syncthing bullshit

bin/git_upstream

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+cd /home/blake/.nix
+git remote remove origin                 
+git remote add origin ssh://gitea@git.holocron.blue:7567/blake/nix.git
+git fetch
+git branch --set-upstream-to=origin/trunk trunk

flake.lock

@@ -106,16 +106,16 @@
     "brew-src": {
       "flake": false,
       "locked": {
-        "lastModified": 1785146564,
+        "lastModified": 1788591592,
-        "narHash": "sha256-Sa7/HrfB04H32OJ7/ofxXjiZEbkWtCNOriONYYTL1OA=",
+        "narHash": "sha256-NbwVKwKLFl0oXub7oPjvmDaOygCtV2oboeKTu4xXFTk=",
         "owner": "Homebrew",
         "repo": "brew",
-        "rev": "b2cfc03346d482f79886de108fee5dc49a6efc10",
+        "rev": "08e85c4e42f5d8f1ea17c36cb59cf61c2ccb26c3",
         "type": "github"
       },
       "original": {
         "owner": "Homebrew",
-        "ref": "6.0.13",
+        "ref": "6.0.22",
         "repo": "brew",
         "type": "github"
       }
@@ -126,11 +126,11 @@
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1785436771,
+        "lastModified": 1789598303,
-        "narHash": "sha256-MppnC7CwEcA6oFwHfpEythJq9Z6kzoccxJ12IUl98Dc=",
+        "narHash": "sha256-hyAB8PqtE+2NPbXqFWFOVessao4ccpsQq6hKBfZPN0w=",
         "owner": "9001",
         "repo": "copyparty",
-        "rev": "9f5f9d8884605aee3586d7bd9e48005d56c6afb6",
+        "rev": "6867ccc51181e7965445c3d158ddddf9a8fd817e",
         "type": "github"
       },
       "original": {
@@ -277,11 +277,11 @@
     "firefox-gnome-theme": {
       "flake": false,
       "locked": {
-        "lastModified": 1782007937,
+        "lastModified": 1783570805,
-        "narHash": "sha256-PbnJr+eB+9Czol3ReI83dUgEhcn0sDK6TSy6ODTQm88=",
+        "narHash": "sha256-ptl5aRlCv9/uRSv2u8Hq8UFVFeZ6Q/bT049bpqNgc3w=",
         "owner": "rafaelmardojai",
         "repo": "firefox-gnome-theme",
-        "rev": "981bd332015397fb1ca033fa982bd61635160c78",
+        "rev": "5602ed62d638142c1ab31dccd01dfbfb28841225",
         "type": "github"
       },
       "original": {
@@ -566,11 +566,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785119570,
+        "lastModified": 1789267039,
-        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
+        "narHash": "sha256-LWiBv9yAYFi2LPbUhDGHPGKYskJQjj2fw12OlyO1uQo=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
+        "rev": "ec172013fa62135f58fb58dd17ae9651e8f39727",
         "type": "github"
       },
       "original": {
@@ -587,11 +587,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785531816,
+        "lastModified": 1789676441,
-        "narHash": "sha256-vkMnV0JIyw+g/NmcfoajlGaAO+9a0ezia+FZohQJrik=",
+        "narHash": "sha256-mOvO5VvycuBtOUe5EYI54vrLsWe+2KF/82fmwKooe48=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "bf9ce9fec78f95f374e8dd3b503863a3ec128ebe",
+        "rev": "9d485f74cd27d17126ee34cb31005c39d20f741f",
         "type": "github"
       },
       "original": {
@@ -718,11 +718,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785389976,
+        "lastModified": 1786845137,
-        "narHash": "sha256-0tLW8Ff5yt8AH97jw4ZpFJ0OCJ122zIlgWGDmOfU/VU=",
+        "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
         "owner": "nix-darwin",
         "repo": "nix-darwin",
-        "rev": "15abb8c98f336cd8bd840d71059adebabe60bf04",
+        "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
         "type": "github"
       },
       "original": {
@@ -753,11 +753,11 @@
         "brew-src": "brew-src"
       },
       "locked": {
-        "lastModified": 1785544760,
+        "lastModified": 1788981439,
-        "narHash": "sha256-qV6OoNuly4ntqpCg7esIeJjUboxSnQNlLPxz+y5h9/o=",
+        "narHash": "sha256-fEaFq0XgpgWFPLfpq1UK4/8ylHd2T0+fo6O3hKz1LUM=",
         "owner": "zhaofengli",
         "repo": "nix-homebrew",
-        "rev": "937ce52c7d046310571f3a070713804ead496843",
+        "rev": "09a921d0181146cf6163ec2cc1db7b6fd539a885",
         "type": "github"
       },
       "original": {
@@ -806,11 +806,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784642409,
+        "lastModified": 1789164534,
-        "narHash": "sha256-hcbDqFuySAJawljt5r0sKBCJKYnbtGD0T/ZIozH1Dq0=",
+        "narHash": "sha256-DoYGPM6QpnYBLWj9gGw6ZwAzIX+HrAVov1BoT+8Jixo=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "eaeb18da90024448a60eb1ec7132eafa4003404e",
+        "rev": "72c92b11bb8289e6651c7fef29cc0a885fd6a255",
         "type": "github"
       },
       "original": {
@@ -837,11 +837,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1785454630,
+        "lastModified": 1789546076,
-        "narHash": "sha256-Lr/ImHlbXabw7KPWfXWY4kkiiHb24PkmBZVVIm28V/c=",
+        "narHash": "sha256-vWkSk5bbfTqdtMoSgD9FshACO8JCvXTFi+3cqEp0mH0=",
-        "rev": "1559d3daa3ecc813a650b79375ea61b6741b8746",
+        "rev": "b1b875982b17dabde9b4a37f3e229e74913e6db3",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1044798.1559d3daa3ec/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.11pre1074753.b1b875982b17/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -851,11 +851,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1785491804,
+        "lastModified": 1789542786,
-        "narHash": "sha256-GGQER+O/plhJCG35JVsKYVwI8qtOKR7UB4E3e8DBKmQ=",
+        "narHash": "sha256-BGtBoaZNpOPDEBLTiWNFdYppnDjGhwrUq5/P15QwrrM=",
-        "rev": "5b4f72e1705a63aace42900610c4db82cb4af0ec",
+        "rev": "4c7870105e7f1fdf9c48688c8d7efc21abf0688a",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.6603.5b4f72e1705a/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.9904.4c7870105e7f/nixexprs.tar.zst"
       },
       "original": {
         "id": "nixpkgs",
@@ -922,11 +922,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783439237,
+        "lastModified": 1785549842,
-        "narHash": "sha256-WUr8JF2v3n4Y30E5dxv4sAgNJXpVDBoCQNoQ/V4+n4o=",
+        "narHash": "sha256-DCwBZmGsySF7oKGTRgEv2HvpxVXkHT+38VhTM76k0B4=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "b70bb66c7bcd162642f3a609bc16843c7059f503",
+        "rev": "a9f987b57594e845e3e5cdd423b9a70846d70308",
         "type": "github"
       },
       "original": {
@@ -944,11 +944,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785524545,
+        "lastModified": 1789510188,
-        "narHash": "sha256-ILww3rsO4JA9bY2pV56Pg/VrRADQmIw/alhpM4eUIYY=",
+        "narHash": "sha256-umec9LKkWjK89Yx4XpvQStkgfKvhK7GjVf5m21bjzKU=",
         "owner": "notashelf",
         "repo": "nvf",
-        "rev": "fbf73761f56c7b41f8095bd1a8fcadefea30a05b",
+        "rev": "cdc7e7aaa7eb521bba1b38f54c3228d52cc31703",
         "type": "github"
       },
       "original": {
@@ -1064,6 +1064,29 @@
         "type": "github"
       }
     },
+    "plasma-manager": {
+      "inputs": {
+        "home-manager": [
+          "home-manager-unstable"
+        ],
+        "nixpkgs": [
+          "nixpkgs-unstable"
+        ]
+      },
+      "locked": {
+        "lastModified": 1785762349,
+        "narHash": "sha256-jZhZkzAwc7f3exzcTDJWP2WCAchCv0iNC3UF/QsahdQ=",
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "rev": "a19a2a029fa180911bd89c554dca1616e10f4c1d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "plasma-manager",
+        "type": "github"
+      }
+    },
     "pre-commit-hooks-nix": {
       "inputs": {
         "flake-compat": [
@@ -1105,6 +1128,7 @@
         "nixpkgs": "nixpkgs_2",
         "nixpkgs-unstable": "nixpkgs-unstable",
         "nvf": "nvf",
+        "plasma-manager": "plasma-manager",
         "slippi": "slippi",
         "sops-nix": "sops-nix",
         "srcds-nix": "srcds-nix",
@@ -1211,11 +1235,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783174389,
+        "lastModified": 1789623319,
-        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "narHash": "sha256-kmlp8rPrvrXn58YiaANHKSWUijtUc7pwgerIywosOIM=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "rev": "16954c1c360c3dc4d4b3b3e64df59f7e89452cb1",
         "type": "github"
       },
       "original": {
@@ -1310,11 +1334,11 @@
         "tinted-zed": "tinted-zed"
       },
       "locked": {
-        "lastModified": 1785518890,
+        "lastModified": 1787771653,
-        "narHash": "sha256-BeXpCHTPZ+ZlRR12nYe/0JHjfp/fgJVY2YV2xAz8JHs=",
+        "narHash": "sha256-DkkJSBOXWV/mja5Vy8az5g1KpZlsbUwlmH0BsQhowaQ=",
         "owner": "nix-community",
         "repo": "stylix",
-        "rev": "6316d1d03e7a12cae7cdb007f34d2eaebbfc802a",
+        "rev": "5e3809851f486e7fc7e84b40f174c74b60ecc784",
         "type": "github"
       },
       "original": {
@@ -1325,15 +1349,16 @@
     },
     "systems": {
       "locked": {
-        "lastModified": 1681028828,
+        "lastModified": 1774449309,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",
         "owner": "nix-systems",
         "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "rev": "c29398b59d2048c4ab79345812849c9bd15e9150",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
+        "ref": "future-26.11",
         "repo": "default",
         "type": "github"
       }
@@ -1357,11 +1382,11 @@
     "tinted-schemes": {
       "flake": false,
       "locked": {
-        "lastModified": 1781968807,
+        "lastModified": 1785153830,
-        "narHash": "sha256-yYO3Vw2M0y3TAUqt+9+Mj0zwP3XDTF5/PXcPhhFQ1ZM=",
+        "narHash": "sha256-fNdfCTeCXU3tZG3TMincd+u68qBHQgCr2Ljr/M1mWP0=",
         "owner": "tinted-theming",
         "repo": "schemes",
-        "rev": "2ccef2f4b22e3cab5a9292811f7133a07eeba4a7",
+        "rev": "9bd28ed313560db3c5b605c63bc4e309e78e3fc8",
         "type": "github"
       },
       "original": {
@@ -1373,11 +1398,11 @@
     "tinted-tmux": {
       "flake": false,
       "locked": {
-        "lastModified": 1782012462,
+        "lastModified": 1785031658,
-        "narHash": "sha256-2iDiD8DQLwS1lGuD9TS8WlvNyDoTs6krWntJbtB2zGo=",
+        "narHash": "sha256-mZp9O2LjzdMzlqQF3l3fjqsuPBzXy+1qTfBEUGjTlpk=",
         "owner": "tinted-theming",
         "repo": "tinted-tmux",
-        "rev": "8c4e750f738a742bd73377ee41d3dadedebedef4",
+        "rev": "5d2c67f61ea7af36f16865ab6d541cdba41dc257",
         "type": "github"
       },
       "original": {
@@ -1389,11 +1414,11 @@
     "tinted-zed": {
       "flake": false,
       "locked": {
-        "lastModified": 1782009766,
+        "lastModified": 1785030526,
-        "narHash": "sha256-VUhBjpGvWqHI7rWeyMYb/u87YJSXHKfVV6S+IelWeO8=",
+        "narHash": "sha256-klZf8UviewRkxuu74Bhbq6tqy7oxebQC7UVRWbbtQxU=",
         "owner": "tinted-theming",
         "repo": "base16-zed",
-        "rev": "5e8350bcd354e3241ab681a265fa6ef060c40be1",
+        "rev": "16f5a8adf4a6b1310d0a61ab172de963e8f76a02",
         "type": "github"
       },
       "original": {
@@ -1425,11 +1450,11 @@
     },
     "vpn-confinement": {
       "locked": {
-        "lastModified": 1785142579,
+        "lastModified": 1789394839,
-        "narHash": "sha256-WEPxDMiKt3uGVVu/aorHnIgYYW62mEq2Q+rlN3qH6bg=",
+        "narHash": "sha256-trdjVJKmDBbzgbP8pd+R7iKbGkdRu0nmXgQlBR/hEiU=",
         "owner": "Maroka-chan",
         "repo": "VPN-Confinement",
-        "rev": "b3aa71a7edfe6af748c23729d1bdec3b499741ff",
+        "rev": "a21f66ccd9f644c3770ccdf287cb380c00192628",
         "type": "github"
       },
       "original": {

