use ghidra-bin cause debugger works

Signed-off-by: cy <cy@cy7.sh>

.sops.yaml

@@ -108,3 +108,8 @@ creation_rules:
       - age:
           - *chunk
           - *cy
+  - path_regex: secrets/yt/(.*).yaml$
+    key_groups:
+      - age:
+          - *yt
+          - *cy

flake.lock

@@ -32,11 +32,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1733424942,
-        "narHash": "sha256-5t7Sl6EkOaoP4FvzLmH7HFDbdl9SizmLh53RjDQCbWQ=",
+        "lastModified": 1737621947,
+        "narHash": "sha256-8HFvG7fvIFbgtaYAY2628Tb89fA55nPm2jSiNs0/Cws=",
         "owner": "cachix",
         "repo": "cachix",
-        "rev": "8b6b0e4694b9aa78b2ea4c93bff6e1a222dc7e4a",
+        "rev": "f65a3cd5e339c223471e64c051434616e18cc4f5",
         "type": "github"
       },
       "original": {
@@ -120,11 +120,11 @@
         "rocksdb": "rocksdb"
       },
       "locked": {
-        "lastModified": 1737153653,
-        "narHash": "sha256-yNdxoVZX13QUDJYM6zTMY9ExvacTqB+f0MLvDreSW8U=",
+        "lastModified": 1738132650,
+        "narHash": "sha256-ryebu2VoopIpr5+DuHIs2/x60u+3EzRJexYRWVJn2AE=",
         "owner": "girlbossceo",
         "repo": "conduwuit",
-        "rev": "5b8464252c2c03edf65e43153be026dbb768a12a",
+        "rev": "eb7d893c8675f955fa770c8ae6f1c32a2394284c",
         "type": "github"
       },
       "original": {
@@ -255,11 +255,11 @@
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
-        "lastModified": 1736836313,
-        "narHash": "sha256-zdZ7/T6yG0/hzoVOiNpDiR/sW3zR6oSMrfIFJK2BrrE=",
+        "lastModified": 1737786656,
+        "narHash": "sha256-ubCW9Jy7ZUOF354bWxTgLDpVnTvIpNr6qR4H/j7I0oo=",
         "owner": "nix-community",
         "repo": "fenix",
-        "rev": "056c9393c821a4df356df6ce7f14c722dc8717ec",
+        "rev": "2f721f527886f801403f389a9cabafda8f1e3b7f",
         "type": "github"
       },
       "original": {
@@ -369,11 +369,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736143030,
-        "narHash": "sha256-+hu54pAoLDEZT9pjHlqL9DNzWz0NbUn8NEAHP7PQPzU=",
+        "lastModified": 1738453229,
+        "narHash": "sha256-7H9XgNiGLKN1G1CgRh0vUL4AheZSYzPm+zmZ7vxbJdo=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "b905f6fc23a9051a6e1b741e1438dbfc0634c6de",
+        "rev": "32ea77a06711b758da0ad9bd6a844c5740a87abd",
         "type": "github"
       },
       "original": {
@@ -562,11 +562,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737704314,
-        "narHash": "sha256-zta8jvOQ2wRCZmiwFEnS5iCulWAh8e+fLUlQxrgOBjM=",
+        "lastModified": 1738448366,
+        "narHash": "sha256-4ATtQqBlgsGqkHTemta0ydY6f7JBRXz4Hf574NHQpkg=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a0428685572b134f6594e7d7f5db5e1febbab2d7",
+        "rev": "18fa9f323d8adbb0b7b8b98a8488db308210ed93",
         "type": "github"
       },
       "original": {
@@ -656,11 +656,11 @@
     "liburing": {
       "flake": false,
       "locked": {
-        "lastModified": 1736719310,
-        "narHash": "sha256-Turvx60THwzTiUHb49WV3upUgsPuktr7tVy2Lwu2xJg=",
+        "lastModified": 1737600516,
+        "narHash": "sha256-EKyLQ3pbcjoU5jH5atge59F4fzuhTsb6yalUj6Ve2t8=",
         "owner": "axboe",
         "repo": "liburing",
-        "rev": "3124a4619e4daf26b06d48ccf0186a947070c415",
+        "rev": "6c509e2b0c881a13b83b259a221bf15fc9b3f681",
         "type": "github"
       },
       "original": {
@@ -683,11 +683,11 @@
         "pre-commit-hooks": "pre-commit-hooks"
       },
       "locked": {
-        "lastModified": 1737726524,
-        "narHash": "sha256-Tw4kY4m5iNkRWCzmZO8ZO0i5iufD2K11leRy3uPR+g0=",
+        "lastModified": 1738446528,
+        "narHash": "sha256-NYL/r7EXSyYP7nXuYGvGYMI9QtztGjVaKKofBt/pCv8=",
         "ref": "refs/heads/main",
-        "rev": "ca68979174da416f0c3d11beaa19d3965a4654a0",
-        "revCount": 16681,
+        "rev": "a51380645f61b33d37a536b596d16c481f7b84a6",
+        "revCount": 17342,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/lix"
       },
@@ -710,11 +710,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737675503,
-        "narHash": "sha256-FUWpqPOsEJwK8oomffat+lgKnoxJHArRlWo2j17EhxQ=",
+        "lastModified": 1738176840,
+        "narHash": "sha256-NG3IRvRs3u3btVCN861FqHvgOwqcNT/Oy6PBG86F5/E=",
         "ref": "refs/heads/main",
-        "rev": "3e18a1ceec7df4514f5a045441e5f98dd003db09",
-        "revCount": 131,
+        "rev": "621aae0f3cceaffa6d73a4fb0f89c08d338d729e",
+        "revCount": 133,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/nixos-module"
       },
@@ -737,11 +737,11 @@
         "xwayland-satellite-unstable": "xwayland-satellite-unstable"
       },
       "locked": {
-        "lastModified": 1737723936,
-        "narHash": "sha256-7badcmkmjaOeEshFdGnoEofrZO667t/k5jDa0/NINpI=",
+        "lastModified": 1738502867,
+        "narHash": "sha256-92cVHcxV7j00BquLo5I4G8EwKzrq2AlHuD3AQV9r+T8=",
         "owner": "sodiboo",
         "repo": "niri-flake",
-        "rev": "84a8590f8196d3fccb1618a153dbd6bac325e3c4",
+        "rev": "cf0be7affb15e21727d137c029146fe7df2bc6d0",
         "type": "github"
       },
       "original": {
@@ -770,11 +770,11 @@
     "niri-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1737697331,
-        "narHash": "sha256-9k77pFW2ANx8bZc+RcF6YP9McFZsUCWWY+XwBX0P3/Q=",
+        "lastModified": 1738479340,
+        "narHash": "sha256-sutel7RKfu9eIJsjswSzptCIvKELbXQCSldt0PtwSd0=",
         "owner": "YaLTeR",
         "repo": "niri",
-        "rev": "748d90b443b9f20134020c21760b5b6c2c42a7de",
+        "rev": "d5592743cb04cef3fe50c987b7ba9349c5090dbd",
         "type": "github"
       },
       "original": {
@@ -832,11 +832,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737504076,
-        "narHash": "sha256-/B4XJnzYU/6K1ZZOBIgsa3K4pqDJrnC2579c44c+4rI=",
+        "lastModified": 1738277753,
+        "narHash": "sha256-iyFcCOk0mmDiv4ut9mBEuMxMZIym3++0qN1rQBg8FW0=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "65cc1fa8e36ceff067daf6cfb142331f02f524d3",
+        "rev": "49b807fa7c37568d7fbe2aeaafb9255c185412f9",
         "type": "github"
       },
       "original": {
