patch bitwarden to disable annoying ssh-agent confirmation and clean dead overlays

Signed-off-by: cy <cy@cy7.sh>

.github/workflows/build-and-cache.yml

@@ -1,28 +0,0 @@
-name: build and cache random stuff
-on:
-  workflow_dispatch:
-  push:
-jobs:
-  build:
-    strategy:
-      matrix:
-        package:
-          - github:nixos/nixpkgs/nixos-unstable-small#ollama
-    runs-on: ubuntu-latest
-    steps:
-      - uses: DeterminateSystems/nix-installer-action@main
-        with:
-          logger: pretty
-      - uses: DeterminateSystems/magic-nix-cache-action@main
-      - uses: cachix/cachix-action@v15
-        with:
-          name: cything
-          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
-      - name: Setup Attic cache
-        uses: ryanccn/attic-action@v0
-        with:
-          endpoint: ${{ vars.ATTIC_ENDPOINT }}
-          cache: ${{ vars.ATTIC_CACHE }}
-          token: ${{ secrets.ATTIC_TOKEN }}
-      - uses: actions/checkout@v4
-      - run: nix build '${{ matrix.package }}'

.github/workflows/build-machines-and-homes.yml

@@ -0,0 +1,112 @@
+name: build and cache machines and homes
+on:
+  workflow_dispatch:
+  push:
+  pull_request:
+jobs:
+  build-machines:
+    strategy:
+      fail-fast: false
+      matrix:
+        machine:
+          - chunk
+          - ytnix
+        os:
+          - ubuntu-latest
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Maximize build disk space
+        uses: easimon/maximize-build-space@v10
+        with:
+          overprovision-lvm: true
+          swap-size-mb: 1024
+          remove-dotnet: 'true'
+          remove-android: 'true'
+          remove-haskell: 'true'
+          remove-codeql: 'true'
+          remove-docker-images: 'true'
+          build-mount-path: /nix
+      - name: Install Nix
+        uses: cachix/install-nix-action@v30
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.25.4/install
+          extra_nix_config: 'accept-flake-config = true'
+      - name: Sync repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: cachix/cachix-action@v14
+        with:
+          name: cything
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          useDaemon: false
+          installCommand: nix profile install nixpkgs#cachix
+      - name: Restore and cache Nix store
+        uses: nix-community/cache-nix-action@v5.1.0
+        with:
+          # restore and save a cache using this key
+          primary-key: nix-${{ runner.os }}-${{ matrix.machine }}-${{ hashFiles('**/*.nix', 'flake.lock') }}
+          # if there's no cache hit, restore a cache by this prefix
+          restore-prefixes-first-match: nix-${{ runner.os }}-${{ matrix.machine }}-
+          # do purge caches
+          purge: true
+          # purge all versions of the cache
+          purge-prefixes: nix-${{ runner.os }}-
+          # created more than this number of seconds ago relative to the start of the `Post Restore` phase
+          purge-last-accessed: 86400
+          # except the version with the `primary-key`, if it exists
+          purge-primary-key: never
+          # always save the cache
+          save-always: true
+      - run: nix build -L .#nixosConfigurations.${{ matrix.machine }}.config.system.build.toplevel
+  build-homes:
+    strategy:
+      matrix:
+        home:
+          - yt@ytnix
+          - yt@chunk
+        os:
+          - ubuntu-latest
+          # - macos-latest
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Maximize build disk space
+        uses: easimon/maximize-build-space@v10
+        with:
+          overprovision-lvm: true
+          swap-size-mb: 1024
+          remove-dotnet: 'true'
+          remove-android: 'true'
+          remove-haskell: 'true'
+          remove-codeql: 'true'
+          remove-docker-images: 'true'
+          build-mount-path: /nix
+      - uses: nixbuild/nix-quick-install-action@master
+      - name: Sync repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - uses: cachix/cachix-action@v14
+        with:
+          name: cything
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          useDaemon: false
+          installCommand: nix profile install nixpkgs#cachix
+      - name: Restore and cache Nix store
+        uses: nix-community/cache-nix-action@v5.1.0
+        with:
+          # restore and save a cache using this key
+          primary-key: nix-${{ runner.os }}-${{ matrix.home }}-${{ hashFiles('**/*.nix', 'flake.lock') }}
+          # if there's no cache hit, restore a cache by this prefix
+          restore-prefixes-first-match: nix-${{ runner.os }}-${{ matrix.home }}-
+          # do purge caches
+          purge: true
+          # purge all versions of the cache
+          purge-prefixes: nix-${{ runner.os }}-
+          # created more than this number of seconds ago relative to the start of the `Post Restore` phase
+          purge-last-accessed: 86400
+          # except the version with the `primary-key`, if it exists
+          purge-primary-key: never
+          # always save the cache
+          save-always: true
+      - run: nix build -L .#homeConfigurations."${{ matrix.home }}".activationPackage

.github/workflows/build-packages.yml

@@ -0,0 +1,38 @@
+name: build and cache packages
+on:
+  workflow_dispatch:
+    inputs:
+      package:
+        description: "package to build"
+        required: false
+        type: string
+jobs:
+  build-packages:
+    strategy:
+      fail-fast: false
+      matrix:
+        package:
+          - ${{ inputs.package }}
+        os:
+          - ubuntu-latest
+          - ubuntu-24.04-arm
+          - macos-latest
+          - macos-13
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Install Nix
+        uses: cachix/install-nix-action@v30
+
+      - name: Sync repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - uses: cachix/cachix-action@v14
+        with:
+          name: cything
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          useDaemon: false
+          installCommand: nix profile install nixpkgs#cachix
+
+      - run: nix build -L ${{ matrix.package }}

.sops.yaml

@@ -103,3 +103,24 @@ creation_rules:
       - age:
           - *chunk
           - *cy
+  - path_regex: secrets/services/tailscale.yaml
+    key_groups:
+      - age:
+          - *chunk
+          - *cy
+  - path_regex: secrets/yt/(.*).yaml$
+    key_groups:
+      - age:
+          - *yt
+          - *cy
+  - path_regex: secrets/services/zipline.yaml
+    key_groups:
+      - age:
+          - *chunk
+          - *cy
+
+  - path_regex: secrets/services/searx.yaml
+    key_groups:
+      - age:
+          - *chunk
+          - *cy

flake.nix

@@ -3,6 +3,7 @@
 
   inputs = {
     nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable-small";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11";
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -15,29 +16,89 @@
       url = "github:numtide/treefmt-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
-    disko = {
-      url = "github:nix-community/disko/latest";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     lanzaboote = {
-      url = "github:nix-community/lanzaboote/v0.4.1";
+      url = "github:nix-community/lanzaboote/master";
       inputs.nixpkgs.follows = "nixpkgs";
+      inputs.crane.follows = "crane";
+      inputs.flake-compat.follows = "flake-compat";
+      inputs.flake-parts.follows = "flake-parts";
+      inputs.rust-overlay.follows = "rust-overlay";
     };
     nixvim = {
       url = "github:nix-community/nixvim";
       inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-parts.follows = "flake-parts";
     };
-    flake-parts.url = "github:hercules-ci/flake-parts";
+    flake-parts = {
+      url = "github:hercules-ci/flake-parts";
+      inputs.nixpkgs-lib.follows = "nixpkgs";
+    };
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    conduwuit = {
+      url = "github:girlbossceo/conduwuit";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        crane.follows = "crane";
+        flake-compat.follows = "flake-compat";
+        flake-utils.follows = "flake-utils";
+      };
+    };
+    lix-module = {
+      url = "git+https://git.lix.systems/lix-project/nixos-module";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-utils.follows = "flake-utils";
+      inputs.lix.follows = "lix";
+    };
+    lix = {
+      url = "git+https://git.lix.systems/lix-project/lix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-compat.follows = "flake-compat";
+    };
+    nix-ld = {
+      url = "github:nix-community/nix-ld";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nil = {
+      url = "github:oxalica/nil";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.rust-overlay.follows = "rust-overlay";
+      inputs.flake-utils.follows = "flake-utils";
+    };
+    vscode-extensions = {
+      url = "github:nix-community/nix-vscode-extensions/";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-utils.follows = "flake-utils";
+    };
+    nix-index-database = {
+      url = "github:nix-community/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    pixelflasher.url = "github:cything/nixpkgs/pixelflasher";
 
-    nixpkgs-garage.url = "github:cything/nixpkgs/garage-module"; # unmerged PR
+    nvim-github-theme = {
+      url = "github:projekt0n/github-nvim-theme";
+      flake = false;
+    };
+
+    # deduplication
+    flake-utils.url = "github:numtide/flake-utils";
+    crane.url = "github:ipetkov/crane";
+    flake-compat.url = "github:edolstra/flake-compat";
   };
 
   nixConfig = {
     extra-substituters = [
-      "https://cache.cything.io/central"
+      "https://nix-community.cachix.org"
+      "https://cache.garnix.io"
+      "https://cything.cachix.org"
     ];
     extra-trusted-public-keys = [
-      "central:uWhjva6m6dhC2hqNisjn2hXGvdGBs19vPkA1dPEuwFg="
+      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+      "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+      "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
     ];
     builders-use-substitutes = true;
   };
@@ -47,7 +108,6 @@
       self,
       nixpkgs,
       home-manager,
-      disko,
       flake-parts,
       ...
     }@inputs:
@@ -63,18 +123,10 @@
         ];
         perSystem =
           {
-            system,
+            inputs',
             ...
           }:
           {
-            # make pkgs available to `perSystem`
-            _module.args.pkgs = import inputs.nixpkgs {
-              inherit system;
-              config = {
-                allowUnfree = true;
-              };
-            };
-
             treefmt = {
               projectRootFile = "flake.nix";
               programs.nixfmt.enable = true;
@@ -83,7 +135,10 @@
               programs.typos.enable = true;
               programs.shellcheck.enable = true;
 
-              settings.global.excludes = [ "secrets/*" ];
+              settings.global.excludes = [
+                "secrets/*"
+                "**/*.png" # tries to format a png file
+              ];
             };
           };
 
@@ -92,7 +147,10 @@
             pkgs = import nixpkgs {
               config.allowUnfree = true;
               system = "x86_64-linux";
-              overlays = import ./overlay;
+              overlays = [
+                inputs.rust-overlay.overlays.default
+                inputs.vscode-extensions.overlays.default
+              ] ++ (import ./overlay { inherit inputs; });
             };
           in
           {
@@ -102,14 +160,17 @@
               in
               {
                 ytnix = lib.nixosSystem {
+                  specialArgs = { inherit inputs; };
                   modules = [
                     {
                       nixpkgs = { inherit pkgs; };
                     }
                     ./hosts/ytnix
-                  inputs.sops-nix.nixosModules.sops
                     ./modules
+                    inputs.sops-nix.nixosModules.sops
                     inputs.lanzaboote.nixosModules.lanzaboote
+                    inputs.lix-module.nixosModules.default
+                    inputs.nix-ld.nixosModules.nix-ld
                   ];
                 };
                 chunk = lib.nixosSystem {
@@ -117,27 +178,11 @@
                   modules = [
                     {
                       nixpkgs = { inherit pkgs; };
-                    disabledModules = [
-                      "services/web-servers/garage.nix"
-                    ];
                     }
                     ./hosts/chunk
-                  inputs.sops-nix.nixosModules.sops
                     ./modules
-                  (inputs.nixpkgs-garage + "/nixos/modules/services/web-servers/garage.nix")
-                ];
-              };
-
-              titan = lib.nixosSystem {
-                specialArgs = { inherit inputs; };
-                modules = [
-                  {
-                    nixpkgs = { inherit pkgs; };
-                  }
-                  ./hosts/titan
-                  disko.nixosModules.disko
                     inputs.sops-nix.nixosModules.sops
-                  ./modules
+                    inputs.lix-module.nixosModules.default
                   ];
                 };
               };
@@ -152,6 +197,7 @@
                   modules = [
                     ./home/yt/ytnix.nix
                     inputs.nixvim.homeManagerModules.nixvim
+                    inputs.nix-index-database.hmModules.nix-index
                   ];
                 };
 
@@ -163,15 +209,6 @@
                     inputs.nixvim.homeManagerModules.nixvim
                   ];
                 };
-
-              "codespace@codespace" = lib.homeManagerConfiguration {
-                inherit pkgs;
-                extraSpecialArgs = { inherit inputs; };
-                modules = [
-                  ./home/yt/codespace.nix
-                  inputs.nixvim.homeManagerModules.nixvim
-                ];
-              };
               };
           };
       }

garnix.yaml

@@ -0,0 +1,6 @@
+builds:
+  include:
+    - 'nixosConfigurations.*'
+    - 'homeConfigurations.*'
+    - '*.aarch64-linux.*'
+    - '*.x86_64-linux.*'

home/codium.nix

@@ -0,0 +1,198 @@
+{ pkgs, ... }:
+{
+  programs.vscode = {
+    enable = true;
+    package = pkgs.vscodium;
+    mutableExtensionsDir = false;
+    profiles.default = {
+      enableUpdateCheck = false;
+      enableExtensionUpdateCheck = false;
+      extensions =
+        # if unfree
+        # with pkgs.vscode-marketplace;
+        with pkgs.open-vsx;
+        [
+          vscodevim.vim
+          jnoortheen.nix-ide
+          github.github-vscode-theme
+          rust-lang.rust-analyzer
+          shd101wyy.markdown-preview-enhanced
+          alefragnani.bookmarks
+          tomrijndorp.find-it-faster
+          streetsidesoftware.code-spell-checker
+          emilast.logfilehighlighter
+        ];
+      userSettings =
+        let
+          vimCommonKeyBindings = [
+            {
+              "before" = [ "C-a" ];
+              "commands" = [ "cursorHome" ];
+            }
+            {
+              "before" = [ "C-e" ];
+              "commands" = [ "cursorEnd" ];
+            }
+          ];
+        in
+        {
+          "workbench.colorTheme" = "GitHub Dark Default";
+          "workbench.startupEditor" = "none";
+          "workbench.enableExperiments" = false;
+          "files.autoSave" = "onFocusChange";
+          "editor.fontFamily" = "IBM Plex Mono";
+          "editor.fontSize" = 15;
+          "editor.minimap.enabled" = false;
+          "window.zoomLevel" = 0.5;
+          "security.promptForLocalFileProtocolHandling" = false;
+          "security.promptForRemoteFileProtocolHandling" = false;
+          "explorer.confirmDelete" = false;
+          "explorer.confirmDragAndDrop" = false;
+          "editor.acceptSuggestionOnEnter" = "off";
+          "editor.acceptSuggestionOnCommitCharacter" = false;
+          "git.openRepositoryInParentFolders" = "never";
+          "git.ignoreLimitWarning" = true;
+          "git.blame.editorDecoration.enabled" = true;
+          "extensions.ignoreRecommendations" = true;
+          "telemetry.enableTelemetry" = false;
+          "telemetry.telemetryLevel" = "off";
+          "window.titleBarStyle" = "custom";
+
+          # terminal stuff
+          "terminal.integrated.cursorBlinking" = true;
+          "terminal.integrated.cursorStyle" = "line";
+          "terminal.integrated.customGlyphs" = false;
+          "terminal.integrated.env.linux" = {
+            # https://github.com/tomrijndorp/vscode-finditfaster/issues/112#issuecomment-2475227546
+            FZF_DEFAULT_OPTS = "--bind ctrl-n:down,ctrl-p:up";
+          };
+          # don't let the workbench handle terminal keys like ctrl+n and friends
+          "terminal.integrated.sendKeybindingsToShell" = true;
+          "terminal.integrated.allowChords" = false;
+
+          "markdown-preview-enhanced.previewTheme" = "github-dark.css";
+          "nix.enableLanguageServer" = true;
+          "nix.serverPath" = "nil";
+          "bookmarks.saveBookmarksInProject" = true;
+
+          "cSpell.enabledFileTypes" = {
+            "markdown" = true;
+            "*" = false;
+          };
+
+          # vim stuff
+          "vim.leader" = ",";
+          "vim.normalModeKeyBindings" = vimCommonKeyBindings ++ [
+            {
+              "before" = [ ";" ];
+              "after" = [ ":" ];
+              "silent" = true;
+            }
+            {
+              "before" = [
+                "<leader>"
+                "m"
+              ];
+              "commands" = [ "bookmarks.toggle" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "l"
+              ];
+              "commands" = [ "bookmarks.toggleLabeled" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "b"
+              ];
+              "commands" = [ "bookmarks.list" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "s"
+              ];
+              "commands" = [ "workbench.action.toggleSidebarVisibility" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "f"
+                "f"
+              ];
+              "commands" = [ "find-it-faster.findFiles" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "f"
+                "g"
+              ];
+              "commands" = [ "find-it-faster.findWithinFiles" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "f"
+                "t"
+              ];
+              "commands" = [ "find-it-faster.findWithinFilesWithType" ];
+            }
+            # "gd" for definitions is by default
+            {
+              "before" = [
+                "g"
+                "r"
+              ];
+              "commands" = [ "editor.action.goToReferences" ];
+            }
+            # the default is weird when you need to go back within a file
+            {
+              "before" = [ "C-o" ];
+              "commands" = [ "workbench.action.navigateBack" ];
+            }
+            {
+              "before" = [ "C-i" ];
+              "commands" = [ "workbench.action.navigateForward" ];
+            }
+            # insert line without leaving normal mode
+            {
+              "before" = [
+                "<space>"
+                "o"
+              ];
+              "commands" = [ "editor.action.insertLineAfter" ];
+            }
+            {
+              "before" = [
+                "<space>"
+                "O"
+              ];
+              "commands" = [ "editor.action.insertLineBefore" ];
+            }
+          ];
+          "vim.insertModeKeyBindings" = vimCommonKeyBindings ++ [
+            {
+              "before" = [ "C-k" ];
+              "commands" = [ "acceptSelectedSuggestion" ];
+            }
+          ];
+          "vim.visualModeKeyBindings" = vimCommonKeyBindings ++ [
+            {
+              "before" = [ ">" ];
+              "commands" = [ "editor.action.indentLines" ];
+            }
+            {
+              "before" = [ "<" ];
+              "commands" = [ "editor.action.outdentLines" ];
+            }
+          ];
+          "extensions.experimental.affinity" = {
+            "vscodevim.vim" = 1;
+          };
+        };
+    };
+  };
+}