flake.nix

@@ -19,6 +19,11 @@
       url = "github:nix-community/home-manager";
       inputs.nixpkgs.follows = "nixpkgs-unstable";
     };
+    plasma-manager = {
+      url = "github:nix-community/plasma-manager";
+      inputs.nixpkgs.follows = "nixpkgs-unstable";
+      inputs.home-manager.follows = "home-manager-unstable";
+    };
     nix-homebrew.url = "github:zhaofengli/nix-homebrew";
     nix-flatpak.url = "github:gmodena/nix-flatpak/?ref=latest";
     sops-nix = {
@@ -70,6 +75,7 @@
     nix-darwin,
     nix-homebrew,
     nixos-wsl,
+    plasma-manager,
     ...
   } @ inputs: let
     systems = {

hosts/darwin/cen-it-07/configuration.nix

@@ -15,6 +15,7 @@
   darwin = {
     syncthing.enable = true;
     tailscale.enable = true;
+    nextdns.enable = true;
     yubikey.enable = true;
     work.enable = true;
     apps.enable = true;
@@ -56,7 +57,7 @@
       formulae = [];
       casks = [];
       commands = [];
-      #taps = ["mhaeuser/mhaeuser"];
+      taps = ["rogeriopradoj/cask-peazip"];
     };
   };
 
@@ -66,12 +67,12 @@
     onActivation = {
       cleanup = "zap";
       autoUpdate = false;
-      upgrade = false;
+      upgrade = true;
     };
 
-    #    taps = [
+    taps = [
-    #      "mhaeuser/mhaeuser"
+      "rogeriopradoj/cask-peazip"
-    #    ];
+    ];
 
     brews = [
       "mas"
@@ -84,6 +85,7 @@
       "linearmouse"
       "betterdisplay"
       "rectangle"
+      "peazip"
     ];
     masApps = {
       # "name" = app_id_number;

hosts/nixos/default.nix

@@ -53,7 +53,15 @@
   powerManagement.powertop.enable = true;
 
   # things are better this way
-  users.defaultUserShell = pkgs.zsh;
+  users = {
+    defaultUserShell = pkgs.zsh;
+    users.root = {
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
+      ];
+    };
+  };
 
   # base system package install list
   environment.systemPackages = with pkgs; [
@@ -117,6 +125,10 @@
             command = "/run/current-system/sw/bin/rsync";
             options = ["NOPASSWD"];
           }
+          {
+            command = "/etc/profiles/per-user/blake/bin/lf";
+            options = ["NOPASSWD"];
+          }
         ];
       }
     ];

hosts/nixos/lumiose/configuration.nix

@@ -20,6 +20,7 @@
     #../../../modules/gameservers/srcds
     ../../../modules/gameservers/minecraft_recpro
     ../../../modules/gameservers/minecraft_modded
+    ../../../modules/gameservers/valheim
   ];
 
   home-manager.users.blake.imports = [
@@ -45,14 +46,14 @@
     enable = true;
     base_domain = "lumiose.holocron.blue";
     host_ip = "10.10.0.11";
-    gitea.enable = true;
+    gitea.enable = false;
     glance.enable = true;
     immich = {
       enable = true;
       data_dir = "/holocron/srv/immich";
       backup = false;
     };
-    vaultwarden.enable = true;
+    vaultwarden.enable = false;
     #searx.enable = true;
     # home assistant
     home.enable = true;
@@ -91,6 +92,7 @@
   gameservers = {
     minecraft_recpro.enable = true;
     minecraft_modded.enable = false;
+    valheim.enable = true;
   };
 
   # boot (systemd is going on me)
@@ -111,6 +113,12 @@
   networking = {
     hostName = "lumiose"; # hostname
     hostId = "007f0200";
+    getaddrinfo = {
+      enable = true;
+      precedence = {
+        "::ffff:0:0/96" = 100;
+      };
+    };
     networkmanager = {
       enable = true; # the goat
       dns = "systemd-resolved"; # the backup dancer!
@@ -160,6 +168,7 @@
   boot.initrd.availableKernelModules = ["nvme" "xhci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
   boot.initrd.kernelModules = [];
   boot.kernelModules = ["kvm-amd"];
+  boot.kernelParams = ["ipv6.disable=1"];
   boot.extraModulePackages = [];
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
   hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

hosts/nixos/vaniville/configuration.nix

@@ -30,8 +30,9 @@ in {
     tailscale.enable = false;
   };
   homelab = {
-    base_domain = "vaniville.lan";
+    enable = true;
-    host_ip = "10.10.0.11";
+    base_domain = "vaniville.holocron.blue";
+    host_ip = "100.100.1.10";
     ddns.enable = true;
     uptime-kuma = {
       enable = true;
@@ -41,6 +42,15 @@ in {
       enable = true;
       keys = true;
     };
+    backups = {
+      enable = true;
+      databases = false;
+      homelab = true;
+      backup_repo = "/var/lib/backups/homelab";
+      offsite_dir = "lifeboat/vaniville/homelab";
+    };
+    gitea.enable = true;
+    vaultwarden.enable = true;
     home.enable = false;
   };
 
