hardcoded swap for sandbox

.gitea/workflows/build.yml

@@ -12,17 +12,17 @@ jobs:
   build-nixos:
     runs-on: ubuntu-latest
     steps: 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       
       - name: "Install Nix ❄️"
         uses: cachix/install-nix-action@v31
 
     #  - uses: DeterminateSystems/nix-installer-action@v4
-      - uses: DeterminateSystems/magic-nix-cache-action@v12
-      - uses: DeterminateSystems/flake-checker-action@v11
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
+      - uses: DeterminateSystems/flake-checker-action@v12
 
       - name: "Install Cachix ❄️"
-        uses: cachix/cachix-action@v16
+        uses: cachix/cachix-action@v17
         with:
           name: helcel
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

.gitea/workflows/update.yml

@@ -13,15 +13,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Install nix
-        uses: DeterminateSystems/nix-installer-action@v18
+        uses: DeterminateSystems/nix-installer-action@v22
         with:
           github-token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
           extra_nix_config: |
             experimental-features = nix-command flakes            
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@v26
+        uses: DeterminateSystems/update-flake-lock@v28
         with:
           token: ${{ secrets.GT_TOKEN_FOR_UPDATES }}
           pr-title: "[chore] Update flake.lock"

.gitignore

@@ -2,3 +2,4 @@ result
 age-key.txt
 .decrypted~common.yaml
 .decrypted*
+.tmp

.sops.yaml

@@ -9,55 +9,57 @@ keys:
     - &avalon age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
     - &valinor age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
     - &asgard age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+    - &gateway age1lqvnzlendlmtwgstzrj4xzrwpatwx56k5az5au78fyg99yecwfzs3s6xn6
+    - &sandbox age1pf4auk6u2tmefuqpuc6mntr26cp4wcsmlhnn98arzxsp3753ruqsj0jqk3
 
 creation_rules:
   - path_regex: modules/shared/sops/private/iriy.[a-z]+
     key_groups:
-    - age:
-      - *iriy
-      pgp:
-      - *sora
+      - age:
+          - *iriy
+        pgp:
+          - *sora
   - path_regex: modules/shared/sops/private/avalon.[a-z]+
     key_groups:
-    - age:
-      - *avalon
-      pgp:
-      - *sora
+      - age:
+          - *avalon
+        pgp:
+          - *sora
   - path_regex: modules/shared/sops/private/valinor.[a-z]+
     key_groups:
-    - age:
-      - *valinor
-      pgp:
-      - *sora
+      - age:
+          - *valinor
+        pgp:
+          - *sora
   - path_regex: modules/shared/sops/private/asgard.[a-z]+
     key_groups:
-    - age:
-      - *asgard
-      pgp:
-      - *sora
+      - age:
+          - *asgard
+        pgp:
+          - *sora
 
   - path_regex: modules/shared/sops/common.[a-z]+
     key_groups:
-    - age:
-      - *valinor
-      - *iriy
-      - *avalon
-      - *asgard
-      pgp:
-      - *sora
-  
+      - age:
+          - *valinor
+          - *iriy
+          - *avalon
+          - *asgard
+          - *gateway
+        pgp:
+          - *sora
+
   - path_regex: modules/shared/sops/mock.[a-z]+
     key_groups:
-    - age:
-      - *ci
-
+      - age:
+          - *ci
+          - *sandbox
 
   - path_regex: modules/server/sops/server.[a-z]+
     key_groups:
-    - age:
-      - *valinor
-      - *iriy
-      - *avalon
-      - *asgard
-      pgp:
-      - *sora
+      - age:
+          - *avalon
+          - *sandbox
+
+        pgp:
+          - *sora

flake.lock

@@ -1,27 +1,5 @@
 {
   "nodes": {
-    "arion": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "haskell-flake": "haskell-flake",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1745165725,
-        "narHash": "sha256-OnHV8Us04vRsWM0uL1cQez8DumhRi6yE+4K4VLtH6Ws=",
-        "owner": "hercules-ci",
-        "repo": "arion",
-        "rev": "4f59059633b14364b994503b179a701f5e6cfb90",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "arion",
-        "type": "github"
-      }
-    },
     "base16-schemes": {
       "flake": false,
       "locked": {
@@ -45,11 +23,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751313918,
-        "narHash": "sha256-HsJM3XLa43WpG+665aGEh8iS8AfEwOIQWk3Mke3e7nk=",
+        "lastModified": 1779036909,
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "e04a388232d9a6ba56967ce5b53a8a6f713cdfcf",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
         "type": "github"
       },
       "original": {
@@ -59,28 +37,23 @@
         "type": "github"
       }
     },
-    "flake-parts": {
-      "inputs": {
-        "nixpkgs-lib": [
-          "arion",
-          "nixpkgs"
-        ]
-      },
+    "flake-compat": {
+      "flake": false,
       "locked": {
-        "lastModified": 1733312601,
-        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
-        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
-        "repo": "flake-parts",
+        "owner": "edolstra",
+        "repo": "flake-compat",
         "type": "github"
       }
     },
-    "flake-parts_2": {
+    "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -101,34 +74,39 @@
         "type": "github"
       }
     },
-    "hardware": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
       "locked": {
-        "lastModified": 1752048960,
-        "narHash": "sha256-gATnkOe37eeVwKKYCsL+OnS2gU4MmLuZFzzWCtaKLI8=",
-        "owner": "nixos",
-        "repo": "nixos-hardware",
-        "rev": "7ced9122cff2163c6a0212b8d1ec8c33a1660806",
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "repo": "nixos-hardware",
+        "owner": "numtide",
+        "repo": "flake-utils",
         "type": "github"
       }
     },
-    "haskell-flake": {
+    "hardware": {
+      "inputs": {
+        "nixpkgs": "nixpkgs"
+      },
       "locked": {
-        "lastModified": 1675296942,
-        "narHash": "sha256-u1X1sblozi5qYEcLp1hxcyo8FfDHnRUVX3dJ/tW19jY=",
-        "owner": "srid",
-        "repo": "haskell-flake",
-        "rev": "c2cafce9d57bfca41794dc3b99c593155006c71e",
+        "lastModified": 1780065812,
+        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
+        "owner": "nixos",
+        "repo": "nixos-hardware",
+        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
         "type": "github"
       },
       "original": {
-        "owner": "srid",
-        "ref": "0.1.0",
-        "repo": "haskell-flake",
+        "owner": "nixos",
+        "repo": "nixos-hardware",
         "type": "github"
       }
     },
@@ -139,16 +117,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1752208517,
-        "narHash": "sha256-aRY1cYOdVdXdNjcL/Twpa27CknO7pVHxooPsBizDraE=",
+        "lastModified": 1779726825,
+        "narHash": "sha256-RUkMrREjKDQrA+dA9+xZviGAxM5W1aVdyOr/bSYpHrE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "c6a01e54af81b381695db796a43360bf6db5702f",
+        "rev": "b179bde238977f7d4454fc770b1a727eaf55111c",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.05",
+        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -174,11 +152,11 @@
     },
     "nixUnstable": {
       "locked": {
-        "lastModified": 1752012998,
-        "narHash": "sha256-Q82Ms+FQmgOBkdoSVm+FBpuFoeUAffNerR5yVV7SgT8=",
+        "lastModified": 1780030872,
+        "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "2a2130494ad647f953593c4e84ea4df839fbd68c",
+        "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b",
         "type": "github"
       },
       "original": {
@@ -188,22 +166,40 @@
         "type": "github"
       }
     },
-    "nixpkgs": {
+    "nixos-wsl": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
       "locked": {
-        "lastModified": 1752162966,
-        "narHash": "sha256-3MxxkU8ZXMHXcbFz7UE4M6qnIPTYGcE/7EMqlZNnVDE=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "10e687235226880ed5e9f33f1ffa71fe60f2638a",
+        "lastModified": 1780169171,
+        "narHash": "sha256-3HBYDfBgZ+ph52HS6Ks/bMMwuh2uONIT72sZ1CtLE/s=",
+        "owner": "nix-community",
+        "repo": "nixos-wsl",
+        "rev": "998b2821c30b2938637230916904ceb8757c79e8",
         "type": "github"
       },
       "original": {
-        "owner": "nixos",
-        "ref": "nixos-25.05",
-        "repo": "nixpkgs",
+        "owner": "nix-community",
+        "repo": "nixos-wsl",
         "type": "github"
       }
     },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
     "nixpkgs-lib": {
       "locked": {
         "lastModified": 1697935651,
@@ -221,31 +217,33 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1751984180,
-        "narHash": "sha256-LwWRsENAZJKUdD3SpLluwDmdXY9F45ZEgCb0X+xgOL0=",
+        "lastModified": 1780203844,
+        "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "9807714d6944a957c2e036f84b0ff8caf9930bc0",
+        "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
-        "nixpkgs": "nixpkgs_2"
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1752359539,
-        "narHash": "sha256-vgNUyR58cOf7hHZOSlRnVCHNynWn2khLOD1bCorAnS4=",
+        "lastModified": 1780265777,
+        "narHash": "sha256-t/KORFHEv8Jn2vFmVfv4Zffekv+MUogI2KgtxuCcEmQ=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "196696a12a1087ce8dd11708d2e7e652c5c666ed",
+        "rev": "39917b7f68263188707925ffe26c9df6ef4e7d64",
         "type": "github"
       },
       "original": {
@@ -256,15 +254,16 @@
     },
     "root": {
       "inputs": {
-        "arion": "arion",
         "darwin": "darwin",
         "hardware": "hardware",
         "home-manager": "home-manager",
         "nix-colors": "nix-colors",
         "nixUnstable": "nixUnstable",
-        "nixpkgs": "nixpkgs",
+        "nixos-wsl": "nixos-wsl",
+        "nixpkgs": "nixpkgs_2",
         "nur": "nur",
-        "sops-nix": "sops-nix"
+        "sops-nix": "sops-nix",
+        "vscode-server": "vscode-server"
       }
     },
     "sops-nix": {
@@ -274,11 +273,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751606940,
-        "narHash": "sha256-KrDPXobG7DFKTOteqdSVeL1bMVitDcy7otpVZWDE6MA=",
+        "lastModified": 1777944972,
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "3633fc4acf03f43b260244d94c71e9e14a2f6e0d",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
         "type": "github"
       },
       "original": {
@@ -286,6 +285,42 @@
         "repo": "sops-nix",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "vscode-server": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770124655,
+        "narHash": "sha256-yHmd2B13EtBUPLJ+x0EaBwNkQr9LTne1arLVxT6hSnY=",
+        "owner": "nix-community",
+        "repo": "nixos-vscode-server",
+        "rev": "92ce71c3ba5a94f854e02d57b14af4997ab54ef0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-vscode-server",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -3,12 +3,15 @@
   inputs = {
     # Trick renovate into working: "github:NixOS/nixpkgs/nixpkgs-unstable"
     nixUnstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
     hardware.url = "github:nixos/nixos-hardware";
-    nur.url = "github:nix-community/nur";
+    nur = {
+      url = "github:nix-community/nur";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.05";
+      url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -17,18 +20,20 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    # hyprland = {
-    #   url = "github:hyprwm/Hyprland";
-    #   inputs.nixpkgs.follows = "nixpkgs";
-    # };
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nix-colors.url = "github:misterio77/nix-colors";
+    nixos-wsl = {
+      url = "github:nix-community/nixos-wsl";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
-    arion.url = "github:hercules-ci/arion";
-    arion.inputs.nixpkgs.follows = "nixpkgs";
+    vscode-server = {
+      url = "github:nix-community/nixos-vscode-server";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
   };
 
@@ -44,6 +49,7 @@
         avalon = gen.generate { host = "avalon"; };
         ci = gen.generate { host = "ci"; };
         sandbox = gen.generate { host = "sandbox"; };
+        gateway = gen.generate { host = "gateway"; };
       };
       darwinConfigurations = { asgard = gen.generate { host = "asgard"; }; };
       homeConfigurations = {

generator.nix

@@ -5,7 +5,7 @@
       nameValuePair = name: value: { inherit name value; };
     in ({
       "nixos" = inputs.nixpkgs.lib.nixosSystem {
-        system = syscfg.syscfg.system;
+        system = "x86_64-linux";
         specialArgs = { inherit inputs; };
         modules = [
           ./modules/shared/syscfg
@@ -13,9 +13,12 @@
           ./modules/nixos
           syscfg
           ./systems/${host}
-          inputs.arion.nixosModules.arion
           inputs.sops-nix.nixosModules.sops
           inputs.home-manager.nixosModules.home-manager
+
+          inputs.nixos-wsl.nixosModules.wsl
+          inputs.vscode-server.nixosModules.default
+
           {
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
@@ -29,7 +32,6 @@
                   syscfg
                   { usercfg = userConfig; }
                   inputs.nix-colors.homeManagerModule
-                  # inputs.hyprland.homeManagerModules.default
                   inputs.sops-nix.homeManagerModules.sops
                 ];
               }) syscfg.syscfg.users);
@@ -38,7 +40,7 @@
       };
 
       "macos" = inputs.darwin.lib.darwinSystem {
-        system = syscfg.system;
+        system = "x86_64-darwin";
         modules = [
           ./modules/shared/syscfg
           ./modules/shared/sops

modules/home/cli/git/default.nix

@@ -1,15 +1,17 @@
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
 
   programs.git = {
     enable = true;
-    userEmail = "${config.usercfg.git.email}";
-    userName = "${config.usercfg.git.username}";
-    signing = {
-      key = "${config.usercfg.git.key}";
+    signing = lib.mkIf (config.usercfg.git.key != null) {
+      key = config.usercfg.git.key;
       signByDefault = true;
     };
     ignores = [ "*result*" ".direnv" "node_modules" ];
-    extraConfig = { core.hooksPath = "./.dev/hooks"; };
+    settings = {
+      core.hooksPath = "./.dev/hooks"; 
+      user.email = "${config.usercfg.git.email}";
+      user.name = "${config.usercfg.git.username}";
+    };
   };
 
   home.packages = with pkgs; [ tig ];

modules/home/cli/neofetch/config.jsonc

@@ -0,0 +1,147 @@
+{
+    "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json",
+    "logo": {
+        "type": "builtin", // Logo type: auto, builtin, small, file, etc.
+        // "source": "arch",
+        "width": 10,
+        "height": 10,
+        "padding": {
+            "top": 3,
+            "left": 2,
+            "right": 2
+        },
+        "color": {
+            "1": "blue",
+            "2": "white",
+            "3": "cyan"
+        }
+    },
+    "display": { /* Display settings */},
+    "modules": [
+        "break",
+        {
+            "type": "custom",
+            "format": "\u001b[90m┌──────────────────────Hardware──────────────────────┐"
+        },
+        {
+            "type": "host",
+            "key": "󰌢  PC",
+            "keyColor": "green",
+            "format": "{2}"
+        },
+        {
+            "type": "cpu",
+            "key": "│ ├󱛠 ",
+            "keyColor": "green",
+            "format": "{1} | {4} @{6}"
+        },
+        {
+            "type": "gpu",
+            "key": "│ ├󰍹 ",
+            "keyColor": "green",
+            "format": "{2} | {7}"
+        },
+        {
+            "type": "memory",
+            "key": "│ ├󰑭 ",
+            "keyColor": "green",
+            "format": "{2}"
+        },
+        // {
+        //     "type": "disk",
+        //     "key": "└ └󰋊 ",
+        //     "keyColor": "green"
+        // },
+        {
+            "type": "custom",
+            "format": "\u001b[90m└────────────────────────────────────────────────────┘"
+        },
+        "break",
+        {
+            "type": "custom",
+            "format": "\u001b[90m┌──────────────────────Software──────────────────────┐"
+        },
+        {
+            "type": "os",
+            "key": "  OS",
+            "keyColor": "yellow",
+            "format": " {2} {8}"
+        },
+        {
+            "type": "kernel",
+            "key": "│ ├󰌽 ",
+            "keyColor": "yellow",
+            "format": "{1} {2}"
+        },
+        {
+            "type": "bios",
+            "key": "│ ├󰖡 ",
+            "keyColor": "yellow"
+        },
+        {
+            "type": "packages",
+            "key": "│ ├󰏗 ",
+            "keyColor": "yellow"
+        },
+        {
+            "type": "de",
+            "key": "󰧨  DE",
+            "keyColor": "blue",
+            "format": "{2} | {3}"
+        },
+        {
+            "type": "lm",
+            "key": "│ ├󰍁 ",
+            "keyColor": "blue",
+            "format": "{1} {2} {3}"
+        },
+        {
+            "type": "wm",
+            "key": "│ ├󱂬 ",
+            "keyColor": "blue",
+            "format": "{2} {5}"
+        },
+        {
+            "type": "custom",
+            "format": "\u001b[90m└────────────────────────────────────────────────────┘"
+        },
+        "break",
+        {
+            "type": "custom",
+            "format": "\u001b[90m┌──────────────────────Age───────────────────────────┐"
+        },
+        {
+            "type": "command",
+            "key": "  ›  OS Age  ",
+            "keyColor": "magenta",
+            "text": "birth_install=$(stat -c %W /); current=$(date +%s); time_progression=$((current - birth_install)); days_difference=$((time_progression / 86400)); echo $days_difference days"
+        },
+        {
+            "type": "command",
+            "key": "  ›  Update  ",
+            "keyColor": "magenta",
+            "text": "nixos-rebuild list-generations | awk '$NF == \"True\" {print $2, $3}' | xargs -I {} date -d \"{}\" +\"%s\" | awk '{diff=systime()-$1; printf \"%d days, %d hours, %d mins\\n\", diff/86400, (diff%86400)/3600, (diff%3600)/60}'"
+        },
+        {
+            "type": "uptime",
+            "key": "  ›  Uptime  ",
+            "keyColor": "magenta"
+        },
+        {
+            "type": "custom",
+            "format": "\u001b[90m└────────────────────────────────────────────────────┘"
+        },
+        {
+            "type": "colors",
+            "paddingLeft": 2,
+            "block": {
+                "width": 3,
+                "range": [
+                    0,
+                    15
+                ]
+            } //,
+            //"symbol": "circle"
+        },
+    ]
+}

modules/home/cli/neofetch/default.nix

@@ -1,4 +1,5 @@
 { pkgs, config, ... }: {
-  home.packages = with pkgs; [ neofetch ];
+  home.packages = with pkgs; [ fastfetch ];
   xdg.configFile."neofetch/config.conf".source = ./config.conf;
+  xdg.configFile."fastfetch/config.jsonc".source = ./config.jsonc;
 }

modules/home/cli/zsh/default.nix

@@ -9,6 +9,8 @@ in {
       "sudo" = "sudo ";
       "devsh" =
         "nix develop --profile /tmp/devsh-env ${nixflake_url}#devsh -c zsh";
+      "cdevsh" =
+        "nix develop --profile /tmp/devsh-env -c zsh";
       "nixb" = "(sudo nixos-rebuild switch --flake ${nixflake_url})";
       "nixgc" = "sudo nix-collect-garbage -d && nix-collect-garbage -d";
       "ssh" = "TERM=xterm-256color  ${pkgs.openssh}/bin/ssh";

modules/home/gui/apps/develop/default.nix

@@ -2,6 +2,6 @@
   imports = [ ./vscodium ];
 
   config = lib.mkIf (config.syscfg.make.develop) {
-    home.packages = with pkgs; [ blender godot_4 openscad-unstable bambu-studio ];
+    home.packages = with pkgs; [ blender godot_4 openscad-unstable orca-slicer pandoc claude-code];
   };
 }

modules/home/gui/apps/develop/vscodium/default.nix

@@ -12,6 +12,7 @@
           ms-python.vscode-pylance
           ms-vscode.cpptools
           dbaeumer.vscode-eslint
+          continue.continue 
         ];
       #};
     };

modules/home/gui/apps/pipewire/default.nix

@@ -25,6 +25,20 @@
                 }
             }
         }
+        {   name = "libpipewire-module-loopback"
+            args = {
+                node.description = "Virtual Loopback"
+                audio.position = [ FL FR ]
+                capture.props = {
+                    media.class = "Audio/Sink"
+                    node.name = "vloopback_sink"
+                }
+                playback.props = {
+                    media.class = "Audio/Source"
+                    node.name = "vloopback_source"
+                }
+            }
+        }
       ]
     '';
   };

modules/home/gui/base/default.nix

@@ -16,7 +16,6 @@
       nextcloud-client
 
       gramps
-      sweethome3d.application
     ];
   };
 }

modules/home/gui/games/default.nix

@@ -7,16 +7,16 @@
     home.packages = with pkgs; [
 
       #games
-      steam
+      # steam
       gamemode
-      gamescope
-      mangohud
+      #gamescope
+      #mangohud
       prismlauncher
       openttd-jgrpp
-      bottles
+      #bottles
       lutris
       unstable.umu-launcher
-      wine
+      # wine
     ];
   };
 

modules/home/gui/games/wow.nix

@@ -5,6 +5,7 @@
     home.packages = with pkgs;
       [
         # custom.simc
+        unstable.instawow
       ];
 
     # templates buggy currently
@@ -18,64 +19,5 @@
               "wago_addons": null
             }
         }'';
-
-# curse:master-plan
-# curse:raretrackercore-rt
-# curse:raretrackerdragonflight-rtd
-# curse:raretrackermaw-rtmw
-# curse:raretrackermechagon-rtm
-# curse:raretrackerthewarwithin-rtww
-# curse:raretrackertimelessisle-rtti
-# curse:raretrackeruldum-rtu
-# curse:raretrackervale-rtv
-# curse:raretrackerworldbosses-rtwb
-# curse:raretrackerzerethmortis-rtz
-# curse:venture-plan
-# curse:war-plan
-# github:nevcairiel/bartender4
-# github:cidan/betterbags
-# github:bigwigsmods/bigwigs
-# github:bigwigsmods/bigwigs_battleforazeroth
-# github:bigwigsmods/bigwigs_burningcrusade
-# github:bigwigsmods/bigwigs_cataclysm
-# github:bigwigsmods/bigwigs_classic
-# github:bigwigsmods/bigwigs_dragonflight
-# github:bigwigsmods/bigwigs_legion
-# github:bigwigsmods/bigwigs_mistsofpandaria
-# github:bigwigsmods/bigwigs_shadowlands
-# github:bigwigsmods/bigwigs_warlordsofdraenor
-# github:bigwigsmods/bigwigs_wrathofthelichking
-# github:nezroy/demodal
-# github:curseforge-mirror/details
-# github:edusperoni/details_elitism
-# github:curseforge-mirror/elitismhelper
-# github:michaelnpsp/grid2
-# github:jods-gh/groupfinderrio
-# github:nevcairiel/handynotes
-# github:hekili/hekili
-# github:thekrowi/krowi_achievementfilter
-# github:bigwigsmods/littlewigs
-# github:nnoggie/mythicdungeontools
-# github:tullamods/omnicc
-# github:tercioo/plater-nameplates
-# github:curseforge-mirror/quest_completist
-# github:raiderio/raiderio-addon
-# github:wowrarity/rarity
-# github:nevcairiel/shadowedunitframes
-# github:simulationcraft/simc-addon
-# github:curseforge-mirror/tomcats
-# github:weakauras/weakauras2
-# github:kemayo/wow-handynotes-battleforazerothtreasures
-# github:kemayo/wow-handynotes-dragonflight
-# github:kemayo/wow-handynotes-legiontreasures
-# github:kemayo/wow-handynotes-longforgottenhippogryph
-# github:kemayo/wow-handynotes-lostandfound
-# github:kemayo/wow-handynotes-secretfish
-# github:kemayo/wow-handynotes-shadowlandstreasures
-# github:kemayo/wow-handynotes-stygia
-# github:kemayo/wow-handynotes-treasurehunter
-# github:kemayo/wow-handynotes-warwithin
-# wowi:7032-tomtom
-
   };
 }

modules/home/wayland/apps/eww/bar/eww.yuck

@@ -48,7 +48,7 @@
 
 
 (defwindow bar
-    :monitor 0
+    :monitor 1
     :geometry (geometry
       :x "0%"
       :y "0%"

modules/home/wayland/apps/eww/bar/windows/calendar.yuck

@@ -1,5 +1,5 @@
 (defwindow calendar
-  :monitor 0
+  :monitor 1
   :geometry (geometry
     :x "0%"
     :y "0%"

modules/home/wayland/apps/eww/bar/windows/powermenu.yuck

@@ -34,7 +34,7 @@
 )
 
 (defwindow powermenu
-    :monitor 0
+    :monitor 1
     :stacking "overlay"
     :geometry (geometry 
                     :anchor "center"

modules/home/wayland/apps/eww/bar/windows/radio.yuck

@@ -2,7 +2,7 @@
 (defvar radio_rev false)
 
 (defwindow radio
-  :monitor 0
+  :monitor 1
   :geometry (geometry
     :x "0%"
     :y "0%"

modules/home/wayland/apps/eww/bar/windows/sys.yuck

@@ -129,7 +129,7 @@
 )
 
 (defwindow sys
-  :monitor 0
+  :monitor 1
   :stacking "overlay"
   :geometry (geometry
     :x "0%"

modules/home/wayland/apps/kanshi/default.nix

@@ -7,42 +7,51 @@
       settings = [
         {
           profile.name = "tower_0";
-          profile.outputs = [{
-            criteria = "CEX CX133 0x00000001";
-            mode = "1920x1200@59.972";
-            position = "0,0";
-            scale = 1.0;
-            status = "enable";
-          }];
-        }
-        {
-          profile.name = "tower_1";
-          profile.outputs = [{
-            criteria = "AOC 16G3 1DDP7HA000348";
-            mode = "1920x1080@144.000";
-            position = "0,0";
-            status = "enable";
-            scale = 1.0;
-            adaptiveSync = true;
-          }];
-        }
-        {
-          profile.name = "tower_2";
           profile.outputs = [
             {
-              criteria = "AOC 16G3 1DDP7HA000348";
-              mode = "1920x1080@144.000";
+              criteria = "AOC 24E1W1 GNSKCHA086899";
+              mode = "1920x1080@60.000";
               position = "0,0";
               status = "enable";
               scale = 1.0;
               adaptiveSync = true;
             }
             {
-              criteria = "CEX CX133 0x00000001";
-              mode = "1920x1200@59.972";
-              position = "0,1080";
-              scale = 1.0;
+              criteria = "AOC 24E1W1 GNSKBHA080346";
+              mode = "1920x1080@60.000";
+              position = "1920,0";
               status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
+            }
+          ];
+        }
+        {
+          profile.name = "tower_1";
+          profile.outputs = [
+            {
+              criteria = "AOC 24E1W1 GNSKCHA086899";
+              mode = "1920x1080@60.000";
+              position = "0,0";
+              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
+            }
+            {
+              criteria = "AOC 24E1W1 GNSKBHA080346";
+              mode = "1920x1080@60.000";
+              position = "0,0";
+              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
+            }
+            {
+              criteria = "LG UNKNOWN_TBD";
+              mode = "1920x1080@144.000";
+              position = "0,0";
+              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
             }
           ];
         }

modules/home/wayland/base/default.nix

@@ -17,8 +17,12 @@ in {
       dbus-hyprland-environment
       wayland
 
-      grim
+      hyprpicker
+      
+      hyprshot
       slurp
+      satty
+
       swappy
       cliphist
       wl-clipboard

modules/home/wayland/hyprland/config.nix

@@ -89,9 +89,7 @@
             new_status = master
         }
 
-        gestures {
-            workspace_swipe = off
-        }
+        gesture = 3, vertical, workspace
                         
         exec-once = eww open bar
         #exec-once = waybar
@@ -166,7 +164,7 @@
         bind = SUPER SHIFT,D,exec, ~/.config/hypr/themes/apatheia/eww/launch_bar 
 
         bind = SUPER, V, exec, cliphist list | wofi -dmenu | cliphist decode | wl-copy
-        bind =  , Print, exec, grim -g "$(slurp -d)" - | swappy -f -
+        bind = , PRINT, exec, hyprshot -m region --raw | satty --filename - --early-exit --action-on-enter save-to-clipboard --copy-command 'wl-copy'
 
         bind = SUPER, L, exec, swaylock 
 

modules/home/xdg/default.nix

@@ -7,7 +7,7 @@
   xdg.userDirs.documents = "${config.home.homeDirectory}/desktop";
   xdg.userDirs.download = "${config.home.homeDirectory}/downloads";
   xdg.userDirs.extraConfig = {
-    XDG_MISC_DIR = "${config.home.homeDirectory}/misc";
+    MISC = "${config.home.homeDirectory}/misc";
   };
   xdg.userDirs.music = "${config.home.homeDirectory}/media/music";
   xdg.userDirs.pictures = "${config.home.homeDirectory}/media/photo";
@@ -15,5 +15,5 @@
   xdg.userDirs.templates = "${config.home.homeDirectory}/media/template";
   xdg.userDirs.videos = "${config.home.homeDirectory}/media/video";
   xdg.userDirs.createDirectories = true;
-
+  xdg.userDirs.setSessionVariables = true;
 }

modules/home/xorg/bspwm/config.nix

@@ -110,7 +110,7 @@
       telegram-desktop &
       nextcloud &
       jellyfin-mpv-shim &
-      flameshot &
+      #flameshot &
 
       sleep 2
 
@@ -265,7 +265,7 @@
 
       # Screenshots
       Print
-      	flameshot gui
+      	hyprshot -m region
 
       # Lock Desktop
       super + l

modules/home/xorg/bspwm/default.nix

@@ -5,7 +5,7 @@
   config = lib.mkIf (config.usercfg.wm == "X11") {
     xsession.windowManager.bspwm = { enable = true; };
     services.sxhkd = { enable = true; };
-    home.packages = with pkgs; [ xrandr arandr flameshot xtrlock i3lock ];
+    home.packages = with pkgs; [ xrandr arandr hyprshot xtrlock i3lock ];
 
