syncthing bullshit

flake.lock

@@ -106,16 +106,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1786945682,
-        "narHash": "sha256-VBESSoJccikdhxh3vp3SQeG7cZXTOulMvVkoSqNDEhs=",
+        "lastModified": 1788591592,
+        "narHash": "sha256-NbwVKwKLFl0oXub7oPjvmDaOygCtV2oboeKTu4xXFTk=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "5b90e281d4e0c8fbd6ca4d8358276fb305b8d0bd",
+        "rev": "08e85c4e42f5d8f1ea17c36cb59cf61c2ccb26c3",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "6.0.18",
+        "ref": "6.0.22",
         "repo": "brew",
         "type": "github"
       }
@@ -126,11 +126,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1787004344,
-        "narHash": "sha256-/YbaX3cVP54l6Ol8qgS/K8H+Hu8zgyOgUVDLTv70txE=",
+        "lastModified": 1789598303,
+        "narHash": "sha256-hyAB8PqtE+2NPbXqFWFOVessao4ccpsQq6hKBfZPN0w=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "6115eb452d2c2bbdeef5d19098fac17db69ddaa8",
+        "rev": "6867ccc51181e7965445c3d158ddddf9a8fd817e",
         "type": "github"
       },
       "original": {
@@ -566,11 +566,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787377438,
-        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
+        "lastModified": 1789267039,
+        "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
+        "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
         "type": "github"
       },
       "original": {
@@ -587,11 +587,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787487906,
-        "narHash": "sha256-zIdM+8teujHm5hc5MIPDnV7k2UeOOT/pFyFtWjOCwsY=",
+        "lastModified": 1789676441,
+        "narHash": "sha256-mOvO5VvycuBtOUe5EYI54vrLsWe+2KF/82fmwKooe48=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "cfba7ad5886b342b8dd63ba74354b3853ea4cfc9",
+        "rev": "9d485f74cd27d17126ee34cb31005c39d20f741f",
         "type": "github"
       },
       "original": {
@@ -753,11 +753,11 @@
         "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1787330919,
-        "narHash": "sha256-LslMncqN7uOOH5S88WZtO/EVt2HwD8ltUnfyANk+mC0=",
+        "lastModified": 1788981439,
+        "narHash": "sha256-fEaFq0XgpgWFPLfpq1UK4/8ylHd2T0+fo6O3hKz1LUM=",
         "owner": "zhaofengli",
         "repo": "nix-homebrew",
-        "rev": "b00218e4aec0e5bf07d61a0bb13f842faa582d7b",
+        "rev": "09a921d0181146cf6163ec2cc1db7b6fd539a885",
         "type": "github"
       },
       "original": {
@@ -806,11 +806,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784642409,
-        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
+        "lastModified": 1789164534,
+        "narHash": "sha256-DoYGPM6QpnYBLWj9gGw6ZwAzIX+HrAVov1BoT+8Jixo=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
+        "rev": "72c92b11bb8289e6651c7fef29cc0a885fd6a255",
         "type": "github"
       },
       "original": {
@@ -837,11 +837,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1787360063,
-        "narHash": "sha256-95aJfHyQTLWslCXFVNB0odgmVkpdmDezQwTg9mhqV1E=",
-        "rev": "2c423e03bbafcff28bfadc6781a4a8257f205cb5",
+        "lastModified": 1789546076,
+        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1059570.2c423e03bbaf/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -851,11 +851,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1787204541,
-        "narHash": "sha256-Rb7J0ykni6QA+m5ZC6t5gbBBgkS0xn3bf2fgKpSSbFE=",
-        "rev": "5880666fd9eb563038431edb35c2d0aa595884e6",
+        "lastModified": 1789542786,
+        "narHash": "sha256-BGtBoaZNpOPDEBLTiWNFdYppnDjGhwrUq5/P15QwrrM=",
+        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.8111.5880666fd9eb/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9904.4c7870105e7f/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -944,11 +944,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1787432068,
-        "narHash": "sha256-IwY4Dfd5xCnNo66Jx2CCyVRkIuZ9ub59v8+E6kVVlIY=",
+        "lastModified": 1789510188,
+        "narHash": "sha256-umec9LKkWjK89Yx4XpvQStkgfKvhK7GjVf5m21bjzKU=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "45ad22485d23bf131e3543eb7de16d0adf274e8b",
+        "rev": "cdc7e7aaa7eb521bba1b38f54c3228d52cc31703",
         "type": "github"
       },
       "original": {
@@ -1235,11 +1235,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1786629091,
-        "narHash": "sha256-gkig4nPi1CWc4Z50GBsjE4ygSE7hMpl/TwID2an2Cck=",
+        "lastModified": 1789623319,
+        "narHash": "sha256-kmlp8rPrvrXn58YiaANHKSWUijtUc7pwgerIywosOIM=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "a8627b21b9107c5711c96b84f32a9a4b3d45295f",
+        "rev": "16954c1c360c3dc4d4b3b3e64df59f7e89452cb1",
         "type": "github"
       },
       "original": {
@@ -1334,11 +1334,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1787175104,
-        "narHash": "sha256-tzNjlb0loxeWlipvxSNAUUihloeTZoyGFhEen87yM9k=",
+        "lastModified": 1787771653,
+        "narHash": "sha256-DkkJSBOXWV/mja5Vy8az5g1KpZlsbUwlmH0BsQhowaQ=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "a9e5a76a1b75b137f266e4f445e1eaba82e9783e",
+        "rev": "5e3809851f486e7fc7e84b40f174c74b60ecc784",
         "type": "github"
       },
       "original": {
@@ -1450,11 +1450,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1785142579,
-        "narHash": "sha256-WEPxDMiKt3uGVVu/aorHnIgYYW62mEq2Q+rlN3qH6bg=",
+        "lastModified": 1789394839,
+        "narHash": "sha256-trdjVJKmDBbzgbP8pd+R7iKbGkdRu0nmXgQlBR/hEiU=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "b3aa71a7edfe6af748c23729d1bdec3b499741ff",
+        "rev": "a21f66ccd9f644c3770ccdf287cb380c00192628",
         "type": "github"
       },
       "original": {

