update caddy hash

Flake lock file updates:

• Updated input 'garage':
    'github:deuxfleurs-org/garage/14d2f2b18da015508d4a1e31b2f014da5188d516' (2025-03-21)
  → 'github:deuxfleurs-org/garage/4ef954d17604eba8aafa52902cd3c573978c7195' (2025-04-19)
• Updated input 'home-manager':
    'github:nix-community/home-manager/c6b75d69b6994ba68ec281bd36faebcc56097800' (2025-04-16)
  → 'github:nix-community/home-manager/f98314bb064cf8f8446c44afbadaaad2505875a7' (2025-04-20)
• Updated input 'nix-index-database':
    'github:nix-community/nix-index-database/4fc9ea78c962904f4ea11046f3db37c62e8a02fd' (2025-04-13)
  → 'github:nix-community/nix-index-database/69716041f881a2af935021c1182ed5b0cc04d40e' (2025-04-20)
• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/2631b0b7abcea6e640ce31cd78ea58910d31e650' (2025-04-12)
  → 'github:nixos/nixpkgs/b024ced1aac25639f8ca8fdfc2f8c4fbd66c48ef' (2025-04-17)
• Updated input 'rust-overlay':
    'github:oxalica/rust-overlay/c564fb830c7d5b3e4fde5ea829a62f0e41e43a20' (2025-04-16)
  → 'github:oxalica/rust-overlay/e2142ef330a61c02f274ac9a9cb6f8487a5d0080' (2025-04-20)
• Updated input 'vscode-extensions':
    'github:nix-community/nix-vscode-extensions/47bd3dc652c4a02dc565a9360fe828af38bea287' (2025-04-16)
  → 'github:nix-community/nix-vscode-extensions/ff14820202442f847fd37862eb48a7cb254a19d3' (2025-04-20)

.github/workflows/build-machines-and-homes.yml

@@ -3,18 +3,26 @@ on:
   workflow_dispatch:
   push:
   pull_request:
+
+env:
+  TERM: ansi
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
+  AWS_DEFAULT_REGION: us-east-1
+  AWS_ENDPOINT_URL: https://s3.cy7.sh
+
 jobs:
   build-machines:
     strategy:
+      fail-fast: false
       matrix:
         machine:
           - chunk
           - ytnix
-          - titan
         os:
           - ubuntu-latest
     runs-on: ${{ matrix.os }}
-    continue-on-error: true
+
     steps:
       - name: Maximize build disk space
         uses: easimon/maximize-build-space@v10
@@ -27,47 +35,50 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
           build-mount-path: /nix
-      - name: Install Nix
+
-        uses: cachix/install-nix-action@v30
+      - name: setup binary cache key
-        with:
+        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
-          install_url: https://releases.nixos.org/nix/nix-2.25.4/install
+
-          extra_nix_config: 'accept-flake-config = true'
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: cachix/cachix-action@v14
+
+      - name: post-build-hook
+        run: |
+          sudo mkdir -p /etc/nix
+          sudo cp ci/upload-to-cache.sh /etc/nix/
+          sudo chmod +x /etc/nix/upload-to-cache.sh
+
+      - name: setup s3 credentials
+        run: |
+          sudo mkdir /root/.aws
+          echo "[default]" |sudo tee /root/.aws/config |sudo tee /root/.aws/credentials
+          echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" |sudo tee -a /root/.aws/credentials
+          echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" |sudo tee -a /root/.aws/credentials
+          echo "endpoint_url=$AWS_ENDPOINT_URL" |sudo tee -a /root/.aws/config
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v30
         with:
-          name: cything
+          enable_kvm: true
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          extra_nix_config: |
-          useDaemon: false
+            show-trace = true
-          installCommand: nix profile install nixpkgs#cachix
+            experimental-features = nix-command flakes
-      - name: Setup Attic cache
+            accept-flake-config = true
-        uses: ryanccn/attic-action@v0
+            system-features = nixos-test benchmark big-parallel kvm
-        with:
+            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-          endpoint: ${{ vars.ATTIC_ENDPOINT }}
+            extra-substituters = https://nixcache.cy7.sh
-          cache: ${{ vars.ATTIC_CACHE }}
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-          token: ${{ secrets.ATTIC_TOKEN }}
+            post-build-hook = /etc/nix/upload-to-cache.sh
-      - name: Restore and cache Nix store
+
-        uses: nix-community/cache-nix-action@v5.1.0
+      - name: build
-        with:
+        run: |
-          # restore and save a cache using this key
+          nix run nixpkgs#nixos-rebuild build -- -L --flake ".#${{ matrix.machine }}"
-          primary-key: nix-${{ runner.os }}-${{ matrix.machine }}-${{ hashFiles('**/*.nix', 'flake.lock') }}
+
-          # if there's no cache hit, restore a cache by this prefix
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ matrix.machine }}-
-          # do purge caches
-          purge: true
-          # purge all versions of the cache
-          purge-prefixes: nix-${{ runner.os }}-
-          # created more than this number of seconds ago relative to the start of the `Post Restore` phase
-          purge-last-accessed: 86400
-          # except the version with the `primary-key`, if it exists
-          purge-primary-key: never
-          # always save the cache
-          save-always: true
-      - run: nix build -L .#nixosConfigurations.${{ matrix.machine }}.config.system.build.toplevel
   build-homes:
     strategy:
+      fail-fast: false
       matrix:
         home:
           - yt@ytnix
@@ -76,7 +87,7 @@ jobs:
           - ubuntu-latest
           # - macos-latest
     runs-on: ${{ matrix.os }}
-    continue-on-error: true
+
     steps:
       - name: Maximize build disk space
         uses: easimon/maximize-build-space@v10
@@ -89,38 +100,44 @@ jobs:
           remove-codeql: 'true'
           remove-docker-images: 'true'
           build-mount-path: /nix
-      - uses: nixbuild/nix-quick-install-action@master
+
+      - name: setup binary cache key
+        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
+
       - name: Sync repository
         uses: actions/checkout@v4
         with:
           persist-credentials: false
-      - uses: cachix/cachix-action@v14
+
+      - name: post-build-hook
+        run: |
+          sudo mkdir -p /etc/nix
+          sudo cp ci/upload-to-cache.sh /etc/nix/
+          sudo chmod +x /etc/nix/upload-to-cache.sh
+
+      - name: setup s3 credentials
+        run: |
+          sudo mkdir /root/.aws
+          echo "[default]" |sudo tee /root/.aws/config |sudo tee /root/.aws/credentials
+          echo "aws_access_key_id=$AWS_ACCESS_KEY_ID" |sudo tee -a /root/.aws/credentials
+          echo "aws_secret_access_key=$AWS_SECRET_ACCESS_KEY" |sudo tee -a /root/.aws/credentials
+          echo "endpoint_url=$AWS_ENDPOINT_URL" |sudo tee -a /root/.aws/config
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@v30
         with:
-          name: cything
+          enable_kvm: true
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+          extra_nix_config: |
-          useDaemon: false
+            show-trace = true
-          installCommand: nix profile install nixpkgs#cachix
+            experimental-features = nix-command flakes
-      - name: Setup Attic cache
+            accept-flake-config = true
-        uses: ryanccn/attic-action@v0
+            system-features = nixos-test benchmark big-parallel kvm
-        with:
+            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-          endpoint: ${{ vars.ATTIC_ENDPOINT }}
+            extra-substituters = https://nixcache.cy7.sh
-          cache: ${{ vars.ATTIC_CACHE }}
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-          token: ${{ secrets.ATTIC_TOKEN }}
+            post-build-hook = /etc/nix/upload-to-cache.sh
-      - name: Restore and cache Nix store
+
-        uses: nix-community/cache-nix-action@v5.1.0
+      - name: build
-        with:
+        run: |
-          # restore and save a cache using this key
+          package=".#homeConfigurations."${{ matrix.home }}".activationPackage"
-          primary-key: nix-${{ runner.os }}-${{ matrix.home }}-${{ hashFiles('**/*.nix', 'flake.lock') }}
+          nix build -L "$package"
-          # if there's no cache hit, restore a cache by this prefix
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ matrix.home }}-
-          # do purge caches
-          purge: true
-          # purge all versions of the cache
-          purge-prefixes: nix-${{ runner.os }}-
-          # created more than this number of seconds ago relative to the start of the `Post Restore` phase
-          purge-last-accessed: 86400
-          # except the version with the `primary-key`, if it exists
-          purge-primary-key: never
-          # always save the cache
-          save-always: true
-      - run: nix build -L .#homeConfigurations."${{ matrix.home }}".activationPackage

.github/workflows/build-packages.yml

@@ -6,54 +6,64 @@ on:
         description: "package to build"
         required: false
         type: string
+
+env:
+  TERM: ansi
+  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+  AWS_SECRET_ACCESS_KEY: ${{ secrets. AWS_SECRET_ACCESS_KEY }}
+  AWS_DEFAULT_REGION: us-east-1
+  AWS_ENDPOINT_URL: https://s3.cy7.sh
+
 jobs:
   build-packages:
     strategy:
+      fail-fast: false
       matrix:
         package:
-          - github:cything/nixpkgs/928e0c6874ab3e759305e93f806a4cf559645677#alvr
-          - github:cything/nixpkgs/8929e1256ceec677dd57fce405cdaca23176399b#lact
           - ${{ inputs.package }}
         os:
           - ubuntu-latest
-          - macos-latest
           - ubuntu-24.04-arm
+          - macos-latest
+          - macos-13
     runs-on: ${{ matrix.os }}
-    continue-on-error: true
+
     steps:
+      - name: setup binary cache key
+        run: echo -n "${{ secrets.NIX_CACHE_SECRET_KEY }}" | xxd -p -r > ${{ runner.temp }}/cache-priv-key.pem
+
       - name: Install Nix
         uses: cachix/install-nix-action@v30
-      - name: Sync repository
-        uses: actions/checkout@v4
         with:
-          persist-credentials: false
+          enable_kvm: true
-      - uses: cachix/cachix-action@v14
+          extra_nix_config: |
-        with:
+            show-trace = true
-          name: cything
+            experimental-features = nix-command flakes
-          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+            accept-flake-config = true
-          useDaemon: false
+            system-features = nixos-test benchmark big-parallel kvm
-          installCommand: nix profile install nixpkgs#cachix
+            secret-key-files = ${{ runner.temp }}/cache-priv-key.pem
-      - name: Setup Attic cache
+            extra-substituters = https://nixcache.cy7.sh
-        uses: ryanccn/attic-action@v0
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
-        with:
+
-          endpoint: ${{ vars.ATTIC_ENDPOINT }}
-          cache: ${{ vars.ATTIC_CACHE }}
-          token: ${{ secrets.ATTIC_TOKEN }}
-      - name: Restore and cache Nix store
-        uses: nix-community/cache-nix-action@v5.1.0
-        with:
-          # restore and save a cache using this key
-          primary-key: nix-${{ runner.os }}-${{ matrix.package }}-${{ hashFiles('**/*.nix', 'flake.lock') }}
-          # if there's no cache hit, restore a cache by this prefix
-          restore-prefixes-first-match: nix-${{ runner.os }}-${{ matrix.package }}-
-          # do purge caches
-          purge: true
-          # purge all versions of the cache
-          purge-prefixes: nix-${{ runner.os }}-
-          # created more than this number of seconds ago relative to the start of the `Post Restore` phase
-          purge-last-accessed: 86400
-          # except the version with the `primary-key`, if it exists
-          purge-primary-key: never
-          # always save the cache
-          save-always: true
       - run: nix build -L ${{ matrix.package }}
+
+      - name: cache result
+        # https://stackoverflow.com/a/58859404
+        if: '!cancelled()'
+        run: |
+          nix run github:cything/nixcp -- \
+            push \
+            --bucket nixcache \
+            --signing-key ${{ runner.temp }}/cache-priv-key.pem \
+            -u https://nix-community.cachix.org \
+            "${{ matrix.package }}"
+
+      - name: prepare tarball to upload
+        run: nix run github:nixos/nixpkgs#gnutar hcvf result.tar result
+
+      - name: upload result
+        uses: actions/upload-artifact@v4
+        with:
+          name: ${{ matrix.os }}
+          path: result.tar
+          if-no-files-found: error

.github/workflows/update-flake-lock.yml

@@ -11,10 +11,32 @@ jobs:
   createPullRequest:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2
-      - name: Install Nix
-        uses: cachix/install-nix-action@v30
         with:
-          github_access_token: ${{ secrets.GITHUB_TOKEN }}
+          ssh-key: ${{ secrets.SSH_DEPLOY_KEY }}
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@53fb48f556dd912c4814b24ee8059a9c91c82b18
+        with:
+          enable_kvm: true
+          extra_nix_config: |
+            show-trace = true
+            experimental-features = nix-command flakes
+            accept-flake-config = true
+            system-features = nixos-test benchmark big-parallel kvm
+            secret-key-files = /home/runner/cache-priv-key.pem
+            extra-substituters = https://nixcache.cy7.sh
+            extra-trusted-public-keys = nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8=
+
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@v24
+        run: |
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+          git config --global user.name "github-actions[bot]"
+          nix flake update --commit-lock-file
+
+      - name: Create PR
+        uses: peter-evans/create-pull-request@98106d3f2b65918a6591f9e155117b7219ff7e51
+        with:
+          title: nix flake update
+          branch: update-flake-inputs
+          branch-suffix: timestamp

.sops.yaml

@@ -118,3 +118,27 @@ creation_rules:
       - age:
           - *chunk
           - *cy
+  - path_regex: secrets/services/searx.yaml
+    key_groups:
+      - age:
+          - *chunk
+          - *cy
+  - path_regex: secrets/cache-priv-key.pem
+    key_groups:
+      - age:
+          - *yt
+          - *cy
+          - *chunk
+  - path_regex: secrets/services/authelia.yaml
+    key_groups:
+      - age:
+          - *yt
+          - *cy
+          - *chunk
+  - path_regex: secrets/services/karakeep.yaml
+    key_groups:
+      - age:
+          - *yt
+          - *cy
+          - *chunk
+

README

@@ -0,0 +1 @@
+this is only open source for free ci

README.md

@@ -1,40 +0,0 @@
-# infra
-## ./home
-- [home-manager](https://github.com/nix-community/home-manager) configuration files
-- foot, tmux, and zsh are configured in Nix
-- nvim, rofi, sway, waybar are configured in their own literature and symlinked to $XDG_CONFIG_HOME with home-manager
-
-## ./hosts
-- [`hosts/common.nix`](hosts/common.nix): configuration that makes sense on all computers
-- [`hosts/zsh.nix`](hosts/zsh.nix): for computers that have the power to run zsh
-### ./hosts/ytnix
-- personal laptop
-- a single [`default.nix`](hosts/ytnix/default.nix) that could be modularized but works for now
-
-### ./hosts/chunk
-- the overworked server with 5% SLA
-- very short and concise [`default.nix`](hosts/chunk/default.nix)
-- services organized in their modules
-- some services run through `virtualisation.oci-containers`:
-    - [immich](hosts/chunk/immich.nix)
-    - [conduwuit](hosts/chunk/conduwuit.nix)
-
-### ./hosts/titan
-- got this cause chunk would go down way too often :(
-- hosted on azure for "reliability"
-- runs:
-    - [ghost](hosts/titan/ghost.nix) (through `virtualisation.oci-containers`)
-    - [uptime-kuma](hosts/titan/uptime-kuma.nix)
-    - [ntfy-sh](hosts/titan/ntfy.nix)
-
-## ./secrets
-- secrets
-- see [`.sops.yaml`](.sops.yaml) for who privy to what
-
-## backups
-- hourly borgbackup to [rsync.net](https://rsync.net)
-- see [modules/backup](modules/backup.nix)
-
-## monitoring
-- [status.cything.io](https://status.cything.io/): uptime kuma (reliable)
-- [grafana.cything.io](https://grafana.cything.io/): some real-time metrics here; unlike the status page this will go kaput often

ci/upload-to-cache.sh

@@ -0,0 +1,8 @@
+#!/bin/sh
+
+# https://nix.dev/guides/recipes/post-build-hook.html#implementing-the-build-hook
+set -eu
+set -f # disable globbing
+export IFS=' '
+echo "Uploading paths" $OUT_PATHS
+exec /nix/var/nix/profiles/default/bin/nix copy --to "s3://nixcache?endpoint=s3.cy7.sh&compression=zstd&parallel-compression=true" $OUT_PATHS

flake.nix

@@ -2,121 +2,36 @@
   description = "cy's flake";
 
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable-small";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
-    nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-24.11";
+    sops-nix.url = "github:Mic92/sops-nix";
-    sops-nix = {
+    sops-nix.inputs.nixpkgs.follows = "nixpkgs";
-      url = "github:Mic92/sops-nix";
+    home-manager.url = "github:nix-community/home-manager";
-      inputs.nixpkgs.follows = "nixpkgs";
+    home-manager.inputs.nixpkgs.follows = "nixpkgs";
-    };
+    lanzaboote.url = "github:nix-community/lanzaboote/master";
-    home-manager = {
+    lanzaboote.inputs.nixpkgs.follows = "nixpkgs";
-      url = "github:nix-community/home-manager";
+    rust-overlay.url = "github:oxalica/rust-overlay";
-      inputs.nixpkgs.follows = "nixpkgs";
+    rust-overlay.inputs.nixpkgs.follows = "nixpkgs";
-    };
+    nix-ld.url = "github:nix-community/nix-ld";
-    treefmt = {
+    nix-ld.inputs.nixpkgs.follows = "nixpkgs";
-      url = "github:numtide/treefmt-nix";
+    nil.url = "github:oxalica/nil";
-      inputs.nixpkgs.follows = "nixpkgs";
+    nil.inputs.nixpkgs.follows = "nixpkgs";
-    };
+    vscode-extensions.url = "github:nix-community/nix-vscode-extensions/";
-    disko = {
+    vscode-extensions.inputs.nixpkgs.follows = "nixpkgs";
-      url = "github:nix-community/disko/latest";
+    nix-index-database.url = "github:nix-community/nix-index-database";
-      inputs.nixpkgs.follows = "nixpkgs";
+    nix-index-database.inputs.nixpkgs.follows = "nixpkgs";
-    };
+    garage.url = "github:deuxfleurs-org/garage";
-    lanzaboote = {
+    garage.inputs.nixpkgs.follows = "nixpkgs";
-      url = "github:nix-community/lanzaboote/master";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.crane.follows = "crane";
-      inputs.flake-compat.follows = "flake-compat";
-      inputs.flake-parts.follows = "flake-parts";
-      inputs.rust-overlay.follows = "rust-overlay";
-    };
-    nixvim = {
-      url = "github:nix-community/nixvim";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-parts.follows = "flake-parts";
-      inputs.flake-compat.follows = "flake-compat";
-      inputs.home-manager.follows = "home-manager";
-      inputs.treefmt-nix.follows = "treefmt";
-    };
-    flake-parts = {
-      url = "github:hercules-ci/flake-parts";
-      inputs.nixpkgs-lib.follows = "nixpkgs";
-    };
-    niri = {
-      url = "github:sodiboo/niri-flake";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs-stable.follows = "nixpkgs";
-    };
-    rust-overlay = {
-      url = "github:oxalica/rust-overlay";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    conduwuit = {
-      url = "github:girlbossceo/conduwuit";
-      inputs = {
-        nixpkgs.follows = "nixpkgs";
-        crane.follows = "crane";
-        flake-compat.follows = "flake-compat";
-        flake-utils.follows = "flake-utils";
-      };
-    };
-    lix-module = {
-      url = "git+https://git.lix.systems/lix-project/nixos-module";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-utils.follows = "flake-utils";
-      inputs.lix.follows = "lix";
-    };
-    lix = {
-      url = "git+https://git.lix.systems/lix-project/lix";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-compat.follows = "flake-compat";
-    };
-    nix-ld = {
-      url = "github:nix-community/nix-ld";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    plasma-manager = {
-      url = "github:nix-community/plasma-manager";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.home-manager.follows = "home-manager";
-    };
-    nil = {
-      url = "github:oxalica/nil";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.rust-overlay.follows = "rust-overlay";
-      inputs.flake-utils.follows = "flake-utils";
-    };
-    vscode-extensions = {
-      url = "github:nix-community/nix-vscode-extensions";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.flake-utils.follows = "flake-utils";
-      inputs.flake-compat.follows = "flake-compat";
-    };
-
-    nvim-github-theme = {
-      url = "github:projekt0n/github-nvim-theme";
-      flake = false;
-    };
-
-    # deduplication
-    flake-utils.url = "github:numtide/flake-utils";
-    crane.url = "github:ipetkov/crane";
-    flake-compat.url = "github:edolstra/flake-compat";
   };
 
   nixConfig = {
     extra-substituters = [
-      "https://niri.cachix.org"
       "https://nix-community.cachix.org"
-      "https://cache.garnix.io"
+      "https://nixcache.cy7.sh"
-      "https://cything.cachix.org"
-      "https://aseipp-nix-cache.global.ssl.fastly.net"
     ];
     extra-trusted-public-keys = [
-      "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
       "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-      "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+      "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8="
-      "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
     ];
-    builders-use-substitutes = true;
   };
 
   outputs =
@@ -124,112 +39,70 @@
       self,
       nixpkgs,
       home-manager,
-      disko,
-      flake-parts,
       ...
     }@inputs:
-    flake-parts.lib.mkFlake { inherit inputs; } (
+      let
-      { ... }:
+        pkgs = import nixpkgs {
+          config.allowUnfree = true;
+          system = "x86_64-linux";
+          overlays = [
+            inputs.rust-overlay.overlays.default
+            inputs.vscode-extensions.overlays.default
+          ] ++ (import ./overlay { inherit inputs; });
+        };
+      in
       {
-        imports = [
+        nixosConfigurations =
-          inputs.treefmt.flakeModule
+          let
-        ];
+            lib = nixpkgs.lib;
-        debug = true;
+          in
-        systems = [
-          "x86_64-linux"
-        ];
-        perSystem =
           {
-            inputs',
+            ytnix = lib.nixosSystem {
-            ...
+              specialArgs = { inherit inputs; };
-          }:
+              modules = [
-          {
+                {
-            treefmt = {
+                  nixpkgs = { inherit pkgs; };
-              projectRootFile = "flake.nix";
+                }
-              programs.nixfmt.enable = true;
+                ./hosts/ytnix
-              programs.stylua.enable = true;
+                ./modules
-              programs.yamlfmt.enable = true;
+                inputs.sops-nix.nixosModules.sops
-              programs.typos.enable = true;
+                inputs.lanzaboote.nixosModules.lanzaboote
-              programs.shellcheck.enable = true;
+                inputs.nix-ld.nixosModules.nix-ld
-
+              ];
-              settings.global.excludes = [
+            };
-                "secrets/*"
+            chunk = lib.nixosSystem {
-                "**/*.png" # tries to format a png file
+              specialArgs = { inherit inputs; };
+              modules = [
+                {
+                  nixpkgs = { inherit pkgs; };
+                }
+                ./hosts/chunk
+                ./modules
+                inputs.sops-nix.nixosModules.sops
               ];
             };
           };
-
+        homeConfigurations =
-        flake =
           let
-            pkgs = import nixpkgs {
+            lib = home-manager.lib;
-              config.allowUnfree = true;
-              system = "x86_64-linux";
-              overlays = [
-                inputs.niri.overlays.niri
-                inputs.rust-overlay.overlays.default
-                inputs.vscode-extensions.overlays.default
-              ] ++ (import ./overlay { inherit inputs; });
-            };
           in
           {
-            nixosConfigurations =
+            "yt@ytnix" = lib.homeManagerConfiguration {
-              let
+              inherit pkgs;
-                lib = nixpkgs.lib;
+              extraSpecialArgs = { inherit inputs; };
-              in
+              modules = [
-              {
+                ./home/yt/ytnix.nix
-                ytnix = lib.nixosSystem {
+                inputs.nix-index-database.hmModules.nix-index
-                  specialArgs = { inherit inputs; };
+              ];
-                  modules = [
+            };
-                    {
-                      nixpkgs = { inherit pkgs; };
-                    }
-                    ./hosts/ytnix
-                    inputs.sops-nix.nixosModules.sops
-                    ./modules
-                    inputs.lanzaboote.nixosModules.lanzaboote
-                    inputs.niri.nixosModules.niri
-                    inputs.lix-module.nixosModules.default
-                    inputs.nix-ld.nixosModules.nix-ld
-                  ];
-                };
-                chunk = lib.nixosSystem {
-                  specialArgs = { inherit inputs; };
-                  modules = [
-                    {
-                      nixpkgs = { inherit pkgs; };
-                    }
-                    ./hosts/chunk
-                    inputs.sops-nix.nixosModules.sops
-                    ./modules
-                  ];
-                };
-              };
-            homeConfigurations =
-              let
-                lib = home-manager.lib;
-              in
-              {
-                "yt@ytnix" = lib.homeManagerConfiguration {
-                  inherit pkgs;
-                  extraSpecialArgs = { inherit inputs; };
-                  modules = [
-                    ./home/yt/ytnix.nix
-                    inputs.nixvim.homeManagerModules.nixvim
-                    inputs.niri.homeModules.config
-                    inputs.plasma-manager.homeManagerModules.plasma-manager
-                  ];
-                };
 