   };
 }

modules/nixos/gui/games/default.nix

@@ -5,6 +5,9 @@ in {
     programs.steam = {
       enable = true;
       remotePlay.openFirewall = true;
+      extraCompatPackages = with pkgs;  [proton-ge-bin];
     };
+    programs.gamemode.enable = true;
+
   };
 }

modules/nixos/system/default.nix

@@ -1,3 +1,11 @@
 { ... }: {
   imports = [ ./dbus ./fonts ./hw ./locale ./network ./nix ./security ./xdg ];
+
+  services.journald.extraConfig = ''
+    SystemMaxUse=512M
+    SystemMaxFileSize=64M
+    MaxRetentionSec=1month
+    RateLimitIntervalSec=30s
+    RateLimitBurst=10000
+  '';
 }

modules/nixos/system/hw/boot/default.nix

@@ -9,7 +9,7 @@ in {
       };
       efi = {
         canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot/efi";
+        efiSysMountPoint = "/boot";
       };
     };
   };

modules/nixos/system/hw/default.nix

@@ -1 +1 @@
-{ ... }: { imports = [ ./base ./boot ./fs ./graphics ./power ./udev ./virt ]; }
+{ ... }: { imports = [ ./base ./boot ./fs ./graphics ./power ./udev ./virt ./wsl ]; }

modules/nixos/system/hw/power/default.nix

@@ -20,11 +20,10 @@
       SuspendState=mem
     '';
 
-    services.logind.lidSwitch = "suspend-then-hibernate";
+    services.logind.settings.Login.HandleLidSwitch = "suspend-then-hibernate";
     # Hibernate on power button pressed
-    services.logind.powerKey = "hibernate";
-    services.logind.powerKeyLongPress = "poweroff";
-
+    services.logind.settings.Login.HandlePowerKey = "hibernate";
+    services.logind.settings.Login.HandlePowerKeyLongPress = "poweroff";
 
     systemd.user.services.battery_monitor = {
       wants = [ "display-manager.service" ];

modules/nixos/system/hw/virt/default.nix

@@ -11,11 +11,13 @@
         dockerSocket.enable = true;
         dockerCompat = true;
         defaultNetwork.settings = {
-          dnsname.enable = true;
-          internal = true;
-          name = "internal";
+          #dnsname.enable = true;
+          dns_enabled = true;
+          #internal = true;
+          #name = "internal";
         };
       };
     };
+    virtualisation.containers.registries.search = [ "quay.io" "docker.io" "ghcr.io" ];
   };
 }

modules/nixos/system/hw/wsl/default.nix

@@ -0,0 +1,13 @@
+{ lib, config, pkgs, ... }: {
+    config = lib.mkIf (config.syscfg.extra.wsl) {
+    wsl.enable = true;
+    wsl.defaultUser = config.syscfg.defaultUser;
+    wsl.extraBin = with pkgs; [
+        { src = "${coreutils}/bin/uname"; }
+        { src = "${coreutils}/bin/dirname"; }
+        { src = "${coreutils}/bin/readlink"; }
+    ];
+    
+    wsl.wslConf.network.generateHosts = false;
+    };
+}

modules/nixos/system/network/base/default.nix

@@ -1,9 +1,30 @@
-{ config, ... }: {
+{ lib, config, ... }: {
   networking = {
     hostName = config.syscfg.hostname;
     useDHCP = true;
     nameservers = [ "1.1.1.1" "9.9.9.9" ];
 
-    firewall = { enable = true; };
+    extraHosts = ''
+      ${lib.concatStringsSep "\n" config.syscfg.extra.hosts}
+    '';
+
+    proxy = lib.mkIf (config.syscfg.extra.proxy.domain != "") {
+      default = "http://${config.syscfg.extra.proxy.domain}:${config.syscfg.extra.proxy.port or "8080"}";
+      noProxy = "${config.syscfg.extra.proxy.noProxy}";
+    };
+
+
+    firewall = { 
+      enable = true;
+      allowedUDPPorts = 
+        (if (config.syscfg.server != false && config.syscfg.server.wireguard) then [ 1515 ] else [ ]) ++ 
+        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
+        [ ];
+
+      allowedTCPPorts = 
+        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
+        (if (config.syscfg.server != false) then [ 5432 6379 8181 ] else [ ]) ++ 
+        [ ];
+    };
   };
 }

modules/nixos/system/network/wireguard/default.nix

@@ -1,4 +1,12 @@
-{ config, lib, ... }: {
+{ config, lib, pkgs, ... }: let
+
+  isValidPeer = p: 
+    (p ? syscfg.net.wg.enable) && 
+    (p.syscfg.net.wg.enable == true) && 
+    (p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
+  activePeers = builtins.filter isValidPeer config.syscfg.peers;
+in
+{
   config = lib.mkIf (config.syscfg.net.wg.enable) {
     networking.wireguard = {
       enable = true;
@@ -9,14 +17,26 @@
             config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
           listenPort = 1515;
           mtu = 1340;
-          peers = [{
-            allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
-            endpoint = "vpn.helcel.net:1515";
-            publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
-            persistentKeepalive = 30;
-          }];
+          peers = 
+            if (config.syscfg.server ? wireguard && config.syscfg.server.wireguard) then
+              map (p: {
+                name = p.syscfg.hostname;
+                publicKey = p.syscfg.net.wg.pubkey;
+                allowedIPs = [ p.syscfg.net.wg.ip4 p.syscfg.net.wg.ip6 ];
+              }) activePeers
+            else
+              [{
+                allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
+                endpoint = "vpn.helcel.net:1515";
+                publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
+                persistentKeepalive = 30;
+              }];
         };
       };
     };
+    systemd.services."wireguard-wg0" = {
+      after = [ "network-online.target" "nss-lookup.target" ];
+      wants = [ "network-online.target" "nss-lookup.target" ];
+    };
   };
 }

modules/nixos/system/nix/default.nix

@@ -37,5 +37,12 @@
       ];
     };
   };
+  programs.nix-ld = {
+    enable = true;
+    libraries = with pkgs; [
+      libx11 libxcb libxi libxext libxkbfile xcbutilcursor
+      libpng libdrm libpulseaudio nss nspr expat libbsd
+    ];
+  };
   system.stateVersion = "24.11";
 }

modules/nixos/tools/debug/default.nix

@@ -2,6 +2,9 @@
 
   config = lib.mkIf (config.syscfg.make.develop) {
     programs.adb.enable = true;
+    # services.udev.packages = [
+    #   pkgs.android-udev-rules
+    # ];
     programs.wireshark.enable = true;
 
     environment.systemPackages = with pkgs; [ wget dconf wireshark ];

modules/nixos/tools/develop/default.nix

@@ -6,11 +6,19 @@ let
     includeEmulator = false;
   };
 in {
+
+  imports = [ ./ollama ];
   config = lib.mkIf (config.syscfg.make.develop) {
+
+    services.vscode-server = lib.mkIf (config.syscfg.extra.wsl) {
+      enable = true;
+      enableFHS = true;
+    };
+
     environment.systemPackages = with pkgs;
       [
         # android-tools
-        # androidStudioPackages.canary
+        unstable.androidStudioPackages.canary
       ];
   };
 }

modules/nixos/tools/develop/ollama/default.nix

@@ -0,0 +1,16 @@
+{ lib, config, pkgs, ... }: 
+let 
+ ollamaPkg = pkgs.ollama-rocm;
+in{
+
+  config = lib.mkIf (config.syscfg.make.develop) {
+    services.ollama = {
+        enable = true;
+        package = ollamaPkg;
+        acceleration = "rocm"; 
+        loadModels = [ "deepseek-v2:lite" "qwen2.5-coder:7b" "qwen2.5-coder:1.5b" ];
+        syncModels = true;
+    };
+    environment.systemPackages = with pkgs; [ ollamaPkg ];
+  };
+}

modules/nixos/users/default.nix

@@ -22,6 +22,7 @@ in {
           "docker"
           "podman"
           "wireshark"
+          "gamemode"
         ];
       }) config.syscfg.users);
   };

modules/server/containers/apps/.template.nix

@@ -0,0 +1,49 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "EXAMPLE";
+    tag = "0.0.0";
+    contents = [ pkgs.bashInteractive ];
+    config = {
+      Entrypoint = [ "echo 1" ];
+      ExposedPorts = {  };
+    };
+  }; 
+  settings = pkgs.writeText "settings.yaml" ...;
+  templateData = builder.mkData { name = "template"; dir = "template"; vars = {
+      _ARGUMENT = "template";
+    };
+  };
+in {
+  sops = false;
+  db = false;
+  paths = [{
+    path="${serverCfg.configPath}/example/";
+    mode = "0444";
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      # imageStream = image;
+      image = "....:${version}";
+      port = 8080;
+      secret = name;
+      extraEnv = { };
+      overrides = {
+        cmd = [ ];
+        volumes = [ ];
+       };
+    };
+  };
+
+  setup = {
+    trigger = "server";
+    envFile = config.sops.secrets."EXAMPLE".path;
+    script = pkgs.writeShellScript "setup" ''
+      ...
+    '';
+  };
+}

modules/server/containers/apps/.todo.md

@@ -0,0 +1,8 @@
+# Missing
+
+RSS: TTRSS / FreshRSS
+Monitoring: Telegraf + InfluxDB
+https://github.com/tarampampam/error-pages ?
+kavita + mylar ? kapowarr ?
+
+- Transmission Cfg and API/Token handling

modules/server/containers/apps/authentik.nix

@@ -0,0 +1,115 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  version = "2026.2.2";
+  serverCfg = config.syscfg.server;
+  authentikData = builder.mkData { 
+    name = "authentik"; dir = "authentik"; vars = {
+      AUTHENTIK_DOMAIN = "${containerCfg.subdomain}.${serverCfg.domain}";
+      COOKIE_DOMAIN = "${serverCfg.domain}";
+      AUTHENTIK_LDAP_DC_DOMAIN = "dc=ldap," + (lib.concatMapStringsSep "," (x: "dc=${x}") (lib.splitString "." serverCfg.domain));
+    } 
+    // (if serverCfg.containers?jellyfin then { JELLYFIN_DOMAIN = "${serverCfg.containers.jellyfin.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?gitea then { GITEA_DOMAIN = "${serverCfg.containers.gitea.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?immich then { IMMICH_DOMAIN = "${serverCfg.containers.immich.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?homepage then { HOMEPAGE_DOMAIN = "${serverCfg.containers.homepage.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?nextcloud then { NEXTCLOUD_DOMAIN = "${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";} else {});
+  };
+in {
+  sops = true;
+  db = true;
+  paths = [{
+    path="${serverCfg.configPath}/authentik/media";
+    owner = "1000:1000";
+    mode = "0755";
+  }{
+    path="${serverCfg.configPath}/authentik/templates";
+    owner = "1000:1000";
+    mode = "0755";
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "ghcr.io/goauthentik/server:${version}";
+      port = 9000;
+      secret = name;
+      extraEnv = {
+        AUTHENTIK_REDIS__HOST = builder.host;
+        AUTHENTIK_POSTGRESQL__HOST = builder.host;
+        AUTHENTIK_POSTGRESQL__USER = "authentik_user";
+        AUTHENTIK_POSTGRESQL__NAME = "authentik_db";
+        AUTHENTIK_POSAUTHENTIK_POSTGRESQL__SSLMODE = "false";
+        AUTHENTIK_EMAIL__HOST = serverCfg.mailDomain;
+        AUTHENTIK_EMAIL__PORT = "587";
+        AUTHENTIK_EMAIL__USERNAME = "noreply@${serverCfg.domain}";
+        AUTHENTIK_EMAIL__USE_TLS = "true";
+        AUTHENTIK_EMAIL__USE_SSL = "false";
+        AUTHENTIK_EMAIL__TIMEOUT = "10";
+        AUTHENTIK_EMAIL__FROM = "sso@noreply.${serverCfg.domain}";
+        AUTHENTIK_DISABLE_UPDATE_CHECK = "true";
+        AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+      };
+      overrides = {
+        environmentFiles =  [ config.sops.secrets."AUTHENTIK".path config.sops.secrets."CUSTOM".path ] ;
+      
+        cmd = [ "server" ];
+        volumes = [
+          "${serverCfg.configPath}/authentik/media:/media"
+          "${serverCfg.configPath}/authentik/templates:/templates"
+          "${authentikData}:/blueprints/custom:ro"
+        ];
+      };
+    };
+
+    worker = builder.mkContainer {
+      image = "ghcr.io/goauthentik/server:${version}";
+      secret = name;
+      extraEnv = {
+        AUTHENTIK_REDIS__HOST = builder.host;
+        AUTHENTIK_POSTGRESQL__HOST = builder.host;
+        AUTHENTIK_POSTGRESQL__USER = "authentik_user";
+        AUTHENTIK_POSTGRESQL__NAME = "authentik_db";
+        AUTHENTIK_POSAUTHENTIK_POSTGRESQL__SSLMODE = "false";
+        AUTHENTIK_DISABLE_UPDATE_CHECK = "true";
+        AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+      };
+      overrides = {
+        cmd = [ "worker" ];
+        volumes = [
+          "${serverCfg.configPath}/authentik/media:/media"
+          "${serverCfg.configPath}/authentik/templates:/templates"
+          "${authentikData}:/blueprints/custom:ro"
+        ];
+      };
+    };
+
+    ldap = builder.mkContainer {
+      image = "ghcr.io/goauthentik/ldap:${version}";
+      secret = name;
+      extraEnv = {
+        AUTHENTIK_HOST = "https://${containerCfg.subdomain}.${serverCfg.domain}"; 
+        AUTHENTIK_INSECURE = "false"; 
+      };
+    };
+  };
+
+  setup = {
+    trigger = "worker";
+    script = pkgs.writeShellScript "setup" ''
+      # Define the command wrapper
+      AK="${pkgs.podman}/bin/podman --events-backend=none exec --env-file ${config.sops.secrets."CUSTOM".path} -e DOMAIN=${serverCfg.domain} -u root authentik-worker ak"
+
+      $AK apply_blueprint /blueprints/custom/authentik.yaml
+      $AK apply_blueprint /blueprints/custom/traefik.yaml
+      $AK apply_blueprint /blueprints/custom/ldap.yaml
+
+      ${lib.optionalString (serverCfg.containers ? gitea) ''$AK apply_blueprint /blueprints/custom/gitea.yaml''}
+      ${lib.optionalString (serverCfg.containers ? jellyfin) ''$AK apply_blueprint /blueprints/custom/jellyfin.yaml''}
+      ${lib.optionalString (serverCfg.containers ? nextcloud) ''$AK apply_blueprint /blueprints/custom/nextcloud.yaml''}
+      ${lib.optionalString (serverCfg.containers ? immich) ''$AK apply_blueprint /blueprints/custom/immich.yaml''}
+      ${lib.optionalString (serverCfg.containers ? homepage) ''$AK apply_blueprint /blueprints/custom/homepage.yaml''}
+
+      echo "Completed Authentik Setup"
+      '';
+  };
+}

modules/server/containers/apps/calibre.nix

@@ -0,0 +1,39 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+in {
+  sops = false;
+  db = false;
+  paths = [
+    {
+      path = "${serverCfg.configPath}/calibre-web/";
+      mode = "0755";
+      dirs = ["library" "ingest"];
+    }
+  ];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "crocodilestick/calibre-web-automated:${version}";
+      port = 8083;
+    #   secret = name;
+      extraEnv = {
+        CWA_PORT_OVERRIDE = "8083";
+
+        PUID = "1000";
+        PGID = "1000";
+        #HARDCOVER_TOKEN= ....
+        TRUSTED_PROXY_COUNT= "1";
+      };
+      overrides = {
+        cmd = [ ];
+        volumes = [
+          "${serverCfg.configPath}/calibre-web/library/:/calibre-library"
+          "${serverCfg.configPath}/calibre-web/ingest/:/cwa-book-ingest"
+        ];
+      };
+    };
+  };
+}

modules/server/containers/apps/collabora.nix

@@ -0,0 +1,34 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+version = "latest";
+serverCfg = config.syscfg.server;
+in {
+  sops = true;
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "collabora/code:${version}";
+      port = 9980;
+      secret = name;
+      extraEnv = {
+        "aliasgroup1" = "https://${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";
+        "server_name" = "${containerCfg.subdomain}.${serverCfg.domain}";
+        "username" = "collabora_user";
+        "VIRTUAL_HOST" = "${containerCfg.subdomain}.${serverCfg.domain}";
+        "VIRTUAL_PORT" = "9980";
+        "VIRTUAL_PROTO" = "http";
+        "DONT_GEN_SSL_CERT" = "true";
+        "RESOLVE_TO_PROXY_IP" = "true";
+        "extra_params" = "--o:ssl.enable=false --o:ssl.termination=true";
+        "dictionaries" = "en fr de jp no";
+      };
+      
+      overrides = {
+        volumes = [
+          "${pkgs.noto-fonts}/share/fonts/noto:/opt/collaboraoffice/share/fonts/truetype/noto:ro"
+          "${pkgs.ibm-plex}/share/fonts/opentype:/opt/collaboraoffice/share/fonts/opentype/plex:ro"
+        ];
+      };
+    };
+  };
+}

modules/server/containers/apps/ethercalc.nix

@@ -0,0 +1,39 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  ethercalc_exe = pkgs.ethercalc;
+
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "ethercalc";
+    tag = ethercalc_exe.version;
+    contents = [ pkgs.bashInteractive ];
+    config = {
+      Entrypoint = [ "${ethercalc_exe}/bin/ethercalc" ];
+      ExposedPorts = { "8080/tcp" = {}; };
+    };
+  };
+in {
+  sops = true;
+  paths = [{
+    path="${serverCfg.dataPath}/ethercalc/";
+    mode = "0666";
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      imageStream = image;
+      port = 8080;
+      secret = name;
+      extraEnv = {
+        ETHERCALC_PORT = "8080";
+        #CONNECT TO REDIS
+      };
+      overrides = {
+        volumes = [
+          "${serverCfg.dataPath}/ethercalc:/data"
+        ];
+       };
+    };
+  };
+}

modules/server/containers/apps/etherpad.nix

@@ -0,0 +1,124 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  etherpad_exe = pkgs.etherpad-lite;
+  settings = pkgs.writeText"settings.json" (builtins.toJSON {
+    title= "\${TITLE:Etherpad}";
+    showRecentPads = "\${SHOW_RECENT_PADS:true}";
+    favicon = "\${FAVICON:null}";
+    publicURL = "\${PUBLIC_URL:null}";
+    skinName = "\${SKIN_NAME:colibris}";
+    skinVariants = "\${SKIN_VARIANTS:super-light-toolbar super-light-editor light-background}";
+    ip = "\${IP:0.0.0.0}";
+    port = "\${PORT:9001}";
+    showSettingsInAdminPage = "\${SHOW_SETTINGS_IN_ADMIN_PAGE:true}";
+    enableMetrics = "\${ENABLE_METRICS:true}";
+    updates.tier = "off";
+    cleanup.enabled = false;
+    gdprAuthorErasure.enabled = "\${GDPR_AUTHOR_ERASURE_ENABLED:false}";
+    authenticationMethod = "\${AUTHENTICATION_METHOD:apikey}";
+    enableDarkMode = "\${ENABLE_DARK_MODE:true}";
+    enablePadWideSettings = "\${ENABLE_PAD_WIDE_SETTINGS:true}";
+    dbType = "\${DB_TYPE:dirty}";
+    dbSettings = {
+      host =       "\${DB_HOST:undefined}";
+      port =       "\${DB_PORT:undefined}";
+      database =   "\${DB_NAME:undefined}";
+      user =       "\${DB_USER:undefined}";
+      password =   "\${DB_PASS:undefined}";
+      charset =    "\${DB_CHARSET:undefined}";
+      filename =   "\${DB_FILENAME:var/dirty.db}";
+      collection = "\${DB_COLLECTION:undefined}";
+      url =        "\${DB_URL:undefined}";
+    };
+    defaultPadText = "\${DEFAULT_PAD_TEXT:P A D}";
+    padOptions = {
+      noColors =         "\${PAD_OPTIONS_NO_COLORS:false}";
+      showControls =     "\${PAD_OPTIONS_SHOW_CONTROLS:true}";
+      showChat =         "\${PAD_OPTIONS_SHOW_CHAT:true}";
+      showLineNumbers =  "\${PAD_OPTIONS_SHOW_LINE_NUMBERS:true}";
+      useMonospaceFont = "\${PAD_OPTIONS_USE_MONOSPACE_FONT:false}";
+      userName =         "\${PAD_OPTIONS_USER_NAME:null}";
+      userColor =        "\${PAD_OPTIONS_USER_COLOR:null}";
+      rtl =              "\${PAD_OPTIONS_RTL:false}";
+      alwaysShowChat =   "\${PAD_OPTIONS_ALWAYS_SHOW_CHAT:false}";
+      chatAndUsers =     "\${PAD_OPTIONS_CHAT_AND_USERS:false}";
+      lang =             "\${PAD_OPTIONS_LANG:null}";
+      fadeInactiveAuthorColors = "\${PAD_OPTIONS_FADE_INACTIVE_AUTHOR_COLORS:true}";
+      enforceReadableAuthorColors = "\${PAD_OPTIONS_ENFORCE_READABLE_AUTHOR_COLORS:true}";
+    };
+
+    requireSession = "\${REQUIRE_SESSION:false}";
+    editOnly = "\${EDIT_ONLY:false}";
+    minify = "\${MINIFY:true}";
+    requireAuthentication = "\${REQUIRE_AUTHENTICATION:false}";
+    requireAuthorization = "\${REQUIRE_AUTHORIZATION:false}";
+    trustProxy = "\${TRUST_PROXY:true}";
+    ep_headerauth.username_header = "X-authentik-username";
+    users.admin = {
+      password = "\${ADMIN_PASSWORD:null}";
+      is_admin = true;
+    };
+    socketTransportProtocols = ["websocket" "polling"];
+    socketIo.maxHttpBufferSize = "\${SOCKETIO_MAX_HTTP_BUFFER_SIZE:1000000}";
+    indentationOnNewLine = true;
+
+    loglevel = "\${LOGLEVEL:INFO}";
+    lowerCasePadIds = "\${LOWER_CASE_PAD_IDS:true}";
+  });
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "etherpad";
+    tag = etherpad_exe.version;
+    contents = [ pkgs.bashInteractive ];
+    config = {
+      Entrypoint = [ "${etherpad_exe}/bin/etherpad-lite" ];
+      ExposedPorts = { "8080/tcp" = {}; };
+    };
+  };
+in {
+  sops = true;
+  db = true;
+  paths = [{
+    path="${serverCfg.configPath}/etherpad/";
+    mode = "0444";
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      imageStream = image;
+      port = 8080;
+      secret = name;
+      extraEnv = {
+        TITLE = "Pad";
+        PORT ="8080";
+        DB_TYPE = "postgres";
+        DB_HOST = builder.host;
+        DB_NAME = "etherpad_db";
+        DB_USER = "etherpad_user";
+        TRUST_PROXY = "true";
+        DB_CHARSET = "utf8mb4";
+        DEFAULT_PAD_TEXT = "";
+        PAD_OPTIONS_SHOW_LINE_NUMBERS = "true";
+        PAD_OPTIONS_USE_MONOSPACE_FONT = "true";
+        SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
+      };
+      overrides = {
+        cmd = [ "--settings" "/etc/etherpad/settings.json" "--apikey" "/etc/etherpad/APIKEY.txt" ];
+        volumes = [
+          "${settings}:/etc/etherpad/settings.json"
+          "${serverCfg.configPath}/etherpad/APIKEY.txt:/etc/etherpad/APIKEY.txt:ro"
+        ];
+       };
+    };
+  };
+
+  setup = {
+    trigger = "server";
+    envFile = config.sops.secrets."ETHERPAD".path;
+    script = pkgs.writeShellScript "setup" ''
+      echo "$APIKEY" > ${serverCfg.configPath}/etherpad/APIKEY.txt
+      chmod 444 ${serverCfg.configPath}/etherpad/APIKEY.txt
+    '';
+  };
+}

modules/server/containers/apps/freshrss.nix

@@ -0,0 +1,54 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+in {
+  sops = true;
+  db = true;
+  paths = [
+    {
+      path = "${serverCfg.configPath}/freshrss";
+      owner = "1000:1000";
+      mode = "0755";
+    }
+  ];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "ghcr.io/freshrss/freshrss:${version}";
+      port = 80;
+      secret = name;
+      
+      extraEnv = {
+        CRON_MIN = "5,35";
+        PUID = "1000";
+        PGID = "1000";
+        TRUSTED_PROXY = "10.0.0.0/8 192.168.0.1/16";
+        PUBLISHED_PORT = "80";
+        ADMIN_PASSWORD = "admin"; # Change this to a secure password in production!
+        ADMIN_API_PASSWORD = "admin"; # Change this to a secure password in production!
+        BASE_URL = "https://${containerCfg.subdomain}.${serverCfg.domain}";
+        SERVER_DNS = "${containerCfg.subdomain}.${serverCfg.domain}";
+        DB_HOST = "${builder.host}";
+        DB_BASE = "freshrss_db";
+        DB_USER = "freshrss_user";
+      };
+
+      overrides = {
+        volumes = [
+          "${serverCfg.configPath}/freshrss:/config"
+        ];
+      };
+    };
+  };
+
+  setup = {
+    trigger = "server"; # Triggers atomic environment verification on main controller
+    envFile = config.sops.secrets."FRESHRSS".path;
+    script = pkgs.writeShellScript "setup-freshrss" ''
+      RSS_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+      ${pkgs.curl}/bin/curl -s -X POST "$RSS_URL/i/index.php?step=0" -H "Content-Type: application/x-www-form-urlencoded" --data-raw "language=en"
+    '';
+  };
+}