@@ -114,7 +124,7 @@ in {
       enable = true;
       allowedTCPPorts = [22 80 443 25777 25579 7567 21115 21116 21117 21118 21119];
       # tailscale will also need its UDP port open:
-      allowedUDPPorts = [config.services.tailscale.port 25777 21116 25580];
+      allowedUDPPorts = [config.services.tailscale.port 2456 2457 25777 21116 25580];
       trustedInterfaces = ["tailscale0"];
       /*
       iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${snowbelle_ip}:80        # http
@@ -123,23 +133,29 @@ in {
       iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}     # http
       iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}    # https
       */
+
+      #        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567    # gitea ssh
+      #        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
+
       extraCommands = ''
         # Clear any previous rules if you are iterating
         iptables -t nat -F
 
         # DNAT: internet -> homelab over tailscale
-        iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${lumiose_ip}:7567    # gitea ssh
         iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777  # recpro mc
         iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${lumiose_ip}:25777  # recpro mc
         iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25579 -j DNAT --to-destination ${snowbelle_ip}:25579  # craftoria mc
         iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25580 -j DNAT --to-destination ${snowbelle_ip}:25580  # craftoria mc voice chat
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2456 -j DNAT --to-destination ${lumiose_ip}:2456     # valheim server
+        iptables -t nat -A PREROUTING -i eth0 -p udp --dport 2457 -j DNAT --to-destination ${lumiose_ip}:2457     # valheim server
 
         # SNAT: ensure replies go back through VPS tailscale IP
-        iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # gitea ssh
         iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
         iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}  # recpro mc
         iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25579 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc
         iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25580 -d ${snowbelle_ip}/32 -j SNAT --to-source ${vpsip4}  # craftoria mc voicechat
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2456 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # valheim server
+        iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 2457 -d ${lumiose_ip}/32 -j SNAT --to-source ${vpsip4}   # valheim server
       '';
     };
   };
@@ -169,15 +185,9 @@ in {
       "media.${homelab.public_domain}".extraConfig = ''
         reverse_proxy ${lumiose_ip}:7100
       '';
-      "pass.${homelab.public_domain}".extraConfig = ''
-        reverse_proxy ${lumiose_ip}:7701
-      '';
       "photos.${homelab.public_domain}".extraConfig = ''
         reverse_proxy ${lumiose_ip}:7702
       '';
-      "git.${homelab.public_domain}".extraConfig = ''
-        reverse_proxy ${lumiose_ip}:7703
-      '';
       "hass.${homelab.public_domain}".extraConfig = ''
           reverse_proxy ${lumiose_ip}:7704 {
           header_up Host {host}
@@ -186,6 +196,13 @@ in {
           header_up X-Forwarded-Proto https
         }
       '';
+      # now hosted on vaniville!
+      #      "pass.${homelab.public_domain}".extraConfig = ''
+      #        reverse_proxy 127.0.0.1:7701
+      #      '';
+      #      "git.${homelab.public_domain}".extraConfig = ''
+      #        reverse_proxy localhost:7703
+      #      '';
     };
   };
 

hosts/nixos/yveltal/configuration.nix

@@ -26,7 +26,7 @@
     ssh.enable = true;
     sops.enable = true;
     yubikey.enable = true;
-    yubikey.lock_on_remove = true;
+    yubikey.lock_on_remove = false;
     tailscale.enable = true;
     syncthing.enable = true;
     flatpak.enable = true;
@@ -37,7 +37,7 @@
   };
   desktop = {
     pipewire.enable = true;
-    hypr.enable = true;
+    hypr.enable = false;
     greetd.enable = true;
     kde.enable = true;
   };

modules/darwin/apps/default.nix

@@ -23,6 +23,9 @@ in {
         "sl"
         "cowsay"
         "apfel"
+        "yt-dlp"
+        "ffmpeg"
+        "ffmpeg-full"
       ];
       casks = [
         "gnucash"
@@ -43,6 +46,7 @@ in {
         "yacreader"
         "keepassxc"
         "thunderbird"
+        "musicbrainz-picard"
       ];
       masApps = {
         "pages" = 361309726;
@@ -52,6 +56,7 @@ in {
         "darkreader" = 1438243180;
         "ghostery" = 6504861501;
         "privacy" = 6449850851;
+        "flo" = 6529533140;
       };
     };
   };

modules/darwin/default.nix

@@ -6,6 +6,7 @@
 }: {
   imports = [
     ./tailscale
+    ./nextdns
     ./syncthing
     ./yubikey
     ./work
@@ -13,5 +14,4 @@
     ./cyber
     ./gaming
   ];
-
 }

modules/darwin/gaming/default.nix

@@ -3,8 +3,7 @@
   config,
   lib,
   ...
-}:
+}: let
-let
   service = "gaming";
   cfg = config.darwin.${service};
 in {
@@ -13,10 +12,9 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-
+    #    environment.systemPackages = with pkgs; [
-#    environment.systemPackages = with pkgs; [
+    #      uhhh
-#      uhhh
+    #    ];
-#    ];
 
     homebrew = {
       brews = [
@@ -25,8 +23,8 @@ in {
         "steam"
         "prismlauncher"
         "discord"
-        "runelite"
+        #        "runelite"
-        "jagex"
+        #        "jagex"
       ];
       masApps = {
       };

modules/darwin/nextdns/default.nix

@@ -0,0 +1,23 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  service = "nextdns";
+  cfg = config.darwin.${service};
+in {
+  options.darwin.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.${service} = {
+      enable = true;
+      arguments = [
+        "-profile 527db2"
+      ];
+    };
+  };
+}

modules/darwin/tailscale/default.nix

@@ -8,23 +8,25 @@
   service = "tailscale";
   cfg = config.darwin.${service};
 in {
-
   options.darwin.tailscale = {
     enable = lib.mkEnableOption "enables tailscale";
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale = {
+    #    services.tailscale = {
-      enable = true;
+    #      enable = true;
-      #overrideLocalDns = true;
+    #      #overrideLocalDns = true;
-      #authKeyFile = authkey_file;
+    #      #authKeyFile = authkey_file;
-    };
+    #    };
 
-    homebrew = {
+    #    environment.systemPackages = with pkgs; [
-      casks = [
+    #      tailscale-gui
-        "tailscale-app"
+    #    ];
-      ];
-    };
 
+    #    homebrew = {
+    #      casks = [
+    #        "tailscale-app"
+    #      ];
+    #    };
   };
 }

modules/darwin/work/default.nix

@@ -8,17 +8,16 @@
   service = "work";
   cfg = config.darwin.${service};
 in {
-
   options.darwin.work = {
     enable = lib.mkEnableOption "installs apps for work";
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale = {
+    #    services.tailscale = {
-      enable = true;
+    #      enable = true;
-      #overrideLocalDns = true;
+    #      #overrideLocalDns = true;
-      #authKeyFile = authkey_file;
+    #      #authKeyFile = authkey_file;
-    };
+    #    };
 
     homebrew = {
       casks = [
@@ -27,11 +26,11 @@ in {
         "microsoft-office"
         "jump-desktop"
         "wifiman"
+        "adobe-acrobat-pro"
       ];
       masApps = {
         "configurator" = 1037126344;
       };
     };
-
   };
 }

modules/desktop/kde/default.nix

@@ -12,6 +12,42 @@ in {
 
   config = lib.mkIf cfg.enable {
     # enable kde plasma
-    services.desktopManager.plasma6.enable = true;
+    services = {
+      desktopManager.plasma6.enable = true;
+      #displayManager.sddm.enable = true;
+      #displayManager.sddm.wayland.enable = true;
+    };
+
+    environment.systemPackages = with pkgs; [
+      # KDE Utilities
+      kdePackages.discover # Optional: Software center for Flatpaks/firmware updates
+      kdePackages.kcalc # Calculator
+      kdePackages.kcharselect # Character map
+      kdePackages.kclock # Clock app
+      kdePackages.kcolorchooser # Color picker
+      kdePackages.kolourpaint # Simple paint program
+      kdePackages.ksystemlog # System log viewer
+      kdePackages.sddm-kcm # SDDM configuration module
+      kdiff3 # File/directory comparison tool
+
+      # Hardware/System Utilities (Optional)
+      kdePackages.isoimagewriter # Write hybrid ISOs to USB
+      kdePackages.partitionmanager # Disk and partition management
+      hardinfo2 # System benchmarks and hardware info
+      wayland-utils # Wayland diagnostic tools
+      wl-clipboard # Wayland copy/paste support
+      vlc # Media player
+    ];
+
+    environment.plasma6.excludePackages = with pkgs; [
+      kdePackages.elisa # Music player
+      kdePackages.kdepim-runtime # Akonadi agents
+      kdePackages.kmahjongg
+      #kdePackages.kmines
+      kdePackages.konversation # IRC client
+      kdePackages.kpat # Solitaire
+      kdePackages.ksudoku
+      kdePackages.ktorrent
+    ];
   };
 }

