syncthing bullshit

bin/git_upstream

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+cd /home/blake/.nix
+git remote remove origin                 
+git remote add origin ssh://gitea@git.holocron.blue:7567/blake/nix.git
+git fetch
+git branch --set-upstream-to=origin/trunk trunk

flake.lock

@@ -58,11 +58,11 @@
     "base16-helix": {
       "flake": false,
       "locked": {
-        "lastModified": 1760703920,
-        "narHash": "sha256-m82fGUYns4uHd+ZTdoLX2vlHikzwzdu2s2rYM2bNwzw=",
+        "lastModified": 1776754714,
+        "narHash": "sha256-E3OAK27smtATTmX45uoTSRsVD+Y+ZiVVfgM/tjpbtYg=",
         "owner": "tinted-theming",
         "repo": "base16-helix",
-        "rev": "d646af9b7d14bff08824538164af99d0c521b185",
+        "rev": "4d508123037e7851ad36ebf7d9c48b0e9e1eb581",
         "type": "github"
       },
       "original": {
@@ -106,16 +106,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1774235677,
-        "narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=",
+        "lastModified": 1788591592,
+        "narHash": "sha256-NbwVKwKLFl0oXub7oPjvmDaOygCtV2oboeKTu4xXFTk=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201",
+        "rev": "08e85c4e42f5d8f1ea17c36cb59cf61c2ccb26c3",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "5.1.1",
+        "ref": "6.0.22",
         "repo": "brew",
         "type": "github"
       }
@@ -126,11 +126,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1776983715,
-        "narHash": "sha256-XonefkUGuMkCvyFfy3B6crz6FV8Ghsrc3Lg1SIWi2hg=",
+        "lastModified": 1789598303,
+        "narHash": "sha256-hyAB8PqtE+2NPbXqFWFOVessao4ccpsQq6hKBfZPN0w=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "1e7de5d14f00f8821b1a32f3009f4328b1a5e04a",
+        "rev": "6867ccc51181e7965445c3d158ddddf9a8fd817e",
         "type": "github"
       },
       "original": {
@@ -156,7 +156,7 @@
     },
     "crane_2": {
       "inputs": {
-        "flake-compat": "flake-compat_4",
+        "flake-compat": "flake-compat_5",
         "flake-utils": "flake-utils_3",
         "nixpkgs": [
           "watershot",
@@ -257,7 +257,7 @@
     },
     "fenix": {
       "inputs": {
-        "nixpkgs": "nixpkgs_3",
+        "nixpkgs": "nixpkgs_4",
         "rust-analyzer-src": "rust-analyzer-src"
       },
       "locked": {
@@ -277,11 +277,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1775176642,
-        "narHash": "sha256-2veEED0Fg7Fsh81tvVDNYR6SzjqQxa7hbi18Jv4LWpM=",
+        "lastModified": 1783570805,
+        "narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "179704030c5286c729b5b0522037d1d51341022c",
+        "rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
         "type": "github"
       },
       "original": {
@@ -309,11 +309,27 @@
     "flake-compat_2": {
       "flake": false,
       "locked": {
-        "lastModified": 1751685974,
-        "narHash": "sha256-NKw96t+BgHIYzHUjkTK95FqYRVKB8DHpVhefWSz/kTw=",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
+    "flake-compat_3": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1777699697,
+        "narHash": "sha256-Eg9b/rq/ECYwNwEXs5i9wHyhxNI0JrYx2srdI2uZMaQ=",
         "ref": "refs/heads/main",
-        "rev": "549f2762aebeff29a2e5ece7a7dc0f955281a1d1",
-        "revCount": 92,
+        "rev": "382052b74656a369c5408822af3f2501e9b1af81",
+        "revCount": 94,
         "type": "git",
         "url": "https://git.lix.systems/lix-project/flake-compat.git"
       },
@@ -322,7 +338,7 @@
         "url": "https://git.lix.systems/lix-project/flake-compat.git"
       }
     },
-    "flake-compat_3": {
+    "flake-compat_4": {
       "flake": false,
       "locked": {
         "lastModified": 1696426674,
@@ -338,7 +354,7 @@
         "type": "github"
       }
     },
-    "flake-compat_4": {
+    "flake-compat_5": {
       "flake": false,
       "locked": {
         "lastModified": 1673956053,
@@ -376,27 +392,6 @@
       }
     },
     "flake-parts_2": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "nvf",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1769996383,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "type": "github"
-      }
-    },
-    "flake-parts_3": {
       "inputs": {
         "nixpkgs-lib": [
           "stylix",
@@ -404,11 +399,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775087534,
-        "narHash": "sha256-91qqW8lhL7TLwgQWijoGBbiD4t7/q75KTi8NxjVmSmA=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "3107b77cd68437b9a76194f0f7f9c55f2329ca5b",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -480,7 +475,7 @@
     },
     "git-hooks": {
       "inputs": {
-        "flake-compat": "flake-compat_3",
+        "flake-compat": "flake-compat_4",
         "gitignore": "gitignore_2",
         "nixpkgs": [
           "slippi",
@@ -548,18 +543,20 @@
     "gnome-shell": {
       "flake": false,
       "locked": {
-        "lastModified": 1767737596,
-        "narHash": "sha256-eFujfIUQDgWnSJBablOuG+32hCai192yRdrNHTv0a+s=",
+        "host": "gitlab.gnome.org",
+        "lastModified": 1776175984,
+        "narHash": "sha256-RJFlFW8GiMei6oqUGrMkGEvVqOH8U7Q8abc1yK4VKD8=",
         "owner": "GNOME",
         "repo": "gnome-shell",
-        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "github"
+        "rev": "e0fdc4c13250e9a9b8ea9594c83925274f4a5dca",
+        "type": "gitlab"
       },
       "original": {
+        "host": "gitlab.gnome.org",
         "owner": "GNOME",
+        "ref": "50.1",
         "repo": "gnome-shell",
-        "rev": "ef02db02bf0ff342734d525b5767814770d85b49",
-        "type": "github"
+        "type": "gitlab"
       }
     },
     "home-manager": {
@@ -569,16 +566,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1775425411,
-        "narHash": "sha256-KY6HsebJHEe5nHOWP7ur09mb0drGxYSzE3rQxy62rJo=",
+        "lastModified": 1789267039,
+        "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "0d02ec1d0a05f88ef9e74b516842900c41f0f2fe",
+        "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.11",
+        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -590,11 +587,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776989775,
-        "narHash": "sha256-sIIeTZz5sWfrkV/SplDAthZNAzLhSxnJ7Foia6bAxB4=",
+        "lastModified": 1789676441,
+        "narHash": "sha256-mOvO5VvycuBtOUe5EYI54vrLsWe+2KF/82fmwKooe48=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "5bba6a1e027b79ba56dd6ed8e6edbed80aa8e3cb",
+        "rev": "9d485f74cd27d17126ee34cb31005c39d20f741f",
         "type": "github"
       },
       "original": {
@@ -674,11 +671,11 @@
     },
     "mnw": {
       "locked": {
-        "lastModified": 1770419553,
-        "narHash": "sha256-b1XqsH7AtVf2dXmq2iyRr2NC1yG7skY7Z6N2MpWHlK4=",
+        "lastModified": 1780772958,
+        "narHash": "sha256-VKKe8r4pwCGWZ3Yr9CPN129R4S3CKLSrlYqdYz3vKpM=",
         "owner": "Gerg-L",
         "repo": "mnw",
-        "rev": "2aaffa8030d0b262176146adbb6b0e6374ce2957",
+        "rev": "0871dbf63a53610c95db04439ed8ea4d6ec9c160",
         "type": "github"
       },
       "original": {
@@ -714,28 +711,6 @@
         "type": "github"
       }
     },
-    "ndg": {
-      "inputs": {
-        "nixpkgs": [
-          "nvf",
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1776882296,
-        "narHash": "sha256-DWZozXwMsgvUqfVlL1mQ8dOxW7GJ/8CdyaDN+1niZRg=",
-        "owner": "feel-co",
-        "repo": "ndg",
-        "rev": "ab7d78d4884b3a34968cf9fa3d16c0c1246d5c6e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "feel-co",
-        "ref": "refs/tags/v2.6.0",
-        "repo": "ndg",
-        "type": "github"
-      }
-    },
     "nix-darwin": {
       "inputs": {
         "nixpkgs": [
@@ -743,11 +718,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775037210,
-        "narHash": "sha256-KM2WYj6EA7M/FVZVCl3rqWY+TFV5QzSyyGE2gQxeODU=",
+        "lastModified": 1786845137,
+        "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "06648f4902343228ce2de79f291dd5a58ee12146",
+        "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
         "type": "github"
       },
       "original": {
@@ -778,11 +753,11 @@
         "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1774720267,
-        "narHash": "sha256-YYftFe8jyfpQI649yfr0E+dqEXE2jznZNcYvy/lKV1U=",
+        "lastModified": 1788981439,
+        "narHash": "sha256-fEaFq0XgpgWFPLfpq1UK4/8ylHd2T0+fo6O3hKz1LUM=",
         "owner": "zhaofengli",
         "repo": "nix-homebrew",
-        "rev": "a7760a3a83f7609f742861afb5732210fdc437ed",
+        "rev": "09a921d0181146cf6163ec2cc1db7b6fd539a885",
         "type": "github"
       },
       "original": {
@@ -823,6 +798,28 @@
         "type": "github"
       }
     },
+    "nixos-wsl": {
+      "inputs": {
+        "flake-compat": "flake-compat_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1789164534,
+        "narHash": "sha256-DoYGPM6QpnYBLWj9gGw6ZwAzIX+HrAVov1BoT+8Jixo=",
+        "owner": "nix-community",
+        "repo": "NixOS-WSL",
+        "rev": "72c92b11bb8289e6651c7fef29cc0a885fd6a255",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "ref": "main",
+        "repo": "NixOS-WSL",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1748162331,
@@ -840,12 +837,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1776548001,
-        "narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
-        "type": "github"
+        "lastModified": 1789546076,
+        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -855,20 +851,35 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1776734388,
-        "narHash": "sha256-vl3dkhlE5gzsItuHoEMVe+DlonsK+0836LIRDnm6MXQ=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "10e7ad5bbcb421fe07e3a4ad53a634b0cd57ffac",
-        "type": "github"
+        "lastModified": 1789542786,
+        "narHash": "sha256-BGtBoaZNpOPDEBLTiWNFdYppnDjGhwrUq5/P15QwrrM=",
+        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9904.4c7870105e7f/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
         "type": "indirect"
       }
     },
     "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1739419412,
+        "narHash": "sha256-NCWZQg4DbYVFWg+MOFrxWRaVsLA7yvRWAf6o0xPR1hI=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "2d55b4c1531187926c2a423f6940b3b1301399b5",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_4": {
       "locked": {
         "lastModified": 1677063315,
         "narHash": "sha256-qiB4ajTeAOVnVSAwCNEEkoybrAlA+cpeiBxLobHndE8=",
@@ -911,11 +922,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1775228139,
-        "narHash": "sha256-ebbeHmg+V7w8050bwQOuhmQHoLOEOfqKzM1KgCTexK4=",
+        "lastModified": 1785549842,
+        "narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "601971b9c89e0304561977f2c28fa25e73aa7132",
+        "rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
         "type": "github"
       },
       "original": {
@@ -926,21 +937,18 @@
     },
     "nvf": {
       "inputs": {
-        "flake-compat": "flake-compat_2",
-        "flake-parts": "flake-parts_2",
+        "flake-compat": "flake-compat_3",
         "mnw": "mnw",
-        "ndg": "ndg",
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "systems": "systems"
+        ]
       },
       "locked": {
-        "lastModified": 1776987992,
-        "narHash": "sha256-hcAGb1ZH8AXFjy0UefPIgj0GCSKaaKXWU4kfPJtHutA=",
+        "lastModified": 1789510188,
+        "narHash": "sha256-umec9LKkWjK89Yx4XpvQStkgfKvhK7GjVf5m21bjzKU=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "26b98908d9c1a3260724dc5fabd16f3da1e6ba6c",
+        "rev": "cdc7e7aaa7eb521bba1b38f54c3228d52cc31703",
         "type": "github"
       },
       "original": {
@@ -1056,6 +1064,29 @@
         "type": "github"
       }
     },
+    "plasma-manager": {
+      "inputs": {
+        "home-manager": [
+          "home-manager-unstable"
+        ],
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785762349,
+        "narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "type": "github"
+      }
+    },
     "pre-commit-hooks-nix": {
       "inputs": {
         "flake-compat": [
@@ -1093,11 +1124,14 @@
         "nix-darwin": "nix-darwin",
         "nix-flatpak": "nix-flatpak",
         "nix-homebrew": "nix-homebrew",
+        "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nvf": "nvf",
+        "plasma-manager": "plasma-manager",
         "slippi": "slippi",
         "sops-nix": "sops-nix",
+        "srcds-nix": "srcds-nix",
         "stylix": "stylix",
         "vpn-confinement": "vpn-confinement",
         "watershot": "watershot"
@@ -1181,11 +1215,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1774370155,
-        "narHash": "sha256-emNcbleHPyUszpRFV5mHnU3q4E0aq7FNJxPtIAvsJqE=",
+        "lastModified": 1784166278,
+        "narHash": "sha256-TSvk8AK8ACGTSeC2v/tyWX3UiiaEQ5O4nX5jqVtEEEI=",
         "owner": "lytedev",
         "repo": "slippi-nix",
-        "rev": "c1f16cb34f7e09e8a9c7fe49744305c2f65a5b5f",
+        "rev": "d87fef3580e6afc19bc3fffbba61069df2452cbf",
         "type": "github"
       },
       "original": {
@@ -1201,11 +1235,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1776771786,
-        "narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
+        "lastModified": 1789623319,
+        "narHash": "sha256-kmlp8rPrvrXn58YiaANHKSWUijtUc7pwgerIywosOIM=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
+        "rev": "16954c1c360c3dc4d4b3b3e64df59f7e89452cb1",
         "type": "github"
       },
       "original": {
@@ -1214,6 +1248,25 @@
         "type": "github"
       }
     },
+    "srcds-nix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_3",
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1739576881,
+        "narHash": "sha256-zudD0ycB1cOwvqFBlAwSKwjO9cZir2qzA4f43ixNYCQ=",
+        "owner": "ihaveamac",
+        "repo": "srcds-nix",
+        "rev": "ad8a719fa97b26dfc0b3b6f0ba0f468036c549e1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "ihaveamac",
+        "repo": "srcds-nix",
+        "type": "github"
+      }
+    },
     "std": {
       "inputs": {
         "arion": [
@@ -1268,24 +1321,24 @@
         "base16-helix": "base16-helix",
         "base16-vim": "base16-vim",
         "firefox-gnome-theme": "firefox-gnome-theme",
-        "flake-parts": "flake-parts_3",
+        "flake-parts": "flake-parts_2",
         "gnome-shell": "gnome-shell",
         "nixpkgs": [
           "nixpkgs-unstable"
         ],
         "nur": "nur",
-        "systems": "systems_2",
+        "systems": "systems",
         "tinted-kitty": "tinted-kitty",
         "tinted-schemes": "tinted-schemes",
         "tinted-tmux": "tinted-tmux",
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1776893932,
-        "narHash": "sha256-AFD5cf9eNqXq1brHS63xeZy2xKZMgG9J86XJ9I2eLn8=",
+        "lastModified": 1787771653,
+        "narHash": "sha256-DkkJSBOXWV/mja5Vy8az5g1KpZlsbUwlmH0BsQhowaQ=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "84971726c7ef0bb3669a5443e151cc226e65c518",
+        "rev": "5e3809851f486e7fc7e84b40f174c74b60ecc784",
         "type": "github"
       },
       "original": {
@@ -1296,30 +1349,16 @@
     },
     "systems": {
       "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "lastModified": 1774449309,
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
-    },
-    "systems_2": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
+        "ref": "future-26.11",
         "repo": "default",
         "type": "github"
       }
@@ -1343,11 +1382,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1772661346,
-        "narHash": "sha256-4eu3LqB9tPqe0Vaqxd4wkZiBbthLbpb7llcoE/p5HT0=",
+        "lastModified": 1785153830,
+        "narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "13b5b0c299982bb361039601e2d72587d6846294",
+        "rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
         "type": "github"
       },
       "original": {
@@ -1359,11 +1398,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1772934010,
-        "narHash": "sha256-x+6+4UvaG+RBRQ6UaX+o6DjEg28u4eqhVRM9kpgJGjQ=",
+        "lastModified": 1785031658,
+        "narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "c3529673a5ab6e1b6830f618c45d9ce1bcdd829d",
+        "rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
         "type": "github"
       },
       "original": {
@@ -1375,11 +1414,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1772909925,
-        "narHash": "sha256-jx/5+pgYR0noHa3hk2esin18VMbnPSvWPL5bBjfTIAU=",
+        "lastModified": 1785030526,
+        "narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "b4d3a1b3bcbd090937ef609a0a3b37237af974df",
+        "rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
         "type": "github"
       },
       "original": {
@@ -1388,13 +1427,34 @@
         "type": "github"
       }
     },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "srcds-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1738953846,
+        "narHash": "sha256-yrK3Hjcr8F7qS/j2F+r7C7o010eVWWlm4T1PrbKBOxQ=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "4f09b473c936d41582dd744e19f34ec27592c5fd",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1767604552,
-        "narHash": "sha256-FddhMxnc99KYOZ/S3YNqtDSoxisIhVtJ7L4s8XD2u0A=",
+        "lastModified": 1789394839,
+        "narHash": "sha256-trdjVJKmDBbzgbP8pd+R7iKbGkdRu0nmXgQlBR/hEiU=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "a6b2da727853886876fd1081d6bb2880752937f3",
+        "rev": "a21f66ccd9f644c3770ccdf287cb380c00192628",
         "type": "github"
       },
       "original": {

flake.nix

@@ -4,20 +4,26 @@
 {
   description = "blakes nix config";
   inputs = {
-    nixpkgs.url = "nixpkgs/nixos-25.11";
+    nixpkgs.url = "nixpkgs/nixos-26.05";
     nixpkgs-unstable.url = "nixpkgs/nixos-unstable";
     nix-darwin = {
       url = "github:nix-darwin/nix-darwin/master";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      #url = "github:nix-community/home-manager";
+      url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     home-manager-unstable = {
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
+    plasma-manager = {
+      url = "github:nix-community/plasma-manager";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.home-manager.follows = "home-manager-unstable";
+    };
     nix-homebrew.url = "github:zhaofengli/nix-homebrew";
     nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
     sops-nix = {
@@ -28,6 +34,10 @@
       url = "github:nix-community/disko/latest";
       inputs.nixpkgs.follows = "nixpkgs";
     };
+    nixos-wsl = {
+      url = "github:nix-community/NixOS-WSL/main";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
     lanzaboote = {
       url = "github:nix-community/lanzaboote/v0.4.3";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -56,6 +66,7 @@
       url = "github:lytedev/slippi-nix";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
+    srcds-nix.url = "github:ihaveamac/srcds-nix";
   };
   outputs = {
     self,
@@ -63,29 +74,41 @@
     nixpkgs-unstable,
     nix-darwin,
     nix-homebrew,
+    nixos-wsl,
+    plasma-manager,
     ...
   } @ inputs: let
     systems = {
-      x86_64 = "x86_64-linux";
-      arm64 = "aarch64-linux";
-      darwin = "aarch64-darwin";
+      x86_64-linux = "x86_64-linux";
+      aarch64-linux = "aarch64-linux";
+      aarch64-darwin = "aarch64-darwin";
     };
+    unstableOverlay = final: prev: {
+      unstable = import nixpkgs-unstable {
+        #system = prev.system;
+        system = prev.stdenv.hostPlatform.system;
+        config.allowUnfree = true;
+      };
+    };
+    # legacy
     stable_pkgs = builtins.mapAttrs (k: v: import nixpkgs {system = v;}) systems;
     unstable_pkgs = builtins.mapAttrs (k: v: import nixpkgs-unstable {system = v;}) systems;
   in {
     nixosConfigurations = {
       snowbelle = nixpkgs.lib.nixosSystem {
-        system = systems.x86_64;
+        system = systems.x86_64-linux;
         specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
         modules = [
+          {nixpkgs.overlays = [unstableOverlay];}
           ./hosts/nixos/snowbelle/configuration.nix
           inputs.home-manager.nixosModules.default
         ];
       };
       yveltal = nixpkgs-unstable.lib.nixosSystem {
-        system = systems.x86_64;
+        system = systems.x86_64-linux;
         specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
         modules = [
+          {nixpkgs.overlays = [unstableOverlay];}
           ./hosts/nixos/yveltal/configuration.nix
           ./hosts/nixos/yveltal/disko.nix
           inputs.home-manager-unstable.nixosModules.default
@@ -93,9 +116,10 @@
         ];
       };
       mew = nixpkgs-unstable.lib.nixosSystem {
-        system = systems.x86_64;
+        system = systems.x86_64-linux;
         specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
         modules = [
+          {nixpkgs.overlays = [unstableOverlay];}
           ./hosts/nixos/mew/configuration.nix
           ./hosts/nixos/mew/disko.nix
           inputs.home-manager-unstable.nixosModules.default
@@ -103,28 +127,41 @@
         ];
       };
       vaniville = nixpkgs.lib.nixosSystem {
-        system = systems.x86_64;
+        system = systems.x86_64-linux;
         specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
         modules = [
+          {nixpkgs.overlays = [unstableOverlay];}
           ./hosts/nixos/vaniville/configuration.nix
           inputs.home-manager.nixosModules.default
         ];
       };
       lumiose = nixpkgs.lib.nixosSystem {
-        system = systems.x86_64;
+        system = systems.x86_64-linux;
         specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
         modules = [
+          {nixpkgs.overlays = [unstableOverlay];}
           ./hosts/nixos/lumiose/configuration.nix
           inputs.home-manager.nixosModules.default
           inputs.disko.nixosModules.disko
         ];
       };
+      wsl = nixpkgs.lib.nixosSystem {
+        system = systems.x86_64-linux;
+        specialArgs = {inherit inputs stable_pkgs unstable_pkgs;};
+        modules = [
+          {nixpkgs.overlays = [unstableOverlay];}
+          ./hosts/nixos/wsl/configuration.nix
+          nixos-wsl.nixosModules.default
+          inputs.home-manager.nixosModules.default
+        ];
+      };
     };
     darwinConfigurations = {
       cen-it-07 = nix-darwin.lib.darwinSystem {
-        system = systems.darwin;
+        system = systems.aarch64-darwin;
         specialArgs = {inherit inputs stable_pkgs unstable_pkgs nix-homebrew;};
         modules = [
+          {nixpkgs.overlays = [unstableOverlay];}
           ./hosts/darwin/cen-it-07/configuration.nix
           inputs.home-manager.darwinModules.default
         ];

hosts/darwin/cen-it-07/configuration.nix

@@ -5,25 +5,23 @@
   inputs,
   ...
 }: {
-
   imports = [
     inputs.nix-homebrew.darwinModules.nix-homebrew
     ../default.nix
-   ../../../modules/darwin
+    ../../../modules/darwin
   ];
 
   # home grown nixos modules
   darwin = {
     syncthing.enable = true;
     tailscale.enable = true;
+    nextdns.enable = true;
     yubikey.enable = true;
     work.enable = true;
     apps.enable = true;
     cyber.enable = true;
     gaming.enable = true;
   };
-  
- 
 
   # import home grown host specific home-manager modules
   home-manager.users.bhelderman.imports = [
@@ -44,17 +42,23 @@
     };
   };
 
-
   # base system package install list
   environment.systemPackages = with pkgs; [
     neovide
   ];
 
   nix-homebrew = {
-    enable = true;  # install homebrew
-    enableRosetta = true;   # install homebrew for rosetta as well
-#    autoMigrate = true;
-    user = "bhelderman";  # user owning homebrew prefix
+    enable = true; # install homebrew
+    enableRosetta = true; # install homebrew for rosetta as well
+    #autoMigrate = true;
+    user = "bhelderman"; # user owning homebrew prefix
+
+    trust = {
+      formulae = [];
+      casks = [];
+      commands = [];
+      taps = ["rogeriopradoj/cask-peazip"];
+    };
   };
 
   homebrew = {
@@ -63,9 +67,13 @@
     onActivation = {
       cleanup = "zap";
       autoUpdate = false;
-      upgrade = false;
+      upgrade = true;
     };
 
+    taps = [
+      "rogeriopradoj/cask-peazip"
+    ];
+
     brews = [
       "mas"
       "coreutils"
@@ -74,9 +82,10 @@
     ];
     casks = [
       "kitty"
-      "battery-toolkit"
       "linearmouse"
       "betterdisplay"
+      "rectangle"
+      "peazip"
     ];
     masApps = {
       # "name" = app_id_number;
@@ -96,8 +105,4 @@
       allowSleepByPowerButton = true;
     };
   };
-
-
-
-
 }

hosts/darwin/default.nix

@@ -5,18 +5,17 @@
   inputs,
   ...
 }: {
-
-/*
-instructions for first time setup for macos here
-1. install the nix package manager with: `sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install)`
-2. install xcode tools with `xcode-select --install`
-3. allow full disk access to terminal
-4. xfer or git clone flake to ~/.nix
-5. sign into icloud and by extension app store for mas 
-6. rename some shell rc files with `sudo mv /etc/bashrc /etc/bashrc.before-nix-darwin && sudo mv /etc/zshrc /etc/zshrc.before-nix-darwin`
-7. install nix-darwin with: `nix run --extra-experimental-features "nix-command flakes" nix-darwin -- switch --flake ~/.nix#host`
-8. nh should be installed now so enjoy and use `nh darwin switch`
-*/
+  /*
+  instructions for first time setup for macos here
+  1. install the nix package manager with: `sh <(curl --proto '=https' --tlsv1.2 -L https://nixos.org/nix/install)`
+  2. install xcode tools with `xcode-select --install`
+  3. allow full disk access to terminal
+  4. xfer or git clone flake to ~/.nix
+  5. sign into icloud and by extension app store for mas
+  6. rename some shell rc files with `sudo mv /etc/bashrc /etc/bashrc.before-nix-darwin && sudo mv /etc/zshrc /etc/zshrc.before-nix-darwin`
+  7. install nix-darwin with: `nix run --extra-experimental-features "nix-command flakes" nix-darwin -- switch --flake ~/.nix#host`
+  8. nh should be installed now so enjoy and use `nh darwin switch`
+  */
 
   imports = [
   ];
@@ -25,6 +24,7 @@ instructions for first time setup for macos here
   # base system package install list
   environment.systemPackages = with pkgs; [
     wget
+    sl
     curl
     rsync
     git
@@ -35,7 +35,6 @@ instructions for first time setup for macos here
     python3
     lf
     btop
-    rectangle
     pinentry_mac
   ];
 
@@ -55,7 +54,6 @@ instructions for first time setup for macos here
     };
   };
 
-
   # set timezone
   time.timeZone = "America/Chicago";
 
@@ -69,7 +67,7 @@ instructions for first time setup for macos here
     stateVersion = 6;
     defaults = {
       trackpad = {
-        Clicking = true; 
+        Clicking = true;
         TrackpadThreeFingerDrag = true;
         TrackpadFourFingerVertSwipeGesture = 2;
         TrackpadRightClick = true;
@@ -78,18 +76,15 @@ instructions for first time setup for macos here
         TrackpadRotate = true;
         TrackpadTwoFingerDoubleTapGesture = true;
         TrackpadTwoFingerFromRightEdgeSwipeGesture = 3;
-
       };
       universalaccess = {
         mouseDriverCursorSize = 3.0;
-
       };
       NSGlobalDomain = {
         AppleICUForce24HourTime = true;
         AppleInterfaceStyle = "Dark";
         NSAutomaticCapitalizationEnabled = false;
         NSDocumentSaveNewDocumentsToCloud = false;
-
       };
       WindowManager = {
         EnableStandardClickToShowDesktop = false;
@@ -117,6 +112,7 @@ instructions for first time setup for macos here
         orientation = "bottom";
         scroll-to-open = true;
         show-recents = false;
+        showAppExposeGestureEnabled = true;
       };
       finder = {
         AppleShowAllExtensions = true;
@@ -137,9 +133,6 @@ instructions for first time setup for macos here
         askForPassword = true;
         askForPasswordDelay = 15;
       };
-
     };
   };
-
-
 }

hosts/nixos/default.nix

@@ -3,6 +3,7 @@
   config,
   lib,
   inputs,
+  unstable_pkgs,
   ...
 }: {
   imports = [
@@ -23,7 +24,7 @@
     # optimise nix store, dedupe and such
     optimise = {
       automatic = true;
-      dates = [ "daily" ];
+      dates = ["daily"];
     };
     # the goats
     settings = {
@@ -52,7 +53,15 @@
   powerManagement.powertop.enable = true;
 
