syncthing bullshit

bin/git_upstream

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+cd /home/blake/.nix
+git remote remove origin                 
+git remote add origin ssh://gitea@git.holocron.blue:7567/blake/nix.git
+git fetch
+git branch --set-upstream-to=origin/trunk trunk

flake.lock

@@ -106,16 +106,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1781226006,
+        "lastModified": 1788591592,
-        "narHash": "sha256-w4ZTuOnhYiDxjaynrMTASzp802QblBWmo3wpB8wVN4Y=",
+        "narHash": "sha256-NbwVKwKLFl0oXub7oPjvmDaOygCtV2oboeKTu4xXFTk=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "109191be4988470b51a60a5ef1998520aa24c01b",
+        "rev": "08e85c4e42f5d8f1ea17c36cb59cf61c2ccb26c3",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "6.0.1",
+        "ref": "6.0.22",
         "repo": "brew",
         "type": "github"
       }
@@ -126,11 +126,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1781385969,
+        "lastModified": 1789598303,
-        "narHash": "sha256-dn8GKHXb0MQWNaqBXIZIyryA6YgNZsHULHTevRfwvd4=",
+        "narHash": "sha256-hyAB8PqtE+2NPbXqFWFOVessao4ccpsQq6hKBfZPN0w=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "efa43f891b18f9e0b354ce676d3050b7690f985e",
+        "rev": "6867ccc51181e7965445c3d158ddddf9a8fd817e",
         "type": "github"
       },
       "original": {
@@ -277,11 +277,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1779670703,
+        "lastModified": 1783570805,
-        "narHash": "sha256-UdfMivNMwCCqQsYDg5pSz8X2IOaOrIZLIIy+Bg3CO2o=",
+        "narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "942159e73e40bf785816f7f1f5feed9ef3d7c8f9",
+        "rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
         "type": "github"
       },
       "original": {
@@ -392,27 +392,6 @@
       }
     },
     "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nvf",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -420,11 +399,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1778716662,
+        "lastModified": 1782949081,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -564,18 +543,20 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "lastModified": 1767737596,
+        "host": "gitlab.gnome.org",
-        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
+        "lastModified": 1776175984,
+        "narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
         "owner": "GNOME",
         "repo": "gnome-shell",
-        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca",
-        "type": "github"
+        "type": "gitlab"
       },
       "original": {
+        "host": "gitlab.gnome.org",
         "owner": "GNOME",
+        "ref": "50.1",
         "repo": "gnome-shell",
-        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
+        "type": "gitlab"
-        "type": "github"
       }
     },
     "home-manager": {
@@ -585,11 +566,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781319724,
+        "lastModified": 1789267039,
-        "narHash": "sha256-ZGuxexEMo4Xv28KJ0dX/m/PHN4oZIOnxHZpNTyrvx4M=",
+        "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "8355f0a16b2dbb06a97959a918af5b239bbe05ae",
+        "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
         "type": "github"
       },
       "original": {
@@ -606,11 +587,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781365335,
+        "lastModified": 1789676441,
-        "narHash": "sha256-zqDBhXMzfbdlO7F2bGHe7MOtB3xngd/+4ieMHDC+ZXo=",
+        "narHash": "sha256-mOvO5VvycuBtOUe5EYI54vrLsWe+2KF/82fmwKooe48=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5b6f5733726a1b2ccafb5dec6ac4ca7299fad66c",
+        "rev": "9d485f74cd27d17126ee34cb31005c39d20f741f",
         "type": "github"
       },
       "original": {
@@ -730,28 +711,6 @@
         "type": "github"
       }
     },
-    "ndg": {
-      "inputs": {
-        "nixpkgs": [
-          "nvf",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1779233504,
-        "narHash": "sha256-YIKEyzh0NFQlD0O92LQQNMoVCDwV8yw1Xz0Iu+4ZC5U=",
-        "owner": "feel-co",
-        "repo": "ndg",
-        "rev": "86f6644411a64d5413711895b7cf6e0e1be465b6",
-        "type": "github"
-      },
-      "original": {
-        "owner": "feel-co",
-        "ref": "refs/tags/v2.8.0",
-        "repo": "ndg",
-        "type": "github"
-      }
-    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -759,11 +718,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781242433,
+        "lastModified": 1786845137,
-        "narHash": "sha256-bchLZZ3sRn740zyvD2icZSnNoTaanN0nw7l6fjVXO+E=",
+        "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "aabb2037edfc0f210723b72cd5f528aab5dd3f0b",
+        "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
         "type": "github"
       },
       "original": {
@@ -794,11 +753,11 @@
         "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1781389246,
+        "lastModified": 1788981439,
-        "narHash": "sha256-ORqLAo/hoJdsZC7UPAuEHev6S0+XIqKEC7vjo5prz1k=",
+        "narHash": "sha256-fEaFq0XgpgWFPLfpq1UK4/8ylHd2T0+fo6O3hKz1LUM=",
         "owner": "zhaofengli",
         "repo": "nix-homebrew",
-        "rev": "de7953a08ed4bb9245be043e468561c17b89130d",
+        "rev": "09a921d0181146cf6163ec2cc1db7b6fd539a885",
         "type": "github"
       },
       "original": {
@@ -847,11 +806,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781182279,
+        "lastModified": 1789164534,
-        "narHash": "sha256-V5EQQbDnmdiXGQXrEF1PEL7QYsFqfH8N1E89Z5ONwFk=",
+        "narHash": "sha256-DoYGPM6QpnYBLWj9gGw6ZwAzIX+HrAVov1BoT+8Jixo=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "5675822ba756e6e56f8f6a5a76e90e0da2ece94d",
+        "rev": "72c92b11bb8289e6651c7fef29cc0a885fd6a255",
         "type": "github"
       },
       "original": {
@@ -878,12 +837,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1781074563,
+        "lastModified": 1789546076,
-        "narHash": "sha256-md8WlXOlfnIeHeOScMTTHFyf2d6iaTwPl2apR5EQ3P4=",
+        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
-        "owner": "NixOS",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "9ae611a455b90cf061d8f332b977e387bda8e1ca",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.zst"
-        "type": "github"
       },
       "original": {
         "id": "nixpkgs",
@@ -893,12 +851,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1781216227,
+        "lastModified": 1789542786,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
+        "narHash": "sha256-BGtBoaZNpOPDEBLTiWNFdYppnDjGhwrUq5/P15QwrrM=",
-        "owner": "NixOS",
+        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
-        "repo": "nixpkgs",
+        "type": "tarball",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9904.4c7870105e7f/nixexprs.tar.zst"
-        "type": "github"
       },
       "original": {
         "id": "nixpkgs",
@@ -965,11 +922,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780281641,
+        "lastModified": 1785549842,
-        "narHash": "sha256-M/+hUKoKbHXpV0xGVfELbN1Ds1aoe3pL5p5/t46YhVo=",
+        "narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "30f9ae2f04174de63ba8bcf3580ca90843b28a01",
+        "rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
         "type": "github"
       },
       "original": {
@@ -981,20 +938,17 @@
     "nvf": {
       "inputs": {
         "flake-compat": "flake-compat_3",
-        "flake-parts": "flake-parts_2",
         "mnw": "mnw",
-        "ndg": "ndg",
         "nixpkgs": [
           "nixpkgs"
-        ],
+        ]
-        "systems": "systems"
       },
       "locked": {
-        "lastModified": 1781374247,
+        "lastModified": 1789510188,
-        "narHash": "sha256-34t1PpO8957G0KkE9YdZx5tsVW1HwMYxUsDep+q093o=",
+        "narHash": "sha256-umec9LKkWjK89Yx4XpvQStkgfKvhK7GjVf5m21bjzKU=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "b67d23fad44b27764ef4af290745188cf3bcbade",
+        "rev": "cdc7e7aaa7eb521bba1b38f54c3228d52cc31703",
         "type": "github"
       },
       "original": {
@@ -1110,6 +1064,29 @@
         "type": "github"
       }
     },
+    "plasma-manager": {
+      "inputs": {
+        "home-manager": [
+          "home-manager-unstable"
+        ],
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785762349,
+        "narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "type": "github"
+      }
+    },
     "pre-commit-hooks-nix": {
       "inputs": {
         "flake-compat": [
@@ -1151,6 +1128,7 @@
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nvf": "nvf",
+        "plasma-manager": "plasma-manager",
         "slippi": "slippi",
         "sops-nix": "sops-nix",
         "srcds-nix": "srcds-nix",
@@ -1237,11 +1215,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781025328,
+        "lastModified": 1784166278,
-        "narHash": "sha256-Fi267TtVlhI+0EHlqpsXCGi2rQsWf6oc8MMwUpafEII=",
+        "narHash": "sha256-TSvk8AK8ACGTSeC2v/tyWX3UiiaEQ5O4nX5jqVtEEEI=",
         "owner": "lytedev",
         "repo": "slippi-nix",
-        "rev": "eec3b4694c92d7c03d40dc52eff8e216fc92a3eb",
+        "rev": "d87fef3580e6afc19bc3fffbba61069df2452cbf",
         "type": "github"
       },
       "original": {
@@ -1257,11 +1235,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780547341,
+        "lastModified": 1789623319,
-        "narHash": "sha256-Gq8KNx5A7hBB3uGJaj6eQfLDIz5YdLu92gqBcvHvoUo=",
+        "narHash": "sha256-kmlp8rPrvrXn58YiaANHKSWUijtUc7pwgerIywosOIM=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "9ed65852b6257fbeae4355bc24ecfea307ca759a",
+        "rev": "16954c1c360c3dc4d4b3b3e64df59f7e89452cb1",
         "type": "github"
       },
       "original": {
@@ -1343,24 +1321,24 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_2",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
         "nur": "nur",
-        "systems": "systems_2",
+        "systems": "systems",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1781018772,
+        "lastModified": 1787771653,
-        "narHash": "sha256-C+cGIUaC6dqfwTbI+BwCd572PbESGA3WYxR1sLTqxkY=",
+        "narHash": "sha256-DkkJSBOXWV/mja5Vy8az5g1KpZlsbUwlmH0BsQhowaQ=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "a378e4c09031fb15a4d65da88aa628f71fc52f6b",
+        "rev": "5e3809851f486e7fc7e84b40f174c74b60ecc784",
         "type": "github"
       },
       "original": {
@@ -1371,30 +1349,16 @@
     },
     "systems": {
       "locked": {
-        "lastModified": 1681028828,
+        "lastModified": 1774449309,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
+        "ref": "future-26.11",
         "repo": "default",
         "type": "github"
       }
@@ -1418,11 +1382,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1777806186,
+        "lastModified": 1785153830,
-        "narHash": "sha256-PDF0/wObw4nIsSBeXVYLsloXOiphXCgIdsrNcVXguKs=",
+        "narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "0c94645546f4f3ddac77a1a5fce54eb95bf50795",
+        "rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
         "type": "github"
       },
       "original": {
@@ -1434,11 +1398,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1778379944,
+        "lastModified": 1785031658,
-        "narHash": "sha256-wPDFzMGSlARlw0Sfsn48Q2+jPSfk6N0Ng6BC/d+7Q24=",
+        "narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "fe0203a198690e71a5ff11e08812a4673de3678d",
+        "rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
         "type": "github"
       },
       "original": {
@@ -1450,11 +1414,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1778378178,
+        "lastModified": 1785030526,
-        "narHash": "sha256-OXPXRIQgGwV77HjYRryOHguh4ALX96jkg+tseLkGgHA=",
+        "narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "9cd816033ff969415b190722cddf134e78a5665f",
+        "rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
         "type": "github"
       },
       "original": {
@@ -1486,11 +1450,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1778182451,
+        "lastModified": 1789394839,
-        "narHash": "sha256-Bz3n2THDGf90Z9gMqhH/J492prYH8B6RFRlxv/fPBwc=",
+        "narHash": "sha256-trdjVJKmDBbzgbP8pd+R7iKbGkdRu0nmXgQlBR/hEiU=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "cf5bfc4c3559f2e783698b1aa23c165072039a7d",
+        "rev": "a21f66ccd9f644c3770ccdf287cb380c00192628",
         "type": "github"
       },
       "original": {