modules/fileshares/holocron.old/copyparty/default.nix

@@ -1,160 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  inputs,
-  ...
-}: let
-  service = "copyparty";
-  cfg = config.holocron.${service};
-  sec = config.sops.secrets;
-  homelab = config.homelab;
-in {
-  imports = [inputs.copyparty.nixosModules.default];
-
-  options.holocron.${service} = {
-    enable = lib.mkEnableOption "enables ${service}";
-
-    # set port options
-    port = lib.mkOption {
-      type = lib.types.int;
-      default = 7902;
-      description = "set port for ${service} (default: ${toString cfg.port}";
-    };
-    url = lib.mkOption {
-      type = lib.types.str;
-      default = "${service}.${homelab.base_domain}";
-      description = "set domain for ${service}";
-    };
-    data_dir = lib.mkOption {
-      type = lib.types.str;
-      default = "/var/lib/${service}";
-      description = "set data directory for ${service}";
-    };
-    ids = lib.mkOption {
-      type = lib.types.int;
-      default = cfg.port;
-      description = "set uid and pid of ${service} user (matches port by default)";
-    };
-    backup = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "enable backups for ${service}";
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    nixpkgs.overlays = [inputs.copyparty.overlays.default];
-    # declare ${service} group
-    users.groups.${service} = {
-      gid = lib.mkForce cfg.ids;
-    };
-
-    # declare ${service} user
-    users.users.${service} = {
-      description = lib.mkForce "${service} server user";
-      uid = lib.mkForce cfg.ids;
-      isSystemUser = true;
-      home = cfg.data_dir;
-      createHome = true;
-      group = service;
-      extraGroups = [ "media" "blake" "archives" ];
-    };
-
-    # enable the ${service} service
-    services.${service} = {
-      enable = true;
-      user = service;
-      group = service;
-      settings = {
-        i = "0.0.0.0";
-        p = [7902];
-        rproxy = 1;
-      };
-      accounts = {
-        blake = {
-          passwordFile = sec."copyparty_passwd".path;
-        };
-      };
-      groups = {
-        media = ["blake"];
-      };
-      volumes = {
-        "/archives" = {
-          path = "/holocron/archives";
-          access = {
-            r = "*";
-            A = "blake";
-          };
-          flags = {
-            chmod_f = 660;
-            chmod_d = 770;
-            #gid = ?;
-          };
-        };
-        "/media" = {
-          path = "/holocron/media";
-          access = {
-            r = "*";
-            w = "@media";
-            A = "blake";
-          };
-          flags = {
-            chmod_f = 660;
-            chmod_d = 770;
-            gid = "700";
-          };
-        };
-        "/users/blake" = {
-          path = "/holocron/users/blake";
-          access = {
-            A = "blake";
-          };
-          flags = {
-            chmod_f = 660;
-            chmod_d = 770;
-            gid = "1000";
-          };
-        };
-      };
-    };
-
-    # open firewall
-    networking.firewall.allowedTCPPorts = [cfg.port];
-
-    # add to caddy for reverse proxy
-    services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = ["${service}.${homelab.public_domain}"];
-      extraConfig = ''
-        tls /etc/ssl/blakedheld.xyz.crt /etc/ssl/blakedheld.xyz.key
-        reverse_proxy 127.0.0.1:${toString cfg.port} {
-        }
-      '';
-    };
-
-    # add to glance (local service)
-    homelab.glance.links.system = [
-      {
-        title = service;
-        url = "https://${cfg.url}";
-        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
-        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
-        icon = "di:${service}";
-      }
-    ];
-
-    sops.secrets = {
-      "${service}_passwd" = {
-        owner = service;
-        group = service;
-      };
-    };
-
-    # add to backups
-    homelab.backups.baks = {
-      ${service} = {
-        paths = [cfg.data_dir];
-      };
-    };
-  };
-}

modules/fileshares/holocron.old/default.nix

@@ -1,20 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  inputs,
-  ...
-}: {
-  # services show up in glance in reverse import order lmao
-  imports = [
-    ./nfs
-    ./smb
-    ./zfs
-    #./syncthing
-    #./copyparty
-    ./perms
-  ];
-
-  # define the groups used for backups and archives
-  users.groups.archives = {gid = 727;};
-}

modules/fileshares/holocron.old/nfs/default.nix

@@ -1,28 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-# define nfs exports
-let
-  cfg = config.holocron.nfs;
-  nfs_exports = ''
-    /holocron/media *(ro,sync,no_subtree_check)
-  '';
-  #/holocron/users *(rw,sync,no_subtree_check,no_root_squash)
-in {
-  options.holocron.nfs = {
-    enable = lib.mkEnableOption "enables nfs";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # enable nfs with all exports
-    services.nfs = {
-      server = {
-        enable = true;
-        exports = nfs_exports;
-      };
-    };
-  };
-}

modules/fileshares/holocron.old/perms/default.nix

@@ -1,65 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}: let
-  service = "ensure_perms";
-  cfg = config.holocron.${service};
-
-  # define variables for paths
-  archives_path = "/holocron/archives";
-  media_path = "/holocron/media";
-  users_path = "/holocron/users";
-in {
-  options.holocron.ensure_perms = {
-    enable = lib.mkEnableOption "enables perms ensurence script";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # service to run periodically to reset the perms on all zpools
-    # everything works fine without this, just for peace of mind
-    # and to clean up the ownership from the arr stack in /holocron/media
-    systemd.services.${service} = {
-      description = "ensure file permissions for archives, media and user folders";
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = pkgs.writeShellScript "ensure_perms" ''
-
-          # Fix ownership for archives directory
-          echo "starting ${archives_path}"
-          chown -Rc root:archives ${archives_path}
-          find "${archives_path}" -type d -exec chmod 2770 "$@" {} +
-          find "${archives_path}" -type f -exec chmod 660 "$@" {} +
-
-          # Fix ownership for media directory
-          echo "starting ${media_path}"
-          chown -Rc root:media ${media_path}
-          find "${media_path}" -type d -exec chmod 2770 "$@" {} +
-          find "${media_path}" -type f -exec chmod 660 "$@" {} +
-
-          # Fix user directories
-          for user_dir in ${users_path}/*; do
-            if [ -d "$user_dir" ]; then
-              user=$(basename "$user_dir")
-              echo "starting $user_dir"
-              chown -Rc $user:$user $user_dir
-              find $user_dir -type d -exec chmod 2770 "$@" {} +
-              find $user_dir -type f -exec chmod 660 "$@" {} +
-            fi
-          done
-          echo "fin"
-        '';
-      };
-    };
-
-    systemd.timers.${service} = {
-      description = "run script to ensure_perms daily";
-      wantedBy = ["timers.target"];
-      timerConfig = {
-        OnCalendar = "03:30";
-        Persistent = true;
-      };
-    };
-  };
-}

modules/fileshares/holocron.old/smb/default.nix

@@ -1,97 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}:
-# define smb shares
-let
-  cfg = config.holocron.smb;
-  smb_shares = {
-    global = {
-      "ea support" = "yes";
-      "vfs objects" = "catia fruit streams_xattr";
-      "fruit:aapl" = "yes";
-      "fruit:metadata" = "stream";
-      "fruit:model" = "MacSamba";
-      "fruit:posix_rename" = "yes";
-      "fruit:nfs_aces" = "no";
-      "fruit:veto_appledouble" = "no";
-      "fruit:wipe_intentionally_left_blank_rfork" = "yes";
-      "fruit:delete_empty_adfiles" = "yes";
-    };
-    archives = {
-      path = "/holocron/archives";
-      browseable = true;
-      writable = true;
-      guestOk = false;
-      "create mask" = "0775";
-      "directory mask" = "0775";
-    };
-    timemachine = {
-      browseable = true;
-      "path" = "/holocron/archives/timemachine";
-      "valid users" = "blake";
-      "public" = "no";
-      "writeable" = "yes";
-      "force user" = "blake";
-      "fruit:aapl" = "yes";
-      "fruit:time machine" = "yes";
-      "vfs objects" = "catia fruit streams_xattr";
-    };
-    users = {
-      path = "/holocron/users";
-      browseable = true;
-      writable = true;
-      guestOk = false;
-      "create mask" = "0660";
-      "directory mask" = "0770";
-    };
-    media = {
-      path = "/holocron/media";
-      browseable = true;
-      writable = true;
-      guestOk = false;
-      "create mask" = "0775";
-      "directory mask" = "0775";
-    };
-  };
-in {
-  options.holocron.smb = {
-    enable = lib.mkEnableOption "enables smb";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # enable smb with all shares
-    services.samba = {
-      enable = true;
-      settings = smb_shares;
-    };
-    # Ensure Time Machine can discover the share without `tmutil`
-    services.avahi = {
-      extraServiceFiles = {
-        timemachine = ''
-          <?xml version="1.0" standalone='no'?>
-          <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
-          <service-group>
-            <name replace-wildcards="yes">%h</name>
-            <service>
-              <type>_smb._tcp</type>
-              <port>445</port>
-            </service>
-              <service>
-              <type>_device-info._tcp</type>
-              <port>0</port>
-              <txt-record>model=TimeCapsule8,119</txt-record>
-            </service>
-            <service>
-              <type>_adisk._tcp</type>
-              <txt-record>dk0=adVN=timemachine,adVF=0x82</txt-record>
-              <txt-record>sys=waMa=0,adVF=0x100</txt-record>
-            </service>
-          </service-group>
-        '';
-      };
-    };
-  };
-}