modules/server/containers/apps/frigate.nix

@@ -0,0 +1,95 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+  
+  # Ensure the package is available (Nixpkgs includes frigate)
+  frigatePkg = pkgs.frigate;
+
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "frigate";
+    tag = frigatePkg.version;
+    contents = [ 
+      pkgs.bashInteractive 
+      frigatePkg
+      pkgs.ffmpeg # Explicitly included for video stream processing
+    ];
+    config = {
+      Entrypoint = [ "${frigatePkg}/bin/frigate" ];
+      Cmd = [ "start" ];
+      ExposedPorts = {
+        "5000/tcp" = {}; # Web UI / API
+        "8554/tcp" = {}; # RTSP Feeds
+        "8555/tcp" = {}; # WebRTC
+      };
+      Env = [
+        "FRIGATE_RTSP_PASSWORD=secret" # Base fallback, overridden by envFile/sops
+      ];
+    };
+  };
+in {
+  sops = true; # Enabled to safeguard sensitive camera RTSP stream credentials
+  db = false;  # Internal SQLite is used by default in Frigate
+
+  paths = [
+    {
+      path = "${serverCfg.configPath}/frigate/";
+      mode = "0755";
+    }
+    {
+      path = "/var/lib/frigate/storage/";
+      mode = "0755"; # Dedicated path for heavy video recordings and media
+    }
+  ];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      imageStream = image;
+      port = 5000;
+      secret = name;
+      extraEnv = {
+        PLUS_API_KEY = ""; # Optional: For Frigate Plus users
+      };
+      overrides = {
+        cmd = [ ];
+        volumes = [
+          "${serverCfg.configPath}/frigate:/config"
+          "/var/lib/frigate/storage:/media/frigate"
+          "/dev/bus/usb:/dev/bus/usb" # Passes Google Coral USB TPU to the container
+          "/dev/dri:/dev/dri"         # Passes Intel/AMD GPU for hardware video decoding
+        ];
+      };
+    };
+  };
+
+  setup = {
+    trigger = "server";
+    envFile = config.sops.secrets."FRIGATE_ENV".path;
+    script = pkgs.writeShellScript "setup-frigate" ''
+      mkdir -p "${serverCfg.configPath}/frigate"
+      mkdir -p "/var/lib/frigate/storage"
+      
+      # Bootstrap a standard configuration layout if missing
+      if [ ! -f "${serverCfg.configPath}/frigate/config.yml" ]; then
+        cat <<EOF > "${serverCfg.configPath}/frigate/config.yml"
+mqtt:
+  enabled: False # Set to True and define host if connecting to Home Assistant
+
+database:
+  path: /config/frigate.db
+
+cameras:
+  dummy_camera: # Replace with your actual RTSP stream details
+    enabled: false
+    ffmpeg:
+      inputs:
+        - path: rtsp://127.0.0.1:554/live
+          roles:
+            - detect
+    detect:
+      enabled: false
+EOF
+      fi
+    '';
+  };
+}

modules/server/containers/apps/gitea.nix

@@ -0,0 +1,144 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  version = "latest";
+  serverCfg = config.syscfg.server;
+
+  LDAP_DC_DOMAIN = "dc=ldap," + (lib.concatMapStringsSep "," (x: "dc=${x}") (lib.splitString "." serverCfg.domain));
+in {
+  sops = true;
+  db = true;
+  paths = [{
+    path="${serverCfg.dataPath}/gitea/data";
+    owner = "1000:1000";
+    mode = "0755";
+  }{
+    path="${serverCfg.dataPath}/gitea/data-runner";
+    owner = "1000:1000";
+    mode = "0755";
+  }];
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "gitea/gitea:${version}";
+      port = 8080;
+      secret = name;
+      
+      extraEnv = { # app.ini -> GITEA__<section>__<KEY> = "<VALUE>";
+        GITEA__DEFAULT__APP_NAME = if(containerCfg.extra ? name) then containerCfg.extra.name else "Gitea";
+        GITEA__repository__DISABLED_REPO_UNITS = "repo.ext_issues,repo.ext_wiki";
+        GITEA__repository__DISABLE_STARS = "true";
+        GITEA__repository__DEFAULT_MERGE_STYLE = "squash";
+        # GITEA__ui__THEMES = "";
+        # GITEA__ui__DEFAULT_THEME = "";
+
+        # GITEA__security__SECRET_KEY = "SECRET_ENV";
+        # GITEA__security__INTERNAL_TOKEN = "SECRET_ENV";
+        # GITEA__database__PASSWD = "SECRET_ENV";
+        # GITEA__mailer__PASSWD="SECRET_ENV";
+
+        GITEA__database__DB_TYPE = "postgres"; 
+        GITEA__database__HOST = builder.host;
+        GITEA__database__NAME = "gitea_db";
+        GITEA__database__USER = "gitea_user";
+
+
+        GITEA__mailer__ENABLED = "true";
+        GITEA__mailer__FROM = "";
+        GITEA__mailer__PROTOCOL = "smtps";
+        GITEA__mailer__SMTP_ADDR = "";
+        GITEA__mailer__SMTP_PORT = "";
+        GITEA__mailer__USER= "";
+
+        GITEA__server__DOMAIN = "${containerCfg.subdomain}.${serverCfg.domain}";
+        GITEA__server__ROOT_URL = "https://${containerCfg.subdomain}.${serverCfg.domain}/";
+        GITEA__server__PROTOCOL = "http";
+        GITEA__server__HTTP_PORT = "8080";
+        GITEA__server__LFS_START_SERVER = "true";
+        GITEA__security__INSTALL_LOCK = "true";
+
+      } // ( if serverCfg.containers?authentik then {
+        GITEA__service__ENABLE_BASIC_AUTHENTICATION = "false";
+        GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION = "true";
+        GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION_API = "true";
+        GITEA__service__ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = "true";
+        GITEA__service__ENABLE_REVERSE_PROXY_EMAIL = "true";
+        GITEA__service__ENABLE_REVERSE_PROXY_FULL_NAME = "true";
+        GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION = "true";
+        GITEA__security__REVERSE_PROXY_LOGOUT_REDIRECT = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/outpost.goauthentik.io/sign_out";
+        GITEA__security__REVERSE_PROXY_AUTHENTICATION_USER = "X-authentik-username";
+        GITEA__security__REVERSE_PROXY_AUTHENTICATION_EMAIL = "X-authentik-email";
+        GITEA__security__REVERSE_PROXY_AUTHENTICATION_FULL_NAME = "X-authentik-name";
+        GITEA__security__RREVERSE_PROXY_LIMIT = "1";
+        GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES = "127.0.0.0/8,::1/128,10.0.0.0/8";
+      } else {});
+      extraLabels = {
+        "traefik.http.routers.${containerCfg.subdomain}-login.rule" = "Host(`${containerCfg.subdomain}.${serverCfg.domain}`) && Path(`/user/login`) ";
+        "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if (serverCfg.containers?authentik && false) then "authentik" else "";
+        "traefik.http.routers.${containerCfg.subdomain}-login.priority" = "100";
+        "traefik.http.routers.${containerCfg.subdomain}-login.entrypoints" = "web-secure";
+        "traefik.http.routers.${containerCfg.subdomain}-login.tls" = "true";
+      };
+
+      overrides = {
+        volumes = [
+          "${serverCfg.dataPath}/gitea/data:/data"
+        ];
+        ports = [ "2222:22" ]; 
+      };
+    };
+
+    runner = builder.mkContainer {
+      image = "gitea/act_runner:${version}";
+      secret = name;
+      extraEnv = { 
+        CONFIG_FILE="/data/config.yml";
+        GITEA_INSTANCE_URL="https://${containerCfg.subdomain}.${serverCfg.domain}";
+        GITHUB_INSTANCE_URL="https://${containerCfg.subdomain}.${serverCfg.domain}";
+      };
+
+      overrides = {
+        volumes = [
+          "${serverCfg.dataPath}/gitea/data-runner:/data"
+          "/var/run/podman/podman.sock:/var/run/docker.sock"
+        ];
+        # ports = [ "8088:8088" ]; 
+      };
+    };
+  };
+
+
+  setup = {
+    trigger = "server";
+    envFile = config.sops.secrets."CUSTOM".path;
+    script = pkgs.writeShellScript "setup" ''
+      # Define the command wrapper
+      GT="${pkgs.podman}/bin/podman --events-backend=none exec -u git gitea-server gitea"
+      GTR="${pkgs.podman}/bin/podman --events-backend=none exec -u git gitea-runner ./act_runner"
+
+      $GT admin user create --username "$DEFAULT_ADMIN_USERNAME" --password "$DEFAULT_ADMIN_PASSWORD" --email "$DEFAULT_ADMIN_EMAIL" --admin || true
+
+      touch ${serverCfg.dataPath}/gitea/data-runner/config.yml
+
+      RUNNER_TOKEN=$($GT actions generate-runner-token)
+      $GTR register \
+        --instance "https://${containerCfg.subdomain}.${serverCfg.domain}" \
+        --token "$RUNNER_TOKEN" \
+        --name "Runner" \
+        --labels "ubuntu-latest:docker://catthehacker/ubuntu:act-latest" \
+        --no-interactive
+
+
+      ${lib.optionalString (serverCfg.containers ? authentik) ''
+      $GT admin auth add-ldap --name Authentik --host authentik-ldap --port 6636 --security-protocol ldaps --skip-tls-verify \
+          --bind-dn "cn=ldap-service,ou=users,${LDAP_DC_DOMAIN}" --bind-password $DEFAULT_LDAP_PASSWORD \
+          --user-search-base "ou=users,${LDAP_DC_DOMAIN}" \
+          --user-filter "(&(objectClass=user)(|(uid=%[1]s)(mail=%[1]s)))" \
+          --admin-filter "(memberOf=cn=admin,ou=groups,${LDAP_DC_DOMAIN})" \
+          --username-attribute "username" --firstname-attribute "givenName" --surname-attribute "sn" --email-attribute "mail" \
+          --synchronize-users
+      ''}
+
+      echo "Completed Gitea Setup"
+      '';
+  };
+}

modules/server/containers/apps/handbrake.nix

@@ -0,0 +1,59 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  version = "latest";
+  
+  routerName = if containerCfg.subpath != null 
+              then "${containerCfg.subdomain}-${lib.strings.sanitizeDerivationName containerCfg.subpath}" 
+              else containerCfg.subdomain;
+in {
+  
+  paths = [{
+    path = "${serverCfg.configPath}/handbrake/config";
+    mode = "0755";
+  } {
+    path = "${serverCfg.dataPath}/handbrake/";
+    mode = "0755";
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      subpath = containerCfg.subpath;
+      image = "ghcr.io/jlesage/handbrake:${version}";
+      port = 5800;
+      
+      extraEnv = {
+        USER_ID = "1000";
+        GROUP_ID = "1000";
+        AUTOMATED_CONVERSION_PRESET = "Custom/AV1 MKV 1080p30";
+        AUTOMATED_CONVERSION_FORMAT = "mkv";
+        AUTOMATED_CONVERSION_OUTPUT_SUBDIR = "SAME_AS_SRC";
+      };
+      extraLabels = { } // (if serverCfg.containers ? authentik then {
+        "traefik.http.routers.${routerName}.middlewares" = "authentik";
+      } else {});
+      extraOptions = [
+        "--tmpfs=/tmp:rw,noexec,nosuid,size=512m"
+      ];
+      
+      overrides = {
+        volumes = [
+          "${serverCfg.configPath}/handbrake/config:/config:rw"
+          "${serverCfg.dataPath}/handbrake/watch:/watch:rw"
+          "${serverCfg.dataPath}/handbrake/output:/output:rw"
+        ];
+       };
+    };
+  };
+
+  
+  setup = {
+    trigger = "server";
+    script = pkgs.writeShellScript "setup" ''
+        mkdir -p ${serverCfg.dataPath}/handbrake/{watch,output}
+
+    '';
+  };
+    
+}

modules/server/containers/apps/homeassistant.nix

@@ -0,0 +1,101 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  version = "latest";
+  serverCfg = config.syscfg.server;
+  
+in {
+  vm = {
+    portForward = [ 8123 ];
+    cfg = {cfg,...}:{ 
+      services.home-assistant = {
+        enable = true;
+        openFirewall = true;
+        
+        extraComponents = [
+          "matter" "thread" "cast" "zha"
+          "default_config" "met" "esphome" "radio_browser"
+          "telegram_bot" "swiss_public_transport" "nextcloud" "jellyfin" 
+        ]  ++ (if containerCfg.extra ? components then containerCfg.extra.components else []);
+        
+
+        extraPackages = pp: with pp; [
+            python-telegram gtts
+        ];
+        lovelaceConfig = {};
+
+        config = {
+          homeassistant = {
+            name = "Home";
+            latitude = "${if containerCfg.extra ? latitude then toString containerCfg.extra.latitude else toString 0}";
+            longitude = "${if containerCfg.extra ? longitude then toString containerCfg.extra.longitude else toString 0}";
+            elevation = "${if containerCfg.extra ? elevation then toString containerCfg.extra.elevation else toString 0}";
+            unit_system = "metric";
+            time_zone = config.time.timeZone;
+          };
+          lovelace = { mode = "yaml"; };
+          customLovelaceModules = [];
+          
+          # default_config = {};
+          http = {
+            use_x_forwarded_for = true;
+            trusted_proxies = [ "10.0.0.0/8" "127.0.0.1" ];
+          };
+        };
+      };
+    };
+  };
+
+  containers = {
+    dummy = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "alpine:latest";
+      extraLabels = {
+        "traefik.http.services.${containerCfg.subdomain}.loadbalancer.server.url" = "http://${builder.hostIp}:8123";
+      };
+      overrides = {cmd = [ "sleep" "infinity" ];};
+    };
+  };
+
+  setup = {
+    trigger = "dummy";
+    envFile = config.sops.secrets."CUSTOM".path;
+    script = pkgs.writeShellScript "setup" ''
+
+    HASS_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+    until [[ "$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$HASS_URL/manifest.json")" =~ (200|301|302) ]]; do
+      sleep 5
+    done
+    sleep 5
+
+    ONBOARDING_STATUS=$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$HASS_URL/api/onboarding" 2>/dev/null || echo "000")
+
+    if [ "$ONBOARDING_STATUS" = "200" ]; then
+      AUTH_CODE=$( ${pkgs.curl}/bin/curl -s -X POST "$HASS_URL/api/onboarding/users" \
+        -H "Content-Type: application/json" \
+        -d '{"client_id":"'"$HASS_URL"'","name":"'"$DEFAULT_ADMIN_USERNAME"'","username":"'"$DEFAULT_ADMIN_USERNAME"'","password":"'"$DEFAULT_ADMIN_PASSWORD"'","language":"en"}' \
+        | ${pkgs.jq}/bin/jq -r '.auth_code' )
+
+      ACCESS_TOKEN=$(${pkgs.curl}/bin/curl -s -X POST "$HASS_URL/auth/token" \
+          -H "Content-Type: application/x-www-form-urlencoded" \
+          -d "grant_type=authorization_code&code=$AUTH_CODE&client_id=$HASS_URL" \
+      | ${pkgs.jq}/bin/jq -r '.access_token' )    
+
+      ${pkgs.curl} -s -X POST "$HASS_URL/api/onboarding/core_config" \
+          -H "Authorization: Bearer $ACCESS_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d '{"time_zone":"${config.time.timeZone}"}' > /dev/null 2>&1 || true
+      # We can configure many more things above !
+
+      ${pkgs.curl} -s -X POST "$HASS_URL/api/onboarding/analytics" \
+          -H "Authorization: Bearer $ACCESS_TOKEN" \
+          -H "Content-Type: application/json" -d '{}' > /dev/null 2>&1 || true
+
+      ${pkgs.curl} -s -X POST "$HA_URL/api/onboarding/integration" \
+          -H "Authorization: Bearer $ACCESS_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d '{"client_id":"'"$HASS_URL"'","redirect_uri":"'"$HASS_URL"'/?auth_callback=1"}' > /dev/null 2>&1 || true
+    fi
+    '';
+  };
+
+}

modules/server/containers/apps/homepage.nix

@@ -0,0 +1,288 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+    version = "latest";
+    serverCfg = config.syscfg.server;
+
+    settings = pkgs.writers.writeYAML "settings.yaml" {
+        title = "My Self-Hosted Dashboard";
+        description = "";
+        startUrl = "https://${containerCfg.subdomain}.${serverCfg.domain}";
+        background = {
+            # image = "...";
+            blur = "sm"; #sm, md, xl,... 
+            # saturate = "";
+            # brightness = "";
+            # opacity = "";
+        };
+        cardBlur = "xs"; #xs, md, ...
+        # favicon = ""; 
+        theme = "dark";
+        color = "slate";
+        pwa = {
+
+        };
+        layout = {
+            Admin = {
+                style = "grid";
+                columns = 1;
+            };
+        };
+        providers = {
+            finnhub = "{{HOMEPAGE_VAR_FINNHUB}}";
+        };
+        headerStyle = "clean";
+        hideVersion = true;
+        disableUpdateCheck = true;
+        showStats = false;
+        statusStyle = "dot";
+        hideErrors = true;
+    };
+    widgets = pkgs.writers.writeYAML "widgets.yaml" [
+        {openmeteo = {
+            latitude = "47.3769";
+            longitude = "8.5417";
+            timezone = "Europe/Zurich";
+            units = "metric";
+            cache = "15";
+        };}
+        {search = {
+            provider = "custom";
+            focus = true;
+            showSearchSuggestions = true;
+            target = "_blank";
+          } // (lib.optionalAttrs (serverCfg.containers?searxng) {
+            url = "https://${serverCfg.containers.searxng.subdomain}.${serverCfg.domain}/search?q=";
+            suggestionUrl = "https://${serverCfg.containers.searxng.subdomain}.${serverCfg.domain}/autocompleter?q=";
+          });
+        }
+        {stocks = {
+            provider = "finnhub";
+            color = true;
+            cache = 15;
+            watchlist = containerCfg.extra.stocks or [];
+            
+        };}
+    ];
+
+    bookmarks = pkgs.writers.writeYAML "bookmarks.yaml" [
+        
+    ];
+    services = pkgs.writers.writeYAML "services.yaml" [
+        {Media = lib.flatten [
+            (lib.optional (serverCfg.containers?jellyfin) { 
+                Jellyfin={
+                    icon = "jellyfin.png";
+                    href = "https://${serverCfg.containers.jellyfin.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type="jellyfin";
+                        url = "http://jellyfin-server:8096";
+                        key = "{{HOMEPAGE_VAR_JELLYFIN_API}}";
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?invidious) { 
+                Invidious={
+                    icon = "invidious.png";
+                    href = "https://${serverCfg.containers.invidious.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?miniflux) { 
+                Miniflux={
+                    icon = "miniflux.png";
+                    href = "https://${serverCfg.containers.miniflux.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type="miniflux";
+                        url = "http://miniflux-server";
+                        key = "{{HOMEPAGE_VAR_MINIFLUX_API}}";
+                    };
+                };
+            })
+        ];}
+        {Cloud = lib.flatten [
+            (lib.optional (serverCfg.containers?nextcloud) { 
+                Nextcloud={
+                    icon = "nextcloud.png";
+                    href = "https://${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type="nextcloud";
+                        url = "http://nextcloud-server:80";
+                        key = "{{HOMEPAGE_VAR_NEXTCLOUD_API}}";
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?ethercalc) { 
+                Ethercalc={
+                    icon = "ethercalc.png";
+                    href = "https://${serverCfg.containers.ethercalc.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?etherpad) { 
+                Etherpad={
+                    icon = "etherpad.png";
+                    href = "https://${serverCfg.containers.etherpad.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?immich) { 
+                immich={
+                    icon = "immich.png";
+                    href = "https://${serverCfg.containers.immich.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type="immich";
+                        url = "http://immich-server:80";
+                        key = "{{HOMEPAGE_VAR_IMMICH_API}}";
+                        version = "2";
+                    };
+                };
+            })
+        ];}
+        {Dev = lib.flatten [
+            (lib.optional (serverCfg.containers?gitea) { 
+                Gitea={
+                    icon = "gitea.png";
+                    href = "https://${serverCfg.containers.gitea.subdomain}.${serverCfg.domain}";
+                    # widget = {
+                    #     type="gitea";
+                    #     url = "http://gitea-server:8080";
+                    #     key = "{{HOMEPAGE_VAR_GITEA_API}}";
+                    # };
+                };
+            })
+        ];}
+         {Admin = #lib.flatten [
+            #({permissions.groups = ["admin"];})
+            #({services = 
+            lib.flatten [
+            (lib.optional (serverCfg.containers?traefik) { 
+                Traefik={
+                    icon = "traefik.png";
+                    href = "https://${serverCfg.containers.traefik.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type = "traefik";
+                        url = "http://traefik-server:8080";
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?authentik) { 
+                Authentik={
+                    icon = "authentik.png";
+                    href = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type = "authentik";
+                        url = "http://authentik-server:9000";
+                        key = "{{HOMEPAGE_VAR_AUTHENTIK_API}}";
+                        version = "2";
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?umami) { 
+                Umami={
+                    icon = "umami.png";
+                    href = "https://${serverCfg.containers.umami.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?influx) { 
+                Influx={
+                    icon = "influx.png";
+                    href = "https://${serverCfg.containers.influx.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?handbrake) { 
+                Handbrake={
+                    icon = "handbrake.png";
+                    href = "https://${serverCfg.containers.handbrake.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?transmission) { 
+                Transmission={
+                    icon = "transmission.png";
+                    href = "https://${serverCfg.containers.transmission.subdomain}.${serverCfg.domain}/transmission";
+                    widget = {
+                        type = "transmission";
+                        url = "http://transmission-server:9091";
+                        rpcUrl = "/transmission/"; 
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?servarr) (
+            let 
+                modules = serverCfg.containers.servarr.extra.modules or ["prowlarr" "sonarr" "radarr" "flaresolverr" ];
+            in
+            (lib.optional (builtins.elem "sonarr" modules) {
+                Sonarr={
+                    icon = "sonarr.png";
+                    href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/sonarr";
+                    widget = {
+                        type = "sonarr";
+                        url = "http://servarr-sonarr:8989";
+                        key = "{{HOMEPAGE_VAR_SONARR_API}}";
+                         
+                    };
+                };
+            }) ++ (lib.optional (builtins.elem "radarr" modules) {
+                Radarr={
+                    icon = "radarr.png";
+                    href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/radarr";
+                    widget = {
+                        type = "radarr";
+                        url = "http://servarr-radarr:8989";
+                        key = "{{HOMEPAGE_VAR_RADARR_API}}";
+                         
+                    };
+                };
+            }) ++ (lib.optional (builtins.elem "lidarr" modules) {
+                Lidarr={
+                    icon = "lidarr.png";
+                    href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/lidarr";
+                    widget = {
+                        type = "lidarr";
+                        url = "http://servarr-lidarr:8989";
+                        key = "{{HOMEPAGE_VAR_LIDARR_API}}";
+                         
+                    };
+                };
+            }) ++ (lib.optional (builtins.elem "prowlarr" modules) {
+                Prowlarr={
+                    icon = "prowlarr.png";
+                    href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/prowlarr";
+                    widget = {
+                        type = "prowlarr";
+                        url = "http://servarr-prowlarr:8989";
+                        key = "{{HOMEPAGE_VAR_PROWLARR_API}}";
+                         
+                    };
+                };
+            })
+                # Bazarr
+
+            ))
+        ];}#)];}
+    ];
+in {
+    sops = false;
+    db = false;
+    
+    containers = {
+    server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "ghcr.io/gethomepage/homepage:${version}";
+        port = 3000;
+        extraEnv = { 
+            HOMEPAGE_VAR_TITLE="${serverCfg.domain}";
+            HOMEPAGE_ALLOWED_HOSTS = "${containerCfg.subdomain}.${serverCfg.domain},${builder.host}";
+        };
+        extraLabels = {
+        "traefik.http.routers.${containerCfg.subdomain}.service" = "${containerCfg.subdomain}";
+        };
+        overrides = {
+            environmentFiles =  [ config.sops.secrets."CUSTOM".path ];
+            volumes = [ 
+                "${settings}:/app/config/settings.yaml:ro"
+                "${services}:/app/config/services.yaml:ro"
+                "${widgets}:/app/config/widgets.yaml:ro"
+                "${bookmarks}:/app/config/bookmarks.yaml:ro"
+            ];
+        };
+    };
+    };
+
+}

modules/server/containers/apps/immich.nix

@@ -0,0 +1,97 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  version = "v2";
+  serverCfg = config.syscfg.server;
+
+in {
+  sops = true;
+  db = true;
+
+  paths = [{
+    path = "${serverCfg.configPath}/immich/cache";
+    mode = "0750";
+  }{
+    path = "${serverCfg.dataPath}/immich/";
+    mode = "0755";
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "ghcr.io/immich-app/immich-server:${version}";
+      port = 2283;
+      secret = name;
+      extraEnv = {
+        DB_HOSTNAME = builder.host;
+        REDIS_HOSTNAME = builder.host;
+        DB_USERNAME = "immich_user";
+        DB_DATABASE_NAME = "immich_db";
+        IMMICH_TRUSTED_PROXIES = "10.0.0.0/8";
+        IMMICH_MACHINE_LEARNING_URL = "http://immich-ml:3003";
+        # IMMICH_ALLOW_SETUP = "false";
+        # IMMICH_IGNORE_MOUNT_CHECK_ERRORS = "true";
+      };
+      overrides = {
+        volumes = [
+          "${serverCfg.dataPath}/immich:/data"
+        ];
+      };
+    };
+
+    ml = builder.mkContainer {
+      image = "ghcr.io/immich-app/immich-machine-learning:${version}";
+      port = 3003;
+      overrides = {
+        volumes = [
+          "${serverCfg.configPath}/immich/cache:/cache"
+        ];
+      };
+    };
+  };
+
+  setup = {
+    trigger = "server";
+    envFile = config.sops.secrets."CUSTOM".path;
+    script = pkgs.writeShellScript "setup" ''
+        PSQL="${pkgs.postgresql}/bin/psql -U postgres"
+        $PSQL -d "immich_db" -tAc "CREATE EXTENSION IF NOT EXISTS vchord CASCADE;"
+        $PSQL -d "immich_db" -tAc "CREATE EXTENSION IF NOT EXISTS earthdistance CASCADE;"
+
+        mkdir -p ${serverCfg.dataPath}/immich/{upload,library,thumbs,encoded-video,profile,backups}
+
+        IMMICH_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+        until [[ "$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$IMMICH_URL")" =~ (200|301|302) ]]; do
+          sleep 5
+        done
+        ${pkgs.curl}/bin/curl -X POST "$IMMICH_URL/api/auth/admin-sign-up" \
+          -H "Content-Type: application/json" -H "Accept: application/json" \
+          -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'", "name": "'"$DEFAULT_ADMIN_USERNAME"'" }'
+
+        IMMICH_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$IMMICH_URL/api/auth/login" \
+        -H "Content-Type: application/json" \
+        -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'"}' \
+        | ${pkgs.jq}/bin/jq -r '.accessToken')        
+
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+        ${pkgs.jq}/bin/jq '.oauth.enabled = true | 
+                          .oauth.autoRegister = true |
+                          .oauth.autoLaunch = true |
+                          .oauth.signingAlgorithm = "RS256" |
+                          .oauth.profileSigningAlgorithm = "RS256" |
+                          .oauth.clientId = "immich" | 
+                          .oauth.clientSecret = "'"$IMMICH_OAUTH_SECRET"'" | 
+                          .oauth.issuerUrl = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/o/immich/" | 
+                          .oauth.scope = "openid profile email" |
+                          .oauth.buttonText = "Login with SSO"' | \
+        ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+        ''}
+
+        ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+        ${pkgs.jq}/bin/jq '.storageTemplate.enable = true |
+                          .storageTemplate.template = "{{y}}/{{#if album}}{{album}}{{else}}{{MM}}{{/if}}/{{filename}}"' | \
+        ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+        
+    '';
+  };
+}

