alyssum/samba: bind music

input delay :p

.git-crypt/.gitattributes

@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary

.gitattributes

@@ -0,0 +1 @@
+secrets.gcrypt/** filter=git-crypt diff=git-crypt

.github/workflows/autoupdate.yml

@@ -12,6 +12,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.PAT_TOKEN }}
 
       - name: Check for updates
         id: check
@@ -44,5 +46,5 @@ jobs:
         if: steps.check.outputs.skip == 0
         uses: ad-m/github-push-action@master
         with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.PAT_TOKEN }}
           branch: ${{ steps.check.outputs.branch_name }}

.github/workflows/cachix.yml

@@ -5,29 +5,23 @@ on:
   workflow_dispatch:
 
 jobs:
-  check:
-    name: Check flake
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - uses: cachix/install-nix-action@v31
-      - uses: cachix/cachix-action@v14
-        with:
-          name: lava
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-      - run: nix flake check --keep-going --verbose
-
   build:
     name: Build linux-lava for x86_64-linux
     runs-on: ubuntu-latest
     steps:
+      # credits to https://github.com/easimon/maximize-build-space/issues/45
+      - name: Remove unneeded packages to maximise build space
+        shell: bash
+        run: |
+            df -h
+            sudo rm -rf /usr/share/dotnet
+            sudo rm -rf /usr/local/lib/android
+            df -h
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - uses: cachix/install-nix-action@v31
-      - uses: cachix/cachix-action@v14
+      - uses: cachix/cachix-action@v16
         with:
           name: lava
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'

containers/amethyst/configuration.nix

@@ -0,0 +1,47 @@
+{ lib, pkgs, ... }: {
+  system.stateVersion = "23.11";
+  systemd.tmpfiles.rules = [
+    "d /persist/transmission 755 transmission transmission"
+    "d /persist/transmission/.config/transmission-daemon 750 transmission transmission"
+    "d /persist/transmission/.incomplete 750 transmission transmission"
+    "d /persist/transmission/Downloads 755 transmission transmission"
+    "d /persist/transmission/watchdir 755 transmission transmission"
+  ];
+  networking.wg-quick.interfaces.wg0 = {
+    configFile = "/persist/vpn.conf";
+    preUp = ''
+          # Try to access the DNS for up to 300s
+          for i in {1..60}; do
+            ${pkgs.iputils}/bin/ping -c1 'google.com' && break
+            echo "Attempt $i: DNS still not available"
+            sleep 5s
+          done
+    '';
+  };
+
+  # https://github.com/NixOS/nixpkgs/issues/258793
+  systemd.services.transmission.serviceConfig = {
+    BindReadOnlyPaths = lib.mkForce [ builtins.storeDir "/etc" ];
+    RootDirectoryStartOnly = lib.mkForce false;
+    RootDirectory = lib.mkForce "";
+    PrivateMounts = lib.mkForce false;
+    PrivateUsers = lib.mkForce false;
+  };
+
+  networking.firewall.allowedTCPPorts = [ 9091 ];
+  services.transmission = {
+    enable = true;
+    package = pkgs.transmission_4;
+    downloadDirPermissions = "775";
+    openFirewall = true;
+    home = "/persist/transmission";
+    settings = {
+      ratio-limit-enabled = true;
+      rpc-bind-address = "0.0.0.0";
+      rpc-enabled = true;
+      rpc-port = 9091;
+      rpc-host-whitelist-enabled = false;
+      rpc-whitelist-enabled = false;
+    };
+  };
+}

containers/amethyst/flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1773282481,
+        "narHash": "sha256-b/GV2ysM8mKHhinse2wz+uP37epUrSE+sAKXy/xvBY4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fe416aaedd397cacb33a610b33d60ff2b431b127",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

containers/amethyst/flake.nix

@@ -0,0 +1,51 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+  outputs = { nixpkgs, ... }: {
+    nixosConfigurations.container = nixpkgs.lib.nixosSystem {
+      modules = [ ./configuration.nix ];
+    };
+    nixosModule = { ... }:
+    let
+      name = "amethyst";
+      fqdn = "amethyst.lava.moe";
+      subnet = "1";
+    in {
+      networking.nat = {
+        enable = true;
+        enableIPv6 = true;
+        internalInterfaces = [ "ve-${name}" ];
+      };
+
+      services.nginx.virtualHosts."${fqdn}" = {
+        useACMEHost = "lava.moe";
+        forceSSL = true;
+        #locations."/".proxyPass = "http://[fd0d:1::${subnet}:2]:9091";
+        locations."/".proxyPass = "http://10.30.${subnet}.2:9091";
+        listenAddresses = [ "10.0.0.1" "[fd0d::1]" ];
+      };
+
+      systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" ];
+      containers.${name} = {
+        autoStart = true;
+        privateNetwork = true;
+        hostAddress = "10.30.${subnet}.1";
+        localAddress = "10.30.${subnet}.2";
+        hostAddress6 = "fd0d:1::${subnet}:1";
+        localAddress6 = "fd0d:1::${subnet}:2";
+        # privateUsers = "pick";
+        nixpkgs = nixpkgs;
+        ephemeral = true;
+        config = { imports = [ ./configuration.nix ]; };
+
+        bindMounts."persist" = {
+          hostPath = "/persist/containers/${name}";
+          mountPoint = "/persist";
+          isReadOnly = false;
+        };
+        # flake = "path:" + ./.;
+      };
+    };
+  };
+}

containers/beryllium/configuration.nix

@@ -0,0 +1,23 @@
+{ ... }: {
+  system.stateVersion = "25.11";
+  fileSystems."/var/lib/private" = {
+    device = "/persist";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+  networking.firewall.allowedTCPPorts = [ 6167 ];
+  networking.firewall.allowedUDPPorts = [ 6167 ];
+  # TODO: this should be generically set
+  networking.useHostResolvConf = false;
+  networking.nameservers = [ "8.8.8.8" ];
+
+  services.matrix-continuwuity = {
+    enable = true;
+    settings.global = {
+      # TODO: link this with outer container's address
+      address = [ "10.30.2.2" ];
+      server_name = "lava.moe";
+      rocksdb_recovery_mode = 2;
+    };
+  };
+}

containers/beryllium/flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1773282481,
+        "narHash": "sha256-b/GV2ysM8mKHhinse2wz+uP37epUrSE+sAKXy/xvBY4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fe416aaedd397cacb33a610b33d60ff2b431b127",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

containers/beryllium/flake.nix

@@ -0,0 +1,69 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+  outputs = { nixpkgs, ... }: {
+    nixosConfigurations.container = nixpkgs.lib.nixosSystem {
+      modules = [ ./configuration.nix ];
+    };
+    nixosModule = { ... }:
+    let
+      name = "beryllium";
+      fqdn = "beryllium.lava.moe";
+      subnet = "2";
+    in {
+      networking.nat = {
+        enable = true;
+        enableIPv6 = true;
+        internalInterfaces = [ "ve-${name}" ];
+      };
+
+      services.nginx.virtualHosts."${fqdn}" = {
+        useACMEHost = "lava.moe";
+        forceSSL = true;
+        locations."/".extraConfig = "return 302 'https://lava.moe';";
+        locations."/_matrix".proxyPass = "http://10.30.${subnet}.2:6167";
+        locations."/_conduwuit".proxyPass = "http://10.30.${subnet}.2:6167";
+        locations."/_continuwuity".proxyPass = "http://10.30.${subnet}.2:6167";
+      };
+
+      services.nginx.virtualHosts."lava.moe" = {
+        locations."= /.well-known/matrix/server".extraConfig =
+          let
+            server = { "m.server" = "${fqdn}:443"; };
+          in ''
+            add_header Content-Type application/json;
+            return 200 '${builtins.toJSON server}';
+          '';
+        locations."= /.well-known/matrix/client".extraConfig =
+          let
+            client = {
+              "m.homeserver" = { "base_url" = "https://${fqdn}"; };
+              # "m.identity_server" = { "base_url" = "https://vector.im"; };
+            };
+          in ''
+            add_header Content-Type application/json;
+            add_header Access-Control-Allow-Origin *;
+            return 200 '${builtins.toJSON client}';
+          '';
+      };
+
+      systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" ];
+      containers.${name} = {
+        autoStart = true;
+        privateNetwork = true;
+        hostAddress = "10.30.${subnet}.1";
+        localAddress = "10.30.${subnet}.2";
+        nixpkgs = nixpkgs;
+        ephemeral = true;
+        config = { imports = [ ./configuration.nix ]; };
+
+        bindMounts."persist" = {
+          hostPath = "/persist/containers/${name}";
+          mountPoint = "/persist";
+          isReadOnly = false;
+        };
+      };
+    };
+  };
+}

containers/citrine/configuration.nix

@@ -0,0 +1,53 @@
+{ config, fqdn, lib, ... }: {
+  system.stateVersion = "25.11";
+  networking.firewall.allowedTCPPorts = [ 22 3000 ];
+  networking.firewall.allowedUDPPorts = [ 22 3000 ];
+
+  systemd.tmpfiles.rules = [
+    "L+ /persist/forgejo/custom/templates - - - - ${./templates}"
+  ];
+
+  services.forgejo = {
+    enable = true;
+    lfs.enable = true;
+    settings = {
+      DEFAULT.APP_NAME = "cilly's botanical laboratory";
+      server = {
+        DOMAIN = fqdn;
+        ROOT_URL = "https://${fqdn}/";
+        HTTP_PORT = 3000;
+        START_SSH_SERVER = true;
+        BUILTIN_SSH_SERVER_USER = "git";
+        SSH_DOMAIN = "git.lava.moe";
+        SSH_SERVER_KEY_EXCHANGES = "mlkem768x25519-sha256,sntrup761x25519-sha512,sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256";
+      };
+      ui = lib.mkForce {
+        DEFAULT_THEME = "catppuccin-maroon-auto";
+        THEMES = lib.strings.concatMapStringsSep "," (x: "${x}-auto") [
+          "catppuccin-pink"
+          "catppuccin-maroon"
+          "catppuccin-flamingo"
+          "catppuccin-rosewater"
+          "forgejo"
+          "gitea"
+        ];
+      };
+      api.ENABLE_SWAGGER = false;
+      other.SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
+      repository.ENABLE_PUSH_CREATE_USER = true;
+      repository.ENABLE_PUSH_CREATE_ORG = true;
+      service.DISABLE_REGISTRATION = true;
+    };
+    stateDir = "/persist/forgejo";
+  };
+
+  systemd.services.forgejo.serviceConfig = {
+    AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+    CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+    PrivateUsers = lib.mkForce false;
+  };
+
+  catppuccin.forgejo.enable = true;
+
+  environment.systemPackages = [ config.services.forgejo.package ];
+}

containers/citrine/flake.lock

@@ -0,0 +1,62 @@
+{
+  "nodes": {
+    "catppuccin": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1773403535,
+        "narHash": "sha256-47MZaFrHxNO8tVUAmtVnerXUw2WWVluBOiU9MulN/yM=",
+        "owner": "catppuccin",
+        "repo": "nix",
+        "rev": "d45b5665cc638bad1b794350de02f4dd41b0bb47",
+        "type": "github"
+      },
+      "original": {
+        "owner": "catppuccin",
+        "repo": "nix",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1773122722,
+        "narHash": "sha256-FIqHByVqxCprNjor1NqF80F2QQoiiyqanNNefdlvOg4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "62dc67aa6a52b4364dd75994ec00b51fbf474e50",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1773282481,
+        "narHash": "sha256-b/GV2ysM8mKHhinse2wz+uP37epUrSE+sAKXy/xvBY4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fe416aaedd397cacb33a610b33d60ff2b431b127",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "catppuccin": "catppuccin",
+        "nixpkgs": "nixpkgs_2"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

containers/citrine/flake.nix

@@ -0,0 +1,68 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+    catppuccin.url = "github:catppuccin/nix";
+  };
+  outputs = { nixpkgs, catppuccin, ... }:
+  let
+    name = "citrine";
+    fqdn = "lab.lava.moe";
+    subnetId = "3";
+
+    subnet = x: "fd0d:1::${subnetId}:${toString x}";
+    host = subnet 1;
+    client = subnet 2;
+
+    subnet4 = x: "10.30.${subnetId}.${toString x}";
+    host4 = subnet4 1;
+    client4 = subnet4 2;
+
+    modules = [
+      ./configuration.nix
+      catppuccin.nixosModules.catppuccin
+      {
+        networking.useHostResolvConf = false;
+        networking.nameservers = [ host ];
+      }
+    ];
+  in {
+    nixosConfigurations.container = nixpkgs.lib.nixosSystem {
+      inherit modules;
+    };
+    nixosModule = { ... }: {
+      networking.nat = {
+        enable = true;
+        enableIPv6 = true;
+        internalInterfaces = [ "ve-${name}" ];
+      };
+
+      services.nginx.virtualHosts."${fqdn}" = {
+        useACMEHost = "lava.moe";
+        forceSSL = true;
+        locations."/".proxyPass = "http://[${client}]:3000";
+      };
+
+      systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" ];
+      containers.${name} = {
+        autoStart = true;
+        privateNetwork = true;
+        hostAddress = host4;
+        localAddress = client4;
+        hostAddress6 = host;
+        localAddress6 = client;
+        # privateUsers = "pick";
+        nixpkgs = nixpkgs;
+        ephemeral = true;
+        config = { imports = modules; };
+        specialArgs = { inherit fqdn; };
+
+        bindMounts."persist" = {
+          hostPath = "/persist/containers/${name}";
+          mountPoint = "/persist";
+          isReadOnly = false;
+        };
+        # flake = "path:" + ./.;
+      };
+    };
+  };
+}