home/fish.nix

@@ -1,80 +0,0 @@
-{ ... }:
-{
-  programs.fish = {
-    enable = true;
-    shellAliases = {
-      "vi" = "nvim";
-      "vim" = "nvim";
-      "t" = "tmux";
-      "tl" = "tmux list-sessions";
-      "ta" = "tmux new-session -A -s";
-      "se" = "sudoedit";
-      "s" = "sudo";
-      "nrs" = "sudo nixos-rebuild switch --flake .";
-      "nrt" = "sudo nixos-rebuild test --flake .";
-      "hrs" = "home-manager switch --flake .";
-      "g" = "git";
-      "ga" = "git add";
-      "gaa" = "git add --all";
-      "gb" = "git branch";
-      "gc" = "git commit --verbose";
-      "gcmsg" = "git commit --message";
-      "gd" = "git diff";
-      "gdca" = "git diff --cached";
-      "gds" = "git diff --staged";
-      "gl" = "git log --stat";
-      "glg" = "git log --graph";
-      "glga" = "git log --graph --decorate --all";
-      "glo" = "git log --oneline --decorate";
-      "gp" = "git push";
-      "gr" = "git remote";
-      "gra" = "git remote add";
-      "grv" = "git remote --verbose";
-      "gs" = "git status --short";
-      "gss" = "git status";
-    };
-
-    shellInit = ''
-      set fish_greeting
-    '';
-
-    functions = {
-      fish_prompt = ''
-        set -l last_status $status
-        set -l normal (set_color normal)
-        set -l status_color (set_color brgreen)
-        set -l cwd_color (set_color $fish_color_cwd)
-        set -l vcs_color (set_color brpurple)
-        set -l prompt_status ""
-
-        # Since we display the prompt on a new line allow the directory names to be longer.
-        set -q fish_prompt_pwd_dir_length
-        or set -lx fish_prompt_pwd_dir_length 0
-
-        # Color the prompt differently when we're root
-        set -l suffix '❯'
-        if functions -q fish_is_root_user; and fish_is_root_user
-            if set -q fish_color_cwd_root
-                set cwd_color (set_color $fish_color_cwd_root)
-            end
-            set suffix '#'
-        end
-
-        # Color the prompt in red on error
-        if test $last_status -ne 0
-            set status_color (set_color $fish_color_error)
-            set prompt_status $status_color "[" $last_status "]" $normal
-        end
-
-        echo -s (prompt_login) ' ' $cwd_color (prompt_pwd) $vcs_color (fish_vcs_prompt) $normal ' ' $prompt_status
-        echo -n -s $status_color $suffix ' ' $normal
-      '';
-
-    };
-  };
-
-  programs.fzf.enableFishIntegration = true;
-  programs.zoxide.enableFishIntegration = true;
-  programs.eza.enableFishIntegration = true;
-  programs.nix-index.enableFishIntegration = true;
-}

home/foot.nix

@@ -1,63 +0,0 @@
-{ ... }:
-{
-  programs.foot = {
-    enable = true;
-    settings = {
-      main = {
-        font = "IBM Plex Mono:size=8";
-        dpi-aware = "yes";
-      };
-      bell = {
-        urgent = "no";
-        notify = "no";
-        visual = "no";
-      };
-      cursor = {
-        style = "beam";
-        blink = "yes";
-        blink-rate = 500;
-        beam-thickness = 1.5;
-      };
-      mouse = {
-        hide-when-typing = "yes";
-      };
-      colors = {
-        background = "161821";
-        foreground = "c6c8d1";
-
-        selection-background = "1e2132";
-        selection-foreground = "c6c8d1";
-
-        regular0 = "161821";
-        bright0 = "6b7089";
-
-        regular1 = "e27878";
-        bright1 = "e98989";
-
-        regular2 = "b4be82";
-        bright2 = "c0ca8e";
-
-        regular3 = "e2a478";
-        bright3 = "e9b189";
-
-        regular4 = "84a0c6";
-        bright4 = "91acd1";
-
-        regular5 = "a093c7";
-        bright5 = "ada0d3";
-
-        regular6 = "89b8c2";
-        bright6 = "95c4ce";
-
-        regular7 = "c6c8d1";
-        bright7 = "d2d4de";
-      };
-
-      key-bindings = {
-        clipboard-copy = "Control+Shift+c XF86Copy";
-        clipboard-paste = "Control+Shift+v XF86Paste";
-        quit = "Control+q";
-      };
-    };
-  };
-}

home/irssi.nix

@@ -0,0 +1,22 @@
+{ ... }:
+{
+  programs.irssi = {
+    enable = true;
+    networks.liberachat = {
+      nick = "cy7";
+      server = {
+        address = "irc.libera.chat";
+        port = 6697;
+        autoConnect = true;
+      };
+      channels = {
+        nixos.autoJoin = true;
+        linux.autoJoin = true;
+        rust.autoJoin = true;
+      };
+    };
+    extraConfig = ''
+      ignores = ( { level = "JOINS PARTS QUITS MODES NICKS"; } )
+    '';
+  };
+}

home/kitty.nix

@@ -0,0 +1,75 @@
+{ pkgs, ... }:
+{
+  programs.kitty = {
+    enable = true;
+    font = {
+      name = "IBM Plex Mono";
+      package = pkgs.ibm-plex;
+      size = 12;
+    };
+    themeFile = "GitHub_Dark";
+    settings = {
+      enable_audio_bell = true;
+      # how many windows should be open before kitty asks
+      # for confirmation
+      confirm_os_window_close = 0;
+      clear_all_shortcuts = true;
+
+      # will probably lower this later but the max allowed is actually 4GB
+      # this is NOT stored in memory and can only be viewed with scrollback_pager
+      "scrollback_pager_history_size" = "1024";
+      # see https://github.com/sharkdp/bat/issues/1077#issuecomment-652785399
+      "scrollback_pager" = "bat --pager='less -FR +G'";
+      "scrollback_lines" = 20000;
+    };
+    keybindings = {
+      # kitty_mod is ctrl+shift by default
+      "kitty_mod+c" = "copy_to_clipboard";
+      "kitty_mod+v" = "paste_from_clipboard";
+      # "ctrl+q" = "quit";
+
+      "kitty_mod+m" = "show_scrollback";
+
+      # windows
+      "kitty_mod+h" = "neighboring_window left";
+      "kitty_mod+alt+h" = "move_window left";
+      "kitty_mod+l" = "neighboring_window right";
+      "kitty_mod+alt+l" = "move_window right";
+      "kitty_mod+j" = "neighboring_window down";
+      "kitty_mod+alt+j" = "move_window down";
+      "kitty_mod+k" = "neighboring_window up";
+      "kitty_mod+alt+k" = "move_window up";
+      "ctrl+f3" = "detach_window new-tab";
+      "ctrl+f4" = "detach_window tab-left";
+      "ctrl+f5" = "load_config_file";
+      "ctrl+alt+l" = "next_layout";
+      "ctrl+alt+t" = "goto_layout tall";
+      "ctrl+alt+s" = "goto_layout stack";
+      "kitty_mod+enter" = "new_window_with_cwd";
+      "kitty_mod+r" = "resize_window";
+      # this closes the *current* window, not the *OS* window
+      # https://sw.kovidgoyal.net/kitty/overview/#tabs-and-windows
+      "kitty_mod+w" = "close_window";
+
+      # tabs
+      "kitty_mod+n" = "next_tab";
+      "kitty_mod+p" = "previous_tab";
+      "kitty_mod+alt+n" = "move_tab_forward";
+      "kitty_mod+alt+p" = "move_tab_backward";
+      "kitty_mod+q" = "close_tab";
+      "kitty_mod+t" = "new_tab_with_cwd";
+      "ctrl+f2" = "detach_tab";
+
+      # hints
+      # > basically means the preceding key is a prefix (think tmux)
+      "kitty_mod+o>o" = "open_url_with_hints";
+      "kitty_mod+o>p" = "kitten hints --type path --program -";
+      "kitty_mod+o>n" = "kitten hints --type line --program -";
+      "kitty_mod+o>w" = "kitten hints --type word --program -";
+      "kitty_mod+o>h" = "kitten hints --type hash --program -";
+      "kitty_mod+o>l" = "kitten hints --type linenum";
+    };
+  };
+
+  # programs.zsh.shellAliases."ssh" = "kitten ssh"; # doesn't seem to work with bitwarden ssh agent :(
+}

home/nixvim/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, inputs, ... }:
 {
   programs.nixvim = {
     enable = true;
@@ -15,15 +15,18 @@
       incsearch = true;
       smartcase = true;
     };
-    colorscheme = "iceberg";
-    clipboard.register = "unnamedplus";
+    colorscheme = "github_dark_tritanopia";
+    clipboard.register = "unnamed";
 
     globals = {
       mapleader = ",";
     };
 
-    extraPlugins = with pkgs.vimPlugins; [
-      iceberg-vim
+    extraPlugins = [
+      (pkgs.vimUtils.buildVimPlugin {
+        name = "github-theme";
+        src = inputs.nvim-github-theme;
+      })
     ];
 
     keymaps = [
@@ -68,6 +71,41 @@
         key = "<C-e>";
         mode = "i";
       }
+      # quick chat with copilot
+      {
+        key = "<leader>ccq";
+        action.__raw = ''
+          function()
+            local input = vim.fn.input("Quick chat: ")
+            if input ~= "" then
+              require("CopilotChat").ask(input, { selection = require("CopilotChat.select").buffer })
+            end
+          end
+        '';
+        mode = [
+          "n"
+          "v"
+        ];
+      }
+      # ask perplexity a quick question
+      {
+        key = "<leader>ccs";
+        action.__raw = ''
+          function()
+            local input = vim.fn.input("Perplexity: ")
+            if input ~= "" then
+              require("CopilotChat").ask(input, {
+                agent = "perplexityai",
+                selection = false,
+              })
+            end
+          end
+        '';
+        mode = [
+          "n"
+          "v"
+        ];
+      }
     ];
 
     plugins.cmp = {
@@ -112,7 +150,8 @@
               end
             end)
           '';
-          "<Tab>" = ''
+          # plain tab conflicts with i try to indent
+          "<C-Tab>" = ''
             cmp.mapping(function(fallback)
               if require("luasnip").jumpable(1) then
                 require("luasnip").jump(1)
@@ -150,7 +189,10 @@
         nil_ls = {
           enable = true;
           settings = {
-            formatting.command = [ "nix" "fmt" ];
+            formatting.command = [
+              "nix"
+              "fmt"
+            ];
             nix.flake.autoArchive = true;
           };
         };
@@ -159,15 +201,21 @@
           installRustc = true;
           installCargo = true;
         };
+        eslint.enable = true;
       };
     };
     plugins.treesitter = {
       enable = true;
       nixGrammars = true;
-      settings.indent.enable = true;
+      settings = {
+        indent.enable = true;
+        auto_install = true;
+        highlight.enable = true;
+      };
     };
     plugins.fzf-lua = {
       enable = true;
+      profile = "fzf-native";
       keymaps = {
         "<leader>ff" = "files";
         "<leader>fg" = "live_grep";
@@ -185,6 +233,13 @@
       settings.current_line_blame = true;
     };
 
+    plugins.copilot-chat = {
+      enable = true;
+      settings = {
+        model = "claude-3.5-sonnet";
+      };
+    };
+
     plugins.cmp-buffer.enable = true;
     plugins.cmp-emoji.enable = true;
     plugins.cmp-nvim-lsp.enable = true;

home/plasma.nix

@@ -0,0 +1,85 @@
+{ ... }:
+{
+  programs.plasma = {
+    enable = true;
+    overrideConfig = true;
+    immutableByDefault = true;
+    workspace = {
+      lookAndFeel = "org.ide.breezedark.desktop";
+      cursor = {
+        theme = "Bibata-Modern-Classic";
+        size = 23;
+      };
+    };
+
+    fonts = {
+      general = {
+        family = "IBM Plex Mono";
+        pointSize = 12;
+      };
+    };
+
+    input.keyboard = {
+      numlockOnStartup = "on";
+      options = [ "ctrl:nocaps" ];
+    };
+
+    # Meta key is actually the Super key in KDE
+
+    hotkeys.commands = {
+      "launch-terminal" = {
+        name = "launch terminal";
+        key = "Meta+Return";
+        command = "kitty";
+      };
+      "launch-browser" = {
+        name = "launch browser";
+        key = "Meta+B";
+        command = "chromium";
+      };
+      "launch-fuzzel" = {
+        name = "launch-fuzzel";
+        key = "Meta+d";
+        command = "fuzzel";
+      };
+    };
+
+    shortcuts = {
+      kwin = {
+        "Switch Window Down" = "Meta+J";
+        "Switch Window Left" = "Meta+H";
+        "Switch Window Right" = "Meta+L";
+        "Switch Window Up" = "Meta+K";
+        "Window Quick Tile Down" = "Meta+Shift+J";
+        "Window Quick Tile Left" = "Meta+Shift+H";
+        "Window Quick Tile Right" = "Meta+Shift+L";
+        "Window Quick Tile Up" = "Meta+Shift+K";
+        "Window Close" = "Meta+Ctrl+Q";
+        "Window Maximize" = "Meta+W";
+        "Window Minimize" = "Meta+Shift+-";
+        "Window Fullscreen" = "Meta+F";
+        "Window Shrink Horizontal" = "Meta+-";
+      };
+
+      ksmserver = {
+        "Lock Session" = [
+          "Screensaver"
+          "Meta+Ctrl+L"
+        ];
+      };
+    };
+
+    configFile = {
+      # save RAM
+      baloofilerc."Basic Settings"."Indexing-Enabled" = false;
+    };
+
+    # looks like KDE overrides services.logind settings
+    powerdevil.AC = {
+      whenLaptopLidClosed = "hibernate";
+    };
+    powerdevil.battery = {
+      whenLaptopLidClosed = "hibernate";
+    };
+  };
+}