@@ -883,6 +883,26 @@
         "type": "github"
       }
     },
+    "nix-ld": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1737361468,
+        "narHash": "sha256-+CtIrQZ22MOAOHcpg1zbhX/fVkmEc8A8lYVpXAbXElQ=",
+        "owner": "nix-community",
+        "repo": "nix-ld",
+        "rev": "7f15f8622b63b907fef137689f4528a9447d9377",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-ld",
+        "type": "github"
+      }
+    },
     "nix2container": {
       "flake": false,
       "locked": {
@@ -1045,11 +1065,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1737706285,
-        "narHash": "sha256-k/f1rAyCjGkNu4BnlnUGEvQPSnYVG7UHoOeaQQcjQps=",
+        "lastModified": 1738487426,
+        "narHash": "sha256-hnB0V0R/aKASnTBeTthFvW60uydv1xswWD4weqSuSfg=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "dcb7446a099fe1c95b3694fdb7a4dda8f19d6ba8",
+        "rev": "8ed1fafea6a613d962f6a84c1153d34dc8b06d83",
         "type": "github"
       },
       "original": {
@@ -1082,11 +1102,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737735875,
-        "narHash": "sha256-uZpZbT5kH7whiMpaMQjSPxRbRTmH5LaoBat6eQBHHaY=",
+        "lastModified": 1738517265,
+        "narHash": "sha256-ZzulGUIHZhvcSHx+1ucCJkIcn27r9H+cSzCCpKxJcls=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "bd3184f4957d5484bb5ebef4b9bc6f9cc53cfad5",
+        "rev": "56d0c4579e022b44a3e324f722fa23a6f4295798",
         "type": "github"
       },
       "original": {
@@ -1105,11 +1125,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737372689,
-        "narHash": "sha256-nH3zK2ki0fd5o5qvbGHxukE4qnOLJa1uCzoDObG5vrE=",
+        "lastModified": 1738445998,
+        "narHash": "sha256-wF2ZcRKF37re161jrXtNyjGMBDsIFtPeDvmIVfp8f7w=",
         "owner": "NuschtOS",
         "repo": "search",
-        "rev": "570cc17bbc25650eb7d69e4fcda8cfd2f1656922",
+        "rev": "381d84a7422a4dbfef6a9c7703dbaf42036ae1c3",
         "type": "github"
       },
       "original": {
@@ -1134,6 +1154,29 @@
         "type": "github"
       }
     },
+    "plasma-manager": {
+      "inputs": {
+        "home-manager": [
+          "home-manager"
+        ],
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1736549395,
+        "narHash": "sha256-XzwkB62Tt5UYoL1jXiHzgk/qz2fUpGHExcSIbyGTtI0=",
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "rev": "a53af7f1514ef4cce8620a9d6a50f238cdedec8b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "type": "github"
+      }
+    },
     "pre-commit-hooks": {
       "flake": false,
       "locked": {
@@ -1180,11 +1223,11 @@
     "rocksdb": {
       "flake": false,
       "locked": {
-        "lastModified": 1734469478,
-        "narHash": "sha256-IcQ4N8xADYal79K+ONmNq4RLlIwdgUqgrVzgNgiIaG8=",
+        "lastModified": 1737828695,
+        "narHash": "sha256-8Ev6zzhNPU798JNvU27a7gj5X+6SDG3jBweUkQ59DbA=",
         "owner": "girlbossceo",
         "repo": "rocksdb",
-        "rev": "8b4808e7de2fbb5d119d8d72cdca76d8ab84bc47",
+        "rev": "a4d9230dcc9d03be428b9a728133f8f646c0065c",
         "type": "github"
       },
       "original": {
@@ -1207,10 +1250,12 @@
         "lix": "lix",
         "lix-module": "lix-module",
         "niri": "niri",
+        "nix-ld": "nix-ld",
         "nixpkgs": "nixpkgs_5",
         "nixpkgs-garage": "nixpkgs-garage",
         "nixvim": "nixvim",
         "nvim-github-theme": "nvim-github-theme",
+        "plasma-manager": "plasma-manager",
         "rust-overlay": "rust-overlay",
         "sops-nix": "sops-nix",
         "treefmt": "treefmt"
@@ -1219,11 +1264,11 @@
     "rust-analyzer-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1736690231,
-        "narHash": "sha256-g9gyxX+F6CrkT5gRIMKPnCPom0o9ZDzYnzzeNF86D6Q=",
+        "lastModified": 1737728869,
+        "narHash": "sha256-U4pl3Hi0lT6GP4ecN3q9wdD2sdaKMbmD/5NJ1NdJ9AM=",
         "owner": "rust-lang",
         "repo": "rust-analyzer",
-        "rev": "8364ef299790cb6ec22b9e09e873c97dbe9f2cb5",
+        "rev": "6e4c29f7ce18cea7d3d31237a4661ab932eab636",
         "type": "github"
       },
       "original": {
@@ -1240,11 +1285,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737685583,
-        "narHash": "sha256-p+NVABRpGi+pT+xxf9HcLcFVxG6L+vEEy+NwzB9T0f8=",
+        "lastModified": 1738463259,
+        "narHash": "sha256-+5QJpiRpkh1ALvKcMEpPyGwkPZfaynsYF4SFdNW5UfQ=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "eb64cbcc8eee0fa87ebded92805280d2ec97415a",
+        "rev": "e2bb8c205a069514535f083742c7da8dfb6e02b9",
         "type": "github"
       },
       "original": {
@@ -1260,11 +1305,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737411508,
-        "narHash": "sha256-j9IdflJwRtqo9WpM0OfAZml47eBblUHGNQTe62OUqTw=",
+        "lastModified": 1738291974,
+        "narHash": "sha256-wkwYJc8cKmmQWUloyS9KwttBnja2ONRuJQDEsmef320=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "015d461c16678fc02a2f405eb453abb509d4e1d4",
+        "rev": "4c1251904d8a08c86ac6bc0d72cc09975e89aef7",
         "type": "github"
       },
       "original": {
@@ -1310,11 +1355,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1737483750,
-        "narHash": "sha256-5An1wq5U8sNycOBBg3nsDDgpwBmR9liOpDGlhliA6Xo=",
+        "lastModified": 1738070913,
+        "narHash": "sha256-j6jC12vCFsTGDmY2u1H12lMr62fnclNjuCtAdF1a4Nk=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "f2cc121df15418d028a59c9737d38e3a90fbaf8f",
+        "rev": "bebf27d00f7d10ba75332a0541ac43676985dea3",
         "type": "github"
       },
       "original": {
@@ -1343,11 +1388,11 @@
     "xwayland-satellite-unstable": {
       "flake": false,
       "locked": {
-        "lastModified": 1736487362,
-        "narHash": "sha256-4kGoOA7FgK9N2mzS+TFEn41kUUNY6KwdiA/0rqlr868=",
+        "lastModified": 1737837494,
+        "narHash": "sha256-wIMowP8Juas4ZwMRcpc+58sZ0kKTDu8fm13THPmv/F8=",
         "owner": "Supreeeme",
         "repo": "xwayland-satellite",
-        "rev": "8f55e27f63a749881c4bbfbb6b1da028342a91d1",
+        "rev": "3944c9a0e40e5629f16ad023bbc90dac80d35a0f",
         "type": "github"
       },
       "original": {