modules/fileshares/holocron.old/syncthing/default.nix

@@ -1,89 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  service = "syncthing";
-  cfg = config.holocron.${service};
-  sec = config.sops.secrets;
-  url = "syncthing.snowbelle.blakedheld.xyz";
-  homelab = config.homelab;
-in {
-  options.holocron.${service} = {
-    enable = lib.mkEnableOption "enables syncthing";
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.syncthing = {
-      enable = true;
-      user = "blake";
-      group = "blake";
-      dataDir = "/var/lib/syncthing";
-      guiAddress = "0.0.0.0:2222";
-      openDefaultPorts = true;
-      #extraFlags = ["--no-default-folder"];
-      key = sec."${service}/snowbelle/key".path;
-      cert = sec."${service}/snowbelle/cert".path;
-      settings = {
-        devices = {
-          "mudkip" = {id = "OV4NUQK-3YHRL5R-SIZGTNL-7VZFFUX-FOJ6NTS-C7ROXR7-I2Q2W7G-QERO7AO";};
-          "zygarde" = {id = "UYLTF52-VVKUR7F-JN33HQZ-RFNWGL3-JER52LA-GZD2LPJ-QIFEE7K-MNMZRQ5";};
-          "yveltal" = {id = "ZVSQ4WJ-7OICYOZ-3ECES4X-KH37IPB-TKHKUJG-BSEGXVM-AHYY5C3-VKG44AX";};
-          "CEN-IT-07" = {id = "DPYKA4Z-3PX7JB2-FBEOXXX-SC7TLT2-QC5P2IR-SXOPJGX-QO3DMII-5B7UCA4";};
-          "CEN-IT-00007" = {id = "XBPXGYU-DUJSLDH-6BDNF4D-CO2COC3-N3FM6W5-IHZOJBM-Z2N77RI-IVAV5AH";};
-        };
-        folders = {
-          "holocron" = {
-            path = "/holocron/users/blake/holocron";
-            devices = ["mudkip" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
-            id = "5voxg-c3he2";
-            versioning = {
-              type = "staggered";
-              fsPath = "/holocron/users/blake/holocron/.stversions";
-              params = {
-                cleanInterval = "3600";
-                maxAge = "0";
-              };
-            };
-          };
-        };
-        options = {
-          urAccepted = -1;
-        };
-      };
-    };
-
-    sops.secrets = {
-      "${service}/snowbelle/key" = {
-        owner = "blake";
-        group = "blake";
-      };
-      "${service}/snowbelle/cert" = {
-        owner = "blake";
-        group = "blake";
-      };
-    };
-    homelab.backups.baks = {
-      ${service} = {paths = [config.services.syncthing.dataDir];};
-    };
-
-    services.caddy.virtualHosts."${url}" = {
-      extraConfig = ''
-        tls internal
-        reverse_proxy 127.0.0.1:2222
-      '';
-    };
-
-    # add to glance (local service)
-    homelab.glance.links.system = [
-      {
-        title = service;
-        url = "https://${url}";
-        error-url = "http://${homelab.host_ip}:2222";
-        check-url = "http://${homelab.host_ip}:2222";
-        icon = "di:${service}";
-      }
-    ];
-  };
-}

modules/fileshares/holocron.old/zfs/default.nix

@@ -1,79 +0,0 @@
-{
-  pkgs,
-  config,
-  lib,
-  ...
-}: let
-  cfg = config.holocron.zfs;
-in {
-  options.holocron.zfs = {
-    enable = lib.mkEnableOption "enables zfs";
-  };
-
-  config = lib.mkIf cfg.enable {
-    # set network host id
-    networking.hostId = "3e6e7055";
-
-    # enable zfs support
-    boot.zfs.forceImportRoot = false;
-    boot.kernelModules = ["zfs"];
-    boot.supportedFilesystems = ["zfs"];
-
-    # arc cache size
-    boot.kernelParams = ["zfs.zfs_arc_max=12884901888"];
-
-    # pools to import
-    #boot.zfs.extraPools = [ "holocron" "holocron/archives" "/holocron/media" "/holocron/users" ];
-    #boot.zfs.extraPools = [ "holocron" ];
-
-    # enable smart monitoring
-    services.smartd = {
-      enable = true;
-      autodetect = true;
-      defaults.monitored = "-a -o on -s (S/../.././05|L/../01/./05)";
-      notifications.mail = {
-        enable = true;
-        sender = "zfs@snowbelle.lan";
-      };
-    };
-
-    # enable zfs
-    services.zfs = {
-      autoScrub.enable = true;
-      autoScrub.interval = "weekly";
-      # email notifs
-      zed = {
-        enableMail = false;
-        settings = {
-          ZED_EMAIL_ADDR = ["root"];
-          # send notification if scrub succeeds
-          ZED_NOTIFY_VERBOSE = true;
-        };
-      };
-    };
-
-    # install userspace tools for acl's
-    environment.systemPackages = with pkgs; [smartmontools];
-
-    fileSystems."/holocron" = {
-      device = "holocron";
-      fsType = "zfs";
-      options = ["nofail"];
-    };
-    fileSystems."/holocron/archives" = {
-      device = "holocron/archives";
-      fsType = "zfs";
-      options = ["nofail"];
-    };
-    fileSystems."/holocron/users" = {
-      device = "holocron/users";
-      fsType = "zfs";
-      options = ["nofail"];
-    };
-    fileSystems."/holocron/media" = {
-      device = "holocron/media";
-      fsType = "zfs";
-      options = ["nofail"];
-    };
-  };
-}

modules/fileshares/holocron/default.nix

@@ -16,11 +16,11 @@
     ./perms
   ];
 
-  # define the groups used for backups and archives
+  #  # define the groups used for backups and archives
-  users.users.archives = {
+  #  users.users.archives = {
-    isSystemUser = true;
+  #    isSystemUser = true;
-    group = "archives";
+  #    group = "archives";
-  };
+  #  };
-
+  #
-  users.groups.archives = {gid = 727;};
+  #  users.groups.archives = {gid = 727;};
 }

modules/fileshares/holocron/smb/default.nix

@@ -34,7 +34,7 @@ let
     };
     timemachine = {
       browseable = true;
-      "path" = "/holocron/timemachine";
+      "path" = "/holocron/archives/timemachine";
       "valid users" = "blake";
       "public" = "no";
       "writeable" = "yes";
@@ -68,7 +68,6 @@ let
     };
     nvr = {
       path = "/holocron/nvr";
-      browseable = true;
       writable = true;
       guestOk = false;
       browseable = true;
@@ -77,10 +76,6 @@ let
       "writeable" = "yes";
       "force user" = "archives";
       # time machine specifc config
-      "case sensitive" = "yes";
-      "default case" = "lower";
-      "preserve case" = "no";
-      "short preserve case" = "no";
       "create mask" = "0660";
       "directory mask" = "0770";
       "force group" = "archives";

modules/fileshares/holocron/syncthing/default.nix

@@ -38,14 +38,14 @@ in {
             path = "/holocron/users/blake/holocron";
             devices = ["piplup" "zygarde" "CEN-IT-07" "CEN-IT-00007" "yveltal"];
             id = "5voxg-c3he2";
-            versioning = {
+            #            versioning = {
-              type = "staggered";
+            #              type = "staggered";
-              fsPath = "/holocron/users/blake/holocron/.stversions";
+            #              fsPath = "/holocron/users/blake/holocron/.stversions";
-              params = {
+            #              params = {
-                cleanInterval = "3600";
+            #                cleanInterval = "3600";
-                maxAge = "0";
+            #                maxAge = "0";
-              };
+            #              };
-            };
+            #            };
           };
         };
         options = {

