fixes

Reviewed-on: #120

.gitea/workflows/build.yml

@@ -12,17 +12,17 @@ jobs:
   build-nixos:
     runs-on: ubuntu-latest
     steps: 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       
       - name: "Install Nix ❄️"
-        uses: cachix/install-nix-action@v27
+        uses: cachix/install-nix-action@v31
 
     #  - uses: DeterminateSystems/nix-installer-action@v4
-      - uses: DeterminateSystems/magic-nix-cache-action@v7
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
-      - uses: DeterminateSystems/flake-checker-action@v8
+      - uses: DeterminateSystems/flake-checker-action@v12
 
       - name: "Install Cachix ❄️"
-        uses: cachix/cachix-action@v15
+        uses: cachix/cachix-action@v17
         with:
           name: helcel
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"

.gitea/workflows/update.yml

@@ -13,15 +13,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Install nix
-        uses: DeterminateSystems/nix-installer-action@v12
+        uses: DeterminateSystems/nix-installer-action@v22
         with:
           github-token: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
           extra_nix_config: |
             experimental-features = nix-command flakes            
       - name: Update flake.lock
-        uses: DeterminateSystems/update-flake-lock@v22
+        uses: DeterminateSystems/update-flake-lock@v28
         with:
           token: ${{ secrets.GT_TOKEN_FOR_UPDATES }}
           pr-title: "[chore] Update flake.lock"

.gitignore

@@ -2,3 +2,4 @@ result
 age-key.txt
 .decrypted~common.yaml
 .decrypted*
+.tmp

.sops.yaml

@@ -9,55 +9,57 @@ keys:
     - &avalon age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
     - &valinor age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
     - &asgard age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+    - &gateway age1lqvnzlendlmtwgstzrj4xzrwpatwx56k5az5au78fyg99yecwfzs3s6xn6
+    - &sandbox age1pf4auk6u2tmefuqpuc6mntr26cp4wcsmlhnn98arzxsp3753ruqsj0jqk3
 
 creation_rules:
   - path_regex: modules/shared/sops/private/iriy.[a-z]+
     key_groups:
-    - age:
+      - age:
-      - *iriy
+          - *iriy
-      pgp:
+        pgp:
-      - *sora
+          - *sora
   - path_regex: modules/shared/sops/private/avalon.[a-z]+
     key_groups:
-    - age:
+      - age:
-      - *avalon
+          - *avalon
-      pgp:
+        pgp:
-      - *sora
+          - *sora
   - path_regex: modules/shared/sops/private/valinor.[a-z]+
     key_groups:
-    - age:
+      - age:
-      - *valinor
+          - *valinor
-      pgp:
+        pgp:
-      - *sora
+          - *sora
   - path_regex: modules/shared/sops/private/asgard.[a-z]+
     key_groups:
-    - age:
+      - age:
-      - *asgard
+          - *asgard
-      pgp:
+        pgp:
-      - *sora
+          - *sora
 
   - path_regex: modules/shared/sops/common.[a-z]+
     key_groups:
-    - age:
+      - age:
-      - *valinor
+          - *valinor
-      - *iriy
+          - *iriy
-      - *avalon
+          - *avalon
-      - *asgard
+          - *asgard
-      pgp:
+          - *gateway
-      - *sora
+        pgp:
+          - *sora
 
   - path_regex: modules/shared/sops/mock.[a-z]+
     key_groups:
-    - age:
+      - age:
-      - *ci
+          - *ci
-
+          - *sandbox
 
   - path_regex: modules/server/sops/server.[a-z]+
     key_groups:
-    - age:
+      - age:
-      - *valinor
+          - *avalon
-      - *iriy
+          - *sandbox
-      - *avalon
+
-      - *asgard
+        pgp:
-      pgp:
+          - *sora
-      - *sora

flake.lock

@@ -1,28 +1,5 @@
 {
   "nodes": {
-    "arion": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "haskell-flake": "haskell-flake",
-        "hercules-ci-effects": "hercules-ci-effects",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1717555938,
-        "narHash": "sha256-sVsJ48fKnIylxXbAIsdTJixkUxA8p2WvYRlyfo0KQos=",
-        "owner": "hercules-ci",
-        "repo": "arion",
-        "rev": "c24c185e67f093298a081900b49ca18716077dec",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "arion",
-        "type": "github"
-      }
-    },
     "base16-schemes": {
       "flake": false,
       "locked": {
@@ -46,11 +23,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1716993688,
+        "lastModified": 1779036909,
-        "narHash": "sha256-vo5k2wQekfeoq/2aleQkBN41dQiQHNTniZeVONWiWLs=",
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "c0d5b8c54d6828516c97f6be9f2d00c63a363df4",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
         "type": "github"
       },
       "original": {
@@ -60,19 +37,35 @@
         "type": "github"
       }
     },
+    "flake-compat": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1767039857,
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
+        "type": "github"
+      },
+      "original": {
+        "owner": "edolstra",
+        "repo": "flake-compat",
+        "type": "github"
+      }
+    },
     "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
-          "arion",
+          "nur",
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1717285511,
+        "lastModified": 1733312601,
-        "narHash": "sha256-iKzJcpdXih14qYVcZ9QC9XuZYnPc6T8YImb6dX166kw=",
+        "narHash": "sha256-4pDvzqnegAfRkPwO3wmwBhVi/Sye1mzps0zHWYnP88c=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "2a55567fcf15b1b1c7ed712a2c6fadaec7412ea8",
+        "rev": "205b12d8b7cd4802fbcb8e8ef6a0f1408781a4f9",
         "type": "github"
       },
       "original": {
@@ -81,77 +74,39 @@
         "type": "github"
       }
     },
-    "flake-parts_2": {
+    "flake-utils": {
       "inputs": {
-        "nixpkgs-lib": [
+        "systems": "systems"
-          "arion",
-          "hercules-ci-effects",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1712014858,
+        "lastModified": 1681202837,
-        "narHash": "sha256-sB4SWl2lX95bExY2gMFG5HIzvva5AVMJd4Igm+GpZNw=",
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
-        "owner": "hercules-ci",
+        "owner": "numtide",
-        "repo": "flake-parts",
+        "repo": "flake-utils",
-        "rev": "9126214d0a59633752a136528f5f3b9aa8565b7d",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
         "type": "github"
       },
       "original": {
-        "id": "flake-parts",
+        "owner": "numtide",
-        "type": "indirect"
+        "repo": "flake-utils",
+        "type": "github"
       }
     },
     "hardware": {
-      "locked": {
-        "lastModified": 1717574423,
-        "narHash": "sha256-cz3P5MZffAHwL2IQaNzsqUBsJS+u0J/AAwArHMAcCa0=",
-        "owner": "nixos",
-        "repo": "nixos-hardware",
-        "rev": "d6c6cf6f5fead4057d8fb2d5f30aa8ac1727f177",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "repo": "nixos-hardware",
-        "type": "github"
-      }
-    },
-    "haskell-flake": {
-      "locked": {
-        "lastModified": 1675296942,
-        "narHash": "sha256-u1X1sblozi5qYEcLp1hxcyo8FfDHnRUVX3dJ/tW19jY=",
-        "owner": "srid",
-        "repo": "haskell-flake",
-        "rev": "c2cafce9d57bfca41794dc3b99c593155006c71e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "srid",
-        "ref": "0.1.0",
-        "repo": "haskell-flake",
-        "type": "github"
-      }
-    },
-    "hercules-ci-effects": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "nixpkgs": "nixpkgs"
-        "nixpkgs": [
-          "arion",
-          "nixpkgs"
-        ]
       },
       "locked": {
-        "lastModified": 1713898448,
+        "lastModified": 1780065812,
-        "narHash": "sha256-6q6ojsp/Z9P2goqnxyfCSzFOD92T3Uobmj8oVAicUOs=",
+        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
-        "owner": "hercules-ci",
+        "owner": "nixos",
-        "repo": "hercules-ci-effects",
+        "repo": "nixos-hardware",
-        "rev": "c0302ec12d569532a6b6bd218f698bc402e93adc",
+        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "nixos",
-        "repo": "hercules-ci-effects",
+        "repo": "nixos-hardware",
         "type": "github"
       }
     },
@@ -162,152 +117,20 @@
         ]
       },
       "locked": {
-        "lastModified": 1717525419,
+        "lastModified": 1779726825,
-        "narHash": "sha256-5z2422pzWnPXHgq2ms8lcCfttM0dz+hg+x1pCcNkAws=",
+        "narHash": "sha256-RUkMrREjKDQrA+dA9+xZviGAxM5W1aVdyOr/bSYpHrE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a7117efb3725e6197dd95424136f79147aa35e5b",
+        "rev": "b179bde238977f7d4454fc770b1a727eaf55111c",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
+        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
     },
-    "hyprcursor": {
-      "inputs": {
-        "hyprlang": [
-          "hyprland",
-          "hyprlang"
-        ],
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1716576411,
-        "narHash": "sha256-FIN1wMoyePBTtibCbaeJaoKNLuAYIGwLCWAYC1DJanw=",
-        "owner": "hyprwm",
-        "repo": "hyprcursor",
-        "rev": "57298fc4f13c807e50ada2c986a3114b7fc2e621",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprcursor",
-        "type": "github"
-      }
-    },
-    "hyprland": {
-      "inputs": {
-        "hyprcursor": "hyprcursor",
-        "hyprlang": "hyprlang",
-        "hyprwayland-scanner": "hyprwayland-scanner",
-        "nixpkgs": [
-          "nixpkgs"
-        ],
-        "systems": "systems",
-        "xdph": "xdph"
-      },
-      "locked": {
-        "lastModified": 1717784649,
-        "narHash": "sha256-rU23X1kppflHachNGlwjjVNtz5haTVgFAUrrQjRE1o0=",
-        "ref": "refs/heads/main",
-        "rev": "c31d9ef4172452f6f219f91d9b87a24d91f0cf3a",
-        "revCount": 4774,
-        "submodules": true,
-        "type": "git",
-        "url": "https://github.com/hyprwm/Hyprland"
-      },
-      "original": {
-        "submodules": true,
-        "type": "git",
-        "url": "https://github.com/hyprwm/Hyprland"
-      }
-    },
-    "hyprland-protocols": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "xdph",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "xdph",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1691753796,
-        "narHash": "sha256-zOEwiWoXk3j3+EoF3ySUJmberFewWlagvewDRuWYAso=",
-        "owner": "hyprwm",
-        "repo": "hyprland-protocols",
-        "rev": "0c2ce70625cb30aef199cb388f99e19a61a6ce03",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprland-protocols",
-        "type": "github"
-      }
-    },
-    "hyprlang": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1716473782,
-        "narHash": "sha256-+qLn4lsHU6iL3+HTo1gTQ1tWzet8K9h+IfVemzEQZj8=",
-        "owner": "hyprwm",
-        "repo": "hyprlang",
-        "rev": "87d5d984109c839482b88b4795db073eb9ed446f",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprlang",
-        "type": "github"
-      }
-    },
-    "hyprwayland-scanner": {
-      "inputs": {
-        "nixpkgs": [
-          "hyprland",
-          "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
-        ]
-      },
-      "locked": {
-        "lastModified": 1716058375,
-        "narHash": "sha256-CwjWoVnBZE5SBpRx9dgSQGCr4Goxyfcyv3zZbOhVqzk=",
-        "owner": "hyprwm",
-        "repo": "hyprwayland-scanner",
-        "rev": "3afed4364790aebe0426077631af1e164a9650cc",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hyprwm",
-        "repo": "hyprwayland-scanner",
-        "type": "github"
-      }
-    },
     "nix-colors": {
       "inputs": {
         "base16-schemes": "base16-schemes",
@@ -327,22 +150,56 @@
         "type": "github"
       }
     },
-    "nixpkgs": {
+    "nixUnstable": {
       "locked": {
-        "lastModified": 1717602782,
+        "lastModified": 1780030872,
-        "narHash": "sha256-pL9jeus5QpX5R+9rsp3hhZ+uplVHscNJh8n8VpqscM0=",
+        "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "e8057b67ebf307f01bdcc8fba94d94f75039d1f6",
+        "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-unstable",
+        "ref": "nixpkgs-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
+    "nixos-wsl": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780169171,
+        "narHash": "sha256-3HBYDfBgZ+ph52HS6Ks/bMMwuh2uONIT72sZ1CtLE/s=",
+        "owner": "nix-community",
+        "repo": "nixos-wsl",
+        "rev": "998b2821c30b2938637230916904ceb8757c79e8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-wsl",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1767892417,
+        "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=",
+        "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba",
+        "type": "tarball",
+        "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz"
+      }
+    },
     "nixpkgs-lib": {
       "locked": {
         "lastModified": 1697935651,
@@ -358,13 +215,35 @@
         "type": "github"
       }
     },
-    "nur": {
+    "nixpkgs_2": {
       "locked": {
-        "lastModified": 1717796685,
+        "lastModified": 1780203844,
-        "narHash": "sha256-gSqABDeA5b7Q8eQQIr90fDr4FCTFwKbcVtFoo9leEBc=",
+        "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-26.05",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nur": {
+      "inputs": {
+        "flake-parts": "flake-parts",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780265777,
+        "narHash": "sha256-t/KORFHEv8Jn2vFmVfv4Zffekv+MUogI2KgtxuCcEmQ=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "5b8027e546936ceba46599439097b370d9276856",
+        "rev": "39917b7f68263188707925ffe26c9df6ef4e7d64",
         "type": "github"
       },
       "original": {
@@ -375,32 +254,30 @@
     },
     "root": {
       "inputs": {
-        "arion": "arion",
         "darwin": "darwin",
         "hardware": "hardware",
         "home-manager": "home-manager",
-        "hyprland": "hyprland",
         "nix-colors": "nix-colors",
-        "nixpkgs": "nixpkgs",
+        "nixUnstable": "nixUnstable",
+        "nixos-wsl": "nixos-wsl",
+        "nixpkgs": "nixpkgs_2",
         "nur": "nur",
-        "sops-nix": "sops-nix"
+        "sops-nix": "sops-nix",
+        "vscode-server": "vscode-server"
       }
     },
     "sops-nix": {
       "inputs": {
         "nixpkgs": [
           "nixpkgs"
-        ],
-        "nixpkgs-stable": [
-          "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1717455931,
+        "lastModified": 1777944972,
-        "narHash": "sha256-8Q6mKSsto8gaGczXd4G0lvawdAYLa5Dlh3/g4hl5CaM=",
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "d4555e80d80d2fa77f0a44201ca299f9602492a0",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
         "type": "github"
       },
       "original": {
@@ -411,46 +288,37 @@
     },
     "systems": {
       "locked": {
-        "lastModified": 1689347949,
+        "lastModified": 1681028828,
-        "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
         "owner": "nix-systems",
-        "repo": "default-linux",
+        "repo": "default",
-        "rev": "31732fcf5e8fea42e59c2488ad31a0e651500f68",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
         "type": "github"
       },
       "original": {
         "owner": "nix-systems",
-        "repo": "default-linux",
+        "repo": "default",
         "type": "github"
       }
     },
-    "xdph": {
+    "vscode-server": {
       "inputs": {
-        "hyprland-protocols": "hyprland-protocols",
+        "flake-utils": "flake-utils",
-        "hyprlang": [
-          "hyprland",
-          "hyprlang"
-        ],
         "nixpkgs": [
-          "hyprland",
           "nixpkgs"
-        ],
-        "systems": [
-          "hyprland",
-          "systems"
         ]
       },
       "locked": {
-        "lastModified": 1716290197,
+        "lastModified": 1770124655,
-        "narHash": "sha256-1u9Exrc7yx9qtES2brDh7/DDZ8w8ap1nboIOAtCgeuM=",
+        "narHash": "sha256-yHmd2B13EtBUPLJ+x0EaBwNkQr9LTne1arLVxT6hSnY=",
-        "owner": "hyprwm",
+        "owner": "nix-community",
-        "repo": "xdg-desktop-portal-hyprland",
+        "repo": "nixos-vscode-server",
-        "rev": "91e48d6acd8a5a611d26f925e51559ab743bc438",
+        "rev": "92ce71c3ba5a94f854e02d57b14af4997ab54ef0",
         "type": "github"
       },
       "original": {
-        "owner": "hyprwm",
+        "owner": "nix-community",
-        "repo": "xdg-desktop-portal-hyprland",
+        "repo": "nixos-vscode-server",
         "type": "github"
       }
     }

flake.nix

@@ -1,13 +1,17 @@
 {
   description = "SoraFlake";
-
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+    # Trick renovate into working: "github:NixOS/nixpkgs/nixpkgs-unstable"
+    nixUnstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
     hardware.url = "github:nixos/nixos-hardware";
-    nur.url = "github:nix-community/nur";
+    nur = {
+      url = "github:nix-community/nur";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     home-manager = {
-      url = "github:nix-community/home-manager";
+      url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -16,40 +20,45 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    hyprland = {
-      url = "git+https://github.com/hyprwm/Hyprland?submodules=1";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs-stable.follows = "nixpkgs";
     };
     nix-colors.url = "github:misterio77/nix-colors";
+    nixos-wsl = {
+      url = "github:nix-community/nixos-wsl";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
-    arion.url = "github:hercules-ci/arion";
+    vscode-server = {
-    arion.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/nixos-vscode-server";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
   };
 
   outputs = inputs:
-    let gen = import ./generator.nix { inherit inputs; };
+    let
+      lib = inputs.nixpkgs.lib;
+      gen = import ./generator.nix { inherit inputs; };
+      systemsDir = ./systems;
+      systemNames = lib.attrNames (lib.filterAttrs
+        (name: type: type == "directory" && builtins.pathExists (systemsDir + "/${name}/cfg.nix"))
+        (builtins.readDir systemsDir));
+      hostsByType = systemType:
+        lib.filter
+          (host: (import (systemsDir + "/${host}/cfg.nix")).syscfg.type == systemType)
+          systemNames;
+      generateHosts = systemType:
+        builtins.listToAttrs (map
+          (host: lib.nameValuePair host (gen.generate { inherit host; }))
+          (hostsByType systemType));
     in {
       devShells = import ./shells { inherit inputs; };
 
-      nixosConfigurations = {
+      nixosConfigurations = generateHosts "nixos";
-        valinor = gen.generate { host = "valinor"; };
+      darwinConfigurations = generateHosts "macos";
-        iriy = gen.generate { host = "iriy"; };
+      homeConfigurations = generateHosts "home";
-        efir = gen.generate { host = "efir"; };
-        avalon = gen.generate { host = "avalon"; };
-        ci = gen.generate { host = "ci"; };
-        sandbox = gen.generate { host = "sandbox"; };
-      };
-      darwinConfigurations = { asgard = gen.generate { host = "asgard"; }; };
-      homeConfigurations = {
-        yomi = gen.generate { host = "example"; };
-        example = gen.generate { host = "example"; };
-      };
     };
 
