $mainMod, I, movetoworkspace, +1
-
-bind = $mainMod SHIFT, space, togglefloating,
-
-binde=, XF86AudioLowerVolume, exec, wpctl set-volume -l 1.0 @DEFAULT_AUDIO_SINK@ 5%-
-bind=, XF86AudioMute, exec, wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle
-binde=, XF86AudioRaiseVolume, exec, wpctl set-volume -l 1.0 @DEFAULT_AUDIO_SINK@ 5%+
-
-binde=, XF86MonBrightnessUp, exec, xbacklight -inc 10
-binde=, XF86MonBrightnessDown, exec, xbacklight -dec 10
-
-# Move/resize windows with mainMod + LMB/RMB and dragging
-bindm = $mainMod, mouse:272, movewindow
-bindm = $mainMod, mouse:273, resizewindow

users/daniel/configs/desktop/hyprland/macchiato.conf

@@ -1,30 +0,0 @@
-$rosewater = 0xfff4dbd6
-$flamingo  = 0xfff0c6c6
-$pink      = 0xfff5bde6
-$mauve     = 0xffc6a0f6
-$red       = 0xffed8796
-$maroon    = 0xffee99a0
-$peach     = 0xfff5a97f
-$yellow    = 0xffeed49f
-$green     = 0xffa6da95
-$teal      = 0xff8bd5ca
-$sky       = 0xff91d7e3
-$sapphire  = 0xff7dc4e4
-$blue      = 0xff8aadf4
-$lavender  = 0xffb7bdf8
-
-$text      = 0xffcad3f5
-$subtext1  = 0xffb8c0e0
-$subtext0  = 0xffa5adcb
-
-$overlay2  = 0xff939ab7
-$overlay1  = 0xff8087a2
-$overlay0  = 0xff6e738d
-
-$surface2  = 0xff5b6078
-$surface1  = 0xff494d64
-$surface0  = 0xff363a4f
-
-$base      = 0xff24273a
-$mantle    = 0xff1e2030
-$crust     = 0xff181926

users/daniel/configs/desktop/hyprland/pingbox.conf

@@ -1,9 +0,0 @@
-monitor=,preferred,auto,1.5
-
-$mainMod = SUPER
-
-bind = $mainMod + SHIFT + CTRL, Q, exit,
-bind = $mainMod + CTRL, H, workspace, -1
-bind = $mainMod + CTRL, L, workspace, +1
-bind = $mainMod + SHIFT, H, movetoworkspace, -1
-bind = $mainMod + SHIFT, L, movetoworkspace, +1

users/daniel/configs/desktop/waybar/config.json

@@ -1,47 +0,0 @@
-{
-    "layer": "top",
-    "modules-left": ["wlr/workspaces", "hyprland/window"],
-    "modules-center": ["clock"],
-    "modules-right": [
-        "backlight",
-        "pulseaudio",
-        "network",
-        "battery",
-        "tray"
-    ],
-    "hyprland/window": {
-    },
-    "network": {
-
-    },
-    "bat": {
-
-    },
-    "backlight": {
-        "format": "{percent}% {icon}",
-        "format-icons": ["", ""]
-    },
-    "wlr/workspaces": {
-        "format": "{icon}",
-        "on-scroll-up": "hyprctl dispatch workspace e+1",
-        "on-scroll-down": "hyprctl dispatch workspace e-1"
-    },
-    "clock": {
-        "format-alt": "{:%a, %d. %b  %H:%M}"
-    },
-    "pulseaudio": {
-        "format": "󰕾{icon} {volume}%",
-        "format-muted": "",
-        "format-icons": {
-            "default": [
-                "󰣾",
-                "󰣴",
-                "󰣶",
-                "󰣸",
-                "󰣺"
-            ]
-        },
-        "max-volume": 100,
-        "on-click": "pavucontrol"
-    }
-}

users/daniel/configs/system/default.nix

@@ -1,9 +0,0 @@
-{
-  imports = [
-    ./alacritty
-    ./helix
-    ./kitty
-    ./neovim
-    ./nushell
-  ];
-}

users/daniel/configs/system/helix/config/config.toml

@@ -1,4 +0,0 @@
-theme = "dracula"
-
-[editor]
-mouse = false