containers/citrine/templates/base/footer_content.tmpl

@@ -0,0 +1,31 @@
+<footer class="page-footer" role="group" aria-label="{{ctx.Locale.Tr "aria.footer"}}">
+    <div class="left-links" role="contentinfo" aria-label="{{ctx.Locale.Tr "aria.footer.software"}}">
+        {{if ShowFooterPoweredBy}}
+            <a target="_blank" rel="noopener noreferrer" href="https://forgejo.org">Forgejo</a>
+        {{end}}
+        {{if (or .ShowFooterVersion .PageIsAdmin)}}
+            {{if .IsAdmin}}
+                <a href="{{AppSubUrl}}/admin/config">{{AppVerNoMetadata}}</a>
+            {{else}}
+                {{AppVerNoMetadata}}
+            {{end}}
+        {{end}}
+        {{if and .TemplateLoadTimes ShowFooterTemplateLoadTime}}
+            {{ctx.Locale.Tr "page"}}: <strong>{{LoadTimes .PageStartTime}}</strong>
+            {{ctx.Locale.Tr "template"}}{{if .TemplateName}} {{.TemplateName}}{{end}}: <strong>{{call .TemplateLoadTimes}}</strong>
+        {{end}}
+    </div>
+    <div class="right-links" role="group" aria-label="{{ctx.Locale.Tr "aria.footer.links"}}">
+        <div class="ui dropdown upward language">
+            <span class="flex-text-inline">{{svg "octicon-globe" 14}} {{ctx.Locale.LangName}}</span>
+            <div class="menu language-menu">
+                {{range .AllLangs}}
+                    <a lang="{{.Lang}}" data-url="{{AppSubUrl}}/?lang={{.Lang}}" class="item {{if eq ctx.Locale.Lang .Lang}}active selected{{end}}">{{.Name}}</a>
+                {{end}}
+            </div>
+        </div>
+        <a href="{{AssetUrlPrefix}}/licenses.txt">{{ctx.Locale.Tr "licenses"}}</a>
+        {{if .EnableSwagger}}<a href="{{AppSubUrl}}/api/swagger">API</a>{{end}}
+        {{template "custom/extra_links_footer" .}}
+    </div>
+</footer>

containers/citrine/templates/home.tmpl

@@ -0,0 +1,19 @@
+{{template "base/head" .}}
+{{if not .IsSigned}}
+    <script>window.location.href = "/explore/repos";</script>
+{{end}}
+<div role="main" aria-label="{{if .IsSigned}}{{ctx.Locale.Tr "dashboard"}}{{else}}{{ctx.Locale.Tr "home"}}{{end}}" class="page-content home">
+    <div class="tw-mb-8 tw-px-8">
+        <div class="center">
+            <img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg" alt="{{ctx.Locale.Tr "logo"}}">
+            <div class="hero">
+                <h1 class="ui icon header title">
+                    {{AppDisplayName}}
+                </h1>
+                <h2>{{ctx.Locale.Tr "startpage.app_desc"}}</h2>
+            </div>
+        </div>
+    </div>
+    {{template "home_forgejo" .}}
+</div>
+{{template "base/footer" .}}

containers/diamond/configuration.nix

@@ -0,0 +1,22 @@
+{ fqdn, ... }: {
+  system.stateVersion = "25.11";
+  systemd.tmpfiles.rules = [
+    "d /persist/vaultwarden 755 vaultwarden vaultwarden"
+  ];
+  fileSystems."/var/lib/vaultwarden" = {
+    device = "/persist/vaultwarden";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+  networking.firewall.allowedTCPPorts = [ 8000 ];
+  networking.firewall.allowedUDPPorts = [ 8000 ];
+
+  services.vaultwarden = {
+    enable = true;
+    domain = fqdn;
+    config = {
+      DOMAIN = "https://${fqdn}";
+      ROCKET_ADDRESS = "::";
+    };
+  };
+}

containers/diamond/flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1773282481,
+        "narHash": "sha256-b/GV2ysM8mKHhinse2wz+uP37epUrSE+sAKXy/xvBY4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fe416aaedd397cacb33a610b33d60ff2b431b127",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

containers/diamond/flake.nix

@@ -0,0 +1,51 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+  outputs = { nixpkgs, ... }:
+  let
+    name = "diamond";
+    fqdn = "astransia.lava.moe";
+    subnetId = "4";
+
+    subnet = x: "fd0d:1::${subnetId}:${toString x}";
+    host = subnet 1;
+    client = subnet 2;
+
+    modules = [
+      ./configuration.nix
+    ];
+  in {
+    nixosConfigurations.container = nixpkgs.lib.nixosSystem {
+      inherit modules;
+    };
+    nixosModule = { ... }: {
+      services.nginx.virtualHosts."${fqdn}" = {
+        useACMEHost = "lava.moe";
+        forceSSL = true;
+        locations."/".proxyPass = "http://[${client}]:8000";
+        listenAddresses = [ "10.0.0.1" "[fd0d::1]" "100.67.1.1" ];
+      };
+
+      systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" ];
+      containers.${name} = {
+        autoStart = true;
+        privateNetwork = true;
+        hostAddress6 = host;
+        localAddress6 = client;
+        # privateUsers = "pick";
+        nixpkgs = nixpkgs;
+        ephemeral = true;
+        config = { imports = modules; };
+        specialArgs = { inherit fqdn; };
+
+        bindMounts."persist" = {
+          hostPath = "/persist/containers/${name}";
+          mountPoint = "/persist";
+          isReadOnly = false;
+        };
+        # flake = "path:" + ./.;
+      };
+    };
+  };
+}

containers/emerald/configuration.nix

@@ -0,0 +1,23 @@
+{ fqdn, shareFqdn, ... }: {
+  system.stateVersion = "25.11";
+  systemd.tmpfiles.rules = [
+    "d /persist/navidrome 755 navidrome navidrome"
+  ];
+  networking.firewall.allowedTCPPorts = [ 4533 ];
+  networking.firewall.allowedUDPPorts = [ 4533 ];
+
+  services.navidrome = {
+    enable = true;
+    environmentFile = "/binds/navidrome_env";
+    settings = {
+      Port = 4533;
+      Address = "[::]";
+      BaseUrl = "https://${fqdn}/";
+      ShareURL = "https://${shareFqdn}";
+      EnableSharing = true;
+      DataFolder = "/persist/navidrome";
+      MusicFolder = "/binds/music/main";
+    };
+  };
+  systemd.services.navidrome.serviceConfig.BindReadOnlyPaths = ["/binds/music"];
+}

containers/emerald/flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1773282481,
+        "narHash": "sha256-b/GV2ysM8mKHhinse2wz+uP37epUrSE+sAKXy/xvBY4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fe416aaedd397cacb33a610b33d60ff2b431b127",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

containers/emerald/flake.nix

@@ -0,0 +1,78 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+  outputs = { nixpkgs, ... }:
+  let
+    name = "emerald";
+    fqdn = "navia.lava.moe";
+    shareFqdn = "muse.lava.moe";
+    subnetId = "5";
+
+    subnet = x: "fd0d:2::${subnetId}:${toString x}";
+    host = subnet 1;
+    client = subnet 2;
+
+    subnet4 = x: "10.32.${subnetId}.${toString x}";
+    host4 = subnet4 1;
+    client4 = subnet4 2;
+
+    modules = [
+      ./configuration.nix
+      {
+        networking.useHostResolvConf = false;
+        networking.nameservers = [ host ];
+      }
+    ];
+  in {
+    nixosConfigurations.container = nixpkgs.lib.nixosSystem {
+      inherit modules;
+    };
+    nixosModule = { config, ... }: {
+      networking.nat = {
+        enable = true;
+        enableIPv6 = true;
+        internalInterfaces = [ "ve-${name}" ];
+      };
+
+      services.nginx.virtualHosts."${fqdn}" = {
+        useACMEHost = "lava.moe";
+        forceSSL = true;
+        locations."/".proxyPass = "http://[${client}]:4533";
+        listenAddresses = [ "100.67.2.1" ];
+      };
+
+      systemd.tmpfiles.rules = [ "d /persist/containers/${name} 755 root users" ];
+      containers.${name} = {
+        autoStart = true;
+        privateNetwork = true;
+        hostAddress = host4;
+        localAddress = client4;
+        hostAddress6 = host;
+        localAddress6 = client;
+        # privateUsers = "pick";
+        nixpkgs = nixpkgs;
+        ephemeral = true;
+        config = { imports = modules; };
+        specialArgs = { inherit fqdn shareFqdn; };
+
+        bindMounts."persist" = {
+          hostPath = "/persist/containers/${name}";
+          mountPoint = "/persist";
+          isReadOnly = false;
+        };
+        bindMounts."music" = {
+          hostPath = "/flower/media/music";
+          mountPoint = "/binds/music";
+          isReadOnly = true;
+        };
+        bindMounts."navidrome_env" = {
+          hostPath = config.age.secrets.navidrome_env.path;
+          mountPoint = "/binds/navidrome_env";
+          isReadOnly = true;
+        };
+        # flake = "path:" + ./.;
+      };
+    };
+  };
+}

containers/fluorite/configuration.nix

@@ -0,0 +1,22 @@
+{ ... }: {
+  system.stateVersion = "25.11";
+  systemd.tmpfiles.rules = [
+    "d /persist/slskd/Downloads 755 slskd slskd"
+  ];
+  fileSystems."/var/lib/slskd" = {
+    device = "/persist/slskd";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+  networking.firewall.allowedTCPPorts = [ 5030 50300 ];
+  networking.firewall.allowedUDPPorts = [ 5030 50300 ];
+
+  services.slskd = {
+    enable = true;
+    domain = null;
+    environmentFile = "/binds/slskd_env";
+    settings = {
+      shares.directories = [ "/binds/music/" ];
+    };
+  };
+}

containers/fluorite/flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1773282481,
+        "narHash": "sha256-b/GV2ysM8mKHhinse2wz+uP37epUrSE+sAKXy/xvBY4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fe416aaedd397cacb33a610b33d60ff2b431b127",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

containers/fluorite/flake.nix

@@ -0,0 +1,89 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+  outputs = { nixpkgs, ... }:
+  let
+    name = "fluorite";
+    fqdn = "fluorite.lava.moe";
+    subnetId = "6";
+
+    subnet = x: "fd0d:1::${subnetId}:${toString x}";
+    host = subnet 1;
+    client = subnet 2;
+
+    subnet4 = x: "10.30.${subnetId}.${toString x}";
+    host4 = subnet4 1;
+    client4 = subnet4 2;
+
+    modules = [
+      ./configuration.nix
+      {
+        networking.useHostResolvConf = false;
+        networking.nameservers = [ host ];
+      }
+    ];
+  in {
+    nixosConfigurations.container = nixpkgs.lib.nixosSystem {
+      inherit modules;
+    };
+    nixosModule = { config, ... }: {
+      networking.nat = {
+        enable = true;
+        enableIPv6 = true;
+        internalInterfaces = [ "ve-${name}" ];
+      };
+      networking.firewall.allowedTCPPorts = [ 50300 ];
+
+      services.nginx.virtualHosts."${fqdn}" = {
+        useACMEHost = "lava.moe";
+        forceSSL = true;
+        locations."/".proxyPass = "http://[${client}]:5030";
+        listenAddresses = [ "10.0.0.1" "[fd0d::1]" "100.67.1.1" ];
+      };
+
+      systemd.tmpfiles.rules = [
+        "d /persist/containers/${name} 755 root users"
+        "d /persist/media/music 075 nobody users"
+      ];
+      containers.${name} = {
+        autoStart = true;
+        privateNetwork = true;
+        hostAddress = host4;
+        localAddress = client4;
+        hostAddress6 = host;
+        localAddress6 = client;
+        # privateUsers = "pick";
+        nixpkgs = nixpkgs;
+        ephemeral = true;
+        config = { imports = modules; };
+        specialArgs = { inherit fqdn; };
+
+        forwardPorts = [
+          {
+            containerPort = 50300;
+            hostPort = 50300;
+            protocol = "tcp";
+          }
+        ];
+
+        bindMounts."persist" = {
+          hostPath = "/persist/containers/${name}";
+          mountPoint = "/persist";
+          isReadOnly = false;
+        };
+        bindMounts."music" = {
+          hostPath = "/persist/media/music";
+          mountPoint = "/binds/music";
+          isReadOnly = true;
+        };
+        bindMounts."slskd_env" = {
+          hostPath = config.age.secrets.slskd_env.path;
+          mountPoint = "/binds/slskd_env";
+          isReadOnly = true;
+        };
+        # flake = "path:" + ./.;
+      };
+    };
+  };
+}

containers/garnet/configuration.nix

@@ -0,0 +1,36 @@
+{ ... }: {
+  system.stateVersion = "25.11";
+  fileSystems."/var/lib/opencloud" = {
+    device = "/flower/data";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+  fileSystems."/etc/opencloud" = {
+    device = "/persist/cfg";
+    fsType = "none";
+    options = [ "bind" ];
+  };
+  # TODO: hardcoded address
+  networking.extraHosts = ''
+    100.67.2.1 cloud.lava.moe
+  '';
+
+  networking.firewall.allowedTCPPorts = [ 9200 ];
+  networking.firewall.allowedUDPPorts = [ 9200 ];
+
+  environment.etc."opencloud-admin-pass".text = ''
+    IDM_ADMIN_PASSWORD=supersillysecure
+  '';
+  services.opencloud = {
+    enable = true;
+    url = "https://cloud.lava.moe";
+    address = "10.30.7.2";
+    port = 9200;
+    environment = {
+      PROXY_TLS = "false";
+      IDP_ACCESS_TOKEN_EXPIRATION = "2592000";
+      IDP_ID_TOKEN_EXPIRATION = "2592000";
+    };
+    environmentFile = "/etc/opencloud-admin-pass";
+  };
+}

containers/garnet/flake.lock

@@ -0,0 +1,27 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1779560665,
+        "narHash": "sha256-tpyBcxPpcQb8ukyNF7DoCwfSY3VPsxHoYwj00Cayv5o=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "64c08a7ca051951c8eae34e3e3cb1e202fe36786",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

containers/garnet/flake.nix

@@ -0,0 +1,84 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+  };
+  outputs = { nixpkgs, ... }:
+  let
+    name = "garnet";
+    fqdn = "cloud.lava.moe";
+    subnetId = "7";
+
+    subnet = x: "fd0d:1::${subnetId}:${toString x}";
+    host = subnet 1;
+    client = subnet 2;
+
+    subnet4 = x: "10.30.${subnetId}.${toString x}";
+    host4 = subnet4 1;
+    client4 = subnet4 2;
+
+    modules = [
+      ./configuration.nix
+      {
+        networking.useHostResolvConf = false;
+        networking.nameservers = [ host ];
+      }
+    ];
+  in {
+    nixosConfigurations.container = nixpkgs.lib.nixosSystem {
+      inherit modules;
+    };
+    nixosModule = { config, ... }: {
+      networking.nat = {
+        enable = true;
+        enableIPv6 = true;
+        internalInterfaces = [ "ve-${name}" ];
+      };
+
+      services.nginx.virtualHosts."${fqdn}" = {
+        useACMEHost = "lava.moe";
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://${client4}:9200";
+          proxyWebsockets = true;
+        };
+        extraConfig = ''
+          proxy_read_timeout 3600s;
+          proxy_send_timeout 3600s;
+          keepalive_requests 100000;
+          keepalive_timeout 5m;
+          http2_max_concurrent_streams 512;
+        '';
+        # TODO: hardcoded address
+        listenAddresses = [ "100.67.2.1" ];
+      };
+
+      systemd.tmpfiles.rules = [
+        "d /persist/containers/${name} 755 root users"
+      ];
+      containers.${name} = {
+        autoStart = true;
+        privateNetwork = true;
+        hostAddress = host4;
+        localAddress = client4;
+        hostAddress6 = host;
+        localAddress6 = client;
+        # privateUsers = "pick";
+        nixpkgs = nixpkgs;
+        ephemeral = true;
+        config = { imports = modules; };
+        specialArgs = { inherit fqdn; };
+
+        bindMounts."persist" = {
+          hostPath = "/persist/containers/${name}";
+          mountPoint = "/persist";
+          isReadOnly = false;
+        };
+        bindMounts."content" = {
+          hostPath = "/flower/opencloud";
+          mountPoint = "/flower";
+          isReadOnly = false;
+        };
+      };
+    };
+  };
+}

flake.nix

@@ -2,24 +2,27 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     home-manager.url = "github:nix-community/home-manager";
-    neovim-nightly.url = "github:nix-community/neovim-nightly-overlay";
-    agenix.url = "github:ryantm/agenix";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
 