   # ===== Unsupported/NotImplemented ======

generator.nix

@@ -5,16 +5,20 @@
       nameValuePair = name: value: { inherit name value; };
     in ({
       "nixos" = inputs.nixpkgs.lib.nixosSystem {
-        system = syscfg.syscfg.system;
+        system = "x86_64-linux";
+        specialArgs = { inherit inputs; };
         modules = [
           ./modules/shared/syscfg
           ./modules/shared/sops
           ./modules/nixos
           syscfg
           ./systems/${host}
-          inputs.arion.nixosModules.arion
           inputs.sops-nix.nixosModules.sops
           inputs.home-manager.nixosModules.home-manager
+
+          inputs.nixos-wsl.nixosModules.wsl
+          inputs.vscode-server.nixosModules.default
+
           {
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
@@ -28,7 +32,7 @@
                   syscfg
                   { usercfg = userConfig; }
                   inputs.nix-colors.homeManagerModule
-                  inputs.hyprland.homeManagerModules.default
+                  inputs.sops-nix.homeManagerModules.sops
                 ];
               }) syscfg.syscfg.users);
           }
@@ -36,7 +40,7 @@
       };
 
       "macos" = inputs.darwin.lib.darwinSystem {
-        system = syscfg.system;
+        system = "x86_64-darwin";
         modules = [
           ./modules/shared/syscfg
           ./modules/shared/sops
@@ -52,7 +56,7 @@
               nameValuePair userConfig.username {
                 imports = [
                   inputs.nix-colors.homeManagerModule
-                  inputs.hyprland.homeManagerModules
+                  inputs.sops-nix.homeManagerModules.sops
                 ];
               }) syscfg.syscfg.users);
           }

modules/home/base/default.nix

@@ -1,5 +1,6 @@
 { lib, config, ... }: {
 
+  #environment.sessionVariables.SOPS_AGE_KEY_FILE = keyFilePath;
   systemd.user.startServices = "sd-switch";
   programs.home-manager.enable = true;
 
@@ -7,6 +8,14 @@
     username = "${config.usercfg.username}";
     homeDirectory = "/home/${config.usercfg.username}";
 
-    stateVersion = "23.11";
+    stateVersion = "26.05";
   };
+
+
+  #SOPS
+  # sops.defaultSopsFile = ./sops/${config.usercfg.username}.yaml;
+  # sops.age.keyFile = "/var/lib/sops-nix/age-key.txt";
+  # sops.age.generateKey = true;
+  # sops.secrets."github_user_key" = { };
+  # sops.secrets."curse_forge_key" = { };
 }

modules/home/base/sops/sora.yaml

@@ -0,0 +1,69 @@
+curse_forge_key: ENC[AES256_GCM,data:PhhwPhUys/WDzXb40iFlrUcwFEJVzi49vDlm5Hpc7IUwbBiQI1Zvi6115THMvarnGESDyouPfoZP0wha,iv:x//EzR4QwdD0UxqV97yUepc39DopoqiDT21unpF9R2E=,tag:5jM1EibWo0wI+PS70+kb/Q==,type:str]
+github_user_key: ENC[AES256_GCM,data:RvBsQjWGd2qRCvBzcpMv8FIXGY/GiPd9o0x2Oq+NlbXxR2NMqNBNLw==,iv:99AcmOWFft7XQAn7YrGjZuCvz0M5wUkYeInsWwyeUFM=,tag:wkw2YQGi9j/8XtOFd8KhdQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBraWFDRFUxQ2l5OWV1OXNK
+            UExEbWZkM0kzVk1rZG4yY3pBLzdMVWVJS0UwCnhlWFJ5T2lZUXJyNkg1ejQxaU1t
+            L3F2RUhldTY3N2xXL0hwczNKRzNjcncKLS0tIEkycHoxcDBGNyt2V3RDY29wNGVp
+            TGg5Rk05VkRsaXM1Q0NxMmtMajRORDAKqjFldiAYJKjmnkeDkwanjYvhL6645DZ5
+            dVXExjqO/DG733ge8HFyKzpfpkzRymV1giUwxBdII1dd0mJ2ncINeA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1ms8f0ysv6vakxepvt69fejczs6tddexepesdv4rkgtheehj3nu4sc6290s
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3UkRjblIvYStZUzQyRHA1
+            ZGVXeHhrN0kyVkxZdms5U3gwVFlPMW12MVJjCjRkVURpZXBzb0tYenB4dGxKamh6
+            VXVBMmo1Ujkvd2VTRExyWE5MbVJaclUKLS0tIDVhRkYzZmEzUG00Q2IwOWZUMVVt
+            ODVIbytpcjN1cVMyaG1qVVdkRmtaMzQKNsvD9DpK/raDBob+IcuNk72tQDts36kJ
+            QhtoLy8MvUymi49PdEWrgyf68w5XwRO/U4iINhR0qzm0glg/XcyHjA==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJc3hKWkk3ckNOY2UyTVhG
+            MmtLaEd0K04yaGxiOUoxMXkzOEFnYis4VkhnCktDRFM2bS8vb05OWDdwa0RwRlNO
+            cmlZemtxVGZ6S0tNTDV1cmE1N0pVWnMKLS0tIE9EZllycHJpcEY2R1pwOFhOZEU3
+            L01IcytDd3BPb0VOTW9DQ2lUdUVJS0kKiD+C+3mK1b/eIwCEFanFgYGLNk3JNPQ7
+            i1UqzbHVxSd0q/YVwdKAcj0jA6EezGm275tgq7IVsy2sHkvRMaEDtQ==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1sxzuhh2fcd4pmaz4mdqq95t683d32ft22w9t2r7pk258u0s8wymsqdj7lg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAweVU3TkxFZzRnd2I2clN2
+            ZTlTWmhwQkhVc1hnOXFvZVVDSWpHMVh1TGtrCkc3M1pUTnZCMHpvYXB5ZVhreGxa
+            ZVY2cG5Ja2ltL3k2Q1VEalc5TTNFMXcKLS0tIGd5UWl0RGVXT211Zm51dlB6WFZ1
+            STRtTVpVTCtVZ1FUNENqWFFVNTNuaVUKN6HRiZjTdENeif8dJ29urBxPXDaosjjY
+            InN4Ko6YUaGfvB1DTrKIzrxOpsHS+XjisoGfT71tJwwEOoREklEO/A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-12-23T18:05:22Z"
+    mac: ENC[AES256_GCM,data:YSi2xIwz50VxUDL3QzGVUwRWUgZhvudSLCKgwIbWm8gkuAJ/V2sVRhJNVQJ1YvLO44ob5hmrgR4wSnOdAbS7FrpbLcJuoYBjVUTDjy+j6otnIDxEcYeciHhZ1pV/OiydBmJC+lZ4+SRdWdokL2HaXRKgc9QT9e/MdAbFIzI1x90=,iv:8rj8yEqHTMgoGu31RVskYizmROB/5I0ajZJ/EcmlVfE=,tag:PILFCyXY8sXYGxCEHS7qCg==,type:str]
+    pgp:
+        - created_at: "2023-04-20T10:20:17Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            wcFMA6R3Y9nD7qMBAQ/8CVWQaYKfOzvPIllZyyWpUjHRLLXaR8MNJ8U5WI/tdwdN
+            9UScDYJFuYRW7Q9s4Mt961kBGpaHqe9MUZBxUDlYX59+EN3FbO/eMQ5OqI05ESmL
+            TvZB4+S9C5o73nuypSDNvYz+Lgq6DO25ZPhXdtPhx2DE4G31/wft/LpxhjalIjI8
+            MU0Dv22R4qC+glJbe4GIF2IJ8XoxnnzjiGeSqiyv0QIBM0SzOtA5sKwNohWBnW7g
+            7vxOTm5+kyzG0dDjt3tFApgPDaA1wjofzhRuuveF52VBsuIA2opFdpqkyICvK6rn
+            NB5kUaPlY6A0m+n0oHSfY5wm/AnHNE4Oob/ifumAaB0EAJVUTRauI5M8SeJF0ya1
+            U0IQ9N2lb7Y6q4pqHywIa6fnylsqCfxInAYKMuslRq8f9t/qakb4/MYcnPrwpzjw
+            73/naiNoJmG6NVTkM52qTtOqZAmsaQd5cigTuPW2Z2CJq1yLZEVGSSd1DUGUjBDK
+            nQGucpVVVpD+ifrIPz+Iqwy+5NoZZm/Oa9pKJGFzqXinnDNZaqtgpmTw9QxcSeaP
+            VvGZG9CDd89MtAm1VQyuqi1bQ2faq3G0xNrLl7xUsfmjx4ofW+JXR87OzvGfLPhu
+            Sjl3kS9j5/MEBRBg3n9gNkgSu5Sy3ilhckY3yjTgAT9Gw2giDhCiUXi1/7KrGprS
+            UQHPCSsjyWsyuYVa3lAP/WPdVclc4WOdfYcetUCXBVP7LQr0bq+IG+2J0nnY3mDt
+            Va5k4sP1qu6Ecrs2JioQ1V2H+VmcrRykBWnMXl1tDSWKMA==
+            =pS8X
+            -----END PGP MESSAGE-----
+          fp: 4E241635F8EDD2919D2FB44CA362EA0491E2EEA0
+    unencrypted_suffix: _unencrypted
+    version: 3.9.2

modules/home/cli/git/default.nix

@@ -1,15 +1,17 @@
-{ config, pkgs, ... }: {
+{ config, lib, pkgs, ... }: {
 
   programs.git = {
     enable = true;
-    userEmail = "${config.usercfg.git.email}";
+    signing = lib.mkIf (config.usercfg.git.key != null) {
-    userName = "${config.usercfg.git.username}";
+      key = config.usercfg.git.key;
-    signing = {
-      key = "${config.usercfg.git.key}";
       signByDefault = true;
     };
     ignores = [ "*result*" ".direnv" "node_modules" ];
-    extraConfig = { core.hooksPath = "./.dev/hooks"; };
+    settings = {
+      core.hooksPath = "./.dev/hooks"; 
+      user.email = "${config.usercfg.git.email}";
+      user.name = "${config.usercfg.git.username}";
+    };
   };
 
   home.packages = with pkgs; [ tig ];

modules/home/cli/neofetch/config.jsonc

@@ -0,0 +1,147 @@
+{
+    "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json",
+    "logo": {
+        "type": "builtin", // Logo type: auto, builtin, small, file, etc.
+        // "source": "arch",
+        "width": 10,
+        "height": 10,
+        "padding": {
+            "top": 3,
+            "left": 2,
+            "right": 2
+        },
+        "color": {
+            "1": "blue",
+            "2": "white",
+            "3": "cyan"
+        }
+    },
+    "display": { /* Display settings */},
+    "modules": [
+        "break",
+        {
+            "type": "custom",
+            "format": "\u001b[90m┌──────────────────────Hardware──────────────────────┐"
+        },
+        {
+            "type": "host",
+            "key": "󰌢  PC",
+            "keyColor": "green",
+            "format": "{2}"
+        },
+        {
+            "type": "cpu",
+            "key": "│ ├󱛠 ",
+            "keyColor": "green",
+            "format": "{1} | {4} @{6}"
+        },
+        {
+            "type": "gpu",
+            "key": "│ ├󰍹 ",
+            "keyColor": "green",
+            "format": "{2} | {7}"
+        },
+        {
+            "type": "memory",
+            "key": "│ ├󰑭 ",
+            "keyColor": "green",
+            "format": "{2}"
+        },
+        // {
+        //     "type": "disk",
+        //     "key": "└ └󰋊 ",
+        //     "keyColor": "green"
+        // },
+        {
+            "type": "custom",
+            "format": "\u001b[90m└────────────────────────────────────────────────────┘"
+        },
+        "break",
+        {
+            "type": "custom",
+            "format": "\u001b[90m┌──────────────────────Software──────────────────────┐"
+        },
+        {
+            "type": "os",
+            "key": "  OS",
+            "keyColor": "yellow",
+            "format": " {2} {8}"
+        },
+        {
+            "type": "kernel",
+            "key": "│ ├󰌽 ",
+            "keyColor": "yellow",
+            "format": "{1} {2}"
+        },
+        {
+            "type": "bios",
+            "key": "│ ├󰖡 ",
+            "keyColor": "yellow"
+        },
+        {
+            "type": "packages",
+            "key": "│ ├󰏗 ",
+            "keyColor": "yellow"
+        },
+        {
+            "type": "de",
+            "key": "󰧨  DE",
+            "keyColor": "blue",
+            "format": "{2} | {3}"
+        },
+        {
+            "type": "lm",
+            "key": "│ ├󰍁 ",
+            "keyColor": "blue",
+            "format": "{1} {2} {3}"
+        },
+        {
+            "type": "wm",
+            "key": "│ ├󱂬 ",
+            "keyColor": "blue",
+            "format": "{2} {5}"
+        },
+        {
+            "type": "custom",
+            "format": "\u001b[90m└────────────────────────────────────────────────────┘"
+        },
+        "break",
+        {
+            "type": "custom",
+            "format": "\u001b[90m┌──────────────────────Age───────────────────────────┐"
+        },
+        {
+            "type": "command",
+            "key": "  ›  OS Age  ",
+            "keyColor": "magenta",
+            "text": "birth_install=$(stat -c %W /); current=$(date +%s); time_progression=$((current - birth_install)); days_difference=$((time_progression / 86400)); echo $days_difference days"
+        },
+        {
+            "type": "command",
+            "key": "  ›  Update  ",
+            "keyColor": "magenta",
+            "text": "nixos-rebuild list-generations | awk '$NF == \"True\" {print $2, $3}' | xargs -I {} date -d \"{}\" +\"%s\" | awk '{diff=systime()-$1; printf \"%d days, %d hours, %d mins\\n\", diff/86400, (diff%86400)/3600, (diff%3600)/60}'"
+        },
+        {
+            "type": "uptime",
+            "key": "  ›  Uptime  ",
+            "keyColor": "magenta"
+        },
+        {
+            "type": "custom",
+            "format": "\u001b[90m└────────────────────────────────────────────────────┘"
+        },
+        {
+            "type": "colors",
+            "paddingLeft": 2,
+            "block": {
+                "width": 3,
+                "range": [
+                    0,
+                    15
+                ]
+            } //,
+            //"symbol": "circle"
+        },
+    ]
+}

modules/home/cli/neofetch/default.nix

@@ -1,4 +1,5 @@
 { pkgs, config, ... }: {
-  home.packages = with pkgs; [ neofetch ];
+  home.packages = with pkgs; [ fastfetch ];
   xdg.configFile."neofetch/config.conf".source = ./config.conf;
+  xdg.configFile."fastfetch/config.jsonc".source = ./config.jsonc;
 }

modules/home/cli/other/default.nix

@@ -12,7 +12,7 @@
     cbonsai
     pipes-rs
     cmatrix
-    cava
+    #cava
     sl
   ];
 }

modules/home/cli/zsh/default.nix

@@ -9,12 +9,14 @@ in {
       "sudo" = "sudo ";
       "devsh" =
         "nix develop --profile /tmp/devsh-env ${nixflake_url}#devsh -c zsh";
+      "cdevsh" =
+        "nix develop --profile /tmp/devsh-env -c zsh";
       "nixb" = "(sudo nixos-rebuild switch --flake ${nixflake_url})";
       "nixgc" = "sudo nix-collect-garbage -d && nix-collect-garbage -d";
       "ssh" = "TERM=xterm-256color  ${pkgs.openssh}/bin/ssh";
       "top" = "btop";
     };
-    initExtra = ''
+    initContent = ''
       sopsu() {nix-shell -p sops --run "sops updatekeys $1";}
       sopsn() {nix-shell -p sops --run "sops $1";}
     '';

modules/home/gui/apps/develop/default.nix

@@ -2,6 +2,6 @@
   imports = [ ./vscodium ];
 
   config = lib.mkIf (config.syscfg.make.develop) {
-    home.packages = with pkgs; [ blender godot_4 ];
+    home.packages = with pkgs; [ blender godot_4 openscad-unstable orca-slicer pandoc claude-code];
   };
 }

modules/home/gui/apps/develop/vscodium/default.nix

@@ -4,14 +4,17 @@
     programs.vscode = {
       enable = true;
       package = pkgs.vscodium;
-      extensions = with pkgs.vscode-extensions; [
+      #profiles.default = {
-        bbenoist.nix
+        profiles.default.extensions = with pkgs.vscode-extensions; [
-        esbenp.prettier-vscode
+          bbenoist.nix
-        golang.go
+          esbenp.prettier-vscode
-        ms-python.vscode-pylance
+          golang.go
-        ms-vscode.cpptools
+          ms-python.vscode-pylance
-        dbaeumer.vscode-eslint
+          ms-vscode.cpptools
-      ];
+          dbaeumer.vscode-eslint
+          continue.continue 
+        ];
+      #};
     };
   };
 }

modules/home/gui/apps/pipewire/default.nix

@@ -25,6 +25,20 @@
                 }
             }
         }
+        {   name = "libpipewire-module-loopback"
+            args = {
+                node.description = "Virtual Loopback"
+                audio.position = [ FL FR ]
+                capture.props = {
+                    media.class = "Audio/Sink"
+                    node.name = "vloopback_sink"
+                }
+                playback.props = {
+                    media.class = "Audio/Source"
+                    node.name = "vloopback_source"
+                }
+            }
+        }
       ]
     '';
   };

modules/home/gui/base/default.nix

@@ -4,15 +4,17 @@
     services.nextcloud-client.enable = true;
 
     home.packages = with pkgs; [
-      xfce.thunar
+      thunar
-      xfce.thunar-volman
+      thunar-volman
-      xfce.thunar-archive-plugin
+      thunar-archive-plugin
-      xfce.tumbler
+      tumbler
 
       telegram-desktop
+      discord-canary
       pavucontrol
       keepassxc
       nextcloud-client
+
       gramps
     ];
   };

modules/home/gui/games/default.nix

@@ -1,20 +1,22 @@
-{ lib, config, pkgs, ... }: {
+{ inputs, lib, config, pkgs, ... }: {
 
-  imports = [ ./openttd.nix ];
+  imports = [ ./openttd.nix ./wow.nix ];
 
   config = lib.mkIf (config.syscfg.make.game) {
 
     home.packages = with pkgs; [
-      # custom.simc
 
       #games
-      steam
+      # steam
       gamemode
-      gamescope
+      #gamescope
-      mangohud
+      #mangohud
       prismlauncher
       openttd-jgrpp
-      bottles
+      #bottles
+      lutris
+      unstable.umu-launcher
+      # wine
     ];
   };
 

modules/home/gui/games/wow.nix

@@ -0,0 +1,23 @@
+{ pkgs, lib, config, sops, ... }: {
+
+  config = lib.mkIf (config.syscfg.make.game) {
+
+    home.packages = with pkgs;
+      [
+        # custom.simc
+        unstable.instawow
+      ];
+
+    # templates buggy currently
+    #xdg.configFile."instawow/config.json" = ''${config.sops.templates."instawow_config.json".path}'';
+    sops.templates."instawow_config.json".content = ''
+       {
+            "auto_update_check": true,
+            "access_tokens": {
+              "cfcore": "${config.sops.placeholder.curse_forge_key}",
+              "github": "${config.sops.placeholder.github_user_key}",
+              "wago_addons": null
+            }
+        }'';
+  };
+}

modules/home/gui/theme/default.nix

@@ -1,6 +1,5 @@
 { lib, config, pkgs, ... }:
 let
-  colorVariant = " black";
   gtkThemeFromScheme = import ./gtk-theme-gen.nix { inherit pkgs config; };
   wallpaperGen = import ./wallpaper-gen.nix { inherit pkgs config; };
 in {
@@ -20,6 +19,7 @@ in {
         name = "${config.colorscheme.slug}-Dark";
         package = gtkThemeFromScheme;
       };
+      gtk4.theme = config.gtk.theme; 
       iconTheme = {
         name = "tela-circle-icon-theme";
         package = pkgs.tela-circle-icon-theme;
@@ -31,7 +31,7 @@ in {
       platformTheme.name = "gtk";
     };
 
