Update DeterminateSystems/magic-nix-cache-action action to v15

Merge pull request 'Lock file maintenance' (#310 ) from renovate/lock-file-maintenance into main
Lock file maintenance
2026-09-10 02:03:47 +00:00 · 2026-09-06 04:03:48 +02:00 · 2026-09-06 02:03:44 +00:00 · 2026-09-05 04:04:01 +02:00 · 2026-09-05 02:04:00 +00:00 · 2026-08-30 04:06:25 +02:00
101 changed files with 3140 additions and 1566 deletions
@@ -12,17 +12,22 @@ jobs:
  build-nixos:
    runs-on: ubuntu-latest
    steps: 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
      
      - name: "Install Nix ❄️"
-        uses: cachix/install-nix-action@v26
+        uses: cachix/install-nix-action@v31
+
+    #  - uses: DeterminateSystems/nix-installer-action@v4
+      - uses: DeterminateSystems/magic-nix-cache-action@v15
+      - uses: DeterminateSystems/flake-checker-action@v13

      - name: "Install Cachix ❄️"
-        uses: cachix/cachix-action@v14
+        uses: cachix/cachix-action@v17
        with:
          name: helcel
          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
          
+
      - name: "Build NixOS CI config ❄️"
        run: |
          nix build .#nixosConfigurations.ci.config.system.build.toplevel
@@ -30,3 +35,4 @@ jobs:
      - name: "Build NixOS Sandbox config ❄️"
        run: |
          nix build .#nixosConfigurations.sandbox.config.system.build.toplevel
+          
@@ -13,15 +13,15 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v7
      - name: Install nix
-        uses: DeterminateSystems/nix-installer-action@v10
+        uses: DeterminateSystems/nix-installer-action@v22
        with:
          github-token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
          extra_nix_config: |
            experimental-features = nix-command flakes            
      - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@v21
+        uses: DeterminateSystems/update-flake-lock@v28
        with:
          token: ${{ secrets.GT_TOKEN_FOR_UPDATES }}
          pr-title: "[chore] Update flake.lock"
@@ -9,44 +9,57 @@ keys:
    - &avalon age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
    - &valinor age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
    - &asgard age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+    - &gateway age1lqvnzlendlmtwgstzrj4xzrwpatwx56k5az5au78fyg99yecwfzs3s6xn6
+    - &sandbox age1pf4auk6u2tmefuqpuc6mntr26cp4wcsmlhnn98arzxsp3753ruqsj0jqk3

 creation_rules:
-  - path_regex: modules/shared/sops/iriy.ya?ml
+  - path_regex: modules/shared/sops/private/iriy.[a-z]+
    key_groups:
-    - age:
-      - *iriy
-      pgp:
-      - *sora
-  - path_regex: modules/shared/sops/avalon.ya?ml
+      - age:
+          - *iriy
+        pgp:
+          - *sora
+  - path_regex: modules/shared/sops/private/avalon.[a-z]+
    key_groups:
-    - age:
-      - *avalon
-      pgp:
-      - *sora
-  - path_regex: modules/shared/sops/valinor.ya?ml
+      - age:
+          - *avalon
+        pgp:
+          - *sora
+  - path_regex: modules/shared/sops/private/valinor.[a-z]+
    key_groups:
-    - age:
-      - *valinor
-      pgp:
-      - *sora
-  - path_regex: modules/shared/sops/asgard.ya?ml
+      - age:
+          - *valinor
+        pgp:
+          - *sora
+  - path_regex: modules/shared/sops/private/asgard.[a-z]+
    key_groups:
-    - age:
-      - *asgard
-      pgp:
-      - *sora
+      - age:
+          - *asgard
+        pgp:
+          - *sora

-  - path_regex: modules/shared/sops/common.yaml
+  - path_regex: modules/shared/sops/common.[a-z]+
    key_groups:
-    - age:
-      - *valinor
-      - *iriy
-      - *avalon
-      - *asgard
-      pgp:
-      - *sora
+      - age:
+          - *valinor
+          - *iriy
+          - *avalon
+          - *asgard
+          - *gateway
+        pgp:
+          - *sora

-  - path_regex: modules/shared/sops/mock.yaml
+  - path_regex: modules/shared/sops/mock.[a-z]+
    key_groups:
-    - age:
-      - *ci
+      - age:
+          - *ci
+          - *sandbox
+
+  - path_regex: modules/server/sops/server.[a-z]+
+    key_groups:
+      - age:
+          - *avalon
+          - *sandbox
+
+        pgp:
+          - *sora
@@ -1,5 +1,27 @@
 {
  "nodes": {
+    "arion": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "haskell-flake": "haskell-flake",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770259557,
+        "narHash": "sha256-EvZ09k9+mzXAngPzU2K7oLLUDlKoT1numb4bDb3Gtl4=",
+        "owner": "hercules-ci",
+        "repo": "arion",
+        "rev": "9b24cf65c72cb0e9616e437d55e1ac8e5c6bc715",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "arion",
+        "type": "github"
+      }
+    },
    "base16-schemes": {
      "flake": false,
      "locked": {
@@ -23,11 +45,11 @@
        ]
      },
      "locked": {
-        "lastModified": 1711763326,
-        "narHash": "sha256-sXcesZWKXFlEQ8oyGHnfk4xc9f2Ip0X/+YZOq3sKviI=",
+        "lastModified": 1786845137,
+        "narHash": "sha256-oQFip+v0luP8NIxJzmiW4Wu8bILsbFWom5l0zonl8hQ=",
        "owner": "lnl7",
        "repo": "nix-darwin",
-        "rev": "36524adc31566655f2f4d55ad6b875fb5c1a4083",
+        "rev": "4cff07de74b50e64bdd68cd4e722ab5b6b35ee48",
        "type": "github"
      },
      "original": {
@@ -37,13 +59,58 @@
        "type": "github"
      }
    },
-    "hardware": {
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "arion",
+          "nixpkgs"
+        ]
+      },
      "locked": {
-        "lastModified": 1712909959,
-        "narHash": "sha256-7/5ubuwdEbQ7Z+Vqd4u0mM5L2VMNDsBh54visp27CtQ=",
+        "lastModified": 1769996383,
+        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": [
+          "nur",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1733312601,
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
+      "locked": {
+        "lastModified": 1788335262,
+        "narHash": "sha256-3jBEq8avfzlrsY4UpW4d5TOmm7ocseZfnitEJhqauyc=",
        "owner": "nixos",
        "repo": "nixos-hardware",
-        "rev": "f58b25254be441cd2a9b4b444ed83f1e51244f1f",
+        "rev": "44d95795ee2d475b3d687325e26dcf4ca9104557",
        "type": "github"
      },
      "original": {
@@ -52,6 +119,22 @@
        "type": "github"
      }
    },
+    "haskell-flake": {
+      "locked": {
+        "lastModified": 1675296942,
+        "narHash": "sha256-u1X1sblozi5qYEcLp1hxcyo8FfDHnRUVX3dJ/tW19jY=",
+        "owner": "srid",
+        "repo": "haskell-flake",
+        "rev": "c2cafce9d57bfca41794dc3b99c593155006c71e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "srid",
+        "ref": "0.1.0",
+        "repo": "haskell-flake",
+        "type": "github"
+      }
+    },
    "home-manager": {
      "inputs": {
        "nixpkgs": [
@@ -59,124 +142,20 @@
        ]
      },
      "locked": {
-        "lastModified": 1712759992,
-        "narHash": "sha256-2APpO3ZW4idlgtlb8hB04u/rmIcKA8O7pYqxF66xbNY=",
+        "lastModified": 1779506708,
+        "narHash": "sha256-QOD/CNm196nCJRheux/URi4/HE66fthdOMqCJoPP1Y0=",
        "owner": "nix-community",
        "repo": "home-manager",
-        "rev": "31357486b0ef6f4e161e002b6893eeb4fafc3ca9",
+        "rev": "3ee51fbdac8c8bdfe1e7e1fcaba6520a563f394f",
        "type": "github"
      },
      "original": {
        "owner": "nix-community",
+        "ref": "release-25.11",
        "repo": "home-manager",
        "type": "github"
      }
    },
-    "hyprcursor": {
-      "inputs": {
-        "hyprlang": [
-          "hyprland",
-          "hyprlang"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1712434681,
-        "narHash": "sha256-qwmR2p1oc48Bj7gUDvb1oGL19Rjs2PmEmk4ChV01A5o=",
-        "owner": "hyprwm",
-        "repo": "hyprcursor",
-        "rev": "818d8c4b69e0997483d60b75f701fe14b561a7a3",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprcursor",
-        "type": "github"
-      }
-    },
-    "hyprland": {
-      "inputs": {
-        "hyprcursor": "hyprcursor",
-        "hyprland-protocols": "hyprland-protocols",
-        "hyprlang": "hyprlang",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": "systems",
-        "wlroots": "wlroots",
-        "xdph": "xdph"
-      },
-      "locked": {
-        "lastModified": 1712951181,
-        "narHash": "sha256-Am+Jl/pDkVuZxyiBEAw1Ia5/dDRi5HOIYBT/kTT6uKA=",
-        "owner": "hyprwm",
-        "repo": "Hyprland",
-        "rev": "0c513ba91bd73106be99e35b1a020d24e5ae874a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "Hyprland",
-        "type": "github"
-      }
-    },
-    "hyprland-protocols": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1691753796,
-        "narHash": "sha256-zOEwiWoXk3j3+EoF3ySUJmberFewWlagvewDRuWYAso=",
-        "owner": "hyprwm",
-        "repo": "hyprland-protocols",
-        "rev": "0c2ce70625cb30aef199cb388f99e19a61a6ce03",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-protocols",
-        "type": "github"
-      }
-    },
-    "hyprlang": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1711671891,
-        "narHash": "sha256-C/Wwsy/RLxHP1axFFl+AnwJRWfd8gxDKKoa8nt8Qk3c=",
-        "owner": "hyprwm",
-        "repo": "hyprlang",
-        "rev": "c1402612146ba06606ebf64963a02bc1efe11e74",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprlang",
-        "type": "github"
-      }
-    },
    "nix-colors": {
      "inputs": {
        "base16-schemes": "base16-schemes",
@@ -196,22 +175,35 @@
        "type": "github"
      }
    },
-    "nixpkgs": {
+    "nixUnstable": {
      "locked": {
-        "lastModified": 1712791164,
-        "narHash": "sha256-3sbWO1mbpWsLepZGbWaMovSO7ndZeFqDSdX0hZ9nVyw=",
+        "lastModified": 1788549839,
+        "narHash": "sha256-kOrCcSIA6w9J1hX5DqHy2k9pDTJymExTsbV74U9UtCA=",
        "owner": "nixos",
        "repo": "nixpkgs",
-        "rev": "1042fd8b148a9105f3c0aca3a6177fd1d9360ba5",
+        "rev": "17de0b976395537756f30a3e78f2f06e5cec89ed",
        "type": "github"
      },
      "original": {
        "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "nixpkgs-unstable",
        "repo": "nixpkgs",
        "type": "github"
      }
    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
    "nixpkgs-lib": {
      "locked": {
        "lastModified": 1697935651,
@@ -227,13 +219,49 @@
        "type": "github"
      }
    },
-    "nur": {
+    "nixpkgs_2": {
      "locked": {
-        "lastModified": 1712965531,
-        "narHash": "sha256-qSOJWWc+mCK7oR9D+w/ZCe9FapLZT85j3HIjoq80Uxk=",
+        "lastModified": 1782847189,
+        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_3": {
+      "locked": {
+        "lastModified": 1788614874,
+        "narHash": "sha256-7QYjT2vHLuX9Z1pdxHXDKCbh1CR3D/2rywB9Tx0MPRg=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "c043004d1c6985732bcc1cbc5a9c9aecbbb4e0f0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nur": {
+      "inputs": {
+        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs_3"
+      },
+      "locked": {
+        "lastModified": 1788659397,
+        "narHash": "sha256-Xd/wUmqlqS47w0t/ljKub0MOmiAAVpx0igi1n0hmKkM=",
        "owner": "nix-community",
        "repo": "nur",
-        "rev": "6cb6d34cd4db4e7ea09ff3e8bea0e2b11773292b",
+        "rev": "1e14af32138775431c1656ca01dbc2a8d9c6c9e7",
        "type": "github"
      },
      "original": {
@@ -244,12 +272,13 @@
    },
    "root": {
      "inputs": {
+        "arion": "arion",
        "darwin": "darwin",
        "hardware": "hardware",
        "home-manager": "home-manager",
-        "hyprland": "hyprland",
        "nix-colors": "nix-colors",
-        "nixpkgs": "nixpkgs",
+        "nixUnstable": "nixUnstable",
+        "nixpkgs": "nixpkgs_2",
        "nur": "nur",
        "sops-nix": "sops-nix"
      }
@@ -258,17 +287,14 @@
      "inputs": {
        "nixpkgs": [
          "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs"
        ]
      },
      "locked": {
-        "lastModified": 1712617241,
-        "narHash": "sha256-a4hbls4vlLRMciv62YrYT/Xs/3Cubce8WFHPUDWwzf8=",
+        "lastModified": 1788337237,
+        "narHash": "sha256-gkSH8VUtCo6hnysNmb9DbTuDepH2t5pv+QWjP75xKAk=",
        "owner": "Mic92",
        "repo": "sops-nix",
-        "rev": "538c114cfdf1f0458f507087b1dcf018ce1c0c4c",
+        "rev": "fbf759290e0cb0a98dfc813a4eb7d53ad1dacb57",
        "type": "github"
      },
      "original": {
@@ -276,71 +302,6 @@
        "repo": "sops-nix",
        "type": "github"
      }
-    },
-    "systems": {
-      "locked": {
-        "lastModified": 1689347949,
-        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
-        "owner": "nix-systems",
-        "repo": "default-linux",
-        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default-linux",
-        "type": "github"
-      }
-    },
-    "wlroots": {
-      "flake": false,
-      "locked": {
-        "lastModified": 1712935342,
-        "narHash": "sha256-zzIbTFNFd/as42jyGx23fil2uBDYYv+8GA5JmRq5y9c=",
-        "owner": "hyprwm",
-        "repo": "wlroots-hyprland",
-        "rev": "62eeffbe233d199f520a5755c344e85f8eab7940",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "wlroots-hyprland",
-        "rev": "62eeffbe233d199f520a5755c344e85f8eab7940",
-        "type": "github"
-      }
-    },
-    "xdph": {
-      "inputs": {
-        "hyprland-protocols": [
-          "hyprland",
-          "hyprland-protocols"
-        ],
-        "hyprlang": [
-          "hyprland",
-          "hyprlang"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1709299639,
-        "narHash": "sha256-jYqJM5khksLIbqSxCLUUcqEgI+O2LdlSlcMEBs39CAU=",
-        "owner": "hyprwm",
-        "repo": "xdg-desktop-portal-hyprland",
-        "rev": "2d2fb547178ec025da643db57d40a971507b82fe",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "xdg-desktop-portal-hyprland",
-        "type": "github"
-      }
    }
  },
  "root": "root",
@@ -1,13 +1,14 @@
 {
  description = "SoraFlake";
-
  inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    # Trick renovate into working: "github:NixOS/nixpkgs/nixpkgs-unstable"
+    nixUnstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
    hardware.url = "github:nixos/nixos-hardware";
    nur.url = "github:nix-community/nur";

    home-manager = {
-      url = "github:nix-community/home-manager";
+      url = "github:nix-community/home-manager/release-25.11";
      inputs.nixpkgs.follows = "nixpkgs";
    };

@@ -16,17 +17,19 @@
      inputs.nixpkgs.follows = "nixpkgs";
    };

-    hyprland = {
-      url = "github:hyprwm/Hyprland";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
+    # hyprland = {
+    #   url = "github:hyprwm/Hyprland";
+    #   inputs.nixpkgs.follows = "nixpkgs";
+    # };
    sops-nix = {
      url = "github:Mic92/sops-nix";
      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs-stable.follows = "nixpkgs";
    };
    nix-colors.url = "github:misterio77/nix-colors";

