.editorconfig

@@ -1,3 +0,0 @@
-[*.nix]
-indent_style = space
-indent_size = 2

.github/workflows/build-machines-and-homes.yml

@@ -8,8 +8,6 @@ env:
   TERM: ansi
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
-  AWS_DEFAULT_REGION: us-east-1
-  AWS_ENDPOINT_URL: https://s3.cy7.sh
 
 jobs:
   build-machines:
@@ -37,7 +35,7 @@ jobs:
           build-mount-path: /nix
 
       - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
+        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem
 
       - name: Install Nix
         uses: cachix/install-nix-action@v30
@@ -48,10 +46,16 @@ jobs:
             experimental-features = nix-command flakes
             accept-flake-config = true
             system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
+            secret-key-files = /home/runner/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
+            extra-substituters = https://nixcache.cy7.sh https://cache.lix.systems
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
-            download-buffer-size = 1073741824
+
+      - name: Install Lix
+        run: |
+          sudo --preserve-env=PATH $(which nix) run \
+          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
+          upgrade-nix
+          nix --version
 
       - name: Sync repository
         uses: actions/checkout@v4
@@ -60,16 +64,20 @@ jobs:
 
       - name: build
         run: |
+          # package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
+          # nix build -L "$package"
           nix run nixpkgs#nixos-rebuild build -- -L --flake ".#${{ matrix.machine }}"
 
       - name: cache
+        # https://stackoverflow.com/a/58859404
+        if: '!cancelled()'
         run: |
-          nix run \
+          package=".#nixosConfigurations."${{ matrix.machine }}".config.system.build.toplevel"
-            github:cything/nixcp -- push \
+          nix run git+https://git.cy7.sh/cy/nixcp.git -- \
-            --bucket nixcache \
+            --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem&compression=none' \
-            --endpoint $AWS_ENDPOINT_URL \
+            -u https://nix-community.cachix.org \
-            --signing-key ${{ runner.temp }}/cache-priv-key.pem \
+            -u https://nixcache.web.cy7.sh \
-            result
+            $package
 
   build-homes:
     strategy:
@@ -80,6 +88,7 @@ jobs:
           - yt@chunk
         os:
           - ubuntu-latest
+          # - macos-latest
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -96,7 +105,7 @@ jobs:
           build-mount-path: /nix
 
       - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
+        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem
 
       - name: Install Nix
         uses: cachix/install-nix-action@v30
@@ -107,10 +116,16 @@ jobs:
             experimental-features = nix-command flakes
             accept-flake-config = true
             system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
+            secret-key-files = /home/runner/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
+            extra-substituters = https://nixcache.cy7.sh https://cache.lix.systems
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
-            download-buffer-size = 1073741824
+
+      - name: Install Lix
+        run: |
+          sudo --preserve-env=PATH $(which nix) run \
+          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
+          upgrade-nix
+          nix --version
 
       - name: Sync repository
         uses: actions/checkout@v4
@@ -123,10 +138,12 @@ jobs:
           nix build -L "$package"
 
       - name: cache
+        # https://stackoverflow.com/a/58859404
+        if: '!cancelled()'
         run: |
-          nix run \
+          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
-            github:cything/nixcp -- push \
+          nix run git+https://git.cy7.sh/cy/nixcp.git -- \
-            --bucket nixcache \
+            --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem&compression=none' \
-            --endpoint $AWS_ENDPOINT_URL \
+            -u https://nix-community.cachix.org \
-            --signing-key ${{ runner.temp }}/cache-priv-key.pem \
+            -u https://nixcache.web.cy7.sh \
-            result
+            $package

.github/workflows/build-packages.yml

@@ -11,8 +11,6 @@ env:
   TERM: ansi
   AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
   AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
-  AWS_DEFAULT_REGION: us-east-1
-  AWS_ENDPOINT_URL: https://s3.cy7.sh
 
 jobs:
   build-packages:
@@ -30,7 +28,7 @@ jobs:
 
     steps:
       - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
+        run: echo "${{ secrets.NIX_CACHE_SECRET_KEY }}" >> /home/runner/cache-priv-key.pem
 
       - name: Install Nix
         uses: cachix/install-nix-action@v30
@@ -41,20 +39,33 @@ jobs:
             experimental-features = nix-command flakes
             accept-flake-config = true
             system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
+            secret-key-files = /home/runner/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
+            extra-substituters = https://nixcache.cy7.sh https://cache.lix.systems
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8= cache.lix.systems:aBnZUw8zA7H35Cz2RyKFVs3H4PlGTLawyY5KRbvJR8o=
+
+      - name: Install Lix
+        run: |
+          sudo --preserve-env=PATH $(which nix) run \
+          'git+https://git.lix.systems/lix-project/lix?ref=refs/tags/2.92.0' -- \
+          upgrade-nix
+          nix --version
+
+      - name: Sync repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - run: nix build -L ${{ matrix.package }}
 
-      - name: cache
+      - name: cache result
+        # https://stackoverflow.com/a/58859404
+        if: '!cancelled()'
         run: |
-          nix run \
+          nix run git+https://git.cy7.sh/cy/nixcp.git -- \
-            github:cything/nixcp -- push \
+            --to 's3://nixcache?endpoint=s3.cy7.sh&secret-key=/home/runner/cache-priv-key.pem&compression=none' \
-            --bucket nixcache \
+            -u https://nix-community.cachix.org \
-            --endpoint $AWS_ENDPOINT_URL \
+            -u https://nixcache.web.cy7.sh \
-            --signing-key ${{ runner.temp }}/cache-priv-key.pem \
+            "${{ matrix.package }}"
-            result
 
       - name: prepare tarball to upload
         run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result

.sops.yaml

@@ -135,10 +135,4 @@ creation_rules:
           - *yt
           - *cy
           - *chunk
-  - path_regex: secrets/services/karakeep.yaml
-    key_groups:
-      - age:
-          - *yt
-          - *cy
-          - *chunk
 