hosts/darwin/cen-it-07/configuration.nix

@@ -57,7 +57,7 @@
       formulae = [];
       casks = [];
       commands = [];
-      #taps = ["mhaeuser/mhaeuser"];
+      taps = ["rogeriopradoj/cask-peazip"];
     };
   };
 
@@ -67,12 +67,12 @@
     onActivation = {
       cleanup = "zap";
       autoUpdate = false;
-      upgrade = false;
+      upgrade = true;
     };
 
-    #    taps = [
-    #      "mhaeuser/mhaeuser"
-    #    ];
+    taps = [
+      "rogeriopradoj/cask-peazip"
+    ];
 
     brews = [
       "mas"
@@ -85,6 +85,7 @@
       "linearmouse"
       "betterdisplay"
       "rectangle"
+      "peazip"
     ];
     masApps = {
       # "name" = app_id_number;

hosts/nixos/default.nix

@@ -125,6 +125,10 @@
             command = "/run/current-system/sw/bin/rsync";
             options = ["NOPASSWD"];
           }
+          {
+            command = "/etc/profiles/per-user/blake/bin/lf";
+            options = ["NOPASSWD"];
+          }
         ];
       }
     ];

hosts/nixos/lumiose/configuration.nix

@@ -20,6 +20,7 @@
     #../../../modules/gameservers/srcds
     ../../../modules/gameservers/minecraft_recpro
     ../../../modules/gameservers/minecraft_modded
+    ../../../modules/gameservers/valheim
   ];
 
   home-manager.users.blake.imports = [
@@ -91,6 +92,7 @@
   gameservers = {
     minecraft_recpro.enable = true;
     minecraft_modded.enable = false;
+    valheim.enable = true;
   };
 