+    arion.url = "github:hercules-ci/arion";
+    arion.inputs.nixpkgs.follows = "nixpkgs";
+
  };

  outputs = inputs:
@@ -41,6 +44,7 @@
        avalon = gen.generate { host = "avalon"; };
        ci = gen.generate { host = "ci"; };
        sandbox = gen.generate { host = "sandbox"; };
+        gateway = gen.generate { host = "gateway"; };
      };
      darwinConfigurations = { asgard = gen.generate { host = "asgard"; }; };
      homeConfigurations = {
@@ -6,12 +6,14 @@
    in ({
      "nixos" = inputs.nixpkgs.lib.nixosSystem {
        system = syscfg.syscfg.system;
+        specialArgs = { inherit inputs; };
        modules = [
          ./modules/shared/syscfg
          ./modules/shared/sops
          ./modules/nixos
          syscfg
          ./systems/${host}
+          inputs.arion.nixosModules.arion
          inputs.sops-nix.nixosModules.sops
          inputs.home-manager.nixosModules.home-manager
          {
@@ -27,7 +29,8 @@
                  syscfg
                  { usercfg = userConfig; }
                  inputs.nix-colors.homeManagerModule
-                  inputs.hyprland.homeManagerModules.default
+                  # inputs.hyprland.homeManagerModules.default
+                  inputs.sops-nix.homeManagerModules.sops
                ];
              }) syscfg.syscfg.users);
          }
@@ -51,7 +54,7 @@
              nameValuePair userConfig.username {
                imports = [
                  inputs.nix-colors.homeManagerModule
-                  inputs.hyprland.homeManagerModules
+                  inputs.sops-nix.homeManagerModules.sops
                ];
              }) syscfg.syscfg.users);
          }
@@ -1,5 +1,6 @@
 { lib, config, ... }: {

+  #environment.sessionVariables.SOPS_AGE_KEY_FILE = keyFilePath;
  systemd.user.startServices = "sd-switch";
  programs.home-manager.enable = true;

@@ -7,6 +8,14 @@
    username = "${config.usercfg.username}";
    homeDirectory = "/home/${config.usercfg.username}";

-    stateVersion = "23.11";
+    stateVersion = "24.11";
  };
+
+
+  #SOPS
+  # sops.defaultSopsFile = ./sops/${config.usercfg.username}.yaml;
+  # sops.age.keyFile = "/var/lib/sops-nix/age-key.txt";
+  # sops.age.generateKey = true;
+  # sops.secrets."github_user_key" = { };
+  # sops.secrets."curse_forge_key" = { };
 }
@@ -0,0 +1,69 @@
+curse_forge_key: ENC[AES256_GCM,data:PhhwPhUys/WDzXb40iFlrUcwFEJVzi49vDlm5Hpc7IUwbBiQI1Zvi6115THMvarnGESDyouPfoZP0wha,iv:x//EzR4QwdD0UxqV97yUepc39DopoqiDT21unpF9R2E=,tag:5jM1EibWo0wI+PS70+kb/Q==,type:str]
+github_user_key: ENC[AES256_GCM,data:RvBsQjWGd2qRCvBzcpMv8FIXGY/GiPd9o0x2Oq+NlbXxR2NMqNBNLw==,iv:99AcmOWFft7XQAn7YrGjZuCvz0M5wUkYeInsWwyeUFM=,tag:wkw2YQGi9j/8XtOFd8KhdQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBraWFDRFUxQ2l5OWV1OXNK
+            UExEbWZkM0kzVk1rZG4yY3pBLzdMVWVJS0UwCnhlWFJ5T2lZUXJyNkg1ejQxaU1t
+            L3F2RUhldTY3N2xXL0hwczNKRzNjcncKLS0tIEkycHoxcDBGNyt2V3RDY29wNGVp
+            TGg5Rk05VkRsaXM1Q0NxMmtMajRORDAKqjFldiAYJKjmnkeDkwanjYvhL6645DZ5
+            dVXExjqO/DG733ge8HFyKzpfpkzRymV1giUwxBdII1dd0mJ2ncINeA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ms8f0ysv6vakxepvt69fejczs6tddexepesdv4rkgtheehj3nu4sc6290s
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3UkRjblIvYStZUzQyRHA1
+            ZGVXeHhrN0kyVkxZdms5U3gwVFlPMW12MVJjCjRkVURpZXBzb0tYenB4dGxKamh6
+            VXVBMmo1Ujkvd2VTRExyWE5MbVJaclUKLS0tIDVhRkYzZmEzUG00Q2IwOWZUMVVt
+            ODVIbytpcjN1cVMyaG1qVVdkRmtaMzQKNsvD9DpK/raDBob+IcuNk72tQDts36kJ
+            QhtoLy8MvUymi49PdEWrgyf68w5XwRO/U4iINhR0qzm0glg/XcyHjA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJc3hKWkk3ckNOY2UyTVhG
+            MmtLaEd0K04yaGxiOUoxMXkzOEFnYis4VkhnCktDRFM2bS8vb05OWDdwa0RwRlNO
+            cmlZemtxVGZ6S0tNTDV1cmE1N0pVWnMKLS0tIE9EZllycHJpcEY2R1pwOFhOZEU3
+            L01IcytDd3BPb0VOTW9DQ2lUdUVJS0kKiD+C+3mK1b/eIwCEFanFgYGLNk3JNPQ7
+            i1UqzbHVxSd0q/YVwdKAcj0jA6EezGm275tgq7IVsy2sHkvRMaEDtQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAweVU3TkxFZzRnd2I2clN2
+            ZTlTWmhwQkhVc1hnOXFvZVVDSWpHMVh1TGtrCkc3M1pUTnZCMHpvYXB5ZVhreGxa
+            ZVY2cG5Ja2ltL3k2Q1VEalc5TTNFMXcKLS0tIGd5UWl0RGVXT211Zm51dlB6WFZ1
+            STRtTVpVTCtVZ1FUNENqWFFVNTNuaVUKN6HRiZjTdENeif8dJ29urBxPXDaosjjY
+            InN4Ko6YUaGfvB1DTrKIzrxOpsHS+XjisoGfT71tJwwEOoREklEO/A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-23T18:05:22Z"
+    mac: ENC[AES256_GCM,data:YSi2xIwz50VxUDL3QzGVUwRWUgZhvudSLCKgwIbWm8gkuAJ/V2sVRhJNVQJ1YvLO44ob5hmrgR4wSnOdAbS7FrpbLcJuoYBjVUTDjy+j6otnIDxEcYeciHhZ1pV/OiydBmJC+lZ4+SRdWdokL2HaXRKgc9QT9e/MdAbFIzI1x90=,iv:8rj8yEqHTMgoGu31RVskYizmROB/5I0ajZJ/EcmlVfE=,tag:PILFCyXY8sXYGxCEHS7qCg==,type:str]
+    pgp:
+        - created_at: "2023-04-20T10:20:17Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA6R3Y9nD7qMBAQ/8CVWQaYKfOzvPIllZyyWpUjHRLLXaR8MNJ8U5WI/tdwdN
+            9UScDYJFuYRW7Q9s4Mt961kBGpaHqe9MUZBxUDlYX59+EN3FbO/eMQ5OqI05ESmL
+            TvZB4+S9C5o73nuypSDNvYz+Lgq6DO25ZPhXdtPhx2DE4G31/wft/LpxhjalIjI8
+            MU0Dv22R4qC+glJbe4GIF2IJ8XoxnnzjiGeSqiyv0QIBM0SzOtA5sKwNohWBnW7g
+            7vxOTm5+kyzG0dDjt3tFApgPDaA1wjofzhRuuveF52VBsuIA2opFdpqkyICvK6rn
+            NB5kUaPlY6A0m+n0oHSfY5wm/AnHNE4Oob/ifumAaB0EAJVUTRauI5M8SeJF0ya1
+            U0IQ9N2lb7Y6q4pqHywIa6fnylsqCfxInAYKMuslRq8f9t/qakb4/MYcnPrwpzjw
+            73/naiNoJmG6NVTkM52qTtOqZAmsaQd5cigTuPW2Z2CJq1yLZEVGSSd1DUGUjBDK
+            nQGucpVVVpD+ifrIPz+Iqwy+5NoZZm/Oa9pKJGFzqXinnDNZaqtgpmTw9QxcSeaP
+            VvGZG9CDd89MtAm1VQyuqi1bQ2faq3G0xNrLl7xUsfmjx4ofW+JXR87OzvGfLPhu
+            Sjl3kS9j5/MEBRBg3n9gNkgSu5Sy3ilhckY3yjTgAT9Gw2giDhCiUXi1/7KrGprS
+            UQHPCSsjyWsyuYVa3lAP/WPdVclc4WOdfYcetUCXBVP7LQr0bq+IG+2J0nnY3mDt
+            Va5k4sP1qu6Ecrs2JioQ1V2H+VmcrRykBWnMXl1tDSWKMA==
+            =pS8X
+            -----END PGP MESSAGE-----
+          fp: 4E241635F8EDD2919D2FB44CA362EA0491E2EEA0
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2
@@ -1,15 +1,17 @@
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {

  programs.git = {
    enable = true;
-    userEmail = "${config.usercfg.git.email}";
-    userName = "${config.usercfg.git.username}";
-    signing = {
-      key = "${config.usercfg.git.key}";
+    signing = lib.mkIf (config.usercfg.git.key != null) {
+      key = config.usercfg.git.key;
      signByDefault = true;
    };
    ignores = [ "*result*" ".direnv" "node_modules" ];
-    extraConfig = { core.hooksPath = "./.dev/hooks"; };
+    settings = {
+      core.hooksPath = "./.dev/hooks"; 
+      user.email = "${config.usercfg.git.email}";
+      user.name = "${config.usercfg.git.username}";
+    };
  };

  home.packages = with pkgs; [ tig ];
@@ -12,7 +12,7 @@
    cbonsai
    pipes-rs
    cmatrix
-    cava
+    #cava
    sl
  ];
 }
@@ -9,10 +9,16 @@ in {
      "sudo" = "sudo ";
      "devsh" =
        "nix develop --profile /tmp/devsh-env ${nixflake_url}#devsh -c zsh";
+      "cdevsh" =
+        "nix develop --profile /tmp/devsh-env -c zsh";
      "nixb" = "(sudo nixos-rebuild switch --flake ${nixflake_url})";
      "nixgc" = "sudo nix-collect-garbage -d && nix-collect-garbage -d";
      "ssh" = "TERM=xterm-256color  ${pkgs.openssh}/bin/ssh";
      "top" = "btop";
    };
+    initContent = ''
+      sopsu() {nix-shell -p sops --run "sops updatekeys $1";}
+      sopsn() {nix-shell -p sops --run "sops $1";}
+    '';
  };
 }
@@ -2,6 +2,6 @@
  imports = [ ./vscodium ];

  config = lib.mkIf (config.syscfg.make.develop) {
-    home.packages = with pkgs; [ blender godot_4 ];
+    home.packages = with pkgs; [ blender godot_4 openscad-unstable orca-slicer pandoc claude-code];
  };
 }
@@ -4,14 +4,17 @@
    programs.vscode = {
      enable = true;
      package = pkgs.vscodium;
-      extensions = with pkgs.vscode-extensions; [
-        bbenoist.nix
-        esbenp.prettier-vscode
-        golang.go
-        ms-python.vscode-pylance
-        ms-vscode.cpptools
-        dbaeumer.vscode-eslint
-      ];
+      #profiles.default = {
+        profiles.default.extensions = with pkgs.vscode-extensions; [
+          bbenoist.nix
+          esbenp.prettier-vscode
+          golang.go
+          ms-python.vscode-pylance
+          ms-vscode.cpptools
+          dbaeumer.vscode-eslint
+          continue.continue 
+        ];
+      #};
    };
  };
 }
@@ -25,6 +25,20 @@
                }
            }
        }
+        {   name = "libpipewire-module-loopback"
+            args = {
+                node.description = "Virtual Loopback"
+                audio.position = [ FL FR ]
+                capture.props = {
+                    media.class = "Audio/Sink"
+                    node.name = "vloopback_sink"
+                }
+                playback.props = {
+                    media.class = "Audio/Source"
+                    node.name = "vloopback_source"
+                }
+            }
+        }
      ]
    '';
  };
@@ -10,8 +10,11 @@
      xfce.tumbler

      telegram-desktop
+      discord-canary
      pavucontrol
      keepassxc
+      nextcloud-client
+
      gramps
    ];
  };
@@ -1,20 +1,22 @@
-{ lib, config, pkgs, ... }: {
+{ inputs, lib, config, pkgs, ... }: {

-  imports = [ ./openttd.nix ];
+  imports = [ ./openttd.nix ./wow.nix ];

  config = lib.mkIf (config.syscfg.make.game) {

    home.packages = with pkgs; [
-      # custom.simc

      #games
-      steam
+      # steam
      gamemode
-      gamescope
-      mangohud
+      #gamescope
+      #mangohud
      prismlauncher
      openttd-jgrpp
-      bottles
+      #bottles
+      lutris
+      unstable.umu-launcher
+      # wine
    ];
  };

@@ -0,0 +1,23 @@
+{ pkgs, lib, config, sops, ... }: {
+
+  config = lib.mkIf (config.syscfg.make.game) {
+
+    home.packages = with pkgs;
+      [
+        # custom.simc
+        unstable.instawow
+      ];
+
+    # templates buggy currently
+    #xdg.configFile."instawow/config.json" = ''${config.sops.templates."instawow_config.json".path}'';
+    sops.templates."instawow_config.json".content = ''
+       {
+            "auto_update_check": true,
+            "access_tokens": {
+              "cfcore": "${config.sops.placeholder.curse_forge_key}",
+              "github": "${config.sops.placeholder.github_user_key}",
+              "wago_addons": null
+            }
+        }'';
+  };
+}
@@ -28,7 +28,7 @@ in {

    qt = {
      enable = true;
-      platformTheme = "gtk";
+      platformTheme.name = "gtk";
    };

    home.packages = [ wallpaperGen pkgs.swww ];
@@ -11,8 +11,8 @@ in pkgs.stdenv.mkDerivation rec {
  src = pkgs.fetchFromGitHub {
    owner = "vinceliuice";
    repo = "Orchis-theme";
-    rev = "be8b0aff92ed0741174b74c2ee10c74b15be0474";
-    sha256 = "sha256-m7xh/1uIDh2BM0hTPA5QymXQt6yV7mM7Ivg5VaF2PvM=";
+    rev = "5b73376721cf307101e22d7031c1f4b1344d1f63";
+    sha256 = "sha256-+2/CsgJ+rdDpCp+r5B/zys3PtFgtnu+ohTEUOtJNd1Y=";
  };

  nativeBuildInputs = with pkgs; [ gtk3 sassc ];
@@ -22,43 +22,43 @@ in pkgs.stdenv.mkDerivation rec {
  preInstall = ''
    mkdir -p $out/share/themes
    cat > src/_sass/_color-palette-${scheme.slug}.scss << 'EOF'
-      $red-light: #${scheme.palette.base0F};
-      $red-dark: #${scheme.palette.base0F};
+      $red-light: #${scheme.palette.low0F};
+      $red-dark: #${scheme.palette.high0F};

-      $pink-light: #${scheme.palette.base0E};
-      $pink-dark: #${scheme.palette.base0E};
+      $pink-light: #${scheme.palette.low0E};
+      $pink-dark: #${scheme.palette.high0E};

-      $purple-light: #${scheme.palette.base0D};
-      $purple-dark: #${scheme.palette.base0D};
+      $purple-light: #${scheme.palette.low0D};
+      $purple-dark: #${scheme.palette.high0D};

-      $blue-light: #${scheme.palette.base0C};
-      $blue-dark: #${scheme.palette.base0C};
+      $blue-light: #${scheme.palette.low0C};
+      $blue-dark: #${scheme.palette.high0C};

-      $teal-light: #${scheme.palette.base0B};
-      $teal-dark: #${scheme.palette.base0B};
+      $teal-light: #${scheme.palette.low0B};
+      $teal-dark: #${scheme.palette.high0B};

-      $green-light: #${scheme.palette.base0A};
-      $green-dark: #${scheme.palette.base0A};
-      $sea-light: #${scheme.palette.base0B};
-      $sea-dark: #${scheme.palette.base0B};
+      $green-light: #${scheme.palette.low0A};
+      $green-dark: #${scheme.palette.high0A};
+      $sea-light: #${scheme.palette.alt_low0B};
+      $sea-dark: #${scheme.palette.alt_high0B};

-      $yellow-light: #${scheme.palette.base09};
-      $yellow-dark: #${scheme.palette.base09};
+      $yellow-light: #${scheme.palette.low09};
+      $yellow-dark: #${scheme.palette.low09};