modules/server/containers/apps/influx.nix

@@ -0,0 +1,58 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+  version = "latest";
+in {
+  sops = true;
+  db = true;
+  
+  paths = [{
+    path = "${serverCfg.configPath}/influxdb/";
+    mode = "0700"; 
+  }{
+    path = "${serverCfg.dataPath}/influxdb/";
+    owner = "1500:1500";
+    mode = "0700"; 
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "influxdata/influxdb3-ui:${version}";
+      port = 8080;
+      secret = name;
+      extraEnv = {
+        SESSION_SECRET_KEY = "7b0024c13ae770000f797c201e2f210b9932a689c04d34de04379faa44e88e97";
+        DATABASE_URL = "/db/sqlite.db"; 
+      };
+      extraOptions = [
+        "--tmpfs=/tmp:rw,noexec,nosuid,size=512m"
+      ];
+      overrides = {
+        cmd = [ "--mode=admin" ]; 
+        volumes = [
+          "${serverCfg.dataPath}/influxdb:/db:rw"
+          "${serverCfg.configPath}/influxdb/:/app-root/config:ro"
+        ];
+      };
+    };
+  };
+
+  setup = {
+    trigger = "server";
+    script = pkgs.writeShellScript "setup" ''
+
+      cat > ${serverCfg.configPath}/influxdb/config.json << 'EOF'
+{
+  "DEFAULT_INFLUX_SERVER": "http://${builder.host}:8181",
+  "DEFAULT_INFLUX_DATABASE": "main",
+  "DEFAULT_API_TOKEN": "b27686e85a883437666f61586e084f7deb763958497739479ca48bc913ee90afd1a920332156133c89fb8674cb197ced17706074e6a42fc7ce6b2d54ac6119c9",
+  "DEFAULT_SERVER_NAME": "${serverCfg.domain}"
+}
+EOF
+
+    chown 1500:1500 ${serverCfg.configPath}/influxdb/config.json
+    '';
+  };
+
+}

modules/server/containers/apps/invidious.nix

@@ -0,0 +1,78 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+
+  patchedInvidious = pkgs.invidious.overrideAttrs (oldAttrs: {
+    postPatch = (oldAttrs.postPatch or "") + ''
+      cp ${../data/invidious/login.cr} src/invidious/routes/login.cr
+    '';
+  });
+
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = pkgs.invidious.name;
+    tag = pkgs.invidious.version;
+
+    contents = [ pkgs.cacert patchedInvidious ];
+    config = {
+      Entrypoint = [ "${patchedInvidious}/bin/invidious" ];
+      ExposedPorts = { "3000/tcp" = {}; };
+      Env = [ 
+        "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+        "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+      ];
+    };
+  };
+
+in {
+  sops = true;
+  db = true;
+  paths = [{
+    path="${serverCfg.configPath}/invidious";
+    mode = "0755";
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      imageStream = image;
+      port = 3000;
+      secret = name;
+      extraLabels = {
+        "traefik.http.routers.${containerCfg.subdomain}-login.rule" = "Host(`${containerCfg.subdomain}.${serverCfg.domain}`) && Path(`/login`) ";
+        "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if serverCfg.containers?authentik then "authentik" else "";
+        "traefik.http.routers.${containerCfg.subdomain}-login.priority" = "100";
+        "traefik.http.routers.${containerCfg.subdomain}-login.entrypoints" = "web-secure";
+        "traefik.http.routers.${containerCfg.subdomain}-login.tls" = "true";
+      };
+      extraEnv = {
+        INVIDIOUS_CONFIG_FILE = "/data/config.yml";
+      };
+      overrides = {
+        volumes = [
+          "${serverCfg.configPath}/invidious:/data:ro"
+        ];
+      };
+    };
+
+    companion = builder.mkContainer {
+      image = "quay.io/invidious/invidious-companion:latest";
+      port = 8282;
+      secret = name; #SERVER_SECRET_KEY = INVIDIOUS_COMPANION_KEY
+      extraOptions = [
+        "--cap-drop=all"
+        "--security-opt=no-new-privileges"
+      ];
+    };
+  };
+
+  setup = {
+    trigger = "server";
+    envFile = [ config.sops.secrets."INVIDIOUS".path config.sops.secrets."CUSTOM".path ];
+    script = pkgs.writeShellScript "setup" ''
+      export DB_HOST=${builder.host}
+      export INVIDIOUS_DOMAIN=${containerCfg.subdomain}.${serverCfg.domain}
+
+      ${pkgs.gettext}/bin/envsubst < "${../data/invidious/config.yml}" > "${serverCfg.configPath}/invidious/config.yml"
+    '';
+  };
+}

modules/server/containers/apps/jellyfin.nix

@@ -0,0 +1,181 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let
+  serverCfg = config.syscfg.server;
+  LDAP_DC_DOMAIN = "dc=ldap," + (lib.concatMapStringsSep "," (x: "dc=${x}") (lib.splitString "." serverCfg.domain));
+  nss = pkgs.dockerTools.fakeNss.override {
+    extraPasswdLines = [
+      "jellyfin:x:1000:1000:Jellyfin Daemon:/config/data:/bin/false"
+    ];
+    extraGroupLines = [
+      "jellyfin:x:1000:"
+    ];
+  };
+  image = pkgs.dockerTools.streamLayeredImage { # pkgs.dockerTools.buildImage{#
+    name = pkgs.jellyfin.name;
+    tag = pkgs.jellyfin.version;  
+    contents = [ pkgs.cacert nss pkgs.jellyfin pkgs.bashInteractive ];
+    config = {
+      User = "jellyfin:jellyfin"; 
+      Entrypoint = [ "${pkgs.jellyfin}/bin/jellyfin" ];
+      ExposedPorts = { "8096/tcp" = { }; };
+      Env = [ 
+        "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+        "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+      ];
+    };
+  };
+in {
+  paths = [
+    {
+      path = "${serverCfg.dataPath}/media/";
+      owner = "1000:1000";
+      mode = "0755";
+    }
+    {
+      path = "${serverCfg.configPath}/jellyfin/";
+      owner = "1000:1000";
+      mode = "0755";
+    }
+  ];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      imageStream = image;
+      port = 8096;
+      extraEnv = {
+        HOME = "/config/data";
+        DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = "1";
+        JELLYFIN_HttpListenerHost__BindAddress= "0.0.0.0"; #we can use settings.xml override
+        JELLYFIN_ServerName = if containerCfg.extra?name then containerCfg.extra.name else "Flix";
+      };
+      extraOptions = [
+        "--tmpfs=/tmp:rw,noexec,nosuid,size=512m"
+      ];
+      overrides = {
+        cmd = [
+        "--datadir" "/config/data"
+        "--cachedir" "/config/cache"
+        "--configdir" "/config/config"
+        "--logdir" "/config/log" 
+        ];
+        volumes = [
+          "${serverCfg.dataPath}/media:/media:ro" 
+          "${serverCfg.configPath}/jellyfin:/config"
+        ];
+        # If you have an Intel/AMD GPU for transcoding, add the device:
+        devices = lib.optionals (builtins.pathExists "/dev/dri") [ "/dev/dri:/dev/dri" ];
+      };
+    };
+  };
+
+  setup = {
+    trigger = "server";
+    envFile = config.sops.secrets."CUSTOM".path;
+    script = pkgs.writeShellScript "setup" ''
+      JELLYFIN_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+      until [ "$(${pkgs.curl}/bin/curl -sf "$JELLYFIN_URL/health")" = "Healthy" ]; do
+        sleep 5
+      done
+      echo "Jellyfin is up. Sleeping for 20 seconds..."
+      sleep 20
+      WIZARD_COMPLETE=$(${pkgs.curl}/bin/curl -sSf "$JELLYFIN_URL/System/Info/Public" 2>/dev/null | \
+        ${pkgs.jq}/bin/jq -r '.StartupWizardCompleted // false')
+      if [ "$WIZARD_COMPLETE" = "false" ]; then
+        if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Startup/Configuration" \
+          -H "Content-Type: application/json" \
+          -d '{"ServerName":"Flix","UICulture":"en-US","MetadataCountryCode":"US","PreferredMetadataLanguage":"en"}'; then
+          echo "ERROR: Failed to set startup configuration."
+          exit 1
+        fi
+        
+        if ! ${pkgs.curl}/bin/curl -sSf -X GET "$JELLYFIN_URL/Startup/User"; then
+          echo "ERROR: Failed to get base user."
+          exit 1
+        fi
+
+        if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Startup/User" \
+          -H 'accept: */*' -H "Content-Type: application/json" \
+          -d '{"Name": "'"$DEFAULT_ADMIN_USERNAME"'", "Password": "'"$DEFAULT_ADMIN_PASSWORD"'"}'; then
+          echo "ERROR: Failed to set admin user."
+          exit 1
+        fi
+
+        if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Startup/RemoteAccess" \
+          -H "Content-Type: application/json" \
+          -d '{"EnableRemoteAccess":true,"EnableAutomaticPortMapping":false}'; then
+          echo "ERROR: Failed to configure remote access."
+          exit 1
+        fi
+
+        if ! ${pkgs.curl}/bin/curl -sSf -X POST "''$JELLYFIN_URL/Startup/Complete"; then
+          echo "ERROR: Failed to complete wizard."
+          exit 1
+        fi
+        echo "Jellyfin initialization successfully completed!"
+      fi
+
+      ${lib.optionalString (serverCfg.containers ? authentik) ''
+      JELLYFIN_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Users/AuthenticateByName" \
+        -H "Content-Type: application/json" \
+        -H "Authorization: MediaBrowser Client=\"Bash Script\", Device=\"Server Terminal\", DeviceId=\"script-12345\", Version=\"1.0.0\"" \
+        -d "{\"Username\": \"$DEFAULT_ADMIN_USERNAME\", \"Pw\": \"$DEFAULT_ADMIN_PASSWORD\"}" \
+        | ${pkgs.jq}/bin/jq -r '.AccessToken')
+
+      # Verify we got a token
+      if [ "$JELLYFIN_TOKEN" = "null" ] || [ -z "$JELLYFIN_TOKEN" ]; then
+          echo "ERROR: Authentication failed."
+          exit 1
+      fi
+      if ${pkgs.curl}/bin/curl -sSf -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+          "$JELLYFIN_URL/Plugins" | ${pkgs.gnugrep}/bin/grep -q "958aad6637844d2ab89aa7b6fab6e25c"; then
+        echo "LDAP Plugin is already installed. Skipping setup."
+      else
+        if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Packages/Installed/LDAP%20Authentication?assemblyGuid=958aad6637844d2ab89aa7b6fab6e25c" \
+            -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+            -H "Content-Length: 0"; then
+          echo "ERROR: LDAP Plugin Setup Failed."
+          exit 1
+        fi
+
+        if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/System/Restart" \
+            -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+            -H "Content-Length: 0"; then
+          echo "ERROR: Server failed to accept restart command."
+          exit 1
+        fi
+        sleep 1-
+        until [ "$(${pkgs.curl}/bin/curl -sf "$JELLYFIN_URL/health")" = "Healthy" ]; do
+          sleep 5
+        done
+        echo "Jellyfin is up. Sleeping for 20 seconds..."
+        sleep 20
+      fi
+
+      if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Plugins/958aad66-3784-4d2a-b89a-a7b6fab6e25c/Configuration" \
+          -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+          -H "Content-Type: application/json" -H 'accept: */*' \
+          -d '{"LdapUsers":[],"LdapServer":"authentik-ldap","LdapPort":6636,"UseSsl":true,"UseStartTls":false,"SkipSslVerify":true,
+          "LdapBindUser":"cn=ldap-service,ou=users,${LDAP_DC_DOMAIN}","LdapBindPassword": "'"$DEFAULT_LDAP_PASSWORD"'",
+          "LdapBaseDn":"${LDAP_DC_DOMAIN}","LdapSearchFilter":"(memberOf=cn=flix,ou=groups,${LDAP_DC_DOMAIN})",
+          "LdapSearchAttributes":"uid, cn, mail, displayName",
+          "LdapAdminBaseDn":"","LdapAdminFilter":"(memberOf=cn=admin,ou=groups,${LDAP_DC_DOMAIN})",
+          "EnableLdapAdminFilterMemberUid":false,"LdapUidAttribute":"uid","LdapUsernameAttribute":"cn","LdapPasswordAttribute":"userPassword",
+          "EnableLdapProfileImageSync":false,"RemoveImagesNotInLdap":false,"LdapProfileImageAttribute":"jpegphoto","LdapProfileImageFormat":"Default",
+          "LdapClientCertPath":"","LdapClientKeyPath":"","LdapRootCaPath":"","CreateUsersFromLdap":true,"AllowPassChange":false,
+          "EnableAllFolders":true,"EnabledFolders":[],"PasswordResetUrl":""}'; then
+        echo "ERROR: LDAP Plugin Setup Failed."
+        exit 1
+      fi
+      ''}
+
+      ${pkgs.sqlite}/bin/sqlite3 ${serverCfg.configPath}/jellyfin/data/data/jellyfin.db <<EOF
+INSERT OR IGNORE INTO ApiKeys (Id, AccessToken, Name, DateCreated, DateLastActivity) 
+VALUES ( 1, "$HOMEPAGE_VAR_JELLYFIN_API", 'Home', strftime('%Y-%m-%d %H:%M:%S', 'now'), strftime('%Y-%m-%d %H:%M:%S', 'now'));
+EOF
+      echo "Completed Setup"
+
+    '';
+  };
+
+}

modules/server/containers/apps/nextcloud.nix

@@ -0,0 +1,200 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+version = "31";
+serverCfg = config.syscfg.server;
+in {
+  sops = true;
+  db = true;
+  paths = [{
+    path="${serverCfg.dataPath}/nextcloud/www";
+    owner = "33:33";
+    mode = "0755";
+  }{
+    path="${serverCfg.dataPath}/nextcloud/data";
+    owner = "33:33";
+    mode = "0755";
+    backup = true;
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "nextcloud:${version}";
+      port = 80;
+      secret = name;
+      extraEnv = {
+        REDIS_HOST = builder.host;
+        POSTGRES_HOST = builder.host;
+        POSTGRES_USER = "nextcloud_user";
+        POSTGRES_DB = "nextcloud_db";
+        AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+        "NEXTCLOUD_TRUSTED_DOMAINS " = "${containerCfg.subdomain}.${serverCfg.domain} nextcloud-server";
+        "SMTP_HOST" = serverCfg.mailServer;
+        "SMTP_NAME" = "mail_user";
+        "SMTP_PASSWORD" = "mail_password";
+        "MAIL_FROM_ADDRESS" = "${containerCfg.subdomain}@${serverCfg.domain}";
+        "MAIL_DOMAIN" = serverCfg.mailDomain;
+        "TRUSTED_PROXIES" = "10.10.0.0/16 192.168.0.0/16";
+      };
+      extraLabels = {
+        "traefik.http.routers.${containerCfg.subdomain}.middlewares" = "sts_headers,${containerCfg.subdomain}-caldav";
+        "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.permanent" = "true";
+        "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.regex" = "https://(.*)/.well-known/(?:card|cal)dav";
+        "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.replacement" = "https://$1/remote.php/dav";
+        "traefik.http.middlewares.sts_headers.headers.stsSeconds" = "15552000";
+        "traefik.http.middlewares.sts_headers.headers.stsIncludeSubdomains" = "true";
+      };
+      extraOptions = [
+        "--tmpfs=/tmp:rw,noexec,nosuid,size=512m"
+      ];
+      overrides = {
+        ports = if containerCfg.port!=null then [ "${toString containerCfg.port}:80" ] else [];
+        volumes = [
+          "${serverCfg.dataPath}/nextcloud/www:/var/www/html"
+          "${serverCfg.dataPath}/nextcloud/data:/var/www/html/data"
+        ];
+      };
+    };
+  };
+
+  setup = {
+    trigger = "server";
+    script = pkgs.writeShellScript "setup" ''
+      # Define the command wrapper
+      OCC="${pkgs.podman}/bin/podman --events-backend=none exec --env-file ${config.sops.secrets."CUSTOM".path} -e DOMAIN=${serverCfg.domain} -u www-data nextcloud-server php occ"
+
+      echo "Waiting for Nextcloud container to start..."
+      until $OCC status > /dev/null 2>&1; do
+        sleep 2
+      done
+
+      INSTALLED=$($OCC status --output=json | grep -o '"installed":true')
+      if [ -z "$INSTALLED" ]; then
+        echo "Running first-time setup..."
+        
+        $OCC maintenance:install \
+          --admin-user "$DEFAULT_ADMIN_USERNAME" \
+          --admin-pass "$DEFAULT_ADMIN_PASSWORD"
+      fi
+      if [ -z "$INSTALLED" ] || [ -f "/tmp/force-nextcloud-setup" ]; then
+        rm -f "/tmp/force-nextcloud-setup"
+        echo "Applying Settings..."
+        
+        $OCC config:system:set default_phone_region --value="CH"
+        $OCC config:system:set overwriteprotocol --value="https"
+        $OCC config:app:set core backgroundjobs_mode --value="cron"
+        $OCC config:system:set maintenance_window_start --type=integer --value=1
+        $OCC config:system:set default_language --value="en"
+        $OCC config:system:set default_locale --value="en_CH"
+
+        echo "Applying Apps..."
+        $OCC app:disable activity || true
+        $OCC app:disable app_api || true
+        $OCC app:disable comments || true
+        $OCC app:disable firstrunwizard || true
+        $OCC config:system:set show_first_run_wizard --type=bool --value=false
+        $OCC app:disable nextcloud_announcements || true
+        $OCC app:disable oauth2 || true
+        $OCC app:disable recommendations || true
+        $OCC app:disable sharebymail || true
+        $OCC app:disable support || true
+        $OCC app:disable survey_client || true
+        $OCC app:disable updatenotification || true
+        $OCC app:disable user_status || true
+
+        $OCC app:install calendar || true
+        $OCC app:install contacts || true
+        $OCC app:install camerarawpreviews || true
+        $OCC app:install cospend || true
+        $OCC app:install deck || true
+        $OCC app:install files_markdown || true
+        $OCC app:install forms || true
+        $OCC app:install groupfolders || true
+        $OCC app:install ownpad || true
+        $OCC app:install previewgenerator || true
+        $OCC app:install richdocuments || true
+        ${lib.optionalString (serverCfg.containers ? collabora == false) ''$OCC app:install richdocumentscode || true''}
+        # $OCC app:install side_menu || true 
+        $OCC app:install spreed || true
+        $OCC app:install teamfolders || true
+        ${lib.optionalString (serverCfg.containers ? authentik) ''$OCC app:install user_saml || true''}
+
+        echo "Applying Apps Settings..."
+        $OCC config:system:set enabledPreviewProviders --value='["OC\\Preview\\Movie", "OC\\Preview\\PNG", "OC\\Preview\\JPEG", "OC\\Preview\\GIF", "OC\\Preview\\HEIC", "OC\\Preview\\RAW"]' --type=json
+        $OCC config:app:set cospend allow_federation --value="yes"
+        
+        ${lib.optionalString (serverCfg.containers ? ethercalc) ''
+        $OCC config:app:set ownpad ownpad_ethercalc_enable --value="yes"
+        $OCC config:app:set ownpad ownpad_ethercalc_host --value="https://${serverCfg.containers.ethercalc.subdomain}.${serverCfg.domain}"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? etherpad) ''
+        $OCC config:app:set ownpad ownpad_etherpad_enable --value="yes"
+        $OCC config:app:set ownpad ownpad_etherpad_host --value="https://${serverCfg.containers.etherpad.subdomain}.${serverCfg.domain}"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? collabora) ''
+        $OCC config:app:set richdocuments wopi_url --value="https://${serverCfg.containers.collabora.subdomain}.${serverCfg.domain}/"
+        $OCC config:app:set richdocuments public_wopi_url --value="https://${serverCfg.containers.collabora.subdomain}.${serverCfg.domain}"
+        $OCC config:app:set richdocuments wopi_allowlist --value="10.0.0.0/8"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        $OCC saml:config:set 1 --general-idp0_display_name="authentik"
+        $OCC saml:config:set 1 --general-uid_mapping="http://schemas.goauthentik.io/2021/02/saml/username"
+        $OCC saml:config:set 1 --idp-entityId="https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}"
+        $OCC saml:config:set 1 --idp-singleSignOnService.url="https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/saml/nextcloud/sso/binding/redirect/"
+        $OCC saml:config:set 1 --idp-singleLogoutService.url="https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/saml/nextcloud/slo/binding/redirect/"
+        AUTHENTIK_CERT=$(${pkgs.postgresql}/bin/psql -h localhost -U authentik_user -d authentik_db -At -c "SELECT certificate_data FROM authentik_crypto_certificatekeypair WHERE name = 'authentik Self-signed Certificate';")
+        $OCC saml:config:set 1 --idp-x509cert="$AUTHENTIK_CERT" 
+
+        $OCC saml:config:set 1 --saml-attribute-mapping-displayName_mapping="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
+        $OCC saml:config:set 1 --saml-attribute-mapping-email_mapping="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
+        $OCC saml:config:set 1 --saml-attribute-mapping-group_mapping="http://schemas.xmlsoap.org/claims/Group"
+
+        $OCC config:app:set user_saml general-allowed_groups --value="admin,cloud"
+        $OCC group:add cloud || true
+        $OCC group:adduser admin $DEFAULT_ADMIN_USERNAME
+        $OCC config:app:set user_saml general-group_provisioning --value="0"
+        $OCC config:app:set user_saml general-require_provisioning_groups --value="1"
+        ''}
+        # configure side_menu ...
+        FOLDERS=$($OCC teamfolders:list --format=json)
+        ${builtins.concatStringsSep "\n" (map (name: ''
+          if ! echo "$FOLDERS" | grep -q '"name":"${name}"'; then
+              $OCC teamfolders:create "${name}"
+          fi
+        '') containerCfg.extra.teamFolders or [])}
+        SERVERS=$($OCC federation:list-servers --format=json)
+        ${builtins.concatStringsSep "\n" (map (domain: ''
+          if ! echo "$SERVERS" | grep -q "${domain}"; then
+            $OCC federation:add-server "https://${domain}"
+          fi
+        '') containerCfg.extra.federatedServers or [])}
+        $OCC config:app:set systemtags allow_user_creating --value="no"
+        
+        echo "Applying Theme..."
+        $OCC config:app:set theming url --value="https://${containerCfg.subdomain}.${serverCfg.domain}"
+        ${lib.optionalString (containerCfg.extra ? name) ''$OCC config:app:set theming name --value="${containerCfg.extra.name}"''}
+        ${lib.optionalString (containerCfg.extra ? slogan) ''$OCC config:app:set theming slogan --value="${containerCfg.extra.slogan}"''}
+        $OCC config:app:set theming background_color --value="${serverCfg.colorScheme.palette.base02}"
+        $OCC config:app:set theming primary_color --value="${serverCfg.colorScheme.palette.base0C}"
+
+        #$OCC theming:config logo {serverCfg.colorScheme.logo}
+        #$OCC theming:config logoheader {serverCfg.colorScheme.logo}
+        #$OCC theming:config background {serverCfg.colorScheme.bg}
+            
+      else
+          echo "Nextcloud is already installed. Skipping setup."
+      fi
+
+      $OCC config:app:set serverinfo token --value="$HOMEPAGE_VAR_NEXTCLOUD_API"
+
+      echo "Maintenance..."
+      $OCC app:update --all
+      $OCC maintenance:repair --include-expensive --no-interaction
+      $OCC db:add-missing-indices --no-interaction
+
+      echo "Completed Setup"
+    '';
+  };
+
+  cron = [ "*/5 * * * *  root  ${pkgs.podman}/bin/podman --events-backend=none exec -u www-data nextcloud-server php -f /var/www/html/cron.php" ];
+}

modules/server/containers/apps/openhab.nix

@@ -0,0 +1,77 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  version = "5.1.4"; 
+
+in {
+  sops = false;
+  db = false;
+  paths = [
+    { path="${serverCfg.configPath}/openhab/conf";  owner="1000:1000"; mode = "0755"; }
+    { path="${serverCfg.configPath}/openhab/userdata";  owner="1000:1000"; mode = "0755"; }
+    { path="${serverCfg.configPath}/openhab/addons";  owner="1000:1000"; mode = "0755"; }
+  ];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "openhab/openhab:${version}";
+      port = 8080; 
+      extraEnv = { 
+        USER_ID = "1000";
+        GROUP_ID = "1000";
+        CRYPTO_POLICY = "unlimited";
+        OPENHAB_HTTP_PORT = "8080";
+      };
+      extraOptions = [
+        "--network=host"
+        "--cap-add=NET_ADMIN"
+        "--cap-add=NET_RAW"
+        "--no-healthcheck"
+      ];
+      overrides = {
+        volumes = [ 
+          "${serverCfg.configPath}/openhab/conf:/openhab/conf"
+          "${serverCfg.configPath}/openhab/userdata:/openhab/userdata"
+          "${serverCfg.configPath}/openhab/addons:/opt/openhab/addons"
+          "/var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket:ro"
+        ];
+       };
+    };
+  };
+
+  setup = {
+    trigger = "server";
+    envFile = [ config.sops.secrets."CUSTOM".path ];
+    script = pkgs.writeShellScript "setup" ''
+      # Pre-generate openHAB directories on the host
+      OHAB="${pkgs.podman}/bin/podman --events-backend=none exec openhab-server /openhab/runtime/bin/client -u openhab -p habopen"
+      sleep 20
+      exit 0
+      $OHAB openhab:users add $DEFAULT_ADMIN_USERNAME $DEFAULT_ADMIN_PASSWORD administrator 
+      $OHAB feature:list
+      $OHAB openhab:addons install persistance-mapdb
+      $OHAB openhab:addons install persistance-influxdb
+
+      $OHAB openhab:addons install ui-basic
+      $OHAB openhab:addons install automation-jsscripting
+
+      $OHAB openhab:addons install binding-telegram
+      $OHAB openhab:addons install binding-matter
+      $OHAB openhab:addons install binding-mqtt
+      $OHAB openhab:addons install binding-bluetooth
+      $OHAB openhab:addons install binding-zigbee
+      $OHAB openhab:addons install binding-chromecast
+      $OHAB openhab:addons install binding-astro
+      $OHAB openhab:addons install binding-meteoblue
+      $OHAB openhab:addons install binding-publictransportswitzerland
+
+      #IF APPLE DEVICE: HomeKit (siri/apple bridge)
+      #IF UBIQUITY NET: Unifi + UnifiProtect (net/cam bridge)
+      #IF YAMAHA+EPSON: EpsonProjector + Yamaha (projector and sound)
+      #IF BAMBULAB DEVICE: BambuLab (notify print state)
+      #IF GARDENA DEVICE: Gardena (smart watering)
+      #Extra: AndroidTV/Jellyfin (Bind with lights + more)
+    '';
+  };
+}

