55 changed files with 1862 additions and 1150 deletions
--- a/.github/workflows/build-machines-and-homes.yml
+++ b/.github/workflows/build-machines-and-homes.yml
@ -3,14 +3,6 @@ on:
  workflow_dispatch:
  push:
  pull_request:
-
-env:
-  TERM: ansi
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
-  AWS_DEFAULT_REGION: us-east-1
-  AWS_ENDPOINT_URL: https://s3.cy7.sh
-
 jobs:
  build-machines:
    strategy:
@ -22,7 +14,6 @@ jobs:
        os:
          - ubuntu-latest
    runs-on: ${{ matrix.os }}
-
    steps:
      - name: Maximize build disk space
        uses: easimon/maximize-build-space@v10
@ -35,50 +26,41 @@ jobs:
          remove-codeql: 'true'
          remove-docker-images: 'true'
          build-mount-path: /nix
-
-      - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
-
+      - name: Install Nix
+        uses: cachix/install-nix-action@v30
+        with:
+          install_url: https://releases.nixos.org/nix/nix-2.25.4/install
+          extra_nix_config: 'accept-flake-config = true'
      - name: Sync repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false
-
-      - name: post-build-hook
-        run: |
-          sudo mkdir -p /etc/nix
-          sudo cp ci/upload-to-cache.sh /etc/nix/
-          sudo chmod +x /etc/nix/upload-to-cache.sh
-
-      - name: setup s3 credentials
-        run: |
-          sudo mkdir /root/.aws
-          echo "[default]" |sudo tee /root/.aws/config |sudo tee /root/.aws/credentials
-          echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" |sudo tee -a /root/.aws/credentials
-          echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" |sudo tee -a /root/.aws/credentials
-          echo "endpoint_url=$AWS_ENDPOINT_URL" |sudo tee -a /root/.aws/config
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v30
+      - uses: cachix/cachix-action@v14
        with:
-          enable_kvm: true
-          extra_nix_config: |
-            show-trace = true
-            experimental-features = nix-command flakes
-            accept-flake-config = true
-            system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-            post-build-hook = /etc/nix/upload-to-cache.sh
-
-      - name: build
-        run: |
-          nix run nixpkgs#nixos-rebuild build -- -L --flake ".#${{ matrix.machine }}"
-
+          name: cything
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          useDaemon: false
+          installCommand: nix profile install nixpkgs#cachix
+      - name: Restore and cache Nix store
+        uses: nix-community/cache-nix-action@v5.1.0
+        with:
+          # restore and save a cache using this key
+          primary-key: nix-${{ runner.os }}-${{ matrix.machine }}-${{ hashFiles('**/*.nix', 'flake.lock') }}
+          # if there's no cache hit, restore a cache by this prefix
+          restore-prefixes-first-match: nix-${{ runner.os }}-${{ matrix.machine }}-
+          # do purge caches
+          purge: true
+          # purge all versions of the cache
+          purge-prefixes: nix-${{ runner.os }}-
+          # created more than this number of seconds ago relative to the start of the `Post Restore` phase
+          purge-last-accessed: 86400
+          # except the version with the `primary-key`, if it exists
+          purge-primary-key: never
+          # always save the cache
+          save-always: true
+      - run: nix build -L .#nixosConfigurations.${{ matrix.machine }}.config.system.build.toplevel
  build-homes:
    strategy:
-      fail-fast: false
      matrix:
        home:
          - yt@ytnix
@ -87,7 +69,6 @@ jobs:
          - ubuntu-latest
          # - macos-latest
    runs-on: ${{ matrix.os }}
-
    steps:
      - name: Maximize build disk space
        uses: easimon/maximize-build-space@v10
@ -100,44 +81,32 @@ jobs:
          remove-codeql: 'true'
          remove-docker-images: 'true'
          build-mount-path: /nix
-
-      - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
-
+      - uses: nixbuild/nix-quick-install-action@master
      - name: Sync repository
        uses: actions/checkout@v4
        with:
          persist-credentials: false
-
-      - name: post-build-hook
-        run: |
-          sudo mkdir -p /etc/nix
-          sudo cp ci/upload-to-cache.sh /etc/nix/
-          sudo chmod +x /etc/nix/upload-to-cache.sh
-
-      - name: setup s3 credentials
-        run: |
-          sudo mkdir /root/.aws
-          echo "[default]" |sudo tee /root/.aws/config |sudo tee /root/.aws/credentials
-          echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" |sudo tee -a /root/.aws/credentials
-          echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" |sudo tee -a /root/.aws/credentials
-          echo "endpoint_url=$AWS_ENDPOINT_URL" |sudo tee -a /root/.aws/config
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v30
+      - uses: cachix/cachix-action@v14
        with:
-          enable_kvm: true
-          extra_nix_config: |
-            show-trace = true
-            experimental-features = nix-command flakes
-            accept-flake-config = true
-            system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-            post-build-hook = /etc/nix/upload-to-cache.sh
-
-      - name: build
-        run: |
-          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
-          nix build -L "$package"
+          name: cything
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          useDaemon: false
+          installCommand: nix profile install nixpkgs#cachix
+      - name: Restore and cache Nix store
+        uses: nix-community/cache-nix-action@v5.1.0
+        with:
+          # restore and save a cache using this key
+          primary-key: nix-${{ runner.os }}-${{ matrix.home }}-${{ hashFiles('**/*.nix', 'flake.lock') }}
+          # if there's no cache hit, restore a cache by this prefix
+          restore-prefixes-first-match: nix-${{ runner.os }}-${{ matrix.home }}-
+          # do purge caches
+          purge: true
+          # purge all versions of the cache
+          purge-prefixes: nix-${{ runner.os }}-
+          # created more than this number of seconds ago relative to the start of the `Post Restore` phase
+          purge-last-accessed: 86400
+          # except the version with the `primary-key`, if it exists
+          purge-primary-key: never
+          # always save the cache
+          save-always: true
+      - run: nix build -L .#homeConfigurations."${{ matrix.home }}".activationPackage
--- a/.github/workflows/build-packages.yml
+++ b/.github/workflows/build-packages.yml
@ -6,14 +6,6 @@ on:
        description: "package to build"
        required: false
        type: string
-
-env:
-  TERM: ansi
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
-  AWS_DEFAULT_REGION: us-east-1
-  AWS_ENDPOINT_URL: https://s3.cy7.sh
-
 jobs:
  build-packages:
    strategy:
@ -27,43 +19,20 @@ jobs:
          - macos-latest
          - macos-13
    runs-on: ${{ matrix.os }}
-
    steps:
-      - name: setup binary cache key
-        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
-
      - name: Install Nix
        uses: cachix/install-nix-action@v30
+
+      - name: Sync repository
+        uses: actions/checkout@v4
        with:
-          enable_kvm: true
-          extra_nix_config: |
-            show-trace = true
-            experimental-features = nix-command flakes
-            accept-flake-config = true
-            system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
+          persist-credentials: false
+
+      - uses: cachix/cachix-action@v14
+        with:
+          name: cything
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          useDaemon: false
+          installCommand: nix profile install nixpkgs#cachix

      - run: nix build -L ${{ matrix.package }}
-
-      - name: cache result
-        # https://stackoverflow.com/a/58859404
-        if: '!cancelled()'
-        run: |
-          nix run github:cything/nixcp -- \
-            push \
-            --bucket nixcache \
-            --signing-key ${{ runner.temp }}/cache-priv-key.pem \
-            -u https://nix-community.cachix.org \
-            "${{ matrix.package }}"
-
-      - name: prepare tarball to upload
-        run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
-
-      - name: upload result
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.os }}
-          path: result.tar
-          if-no-files-found: error
--- a/.github/workflows/update-flake-lock.yml
+++ b/.github/workflows/update-flake-lock.yml
@ -11,32 +11,10 @@ jobs:
  createPullRequest:
    runs-on: ubuntu-latest
    steps:
-      - uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2
-        with:
-          ssh-key: ${{ secrets.SSH_DEPLOY_KEY }}
-
+      - uses: actions/checkout@v4
      - name: Install Nix
-        uses: cachix/install-nix-action@53fb48f556dd912c4814b24ee8059a9c91c82b18
+        uses: cachix/install-nix-action@v30
        with:
-          enable_kvm: true
-          extra_nix_config: |
-            show-trace = true
-            experimental-features = nix-command flakes
-            accept-flake-config = true
-            system-features = nixos-test benchmark big-parallel kvm
-            secret-key-files = /home/runner/cache-priv-key.pem
-            extra-substituters = https://nixcache.cy7.sh
-            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-
+          github_access_token: ${{ secrets.GITHUB_TOKEN }}
      - name: Update flake.lock
-        run: |
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-          nix flake update --commit-lock-file
-
-      - name: Create PR
-        uses: peter-evans/create-pull-request@98106d3f2b65918a6591f9e155117b7219ff7e51
-        with:
-          title: nix flake update
-          branch: update-flake-inputs
-          branch-suffix: timestamp
+        uses: DeterminateSystems/update-flake-lock@v24
--- a/.sops.yaml
+++ b/.sops.yaml
@ -118,27 +118,9 @@ creation_rules:
      - age:
          - *chunk
          - *cy
+
  - path_regex: secrets/services/searx.yaml
    key_groups:
      - age:
          - *chunk
          - *cy
-  - path_regex: secrets/cache-priv-key.pem
-    key_groups:
-      - age:
-          - *yt
-          - *cy
-          - *chunk
-  - path_regex: secrets/services/authelia.yaml
-    key_groups:
-      - age:
-          - *yt
-          - *cy
-          - *chunk
-  - path_regex: secrets/services/karakeep.yaml
-    key_groups:
-      - age:
-          - *yt
-          - *cy
-          - *chunk
-
--- a/1
+++ b/1
@ -1 +0,0 @@
-this is only open source for free ci
--- a/README.md
+++ b/README.md
@ -0,0 +1,40 @@
+# infra
+## ./home
+- [home-manager](https://github.com/nix-community/home-manager) configuration files
+- foot, tmux, and zsh are configured in Nix
+- nvim, rofi, sway, waybar are configured in their own literature and symlinked to $XDG_CONFIG_HOME with home-manager
+
+## ./hosts
+- [`hosts/common.nix`](hosts/common.nix): configuration that makes sense on all computers
+- [`hosts/zsh.nix`](hosts/zsh.nix): for computers that have the power to run zsh
+### ./hosts/ytnix
+- personal laptop
+- a single [`default.nix`](hosts/ytnix/default.nix) that could be modularized but works for now
+
+### ./hosts/chunk
+- the overworked server with 5% SLA
+- very short and concise [`default.nix`](hosts/chunk/default.nix)
+- services organized in their modules
+- some services run through `virtualisation.oci-containers`:
+    - [immich](hosts/chunk/immich.nix)
+    - [conduwuit](hosts/chunk/conduwuit.nix)
+
+### ./hosts/titan
+- got this cause chunk would go down way too often :(
+- hosted on azure for "reliability"
+- runs:
+    - [ghost](hosts/titan/ghost.nix) (through `virtualisation.oci-containers`)
+    - [uptime-kuma](hosts/titan/uptime-kuma.nix)
+    - [ntfy-sh](hosts/titan/ntfy.nix)
+
+## ./secrets
+- secrets
+- see [`.sops.yaml`](.sops.yaml) for who privy to what
+
+## backups
+- hourly borgbackup to [rsync.net](https://rsync.net)
+- see [modules/backup](modules/backup.nix)
+
+## monitoring
+- [status.cything.io](https://status.cything.io/): uptime kuma (reliable)
+- [grafana.cything.io](https://grafana.cything.io/): some real-time metrics here; unlike the status page this will go kaput often
--- a/ci/upload-to-cache.sh
+++ b/ci/upload-to-cache.sh
@ -1,8 +0,0 @@
-#!/bin/sh
-
-# https://nix.dev/guides/recipes/post-build-hook.html#implementing-the-build-hook
-set -eu
-set -f # disable globbing
-export IFS=' '
-echo "Uploading paths" $OUT_PATHS
-exec /nix/var/nix/profiles/default/bin/nix copy --to "s3://nixcache?endpoint=s3.cy7.sh&compression=zstd&parallel-compression=true" $OUT_PATHS
--- a/flake.lock
+++ b/flake.lock
--- a/flake.nix
+++ b/flake.nix
@ -2,36 +2,105 @@
  description = "cy's flake";