-      $orange-light: #${scheme.palette.base08};
-      $orange-dark: #${scheme.palette.base08};
+      $orange-light: #${scheme.palette.low08};
+      $orange-dark: #${scheme.palette.high08};

      $grey-050: #${scheme.palette.base07};
      $grey-100: #${scheme.palette.base07};
-      $grey-150: #${scheme.palette.base07};
+      $grey-150: #${scheme.palette.base06};
      $grey-200: #${scheme.palette.base06};
-      $grey-250: #${scheme.palette.base06};
+      $grey-250: #${scheme.palette.base05};
      $grey-300: #${scheme.palette.base05};
-      $grey-350: #${scheme.palette.base05};
+      $grey-350: #${scheme.palette.base04};
      $grey-400: #${scheme.palette.base04};
-      $grey-450: #${scheme.palette.base04};
+      $grey-450: #${scheme.palette.base03};
      $grey-500: #${scheme.palette.base03};
-      $grey-550: #${scheme.palette.base03};
+      $grey-550: #${scheme.palette.base02};
      $grey-600: #${scheme.palette.base02};
      $grey-650: #${scheme.palette.base02};
      $grey-700: #${scheme.palette.base01};
@@ -17,7 +17,8 @@ calendar {
    font-weight: bold;
  }

-  .button {
+  label {
+    font-size: 20pt;
    color: $base0C;
  }

@@ -35,9 +36,6 @@ calendar {
  margin-top: -4pt;
 }

-.minute, .hour, .day, .month {
-  font-size: 20pt;
-}

 .date {
  color: $base0C;
@@ -47,5 +45,4 @@ calendar {

 .datetime {
  padding: $gaps-window;
-  
 }
@@ -1,3 +1,6 @@
+.tray * {
+    padding: $border-width 0px;
+}
 .tray menu {
    background-color: $base01;
    color: $base07;
@@ -8,7 +11,7 @@
 	padding: 10px 0px;

 	>menuitem {
-        margin: 0px $border-width;
+        margin: 2px $border-width;
 		padding: 0px 10px;

 		&:disabled label {
@@ -101,6 +101,9 @@ tooltip {
 }
 .modevent:hover {
  @include border-active;
+  border-right-style: none;
+  border-bottom-right-radius: 0;
+  border-top-right-radius: 0;
 }

 .modinner {
@@ -48,7 +48,7 @@


 (defwindow bar
-    :monitor 0
+    :monitor 1
    :geometry (geometry
      :x "0%"
      :y "0%"
@@ -5,28 +5,30 @@
    (eventbox
      :onhover "${EWW_CMD} update date_rev=true"
      :onhoverlost "${EWW_CMD} update date_rev=false"
+      :onclick "(sleep 0.1 && ${EWW_CMD} open --toggle calendar)"
+      :onrightclick "(sleep 0.1 && ${EWW_CMD} open --toggle powermenu)"
      (box
        :class "datetime"
        (overlay
          (box
            :orientation "v"
-            (button
-              :class "hour" hour)
-            (button
-              :class "minute" minute))
+            (label :show-truncated false 
+              :class "hour" 
+              :text {hour})
+            (label :show-truncated false
+            :class "minute"
+              :text {minute}))
          (revealer
            :reveal date_rev
            (box
              :class "date"
              :orientation "v"
-              (button
-                :onclick "${EWW_CMD} open --toggle calendar"
-                :onrightclick "${EWW_CMD} open --toggle powermenu"
-                :class "day" day)
-              (button
-                :onclick "${EWW_CMD} open --toggle calendar"
-                :onrightclick "${EWW_CMD} open --toggle powermenu"
-                :class "month" month))
+              (label :show-truncated "false" 
+                :class "day"
+                :text {day})
+              (label :show-truncated "false"
+                :class "month" 
+                :text {month}))
          )
        )
      )
@@ -6,23 +6,21 @@

 (defwidget sys-mod []
  (module
-    (button
-      :class "module"
-      :onclick "${EWW_CMD} open --toggle sys"
+    (eventbox
+      :onclick "(sleep 0.1 && ${EWW_CMD} open --toggle sys)"
      (box
-      :orientation "v"
-        (circular-progress
-          :value {EWW_CPU.avg}
-          :class "cpubar"
-          :thickness 6
-          (label :class "icon-text" :text "C"))
-
-        (circular-progress
-          :value {gpu.devices[0].GRBM2?.CommandProcessor-Graphics?.value?:0}
-          :class "gpubar"
-          :thickness 6
-          (label :class "icon-text" :text "G"))
+        :orientation "v"
+          (circular-progress
+            :value {EWW_CPU.avg}
+            :class "cpubar"
+            :thickness 6
+            (label :class "icon-text" :text "C"))

+          (circular-progress
+            :value {gpu.devices[0].GRBM2?.CommandProcessor-Graphics?.value?:0}
+            :class "gpubar"
+            :thickness 6
+            (label :class "icon-text" :text "G"))
        (circular-progress
          :value {100*memory.used/memory.total}
          :class "membar"
@@ -7,7 +7,7 @@
        :class "tray"
        :space-evenly "true"
        :orientation "v"
-        :icon-size 24
+        :icon-size 20
        :prepend-new "false"
        )
    )
@@ -11,6 +11,7 @@
 					(button
 						:onclick "hyprctl dispatch workspace ${ws.number}"
 						(label 
+							:show-truncated false
 							:class "icon-text  ${ws.color}"
 							:text `${ws.focused ? "󰜗" : "󰝥"}`
 						)
@@ -64,7 +64,7 @@ done
 generate

 # main loop
-socat -u UNIX-CONNECT:/tmp/hypr/"$HYPRLAND_INSTANCE_SIGNATURE"/.socket2.sock - | rg --line-buffered "workspace|mon(itor)?" | while read -r line; do
+socat -u UNIX-CONNECT:$XDG_RUNTIME_DIR/hypr/"$HYPRLAND_INSTANCE_SIGNATURE"/.socket2.sock - | rg --line-buffered "workspace|mon(itor)?" | while read -r line; do
  case ${line%>>*} in
  "workspace")
    focusedws=${line#*>>}
@@ -1,5 +1,5 @@
 (defwindow calendar
-  :monitor 0
+  :monitor 1
  :geometry (geometry
    :x "0%"
    :y "0%"
@@ -34,7 +34,7 @@
 )

 (defwindow powermenu
-    :monitor 0
+    :monitor 1
    :stacking "overlay"
    :geometry (geometry 
                    :anchor "center"
@@ -2,7 +2,7 @@
 (defvar radio_rev false)

 (defwindow radio
-  :monitor 0
+  :monitor 1
  :geometry (geometry
    :x "0%"
    :y "0%"
@@ -100,8 +100,11 @@
    (box
      :orientation "v"
      (button
-        :onclick "${EWW_CMD} open --toggle --no-daemonize radio"
-        (label :class "icon-text" :text "󰝚")
+        :onclick "(sleep 0.1 && ${EWW_CMD} open --toggle --no-daemonize radio)"
+        (label 
+          :show-truncated false
+          :class "icon-text" 
+          :text "󰝚")
      )
    )
  )
@@ -129,7 +129,7 @@
 )

 (defwindow sys
-  :monitor 0
+  :monitor 1
  :stacking "overlay"
  :geometry (geometry
    :x "0%"
@@ -4,56 +4,70 @@
    services.kanshi = {
      enable = true;
      systemdTarget = "graphical-session.target";
-      profiles = {
-        tower_0 = {
-          outputs = [{
-            criteria = "CEX CX133 0x00000001";
-            mode = "1920x1200@59.972";
-            position = "0,0";
-            scale = 1.0;
-            status = "enable";
-          }];
-        };
-        tower_1 = {
-          outputs = [{
-            criteria = "AOC 16G3 1DDP7HA000348";
-            mode = "1920x1080@144.000";
-            position = "0,0";
-            status = "enable";
-            scale = 1.0;
-            adaptiveSync = true;
-          }];
-        };
-        tower_2 = {
-          outputs = [
+      settings = [
+        {
+          profile.name = "tower_0";
+          profile.outputs = [
            {
-              criteria = "AOC 16G3 1DDP7HA000348";
-              mode = "1920x1080@144.000";
+              criteria = "AOC 24E1W1 GNSKCHA086899";
+              mode = "1920x1080@60.000";
              position = "0,0";
              status = "enable";
              scale = 1.0;
              adaptiveSync = true;
            }
            {
-              criteria = "CEX CX133 0x00000001";
-              mode = "1920x1200@59.972";
-              position = "0,1080";
-              scale = 1.0;
+              criteria = "AOC 24E1W1 GNSKBHA080346";
+              mode = "1920x1080@60.000";
+              position = "1920,0";
              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
            }
          ];
-        };
-        laptop_0 = {
-          outputs = [{
+        }
+        {
+          profile.name = "tower_1";
+          profile.outputs = [
+            {
+              criteria = "AOC 24E1W1 GNSKCHA086899";
+              mode = "1920x1080@60.000";
+              position = "0,0";
+              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
+            }
+            {
+              criteria = "AOC 24E1W1 GNSKBHA080346";
+              mode = "1920x1080@60.000";
+              position = "0,0";
+              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
+            }
+            {
+              criteria = "LG UNKNOWN_TBD";
+              mode = "1920x1080@144.000";
+              position = "0,0";
+              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
+            }
+          ];
+        }
+        {
+          profile.name = "laptop_0";
+          profile.outputs = [{
            criteria = "LG Display 0x060A Unknown";
            mode = "1920x1080@60.020";
            position = "0,0";
            scale = 1.0;
            status = "enable";
          }];
-        };
-        laptop_1 = {
-          outputs = [
+        }
+        {
+          profile.name = "laptop_1";
+          profile.outputs = [
            {
              criteria = "CEX CX133 0x00000001";
              mode = "2560x1600@59.972";
@@ -69,9 +83,10 @@
              status = "enable";
            }
          ];
-        };
-        laptop_2 = {
-          outputs = [
+        }
+        {
+          profile.name = "laptop_2";
+          profile.outputs = [
            {
              criteria = "AOC 16G3 1DDP7HA000348";
              mode = "1920x1080@144.000";
@@ -88,8 +103,8 @@
              status = "enable";
            }
          ];
-        };
-      };
+        }
+      ];
    };
  };
 }
@@ -5,6 +5,8 @@

    xdg.configFile."swaylock/config".text = ''
      screenshots
+      grace-no-mouse
+      grace-no-touch
      grace=5
      effect-pixelate=5
      fade-in=0.2
@@ -17,8 +17,12 @@ in {
      dbus-hyprland-environment
      wayland

-      grim
+      hyprpicker
+      
+      hyprshot
      slurp
+      satty
+
      swappy
      cliphist
      wl-clipboard
@@ -42,6 +46,8 @@ in {
          [ "discord-402572971681644545.desktop" ];
        "x-scheme-handler/discord-696343075731144724" =
          [ "discord-696343075731144724.desktop" ];
+        "x-scheme-handler/tg" = [ "org.telegram.desktop.desktop" ];
+        "x-scheme-handler/tonsite" = [ "org.telegram.desktop.desktop" ];
        "x-scheme-handler/http" = [ "firefox.desktop" ];
        "x-scheme-handler/https" = [ "firefox.desktop" ];
        "x-scheme-handler/chrome" = [ "firefox.desktop" ];
@@ -1,11 +1,12 @@
 { lib, config, pkgs, ... }: {
  config = lib.mkIf (config.usercfg.wm == "Wayland") {
+
    wayland.windowManager.hyprland = {
      enable = true;
      xwayland.enable = true;
      extraConfig = ''
        monitor=,preferred,auto,auto
-
+        env=bitdepth,10
        input {
            kb_layout = us, ru
            kb_variant = intl, phonetic
@@ -13,7 +14,7 @@

            follow_mouse = 1

-            sensitivity = 0 # -0.5 # -1.0 - 1.0, 0 means no modification.
+            sensitivity = 0
                        
            touchpad {
                natural_scroll=no
@@ -60,10 +61,10 @@
            fullscreen_opacity = 1.0
                                      
            # shadow
-            drop_shadow = no
-            shadow_range = 60
-            shadow_offset = 0 5
-            shadow_render_power = 4
+            # drop_shadow = no
+            # shadow_range = 60
+            # shadow_offset = 0 5
+            # shadow_render_power = 4
            #col.shadow = rgba(00000099)
        }
                        
@@ -85,12 +86,10 @@
        }

        master {
-            new_is_master = true
+            new_status = master
        }

-        gestures {
-            workspace_swipe = off
-        }
+        gesture = 3, vertical, workspace
                        
        exec-once = eww open bar
        #exec-once = waybar
@@ -145,6 +144,11 @@
        windowrulev2 = float,class:^(org.telegram.desktop)$,title:^(Media viewer)$
        windowrulev2 = center,class:^(org.telegram.desktop)$,title:^(Media viewer)$

+        #SPECIAL NO SLEEP
+        windowrulev2 = idleinhibit fullscreen, class:^(.*)
+        windowrulev2 = idleinhibit focus, class:^(steam_app_.*)$
+        windowrulev2 = idleinhibit focus, class:^(mpv)$
+
        layerrule = blur,^(eww-blur)

        #binds
@@ -160,7 +164,7 @@
        bind = SUPER SHIFT,D,exec, ~/.config/hypr/themes/apatheia/eww/launch_bar 

        bind = SUPER, V, exec, cliphist list | wofi -dmenu | cliphist decode | wl-copy
-        bind =  , Print, exec, grim -g "$(slurp -d)" - | swappy -f -
+        bind = , PRINT, exec, hyprshot -m region --raw | satty --filename - --early-exit --action-on-enter save-to-clipboard --copy-command 'wl-copy'

        bind = SUPER, L, exec, swaylock 

@@ -110,7 +110,7 @@
      telegram-desktop &
      nextcloud &
      jellyfin-mpv-shim &
-      flameshot &
+      #flameshot &

      sleep 2

@@ -265,7 +265,7 @@

      # Screenshots
      Print
-      	flameshot gui
+      	hyprshot -m region

      # Lock Desktop
      super + l
@@ -5,7 +5,7 @@
  config = lib.mkIf (config.usercfg.wm == "X11") {
    xsession.windowManager.bspwm = { enable = true; };
    services.sxhkd = { enable = true; };
-    home.packages = with pkgs; [ xrandr arandr flameshot xtrlock i3lock ];
+    home.packages = with pkgs; [ xrandr arandr hyprshot xtrlock i3lock ];

  };
 }
@@ -2,9 +2,9 @@
 let cfg = config.syscfg.make.gui;
 in {
  config = lib.mkIf cfg {
-    sound.enable = true;
-    hardware.pulseaudio.enable = false;
+    # sound.enable = true;
    security.rtkit.enable = true;
+    services.pulseaudio.enable = false; #25.05 change to services
    services.pipewire = {
      enable = true;
      alsa.enable = true;
@@ -13,6 +13,6 @@ in {
      # wireplumber.enable = true;
    };

-    environment.systemPackages = with pkgs; [ easyeffects ];
+    environment.systemPackages = with pkgs; [ easyeffects alsa-utils ];
  };
 }
@@ -5,6 +5,9 @@ in {
    programs.steam = {
      enable = true;
      remotePlay.openFirewall = true;
+      extraCompatPackages = with pkgs;  [proton-ge-bin];
    };
+    programs.gamemode.enable = true;
+
  };
 }
@@ -1,5 +1,6 @@
 { lib, config, pkgs, ... }: {
  config = lib.mkIf (config.syscfg.make.gui) {
+    programs.xwayland.enable = true;
    services.xserver = {
      enable = true;
      videoDrivers = [ "amd" ];
@@ -9,7 +9,7 @@ in {
      };
      efi = {
        canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot/efi";
+        efiSysMountPoint = "/boot";
      };
    };
  };
@@ -1 +1 @@
-{ ... }: { imports = [ ./base ./boot ./fs ./opengl ./power ./udev ./virt ]; }
+{ ... }: { imports = [ ./base ./boot ./fs ./graphics ./power ./udev ./virt ]; }
@@ -0,0 +1,4 @@
+{ ... }: {
+  hardware.graphics.enable = true;
+  hardware.graphics.enable32Bit = true;
+}
@@ -1,5 +0,0 @@
-{ ... }: {
-  hardware.opengl.enable = true;
-  hardware.opengl.driSupport = true;
-  hardware.opengl.driSupport32Bit = true;
-}
@@ -7,9 +7,24 @@
        STOP_CHARGE_THRESH_BAT0 = 90;
        CPU_SCALING_GOVERNOR_ON_AC = "performance";
        CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+        MEM_SLEEP_ON_BAT = "deep";
      };
    };
    