   # boot (systemd is going on me)
@@ -111,6 +113,12 @@
   networking = {
     hostName = "lumiose"; # hostname
     hostId = "007f0200";
+    getaddrinfo = {
+      enable = true;
+      precedence = {
+        "::ffff:0:0/96" = 100;
+      };
+    };
     networkmanager = {
       enable = true; # the goat
       dns = "systemd-resolved"; # the backup dancer!
@@ -160,6 +168,7 @@
   boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-amd"];
+  boot.kernelParams = ["ipv6.disable=1"];
   boot.extraModulePackages = [];
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

hosts/nixos/vaniville/configuration.nix

@@ -124,7 +124,7 @@ in {
       enable = true;
       allowedTCPPorts = [22 80 443 25777 25579 7567 21115 21116 21117 21118 21119];
       # tailscale will also need its UDP port open:
-      allowedUDPPorts = [config.services.tailscale.port 25777 21116 25580];
+      allowedUDPPorts = [config.services.tailscale.port 2456 2457 25777 21116 25580];
       trustedInterfaces = ["tailscale0"];
       /*
       iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80        # http
@@ -146,12 +146,16 @@ in {
         iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777  # recpro mc
         iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25579 -j DNAT --to-destination ${snowbelle_ip}:25579  # craftoria mc
         iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25580 -j DNAT --to-destination ${snowbelle_ip}:25580  # craftoria mc voice chat
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2456 -j DNAT --to-destination ${lumiose_ip}:2456     # valheim server
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2457 -j DNAT --to-destination ${lumiose_ip}:2457     # valheim server
 
         # SNAT: ensure replies go back through VPS tailscale IP
         iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
         iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
         iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25579 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc
         iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25580 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc voicechat
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2456 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # valheim server
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2457 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # valheim server
       '';
     };
   };

modules/darwin/apps/default.nix

@@ -23,6 +23,9 @@ in {
         "sl"
         "cowsay"
         "apfel"
+        "yt-dlp"
+        "ffmpeg"
+        "ffmpeg-full"
       ];
       casks = [
         "gnucash"
@@ -43,6 +46,7 @@ in {
         "yacreader"
         "keepassxc"
         "thunderbird"
+        "musicbrainz-picard"
       ];
       masApps = {
         "pages" = 361309726;
@@ -52,6 +56,7 @@ in {
         "darkreader" = 1438243180;
         "ghostery" = 6504861501;
         "privacy" = 6449850851;
+        "flo" = 6529533140;
       };
     };
   };

modules/darwin/gaming/default.nix

@@ -3,8 +3,7 @@
   config,
   lib,
   ...
-}:
-let
+}: let
   service = "gaming";
   cfg = config.darwin.${service};
 in {
@@ -13,7 +12,6 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-
     #    environment.systemPackages = with pkgs; [
     #      uhhh
     #    ];
@@ -25,8 +23,8 @@ in {
         "steam"
         "prismlauncher"
         "discord"
-        "runelite"
-        "jagex"
+        #        "runelite"
+        #        "jagex"
       ];
       masApps = {
       };

modules/darwin/nextdns/default.nix

@@ -16,9 +16,7 @@ in {
     services.${service} = {
       enable = true;
       arguments = [
-        "-config"
-        #        "-profile"
-        "527db2"
+        "-profile 527db2"
       ];
     };
   };

modules/darwin/tailscale/default.nix

@@ -8,23 +8,25 @@
   service = "tailscale";
   cfg = config.darwin.${service};
 in {
-
   options.darwin.tailscale = {
     enable = lib.mkEnableOption "enables tailscale";
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale = {
-      enable = true;
-      #overrideLocalDns = true;
-      #authKeyFile = authkey_file;
-    };
+    #    services.tailscale = {
+    #      enable = true;
+    #      #overrideLocalDns = true;
+    #      #authKeyFile = authkey_file;
+    #    };
 
-    homebrew = {
-      casks = [
-        "tailscale-app"
-      ];
-    };
+    #    environment.systemPackages = with pkgs; [
+    #      tailscale-gui
+    #    ];
 