  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    sops-nix.url = "github:Mic92/sops-nix";
-    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-    home-manager.url = "github:nix-community/home-manager";
-    home-manager.inputs.nixpkgs.follows = "nixpkgs";
-    lanzaboote.url = "github:nix-community/lanzaboote/master";
-    lanzaboote.inputs.nixpkgs.follows = "nixpkgs";
-    rust-overlay.url = "github:oxalica/rust-overlay";
-    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
-    nix-ld.url = "github:nix-community/nix-ld";
-    nix-ld.inputs.nixpkgs.follows = "nixpkgs";
-    nil.url = "github:oxalica/nil";
-    nil.inputs.nixpkgs.follows = "nixpkgs";
-    vscode-extensions.url = "github:nix-community/nix-vscode-extensions/";
-    vscode-extensions.inputs.nixpkgs.follows = "nixpkgs";
-    nix-index-database.url = "github:nix-community/nix-index-database";
-    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
-    garage.url = "github:deuxfleurs-org/garage";
-    garage.inputs.nixpkgs.follows = "nixpkgs";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable-small";
+    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11";
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    home-manager = {
+      url = "github:nix-community/home-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    treefmt = {
+      url = "github:numtide/treefmt-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    lanzaboote = {
+      url = "github:nix-community/lanzaboote/master";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.crane.follows = "crane";
+      inputs.flake-compat.follows = "flake-compat";
+      inputs.flake-parts.follows = "flake-parts";
+      inputs.rust-overlay.follows = "rust-overlay";
+    };
+    nixvim = {
+      url = "github:nix-community/nixvim";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-parts.follows = "flake-parts";
+    };
+    flake-parts = {
+      url = "github:hercules-ci/flake-parts";
+      inputs.nixpkgs-lib.follows = "nixpkgs";
+    };
+    rust-overlay = {
+      url = "github:oxalica/rust-overlay";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    conduwuit = {
+      url = "github:girlbossceo/conduwuit";
+      inputs = {
+        nixpkgs.follows = "nixpkgs";
+        crane.follows = "crane";
+        flake-compat.follows = "flake-compat";
+        flake-utils.follows = "flake-utils";
+      };
+    };
+    lix-module = {
+      url = "git+https://git.lix.systems/lix-project/nixos-module";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-utils.follows = "flake-utils";
+      inputs.lix.follows = "lix";
+    };
+    lix = {
+      url = "git+https://git.lix.systems/lix-project/lix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-compat.follows = "flake-compat";
+    };
+    nix-ld = {
+      url = "github:nix-community/nix-ld";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    nil = {
+      url = "github:oxalica/nil";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.rust-overlay.follows = "rust-overlay";
+      inputs.flake-utils.follows = "flake-utils";
+    };
+    vscode-extensions = {
+      url = "github:nix-community/nix-vscode-extensions/";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-utils.follows = "flake-utils";
+    };
+    nix-index-database = {
+      url = "github:nix-community/nix-index-database";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    pixelflasher.url = "github:cything/nixpkgs/pixelflasher";
+
+    nvim-github-theme = {
+      url = "github:projekt0n/github-nvim-theme";
+      flake = false;
+    };
+
+    # deduplication
+    flake-utils.url = "github:numtide/flake-utils";
+    crane.url = "github:ipetkov/crane";
+    flake-compat.url = "github:edolstra/flake-compat";
  };

  nixConfig = {
    extra-substituters = [
      "https://nix-community.cachix.org"
-      "https://nixcache.cy7.sh"
+      "https://cache.garnix.io"
+      "https://cything.cachix.org"
    ];
    extra-trusted-public-keys = [
      "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-      "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8="
+      "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+      "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
    ];
+    builders-use-substitutes = true;
  };

  outputs =
@ -39,70 +108,109 @@
      self,
      nixpkgs,
      home-manager,
+      flake-parts,
      ...
    }@inputs:
-      let
-        pkgs = import nixpkgs {
-          config.allowUnfree = true;
-          system = "x86_64-linux";
-          overlays = [
-            inputs.rust-overlay.overlays.default
-            inputs.vscode-extensions.overlays.default
-          ] ++ (import ./overlay { inherit inputs; });
-        };
-      in
+    flake-parts.lib.mkFlake { inherit inputs; } (
+      { ... }:
      {
-        nixosConfigurations =
-          let
-            lib = nixpkgs.lib;
-          in
+        imports = [
+          inputs.treefmt.flakeModule
+        ];
+        debug = true;
+        systems = [
+          "x86_64-linux"
+        ];
+        perSystem =
          {
-            ytnix = lib.nixosSystem {
-              specialArgs = { inherit inputs; };
-              modules = [
-                {
-                  nixpkgs = { inherit pkgs; };
-                }
-                ./hosts/ytnix
-                ./modules
-                inputs.sops-nix.nixosModules.sops
-                inputs.lanzaboote.nixosModules.lanzaboote
-                inputs.nix-ld.nixosModules.nix-ld
-              ];
-            };
-            chunk = lib.nixosSystem {
-              specialArgs = { inherit inputs; };
-              modules = [
-                {
-                  nixpkgs = { inherit pkgs; };
-                }
-                ./hosts/chunk
-                ./modules
-                inputs.sops-nix.nixosModules.sops
-              ];
-            };
-          };
-        homeConfigurations =
-          let
-            lib = home-manager.lib;
-          in
+            inputs',
+            ...
+          }:
          {
-            "yt@ytnix" = lib.homeManagerConfiguration {
-              inherit pkgs;
-              extraSpecialArgs = { inherit inputs; };
-              modules = [
-                ./home/yt/ytnix.nix
-                inputs.nix-index-database.hmModules.nix-index
-              ];
-            };
+            treefmt = {
+              projectRootFile = "flake.nix";
+              programs.nixfmt.enable = true;
+              programs.stylua.enable = true;
+              programs.yamlfmt.enable = true;
+              programs.typos.enable = true;
+              programs.shellcheck.enable = true;

-            "yt@chunk" = lib.homeManagerConfiguration {
-              inherit pkgs;
-              extraSpecialArgs = { inherit inputs; };
-              modules = [
-                ./home/yt/chunk.nix
+              settings.global.excludes = [
+                "secrets/*"
+                "**/*.png" # tries to format a png file
              ];
            };
          };
-      };
+
+        flake =
+          let
+            pkgs = import nixpkgs {
+              config.allowUnfree = true;
+              system = "x86_64-linux";
+              overlays = [
+                inputs.rust-overlay.overlays.default
+                inputs.vscode-extensions.overlays.default
+              ] ++ (import ./overlay { inherit inputs; });
+            };
+          in
+          {
+            nixosConfigurations =
+              let
+                lib = nixpkgs.lib;
+              in
+              {
+                ytnix = lib.nixosSystem {
+                  specialArgs = { inherit inputs; };
+                  modules = [
+                    {
+                      nixpkgs = { inherit pkgs; };
+                    }
+                    ./hosts/ytnix
+                    ./modules
+                    inputs.sops-nix.nixosModules.sops
+                    inputs.lanzaboote.nixosModules.lanzaboote
+                    inputs.lix-module.nixosModules.default
+                    inputs.nix-ld.nixosModules.nix-ld
+                  ];
+                };
+                chunk = lib.nixosSystem {
+                  specialArgs = { inherit inputs; };
+                  modules = [
+                    {
+                      nixpkgs = { inherit pkgs; };
+                    }
+                    ./hosts/chunk
+                    ./modules
+                    inputs.sops-nix.nixosModules.sops
+                    inputs.lix-module.nixosModules.default
+                  ];
+                };
+              };
+            homeConfigurations =
+              let
+                lib = home-manager.lib;
+              in
+              {
+                "yt@ytnix" = lib.homeManagerConfiguration {
+                  inherit pkgs;
+                  extraSpecialArgs = { inherit inputs; };
+                  modules = [
+                    ./home/yt/ytnix.nix
+                    inputs.nixvim.homeManagerModules.nixvim
+                    inputs.nix-index-database.hmModules.nix-index
+                  ];
+                };
+
+                "yt@chunk" = lib.homeManagerConfiguration {
+                  inherit pkgs;
+                  extraSpecialArgs = { inherit inputs; };
+                  modules = [
+                    ./home/yt/chunk.nix
+                    inputs.nixvim.homeManagerModules.nixvim
+                  ];
+                };
+              };
+          };
+      }
+    );
 }
--- a/garnix.yaml
+++ b/garnix.yaml
@ -0,0 +1,6 @@
+builds:
+  include:
+    - 'nixosConfigurations.*'
+    - 'homeConfigurations.*'
+    - '*.aarch64-linux.*'
+    - '*.x86_64-linux.*'
--- a/home/codium.nix
+++ b/home/codium.nix
@ -1,4 +1,4 @@
-{ pkgs, lib, ... }:
+{ pkgs, ... }:
 {
  programs.vscode = {
    enable = true;
@ -10,7 +10,8 @@
      extensions =
        # if unfree
        # with pkgs.vscode-marketplace;
-        with pkgs.open-vsx; [
+        with pkgs.open-vsx;
+        [
          vscodevim.vim
          jnoortheen.nix-ide
          github.github-vscode-theme
@ -20,14 +21,10 @@
          tomrijndorp.find-it-faster
          streetsidesoftware.code-spell-checker
          emilast.logfilehighlighter
-          tamasfe.even-better-toml
-          golang.go
-          ms-python.python
        ];
      userSettings =
        let
          vimCommonKeyBindings = [
-            # nice emacs bindings
            {
              "before" = [ "C-a" ];
              "commands" = [ "cursorHome" ];
@ -36,19 +33,6 @@
              "before" = [ "C-e" ];
              "commands" = [ "cursorEnd" ];
            }
-            {
-              "before" = [ "C-b" ];
-              "commands" = [ "cursorLeft" ];
-            }
-            {
-              "before" = [ "C-f" ];
-              "commands" = [ "cursorRight" ];
-            }
-            # ctrl+h to turn off search highlighting
-            {
-              "before" = [ "C-h" ];
-              "commands" = [ ":nohl" ];
-            }
          ];
        in
        {
@ -73,7 +57,6 @@
          "telemetry.enableTelemetry" = false;
          "telemetry.telemetryLevel" = "off";
          "window.titleBarStyle" = "custom";
-          "editor.formatOnSave" = true;

          # terminal stuff
          "terminal.integrated.cursorBlinking" = true;
@ -89,7 +72,7 @@

          "markdown-preview-enhanced.previewTheme" = "github-dark.css";
          "nix.enableLanguageServer" = true;
-          "nix.serverPath" = "${lib.getExe pkgs.nil}";
+          "nix.serverPath" = "nil";
          "bookmarks.saveBookmarksInProject" = true;

          "cSpell.enabledFileTypes" = {
@ -99,15 +82,6 @@

          # vim stuff
          "vim.leader" = ",";
-          "extensions.experimental.affinity" = {
-            "vscodevim.vim" = 1;
-          };
-          "vim.sneak" = true;
-          "vim.sneakUseIgnorecaseAndSmartcase" = true;
-          "vim.enableNeovim" = true;
-          "vim.hlsearch" = true;
-          "vim.easymotion" = true;
-          "editor.lineNumbers" = "relative";
          "vim.normalModeKeyBindings" = vimCommonKeyBindings ++ [
            {
              "before" = [ ";" ];
@ -142,13 +116,6 @@
              ];
              "commands" = [ "workbench.action.toggleSidebarVisibility" ];
            }
-            {
-              "before" = [
-                "<space>"
-                "s"
-              ];
-              "commands" = [ "workbench.action.toggleSidebarVisibility" ];
-            }
            {
              "before" = [
                "<leader>"
@ -222,33 +189,10 @@
              "commands" = [ "editor.action.outdentLines" ];
            }
          ];
+          "extensions.experimental.affinity" = {
+            "vscodevim.vim" = 1;
+          };
        };
-      keybindings = [
-        # repeat these vim bindings here cause otherwise they get overridden by vscode
-        {
-          "key" = "ctrl+b";
-          "when" = "inputFocus";
-          "command" = "cursorLeft";
-        }
-        {
-          "key" = "ctrl+f";
-          "when" = "inputFocus";
-          "command" = "cursorRight";
-        }
-        # clear default bindings that conflict
-        {
-          "key" = "ctrl+f";
-          "command" = "-actions.find";
-        }
-        {
-          "key" = "ctrl+b";
-          "command" = "-workbench.action.toggleSidebarVisibility";
-        }
-        {
-          "key" = "ctrl+w";
-          "command" = "-workbench.action.closeActiveEditor";
-        }
-      ];
    };
  };
 }
--- a/home/kitty.nix
+++ b/home/kitty.nix
@ -7,6 +7,7 @@
      package = pkgs.ibm-plex;
      size = 12;
    };
+    themeFile = "GitHub_Dark";
    settings = {
      enable_audio_bell = true;
      # how many windows should be open before kitty asks
@ -16,11 +17,10 @@

      # will probably lower this later but the max allowed is actually 4GB
      # this is NOT stored in memory and can only be viewed with scrollback_pager
-      "scrollback_pager_history_size" = "10"; # in MB
+      "scrollback_pager_history_size" = "1024";
      # see https://github.com/sharkdp/bat/issues/1077#issuecomment-652785399
      "scrollback_pager" = "bat --pager='less -FR +G'";
-      # "scrollback_lines" = 20000;
-      wheel_scroll_multiplier = 50;
+      "scrollback_lines" = 20000;
    };
    keybindings = {
      # kitty_mod is ctrl+shift by default
@ -58,29 +58,18 @@
      "kitty_mod+alt+p" = "move_tab_backward";
      "kitty_mod+q" = "close_tab";
      "kitty_mod+t" = "new_tab_with_cwd";
+      "ctrl+f2" = "detach_tab";

      # hints
      # > basically means the preceding key is a prefix (think tmux)
      "kitty_mod+o>o" = "open_url_with_hints";
-      # `--program @` means copy to clipboard
-      "kitty_mod+o>u" = "kitten hints --type url --program @";
-      "kitty_mod+o>p" = "kitten hints --type path --program @";
-      "kitty_mod+o>n" = "kitten hints --type line --program @";
-      "kitty_mod+o>w" = "kitten hints --type word --program @";
-      "kitty_mod+o>h" = "kitten hints --type hash --program @";
+      "kitty_mod+o>p" = "kitten hints --type path --program -";
+      "kitty_mod+o>n" = "kitten hints --type line --program -";
+      "kitty_mod+o>w" = "kitten hints --type word --program -";
+      "kitty_mod+o>h" = "kitten hints --type hash --program -";
      "kitty_mod+o>l" = "kitten hints --type linenum";
-
-      # scrolling
-      "kitty_mod+u" = "scroll_page_up";
-      "kitty_mod+d" = "scroll_page_down";
-      "kitty_mod+a" = "scroll_home";
-      "kitty_mod+e" = "scroll_end";
-      "kitty_mod+z" = "scroll_to_prompt -1"; # scroll to previous shell prompt
-      "kitty_mod+x" = "scroll_to_prompt 1"; # scroll to next shell prompt
-      "kitty_mod+y" = "show_scrollback"; # browse scrollback buffer in pager
-      "kitty_mod+g" = "show_last_command_output"; # browse output of last command in pager
    };
  };