flake.nix

@@ -68,6 +68,15 @@
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.flake-compat.follows = "flake-compat";
     };
+    nix-ld = {
+      url = "github:nix-community/nix-ld";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    plasma-manager = {
+      url = "github:nix-community/plasma-manager";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.home-manager.follows = "home-manager";
+    };
 
     nixpkgs-garage.url = "github:cything/nixpkgs/garage-module"; # unmerged PR
 
@@ -89,6 +98,7 @@
       "https://nix-community.cachix.org"
       "https://cache.garnix.io"
       "https://cything.cachix.org"
+      "https://aseipp-nix-cache.global.ssl.fastly.net"
     ];
     extra-trusted-public-keys = [
       "central:uWhjva6m6dhC2hqNisjn2hXGvdGBs19vPkA1dPEuwFg="
@@ -125,9 +135,6 @@
             ...
           }:
           {
-            # make pkgs available to `perSystem`
-            _module.args.pkgs = inputs'.nixpkgs.legacyPackages;
-
             treefmt = {
               projectRootFile = "flake.nix";
               programs.nixfmt.enable = true;
@@ -138,23 +145,21 @@
 
               settings.global.excludes = [
                 "secrets/*"
-                "**/*.png" # tries to format a png file??
+                "**/*.png" # tries to format a png file
               ];
             };
           };
 
         flake =
           let
-            pkgsFor =
-              system:
-              import nixpkgs {
-                config.allowUnfree = true;
-                system = system;
-                overlays = [
-                  inputs.niri.overlays.niri
-                  inputs.rust-overlay.overlays.default
-                ] ++ import ./overlay;
-              };
+            pkgs = import nixpkgs {
+              config.allowUnfree = true;
+              system = "x86_64-linux";
+              overlays = [
+                inputs.niri.overlays.niri
+                inputs.rust-overlay.overlays.default
+              ] ++ import ./overlay;
+            };
           in
           {
             nixosConfigurations =
@@ -166,21 +171,22 @@
                   specialArgs = { inherit inputs; };
                   modules = [
                     {
-                      nixpkgs.pkgs = pkgsFor "x86_64-linux";
+                      nixpkgs = { inherit pkgs; };
                     }
                     ./hosts/ytnix
                     inputs.sops-nix.nixosModules.sops
                     ./modules
                     inputs.lanzaboote.nixosModules.lanzaboote
                     inputs.niri.nixosModules.niri
-                    # inputs.lix-module.nixosModules.default # broken
+                    inputs.lix-module.nixosModules.default
+                    inputs.nix-ld.nixosModules.nix-ld
                   ];
                 };
                 chunk = lib.nixosSystem {
                   specialArgs = { inherit inputs; };
                   modules = [
                     {
-                      nixpkgs.pkgs = pkgsFor "x86_64-linux";
+                      nixpkgs = { inherit pkgs; };
                       disabledModules = [
                         "services/web-servers/garage.nix"
                       ];
@@ -196,7 +202,7 @@
                   specialArgs = { inherit inputs; };
                   modules = [
                     {
-                      nixpkgs.pkgs = pkgsFor "x86_64-linux";
+                      nixpkgs = { inherit pkgs; };
                     }
                     ./hosts/titan
                     disko.nixosModules.disko
@@ -211,17 +217,18 @@
               in
               {
                 "yt@ytnix" = lib.homeManagerConfiguration {
-                  pkgs = pkgsFor "x86_64-linux";
+                  inherit pkgs;
                   extraSpecialArgs = { inherit inputs; };
                   modules = [
                     ./home/yt/ytnix.nix
                     inputs.nixvim.homeManagerModules.nixvim
                     inputs.niri.homeModules.config
+                    inputs.plasma-manager.homeManagerModules.plasma-manager
                   ];
                 };
 
                 "yt@chunk" = lib.homeManagerConfiguration {
-                  pkgs = pkgsFor "x86_64-linux";
+                  inherit pkgs;
                   extraSpecialArgs = { inherit inputs; };
                   modules = [
                     ./home/yt/chunk.nix
@@ -229,17 +236,8 @@
                   ];
                 };
 
-                "yt@raspberrypi" = lib.homeManagerConfiguration {
-                  pkgs = pkgsFor "aarch64-linux";
-                  extraSpecialArgs = { inherit inputs; };
-                  modules = [
-                    ./home/yt/raspberrypi.nix
-                    inputs.nixvim.homeManagerModules.nixvim
-                  ];
-                };
-
                 "codespace@codespace" = lib.homeManagerConfiguration {
-                  pkgs = pkgsFor "x86_64-linux";
+                  inherit pkgs;
                   extraSpecialArgs = { inherit inputs; };
                   modules = [
                     ./home/yt/codespace.nix

home/kitty.nix

@@ -58,6 +58,7 @@
       "ctrl+f2" = "detach_tab";
 
       # hints
+      # > basically means the preceding key is a prefix (think tmux)
       "kitty_mod+o>o" = "open_url_with_hints";
       "kitty_mod+o>p" = "kitten hints --type path --program -";
       "kitty_mod+o>n" = "kitten hints --type line --program -";
@@ -66,4 +67,6 @@
       "kitty_mod+o>l" = "kitten hints --type linenum";
     };
   };
+
+  programs.zsh.shellAliases."ssh" = "kitten ssh";
 }

home/niri/default.nix

@@ -50,7 +50,7 @@ in
         natural-scroll = true;
         click-method = "clickfinger";
       };
-      warp-mouse-to-focus = true;
+      warp-mouse-to-focus = false;
       focus-follows-mouse.enable = false;
     };
 