home/rofi/config.rasi

@@ -1,156 +0,0 @@
-configuration {
-    modes: "drun,run,emoji:rofimoji,clipboard:/home/yt/.config/rofi/scripts/cliphist.sh";
-    font: "hack 12";
-/*	location: 0;*/
-/*	yoffset: 0;*/
-/*	xoffset: 0;*/
-/*	fixed-num-lines: true;*/
-  	show-icons: true;
-  	terminal: "kitty";
-/*	ssh-client: "ssh";*/
-/*	ssh-command: "{terminal} -e {ssh-client} {host} [-p {port}]";*/
-/*	run-command: "{cmd}";*/
-/*	run-list-command: "";*/
-/*	run-shell-command: "{terminal} -e {cmd}";*/
-/*	window-command: "wmctrl -i -R {window}";*/
-/*	window-match-fields: "all";*/
-  	icon-theme: "Papirus";
-/*	drun-match-fields: "name,generic,exec,categories,keywords";*/
-/*	drun-categories: ;*/
-/*	drun-show-actions: false;*/
-/*	drun-display-format: "{name} [<span weight='light' size='small'><i>({generic})</i></span>]";*/
-/*	drun-url-launcher: "xdg-open";*/
-/*	disable-history: false;*/
-/*	ignored-prefixes: "";*/
-/*	sort: false;*/
-/*	sorting-method: "normal";*/
-/*	case-sensitive: false;*/
-/*	cycle: true;*/
-/*	sidebar-mode: false;*/
-/*	hover-select: false;*/
-/*	eh: 1;*/
-/*	auto-select: false;*/
-/*	parse-hosts: false;*/
-/*	parse-known-hosts: true;*/
-  	combi-modes: "window,run,calc,filebrowser";
-/*	matching: "normal";*/
-/*	tokenize: true;*/
-/*	m: "-5";*/
-/*	filter: ;*/
-/*	dpi: -1;*/
-/*	threads: 0;*/
-/*	scroll-method: 0;*/
-/*	window-format: "{w}    {c}   {t}";*/
-/*	click-to-exit: true;*/
-/*	global-kb: false;*/
-/*	max-history-size: 25;*/
-/*	combi-hide-mode-prefix: false;*/
-/*	combi-display-format: "{mode} {text}";*/
-/*	matching-negate-char: '-' /* unsupported */;*/
-/*	cache-dir: ;*/
-/*	window-thumbnail: false;*/
-/*	drun-use-desktop-cache: false;*/
-/*	drun-reload-desktop-cache: false;*/
-/*	normalize-match: false;*/
-/*	steal-focus: false;*/
-/*	application-fallback-icon: ;*/
-/*	refilter-timeout-limit: 300;*/
-/*	xserver-i300-workaround: false;*/
-/*	completer-mode: "recursivebrowser";*/
-/*	pid: "/run/user/1000/rofi.pid";*/
-/*	display-window: ;*/
-/*	display-run: ;*/
-/*	display-ssh: ;*/
-/*	display-drun: ;*/
-/*	display-combi: ;*/
-/*	display-keys: ;*/
-/*	display-filebrowser: ;*/
-/*	display-recursivebrowser: ;*/
-/*	kb-primary-paste: "Control+V,Shift+Insert";*/
-/*	kb-secondary-paste: "Control+v,Insert";*/
-/*	kb-secondary-copy: "Control+c";*/
-/*	kb-clear-line: "Control+w";*/
-/*	kb-move-front: "Control+a";*/
-/*	kb-move-end: "Control+e";*/
-/*	kb-move-word-back: "Alt+b,Control+Left";*/
-/*	kb-move-word-forward: "Alt+f,Control+Right";*/
-/*	kb-move-char-back: "Left,Control+b";*/
-/*	kb-move-char-forward: "Right,Control+f";*/
-/*	kb-remove-word-back: "Control+Alt+h,Control+BackSpace";*/
-/*	kb-remove-word-forward: "Control+Alt+d";*/
-/*	kb-remove-char-forward: "Delete,Control+d";*/
-/*	kb-remove-char-back: "BackSpace,Shift+BackSpace,Control+h";*/
-/*	kb-remove-to-eol: "Control+k";*/
-/*	kb-remove-to-sol: "Control+u";*/
-/*	kb-accept-entry: "Control+j,Control+m,Return,KP_Enter";*/
-/*	kb-accept-custom: "Control+Return";*/
-/*	kb-accept-custom-alt: "Control+Shift+Return";*/
-/*	kb-accept-alt: "Shift+Return";*/
-/*	kb-delete-entry: "Shift+Delete";*/
-/*	kb-mode-next: "Shift+Right,Control+Tab";*/
-/*	kb-mode-previous: "Shift+Left,Control+ISO_Left_Tab";*/
-/*	kb-mode-complete: "Control+l";*/
-/*	kb-row-left: "Control+Page_Up";*/
-/*	kb-row-right: "Control+Page_Down";*/
-/*	kb-row-up: "Up,Control+p";*/
-/*	kb-row-down: "Down,Control+n";*/
-/*	kb-row-tab: "";*/
-/*	kb-element-next: "Tab";*/
-/*	kb-element-prev: "ISO_Left_Tab";*/
-/*	kb-page-prev: "Page_Up";*/
-/*	kb-page-next: "Page_Down";*/
-/*	kb-row-first: "Home,KP_Home";*/
-/*	kb-row-last: "End,KP_End";*/
-/*	kb-row-select: "Control+space";*/
-/*	kb-screenshot: "Alt+S";*/
-/*	kb-ellipsize: "Alt+period";*/
-/*	kb-toggle-case-sensitivity: "grave,dead_grave";*/
-/*	kb-toggle-sort: "Alt+grave";*/
-/*	kb-cancel: "Escape,Control+g,Control+bracketleft";*/
-/*	kb-custom-1: "Alt+1";*/
-/*	kb-custom-2: "Alt+2";*/
-/*	kb-custom-3: "Alt+3";*/
-/*	kb-custom-4: "Alt+4";*/
-/*	kb-custom-5: "Alt+5";*/
-/*	kb-custom-6: "Alt+6";*/
-/*	kb-custom-7: "Alt+7";*/
-/*	kb-custom-8: "Alt+8";*/
-/*	kb-custom-9: "Alt+9";*/
-/*	kb-custom-10: "Alt+0";*/
-/*	kb-custom-11: "Alt+exclam";*/
-/*	kb-custom-12: "Alt+at";*/
-/*	kb-custom-13: "Alt+numbersign";*/
-/*	kb-custom-14: "Alt+dollar";*/
-/*	kb-custom-15: "Alt+percent";*/
-/*	kb-custom-16: "Alt+dead_circumflex";*/
-/*	kb-custom-17: "Alt+ampersand";*/
-/*	kb-custom-18: "Alt+asterisk";*/
-/*	kb-custom-19: "Alt+parenleft";*/
-/*	kb-select-1: "Super+1";*/
-/*	kb-select-2: "Super+2";*/
-/*	kb-select-3: "Super+3";*/
-/*	kb-select-4: "Super+4";*/
-/*	kb-select-5: "Super+5";*/
-/*	kb-select-6: "Super+6";*/
-/*	kb-select-7: "Super+7";*/
-/*	kb-select-8: "Super+8";*/
-/*	kb-select-9: "Super+9";*/
-/*	kb-select-10: "Super+0";*/
-/*	kb-entry-history-up: "Control+Up";*/
-/*	kb-entry-history-down: "Control+Down";*/
-/*	ml-row-left: "ScrollLeft";*/
-/*	ml-row-right: "ScrollRight";*/
-/*	ml-row-up: "ScrollUp";*/
-/*	ml-row-down: "ScrollDown";*/
-/*	me-select-entry: "MousePrimary";*/
-/*	me-accept-entry: "MouseDPrimary";*/
-/*	me-accept-custom: "Control+MouseDPrimary";*/
-  timeout {
-      action: "kb-cancel";
-      delay:  0;
-  }
-  filebrowser {
-      directories-first: true;
-      sorting-method:    "name";
-  }
-}

home/rofi/scripts/cliphist.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-
-tmp_dir="/tmp/cliphist"
-rm -rf "$tmp_dir"
-
-if [[ -n "$1" ]]; then
-    cliphist decode <<<"$1" | wl-copy
-    exit
-fi
-
-mkdir -p "$tmp_dir"
-
-read -r -d '' prog <<EOF
-/^[0-9]+\s<meta http-equiv=/ { next }
-match(\$0, /^([0-9]+)\s(\[\[\s)?binary.*(jpg|jpeg|png|bmp)/, grp) {
-    system("echo " grp[1] "\\\\\t | cliphist decode >$tmp_dir/"grp[1]"."grp[3])
-    print \$0"\0icon\x1f$tmp_dir/"grp[1]"."grp[3]
-    next
-}
-1
-EOF
-cliphist list | gawk "$prog"

home/sway/config

@@ -1,156 +0,0 @@
-set $mod Mod4
-set $alt Mod1
-set $left h
-set $down j
-set $up k
-set $right l
-
-set $term $HOME/.config/sway/scripts/terminal.sh
-set $menu rofi -show run
-set $screenshot grim -g "$(slurp)" - | wl-copy
-set $browser librewolf
-set $clipboard rofi -show clipboard -show-icons
-set $emoji rofi -show emoji
-
-set $font_family DejaVu Sans Mono
-set $font_size 11
-set $bg #000000
-set $fg #ffffff
-set $fgi #888888
-
-set $wallpaper $HOME/wallpapers/nixos-c-book-large.png
-set $lock swaylock -f -i $wallpaper
-output * bg $wallpaper fill
-
-floating_modifier $mod normal
-default_border pixel
-smart_borders on
-focus_follows_mouse always
-# mouse_warping container
-
-bindsym $mod+Return exec $term
-bindsym $mod+Ctrl+q kill
-bindsym $mod+d exec $menu
-bindsym $mod+Shift+c reload
-bindsym $mod+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' -B 'Yes, exit sway' 'swaymsg exit'
-bindsym Print exec $screenshot
-bindsym $mod+comma exec $clipboard
-bindsym $mod+period exec $emoji
-
-bindsym $mod+$alt+b exec $browser
-bindsym $mod+$alt+a exec anki
-bindsym $mod+$alt+f exec thunar
-bindsym $mod+$alt+e exec evolution
-bindsym $mod+p exec bitwarden
-bindsym $mod+$alt+m exec element-desktop
-
-bindsym $mod+$left focus left
-bindsym $mod+$down focus down
-bindsym $mod+$up focus up
-bindsym $mod+$right focus right
-
-bindsym $mod+Shift+$left move left
-bindsym $mod+Shift+$down move down
-bindsym $mod+Shift+$up move up
-bindsym $mod+Shift+$right move right
-
-bindsym $mod+1 workspace number 1
-bindsym $mod+2 workspace number 2
-bindsym $mod+3 workspace number 3
-bindsym $mod+4 workspace number 4
-bindsym $mod+5 workspace number 5
-bindsym $mod+6 workspace number 6
-bindsym $mod+7 workspace number 7
-bindsym $mod+8 workspace number 8
-bindsym $mod+9 workspace number 9
-bindsym $mod+0 workspace number 10
-
-bindsym $mod+Shift+1 move container to workspace number 1
-bindsym $mod+Shift+2 move container to workspace number 2
-bindsym $mod+Shift+3 move container to workspace number 3
-bindsym $mod+Shift+4 move container to workspace number 4
-bindsym $mod+Shift+5 move container to workspace number 5
-bindsym $mod+Shift+6 move container to workspace number 6
-bindsym $mod+Shift+7 move container to workspace number 7
-bindsym $mod+Shift+8 move container to workspace number 8
-bindsym $mod+Shift+9 move container to workspace number 9
-bindsym $mod+Shift+0 move container to workspace number 10
-
-# mouse side buttons
-bindsym --whole-window BTN_EXTRA exec ~/.config/sway/scripts/remote.sh btn1
-bindsym --whole-window BTN_SIDE exec ~/.config/sway/scripts/remote.sh
-
-bindsym $mod+b splith
-bindsym $mod+v splitv
-
-bindsym $mod+s layout stacking
-bindsym $mod+w layout tabbed
-bindsym $mod+e layout toggle split
-
-bindsym $mod+f fullscreen
-
-bindsym $mod+Shift+space floating toggle
-
-bindsym $mod+space focus mode_toggle
-
-bindsym $mod+a focus parent
-bindsym $mod+Shift+a focus child
-
-bindsym $mod+Shift+minus move scratchpad
-bindsym $mod+minus scratchpad show
-
-mode "resize" {
-    bindsym $left resize shrink width 10px
-    bindsym $down resize grow height 10px
-    bindsym $up resize shrink height 10px
-    bindsym $right resize grow width 10px
-    bindsym Return mode "default"
-    bindsym Escape mode "default"
-}
-bindsym $mod+r mode "resize"
-
-# keys to adjust volue and brightness
-bindsym --locked XF86AudioMute exec "amixer -q sset Master,0 toggle"
-bindsym --locked XF86AudioLowerVolume exec "amixer -q set Master 1%-"
-bindsym --locked XF86AudioRaiseVolume exec "amixer -q sset Master 1%+"
-bindsym --locked XF86MonBrightnessDown exec brightnessctl set 1%-
-bindsym --locked XF86MonBrightnessUp exec brightnessctl set 1%+
-
-# lockscreen
-bindsym $mod+Control+l exec $lock
-
-font pango:$font_family $font_size
-
-for_window [app_id=mpv] inhibit_idle visible, floating enable, sticky enable
-for_window [app_id="LibreWolf" title="^Extension"] floating enable
-for_window [floating] border csd
-for_window [app_id="Bitwarden"] floating enable
-for_window [app_id=anki title="Add"] floating enable
-
-bar {
-	swaybar_command waybar
-}
-
-input "type:touchpad" {
-    dwt enabled
-    tap enabled
-    natural_scroll enabled
-}
-
-input "type:keyboard" {
-  xkb_layout us
-  xkb_options ctrl:nocaps
-  xkb_numlock enabled
-}
-
-exec wl-paste --watch cliphist store
-exec mako >> $HOME/mako.log 2>&1
-exec dbus-update-activation-environment --all
-
-exec swayidle -w \
-  timeout 300 'swaymsg "output * power off"' \
-  timeout 305 $lock \
-  resume 'swaymsg "output * power on"' \
-  before-sleep 'playerctl pause; swaylock -f'
-
-exec system-dnotify --ready

home/sway/scripts/remote.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-
-active_window=$(swaymsg -t get_tree |jq -r '..|try select(.focused == true) |.app_id')
-
-if [ "$1" = "btn1" ]; then
-  if [ "$active_window" = "anki" ]; then
-    wtype " "
-  elif [ "$active_window" = "foot" ]; then
-    wtype -M ctrl -M shift -k c -m ctrl -m shift
-  elif [ "$active_window" = "chromium-browser" ] || [ "$active_window" = "librewolf" ]; then
-    wtype -M alt -P right -p right -m alt
-  else
-    wtype -M ctrl -k c -m ctrl
-  fi
-else
-  if [ "$active_window" = "anki" ]; then
-    wtype "1"
-  elif [ "$active_window" = "foot" ]; then
-    wtype -M ctrl -M shift -k v
-    wtype -m ctrl
-  elif [ "$active_window" = "chromium-browser" ] || [ "$active_window" = "librewolf" ]; then
-    wtype -M alt -P left -p left -m alt
-  else
-    wtype -M ctrl -k v
-    wtype -m ctrl
-  fi
-fi

home/sway/scripts/terminal.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-
-focused_workspace=$(swaymsg -t get_workspaces | jq '.[] | select(.focused == true) | .num')
-
-foot_window_count=$(swaymsg -t get_tree | jq --argjson workspace "$focused_workspace" '[recurse(.nodes[]?) | select(.type == "workspace" and .num == $workspace) | recurse(.nodes[]?) | select(.app_id == "foot")] | length')
-
-next_session=$((focused_workspace * 10))
-
-if [ "$foot_window_count" -gt 0 ]
-then
-  next_session=$((next_session + foot_window_count))
-fi
-
-foot tmux new-session -A -s ${next_session}

home/vscode.nix

@@ -1,18 +0,0 @@
-{ pkgs, ... }:
-{
-  programs.vscode = {
-    enable = true;
-    package = pkgs.vscodium;
-    enableUpdateCheck = false;
-    enableExtensionUpdateCheck = false;
-    mutableExtensionsDir = false;
-    extensions = with pkgs.vscode-extensions; [
-      vscodevim.vim
-      jnoortheen.nix-ide # nix language support
-      editorconfig.editorconfig # editorconfig
-      dracula-theme.theme-dracula # color scheme
-      tomoki1207.pdf # pdf viewer
-      yzhang.markdown-all-in-one # markdown tools
-    ];
-  };
-}

home/waybar/config

@@ -1,81 +0,0 @@
-{
-  "layer": "top", // Waybar on highest layer so tooltips go over windows
-    "output": "eDP-1", // Set output to primary monitor
-    "height": 40, // Set height to avoid jumping due to active workspace indicator
-		
-		"margin-left": 0,
-		"margin-right": 0,
-		"margin-top": 0,
-    "modules-left": ["sway/workspaces", "clock#time", "clock#date", "battery"], // Sets modules for the left of the bar
-    "modules-center": ["sway/window"], // Set modules for the center of the bar
-    "modules-right": ["tray", "temperature", "cpu", "memory", "wireplumber"], // Set modules for the right of the bar
-    "clock#time": {
-    "format": "<span color=\"#7aa2f7\"> </span>{:%H:%M:%S}",
-    "interval": 1,
-  },
-  "clock#date": {
-    "format": "<span color=\"#7aa2f7\"> </span>{:%Y/%m/%d}",
-    "tooltip-format": "<tt>{calendar}</tt>",
-    "interval": 360,
-    "calendar": {
-      "mode": "month",
-      "mode-mon-col": 4,
-      "weeks-pos": "right",
-      "on-scroll": 1,
-      "on-click-right": "mode",
-      "format": {
-        "months": "<span color='#c0caf5'><b>{}</b></span>",
-        "days": "<span color='#c0caf5'><b>{}</b></span>",
-        "weeks": "<span color='#7dcfff'><b>W{}</b></span>",
-        "weekdays": "<span color='#ff9e64'><b>{}</b></span>",
-        "today": "<span color='#f7768e'><b><u>{}</u></b></span>",
-      },
-    },
-  },
-  "battery": {
-    "interval": 60,
-    "states": {
-      "warning": 40,
-      "critical": 20,
-    },
-    "format": "{icon} {capacity}%",
-    "format-icons": [
-      "<span color=\"#f7768e\"> </span>",
-      "<span color=\"#f7768e\"> </span>",
-      "<span color=\"#7aa2f7\"> </span>",
-      "<span color=\"#7aa2f7\"> </span>",
-      "<span color=\"#7aa2f7\"> </span>",
-    ],
-    "format-charging": "<span color=\"#e0af68\">󱐌</span> {capacity}%",
-  },
-  "cpu": {
-    "format": "<span color=\"#7aa2f7\"> </span>{usage}%",
-    "interval": 4,
-  },
-  "memory": {
-    "format": "<span color=\"#7aa2f7\"> </span>{used}GiB",
-    "interval": 4,
-  },
-  "temperature": {
-    "hwmon-path": "/sys/class/hwmon/hwmon4/temp1_input",
-    "critical-threshold": 80,
-    "format": "<span color=\"#7aa2f7\"> </span>{temperatureC}°C",
-    "format-critical": "<span color=\"#f7768e\"> </span>{temperatureC}°C",
-    "interval": 4,
-  },
-  "wireplumber": {
-    "scroll-step": 1, // %, can be a float
-    "format": "<span color=\"#7aa2f7\">{icon} </span>{volume}%",
-    "format-muted": "<span color=\"#f7768e\">󰝟 </span>Muted",
-    "format-icons": ["", "", ""],
-    "on-click": "pavucontrol",
-		"interval": 4,
-  },
-  "sway/window": {
-    "max-length": 64,
-  },
-  "tray": {
-    "icon-size": 22,
-    "spacing": 6,
-  }
-}