+    powerManagement.enable = true;
+    # suspend to RAM (deep) rather than `s2idle`
+    boot.kernelParams = [ "mem_sleep_default=deep" ];
+    # suspend-then-hibernate
+    systemd.sleep.extraConfig = ''
+      HibernateDelaySec=30m
+      SuspendState=mem
+    '';
+
+    services.logind.settings.Login.HandleLidSwitch = "suspend-then-hibernate";
+    # Hibernate on power button pressed
+    services.logind.settings.Login.HandlePowerKey = "hibernate";
+    services.logind.settings.Login.HandlePowerKeyLongPress = "poweroff";
+
    systemd.user.services.battery_monitor = {
      wants = [ "display-manager.service" ];
      wantedBy = [ "graphical-session.target" ];
@@ -9,7 +9,13 @@
      podman = {
        enable = true;
        dockerSocket.enable = true;
-        defaultNetwork.settings.dnsname.enable = true;
+        dockerCompat = true;
+        defaultNetwork.settings = {
+          #dnsname.enable = true;
+          dns_enabled = true;
+          #internal = true;
+          #name = "internal";
+        };
      };
    };
  };
@@ -4,6 +4,15 @@
    useDHCP = true;
    nameservers = [ "1.1.1.1" "9.9.9.9" ];

-    firewall = { enable = true; };
+    firewall = { 
+      enable = true;
+      allowedUDPPorts = 
+        (if config.syscfg.server ? wireguard then [ 1515 ] else [ ]) ++ 
+        [ ];
+
+      allowedTCPPorts = 
+        (if config.syscfg.server ? web       then [ 80 443 22 ] else [ ]) ++ 
+        [ ];
+    };
  };
 }
@@ -1,4 +1,12 @@
-{ config, lib, ... }: {
+{ config, lib, pkgs, ... }: let
+
+  isValidPeer = p: 
+    (p ? syscfg.net.wg.enable) && 
+    (p.syscfg.net.wg.enable == true) && 
+    (p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
+  activePeers = builtins.filter isValidPeer config.syscfg.peers;
+in
+{
  config = lib.mkIf (config.syscfg.net.wg.enable) {
    networking.wireguard = {
      enable = true;
@@ -9,14 +17,26 @@
            config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
          listenPort = 1515;
          mtu = 1340;
-          peers = [{
-            allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
-            endpoint = "vpn.helcel.net:1515";
-            publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
-            persistentKeepalive = 30;
-          }];
+          peers = 
+            if (config.syscfg.server ? wireguard && config.syscfg.server.wireguard) then
+              map (p: {
+                name = p.syscfg.hostname;
+                publicKey = p.syscfg.net.wg.pubkey;
+                allowedIPs = [ p.syscfg.net.wg.ip4 p.syscfg.net.wg.ip6 ];
+              }) activePeers
+            else
+              [{
+                allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
+                endpoint = "vpn.helcel.net:1515";
+                publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
+                persistentKeepalive = 30;
+              }];
        };
      };
    };
+    systemd.services."wireguard-wg0" = {
+      after = [ "network-online.target" "nss-lookup.target" ];
+      wants = [ "network-online.target" "nss-lookup.target" ];
+    };
  };
 }
@@ -1,4 +1,4 @@
-{ pkgs, ... }: {
+{ inputs, pkgs, ... }: {
  nixpkgs.config = {
    permittedInsecurePackages = [ ];
    allowUnfree = true;
@@ -8,9 +8,9 @@
    };

  };
-  nixpkgs.overlays = import ../../../../overlays { inherit pkgs; };
+  nixpkgs.overlays = import ../../../../overlays { inherit inputs pkgs; };
  nix = {
-    package = pkgs.nixFlakes;
+    package = pkgs.nixVersions.stable;
    extraOptions = ''
      experimental-features = nix-command flakes
      warn-dirty = false
@@ -37,5 +37,5 @@
      ];
    };
  };
-  system.stateVersion = "24.05";
+  system.stateVersion = "24.11";
 }
@@ -15,16 +15,16 @@
        GBM_BACKEND = "amd-drm";
        __GL_GSYNC_ALLOWED = "0";
        __GL_VRR_ALLOWED = "1";
-        WLR_DRM_NO_ATOMIC = "1";
        __GLX_VENDOR_LIBRARY_NAME = "amd";
+        WLR_DRM_NO_ATOMIC = "1";
        _JAVA_AWT_WM_NONREPARENTING = "1";
        QT_QPA_PLATFORM = "wayland";
        QT_WAYLAND_DISABLE_WINDOWDECORATION = "1";
-        GDK_BACKEND = "wayland";
+        # GDK_BACKEND = "wayland";
        WLR_NO_HARDWARE_CURSORS = "1";
        MOZ_ENABLE_WAYLAND = "1";
-        WLR_BACKEND = "vulkan";
-        WLR_RENDERER = "vulkan";
+        # WLR_BACKEND = "vulkan";
+        # WLR_RENDERER = "vulkan";
        XCURSOR_SIZE = "24";
        NIXOS_OZONE_WL = "1";
      };
@@ -2,6 +2,9 @@

  config = lib.mkIf (config.syscfg.make.develop) {
    programs.adb.enable = true;
+    # services.udev.packages = [
+    #   pkgs.android-udev-rules
+    # ];
    programs.wireshark.enable = true;

    environment.systemPackages = with pkgs; [ wget dconf wireshark ];
@@ -1 +1,64 @@
-{ ... }: { imports = [ ./debug ./develop ]; }
+{ pkgs, ... }: {
+  imports = [ ./debug ./develop ];
+
+  # services.telegraf = {
+  #     enable = true;
+  #     extraConfig = {
+  #         agent = {
+  #             interval = "10s";
+  #             round_interval = true;
+  #             metric_batch_size = 1000;
+  #             metric_buffer_limit = 10000;
+  #             collection_jitter = "0s";
+  #             flush_interval = "10s";
+  #             flush_jitter = "0s";
+  #             precision = "";
+  #             hostname = "valinor";
+  #             omit_hostname = false;
+  #         };
+
+  #         inputs.cpu = {
+  #             percpu = true;
+  #             totalcpu = true;
+  #             collect_cpu_time = false;
+  #             report_active = false;
+  #         };
+
+  #         inputs.mem = {};
+  #         inputs.swap = {};
+  #         inputs.system = {};
+  #         inputs.disk = {
+  #             ignore_fs = ["tmpfs" "devtmpfs" "devfs"];
+  #         };
+
+  #         inputs.net = {};
+  #         inputs.netstat = {};
+
+  #         inputs.ping = {
+  #             urls = ["8.8.8.8" "8.8.4.4"];
+  #             count = 4;
+  #             interval = "60s";
+  #             binary = "${pkgs.iputils.out}/bin/ping";
+  #         };
+
+  #         inputs.internet_speed = {
+  #             interval = "2m";
+  #         };
+
+  #         inputs.net_response = {
+  #             protocol = "tcp";
+  #             address = "google.com:80";
+  #             timeout = "5s";
+  #             read_timeout = "5s";
+  #             interval = "30s";
+  #         };
+
+  #         outputs.influxdb_v2 = {
+  #             urls = [""];
+  #             token = "";
+  #             organization = "";
+  #             bucket = "";
+  #         };
+  #     };
+  # };
+}
@@ -6,10 +6,13 @@ let
    includeEmulator = false;
  };
 in {
+
+  imports = [ ./ollama ];
  config = lib.mkIf (config.syscfg.make.develop) {
-    environment.systemPackages = with pkgs; [
-      android-tools
-      androidStudioPackages.canary
-    ];
+    environment.systemPackages = with pkgs;
+      [
+        # android-tools
+        unstable.androidStudioPackages.canary
+      ];
  };
 }
@@ -0,0 +1,16 @@
+{ lib, config, pkgs, ... }: 
+let 
+ ollamaPkg = pkgs.ollama-rocm;
+in{
+
+  config = lib.mkIf (config.syscfg.make.develop) {
+    services.ollama = {
+        enable = true;
+        package = ollamaPkg;
+        acceleration = "rocm"; 
+        loadModels = [ "deepseek-v2:lite" "qwen2.5-coder:7b" "qwen2.5-coder:1.5b" ];
+        syncModels = true;
+    };
+    environment.systemPackages = with pkgs; [ ollamaPkg ];
+  };
+}
@@ -11,6 +11,7 @@ in {
        extraGroups = [
          "networkmanager"
          "wheel"
+          "dialout"
          "vboxsf"
          "adbusers"
          "libvirtd"
@@ -21,6 +22,7 @@ in {
          "docker"
          "podman"
          "wireshark"
+          "gamemode"
        ];
      }) config.syscfg.users);
  };
@@ -0,0 +1,43 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.syscfg.server.containers;
+  enabledConfigs = lib.filterAttrs (name: c: c.enable) cfg;
+  containerSetsList = lib.mapAttrsToList (name: containerCfg:
+  let defs = import (./defs + "/${name}.nix") {inherit config pkgs lib containerCfg;};
+  in{
+    containers = lib.mapAttrs' (cName: cValue: 
+      lib.nameValuePair "${name}-${cName}" cValue
+    ) defs.containers;
+  }
+) enabledConfigs;
+  mergedContainers = lib.attrsets.mergeAttrsList  (lib.map(e: e.containers) containerSetsList);
+  allPathConfigs = lib.flatten (lib.map (e: e.paths or []) containerSetsList);
+in
+{
+  config = lib.mkIf ( enabledConfigs != {} ) {
+
+    virtualisation.oci-containers = {
+      backend = "podman";
+      containers = mergedContainers;
+    };
+
+    systemd.services.podman-gc = {
+      description = "Podman garbage collection";
+      serviceConfig.Type = "oneshot";
+      script = ''
+        ${pkgs.podman}/bin/podman container prune -f
+        ${pkgs.podman}/bin/podman image prune -f
+      '';
+      startAt = "weekly";
+    };
+    
+    system.activationScripts.container-setup-dirs = {
+      deps = [ "users" "groups" ];
+      text = lib.concatStringsSep "\n" (map (cfg: ''
+        mkdir -p "${cfg.path}"
+        chown ${cfg.owner} "${cfg.path}"
+        chmod ${cfg.mode} "${cfg.path}"
+      '') allPathConfigs);
+    };
+  };
+}
@@ -0,0 +1,78 @@
+{ config, containerCfg, pkgs, lib, ... }:
+let 
+serverCfg = config.syscfg.server;
+in {
+  paths = [{
+    path="${serverCfg.dataPath}/authentik/media";
+    owner = "1000:1000";
+    mode = "0755";
+  }{
+    path="${serverCfg.dataPath}/authentik/templates";
+    owner = "1000:1000";
+    mode = "0755";
+  }];
+
+  containers = {
+
+    server = {
+      image = "ghcr.io/goauthentik/server:latest";
+      volumes = [
+        "${serverCfg.dataPath}/authentik/media:/media"
+        "${serverCfg.dataPath}/authentik/templates:/templates"
+      ];
+      environmentFiles = [
+        config.sops.secrets."AUTHENTIK".path
+      ];
+      environment = {
+        "AUTHENTIK_REDIS__HOST" = "host.containers.internal";
+        "AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
+        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
+        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
+        "AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}";
+        "AUTHENTIK_EMAIL__PORT" = "587";
+        "AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}";
+        "AUTHENTIK_EMAIL__USE_TLS" = "true";
+        "AUTHENTIK_EMAIL__USE_SSL" = "false";
+        "AUTHENTIK_EMAIL__TIMEOUT" = "10";
+        "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}";
+      };
+      labels = {
+        "traefik.enable" = "true";
+        "traefik.http.routers.sso.entrypoints" = "web-secure";
+        "traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
+        "traefik.http.routers.sso.tls" = "true";
+        "traefik.http.services.sso.loadbalancer.server.port" = "${toString containerCfg.port}";
+      };
+      cmd = [ "server" ];
+      extraOptions = [
+        "--add-host=host.containers.internal:host-gateway"
+        "--ip=${containerCfg.ip}"
+      ];
+      ports = [
+        "9999:${toString containerCfg.port}"
+      ];
+    };
+
+    worker = {
+      image = "ghcr.io/goauthentik/server:latest";
+      volumes = [
+        "${serverCfg.dataPath}/authentik/media:/media"
+        "${serverCfg.dataPath}/authentik/templates:/templates"
+        "/var/run/docker.sock:/var/run/docker.sock"
+      ];
+      environmentFiles = [
+        config.sops.secrets."AUTHENTIK".path
+      ];
+      environment = {
+        "AUTHENTIK_REDIS__HOST" = "host.containers.internal";
+        "AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
+        "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
+        "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
+      };
+      extraOptions = [
+        "--add-host=host.containers.internal:host-gateway"
+      ];
+      cmd = [ "worker" ];
+    };
+  };
+}
@@ -1,12 +1,17 @@
-{ pkgs, ... }: {
-  project.name = "Cloud";
+{ config, pkgs, lib, ... }:
+let serverCfg = config.syscfg.server;
+in {
+  project.name = "cloud";

  networks = {
    internal = {
+      name = lib.mkForce "internal";
      internal = true;
-      external = false;
    };
-    external = { external = true; };
+    external = {
+      name = lib.mkForce "external";
+      internal = false;
+    };
  };

  services = {
@@ -17,16 +22,17 @@
      restart = "unless-stopped";
      networks = [ "external" ];
      volumes = [
-        "${DATA_PATH}/data/nextcloud:/var/www/html"
-        "${DATA_PATH}/data/music:/media/music"
-        "${DATA_PATH}/data/video:/media/video"
-        "${DATA_PATH}/data/photo:/media/photo"
+        "${serverCfg.configPath}/data/nextcloud:/var/www/html"
+        "${serverCfg.dataPath}/data/music:/media/music"
+        "${serverCfg.dataPath}/data/video:/media/video"
+        "${serverCfg.dataPath}/data/photo:/media/photo"
      ];
      tmpfs = [ "/tmp" ];
      labels = {
        "traefik.enable" = "true";
        "traefik.http.routers.nextcloud.entrypoints" = "web-secure";
-        "traefik.http.routers.nextcloud.rule" = "Host(`cloud.${HOST_DOMAIN}`)";
+        "traefik.http.routers.nextcloud.rule" =
+          "Host(`cloud.${serverCfg.hostDomain}`)";
        "traefik.http.routers.nextcloud.tls" = "true";
        "traefik.http.routers.nextcloud.middlewares" =
          "sts_headers,nextcloud-caldav";
@@ -52,9 +58,9 @@
      environment = {
        username = "COLLABORA_USER";
        password = "COLLABORA_PASSWORD";
-        aliasgroup1 = "https://cloud.${HOST_DOMAIN}";
-        server_name = "office.${HOST_DOMAIN}";
-        VIRTUAL_HOST = "office.${HOST_DOMAIN}";
+        aliasgroup1 = "https://cloud.${serverCfg.hostDomain}";
+        server_name = "office.${serverCfg.hostDomain}";
+        VIRTUAL_HOST = "office.${serverCfg.hostDomain}";
        VIRTUAL_PORT = "9980";
        VIRTUAL_PROTO = "http";
        DONT_GEN_SSL_CERT = "true";
@@ -66,7 +72,8 @@
      labels = {
        "traefik.enable" = "true";
        "traefik.http.routers.collabora.entrypoints" = "web-secure";
-        "traefik.http.routers.collabora.rule" = "Host(`office.${HOST_DOMAIN}`)";
+        "traefik.http.routers.collabora.rule" =
+          "Host(`office.${serverCfg.hostDomain}`)";
        "traefik.http.routers.collabora.tls" = "true";
      };
    };
@@ -77,15 +84,15 @@
      restart = "unless-stopped";
      networks = [ "external" ];
      volumes = [
-        "${DATA_PATH}/ether/etherpad/data:/opt/etherpad-lite/var"
-        "/${DATA_PATH}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
+        "${serverCfg.dataPath}/ether/etherpad/data:/opt/etherpad-lite/var"
+        "${serverCfg.dataPath}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
      ];
      environment = {
        NODE_ENV = "production";
        TITLE = "Helcel-Pad";
        DB_TYPE = "mysql";
-        DB_HOST = DB_HOST;
-        DB_PORT = DB_PORT;
+        DB_HOST = serverCfg.dbHost;
+        DB_PORT = serverCfg.dbPort;
        DB_NAME = "etherpad";
        DB_USER = "ETHERPAD_DB_USER";
        DB_PASS = "ETHERPAD_DB_PASSWORD";
@@ -99,7 +106,8 @@
      labels = {
        "traefik.enable" = "true";
        "traefik.http.routers.etherpad.entrypoints" = "web-secure";
-        "traefik.http.routers.etherpad.rule" = "Host(`pad.${HOST_DOMAIN}`)";
+        "traefik.http.routers.etherpad.rule" =
+          "Host(`pad.${serverCfg.hostDomain}`)";
        "traefik.http.routers.etherpad.tls" = "true";
      };
    };
@@ -110,13 +118,13 @@
      restart = "unless-stopped";
      networks = [ "external" "internal" ];
      volumes = [
-        "${DATA_PATH}/ether/etherpad/data:/opt/etherpad-lite/var"
-        "/${DATA_PATH}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
+        "${serverCfg.dataPath}/ether/etherpad/data:/opt/etherpad-lite/var"
+        "${serverCfg.dataPath}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
      ];
      environment = {
        NODE_ENV = "production";
        TITLE = "Helcel-Calc";
-        REDIS_PORT_6379_TCP_ADDR = "redis";
+        REDIS_PORT_6379_TCP_ADDR = "ethercalc-redis";
        REDIS_PORT_6379_TCP_PORT = "6379";
        ADMIN_PASSWORD = "ETHERPAD_ADMIN_PASSWORD";
        SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
@@ -124,7 +132,8 @@
      labels = {
        "traefik.enable" = "true";
        "traefik.http.routers.ethercalc.entrypoints" = "web-secure";
-        "traefik.http.routers.ethercalc.rule" = "Host(`calc.${HOST_DOMAIN}`)";
+        "traefik.http.routers.ethercalc.rule" =
+          "Host(`calc.${serverCfg.hostDomain}`)";
        "traefik.http.routers.ethercalc.tls" = "true";
      };
    };
@@ -134,7 +143,7 @@
      container_name = "ethercalc-redis";
      restart = "unless-stopped";
      networks = [ "internal" ];
-      volumes = [ "${DATA_PATH}/ether/ethercalc/redis:/data" ];
+      volumes = [ "${serverCfg.dataPath}/ether/ethercalc/redis:/data" ];
      environment = { };
      labels = { "traefik.enable" = "false"; };
    };
@@ -1,12 +1,17 @@
-{ pkgs, ... }: {
-  project.name = "NEW";
+{ config, pkgs, lib, ... }:
+let serverCfg = config.syscfg.server;
+in {
+  project.name = "name";