flake.nix

@@ -19,6 +19,11 @@
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
+    plasma-manager = {
+      url = "github:nix-community/plasma-manager";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.home-manager.follows = "home-manager-unstable";
+    };
     nix-homebrew.url = "github:zhaofengli/nix-homebrew";
     nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
     sops-nix = {
@@ -70,6 +75,7 @@
     nix-darwin,
     nix-homebrew,
     nixos-wsl,
+    plasma-manager,
     ...
   } @ inputs: let
     systems = {

hosts/darwin/cen-it-07/configuration.nix

@@ -15,6 +15,7 @@
   darwin = {
     syncthing.enable = true;
     tailscale.enable = true;
+    nextdns.enable = true;
     yubikey.enable = true;
     work.enable = true;
     apps.enable = true;
@@ -56,7 +57,7 @@
       formulae = [];
       casks = [];
       commands = [];
-      #taps = ["mhaeuser/mhaeuser"];
+      taps = ["rogeriopradoj/cask-peazip"];
     };
   };
 
@@ -66,12 +67,12 @@
     onActivation = {
       cleanup = "zap";
       autoUpdate = false;
-      upgrade = false;
+      upgrade = true;
     };
 
-    #    taps = [
+    taps = [
-    #      "mhaeuser/mhaeuser"
+      "rogeriopradoj/cask-peazip"
-    #    ];
+    ];
 
     brews = [
       "mas"
@@ -83,6 +84,8 @@
       "kitty"
       "linearmouse"
       "betterdisplay"
+      "rectangle"
+      "peazip"
     ];
     masApps = {
       # "name" = app_id_number;

hosts/darwin/default.nix

@@ -24,6 +24,7 @@
   # base system package install list
   environment.systemPackages = with pkgs; [
     wget
+    sl
     curl
     rsync
     git
@@ -34,7 +35,6 @@
     python3
     lf
     btop
-    rectangle
     pinentry_mac
   ];
 

hosts/nixos/default.nix

@@ -53,7 +53,15 @@
   powerManagement.powertop.enable = true;
 
   # things are better this way
-  users.defaultUserShell = pkgs.zsh;
+  users = {
+    defaultUserShell = pkgs.zsh;
+    users.root = {
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
+      ];
+    };
+  };
 
   # base system package install list
   environment.systemPackages = with pkgs; [
@@ -117,6 +125,10 @@
             command = "/run/current-system/sw/bin/rsync";
             options = ["NOPASSWD"];
           }
+          {
+            command = "/etc/profiles/per-user/blake/bin/lf";
+            options = ["NOPASSWD"];
+          }
         ];
       }
     ];

hosts/nixos/lumiose/configuration.nix

@@ -20,6 +20,7 @@
     #../../../modules/gameservers/srcds
     ../../../modules/gameservers/minecraft_recpro
     ../../../modules/gameservers/minecraft_modded
+    ../../../modules/gameservers/valheim
   ];
 
   home-manager.users.blake.imports = [
@@ -37,7 +38,7 @@
     };
     keepalive = {
       enable = true;
-      url = "https://up.blakedheld.xyz/api/push/7DAcvsedwB?status=up&msg=fuckingvibing&ping=";
+      url = "https://up.holocron.blue/api/push/7DAcvsedwB?status=up&msg=fuckingvibing&ping=";
     };
   };
 
@@ -45,24 +46,28 @@
     enable = true;
     base_domain = "lumiose.holocron.blue";
     host_ip = "10.10.0.11";
-    gitea.enable = true;
+    gitea.enable = false;
     glance.enable = true;
     immich = {
       enable = true;
       data_dir = "/holocron/srv/immich";
       backup = false;
     };
-    vaultwarden.enable = true;
+    vaultwarden.enable = false;
     #searx.enable = true;
     # home assistant
     home.enable = true;
+    homebox.enable = true;
     # network
     tailscale.enable = true;
-    caddy.enable = true;
+    caddy = {
+      enable = true;
+      keys = false;
+    };
     dnsmasq.enable = true;
     # mediastack
     mediastack.enable = true;
-    qbittorrent.vpn_inf = "enp37s0f1.69";
+    qbittorrent.vpn_inf = "enp34s0.69";
     # system
     backups.enable = true;
     motd.enable = true;
@@ -87,6 +92,7 @@
   gameservers = {
     minecraft_recpro.enable = true;
     minecraft_modded.enable = false;
+    valheim.enable = true;
   };
 
   # boot (systemd is going on me)
@@ -107,54 +113,31 @@
   networking = {
     hostName = "lumiose"; # hostname
     hostId = "007f0200";
-    #    dhcpcd.enable = false;
+    getaddrinfo = {
-    #    interfaces = {
+      enable = true;
-    #      enp34s0 = {
+      precedence = {
-    #        useDHCP = true;
+        "::ffff:0:0/96" = 100;
-    #      };
+      };
-    #      vlan10 = {
+    };
-    #        useDHCP = true;
-    #      };
-    #      vlan69 = {
-    #        useDHCP = true;
-    #      };
-    #    };
-    #    vlans = {
-    #      vlan10 = {
-    #        id = 10;
-    #        interface = "enp37s0f0";
-    #      };
-    #      vlan69 = {
-    #        id = 69;
-    #        interface = "enp37s0f0";
-    #      };
-    #    };
-    #    defaultGateway = "10.10.0.1";
-    #    nameservers = ["10.10.0.1"];
     networkmanager = {
       enable = true; # the goat
       dns = "systemd-resolved"; # the backup dancer!
       ensureProfiles.profiles = {
         vpn = {
+          ipv4 = {
+            method = "manual";
+            addresses = "10.69.0.11/24";
+            gateway = "10.69.0.1";
+          };
           ethernet.mac-address = "02:ea:6c:3c:9f:cd";
           connection.type = "vlan";
           connection.id = "vpn";
-          connection.interface-name = "enp37s0f1.69"; # or just "vpn-vlan"
+          connection.interface-name = "enp34s0.69"; # or just "vpn-vlan"
-          vlan.interface-name = "enp37s0f1.69"; # or just "vpn-vlan"
+          vlan.interface-name = "enp34s0.69"; # or just "vpn-vlan"
-          vlan.parent = "enp37s0f1";
+          vlan.parent = "enp34s0";
           vlan.id = 69;
           #ipv4.dns = "9.9.9.9";
         };
-        #        lan = {
-        #          ethernet.mac-address = "02:11:61:c5:31:b6";
-        #          connection.type = "vlan";
-        #          connection.id = "lan";
-        #          connection.interface-name = "enp37s0f1.20"; # or just "vpn-vlan"
-        #          vlan.interface-name = "enp37s0f1.20"; # or just "vpn-vlan"
-        #          vlan.parent = "enp37s0f1";
-        #          vlan.id = 20;
-        #          #ipv4.dns = "9.9.9.9";
-        #        };
       };
     };
   };
@@ -165,12 +148,11 @@
   networking.firewall.allowedTCPPorts = [
     80 # set - http
     111 # set - portmapper for nfs
-    139 # set - smb
     443 # set - https
-    137
+    137 # set - smb
-    138
+    138 # set - smb
-    139
+    139 # set - smb
-    445 # set - cifs
+    445 # set - smb
     1198
     1883 # set - mqtt
     2049 # set - nfs
@@ -186,6 +168,7 @@
   boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-amd"];
+  boot.kernelParams = ["ipv6.disable=1"];
   boot.extraModulePackages = [];
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

hosts/nixos/snowbelle/configuration.nix

@@ -15,7 +15,7 @@
     ../../../modules/homelab
     #../../../modules/fileshares/holocron
     #../../../modules/gameservers/minecraft_recpro
-    #../../../modules/gameservers/minecraft_modded
+    ../../../modules/gameservers/minecraft_modded
   ];
 
   home-manager.users.blake.imports = [
@@ -33,7 +33,7 @@
     };
     keepalive = {
       enable = true;
-      url = "https://up.blakedheld.xyz/api/push/kMoYviAuCL?status=up&msg=bigchilling&ping=";
+      url = "https://up.holocron.blue/api/push/kMoYviAuCL?status=up&msg=bigchilling&ping=";
     };
   };
   #  holocron = {
@@ -61,7 +61,7 @@
     # mediastack
     mediastack.enable = false;
     # system
-    backups.enable = true;
+    backups.enable = false;
     motd.enable = false;
     uptime-kuma.enable = false;
     # ai
@@ -70,10 +70,13 @@
     wyoming.enable = false;
   };
 
-  #  gameservers = {
+  gameservers = {
     #    minecraft_recpro.enable = true;
-  #    minecraft_modded.enable = true;
+    minecraft_modded = {
-  #  };
+      enable = true;
+      url = "raceraskedforthisenjoyyall.recoil.pro";
+    };
+  };
 
   # boot (systemd is going on me)
   boot.loader.systemd-boot.enable = true; # systemd your pretty cool ya know

hosts/nixos/vaniville/configuration.nix

@@ -30,8 +30,9 @@ in {
     tailscale.enable = false;
   };
   homelab = {
-    base_domain = "vaniville.lan";
+    enable = true;
-    host_ip = "10.10.0.11";
+    base_domain = "vaniville.holocron.blue";
+    host_ip = "100.100.1.10";
     ddns.enable = true;
     uptime-kuma = {
       enable = true;
@@ -39,8 +40,17 @@ in {
     };
     caddy = {
       enable = true;
-      keys = false;
+      keys = true;
     };
+    backups = {
+      enable = true;
+      databases = false;
+      homelab = true;
+      backup_repo = "/var/lib/backups/homelab";
+      offsite_dir = "lifeboat/vaniville/homelab";
+    };
+    gitea.enable = true;
+    vaultwarden.enable = true;
     home.enable = false;
   };
 