-  programs.zsh.shellAliases."ssh" = "kitten ssh";
+  # programs.zsh.shellAliases."ssh" = "kitten ssh"; # doesn't seem to work with bitwarden ssh agent :(
 }
--- a/home/nixvim/default.nix
+++ b/home/nixvim/default.nix
@ -0,0 +1,256 @@
+{ pkgs, inputs, ... }:
+{
+  programs.nixvim = {
+    enable = true;
+    plugins.lualine.enable = true;
+    opts = {
+      number = true;
+      relativenumber = true;
+      expandtab = true;
+      autoindent = true;
+      shiftwidth = 2;
+      smartindent = true;
+      tabstop = 2;
+      ignorecase = true;
+      incsearch = true;
+      smartcase = true;
+    };
+    colorscheme = "github_dark_tritanopia";
+    clipboard.register = "unnamed";
+
+    globals = {
+      mapleader = ",";
+    };
+
+    extraPlugins = [
+      (pkgs.vimUtils.buildVimPlugin {
+        name = "github-theme";
+        src = inputs.nvim-github-theme;
+      })
+    ];
+
+    keymaps = [
+      {
+        action = "<cmd>Neotree toggle<CR>";
+        key = "<space>s";
+        mode = "n";
+        options.silent = true;
+      }
+      {
+        # shortcut to command mode
+        action = ":";
+        key = ";";
+        mode = [
+          "n"
+          "x"
+        ];
+        options.silent = true;
+      }
+      {
+        # insert line below without moving cursor
+        action = "printf('m`%so<ESC>``', v:count1)";
+        key = "<space>o";
+        options.expr = true;
+        mode = "n";
+      }
+      {
+        # insert line above without moving cursor
+        action = "printf('m`%sO<ESC>``', v:count1)";
+        key = "<space>O";
+        options.expr = true;
+        mode = "n";
+      }
+      # nice emacs bindings
+      {
+        action = "<HOME>";
+        key = "<C-a>";
+        mode = "i";
+      }
+      {
+        action = "<END>";
+        key = "<C-e>";
+        mode = "i";
+      }
+      # quick chat with copilot
+      {
+        key = "<leader>ccq";
+        action.__raw = ''
+          function()
+            local input = vim.fn.input("Quick chat: ")
+            if input ~= "" then
+              require("CopilotChat").ask(input, { selection = require("CopilotChat.select").buffer })
+            end
+          end
+        '';
+        mode = [
+          "n"
+          "v"
+        ];
+      }
+      # ask perplexity a quick question
+      {
+        key = "<leader>ccs";
+        action.__raw = ''
+          function()
+            local input = vim.fn.input("Perplexity: ")
+            if input ~= "" then
+              require("CopilotChat").ask(input, {
+                agent = "perplexityai",
+                selection = false,
+              })
+            end
+          end
+        '';
+        mode = [
+          "n"
+          "v"
+        ];
+      }
+    ];
+
+    plugins.cmp = {
+      enable = true;
+      settings = {
+        formatting.fields = [
+          "abbr"
+          "kind"
+          "menu"
+        ];
+        experimental = {
+          ghost_text = true;
+        };
+        snippet.expand = ''
+          function(args) require('luasnip').lsp_expand(args.body) end
+        '';
+        sources = [
+          { name = "nvim_lsp"; }
+          { name = "emoji"; }
+          { name = "luasnip"; }
+          { name = "buffer"; }
+          { name = "path"; }
+        ];
+        mapping = {
+          "<C-h>" = "cmp.mapping.abort()";
+          "<C-n>" = "cmp.mapping.select_next_item()";
+          "<C-p>" = "cmp.mapping.select_prev_item()";
+          "<C-u>" = "cmp.mapping.scroll_docs(-4)";
+          "<C-d>" = "cmp.mapping.scroll_docs(4)";
+          "<C-k>" = ''
+            cmp.mapping(function(fallback)
+              if cmp.visible() then
+                if require("luasnip").expandable() then
+                  require("luasnip").expand()
+                else
+                  cmp.confirm({
+                    select = true,
+                  })
+                end
+              else
+                fallback()
+              end
+            end)
+          '';
+          # plain tab conflicts with i try to indent
+          "<C-Tab>" = ''
+            cmp.mapping(function(fallback)
+              if require("luasnip").jumpable(1) then
+                require("luasnip").jump(1)
+              else
+                fallback()
+              end
+            end,{"i","s"})
+          '';
+          "<S-Tab>" = ''
+            cmp.mapping(function(fallback)
+              if require("luasnip").jumpable(-1) then
+                require("luasnip").jump(-1)
+              else
+                fallback()
+              end
+            end,{"i","s"})
+          '';
+        };
+      };
+    };
+
+    plugins.lsp = {
+      enable = true;
+      keymaps.lspBuf = {
+        "K" = "hover";
+        "gd" = "definition";
+        "gD" = "references";
+        # "gt" = "type_definition"; # conflicts with switch tab
+        "gI" = "type_definition";
+        "gi" = "implementation";
+      };
+      servers = {
+        bashls.enable = true;
+        lua_ls.enable = true;
+        nil_ls = {
+          enable = true;
+          settings = {
+            formatting.command = [
+              "nix"
+              "fmt"
+            ];
+            nix.flake.autoArchive = true;
+          };
+        };
+        rust_analyzer = {
+          enable = true;
+          installRustc = true;
+          installCargo = true;
+        };
+        eslint.enable = true;
+      };
+    };
+    plugins.treesitter = {
+      enable = true;
+      nixGrammars = true;
+      settings = {
+        indent.enable = true;
+        auto_install = true;
+        highlight.enable = true;
+      };
+    };
+    plugins.fzf-lua = {
+      enable = true;
+      profile = "fzf-native";
+      keymaps = {
+        "<leader>ff" = "files";
+        "<leader>fg" = "live_grep";
+      };
+    };
+
+    plugins.neo-tree = {
+      enable = true;
+      buffers.followCurrentFile.enabled = true;
+      window.width = 30;
+    };
+
+    plugins.gitsigns = {
+      enable = true;
+      settings.current_line_blame = true;
+    };
+
+    plugins.copilot-chat = {
+      enable = true;
+      settings = {
+        model = "claude-3.5-sonnet";
+      };
+    };
+
+    plugins.cmp-buffer.enable = true;
+    plugins.cmp-emoji.enable = true;
+    plugins.cmp-nvim-lsp.enable = true;
+    plugins.cmp-path.enable = true;
+    plugins.cmp_luasnip.enable = true;
+    plugins.luasnip.enable = true;
+    plugins.nvim-autopairs.enable = true;
+    plugins.rainbow-delimiters.enable = true;
+    plugins.web-devicons.enable = true;
+    plugins.auto-save.enable = true;
+    plugins.indent-blankline.enable = true;
+    plugins.undotree.enable = true;
+  };
+}
--- a/home/yt/chunk.nix
+++ b/home/yt/chunk.nix
@ -14,4 +14,8 @@
  programs.home-manager.enable = true;

  systemd.user.startServices = "sd-switch";
+
+  home.packages = with pkgs; [
+    attic-server
+  ];
 }
--- a/home/yt/common.nix
+++ b/home/yt/common.nix
@ -3,6 +3,7 @@
  imports = [
    ../tmux.nix
    ../zsh
+    ../nixvim
  ];

  home.sessionVariables = {
--- a/home/yt/ytnix.nix
+++ b/home/yt/ytnix.nix
@ -60,6 +60,7 @@
      unzip
      anki-bin
      trezorctl
+      trezor-agent
      q
      gdb
      fuzzel
@ -76,6 +77,7 @@
      ))
      p7zip
      qbittorrent
+      nil
      android-tools
      frida-tools
      mitmproxy
@ -98,13 +100,8 @@
      nix-output-monitor
      wl-clipboard-rs
      pixelflasher
-      cinny-desktop
+      element-desktop
      freetube
-      gopls
-      rust-analyzer
-      minio-client
-      nil
-      keepassxc
    ];

  home.sessionVariables = {
@ -115,15 +112,18 @@
    RUSTC_WRAPPER = "${lib.getExe pkgs.sccache}";
    SCCACHE_BUCKET = "sccache";
    SCCACHE_REGION = "us-east-1";
-    SCCACHE_ENDPOINT = "https://s3.cy7.sh";
+    SCCACHE_ENDPOINT = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
    SCCACHE_ALLOW_CORE_DUMPS = "true";
    SCCACHE_S3_USE_SSL = "true";
    SCCACHE_CACHE_MULTIARCH = "true";
    SCCACHE_LOG = "warn";
    AWS_DEFAULT_REGION = "us-east-1";
-    AWS_ENDPOINT_URL = "https://s3.cy7.sh";
+    AWS_ENDPOINT_URL = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
    AWS_ACCESS_KEY_ID = "$(cat /run/secrets/aws/key_id)";
    AWS_SECRET_ACCESS_KEY = "$(cat /run/secrets/aws/key_secret)";
+
+    # bitwarden ssh agent
+    SSH_AUTH_SOCK = "$HOME/.bitwarden-ssh-agent.sock";
  };

  home.sessionPath = [
@ -151,17 +151,4 @@
  };

  programs.nix-index-database.comma.enable = true;
-
-  programs.neovim = {
-    enable = true;
-    viAlias = true;
-    vimAlias = true;
-  };
-
-  programs.ssh = {
-    enable = true;
-    addKeysToAgent = "yes";
-  };
-
-  programs.firefox.enable = true;
 }
--- a/home/zsh/default.nix
+++ b/home/zsh/default.nix
@ -92,7 +92,7 @@
      "s" = "sudo";
      "nrs" = "sudo nixos-rebuild switch -L --flake . --log-format internal-json -v |& nom --json";
      "nrt" = "sudo nixos-rebuild test -L --flake . --log-format internal-json -v |& nom --json";
-      "hrs" = "home-manager switch -L --flake .";
+      "hrs" = "home-manager switch -L --flake . |& nom --json";
      "g" = "git";
      "ga" = "git add";
      "gaa" = "git add --all";
--- a/hosts/chunk/conduwuit.nix
+++ b/hosts/chunk/conduwuit.nix
@ -0,0 +1,33 @@
+{ ... }:
+{
+  services.conduwuit = {
+    enable = true;
+    settings.global = {
+      port = [ 8448 ];
+      server_name = "cything.io";
+      allow_check_for_updates = true;
+    };
+  };
+
+  services.caddy.virtualHosts."chat.cything.io".extraConfig = ''
+    import common
+    reverse_proxy localhost:8448
+  '';
+
+  services.caddy.virtualHosts."cything.io" = {
+    serverAliases = [ "www.cything.io" ];
+    extraConfig = ''
+      import common
+
+      header /.well-known/matrix/* Content-Type application/json
+      header /.well-known/matrix/* Access-Control-Allow-Origin *
+      header /.well-known/matrix/* Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH,HEAD
+      header /.well-known/matrix/* Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization,Origin,Accept
+      route {
+        respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
+        respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
+        redir https://cy7.sh/posts{uri} permanent
+      }
+    '';
+  };
+}
--- a/hosts/chunk/default.nix
+++ b/hosts/chunk/default.nix
@ -16,10 +16,13 @@
    ./redlib.nix
    ./vaultwarden.nix
    ./grafana.nix
+    ./conduwuit.nix
    ./immich.nix
+    ./element.nix
    ./forgejo.nix
    ./garage.nix
    ./tailscale.nix
+    ./tor.nix
  ];

  sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@ -45,14 +48,20 @@
    "rsyncnet/id_ed25519" = {
      sopsFile = ../../secrets/zh5061/chunk.yaml;
    };
+    "attic/env" = {
+      sopsFile = ../../secrets/services/attic.yaml;
+    };
    "garage/env" = {
      sopsFile = ../../secrets/services/garage.yaml;
    };
    "tailscale/auth" = {
      sopsFile = ../../secrets/services/tailscale.yaml;
    };
-    "karakeep/env" = {
-      sopsFile = ../../secrets/services/karakeep.yaml;
+    "zipline/env" = {
+      sopsFile = ../../secrets/services/zipline.yaml;
+    };
+    "searx/env" = {
+      sopsFile = ../../secrets/services/searx.yaml;
    };
  };

@ -92,18 +101,22 @@
          ${tc} qdisc del dev ens18 root || true

          # create HTB hierarchy
-          ${tc} qdisc add dev ens18 root handle 1: htb default 10
+          ${tc} qdisc add dev ens18 root handle 1: htb default 30
          ${tc} class add dev ens18 parent 1: classid 1:1 htb rate 100% ceil 100%
-          # rest
-          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 60% ceil 100%
+          # tailscale
+          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 30% ceil 100%
          # caddy
+          ${tc} class add dev ens18 parent 1:1 classid 1:20 htb rate 30% ceil 100%
+          # rest
          ${tc} class add dev ens18 parent 1:1 classid 1:30 htb rate 40% ceil 100%

          # mark traffic
-          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 3
+          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/tailscaled.service" -j MARK --set-mark 1
+          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 2

          # route marked packets
-          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 3 fw flowid 1:30
+          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 1 fw flowid 1:10
+          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 2 fw flowid 1:20
        '';
    };
    interfaces.ens18 = {
@ -137,15 +150,13 @@
      "podman"
    ];
    openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
-      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD yt@ytnix"
    ];
  };
  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
-    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD yt@ytnix"
  ];
  # for forgejo
  users.users.git = {
@ -178,13 +189,15 @@
  security.sudo.enable = true;
  security.sudo.wheelNeedsPassword = false;