-                "yt@chunk" = lib.homeManagerConfiguration {
+            "yt@chunk" = lib.homeManagerConfiguration {
-                  inherit pkgs;
+              inherit pkgs;
-                  extraSpecialArgs = { inherit inputs; };
+              extraSpecialArgs = { inherit inputs; };
-                  modules = [
+              modules = [
-                    ./home/yt/chunk.nix
+                ./home/yt/chunk.nix
-                    inputs.nixvim.homeManagerModules.nixvim
+              ];
-                  ];
+            };
-                };
-              };
           };
-      }
+      };
-    );
 }

garnix.yaml

@@ -1,6 +0,0 @@
-builds:
-  include:
-    - 'nixosConfigurations.*'
-    - 'homeConfigurations.*'
-    - '*.aarch64-linux.*'
-    - '*.x86_64-linux.*'

home/codium.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 {
   programs.vscode = {
     enable = true;
@@ -16,30 +16,239 @@
           github.github-vscode-theme
           rust-lang.rust-analyzer
           shd101wyy.markdown-preview-enhanced
-          fwcd.kotlin
+          alefragnani.bookmarks
+          tomrijndorp.find-it-faster
+          streetsidesoftware.code-spell-checker
+          emilast.logfilehighlighter
+          tamasfe.even-better-toml
+          golang.go
+          ms-python.python
         ];
-      userSettings = {
+      userSettings =
-        "workbench.colorTheme" = "GitHub Dark Default";
+        let
-        "files.autoSave" = "afterDelay";
+          vimCommonKeyBindings = [
-        "nix.enableLanguageServer" = true;
+            # nice emacs bindings
-        "nix.serverPath" = "nil";
+            {
-        "editor.fontFamily" = "IBM Plex Mono";
+              "before" = [ "C-a" ];
-        "editor.fontSize" = 16;
+              "commands" = [ "cursorHome" ];
-        "editor.wordWrap" = "on";
+            }
+            {
+              "before" = [ "C-e" ];
+              "commands" = [ "cursorEnd" ];
+            }
+            {
+              "before" = [ "C-b" ];
+              "commands" = [ "cursorLeft" ];
+            }
+            {
+              "before" = [ "C-f" ];
+              "commands" = [ "cursorRight" ];
+            }
+            # ctrl+h to turn off search highlighting
+            {
+              "before" = [ "C-h" ];
+              "commands" = [ ":nohl" ];
+            }
+          ];
+        in
+        {
+          "workbench.colorTheme" = "GitHub Dark Default";
+          "workbench.startupEditor" = "none";
+          "workbench.enableExperiments" = false;
+          "files.autoSave" = "onFocusChange";
+          "editor.fontFamily" = "IBM Plex Mono";
+          "editor.fontSize" = 15;
+          "editor.minimap.enabled" = false;
+          "window.zoomLevel" = 0.5;
+          "security.promptForLocalFileProtocolHandling" = false;
+          "security.promptForRemoteFileProtocolHandling" = false;
+          "explorer.confirmDelete" = false;
+          "explorer.confirmDragAndDrop" = false;
+          "editor.acceptSuggestionOnEnter" = "off";
+          "editor.acceptSuggestionOnCommitCharacter" = false;
+          "git.openRepositoryInParentFolders" = "never";
+          "git.ignoreLimitWarning" = true;
+          "git.blame.editorDecoration.enabled" = true;
+          "extensions.ignoreRecommendations" = true;
+          "telemetry.enableTelemetry" = false;
+          "telemetry.telemetryLevel" = "off";
+          "window.titleBarStyle" = "custom";
+          "editor.formatOnSave" = true;
 
-        # vim mode settings
+          # terminal stuff
-        "vim.handleKeys" = {
+          "terminal.integrated.cursorBlinking" = true;
-          "<C-b>" = false; # file tree toggle
+          "terminal.integrated.cursorStyle" = "line";
+          "terminal.integrated.customGlyphs" = false;
+          "terminal.integrated.env.linux" = {
+            # https://github.com/tomrijndorp/vscode-finditfaster/issues/112#issuecomment-2475227546
+            FZF_DEFAULT_OPTS = "--bind ctrl-n:down,ctrl-p:up";
+          };
+          # don't let the workbench handle terminal keys like ctrl+n and friends
+          "terminal.integrated.sendKeybindingsToShell" = true;
+          "terminal.integrated.allowChords" = false;
+
+          "markdown-preview-enhanced.previewTheme" = "github-dark.css";
+          "nix.enableLanguageServer" = true;
+          "nix.serverPath" = "${lib.getExe pkgs.nil}";
+          "bookmarks.saveBookmarksInProject" = true;
+
+          "cSpell.enabledFileTypes" = {
+            "markdown" = true;
+            "*" = false;
+          };
+
+          # vim stuff
+          "vim.leader" = ",";
+          "extensions.experimental.affinity" = {
+            "vscodevim.vim" = 1;
+          };
+          "vim.sneak" = true;
+          "vim.sneakUseIgnorecaseAndSmartcase" = true;
+          "vim.enableNeovim" = true;
+          "vim.hlsearch" = true;
+          "vim.easymotion" = true;
+          "editor.lineNumbers" = "relative";
+          "vim.normalModeKeyBindings" = vimCommonKeyBindings ++ [
+            {
+              "before" = [ ";" ];
+              "after" = [ ":" ];
+              "silent" = true;
+            }
+            {
+              "before" = [
+                "<leader>"
+                "m"
+              ];
+              "commands" = [ "bookmarks.toggle" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "l"
+              ];
+              "commands" = [ "bookmarks.toggleLabeled" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "b"
+              ];
+              "commands" = [ "bookmarks.list" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "s"
+              ];
+              "commands" = [ "workbench.action.toggleSidebarVisibility" ];
+            }
+            {
+              "before" = [
+                "<space>"
+                "s"
+              ];
+              "commands" = [ "workbench.action.toggleSidebarVisibility" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "f"
+                "f"
+              ];
+              "commands" = [ "find-it-faster.findFiles" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "f"
+                "g"
+              ];
+              "commands" = [ "find-it-faster.findWithinFiles" ];
+            }
+            {
+              "before" = [
+                "<leader>"
+                "f"
+                "t"
+              ];
+              "commands" = [ "find-it-faster.findWithinFilesWithType" ];
+            }
+            # "gd" for definitions is by default
+            {
+              "before" = [
+                "g"
+                "r"
+              ];
+              "commands" = [ "editor.action.goToReferences" ];
+            }
+            # the default is weird when you need to go back within a file
+            {
+              "before" = [ "C-o" ];
+              "commands" = [ "workbench.action.navigateBack" ];
+            }
+            {
+              "before" = [ "C-i" ];
+              "commands" = [ "workbench.action.navigateForward" ];
+            }
+            # insert line without leaving normal mode
+            {
+              "before" = [
+                "<space>"
+                "o"
+              ];
+              "commands" = [ "editor.action.insertLineAfter" ];
+            }
+            {
+              "before" = [
+                "<space>"
+                "O"
+              ];
+              "commands" = [ "editor.action.insertLineBefore" ];
+            }
+          ];
+          "vim.insertModeKeyBindings" = vimCommonKeyBindings ++ [
+            {
+              "before" = [ "C-k" ];
+              "commands" = [ "acceptSelectedSuggestion" ];
+            }
+          ];
+          "vim.visualModeKeyBindings" = vimCommonKeyBindings ++ [
+            {
+              "before" = [ ">" ];
+              "commands" = [ "editor.action.indentLines" ];
+            }
+            {
+              "before" = [ "<" ];
+              "commands" = [ "editor.action.outdentLines" ];
+            }
+          ];
         };
-        "vim.normalModeKeyBindings" = [
+      keybindings = [
-          {
+        # repeat these vim bindings here cause otherwise they get overridden by vscode
-            "before" = [ ";" ];
+        {
-            "after" = [ ":" ];
+          "key" = "ctrl+b";
-            "silent" = true;
+          "when" = "inputFocus";
-          }
+          "command" = "cursorLeft";
-        ];
+        }
-        "workbench.startupEditor" = "none";
+        {
-      };
+          "key" = "ctrl+f";
+          "when" = "inputFocus";
+          "command" = "cursorRight";
+        }
+        # clear default bindings that conflict
+        {
+          "key" = "ctrl+f";
+          "command" = "-actions.find";
+        }
+        {
+          "key" = "ctrl+b";
+          "command" = "-workbench.action.toggleSidebarVisibility";
+        }
+        {
+          "key" = "ctrl+w";
+          "command" = "-workbench.action.closeActiveEditor";
+        }
+      ];
     };
   };
 }

home/fish.nix

@@ -1,80 +0,0 @@
-{ ... }:
-{
-  programs.fish = {
-    enable = true;
-    shellAliases = {
-      "vi" = "nvim";
-      "vim" = "nvim";
-      "t" = "tmux";
-      "tl" = "tmux list-sessions";
-      "ta" = "tmux new-session -A -s";
-      "se" = "sudoedit";
-      "s" = "sudo";
-      "nrs" = "sudo nixos-rebuild switch --flake .";
-      "nrt" = "sudo nixos-rebuild test --flake .";
-      "hrs" = "home-manager switch --flake .";
-      "g" = "git";
-      "ga" = "git add";
-      "gaa" = "git add --all";
-      "gb" = "git branch";
-      "gc" = "git commit --verbose";
-      "gcmsg" = "git commit --message";
-      "gd" = "git diff";
-      "gdca" = "git diff --cached";
-      "gds" = "git diff --staged";
-      "gl" = "git log --stat";
-      "glg" = "git log --graph";
-      "glga" = "git log --graph --decorate --all";
-      "glo" = "git log --oneline --decorate";
-      "gp" = "git push";
-      "gr" = "git remote";
-      "gra" = "git remote add";
-      "grv" = "git remote --verbose";
-      "gs" = "git status --short";
-      "gss" = "git status";
-    };
-
-    shellInit = ''
-      set fish_greeting
-    '';
-
-    functions = {
-      fish_prompt = ''
-        set -l last_status $status
-        set -l normal (set_color normal)
-        set -l status_color (set_color brgreen)
-        set -l cwd_color (set_color $fish_color_cwd)
-        set -l vcs_color (set_color brpurple)
-        set -l prompt_status ""
-
-        # Since we display the prompt on a new line allow the directory names to be longer.
-        set -q fish_prompt_pwd_dir_length
-        or set -lx fish_prompt_pwd_dir_length 0
-
-        # Color the prompt differently when we're root
-        set -l suffix '❯'
-        if functions -q fish_is_root_user; and fish_is_root_user
-            if set -q fish_color_cwd_root
-                set cwd_color (set_color $fish_color_cwd_root)
-            end
-            set suffix '#'
-        end
-
-        # Color the prompt in red on error
-        if test $last_status -ne 0
-            set status_color (set_color $fish_color_error)
-            set prompt_status $status_color "[" $last_status "]" $normal
-        end
-
-        echo -s (prompt_login) ' ' $cwd_color (prompt_pwd) $vcs_color (fish_vcs_prompt) $normal ' ' $prompt_status
-        echo -n -s $status_color $suffix ' ' $normal
-      '';
-
-    };
-  };
-
-  programs.fzf.enableFishIntegration = true;
-  programs.zoxide.enableFishIntegration = true;
-  programs.eza.enableFishIntegration = true;
-  programs.nix-index.enableFishIntegration = true;
-}

home/foot.nix

@@ -1,55 +0,0 @@
-{ ... }:
-{
-  programs.foot = {
-    enable = true;
-    settings = {
-      main = {
-        font = "IBM Plex Mono:size=8";
-        dpi-aware = "yes";
-      };
-      bell = {
-        urgent = "no";
-        notify = "no";
-        visual = "no";
-      };
-      cursor = {
-        style = "beam";
-        blink = "yes";
-        blink-rate = 500;
-        beam-thickness = 1.5;
-        color = "161821 c6c8d1";
-      };
-      mouse = {
-        hide-when-typing = "yes";
-      };
-      colors = {
-        foreground = "c6c8d1";
-        background = "161821";
-        regular0 = "1e2132";
-        regular1 = "e27878";
-        regular2 = "b4be82";
-        regular3 = "e2a478";
-        regular4 = "84a0c6";
-        regular5 = "a093c7";
-        regular6 = "89b8c2";
-        regular7 = "c6c8d1";
-        bright0 = "6b7089";
-        bright1 = "e98989";
-        bright2 = "c0ca8e";
-        bright3 = "e9b189";
-        bright4 = "91acd1";
-        bright5 = "ada0d3";
-        bright6 = "95c4ce";
-        bright7 = "d2d4de";
-        selection-foreground = "161821";
-        selection-background = "c6c8d1";
-      };
-
-      key-bindings = {
-        clipboard-copy = "Control+Shift+c XF86Copy";
-        clipboard-paste = "Control+Shift+v XF86Paste";
-        quit = "Control+q";
-      };
-    };
-  };
-}

home/ghostty.nix

@@ -1,20 +0,0 @@
-{ ... }:
-{
-  programs.ghostty = {
-    enable = true;
-    enableZshIntegration = true;
-    clearDefaultKeybinds = true;
-    settings = {
-      theme = "iceberg-dark";
-      font-family = "IBM Plex Mono";
-      font-size = "12";
-      window-decoration = false;
-      confirm-close-surface = false;
-      keybind = [
-        "ctrl+q=quit"
-        "ctrl+shift+c=copy_to_clipboard"
-        "ctrl+shift+v=paste_from_clipboard"
-      ];
-    };
-  };
-}

home/kitty.nix

@@ -7,7 +7,6 @@
       package = pkgs.ibm-plex;
       size = 12;
     };
-    themeFile = "GitHub_Dark";
     settings = {
       enable_audio_bell = true;
       # how many windows should be open before kitty asks
@@ -17,10 +16,11 @@
 
       # will probably lower this later but the max allowed is actually 4GB
       # this is NOT stored in memory and can only be viewed with scrollback_pager
-      "scrollback_pager_history_size" = "1024";
+      "scrollback_pager_history_size" = "10"; # in MB
       # see https://github.com/sharkdp/bat/issues/1077#issuecomment-652785399
       "scrollback_pager" = "bat --pager='less -FR +G'";
-      "scrollback_lines" = 20000;
+      # "scrollback_lines" = 20000;
+      wheel_scroll_multiplier = 50;
     };
     keybindings = {
       # kitty_mod is ctrl+shift by default
@@ -47,24 +47,38 @@
       "ctrl+alt+s" = "goto_layout stack";
       "kitty_mod+enter" = "new_window_with_cwd";
       "kitty_mod+r" = "resize_window";
+      # this closes the *current* window, not the *OS* window
+      # https://sw.kovidgoyal.net/kitty/overview/#tabs-and-windows
+      "kitty_mod+w" = "close_window";
 
       # tabs
       "kitty_mod+n" = "next_tab";
       "kitty_mod+p" = "previous_tab";
       "kitty_mod+alt+n" = "move_tab_forward";
       "kitty_mod+alt+p" = "move_tab_backward";
-      "kitty_mod+w" = "close_tab";
+      "kitty_mod+q" = "close_tab";
       "kitty_mod+t" = "new_tab_with_cwd";
-      "ctrl+f2" = "detach_tab";
 
       # hints
       # > basically means the preceding key is a prefix (think tmux)
       "kitty_mod+o>o" = "open_url_with_hints";
-      "kitty_mod+o>p" = "kitten hints --type path --program -";
+      # `--program @` means copy to clipboard
-      "kitty_mod+o>n" = "kitten hints --type line --program -";
+      "kitty_mod+o>u" = "kitten hints --type url --program @";
-      "kitty_mod+o>w" = "kitten hints --type word --program -";
+      "kitty_mod+o>p" = "kitten hints --type path --program @";
-      "kitty_mod+o>h" = "kitten hints --type hash --program -";
+      "kitty_mod+o>n" = "kitten hints --type line --program @";
+      "kitty_mod+o>w" = "kitten hints --type word --program @";
+      "kitty_mod+o>h" = "kitten hints --type hash --program @";
       "kitty_mod+o>l" = "kitten hints --type linenum";
+
+      # scrolling
+      "kitty_mod+u" = "scroll_page_up";
+      "kitty_mod+d" = "scroll_page_down";
+      "kitty_mod+a" = "scroll_home";
+      "kitty_mod+e" = "scroll_end";
+      "kitty_mod+z" = "scroll_to_prompt -1"; # scroll to previous shell prompt
+      "kitty_mod+x" = "scroll_to_prompt 1"; # scroll to next shell prompt
+      "kitty_mod+y" = "show_scrollback"; # browse scrollback buffer in pager
+      "kitty_mod+g" = "show_last_command_output"; # browse output of last command in pager
     };
   };
 

home/niri/default.nix

@@ -1,210 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  wallpaper = "${./nixos-c-book.png}";
-  terminal = "kitty";
-  menu = [
-    "fuzzel"
-    "-w"
-    "100"
-  ];
-  browser = "librewolf";
-  file-manager = "thunar";
-  clipboard = "cliphist list | ${lib.concatStringsSep " " menu} --dmenu | cliphist decode | wl-copy";
-in
-{
-  programs.niri.settings = {
-    prefer-no-csd = true;
-    input.keyboard.xkb.options = "ctrl:nocaps";
-    spawn-at-startup = [
-      { command = [ "${lib.getExe pkgs.waybar}" ]; }
-      {
-        command = [
-          "${lib.getExe pkgs.swaybg}"
-          "-m"
-          "fill"
-          "-i"
-          wallpaper
-        ];
-      }
-      { command = [ "${lib.getExe pkgs.xwayland-satellite}" ]; }
-      {
-        command = [
-          "wl-paste"
-          "--watch"
-          "cliphist"
-          "store"
-        ];
-      }
-    ];
-    hotkey-overlay.skip-at-startup = true;
-
-    input = {
-      touchpad = {
-        tap = true;
-        dwt = true;
-        natural-scroll = true;
-        click-method = "clickfinger";
-      };
-      warp-mouse-to-focus = false;
-      focus-follows-mouse.enable = false;
-    };
-
-    environment = {
-      DISPLAY = ":0"; # for xwayland-satellite
-      ANKI_WAYLAND = "1";
-    };
-
-    layout = {
-      gaps = 0;
-      focus-ring = {
-        width = 4;
-        active.color = "#4c7899";
-        inactive.color = "#333333";
-      };
-      always-center-single-column = true;
-      border.enable = false;
-    };
-
-    window-rules = [
-      {
-        matches = [
-          { app-id = "mpv"; }
-          { app-id = "Bitwarden"; }
-          {
-            app-id = "ghidra-Ghidra";
-            # pop-up windows
-            title = "^win(.*)";
-          }
-        ];
-        open-floating = true;
-      }
-      {
-        matches = [
-          {
-            app-id = "anki";
-            title = "Add";
-          }
-        ];
-        default-column-width.proportion = .25;
-      }
-      {
-        matches = [
-          { app-id = "foot"; }
-          {
-            app-id = "anki";
-            title = "^Browse";
-          }
-          { app-id = "com.mitchellh.ghostt"; }
-          { app-id = "org.kde.okular"; }
-          { app-id = "kitty"; }
-          { app-id = "VSCodium"; }
-        ];
-        default-column-width.proportion = .5;
-      }
-      {
-        matches = [ { app-id = "librewolf"; } ];
-        default-column-width.proportion = .75;
-      }
-    ];
-  };
-
-  programs.niri.settings.binds =
-    with config.lib.niri.actions;
-    let
-      sh = spawn "sh" "-c";
-    in
-    {
-      "Mod+Return".action = spawn terminal;
-      "Mod+D".action = spawn menu;
-
-      "Mod+Shift+E".action = quit;
-      "Mod+Equal".action = set-column-width "+10%";
-      "Mod+Minus".action = set-column-width "-10%";
-      "Mod+Shift+Equal".action = set-window-height "+10%";
-      "Mod+Shift+Minus".action = set-window-height "-10%";
-      "Super+Alt+L".action = spawn "swaylock";
-      "Mod+Ctrl+Q".action = close-window;
-      "Mod+H".action = focus-column-left;
-      "Mod+L".action = focus-column-right;
-      "Mod+K".action = focus-window-up;
-      "Mod+J".action = focus-window-down;
-      "Mod+Shift+H".action = move-column-left;
-      "Mod+Shift+L".action = move-column-right;
-      "Mod+Shift+K".action = move-window-up;
-      "Mod+Shift+J".action = move-window-down;
-      "Mod+U".action = focus-workspace-up;
-      "Mod+I".action = focus-workspace-down;
-      "Mod+Shift+U".action = move-window-to-workspace-up;
-      "Mod+Shift+I".action = move-window-to-workspace-down;
-      "Mod+W".action = maximize-column;
-      "Mod+E".action = set-column-width "50%";
-      "Mod+R".action = set-column-width "75%";
-      "Mod+Q".action = set-column-width "25%";
-      "Mod+C".action = center-column;
-      "Mod+Shift+Space".action = toggle-window-floating;
-      "Mod+Space".action = switch-focus-between-floating-and-tiling;
-      "Print".action = screenshot;
-      "Alt+Print".action = screenshot-window;
-      "Ctrl+Print".action = screenshot-screen;
-      # "Mod+R".action = switch-preset-column-width;
-      "Mod+Shift+R".action = switch-preset-window-height;
-      "Mod+Ctrl+R".action = reset-window-height;
-      "Mod+F".action = fullscreen-window;
-      "Mod+WheelScrollDown" = {
-        cooldown-ms = 150;
-        action = focus-column-right;
-      };
-      "Mod+WheelScrollUp" = {
-        cooldown-ms = 150;
-        action = focus-column-left;
-      };
-      "Mod+Shift+WheelScrollDown" = {
-        cooldown-ms = 150;
-        action = focus-workspace-down;
-      };
-      "Mod+Shift+WheelScrollUp" = {
-        cooldown-ms = 150;
-        action = focus-workspace-up;
-      };
-
-      "XF86AudioRaiseVolume".action = sh "wpctl set-volume @DEFAULT_AUDIO_SINK@ 1%+";
-      "XF86AudioLowerVolume".action = sh "wpctl set-volume @DEFAULT_AUDIO_SINK@ 1%-";
-      "XF86AudioMute".action = sh "wpctl set-mute @DEFAULT_AUDIO_SINK@ toggle";
-      "XF86MonBrightnessUp".action = sh "brightnessctl set 1%+";
-      "XF86MonBrightnessDown".action = sh "brightnessctl set 1%-";
-
-      "Mod+1".action = focus-workspace 1;
-      "Mod+2".action = focus-workspace 2;
-      "Mod+3".action = focus-workspace 3;
-      "Mod+4".action = focus-workspace 4;
-      "Mod+5".action = focus-workspace 5;
-      "Mod+6".action = focus-workspace 6;
-      "Mod+7".action = focus-workspace 7;
-      "Mod+8".action = focus-workspace 8;
-      "Mod+9".action = focus-workspace 9;
-      "Mod+Shift+1".action = move-column-to-workspace 1;
-      "Mod+Shift+2".action = move-column-to-workspace 2;
-      "Mod+Shift+3".action = move-column-to-workspace 3;
-      "Mod+Shift+4".action = move-column-to-workspace 4;
-      "Mod+Shift+5".action = move-column-to-workspace 5;
-      "Mod+Shift+6".action = move-column-to-workspace 6;
-      "Mod+Shift+7".action = move-column-to-workspace 7;
-      "Mod+Shift+8".action = move-column-to-workspace 8;
-      "Mod+Shift+9".action = move-column-to-workspace 9;
-
-      "Mod+Alt+B".action = spawn browser;
-      "Mod+Alt+A".action = spawn "anki";
-      "Mod+Alt+F".action = spawn file-manager;
-      "Mod+Alt+E".action = spawn "evolution";
-      "Mod+P".action = spawn "bitwarden";
-      "Mod+Comma".action = sh clipboard;
-
-      "MouseForward".action = spawn "sh" "${./scripts/remote.sh}" "btn1";
-      "MouseBack".action = spawn "sh" "${./scripts/remote.sh}";
-    };
-}