modules/gameservers/valheim/default.nix

@@ -0,0 +1,149 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  nixservice = "podman-valheim";
+  service = "valheim";
+  cfg = config.gameservers.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.gameservers.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 2456;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/gameservers/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    motd_gs = lib.mkOption {
+      type = lib.types.nullOr (lib.types.listOf lib.types.str);
+      default = ["podman-valheim"];
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "enable backups for ${service}";
+    };
+    backup_repo = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/backup/gameservers/valheim";
+      description = "path to take hourly backups to with borg!";
+    };
+    offsite_user = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat";
+      description = "user to connect to offsite host with";
+    };
+    offsite_target = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat.holocron.blue";
+      description = "ip or domain for offsite backups";
+    };
+    offsite_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "lifeboat/holocron/archives/gameservers";
+      description = "path to rsync offsite backups to";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    virtualisation.oci-containers.containers = {
+      ${service} = {
+        image = "ghcr.io/community-valheim-tools/valheim-server";
+        autoStart = true;
+        extraOptions = [
+          "--cap-add=sys_nice"
+          "--stop-timeout=120"
+        ];
+        ports = [
+          "2456-2457:2456-2457/udp"
+          "2456:80/tcp"
+        ];
+        volumes = [
+          "${cfg.data_dir}/config:/config"
+          "${cfg.data_dir}/data:/opt/valheim"
+        ];
+        environment = {
+          SERVER_NAME = "recpro";
+          SERVER_PASS = "recoil727pro";
+          #WORLD_NAME = "";
+          STATUS_HTTP = "true";
+          TZ = homelab.tz;
+          PUID = toString config.users.users.${service}.uid;
+          PGID = toString config.users.groups.${service}.gid;
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port];
+    networking.firewall.allowedUDPPorts = [2456 2457];
+
+    # backups valhiem with borg!
+    services.borgbackup.jobs.${service} = {
+      archiveBaseName = service;
+      repo = cfg.backup_repo;
+      paths = cfg.data_dir;
+      compression = "auto,zstd";
+      #preHook = "systemctl start mysql-backup.service";
+      postHook = ''
+        ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+      '';
+      startAt = "*-*-* *:00:00";
+      group = "archives";
+      encryption.mode = "repokey-blake2";
+      encryption.passCommand = "cat ${config.sops.secrets."borg_passwd".path}";
+      extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
+      extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
+      prune.keep = {
+        within = "1d"; # Keep all archives from the last day
+        hourly = 24;
+        daily = 7;
+        weekly = 12;
+        monthly = -1; # Keep at least one archive for each month
+      };
+    };
+  };
+}

modules/homelab/default.nix

@@ -2,6 +2,7 @@
   pkgs,
   config,
   lib,
+  inputs,
   ...
 }: let
   cfg = config.homelab;
@@ -39,4 +40,14 @@ in {
     #./nomad
     ./network
   ];
+
+  config = lib.mkIf cfg.enable {
+    # define the groups used for backups and archives
+    users.users.archives = {
+      isSystemUser = true;
+      group = "archives";
+    };
+
+    users.groups.archives = {gid = 727;};
+  };
 }

modules/homelab/mediastack/default.nix

@@ -27,13 +27,15 @@ in {
 
   # the order determines the order in glance :3
   imports = [
-    ./bazarr
-    ./prowlarr
-    ./radarr
-    ./qbittorrent
-    ./sonarr
     ./yacreader
+    ./bazarr
+    ./qbittorrent
+    ./prowlarr
+    ./lidarr
+    ./radarr
+    ./sonarr
     ./audiobookshelf
+    ./navidrome
     ./jellyfin
     ./flaresolverr
   ];
@@ -56,7 +58,9 @@ in {
     homelab.prowlarr.enable = lib.mkDefault true;
     homelab.radarr.enable = lib.mkDefault true;
     homelab.sonarr.enable = lib.mkDefault true;
+    homelab.lidarr.enable = lib.mkDefault true;
     homelab.audiobookshelf.enable = lib.mkDefault true;
+    homelab.navidrome.enable = lib.mkDefault true;
     homelab.flaresolverr.enable = lib.mkDefault true;
   };
 }

modules/homelab/mediastack/jellyfin/default.nix

@@ -7,6 +7,7 @@
   service = "jellyfin";
   cfg = config.homelab.${service};
   homelab = config.homelab;
+  host = config.networking.hostName;
 in {
   options.homelab.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
@@ -61,6 +62,7 @@ in {
     # enable the ${service} service
     services.${service} = {
       enable = true;
+      package = pkgs.unstable.jellyfin;
       openFirewall = true;
       user = service;
       group = service;
@@ -85,7 +87,7 @@ in {
     homelab.glance.links.mediastack = [
       {
         title = service;
-        url = "https://media.${homelab.public_domain}";
+        url = "https://media.${host}.${homelab.public_domain}";
         error-url = "http://${homelab.host_ip}:${toString cfg.port}";
         check-url = "http://${homelab.host_ip}:${toString cfg.port}";
         icon = "di:${service}";

modules/homelab/mediastack/lidarr/default.nix

@@ -0,0 +1,108 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "lidarr";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7109;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # required
+    environment.systemPackages = with pkgs; [ffmpeg_6-headless yt-dlp];
+
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      openFirewall = true;
+      user = service;
+      group = service;
+      dataDir = cfg.data_dir;
+      settings = {
+        server.port = cfg.port;
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      #      User = service;
+      #      Group = service;
+    };
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port}
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://${cfg.url}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/mediastack/navidrome/default.nix

@@ -0,0 +1,115 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  service = "navidrome";
+  cfg = config.homelab.${service};
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7108;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "music.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = service;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      #      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = ["media"];
+    };
+
+    # enable the ${service} service
+    services.${service} = {
+      enable = true;
+      openFirewall = true;
+      user = service;
+      group = service;
+      #      plugins = [
+      #      ];
+      environmentFile = "${cfg.data_dir}/navidrome.env";
+      settings = {
+        Address = "0.0.0.0";
+        Port = cfg.port;
+        MusicFolder = "/holocron/media/music";
+        EnableInsightsCollector = false;
+        LyricsPriority = "nd-lyrics";
+        Plugins = {
+          Enabled = true;
+          #Folder = lib.mkForce "${cfg.data_dir}/plugins";
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+      EnvironmentFile = "${cfg.data_dir}/navidrome.env";
+    };
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      #serverAliases = ["abs.${homelab.public_domain}"];
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port} {
+        }
+      '';
+    };
+
+    # add to glance public service
+    homelab.glance.links.mediastack = [
+      {
+        title = service;
+        url = "https://music.${homelab.base_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${service}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/network/caddy/default.nix

@@ -58,7 +58,7 @@ in {
         plugins = [
           "github.com/caddy-dns/cloudflare@v0.2.4"
         ];
-        hash = "sha256-7GoH8YLCoPmPExQxoga2FHB58zQDoZVf1BBwkVi0SsQ=";
+        hash = "sha256-dQvk6ezY6TQ1J7PjhCXnThF/SqVgPwBO8/RXzHCY+js=";
         # Replace with the hash from the build error the first time you build.
       };
       email = "me@blakedheld.xyz";

modules/homelab/network/ddns/default.nix

@@ -29,17 +29,23 @@ in {
         "superflat.recoil.pro"
         "skyblock.recoil.pro"
         "cobblemon.recoil.pro"
+        "valheim.recoil.pro"
 
         # blakedheld.xyz
-        "blakedheld.xyz"
+        #"blakedheld.xyz"
-        "*.blakedheld.xyz"
+        #"*.blakedheld.xyz"
-        "git.blakedheld.xyz"
+        #"git.blakedheld.xyz"
-        "up.blakedheld.xyz"
+        #"up.blakedheld.xyz"
 
         # holocron.blue
-        "holocron.blue"
+        #"holocron.blue"
-        "*.holocron.blue"
+        #"*.holocron.blue"
         "git.holocron.blue"
+        "pass.holocron.blue"
+        "photos.holocron.blue"
+        "media.holocron.blue"
+        "up.holocron.blue"
+        # mc servers
         "mine.holocron.blue"
         "smp.holocron.blue"
         "skyblock.holocron.blue"