   # things are better this way
-  users.defaultUserShell = pkgs.zsh;
+  users = {
+    defaultUserShell = pkgs.zsh;
+    users.root = {
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
+      ];
+    };
+  };
 
   # base system package install list
   environment.systemPackages = with pkgs; [
@@ -74,6 +83,8 @@
     usbutils
     pciutils
     lm_sensors
+    smartmontools
+    unstable.siomon
   ];
 
   # nice to have passwordless sudo
@@ -110,6 +121,14 @@
             command = "/etc/profiles/per-user/blake/bin/nom-shell";
             options = ["NOPASSWD"];
           }
+          {
+            command = "/run/current-system/sw/bin/rsync";
+            options = ["NOPASSWD"];
+          }
+          {
+            command = "/etc/profiles/per-user/blake/bin/lf";
+            options = ["NOPASSWD"];
+          }
         ];
       }
     ];

hosts/nixos/froakie/disko.nix

@@ -1,70 +0,0 @@
-{
-  disko.devices = {
-    disk = {
-      main = {
-        type = "disk";
-        device = ""; # disk id here
-        content = {
-          type = "gpt";
-          partitions = {
-            ESP = {
-              size = "1G";
-              type = "EF00";
-              content = {
-                type = "filesystem";
-                format = "vfat";
-                mountpoint = "/boot";
-                mountOptions = [ "umask=0077" ];
-              };
-            };
-            luks = {
-              size = "100%";
-              content = {
-                type = "luks";
-                name = "crypted";
-                # disable settings.keyFile if you want to use interactive password entry
-                #passwordFile = "/tmp/secret.key"; # Interactive
-                settings = {
-                  allowDiscards = true;
-                  #keyFile = "/tmp/secret.key";
-                };
-                #additionalKeyFiles = [ "/tmp/additionalSecret.key" ];
-                content = {
-                  type = "btrfs";
-                  extraArgs = [ "-f" ];
-                  subvolumes = {
-                    "@root" = {
-                      mountpoint = "/";
-                      mountOptions = [
-                        "compress=zstd"
-                        "noatime"
-                      ];
-                    };
-                    "@home" = {
-                      mountpoint = "/home";
-                      mountOptions = [
-                        "compress=zstd"
-                        "noatime"
-                      ];
-                    };
-                    "@nix" = {
-                      mountpoint = "/nix";
-                      mountOptions = [
-                        "compress=zstd"
-                        "noatime"
-                      ];
-                    };
-                    "@swap" = {
-                      mountpoint = "/.swapvol";
-                      swap.swapfile.size = "32G";
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      };
-    };
-  };
-}

hosts/nixos/lumiose/configuration.nix

@@ -1,26 +1,30 @@
-{ config, lib, inputs, modulesPath, stable_pkgs, unstable_pkgs, ... }:
-
-let
-  pkgs = stable_pkgs.x86_64;
-  unstable = unstable_pkgs.x86_64;
-in
 {
-  imports =
-    [ # Include the results of the hardware scan.
-      (modulesPath + "/installer/scan/not-detected.nix")
-      #./hardware-configuration.nix
-      ./disko.nix
-      ../../nixos
-      ../../../users/blake
-      ../../../modules/system
-      #../../../modules/holocron
-      #../../../modules/homelab
-      #../../../modules/gameservers/minecraft_recpro
-      #../../../modules/gameservers/minecraft_modded
-    ];
+  config,
+  lib,
+  inputs,
+  modulesPath,
+  stable_pkgs,
+  unstable_pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    (modulesPath + "/installer/scan/not-detected.nix")
+    #./hardware-configuration.nix
+    ./disko.nix
+    ../../nixos
+    ../../../users/blake
+    ../../../modules/system
+    ../../../modules/fileshares/holocron
+    ../../../modules/homelab
+    #../../../modules/gameservers/srcds
+    ../../../modules/gameservers/minecraft_recpro
+    ../../../modules/gameservers/minecraft_modded
+    ../../../modules/gameservers/valheim
+  ];
 
   home-manager.users.blake.imports = [
-  ../../../users/blake/hosts/lumiose.nix
+    ../../../users/blake/hosts/lumiose.nix
   ];
 
   system = {
@@ -32,73 +36,142 @@ in
       enable = true;
       vendor = "amd";
     };
+    keepalive = {
+      enable = true;
+      url = "https://up.holocron.blue/api/push/7DAcvsedwB?status=up&msg=fuckingvibing&ping=";
+    };
+  };
+
+  homelab = {
+    enable = true;
+    base_domain = "lumiose.holocron.blue";
+    host_ip = "10.10.0.11";
+    gitea.enable = false;
+    glance.enable = true;
+    immich = {
+      enable = true;
+      data_dir = "/holocron/srv/immich";
+      backup = false;
+    };
+    vaultwarden.enable = false;
+    #searx.enable = true;
+    # home assistant
+    home.enable = true;
+    homebox.enable = true;
+    # network
+    tailscale.enable = true;
+    caddy = {
+      enable = true;
+      keys = false;
+    };
+    dnsmasq.enable = true;
+    # mediastack
+    mediastack.enable = true;
+    qbittorrent.vpn_inf = "enp34s0.69";
+    # system
+    backups.enable = true;
+    motd.enable = true;
+    msmtp.enable = true;
+    uptime-kuma.enable = true;
+    #    # ai
+    #    ollama.enable = false;
+    #    open-webui.enable = false;
+    wyoming.enable = true;
+  };
+
+  holocron = {
+    #    copyparty.enable = false;
+    syncthing.enable = true;
+    ensure_perms.enable = false;
+    offsite.enable = true;
+    zfs.enable = true;
+    smb.enable = true;
+    nfs.enable = true;
+  };
+
+  gameservers = {
+    minecraft_recpro.enable = true;
+    minecraft_modded.enable = false;
+    valheim.enable = true;
   };
 
   # boot (systemd is going on me)
-  boot.loader.systemd-boot.enable = true;   # systemd your pretty cool ya know
+  boot.loader.systemd-boot.enable = true; # systemd your pretty cool ya know
   boot.loader.efi.canTouchEfiVariables = true;
-  boot.initrd.systemd.enable = true;  # better logging
+  boot.initrd.systemd.enable = true; # better logging
 
   # setup hostname and networking stack
   services.resolved = {
     enable = true;
-    fallbackDns = [ "1.1.1.1" "9.9.9.9" ];
-    dnsovertls = "opportunistic";
+    settings = {
+      Resolve = {
+        FallbackDNS = ["1.1.1.1" "9.9.9.9"];
+        DNSOverTLS = "opportunistic";
+      };
+    };
   };
   networking = {
     hostName = "lumiose"; # hostname
-    #hostId = "";    # zfs wants this
+    hostId = "007f0200";
+    getaddrinfo = {
+      enable = true;
+      precedence = {
+        "::ffff:0:0/96" = 100;
+      };
+    };
     networkmanager = {
-      enable = true;  # the goat
+      enable = true; # the goat
       dns = "systemd-resolved"; # the backup dancer!
       ensureProfiles.profiles = {
-          #        vpn = {
-          #          ethernet.mac-address = "7a:e4:07:8d:22:76";
-          #          connection.type = "vlan";
-          #          connection.id = "vpn";
-          #          connection.interface-name = "enp89s0.69";   # or just "vpn-vlan"
-          #          vlan.interface-name = "enp89s0.69";   # or just "vpn-vlan"
-          #          vlan.parent = "enp89s0";
-          #          vlan.id = 69;
-          #          #ipv4.dns = "9.9.9.9";
-          #        };
+        vpn = {
+          ipv4 = {
+            method = "manual";
+            addresses = "10.69.0.11/24";
+            gateway = "10.69.0.1";
+          };
+          ethernet.mac-address = "02:ea:6c:3c:9f:cd";
+          connection.type = "vlan";
+          connection.id = "vpn";
+          connection.interface-name = "enp34s0.69"; # or just "vpn-vlan"
+          vlan.interface-name = "enp34s0.69"; # or just "vpn-vlan"
+          vlan.parent = "enp34s0";
+          vlan.id = 69;
+          #ipv4.dns = "9.9.9.9";
+        };
       };
     };
   };
 
-  
-
   hardware.bluetooth.enable = true;
 
-
-
   # Open ports in the firewall.
   networking.firewall.allowedTCPPorts = [
-    80      # set - http
-    111     # set - portmapper for nfs
-    139     # set - smb
-    443     # set - https
-    445     # set - cifs
+    80 # set - http
+    111 # set - portmapper for nfs
+    443 # set - https
+    137 # set - smb
+    138 # set - smb
+    139 # set - smb
+    445 # set - smb
     1198
-    1883    # set - mqtt
-    2049    # set - nfs
-    2222    # srv - syncthing
+    1883 # set - mqtt
+    2049 # set - nfs
+    2222 # srv - syncthing
+    5201 # iperf3
   ];
 
-  networking.firewall.allowedUDPPorts = [ 51820 ];
+  networking.firewall.allowedUDPPorts = [51820];
   # Or disable the firewall altogether.
   networking.firewall.enable = true;
 
   # hardware stuff
-  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod" ];
-  boot.initrd.kernelModules = [ ];
-  boot.kernelModules = [ "kvm-amd" ];
-  boot.extraModulePackages = [ ];
+  boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = ["kvm-amd"];
+  boot.kernelParams = ["ipv6.disable=1"];
+  boot.extraModulePackages = [];
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
 
-
   system.stateVersion = "25.05"; # stays here :   )
-
 }
-

hosts/nixos/lumiose/hardware-configuration.nix

@@ -1,45 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{ config, lib, pkgs, modulesPath, ... }:
-
-{
-  imports =
-    ];
-
-
-#  fileSystems."/" =
-#    { device = "/dev/mapper/crypted";
-#      fsType = "btrfs";
-#      options = [ "subvol=@root" ];
-#    };
-#
-#  boot.initrd.luks.devices."crypted".device = "/dev/disk/by-uuid/a894d58e-d54c-4df5-9d89-07785a3acd4a";
-#
-#  fileSystems."/.swapvol" =
-#    { device = "/dev/mapper/crypted";
-#      fsType = "btrfs";
-#      options = [ "subvol=@swap" ];
-#    };
-#
-#  fileSystems."/boot" =
-#    { device = "/dev/disk/by-uuid/49F6-56FB";
-#      fsType = "vfat";
-#      options = [ "fmask=0077" "dmask=0077" ];
-#    };
-#
-#  fileSystems."/home" =
-#    { device = "/dev/mapper/crypted";
-#      fsType = "btrfs";
-#      options = [ "subvol=@home" ];
-#    };
-#
-#  fileSystems."/nix" =
-#    { device = "/dev/mapper/crypted";
-#      fsType = "btrfs";
-#      options = [ "subvol=@nix" ];
-#    };
-#
-  swapDevices = [ ];
-
-}

hosts/nixos/snowbelle/configuration.nix

@@ -1,24 +1,25 @@
-{ config, lib, inputs, stable_pkgs, unstable_pkgs, ... }:
-
-let
-  pkgs = stable_pkgs.x86_64;
-  unstable = unstable_pkgs.x86_64;
-in
 {
-  imports =
-    [ # Include the results of the hardware scan.
-      ./hardware-configuration.nix
-      ../../nixos
-      ../../../users/blake
-      ../../../modules/system
-      ../../../modules/holocron
-      ../../../modules/homelab
-      ../../../modules/gameservers/minecraft_recpro
-      ../../../modules/gameservers/minecraft_modded
-    ];
+  config,
+  lib,
+  inputs,
+  stable_pkgs,
+  unstable_pkgs,
+  ...
+}: {
+  imports = [
+    # Include the results of the hardware scan.
+    ./hardware-configuration.nix
+    ../../nixos
+    ../../../users/blake
+    ../../../modules/system
+    ../../../modules/homelab
+    #../../../modules/fileshares/holocron
+    #../../../modules/gameservers/minecraft_recpro
+    ../../../modules/gameservers/minecraft_modded
+  ];
 
   home-manager.users.blake.imports = [
-  ../../../users/blake/hosts/snowbelle.nix
+    ../../../users/blake/hosts/snowbelle.nix
   ];
 
   system = {
@@ -32,72 +33,75 @@ in
     };
     keepalive = {
       enable = true;
-      url = "";
+      url = "https://up.holocron.blue/api/push/kMoYviAuCL?status=up&msg=bigchilling&ping=";
     };
   };
-  holocron = {
-    syncthing.enable = true;
-    copyparty.enable = false;
-    ensure_perms.enable = false;
-    zfs.enable = true;
-    smb.enable = true;
-    nfs.enable = true;
-  };
+  #  holocron = {
+  #    ensure_perms.enable = true;
+  #    zfs.enable = true;
+  #    smb.enable = true;
+  #    nfs.enable = true;
+  #  };
+
   homelab = {
     enable = true;
+    base_domain = "snowbelle.holocron.blue";
+    # services
+    gitea.enable = false;
+    glance.enable = false;
+    immich.enable = false;
+    vaultwarden.enable = false;
+    #searx.enable = true;
+    # home assistant
+    home.enable = false;
+    # network
     tailscale.enable = true;
-    dnsmasq.enable = true;
-    backups.enable = true;
-    motd.enable = true;
-    postfix.enable = true;
-    gitea.enable = true;
-    glance.enable = true;
-    immich.enable = true;
-    hass.enable = true;
-    jellyfin.enable = true;
-    audiobookshelf.enable = true;
-    yacreader.enable = true;
-    qbittorrent.enable = true;
-    sonarr.enable = true;
-    radarr.enable = true;
-    bazarr.enable = true;
-    prowlarr.enable = true;
-    flaresolverr.enable = true;
-    zigbee2mqtt.enable = true;
-    mosquitto.enable = true;
-    caddy.enable = true;
-    uptime-kuma.enable = true;
-    vaultwarden.enable = true;
+    caddy.enable = false;
+    dnsmasq.enable = false;
+    # mediastack
+    mediastack.enable = false;
+    # system
+    backups.enable = false;
+    motd.enable = false;
+    uptime-kuma.enable = false;
+    # ai
+    #ollama.enable = false;
+    #open-webui.enable = false;
+    wyoming.enable = false;
   };
+
   gameservers = {
-    minecraft_recpro.enable = true;
-    minecraft_modded.enable = true;
+    #    minecraft_recpro.enable = true;
+    minecraft_modded = {
+      enable = true;
+      url = "raceraskedforthisenjoyyall.recoil.pro";
+    };
   };
 
   # boot (systemd is going on me)
-  boot.loader.systemd-boot.enable = true;   # systemd your pretty cool ya know
+  boot.loader.systemd-boot.enable = true; # systemd your pretty cool ya know
   boot.loader.efi.canTouchEfiVariables = true;
-  boot.initrd.systemd.enable = true;  # better logging
+  boot.initrd.systemd.enable = true; # better logging
 
   # setup hostname and networking stack
   services.resolved = {
     enable = true;
-    fallbackDns = [ "1.1.1.1" "9.9.9.9" ];
-    dnsovertls = "opportunistic";
+    #fallbackDns = ["1.1.1.1" "9.9.9.9"];
+    settings.Resolve.DNSOverTLS = "opportunistic";
   };
   networking = {
     hostName = "snowbelle"; # hostname
-    hostId = "3e6e7055";    # zfs wants this
+    hostId = "3e6e7055"; # zfs wants this
     networkmanager = {
-      enable = true;  # the goat
+      enable = true; # the goat
       dns = "systemd-resolved"; # the backup dancer!
       ensureProfiles.profiles = {
         vpn = {
           ethernet.mac-address = "7a:e4:07:8d:22:76";
           connection.type = "vlan";
           connection.id = "vpn";
-          connection.interface-name = "enp89s0.69";   # or just "vpn-vlan"
-          vlan.interface-name = "enp89s0.69";   # or just "vpn-vlan"
+          connection.interface-name = "enp89s0.69"; # or just "vpn-vlan"
+          vlan.interface-name = "enp89s0.69"; # or just "vpn-vlan"
           vlan.parent = "enp89s0";
           vlan.id = 69;
           #ipv4.dns = "9.9.9.9";
@@ -106,54 +110,49 @@ in
     };
   };
 
-  
-
   hardware.bluetooth.enable = true;
 
-
-
   # Open ports in the firewall.
   networking.firewall.allowedTCPPorts = [
-    80      # set - http
-    111     # set - portmapper for nfs
-    139     # set - smb
-    443     # set - https
-    445     # set - cifs
+    80 # set - http
+    111 # set - portmapper for nfs
+    139 # set - smb
+    443 # set - https
+    445 # set - cifs
+    5201
     1198
-    1883    # set - mqtt
-    2049    # set - nfs
-    2222    # srv - syncthing
-    7100    # srv - jellyfin
-    7101    # srv - audiobookshelf
-    7102    # srv - yacreader
-    7103    # srv - qbittorrent
-    7104    # srv - prowlarr
-    7105    # srv - bazarr
-    7106    # srv - sonarr
-    7107    # srv - radarr
-    7120    # srv - flaresolverr
-    5701    # srv - archivebox
-    7502    # srv - kiwix
-    7567    # srv - gitea ssh
-    7700    # srv - glance
-    7701    # srv - vaultwarden
-    7702    # srv - immich
-    7703    # srv - gitea
-    7704    # srv - hass
-    7705    # srv - zigbee2mqtt
-    7901    # srv - uptime kuma
-    7902    # srv - copyparty
-    25777   # srv - minecraft
-    25565   #        ^  ^  ^
-    25566   #        |  |  |
-    25567   #        |  |  |
+    1883 # set - mqtt
+    2049 # set - nfs
+    2222 # srv - syncthing
+    7100 # srv - jellyfin
+    7101 # srv - audiobookshelf
+    7102 # srv - yacreader
+    7103 # srv - qbittorrent
+    7104 # srv - prowlarr
+    7105 # srv - bazarr
+    7106 # srv - sonarr
+    7107 # srv - radarr
+    7120 # srv - flaresolverr
+    5701 # srv - archivebox
+    7502 # srv - kiwix
+    7567 # srv - gitea ssh
+    7700 # srv - glance
+    7701 # srv - vaultwarden
+    7702 # srv - immich
+    7703 # srv - gitea
+    7704 # srv - hass
+    7705 # srv - zigbee2mqtt
+    7901 # srv - uptime kuma
+    7902 # srv - copyparty
+    25777 # srv - minecraft
+    25565 #        ^  ^  ^
+    25566 #        |  |  |
+    25567 #        |  |  |
   ];
 
-  networking.firewall.allowedUDPPorts = [ 51820 ];
+  networking.firewall.allowedUDPPorts = [51820];
   # Or disable the firewall altogether.
   networking.firewall.enable = true;
 
   system.stateVersion = "25.05"; # stays here :   )
-
 }
-

hosts/nixos/vaniville/configuration.nix

@@ -1,46 +1,60 @@
-{ config, lib, stable_pkgs, unstable_pkgs, ... }:
-
-let
-  pkgs = stable_pkgs.x86_64;
-  unstable = unstable_pkgs.x86_64;
-  vpsip4 = "100.100.1.10";
-  homelabipv4 = "10.10.0.10";
-in
 {
-  imports =
-    [
-      ./hardware-configuration.nix
-      ../../nixos
-      ../../../users/blake
-      ../../../modules/system
-      ../../../modules/homelab
-      #../../../modules/holocron
-    ];
+  config,
+  lib,
+  pkgs,
+  inputs,
+  stable_pkgs,
+  unstable_pkgs,
+  ...
+}: let
+  vpsip4 = "100.100.1.10";
+  snowbelle_ip = "10.10.0.10";
+  lumiose_ip = "10.10.0.11";
+
+  homelab = config.homelab;
+in {
+  imports = [
+    ./hardware-configuration.nix
+    ../../nixos
+    ../../../users/blake
+    ../../../modules/system
+    ../../../modules/homelab
+    #../../../modules/holocron
+  ];
 
   home-manager.users.blake.imports = [
-  ../../../users/blake/hosts/vaniville.nix
+    ../../../users/blake/hosts/vaniville.nix
   ];
 
   system = {
     tailscale.enable = false;
   };
   homelab = {
-    base_domain = "vaniville.lan";
-    host_ip = "10.10.0.11";
+    enable = true;
+    base_domain = "vaniville.holocron.blue";
+    host_ip = "100.100.1.10";
     ddns.enable = true;
-
     uptime-kuma = {
       enable = true;
-      url = "up.blakedheld.xyz";
-      backup = false;
+      url = "up.holocron.blue";
     };
     caddy = {
       enable = true;
-      backup = false;
+      keys = true;
     };
+    backups = {
+      enable = true;
+      databases = false;
+      homelab = true;
+      backup_repo = "/var/lib/backups/homelab";
+      offsite_dir = "lifeboat/vaniville/homelab";
+    };
+    gitea.enable = true;
+    vaultwarden.enable = true;
+    home.enable = false;
   };
 
-  boot = { 
+  boot = {
     loader = {
       efi.canTouchEfiVariables = true;
       grub = {
@@ -64,6 +78,16 @@ in
     sysstat
   ];
 
+  #  services.resolved = {
+  #    enable = true;
+  #    settings = {
+  #      Resolve = {
+  #        FallbackDNS = ["1.1.1.1" "9.9.9.9"];
+  #        DNSOverTLS = "opportunistic";
+  #      };
+  #    };
+  #  };
+
   # setup the network forwarding this host is designed for
   # general networking config
   networking = {
@@ -75,52 +99,63 @@ in
     # the proper way to forward ports on nixos, need to figure it out locally then try to get it working over vps
     nat = {
       enable = true;
-      externalInterface = "eth0";          # your PUBLIC_IF
-      internalInterfaces = [ "tailscale0" ];
+      externalInterface = "eth0"; # your PUBLIC_IF
+      internalInterfaces = ["tailscale0"];
       # maybe one day i will figure out the forward ports proper
       forwardPorts = [
-#        { sourcePort = 80;    destination = "10.10.0.10:80";    proto = "tcp"; } # http
-#        { sourcePort = 443;   destination = "10.10.0.10:443";   proto = "tcp"; } # https
-#        { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
-#        { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
-#        { sourcePort = 7567;  destination = "10.10.0.10:7567";  proto = "tcp"; } # git
-  
+        #        { sourcePort = 80;    destination = "10.10.0.10:80";    proto = "tcp"; } # http
+        #        { sourcePort = 443;   destination = "10.10.0.10:443";   proto = "tcp"; } # https
+        #        { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "tcp"; } # minecraft
+        #        { sourcePort = 25777; destination = "10.10.0.10:25777"; proto = "udp"; } # minecraft
+        #        { sourcePort = 7567;  destination = "10.10.0.10:7567";  proto = "tcp"; } # git
+
         # Rustdesk ports
-#        { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
-#        { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
-#        { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
-#        { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
-#        { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
-#        { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
+        #        { sourcePort = 21115; destination = "10.10.0.10:21115"; proto = "tcp"; }
+        #        { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "tcp"; }
+        #        { sourcePort = 21116; destination = "10.10.0.10:21116"; proto = "udp"; }
+        #        { sourcePort = 21118; destination = "10.10.0.10:21118"; proto = "tcp"; }
+        #        { sourcePort = 21117; destination = "10.10.0.10:21117"; proto = "tcp"; }
+        #        { sourcePort = 21119; destination = "10.10.0.10:21119"; proto = "tcp"; }
       ];
     };
-  
+
     # what actually does the forwarding
     firewall = {
       enable = true;
-      allowedTCPPorts = [ 22 80 443 25777 7567 21115 21116 21117 21118 21119 ];
+      allowedTCPPorts = [22 80 443 25777 25579 7567 21115 21116 21117 21118 21119];
       # tailscale will also need its UDP port open:
-      allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
-      trustedInterfaces = [ "tailscale0" ];
+      allowedUDPPorts = [config.services.tailscale.port 2456 2457 25777 21116 25580];
+      trustedInterfaces = ["tailscale0"];
+      /*
+      iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80        # http
+      iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${snowbelle_ip}:443      # https
+
+      iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}     # http
+      iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}    # https
+      */
+
+      #        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567    # gitea ssh
+      #        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
+
       extraCommands = ''
         # Clear any previous rules if you are iterating
         iptables -t nat -F
-    
+
         # DNAT: internet -> homelab over tailscale
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80        # http
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443      # https
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567    # gitea ssh
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777  # recpro mc
-        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777  # recpro mc
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778  # cbblemon mc
-    
+        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777  # recpro mc
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777  # recpro mc
+        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25579 -j DNAT --to-destination ${snowbelle_ip}:25579  # craftoria mc
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25580 -j DNAT --to-destination ${snowbelle_ip}:25580  # craftoria mc voice chat
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2456 -j DNAT --to-destination ${lumiose_ip}:2456     # valheim server
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2457 -j DNAT --to-destination ${lumiose_ip}:2457     # valheim server
+
         # SNAT: ensure replies go back through VPS tailscale IP
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}     # http
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}    # https
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
-        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25778 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4}  # cbblemon mc
+        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
+        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25579 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25580 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc voicechat
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2456 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # valheim server
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2457 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # valheim server
       '';
     };
   };
@@ -129,10 +164,47 @@ in
   services.tailscale = {
     enable = true;
     useRoutingFeatures = "server";
+    extraSetFlags = [
+      "--advertise-exit-node"
+    ];
   };
 
+  # forwarding for caddy
+  services.caddy = {
+    globalConfig = ''
+      auto_https ignore_loaded_certs
+    '';
+    virtualHosts = {
+      # for central uptime monitoring
+      "up.${homelab.public_domain}".extraConfig = ''
+        reverse_proxy 127.0.0.1:7901
+      '';
+      # below is basically just manually reverse proxying everything in the homelab
+      # this is instead of forwarding all 80 & 443 traffic to have more explicit
+      # publishing things to the open web
+      "media.${homelab.public_domain}".extraConfig = ''
+        reverse_proxy ${lumiose_ip}:7100
+      '';
+      "photos.${homelab.public_domain}".extraConfig = ''
+        reverse_proxy ${lumiose_ip}:7702
+      '';
+      "hass.${homelab.public_domain}".extraConfig = ''
+          reverse_proxy ${lumiose_ip}:7704 {
+          header_up Host {host}
+          header_up X-Real-IP {remote_host}
+          header_up X-Forwarded-For {remote_host}
+          header_up X-Forwarded-Proto https
+        }
+      '';
+      # now hosted on vaniville!
+      #      "pass.${homelab.public_domain}".extraConfig = ''
+      #        reverse_proxy 127.0.0.1:7701
+      #      '';
+      #      "git.${homelab.public_domain}".extraConfig = ''
+      #        reverse_proxy localhost:7703
+      #      '';
+    };
+  };
 
   system.stateVersion = "25.05"; # Did you read the comment?
-
 }
-

hosts/nixos/wsl/configuration.nix

@@ -0,0 +1,58 @@
+{ config, lib, stable_pkgs, unstable_pkgs, ... }:
+
+let
+  pkgs = stable_pkgs.x86_64;
+  unstable = unstable_pkgs.x86_64;
+in
+{
+  imports =
+    [
+      ./hardware-configuration.nix
+      ../../nixos
+      ../../../users/blake
+      ../../../modules/system
+      #../../../modules/homelab
+    ];
+
+  home-manager.users.blake.imports = [
+  ../../../users/blake/hosts/wsl.nix
+  ];
+
+  wsl = {
+    enable = true;
+    defaultUser = "blake";
+  };
+
+  system = {
+    ssh.enable = true;
+    sops.enable = true;
+  };
+
+  boot = { 
+    loader = {
+      efi.canTouchEfiVariables = true;
+      grub = {
+        enable = true;
+        forceInstall = true;
+      };
+    };
+  };
+
+  # define shell
+  programs.zsh.enable = true;
+  users.defaultUserShell = pkgs.zsh;
+
+  # packages reccomended by linode
+  environment.systemPackages = with pkgs; [
+  ];
+
+  # setup the network forwarding this host is designed for
+  # general networking config
+  networking = {
+    hostName = "zygarde"; # Define your hostname.
+  };
+
+  system.stateVersion = "25.05"; # Did you read the comment?
+
+}
+

hosts/nixos/yveltal/configuration.nix

@@ -26,7 +26,7 @@
     ssh.enable = true;
     sops.enable = true;
     yubikey.enable = true;
-    yubikey.lock_on_remove = true;
+    yubikey.lock_on_remove = false;
     tailscale.enable = true;
     syncthing.enable = true;
     flatpak.enable = true;
@@ -37,12 +37,13 @@
   };
   desktop = {
     pipewire.enable = true;
-    hypr.enable = true;
+    hypr.enable = false;
     greetd.enable = true;
+    kde.enable = true;
   };
   gaming = {
     steam.enable = true;
-    lutris.enable = true;
+    lutris.enable = false;
     proton_ge.enable = true;
     gamemode.enable = true;
     mangohud.enable = true;
@@ -62,7 +63,7 @@
   # sets the delay before hibernation for ^
   systemd.sleep.settings.Sleep = {
     HibernateDelaySec = "30m";
-    };
+  };
 