+    #    homebrew = {
+    #      casks = [
+    #        "tailscale-app"
+    #      ];
+    #    };
   };
 }

modules/darwin/work/default.nix

@@ -8,17 +8,16 @@
   service = "work";
   cfg = config.darwin.${service};
 in {
-
   options.darwin.work = {
     enable = lib.mkEnableOption "installs apps for work";
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale = {
-      enable = true;
-      #overrideLocalDns = true;
-      #authKeyFile = authkey_file;
-    };
+    #    services.tailscale = {
+    #      enable = true;
+    #      #overrideLocalDns = true;
+    #      #authKeyFile = authkey_file;
+    #    };
 
     homebrew = {
       casks = [
@@ -27,11 +26,11 @@ in {
         "microsoft-office"
         "jump-desktop"
         "wifiman"
+        "adobe-acrobat-pro"
       ];
       masApps = {
         "configurator" = 1037126344;
       };
     };
-
   };
 }

modules/fileshares/holocron/syncthing/default.nix

@@ -38,14 +38,14 @@ in {
             path = "/holocron/users/blake/holocron";
             devices = ["piplup" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
             id = "5voxg-c3he2";
-            versioning = {
-              type = "staggered";
-              fsPath = "/holocron/users/blake/holocron/.stversions";
-              params = {
-                cleanInterval = "3600";
-                maxAge = "0";
-              };
-            };
+            #            versioning = {
+            #              type = "staggered";
+            #              fsPath = "/holocron/users/blake/holocron/.stversions";
+            #              params = {
+            #                cleanInterval = "3600";
+            #                maxAge = "0";
+            #              };
+            #            };
           };
         };
         options = {

modules/gameservers/valheim/default.nix

@@ -0,0 +1,149 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  nixservice = "podman-valheim";
+  service = "valheim";
+  cfg = config.gameservers.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.gameservers.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 2456;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/gameservers/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    motd_gs = lib.mkOption {
+      type = lib.types.nullOr (lib.types.listOf lib.types.str);
+      default = ["podman-valheim"];
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "enable backups for ${service}";
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/backup/gameservers/valheim";
+      description = "path to take hourly backups to with borg!";
+    };
+    offsite_user = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat.holocron.blue";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat/holocron/archives/gameservers";
+      description = "path to rsync offsite backups to";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    virtualisation.oci-containers.containers = {
+      ${service} = {
+        image = "ghcr.io/community-valheim-tools/valheim-server";
+        autoStart = true;
+        extraOptions = [
+          "--cap-add=sys_nice"
+          "--stop-timeout=120"
+        ];
+        ports = [
+          "2456-2457:2456-2457/udp"
+          "2456:80/tcp"
+        ];
+        volumes = [
+          "${cfg.data_dir}/config:/config"
+          "${cfg.data_dir}/data:/opt/valheim"
+        ];
+        environment = {
+          SERVER_NAME = "recpro";
+          SERVER_PASS = "recoil727pro";
+          #WORLD_NAME = "";
+          STATUS_HTTP = "true";
+          TZ = homelab.tz;
+          PUID = toString config.users.users.${service}.uid;
+          PGID = toString config.users.groups.${service}.gid;
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+    networking.firewall.allowedUDPPorts = [2456 2457];
+
+    # backups valhiem with borg!
+    services.borgbackup.jobs.${service} = {
+      archiveBaseName = service;
+      repo = cfg.backup_repo;
+      paths = cfg.data_dir;
+      compression = "auto,zstd";
+      #preHook = "systemctl start mysql-backup.service";
+      postHook = ''
+        ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+      '';
+      startAt = "*-*-* *:00:00";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        hourly = 24;
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+  };
+}

modules/homelab/mediastack/default.nix

@@ -27,12 +27,13 @@ in {
 
   # the order determines the order in glance :3
   imports = [
-    ./bazarr
-    ./prowlarr
-    ./radarr
-    ./qbittorrent
-    ./sonarr
     ./yacreader
+    ./bazarr
+    ./qbittorrent
+    ./prowlarr
+    ./lidarr
+    ./radarr
+    ./sonarr
     ./audiobookshelf
     ./navidrome
     ./jellyfin
@@ -57,6 +58,7 @@ in {
     homelab.prowlarr.enable = lib.mkDefault true;
     homelab.radarr.enable = lib.mkDefault true;
     homelab.sonarr.enable = lib.mkDefault true;
+    homelab.lidarr.enable = lib.mkDefault true;
     homelab.audiobookshelf.enable = lib.mkDefault true;
     homelab.navidrome.enable = lib.mkDefault true;
     homelab.flaresolverr.enable = lib.mkDefault true;