@@ -112,9 +122,9 @@ in {
     # what actually does the forwarding
     firewall = {
       enable = true;
-      allowedTCPPorts = [22 80 443 25777 7567 21115 21116 21117 21118 21119];
+      allowedTCPPorts = [22 80 443 25777 25579 7567 21115 21116 21117 21118 21119];
       # tailscale will also need its UDP port open:
-      allowedUDPPorts = [config.services.tailscale.port 25777 21116];
+      allowedUDPPorts = [config.services.tailscale.port 2456 2457 25777 21116 25580];
       trustedInterfaces = ["tailscale0"];
       /*
       iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80        # http
@@ -123,21 +133,29 @@ in {
       iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}     # http
       iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}    # https
       */
+
+      #        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567    # gitea ssh
+      #        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
+
       extraCommands = ''
         # Clear any previous rules if you are iterating
         iptables -t nat -F
 
         # DNAT: internet -> homelab over tailscale
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567    # gitea ssh
         iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777  # recpro mc
         iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777  # recpro mc
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${lumiose_ip}:25778  # cbblemon mc
+        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25579 -j DNAT --to-destination ${snowbelle_ip}:25579  # craftoria mc
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25580 -j DNAT --to-destination ${snowbelle_ip}:25580  # craftoria mc voice chat
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2456 -j DNAT --to-destination ${lumiose_ip}:2456     # valheim server
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2457 -j DNAT --to-destination ${lumiose_ip}:2457     # valheim server
 
         # SNAT: ensure replies go back through VPS tailscale IP
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
         iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
         iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # cbblemon mc
+        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25579 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25580 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc voicechat
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2456 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # valheim server
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2457 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # valheim server
       '';
     };
   };
@@ -167,15 +185,9 @@ in {
       "media.${homelab.public_domain}".extraConfig = ''
         reverse_proxy ${lumiose_ip}:7100
       '';
-      "pass.${homelab.public_domain}".extraConfig = ''
-        reverse_proxy ${lumiose_ip}:7701
-      '';
       "photos.${homelab.public_domain}".extraConfig = ''
         reverse_proxy ${lumiose_ip}:7702
       '';
-      "git.${homelab.public_domain}".extraConfig = ''
-        reverse_proxy ${lumiose_ip}:7703
-      '';
       "hass.${homelab.public_domain}".extraConfig = ''
           reverse_proxy ${lumiose_ip}:7704 {
           header_up Host {host}
@@ -184,6 +196,13 @@ in {
           header_up X-Forwarded-Proto https
         }
       '';
+      # now hosted on vaniville!
+      #      "pass.${homelab.public_domain}".extraConfig = ''
+      #        reverse_proxy 127.0.0.1:7701
+      #      '';
+      #      "git.${homelab.public_domain}".extraConfig = ''
+      #        reverse_proxy localhost:7703
+      #      '';
     };
   };
 

hosts/nixos/yveltal/configuration.nix

@@ -26,7 +26,7 @@
     ssh.enable = true;
     sops.enable = true;
     yubikey.enable = true;
-    yubikey.lock_on_remove = true;
+    yubikey.lock_on_remove = false;
     tailscale.enable = true;
     syncthing.enable = true;
     flatpak.enable = true;
@@ -37,7 +37,7 @@
   };
   desktop = {
     pipewire.enable = true;
-    hypr.enable = true;
+    hypr.enable = false;
     greetd.enable = true;
     kde.enable = true;
   };

modules/darwin/apps/default.nix

@@ -23,6 +23,9 @@ in {
         "sl"
         "cowsay"
         "apfel"
+        "yt-dlp"
+        "ffmpeg"
+        "ffmpeg-full"
       ];
       casks = [
         "gnucash"
@@ -33,7 +36,7 @@ in {
         "grandperspective"
         "spotify"
         "obs"
-        #        "gimp"
+        "gimp"
         "audacity"
         "anki"
         "rustdesk"
@@ -41,6 +44,9 @@ in {
         "transmission"
         "finetune"
         "yacreader"
+        "keepassxc"
+        "thunderbird"
+        "musicbrainz-picard"
       ];
       masApps = {
         "pages" = 361309726;
@@ -50,7 +56,7 @@ in {
         "darkreader" = 1438243180;
         "ghostery" = 6504861501;
         "privacy" = 6449850851;
-        #"unifi" = 1057750338;
+        "flo" = 6529533140;
       };
     };
   };

modules/darwin/default.nix

@@ -6,6 +6,7 @@
 }: {
   imports = [
     ./tailscale
+    ./nextdns
     ./syncthing
     ./yubikey
     ./work
@@ -13,5 +14,4 @@
     ./cyber
     ./gaming
   ];
-
 }

modules/darwin/gaming/default.nix

@@ -3,8 +3,7 @@
   config,
   lib,
   ...
-}:
+}: let
-let
   service = "gaming";
   cfg = config.darwin.${service};
 in {
@@ -13,7 +12,6 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-
     #    environment.systemPackages = with pkgs; [
     #      uhhh
     #    ];
@@ -25,8 +23,8 @@ in {
         "steam"
         "prismlauncher"
         "discord"
-        "runelite"
+        #        "runelite"
-        "jagex"
+        #        "jagex"
       ];
       masApps = {
       };

modules/darwin/nextdns/default.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  service = "nextdns";
+  cfg = config.darwin.${service};
+in {
+  options.darwin.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.${service} = {
+      enable = true;
+      arguments = [
+        "-profile 527db2"
+      ];
+    };
+  };
+}

modules/darwin/tailscale/default.nix

@@ -8,23 +8,25 @@
   service = "tailscale";
   cfg = config.darwin.${service};
 in {
-
   options.darwin.tailscale = {
     enable = lib.mkEnableOption "enables tailscale";
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale = {
+    #    services.tailscale = {
-      enable = true;
+    #      enable = true;
-      #overrideLocalDns = true;
+    #      #overrideLocalDns = true;
-      #authKeyFile = authkey_file;
+    #      #authKeyFile = authkey_file;
-    };
+    #    };
 
-    homebrew = {
+    #    environment.systemPackages = with pkgs; [
-      casks = [
+    #      tailscale-gui
-        "tailscale-app"
+    #    ];
-      ];
-    };
 
+    #    homebrew = {
+    #      casks = [
+    #        "tailscale-app"
+    #      ];
+    #    };
   };
 }

modules/darwin/work/default.nix

@@ -8,17 +8,16 @@
   service = "work";
   cfg = config.darwin.${service};
 in {
-
   options.darwin.work = {
     enable = lib.mkEnableOption "installs apps for work";
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale = {
+    #    services.tailscale = {
-      enable = true;
+    #      enable = true;
-      #overrideLocalDns = true;
+    #      #overrideLocalDns = true;
-      #authKeyFile = authkey_file;
+    #      #authKeyFile = authkey_file;
-    };
+    #    };
 
     homebrew = {
       casks = [
@@ -27,11 +26,11 @@ in {
         "microsoft-office"
         "jump-desktop"
         "wifiman"
+        "adobe-acrobat-pro"
       ];
       masApps = {
         "configurator" = 1037126344;
       };
     };
-
   };
 }

modules/desktop/kde/default.nix

@@ -12,6 +12,42 @@ in {
 
   config = lib.mkIf cfg.enable {
     # enable kde plasma
-    services.desktopManager.plasma6.enable = true;
+    services = {
+      desktopManager.plasma6.enable = true;
+      #displayManager.sddm.enable = true;
+      #displayManager.sddm.wayland.enable = true;
+    };
+
+    environment.systemPackages = with pkgs; [
+      # KDE Utilities
+      kdePackages.discover # Optional: Software center for Flatpaks/firmware updates
+      kdePackages.kcalc # Calculator
+      kdePackages.kcharselect # Character map
+      kdePackages.kclock # Clock app
+      kdePackages.kcolorchooser # Color picker
+      kdePackages.kolourpaint # Simple paint program
+      kdePackages.ksystemlog # System log viewer
+      kdePackages.sddm-kcm # SDDM configuration module
+      kdiff3 # File/directory comparison tool
+
+      # Hardware/System Utilities (Optional)
+      kdePackages.isoimagewriter # Write hybrid ISOs to USB
+      kdePackages.partitionmanager # Disk and partition management
+      hardinfo2 # System benchmarks and hardware info
+      wayland-utils # Wayland diagnostic tools
+      wl-clipboard # Wayland copy/paste support
+      vlc # Media player
+    ];
+
+    environment.plasma6.excludePackages = with pkgs; [
+      kdePackages.elisa # Music player
+      kdePackages.kdepim-runtime # Akonadi agents
+      kdePackages.kmahjongg
+      #kdePackages.kmines
+      kdePackages.konversation # IRC client
+      kdePackages.kpat # Solitaire
+      kdePackages.ksudoku
+      kdePackages.ktorrent
+    ];
   };
 }

modules/fileshares/holocron.old/default.nix

@@ -1,20 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  inputs,
-  ...
-}: {
-  # services show up in glance in reverse import order lmao
-  imports = [
-    ./nfs
-    ./smb
-    ./zfs
-    #./syncthing
-    #./copyparty
-    ./perms
-  ];
-
-  # define the groups used for backups and archives
-  users.groups.archives = {gid = 727;};
-}

modules/fileshares/holocron.old/nfs/default.nix

@@ -1,28 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-# define nfs exports
-let
-  cfg = config.holocron.nfs;
-  nfs_exports = ''
-    /holocron/media *(ro,sync,no_subtree_check)
-  '';
-  #/holocron/users *(rw,sync,no_subtree_check,no_root_squash)
-in {
-  options.holocron.nfs = {
-    enable = lib.mkEnableOption "enables nfs";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # enable nfs with all exports
-    services.nfs = {
-      server = {
-        enable = true;
-        exports = nfs_exports;
-      };
-    };
-  };
-}