-    home.packages = [ wallpaperGen pkgs.swww ];
+    home.packages = [ wallpaperGen pkgs.awww ];
 
     xdg.configFile."script/wallpaper.sh".text = ''
       #!/bin/sh
@@ -50,7 +50,7 @@ in {
 
       IMG=$WPDIR/$(echo "$RES" | wofi --dmenu --allow-images show-icons true -theme-str '#window { width: 50%; }' -p "Choose wallpaper:")
       IMG=$(echo "$IMG" | awk -F ':' '{print $2}')
-      swww img $IMG
+      awww img $IMG
     '';
   };
 }

modules/home/gui/theme/gtk-theme-gen.nix

@@ -11,8 +11,8 @@ in pkgs.stdenv.mkDerivation rec {
   src = pkgs.fetchFromGitHub {
     owner = "vinceliuice";
     repo = "Orchis-theme";
-    rev = "be8b0aff92ed0741174b74c2ee10c74b15be0474";
+    rev = "5b73376721cf307101e22d7031c1f4b1344d1f63";
-    sha256 = "sha256-m7xh/1uIDh2BM0hTPA5QymXQt6yV7mM7Ivg5VaF2PvM=";
+    sha256 = "sha256-+2/CsgJ+rdDpCp+r5B/zys3PtFgtnu+ohTEUOtJNd1Y=";
   };
 
   nativeBuildInputs = with pkgs; [ gtk3 sassc ];
@@ -22,43 +22,43 @@ in pkgs.stdenv.mkDerivation rec {
   preInstall = ''
     mkdir -p $out/share/themes
     cat > src/_sass/_color-palette-${scheme.slug}.scss << 'EOF'
-      $red-light: #${scheme.palette.base0F};
+      $red-light: #${scheme.palette.low0F};
-      $red-dark: #${scheme.palette.base0F};
+      $red-dark: #${scheme.palette.high0F};
 
-      $pink-light: #${scheme.palette.base0E};
+      $pink-light: #${scheme.palette.low0E};
-      $pink-dark: #${scheme.palette.base0E};
+      $pink-dark: #${scheme.palette.high0E};
 
-      $purple-light: #${scheme.palette.base0D};
+      $purple-light: #${scheme.palette.low0D};
-      $purple-dark: #${scheme.palette.base0D};
+      $purple-dark: #${scheme.palette.high0D};
 
-      $blue-light: #${scheme.palette.base0C};
+      $blue-light: #${scheme.palette.low0C};
-      $blue-dark: #${scheme.palette.base0C};
+      $blue-dark: #${scheme.palette.high0C};
 
-      $teal-light: #${scheme.palette.base0B};
+      $teal-light: #${scheme.palette.low0B};
-      $teal-dark: #${scheme.palette.base0B};
+      $teal-dark: #${scheme.palette.high0B};
 
-      $green-light: #${scheme.palette.base0A};
+      $green-light: #${scheme.palette.low0A};
-      $green-dark: #${scheme.palette.base0A};
+      $green-dark: #${scheme.palette.high0A};
-      $sea-light: #${scheme.palette.base0B};
+      $sea-light: #${scheme.palette.alt_low0B};
-      $sea-dark: #${scheme.palette.base0B};
+      $sea-dark: #${scheme.palette.alt_high0B};
 
-      $yellow-light: #${scheme.palette.base09};
+      $yellow-light: #${scheme.palette.low09};
-      $yellow-dark: #${scheme.palette.base09};
+      $yellow-dark: #${scheme.palette.low09};
 
-      $orange-light: #${scheme.palette.base08};
+      $orange-light: #${scheme.palette.low08};
-      $orange-dark: #${scheme.palette.base08};
+      $orange-dark: #${scheme.palette.high08};
 
       $grey-050: #${scheme.palette.base07};
       $grey-100: #${scheme.palette.base07};
-      $grey-150: #${scheme.palette.base07};
+      $grey-150: #${scheme.palette.base06};
       $grey-200: #${scheme.palette.base06};
-      $grey-250: #${scheme.palette.base06};
+      $grey-250: #${scheme.palette.base05};
       $grey-300: #${scheme.palette.base05};
-      $grey-350: #${scheme.palette.base05};
+      $grey-350: #${scheme.palette.base04};
       $grey-400: #${scheme.palette.base04};
-      $grey-450: #${scheme.palette.base04};
+      $grey-450: #${scheme.palette.base03};
       $grey-500: #${scheme.palette.base03};
-      $grey-550: #${scheme.palette.base03};
+      $grey-550: #${scheme.palette.base02};
       $grey-600: #${scheme.palette.base02};
       $grey-650: #${scheme.palette.base02};
       $grey-700: #${scheme.palette.base01};

modules/home/gui/theme/wallpaper-gen.nix

@@ -1,40 +1,150 @@
-{ pkgs, config }:
+{ pkgs, config, lib ? pkgs.lib }:
 
 let
-  scheme = config.colorScheme;
+  colors = config.colorScheme.palette;
-  colors = scheme.palette;
+  mediaImages = config.syscfg.media.main;
-  dither =
+  mediaNames = map (image: builtins.baseNameOf (toString image)) mediaImages;
-    "atkinson"; # none | floyd-steinberg | atkinson | jjn | burkes | sierra | sierra-lite
+  mediaSourceDir = pkgs.linkFarm "wallpaper-media" (
-in pkgs.stdenv.mkDerivation rec {
+    map (image: {
-  pname = "generated-wallpaper";
+      name = builtins.baseNameOf (toString image);
-  version = "a1676fc2a0e3dfb7bf95d8a89e592830";
+      path = image;
-  src = pkgs.fetchFromGitea {
+    }) mediaImages
-    domain = "git.helcel.net";
+  );
-    owner = "sora";
+
-    repo = "nixconfig-wallpaper";
+  dither = "atkinson"; # none | floyd-steinberg | atkinson | jjn | burkes | sierra | sierra-lite
-    rev = version;
+  paletteSize = 0;
-    sha256 = "sha256-ZhBjTaKzoiEq1ptMmNWWRPCjLJsvy9My/HuzRaDjX1c=";
+
+  hexChars = "0123456789abcdef";
+  hexMap = {
+    "0" = 0; "1" = 1; "2" = 2; "3" = 3;
+    "4" = 4; "5" = 5; "6" = 6; "7" = 7;
+    "8" = 8; "9" = 9; "a" = 10; "b" = 11;
+    "c" = 12; "d" = 13; "e" = 14; "f" = 15;
   };
 
-  buildInputs = with pkgs; [ custom.repalette nodejs imagemagick gifsicle ];
+  baseColors = [
+    colors.base00
+    colors.base01
+    colors.base02
+    colors.base03
+    colors.base04
+    colors.base05
+    colors.base06
+    colors.base07
+    colors.base08
+    colors.base09
+    colors.base0A
+    colors.base0B
+    colors.base0C
+    colors.base0D
+    colors.base0E
+    colors.base0F
+  ];
 
-  configurePhase = ''
+  round = x: builtins.floor (x + 0.5);
-    echo "${colors.base00},${colors.base01},\
+  clamp = x:
-          ${colors.base02},${colors.base03},\
+    if x < 0 then 0 else if x > 255 then 255 else x;
-          ${colors.base04},${colors.base05},\
+  parseHexByte = byte:
-          ${colors.base06},${colors.base07},\
+    let
-          ${colors.base08},${colors.base09},\
+      hi = hexMap.${builtins.substring 0 1 byte};
-          ${colors.base0A},${colors.base0B},\
+      lo = hexMap.${builtins.substring 1 1 byte};
-          ${colors.base0C},${colors.base0D},\
+    in
-          ${colors.base0E},${colors.base0F}" > palette.in
+    hi * 16 + lo;
-  '';
+  hexToRgb = hex:
+    let
+      clean = lib.toLower (lib.removePrefix "#" hex);
+    in
+    {
+      r = parseHexByte (builtins.substring 0 2 clean);
+      g = parseHexByte (builtins.substring 2 2 clean);
+      b = parseHexByte (builtins.substring 4 2 clean);
+    };
+  componentToHex = value:
+    let
+      bounded = clamp value;
+      hi = builtins.div bounded 16;
+      lo = bounded - hi * 16;
+    in
+    "${builtins.substring hi 1 hexChars}${builtins.substring lo 1 hexChars}";
+  rgbToHex = color: "${componentToHex color.r}${componentToHex color.g}${componentToHex color.b}";
+
+  getTint = c: weight: round (c + (255 - c) * weight);
+  getShade = c: weight: round (c * weight);
+  tint = color: weight: {
+    r = getTint color.r weight;
+    g = getTint color.g weight;
+    b = getTint color.b weight;
+  };
+  shade = color: weight: {
+    r = getShade color.r weight;
+    g = getShade color.g weight;
+    b = getShade color.b weight;
+  };
+  genPalette = color:
+    let
+      tints =
+        if paletteSize == 0
+        then [ ]
+        else lib.genList (i: tint color ((i + 1.0) / paletteSize)) paletteSize;
+      shades =
+        if paletteSize == 0
+        then [ ]
+        else lib.genList (i: shade color (i * 1.0 / paletteSize)) paletteSize;
+    in
+    lib.reverseList tints ++ [ color ] ++ lib.reverseList shades;
+  keepColor = color:
+    let
+      sum = color.r + color.g + color.b;
+    in
+    sum > 0 && sum < 765;
+
+  paletteColors = lib.concatMap (hex: lib.filter keepColor (genPalette (hexToRgb hex))) baseColors;
+  paletteHex = lib.concatStringsSep "," (map rgbToHex paletteColors);
+  gifPaletteFile = pkgs.writeText "wallpaper-gifpalette.txt" (
+    lib.concatMapStringsSep "\n" (color: "${toString color.r} ${toString color.g} ${toString color.b}") paletteColors
+  );
+
+  buildCommands =
+    lib.concatMapStringsSep "\n" (name:
+      let
+        source = "${mediaSourceDir}/${name}";
+        target = "build/${name}";
+      in
+      if lib.hasSuffix ".gif" (lib.toLower name) then ''
+        gifsicle --use-colormap ${lib.escapeShellArg (toString gifPaletteFile)} < ${lib.escapeShellArg source} > ${lib.escapeShellArg target}
+      '' else ''
+        repalette ${lib.escapeShellArg source} ${lib.escapeShellArg target} -p ${lib.escapeShellArg paletteHex} --dither ${lib.escapeShellArg dither}
+      ''
+    ) mediaNames;
+in
+assert lib.assertMsg
+  (builtins.length mediaNames == builtins.length (lib.unique mediaNames))
+  "syscfg.media.main contains duplicate basenames, which would collide in generated wallpaper output.";
+pkgs.stdenv.mkDerivation {
+  pname = "generated-wallpaper";
+  version = "local";
+  dontUnpack = true;
+
+  nativeBuildInputs = with pkgs; [
+    custom.repalette
+    gifsicle
+  ];
 
   buildPhase = ''
-    make DITHER=${dither} PALETTE_SIZE=0 all
+    runHook preBuild
+
+    mkdir -p build
+    ${buildCommands}
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/wallpaper
-    cp -r build/* $out/share/wallpaper/
+    cp -r build/. $out/share/wallpaper/
+
+    runHook postInstall
   '';
 }

modules/home/wayland/apps/dunst/default.nix

@@ -46,7 +46,7 @@
           min_icon_size = 32;
           max_icon_size = 64;
 
-          icon_path =
+          icon_path = lib.mkForce 
             "${pkgs.tela-circle-icon-theme}/share/icons/Tela-circle-dark/32/status:${pkgs.tela-circle-icon-theme}/share/icons/Tela-circle-dark/32/device ";
           icon_theme = "Tela-circle-dark";
           enable_recursive_icon_lookup = "true";

modules/home/wayland/apps/eww/bar/modules/clock.yuck

@@ -5,8 +5,8 @@
     (eventbox
       :onhover "${EWW_CMD} update date_rev=true"
       :onhoverlost "${EWW_CMD} update date_rev=false"
-      :onclick "(sleep 0.1 && ${EWW_CMD} open --toggle calendar)"
+      :onclick "(sleep 0.1 && eww-open-on-current-screen calendar --toggle)"
-      :onrightclick "(sleep 0.1 && ${EWW_CMD} open --toggle powermenu)"
+      :onrightclick "(sleep 0.1 && eww-open-on-current-screen powermenu --toggle)"
       (box
         :class "datetime"
         (overlay

modules/home/wayland/apps/eww/bar/modules/sys.yuck

@@ -7,7 +7,7 @@
 (defwidget sys-mod []
   (module
     (eventbox
-      :onclick "(sleep 0.1 && ${EWW_CMD} open --toggle sys)"
+      :onclick "(sleep 0.1 && eww-open-on-current-screen sys --toggle)"
       (box
         :orientation "v"
           (circular-progress

modules/home/wayland/apps/eww/bar/modules/workspaces.yuck

@@ -3,13 +3,14 @@
 (defwidget workspace-mod []
   	(module
   	  	(eventbox
-		:onscroll "echo {} | sed -e \"s/up/-1/g\" -e \"s/down/+1/g\" | xargs hyprctl dispatch workspace"
+			:onscroll "echo {} | sed -e 's/up/-1/' -e 's/down/+1/' | xargs -I % hyprctl eval \"hl.dispatch(hl.dsp.focus({ workspace = '%' }))\""
+
 			(box
 				:class "module workspaces"
 				:orientation "v"
 				(for ws in workspace
 					(button
-						:onclick "hyprctl dispatch workspace ${ws.number}"
+						:onclick "hyprctl  eval \"hl.dispatch(hl.dsp.focus({ workspace = '${ws.number}' }))\""
 						(label 
 							:show-truncated false
 							:class "icon-text  ${ws.color}"

modules/home/wayland/apps/eww/bar/scripts/net/net

@@ -6,6 +6,10 @@ function get_time_ms {
 
 icons=("󰤯" "󰤟" "󰤢" "󰤥" "󰤨")
 
+function get_wifi_interface() {
+  awk 'NR > 2 { gsub(":", "", $1); print $1; exit }' /proc/net/wireless
+}
+
 function toggle() {
   status=$(rfkill | grep wlan | awk '{print $4}')
 
@@ -17,7 +21,8 @@ function toggle() {
 }
 
 function gen_wifi() {
-  signal=$(cat /proc/net/wireless | head -n3 | tail -n1 | awk '{print $3}')
+  wifi_iface=$(get_wifi_interface)
+  signal=$(awk -v iface="$wifi_iface" '$1 == iface ":" { print $3; exit }' /proc/net/wireless)
   level=$(awk -v n="$signal" 'BEGIN{print int((n-1)/20)}')
   if [ "$level" -gt 4 ]; then
     level=4
@@ -26,8 +31,8 @@ function gen_wifi() {
   icon=${icons[$level]}
   ip="-"
   class="net-connected"
-  name_raw=$(wpa_cli status | grep \^ssid= | sed 's/ssid=//g')
+  name_raw=$(wpa_cli -g "/run/wpa_supplicant/$wifi_iface" status | grep \^ssid= | sed 's/ssid=//g')
-  name=$(printf "%s" $name_raw)
+  name=$(printf "%s" "$name_raw")
 }
 
 function gen_ethernet() {
@@ -38,9 +43,12 @@ function gen_ethernet() {
 }
 
 function make_content() {
-  local ethernet wifi
+  local ethernet wifi wifi_iface
   ethernet=$(ip link | rg "^[0-9]+: en[po]+" | head -n1 | sed 's/[a-zA-Z0-9_,><:\ -]*state //g' | sed 's/ mode [a-zA-Z0-9 ]*//g')
-  wifi=$(wpa_cli status | rg "^wpa_state=" | sed 's/wpa_state=//g')
+  wifi_iface=$(get_wifi_interface)
+  if [ -n "$wifi_iface" ]; then
+    wifi=$(wpa_cli -g "/run/wpa_supplicant/$wifi_iface" status | rg "^wpa_state=" | sed 's/wpa_state=//g')
+  fi
 
   # test ethernet first
   if [[ $ethernet == "UP" ]]; then

modules/home/wayland/apps/eww/bar/windows/powermenu.yuck

@@ -25,7 +25,7 @@
                                 
         (powermenu_entry    :label "Sign out" 
                             :icon "󰗼" 
-                            :onclick "hyprctl dispatch exit 0")
+                            :onclick "hyprctl eval \"hl.dispatch(hl.dsp.exit())\"")
 