home/waybar/style.css

@@ -1,70 +0,0 @@
-.module,
-#clock.date,
-#clock.time,
-#workspaces button {
-  background: transparent;
-  padding: 0 10px;
-  font-family: RobotoMono Nerd Font;
-  font-weight: 900;
-  font-size: 13pt;
-  color: #c0caf5;
-}
-
-/* main waybar */
-window#waybar {
-  background: rgba(26, 27, 38, 1);
-	border: 2px solid #414868;
-}
-
-/* when hovering over modules */
-tooltip {
-  background: #1e1e2e;
-  border-radius: 0;
-}
-
-#workspaces {
-	padding-right: 0;
-}
-
-#workspaces button {
-  padding: 2px;
-}
-
-#clock {
-	padding-right: 100px;
-}
-
-
-/* Sets active workspace to have a solid line on the bottom */
-#workspaces button.focused {
-  border-bottom: 2px solid #7aa2f7;
-  border-radius: 0;
-	margin-top: 0px;
-  transition: none;
-}
-
-/* More workspace stuff for highlighting on hover */
-#workspaces button.focused {
-  color: #a6adc8;
-}
-
-#workspaces button.urgent {
-  color: #f7768e;
-}
-
-#workspaces button:hover {
-  background: #11111b;
-  color: #cdd6f4;
-}
-
-/* Hide window module when not focused on window or empty workspace */
-window#waybar.empty #window {
-  padding: 0;
-  margin: 0;
-  opacity: 0;
-}
-
-/* Set up rounding to make these modules look like separate pills */
-#tray {
-  margin-right: 4px;
-}

home/yt/chunk.nix

@@ -16,7 +16,6 @@
   systemd.user.startServices = "sd-switch";
 
   home.packages = with pkgs; [
-    foot.terminfo
     attic-server
   ];
 }

home/yt/codespace.nix

@@ -1,22 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    ./common.nix
-  ];
-  home = {
-    username = "codespace";
-    homeDirectory = "/home/codespace";
-    stateVersion = "24.05";
-  };
-  programs.home-manager.enable = true;
-
-  systemd.user.startServices = "sd-switch";
-
-  home.packages = with pkgs; [
-    foot.terminfo
-    attic-client
-  ];
-}

home/yt/common.nix

@@ -32,11 +32,12 @@
     userName = "cy";
     userEmail = "cy@cy7.sh";
     delta = {
-      enable = true;
+      enable = false;
       options = {
         navigate = true;
       };
     };
+    difftastic.enable = true;
     extraConfig = {
       init.defaultBranch = "main";
       push.autoSetupRemote = true; # assume -u on first push
@@ -44,7 +45,11 @@
         rebase = true;
         autostash = true;
       };
-      merge.tool = "vimdiff";
+      merge = {
+        tool = "vimdiff";
+        keepBackup = false;
+        prompt = false;
+      };
       rebase = {
         stat = true;
         autoStash = true;
@@ -52,12 +57,20 @@
         updateRefs = true;
       };
       help.autocorrect = 1;
-      mergetool = {
-        prompt = false;
-        path = "nvim-open";
+      "mergetool \"vimdiff\"".cmd = "nvim -d $LOCAL $REMOTE $MERGED -c '$wincmd w' -c 'wincmd J'";
+      url = {
+        "ssh://git@github.com/" = {
+          insteadOf = [
+            "https://github.com/"
+            "github:"
+            "gh:"
+          ];
+        };
       };
     };
   };
   programs.ripgrep.enable = true;
-  programs.man.generateCaches = true;
+  # programs.man.generateCaches = true; # slows down eval
+  programs.fd.enable = true;
+  news.display = "silent";
 }

home/yt/ytnix.nix

@@ -1,11 +1,14 @@
 {
   pkgs,
+  lib,
   ...
 }:
 {
   imports = [
     ./common.nix
-    ../foot.nix
+    ../irssi.nix
+    ../kitty.nix
+    ../codium.nix
   ];
   home = {
     username = "yt";
@@ -14,133 +17,138 @@
   };
   programs.home-manager.enable = true;
 
-  systemd.user.startServices = "sd-switch";
-
-  qt = {
-    enable = true;
-    platformTheme.name = "gtk";
-    style.name = "adwaita-dark";
-    style.package = pkgs.adwaita-qt;
-  };
-
-  gtk = {
-    enable = true;
-    cursorTheme = {
+  home.pointerCursor = {
     package = pkgs.bibata-cursors;
-      name = "Bibata-Modern";
-    };
-    theme = {
-      package = pkgs.adw-gtk3;
-      name = "adw-gtk3-dark";
-    };
-    iconTheme = {
-      package = pkgs.adwaita-icon-theme;
-      name = "Adwaita";
-    };
+    name = "Bibata-Modern-Classic";
+    size = 23;
+    gtk.enable = true;
+    x11.enable = true;
   };
 
-  home.sessionVariables = {
-    ANKI_WAYLAND = "1";
-  };
-
-  home.packages = with pkgs; [
-    firefox
+  home.packages =
+    with pkgs;
+    lib.flatten [
       ungoogled-chromium
       librewolf
       bitwarden-desktop
       bitwarden-cli
       fastfetch
-    discord
-    nwg-look
-    kdePackages.gwenview
-    kdePackages.okular
-    kdePackages.qtwayland
+      (with kdePackages; [
+        gwenview
+        okular
+      ])
       mpv
-    yt-dlp
       signal-desktop
-    azure-cli
-    pavucontrol
       btop
-    grim
-    slurp
-    rofi-wayland
-    rofimoji
-    cliphist
       jq
-    bash-language-server
       sqlite
       usbutils
-    clang-tools
       calibre
       tor-browser
       wtype
       bat
-    yarn
       rclone
       go
-    rustup
+      (rust-bin.selectLatestNightlyWith (
+        toolchain:
+        toolchain.default.override {
+          extensions = [ "rust-src" ];
+        }
+      ))
       pwgen
-    lua-language-server
       gnumake
-    foot
-    minisign
       unzip
-    lm_sensors
-    sshfs
-    python312Packages.python-lsp-server
-    gopls
-    anki
+      anki-bin
       trezorctl
       trezor-agent
       q
-    opentofu
-    terraform-ls
       gdb
-    clang
-    seahorse
-    github-cli
+      fuzzel
+      hugo
+      ghidra
+      sccache
+      awscli2
+      (cutter.withPlugins (
+        p: with p; [
+          rz-ghidra
+          jsdec
+          sigdb
+        ]
+      ))
+      p7zip
+      qbittorrent
+      nil
+      android-tools
+      frida-tools
+      mitmproxy
+      (python313.withPackages (
+        p: with p; [
+          python-lsp-server
+          pip
+          virtualenv
+        ]
+      ))
+      jadx
+      scrcpy
+      syncthing
+      syncthingtray
+      (with llvmPackages; [
+        clangUseLLVM
+        compiler-rt
+        libllvm
+      ])
+      nix-output-monitor
+      wl-clipboard-rs
+      pixelflasher
+      element-desktop
+      freetube
+    ];
+
+  home.sessionVariables = {
+    # to make ghidra work on xwayland
+    _JAVA_AWT_WM_NONREPARENTING = 1;
+
+    # sccache stuff
+    RUSTC_WRAPPER = "${lib.getExe pkgs.sccache}";
+    SCCACHE_BUCKET = "sccache";
+    SCCACHE_REGION = "us-east-1";
+    SCCACHE_ENDPOINT = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
+    SCCACHE_ALLOW_CORE_DUMPS = "true";
+    SCCACHE_S3_USE_SSL = "true";
+    SCCACHE_CACHE_MULTIARCH = "true";
+    SCCACHE_LOG = "warn";
+    AWS_DEFAULT_REGION = "us-east-1";
+    AWS_ENDPOINT_URL = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
+    AWS_ACCESS_KEY_ID = "$(cat /run/secrets/aws/key_id)";
+    AWS_SECRET_ACCESS_KEY = "$(cat /run/secrets/aws/key_secret)";
+
+    # bitwarden ssh agent
+    SSH_AUTH_SOCK = "$HOME/.bitwarden-ssh-agent.sock";
+  };
+
+  home.sessionPath = [
+    "$HOME/.cargo/bin"
+    "$HOME/go/bin"
   ];
 
-  programs.waybar.enable = true;
   programs.feh.enable = true;
 
-  services.mako = {
-    enable = true;
-    backgroundColor = "#1a1a1a";
-    defaultTimeout = 5000;
-    borderSize = 0;
-    borderRadius = 10;
-    font = "DejaVu Sans Mono 11";
-    padding = "10";
-    textColor = "#ffffff";
-    extraConfig = ''
-      [urgency=high]
-      background-color=#c00000
-      border-color=#ff0000
-    '';
-  };
-
   xdg.configFile = {
-    sway.source = ../sway;
-    rofi.source = ../rofi;
-    waybar.source = ../waybar;
     mpv.source = ../mpv;
   };
 
-  programs.newsboat = {
-    enable = true;
-    extraConfig = ''
-      urls-source "miniflux"
-      miniflux-url "https://rss.cything.io/"
-      miniflux-login "cy"
-      miniflux-passwordfile /run/secrets/newsboat/miniflux
-    '';
-  };
-
-  services.gnome-keyring.enable = true;
-
   programs.direnv = {
     enable = true;
     nix-direnv.enable = true;
   };
+
+  programs.git.extraConfig = {
+    user = {
+      signingKey = "~/.ssh/id_ed25519";
+    };
+    gpg.format = "ssh";
+    commit.gpgsign = true;
+  };
+
+  programs.nix-index-database.comma.enable = true;
 }

home/zsh/default.nix

@@ -36,19 +36,22 @@
       searchUpKey = "^p";
       searchDownKey = "^n";
     };
+
+    # prezto = {
+    #   enable = true;
+    #   caseSensitive = false;
+    #   editor.keymap = "vi";
+    # };
+
     initExtra = ''
       # disable control+s to pause terminal
       unsetopt FLOW_CONTROL
-      # manually integrate fzf cause we need to make sure zsh-vi-mode
-      # won't override C-r
-      function zvm_after_init() {
-        eval "$(${pkgs.fzf}/bin/fzf --zsh)"
-      }
 
       # useful emacs mode bindings
       bindkey -M viins "^E" end-of-line
       bindkey -M viins "^A" beginning-of-line
       bindkey -M viins "^B" backward-char
+      bindkey -M viins "^F" forward-char
 
       # accept one word completion
       bindkey -M viins "^S" forward-word
@@ -87,9 +90,9 @@
       "ta" = "tmux new-session -A -s";
       "se" = "sudoedit";
       "s" = "sudo";
-      "nrs" = "sudo nixos-rebuild switch --flake .";
-      "nrt" = "sudo nixos-rebuild test --flake .";
-      "hrs" = "home-manager switch --flake .";
+      "nrs" = "sudo nixos-rebuild switch -L --flake . --log-format internal-json -v |& nom --json";
+      "nrt" = "sudo nixos-rebuild test -L --flake . --log-format internal-json -v |& nom --json";
+      "hrs" = "home-manager switch -L --flake . |& nom --json";
       "g" = "git";
       "ga" = "git add";
       "gaa" = "git add --all";
@@ -109,12 +112,13 @@
       "grv" = "git remote --verbose";
       "gs" = "git status --short";
       "gss" = "git status";
+      "code" = "codium";
     };
   };
 
   programs.fzf.enableZshIntegration = true;
   programs.zoxide.enableZshIntegration = true;
   programs.eza.enableZshIntegration = true;
-  programs.nix-index.enableZshIntegration = false;
-  programs.direnv.enableZshIntegration = false;
+  programs.nix-index.enableZshIntegration = true;
+  programs.direnv.enableZshIntegration = true;
 }

hosts/chunk/Caddyfile

@@ -1,89 +0,0 @@
-{
-  acme_ca https://acme.zerossl.com/v2/DV90
-  acme_eab {
-    key_id {$EAB_KEY_ID}
-    mac_key {$EAB_MAC_KEY}
-  }
-}
-
-(common) {
-  encode zstd gzip
-  header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
-}
-
-git.cything.io {
-  import common
-
-  # wrap in route so things are evaluated in the order written
-  route {
-    # rewrite gitlab URIs to make it work with forgejo
-    uri path_regexp /-/ /
-    uri replace /blob/ /src/
-    redir https://git.cy7.sh{uri} permanent
-  }
-}
-
-git.cy7.sh {
-  import common
-  reverse_proxy localhost:3000
-}
-
-rss.cy7.sh {
-  import common
-  reverse_proxy localhost:8080
-}
-
-photos.cy7.sh {
-  import common
-  reverse_proxy localhost:2283
-}
-
-chat.cything.io {
-  import common
-  reverse_proxy localhost:8448
-}
-
-pass.cy7.sh {
-  import common
-  reverse_proxy localhost:8081
-}
-
-dns.cything.io {
-  import common
-  reverse_proxy localhost:8082
-}
-
-pad.cything.io {
-  import common
-  reverse_proxy localhost:8085
-}
-
-red.cything.io {
-  import common
-  reverse_proxy localhost:8087
-}
-
-grafana.cything.io {
-  import common
-  reverse_proxy localhost:8088
-}
-
-element.cything.io {
-  import common
-  reverse_proxy localhost:8089
-}
-
-cache.cything.io {
-  import common
-  reverse_proxy localhost:8090
-}
-
-s3.cy7.sh {
-  import common
-  reverse_proxy localhost:3900
-}
-
-admin.s3.cy7.sh {
-  import common
-  reverse_proxy localhost:3903
-}

hosts/chunk/adguard.nix

@@ -1,24 +0,0 @@
-{ ... }:
-{
-  services.adguardhome = {
-    enable = true;
-    host = "127.0.0.1";
-    port = 8082;
-    settings = {
-      http.port = "8083";
-      users = [
-        {
-          name = "cy";
-          password = "$2y$10$BZy2zYJj5z4e8LZCq/GwuuhWUafL/MNFO.YcsAMmpDS.2krPxi7KC";
-        }
-      ];
-      # do not listen eveywhere cause podman runs it's own DNS
-      dns.bind_hosts = [
-        "127.0.0.1"
-        "::1"
-        "31.59.129.225"
-        "2a0f:85c1:840:2bfb::1"
-      ];
-    };
-  };
-}

hosts/chunk/attic.nix

@@ -1,34 +0,0 @@
-{ config, ... }:
-{
-  services.atticd = {
-    enable = true;
-
-    environmentFile = config.sops.secrets."attic/env".path;
-
-    settings = {
-      listen = "[::]:8090";
-      api-endpoint = "https://cache.cything.io/";
-      allowed-hosts = [ "cache.cything.io" ];
-      require-proof-of-possession = false;
-      compression.type = "zstd";
-      database.url = "postgresql:///atticd?host=/run/postgresql";
-
-      storage = {
-        type = "local";
-        path = "/mnt/attic";
-      };
-
-      garbage-collection = {
-        default-retention-period = "3 months";
-      };
-
-      chunking = {
-        nar-size-threshold = 0; # disables chunking
-        min-size = 0;
-        avg-size = 0;
-        max-size = 0;
-        concurrent-chunk-uploads = 32;
-      };
-    };
-  };
-}

hosts/chunk/conduit.nix

@@ -1,40 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-{
-  virtualisation.oci-containers.containers.conduit = {
-    image = "ghcr.io/girlbossceo/conduwuit:main";
-    autoStart = true;
-    ports = [ "127.0.0.1:8448:8448" ];
-    pull = "newer";
-    environment = {
-      CONDUWUIT_SERVER_NAME = "cything.io";
-      CONDUWUIT_DATABASE_PATH = "/var/lib/conduwuit";
-      CONDUWUIT_PORT = "8448";
-      CONDUWUIT_MAX_REQUEST_SIZE = "20000000"; # in bytes ~20MB
-      CONDUWUIT_ALLOW_REGISTRATION = "false";
-      CONDUWUIT_ALLOW_FEDERATION = "true";
-      CONDUWUIT_ALLOW_CHECK_FOR_UPDATES = "true";
-      CONDUWUIT_TRUSTED_SERVERS = ''["matrix.org"]'';
-      CONDUWUIT_ADDRESS = "0.0.0.0";
-      # CONDUIT_CONFIG = "";
-    };
-    volumes = [
-      "/opt/conduit/db:/var/lib/conduwuit/"
-    ];
-    networks = [ "conduit-net" ];
-  };
-
-  systemd.services.create-conduit-net = {
-    serviceConfig.Type = "oneshot";
-    wantedBy = with config.virtualisation.oci-containers; [
-      "${backend}-conduit.service"
-    ];
-    script = ''
-      ${pkgs.podman}/bin/podman network exists conduit-net || \
-      ${pkgs.podman}/bin/podman network create conduit-net
-    '';
-  };
-}

hosts/chunk/conduwuit.nix

@@ -8,4 +8,26 @@
       allow_check_for_updates = true;
     };
   };
+
+  services.caddy.virtualHosts."chat.cything.io".extraConfig = ''
+    import common
+    reverse_proxy localhost:8448
+  '';
+
+  services.caddy.virtualHosts."cything.io" = {
+    serverAliases = [ "www.cything.io" ];
+    extraConfig = ''
+      import common
+
+      header /.well-known/matrix/* Content-Type application/json
+      header /.well-known/matrix/* Access-Control-Allow-Origin *
+      header /.well-known/matrix/* Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH,HEAD
+      header /.well-known/matrix/* Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization,Origin,Accept
+      route {
+        respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
+        respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
+        redir https://cy7.sh/posts{uri} permanent
+      }
+    '';
+  };
 }

hosts/chunk/default.nix

@@ -1,7 +1,6 @@
 {
-  config,
-  lib,
   pkgs,
+  lib,
   ...
 }:
 {
@@ -12,20 +11,18 @@
     ./backup.nix
     ./rclone.nix
     ./postgres.nix
-    ./wireguard.nix
-    ./adguard.nix
     ./hedgedoc.nix
     ./miniflux.nix
     ./redlib.nix
     ./vaultwarden.nix
-    ./wireguard.nix
     ./grafana.nix
     ./conduwuit.nix
     ./immich.nix
     ./element.nix
-    ./attic.nix
     ./forgejo.nix
     ./garage.nix
+    ./tailscale.nix
+    ./tor.nix
   ];
 
   sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@@ -33,9 +30,6 @@
     "borg/rsyncnet" = {
       sopsFile = ../../secrets/borg/chunk.yaml;
     };
-    "services/ntfy" = {
-      sopsFile = ../../secrets/services/ntfy.yaml;
-    };
     "rclone/config" = {
       sopsFile = ../../secrets/rclone.yaml;
     };
@@ -48,15 +42,6 @@
     "hedgedoc/env" = {
       sopsFile = ../../secrets/services/hedgedoc.yaml;
     };
-    "wireguard/private" = {
-      sopsFile = ../../secrets/wireguard/chunk.yaml;
-    };
-    "wireguard/psk-yt" = {
-      sopsFile = ../../secrets/wireguard/chunk.yaml;
-    };
-    "wireguard/psk-phone" = {
-      sopsFile = ../../secrets/wireguard/chunk.yaml;
-    };
     "miniflux/env" = {
       sopsFile = ../../secrets/services/miniflux.yaml;
     };
@@ -66,39 +51,75 @@
     "attic/env" = {
       sopsFile = ../../secrets/services/attic.yaml;
     };
-
     "garage/env" = {
       sopsFile = ../../secrets/services/garage.yaml;
     };
+    "tailscale/auth" = {
+      sopsFile = ../../secrets/services/tailscale.yaml;
+    };
+    "zipline/env" = {
+      sopsFile = ../../secrets/services/zipline.yaml;
+    };
+    "searx/env" = {
+      sopsFile = ../../secrets/services/searx.yaml;
+    };
   };
 