  networks = {
    internal = {
+      name = lib.mkForce "internal";
      internal = true;
-      external = false;
    };
-    external = { external = true; };
+    external = {
+      name = lib.mkForce "external";
+      internal = false;
+    };
  };

  services = {
@@ -0,0 +1,81 @@
+{ config, pkgs, ... }: {
+  project.name = "traefik";
+
+  networks = {
+    internal = {
+      name = lib.mkForce "internal";
+      internal = true;
+    };
+    external = {
+      name = lib.mkForce "external";
+      internal = false;
+    };
+  };
+
+  services = {
+
+    traefik.service = {
+      image = "traefik:latest";
+      container_name = "traefik";
+      restart = "unless-stopped";
+      networks = [ "internal" "external" ];
+      command = [
+        "--api"
+        "--providers.docker=true"
+        "--entrypoints.web.address=:80"
+        "--entrypoints.web-secure.address=:443"
+      ];
+      port = [ "443" "80" ];
+      volumes = [
+        "/var/run/docker.sock:/var/run/docker.sock:ro"
+        "${serverCfg.configPath}/traefik/traefik.yaml:/etc/traefik/traefik.yaml"
+        "${serverCfg.configPath}/traefik/access.log:/etc/traefik/access.log"
+        "${serverCfg.configPath}/traefik/acme.json:/acme.json"
+      ];
+      environment = {
+        "INFOMANIAK_ACCESS_TOKEN" = config.sops.secrets.INFOMANIAK_API_KEY.path;
+      };
+      labels = { "traefik.enable" = "false"; };
+    };
+
+    matomo.service = {
+      image = "matomo:latest";
+      container_name = "matomo";
+      restart = "unless-stopped";
+      networks = [ "external" ];
+      volumes = [
+        "/etc/localtime:/etc/localtime:ro"
+        "${serverCfg.configPath}/matomo:/var/www/html/config:rw"
+        "${serverCfg.configPath}/traefik/access.log:/var/log/taccess.log:ro"
+      ];
+      environment = { };
+      labels = {
+        "traefik.http.routers.matomo.rule" =
+          "Host(`matomo.${serverCfg.hostDomain}`)";
+        "traefik.http.routers.matomo.entrypoints" = "web-secure";
+        "traefik.http.routers.matomo.tls" = "true";
+      };
+    };
+
+    searx.service = {
+      image = "searxng/searxng:latest";
+      container_name = "searx";
+      restart = "unless-stopped";
+      networks = [ "external" ];
+      volumes = [ "/etc/localtime:/etc/localtime:ro" ];
+      environment = {
+        "BASE_URL" = "https://searx.${serverCfg.hostDomain}";
+        "AUTOCOMPLETE" = "true";
+        "INSTANCE_NAME" = "searx${serverCfg.shortName}";
+      };
+      labels = {
+        "traefik.http.routers.matomo.rule" =
+          "Host(`searx.${serverCfg.hostDomain}`)";
+        "traefik.http.routers.matomo.entrypoints" = "web-secure";
+        "traefik.http.routers.matomo.tls" = "true";
+      };
+    };
+
+  };
+}
+
@@ -0,0 +1,76 @@
+
+{ config, lib, pkgs, ... }:
+let
+  listNames = config.syscfg.server.db;
+
+  containerNames = lib.mapAttrsToList 
+    (name: cfg: name) 
+    (lib.filterAttrs (name: cfg: cfg.db or false) config.syscfg.server.containers);
+
+  allApps = lib.unique (listNames ++ containerNames);
+
+in {
+  config = lib.mkIf ( builtins.length allApps > 0) {
+    services.postgresql = {
+      enable = true;
+      enableTCPIP = true; # Required to listen on network interfaces
+      settings = {
+        listen_addresses = lib.mkForce "*"; 
+      };
+      authentication = pkgs.lib.mkOverride 10 ''
+         # TYPE  DATABASE        USER            ADDRESS                 METHOD
+         local   all             all                                     trust
+         host    all             all             127.0.0.1/32            trust
+         host    all             all             ::1/128                 trust
+         host    all             all             10.0.0.0/8              scram-sha-256
+         host    all             all             169.254.0.0/16          scram-sha-256
+      '';
+      ensureDatabases = map (name: "${name}_db") allApps;
+      ensureUsers = map (name: { name = "${name}_user"; }) allApps;
+    };
+    services.postgresqlBackup = {
+      enable = true;
+      location = "/var/lib/postgresql/backups";
+      startAt = "*-*-* 04:00:00"; # Runs every day at 4 AM
+      backupAll = true; # Backs up all databases and roles
+    };
+
+    services.redis.servers."main" = {
+      enable = true;
+      port = 6379;
+      bind = "*";
+      settings.protected-mode = "no";
+    };
+
+
+    systemd.services.postgresql-init = {
+      description = "Custom Postgres Setup (Ownership & Passwords)";
+      after = [ "postgresql.service" ];
+      wantedBy = [ "multi-user.target" ];
+      
+      serviceConfig = {
+        Type = "oneshot";
+        User = "postgres";
+        RemainAfterExit = true;
+      };
+
+      script = ''
+        ${pkgs.coreutils}/bin/sleep 2
+        PSQL="${pkgs.postgresql}/bin/psql"
+        ${lib.concatMapStringsSep "\n" (name: ''
+          $PSQL -tAc "ALTER DATABASE ${name}_db OWNER TO ${name}_user;"
+          
+          if [ -f "${config.sops.secrets."${lib.toUpper name}".path}" ]; then
+            PASS=$(grep "^DB_PASSWORD=" "${config.sops.secrets."${lib.toUpper name}".path}" | cut -d'=' -f2-)
+            echo $PASS
+            if $PSQL -tAc "ALTER USER ${name}_user WITH PASSWORD '$PASS';" ; then
+                echo "✅ Successfully set password for ${name}_user"
+            else
+                echo "❌ FAILED to set password for ${name}_user"
+            fi
+          fi
+        '') allApps}
+      '';
+    };
+  };
+}
@@ -1,4 +1,3 @@
-{ ... }:
-{
-  # virtualisation.arion.projects.
+{ config, pkgs, lib, ... }:{
+  imports = [ ./containers ./database ./nftables ./openssh ./sops ];
 }
@@ -1,99 +0,0 @@
-{ pkgs, ... }: {
-  project.name = "Authentik";
-
-  networks = {
-    internal = {
-      internal = true;
-      external = false;
-    };
-    external = { external = true; };
-  };
-
-  services = {
-
-    auth_postgresql.service = {
-      image = "postgres:14-alpine";
-      container_name = "auth_postgresql";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [ ];
-      environment = {
-        POSTGRES_PASSWORD = "/run/secrets/AUTHENTIK_POSTGRESQL__PASSWORD";
-        POSTGRES_USER = "authentik";
-        POSTGRES_DB = "authentik";
-      };
-    };
-
-    auth_redis.service = {
-      image = "redis:alpine";
-      container_name = "auth_redis";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [ ];
-      environment = { };
-      labels = { "traefik.enable" = "false"; };
-    };
-
-    auth_server.service = {
-      image = "ghcr.io/goauthentik/server:latest";
-      container_name = "auth_server";
-      restart = "unless-stopped";
-      networks = [ "internal" "external" ];
-      volumes = [
-        "${DATA_PATH}/authentik/media:/media"
-        "${DATA_PATH}/authentik/templates:/templates"
-      ];
-      environment = {
-        "AUTHENTIK_REDIS__HOST" = "auth_redis";
-        "AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql";
-        "AUTHENTIK_POSTGRESQL__USER" = "authentik";
-        "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
-        "AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD";
-        "AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY";
-        "AUTHENTIK_EMAIL__HOST" = "${MAIL_SERVER_DOMAIN}";
-        "AUTHENTIK_EMAIL__PORT" = "587";
-        "AUTHENTIK_EMAIL__USERNAME" = "noreply@${MAIL_HOST_DOMAIN}";
-        "AUTHENTIK_EMAIL__PASSWORD" = "AUTHENTIK_EMAIL_PASSWORD";
-        "AUTHENTIK_EMAIL__USE_TLS" = "true";
-        "AUTHENTIK_EMAIL__USE_SSL" = "false";
-        "AUTHENTIK_EMAIL__TIMEOUT" = "10";
-        "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${MAIL_HOST_DOMAIN}";
-      };
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.sso.entrypoints" = "web-secure";
-        "traefik.http.routers.sso.rule" = "Host(`sso.${HOST_DOMAIN}`)";
-        "traefik.http.routers.sso.tls" = "true";
-        "traefik.http.services.sso.loadbalancer.server.port" = "9000";
-        "traefik.docker.network" = "external";
-      };
-      command = "server";
-      service.ports = [
-        "9999:9000" # host:container
-      ];
-    };
-
-    auth_worker.service = {
-      image = "ghcr.io/goauthentik/server:latest";
-      container_name = "auth_worker";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [
-        "${DATA_PATH}/authentik/media:/media"
-        "${DATA_PATH}/authentik/templates:/templates"
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ];
-      environment = {
-        "AUTHENTIK_REDIS__HOST" = "auth_redis";
-        "AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql";
-        "AUTHENTIK_POSTGRESQL__USER" = "authentik";
-        "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
-        "AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD";
-        "AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY";
-      };
-      labels = { "traefik.enable" = "false"; };
-      command = "worker";
-      user = "root";
-    };
-  };
-}
@@ -0,0 +1,47 @@
+
+
+{ config, lib, ... }:{
+  config = lib.mkIf (config.syscfg.server.nftables.enable) {
+    boot.kernel.sysctl = {
+      "net.ipv4.ip_forward" = 1;
+      "net.ipv6.conf.all.forwarding" = 1;
+    };
+
+    networking.nftables.enable = true;
+    networking.nftables.ruleset = ''
+      table inet filter {
+        chain input {
+          type filter hook input priority filter; policy accept;
+          tcp dport {5432, 6379} ip saddr { 10.0.0.0/8 169.254.0.0/16 } accept
+          
+        }
+      }
+      table inet nat {
+        chain prerouting {
+          type nat hook prerouting priority dstnat; policy accept;
+          
+          ${lib.concatMapStringsSep "\n" (rule:
+            let
+              srcInt = builtins.elemAt rule 0;
+              dstAddr4 = builtins.elemAt rule 1;
+              dstAddr6 = builtins.elemAt rule 2;
+              srcPort = toString (builtins.elemAt rule 3);
+              dstPort = toString (builtins.elemAt rule 4);
+            in ''
+                iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
+                iifname "${srcInt}" udp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
+
+                iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
+                iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
+            ''
+          ) config.syscfg.server.nftables.ports}
+        }
+        
+        chain postrouting {
+          type nat hook postrouting priority srcnat; policy accept;
+          oifname { ${lib.concatMapStringsSep ", " (iface: ''"${iface}"'') config.syscfg.server.nftables.ifs} } masquerade
+        }
+      }
+    '';
+  };
+}
@@ -0,0 +1,27 @@
+{ config, lib, ... }: 
+let
+  allUsers = lib.concatMap (peer: if peer.syscfg ? users then peer.syscfg.users else []) config.syscfg.peers;
+  groupedUsers = lib.groupBy (u: u.username) allUsers;
+  allowedUsernames = map (u: u.username) config.syscfg.users;
+  activeUsers = lib.filterAttrs (name: _: lib.elem name allowedUsernames) groupedUsers;
+in {
+  config = lib.mkIf (config.syscfg.server.openssh) {
+    services.openssh = {
+        enable = true;
+        ports = [ 422 ];
+        banner = "";
+        settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        ClientAliveInterval = 60;
+        ClientAliveCountMax = 3;
+        TCPKeepAlive = true;
+        };
+    };
+    users.users = lib.mapAttrs (name: userList: {
+        openssh.authorizedKeys.keys = lib.unique (
+        lib.concatMap (u: if u ? pubssh then [ u.pubssh ] else []) userList
+        );
+    }) activeUsers;
+    };
+}
@@ -0,0 +1,16 @@
+{ config, lib, pkgs, ... }:
+let
+ listNames = config.syscfg.server.db;
+  containerNames = lib.mapAttrsToList (name: cfg: name) 
+    (lib.filterAttrs (name: cfg: cfg.db or false) config.syscfg.server.containers);
+  allApps = lib.unique (listNames ++ containerNames);
+in{
+  config = lib.mkIf (config.syscfg.server.sops) {
+    sops.secrets = {
+      INFOMANIAK_API_KEY = { sopsFile = ./server.yaml; };
+    } // (lib.genAttrs (map (name: "${lib.toUpper name}") allApps) (name: {
+      owner = "postgres";
+      sopsFile = ./server.yaml;
+    }));
+  };
+}
@@ -0,0 +1,47 @@
+INFOMANIAK_API_KEY: ENC[AES256_GCM,data:QhjQoCMxogXAPtvUbf/EWkqsFAndn73LBuTqj5essjruekynH287D/CYN/cwfcnDqZoh6Z4A9p08uUmXzqmTiralAhsCoc+Ljb/monmsruc=,iv:8rMGNc9398jnFXZm34fOht6fMNDAcDZ68B1jwoQPn2Q=,tag:ZlQnPaxkCktpwiC6HzmFVg==,type:str]
+AUTHENTIK: ENC[AES256_GCM,data:jNcqbLEMbaQ7mmn4dK4LFguecDDxrBsQZaqfQeQ+iGel6mD4jAC6rNdGC8H8NepRWmc0ZjNC6Fe4EaGllbjq/50SqlB47DtyuuCwOZFP6fiU4sD13B7t0Fg/7xMomqnRnJ+3UyVzt6PgEzzQNoPPpHxVGpR+TJnROhflcmCKi/JdAR6dspNqJEbrjp4LVk28Rp9Od6lbsOGphRb79z/DKA1QYRPuE7QU7Edzqqy09g5nKjGxIxjWNEYPt0WiD3537eBICfWm5krs8jxyf6TSiGasHSgSDyJSbnoNkPzSf9A5Jwtulu1jFgjvY/v+qhs9649USp1MzogSAfDZBNC4irge/lb5EPPIQ31EC/Dybza9dX/h6cR/KyQm5GsxBBJzm33rzC/4aCCRlcsAl5eO4JZn4MZta4yHss2UQHQ48i15OSdBwwTbTt240UbrIIje0hfOM6R+Uk3VOY/+VtBV/D+0ks2SUEKMvWgqJDhDh4FVqeR0a9dpLhOAvaWryAAETjlHljOrcF3Q3WooZbBDvLyMMtsHIeF1JDqwghI3,iv:8RdNbsnVVu4awW6yrpLGxAtM7o6uN5vgZIotmT6osW8=,tag:rNaCeG6STXINm42x1b2jcw==,type:str]
+sops:
+    age:
+        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4Rzc3ak4vRVZiNWxNZEN3
+            N21rSjZqUm9XVWF5TUxNTXVybEMzNCtod0NnClNjODB6VWhzU1VHeVdlZ3hEaE5D
+            MW9WWWYvYmt5TmNzMzNudDhLSW12RnMKLS0tIDdjc2ZOK3QxaTFJMFdpTHFzcklr
+            clZnQXpPbWs5aXZJeUlxOWhJNmIrOFkKZfZ19Y4yfCJi1GrxLsv76JyBmuxW/glF
+            BCJCvmdSSOJx5JW26Y3Y3LwiIuL8yboKR+8ZAwU2fG5OQfs+2czFdQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1pf4auk6u2tmefuqpuc6mntr26cp4wcsmlhnn98arzxsp3753ruqsj0jqk3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cEpsb2gvbDJ0aG5BRWNS
+            WXgydFo3ZkF3SmVIU1EvaHVjb3RvK3BxVDJrCis2ME9zUEVGQURFdmJXS2lTSklk
+            V3ZONHpTZVJqMUxOVkd5ZDlqVTRNdzgKLS0tIGwwR0k1Vll6bEdmZVZvVktzMTRN
+            S1NaTVFTL0FCdm1EQmRsUnlhclZNZlEKEgIe60qkvY8+UocjQU+WM2dTL/1y3Kqk
+            d4RrlLP9NSozwVsPYI4ntygvMSApbT4v0YvoO7gV90lkGWEvW1YDfA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-06T01:10:20Z"
+    mac: ENC[AES256_GCM,data:O4RLfEE6z0uDRpZdL47Or+z/PTeJ+zgzXN9kJS6Nebs9Uhw0XUJUPGhAocLokiMin5sQcpxXG5Q8oc2rAkq2GDbtna4u26dtNkd2Q/vtly6DqUaIRXXt3TL5cfJwMNa76fp+ERKLwGbBG+/BFWajzYJtcE257I8t3X4UmAdqYmE=,iv:uYLh8LnGobf7t3Ur7drEiA6n3Vv0e0yhlja6Uww8jiU=,tag:ZK3OCCsiMPtKl28lrGKtqQ==,type:str]
+    pgp:
+        - created_at: "2026-05-05T23:46:27Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA6R3Y9nD7qMBAQ/+JdTDmQhL1+iX7yeyGs1kt9yQeMYkJ+bQD3LqlQVh6Xea
+            yPIdcMBjAf1CNlkJKeJ4QK3f8rsZkxHmUFVDz7yCXctsp81hNBMZ0sauBM50OU4W
+            gQsDailZHgG5qCqKx91qSyVLtzVy4zcoTXy8TWLrSwztCt9qqX9LFZTKyZzNTiHW
+            DHYSwaJdTteXY89pZjPAQ6UtIdoVWaVfvCgaSZAxr3K8IJmobvMhhk/Fgm3CoE6Y
+            mfQd4lQhoqxrn2M/FKc30vg0yKVsiW3qlfnJCVHCxYUtQLVs3cF05lmj7CYy+0Mu
+            7eZlfVj84hCLmd4ccOITkrOTqcBKWKQ5EpE8DGvWlLPEZt407MjaphEJ7dYhkfr/
+            x4HrahZoeVbYX2Va0++picut+cE/NL9F/QMfqP4QhdHQhe74FlQcxpGDtcUIQep5
+            8MvbEAhUpGL4sErg6afmIapxXi3euIXcBDYPatgoAlsH7E8rUTX1Sd4VOgV89kEJ
+            pkl4OOwcaiF+brqtDiTGZf5l6AOugiYTp2Rtq9KMcGEGEmXFLcFKVjNEkZIxNxt3
+            EtrXrNmOCVJm71yOn2ruD9n2EXzFULfeyOhup7eYVfynkEWYlCQNHeaqMy2q656m
+            LWVd89AUzWLcsmY8naWpfekU9K//hLHxRLBzqfouYXJ+Ji/HOvfRj7NZBg6UtgfS
+            XgFOJg3EaLAZEyvEZKWpnWlf3gBTRK3ffaLzs+eddSgzYUutzlOYUZb7v3iEdjta
+            4Ik4F1M+kOGieyVxxLHOHMrOn09+WMmFIiPpBtCIcZmtwOzXNdhbZdFWNx5qPhU=
+            =wXdG
+            -----END PGP MESSAGE-----
+          fp: 4E241635F8EDD2919D2FB44CA362EA0491E2EEA0
+    unencrypted_suffix: _unencrypted
+    version: 3.12.1
@@ -1,5 +1,5 @@
 { config, ... }: {
-  imports = [ ./sorahiro_soft.nix ];
+  imports = [ ./sorahiro.nix ];