@@ -73,17 +73,23 @@ in
     window-rules = [
       {
         matches = [
-          {
-            app-id = "anki";
-            title = "Add";
-          }
           { app-id = "mpv"; }
           { app-id = "Bitwarden"; }
+          {
+            app-id = "ghidra-Ghidra";
+            # pop-up windows
+            title = "^win(.*)";
+          }
         ];
         open-floating = true;
       }
       {
-        matches = [ { app-id = "anki"; } ];
+        matches = [
+          {
+            app-id = "anki";
+            title = "Add";
+          }
+        ];
         default-column-width.proportion = .25;
       }
       {
@@ -96,6 +102,7 @@ in
           { app-id = "com.mitchellh.ghostt"; }
           { app-id = "org.kde.okular"; }
           { app-id = "kitty"; }
+          { app-id = "VSCodium"; }
         ];
         default-column-width.proportion = .5;
       }

home/nixvim/default.nix

@@ -24,7 +24,7 @@
 
     extraPlugins = [
       (pkgs.vimUtils.buildVimPlugin {
-        name = "gitub-theme";
+        name = "github-theme";
         src = inputs.nvim-github-theme;
       })
     ];
@@ -71,6 +71,41 @@
         key = "<C-e>";
         mode = "i";
       }
+      # quick chat with copilot
+      {
+        key = "<leader>ccq";
+        action.__raw = ''
+          function()
+            local input = vim.fn.input("Quick chat: ")
+            if input ~= "" then
+              require("CopilotChat").ask(input, { selection = require("CopilotChat.select").buffer })
+            end
+          end
+        '';
+        mode = [
+          "n"
+          "v"
+        ];
+      }
+      # ask perplexity a quick question
+      {
+        key = "<leader>ccs";
+        action.__raw = ''
+          function()
+            local input = vim.fn.input("Perplexity: ")
+            if input ~= "" then
+              require("CopilotChat").ask(input, {
+                agent = "perplexityai",
+                selection = false,
+              })
+            end
+          end
+        '';
+        mode = [
+          "n"
+          "v"
+        ];
+      }
     ];
 
     plugins.cmp = {
@@ -171,7 +206,11 @@
     plugins.treesitter = {
       enable = true;
       nixGrammars = true;
-      settings.indent.enable = true;
+      settings = {
+        indent.enable = true;
+        auto_install = true;
+        highlight.enable = true;
+      };
     };
     plugins.fzf-lua = {
       enable = true;
@@ -193,6 +232,13 @@
       settings.current_line_blame = true;
     };
 
+    plugins.copilot-chat = {
+      enable = true;
+      settings = {
+        model = "claude-3.5-sonnet";
+      };
+    };
+
     plugins.cmp-buffer.enable = true;
     plugins.cmp-emoji.enable = true;
     plugins.cmp-nvim-lsp.enable = true;

home/plasma.nix

@@ -0,0 +1,80 @@
+{ ... }:
+{
+  programs.plasma = {
+    enable = true;
+    overrideConfig = true;
+    immutableByDefault = true;
+    workspace = {
+      lookAndFeel = "org.ide.breezedark.desktop";
+      cursor = {
+        theme = "Bibata-Modern-Classic";
+        size = 23;
+      };
+    };
+
+    fonts = {
+      general = {
+        family = "IBM Plex Mono";
+        pointSize = 12;
+      };
+    };
+
+    input.keyboard = {
+      numlockOnStartup = "on";
+      options = [ "ctrl:nocaps" ];
+    };
+
+    # Meta key is actually the Super key in KDE
+
+    hotkeys.commands = {
+      "launch-terminal" = {
+        name = "launch terminal";
+        key = "Meta+Return";
+        command = "kitty";
+      };
+      "launch-browser" = {
+        name = "launch browser";
+        key = "Meta+B";
+        command = "librewolf";
+      };
+    };
+
+    shortcuts = {
+      kwin = {
+        "Switch Window Down" = "Meta+J";
+        "Switch Window Left" = "Meta+H";
+        "Switch Window Right" = "Meta+L";
+        "Switch Window Up" = "Meta+K";
+        "Window Quick Tile Down" = "Meta+Shift+J";
+        "Window Quick Tile Left" = "Meta+Shift+H";
+        "Window Quick Tile Right" = "Meta+Shift+L";
+        "Window Quick Tile Up" = "Meta+Shift+K";
+        "Window Close" = "Meta+Ctrl+Q";
+        "Window Maximize" = "Meta+W";
+        "Window Minimize" = "Meta+Shift+-";
+        "Window Fullscreen" = "Meta+F";
+        "Window Shrink Horizontal" = "Meta+-";
+      };
+
+      ksmserver = {
+        "Lock Session" = [
+          "Screensaver"
+          "Meta+Ctrl+L"
+        ];
+      };
+    };
+
+    configFile = {
+      # save RAM
+      baloofilerc."Basic Settings"."Indexing-Enabled" = false;
+    };
+
+    # looks like KDE overrides services.logind settings
+    powerdevil.AC = {
+      whenLaptopLidClosed = "hibernate";
+    };
+    powerdevil.battery = {
+      whenLaptopLidClosed = "hibernate";
+    };
+  };
+}

home/vscode.nix

@@ -8,11 +8,33 @@
     mutableExtensionsDir = false;
     extensions = with pkgs.vscode-extensions; [
       vscodevim.vim
-      jnoortheen.nix-ide # nix language support
-      editorconfig.editorconfig # editorconfig
-      dracula-theme.theme-dracula # color scheme
-      tomoki1207.pdf # pdf viewer
-      yzhang.markdown-all-in-one # markdown tools
+      jnoortheen.nix-ide
+      editorconfig.editorconfig
+      github.github-vscode-theme
+      github.copilot
+      rust-lang.rust-analyzer
     ];
+    userSettings = {
+      "workbench.colorTheme" = "GitHub Dark Default";
+      "files.autoSave" = "afterDelay";
+      "nix.enableLanguageServer" = true;
+      "nix.serverPath" = "nixd";
+      "editor.fontFamily" = "IBM Plex Mono";
+      "editor.fontSize" = 16;
+      "editor.wordWrap" = "on";
+
+      # vim mode settings
+      "vim.handleKeys" = {
+        "<C-b>" = false; # file tree toggle
+      };
+      "vim.normalModeKeyBindings" = [
+        {
+          "before" = [ ";" ];
+          "after" = [ ":" ];
+          "silent" = true;
+        }
+      ];
+      "workbench.startupEditor" = "none";
+    };
   };
 }

home/yt/common.nix

@@ -61,4 +61,5 @@
   };
   programs.ripgrep.enable = true;
   programs.man.generateCaches = true;
+  programs.fd.enable = true;
 }

home/yt/raspberrypi.nix

@@ -1,21 +0,0 @@
-{
-  pkgs,
-  ...
-}:
-{
-  imports = [
-    ./common.nix
-  ];
-  home = {
-    username = "yt";
-    homeDirectory = "/home/yt";
-    stateVersion = "25.05";
-  };
-  programs.home-manager.enable = true;
-
-  systemd.user.startServices = "sd-switch";
-
-  home.packages = with pkgs; [
-
-  ];
-}

home/yt/ytnix.nix

@@ -1,5 +1,6 @@
 {
   pkgs,
+  lib,
   ...
 }:
 {
@@ -9,6 +10,8 @@
     ../niri
     ../irssi.nix
     ../kitty.nix
+    ../vscode.nix
+    ../plasma.nix
   ];
   home = {
     username = "yt";
@@ -19,32 +22,32 @@
 
   systemd.user.startServices = "sd-switch";
 