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/vda";
+  boot = {
+    loader.grub.enable = true;
+    loader.grub.device = "/dev/vda";
+    kernelPackages = pkgs.linuxPackages_latest;
+  };
 
   system.stateVersion = "24.05";
 
   # network stuff
-
-  networking.hostName = "chunk";
-  networking.networkmanager.enable = true;
-  networking.firewall = {
+  networking = {
+    hostName = "chunk";
+    networkmanager.enable = true;
+    firewall = {
       enable = true;
+      trustedInterfaces = [ "tailscale0" ];
       allowedTCPPorts = [
         22
         80
         443
-      53
-      853
       ];
       allowedUDPPorts = [
         443
-      51820
-      53
-      853
-    ]; # 51820 is wireguard
-    trustedInterfaces = [ "wg0" ];
+      ];
+      extraCommands =
+        let
+          ethtool = lib.getExe pkgs.ethtool;
+          tc = lib.getExe' pkgs.iproute2 "tc";
+        in
+        ''
+          # disable TCP segmentation offload (https://wiki.archlinux.org/title/Advanced_traffic_control#Prerequisites)
+          ${ethtool} -K ens18 tso off
+
+          # clear existing rules
+          ${tc} qdisc del dev ens18 root || true
+
+          # create HTB hierarchy
+          ${tc} qdisc add dev ens18 root handle 1: htb default 30
+          ${tc} class add dev ens18 parent 1: classid 1:1 htb rate 100% ceil 100%
+          # tailscale
+          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 30% ceil 100%
+          # caddy
+          ${tc} class add dev ens18 parent 1:1 classid 1:20 htb rate 30% ceil 100%
+          # rest
+          ${tc} class add dev ens18 parent 1:1 classid 1:30 htb rate 40% ceil 100%
+
+          # mark traffic
+          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/tailscaled.service" -j MARK --set-mark 1
+          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 2
+
+          # route marked packets
+          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 1 fw flowid 1:10
+          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 2 fw flowid 1:20
+        '';
     };
-  networking.interfaces.ens18 = {
+    interfaces.ens18 = {
       ipv6.addresses = [
         {
           address = "2a0f:85c1:840:2bfb::1";
@@ -112,19 +133,14 @@
         }
       ];
     };
-  networking.defaultGateway6 = {
+    defaultGateway6 = {
       address = "2a0f:85c1:840::1";
       interface = "ens18";
     };
-  networking.defaultGateway = {
+    defaultGateway = {
       address = "31.59.129.1";
       interface = "ens18";
     };
-
-  i18n.defaultLocale = "en_US.UTF-8";
-  console = {
-    font = "Lat2-Terminus16";
-    useXkbConfig = true;
   };
 
   users.users.yt = {
@@ -158,7 +174,6 @@
     tmux
     file
     sops
-    attic-server
   ];
 
   environment.variables = {
@@ -177,24 +192,12 @@
   programs.gnupg.agent.enable = true;
   programs.git.enable = true;
 
-  services.caddy = {
-    enable = true;
-    configFile = ./Caddyfile;
-    environmentFile = config.sops.secrets."caddy/env".path;
-    logFormat = lib.mkForce "level INFO";
-  };
+  my.caddy.enable = true;
 
   # container stuff
-  virtualisation.containers.enable = true;
-  virtualisation.podman = {
-    enable = true;
-    # create 'docker' alias for podman, to use as
-    # drop-in replacement
-    dockerCompat = true;
-    defaultNetwork.settings = {
-      dns_enabled = true;
-      ipv6_enabled = true;
-    };
-  };
-  virtualisation.oci-containers.backend = "podman";
+  my.containerization.enable = true;
+
+  my.roundcube.enable = true;
+  my.zipline.enable = true;
+  my.searx.enable = true;
 }

hosts/chunk/deluge.nix

@@ -1,10 +0,0 @@
-{ ... }:
-{
-  services.deluge = {
-    enable = true;
-    web = {
-      enable = true;
-      port = 8112;
-    };
-  };
-}

hosts/chunk/element.nix

@@ -7,9 +7,12 @@
   virtualisation.oci-containers.containers.element = {
     image = "vectorim/element-web";
     autoStart = true;
-    ports = [ "127.0.0.1:8089:80" ];
+    ports = [ "127.0.0.1:8089:8089" ];
     pull = "newer";
     networks = [ "element-net" ];
+    environment = {
+      ELEMENT_WEB_PORT = "8089";
+    };
   };
 
   systemd.services.create-element-net = {
@@ -22,4 +25,9 @@
       ${pkgs.podman}/bin/podman network create element-net
     '';
   };
+
+  services.caddy.virtualHosts."element.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8089
+  '';
 }

hosts/chunk/forgejo.nix

@@ -1,7 +1,8 @@
-{ ... }:
+{ pkgs, ... }:
 {
   services.forgejo = {
     enable = true;
+    package = pkgs.forgejo; # uses forgejo-lts by default
     user = "git";
     group = "git";
     settings = {
@@ -16,10 +17,11 @@
       service.DISABLE_REGISTRATION = true;
       ui = {
         AMBIGUOUS_UNICODE_DETECTION = false;
-        DEFAULT_THEME = "gitea-dark";
+        DEFAULT_THEME = "forgejo-dark";
       };
       actions.ENABLED = false;
       repository.ENABLE_PUSH_CREATE_USER = true;
+      indexer.REPO_INDEXER_ENABLED = true;
     };
     database = {
       type = "postgres";
@@ -28,4 +30,24 @@
       name = "git";
     };
   };
+
+  services.caddy.virtualHosts."git.cy7.sh".extraConfig = ''
+    import common
+
+    # renamed repo
+    uri replace /cy/infra /cy/nixos-config
+
+    reverse_proxy localhost:3000
+  '';
+  services.caddy.virtualHosts."git.cything.io".extraConfig = ''
+    import common
+
+    # wrap in route so things are evaluated in the order written
+    route {
+      # rewrite gitlab URIs to make it work with forgejo
+      uri path_regexp /-/ /
+      uri replace /blob/ /src/
+      redir https://git.cy7.sh{uri} permanent
+    }
+  '';
 }

hosts/chunk/garage.nix

@@ -6,8 +6,14 @@
     settings = {
       data_dir = "/mnt/garage";
       s3_api = {
-        s3_region = "earth";
+        s3_region = "us-east-1";
         api_bind_addr = "[::]:3900";
+        root_domain = "s3.cy7.sh";
+      };
+      s3_web = {
+        bind_addr = "[::]:3902";
+        root_domain = ".web.s3.cy7.sh";
+        index = "index.html";
       };
       admin.api_bind_addr = "[::]:3903";
       rpc_bind_addr = "[::]:3901";
@@ -16,4 +22,22 @@
     };
     environmentFile = config.sops.secrets."garage/env".path;
   };
+
+  services.caddy.virtualHosts = {
+    "s3.cy7.sh" = {
+      serverAliases = [ "*.s3.cy7.sh" ];
+      extraConfig = ''
+        import common
+        reverse_proxy localhost:3900
+      '';
+    };
+    "*.web.s3.cy7.sh".extraConfig = ''
+      import common
+      reverse_proxy localhost:3902
+    '';
+    "admin.s3.cy7.sh".extraConfig = ''
+      import common
+      reverse_proxy localhost:3903
+    '';
+  };
 }

hosts/chunk/gitlab.nix

@@ -1,35 +0,0 @@
-{ config, ... }:
-{
-  services.gitlab = {
-    enable = true;
-    https = true;
-    host = "git.cything.io";
-    user = "git"; # so that you can ssh with git@git.cything.io
-    group = "git";
-    port = 443; # this *not* the port gitlab will run on
-    puma.workers = 0; # https://docs.gitlab.com/omnibus/settings/memory_constrained_envs.html#optimize-puma
-    sidekiq.concurrency = 5;
-    databaseUsername = "git"; # needs to be same as user
-    initialRootEmail = "hi@cything.io";
-    initialRootPasswordFile = config.sops.secrets."gitlab/root".path;
-    secrets = {
-      secretFile = config.sops.secrets."gitlab/secret".path;
-      otpFile = config.sops.secrets."gitlab/otp".path;
-      jwsFile = config.sops.secrets."gitlab/jws".path;
-      dbFile = config.sops.secrets."gitlab/db".path;
-    };
-    backup = {
-      startAt = "daily";
-      # we already postgresqlbackup.service
-      skip = [ "db" ];
-      keepTime = 48; # hours
-    };
-    extraConfig = {
-      gitlab = {
-        # NOTE: default_syntax_highlighting_theme needs to be set in the application_settings table in the database
-        default_color_mode = 2;
-      };
-      prometheus.enabled = false;
-    };
-  };
-}

hosts/chunk/grafana.nix

@@ -7,7 +7,7 @@
       http_port = 8088;
       enforce_domain = true;
       enable_gzip = true;
-      domain = "grafana.cything.io";
+      domain = "grafana.cy7.sh";
     };
     settings.analytics.reporting_enabled = false;
   };
@@ -31,4 +31,9 @@
       }
     ];
   };
+
+  services.caddy.virtualHosts."grafana.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8088
+  '';
 }

hosts/chunk/hedgedoc.nix

@@ -16,4 +16,9 @@
       protocolUseSSL = true;
     };
   };
+
+  services.caddy.virtualHosts."pad.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8085
+  '';
 }

hosts/chunk/immich.nix

@@ -1,6 +1,7 @@
 {
   pkgs,
   config,
+  lib,
   ...
 }:
 let
@@ -67,21 +68,9 @@ in
       ];
       networks = [ "immich-net" ];
     };
-
-    # immich-ml = {
-    #   image = "ghcr.io/immich-app/immich-machine-learning:release";
-    #   autoStart = true;
-    #   pull = "newer";
-    #   environment = {
-    #     REDIS_HOSTNAME = "immich-redis";
-    #     DB_HOSTNAME = "immich-db";
-    #   };
-    #   volumes = [ "${modelCache}:/cache" ];
-    #   networks = [ "immich-net" ];
-    # };
   };
 
-  systemd.services.create-immich-net = {
+  systemd.services.create-immich-net = rec {
     serviceConfig.Type = "oneshot";
     requiredBy = with config.virtualisation.oci-containers; [
       "${backend}-immich.service"
@@ -89,10 +78,15 @@ in
       "${backend}-immich-redis.service"
       # "${backend}-immich-ml.service"
     ];
-    before = config.systemd.services.create-immich-net.requiredBy;
+    before = requiredBy;
     script = ''
-      ${pkgs.podman}/bin/podman network exists immich-net || \
-      ${pkgs.podman}/bin/podman network create immich-net
+      ${lib.getExe pkgs.podman} network exists immich-net || \
+      ${lib.getExe pkgs.podman} network create immich-net
     '';
   };
+
+  services.caddy.virtualHosts."photos.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:2283
+  '';
 }

hosts/chunk/jellyfin.nix

@@ -1,8 +0,0 @@
-{ ... }:
-{
-  services.jellyfin = {
-    enable = true;
-    dataDir = "/mnt/jellyfin";
-    configDir = "/var/lib/jellyfin/config";
-  };
-}

hosts/chunk/miniflux.nix

@@ -9,4 +9,9 @@
       FORCE_REFRESH_INTERVAL = 0; # don't rate limit me
     };
   };
+
+  services.caddy.virtualHosts."rss.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8080
+  '';
 }

hosts/chunk/rclone.nix

@@ -34,7 +34,7 @@
       ExecStartPre = "/usr/bin/env mkdir -p /mnt/attic";
       ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
         config.sops.secrets."rclone/config".path
-      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 15G --allow-other rsyncnet:attic /mnt/attic ";
+      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 2G --allow-other rsyncnet:attic /mnt/attic ";
       ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/attic";
     };
   };
@@ -55,6 +55,4 @@
       ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/garage";
     };
   };
-
-  programs.fuse.userAllowOther = true;
 }

hosts/chunk/redlib.nix

@@ -10,4 +10,9 @@
       REDLIB_ROBOTS_DISABLE_INDEXING = "on";
     };
   };
+
+  services.caddy.virtualHosts."red.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8087
+  '';
 }

hosts/chunk/tailscale.nix

@@ -0,0 +1,16 @@
+{ config, ... }:
+{
+  services.tailscale = {
+    enable = true;
+    authKeyFile = config.sops.secrets."tailscale/auth".path;
+    extraUpFlags = [
+      "--advertise-exit-node"
+      "--accept-dns=false"
+    ];
+    extraDaemonFlags = [
+      "--no-logs-no-support"
+    ];
+    useRoutingFeatures = "server";
+    openFirewall = true;
+  };
+}

hosts/chunk/tor.nix

@@ -10,7 +10,7 @@
     settings = {
       ORPort = 9001;
       Nickname = "chunk";
-      MaxAdvertisedBandwidth = "20MBytes";
+      # MaxAdvertisedBandwidth = "20MBytes";
     };
   };
 }

hosts/chunk/vaultwarden.nix

@@ -1,13 +1,9 @@
-{ config, ... }:
+{ ... }:
 {
-  services.vaultwarden = {
-    enable = true;
-    dbBackend = "postgresql";
-    environmentFile = config.sops.secrets."vaultwarden/env".path;
-    config = {
-      ROCKET_ADDRESS = "127.0.0.1";
-      ROCKET_PORT = "8081";
-      DATABASE_URL = "postgresql://vaultwarden:vaultwarden@127.0.0.1:5432/vaultwarden";
-    };
-  };
+  my.vaultwarden.enable = true;
+
+  services.caddy.virtualHosts."pass.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8081
+  '';
 }

hosts/common.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ inputs, ... }:
 {
   nix = {
     settings = {
@@ -9,8 +9,18 @@
         "root"
         "@wheel"
       ];
-      trusted-public-keys = [ "central:uWhjva6m6dhC2hqNisjn2hXGvdGBs19vPkA1dPEuwFg=" ];
-      substituters = [ "https://cache.cything.io/central" ];
+      trusted-public-keys = [
+        "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+        "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
+      ];
+      substituters = [
+        "https://niri.cachix.org"
+        "https://nix-community.cachix.org"
+        "https://cache.garnix.io"
+        "https://cything.cachix.org"
+      ];
     };
     channel.enable = false;
     optimise = {
@@ -26,22 +36,49 @@
     extraOptions = ''
       builders-use-substitutes = true
     '';
+    registry.nixpkgs.flake = inputs.nixpkgs;
   };
-  time.timeZone = "America/Toronto";
-  networking.firewall.logRefusedConnections = false;
-  networking.nameservers = [
-    # quad9
-    "2620:fe::fe"
-    "2620:fe::9"
-    "9.9.9.9"
-    "149.112.112.112"
-  ];
 
-  # this is true by default and mutually exclusive with
-  # programs.nix-index
-  programs.command-not-found.enable = false;
-  programs.nix-index.enable = false; # set above to false to use this
+  i18n.defaultLocale = "en_US.UTF-8";
+  time.timeZone = "America/New_York";
+  networking = {
+    firewall.logRefusedConnections = false;
+    nameservers = [
+      # quad9 (unfiltered)
+      "2620:fe::10"
+      "2620:fe::fe:10"
+      "9.9.9.10"
+      "149.112.112.110"
+    ];
+    timeServers = [
+      # https://github.com/jauderho/nts-servers
+      "ntp3.fau.de"
+      "ntppool1.time.nl"
+      "ntpmon.dcs1.biz"
+      "stratum1.time.cifelli.xyz"
+      "nts.teambelgium.net"
+      "c.st1.ntp.br"
+    ];
+  };
+  services.chrony = {
+    enable = true;
+    enableNTS = true;
+    enableMemoryLocking = true;
+    extraConfig = ''
+      # Expedited Forwarding
+      dscp 46
+      # disable command port
+      cmdport 0
+      # only allow NTS
+      authselectmode require
+      # update the clock only when at least 3 sources agree on the correct time
+      minsources 3
+    '';
+  };
 