-    aagl.url = "github:ezKEa/aagl-gtk-on-nix";
+    agenix.url = "github:ryantm/agenix";
     agenix.inputs.nixpkgs.follows = "nixpkgs";
+    aagl.url = "github:ezKEa/aagl-gtk-on-nix";
     catppuccin.url = "github:catppuccin/nix/8eada392fd6571a747e1c5fc358dd61c14c8704e";
     catppuccin.inputs.nixpkgs.follows = "nixpkgs";
     catppuccin-palette = { url = "github:catppuccin/palette"; flake = false; };
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
+    neovim-nightly.url = "github:nix-community/neovim-nightly-overlay";
     neovim-nightly.inputs.nixpkgs.follows = "nixpkgs";
 
     nix-gaming.url = "github:fufexan/nix-gaming";
+    nix-index-database.url = "github:nix-community/nix-index-database";
+    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
     spicetify-nix.url = "github:Gerg-L/spicetify-nix";
     spicetify-nix.inputs.nixpkgs.follows = "nixpkgs";
 
     # services
-    # hosts-blocklists = { url = "github:notracking/hosts-blocklists"; flake = false; };
-    # website = { url = "github:LavaDesu/lavadesu.github.io/master"; flake = false; };
+    pastel.url = "github:cillynder/pastel";
+    stevenblack-hosts = { url = "github:StevenBlack/hosts"; flake = false; };
+    website = { url = "github:cillynder/lavadesu.github.io/master"; flake = false; };
 
     # zsh plugins
     zsh-abbr = { url = "git+https://github.com/olets/zsh-abbr?submodules=1"; flake = false; };
@@ -33,6 +36,15 @@
     spotify-adblock = { url = "github:abba23/spotify-adblock"; flake = false; };
     tree-sitter-jsonc = { url = "gitlab:WhyNotHugo/tree-sitter-jsonc"; flake = false; };
     wine-discord-ipc-bridge = { url = "github:0e4ef622/wine-discord-ipc-bridge"; flake = false; };
+
+    # containers
+    c-amethyst.url = "path:./containers/amethyst";
+    c-beryllium.url = "path:./containers/beryllium";
+    c-citrine.url = "path:./containers/citrine";
+    c-diamond.url = "path:./containers/diamond";
+    c-emerald.url = "path:./containers/emerald";
+    c-fluorite.url = "path:./containers/fluorite";
+    c-garnet.url = "path:./containers/garnet";
   };
 
   outputs = { self, agenix, catppuccin, nixpkgs, ... } @ inputs:
@@ -51,7 +63,7 @@
 
       mkSystem =
         if !(self ? rev) then throw "Dirty git tree detected." else
-        nixpkgs: name: arch: enableGUI: extraModules: nixpkgs.lib.nixosSystem {
+        nixpkgs: name: arch: extraModules: nixpkgs.lib.nixosSystem {
           system = arch;
           modules = [
             ({
@@ -62,14 +74,17 @@
             (./hosts + "/${name}")
           ] ++ extraModules;
           specialArgs = {
-            inherit inputs enableGUI;
+            inherit inputs;
             modules = import ./modules { lib = nixpkgs.lib; };
+            gcSecrets = builtins.fromJSON (builtins.readFile "${self}/secrets.gcrypt/shared.json");
           };
         };
     in
     {
-      nixosConfigurations."anemone" = mkSystem nixpkgs "anemone" "x86_64-linux" true [];
-      nixosConfigurations."hyacinth" = mkSystem nixpkgs "hyacinth" "x86_64-linux" true [];
+      nixosConfigurations."alyssum" = mkSystem nixpkgs "alyssum" "x86_64-linux" [];
+      nixosConfigurations."anemone" = mkSystem nixpkgs "anemone" "x86_64-linux" [];
+      nixosConfigurations."dandelion" = mkSystem nixpkgs "dandelion" "aarch64-linux" [];
+      nixosConfigurations."hyacinth" = mkSystem nixpkgs "hyacinth" "x86_64-linux" [];
 
       packages."x86_64-linux" =
         let
@@ -80,6 +95,7 @@
         in
         {
           inherit (pkgs.me) linux-lava spotify-adblock;
+          linux-lava-ccache = pkgs.me.linux-lava.override { useCcache = true; };
         };
     };
 }

hosts/alyssum/default.nix

@@ -0,0 +1,45 @@
+{ inputs, lib, modules, modulesPath, ... }: {
+  networking.hostName = "alyssum";
+  system.stateVersion = "25.11";
+  time.timeZone = "Australia/Melbourne";
+
+  age.secrets = {
+    acme_dns.file = ../../secrets/acme_dns.age;
+    passwd.file = ../../secrets/passwd.age;
+    navidrome_env.file = ../../secrets/navidrome_env.age;
+    wpa_conf = {
+      file = ../../secrets/wpa_conf.age;
+      path = "/etc/wpa_supplicant/imperative.conf";
+      symlink = false;
+    };
+  };
+
+  imports = with modules.system; [
+    (modulesPath + "/profiles/qemu-guest.nix")
+    home-manager
+
+    base
+    kernel
+    nix-stable
+    packages
+    security
+    tailscale
+
+    modules.services.nginx
+    modules.services.syncthing
+
+    inputs.c-emerald.nixosModule
+    inputs.c-garnet.nixosModule
+
+    ./filesystem.nix
+    ./kernel.nix
+    ./networking.nix
+    ./home.syncthing.nix
+    ./samba.nix
+
+    ../../users/hana
+  ];
+
+  me.environment = "headless";
+  services.syncthing.user = lib.mkForce "hana";
+}

hosts/alyssum/filesystem.nix

@@ -0,0 +1,35 @@
+{ ... }:
+let
+  bind = src: {
+    depends = [ "/nix" ];
+    device = src;
+    fsType = "none";
+    neededForBoot = true;
+    options = [ "bind" ];
+  };
+
+  mkLabelMount = label: type: {
+    device = "/dev/disk/by-label/${label}";
+    fsType = type;
+    options = [ "defaults" "relatime" ];
+  };
+  mkBtrfsMount = name: subvol: atime: mkLabelMount name "btrfs" // {
+    options = [ "autodefrag" "compress=zstd:3" "defaults" "discard=async" "space_cache=v2" "ssd" "subvol=${subvol}" (if atime then "relatime" else "noatime") ];
+  };
+  submount = mkBtrfsMount "alyssum";
+in {
+  fileSystems = {
+    "/" = {
+      device = "rootfs";
+      fsType = "tmpfs";
+      options = [ "defaults" "size=8G" "mode=755" ];
+    };
+    "/boot" = mkLabelMount "stem" "vfat";
+
+    "/flower" = mkBtrfsMount "myosotis" "/@" true;
+    "/nix" = submount "/@/nix" false;
+    "/persist" = (submount "/@/persist" true) // { neededForBoot = true; };
+    "/persist/.snapshots" = submount "/snap/persist" false;
+    "/var/log/journal" = bind "/persist/journal";
+  };
+}

hosts/alyssum/home.syncthing.nix

@@ -0,0 +1,39 @@
+{ config, lib, ... }:
+let
+  configOn = user: port: {
+    me.binds."/home/${user}/.config/syncthing" = "${user}/syncthing/config";
+    me.binds."/home/${user}/.local/state/syncthing" = "${user}/syncthing/state";
+
+    systemd.tmpfiles.rules = [ "d /flower/syncthing/${user} 700 ${user} users" ];
+
+    users.users.${user} = {
+      hashedPasswordFile = config.age.secrets.passwd.path;
+      isNormalUser = true;
+      linger = true;
+    };
+    home-manager.users.${user} = { ... }: {
+      home = {
+        username = "${user}";
+        homeDirectory = "/home/${user}";
+        stateVersion = "26.05";
+      };
+      services.syncthing = {
+        enable = true;
+        guiAddress = "[::]:${toString port}";
+        overrideDevices = false;
+        overrideFolders = false;
+        settings = {
+          options.listenAddresses = [
+            "tcp://0.0.0.0:2${toString port}"
+            "quic://0.0.0.0:2${toString port}"
+            "dynamic+https://relays.syncthing.net/endpoint"
+          ];
+          defaults.folder.path = "/flower/syncthing/${user}";
+        };
+      };
+    };
+  };
+in lib.mkMerge [
+  (configOn "kujira" 8385)
+  (configOn "cilly" 8386)
+]

hosts/alyssum/kernel.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }: {
+  boot = {
+    loader = {
+      efi.canTouchEfiVariables = true;
+      systemd-boot.enable = true;
+    };
+    initrd.availableKernelModules = [ "nvme" "xhci_pci" "usb_storage" "sd_mod" "rtsx_usb_sdmmc" ];
+    initrd.kernelModules = [ ];
+    kernelModules = [ "kvm-amd" ];
+  };
+  hardware.cpu.amd.updateMicrocode = true;
+}

hosts/alyssum/networking.nix

@@ -0,0 +1,15 @@
+{ config, ... }: {
+  networking = {
+    useDHCP = true;
+    wireless.enable = true;
+
+    interfaces.wlp1s0.useDHCP = false;
+    interfaces.wlp1s0.ipv4.addresses = [{
+      address = "192.168.1.167";
+      prefixLength = 24;
+    }];
+
+    defaultGateway = "192.168.1.1";
+    nameservers = [ "8.8.8.8" "8.8.4.4" ];
+  };
+}

hosts/alyssum/packages.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }: {
+  environment.systemPackages = with pkgs; [
+    git
+    htop
+    jq
+    neovim
+    rsync
+    sshfs
+    wget
+
+    kitty.terminfo
+  ];
+  environment.variables.EDITOR = "nvim";
+}

hosts/alyssum/samba.nix

@@ -0,0 +1,84 @@
+{ config, lib, pkgs, ... }:
+let
+  configOn = user: let
+    passwd_fname = "passwd_smb${user}";
+  in {
+    age.secrets.${passwd_fname}.file = ../../secrets/${passwd_fname}.age;
+    me.binds."/flower/smb/${user}/music" = "/flower/media/music/${user}";
+    me.binds."/flower/smb/${user}/syncthing" = "/flower/syncthing/${user}";
+
+    users.users.${user} = {
+      hashedPasswordFile = config.age.secrets.passwd.path;
+      isNormalUser = true;
+    };
+
+    system.activationScripts = {
+      init_smbpasswd.text = let
+        smbpasswd = "${config.services.samba.package}/bin/smbpasswd";
+      in ''
+        printf "$(cat ${config.age.secrets.${passwd_fname}.path})\n$(cat ${config.age.secrets.${passwd_fname}.path})\n" | ${smbpasswd} -sa ${user}
+      '';
+    };
+    services.samba.settings."${user}" = {
+      "path" = "/flower/smb/${user}";
+      "browseable" = "yes";
+      "read only" = "no";
+      "guest ok" = "no";
+      "create mask" = "0644";
+      "directory mask" = "0755";
+      "force user" = user;
+      "force group" = "users";
+      "valid users" = user;
+    };
+  };
+in lib.mkMerge [
+  (configOn "cilly")
+  (configOn "kujira")
+  {
+    me.binds."/flower/smb/kujira/opencloud" = "/flower/opencloud/data/storage/users/users/a8e29fc0-673c-4c67-be00-2442904acb43";
+
+    networking.firewall.allowPing = true;
+
+    services.samba = {
+      enable = true;
+      package = pkgs.samba4Full;
+      openFirewall = true;
+      settings = {
+        global = {
+          "server smb encrypt" = "required";
+          "workgroup" = "WORKGROUP";
+          "server string" = "smbnix";
+          "netbios name" = "smbnix";
+          "security" = "user";
+          "hosts allow" = "100.64.0.0/10 127.0.0.1 alyssum localhost";
+          "hosts deny" = "0.0.0.0/0";
+          "guest account" = "nobody";
+          "map to guest" = "bad user";
+        };
+        "public" = {
+          "path" = "/flower/smb/public";
+          "browseable" = "yes";
+          "read only" = "no";
+          "guest ok" = "yes";
+          "create mask" = "0644";
+          "directory mask" = "0755";
+          "force user" = "hana";
+          "force group" = "users";
+        };
+      };
+    };
+
+    services.samba-wsdd = {
+      enable = true;
+      openFirewall = true;
+    };
+
+    services.avahi = {
+      enable = true;
+      openFirewall = true;
+      nssmdns4 = true;
+      publish.enable = true;
+      publish.userServices = true;
+    };
+  }
+]

hosts/anemone/default.nix

@@ -5,6 +5,7 @@
 
   nixpkgs.overlays = [ inputs.neovim-nightly.overlays.default ];
   age.secrets = {
+    wg_anemone.file = ../../secrets/wg_anemone.age;
     passwd.file = ../../secrets/passwd.age;
   };
 