   # boot (systemd is growing on me)
   boot = {
@@ -98,8 +99,12 @@
   };
   services.resolved = {
     enable = true;
-    fallbackDns = ["1.1.1.1" "9.9.9.9"];
-    dnsovertls = "opportunistic";
+    settings = {
+      Resolve = {
+        FallbackDNS = ["1.1.1.1" "9.9.9.9"];
+        DNSOverTLS = "opportunistic";
+      };
+    };
   };
 
   hardware.bluetooth.enable = true;

modules/darwin/apps/default.nix

@@ -3,8 +3,7 @@
   config,
   lib,
   ...
-}:
-let
+}: let
   service = "apps";
   cfg = config.darwin.${service};
 in {
@@ -13,7 +12,6 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-
     #    environment.systemPackages = with pkgs; [
     #      open-webui
     #    ];
@@ -25,30 +23,40 @@ in {
         "sl"
         "cowsay"
         "apfel"
+        "yt-dlp"
+        "ffmpeg"
+        "ffmpeg-full"
       ];
       casks = [
         "gnucash"
         "utm"
         "libreoffice"
         "firefox"
+        "zen"
         "grandperspective"
         "spotify"
         "obs"
-#        "gimp"
+        "gimp"
         "audacity"
         "anki"
         "rustdesk"
         "mullvad-vpn"
         "transmission"
+        "finetune"
+        "yacreader"
+        "keepassxc"
+        "thunderbird"
+        "musicbrainz-picard"
       ];
       masApps = {
-        "pages" = 361309726 ;
+        "pages" = 361309726;
         "numbers" = 361304891;
         "keynote" = 361285480;
         "bitwarden" = 1352778147;
         "darkreader" = 1438243180;
         "ghostery" = 6504861501;
         "privacy" = 6449850851;
+        "flo" = 6529533140;
       };
     };
   };

modules/darwin/default.nix

@@ -6,6 +6,7 @@
 }: {
   imports = [
     ./tailscale
+    ./nextdns
     ./syncthing
     ./yubikey
     ./work
@@ -13,5 +14,4 @@
     ./cyber
     ./gaming
   ];
-
 }

modules/darwin/gaming/default.nix

@@ -3,8 +3,7 @@
   config,
   lib,
   ...
-}:
-let
+}: let
   service = "gaming";
   cfg = config.darwin.${service};
 in {
@@ -13,10 +12,9 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-
-#    environment.systemPackages = with pkgs; [
-#      uhhh
-#    ];
+    #    environment.systemPackages = with pkgs; [
+    #      uhhh
+    #    ];
 
     homebrew = {
       brews = [
@@ -25,8 +23,8 @@ in {
         "steam"
         "prismlauncher"
         "discord"
-        "runelite"
-        "jagex"
+        #        "runelite"
+        #        "jagex"
       ];
       masApps = {
       };

modules/darwin/nextdns/default.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  service = "nextdns";
+  cfg = config.darwin.${service};
+in {
+  options.darwin.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.${service} = {
+      enable = true;
+      arguments = [
+        "-profile 527db2"
+      ];
+    };
+  };
+}

modules/darwin/tailscale/default.nix

@@ -8,23 +8,25 @@
   service = "tailscale";
   cfg = config.darwin.${service};
 in {
-
   options.darwin.tailscale = {
     enable = lib.mkEnableOption "enables tailscale";
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale = {
-      enable = true;
-      #overrideLocalDns = true;
-      #authKeyFile = authkey_file;
-    };
+    #    services.tailscale = {
+    #      enable = true;
+    #      #overrideLocalDns = true;
+    #      #authKeyFile = authkey_file;
+    #    };
 
-    homebrew = {
-      casks = [
-        "tailscale-app"
-      ];
-    };
+    #    environment.systemPackages = with pkgs; [
+    #      tailscale-gui
+    #    ];
 
+    #    homebrew = {
+    #      casks = [
+    #        "tailscale-app"
+    #      ];
+    #    };
   };
 }

modules/darwin/work/default.nix

@@ -8,17 +8,16 @@
   service = "work";
   cfg = config.darwin.${service};
 in {
-
   options.darwin.work = {
     enable = lib.mkEnableOption "installs apps for work";
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale = {
-      enable = true;
-      #overrideLocalDns = true;
-      #authKeyFile = authkey_file;
-    };
+    #    services.tailscale = {
+    #      enable = true;
+    #      #overrideLocalDns = true;
+    #      #authKeyFile = authkey_file;
+    #    };
 
     homebrew = {
       casks = [
@@ -26,11 +25,12 @@ in {
         "microsoft-teams"
         "microsoft-office"
         "jump-desktop"
+        "wifiman"
+        "adobe-acrobat-pro"
       ];
       masApps = {
         "configurator" = 1037126344;
       };
     };
-
   };
 }

modules/desktop/default.nix

@@ -9,5 +9,6 @@
     ./hypr
     ./greetd
     ./gaming
+    ./kde
   ];
 }

modules/desktop/kde/default.nix

@@ -0,0 +1,53 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.desktop.kde;
+in {
+  options.desktop.kde = {
+    enable = lib.mkEnableOption "enable kde on nixos side";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # enable kde plasma
+    services = {
+      desktopManager.plasma6.enable = true;
+      #displayManager.sddm.enable = true;
+      #displayManager.sddm.wayland.enable = true;
+    };
+
+    environment.systemPackages = with pkgs; [
+      # KDE Utilities
+      kdePackages.discover # Optional: Software center for Flatpaks/firmware updates
+      kdePackages.kcalc # Calculator
+      kdePackages.kcharselect # Character map
+      kdePackages.kclock # Clock app
+      kdePackages.kcolorchooser # Color picker
+      kdePackages.kolourpaint # Simple paint program
+      kdePackages.ksystemlog # System log viewer
+      kdePackages.sddm-kcm # SDDM configuration module
+      kdiff3 # File/directory comparison tool
+
+      # Hardware/System Utilities (Optional)
+      kdePackages.isoimagewriter # Write hybrid ISOs to USB
+      kdePackages.partitionmanager # Disk and partition management
+      hardinfo2 # System benchmarks and hardware info
+      wayland-utils # Wayland diagnostic tools
+      wl-clipboard # Wayland copy/paste support
+      vlc # Media player
+    ];
+
+    environment.plasma6.excludePackages = with pkgs; [
+      kdePackages.elisa # Music player
+      kdePackages.kdepim-runtime # Akonadi agents
+      kdePackages.kmahjongg
+      #kdePackages.kmines
+      kdePackages.konversation # IRC client
+      kdePackages.kpat # Solitaire
+      kdePackages.ksudoku
+      kdePackages.ktorrent
+    ];
+  };
+}

modules/fileshares/holocron/default.nix

@@ -0,0 +1,26 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: {
+  # services show up in glance in reverse import order lmao
+  imports = [
+    ./nfs
+    ./smb
+    ./zfs
+    ./syncthing
+    ./offsite
+    #    ./copyparty
+    ./perms
+  ];
+
+  #  # define the groups used for backups and archives
+  #  users.users.archives = {
+  #    isSystemUser = true;
+  #    group = "archives";
+  #  };
+  #
+  #  users.groups.archives = {gid = 727;};
+}

modules/fileshares/holocron/offsite/default.nix

@@ -0,0 +1,68 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: let
+  service = "offsite";
+  cfg = config.holocron.${service};
+  sec = config.sops.secrets;
+in {
+  options.holocron.offsite = {
+    enable = lib.mkEnableOption "enables backup script for holocron fileshare";
+    paths = lib.mkOption {
+      type = with lib.types; listOf str;
+      default = [
+        "/holocron/srv"
+        "/holocron/users"
+      ];
+      description = "list of paths to backup";
+    };
+    offsite_user = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat.holocron.blue";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat/holocron";
+      description = "path to rsync offsite backups to";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.${service} = {
+      description = "holocron daily sync";
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = "root";
+        Group = "archives";
+      };
+
+      script = ''
+        ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "${pkgs.openssh}/bin/ssh -o StrictHostKeyChecking=no" \
+          ${builtins.concatStringsSep " " cfg.paths}  \
+          ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+      '';
+    };
+
+    systemd.timers.${service} = {
+      description = "timer for ${service}";
+
+      wantedBy = ["timers.target"];
+
+      timerConfig = {
+        OnCalendar = "*-*-* 05:00:00";
+        Persistent = true;
+      };
+    };
+  };
+}

modules/fileshares/holocron/smb/default.nix

@@ -0,0 +1,130 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+# define smb shares
+let
+  cfg = config.holocron.smb;
+  smb_shares = {
+    global = {
+      # time machine specifc config, must be global
+      "fruit:aapl" = "yes";
+      "fruit:nfs_aces" = "no";
+      "fruit:metadata" = "stream";
+      "fruit:model" = "TimeCapsule";
+      "fruit:posix_rename" = "yes";
+      "fruit:veto_appledouble" = "no";
+      "fruit:wipe_intentionally_left_blank_rfork" = "yes";
+      "fruit:delete_empty_adfiles" = "yes";
+      "vfs objects" = "catia fruit streams_xattr";
+      "ea support" = "yes";
+      "spotlight" = "no";
+      "multicast dns register" = "no";
+      "min protocol" = "SMB2";
+    };
+    archives = {
+      path = "/holocron/archives";
+      browseable = true;
+      writable = true;
+      guestOk = false;
+      "create mask" = "0775";
+      "directory mask" = "0775";
+    };
+    timemachine = {
+      browseable = true;
+      "path" = "/holocron/archives/timemachine";
+      "valid users" = "blake";
+      "public" = "no";
+      "writeable" = "yes";
+      "force user" = "blake";
+      # time machine specifc config
+      "fruit:time machine" = "yes";
+      "fruit:time machine max size" = "5T";
+      "case sensitive" = "yes";
+      "default case" = "lower";
+      "preserve case" = "no";
+      "short preserve case" = "no";
+      "create mask" = "0660";
+      "directory mask" = "0770";
+      "force group" = "blake";
+    };
+    users = {
+      path = "/holocron/users";
+      browseable = true;
+      writable = true;
+      guestOk = false;
+      "create mask" = "0660";
+      "directory mask" = "0770";
+    };
+    media = {
+      path = "/holocron/media";
+      browseable = true;
+      writable = true;
+      guestOk = false;
+      "create mask" = "0775";
+      "directory mask" = "0775";
+    };
+    nvr = {
+      path = "/holocron/nvr";
+      writable = true;
+      guestOk = false;
+      browseable = true;
+      "valid users" = "archives";
+      "public" = "no";
+      "writeable" = "yes";
+      "force user" = "archives";
+      # time machine specifc config
+      "create mask" = "0660";
+      "directory mask" = "0770";
+      "force group" = "archives";
+    };
+  };
+in {
+  options.holocron.smb = {
+    enable = lib.mkEnableOption "enables smb";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # enable smb with all shares
+    services.samba = {
+      enable = true;
+      package = pkgs.sambaFull;
+      settings = smb_shares;
+    };
+
+    # ensure time machine can discover the share without `tmutil`
+    services.avahi = {
+      enable = true;
+      openFirewall = true;
+      nssmdns4 = true;
+      publish.enable = true;
+      publish.userServices = true;
+      extraServiceFiles = {
+        timemachine = ''
+          <?xml version="1.0" standalone='no'?>
+          <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
+          <service-group>
+            <name replace-wildcards="yes">%h</name>
+            <service>
+              <type>_smb._tcp</type>
+              <port>445</port>
+            </service>
+              <service>
+              <type>_device-info._tcp</type>
+              <port>0</port>
+              <txt-record>model=TimeCapsule8,119</txt-record>
+            </service>
+            <service>
+              <type>_adisk._tcp</type>
+              <port>0</port>
+              <txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
+              <txt-record>sys=waMa=0,adVF=0x100</txt-record>
+            </service>
+          </service-group>
+        '';
+      };
+    };
+  };
+}

modules/fileshares/holocron/syncthing/default.nix

@@ -7,7 +7,7 @@
   service = "syncthing";
   cfg = config.holocron.${service};
   sec = config.sops.secrets;
-  url = "syncthing.snowbelle.lan";
+  url = "syncthing.${config.networking.hostName}.holocron.blue";
   homelab = config.homelab;
 in {
   options.holocron.${service} = {
@@ -23,30 +23,29 @@ in {
       guiAddress = "0.0.0.0:2222";
       openDefaultPorts = true;
       #extraFlags = ["--no-default-folder"];
-      key = sec."${service}/snowbelle/key".path;
-      cert = sec."${service}/snowbelle/cert".path;
+      key = sec."${service}/lumiose/key".path;
+      cert = sec."${service}/lumiose/cert".path;
       settings = {
         devices = {
-          "mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
+          "piplup" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
           "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
           "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
           "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
-          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
+          "CEN-IT-00007" = {id = "UEWNSUZ-AX75M5Y-OA4FURY-ORMEXFA-XUXU4LU-LEUYKVW-IDM2GQC-4UR4YAL";};
         };
         folders = {
           "holocron" = {
             path = "/holocron/users/blake/holocron";
-            devices = ["mudkip" "zygarde" "CEN-IT-07" "CEN-IT-00007"  "yveltal"];
+            devices = ["piplup" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
             id = "5voxg-c3he2";
-            versioning = {
-              type = "staggered";
-              fsPath = "/holocron/users/blake/holocron/.stversions";
-              params = {
-                cleanInterval = "3600";
-                maxAge = "0";
-              };
-            };
-
+            #            versioning = {
+            #              type = "staggered";
+            #              fsPath = "/holocron/users/blake/holocron/.stversions";
+            #              params = {
+            #                cleanInterval = "3600";
+            #                maxAge = "0";
+            #              };
+            #            };
           };
         };
         options = {
@@ -56,32 +55,35 @@ in {
     };
 
     sops.secrets = {
-      "${service}/snowbelle/key" = {
+      "${service}/lumiose/key" = {
         owner = "blake";
         group = "blake";
       };
-      "${service}/snowbelle/cert" = {
+      "${service}/lumiose/cert" = {
         owner = "blake";
         group = "blake";
       };
     };
     homelab.backups.baks = {
-      ${service} = { paths = [ config.services.syncthing.dataDir ]; };
+      ${service} = {paths = [config.services.syncthing.dataDir];};
     };
 
     services.caddy.virtualHosts."${url}" = {
       extraConfig = ''
-        tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
+        tls internal
         reverse_proxy 127.0.0.1:2222
       '';
     };
 
     # add to glance (local service)
-    homelab.glance.links.system = [{
-      title = service;
-      url = "https://${url}";
-      error-url = "http://${homelab.host_ip}:2222";
-      check-url = "http://${homelab.host_ip}:2222";
-      icon = "di:${service}"; }];
+    homelab.glance.links.system = [
+      {
+        title = service;
+        url = "https://${url}";
+        error-url = "http://${homelab.host_ip}:2222";
+        check-url = "http://${homelab.host_ip}:2222";
+        icon = "di:${service}";
+      }
+    ];
   };
 }

modules/fileshares/holocron/zfs/default.nix

@@ -0,0 +1,72 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.holocron.zfs;
+  sec = config.sops.secrets;
+in {
+  options.holocron.zfs = {
+    enable = lib.mkEnableOption "enables zfs";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # set network host id
+
+    # enable zfs support
+    boot.kernelModules = ["zfs"];
+    boot.supportedFilesystems = ["zfs"];
+    boot.zfs.forceImportRoot = false;
+    #    boot.initrd.services.zfs.enable = true;
+    #    boot.zfs.requestEncryptionCredentials = true;
+
+    # arc cache size
+    boot.kernelParams = ["zfs.zfs_arc_max=12884901888"];
+
+    # pools to import
+    boot.zfs.extraPools = ["holocron"];
+
+    # enable smart monitoring
+
+    services.smartd = {
+      enable = true;
+      autodetect = true;
+      defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
+      notifications = {
+        test = false;
+        mail = {
+          enable = true;
+          recipient = "blake";
+          sender = "alerts@blakedheld.xyz";
+        };
+      };
+    };
+
+    # enable zfs
+    services.zfs = {
+      autoScrub.enable = true;
+      autoScrub.interval = "weekly";
+      autoSnapshot = {
+        enable = true;
+        frequent = 4; # 15 min snapshots
+        hourly = 24; # hourly snapshots
+        daily = 7; # daily snapshots
+        weekly = 4; # weekly snapshots
+        monthly = 12; # monthly snapshots
+      };
+      # email notifs
+      zed = {
+        enableMail = true;
+        settings = {
+          ZED_EMAIL_ADDR = ["root" "blake"];
+          # send notification if scrub succeeds
+          ZED_NOTIFY_VERBOSE = true;
+        };
+      };
+    };
+
+    # install userspace tools for smart
+    environment.systemPackages = with pkgs; [smartmontools];
+  };
+}

modules/gameservers/cs2/default.nix

@@ -0,0 +1,162 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "cs2";
+  cfg = config.gameservers.${service};
+in {
+  options.gameservers.${service} = {
+    enable = lib.mkEnableOption "Counter Strike 2 server";
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/gameservers/cs2";
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 27015;
+    };
+    tv_port = lib.mkOption {
+      type = lib.types.int;
+      default = 27016;
+    };
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "recoil.pro CS2";
+    };
+    map = lib.mkOption {
+      type = lib.types.str;
+      default = "de_dust2";
+    };
+    max_players = lib.mkOption {
+      type = lib.types.int;
+      default = 10;
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/holocron/archives/gameservers/cs2";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.cs2 = {
+      isSystemUser = true;
+      group = "cs2";
+      home = cfg.data_dir;
+      createHome = true;
+    };
+
+    users.groups.cs2 = {};
+
+    environment.systemPackages = with pkgs; [
+      steamcmd
+      steam-run
+      rcon
+    ];
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.data_dir} 0770 cs2 cs2 -"
+      "d ${cfg.data_dir}/server 0770 cs2 cs2 -"
+    ];
+
+    environment.etc."cs2/server.cfg".text = ''
+      hostname "${cfg.hostname}"
+      sv_lan 0
+      rcon_password "$(<${config.sops.secrets."cs2/rcon".path})"
+      mp_autoteambalance 1
+      mp_limitteams 2
+    '';
+
+    systemd.services.cs2-update = {
+      description = "Update CS2 server";
+      serviceConfig = {
+        Type = "oneshot";
+        User = "cs2";
+      };
+      script = ''
+        ${pkgs.steamcmd}/bin/steamcmd \
+          +force_install_dir ${cfg.data_dir}/server \
+          +login anonymous \
+          +app_update 730 validate \
+          +quit
+      '';
+    };
+
+    systemd.services.cs2-server = {
+      description = "Counter Strike 2 Dedicated Server";
+      after = [
+        "network.target"
+        "cs2-update.service"
+      ];
+      requires = [
+        "cs2-update.service"
+      ];
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        User = "cs2";
+        Group = "cs2";
+        WorkingDirectory = "${cfg.data_dir}";
+        Restart = "always";
+        ExecStart = pkgs.writeShellScript "cs2-start" ''
+          export GSLT=$(cat ${config.sops.secrets."cs2/gslt".path})
+          exec ${pkgs.steam-run}/bin/steam-run -- \
+            ${cfg.data_dir}/server/game/bin/linuxsteamrt64/cs2 \
+            -dedicated \
+            -usercon \
+            -console \
+            -port ${toString cfg.port} \
+            -tv_port ${toString cfg.tv_port} \
+            -maxplayers_override ${toString cfg.max_players} \
+            +game_type 0 \
+            +game_mode 1 \
+            +mapgroup mg_active \
+            +map ${cfg.map} \
+            +sv_setsteamaccount "$GSLT" \
+            +exec /etc/gameserver/cs2/server.cfg
+        '';
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [cfg.port cfg.tv_port];
+    networking.firewall.allowedUDPPorts = [cfg.port cfg.tv_port];
+
+    # backups cs2 server with borg!
+    services.borgbackup.jobs.${service} = {
+      archiveBaseName = service;
+      repo = cfg.backup_repo;
+      paths = cfg.data_dir;
+      compression = "auto,zstd";
+      #preHook = "systemctl start mysql-backup.service";
+      startAt = "*-*-* *:00:00";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        hourly = 24;
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+
+    # manage secrets with sops
+    sops.secrets = {
+      "${service}/gslt" = {
+        owner = service;
+        group = service;
+      };
+      "${service}/rcon" = {
+        owner = service;
+        group = service;
+      };
+    };
+  };
+}

modules/gameservers/cs2/default.nix.test

@@ -0,0 +1,162 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "cs2";
+  cfg = config.gameservers.${service};
+in {
+  options.gameservers.${service} = {
+    enable = lib.mkEnableOption "Counter Strike 2 server";
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/gameservers/cs2";
+    };
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 27015;
+    };
+    tv_port = lib.mkOption {
+      type = lib.types.int;
+      default = 27016;
+    };
+    hostname = lib.mkOption {
+      type = lib.types.str;
+      default = "recoil.pro CS2";
+    };
+    map = lib.mkOption {
+      type = lib.types.str;
+      default = "de_dust2";
+    };
+    max_players = lib.mkOption {
+      type = lib.types.int;
+      default = 10;
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/holocron/archives/gameservers/cs2";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.cs2 = {
+      isSystemUser = true;
+      group = "cs2";
+      home = cfg.data_dir;
+      createHome = true;
+    };
+
+    users.groups.cs2 = {};
+
+    environment.systemPackages = with pkgs; [
+      steamcmd
+      steam-run
+      rcon
+    ];
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.data_dir} 0770 cs2 cs2 -"
+      "d ${cfg.data_dir}/server 0770 cs2 cs2 -"
+    ];
+
+    environment.etc."cs2/server.cfg".text = ''
+      hostname "${cfg.hostname}"
+      sv_lan 0
+      rcon_password "$(<${config.sops.secrets."cs2/rcon".path})"
+      mp_autoteambalance 1
+      mp_limitteams 2
+    '';
+
+    systemd.services.cs2-update = {
+      description = "Update CS2 server";
+      serviceConfig = {
+        Type = "oneshot";
+        User = "cs2";
+      };
+      script = ''
+        ${pkgs.steamcmd}/bin/steamcmd \
+          +force_install_dir ${cfg.data_dir}/server \
+          +login anonymous \
+          +app_update 730 validate \
+          +quit
+      '';
+    };
+
+    systemd.services.cs2-server = {
+      description = "Counter Strike 2 Dedicated Server";
+      after = [
+        "network.target"
+        "cs2-update.service"
+      ];
+      requires = [
+        "cs2-update.service"
+      ];
+      wantedBy = ["multi-user.target"];
+      serviceConfig = {
+        User = "cs2";
+        Group = "cs2";
+        WorkingDirectory = "${cfg.data_dir}/server";
+        Restart = "always";
+        ExecStart = pkgs.writeShellScript "cs2-start" ''
+          export GSLT=$(cat ${config.sops.secrets."cs2/gslt".path})
+          exec ${pkgs.steam-run}/bin/steam-run -- \
+            ${cfg.data_dir}/server/game/cs2.sh \
+            -dedicated \
+            -usercon \
+            -console \
+            -port ${toString cfg.port} \
+            -tv_port ${toString cfg.tv_port} \
+            -maxplayers_override ${toString cfg.max_players} \
+            +game_type 0 \
+            +game_mode 1 \
+            +mapgroup mg_active \
+            +map ${cfg.map} \
+            +sv_setsteamaccount "$GSLT" \
+            +exec /etc/gameserver/cs2/server.cfg
+        '';
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [cfg.port cfg.tv_port];
+    networking.firewall.allowedUDPPorts = [cfg.port cfg.tv_port];
+
+    # backups cs2 server with borg!
+    services.borgbackup.jobs.${service} = {
+      archiveBaseName = service;
+      repo = cfg.backup_repo;
+      paths = cfg.data_dir;
+      compression = "auto,zstd";
+      #preHook = "systemctl start mysql-backup.service";
+      startAt = "*-*-* *:00:00";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        hourly = 24;
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+
+    # manage secrets with sops
+    sops.secrets = {
+      "${service}/gslt" = {
+        owner = service;
+        group = service;
+      };
+      "${service}/rcon" = {
+        owner = service;
+        group = service;
+      };
+    };
+  };
+}

modules/gameservers/minecraft_modded/default.nix

@@ -8,8 +8,12 @@
   cfg = config.gameservers.${service};
   sec = config.sops.secrets;
   servers = {
-    cobblemon = {
-      data_dir = "/var/lib/gameservers/minecraft_modded/cobblemon";
+    #    cobblemon = {
+    #      data_dir = "/var/lib/gameservers/minecraft_modded/cobblemon";
+    #      start_file = "start.sh";
+    #    };
+    linggango = {
+      data_dir = "/var/lib/gameservers/minecraft_modded/linggango";
       start_file = "start.sh";
     };
   };
@@ -18,7 +22,7 @@ in {
     enable = lib.mkEnableOption "enables ${service}";
     url = lib.mkOption {
       type = lib.types.str;
-      default = "mc.recoil.pro";
+      default = "modded.recoil.pro";
       description = "set domain for ${service}";
     };
     data_dir = lib.mkOption {
@@ -36,18 +40,34 @@ in {
       default = false;
       description = "enable backups for ${service}";
     };
-    motd = lib.mkOption {
+    motd_gs = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
-      default = "velocity";
+      default = ["craftoria"];
     };
     backup_repo = lib.mkOption {
       type = lib.types.path;
-      default = "/holocron/archives/gameservers/minecraft/modded";
+      default = "/var/backup/gameservers/minecraft/modded";
       description = "path to take hourly backups to with borg!";
     };
+    offsite_user = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat.holocron.blue";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat/holocron/archives/gameservers";
+      description = "path to rsync offsite backups to";
+    };
   };
 
   config = lib.mkIf cfg.enable {
+    users.groups.minecraft = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.minecraft = lib.mkDefault {
@@ -71,13 +91,15 @@ in {
         description = "minecraft_recpro: ${name}";
         after = ["network.target"];
         wants = ["network.target"];
+        path = [pkgs.openjdk21];
         serviceConfig = {
           User = "minecraft";
           Group = "minecraft";
           WorkingDirectory = srv.data_dir;
           UMask = "0007";
-          ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx12G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true @libraries/net/neoforged/neoforge/21.1.211/unix_args.txt";
+          #ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx12G -XX:+UseG1GC -XX:+ParallelRefProcEnabled -XX:MaxGCPauseMillis=200 -XX:+UnlockExperimentalVMOptions -XX:+AlwaysPreTouch -XX:G1NewSizePercent=30 -XX:G1MaxNewSizePercent=40 -XX:G1HeapRegionSize=8M -XX:G1ReservePercent=20 -XX:G1HeapWastePercent=5 -XX:G1MixedGCCountTarget=4 -XX:InitiatingHeapOccupancyPercent=15 -XX:G1MixedGCLiveThresholdPercent=90 -XX:G1RSetUpdatingPauseTimePercent=5 -XX:SurvivorRatio=32 -XX:+PerfDisableSharedMem -XX:MaxTenuringThreshold=1 -Dusing.aikars.flags=https://mcflags.emc.gs -Daikars.new.flags=true @libraries/net/neoforged/neoforge/21.1.211/unix_args.txt";
           #ExecStart = "${srv.data_dir}/${srv.start_file}";
+          ExecStart = "${pkgs.openjdk21}/bin/java -Xms4G -Xmx24G @libraries/net/minecraftforge/forge/1.20.1-47.4.20/unix_args.txt \"$@\"";
           Restart = "on-failure";
           KillMode = "process";
         };
@@ -85,7 +107,7 @@ in {
       })
       servers;
 