-  qt = {
-    enable = true;
-    platformTheme.name = "kde";
-    style.name = "breeze-dark";
-    style.package = pkgs.kdePackages.breeze;
-  };
+  # keep this commented when using plasma
+  # otherwise "system settings" in KDE will not function
+  # qt = {
+  #   enable = true;
+  #   platformTheme.name = "kde";
+  #   style.name = "breeze-dark";
+  #   style.package = pkgs.kdePackages.breeze;
+  # };
 
-  gtk = {
-    enable = true;
-    cursorTheme = {
-      package = pkgs.bibata-cursors;
-      name = "Bibata-Modern";
-    };
-    theme = {
-      package = pkgs.adw-gtk3;
-      name = "adw-gtk3-dark";
-    };
-    iconTheme = {
-      package = pkgs.adwaita-icon-theme;
-      name = "Adwaita";
-    };
-  };
+  # this one too
+  # gtk = {
+  #   enable = true;
+  #   theme = {
+  #     package = pkgs.adw-gtk3;
+  #     name = "adw-gtk3-dark";
+  #   };
+  #   iconTheme = {
+  #     package = pkgs.adwaita-icon-theme;
+  #     name = "Adwaita";
+  #   };
+  # };
 
   home.pointerCursor = {
     package = pkgs.bibata-cursors;
-    name = "Bibata-Modern";
+    name = "Bibata-Modern-Classic";
+    size = 23;
     gtk.enable = true;
     x11.enable = true;
   };
@@ -106,6 +109,21 @@
     github-cli
     fuzzel
     nixpkgs-review
+    just
+    hugo
+    ghidra-bin
+    sequoia
+    sccache
+    awscli2
+    lldb
+    (cutter.withPlugins (p: with p; [
+      rz-ghidra
+      jsdec
+      sigdb
+    ]))
+    ida-free
+    patchelf
+    radare2
   ];
 
   programs.waybar.enable = true;
@@ -143,10 +161,36 @@
     '';
   };
 
-  services.gnome-keyring.enable = true;
-
   programs.direnv = {
     enable = true;
     nix-direnv.enable = true;
   };
+
+  programs.git.extraConfig = {
+    user = {
+      signingKey = "~/.ssh/id.key";
+    };
+    gpg.format = "ssh";
+    commit.gpgsign = true;
+    core.sshCommand = "ssh -i ~/.ssh/id.key";
+  };
+
+  home.sessionVariables = {
+    # to make ghidra work on xwayland
+    _JAVA_AWT_WM_NONREPARENTING = 1;
+
+    # sccache stuff
+    RUSTC_WRAPPER = "${lib.getExe pkgs.sccache}";
+    SCCACHE_BUCKET = "sccache";
+    SCCACHE_REGION = "earth";
+    SCCACHE_ENDPOINT = "https://sccache.s3.cy7.sh";
+    SCCACHE_ALLOW_CORE_DUMPS = "true";
+    SCCACHE_S3_USE_SSL = "true";
+    SCCACHE_CACHE_MULTIARCH = "true";
+    SCCACHE_LOG_LEVEL = "warn";
+    AWS_DEFAULT_REGION = "earth";
+    AWS_ENDPOINT_URL = "https://s3.cy7.sh";
+    AWS_ACCESS_KEY_ID = "$(cat /run/secrets/aws/key_id)";
+    AWS_SECRET_ACCESS_KEY = "$(cat /run/secrets/aws/key_secret)";
+  };
 }

home/zsh/default.nix

@@ -39,11 +39,6 @@
     initExtra = ''
       # disable control+s to pause terminal
       unsetopt FLOW_CONTROL
-      # manually integrate fzf cause we need to make sure zsh-vi-mode
-      # won't override C-r
-      function zvm_after_init() {
-        eval "$(${pkgs.fzf}/bin/fzf --zsh)"
-      }
 
       # useful emacs mode bindings
       bindkey -M viins "^E" end-of-line
@@ -94,8 +89,8 @@
       "ga" = "git add";
       "gaa" = "git add --all";
       "gb" = "git branch";
-      "gc" = "git commit --verbose -s";
-      "gcmsg" = "git commit -s --message";
+      "gc" = "git commit --verbose";
+      "gcmsg" = "git commit --message";
       "gd" = "git diff";
       "gdca" = "git diff --cached";
       "gds" = "git diff --staged";

hosts/chunk/Caddyfile

@@ -1,89 +0,0 @@
-{
-  acme_ca https://acme.zerossl.com/v2/DV90
-  acme_eab {
-    key_id {$EAB_KEY_ID}
-    mac_key {$EAB_MAC_KEY}
-  }
-}
-
-(common) {
-  encode zstd gzip
-  header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
-}
-
-git.cything.io {
-  import common
-
-  # wrap in route so things are evaluated in the order written
-  route {
-    # rewrite gitlab URIs to make it work with forgejo
-    uri path_regexp /-/ /
-    uri replace /blob/ /src/
-    redir https://git.cy7.sh{uri} permanent
-  }
-}
-
-git.cy7.sh {
-  import common
-  reverse_proxy localhost:3000
-}
-
-rss.cy7.sh {
-  import common
-  reverse_proxy localhost:8080
-}
-
-photos.cy7.sh {
-  import common
-  reverse_proxy localhost:2283
-}
-
-chat.cything.io {
-  import common
-  reverse_proxy localhost:8448
-}
-
-pass.cy7.sh {
-  import common
-  reverse_proxy localhost:8081
-}
-
-dns.cything.io {
-  import common
-  reverse_proxy localhost:8082
-}
-
-pad.cything.io {
-  import common
-  reverse_proxy localhost:8085
-}
-
-red.cything.io {
-  import common
-  reverse_proxy localhost:8087
-}
-
-grafana.cything.io {
-  import common
-  reverse_proxy localhost:8088
-}
-
-element.cything.io {
-  import common
-  reverse_proxy localhost:8089
-}
-
-cache.cything.io {
-  import common
-  reverse_proxy localhost:8090
-}
-
-s3.cy7.sh {
-  import common
-  reverse_proxy localhost:3900
-}
-
-admin.s3.cy7.sh {
-  import common
-  reverse_proxy localhost:3903
-}

hosts/chunk/adguard.nix

@@ -21,4 +21,9 @@
       ];
     };
   };
+
+  services.caddy.virtualHosts."dns.cything.io".extraConfig = ''
+    import common
+    reverse_proxy localhost:8082
+  '';
 }

hosts/chunk/attic.nix

@@ -31,4 +31,9 @@
       };
     };
   };
+
+  services.caddy.virtualHosts."cache.cything.io".extraConfig = ''
+    import common
+    reverse_proxy localhost:8090
+  '';
 }

hosts/chunk/conduwuit.nix

@@ -10,4 +10,9 @@
       allow_check_for_updates = true;
     };
   };
+
+  services.caddy.virtualHosts."chat.cything.io".extraConfig = ''
+    import common
+    reverse_proxy localhost:8448
+  '';
 }

hosts/chunk/default.nix

@@ -1,6 +1,4 @@
 {
-  config,
-  lib,
   pkgs,
   ...
 }:
@@ -75,8 +73,11 @@
     };
   };
 