README.md

@@ -0,0 +1,40 @@
+# infra
+## ./home
+- [home-manager](https://github.com/nix-community/home-manager) configuration files
+- foot, tmux, and zsh are configured in Nix
+- nvim, rofi, sway, waybar are configured in their own literature and symlinked to $XDG_CONFIG_HOME with home-manager
+
+## ./hosts
+- [`hosts/common.nix`](hosts/common.nix): configuration that makes sense on all computers
+- [`hosts/zsh.nix`](hosts/zsh.nix): for computers that have the power to run zsh
+### ./hosts/ytnix
+- personal laptop
+- a single [`default.nix`](hosts/ytnix/default.nix) that could be modularized but works for now
+
+### ./hosts/chunk
+- the overworked server with 5% SLA
+- very short and concise [`default.nix`](hosts/chunk/default.nix)
+- services organized in their modules
+- some services run through `virtualisation.oci-containers`:
+    - [immich](hosts/chunk/immich.nix)
+    - [conduwuit](hosts/chunk/conduwuit.nix)
+
+### ./hosts/titan
+- got this cause chunk would go down way too often :(
+- hosted on azure for "reliability"
+- runs:
+    - [ghost](hosts/titan/ghost.nix) (through `virtualisation.oci-containers`)
+    - [uptime-kuma](hosts/titan/uptime-kuma.nix)
+    - [ntfy-sh](hosts/titan/ntfy.nix)
+
+## ./secrets
+- secrets
+- see [`.sops.yaml`](.sops.yaml) for who privy to what
+
+## backups
+- hourly borgbackup to [rsync.net](https://rsync.net)
+- see [modules/backup](modules/backup.nix)
+
+## monitoring
+- [status.cything.io](https://status.cything.io/): uptime kuma (reliable)
+- [grafana.cything.io](https://grafana.cything.io/): some real-time metrics here; unlike the status page this will go kaput often

ci/upload-to-cache.sh

@@ -1,8 +0,0 @@
-#!/bin/sh
-
-# https://nix.dev/guides/recipes/post-build-hook.html#implementing-the-build-hook
-set -eu
-set -f # disable globbing
-export IFS=' '
-echo "Uploading paths" $OUT_PATHS
-exec /nix/var/nix/profiles/default/bin/nix copy --to "s3://nixcache?endpoint=s3.cy7.sh&compression=zstd&parallel-compression=true" $OUT_PATHS

flake.nix

@@ -2,7 +2,8 @@
   description = "cy's flake";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable-small";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11";
     sops-nix.url = "github:Mic92/sops-nix";
     sops-nix.inputs.nixpkgs.follows = "nixpkgs";
     home-manager.url = "github:nix-community/home-manager";
@@ -11,6 +12,9 @@
     lanzaboote.inputs.nixpkgs.follows = "nixpkgs";
     rust-overlay.url = "github:oxalica/rust-overlay";
     rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
+    conduwuit.url = "github:girlbossceo/conduwuit";
+    conduwuit.inputs.nixpkgs.follows = "nixpkgs";
+    lix-module.url = "git+https://git.lix.systems/lix-project/nixos-module?ref=release-2.92";
     nix-ld.url = "github:nix-community/nix-ld";
     nix-ld.inputs.nixpkgs.follows = "nixpkgs";
     nil.url = "github:oxalica/nil";
@@ -67,6 +71,7 @@
                 ./modules
                 inputs.sops-nix.nixosModules.sops
                 inputs.lanzaboote.nixosModules.lanzaboote
+                inputs.lix-module.nixosModules.default
                 inputs.nix-ld.nixosModules.nix-ld
               ];
             };
@@ -79,6 +84,7 @@
                 ./hosts/chunk
                 ./modules
                 inputs.sops-nix.nixosModules.sops
+                inputs.lix-module.nixosModules.default
               ];
             };
           };

garnix.yaml

@@ -0,0 +1,6 @@
+builds:
+  include:
+    - 'nixosConfigurations.*'
+    - 'homeConfigurations.*'
+    - '*.aarch64-linux.*'
+    - '*.x86_64-linux.*'

home/codium.nix

@@ -23,6 +23,7 @@
           tamasfe.even-better-toml
           golang.go
           ms-python.python
+          christian-kohler.path-intellisense
         ];
       userSettings =
         let
@@ -73,7 +74,6 @@
           "telemetry.enableTelemetry" = false;
           "telemetry.telemetryLevel" = "off";
           "window.titleBarStyle" = "custom";
-          "editor.formatOnSave" = true;
 
           # terminal stuff
           "terminal.integrated.cursorBlinking" = true;

home/kitty.nix

@@ -7,13 +7,13 @@
       package = pkgs.ibm-plex;
       size = 12;
     };
+    themeFile = "GitHub_Dark";
     settings = {
       enable_audio_bell = true;
       # how many windows should be open before kitty asks
       # for confirmation
       confirm_os_window_close = 0;
       clear_all_shortcuts = true;
-      background_opacity = 0.9;
 
       # will probably lower this later but the max allowed is actually 4GB
       # this is NOT stored in memory and can only be viewed with scrollback_pager
@@ -21,7 +21,6 @@
       # see https://github.com/sharkdp/bat/issues/1077#issuecomment-652785399
       "scrollback_pager" = "bat --pager='less -FR +G'";
       # "scrollback_lines" = 20000;
-      # wheel_scroll_multiplier = 50;
     };
     keybindings = {
       # kitty_mod is ctrl+shift by default

home/yt/ytnix.nix

@@ -8,7 +8,7 @@
     ./common.nix
     ../irssi.nix
     ../kitty.nix
-    # ../codium.nix
+    ../codium.nix
   ];
   home = {
     username = "yt";
@@ -28,7 +28,10 @@
   home.packages =
     with pkgs;
     lib.flatten [
+      ungoogled-chromium
+      librewolf
       bitwarden-desktop
+      bitwarden-cli
       fastfetch
       (with kdePackages; [
         gwenview
@@ -38,58 +41,32 @@
       signal-desktop
       btop
       jq
+      sqlite
       usbutils
       calibre
       tor-browser
       wtype
       bat
       rclone
+      go
       (rust-bin.selectLatestNightlyWith (
         toolchain:
         toolchain.default.override {
           extensions = [ "rust-src" ];
-          targets = [ "aarch64-unknown-linux-musl" ];
         }
       ))
+      pwgen
       gnumake
       unzip
       anki-bin
+      trezorctl
+      q
       gdb
       fuzzel
       hugo
+      ghidra
       sccache
       awscli2
-      p7zip
-      qbittorrent
-      android-tools
-      (python313.withPackages (
-        p: with p; [
-          python-lsp-server
-          pip
-          virtualenv
-        ]
-      ))
-      scrcpy
-      syncthing
-      (with llvmPackages; [
-        clangUseLLVM
-        compiler-rt
-        libllvm
-      ])
-      nix-output-monitor
-      cinny-desktop
-      minio-client
-      keepassxc
-      jujutsu
-      ffmpeg
-      typst
-      pavucontrol
-
-      # reversing
-      radare2
-      jadx
-      frida-tools
-      mitmproxy
       (cutter.withPlugins (
         p: with p; [
           rz-ghidra
@@ -97,6 +74,35 @@
           sigdb
         ]
       ))
+      p7zip
+      qbittorrent
+      android-tools
+      frida-tools
+      mitmproxy
+      (python313.withPackages (
+        p: with p; [
+          python-lsp-server
+          pip
+          virtualenv
+        ]
+      ))
+      jadx
+      scrcpy
+      syncthing
+      syncthingtray
+      (with llvmPackages; [
+        clangUseLLVM
+        compiler-rt
+        libllvm
+      ])
+      nix-output-monitor
+      wl-clipboard-rs
+      pixelflasher
+      cinny-desktop
+      freetube
+      gopls
+      rust-analyzer
+      minio-client
     ];
 