@@ -16,8 +17,9 @@
     bluetooth
     ccache
     corectrl
+    docker
     flatpak
-    greetd_wayland
+    greetd
     gui
     input
     kernel
@@ -26,21 +28,25 @@
     printing
     security
     snapper
+    tailscale
+    wireguard
 
     ./filesystem.nix
     ./kernel.nix
     ./networking.nix
 
-    ../../users/rin/wayland.nix
+    ../../users/rin
+
+    modules.services.syncthing
   ];
 
-  programs.hyprland.enable = true;
-  security.pam.services.hyprlock = {};
-
-  # For steam fhs-env
-  nixpkgs.config.permittedInsecurePackages = [
-    "openssl-1.1.1w"
-  ];
+  me = {
+    environment = "laptop";
+    batteryDevice = "BATT";
+    kbBacklightDevice = "asus::kbd_backlight";
+    hasFingerprint = true;
+    hidpi = true;
+  };
 
   programs.wireshark = {
     enable = true;
@@ -49,4 +55,6 @@
 
   services.fprintd.enable = true;
   services.tlp.enable = true;
+
+  programs.kdeconnect.enable = true;
 }

hosts/anemone/kernel.nix

@@ -23,17 +23,22 @@
     ];
   };
 
-  swapDevices = [{
-    device = "/persist/swapfile";
-    size = 16 * 1024;
-  }];
-
+  # swapDevices = [{
+  #   device = "/persist/swapfile";
+  #   size = 16 * 1024;
+  # }];
+  #
+  # systemd.sleep.extraConfig = ''
+  #   HibernateMode=shutdown
+  # '';
+  /*
   services.logind.lidSwitch = "suspend-then-hibernate";
   systemd.sleep.extraConfig = ''
     HibernateDelaySec=14400
     SuspendEstimationSec=3600
-    HibernateOnACPower=false
+    HibernateOnACPower=true
   '';
+  */
 
   powerManagement.cpufreq.min = 400000;
 

hosts/anemone/networking.nix

@@ -1,18 +1,4 @@
 { config, ... }: {
-  networking = {
-    #nameservers = [ "8.8.8.8" "8.8.4.4" ];
-
-    #wg-quick.interfaces.wg0.configFile = "/persist/vpn.conf";
-
-    networkmanager = {
-      enable = true;
-      #dns = "none";
-    };
-
-    extraHosts = ''
-      192.168.100.16 hyacinth
-    '';
-  };
-
+  networking.wireless.iwd.enable = true;
   environment.etc."NetworkManager/system-connections".source = "/persist/nm_system-connections";
 }

hosts/dandelion/default.nix

@@ -0,0 +1,44 @@
+{ inputs, modules, modulesPath, ... }: {
+  networking.hostName = "dandelion";
+  system.stateVersion = "23.11";
+  time.timeZone = "Australia/Melbourne";
+
+  age.secrets = {
+    acme_dns.file = ../../secrets/acme_dns.age;
+    slskd_env.file = ../../secrets/slskd_env.age;
+    wg_dandelion.file = ../../secrets/wg_dandelion.age;
+  };
+
+  imports = with modules.system; [
+    (modulesPath + "/profiles/qemu-guest.nix")
+    home-manager
+
+    base
+    kernel
+    nix-stable
+    packages
+    security
+    tailscale
+    wireguard
+
+    modules.services.banksia
+    modules.services.nginx
+    modules.services.unbound
+    modules.services.website
+
+    inputs.c-amethyst.nixosModule
+    inputs.c-beryllium.nixosModule
+    inputs.c-citrine.nixosModule
+    inputs.c-diamond.nixosModule
+    inputs.c-fluorite.nixosModule
+
+    ./filesystem.nix
+    ./kernel.nix
+    ./networking.nix
+    ./nginx.nix
+
+    ../../users/hana
+  ];
+
+  me.environment = "headless";
+}

hosts/dandelion/filesystem.nix

@@ -0,0 +1,34 @@
+{ ... }:
+let
+  bind = src: {
+    depends = [ "/nix" ];
+    device = src;
+    fsType = "none";
+    neededForBoot = true;
+    options = [ "bind" ];
+  };
+
+  mkLabelMount = label: type: {
+    device = "/dev/disk/by-label/${label}";
+    fsType = type;
+    options = [ "defaults" "relatime" ];
+  };
+  mkBtrfsMount = name: subvol: atime: mkLabelMount name "btrfs" // {
+    options = [ "autodefrag" "compress=zstd:3" "defaults" "discard=async" "space_cache=v2" "ssd" "subvol=${subvol}" (if atime then "relatime" else "noatime") ];
+  };
+  submount = mkBtrfsMount "DANDELION";
+in {
+  fileSystems = {
+    "/" = {
+      device = "rootfs";
+      fsType = "tmpfs";
+      options = [ "defaults" "size=6G" "mode=755" ];
+    };
+    "/boot" = mkLabelMount "UEFI" "vfat";
+
+    "/nix" = submount "/@/nix" false;
+    "/persist" = (submount "/@/persist" true) // { neededForBoot = true; };
+    "/persist/.snapshots" = submount "/snap/persist" false;
+    "/var/log/journal" = bind "/persist/journal";
+  };
+}

hosts/dandelion/kernel.nix

@@ -0,0 +1,10 @@
+{ ... }: {
+  boot = {
+    loader = {
+      efi.canTouchEfiVariables = true;
+      systemd-boot.enable = true;
+    };
+    initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" ];
+    initrd.kernelModules = [ "nvme" ];
+  };
+}

hosts/dandelion/networking.nix

@@ -0,0 +1,4 @@
+{ ... }: {
+  networking.useDHCP = true;
+  networking.interfaces.enp2s0.useDHCP = false;
+}

hosts/dandelion/nginx.nix

@@ -0,0 +1,8 @@
+{ ... }: {
+  services.nginx.virtualHosts."muse.lava.moe" = {
+    useACMEHost = "lava.moe";
+    forceSSL = true;
+    locations."/".return = "404";
+    locations."/share/".proxyPass = "http://[fd0d:2::5:2]:4533";
+  };
+}

hosts/dandelion/packages.nix

@@ -0,0 +1,14 @@
+{ pkgs, ... }: {
+  environment.systemPackages = with pkgs; [
+    git
+    htop
+    jq
+    neovim
+    rsync
+    sshfs
+    wget
+
+    kitty.terminfo
+  ];
+  environment.variables.EDITOR = "nvim";
+}

hosts/hyacinth/default.nix

@@ -3,11 +3,10 @@
   system.stateVersion = "21.11";
   time.timeZone = "Australia/Melbourne";
 
-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
   nixpkgs.overlays = [ inputs.neovim-nightly.overlays.default ];
   age.secrets = {
     passwd.file = ../../secrets/passwd.age;
-    wg_hyacinth.file = ../../secrets/wg_blossom.age;
+    wg_hyacinth.file = ../../secrets/wg_hyacinth.age;
     wpa_conf.file = ../../secrets/wpa_conf.age;
   };
   imports = with modules.system; [
@@ -19,9 +18,9 @@
     bluetooth
     ccache
     corectrl
+    docker
     flatpak
-    #greetd_xorg
-    greetd_wayland
+    greetd
     gui
     input
     kernel
@@ -30,24 +29,19 @@
     printing
     security
     snapper
-    virtualisation
+    tailscale
+    wireguard
 
-    modules.services.postgres
+    modules.services.syncthing
 
     ./filesystem.nix
     ./kernel.nix
     ./networking.nix
     ./packages.nix
 
-    #../../users/rin/xorg.nix
-    ../../users/rin/wayland.nix
+    ../../users/rin
   ];
-  services.postgresql.ensureDatabases = [ "barista" "barista-dev" ];
-  programs.hyprland.enable = true;
   systemd.services.nix-daemon.environment.TMPDIR = "/nix/tmp";
 
-  # For steam fhs-env
-  nixpkgs.config.permittedInsecurePackages = [
-    "openssl-1.1.1w"
-  ];
+  me.hasBluetooth = true;
 }

hosts/hyacinth/filesystem.nix

@@ -15,7 +15,7 @@ in
     "/" = {
       device = "rootfs";
       fsType = "tmpfs";
-      options = [ "defaults" "size=8G" "mode=755" ];
+      options = [ "defaults" "size=24G" "mode=755" ];
     };
     "/boot" = mkLabelMount "CUP" "vfat";
 

hosts/hyacinth/kernel.nix

@@ -13,12 +13,8 @@
     ];
     kernelPackages = lib.mkForce (pkgs.linuxPackagesFor pkgs.me.linux-lava);
   };
-  services.xserver.xrandrHeads = [{
-    output = "DP-1";
-    primary = true;
-    monitorConfig = ''
-      Modeline "2560x1440_144.00"  808.75  2560 2792 3072 3584  1440 1443 1448 1568 -hsync +vsync
-      Option "PreferredMode" "2560x1440_144.00"
-    '';
-  }];
+  hardware.amdgpu.overdrive = {
+    enable = true;
+    ppfeaturemask = "0xffffffff";
+  };
 }

hosts/hyacinth/networking.nix

@@ -3,12 +3,13 @@
   networking = {
     useDHCP = true;
     interfaces.enp5s0.useDHCP = false;
+    interfaces.enp5s0.wakeOnLan.enable = true;
 
     interfaces.enp5s0.ipv4.addresses = [{
-      address = "192.168.0.151";
+      address = "192.168.1.201";
       prefixLength = 24;
     }];
-    defaultGateway = "192.168.0.1";
+    defaultGateway = "192.168.1.1";
     nameservers = [ "8.8.8.8" "8.8.4.4" ];
 
     extraHosts = ''

hosts/hyacinth/packages.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }: {
   environment.systemPackages = with pkgs; [
-    android-studio
-    jetbrains.idea-community-bin
+    discord
+    jetbrains.idea
     texliveFull
   ];
 }

modules/binds.nix

@@ -0,0 +1,13 @@
+{ config, lib, ...}: {
+  imports = [ ./options.nix ];
+  fileSystems = lib.mapAttrs (dest: key: let
+    target = if (lib.strings.hasPrefix "/" key)
+      then key
+      else "/persist/binds/${key}";
+  in {
+    depends = [ "/persist" ];
+    device = target;
+    fsType = "none";
+    options = [ "bind" ];
+  }) config.me.binds;
+}

modules/default.nix

@@ -14,15 +14,21 @@ let
     }) paths
   );
 in {
+  binds = ./binds.nix;
+  options = ./options.nix;
   services = mkAttrsFromPaths [
+    ./services/banksia.nix
     ./services/jellyfin.nix
     ./services/nginx.nix
     ./services/postgres.nix
     ./services/sonarr.nix
     ./services/synapse.nix
+    ./services/syncthing.nix
     ./services/tmptsync.nix
+    ./services/transmission.nix
     ./services/unbound.nix
     ./services/vaultwarden.nix
+    ./services/website.nix
   ];
   system = mkAttrsFromPaths [
     ./system/aagl.nix
@@ -31,9 +37,9 @@ in {
     ./system/bluetooth.nix
     ./system/ccache.nix
     ./system/corectrl.nix
+    ./system/docker.nix
     ./system/flatpak.nix
-    ./system/greetd_wayland.nix
-    ./system/greetd_xorg.nix
+    ./system/greetd.nix
     ./system/gui.nix
     ./system/home-manager.nix
     ./system/input.nix
@@ -44,17 +50,16 @@ in {
     ./system/printing.nix
     ./system/security.nix
     ./system/snapper.nix
-    ./system/transmission.nix
+    ./system/tailscale.nix
     ./system/virtualisation.nix
     ./system/wireguard.nix
   ];
   user = mkAttrsFromPaths [
-    ./user/bspwm.nix
     ./user/catppuccin.nix
+    ./user/comma.nix
     ./user/direnv.nix
     ./user/dunst.nix
     ./user/eww.nix
-    ./user/eww-wayland.nix
     ./user/git.nix
     ./user/gpg.nix
     ./user/hypridle.nix
@@ -65,18 +70,11 @@ in {
     ./user/neovim-minimal.nix
     ./user/npm.nix
     ./user/obs.nix
-    ./user/packages-rin.nix
-    ./user/pass.nix
-    ./user/picom.nix
-    ./user/polybar.nix
     ./user/rofi.nix
-    ./user/rofi-wayland.nix
     ./user/sessionVariables.nix
     ./user/spicetify.nix
-    ./user/sxhkd.nix
     ./user/theming.nix
     ./user/xdg.nix
-    ./user/xorg.nix
     ./user/zsh.nix
   ];
 }

modules/options.nix

@@ -0,0 +1,53 @@
+{ config, lib, ... }:
+let
+  inherit (lib)
+    mkOption
+    types;
+in {
+  options.me = {
+    environment = mkOption {
+      type = types.enum [ "desktop" "laptop" "headless" ];
+      default = "desktop";
+    };
+
+    hasFingerprint = mkOption {
+      type = types.bool;
+      default = false;
+    };
+
+    gui = mkOption {
+      type = types.bool;
+      default = config.me.environment != "headless";
+    };
+
+    batteryDevice = mkOption {
+      type = with types; nullOr (uniq str);
+      default = null;
+    };
+
+    kbBacklightDevice = mkOption {
+      type = with types; nullOr (uniq str);
+      default = null;
+    };
+
+    hasBluetooth = mkOption {
+      type = types.bool;
+      default = config.me.environment == "laptop";
+    };
+
+    hasWifi = mkOption {
+      type = types.bool;
+      default = config.me.environment == "laptop";
+    };
+
+    hidpi = mkOption {
+      type = types.bool;
+      default = false;
+    };
+
+    binds = lib.mkOption {
+      type = with lib.types; attrsOf str;
+      default = {};
+    };
+  };
+}

modules/services/banksia.nix

@@ -0,0 +1,11 @@
+# TODO ^^
+{ ... }: {
+  services.nginx.virtualHosts = {
+    "banksia.lava.moe" = {
+      useACMEHost = "lava.moe";
+      forceSSL = true;
+      locations."/".return = "302 https://lab.lava.moe/cilly/Banksia";
+      locations."/api".proxyPass = "http://localhost:8080/";
+    };
+  };
+}