         (powermenu_entry    :label "Cancel" 
                             :icon "󰅖" 

modules/home/wayland/apps/eww/bar/windows/radio.yuck

@@ -100,7 +100,7 @@
     (box
       :orientation "v"
       (button
-        :onclick "(sleep 0.1 && ${EWW_CMD} open --toggle --no-daemonize radio)"
+        :onclick "(sleep 0.1 && eww-open-on-current-screen radio --toggle --no-daemonize)"
         (label 
           :show-truncated false
           :class "icon-text" 

modules/home/wayland/apps/eww/default.nix

@@ -1,7 +1,21 @@
-{ lib, config, pkgs, ... }: {
+{ lib, config, pkgs, ... }:
+let
+  openOnCurrentScreen = pkgs.writeShellScriptBin "eww-open-on-current-screen" ''
+    window="$1"
+    shift
+
+    screen="$(hyprctl monitors -j | ${lib.getExe pkgs.jq} -r '.[] | select(.focused == true) | .name' | head -n1)"
+
+    if [ -n "$screen" ]; then
+      exec ${lib.getExe pkgs.eww} open "$window" --screen "$screen" "$@"
+    fi
+
+    exec ${lib.getExe pkgs.eww} open "$window" "$@"
+  '';
+in {
 
   config = lib.mkIf (config.usercfg.wm == "Wayland") {
-    home.packages = with pkgs; [ eww jq jaq custom.amdgpu_top ];
+    home.packages = with pkgs; [ eww jq jaq custom.amdgpu_top openOnCurrentScreen ];
 
     xdg.configFile."eww" = {
       source = lib.cleanSourceWith {

modules/home/wayland/apps/kanshi/default.nix

@@ -1,4 +1,12 @@
-{ config, lib, ... }: {
+{ config, lib, pkgs, ... }:
+let
+  restartEwwBar = monitor: pkgs.writeShellScript "restart-eww-bar-after-kanshi-${toString monitor}" ''
+
+    sleep 1
+    ${lib.getExe pkgs.eww} close bar || true
+    ${lib.getExe pkgs.eww} open bar --screen ${toString monitor}
+  '';
+in {
 
   config = lib.mkIf (config.usercfg.wm == "Wayland") {
     services.kanshi = {
@@ -7,47 +15,59 @@
       settings = [
         {
           profile.name = "tower_0";
-          profile.outputs = [{
+          profile.exec = [ "${restartEwwBar 1}" ];
-            criteria = "CEX CX133 0x00000001";
-            mode = "1920x1200@59.972";
-            position = "0,0";
-            scale = 1.0;
-            status = "enable";
-          }];
-        }
-        {
-          profile.name = "tower_1";
-          profile.outputs = [{
-            criteria = "AOC 16G3 1DDP7HA000348";
-            mode = "1920x1080@144.000";
-            position = "0,0";
-            status = "enable";
-            scale = 1.0;
-            adaptiveSync = true;
-          }];
-        }
-        {
-          profile.name = "tower_2";
           profile.outputs = [
             {
-              criteria = "AOC 16G3 1DDP7HA000348";
+              criteria = "AOC 24E1W1 GNSKCHA086899";
-              mode = "1920x1080@144.000";
+              mode = "1920x1080@60.000";
               position = "0,0";
               status = "enable";
               scale = 1.0;
               adaptiveSync = true;
             }
             {
-              criteria = "CEX CX133 0x00000001";
+              criteria = "AOC 24E1W1 GNSKBHA080346";
-              mode = "1920x1200@59.972";
+              mode = "1920x1080@60.000";
-              position = "0,1080";
+              position = "1920,0";
-              scale = 1.0;
               status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
+            }
+          ];
+        }
+        {
+          profile.name = "tower_1";
+          profile.exec = [ "${restartEwwBar 1}" ];
+          profile.outputs = [
+            {
+              criteria = "AOC 24E1W1 GNSKCHA086899";
+              mode = "1920x1080@60.000";
+              position = "0,0";
+              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
+            }
+            {
+              criteria = "AOC 24E1W1 GNSKBHA080346";
+              mode = "1920x1080@60.000";
+              position = "0,0";
+              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
+            }
+            {
+              criteria = "LG UNKNOWN_TBD";
+              mode = "1920x1080@144.000";
+              position = "0,0";
+              status = "enable";
+              scale = 1.0;
+              adaptiveSync = true;
             }
           ];
         }
         {
           profile.name = "laptop_0";
+          profile.exec = [ "${restartEwwBar 0}" ];
           profile.outputs = [{
             criteria = "LG Display 0x060A Unknown";
             mode = "1920x1080@60.020";
@@ -58,6 +78,7 @@
         }
         {
           profile.name = "laptop_1";
+          profile.exec = [ "${restartEwwBar 1}" ];
           profile.outputs = [
             {
               criteria = "CEX CX133 0x00000001";
@@ -77,6 +98,7 @@
         }
         {
           profile.name = "laptop_2";
+          profile.exec = [ "${restartEwwBar 1}" ];
           profile.outputs = [
             {
               criteria = "AOC 16G3 1DDP7HA000348";

modules/home/wayland/apps/waybar/default.nix

@@ -146,8 +146,8 @@ in {
             "9" = [ ];
             "10" = [ ];
           };
-          "on-scroll-up" = "hyprctl dispatch workspace r-1";
+          "on-scroll-up" = "hyprctl eval \"hl.dispatch(hl.dsp.focus({ workspace = '-1' }))\"";
-          "on-scroll-down" = "hyprctl dispatch workspace r+1";
+          "on-scroll-down" = "hyprctl eval \"hl.dispatch(hl.dsp.focus({ workspace = '+1' }))\"";
         };
 
         "backlight" = {
@@ -232,7 +232,7 @@ in {
         "custom/powermenu" = {
           "format" = "{icon}";
           "format-icons" = [ "󰐥" ];
-          "on-click" = "eww open powermenu";
+          "on-click" = "eww-open-on-current-screen powermenu";
           "tooltip" = false;
         };
         "tray" = {

modules/home/wayland/apps/waylock/default.nix

@@ -5,6 +5,8 @@
 
     xdg.configFile."swaylock/config".text = ''
       screenshots
+      grace-no-mouse
+      grace-no-touch
       grace=5
       effect-pixelate=5
       fade-in=0.2

modules/home/wayland/base/default.nix

@@ -17,8 +17,12 @@ in {
       dbus-hyprland-environment
       wayland
 
-      grim
+      hyprpicker
+      
+      hyprshot
       slurp
+      satty
+
       swappy
       cliphist
       wl-clipboard
@@ -30,7 +34,7 @@ in {
       glib
 
       brightnessctl
-      swww
+      awww
     ];
 
     xdg.mimeApps = {
@@ -42,6 +46,8 @@ in {
           [ "discord-402572971681644545.desktop" ];
         "x-scheme-handler/discord-696343075731144724" =
           [ "discord-696343075731144724.desktop" ];
+        "x-scheme-handler/tg" = [ "org.telegram.desktop.desktop" ];
+        "x-scheme-handler/tonsite" = [ "org.telegram.desktop.desktop" ];
         "x-scheme-handler/http" = [ "firefox.desktop" ];
         "x-scheme-handler/https" = [ "firefox.desktop" ];
         "x-scheme-handler/chrome" = [ "firefox.desktop" ];

modules/home/wayland/hyprland/config.nix

@@ -1,233 +1,332 @@
-{ lib, config, pkgs, ... }: {
+{ lib, config, pkgs, ... }: let
-  config = lib.mkIf (config.usercfg.wm == "Wayland") {
+  lua = lib.generators.mkLuaInline;
 
+  bind = keys: dispatcher: { _args = [ keys dispatcher ]; };
+  bindOpts = keys: dispatcher: opts: { _args = [ keys dispatcher opts ]; };
+
+  dsp = {
+    exec = cmd: lua ''hl.dsp.exec_cmd("${cmd}")'';
+    close = lua "hl.dsp.window.close()";
+    exit = lua "hl.dsp.exit()";
+    float = lua ''hl.dsp.window.float({ action = "toggle" })'';
+    fullscreen = lua "hl.dsp.window.fullscreen()";
+    pseudo = lua "hl.dsp.window.pseudo()";
+    layout = msg: lua ''hl.dsp.layout("${msg}")'';
+    focus = dir: lua ''hl.dsp.focus({ direction = "${dir}" })'';
+    swap = dir: lua ''hl.dsp.window.swap({ direction = "${dir}" })'';
+    toggleSpecial = name: lua ''hl.dsp.workspace.toggle_special("${name}")'';
+    moveToSpecial = name: lua ''hl.dsp.window.move({ workspace = "special:${name}" })'';
+    focusWorkspace = ws: lua ''hl.dsp.focus({ workspace = "${toString ws}" })'';
+    moveToWorkspace = ws: lua ''hl.dsp.window.move({ workspace = "${toString ws}", follow = false})'';
+    drag = lua "hl.dsp.window.drag()";
+    resize = lua "hl.dsp.window.resize()";
+  };
+  
+
+  startupScript = pkgs.writeShellScriptBin "hyprland-start" ''
+    eww-open-on-current-screen bar &
+    awww-daemon &
+
+    sleep 2
+    keepassxc &
+    firefox &
+    jellyfin-mpv-shim &
+    easyeffects --gapplication-service &
+
+    sleep 2
+    nextcloud &
+    # telegram-desktop &
+    # discord &
+  '';
+in {
+  config = lib.mkIf (config.usercfg.wm == "Wayland") {
     wayland.windowManager.hyprland = {
       enable = true;
       xwayland.enable = true;
-      extraConfig = ''
+      configType = "lua";
-        monitor=,preferred,auto,auto
+      settings = {
+        on = {
+          _args = [
+            "hyprland.start"
+            (lua ''
+              function()
+                hl.exec_cmd("dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP")
+                hl.exec_cmd("${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1")
+                hl.exec_cmd("wl-paste --type text --watch cliphist store")
+                hl.exec_cmd("wl-paste --type image --watch cliphist store")
+                hl.exec_cmd("swayidle -w timeout 600 'swaylock' before-sleep 'swaylock'")
+                hl.exec_cmd("${lib.getExe startupScript}")
+                hl.exec_cmd("[workspace special:magic silent] kitty --title flying_kitty")
+              end'')
+          ];
+        };
 
-        input {
+        monitor = [{
-            kb_layout = us, ru
+          output = "";
-            kb_variant = intl, phonetic
+          mode = "preferred";
-            kb_options = grp:ctrls_toggle
+          position = "auto";
+          scale = "auto";
+          bitdepth = 10;
+        }];
+        #Fullscreen HDR is possible without the hdr cm setting if "render:cm_auto_hdr" is enabled.
 
-            follow_mouse = 1
+        config = {
+          input = {
+            kb_layout = "us";
+            kb_variant = "intl";#, phonetic";
+            kb_options = "grp:alt_shift_toggle";
+            follow_mouse = 1;
+            sensitivity = 0;
 
-            sensitivity = 0 # -0.5 # -1.0 - 1.0, 0 means no modification.
+            touchpad = {
+              natural_scroll = false;
+              scroll_factor = 1;
+              disable_while_typing = false;
+              tap_to_click = false;
+            };
+          };
 
-            touchpad {
+          misc = {
-                natural_scroll=no
+            force_default_wallpaper = -1;
-                disable_while_typing=true
+            disable_hyprland_logo = true;
-                scroll_factor=1
+            animate_mouse_windowdragging = false;
-                disable_while_typing=0
+            animate_manual_resizes = false;
-                tap-to-click=0
+            vrr = 1;
+          };
+          general = {
+            gaps_in = config.colorScheme.palette.gaps-window;
+            gaps_out = config.colorScheme.palette.gaps-screen;
+            border_size = lib.toInt config.colorScheme.palette.border-width;
+            col = {
+              active_border = "rgb(${config.colorScheme.palette.base04})";
+              inactive_border = "rgb(${config.colorScheme.palette.base03})";
+            };
+            layout = "dwindle";
+          };
+
+          decoration = {
+            rounding = lib.toInt config.colorScheme.palette.border-radius;
+            inactive_opacity = 1.0;
+            active_opacity = 1.0;
+            fullscreen_opacity = 1.0;
+
+            blur = {
+              enabled = true;
+              size = 2;
+              passes = 1;
+              new_optimizations = true;
+            };
+          };
+
+          dwindle = {
+            #pseudotile = true;
+            preserve_split = true;
+          };
+          animations = {
+            enabled = true;
+          };
+
+          master = {
+            new_status = "master";
+          };
+        };
+
+        curve = [{
+          _args = [
+            "customcurve"
+            {
+              type = "bezier";
+              points = lua "{ {0.0, 0.9}, {0.1, 1.0} }";
             }
-        }
+          ];
+        }];
 
-        misc {
+        animation = [
-            disable_hyprland_logo=true
+          { leaf = "windows"; enabled = true; speed = 4; bezier = "customcurve"; }
-            animate_mouse_windowdragging=false
+          { leaf = "windowsOut"; enabled = true; speed = 4; bezier = "customcurve"; style = "popin 80%"; }
-            animate_manual_resizes=false
+          { leaf = "border"; enabled = true; speed = 10; bezier = "customcurve"; }
+          { leaf = "borderangle"; enabled = true; speed = 1; bezier = "customcurve"; }
+          { leaf = "fade"; enabled = true; speed = 4; bezier = "customcurve"; }
+          { leaf = "workspaces"; enabled = true; speed = 4; bezier = "customcurve"; }
+        ];
 
-            vrr=1
-        }
 
-        general {
+        gesture = {
-            gaps_in = ${config.colorScheme.palette.gaps-window}
+          fingers = 3;
-            gaps_out = ${config.colorScheme.palette.gaps-screen}
+          direction = "vertical";
-            border_size = ${config.colorScheme.palette.border-width}
+          action = "workspace";
+        };
 
-            col.active_border = rgb(${config.colorScheme.palette.base04})
+        window_rule = [
-            col.inactive_border = rgb(${config.colorScheme.palette.base03})
+          { match.title = "noshadow"; float= false;}
-                          
+          {
-            layout = dwindle
+            match.title = "^(flying_kitty)$";
-        }
+            float = true;
-                        
+            center = true;
-        decoration {
+            size = "1100 600";
-            rounding = ${config.colorScheme.palette.border-radius}
+            move = "{0 600}";
-                          
+            animation = "slide";
-            blur {
+          }
-                enabled = true
+          { match.title = "^(Volume Control)$"; float = true; }
-                size = 2
+          { match.title = "^(Picture-in-Picture)$"; float = true; }
-                passes = 1
+          { match.title = "^(Steam)$"; float = true; }
-                new_optimizations = true
+          # --- Chat & Workspace Assignments ---
+            { match.class = "^(org.telegram.desktop)$"; workspace = "2 silent"; }
+            { match.class = "^(discord)$"; workspace = "2 silent"; }
+            { match.class = "^(org.keepassxc.KeePassXC)$"; workspace = "8 silent"; }
+            { match.title = "^(Nextcloud)$"; workspace = "8 silent"; }
+            { match.class = "^(org.telegram.desktop)$"; match.title = "^(Media viewer)$"; float = true; center = true; }
+            { 
+              match.class = "^(Tk)$"; 
+              match.title = "^(Server Configuration)$"; 
+              workspace = "8 silent"; 
             }
-            #multisample_edges = true
+              # --- KeePassXC Dialogs ---
+            {
+              match.class = "^(org.keepassxc.KeePassXC)$";
+              match.title = "^(KeePassXC -  Access Request)$";
+              float = true;
+              pin = true;
+            }
+            {
+              match.class = "^(org.keepassxc.KeePassXC)$";
+              match.title = "^(Unlock Database - KeePassXC)$";
+              float = true;
+              pin = true;
+            }
+            # --- Generic System / File Dialogs ---
+            { match.title = "^(Open)$"; float = true; }
+            { match.title = "^(Choose Files)$"; float = true; }
+            { match.title = "^(Save As)$"; float = true; }
+            { match.title = "^(Confirm to replace files)$"; float = true; }
+            { match.title = "^(File Operation Progress)$"; float = true; }
 
-            #opactity
+            # --- Firefox Window Rules ---
-            inactive_opacity = 1.0
+            {
-            active_opacity = 1.0
+              match.class = "^(firefox)$";
-            fullscreen_opacity = 1.0
+              match.title = "^(Picture-in-Picture)$";
+              float = true;
+              pin = true;
+              suppress_event = "fullscreen";
+            }
+            {
+              match.class = "^(firefox)$";
+              match.title = "^(Firefox — Sharing Indicator)$";
+              float = true;
+              suppress_event = "fullscreen";
+            }
+            {
+              match.class = "^(firefox)$";
+              match.title = "^(Extension:.* Mozilla Firefox)$";
+              float = true;
+              suppress_event = "fullscreen";
+            }
 
-            # shadow
+            # --- Telegram Media Viewer ---
-            drop_shadow = no
+            {
-            shadow_range = 60
+              match.class = "^(org.telegram.desktop)$";
-            shadow_offset = 0 5
+              match.title = "^(Media viewer)$";
-            shadow_render_power = 4
+              float = true;
-            #col.shadow = rgba(00000099)
+              center = true;
-        }
+            }
 
-        animations {
+            # --- Idle Inhibition ---
-            enabled = true
+            { match.class = "^(.*)$"; idle_inhibit = "fullscreen"; }
-            bezier = customcurve, 0.0, 0.9, 0.1, 1.0
+            { match.class = "^(steam_app_.*)$"; idle_inhibit = "focus"; }
+            { match.class = "^(mpv)$"; idle_inhibit = "focus"; }
 
-            animation = windows, 1, 4, customcurve
+        ];
-            animation = windowsOut, 1, 4, customcurve, popin 50%
-            animation = border, 1, 10, customcurve
-            animation = borderangle, 0, 1, customcurve
-            animation = fade, 1, 4, customcurve
-            animation = workspaces, 1, 4, customcurve
-        }
 
-        dwindle {
+        # windowrule = [ "noshadow, floating:0" ];
-            pseudotile = yes
-            preserve_split = yes 
-        }
 
-        master {
+        # windowrulev2 = [
-            new_is_master = true
+        #   "workspace 2 silent, class:^(org.telegram.desktop)$"
-        }
+        #   "workspace 2 silent, class:^(discord)$"
+        #   "workspace 8 silent, class:^(org.keepassxc.KeePassXC)$"
+        #   "workspace 8 silent, title:^(Nextcloud)$"
+        #   "workspace 8 silent, class:^(Tk)$,title:^(Server Configuration)$"
+        #   "float,class:^(org.keepassxc.KeePassXC)$,title:^(KeePassXC -  Access Request)$"
+        #   "pin,class:^(org.keepassxc.KeePassXC)$,title:^(KeePassXC -  Access Request)$"
+        #   "float,class:^(org.keepassxc.KeePassXC)$,title:^(Unlock Database - KeePassXC)$"
+        #   "pin,class:^(org.keepassxc.KeePassXC)$,title:^(Unlock Database - KeePassXC)$"
+        #   "float,title:^(Open)$"
+        #   "float,title:^(Choose Files)$"
+        #   "float,title:^(Save As)$"
+        #   "float,title:^(Confirm to replace files)$"
+        #   "float,title:^(File Operation Progress)$"
+        #   "float,class:^(firefox)$,title:^(Picture-in-Picture)$"
+        #   "pin,class:^(firefox)$,title:^(Picture-in-Picture)$"
+        #   "suppressevent fullscreen,class:^(firefox)$,title:^(Picture-in-Picture)$"
+        #   "float,class:^(firefox)$,title:^(Firefox — Sharing Indicator)$"
+        #   "suppressevent fullscreen,class:^(firefox)$,title:^(Firefox — Sharing Indicator)$"
+        #   "float,class:^(firefox)$,title:^(Extension:.* Mozilla Firefox)$"
+        #   "suppressevent fullscreen,class:^(firefox)$,title:^(Extension:.* Mozilla Firefox)$"
+        #   "float,class:^(org.telegram.desktop)$,title:^(Media viewer)$"
+        #   "center,class:^(org.telegram.desktop)$,title:^(Media viewer)$"
+        #   "idleinhibit fullscreen, class:^(.*)"
+        #   "idleinhibit focus, class:^(steam_app_.*)$"
+        #   "idleinhibit focus, class:^(mpv)$"
+        # ];
 
-        gestures {
+        layer_rule = [ {
-            workspace_swipe = off
+          match.namespace = "^eww%-blur$";
-        }
+          blur = true;
+          ignore_alpha = 0.5;
+        }];
 