home/niri/scripts/remote.sh

@@ -1,25 +0,0 @@
-#!/usr/bin/env bash
-
-active_window=$(niri msg --json focused-window |jq -r .app_id)
-
-if [ "$1" = "btn1" ]; then
-  if [ "$active_window" = "anki" ]; then
-    wtype " "
-  elif [ "$active_window" = "kitty" ]; then
-    wtype -M ctrl -M shift -k c -m ctrl -m shift
-  elif [ "$active_window" = "chromium-browser" ] || [ "$active_window" = "librewolf" ]; then
-    wtype -M alt -P right -p right -m alt
-  else
-    wtype -M ctrl -k c -m ctrl
-  fi
-else
-  if [ "$active_window" = "anki" ]; then
-    wtype "1"
-  elif [ "$active_window" = "kitty" ]; then
-    wtype -M ctrl -M shift -k v -m ctrl
-  elif [ "$active_window" = "chromium-browser" ] || [ "$active_window" = "librewolf" ]; then
-    wtype -M alt -P left -p left -m alt
-  else
-    wtype -M ctrl -k v -m ctrl
-  fi
-fi

home/nixvim/default.nix

@@ -1,256 +0,0 @@
-{ pkgs, inputs, ... }:
-{
-  programs.nixvim = {
-    enable = true;
-    plugins.lualine.enable = true;
-    opts = {
-      number = true;
-      relativenumber = true;
-      expandtab = true;
-      autoindent = true;
-      shiftwidth = 2;
-      smartindent = true;
-      tabstop = 2;
-      ignorecase = true;
-      incsearch = true;
-      smartcase = true;
-    };
-    colorscheme = "github_dark_tritanopia";
-    clipboard.register = "unnamed";
-
-    globals = {
-      mapleader = ",";
-    };
-
-    extraPlugins = [
-      (pkgs.vimUtils.buildVimPlugin {
-        name = "github-theme";
-        src = inputs.nvim-github-theme;
-      })
-    ];
-
-    keymaps = [
-      {
-        action = "<cmd>Neotree toggle<CR>";
-        key = "<space>s";
-        mode = "n";
-        options.silent = true;
-      }
-      {
-        # shortcut to command mode
-        action = ":";
-        key = ";";
-        mode = [
-          "n"
-          "x"
-        ];
-        options.silent = true;
-      }
-      {
-        # insert line below without moving cursor
-        action = "printf('m`%so<ESC>``', v:count1)";
-        key = "<space>o";
-        options.expr = true;
-        mode = "n";
-      }
-      {
-        # insert line above without moving cursor
-        action = "printf('m`%sO<ESC>``', v:count1)";
-        key = "<space>O";
-        options.expr = true;
-        mode = "n";
-      }
-      # nice emacs bindings
-      {
-        action = "<HOME>";
-        key = "<C-a>";
-        mode = "i";
-      }
-      {
-        action = "<END>";
-        key = "<C-e>";
-        mode = "i";
-      }
-      # quick chat with copilot
-      {
-        key = "<leader>ccq";
-        action.__raw = ''
-          function()
-            local input = vim.fn.input("Quick chat: ")
-            if input ~= "" then
-              require("CopilotChat").ask(input, { selection = require("CopilotChat.select").buffer })
-            end
-          end
-        '';
-        mode = [
-          "n"
-          "v"
-        ];
-      }
-      # ask perplexity a quick question
-      {
-        key = "<leader>ccs";
-        action.__raw = ''
-          function()
-            local input = vim.fn.input("Perplexity: ")
-            if input ~= "" then
-              require("CopilotChat").ask(input, {
-                agent = "perplexityai",
-                selection = false,
-              })
-            end
-          end
-        '';
-        mode = [
-          "n"
-          "v"
-        ];
-      }
-    ];
-
-    plugins.cmp = {
-      enable = true;
-      settings = {
-        formatting.fields = [
-          "abbr"
-          "kind"
-          "menu"
-        ];
-        experimental = {
-          ghost_text = true;
-        };
-        snippet.expand = ''
-          function(args) require('luasnip').lsp_expand(args.body) end
-        '';
-        sources = [
-          { name = "nvim_lsp"; }
-          { name = "emoji"; }
-          { name = "luasnip"; }
-          { name = "buffer"; }
-          { name = "path"; }
-        ];
-        mapping = {
-          "<C-h>" = "cmp.mapping.abort()";
-          "<C-n>" = "cmp.mapping.select_next_item()";
-          "<C-p>" = "cmp.mapping.select_prev_item()";
-          "<C-u>" = "cmp.mapping.scroll_docs(-4)";
-          "<C-d>" = "cmp.mapping.scroll_docs(4)";
-          "<C-k>" = ''
-            cmp.mapping(function(fallback)
-              if cmp.visible() then
-                if require("luasnip").expandable() then
-                  require("luasnip").expand()
-                else
-                  cmp.confirm({
-                    select = true,
-                  })
-                end
-              else
-                fallback()
-              end
-            end)
-          '';
-          # plain tab conflicts with i try to indent
-          "<C-Tab>" = ''
-            cmp.mapping(function(fallback)
-              if require("luasnip").jumpable(1) then
-                require("luasnip").jump(1)
-              else
-                fallback()
-              end
-            end,{"i","s"})
-          '';
-          "<S-Tab>" = ''
-            cmp.mapping(function(fallback)
-              if require("luasnip").jumpable(-1) then
-                require("luasnip").jump(-1)
-              else
-                fallback()
-              end
-            end,{"i","s"})
-          '';
-        };
-      };
-    };
-
-    plugins.lsp = {
-      enable = true;
-      keymaps.lspBuf = {
-        "K" = "hover";
-        "gd" = "definition";
-        "gD" = "references";
-        # "gt" = "type_definition"; # conflicts with switch tab
-        "gI" = "type_definition";
-        "gi" = "implementation";
-      };
-      servers = {
-        bashls.enable = true;
-        lua_ls.enable = true;
-        nil_ls = {
-          enable = true;
-          settings = {
-            formatting.command = [
-              "nix"
-              "fmt"
-            ];
-            nix.flake.autoArchive = true;
-          };
-        };
-        rust_analyzer = {
-          enable = true;
-          installRustc = true;
-          installCargo = true;
-        };
-        eslint.enable = true;
-      };
-    };
-    plugins.treesitter = {
-      enable = true;
-      nixGrammars = true;
-      settings = {
-        indent.enable = true;
-        auto_install = true;
-        highlight.enable = true;
-      };
-    };
-    plugins.fzf-lua = {
-      enable = true;
-      profile = "fzf-native";
-      keymaps = {
-        "<leader>ff" = "files";
-        "<leader>fg" = "live_grep";
-      };
-    };
-
-    plugins.neo-tree = {
-      enable = true;
-      buffers.followCurrentFile.enabled = true;
-      window.width = 30;
-    };
-
-    plugins.gitsigns = {
-      enable = true;
-      settings.current_line_blame = true;
-    };
-
-    plugins.copilot-chat = {
-      enable = true;
-      settings = {
-        model = "claude-3.5-sonnet";
-      };
-    };
-
-    plugins.cmp-buffer.enable = true;
-    plugins.cmp-emoji.enable = true;
-    plugins.cmp-nvim-lsp.enable = true;
-    plugins.cmp-path.enable = true;
-    plugins.cmp_luasnip.enable = true;
-    plugins.luasnip.enable = true;
-    plugins.nvim-autopairs.enable = true;
-    plugins.rainbow-delimiters.enable = true;
-    plugins.web-devicons.enable = true;
-    plugins.auto-save.enable = true;
-    plugins.indent-blankline.enable = true;
-    plugins.undotree.enable = true;
-  };
-}

home/rofi/config.rasi

@@ -1,156 +0,0 @@
-configuration {
-    modes: "drun,run,emoji:rofimoji,clipboard:/home/yt/.config/rofi/scripts/cliphist.sh";
-    font: "hack 12";
-/*	location: 0;*/
-/*	yoffset: 0;*/
-/*	xoffset: 0;*/
-/*	fixed-num-lines: true;*/
-  	show-icons: true;
-  	terminal: "kitty";
-/*	ssh-client: "ssh";*/
-/*	ssh-command: "{terminal} -e {ssh-client} {host} [-p {port}]";*/
-/*	run-command: "{cmd}";*/
-/*	run-list-command: "";*/
-/*	run-shell-command: "{terminal} -e {cmd}";*/
-/*	window-command: "wmctrl -i -R {window}";*/
-/*	window-match-fields: "all";*/
-  	icon-theme: "Papirus";
-/*	drun-match-fields: "name,generic,exec,categories,keywords";*/
-/*	drun-categories: ;*/
-/*	drun-show-actions: false;*/
-/*	drun-display-format: "{name} [<span weight='light' size='small'><i>({generic})</i></span>]";*/
-/*	drun-url-launcher: "xdg-open";*/
-/*	disable-history: false;*/
-/*	ignored-prefixes: "";*/
-/*	sort: false;*/
-/*	sorting-method: "normal";*/
-/*	case-sensitive: false;*/
-/*	cycle: true;*/
-/*	sidebar-mode: false;*/
-/*	hover-select: false;*/
-/*	eh: 1;*/
-/*	auto-select: false;*/
-/*	parse-hosts: false;*/
-/*	parse-known-hosts: true;*/
-  	combi-modes: "window,run,calc,filebrowser";
-/*	matching: "normal";*/
-/*	tokenize: true;*/
-/*	m: "-5";*/
-/*	filter: ;*/
-/*	dpi: -1;*/
-/*	threads: 0;*/
-/*	scroll-method: 0;*/
-/*	window-format: "{w}    {c}   {t}";*/
-/*	click-to-exit: true;*/
-/*	global-kb: false;*/
-/*	max-history-size: 25;*/
-/*	combi-hide-mode-prefix: false;*/
-/*	combi-display-format: "{mode} {text}";*/
-/*	matching-negate-char: '-' /* unsupported */;*/
-/*	cache-dir: ;*/
-/*	window-thumbnail: false;*/
-/*	drun-use-desktop-cache: false;*/
-/*	drun-reload-desktop-cache: false;*/
-/*	normalize-match: false;*/
-/*	steal-focus: false;*/
-/*	application-fallback-icon: ;*/
-/*	refilter-timeout-limit: 300;*/
-/*	xserver-i300-workaround: false;*/
-/*	completer-mode: "recursivebrowser";*/
-/*	pid: "/run/user/1000/rofi.pid";*/
-/*	display-window: ;*/
-/*	display-run: ;*/
-/*	display-ssh: ;*/
-/*	display-drun: ;*/
-/*	display-combi: ;*/
-/*	display-keys: ;*/
-/*	display-filebrowser: ;*/
-/*	display-recursivebrowser: ;*/
-/*	kb-primary-paste: "Control+V,Shift+Insert";*/
-/*	kb-secondary-paste: "Control+v,Insert";*/
-/*	kb-secondary-copy: "Control+c";*/
-/*	kb-clear-line: "Control+w";*/
-/*	kb-move-front: "Control+a";*/
-/*	kb-move-end: "Control+e";*/
-/*	kb-move-word-back: "Alt+b,Control+Left";*/
-/*	kb-move-word-forward: "Alt+f,Control+Right";*/
-/*	kb-move-char-back: "Left,Control+b";*/
-/*	kb-move-char-forward: "Right,Control+f";*/
-/*	kb-remove-word-back: "Control+Alt+h,Control+BackSpace";*/
-/*	kb-remove-word-forward: "Control+Alt+d";*/
-/*	kb-remove-char-forward: "Delete,Control+d";*/
-/*	kb-remove-char-back: "BackSpace,Shift+BackSpace,Control+h";*/
-/*	kb-remove-to-eol: "Control+k";*/
-/*	kb-remove-to-sol: "Control+u";*/
-/*	kb-accept-entry: "Control+j,Control+m,Return,KP_Enter";*/
-/*	kb-accept-custom: "Control+Return";*/
-/*	kb-accept-custom-alt: "Control+Shift+Return";*/
-/*	kb-accept-alt: "Shift+Return";*/
-/*	kb-delete-entry: "Shift+Delete";*/
-/*	kb-mode-next: "Shift+Right,Control+Tab";*/
-/*	kb-mode-previous: "Shift+Left,Control+ISO_Left_Tab";*/
-/*	kb-mode-complete: "Control+l";*/
-/*	kb-row-left: "Control+Page_Up";*/
-/*	kb-row-right: "Control+Page_Down";*/
-/*	kb-row-up: "Up,Control+p";*/
-/*	kb-row-down: "Down,Control+n";*/
-/*	kb-row-tab: "";*/
-/*	kb-element-next: "Tab";*/
-/*	kb-element-prev: "ISO_Left_Tab";*/
-/*	kb-page-prev: "Page_Up";*/
-/*	kb-page-next: "Page_Down";*/
-/*	kb-row-first: "Home,KP_Home";*/
-/*	kb-row-last: "End,KP_End";*/
-/*	kb-row-select: "Control+space";*/
-/*	kb-screenshot: "Alt+S";*/
-/*	kb-ellipsize: "Alt+period";*/
-/*	kb-toggle-case-sensitivity: "grave,dead_grave";*/
-/*	kb-toggle-sort: "Alt+grave";*/
-/*	kb-cancel: "Escape,Control+g,Control+bracketleft";*/
-/*	kb-custom-1: "Alt+1";*/
-/*	kb-custom-2: "Alt+2";*/
-/*	kb-custom-3: "Alt+3";*/
-/*	kb-custom-4: "Alt+4";*/
-/*	kb-custom-5: "Alt+5";*/
-/*	kb-custom-6: "Alt+6";*/
-/*	kb-custom-7: "Alt+7";*/
-/*	kb-custom-8: "Alt+8";*/
-/*	kb-custom-9: "Alt+9";*/
-/*	kb-custom-10: "Alt+0";*/
-/*	kb-custom-11: "Alt+exclam";*/
-/*	kb-custom-12: "Alt+at";*/
-/*	kb-custom-13: "Alt+numbersign";*/
-/*	kb-custom-14: "Alt+dollar";*/
-/*	kb-custom-15: "Alt+percent";*/
-/*	kb-custom-16: "Alt+dead_circumflex";*/
-/*	kb-custom-17: "Alt+ampersand";*/
-/*	kb-custom-18: "Alt+asterisk";*/
-/*	kb-custom-19: "Alt+parenleft";*/
-/*	kb-select-1: "Super+1";*/
-/*	kb-select-2: "Super+2";*/
-/*	kb-select-3: "Super+3";*/
-/*	kb-select-4: "Super+4";*/
-/*	kb-select-5: "Super+5";*/
-/*	kb-select-6: "Super+6";*/
-/*	kb-select-7: "Super+7";*/
-/*	kb-select-8: "Super+8";*/
-/*	kb-select-9: "Super+9";*/
-/*	kb-select-10: "Super+0";*/
-/*	kb-entry-history-up: "Control+Up";*/
-/*	kb-entry-history-down: "Control+Down";*/
-/*	ml-row-left: "ScrollLeft";*/
-/*	ml-row-right: "ScrollRight";*/
-/*	ml-row-up: "ScrollUp";*/
-/*	ml-row-down: "ScrollDown";*/
-/*	me-select-entry: "MousePrimary";*/
-/*	me-accept-entry: "MouseDPrimary";*/
-/*	me-accept-custom: "Control+MouseDPrimary";*/
-  timeout {
-      action: "kb-cancel";
-      delay:  0;
-  }
-  filebrowser {
-      directories-first: true;
-      sorting-method:    "name";
-  }
-}

home/rofi/scripts/cliphist.sh

@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-
-tmp_dir="/tmp/cliphist"
-rm -rf "$tmp_dir"
-
-if [[ -n "$1" ]]; then
-    cliphist decode <<<"$1" | wl-copy
-    exit
-fi
-
-mkdir -p "$tmp_dir"
-
-read -r -d '' prog <<EOF
-/^[0-9]+\s<meta http-equiv=/ { next }
-match(\$0, /^([0-9]+)\s(\[\[\s)?binary.*(jpg|jpeg|png|bmp)/, grp) {
-    system("echo " grp[1] "\\\\\t | cliphist decode >$tmp_dir/"grp[1]"."grp[3])
-    print \$0"\0icon\x1f$tmp_dir/"grp[1]"."grp[3]
-    next
-}
-1
-EOF
-cliphist list | gawk "$prog"

home/sway/config

@@ -1,156 +0,0 @@
-set $mod Mod4
-set $alt Mod1
-set $left h
-set $down j
-set $up k
-set $right l
-
-set $term $HOME/.config/sway/scripts/terminal.sh
-set $menu rofi -show run
-set $screenshot grim -g "$(slurp)" - | wl-copy
-set $browser librewolf
-set $clipboard rofi -show clipboard -show-icons
-set $emoji rofi -show emoji
-
-set $font_family DejaVu Sans Mono
-set $font_size 11
-set $bg #000000
-set $fg #ffffff
-set $fgi #888888
-
-set $wallpaper $HOME/wallpapers/nixos-c-book-large.png
-set $lock swaylock -f -i $wallpaper
-output * bg $wallpaper fill
-
-floating_modifier $mod normal
-default_border pixel
-smart_borders on
-focus_follows_mouse always
-# mouse_warping container
-
-bindsym $mod+Return exec $term
-bindsym $mod+Ctrl+q kill
-bindsym $mod+d exec $menu
-bindsym $mod+Shift+c reload
-bindsym $mod+Shift+e exec swaynag -t warning -m 'You pressed the exit shortcut. Do you really want to exit sway? This will end your Wayland session.' -B 'Yes, exit sway' 'swaymsg exit'
-bindsym Print exec $screenshot
-bindsym $mod+comma exec $clipboard
-bindsym $mod+period exec $emoji
-
-bindsym $mod+$alt+b exec $browser
-bindsym $mod+$alt+a exec anki
-bindsym $mod+$alt+f exec thunar
-bindsym $mod+$alt+e exec evolution
-bindsym $mod+p exec bitwarden
-bindsym $mod+$alt+m exec element-desktop
-
-bindsym $mod+$left focus left
-bindsym $mod+$down focus down
-bindsym $mod+$up focus up
-bindsym $mod+$right focus right
-
-bindsym $mod+Shift+$left move left
-bindsym $mod+Shift+$down move down
-bindsym $mod+Shift+$up move up
-bindsym $mod+Shift+$right move right
-
-bindsym $mod+1 workspace number 1
-bindsym $mod+2 workspace number 2
-bindsym $mod+3 workspace number 3
-bindsym $mod+4 workspace number 4
-bindsym $mod+5 workspace number 5
-bindsym $mod+6 workspace number 6
-bindsym $mod+7 workspace number 7
-bindsym $mod+8 workspace number 8
-bindsym $mod+9 workspace number 9
-bindsym $mod+0 workspace number 10
-
-bindsym $mod+Shift+1 move container to workspace number 1
-bindsym $mod+Shift+2 move container to workspace number 2
-bindsym $mod+Shift+3 move container to workspace number 3
-bindsym $mod+Shift+4 move container to workspace number 4
-bindsym $mod+Shift+5 move container to workspace number 5
-bindsym $mod+Shift+6 move container to workspace number 6
-bindsym $mod+Shift+7 move container to workspace number 7
-bindsym $mod+Shift+8 move container to workspace number 8
-bindsym $mod+Shift+9 move container to workspace number 9
-bindsym $mod+Shift+0 move container to workspace number 10
-
-# mouse side buttons
-bindsym --whole-window BTN_EXTRA exec ~/.config/sway/scripts/remote.sh btn1
-bindsym --whole-window BTN_SIDE exec ~/.config/sway/scripts/remote.sh
-
-bindsym $mod+b splith
-bindsym $mod+v splitv
-
-bindsym $mod+s layout stacking
-bindsym $mod+w layout tabbed
-bindsym $mod+e layout toggle split
-
-bindsym $mod+f fullscreen
-
-bindsym $mod+Shift+space floating toggle
-
-bindsym $mod+space focus mode_toggle
-
-bindsym $mod+a focus parent
-bindsym $mod+Shift+a focus child
-
-bindsym $mod+Shift+minus move scratchpad
-bindsym $mod+minus scratchpad show
-
-mode "resize" {
-    bindsym $left resize shrink width 10px
-    bindsym $down resize grow height 10px
-    bindsym $up resize shrink height 10px
-    bindsym $right resize grow width 10px
-    bindsym Return mode "default"
-    bindsym Escape mode "default"
-}
-bindsym $mod+r mode "resize"
-
-# keys to adjust volue and brightness
-bindsym --locked XF86AudioMute exec "amixer -q sset Master,0 toggle"
-bindsym --locked XF86AudioLowerVolume exec "amixer -q set Master 1%-"
-bindsym --locked XF86AudioRaiseVolume exec "amixer -q sset Master 1%+"
-bindsym --locked XF86MonBrightnessDown exec brightnessctl set 1%-
-bindsym --locked XF86MonBrightnessUp exec brightnessctl set 1%+
-
-# lockscreen
-bindsym $mod+Control+l exec $lock
-
-font pango:$font_family $font_size
-
-for_window [app_id=mpv] inhibit_idle visible, floating enable, sticky enable
-for_window [app_id="LibreWolf" title="^Extension"] floating enable
-for_window [floating] border csd
-for_window [app_id="Bitwarden"] floating enable
-for_window [app_id=anki title="Add"] floating enable
-
-bar {
-	swaybar_command waybar
-}
-
-input "type:touchpad" {
-    dwt enabled
-    tap enabled
-    natural_scroll enabled
-}
-
-input "type:keyboard" {
-  xkb_layout us
-  xkb_options ctrl:nocaps
-  xkb_numlock enabled
-}
-
-exec wl-paste --watch cliphist store
-exec mako >> $HOME/mako.log 2>&1
-exec dbus-update-activation-environment --all
-
-exec swayidle -w \
-  timeout 300 'swaymsg "output * power off"' \
-  timeout 305 $lock \
-  resume 'swaymsg "output * power on"' \
-  before-sleep 'playerctl pause; swaylock -f'
-
-exec system-dnotify --ready

home/sway/scripts/remote.sh

@@ -1,27 +0,0 @@
-#!/usr/bin/env bash
-
-active_window=$(swaymsg -t get_tree |jq -r '..|try select(.focused == true) |.app_id')
-
-if [ "$1" = "btn1" ]; then
-  if [ "$active_window" = "anki" ]; then
-    wtype " "
-  elif [ "$active_window" = "foot" ]; then
-    wtype -M ctrl -M shift -k c -m ctrl -m shift
-  elif [ "$active_window" = "chromium-browser" ] || [ "$active_window" = "librewolf" ]; then
-    wtype -M alt -P right -p right -m alt
-  else
-    wtype -M ctrl -k c -m ctrl
-  fi
-else
-  if [ "$active_window" = "anki" ]; then
-    wtype "1"
-  elif [ "$active_window" = "foot" ]; then
-    wtype -M ctrl -M shift -k v
-    wtype -m ctrl
-  elif [ "$active_window" = "chromium-browser" ] || [ "$active_window" = "librewolf" ]; then
-    wtype -M alt -P left -p left -m alt
-  else
-    wtype -M ctrl -k v
-    wtype -m ctrl
-  fi
-fi