  colorScheme.palette.border-radius = "#8";
  colorScheme.palette.border-width = "#2";
@@ -0,0 +1,67 @@
+{ nix-colors, ... }: 
+let use_pastelle = true;
+in{
+  # usage:  a = "#${config.colorScheme.palette.base00}";
+
+  colorScheme = {
+    slug = "sorahiro";
+    name = "sorahiro";
+    author = "Soraefir @ Helcel";
+    variant = "dark";
+    palette = rec {
+      # Format: Name, Pantone, RAL
+      base00 = "#000000"; # Black / 419C / 9005
+      base01 = "#060a0f"; # Rich Black / 532C / 9005
+      base02 = "#212c38"; # Yankees Blue / 433C / 5011
+      base03 = "#3f5268"; # Police Blue  / 432C / 5000
+      base04 = "#617b9a"; # Slate Gray  / 5415C / 5014
+      base05 = "#90a7c1"; # Pewter Blue / 535C / 5024
+      base06 = "#c9d3df"; # Columbia Blue / 538C / 7047
+      base07 = "#fcfcfc"; # Lotion / 663C / 9016
+      alt00 = "#000000"; # Black / 419C / 9005
+      alt01 = "#0c0906"; # Vampire Black  / 419C / 9005
+      alt02 = "#312920"; # Pine Tree / 440C / 6022
+      alt03 = "#5b4e3e"; # Olive Drab Camouflage / 411C / 7013
+      alt04 = "#887660"; # Shadow / 404C / 7002
+      alt05 = "#b8a083"; # Pale Taupe / 480C / 1019
+      alt06 = "#e1cfb9"; # Desert Sand / 482C / 1015
+      alt07 = "#fcfcfc"; # Lotion / 663C / 9016
+
+      base08 = if use_pastelle then low08 else high08;
+      base09 = if use_pastelle then low09 else high09;
+      base0A = if use_pastelle then low0A else high0A;
+      base0B = if use_pastelle then low0B else high0B;
+      base0C = if use_pastelle then low0C else high0C;
+      base0D = if use_pastelle then low0D else high0D;
+      base0E = if use_pastelle then low0E else high0E;
+      base0F = if use_pastelle then low0F else high0F;
+
+      high08 = "#f09732"; # Deep Saffron / 804C / 1033
+      high09 = "#f2d831"; # Dandelion / 114C / 1016
+      high0A = "#98f12f"; # Green Lizard  / 375C / 6038
+      high0B = "#34f4f0"; # Fluorescent Blue  / 3252C / 6027
+      high0C = "#3193f5"; # Brilliant Azure / 2727C / 5015
+      high0D = "#c156f6"; # Blue-Violet / 2592C / 4006
+      high0E = "#f62ac0"; # Royal Pink / 807C / 4010
+      high0F = "#f42060"; # Deep Carmine Pink / 1925C / 3018
+      alt_high08 = "#f66824"; # Orange-Red / 165C / 2008
+      alt_high0B = "#41f3a4"; # Eucalyptus / 3395C / 6037
+      alt_high0C = "#2abef8"; # Spiro Disco Ball / 298C / 5012
+      alt_high0D = "#837ff5"; # Violets Are Blue / 814C / 4005
+
+      low08 = "#ffac56"; # Rajah  / 150C / 1017
+      low09 = "#feea74"; # Shandy  / 127C / 1016
+      low0A = "#bffe8a"; # Menthol  / 374C / 6018
+      low0B = "#4cfefa"; # Electric Blue / 3252C / 6027
+      low0C = "#62acfd"; # Blue Jeans / 279C / 5012
+      low0D = "#9b9bfd"; # Maximum Blue Purple  / 2715C / 4005
+      low0E = "#fe9bda"; # Lavender Rose / 223C / 4003
+      low0F = "#fc8999"; # Tulip / 1775C / 3014
+      alt_low08 = "#fe946a"; # Atomic Tangerine / 811C / 1034
+      alt_low0B = "#87febf"; # Aquamarine / 353C / 6019
+      alt_low0C = "#38c3fd"; # Picton Blue / 298C / 5012
+      alt_low0D = "#dca2ff"; # Mauve / 2572C / 4005
+
+    };
+  };
+}
@@ -1,29 +0,0 @@
-{ nix-colors, ... }: {
-  # usage:  a = "#${config.colorScheme.palette.base00}";
-
-  colorScheme = {
-    slug = "sorahiro-hard";
-    name = "sorahiro-hard";
-    author = "Soraefir @ Helcel";
-    variant = "dark";
-    palette = {
-      # Format: Name, Pantone, RAL
-      base00 = "#030B12"; # Rich Black / 6C / 000-15-00
-      base01 = "#0C1D2E"; # Maastricht Blue / 5395C / 270-20-15
-      base02 = "#203A53"; # Japanese Indigo / 534C / 260-20-20
-      base03 = "#425F7C"; # Deep Space Sparkle / 7699C / 260-40-20
-      base04 = "#93A9BE"; # Pewter Blue / 535C / 260-70-15
-      base05 = "#B6C5D5"; # Pastel Blue / 5445C / 260-80-10
-      base06 = "#D6DFE8"; # Gainsboro / 642C / 260-90-05
-      base07 = "#F0F3F7"; # White / 656C / 290-92-05
-      base08 = "#F59331"; # Deep Saffron / 715C / 070-70-70
-      base09 = "#F5F531"; # Maximum Yellow / 394C / 100-80-80
-      base0A = "#93F531"; # French Lime / 7488C / 120-70-75
-      base0B = "#31F593"; # Eucalyptus / 3385C / 160-70-50
-      base0C = "#3193F5"; # Brilliant Azure / 2727C / 280-50-40
-      baseOD = "#9331F5"; # Blue-Violet / 7442C / 300-40-45
-      base0E = "#F53193"; # Royal Pink / 232C / 350-50-50
-      base0F = "#F53131"; # Deep Carmine Pink / 1788C / 040-50-70
-    };
-  };
-}
@@ -1,29 +0,0 @@
-{ nix-colors, ... }: {
-  # usage:  a = "#${config.colorScheme.palette.base00}";
-
-  colorScheme = {
-    slug = "sorahiro-soft";
-    name = "sorahiro-soft";
-    author = "Soraefir @ Helcel";
-    variant = "dark";
-    palette = {
-      # Format: Name, Pantone, RAL
-      base00 = "#030B12"; # Rich Black / 6C / 000-15-00
-      base01 = "#0C1D2E"; # Maastricht Blue / 5395C / 270-20-15
-      base02 = "#203A53"; # Japanese Indigo / 534C / 260-20-20
-      base03 = "#425F7C"; # Deep Space Sparkle / 7699C / 260-40-20
-      base04 = "#93A9BE"; # Pewter Blue / 535C / 260-70-15
-      base05 = "#B6C5D5"; # Pastel Blue / 5445C / 260-80-10
-      base06 = "#D6DFE8"; # Gainsboro / 642C / 260-90-05
-      base07 = "#F0F3F7"; # White / 656C / 290-92-05
-      base08 = "#F5B97D"; # Mellow Apricot / 156C / 070-80-40
-      base09 = "#F5F57D"; # Sunny / 393C / 100-90-50
-      base0A = "#B9F57D"; # Yellow-Green / 373C / 120-80-60
-      base0B = "#7DF5B9"; # Aquamarine / 3375C / 150-80-40
-      base0C = "#7DB9F5"; # Light Azure / 278C / 250-70-30
-      base0D = "#B97DF5"; # Lavender / 2572C / 310-60-35
-      base0E = "#F57DB9"; # Persian Pink / 211C / 350-60-45
-      base0F = "#F57D7D"; # Light Coral / 170C / 030-60-50
-    };
-  };
-}
@@ -1,30 +1,28 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 let
  isCI = builtins.elem config.syscfg.hostname [ "ci" "sandbox" ];
-  keyFilePath =
-    (if isCI then ./mock-key.txt else "/var/lib/sops-nix/age-key.txt");
+  keyFilePath = (if isCI then
+    "/var/lib/sops-nix/mock-key.txt"
+  else
+    "/var/lib/sops-nix/age-key.txt");
  sopsFilePath = (if isCI then ./mock.yaml else ./common.yaml);
 in {
  environment.systemPackages = with pkgs; [ sops ];
-  environment.sessionVariables.OPS_AGE_KEY_FILE = keyFilePath;
+  environment.sessionVariables.SOPS_AGE_KEY_FILE = keyFilePath;

  sops.defaultSopsFile = sopsFilePath;
  sops.age.keyFile = keyFilePath;
  sops.age.generateKey = true;