-    environment.systemPackages = with pkgs; [openjdk21 mcrcon];
+    environment.systemPackages = with pkgs; [openjdk21 mcrcon borgbackup sshpass tree rsync];
 
     #    services.mysql = {
     #      enable = true;
@@ -105,22 +127,25 @@ in {
     #    };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [25778];
+    networking.firewall.allowedTCPPorts = [25579];
+    networking.firewall.allowedUDPPorts = [25580]; #voicechat
 
-    #    sops.secrets = {
-    #      "velocity_forwarding" = {
-    #        owner = "minecraft";
-    #        group = "minecraft";
-    #        path = "/var/lib/gameservers/minecraft_recpro/velocity/forwarding.secret";
-    #        mode = "0400";
-    #      };
-    #      "minecraft_recpro_db_passwd" = {
-    #        owner = "mysql";
-    #        group = "mysql";
-    #      };
-    #    };
+    sops.secrets = {
+      "borg_passwd" = {
+        owner = "root";
+        group = "root";
+      };
+      "lifeboat_rsync" = {
+        owner = "root";
+        group = "archives";
+        mode = "0440";
+      };
+    };
 
-    # backups minecraft_recpro with borg!
+    # helpful and for scripts
+    users.groups.archives = {gid = 727;};
+
+    # backups minecraft_modded with borg!
     services.borgbackup.jobs.${service} = {
       archiveBaseName = service;
       repo = cfg.backup_repo;
@@ -138,6 +163,13 @@ in {
       );
       compression = "auto,zstd";
       #preHook = "systemctl start mysql-backup.service";
+      postHook = ''
+        ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+      '';
       startAt = "*-*-* *:00:00";
       group = "archives";
       encryption.mode = "repokey-blake2";

modules/gameservers/minecraft_recpro/default.nix

@@ -49,15 +49,30 @@ in {
       default = false;
       description = "enable backups for ${service}";
     };
-    motd = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = "velocity";
+    motd_gs = lib.mkOption {
+      type = lib.types.nullOr (lib.types.listOf lib.types.str);
+      default = ["velocity" "smp" "superflat" "bento"];
     };
     backup_repo = lib.mkOption {
       type = lib.types.path;
       default = "/holocron/archives/gameservers/minecraft/recpro_stack";
       description = "path to take hourly backups to with borg!";
     };
+    offsite_user = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat.holocron.blue";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat/holocron/archives/gameservers";
+      description = "path to rsync offsite backups to";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -152,6 +167,13 @@ in {
       );
       compression = "auto,zstd";
       preHook = "systemctl start mysql-backup.service";
+      postHook = ''
+        ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+      '';
       startAt = "*-*-* *:00:00";
       group = "archives";
       encryption.mode = "repokey-blake2";

modules/gameservers/valheim/default.nix

@@ -0,0 +1,149 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  nixservice = "podman-valheim";
+  service = "valheim";
+  cfg = config.gameservers.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.gameservers.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 2456;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/gameservers/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    motd_gs = lib.mkOption {
+      type = lib.types.nullOr (lib.types.listOf lib.types.str);
+      default = ["podman-valheim"];
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "enable backups for ${service}";
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/backup/gameservers/valheim";
+      description = "path to take hourly backups to with borg!";
+    };
+    offsite_user = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat.holocron.blue";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat/holocron/archives/gameservers";
+      description = "path to rsync offsite backups to";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    virtualisation.oci-containers.containers = {
+      ${service} = {
+        image = "ghcr.io/community-valheim-tools/valheim-server";
+        autoStart = true;
+        extraOptions = [
+          "--cap-add=sys_nice"
+          "--stop-timeout=120"
+        ];
+        ports = [
+          "2456-2457:2456-2457/udp"
+          "2456:80/tcp"
+        ];
+        volumes = [
+          "${cfg.data_dir}/config:/config"
+          "${cfg.data_dir}/data:/opt/valheim"
+        ];
+        environment = {
+          SERVER_NAME = "recpro";
+          SERVER_PASS = "recoil727pro";
+          #WORLD_NAME = "";
+          STATUS_HTTP = "true";
+          TZ = homelab.tz;
+          PUID = toString config.users.users.${service}.uid;
+          PGID = toString config.users.groups.${service}.gid;
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+    networking.firewall.allowedUDPPorts = [2456 2457];
+
+    # backups valhiem with borg!
+    services.borgbackup.jobs.${service} = {
+      archiveBaseName = service;
+      repo = cfg.backup_repo;
+      paths = cfg.data_dir;
+      compression = "auto,zstd";
+      #preHook = "systemctl start mysql-backup.service";
+      postHook = ''
+        ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+      '';
+      startAt = "*-*-* *:00:00";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        hourly = 24;
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+  };
+}

modules/holocron/default.nix

@@ -1,21 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  inputs,
-  ...
-}: {
-  # services show up in glance in reverse import order lmao
-  imports = [
-    ./nfs
-    ./smb
-    ./zfs
-    ./syncthing
-    ./copyparty
-    ./perms
-  ];
-
-  # define the groups used for backups and archives
-  users.groups.archives = {gid = 727;};
-
-}

modules/holocron/smb/default.nix

@@ -1,59 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-# define smb shares
-let
-  cfg = config.holocron.smb;
-  smb_shares = {
-    archives = {
-      path = "/holocron/archives";
-      browseable = true;
-      writable = true;
-      guestOk = false;
-      "create mask" = "0775";
-      "directory mask" = "0775";
-    };
-    timemachine = {
-      browseable = true;
-      "path" = "/holocron/archives/timemachine";
-      #"valid users" = "blake";
-      "public" = "no";
-      "writeable" = "yes";
-      #"force user" = "blake";
-      "fruit:aapl" = "yes";
-      "fruit:time machine" = "yes";
-      "vfs objects" = "catia fruit streams_xattr";
-    };
-    users = {
-      path = "/holocron/users";
-      browseable = true;
-      writable = true;
-      guestOk = false;
-      "create mask" = "0660";
-      "directory mask" = "0770";
-    };
-    media = {
-      path = "/holocron/media";
-      browseable = true;
-      writable = true;
-      guestOk = false;
-      "create mask" = "0775";
-      "directory mask" = "0775";
-    };
-  };
-in {
-  options.holocron.smb = {
-    enable = lib.mkEnableOption "enables smb";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # enable smb with all shares
-    services.samba = {
-      enable = true;
-      settings = smb_shares;
-    };
-  };
-}

modules/holocron/zfs/default.nix

@@ -1,78 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.holocron.zfs;
-in {
-  options.holocron.zfs = {
-    enable = lib.mkEnableOption "enables zfs";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # set network host id
-    networking.hostId = "3e6e7055";
-
-    # enable zfs support
-    boot.kernelModules = ["zfs"];
-    boot.supportedFilesystems = ["zfs"];
-
-    # arc cache size
-    boot.kernelParams = [ "zfs.zfs_arc_max=12884901888" ];
-
-    # pools to import
-    #boot.zfs.extraPools = [ "holocron" "holocron/archives" "/holocron/media" "/holocron/users" ];
-    #boot.zfs.extraPools = [ "holocron" ];
-
-    # enable smart monitoring
-    services.smartd = { 
-      enable = true;
-      autodetect = true;
-      defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
-      notifications.mail = {
-        enable = true;
-        sender = "zfs@snowbelle.lan";
-      };
-    };
-
-    # enable zfs
-    services.zfs = {
-      autoScrub.enable = true;
-      autoScrub.interval = "weekly";
-      # email notifs
-      zed = {
-        enableMail = true;
-        settings = {
-          ZED_EMAIL_ADDR = ["root"];
-          # send notification if scrub succeeds
-          ZED_NOTIFY_VERBOSE = true;
-        };
-      };
-    };
-
-    # install userspace tools for acl's
-    environment.systemPackages = with pkgs; [smartmontools];
-
-     fileSystems."/holocron" = {
-       device = "holocron";
-       fsType = "zfs";
-       options = ["nofail"];
-     };
-     fileSystems."/holocron/archives" = {
-       device = "holocron/archives";
-       fsType = "zfs";
-       options = ["nofail"];
-     };
-     fileSystems."/holocron/users" = {
-       device = "holocron/users";
-       fsType = "zfs";
-       options = ["nofail"];
-     };
-     fileSystems."/holocron/media" = {
-       device = "holocron/media";
-       fsType = "zfs";
-       options = ["nofail"];
-     };
-  };
-}

modules/homelab/.ai/default.nix

@@ -0,0 +1,9 @@
+{ pkgs, config, lib, ... }:
+{
+  # the order determines the order in glance :3
+  imports = [
+    ./ollama
+    ./open-webui
+  ];
+
+}

modules/homelab/.ai/ollama/default.nix

@@ -0,0 +1,98 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "ollama";
+  cfg = config.homelab.${service};
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7710;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "ollama.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = lib.mkForce "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      shell = pkgs.bash;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # declare the gitea service
+    services.${service} = {
+      enable = true;
+      host = "0.0.0.0";
+      port = cfg.port;
+      openFirewall = true;
+      syncModels = true;
+      loadModels = [
+        "deepseek-r1:7b"
+        "deepseek-r1:14b"
+      ];
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+
+    services.caddy.virtualHosts."${cfg.url}" = {
+      extraConfig = ''
+        tls internal
+        reverse_proxy localhost:${toString cfg.port} {
+        }
+      '';
+    };
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
+    };
+  };
+}

modules/homelab/.ai/open-webui/default.nix

@@ -0,0 +1,104 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "open-webui";
+  cfg = config.homelab.${service};
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7711;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "ai.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = lib.mkForce "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      shell = pkgs.bash;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # declare the gitea service
+    services.${service} = {
+      enable = true;
+      host = "0.0.0.0";
+      port = cfg.port;
+      openFirewall = true;
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+
+    services.caddy.virtualHosts."${cfg.url}" = {
+      extraConfig = ''
+        tls internal
+        reverse_proxy localhost:${toString cfg.port} {
+        }
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.services = [
+      {
+        title = service;
+        url = "https://ai.${homelab.base_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
+    };
+  };
+}

modules/homelab/.default.nix.template.nix

@@ -38,6 +38,10 @@ in {
       default = true;
       description = "enable backups for ${service}";
     };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -82,8 +86,10 @@ in {
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       serverAliases = ["${service}.${homelab.public_domain}"];
+      # use explicitly defined tls cert
+      # tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
       extraConfig = ''
-        tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/homelab/.nomad/default.nix

@@ -0,0 +1,29 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.homelab.nomad;
+in {
+  options.homelab.nomad = {
+    enable = lib.mkEnableOption "enable in house project nomad";
+    tz = lib.mkOption {
+      default = "America/Chicago";
+      type = lib.types.str;
+      description = "set timezone";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # the order determines the order in glance :3
+    imports = [
+      ./kiwix
+      ./maps
+      ./kolibri
+    ];
+    homelab.kiwix.enable = lib.mkDefault true;
+    homelab.maps.enable = lib.mkDefault true;
+    homelab.kolibri.enable = lib.mkDefault true;
+  };
+}

modules/homelab/.nomad/kiwix/default.nix

@@ -0,0 +1,121 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "kiwix";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7730;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "kiwix-serve";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {
+      gid = lib.mkForce cfg.ids;
+    };
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # helpful and for scripts
+    environment.systemPackages = with pkgs; [kiwix-tools];
+
+    # enable the ${service} service
+    services.kiwix-serve = {
+      enable = true;
+      openFirewall = true;
+      port = cfg.port;
+      user = service;
+      group = service;
+      libraryPath = "${cfg.data_dir}/library.xml";
+      extraArgs = {
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      User = service;
+      Group = service;
+    };
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["${service}.${homelab.public_domain}"];
+      # use explicitly defined tls cert
+      # tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port}
+      '';
+    };
+
+    # add to glance (local service)
+    homelab.glance.links.nomad = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    #    sops.secrets = {
+    #      "${service}_" = {
+    #        owner = ;
+    #        group = ;
+    #      };
+    #    };
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {
+        paths = [cfg.data_dir];
+      };
+    };
+  };
+}

modules/homelab/backups/default.nix

@@ -1,89 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-/*
-to restore mysql/marinadb database:
-mysql -u root -p -e "DROP DATABASE IF EXISTS <database_name>;"  # delete old db if still lingering
-mysql -u root -p -e "CREATE DATABASE IF NOT EXISTS <database_name>;"  # create empty db w/ correct name
-zstd -dc <path_to_backup> | mysql -u root -p <database_name>
-
-to restore a postgres database:
-sudo -u postgres psql -c "DROP DATABASE IF EXISTS <database_name>;"   # delete old db if lingering (prolly wont work)
-sudo -u postgres psql -c "CREATE DATABASE <database_name>;"   # create empty db w/ correct name
-zstd -dc <path_to_backup> | sudo -u postgres psql -d immich   # restore from the dump
-*/
-let
-  cfg = config.homelab.backups;
-  sec = config.sops.secrets;
-in {
-  options.homelab.backups = {
-    enable = lib.mkEnableOption "enables borg backups for state files and db backup services";
-    baks = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.attrsOf (lib.types.listOf lib.types.path));
-      default = {};
-      description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
-    };
-    backup_repo = lib.mkOption {
-      type = lib.types.path;
-      default = "/holocron/archives/homelab";
-      description = "path to take daily backups to with borg!";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    # backups homelab with borg
-    services.borgbackup.jobs.homelab = lib.mkIf (cfg.baks != {}) {
-        archiveBaseName = "homelab";
-        repo = cfg.backup_repo;
-        paths = lib.flatten (lib.attrsets.mapAttrsToList (_: arg: arg.paths) cfg.baks);
-        compression = "auto,zstd";
-        startAt = "03:30";
-        group = "archives";
-        encryption.mode = "repokey-blake2";
-        encryption.passCommand = "cat ${sec."borg_passwd".path}";
-        preHook = ''
-          systemctl start mysql-backup.service
-          systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
-        '';
-        extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
-        extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
-        prune.keep = {
-          within = "1d"; # Keep all archives from the last day
-          daily = 7;
-          weekly = 12;
-          monthly = -1; # Keep at least one archive for each month
-        };
-      };
-
-    # mysql backups currently minecraft_recpro is the only thing using this
-    services.mysqlBackup = lib.mkIf (config.services.mysql.ensureDatabases != []) {
-      enable = true;
-      location = "/var/backup/mysql";
-      user = "root";
-      calendar = "daily"; # goes fast, included in back up with server dirs at **:00
-      compressionAlg = "zstd";
-      databases = config.services.mysql.ensureDatabases; # set to all databases defined in esure databases
-    };
-    # postgresql backups currently immich is the only user
-    services.postgresqlBackup = lib.mkIf (config.services.postgresql.ensureDatabases != []) {
-      enable = true;
-      location = "/var/backup/postgresql";
-      compression = "zstd"; # optional: "xz", "zstd", "none"
-      startAt = "daily"; # the dump is included in a backup taken at 4:00
-      databases = config.services.postgresql.ensureDatabases; # set to all databases defined in esure databases
-    };
-
-    # helpful and for scripts
-    environment.systemPackages = with pkgs; [borgbackup tree];
-
-    sops.secrets = {
-      "borg_passwd" = {
-        owner = "root";
-        group = "root";
-      };
-    };
-  };
-}

modules/homelab/ddns/default.nix

@@ -1,47 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.homelab.ddns;
-  token = config.sops.secrets."cloudflare/api_token".path;
-  sec = config.sops.secrets;
-in {
-  options.homelab.ddns = {
-    enable = lib.mkEnableOption "enables ddns with cloudflare";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.cloudflare-ddns = {
-      enable = true;
-      credentialsFile = token;
-      domains = [
-        # recoil.pro
-        "recoil.pro"
-        "*.recoil.pro"
-        "mc.recoil.pro"
-        "smp.recoil.pro"
-        "superflat.recoil.pro"
-        "skyblock.recoil.pro"
-        "cobblemon.recoil.pro"
-
-        # blakedheld.xyz
-        "blakedheld.xyz"
-        "*.blakedheld.xyz"
-        "git.blakedheld.xyz"
-
-      ];
-    };
-
-    # network config
-
-    # declare authkey secrets
-    sops.secrets = {
-      "cloudflare/api_token" = {
-        owner = "cloudflare-ddns";
-        group = "cloudflare-ddns";
-      };
-    };
-  };
-}

modules/homelab/default.nix

@@ -1,83 +1,53 @@
-{ pkgs, config, lib, ... }:
-
-
-let
-  cfg = config.homelab;
-in
 {
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  cfg = config.homelab;
+in {
   options.homelab = {
     enable = lib.mkEnableOption "enable homelab services and configuration";
-    media_user = lib.mkOption {
-      default = "media";
-      type = lib.types.str;
-      description = "user for media file permissions";
-    };
-    media_group = lib.mkOption {
-      default = "media";
-      type = lib.types.str;
-      description = "group for media file permissions";
-    };
     tz = lib.mkOption {
       default = "America/Chicago";
       type = lib.types.str;
       description = "set timezone";
     };
     base_domain = lib.mkOption {
-      default = "snowbelle.lan";
+      default = "lumiose.holocron.blue";
       type = lib.types.str;
       description = "base domain used for reverse proxy";
     };
     public_domain = lib.mkOption {
-      default = "blakedheld.xyz";
+      default = "holocron.blue";
       type = lib.types.str;
-      description = "base domain used for reverse proxy";
+      description = "public domain used for reverse proxy";
     };
     host_ip = lib.mkOption {
-      default = "10.10.0.10";
+      default = "10.10.0.11";
       type = lib.types.str;
-      description = "base domain used for reverse proxy";
+      description = "base ip used for reverse proxy";
     };
   };
 
   # the order determines the order in glance :3
   imports = [
-    ./motd
-    ./dnsmasq
-    ./backups
-    ./glance
-    ./postfix
-    ./caddy
-    ./home/zigbee2mqtt
-    ./vaultwarden
-    ./gitea
-    ./home/homeassistant
-    ./immich
-    ./arr/bazarr
-    ./arr/prowlarr
-    ./arr/radarr
-    ./qbittorrent
-    ./arr/sonarr
-    ./yacreader
-    ./audiobookshelf
-    ./jellyfin
-    ./arr/flaresolverr
-    ./home/mosquitto
-    ./uptime-kuma
-    ./tailscale
-    ./ddns
+    #./ai
+    ./mediastack
+    ./services
+    ./system
+    #./nomad
+    ./network
   ];
 
   config = lib.mkIf cfg.enable {
-    users = {
-      groups.${cfg.media_group} = {
-        gid = 700;
-      };
-      users.${cfg.media_user} = {
-        uid = 700;
-        isSystemUser = true;
-        group = cfg.media_group;
-      };
+    # define the groups used for backups and archives
+    users.users.archives = {
+      isSystemUser = true;
+      group = "archives";
     };
 
+    users.groups.archives = {gid = 727;};
   };
 }

modules/homelab/dnsmasq/default.nix

@@ -1,42 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  service = "dnsmasq";
-  cfg = config.homelab.${service};
-  sec = config.sops.secrets;
-  homelab = config.homelab;
-in {
-  options.homelab.${service} = {
-    enable = lib.mkEnableOption "enables ${service}";
-    port = lib.mkOption {
-      type = lib.types.int;
-      default = 53;
-      description = "set port for ${service} (default: ${toString cfg.port}";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    # enable the ${service} service
-    services.${service} = {
-      enable = true;
-      settings = {
-        listen-address = "10.10.0.10";  # your LAN IP
-        #interface = "enp89s0";
-        bind-interfaces = true;
-        address = "/snowbelle.lan/10.10.0.10";
-        server = [ # upstream dns
-          "9.9.9.9"
-          "1.1.1.1"
-        ];
-      };
-    };
-
-    # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
-    networking.firewall.allowedUDPPorts = [ cfg.port ];
-
-  };
-}

modules/homelab/mediastack/audiobookshelf/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "audiobookshelf";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,19 +44,18 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
       description = "${service} server user";
       uid = lib.mkForce cfg.ids;
       isSystemUser = true;
-#      home = cfg.data_dir;
+      #      home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
@@ -64,7 +64,7 @@ in
       openFirewall = true;
       user = service;
       group = service;
-#      dataDir = cfg.data_dir;
+      #      dataDir = cfg.data_dir;
       host = "0.0.0.0";
       port = cfg.port;
     };
@@ -72,34 +72,32 @@ in
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
-#      User = service;
-#      Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = [ "abs.${homelab.public_domain}" ];
+      #serverAliases = ["abs.${homelab.public_domain}"];
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port} {
         }
       '';
     };
 
     # add to glance public service
-    homelab.glance.links.mediastack = [{
-      title = service;
-      url = "https://abs.${homelab.public_domain}";
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://abs.${homelab.base_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/bazarr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "bazarr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,9 +44,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -55,7 +55,7 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
@@ -72,9 +72,6 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -84,16 +81,19 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
-      title = service; 
-      url = "https://${cfg.url}"; 
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
-      icon = "di:${service}"; }];
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/default.nix

@@ -0,0 +1,66 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.homelab.mediastack;
+in {
+  options.homelab.mediastack = {
+    enable = lib.mkEnableOption "enable the mediastack";
+    media_user = lib.mkOption {
+      default = "media";
+      type = lib.types.str;
+      description = "user for media file permissions";
+    };
+    media_group = lib.mkOption {
+      default = "media";
+      type = lib.types.str;
+      description = "group for media file permissions";
+    };
+    tz = lib.mkOption {
+      default = "America/Chicago";
+      type = lib.types.str;
+      description = "set timezone";
+    };
+  };
+
+  # the order determines the order in glance :3
+  imports = [
+    ./yacreader
+    ./bazarr
+    ./qbittorrent
+    ./prowlarr
+    ./lidarr
+    ./radarr
+    ./sonarr
+    ./audiobookshelf
+    ./navidrome
+    ./jellyfin
+    ./flaresolverr
+  ];
+
+  config = lib.mkIf cfg.enable {
+    users = {
+      groups.${cfg.media_group} = {
+        gid = 700;
+      };
+      users.${cfg.media_user} = {
+        uid = 700;
+        isSystemUser = true;
+        group = cfg.media_group;
+      };
+    };
+    homelab.jellyfin.enable = lib.mkDefault true;
+    homelab.yacreader.enable = lib.mkDefault true;
+    homelab.qbittorrent.enable = lib.mkDefault true;
+    homelab.bazarr.enable = lib.mkDefault true;
+    homelab.prowlarr.enable = lib.mkDefault true;
+    homelab.radarr.enable = lib.mkDefault true;
+    homelab.sonarr.enable = lib.mkDefault true;
+    homelab.lidarr.enable = lib.mkDefault true;
+    homelab.audiobookshelf.enable = lib.mkDefault true;
+    homelab.navidrome.enable = lib.mkDefault true;
+    homelab.flaresolverr.enable = lib.mkDefault true;
+  };
+}

modules/homelab/mediastack/flaresolverr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "flaresolverr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,9 +44,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -68,9 +68,6 @@ in
       Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''

modules/homelab/mediastack/jellyfin/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "jellyfin";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+  host = config.networking.hostName;
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,9 +45,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -55,12 +56,13 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" "video" "render" ];
+      extraGroups = ["media" "video" "render"];
     };
 
     # enable the ${service} service
     services.${service} = {
       enable = true;
+      package = pkgs.unstable.jellyfin;
       openFirewall = true;
       user = service;
       group = service;
@@ -72,29 +74,29 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = [ "media.${homelab.public_domain}" ];
+      serverAliases = ["media.${homelab.public_domain}"];
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{
-      title = service;
-      url = "https://media.${homelab.public_domain}";
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://media.${host}.${homelab.public_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/lidarr/default.nix

@@ -0,0 +1,108 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "lidarr";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7109;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # required
+    environment.systemPackages = with pkgs; [ffmpeg_6-headless yt-dlp];
+
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      openFirewall = true;
+      user = service;
+      group = service;
+      dataDir = cfg.data_dir;
+      settings = {
+        server.port = cfg.port;
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      #      User = service;
+      #      Group = service;
+    };
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port}
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/mediastack/navidrome/default.nix

@@ -0,0 +1,115 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "navidrome";
+  cfg = config.homelab.${service};
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7108;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "music.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      #      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      openFirewall = true;
+      user = service;
+      group = service;
+      #      plugins = [
+      #      ];
+      environmentFile = "${cfg.data_dir}/navidrome.env";
+      settings = {
+        Address = "0.0.0.0";
+        Port = cfg.port;
+        MusicFolder = "/holocron/media/music";
+        EnableInsightsCollector = false;
+        LyricsPriority = "nd-lyrics";
+        Plugins = {
+          Enabled = true;
+          #Folder = lib.mkForce "${cfg.data_dir}/plugins";
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      EnvironmentFile = "${cfg.data_dir}/navidrome.env";
+    };
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      #serverAliases = ["abs.${homelab.public_domain}"];
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port} {
+        }
+      '';
+    };
+
+    # add to glance public service
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://music.${homelab.base_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/mediastack/prowlarr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "prowlarr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,9 +44,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -55,7 +55,7 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
@@ -74,9 +74,6 @@ in
       Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -86,16 +83,21 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
-      title = service; 
-      url = "https://${cfg.url}"; 
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
-      icon = "di:${service}"; }];
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }

modules/homelab/mediastack/qbittorrent/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "qbittorrent";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -16,11 +17,11 @@ in
       default = 7103;
       description = "set port for ${service} (default: ${toString cfg.port}";
     };
-#    torrenting_port = lib.mkOption {
-#      type = lib.types.int;
-#      default = ;
-#      description = "set port for ${service} (default: ${toString cfg.port}";
-#    };
+    #    torrenting_port = lib.mkOption {
+    #      type = lib.types.int;
+    #      default = ;
+    #      description = "set port for ${service} (default: ${toString cfg.port}";
+    #    };
     url = lib.mkOption {
       type = lib.types.str;
       default = "qbit.${homelab.base_domain}";
@@ -53,11 +54,10 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-
     # ensure media dirs existence
     systemd.tmpfiles.rules = [
       "d /holocron/media/downloads 2775 qbittorrent media -"
-  ];
+    ];
 
     # declare ${service} user
     users.users.${service} = {
@@ -74,10 +74,10 @@ in
       enable = true;
       openFirewall = true;
       user = service;
-      group = lib.mkForce "media";  # override for permissions
+      group = lib.mkForce "media"; # override for permissions
       profileDir = cfg.data_dir;
       webuiPort = cfg.port;
-#      torrentingPort = cfg.torrenting_port;
+      #      torrentingPort = cfg.torrenting_port;
     };
 
     # override umask to make permissions work out
@@ -102,18 +102,6 @@ in
       iptables -A QBIT -j DROP
     '';
 
-# boilerplate for if you ever want to try to get this working again
-# ------------------------------------------------------------------------------
-#      # add systemd service to VPN network namespace
-#      vpnConfinement = {
-#        enable = true;
-#        vpnNamespace = "wgmex";
-#      };
-# ------------------------------------------------------------------------------
-
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -123,16 +111,19 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{
-      title = service;
-      url = "https://${cfg.url}";
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/radarr/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "radarr";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,12 +45,11 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-
     # required
     environment.systemPackages = with pkgs; [ffmpeg_6-headless];
-    
+
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -58,7 +59,7 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
@@ -76,13 +77,10 @@ in
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
-#      User = service;
-#      Group = service;
+      #      User = service;
+      #      Group = service;
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
@@ -92,16 +90,19 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
-      title = service; 
-      url = "https://${cfg.url}"; 
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
-      icon = "di:${service}"; }];
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/sonarr/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "sonarr";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,12 +44,11 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # required
     environment.systemPackages = with pkgs; [ffmpeg_6-headless];
 