   home.sessionVariables = {
@@ -148,56 +154,10 @@
     enable = true;
     viAlias = true;
     vimAlias = true;
-    extraPackages = with pkgs; [
-      lua-language-server
-      nixd
-      rust-analyzer
-      fzf
-      fd
-      ripgrep
-      bat
-      delta
-      taplo
-      llvmPackages.clang-tools
-      pyright
-      tree-sitter
-      nodejs
-      nixfmt-rfc-style
-    ];
   };
 
   programs.ssh = {
     enable = true;
     addKeysToAgent = "yes";
   };
-
-  programs.firefox.enable = true;
-
-  programs.emacs = {
-    enable = true;
-    extraPackages = _: with pkgs; [
-      rust-analyzer
-      nil
-      ispell
-    ];
-  };
-
-  gtk = {
-    enable = true;
-    theme.package = pkgs.gnome-themes-extra;
-    theme.name = "Adwaita-dark";
-  };
-
-  qt = {
-    enable = true;
-    platformTheme.name = "adwaita";
-    style.name = "adwaita-dark";
-    style.package = pkgs.adwaita-qt;
-  };
-
-  dconf.settings = {
-    "org/gnome/desktop/interface" = {
-      color-scheme = "prefer-dark";
-    };
-  };
 }

home/zsh/default.nix

@@ -37,6 +37,12 @@
       searchDownKey = "^n";
     };
 
+    # prezto = {
+    #   enable = true;
+    #   caseSensitive = false;
+    #   editor.keymap = "vi";
+    # };
+
     initExtra = ''
       # disable control+s to pause terminal
       unsetopt FLOW_CONTROL
@@ -79,11 +85,14 @@
     shellAliases = {
       "vi" = "nvim";
       "vim" = "nvim";
+      "t" = "tmux";
+      "tl" = "tmux list-sessions";
+      "ta" = "tmux new-session -A -s";
       "se" = "sudoedit";
       "s" = "sudo";
-      "nrs" = "sudo nixos-rebuild switch -L --flake ~/nixos-config";
+      "nrs" = "sudo nixos-rebuild switch -L --flake . --log-format internal-json -v |& nom --json";
-      "nrt" = "sudo nixos-rebuild test -L --flake ~/nixos-config";
+      "nrt" = "sudo nixos-rebuild test -L --flake . --log-format internal-json -v |& nom --json";
-      "hrs" = "home-manager switch -L --flake ~/nixos-config";
+      "hrs" = "home-manager switch -L --flake .";
       "g" = "git";
       "ga" = "git add";
       "gaa" = "git add --all";
@@ -91,6 +100,7 @@
       "gc" = "git commit --verbose";
       "gcmsg" = "git commit --message";
       "gd" = "git diff";
+      "gdca" = "git diff --cached";
       "gds" = "git diff --staged";
       "gl" = "git log --stat";
       "glg" = "git log --graph";
@@ -103,11 +113,6 @@
       "gs" = "git status --short";
       "gss" = "git status";
       "code" = "codium";
-      "jl" = "jj log -n 10";
-      "jll" = "jj log";
-      "jd" = "jj diff";
-      "jn" = "jj new";
-      "jm" = "jj describe -m";
     };
   };
 

hosts/chunk/conduwuit.nix

@@ -0,0 +1,33 @@
+{ ... }:
+{
+  services.conduwuit = {
+    enable = true;
+    settings.global = {
+      port = [ 8448 ];
+      server_name = "cything.io";
+      allow_check_for_updates = true;
+    };
+  };
+
+  services.caddy.virtualHosts."chat.cything.io".extraConfig = ''
+    import common
+    reverse_proxy localhost:8448
+  '';
+
+  services.caddy.virtualHosts."cything.io" = {
+    serverAliases = [ "www.cything.io" ];
+    extraConfig = ''
+      import common
+
+      header /.well-known/matrix/* Content-Type application/json
+      header /.well-known/matrix/* Access-Control-Allow-Origin *
+      header /.well-known/matrix/* Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH,HEAD
+      header /.well-known/matrix/* Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization,Origin,Accept
+      route {
+        respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
+        respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
+        redir https://cy7.sh/posts{uri} permanent
+      }
+    '';
+  };
+}

hosts/chunk/default.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  lib,
   ...
 }:
 {
@@ -15,7 +16,9 @@
     ./redlib.nix
     ./vaultwarden.nix
     ./grafana.nix
+    ./conduwuit.nix
     ./immich.nix
+    ./element.nix
     ./forgejo.nix
     ./garage.nix
     ./tailscale.nix
@@ -44,14 +47,20 @@
     "rsyncnet/id_ed25519" = {
       sopsFile = ../../secrets/zh5061/chunk.yaml;
     };
+    "attic/env" = {
+      sopsFile = ../../secrets/services/attic.yaml;
+    };
     "garage/env" = {
       sopsFile = ../../secrets/services/garage.yaml;
     };
     "tailscale/auth" = {
       sopsFile = ../../secrets/services/tailscale.yaml;
     };
-    "karakeep/env" = {
+    "zipline/env" = {
-      sopsFile = ../../secrets/services/karakeep.yaml;
+      sopsFile = ../../secrets/services/zipline.yaml;
+    };
+    "searx/env" = {
+      sopsFile = ../../secrets/services/searx.yaml;
     };
   };
 