   # see journald.conf(5)
   services.journald.extraConfig = "MaxRetentionSec=2d";
+
+  services.thermald.enable = true;
+  environment.enableAllTerminfo = true;
 }

hosts/titan/Caddyfile

@@ -1,39 +0,0 @@
-{
-  acme_ca https://acme.zerossl.com/v2/DV90
-  acme_eab {
-    key_id {$EAB_KEY_ID}
-    mac_key {$EAB_MAC_KEY}
-  }
-}
-
-(common) {
-  encode zstd gzip
-  header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
-}
-
-cything.io {
-  import common
-  reverse_proxy localhost:8084
-
-  header /.well-known/matrix/* Content-Type application/json
-  header /.well-known/matrix/* Access-Control-Allow-Origin *
-  header /.well-known/matrix/* Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH,HEAD
-  header /.well-known/matrix/* Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization,Origin,Accept
-  respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
-  respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
-}
-
-www.cything.io {
-  import common
-  redir https://cything.io{uri} permanent
-}
-
-ntfy.cything.io {
-  import common
-  reverse_proxy localhost:8083
-}
-
-status.cything.io {
-  import common
-  reverse_proxy localhost:3001
-}

hosts/titan/backup.nix

@@ -1,13 +0,0 @@
-{
-  config,
-  ...
-}:
-{
-  my.backup = {
-    enable = true;
-    jobName = "titanRsync";
-    repo = "titan";
-    passFile = config.sops.secrets."borg/rsyncnet".path;
-    sshKeyFile = config.sops.secrets."rsyncnet/id_ed25519".path;
-  };
-}

hosts/titan/default.nix

@@ -1,98 +0,0 @@
-{
-  modulesPath,
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-    (modulesPath + "/profiles/qemu-guest.nix")
-    ../common.nix
-    ./disk-config.nix
-    ./hardware-configuration.nix
-    ./ghost.nix
-    ./ntfy.nix
-    ./uptime-kuma.nix
-    ./backup.nix
-  ];
-
-  sops.age.keyFile = "/root/.config/sops/age/keys.txt";
-  sops.secrets = {
-    "caddy/env" = {
-      sopsFile = ../../secrets/services/caddy.yaml;
-    };
-    "services/ntfy" = {
-      sopsFile = ../../secrets/services/ntfy.yaml;
-    };
-    "borg/rsyncnet" = {
-      sopsFile = ../../secrets/borg/titan.yaml;
-    };
-    "rsyncnet/id_ed25519" = {
-      sopsFile = ../../secrets/zh5061/titan.yaml;
-    };
-  };
-
-  boot = {
-    loader = {
-      systemd-boot.enable = true;
-      efi.canTouchEfiVariables = true;
-    };
-    tmp.cleanOnBoot = true;
-    kernelPackages = pkgs.linuxPackages_latest;
-  };
-
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-  };
-
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD yt@ytnix"
-  ];
-
-  system.stateVersion = "24.05";
-
-  environment.systemPackages = with pkgs; [
-    curl
-    git
-  ];
-
-  # network stuff
-  networking.hostName = "titan";
-  networking.networkmanager.enable = true;
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [
-      22
-      80
-      443
-    ];
-    allowedUDPPorts = [
-      443
-    ];
-  };
-
-  # container stuff
-  virtualisation.containers.enable = true;
-  virtualisation.podman = {
-    enable = true;
-    # create 'docker' alias for podman, to use as
-    # drop-in replacement
-    dockerCompat = true;
-    defaultNetwork.settings = {
-      dns_enabled = true;
-      ipv6_enabled = true;
-    };
-  };
-  virtualisation.oci-containers.backend = "podman";
-
-  services.caddy = {
-    enable = true;
-    configFile = ./Caddyfile;
-    environmentFile = config.sops.secrets."caddy/env".path;
-    logFormat = lib.mkForce "level INFO";
-  };
-}

hosts/titan/disk-config.nix

@@ -1,33 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      main = {
-        device = "/dev/sda";
-        type = "disk";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              type = "EF00";
-              size = "500M";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-            root = {
-              size = "100%";
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/";
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/titan/ghost.nix

@@ -1,52 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-{
-  virtualisation.oci-containers.containers.ghost = {
-    image = "ghost:5-alpine";
-    autoStart = true;
-    ports = [ "127.0.0.1:8084:2368" ];
-    pull = "newer";
-    environment = {
-      database__client = "mysql";
-      database__connection__host = "ghost-db";
-      database__connection__user = "root";
-      database__connection__password = "example";
-      database__connection__database = "ghost";
-      url = "https://cything.io";
-      NODE_ENV = "production";
-    };
-    volumes = [
-      "/opt/ghost/data:/var/lib/ghost/content"
-    ];
-    networks = [ "ghost-net" ];
-    dependsOn = [ "ghost-db" ];
-  };
-
-  virtualisation.oci-containers.containers.ghost-db = {
-    image = "mysql:8.0";
-    autoStart = true;
-    pull = "newer";
-    environment = {
-      MYSQL_ROOT_PASSWORD = "example";
-    };
-    volumes = [
-      "/opt/ghost/db:/var/lib/mysql"
-    ];
-    networks = [ "ghost-net" ];
-  };
-
-  systemd.services.create-ghost-net = {
-    serviceConfig.Type = "oneshot";
-    wantedBy = with config.virtualisation.oci-containers; [
-      "${backend}-ghost.service"
-      "${backend}-ghost-db.service"
-    ];
-    script = ''
-      ${pkgs.podman}/bin/podman network exists ghost-net || \
-      ${pkgs.podman}/bin/podman network create ghost-net
-    '';
-  };
-}

hosts/titan/hardware-configuration.nix

@@ -1,26 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  boot.initrd.availableKernelModules = [ "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  virtualisation.hypervGuest.enable = true;
-}

hosts/titan/ntfy.nix

@@ -1,13 +0,0 @@
-{ ... }:
-{
-  services.ntfy-sh = {
-    enable = true;
-    settings = {
-      listen-http = "127.0.0.1:8083";
-      base-url = "https://ntfy.cything.io";
-      upstream-base-url = "https://ntfy.sh";
-      auth-default-access = "deny-all";
-      behind-proxy = true;
-    };
-  };
-}

hosts/titan/uptime-kuma.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  # data stored at /var/lib/uptime-kuma/ but does not expose
-  # an option to change it
-  services.uptime-kuma = {
-    enable = true;
-    settings.PORT = "3001";
-  };
-}

hosts/ytnix/containers.nix

@@ -0,0 +1,36 @@
+{ 
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  virtualisation.oci-containers.containers = {
+    immich-ml = let
+      modelCache = "/opt/immich-ml";
+    in {
+      image = "ghcr.io/immich-app/immich-machine-learning:release";
+      autoStart = true;
+      pull = "newer";
+      ports = [ "3003:3003" ];
+      environment = {
+        REDIS_HOSTNAME = "immich-redis";
+        DB_HOSTNAME = "immich-db";
+      };
+      volumes = [ "${modelCache}:/cache" ];
+      networks = [ "immich-net" ];
+    };
+  };
+
+  systemd.services.create-immich-net = rec {
+    serviceConfig.Type = "oneshot";
+    requiredBy = with config.virtualisation.oci-containers; [
+      "${backend}-immich-ml.service"
+    ];
+    before = requiredBy;
+    script = ''
+      ${lib.getExe pkgs.podman} network exists immich-net || \
+      ${lib.getExe pkgs.podman} network create immich-net
+    '';
+  };
+}

hosts/ytnix/default.nix

@@ -9,6 +9,8 @@
     ./hardware-configuration.nix
     ../common.nix
     ../zsh.nix
+    ./tailscale.nix
+    ./containers.nix
   ];
 
   sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@@ -16,32 +18,33 @@
     "borg/rsyncnet" = {
       sopsFile = ../../secrets/borg/yt.yaml;
     };
-    "services/ntfy" = {
-      sopsFile = ../../secrets/services/ntfy.yaml;
-    };
-    "wireguard/private" = {
-      sopsFile = ../../secrets/wireguard/yt.yaml;
-    };
-    "wireguard/psk" = {
-      sopsFile = ../../secrets/wireguard/yt.yaml;
-    };
     "rsyncnet/id_ed25519" = {
       sopsFile = ../../secrets/zh5061/yt.yaml;
     };
-    "newsboat/miniflux" = {
-      sopsFile = ../../secrets/newsboat.yaml;
+    "tailscale/auth" = {
+      sopsFile = ../../secrets/services/tailscale.yaml;
+    };
+    "aws/key_id" = {
+      sopsFile = ../../secrets/yt/aws.yaml;
       owner = "yt";
     };
+    "aws/key_secret" = {
+      sopsFile = ../../secrets/yt/aws.yaml;
+      owner = "yt";
+    };
+    "vaultwarden/env" = {
+      sopsFile = ../../secrets/services/vaultwarden.yaml;
+    };
   };
 
   boot = {
     loader = {
       # lanzaboote replaces systemd-boot
       systemd-boot.enable = lib.mkForce false;
-      efi.canTouchEfiVariables = false; # toggle when installing
+      efi.canTouchEfiVariables = true;
     };
     tmp.cleanOnBoot = true;
-    kernelPackages = pkgs.linuxPackages_latest;
+    kernelPackages = pkgs.linuxKernel.packages.linux_zen;
     extraModulePackages = with config.boot.kernelPackages; [
       rtl8821ce
     ];
@@ -58,6 +61,7 @@
       pkiBundle = "/var/lib/sbctl";
     };
     kernel.sysctl."kernel.sysrq" = 1;
+    binfmt.emulatedSystems = [ "aarch64-linux" ];
   };
 
   networking = {
@@ -75,12 +79,20 @@
     networkmanager = {
       enable = true;
       dns = "none";
-      wifi.backend = "iwd";
+      wifi = {
+        backend = "iwd";
+        powersave = false;
+      };
     };
     resolvconf.enable = true;
     firewall = {
-      allowedUDPPorts = [ 51820 ]; # for wireguard
-      trustedInterfaces = [ "wg0" ];
+      enable = true;
+      trustedInterfaces = [ "tailscale0" ];
+      # allowedTCPPorts = [
+      #   8080 # mitmproxy
+      #   22000 # syncthing
+      #   3003 # immich-ml
+      # ];
     };
   };
   programs.nm-applet.enable = true;
@@ -92,9 +104,7 @@
     alsa.enable = true;
     alsa.support32Bit = true;
     wireplumber.extraConfig.bluetoothEnhancements = {
-      "wireplumber.settings" = {
-        "bluetooth.autoswitch-to-headset-profile" = false;
-      };
+      # https://julian.pages.freedesktop.org/wireplumber/daemon/configuration/bluetooth.html#bluetooth-configuration
       "monitor.bluez.properties" = {
         "bluez5.enable-sbc-xq" = true;
         "bluez5.enable-msbc" = true;
@@ -102,6 +112,10 @@
         "bluez5.roles" = [
           "a2dp_sink"
           "a2dp_source"
+          "hsp_hs"
+          "hsp_ag"
+          "hfp_hf"
+          "hfp_ag"
         ];
       };
     };
@@ -128,38 +142,50 @@
     "wheel"
     "libvirtd"
     "docker"
+    "disk"
+    "adbusers"
   ];
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages = with pkgs; lib.flatten [
     tmux
     vim
     wget
-    neovim
-    git
-    python3
-    wl-clipboard
-    mako
     tree
     kitty
     borgbackup
-    brightnessctl
-    alsa-utils
-    nixd
-    bluetuith
-    libimobiledevice
-    pass-wayland
     htop
     file
     dnsutils
+    q
     age
     compsize
     wireguard-tools
     traceroute
     sops
-    restic
-    haskell-language-server
-    ghc
     sbctl # secure boot
+    lm_sensors
+    sshfs
+    openssl
+    just
+    killall
+    lshw
+    bubblewrap
+    fuse-overlayfs
+    dwarfs
+    wineWowPackages.stagingFull
+    (with gst_all_1; [
+      gst-plugins-good
+      gst-plugins-bad
+      gst-plugins-ugly
+      gst-plugins-base
+    ])
+    vulkan-loader
+    (heroic.override {
+      extraPkgs = pkgs: [
+        pkgs.gamescope
+        pkgs.gamemode
+      ];
+    })
   ];
 
   environment.sessionVariables = {
@@ -173,25 +199,27 @@
   services.displayManager = {
     enable = true;
     autoLogin.user = "yt";
+    defaultSession = "plasma";
+    sddm = {
+      enable = true;
+      wayland.enable = true;
+      autoNumlock = true;
+    };
   };
 
-  fonts.packages = with pkgs; [
+  fonts = {
+    packages = with pkgs; [
       nerd-fonts.roboto-mono
       ibm-plex
     ];
-  fonts.enableDefaultPackages = true;
+    enableDefaultPackages = true;
+  };
 
   hardware.enableAllFirmware = true;
   hardware.bluetooth = {
     enable = true;
     powerOnBoot = true;
   };
-  services.blueman.enable = true;
-
-  programs.sway = {
-    enable = true;
-    wrapperFeatures.gtk = true;
-  };
 
   my.backup = {
     enable = true;
@@ -203,82 +231,118 @@
       "/home/yt/.local/share/Steam"
       "**/.wine"
       "/home/yt/Games"
+      "/home/yt/Videos"
+      "/home/yt/.bitmonero"
     ];
     repo = "yt";
     passFile = config.sops.secrets."borg/rsyncnet".path;
     sshKeyFile = config.sops.secrets."rsyncnet/id_ed25519".path;
   };
 
-  services.btrbk.instances.local = {
-    onCalendar = "hourly";
-    # only create snapshots automatically. backups are triggered manually with `btrbk resume`
-    snapshotOnly = true;
-    settings = {
-      snapshot_preserve_min = "latest";
-      target_preserve = "*d";
-      target_preserve_min = "no";
-      target = "/mnt/external/btr_backup/ytnix";
-      stream_compress = "zstd";
-      stream_compress_level = "8";
-      snapshot_dir = "/snapshots";
-      subvolume = {
-        "/home" = { };
-        "/" = { };
-      };
-    };
-  };
-
   programs.steam = {
     enable = true;
     extest.enable = true;
     extraCompatPackages = with pkgs; [ proton-ge-bin ];
   };
-  hardware.steam-hardware.enable = true;
+  programs.gamescope.enable = true;
 
   services.logind = {
-    lidSwitch = "hibernate";
-    powerKey = "hibernate";
+    lidSwitch = "suspend";
+    powerKey = "poweroff";
+    suspendKey = "hibernate";
   };
 
   xdg.mime.defaultApplications = {
     "application/pdf" = "okular.desktop";
     "image/*" = "gwenview.desktop";
-    "*/html" = "chromium-browser.desktop";
   };
 
-  programs.thunar = {
+  virtualisation.libvirtd = {
     enable = true;
-    plugins = with pkgs.xfce; [
-      thunar-archive-plugin
-      thunar-volman
-    ];
-  };
-  # preference changes don't work in thunar without this
-  programs.xfconf.enable = true;
-  # mount, trash and stuff in thunar
-  services.gvfs.enable = true;
-  # thumbnails in thunar
-  services.tumbler.enable = true;
-
-  virtualisation = {
-    libvirtd.enable = true;
-    docker.enable = true;
+    qemu.vhostUserPackages = with pkgs; [ virtiofsd ];
   };
   programs.virt-manager.enable = true;
+  my.containerization.enable = true;
 
   services.usbmuxd.enable = true;
-  programs.nix-ld.enable = true;
+  programs.nix-ld.dev = {
+    enable = true;
+    # nix run github:thiagokokada/nix-alien#nix-alien-find-libs ./<binary>
+    libraries = with pkgs; [
+      # TODO: revisit what we actually need
+      mesa
+      extest
+      stdenv.cc.cc
+      libGL
+      fontconfig
+      libxkbcommon
+      zlib
+      libz
+      libxml2
+      dbus
+      freetype
+      egl-wayland
+      waylandpp
+      cairo
+      xcb-util-cursor
+      libplist
+      p11-kit
+      kdePackages.qtwayland
+      qt6.full
+      qt6.qtwayland
+      qt5.full
+      qt5.qtwayland
+      xorg.libX11
+      xorg.libxcb
+      xorg.xcbutilwm
+      xorg.xcbutilimage
+      xorg.xcbutilkeysyms
+      xorg.xcbutilrenderutil
+      xorg.libXScrnSaver
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXi
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXtst
+      xorg.libxkbfile
+      xorg.libxshmfence
+      xorg.libXxf86vm
+      xorg.libSM
+      gtk3
+      pango
+      gdk-pixbuf
+      glib
+      libnotify
+      SDL2
+      libpng
+      libjpeg8
+      libtiff
+      curl
+      pcre2
+      gsettings-desktop-schemas
+    ];
+  };
   programs.evolution.enable = true;
 
   xdg.portal = {
     enable = true;
     wlr.enable = true;
+    xdgOpenUsePortal = true;
+    extraPortals = with pkgs; [
+      xdg-desktop-portal-gtk
+      xdg-desktop-portal-gnome
+    ];
   };
 
   programs.obs-studio = {
     enable = true;
     plugins = with pkgs.obs-studio-plugins; [
       wlrobs
+      obs-pipewire-audio-capture
     ];
   };
 
@@ -290,29 +354,34 @@
     ];
   };
 