modules/homelab/services/glance/default.nix

@@ -77,7 +77,7 @@ in {
         default = [];
         description = "list of links for ${service}";
       };
-      nomad = lib.mkOption {
+      network = lib.mkOption {
         type = lib.types.listOf lib.types.attrs;
         default = [];
         description = "list of links for ${service}";
@@ -252,8 +252,8 @@ in {
                   {
                     type = "monitor";
                     cache = "1m";
-                    title = "system";
+                    title = "network";
-                    sites = cfg.links.nomad;
+                    sites = cfg.links.network;
                   }
                   {
                     type = "custom-api";
@@ -262,13 +262,13 @@ in {
                     cache = "5s";
                     template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
                   }
-                  {
+                  #                  {
-                    type = "custom-api";
+                  #                    type = "custom-api";
-                    title = "linggango";
+                  #                    title = "linggango";
-                    url = "https://api.mcstatus.io/v2/status/java/raceraskedforthisenjoyyall.recoil.pro";
+                  #                    url = "https://api.mcstatus.io/v2/status/java/raceraskedforthisenjoyyall.recoil.pro";
-                    cache = "5s";
+                  #                    cache = "5s";
-                    template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
+                  #                    template = "<div style=\"display:flex; align-items:center; gap:12px;\">\n  <div style=\"width:40px; height:40px; flex-shrink:0;  border-radius:4px; display:flex; justify-content:center; align-items:center; overflow:hidden;\">\n    {{ if .JSON.Bool \"online\" }}\n      <img src=\"{{ .JSON.String \"icon\" | safeURL }}\" width=\"64\" height=\"64\" style=\"object-fit:contain;\">\n    {{ else }}\n      <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 20 20\" fill=\"currentColor\" style=\"width:32px; height:32px; opacity:0.5;\">\n        <path fill-rule=\"evenodd\" d=\"M1 5.25A2.25 2.25 0 0 1 3.25 3h13.5A2.25 2.25 0 0 1 19 5.25v9.5A2.25 2.25 0 0 1 16.75 17H3.25A2.25 2.25 0 0 1 1 14.75v-9.5Zm1.5 5.81v3.69c0 .414.336.75.75.75h13.5a.75.75 0 0 0 .75-.75v-2.69l-2.22-2.219a.75.75 0 0 0-1.06 0l-1.91 1.909.47.47a.75.75 0 1 1-1.06 1.06L6.53 8.091a.75.75 0 0 0-1.06 0l-2.97 2.97ZM12 7a1 1 0 1 1-2 0 1 1 0 0 1 2 0Z\" clip-rule=\"evenodd\" />\n      </svg>\n    {{ end }}\n  </div>\n\n  <div style=\"flex-grow:1; min-width:0;\">\n    <a class=\"size-h4 block text-truncate color-highlight\">\n      {{ .JSON.String \"host\" }}\n      {{ if .JSON.Bool \"online\" }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-positive); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Online\"\n      ></span>\n      {{ else }}\n      <span\n        style=\"width: 8px; height: 8px; border-radius: 50%; background-color: var(--color-negative); display: inline-block; vertical-align: middle;\"\n        data-popover-type=\"text\"\n        data-popover-text=\"Offline\"\n      ></span>\n      {{ end }}\n    </a>\n\n    <ul class=\"list-horizontal-text\">\n      <li>\n        {{ if .JSON.Bool \"online\" }}\n        <span>{{ .JSON.String \"version.name_clean\" }}</span>\n        {{ else }}\n        <span>Offline</span>\n        {{ end }}\n      </li>\n      {{ if .JSON.Bool \"online\" }}\n      <li data-popover-type=\"html\">\n        <div data-popover-html>\n          {{ range .JSON.Array \"players.list\" }}{{ .String \"name_clean\" }}<br>{{ end }}\n        </div>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          {{ .JSON.Int \"players.online\" | formatNumber }}/{{ .JSON.Int \"players.max\" | formatNumber }} players\n        </p>\n      </li>\n      {{ else }}\n      <li>\n        <p style=\"display:inline-flex;align-items:center;\">\n          <svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 24 24\" fill=\"currentColor\" class=\"size-6\" style=\"height:1em;vertical-align:middle;margin-right:0.5em;opacity:0.5;\">\n            <path fill-rule=\"evenodd\" d=\"M7.5 6a4.5 4.5 0 1 1 9 0 4.5 4.5 0 0 1-9 0ZM3.751 20.105a8.25 8.25 0 0 1 16.498 0 .75.75 0 0 1-.437.695A18.683 18.683 0 0 1 12 22.5c-2.786 0-5.433-.608-7.812-1.7a.75.75 0 0 1-.437-.695Z\" clip-rule=\"evenodd\" />\n          </svg>\n          0 players\n        </p>\n      </li>\n      {{ end }}\n    </ul>\n  </div>\n</div>";
-                  }
+                  #                  }
                 ];
               }
               {
@@ -346,8 +346,36 @@ in {
       };
     };
 
-    # add to udr to glance
+    # add to vaniville services to glance
+    homelab.glance.links.services = [
+      {
+        title = "vaultwarden";
+        url = "https://pass.${homelab.public_domain}";
+        error-url = "https://pass.vaniville.${homelab.public_domain}";
+        check-url = "https://pass.${homelab.public_domain}";
+        icon = "di:vaultwarden";
+      }
+      {
+        title = "gitea";
+        url = "https://git.${homelab.public_domain}";
+        error-url = "https://git.vaniville.${homelab.public_domain}";
+        check-url = "https://git.${homelab.public_domain}";
+        icon = "di:gitea";
+      }
+    ];
+
     homelab.glance.links.system = [
+      {
+        title = "vaniville uptime";
+        url = "https://up.${homelab.public_domain}";
+        error-url = "https://up.vaniville.${homelab.public_domain}";
+        check-url = "https://up.${homelab.public_domain}";
+        icon = "di:uptime-kuma";
+      }
+    ];
+
+    # add to udr to glance
+    homelab.glance.links.network = [
       {
         title = "shauna";
         url = "https://shauna.holocron.blue";
@@ -364,6 +392,38 @@ in {
         icon = "di:unifi";
         allow-insecure = true;
       }
+      {
+        title = "korrina";
+        url = "https://korrina.holocron.blue";
+        error-url = "https://100.101.11.1";
+        check-url = "https://100.101.11.1";
+        icon = "di:unifi";
+        allow-insecure = true;
+      }
+      {
+        title = "linode";
+        url = "https://cloud.linode.com/linodes";
+        error-url = "https://status.linode.com";
+        check-url = "https://cloud.linode.com/linodes";
+        icon = "di:linode";
+        allow-insecure = true;
+      }
+      {
+        title = "tailscale";
+        url = "https://console.tailscale.com/admin/machines";
+        error-url = "https://status.tailscale.com/";
+        check-url = "https://console.tailscale.com/admin/machines";
+        icon = "di:tailscale";
+        allow-insecure = true;
+      }
+      {
+        title = "nextdns";
+        url = "https://my.nextdns.io";
+        error-url = "https://test.nextdns.io";
+        check-url = "https://my.nextdns.io/527db2/setup";
+        icon = "di:nextdns";
+        allow-insecure = true;
+      }
     ];
   };
 }

modules/homelab/services/vaultwarden/default.nix

@@ -84,8 +84,8 @@ in {
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
       serverAliases = ["pass.${homelab.public_domain}"];
+      #tls internal
       extraConfig = ''
-        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/homelab/services/wger/default.nix

@@ -0,0 +1,125 @@
+{
+  pkgs,
+  config,
+  lib,
+  inputs,
+  ...
+}: let
+  nixservice = "wger";
+  service = "wger";
+  cfg = config.homelab.${service};
+  sec = config.sops.secrets;
+  homelab = config.homelab;
+in {
+  options.homelab.${service} = {
+    enable = lib.mkEnableOption "enables ${service}";
+
+    # set port options
+    port = lib.mkOption {
+      type = lib.types.int;
+      default = 7707;
+      description = "set port for ${service} (default: ${toString cfg.port}";
+    };
+    url = lib.mkOption {
+      type = lib.types.str;
+      default = "${service}.${homelab.base_domain}";
+      description = "set domain for ${service}";
+    };
+    data_dir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/${service}";
+      description = "set data directory for ${service}";
+    };
+    ids = lib.mkOption {
+      type = lib.types.int;
+      default = cfg.port;
+      description = "set uid and pid of ${service} user (matches port by default)";
+    };
+    backup = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "enable backups for ${service}";
+    };
+    motd = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "podman-wger";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # declare ${service} group
+    users.groups.${service} = {gid = lib.mkForce cfg.ids;};
+
+    # declare ${service} user
+    users.users.${service} = {
+      description = "${service} server user";
+      uid = lib.mkForce cfg.ids;
+      isSystemUser = true;
+      home = cfg.data_dir;
+      createHome = true;
+      group = service;
+      extraGroups = [];
+    };
+
+    # still suss as fuck bro man fuck
+    virtualisation.oci-containers.containers = {
+      hass = {
+        image = "homeassistant/home-assistant:stable";
+        autoStart = true;
+        extraOptions = [
+          "--pull=newer"
+          "--network=host"
+        ];
+        volumes = [
+          "${cfg.data_dir}:/config"
+        ];
+        environment = {
+          TZ = homelab.tz;
+          PUID = toString config.users.users.${service}.uid;
+          PGID = toString config.users.groups.${service}.gid;
+        };
+      };
+    };
+
+    # override umask to make permissions work out
+    systemd.services.${service}.serviceConfig = {
+      UMask = lib.mkForce "0007";
+    };
+
+    # open firewall
+    networking.firewall.allowedTCPPorts = [cfg.port 8123 21063 21064];
+    networking.firewall.allowedUDPPorts = [5353];
+
+    # add to caddy for reverse proxy
+    services.caddy.virtualHosts."${cfg.url}" = {
+      serverAliases = ["${service}.${homelab.public_domain}"];
+      extraConfig = ''
+        tls internal
+        reverse_proxy 127.0.0.1:${toString cfg.port} {
+
+        header_up Host {host}
+        header_up X-Real-IP {remote_host}
+        header_up X-Forwarded-For {remote_host}
+        header_up X-Forwarded-Proto https
+
+        }
+      '';
+    };
+
+    # add to glance
+    homelab.glance.links.services = [
+      {
+        title = "wger";
+        url = "https://hass.${homelab.public_domain}";
+        error-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        check-url = "http://${homelab.host_ip}:${toString cfg.port}";
+        icon = "di:${nixservice}";
+      }
+    ];
+
+    # add to backups
+    homelab.backups.baks = {
+      ${service} = {paths = [cfg.data_dir];};
+    };
+  };
+}

