file cleanup, conditional motd

modules/homelab/ai/ollama/default.nix

@@ -1,13 +1,11 @@
 {
   pkgs,
-  nixpkgs-unstable,
   config,
   lib,
   ...
 }: let
   service = "ollama";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
 in {
   options.homelab.${service} = {
@@ -41,7 +39,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
@@ -59,10 +60,6 @@ in {
       createHome = true;
       group = service;
       extraGroups = [];
-      # if you wanna attempt system ssh again
-      #openssh.authorizedKeys.keyFiles = [
-      #  "${cfg.data_dir}/.ssh/authorized_keys"
-      #];
     };
 
     # declare the gitea service
@@ -94,25 +91,11 @@ in {
       '';
     };
 
-    # add to glance
-    #    homelab.glance.links.services = [{
-    #      title = service;
-    #      url = "https://git.${homelab.base_domain}";
-    #      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-    #      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-    #      icon = "di:${service}"; }];
-
-    # manage secrets with sops
-    #    sops.secrets = {
-    #      "${service}_database_password" = {
-    #        owner = service;
-    #        group = service;
-    #      };
-    #    };
-
     # add to backups
     homelab.backups.baks = {
-      ${service} = {paths = [cfg.data_dir];};
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }

modules/homelab/ai/open-webui/default.nix

@@ -1,13 +1,11 @@
 {
   pkgs,
-  nixpkgs-unstable,
   config,
   lib,
   ...
 }: let
   service = "open-webui";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
 in {
   options.homelab.${service} = {
@@ -41,7 +39,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
@@ -59,10 +60,6 @@ in {
       createHome = true;
       group = service;
       extraGroups = [];
-      # if you wanna attempt system ssh again
-      #openssh.authorizedKeys.keyFiles = [
-      #  "${cfg.data_dir}/.ssh/authorized_keys"
-      #];
     };
 
     # declare the gitea service
@@ -100,17 +97,11 @@ in {
       }
     ];
 
-    # manage secrets with sops
-    #    sops.secrets = {
-    #      "${service}_database_password" = {
-    #        owner = service;
-    #        group = service;
-    #      };
-    #    };
-
     # add to backups
     homelab.backups.baks = {
-      ${service} = {paths = [cfg.data_dir];};
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }

modules/homelab/default.nix

@@ -14,7 +14,7 @@ in {
       description = "set timezone";
     };
     base_domain = lib.mkOption {
-      default = "snowbelle.lan";
+      default = "lumiose.blakedheld.xyz";
       type = lib.types.str;
       description = "base domain used for reverse proxy";
     };

modules/homelab/mediastack/audiobookshelf/default.nix

@@ -6,7 +6,6 @@
 }: let
   service = "audiobookshelf";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
 in {
   options.homelab.${service} = {
@@ -76,16 +75,11 @@ in {
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
-      #      User = service;
-      #      Group = service;
     };
 
-    #    # open firewall
-    #    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = ["abs.${homelab.public_domain}"];
+      #serverAliases = ["abs.${homelab.public_domain}"];
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port} {

modules/homelab/mediastack/bazarr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "bazarr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,12 +39,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
@@ -72,9 +75,6 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -84,12 +84,15 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {

modules/homelab/mediastack/flaresolverr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "flaresolverr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,12 +39,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
@@ -68,9 +71,6 @@ in
       Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''

modules/homelab/mediastack/jellyfin/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "jellyfin";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,7 +44,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
@@ -72,14 +72,9 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-    #services.caddy.virtualHosts."${cfg.url}" = {
       serverAliases = ["media.${homelab.public_domain}"];
-      #tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -87,12 +82,15 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://media.${homelab.public_domain}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {

modules/homelab/mediastack/prowlarr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "prowlarr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,12 +39,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
@@ -74,9 +77,6 @@ in
       Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -86,16 +86,21 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }

modules/homelab/mediastack/qbittorrent/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "qbittorrent";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -48,12 +49,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-
     # ensure media dirs existence
     systemd.tmpfiles.rules = [
       "d /holocron/media/downloads 2775 qbittorrent media -"
@@ -102,18 +105,6 @@ in
       iptables -A QBIT -j DROP
     '';
 