home/sway/scripts/terminal.sh

@@ -1,14 +0,0 @@
-#!/usr/bin/env bash
-
-focused_workspace=$(swaymsg -t get_workspaces | jq '.[] | select(.focused == true) | .num')
-
-foot_window_count=$(swaymsg -t get_tree | jq --argjson workspace "$focused_workspace" '[recurse(.nodes[]?) | select(.type == "workspace" and .num == $workspace) | recurse(.nodes[]?) | select(.app_id == "foot")] | length')
-
-next_session=$((focused_workspace * 10))
-
-if [ "$foot_window_count" -gt 0 ]
-then
-  next_session=$((next_session + foot_window_count))
-fi
-
-foot tmux new-session -A -s ${next_session}

home/waybar/config

@@ -1,81 +0,0 @@
-{
-  "layer": "top", // Waybar on highest layer so tooltips go over windows
-    "output": "eDP-1", // Set output to primary monitor
-    "height": 40, // Set height to avoid jumping due to active workspace indicator
-		
-		"margin-left": 0,
-		"margin-right": 0,
-		"margin-top": 0,
-    "modules-left": ["niri/workspaces", "clock#time", "clock#date", "battery"], // Sets modules for the left of the bar
-    "modules-center": ["niri/window"], // Set modules for the center of the bar
-    "modules-right": ["tray", "temperature", "cpu", "memory", "wireplumber"], // Set modules for the right of the bar
-    "clock#time": {
-    "format": "<span color=\"#7aa2f7\"> </span>{:%H:%M:%S}",
-    "interval": 1,
-  },
-  "clock#date": {
-    "format": "<span color=\"#7aa2f7\"> </span>{:%Y/%m/%d}",
-    "tooltip-format": "<tt>{calendar}</tt>",
-    "interval": 360,
-    "calendar": {
-      "mode": "month",
-      "mode-mon-col": 4,
-      "weeks-pos": "right",
-      "on-scroll": 1,
-      "on-click-right": "mode",
-      "format": {
-        "months": "<span color='#c0caf5'><b>{}</b></span>",
-        "days": "<span color='#c0caf5'><b>{}</b></span>",
-        "weeks": "<span color='#7dcfff'><b>W{}</b></span>",
-        "weekdays": "<span color='#ff9e64'><b>{}</b></span>",
-        "today": "<span color='#f7768e'><b><u>{}</u></b></span>",
-      },
-    },
-  },
-  "battery": {
-    "interval": 60,
-    "states": {
-      "warning": 40,
-      "critical": 20,
-    },
-    "format": "{icon} {capacity}%",
-    "format-icons": [
-      "<span color=\"#f7768e\"> </span>",
-      "<span color=\"#f7768e\"> </span>",
-      "<span color=\"#7aa2f7\"> </span>",
-      "<span color=\"#7aa2f7\"> </span>",
-      "<span color=\"#7aa2f7\"> </span>",
-    ],
-    "format-charging": "<span color=\"#e0af68\">󱐌</span> {capacity}%",
-  },
-  "cpu": {
-    "format": "<span color=\"#7aa2f7\"> </span>{usage}%",
-    "interval": 4,
-  },
-  "memory": {
-    "format": "<span color=\"#7aa2f7\"> </span>{used}GiB",
-    "interval": 4,
-  },
-  "temperature": {
-    "hwmon-path": "/sys/class/hwmon/hwmon4/temp1_input",
-    "critical-threshold": 80,
-    "format": "<span color=\"#7aa2f7\"> </span>{temperatureC}°C",
-    "format-critical": "<span color=\"#f7768e\"> </span>{temperatureC}°C",
-    "interval": 4,
-  },
-  "wireplumber": {
-    "scroll-step": 1, // %, can be a float
-    "format": "<span color=\"#7aa2f7\">{icon} </span>{volume}%",
-    "format-muted": "<span color=\"#f7768e\">󰝟 </span>Muted",
-    "format-icons": ["", "", ""],
-    "on-click": "pavucontrol",
-		"interval": 4,
-  },
-  "niri/window": {
-    "max-length": 64,
-  },
-  "tray": {
-    "icon-size": 22,
-    "spacing": 6,
-  }
-}

home/waybar/style.css

@@ -1,70 +0,0 @@
-.module,
-#clock.date,
-#clock.time,
-#workspaces button {
-  background: transparent;
-  padding: 0 10px;
-  font-family: RobotoMono Nerd Font;
-  font-weight: 900;
-  font-size: 13pt;
-  color: #c0caf5;
-}
-
-/* main waybar */
-window#waybar {
-  background: rgba(26, 27, 38, 1);
-	border: 2px solid #414868;
-}
-
-/* when hovering over modules */
-tooltip {
-  background: #1e1e2e;
-  border-radius: 0;
-}
-
-#workspaces {
-	padding-right: 0;
-}
-
-#workspaces button {
-  padding: 2px;
-}
-
-#clock {
-	padding-right: 100px;
-}
-
-
-/* Sets active workspace to have a solid line on the bottom */
-#workspaces button.focused {
-  border-bottom: 2px solid #7aa2f7;
-  border-radius: 0;
-	margin-top: 0px;
-  transition: none;
-}
-
-/* More workspace stuff for highlighting on hover */
-#workspaces button.focused {
-  color: #a6adc8;
-}
-
-#workspaces button.urgent {
-  color: #f7768e;
-}
-
-#workspaces button:hover {
-  background: #11111b;
-  color: #cdd6f4;
-}
-
-/* Hide window module when not focused on window or empty workspace */
-window#waybar.empty #window {
-  padding: 0;
-  margin: 0;
-  opacity: 0;
-}
-
-/* Set up rounding to make these modules look like separate pills */
-#tray {
-  margin-right: 4px;
-}

home/yt/chunk.nix

@@ -14,8 +14,4 @@
   programs.home-manager.enable = true;
 
   systemd.user.startServices = "sd-switch";
-
-  home.packages = with pkgs; [
-    attic-server
-  ];
 }

home/yt/codespace.nix

@@ -1,22 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    ./common.nix
-  ];
-  home = {
-    username = "codespace";
-    homeDirectory = "/home/codespace";
-    stateVersion = "24.05";
-  };
-  programs.home-manager.enable = true;
-
-  systemd.user.startServices = "sd-switch";
-
-  home.packages = with pkgs; [
-    foot.terminfo
-    attic-client
-  ];
-}

home/yt/common.nix

@@ -3,7 +3,6 @@
   imports = [
     ../tmux.nix
     ../zsh
-    ../nixvim
   ];
 
   home.sessionVariables = {
@@ -60,12 +59,17 @@
       "mergetool \"vimdiff\"".cmd = "nvim -d $LOCAL $REMOTE $MERGED -c '$wincmd w' -c 'wincmd J'";
       url = {
         "ssh://git@github.com/" = {
-          insteadOf = "https://github.com/";
+          insteadOf = [
+            "https://github.com/"
+            "github:"
+            "gh:"
+          ];
         };
       };
     };
   };
   programs.ripgrep.enable = true;
-  programs.man.generateCaches = true;
+  # programs.man.generateCaches = true; # slows down eval
   programs.fd.enable = true;
+  news.display = "silent";
 }

home/yt/ytnix.nix

@@ -6,8 +6,6 @@
 {
   imports = [
     ./common.nix
-    ../foot.nix
-    ../niri
     ../irssi.nix
     ../kitty.nix
     ../codium.nix
@@ -19,30 +17,6 @@
   };
   programs.home-manager.enable = true;
 
-  systemd.user.startServices = "sd-switch";
-
-  # keep this commented when using plasma
-  # otherwise "system settings" in KDE will not function
-  # qt = {
-  #   enable = true;
-  #   platformTheme.name = "kde";
-  #   style.name = "breeze-dark";
-  #   style.package = pkgs.kdePackages.breeze;
-  # };
-
-  # this one too
-  # gtk = {
-  #   enable = true;
-  #   theme = {
-  #     package = pkgs.adw-gtk3;
-  #     name = "adw-gtk3-dark";
-  #   };
-  #   iconTheme = {
-  #     package = pkgs.adwaita-icon-theme;
-  #     name = "Adwaita";
-  #   };
-  # };
-
   home.pointerCursor = {
     package = pkgs.bibata-cursors;
     name = "Bibata-Modern-Classic";
@@ -51,123 +25,118 @@
     x11.enable = true;
   };
 
-  home.packages = with pkgs; [
+  home.packages =
-    firefox
+    with pkgs;
-    ungoogled-chromium
+    lib.flatten [
-    librewolf
+      ungoogled-chromium
-    bitwarden-desktop
+      librewolf
-    bitwarden-cli
+      bitwarden-desktop
-    fastfetch
+      bitwarden-cli
-    nwg-look
+      fastfetch
-    kdePackages.gwenview
+      (with kdePackages; [
-    kdePackages.okular
+        gwenview
-    kdePackages.qtwayland
+        okular
-    mpv
+      ])
-    yt-dlp
+      mpv
-    signal-desktop
+      signal-desktop
-    pavucontrol
+      btop
-    btop
+      jq
-    grim
+      sqlite
-    slurp
+      usbutils
-    rofi-wayland
+      calibre
-    rofimoji
+      tor-browser
-    cliphist
+      wtype
-    jq
+      bat
-    bash-language-server
+      rclone
-    sqlite
+      go
-    usbutils
+      (rust-bin.selectLatestNightlyWith (
-    clang-tools
+        toolchain:
-    calibre
+        toolchain.default.override {
-    tor-browser
+          extensions = [ "rust-src" ];
-    wtype
+        }
-    bat
+      ))
-    yarn
+      pwgen
-    rclone
+      gnumake
-    go
+      unzip
-    rustup
+      anki-bin
-    pwgen
+      trezorctl
-    lua-language-server
+      q
-    gnumake
+      gdb
-    foot
+      fuzzel
-    minisign
+      hugo
-    unzip
+      ghidra
-    lm_sensors
+      sccache
-    sshfs
+      awscli2
-    gopls
+      (cutter.withPlugins (
-    anki-bin
+        p: with p; [
-    trezorctl
+          rz-ghidra
-    trezor-agent
+          jsdec
-    q
+          sigdb
-    opentofu
+        ]
-    terraform-ls
+      ))
-    gdb
+      p7zip
-    clang
+      qbittorrent
-    seahorse
+      android-tools
-    github-cli
+      frida-tools
-    fuzzel
+      mitmproxy
-    nixpkgs-review
+      (python313.withPackages (
-    just
+        p: with p; [
-    hugo
+          python-lsp-server
-    ghidra
+          pip
-    sequoia
+          virtualenv
-    sccache
+        ]
-    awscli2
+      ))
-    lldb
+      jadx
-    (cutter.withPlugins (
+      scrcpy
-      p: with p; [
+      syncthing
-        rz-ghidra
+      syncthingtray
-        jsdec
+      (with llvmPackages; [
-        sigdb
+        clangUseLLVM
-      ]
+        compiler-rt
-    ))
+        libllvm
-    ida-free
+      ])
-    patchelf
+      nix-output-monitor
-    radare2
+      wl-clipboard-rs
-    p7zip
+      pixelflasher
-    qbittorrent
+      cinny-desktop
-    # vscodium
+      freetube
-    nil
+      gopls
-    pkg-config
+      rust-analyzer
-    gtk2
+      minio-client
-    gtk2-x11
+      nil
-    android-tools
+      keepassxc
-    frida-tools
+    ];
-    mitmproxy
+
-    openssl
+  home.sessionVariables = {
-    (python313.withPackages (
+    # to make ghidra work on xwayland
-      p: with p; [
+    _JAVA_AWT_WM_NONREPARENTING = 1;
-        python-lsp-server
+
-        pip
+    # sccache stuff
-        virtualenv
+    RUSTC_WRAPPER = "${lib.getExe pkgs.sccache}";
-      ]
+    SCCACHE_BUCKET = "sccache";
-    ))
+    SCCACHE_REGION = "us-east-1";
-    telegram-desktop
+    SCCACHE_ENDPOINT = "https://s3.cy7.sh";
-    jadx
+    SCCACHE_ALLOW_CORE_DUMPS = "true";
-    gradle
+    SCCACHE_S3_USE_SSL = "true";
-    localsend
+    SCCACHE_CACHE_MULTIARCH = "true";
-    scrcpy
+    SCCACHE_LOG = "warn";
-    syncthing
+    AWS_DEFAULT_REGION = "us-east-1";
+    AWS_ENDPOINT_URL = "https://s3.cy7.sh";
+    AWS_ACCESS_KEY_ID = "$(cat /run/secrets/aws/key_id)";
+    AWS_SECRET_ACCESS_KEY = "$(cat /run/secrets/aws/key_secret)";
+  };
+
+  home.sessionPath = [
+    "$HOME/.cargo/bin"
+    "$HOME/go/bin"
   ];
 
-  programs.waybar.enable = true;
   programs.feh.enable = true;
 
   xdg.configFile = {
-    rofi.source = ../rofi;
-    waybar.source = ../waybar;
     mpv.source = ../mpv;
   };
 
-  programs.newsboat = {
-    enable = true;
-    extraConfig = ''
-      urls-source "miniflux"
-      miniflux-url "https://rss.cything.io/"
-      miniflux-login "cy"
-      miniflux-passwordfile /run/secrets/newsboat/miniflux
-    '';
-  };
-
   programs.direnv = {
     enable = true;
     nix-direnv.enable = true;
@@ -175,29 +144,24 @@
 
   programs.git.extraConfig = {
     user = {
-      signingKey = "~/.ssh/id.key";
+      signingKey = "~/.ssh/id_ed25519";
     };
     gpg.format = "ssh";
     commit.gpgsign = true;
-    core.sshCommand = "ssh -i ~/.ssh/id.key";
   };
 
-  home.sessionVariables = {
+  programs.nix-index-database.comma.enable = true;
-    # to make ghidra work on xwayland
-    _JAVA_AWT_WM_NONREPARENTING = 1;
 
-    # sccache stuff
+  programs.neovim = {
-    RUSTC_WRAPPER = "${lib.getExe pkgs.sccache}";
+    enable = true;
-    SCCACHE_BUCKET = "sccache";
+    viAlias = true;
-    SCCACHE_REGION = "earth";
+    vimAlias = true;
-    SCCACHE_ENDPOINT = "https://sccache.s3.cy7.sh";
-    SCCACHE_ALLOW_CORE_DUMPS = "true";
-    SCCACHE_S3_USE_SSL = "true";
-    SCCACHE_CACHE_MULTIARCH = "true";
-    SCCACHE_LOG_LEVEL = "warn";
-    AWS_DEFAULT_REGION = "us-east-1";
-    AWS_ENDPOINT_URL = "https://s3.cy7.sh";
-    AWS_ACCESS_KEY_ID = "$(cat /run/secrets/aws/key_id)";
-    AWS_SECRET_ACCESS_KEY = "$(cat /run/secrets/aws/key_secret)";
   };
+
+  programs.ssh = {
+    enable = true;
+    addKeysToAgent = "yes";
+  };
+
+  programs.firefox.enable = true;
 }

home/zsh/default.nix

@@ -51,6 +51,7 @@
       bindkey -M viins "^E" end-of-line
       bindkey -M viins "^A" beginning-of-line
       bindkey -M viins "^B" backward-char
+      bindkey -M viins "^F" forward-char
 
       # accept one word completion
       bindkey -M viins "^S" forward-word
@@ -89,8 +90,8 @@
       "ta" = "tmux new-session -A -s";
       "se" = "sudoedit";
       "s" = "sudo";
-      "nrs" = "sudo nixos-rebuild switch -L --flake .";
+      "nrs" = "sudo nixos-rebuild switch -L --flake . --log-format internal-json -v |& nom --json";
-      "nrt" = "sudo nixos-rebuild test -L --flake .";
+      "nrt" = "sudo nixos-rebuild test -L --flake . --log-format internal-json -v |& nom --json";
       "hrs" = "home-manager switch -L --flake .";
       "g" = "git";
       "ga" = "git add";
@@ -111,12 +112,13 @@
       "grv" = "git remote --verbose";
       "gs" = "git status --short";
       "gss" = "git status";
+      "code" = "codium";
     };
   };
 
   programs.fzf.enableZshIntegration = true;
   programs.zoxide.enableZshIntegration = true;
   programs.eza.enableZshIntegration = true;
-  programs.nix-index.enableZshIntegration = false;
+  programs.nix-index.enableZshIntegration = true;
-  programs.direnv.enableZshIntegration = false;
+  programs.direnv.enableZshIntegration = true;
 }

hosts/chunk/adguard.nix

@@ -1,29 +0,0 @@
-{ ... }:
-{
-  services.adguardhome = {
-    enable = true;
-    host = "127.0.0.1";
-    port = 8082;
-    settings = {
-      http.port = "8083";
-      users = [
-        {
-          name = "cy";
-          password = "$2y$10$BZy2zYJj5z4e8LZCq/GwuuhWUafL/MNFO.YcsAMmpDS.2krPxi7KC";
-        }
-      ];
-      # do not listen eveywhere cause podman runs it's own DNS
-      dns.bind_hosts = [
-        "127.0.0.1"
-        "::1"
-        "31.59.129.225"
-        "2a0f:85c1:840:2bfb::1"
-      ];
-    };
-  };
-
-  services.caddy.virtualHosts."dns.cything.io".extraConfig = ''
-    import common
-    reverse_proxy localhost:8082
-  '';
-}

hosts/chunk/attic.nix

@@ -1,33 +0,0 @@
-{ config, ... }:
-{
-  services.atticd = {
-    enable = true;
-
-    environmentFile = config.sops.secrets."attic/env".path;
-
-    settings = {
-      listen = "[::]:8090";
-      api-endpoint = "https://cache.cy7.sh/";
-      allowed-hosts = [ "cache.cy7.sh" ];
-      require-proof-of-possession = false;
-      compression.type = "zstd";
-      database.url = "postgresql:///atticd?host=/run/postgresql";
-
-      storage = {
-        type = "s3";
-        region = "auto";
-        bucket = "attic";
-        endpoint = "https://e3e97aac307d106a7becea43cef8fcbd.r2.cloudflarestorage.com";
-      };
-
-      garbage-collection = {
-        default-retention-period = "2 weeks";
-      };
-    };
-  };
-
-  services.caddy.virtualHosts."cache.cy7.sh".extraConfig = ''
-    import common
-    reverse_proxy localhost:8090
-  '';
-}

hosts/chunk/conduit.nix

@@ -1,40 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-{
-  virtualisation.oci-containers.containers.conduit = {
-    image = "ghcr.io/girlbossceo/conduwuit:main";
-    autoStart = true;
-    ports = [ "127.0.0.1:8448:8448" ];
-    pull = "newer";
-    environment = {
-      CONDUWUIT_SERVER_NAME = "cything.io";
-      CONDUWUIT_DATABASE_PATH = "/var/lib/conduwuit";
-      CONDUWUIT_PORT = "8448";
-      CONDUWUIT_MAX_REQUEST_SIZE = "20000000"; # in bytes ~20MB
-      CONDUWUIT_ALLOW_REGISTRATION = "false";
-      CONDUWUIT_ALLOW_FEDERATION = "true";
-      CONDUWUIT_ALLOW_CHECK_FOR_UPDATES = "true";
-      CONDUWUIT_TRUSTED_SERVERS = ''["matrix.org"]'';
-      CONDUWUIT_ADDRESS = "0.0.0.0";
-      # CONDUIT_CONFIG = "";
-    };
-    volumes = [
-      "/opt/conduit/db:/var/lib/conduwuit/"
-    ];
-    networks = [ "conduit-net" ];
-  };
-
-  systemd.services.create-conduit-net = {
-    serviceConfig.Type = "oneshot";
-    wantedBy = with config.virtualisation.oci-containers; [
-      "${backend}-conduit.service"
-    ];
-    script = ''
-      ${pkgs.podman}/bin/podman network exists conduit-net || \
-      ${pkgs.podman}/bin/podman network create conduit-net
-    '';
-  };
-}

hosts/chunk/conduwuit.nix

@@ -1,33 +0,0 @@
-{ ... }:
-{
-  services.conduwuit = {
-    enable = true;
-    settings.global = {
-      port = [ 8448 ];
-      server_name = "cything.io";
-      allow_check_for_updates = true;
-    };
-  };
-
-  services.caddy.virtualHosts."chat.cything.io".extraConfig = ''
-    import common
-    reverse_proxy localhost:8448
-  '';
-
-  services.caddy.virtualHosts."cything.io" = {
-    serverAliases = [ "www.cything.io" ];
-    extraConfig = ''
-      import common
-
-      header /.well-known/matrix/* Content-Type application/json
-      header /.well-known/matrix/* Access-Control-Allow-Origin *
-      header /.well-known/matrix/* Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH,HEAD
-      header /.well-known/matrix/* Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization,Origin,Accept
-      route {
-        respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
-        respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
-        redir https://cy7.sh/posts{uri} permanent
-      }
-    '';
-  };
-}

hosts/chunk/default.nix

@@ -16,14 +16,10 @@
     ./redlib.nix
     ./vaultwarden.nix
     ./grafana.nix
-    ./conduwuit.nix
     ./immich.nix
-    ./element.nix
-    ./attic.nix
     ./forgejo.nix
     ./garage.nix
     ./tailscale.nix
-    ./tor.nix
   ];
 
   sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@@ -31,9 +27,6 @@
     "borg/rsyncnet" = {
       sopsFile = ../../secrets/borg/chunk.yaml;
     };
-    "services/ntfy" = {
-      sopsFile = ../../secrets/services/ntfy.yaml;
-    };
     "rclone/config" = {
       sopsFile = ../../secrets/rclone.yaml;
     };
@@ -52,17 +45,14 @@
     "rsyncnet/id_ed25519" = {
       sopsFile = ../../secrets/zh5061/chunk.yaml;
     };
-    "attic/env" = {
-      sopsFile = ../../secrets/services/attic.yaml;
-    };
     "garage/env" = {
       sopsFile = ../../secrets/services/garage.yaml;
     };
     "tailscale/auth" = {
       sopsFile = ../../secrets/services/tailscale.yaml;
     };
-    "zipline/env" = {
+    "karakeep/env" = {
-      sopsFile = ../../secrets/services/zipline.yaml;
+      sopsFile = ../../secrets/services/karakeep.yaml;
     };
   };
 
@@ -75,74 +65,69 @@
   system.stateVersion = "24.05";
 
   # network stuff
+  networking = {
+    hostName = "chunk";
+    networkmanager.enable = true;
+    firewall = {
+      enable = true;
+      trustedInterfaces = [ "tailscale0" ];
+      allowedTCPPorts = [
+        22
+        80
+        443
+      ];
+      allowedUDPPorts = [
+        443
+      ];
+      extraCommands =
+        let
+          ethtool = lib.getExe pkgs.ethtool;
+          tc = lib.getExe' pkgs.iproute2 "tc";
+        in
+        ''
+          # disable TCP segmentation offload (https://wiki.archlinux.org/title/Advanced_traffic_control#Prerequisites)
+          ${ethtool} -K ens18 tso off
 
-  networking.hostName = "chunk";
+          # clear existing rules
-  networking.networkmanager.enable = true;
+          ${tc} qdisc del dev ens18 root || true
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [
-      22
-      80
-      443
-      53
-      853
-    ];
-    allowedUDPPorts = [
-      443
-      53
-      853
-    ];
-    extraCommands =
-      let
-        ethtool = lib.getExe pkgs.ethtool;
-        tc = lib.getExe' pkgs.iproute2 "tc";
-      in ''
-      # disable TCP segmentation offload (https://wiki.archlinux.org/title/Advanced_traffic_control#Prerequisites)
-      ${ethtool} -K ens18 tso off
 
-      # clear existing rules
+          # create HTB hierarchy
-      ${tc} qdisc del dev ens18 root || true
+          ${tc} qdisc add dev ens18 root handle 1: htb default 10
+          ${tc} class add dev ens18 parent 1: classid 1:1 htb rate 100% ceil 100%
+          # rest
+          ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 60% ceil 100%
+          # caddy
+          ${tc} class add dev ens18 parent 1:1 classid 1:30 htb rate 40% ceil 100%
 
-      # create HTB hierarchy
+          # mark traffic
-      ${tc} qdisc add dev ens18 root handle 1: htb default 20
+          iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/caddy.service" -j MARK --set-mark 3
-      ${tc} class add dev ens18 parent 1: classid 1:1 htb rate 100% ceil 100%
-      ${tc} class add dev ens18 parent 1:1 classid 1:10 htb rate 40% ceil 100%
-      ${tc} class add dev ens18 parent 1:1 classid 1:20 htb rate 60% ceil 100%
 