-  boot.loader.grub.enable = true;
-  boot.loader.grub.device = "/dev/vda";
+  boot = {
+    loader.grub.enable = true;
+    loader.grub.device = "/dev/vda";
+    kernelPackages = pkgs.linuxPackages_latest;
+  };
 
   system.stateVersion = "24.05";
 
@@ -180,11 +181,13 @@
   programs.gnupg.agent.enable = true;
   programs.git.enable = true;
 
-  services.caddy = {
-    enable = true;
-    configFile = ./Caddyfile;
-    environmentFile = config.sops.secrets."caddy/env".path;
-    logFormat = lib.mkForce "level INFO";
+  my.caddy.enable = true;
+  services.caddy.virtualHosts."cy7.sh" = {
+    serverAliases = [ "www.cy7.sh" ];
+    extraConfig = ''
+      import common
+      redir https://cything.io temporary
+    '';
   };
 
   # container stuff

hosts/chunk/deluge.nix

@@ -7,4 +7,9 @@
       port = 8112;
     };
   };
+
+  services.caddy.virtualHosts."t.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8112
+  '';
 }

hosts/chunk/element.nix

@@ -25,4 +25,9 @@
       ${pkgs.podman}/bin/podman network create element-net
     '';
   };
+
+  services.caddy.virtualHosts."element.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8089
+  '';
 }

hosts/chunk/forgejo.nix

@@ -1,7 +1,8 @@
-{ ... }:
+{ pkgs, ... }:
 {
   services.forgejo = {
     enable = true;
+    package = pkgs.forgejo; # uses forgejo-lts by default
     user = "git";
     group = "git";
     settings = {
@@ -16,7 +17,7 @@
       service.DISABLE_REGISTRATION = true;
       ui = {
         AMBIGUOUS_UNICODE_DETECTION = false;
-        DEFAULT_THEME = "gitea-dark";
+        DEFAULT_THEME = "forgejo-dark";
       };
       actions.ENABLED = false;
       repository.ENABLE_PUSH_CREATE_USER = true;
@@ -29,4 +30,24 @@
       name = "git";
     };
   };
+
+  services.caddy.virtualHosts."git.cy7.sh".extraConfig = ''
+    import common
+
+    # renamed repo
+    uri replace /cy/infra /cy/nixos-config
+
+    reverse_proxy localhost:3000
+  '';
+  services.caddy.virtualHosts."git.cything.io".extraConfig = ''
+    import common
+
+    # wrap in route so things are evaluated in the order written
+    route {
+      # rewrite gitlab URIs to make it work with forgejo
+      uri path_regexp /-/ /
+      uri replace /blob/ /src/
+      redir https://git.cy7.sh{uri} permanent
+    }
+  '';
 }

hosts/chunk/garage.nix

@@ -8,6 +8,12 @@
       s3_api = {
         s3_region = "earth";
         api_bind_addr = "[::]:3900";
+        root_domain = ".s3.cy7.sh";
+      };
+      s3_web = {
+        bind_addr = "[::]:3902";
+        root_domain = ".web.s3.cy7.sh";
+        index = "index.html";
       };
       admin.api_bind_addr = "[::]:3903";
       rpc_bind_addr = "[::]:3901";
@@ -16,4 +22,22 @@
     };
     environmentFile = config.sops.secrets."garage/env".path;
   };
+
+  services.caddy.virtualHosts = {
+    "s3.cy7.sh" = {
+      serverAliases = [ "*.s3.cy7.sh" ];
+      extraConfig = ''
+        import common
+        reverse_proxy localhost:3900
+      '';
+    };
+    "*.web.s3.cy7.sh".extraConfig = ''
+      import common
+      reverse_proxy localhost:3902
+    '';
+    "admin.s3.cy7.sh".extraConfig = ''
+      import common
+      reverse_proxy localhost:3903
+    '';
+  };
 }

hosts/chunk/grafana.nix

@@ -31,4 +31,9 @@
       }
     ];
   };
+
+  services.caddy.virtualHosts."grafana.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8088
+  '';
 }

hosts/chunk/hedgedoc.nix

@@ -16,4 +16,9 @@
       protocolUseSSL = true;
     };
   };
+
+  services.caddy.virtualHosts."pad.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8085
+  '';
 }

hosts/chunk/immich.nix

@@ -95,4 +95,9 @@ in
       ${pkgs.podman}/bin/podman network create immich-net
     '';
   };
+
+  services.caddy.virtualHosts."photos.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:2283
+  '';
 }

hosts/chunk/miniflux.nix

@@ -9,4 +9,9 @@
       FORCE_REFRESH_INTERVAL = 0; # don't rate limit me
     };
   };
+
+  services.caddy.virtualHosts."rss.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8080
+  '';
 }

hosts/chunk/redlib.nix

@@ -10,4 +10,9 @@
       REDLIB_ROBOTS_DISABLE_INDEXING = "on";
     };
   };
+
+  services.caddy.virtualHosts."red.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8087
+  '';
 }

hosts/chunk/tailscale.nix

@@ -1,8 +1,12 @@
-{ config, ... }: {
+{ config, ... }:
+{
   services.tailscale = {
     enable = true;
     authKeyFile = config.sops.secrets."tailscale/auth".path;
-    extraUpFlags = [ "--advertise-exit-node" ];
+    extraUpFlags = [
+      "--advertise-exit-node"
+      "--accept-dns=false"
+    ];
     useRoutingFeatures = "server";
     openFirewall = true;
   };

hosts/chunk/vaultwarden.nix

@@ -10,4 +10,9 @@
       DATABASE_URL = "postgresql://vaultwarden:vaultwarden@127.0.0.1:5432/vaultwarden";
     };
   };
+
+  services.caddy.virtualHosts."pass.cy7.sh".extraConfig = ''
+    import common
+    reverse_proxy localhost:8081
+  '';
 }