-  services.ollama.enable = true;
-
-  # wireguard setup
-  networking.wg-quick.interfaces.wg0 = {
-    autostart = false;
-    address = [
-      "10.0.0.2/24"
-      "fdc9:281f:04d7:9ee9::2/64"
-    ];
-    privateKeyFile = config.sops.secrets."wireguard/private".path;
-    peers = [
-      {
-        publicKey = "a16/F/wP7HQIUtFywebqPSXQAktPsLgsMLH9ZfevMy0=";
-        allowedIPs = [
-          "0.0.0.0/0"
-          "::/0"
-        ];
-        endpoint = "31.59.129.225:51820";
-        persistentKeepalive = 25;
-        presharedKeyFile = config.sops.secrets."wireguard/psk".path;
-      }
-    ];
-  };
+  services.ollama.enable = false;
 
   services.trezord.enable = true;
+
+  programs.niri.enable = false;
+  programs.niri.package = pkgs.niri-unstable;
+  programs.xwayland.enable = true;
+
+  services.udev.extraHwdb = ''
+    SUBSYSTEM=="usb", SYSFS{idVendor}=="090c", SYSFS{idProduct}=="1000", ACTION=="add", GROUP="users", MODE="0664"
+  '';
+
+  services.desktopManager.plasma6 = {
+    enable = true;
+    enableQt5Integration = true;
+  };
+
+  programs.appimage = {
+    enable = true;
+    binfmt = true;
+  };
+
+  programs.adb.enable = true;
+  services.envfs.enable = true;
+  programs.kdeconnect.enable = true;
+  programs.dconf.enable = true;
+
+  programs.ccache.enable = true;
+  nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
+  programs.fuse.userAllowOther = true;
 }

hosts/ytnix/tailscale.nix

@@ -0,0 +1,18 @@
+{ config, ... }:
+{
+  services.tailscale = {
+    enable = true;
+    authKeyFile = config.sops.secrets."tailscale/auth".path;
+    openFirewall = true;
+    useRoutingFeatures = "client";
+    extraUpFlags = [
+      "--exit-node=chunk"
+      "--accept-dns=false"
+      "--operator=yt"
+      "--exit-node-allow-lan-access"
+    ];
+    extraDaemonFlags = [
+      "--no-logs-no-support"
+    ];
+  };
+}

justfile

@@ -0,0 +1,22 @@
+update:
+    git branch -D update || true
+    git switch -c update
+    nix flake update
+    git add flake.lock
+    git commit -s -m "flake update"
+    git push -f
+    git switch main
+
+upgrade:
+    git switch update
+    sudo nixos-rebuild switch -L --flake . --use-substitutes
+    nixos-rebuild switch -L --flake .#chunk --target-host root@2a0f:85c1:840:2bfb::1 --use-substitutes
+    home-manager -L switch --flake .
+    git switch main
+    git merge update
+    git branch -d update
+
+switch:
+    sudo nixos-rebuild switch -L --flake . --use-substitutes
+    nixos-rebuild switch -L --flake .#chunk --target-host root@2a0f:85c1:840:2bfb::1 --use-substitutes
+    home-manager -L switch --flake .

modules/backup.nix

@@ -6,7 +6,6 @@
 }:
 let
   cfg = config.my.backup;
-  hostname = config.networking.hostName;
   defaultPaths = [
     "/root"
     "/home"
@@ -97,23 +96,6 @@ in
       ];
       # warnings are often not that serious
       failOnWarnings = false;
-      postHook = ''
-        invocationId=$(systemctl show -p InvocationID --value borgbackup-job-${cfg.jobName}.service)
-        title="${hostname}: backup completed with exit code: $exitStatus"
-        msg=$(journalctl -o cat _SYSTEMD_INVOCATION_ID=$invocationId)
-
-        if [ "$exitStatus" -eq 0 ]; then
-          tag="v"
-        else
-          tag="rotating_light"
-        fi
-
-        ${pkgs.curl}/bin/curl -sL -u $(cat ${config.sops.secrets."services/ntfy".path}) \
-        -H "Title: $title" \
-        -H "Tags: $tag" \
-        -d "$msg" \
-        https://ntfy.cything.io/backups > /dev/null
-      '';
 
       prune.keep = {
         within = "2d";

modules/caddy.nix

@@ -0,0 +1,41 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.my.caddy;
+in
+{
+  options.my.caddy = {
+    enable = lib.mkEnableOption "caddy reverse proxy";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.caddy = {
+      enable = true;
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          # error message will tell you the correct version tag to use
+          # (still need the @ to pass nix config check)
+          "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"
+        ];
+        hash = "sha256-jCcSzenewQiW897GFHF9WAcVkGaS/oUu63crJu7AyyQ=";
+      };
+      logFormat = lib.mkForce "level INFO";
+      acmeCA = "https://acme-v02.api.letsencrypt.org/directory";
+      extraConfig = ''
+        (common) {
+          encode zstd gzip
+          header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+          tls {
+            dns cloudflare {$CLOUDFLARE_KEY}
+            resolvers 1.1.1.1 8.8.8.8
+          }
+        }
+      '';
+      environmentFile = config.sops.secrets."caddy/env".path;
+    };
+  };
+}

modules/containerization.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.containerization;
+in
+{
+  options.my.containerization = {
+    enable = lib.mkEnableOption "containerization";
+    usePodman = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "whether to use podman instead of docker";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation = {
+      containers.enable = true;
+      podman = lib.mkIf cfg.usePodman {
+        enable = true;
+        # create 'docker' alias for podman, to use as
+        # drop-in replacement
+        dockerCompat = true;
+        defaultNetwork.settings = {
+          dns_enabled = true;
+          ipv6_enabled = true;
+        };
+      };
+      oci-containers.backend = lib.mkIf cfg.usePodman "podman";
+    };
+  };
+}

modules/default.nix

@@ -2,5 +2,11 @@
 {
   imports = [
     ./backup.nix
+    ./caddy.nix
+    ./roundcube.nix
+    ./zipline.nix
+    ./containerization.nix
+    ./vaultwarden.nix
+    ./searx.nix
   ];
 }

modules/roundcube.nix

@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.my.roundcube;
+  fpm = config.services.phpfpm.pools.roundcube;
+  roundcube = config.services.roundcube;
+in
+{
+  options.my.roundcube = {
+    enable = lib.mkEnableOption "roundcube webmail";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.roundcube = {
+      enable = true;
+      configureNginx = false;
+      package = pkgs.roundcube.withPlugins (
+        p: with p; [
+          persistent_login
+          contextmenu
+          custom_from
+          thunderbird_labels
+        ]
+      );
+      plugins = [
+        "persistent_login"
+        "contextmenu"
+        "custom_from"
+        "thunderbird_labels"
+      ];
+      dicts = with pkgs.aspellDicts; [ en ];
+      extraConfig = ''
+        $config['imap_host'] = "ssl://imap.migadu.com:993";
+        $config['smtp_host'] = "ssl://smtp.migadu.com:465";
+        $config['smtp_user'] = "%u";
+        $config['smtp_pass'] = "%p";
+      '';
+    };
+
+    services.phpfpm.pools.roundcube.settings = lib.mapAttrs (name: lib.mkForce) {
+      "listen.owner" = "caddy";
+      "listen.group" = "caddy";
+    };
+
+    services.caddy.virtualHosts."mail.cy7.sh".extraConfig = ''
+      import common
+      root ${roundcube.package}
+      php_fastcgi unix/${fpm.socket}
+      file_server
+    '';
+  };
+}

modules/searx.nix

@@ -0,0 +1,47 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.searx;
+in
+{
+  options.my.searx = {
+    enable = lib.mkEnableOption "searx";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.searx = {
+      enable = true;
+      runInUwsgi = true;
+      uwsgiConfig = {
+        disable-logging = true;
+        http = "127.0.0.1:8090";
+      };
+      settings = {
+        # get secret from env
+        server.secret_key = "@SEARX_SECRET_KEY@";
+      };
+      environmentFile = config.sops.secrets."searx/env".path;
+      redisCreateLocally = true; # required for limiter
+      limiterSettings = {
+        real_ip = {
+          x_for = 1;
+          ipv4_prefix = 32;
+          ipv6_prefix = 56;
+        };
+        botdetection.ip_lists.pass_ip = [
+          "100.121.152.86"
+          "100.66.32.54"
+        ];
+        link_token = true;
+      };
+    };
+
+    services.caddy.virtualHosts."x.cy7.sh".extraConfig = ''
+      import common
+      reverse_proxy 127.0.0.1:8090
+    '';
+  };
+}

modules/vaultwarden.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.vaultwarden;
+in
+{
+  options.my.vaultwarden = {
+    enable = lib.mkEnableOption "vaultwarden";
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "https://pass.cy7.sh";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.vaultwarden = {
+      enable = true;
+      dbBackend = "postgresql";
+      environmentFile = config.sops.secrets."vaultwarden/env".path;
+      config = {
+        ROCKET_ADDRESS = "0.0.0.0";
+        ROCKET_PORT = "8081";
+        DATABASE_URL = "postgresql://vaultwarden:vaultwarden@127.0.0.1:5432/vaultwarden";
+        EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,ssh-agent,ssh-key-vault-item,autofill-v2";
+        DOMAIN = cfg.domain;
+      };
+    };
+  };
+}

modules/zipline.nix

@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.zipline;
+in
+{
+  options.my.zipline = {
+    enable = lib.mkEnableOption "zipline";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.zipline = {
+      enable = true;
+      settings = {
+        CORE_HOSTNAME = "127.0.0.1";
+        CORE_PORT = 3001;
+        DATASOURCE_TYPE = "s3";
+        DATASOURCE_S3_ENDPOINT = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
+        DATASOURCE_S3_BUCKET = "zipline";
+        DATASOURCE_S3_REGION = "auto";
+      };
+      environmentFiles = [ config.sops.secrets."zipline/env".path ];
+    };
+
+    services.caddy.virtualHosts."host.cy7.sh".extraConfig = ''
+      import common
+      reverse_proxy 127.0.0.1:3001
+    '';
+  };
+}

overlay/attic/concurrent-32.patch

@@ -0,0 +1,13 @@
+diff --git a/server/src/config.rs b/server/src/config.rs
+index 4412cbf..6dd483a 100644
+--- a/server/src/config.rs
++++ b/server/src/config.rs
+@@ -565,7 +565,7 @@ fn default_default_retention_period() -> Duration {
+ }
+ 
+ fn default_concurrent_chunk_uploads() -> usize {
+-    10
++    32
+ }
+ 
+ fn load_config_from_path(path: &Path) -> Result<Config> {

overlay/attic/default.nix

@@ -16,6 +16,9 @@ final: prev: {
             cargoLock = null;
             cargoHash = "sha256-AbpWnYfBMrR6oOfy2LkQvIPYsClCWE89bJav+iHTtLM=";
             useFetchCargoVendor = true;
+            patches = [
+              ./concurrent-32.patch
+            ];
           }
         );
     };

overlay/bitwarden/default.nix

@@ -0,0 +1,7 @@
+final: prev: {
+  bitwarden-desktop = prev.bitwarden-desktop.overrideAttrs (finalAttrs: prevAttrs: {
+    patches = prevAttrs.patches ++ [
+      ./ssh-agent-no-confirm.patch
+    ];
+  });
+}

overlay/bitwarden/ssh-agent-no-confirm.patch

@@ -0,0 +1,34 @@
+diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/mod.rs b/core/src/ssh_agent/mod.rs
+index 4e304cc..8203dca 100644
+--- a/apps/desktop/desktop_native/core/src/ssh_agent/mod.rs
++++ b/apps/desktop/desktop_native/core/src/ssh_agent/mod.rs
+@@ -44,28 +44,7 @@ impl ssh_agent::Agent<peerinfo::models::PeerInfo> for BitwardenDesktopAgent {
+             return false;
+         }
+ 
+-        let request_id = self.get_request_id().await;
+-        println!(
+-            "[SSH Agent] Confirming request from application: {}",
+-            info.process_name()
+-        );
+-
+-        let mut rx_channel = self.get_ui_response_rx.lock().await.resubscribe();
+-        self.show_ui_request_tx
+-            .send(SshAgentUIRequest {
+-                request_id,
+-                cipher_id: Some(ssh_key.cipher_uuid.clone()),
+-                process_name: info.process_name().to_string(),
+-                is_list: false,
+-            })
+-            .await
+-            .expect("Should send request to ui");
+-        while let Ok((id, response)) = rx_channel.recv().await {
+-            if id == request_id {
+-                return response;
+-            }
+-        }
+-        false
++        true
+     }
+ 
+     async fn can_list(&self, info: &peerinfo::models::PeerInfo) -> bool {

overlay/conduwuit/default.nix

@@ -1,39 +0,0 @@
-final: prev: {
-  conduwuit = prev.conduwuit.override (old: {
-    rustPlatform = old.rustPlatform // {
-      buildRustPackage =
-        args:
-        old.rustPlatform.buildRustPackage (
-          args
-          // {
-            version = "0.5.0-rc2";
-            src = final.fetchFromGitHub {
-              owner = "girlbossceo";
-              repo = "conduwuit";
-              rev = "8c74e35e7640a041c1f3496d82585e5240294352";
-              hash = "sha256-/2YD3TXT9pQ7oPEm9wDrq35afU88qukMIWqrBX5JyXg=";
-            };
-            doCheck = false;
-            cargoHash = "sha256-ZenMTCEJrALKQnW7/eXqrhFj+BedE9i/rQZMsPHl8K0=";
-            cargoPatches = [
-              ./fix-lint.patch
-            ];
-            # unstable has this set to "conduit"
-            meta.mainProgram = "conduwuit";
-
-            buildFeatures = [
-              "brotli_compression"
-              "element_hacks"
-              "gzip_compression"
-              "release_max_log_level" # without this feature to enable debug logging
-              "sentry_telemetry"
-              "systemd"
-              "zstd_compression"
-              "jemalloc"
-              "io_uring"
-            ];
-          }
-        );
-    };
-  });
-}

overlay/conduwuit/fix-lint.patch

@@ -1,74 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 3f900a114..0d30a3fec 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -4493,7 +4493,7 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
- [[package]]
- name = "tracing"
- version = "0.1.41"
--source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
-+source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
- dependencies = [
-  "log",
-  "pin-project-lite",
-@@ -4504,7 +4504,7 @@ dependencies = [
- [[package]]
- name = "tracing-attributes"
- version = "0.1.28"
--source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
-+source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
- dependencies = [
-  "proc-macro2",
-  "quote",
-@@ -4514,7 +4514,7 @@ dependencies = [
- [[package]]
- name = "tracing-core"
- version = "0.1.33"
--source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
-+source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
- dependencies = [
-  "once_cell",
-  "valuable",
-@@ -4534,7 +4534,7 @@ dependencies = [
- [[package]]
- name = "tracing-log"
- version = "0.2.0"
--source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
-+source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
- dependencies = [
-  "log",
-  "once_cell",
-@@ -4562,7 +4562,7 @@ dependencies = [
- [[package]]
- name = "tracing-subscriber"
- version = "0.3.18"
--source = "git+https://github.com/girlbossceo/tracing?rev=ccc4fbd8238c2d5ba354e61ec17ac610af11401d#ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
-+source = "git+https://github.com/girlbossceo/tracing?rev=3cf1c991e3660785d3855a34245949557db33209#3cf1c991e3660785d3855a34245949557db33209"
- dependencies = [
-  "matchers",
-  "nu-ansi-term",
-diff --git a/Cargo.toml b/Cargo.toml
-index 76acda807..a2916a6aa 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -513,16 +513,16 @@ version = "0.2"
- # https://github.com/girlbossceo/tracing/commit/b348dca742af641c47bc390261f60711c2af573c
- [patch.crates-io.tracing-subscriber]
- git = "https://github.com/girlbossceo/tracing"
--rev = "ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
-+rev = "3cf1c991e3660785d3855a34245949557db33209"
- [patch.crates-io.tracing]
- git = "https://github.com/girlbossceo/tracing"
--rev = "ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
-+rev = "3cf1c991e3660785d3855a34245949557db33209"
- [patch.crates-io.tracing-core]
- git = "https://github.com/girlbossceo/tracing"
--rev = "ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
-+rev = "3cf1c991e3660785d3855a34245949557db33209"
- [patch.crates-io.tracing-log]
- git = "https://github.com/girlbossceo/tracing"
--rev = "ccc4fbd8238c2d5ba354e61ec17ac610af11401d"
-+rev = "3cf1c991e3660785d3855a34245949557db33209"
- 
- # adds a tab completion callback: https://github.com/girlbossceo/rustyline-async/commit/de26100b0db03e419a3d8e1dd26895d170d1fe50
- # adds event for CTRL+\: https://github.com/girlbossceo/rustyline-async/commit/67d8c49aeac03a5ef4e818f663eaa94dd7bf339b

overlay/default.nix

@@ -1,8 +1,24 @@
+{ inputs }:
 let
   overlays = [
-    ./conduwuit
     ./attic
+    ./zipline
+    ./bitwarden
   ];
   importedOverlays = map (m: import m) overlays;
 in
 importedOverlays
+++ [
+  (
+    final: prev:
+    let
+      nixpkgsFrom = flake: pkg: flake.legacyPackages.${prev.system}.${pkg};
+      pkgFrom = flake: pkg: flake.packages.${prev.system}.${pkg};
+    in
+    {
+      conduwuit =
+       pkgFrom inputs.conduwuit "static-x86_64-linux-musl-all-features-x86_64-haswell-optimised";
+      pixelflasher = nixpkgsFrom inputs.pixelflasher "pixelflasher";
+    }
+  )
+]