@@ -69,10 +78,7 @@
     networkmanager.enable = true;
     firewall = {
       enable = true;
-      trustedInterfaces = [
+      trustedInterfaces = [ "tailscale0" ];
-        "tailscale0"
-        "podman1"
-      ];
       allowedTCPPorts = [
         22
         80
@@ -81,6 +87,32 @@
       allowedUDPPorts = [
         443
       ];
+      extraCommands =
+        let
+          ethtool = lib.getExe pkgs.ethtool;
+          tc = lib.getExe' pkgs.iproute2 "tc";
+        in
+        ''
+          # disable TCP segmentation offload (https://wiki.archlinux.org/title/Advanced_traffic_control#Prerequisites)
+          ${ethtool} -K ens18 tso off
+
+          # clear existing rules
+          ${tc} qdisc del dev ens18 root || true
+
+          # create HTB hierarchy
+          ${tc} qdisc add dev ens18 root handle 1: htb default 10
+          ${tc} class add dev ens18 parent 1: classid 1:1 htb rate 100% ceil 100%
+          # rest
+          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 60% ceil 100%
+          # caddy
+          ${tc} class add dev ens18 parent 1:1 classid 1:30 htb rate 40% ceil 100%
+
+          # mark traffic
+          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 3
+
+          # route marked packets
+          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 3 fw flowid 1:30
+        '';
     };
     interfaces.ens18 = {
       ipv6.addresses = [
@@ -113,15 +145,13 @@
       "podman"
     ];
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
     ];
   };
   users.users.root.openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
-    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
   ];
   # for forgejo
   users.users.git = {
@@ -133,7 +163,6 @@
 
   environment.systemPackages = with pkgs; [
     vim
-    neovim
     wget
     curl
     tree
@@ -158,11 +187,9 @@
   programs.git.enable = true;
 
   my.caddy.enable = true;
+
+  # container stuff
   my.containerization.enable = true;
+
   my.authelia.enable = true;
-  my.karakeep = {
-    enable = false;
-    dataDir = "/opt/karakeep";
-  };
-  my.roundcube.enable = true;
 }

hosts/chunk/element.nix

@@ -0,0 +1,33 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+{
+  virtualisation.oci-containers.containers.element = {
+    image = "vectorim/element-web";
+    autoStart = true;
+    ports = [ "127.0.0.1:8089:8089" ];
+    pull = "newer";
+    networks = [ "element-net" ];
+    environment = {
+      ELEMENT_WEB_PORT = "8089";
+    };
+  };
+
+  systemd.services.create-element-net = {
+    serviceConfig.Type = "oneshot";
+    wantedBy = with config.virtualisation.oci-containers; [
+      "${backend}-element.service"
+    ];
+    script = ''
+      ${pkgs.podman}/bin/podman network exists element-net || \
+      ${pkgs.podman}/bin/podman network create element-net
+    '';
+  };
+
+  services.caddy.virtualHosts."element.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8089
+  '';
+}

hosts/chunk/garage.nix

@@ -17,15 +17,14 @@
       };
       admin.api_bind_addr = "[::]:3903";
       rpc_bind_addr = "[::]:3901";
-      rpc_public_addr = "100.122.132.30:3901";
       replication_factor = 1;
       db_engine = "lmdb";
       disable_scrub = true;
-      block_size = "128M";
+      block_size = "16M";
-      compression_level = "none";
+      compression_level = 3;
     };
     environmentFile = config.sops.secrets."garage/env".path;
-    logLevel = "info";
+    logLevel = "warn";
   };
 
   services.caddy.virtualHosts = {

hosts/chunk/postgres.nix

@@ -19,5 +19,8 @@
       }
     ];
   };
-  services.postgresqlBackup.enable = true;
+  services.postgresqlBackup = {
+    enable = true;
+    startAt = "hourly";
+  };
 }

hosts/chunk/rclone.nix

@@ -14,22 +14,22 @@ let
         --config ${config.sops.secrets."rclone/config".path} \
         --allow-other \
         --cache-dir /var/cache/rclone \
-        --transfers 16 \
+        --transfers 64 \
-        --vfs-cache-mode writes \
+        --vfs-cache-mode full \
         --vfs-cache-min-free-space 5G \
         --dir-cache-time 30d \
+        --no-checksum \
         --no-modtime \
         --vfs-fast-fingerprint \
-        --vfs-read-chunk-size 128M \
+        --vfs-read-chunk-size 8M \
-        --vfs-read-chunk-streams 0 \
+        --vfs-read-chunk-streams 16 \
-        --sftp-concurrency 64 \
+        --sftp-concurrency 128 \
         --sftp-chunk-size 255k \
         --buffer-size 0 \
         --write-back-cache \
         ${remote} ${mount}
     '';
     ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -zu ${mount}";
-    Restart = "on-failure";
   };
 in
 {

hosts/common.nix

@@ -1,7 +1,6 @@
-{ inputs, config, pkgs, ... }:
+{ inputs, config, ... }:
 {
   nix = {
-    package = pkgs.lix;
     settings = {
       experimental-features = "nix-command flakes";
       auto-optimise-store = true;
@@ -39,7 +38,7 @@
   i18n.defaultLocale = "en_US.UTF-8";
   time.timeZone = "America/New_York";
   networking = {
-    firewall.logRefusedConnections = true;
+    firewall.logRefusedConnections = false;
     nameservers = [
       # quad9 (unfiltered)
       "2620:fe::10"
@@ -56,7 +55,6 @@
       "nts.teambelgium.net"
       "c.st1.ntp.br"
     ];
-    nftables.enable = true;
   };
   services.chrony = {
     enable = true;

hosts/ytnix/default.nix

@@ -44,11 +44,10 @@
       efi.canTouchEfiVariables = true;
     };
     tmp.cleanOnBoot = true;
-    kernelPackages = pkgs.linuxPackages_6_14;
+    kernelPackages = pkgs.linuxKernel.packages.linux_zen;
     extraModulePackages = with config.boot.kernelPackages; [
       rtl8821ce
     ];
-    kernelModules = [ "8821ce" ];
     kernelParams = [
       # see https://github.com/tomaspinho/rtl8821ce#pcie-active-state-power-management
       "pcie_aspm=off"
@@ -61,10 +60,7 @@
       enable = true;
       pkiBundle = "/var/lib/sbctl";
     };
-    kernel.sysctl = {
+    kernel.sysctl."kernel.sysrq" = 1;
-      "kernel.sysrq" = 1;
-      # "net.ipv4.ip_forward" = 1;
-    };
     binfmt.emulatedSystems = [ "aarch64-linux" ];
   };
 