+  programs.gnupg.agent.enable = true;
  programs.git.enable = true;

  my.caddy.enable = true;
+
+  # container stuff
  my.containerization.enable = true;
-  my.authelia.enable = true;
-  my.karakeep = {
-    enable = false;
-    dataDir = "/opt/karakeep";
-  };
+
+  my.roundcube.enable = true;
+  my.zipline.enable = true;
+  my.searx.enable = true;
 }
--- a/hosts/chunk/element.nix
+++ b/hosts/chunk/element.nix
@ -0,0 +1,33 @@
+{
+  pkgs,
+  config,
+  ...
+}:
+{
+  virtualisation.oci-containers.containers.element = {
+    image = "vectorim/element-web";
+    autoStart = true;
+    ports = [ "127.0.0.1:8089:8089" ];
+    pull = "newer";
+    networks = [ "element-net" ];
+    environment = {
+      ELEMENT_WEB_PORT = "8089";
+    };
+  };
+
+  systemd.services.create-element-net = {
+    serviceConfig.Type = "oneshot";
+    wantedBy = with config.virtualisation.oci-containers; [
+      "${backend}-element.service"
+    ];
+    script = ''
+      ${pkgs.podman}/bin/podman network exists element-net || \
+      ${pkgs.podman}/bin/podman network create element-net
+    '';
+  };
+
+  services.caddy.virtualHosts."element.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8089
+  '';
+}
--- a/hosts/chunk/garage.nix
+++ b/hosts/chunk/garage.nix
@ -12,20 +12,15 @@
      };
      s3_web = {
        bind_addr = "[::]:3902";
-        root_domain = ".web.cy7.sh";
-        add_host_to_metrics = true;
+        root_domain = ".web.s3.cy7.sh";
+        index = "index.html";
      };
      admin.api_bind_addr = "[::]:3903";
      rpc_bind_addr = "[::]:3901";
-      rpc_public_addr = "100.122.132.30:3901";
      replication_factor = 1;
      db_engine = "lmdb";
-      disable_scrub = true;
-      block_size = "128M";
-      compression_level = "none";
    };
    environmentFile = config.sops.secrets."garage/env".path;
-    logLevel = "warn";
  };

  services.caddy.virtualHosts = {
@ -36,24 +31,13 @@
        reverse_proxy localhost:3900
      '';
    };
+    "*.web.s3.cy7.sh".extraConfig = ''
+      import common
+      reverse_proxy localhost:3902
+    '';
    "admin.s3.cy7.sh".extraConfig = ''
      import common
      reverse_proxy localhost:3903
    '';
-    "*.web.cy7.sh" = {
-      serverAliases = [ "nixcache.cy7.sh" "staging.cy7.sh" ];
-      extraConfig = ''
-        import common
-        @plain {
-          host nixcache.cy7.sh nixcache.web.cy7.sh
-          path / /nix-cache-info
-        }
-        header @plain {
-          >content-type text/plain
-        }
-
-        reverse_proxy localhost:3902
-      '';
-    };
  };
 }
--- a/hosts/chunk/grafana.nix
+++ b/hosts/chunk/grafana.nix
@ -29,20 +29,11 @@
          }
        ];
      }
-      {
-        job_name = "garage";
-        static_configs = [
-          {
-            targets = [ "127.0.0.1:3903" ];
-          }
-        ];
-      }
    ];
  };

  services.caddy.virtualHosts."grafana.cy7.sh".extraConfig = ''
    import common
-    import authelia
    reverse_proxy localhost:8088
  '';
 }
--- a/hosts/chunk/hedgedoc.nix
+++ b/hosts/chunk/hedgedoc.nix
@ -11,7 +11,7 @@
        dialect = "postgresql";
      };
      port = 8085;
-      domain = "pad.cy7.sh";
+      domain = "pad.cything.io";
      allowEmailRegister = false;
      protocolUseSSL = true;
    };
--- a/hosts/chunk/immich.nix
+++ b/hosts/chunk/immich.nix
@ -6,10 +6,9 @@
 }:
 let
  uploadLocation = "/mnt/photos/immich";
-  # thumbsLocation = "/opt/immich/thumbs";
+  thumbsLocation = "/opt/immich/thumbs";
  profileLocation = "/opt/immich/profile";
  dbDataLocation = "/opt/immich/postgres";
-  backupsLocation = "/opt/immich/backups";
 in
 {
  virtualisation.oci-containers.containers = {
@ -20,9 +19,8 @@ in
      pull = "newer";
      volumes = [
        "${uploadLocation}:/usr/src/app/upload"
-        # "${thumbsLocation}:/usr/src/app/upload/thumbs"
+        "${thumbsLocation}:/usr/src/app/upload/thumbs"
        "${profileLocation}:/usr/src/app/upload/profile"
-        "${backupsLocation}:/usr/src/app/upload/backups"
      ];
      environment = {
        REDIS_HOSTNAME = "immich-redis";
--- a/hosts/chunk/miniflux.nix
+++ b/hosts/chunk/miniflux.nix
@ -12,7 +12,6 @@

  services.caddy.virtualHosts."rss.cy7.sh".extraConfig = ''
    import common
-    import authelia
    reverse_proxy localhost:8080
  '';
 }
--- a/hosts/chunk/rclone.nix
+++ b/hosts/chunk/rclone.nix
@ -4,34 +4,6 @@
  lib,
  ...
 }:
-let
-  mkServiceConfig = remote: mount: {
-    Type = "notify";
-    TimeoutSec = "5min 20s";
-    ExecStartPre = "/usr/bin/env mkdir -p ${mount}";
-    ExecStart = ''
-      ${lib.getExe pkgs.rclone} mount \
-        --config ${config.sops.secrets."rclone/config".path} \
-        --allow-other \
-        --cache-dir /var/cache/rclone \
-        --transfers 64 \
-        --vfs-cache-mode full \
-        --vfs-cache-min-free-space 5G \
-        --dir-cache-time 30d \
-        --no-checksum \
-        --no-modtime \
-        --vfs-fast-fingerprint \
-        --vfs-read-chunk-size 8M \
-        --vfs-read-chunk-streams 16 \
-        --sftp-concurrency 128 \
-        --sftp-chunk-size 255k \
-        --buffer-size 0 \
-        --write-back-cache \
-        ${remote} ${mount}
-    '';
-    ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -zu ${mount}";
-  };
-in
 {
  systemd.services.immich-mount = {
    enable = true;
@ -40,7 +12,31 @@ in
    after = [ "network-online.target" ];
    requiredBy = [ "podman-immich-server.service" ];
    before = [ "podman-immich-server.service" ];
-    serviceConfig = mkServiceConfig "photos:" "/mnt/photos";
+    serviceConfig = {
+      Type = "notify";
+      ExecStartPre = "/usr/bin/env mkdir -p /mnt/photos";
+      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
+        config.sops.secrets."rclone/config".path
+      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --dir-cache-time 72h --vfs-cache-mode writes --vfs-cache-max-size 2G photos: /mnt/photos ";
+      ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/photos";
+    };
+  };
+
+  systemd.services.attic-mount = {
+    enable = true;
+    description = "Mount the attic data remote";
+    requires = [ "network-online.target" ];
+    after = [ "network-online.target" ];
+    requiredBy = [ "atticd.service" ];
+    before = [ "atticd.service" ];
+    serviceConfig = {
+      Type = "notify";
+      ExecStartPre = "/usr/bin/env mkdir -p /mnt/attic";
+      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
+        config.sops.secrets."rclone/config".path
+      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 2G --allow-other rsyncnet:attic /mnt/attic ";
+      ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/attic";
+    };
  };

  systemd.services.garage-mount = {
@ -50,6 +46,13 @@ in
    after = [ "network-online.target" ];
    requiredBy = [ "garage.service" ];
    before = [ "garage.service" ];
-    serviceConfig = mkServiceConfig "rsyncnet:garage" "/mnt/garage";
+    serviceConfig = {
+      Type = "notify";
+      ExecStartPre = "/usr/bin/env mkdir -p /mnt/garage";
+      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
+        config.sops.secrets."rclone/config".path
+      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 5G --allow-other rsyncnet:garage /mnt/garage ";
+      ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/garage";
+    };
  };
 }
--- a/hosts/chunk/redlib.nix
+++ b/hosts/chunk/redlib.nix
@ -13,7 +13,6 @@

  services.caddy.virtualHosts."red.cy7.sh".extraConfig = ''
    import common
-    import authelia
    reverse_proxy localhost:8087
  '';
 }
--- a/hosts/chunk/tor.nix
+++ b/hosts/chunk/tor.nix
@ -0,0 +1,16 @@
+{ ... }:
+{
+  services.tor = {
+    enable = true;
+    openFirewall = true;
+    relay = {
+      enable = true;
+      role = "relay";
+    };
+    settings = {
+      ORPort = 9001;
+      Nickname = "chunk";
+      # MaxAdvertisedBandwidth = "20MBytes";
+    };
+  };
+}
--- a/hosts/common.nix
+++ b/hosts/common.nix
@ -1,7 +1,6 @@
-{ inputs, config, pkgs, ... }:
+{ inputs, ... }:
 {
  nix = {
-    package = pkgs.lix;
    settings = {
      experimental-features = "nix-command flakes";
      auto-optimise-store = true;
@ -10,16 +9,17 @@
        "root"
        "@wheel"
      ];
-      extra-trusted-public-keys = [
+      trusted-public-keys = [
+        "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8="
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+        "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
      ];
-      extra-substituters = [
+      substituters = [
+        "https://niri.cachix.org"
        "https://nix-community.cachix.org"
-        "https://nixcache.cy7.sh"
-      ];
-      secret-key-files = [
-        config.sops.secrets.cache-priv-key.path
+        "https://cache.garnix.io"
+        "https://cything.cachix.org"
      ];
    };
    channel.enable = false;
@ -33,6 +33,9 @@
      persistent = true;
      options = "--delete-older-than 14d";
    };
+    extraOptions = ''
+      builders-use-substitutes = true
+    '';
    registry.nixpkgs.flake = inputs.nixpkgs;
  };

@ -78,11 +81,4 @@

  services.thermald.enable = true;
  environment.enableAllTerminfo = true;
-
-  sops.secrets.cache-priv-key = {
-    format = "binary";
-    sopsFile = ../secrets/cache-priv-key.pem;
-    mode = "0440";
-    group = "users";
-  };
 }
--- a/hosts/ytnix/containers.nix
+++ b/hosts/ytnix/containers.nix
@ -6,22 +6,20 @@
 }:
 {
  virtualisation.oci-containers.containers = {
-    immich-ml =
-      let
-        modelCache = "/opt/immich-ml";
-      in
-      {
-        image = "ghcr.io/immich-app/immich-machine-learning:release";
-        autoStart = true;
-        pull = "newer";
-        ports = [ "3003:3003" ];
-        environment = {
-          REDIS_HOSTNAME = "immich-redis";
-          DB_HOSTNAME = "immich-db";
-        };
-        volumes = [ "${modelCache}:/cache" ];
-        networks = [ "immich-net" ];
+    immich-ml = let
+      modelCache = "/opt/immich-ml";
+    in {
+      image = "ghcr.io/immich-app/immich-machine-learning:release";
+      autoStart = true;
+      pull = "newer";
+      ports = [ "3003:3003" ];
+      environment = {
+        REDIS_HOSTNAME = "immich-redis";
+        DB_HOSTNAME = "immich-db";
      };
+      volumes = [ "${modelCache}:/cache" ];
+      networks = [ "immich-net" ];
+    };
  };

  systemd.services.create-immich-net = rec {
--- a/hosts/ytnix/default.nix
+++ b/hosts/ytnix/default.nix
@ -94,10 +94,8 @@
      #   3003 # immich-ml
      # ];
    };
-    hosts = {
-      "100.122.132.30" = [ "s3.cy7.sh" ];
-    };
  };
+  programs.nm-applet.enable = true;

  security.rtkit.enable = true;
  services.pipewire = {
@ -146,52 +144,49 @@
    "docker"
    "disk"
    "adbusers"
-    "podman"
  ];