modules/services/nginx.nix

@@ -1,18 +1,21 @@
-{ config, inputs, ... }: {
+{ config, ... }: {
   networking.firewall.allowedTCPPorts = [ 80 443 ];
   security.acme = {
     acceptTerms = true;
+    defaults = {
       email = "me@lava.moe";
-    certs."lava.moe" = {
       group = "nginx";
-      domain = "lava.moe";
+      dnsProvider = "cloudflare";
+      environmentFile = config.age.secrets."acme_dns".path;
+    };
+    certs."lava.moe" = {
       extraDomainNames = [
         "*.lava.moe"
         "*.local.lava.moe"
       ];
-      dnsProvider = "cloudflare";
-      credentialsFile = config.age.secrets."acme_dns".path;
     };
+    certs."cilly.moe" = {};
+    certs."cilly.dev" = {};
   };
 
   services.nginx = {
@@ -21,28 +24,5 @@
     recommendedOptimisation = true;
     recommendedGzipSettings = true;
     recommendedProxySettings = true;
-
-    virtualHosts = {
-      "lava.moe" = {
-        useACMEHost = "lava.moe";
-        forceSSL = true;
-        root = inputs.website.outPath;
-      };
-      "cdn.lava.moe" = {
-        useACMEHost = "lava.moe";
-        forceSSL = true;
-        root = "/persist/cdn";
-      };
-      "_" = {
-        default = true;
-        addSSL = true;
-        # TODO generate this somewhere
-        sslCertificate = "/persist/fakeCerts/fake.crt";
-        sslCertificateKey = "/persist/fakeCerts/fake.key";
-        extraConfig = ''
-          return 444;
-        '';
-      };
-    };
   };
 }

modules/services/postgres.nix

@@ -8,6 +8,7 @@ in {
   services.postgresql = {
     enable = true;
     dataDir = dir;
+    # TODO: broken :3
     package = pkgs.postgresql_13;
     authentication = lib.mkOverride 10 ''
       #type  database  DBuser  origin-address      auth-method

modules/services/syncthing.nix

@@ -0,0 +1,23 @@
+{ config, ... }:
+let
+  dir = "/persist/shared/.syncthing";
+  user = if config.me.gui then "rin" else "hana";
+  uid = toString config.users.users."${user}".uid;
+  gid = toString config.users.groups.users.gid;
+in
+{
+  systemd.tmpfiles.rules = [
+    "d ${dir}/config 700 ${uid} ${gid}"
+    "d ${dir}/data 700 ${uid} ${gid}"
+  ];
+  systemd.services.syncthing.environment.STNODEFAULTFOLDER = "true";
+  services.syncthing = {
+    enable = true;
+    openDefaultPorts = true;
+    user = user;
+    group = "users";
+    dataDir = "/persist/shared/.syncthing/data";
+    configDir = "/persist/shared/.syncthing/config";
+    guiAddress = if config.me.gui then "127.0.0.1:8384" else ":8384";
+  };
+}

modules/services/transmission.nix

@@ -5,13 +5,6 @@
     downloadDirPermissions = "775";
     openFirewall = true;
     settings = {
-      alt-speed-down = 512;
-      alt-speed-enabled = true;
-      alt-speed-time-begin = 360;
-      alt-speed-time-day = 127;
-      alt-speed-time-enabled = true;
-      alt-speed-time-end = 1380;
-      alt-speed-up = 256;
       download-dir = "/persist/transmission/Downloads";
       incomplete-dir = "/persist/transmission/.incomplete";
       ratio-limit-enabled = true;

modules/services/unbound.nix

@@ -1,8 +1,17 @@
-{ inputs, ... }:
+{ inputs, pkgs, gcSecrets, ... }:
 let
   dir = "/persist/unbound";
+
+  converted = pkgs.runCommand "stevenblack-hosts-unbound" {} ''
+    echo "server:" > "$out"
+    grep '^0\.0\.0\.0' "${inputs.stevenblack-hosts}/hosts" | awk '{print "local-zone: \""$2"\" always_refuse"}' | tail -n +2 >> "$out"
+  '';
 in {
-  networking.firewall.interfaces.wlan0 = {
+  networking.firewall.interfaces."ve-+" = {
+    allowedUDPPorts = [ 53 853 ];
+    allowedTCPPorts = [ 53 853 ];
+  };
+  networking.firewall.interfaces.wg0 = {
     allowedUDPPorts = [ 53 853 ];
     allowedTCPPorts = [ 53 853 ];
   };
@@ -16,17 +25,27 @@ in {
         name = ".";
         forward-tls-upstream = true;
         forward-addr = [
+          "2606:4700:4700::1111@853#cloudflare-dns.com"
+          "2606:4700:4700::1001@853#cloudflare-dns.com"
+          "2001:4860:4860::8888@853#dns.google"
+          "2001:4860:4860::8844@853#dns.google"
           "1.1.1.1@853#cloudflare-dns.com"
           "1.0.0.1@853#cloudflare-dns.com"
+          "8.8.8.8@853#dns.google"
+          "8.8.4.4@853#dns.google"
         ];
       }];
 
       server = {
-        interface = [ "0.0.0.0" ];
+        interface = [ "0.0.0.0" "::0" ];
         access-control = [
           "127.0.0.1/8      allow"
           "10.0.0.0/8       allow"
+          "100.64.0.0/10    allow"
           "192.168.100.0/24 allow"
+          "fd0d::/16        allow"
+          "fd7a:115c:a1e0::/48 allow"
+          "${gcSecrets.wireguard.ipv6Subnet}:/80 allow"
         ];
         domain-insecure = [ "\"local.lava.moe\"" ];
         local-zone = [ "\"warden.local.lava.moe.\" redirect" ];
@@ -35,7 +54,7 @@ in {
         ];
       };
 
-      include = "${inputs.hosts-blocklists}/unbound/unbound.blacklist.conf";
+      include = "${converted}";
     };
   };
 

modules/services/website.nix

@@ -0,0 +1,43 @@
+{ inputs, pkgs, ... }: let
+  pastel = inputs.pastel.packages.${pkgs.system}.default;
+in {
+  services.nginx.virtualHosts = {
+    "cilly.moe" = {
+      useACMEHost = "cilly.moe";
+      forceSSL = true;
+      root = pastel.outPath;
+    };
+    "cilly.dev" = {
+      useACMEHost = "cilly.dev";
+      forceSSL = true;
+      root = pastel.outPath;
+    };
+    "lava.moe" = {
+      useACMEHost = "lava.moe";
+      forceSSL = true;
+      root = inputs.website.outPath;
+    };
+    "cdn.lava.moe" = {
+      useACMEHost = "lava.moe";
+      forceSSL = true;
+      extraConfig = ''
+        return 301 https://sh.lava.moe$request_uri;
+      '';
+    };
+    "sh.lava.moe" = {
+      useACMEHost = "lava.moe";
+      forceSSL = true;
+      root = "/persist/cdn";
+    };
+    "_" = {
+      default = true;
+      addSSL = true;
+      # TODO generate this somewhere
+      sslCertificate = "/persist/fakeCerts/fake.crt";
+      sslCertificateKey = "/persist/fakeCerts/fake.key";
+      extraConfig = ''
+        return 444;
+      '';
+    };
+  };
+}

modules/system/base.nix

@@ -1,4 +1,6 @@
-{ config, enableGUI, inputs, modules, overlays, ... }: {
+{ config, inputs, modules, ... }: {
+  imports = [ modules.binds modules.options ];
+
   environment.etc = {
     "machine-id".source = "/persist/machine-id";
     "ssh/ssh_host_rsa_key".source = "/persist/ssh_host_rsa_key";
@@ -9,6 +11,8 @@
   environment.pathsToLink = [ "/share/zsh" ];
 
   i18n.defaultLocale = "en_AU.UTF-8";
+  i18n.extraLocales = [ "en_GB.UTF-8/UTF-8" ];
+
   users.mutableUsers = false;
 
   system = {
@@ -19,6 +23,5 @@
     };
   };
   nix.registry.config.flake = inputs.self;
-  nix.registry.nixpkgs.flake = inputs.nixpkgs;
   nix.registry.shells.flake = inputs.self;
 }

modules/system/corectrl.nix

@@ -1,9 +1,5 @@
 { ... }: {
   programs.corectrl = {
     enable = true;
-    gpuOverclock = {
-      enable = true;
-      ppfeaturemask = "0xffffffff";
-    };
   };
 }

modules/system/docker.nix

@@ -0,0 +1,13 @@
+{ pkgs, ... }: {
+  virtualisation.docker = {
+    enable = true;
+    storageDriver = "btrfs";
+    # rootless = {
+    #   enable = true;
+    #   setSocketVariable = true;
+    # };
+  };
+  environment.systemPackages = [
+    pkgs.docker-compose
+  ];
+}

modules/system/greetd.nix

@@ -0,0 +1,18 @@
+{ pkgs, ... }: {
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.tuigreet}/bin/tuigreet --remember --asterisks --time --cmd 'zsh -c \"source $HOME/.config/zsh/.zshrc && Hyprland > $XDG_RUNTIME_DIR/Hyprland.out\"'";
+        user = "greeter";
+      };
+
+      initial_session = {
+        command = "${pkgs.writeShellScript "launch.sh" ''
+          zsh -c "source $HOME/.config/zsh/.zshrc && Hyprland > \"$XDG_RUNTIME_DIR/Hyprland.out\""
+        ''}";
+        user = "rin";
+      };
+    };
+  };
+}

modules/system/greetd_wayland.nix

@@ -1,21 +0,0 @@
-{ pkgs, lib, ... }: {
-  services.greetd = {
-    enable = true;
-    settings = {
-      default_session = {
-        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --remember --asterisks --time --cmd 'zsh -c \"source $HOME/.config/zsh/.zshrc && Hyprland > $XDG_RUNTIME_DIR/Hyprland.out\"'";
-        user = "greeter";
-      };
-
-      initial_session = {
-        command = "Hyprland > \"$XDG_RUNTIME_DIR/Hyprland.out\"";
-        user = "rin";
-      };
-    };
-  };
-
-  services.xserver = {
-    autorun = false;
-    displayManager.startx.enable = true;
-  };
-}

modules/system/greetd_xorg.nix

@@ -1,16 +0,0 @@
-{ pkgs, lib, ... }: {
-  services.greetd = {
-    enable = true;
-    settings = {
-      default_session = {
-        command = "${pkgs.greetd.tuigreet}/bin/tuigreet --remember --asterisks --time --cmd 'zsh -c \"source $HOME/.config/zsh/.zshrc && startx\"'";
-        user = "greeter";
-      };
-    };
-  };
-
-  services.xserver = {
-    autorun = false;
-    displayManager.startx.enable = true;
-  };
-}

modules/system/gui.nix

@@ -15,7 +15,6 @@
       hanazono
       noto-fonts
       noto-fonts-cjk-sans
-      noto-fonts-extra
       open-sans
       twemoji-color-font
       unifont
@@ -26,4 +25,7 @@
     displayManager.lightdm.enable = lib.mkForce false;
     desktopManager.xterm.enable = false;
   };
+
+  programs.hyprland.enable = true;
+  security.pam.services.hyprlock = {};
 }

modules/system/home-manager.nix

@@ -1,4 +1,4 @@
-{ config, enableGUI, inputs, modules, ... }: {
+{ config, inputs, modules, ... }: {
   imports = [
     inputs.home-manager.nixosModules.home-manager
   ];
@@ -6,8 +6,14 @@
     useGlobalPkgs = true;
     useUserPackages = true;
     extraSpecialArgs = {
-      inherit enableGUI inputs modules;
+      inherit inputs modules;
       sysConfig = config;
     };
+    sharedModules = [
+      {
+        imports = [ modules.options ];
+        config.me = config.me;
+      }
+    ];
   };
 }

modules/system/input.nix

@@ -6,14 +6,19 @@
         "-arinterval 15"
       ];
     };
-    xkb.options = "caps:escape";
   };
-  services.libinput = {
+  services.keyd = {
     enable = true;
-    mouse = {
-      accelSpeed = "0";
-      accelProfile = "flat";
+    keyboards = {
+      default = {
+        ids = [ "*" ];
+        settings = {
+          main = {
+            capslock = "esc";
+            esc = "capslock";
+          };
+        };
+      };
     };
   };
-  console.useXkbConfig = true;
 }

modules/system/nix-stable.nix

@@ -1,5 +1,7 @@
 { config, lib, pkgs, ... }: {
   nix = {
+    package = pkgs.nixVersions.latest;
+
     settings = rec {
       substituters = [
         "https://cache.nixos.org?priority=10"
@@ -17,4 +19,5 @@
     '';
   };
   nixpkgs.config.allowUnfree = true;
+  programs.nh.enable = true;
 }

modules/system/nix.nix

@@ -1,6 +1,7 @@
-{ config, lib, pkgs, ... }: {
+{ config, inputs, pkgs, ... }: {
   nix = {
-    package = pkgs.nixVersions.git;
+    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
+    package = pkgs.nixVersions.latest;
 
     settings = rec {
       extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
@@ -23,4 +24,5 @@
     '';
   };
   nixpkgs.config.allowUnfree = true;
+  programs.nh.enable = true;
 }

modules/system/packages-gui.nix

@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }: {
+  config = lib.mkIf config.me.gui {
+    environment.systemPackages = with pkgs; [
+      android-tools
+      gparted
+      nautilus
+    ];
+    hardware.graphics.extraPackages = with pkgs; [
+      intel-vaapi-driver
+      libva-vdpau-driver
+      libvdpau-va-gl
+    ];
+    hardware.opentabletdriver.enable = true;
+    hardware.keyboard.qmk.enable = true;
+    programs.steam = {
+      enable = true;
+      package = pkgs.steam.override {
+        extraPkgs = pkgs: with pkgs; [
+          gsettings-desktop-schemas
+        ];
+      };
+    };
+    services.dbus.packages = [ pkgs.dconf pkgs.gcr ];
+    services.gnome.sushi.enable = true;
+  };
+}