@@ -91,12 +87,12 @@
     resolvconf.enable = true;
     firewall = {
       enable = true;
-      trustedInterfaces = [
+      trustedInterfaces = [ "tailscale0" ];
-        "tailscale0"
+      # allowedTCPPorts = [
-      ];
+      #   8080 # mitmproxy
-      extraInputRules = ''
+      #   22000 # syncthing
-        ip saddr 192.168.100.0/24 tcp dport 9234 accept
+      #   3003 # immich-ml
-      '';
+      # ];
     };
     hosts = {
       "100.122.132.30" = [ "s3.cy7.sh" ];
@@ -109,10 +105,8 @@
     pulse.enable = true;
     alsa.enable = true;
     alsa.support32Bit = true;
-    wireplumber.extraConfig."10-bluetooth-enhancements" = {
+    wireplumber.extraConfig.bluetoothEnhancements = {
-      "wireplumber.settings" = {
+      # https://julian.pages.freedesktop.org/wireplumber/daemon/configuration/bluetooth.html#bluetooth-configuration
-        "bluetooth.autoswitch-to-headset-profile" = false;
-      };
       "monitor.bluez.properties" = {
         "bluez5.enable-sbc-xq" = true;
         "bluez5.enable-msbc" = true;
@@ -120,27 +114,27 @@
         "bluez5.roles" = [
           "a2dp_sink"
           "a2dp_source"
+          "hsp_hs"
+          "hsp_ag"
           "hfp_hf"
           "hfp_ag"
         ];
       };
     };
     # https://wiki.archlinux.org/title/Bluetooth_headset#Connecting_works,_sound_plays_fine_until_headphones_become_idle,_then_stutters
-    wireplumber.extraConfig."11-disable-suspend" = {
+    wireplumber.extraConfig.disableSuspend = {
-      "monitor.bluez.rules" = [
+      "monitor.bluez.rules" = {
-        {
+        matches = [
-          matches = [
+          {
-            {
+            "node.name" = "bluez_output.*";
-              "device.name" = "bluez_card.*";
+          }
-            }
+        ];
-          ];
+      };
-          actions = {
+      actions = {
-            update-props = {
+        update-props = {
-              "session.suspend-timeout-seconds" = 0;
+          "session.suspend-timeout-seconds" = 0;
-            };
+        };
-          };
+      };
-        }
-      ];
     };
   };
 
@@ -210,7 +204,7 @@
   services.displayManager = {
     enable = true;
     autoLogin.user = "yt";
-    defaultSession = "sway";
+    defaultSession = "plasma";
     sddm = {
       enable = true;
       wayland.enable = true;
@@ -219,14 +213,10 @@
   };
 
   fonts = {
-    packages =
+    packages = with pkgs; [
-      (with pkgs; [
+      nerd-fonts.roboto-mono
-        ibm-plex
+      ibm-plex
-      ])
+    ];
-      ++ (with pkgs.nerd-fonts; [
-        roboto-mono
-        jetbrains-mono
-      ]);
     enableDefaultPackages = true;
   };
 
@@ -248,7 +238,6 @@
       "/home/yt/Games"
       "/home/yt/Videos"
       "/home/yt/.bitmonero"
-      "/home/yt/vms"
     ];
     repo = "yt";
     passFile = config.sops.secrets."borg/rsyncnet".path;
@@ -277,10 +266,6 @@
     enable = true;
     qemu.vhostUserPackages = with pkgs; [ virtiofsd ];
   };
-  # virtualisation.vmware.host = {
-  #   enable = true;
-  #   package = pkgs.vmware-workstation;
-  # };
   programs.virt-manager.enable = true;
   my.containerization.enable = true;
 
@@ -289,6 +274,7 @@
     enable = true;
     # nix run github:thiagokokada/nix-alien#nix-alien-find-libs ./<binary>
     libraries = with pkgs; [
+      # TODO: revisit what we actually need
       mesa
       extest
       stdenv.cc.cc
@@ -331,7 +317,6 @@
       xorg.libxshmfence
       xorg.libXxf86vm
       xorg.libSM
-      xorg.libICE
       gtk3
       pango
       gdk-pixbuf
@@ -345,7 +330,6 @@
       pcre2
       gsettings-desktop-schemas
       fzf
-      systemd
     ];
   };
   programs.evolution.enable = true;
@@ -376,6 +360,12 @@
     ];
   };
 
+  services.ollama.enable = false;
+
+  services.trezord.enable = true;
+
+  programs.niri.enable = false;
+  programs.niri.package = pkgs.niri-unstable;
   programs.xwayland.enable = true;
 
   services.udev.extraHwdb = ''
@@ -400,32 +390,7 @@
   programs.ccache.enable = true;
   nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
   programs.fuse.userAllowOther = true;
-  nix.settings.sandbox = true;
+  nix.settings.sandbox = false;
 
   programs.ssh.startAgent = true;
-
-  programs.sway = {
-    enable = true;
-    wrapperFeatures.gtk = true;
-    extraPackages = with pkgs; [
-      rofi-wayland
-      cliphist
-      rofimoji
-      grim
-      slurp
-      swaylock
-      swayidle
-      brightnessctl
-      waybar
-      wl-clipboard
-    ];
-  };
-
-  programs.ghidra = {
-    enable = true;
-    package = pkgs.ghidra.withExtensions (p: with p; [
-      findcrypt
-      ret-sync
-    ]);
-  };
 }

hosts/ytnix/hardware-configuration.nix

@@ -82,5 +82,5 @@
   # networking.interfaces.wlp2s0.useDHCP = lib.mkDefault true;
 
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault true;
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 }