-  environment.systemPackages =
-    with pkgs;
-    lib.flatten [
-      tmux
-      vim
-      wget
-      tree
-      kitty
-      borgbackup
-      htop
-      file
-      dnsutils
-      q
-      age
-      compsize
-      wireguard-tools
-      traceroute
-      sops
-      sbctl # secure boot
-      lm_sensors
-      sshfs
-      openssl
-      just
-      killall
-      lshw
-      bubblewrap
-      fuse-overlayfs
-      dwarfs
-      wineWowPackages.stagingFull
-      (with gst_all_1; [
-        gst-plugins-good
-        gst-plugins-bad
-        gst-plugins-ugly
-        gst-plugins-base
-      ])
-      vulkan-loader
-      (heroic.override {
-        extraPkgs = pkgs: [
-          pkgs.gamescope
-          pkgs.gamemode
-        ];
-      })
-    ];
+  environment.systemPackages = with pkgs; lib.flatten [
+    tmux
+    vim
+    wget
+    tree
+    kitty
+    borgbackup
+    htop
+    file
+    dnsutils
+    q
+    age
+    compsize
+    wireguard-tools
+    traceroute
+    sops
+    sbctl # secure boot
+    lm_sensors
+    sshfs
+    openssl
+    just
+    killall
+    lshw
+    bubblewrap
+    fuse-overlayfs
+    dwarfs
+    wineWowPackages.stagingFull
+    (with gst_all_1; [
+      gst-plugins-good
+      gst-plugins-bad
+      gst-plugins-ugly
+      gst-plugins-base
+    ])
+    vulkan-loader
+    (heroic.override {
+      extraPkgs = pkgs: [
+        pkgs.gamescope
+        pkgs.gamemode
+      ];
+    })
+  ];

  environment.sessionVariables = {
    NIXOS_OZONE_WL = "1";
@ -274,6 +269,7 @@
    enable = true;
    # nix run github:thiagokokada/nix-alien#nix-alien-find-libs ./<binary>
    libraries = with pkgs; [
+      # TODO: revisit what we actually need
      mesa
      extest
      stdenv.cc.cc
@ -328,8 +324,6 @@
      curl
      pcre2
      gsettings-desktop-schemas
-      fzf
-      systemd
    ];
  };
  programs.evolution.enable = true;
@ -390,7 +384,4 @@
  programs.ccache.enable = true;
  nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
  programs.fuse.userAllowOther = true;
-  nix.settings.sandbox = false;
-
-  programs.ssh.startAgent = true;
 }
--- a/4
+++ b/4
@ -1,7 +1,9 @@
 update:
    git branch -D update || true
    git switch -c update
-    nix flake update --commit-lock-file
+    nix flake update
+    git add flake.lock
+    git commit -s -m "flake update"
    git push -f
    git switch main