modules/system/packages.nix

@@ -1,11 +1,14 @@
-{ config, enableGUI, lib, pkgs, ... }: {
+{ pkgs, ... }: {
+  imports = [ ./packages-gui.nix ];
   environment.systemPackages = with pkgs; [
-    comma
-    ecryptfs
+    # ecryptfs
     efibootmgr
+    fd
     git
+    git-crypt
     htop
     jq
+    kitty.terminfo
     libarchive
     lf
     msr-tools
@@ -13,33 +16,10 @@
     neovim
     nfs-utils
     ntfs3g
-    sshfs
+    ripgrep
     rsync
+    sshfs
     wget
-  ] ++ lib.optionals enableGUI [
-    gparted
-    nautilus
   ];
   environment.variables.EDITOR = "nvim";
 }
-// (if !enableGUI then {} else {
-  programs.adb.enable = true;
-  hardware.graphics.extraPackages = with pkgs; [
-    vaapiIntel
-    vaapiVdpau
-    libvdpau-va-gl
-  ];
-  programs.light.enable = true;
-  hardware.opentabletdriver.enable = true;
-  hardware.keyboard.qmk.enable = true;
-  programs.steam = {
-    enable = true;
-    package = pkgs.steam.override {
-      extraPkgs = pkgs: with pkgs; [
-        gsettings-desktop-schemas
-      ];
-    };
-  };
-  services.dbus.packages = [ pkgs.dconf pkgs.gcr ];
-  services.gnome.sushi.enable = true;
-})

modules/system/security.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
   networking.firewall =
   let
     iptables = "${pkgs.iptables}/bin/iptables";
@@ -53,5 +53,33 @@
         }
       ];
     };
+    pam = lib.mkIf (config.me.environment != "headless") {
+      u2f = {
+        enable = true;
+        settings = {
+          cue = true;
+          pinverification = 1;
+        };
+      };
+      services.doas.rules.auth = {
+        u2f.settings.pinverification = lib.mkForce 0;
+        u2f_int = lib.mkMerge [
+          {
+            enable = true;
+            order = config.security.pam.services.doas.rules.auth.u2f.order + 1;
+            control = "sufficient";
+            modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so";
+            inherit (config.security.pam.u2f) settings;
+          }
+          {
+            settings = lib.mkForce {
+              interactive = true;
+              pinverification = 0;
+              userpresence = 0;
+            };
+          }
+        ];
+      };
+    };
   };
 }

modules/system/tailscale.nix

@@ -0,0 +1,13 @@
+{ config, lib, ... }: {
+  age.secrets.tailscale_auth.file = ../../secrets/tailscale_auth.age;
+  me.binds."/var/lib/tailscale" = "tailscale";
+  networking.firewall.trustedInterfaces = [ "tailscale0" ];
+  networking.firewall.allowedUDPPorts = lib.mkIf (config.me.environment == "headless") [ 123 ];
+
+  services.tailscale = {
+    enable = true;
+    authKeyFile = config.age.secrets.tailscale_auth.path;
+    openFirewall = true;
+    useRoutingFeatures = if config.me.environment == "headless" then "both" else "client";
+  };
+}

modules/system/wireguard.nix

@@ -1,13 +1,11 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, gcSecrets, ... }:
 let
-  port = 51820;
-  serverName = "sugarcane";
-  serverInterface = "ens3";
-  serverIp = "51.79.240.130";
+  port = 51801;
+  serverName = "dandelion";
+  serverInterface = "enp0s6";
+  serverIp = gcSecrets.wireguard.gateway;
 
   forwarding = {
-    "80" = [ "10.100.0.2" "80" ];
-    "443" = [ "10.100.0.2" "443" ];
     "22727" = [ "10.100.0.3" "7777" ];
   };
 
@@ -20,52 +18,61 @@ let
       in ''
         ${pkgs.iptables}/bin/iptables -${type} PREROUTING -t nat -i ${serverInterface} -p tcp --dport ${sport} -j DNAT --to ${dest}:${dport}
         ${pkgs.iptables}/bin/iptables -${type} FORWARD -p tcp -d ${dest} --dport ${dport} -j ACCEPT
+        ${pkgs.iptables}/bin/iptables -${type} PREROUTING -t nat -i ${serverInterface} -p udp --dport ${sport} -j DNAT --to ${dest}:${dport}
+        ${pkgs.iptables}/bin/iptables -${type} FORWARD -p udp -d ${dest} --dport ${dport} -j ACCEPT
       '') forwarding
     );
 
-  routeBypass = {
-    caramel = {
-      gateway = "192.168.100.1";
-      interface = "wlan0";
-      routes = [
-        serverIp
-      ];
-    };
-    hyacinth = {
-      gateway = "192.168.100.1";
-      interface = "enp5s0";
-      routes = [
-        serverIp
-      ];
-    };
-  };
-
   clients = {
-    caramel = {
-      publicKey = "VDqcpS0lJzFgwikj61MJ1xc9P8Cuq0NXa+Hc+etn2iA=";
-      allowedIPs = [ "10.100.0.2/32" ];
-    };
     hyacinth = {
       publicKey = "6nVhazYdmC15A/nke9VrqIg3sOBVOmqj4GEsyBq7MVo=";
-      allowedIPs = [ "10.100.0.3/32" ];
+      allowedIPs = [ "10.100.0.3/32" "${gcSecrets.wireguard.ipv6Subnet}:3" "fd0d::3" ];
+      interfaces = {
+        wg0 = { peers = [ server6OnlyPeer ]; };
+        wg1 = { peers = [ serverPeer ]; autostart = false; };
+        wg2 = { peers = [ serverLocalOnlyPeer ]; autostart = false; };
+      };
+    };
+    anemone = {
+      publicKey = "px5+JNdAmqBvUC++DhiJrUBRAr+BYP6iYVt4sbhPTWY=";
+      allowedIPs = [ "10.100.0.4/32" "${gcSecrets.wireguard.ipv6Subnet}:4" "fd0d::4" ];
+      interfaces = {
+        wg0 = { peers = [ server6OnlyPeer ]; };
+        wg1 = { peers = [ serverPeer ]; autostart = false; };
+        wg2 = { peers = [ serverLocalOnlyPeer ]; autostart = false; };
+      };
+    };
+    hibiscus = {
+      publicKey = "vQ5a2KMrwi7RCRsD0yvog+n35vQYFuvwiPn+W4lbRBw=";
+      allowedIPs = [ "10.100.0.5/32" "${gcSecrets.wireguard.ipv6Subnet}:5" "fd0d::5" ];
+      interfaces = {
+        wg0 = { peers = [ server6OnlyPeer ]; };
+        wg1 = { peers = [ serverPeer ]; autostart = false; };
+        wg2 = { peers = [ serverLocalOnlyPeer ]; autostart = false; };
+      };
+    };
+    hazel = {
+      publicKey = "0zruTndObzHo+b1rbOuTsxCU97epygZycxXS/lgUHUc=";
+      allowedIPs = [ "10.100.0.21/32" "${gcSecrets.wireguard.ipv6Subnet}:21" "fd0d::21" ];
+      interfaces = {
+        wg0 = {
+          dns = [ "::1" "127.0.0.1" ];
+          peers = [ serverLocalOnlyPeer ];
         };
-    strawberry = {
-      publicKey = "Fkcp/VSN4Dkhly8V4hskF4lnDviA7VZHCnWf7OliFCg=";
-      allowedIPs = [ "10.100.0.4/32" ];
       };
-    maple = {
-      publicKey = "kPw8hpANygfz83Oi/l+iCVYalV2zfs7fhkccjoGG2Do=";
-      allowedIPs = [ "10.100.0.5/32" ];
     };
   };
 
-  clientPeers = builtins.attrValues clients;
-  serverPeer = {
+  clientPeers = builtins.map (client: builtins.removeAttrs client [ "interfaces" ]) (builtins.attrValues clients);
+  serverPeerWith = ips: {
     publicKey = "3ugIk2tQZXjAH9/95s63ld2WNUHQrd4Mz5jzbln6oj0=";
-    allowedIPs = [ "0.0.0.0/0" ];
+    allowedIPs = ips;
     endpoint = "${serverIp}:${toString port}";
     persistentKeepalive = 25;
   };
+  serverPeer = serverPeerWith [ "0.0.0.0/0" "::/0" ];
+  server6OnlyPeer = serverPeerWith [ "10.100.0.0/24" "::/0" ];
+  serverLocalOnlyPeer = serverPeerWith [ "10.100.0.0/24" "fd0d::/16" ];
 
   serverConfig = {
     nat = {
@@ -79,7 +86,7 @@ let
     };
 
     wireguard.interfaces.wg0 = {
-      ips = [ "10.100.0.1/24" ];
+      ips = [ "10.100.0.1/24" "${gcSecrets.wireguard.ipv6Subnet}:1" "fd0d::1" ];
       listenPort = port;
 
       postSetup = ''
@@ -97,33 +104,24 @@ let
   };
 
   clientConfig = {
-    wireguard.interfaces.wg0 =
+    wg-quick.interfaces =
     let
       client = clients."${config.networking.hostName}";
-      routes = routeBypass."${config.networking.hostName}";
-      mapRoutes = type: lib.concatMapStringsSep "\n" (r: "${pkgs.iproute2}/bin/ip route ${type} ${r} via ${routes.gateway} dev ${routes.interface}") routes.routes;
-    in {
-      ips = client.allowedIPs;
-      listenPort = port;
-
-      postSetup = ''
-        ${mapRoutes "add"}
-        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
-      '';
-
-      postShutdown = ''
-        ${mapRoutes "del"}
-        ${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -s 10.100.0.0/24 -o ${serverInterface} -j MASQUERADE
-      '';
-
+    in
+      builtins.mapAttrs (interface: conf: {
+        address = client.allowedIPs;
+        dns = [ "fd0d::1" "10.100.0.1" ];
         privateKeyFile = config.age.secrets."wg_${config.networking.hostName}".path;
-      peers = [ serverPeer ];
-    };
+      } // conf) client.interfaces;
   };
 in {
+  boot.kernel.sysctl = lib.mkIf (config.networking.hostName == serverName) ({
+    "net.ipv6.conf.all.forwarding" = true;
+    "net.ipv6.conf.default.forwarding" = true;
+  });
   networking =
     lib.mkMerge [
       (lib.mkIf (config.networking.hostName == serverName) serverConfig)
-      (lib.mkIf (builtins.hasAttr config.networking.hostName clients) clientConfig)
+      (lib.mkIf (config.networking.hostName != serverName) clientConfig)
     ];
 }

modules/user/bspwm.nix

@@ -1,19 +0,0 @@
-# Depends on eww
-{ config, pkgs, ... }: {
-  xsession.windowManager.bspwm = {
-    enable = true;
-    monitors = { "DP-1" = [ "1" "2" "3" "4" "5" "6" "7" "8" "9" "0"]; };
-    settings = {
-      window_gap = 10;
-      border_width = 0;
-      split_ratio = 0.5;
-      top_padding = 0;
-    };
-    extraConfig = ''
-      ${pkgs.feh}/bin/feh --no-fehbg --bg-fill ~/Pictures/Wallpapers/current
-
-      ${pkgs.procps}/bin/pkill -SIGINT eww
-      ${pkgs.eww}/bin/eww open linebar
-    '';
-  };
-}

modules/user/catppuccin.nix

@@ -1,4 +1,4 @@
-{ config, inputs, lib, ... }: {
+{ config, inputs, lib, pkgs, ... }: {
   imports = [
     inputs.catppuccin.homeManagerModules.catppuccin
   ];
@@ -14,18 +14,62 @@
 
   config = {
     catppuccin = {
-      accent = "maroon";
-      flavor = "mocha";
+      accent = lib.mkDefault "pink";
+      flavor = lib.mkDefault "mocha";
       kitty.enable = true;
       gtk.enable = true;
       hyprlock.enable = true;
-      kvantum.enable = true;
       nvim.enable = true;
     };
-    qt = {
-      enable = true;
-      style.name = "kvantum";
-      platformTheme.name = "kvantum";
+
+    specialisation = {
+      light.configuration.catppuccin.flavor = "latte";
+      dark.configuration.catppuccin.flavor = "mocha";
     };
+
+    home.packages = [(pkgs.writeShellScriptBin "theme" ''
+      last_path="$HOME/.local/state/last-theme"
+      target="$1"
+      if [ "$target" == "get_last" ]; then
+        if [ ! -e "$last_path" ]; then
+          echo "no last theme found; assuming dark" >&2
+          target="dark"
+        else
+          target=$(cat "$last_path" | tr -d "\n")
+        fi
+        echo "$target"
+        exit 0
+      fi
+      if [ "$target" == "restore" ]; then
+        echo "restoring theme"
+        if [ ! -e "$last_path" ]; then
+          echo "no last theme found; assuming dark" >&2
+          target="dark"
+        else
+          target=$(cat "$last_path" | tr -d "\n")
+        fi
+      fi
+      if [ "$target" != "dark" ] && [ "$target" != "light" ]; then
+        echo "invalid theme, valid values: [dark, light, restore]"
+        exit 1
+      fi
+      current="$HOME/.local/state/home-manager/gcroots/current-home/"
+      cached="$HOME/.local/state/last-parent-specialisation"
+      if [ -d "$current/specialisation" ]; then
+        if [ -d "$cached" ]; then
+          rm -f "$cached"
+        fi
+        ln -sf "$(readlink -f $current)" "$cached"
+      fi
+
+      if [ ! -d "$cached/specialisation" ]; then
+        echo "no specialisations found"
+        exit 1
+      fi
+
+      "$cached/specialisation/$target/activate"
+
+      echo "$target" > "$last_path"
+    '')];
   };
 }

modules/user/comma.nix

@@ -0,0 +1,7 @@
+{ inputs, ... }: {
+  imports = [
+    inputs.nix-index-database.homeModules.default
+  ];
+  programs.nix-index.enable = true;
+  programs.nix-index-database.comma.enable = true;
+}

modules/user/direnv.nix

@@ -5,7 +5,7 @@
       enable = true;
     };
   };
-  programs.git.extraConfig.core.excludesFile = ".envrc";
+  programs.git.settings.core.excludesFile = ".envrc";
   # We can't use .source since hm manages this file too
   xdg.configFile."direnv/direnvrc".text = builtins.readFile ../../res/direnvrc;
   home.activation = {

modules/user/eww-wayland.nix

@@ -1,21 +0,0 @@
-{ config, pkgs, ... }:
-let
-  res = pkgs.stdenvNoCC.mkDerivation {
-    pname = "eww-wayland-config";
-    version = "1.0.0";
-    dontUnpack = true;
-    installPhase = ''
-      cp -r ${../../res/eww-wayland} $out
-      substituteInPlace $out/eww.scss \
-        --replace-warn "EWW_BACKGROUND" "${config.catppuccin.hexcolors.crust}" \
-        --replace-warn "EWW_TEXT" "${config.catppuccin.hexcolors.text}" \
-        --replace-warn "EWW_ACCENT" "${config.catppuccin.hexcolors.${config.catppuccin.accent}}"
-    '';
-  };
-in {
-  home.packages = with pkgs; [ socat ];
-  programs.eww = {
-    enable = true;
-    configDir = res;
-  };
-}