modules/authelia.nix

@@ -49,14 +49,9 @@ in
         webauthn = {
           enable_passkey_login = true;
         };
-        identity_providers.oidc.claims_policies = {
-          # https://github.com/karakeep-app/karakeep/issues/410
-          # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
-          karakeep.id_token = [ "email" ];
-        };
         identity_providers.oidc.clients = [
           {
-            client_id = "4EIrpRb9rnwHWjYWvlz2gYrtTmoOLF1D5gqXw28BvmOS0f-9T2p4CFwuctf4Co1hkpo2sd4Y";
+            client_id = "immich";
             client_name = "immich";
             client_secret = "$argon2id$v=19$m=65536,t=3,p=4$Vny2G8EbSPafSwnIuq2Zkg$eF2om4WDEaqCFmrAG27h2mYl+cXxXyttPJ7gaPLs+f8";
             public = false;
@@ -68,10 +63,9 @@ in
             ];
             scopes = [ "openid" "profile" "email" ];
             userinfo_signed_response_alg = "none";
-            token_endpoint_auth_method = "client_secret_basic";
           }
           {
-            client_id = "_kuUEYxyfXjInJCniwugpw2Qn6iI-YW24NOkHZG~63BAhnAACDZ.xsLqOdGghj2DNZxXR0sU";
+            client_id = "forgejo";
             client_name = "Forgejo";
             client_secret = "$argon2id$v=19$m=65536,t=3,p=4$O2O5r/7A8hc4EMvernQ4Dw$YOVqtwY3jv0HlcxmviPq2CRnD7Dw85V9KDtTSUQE7bA";
             public = false;
@@ -84,7 +78,7 @@ in
             token_endpoint_auth_method = "client_secret_basic";
           }
           {
-            client_id = "b_ITCG0uNzy9lZ5nVC~Ny5R35te8I3hoQW1uraCbdxeiE9VuiCIelMmZZ7dAZLg_anTUWSQG";
+            client_id = "hedgedoc";
             client_name = "HedgeDoc";
             client_secret = "$argon2id$v=19$m=65536,t=3,p=4$MFSXW3gjIZf0M3e8s8RJCg$6KWwksJe2vdUebPEdYc0Zy88fzGcHPrbStcqkiXl+Hg";
             public = false;
@@ -100,17 +94,6 @@ in
             audience = [];
             token_endpoint_auth_method = "client_secret_post";
           }
-          {
-            client_id = "0SbsGvw5APYJ4px~dv38rCVgXtK2XWrF1QvyuaFz48cgsNm-rAXkSgNOctfxS21IWOFSfsm5";
-            client_name = "Karakeep";
-            client_secret = "$pbkdf2-sha512$310000$4UanDZq.6oholJW3CmKwtQ$9e3hqR8qGU4LoneR/Y9jtJTx0iSzATI4iXymrs8QrmGw4JY1BPF4.IJ9Jbc.8cikU4qpfUIFO6r2dG7JHznCnw";
-            public = false;
-            authorization_policy = "two_factor";
-            redirect_uris = [ "https://keep.cy7.sh/api/auth/callback/custom" ];
-            scopes = [ "openid" "profile" "email" ];
-            userinfo_signed_response_alg = "none";
-            claims_policy = "karakeep";
-          }
         ];
       };
       secrets = {

modules/backup.nix

@@ -21,7 +21,7 @@ let
     "/var/lib/docker"
     "/var/lib/containers" # podman
     "/var/lib/systemd"
-    "/var/lib/libvirt/images"
+    "/var/lib/libvirt"
     "**/.rustup"
     "**/.cargo"
     "**/.docker"
@@ -47,7 +47,7 @@ in
     };
     startAt = lib.mkOption {
       type = lib.types.str;
-      default = "daily";
+      default = "hourly";
       description = "see systemd.timer(5)";
     };
     jobName = lib.mkOption {
@@ -98,9 +98,8 @@ in
       failOnWarnings = false;
 
       prune.keep = {
-        daily = 7;
+        within = "2d";
-        weekly = 12;
+        daily = 365;
-        monthly = -1;
       };
       extraPruneArgs = [ "--stats" ];
     };

modules/caddy.nix

@@ -19,9 +19,9 @@ in
         plugins = [
           # error message will tell you the correct version tag to use
           # (still need the @ to pass nix config check)
-          "github.com/caddy-dns/cloudflare@v0.2.2-0.20250420134112-006ebb07b349"
+          "github.com/caddy-dns/cloudflare@v0.0.0-20250228175314-1fb64108d4de"
         ];
-        hash = "sha256-2U+icm4GtI5Fww6U8nKzQ/+pPf63T3scTGuj1zjj4b4=";
+        hash = "sha256-YYpsf8HMONR1teMiSymo2y+HrKoxuJMKIea5/NEykGc=";
       };
       logFormat = lib.mkForce "level INFO";
       acmeCA = "https://acme-v02.api.letsencrypt.org/directory";
@@ -37,9 +37,9 @@ in
 
         (authelia) {
           forward_auth localhost:9091 {
-            uri /api/authz/forward-auth
+		        uri /api/authz/forward-auth
-            copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+		        copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
-	  }
+	        }
         }
       '';
       environmentFile = config.sops.secrets."caddy/env".path;
@@ -49,8 +49,7 @@ in
         respond / 200 {
           body "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6
         ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhUt9h5dCcrwOrZNKkStCX5OxumPzEwYXSU/0DgtWgP
-        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD
+        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD"
-        sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
         }
       '';
     };

modules/containerization.nix

@@ -30,10 +30,6 @@ in
         };
         # answer on /var/run/docker.sock
         dockerSocket.enable = true;
-        autoPrune = {
-          enable = true;
-          dates = "daily";
-        };
       };
       docker.enable = lib.mkIf (!cfg.usePodman) true;
       oci-containers.backend = lib.mkIf (!cfg.usePodman) "docker";

modules/default.nix

@@ -10,6 +10,5 @@
     ./searx.nix
     ./attic.nix
     ./authelia.nix
-    ./karakeep.nix
   ];
 }

modules/karakeep.nix

@@ -1,81 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.karakeep;
-in
-{
-  options.my.karakeep = {
-    enable = lib.mkEnableOption "karakeep";
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-    };
-    port = lib.mkOption {
-      default = 3002;
-      description = "port for the web service";
-      type = lib.types.port;
-    };
-    domain = lib.mkOption {
-      default = "keep.cy7.sh";
-      type = lib.types.str;
-    };
-    environmentFile = lib.mkOption {
-      default = config.sops.secrets."karakeep/env".path;
-      type = lib.types.path;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    virtualisation.oci-containers.containers = {
-      karakeep-web = {
-        image = "ghcr.io/karakeep-app/karakeep:release";
-        pull = "newer";
-        volumes = [ "${cfg.dataDir}:/data" ];
-        ports = [ "${toString cfg.port}:3000"];
-        dependsOn = [
-          "karakeep-chrome"
-          "karakeep-meilisearch"
-        ];
-        environment = {
-          MEILI_ADDR = "http://karakeep-meilisearch:7700";
-          BROWSER_WEB_URL = "http://karakeep-chrome:9222";
-          DATA_DIR =  "/data";
-          NEXTAUTH_URL = "https://${cfg.domain}";
-          DISABLE_PASSWORD_AUTH = "true";
-          OAUTH_WELLKNOWN_URL = "https://auth.cy7.sh/.well-known/openid-configuration";
-          OAUTH_CLIENT_ID = "0SbsGvw5APYJ4px~dv38rCVgXtK2XWrF1QvyuaFz48cgsNm-rAXkSgNOctfxS21IWOFSfsm5";
-          OAUTH_PROVIDER_NAME = "Authelia";
-          OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING = "true";
-        };
-        # needs NEXTAUTH_SECRET
-        environmentFiles = [ "${cfg.environmentFile}" ];
-      };
-
-      karakeep-chrome = {
-        image = "ghcr.io/zenika/alpine-chrome:latest";
-        pull = "newer";
-        cmd = [
-          "--no-sandbox"
-          "--disable-gpu"
-          "--disable-dev-shm-usage"
-          "--remote-debugging-address=0.0.0.0"
-          "--remote-debugging-port=9222"
-          "--hide-scrollbars"
-        ];
-      };
-
-      karakeep-meilisearch = {
-        image = "getmeili/meilisearch:latest";
-        volumes = [ "meilisearch:/meili_data" ];
-        environment = {
-          MEILI_NO_ANALYTICS = "true";
-        };
-        # needs MEILI_MASTER_KEY
-        environmentFiles = [ "${cfg.environmentFile}" ];
-      };
-    };
-
-    services.caddy.virtualHosts.${cfg.domain}.extraConfig = ''
-      import common
-      reverse_proxy localhost:${toString cfg.port}
-    '';
-  };
-}