--- a/modules/attic.nix
+++ b/modules/attic.nix
@ -1,72 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.attic;
-in
-{
-  options.my.attic = {
-    enable = lib.mkEnableOption "attic";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.atticd = {
-      enable = true;
-      environmentFile = config.sops.secrets."attic/env".path;
-      settings = {
-        listen = "[::]:8091";
-        api-endpoint = "https://cache.cy7.sh/";
-        allowed-hosts = [
-          "cache.cy7.sh"
-          "cdn.cy7.sh"
-        ];
-        require-proof-of-possession = false;
-        compression = {
-          type = "none";
-          level = 3;
-        };
-        database.url = "postgresql:///atticd?host=/run/postgresql";
-
-        storage = {
-          type = "s3";
-          region = "us-east-1";
-          bucket = "attic";
-          # attic must be patched to never serve pre-signed s3 urls directly
-          # otherwise it will redirect clients to this localhost endpoint
-          endpoint = "http://127.0.0.1:3900";
-        };
-
-        garbage-collection = {
-          default-retention-period = "1 month";
-        };
-
-        chunking = {
-          # disable chunking since garage does its own
-          nar-size-threshold = 0;
-          # defaults
-          min-size = 16384;
-          avg-size = 65536;
-          max-size = 262144;
-        };
-      };
-    };
-
-    systemd.services.atticd = {
-      requires = [ "garage.service" ];
-      after = [ "garage.service" ];
-      environment = {
-        RUST_LOG = "INFO";
-      };
-    };
-
-    services.caddy.virtualHosts."cache.cy7.sh" = {
-      serverAliases = [ "cdn.cy7.sh" ];
-      extraConfig = ''
-        import common
-        reverse_proxy localhost:8091
-      '';
-    };
-  };
-}
--- a/modules/authelia.nix
+++ b/modules/authelia.nix
@ -1,137 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.authelia;
-  getSecret = path: config.sops.secrets.${path}.path;
-  sopsConfig = {
-    sopsFile = ../secrets/services/authelia.yaml;
-    owner = "authelia-main";
-  };
-  domain = "auth.cy7.sh";
-  varPath = "/var/lib/authelia-main";
-in
-{
-  options.my.authelia = {
-    enable = lib.mkEnableOption "authelia";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.authelia.instances.main = {
-      enable = true;
-      settings = {
-        theme = "dark";
-        default_2fa_method = "webauthn";
-        log.level = "info";
-        log.format = "text";
-        server = {
-          disable_healthcheck = true;
-          endpoints.authz.forward-auth.implementation = "ForwardAuth";
-        };
-        authentication_backend.file.path = "${varPath}/users_database.yaml";
-        access_control = {
-          default_policy = "deny";
-          rules = [
-            {
-              domain = "*.cy7.sh";
-              policy = "one_factor";
-            }
-          ];
-        };
-        session.cookies = [{
-          domain = "cy7.sh";
-          authelia_url = "https://${domain}";
-        }];
-        storage.local.path = "${varPath}/db.sqlite3";
-        notifier.filesystem.filename = "${varPath}/notifications.txt";
-        webauthn = {
-          enable_passkey_login = true;
-        };
-        identity_providers.oidc.claims_policies = {
-          # https://github.com/karakeep-app/karakeep/issues/410
-          # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
-          karakeep.id_token = [ "email" ];
-        };
-        identity_providers.oidc.clients = [
-          {
-            client_id = "4EIrpRb9rnwHWjYWvlz2gYrtTmoOLF1D5gqXw28BvmOS0f-9T2p4CFwuctf4Co1hkpo2sd4Y";
-            client_name = "immich";
-            client_secret = "$argon2id$v=19$m=65536,t=3,p=4$Vny2G8EbSPafSwnIuq2Zkg$eF2om4WDEaqCFmrAG27h2mYl+cXxXyttPJ7gaPLs+f8";
-            public = false;
-            authorization_policy = "two_factor";
-            redirect_uris = [
-              "https://photos.cy7.sh/auth/login"
-              "https://photos.cy7.sh/user-settings"
-              "app.immich:///oauth-callback"
-            ];
-            scopes = [ "openid" "profile" "email" ];
-            userinfo_signed_response_alg = "none";
-          }
-          {
-            client_id = "_kuUEYxyfXjInJCniwugpw2Qn6iI-YW24NOkHZG~63BAhnAACDZ.xsLqOdGghj2DNZxXR0sU";
-            client_name = "Forgejo";
-            client_secret = "$argon2id$v=19$m=65536,t=3,p=4$O2O5r/7A8hc4EMvernQ4Dw$YOVqtwY3jv0HlcxmviPq2CRnD7Dw85V9KDtTSUQE7bA";
-            public = false;
-            authorization_policy = "two_factor";
-            redirect_uris = [
-              "https://git.cy7.sh/user/oauth2/authelia/callback"
-            ];
-            scopes = [ "openid" "profile" "email" ];
-            userinfo_signed_response_alg = "none";
-            token_endpoint_auth_method = "client_secret_basic";
-          }
-          {
-            client_id = "b_ITCG0uNzy9lZ5nVC~Ny5R35te8I3hoQW1uraCbdxeiE9VuiCIelMmZZ7dAZLg_anTUWSQG";
-            client_name = "HedgeDoc";
-            client_secret = "$argon2id$v=19$m=65536,t=3,p=4$MFSXW3gjIZf0M3e8s8RJCg$6KWwksJe2vdUebPEdYc0Zy88fzGcHPrbStcqkiXl+Hg";
-            public = false;
-            authorization_policy = "two_factor";
-            redirect_uris = [
-              "https://pad.cy7.sh/auth/oauth2/callback"
-            ];
-            scopes = [ "openid" "profile" "email" ];
-            userinfo_signed_response_alg = "none";
-            grant_types = [ "refresh_token" "authorization_code" ];
-            response_types = [ "code" ];
-            response_modes = [ "form_post" "query" "fragment" ];
-            audience = [];
-            token_endpoint_auth_method = "client_secret_post";
-          }
-          {
-            client_id = "0SbsGvw5APYJ4px~dv38rCVgXtK2XWrF1QvyuaFz48cgsNm-rAXkSgNOctfxS21IWOFSfsm5";
-            client_name = "Karakeep";
-            client_secret = "$pbkdf2-sha512$310000$4UanDZq.6oholJW3CmKwtQ$9e3hqR8qGU4LoneR/Y9jtJTx0iSzATI4iXymrs8QrmGw4JY1BPF4.IJ9Jbc.8cikU4qpfUIFO6r2dG7JHznCnw";
-            public = false;
-            authorization_policy = "two_factor";
-            redirect_uris = [ "https://keep.cy7.sh/api/auth/callback/custom" ];
-            scopes = [ "openid" "profile" "email" ];
-            userinfo_signed_response_alg = "none";
-            claims_policy = "karakeep";
-          }
-        ];
-      };
-      secrets = {
-        sessionSecretFile = getSecret "authelia/session";
-        storageEncryptionKeyFile = getSecret "authelia/storage";
-        jwtSecretFile = getSecret "authelia/jwt";
-        oidcHmacSecretFile = getSecret "authelia/hmac";
-        oidcIssuerPrivateKeyFile = getSecret "authelia/oidc_private";
-      };
-    };
-
-    sops.secrets = {
-      "authelia/jwt" = sopsConfig;
-      "authelia/storage" = sopsConfig;
-      "authelia/session" = sopsConfig;
-      "authelia/hmac" = sopsConfig;
-      "authelia/oidc_private" = sopsConfig;
-    };
-
-    services.caddy.virtualHosts.${domain}.extraConfig = ''
-      import common
-      reverse_proxy localhost:9091
-    '';
-  };
-}
--- a/modules/caddy.nix
+++ b/modules/caddy.nix
@ -19,9 +19,9 @@ in
        plugins = [
          # error message will tell you the correct version tag to use
          # (still need the @ to pass nix config check)
-          "github.com/caddy-dns/cloudflare@v0.0.0-20250228175314-1fb64108d4de"
+          "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"
        ];
-        hash = "sha256-pfh9DXUj35jlAntkWc4D5wuW04xxQfM1rZ4KFauMzvc=";
+        hash = "sha256-jCcSzenewQiW897GFHF9WAcVkGaS/oUu63crJu7AyyQ=";
      };
      logFormat = lib.mkForce "level INFO";
      acmeCA = "https://acme-v02.api.letsencrypt.org/directory";
@ -34,25 +34,8 @@ in
            resolvers 1.1.1.1 8.8.8.8
          }
        }
-
-        (authelia) {
-          forward_auth localhost:9091 {
-		        uri /api/authz/forward-auth
-		        copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
-	        }
-        }
      '';
      environmentFile = config.sops.secrets."caddy/env".path;
-      
-      virtualHosts."keys.cy7.sh".extraConfig = ''
-        import common
-        respond / 200 {
-          body "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6
-        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhUt9h5dCcrwOrZNKkStCX5OxumPzEwYXSU/0DgtWgP
-        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD
-        sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
-        }
-      '';
    };
  };
 }
--- a/modules/containerization.nix
+++ b/modules/containerization.nix
@ -28,15 +28,8 @@ in
          dns_enabled = true;
          ipv6_enabled = true;
        };
-        # answer on /var/run/docker.sock
-        dockerSocket.enable = true;
-        autoPrune = {
-          enable = true;
-          dates = "daily";
-        };
      };
-      docker.enable = lib.mkIf (!cfg.usePodman) true;
-      oci-containers.backend = lib.mkIf (!cfg.usePodman) "docker";
+      oci-containers.backend = lib.mkIf cfg.usePodman "podman";
    };
  };
 }
--- a/modules/default.nix
+++ b/modules/default.nix
@ -8,8 +8,5 @@
    ./containerization.nix
    ./vaultwarden.nix
    ./searx.nix
-    ./attic.nix
-    ./authelia.nix
-    ./karakeep.nix
  ];
 }
--- a/modules/karakeep.nix
+++ b/modules/karakeep.nix
@ -1,81 +0,0 @@
-{ config, lib, ... }:
-let
-  cfg = config.my.karakeep;
-in
-{
-  options.my.karakeep = {
-    enable = lib.mkEnableOption "karakeep";
-    dataDir = lib.mkOption {
-      type = lib.types.path;
-    };
-    port = lib.mkOption {
-      default = 3002;
-      description = "port for the web service";
-      type = lib.types.port;
-    };
-    domain = lib.mkOption {
-      default = "keep.cy7.sh";
-      type = lib.types.str;
-    };
-    environmentFile = lib.mkOption {
-      default = config.sops.secrets."karakeep/env".path;
-      type = lib.types.path;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    virtualisation.oci-containers.containers = {
-      karakeep-web = {
-        image = "ghcr.io/karakeep-app/karakeep:release";
-        pull = "newer";
-        volumes = [ "${cfg.dataDir}:/data" ];
-        ports = [ "${toString cfg.port}:3000"];
-        dependsOn = [
-          "karakeep-chrome"
-          "karakeep-meilisearch"
-        ];
-        environment = {
-          MEILI_ADDR = "http://karakeep-meilisearch:7700";
-          BROWSER_WEB_URL = "http://karakeep-chrome:9222";
-          DATA_DIR =  "/data";
-          NEXTAUTH_URL = "https://${cfg.domain}";
-          DISABLE_PASSWORD_AUTH = "true";
-          OAUTH_WELLKNOWN_URL = "https://auth.cy7.sh/.well-known/openid-configuration";
-          OAUTH_CLIENT_ID = "0SbsGvw5APYJ4px~dv38rCVgXtK2XWrF1QvyuaFz48cgsNm-rAXkSgNOctfxS21IWOFSfsm5";
-          OAUTH_PROVIDER_NAME = "Authelia";
-          OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING = "true";
-        };
-        # needs NEXTAUTH_SECRET
-        environmentFiles = [ "${cfg.environmentFile}" ];
-      };
-
-      karakeep-chrome = {
-        image = "ghcr.io/zenika/alpine-chrome:latest";
-        pull = "newer";
-        cmd = [
-          "--no-sandbox"
-          "--disable-gpu"
-          "--disable-dev-shm-usage"
-          "--remote-debugging-address=0.0.0.0"
-          "--remote-debugging-port=9222"
-          "--hide-scrollbars"
-        ];
-      };
-
-      karakeep-meilisearch = {
-        image = "getmeili/meilisearch:latest";
-        volumes = [ "meilisearch:/meili_data" ];
-        environment = {