modules/homelab/mediastack/jellyfin/default.nix

@@ -62,6 +62,7 @@ in {
     # enable the ${service} service
     services.${service} = {
       enable = true;
+      package = pkgs.unstable.jellyfin;
       openFirewall = true;
       user = service;
       group = service;

modules/homelab/mediastack/lidarr/default.nix

@@ -0,0 +1,108 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "lidarr";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7109;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # required
+    environment.systemPackages = with pkgs; [ffmpeg_6-headless yt-dlp];
+
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      openFirewall = true;
+      user = service;
+      group = service;
+      dataDir = cfg.data_dir;
+      settings = {
+        server.port = cfg.port;
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      #      User = service;
+      #      Group = service;
+    };
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port}
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/mediastack/navidrome/default.nix

@@ -64,20 +64,26 @@ in {
       openFirewall = true;
       user = service;
       group = service;
-      plugins = [
-      ];
+      #      plugins = [
+      #      ];
+      environmentFile = "${cfg.data_dir}/navidrome.env";
       settings = {
         Address = "0.0.0.0";
         Port = cfg.port;
         MusicFolder = "/holocron/media/music";
         EnableInsightsCollector = false;
-        Plugins.Enabled = true;
+        LyricsPriority = "nd-lyrics";
+        Plugins = {
+          Enabled = true;
+          #Folder = lib.mkForce "${cfg.data_dir}/plugins";
+        };
       };
     };
 
     # override umask to make permissions work out
     systemd.services.${service}.serviceConfig = {
       UMask = lib.mkForce "0007";
+      EnvironmentFile = "${cfg.data_dir}/navidrome.env";
     };
 
     # add to caddy for reverse proxy

modules/homelab/network/caddy/default.nix

@@ -58,7 +58,7 @@ in {
         plugins = [
           "github.com/caddy-dns/cloudflare@v0.2.4"
         ];
-        hash = "sha256-PWadA5qr/gR2qDcT8l8u1Xku7LM2HIfWTLOkzezCYy0=";
+        hash = "sha256-dQvk6ezY6TQ1J7PjhCXnThF/SqVgPwBO8/RXzHCY+js=";
         # Replace with the hash from the build error the first time you build.
       };
       email = "me@blakedheld.xyz";

modules/homelab/network/ddns/default.nix

@@ -29,6 +29,7 @@ in {
         "superflat.recoil.pro"
         "skyblock.recoil.pro"
         "cobblemon.recoil.pro"
+        "valheim.recoil.pro"
 
         # blakedheld.xyz
         #"blakedheld.xyz"

modules/homelab/services/vaultwarden/default.nix

@@ -84,8 +84,8 @@ in {
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       serverAliases = ["pass.${homelab.public_domain}"];
+      #tls internal
       extraConfig = ''
-        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/homelab/services/wger/default.nix

@@ -0,0 +1,125 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  nixservice = "wger";
+  service = "wger";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7707;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "podman-wger";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # still suss as fuck bro man fuck
+    virtualisation.oci-containers.containers = {
+      hass = {
+        image = "homeassistant/home-assistant:stable";
+        autoStart = true;
+        extraOptions = [
+          "--pull=newer"
+          "--network=host"
+        ];
+        volumes = [
+          "${cfg.data_dir}:/config"
+        ];
+        environment = {
+          TZ = homelab.tz;
+          PUID = toString config.users.users.${service}.uid;
+          PGID = toString config.users.groups.${service}.gid;
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064];
+    networking.firewall.allowedUDPPorts = [5353];
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["${service}.${homelab.public_domain}"];
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port} {
+
+        header_up Host {host}
+        header_up X-Real-IP {remote_host}
+        header_up X-Forwarded-For {remote_host}
+        header_up X-Forwarded-Proto https
+
+        }
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.services = [
+      {
+        title = "wger";
+        url = "https://hass.${homelab.public_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${nixservice}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/system/uptime-kuma/default.nix