modules/fileshares/holocron.old/perms/default.nix

@@ -1,65 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  service = "ensure_perms";
-  cfg = config.holocron.${service};
-
-  # define variables for paths
-  archives_path = "/holocron/archives";
-  media_path = "/holocron/media";
-  users_path = "/holocron/users";
-in {
-  options.holocron.ensure_perms = {
-    enable = lib.mkEnableOption "enables perms ensurence script";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # service to run periodically to reset the perms on all zpools
-    # everything works fine without this, just for peace of mind
-    # and to clean up the ownership from the arr stack in /holocron/media
-    systemd.services.${service} = {
-      description = "ensure file permissions for archives, media and user folders";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = pkgs.writeShellScript "ensure_perms" ''
-
-          # Fix ownership for archives directory
-          echo "starting ${archives_path}"
-          chown -Rc root:archives ${archives_path}
-          find "${archives_path}" -type d -exec chmod 2770 "$@" {} +
-          find "${archives_path}" -type f -exec chmod 660 "$@" {} +
-
-          # Fix ownership for media directory
-          echo "starting ${media_path}"
-          chown -Rc root:media ${media_path}
-          find "${media_path}" -type d -exec chmod 2770 "$@" {} +
-          find "${media_path}" -type f -exec chmod 660 "$@" {} +
-
-          # Fix user directories
-          for user_dir in ${users_path}/*; do
-            if [ -d "$user_dir" ]; then
-              user=$(basename "$user_dir")
-              echo "starting $user_dir"
-              chown -Rc $user:$user $user_dir
-              find $user_dir -type d -exec chmod 2770 "$@" {} +
-              find $user_dir -type f -exec chmod 660 "$@" {} +
-            fi
-          done
-          echo "fin"
-        '';
-      };
-    };
-
-    systemd.timers.${service} = {
-      description = "run script to ensure_perms daily";
-      wantedBy = ["timers.target"];
-      timerConfig = {
-        OnCalendar = "03:30";
-        Persistent = true;
-      };
-    };
-  };
-}

modules/fileshares/holocron.old/smb/default.nix

@@ -1,97 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-# define smb shares
-let
-  cfg = config.holocron.smb;
-  smb_shares = {
-    global = {
-      "ea support" = "yes";
-      "vfs objects" = "catia fruit streams_xattr";
-      "fruit:aapl" = "yes";
-      "fruit:metadata" = "stream";
-      "fruit:model" = "MacSamba";
-      "fruit:posix_rename" = "yes";
-      "fruit:nfs_aces" = "no";
-      "fruit:veto_appledouble" = "no";
-      "fruit:wipe_intentionally_left_blank_rfork" = "yes";
-      "fruit:delete_empty_adfiles" = "yes";
-    };
-    archives = {
-      path = "/holocron/archives";
-      browseable = true;
-      writable = true;
-      guestOk = false;
-      "create mask" = "0775";
-      "directory mask" = "0775";
-    };
-    timemachine = {
-      browseable = true;
-      "path" = "/holocron/archives/timemachine";
-      "valid users" = "blake";
-      "public" = "no";
-      "writeable" = "yes";
-      "force user" = "blake";
-      "fruit:aapl" = "yes";
-      "fruit:time machine" = "yes";
-      "vfs objects" = "catia fruit streams_xattr";
-    };
-    users = {
-      path = "/holocron/users";
-      browseable = true;
-      writable = true;
-      guestOk = false;
-      "create mask" = "0660";
-      "directory mask" = "0770";
-    };
-    media = {
-      path = "/holocron/media";
-      browseable = true;
-      writable = true;
-      guestOk = false;
-      "create mask" = "0775";
-      "directory mask" = "0775";
-    };
-  };
-in {
-  options.holocron.smb = {
-    enable = lib.mkEnableOption "enables smb";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # enable smb with all shares
-    services.samba = {
-      enable = true;
-      settings = smb_shares;
-    };
-    # Ensure Time Machine can discover the share without `tmutil`
-    services.avahi = {
-      extraServiceFiles = {
-        timemachine = ''
-          <?xml version="1.0" standalone='no'?>
-          <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
-          <service-group>
-            <name replace-wildcards="yes">%h</name>
-            <service>
-              <type>_smb._tcp</type>
-              <port>445</port>
-            </service>
-              <service>
-              <type>_device-info._tcp</type>
-              <port>0</port>
-              <txt-record>model=TimeCapsule8,119</txt-record>
-            </service>
-            <service>
-              <type>_adisk._tcp</type>
-              <txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
-              <txt-record>sys=waMa=0,adVF=0x100</txt-record>
-            </service>
-          </service-group>
-        '';
-      };
-    };
-  };
-}

modules/fileshares/holocron.old/syncthing/default.nix

@@ -1,89 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  service = "syncthing";
-  cfg = config.holocron.${service};
-  sec = config.sops.secrets;
-  url = "syncthing.snowbelle.blakedheld.xyz";
-  homelab = config.homelab;
-in {
-  options.holocron.${service} = {
-    enable = lib.mkEnableOption "enables syncthing";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.syncthing = {
-      enable = true;
-      user = "blake";
-      group = "blake";
-      dataDir = "/var/lib/syncthing";
-      guiAddress = "0.0.0.0:2222";
-      openDefaultPorts = true;
-      #extraFlags = ["--no-default-folder"];
-      key = sec."${service}/snowbelle/key".path;
-      cert = sec."${service}/snowbelle/cert".path;
-      settings = {
-        devices = {
-          "mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
-          "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
-          "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
-          "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
-          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
-        };
-        folders = {
-          "holocron" = {
-            path = "/holocron/users/blake/holocron";
-            devices = ["mudkip" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
-            id = "5voxg-c3he2";
-            versioning = {
-              type = "staggered";
-              fsPath = "/holocron/users/blake/holocron/.stversions";
-              params = {
-                cleanInterval = "3600";
-                maxAge = "0";
-              };
-            };
-          };
-        };
-        options = {
-          urAccepted = -1;
-        };
-      };
-    };
-
-    sops.secrets = {
-      "${service}/snowbelle/key" = {
-        owner = "blake";
-        group = "blake";
-      };
-      "${service}/snowbelle/cert" = {
-        owner = "blake";
-        group = "blake";
-      };
-    };
-    homelab.backups.baks = {
-      ${service} = {paths = [config.services.syncthing.dataDir];};
-    };
-
-    services.caddy.virtualHosts."${url}" = {
-      extraConfig = ''
-        tls internal
-        reverse_proxy 127.0.0.1:2222
-      '';
-    };
-
-    # add to glance (local service)
-    homelab.glance.links.system = [
-      {
-        title = service;
-        url = "https://${url}";
-        error-url = "http://${homelab.host_ip}:2222";
-        check-url = "http://${homelab.host_ip}:2222";
-        icon = "di:${service}";
-      }
-    ];
-  };
-}

modules/fileshares/holocron.old/zfs/default.nix

@@ -1,79 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.holocron.zfs;
-in {
-  options.holocron.zfs = {
-    enable = lib.mkEnableOption "enables zfs";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # set network host id
-    networking.hostId = "3e6e7055";
-
-    # enable zfs support
-    boot.zfs.forceImportRoot = false;
-    boot.kernelModules = ["zfs"];
-    boot.supportedFilesystems = ["zfs"];
-
-    # arc cache size
-    boot.kernelParams = ["zfs.zfs_arc_max=12884901888"];
-
-    # pools to import
-    #boot.zfs.extraPools = [ "holocron" "holocron/archives" "/holocron/media" "/holocron/users" ];
-    #boot.zfs.extraPools = [ "holocron" ];
-
-    # enable smart monitoring
-    services.smartd = {
-      enable = true;
-      autodetect = true;
-      defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
-      notifications.mail = {
-        enable = true;
-        sender = "zfs@snowbelle.lan";
-      };
-    };
-
-    # enable zfs
-    services.zfs = {
-      autoScrub.enable = true;
-      autoScrub.interval = "weekly";
-      # email notifs
-      zed = {
-        enableMail = false;
-        settings = {
-          ZED_EMAIL_ADDR = ["root"];
-          # send notification if scrub succeeds
-          ZED_NOTIFY_VERBOSE = true;
-        };
-      };
-    };
-
-    # install userspace tools for acl's
-    environment.systemPackages = with pkgs; [smartmontools];
-
-    fileSystems."/holocron" = {
-      device = "holocron";
-      fsType = "zfs";
-      options = ["nofail"];
-    };
-    fileSystems."/holocron/archives" = {
-      device = "holocron/archives";
-      fsType = "zfs";
-      options = ["nofail"];
-    };
-    fileSystems."/holocron/users" = {
-      device = "holocron/users";
-      fsType = "zfs";
-      options = ["nofail"];
-    };
-    fileSystems."/holocron/media" = {
-      device = "holocron/media";
-      fsType = "zfs";
-      options = ["nofail"];
-    };
-  };
-}

modules/fileshares/holocron/default.nix

@@ -16,6 +16,11 @@
     ./perms
   ];
 
-  # define the groups used for backups and archives
+  #  # define the groups used for backups and archives
-  users.groups.archives = {gid = 727;};
+  #  users.users.archives = {
+  #    isSystemUser = true;
+  #    group = "archives";
+  #  };
+  #
+  #  users.groups.archives = {gid = 727;};
 }

modules/fileshares/holocron/smb/default.nix

@@ -34,7 +34,7 @@ let
     };
     timemachine = {
       browseable = true;
-      "path" = "/holocron/timemachine";
+      "path" = "/holocron/archives/timemachine";
       "valid users" = "blake";
       "public" = "no";
       "writeable" = "yes";
@@ -66,6 +66,20 @@ let
       "create mask" = "0775";
       "directory mask" = "0775";
     };
+    nvr = {
+      path = "/holocron/nvr";
+      writable = true;
+      guestOk = false;
+      browseable = true;
+      "valid users" = "archives";
+      "public" = "no";
+      "writeable" = "yes";
+      "force user" = "archives";
+      # time machine specifc config
+      "create mask" = "0660";
+      "directory mask" = "0770";
+      "force group" = "archives";
+    };
   };
 in {
   options.holocron.smb = {

modules/fileshares/holocron/syncthing/default.nix

@@ -31,21 +31,21 @@ in {
           "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
           "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
           "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
-          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
+          "CEN-IT-00007" = {id = "UEWNSUZ-AX75M5Y-OA4FURY-ORMEXFA-XUXU4LU-LEUYKVW-IDM2GQC-4UR4YAL";};
         };
         folders = {
           "holocron" = {
             path = "/holocron/users/blake/holocron";
             devices = ["piplup" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
             id = "5voxg-c3he2";
-            versioning = {
+            #            versioning = {
-              type = "staggered";
+            #              type = "staggered";
-              fsPath = "/holocron/users/blake/holocron/.stversions";
+            #              fsPath = "/holocron/users/blake/holocron/.stversions";
-              params = {
+            #              params = {
-                cleanInterval = "3600";
+            #                cleanInterval = "3600";
-                maxAge = "0";
+            #                maxAge = "0";
-              };
+            #              };
-            };
+            #            };
           };
         };
         options = {

modules/gameservers/minecraft_modded/default.nix

@@ -8,8 +8,12 @@
   cfg = config.gameservers.${service};
   sec = config.sops.secrets;
   servers = {
-    cobblemon = {
+    #    cobblemon = {
-      data_dir = "/var/lib/gameservers/minecraft_modded/cobblemon";
+    #      data_dir = "/var/lib/gameservers/minecraft_modded/cobblemon";
+    #      start_file = "start.sh";
+    #    };
+    linggango = {
+      data_dir = "/var/lib/gameservers/minecraft_modded/linggango";
       start_file = "start.sh";
     };
   };
@@ -18,7 +22,7 @@ in {
     enable = lib.mkEnableOption "enables ${service}";
     url = lib.mkOption {
       type = lib.types.str;
-      default = "mc.recoil.pro";
+      default = "modded.recoil.pro";
       description = "set domain for ${service}";
     };
     data_dir = lib.mkOption {
@@ -38,16 +42,33 @@ in {
     };
     motd_gs = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = ["cobblemon"];
+      default = ["craftoria"];
     };
     backup_repo = lib.mkOption {
       type = lib.types.path;
-      default = "/holocron/archives/gameservers/minecraft/modded";
+      default = "/var/backup/gameservers/minecraft/modded";
       description = "path to take hourly backups to with borg!";
     };
+    offsite_user = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat.holocron.blue";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat/holocron/archives/gameservers";
+      description = "path to rsync offsite backups to";
+    };
   };
 
   config = lib.mkIf cfg.enable {
+    users.groups.minecraft = {gid = lib.mkForce cfg.ids;};
+
     # declare ${service} user
     users.users.minecraft = lib.mkDefault {
       description = "minecraft server user";
@@ -70,13 +91,15 @@ in {
         description = "minecraft_recpro: ${name}";
         after = ["network.target"];
         wants = ["network.target"];
+        path = [pkgs.openjdk21];
         serviceConfig = {
           User = "minecraft";
           Group = "minecraft";
           WorkingDirectory = srv.data_dir;
           UMask = "0007";
-          ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx12G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true @libraries/net/neoforged/neoforge/21.1.211/unix_args.txt";
+          #ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx12G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true @libraries/net/neoforged/neoforge/21.1.211/unix_args.txt";
           #ExecStart = "${srv.data_dir}/${srv.start_file}";
+          ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx24G @libraries/net/minecraftforge/forge/1.20.1-47.4.20/unix_args.txt \"$@\"";
           Restart = "on-failure";
           KillMode = "process";
         };
@@ -84,7 +107,7 @@ in {
       })
       servers;
 
-    environment.systemPackages = with pkgs; [openjdk21 mcrcon];
+    environment.systemPackages = with pkgs; [openjdk21 mcrcon borgbackup sshpass tree rsync];
 
     #    services.mysql = {
     #      enable = true;
@@ -104,20 +127,23 @@ in {
     #    };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [25778];
+    networking.firewall.allowedTCPPorts = [25579];
+    networking.firewall.allowedUDPPorts = [25580]; #voicechat
 
-    #    sops.secrets = {
+    sops.secrets = {
-    #      "velocity_forwarding" = {
+      "borg_passwd" = {
-    #        owner = "minecraft";
+        owner = "root";
-    #        group = "minecraft";
+        group = "root";
-    #        path = "/var/lib/gameservers/minecraft_recpro/velocity/forwarding.secret";
+      };
-    #        mode = "0400";
+      "lifeboat_rsync" = {
-    #      };
+        owner = "root";
-    #      "minecraft_recpro_db_passwd" = {
+        group = "archives";
-    #        owner = "mysql";
+        mode = "0440";
-    #        group = "mysql";
+      };
-    #      };
+    };
-    #    };
+
+    # helpful and for scripts
+    users.groups.archives = {gid = 727;};
 
     # backups minecraft_modded with borg!
     services.borgbackup.jobs.${service} = {
@@ -137,6 +163,13 @@ in {
       );
       compression = "auto,zstd";
       #preHook = "systemctl start mysql-backup.service";
+      postHook = ''
+        ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+      '';
       startAt = "*-*-* *:00:00";
       group = "archives";
       encryption.mode = "repokey-blake2";

modules/gameservers/valheim/default.nix

@@ -0,0 +1,149 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  nixservice = "podman-valheim";
+  service = "valheim";
+  cfg = config.gameservers.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.gameservers.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 2456;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/gameservers/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    motd_gs = lib.mkOption {
+      type = lib.types.nullOr (lib.types.listOf lib.types.str);
+      default = ["podman-valheim"];
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "enable backups for ${service}";
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/backup/gameservers/valheim";
+      description = "path to take hourly backups to with borg!";
+    };
+    offsite_user = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat.holocron.blue";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat/holocron/archives/gameservers";
+      description = "path to rsync offsite backups to";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    virtualisation.oci-containers.containers = {
+      ${service} = {
+        image = "ghcr.io/community-valheim-tools/valheim-server";
+        autoStart = true;
+        extraOptions = [
+          "--cap-add=sys_nice"
+          "--stop-timeout=120"
+        ];
+        ports = [
+          "2456-2457:2456-2457/udp"
+          "2456:80/tcp"
+        ];
+        volumes = [
+          "${cfg.data_dir}/config:/config"
+          "${cfg.data_dir}/data:/opt/valheim"
+        ];
+        environment = {
+          SERVER_NAME = "recpro";
+          SERVER_PASS = "recoil727pro";
+          #WORLD_NAME = "";
+          STATUS_HTTP = "true";
+          TZ = homelab.tz;
+          PUID = toString config.users.users.${service}.uid;
+          PGID = toString config.users.groups.${service}.gid;
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+    networking.firewall.allowedUDPPorts = [2456 2457];
+
+    # backups valhiem with borg!
+    services.borgbackup.jobs.${service} = {
+      archiveBaseName = service;
+      repo = cfg.backup_repo;
+      paths = cfg.data_dir;
+      compression = "auto,zstd";
+      #preHook = "systemctl start mysql-backup.service";
+      postHook = ''
+        ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+      '';
+      startAt = "*-*-* *:00:00";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        hourly = 24;
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+  };
+}

modules/homelab/.nomad/default.nix

@@ -0,0 +1,29 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.homelab.nomad;
+in {
+  options.homelab.nomad = {
+    enable = lib.mkEnableOption "enable in house project nomad";
+    tz = lib.mkOption {
+      default = "America/Chicago";
+      type = lib.types.str;
+      description = "set timezone";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # the order determines the order in glance :3
+    imports = [
+      ./kiwix
+      ./maps
+      ./kolibri
+    ];
+    homelab.kiwix.enable = lib.mkDefault true;
+    homelab.maps.enable = lib.mkDefault true;
+    homelab.kolibri.enable = lib.mkDefault true;
+  };
+}

modules/homelab/.nomad/kiwix/default.nix

@@ -0,0 +1,121 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "kiwix";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7730;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "kiwix-serve";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {
+      gid = lib.mkForce cfg.ids;
+    };
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # helpful and for scripts
+    environment.systemPackages = with pkgs; [kiwix-tools];
+
+    # enable the ${service} service
+    services.kiwix-serve = {
+      enable = true;
+      openFirewall = true;
+      port = cfg.port;
+      user = service;
+      group = service;
+      libraryPath = "${cfg.data_dir}/library.xml";
+      extraArgs = {
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      User = service;
+      Group = service;
+    };
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["${service}.${homelab.public_domain}"];
+      # use explicitly defined tls cert
+      # tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port}
+      '';
+    };
+
+    # add to glance (local service)
+    homelab.glance.links.nomad = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    #    sops.secrets = {
+    #      "${service}_" = {
+    #        owner = ;
+    #        group = ;
+    #      };
+    #    };
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {
+        paths = [cfg.data_dir];
+      };
+    };
+  };
+}

modules/homelab/default.nix

@@ -2,6 +2,7 @@
   pkgs,
   config,
   lib,
+  inputs,
   ...
 }: let
   cfg = config.homelab;
@@ -36,6 +37,17 @@ in {
     ./mediastack
     ./services
     ./system
+    #./nomad
     ./network
   ];
+
+  config = lib.mkIf cfg.enable {
+    # define the groups used for backups and archives
+    users.users.archives = {
+      isSystemUser = true;
+      group = "archives";
+    };
+
+    users.groups.archives = {gid = 727;};
+  };
 }

modules/homelab/mediastack/default.nix

@@ -27,13 +27,15 @@ in {
 
   # the order determines the order in glance :3
   imports = [
-    ./bazarr
-    ./prowlarr
-    ./radarr
-    ./qbittorrent
-    ./sonarr
     ./yacreader
+    ./bazarr
+    ./qbittorrent
+    ./prowlarr
+    ./lidarr
+    ./radarr
+    ./sonarr
     ./audiobookshelf
+    ./navidrome
     ./jellyfin
     ./flaresolverr
   ];
@@ -56,7 +58,9 @@ in {
     homelab.prowlarr.enable = lib.mkDefault true;
     homelab.radarr.enable = lib.mkDefault true;
     homelab.sonarr.enable = lib.mkDefault true;
+    homelab.lidarr.enable = lib.mkDefault true;
     homelab.audiobookshelf.enable = lib.mkDefault true;
+    homelab.navidrome.enable = lib.mkDefault true;
     homelab.flaresolverr.enable = lib.mkDefault true;
   };
 }

modules/homelab/mediastack/jellyfin/default.nix

@@ -7,6 +7,7 @@
   service = "jellyfin";
   cfg = config.homelab.${service};
   homelab = config.homelab;
+  host = config.networking.hostName;
 in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
@@ -61,6 +62,7 @@ in {
     # enable the ${service} service
     services.${service} = {
       enable = true;
+      package = pkgs.unstable.jellyfin;
       openFirewall = true;
       user = service;
       group = service;
@@ -85,7 +87,7 @@ in {
     homelab.glance.links.mediastack = [
       {
         title = service;
-        url = "https://media.${homelab.public_domain}";
+        url = "https://media.${host}.${homelab.public_domain}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
         icon = "di:${service}";

modules/homelab/mediastack/lidarr/default.nix

@@ -0,0 +1,108 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "lidarr";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7109;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # required
+    environment.systemPackages = with pkgs; [ffmpeg_6-headless yt-dlp];
+
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      openFirewall = true;
+      user = service;
+      group = service;
+      dataDir = cfg.data_dir;
+      settings = {
+        server.port = cfg.port;
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      #      User = service;
+      #      Group = service;
+    };
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port}
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/mediastack/navidrome/default.nix

@@ -0,0 +1,115 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "navidrome";
+  cfg = config.homelab.${service};
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7108;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "music.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      #      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      openFirewall = true;
+      user = service;
+      group = service;
+      #      plugins = [
+      #      ];
+      environmentFile = "${cfg.data_dir}/navidrome.env";
+      settings = {
+        Address = "0.0.0.0";
+        Port = cfg.port;
+        MusicFolder = "/holocron/media/music";
+        EnableInsightsCollector = false;
+        LyricsPriority = "nd-lyrics";
+        Plugins = {
+          Enabled = true;
+          #Folder = lib.mkForce "${cfg.data_dir}/plugins";
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      EnvironmentFile = "${cfg.data_dir}/navidrome.env";
+    };
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      #serverAliases = ["abs.${homelab.public_domain}"];
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port} {
+        }
+      '';
+    };
+
+    # add to glance public service
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://music.${homelab.base_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/network/caddy/default.nix

@@ -20,7 +20,7 @@ in {
     };
     keys = lib.mkOption {
       type = lib.types.bool;
-      default = true;
+      default = false;
       description = "host keys directory";
     };
     backup = lib.mkOption {
@@ -54,13 +54,23 @@ in {
       user = service;
       group = service;
       dataDir = cfg.data_dir;
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          "github.com/caddy-dns/cloudflare@v0.2.4"
+        ];
+        hash = "sha256-dQvk6ezY6TQ1J7PjhCXnThF/SqVgPwBO8/RXzHCY+js=";
+        # Replace with the hash from the build error the first time you build.
+      };
       email = "me@blakedheld.xyz";
+
       globalConfig = ''
         auto_https ignore_loaded_certs
+        acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
       '';
 
       # static page for hosting key files
-      virtualHosts."keys.${homelab.base_domain}" = {
+      virtualHosts = {
+        "keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
           serverAliases = ["keys.${homelab.public_domain}"];
           extraConfig = ''
             tls internal
@@ -69,6 +79,7 @@ in {
           '';
         };
       };
+    };
 
     # enable acme for auto ssl certs with lets encrypt
     security.acme = {
@@ -79,6 +90,9 @@ in {
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
+      # make cloudflare token readable
+      EnvironmentFile = sec."cloudflare/api_token_caddy".path;
+      #LoadCredential = "CLOUDFLARE_API_TOKEN:${sec."cloudflare/api_token_caddy".path}";
     };
 
     # open firewall
@@ -95,6 +109,10 @@ in {
         group = "caddy";
         path = "/etc/ssl/blakedheld.xyz.key";
       };
+      "cloudflare/api_token_caddy" = {
+        owner = "caddy";
+        group = "caddy";
+      };
       "klefki_pub.asc" = {
         owner = "caddy";
         group = "caddy";
@@ -112,7 +130,7 @@ in {
       <html>
         <head>
           <meta charset="utf-8">
-          <title>{{html .Name}}</title>
+          <title>keyring</title>
           <style>
             footer { display: none !important; }
           </style>

modules/homelab/network/ddns/default.nix

@@ -29,17 +29,23 @@ in {
         "superflat.recoil.pro"
         "skyblock.recoil.pro"
         "cobblemon.recoil.pro"
+        "valheim.recoil.pro"
 
         # blakedheld.xyz
-        "blakedheld.xyz"
+        #"blakedheld.xyz"
-        "*.blakedheld.xyz"
+        #"*.blakedheld.xyz"
-        "git.blakedheld.xyz"
+        #"git.blakedheld.xyz"
-        "up.blakedheld.xyz"
+        #"up.blakedheld.xyz"
 
         # holocron.blue
-        "holocron.blue"
+        #"holocron.blue"
-        "*.holocron.blue"
+        #"*.holocron.blue"
         "git.holocron.blue"
+        "pass.holocron.blue"
+        "photos.holocron.blue"
+        "media.holocron.blue"
+        "up.holocron.blue"
+        # mc servers
         "mine.holocron.blue"
         "smp.holocron.blue"
         "skyblock.holocron.blue"

modules/homelab/network/tailscale/default.nix

@@ -23,7 +23,7 @@ in {
       useRoutingFeatures = "both";
       authKeyFile = sec."tailscale_authkey".path;
       extraSetFlags = [
-        "--advertise-routes=${config.homelab.host_ip}/32" # advertise self
+        "--advertise-routes=${config.homelab.host_ip}/32,10.10.0.1/32,10.10.0.5/32,10.10.0.10/32" # advertise self
         "--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
         "--accept-dns=true" # explicitly allow resolved
       ];

modules/homelab/services/default.nix

@@ -11,6 +11,7 @@
     ./vaultwarden
     ./gitea
     ./immich
+    ./homebox
     #./searxng
   ];
 }

modules/homelab/services/glance/default.nix

@@ -77,6 +77,11 @@ in {
         default = [];
         description = "list of links for ${service}";
       };
+      network = lib.mkOption {
+        type = lib.types.listOf lib.types.attrs;
+        default = [];
+        description = "list of links for ${service}";
+      };
     };
   };
 
@@ -244,6 +249,12 @@ in {
                     title = "system";
                     sites = cfg.links.system;
                   }
+                  {
+                    type = "monitor";
+                    cache = "1m";
+                    title = "network";
+                    sites = cfg.links.network;
+                  }
                   {
                     type = "custom-api";
                     title = "recpro";
@@ -251,13 +262,13 @@ in {
                     cache = "5s";
                     template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
                   }
-                  {
+                  #                  {
-                    type = "custom-api";
+                  #                    type = "custom-api";
-                    title = "cobblemon";
+                  #                    title = "linggango";
-                    url = "https://api.mcstatus.io/v2/status/java/cobblemon.recoil.pro";
+                  #                    url = "https://api.mcstatus.io/v2/status/java/raceraskedforthisenjoyyall.recoil.pro";
-                    cache = "5s";
+                  #                    cache = "5s";
-                    template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
+                  #                    template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
-                  }
+                  #                  }
                 ];
               }
               {
@@ -335,16 +346,84 @@ in {
       };
     };
 
-    # add to udr to glance
+    # add to vaniville services to glance
+    homelab.glance.links.services = [
+      {
+        title = "vaultwarden";
+        url = "https://pass.${homelab.public_domain}";
+        error-url = "https://pass.vaniville.${homelab.public_domain}";
+        check-url = "https://pass.${homelab.public_domain}";
+        icon = "di:vaultwarden";
+      }
+      {
+        title = "gitea";
+        url = "https://git.${homelab.public_domain}";
+        error-url = "https://git.vaniville.${homelab.public_domain}";
+        check-url = "https://git.${homelab.public_domain}";
+        icon = "di:gitea";
+      }
+    ];
+
     homelab.glance.links.system = [
       {
-        title = "bebe";
+        title = "vaniville uptime";
-        url = "https://bebe.holocron.blue";
+        url = "https://up.${homelab.public_domain}";
-        error-url = "https://10.10.0.1";
+        error-url = "https://up.vaniville.${homelab.public_domain}";
-        check-url = "https://10.10.0.1";
+        check-url = "https://up.${homelab.public_domain}";
+        icon = "di:uptime-kuma";
+      }
+    ];
+
+    # add to udr to glance
+    homelab.glance.links.network = [
+      {
+        title = "shauna";
+        url = "https://shauna.holocron.blue";
+        error-url = "https://10.0.0.1";
+        check-url = "https://10.0.0.1";
         icon = "di:unifi";
         allow-insecure = true;
       }
+      {
+        title = "lifeboat";
+        url = "https://lifeboat.holocron.blue";
+        error-url = "https://100.101.11.5";
+        check-url = "https://100.101.11.5";
+        icon = "di:unifi";
+        allow-insecure = true;
+      }
+      {
+        title = "korrina";
+        url = "https://korrina.holocron.blue";
+        error-url = "https://100.101.11.1";
+        check-url = "https://100.101.11.1";
+        icon = "di:unifi";
+        allow-insecure = true;
+      }
+      {
+        title = "linode";
+        url = "https://cloud.linode.com/linodes";
+        error-url = "https://status.linode.com";
+        check-url = "https://cloud.linode.com/linodes";
+        icon = "di:linode";
+        allow-insecure = true;
+      }
+      {
+        title = "tailscale";
+        url = "https://console.tailscale.com/admin/machines";
+        error-url = "https://status.tailscale.com/";
+        check-url = "https://console.tailscale.com/admin/machines";
+        icon = "di:tailscale";
+        allow-insecure = true;
+      }
+      {
+        title = "nextdns";
+        url = "https://my.nextdns.io";
+        error-url = "https://test.nextdns.io";
+        check-url = "https://my.nextdns.io/527db2/setup";
+        icon = "di:nextdns";
+        allow-insecure = true;
+      }
     ];
   };
 }

modules/homelab/services/home/homeassistant/default.nix

@@ -87,8 +87,8 @@ in {
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [cfg.port 8123 21063];
+    networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064];
-    networking.firewall.allowedUDPPorts = [21063];
+    networking.firewall.allowedUDPPorts = [5353];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {

modules/homelab/services/home/zigbee2mqtt/default.nix

@@ -85,6 +85,7 @@ in {
         };
         homeassistant = {
           enabled = true;
+          experimental_event_entities = true;
         };
       };
     };

modules/homelab/services/homebox/default.nix

@@ -2,23 +2,20 @@
   pkgs,
   config,
   lib,
-  inputs,
   ...
 }: let
-  service = "copyparty";
+  service = "homebox";
-  cfg = config.holocron.${service};
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
 in {
-  imports = [inputs.copyparty.nixosModules.default];
+  options.homelab.${service} = {
-
-  options.holocron.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
     port = lib.mkOption {
       type = lib.types.int;
-      default = 7902;
+      default = 7709;
       description = "set port for ${service} (default: ${toString cfg.port}";
     };
     url = lib.mkOption {
@@ -41,10 +38,13 @@ in {
       default = true;
       description = "enable backups for ${service}";
     };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
   };
 
   config = lib.mkIf cfg.enable {
-    nixpkgs.overlays = [inputs.copyparty.overlays.default];
     # declare ${service} group
     users.groups.${service} = {
       gid = lib.mkForce cfg.ids;
@@ -58,7 +58,6 @@ in {
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" "blake" "archives" ];
     };
 
     # enable the ${service} service
@@ -67,56 +66,24 @@ in {
       user = service;
       group = service;
       settings = {
-        i = "0.0.0.0";
+        HBOX_WEB_PORT = toString cfg.port;
-        p = [7902];
+        HBOX_STORAGE_CONN_STRING = "file://${cfg.data_dir}";
-        rproxy = 1;
+        HBOX_STORAGE_PREFIX_PATH = "data";
-      };
+        HBOX_DATABASE_DRIVER = "sqlite3";
-      accounts = {
+        HBOX_DATABASE_SQLITE_PATH = "${cfg.data_dir}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
-        blake = {
+        HBOX_OPTIONS_ALLOW_REGISTRATION = "false";
-          passwordFile = sec."copyparty_passwd".path;
+        HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
-        };
+        HBOX_MODE = "production";
-      };
+        HOME = cfg.data_dir;
-      groups = {
+        TMPDIR = "${cfg.data_dir}/tmp";
-        media = ["blake"];
-      };
-      volumes = {
-        "/archives" = {
-          path = "/holocron/archives";
-          access = {
-            r = "*";
-            A = "blake";
-          };
-          flags = {
-            chmod_f = 660;
-            chmod_d = 770;
-            #gid = ?;
-          };
-        };
-        "/media" = {
-          path = "/holocron/media";
-          access = {
-            r = "*";
-            w = "@media";
-            A = "blake";
-          };
-          flags = {
-            chmod_f = 660;
-            chmod_d = 770;
-            gid = "700";
-          };
-        };
-        "/users/blake" = {
-          path = "/holocron/users/blake";
-          access = {
-            A = "blake";
-          };
-          flags = {
-            chmod_f = 660;
-            chmod_d = 770;
-            gid = "1000";
-          };
       };
     };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      User = service;
+      Group = service;
     };
 
     # open firewall
@@ -124,16 +91,14 @@ in {
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = ["${service}.${homelab.public_domain}"];
       extraConfig = ''
-        tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
+        tls internal
-        reverse_proxy 127.0.0.1:${toString cfg.port} {
+        reverse_proxy 127.0.0.1:${toString cfg.port}
-        }
       '';
     };
 
     # add to glance (local service)
-    homelab.glance.links.system = [
+    homelab.glance.links.services = [
       {
         title = service;
         url = "https://${cfg.url}";
@@ -142,13 +107,14 @@ in {
         icon = "di:${service}";
       }
     ];
-
+    #---------------------------------------------------------------------------
-    sops.secrets = {
+    #
-      "${service}_passwd" = {
+    #    sops.secrets = {
-        owner = service;
+    #      "${service}_" = {
-        group = service;
+    #        owner = ;
-      };
+    #        group = ;
-    };
+    #      };
+    #    };
 
     # add to backups
     homelab.backups.baks = {

modules/homelab/services/vaultwarden/default.nix

@@ -65,12 +65,13 @@ in {
       enable = true;
       package = pkgs.unstable.vaultwarden;
       config = {
-        DOMAIN = domain;
+        DOMAIN = "pass.${homelab.public_domain}";
+        IP_HEADER = "X-Forwarded-For";
         ROCKET_ADDRESS = "0.0.0.0";
         ROCKET_PORT = cfg.port;
         SIGNUPS_ALLOWED = true;
-        ADMIN_TOKEN = "${toString sec."vaultwarden_admin_token".path}";
+        ADMIN_TOKEN = "$argon2id$v=19$m=19456,t=2,p=1$YXJKa0ZubE9OZkp5c0NlMC95TFhBcFh3K1VsUkk1bElTSFJkbmdYdmp4az0$bsLT8/18BmexUbzqlHp0S4aoIxi6bYxl0IY0EweF5N4";
-        EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item";
+        EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "ssh-key-vault-item";
       };
     };
 
@@ -83,8 +84,8 @@ in {
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       serverAliases = ["pass.${homelab.public_domain}"];
+      #tls internal
       extraConfig = ''
-        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/homelab/services/wger/default.nix

@@ -0,0 +1,125 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  nixservice = "wger";
+  service = "wger";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7707;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "podman-wger";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # still suss as fuck bro man fuck
+    virtualisation.oci-containers.containers = {
+      hass = {
+        image = "homeassistant/home-assistant:stable";
+        autoStart = true;
+        extraOptions = [
+          "--pull=newer"
+          "--network=host"
+        ];
+        volumes = [
+          "${cfg.data_dir}:/config"
+        ];
+        environment = {
+          TZ = homelab.tz;
+          PUID = toString config.users.users.${service}.uid;
+          PGID = toString config.users.groups.${service}.gid;
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064];
+    networking.firewall.allowedUDPPorts = [5353];
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["${service}.${homelab.public_domain}"];
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port} {
+
+        header_up Host {host}
+        header_up X-Real-IP {remote_host}
+        header_up X-Forwarded-For {remote_host}
+        header_up X-Forwarded-Proto https
+
+        }
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.services = [
+      {
+        title = "wger";
+        url = "https://hass.${homelab.public_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${nixservice}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/system/backups/default.nix

@@ -18,6 +18,7 @@ zstd -dc <path_to_backup> | sudo -u postgres psql -d <database_name>  # restore
 let
   cfg = config.homelab.backups;
   sec = config.sops.secrets;
+  host = config.networking.hostName;
 in {
   options.homelab.backups = {
     enable = lib.mkEnableOption "enables borg backups for state files and db backup services";
@@ -26,11 +27,26 @@ in {
       default = {};
       description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
     };
+    databases = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "if databases are present, runs dumps";
+    };
     backup_repo = lib.mkOption {
       type = lib.types.path;
-      default = "/holocron/archives/homelab";
+      default = "/holocron/archives/servers/${host}/homelab";
       description = "path to take daily backups to with borg!";
     };
+    offsite = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "bool to control weather or not the repo is backed up offsite";
+    };
+    homelab = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "bool to control weather or not the repo is backed up to homelab";
+    };
     offsite_user = lib.mkOption {
       type = lib.types.str;
       default = "lifeboat";
@@ -59,17 +75,26 @@ in {
       group = "archives";
       encryption.mode = "repokey-blake2";
       encryption.passCommand = "cat ${sec."borg_passwd".path}";
-      preHook = ''
+      preHook = lib.mkIf cfg.databases ''
         systemctl start mysql-backup.service
         systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
       '';
-      postHook = ''
+      postHook = lib.mkIf (cfg.offsite || cfg.homelab) ''
+        ${lib.optionalString cfg.offsite ''
           ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
             ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
             -e "ssh -o StrictHostKeyChecking=no" \
             ${toString cfg.backup_repo} \
             ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+        ''}
+        ${lib.optionalString cfg.homelab ''
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -i /home/blake/.ssh/id_vaniville -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          blake@lumiose:/holocron/archives/servers/vaniville
+        ''}
       '';
+
       extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
       extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
       prune.keep = {

modules/homelab/system/uptime-kuma/default.nix

@@ -75,9 +75,8 @@ in {
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = ["up.${homelab.public_domain}"];
+      #serverAliases = ["up.${homelab.public_domain}"];
       extraConfig = ''
-        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/system/keepalive/default.nix

@@ -16,7 +16,7 @@ in {
     };
     interval = lib.mkOption {
       type = lib.types.str;
-      default = "60s";
+      default = "45s";
     };
   };
 

modules/system/ssh/default.nix

@@ -1,9 +1,11 @@
-{ pkgs, config, lib, ... }:
-
-let
-  cfg = config.system.ssh;
-in
 {
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.system.ssh;
+in {
   options.system.ssh = {
     enable = lib.mkEnableOption "enables ssh";
   };
@@ -14,7 +16,7 @@ in
       enable = true;
       settings = {
         PasswordAuthentication = false;
-        PermitRootLogin = "no";
+        PermitRootLogin = "prohibit-password";
         X11Forwarding = false;
       };
     };

modules/system/syncthing/default.nix

@@ -37,7 +37,7 @@ in {
           "mew" = {id = "7ZC2NAS-QONQKAL-Z54NPMB-7TRXM6M-K7Z6PZD-FG4AI4H-V7SMFJN-JOYBHQO";};
           "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
           "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
-          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
+          "CEN-IT-00007" = {id = "UEWNSUZ-AX75M5Y-OA4FURY-ORMEXFA-XUXU4LU-LEUYKVW-IDM2GQC-4UR4YAL";};
         };
         folders = {
           "holocron" = {