-      # mark traffic
+          # route marked packets
-      iptables -t mangle -A OUTPUT -m cgroup --path "system.slice/tailscaled.service" -j MARK --set-mark 1
+          ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 3 fw flowid 1:30
-
+        '';
-      # route marked packets
+    };
-      ${tc} filter add dev ens18 parent 1: protocol ip prio 1 handle 1 fw flowid 1:10
+    interfaces.ens18 = {
-    '';
+      ipv6.addresses = [
-  };
+        {
-  networking.interfaces.ens18 = {
+          address = "2a0f:85c1:840:2bfb::1";
-    ipv6.addresses = [
+          prefixLength = 64;
-      {
+        }
-        address = "2a0f:85c1:840:2bfb::1";
+      ];
-        prefixLength = 64;
+      ipv4.addresses = [
-      }
+        {
-    ];
+          address = "31.59.129.225";
-    ipv4.addresses = [
+          prefixLength = 24;
-      {
+        }
-        address = "31.59.129.225";
+      ];
-        prefixLength = 24;
+    };
-      }
+    defaultGateway6 = {
-    ];
+      address = "2a0f:85c1:840::1";
-  };
+      interface = "ens18";
-  networking.defaultGateway6 = {
+    };
-    address = "2a0f:85c1:840::1";
+    defaultGateway = {
-    interface = "ens18";
+      address = "31.59.129.1";
-  };
+      interface = "ens18";
-  networking.defaultGateway = {
+    };
-    address = "31.59.129.1";
-    interface = "ens18";
-  };
-
-  i18n.defaultLocale = "en_US.UTF-8";
-  console = {
-    font = "Lat2-Terminus16";
-    useXkbConfig = true;
   };
 
   users.users.yt = {
@@ -152,13 +137,15 @@
       "podman"
     ];
     openssh.authorizedKeys.keys = [
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD yt@ytnix"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
+      "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
     ];
   };
   users.users.root.openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD yt@ytnix"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6"
+    "sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
   ];
   # for forgejo
   users.users.git = {
@@ -176,7 +163,6 @@
     tmux
     file
     sops
-    attic-server
   ];
 
   environment.variables = {
@@ -192,33 +178,13 @@
   security.sudo.enable = true;
   security.sudo.wheelNeedsPassword = false;
 
-  programs.gnupg.agent.enable = true;
   programs.git.enable = true;
 
   my.caddy.enable = true;
-  services.caddy.virtualHosts."cy7.sh" = {
+  my.containerization.enable = true;
-    serverAliases = [ "www.cy7.sh" ];
+  my.authelia.enable = true;
-    extraConfig = ''
+  my.karakeep = {
-      import common
+    enable = false;
-      redir https://cything.io temporary
+    dataDir = "/opt/karakeep";
-    '';
   };
-
-  # container stuff
-  virtualisation.containers.enable = true;
-  virtualisation.podman = {
-    enable = true;
-    # create 'docker' alias for podman, to use as
-    # drop-in replacement
-    dockerCompat = true;
-    defaultNetwork.settings = {
-      dns_enabled = true;
-      ipv6_enabled = true;
-    };
-  };
-  virtualisation.oci-containers.backend = "podman";
-  environment.enableAllTerminfo = true;
-
-  my.roundcube.enable = true;
-  my.zipline.enable = true;
 }

hosts/chunk/deluge.nix

@@ -1,15 +0,0 @@
-{ ... }:
-{
-  services.deluge = {
-    enable = true;
-    web = {
-      enable = true;
-      port = 8112;
-    };
-  };
-
-  services.caddy.virtualHosts."t.cy7.sh".extraConfig = ''
-    import common
-    reverse_proxy localhost:8112
-  '';
-}

hosts/chunk/element.nix

@@ -1,33 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-{
-  virtualisation.oci-containers.containers.element = {
-    image = "vectorim/element-web";
-    autoStart = true;
-    ports = [ "127.0.0.1:8089:8089" ];
-    pull = "newer";
-    networks = [ "element-net" ];
-    environment = {
-      ELEMENT_WEB_PORT = "8089";
-    };
-  };
-
-  systemd.services.create-element-net = {
-    serviceConfig.Type = "oneshot";
-    wantedBy = with config.virtualisation.oci-containers; [
-      "${backend}-element.service"
-    ];
-    script = ''
-      ${pkgs.podman}/bin/podman network exists element-net || \
-      ${pkgs.podman}/bin/podman network create element-net
-    '';
-  };
-
-  services.caddy.virtualHosts."element.cy7.sh".extraConfig = ''
-    import common
-    reverse_proxy localhost:8089
-  '';
-}

hosts/chunk/garage.nix

@@ -12,15 +12,20 @@
       };
       s3_web = {
         bind_addr = "[::]:3902";
-        root_domain = ".web.s3.cy7.sh";
+        root_domain = ".web.cy7.sh";
-        index = "index.html";
+        add_host_to_metrics = true;
       };
       admin.api_bind_addr = "[::]:3903";
       rpc_bind_addr = "[::]:3901";
+      rpc_public_addr = "100.122.132.30:3901";
       replication_factor = 1;
       db_engine = "lmdb";
+      disable_scrub = true;
+      block_size = "128M";
+      compression_level = "none";
     };
     environmentFile = config.sops.secrets."garage/env".path;
+    logLevel = "warn";
   };
 
   services.caddy.virtualHosts = {
@@ -31,13 +36,24 @@
         reverse_proxy localhost:3900
       '';
     };
-    "*.web.s3.cy7.sh".extraConfig = ''
-      import common
-      reverse_proxy localhost:3902
-    '';
     "admin.s3.cy7.sh".extraConfig = ''
       import common
       reverse_proxy localhost:3903
     '';
+    "*.web.cy7.sh" = {
+      serverAliases = [ "nixcache.cy7.sh" "staging.cy7.sh" ];
+      extraConfig = ''
+        import common
+        @plain {
+          host nixcache.cy7.sh nixcache.web.cy7.sh
+          path / /nix-cache-info
+        }
+        header @plain {
+          >content-type text/plain
+        }
+
+        reverse_proxy localhost:3902
+      '';
+    };
   };
 }

hosts/chunk/gitlab.nix

@@ -1,35 +0,0 @@
-{ config, ... }:
-{
-  services.gitlab = {
-    enable = true;
-    https = true;
-    host = "git.cything.io";
-    user = "git"; # so that you can ssh with git@git.cything.io
-    group = "git";
-    port = 443; # this *not* the port gitlab will run on
-    puma.workers = 0; # https://docs.gitlab.com/omnibus/settings/memory_constrained_envs.html#optimize-puma
-    sidekiq.concurrency = 5;
-    databaseUsername = "git"; # needs to be same as user
-    initialRootEmail = "hi@cything.io";
-    initialRootPasswordFile = config.sops.secrets."gitlab/root".path;
-    secrets = {
-      secretFile = config.sops.secrets."gitlab/secret".path;
-      otpFile = config.sops.secrets."gitlab/otp".path;
-      jwsFile = config.sops.secrets."gitlab/jws".path;
-      dbFile = config.sops.secrets."gitlab/db".path;
-    };
-    backup = {
-      startAt = "daily";
-      # we already postgresqlbackup.service
-      skip = [ "db" ];
-      keepTime = 48; # hours
-    };
-    extraConfig = {
-      gitlab = {
-        # NOTE: default_syntax_highlighting_theme needs to be set in the application_settings table in the database
-        default_color_mode = 2;
-      };
-      prometheus.enabled = false;
-    };
-  };
-}

hosts/chunk/grafana.nix

@@ -29,11 +29,20 @@
           }
         ];
       }
+      {
+        job_name = "garage";
+        static_configs = [
+          {
+            targets = [ "127.0.0.1:3903" ];
+          }
+        ];
+      }
     ];
   };
 
   services.caddy.virtualHosts."grafana.cy7.sh".extraConfig = ''
     import common
+    import authelia
     reverse_proxy localhost:8088
   '';
 }

hosts/chunk/hedgedoc.nix

@@ -11,7 +11,7 @@
         dialect = "postgresql";
       };
       port = 8085;
-      domain = "pad.cything.io";
+      domain = "pad.cy7.sh";
       allowEmailRegister = false;
       protocolUseSSL = true;
     };

hosts/chunk/immich.nix

@@ -1,13 +1,15 @@
 {
   pkgs,
   config,
+  lib,
   ...
 }:
 let
   uploadLocation = "/mnt/photos/immich";
-  thumbsLocation = "/opt/immich/thumbs";
+  # thumbsLocation = "/opt/immich/thumbs";
   profileLocation = "/opt/immich/profile";
   dbDataLocation = "/opt/immich/postgres";
+  backupsLocation = "/opt/immich/backups";
 in
 {
   virtualisation.oci-containers.containers = {
@@ -18,8 +20,9 @@ in
       pull = "newer";
       volumes = [
         "${uploadLocation}:/usr/src/app/upload"
-        "${thumbsLocation}:/usr/src/app/upload/thumbs"
+        # "${thumbsLocation}:/usr/src/app/upload/thumbs"
         "${profileLocation}:/usr/src/app/upload/profile"
+        "${backupsLocation}:/usr/src/app/upload/backups"
       ];
       environment = {
         REDIS_HOSTNAME = "immich-redis";
@@ -67,21 +70,9 @@ in
       ];
       networks = [ "immich-net" ];
     };
-
-    # immich-ml = {
-    #   image = "ghcr.io/immich-app/immich-machine-learning:release";
-    #   autoStart = true;
-    #   pull = "newer";
-    #   environment = {
-    #     REDIS_HOSTNAME = "immich-redis";
-    #     DB_HOSTNAME = "immich-db";
-    #   };
-    #   volumes = [ "${modelCache}:/cache" ];
-    #   networks = [ "immich-net" ];
-    # };
   };
 
-  systemd.services.create-immich-net = {
+  systemd.services.create-immich-net = rec {
     serviceConfig.Type = "oneshot";
     requiredBy = with config.virtualisation.oci-containers; [
       "${backend}-immich.service"
@@ -89,10 +80,10 @@ in
       "${backend}-immich-redis.service"
       # "${backend}-immich-ml.service"
     ];
-    before = config.systemd.services.create-immich-net.requiredBy;
+    before = requiredBy;
     script = ''
-      ${pkgs.podman}/bin/podman network exists immich-net || \
+      ${lib.getExe pkgs.podman} network exists immich-net || \
-      ${pkgs.podman}/bin/podman network create immich-net
+      ${lib.getExe pkgs.podman} network create immich-net
     '';
   };
 

hosts/chunk/jellyfin.nix

@@ -1,8 +0,0 @@
-{ ... }:
-{
-  services.jellyfin = {
-    enable = true;
-    dataDir = "/mnt/jellyfin";
-    configDir = "/var/lib/jellyfin/config";
-  };
-}

hosts/chunk/miniflux.nix

@@ -12,6 +12,7 @@
 
   services.caddy.virtualHosts."rss.cy7.sh".extraConfig = ''
     import common
+    import authelia
     reverse_proxy localhost:8080
   '';
 }

hosts/chunk/rclone.nix

@@ -4,6 +4,34 @@
   lib,
   ...
 }:
+let
+  mkServiceConfig = remote: mount: {
+    Type = "notify";
+    TimeoutSec = "5min 20s";
+    ExecStartPre = "/usr/bin/env mkdir -p ${mount}";
+    ExecStart = ''
+      ${lib.getExe pkgs.rclone} mount \
+        --config ${config.sops.secrets."rclone/config".path} \
+        --allow-other \
+        --cache-dir /var/cache/rclone \
+        --transfers 64 \
+        --vfs-cache-mode full \
+        --vfs-cache-min-free-space 5G \
+        --dir-cache-time 30d \
+        --no-checksum \
+        --no-modtime \
+        --vfs-fast-fingerprint \
+        --vfs-read-chunk-size 8M \
+        --vfs-read-chunk-streams 16 \
+        --sftp-concurrency 128 \
+        --sftp-chunk-size 255k \
+        --buffer-size 0 \
+        --write-back-cache \
+        ${remote} ${mount}
+    '';
+    ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -zu ${mount}";
+  };
+in
 {
   systemd.services.immich-mount = {
     enable = true;
@@ -12,31 +40,7 @@
     after = [ "network-online.target" ];
     requiredBy = [ "podman-immich-server.service" ];
     before = [ "podman-immich-server.service" ];
-    serviceConfig = {
+    serviceConfig = mkServiceConfig "photos:" "/mnt/photos";
-      Type = "notify";
-      ExecStartPre = "/usr/bin/env mkdir -p /mnt/photos";
-      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
-        config.sops.secrets."rclone/config".path
-      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --dir-cache-time 72h --vfs-cache-mode writes --vfs-cache-max-size 2G photos: /mnt/photos ";
-      ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/photos";
-    };
-  };
-
-  systemd.services.attic-mount = {
-    enable = true;
-    description = "Mount the attic data remote";
-    requires = [ "network-online.target" ];
-    after = [ "network-online.target" ];
-    requiredBy = [ "atticd.service" ];
-    before = [ "atticd.service" ];
-    serviceConfig = {
-      Type = "notify";
-      ExecStartPre = "/usr/bin/env mkdir -p /mnt/attic";
-      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
-        config.sops.secrets."rclone/config".path
-      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 2G --allow-other rsyncnet:attic /mnt/attic ";
-      ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/attic";
-    };
   };
 
   systemd.services.garage-mount = {
@@ -46,13 +50,6 @@
     after = [ "network-online.target" ];
     requiredBy = [ "garage.service" ];
     before = [ "garage.service" ];
-    serviceConfig = {
+    serviceConfig = mkServiceConfig "rsyncnet:garage" "/mnt/garage";
-      Type = "notify";
-      ExecStartPre = "/usr/bin/env mkdir -p /mnt/garage";
-      ExecStart = "${lib.getExe pkgs.rclone} mount --config ${
-        config.sops.secrets."rclone/config".path
-      } --cache-dir /var/cache/rclone --transfers=32 --checkers=32 --vfs-cache-mode writes --vfs-cache-max-size 5G --allow-other rsyncnet:garage /mnt/garage ";
-      ExecStop = "${lib.getExe' pkgs.fuse "fusermount"} -u /mnt/garage";
-    };
   };
 }

hosts/chunk/redlib.nix

@@ -13,6 +13,7 @@
 
   services.caddy.virtualHosts."red.cy7.sh".extraConfig = ''
     import common
+    import authelia
     reverse_proxy localhost:8087
   '';
 }

hosts/chunk/tor.nix

@@ -1,16 +0,0 @@
-{ ... }:
-{
-  services.tor = {
-    enable = true;
-    openFirewall = true;
-    relay = {
-      enable = true;
-      role = "relay";
-    };
-    settings = {
-      ORPort = 9001;
-      Nickname = "chunk";
-      # MaxAdvertisedBandwidth = "20MBytes";
-    };
-  };
-}

hosts/chunk/vaultwarden.nix

@@ -1,15 +1,6 @@
-{ config, ... }:
+{ ... }:
 {
-  services.vaultwarden = {
+  my.vaultwarden.enable = true;
-    enable = true;
-    dbBackend = "postgresql";
-    environmentFile = config.sops.secrets."vaultwarden/env".path;
-    config = {
-      ROCKET_ADDRESS = "127.0.0.1";
-      ROCKET_PORT = "8081";
-      DATABASE_URL = "postgresql://vaultwarden:vaultwarden@127.0.0.1:5432/vaultwarden";
-    };
-  };
 
   services.caddy.virtualHosts."pass.cy7.sh".extraConfig = ''
     import common

hosts/common.nix

@@ -1,6 +1,7 @@
-{ inputs, ... }:
+{ inputs, config, pkgs, ... }:
 {
   nix = {
+    package = pkgs.lix;
     settings = {
       experimental-features = "nix-command flakes";
       auto-optimise-store = true;
@@ -9,18 +10,16 @@
         "root"
         "@wheel"
       ];
-      trusted-public-keys = [
+      extra-trusted-public-keys = [
-        "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
         "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
-        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+        "nixcache.cy7.sh:DN3d1dt0wnXfTH03oVmTee4KgmdNdB0NY3SuzA8Fwx8="
-        "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
       ];
-      substituters = [
+      extra-substituters = [
-        "https://aseipp-nix-cache.global.ssl.fastly.net"
-        "https://niri.cachix.org"
         "https://nix-community.cachix.org"
-        "https://cache.garnix.io"
+        "https://nixcache.cy7.sh"
-        "https://cything.cachix.org"
+      ];
+      secret-key-files = [
+        config.sops.secrets.cache-priv-key.path
       ];
     };
     channel.enable = false;
@@ -34,41 +33,56 @@
       persistent = true;
       options = "--delete-older-than 14d";
     };
-    extraOptions = ''
-      builders-use-substitutes = true
-    '';
     registry.nixpkgs.flake = inputs.nixpkgs;
   };
 
+  i18n.defaultLocale = "en_US.UTF-8";
   time.timeZone = "America/New_York";
   networking = {
     firewall.logRefusedConnections = false;
     nameservers = [
-      # quad9
+      # quad9 (unfiltered)
-      "2620:fe::fe"
+      "2620:fe::10"
-      "2620:fe::9"
+      "2620:fe::fe:10"
-      "9.9.9.9"
+      "9.9.9.10"
-      "149.112.112.112"
+      "149.112.112.110"
     ];
     timeServers = [
+      # https://github.com/jauderho/nts-servers
+      "ntp3.fau.de"
       "ntppool1.time.nl"
-      "nts.netnod.se"
+      "ntpmon.dcs1.biz"
-      "ptbtime1.ptb.de"
+      "stratum1.time.cifelli.xyz"
-      "ohio.time.system76.com"
+      "nts.teambelgium.net"
-      "time.txryan.com"
+      "c.st1.ntp.br"
-      "time.dfm.dk"
     ];
   };
   services.chrony = {
     enable = true;
     enableNTS = true;
+    enableMemoryLocking = true;
+    extraConfig = ''
+      # Expedited Forwarding
+      dscp 46
+      # disable command port
+      cmdport 0
+      # only allow NTS
+      authselectmode require
+      # update the clock only when at least 3 sources agree on the correct time
+      minsources 3
+    '';
   };
 
-  # this is true by default and mutually exclusive with
-  # programs.nix-index
-  programs.command-not-found.enable = false;
-  programs.nix-index.enable = false; # set above to false to use this
-
   # see journald.conf(5)
   services.journald.extraConfig = "MaxRetentionSec=2d";
+
+  services.thermald.enable = true;
+  environment.enableAllTerminfo = true;
+
+  sops.secrets.cache-priv-key = {
+    format = "binary";
+    sopsFile = ../secrets/cache-priv-key.pem;
+    mode = "0440";
+    group = "users";
+  };
 }

hosts/titan/Caddyfile

@@ -1,41 +0,0 @@
-{
-  acme_ca https://acme.zerossl.com/v2/DV90
-  acme_eab {
-    key_id {$EAB_KEY_ID}
-    mac_key {$EAB_MAC_KEY}
-  }
-}
-
-(common) {
-  encode zstd gzip
-  header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
-}
-
-cything.io {
-  import common
-
-  header /.well-known/matrix/* Content-Type application/json
-  header /.well-known/matrix/* Access-Control-Allow-Origin *
-  header /.well-known/matrix/* Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH,HEAD
-  header /.well-known/matrix/* Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization,Origin,Accept
-  route {
-    respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
-    respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
-    redir https://cy7.sh/posts{uri} permanent
-  }
-}
-
-www.cything.io {
-  import common
-  redir https://cything.io{uri} permanent
-}
-
-ntfy.cything.io {
-  import common
-  reverse_proxy localhost:8083
-}
-
-status.cything.io {
-  import common
-  reverse_proxy localhost:3001
-}

hosts/titan/backup.nix

@@ -1,13 +0,0 @@
-{
-  config,
-  ...
-}:
-{
-  my.backup = {
-    enable = true;
-    jobName = "titanRsync";
-    repo = "titan";
-    passFile = config.sops.secrets."borg/rsyncnet".path;
-    sshKeyFile = config.sops.secrets."rsyncnet/id_ed25519".path;
-  };
-}

hosts/titan/default.nix

@@ -1,98 +0,0 @@
-{
-  modulesPath,
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    (modulesPath + "/installer/scan/not-detected.nix")
-    (modulesPath + "/profiles/qemu-guest.nix")
-    ../common.nix
-    ./disk-config.nix
-    ./hardware-configuration.nix
-    ./ghost.nix
-    ./ntfy.nix
-    ./uptime-kuma.nix
-    ./backup.nix
-  ];
-
-  sops.age.keyFile = "/root/.config/sops/age/keys.txt";
-  sops.secrets = {
-    "caddy/env" = {
-      sopsFile = ../../secrets/services/caddy.yaml;
-    };
-    "services/ntfy" = {
-      sopsFile = ../../secrets/services/ntfy.yaml;
-    };
-    "borg/rsyncnet" = {
-      sopsFile = ../../secrets/borg/titan.yaml;
-    };
-    "rsyncnet/id_ed25519" = {
-      sopsFile = ../../secrets/zh5061/titan.yaml;
-    };
-  };
-
-  boot = {
-    loader = {
-      systemd-boot.enable = true;
-      efi.canTouchEfiVariables = true;
-    };
-    tmp.cleanOnBoot = true;
-    kernelPackages = pkgs.linuxPackages_latest;
-  };
-
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-  };
-
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPdhAQYy0+vS+QmyCd0MAbqbgzyMGcsuuFyf6kg2yKge yt@ytlinux"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD yt@ytnix"
-  ];
-
-  system.stateVersion = "24.05";
-
-  environment.systemPackages = with pkgs; [
-    curl
-    git
-  ];
-
-  # network stuff
-  networking.hostName = "titan";
-  networking.networkmanager.enable = true;
-  networking.firewall = {
-    enable = true;
-    allowedTCPPorts = [
-      22
-      80
-      443
-    ];
-    allowedUDPPorts = [
-      443
-    ];
-  };
-
-  # container stuff
-  virtualisation.containers.enable = true;
-  virtualisation.podman = {
-    enable = true;
-    # create 'docker' alias for podman, to use as
-    # drop-in replacement
-    dockerCompat = true;
-    defaultNetwork.settings = {
-      dns_enabled = true;
-      ipv6_enabled = true;
-    };
-  };
-  virtualisation.oci-containers.backend = "podman";
-
-  services.caddy = {
-    enable = true;
-    configFile = ./Caddyfile;
-    environmentFile = config.sops.secrets."caddy/env".path;
-    logFormat = lib.mkForce "level INFO";
-  };
-}

hosts/titan/disk-config.nix

@@ -1,33 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      main = {
-        device = "/dev/sda";
-        type = "disk";
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              type = "EF00";
-              size = "500M";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-            root = {
-              size = "100%";
-              content = {
-                type = "filesystem";
-                format = "ext4";
-                mountpoint = "/";
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/titan/ghost.nix