modules/server/containers/apps/searxng.nix

@@ -0,0 +1,92 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  version= "latest";
+  serverCfg = config.syscfg.server;
+  settings = pkgs.writeText"settings.yml" (pkgs.lib.generators.toYAML {}{
+    use_default_settings = true;
+    brand = {
+        issue_url = "";
+        docs_url = "";
+        public_instances = "";
+        wiki_url = "";
+        custom = {
+            links = {
+                "Home" = "https://${serverCfg.domain}";
+                # "Status" = "https://status.${serverCfg.domain}";
+            };
+        };
+        pwa_colors = {
+            theme_color_light = "${serverCfg.colorScheme.palette.base0C}";
+            background_color_light = "${serverCfg.colorScheme.palette.base07}";
+            theme_color_dark = "${serverCfg.colorScheme.palette.base0C}";
+            background_color_dark = "${serverCfg.colorScheme.palette.base02}";
+            theme_color_black = "${serverCfg.colorScheme.palette.base0C}";
+            background_color_black = "${serverCfg.colorScheme.palette.base01}";
+        };
+    };
+    general = {
+        debug = false;
+        instance_name = if containerCfg.extra ? instanceName then containerCfg.extra.instanceName else "SearXNG";
+        privacypolicy_url = false;
+        donation_url = false;
+        contact_url = false;
+        enable_metrics = false;
+    };
+    search = {
+        safe_search = 0;
+        autocomplete = if containerCfg.extra ? autocomplete then containerCfg.extra.autocomplete else "";
+        languages = [ "all" "en" "en-US" "ja" "de-CH" "fr-CH" "nb" ];
+    };
+    server = {
+        # secret_key = ""; SET BY ENV VAR
+    };
+    ui = {
+        default_locale = if containerCfg.extra ? defaultLocale then containerCfg.extra.defaultLocale else "en";
+        # query_in_title = "true";
+        #default_theme = "custom";
+        custom_css = "footer { display: none !important; }";
+    };
+    # categories_as_tabs = {
+    #     general = {};
+    #     images ={};
+    #     videos = {};
+    #     news = {};
+    #     files = {};
+    # };
+    plugins = {
+        "searx.plugins.infinite_scroll.SXNGPlugin".active = true;
+        "searx.plugins.tracker_url_remover.SXNGPlugin".active = true;
+    };
+  });
+in {
+   sops = true;
+#   paths = [{
+#     path="${serverCfg.dataPath}/searxng/";
+#     mode = "0444";
+#   }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "searxng/searxng:${version}";
+      port = 8080;
+      secret = name;
+      extraEnv = { 
+        SEARXNG_BASE_URL = "https://${containerCfg.subdomain}.${serverCfg.domain}";
+        SEARXNG_PORT = "8080";
+        SEARXNG_BIND_ADDRESS = "[::]";
+        SEARXNG_PUBLIC_INSTANCE = "false";
+        SEARXNG_SETTINGS_PATH = "/etc/searxng/settings.yml";
+        #SEARXNG_VALKEY_URL = "valkey://user:password@${builder.host}:6379/0}";
+      };
+      overrides = {
+        cmd = [ ];
+        volumes = [ 
+            "${settings}:/etc/searxng/settings.yml"
+            # "/path/to/your/logo.png:/usr/local/searxng/searx/static/themes/simple/img/searxng.png
+            # "${serverCfg.dataPath}/searxng:/var/cache/searxng/"
+        ];
+       };
+    };
+  };
+}

modules/server/containers/apps/selfmark.nix

@@ -0,0 +1,36 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+
+in {
+  sops = false;
+  db = false;
+  paths = [{
+    path = "${serverCfg.configPath}/selfmark/";
+    mode = "0444";
+  }];
+
+  containers = {
+    selfmark = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      subpath = containerCfg.subpath;
+      image = "ghcr.io/calibrain/shelfmark:${version}";
+      port = 8080;
+      
+      extraEnv = {
+        FLASK_PORT = "8080";
+        INGEST_DIR = "/books";
+        PUID = "1000";
+        PGID = "1000";
+        SEARCH_MODE = "universal";
+       };
+      overrides = {
+        ports = [ "8080:8080" ];
+        cmd = [ ];
+        volumes = [ ];
+       };
+    };
+  };
+
+}

modules/server/containers/apps/suwayomi.nix

@@ -0,0 +1,33 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "stable"; 
+  serverCfg = config.syscfg.server;
+in {
+    sops = true;
+    db =true;
+  containers = {
+    
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "ghcr.io/suwayomi/suwayomi-server:${version}";
+      port = 4567;
+      secret = name;
+
+      extraEnv = {
+        BIND_PORT = "4567";
+        AUTH_MODE = "none";
+        WEB_UI_ENABLED = "true";
+        DATABASE_URL = "postgresql://${builder.host}/suwayomi_db";
+        DATABASE_USER = "suwayomi_user";
+        FLARESOLVERR_ENABLED = lib.boolToString (builtins.elem "flaresolverr" (((config.syscfg.server.containers.servarr or {}).extra or {}).modules or []));
+        FLARESOLVERR_URL = "http://servarr-flaresolverr:8191";
+      };
+
+      overrides = {
+        volumes = [
+        ];
+      };
+    };
+  };
+
+}

modules/server/containers/apps/traefik.nix

@@ -0,0 +1,87 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "traefik";
+    tag = pkgs.traefik.version;
+    contents = with pkgs;[ cacert tzdata ];
+    config = {
+      Entrypoint = [ "${pkgs.traefik}/bin/traefik" ];
+      WorkingDir = "/";
+    };
+  };
+in {
+  sops = true;
+  paths = [{
+    path="${serverCfg.configPath}/traefik";
+    owner = "1000:1000";
+    mode = "0755";
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      imageStream = image;
+      subdomain = containerCfg.subdomain;
+      port = 8080;
+      secret = name;
+      extraLabels = {
+        "traefik.http.routers.${containerCfg.subdomain}.priority" = "10";
+        "traefik.http.routers.${containerCfg.subdomain}.service" = "api@internal";
+                
+        "traefik.http.routers.${containerCfg.subdomain}.middlewares" =  if serverCfg.containers?authentik then "authentik" else "";
+      } // (if serverCfg.containers?authentik then {
+        "traefik.http.middlewares.authentik.forwardauth.maxResponseBodySize" = "10485760";
+        "traefik.http.middlewares.authentik.forwardauth.address" = "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik";
+        "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader" = "true";
+        "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders" = "X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version";
+      } else {}) // (if serverCfg.containers?umami then {
+        "traefik.http.middlewares.umami-global.plugin.umami-feeder.umamiHost" = "http://umami-server:3000";
+        "traefik.http.middlewares.umami-global.plugin.umami-feeder.umamiUsername" = "admin";
+        "traefik.http.middlewares.umami-global.plugin.umami-feeder.umamiPassword" = "umami";
+        "traefik.http.middlewares.umami-global.plugin.umami-feeder.createNewWebsites" = "true";
+      } else {}) // (if containerCfg.extra ? provider || serverCfg.domain != "localhost" then {
+        "traefik.http.routers.${containerCfg.subdomain}.tls.certresolver" = "default";
+        "traefik.http.routers.${containerCfg.subdomain}.tls.domains[0].main" = "${serverCfg.domain}";
+        "traefik.http.routers.${containerCfg.subdomain}.tls.domains[0].sans" = "*.${serverCfg.domain}";
+      } else {});
+      extraEnv = { };
+      overrides = {
+        cmd = [ 
+          "--api"
+          "--log.level=INFO"
+          "--providers.docker=true"
+          "--global.checknewversion=false"
+          "--global.sendanonymoususage=false"
+          "--api.insecure=true"
+          "--api.dashboard=true"
+          "--providers.docker.exposedByDefault=false"
+          "--entrypoints.web.address=:80"
+          "--entrypoints.web-secure.address=:443"
+          "--entrypoints.web.http.redirections.entrypoint.to=web-secure"
+          "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+          "--entrypoints.web-secure.transport.respondingtimeouts.readtimeout=0s"
+          "--entrypoints.web-secure.proxyprotocol.trustedips=127.0.0.1/32,192.168.1.1/16,10.10.0.0/16"
+        ] ++ (if serverCfg.containers ? umami  then [
+          "--experimental.plugins.umami-feeder.moduleName=github.com/astappiev/traefik-umami-feeder"
+          "--experimental.plugins.umami-feeder.version=v1.4.1"
+          "--entrypoints.web-secure.http.middlewares=umami-global@docker"
+        ] else []) ++ (if containerCfg.extra ? provider then [
+          "--certificatesresolvers.default.acme.email=acme@${serverCfg.domain}"
+          "--certificatesresolvers.default.acme.dnschallenge=true"
+          "--certificatesresolvers.default.acme.dnschallenge.provider=${containerCfg.extra.provider}"
+          "--certificatesresolvers.default.acme.storage=/custom/acme.json"
+        ] else []) ++ (if serverCfg.domain != "localhost" then [
+          "--certificatesresolvers.default.acme.httpchallenge=false"
+          "--certificatesresolvers.default.acme.tlschallenge=true"
+        ] else []);
+        ports = [ "443:443" "80:80" ] ++ (if containerCfg.port!=null then [ "${toString containerCfg.port}:8080" ] else []);
+        volumes = [
+          "/var/run/podman/podman.sock:/var/run/docker.sock"
+          # "${serverCfg.configPath}/traefik/access.log:/etc/traefik/access.log"
+          "${serverCfg.configPath}/traefik:/custom"
+        ];
+      };
+    };
+  };
+}
+

modules/server/containers/apps/transmission.nix

@@ -0,0 +1,73 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = pkgs.transmission_4.name;
+    tag = pkgs.transmission_4.version;
+    contents = [ pkgs.cacert ];
+    config = {
+        Cmd = [ "${pkgs.transmission_4}/bin/transmission-daemon" "--foreground" "--config-dir" "/config" ];
+        ExposedPorts = {
+            "9091/tcp" = {};
+            "51413/tcp" = {}; "51413/udp" = {};
+        };
+    };
+  };
+  routerName = if containerCfg.subpath != null 
+              then "${containerCfg.subdomain}-${lib.strings.sanitizeDerivationName containerCfg.subpath}" 
+              else containerCfg.subdomain;
+in {
+  paths = [{
+      path = "${serverCfg.dataPath}/transmission/complete";
+      owner = "1000:1000";
+      mode = "0755";
+    }{
+      path = "${serverCfg.dataPath}/transmission/incomplete";
+      owner = "1000:1000";
+      mode = "0755";
+    }{
+      path = "${serverCfg.configPath}/transmission/config";
+      owner = "1000:1000";
+      mode = "0755";
+    }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      subpath = containerCfg.subpath;
+      imageStream = image;
+      port = 9091;
+      
+      extraEnv = {
+        PUID = "1000";
+        PGID = "1000";
+        WHITELIST = "";# 127.0.0.1,::1,10.*";
+        # HOST_WHITELIST = "traefik-server,authentik-server,authentik-worker";
+      };
+      extraLabels = { 
+      } // (if serverCfg.containers ? authentik then {
+        "traefik.http.routers.${routerName}.middlewares" = "authentik";
+      } else {});
+
+      overrides = {
+        cmd = [ ];
+        volumes = [
+          "${serverCfg.dataPath}/transmission/complete:/downloads/complete"
+          "${serverCfg.dataPath}/transmission/incomplete:/downloads/incomplete"
+          "${serverCfg.configPath}/transmission/config:/config"
+        ];
+      };
+    };
+  };
+
+
+  setup = {
+    trigger = "server";
+    envFile = [ config.sops.secrets."CUSTOM".path ];
+    script = pkgs.writeShellScript "setup" ''
+
+      ${pkgs.gettext}/bin/envsubst < "${../data/transmission/settings.json}" > "${serverCfg.configPath}/transmission/config/settings.json"
+    '';
+  };
+
+}

modules/server/containers/apps/trmnl.nix

@@ -0,0 +1,3 @@
+{...}:{
+    
+}

modules/server/containers/apps/umami.nix

@@ -0,0 +1,54 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  
+  # Umami image built from nixpkgs
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = pkgs.umami.name;
+    tag = pkgs.umami.version;
+    contents = with pkgs; [ cacert openssl ];
+    config = {
+      # Umami in nixpkgs typically provides a binary or script to start the server
+      Entrypoint = [ "${pkgs.umami}/bin/umami-server" ];
+      ExposedPorts = { "3000/tcp" = {}; };
+      Env = [ "NODE_ENV=production" ];
+    };
+  };
+in {
+  sops = true;
+  db = true;
+  paths = [{
+    path = "${serverCfg.configPath}/umami/";
+    mode = "0444";
+  }];
+
+  containers = {
+    server = builder.mkContainer {
+      subdomain = containerCfg.subdomain;
+      image = "${pkgs.umami.name}:${pkgs.umami.version}"; 
+      imageStream = image;
+      port = 3000;
+      secret = name;
+      extraEnv = {
+        PORT = "3000";
+        # HOSTNAME = "${containerCfg.subdomain}.${serverCfg.domain}";
+        DATABASE_TYPE = "postgresql";
+        REDIS_URL = "redis://${builder.host}";
+        CLIENT_IP_HEADER = "X-Forwarded-For";
+        BASE_PATH = lib.optionalString (containerCfg.subpath or null != null) "/${containerCfg.subpath}";
+        # DISABLE_LOGIN = "1";#(if serverCfg.containers?authentik then "1" else "0");
+
+      };
+      extraLabels = { } // ( if serverCfg.containers?authentik then {
+        "traefik.http.routers.${containerCfg.subdomain}.middlewares" = if serverCfg.containers?authentik then "authentik" else "";
+      } else {});
+      extraOptions = [
+        "--tmpfs=/tmp:rw,noexec,nosuid,size=512m"
+      ];
+      overrides = {
+        cmd = [ "start" ]; # Specific command for the umami binary
+       };
+    };
+  };
+
+}

modules/server/containers/builder.nix

@@ -0,0 +1,85 @@
+{ config, lib, pkgs, serverCfg }:
+let 
+  contBuilder =
+    { image ? null, imageStream ? null, imageFile ? null
+    , secret ? null
+    , subdomain ? null, subpath?null, port ? null
+    , extraEnv ? { }, extraLabels ? { }, extraOptions ? [ ]
+    , overrides ? { }
+    }:
+    let 
+      routerName = if subpath != null 
+                  then "${subdomain}-${lib.strings.sanitizeDerivationName subpath}" 
+                  else subdomain;
+      base = {
+      image = if imageStream != null then "${imageStream.imageName}:${imageStream.imageTag}" 
+              else if imageFile != null then "${imageFile.imageName}:${imageFile.imageTag}" else image;
+      imageStream = imageStream;
+      imageFile = imageFile;
+
+      environmentFiles = if secret!=null then [ config.sops.secrets."${lib.toUpper secret}".path ] else [];
+      environment = {
+        TZ = config.time.timeZone;
+      } // extraEnv;
+
+      labels = (if subdomain!=null then ({
+        "traefik.enable" = "true";
+        "traefik.http.routers.${routerName}.entrypoints" = "web-secure";
+        "traefik.http.routers.${routerName}.rule" = if subpath != null 
+          then "Host(`${subdomain}.${serverCfg.domain}`) && PathPrefix(`/${subpath}`)"
+          else "Host(`${subdomain}.${serverCfg.domain}`)";
+        "traefik.http.routers.${routerName}.tls" = "true";
+      } // lib.optionalAttrs (port!=null) {
+        "traefik.http.services.${routerName}.loadbalancer.server.port" = toString port;
+      }) else {
+        "traefik.enable" = "false";
+      }) // extraLabels;
+
+      extraOptions = [
+        "--add-host=host.containers.internal:host-gateway"
+      ] ++ extraOptions;
+    };
+    in lib.recursiveUpdate base overrides;
+  vmBuilder = { name, vm }: ((import "${pkgs.path}/nixos/lib/eval-config.nix" {
+      system = "x86_64-linux";
+      modules = [ vm.cfg
+        ({ config, lib, modulesPath, ... }: {
+        imports = [
+          "${modulesPath}/profiles/qemu-guest.nix"
+          "${modulesPath}/virtualisation/qemu-vm.nix"
+        ];
+        networking.hostName = name;
+        networking.useDHCP = true; 
+        networking.firewall.enable = false;
+        services.qemuGuest.enable = true;
+        system.stateVersion = "26.05"; 
+        virtualisation = {
+          memorySize = vm.memory or 2048;
+          cores = vm.cores or 2;
+          forwardPorts = let
+            parsePortString = port: {
+              from = "host";
+              host.port = port;
+              guest.port = port;
+            };
+          in if (vm ? portForward && vm.portForward != null) then map parsePortString vm.portForward else [];
+        };})
+      ];
+    }).config.system.build.vm);
+in {
+  mkContainer = contBuilder;
+  mkVm = vmBuilder;
+  mkData = { name, dir, vars?{} }: pkgs.runCommand name vars ''
+    mkdir -p $out
+    cp -r ${./data + "/${dir}"}/. $out/
+    find $out -type f | while read file; do
+      ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
+        substituteInPlace "$file" --replace "@${n}@" "${toString v}"
+      '') vars)}
+    done
+  '';
+  host = "host.containers.internal"; 
+  hostIp =  if (config.virtualisation.podman.defaultNetwork.settings ? subnets) 
+    then (builtins.elemAt config.virtualisation.podman.defaultNetwork.settings.subnets 0).gateway
+    else "10.88.0.1"; 
+}

modules/server/containers/data/authentik/authentik.yaml

@@ -0,0 +1,70 @@
+version: 1
+metadata:
+  name: "Initial User Setup"
+  labels:
+    blueprint-type: core
+entries:
+  # Optionally, disable the default enrollment flow entirely
+  - model: authentik_flows.flow
+    identifiers:
+      slug: "default-source-enrollment"
+    attrs:
+      designation: "enrollment"
+      enabled: false
+  # --- GROUPS ---
+  - model: authentik_core.group
+    identifiers:
+      name: "admin"
+    attrs:
+      is_superuser: true
+
+  - model: authentik_core.group
+    identifiers:
+      name: "cloud"
+    attrs:
+      is_superuser: false
+
+  - model: authentik_core.group
+    identifiers:
+      name: "dev"
+    attrs:
+      is_superuser: false
+
+  - model: authentik_core.group
+    identifiers:
+      name: "flix"
+    attrs:
+      is_superuser: false
+
+  - model: authentik_core.group
+    identifiers:
+      name: "family"
+    attrs:
+      is_superuser: false
+
+  # --- ADMIN USERS ---
+  - model: authentik_core.user
+    identifiers:
+      username: !Env DEFAULT_ADMIN_USERNAME
+    attrs:
+      name: !Env DEFAULT_ADMIN_USERNAME
+      email: !Env DEFAULT_ADMIN_EMAIL
+      password: !Env DEFAULT_ADMIN_PASSWORD
+      path: "users"
+      groups:
+        - !Find [authentik_core.group, [name, "admin"]]
+
+  # Disable the Initial Setup Flow
+  - model: authentik_flows.flow
+    identifiers:
+      slug: "initial-setup"
+    attrs:
+      authentication: "require_superuser"
+      enabled: false
+
+  # Disable the default 'akadmin' if it exists
+  - model: authentik_core.user
+    identifiers:
+      username: "akadmin"
+    attrs:
+      is_active: false

modules/server/containers/data/authentik/gitea.yaml

@@ -0,0 +1,11 @@
+version: 1
+metadata:
+  name: gitea-ldap-setup
+entries:
+  - model: authentik_core.application
+    id: gitea-app
+    identifiers:
+      slug: gitea
+    attrs:
+      name: Gitea
+      launch_url: "@GITEA_DOMAIN@"

modules/server/containers/data/authentik/homepage.yaml

@@ -0,0 +1,108 @@
+version: 1
+metadata:
+  name: "Homepage Dashboard - OIDC Provisioning"
+  labels:
+    app: homepage
+
+entries:
+  - model: authentik_providers_oauth2.scopemapping
+    identifiers:
+      name: "Homepage Custom Scope: Groups"
+    attrs:
+      scope_name: "groups"
+      description: "Pass user groups array to Homepage for conditional element rendering"
+      expression: |
+        return {
+            "groups": [group.name for group in request.user.ak_groups.all()]
+        }
+  # 1. Create the OAuth2/OIDC Provider
+  - model: authentik_providers_oauth2.oauth2provider
+    identifiers:
+      name: "Homepage Provider"
+    attrs:
+      authorization_flow:
+        !Find [
+          authentik_flows.flow,
+          [slug, default-provider-authorization-implicit-consent],
+        ]
+      authentication_flow:
+        !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      client_type: "confidential"
+      client_id: "homepage"
+      client_secret: !Env HOMEPAGE_VAR_OAUTH_SECRET
+      access_code_validity: "minutes=5"
+      token_validity: "days=30"
+      redirect_uris:
+        - url: "https://@HOMEPAGE_DOMAIN@/login"
+          matching_mode: "regex"
+      signing_key:
+        !Find [
+          authentik_crypto.certificatekeypair,
+          [name, "authentik Self-signed Certificate"],
+        ]
+      property_mappings:
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'openid'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'email'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'profile'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "Homepage Custom Scope: Groups"],
+          ]
+
+  # 2. Create the Application and link it to the Provider
+  - model: authentik_core.application
+    identifiers:
+      slug: homepage
+    attrs:
+      name: "Homepage"
+      launch_url: "@HOMEPAGE_DOMAIN@"
+      provider:
+        !Find [
+          authentik_providers_oauth2.oauth2provider,
+          [name, Homepage Provider],
+        ]
+      open_in_new_tab: false
+
+  # 3. Provision the static API token linked to the user account
+  - model: authentik_rbac.role
+    state: present
+    identifiers:
+      name: homepage-viewer
+    attrs:
+      permissions:
+        - authentik_core.view_user
+        - authentik_events.view_event
+
+  - model: authentik_core.user
+    state: present
+    identifiers:
+      username: homepage-svc
+    attrs:
+      roles:
+        - !Find [authentik_rbac.role, [name, "homepage-viewer"]]
+      name: Homepage Service Account
+      path: goauthentik.io/service-accounts
+      is_active: true
+      attributes:
+        goauthentik.io/user/service-account: true
+
+  - model: authentik_core.token
+    state: present
+    identifiers:
+      identifier: homepage-token
+    attrs:
+      key: !Env HOMEPAGE_VAR_AUTHENTIK_API
+      user: !Find [authentik_core.user, [username, "homepage-svc"]]
+      intent: api
+      expiring: false

modules/server/containers/data/authentik/immich.yaml

@@ -0,0 +1,62 @@
+version: 1
+metadata:
+  name: "Immich OAuth2 Provisioning"
+  labels:
+    app: immich
+entries:
+  - model: authentik_providers_oauth2.oauth2provider
+    identifiers:
+      name: "Immich Provider"
+    attrs:
+      authorization_flow:
+        !Find [
+          authentik_flows.flow,
+          [slug, default-provider-authorization-implicit-consent],
+        ]
+      authentication_flow:
+        !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      client_type: "confidential"
+      client_id: "immich"
+
+      client_secret: !Env IMMICH_OAUTH_SECRET
+      access_code_validity: "minutes=5"
+      token_validity: "days=30"
+      signing_key:
+        !Find [
+          authentik_crypto.certificatekeypair,
+          [name, "authentik Self-signed Certificate"],
+        ]
+      redirect_uris:
+        - url: "app.immich:///oauth-callback"
+          matching_mode: "strict"
+        - url: "https://@IMMICH_DOMAIN@/auth/login"
+          matching_mode: "regex"
+        - url: "https://@IMMICH_DOMAIN@/user-settings"
+          matching_mode: "regex"
+      property_mappings:
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'openid'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'email'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'profile'"],
+          ]
+
+  - model: authentik_core.application
+    identifiers:
+      slug: "immich"
+    attrs:
+      name: "Immich"
+      launch_url: "@IMMICH_DOMAIN@"
+      provider:
+        !Find [
+          authentik_providers_oauth2.oauth2provider,
+          [name, "Immich Provider"],
+        ]

modules/server/containers/data/authentik/jellyfin.yaml

@@ -0,0 +1,11 @@
+version: 1
+metadata:
+  name: jellyfin-ldap-setup
+entries:
+  - model: authentik_core.application
+    id: jellyfin-app
+    identifiers:
+      slug: jellyfin
+    attrs:
+      name: Jellyfin
+      launch_url: "@JELLYFIN_DOMAIN@"

modules/server/containers/data/authentik/ldap.yaml

@@ -0,0 +1,79 @@
+version: 1
+metadata:
+  name: Pre-configured LDAP Outpost
+entries:
+  - model: authentik_providers_ldap.ldapprovider
+    identifiers:
+      name: ldap-provider
+    attrs:
+      base_dn: "@AUTHENTIK_LDAP_DC_DOMAIN@"
+      search_group: null
+      authorization_flow:
+        !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.user
+    state: present
+    identifiers:
+      username: "ldap-service"
+    attrs:
+      name: "LDAP Bind Service Account"
+      type: "service_account"
+      path: "goauthentik.io"
+      is_active: true
+      password: !Env DEFAULT_LDAP_PASSWORD
+      attributes:
+        ak_recovery_immutable: true
+
+  - model: authentik_core.token
+    identifiers:
+      identifier: ldap-outpost-static-token
+    attrs:
+      intent: api
+      expiring: false
+      key: !Env AUTHENTIK_TOKEN
+      user: !Find [authentik_core.user, [username, "ldap-service"]]
+
+  - model: authentik_outposts.outpost
+    identifiers:
+      name: LDAP Outpost
+    attrs:
+      type: ldap
+      providers:
+        - !Find [authentik_providers_ldap.ldapprovider, [name, ldap-provider]]
+      token:
+        !Find [authentik_core.token, [identifier, ldap-outpost-static-token]]
+      config:
+        log_level: info
+        authentik_host: https://sso.test.helcel.net/
+        refresh_interval: minutes=5
+        authentik_host_insecure: false
+
+  - model: authentik_rbac.role
+    state: present
+    identifiers:
+      name: "LDAP Search Role"
+    attrs:
+      permissions:
+        - "authentik_providers_ldap.search_full_directory"
+
+  - model: authentik_core.group
+    state: present
+    identifiers:
+      name: "LDAP Search Group"
+    attrs:
+      users:
+        - !Find [authentik_core.user, [username, "ldap-service"]]
+      roles:
+        - !Find [authentik_rbac.role, [name, "LDAP Search Role"]]
+
+  - model: authentik_core.application
+    id: ldap-placeholder
+    identifiers:
+      slug: ldap
+    attrs:
+      name: ldap
+      group: _
+      provider:
+        !Find [authentik_providers_ldap.ldapprovider, [name, ldap-provider]]