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -58,7 +58,7 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
@@ -78,12 +78,8 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      # tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
       extraConfig = ''
         tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
@@ -91,16 +87,19 @@ in
     };
 
     # add to glance
-    homelab.glance.links.mediastack = [{ 
-      title = service; 
-      url = "https://${cfg.url}"; 
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}"; 
-      icon = "di:${service}"; }];
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/mediastack/yacreader/default.nix

@@ -1,12 +1,13 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "yacreader";
   cfg = config.homelab.${service};
-  sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,12 +44,11 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # install the binary
-    environment.systemPackages = with pkgs; [ yacreader ];
+    environment.systemPackages = with pkgs; [yacreader];
 
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -58,15 +58,15 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" ];
+      extraGroups = ["media"];
     };
 
     # enable the ${service} service
     systemd.services.${service} = {
       description = "${service} library server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-  
+      wantedBy = ["multi-user.target"];
+      after = ["network.target"];
+
       serviceConfig = {
         UMask = lib.mkForce "0007";
         User = service;
@@ -81,29 +81,31 @@ in
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
+    networking.firewall.allowedTCPPorts = [cfg.port];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port} {
         }
       '';
     };
 
-   # add to glance local service
-    homelab.glance.links.mediastack = [{
-      title = service;
-      url = "https://${cfg.url}";
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:yac-reader"; }];
+    # add to glance local service
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:yac-reader";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }
-

modules/homelab/network/caddy/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "caddy";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -16,6 +18,11 @@ in
       default = "/var/lib/${service}";
       description = "set data directory for ${service}";
     };
+    keys = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "host keys directory";
+    };
     backup = lib.mkOption {
       type = lib.types.bool;
       default = true;
@@ -28,7 +35,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
     users.groups.${service} = {};
 
@@ -48,16 +54,30 @@ in
       user = service;
       group = service;
       dataDir = cfg.data_dir;
+      package = pkgs.caddy.withPlugins {
+        plugins = [
+          "github.com/caddy-dns/cloudflare@v0.2.4"
+        ];
+        hash = "sha256-dQvk6ezY6TQ1J7PjhCXnThF/SqVgPwBO8/RXzHCY+js=";
+        # Replace with the hash from the build error the first time you build.
+      };
       email = "me@blakedheld.xyz";
+
       globalConfig = ''
         auto_https ignore_loaded_certs
+        acme_dns cloudflare {env.CLOUDFLARE_API_TOKEN}
       '';
-      
-      virtualHosts."key.${homelab.public_domain}" = {
-        extraConfig = ''
-            root * /var/www/keys
-            file_server
-        '';
+
+      # static page for hosting key files
+      virtualHosts = {
+        "keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
+          serverAliases = ["keys.${homelab.public_domain}"];
+          extraConfig = ''
+            tls internal
+            root /var/www/keys
+            file_server browse
+          '';
+        };
       };
     };
 
@@ -70,10 +90,13 @@ in
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
+      # make cloudflare token readable
+      EnvironmentFile = sec."cloudflare/api_token_caddy".path;
+      #LoadCredential = "CLOUDFLARE_API_TOKEN:${sec."cloudflare/api_token_caddy".path}";
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ 80 443 ];
+    networking.firewall.allowedTCPPorts = [80 443];
 
     sops.secrets = {
       "ssl_blakedheld_crt" = {
@@ -86,17 +109,41 @@ in
         group = "caddy";
         path = "/etc/ssl/blakedheld.xyz.key";
       };
+      "cloudflare/api_token_caddy" = {
+        owner = "caddy";
+        group = "caddy";
+      };
       "klefki_pub.asc" = {
         owner = "caddy";
         group = "caddy";
         path = "/var/www/keys/klefki_pub.asc";
       };
+      "caddy_root.crt" = {
+        owner = "caddy";
+        group = "caddy";
+        path = "/var/www/keys/caddy_root.crt";
+      };
     };
- 
+
+    environment.etc."caddy/browse.html".text = ''
+      <!DOCTYPE html>
+      <html>
+        <head>
+          <meta charset="utf-8">
+          <title>keyring</title>
+          <style>
+            footer { display: none !important; }
+          </style>
+        </head>
+        <body>
+          {{template "listing" .}}
+        </body>
+      </html>
+    '';
 
     # add to backups
-   homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/network/ddns/default.nix

@@ -0,0 +1,64 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "cloudflare-ddns";
+  cfg = config.homelab.ddns;
+  sec = config.sops.secrets;
+in {
+  options.homelab.ddns = {
+    enable = lib.mkEnableOption "enables ddns with cloudflare";
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.${service} = {
+      enable = true;
+      credentialsFile = sec."cloudflare/api_token".path;
+      domains = [
+        # recoil.pro
+        "recoil.pro"
+        "*.recoil.pro"
+        "mc.recoil.pro"
+        "smp.recoil.pro"
+        "superflat.recoil.pro"
+        "skyblock.recoil.pro"
+        "cobblemon.recoil.pro"
+        "valheim.recoil.pro"
+
+        # blakedheld.xyz
+        #"blakedheld.xyz"
+        #"*.blakedheld.xyz"
+        #"git.blakedheld.xyz"
+        #"up.blakedheld.xyz"
+
+        # holocron.blue
+        #"holocron.blue"
+        #"*.holocron.blue"
+        "git.holocron.blue"
+        "pass.holocron.blue"
+        "photos.holocron.blue"
+        "media.holocron.blue"
+        "up.holocron.blue"
+        # mc servers
+        "mine.holocron.blue"
+        "smp.holocron.blue"
+        "skyblock.holocron.blue"
+        "superflat.holocron.blue"
+      ];
+    };
+
+    # declare authkey secrets
+    sops.secrets = {
+      "cloudflare/api_token" = {
+        owner = "cloudflare-ddns";
+        group = "cloudflare-ddns";
+      };
+    };
+  };
+}

modules/homelab/network/default.nix

@@ -0,0 +1,11 @@
+{ pkgs, config, lib, ... }:
+{
+  # the order determines the order in glance :3
+  imports = [
+    ./dnsmasq
+    ./caddy
+    ./tailscale
+    ./ddns
+  ];
+
+}

modules/homelab/network/dnsmasq/default.nix

@@ -0,0 +1,59 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "dnsmasq";
+  cfg = config.homelab.${service};
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 53;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    upstream = lib.mkOption {
+      type = lib.types.str;
+      default = "10.10.0.1";
+      description = "set upstream dns server for ${service} (default: $cfg.upstream}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      alwaysKeepRunning = true;
+      settings = {
+        no-resolv = true;
+        listen-address = config.homelab.host_ip; # your LAN IP
+        #interface = "enp89s0";
+        bind-interfaces = true;
+        #        address = [
+        #          "/snowbelle.blakedheld.xyz/10.10.0.10"
+        #          "/lumiose.blakedheld.xyz/10.10.0.10"
+        #          "/bebe.blakedheld.xyz/10.10.0.1"
+        #        ];
+        server = [
+          # upstream dns
+          cfg.upstream
+        ];
+      };
+    };
+
+    systemd.services.dnsmasq.serviceConfig = {
+      RestartSec = "5s";
+      StartLimitBurst = 10;
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+    networking.firewall.allowedUDPPorts = [cfg.port];
+  };
+}

modules/homelab/network/tailscale/default.nix

@@ -4,21 +4,26 @@
   lib,
   ...
 }: let
+  service = "tailscale";
   cfg = config.homelab.tailscale;
-  authkey_file = config.sops.secrets."tailscale_authkey".path;
+  sec = config.sops.secrets;
 in {
   options.homelab.tailscale = {
     enable = lib.mkEnableOption "enables tailscale";
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "tailscaled";
+    };
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale = {
+    services.${service} = {
       enable = true;
       openFirewall = true;
       useRoutingFeatures = "both";
-      authKeyFile = authkey_file;
+      authKeyFile = sec."tailscale_authkey".path;
       extraSetFlags = [
-        "--advertise-routes=10.10.0.10/32" # advertise self
+        "--advertise-routes=${config.homelab.host_ip}/32,10.10.0.1/32,10.10.0.5/32,10.10.0.10/32" # advertise self
         "--accept-routes=false" # true is equilivant to useRoutingFeatures = "client" (breaks shit)
         "--accept-dns=true" # explicitly allow resolved
       ];

modules/homelab/services/default.nix

@@ -0,0 +1,17 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  # the order determines the order in glance :3
+  imports = [
+    ./home
+    ./glance
+    ./vaultwarden
+    ./gitea
+    ./immich
+    ./homebox
+    #./searxng
+  ];
+}

modules/homelab/services/gitea/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, nixpkgs-unstable, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "gitea";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -48,16 +50,15 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
       description = lib.mkForce "${service} server user";
       uid = lib.mkForce cfg.ids;
       isSystemUser = true;
-      shell = pkgs.bash; 
+      shell = pkgs.bash;
       home = cfg.data_dir;
       createHome = true;
       group = service;
@@ -74,17 +75,17 @@ in
       user = "gitea";
       group = "gitea";
       stateDir = cfg.data_dir;
-      appName =  "gitea";
+      appName = "gitea";
       settings = {
         server = {
           # http config
-          ROOT_URL = "https://git.blakedheld.xyz";
-          DOMAIN = "git.blakedheld.xyz";
+          ROOT_URL = "https://git.${homelab.public_domain}";
+          DOMAIN = "git.${homelab.public_domain}";
           HTTP_PORT = cfg.port;
           # local network config
           #LOCAL_ROOT_URL = "https://git.snowbelle.lan";
           ALLOW_LOCALNETWORKS = true;
-          ALLOWED_DOMAINS = "10.10.0.10";
+          ALLOWED_DOMAINS = homelab.host_ip;
           SKIP_TLS_VERIFY = true;
           # configure for system ssh (trying to use the systms on nix sucks)
           SSH_PORT = cfg.ssh_port;
@@ -100,7 +101,7 @@ in
         };
       };
       database = {
-        passwordFile = "${toString config.sops.secrets."gitea_database_password".path}";
+        passwordFile = "${toString sec."gitea_database_password".path}";
       };
     };
 
@@ -110,7 +111,7 @@ in
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port cfg.ssh_port ];
+    networking.firewall.allowedTCPPorts = [cfg.port cfg.ssh_port];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."git.${homelab.public_domain}" = {
@@ -121,20 +122,22 @@ in
     };
     services.caddy.virtualHosts."${cfg.url}" = {
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy localhost:${toString cfg.port} {
         }
       '';
     };
 
-
     # add to glance
-    homelab.glance.links.services = [{
-      title = service;
-      url = "https://git.${homelab.public_domain}";
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+    homelab.glance.links.services = [
+      {
+        title = service;
+        url = "https://git.${homelab.public_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
     # manage secrets with sops
     sops.secrets = {
@@ -146,7 +149,7 @@ in
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/services/glance/default.nix

@@ -4,23 +4,21 @@
   lib,
   ...
 }:
-
 /*
-  this is a wrapper module for glance that allows you to
-  to pass monitor entries in with nix, all declaratively!
+this is a wrapper module for glance that allows you to
+to pass monitor entries in with nix, all declaratively!
 
-          |           <8yy>            |
-          V                            V
-      # add to glance
-      homelab.glance.links.mediastack = [{
-        title = service;
-        url = "https://${cfg.url}";
-        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-        icon = "di:${service}";
-        allow-insecure = true; }];
+        |           <8yy>            |
+        V                            V
+    # add to glance
+    homelab.glance.links.mediastack = [{
+      title = service;
+      url = "https://${cfg.url}";
+      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+      icon = "di:${service}";
+      allow-insecure = true; }];
 */
-
 let
   service = "glance";
   cfg = config.homelab.${service};
@@ -29,8 +27,7 @@ let
 
   uptimekuma_url = "localhost:7901";
   uptimekuma_page = "glance";
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -67,24 +64,28 @@ in
     links = {
       services = lib.mkOption {
         type = lib.types.listOf lib.types.attrs;
-        default = [ ];
+        default = [];
         description = "list of links for ${service}";
       };
       mediastack = lib.mkOption {
         type = lib.types.listOf lib.types.attrs;
-        default = [ ];
+        default = [];
         description = "list of links for ${service}";
       };
       system = lib.mkOption {
         type = lib.types.listOf lib.types.attrs;
-        default = [ ];
+        default = [];
+        description = "list of links for ${service}";
+      };
+      network = lib.mkOption {
+        type = lib.types.listOf lib.types.attrs;
+        default = [];
         description = "list of links for ${service}";
       };
     };
   };
 
   config = lib.mkIf cfg.enable {
-
     # declare ${service} group
     users.groups.${service} = {
       gid = lib.mkForce cfg.ids;
@@ -98,7 +99,7 @@ in
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ ];
+      extraGroups = [];
     };
 
     services.${service} = {
@@ -120,12 +121,13 @@ in
           };
         };
         branding = {
+          #logo-url = "/assets/icons/${config.networking.hostName}.png";
           logo-url = "/assets/icons/snowbelle.png";
           favicon-url = "/assets/icons/favicon.ico";
         };
         pages = [
           {
-            name = "snowbelle";
+            name = config.networking.hostName;
             hide-desktop-navigation = true;
             columns = [
               {
@@ -140,13 +142,25 @@ in
                     servers = [
                       {
                         type = "local";
-                        name = "snowbelle";
+                        name = config.networking.hostName;
                         hide-mountpoints-by-default = true;
                         mountpoints = {
-                          "/" = {name = "root"; hide = false;};
-                          "/holocron" = {name = "holocron"; hide = false;};
-                          "/holocron/media" = {name = "media"; hide = false;};
-                          "/holocron/vault" = {name = "vault"; hide = false;};
+                          "/" = {
+                            name = "root";
+                            hide = false;
+                          };
+                          "/holocron" = {
+                            name = "holocron";
+                            hide = false;
+                          };
+                          "/holocron/media" = {
+                            name = "media";
+                            hide = false;
+                          };
+                          "/holocron/vault" = {
+                            name = "vault";
+                            hide = false;
+                          };
                         };
                       }
                     ];
@@ -203,17 +217,17 @@ in
                       {
                         title = "nixos options";
                         shortcut = "!no";
-                        url = "https://search.nixos.org/options?channel=25.05&query={QUERY}";
+                        url = "https://search.nixos.org/options?channel=26.05&query={QUERY}";
                       }
                       {
                         title = "nixos packages";
                         shortcut = "!np";
-                        url = "https://search.nixos.org/packages?channel=25.05&query={QUERY}";
+                        url = "https://search.nixos.org/packages?channel=26.05&query={QUERY}";
                       }
                       {
                         title = "home-manager options";
                         shortcut = "!hm";
-                        url = "https://home-manager-options.extranix.com/?query={QUERY}&release=release-25.05";
+                        url = "https://home-manager-options.extranix.com/?query={QUERY}&release=release-26.05";
                       }
                     ];
                   }
@@ -235,6 +249,12 @@ in
                     title = "system";
                     sites = cfg.links.system;
                   }
+                  {
+                    type = "monitor";
+                    cache = "1m";
+                    title = "network";
+                    sites = cfg.links.network;
+                  }
                   {
                     type = "custom-api";
                     title = "recpro";
@@ -242,13 +262,13 @@ in
                     cache = "5s";
                     template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
                   }
-                  {
-                    type = "custom-api";
-                    title = "cobblemon";
-                    url = "https://api.mcstatus.io/v2/status/java/cobblemon.recoil.pro";
-                    cache = "5s";
-                    template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
-                  }
+                  #                  {
+                  #                    type = "custom-api";
+                  #                    title = "linggango";
+                  #                    url = "https://api.mcstatus.io/v2/status/java/raceraskedforthisenjoyyall.recoil.pro";
+                  #                    cache = "5s";
+                  #                    template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
+                  #                  }
                 ];
               }
               {
@@ -314,7 +334,7 @@ in
     services.caddy.virtualHosts."${cfg.url}" = {
       #      serverAliases = [ "${homelab.public_domain}" ];
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };
@@ -322,17 +342,88 @@ in
     # add to backups
     homelab.backups.baks = {
       ${service} = {
-        paths = [ cfg.data_dir ];
+        paths = [cfg.data_dir "/var/lib/private"];
       };
     };
 
+    # add to vaniville services to glance
+    homelab.glance.links.services = [
+      {
+        title = "vaultwarden";
+        url = "https://pass.${homelab.public_domain}";
+        error-url = "https://pass.vaniville.${homelab.public_domain}";
+        check-url = "https://pass.${homelab.public_domain}";
+        icon = "di:vaultwarden";
+      }
+      {
+        title = "gitea";
+        url = "https://git.${homelab.public_domain}";
+        error-url = "https://git.vaniville.${homelab.public_domain}";
+        check-url = "https://git.${homelab.public_domain}";
+        icon = "di:gitea";
+      }
+    ];
+
+    homelab.glance.links.system = [
+      {
+        title = "vaniville uptime";
+        url = "https://up.${homelab.public_domain}";
+        error-url = "https://up.vaniville.${homelab.public_domain}";
+        check-url = "https://up.${homelab.public_domain}";
+        icon = "di:uptime-kuma";
+      }
+    ];
+
     # add to udr to glance
-    homelab.glance.links.system = [{
-      title = "bebe";
-      url = "https://bebe.lan";
-      error-url = "https://10.10.0.1";
-      check-url = "https://10.10.0.1";
-      icon = "di:unifi";
-      allow-insecure = true; }];
+    homelab.glance.links.network = [
+      {
+        title = "shauna";
+        url = "https://shauna.holocron.blue";
+        error-url = "https://10.0.0.1";
+        check-url = "https://10.0.0.1";
+        icon = "di:unifi";
+        allow-insecure = true;
+      }
+      {
+        title = "lifeboat";
+        url = "https://lifeboat.holocron.blue";
+        error-url = "https://100.101.11.5";
+        check-url = "https://100.101.11.5";
+        icon = "di:unifi";
+        allow-insecure = true;
+      }
+      {
+        title = "korrina";
+        url = "https://korrina.holocron.blue";
+        error-url = "https://100.101.11.1";
+        check-url = "https://100.101.11.1";
+        icon = "di:unifi";
+        allow-insecure = true;
+      }
+      {
+        title = "linode";
+        url = "https://cloud.linode.com/linodes";
+        error-url = "https://status.linode.com";
+        check-url = "https://cloud.linode.com/linodes";
+        icon = "di:linode";
+        allow-insecure = true;
+      }
+      {
+        title = "tailscale";
+        url = "https://console.tailscale.com/admin/machines";
+        error-url = "https://status.tailscale.com/";
+        check-url = "https://console.tailscale.com/admin/machines";
+        icon = "di:tailscale";
+        allow-insecure = true;
+      }
+      {
+        title = "nextdns";
+        url = "https://my.nextdns.io";
+        error-url = "https://test.nextdns.io";
+        check-url = "https://my.nextdns.io/527db2/setup";
+        icon = "di:nextdns";
+        allow-insecure = true;
+      }
+    ];
   };
 }

modules/homelab/services/home/default.nix

@@ -0,0 +1,27 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.homelab.home;
+in {
+  options.homelab.home = {
+    enable = lib.mkEnableOption "enable the smarthome stack";
+  };
+
+  # the order determines the order in glance :3
+  imports = [
+    ./zigbee2mqtt
+    ./mosquitto
+    ./homeassistant
+    ./wyoming
+  ];
+
+  config = lib.mkIf cfg.enable {
+    homelab.hass.enable = lib.mkDefault true;
+    homelab.mosquitto.enable = lib.mkDefault true;
+    homelab.zigbee2mqtt.enable = lib.mkDefault true;
+    homelab.wyoming.enable = lib.mkDefault true;
+  };
+}

modules/homelab/services/home/homeassistant/default.nix

@@ -1,13 +1,16 @@
-{ pkgs, config, lib, inputs, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
   nixservice = "home-assistant";
   service = "hass";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -44,9 +47,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -71,10 +73,6 @@ in
         volumes = [
           "${cfg.data_dir}:/config"
         ];
-#        ports = [
-#          "0.0.0.0:7704:8123"
-#          "0.0.0.0:4141:4141"
-#        ];
         environment = {
           TZ = homelab.tz;
           PUID = toString config.users.users.${service}.uid;
@@ -89,34 +87,42 @@ in
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port 8123 ];
+    networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064];
+    networking.firewall.allowedUDPPorts = [5353];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = [ "${service}.${homelab.public_domain}" ];
+      serverAliases = ["${service}.${homelab.public_domain}"];
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
-        reverse_proxy 127.0.0.1:${toString cfg.port}
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port} {
+
+        header_up Host {host}
+        header_up X-Real-IP {remote_host}
+        header_up X-Forwarded-For {remote_host}
+        header_up X-Forwarded-Proto https
+
+        }
       '';
     };
 
     # add to glance
-    homelab.glance.links.services = [{
-      title = "home assistant";
-      url = "https://hass.${homelab.public_domain}";
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${nixservice}"; }];
+    homelab.glance.links.services = [
+      {
+        title = "home assistant";
+        url = "https://hass.${homelab.public_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${nixservice}";
+      }
+    ];
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }
-
-
-
 # here lies my tough, and I mean fucking tough, swing at
 # getting this to work bare metal, ggs ill see you again
 # - didnt take long
@@ -158,4 +164,3 @@ in
 ##      };
 #    };
 
-

modules/homelab/services/home/mosquitto/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "mosquitto";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,9 +45,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -65,15 +66,16 @@ in
         port = 1883;
         address = "0.0.0.0";
         users.zigbee = {
-          acl = [ "readwrite #" ];
+          acl = ["readwrite #"];
           hashedPassword = "$7$101$140powz2MtsRawFT$ydndjal9wCAywIWtUEAh/IusdfDFvnHMupTFjdS7Ad/EjsEIbJgHrLY9waCe4Z3142XieuxMrXUDjMTp2qwyiw==";
         };
         # use with no auth
-#        settings.allow_anonymous = true;
-#        acl = [ "pattern readwrite #" ];
-#        omitPasswordAuth = true;
+        #        settings.allow_anonymous = true;
+        #        acl = [ "pattern readwrite #" ];
+        #        omitPasswordAuth = true;
       }
     ];
+
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
@@ -82,7 +84,7 @@ in
     };
 
     # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
+    networking.firewall.allowedTCPPorts = [cfg.port];
 
     sops.secrets = {
       "${service}_hashed_passwd" = {
@@ -93,7 +95,7 @@ in
 
     # add to backups
     homelab.backups.baks = {
-     ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/services/home/wyoming/default.nix

@@ -0,0 +1,56 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "wyoming";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    faster_whisper_port = lib.mkOption {
+      type = lib.types.int;
+      default = 7706;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    piper_port = lib.mkOption {
+      type = lib.types.int;
+      default = 7707;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # enable the ${service} service
+    services.${service} = {
+      faster-whisper = {
+        servers = {
+          vanessa = {
+            enable = true;
+            language = "en";
+            uri = "tcp://0.0.0.0:${toString cfg.faster_whisper_port}";
+            model = "medium";
+            device = "auto";
+          };
+        };
+      };
+      piper = {
+        servers = {
+          vanessa = {
+            enable = true;
+            uri = "tcp://0.0.0.0:${toString cfg.piper_port}";
+            voice = "en_US-amy-medium";
+          };
+        };
+      };
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.faster_whisper_port cfg.piper_port];
+  };
+}

modules/homelab/services/home/zigbee2mqtt/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "zigbee2mqtt";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,9 +45,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -63,28 +64,29 @@ in
       enable = true;
       dataDir = cfg.data_dir;
       settings = {
-          mqtt = {
-            base_topic = "zigbee2mqtt";
-            client_id = "zigbee2mqtt";
-            server = "mqtt://localhost:1883";
-            user = "!/run/secrets/mosquitto_passwd.yaml user";
-            password = "!/run/secrets/mosquitto_passwd.yaml password";
-            keepalive = 20;
-          };
-          serial = {
-            port = "/dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_4a4e75d63653ef1198d728e0174bec31-if00-port0";
-            adapter = "ember";
-          };
-          advanced = {
-            channel = 11;
-          };
-          frontend = {
-            enabled = true;
-            port = cfg.port;
-          };
-          homeassistant = {
-            enabled = true;      
-          };
+        mqtt = {
+          base_topic = "zigbee2mqtt";
+          client_id = "zigbee2mqtt";
+          server = "mqtt://localhost:1883";
+          user = "!/run/secrets/mosquitto_passwd.yaml user";
+          password = "!/run/secrets/mosquitto_passwd.yaml password";
+          keepalive = 20;
+        };
+        serial = {
+          port = "/dev/serial/by-id/usb-Itead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_V2_4a4e75d63653ef1198d728e0174bec31-if00-port0";
+          adapter = "ember";
+        };
+        advanced = {
+          channel = 11;
+        };
+        frontend = {
+          enabled = true;
+          port = cfg.port;
+        };
+        homeassistant = {
+          enabled = true;
+          experimental_event_entities = true;
+        };
       };
     };
 
@@ -95,25 +97,28 @@ in
       Group = service;
     };
 
-#    # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
+    #    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = [ "z2m.${homelab.public_domain}" ];
+      serverAliases = ["z2m.${homelab.public_domain}"];
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };
 
     # add to glance
-    homelab.glance.links.services = [{
-      title = service;
-      url = "https://${cfg.url}";
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+    homelab.glance.links.services = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
     sops.secrets = {
       "mosquitto_passwd.yaml" = {
@@ -124,7 +129,7 @@ in
 
     # add to backups
     homelab.backups.baks = {
-     ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {paths = [cfg.data_dir];};
     };
   };
 }

modules/homelab/services/homebox/default.nix

@@ -2,23 +2,20 @@
   pkgs,
   config,
   lib,
-  inputs,
   ...
 }: let
-  service = "copyparty";
-  cfg = config.holocron.${service};
+  service = "homebox";
+  cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
 in {
-  imports = [inputs.copyparty.nixosModules.default];
-
-  options.holocron.${service} = {
+  options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
     # set port options
     port = lib.mkOption {
       type = lib.types.int;
-      default = 7902;
+      default = 7709;
       description = "set port for ${service} (default: ${toString cfg.port}";
     };
     url = lib.mkOption {
@@ -41,10 +38,13 @@ in {
       default = true;
       description = "enable backups for ${service}";
     };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
   };
 
   config = lib.mkIf cfg.enable {
-    nixpkgs.overlays = [inputs.copyparty.overlays.default];
     # declare ${service} group
     users.groups.${service} = {
       gid = lib.mkForce cfg.ids;
@@ -58,7 +58,6 @@ in {
       home = cfg.data_dir;
       createHome = true;
       group = service;
-      extraGroups = [ "media" "blake" "archives" ];
     };
 
     # enable the ${service} service
@@ -67,73 +66,39 @@ in {
       user = service;
       group = service;
       settings = {
-        i = "0.0.0.0";
-        p = [7902];
-        rproxy = 1;
-      };
-      accounts = {
-        blake = {
-          passwordFile = sec."copyparty_passwd".path;
-        };
-      };
-      groups = {
-        media = ["blake"];
-      };
-      volumes = {
-        "/archives" = {
-          path = "/holocron/archives";
-          access = {
-            r = "*";
-            A = "blake";
-          };
-          flags = {
-            chmod_f = 660;
-            chmod_d = 770;
-            #gid = ?;
-          };
-        };
-        "/media" = {
-          path = "/holocron/media";
-          access = {
-            r = "*";
-            w = "@media";
-            A = "blake";
-          };
-          flags = {
-            chmod_f = 660;
-            chmod_d = 770;
-            gid = "700";
-          };
-        };
-        "/users/blake" = {
-          path = "/holocron/users/blake";
-          access = {
-            A = "blake";
-          };
-          flags = {
-            chmod_f = 660;
-            chmod_d = 770;
-            gid = "1000";
-          };
-        };
+        HBOX_WEB_PORT = toString cfg.port;
+        HBOX_STORAGE_CONN_STRING = "file://${cfg.data_dir}";
+        HBOX_STORAGE_PREFIX_PATH = "data";
+        HBOX_DATABASE_DRIVER = "sqlite3";
+        HBOX_DATABASE_SQLITE_PATH = "${cfg.data_dir}/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
+        HBOX_OPTIONS_ALLOW_REGISTRATION = "false";
+        HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
+        HBOX_MODE = "production";
+        HOME = cfg.data_dir;
+        TMPDIR = "${cfg.data_dir}/tmp";
       };
     };
 