-        exec-once = eww open bar
+        bind = [
-        #exec-once = waybar
+          (bind "SUPER + RETURN" (dsp.exec "kitty"))
-        exec-once = dunst
+          (bind "SUPER + SHIFT + RETURN" (dsp.toggleSpecial "magic"))
+          (bind "SUPER + SHIFT + S" (dsp.moveToSpecial "magic"))
+          (bind "SUPER + Q" dsp.close)
+          (bind "SUPER + T" dsp.float)
+          (bind "SUPER + F" dsp.fullscreen)
+          (bind "SUPER + P" dsp.pseudo)
+          (bind "SUPER + J" (dsp.layout "togglesplit"))
+          (bind "SUPER + D" (dsp.exec "wofi -modi --show drun"))
+          (bind "SUPER + SHIFT + D" (dsp.exec "~/.config/hypr/themes/apatheia/eww/launch_bar"))
+          (bind "SUPER + V" (dsp.exec "cliphist list | wofi -dmenu | cliphist decode | wl-copy"))
+          (bind "PRINT" (dsp.exec "hyprshot -m region --raw | satty --filename - --early-exit --action-on-enter save-to-clipboard --copy-command 'wl-copy'"))
+          (bind "SUPER + L" (dsp.exec "swaylock"))
+          (bind "SUPER + left" (dsp.focus "left"))
+          (bind "SUPER + right" (dsp.focus "right"))
+          (bind "SUPER + up" (dsp.focus "up"))
+          (bind "SUPER + down" (dsp.focus "down"))
+          (bind "SUPER + mouse_down" (dsp.focusWorkspace "e+1"))
+          (bind "SUPER + mouse_up" (dsp.focusWorkspace "e-1"))
 
-        exec-once = swww init
+          (bind "SUPER + 1" (dsp.focusWorkspace 1))
-
+          (bind "SUPER + SHIFT + 1" (dsp.moveToWorkspace 1))
-        exec-once = dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
+          (bind "SUPER + 2" (dsp.focusWorkspace 2))
-        exec-once = /nix/store/$(ls -la /nix/store | grep 'polkit-gnome' | grep '4096' | awk '{print $9}' | sed -n '$p')/libexec/polkit-gnome-authentication-agent-1 & 
+          (bind "SUPER + SHIFT + 2" (dsp.moveToWorkspace 2))
-
+          (bind "SUPER + 3" (dsp.focusWorkspace 3))
-        exec-once = wl-paste --type text --watch cliphist store #Stores only text data
+          (bind "SUPER + SHIFT + 3" (dsp.moveToWorkspace 3))
-        exec-once = wl-paste --type image --watch cliphist store #Stores only image data
+          (bind "SUPER + 4" (dsp.focusWorkspace 4))
-
+          (bind "SUPER + SHIFT + 4" (dsp.moveToWorkspace 4))
-        exec-once = swayidle -w timeout 600 'swaylock' before-sleep 'swaylock'
+          (bind "SUPER + 5" (dsp.focusWorkspace 5))
-
+          (bind "SUPER + SHIFT + 5" (dsp.moveToWorkspace 5))
-
+          (bind "SUPER + 6" (dsp.focusWorkspace 6))
-        #windowrules
+          (bind "SUPER + SHIFT + 6" (dsp.moveToWorkspace 6))
-        windowrule = noshadow, floating:0
+          (bind "SUPER + 7" (dsp.focusWorkspace 7))
-
+          (bind "SUPER + SHIFT + 7" (dsp.moveToWorkspace 7))
-        windowrule = float, title:^(flying_kitty)$
+          (bind "SUPER + 8" (dsp.focusWorkspace 8))
-        windowrule = size 1100 600, title:^(flying_kitty)$
+          (bind "SUPER + SHIFT + 8" (dsp.moveToWorkspace 8))
-        windowrule = move center, title:^(flying_kitty)$
+          (bind "SUPER + 9" (dsp.focusWorkspace 9))
-        windowrule = animation slide, title:^(flying_kitty)$
+          (bind "SUPER + SHIFT + 9" (dsp.moveToWorkspace 9))
-        windowrule = float, title:^(Volume Control)$
+          (bind "SUPER + 0" (dsp.focusWorkspace 0))
-        windowrule = float, title:^(Picture-in-Picture)$
+          (bind "SUPER + SHIFT + 0" (dsp.moveToWorkspace 0))
-        windowrule = float, title:^(Steam)$
+          (bind "XF86AudioPlay" (dsp.exec "playerctl play-pause"))
-
+          (bind "XF86AudioPrev" (dsp.exec "playerctl previous"))
-        windowrulev2 = workspace 2 silent, class:^(org.telegram.desktop)$
+          (bind "XF86AudioNext" (dsp.exec "playerctl next"))
-        windowrulev2 = workspace 2 silent, class:^(discord)$
+          (bindOpts "XF86AudioRaiseVolume" (dsp.exec "amixer -q sset 'Master' 5%+") { locked = true; repeating = true; })
-
+          (bindOpts "XF86AudioLowerVolume" (dsp.exec "amixer -q sset 'Master' 5%-") { locked = true; repeating = true; })
-        windowrulev2 = workspace 8 silent, class:^(org.keepassxc.KeePassXC)$
+          (bindOpts "XF86AudioMute" (dsp.exec "amixer -q sset 'Master' toggle") { locked = true; })
-        windowrulev2 = workspace 8 silent, title:^(Nextcloud)$
+          (bindOpts "XF86MonBrightnessUp" (dsp.exec "brightnessctl s 5%+") { locked = true; repeating = true; })
-        windowrulev2 = workspace 8 silent, class:^(Tk)$,title:^(Server Configuration)$
+          (bindOpts "XF86MonBrightnessDown" (dsp.exec "brightnessctl s 5%-") { locked = true; repeating = true; })
-
+          (bindOpts "SUPER + mouse:272" dsp.drag { mouse = true; })
-        #SPECIAL FLOATERS
+          (bindOpts "SUPER + mouse:273" dsp.resize { mouse = true; })
-        windowrulev2 = float,class:^(org.keepassxc.KeePassXC)$,title:^(KeePassXC -  Access Request)$
+        ];
-        windowrulev2 = pin,class:^(org.keepassxc.KeePassXC)$,title:^(KeePassXC -  Access Request)$
+      };
-        windowrulev2 = float,class:^(org.keepassxc.KeePassXC)$,title:^(Unlock Database - KeePassXC)$
-        windowrulev2 = pin,class:^(org.keepassxc.KeePassXC)$,title:^(Unlock Database - KeePassXC)$
-        windowrulev2 = float,title:^(Open)$
-        windowrulev2 = float,title:^(Choose Files)$
-        windowrulev2 = float,title:^(Save As)$
-        windowrulev2 = float,title:^(Confirm to replace files)$
-        windowrulev2 = float,title:^(File Operation Progress)$
-        windowrulev2 = float,class:^(firefox)$,title:^(Picture-in-Picture)$
-        windowrulev2 = pin,class:^(firefox)$,title:^(Picture-in-Picture)$
-        windowrulev2 = suppressevent fullscreen,class:^(firefox)$,title:^(Picture-in-Picture)$
-        windowrulev2 = float,class:^(firefox)$,title:^(Firefox — Sharing Indicator)$
-        windowrulev2 = suppressevent fullscreen,class:^(firefox)$,title:^(Firefox — Sharing Indicator)$
-        windowrulev2 = float,class:^(firefox)$,title:^(Extension:.* Mozilla Firefox)$
-        windowrulev2 = suppressevent fullscreen,class:^(firefox)$,title:^(Extension:.* Mozilla Firefox)$
-        windowrulev2 = float,class:^(org.telegram.desktop)$,title:^(Media viewer)$
-        windowrulev2 = center,class:^(org.telegram.desktop)$,title:^(Media viewer)$
-
-        #SPECIAL NO SLEEP
-        windowrulev2 = idleinhibit fullscreen, class:^(.*)
-        windowrulev2 = idleinhibit focus, class:^(steam_app_.*)$
-        windowrulev2 = idleinhibit focus, class:^(mpv)$
-
-        layerrule = blur,^(eww-blur)
-
-        #binds
-        bind = SUPER, RETURN, exec, kitty
-
-        bind = SUPER_SHIFT, RETURN,togglespecialworkspace,
-        # bind = SUPER_SHIFT, RETURN, exec, kitty --title flying_kitty --single-instance
-        bind = SUPER, Q, killactive, 
-        bind = SUPER, T, togglefloating, 
-        bind = SUPER, F, fullscreen, 
-
-        bind = SUPER, D, exec, wofi -modi --show drun
-        bind = SUPER SHIFT,D,exec, ~/.config/hypr/themes/apatheia/eww/launch_bar 
-
-        bind = SUPER, V, exec, cliphist list | wofi -dmenu | cliphist decode | wl-copy
-        bind =  , Print, exec, grim -g "$(slurp -d)" - | swappy -f -
-
-        bind = SUPER, L, exec, swaylock 
-
-        bind = SUPER, left, movefocus, l
-        bind = SUPER, right, movefocus, r
-        bind = SUPER, up, movefocus, u
-        bind = SUPER, down, movefocus, d
-
-        bind = SUPER, 1, workspace, 1
-        bind = SUPER, 2, workspace, 2
-        bind = SUPER, 3, workspace, 3
-        bind = SUPER, 4, workspace, 4
-        bind = SUPER, 5, workspace, 5
-        bind = SUPER, 6, workspace, 6
-        bind = SUPER, 7, workspace, 7
-        bind = SUPER, 8, workspace, 8
-        bind = SUPER, 9, workspace, 9
-        bind = SUPER, 0, workspace, 10
-
-        bind = SUPER SHIFT, 1, movetoworkspacesilent, 1
-        bind = SUPER SHIFT, 2, movetoworkspacesilent, 2
-        bind = SUPER SHIFT, 3, movetoworkspacesilent, 3
-        bind = SUPER SHIFT, 4, movetoworkspacesilent, 4
-        bind = SUPER SHIFT, 5, movetoworkspacesilent, 5
-        bind = SUPER SHIFT, 6, movetoworkspacesilent, 6
-        bind = SUPER SHIFT, 7, movetoworkspacesilent, 7
-        bind = SUPER SHIFT, 8, movetoworkspacesilent, 8
-        bind = SUPER SHIFT, 9, movetoworkspacesilent, 9
-        bind = SUPER SHIFT, 0, movetoworkspacesilent, 10
-
-        bind = SUPER, mouse_down, workspace, e+1
-        bind = SUPER, mouse_up, workspace, e-1
-
-        bindm = SUPER, mouse:272, movewindow
-        bindm = SUPER, mouse:273, resizewindow
-        bind = , XF86AudioPlay, exec, playerctl play-pause
-        bind = , XF86AudioPrev, exec, playerctl previous
-        bind = , XF86AudioNext, exec, playerctl next
-        bind = , XF86AudioRaiseVolume, exec, amixer -q sset 'Master' 5%+
-        bind = , XF86AudioLowerVolume, exec, amixer -q sset 'Master' 5%-
-        bind = , XF86AudioMute, exec, amixer -q sset 'Master' toggle
-        bind = , XF86MonBrightnessUp, exec, brightnessctl s 5%+
-        bind = , XF86MonBrightnessDown, exec, brightnessctl s 5%-
-
-        exec-once = [workspace special silent] kitty --title flying_kitty
-        exec-once = sh ~/.config/startup.sh
-      '';
     };
-
-    xdg.configFile."startup.sh".text = ''
-      #!/bin/sh
-      sleep 2
-      keepassxc & 
-      firefox & 
-      jellyfin-mpv-shim & 
-      easyeffects --gapplication-service &
-
-      sleep 2
-      nextcloud & 
-      #telegram-desktop&
-      #discord&
-    '';
   };
 }

modules/home/xdg/default.nix

@@ -7,7 +7,7 @@
   xdg.userDirs.documents = "${config.home.homeDirectory}/desktop";
   xdg.userDirs.download = "${config.home.homeDirectory}/downloads";
   xdg.userDirs.extraConfig = {
-    XDG_MISC_DIR = "${config.home.homeDirectory}/misc";
+    MISC = "${config.home.homeDirectory}/misc";
   };
   xdg.userDirs.music = "${config.home.homeDirectory}/media/music";
   xdg.userDirs.pictures = "${config.home.homeDirectory}/media/photo";
@@ -15,5 +15,5 @@
   xdg.userDirs.templates = "${config.home.homeDirectory}/media/template";
   xdg.userDirs.videos = "${config.home.homeDirectory}/media/video";
   xdg.userDirs.createDirectories = true;
-
+  xdg.userDirs.setSessionVariables = true;
 }

modules/home/xorg/bspwm/config.nix

@@ -110,7 +110,7 @@
       telegram-desktop &
       nextcloud &
       jellyfin-mpv-shim &
-      flameshot &
+      #flameshot &
 
       sleep 2
 
@@ -265,7 +265,7 @@
 
       # Screenshots
       Print
-      	flameshot gui
+      	hyprshot -m region
 
       # Lock Desktop
       super + l

modules/home/xorg/bspwm/default.nix

@@ -5,7 +5,7 @@
   config = lib.mkIf (config.usercfg.wm == "X11") {
     xsession.windowManager.bspwm = { enable = true; };
     services.sxhkd = { enable = true; };
-    home.packages = with pkgs; [ xrandr arandr flameshot xtrlock i3lock ];
+    home.packages = with pkgs; [ xrandr arandr hyprshot xtrlock i3lock ];
 
   };
 }

modules/nixos/gui/audio/default.nix

@@ -2,9 +2,9 @@
 let cfg = config.syscfg.make.gui;
 in {
   config = lib.mkIf cfg {
-    sound.enable = true;
+    # sound.enable = true;
-    hardware.pulseaudio.enable = false;
     security.rtkit.enable = true;
+    services.pulseaudio.enable = false; #25.05 change to services
     services.pipewire = {
       enable = true;
       alsa.enable = true;
@@ -13,6 +13,6 @@ in {
       # wireplumber.enable = true;
     };
 
-    environment.systemPackages = with pkgs; [ easyeffects ];
+    environment.systemPackages = with pkgs; [ easyeffects alsa-utils ];
   };
 }

modules/nixos/gui/games/default.nix

@@ -5,6 +5,9 @@ in {
     programs.steam = {
       enable = true;
       remotePlay.openFirewall = true;
+      extraCompatPackages = with pkgs;  [proton-ge-bin];
     };
+    programs.gamemode.enable = true;
+
   };
 }

modules/nixos/gui/greet/default.nix

@@ -5,7 +5,7 @@
       enable = true;
       settings = rec {
         initial_session = {
-          command = "zsh";
+          command = "start-hyprland";
           user = "${config.syscfg.defaultUser}";
         };
         default_session = initial_session;

modules/nixos/gui/xserver/default.nix

@@ -3,7 +3,7 @@
     programs.xwayland.enable = true;
     services.xserver = {
       enable = true;
-      videoDrivers = [ "amd" ];
+      videoDrivers = [ "amdgpu" ];
       xkb = {
         layout = "us";
         variant = "intl";

modules/nixos/system/default.nix

@@ -1,3 +1,11 @@
 { ... }: {
   imports = [ ./dbus ./fonts ./hw ./locale ./network ./nix ./security ./xdg ];
+
+  services.journald.extraConfig = ''
+    SystemMaxUse=512M
+    SystemMaxFileSize=64M
+    MaxRetentionSec=1month
+    RateLimitIntervalSec=30s
+    RateLimitBurst=10000
+  '';
 }

modules/nixos/system/hw/boot/default.nix

@@ -9,7 +9,7 @@ in {
       };
       efi = {
         canTouchEfiVariables = true;
-        efiSysMountPoint = "/boot/efi";
+        efiSysMountPoint = "/boot";
       };
     };
   };

modules/nixos/system/hw/default.nix

@@ -1 +1 @@
-{ ... }: { imports = [ ./base ./boot ./fs ./opengl ./power ./udev ./virt ]; }
+{ ... }: { imports = [ ./base ./boot ./fs ./graphics ./power ./udev ./virt ./wsl ]; }

modules/nixos/system/hw/graphics/default.nix

@@ -0,0 +1,4 @@
+{ ... }: {
+  hardware.graphics.enable = true;
+  hardware.graphics.enable32Bit = true;
+}

modules/nixos/system/hw/opengl/default.nix

@@ -1,5 +0,0 @@
-{ ... }: {
-  hardware.opengl.enable = true;
-  hardware.opengl.driSupport = true;
-  hardware.opengl.driSupport32Bit = true;
-}

modules/nixos/system/hw/power/default.nix

@@ -7,9 +7,24 @@
         STOP_CHARGE_THRESH_BAT0 = 90;
         CPU_SCALING_GOVERNOR_ON_AC = "performance";
         CPU_SCALING_GOVERNOR_ON_BAT = "powersave";
+        MEM_SLEEP_ON_BAT = "deep";
       };
     };
     
+    powerManagement.enable = true;
+    # suspend to RAM (deep) rather than `s2idle`
+    boot.kernelParams = [ "mem_sleep_default=deep" ];
+    # suspend-then-hibernate
+    systemd.sleep.settings.Sleep = {
+      HibernateDelaySec = "30m";
+      SuspendState = "mem";
+    };
+
+    services.logind.settings.Login.HandleLidSwitch = "suspend-then-hibernate";
+    # Hibernate on power button pressed
+    services.logind.settings.Login.HandlePowerKey = "hibernate";
+    services.logind.settings.Login.HandlePowerKeyLongPress = "poweroff";
+
     systemd.user.services.battery_monitor = {
       wants = [ "display-manager.service" ];
       wantedBy = [ "graphical-session.target" ];

modules/nixos/system/hw/udev/default.nix

@@ -1,8 +1,8 @@
-{ ... }: {
+{ pkgs, ... }: {
   systemd.services.systemd-udevd.restartIfChanged = false;
 
   services.udev = {
-    packages = [ ];
+    packages = with pkgs; [ ];
     extraRules = ''
       SUBSYSTEM=="usb", ATTRS{idVendor}=="2104", ATTRS{idProduct}=="0127", GROUP="plugdev", TAG+="uaccess"
       SUBSYSTEM=="usb", ATTRS{idVendor}=="2104", ATTRS{idProduct}=="0118", GROUP="plugdev", TAG+="uaccess"

modules/nixos/system/hw/virt/default.nix

@@ -11,11 +11,13 @@
         dockerSocket.enable = true;
         dockerCompat = true;
         defaultNetwork.settings = {
-          dnsname.enable = true;
+          #dnsname.enable = true;
-          internal = true;
+          dns_enabled = true;
-          name = "internal";
+          #internal = true;
+          #name = "internal";
         };
       };
     };
+    virtualisation.containers.registries.search = [ "quay.io" "docker.io" "ghcr.io" ];
   };
 }

modules/nixos/system/hw/wsl/default.nix

@@ -0,0 +1,13 @@
+{ lib, config, pkgs, ... }: {
+    config = lib.mkIf (config.syscfg.extra.wsl) {
+    wsl.enable = true;
+    wsl.defaultUser = config.syscfg.defaultUser;
+    wsl.extraBin = with pkgs; [
+        { src = "${coreutils}/bin/uname"; }
+        { src = "${coreutils}/bin/dirname"; }
+        { src = "${coreutils}/bin/readlink"; }
+    ];
+    
+    wsl.wslConf.network.generateHosts = false;
+    };
+}

modules/nixos/system/network/base/default.nix

@@ -1,9 +1,30 @@
-{ config, ... }: {
+{ lib, config, ... }: {
   networking = {
     hostName = config.syscfg.hostname;
     useDHCP = true;
     nameservers = [ "1.1.1.1" "9.9.9.9" ];
 