@@ -1,52 +0,0 @@
-{
-  pkgs,
-  config,
-  ...
-}:
-{
-  virtualisation.oci-containers.containers.ghost = {
-    image = "ghost:5-alpine";
-    autoStart = true;
-    ports = [ "127.0.0.1:8084:2368" ];
-    pull = "newer";
-    environment = {
-      database__client = "mysql";
-      database__connection__host = "ghost-db";
-      database__connection__user = "root";
-      database__connection__password = "example";
-      database__connection__database = "ghost";
-      url = "https://cything.io";
-      NODE_ENV = "production";
-    };
-    volumes = [
-      "/opt/ghost/data:/var/lib/ghost/content"
-    ];
-    networks = [ "ghost-net" ];
-    dependsOn = [ "ghost-db" ];
-  };
-
-  virtualisation.oci-containers.containers.ghost-db = {
-    image = "mysql:8.0";
-    autoStart = true;
-    pull = "newer";
-    environment = {
-      MYSQL_ROOT_PASSWORD = "example";
-    };
-    volumes = [
-      "/opt/ghost/db:/var/lib/mysql"
-    ];
-    networks = [ "ghost-net" ];
-  };
-
-  systemd.services.create-ghost-net = {
-    serviceConfig.Type = "oneshot";
-    wantedBy = with config.virtualisation.oci-containers; [
-      "${backend}-ghost.service"
-      "${backend}-ghost-db.service"
-    ];
-    script = ''
-      ${pkgs.podman}/bin/podman network exists ghost-net || \
-      ${pkgs.podman}/bin/podman network create ghost-net
-    '';
-  };
-}

hosts/titan/hardware-configuration.nix

@@ -1,26 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  lib,
-  ...
-}:
-
-{
-  imports = [ ];
-
-  boot.initrd.availableKernelModules = [ "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ ];
-  boot.extraModulePackages = [ ];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.eth0.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  virtualisation.hypervGuest.enable = true;
-}

hosts/titan/ntfy.nix

@@ -1,13 +0,0 @@
-{ ... }:
-{
-  services.ntfy-sh = {
-    enable = true;
-    settings = {
-      listen-http = "127.0.0.1:8083";
-      base-url = "https://ntfy.cything.io";
-      upstream-base-url = "https://ntfy.sh";
-      auth-default-access = "deny-all";
-      behind-proxy = true;
-    };
-  };
-}

hosts/titan/uptime-kuma.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  # data stored at /var/lib/uptime-kuma/ but does not expose
-  # an option to change it
-  services.uptime-kuma = {
-    enable = true;
-    settings.PORT = "3001";
-  };
-}

hosts/ytnix/containers.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+{
+  virtualisation.oci-containers.containers = {
+    immich-ml =
+      let
+        modelCache = "/opt/immich-ml";
+      in
+      {
+        image = "ghcr.io/immich-app/immich-machine-learning:release";
+        autoStart = true;
+        pull = "newer";
+        ports = [ "3003:3003" ];
+        environment = {
+          REDIS_HOSTNAME = "immich-redis";
+          DB_HOSTNAME = "immich-db";
+        };
+        volumes = [ "${modelCache}:/cache" ];
+        networks = [ "immich-net" ];
+      };
+  };
+
+  systemd.services.create-immich-net = rec {
+    serviceConfig.Type = "oneshot";
+    requiredBy = with config.virtualisation.oci-containers; [
+      "${backend}-immich-ml.service"
+    ];
+    before = requiredBy;
+    script = ''
+      ${lib.getExe pkgs.podman} network exists immich-net || \
+      ${lib.getExe pkgs.podman} network create immich-net
+    '';
+  };
+}

hosts/ytnix/default.nix

@@ -10,6 +10,7 @@
     ../common.nix
     ../zsh.nix
     ./tailscale.nix
+    ./containers.nix
   ];
 
   sops.age.keyFile = "/root/.config/sops/age/keys.txt";
@@ -17,16 +18,9 @@
     "borg/rsyncnet" = {
       sopsFile = ../../secrets/borg/yt.yaml;
     };
-    "services/ntfy" = {
-      sopsFile = ../../secrets/services/ntfy.yaml;
-    };
     "rsyncnet/id_ed25519" = {
       sopsFile = ../../secrets/zh5061/yt.yaml;
     };
-    "newsboat/miniflux" = {
-      sopsFile = ../../secrets/newsboat.yaml;
-      owner = "yt";
-    };
     "tailscale/auth" = {
       sopsFile = ../../secrets/services/tailscale.yaml;
     };
@@ -38,16 +32,18 @@
       sopsFile = ../../secrets/yt/aws.yaml;
       owner = "yt";
     };
+    "vaultwarden/env" = {
+      sopsFile = ../../secrets/services/vaultwarden.yaml;
+    };
   };
 
   boot = {
     loader = {
       # lanzaboote replaces systemd-boot
       systemd-boot.enable = lib.mkForce false;
-      efi.canTouchEfiVariables = false; # toggle when installing
+      efi.canTouchEfiVariables = true;
     };
     tmp.cleanOnBoot = true;
-    # upgrade after https://github.com/tomaspinho/rtl8821ce/issues/356 is fixed
     kernelPackages = pkgs.linuxKernel.packages.linux_zen;
     extraModulePackages = with config.boot.kernelPackages; [
       rtl8821ce
@@ -91,13 +87,17 @@
     resolvconf.enable = true;
     firewall = {
       enable = true;
-      allowedTCPPorts = [
+      trustedInterfaces = [ "tailscale0" ];
-        8080  # mitmproxy
+      # allowedTCPPorts = [
-        22000 # syncthing
+      #   8080 # mitmproxy
-      ];
+      #   22000 # syncthing
+      #   3003 # immich-ml
+      # ];
+    };
+    hosts = {
+      "100.122.132.30" = [ "s3.cy7.sh" ];
     };
   };
-  programs.nm-applet.enable = true;
 
   security.rtkit.enable = true;
   services.pipewire = {
@@ -146,43 +146,52 @@
     "docker"
     "disk"
     "adbusers"
+    "podman"
   ];
 
-  environment.systemPackages = with pkgs; [
+  environment.systemPackages =
-    tmux
+    with pkgs;
-    vim
+    lib.flatten [
-    wget
+      tmux
-    neovim
+      vim
-    git
+      wget
-    python3
+      tree
-    wl-clipboard
+      kitty
-    # mako # sway config uses this
+      borgbackup
-    tree
+      htop
-    kitty
+      file
-    borgbackup
+      dnsutils
-    brightnessctl
+      q
-    alsa-utils
+      age
-    nixd
+      compsize
-    bluetuith
+      wireguard-tools
-    libimobiledevice
+      traceroute
-    pass-wayland
+      sops
-    htop
+      sbctl # secure boot
-    file
+      lm_sensors
-    dnsutils
+      sshfs
-    age
+      openssl
-    compsize
+      just
-    wireguard-tools
+      killall
-    traceroute
+      lshw
-    sops
+      bubblewrap
-    restic
+      fuse-overlayfs
-    haskell-language-server
+      dwarfs
-    ghc
+      wineWowPackages.stagingFull
-    sbctl # secure boot
+      (with gst_all_1; [
-    wine-wayland
+        gst-plugins-good
-    wine64
+        gst-plugins-bad
-    solaar
+        gst-plugins-ugly
-    gtk3
+        gst-plugins-base
-  ];
+      ])
+      vulkan-loader
+      (heroic.override {
+        extraPkgs = pkgs: [
+          pkgs.gamescope
+          pkgs.gamemode
+        ];
+      })
+    ];
 
   environment.sessionVariables = {
     NIXOS_OZONE_WL = "1";
@@ -203,18 +212,19 @@
     };
   };
 
-  fonts.packages = with pkgs; [
+  fonts = {
-    nerd-fonts.roboto-mono
+    packages = with pkgs; [
-    ibm-plex
+      nerd-fonts.roboto-mono
-  ];
+      ibm-plex
-  fonts.enableDefaultPackages = true;
+    ];
+    enableDefaultPackages = true;
+  };
 
   hardware.enableAllFirmware = true;
   hardware.bluetooth = {
     enable = true;
     powerOnBoot = true;
   };
-  services.blueman.enable = true;
 
   my.backup = {
     enable = true;
@@ -227,68 +237,37 @@
       "**/.wine"
       "/home/yt/Games"
       "/home/yt/Videos"
+      "/home/yt/.bitmonero"
     ];
     repo = "yt";
     passFile = config.sops.secrets."borg/rsyncnet".path;
     sshKeyFile = config.sops.secrets."rsyncnet/id_ed25519".path;
   };
 
-  services.btrbk.instances.local = {
-    onCalendar = "hourly";
-    # only create snapshots automatically. backups are triggered manually with `btrbk resume`
-    snapshotOnly = true;
-    settings = {
-      snapshot_preserve_min = "latest";
-      target_preserve = "*d";
-      target_preserve_min = "no";
-      target = "/mnt/external/btr_backup/ytnix";
-      stream_compress = "zstd";
-      stream_compress_level = "8";
-      snapshot_dir = "/snapshots";
-      subvolume = {
-        "/home" = { };
-        "/" = { };
-      };
-    };
-  };
-
   programs.steam = {
     enable = true;
     extest.enable = true;
     extraCompatPackages = with pkgs; [ proton-ge-bin ];
   };
-  hardware.steam-hardware.enable = true;
+  programs.gamescope.enable = true;
 
   services.logind = {
-    lidSwitch = "hibernate";
+    lidSwitch = "suspend";
-    powerKey = "hibernate";
+    powerKey = "poweroff";
+    suspendKey = "hibernate";
   };
 
   xdg.mime.defaultApplications = {
     "application/pdf" = "okular.desktop";
     "image/*" = "gwenview.desktop";
-    "*/html" = "chromium-browser.desktop";
   };
 
-  programs.thunar = {
+  virtualisation.libvirtd = {
     enable = true;
-    plugins = with pkgs.xfce; [
+    qemu.vhostUserPackages = with pkgs; [ virtiofsd ];
-      thunar-archive-plugin
-      thunar-volman
-    ];
-  };
-  # preference changes don't work in thunar without this
-  programs.xfconf.enable = true;
-  # mount, trash and stuff in thunar
-  services.gvfs.enable = true;
-  # thumbnails in thunar
-  services.tumbler.enable = true;
-
-  virtualisation = {
-    libvirtd.enable = true;
-    docker.enable = true;
   };
   programs.virt-manager.enable = true;
+  my.containerization.enable = true;
 
   services.usbmuxd.enable = true;
   programs.nix-ld.dev = {
@@ -302,6 +281,7 @@
       fontconfig
       libxkbcommon
       zlib
+      libz
       libxml2
       dbus
       freetype
@@ -348,6 +328,8 @@
       curl
       pcre2
       gsettings-desktop-schemas
+      fzf
+      systemd
     ];
   };
   programs.evolution.enable = true;
@@ -366,6 +348,7 @@
     enable = true;
     plugins = with pkgs.obs-studio-plugins; [
       wlrobs
+      obs-pipewire-audio-capture
     ];
   };
 
@@ -379,7 +362,7 @@
 
   services.ollama.enable = false;
 
-  services.trezord.enable = false;
+  services.trezord.enable = true;
 
   programs.niri.enable = false;
   programs.niri.package = pkgs.niri-unstable;
@@ -389,12 +372,6 @@
     SUBSYSTEM=="usb", SYSFS{idVendor}=="090c", SYSFS{idProduct}=="1000", ACTION=="add", GROUP="users", MODE="0664"
   '';
 
-  programs.ssh = {
-    askPassword = "${pkgs.seahorse}/libexec/seahorse/ssh-askpass";
-    startAgent = true;
-    enableAskPassword = true;
-  };
-
   services.desktopManager.plasma6 = {
     enable = true;
     enableQt5Integration = true;
@@ -410,8 +387,10 @@
   programs.kdeconnect.enable = true;
   programs.dconf.enable = true;
 
-  programs.java = {
+  programs.ccache.enable = true;
-    enable = true;
+  nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
-    binfmt = true;
+  programs.fuse.userAllowOther = true;
-  };
+  nix.settings.sandbox = false;
+
+  programs.ssh.startAgent = true;
 }

justfile

@@ -1,9 +1,7 @@
 update:
     git branch -D update || true
     git switch -c update
-    nix flake update
+    nix flake update --commit-lock-file
-    git add flake.lock
-    git commit -s -m "flake update"
     git push -f
     git switch main
 

modules/attic.nix

@@ -0,0 +1,72 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.attic;
+in
+{
+  options.my.attic = {
+    enable = lib.mkEnableOption "attic";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.atticd = {
+      enable = true;
+      environmentFile = config.sops.secrets."attic/env".path;
+      settings = {
+        listen = "[::]:8091";
+        api-endpoint = "https://cache.cy7.sh/";
+        allowed-hosts = [
+          "cache.cy7.sh"
+          "cdn.cy7.sh"
+        ];
+        require-proof-of-possession = false;
+        compression = {
+          type = "none";
+          level = 3;
+        };
+        database.url = "postgresql:///atticd?host=/run/postgresql";
+
+        storage = {
+          type = "s3";
+          region = "us-east-1";
+          bucket = "attic";
+          # attic must be patched to never serve pre-signed s3 urls directly
+          # otherwise it will redirect clients to this localhost endpoint
+          endpoint = "http://127.0.0.1:3900";
+        };
+
+        garbage-collection = {
+          default-retention-period = "1 month";
+        };
+
+        chunking = {
+          # disable chunking since garage does its own
+          nar-size-threshold = 0;
+          # defaults
+          min-size = 16384;
+          avg-size = 65536;
+          max-size = 262144;
+        };
+      };
+    };
+
+    systemd.services.atticd = {
+      requires = [ "garage.service" ];
+      after = [ "garage.service" ];
+      environment = {
+        RUST_LOG = "INFO";
+      };
+    };
+
+    services.caddy.virtualHosts."cache.cy7.sh" = {
+      serverAliases = [ "cdn.cy7.sh" ];
+      extraConfig = ''
+        import common
+        reverse_proxy localhost:8091
+      '';
+    };
+  };
+}

modules/authelia.nix

@@ -0,0 +1,137 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.authelia;
+  getSecret = path: config.sops.secrets.${path}.path;
+  sopsConfig = {
+    sopsFile = ../secrets/services/authelia.yaml;
+    owner = "authelia-main";
+  };
+  domain = "auth.cy7.sh";
+  varPath = "/var/lib/authelia-main";
+in
+{
+  options.my.authelia = {
+    enable = lib.mkEnableOption "authelia";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.authelia.instances.main = {
+      enable = true;
+      settings = {
+        theme = "dark";
+        default_2fa_method = "webauthn";
+        log.level = "info";
+        log.format = "text";
+        server = {
+          disable_healthcheck = true;
+          endpoints.authz.forward-auth.implementation = "ForwardAuth";
+        };
+        authentication_backend.file.path = "${varPath}/users_database.yaml";
+        access_control = {
+          default_policy = "deny";
+          rules = [
+            {
+              domain = "*.cy7.sh";
+              policy = "one_factor";
+            }
+          ];
+        };
+        session.cookies = [{
+          domain = "cy7.sh";
+          authelia_url = "https://${domain}";
+        }];
+        storage.local.path = "${varPath}/db.sqlite3";
+        notifier.filesystem.filename = "${varPath}/notifications.txt";
+        webauthn = {
+          enable_passkey_login = true;
+        };
+        identity_providers.oidc.claims_policies = {
+          # https://github.com/karakeep-app/karakeep/issues/410
+          # https://www.authelia.com/integration/openid-connect/openid-connect-1.0-claims/#restore-functionality-prior-to-claims-parameter
+          karakeep.id_token = [ "email" ];
+        };
+        identity_providers.oidc.clients = [
+          {
+            client_id = "4EIrpRb9rnwHWjYWvlz2gYrtTmoOLF1D5gqXw28BvmOS0f-9T2p4CFwuctf4Co1hkpo2sd4Y";
+            client_name = "immich";
+            client_secret = "$argon2id$v=19$m=65536,t=3,p=4$Vny2G8EbSPafSwnIuq2Zkg$eF2om4WDEaqCFmrAG27h2mYl+cXxXyttPJ7gaPLs+f8";
+            public = false;
+            authorization_policy = "two_factor";
+            redirect_uris = [
+              "https://photos.cy7.sh/auth/login"
+              "https://photos.cy7.sh/user-settings"
+              "app.immich:///oauth-callback"
+            ];
+            scopes = [ "openid" "profile" "email" ];
+            userinfo_signed_response_alg = "none";
+          }
+          {
+            client_id = "_kuUEYxyfXjInJCniwugpw2Qn6iI-YW24NOkHZG~63BAhnAACDZ.xsLqOdGghj2DNZxXR0sU";
+            client_name = "Forgejo";
+            client_secret = "$argon2id$v=19$m=65536,t=3,p=4$O2O5r/7A8hc4EMvernQ4Dw$YOVqtwY3jv0HlcxmviPq2CRnD7Dw85V9KDtTSUQE7bA";
+            public = false;
+            authorization_policy = "two_factor";
+            redirect_uris = [
+              "https://git.cy7.sh/user/oauth2/authelia/callback"
+            ];
+            scopes = [ "openid" "profile" "email" ];
+            userinfo_signed_response_alg = "none";
+            token_endpoint_auth_method = "client_secret_basic";
+          }
+          {
+            client_id = "b_ITCG0uNzy9lZ5nVC~Ny5R35te8I3hoQW1uraCbdxeiE9VuiCIelMmZZ7dAZLg_anTUWSQG";
+            client_name = "HedgeDoc";
+            client_secret = "$argon2id$v=19$m=65536,t=3,p=4$MFSXW3gjIZf0M3e8s8RJCg$6KWwksJe2vdUebPEdYc0Zy88fzGcHPrbStcqkiXl+Hg";
+            public = false;
+            authorization_policy = "two_factor";
+            redirect_uris = [
+              "https://pad.cy7.sh/auth/oauth2/callback"
+            ];
+            scopes = [ "openid" "profile" "email" ];
+            userinfo_signed_response_alg = "none";
+            grant_types = [ "refresh_token" "authorization_code" ];
+            response_types = [ "code" ];
+            response_modes = [ "form_post" "query" "fragment" ];
+            audience = [];
+            token_endpoint_auth_method = "client_secret_post";
+          }
+          {
+            client_id = "0SbsGvw5APYJ4px~dv38rCVgXtK2XWrF1QvyuaFz48cgsNm-rAXkSgNOctfxS21IWOFSfsm5";
+            client_name = "Karakeep";
+            client_secret = "$pbkdf2-sha512$310000$4UanDZq.6oholJW3CmKwtQ$9e3hqR8qGU4LoneR/Y9jtJTx0iSzATI4iXymrs8QrmGw4JY1BPF4.IJ9Jbc.8cikU4qpfUIFO6r2dG7JHznCnw";
+            public = false;
+            authorization_policy = "two_factor";
+            redirect_uris = [ "https://keep.cy7.sh/api/auth/callback/custom" ];
+            scopes = [ "openid" "profile" "email" ];
+            userinfo_signed_response_alg = "none";
+            claims_policy = "karakeep";
+          }
+        ];
+      };
+      secrets = {
+        sessionSecretFile = getSecret "authelia/session";
+        storageEncryptionKeyFile = getSecret "authelia/storage";
+        jwtSecretFile = getSecret "authelia/jwt";
+        oidcHmacSecretFile = getSecret "authelia/hmac";
+        oidcIssuerPrivateKeyFile = getSecret "authelia/oidc_private";
+      };
+    };
+
+    sops.secrets = {
+      "authelia/jwt" = sopsConfig;
+      "authelia/storage" = sopsConfig;
+      "authelia/session" = sopsConfig;
+      "authelia/hmac" = sopsConfig;
+      "authelia/oidc_private" = sopsConfig;
+    };
+
+    services.caddy.virtualHosts.${domain}.extraConfig = ''
+      import common
+      reverse_proxy localhost:9091
+    '';
+  };
+}

modules/backup.nix

@@ -6,7 +6,6 @@
 }:
 let
   cfg = config.my.backup;
-  hostname = config.networking.hostName;
   defaultPaths = [
     "/root"
     "/home"
@@ -97,23 +96,6 @@ in
       ];
       # warnings are often not that serious
       failOnWarnings = false;
-      postHook = ''
-        invocationId=$(systemctl show -p InvocationID --value borgbackup-job-${cfg.jobName}.service)
-        title="${hostname}: backup completed with exit code: $exitStatus"
-        msg=$(journalctl -o cat _SYSTEMD_INVOCATION_ID=$invocationId)
-
-        if [ "$exitStatus" -eq 0 ]; then
-          tag="v"
-        else
-          tag="rotating_light"
-        fi
-
-        ${pkgs.curl}/bin/curl -sL -u $(cat ${config.sops.secrets."services/ntfy".path}) \
-        -H "Title: $title" \
-        -H "Tags: $tag" \
-        -d "$msg" \
-        https://ntfy.cything.io/backups > /dev/null
-      '';
 
       prune.keep = {
         within = "2d";

modules/caddy.nix

@@ -19,9 +19,9 @@ in
         plugins = [
           # error message will tell you the correct version tag to use
           # (still need the @ to pass nix config check)
-          "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"
+          "github.com/caddy-dns/cloudflare@v0.0.0-20250228175314-1fb64108d4de"
         ];
-        hash = "sha256-jCcSzenewQiW897GFHF9WAcVkGaS/oUu63crJu7AyyQ=";
+        hash = "sha256-pfh9DXUj35jlAntkWc4D5wuW04xxQfM1rZ4KFauMzvc=";
       };
       logFormat = lib.mkForce "level INFO";
       acmeCA = "https://acme-v02.api.letsencrypt.org/directory";
@@ -29,12 +29,30 @@ in
         (common) {
           encode zstd gzip
           header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+          tls {
+            dns cloudflare {$CLOUDFLARE_KEY}
+            resolvers 1.1.1.1 8.8.8.8
+          }
+        }
+
+        (authelia) {
+          forward_auth localhost:9091 {
+		        uri /api/authz/forward-auth
+		        copy_headers Remote-User Remote-Groups Remote-Name Remote-Email
+	        }
         }
       '';
-      globalConfig = ''
-        acme_dns cloudflare {$CLOUDFLARE_KEY}
-      '';
       environmentFile = config.sops.secrets."caddy/env".path;
+      
+      virtualHosts."keys.cy7.sh".extraConfig = ''
+        import common
+        respond / 200 {
+          body "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfubDWr0kRm2o4DqaK6l1s4NCdTkljXZWKWCiF5nX+6
+        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhUt9h5dCcrwOrZNKkStCX5OxumPzEwYXSU/0DgtWgP
+        ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINyn2+OoRN4nExti+vFQ1NHEZip0slAoCH9C5/FzvgZD
+        sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIA/IX9OFEhHS9Dl8nrtHkL7j7hhy7in9OAY/hVuzEGL0AAAABHNzaDo="
+        }
+      '';
     };
   };
 }

modules/containerization.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.containerization;
+in
+{
+  options.my.containerization = {
+    enable = lib.mkEnableOption "containerization";
+    usePodman = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "whether to use podman instead of docker";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation = {
+      containers.enable = true;
+      podman = lib.mkIf cfg.usePodman {
+        enable = true;
+        # create 'docker' alias for podman, to use as
+        # drop-in replacement
+        dockerCompat = true;
+        defaultNetwork.settings = {
+          dns_enabled = true;
+          ipv6_enabled = true;
+        };
+        # answer on /var/run/docker.sock
+        dockerSocket.enable = true;
+        autoPrune = {
+          enable = true;
+          dates = "daily";
+        };
+      };
+      docker.enable = lib.mkIf (!cfg.usePodman) true;
+      oci-containers.backend = lib.mkIf (!cfg.usePodman) "docker";
+    };
+  };
+}

modules/default.nix

@@ -5,5 +5,11 @@
     ./caddy.nix
     ./roundcube.nix
     ./zipline.nix
+    ./containerization.nix
+    ./vaultwarden.nix
+    ./searx.nix
+    ./attic.nix
+    ./authelia.nix
+    ./karakeep.nix
   ];
 }