modules/homelab/system/backups/default.nix

@@ -18,6 +18,7 @@ zstd -dc <path_to_backup> | sudo -u postgres psql -d <database_name>  # restore
 let
   cfg = config.homelab.backups;
   sec = config.sops.secrets;
+  host = config.networking.hostName;
 in {
   options.homelab.backups = {
     enable = lib.mkEnableOption "enables borg backups for state files and db backup services";
@@ -26,11 +27,26 @@ in {
       default = {};
       description = "backup jobs, nested attribute sets should be <bak_name> = paths [<list_of_paths>]";
     };
+    databases = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "if databases are present, runs dumps";
+    };
     backup_repo = lib.mkOption {
       type = lib.types.path;
-      default = "/holocron/archives/homelab";
+      default = "/holocron/archives/servers/${host}/homelab";
       description = "path to take daily backups to with borg!";
     };
+    offsite = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "bool to control weather or not the repo is backed up offsite";
+    };
+    homelab = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "bool to control weather or not the repo is backed up to homelab";
+    };
     offsite_user = lib.mkOption {
       type = lib.types.str;
       default = "lifeboat";
@@ -59,17 +75,26 @@ in {
       group = "archives";
       encryption.mode = "repokey-blake2";
       encryption.passCommand = "cat ${sec."borg_passwd".path}";
-      preHook = ''
+      preHook = lib.mkIf cfg.databases ''
         systemctl start mysql-backup.service
         systemctl start $(systemctl list-unit-files 'postgresqlBackup-*.service' --no-legend --no-pager | cut -d' ' -f1)
       '';
-      postHook = ''
+      postHook = lib.mkIf (cfg.offsite || cfg.homelab) ''
+        ${lib.optionalString cfg.offsite ''
           ${pkgs.sshpass}/bin/sshpass -f ${sec."lifeboat_rsync".path} \
             ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
             -e "ssh -o StrictHostKeyChecking=no" \
             ${toString cfg.backup_repo} \
             ${cfg.offsite_user}@${cfg.offsite_target}::${cfg.offsite_dir}
+        ''}
+        ${lib.optionalString cfg.homelab ''
+          ${pkgs.rsync}/bin/rsync -aHAX --partial --numeric-ids --info=progress2,name1,stats2 --delete \
+          -e "ssh -i /home/blake/.ssh/id_vaniville -o StrictHostKeyChecking=no" \
+          ${toString cfg.backup_repo} \
+          blake@lumiose:/holocron/archives/servers/vaniville
+        ''}
       '';
+
       extraArgs = ["--verbose" "--show-rc" "--umask" "0007"];
       extraCreateArgs = ["--list" "--stats" "--filter" "AME"];
       prune.keep = {

modules/homelab/system/uptime-kuma/default.nix

@@ -75,9 +75,8 @@ in {
 
     # add to caddy for reverse proxy
     services.caddy.virtualHosts."${cfg.url}" = {
-      serverAliases = ["up.${homelab.public_domain}"];
+      #serverAliases = ["up.${homelab.public_domain}"];
       extraConfig = ''
-        tls internal
         reverse_proxy 127.0.0.1:${toString cfg.port}
       '';
     };

modules/system/ssh/default.nix

@@ -1,9 +1,11 @@
-{ pkgs, config, lib, ... }:
-
-let
-  cfg = config.system.ssh;
-in
 {
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.system.ssh;
+in {
   options.system.ssh = {
     enable = lib.mkEnableOption "enables ssh";
   };
@@ -14,11 +16,11 @@ in
       enable = true;
       settings = {
         PasswordAuthentication = false;
-        PermitRootLogin = "no";
+        PermitRootLogin = "prohibit-password";
         X11Forwarding = false;
       };
     };
     # open firewall
-    networking.firewall.allowedTCPPorts = [ 22 ];
+    networking.firewall.allowedTCPPorts = [22];
   };
 }

users/blake/default.nix

@@ -27,6 +27,7 @@ in {
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOVsjLEbnW/KeFXogppi0AP6ZbCZpObu7zFeRV/aLkP9 blake@lugia"
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHJiskD81/2bd63sbJVSN0xPNwnbCGXheIBIKrwShDoo bhelderman@cen-it-07.local"
           "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO06en1r4+zg8JMGPq7WiZeh/DBUvfhDJX3e+J5Z5Ttk blake@snowbelle"
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP0FLKK9yEPYpGuCjoX0e7Ky/zTPfzDk7IkrR3tOmELP blake@vaniville"
         ];
       };
     };

users/blake/dots/core/lf/lfrc

@@ -23,9 +23,9 @@ set ignorecase true
 
 # shortcuts
 map gb cd /holocron
-map gz cd %{{ [ -d /holocron ] && printf /holocron || printf /media/holocron }}
 map gn cd ~/.nix
 map gc cd ~/.config
+map gv cd /var/lib
 
 # navigation
 map [ half-up

users/blake/dots/core/zsh/default.nix

@@ -7,6 +7,7 @@
   program = "zsh";
   cfg = config.dots.${program};
   home_dir = config.home.homeDirectory;
+  isDarwin = pkgs.stdenv.isDarwin;
   #sec = sops.secrets;
 in {
   options.dots.${program} = {
@@ -23,7 +24,6 @@ in {
     programs.${program} = {
       enable = true;
       dotDir = "${config.xdg.configHome}/zsh";
-      #dotDir = ".config/zsh";
       autocd = true;
       enableCompletion = true;
 
@@ -41,18 +41,20 @@ in {
         path = "$XDG_STATE_HOME/zsh/history";
       };
 
-      shellAliases = {
+      shellAliases =
+        {
           # --- zsh ---
           src = "source ${home_dir}/.config/zsh/.zshrc";
 
           # --- config editing ---
           cfl = "nvim /home/blake/.nix/users/blake/dots/core/lf/lfrc";
           cfz = "nvim /home/blake/.nix/users/blake/dots/core/zsh/default.nix";
+          cfv = "sudo lf /var/lib";
 
           # --- navigation ---
-        ls = "ls --color=auto --group-directories-first";
+          #          ls = "ls --color=auto --group-directories-first";
-        ll = "ls -lh --color=auto --group-directories-first";
+          #          ll = "ls -lh --color=auto --group-directories-first";
-        la = "ls -Alh --color=auto --group-directories-first";
+          #          la = "ls -Alh --color=auto --group-directories-first";
           ".." = "cd ..";
           "..." = "cd ../..";
           fs = "du -h | sort -h";
@@ -99,6 +101,12 @@ in {
           # zfs
           dfzfs = "zfs list -r -o name,used,usedsnap,usedds";
 
+          # --- yt-dlp ---
+          yt-music = "noglob yt-dlp -f 'bestaudio/best' --extract-audio --audio-format opus --audio-quality 0 --embed-metadata --embed-thumbnail -o '%(playlist_index)02d - %(title)s.%(ext)s'";
+
+          # --- dumb shit ---
+          fix-music = "sudo find /holocron/media/music -type d -exec chmod 2770 {} + && sudo find /holocron/media/music -type f -exec chmod 660 {} +";
+
           # --- systemd ---
           stat = "sudo systemctl status";
           restart = "sudo systemctl restart";
@@ -111,7 +119,21 @@ in {
           peace = "systemctl poweroff";
           love = "systemctl reboot";
           lock = "loginctl lock-session";
-      };
+        }
+        # use GNU core utils ls on macos
+        // (
+          if isDarwin
+          then {
+            ls = "gls --color=auto --group-directories-first";
+            ll = "gls -lh --color=auto --group-directories-first";
+            la = "gls -Alh --color=auto --group-directories-first";
+          }
+          else {
+            ls = "ls --color=auto --group-directories-first";
+            ll = "ls -lh --color=auto --group-directories-first";
+            la = "ls -Alh --color=auto --group-directories-first";
+          }
+        );
 
       initContent = ''
 
@@ -122,6 +144,7 @@ in {
         alias lf='lfcd'
         lfcd () {cd "$(command lf -print-last-dir "$@")"}
 
+
       '';
 
       syntaxHighlighting = {

users/blake/dots/desktop/default.nix

@@ -10,6 +10,7 @@
     ./waybar
     ./stylix
     ./hypr
+    ./kde
     ./tofi
     ./clipboard
     ./cursor

users/blake/dots/desktop/kde/default.nix

@@ -0,0 +1,20 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  program = "plasma";
+  cfg = config.dots.${program};
+  #sec = sops.secrets;
+in {
+  options.dots.${program} = {
+    enable = lib.mkEnableOption "enables ${program}";
+  };
+
+  config = lib.mkIf cfg.enable {
+    programs.${program} = {
+      enable = true;
+    };
+  };
+}

users/blake/hosts/lumiose.nix

@@ -49,6 +49,7 @@ in {
     };
     "vaniville" = {
       hostname = "96.126.127.102";
+      identityFile = "${home_dir}/.ssh/id_snowbelle";
       user = "blake";
     };
     "zygarde" = {

users/blake/hosts/vaniville.nix

@@ -28,6 +28,7 @@ in {
   # import snowbelle specific ssh keys
   programs.ssh.settings = lib.mkForce {
     "git.holocron.blue" = {
+      #AddressFamily = "inet";
       user = "gitea";
       identityFile = "${home_dir}/.ssh/id_vaniville";
       port = 7567;
@@ -37,6 +38,11 @@ in {
       identityFile = "${home_dir}/.ssh/id_vaniville";
       port = 7567;
     };
+    "lumiose" = {
+      hostname = "10.10.0.11";
+      user = "blake";
+      identityFile = "${home_dir}/.ssh/id_vaniville";
+    };
     "shauna" = {
       hostname = "10.10.0.1";
       user = "root";