modules/server/containers/data/authentik/nextcloud.yaml

@@ -0,0 +1,58 @@
+version: 1
+metadata:
+  name: nextcloud-saml-setup
+entries:
+  - model: authentik_providers_saml.samlprovider
+    identifiers:
+      name: Nextcloud SAML
+    attrs:
+      authorization_flow:
+        !Find [
+          authentik_flows.flow,
+          [slug, default-provider-authorization-explicit-consent],
+        ]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+      acs_url: https://@NEXTCLOUD_DOMAIN@/apps/user_saml/saml/acs
+      audience: https://@NEXTCLOUD_DOMAIN@/apps/user_saml/saml/metadata
+      issuer: https://@AUTHENTIK_DOMAIN@
+      sp_binding: post
+      property_mappings:
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: Name"],
+          ]
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: Email"],
+          ]
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: Groups"],
+          ]
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: Username"],
+          ]
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: User ID"],
+          ]
+
+      signing_kp:
+        !Find [
+          authentik_crypto.certificatekeypair,
+          [name, "authentik Self-signed Certificate"],
+        ]
+      sign_assertion: true
+      sign_response: false
+
+  - model: authentik_core.application
+    identifiers:
+      slug: nextcloud
+    attrs:
+      name: Nextcloud
+      provider:
+        !Find [authentik_providers_saml.samlprovider, [name, Nextcloud SAML]]
+      launch_url: "@NEXTCLOUD_DOMAIN@"

modules/server/containers/data/authentik/traefik.yaml

@@ -0,0 +1,46 @@
+version: 1
+metadata:
+  name: domain-wide-proxy-setup
+entries:
+  # 1. The Provider
+  - model: authentik_providers_proxy.proxyprovider
+    identifiers:
+      name: Domain Wide Proxy
+    attrs:
+      authorization_flow:
+        !Find [
+          authentik_flows.flow,
+          [slug, default-provider-authorization-implicit-consent],
+        ]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+      external_host: https://@AUTHENTIK_DOMAIN@
+      cookie_domain: "@COOKIE_DOMAIN@"
+
+      mode: forward_domain
+      intercept_header_auth: true
+
+  # 2. The Application (Required to link the provider)
+  - model: authentik_core.application
+    identifiers:
+      slug: authentik-proxy
+    attrs:
+      name: "Domain Auth Provider"
+      group: _
+      provider:
+        !Find [
+          authentik_providers_proxy.proxyprovider,
+          [name, Domain Wide Proxy],
+        ]
+
+  # 3. Add to Outpost
+  - model: authentik_outposts.outpost
+    identifiers:
+      name: authentik Embedded Outpost
+    attrs:
+      providers:
+        - !Find [
+            authentik_providers_proxy.proxyprovider,
+            [name, Domain Wide Proxy],
+          ]

modules/server/containers/data/invidious/config.yml

@@ -0,0 +1,137 @@
+db:
+    user: invidious_user
+    password: $DB_PASSWORD
+    host: $DB_HOST
+    port: 5432
+    dbname: invidious_db
+
+check_tables: true
+invidious_companion:
+    - private_url: "http://invidious-companion:8282/companion"
+
+invidious_companion_key: $SERVER_SECRET_KEY
+port: 3000
+
+external_port: 443
+host_binding: 0.0.0.0
+domain: $INVIDIOUS_DOMAIN
+https_only: false
+#hsts: true
+
+## Accepted values: true, false, dash, livestreams, downloads, local
+#disable_proxy: false
+# use_innertube_for_captions: false
+
+# -----------------------------
+#  Features
+# -----------------------------
+
+popular_enabled: false
+statistics_enabled: true
+registration_enabled: true
+login_enabled: true
+captcha_enabled: false
+admins: ["$DEFAULT_ADMIN_EMAIL"]
+enable_user_notifications: false
+
+# -----------------------------
+#  Background jobs
+# -----------------------------
+
+channel_threads: 1
+#channel_refresh_interval: 30m
+
+full_refresh: false
+feed_threads: 1
+
+jobs:
+    clear_expired_items:
+        enable: true
+    refresh_channels:
+        enable: true
+    refresh_feeds:
+        enable: true
+
+# -----------------------------
+#  Miscellaneous
+# -----------------------------
+
+#banner:
+# use_pubsub_feeds: true
+
+hmac_key: $HMAC_KEY
+#dmca_content:
+#cache_annotations: false
+#modified_source_code_url: ""
+#playlist_length_limit: 500
+
+#########################################
+#
+#  Default user preferences
+#
+#########################################
+
+default_user_preferences:
+    # -----------------------------
+    #  Internationalization
+    # -----------------------------
+
+    #locale: en-US
+    #region: US
+    ## Top 3 preferred languages for video captions.
+    #captions: ["", "", ""]
+
+    # -----------------------------
+    #  Interface
+    # -----------------------------
+
+    dark_mode: "auto"
+    #thin_mode: false
+    feed_menu: ["Subscriptions", "Playlists"]
+    default_home: Subscriptions
+    #max_results: 40
+    #annotations: false
+    #annotations_subscribed: false
+    #comments: ["youtube", ""]
+    #player_style: invidious
+    #related_videos: true
+
+    # -----------------------------
+    #  Video player behavior
+    # -----------------------------
+
+    #preload: true
+    #autoplay: false
+    #continue: false
+    #continue_autoplay: true
+    #listen: false
+    #video_loop: false
+
+    # -----------------------------
+    #  Video playback settings
+    # -----------------------------
+
+    #quality: dash
+    #quality_dash: auto
+    #speed: 1.0
+    #volume: 100
+    #vr_mode: true
+    save_player_pos: true
+
+    # -----------------------------
+    #  Subscription feed
+    # -----------------------------
+
+    #latest_only: false
+    #notifications_only: false
+    unseen_only: true
+    #sort: published
+
+    # -----------------------------
+    #  Miscellaneous
+    # -----------------------------
+
+    #local: false
+    show_nick: false
+    #automatic_instance_redirect: false
+    #extend_desc: false

modules/server/containers/data/invidious/login.cr

@@ -0,0 +1,101 @@
+{% skip_file if flag?(:api_only) %}
+
+module Invidious::Routes::Login
+    def self.login_page(env)
+        locale = env.get("preferences").as(Preferences).locale
+
+        user = env.get? "user"
+        referer = get_referer(env, "/feed/subscriptions")
+        return env.redirect referer if user
+        return error_template(400, "Login has been disabled by administrator.") if !CONFIG.login_enabled
+        
+
+        if forwarded_user = env.request.headers["X-authentik-email"]? 
+            begin
+                email = forwarded_user.try &.downcase.byte_slice(0, 254)
+                
+                return error_template(401, "User ID is a required field") if email.nil? || email.empty?
+                
+                user = Invidious::Database::Users.select(email: email)
+                if user
+                    sid = Base64.urlsafe_encode(Random::Secure.random_bytes(32))
+                    Invidious::Database::SessionIDs.insert(sid, email)
+                    env.response.cookies["SID"] = Invidious::User::Cookies.sid(CONFIG.domain, sid)
+
+                    if env.request.cookies["PREFS"]?
+                        cookie = env.request.cookies["PREFS"]
+                        cookie.expires = Time.utc(1990, 1, 1)
+                        env.response.cookies << cookie
+                    end
+                else
+                    return error_template(400, "Registration has been disabled by administrator.") if !CONFIG.registration_enabled
+
+                    sid = Base64.urlsafe_encode(Random::Secure.random_bytes(32))
+                    user, sid = create_user(sid, email, "")
+
+                    if language_header = env.request.headers["Accept-Language"]?
+                        if language = ANG.language_negotiator.best(language_header, LOCALES.keys)
+                            user.preferences.locale = language.header
+                        end
+                    end
+
+                    Invidious::Database::Users.insert(user)
+                    Invidious::Database::SessionIDs.insert(sid, email)
+
+                    view_name = "subscriptions_#{sha256(user.email)}"
+                    PG_DB.exec("CREATE MATERIALIZED VIEW #{view_name} AS #{MATERIALIZED_VIEW_SQL.call(user.email)}")
+                    env.response.cookies["SID"] = Invidious::User::Cookies.sid(CONFIG.domain, sid)
+
+                    if env.request.cookies["PREFS"]?
+                        user.preferences = env.get("preferences").as(Preferences)
+                        Invidious::Database::Users.update_preferences(user)
+
+                        cookie = env.request.cookies["PREFS"]
+                        cookie.expires = Time.utc(1990, 1, 1)
+                        env.response.cookies << cookie
+                    end
+                end
+
+                return env.redirect referer
+            rescue ex
+                return error_template(500, "Authentication error: #{ex.message}")
+            end
+        end
+        env.redirect referer
+    end
+
+    def self.login(env)
+        referer = get_referer(env, "/feed/subscriptions")
+        env.redirect referer
+        return error_template(403, "Login post is not supported.")
+    end
+
+    def self.signout(env)
+        locale = env.get("preferences").as(Preferences).locale
+
+        user = env.get? "user"
+        sid = env.get? "sid"
+        referer = get_referer(env)
+
+        return env.redirect referer if !user
+
+        user = user.as(User)
+        sid = sid.as(String)
+        token = env.params.body["csrf_token"]?
+
+        begin
+            validate_request(token, sid, env.request, HMAC_KEY, locale)
+        rescue ex
+            return error_template(400, ex)
+        end
+
+        Invidious::Database::SessionIDs.delete(sid: sid)
+
+        env.request.cookies.each do |cookie|
+            cookie.expires = Time.utc(1990, 1, 1)
+            env.response.cookies << cookie
+        end
+
+        env.redirect referer
+    end
+end

modules/server/containers/data/transmission/settings.json

@@ -0,0 +1,70 @@
+{
+    "alt-speed-down": 50,
+    "alt-speed-enabled": false,
+    "alt-speed-time-begin": 540,
+    "alt-speed-time-day": 127,
+    "alt-speed-time-enabled": false,
+    "alt-speed-time-end": 1020,
+    "alt-speed-up": 50,
+    "bind-address-ipv4": "0.0.0.0",
+    "bind-address-ipv6": "::",
+    "blocklist-enabled": false,
+    "blocklist-url": "http://www.example.com/blocklist",
+    "cache-size-mb": 4,
+    "dht-enabled": true,
+    "download-dir": "/downloads/complete",
+    "download-queue-enabled": true,
+    "download-queue-size": 5,
+    "encryption": 1,
+    "idle-seeding-limit": 30,
+    "idle-seeding-limit-enabled": false,
+    "incomplete-dir": "/downloads/incomplete",
+    "incomplete-dir-enabled": true,
+    "lpd-enabled": false,
+    "message-level": 2,
+    "peer-congestion-algorithm": "",
+    "peer-id-ttl-hours": 6,
+    "peer-limit-global": 200,
+    "peer-limit-per-torrent": 50,
+    "peer-port": 51413,
+    "peer-port-random-high": 65535,
+    "peer-port-random-low": 49152,
+    "peer-port-random-on-start": false,
+    "peer-socket-tos": "default",
+    "pex-enabled": true,
+    "port-forwarding-enabled": true,
+    "preallocation": 1,
+    "prefetch-enabled": 1,
+    "queue-stalled-enabled": true,
+    "queue-stalled-minutes": 30,
+    "ratio-limit": 2,
+    "ratio-limit-enabled": false,
+    "rename-partial-files": true,
+    "rpc-authentication-required": false,
+    "rpc-bind-address": "0.0.0.0",
+    "rpc-enabled": true,
+    "rpc-password": "$TRANSMISSION_RPC_PASSWORD",
+    "rpc-port": 9091,
+    "rpc-url": "/transmission/",
+    "rpc-username": "",
+    "rpc-host-whitelist": "127.0.0.1",
+    "rpc-host-whitelist-enabled": false,
+    "rpc-whitelist": "127.0.0.1",
+    "rpc-whitelist-enabled": false,
+    "scrape-paused-torrents-enabled": true,
+    "script-torrent-done-enabled": false,
+    "script-torrent-done-filename": "",
+    "seed-queue-enabled": false,
+    "seed-queue-size": 10,
+    "speed-limit-down": 100,
+    "speed-limit-down-enabled": false,
+    "speed-limit-up": 100,
+    "speed-limit-up-enabled": false,
+    "start-added-torrents": true,
+    "trash-original-torrent-files": false,
+    "umask": 2,
+    "upload-slots-per-torrent": 14,
+    "utp-enabled": false,
+    "watch-dir": "/watch",
+    "watch-dir-enabled": true
+}

modules/server/containers/default.nix

@@ -0,0 +1,102 @@
+{ config, pkgs, lib, ... }:
+let
+  serverCfg = config.syscfg.server;
+  builder = import ./builder.nix { inherit config lib pkgs serverCfg; };
+
+in{
+  config = lib.mkMerge [{
+    syscfg.server.loadedContainers = lib.mapAttrs (name: containerCfg:
+      (import (./apps + "/${name}.nix")) { inherit config pkgs lib containerCfg builder name; }
+    ) config.syscfg.server.containers;
+  } (lib.mkIf ( serverCfg.containers != {} ) (
+    let
+      appsList = builtins.attrValues config.syscfg.server.loadedContainers;
+      mergedContainers = lib.concatMapAttrs (appName: app:
+        lib.mapAttrs' (cName: cCfg: lib.nameValuePair "${appName}-${cName}" cCfg) app.containers
+      ) config.syscfg.server.loadedContainers;
+      allPathConfigs  = lib.concatMap (app: app.paths) appsList;
+      allSetupConfigs = lib.concatMap (app: if app.setup?script then [({name = app.name; envFile="";} // app.setup)] else []) appsList;
+      allCronsConfigs = lib.concatMap (app: app.cron) appsList;
+      allVMConfigs = builtins.filter (app: app.vm != null) appsList;
+    in{
+      virtualisation.oci-containers = {
+        backend = "podman";
+        containers = mergedContainers;
+      };
+      system.activationScripts.container-setup-dirs = {
+        deps = [ "users" "groups" ];
+        text = lib.concatStringsSep "\n" (map (cfg:
+        let
+          effectiveCfg = {
+            owner = "root:root";
+            mode = "0400";
+            dirs = [];
+          } // cfg;
+        in ''
+          ${pkgs.coreutils}/bin/mkdir -p "${effectiveCfg.path}"
+          ${lib.concatMapStringsSep "\n" (dir: "${pkgs.coreutils}/bin/mkdir -p ${effectiveCfg.path}/${lib.escapeShellArg dir}") effectiveCfg.dirs}
+          ${pkgs.coreutils}/bin/chown ${effectiveCfg.owner} "${effectiveCfg.path}"
+          ${pkgs.coreutils}/bin/chmod ${effectiveCfg.mode} "${effectiveCfg.path}"
+
+        '') allPathConfigs);
+      };
+
+      systemd.services = {
+        podman-gc = {
+          description = "Podman garbage collection";
+          serviceConfig.Type = "oneshot";
+          script = ''
+            ${pkgs.podman}/bin/podman container prune -f
+            ${pkgs.podman}/bin/podman image prune -f
+          '';
+          startAt = "weekly";
+        };
+      } 
+      // lib.listToAttrs (lib.concatMap (e: [{
+        name = "${e.name}-vm";
+        value = {
+          description = "Isolated NixOS Guest VM for ${e.name}";
+          after = [ "network-online.target" ];
+          wants = [ "network-online.target" ];
+          wantedBy = [ "multi-user.target" ];
+          environment = {
+            QEMU_VM_REG_SND = "0";
+            NIX_DISK_IMAGE = "/media/data/kvm/${e.name}-guest.qcw2";
+          };
+          serviceConfig = {
+            Type = "simple";
+            Restart = "always";
+            RestartSec = "10s";
+            ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /media/data/kvm";
+            ExecStart = ''
+              ${builder.mkVm { name = e.name; vm = e.vm; }}/bin/run-${e.name}-vm -nographic
+            '';
+          };
+        };
+      }]) allVMConfigs)      
+       // lib.listToAttrs (lib.concatMap (e: [{
+        name = "${e.name}-setup";
+        value = {
+          description = "Run ${e.name} setup";
+          after = [ "podman-${e.name}-${e.trigger}.service" ];
+          wants = [ "podman-${e.name}-${e.trigger}.service" ];
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            TimeoutStartSec = "360s";
+            EnvironmentFile = e.envFile;
+            ExecStart = e.script;
+            RemainAfterExit = true;
+            User = "root";
+          };
+        };
+      }]) allSetupConfigs );
+
+      services.cron = {
+        enable = true;
+        systemCronJobs = allCronsConfigs;
+      };
+
+  }))];
+
+}

modules/server/database/default.nix

@@ -0,0 +1,95 @@
+
+{ config, lib, pkgs, ... }:
+let
+
+  listNames = config.syscfg.server.db;
+  containerNames = builtins.attrNames (lib.filterAttrs (appName: app: app.db) config.syscfg.server.loadedContainers);
+  allApps = lib.unique (listNames ++ containerNames);
+in {
+  config = lib.mkIf ( builtins.length allApps > 0) {
+    services.postgresql = {
+      enable = true;
+      enableTCPIP = true;
+      extensions = ps: with ps; [ vectorchord pgvector ];
+      settings = {
+        listen_addresses = lib.mkForce "*"; 
+        shared_preload_libraries = "vchord";
+      };
+      authentication = pkgs.lib.mkOverride 10 ''
+         # TYPE  DATABASE        USER            ADDRESS                 METHOD
+         local   all             all                                     trust
+         host    all             all             127.0.0.1/32            trust
+         host    all             all             ::1/128                 trust
+         host    all             all             10.0.0.0/8              scram-sha-256
+         host    all             all             169.254.0.0/16          scram-sha-256
+      '';
+      ensureDatabases = map (name: "${name}_db") allApps;
+      ensureUsers = map (name: { name = "${name}_user"; }) allApps;
+    };
+    services.postgresqlBackup = {
+      enable = true;
+      location = "/var/lib/postgresql/backups";
+      startAt = "*-*-* 04:00:00"; # Runs every day at 4 AM
+      backupAll = true; # Backs up all databases and roles
+    };
+
+    services.redis.servers."main" = {
+      enable = true;
+      port = 6379;
+      bind = "*";
+      settings.protected-mode = "no";
+    };
+    
+    systemd.services.influxdb3 = {
+      description = "InfluxDB 3 Time Series Database Engine";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        INFLUXDB3_NODE_IDENTIFIER_PREFIX = "node0";
+        INFLUXDB3_OBJECT_STORE = "file";
+        INFLUXDB3_DATA_DIR = "${config.syscfg.server.dataPath}/influxdb";
+        INFLUXDB3_DB_DIR = "${config.syscfg.server.dataPath}/influxdb";
+        INFLUXDB3_ENABLE_INTERNAL_DB = "true";
+        INFLUXDB3_INITIAL_ADMIN_TOKEN = "b27686e85a883437666f61586e084f7deb763958497739479ca48bc913ee90afd1a920332156133c89fb8674cb197ced17706074e6a42fc7ce6b2d54ac6119c9";
+      };
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${pkgs.influxdb3}/bin/influxdb3 serve";
+        Restart = "on-failure";
+        StateDirectory = "influxdb3";
+        PrivateTmp = true;
+        NoNewPrivileges = true;
+      };
+    };
+
+
+    systemd.services.postgresql-init = {
+      description = "Custom Postgres Setup (Ownership & Passwords)";
+      after = [ "postgresql.service" ];
+      wantedBy = [ "multi-user.target" ];
+      
+      serviceConfig = {
+        Type = "oneshot";
+        User = "postgres";
+        RemainAfterExit = true;
+      };
+
+      script = ''
+        ${pkgs.coreutils}/bin/sleep 20
+        PSQL="${pkgs.postgresql}/bin/psql"
+        ${lib.concatMapStringsSep "\n" (name: ''
+          $PSQL -tAc "ALTER DATABASE ${name}_db OWNER TO ${name}_user;"
+          
+          if [ -f "${config.sops.secrets."${lib.toUpper name}".path}" ]; then
+            PASS=$(grep "^DB_PASSWORD=" "${config.sops.secrets."${lib.toUpper name}".path}" | cut -d'=' -f2-)
+            if $PSQL -tAc "ALTER USER ${name}_user WITH PASSWORD '$PASS';" ; then
+                echo "✅ Successfully set password for ${name}_user"
+            else
+                echo "❌ FAILED to set password for ${name}_user"
+            fi
+          fi
+        '') allApps}
+      '';
+    };
+  };
+}

modules/server/default.nix

@@ -1,15 +1,3 @@
-{ config, pkgs, lib, ... }:
-let
-in {
-  imports = [ ./sops ];
-  environment.systemPackages = with pkgs; [ arion ];
-  virtualisation.arion = {
-    backend = "podman-socket";
-    projects = {
-      cloud.settings = import ./docker/cloud.nix { inherit config pkgs lib; };
-      authentik.settings =
-        import ./docker/authentik.nix { inherit config pkgs lib; };
-    };
-  };
-
+{ config, pkgs, lib, ... }:{
+  imports = [ ./containers ./database ./nftables ./openssh ./sops ];
 }

modules/server/docker/authentik.nix

@@ -1,104 +0,0 @@
-{ config, pkgs, lib, ... }:
-let serverCfg = config.syscfg.server;
-in {
-  project.name = "authentik";
-
-  networks = {
-    internal = {
-      name = lib.mkForce "internal";
-      internal = true;
-    };
-    external = {
-      name = lib.mkForce "external";
-      internal = false;
-    };
-  };
-
-  services = {
-
-    auth_postgresql.service = {
-      image = "postgres:14-alpine";
-      container_name = "auth_postgresql";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [ ];
-      environment = {
-        POSTGRES_PASSWORD = "/run/secrets/AUTHENTIK_POSTGRESQL__PASSWORD";
-        POSTGRES_USER = "authentik";
-        POSTGRES_DB = "authentik";
-      };
-    };
-
-    auth_redis.service = {
-      image = "redis:alpine";
-      container_name = "auth_redis";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [ ];
-      environment = { };
-      labels = { "traefik.enable" = "false"; };
-    };
-
-    auth_server.service = {
-      image = "ghcr.io/goauthentik/server:latest";
-      container_name = "auth_server";
-      restart = "unless-stopped";
-      networks = [ "internal" "external" ];
-      volumes = [
-        "${serverCfg.dataPath}/authentik/media:/media"
-        "${serverCfg.dataPath}/authentik/templates:/templates"
-      ];
-      environment = {
-        "AUTHENTIK_REDIS__HOST" = "auth_redis";
-        "AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql";
-        "AUTHENTIK_POSTGRESQL__USER" = "authentik";
-        "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
-        "AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD";
-        "AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY";
-        "AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}";
-        "AUTHENTIK_EMAIL__PORT" = "587";
-        "AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}";
-        "AUTHENTIK_EMAIL__PASSWORD" = "AUTHENTIK_EMAIL_PASSWORD";
-        "AUTHENTIK_EMAIL__USE_TLS" = "true";
-        "AUTHENTIK_EMAIL__USE_SSL" = "false";
-        "AUTHENTIK_EMAIL__TIMEOUT" = "10";
-        "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}";
-      };
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.sso.entrypoints" = "web-secure";
-        "traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.sso.tls" = "true";
-        "traefik.http.services.sso.loadbalancer.server.port" = "9000";
-        "traefik.docker.network" = "external";
-      };
-      command = "server";
-      ports = [
-        "9999:9000" # host:container
-      ];
-    };
-
-    auth_worker.service = {
-      image = "ghcr.io/goauthentik/server:latest";
-      container_name = "auth_worker";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [
-        "${serverCfg.dataPath}/authentik/media:/media"
-        "${serverCfg.dataPath}/authentik/templates:/templates"
-        "/var/run/docker.sock:/var/run/docker.sock"
-      ];
-      environment = {
-        "AUTHENTIK_REDIS__HOST" = "auth_redis";
-        "AUTHENTIK_POSTGRESQL__HOST" = "auth_postgresql";
-        "AUTHENTIK_POSTGRESQL__USER" = "authentik";
-        "AUTHENTIK_POSTGRESQL__NAME" = "authentik";
-        "AUTHENTIK_POSTGRESQL__PASSWORD" = "AUTHENTIK_DB_PASSWORD";
-        "AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY";
-      };
-      labels = { "traefik.enable" = "false"; };
-      command = "worker";
-      user = "root";
-    };
-  };
-}

modules/server/docker/cloud.nix

@@ -1,152 +0,0 @@
-{ config, pkgs, lib, ... }:
-let serverCfg = config.syscfg.server;
-in {
-  project.name = "cloud";
-
-  networks = {
-    internal = {
-      name = lib.mkForce "internal";
-      internal = true;
-    };
-    external = {
-      name = lib.mkForce "external";
-      internal = false;
-    };
-  };
-
-  services = {
-
-    cloud_nextcloud.service = {
-      image = "nextcloud:27";
-      container_name = "cloud";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [
-        "${serverCfg.configPath}/data/nextcloud:/var/www/html"
-        "${serverCfg.dataPath}/data/music:/media/music"
-        "${serverCfg.dataPath}/data/video:/media/video"
-        "${serverCfg.dataPath}/data/photo:/media/photo"
-      ];
-      tmpfs = [ "/tmp" ];
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.nextcloud.entrypoints" = "web-secure";
-        "traefik.http.routers.nextcloud.rule" =
-          "Host(`cloud.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.nextcloud.tls" = "true";
-        "traefik.http.routers.nextcloud.middlewares" =
-          "sts_headers,nextcloud-caldav";
-
-        "traefik.http.middlewares.nextcloud-caldav.redirectregex.permanent" =
-          "true";
-        "traefik.http.middlewares.nextcloud-caldav.redirectregex.regex" =
-          "^https://(.*)/.well-known/(card|cal)dav";
-        "traefik.http.middlewares.nextcloud-caldav.redirectregex.replacement" =
-          "https://$\${1}/remote.php/dav/";
-        "traefik.http.middlewares.sts_headers.headers.stsSeconds" = "15552000";
-        "traefik.http.middlewares.sts_headers.headers.stsIncludeSubdomains" =
-          "true";
-      };
-    };
-
-    cloud_office.service = {
-      image = "collabora/code:latest";
-      container_name = "cloud_office";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [ ];
-      environment = {
-        username = "COLLABORA_USER";
-        password = "COLLABORA_PASSWORD";
-        aliasgroup1 = "https://cloud.${serverCfg.hostDomain}";
-        server_name = "office.${serverCfg.hostDomain}";
-        VIRTUAL_HOST = "office.${serverCfg.hostDomain}";
-        VIRTUAL_PORT = "9980";
-        VIRTUAL_PROTO = "http";
-        DONT_GEN_SSL_CERT = "true";
-        RESOLVE_TO_PROXY_IP = "true";
-        NETWORK_ACCESS = "internal";
-        extra_params = "--o:ssl.enable=false --o:ssl.termination=true";
-        dictionaries = "en fr de jp";
-      };
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.collabora.entrypoints" = "web-secure";
-        "traefik.http.routers.collabora.rule" =
-          "Host(`office.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.collabora.tls" = "true";
-      };
-    };
-
-    cloud_etherpad.service = {
-      image = "etherpad/etherpad:latest";
-      container_name = "etherpad";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [
-        "${serverCfg.dataPath}/ether/etherpad/data:/opt/etherpad-lite/var"
-        "${serverCfg.dataPath}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
-      ];
-      environment = {
-        NODE_ENV = "production";
-        TITLE = "Helcel-Pad";
-        DB_TYPE = "mysql";
-        DB_HOST = serverCfg.dbHost;
-        DB_PORT = serverCfg.dbPort;
-        DB_NAME = "etherpad";
-        DB_USER = "ETHERPAD_DB_USER";
-        DB_PASS = "ETHERPAD_DB_PASSWORD";
-        DB_CHARSET = "utf8mb4";
-        DEFAULT_PAD_TEXT = "P A D";
-        PAD_OPTIONS_SHOW_LINE_NUMBERS = "true";
-        PAD_OPTIONS_USE_MONOSPACE_FONT = "true";
-        ADMIN_PASSWORD = "ETHERPAD_ADMIN_PASSWORD";
-        SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
-      };
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.etherpad.entrypoints" = "web-secure";
-        "traefik.http.routers.etherpad.rule" =
-          "Host(`pad.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.etherpad.tls" = "true";
-      };
-    };
-
-    cloud_ethercalc.service = {
-      image = "audreyt/ethercalc:latest";
-      container_name = "ethercalc";
-      restart = "unless-stopped";
-      networks = [ "external" "internal" ];
-      volumes = [
-        "${serverCfg.dataPath}/ether/etherpad/data:/opt/etherpad-lite/var"
-        "${serverCfg.dataPath}/ether/etherpad/APIKEY.txt:/opt/etherpad-lite/APIKEY.txt"
-      ];
-      environment = {
-        NODE_ENV = "production";
-        TITLE = "Helcel-Calc";
-        REDIS_PORT_6379_TCP_ADDR = "ethercalc-redis";
-        REDIS_PORT_6379_TCP_PORT = "6379";
-        ADMIN_PASSWORD = "ETHERPAD_ADMIN_PASSWORD";
-        SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
-      };
-      labels = {
-        "traefik.enable" = "true";
-        "traefik.http.routers.ethercalc.entrypoints" = "web-secure";
-        "traefik.http.routers.ethercalc.rule" =
-          "Host(`calc.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.ethercalc.tls" = "true";
-      };
-    };
-
-    cloud_redis.service = {
-      image = "redis:latest";
-      container_name = "ethercalc-redis";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [ "${serverCfg.dataPath}/ether/ethercalc/redis:/data" ];
-      environment = { };
-      labels = { "traefik.enable" = "false"; };
-    };
-
-  };
-}