@@ -75,9 +75,8 @@ in {
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = ["up.${homelab.public_domain}"];
+      #serverAliases = ["up.${homelab.public_domain}"];
       extraConfig = ''
-        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

users/blake/dots/core/lf/lfrc

@@ -23,9 +23,9 @@ set ignorecase true
 
 # shortcuts
 map gb cd /holocron
-map gz cd %{{ [ -d /holocron ] && printf /holocron || printf /media/holocron }}
 map gn cd ~/.nix
 map gc cd ~/.config
+map gv cd /var/lib
 
 # navigation
 map [ half-up

users/blake/dots/core/zsh/default.nix

@@ -7,6 +7,7 @@
   program = "zsh";
   cfg = config.dots.${program};
   home_dir = config.home.homeDirectory;
+  isDarwin = pkgs.stdenv.isDarwin;
   #sec = sops.secrets;
 in {
   options.dots.${program} = {
@@ -23,7 +24,6 @@ in {
     programs.${program} = {
       enable = true;
       dotDir = "${config.xdg.configHome}/zsh";
-      #dotDir = ".config/zsh";
       autocd = true;
       enableCompletion = true;
 
@@ -41,18 +41,20 @@ in {
         path = "$XDG_STATE_HOME/zsh/history";
       };
 
-      shellAliases = {
+      shellAliases =
+        {
           # --- zsh ---
           src = "source ${home_dir}/.config/zsh/.zshrc";
 
           # --- config editing ---
           cfl = "nvim /home/blake/.nix/users/blake/dots/core/lf/lfrc";
           cfz = "nvim /home/blake/.nix/users/blake/dots/core/zsh/default.nix";
+          cfv = "sudo lf /var/lib";
 
           # --- navigation ---
-        ls = "ls --color=auto --group-directories-first";
-        ll = "ls -lh --color=auto --group-directories-first";
-        la = "ls -Alh --color=auto --group-directories-first";
+          #          ls = "ls --color=auto --group-directories-first";
+          #          ll = "ls -lh --color=auto --group-directories-first";
+          #          la = "ls -Alh --color=auto --group-directories-first";
           ".." = "cd ..";
           "..." = "cd ../..";
           fs = "du -h | sort -h";
@@ -99,6 +101,12 @@ in {
           # zfs
           dfzfs = "zfs list -r -o name,used,usedsnap,usedds";
 
+          # --- yt-dlp ---
+          yt-music = "noglob yt-dlp -f 'bestaudio/best' --extract-audio --audio-format opus --audio-quality 0 --embed-metadata --embed-thumbnail -o '%(playlist_index)02d - %(title)s.%(ext)s'";
+
+          # --- dumb shit ---
+          fix-music = "sudo find /holocron/media/music -type d -exec chmod 2770 {} + && sudo find /holocron/media/music -type f -exec chmod 660 {} +";
+
           # --- systemd ---
           stat = "sudo systemctl status";
           restart = "sudo systemctl restart";
@@ -111,7 +119,21 @@ in {
           peace = "systemctl poweroff";
           love = "systemctl reboot";
           lock = "loginctl lock-session";
-      };
+        }
+        # use GNU core utils ls on macos
+        // (
+          if isDarwin
+          then {
+            ls = "gls --color=auto --group-directories-first";
+            ll = "gls -lh --color=auto --group-directories-first";
+            la = "gls -Alh --color=auto --group-directories-first";
+          }
+          else {
+            ls = "ls --color=auto --group-directories-first";
+            ll = "ls -lh --color=auto --group-directories-first";
+            la = "ls -Alh --color=auto --group-directories-first";
+          }
+        );
 
       initContent = ''
 
@@ -122,6 +144,7 @@ in {
         alias lf='lfcd'
         lfcd () {cd "$(command lf -print-last-dir "$@")"}
 
+
       '';
 
       syntaxHighlighting = {