-          MEILI_NO_ANALYTICS = "true";
-        };
-        # needs MEILI_MASTER_KEY
-        environmentFiles = [ "${cfg.environmentFile}" ];
-      };
-    };
-
-    services.caddy.virtualHosts.${cfg.domain}.extraConfig = ''
-      import common
-      reverse_proxy localhost:${toString cfg.port}
-    '';
-  };
-}
--- a/modules/vault.nix
+++ b/modules/vault.nix
@ -1,19 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-let
-  cfg = config.my.vault;
-in
-{
-  options.my.vault = {
-    enable = lib.mkEnableOption "hashicorp vault";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.vault = {
-
-    };
-  };
-}
--- a/overlay/attic/concurrent-32.patch
+++ b/overlay/attic/concurrent-32.patch
@ -0,0 +1,13 @@
+diff --git a/server/src/config.rs b/server/src/config.rs
+index 4412cbf..6dd483a 100644
+--- a/server/src/config.rs
+++ b/server/src/config.rs
+@@ -565,7 +565,7 @@ fn default_default_retention_period() -> Duration {
+ }
+ 
+ fn default_concurrent_chunk_uploads() -> usize {
+-    10
+    32
+ }
+ 
+ fn load_config_from_path(path: &Path) -> Result<Config> {
--- a/overlay/attic/default.nix
+++ b/overlay/attic/default.nix
@ -0,0 +1,26 @@
+final: prev: {
+  attic-client = prev.attic-client.override (old: {
+    rustPlatform = old.rustPlatform // {
+      buildRustPackage =
+        args:
+        old.rustPlatform.buildRustPackage (
+          args
+          // {
+            version = "0.1.1";
+            src = final.fetchFromGitHub {
+              owner = "cything";
+              repo = "attic";
+              rev = "d660c85bdb6bb10499a23a846a13107ea0c72769";
+              hash = "sha256-E22d2OLV02L2QdiSeK58flveehR8z8WIKkcN/njAMdg=";
+            };
+            cargoLock = null;
+            cargoHash = "sha256-AbpWnYfBMrR6oOfy2LkQvIPYsClCWE89bJav+iHTtLM=";
+            useFetchCargoVendor = true;
+            patches = [
+              ./concurrent-32.patch
+            ];
+          }
+        );
+    };
+  });
+}
--- a/overlay/bitwarden/default.nix
+++ b/overlay/bitwarden/default.nix
@ -0,0 +1,7 @@
+final: prev: {
+  bitwarden-desktop = prev.bitwarden-desktop.overrideAttrs (finalAttrs: prevAttrs: {
+    patches = prevAttrs.patches ++ [
+      ./ssh-agent-no-confirm.patch
+    ];
+  });
+}
--- a/overlay/bitwarden/ssh-agent-no-confirm.patch
+++ b/overlay/bitwarden/ssh-agent-no-confirm.patch
@ -0,0 +1,34 @@
+diff --git a/apps/desktop/desktop_native/core/src/ssh_agent/mod.rs b/core/src/ssh_agent/mod.rs
+index 4e304cc..8203dca 100644
+--- a/apps/desktop/desktop_native/core/src/ssh_agent/mod.rs
+++ b/apps/desktop/desktop_native/core/src/ssh_agent/mod.rs
+@@ -44,28 +44,7 @@ impl ssh_agent::Agent<peerinfo::models::PeerInfo> for BitwardenDesktopAgent {
+             return false;
+         }
+ 
+-        let request_id = self.get_request_id().await;
+-        println!(
+-            "[SSH Agent] Confirming request from application: {}",
+-            info.process_name()
+-        );
+-
+-        let mut rx_channel = self.get_ui_response_rx.lock().await.resubscribe();
+-        self.show_ui_request_tx
+-            .send(SshAgentUIRequest {
+-                request_id,
+-                cipher_id: Some(ssh_key.cipher_uuid.clone()),
+-                process_name: info.process_name().to_string(),
+-                is_list: false,
+-            })
+-            .await
+-            .expect("Should send request to ui");
+-        while let Ok((id, response)) = rx_channel.recv().await {
+-            if id == request_id {
+-                return response;
+-            }
+-        }
+-        false
+        true
+     }
+ 
+     async fn can_list(&self, info: &peerinfo::models::PeerInfo) -> bool {
--- a/overlay/default.nix
+++ b/overlay/default.nix
@ -1,5 +1,14 @@
 { inputs }:
-[
+let
+  overlays = [
+    ./attic
+    ./zipline
+    ./bitwarden
+  ];
+  importedOverlays = map (m: import m) overlays;
+in
+importedOverlays
++ [
  (
    final: prev:
    let
@ -7,12 +16,9 @@
      pkgFrom = flake: pkg: flake.packages.${prev.system}.${pkg};
    in
    {
-      garage = (
-        (pkgFrom inputs.garage "default").overrideAttrs {
-          meta.mainProgram = "garage";
-        }
-      );
-      nil = pkgFrom inputs.nil "default";
+      conduwuit =
+       pkgFrom inputs.conduwuit "static-x86_64-linux-musl-all-features-x86_64-haswell-optimised";
+      pixelflasher = nixpkgsFrom inputs.pixelflasher "pixelflasher";
    }
  )
 ]
--- a/overlay/vscode.nix
+++ b/overlay/vscode.nix
@ -0,0 +1,14 @@
+final: prev: {
+  vscode-extensions = prev.vscode-extensions // {
+    github = prev.vscode-extensions.github // {
+      codespaces = prev.vscode-utils.buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "github";
+          name = "codespaces";
+          version = "1.17.3";
+          hash = "sha256-idJFYHJ4yeqpFZBX55Y0v1yfzgqyhS0MrC4yIto7i7w=";
+        };
+      };
+    };
+  };
+}
--- a/overlay/zipline/default.nix
+++ b/overlay/zipline/default.nix
@ -0,0 +1,7 @@
+final: prev: {
+  zipline = prev.zipline.overrideAttrs {
+    patches = [
+      ./no-check-bucket.patch
+    ];
+  };
+}
--- a/overlay/zipline/no-check-bucket.patch
+++ b/overlay/zipline/no-check-bucket.patch
@ -0,0 +1,45 @@
+diff --git a/src/lib/datasource/S3.ts b/src/lib/datasource/S3.ts
+index 089dd64..39dd8f4 100644
+--- a/src/lib/datasource/S3.ts
+++ b/src/lib/datasource/S3.ts
+@@ -4,7 +4,6 @@ import {
+   DeleteObjectCommand,
+   DeleteObjectsCommand,
+   GetObjectCommand,
+-  ListBucketsCommand,
+   ListObjectsCommand,
+   PutObjectCommand,
+   S3Client,
+@@ -38,32 +37,6 @@ export class S3Datasource extends Datasource {
+       endpoint: this.options.endpoint ?? undefined,
+       forcePathStyle: this.options.forcePathStyle ?? false,
+     });
+-
+-    this.ensureBucketExists();
+-  }
+-
+-  private async ensureBucketExists() {
+-    try {
+-      const res = await this.client.send(new ListBucketsCommand());
+-      if (res.$metadata.httpStatusCode !== 200) {
+-        this.logger
+-          .error('there was an error while listing buckets', res.$metadata as Record<string, unknown>)
+-          .error('zipline will now exit');
+-        process.exit(1);
+-      }
+-
+-      if (!res.Buckets?.find((bucket) => bucket.Name === this.options.bucket)) {
+-        this.logger.error(`bucket ${this.options.bucket} does not exist`).error('zipline will now exit');
+-        process.exit(1);
+-      }
+-    } catch (e) {
+-      this.logger
+-        .error('there was an error while listing buckets', e as Record<string, unknown>)
+-        .error('zipline will now exit');
+-      process.exit(1);
+-    } finally {
+-      this.logger.debug(`bucket ${this.options.bucket} exists`);
+-    }
+   }
+ 
+   public async get(file: string): Promise<Readable | null> {
--- a/secrets/cache-priv-key.pem
+++ b/secrets/cache-priv-key.pem
@ -1,28 +0,0 @@
-{
-	"data": "ENC[AES256_GCM,data:IVRg3IqrlV1Cy3xwyVszhUnRzbWP3OSb/XZF1H0N30eKL8d0DxFGngC5qMgRcmSs203/QL3w0fENp1u0f8tVajqJVlzLjlsiQrMdtXmiMv0LKO7E+aj4UZ0wMchB0XgSVUWrKUXxZrA=,iv:3GtA07yuAAI++RsLSwY3U62k1iG9+hvkGn45HjFt/Gk=,tag:PJ13CrjcE06KMC383txqHw==,type:str]",
-	"sops": {
-		"kms": null,
-		"gcp_kms": null,
-		"azure_kv": null,
-		"hc_vault": null,
-		"age": [
-			{
-				"recipient": "age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLcGd1alJmNWM3dVBmSWxs\nRHBTOVV6U3p1U3Q3bzQ3OXYrWVhNVTlxTGxvClllbFMwc3dFZW56a0d6eUhVZ2Na\nMUVJc29CNHVMcHRLaXBlRnRLZ2pNb0UKLS0tIFRERnRBZGVFRk9sYmpzVjlpdmN1\ndjUyVmRZMFlFTm4zSnZWV09WbTNoMWMKM35a6GkCZIKscqgADrbIa48T8++wkhLP\nOFr03bv6D0Hj38VLWx+kh9kmja8BaxmdSUTeAhdORwbQumJBAqjsOw==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHbEh0YkFlL3dPL1FmcE9m\nbjl0dHhQZlpBREMwYzQ0NEpQQ3RZVlNsM1Q4CmYwS0VDNjFaOXhOS3JkVUtaTEJZ\nSVNyZ1lXbEhCbE5XdGxCRWhsNVR1N0EKLS0tICt2Um9wQ0pyUVpnd1dVemM4NmpU\nTHE1bi9OcmsweDZyNVpVVUlITmt3c28KdX6fO1C7Ma66AAv/RCI5z8p/7fSvKWQ7\nCL86Nl4Xzb5WWxkteO4wOoHh4y0+9dpEAbS/XP78PkC07uRttcS7pQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			},
-			{
-				"recipient": "age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn",
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCRmNheTZrUWplWFZJcm53\nbC94UHdYbXdsSFB0Nk92Q29RdGMxbUxVeEhjCkZqVk13bEFvNFFLZllTN0NUeFpj\nRkhlYXl5STJrbVQzeWg3YzlQZ1ZlZncKLS0tIGhjUytJa2FXa0VVTFlMN2ZpTjF0\ncG9ZTG0zL2dNekV0NkFZWWVrcFpPU3cK/Kia/sHk5T9nlbDg2G52uQcJUoPrnu3y\n6ARJKoz0MnV4csjS6IZCFSb7Vy5DSH+at3khEw3x00eGae1Jd89vwQ==\n-----END AGE ENCRYPTED FILE-----\n"
-			}
-		],
-		"lastmodified": "2025-03-27T20:37:28Z",
-		"mac": "ENC[AES256_GCM,data:35iUoodcjvIn+VAE20f2sHFaTh3+aqCYQ4HalWdVz4eUSkVNcdXs2uqOZtFv3MszDiH9izM84OyHwykudJ99QE3B/NwpfIoKQaU6Qg5X/g/rC1meffMaZwcASVbepjznahbTKmJqeSrMeybrBIV+6FaSjWXn0+D72GEEM1vgH9c=,iv:N2CbttHJsczm37qdapOCrlNeSSgsZBDlvWyvUpa3mkk=,tag:btniVwaVS9h4jDo4IM2wcA==,type:str]",
-		"pgp": null,
-		"unencrypted_suffix": "_unencrypted",
-		"version": "3.9.4"
-	}
-}
--- a/secrets/services/attic.yaml
+++ b/secrets/services/attic.yaml
--- a/secrets/services/authelia.yaml
+++ b/secrets/services/authelia.yaml
@ -1,39 +0,0 @@
-authelia:
-    jwt: ENC[AES256_GCM,data:L20XZt1eYz1srY+xIliasq4x2guxNIUOM4mVTPe/1uS2wQY6h1uY9n7yoMQ=,iv:OhTuutHQOVLG/CjX3m839Acw9eq/Yh3Iy947km1jalQ=,tag:nq/lwsfGSzeH6RsXLzr24g==,type:str]
-    storage: ENC[AES256_GCM,data:RW15TzoZifv0xrVAfrM7yFXv1ISp7v1c20PL4nGkQrXwjablPKQa5IZ0Fvg=,iv:YQ7+2h4O0Qx9BqnFU7WMaZuPtKU4BUo56/KPq2NQYxI=,tag:LQ8gWhf9rblGkN5bhPHPIQ==,type:str]
-    session: ENC[AES256_GCM,data:fJY4uSKRIcHDyDqndT9YiolOX1HDw2BphoaZONAv8AhdPV+aG5qj9Ppy3Rw=,iv:dcFZyIdZQQlyAORudsUCCD2wx4Sc7NF0dh/v/M6iYko=,tag:vBYU58mL7DecMqhX/TUdVg==,type:str]
-    hmac: ENC[AES256_GCM,data:K/qiyibBlu9wNh9IINHgYQiEZMromSA9Kf0iRVHPVuuhhUBZRyyfFyd4sLYNDLWvYKRJGnTBniIscQuBR+HU3/ttFGN0EkDsuAXlW3tKyLSxTiVgEvsKhA==,iv:2femAZUtSE9DjopiRIRT3Be3T2Qi0J+b8TaNJZ9vcjw=,tag:Sb7TT+1uxtStv20oM8oa8A==,type:str]