-# boilerplate for if you ever want to try to get this working again
-# ------------------------------------------------------------------------------
-#      # add systemd service to VPN network namespace
-#      vpnConfinement = {
-#        enable = true;
-#        vpnNamespace = "wgmex";
-#      };
-# ------------------------------------------------------------------------------
-
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -123,12 +114,15 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {

modules/homelab/mediastack/radarr/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "radarr";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,12 +40,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-
     # required
     environment.systemPackages = with pkgs; [ffmpeg_6-headless];
 
@@ -80,9 +84,6 @@ in
       #      Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -92,12 +93,15 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {

modules/homelab/mediastack/sonarr/default.nix

@@ -6,7 +6,6 @@
 }: let
   service = "sonarr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
 in {
   options.homelab.${service} = {
@@ -40,7 +39,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
@@ -79,12 +81,8 @@ in {
       UMask = lib.mkForce "0007";
     };
 
-    #    # open firewall
-    #    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      # tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}

modules/homelab/mediastack/yacreader/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "yacreader";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,12 +39,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # install the binary
     environment.systemPackages = with pkgs; [yacreader];
 
@@ -93,12 +96,15 @@ in
     };
 
     # add to glance local service
-    homelab.glance.links.mediastack = [{
+    homelab.glance.links.mediastack = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:yac-reader"; }];
+        icon = "di:yac-reader";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
@@ -106,4 +112,3 @@ in
     };
   };
 }
-

modules/homelab/network/caddy/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "caddy";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -28,12 +30,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {};
 
@@ -58,6 +62,7 @@ in
         auto_https ignore_loaded_certs
       '';
 
+      # static page for hosting key files
       virtualHosts."keys.${homelab.base_domain}" = {
         serverAliases = ["keys.${homelab.public_domain}"];
         extraConfig = ''

modules/homelab/network/ddns/default.nix

@@ -5,7 +5,6 @@
   ...
 }: let
   cfg = config.homelab.ddns;
-  token = config.sops.secrets."cloudflare/api_token".path;
   sec = config.sops.secrets;
 in {
   options.homelab.ddns = {
@@ -15,7 +14,7 @@ in {
   config = lib.mkIf cfg.enable {
     services.cloudflare-ddns = {
       enable = true;
-      credentialsFile = token;
+      credentialsFile = sec."cloudflare/api_token".path;
       domains = [
         # recoil.pro
         "recoil.pro"
@@ -31,12 +30,9 @@ in {
         "*.blakedheld.xyz"
         "git.blakedheld.xyz"
         "up.blakedheld.xyz"
-
       ];
     };
 
-    # network config
-
     # declare authkey secrets
     sops.secrets = {
       "cloudflare/api_token" = {

modules/homelab/network/dnsmasq/default.nix

@@ -6,8 +6,6 @@
 }: let
   service = "dnsmasq";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
-  homelab = config.homelab;
 in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
@@ -16,6 +14,11 @@ in {
       default = 53;
       description = "set port for ${service} (default: ${toString cfg.port}";
     };
+    upstream = lib.mkOption {
+      type = lib.types.str;
+      default = "10.10.0.1";
+      description = "set upstream dns server for ${service} (default: $cfg.upstream}";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -25,7 +28,7 @@ in {
       alwaysKeepRunning = true;
       settings = {
         no-resolv = true;
-        listen-address = "10.10.0.11"; # your LAN IP
+        listen-address = config.homelab.host_ip; # your LAN IP
         #interface = "enp89s0";
         bind-interfaces = true;
         #        address = [
@@ -35,7 +38,7 @@ in {
         #        ];
         server = [
           # upstream dns
-          "10.10.0.1"
+          cfg.upstream
         ];
       };
     };