modules/server/docker/sample.nix

@@ -1,30 +0,0 @@
-{ config, pkgs, lib, ... }:
-let serverCfg = config.syscfg.server;
-in {
-  project.name = "name";
-
-  networks = {
-    internal = {
-      name = lib.mkForce "internal";
-      internal = true;
-    };
-    external = {
-      name = lib.mkForce "external";
-      internal = false;
-    };
-  };
-
-  services = {
-
-    NAME.service = {
-      image = "NAME:latest";
-      container_name = "NAME";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
-      volumes = [ ];
-      environment = { };
-      labels = { "traefik.enable" = "false"; };
-    };
-
-  };
-}

modules/server/docker/traefik.nix

@@ -1,81 +0,0 @@
-{ config, pkgs, ... }: {
-  project.name = "traefik";
-
-  networks = {
-    internal = {
-      name = lib.mkForce "internal";
-      internal = true;
-    };
-    external = {
-      name = lib.mkForce "external";
-      internal = false;
-    };
-  };
-
-  services = {
-
-    traefik.service = {
-      image = "traefik:latest";
-      container_name = "traefik";
-      restart = "unless-stopped";
-      networks = [ "internal" "external" ];
-      command = [
-        "--api"
-        "--providers.docker=true"
-        "--entrypoints.web.address=:80"
-        "--entrypoints.web-secure.address=:443"
-      ];
-      port = [ "443" "80" ];
-      volumes = [
-        "/var/run/docker.sock:/var/run/docker.sock:ro"
-        "${serverCfg.configPath}/traefik/traefik.yaml:/etc/traefik/traefik.yaml"
-        "${serverCfg.configPath}/traefik/access.log:/etc/traefik/access.log"
-        "${serverCfg.configPath}/traefik/acme.json:/acme.json"
-      ];
-      environment = {
-        "INFOMANIAK_ACCESS_TOKEN" = config.sops.secrets.INFOMANIAK_API_KEY.path;
-      };
-      labels = { "traefik.enable" = "false"; };
-    };
-
-    matomo.service = {
-      image = "matomo:latest";
-      container_name = "matomo";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [
-        "/etc/localtime:/etc/localtime:ro"
-        "${serverCfg.configPath}/matomo:/var/www/html/config:rw"
-        "${serverCfg.configPath}/traefik/access.log:/var/log/taccess.log:ro"
-      ];
-      environment = { };
-      labels = {
-        "traefik.http.routers.matomo.rule" =
-          "Host(`matomo.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.matomo.entrypoints" = "web-secure";
-        "traefik.http.routers.matomo.tls" = "true";
-      };
-    };
-
-    searx.service = {
-      image = "searxng/searxng:latest";
-      container_name = "searx";
-      restart = "unless-stopped";
-      networks = [ "external" ];
-      volumes = [ "/etc/localtime:/etc/localtime:ro" ];
-      environment = {
-        "BASE_URL" = "https://searx.${serverCfg.hostDomain}";
-        "AUTOCOMPLETE" = "true";
-        "INSTANCE_NAME" = "searx${serverCfg.shortName}";
-      };
-      labels = {
-        "traefik.http.routers.matomo.rule" =
-          "Host(`searx.${serverCfg.hostDomain}`)";
-        "traefik.http.routers.matomo.entrypoints" = "web-secure";
-        "traefik.http.routers.matomo.tls" = "true";
-      };
-    };
-
-  };
-}
-

modules/server/nftables/default.nix

@@ -0,0 +1,41 @@
+{ config, lib, ... }:
+let
+ cfg = config.syscfg.server;
+in {
+  config = lib.mkIf (cfg.ipfw.enable) {
+    boot.kernel.sysctl = {
+      "net.ipv4.ip_forward" = 1;
+      "net.ipv6.conf.all.forwarding" = 1;
+    };
+
+    networking.nftables.enable = true;
+    networking.nftables.ruleset = ''
+      table inet nat {
+        chain prerouting {
+          type nat hook prerouting priority dstnat; policy accept;
+          
+          ${lib.concatMapStringsSep "\n" (rule:
+            let
+              srcInt = builtins.elemAt rule 0;
+              dstAddr4 = builtins.elemAt rule 1;
+              dstAddr6 = builtins.elemAt rule 2;
+              srcPort = toString (builtins.elemAt rule 3);
+              dstPort = toString (builtins.elemAt rule 4);
+            in ''
+                iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
+                iifname "${srcInt}" udp dport ${srcPort} counter dnat ip to ${dstAddr4}:${dstPort}
+
+                iifname "${srcInt}" tcp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
+                iifname "${srcInt}" udp dport ${srcPort} counter dnat ip6 to [${dstAddr6}]:${dstPort}
+            ''
+          ) cfg.ipfw.ports}
+        }
+        
+        chain postrouting {
+          type nat hook postrouting priority srcnat; policy accept;
+          oifname { ${lib.concatMapStringsSep ", " (iface: ''"${iface}"'') cfg.ipfw.ifs} } masquerade
+        }
+      }
+    '';
+  };
+}

modules/server/openssh/default.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }: 
+let
+  allUsers = lib.concatMap (peer: if peer.syscfg ? users then peer.syscfg.users else []) config.syscfg.peers;
+  groupedUsers = lib.groupBy (u: u.username) allUsers;
+  allowedUsernames = map (u: u.username) config.syscfg.users;
+  activeUsers = lib.filterAttrs (name: _: lib.elem name allowedUsernames) groupedUsers;
+in {
+  config = lib.mkIf (config.syscfg.server.openssh) {
+    services.openssh = {
+        enable = true;
+        ports = [ 422 ];
+        settings = {
+        #Banner = "";
+        PasswordAuthentication = false;
+        PermitRootLogin = "no";
+        ClientAliveInterval = 60;
+        ClientAliveCountMax = 3;
+        TCPKeepAlive = true;
+        };
+    };
+    users.users = lib.mapAttrs (name: userList: {
+        openssh.authorizedKeys.keys = lib.unique (
+        lib.concatMap (u: if u ? pubssh then [ u.pubssh ] else []) userList
+        );
+    }) activeUsers;
+    };
+}

modules/server/sops/default.nix

@@ -1,10 +1,16 @@
-{ config, pkgs, ... }: {
-  sops.secrets.INFOMANIAK_API_KEY = { sopsFile = ./server.yaml; };
-  sops.secrets."${config.syscfg.hostname}_ssh_pub" = {
-    mode = "0400";
-    owner = config.users.users.${config.syscfg.defaultUser}.name;
-    group = config.users.users.${config.syscfg.defaultUser}.group;
-  };
-  sops.secrets."${config.syscfg.hostname}_wg_priv" = { };
-  sops.secrets."${config.syscfg.hostname}_wg_pub" = { };
+{ config, lib, pkgs, ... }:
+let
+  listNames = config.syscfg.server.db;
+  containerNames = builtins.attrNames (lib.filterAttrs (appName: app: app.sops) config.syscfg.server.loadedContainers);
+  allApps = lib.unique (listNames ++ containerNames);
+in{
+    sops.secrets = {
+      CUSTOM = { 
+        mode = "0444";
+        sopsFile = ./server.yaml; 
+      };
+    } // (lib.genAttrs (map (name: lib.toUpper name) allApps) (name: {
+      mode = "0444";
+      sopsFile = ./server.yaml;
+    }));
 }

modules/server/sops/example.server.yaml

@@ -0,0 +1,48 @@
+CUSTOM: |
+  DEFAULT_ADMIN_USERNAME=...
+  DEFAULT_ADMIN_PASSWORD=...
+  DEFAULT_ADMIN_EMAIL=...
+  DEFAULT_LDAP_PASSWORD=...
+TRAEFIK: |
+  INFOMANIAK_ACCESS_TOKEN=...
+AUTHENTIK: |
+  DB_PASSWORD=...
+  POSTGRES_PASSWORD=...
+  AUTHENTIK_SECRET_KEY=...
+  AUTHENTIK_EMAIL__PASSWORD=...
+  AUTHENTIK_TOKEN=...
+NEXTCLOUD: |
+  DB_PASSWORD=...
+  POSTGRES_PASSWORD=...
+COLLABORA: |
+  password=...
+ETHERPAD: |
+  DB_PASSWORD=...
+  DB_PASS=...
+  ADMIN_PASSWORD=...
+  APIKEY=...
+ETHERCALC: |
+  ETHERCALC_KEY=...
+GITEA: |
+  DB_PASSWORD=...
+  GITEA__database__PASSWD=...
+  GITEA__security__SECRET_KEY=...
+  GITEA__security__INTERNAL_TOKEN=...
+SEARXNG: |
+  SEARXNG_SECRET=...
+UMAMI: |
+  DB_PASSWORD=...
+  DATABASE_URL=postgresql://username:mypassword@localhost:5432/mydb
+  APP_SECRET=...
+IMMICH: |
+  DB_URL = "postgresql://immich_user:...@localhost:5432/immich_db";
+SERVARR: |
+  SONARR__AUTH__APIKEY=...
+  RADARR__AUTH__APIKEY=...
+FRESHRSS: |
+    DB_PASSWORD=...
+SUWAYOMI: |
+    DATABASE_PASSWORD=...
+    DB_PASSWORD=...
+CALIBRE: |
+    DB_PASSWORD=...

modules/server/sops/server.yaml

@@ -1,68 +1,62 @@
-INFOMANIAK_API_KEY: ENC[AES256_GCM,data:QhjQoCMxogXAPtvUbf/EWkqsFAndn73LBuTqj5essjruekynH287D/CYN/cwfcnDqZoh6Z4A9p08uUmXzqmTiralAhsCoc+Ljb/monmsruc=,iv:8rMGNc9398jnFXZm34fOht6fMNDAcDZ68B1jwoQPn2Q=,tag:ZlQnPaxkCktpwiC6HzmFVg==,type:str]
+CUSTOM: ENC[AES256_GCM,data:7QblAIVKUop4NOE4DvuTJUFigXoc0VJ20ADbSjunP1JZfCvrWSZU0gJRr1jmJ2uZrtyWOZUlISmn0HzzGpeJ+FPmj2tCSiqd8aG+j62Dz3JObVJikFde6f95vcn7cnX9AL4IUil+bB6vCPojEskmHVTmcqy9APN7fOlkpvWkBPgN1FnN2PBxIFGNspRHasWZBfXdkpKU2fOLDv6oeNq3U/6o+mqdZru6pHqVsCLOrq8svdoLnWV7KSZ6PFK9HaxI4BfasXZvZaoMSlAKaREeQx52M3xab6vCCh7lTUN2oQD0B47bQhWrC/QpK2e3EdUBfzJWL94tUcTFbLpN+5qwdl6rfM17laFP6ZAjOnYrnK5PXPnOI7WARFw2bs4rBJka+GgCTy8jYgOSGae1Gl1ti9cLkuSy2kiUf2N5uIr5x796TyLA6RH5eGapSR9h+7uTMtozM4TJ3NNwYkvMJR5Uh/5sDNnZ6kcWhqpfvFC9ZFYB7v6wdbYY2As9jLMBPmUe38ivTrqsQSQAdKCgQotGXFEG228VideGn6DeBQCv2T2OVFQHxjYFiTq11S0eOlO87PVGDlOpd6RaKyZJ9mjORTisSNGlFK+GhQtQ0KFMxdZiolEY3Q4UqBR4J5Dx40xSK/1Jo1dZV+P8gRKtdKkVGb2wzjYtfKPlDB1mH3YTl+tU/xomeBnvHm4+XyD7kivCbnLs+009sFocRGPDr7M9MRHwLVBV5UCnewJEJDTvVbPddDSQK/P8gHLYN3pzc6H24dIjWe2w2LSjEEoPh0gCHBBICt746c0N2iJvL190qB9AY7iLMXpitrmYcLVrqfQN3/pzafxNMLaOTIwVc2yeOXwlLBzd1Ze8Inp/e/kirgWQJtjjj3OiqBWnuCLG9d3vCHz7HJidhvX3rSrdqElir6LrjwxJA3g6beNLtnMlM1a4aQS/ouStN1M3u+fMW+iSc3JDsKFH+1qesgPm409+wQPDeRMzsAfKot9tGOH8Y2PV9sBXe2k7H/x3IDIHoY+ArECMIQu/VSU4zmyAZFSYQwvLdvzVjC6vmGrS2gsDpXT0bWW9R5bJuPQTd9wCQhIFJ8oTtmlgJcJ9Xt0bmckhMzsyi5jWZcMgRsaBLmaGCDZ1yQNK/EwFMJwCEf2tgNqLSPuOLFn3RsmSV0sfjghlzxUJtSDeWhgidjGOHSfkgc8tnBVOxfR7mqNoZiMEhymlGUr2sHQR4CDS/YNccwBQR/bktp0eRxvsyfKuFIEPzpRnYtBV9ZUPa/BPKJ9MTuVoJu6bKWR6J9fU0Gltrti+uGUt9/LM6rVGsGYiazIHRfTW1oq3NuipMbmqPneegIk=,iv:bwKIbhcmV0Z5jwrkhI71BDq+og7ZqFVVc3eR2UNa7iE=,tag:l0oi/zALYAOy/43cbA4uZg==,type:str]
+TRAEFIK: ENC[AES256_GCM,data:Ei+/OL7xwNaOEg3rSaz95N78nvp51lC63XCplNzeD+bBMGcK9G7HoyQxfpaJ7S0MkuMW0ZXT2nJ4GES40GoJCZIrnEiSBm2tpjDfNjlS/rFwxx0wVfM1nsEuBf3pL5dqiCNa9+Lad2Cd,iv:d1MH0ive+E8xuUK0CIOXZeEigHJKVGlFaq0iH4KSbZA=,tag:VTARuNeotr2I0+fdOk+iqA==,type:str]
+AUTHENTIK: ENC[AES256_GCM,data:HlUFb7JjzSMTM345miSLlUE4SEXgaRAx7SkDDQzaJzs9VuifJKtOE2M4PCKc35VjVt9xIFH+YoIE93re10Rwbe+QEaUphPOgb/G7jRhaaPV/roBYuv6uO5xy68jaVJZpobxajOSVUmJa1JANCh1qrX0+Imr6udYULvK6wQzAnu2tEDkElQ3eZtezUa4E5ia1j7RCYTTPW9oie+YEVJl5Aws2HzPK5q0wKojZOmHanbnKzij3KnSgtsMc3ftL1Fam3wlSk2n3Tw0nz8aBag9IPwYje5zdBkDJY6qiBwYKcBPQUIW+Na0xX2JHymwJSzMdKmW8cEV9b1fXCPsnYVXulb4VMVkTk4MibZ3YT57wlFhqhSy7D39ZTySllIZg8sOrj8cKhpJ3HlSbceD1GnPJatVzZkDkDeyICLu9sYX3B+KrCDlL5sUMPagUFc3g3HUAPxLVPltoP69ro69acUoz5w8gkAwHlE45I3biC/jLz4telEcW8GkF868j3gsHiayE3f87T5MOPvuvhAFdSMl3SF1ND3mWjJq7+FmA6BhxgESg4m+vPnYyVumcbXJnbgfW69BgPYcL1CWZcA+SP6OWg9GOYT5SuWixkaGn2TgRAUj3nlCcAja8,iv:uXAyOIBl9lGYBvALMdvp2hf6cj6QGWRcyUvEsjIDr1I=,tag:iLxO/qYT2zafXhFGVVUYkA==,type:str]
+NEXTCLOUD: ENC[AES256_GCM,data:IWitzubILQ5SrGdO3UQZboisqAECt5lXOqHVg4yAKxedG7ZLOgVp6jPV+4VVDC13KEkxIsiYjjNvjqnOXCdYWQIC13YZ+o2IBDI9PgavBB3nmjfi0Q7BVki6C8qCtbM5H9uFlQ3h7rkPyEbE3pHa3dY5uwgdtmvw3qKf2UAZGIJCU7dKamjuTCucGitOEG434jFQik9duHZs7EV3AZrkLXqOfdvftvdpciDb/4/K7h/4uEYSXJ94Lf0b16/NRUcR,iv:1UvcbqC3hJEHU9t6Z+N226DTJEcgM315ynYkxPKpYSM=,tag:FGkXlUw+7LRu1/cpMys7OA==,type:str]
+COLLABORA: ENC[AES256_GCM,data:cLGEziks5dyxTF1jugfpQE0l0nSkDP7MpROzCxCM94jv49sguA+d/SnY1olE8ZP9iCBnlvbMZyNR7uYo88B92Pmv8wVWfeuhHiHFIXh5aaOxntpt80UMg3Jy,iv:gmFG7C893QPuZ4rEqllAlUpNIXMcGsf9+/QCPLhWLTM=,tag:WpKHCUk6zhQRfFX2d6OPbQ==,type:str]
+ETHERPAD: ENC[AES256_GCM,data:PSr06GyOgY0HDNC4Hr2XUjbNUszGlfBjxDbrrKNQOqSMSVfZj4iFIGamrS72WO0un4U7IENx0T6CTBN/ELoq7J/+W9zf879uzKWuNaAulLVtBqrUbbqA7hTJpidnveZXzdwZRvlz/bU8kWAmXyhiDb2Q42Sz3BDb6duM3PO1AgG8Ko1pi2IemCPjO3uzudeT8FAlO8NnCUxKgwIKSz8CodOXFVGk66NX4xJd4ycfdNYXvKBNlzt1+WuWsZeZzeWmF7WD2dt4wWA9fWxB90fnth6ZV5LdeXjyYnzwkFOWoyNazgqV4jBv+aXKVwX4fYvspu13cVdrak3gc698bS2N1guDss4A/sfXMbtaYPGm98xXkqz1LP7sXQzKUdZf9sAS9gtOVv2tmg==,iv:uQ0Roe+XefzMjZCF3It+U2D1MWPMT5f6CPwlz0gQ5W0=,tag:wSgp0CVr6Y6M3eqcoTy8cw==,type:str]
+ETHERCALC: ENC[AES256_GCM,data:0ScnDsUNBt6wYJC4hTXn8huuTptBTDKZV4yFVQ4fuBWc6auWNWhDQlTc0ImJoK6efr2uyp3sVu3o+KlCNvUGhDOJ1you6socyTgRP0q7oLPC+Ln+bFP8gWG8v2nyEFY=,iv:YqvVjBFG/WZg1l4aMAiioOruWZ9zcTMr74DVW+1+2DQ=,tag:ePBXd4ddipJtxhFE1amfMg==,type:str]
+GITEA: ENC[AES256_GCM,data:TGsye52g8DVOk51o1dWfF6x3m6BFPe0MtUbOayxYejaYSZ4cDCfx02EPAhiL3FJGLfidZt7+WpjhVqJvFeCvJ1OXdYMQyuL3akPBCmEjmBgBhJvEjVtVgV3aNMS21gy3o0RG/MXDXOLpjHeaXn3G/XWKsv5bw+gg94bDirOguLC5eaFxddn5/UGFvfwXzDmkoNmc9zufGvVpUkRy8rju/TjOz4Q5GZk1gXWtJWdkTGhuVYVBDDHIQq9DBS0qXi8tP3FvY8prOi/c5ZbyyZjTOgNpWB9uU4HkHz4aUTMFIrPFwUeWmNMIdyUmarSQ7tDDdhBfIiLhb94jaMATHq+PfwwpCcmiTfBEG3OS/3SXPMWg6jhfUxvxsKNT2HQca31B9IRqlitaio3r6KEPBTYh2nWtFO9d5Is7TUWkGsOaV+0JSiNPNh5uD7kNyBxsKUKcND7JXMxW/TZOqARY64x6IwDrbcypsyMW5i+4Er1/0HCvZ7FBH1XkTul8vBGF5ZGD/tYp/m6Ld26GKYkj967eYIwlNFcOMGNue5PyJfFCq0qWbLWO9dFA9c2e9r81DCD8y/0S3Ts7X7TkXVGShm7JoMqb8dzg9i6CoNlmbPAM5GwoNV3ftQugvqEGMk5UIvf05YsgSNvq4UJbhsT4bZqpV0plnxYD5TswCGF/XQ3nwwFTudmf1OLcgYwM2NckbVui128o1Rw=,iv:vo6l0QirLIUvwLN675LYkffkXejJecvBesLJvoW/bjY=,tag:zyLyiCskF84A3QVoq5X3iw==,type:str]
+SEARXNG: ENC[AES256_GCM,data:gtKhEmMemzLRl4c3cYhMAQ+5vUth1IhWQeLvW1YtaG5TbhQHBR4PDREQOlGt+tlfGQrft+FeNhMSN/SKOp8gmScVWa+9qmltzxRGRpLm3m/VuBZvOlGdeUcKAX8zEH6A,iv:B2UEtjTRIjT6W+tH2gtcl6XMvZNgbvZUXTiBePGOu24=,tag:SHIF6eaWBLwy9RrEy1N9kg==,type:str]
+UMAMI: ENC[AES256_GCM,data:onB/uXLajaRLmeQMGNHFsjREzPih9ha+cogGRw+nRomERSRrbBv+6gCqEr8F3Dcm818JB4jGRYKoIYG8Jl6gMDaz5QQiA4qAnbG19LuzVeVUgz4NGEgXBULoT/0sQacnyAPIfPEp+ESWRQH81nO6Qcs+rICpS2Xfeye5hb+8rSAxmLpY991AJ3+avGyMwPcpfNCkixWt68KuG5ZN/IGDksM/sSLGgyMisClbEdhigq4mwibOxpiWjcKk/17xYgY6Xz93h/yloHKZIZZpnyA+85YC6oNWgCPhkGIAVu3dGshp10a0nk1A2INm6vxNPbfUjYLkt3zDAPZtoBRCqUs+43Eh62hYgajgWCQJhjJkDgF4Y1ifGfDerIXs/cDpIKLt2+7VqM6/ouqIDPJ7khSAr+8bcHU4CKDtsDagob5PpCG4ABt44cg9cGw=,iv:HD450JZuWn2+V0pvOsDHy9oVAanFMf1el9LA1z0PULY=,tag:p7Vl7dtM8UdAUNgmdG+7cg==,type:str]
+IMMICH: ENC[AES256_GCM,data:1y78yeawkRjUXLWPyFdMB5HCDQhb1PoxEMfHmKSZfv0CWloOrQWT735dlH+W9yC6ljZjqVD9Fwq/9GqqKQMTFMCpr8wVRwSHEuqmaG3UgKzbLA3aWZ1SIB0AiJi+eUunzHj2vikUJx9dMRjC+iNXrsVWh2HqMrOyFCWetZoIfxNiAgsgNKPgYYsHLv6OAZs9XT7V3veqe0zc0nyw7ghWSXne/yNhQESyyGlMAdagrJRNimvXIp/AoAUKl2WUJm2MBl7lb6K1YeJ1XW8OjAHzV8isBiUwU8ZD81VJog0fgTGjbUa+HO7jEo+9YwmDIMx3f5z9N4A=,iv:pboITW2rr7+w8VNZM6uYMMEFZ1S/JtqjNOVthpYJ2tQ=,tag:0dgrJ191sB4MLJHMoQBlCg==,type:str]
+INVIDIOUS: ENC[AES256_GCM,data:ZfgU5UFMmG9Cx9UaR0xnKr9VPebG3kut0difTFZmoqOSs+stG6YJfV82OOhj1RQLVJlPr/scydYy1+3LytwvP1BT7tLe0jII7XupbkL0w3n79KBaiIzAPdicqLxeqjKH45I0NjHra4djdnO2Ff4T8CTiFDlPn1rMuiw=,iv:UaDmOKJ4bFPGCaIePLXkWot9E6sTu2nhaVs83sI38G0=,tag:spTjxWEmLfPc8BZl2GglBA==,type:str]
+SERVARR: ENC[AES256_GCM,data:757WdthmToCGr2boph7iW1ycs3tQyGgD3lhYOcX/X3hjs9dLLPCWGI2zt5axp72IGJ/sVYEop2rqsRLxdPn3VIyQLvQ+3MYdo8Z/yOuMy7DAlnITQQQUI2ylZKHVmFAt39/xBpwsVjh3m/hBQvn/LbCDtR2s4qa+8fQDfeZXksTtnf7YZbVygTF7jWZ+0oVvkvNO1ZUejvP+uHL+jHwgMEwQnR22hOYWEKZ1s7PI+EZHujqyOhnwXB4jRG+XD7R4N6AhC5Z+nmkFpy3ffszCJ0/H,iv:NrNbkL6GWN4r+uzxNYrhoECD1APbRsRBcMBbVHD3DwM=,tag:YK1O50wV+lHAQa6TX9huUw==,type:str]
+INFLUX: ENC[AES256_GCM,data:woaZ/8zWRFtuO6U3HQ==,iv:iLo33tykE6oQW2jUNVGtR/JwrZbs9Fe1fFQ5/LnvaRY=,tag:6UDOU0JJgR7eyQ0hL8j5Qw==,type:str]
+FRESHRSS: ENC[AES256_GCM,data:xY20OMKI6D8aK8myu7ZquS4bTwZL/mrvTM3pDmDPwH4WIbrE227eqrwnRt5VlrPvs33bv31PCgM0fhP9ULVonEePQwM9+wUNhljcluo8JEAKF70ip0ofV5bIkFuO,iv:HUIl/p/w9llZzuN528SBH47fy0h1HGVKe65shjBLS50=,tag:z/ppfhL3M+elQVxVPtxWFg==,type:str]
+SUWAYOMI: ENC[AES256_GCM,data:uPfj1Cgr0IB8BTK0yy6/M0RexP/3IU1bKafvdi6vdwW1KBDdU64phSOGmOyqoHvtnXkUJKIv4Lm41gvQmJRbxvdM099GDXIQeRxuBgl8oUnfb0i/feEQHLnxLVeXZbOV+6jazk7oa6eHNir3tbawkTbYgVi2B/RktlGzEiajUpPryhbi+D2dgHE+GIb18P9m2+s9IZ4NfMOBm7BkgH1lnfCRhaOT7ZOr02GeEQz4gGZ9+F3ocRA85f7rWmOr/V1c,iv:qPmgtCRUR5JiJ1R9CXeNqDGYQtfNB6w8GCrwP9gI8/M=,tag:O+EMoX+QkgvPfCepBjtdBg==,type:str]
+CALIBRE: ENC[AES256_GCM,data:Uxz/5H4q/ugmW49a6oIQsG450w+SS1H58gOMXDVX/JQ8OCGxWQ8DRNmSGBZLgGsJ9UA1rxYRS4+pDuDL+iQsNVOmZzFRAuWJwUhEiF72B/Ah0IyXpnPIups8S2Nq,iv:rK274zWuvguY/DPHXxG174j+Ne11SB7ZCQLxO6Tvvg4=,tag:7wJyt94jRvRCZxgHWotzVA==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpZk1VY3NEZmRkS0J6dU03
-            OUtETWpHL2hLN09kRytNUEhmVnA5WW9yVXlNCmZaZnQ2YUlMMmlrZ2dEZDVFMHA5
-            OUpqOTJJbHVVREtpSFUyaDJDbXltaTgKLS0tIFY0ZkF3Ym5oeHViN3J4eW4vSVYz
-            QkhuU0NLWElyVXpZd2ZpOHhwam04R28KFuaI35e8pB25M2dlP19gApso12ZYJ3ld
-            BpMnp97ShX0I8bZRIYxSHpSrB/J+tt1V4pfGdJq7uWZM7XacPy666A==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4Rzc3ak4vRVZiNWxNZEN3
+            N21rSjZqUm9XVWF5TUxNTXVybEMzNCtod0NnClNjODB6VWhzU1VHeVdlZ3hEaE5D
+            MW9WWWYvYmt5TmNzMzNudDhLSW12RnMKLS0tIDdjc2ZOK3QxaTFJMFdpTHFzcklr
+            clZnQXpPbWs5aXZJeUlxOWhJNmIrOFkKZfZ19Y4yfCJi1GrxLsv76JyBmuxW/glF
+            BCJCvmdSSOJx5JW26Y3Y3LwiIuL8yboKR+8ZAwU2fG5OQfs+2czFdQ==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1ms8f0ysv6vakxepvt69fejczs6tddexepesdv4rkgtheehj3nu4sc6290s
+        - recipient: age1pf4auk6u2tmefuqpuc6mntr26cp4wcsmlhnn98arzxsp3753ruqsj0jqk3
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuZXNjRzJsdFpTdDZhSkRB
-            eW1qSStnZHN5Tzh3bFA1azZIRk42V1RzSTJJCi9MV0k5ZXNQOWJFYnlXdnB3azBL
-            NzNldkFLWlEyT01MeWlFU3RKODU4dWcKLS0tIFJXL1ZsNDgydTgxVGRMYWxyQTNT
-            K1M0TDd1eGd1V3pOcjl1M1VrdDUvbG8KpsWlrr14MOh/8mG+rXpswPPFE3VnpKGt
-            03DWUII3+MMEWLJPLxkNJ9BzCm4Kl1QNHSbJ7Ex6df0b7nB6Ed6Hvw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1cEpsb2gvbDJ0aG5BRWNS
+            WXgydFo3ZkF3SmVIU1EvaHVjb3RvK3BxVDJrCis2ME9zUEVGQURFdmJXS2lTSklk
+            V3ZONHpTZVJqMUxOVkd5ZDlqVTRNdzgKLS0tIGwwR0k1Vll6bEdmZVZvVktzMTRN
+            S1NaTVFTL0FCdm1EQmRsUnlhclZNZlEKEgIe60qkvY8+UocjQU+WM2dTL/1y3Kqk
+            d4RrlLP9NSozwVsPYI4ntygvMSApbT4v0YvoO7gV90lkGWEvW1YDfA==
             -----END AGE ENCRYPTED FILE-----
-        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5U1VjTjlIMTdLRFQ5R1Av
-            SVBLMFZtV3ppK2VXWjdYelNGTGFOZUJaMndBCjYyZ0IveXFiVDlSUEtNOXk2L3g3
-            UmFIRE1GMEs2QVhUcFJkTHpCWmhhbG8KLS0tIG94NStMUnFZRTRsK2w4cDd4Rms5
-            M1MwTEtJNEFDdjRLVFRseThxNGJUQ0kKKN7QX9qUojNQBknbInaXslaKsAAhEj5y
-            QMXAU6TxlHMv+wZy2RQwMe/zE7RP24TypnX894iV0usTHujyxvfk3w==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrUHFYMWdVczRPdEFSbFR5
-            VmcxeEU4YWxwRTlDUkRkNVY0dFh5cjVUNjNnCkRSblNaS214dkdrd3JnNE5rZnR3
-            S0JVeXova1h2VnB2ODY0SUYxZm45TjAKLS0tIFN1QXFyTkt3SmV0UVhGMlMxTmpN
-            VW83cnd2TnQwWlVCUnpzZ29NRE1SekUKBGVCaijugxR6eSxvk19nncR9X6bmSSUq
-            VoxtHBkJbz/4mcQ/SUb4Wv1Rt5875tLWygS7qKmh8jzoP7JI4E9qWQ==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-05-08T16:05:46Z"
-    mac: ENC[AES256_GCM,data:X6AUVWJRcwH45W9NoQxI8Lp6l+5RFpgCNB6cdUZZODHDdTUMt9a6wr9YfU56C7QkdlxXdj6xCOCscJtw/WY2Y+XchWXaUVZZsoZ9xUo28aksUtHSyE9WJBHCeSqss79IW6k/GeDPiDOfz4om+udDvtdpyKbtvbw2a+K5st+62d4=,iv:REGTavU8DkalUbfO1J2+VccYnRRrOqstSFq/RU7Co5Q=,tag:2t8mwqa76kVQyeWS85zXsA==,type:str]
+    lastmodified: "2026-06-01T16:51:24Z"
+    mac: ENC[AES256_GCM,data:rwOoGGhzrCVJGNbHRAG+yjbneeseLlwtBO2ZmTKXWbruZ9Zu4T41DntxkFl+Lw3vTrLriAPiRkdvxTEVRS9ehHTAikUiyPO18vJmOLhlNq7n/HE2YqADJMq2cIJLGhCzA1AFuB5p07ovATPoUyo2OHvnEDgcRVdXJ+ml5zPTvSU=,iv:vYYShdVUDW1SsDlDEpO2EAaahIDexxBLJ5cs5fIx3qA=,tag:F5Q6zAXtRumGYYLDLGL5mw==,type:str]
     pgp:
-        - created_at: "2024-05-08T15:46:52Z"
+        - created_at: "2026-05-05T23:46:27Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA6R3Y9nD7qMBAQ//bYK5gdxv8fNvG6P4GrD27gQRQXhLGF2+hS54sqEqjeN8
-            NZpHVbNNRR3AggOkT7QY1JO8bOhWscefH1vvBmBuODzh5Fw42t4zNPEDjWZEetxa
-            rClbLEvo7Kz8UKCNb9JIeYx7cr8sPWCmg4GvV1wGjhjr+u5ovuheORnHl+qoLsqv
-            P12PV7VzwC52v92GWiu9LRJqfqZra5GjUXGVXzBcZ9i6CnUDejzssWjhO/fmzKum
-            GbGIi9sf3RmVYsUASDgRBmVAZC3KF7RLi0L6WY0etRocAaWSAgnU1lZ04E8ZtLjk
-            DlCtIpreJ1H0Ym+5EXB94PG0KZjayxKc20YDQ+yYwwSmiCVaUCLlYX2BOoncUYFF
-            MxVgWYwn14R5jyGbh4NyiBxPGHvIUx5RCIo70pMgS6W5ALZYTcNDLF82mj1xTOTy
-            bcuaa7FCuXJif457LCe5TcAa5WYDgKX8pUKzFRhWIckcGwgFCUB0Z7+L9L7F0yt/
-            YZd71cY0Lxlwi61CnWgZZMx2FFpHyBCEmF1A180KUtB1jSkS/AVmlM2z9I0QsR62
-            fTFIaqimPMjUzbuTs0QjUXf8OJZo0/cwo9XeGyCBtJTg7cLdsOFouqfvXhvkdCrR
-            xCLE2Ke5jwmoPKs1t+YpwMMzB57j/rluZCgiz45w7YDXKf4gEp2ra9siFiC/y9PS
-            XgEPymUiDZY0w9S5oGr94cNc6LQId16Zgt1vWHLzgg8QZqkxLTBjUXXc7aoCISQp
-            AwUE62KJucVvWjB3kcgDbNvaDWWC5O48zUavmzkmmP1sqKf0gO/XG52PDG/DF3Y=
-            =cs0r
+            hQIMA6R3Y9nD7qMBAQ/+JdTDmQhL1+iX7yeyGs1kt9yQeMYkJ+bQD3LqlQVh6Xea
+            yPIdcMBjAf1CNlkJKeJ4QK3f8rsZkxHmUFVDz7yCXctsp81hNBMZ0sauBM50OU4W
+            gQsDailZHgG5qCqKx91qSyVLtzVy4zcoTXy8TWLrSwztCt9qqX9LFZTKyZzNTiHW
+            DHYSwaJdTteXY89pZjPAQ6UtIdoVWaVfvCgaSZAxr3K8IJmobvMhhk/Fgm3CoE6Y
+            mfQd4lQhoqxrn2M/FKc30vg0yKVsiW3qlfnJCVHCxYUtQLVs3cF05lmj7CYy+0Mu
+            7eZlfVj84hCLmd4ccOITkrOTqcBKWKQ5EpE8DGvWlLPEZt407MjaphEJ7dYhkfr/
+            x4HrahZoeVbYX2Va0++picut+cE/NL9F/QMfqP4QhdHQhe74FlQcxpGDtcUIQep5
+            8MvbEAhUpGL4sErg6afmIapxXi3euIXcBDYPatgoAlsH7E8rUTX1Sd4VOgV89kEJ
+            pkl4OOwcaiF+brqtDiTGZf5l6AOugiYTp2Rtq9KMcGEGEmXFLcFKVjNEkZIxNxt3
+            EtrXrNmOCVJm71yOn2ruD9n2EXzFULfeyOhup7eYVfynkEWYlCQNHeaqMy2q656m
+            LWVd89AUzWLcsmY8naWpfekU9K//hLHxRLBzqfouYXJ+Ji/HOvfRj7NZBg6UtgfS
+            XgFOJg3EaLAZEyvEZKWpnWlf3gBTRK3ffaLzs+eddSgzYUutzlOYUZb7v3iEdjta
+            4Ik4F1M+kOGieyVxxLHOHMrOn09+WMmFIiPpBtCIcZmtwOzXNdhbZdFWNx5qPhU=
+            =wXdG
             -----END PGP MESSAGE-----
           fp: 4E241635F8EDD2919D2FB44CA362EA0491E2EEA0
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.12.1