-    oidc_private: ENC[AES256_GCM,data:dzrykbgRk77yDbrnayTzSyiAjvgr5RUuDG046azumPinHL9wBaKpNdx6CqY7o+W95yOyVr/Xriw/aBbSyCZE8RoMchZhnS5Z8moHrIK7RryRM/BmEpOfyFLf9kpaO5QqSGyPt13yJQSA/3TwoXD4et3rVEdEz8mwb+vIA+G3WIZrNY+95KNjhwu9W648eouGBqJFfwTw0tm8mHsu+VZE8OYdp+ujSlKWZcVDEzgMEe+egXbvSB/3sk82HjolcqCmDx+U1TWMZfZdZPaT4RxONy+4kgGDW4FOqtsgctS2uRUQ2CLuRLD8xIulBO/VbsnNuticiM86BYygobq3RUdCKAFLUpcXqNWgnDBvnYPcF6mXPTmFCD3Gr2t4uRkqIIPc3NrW6DKnSO4pu4oVlUiSd9XaHGvAuo0yR7zcG7Zl4BAzhZa1HuVq6QmSNMf1TAo5P5zBc/NKlUVUhgIEKmRkwf95ZDyph1CJJagTsRZp/D4n6gbuzmV2Pjd8GxT6X+GOK7MQ3hPWsQP8+hhf8DArnVa988Z5cVxG3CQS6wEdEfc8yoHXlXwsB6iHjG4GooJk17GkP0YnMqOkv5Y9QbWXGNN/Zce6LJrSdvpd1Z8oWHxFB9ChFEA34tTYE/1wv0C71K6VRADnshBTyg0i+7GxvW0iyplWGEB2/DRv9WbpmIze1vff0KPlwvmdPXvZM7kfJE6uRP+DH5kJeIlKezA+hwuZmTLEu8kTdIkIJVfbzuOmXtX1yO+sQmSs6anqbSBuw5dpKYFFtQ04V+P27uTdi6lbUUfaBiHMhiW2A8aj/1Xf+pOV5oIN1c7PXNhAGrsNbmumQ7mBmbfOZeLC2aze5iKLSu5xqCzMNEWdlxXkmK+eEuUgDAQgW0pRAA12wvAFT8cf5BIeEPQQF4gPJprrQ3u93AXCVXve/TPC6rSEb+uCVq30JRGvIciFAEPWjhtSSO2Mh2zxjaALXVRE456k8DQq5mvovCp003EW23Io+lKDfg73n4LLZvbpHBVa3SQY0YMazjynJTo6UcDT3J/u9kNutIRjszzohMdW4jmykawPb/FFGv4yaX199bkTT/6/ztygaUTUTtWrl40p61lMzFHsz1qPy/5Bp4fxOYk6mLHpUFBpXUlu90ZxiReu6fX9HR6oQ1OC6MmpYjvcvxOAfIszgoMmp0LABJ1XN7DMOxpRrjNqW071xnel2/NzYy/gx0r2SdusxFJckGjrnyVzjEBVFwdpc9lZ+NdyzbNaElt/duk5AhdQ/iTCDlQpFsBhcl83Sbt38P/QlsOCPvRYuOz3vvOgeRprZn4hXuvGpQKJZEy+/rHDFijVABgbqLBxhfQiCpFmfwqQrcI+vFnPBGHP96p8S7xg5Dh2007QyFk9D2zHDHY6E+Iv27UkjaCZI29IAEdBe86IMtLI7Pl0q6XE44cHwD+QqzS55YlPj/F3va9LesoylPzBJwlxogciolfBQfQjLp4OF1rBSpy1Xy/Es7+M9eEsdatX1a3qFzYCJbC8+no5ol0PaIHx4ejH9aeoIiVfq/yXtzV04pJQz0bZfpfKVwtroyHhclEsP9pZVHnnexIFY1xqVF76V0kbusiizhru5ldOWE7smwXD5+KyMCTfDuxPnEjFBZLb/BLjo46sugJTAGQJhBBWJY+h7Je5PP+FnjQG28h4n4NMshhPfnyDEAZWNpDAHi08KhHOGzbNhPl+E+pNrNoNwmJjWbiqZ+P9LVQf1s5C+UrL+uV6qpeVKcm9tjy75fgVTD4iRXb4ejQIWlwO2EVLBzI9BXYsVmly6z0C+8f3wDPswwwocna9SonBus1QGudZ8cLSihZqSYmq6fCIFqfXTlCj3H0aOBNbX7dCYrles/y6jtn0VebQa3UEflXs+4WytpXdKEelN5f1PoJVnjrRF6Wtyq23GNbo1M9BTBQfpUf5x7QnZrxyIVbgvHq3JSR6/5p6yv6SGOdypCEqMtvnw9+bJMi6bxy55tXQNNpBB/GHWPqzOE9//9pqazJzikL/x7HWg/t+tJ7yV7MCFV6Bk2cy77j7i0fftxfHqjF7MRbnIaJRqxiTqp0z2rA4L797Que6a903b/u/AStMnsm8sE9gRy7P5L/PafqpgA/kK2FIxbDDP91cnvikRi2u+oaydHLhCkaq20SIupBCbgyDVkOXZ9n5EnKJDjFOAbOQ2UiXYrQPXDEMPLLUklBeLzQBHY4ZTQ7zzMb1tqvo4UqaHVnw2FwY+PoX2IPmF1ciccFO5uHX2w2qz8Hx0ZCPa9AsR/3HhKAg9sdg0cF0k3nXqTWCSs8j+9vpJxjCmrN1bXwoRA8K/ICYDoOtjb76c1B/Ahvc2YA7OULcM0EAzsQ2Z++cU/OCIcQatxzEx+TOp5i1yN2YnCFHqDBpE1UB2UbxBCYb+oEEBqB9qeFkQI6eZmvHASjdasXUtvnBYNCc3nliGfODoOXKLmzHQZJVPguWFu7b06zWA7fy3qGMjf7h/RhKbfkL9o7HkAvHTSh0+Lpc8gjPVu+sqLNUMyk3196LJWUI3nf7L3kUxkdSBdsJ/18FZ97OzC3Ws9dhhWe02ry3Y2ptRnIlLf8f4Y/P6FpqwR8Asa6NYBq+LKNSuWfzo4ZynkPt4irAm0LDOnZzbrRbQTB7tUHIA1dZMMWueIe22mUDOzTGDPuFSfF31rYbh2rmc3Tjvkumz6g53kdCV4QnL04htkMwql4KvpMCrkkMxDRlOTf1Xh10QrO49aPd29i7LbFjorGj1872hXszPDpmdDN78VApvMzVue8dKdhlz/x/9aCJnp9oEEgdObEg2OYyc29bqd9kbCOs5F4vaI4YdMrN9QKTqjAVG0kQAKH41Q7VCe0/jPWmGpH4Kd40RQ6/NY5g312D3RKV3V30DlCOIm+w1z7XzV2EWTgb5vgg4EbYyVmh3Y7wBguv2qOqzwhGMFrWGx+fTFAe5Zq8TVwvQUfeN/vFlYz+jc8ysKBbyrrAl4vKm2pz9Geu3Rh4AfRRmxawNjE/qlrTk6sWdWNJu7i2Wgk1C2+1FZeAprPg6EsZj7rFEGOFvZIjWrTi7n+IHI+8rRKDo3J5SkAsxiDaDo8dfvGecPp9ig5l9+OiN68t29HxfGnhJsk5eim/vkuA5mdFJW0cy7h3gtP1Z0PtRYsRoBO+hPp7dcYhhh9NqkP4LbVI8graz5FEf0yMmaA6ci7xgBWe/zOa0V539Y9cWzTK5zE2wrWI+mHKsbgUH9s+7y0tTVk9mPaNKhih1MHgCQiFyctQLzVnd6fXnv7JHzkkIY7AQiCjEZ4QPUrj99rDh0bikDtKX0hAiVedGMJQ664Hhyd3sWVGfrC/Qmob+4LhpE24kAxIRf94d2cB1zRFQ02HMGkbVUbge8SPNqqq/HoWkYvNo/ltdL0Nr5Qb1OmY0LP5txGh8cCQt8SD3K/ww+ZjD0ZbqqTwIaND9reyzXL0ryf8yNkiPCTpFiNmdL1rtHw+E2s9HtdngCz9XuGW5GRa4cL5xY1Yt4WBLEnxXwmyB/EOjBIeO4aJuwAcssL3UrvS/IEERWN4XrqVM4O81ainLaXeze1jj9VJcMb+/qz8dMdgm4WGkKfbbJeIsFCrlHOJ0CFNZZmijMvkoTvZ9WTq2OpxxZdsci1UmItlU60LETfWTUK8Q3YOo+c+fukIMPv68NLQH1LsiYjFXo9yDdzfD990uI5wdwnR3S3Sx6Vp04SkzJX7BAZ2UuL0wJ564Ny4S9Ew5BfWucd70mfQaEzOl52M9mqCyJYDfMYhd65YxkAEAV1dMg3FBlpZmOr2wtEQqXz+25cSPCNwQ/obCQt12cLNGRhyNi1Stz2E67Q9sesmssF7dgq0u/TeLezzVxTk13sJj6PzMtdpOYDwsgZJdh9hz8PZ32nJMTJnlkq6zcTYsbq23+HreCx1dHJJEDjpqZlttMYqLZ8mLLob25PzFaue164MbqozFtNTOc8eeOD+hoPCP/hfPoKoNi7oARs0fvwOwCQEug0XpMcz9mF/85ZBxYuDUBEP1vpbD9MpP/ECslqGdHuJePEFiiJOrDVggpaGcgWUfS2jwWv/46Bbz+W9QH+6Y8IevMf+lXPOL294g5VOoOW5k77naeNNCbycbijFD76gR5DtA+Vn+B6pxzF7l4E4VqC0Vlc1OUvYA7GLZ4rzb4bH4cEZiIb2/skDhJOmcb2btPWKRgutbmpHmi59eVbVkKUAKXm/WBw8xLwt2sLBS5r5R7aAZpMu/NaXFTfBEBGUzrH1u8Pfz3FwRK7v0QEyzhu2bS2JkGxSsaxD5+geQlvzN8eRYW4+pst/CfcCxTES9spBnqSWIX++rs8f9/mECf4jXzZQDv0fdbGILAU=,iv:GTKiBIir9+G3Lh45x77KARxi7paEsGP1m0qVldRnuOw=,tag:eCsjDzyO1g2HvnDhR/Gb4w==,type:str]
-sops:
-    age:
-        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJOG1menBCTTF3YURCOThM
-            Q3Z4bnZJYmtQY1RmdTBSeFlhZCtUVzg4Qm5ZClo5NFJqaWg3NElKQjRLcFZGdmxP
-            cFMwOGxoelJlVnJNamUxWFhETWpiY3cKLS0tIFNDWGRkYVZQWTd2YXg2aGswbmJz
-            MVJQdDV3ZGdzd3NYL29tYU51NndiNmcKtagAZdoZQo0y0atvRI6f1tY/3j8aD4RP
-            yvs9RVDdNqm990O5EudjMNhoKLXnFQtX9NlzYVHzrsX0UT/HSUi7mQ==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0K2tGaktsdXVPN3g0bXps
-            ZkVWamZGc0QzNk1TaVdla1RDaW90TVpYb25rCmRPL29ZNFFCbVkrbVpseW5SZlFN
-            dmlLWHVBb1RMb1dvY3NKNHc3NEpMZFEKLS0tIFluRGN6U2paVzVBdCt4d3FyMVZ4
-            Nkx5aHo4Qk8vU01wazdWdmhvNWRLQTAK7kiQiEdF1LpzQ/syjRjyhchShrnfhHFE
-            M/XWLSIcnnApt1dOyJhJlpsQTnT6Y6Fqem0y779/uOQCBJGavscOWw==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzK2U3YlRLK3BuK1Q0TkYy
-            SE1lTkVXUUV4NFVuT2V2VjdqUFpBbVFLSTJnCjI3c0xpMnBnV0M0Q0ZHYTdUSVZl
-            MWNMQXowWitFVTlIMFBadVJ6OHBBR28KLS0tIHJ1M0NkZzFMSndIUjBwN2tFUmF5
-            b2pGTmJva2VnOFZlRWxlOW5wMitDUkkKrZyzpch6jTSsumseBEaN8xQXfng4P7ds
-            JSoock3sEmL4NSfxXSu+PP8kEOXFtu1yAcmSSeVDDhV7jiwE4egu2Q==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-02T14:06:11Z"
-    mac: ENC[AES256_GCM,data:wK8Nb1Vb80UfolzqZOpifZdoEKYu847anowYiCdSluoK+dfHhDhCj7ZxznYV7SwVACIoLsqLR5syRzC861PRBrAujkhbcn7lTc1kQRCjw0gMAbPYR/xiO76EHmiYqnV2UMN0EmuQg1nIRIWY9EO9C7m1b9fjoZFgDsj/7O99aVU=,iv:CJxUKpyNgEYwqLhSvuXoHb+Hu3M7ydKh0WlsjlOtKkM=,tag:4KXmNwwFrqvBjxe656Jvug==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.1
--- a/secrets/services/hedgedoc.yaml
+++ b/secrets/services/hedgedoc.yaml
@ -1,6 +1,10 @@
 hedgedoc:
-    env: ENC[AES256_GCM,data:9xnOlQrk1qCyiAHSjmu8dvj2/z/BrJlngNGAQnMwvLsL0pnyvvyJLnYWTDYix1a9o8OJUNLw6Qhq7KbY4uXfxsNZkfGdVHwvkvhySjR2rcX/r90txqHJUUIxE/TzdsBvonzQ0F85KfXhsi69gKHp016gCj+jNf6CCY+tOVpt71el4Z+jzqLHasuQET8GctKJRzHOfNfCx/X2kJeb7RQl3JFC6/VmYT45bUk7uFfveFD9ao03wJwLKi27wO1WDrfpOigFdvkmqpbWZjaILYHYmkdhdlhr7w330CiCmGHT/ssmSPcu5cYUc8tjYPgpYLjusiUzpE5jmut5GaNwZsY9hNuow/mUVnQ/tCDH0ChOq0DQisJ07VMYlRII9tMdcuT4IbjjwiRcYlORAHsTFUuo5DCaDp8a4mx846BGp1YMQsvqJQgOe4x15VMpeB/ptxm79qxcLZKZ3BkiJaKmDdWsVk9RfqVgsxqiq16Me2EQhknO2s/oBjGOaoIiT4NEuRFQl0BIPgIMD0lYzKx0uDaYyclID5W0DqMI+SrcBd+WH/BB9HPdZx92rFe34PzjZse0i6+5UZHXUu8au6CyLMqGkUlzkSFwVT5W7Lv2m9P3+6YjgPRMaYbg8b6kmavB6EtjiqWtTbMKr3nxPVYJc5FRImvebfFqiLy5MWoNV6Qe7TUGIk6QtX2OWBhQ1UB+IpR+180QH7yw7UpgJ9EM8dD2m2/smar5P0BjAaqAFib++GzoB0OfFtxJNUjrejQC11tRWBXYvcHWwa78VbKPul0xqiEMmsAZufMix4lD1EgutTf1CXfv7l0rUpLwkYbWIq2hT5UI53L0YWJDl7zlhi94ANdXV8z8kCvMeXm2Fwl/vIgJ9JuFeVeVYPpXwx2coLBwE6uI4SuFvY1d4ojvzY8KftcHWO7srVzpuwrwW+6gKLwPQyEazv+sRKXAGo0ffMO2/2KRgOu9zGwaOFaNDAZ6gYFDWbPz6TMfNWHzfLEFK5BlVAL8KDb78IODUBYcMr2CX1Y=,iv:LDkuJgxIbohEVf7wmdtOZ/vlPddMYa7uzHGkL+0MnUM=,tag:pnJiCJydjTmUbS761fPUPw==,type:str]
+    env: ENC[AES256_GCM,data:15rWiIYWyIJ0Hxl5I8m+EBV+FkNDT/OHlLK9shVS46UE7SQtuIh45N5hvwgs0rg9E9Tawu+lyE2aozWNh6HSDUZ1h4FYrB+JHwIetGkOqXSLHfXi,iv:v9ohLTtlxw3fsRoJJoOY5VYxVsxUyDEsQHRjcGKg/GY=,tag:Wncm1reqNblnVhRTYjU3Pg==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
    age:
        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
          enc: |
@ -20,7 +24,8 @@ sops:
            enlDZEI2NElkZkI3UmRyQUZqQWE5ZmcK2JlwNzVJNhGjyniIg9UY5tjgUKttkT3e
            9C/xag3dQCiqzX1O3o5tdhYnxXw+VxVf+qTFyyuftg5iQPZNuvX6mA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-05T21:08:15Z"
-    mac: ENC[AES256_GCM,data:cPisYUoZWd/vd+wWzz3xTnftj1RdjK20dWFo+MKssm/eu7eCOWDIaZdcJg13gkTleBpMWQy/mG1drC6GLfGQiBmkS99UCPAoo0aLTBL4FbSm6FEXdbVjoOI7URu6Sj31drWCMAm+lXYymWsHwZJrNLhjsCTQsxTPvFq8oOdNlXo=,iv:KpmJoZ/BGEEhZ75jXfXxegNglm7k6mtleRuVud6tX2g=,tag:lsiqX+YSz4mGK6mw9gdKNg==,type:str]
+    lastmodified: "2024-12-17T03:25:54Z"
+    mac: ENC[AES256_GCM,data:1cxiK/HhqYzatT2PhZxjvtizII2QMHqbbyOujUtx4cT8x488j2wecu6hOfSkuHbQ43AxA8kDH1NAruPCSdCpj3PytMR+np+R/5WuRcK+OF/FCnWvWvvHqgDnBs/wYjllnR6HyWBlhrROpINxu9ch4fzN0Def3I7O+wJgpojnPiU=,iv:PKPykPv9zSHj9+HXnrg1v8Ty78te66D9ZH6c1V7Qlh4=,tag:JQk68u6p317r3Df+hv16+g==,type:str]
+    pgp: []
    unencrypted_suffix: _unencrypted
-    version: 3.10.1
+    version: 3.9.2
--- a/secrets/services/karakeep.yaml
+++ b/secrets/services/karakeep.yaml
@ -1,35 +0,0 @@
-karakeep:
-    env: ENC[AES256_GCM,data:SWc26EQaKR5d9hMDYzVHA/r7XfjwFZ0d44Co0IS6OayR24ej7yqLAtkNttROKoKFuYc0sHgN9bOy4MyX0s3qiSWYovIIUJgFiJjPQFYDAo+50WR4+5W5FgvYI6e42fcWrQhaCXWQrDyzch/zT2OITZsjXcQhT5E+IiPLVkaGOjGptE07GjM7ZXI4UxBzINFQOhxdfIO0km1o6Wq8GhJdWsz4exz4ahRslR+WjK/flV2GZVAj6EHSJ5sHohm74QlhxaShEbc/8IKP6R2gSjBFP7l8VvwFyIUD9sLzYGvS3iU=,iv:gSPQU0bZ+VRFbuaNDc90dW0ogWX2SMH7kewtq/u/11E=,tag:L0Y4EWSQUhcn2eHt+yZ7qQ==,type:str]
-sops:
-    age:
-        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaWQ1Q1JwRHJxQjNjdTAx
-            TXRsWjVZOG1mNEptNVhscHBaK2I5MHhjdlFjCkNqOEhwT3hyOHpHQ2k0ZmowUXB4
-            eks2dlpUS0V6VjBEYW9UWnhFOEw4VGsKLS0tIFo2a0FTRE5WdHBGVW5DOUFkaE9p
-            bitvUnJXSnB6UnV3VTEzSjlSYmEwVUEKHOwFCRu+SIyM0uJ6bNEAo+MMlsc8la6G
-            bLYdCoykcBu+uVXqn3BYTbrS5ylQMRYcbcPFJw5BVdmjIYF4LU5W6A==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrU2ZnNVAyeVdJeHlTSW1x
-            QUhKRzlNclVUWE1ucHFLZW5sL1lnUDhkd0Y4CjFuekNEOE1icDNqL1JyT0hEYW16
-            Q2VyajJFWWtGUnBzOENGOEZHbWROZzAKLS0tIE8wMVc3TkV5Y1VyenIvOW02NDNq
-            cStTeUcvY1pJWEN2MzFEeThKT0JPc1EKXrtVG49a6YZVKiL1F8Xg3t3niTYv3LwN
-            NeAQ8srV0F6ckky7OCkvUp9GInZCWRzULXV/x+4IUb6C+KQaNm2vYA==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdDdUSUlmMk5VcytyT01N
-            UmRaK2k5Wkh5SlhPT3QrczY2eW9vZk5KWFZBCnBteitnNFlHdWRaaTRxSWYvYmtG
-            ZnY5ZXlYa3Z5aENlRy9BQjVSU1F3UzQKLS0tIFpjN1dOaWNKaU9PaENyaXc1K3BU
-            K2orZ0Y2Z05LSUZ5WHQ4TnVVY0QwSzQKiUQT4aSxXnaq0kEMp+q5WnIUoGypEmZ+
-            DQEhkB9yu/BrkjXH+HGQr1W5B4sJyb5rnl0+SQ+IypRIRyaX4CdFxg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-04-05T19:44:58Z"
-    mac: ENC[AES256_GCM,data:OmqsJI9BaICOTiH1cq4gZlNBbkAxn/pAOWBtkIjHdqpikABLG6fMY+sLpyeaovXjexIj9MZk7fPmV8dRZ5VNLHCqlYXK/cVoQBZ2HK+p/cGTAFelNAShu9NSgZdFmVgJJtOjVvFp8dtuY8VcQj861k/MPX0mNZt9pmXYdumjpNM=,iv:efHkp1KUctwtCjG9A8i5qs7nQfQqv2ya1yYlHHOt8pU=,tag:4lChpspl0oOUMiXzvGuA2Q==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.10.1
--- a/secrets/yt/aws.yaml
+++ b/secrets/yt/aws.yaml
@ -1,8 +1,6 @@
 aws:
-    key_id: ENC[AES256_GCM,data:euyq+QtSXv1UR5eOJfvZARhm5L2AuzKIOk8=,iv:RseSyVArmrawNzlwjNh6FScJF2O+F4FBuIq47uMQQEA=,tag:bkZJeX3rUHb1yZu8dytgcg==,type:str]
-    key_secret: ENC[AES256_GCM,data:27BHAU5suCIiSKAf0+1yNa/VJ0umErb6Ry8HI+Zfv6LV+7eB+wk8H3kxdV4wmY2XayHsUrD4FZa30O0a9PdJgA==,iv:oI2X7PCXDZBkUOikHM8S7gHsnMtWp7jxBqdmfbUlrwU=,tag:9mZ3H2jobKqYmw6S4NNpjw==,type:str]
-    _r2_key_id: ENC[AES256_GCM,data:R0xwzUx+6l9SR3Fd93PfJw+WPV0ByzOKMxoJQtn4pEE=,iv:qHmr/HssM8U3znbGznSIOwkAhNaORkCkG9lqAmCKmfw=,tag:LhuiiKSq/VnNEulgrS71vg==,type:str]
-    _r2_key_secret: ENC[AES256_GCM,data:Dw5Gq1URjMpy9Bh1IBYf+/EnkvQA/4yAC4kdoACpCUuJQxdQphFKwWmxJX+Q/oztO1imWoGIxlZNNDr5QCqXaA==,iv:hGePo+Ffe48n1BXI1f2V12C9Gn1CC1nTwbSsfqUGQ3c=,tag:AIy/F3jPGz2WHge3Mk43Ag==,type:str]
+    key_id: ENC[AES256_GCM,data:9tWAMzUv4f6Ea27XsmYhO11NroYnLmED/FVrCCGO0Vc=,iv:YP1xRjVd1M1MB7IKVAw0Sdx0E4AokBrsaAcDLvTLHD4=,tag:SEmEr3NoZvch9LeaJHbCww==,type:str]
+    key_secret: ENC[AES256_GCM,data:AK+vER4T1p0AknKzsxZQJ0JTpfIstnnTWSAZ26zJSCwJYgRYwj8RF98CS7HM+KWvz5VNGENxhVdUnjlGkrTB4w==,iv:3o79gwp5b4KGsixW02qFWYFvpagY/hykbYJ/WNz6PB8=,tag:GW2T8ggKYHa1CQ6DRomJDQ==,type:str]
    _garage_key_id: ENC[AES256_GCM,data:2lLS1nBhrwBkJh/ei7FwBoR6jOI6KCJkvOs=,iv:jwB7ZEaKOPIwghcGRs3qaICypoHgSxkFBOyB6e5hpYI=,tag:Iqwv3j1R1uLLUDKLhN1Atg==,type:str]
    _garage_key_secret: ENC[AES256_GCM,data:5iwwMfojHrR79cOIY+9O2oVY8v1cbPcECMSOMhWuGAdc2lfCogKBwLM4TFwBH9X1Vx56QvUoxCQ2uSyfOMLR7A==,iv:Q523ttz6ijmv8/JlVZuldFR4IabEKiVN4sGmJ9xDJU0=,tag:ZZ4LRG4DXOC7LY8hEjXYHQ==,type:str]
 sops:
@ -29,8 +27,8 @@ sops:
            UlYrTExEUVc0dURLR1czN3BnYzZ2VGMKCbAgM50jvs9VciA1Pb/VY+2I4x62LBGe
            j7eHkfTFc8Gnk/rZA9/ZJDLFr/FUPMQWK/NVoz6oLjO6oVFXqN6OqA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-03-16T16:45:13Z"
-    mac: ENC[AES256_GCM,data:DCx4uVuy53Gz9Ha2p/GjxTigKw/dJ0gvWIAII9AtKQCURu1OfiJ6Lp/ht6ndJwn25em11uppN371pQGxa8FRtLL+dX/YgoDmOw3Tgo3lc5VLBzalRqXHInOGHfgv9k1jHNq6zokKbBLDItBnUNOCvsLTXXenVRYdnkiuf3QPGhk=,iv:gBbbH/nJExK/dEXKHo+cCr+rxQ4uJQWweK0lYT7amsM=,tag:9GaCGFrcinqGfpibUNQ75w==,type:str]
+    lastmodified: "2025-02-27T02:50:27Z"
+    mac: ENC[AES256_GCM,data:FjlbCqqYHPn/FDPUR1flWgg6wwHhLJx1uKOedwkvsTxuPhlVJHghTHWYetdmplOQyEpOEbyv+iqKTGDYHzDdgU2jIZ0TKM66iHq+1yft4TatBu75/0N3I+SfZv97vKNehxN/zvIY3FQF4O8qVy9c1dZRmr7q27Wq2pdHSOe4Myg=,iv:YkUXcOwb6UZr0vXazbLrVeGTvBTtnwuEIY3O+GSrnNk=,tag:kQBh7urSnHoiV18TIGlPEg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.9.4