-    firewall = { enable = true; };
+    extraHosts = ''
+      ${lib.concatStringsSep "\n" config.syscfg.extra.hosts}
+    '';
+
+    proxy = lib.mkIf (config.syscfg.extra.proxy.domain != "") {
+      default = "http://${config.syscfg.extra.proxy.domain}:${config.syscfg.extra.proxy.port or "8080"}";
+      noProxy = "${config.syscfg.extra.proxy.noProxy}";
+    };
+
+
+    firewall = { 
+      enable = true;
+      allowedUDPPorts = 
+        (if (config.syscfg.server != false && config.syscfg.server.wireguard) then [ 1515 ] else [ ]) ++ 
+        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
+        [ ];
+
+      allowedTCPPorts = 
+        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
+        (if (config.syscfg.server != false) then [ 5432 6379 8181 ] else [ ]) ++ 
+        [ ];
+    };
   };
 }

modules/nixos/system/network/wifi/default.nix

@@ -3,6 +3,7 @@
     networking.supplicant = {
       "${config.syscfg.net.wlp.nif}" = {
         configFile.path = config.sops.secrets.wifi.path;
+        userControlled.enable = true;
         extraConf = ''
           network={
               ssid="test"

modules/nixos/system/network/wireguard/default.nix

@@ -1,4 +1,12 @@
-{ config, lib, ... }: {
+{ config, lib, pkgs, ... }: let
+
+  isValidPeer = p: 
+    (p ? syscfg.net.wg.enable) && 
+    (p.syscfg.net.wg.enable == true) && 
+    (p.syscfg.net.wg.pubkey != config.syscfg.net.wg.pubkey);
+  activePeers = builtins.filter isValidPeer config.syscfg.peers;
+in
+{
   config = lib.mkIf (config.syscfg.net.wg.enable) {
     networking.wireguard = {
       enable = true;
@@ -9,14 +17,26 @@
             config.sops.secrets."${config.syscfg.hostname}_wg_priv".path;
           listenPort = 1515;
           mtu = 1340;
-          peers = [{
+          peers = 
-            allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
+            if (config.syscfg.server ? wireguard && config.syscfg.server.wireguard) then
-            endpoint = "vpn.helcel.net:1515";
+              map (p: {
-            publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
+                name = p.syscfg.hostname;
-            persistentKeepalive = 30;
+                publicKey = p.syscfg.net.wg.pubkey;
-          }];
+                allowedIPs = [ p.syscfg.net.wg.ip4 p.syscfg.net.wg.ip6 ];
+              }) activePeers
+            else
+              [{
+                allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
+                endpoint = "vpn.helcel.net:1515";
+                publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
+                persistentKeepalive = 30;
+              }];
         };
       };
     };
+    systemd.services."wireguard-wg0" = {
+      after = [ "network-online.target" "nss-lookup.target" ];
+      wants = [ "network-online.target" "nss-lookup.target" ];
+    };
   };
 }

modules/nixos/system/nix/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }: {
+{ inputs, pkgs, ... }: {
   nixpkgs.config = {
     permittedInsecurePackages = [ ];
     allowUnfree = true;
@@ -8,9 +8,9 @@
     };
 
   };
-  nixpkgs.overlays = import ../../../../overlays { inherit pkgs; };
+  nixpkgs.overlays = import ../../../../overlays { inherit inputs pkgs; };
   nix = {
-    package = pkgs.nixFlakes;
+    package = pkgs.nixVersions.stable;
     extraOptions = ''
       experimental-features = nix-command flakes
       warn-dirty = false
@@ -37,5 +37,12 @@
       ];
     };
   };
-  system.stateVersion = "24.05";
+  programs.nix-ld = {
+    enable = true;
+    libraries = with pkgs; [
+      libx11 libxcb libxi libxext libxkbfile xcbutilcursor
+      libpng libdrm libpulseaudio nss nspr expat libbsd
+    ];
+  };
+  system.stateVersion = "24.11";
 }

modules/nixos/tools/debug/default.nix

@@ -1,9 +1,9 @@
 { pkgs, config, lib, ... }: {
 
   config = lib.mkIf (config.syscfg.make.develop) {
-    programs.adb.enable = true;
+
     programs.wireshark.enable = true;
 
-    environment.systemPackages = with pkgs; [ wget dconf wireshark ];
+    environment.systemPackages = with pkgs; [ wget dconf wireshark mtr android-tools ];
   };
 }

modules/nixos/tools/default.nix

@@ -1 +1,64 @@
-{ ... }: { imports = [ ./debug ./develop ]; }
+{ pkgs, ... }: {
+  imports = [ ./debug ./develop ];
+
+  # services.telegraf = {
+  #     enable = true;
+  #     extraConfig = {
+  #         agent = {
+  #             interval = "10s";
+  #             round_interval = true;
+  #             metric_batch_size = 1000;
+  #             metric_buffer_limit = 10000;
+  #             collection_jitter = "0s";
+  #             flush_interval = "10s";
+  #             flush_jitter = "0s";
+  #             precision = "";
+  #             hostname = "valinor";
+  #             omit_hostname = false;
+  #         };
+
+  #         inputs.cpu = {
+  #             percpu = true;
+  #             totalcpu = true;
+  #             collect_cpu_time = false;
+  #             report_active = false;
+  #         };
+
+  #         inputs.mem = {};
+  #         inputs.swap = {};
+  #         inputs.system = {};
+  #         inputs.disk = {
+  #             ignore_fs = ["tmpfs" "devtmpfs" "devfs"];
+  #         };
+
+  #         inputs.net = {};
+  #         inputs.netstat = {};
+
+  #         inputs.ping = {
+  #             urls = ["8.8.8.8" "8.8.4.4"];
+  #             count = 4;
+  #             interval = "60s";
+  #             binary = "${pkgs.iputils.out}/bin/ping";
+  #         };
+
+  #         inputs.internet_speed = {
+  #             interval = "2m";
+  #         };
+
+  #         inputs.net_response = {
+  #             protocol = "tcp";
+  #             address = "google.com:80";
+  #             timeout = "5s";
+  #             read_timeout = "5s";
+  #             interval = "30s";
+  #         };
+
+  #         outputs.influxdb_v2 = {
+  #             urls = [""];
+  #             token = "";
+  #             organization = "";
+  #             bucket = "";
+  #         };
+  #     };
+  # };
+}

modules/nixos/tools/develop/default.nix

@@ -6,10 +6,19 @@ let
     includeEmulator = false;
   };
 in {
+
+  imports = [ ./ollama ];
   config = lib.mkIf (config.syscfg.make.develop) {
-    environment.systemPackages = with pkgs; [
+
-      android-tools
+    services.vscode-server = lib.mkIf (config.syscfg.extra.wsl) {
-      androidStudioPackages.canary
+      enable = true;
-    ];
+      enableFHS = true;
+    };
+
+    environment.systemPackages = with pkgs;
+      [
+        # android-tools
+        unstable.androidStudioPackages.canary
+      ];
   };
 }

modules/nixos/tools/develop/ollama/default.nix

@@ -0,0 +1,15 @@
+{ lib, config, pkgs, ... }: 
+let 
+ ollamaPkg = pkgs.ollama-vulkan;
+in{
+
+  config = lib.mkIf (config.syscfg.make.develop) {
+    services.ollama = {
+        enable = true;
+        package = ollamaPkg;
+        loadModels = [ ];
+        syncModels = true;
+    };
+    environment.systemPackages = with pkgs; [ ollamaPkg ];
+  };
+}

modules/nixos/users/default.nix

@@ -11,6 +11,7 @@ in {
         extraGroups = [
           "networkmanager"
           "wheel"
+          "dialout"
           "vboxsf"
           "adbusers"
           "libvirtd"
@@ -21,6 +22,7 @@ in {
           "docker"
           "podman"
           "wireshark"
+          "gamemode"
         ];
       }) config.syscfg.users);
   };

modules/server/containers/apps/.template.nix

@@ -0,0 +1,54 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "EXAMPLE";
+    tag = "0.0.0";
+    contents = [ pkgs.bashInteractive ];
+    config = {
+      Entrypoint = [ "echo 1" ];
+      ExposedPorts = {  };
+    };
+  }; 
+  settings = pkgs.writeText "settings.yaml" ...;
+  templateData = builder.mkData { name = "template"; dir = "template"; vars = {
+      _ARGUMENT = "template";
+    };
+  };
+in {
+  requires = {
+    secrets = [ ];
+    databases = [ ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config}/example/";
+      mode = "0444";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        # imageStream = image;
+        image = "....:${version}";
+        port = 8080;
+        secret = name;
+        extraEnv = { };
+        overrides = {
+          cmd = [ ];
+          volumes = [ ];
+         };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."EXAMPLE".path;
+      script = pkgs.writeShellScript "setup" ''
+        ...
+      '';
+    };
+  };
+}

modules/server/containers/apps/.todo.md

@@ -0,0 +1,8 @@
+# Missing
+
+RSS: TTRSS / FreshRSS
+Monitoring: Telegraf + InfluxDB
+https://github.com/tarampampam/error-pages ?
+kavita + mylar ? kapowarr ?
+
+- Transmission Cfg and API/Token handling

modules/server/containers/apps/authentik.nix

@@ -0,0 +1,139 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  version = "2026.2.2";
+  serverCfg = config.syscfg.server;
+  mediaCfg = config.syscfg.media;
+  authentikBackground = if mediaCfg.banner.png != null then mediaCfg.banner.png else mediaCfg.bg;
+  logoSvgFileName = builtins.baseNameOf (toString mediaCfg.logo.svg);
+  logoIcoFileName = builtins.baseNameOf (toString mediaCfg.logo.ico);
+  backgroundFileName = builtins.baseNameOf (toString authentikBackground);
+  logoSvgMount = "/data/media/public/branding/${logoSvgFileName}";
+  logoIcoMount = "/data/media/public/branding/${logoIcoFileName}";
+  backgroundMount = "/data/media/public/branding/${backgroundFileName}";
+  authentikData = builder.mkData { 
+    name = "authentik"; dir = "authentik"; vars = {
+      AUTHENTIK_DOMAIN = "${containerCfg.subdomain}.${serverCfg.domain}";
+      COOKIE_DOMAIN = "${serverCfg.domain}";
+      AUTHENTIK_LDAP_DC_DOMAIN = "dc=ldap," + (lib.concatMapStringsSep "," (x: "dc=${x}") (lib.splitString "." serverCfg.domain));
+      AUTHENTIK_BRANDING_TITLE = if containerCfg.extra ? name then containerCfg.extra.name else "authentik";
+      AUTHENTIK_BRANDING_LOGO = "branding/${logoSvgFileName}";
+      AUTHENTIK_BRANDING_FAVICON = "branding/${logoIcoFileName}";
+      AUTHENTIK_BRANDING_BACKGROUND = "branding/${backgroundFileName}";
+    } 
+    // (if serverCfg.containers?jellyfin then { JELLYFIN_DOMAIN = "${serverCfg.containers.jellyfin.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?gitea then { GITEA_DOMAIN = "${serverCfg.containers.gitea.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?immich then { IMMICH_DOMAIN = "${serverCfg.containers.immich.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?freshrss then { FRESHRSS_DOMAIN = "${serverCfg.containers.freshrss.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?homepage then { HOMEPAGE_DOMAIN = "${serverCfg.containers.homepage.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?nextcloud then { NEXTCLOUD_DOMAIN = "${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";} else {});
+  };
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config}/authentik";
+      owner = "1000:1000";
+      dirs = ["media" "templates"];
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "ghcr.io/goauthentik/server:${version}";
+        port = 9000;
+        secret = name;
+        extraEnv = {
+          AUTHENTIK_REDIS__HOST = builder.host;
+          AUTHENTIK_POSTGRESQL__HOST = builder.host;
+          AUTHENTIK_POSTGRESQL__USER = "authentik_user";
+          AUTHENTIK_POSTGRESQL__NAME = "authentik_db";
+          AUTHENTIK_POSAUTHENTIK_POSTGRESQL__SSLMODE = "false";
+          AUTHENTIK_DISABLE_UPDATE_CHECK = "true";
+          AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+        } // lib.optionalAttrs (serverCfg.mail.server != null) {
+          AUTHENTIK_EMAIL__HOST = serverCfg.mail.server;
+          AUTHENTIK_EMAIL__PORT = "587";
+          AUTHENTIK_EMAIL__USERNAME = "noreply@${serverCfg.domain}";
+          AUTHENTIK_EMAIL__USE_TLS = "true";
+          AUTHENTIK_EMAIL__USE_SSL = "false";
+          AUTHENTIK_EMAIL__TIMEOUT = "10";
+          AUTHENTIK_EMAIL__FROM = "sso@noreply.${serverCfg.domain}";
+        };
+        overrides = {
+          environmentFiles =  [ config.sops.secrets."AUTHENTIK".path config.sops.secrets."CUSTOM".path ] ;
+        
+          cmd = [ "server" ];
+          volumes = [
+            "${serverCfg.path.config}/authentik/media:/media"
+            "${serverCfg.path.config}/authentik/templates:/templates"
+            "${authentikData}:/blueprints/custom:ro"
+            "${mediaCfg.logo.svg}:${logoSvgMount}:ro"
+            "${mediaCfg.logo.ico}:${logoIcoMount}:ro"
+            "${authentikBackground}:${backgroundMount}:ro"
+          ];
+        };
+      };
+
+      worker = builder.mkContainer {
+        image = "ghcr.io/goauthentik/server:${version}";
+        secret = name;
+        extraEnv = {
+          AUTHENTIK_REDIS__HOST = builder.host;
+          AUTHENTIK_POSTGRESQL__HOST = builder.host;
+          AUTHENTIK_POSTGRESQL__USER = "authentik_user";
+          AUTHENTIK_POSTGRESQL__NAME = "authentik_db";
+          AUTHENTIK_POSAUTHENTIK_POSTGRESQL__SSLMODE = "false";
+          AUTHENTIK_DISABLE_UPDATE_CHECK = "true";
+          AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+        };
+        overrides = {
+          cmd = [ "worker" ];
+          volumes = [
+            "${serverCfg.path.config}/authentik/media:/media"
+            "${serverCfg.path.config}/authentik/templates:/templates"
+            "${authentikData}:/blueprints/custom:ro"
+            "${mediaCfg.logo.svg}:${logoSvgMount}:ro"
+            "${mediaCfg.logo.ico}:${logoIcoMount}:ro"
+            "${authentikBackground}:${backgroundMount}:ro"
+          ];
+        };
+      };
+
+      ldap = builder.mkContainer {
+        image = "ghcr.io/goauthentik/ldap:${version}";
+        secret = name;
+        extraEnv = {
+          AUTHENTIK_HOST = "https://${containerCfg.subdomain}.${serverCfg.domain}"; 
+          AUTHENTIK_INSECURE = "false"; 
+        };
+      };
+    };
+
+    setup = {
+      trigger = "worker";
+      script = pkgs.writeShellScript "setup" ''
+        # Define the command wrapper
+        AK="${pkgs.podman}/bin/podman --events-backend=none exec --env-file ${config.sops.secrets."CUSTOM".path} -e DOMAIN=${serverCfg.domain} -u root authentik-worker ak"
+
+        $AK apply_blueprint /blueprints/custom/authentik.yaml
+        $AK apply_blueprint /blueprints/custom/branding.yaml
+        $AK apply_blueprint /blueprints/custom/traefik.yaml
+        $AK apply_blueprint /blueprints/custom/ldap.yaml
+
+        ${lib.optionalString (serverCfg.containers ? gitea) ''$AK apply_blueprint /blueprints/custom/gitea.yaml''}
+        ${lib.optionalString (serverCfg.containers ? jellyfin) ''$AK apply_blueprint /blueprints/custom/jellyfin.yaml''}
+        ${lib.optionalString (serverCfg.containers ? nextcloud) ''$AK apply_blueprint /blueprints/custom/nextcloud.yaml''}
+        ${lib.optionalString (serverCfg.containers ? immich) ''$AK apply_blueprint /blueprints/custom/immich.yaml''}
+        ${lib.optionalString (serverCfg.containers ? freshrss) ''$AK apply_blueprint /blueprints/custom/freshrss.yaml''}
+        ${lib.optionalString (serverCfg.containers ? homepage) ''$AK apply_blueprint /blueprints/custom/homepage.yaml''}
+
+        echo "Completed Authentik Setup"
+      '';
+    };
+  };
+}

modules/server/containers/apps/calibre.nix

@@ -0,0 +1,42 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+in {
+  runtime = {
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "crocodilestick/calibre-web-automated:${version}";
+        port = 8083;
+      #   secret = name;
+        extraEnv = {
+          CWA_PORT_OVERRIDE = "8083";
+
+          PUID = "1000";
+          PGID = "1000";
+          #HARDCOVER_TOKEN= ....
+          TRUSTED_PROXY_COUNT= "1";
+        };
+          extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}-login.rule" = "Host(`${containerCfg.subdomain}.${serverCfg.domain}`)";
+          "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if (serverCfg.containers?authentik) then "authentik" else "";
+          "traefik.http.routers.${containerCfg.subdomain}-login.priority" = "100";
+          "traefik.http.routers.${containerCfg.subdomain}-login.entrypoints" = "web-secure";
+          "traefik.http.routers.${containerCfg.subdomain}-login.tls" = "true";
+        };
+        overrides = {
+          volumes = [
+            "${serverCfg.path.book}:/calibre-library"
+            "${serverCfg.path.download}/book:/cwa-book-ingest"
+          ];
+        };
+      };
+    };
+  };
+
+  # curl 'https://books.test.helcel.net/admin/ajaxconfig' \
+  # -X POST 
+  # -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8'
+  # --data-raw 'csrf_token=${CSRF_TOKEN}&config_certfile=&config_keyfile=&config_updatechannel=0&config_trustedhosts=&config_log_level=20&config_logfile=%2Fdev%2Fstdout&config_access_logfile=%2Fconfig%2Faccess.log&config_embed_metadata=on&config_uploading=on&config_upload_formats=m4b%2Cacsm%2Cdoc%2Cpdf%2Cmp3%2Codt%2Ccbr%2Crtf%2Clit%2Cprc%2Cm4a%2Cdjv%2Cfb2%2Copus%2Cdocx%2Cazw3%2Cepub%2Cdjvu%2Cwav%2Ccb7%2Ccbz%2Cmp4%2Ckfx-zip%2Cmobi%2Ccbt%2Cogg%2Ckfx%2Ckepub%2Ctxt%2Cazw%2Chtml%2Cflac&config_external_port=8083&config_goodreads_api_key=&config_hardcover_token=&config_use_https=on&config_reverse_proxy_login_header_name=&config_login_type=1&config_ldap_provider_url=sso.test.helcel.net&config_ldap_port=389&config_ldap_encryption=0&config_ldap_cacert_path=&config_ldap_cert_path=&config_ldap_key_path=&config_ldap_authentication=2&config_ldap_serv_username=cn%3Dldap-service%2Cou%3Dusers%2C%24%7BLDAP_DC_DOMAIN%7D&config_ldap_serv_password_e=%24DEFAULT_LDAP_PASSWORD&config_ldap_dn=%24%7BLDAP_DC_DOMAIN%7D&config_ldap_user_object=(memberOf%3Dcn%3Dcloud%2Cou%3Dgroups%2C%24%7BLDAP_DC_DOMAIN%7D)&config_ldap_openldap=on&config_ldap_auto_create_users=on&config_ldap_group_object_filter=(memberOf%3Dcn%3Dcloud%2Cou%3Dgroups%2C%24%7BLDAP_DC_DOMAIN%7D)&config_ldap_group_name=cloud&config_ldap_group_members_field=memberUid&ldap_import_user_filter=0&config_ldap_member_user_object=&config_generic_oauth_metadata_url=&config_generic_oauth_server_url=&config_generic_oauth_auth_url=&config_generic_oauth_token_url=&config_generic_oauth_userinfo_url=&config_generic_oauth_scope=email+openid+profile&config_oauth_redirect_host=&config_generic_oauth_client_id=&config_generic_oauth_client_secret=&config_generic_oauth_username_mapper=preferred_username&config_generic_oauth_email_mapper=email&config_generic_oauth_admin_group=admin&config_generic_oauth_login_button=OpenID+Connect&config_1_oauth_client_id=&config_1_oauth_client_secret=&config_2_oauth_client_id=&config_2_oauth_client_secret=&config_binariesdir=%2Fusr%2Fbin&config_calibre=&config_kepubifypath=%2Fusr%2Fbin%2Fkepubify&config_rarfile_location=%2Fusr%2Fbin%2Funrar&config_enable_oauth_group_admin_management=on&config_ratelimiter=on&config_limiter_uri=&config_limiter_options=&config_check_extensions=on&config_session=1&config_password_policy=on&config_password_min_length=8&config_password_number=on&config_password_lower=on&config_password_upper=on&config_password_character=on&config_password_special=on'
+}