modules/user/eww.nix

@@ -1,8 +1,29 @@
-# Depends on bspwm
-{ pkgs, ... }: {
-  home.packages = with pkgs; [ xtitle ];
+{ config, lib, pkgs, ... }:
+let
+  inherit (lib) boolToString defaultTo;
+  res = pkgs.stdenvNoCC.mkDerivation {
+    pname = "eww-wayland-config";
+    version = "1.0.0";
+    dontUnpack = true;
+    installPhase = ''
+      cp -r ${../../res/eww} $out
+
+      substituteInPlace $out/eww.yuck \
+        --replace-fail "_BAT_ENABLED_" "${boolToString (config.me.batteryDevice != null)}" \
+        --replace-fail "_BAT_PATH_" "${defaultTo "" config.me.batteryDevice}" \
+        --replace-fail "_BT_ENABLED_" "${boolToString config.me.hasBluetooth}" \
+        --replace-fail "_WIFI_ENABLED_" "${boolToString config.me.hasWifi}"
+
+      substituteInPlace $out/eww.scss \
+        --replace-fail "EWW_BACKGROUND" "${config.catppuccin.hexcolors.crust}" \
+        --replace-fail "EWW_TEXT" "${config.catppuccin.hexcolors.text}" \
+        --replace-fail "EWW_ACCENT" "${config.catppuccin.hexcolors.${config.catppuccin.accent}}"
+    '';
+  };
+in {
+  home.packages = with pkgs; [ iw socat ];
   programs.eww = {
     enable = true;
-    configDir = ../../res/eww;
   };
+  xdg.configFile."eww".source = res;
 }

modules/user/git.nix

@@ -1,15 +1,16 @@
 { ... }: {
   programs.git = {
     enable = true;
-    userName = "LavaDesu";
-    userEmail = "me@lava.moe";
     signing = {
       key = "059F098EBF0E9A13E10A46BF6500251E087653C9";
       signByDefault = true;
     };
-    extraConfig = {
+    settings = {
+      user.name = "Cilly Leang";
+      user.email = "mini@cilly.moe";
       core.abbrev = 11;
       safe.directory = "/home/rin/Projects/flakes";
+      init.defaultBranch = "master";
     };
   };
 }

modules/user/gpg.nix

@@ -5,6 +5,6 @@
   };
   services.gpg-agent = {
     enable = true;
-    pinentryPackage = pkgs.pinentry-gnome3;
+    pinentry.package = pkgs.pinentry-gnome3;
   };
 }

modules/user/hypridle.nix

@@ -1,6 +1,6 @@
 { config, lib, pkgs, ... }:
 let
-  kblight = "light -s sysfs/leds/asus::kbd_backlight";
+  kblight = "brightnessctl -d ${config.me.kbBacklightDevice}";
 in
 {
   home.packages = [ config.services.hypridle.package ];
@@ -13,26 +13,28 @@ in
         after_sleep_cmd = "hyprctl dispatch dpms on";
       };
 
-      listener = [
+      listener = lib.optionals (config.me.kbBacklightDevice != null) [
         {
           timeout = 120;
-          on-timeout = "${kblight} -O && ${kblight} -S 0";
-          on-resume = "${kblight} -I";
+          on-timeout = "${kblight} -s && ${kblight} 0";
+          on-resume = "${kblight} -r";
         }
+      ] ++ [
         {
           timeout = 150;
-          on-timeout = "light -O && light -T 0.5";
-          on-resume = "light -I";
+          on-timeout = "brightnessctl -s && brightnessctl 50%-";
+          on-resume = "brightnessctl -r";
         }
         {
           timeout = 180;
-          on-timeout = "light -I && loginctl lock-session";
+          on-timeout = "brightnessctl -r && loginctl lock-session";
         }
         {
           timeout = 195;
           on-timeout = "hyprctl dispatch dpms off";
           on-resume = "hyprctl dispatch dpms on";
         }
+      ] ++ lib.optionals (config.me.environment == "laptop") [
         {
           timeout = 600;
           on-timeout = "systemctl suspend";

modules/user/hyprlock.nix

@@ -1,4 +1,17 @@
-{ ... }: {
+{ config, lib, ... }:
+let
+  scaling = if config.me.hidpi then 1 else 0.5;
+  s = value: if builtins.isInt value || builtins.isFloat value
+  then
+    builtins.floor (value * scaling)
+  else if builtins.isList value
+  then
+    lib.strings.concatMapStringsSep "," (v: builtins.toString (scaling * v)) value
+  else
+    builtins.throw "invalid scaled value type ${builtins.typeOf value} for ${value}";
+  sn = value: s (builtins.map (v: (-v)) value);
+in
+{
   programs.hyprlock = {
     enable = true;
     settings = {
@@ -8,7 +21,7 @@
       };
       auth = {
         fingerprint = {
-          enabled = true;
+          enabled = config.me.hasFingerprint;
           ready_message = "Scan fingerprint to unlock";
         };
       };
@@ -16,16 +29,39 @@
         monitor = "";
         color = "$base";
       };
-      label = [
+      shape = lib.optionals (config.me.batteryDevice != null) [
+        # Battery pill
+        {
+          monitor = "";
+          size = s [165 65];
+          color = "$crust";
+          rounding = -1;
+          halign = "right";
+          valign = "top";
+          position = sn [595 10];
+        }
+      ] ++ [
+        # Time pill
+        {
+          monitor = "";
+          size = s [545 65];
+          color = "$crust";
+          rounding = -1;
+          halign = "right";
+          valign = "top";
+          position = sn [40 10];
+        }
+      ];
+      label = lib.optionals config.me.hasFingerprint [
         # Fingerprint icon
         {
             monitor = "";
             color = "$text";
             font_family = "Material Symbols Outlined";
-            font_size = 64;
+            font_size = s 64;
             halign = "center";
             valign = "top";
-            position = "0, -100";
+            position = sn [0 100];
             text = "";
         }
         # Fingerprint text
@@ -33,50 +69,64 @@
           monitor = "";
           color = "$text";
           text = "$FPRINTPROMPT";
-          font_size = 25;
+          font_size = s 25;
           font_family = "Open Sans";
-          position = "0, -235";
+          position = sn [0 235];
           halign = "center";
           valign = "top";
         }
+      ] ++ lib.optionals (config.me.batteryDevice != null) [
+        # Battery icon
+        {
+          monitor = "";
+          text = "";
+          color = "$accent";
+          font_family = "Material Symbols Outlined";
+          font_size = s 27;
+          position = sn [695 20];
+          halign = "right";
+          valign = "top";
+        }
+        # Battery percentage
+        {
+          monitor = "";
+          text = ''cmd[update:60000] echo "<span weight='700'>$(cat /sys/class/power_supply/${config.me.batteryDevice}/capacity)%</span>"'';
+          color = "$text";
+          font_size = s 23;
+          font_family = "Open Sans";
+          position = sn [625 20];
+          halign = "right";
+          valign = "top";
+        }
+      ] ++ [
+        # Time and Date
+        {
+          monitor = "";
+          color = "$text";
+          font_family = "Open Sans";
+          font_size = s 23;
+          halign = "right";
+          valign = "top";
+          position = sn [70 20];
+          text = ''cmd[update:1000] echo "<span alpha='70%' weight='550'>$(date '+%A, %d %B %Y')</span>  <span weight='700'>$(date +%H:%M)</span><span alpha='70%' weight='550'>$(date +:%S)</span>"'';
+        }
+
         # Fail text under input
         {
           monitor = "";
           color = "$red";
           font_family = "Open Sans";
-          font_size = 25;
+          font_size = s 25;
           text = "$FAIL $ATTEMPTS[]";
-          position = "0, -200";
+          position = sn [0 200];
           halign = "center";
           valign = "center";
         }
-        # Time
-        {
-          monitor = "";
-          text = "$TIME";
-          color = "$text";
-          font_size = 90;
-          font_family = "Open Sans";
-          position = "-50, 0";
-          halign = "right";
-          valign = "top";
-        }
-        # Date
-        {
-          monitor = "";
-          text = "cmd[update:43200000] date +'%A, %d %B %Y'";
-          color = "$text";
-          font_size = 25;
-          font_family = "Open Sans";
-          position = "-50, -150";
-          halign = "right";
-          valign = "top";
-        }
       ];
       input-field = {
         monitor = "";
-        size = "600, 120";
-        outline_thickness = 4;
+        size = s [600 120];
+        outline_thickness = s 4;
         check_color = "$peach";
         dots_size = 0.2;
         dots_spacing = 0.2;
@@ -89,7 +139,7 @@
         fade_on_empty = false;
         hide_input = false;
         capslock_color = "$yellow";
-        position = "0, -47";
+        position = sn [0 47];
         halign = "center";
         valign = "center";
       };

modules/user/kitty.nix

@@ -11,6 +11,9 @@
       enable_audio_bell = false;
       color5 = config.catppuccin.hexcolors.mauve;
       color13 = config.catppuccin.hexcolors.mauve;
+      window_margin_width = 5;
+      scrollback_pager = ''nvim --noplugin -c "set signcolumn=no showtabline=0" -c "silent write! /tmp/kitty_scrollback_buffer | te cat /tmp/kitty_scrollback_buffer - " -c "autocmd VimEnter * normal G"'';
+      scrollback_pager_history_size = 2;
     };
   };
 }

modules/user/mpv.nix

@@ -1,8 +1,7 @@
-{ config, pkgs, ... }: {
+{ pkgs, ... }: {
   programs.mpv = {
     enable = true;
-    package = pkgs.mpv-unwrapped.wrapper {
-      mpv = pkgs.mpv-unwrapped;
+    package = pkgs.mpv.override {
       youtubeSupport = true;
       scripts = [ pkgs.mpvScripts.mpris ];
     };

modules/user/neovim-minimal.nix

@@ -9,11 +9,12 @@
     vimAlias = true;
     vimdiffAlias = true;
     withNodeJs = false;
+    withPython3 = false;
+    withRuby = false;
 
     plugins = with pkgs.vimPlugins; [
-      ctrlp-vim
+      fzf-vim
       lualine-nvim
-      nerdtree
       tokyonight-nvim
       vim-fugitive
       vim-nix
@@ -21,14 +22,7 @@
       vim-signify
       vim-surround
 
-      nvim-cmp
-      nvim-lspconfig
-      cmp-nvim-lsp
-      cmp_luasnip
-      luasnip
-
       (nvim-treesitter.withPlugins (p: with p; [
-        tree-sitter-comment
         tree-sitter-json
         tree-sitter-lua
         tree-sitter-nix

modules/user/neovim.nix

@@ -1,9 +1,9 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, pkgs, sysConfig, ... }:
 let
   luaconf = pkgs.writeText "config.lua"
     (lib.replaceStrings
-      ["{{OMNISHARP_PATH}}" "{{DART_PATH}}" "{{CATPPUCCIN_FLAVOUR}}"]
-      ["${pkgs.omnisharp-roslyn}/bin/OmniSharp" "${pkgs.dart}/bin/dart" config.catppuccin.nvim.flavor]
+      ["{{OMNISHARP_PATH}}" "{{DART_PATH}}" "{{CATPPUCCIN_FLAVOUR}}" "{{USERNAME}}" "{{HOSTNAME}}"]
+      ["${pkgs.omnisharp-roslyn}/bin/OmniSharp" "${pkgs.dart}/bin/dart" config.catppuccin.nvim.flavor config.home.username sysConfig.networking.hostName]
       (builtins.readFile ../../res/config.lua));
 in {
   systemd.user.tmpfiles.rules = [
@@ -17,25 +17,35 @@ in {
     vimdiffAlias = true;
     #package = pkgs.neovim-nightly;
     withNodeJs = true;
+    withPython3 = true;
+    withRuby = false;
 
     extraPackages = with pkgs; [
+      nixd
       rust-analyzer
-      nodePackages."@prisma/language-server"
-      nodePackages.diagnostic-languageserver
-      nodePackages.eslint_d
-      nodePackages.typescript-language-server
-      nodePackages.vscode-langservers-extracted
-      nodePackages.yaml-language-server
+      texlab
+      astro-language-server
+      tailwindcss-language-server
+      diagnostic-languageserver
+      eslint_d
+      typescript-language-server
+      vscode-langservers-extracted
+      yaml-language-server
     ];
 
     plugins = with pkgs.vimPlugins; [
+      autoclose-nvim
+      auto-save-nvim
       flutter-tools-nvim
       fzf-vim
       fzf-lsp-nvim
       lualine-nvim
+      nvim-ts-autotag
+      nvim-web-devicons
       plenary-nvim
       tokyonight-nvim
       vim-fugitive
+      vim-latex-live-preview
       vim-nix
       vim-repeat
       vim-signify
@@ -45,6 +55,7 @@ in {
 
       nvim-cmp
       nvim-dap
+      nvim-highlight-colors
       nvim-lspconfig
       cmp-nvim-lsp
       cmp_luasnip
@@ -52,27 +63,33 @@ in {
 