-  sops.secrets.wifi = { };
-
-  sops.secrets."${config.syscfg.hostname}_ssh_priv" = {
-    mode = "0400";
-    owner = config.users.users.${config.syscfg.defaultUser}.name;
-    group = config.users.users.${config.syscfg.defaultUser}.group;
-  };
-  sops.secrets."${config.syscfg.hostname}_ssh_pub" = {
-    mode = "0400";
-    owner = config.users.users.${config.syscfg.defaultUser}.name;
-    group = config.users.users.${config.syscfg.defaultUser}.group;
-  };
-  sops.secrets."${config.syscfg.hostname}_wg_priv" = { };
-  sops.secrets."${config.syscfg.hostname}_wg_pub" = { };
-
+  sops.secrets = lib.mkMerge [
+  {
+    wifi = { };
+    "${config.syscfg.hostname}_ssh_priv" = {
+      mode = "0400";
+      owner = config.users.users.${config.syscfg.defaultUser}.name;
+      group = config.users.users.${config.syscfg.defaultUser}.group;
+    };
+    "${config.syscfg.hostname}_wg_priv" = { };
+  }
+];
 }
@@ -1,30 +1,34 @@
-ci_ssh_priv: ENC[AES256_GCM,data:3Fd7HtFzD+0Pm0qnmaNeivSrEJnH6A3CzLrSyYD4J1rpdHCYdFB2hbZAB5HF3yeCMlyqnApGHxi+9jN8FI54SzwqJQAgSZvKrkBhrs4JIQxPU0ZhOQHvneWYnA==,iv:NbLyzilDIH5cT3SC0SLaOn0alxXSIyZ/4Tr1zSBjIjI=,tag:xGfI8QRlkj4OZDVuV21Kcg==,type:str]
-ci_ssh_pub: ENC[AES256_GCM,data:6BVY3GS9lMLR/dYNxyldcBJe1DrjG/yHjqfCIw==,iv:VZOA/Q9zmbMnf9DsXN90er+tSnJ+syg3QabDuDal92Q=,tag:+xwHADgq22cV5ai9xd6ceQ==,type:str]
-ci_wg_priv: ENC[AES256_GCM,data:uA4eiEhQbbhLkrTyhRX4Tg==,iv:uHbrAq/mSQ6TtMqGhJez3d13u9ZK1S92w49ntXvbA3g=,tag:KwjiYrnuQxrydVKKV4xN4A==,type:str]
-ci_wg_pub: ENC[AES256_GCM,data:MBIdTEkyJBvbTtYrQYS8,iv:GD3xmJEyD9yZaV72GubGCBi8BW74zmSr2hOl123g0mM=,tag:ekUniuYPCSxwlmB1yUbo4w==,type:str]
-sandbox_ssh_priv: ENC[AES256_GCM,data:OG5ZsSQFEbUKLXtHF9MAHWYwnxBM0EyVyj54sPs9XEsFaRXq3WDa+ANnpVqBLtw6cPodLQHyJ5tY/Hr1rdINNGyLPEz/Zm3K7vz6iXUeThAKDhYaCH4vccFFtQ==,iv:2NbVjpKTyyiY4rtC/A6s2nABo5p0VAWtzC6b6TrHkvI=,tag:sO+SUMws8HncC9dmeiJPSg==,type:str]
-sandbox_ssh_pub: ENC[AES256_GCM,data:6bwJAmLuN0dhC8OiBW8qL2Ejt70a2ar02YTAqimnhcez,iv:/QMFyKaa3nOq1GrLNydq+Q8kS52fK6wsB3MioZN/qVM=,tag:XxcTX/REbHl5MKtRecjM2g==,type:str]
-sandbox_wg_priv: ENC[AES256_GCM,data:8d+WCtyGoEH3/4q1DZImUw==,iv:3efDzVFVCqv6yCNgBEXfQ19oh2bZLPO8my33uBgviW0=,tag:+WNPB7b6tVTzDlSVziDO2w==,type:str]
-sandbox_wg_pub: ENC[AES256_GCM,data:rpxkijFKzyKx3uhEa/+j,iv:UULKRJvU0lktwmKGcIP/sRAZb0j2e0iL40o3DkSv/+U=,tag:OWHbfFPbTY6l3Bu/og78Bg==,type:str]
-PGP_KEY: ENC[AES256_GCM,data:IVhL/l0JSPcefX1z,iv:/tOEukP7LiNhhdSw870vPeUGhN2lse2v1pZ5fJQglc0=,tag:++NUJeRhsDE9eRsbKu8Ldw==,type:str]
-wifi: ENC[AES256_GCM,data:SV3yNB/0dBqggh0kOKU98Nodd0VS4K8kTqg7aLyeAg==,iv:w4nspNxswHl2CZ7diPUzupzotfjskzp91NIq4f0v0UM=,tag:7nUHijRlEgyliWn2ZuZo/Q==,type:str]
+ci_ssh_priv: ENC[AES256_GCM,data:OuWZVS+ul8ERoQHEH8Gq6GdHWY5E3spR0uRu7akTVHrr6vYPWZHdV/8fjqKvfHd+dAeymWXe2Li7NXfXQM+y4OH36r1z9DLstwD4ufUmoHZ/MIO6qlsugzYhMw==,iv:NbLyzilDIH5cT3SC0SLaOn0alxXSIyZ/4Tr1zSBjIjI=,tag:uOzoai0Rq6UthSkWHhw8Hg==,type:str]
+ci_ssh_pub: ENC[AES256_GCM,data:Lu2Ec+HylJzt/IMu1b8AKgGsjpZT7X628pjOYQ==,iv:VZOA/Q9zmbMnf9DsXN90er+tSnJ+syg3QabDuDal92Q=,tag:lef6MRtvgyntMrxphatqmg==,type:str]
+ci_wg_priv: ENC[AES256_GCM,data:IoCn7jrahiJBhKxPuGyexg==,iv:uHbrAq/mSQ6TtMqGhJez3d13u9ZK1S92w49ntXvbA3g=,tag:QrZghdiQbmC9pcjKtIuKug==,type:str]
+ci_wg_pub: ENC[AES256_GCM,data:FB+DBkwDizA3C/s1TCkn,iv:GD3xmJEyD9yZaV72GubGCBi8BW74zmSr2hOl123g0mM=,tag:v189CtpJV7OX0sB9OJaWLA==,type:str]
+sandbox_ssh_priv: ENC[AES256_GCM,data:Wj/M/0VEfY7Ruix7nwi09obpX+w6G+gfGK4ZFTKkbpEEM2JyFnRHhWYQiBvBQOXahTGQ+zAnibCNcHSTCBa66XjMhtY865Hs6FovVCfgx0awTZcns26w5vqJdg==,iv:2NbVjpKTyyiY4rtC/A6s2nABo5p0VAWtzC6b6TrHkvI=,tag:CVi4i9MNi/cU64cn9s0DRA==,type:str]
+sandbox_ssh_pub: ENC[AES256_GCM,data:xbcGusta4qBO0hfmks+VCpN8N4dd/qGkGNREACVKxuSF,iv:/QMFyKaa3nOq1GrLNydq+Q8kS52fK6wsB3MioZN/qVM=,tag:WTZ2wlfBMmANw6EEWl5jew==,type:str]
+sandbox_wg_priv: ENC[AES256_GCM,data:4trdnPhgjlUChATnNx9o3Q==,iv:3efDzVFVCqv6yCNgBEXfQ19oh2bZLPO8my33uBgviW0=,tag:Io1obSodHW/RWWIg8VS8Zg==,type:str]
+sandbox_wg_pub: ENC[AES256_GCM,data:7L4SJdDMi5DZHpLfR6cs,iv:UULKRJvU0lktwmKGcIP/sRAZb0j2e0iL40o3DkSv/+U=,tag:irsolwnnfOjhYfiyanjxjw==,type:str]
+PGP_KEY: ENC[AES256_GCM,data:lwwHWksY+ea8D3z9,iv:/tOEukP7LiNhhdSw870vPeUGhN2lse2v1pZ5fJQglc0=,tag:225sf9GjXc8/NZgcXJIxZA==,type:str]
+wifi: ENC[AES256_GCM,data:Z+pbGAekk26GD3zg4TXVacP4Nrh93HPEMNcT0I1YaA==,iv:oiWZvnKvWmF/6cRZpCLsuf1uPJig6toNla5uT3t2kyM=,tag:iS3sq8JZsNUby9pSxYPw5g==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
    age:
        - recipient: age13qv9dn9806paqgpjwmmkwtdzvv4qpv0ulksq0epnn8ufaxeug5zskyas3z
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZd0c5ZjZCb0Z6ZXlKaFph
-            S25LcnFaM3NueUdxOEkwQWRVYjZwNEx1TnpVCkJ1RnJsV2IwNWd5RVJBU2pOUnRa
-            UEcrdDVHUnZ3Zng4UVNWZjNhSzRmRGcKLS0tIEpMMGJCZmkrcnFwWjM4ZVF6VmJN
-            aFplU05pYXpPQWZRY202bVhFd3pHdHcKfauUQhzuUwpoaSlky+PlsOTrVQjyCSxi
-            NYlJ7ScbxzJsqTqJbZnD+lbSdWK2XVKXy1Vn4hR0C0WF7g2Y7CU7tg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEbHNVZjRzQi9ram1xNHk3
+            d3pTTStiMjBLZHgwL0cvUGRwRFFzWi9HS2dvCkQ0ZU5UK1owS0N5MHhxOXV1cGVy
+            RnFQbGlhVy9tSVZKYXBqbzZjZU9nd3cKLS0tIDdXdm1qVTYvdS9sQ0Z0aExpTzB1
+            WkNsWVpqaHRSWkl6YXVrN0NoemhiS1EKoDRocdztTLQ5LMwHdlszTFHy+rm+y4RE
+            f97a6Z2J87ZfObRbaap5adVD7qk/tTYHGshT/8G1JxjctsxRgdfsmA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-14T21:03:55Z"
-    mac: ENC[AES256_GCM,data:W9kM3AaHcZcqVtT4qRpMRYKgmA9pBikAPhdKiPR/Y+0MSjY4c9LPeTBeS1vZzUaTgRHmNh/ns6I9SBO36Hio5qI6m/pjNdr9GfFbBpbnY+5mer6YTitq47TVySC9v+BRkES4A34h1Ky5yvJSDlz2kJfO/WVWllaQd0dxq8rgAU8=,iv:cRxgGKhD6KqXKpK4E12lWIIj99hBFSmGzSIv9LmYEyg=,tag:QXcswnB7GavGrBy1dFpQlQ==,type:str]
-    pgp: []
+        - recipient: age1pf4auk6u2tmefuqpuc6mntr26cp4wcsmlhnn98arzxsp3753ruqsj0jqk3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNSHBpZGg0TlVtMFhjY2Ry
+            NzUrd1pPZFZNdFdLSUxrUUROaVNCTzdGR0hrCkVGUmpGemtFSDErRDArS0Y0WGZu
+            YkYzL2NGMTlnNW1NdStHOGpRN3A1VXcKLS0tIGs0MDIxTmpzSGtRWHZESFhNWXlS
+            Y3N0a2VPUHdoRlpUZ3BPVXROdDRHekEK2YN9ZgCaBPt/8kAkZNgsHp61SYqiFFXX
+            2lF0R1GNmYWm6T0YVCp/2ZN3z4GC+monctg1zoo5QsHfhIOpqIVoTA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-09-06T13:37:03Z"
+    mac: ENC[AES256_GCM,data:uI9yG3/jGNGn6yoN9W+9K/AUeSowe4Mb9vhh38pwkuKab9zXTFidCWyh1e0TEOsIHrhfK2GPc2fHwc309/la+CoiNxAIYtC4xmoCYxSGrDgbsZEONrusy9AEKpRCO8CqLYyLYaAG9sLqFyIz3GyEnS/j98V3LeemhFtS17J1VHI=,iv:x/7caaKnggoyEaCx5sf+zzSE+3d7atv+o9B1O3QX0Uc=,tag:Tzfs+ACx+4A6kxAZtVQ3KQ==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.10.2
@@ -1,15 +1,21 @@
 { inputs, lib, ... }:
 let
+  systemsDir = ../../../systems;
+  systemNames = lib.attrNames (lib.filterAttrs 
+    (name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix")) 
+    (builtins.readDir systemsDir));
+
  userOpt = with lib; {
    username = mkOption { type = types.str; };
+    pubssh = mkOption { type = types.str; default=""; };
    wm = mkOption {
      type = types.enum [ "Wayland" "X11" "-" ];
      default = "-";
    };
    git = {
-      username = mkOption { type = types.str; };
-      email = mkOption { type = types.str; };
-      key = mkOption { type = types.str; };
+      username = mkOption { type = types.str; default = "Anonymous";};
+      email = mkOption { type = types.str; default = "anonymous@domain"; };
+      key = mkOption { type = types.nullOr types.str; default=null; };
    };
  };
  netOpt = with lib; {
@@ -42,6 +48,10 @@ let
        type = types.str;
        default = "";
      };
+      pubkey = mkOption {
+        type = types.str;
+        default = "";
+      };
    };
  };
  makeOpt = with lib; {
@@ -55,7 +65,7 @@ let
    };
    virt = mkOption {
      type = types.bool;
-      default = true;
+      default = false;
    };
    power = mkOption {
      type = types.bool;
@@ -72,6 +82,7 @@ let
  };
  serverOpt = with lib; {
    hostDomain = mkOption { type = types.str; };
+    shortName = mkOption { type = types.str; };
    mailDomain = mkOption { type = types.str; };
    mailServer = mkOption { type = types.str; };

@@ -83,7 +94,6 @@ let
      type = types.str;
      default = "3306";
    };
-
    configPath = mkOption {
      type = types.str;
      default = "/media/config";
@@ -92,6 +102,59 @@ let
      type = types.str;
      default = "/media/data";
    };
+    containers  = mkOption {
+      type = types.attrsOf (types.submodule {
+        options = {
+          enable = mkOption { type = types.bool;default = false; };
+          db = mkOption { type = types.bool;default = false; };
+          ip = mkOption { type = types.str; };
+          port = mkOption { type = types.port; };
+          extraParam = mkOption { type = types.str; default = ""; };
+        };
+      });
+      default = {};
+    };
+    sops = mkOption {
+      type = types.bool;
+      default = false;
+    };
+    openssh = mkOption {
+      type = types.bool;
+      default = false;
+    };
+    wireguard = mkOption {
+      type = types.bool;
+      default = false;
+    };
+    web = mkOption {
+      type = types.bool;
+      default = false;
+    };
+    nftables = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+      };
+      ifs = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+      };
+      ports = mkOption {
+        type = types.listOf (types.listOf (types.oneOf [ types.str types.int ]));
+        default = [];
+        description = "Forwarding rules: [ [srcInterface dstAddr srcPort dstPort] ... ]";
+        example = [
+          [ "ens3" "10.10.1.2" "IPV6" 22 2222 ]
+          [ "ens3" "10.10.1.2" "IPV6" 80 80 ]
+          [ "ens3" "10.10.1.2" "IPV6" 443 443 ]
+        ];
+      };
+    };
+
+    db = mkOption {
+      type = types.listOf (types.str);
+      default = [ ];
+    };

  };
 in with lib; {
@@ -113,5 +176,15 @@ in with lib; {
      type = types.listOf (types.submodule { options = userOpt; });
      default = [ ];
    };
+    peers = mkOption {
+      default = map (name: import (systemsDir + "/${name}/cfg.nix")) systemNames;
+    };
+    server = mkOption {
+      type = types.oneOf [
+        types.bool
+        (types.submodule { options = serverOpt; })
+      ];
+      default = false;
+    };
  };
 }
@@ -0,0 +1,10 @@
+{ final, prev, ... }:
+prev.bambu-studio.overrideAttrs (oldAttrs: rec{
+    version = "02.00.01.50";
+    src = prev.fetchFromGitHub {
+        owner = "bambulab";
+        repo = "BambuStudio";
+        rev = "v${version}";
+        hash = "sha256-7mkrPl2CQSfc1lRjl1ilwxdYcK5iRU//QGKmdCicK30=";
+    };
+})
@@ -1,8 +1,16 @@
-{ pkgs, ... }:
+{ inputs, pkgs, ... }:
 [
  (final: prev: {
-    openttd-jgrpp = import ./openttd-jgrpp { inherit final prev; };
-    yarn-berry = import ./yarn-berry { inherit final prev; };
-    eww = import ./eww { inherit final prev; };
+    #openttd-jgrpp = import ./openttd-jgrpp { inherit final prev; };
+    #yarn-berry = import ./yarn-berry { inherit final prev; };
+    #eww = import ./eww { inherit final prev; };
+    #bambu-studio = import ./bambu-studio { inherit final prev; };
+    wine = final.unstable.wineWow64Packages.unstableFull;
+    unstable = import inputs.nixUnstable {
+      
+      system = final.stdenv.hostPlatform.system;
+      stdenv.hostPlatform.system = final.stdenv.hostPlatform.system;
+      config.allowUnfree = true;
+    };
  })
 ]
@@ -2,16 +2,16 @@
 let old = prev.eww;
 in final.rustPlatform.buildRustPackage rec {
  pname = "eww";
-  version = "ebe5f349d184e79edc33199d064d9ec5f1e4dd9b";
+  version = "98c220126d912b935987766f56650b55f3e226eb";

  src = prev.fetchFromGitHub {
    owner = "elkowar";
    repo = "eww";
    rev = "${version}";
-    hash = "sha256-WcAWIvIdGE0tcS7WJ6JlbRlUnKvpvut500NozUmJ6jY=";
+    hash = "sha256-zi+5G05aakh8GBdfHL1qcNo/15VEm5mXtHGgKMAyp1U=";
  };