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      User = service;
+      Group = service;
+    };
+
     # open firewall
     networking.firewall.allowedTCPPorts = [cfg.port];
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = ["${service}.${homelab.public_domain}"];
       extraConfig = ''
-        tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
-        reverse_proxy 127.0.0.1:${toString cfg.port} {
-        }
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };
 
     # add to glance (local service)
-    homelab.glance.links.system = [
+    homelab.glance.links.services = [
       {
         title = service;
         url = "https://${cfg.url}";
@@ -142,13 +107,14 @@ in {
         icon = "di:${service}";
       }
     ];
-
-    sops.secrets = {
-      "${service}_passwd" = {
-        owner = service;
-        group = service;
-      };
-    };
+    #---------------------------------------------------------------------------
+    #
+    #    sops.secrets = {
+    #      "${service}_" = {
+    #        owner = ;
+    #        group = ;
+    #      };
+    #    };
 
     # add to backups
     homelab.backups.baks = {

modules/homelab/services/immich/default.nix

@@ -44,6 +44,11 @@ in {
       type = lib.types.nullOr lib.types.str;
       default = "immich-server";
     };
+    library_sync_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/holocron/users/blake/pictures/library";
+      description = "set directory to automatically rsync library to storage pool";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -65,7 +70,7 @@ in {
     services.${service} = {
       enable = true;
       #package = inputs.nixpkgs-unstable.legacyPackages.${pkgs.system}.immich;
-      package = unstable_pkgs.x86_64.immich;
+      package = pkgs.unstable.immich;
       openFirewall = true;
       user = service;
       group = service;
@@ -73,9 +78,33 @@ in {
       host = "0.0.0.0";
       port = cfg.port;
       settings = null;
-      #settings.server.externalDomain = "https://photos.blakedheld.xyz";
     };
 
+    # too lazy to add an option, this is on the storage pool now anyway
+    #    systemd.services.immich_library_sync = {
+    #      description = "twice daily sync immich library to holocron";
+    #      serviceConfig = {
+    #        Type = "oneshot";
+    #        User = "root";
+    #      };
+    #
+    #      script = ''
+    #        ${pkgs.rsync}/bin/rsync -avh --info=progress2 --delete \
+    #          --chown=blake:blake \
+    #          /var/lib/immich/library/blake/ \
+    #          /holocron/users/blake/pictures/library/
+    #      '';
+    #    };
+    #
+    #    systemd.timers.immich_library_sync = {
+    #      wantedBy = ["timers.target"];
+    #      timerConfig = {
+    #        OnBootSec = "5m";
+    #        OnUnitActiveSec = "12h";
+    #        Persistent = true;
+    #      };
+    #    };
+
     # override umask to make permissions work out
     #    systemd.services."${toString service}-server".serviceConfig = {
     #      UMask = lib.mkForce "0007";
@@ -91,7 +120,7 @@ in {
     services.caddy.virtualHosts."${cfg.url}" = {
       serverAliases = ["photos.${homelab.public_domain}"];
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
+        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };
@@ -108,13 +137,12 @@ in {
     ];
 
     # add postgresql database that is automatically created to the backup list
-    #services.postgresqlBackup.databases = ["immich"]; # set to all databases defined in esure databases
-
     services.postgresql.ensureDatabases = [service]; # set to all databases defined in esure databases
 
     # add to backups
     homelab.backups.baks = {
-      ${service} = {paths = [cfg.data_dir "/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];};
+      ${service} = {paths = ["/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];};
+      #${service} = {paths = [cfg.data_dir "/var/lib/redis-immich" "/var/backup/postgresql/immich.sql.zstd"];};
     };
   };
 }

modules/homelab/services/radicale/default.nix

@@ -0,0 +1,122 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "radicale";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7705;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "cal.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {
+      gid = lib.mkForce cfg.ids;
+    };
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      #      User = service;
+      #      Group = service;
+    };
+
+    #    # open firewall
+    #    networking.firewall.allowedTCPPorts = [ cfg.port ];
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["${service}.${homelab.public_domain}"];
+      # use explicitly defined tls cert
+      # tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port}
+      '';
+    };
+
+    #---------------------------------------------------------------------------
+    #    # add to glance (public service)
+    #    homelab.glance.links.<category> = [{
+    #      title = service;
+    #      url = "https://${service}.${homelab.public_domain}";
+    #      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+    #      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+    #      icon = "di:${service}"; }];
+    #---------------------------------------------------------------------------
+    #    # add to glance (local service)
+    #    homelab.glance.links.<category> = [{
+    #      title = service;
+    #      url = "https://${cfg.url}";
+    #      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+    #      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+    #      icon = "di:${service}"; }];
+    #---------------------------------------------------------------------------
+    #
+    #    sops.secrets = {
+    #      "${service}_" = {
+    #        owner = ;
+    #        group = ;
+    #      };
+    #    };
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {
+        paths = [cfg.data_dir];
+      };
+    };
+  };
+}

modules/homelab/services/searxng/default.nix

@@ -0,0 +1,115 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "searx";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7709;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "search.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = lib.mkForce "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      shell = pkgs.bash;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # declare the gitea service
+    services.${service} = {
+      enable = true;
+      settings = {
+        server.port = cfg.port;
+        server.bind_address = "0.0.0.0";
+        #server.secret_key = "$SEARX_SECRET_KEY";
+        engines = [
+        ];
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+
+    services.caddy.virtualHosts."${cfg.url}" = {
+      extraConfig = ''
+        tls internal
+        reverse_proxy localhost:${toString cfg.port} {
+        }
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.services = [
+      {
+        title = service;
+        url = "https://search.${homelab.public_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    # manage secrets with sops
+    sops.secrets = {
+      "${service}_database_password" = {
+        owner = service;
+        group = service;
+      };
+    };
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/services/vaultwarden/default.nix

@@ -0,0 +1,116 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "vaultwarden";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+  domain = "https://pass.holocron.blue";
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7701;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "pass.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # enable the vaultwarden service
+    services.${service} = {
+      enable = true;
+      package = pkgs.unstable.vaultwarden;
+      config = {
+        DOMAIN = "pass.${homelab.public_domain}";
+        IP_HEADER = "X-Forwarded-For";
+        ROCKET_ADDRESS = "0.0.0.0";
+        ROCKET_PORT = cfg.port;
+        SIGNUPS_ALLOWED = true;
+        ADMIN_TOKEN = "$argon2id$v=19$m=19456,t=2,p=1$YXJKa0ZubE9OZkp5c0NlMC95TFhBcFh3K1VsUkk1bElTSFJkbmdYdmp4az0$bsLT8/18BmexUbzqlHp0S4aoIxi6bYxl0IY0EweF5N4";
+        EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "ssh-key-vault-item";
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {UMask = lib.mkForce "0007";};
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["pass.${homelab.public_domain}"];
+      #tls internal
+      extraConfig = ''
+        reverse_proxy 127.0.0.1:${toString cfg.port}
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.services = [
+      {
+        title = service;
+        url = "https://pass.${homelab.public_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    sops.secrets = {
+      "${service}_admin_token" = {
+        owner = "${service}";
+        group = "${service}";
+      };
+    };
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/services/wger/default.nix

@@ -0,0 +1,125 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  nixservice = "wger";
+  service = "wger";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7707;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "podman-wger";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # still suss as fuck bro man fuck
+    virtualisation.oci-containers.containers = {
+      hass = {
+        image = "homeassistant/home-assistant:stable";
+        autoStart = true;
+        extraOptions = [
+          "--pull=newer"
+          "--network=host"
+        ];
+        volumes = [
+          "${cfg.data_dir}:/config"
+        ];
+        environment = {
+          TZ = homelab.tz;
+          PUID = toString config.users.users.${service}.uid;
+          PGID = toString config.users.groups.${service}.gid;
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064];
+    networking.firewall.allowedUDPPorts = [5353];
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["${service}.${homelab.public_domain}"];
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port} {
+
+        header_up Host {host}
+        header_up X-Real-IP {remote_host}
+        header_up X-Forwarded-For {remote_host}
+        header_up X-Forwarded-Proto https
+
+        }
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.services = [
+      {
+        title = "wger";
+        url = "https://hass.${homelab.public_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${nixservice}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/system/backups/default.nix

@@ -0,0 +1,141 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+/*
+to restore mysql/marinadb database:
+mysql -u root -p -e "DROP DATABASE IF EXISTS <database_name>;"  # delete old db if still lingering
+mysql -u root -p -e "CREATE DATABASE IF NOT EXISTS <database_name>;"  # create empty db w/ correct name
+zstd -dc <path_to_backup> | mysql -u root -p <database_name>
+
+to restore a postgres database:
+sudo -u postgres psql -c "DROP DATABASE IF EXISTS <database_name>;"   # delete old db if lingering (prolly wont work)
+sudo -u postgres psql -c "CREATE DATABASE <database_name>;"   # create empty db w/ correct name
+zstd -dc <path_to_backup> | sudo -u postgres psql -d <database_name>  # restore from the dump
+*/
+let
+  cfg = config.homelab.backups;
+  sec = config.sops.secrets;
+  host = config.networking.hostName;
+in {
+  options.homelab.backups = {
+    enable = lib.mkEnableOption "enables borg backups for state files and db backup services";
+    baks = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.attrsOf (lib.types.listOf lib.types.path));
+      default = {};
+      description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
+    };
+    databases = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "if databases are present, runs dumps";
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/holocron/archives/servers/${host}/homelab";
+      description = "path to take daily backups to with borg!";
+    };
+    offsite = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "bool to control weather or not the repo is backed up offsite";
+    };
+    homelab = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "bool to control weather or not the repo is backed up to homelab";
+    };
+    offsite_user = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat.holocron.blue";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat/holocron/archives";
+      description = "path to rsync offsite backups to";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # backups homelab with borg
+    services.borgbackup.jobs.homelab = lib.mkIf (cfg.baks != {}) {
+      archiveBaseName = "homelab";
+      repo = cfg.backup_repo;
+      paths = lib.flatten (lib.attrsets.mapAttrsToList (_: arg: arg.paths) cfg.baks);
+      compression = "auto,zstd";
+      startAt = "03:30";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${sec."borg_passwd".path}";
+      preHook = lib.mkIf cfg.databases ''
+        systemctl start mysql-backup.service
+        systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
+      '';
+      postHook = lib.mkIf (cfg.offsite || cfg.homelab) ''
+        ${lib.optionalString cfg.offsite ''
+          ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
+            ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+            -e "ssh -o StrictHostKeyChecking=no" \
+            ${toString cfg.backup_repo} \
+            ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+        ''}
+        ${lib.optionalString cfg.homelab ''
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -i /home/blake/.ssh/id_vaniville -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          blake@lumiose:/holocron/archives/servers/vaniville
+        ''}
+      '';
+
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+
+    # mysql backups currently minecraft_recpro is the only thing using this
+    services.mysqlBackup = lib.mkIf (config.services.mysql.ensureDatabases != []) {
+      enable = true;
+      location = "/var/backup/mysql";
+      user = "root";
+      calendar = "daily"; # goes fast, included in back up with server dirs at **:00
+      compressionAlg = "zstd";
+      databases = config.services.mysql.ensureDatabases; # set to all databases defined in esure databases
+    };
+    # postgresql backups currently immich is the only user
+    services.postgresqlBackup = lib.mkIf (config.services.postgresql.ensureDatabases != []) {
+      enable = true;
+      location = "/var/backup/postgresql";
+      compression = "zstd"; # optional: "xz", "zstd", "none"
+      startAt = "daily"; # the dump is included in a backup taken at 4:00
+      databases = config.services.postgresql.ensureDatabases; # set to all databases defined in esure databases
+    };
+
+    # helpful and for scripts
+    environment.systemPackages = with pkgs; [borgbackup sshpass tree rsync];
+
+    sops.secrets = {
+      "borg_passwd" = {
+        owner = "root";
+        group = "root";
+      };
+      "lifeboat_rsync" = {
+        owner = "root";
+        group = "archives";
+        mode = "0440";
+      };
+    };
+  };
+}

modules/homelab/system/default.nix

@@ -0,0 +1,15 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  # the order determines the order in glance :3
+  imports = [
+    ./motd
+    ./backups
+    ./uptime-kuma
+    ./msmtp
+    #./postfix
+  ];
+}

modules/homelab/system/motd/default.nix

@@ -6,11 +6,29 @@
 }: let
   inherit (lib) mkIf mkOption types filterAttrs mapAttrsToList;
   cfg = config.homelab.motd;
-
+  homelab = lib.attrByPath ["homelab"] {} config;
+  gameservers = lib.attrByPath ["gameservers"] {} config;
   # collect services to display
   motd_list =
     mapAttrsToList (_: v: v.motd)
-    (filterAttrs (_: v: v ? motd && v.motd != null) config.homelab);
+    (filterAttrs (
+        _: v:
+          (v.enable or false)
+          && v ? motd
+          && v.motd != null
+      )
+      homelab);
+
+  motd_gs_list = lib.concatLists (
+    mapAttrsToList (_: v: v.motd_gs)
+    (filterAttrs (
+        _: v:
+          (v.enable or false)
+          && v ? motd_gs
+          && v.motd_gs != null
+      )
+      gameservers)
+  );
 in {
   options.homelab.motd = {
     enable = mkOption {
@@ -75,18 +93,20 @@ in {
         motd_list)}
 
       echo
+      ${lib.optionalString (motd_gs_list != []) ''
+        # --- gameservers ---
+        echo -e "''${headings}gameservers:''${reset}"
+        ${lib.concatStringsSep "\n" (map (service: ''
+            status=$(systemctl is-active ${service} 2>/dev/null)
 
-      # --- gameservers ---
-      echo -e "''${headings}gameservers:''${reset}"
-        for service in velocity smp superflat bento cobblemon; do
-          status=$(systemctl is-active $service 2>/dev/null)
-          if [ "$status" = "active" ]; then
-              printf "%-32s%s\n" "  ''${active}[$service]''${reset}" "running"
-          else
-              printf "%-32s%s\n" "  ''${active}[$service]''${reset}" "not running"
-          fi
-        done
-      echo
+            if [ "$status" = "active" ]; then
+                printf "%-32s%s\n" "  ''${active}[${service}]''${reset}" "running"
+            else
+                printf "%-32s%s\n" "  ''${active}[${service}]''${reset}" "not running"
+            fi
+          '')
+          motd_gs_list)}
+      ''}
     '';
 
     environment.etc."motd".mode = "0755";

modules/homelab/system/msmtp/default.nix

@@ -0,0 +1,50 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "msmtp";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables zfs";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.mail.sendmailSetuidWrapper.enable = true;
+
+    programs.${service} = {
+      enable = true;
+      setSendmail = true;
+
+      defaults = {
+        aliases = "/etc/aliases";
+        port = 587;
+        auth = "plain";
+        tls = "on";
+        tls_starttls = "on";
+      };
+
+      accounts.default = {
+        host = "smtp.mail.me.com";
+        user = "bdhelderman@icloud.com";
+        from = "alerts@blakedheld.xyz";
+        passwordeval = "/run/current-system/sw/bin/cat ${sec."email_pass".path}";
+      };
+    };
+
+    environment.etc.aliases.text = ''
+      root: me@blakedheld.xyz
+      blake: me@blakedheld.xyz
+    '';
+
+    sops.secrets = {
+      "email_pass" = {
+        owner = "blake";
+        group = "blake";
+      };
+    };
+  };
+}

modules/homelab/system/uptime-kuma/default.nix

@@ -1,12 +1,14 @@
-{ pkgs, config, lib, ... }:
-
-let
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
   service = "uptime-kuma";
   cfg = config.homelab.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
 
@@ -43,9 +45,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    
     # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
 
     # declare ${service} user
     users.users.${service} = {
@@ -61,8 +62,7 @@ in
     # enable the ${service} service
     services.${service} = {
       enable = true;
-      settings = 
-      {
+      settings = {
         PORT = toString cfg.port;
         HOST = "0.0.0.0";
       };
@@ -73,28 +73,30 @@ in
       UMask = lib.mkForce "0007";
     };
 
-#    # open firewall
-#    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
+      #serverAliases = ["up.${homelab.public_domain}"];
       extraConfig = ''
-        tls ${sec."ssl_blakedheld_crt".path} ${sec."ssl_blakedheld_key".path}
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };
 
     # add to glance
-    homelab.glance.links.system = [{
-      title = service;
-      url = "https://${cfg.url}";
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
+    homelab.glance.links.system = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
 
-     # add to backups
+    # add to backups
     homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
+      ${service} = {
+        paths = [cfg.data_dir "/var/lib/private"];
+      };
     };
   };
 }

modules/homelab/vaultwarden/default.nix

@@ -1,121 +0,0 @@
-{ pkgs, config, lib, unstable_pkgs, ... }:
-
-let
-  service = "vaultwarden";
-  cfg = config.homelab.${service};
-  sec = config.sops.secrets;
-  homelab = config.homelab;
-  domain = "https://pass.blakedheld.xyz";
-in
-{
-  options.homelab.${service} = {
-    enable = lib.mkEnableOption "enables ${service}";
-
-    # set port options
-    port = lib.mkOption {
-      type = lib.types.int;
-      default = 7701;
-      description = "set port for ${service} (default: ${toString cfg.port}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "pass.${homelab.base_domain}";
-      description = "set domain for ${service}";
-    };
-    data_dir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${service}";
-      description = "set data directory for ${service}";
-    };
-    ids = lib.mkOption {
-      type = lib.types.int;
-      default = cfg.port;
-      description = "set uid and pid of ${service} user (matches port by default)";
-    };
-    backup = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "enable backups for ${service}";
-    };
-    motd = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = service;
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    
-    # declare ${service} group
-    users.groups.${service} = { gid = lib.mkForce cfg.ids; };
-
-    # declare ${service} user
-    users.users.${service} = {
-      description = "${service} server user";
-      uid = lib.mkForce cfg.ids;
-      isSystemUser = true;
-      home = cfg.data_dir;
-      createHome = true;
-      group = service;
-      extraGroups = [];
-    };
-
-    # enable the vaultwarden service
-    services.${service} = {
-      enable = true;
-      package = unstable_pkgs.x86_64.vaultwarden;
-      config = {
-        DOMAIN = domain;
-        ROCKET_ADDRESS = "0.0.0.0";
-        ROCKET_PORT = cfg.port;
-        SIGNUPS_ALLOWED = true;
-#        ADMIN_TOKEN = "yuh";
-        ADMIN_TOKEN = "${toString config.sops.secrets."vaultwarden_admin_token".path}";
-        EXPERIMENTAL_CLIENT_FEATURE_FLAGS = "fido2-vault-credentials,autofill-overlay,autofill-v2,inline-menu-positioning-improvements,ssh-key-vault-item";
-          # The following flags are available:
-          # - "autofill-overlay": Add an overlay menu to form fields for quick access to credentials.
-          # - "autofill-v2": Use the new autofill implementation.
-          # - "browser-fileless-import": Directly import credentials from other providers without a file.
-          # - "extension-refresh": Temporarily enable the new extension design until general availability (should be used with the beta Chrome extension)
-          # - "fido2-vault-credentials": Enable the use of FIDO2 security keys as second factor.
-          # - "inline-menu-positioning-improvements": Enable the use of inline menu password generator and identity suggestions in the browser extension.
-          # - "ssh-key-vault-item": Enable the creation and use of SSH key vault items. (Needs clients >=2024.12.0)
-          # - "ssh-agent": Enable SSH agent support on Desktop. (Needs desktop >=2024.12.0)
-      };
-    };
-
-    # override umask to make permissions work out
-    systemd.services.${service}.serviceConfig = { UMask = lib.mkForce "0007"; };
-
-    # open firewall
-    networking.firewall.allowedTCPPorts = [ cfg.port ];
-
-    # add to caddy for reverse proxy
-    services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = [ "pass.${homelab.public_domain}" ];
-      extraConfig = ''
-        tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
-        reverse_proxy 127.0.0.1:${toString cfg.port}
-      '';
-    };
-
-    # add to glance
-    homelab.glance.links.services = [{
-      title = service;
-      url = "https://pass.${homelab.public_domain}";
-      error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-      icon = "di:${service}"; }];
-
-    sops.secrets = {
-      "${service}_admin_token" = {
-        owner = "${service}";
-        group = "${service}";
-      };
-    };
-
-     # add to backups
-    homelab.backups.baks = {
-      ${service} = { paths = [ cfg.data_dir ]; };
-    };
-  };
-}

modules/system/default.nix

@@ -20,6 +20,7 @@
     ./secure_boot
     ./cifs_mounts
     ./udiskie
+    ./keepalive
   ];
 
   system.ssh.enable = lib.mkDefault true;

modules/system/graphics/default.nix

@@ -84,6 +84,23 @@ in {
 
       # enable docker gpu passthrough
       hardware.nvidia-container-toolkit.enable = true;
+
+      #      systemd.services.nvidia-mps = {
+      #        description = "NVIDIA CUDA Multi-Process Service";
+      #        after = [ "nvidia-persistenced.service" ];
+      #        requires = [ "nvidia-persistenced.service" ];
+      #        wantedBy = [ "multi-user.target" ];
+      #        path = [ config.hardware.nvidia.package.bin ];
+      #        serviceConfig = {
+      #          Type = "forking";
+      #          ExecStart = "${config.hardware.nvidia.package.bin}/bin/nvidia-cuda-mps-control -d";
+      #          ExecStop = "${pkgs.writeShellScript "nvidia-mps-stop" ''
+      #            echo quit | ${config.hardware.nvidia.package.bin}/bin/nvidia-cuda-mps-control
+      #          ''}";
+      #          Restart = "on-failure";
+      #          RestartSec = 5;
+      #        };
+      #      };
     })
   ]);
 }

modules/system/keepalive/default.nix

@@ -3,8 +3,7 @@
   config,
   lib,
   ...
-}:
-let
+}: let
   service = "keepalive";
   cfg = config.system.${service};
 in {
@@ -17,7 +16,7 @@ in {
     };
     interval = lib.mkOption {
       type = lib.types.str;
-      default = "60s";
+      default = "45s";
     };
   };
 
@@ -35,7 +34,7 @@ in {
     };
 
     systemd.timers.keepalive = {
-      wantedBy = [ "timers.target" ];
+      wantedBy = ["timers.target"];
       timerConfig = {
         OnBootSec = "30s";
         OnUnitActiveSec = cfg.interval;

modules/system/ssh/default.nix

@@ -1,9 +1,11 @@
-{ pkgs, config, lib, ... }:
-
-let
-  cfg = config.system.ssh;
-in
 {
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.system.ssh;
+in {
   options.system.ssh = {
     enable = lib.mkEnableOption "enables ssh";
   };
@@ -14,11 +16,11 @@ in
       enable = true;
       settings = {
         PasswordAuthentication = false;
-        PermitRootLogin = "no";
+        PermitRootLogin = "prohibit-password";
         X11Forwarding = false;
       };
     };
     # open firewall
-    networking.firewall.allowedTCPPorts = [ 22 ];
+    networking.firewall.allowedTCPPorts = [22];
   };
 }

modules/system/syncthing/default.nix

@@ -32,17 +32,17 @@ in {
       settings = {
         devices = {
           "snowbelle" = {id = "6WQ6ATA-5AT4RUM-NW67PAL-N62CPNV-ALRFG3P-5BDRO22-HWFC2Q4-5S5BDA5";};
-          "mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
+          "piplup" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
           "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
           "mew" = {id = "7ZC2NAS-QONQKAL-Z54NPMB-7TRXM6M-K7Z6PZD-FG4AI4H-V7SMFJN-JOYBHQO";};
           "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
           "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
-          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
+          "CEN-IT-00007" = {id = "UEWNSUZ-AX75M5Y-OA4FURY-ORMEXFA-XUXU4LU-LEUYKVW-IDM2GQC-4UR4YAL";};
         };
         folders = {
           "holocron" = {
             path = "/home/blake/holocron";
-            devices = ["mudkip" "zygarde" "mew" "yveltal" "CEN-IT-07" "CEN-IT-00007" "snowbelle"];
+            devices = ["piplup" "zygarde" "mew" "yveltal" "CEN-IT-07" "CEN-IT-00007" "snowbelle"];
             id = "5voxg-c3he2";
             versioning = {
               type = "staggered";