modules/homelab/network/tailscale/default.nix

@@ -5,7 +5,7 @@
   ...
 }: let
   cfg = config.homelab.tailscale;
-  authkey_file = config.sops.secrets."tailscale_authkey".path;
+  sec = config.sops.secrets;
 in {
   options.homelab.tailscale = {
     enable = lib.mkEnableOption "enables tailscale";
@@ -16,7 +16,7 @@ in {
       enable = true;
       openFirewall = true;
       useRoutingFeatures = "both";
-      authKeyFile = authkey_file;
+      authKeyFile = sec."tailscale_authkey".path;;
       extraSetFlags = [
         "--advertise-routes=${config.homelab.host_ip}/32" # advertise self
         "--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)

modules/homelab/services/gitea/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, nixpkgs-unstable, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "gitea";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,12 +45,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
@@ -78,13 +82,13 @@ in
       settings = {
         server = {
           # http config
-          ROOT_URL = "https://git.blakedheld.xyz";
+          ROOT_URL = "https://git.${homelab.public_domain}";
-          DOMAIN = "git.blakedheld.xyz";
+          DOMAIN = "git.${homelab.public_domain}";
           HTTP_PORT = cfg.port;
           # local network config
           #LOCAL_ROOT_URL = "https://git.snowbelle.lan";
           ALLOW_LOCALNETWORKS = true;
-          ALLOWED_DOMAINS = "10.10.0.10";
+          ALLOWED_DOMAINS = homelab.host_ip;
           SKIP_TLS_VERIFY = true;
           # configure for system ssh (trying to use the systms on nix sucks)
           SSH_PORT = cfg.ssh_port;
@@ -100,7 +104,7 @@ in
         };
       };
       database = {
-        passwordFile = "${toString config.sops.secrets."gitea_database_password".path}";
+        passwordFile = "${toString sec."gitea_database_password".path}";
       };
     };
 
@@ -127,14 +131,16 @@ in
       '';
     };
 
-
     # add to glance
-    homelab.glance.links.services = [{
+    homelab.glance.links.services = [
+      {
         title = service;
         url = "https://git.${homelab.public_domain}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # manage secrets with sops
     sops.secrets = {

modules/homelab/services/glance/default.nix

@@ -59,7 +59,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
     links = {
       services = lib.mkOption {

modules/homelab/services/home/homeassistant/default.nix

@@ -42,7 +42,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = "podman-hass";
+      default =
+        if cfg.enable
+        then "podman-hass"
+        else null;
     };
   };
 
@@ -73,10 +76,6 @@ in {
         volumes = [
           "${cfg.data_dir}:/config"
         ];
-        #        ports = [
-        #          "0.0.0.0:7704:8123"
-        #          "0.0.0.0:4141:4141"
-        #        ];
         environment = {
           TZ = homelab.tz;
           PUID = toString config.users.users.${service}.uid;

modules/homelab/services/home/mosquitto/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "mosquitto";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,12 +40,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
@@ -74,6 +78,7 @@ in
         #        omitPasswordAuth = true;
       }
     ];
+
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";

modules/homelab/services/home/wyoming/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "wyoming";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -24,7 +26,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # enable the ${service} service
     services.${service} = {
       faster-whisper = {
@@ -49,9 +50,7 @@ in
       };
     };
 
-#    # open firewall
+    # open firewall
-    #networking.firewall.allowedTCPPorts = [ cfg.faster_whisper_port cfg.piper_port ];
+    networking.firewall.allowedTCPPorts = [cfg.faster_whisper_port cfg.piper_port];
-    networking.firewall.allowedTCPPorts = [ 7706 7707 ];
-
   };
 }

modules/homelab/services/home/zigbee2mqtt/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "zigbee2mqtt";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,12 +40,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
@@ -108,12 +112,15 @@ in
     };
 