-  cargoHash = "sha256-8n21FN6uNj/y/PhCDzpB+1ZifIbpjn4d2YPy4vTcVBM=";
+  cargoHash = "sha256-SEdr9nW5nBm1g6fjC5fZhqPbHQ7H6Kk0RL1V6OEQRdA=";

  nativeBuildInputs = old.nativeBuildInputs;
  buildInputs = old.buildInputs ++ [ final.libdbusmenu-gtk3 ];
@@ -1,10 +1,10 @@
 { final, prev, ... }:
 prev.openttd-jgrpp.overrideAttrs (old: rec {
-  version = "0.55.3";
+  version = "0.65.3";
  src = prev.fetchFromGitHub rec {
    owner = "JGRennison";
    repo = "OpenTTD-patches";
    rev = "jgrpp-${version}";
-    hash = "sha256-E1+pXpXNHOu9nPTGSY8baVaKf1Um6IGDjpi1MmENez8=";
+    hash = "sha256-lmDkYrk7qjUSTtCQQCN/pbuLDt3+2RI1K8A1H1GJRjw=";
  };
 })
@@ -1,10 +1,10 @@
 { final, prev, ... }:
 prev.yarn-berry.overrideAttrs (old: rec {
-  version = "3.6.3";
+  version = "4.4.0";
  src = prev.fetchFromGitHub {
    owner = "yarnpkg";
    repo = "berry";
    rev = "@yarnpkg/cli/${version}";
-    hash = "sha256-5QEnFalOEMs1bKYDYpFGnF1YwiGuW3ZxstyJAjz1/KQ=";
+    hash = "sha256-X/axXgRsxek2EJ+B4EogAsaTWTZDEF1m5dXOTZ4OnQQ=";
  };
 })
@@ -3,19 +3,19 @@

 rustPlatform.buildRustPackage rec {
  pname = "amdgpu_top";
-  version = "0.3.1";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "Umio-Yasuno";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-bkrXm3lXJr+sZ09GeVHgfIp8JO3a/Ejrsm1Cm4eY4IU=";
+    hash = "sha256-FUmOoVHDLb86cDA8b9t+wJkUSgY8Lo+abO3F0UBmi+A=";
  };
  cargoLock = {
    lockFile = ./Cargo.lock;
    outputHashes = {
-      "libdrm_amdgpu_sys-0.2.2" =
-        "sha256-2QXT/6octEzokW8+0mHx02R8qQ3kCBDxZT4yyfDkM5A=";
+      "libdrm_amdgpu_sys-0.7.4" =
+        "sha256-re38Ci4CnVmVzGwk3uB3htFQZ1j4W6+pXw4NbV26dEU=";
    };
  };

@@ -1,13 +1,13 @@
 { stdenv, fetchFromGitHub, qt6 }:
 stdenv.mkDerivation rec {
  pname = "simc";
-  version = "ae04662fca7cad8bf218cd8e43ab05631caad758";
+  version = "b1fd592079d1a673ab53ea96d699a6e56424b0ee";

  src = fetchFromGitHub rec {
    owner = "simulationcraft";
    repo = pname;
    rev = version;
-    hash = "sha256-mTo6YTgZMpfyWvdU1JEEmfmBjJlZwAgja1iliOem7mM=";
+    hash = "sha256-RPUCe7aoAYSNj9jv8HN7qhhxRIMmdCfhmUcr72VaHzg==";
  };

  nativeBuildInputs =
@@ -4,7 +4,7 @@ let
    inputs.nixpkgs.lib.genAttrs [ "aarch64-linux" "x86_64-linux" ];
 in forEachSystem (system:
  let
-    overlays = import ../overlays { inherit pkgs; };
+    overlays = import ../overlays { inherit inputs pkgs; };
    overrides = { custom = import ../pkgs { inherit pkgs; }; };
    pkgs = import inputs.nixpkgs { inherit system overlays; } // overrides;
  in {
@@ -16,12 +16,10 @@ pkgs.mkShell {
    yarn-berry
    crystal
    shards
-    python311Full
-    virtualenv
-    (with python311Packages; [ pip ])
-    pipenv
+    (with python313Packages; [ pip pandas numpy matplotlib typer pillow reportlab python-barcode pypdf markdown requests ])
    scala
    sbt
+    cargo

    #LIBS
    openssl
@@ -1,6 +1,6 @@
 {
  syscfg = {
-    hostname = "asguard";
+    hostname = "asgard";
    defaultUser = "sora";
    type = "macos";
    system = "x86_64-darwin";
@@ -23,21 +23,16 @@
      }
    ];
    make = {
-      gui = false;
      cli = true;
      virt = true;
-      power = false;
-      game = false;
-      develop = false;
    };
-    wlp = {
-      enable = false;
-      nif = "";
-    };
-    wg = {
-      enable = true;
-      ip4 = "10.10.1.2/32";
-      ip6 = "fd10:10:10::2/128";
+    net = {
+      wg = {
+        enable = true;
+        ip4 = "10.10.1.2/32";
+        ip6 = "fd10:10:10::2/128";
+        pubkey = "QlvpTiK6s/lIha9vKmo+teSy2Nw52qWLYatYjxVan3U=";
+      };
    };
  };
 }
@@ -0,0 +1,14 @@
+
+
+AUTHENTIK_DB_PASSWORD=NTQRO0rhPCd4L3HLNK4AT09Npz+ks1jyRC6AOyo5u+k=
+AUTHENTIK_SECRET_KEY=9Zw8Sy8257iJmRdBhUKGiq3d7uYAkhC9smuDUClE8aR1iPdpHHds+K2D1Zy3lwj2Hjnasu5jnopkhwnABWDu8A==
+
+
+AUTHENTIK_EMAIL_PASSWORD=w+g:cPU+e.<q,f<mj3DFPxXxo4h2SVS9.;,T<!Sra>y!mNcAsiAp4jPCLTmjte2d
+
+
+ETHERPAD_DB_PASSWORD=d43352c3906516bf4c34d63316509cb4b1621167af84c81b60689779a62b2348
+ETHERPAD_ADMIN_PASSWORD=Hackme55#
+
+COLLABORA_USER=...
+COLLABORA_PASSWORD=...
@@ -21,16 +21,5 @@
      game = true;
      develop = true;
    };
-    net = {
-      wlp = {
-        enable = false;
-        nif = "NA";
-      };
-      wg = {
-        enable = false;
-        ip4 = "";
-        ip6 = "";
-      };
-    };
  };
 }
@@ -8,7 +8,7 @@
  boot.initrd.kernelModules = [ ];
  boot.kernelModules = [ "v4l2loopback" ];
  boot.extraModulePackages = with config.boot.kernelPackages;
-    [ v4l2loopback.out ];
+    [ v4l2loopback ];

  fileSystems."/" = {
    device = "NA";
@@ -0,0 +1,44 @@
+{
+  syscfg = {
+    hostname = "gateway";
+    type = "nixos";
+    system = "x86_64-linux";
+    defaultUser = "sora";
+    users = [{
+      username = "sora";
+      pubssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrrUB0KBjeAKPVG2Bdcm4mI9AMab7y97SOCdEHGogYv sora@gateway";
+      wm = "-";
+      git = {
+        email = "soraefir+git@helcel";
+        username = "soraefir";
+        key = "4E241635F8EDD2919D2FB44CA362EA0491E2EEA0";
+      };
+    }];
+    make = {
+      cli = true;
+    };
+    net = {
+      wg = {
+        enable = true;
+        ip4 = "10.10.1.1/32";
+        ip6 = "fd10:10:10::1/128";
+        pubkey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
+      };
+    };
+    server = {
+      openssh = true;
+      wireguard = true;
+      web = true;
+      nftables = {
+        enable = true;
+        ifs = ["ens3" "wg0" ];
+        ports = [
+                [ "ens3" "10.10.1.2" "fd10:10:10::2" 22 2222 ]      # SSH/GIT
+                [ "ens3" "10.10.1.2" "fd10:10:10::2" 80 80 ]        # HTTP
+                [ "ens3" "10.10.1.2" "fd10:10:10::2" 443 443 ]      # HTTPS
+                [ "ens3" "10.10.1.2" "fd10:10:10::2" 3979 3979 ]    # OTTD
+        ];
+      };
+    };
+  };
+}
@@ -0,0 +1,20 @@
+{ config, lib, inputs, ... }: {
+  imports = [ ./hardware.nix ../../modules/server ];
+
+  system.autoUpgrade = {
+    enable = true;
+    flake = "git+https://git.helcel.net/sora/nixconfig"; 
+    flags = [
+      "--no-write-lock-file"
+    ];
+    dates = "04:00";
+    randomizedDelaySec = "30min";
+    allowReboot = false;
+  };
+
+  networking.extraHosts = ''
+    10.10.1.2     git.helcel.net
+    10.10.1.2     avalon.helcel.net
+  '';
+
+}
@@ -0,0 +1,27 @@
+{ config, lib, pkgs, modulesPath, ... }: {
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix" ) ];
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+    efiSupport = true;
+  };
+
+  boot.initrd.availableKernelModules =
+    [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
+  boot.initrd.kernelModules = [ "nvme" ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-uuid/25df457a-21d0-41ab-9de5-88ffc00e3469";
+    fsType = "btrfs";
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/F24E-74FA";
+    fsType = "vfat";
+    options = [ "defaults" ];
+  };
+}
@@ -6,6 +6,7 @@
    defaultUser = "sora";
    users = [{
      username = "sora";
+      pubssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDGtotfQkclilrhEOzY3QUpOwYF+eOjHvqN6Of3NVg4x8NQLjx/X/gxC+GAllQxy9Zkz/N5wY0Fa4/6HoGheCRvWaN/nofz95VgtX8a1A/flrT8CGdBfRqXlcd4OEXhpFcbEm9VRXmxSKnsD4zySZr/151S+1PlQr8pJ1yyzxsIQx+RNo9P4gzpoJgkfZ3JIqLWb6B4aXallAg9Ha1WX0lx24voWNgg9AQt6/lccfmeoWAzBGUNq5a/mH59O+UCIM2y19ksEweY6URHpk6Ss597zp+0j2NYg8MS4rToYUb0Y7giNNBdKAzqNd+Wp6gjqBthuDIOfsXM082O5IarPKPJNVbx/Xpf3m1hYtxfL+LhEkdoE94iue601WqTltC0btS63LeZuoAZYji/GG/D8U7V77Lh3MV5/hJm5sK6wM6r7fCoenehgiy49z00NqtgM33rWNrpL9eXNKb//5Lxe7U58jPyteWpsL8+fJFcs/2uh4D5zN3d/I+yLZ1OMgUN6LM= sora@iriy";
      wm = "Wayland";
      git = {
        email = "soraefir+git@helcel";
@@ -17,7 +18,6 @@
      gui = true;
      cli = true;
      virt = true;
-      power = false;
      game = true;
      develop = true;
    };
@@ -31,6 +31,7 @@
        enable = true;
        ip4 = "10.10.1.7/32";
        ip6 = "fd10:10:10::7/128";
+        pubkey = "6d1bINFmH12ACAJLDOwfFIZgmNHV/FGGk0YJyDP50HQ=";
      };
    };
  };
@@ -7,7 +7,10 @@
  boot.kernelModules = [ "v4l2loopback" "kvm-amd" ];
  boot.kernelPackages = pkgs.linuxPackages_latest;
  boot.extraModulePackages = with config.boot.kernelPackages;
-    [ v4l2loopback.out ];
+    [ v4l2loopback ];
+  boot.extraModprobeConfig = ''
+    options v4l2loopback devices=1 video_nr=1 card_label="VCam" exclusive_caps=1
+  '';

  boot.loader.systemd-boot.extraEntries = {
    "00-windows.conf" = ''
@@ -21,7 +24,7 @@
    fsType = "ext4";
  };

-  fileSystems."/boot/efi" = {
+  fileSystems."/boot" = {
    device = "/dev/disk/by-uuid/349E-5086";
    fsType = "vfat";
  };
@@ -6,6 +6,7 @@
    defaultUser = "sora";
    users = [{
      username = "sora";
+      pubssh = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrrUB0KBjeAKPVG2Bdcm4mI9AMab7y97SOCdEHGogYv sora@gateway";
      wm = "-";
      git = {
        email = "soraefir+git@helcel";
@@ -14,16 +15,30 @@
      };
    }];
    make = {
-      gui = false;
      cli = true;
      virt = true;
-      power = false;
-      game = false;
-      develop = false;
    };
-    net = {
-      wlp = { enable = false; };
-      wg = { enable = false; };
+    server = {
+      openssh = true;
+      web = true;
+      sops = true;
+
+      hostDomain = "test.helcel.net";
+      shortName = "testcel";
+      mailDomain = "test@helcel";
+      mailServer = "infomaniak.ch";
+
+      dbHost = "localhost";
+      
+      containers = {
+        #cloud = {enable = true;};
+        authentik = {
+          enable = true;
+          db = true;
+          ip = "10.88.0.125";
+          port = 9000 ;
+        };
+      };
    };
  };
 }
@@ -1,9 +1,4 @@
 { config, inputs, ... }: {
-  imports = [ ./hardware.nix ];
-
-  services.openssh.enable = true;
-  users.users.root.openssh.authorizedKeys.keys = [
-    "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC0GpKd62XMlO410/iYkNG8MHdGGaeMG3Gmsf3Pv3u2BllUzR9Dpym1ZOz2lwo3iK0FimcQpOiJqSIahO59HJl8jQ9BoQrJMXH7l2kuq1T09cMNWGjlzowg0LWKWOzoBzOwcheyW68OJGgkSfvk9BdshkUYTLVBXjiI9jo/8Qkcv1WLJJvJmDBDwnbYDQpODXCEDQ/t3YVubb+ocLmh40sDUffJLWZQXN6OFW9N5XxnvY7K5x9ci9GU4Reei40K8yDw2Hgi0njzijRdzie3MJlKPPawJ2TATu9LsGuxfx8bJXVx+mNxP0lhO8dOOhP7p0ozTxlJJY9ZWaKgOz3SzYNCgJ1gH7NtTBtSruXd6pfmErUmuJEAeMD6+QF3yJ5tnVFNPoSHqjP+oL3CgSRpmuvn7ChSSI3J3UVhLux165VtwIL7UhosO2mCqmn0Yk2mSBkB/L4ZiWFmO3vYdagYNQX7xZHzCJ5my8vomiT+DUGb2h/o1NetKwIZJiFAuHxKt3k= sora@valinor"
-  ];
+  imports = [ ./hardware.nix ../../modules/server ];
 }

@@ -1,14 +1,27 @@
 { config, lib, pkgs, modulesPath, ... }: {
-  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix" ) ];
+
  boot.kernelPackages = pkgs.linuxPackages_latest;
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  boot.loader.grub.device = "/dev/sda";
+
+  boot.loader.systemd-boot.enable = lib.mkForce false;
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+    #efiSupport = true;
+  };
+
  boot.initrd.availableKernelModules =
    [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
  boot.initrd.kernelModules = [ "nvme" ];

  fileSystems."/" = {
-    device = "/dev/sda3";
-    fsType = "btrfs";
+    device = "/dev/disk/by-uuid/abc944c6-484a-4abe-a675-906e3781d71f";
+    fsType = "ext4";
+  };
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/C555-300B";
+    fsType = "vfat";
+    options = [ "defaults" ];
  };
 }
@@ -6,6 +6,7 @@
    defaultUser = "sora";
    users = [{
      username = "sora";
+      pubssh = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDCZibVYTvS4Dd+ZhGCpRpKfxs1fQeepNTzfzYk9I12Hyez25pQCeH+6ArrVhf6yX5Na1ffkvqTrNIDYJ1V2GHhemX0ruYp2B3xt229JszI7DeRC7YeG7v5uvsfTgicADCstGPSNorKXuNnHuBebSHpmWWbuKrYZdmcA/Az7H8uwF5+VQrnyASgZgwGV94MHinFVWsisB7o6iq4qxqpsUdtuZGbU0stDE5f9DLMDYuUxtx+jASRt+X60Bzjv3OFjU/b/YYzojTtuujkYXunNNTceCB4DTue5YMKQOlmd/IezL5nPAK9IsonPqojX9LPk2RvTCr4qalQ6AD92nq+xMW6FY1uJaKT81S8TvZcaqTm4FhEDkChuFq77biSUDhQkpcdNVOjUn5OtKpYl+0VkCaAx/8uyoylBacrn1XXLLg+gjwGCFHa2eeNu/BKIUa+5EK/FRwLpnEoPDkAHQ95JXQewChcUKG8A+Bz29XRKr9J64kbbGmwa+yjlVTPLSE6ZZE= sora@valinor";
      wm = "Wayland";
      git = {
        email = "soraefir+git@helcel";
@@ -31,6 +32,7 @@
        enable = true;
        ip4 = "10.10.1.5/32";
        ip6 = "fd10:10:10::5/128";
+        pubkey = "EUYd/dMdGcbxiWJXHhQhCXV00cr87pxiW1HExwCTGg0=";
      };
    };
  };
--- a/Show More
+++ b/Show More