modules/karakeep.nix

@@ -0,0 +1,81 @@
+{ config, lib, ... }:
+let
+  cfg = config.my.karakeep;
+in
+{
+  options.my.karakeep = {
+    enable = lib.mkEnableOption "karakeep";
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+    };
+    port = lib.mkOption {
+      default = 3002;
+      description = "port for the web service";
+      type = lib.types.port;
+    };
+    domain = lib.mkOption {
+      default = "keep.cy7.sh";
+      type = lib.types.str;
+    };
+    environmentFile = lib.mkOption {
+      default = config.sops.secrets."karakeep/env".path;
+      type = lib.types.path;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    virtualisation.oci-containers.containers = {
+      karakeep-web = {
+        image = "ghcr.io/karakeep-app/karakeep:release";
+        pull = "newer";
+        volumes = [ "${cfg.dataDir}:/data" ];
+        ports = [ "${toString cfg.port}:3000"];
+        dependsOn = [
+          "karakeep-chrome"
+          "karakeep-meilisearch"
+        ];
+        environment = {
+          MEILI_ADDR = "http://karakeep-meilisearch:7700";
+          BROWSER_WEB_URL = "http://karakeep-chrome:9222";
+          DATA_DIR =  "/data";
+          NEXTAUTH_URL = "https://${cfg.domain}";
+          DISABLE_PASSWORD_AUTH = "true";
+          OAUTH_WELLKNOWN_URL = "https://auth.cy7.sh/.well-known/openid-configuration";
+          OAUTH_CLIENT_ID = "0SbsGvw5APYJ4px~dv38rCVgXtK2XWrF1QvyuaFz48cgsNm-rAXkSgNOctfxS21IWOFSfsm5";
+          OAUTH_PROVIDER_NAME = "Authelia";
+          OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING = "true";
+        };
+        # needs NEXTAUTH_SECRET
+        environmentFiles = [ "${cfg.environmentFile}" ];
+      };
+
+      karakeep-chrome = {
+        image = "ghcr.io/zenika/alpine-chrome:latest";
+        pull = "newer";
+        cmd = [
+          "--no-sandbox"
+          "--disable-gpu"
+          "--disable-dev-shm-usage"
+          "--remote-debugging-address=0.0.0.0"
+          "--remote-debugging-port=9222"
+          "--hide-scrollbars"
+        ];
+      };
+
+      karakeep-meilisearch = {
+        image = "getmeili/meilisearch:latest";
+        volumes = [ "meilisearch:/meili_data" ];
+        environment = {
+          MEILI_NO_ANALYTICS = "true";
+        };
+        # needs MEILI_MASTER_KEY
+        environmentFiles = [ "${cfg.environmentFile}" ];
+      };
+    };
+
+    services.caddy.virtualHosts.${cfg.domain}.extraConfig = ''
+      import common
+      reverse_proxy localhost:${toString cfg.port}
+    '';
+  };
+}

modules/searx.nix

@@ -0,0 +1,47 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.searx;
+in
+{
+  options.my.searx = {
+    enable = lib.mkEnableOption "searx";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.searx = {
+      enable = true;
+      runInUwsgi = true;
+      uwsgiConfig = {
+        disable-logging = true;
+        http = "127.0.0.1:8090";
+      };
+      settings = {
+        # get secret from env
+        server.secret_key = "@SEARX_SECRET_KEY@";
+      };
+      environmentFile = config.sops.secrets."searx/env".path;
+      redisCreateLocally = true; # required for limiter
+      limiterSettings = {
+        real_ip = {
+          x_for = 1;
+          ipv4_prefix = 32;
+          ipv6_prefix = 56;
+        };
+        botdetection.ip_lists.pass_ip = [
+          "100.121.152.86"
+          "100.66.32.54"
+        ];
+        link_token = true;
+      };
+    };
+
+    services.caddy.virtualHosts."x.cy7.sh".extraConfig = ''
+      import common
+      reverse_proxy 127.0.0.1:8090
+    '';
+  };
+}

modules/vault.nix

@@ -0,0 +1,19 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.vault;
+in
+{
+  options.my.vault = {
+    enable = lib.mkEnableOption "hashicorp vault";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.vault = {
+
+    };
+  };
+}

modules/vaultwarden.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.my.vaultwarden;
+in
+{
+  options.my.vaultwarden = {
+    enable = lib.mkEnableOption "vaultwarden";
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "https://pass.cy7.sh";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.vaultwarden = {
+      enable = true;
+      dbBackend = "postgresql";
+      environmentFile = config.sops.secrets."vaultwarden/env".path;
+      config = {
+        ROCKET_ADDRESS = "0.0.0.0";
+        ROCKET_PORT = "8081";
+        DATABASE_URL = "postgresql://vaultwarden:vaultwarden@127.0.0.1:5432/vaultwarden";
+        EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,ssh-agent,ssh-key-vault-item,autofill-v2";
+        DOMAIN = cfg.domain;
+      };
+    };
+  };
+}

overlay/attic/concurrent-32.patch

@@ -1,13 +0,0 @@
-diff --git a/server/src/config.rs b/server/src/config.rs
-index 4412cbf..6dd483a 100644
---- a/server/src/config.rs
-+++ b/server/src/config.rs
-@@ -565,7 +565,7 @@ fn default_default_retention_period() -> Duration {
- }
- 
- fn default_concurrent_chunk_uploads() -> usize {
--    10
-+    32
- }
- 
- fn load_config_from_path(path: &Path) -> Result<Config> {

overlay/attic/default.nix

@@ -1,26 +0,0 @@
-final: prev: {
-  attic-client = prev.attic-client.override (old: {
-    rustPlatform = old.rustPlatform // {
-      buildRustPackage =
-        args:
-        old.rustPlatform.buildRustPackage (
-          args
-          // {
-            version = "0.1.1";
-            src = final.fetchFromGitHub {
-              owner = "cything";
-              repo = "attic";
-              rev = "d660c85bdb6bb10499a23a846a13107ea0c72769";
-              hash = "sha256-E22d2OLV02L2QdiSeK58flveehR8z8WIKkcN/njAMdg=";
-            };
-            cargoLock = null;
-            cargoHash = "sha256-AbpWnYfBMrR6oOfy2LkQvIPYsClCWE89bJav+iHTtLM=";
-            useFetchCargoVendor = true;
-            patches = [
-              ./concurrent-32.patch
-            ];
-          }
-        );
-    };
-  });
-}

overlay/conduwuit/default.nix

@@ -1,44 +0,0 @@
-final: prev:
-let
-  newRust = final.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
-  newRustPlatform = final.makeRustPlatform {
-    cargo = newRust;
-    rustc = newRust;
-  };
-in
-{
-  conduwuit = prev.conduwuit.override (old: {
-    rustPlatform = newRustPlatform // {
-      buildRustPackage =
-        args:
-        newRustPlatform.buildRustPackage (
-          args
-          // {
-            version = "0.5.0-rc2";
-            src = final.fetchFromGitHub {
-              owner = "girlbossceo";
-              repo = "conduwuit";
-              rev = "5b8464252c2c03edf65e43153be026dbb768a12a";
-              hash = "sha256-yNdxoVZX13QUDJYM6zTMY9ExvacTqB+f0MLvDreSW8U=";
-            };
-            doCheck = false;
-            cargoHash = "sha256-g19UujLI9d4aw+1273gfC17LDLOciqBvuLhe/VCsh80=";
-            # unstable has this set to "conduit"
-            meta.mainProgram = "conduwuit";
-
-            buildFeatures = [
-              "brotli_compression"
-              "element_hacks"
-              "gzip_compression"
-              "release_max_log_level" # without this feature to enable debug logging
-              "sentry_telemetry"
-              "systemd"
-              "zstd_compression"
-              "jemalloc"
-              "io_uring"
-            ];
-          }
-        );
-    };
-  });
-}

overlay/conduwuit/rust-toolchain.toml

@@ -1,28 +0,0 @@
-# This is the authoritiative configuration of this project's Rust toolchain.
-#
-# Other files that need upkeep when this changes:
-#
-# * `Cargo.toml`
-# * `flake.nix`
-#
-# Search in those files for `rust-toolchain.toml` to find the relevant places.
-# If you're having trouble making the relevant changes, bug a maintainer.
-
-[toolchain]
-channel = "1.84.0"
-profile = "minimal"
-components = [
-    # For rust-analyzer
-    "rust-src",
-    "rust-analyzer",
-    # For CI and editors
-    "rustfmt",
-    "clippy",
-]
-targets = [
-    #"x86_64-apple-darwin",
-    "x86_64-unknown-linux-gnu",
-    "x86_64-unknown-linux-musl",
-    "aarch64-unknown-linux-musl",
-    #"aarch64-apple-darwin",
-]

overlay/default.nix

@@ -1,22 +1,18 @@
 { inputs }:
-let
+[
-  overlays = [
-    ./attic
-    ./zipline
-  ];
-  importedOverlays = map (m: import m) overlays;
-in
-importedOverlays
-++ [
   (
     final: prev:
     let
-      pkgFrom = flake: pkg: flake.legacyPackages.${prev.system}.${pkg};
+      nixpkgsFrom = flake: pkg: flake.legacyPackages.${prev.system}.${pkg};
-      stable = inputs.nixpkgs-stable;
+      pkgFrom = flake: pkg: flake.packages.${prev.system}.${pkg};
     in
     {
-      conduwuit =
+      garage = (
-        inputs.conduwuit.packages.x86_64-linux.static-x86_64-linux-musl-all-features-x86_64-haswell-optimised;
+        (pkgFrom inputs.garage "default").overrideAttrs {
+          meta.mainProgram = "garage";
+        }
+      );
+      nil = pkgFrom inputs.nil "default";
     }
   )
 ]

overlay/vscode.nix

@@ -1,14 +0,0 @@
-final: prev: {
-  vscode-extensions = prev.vscode-extensions // {
-    github = prev.vscode-extensions.github // {
-      codespaces = prev.vscode-utils.buildVscodeMarketplaceExtension {
-        mktplcRef = {
-          publisher = "github";
-          name = "codespaces";
-          version = "1.17.3";
-          hash = "sha256-idJFYHJ4yeqpFZBX55Y0v1yfzgqyhS0MrC4yIto7i7w=";
-        };
-      };
-    };
-  };
-}

overlay/zipline/default.nix

@@ -1,8 +0,0 @@
-final: prev:
-{
-  zipline = prev.zipline.overrideAttrs {
-    patches = [
-      ./no-check-bucket.patch
-    ];
-  };
-}

overlay/zipline/no-check-bucket.patch

@@ -1,45 +0,0 @@
-diff --git a/src/lib/datasource/S3.ts b/src/lib/datasource/S3.ts
-index 089dd64..39dd8f4 100644
---- a/src/lib/datasource/S3.ts
-+++ b/src/lib/datasource/S3.ts
-@@ -4,7 +4,6 @@ import {
-   DeleteObjectCommand,
-   DeleteObjectsCommand,
-   GetObjectCommand,
--  ListBucketsCommand,
-   ListObjectsCommand,
-   PutObjectCommand,
-   S3Client,
-@@ -38,32 +37,6 @@ export class S3Datasource extends Datasource {
-       endpoint: this.options.endpoint ?? undefined,
-       forcePathStyle: this.options.forcePathStyle ?? false,
-     });
--
--    this.ensureBucketExists();
--  }
--
--  private async ensureBucketExists() {
--    try {
--      const res = await this.client.send(new ListBucketsCommand());
--      if (res.$metadata.httpStatusCode !== 200) {
--        this.logger
--          .error('there was an error while listing buckets', res.$metadata as Record<string, unknown>)
--          .error('zipline will now exit');
--        process.exit(1);
--      }
--
--      if (!res.Buckets?.find((bucket) => bucket.Name === this.options.bucket)) {
--        this.logger.error(`bucket ${this.options.bucket} does not exist`).error('zipline will now exit');
--        process.exit(1);
--      }
--    } catch (e) {
--      this.logger
--        .error('there was an error while listing buckets', e as Record<string, unknown>)
--        .error('zipline will now exit');
--      process.exit(1);
--    } finally {
--      this.logger.debug(`bucket ${this.options.bucket} exists`);
--    }
-   }
- 
-   public async get(file: string): Promise<Readable | null> {

secrets/cache-priv-key.pem

@@ -0,0 +1,28 @@
+{
+	"data": "ENC[AES256_GCM,data:IVRg3IqrlV1Cy3xwyVszhUnRzbWP3OSb/XZF1H0N30eKL8d0DxFGngC5qMgRcmSs203/QL3w0fENp1u0f8tVajqJVlzLjlsiQrMdtXmiMv0LKO7E+aj4UZ0wMchB0XgSVUWrKUXxZrA=,iv:3GtA07yuAAI++RsLSwY3U62k1iG9+hvkGn45HjFt/Gk=,tag:PJ13CrjcE06KMC383txqHw==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLcGd1alJmNWM3dVBmSWxs\nRHBTOVV6U3p1U3Q3bzQ3OXYrWVhNVTlxTGxvClllbFMwc3dFZW56a0d6eUhVZ2Na\nMUVJc29CNHVMcHRLaXBlRnRLZ2pNb0UKLS0tIFRERnRBZGVFRk9sYmpzVjlpdmN1\ndjUyVmRZMFlFTm4zSnZWV09WbTNoMWMKM35a6GkCZIKscqgADrbIa48T8++wkhLP\nOFr03bv6D0Hj38VLWx+kh9kmja8BaxmdSUTeAhdORwbQumJBAqjsOw==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHbEh0YkFlL3dPL1FmcE9m\nbjl0dHhQZlpBREMwYzQ0NEpQQ3RZVlNsM1Q4CmYwS0VDNjFaOXhOS3JkVUtaTEJZ\nSVNyZ1lXbEhCbE5XdGxCRWhsNVR1N0EKLS0tICt2Um9wQ0pyUVpnd1dVemM4NmpU\nTHE1bi9OcmsweDZyNVpVVUlITmt3c28KdX6fO1C7Ma66AAv/RCI5z8p/7fSvKWQ7\nCL86Nl4Xzb5WWxkteO4wOoHh4y0+9dpEAbS/XP78PkC07uRttcS7pQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			},
+			{
+				"recipient": "age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCRmNheTZrUWplWFZJcm53\nbC94UHdYbXdsSFB0Nk92Q29RdGMxbUxVeEhjCkZqVk13bEFvNFFLZllTN0NUeFpj\nRkhlYXl5STJrbVQzeWg3YzlQZ1ZlZncKLS0tIGhjUytJa2FXa0VVTFlMN2ZpTjF0\ncG9ZTG0zL2dNekV0NkFZWWVrcFpPU3cK/Kia/sHk5T9nlbDg2G52uQcJUoPrnu3y\n6ARJKoz0MnV4csjS6IZCFSb7Vy5DSH+at3khEw3x00eGae1Jd89vwQ==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-03-27T20:37:28Z",
+		"mac": "ENC[AES256_GCM,data:35iUoodcjvIn+VAE20f2sHFaTh3+aqCYQ4HalWdVz4eUSkVNcdXs2uqOZtFv3MszDiH9izM84OyHwykudJ99QE3B/NwpfIoKQaU6Qg5X/g/rC1meffMaZwcASVbepjznahbTKmJqeSrMeybrBIV+6FaSjWXn0+D72GEEM1vgH9c=,iv:N2CbttHJsczm37qdapOCrlNeSSgsZBDlvWyvUpa3mkk=,tag:btniVwaVS9h4jDo4IM2wcA==,type:str]",
+		"pgp": null,
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.4"
+	}
+}

secrets/services/authelia.yaml

@@ -0,0 +1,39 @@
+authelia:
+    jwt: ENC[AES256_GCM,data:L20XZt1eYz1srY+xIliasq4x2guxNIUOM4mVTPe/1uS2wQY6h1uY9n7yoMQ=,iv:OhTuutHQOVLG/CjX3m839Acw9eq/Yh3Iy947km1jalQ=,tag:nq/lwsfGSzeH6RsXLzr24g==,type:str]
+    storage: ENC[AES256_GCM,data:RW15TzoZifv0xrVAfrM7yFXv1ISp7v1c20PL4nGkQrXwjablPKQa5IZ0Fvg=,iv:YQ7+2h4O0Qx9BqnFU7WMaZuPtKU4BUo56/KPq2NQYxI=,tag:LQ8gWhf9rblGkN5bhPHPIQ==,type:str]
+    session: ENC[AES256_GCM,data:fJY4uSKRIcHDyDqndT9YiolOX1HDw2BphoaZONAv8AhdPV+aG5qj9Ppy3Rw=,iv:dcFZyIdZQQlyAORudsUCCD2wx4Sc7NF0dh/v/M6iYko=,tag:vBYU58mL7DecMqhX/TUdVg==,type:str]
+    hmac: ENC[AES256_GCM,data:K/qiyibBlu9wNh9IINHgYQiEZMromSA9Kf0iRVHPVuuhhUBZRyyfFyd4sLYNDLWvYKRJGnTBniIscQuBR+HU3/ttFGN0EkDsuAXlW3tKyLSxTiVgEvsKhA==,iv:2femAZUtSE9DjopiRIRT3Be3T2Qi0J+b8TaNJZ9vcjw=,tag:Sb7TT+1uxtStv20oM8oa8A==,type:str]
+    oidc_private: ENC[AES256_GCM,data:dzrykbgRk77yDbrnayTzSyiAjvgr5RUuDG046azumPinHL9wBaKpNdx6CqY7o+W95yOyVr/Xriw/aBbSyCZE8RoMchZhnS5Z8moHrIK7RryRM/BmEpOfyFLf9kpaO5QqSGyPt13yJQSA/3TwoXD4et3rVEdEz8mwb+vIA+G3WIZrNY+95KNjhwu9W648eouGBqJFfwTw0tm8mHsu+VZE8OYdp+ujSlKWZcVDEzgMEe+egXbvSB/3sk82HjolcqCmDx+U1TWMZfZdZPaT4RxONy+4kgGDW4FOqtsgctS2uRUQ2CLuRLD8xIulBO/VbsnNuticiM86BYygobq3RUdCKAFLUpcXqNWgnDBvnYPcF6mXPTmFCD3Gr2t4uRkqIIPc3NrW6DKnSO4pu4oVlUiSd9XaHGvAuo0yR7zcG7Zl4BAzhZa1HuVq6QmSNMf1TAo5P5zBc/NKlUVUhgIEKmRkwf95ZDyph1CJJagTsRZp/D4n6gbuzmV2Pjd8GxT6X+GOK7MQ3hPWsQP8+hhf8DArnVa988Z5cVxG3CQS6wEdEfc8yoHXlXwsB6iHjG4GooJk17GkP0YnMqOkv5Y9QbWXGNN/Zce6LJrSdvpd1Z8oWHxFB9ChFEA34tTYE/1wv0C71K6VRADnshBTyg0i+7GxvW0iyplWGEB2/DRv9WbpmIze1vff0KPlwvmdPXvZM7kfJE6uRP+DH5kJeIlKezA+hwuZmTLEu8kTdIkIJVfbzuOmXtX1yO+sQmSs6anqbSBuw5dpKYFFtQ04V+P27uTdi6lbUUfaBiHMhiW2A8aj/1Xf+pOV5oIN1c7PXNhAGrsNbmumQ7mBmbfOZeLC2aze5iKLSu5xqCzMNEWdlxXkmK+eEuUgDAQgW0pRAA12wvAFT8cf5BIeEPQQF4gPJprrQ3u93AXCVXve/TPC6rSEb+uCVq30JRGvIciFAEPWjhtSSO2Mh2zxjaALXVRE456k8DQq5mvovCp003EW23Io+lKDfg73n4LLZvbpHBVa3SQY0YMazjynJTo6UcDT3J/u9kNutIRjszzohMdW4jmykawPb/FFGv4yaX199bkTT/6/ztygaUTUTtWrl40p61lMzFHsz1qPy/5Bp4fxOYk6mLHpUFBpXUlu90ZxiReu6fX9HR6oQ1OC6MmpYjvcvxOAfIszgoMmp0LABJ1XN7DMOxpRrjNqW071xnel2/NzYy/gx0r2SdusxFJckGjrnyVzjEBVFwdpc9lZ+NdyzbNaElt/duk5AhdQ/iTCDlQpFsBhcl83Sbt38P/QlsOCPvRYuOz3vvOgeRprZn4hXuvGpQKJZEy+/rHDFijVABgbqLBxhfQiCpFmfwqQrcI+vFnPBGHP96p8S7xg5Dh2007QyFk9D2zHDHY6E+Iv27UkjaCZI29IAEdBe86IMtLI7Pl0q6XE44cHwD+QqzS55YlPj/F3va9LesoylPzBJwlxogciolfBQfQjLp4OF1rBSpy1Xy/Es7+M9eEsdatX1a3qFzYCJbC8+no5ol0PaIHx4ejH9aeoIiVfq/yXtzV04pJQz0bZfpfKVwtroyHhclEsP9pZVHnnexIFY1xqVF76V0kbusiizhru5ldOWE7smwXD5+KyMCTfDuxPnEjFBZLb/BLjo46sugJTAGQJhBBWJY+h7Je5PP+FnjQG28h4n4NMshhPfnyDEAZWNpDAHi08KhHOGzbNhPl+E+pNrNoNwmJjWbiqZ+P9LVQf1s5C+UrL+uV6qpeVKcm9tjy75fgVTD4iRXb4ejQIWlwO2EVLBzI9BXYsVmly6z0C+8f3wDPswwwocna9SonBus1QGudZ8cLSihZqSYmq6fCIFqfXTlCj3H0aOBNbX7dCYrles/y6jtn0VebQa3UEflXs+4WytpXdKEelN5f1PoJVnjrRF6Wtyq23GNbo1M9BTBQfpUf5x7QnZrxyIVbgvHq3JSR6/5p6yv6SGOdypCEqMtvnw9+bJMi6bxy55tXQNNpBB/GHWPqzOE9//9pqazJzikL/x7HWg/t+tJ7yV7MCFV6Bk2cy77j7i0fftxfHqjF7MRbnIaJRqxiTqp0z2rA4L797Que6a903b/u/AStMnsm8sE9gRy7P5L/PafqpgA/kK2FIxbDDP91cnvikRi2u+oaydHLhCkaq20SIupBCbgyDVkOXZ9n5EnKJDjFOAbOQ2UiXYrQPXDEMPLLUklBeLzQBHY4ZTQ7zzMb1tqvo4UqaHVnw2FwY+PoX2IPmF1ciccFO5uHX2w2qz8Hx0ZCPa9AsR/3HhKAg9sdg0cF0k3nXqTWCSs8j+9vpJxjCmrN1bXwoRA8K/ICYDoOtjb76c1B/Ahvc2YA7OULcM0EAzsQ2Z++cU/OCIcQatxzEx+TOp5i1yN2YnCFHqDBpE1UB2UbxBCYb+oEEBqB9qeFkQI6eZmvHASjdasXUtvnBYNCc3nliGfODoOXKLmzHQZJVPguWFu7b06zWA7fy3qGMjf7h/RhKbfkL9o7HkAvHTSh0+Lpc8gjPVu+sqLNUMyk3196LJWUI3nf7L3kUxkdSBdsJ/18FZ97OzC3Ws9dhhWe02ry3Y2ptRnIlLf8f4Y/P6FpqwR8Asa6NYBq+LKNSuWfzo4ZynkPt4irAm0LDOnZzbrRbQTB7tUHIA1dZMMWueIe22mUDOzTGDPuFSfF31rYbh2rmc3Tjvkumz6g53kdCV4QnL04htkMwql4KvpMCrkkMxDRlOTf1Xh10QrO49aPd29i7LbFjorGj1872hXszPDpmdDN78VApvMzVue8dKdhlz/x/9aCJnp9oEEgdObEg2OYyc29bqd9kbCOs5F4vaI4YdMrN9QKTqjAVG0kQAKH41Q7VCe0/jPWmGpH4Kd40RQ6/NY5g312D3RKV3V30DlCOIm+w1z7XzV2EWTgb5vgg4EbYyVmh3Y7wBguv2qOqzwhGMFrWGx+fTFAe5Zq8TVwvQUfeN/vFlYz+jc8ysKBbyrrAl4vKm2pz9Geu3Rh4AfRRmxawNjE/qlrTk6sWdWNJu7i2Wgk1C2+1FZeAprPg6EsZj7rFEGOFvZIjWrTi7n+IHI+8rRKDo3J5SkAsxiDaDo8dfvGecPp9ig5l9+OiN68t29HxfGnhJsk5eim/vkuA5mdFJW0cy7h3gtP1Z0PtRYsRoBO+hPp7dcYhhh9NqkP4LbVI8graz5FEf0yMmaA6ci7xgBWe/zOa0V539Y9cWzTK5zE2wrWI+mHKsbgUH9s+7y0tTVk9mPaNKhih1MHgCQiFyctQLzVnd6fXnv7JHzkkIY7AQiCjEZ4QPUrj99rDh0bikDtKX0hAiVedGMJQ664Hhyd3sWVGfrC/Qmob+4LhpE24kAxIRf94d2cB1zRFQ02HMGkbVUbge8SPNqqq/HoWkYvNo/ltdL0Nr5Qb1OmY0LP5txGh8cCQt8SD3K/ww+ZjD0ZbqqTwIaND9reyzXL0ryf8yNkiPCTpFiNmdL1rtHw+E2s9HtdngCz9XuGW5GRa4cL5xY1Yt4WBLEnxXwmyB/EOjBIeO4aJuwAcssL3UrvS/IEERWN4XrqVM4O81ainLaXeze1jj9VJcMb+/qz8dMdgm4WGkKfbbJeIsFCrlHOJ0CFNZZmijMvkoTvZ9WTq2OpxxZdsci1UmItlU60LETfWTUK8Q3YOo+c+fukIMPv68NLQH1LsiYjFXo9yDdzfD990uI5wdwnR3S3Sx6Vp04SkzJX7BAZ2UuL0wJ564Ny4S9Ew5BfWucd70mfQaEzOl52M9mqCyJYDfMYhd65YxkAEAV1dMg3FBlpZmOr2wtEQqXz+25cSPCNwQ/obCQt12cLNGRhyNi1Stz2E67Q9sesmssF7dgq0u/TeLezzVxTk13sJj6PzMtdpOYDwsgZJdh9hz8PZ32nJMTJnlkq6zcTYsbq23+HreCx1dHJJEDjpqZlttMYqLZ8mLLob25PzFaue164MbqozFtNTOc8eeOD+hoPCP/hfPoKoNi7oARs0fvwOwCQEug0XpMcz9mF/85ZBxYuDUBEP1vpbD9MpP/ECslqGdHuJePEFiiJOrDVggpaGcgWUfS2jwWv/46Bbz+W9QH+6Y8IevMf+lXPOL294g5VOoOW5k77naeNNCbycbijFD76gR5DtA+Vn+B6pxzF7l4E4VqC0Vlc1OUvYA7GLZ4rzb4bH4cEZiIb2/skDhJOmcb2btPWKRgutbmpHmi59eVbVkKUAKXm/WBw8xLwt2sLBS5r5R7aAZpMu/NaXFTfBEBGUzrH1u8Pfz3FwRK7v0QEyzhu2bS2JkGxSsaxD5+geQlvzN8eRYW4+pst/CfcCxTES9spBnqSWIX++rs8f9/mECf4jXzZQDv0fdbGILAU=,iv:GTKiBIir9+G3Lh45x77KARxi7paEsGP1m0qVldRnuOw=,tag:eCsjDzyO1g2HvnDhR/Gb4w==,type:str]
+sops:
+    age:
+        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJOG1menBCTTF3YURCOThM
+            Q3Z4bnZJYmtQY1RmdTBSeFlhZCtUVzg4Qm5ZClo5NFJqaWg3NElKQjRLcFZGdmxP
+            cFMwOGxoelJlVnJNamUxWFhETWpiY3cKLS0tIFNDWGRkYVZQWTd2YXg2aGswbmJz
+            MVJQdDV3ZGdzd3NYL29tYU51NndiNmcKtagAZdoZQo0y0atvRI6f1tY/3j8aD4RP
+            yvs9RVDdNqm990O5EudjMNhoKLXnFQtX9NlzYVHzrsX0UT/HSUi7mQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0K2tGaktsdXVPN3g0bXps
+            ZkVWamZGc0QzNk1TaVdla1RDaW90TVpYb25rCmRPL29ZNFFCbVkrbVpseW5SZlFN
+            dmlLWHVBb1RMb1dvY3NKNHc3NEpMZFEKLS0tIFluRGN6U2paVzVBdCt4d3FyMVZ4
+            Nkx5aHo4Qk8vU01wazdWdmhvNWRLQTAK7kiQiEdF1LpzQ/syjRjyhchShrnfhHFE
+            M/XWLSIcnnApt1dOyJhJlpsQTnT6Y6Fqem0y779/uOQCBJGavscOWw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzK2U3YlRLK3BuK1Q0TkYy
+            SE1lTkVXUUV4NFVuT2V2VjdqUFpBbVFLSTJnCjI3c0xpMnBnV0M0Q0ZHYTdUSVZl
+            MWNMQXowWitFVTlIMFBadVJ6OHBBR28KLS0tIHJ1M0NkZzFMSndIUjBwN2tFUmF5
+            b2pGTmJva2VnOFZlRWxlOW5wMitDUkkKrZyzpch6jTSsumseBEaN8xQXfng4P7ds
+            JSoock3sEmL4NSfxXSu+PP8kEOXFtu1yAcmSSeVDDhV7jiwE4egu2Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-04-02T14:06:11Z"
+    mac: ENC[AES256_GCM,data:wK8Nb1Vb80UfolzqZOpifZdoEKYu847anowYiCdSluoK+dfHhDhCj7ZxznYV7SwVACIoLsqLR5syRzC861PRBrAujkhbcn7lTc1kQRCjw0gMAbPYR/xiO76EHmiYqnV2UMN0EmuQg1nIRIWY9EO9C7m1b9fjoZFgDsj/7O99aVU=,iv:CJxUKpyNgEYwqLhSvuXoHb+Hu3M7ydKh0WlsjlOtKkM=,tag:4KXmNwwFrqvBjxe656Jvug==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.1