     # add to glance
-    homelab.glance.links.services = [{
+    homelab.glance.links.services = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     sops.secrets = {
       "mosquitto_passwd.yaml" = {

modules/homelab/services/immich/default.nix

@@ -42,7 +42,7 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = "immich-server";
+      default = if cfg.enable then "immich-server" else null;;
     };
     library_sync_dir = lib.mkOption {
       type = lib.types.str;
@@ -78,7 +78,6 @@ in {
       host = "0.0.0.0";
       port = cfg.port;
       settings = null;
-      #settings.server.externalDomain = "https://photos.blakedheld.xyz";
     };
 
     # too lazy to add an option, this is on the storage pool now anyway
@@ -138,8 +137,6 @@ in {
     ];
 
     # add postgresql database that is automatically created to the backup list
-    #services.postgresqlBackup.databases = ["immich"]; # set to all databases defined in esure databases
-
     services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases
 
     # add to backups

modules/homelab/services/searxng/default.nix

@@ -1,6 +1,5 @@
 {
   pkgs,
-  nixpkgs-unstable,
   config,
   lib,
   ...
@@ -41,7 +40,10 @@ in {
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
@@ -59,10 +61,6 @@ in {
       createHome = true;
       group = service;
       extraGroups = [];
-      # if you wanna attempt system ssh again
-      #openssh.authorizedKeys.keyFiles = [
-      #  "${cfg.data_dir}/.ssh/authorized_keys"
-      #];
     };
 
     # declare the gitea service

modules/homelab/services/vaultwarden/default.nix

@@ -1,13 +1,15 @@
-{ pkgs, config, lib, unstable_pkgs, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "vaultwarden";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
   domain = "https://pass.blakedheld.xyz";
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -39,12 +41,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
@@ -68,18 +72,8 @@ in
         ROCKET_ADDRESS = "0.0.0.0";
         ROCKET_PORT = cfg.port;
         SIGNUPS_ALLOWED = true;
-#        ADMIN_TOKEN = "yuh";
+        ADMIN_TOKEN = "${toString sec."vaultwarden_admin_token".path}";
-        ADMIN_TOKEN = "${toString config.sops.secrets."vaultwarden_admin_token".path}";
         EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item";
-          # The following flags are available:
-          # - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
-          # - "autofill-v2": Use the new autofill implementation.
-          # - "browser-fileless-import": Directly import credentials from other providers without a file.
-          # - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
-          # - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
-          # - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
-          # - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
-          # - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
       };
     };
 
@@ -99,12 +93,15 @@ in
     };
 
     # add to glance
-    homelab.glance.links.services = [{
+    homelab.glance.links.services = [
+      {
         title = service;
         url = "https://pass.${homelab.public_domain}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     sops.secrets = {
       "${service}_admin_token" = {

modules/homelab/system/default.nix

@@ -1,11 +1,14 @@
-{ pkgs, config, lib, ... }:
 {
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
   # the order determines the order in glance :3
   imports = [
     ./motd
     ./backups
     ./uptime-kuma
-    ./postfix
+    #./postfix
   ];
-
 }

modules/homelab/system/uptime-kuma/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
+{
-
+  pkgs,
-let
+  config,
+  lib,
+  ...
+}: let
   service = "uptime-kuma";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
+in {
-{
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -38,12 +40,14 @@ in
     };
     motd = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = service;
+      default =
+        if cfg.enable
+        then service
+        else null;
     };
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
@@ -61,8 +65,7 @@ in
     # enable the ${service} service
     services.${service} = {
       enable = true;
-      settings = 
+      settings = {
-      {
         PORT = toString cfg.port;
         HOST = "0.0.0.0";
       };
@@ -73,9 +76,6 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       serverAliases = ["up.${homelab.public_domain}"];
@@ -86,16 +86,21 @@ in
     };
 
     # add to glance
-    homelab.glance.links.system = [{
+    homelab.glance.links.system = [
+      {
         title = service;
         url = "https://${cfg.url}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }