add list of apps for refrence

hosts/darwin/cen-it-07/app_list.md

@@ -0,0 +1,79 @@
+
+casks: 
+
+battery-toolkit
+fuse-t
+linearmouse	
+ollama
+rustdesk
+texstudio
+betterdisplay
+gnucash
+mactex-no-gui
+ollama-app
+syncthing-app
+utm
+command-x
+kitty
+makemkv
+prismlauncher
+tailscale
+veracrypt-fuse-t
+firefox
+libreoffice
+minecraft
+rectangle
+tailscale-app
+vivaldi
+
+brews:
+
+coreutils
+cowsay
+ctpv
+displayplacer
+gawk
+gnupg
+imagemagick
+iperf3
+lf
+lolcat
+media-info
+mpv
+nmap
+openvpn
+p7zip
+pandoc
+pinentry-mac
+pipx
+qemu
+rage
+sl
+speedtest-cli
+xdg-ninja
+yubico-piv-tool
+
+mas:
+
+1168254295  AmorphousDiskMark            (4.0.1)
+1037126344  Apple Configurator           (2.18)
+1352778147  Bitwarden                    (2025.9.0)
+ 425264550  Blackmagic Disk Speed Test   (3.4.2)
+6454431289  CrystalFetch                 (2.2.0)
+1438243180  Dark Reader for Safari       (2.1.8)
+ 975937182  Fantastical                  (4.1.2)
+ 682658836  GarageBand                   (10.4.11)
+6504861501  Ghostery Privacy Ad Blocker  (10.5.38)
+1616683087  GT Uptime                    (2.2.0)
+1452453066  Hidden Bar                   (1.8)
+1487860882  iMazing Profile Editor       (2.1.0)
+ 408981434  iMovie                       (10.4.3)
+ 409183694  Keynote                      (14.5)
+ 634148309  Logic Pro                    (11.2.2)
+1621800675  Mercury                      (2.11.4)
+ 409203825  Numbers                      (14.4)
+ 409201541  Pages                        (14.4)
+6449850851  Privacy.com for Safari       (2.4.15)
+ 899247664  TestFlight                   (4.1.0)
+1614659226  virtualOS                    (2.1)
+1295203466  Windows App                  (11.2.4)

hosts/darwin/cen-it-07/configuration.nix

@@ -32,12 +32,22 @@
 
   homebrew = {
     enable = true;
+    # removes anything in homebrew not explicitly specified
+    #onActivation.cleanup = "uninstall";
+
     brews = [
+      "mas"
+      "coreutils"
       "ctpv"
+      "media-info"
     ];
     casks = [
       "gnucash"
     ];
+    masApps = {
+      # "name" = app_id_number;
+
+    };
   };
 
   system.stateVersion = 6;

hosts/darwin/default.nix

@@ -6,6 +6,10 @@
   ...
 }: {
 
+/*
+instructions for first time setup for macos here
+*/
+
   imports = [
   ];
 

hosts/nixos/vaniville/configuration.nix

@@ -49,101 +49,132 @@ in
   # enable flakes
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
 
-  # Open ports in the firewall.
+  nat = {
-  networking.firewall.enable = true;
+    enable = true;
-  networking.firewall.extraCommands = ''
+    externalInterface = "eth0";          # your PUBLIC_IF
-    HOMELAB_IP="10.10.0.10"         # destination address
+    internalInterfaces = [ "tailscale0" ];
-    PUBLIC_IF="eth0"                # vps public interface
+    forwardPorts = [
-    TAILSCALE_IF="tailscale0"       # tailscale interface
+      { sourcePort = 80;    destination = "10.10.0.10:80";    proto = "tcp"; } # http
-    
+      { sourcePort = 443;   destination = "10.10.0.10:443";   proto = "tcp"; } # https
-    # flush rules (avoid dupes)
+      { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
-    iptables -F
+      { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
-    iptables -t nat -F
+      { sourcePort = 7567;  destination = "10.10.0.10:7567";  proto = "tcp"; } # git
-    iptables -t mangle -F
-    iptables -X
-    
-    # set defualt policies
-    iptables -P INPUT DROP
-    iptables -P FORWARD DROP
-    iptables -P OUTPUT ACCEPT
-    
-    # allow loopback
-    iptables -A INPUT -i lo -j ACCEPT
-    iptables -A OUTPUT -o lo -j ACCEPT
-    
-    # allow replys
-    iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-    iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
-    
-    # allow vps outbound
-    iptables -A OUTPUT -o eth0 -j ACCEPT
-    
-    # general settings
-    sysctl -w net.ipv4.ip_forward=1                                 # enable ip forwarding
-    iptables -t nat -A POSTROUTING -o $TAILSCALE_IF -j MASQUERADE   # postrouting masquerade (outgoing packets appear to come from vps tailscale ip)
-    iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT    # allows pings
-    iptables -A INPUT -p tcp --dport 22 -j ACCEPT                   # allows ssh
-    
-    
-    # --- minecraft ---
-    # port: 25777 tcp & udp
-    # prerouting:
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777     # tcp packets on port 25777
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777     # udp packets on port 25777
-    # forwards:
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 25777 -j ACCEPT       # vps -> homelab: tcp on port 25777
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 25777 -j ACCEPT       # vps -> homelab: udp on port 25777
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 25777 -j ACCEPT       # homelab -> vps: tcp on port 25777
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 25777 -j ACCEPT       # homelab -> vps: udp on port 25777
-    
-    # --- reverse proxy ---
-    # ports: 80 & 443 tcp
-    # prerouting:
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 80  -j DNAT --to-destination $HOMELAB_IP:80          # tcp packets on port 80
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 443 -j DNAT --to-destination $HOMELAB_IP:443         # tcp packets on port 443
-    # forwards:
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 80 -j ACCEPT          # vps -> homelab: tcp on port 80
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 80 -j ACCEPT          # homelab -> vps: tcp on port 80
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 443 -j ACCEPT         # vps -> homelab: tcp on port 443
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 443 -j ACCEPT         # homelab -> vps: tcp on port 443
-    
-    # --- gitea ssh ---
-    # port: 7567 tcp
-    # prerouting:
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 7567 -j DNAT --to-destination $HOMELAB_IP:7567       # tcp packets on port 7567
-    # forwards:
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 7567 -j ACCEPT        # vps -> homelab: tcp on port 7567
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 7567 -j ACCEPT        # homelab -> vps: tcp on port 7567
-    
-    # --- rustdesk ---
-    # ports 2114-2119
-    # hbbs ports
-    # 21115 tcp (nat type test)
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21115 -j DNAT --to-destination $HOMELAB_IP:21115     # tcp packets on port 21115
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21115 -j ACCEPT                               # vps -> homelab: tcp on port 21115
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21115 -j ACCEPT                               # homelab -> vps: tcp on port 21115
-    # 21116 tcp&udp (id registration, heartbeat, TCP hole punching)
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116     # tcp packets on port 21116
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21116 -j ACCEPT                               # vps -> homelab: tcp on port 21116
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21116 -j ACCEPT                               # homelab -> vps: tcp on port 21116
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116     # udp packets on port 21116
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 21116 -j ACCEPT                               # vps -> homelab: tcp on port 21116
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 21116 -j ACCEPT                               # homelab -> vps: tcp on port 21116
-    # 21118 tcp (web client support)
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21118 -j DNAT --to-destination $HOMELAB_IP:21118     # tcp packets on port 21118
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21118 -j ACCEPT                               # vps -> homelab: tcp on port 21118
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21118 -j ACCEPT                               # homelab -> vps: tcp on port 21118
-    # hbbr ports
-    # 21117 tcp (relay services)
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21117 -j DNAT --to-destination $HOMELAB_IP:21117     # tcp packets on port 21117
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21117 -j ACCEPT                               # vps -> homelab: tcp on port 21117
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21117 -j ACCEPT                               # homelab -> vps: tcp on port 21117
-    # 21119 tcp (web client support)
-    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21119 -j DNAT --to-destination $HOMELAB_IP:21119     # tcp packets on port 21119
-    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21119 -j ACCEPT                               # vps -> homelab: tcp on port 21119
-    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21119 -j ACCEPT
-  '';
 
+      # Rustdesk ports
+      { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
+      { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
+      { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
+      { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
+      { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
+      { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
+    ];
+  };
+
+  firewall = {
+    enable = true;
+    allowedTCPPorts = [ 22 80 443 25777 7567 21115 21116 21117 21118 21119 ];
+    allowedUDPPorts = [ 25777 21116 ];
+    # tailscale will also need its UDP port open:
+    allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
+    trustedInterfaces = [ "tailscale0" ];
+  };
+
+
+  # Open ports in the firewall, the wrong way
+#  networking.firewall.enable = true;
+#  networking.firewall.extraCommands = ''
+#    HOMELAB_IP="10.10.0.10"         # destination address
+#    PUBLIC_IF="eth0"                # vps public interface
+#    TAILSCALE_IF="tailscale0"       # tailscale interface
+#    
+#    # flush rules (avoid dupes)
+#    iptables -F
+#    iptables -t nat -F
+#    iptables -t mangle -F
+#    iptables -X
+#    
+#    # set defualt policies
+#    iptables -P INPUT DROP
+#    iptables -P FORWARD DROP
+#    iptables -P OUTPUT ACCEPT
+#    
+#    # allow loopback
+#    iptables -A INPUT -i lo -j ACCEPT
+#    iptables -A OUTPUT -o lo -j ACCEPT
+#    
+#    # allow replys
+#    iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+#    iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
+#    
+#    # allow vps outbound
+#    iptables -A OUTPUT -o eth0 -j ACCEPT
+#    
+#    # general settings
+#    sysctl -w net.ipv4.ip_forward=1                                 # enable ip forwarding
+#    iptables -t nat -A POSTROUTING -o $TAILSCALE_IF -j MASQUERADE   # postrouting masquerade (outgoing packets appear to come from vps tailscale ip)
+#    iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT    # allows pings
+#    iptables -A INPUT -p tcp --dport 22 -j ACCEPT                   # allows ssh
+#    
+#    
+#    # --- minecraft ---
+#    # port: 25777 tcp & udp
+#    # prerouting:
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777     # tcp packets on port 25777
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 25777 -j DNAT --to-destination $HOMELAB_IP:25777     # udp packets on port 25777
+#    # forwards:
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 25777 -j ACCEPT       # vps -> homelab: tcp on port 25777
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 25777 -j ACCEPT       # vps -> homelab: udp on port 25777
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 25777 -j ACCEPT       # homelab -> vps: tcp on port 25777
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 25777 -j ACCEPT       # homelab -> vps: udp on port 25777
+#    
+#    # --- reverse proxy ---
+#    # ports: 80 & 443 tcp
+#    # prerouting:
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 80  -j DNAT --to-destination $HOMELAB_IP:80          # tcp packets on port 80
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 443 -j DNAT --to-destination $HOMELAB_IP:443         # tcp packets on port 443
+#    # forwards:
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 80 -j ACCEPT          # vps -> homelab: tcp on port 80
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 80 -j ACCEPT          # homelab -> vps: tcp on port 80
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 443 -j ACCEPT         # vps -> homelab: tcp on port 443
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 443 -j ACCEPT         # homelab -> vps: tcp on port 443
+#    
+#    # --- gitea ssh ---
+#    # port: 7567 tcp
+#    # prerouting:
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 7567 -j DNAT --to-destination $HOMELAB_IP:7567       # tcp packets on port 7567
+#    # forwards:
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 7567 -j ACCEPT        # vps -> homelab: tcp on port 7567
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 7567 -j ACCEPT        # homelab -> vps: tcp on port 7567
+#    
+#    # --- rustdesk ---
+#    # ports 2114-2119
+#    # hbbs ports
+#    # 21115 tcp (nat type test)
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21115 -j DNAT --to-destination $HOMELAB_IP:21115     # tcp packets on port 21115
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21115 -j ACCEPT                               # vps -> homelab: tcp on port 21115
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21115 -j ACCEPT                               # homelab -> vps: tcp on port 21115
+#    # 21116 tcp&udp (id registration, heartbeat, TCP hole punching)
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116     # tcp packets on port 21116
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21116 -j ACCEPT                               # vps -> homelab: tcp on port 21116
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21116 -j ACCEPT                               # homelab -> vps: tcp on port 21116
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p udp --dport 21116 -j DNAT --to-destination $HOMELAB_IP:21116     # udp packets on port 21116
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p udp --dport 21116 -j ACCEPT                               # vps -> homelab: tcp on port 21116
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p udp --sport 21116 -j ACCEPT                               # homelab -> vps: tcp on port 21116
+#    # 21118 tcp (web client support)
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21118 -j DNAT --to-destination $HOMELAB_IP:21118     # tcp packets on port 21118
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21118 -j ACCEPT                               # vps -> homelab: tcp on port 21118
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21118 -j ACCEPT                               # homelab -> vps: tcp on port 21118
+#    # hbbr ports
+#    # 21117 tcp (relay services)
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21117 -j DNAT --to-destination $HOMELAB_IP:21117     # tcp packets on port 21117
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21117 -j ACCEPT                               # vps -> homelab: tcp on port 21117
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21117 -j ACCEPT                               # homelab -> vps: tcp on port 21117
+#    # 21119 tcp (web client support)
+#    iptables -t nat -A PREROUTING -i $PUBLIC_IF -p tcp --dport 21119 -j DNAT --to-destination $HOMELAB_IP:21119     # tcp packets on port 21119
+#    iptables -A FORWARD -i $PUBLIC_IF -o $TAILSCALE_IF -p tcp --dport 21119 -j ACCEPT                               # vps -> homelab: tcp on port 21119
+#    iptables -A FORWARD -i $TAILSCALE_IF -o $PUBLIC_IF -p tcp --sport 21119 -j ACCEPT
+#  '';
+#
 
   system.stateVersion = "25.05"; # Did you read the comment?
 

users/blake/dots/programs/bitwarden/default.nix

@@ -14,7 +14,7 @@ in {
   config = lib.mkIf cfg.enable {
 
     # just install package
-    home.packages = with pkgs; [bitwarden-desktop bitwarden-cli hakuneko ];
+    home.packages = with pkgs; [bitwarden-desktop bitwarden-cli ];
 
 
   };

users/blake/hosts/cen-it-07.nix

@@ -8,7 +8,10 @@
   home_dir = config.home.homeDirectory;
 in {
   imports = [
+   # ../dots
     ../dots/core
+    ../dots/desktop/kitty
+    ../dots/programs/_browsers
   ];
 
   dots = {
@@ -21,6 +24,9 @@ in {
     git.enable = true;
     nh.enable = true;
     xdg.enable = true;
+
+    kitty.enable = true;
+    
   };
 
   home.packages = with pkgs; [