modules/shared/colors/default.nix

@@ -1,4 +1,4 @@
-{ config, ... }: {
+{ ... }: {
   imports = [ ./sorahiro.nix ];
 
   colorScheme.palette.border-radius = "#8";

modules/shared/colors/sorahiro.nix

@@ -1,4 +1,4 @@
-{ nix-colors, ... }: 
+{ ... }: 
 let use_pastelle = true;
 in{
   # usage:  a = "#${config.colorScheme.palette.base00}";

modules/shared/sops/default.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 let
   isCI = builtins.elem config.syscfg.hostname [ "ci" "sandbox" ];
   keyFilePath = (if isCI then
@@ -14,19 +14,15 @@ in {
   sops.age.keyFile = keyFilePath;
   sops.age.generateKey = true;
 
-  sops.secrets.wifi = { };
-
-  sops.secrets."${config.syscfg.hostname}_ssh_priv" = {
-    mode = "0400";
-    owner = config.users.users.${config.syscfg.defaultUser}.name;
-    group = config.users.users.${config.syscfg.defaultUser}.group;
-  };
-  sops.secrets."${config.syscfg.hostname}_ssh_pub" = {
-    mode = "0400";
-    owner = config.users.users.${config.syscfg.defaultUser}.name;
-    group = config.users.users.${config.syscfg.defaultUser}.group;
-  };
-  sops.secrets."${config.syscfg.hostname}_wg_priv" = { };
-  sops.secrets."${config.syscfg.hostname}_wg_pub" = { };
-
+  sops.secrets = lib.mkMerge [
+  {
+    wifi = { };
+    "${config.syscfg.hostname}_ssh_priv" = {
+      mode = "0400";
+      owner = config.users.users.${config.syscfg.defaultUser}.name;
+      group = config.users.users.${config.syscfg.defaultUser}.group;
+    };
+    "${config.syscfg.hostname}_wg_priv" = { };
+  }
+];
 }

modules/shared/sops/mock.yaml

@@ -1,30 +1,34 @@
-ci_ssh_priv: ENC[AES256_GCM,data:3Fd7HtFzD+0Pm0qnmaNeivSrEJnH6A3CzLrSyYD4J1rpdHCYdFB2hbZAB5HF3yeCMlyqnApGHxi+9jN8FI54SzwqJQAgSZvKrkBhrs4JIQxPU0ZhOQHvneWYnA==,iv:NbLyzilDIH5cT3SC0SLaOn0alxXSIyZ/4Tr1zSBjIjI=,tag:xGfI8QRlkj4OZDVuV21Kcg==,type:str]
-ci_ssh_pub: ENC[AES256_GCM,data:6BVY3GS9lMLR/dYNxyldcBJe1DrjG/yHjqfCIw==,iv:VZOA/Q9zmbMnf9DsXN90er+tSnJ+syg3QabDuDal92Q=,tag:+xwHADgq22cV5ai9xd6ceQ==,type:str]
-ci_wg_priv: ENC[AES256_GCM,data:uA4eiEhQbbhLkrTyhRX4Tg==,iv:uHbrAq/mSQ6TtMqGhJez3d13u9ZK1S92w49ntXvbA3g=,tag:KwjiYrnuQxrydVKKV4xN4A==,type:str]
-ci_wg_pub: ENC[AES256_GCM,data:MBIdTEkyJBvbTtYrQYS8,iv:GD3xmJEyD9yZaV72GubGCBi8BW74zmSr2hOl123g0mM=,tag:ekUniuYPCSxwlmB1yUbo4w==,type:str]
-sandbox_ssh_priv: ENC[AES256_GCM,data:OG5ZsSQFEbUKLXtHF9MAHWYwnxBM0EyVyj54sPs9XEsFaRXq3WDa+ANnpVqBLtw6cPodLQHyJ5tY/Hr1rdINNGyLPEz/Zm3K7vz6iXUeThAKDhYaCH4vccFFtQ==,iv:2NbVjpKTyyiY4rtC/A6s2nABo5p0VAWtzC6b6TrHkvI=,tag:sO+SUMws8HncC9dmeiJPSg==,type:str]
-sandbox_ssh_pub: ENC[AES256_GCM,data:6bwJAmLuN0dhC8OiBW8qL2Ejt70a2ar02YTAqimnhcez,iv:/QMFyKaa3nOq1GrLNydq+Q8kS52fK6wsB3MioZN/qVM=,tag:XxcTX/REbHl5MKtRecjM2g==,type:str]
-sandbox_wg_priv: ENC[AES256_GCM,data:8d+WCtyGoEH3/4q1DZImUw==,iv:3efDzVFVCqv6yCNgBEXfQ19oh2bZLPO8my33uBgviW0=,tag:+WNPB7b6tVTzDlSVziDO2w==,type:str]
-sandbox_wg_pub: ENC[AES256_GCM,data:rpxkijFKzyKx3uhEa/+j,iv:UULKRJvU0lktwmKGcIP/sRAZb0j2e0iL40o3DkSv/+U=,tag:OWHbfFPbTY6l3Bu/og78Bg==,type:str]
-PGP_KEY: ENC[AES256_GCM,data:IVhL/l0JSPcefX1z,iv:/tOEukP7LiNhhdSw870vPeUGhN2lse2v1pZ5fJQglc0=,tag:++NUJeRhsDE9eRsbKu8Ldw==,type:str]
-wifi: ENC[AES256_GCM,data:SV3yNB/0dBqggh0kOKU98Nodd0VS4K8kTqg7aLyeAg==,iv:w4nspNxswHl2CZ7diPUzupzotfjskzp91NIq4f0v0UM=,tag:7nUHijRlEgyliWn2ZuZo/Q==,type:str]
+ci_ssh_priv: ENC[AES256_GCM,data:OuWZVS+ul8ERoQHEH8Gq6GdHWY5E3spR0uRu7akTVHrr6vYPWZHdV/8fjqKvfHd+dAeymWXe2Li7NXfXQM+y4OH36r1z9DLstwD4ufUmoHZ/MIO6qlsugzYhMw==,iv:NbLyzilDIH5cT3SC0SLaOn0alxXSIyZ/4Tr1zSBjIjI=,tag:uOzoai0Rq6UthSkWHhw8Hg==,type:str]
+ci_ssh_pub: ENC[AES256_GCM,data:Lu2Ec+HylJzt/IMu1b8AKgGsjpZT7X628pjOYQ==,iv:VZOA/Q9zmbMnf9DsXN90er+tSnJ+syg3QabDuDal92Q=,tag:lef6MRtvgyntMrxphatqmg==,type:str]
+ci_wg_priv: ENC[AES256_GCM,data:IoCn7jrahiJBhKxPuGyexg==,iv:uHbrAq/mSQ6TtMqGhJez3d13u9ZK1S92w49ntXvbA3g=,tag:QrZghdiQbmC9pcjKtIuKug==,type:str]
+ci_wg_pub: ENC[AES256_GCM,data:FB+DBkwDizA3C/s1TCkn,iv:GD3xmJEyD9yZaV72GubGCBi8BW74zmSr2hOl123g0mM=,tag:v189CtpJV7OX0sB9OJaWLA==,type:str]
+sandbox_ssh_priv: ENC[AES256_GCM,data:Wj/M/0VEfY7Ruix7nwi09obpX+w6G+gfGK4ZFTKkbpEEM2JyFnRHhWYQiBvBQOXahTGQ+zAnibCNcHSTCBa66XjMhtY865Hs6FovVCfgx0awTZcns26w5vqJdg==,iv:2NbVjpKTyyiY4rtC/A6s2nABo5p0VAWtzC6b6TrHkvI=,tag:CVi4i9MNi/cU64cn9s0DRA==,type:str]
+sandbox_ssh_pub: ENC[AES256_GCM,data:xbcGusta4qBO0hfmks+VCpN8N4dd/qGkGNREACVKxuSF,iv:/QMFyKaa3nOq1GrLNydq+Q8kS52fK6wsB3MioZN/qVM=,tag:WTZ2wlfBMmANw6EEWl5jew==,type:str]
+sandbox_wg_priv: ENC[AES256_GCM,data:4trdnPhgjlUChATnNx9o3Q==,iv:3efDzVFVCqv6yCNgBEXfQ19oh2bZLPO8my33uBgviW0=,tag:Io1obSodHW/RWWIg8VS8Zg==,type:str]
+sandbox_wg_pub: ENC[AES256_GCM,data:7L4SJdDMi5DZHpLfR6cs,iv:UULKRJvU0lktwmKGcIP/sRAZb0j2e0iL40o3DkSv/+U=,tag:irsolwnnfOjhYfiyanjxjw==,type:str]
+PGP_KEY: ENC[AES256_GCM,data:lwwHWksY+ea8D3z9,iv:/tOEukP7LiNhhdSw870vPeUGhN2lse2v1pZ5fJQglc0=,tag:225sf9GjXc8/NZgcXJIxZA==,type:str]
+wifi: ENC[AES256_GCM,data:Z+pbGAekk26GD3zg4TXVacP4Nrh93HPEMNcT0I1YaA==,iv:oiWZvnKvWmF/6cRZpCLsuf1uPJig6toNla5uT3t2kyM=,tag:iS3sq8JZsNUby9pSxYPw5g==,type:str]
 sops:
-    kms: []
-    gcp_kms: []
-    azure_kv: []
-    hc_vault: []
     age:
         - recipient: age13qv9dn9806paqgpjwmmkwtdzvv4qpv0ulksq0epnn8ufaxeug5zskyas3z
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZd0c5ZjZCb0Z6ZXlKaFph
-            S25LcnFaM3NueUdxOEkwQWRVYjZwNEx1TnpVCkJ1RnJsV2IwNWd5RVJBU2pOUnRa
-            UEcrdDVHUnZ3Zng4UVNWZjNhSzRmRGcKLS0tIEpMMGJCZmkrcnFwWjM4ZVF6VmJN
-            aFplU05pYXpPQWZRY202bVhFd3pHdHcKfauUQhzuUwpoaSlky+PlsOTrVQjyCSxi
-            NYlJ7ScbxzJsqTqJbZnD+lbSdWK2XVKXy1Vn4hR0C0WF7g2Y7CU7tg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBEbHNVZjRzQi9ram1xNHk3
+            d3pTTStiMjBLZHgwL0cvUGRwRFFzWi9HS2dvCkQ0ZU5UK1owS0N5MHhxOXV1cGVy
+            RnFQbGlhVy9tSVZKYXBqbzZjZU9nd3cKLS0tIDdXdm1qVTYvdS9sQ0Z0aExpTzB1
+            WkNsWVpqaHRSWkl6YXVrN0NoemhiS1EKoDRocdztTLQ5LMwHdlszTFHy+rm+y4RE
+            f97a6Z2J87ZfObRbaap5adVD7qk/tTYHGshT/8G1JxjctsxRgdfsmA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-04-14T21:03:55Z"
-    mac: ENC[AES256_GCM,data:W9kM3AaHcZcqVtT4qRpMRYKgmA9pBikAPhdKiPR/Y+0MSjY4c9LPeTBeS1vZzUaTgRHmNh/ns6I9SBO36Hio5qI6m/pjNdr9GfFbBpbnY+5mer6YTitq47TVySC9v+BRkES4A34h1Ky5yvJSDlz2kJfO/WVWllaQd0dxq8rgAU8=,iv:cRxgGKhD6KqXKpK4E12lWIIj99hBFSmGzSIv9LmYEyg=,tag:QXcswnB7GavGrBy1dFpQlQ==,type:str]
-    pgp: []
+        - recipient: age1pf4auk6u2tmefuqpuc6mntr26cp4wcsmlhnn98arzxsp3753ruqsj0jqk3
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNSHBpZGg0TlVtMFhjY2Ry
+            NzUrd1pPZFZNdFdLSUxrUUROaVNCTzdGR0hrCkVGUmpGemtFSDErRDArS0Y0WGZu
+            YkYzL2NGMTlnNW1NdStHOGpRN3A1VXcKLS0tIGs0MDIxTmpzSGtRWHZESFhNWXlS
+            Y3N0a2VPUHdoRlpUZ3BPVXROdDRHekEK2YN9ZgCaBPt/8kAkZNgsHp61SYqiFFXX
+            2lF0R1GNmYWm6T0YVCp/2ZN3z4GC+monctg1zoo5QsHfhIOpqIVoTA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-09-06T13:37:03Z"
+    mac: ENC[AES256_GCM,data:uI9yG3/jGNGn6yoN9W+9K/AUeSowe4Mb9vhh38pwkuKab9zXTFidCWyh1e0TEOsIHrhfK2GPc2fHwc309/la+CoiNxAIYtC4xmoCYxSGrDgbsZEONrusy9AEKpRCO8CqLYyLYaAG9sLqFyIz3GyEnS/j98V3LeemhFtS17J1VHI=,iv:x/7caaKnggoyEaCx5sf+zzSE+3d7atv+o9B1O3QX0Uc=,tag:Tzfs+ACx+4A6kxAZtVQ3KQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.8.1
+    version: 3.10.2

modules/shared/syscfg/default.nix

@@ -1,125 +1,33 @@
 { inputs, lib, ... }:
 let
-  userOpt = with lib; {
-    username = mkOption { type = types.str; };
-    wm = mkOption {
-      type = types.enum [ "Wayland" "X11" "-" ];
-      default = "-";
-    };
-    git = {
-      username = mkOption { type = types.str; };
-      email = mkOption { type = types.str; };
-      key = mkOption { type = types.str; };
-    };
-  };
-  netOpt = with lib; {
-    ble = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-    };
-    wlp = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      nif = mkOption {
-        type = types.str;
-        default = "";
-      };
-    };
-    wg = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-      };
-      ip4 = mkOption {
-        type = types.str;
-        default = "";
-      };
-      ip6 = mkOption {
-        type = types.str;
-        default = "";
-      };
-    };
-  };
-  makeOpt = with lib; {
-    cli = mkOption {
-      type = types.bool;
-      default = true;
-    };
-    gui = mkOption {
-      type = types.bool;
-      default = false;
-    };
-    virt = mkOption {
-      type = types.bool;
-      default = true;
-    };
-    power = mkOption {
-      type = types.bool;
-      default = false;
-    };
-    game = mkOption {
-      type = types.bool;
-      default = false;
-    };
-    develop = mkOption {
-      type = types.bool;
-      default = false;
-    };
-  };
-  serverOpt = with lib; {
-    hostDomain = mkOption { type = types.str; };
-    shortName = mkOption { type = types.str; };
-    mailDomain = mkOption { type = types.str; };
-    mailServer = mkOption { type = types.str; };
+  systemsDir = ../../../systems;
+  systemNames = lib.attrNames (lib.filterAttrs 
+    (name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix")) 
+    (builtins.readDir systemsDir));
 
-    dbHost = mkOption {
-      type = types.str;
-      default = "localhost";
-    };
-    dbPort = mkOption {
-      type = types.str;
-      default = "3306";
-    };
 
-    configPath = mkOption {
-      type = types.str;
-      default = "/media/config";
-    };
-    dataPath = mkOption {
-      type = types.str;
-      default = "/media/data";
-    };
-
-  };
 in with lib; {
-  options.usercfg = userOpt;
+  options.usercfg = import ./user.nix  {inherit lib;};
   options.syscfg = {
     hostname = mkOption { type = types.str; };
     type = mkOption {
       type = types.enum [ "nixos" "macos" "home" ];
       default = "nixos";
     };
-    system = mkOption {
-      type = types.enum [ "x86_64-linux" "x86_64-darwin" "-" ];
-      default = "x86_64-linux";
-    };
     defaultUser = mkOption { type = types.str; };
-    make = makeOpt;
-    net = netOpt;
+    make = import ./make.nix {inherit lib;};
+    net = import ./net.nix {inherit lib;};
     users = mkOption {
-      type = types.listOf (types.submodule { options = userOpt; });
+      type = types.listOf (types.submodule { options = import ./user.nix  {inherit lib;}; });
       default = [ ];
     };
-    server = mkOption {
-      type = types.oneOf [
-        (types.attrs)
-        (types.submodule { options = serverOpt; })
-      ];
-      default = { };
+    peers = mkOption {
+      default = map (name: import (systemsDir + "/${name}/cfg.nix")) systemNames;
     };
+    server = mkOption {
+      type = types.oneOf [ types.bool (types.submodule { options = import ./server.nix {inherit lib;}; }) ];
+      default = false;
+    };
+    extra = import ./extra.nix {inherit lib;};
   };
 }