secrets/secrets.yaml

@@ -11,6 +11,7 @@ lifeboat_rsync: ENC[AES256_GCM,data:OaijbFFpu8RM3gcWu2XbAHeuUhTIjFNO8aYcA8TJmNxM
 #ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment]
 cloudflare:
     api_token: ENC[AES256_GCM,data:VuRwfZe1cdnQLvxlp9GCDOt9Ijhz4fh2yOev2wLOdLV+zw91blA3Zis2BRyI/ZwN4y+IhiqlpBzXCsoFqw==,iv:6Bt11zz1/slvszh9ZGQ0ov5ts0jAZIAMx3G2AimKIs4=,tag:tyEVhsKCGrJWm6yn+GUlUQ==,type:str]
+    api_token_caddy: ENC[AES256_GCM,data:L1PMeI4zOCPbWuWrczM1aSYl/qk/MW8xLtxr/PL+a3zfDA+USP8Yw4liYnn1qwTxs+oLMHhpBR58kHPr8Q==,iv:NNVBPANwQ9koAKTQD4ikhtwFjCpMLMXEm9scj9jIDFo=,tag:SXt1Y+04BuSsjDhu5ykwLA==,type:str]
 #ENC[AES256_GCM,data:3Nnp9ASh+BPPwSOa+Xx3YEqKnh48oW6sWCQCXy9iZ61qGv9Ubjeaccr+Bh0bD9s=,iv:LwbptKdbhO2yki2BIK+6uPMqe14FNC4EcIwO6HS5xAc=,tag:38P0kwfAFVEps6MnMU8XeA==,type:comment]
 email_pass: ENC[AES256_GCM,data:T4heTFuvD3rUJUInDpJnIhwECw==,iv:uDOk6FKtfYjedE/I3zh9Tl7QuYz/OBe/3tlrTitf2DY=,tag:a80RoPPHMSETAbk5pqGfiQ==,type:str]
 #ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment]
@@ -36,7 +37,7 @@ cs2:
 #ENC[AES256_GCM,data:mbIgMJBhL8nWJzl8q2dFL8XtO1Xa1Q==,iv:caYHYp1boK9wRgCcQe40HTWT/HxAIvYe+HyaruI53Vc=,tag:S6wowhAHObEcs7z8FimZ1g==,type:comment]
 wg_mex_key: ENC[AES256_GCM,data:vxDXixo6X6D33+p21L4hB0/yCH+TvMHZl991BkRsE/jdz7rzZuJF+zI7h+Q=,iv:8WR+feHXNUcat8DB2wY7wpos+P7TzgRF7rFD0fYosjY=,tag:p9b9ck0/VZjyLxtHut3n5Q==,type:str]
 #ENC[AES256_GCM,data:CO5nrcDbgymnEmCvuTexOBEMncuNM5lQ,iv:6HrxqSN6e7ODuz09MIFgPbIqDCKQySRDaKk5Wdu4HoQ=,tag:JBRjZeEdOg+trohfanO6Mg==,type:comment]
-vaultwarden_admin_token: ENC[AES256_GCM,data:G1v3N064ci0Fw5EtTzaryailWpsv6f4w6eoHp2vjXIBtIlScdQk1Q0W+eDNRk8Wr2C3ysTXQNbyYismNsls+jeS3W+YqkKL4fnh3a5UTzQrMqvaH11n3ak0X9R9vmt+ZJXBrUrAOKJ6RPHJJSWenhjDB77kwEdQ=,iv:f8X+x/AdmZ3b3dtcSFrxGgA2tCgDRpgddjlVu3mdCmM=,tag:c0MXljVvhwOdvrb/8hWlsQ==,type:str]
+vaultwarden_admin_token: ENC[AES256_GCM,data:Ow5UcBXe+36POaR099v4Sl0ObLu6/lmk4OO5F3sA6BxoSD3e0LFdlvn2QyWKAUOeBSF9ZoLLSnZwc8xd2vt4xm8WQXe7OupO4yAGeE2P0vNcyMTKXxS48scibDvdoGYEtbfbH3JH29pOF7l6LetWcX3T121mPrNz8bHknj3UXHLYdYm8+eA=,iv:iFZYixNJCpK/VB3AasFO/XdPKL4wh5B9HzSKU39LRn0=,tag:m4wC0CpZK4N6rlKoEa5OZw==,type:str]
 #ENC[AES256_GCM,data:2ESzSsQZqKdjD7OXN8ZPThj6g9acJREe,iv:aDFPB0vs8NNo8ExLcJw7qtQvWbCb1XK6TJrHSK86qss=,tag:z+dypHAGUjEXP7Y9MHYWwg==,type:comment]
 gitea_database_password: ENC[AES256_GCM,data:nhFn0/G7gW5rk996OZzlcTt7T9KMbP8MNM+ReFC8w1H9ZqBSJUbs3K+n68uQVrkOVSXE0cKpOR1VbQ+i+46z3g==,iv:bT4GRZZ83v47/EmeV2KaUFo+4qTT4T2AktFUpPiZdF4=,tag:OC9TInkAr1egM+xnBDizxw==,type:str]
 #ENC[AES256_GCM,data:HJ81OxRD2xtNZKv+8oDqiT8mYpv45JMvjxU5pdmEKzl64SK3lQ==,iv:wStoC6XaZlvRPfbqti2CUbPrOOTt4KktaUp2ecVrggU=,tag:isOwKfNdQZAM+E8YQXBSFA==,type:comment]
@@ -83,7 +84,7 @@ sops:
             PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
-    lastmodified: "2026-06-20T19:06:32Z"
+    lastmodified: "2026-07-28T14:33:14Z"
-    mac: ENC[AES256_GCM,data:Z9QHyyB6GB8meEMlvVBsnKC/NBgDXH2oRc5Isbxi3Nf+zgiL+VL+i3CqHzRx6dFFVqct8zTu5CVNkQ9sbtGrhAccPUnE6sn/pLhsUBDEhvIdjsw5bHHRXZgNwJwNPd8Z4pUcDvQNzGvTDWW+ZkuvnmsdOdAvf5tjfVTGLve4mnU=,iv:E9XFqqThxTLMXKbah4iOkZLQex1bQEkuqrtrv0kKEKU=,tag:MpMkpT4fbaF35V0ZcYOpww==,type:str]
+    mac: ENC[AES256_GCM,data:bEcpoMFzXbK4WCs94Y4I5CDo9JDC4/6iRMfgc41m1o8/qJhKyJUWWZcPhJSaRSituTYyPjSe8aB6k2Vwpgcd+hk41JC2Op09mnjBWfDQz6Ts0YbZAnZ/dV4IrzdxYRtM91EXmJnROeiTftGgYN/6Awa8I+ie3UFBl8u6/5UoD7o=,iv:MIhnNS9RGFWKJ0LI7Ae9gTEcGzfKwQB4bg4oSAs8/Go=,tag:W/zfVpxn+sRa+FOrR9fKyA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.13.1
+    version: 3.13.2

users/blake/default.nix

@@ -27,6 +27,7 @@ in {
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVsjLEbnW/KeFXogppi0AP6ZbCZpObu7zFeRV/aLkP9 blake@lugia"
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJiskD81/2bd63sbJVSN0xPNwnbCGXheIBIKrwShDoo bhelderman@cen-it-07.local"
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
         ];
       };
     };

users/blake/dots/core/lf/lfrc

@@ -23,9 +23,9 @@ set ignorecase true
 
 # shortcuts
 map gb cd /holocron
-map gz cd %{{ [ -d /holocron ] && printf /holocron || printf /media/holocron }}
 map gn cd ~/.nix
 map gc cd ~/.config
+map gv cd /var/lib
 
 # navigation
 map [ half-up

users/blake/dots/core/ssh/default.nix

@@ -40,7 +40,7 @@ in {
           user = "gitea";
           port = 7567;
         };
-        "bebe" = {
+        "shauna" = {
           hostname = "10.10.0.1";
           user = "root";
         };

users/blake/dots/core/zsh/default.nix

@@ -7,6 +7,7 @@
   program = "zsh";
   cfg = config.dots.${program};
   home_dir = config.home.homeDirectory;
+  isDarwin = pkgs.stdenv.isDarwin;
   #sec = sops.secrets;
 in {
   options.dots.${program} = {
@@ -23,7 +24,6 @@ in {
     programs.${program} = {
       enable = true;
       dotDir = "${config.xdg.configHome}/zsh";
-      #dotDir = ".config/zsh";
       autocd = true;
       enableCompletion = true;
 
@@ -41,18 +41,20 @@ in {
         path = "$XDG_STATE_HOME/zsh/history";
       };
 
-      shellAliases = {
+      shellAliases =
+        {
           # --- zsh ---
-        cfz = "nvim ${home_dir}/.config/zsh/.zshrc";
           src = "source ${home_dir}/.config/zsh/.zshrc";
 
           # --- config editing ---
-        cfl = "nvim ${home_dir}/.config/lf/lfrc";
+          cfl = "nvim /home/blake/.nix/users/blake/dots/core/lf/lfrc";
+          cfz = "nvim /home/blake/.nix/users/blake/dots/core/zsh/default.nix";
+          cfv = "sudo lf /var/lib";
 
           # --- navigation ---
-        ls = "ls --color=auto --group-directories-first";
+          #          ls = "ls --color=auto --group-directories-first";
-        ll = "ls -lh --color=auto --group-directories-first";
+          #          ll = "ls -lh --color=auto --group-directories-first";
-        la = "ls -Alh --color=auto --group-directories-first";
+          #          la = "ls -Alh --color=auto --group-directories-first";
           ".." = "cd ..";
           "..." = "cd ../..";
           fs = "du -h | sort -h";
@@ -92,8 +94,19 @@ in {
           pull = "git pull";
           dotfiles = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
           dtf = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
+
+          # nix shit
           sec = "sops ${home_dir}/.nix/secrets/secrets.yaml";
 
+          # zfs
+          dfzfs = "zfs list -r -o name,used,usedsnap,usedds";
+
+          # --- yt-dlp ---
+          yt-music = "noglob yt-dlp -f 'bestaudio/best' --extract-audio --audio-format opus --audio-quality 0 --embed-metadata --embed-thumbnail -o '%(playlist_index)02d - %(title)s.%(ext)s'";
+
+          # --- dumb shit ---
+          fix-music = "sudo find /holocron/media/music -type d -exec chmod 2770 {} + && sudo find /holocron/media/music -type f -exec chmod 660 {} +";
+
           # --- systemd ---
           stat = "sudo systemctl status";
           restart = "sudo systemctl restart";
@@ -106,7 +119,21 @@ in {
           peace = "systemctl poweroff";
           love = "systemctl reboot";
           lock = "loginctl lock-session";
-      };
+        }
+        # use GNU core utils ls on macos
+        // (
+          if isDarwin
+          then {
+            ls = "gls --color=auto --group-directories-first";
+            ll = "gls -lh --color=auto --group-directories-first";
+            la = "gls -Alh --color=auto --group-directories-first";
+          }
+          else {
+            ls = "ls --color=auto --group-directories-first";
+            ll = "ls -lh --color=auto --group-directories-first";
+            la = "ls -Alh --color=auto --group-directories-first";
+          }
+        );
 
       initContent = ''
 
@@ -117,6 +144,7 @@ in {
         alias lf='lfcd'
         lfcd () {cd "$(command lf -print-last-dir "$@")"}
 
+
       '';
 
       syntaxHighlighting = {

users/blake/dots/desktop/default.nix

@@ -10,6 +10,7 @@
     ./waybar
     ./stylix
     ./hypr
+    ./kde
     ./tofi
     ./clipboard
     ./cursor

users/blake/dots/desktop/kde/default.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  program = "plasma";
+  cfg = config.dots.${program};
+  #sec = sops.secrets;
+in {
+  options.dots.${program} = {
+    enable = lib.mkEnableOption "enables ${program}";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.${program} = {
+      enable = true;
+    };
+  };
+}

users/blake/hosts/lumiose.nix

@@ -37,7 +37,7 @@ in {
       identityFile = "${home_dir}/.ssh/id_snowbelle";
       port = 7567;
     };
-    "bebe" = {
+    "shauna" = {
       hostname = "10.10.0.1";
       user = "root";
       identityFile = "${home_dir}/.ssh/id_snowbelle";
@@ -49,8 +49,14 @@ in {
     };
     "vaniville" = {
       hostname = "96.126.127.102";
+      identityFile = "${home_dir}/.ssh/id_snowbelle";
       user = "blake";
     };
+    "zygarde" = {
+      hostname = "zygarde";
+      user = "blake";
+      identityFile = "${home_dir}/.ssh/id_snowbelle";
+    };
   };
 
   sops.secrets = {

users/blake/hosts/snowbelle.nix

@@ -37,7 +37,7 @@ in {
       identityFile = "${home_dir}/.ssh/id_snowbelle";
       port = 7567;
     };
-    "bebe" = {
+    "shauna" = {
       hostname = "10.10.0.1";
       user = "root";
       identityFile = "${home_dir}/.ssh/id_snowbelle";

users/blake/hosts/vaniville.nix

@@ -28,6 +28,7 @@ in {
   # import snowbelle specific ssh keys
   programs.ssh.settings = lib.mkForce {
     "git.holocron.blue" = {
+      #AddressFamily = "inet";
       user = "gitea";
       identityFile = "${home_dir}/.ssh/id_vaniville";
       port = 7567;
@@ -37,7 +38,12 @@ in {
       identityFile = "${home_dir}/.ssh/id_vaniville";
       port = 7567;
     };
-    "bebe" = {
+    "lumiose" = {
+      hostname = "10.10.0.11";
+      user = "blake";
+      identityFile = "${home_dir}/.ssh/id_vaniville";
+    };
+    "shauna" = {
       hostname = "10.10.0.1";
       user = "root";
       identityFile = "${home_dir}/.ssh/id_vaniville";