modules/roundcube.nix

@@ -31,7 +31,6 @@ in
         "contextmenu"
         "custom_from"
         "thunderbird_labels"
-        "managesieve"
       ];
       dicts = with pkgs.aspellDicts; [ en ];
       extraConfig = ''
@@ -39,8 +38,6 @@ in
         $config['smtp_host'] = "ssl://smtp.migadu.com:465";
         $config['smtp_user'] = "%u";
         $config['smtp_pass'] = "%p";
-        $config['managesieve_host'] = "tls://imap.migadu.com";
-        $config['managesieve_port'] = 4190;
       '';
     };
 
@@ -51,7 +48,6 @@ in
 
     services.caddy.virtualHosts."mail.cy7.sh".extraConfig = ''
       import common
-      import authelia
       root ${roundcube.package}
       php_fastcgi unix/${fpm.socket}
       file_server

overlay/default.nix

@@ -7,12 +7,14 @@
       pkgFrom = flake: pkg: flake.packages.${prev.system}.${pkg};
     in
     {
+      conduwuit = pkgFrom inputs.conduwuit "default";
+      attic-server = pkgFrom inputs.attic "attic-server";
+      attic = pkgFrom inputs.attic "attic";
       garage = (
         (pkgFrom inputs.garage "default").overrideAttrs {
           meta.mainProgram = "garage";
         }
       );
-      nil = pkgFrom inputs.nil "default";
     }
   )
 ]

secrets/services/hedgedoc.yaml

@@ -1,5 +1,5 @@
 hedgedoc:
-    env: ENC[AES256_GCM,data:9xnOlQrk1qCyiAHSjmu8dvj2/z/BrJlngNGAQnMwvLsL0pnyvvyJLnYWTDYix1a9o8OJUNLw6Qhq7KbY4uXfxsNZkfGdVHwvkvhySjR2rcX/r90txqHJUUIxE/TzdsBvonzQ0F85KfXhsi69gKHp016gCj+jNf6CCY+tOVpt71el4Z+jzqLHasuQET8GctKJRzHOfNfCx/X2kJeb7RQl3JFC6/VmYT45bUk7uFfveFD9ao03wJwLKi27wO1WDrfpOigFdvkmqpbWZjaILYHYmkdhdlhr7w330CiCmGHT/ssmSPcu5cYUc8tjYPgpYLjusiUzpE5jmut5GaNwZsY9hNuow/mUVnQ/tCDH0ChOq0DQisJ07VMYlRII9tMdcuT4IbjjwiRcYlORAHsTFUuo5DCaDp8a4mx846BGp1YMQsvqJQgOe4x15VMpeB/ptxm79qxcLZKZ3BkiJaKmDdWsVk9RfqVgsxqiq16Me2EQhknO2s/oBjGOaoIiT4NEuRFQl0BIPgIMD0lYzKx0uDaYyclID5W0DqMI+SrcBd+WH/BB9HPdZx92rFe34PzjZse0i6+5UZHXUu8au6CyLMqGkUlzkSFwVT5W7Lv2m9P3+6YjgPRMaYbg8b6kmavB6EtjiqWtTbMKr3nxPVYJc5FRImvebfFqiLy5MWoNV6Qe7TUGIk6QtX2OWBhQ1UB+IpR+180QH7yw7UpgJ9EM8dD2m2/smar5P0BjAaqAFib++GzoB0OfFtxJNUjrejQC11tRWBXYvcHWwa78VbKPul0xqiEMmsAZufMix4lD1EgutTf1CXfv7l0rUpLwkYbWIq2hT5UI53L0YWJDl7zlhi94ANdXV8z8kCvMeXm2Fwl/vIgJ9JuFeVeVYPpXwx2coLBwE6uI4SuFvY1d4ojvzY8KftcHWO7srVzpuwrwW+6gKLwPQyEazv+sRKXAGo0ffMO2/2KRgOu9zGwaOFaNDAZ6gYFDWbPz6TMfNWHzfLEFK5BlVAL8KDb78IODUBYcMr2CX1Y=,iv:LDkuJgxIbohEVf7wmdtOZ/vlPddMYa7uzHGkL+0MnUM=,tag:pnJiCJydjTmUbS761fPUPw==,type:str]
+    env: ENC[AES256_GCM,data:hU4Ht9WkWknuYJ3yHZSm5o22wlssTNjPDZvgDi9DGEh8ULt2GzrEHfFHI9VcpyrbsLcw7HT5TuYrPibWMk4AEvqlZT/6UiyQFMso9mac6x7esf55RHTXr4F7gyC/eRDUE+mAzyhjB5xKaCUhaQpMOwA2t0zahtiaCzLvi/DXRo1jiB42Xt8Nwi1D+zRT3T/HYD8l7D+SZQQc6HC+WM/y7RIjEPcDeX/wTk+JqiGW++0D3GxCQgq6VOhw7EM4hs5aR659QVNICT9kJt9nxEsyU84nsws4MHzU53BvEY77rYZPvvrBSFJ+TnQJ0c/e8K2G9mgaEGkk/+Rmx3RbPQKuTNCzAJZ0m9g9XSwMHU/z5KkrxcI6xU1+JqpdL2Rx35JiNxbNNrlQSvXJFuGNSf0Z5l8RirKJL4HJXAsIPVZTxeJJ0rQflyb5hN63KH/vUTHJWucAFSRYwLHOgs4Yu7SKJjnWnrLYAK9K/eRprhe3Np3vTed13soZXjdB1Jz6lz3lUxZ4TpOb6E8rGt33GqACTp04DBkyUaxMg7fOQIi0riev9GcGNy1kQkDC5dOwWyQdSICIavBrL+4WRoK8xhsEMY8K58+TYfIm3XnWz6pSEl7OzdGNSFZJuwAPzGS065bCjHIlMxIUKlbx4rmGvecIGRLoa5a5XpFwVwPlH8IJ8LvDPXqyIBquL6IsoCNi+jVy7UV52WldqAAeC3+UJtD8LJj1FaWLkoshkSbcr5veZLtBnpOZsiPXtkn1qgRhCB0QjzNwz+AOJCamSn1R+i+JJN6Wja3mJytCrtoj0M6cc1beJBbam4PgxWd1CJE3zhstuqoktn9LdDZ3qNjPgRY3q4FPbjo53XvQQi/NgnPztMg2z7Rj8yeNtG+HjL2pfXIw9AXZwc19D+T7M5hR7jlD3117o+K2CeaC+wgfXPZ/xzIbhg==,iv:gvSOTStLJ5R4UaXj7gXQDCF4TAgway12yh1BtGz1Mvs=,tag:Jt+daURO+t8HME/m7tLEIw==,type:str]
 sops:
     age:
         - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
@@ -20,7 +20,7 @@ sops:
             enlDZEI2NElkZkI3UmRyQUZqQWE5ZmcK2JlwNzVJNhGjyniIg9UY5tjgUKttkT3e
             9C/xag3dQCiqzX1O3o5tdhYnxXw+VxVf+qTFyyuftg5iQPZNuvX6mA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-05T21:08:15Z"
+    lastmodified: "2025-04-04T17:04:50Z"
-    mac: ENC[AES256_GCM,data:cPisYUoZWd/vd+wWzz3xTnftj1RdjK20dWFo+MKssm/eu7eCOWDIaZdcJg13gkTleBpMWQy/mG1drC6GLfGQiBmkS99UCPAoo0aLTBL4FbSm6FEXdbVjoOI7URu6Sj31drWCMAm+lXYymWsHwZJrNLhjsCTQsxTPvFq8oOdNlXo=,iv:KpmJoZ/BGEEhZ75jXfXxegNglm7k6mtleRuVud6tX2g=,tag:lsiqX+YSz4mGK6mw9gdKNg==,type:str]
+    mac: ENC[AES256_GCM,data:RRkdyrxwrFs3r0SaNred5zTpz5CKf043+KWkFSvPFh0RbvIVyxzJKyfL9r7erifEMhPRJ7Hz5GKE4RAPA9yRLkA9C+416sZKfwdopqAe6zSRt4zd0QOPMdc2z3+07+1SP2ay/ZYCn6jjIyoBaki3t0DMv7e9a/OzFv3WfyjG/rg=,iv:K41muQnynaGoZsBquNF0SNFgssLF9KGzBz8siagI+38=,tag:jkWbWBloSbUSJXl9jedAMQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.1