secrets/services/caddy.yaml

@@ -1,5 +1,5 @@
 caddy:
-    env: ENC[AES256_GCM,data:XyxcCVT+rwlS7A3xzUgGqpMoLwhfUJo2++zPTgoPt3q6Edt14bYQJsoSJXnKx/lGg/0ilNfEEg8AEnru/Mzx0bWedSdWuZ380l8wlLiucqQThhEBhEJlyd94BMNzhxFdj82w0ejp4oWb5By/WjkFNesvAyxPIo/Ir4S+fTgGpA1iO2Ms8Pdjp00qeXYsK1CfjaXOYlEP+8BxntN2JKLYb8Cgs7dLmHfUwP6gTFKlTukUTtQZYUw336q3TtGy,iv:Ab/E0ljUBxzWlXfAC2BXCYxlgo0ErvKFaubgVjFR3OU=,tag:Yr24/DofYS2lM6f2/1LQ3Q==,type:str]
+    env: ENC[AES256_GCM,data:fyP1pPJgO9jN0ypC09s0Sz+HlUX42fl6DxWevYYevKdlKTgz5VHQfbELhy6vejmg9v+zFB3/AtSZfWJQB2dNX4Zm/L42wf5QZ7oYoa9QTujJjRgE96OXM77ioNy2DzFzpGw3w16QoC7zaR8UHSN1KL6qRj5xxKw0U6Apxhc0AuBoLvNHOgn8CHY92Q4OBcA1tJn8tgLB9uZB5Ge/2BlEjdSQ0sZMLkE+dHC4/0IILVFrrv1sWRXvXt6t5njF,iv:tF5GRPFYZSuKRgDAY1e8/J7jNQAEqDpgXlpwWW+1P4E=,tag:lK/BUErXNIPgqXPzGJvPTQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -33,8 +33,8 @@ sops:
             Q2hBZE1FOHJ3aW5rVmoyK045eG11cmsKFOmP5iWONREZvxu0rM+fKMPQKgnYq5LH
             AKMZFsP7nnUxjdCXEA18sDg4Rf0qp8i3uQK3D6P7417j9ye/YZA4BQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-30T17:26:39Z"
+    lastmodified: "2025-03-08T21:05:07Z"
-    mac: ENC[AES256_GCM,data:saoalvnwHsv0CTw/cRZqibnH9oGoZTNwGUT7RePKRa8OwNzbUEzQt+Z1WrmmWoqR+omQXLE+lpOPv6uNYxvAWnIelzCGeBBCMSBxtjlTUsjts7oFo7d9C5SdTIOkzotDxryvjRupb0P7hAmEqcSUKRZipJy5MVR7VXR1XZ4fIPM=,iv:VaP05zj8L2pygi1/M4BnOV3Inf0ssaWMu+aTBkdDMys=,tag:nuZT8GMB4F0T5dHnTvHOhA==,type:str]
+    mac: ENC[AES256_GCM,data:vgGCrCJMBxjiCWZYymlaPKTekA1Weprwgtc4xcoPVlDsuljkXDth+aAZPpnakE/nSXhGC6jGJOHdtrsIUTkH2R9WQHIdZDBy+VrVQoV6xE3ijfWyIujcIPwz3s1MGBqRFUYum1XMU5FAcIASiYV7PDxj/f6fsLbjKZCc9/kG3GE=,iv:PSvlssl+Gx+Gcw6/zccIKJDeNz3dJ0kHnPmCrAdBnqQ=,tag:6F/JKBFNxKEgMTyYZ3W0Vg==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4

secrets/services/hedgedoc.yaml

@@ -1,10 +1,6 @@
 hedgedoc:
-    env: ENC[AES256_GCM,data:15rWiIYWyIJ0Hxl5I8m+EBV+FkNDT/OHlLK9shVS46UE7SQtuIh45N5hvwgs0rg9E9Tawu+lyE2aozWNh6HSDUZ1h4FYrB+JHwIetGkOqXSLHfXi,iv:v9ohLTtlxw3fsRoJJoOY5VYxVsxUyDEsQHRjcGKg/GY=,tag:Wncm1reqNblnVhRTYjU3Pg==,type:str]
+    env: ENC[AES256_GCM,data:9xnOlQrk1qCyiAHSjmu8dvj2/z/BrJlngNGAQnMwvLsL0pnyvvyJLnYWTDYix1a9o8OJUNLw6Qhq7KbY4uXfxsNZkfGdVHwvkvhySjR2rcX/r90txqHJUUIxE/TzdsBvonzQ0F85KfXhsi69gKHp016gCj+jNf6CCY+tOVpt71el4Z+jzqLHasuQET8GctKJRzHOfNfCx/X2kJeb7RQl3JFC6/VmYT45bUk7uFfveFD9ao03wJwLKi27wO1WDrfpOigFdvkmqpbWZjaILYHYmkdhdlhr7w330CiCmGHT/ssmSPcu5cYUc8tjYPgpYLjusiUzpE5jmut5GaNwZsY9hNuow/mUVnQ/tCDH0ChOq0DQisJ07VMYlRII9tMdcuT4IbjjwiRcYlORAHsTFUuo5DCaDp8a4mx846BGp1YMQsvqJQgOe4x15VMpeB/ptxm79qxcLZKZ3BkiJaKmDdWsVk9RfqVgsxqiq16Me2EQhknO2s/oBjGOaoIiT4NEuRFQl0BIPgIMD0lYzKx0uDaYyclID5W0DqMI+SrcBd+WH/BB9HPdZx92rFe34PzjZse0i6+5UZHXUu8au6CyLMqGkUlzkSFwVT5W7Lv2m9P3+6YjgPRMaYbg8b6kmavB6EtjiqWtTbMKr3nxPVYJc5FRImvebfFqiLy5MWoNV6Qe7TUGIk6QtX2OWBhQ1UB+IpR+180QH7yw7UpgJ9EM8dD2m2/smar5P0BjAaqAFib++GzoB0OfFtxJNUjrejQC11tRWBXYvcHWwa78VbKPul0xqiEMmsAZufMix4lD1EgutTf1CXfv7l0rUpLwkYbWIq2hT5UI53L0YWJDl7zlhi94ANdXV8z8kCvMeXm2Fwl/vIgJ9JuFeVeVYPpXwx2coLBwE6uI4SuFvY1d4ojvzY8KftcHWO7srVzpuwrwW+6gKLwPQyEazv+sRKXAGo0ffMO2/2KRgOu9zGwaOFaNDAZ6gYFDWbPz6TMfNWHzfLEFK5BlVAL8KDb78IODUBYcMr2CX1Y=,iv:LDkuJgxIbohEVf7wmdtOZ/vlPddMYa7uzHGkL+0MnUM=,tag:pnJiCJydjTmUbS761fPUPw==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
           enc: |
@@ -24,8 +20,7 @@ sops:
             enlDZEI2NElkZkI3UmRyQUZqQWE5ZmcK2JlwNzVJNhGjyniIg9UY5tjgUKttkT3e
             9C/xag3dQCiqzX1O3o5tdhYnxXw+VxVf+qTFyyuftg5iQPZNuvX6mA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-17T03:25:54Z"
+    lastmodified: "2025-04-05T21:08:15Z"
-    mac: ENC[AES256_GCM,data:1cxiK/HhqYzatT2PhZxjvtizII2QMHqbbyOujUtx4cT8x488j2wecu6hOfSkuHbQ43AxA8kDH1NAruPCSdCpj3PytMR+np+R/5WuRcK+OF/FCnWvWvvHqgDnBs/wYjllnR6HyWBlhrROpINxu9ch4fzN0Def3I7O+wJgpojnPiU=,iv:PKPykPv9zSHj9+HXnrg1v8Ty78te66D9ZH6c1V7Qlh4=,tag:JQk68u6p317r3Df+hv16+g==,type:str]
+    mac: ENC[AES256_GCM,data:cPisYUoZWd/vd+wWzz3xTnftj1RdjK20dWFo+MKssm/eu7eCOWDIaZdcJg13gkTleBpMWQy/mG1drC6GLfGQiBmkS99UCPAoo0aLTBL4FbSm6FEXdbVjoOI7URu6Sj31drWCMAm+lXYymWsHwZJrNLhjsCTQsxTPvFq8oOdNlXo=,iv:KpmJoZ/BGEEhZ75jXfXxegNglm7k6mtleRuVud6tX2g=,tag:lsiqX+YSz4mGK6mw9gdKNg==,type:str]
-    pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.10.1

secrets/services/karakeep.yaml

@@ -0,0 +1,35 @@
+karakeep:
+    env: ENC[AES256_GCM,data:SWc26EQaKR5d9hMDYzVHA/r7XfjwFZ0d44Co0IS6OayR24ej7yqLAtkNttROKoKFuYc0sHgN9bOy4MyX0s3qiSWYovIIUJgFiJjPQFYDAo+50WR4+5W5FgvYI6e42fcWrQhaCXWQrDyzch/zT2OITZsjXcQhT5E+IiPLVkaGOjGptE07GjM7ZXI4UxBzINFQOhxdfIO0km1o6Wq8GhJdWsz4exz4ahRslR+WjK/flV2GZVAj6EHSJ5sHohm74QlhxaShEbc/8IKP6R2gSjBFP7l8VvwFyIUD9sLzYGvS3iU=,iv:gSPQU0bZ+VRFbuaNDc90dW0ogWX2SMH7kewtq/u/11E=,tag:L0Y4EWSQUhcn2eHt+yZ7qQ==,type:str]
+sops:
+    age:
+        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIaWQ1Q1JwRHJxQjNjdTAx
+            TXRsWjVZOG1mNEptNVhscHBaK2I5MHhjdlFjCkNqOEhwT3hyOHpHQ2k0ZmowUXB4
+            eks2dlpUS0V6VjBEYW9UWnhFOEw4VGsKLS0tIFo2a0FTRE5WdHBGVW5DOUFkaE9p
+            bitvUnJXSnB6UnV3VTEzSjlSYmEwVUEKHOwFCRu+SIyM0uJ6bNEAo+MMlsc8la6G
+            bLYdCoykcBu+uVXqn3BYTbrS5ylQMRYcbcPFJw5BVdmjIYF4LU5W6A==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrU2ZnNVAyeVdJeHlTSW1x
+            QUhKRzlNclVUWE1ucHFLZW5sL1lnUDhkd0Y4CjFuekNEOE1icDNqL1JyT0hEYW16
+            Q2VyajJFWWtGUnBzOENGOEZHbWROZzAKLS0tIE8wMVc3TkV5Y1VyenIvOW02NDNq
+            cStTeUcvY1pJWEN2MzFEeThKT0JPc1EKXrtVG49a6YZVKiL1F8Xg3t3niTYv3LwN
+            NeAQ8srV0F6ckky7OCkvUp9GInZCWRzULXV/x+4IUb6C+KQaNm2vYA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFdDdUSUlmMk5VcytyT01N
+            UmRaK2k5Wkh5SlhPT3QrczY2eW9vZk5KWFZBCnBteitnNFlHdWRaaTRxSWYvYmtG
+            ZnY5ZXlYa3Z5aENlRy9BQjVSU1F3UzQKLS0tIFpjN1dOaWNKaU9PaENyaXc1K3BU
+            K2orZ0Y2Z05LSUZ5WHQ4TnVVY0QwSzQKiUQT4aSxXnaq0kEMp+q5WnIUoGypEmZ+
+            DQEhkB9yu/BrkjXH+HGQr1W5B4sJyb5rnl0+SQ+IypRIRyaX4CdFxg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-04-05T19:44:58Z"
+    mac: ENC[AES256_GCM,data:OmqsJI9BaICOTiH1cq4gZlNBbkAxn/pAOWBtkIjHdqpikABLG6fMY+sLpyeaovXjexIj9MZk7fPmV8dRZ5VNLHCqlYXK/cVoQBZ2HK+p/cGTAFelNAShu9NSgZdFmVgJJtOjVvFp8dtuY8VcQj861k/MPX0mNZt9pmXYdumjpNM=,iv:efHkp1KUctwtCjG9A8i5qs7nQfQqv2ya1yYlHHOt8pU=,tag:4lChpspl0oOUMiXzvGuA2Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.1

secrets/services/searx.yaml

@@ -0,0 +1,31 @@
+searx:
+    env: ENC[AES256_GCM,data:VWLft5+85mNA8k3VynVBz2V+8zcg97UtHfucpaAcKbA+CQdGUbqLesQSu9a7tNRI7+OdI1qPJj5HTzP8tpGN5f39D4brtyo4fN8n8zAd,iv:F70wq9qJiFjEjJeZeFCyQskLdBR3nd/CR/UW/dE9gTo=,tag:/W8FhRC180aAdzjD5v0vZw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1eg6sxflw6l44fp20sl068sampwd95fm0mnh4ssegrhtktgm50ptqcuspyn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEM3VXOVZBSVdZMzBOVzJD
+            Y0ZvWUtFUW5pMUZnYjdxdHQvWDBEVmU1L2hBCi8zcEszZThwcGQ5WUdRTWFUWCtP
+            WWE0OVJIOXpCMGJZc3J6TmVCMGN2TUUKLS0tIEwxVDJLTkdrK3g2TG9iWml6aEFR
+            d3NOS245SmV3K1dlaHdnMHpVSzlYQk0KnDSK1C1sEeBVMX80DqjJRrGFx+WkNijg
+            XEf/Jq//qzgvX24fOl4X4xGTRfBMbLlznLs4N6WtIY7aVcW5N041jQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCOGFaWkY1TWhvQUhENHUx
+            cUk4b2FpeCs5eUMyQ2FhZzVKdHY1MVIzWUhRCmw0eEhwYjl2OFNoQkZRVW43REQy
+            OGpNWFRTWEF4NFFuU1lpTFdKY3lBNEEKLS0tIFNET0JBZmxoSGhWdTIwL0x2Ris3
+            ZHhidlJHT08rR3ZuME9UQmovRTFGNlkK83k2wqXQvxeURrUE/hXoZMDc9lqkgBuL
+            W/UWt/PBorp1/WRqO6dpuu9N2S9i6VCPJH0jdoHMWEqWuRIENFKVhQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-08T20:52:15Z"
+    mac: ENC[AES256_GCM,data:UGFkCgmgRofmX2gQR2W2DD0u4LowQ9pmUxPOgpLVaKGasEoNWJMGu7A7rUIpHvuUomoL6q8aiWs3kiIuZrTQ3CB5gawmU9pPiEseOAdbww4beIcnUmumwmCLH46XYQdaooPaz8bIncW/gFePRpVB2Oef1pYeryXkbZRwBm+bPOI=,iv:GGFjerxpLH8C1m50AiKoEJxj+lGRYNMe4Y7k4u232v8=,tag:woww///+80wakvzYoyWCqQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

secrets/yt/aws.yaml

@@ -1,6 +1,10 @@
 aws:
-    key_id: ENC[AES256_GCM,data:vxa8IS5zVOStsQaQNoPy36MeCw2KD2Th5tg=,iv:TrPukr/bpkGysf1YigBlXwaCu0H1FM6ivCVQEgnst6A=,tag:yrlcsDkLkH7U2i3JgjDaBA==,type:str]
+    key_id: ENC[AES256_GCM,data:euyq+QtSXv1UR5eOJfvZARhm5L2AuzKIOk8=,iv:RseSyVArmrawNzlwjNh6FScJF2O+F4FBuIq47uMQQEA=,tag:bkZJeX3rUHb1yZu8dytgcg==,type:str]
-    key_secret: ENC[AES256_GCM,data:R9hFgtylEW1RphrP7/9Hi7HIb7gcQX1WDEVfnUTTzh+/0LM2Rb9CdkaleO8wNlcyYVE/jUKtqdqqrospAJ7+Zw==,iv:3+yCVqH441+oXFLI5usaQdhnE3GFhbJjMsYeRvk8xEw=,tag:STxA32cSdwPBikXyVEP5+Q==,type:str]
+    key_secret: ENC[AES256_GCM,data:27BHAU5suCIiSKAf0+1yNa/VJ0umErb6Ry8HI+Zfv6LV+7eB+wk8H3kxdV4wmY2XayHsUrD4FZa30O0a9PdJgA==,iv:oI2X7PCXDZBkUOikHM8S7gHsnMtWp7jxBqdmfbUlrwU=,tag:9mZ3H2jobKqYmw6S4NNpjw==,type:str]
+    _r2_key_id: ENC[AES256_GCM,data:R0xwzUx+6l9SR3Fd93PfJw+WPV0ByzOKMxoJQtn4pEE=,iv:qHmr/HssM8U3znbGznSIOwkAhNaORkCkG9lqAmCKmfw=,tag:LhuiiKSq/VnNEulgrS71vg==,type:str]
+    _r2_key_secret: ENC[AES256_GCM,data:Dw5Gq1URjMpy9Bh1IBYf+/EnkvQA/4yAC4kdoACpCUuJQxdQphFKwWmxJX+Q/oztO1imWoGIxlZNNDr5QCqXaA==,iv:hGePo+Ffe48n1BXI1f2V12C9Gn1CC1nTwbSsfqUGQ3c=,tag:AIy/F3jPGz2WHge3Mk43Ag==,type:str]
+    _garage_key_id: ENC[AES256_GCM,data:2lLS1nBhrwBkJh/ei7FwBoR6jOI6KCJkvOs=,iv:jwB7ZEaKOPIwghcGRs3qaICypoHgSxkFBOyB6e5hpYI=,tag:Iqwv3j1R1uLLUDKLhN1Atg==,type:str]
+    _garage_key_secret: ENC[AES256_GCM,data:5iwwMfojHrR79cOIY+9O2oVY8v1cbPcECMSOMhWuGAdc2lfCogKBwLM4TFwBH9X1Vx56QvUoxCQ2uSyfOMLR7A==,iv:Q523ttz6ijmv8/JlVZuldFR4IabEKiVN4sGmJ9xDJU0=,tag:ZZ4LRG4DXOC7LY8hEjXYHQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -25,8 +29,8 @@ sops:
             UlYrTExEUVc0dURLR1czN3BnYzZ2VGMKCbAgM50jvs9VciA1Pb/VY+2I4x62LBGe
             j7eHkfTFc8Gnk/rZA9/ZJDLFr/FUPMQWK/NVoz6oLjO6oVFXqN6OqA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-01-30T17:45:09Z"
+    lastmodified: "2025-03-16T16:45:13Z"
-    mac: ENC[AES256_GCM,data:uXnJ8DCs1ZZ72PFAmSQpqvVH2UYvRX8AeUC00A6WsgNL9sz6H0b7PwXBn4SucHACwLwilMVKYpFGE1pPMsIgpHxU5coNhvTfth/ChY1KS73LAwrJUAyUoFI3mumPkklj7b/u1CbBfhuhA2QoZVl+d9BGQn5CQu3+BySUmcT+P9k=,iv:H/hUTBDNcsGBP5TA/7U1QMZogZvuoPuEAg/tBCpbf9w=,tag:W7rH84Na/tHPuJlA9tRXEQ==,type:str]
+    mac: ENC[AES256_GCM,data:DCx4uVuy53Gz9Ha2p/GjxTigKw/dJ0gvWIAII9AtKQCURu1OfiJ6Lp/ht6ndJwn25em11uppN371pQGxa8FRtLL+dX/YgoDmOw3Tgo3lc5VLBzalRqXHInOGHfgv9k1jHNq6zokKbBLDItBnUNOCvsLTXXenVRYdnkiuf3QPGhk=,iv:gBbbH/nJExK/dEXKHo+cCr+rxQ4uJQWweK0lYT7amsM=,tag:9GaCGFrcinqGfpibUNQ75w==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
     version: 3.9.4