hosts/common.nix

@@ -9,8 +9,21 @@
         "root"
         "@wheel"
       ];
-      trusted-public-keys = [ "central:uWhjva6m6dhC2hqNisjn2hXGvdGBs19vPkA1dPEuwFg=" ];
-      substituters = [ "https://cache.cything.io/central" ];
+      trusted-public-keys = [
+        "central:uWhjva6m6dhC2hqNisjn2hXGvdGBs19vPkA1dPEuwFg="
+        "niri.cachix.org-1:Wv0OmO7PsuocRKzfDoJ3mulSl7Z6oezYhGhR+3W2964="
+        "nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
+        "cache.garnix.io:CTFPyKSLcx5RMJKfLo5EEPUObbA78b0YQ2DTCJXqr9g="
+        "cything.cachix.org-1:xqW1W5NNL+wrM9wfSELb0MLj/harD2ZyB4HbdaMyvPI="
+      ];
+      substituters = [
+        "https://aseipp-nix-cache.global.ssl.fastly.net"
+        "https://cache.cything.io/central"
+        "https://niri.cachix.org"
+        "https://nix-community.cachix.org"
+        "https://cache.garnix.io"
+        "https://cything.cachix.org"
+      ];
     };
     channel.enable = false;
     optimise = {
@@ -24,8 +37,8 @@
       options = "--delete-older-than 14d";
     };
     extraOptions = ''
-      	    builders-use-substitutes = true
-      	  '';
+      builders-use-substitutes = true
+    '';
     registry.nixpkgs.flake = inputs.nixpkgs;
   };
   time.timeZone = "America/Toronto";

hosts/titan/Caddyfile

@@ -13,14 +13,16 @@
 
 cything.io {
   import common
-  reverse_proxy localhost:8084
 
   header /.well-known/matrix/* Content-Type application/json
   header /.well-known/matrix/* Access-Control-Allow-Origin *
   header /.well-known/matrix/* Access-Control-Allow-Methods GET,POST,PUT,DELETE,OPTIONS,PATCH,HEAD
   header /.well-known/matrix/* Access-Control-Allow-Headers X-Requested-With,Content-Type,Authorization,Origin,Accept
-  respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
-  respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
+  route {
+    respond /.well-known/matrix/server {"m.server":"chat.cything.io:443"}
+    respond /.well-known/matrix/client {"m.server":{"base_url":"https://chat.cything.io"},"m.homeserver":{"base_url":"https://chat.cything.io"},"org.matrix.msc3575.proxy":{"url":"https://chat.cything.io"}}
+    redir https://cy7.sh/posts{uri} permanent
+  }
 }
 
 www.cything.io {

hosts/ytnix/default.nix

@@ -36,6 +36,14 @@
     "tailscale/auth" = {
       sopsFile = ../../secrets/services/tailscale.yaml;
     };
+    "aws/key_id" = {
+      sopsFile = ../../secrets/yt/aws.yaml;
+      owner = "yt";
+    };
+    "aws/key_secret" = {
+      sopsFile = ../../secrets/yt/aws.yaml;
+      owner = "yt";
+    };
   };
 
   boot = {
@@ -166,6 +174,8 @@
     haskell-language-server
     ghc
     sbctl # secure boot
+    wine-wayland
+    wine64
   ];
 
   environment.sessionVariables = {
@@ -179,6 +189,12 @@
   services.displayManager = {
     enable = true;
     autoLogin.user = "yt";
+    defaultSession = "plasma";
+    sddm = {
+      enable = true;
+      wayland.enable = true;
+      autoNumlock = true;
+    };
   };
 
   fonts.packages = with pkgs; [
@@ -268,12 +284,56 @@
   programs.virt-manager.enable = true;
 
   services.usbmuxd.enable = true;
-  programs.nix-ld.enable = true;
+  programs.nix-ld.dev = {
+    enable = true;
+    # nix run github:thiagokokada/nix-alien#nix-alien-find-libs ./<binary>
+    libraries = with pkgs; [
+      mesa
+      extest
+      stdenv.cc.cc
+      libGL
+      fontconfig
+      libxkbcommon
+      zlib
+      libxml2
+      dbus
+      freetype
+      egl-wayland
+      waylandpp
+      cairo
+      xcb-util-cursor
+      libplist
+      p11-kit
+      kdePackages.qtwayland
+      qt6.qtwayland
+      libsForQt5.qt5.qtwayland
+      xorg.libX11
+      xorg.libxcb
+      xorg.xcbutilwm
+      xorg.xcbutilimage
+      xorg.xcbutilkeysyms
+      xorg.xcbutilrenderutil
+      xorg.libXScrnSaver
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXi
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXtst
+      xorg.libxkbfile
+      xorg.libxshmfence
+    ];
+  };
   programs.evolution.enable = true;
 
   xdg.portal = {
     enable = true;
     wlr.enable = true;
+    xdgOpenUsePortal = true;
+    extraPortals = with pkgs; [ xdg-desktop-portal-gtk xdg-desktop-portal-gnome ];
   };
 
   programs.obs-studio = {
@@ -324,4 +384,15 @@
   services.udev.extraHwdb = ''
     SUBSYSTEM=="usb", SYSFS{idVendor}=="090c", SYSFS{idProduct}=="1000", ACTION=="add", GROUP="users", MODE="0664"
   '';
+
+  programs.ssh = {
+    askPassword = "${pkgs.seahorse}/libexec/seahorse/ssh-askpass";
+    startAgent = true;
+    enableAskPassword = true;
+  };
+
+  services.desktopManager.plasma6 = {
+    enable = true;
+    enableQt5Integration = true;
+  };
 }

hosts/ytnix/tailscale.nix

@@ -1,4 +1,5 @@
-{ config, ... }: {
+{ config, ... }:
+{
   services.tailscale = {
     enable = true;
     authKeyFile = config.sops.secrets."tailscale/auth".path;
@@ -6,6 +7,7 @@
     useRoutingFeatures = "client";
     extraUpFlags = [
       "--exit-node=100.122.132.30"
+      "--accept-dns=false"
     ];
   };
 }

justfile

@@ -1,9 +1,10 @@
 update:
+    git branch -D update || true
     git switch -c update
     nix flake update
     git add flake.lock
     git commit -s -m "flake update"
-    git push
+    git push -f
     git switch main
 
 upgrade:

modules/caddy.nix

@@ -0,0 +1,40 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.my.caddy;
+in
+{
+  options.my.caddy = {
+    enable = lib.mkEnableOption "caddy reverse proxy";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.caddy = {
+      enable = true;
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          # error message will tell you the correct version tag to use
+          # (still need the @ to pass nix config check)
+          "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"
+        ];
+        hash = "sha256-jCcSzenewQiW897GFHF9WAcVkGaS/oUu63crJu7AyyQ=";
+      };
+      logFormat = lib.mkForce "level INFO";
+      acmeCA = "https://acme-v02.api.letsencrypt.org/directory";
+      extraConfig = ''
+        (common) {
+          encode zstd gzip
+          header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
+        }
+      '';
+      globalConfig = ''
+        acme_dns cloudflare {$CLOUDFLARE_KEY}
+      '';
+      environmentFile = config.sops.secrets."caddy/env".path;
+    };
+  };
+}

modules/default.nix

@@ -2,5 +2,6 @@
 {
   imports = [
     ./backup.nix
+    ./caddy.nix
   ];
 }

overlay/default.nix

@@ -2,6 +2,7 @@ let
   overlays = [
     ./conduwuit
     ./attic
+    ./vscode.nix
   ];
   importedOverlays = map (m: import m) overlays;
 in