secrets/secrets.yaml

@@ -6,17 +6,22 @@ klefki_auth_map: ENC[AES256_GCM,data:u8OBLtT/,iv:THW21BDyhyFIjcwixsAnaAODofxbuQZ
 tailscale_authkey: ENC[AES256_GCM,data:SqBbzV43arnLJZX0bnCZZGqO3jAKXBPZvIe6lqtf8L8RtqVNPvhxzeHR3Nki5LoSd7f3Za01puBAwpZY2QQ=,iv:f3jNCmrQrWsD2cvB6Ji8H0Ez/kpZ+4K9NIEhGfKU/N4=,tag:ej1gW8fBhAd9j53G7g8/HA==,type:str]
 #ENC[AES256_GCM,data:bEbCic+ZDAA5ieNedCbiVbJrse17,iv:UwRYlis6NPB/RUcv+YnPxrGdbIcF4hrNiZt19YvWZNQ=,tag:m6PVlzPNnahX7X7KzMUj7A==,type:comment]
 borg_passwd: ENC[AES256_GCM,data:XOMJtr+DRs7xn5Iclc49iTzK9cFJyc/fSXJjhdKa9jdN,iv:YB8z7zNYjh6NpSxQb1TfPxAYUdzThdVfNZIe6tO5grA=,tag:bO6kZ3cLJDL4IQoWmGvRdg==,type:str]
+#ENC[AES256_GCM,data:b75Jb5eEKZQlzC6zYJhDNhOOwA4oetNp52J7kE7eCpA=,iv:yNq/pYLtzVfqItBG9peGd0NtL7PkVkaKI8jpzAbWUo0=,tag:suibUsiuNkxrQqWumHTbXA==,type:comment]
+lifeboat_rsync: ENC[AES256_GCM,data:OaijbFFpu8RM3gcWu2XbAHeuUhTIjFNO8aYcA8TJmNxMeUQkZ5QrE+ArAQ==,iv:V0MIqVclg9mg0sIPRgTAu81l9b1f6ssZPCcW+ukM/JM=,tag:5xMgBMfMgGYlHlpFoG4vDQ==,type:str]
 #ENC[AES256_GCM,data:NbXyRroLF2uxHjROnBg9OLQ=,iv:W9Nse9yamov3rflDKBeISO+miQkjH7QfBUZdsDmDM4I=,tag:/RmH3JyriXFxf0hEh9/iRQ==,type:comment]
 cloudflare:
     api_token: ENC[AES256_GCM,data:VuRwfZe1cdnQLvxlp9GCDOt9Ijhz4fh2yOev2wLOdLV+zw91blA3Zis2BRyI/ZwN4y+IhiqlpBzXCsoFqw==,iv:6Bt11zz1/slvszh9ZGQ0ov5ts0jAZIAMx3G2AimKIs4=,tag:tyEVhsKCGrJWm6yn+GUlUQ==,type:str]
+    api_token_caddy: ENC[AES256_GCM,data:L1PMeI4zOCPbWuWrczM1aSYl/qk/MW8xLtxr/PL+a3zfDA+USP8Yw4liYnn1qwTxs+oLMHhpBR58kHPr8Q==,iv:NNVBPANwQ9koAKTQD4ikhtwFjCpMLMXEm9scj9jIDFo=,tag:SXt1Y+04BuSsjDhu5ykwLA==,type:str]
+#ENC[AES256_GCM,data:3Nnp9ASh+BPPwSOa+Xx3YEqKnh48oW6sWCQCXy9iZ61qGv9Ubjeaccr+Bh0bD9s=,iv:LwbptKdbhO2yki2BIK+6uPMqe14FNC4EcIwO6HS5xAc=,tag:38P0kwfAFVEps6MnMU8XeA==,type:comment]
+email_pass: ENC[AES256_GCM,data:T4heTFuvD3rUJUInDpJnIhwECw==,iv:uDOk6FKtfYjedE/I3zh9Tl7QuYz/OBe/3tlrTitf2DY=,tag:a80RoPPHMSETAbk5pqGfiQ==,type:str]
 #ENC[AES256_GCM,data:ztRwuY0mTMDmwV5HqVR7Dmc+dCWcrVRtWZGEL1abE/WUcA==,iv:mmaWfHRiENJUGNhyUBFo1z7PdzVPH1OUZrVhkce6KV0=,tag:GKEvT0qkzTtimQXDueKPdw==,type:comment]
 holocron_creds: ENC[AES256_GCM,data:2QXtXrN5w0UFn70GZOsYFPdtPwjLcuUdtkEam5aZ83N6LEDqPWJi,iv:kUS9pq5CX19vqHumc6QjY+Xpd4N+Ge7oCcQYtMFh+WM=,tag:IUA1ZVThF91EdHrwmS624g==,type:str]
 #ENC[AES256_GCM,data:VdbMrwGKUKNJHw==,iv:OLwBh6KQXR/H8eRgp/hH8k3QfIkK/ydL735kx/dpc8E=,tag:N+v+ym6RMbvW4IckbiLK8Q==,type:comment]
 syncthing:
     gui_passwd: ENC[AES256_GCM,data:CicGIe5dT8lJVchCcE4wg3E8va3RYR8d53MISkE=,iv:8ziDDyQvU8ABaKKwYlcHmvm8Qybk4G+q5F0Ghqluu9w=,tag:YlyNPE04KD3detL1QUTrgQ==,type:str]
-    snowbelle:
-        key: ENC[AES256_GCM,data:MrAc4RXi6h4WOboZgBRjggPNGUrQwM1Vu5N5aPYBxeBZPi2ut8OApWcA9apWzYZNQTFF5QCtCpG9W+1CLJRG701PRK1Wf01r5SDI8aIXkgc2MjXuzS/y/WIqWoPK1nmtjxTYqaDR68II2tc/P7hgtf2EwYPV2JP6v6cCihADOKvXW1pBxi9kMjZGcbY54IyUrOdNauDvaZRgCSP7xtg8aWf1FlmJbiQgMW2lK/f+8rc/3OGS+ieFt35h29Khl4rhuYGB6rgTwvDaWa9g60rPzVcg6tKw+Unef99pA+CQnhVJJIejKlC07pCdqdjCUc+w0oQ69cVoucWeHqlq3xA7IvYIGi9K+OFCLmsoqjMe/wUSC/r2s/nnqbXsgVx9j8j0,iv:2FoZwwzKUky02Z34KRVP/jPhOMXnLZh841+4lybsbCY=,tag:ZL5qh3OcFjiWgqtmTCUFkw==,type:str]
-        cert: ENC[AES256_GCM,data:tvJX88ounzIzKmKcvEe0UtHrq51DMAIHGVZE2StqfNkn2QP+Er/geEh0wwmP9Q8+XBBjDT6oSAlWLjq6Tc1yYWSKju6Ig8GEJNDHL2UMVniBFzroSlO9hqZzbbNe1896WiwhhypvBoves7STTE7tJ2+Hzyss1BCYjcI+evGliJslq2nqxroMxIwBXfuDtxcTAeJ+SiKonY7W29NA05P1zYm6o6Td09VUS0cYWx2VUoP/8PMpeWLNciaHz8TjUeZ2Qob3pcNielu/VDqbunLvbFapqdV0hkl8gxgho+MmkC3+DXp/JDnG+vRm603wxqDECh6CNYc0CEXvM0/8gSXt6AkjATv6tBV98VeLknZkqVjBahtxrZuwquMuQbh1jD53RgsvnwB39FyFHZw29DGcUD0A7hIGnqSYVc2TXW+sgRxzXVFYsVrt1sWrYa2DpZT5zaFbps0dd194/j0SHOdf3p/4HF0GncWfTWLT89F/oAyJLio4X7yjES/DljgvmsrX0LdHnAYYAKDCWhZml3wSHBJ7Uvj1KiH2asxXkdiTPf8wulmwT+01hhBoX3QCkVYkdJpDbVddjLkwpLNyJATHctyuqzOdEMR4w5usTv9vKcgkMtbmxfWajb4lhjCpuaavkDUoI5h6eB8veXbZqAuX24bCvsLBWOVkg4qt1GGRqHx7+lfFanzMGyYYC/ufAXWD6eOOVsCjHJbHJoI16zq0HkfNpr30w+gO8hOyKgBP64anElzT3NB1sDi2GWxhSUKTDZ3rLsagPhZb3l3/u5SMf6lLWsY6IyFgPcVgY1snSOtd+PO9z9ipfyQZn4kKCtkNPPof8T58Qi7CP4KmVvbJsF67BH26SFclQLaJv5RO7e936vNwLrVhbyaclM0Vz6Y8wJvG4vW1Z4qPt6kP80NEATdrfwAr9nvZkb5rHqRWdxqIWSD5as+HPFzM/Mv0sBZ+B+CnsSv1btdB/iLacd032PGKXfZLxqGGOL1HIjM+QjSjaBTqrYcMke3GvnVfIujfdtcn9tOqGK+QYPS1CTYxWznmHloL2/WYwBY=,iv:qlIfrPxz7NvjkIXSkumfKvN0O1qq1S0T5j+37L8aReU=,tag:Qg8CYcDY/MaLWwNY566wBQ==,type:str]
+    lumiose:
+        key: ENC[AES256_GCM,data:82oOep2VmxfbHpRVvmVH/qh8Lv7ZqoSauLZB7l6fwF1EVNc/LnHNxT+JQSGjDPy8Kqieql+cKjjAseBS3u1y600lvuIeOQCOhNQd6JE5wThvCbJvAIH7G5v3ixls7xNThkzNTJKz5gtEcC7bLh0/XV3tm7kXhw6dN2f3kv2aCqF47FNw57v75Sm1yI/Dn/adrMUNCTxiwM8kisn+302YjyfVZ+LC9R49YtuwnOaUnQ1XGp8xeLcRZFkY5ThAxfXtRyZ/d4fwAEkwF5iVFfSQumimmSkgfYRteJtGvq3varV/eC/6IVzzg5hw0jcKZ7u7b3Rwut0mXi6E2WVRlN+L1Y1sk3xXvbF252+Ja1yR1TKipqro1Rv/BHP7DTZ/SSGU,iv:4dDnU1h1RaleL9f/8ywwL1Kk722PQwLB5OEovBoAA8o=,tag:z0cId9BFW0icNzPTm6vDZA==,type:str]
+        cert: ENC[AES256_GCM,data:oALzV1PdQdsjH0TCRZ/LYbrMGROCyFRLF6S7c2Lzyf6i4mUSjp+wqh2OtWKC5GltKgwUoFE7eddLWdYR8Tfi5h4NowJTcWeIg10h6iSiztwZTho4Ob3g0KkzrQRwERcv++SwLz8yo5zeDEnZ/jqanlqcrxQQdoEneFdg7oK8lMXou4r9VZ3y2qgE8+9o4DWeiYaSJif3ad4SSc00evzswz/bN+4O1ei+47C/ABMBHe/N9H6gwZoSUgFrjv8+kcU8g29+HB6Fd9K5quUoR08BCj2d/WoGLmmJXVZm5ee7yEngJTFm1wGYjo5RXxR7fDoThtjre9Nt8L5ssewTTiQ9k4IRKPwTtMpAaSPXkxMS4CJZk7+UoZT1gg4nA3WPz2JKmtiPp2f7tKkglQpN8ckkxuEj+JHaDFSsylp3KcI/MHYrroU+jE6Jy+jVjggy0kg7N7+PqfKU02OTXizymivzRaXUzyrK6dS4/I02rsLcpvzyAqV0o0wHlYgDzZjU9BiNZNIeKXpNasN15nDwmJ4tvvk3QHMsA/sZgAXvaF+KmXeficdPc5YBAIZulvN75OtaE5MF4O+0boZpOXWsGifCvqtQtikAqJ+5DguAGxdR5IsfP3KfqqH0roLaiut2BDGdlPYMbEJkDjQmHm1zsw26TvgN1U1zkBdTZHtFm26g4XuzTqVU9LVgFJveZiOsKBHj19iODAJ3t0uJ44xid1N0udQGagRYi+u1hPVn1p64eI3x8UD/sX5Zz0xyO7+1DZ/eSam4nQYj1lFZ/hfDgZzyr9V4okJqJoMj5ZVhIMDNsiQWCNEVrFf/UG/YJFUr8yjtp4sefWA6vdORJ/sXQ9XYUahFv8Px0Yy0vmApoXMRfubo2nACZyFg55vkY/nEr1fqKXfVROLmgc0q08nG1hgjU+odeIeEbH05P/f5Xago1QO2MdsQqXH0BkDupgkxdz5Dd6HQJlL6EtuAweDUTqvNHKQ90pqqbSnVTM+VvPc8WR7wUniWvoTigG3CA1N3PRF5aGhhnKisml12KCZlUfDj9qfY2CE9Qf9HIEs=,iv:4thjc7nywpSZvj/gcdtjR4zwVopquFuCs41emhfmMPI=,tag:3CRdTk2qNO9GoDrKZZqLhQ==,type:str]
     yveltal:
         key: ENC[AES256_GCM,data:unUnEeDhCqHUZCJtGCbj5rmrLx+9GiUTl75K3HdkI94YfCLNYCBACYu2v/7FbNIEsjVoQEA5/gKEcUHzVq6LaHM2w9GSo6tjkegdzTUgbHBJf4ssJ38z5rQkMc7tbzsA0NUHBPklz1eyjkW96HQPD0REcwA3CIc=,iv:PZ7vfhIpwPpMz4P04bewNhRuahmpukasgYb8fL/EJBE=,tag:G1HDyPAVSdm/fwqTXTT3PQ==,type:str]
         cert: ENC[AES256_GCM,data:yLq2dNjdMiRj4reyZWsSqZ+1rw4DTwKBZoQHzeKb8YBn63ub4TZPlnOjSTt2DwOQwrJDNhsaeGscZ6J7rLxF/rtH6YnR8XxQuOu/NNIcZ4m9EqhsXyznSx4Q+0gamUXujRgGRVH5FNrfiFoqP3VuNghoX+NLxfX0BcVruEjbmLUWVVzY0yS0ufzxegM8WFAxuKhcr1NlhBU65TxKUtbj4vcByzWHkfLGIb5ICnGeF/p9/FvpFSavw3nLdybDLJ6EKEeaxy6t984fkuotAvk54kLbF4yt0q5mjDxy0U6xtn1hg3x03IRAPjKDRdpDmzYf4XxykEb74JX9q2zjUhb2l1ORWcZu/uKvEiuZWDJRmJ4ypOiyZOCqTvY6s2iDhEjmMKxlNr2mhuz9Hn6b3KoQjePIEd1eS/VEmo09pEuUlhlAEziVcdnpeRyWlN2xpv4ps90gLxJ1Mj9nAZwRqFOQl0V4N5OBHEqMBE1nQv4afMpGX5QF2UotTpNfka+LdKwc1iHHtpHZYmG1/LVwz3jDv4XnVLdDWojFA/8eJIWVq1BsUTYSy+Q27bsoTX4iL0Y/OAHRzXZTqYc4aiAWJoaNTNgmagZ9C03SA6qePlGe/5azI3f54rC2m1/JDUtYW3IABHSFUaVnTdWnD4GDNSYRJIknyUwXR4sE3pRD979prmgtepOyETOAVgEeUVKz1leJZ2HyyhjFU41TL0IN/sl+YPD9bC3Nmw7OsxMFGPC4l5vn64DVp7HHRSKyJvZ5fG8s4nSzyZAKomkocOpKHEuQPyyerZpL1lne/m2B/y7/W2ouAGxcawZOSU6f74mn5wM=,iv:Ggag5SNUFkhMWS0u1kwkD5tGjiMv4i041bCESl5XOdc=,tag:pPISz0eBWzHcPHsC8dVG3g==,type:str]
@@ -25,10 +30,14 @@ syncthing:
         cert: ENC[AES256_GCM,data:uvNZYmQnexXTr/Sz7vLQIJK93MmsoiJfCAL8/rLVQH0D+1nVaM472lqR5pP0qhLKuYhFUESxhAotVtqLpOWK1MfAxuk2RHv8mvbtIJkheRmsIWw7dAAABIkmgnelI03P2Tk2129I95vMM1lybu4W6m9VslwJF8X/4rCxshdbuz9mcjwxBpUEDr1V76DO3bgQUuPwizx17ON8gNd+NtRqPPaXlGrfLCFv1Fib3YFd7+WRkERki9ZO7Q0quY75G4Jseb28QaiM2BT7jfECJo4x7rMePMV303sIrF9paaUKTuSiCUsamLsi5Hwr907y2lHB9Gocwio7tnSRSRhHHcWLI8dQktzW7Flqs8+MZGZ1oJBQO7kQDefF1q4mddADimoqD9F1NsOiOmqqZRRB37alLGmRjeYBIlA6q/FgN9BAj9h0cG3oN1MUXPRGzDfggg5TLjBM2FbG/N3xgncZ2AzTPOcLtrtc0I2PYk3FFxgzpHWnjS2t7CQo/JxqdXbdy9nTHIqbrnKIQ/FtS7/p+cgQcU815UMsJm3qP+hPLCyNuziYq3Vt/X7C3eTnrqemXjEeJ/SJxb+Oul5GS1OL14dNsJllFNuj33Zep/hyQvHnf/HW7kXAfDqIP9zn85EFriAZEuaKwbHB2pkvbWKFxrpXJFhjnPFDKxGOjAmsLmil4paFKdt5hK7rp0mmoIMN+mMFbYx333llik0qk27yYTQwOR3eeCGqHODUU+izUT8NuQBezyxsEmEYu/YBcpatcYylwKgIFcC058oltsxlbxRg5Rrdk5FOqj7Uui0qwFXvYesz6Tiq/rGmcOPlcE5xw14=,iv:LePpzWGDTV1ONwt1uHUptMW1dO1SwwUKrtCEerc/DEc=,tag:a5B/7hmIxvLXU90Stcq7zA==,type:str]
 #ENC[AES256_GCM,data:A0ITyGOGMIoyVOcn5JOi1RAtqUM=,iv:+wWpmFbeLiX/Ae53pj0QmnYY3MEzOMib4cqbePUKtGI=,tag:JHXvrN4bOH+oD3Q70pUuew==,type:comment]
 pia_auth: ENC[AES256_GCM,data:rwAu4f5XVS4v4FCLj2zXAegIZeRPLIzUVv6TCrdfg9RGSDJYHgVAX0aFXCBQsDQju9RDycXmc9Id8IuyYN8=,iv:kEA4ADQyUI+zlQoZOKi81dw5BLE1oesqhVf6bfiLgB4=,tag:VHT2uPNW27F3KRM7ZhWdCw==,type:str]
+#ENC[AES256_GCM,data:5F5zgBhqkrxOWOwqOZN3GQ==,iv:TRWqSSGcEBq+3IY0PyYi8SIZH8wKXvNS2VHS5pxlOuY=,tag:tJQgthNyBxu9ebeaxYg/yQ==,type:comment]
+cs2:
+    gslt: ENC[AES256_GCM,data:CJUqox7FRvXhQr4oll4Qex75CEGyUo6cRruvhw9o4wI=,iv:ZQmPd7TWrO6KjLeYbNVIEVtt2DqLMnGZ9LJyo6RWwLI=,tag:XlClJ4tieowiL/bETPMLNA==,type:str]
+    rcon: ENC[AES256_GCM,data:b69rgz71icGSUDXjH5G8DXcA9W2521qRrKcxcONs1NGDjcFyfulPZt8=,iv:DNlujzo4nzIZg6hOxUNDWWDU2o84wZNP6zIJ67Z+xKw=,tag:1MMhWLI8lDuildp++DXc2Q==,type:str]
 #ENC[AES256_GCM,data:mbIgMJBhL8nWJzl8q2dFL8XtO1Xa1Q==,iv:caYHYp1boK9wRgCcQe40HTWT/HxAIvYe+HyaruI53Vc=,tag:S6wowhAHObEcs7z8FimZ1g==,type:comment]
 wg_mex_key: ENC[AES256_GCM,data:vxDXixo6X6D33+p21L4hB0/yCH+TvMHZl991BkRsE/jdz7rzZuJF+zI7h+Q=,iv:8WR+feHXNUcat8DB2wY7wpos+P7TzgRF7rFD0fYosjY=,tag:p9b9ck0/VZjyLxtHut3n5Q==,type:str]
 #ENC[AES256_GCM,data:CO5nrcDbgymnEmCvuTexOBEMncuNM5lQ,iv:6HrxqSN6e7ODuz09MIFgPbIqDCKQySRDaKk5Wdu4HoQ=,tag:JBRjZeEdOg+trohfanO6Mg==,type:comment]
-vaultwarden_admin_token: ENC[AES256_GCM,data:G1v3N064ci0Fw5EtTzaryailWpsv6f4w6eoHp2vjXIBtIlScdQk1Q0W+eDNRk8Wr2C3ysTXQNbyYismNsls+jeS3W+YqkKL4fnh3a5UTzQrMqvaH11n3ak0X9R9vmt+ZJXBrUrAOKJ6RPHJJSWenhjDB77kwEdQ=,iv:f8X+x/AdmZ3b3dtcSFrxGgA2tCgDRpgddjlVu3mdCmM=,tag:c0MXljVvhwOdvrb/8hWlsQ==,type:str]
+vaultwarden_admin_token: ENC[AES256_GCM,data:Ow5UcBXe+36POaR099v4Sl0ObLu6/lmk4OO5F3sA6BxoSD3e0LFdlvn2QyWKAUOeBSF9ZoLLSnZwc8xd2vt4xm8WQXe7OupO4yAGeE2P0vNcyMTKXxS48scibDvdoGYEtbfbH3JH29pOF7l6LetWcX3T121mPrNz8bHknj3UXHLYdYm8+eA=,iv:iFZYixNJCpK/VB3AasFO/XdPKL4wh5B9HzSKU39LRn0=,tag:m4wC0CpZK4N6rlKoEa5OZw==,type:str]
 #ENC[AES256_GCM,data:2ESzSsQZqKdjD7OXN8ZPThj6g9acJREe,iv:aDFPB0vs8NNo8ExLcJw7qtQvWbCb1XK6TJrHSK86qss=,tag:z+dypHAGUjEXP7Y9MHYWwg==,type:comment]
 gitea_database_password: ENC[AES256_GCM,data:nhFn0/G7gW5rk996OZzlcTt7T9KMbP8MNM+ReFC8w1H9ZqBSJUbs3K+n68uQVrkOVSXE0cKpOR1VbQ+i+46z3g==,iv:bT4GRZZ83v47/EmeV2KaUFo+4qTT4T2AktFUpPiZdF4=,tag:OC9TInkAr1egM+xnBDizxw==,type:str]
 #ENC[AES256_GCM,data:HJ81OxRD2xtNZKv+8oDqiT8mYpv45JMvjxU5pdmEKzl64SK3lQ==,iv:wStoC6XaZlvRPfbqti2CUbPrOOTt4KktaUp2ecVrggU=,tag:isOwKfNdQZAM+E8YQXBSFA==,type:comment]
@@ -47,6 +56,8 @@ copyparty_passwd: ENC[AES256_GCM,data:I3UYy4nJ0B6RnIp661O0VVqEmxloxxcroBKmNFcgoQ
 vpncon_mex_config: ENC[AES256_GCM,data:4i356X97sBoRliskmh5ewcEwZHkpo37IhPcemKVdWJgWFWtA+AhTeEo4KQ3dRA1H/n8VjVX7CKZKPDxpmHfcUlnTLT0agtOjjyjf60kWoL8noJqcbDB4wGiYT910rPToVnYMFk0H2lerYp+/n2bhg8BHxn++VlPOOZsgla4El+FNXUqhScpAawySPSF36ocdRJ3r3DuflIhnTBXxSZukMf9Ux1uaFldSG7KasCQlStKy9O2Odd2AvAuGXOHch5KecRPT3WnonQ8oDJpuxbeaosLmtJKHL9oeXHPId2Unc1GNoOpnDC3Y/xGnrPb9WFXWYOSQ/1A3mNKwnVq0FEhluVbqodES4PVIlCS0koiQJq15P15G2z0jO+OhAQrRI5vn3Fki5A==,iv:tQvTpzhl7F7niigAXl61FMHbg6QqI2R7yGD/C2lwOR4=,tag:c+CVLd6lGrAfm38pFXOXTw==,type:str]
 #ENC[AES256_GCM,data:ep/Z5O6RNFwTd0I5hvtk5DP9,iv:M7sclKcTR+IfCEsvz0lZaoZBRZlQsN/FhwuzFNXgVew=,tag:Ddo3Qf8tMBX9Amt7C9m5FA==,type:comment]
 klefki_pub.asc: ENC[AES256_GCM,data:lGfgwhgn2xCb1cNTo0nMP8R3KSDiEn0/k6neDE2dv1DynvXsHWmZSXED6VWBjY3uMU3YtcpXGCtxTU6EiaRKiGnhxslQlBiSypAnXHeh55DZJMJJ/JM7+BCtr33LY2lusF9/aAuKO9tbdpGmu63s5ItZ1/9zMoCJwBfpQZgY2HzZoBhjwqYu2wSkOOVAMjq+jXET7nASieOZXmpQq2uDepuEDa8MP7d6G6kV2KYJPdLYYaY4U2eppEr7ALhhJidYm3P38W47JuLyu/2raG0AY2uDtCQw9d16BcJO3au+T4B4mHzPg1/cPhQ2X4dHTTGHjRZ0sT95DrEYYmcwWVKHKyiuL8WPtQmF0QBfCOPczwJajJejB4DbxEW8U2kuhuoBWr7wZe4y/nbW2hB3pcMYYXc0EXen74IttiUrvksw+hbkLaZDCJgG91SOlWSwI12UlDrJJSzOYm+ODWqK+bKyqAafQTL9xh5heM3nQlR5G6/A/8UG+0q5ZDL+IxJwe+EffJNwrL1mn4Rc3qx068udMJC+qzmft7Ljey7mfoIiwepITpii1IA/CtuEqtpe4I5MUemQ60qAw/PoVbmD8zhOcnRHCBZtQ394I5vMo1qR2a4KeBICexx3IAjpeAQYI3+MAgo/bedqpklLYjbxpv37XwinoLj9ew4hKSjAB1wRRZlswmk+GD4XKlVo8eu88RCXYrsZ2oaOD4qxrtbc7+skGm+EqxL67nLW5n9bSC2u95bFJ1386teSFhsJL9w3EFiBlQRtm5tvee/ipmr6D2W7SyfCnSxImPC4TgTwkAXziQ3XtsUtGqj0Tv1HGayaAQpYzlJaPzf7h8oanH1VaA+AgRq+RY1OjLZGHEz37jSbqhWOiIWxwJ7qFaqGB90cHq3s07qcWrDl2wUawFLTXavZ0IF3gj9KnFSIzW3+ANvedUCXOjai+zOKmpxVFZ4Bi4W3Dcbl9B+qa0Ly0NIgldi7PmqEvL3V4FnJs6WnwdagyhXOzdlKVlrAgGluucgqBpBZZfpN6uB+tdkbrqzsdMbr+H9Hwk3RUxRzAK9k+J9WRgY7eMazH0najJ1PYh9/UZJf0DKWRi2vZTlWW+6ZruJWTohOKm+7MCgvMEttIpNQfvK6+cq7p3vwPe+pmq0DznNg4LO7Uu3cXKq3zHjl08KGE04KZyfoJuZPr+XrF91AywZ03HlT2SBBaZtFld1VapccgB5DqgE1JfFg+TS4is9a8G52Ad9yh/abUmLohsnUpGdYMaj/1FmhSLM7ldHeub8CmL2vKW4f/JTuqmOxq3X5RA+qw5f946ekUz9ZF8EyGvNwaRZ2p5m0MtXQG2IKp8Q61aBSpqbMwKzTW93VycEn7L5ZsoV5eYo0rC4PMawGkfgdNzBpq4NL5bNB82l6qHnWqU7jXh611/ZV4ueX2MLSB3cyhnaFxsH9bat1jGDtUl5umNWNtvN6rWBVsClmYfBLSUCEyftGPlxzAOy6vRHGxAdCNdoiTRGgZru3aYyW9l5XhYH1aZ+dOlTOwngaqqIb3kZoPzcc9xCeZ/I/N6iVuTUI69us8y3LVL6qKa6az5zTTgumoFB5kMugPtumS1U9hzhLtm9+hY6yZVgYredgAwVVIviMAqFFZztFkPiskcwIdrPhXzoXwfuBWDaq+dF9nykjw1F9U2gyDU0YhEOtSmdIWoIma3OmdOZ/h/JbWNrwUoAirmBmWIHQTmA5Ag==,iv:btQ5xmt/AA9vW1njJH4Inj6YmOBx6pGbHbsvCMbg7fI=,tag:DuQ4Wy9wX3mPQAVLLd6t1Q==,type:str]
+#ENC[AES256_GCM,data:lP/UhYvW72t/Ql94rzxb,iv:rAoO8xytnYBTiwqGjxJTWBINaX/W0IOTBhYu8bx1dR8=,tag:RURjkKrFINdbz1RzXM6oGQ==,type:comment]
+caddy_root.crt: ENC[AES256_GCM,data:8KyKvKCjRbzxTIm+OcacNt/h7jNxIApHlRF8T5G18qPg1RVC/XYHUZarichP6m7Z6GwcF9kBCCZ92UqMjskFNbekZZzXZ83FDeAMF76OzzSxW0iyL8sLOm7ApxcRxwIjLmEuR5gvneoamunftKoQevIP/QNyrpTM2oi9GfjE1TY9wwmJKeZpckEVqZcL94jimUXuPQrkvAdf/1mQ02PVQI42rKG6T8dK7bFsxoulRE+HAgwd7fqnBHhMZXvMS8B7GlrO4nfbxNzcO4/HeDWrhH8uADq4io2Gou6bSt+5Q0mqYVFpLA3SqW3FLJFTOmc0OxYyUmQWmMzQyDfI1efpdw64hQGQeZ1f47DUgoVMOMGpvJr8TiPRiEZ0+cxO/jvDTTM0ru9OcLyzSJcVy7z/KjokpF8hCYyDOTlR8tbzomGSJRZGNnsAF7IR7b0bwSfe4MVA855V+Qx10912qRid6W0thNSorL7WO7dLxptJCVvw4gt4M1k6lwRzc3DmhtST7bhgJqh66w94vah3QCRRJ+WAI+pn3wMZD9GiuRBu11dYudUCyebABR601wi6T8cSp4jUXfDwUWq0IkQUcmdPsbV3CA5EuDATQDfVJG3L938sv7oFGud+NLxziAfWBMy5tPzWNOXCh24uG8D4bG+rKtVQFIx1aVxAxLHL8858WbuFw9YQ8Jh7vBOqqSGDa18Xu9/68t5M1yPzs5oknxzTZ4Ti/TCzsOz6Y/GqlaBFWZIVzC8T12uBfUnfwe07i41XL4jNqfhv5WXBEnIaXXGcNOe5k0BocsGAWpV9iYxRKHndEk4op66rZTfOBzbMXOl7wGw6ZLsrFg==,iv:xxCwhxnxvpWJF8SAI8nctHigBa/OJrrc7KJY7VZ6aag=,tag:EIhIbi+niFLw5X4Z/xWAyQ==,type:str]
 #ENC[AES256_GCM,data:ODJOtUINaKPcvckAuk0y+FqAl91xuhmfaBys2UQ7,iv:ZKMV/ma7whPAlCYY5OzOM91QgLvb3v9J92rVB72fduc=,tag:DuZxO2X8grqVbpqXglUlaA==,type:comment]
 id_snowbelle: ENC[AES256_GCM,data:MAw5R2fqVIctN7fB/d3hfCU7W3sxvuy2O3w3n0vD8FxK1DAhqoROlVv04joV1a+U1hof57TYc1cN2ng9BRWxadc8ZIpWakokZYVI0dUG05/hPMyxctWPkOiDd5909aaNUFC2G+Y/VrgAemyrB+AlQgokV0U3fiz+qjg055fzO7ypaeM8okON6rBnigfwetmSm60MxpdYrVlxVaniDVvKKUYZjpHU8SZ+TYj6Jmm/bVuKWOJ2DXZbmM0CeKeIgnA9HML1wSXojMv2IMGulxq5mmdaiiJTPoL1q17OA5zZkkVW3Dx1y6SbEeBAQTPG32RHseAxXK6qdU6lftRQZKyivuyjdCVfBBw/VzqTxbWjSXXsjDdK/Ti09051w6znA1uvRX65XsOq6zPKt4BNwR+yMDF+xR9AElBTHES/TDf7TRc5YDyovlH2PhGNg12Coy3zfb6WESLyaz3/GYZxF0IjvBnDkN65CRjstut0CgKXcWY8x+CuKVysU+U4c0A2ucDnsf3HuITrdIufhAwRNNZMka7LWVsaaR/tnvcf,iv:agf/LEjohw1XAXsOJJ78kiBVJnTT95IUmWzYUujSlJI=,tag:a55o9L85a9Z7gG9s5BEfIw==,type:str]
 #ENC[AES256_GCM,data:wqoh4/WaghcWWifBKYINlE0ovUVJNepdPKnLMXI=,iv:vpTOcdoejeMffDKLVPHmTR5u1rsProi7vtttFjIyp/E=,tag:PtjKubpLJLP+Bq7GQMknEg==,type:comment]
@@ -64,8 +75,7 @@ ssl_recpro_crt: ENC[AES256_GCM,data:CiD7qdfWzi+7iA7qCD+w3UJdpxZByk2kmpw8YW7K3C7O
 ssl_recpro_key: ENC[AES256_GCM,data:ev/g2sKFia5xcgZQ3LsfT0H9AaShYwxglzZadBhvknzFVwWxXGmGfHgKD6GM01fCIFOpB2pPGiiOTpgBh2xoRnPmivsApWoxxXgdVfzEEVbuB5pHAJSHWX5EUEqeiTz83zfbJAC5FZFwlIEQTL3YiPhRzKRWwEpMyYigsZmUAv3970XlDTAxDRgaPc4eHFI2ZrEXGmevnBoHOQPwXi+JCHqSCyhbPnsuU1InIcp4PMlX4/K+WknDT0HaLonIVXds237E8lOCJFAo4Ow3/zHho2B/tBZeqcHHf4P49SaSEO1CSCzTrW+1N1n+EsPo3PPld7AZ3klnsiKltorO18GM+2L9KGg6LbTiWm6FCOk2bMIFg9q1b183SSzeDx9CzhoXefsweMdn9BFBF1BVUObHGgYE0dpme20S43C+NVTeVt9+gjOEYysx/II8m1ui0UzpW+kYRdMLFjepYHlIZRA/jUEfdVssqKsX492n9bX5TRPc/9LN/o6oDg4CZjZXPILjD+Cg1NOW5ZSJrKvbFGRVNVeVlC5+idUqnaKP0Jh6nG/8niEBIyV51YGy6/ukruHyjMiH//iG9oE2xfLwjQGTUKhERxYgKOnisHkH7b7feTQBq926BgtWP63zchkCYz9sQTh8LzmfitXEBYUpRvDdxlnZ7m6I1ssemY7bFCnx2rZEpHRg9LxDG+UNgiODwm8YvXQbL7z+DPSVzG5QdRbhlS+deYMjquLBvWpMfUrJ8HxurLyvcZiTRqRSBmhlc+08Y3/j0RaSfmDdtId0HGKvokSoB7daMpgfKeZs9ddpvmEVYto4bER0Y2xfumgUq/VuhSR/H6KhuR++8JSnDZxPS5WtoH3eVOXrDIRKadiwYzx1r9dhek55iVLZ7uF/YGhxS4DD7gFsJJk8/usLnu7PM2UsoPhfhg69CrigFZRa6I1qdPSon3ODYxlJt1KVLgyNkJqjG06t96i3NcJaIm5tZNsGRDKrU8Jh6EiSzCquGOy4oblpE7lCdK5mlHXL5a0WRiaWTUqo27qTGT7o5jskXHQw8X+/iTP6LO8GpDcL/YCpF/HpV3JiuHLifJoV3u6Cj5qFyCfxF6k7h1gXUZxdMtovpicbzHeJS+4pAnrdR6NmavjlBKDZFRa6cUY0011ZuA4HYm4SdEPTCyEzOLNsmx4iwNao/jH1sPb6hQxfQrI/2xbKJYLeGJBDagCjEOB+bo1sUaTepDVSHAGUVpb6ZdW98AUs+zOiKAhE19H1NRuRRQcyq+6fMFh1+qyIoIELiJNlKcTjv53r30gyvnbz+FPLWqqvskZhRnwrF5JFFqwZ8Rkt/sS8TCQVT3ZGfOHF3J6yApb9GKQVu3D45efUePaPrGHVtWdJmQRVpQNKDAYoxOWT6yMhHH96juDh17QrqSvD6M+NqydP2K4q6zQE4rfSkTz9xPR/O7SvLUIZ6jDKj7TfNqOIpqVLaq8wiSPB3MW75RZKiGqcyH4aiEDgpYJRatF3+qZPx3zyUD8Oh5teEWya/HdqqW24a8FdmuQvdwE+ksCpeMJrVslQNDWpwpmRgJe3Nal7/qhdxh92WBSSteHmRSoFLKDwZAUa/f6Np1SXR7sc9fNeIggDvv3Ctx8LrUWpYTae1iGcaa8bwMPiwYXs0tLF+wmQHSypcMdl9CH76jhBRM+8cBzshiCISzJ4xrVUi91or5eOtXHaUM9BOqVZb1uykU/mkWWGQqdzo5Ng9POWUBxLvR4JywSVo4BaDawRykevOjM8JZFGYLfyOk45+MRRuESJWYnjf6P3V3f8l5Ai3SL0g7q/BImZ09iC2jTib8qlRrLMMJ+OQqx45TeCwicBnmV2hqz77KYvikgYLpYQUGkFKcqpP17nXKajbkvEP+2pIQQp6GRptp0Q3TvbOSZSvBJCmr6/6AQ2EXxTKMS2caUsw2bH2btkk45epPKJY1Qg1QOcjRwCUzy0ametW85M+5a3TSKjYAT5lNDb84q2mdMwy5giSI3iglUemcNYFurVlgGcY2CJJw6xi6UiqaqGIEhU9Sn9ns0cHejtu5Uoy+jxyuNaHyuH/f3pB/jdkCzkyTrxT4j5Lpdu6+Le4MdRbn+FGVtopn0LuoqHG8FhourPmpkQxdwA2Yq9glf9MuqiHz1aDri5rDQs/fdCYffvTxEEkZMvYdNIL+m/9talRX7wS1CffCqUrglcfKZxsbvPY9pK9YSxhOmtyZ/vyRBAMlA8Daz0o0mV7czV35tTPPoD36pgo04JenFRaKopwgyQ,iv:682Ok4M7ptRiWBytvbbiDyBCKBdZ51AIn7VWA62GdBk=,tag:UWsWZnDZ10dMF2vAB8V8tA==,type:str]
 sops:
     age:
-        - recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1WkdJMnJ3Y3IvN3lkemJK
             RjF0dmgzT2lDcENka3BlK1NQRTBuR1BtSmhnCmI2cnRWdVpIM2t5SWNMOWNWdG84
@@ -73,7 +83,8 @@ sops:
             U0tmdFBuZnJES3piOTZNV0VKQmQ0eVUKCWRQ/flLzmpC64WyLoipklZBmrkpYiUg
             PRu+itNolpPTHm96pe+P93g2iP0wgekG0cX21wkiU2xaLF3dY2FEIA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-04-24T23:00:55Z"
-    mac: ENC[AES256_GCM,data:YIkJvC6fb++41e429DXLki/4//O48enrP+iitGbJIDFctSgbBP8U6tgBZTaPjIyLNCpK7yYDRscb1Ydp7gyrAdCOmTVx0SFrcvpsmE76Mw4HNi/xIyrVeQ2HnLal96r3pLIJktIqxEfgcncFdErD13quaLyZiMeZVYwvCMk9+RQ=,iv:xeJ33apAVfSOVjmsT4hBjETDbvx0A5TumiGBOXlrwdY=,tag:j+TzpCY0NPpX5kzVxUwsnA==,type:str]
+          recipient: age14gfh682a7m7jfp3qrulql03x5rs7yedwmxwksxrrmgjsunstyuksqx93pz
+    lastmodified: "2026-07-28T14:33:14Z"
+    mac: ENC[AES256_GCM,data:bEcpoMFzXbK4WCs94Y4I5CDo9JDC4/6iRMfgc41m1o8/qJhKyJUWWZcPhJSaRSituTYyPjSe8aB6k2Vwpgcd+hk41JC2Op09mnjBWfDQz6Ts0YbZAnZ/dV4IrzdxYRtM91EXmJnROeiTftGgYN/6Awa8I+ie3UFBl8u6/5UoD7o=,iv:MIhnNS9RGFWKJ0LI7Ae9gTEcGzfKwQB4bg4oSAs8/Go=,tag:W/zfVpxn+sRa+FOrR9fKyA==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.1
+    version: 3.13.2