modules/server/containers/apps/collabora.nix

@@ -0,0 +1,37 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+version = "latest";
+serverCfg = config.syscfg.server;
+in {
+  requires.secrets = [ name ];
+
+  runtime = {
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "collabora/code:${version}";
+        port = 9980;
+        secret = name;
+        extraEnv = {
+          "aliasgroup1" = "https://${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";
+          "server_name" = "${containerCfg.subdomain}.${serverCfg.domain}";
+          "username" = "collabora_user";
+          "VIRTUAL_HOST" = "${containerCfg.subdomain}.${serverCfg.domain}";
+          "VIRTUAL_PORT" = "9980";
+          "VIRTUAL_PROTO" = "http";
+          "DONT_GEN_SSL_CERT" = "true";
+          "RESOLVE_TO_PROXY_IP" = "true";
+          "extra_params" = "--o:ssl.enable=false --o:ssl.termination=true";
+          "dictionaries" = "en fr de jp no";
+        };
+        
+        overrides = {
+          volumes = [
+            "${pkgs.noto-fonts}/share/fonts/noto:/opt/collaboraoffice/share/fonts/truetype/noto:ro"
+            "${pkgs.ibm-plex}/share/fonts/opentype:/opt/collaboraoffice/share/fonts/opentype/plex:ro"
+          ];
+        };
+      };
+    };
+  };
+}

modules/server/containers/apps/ethercalc.nix

@@ -0,0 +1,42 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  ethercalc_exe = pkgs.ethercalc;
+
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "ethercalc";
+    tag = ethercalc_exe.version;
+    contents = [ pkgs.bashInteractive ];
+    config = {
+      Entrypoint = [ "${ethercalc_exe}/bin/ethercalc" ];
+      ExposedPorts = { "8080/tcp" = {}; };
+    };
+  };
+in {
+  requires.secrets = [ name ];
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.data}/ethercalc/";
+      mode = "0666";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 8080;
+        secret = name;
+        extraEnv = {
+          ETHERCALC_PORT = "8080";
+          #CONNECT TO REDIS
+        };
+        overrides = {
+          volumes = [
+            "${serverCfg.path.data}/ethercalc:/data"
+          ];
+         };
+      };
+    };
+  };
+}

modules/server/containers/apps/etherpad.nix

@@ -0,0 +1,129 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  etherpad_exe = pkgs.etherpad-lite;
+  settings = pkgs.writeText"settings.json" (builtins.toJSON {
+    title= "\${TITLE:Etherpad}";
+    showRecentPads = "\${SHOW_RECENT_PADS:true}";
+    favicon = "\${FAVICON:null}";
+    publicURL = "\${PUBLIC_URL:null}";
+    skinName = "\${SKIN_NAME:colibris}";
+    skinVariants = "\${SKIN_VARIANTS:super-light-toolbar super-light-editor light-background}";
+    ip = "\${IP:0.0.0.0}";
+    port = "\${PORT:9001}";
+    showSettingsInAdminPage = "\${SHOW_SETTINGS_IN_ADMIN_PAGE:true}";
+    enableMetrics = "\${ENABLE_METRICS:true}";
+    updates.tier = "off";
+    cleanup.enabled = false;
+    gdprAuthorErasure.enabled = "\${GDPR_AUTHOR_ERASURE_ENABLED:false}";
+    authenticationMethod = "\${AUTHENTICATION_METHOD:apikey}";
+    enableDarkMode = "\${ENABLE_DARK_MODE:true}";
+    enablePadWideSettings = "\${ENABLE_PAD_WIDE_SETTINGS:true}";
+    dbType = "\${DB_TYPE:dirty}";
+    dbSettings = {
+      host =       "\${DB_HOST:undefined}";
+      port =       "\${DB_PORT:undefined}";
+      database =   "\${DB_NAME:undefined}";
+      user =       "\${DB_USER:undefined}";
+      password =   "\${DB_PASS:undefined}";
+      charset =    "\${DB_CHARSET:undefined}";
+      filename =   "\${DB_FILENAME:var/dirty.db}";
+      collection = "\${DB_COLLECTION:undefined}";
+      url =        "\${DB_URL:undefined}";
+    };
+    defaultPadText = "\${DEFAULT_PAD_TEXT:P A D}";
+    padOptions = {
+      noColors =         "\${PAD_OPTIONS_NO_COLORS:false}";
+      showControls =     "\${PAD_OPTIONS_SHOW_CONTROLS:true}";
+      showChat =         "\${PAD_OPTIONS_SHOW_CHAT:true}";
+      showLineNumbers =  "\${PAD_OPTIONS_SHOW_LINE_NUMBERS:true}";
+      useMonospaceFont = "\${PAD_OPTIONS_USE_MONOSPACE_FONT:false}";
+      userName =         "\${PAD_OPTIONS_USER_NAME:null}";
+      userColor =        "\${PAD_OPTIONS_USER_COLOR:null}";
+      rtl =              "\${PAD_OPTIONS_RTL:false}";
+      alwaysShowChat =   "\${PAD_OPTIONS_ALWAYS_SHOW_CHAT:false}";
+      chatAndUsers =     "\${PAD_OPTIONS_CHAT_AND_USERS:false}";
+      lang =             "\${PAD_OPTIONS_LANG:null}";
+      fadeInactiveAuthorColors = "\${PAD_OPTIONS_FADE_INACTIVE_AUTHOR_COLORS:true}";
+      enforceReadableAuthorColors = "\${PAD_OPTIONS_ENFORCE_READABLE_AUTHOR_COLORS:true}";
+    };
+
+    requireSession = "\${REQUIRE_SESSION:false}";
+    editOnly = "\${EDIT_ONLY:false}";
+    minify = "\${MINIFY:true}";
+    requireAuthentication = "\${REQUIRE_AUTHENTICATION:false}";
+    requireAuthorization = "\${REQUIRE_AUTHORIZATION:false}";
+    trustProxy = "\${TRUST_PROXY:true}";
+    ep_headerauth.username_header = "X-authentik-username";
+    users.admin = {
+      password = "\${ADMIN_PASSWORD:null}";
+      is_admin = true;
+    };
+    socketTransportProtocols = ["websocket" "polling"];
+    socketIo.maxHttpBufferSize = "\${SOCKETIO_MAX_HTTP_BUFFER_SIZE:1000000}";
+    indentationOnNewLine = true;
+
+    loglevel = "\${LOGLEVEL:INFO}";
+    lowerCasePadIds = "\${LOWER_CASE_PAD_IDS:true}";
+  });
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "etherpad";
+    tag = etherpad_exe.version;
+    contents = [ pkgs.bashInteractive ];
+    config = {
+      Entrypoint = [ "${etherpad_exe}/bin/etherpad-lite" ];
+      ExposedPorts = { "8080/tcp" = {}; };
+    };
+  };
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config}/etherpad/";
+      mode = "0444";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 8080;
+        secret = name;
+        extraEnv = {
+          TITLE = "Pad";
+          PORT ="8080";
+          DB_TYPE = "postgres";
+          DB_HOST = builder.host;
+          DB_NAME = "etherpad_db";
+          DB_USER = "etherpad_user";
+          TRUST_PROXY = "true";
+          DB_CHARSET = "utf8mb4";
+          DEFAULT_PAD_TEXT = "";
+          PAD_OPTIONS_SHOW_LINE_NUMBERS = "true";
+          PAD_OPTIONS_USE_MONOSPACE_FONT = "true";
+          SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
+        };
+        overrides = {
+          cmd = [ "--settings" "/etc/etherpad/settings.json" "--apikey" "/etc/etherpad/APIKEY.txt" ];
+          volumes = [
+            "${settings}:/etc/etherpad/settings.json"
+            "${serverCfg.path.config}/etherpad/APIKEY.txt:/etc/etherpad/APIKEY.txt:ro"
+          ];
+         };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."ETHERPAD".path;
+      script = pkgs.writeShellScript "setup" ''
+        echo "$APIKEY" > ${serverCfg.path.config}/etherpad/APIKEY.txt
+        chmod 444 ${serverCfg.path.config}/etherpad/APIKEY.txt
+      '';
+    };
+  };
+}

modules/server/containers/apps/favicon.nix

@@ -0,0 +1,217 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let
+  serverCfg = config.syscfg.server;
+  mediaCfg = config.syscfg.media;
+  port = 8080;
+  assetSize = 64;
+  cacheControl = containerCfg.extra.cacheControl or "public, max-age=86400";
+  priority = toString (containerCfg.extra.priority or 2147482647);
+  logoSvgFileName = builtins.baseNameOf (toString mediaCfg.logo.svg);
+  logoSvgMount = "/assets/${logoSvgFileName}";
+  borderRadius = toString (containerCfg.extra.borderRadius or 32);
+  hostMappings = lib.mapAttrs' (mapping: profile:
+    lib.nameValuePair
+      (if lib.hasInfix "." mapping then mapping else "${mapping}.${serverCfg.domain}")
+      profile
+  ) (containerCfg.extra.mappings or {});
+  traefikAssetPathRegexp =
+    "^/(.*/)?"
+    + "(favicon(-[0-9]+x[0-9]+)?\\.(ico|png|svg)"
+    + "|logo\\.(ico)"
+    + "|apple-touch-icon(-precomposed)?\\.png"
+    + "|android-chrome-[0-9]+x[0-9]+\\.png"
+    + "|mstile-[0-9]+x[0-9]+\\.png)$";
+  configFile = pkgs.writeText "favicon-config.json" (builtins.toJSON {
+    inherit cacheControl;
+    borderRadius = borderRadius;
+    mappings = hostMappings;
+    default = containerCfg.extra.default or null;
+  });
+  pythonEnv = pkgs.python3.withPackages (ps: with ps; [
+    cairosvg
+    pillow
+  ]);
+  serverScript = pkgs.writeText "favicon-server.py" ''
+    import base64
+    import hashlib
+    from io import BytesIO
+    import json
+    import os
+    import re
+    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+    from pathlib import Path
+
+    import cairosvg
+    from PIL import Image
+
+    CONFIG_PATH = os.environ.get("FAVICON_CONFIG", "/config/config.json")
+    LOGO_PATH = os.environ.get("FAVICON_LOGO", "/assets/logo.svg")
+    CACHE_DIR = Path(os.environ.get("FAVICON_CACHE_DIR", "/cache"))
+    LISTEN_HOST = os.environ.get("FAVICON_LISTEN_HOST", "0.0.0.0")
+    LISTEN_PORT = int(os.environ.get("FAVICON_PORT", "8080"))
+    ASSET_SIZE = int(os.environ.get("FAVICON_ASSET_SIZE", "${toString assetSize}"))
+    DEFAULT_CACHE_CONTROL = "public, max-age=86400"
+
+    with open(CONFIG_PATH, "r", encoding="utf-8") as fh:
+        APP_CONFIG = json.load(fh)
+    with open(LOGO_PATH, "rb") as fh:
+        LOGO_BYTES = fh.read()
+    LOGO_HASH = hashlib.sha256(LOGO_BYTES).hexdigest()
+
+    def _normalize_host(host):
+        return (host or "").split(":", 1)[0].strip().lower()
+
+    def _pick_profile(host):
+        mappings = APP_CONFIG.get("mappings", {})
+        return mappings.get(host) or APP_CONFIG.get("default")
+
+    def _color(value, fallback):
+        return value if isinstance(value, str) and value else fallback
+
+    def _replace_svg_color(svg, attribute, color):
+        if attribute in {"fill", "stroke"}:
+            svg = re.sub(
+                rf'{attribute}="(?!none\\b)[^"]*"',
+                f'{attribute}="{color}"',
+                svg,
+                flags=re.IGNORECASE,
+            )
+            svg = re.sub(
+                rf"{attribute}='(?!none\\b)[^']*'",
+                f"{attribute}='{color}'",
+                svg,
+                flags=re.IGNORECASE,
+            )
+        return re.sub(
+            rf"{attribute}\\s*:\\s*(?!none\\b)[^;\"\\']+",
+            f"{attribute}:{color}",
+            svg,
+            flags=re.IGNORECASE,
+        )
+
+    def _tinted_logo_data_uri(color):
+        svg = LOGO_BYTES.decode("utf-8")
+        svg = _replace_svg_color(svg, "fill", color)
+        svg = _replace_svg_color(svg, "stroke", color)
+        return "data:image/svg+xml;base64," + base64.b64encode(svg.encode("utf-8")).decode("ascii")
+
+    def _border_radius():
+        value = APP_CONFIG.get("borderRadius", "8")
+        text = str(value).strip()
+        if text.endswith("px"):
+            return text
+        return f"{text}px"
+
+    def _render_svg(profile):
+        bg = _color(profile.get("background"), "#111827")
+        fg = _color(profile.get("foreground"), "#f8fafc")
+        border_radius = _border_radius()
+        logo_data_uri = _tinted_logo_data_uri(fg)
+
+        canvas = 256
+        return f"""<svg xmlns="http://www.w3.org/2000/svg" width="{canvas}" height="{canvas}" viewBox="0 0 {canvas} {canvas}">
+          <rect x="0" y="0" width="{canvas}" height="{canvas}" rx="{border_radius}" ry="{border_radius}" fill="{bg}" />
+          <image href="{logo_data_uri}" x="0" y="0" width="{canvas}" height="{canvas}" preserveAspectRatio="xMidYMid meet" />
+        </svg>"""
+
+    def _generate_asset(host, profile):
+        cache_name = f"{host}.ico"
+        target = CACHE_DIR / cache_name
+        if target.exists():
+            return target
+
+        CACHE_DIR.mkdir(parents=True, exist_ok=True)
+        svg = _render_svg(profile).encode("utf-8")
+        png_bytes = cairosvg.svg2png(bytestring=svg, output_width=ASSET_SIZE, output_height=ASSET_SIZE)
+        image = Image.open(BytesIO(png_bytes))
+        image.save(target, format="ICO", sizes=[(ASSET_SIZE, ASSET_SIZE)])
+        image.close()
+        return target
+
+    class Handler(BaseHTTPRequestHandler):
+        server_version = "favicon-router/1.0"
+
+        def _serve(self, include_body):
+            host = _normalize_host(self.headers.get("Host", ""))
+            profile = _pick_profile(host)
+            if not profile:
+                self.send_error(404, "No favicon mapping for host")
+                return
+
+            asset_path = _generate_asset(host, profile)
+            payload = asset_path.read_bytes()
+            self.send_response(200)
+            self.send_header("Content-Type", "image/x-icon")
+            self.send_header("Content-Length", str(len(payload)))
+            self.send_header("Cache-Control", APP_CONFIG.get("cacheControl", DEFAULT_CACHE_CONTROL))
+            self.end_headers()
+            if include_body:
+                self.wfile.write(payload)
+
+        def do_GET(self):
+            self._serve(include_body=True)
+
+        def do_HEAD(self):
+            self._serve(include_body=False)
+
+        def log_message(self, fmt, *args):
+            print("%s - - [%s] %s" % (self.address_string(), self.log_date_time_string(), fmt % args))
+
+    if __name__ == "__main__":
+        httpd = ThreadingHTTPServer((LISTEN_HOST, LISTEN_PORT), Handler)
+        httpd.serve_forever()
+  '';
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "favicon";
+    tag = "1";
+    contents = [
+      pythonEnv
+      pkgs.cacert
+      pkgs.tzdata
+    ];
+    config = {
+      Entrypoint = [ "${pythonEnv}/bin/python3" serverScript ];
+      ExposedPorts = { "${toString port}/tcp" = { }; };
+      WorkingDir = "/";
+    };
+  };
+in {
+  runtime = {
+    paths = [
+      {
+        path = "${serverCfg.path.config}/favicon";
+        mode = "0755";
+        dirs = [ "cache" ];
+      }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        imageStream = image;
+        port = port;
+        extraEnv = {
+          FAVICON_CONFIG = "/config/config.json";
+          FAVICON_LOGO = logoSvgMount;
+          FAVICON_CACHE_DIR = "/cache";
+          FAVICON_PORT = toString port;
+          FAVICON_ASSET_SIZE = toString assetSize;
+        };
+        extraLabels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.${name}.entrypoints" = "web-secure";
+          "traefik.http.routers.${name}.rule" = "PathRegexp(`${traefikAssetPathRegexp}`)";
+          "traefik.http.routers.${name}.priority" = priority;
+          "traefik.http.routers.${name}.tls" = "true";
+          "traefik.http.services.${name}.loadbalancer.server.port" = toString port;
+        };
+        overrides = {
+          volumes = [
+            "${configFile}:/config/config.json:ro"
+            "${serverCfg.path.config}/favicon/cache:/cache"
+            "${mediaCfg.logo.svg}:${logoSvgMount}:ro"
+          ];
+        };
+      };
+    };
+  };
+}