       #(pkgs.me.nvim-treesitter-nightly.withPlugins (p: with p; [
       (nvim-treesitter.withPlugins (p: with p; [
+        tree-sitter-astro
         tree-sitter-bash
         tree-sitter-c
         tree-sitter-c-sharp
         tree-sitter-cpp
+        tree-sitter-groovy
         tree-sitter-html
+        tree-sitter-java
         tree-sitter-javascript
         tree-sitter-json
+        tree-sitter-kotlin
+        tree-sitter-latex
         tree-sitter-lua
         tree-sitter-markdown
         tree-sitter-nix
         tree-sitter-php
-        tree-sitter-prisma
         tree-sitter-python
         tree-sitter-query
         tree-sitter-regex
         tree-sitter-rust
+        tree-sitter-swift
         tree-sitter-toml
         tree-sitter-tsx
         tree-sitter-typescript
         tree-sitter-vim
         tree-sitter-vimdoc
+        tree-sitter-xml
         tree-sitter-yaml
       ]))
     ];

modules/user/pass.nix

@@ -1,6 +0,0 @@
-{ pkgs, ... }: {
-  programs.password-store = {
-    enable = true;
-    package = pkgs.pass.withExtensions (exts: with exts; [ pass-import pass-otp ]);
-  };
-}

modules/user/picom.nix

@@ -1,41 +0,0 @@
-{ config, ... }: {
-  services.picom = {
-    enable = true;
-
-    # blur = true;
-    # blurExclude = [
-    #   (builtins.concatStringsSep " && " [
-    #     "class_g != 'Alacritty'"
-    #     "class_g != 'kitty'"
-    #     #"class_g != 'Polybar'"
-    #     "class_g != 'URxvt'"
-    #   ])
-    # ];
-    fade = true;
-    fadeDelta = 5;
-    fadeSteps = [ 0.05 0.05 ];
-
-    opacityRules = [
-      "80:class_g = 'Alacritty' && !focused"
-      "95:class_g = 'kitty' && !focused"
-    ];
-    vSync = true;
-
-    settings = {
-      glx-no-stencil = true;
-      glx-copy-from-front = false;
-      glx-no-rebind-pixmap = true;
-      # https://github.com/yshui/picom/issues/578
-      glx-use-copysubbuffer-mesa = false;
-      use-damage = true;
-
-      detect-transient = true;
-      detect-client-leader = true;
-      detect-client-opacity = true;
-      detect-rounded-corners = true;
-      use-ewmh-active-win = true;
-      mark-wmwin-focused = true;
-      mark-ovredir-focused = true;
-    };
-  };
-}

modules/user/polybar.nix

@@ -1,165 +0,0 @@
-{ config, ... }: {
-  services.polybar =
-  let
-    colours = {
-      background1 = "#1a1b26";
-      background2 = "#9d7cd8";
-      accent = "#c0caf5";
-      foreground2 = "#1a1b26";
-      foreground2trans = "#cc1a1b26";
-    };
-  in {
-    enable = true;
-    script = builtins.readFile ../../scripts/polybar.sh;
-    settings = {
-      "bar/scroller" = {
-        monitor = "DP-1";
-        width = "100%";
-        height = 1;
-        background = colours.background1;
-        spacing = 2;
-        override-redirect = true;
-
-        modules.center = "workspaces-stub";
-        scroll = {
-          up = "#workspaces-stub.prev";
-          down = "#workspaces-stub.next";
-        };
-      };
-
-      "bar/top" = {
-        monitor = "DP-1";
-        width = "100%";
-        height = 29;
-        background = colours.background1;
-        foreground = "#fff";
-        offset-y = 3;
-
-        spacing = 2;
-        padding = {
-          left = 5;
-          right = 5;
-          bottom = 5;
-        };
-        override-redirect = true;
-        wm-restack = "bspwm";
-
-        font = [
-          "NotoSans:style=SemiBold:size=11:antialias=true;2"
-          "NotoSans:size=11:antialias=true;2"
-          "MaterialIcons:size=17:antialias=true;6"
-          "Iosevka:style=Medium:antialias=false:size=19;4"
-
-          "HanaMinA:size=9.8;1"
-          "HanaMinB:size=9.8;1"
-        ];
-
-        modules = {
-          left = "left workspaces right";
-          center = "title";
-          right = "left datetime right";
-        };
-
-        enable-ipc = true;
-        scroll = {
-          up = "#workspaces.prev";
-          down = "#workspaces.next";
-        };
-      };
-
-      "module/left" = {
-        type = "custom/text";
-
-        content = {
-          text = "%{T4}";
-          background = colours.background1;
-          foreground = colours.background2;
-        };
-      };
-
-      "module/right" = {
-        type = "custom/text";
-
-        content = {
-          text = "%{T4}";
-          background = colours.background1;
-          foreground = colours.background2;
-        };
-      };
-
-      "module/workspaces" = {
-        type = "internal/bspwm";
-
-        pin-workspaces = true;
-        enable-click = true;
-        enable-scroll = false;
-        reverse-scroll = false;
-
-        label = {
-          monitor = "";
-          focused = {
-            text = "%{T3}"; # ef4a
-            background = colours.background2;
-            foreground = colours.accent;
-          };
-          occupied = {
-            text = "%{T3}"; # e837
-            background = colours.background2;
-            foreground = colours.background1;
-          };
-          empty = {
-            text = "%{T3}"; # ef4a
-            background = colours.background2;
-            foreground = colours.background1;
-          };
-          urgent = {
-            text = "%{T3}"; # e837
-            background = colours.background2;
-            foreground = colours.background1;
-          };
-
-          separator = {
-            text = " ";
-            background = colours.background2;
-            padding = "0";
-          };
-        };
-      };
-
-      "module/workspaces-stub" = {
-        type = "internal/bspwm";
-        pin-workspaces = true;
-        enable-click = false;
-        enable-scroll = false;
-        reverse-scroll = false;
-        label = {
-          monitor = "";
-          focused = "";
-          occupied = "";
-          empty = "";
-          urgent = "";
-          separator = "";
-        };
-      };
-
-      "module/title" = {
-        type = "internal/xwindow";
-        format = {
-          text = "%{T1}<label>";
-          padding = 4;
-        };
-      };
-
-      "module/datetime" = {
-        type = "internal/date";
-        date = {
-          text = "%{T1}%%{F${colours.foreground2}}%H:%M%%{F-}";
-          alt = "%{T2}%%{F${colours.foreground2trans}}%A, %d %B %Y  %{T1}%%{F${colours.foreground2}}%H:%M%%{F${colours.foreground2trans}}:%{T2}%S%%{F-}";
-        };
-        format = {
-          background = colours.background2;
-        };
-      };
-    };
-  };
-}

modules/user/rofi-wayland.nix

@@ -1,23 +0,0 @@
-{ config, pkgs, ... }:
-let
-  theme = pkgs.stdenvNoCC.mkDerivation {
-    pname = "rofi-theme";
-    version = "1.0.0";
-    dontUnpack = true;
-    installPhase = ''
-      cp ${../../res/theme.rasi} $out
-      substituteInPlace $out \
-        --replace-fail "CAT_BACKGROUND" "${config.catppuccin.hexcolors.crust}" \
-        --replace-fail "CAT_TEXT" "${config.catppuccin.hexcolors.text}" \
-        --replace-fail "CAT_ACCENT" "${config.catppuccin.hexcolors.${config.catppuccin.accent}}" \
-        --replace-fail "CAT_PLACEHOLDER" "${config.catppuccin.hexcolors.overlay1}"
-    '';
-  };
-in {
-  programs.rofi = {
-    enable = true;
-    package = pkgs.rofi-wayland;
-    theme = "theme";
-  };
-  xdg.configFile."rofi/theme.rasi".source = theme;
-}

modules/user/rofi.nix

@@ -1,7 +1,22 @@
-{ config, inputs, ... }: {
+{ config, pkgs, ... }:
+let
+  theme = pkgs.stdenvNoCC.mkDerivation {
+    pname = "rofi-theme";
+    version = "1.0.0";
+    dontUnpack = true;
+    installPhase = ''
+      cp ${../../res/theme.rasi} $out
+      substituteInPlace $out \
+        --replace-fail "CAT_BACKGROUND" "${config.catppuccin.hexcolors.crust}" \
+        --replace-fail "CAT_TEXT" "${config.catppuccin.hexcolors.text}" \
+        --replace-fail "CAT_ACCENT" "${config.catppuccin.hexcolors.${config.catppuccin.accent}}" \
+        --replace-fail "CAT_PLACEHOLDER" "${config.catppuccin.hexcolors.overlay1}"
+    '';
+  };
+in {
   programs.rofi = {
     enable = true;
     theme = "theme";
   };
-  xdg.configFile."rofi/theme.rasi".source = ../../res/theme.rasi;
+  xdg.configFile."rofi/theme.rasi".source = theme;
 }

modules/user/sessionVariables.nix

@@ -6,7 +6,6 @@
       "$PATH"
     ];
 
-    XAUTHORITY = "$XDG_RUNTIME_DIR/Xauthority";
     EDITOR = "nvim";
 
     _JAVA_OPTIONS = "-Djava.util.prefs.userRoot=${config.xdg.configHome}/java";
@@ -22,7 +21,6 @@
     NPM_CONFIG_USERCONFIG = "${config.xdg.configHome}/npm/npmrc";
     PUB_CACHE = "${config.xdg.cacheHome}/dart";
     WGETRC = "${config.xdg.configHome}/wgetrc";
-    XINITRC = "${config.xdg.configHome}/xorg/xinitrc";
 
     WINEPREFIX = "${config.xdg.dataHome}/wine64";
     WINEARCH = "win64";

modules/user/spicetify.nix

@@ -1,4 +1,4 @@
-{ config, inputs, pkgs, ... }:
+{ config, inputs, lib, pkgs, ... }:
 let
   spicePkgs = inputs.spicetify-nix.legacyPackages.${pkgs.system};
 in
@@ -8,7 +8,25 @@ in
   programs.spicetify = {
     enable = true;
     alwaysEnableDevTools = true;
-    theme = spicePkgs.themes.catppuccin;
+    theme = spicePkgs.themes.catppuccin // {
+      additionalCss = ''
+        /* Removes "About the artist" text in now playing menu */
+        .main-nowPlayingView-sectionHeaderText {
+          display: none;
+        }
+
+        /* Removes gradient in now playing menu */
+        .main-nowPlayingView-contextItemInfo:before {
+          background: none;
+        }
+
+        /* Removes gradient above artist image */
+        /* https://stackoverflow.com/a/77015731 < this is so smart */
+        .main-nowPlayingView-aboutArtistV2ImageContainer.main-nowPlayingView-aboutArtistV2Image {
+          background-size: 0% 0%, cover;
+        }
+      '';
+    };
     colorScheme = config.catppuccin.flavor;
 
     enabledSnippets = with spicePkgs.snippets; [
@@ -22,10 +40,11 @@ in
       shuffle
       hidePodcasts
 
-      skipStats
       songStats
       history
       volumePercentage
     ];
   };
+
+  home.file.".local/bin/spotify".source = lib.getExe config.programs.spicetify.spicedSpotify;
 }

modules/user/sxhkd.nix

@@ -1,65 +0,0 @@
-{ config, pkgs, ... }:
-let
-  super = "Mod4";
-  alt = "Mod1";
-in {
-  services.sxhkd = {
-    enable = true;
-    keybindings = {
-      # Dunst (Notification daemon)
-      "super + grave" = "dunstctl history-pop";
-      "super + shift + period" = "dunstctl context";
-      "super + shift + space" = "dunstctl close-all";
-
-      # Rofi (App launcher)
-      "super + Return" = "rofi -lines 12 -padding 18 -width 60 -location 0 -show drun -sidebar-mode -columns 3 -font 'Noto Sans 8'";
-
-      # Printscreen
-      "Print" = "maim -us | tee ~/Pictures/Screenshots/$(date +%s)c.png | xclip -selection clipboard -t image/png";
-      "shift + Print" = "maim -u | tee ~/Pictures/Screenshots/$(date +%s).png | xclip -selection clipboard -t image/png";
-
-      # Quick-kill picom
-      "super + p" = "systemctl --user stop picom";
-      "super + shift + p" = "systemctl --user restart picom";
-
-      # Volume
-      "XF86Audio{RaiseVolume,LowerVolume,Mute}" = "pamixer -{i 5,d 5,t}";
-
-      # Brightness
-      "XF86MonBrightness{Up,Down}" = "light -{A,U} 10";
-      "shift + XF86MonBrightness{Up,Down}" = "light -{A,U} 1";
-
-      # Gamma
-      "ctrl + XF86MonBrightness{Up,Down}" = "xgamma -gamma {1.3,1}";
-
-      "Super_L" = "eww open mainbar";
-      "@Super_L" = "eww close mainbar";
-
-      # Kill focused window
-      "super + {_,shift + }c" = "bspc node -{c,k}";
-
-      # Change focus
-      "super + {h,j,k,l}" = "bspc node -f {west,south,north,east}";
-      "super + {Left,Down,Up,Right}" = "bspc node -f {west,south,north,east}";
-
-      # Switch windows
-      "super + shift + {h,j,k,l}" = "bspc node -s {west,south,north,east}";
-      "super + shift + {Left,Down,Up,Right}" = "bspc node -s {west,south,north,east}";
-
-      # Move focused window
-      "super + shift + {1-9,0}" = "bspc node -d ^{1-9,10}";
-
-      # Toggle tiled/fullscreen/floating
-      "super + {t,f,space}" = "bspc node -t '~{tiled,fullscreen,floating}'";
-
-      # Exit / Restart bspwm
-      "super + shift + {q,r}" = "bspc {quit,wm -r}";
-
-      # Restart sxhkd
-      "super + shift + s" = "pkill -USR1 -x sxhkd";
-
-      # Workspace switching
-      "super + {1-9,0}" = "bspc desktop -f ^{1-9,10}";
-    };
-  };
-}

modules/user/xorg.nix

@@ -1,51 +0,0 @@
-{ config, ... }: {
-
-  xsession = {
-    enable = true;
-    profilePath = ".config/xorg/xprofile";
-    scriptPath = ".config/xorg/xsession";
-  };
-
-  xdg.configFile."xorg/xinitrc".source = ../../scripts/xinitrc;
-  xresources = {
-    path = "${config.xdg.configHome}/xorg/xresources";
-    properties = {
-      # special
-      "*.foreground" =  "#c5c8c6";
-      "*.background" =  "#1d1f21";
-      "*.cursorColor" = "#c5c8c6";
-
-      # black
-      "*.color0" =      "#1d1f21";
-      "*.color8" =      "#969896";
-
-      # red
-      "*.color1" =      "#cc342b";
-      "*.color9" =      "#cc342b";
-
-      # green
-      "*.color2" =      "#198844";
-      "*.color10" =     "#198844";
-
-      # yellow
-      "*.color3" =      "#fba922";
-      "*.color11" =     "#fba922";
-
-      # blue
-      "*.color4" =      "#3971ed";
-      "*.color12" =     "#3971ed";
-
-      # magenta
-      "*.color5" =      "#a36ac7";
-      "*.color13" =     "#a36ac7";
-
-      # cyan
-      "*.color6" =      "#3971ed";
-      "*.color14" =     "#3971ed";
-
-      # white
-      "*.color7" =      "#c5c8c6";
-      "*.color15" =     "#ffffff";
-    };
-  };
-}