users/blake/default.nix

@@ -5,16 +5,17 @@
   inputs,
   ...
 }: let
-
-  platform = if builtins.pathExists "/System/Library/CoreServices" then "darwin" else "nixos";
-
+  platform =
+    if builtins.pathExists "/System/Library/CoreServices"
+    then "darwin"
+    else "nixos";
 in {
   # create blake user
   users = {
     users = {
       blake = {
         isNormalUser = true;
-        extraGroups = ["wheel" "networkmanager" "docker" "media" "podman" "minecraft" "archives" "immich" ]; # Enable ‘sudo’ for the user.
+        extraGroups = ["wheel" "networkmanager" "docker" "media" "podman" "minecraft" "archives" "immich"]; # Enable ‘sudo’ for the user.
         uid = 1000;
         shell = pkgs.zsh;
         group = "blake";
@@ -25,7 +26,8 @@ in {
           "ecdsa-sha2-nistp384 AAAAE2VjZHNhLXNoYTItbmlzdHAzODQAAAAIbmlzdHAzODQAAABhBPdC9cCX8awvA19Ri65fvbYjZYe8X1Ef+nOZAIv92AS6u4SkJYqOvPYfqRHXORNDpbzjTV6nackyCKvV5EO4niv4MFIgdkEQwuVHcYX32/dOsWdDoeXBT/l2sFFM7JESwQ== blake@zygarde"
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVsjLEbnW/KeFXogppi0AP6ZbCZpObu7zFeRV/aLkP9 blake@lugia"
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJiskD81/2bd63sbJVSN0xPNwnbCGXheIBIKrwShDoo bhelderman@cen-it-07.local"
-
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
         ];
       };
     };
@@ -46,14 +48,13 @@ in {
   nix.settings.trusted-users = ["blake"];
   programs.zsh.enable = true;
 
-
   sops.secrets = {
-    "blake_passwd" =  { 
+    "blake_passwd" = {
       owner = "root";
       group = "root";
       neededForUsers = true;
     };
-    "klefki_auth_map" =  { 
+    "klefki_auth_map" = {
       owner = "blake";
       group = "blake";
     };

users/blake/dots/core/gpg/default.nix

@@ -6,6 +6,7 @@
 }: let
   program = "gpg";
   cfg = config.dots.${program};
+  isLinux = pkgs.stdenv.isLinux;
   #sec = sops.secrets;
 in {
   options.dots.${program} = {

users/blake/dots/core/lf/lfrc

@@ -23,9 +23,9 @@ set ignorecase true
 
 # shortcuts
 map gb cd /holocron
-map gz cd %{{ [ -d /holocron ] && printf /holocron || printf /media/holocron }}
 map gn cd ~/.nix
 map gc cd ~/.config
+map gv cd /var/lib
 
 # navigation
 map [ half-up

users/blake/dots/core/nvf/default.nix

@@ -4,15 +4,13 @@
   lib,
   inputs,
   ...
-}:
-let
+}: let
   program = "nvf";
   cfg = config.dots.${program};
   isLinux = pkgs.stdenv.isLinux;
   isDarwin = pkgs.stdenv.isDarwin;
   #sec = sops.secrets;
-in
-{
+in {
   options.dots.${program} = {
     enable = lib.mkEnableOption "enables ${program}";
   };
@@ -28,17 +26,16 @@ in
         vim = {
           clipboard =
             # On Linux, use wl-copy as you do now
-            if isLinux then
-              {
-                enable = true;
-                providers.wl-copy.enable = true;
-                registers = "unnamed,unnamedplus";
-              }
-            else
-              {
-                enable = true;
-                registers = "unnamed,unnamedplus";
-              };
+            if isLinux
+            then {
+              enable = true;
+              providers.wl-copy.enable = true;
+              registers = "unnamed,unnamedplus";
+            }
+            else {
+              enable = true;
+              registers = "unnamed,unnamedplus";
+            };
 
           globals = {
             mapleader = " ";
@@ -47,23 +44,46 @@ in
 
           vimAlias = true;
 
-          lsp.enable = true;
+          # fix indents
+          autocmds = [
+            {
+              enable = true;
+              event = ["BufEnter"];
+              pattern = ["*"];
+              command = "setlocal indentexpr=nvim_treesitter#indent()";
+            }
+          ];
+
+          lsp = {
+            enable = true;
+            formatOnSave = true;
+          };
+
           statusline.lualine.enable = true;
           telescope.enable = true;
           autocomplete.nvim-cmp.enable = true;
           autopairs.nvim-autopairs.enable = true;
 
+          treesitter = {
+            enable = true;
+            #grammars = pkgs.vimPlugins.nvim-treesitter.allGrammars;
+
+            indent = {
+              enable = true;
+            };
+          };
+
           keymaps = [
             # visual line movement (insert mode)
             {
               key = "<Up>";
-              mode = [ "i" ];
+              mode = ["i"];
               action = "<C-o>gk";
               desc = "Visual Line Up (Insert)";
             }
             {
               key = "<Down>";
-              mode = [ "i" ];
+              mode = ["i"];
               action = "<C-o>gj";
               desc = "Visual Line Down (Insert)";
             }
@@ -95,7 +115,7 @@ in
 
             {
               key = "gd";
-              mode = [ "n" ];
+              mode = ["n"];
               silent = true;
               action = "<cmd>lua vim.lsp.buf.definition()<CR>";
               desc = "Go to definition";
@@ -103,7 +123,7 @@ in
             # Hover info
             {
               key = "K";
-              mode = [ "n" ];
+              mode = ["n"];
               silent = true;
               action = "<cmd>lua vim.lsp.buf.hover()<CR>";
               desc = "Hover info";
@@ -111,7 +131,7 @@ in
             # Format buffer (Alejandra for Nix)
             {
               key = "<leader>F";
-              mode = [ "n" ];
+              mode = ["n"];
               silent = true;
               action = "<cmd>lua vim.lsp.buf.format({ async = true })<CR>";
               desc = "Format buffer";
@@ -119,7 +139,7 @@ in
             # Code actions / quickfix
             {
               key = "<leader>a";
-              mode = [ "n" ];
+              mode = ["n"];
               silent = true;
               action = "<cmd>lua vim.lsp.buf.code_action()<CR>";
               desc = "Code action";
@@ -127,7 +147,7 @@ in
             # Rename symbol
             {
               key = "<leader>r";
-              mode = [ "n" ];
+              mode = ["n"];
               silent = true;
               action = "<cmd>lua vim.lsp.buf.rename()<CR>";
               desc = "Rename symbol";
@@ -135,21 +155,21 @@ in
             # Diagnostics
             {
               key = "<leader>e";
-              mode = [ "n" ];
+              mode = ["n"];
               silent = true;
               action = "<cmd>lua vim.diagnostic.open_float()<CR>";
               desc = "Show diagnostic";
             }
             {
               key = "[d";
-              mode = [ "n" ];
+              mode = ["n"];
               silent = true;
               action = "<cmd>lua vim.diagnostic.goto_prev()<CR>";
               desc = "Previous diagnostic";
             }
             {
               key = "]d";
-              mode = [ "n" ];
+              mode = ["n"];
               silent = true;
               action = "<cmd>lua vim.diagnostic.goto_next()<CR>";
               desc = "Next diagnostic";
@@ -157,7 +177,6 @@ in
           ];
 
           options = {
-
             # line numbers
             number = true;
             numberwidth = 2;
@@ -168,7 +187,6 @@ in
             shiftwidth = 2;
             softtabstop = -1;
             expandtab = true;
-            smarttab = true;
             autoindent = true;
 
             # search
@@ -191,14 +209,15 @@ in
           };
 
           languages = {
-            #           enableTreesitter = isLinux;
             enableTreesitter = true;
 
             nix = {
               enable = true;
+              treesitter.enable = true;
+              treesitter.package = pkgs.vimPlugins.nvim-treesitter.grammarPlugins.nix;
               format = {
                 enable = true;
-                type = [ "alejandra" ];
+                type = ["alejandra"];
                 #type = "nixfmt";
               };
             };

users/blake/dots/core/ssh/default.nix

@@ -18,7 +18,7 @@ in {
     programs.ssh = {
       enable = true;
       enableDefaultConfig = false;
-      matchBlocks = {
+      settings = {
         "*" = {
           identityFile = "${home_dir}/.ssh/id_blake";
           forwardAgent = false;
@@ -32,32 +32,38 @@ in {
           controlPath = "~/.ssh/master-%r@%n:%p";
           controlPersist = "no";
         };
-        "git.blakedheld.xyz" = {
+        "git.holocron.blue" = {
           user = "gitea";
           port = 7567;
         };
-        "git.snowbelle.lan" = {
+        "git.lumiose.holocron.blue" = {
           user = "gitea";
           port = 7567;
         };
-        "bebe" = {
+        "shauna" = {
           hostname = "10.10.0.1";
           user = "root";
         };
         "snowbelle" = {
           hostname = "10.10.0.10";
           user = "blake";
+          identityFile = "${home_dir}/.ssh/id_snowbelle";
         };
         "vaniville" = {
           hostname = "96.126.127.102";
           user = "blake";
         };
+        "lumiose" = {
+          hostname = "10.10.0.11";
+          user = "blake";
+          identityFile = "${home_dir}/.ssh/id_snowbelle";
+        };
       };
     };
 
     # manage secrets with sops
     sops.secrets = {
-     "id_blake" = {
+      "id_blake" = {
         mode = "0600";
         path = "${home_dir}/.ssh/id_blake";
       };

users/blake/dots/core/xdg/default.nix

@@ -14,37 +14,38 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    home.packages = with pkgs; [xdg-ninja ];
+    home.packages = with pkgs; [xdg-ninja];
 
     xdg = {
+      enable = true;
+
+      configHome = "${home_dir}/.config";
+      cacheHome = "${home_dir}/.cache";
+      dataHome = "${home_dir}/.local/share";
+      stateHome = "${home_dir}/.local/state";
+
+      userDirs = lib.mkIf isLinux {
         enable = true;
-
-        configHome = "${home_dir}/.config";
-        cacheHome = "${home_dir}/.cache";
-        dataHome = "${home_dir}/.local/share";
-        stateHome = "${home_dir}/.local/state";
-
-        userDirs = lib.mkIf isLinux {
-          enable = true;
-          # writes ~/.config/user-dirs.dirs
-          desktop = "${home_dir}/desktop";
-          download = "${home_dir}/downloads";
-          documents = "${home_dir}/documents";
-          pictures = "${home_dir}/pictures";
-          videos = "${home_dir}/videos";
-          music = "${home_dir}/music";
-          publicShare = "${home_dir}/public";
-          templates = "${home_dir}/templates";
-        };
-
-        mimeApps = lib.mkIf isLinux {
-          enable = true;
-          defaultApplications = {
-            "application/pdf" = ["org.pwmt.zathura.desktop"];
-          };
-        };        
+        setSessionVariables = true;
+        # writes ~/.config/user-dirs.dirs
+        desktop = "${home_dir}/desktop";
+        download = "${home_dir}/downloads";
+        documents = "${home_dir}/documents";
+        pictures = "${home_dir}/pictures";
+        videos = "${home_dir}/videos";
+        music = "${home_dir}/music";
+        publicShare = "${home_dir}/public";
+        templates = "${home_dir}/templates";
       };
 
+      mimeApps = lib.mkIf isLinux {
+        enable = true;
+        defaultApplications = {
+          "application/pdf" = ["org.pwmt.zathura.desktop"];
+        };
+      };
+    };
+
     # misc env variables to get things out of ~ (<3 xdg-ninja)
     home.sessionVariables = {
       GOPATH = "$XDG_DATA_HOME/go";

users/blake/dots/core/zsh/default.nix

@@ -7,6 +7,7 @@
   program = "zsh";
   cfg = config.dots.${program};
   home_dir = config.home.homeDirectory;
+  isDarwin = pkgs.stdenv.isDarwin;
   #sec = sops.secrets;
 in {
   options.dots.${program} = {
@@ -23,7 +24,6 @@ in {
     programs.${program} = {
       enable = true;
       dotDir = "${config.xdg.configHome}/zsh";
-      #dotDir = ".config/zsh";
       autocd = true;
       enableCompletion = true;
 
@@ -41,72 +41,99 @@ in {
         path = "$XDG_STATE_HOME/zsh/history";
       };
 
-      shellAliases = {
-        # --- zsh ---
-        cfz = "nvim ${home_dir}/.config/zsh/.zshrc";
-        src = "source ${home_dir}/.config/zsh/.zshrc";
+      shellAliases =
+        {
+          # --- zsh ---
+          src = "source ${home_dir}/.config/zsh/.zshrc";
 
-        # --- config editing ---
-        cfl = "nvim ${home_dir}/.config/lf/lfrc";
+          # --- config editing ---
+          cfl = "nvim /home/blake/.nix/users/blake/dots/core/lf/lfrc";
+          cfz = "nvim /home/blake/.nix/users/blake/dots/core/zsh/default.nix";
+          cfv = "sudo lf /var/lib";
 
-        # --- navigation ---
-        ls = "ls --color=auto --group-directories-first";
-        ll = "ls -lh --color=auto --group-directories-first";
-        la = "ls -Alh --color=auto --group-directories-first";
-        ".." = "cd ..";
-        "..." = "cd ../..";
-        fs = "du -h | sort -h";
-        ds = "du -hs";
-        gn = "cd ${home_dir}/.nix";
-        woopa = "echo backwhack";
+          # --- navigation ---
+          #          ls = "ls --color=auto --group-directories-first";
+          #          ll = "ls -lh --color=auto --group-directories-first";
+          #          la = "ls -Alh --color=auto --group-directories-first";
+          ".." = "cd ..";
+          "..." = "cd ../..";
+          fs = "du -h | sort -h";
+          ds = "du -hs";
+          gn = "cd ${home_dir}/.nix";
+          woopa = "echo backwhack";
 
-        # --- shortcuts ---
-        vswap = "cd ${home_dir}/.local/state/nvim/swap";
-        rswap = "rm ${home_dir}/.local/state/nvim/swap/*";
-        v = "nvim";
-        sv = "sudo nvim";
-        vim = "nvim";
-        mime-type = "xdg-mime query filetype";
-        mime-default = "xdg-mime query default";
+          # --- shortcuts ---
+          vswap = "cd ${home_dir}/.local/state/nvim/swap";
+          rswap = "rm ${home_dir}/.local/state/nvim/swap/*";
+          v = "nvim";
+          sv = "sudo nvim";
+          vim = "nvim";
+          mime-type = "xdg-mime query filetype";
+          mime-default = "xdg-mime query default";
 
-        # --- safety ---
-        cp = "cp -iv";
-        mv = "mv -iv";
-        rm = "rm -Iv";
+          # --- safety ---
+          cp = "cp -iv";
+          mv = "mv -iv";
+          rm = "rm -Iv";
 
-        # --- colors ---
-        grep = "grep --color=auto";
-        fgrep = "fgrep --color=auto";
-        egrep = "egrep --color=auto";
+          # --- colors ---
+          grep = "grep --color=auto";
+          fgrep = "fgrep --color=auto";
+          egrep = "egrep --color=auto";
 
-        # --- scripts ---
-        motd = "sh /etc/motd";
-        rebuild = "sh ${home_dir}/.nix/bin/rebuild";
-        perms = "sudo sh ${home_dir}/.nix/bin/fix-perms";
+          # --- scripts ---
+          motd = "sh /etc/motd";
+          rebuild = "sh ${home_dir}/.nix/bin/rebuild";
+          perms = "sudo sh ${home_dir}/.nix/bin/fix-perms";
 
-        # --- git ---
-        status = "git status";
-        add = "git add";
-        commit = "git commit";
-        push = "git push";
-        pull = "git pull";
-        dotfiles = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
-        dtf = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
-        sec = "sops ${home_dir}/.nix/secrets/secrets.yaml";
+          # --- git ---
+          status = "git status";
+          add = "git add";
+          commit = "git commit";
+          push = "git push";
+          pull = "git pull";
+          dotfiles = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
+          dtf = "/usr/bin/git --git-dir=${home_dir}/.dotfiles --work-tree=$HOME";
 
-        # --- systemd ---
-        stat = "sudo systemctl status";
-        restart = "sudo systemctl restart";
-        start = "sudo systemctl start";
-        stop = "sudo systemctl stop";
-        jou = "sudo journalctl -xeu";
-        live = "sudo journalctl -o short-iso -n 50 -fu";
+          # nix shit
+          sec = "sops ${home_dir}/.nix/secrets/secrets.yaml";
 
-        # --- system ---
-        peace = "systemctl poweroff";
-        love = "systemctl reboot";
-        lock = "loginctl lock-session";
-      };
+          # zfs
+          dfzfs = "zfs list -r -o name,used,usedsnap,usedds";
+
+          # --- yt-dlp ---
+          yt-music = "noglob yt-dlp -f 'bestaudio/best' --extract-audio --audio-format opus --audio-quality 0 --embed-metadata --embed-thumbnail -o '%(playlist_index)02d - %(title)s.%(ext)s'";
+
+          # --- dumb shit ---
+          fix-music = "sudo find /holocron/media/music -type d -exec chmod 2770 {} + && sudo find /holocron/media/music -type f -exec chmod 660 {} +";
+
+          # --- systemd ---
+          stat = "sudo systemctl status";
+          restart = "sudo systemctl restart";
+          start = "sudo systemctl start";
+          stop = "sudo systemctl stop";
+          jou = "sudo journalctl -xeu";
+          live = "sudo journalctl -o short-iso -n 50 -fu";
+
+          # --- system ---
+          peace = "systemctl poweroff";
+          love = "systemctl reboot";
+          lock = "loginctl lock-session";
+        }
+        # use GNU core utils ls on macos
+        // (
+          if isDarwin
+          then {
+            ls = "gls --color=auto --group-directories-first";
+            ll = "gls -lh --color=auto --group-directories-first";
+            la = "gls -Alh --color=auto --group-directories-first";
+          }
+          else {
+            ls = "ls --color=auto --group-directories-first";
+            ll = "ls -lh --color=auto --group-directories-first";
+            la = "ls -Alh --color=auto --group-directories-first";
+          }
+        );
 
       initContent = ''
 
@@ -117,6 +144,7 @@ in {
         alias lf='lfcd'
         lfcd () {cd "$(command lf -print-last-dir "$@")"}
 
+
       '';
 
       syntaxHighlighting = {

users/blake/dots/desktop/cursor/default.nix

@@ -27,7 +27,6 @@ in {
       default = 64;
       description = "cursor size to use";
     };
-
   };
 
   config = lib.mkIf cfg.enable {
@@ -49,6 +48,8 @@ in {
     #      XCURSOR_THEME = cfg.cursor;
     #    };
 
+    #gtk.gtk4.theme = null;
+
     home.pointerCursor = {
       dotIcons.enable = false;
       enable = true;
@@ -62,6 +63,5 @@ in {
         size = 64;
       };
     };
-
   };
 }

users/blake/dots/desktop/default.nix

@@ -10,6 +10,7 @@
     ./waybar
     ./stylix
     ./hypr
+    ./kde
     ./tofi
     ./clipboard
     ./cursor