overlay/vscode.nix

@@ -0,0 +1,14 @@
+final: prev: {
+  vscode-extensions = prev.vscode-extensions // {
+    github = prev.vscode-extensions.github // {
+      codespaces = prev.vscode-utils.buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "github";
+          name = "codespaces";
+          version = "1.17.3";
+          hash = "sha256-idJFYHJ4yeqpFZBX55Y0v1yfzgqyhS0MrC4yIto7i7w=";
+        };
+      };
+    };
+  };
+}

overlay/zipline/default.nix

@@ -0,0 +1,7 @@
+final: prev: {
+  zipline = prev.zipline.overrideAttrs {
+    patches = [
+      ./no-check-bucket.patch
+    ];
+  };
+}

overlay/zipline/no-check-bucket.patch

@@ -0,0 +1,45 @@
+diff --git a/src/lib/datasource/S3.ts b/src/lib/datasource/S3.ts
+index 089dd64..39dd8f4 100644
+--- a/src/lib/datasource/S3.ts
++++ b/src/lib/datasource/S3.ts
+@@ -4,7 +4,6 @@ import {
+   DeleteObjectCommand,
+   DeleteObjectsCommand,
+   GetObjectCommand,
+-  ListBucketsCommand,
+   ListObjectsCommand,
+   PutObjectCommand,
+   S3Client,
+@@ -38,32 +37,6 @@ export class S3Datasource extends Datasource {
+       endpoint: this.options.endpoint ?? undefined,
+       forcePathStyle: this.options.forcePathStyle ?? false,
+     });
+-
+-    this.ensureBucketExists();
+-  }
+-
+-  private async ensureBucketExists() {
+-    try {
+-      const res = await this.client.send(new ListBucketsCommand());
+-      if (res.$metadata.httpStatusCode !== 200) {
+-        this.logger
+-          .error('there was an error while listing buckets', res.$metadata as Record<string, unknown>)
+-          .error('zipline will now exit');
+-        process.exit(1);
+-      }
+-
+-      if (!res.Buckets?.find((bucket) => bucket.Name === this.options.bucket)) {
+-        this.logger.error(`bucket ${this.options.bucket} does not exist`).error('zipline will now exit');
+-        process.exit(1);
+-      }
+-    } catch (e) {
+-      this.logger
+-        .error('there was an error while listing buckets', e as Record<string, unknown>)
+-        .error('zipline will now exit');
+-      process.exit(1);
+-    } finally {
+-      this.logger.debug(`bucket ${this.options.bucket} exists`);
+-    }
+   }
+ 
+   public async get(file: string): Promise<Readable | null> {

secrets/services/caddy.yaml

@@ -1,5 +1,5 @@
 caddy:
-    env: ENC[AES256_GCM,data:uVCkVky5MRRhN+g4f634nBjvpcI5Ldy+eOKXg7eGu9foswTHA1SXDs67+Wuvo/jaPw7Zg67xKZRHnoTon1udQzyfu0T6pmVKfsUPewITYCd+qLTanFz6uVRUHzpUVwjCZNqB8gxNr/BiZ70NG4vQXRjgd3zKFrQYQBr4zSaP2vK1pRdbuQ==,iv:dQBfX4X8huUp2dqY3tEGW+BPZ/XADT10ptt85R7X+AY=,tag:cvMbFjkRHoxxnNfz8dGv5g==,type:str]
+    env: ENC[AES256_GCM,data:fyP1pPJgO9jN0ypC09s0Sz+HlUX42fl6DxWevYYevKdlKTgz5VHQfbELhy6vejmg9v+zFB3/AtSZfWJQB2dNX4Zm/L42wf5QZ7oYoa9QTujJjRgE96OXM77ioNy2DzFzpGw3w16QoC7zaR8UHSN1KL6qRj5xxKw0U6Apxhc0AuBoLvNHOgn8CHY92Q4OBcA1tJn8tgLB9uZB5Ge/2BlEjdSQ0sZMLkE+dHC4/0IILVFrrv1sWRXvXt6t5njF,iv:tF5GRPFYZSuKRgDAY1e8/J7jNQAEqDpgXlpwWW+1P4E=,tag:lK/BUErXNIPgqXPzGJvPTQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -33,8 +33,8 @@ sops:
             Q2hBZE1FOHJ3aW5rVmoyK045eG11cmsKFOmP5iWONREZvxu0rM+fKMPQKgnYq5LH
             AKMZFsP7nnUxjdCXEA18sDg4Rf0qp8i3uQK3D6P7417j9ye/YZA4BQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-17T03:25:37Z"
-    mac: ENC[AES256_GCM,data:bhFBLkT2q6HGtTPtHLVZkKZn00Lbm11/u3qSR19lU2E1SsQ7mpukvCqcTxNWtJ+HHth6yJJfgM6XABKq/9/598L2MgGuF3C/GGS3xpjwHh5RyV8t1lV8cqDaZGjGOMGx35lFQ6DoXOreQrtP/f7MKzf+nVNFr1NbTR8YhqR1xDU=,iv:+fjYlbyIyM9nLagrvE+PUhC2pT7QTsTSQX7ELZ7Wuhs=,tag:GWQv6VmIsWwFzb4bUr5CLg==,type:str]
+    lastmodified: "2025-03-08T21:05:07Z"
+    mac: ENC[AES256_GCM,data:vgGCrCJMBxjiCWZYymlaPKTekA1Weprwgtc4xcoPVlDsuljkXDth+aAZPpnakE/nSXhGC6jGJOHdtrsIUTkH2R9WQHIdZDBy+VrVQoV6xE3ijfWyIujcIPwz3s1MGBqRFUYum1XMU5FAcIASiYV7PDxj/f6fsLbjKZCc9/kG3GE=,iv:PSvlssl+Gx+Gcw6/zccIKJDeNz3dJ0kHnPmCrAdBnqQ=,tag:6F/JKBFNxKEgMTyYZ3W0Vg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.9.4

secrets/services/searx.yaml

@@ -0,0 +1,31 @@
+searx:
+    env: ENC[AES256_GCM,data:VWLft5+85mNA8k3VynVBz2V+8zcg97UtHfucpaAcKbA+CQdGUbqLesQSu9a7tNRI7+OdI1qPJj5HTzP8tpGN5f39D4brtyo4fN8n8zAd,iv:F70wq9qJiFjEjJeZeFCyQskLdBR3nd/CR/UW/dE9gTo=,tag:/W8FhRC180aAdzjD5v0vZw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEM3VXOVZBSVdZMzBOVzJD
+            Y0ZvWUtFUW5pMUZnYjdxdHQvWDBEVmU1L2hBCi8zcEszZThwcGQ5WUdRTWFUWCtP
+            WWE0OVJIOXpCMGJZc3J6TmVCMGN2TUUKLS0tIEwxVDJLTkdrK3g2TG9iWml6aEFR
+            d3NOS245SmV3K1dlaHdnMHpVSzlYQk0KnDSK1C1sEeBVMX80DqjJRrGFx+WkNijg
+            XEf/Jq//qzgvX24fOl4X4xGTRfBMbLlznLs4N6WtIY7aVcW5N041jQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCOGFaWkY1TWhvQUhENHUx
+            cUk4b2FpeCs5eUMyQ2FhZzVKdHY1MVIzWUhRCmw0eEhwYjl2OFNoQkZRVW43REQy
+            OGpNWFRTWEF4NFFuU1lpTFdKY3lBNEEKLS0tIFNET0JBZmxoSGhWdTIwL0x2Ris3
+            ZHhidlJHT08rR3ZuME9UQmovRTFGNlkK83k2wqXQvxeURrUE/hXoZMDc9lqkgBuL
+            W/UWt/PBorp1/WRqO6dpuu9N2S9i6VCPJH0jdoHMWEqWuRIENFKVhQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-08T20:52:15Z"
+    mac: ENC[AES256_GCM,data:UGFkCgmgRofmX2gQR2W2DD0u4LowQ9pmUxPOgpLVaKGasEoNWJMGu7A7rUIpHvuUomoL6q8aiWs3kiIuZrTQ3CB5gawmU9pPiEseOAdbww4beIcnUmumwmCLH46XYQdaooPaz8bIncW/gFePRpVB2Oef1pYeryXkbZRwBm+bPOI=,iv:GGFjerxpLH8C1m50AiKoEJxj+lGRYNMe4Y7k4u232v8=,tag:woww///+80wakvzYoyWCqQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

secrets/services/tailscale.yaml

@@ -0,0 +1,31 @@
+tailscale:
+    auth: ENC[AES256_GCM,data:7gGiUBRUK25Tp5y/5DDZKOTxKPFFfN1UUeBOdMLLQqobq643MKdJ9imxkKmKFg/FwgLYft/uzdxQGGlE7Q==,iv:HRmd+T1QuTYP8VrX/bZt8dWSwm5rcUvpEMqCMPfxjE4=,tag:PRZn2Pm6yydfEULrYGM6yg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2Z1JZZmZMaDQ3UHYvbXYr
+            c05RaEMxUGJXSGczUDBkL1UxT0hjQ0VNNkJNClFUNmJ5d3gyaHFwMTdNVW9GQ2ly
+            V3haMkx5Z1B5dmJ0SE4wY0UzMWswQ0EKLS0tIGNpZVo3UmtHcjFZVE5FMmdpOGMx
+            UFZGb3I1L3FJYVE2VjJ5aTVoZlo4bFUKwH2sPBwuLQXrHmiKYSu4Eut/H2j/2tUW
+            1y8Eph7l6w3kfhZRRbo6cZ8gcbZNHPSPeAvWf/TpYumiTt1WBt8SMw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSVXBMTEMrY1NGa1NBSjZP
+            R04wYUsrdGlVa3FnL1NYVG4xdUdqeHNnM0ZJCmhMSzFoRVFSOFBrQlU3VUtwaU0r
+            TEtad1B5NGh3OW1oajNvckhJcExrU0kKLS0tIFc5K3JOVTUvSFU1dmQxMUFRZ1o3
+            em5IemlsM29zVy9GK3RmTlgzVnRpMDAKRatmFgCdoXcypQ+1EDedCuVctl0SFMf4
+            kjtHrTSpept/y9bpTUy656aPRQ1LvqvfPs7Co1ssC/YWFroDsLgv4w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-24T05:26:20Z"
+    mac: ENC[AES256_GCM,data:GbQrLESUR/x+eLzukOR1FaJsd8zxlrz9dc/2kDBKUYAgI8L4QwLmwRuzpaIJgNLv2PdLTW83oSC8ekxR8fmsap40DpiygcrmPdPUeVFbEPaz7SSvU+DCgB0UX+qNQ9aOQ0BIbeKKOIj3r9enGv2o6DKY8I85n7VXjnGZAmCf1C8=,iv:UrtVqRGwvOpXOH3X3qF6ZF+VwqO0VGt+hFG7r6oUqCg=,tag:TD4mG3t5ORYgAS0GBmA7Eg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.3

secrets/services/zipline.yaml

@@ -0,0 +1,31 @@
+zipline:
+    env: ENC[AES256_GCM,data:5n056AoWvM4PXBCxm+tk2G9qOugRpA/n5YRrxTtB7XBBQmRQNaP2a6AbAnWX665yFGQsB0iHdSER3sY78RqUL0gFKupVq1UAT8A2Wi0HqcFMqUs2drXjIksdmI6hTLk9TCxtPy0VbPieIshO2VEYesUqitTZ01i8Hj5CyF8yFC6t9eQ2L9iKLm5gje80MoqQT4IFx+V5B4ExP3fzhcpfr8StGHKHvG59nc40KQAW38i/95H3nncScOBfSQSNH61wLnDjecr8srxELO/j2iOKD9JzmqYLQr8TLKNw7KIIhDMAmuNeQhG1YXtj7/nj6gHN6cHpcHPgUdWID/Y6MHcndDCIJnyC2Qeod5ShOn53IjL7C8VZ940o9LfwNz22sx1SYZEwRGktIhUY0c4IL/4bUvhxwTcMH9ITYU8eVfG/QSnr8B4=,iv:juf0dRagztirDN89Jj+v8k62BBl9TU12A8TdR/m8qDA=,tag:WakN+bOYfF4YrleIsAg+OQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDUDFDSnFEM1NZK0lSMnUx
+            YkI3MWlpY1VjYXdaKzBCOFc5NWp5NXdBbkdVCmI0Z2tuSXBOSFN2NXJTUWxKQXNu
+            SGhhTTYzUDFSOFFXdU5aVHlmYnJNa1UKLS0tIGlrUTErQkVRdFBYYWxUcklHaUVY
+            UkQ3eVlDR2lMOEZGNXRjU3J3RXpwZkUKNJL/dvPsGu0AJiXryR8uSM0jE//cQi0b
+            AeYUjXLRcouUq5zWL6AsKDOUAo9t//AAFZqv3DGUboR8UzdymYRYMw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0Wk9ZYkExU3k0ZWpOZEhF
+            TkswRGxTd1hpcGJaa1pmcUJFQnZMcGV6L0ZFCnp3K05YdU56WUl1TktVSFNQWWZH
+            bG5COXVuSjFCUWpEYXQweVFPaDAzcTQKLS0tIFgralQ1TWUzajVOM3RyS3RDcnRx
+            WHZSeVJIaGRldmhmcWZvT3YzL3hPbFEKVUtCU1l/RhFOlwdjE0ejW/Ym+cMVNxIW
+            AdvVcWoilMGTsDJIIlLu7fPbhmGotPvqGjxMC2yEpEgJUt/rsz2vPA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-23T21:43:15Z"
+    mac: ENC[AES256_GCM,data:nI7xnLUMtseY9q8XZ3owb6qtRBtaRmmNNK4Z5ELHaI85VowdItZXMFN9faCVuCVTzhKp/4WC8jm96k7eWxytzW6r6KRvKDrUaRV27UweraK2Oe8et7u+oIEPh6HkNuZFB+qPiFYdfc+qQeTIKwayEVLeVWyvQKVDBhBxZd9UArg=,iv:q4hRQVat+LHVbYnF6QLE8iBdBeacJVUBKmMe4tbU8YU=,tag:6m4+SU1BFXMPORqe9vgXAw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

secrets/yt/aws.yaml

@@ -0,0 +1,34 @@
+aws:
+    key_id: ENC[AES256_GCM,data:9tWAMzUv4f6Ea27XsmYhO11NroYnLmED/FVrCCGO0Vc=,iv:YP1xRjVd1M1MB7IKVAw0Sdx0E4AokBrsaAcDLvTLHD4=,tag:SEmEr3NoZvch9LeaJHbCww==,type:str]
+    key_secret: ENC[AES256_GCM,data:AK+vER4T1p0AknKzsxZQJ0JTpfIstnnTWSAZ26zJSCwJYgRYwj8RF98CS7HM+KWvz5VNGENxhVdUnjlGkrTB4w==,iv:3o79gwp5b4KGsixW02qFWYFvpagY/hykbYJ/WNz6PB8=,tag:GW2T8ggKYHa1CQ6DRomJDQ==,type:str]
+    _garage_key_id: ENC[AES256_GCM,data:2lLS1nBhrwBkJh/ei7FwBoR6jOI6KCJkvOs=,iv:jwB7ZEaKOPIwghcGRs3qaICypoHgSxkFBOyB6e5hpYI=,tag:Iqwv3j1R1uLLUDKLhN1Atg==,type:str]
+    _garage_key_secret: ENC[AES256_GCM,data:5iwwMfojHrR79cOIY+9O2oVY8v1cbPcECMSOMhWuGAdc2lfCogKBwLM4TFwBH9X1Vx56QvUoxCQ2uSyfOMLR7A==,iv:Q523ttz6ijmv8/JlVZuldFR4IabEKiVN4sGmJ9xDJU0=,tag:ZZ4LRG4DXOC7LY8hEjXYHQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKaUZKbTVjZ1NEWlE5RzZT
+            T1dKdkRQajEva0tpRXhxYUlYWmw1b3MwSFZvCmhteVJ2VGhVNnZTZkJlem1OT3dL
+            dGlQTWdOUlo3TXNOS0wvNlpqVWpZSFEKLS0tIC9DNjY3OW1zWUlRQ1ZEOGlBRk9R
+            azQxMGhQejQ5M0N1YjFtSW5uVnRCQ3MKtt26G2PxIry/lppOT/NUX8jebEb5NgqO
+            HuHj7WT51Gtotfgb22VfGeOCaw9+pPYSjdk9WV4z57r7Z/lylALKRw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPaVIwbExDUjJiVFpHOFJu
+            dk1SUHc5UDRFUENsbkg2RmQvazdEZ1NKeEhvCjVCNzdwRFN0aUZJL0pVSTI1RUxv
+            Ymhhc0tsSENVa1VUKzRBZk5IcjEvNFUKLS0tIFpPNlRXOVYyVnpyUmtLMTFqNlZ0
+            UlYrTExEUVc0dURLR1czN3BnYzZ2VGMKCbAgM50jvs9VciA1Pb/VY+2I4x62LBGe
+            j7eHkfTFc8Gnk/rZA9/ZJDLFr/FUPMQWK/NVoz6oLjO6oVFXqN6OqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-27T02:50:27Z"
+    mac: ENC[AES256_GCM,data:FjlbCqqYHPn/FDPUR1flWgg6wwHhLJx1uKOedwkvsTxuPhlVJHghTHWYetdmplOQyEpOEbyv+iqKTGDYHzDdgU2jIZ0TKM66iHq+1yft4TatBu75/0N3I+SfZv97vKNehxN/zvIY3FQF4O8qVy9c1dZRmr7q27Wq2pdHSOe4Myg=,iv:YkUXcOwb6UZr0vXazbLrVeGTvBTtnwuEIY3O+GSrnNk=,tag:kQBh7urSnHoiV18TIGlPEg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4