secrets/services/karakeep.yaml

@@ -1,35 +0,0 @@
-karakeep:
-    env: ENC[AES256_GCM,data:SWc26EQaKR5d9hMDYzVHA/r7XfjwFZ0d44Co0IS6OayR24ej7yqLAtkNttROKoKFuYc0sHgN9bOy4MyX0s3qiSWYovIIUJgFiJjPQFYDAo+50WR4+5W5FgvYI6e42fcWrQhaCXWQrDyzch/zT2OITZsjXcQhT5E+IiPLVkaGOjGptE07GjM7ZXI4UxBzINFQOhxdfIO0km1o6Wq8GhJdWsz4exz4ahRslR+WjK/flV2GZVAj6EHSJ5sHohm74QlhxaShEbc/8IKP6R2gSjBFP7l8VvwFyIUD9sLzYGvS3iU=,iv:gSPQU0bZ+VRFbuaNDc90dW0ogWX2SMH7kewtq/u/11E=,tag:L0Y4EWSQUhcn2eHt+yZ7qQ==,type:str]
-sops:
-    age:
-        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaWQ1Q1JwRHJxQjNjdTAx
-            TXRsWjVZOG1mNEptNVhscHBaK2I5MHhjdlFjCkNqOEhwT3hyOHpHQ2k0ZmowUXB4
-            eks2dlpUS0V6VjBEYW9UWnhFOEw4VGsKLS0tIFo2a0FTRE5WdHBGVW5DOUFkaE9p
-            bitvUnJXSnB6UnV3VTEzSjlSYmEwVUEKHOwFCRu+SIyM0uJ6bNEAo+MMlsc8la6G
-            bLYdCoykcBu+uVXqn3BYTbrS5ylQMRYcbcPFJw5BVdmjIYF4LU5W6A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrU2ZnNVAyeVdJeHlTSW1x
-            QUhKRzlNclVUWE1ucHFLZW5sL1lnUDhkd0Y4CjFuekNEOE1icDNqL1JyT0hEYW16
-            Q2VyajJFWWtGUnBzOENGOEZHbWROZzAKLS0tIE8wMVc3TkV5Y1VyenIvOW02NDNq
-            cStTeUcvY1pJWEN2MzFEeThKT0JPc1EKXrtVG49a6YZVKiL1F8Xg3t3niTYv3LwN
-            NeAQ8srV0F6ckky7OCkvUp9GInZCWRzULXV/x+4IUb6C+KQaNm2vYA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdDdUSUlmMk5VcytyT01N
-            UmRaK2k5Wkh5SlhPT3QrczY2eW9vZk5KWFZBCnBteitnNFlHdWRaaTRxSWYvYmtG
-            ZnY5ZXlYa3Z5aENlRy9BQjVSU1F3UzQKLS0tIFpjN1dOaWNKaU9PaENyaXc1K3BU
-            K2orZ0Y2Z05LSUZ5WHQ4TnVVY0QwSzQKiUQT4aSxXnaq0kEMp+q5WnIUoGypEmZ+
-            DQEhkB9yu/BrkjXH+HGQr1W5B4sJyb5rnl0+SQ+IypRIRyaX4CdFxg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-05T19:44:58Z"
-    mac: ENC[AES256_GCM,data:OmqsJI9BaICOTiH1cq4gZlNBbkAxn/pAOWBtkIjHdqpikABLG6fMY+sLpyeaovXjexIj9MZk7fPmV8dRZ5VNLHCqlYXK/cVoQBZ2HK+p/cGTAFelNAShu9NSgZdFmVgJJtOjVvFp8dtuY8VcQj861k/MPX0mNZt9pmXYdumjpNM=,iv:efHkp1KUctwtCjG9A8i5qs7nQfQqv2ya1yYlHHOt8pU=,tag:4lChpspl0oOUMiXzvGuA2Q==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.1