overlay/vscode.nix

@@ -0,0 +1,14 @@
+final: prev: {
+  vscode-extensions = prev.vscode-extensions // {
+    github = prev.vscode-extensions.github // {
+      codespaces = prev.vscode-utils.buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          publisher = "github";
+          name = "codespaces";
+          version = "1.17.3";
+          hash = "sha256-idJFYHJ4yeqpFZBX55Y0v1yfzgqyhS0MrC4yIto7i7w=";
+        };
+      };
+    };
+  };
+}

secrets/services/caddy.yaml

@@ -1,5 +1,5 @@
 caddy:
-    env: ENC[AES256_GCM,data:uVCkVky5MRRhN+g4f634nBjvpcI5Ldy+eOKXg7eGu9foswTHA1SXDs67+Wuvo/jaPw7Zg67xKZRHnoTon1udQzyfu0T6pmVKfsUPewITYCd+qLTanFz6uVRUHzpUVwjCZNqB8gxNr/BiZ70NG4vQXRjgd3zKFrQYQBr4zSaP2vK1pRdbuQ==,iv:dQBfX4X8huUp2dqY3tEGW+BPZ/XADT10ptt85R7X+AY=,tag:cvMbFjkRHoxxnNfz8dGv5g==,type:str]
+    env: ENC[AES256_GCM,data:XyxcCVT+rwlS7A3xzUgGqpMoLwhfUJo2++zPTgoPt3q6Edt14bYQJsoSJXnKx/lGg/0ilNfEEg8AEnru/Mzx0bWedSdWuZ380l8wlLiucqQThhEBhEJlyd94BMNzhxFdj82w0ejp4oWb5By/WjkFNesvAyxPIo/Ir4S+fTgGpA1iO2Ms8Pdjp00qeXYsK1CfjaXOYlEP+8BxntN2JKLYb8Cgs7dLmHfUwP6gTFKlTukUTtQZYUw336q3TtGy,iv:Ab/E0ljUBxzWlXfAC2BXCYxlgo0ErvKFaubgVjFR3OU=,tag:Yr24/DofYS2lM6f2/1LQ3Q==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -33,8 +33,8 @@ sops:
             Q2hBZE1FOHJ3aW5rVmoyK045eG11cmsKFOmP5iWONREZvxu0rM+fKMPQKgnYq5LH
             AKMZFsP7nnUxjdCXEA18sDg4Rf0qp8i3uQK3D6P7417j9ye/YZA4BQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-17T03:25:37Z"
-    mac: ENC[AES256_GCM,data:bhFBLkT2q6HGtTPtHLVZkKZn00Lbm11/u3qSR19lU2E1SsQ7mpukvCqcTxNWtJ+HHth6yJJfgM6XABKq/9/598L2MgGuF3C/GGS3xpjwHh5RyV8t1lV8cqDaZGjGOMGx35lFQ6DoXOreQrtP/f7MKzf+nVNFr1NbTR8YhqR1xDU=,iv:+fjYlbyIyM9nLagrvE+PUhC2pT7QTsTSQX7ELZ7Wuhs=,tag:GWQv6VmIsWwFzb4bUr5CLg==,type:str]
+    lastmodified: "2025-01-30T17:26:39Z"
+    mac: ENC[AES256_GCM,data:saoalvnwHsv0CTw/cRZqibnH9oGoZTNwGUT7RePKRa8OwNzbUEzQt+Z1WrmmWoqR+omQXLE+lpOPv6uNYxvAWnIelzCGeBBCMSBxtjlTUsjts7oFo7d9C5SdTIOkzotDxryvjRupb0P7hAmEqcSUKRZipJy5MVR7VXR1XZ4fIPM=,iv:VaP05zj8L2pygi1/M4BnOV3Inf0ssaWMu+aTBkdDMys=,tag:nuZT8GMB4F0T5dHnTvHOhA==,type:str]
     pgp: []
     unencrypted_suffix: _unencrypted
-    version: 3.9.2
+    version: 3.9.4

secrets/yt/aws.yaml

@@ -0,0 +1,32 @@
+aws:
+    key_id: ENC[AES256_GCM,data:vxa8IS5zVOStsQaQNoPy36MeCw2KD2Th5tg=,iv:TrPukr/bpkGysf1YigBlXwaCu0H1FM6ivCVQEgnst6A=,tag:yrlcsDkLkH7U2i3JgjDaBA==,type:str]
+    key_secret: ENC[AES256_GCM,data:R9hFgtylEW1RphrP7/9Hi7HIb7gcQX1WDEVfnUTTzh+/0LM2Rb9CdkaleO8wNlcyYVE/jUKtqdqqrospAJ7+Zw==,iv:3+yCVqH441+oXFLI5usaQdhnE3GFhbJjMsYeRvk8xEw=,tag:STxA32cSdwPBikXyVEP5+Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1sy0at69err83qyml2vqu8xvwjccfws447aaadfvacj2qluw3p45s2mtrw8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKaUZKbTVjZ1NEWlE5RzZT
+            T1dKdkRQajEva0tpRXhxYUlYWmw1b3MwSFZvCmhteVJ2VGhVNnZTZkJlem1OT3dL
+            dGlQTWdOUlo3TXNOS0wvNlpqVWpZSFEKLS0tIC9DNjY3OW1zWUlRQ1ZEOGlBRk9R
+            azQxMGhQejQ5M0N1YjFtSW5uVnRCQ3MKtt26G2PxIry/lppOT/NUX8jebEb5NgqO
+            HuHj7WT51Gtotfgb22VfGeOCaw9+pPYSjdk9WV4z57r7Z/lylALKRw==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age10h6pg5qdpc4t0rpmksfv788a57f04n83zgqaezkjjn65nkhv547s0vxfdn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPaVIwbExDUjJiVFpHOFJu
+            dk1SUHc5UDRFUENsbkg2RmQvazdEZ1NKeEhvCjVCNzdwRFN0aUZJL0pVSTI1RUxv
+            Ymhhc0tsSENVa1VUKzRBZk5IcjEvNFUKLS0tIFpPNlRXOVYyVnpyUmtLMTFqNlZ0
+            UlYrTExEUVc0dURLR1czN3BnYzZ2VGMKCbAgM50jvs9VciA1Pb/VY+2I4x62LBGe
+            j7eHkfTFc8Gnk/rZA9/ZJDLFr/FUPMQWK/NVoz6oLjO6oVFXqN6OqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-01-30T17:45:09Z"
+    mac: ENC[AES256_GCM,data:uXnJ8DCs1ZZ72PFAmSQpqvVH2UYvRX8AeUC00A6WsgNL9sz6H0b7PwXBn4SucHACwLwilMVKYpFGE1pPMsIgpHxU5coNhvTfth/ChY1KS73LAwrJUAyUoFI3mumPkklj7b/u1CbBfhuhA2QoZVl+d9BGQn5CQu3+BySUmcT+P9k=,iv:H/hUTBDNcsGBP5TA/7U1QMZogZvuoPuEAg/tBCpbf9w=,tag:W7rH84Na/tHPuJlA9tRXEQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4