modules/server/containers/apps/freshrss.nix

@@ -0,0 +1,61 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [
+      {
+        path = "${serverCfg.path.config}/freshrss";
+        owner = "1000:1000";
+        mode = "0755";
+      }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "ghcr.io/freshrss/freshrss:${version}";
+        port = 80;
+        
+        extraEnv = {
+          CRON_MIN = "5,35";
+          TRUSTED_PROXY = "10.0.0.0/8 192.168.0.1/16";
+          LISTEN = "80";
+          OIDC_ENABLED = "1";
+          OIDC_PROVIDER_METADATA_URL = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/o/freshrss/.well-known/openid-configuration";
+          OIDC_REMOTE_USER_CLAIM = "preferred_username";
+          OIDC_CLIENT_ID = "freshrss";
+          OIDC_SCOPES = "openid profile";
+          OIDC_X_FORWARDED_HEADERS = "X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto";
+        };
+
+        overrides = {
+          environmentFiles =  [ config.sops.secrets."FRESHRSS".path config.sops.secrets."CUSTOM".path ];
+          volumes = ["${serverCfg.path.config}/freshrss:/var/www/FreshRSS/data"];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server"; # Triggers atomic environment verification on main controller
+      envFile = [ config.sops.secrets."FRESHRSS".path config.sops.secrets."CUSTOM".path];
+      script = pkgs.writeShellScript "setup-freshrss" ''
+
+        RSS="${pkgs.podman}/bin/podman --events-backend=none exec -u www-data freshrss-server"
+        $RSS ./cli/prepare.php
+        $RSS ./cli/do-install.php --default-user $DEFAULT_ADMIN_USERNAME --auth-type http_auth --base-url https://${containerCfg.subdomain}.${serverCfg.domain} --language en \
+          --title RSS --api-enabled --db-type pgsql --db-host ${builder.host} --db-user freshrss_user --db-password $DB_PASSWORD --db-base freshrss_db
+        $RSS ./cli/create-user.php --user $DEFAULT_ADMIN_USERNAME --password $DEFAULT_ADMIN_PASSWORD --email $DEFAULT_ADMIN_EMAIL
+        $RSS ./cli/reconfigure.php
+        # $RSS ./cli/access-permissions.sh
+        
+      '';
+    };
+  };
+}

modules/server/containers/apps/frigate.nix

@@ -0,0 +1,96 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+  
+  # Ensure the package is available (Nixpkgs includes frigate)
+  frigatePkg = pkgs.frigate;
+
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "frigate";
+    tag = frigatePkg.version;
+    contents = [ 
+      pkgs.bashInteractive 
+      frigatePkg
+      pkgs.ffmpeg # Explicitly included for video stream processing
+    ];
+    config = {
+      Entrypoint = [ "${frigatePkg}/bin/frigate" ];
+      Cmd = [ "start" ];
+      ExposedPorts = {
+        "5000/tcp" = {}; # Web UI / API
+        "8554/tcp" = {}; # RTSP Feeds
+        "8555/tcp" = {}; # WebRTC
+      };
+      Env = [
+        "FRIGATE_RTSP_PASSWORD=secret" # Base fallback, overridden by envFile/sops
+      ];
+    };
+  };
+in {
+  requires.secrets = [ name ];
+
+  runtime = {
+    paths = [
+      {
+        path = "${serverCfg.path.config}/frigate/";
+        mode = "0755";
+      }
+      {
+        path = "/var/lib/frigate/storage/";
+        mode = "0755"; # Dedicated path for heavy video recordings and media
+      }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 5000;
+        secret = name;
+        extraEnv = {
+          PLUS_API_KEY = ""; # Optional: For Frigate Plus users
+        };
+        overrides = {
+          cmd = [ ];
+          volumes = [
+            "${serverCfg.path.config}/frigate:/config"
+            "/var/lib/frigate/storage:/media/frigate"
+            "/dev/bus/usb:/dev/bus/usb" # Passes Google Coral USB TPU to the container
+            "/dev/dri:/dev/dri"         # Passes Intel/AMD GPU for hardware video decoding
+          ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."FRIGATE_ENV".path;
+      script = pkgs.writeShellScript "setup-frigate" ''
+        mkdir -p "${serverCfg.path.config}/frigate"
+        mkdir -p "/var/lib/frigate/storage"
+        
+        # Bootstrap a standard configuration layout if missing
+        if [ ! -f "${serverCfg.path.config}/frigate/config.yml" ]; then
+          cat <<EOF > "${serverCfg.path.config}/frigate/config.yml"
+mqtt:
+  enabled: False # Set to True and define host if connecting to Home Assistant
+
+database:
+  path: /config/frigate.db
+
+cameras:
+  dummy_camera: # Replace with your actual RTSP stream details
+    enabled: false
+    ffmpeg:
+      inputs:
+        - path: rtsp://127.0.0.1:554/live
+          roles:
+            - detect
+    detect:
+      enabled: false
+EOF
+        fi
+      '';
+    };
+  };
+}

modules/server/containers/apps/gitea.nix

@@ -0,0 +1,146 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  version = "latest";
+  serverCfg = config.syscfg.server;
+
+  LDAP_DC_DOMAIN = "dc=ldap," + (lib.concatMapStringsSep "," (x: "dc=${x}") (lib.splitString "." serverCfg.domain));
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.data}/gitea";
+      owner = "1000:1000";
+      dirs = ["data" "runner"];
+      mode = "0755";
+    }];
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "gitea/gitea:${version}";
+        port = 8080;
+        secret = name;
+        
+        extraEnv = { # app.ini -> GITEA__<section>__<KEY> = "<VALUE>";
+          GITEA__DEFAULT__APP_NAME = if(containerCfg.extra ? name) then containerCfg.extra.name else "Gitea";
+          GITEA__repository__DISABLED_REPO_UNITS = "repo.ext_issues,repo.ext_wiki";
+          GITEA__repository__DISABLE_STARS = "true";
+          GITEA__repository__DEFAULT_MERGE_STYLE = "squash";
+          # GITEA__ui__THEMES = "";
+          # GITEA__ui__DEFAULT_THEME = "";
+
+          # GITEA__security__SECRET_KEY = "SECRET_ENV";
+          # GITEA__security__INTERNAL_TOKEN = "SECRET_ENV";
+          # GITEA__database__PASSWD = "SECRET_ENV";
+          # GITEA__mailer__PASSWD="SECRET_ENV";
+
+          GITEA__database__DB_TYPE = "postgres"; 
+          GITEA__database__HOST = builder.host;
+          GITEA__database__NAME = "gitea_db";
+          GITEA__database__USER = "gitea_user";
+
+
+          GITEA__mailer__ENABLED = "true";
+          GITEA__mailer__FROM = "";
+          GITEA__mailer__PROTOCOL = "smtps";
+          GITEA__mailer__SMTP_ADDR = "";
+          GITEA__mailer__SMTP_PORT = "";
+          GITEA__mailer__USER= "";
+
+          GITEA__server__DOMAIN = "${containerCfg.subdomain}.${serverCfg.domain}";
+          GITEA__server__ROOT_URL = "https://${containerCfg.subdomain}.${serverCfg.domain}/";
+          GITEA__server__PROTOCOL = "http";
+          GITEA__server__HTTP_PORT = "8080";
+          GITEA__server__LFS_START_SERVER = "true";
+          GITEA__security__INSTALL_LOCK = "true";
+
+        } // ( if serverCfg.containers?authentik then {
+          GITEA__service__ENABLE_BASIC_AUTHENTICATION = "false";
+          GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION = "true";
+          GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION_API = "true";
+          GITEA__service__ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = "true";
+          GITEA__service__ENABLE_REVERSE_PROXY_EMAIL = "true";
+          GITEA__service__ENABLE_REVERSE_PROXY_FULL_NAME = "true";
+          GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION = "true";
+          GITEA__security__REVERSE_PROXY_LOGOUT_REDIRECT = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/outpost.goauthentik.io/sign_out";
+          GITEA__security__REVERSE_PROXY_AUTHENTICATION_USER = "X-authentik-username";
+          GITEA__security__REVERSE_PROXY_AUTHENTICATION_EMAIL = "X-authentik-email";
+          GITEA__security__REVERSE_PROXY_AUTHENTICATION_FULL_NAME = "X-authentik-name";
+          GITEA__security__RREVERSE_PROXY_LIMIT = "1";
+          GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES = "127.0.0.0/8,::1/128,10.0.0.0/8";
+        } else {});
+        extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}-login.rule" = "Host(`${containerCfg.subdomain}.${serverCfg.domain}`) && Path(`/user/login`) ";
+          "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if (serverCfg.containers?authentik && containerCfg.extra?proxyauth) then "authentik" else "";
+          "traefik.http.routers.${containerCfg.subdomain}-login.priority" = "100";
+          "traefik.http.routers.${containerCfg.subdomain}-login.entrypoints" = "web-secure";
+          "traefik.http.routers.${containerCfg.subdomain}-login.tls" = "true";
+        };
+
+        overrides = {
+          volumes = [
+            "${serverCfg.path.data}/gitea/data:/data"
+          ];
+          ports = [ "2222:22" ]; 
+        };
+      };
+
+      runner = builder.mkContainer {
+        image = "gitea/act_runner:${version}";
+        secret = name;
+        extraEnv = { 
+          CONFIG_FILE="/data/config.yml";
+          GITEA_INSTANCE_URL="https://${containerCfg.subdomain}.${serverCfg.domain}";
+          GITHUB_INSTANCE_URL="https://${containerCfg.subdomain}.${serverCfg.domain}";
+        };
+
+        overrides = {
+          volumes = [
+            "${serverCfg.path.data}/gitea/runner:/data"
+            "/var/run/podman/podman.sock:/var/run/docker.sock"
+          ];
+          # ports = [ "8088:8088" ]; 
+        };
+      };
+    };
+
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."CUSTOM".path;
+      script = pkgs.writeShellScript "setup" ''
+        # Define the command wrapper
+        GT="${pkgs.podman}/bin/podman --events-backend=none exec -u git gitea-server gitea"
+        GTR="${pkgs.podman}/bin/podman --events-backend=none exec -u git gitea-runner ./act_runner"
+
+        $GT admin user create --username "$DEFAULT_ADMIN_USERNAME" --password "$DEFAULT_ADMIN_PASSWORD" --email "$DEFAULT_ADMIN_EMAIL" --admin || true
+
+        touch ${serverCfg.path.data}/gitea/data-runner/config.yml
+
+        RUNNER_TOKEN=$($GT actions generate-runner-token)
+        $GTR register \
+          --instance "https://${containerCfg.subdomain}.${serverCfg.domain}" \
+          --token "$RUNNER_TOKEN" \
+          --name "Runner" \
+          --labels "ubuntu-latest:docker://catthehacker/ubuntu:act-latest" \
+          --no-interactive
+
+
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        $GT admin auth add-ldap --name Authentik --host authentik-ldap --port 6636 --security-protocol ldaps --skip-tls-verify \
+            --bind-dn "cn=ldap-service,ou=users,${LDAP_DC_DOMAIN}" --bind-password $DEFAULT_LDAP_PASSWORD \
+            --user-search-base "ou=users,${LDAP_DC_DOMAIN}" \
+            --user-filter "(&(objectClass=user)(|(uid=%[1]s)(mail=%[1]s)))" \
+            --admin-filter "(memberOf=cn=admin,ou=groups,${LDAP_DC_DOMAIN})" \
+            --username-attribute "username" --firstname-attribute "givenName" --surname-attribute "sn" --email-attribute "mail" \
+            --synchronize-users
+        ''}
+
+        echo "Completed Gitea Setup"
+      '';
+    };
+  };
+}

modules/server/containers/apps/handbrake.nix

@@ -0,0 +1,48 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  version = "latest";
+in {
+  runtime = {
+    paths = [{
+      path = "${serverCfg.path.config}/handbrake";
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        authentik = true;
+        tmpfs = true;
+        subdomain = containerCfg.subdomain;
+        subpath = containerCfg.subpath;
+        image = "ghcr.io/jlesage/handbrake:${version}";
+        port = 5800;
+        
+        extraEnv = {
+          USER_ID = "1000";
+          GROUP_ID = "1000";
+          AUTOMATED_CONVERSION_PRESET = "Custom/AV1 MKV 1080p30";
+          AUTOMATED_CONVERSION_FORMAT = "mkv";
+          AUTOMATED_CONVERSION_OUTPUT_SUBDIR = "SAME_AS_SRC";
+        };
+        
+        overrides = {
+          volumes = [
+            "${serverCfg.path.config}/handbrake:/config:rw"
+            "${serverCfg.path.dlComplete}:/watch:rw"
+            "${serverCfg.path.dlConverted}:/output:rw"
+          ];
+         };
+      };
+    };
+
+    
+    setup = {
+      trigger = "server";
+      script = pkgs.writeShellScript "setup" ''
+          mkdir -p ${serverCfg.path.data}/handbrake/{watch,output}
+
+      '';
+    };
+  };
+}

modules/server/containers/apps/homeassistant.nix

@@ -0,0 +1,102 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  version = "latest";
+  serverCfg = config.syscfg.server;
+  
+in {
+  runtime = {
+    vm = {
+      portForward = [ 8123 ];
+      cfg = {cfg,...}: {
+        services.home-assistant = {
+          enable = true;
+          openFirewall = true;
+          
+          extraComponents = [
+            "matter" "thread" "cast" "zha"
+            "default_config" "met" "esphome" "radio_browser"
+            "telegram_bot" "swiss_public_transport" "nextcloud" "jellyfin" 
+          ]  ++ (if containerCfg.extra ? components then containerCfg.extra.components else []);
+          
+
+          extraPackages = pp: with pp; [
+              python-telegram gtts
+          ];
+          lovelaceConfig = {};
+
+          config = {
+            homeassistant = {
+              name = "Home";
+              latitude = "${if containerCfg.extra ? latitude then toString containerCfg.extra.latitude else toString 0}";
+              longitude = "${if containerCfg.extra ? longitude then toString containerCfg.extra.longitude else toString 0}";
+              elevation = "${if containerCfg.extra ? elevation then toString containerCfg.extra.elevation else toString 0}";
+              unit_system = "metric";
+              time_zone = config.time.timeZone;
+            };
+            lovelace = { mode = "yaml"; };
+            customLovelaceModules = [];
+            
+            # default_config = {};
+            http = {
+              use_x_forwarded_for = true;
+              trusted_proxies = [ "10.0.0.0/8" "127.0.0.1" ];
+            };
+          };
+        };
+      };
+    };
+
+    containers = {
+      dummy = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "alpine:latest";
+        extraLabels = {
+          "traefik.http.services.${containerCfg.subdomain}.loadbalancer.server.url" = "http://${builder.hostIp}:8123";
+        };
+        overrides = {cmd = [ "sleep" "infinity" ];};
+      };
+    };
+
+    setup = {
+      trigger = "dummy";
+      envFile = config.sops.secrets."CUSTOM".path;
+      script = pkgs.writeShellScript "setup" ''
+
+    HASS_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+    until [[ "$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$HASS_URL/manifest.json")" =~ (200|301|302) ]]; do
+      sleep 5
+    done
+    sleep 5
+
+    ONBOARDING_STATUS=$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$HASS_URL/api/onboarding" 2>/dev/null || echo "000")
+
+    if [ "$ONBOARDING_STATUS" = "200" ]; then
+      AUTH_CODE=$( ${pkgs.curl}/bin/curl -s -X POST "$HASS_URL/api/onboarding/users" \
+        -H "Content-Type: application/json" \
+        -d '{"client_id":"'"$HASS_URL"'","name":"'"$DEFAULT_ADMIN_USERNAME"'","username":"'"$DEFAULT_ADMIN_USERNAME"'","password":"'"$DEFAULT_ADMIN_PASSWORD"'","language":"en"}' \
+        | ${pkgs.jq}/bin/jq -r '.auth_code' )
+
+      ACCESS_TOKEN=$(${pkgs.curl}/bin/curl -s -X POST "$HASS_URL/auth/token" \
+          -H "Content-Type: application/x-www-form-urlencoded" \
+          -d "grant_type=authorization_code&code=$AUTH_CODE&client_id=$HASS_URL" \
+      | ${pkgs.jq}/bin/jq -r '.access_token' )    
+
+      ${pkgs.curl} -s -X POST "$HASS_URL/api/onboarding/core_config" \
+          -H "Authorization: Bearer $ACCESS_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d '{"time_zone":"${config.time.timeZone}"}' > /dev/null 2>&1 || true
+      # We can configure many more things above !
+
+      ${pkgs.curl} -s -X POST "$HASS_URL/api/onboarding/analytics" \
+          -H "Authorization: Bearer $ACCESS_TOKEN" \
+          -H "Content-Type: application/json" -d '{}' > /dev/null 2>&1 || true
+
+      ${pkgs.curl} -s -X POST "$HA_URL/api/onboarding/integration" \
+          -H "Authorization: Bearer $ACCESS_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d '{"client_id":"'"$HASS_URL"'","redirect_uri":"'"$HASS_URL"'/?auth_callback=1"}' > /dev/null 2>&1 || true
+    fi
+      '';
+    };
+  };
+}

modules/server/containers/apps/homepage.nix

@@ -0,0 +1,293 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+    version = "latest";
+    serverCfg = config.syscfg.server;
+    mediaCfg = config.syscfg.media;
+    backgroundImage = if mediaCfg.banner.png != null then mediaCfg.banner.png else mediaCfg.bg;
+    backgroundFileName = builtins.baseNameOf (toString backgroundImage);
+    backgroundMount = "/app/public/media/${backgroundFileName}";
+
+    settings = pkgs.writers.writeYAML "settings.yaml" {
+        title = "My Self-Hosted Dashboard";
+        description = "";
+        startUrl = "https://${containerCfg.subdomain}.${serverCfg.domain}";
+        background = {
+            image = "/media/${backgroundFileName}";
+            blur = "xs"; # "", sm, md, xl,...
+            # saturate = "";
+            brightness = 50;
+            # opacity = 40;
+        };
+        cardBlur = "md";
+        # favicon = ""; 
+        theme = "dark";
+        color = "slate";
+        fullWidth = true;
+        useEqualHeights = true;
+        pwa = {
+
+        };
+        layout = {
+            Admin = {
+                style = "row";
+                columns = 4;
+            };
+        };
+        providers = {
+            finnhub = "{{HOMEPAGE_VAR_FINNHUB}}";
+        };
+        headerStyle = "clean";
+        hideVersion = true;
+        disableUpdateCheck = true;
+        showStats = false;
+        statusStyle = "dot";
+        hideErrors = true;
+    };
+    widgets = pkgs.writers.writeYAML "widgets.yaml" [
+        {openmeteo = {
+            latitude = "47.3769";
+            longitude = "8.5417";
+            timezone = "Europe/Zurich";
+            units = "metric";
+            cache = "15";
+        };}
+        {search = {
+            provider = "custom";
+            focus = true;
+            showSearchSuggestions = true;
+            target = "_blank";
+          } // (lib.optionalAttrs (serverCfg.containers?searxng) {
+            url = "https://${serverCfg.containers.searxng.subdomain}.${serverCfg.domain}/search?q=";
+            suggestionUrl = "https://${serverCfg.containers.searxng.subdomain}.${serverCfg.domain}/autocompleter?q=";
+          });
+        }
+        {stocks = {
+            provider = "finnhub";
+            color = true;
+            cache = 15;
+            watchlist = containerCfg.extra.stocks or [];
+            
+        };}
+    ];
+
+    bookmarks = pkgs.writers.writeYAML "bookmarks.yaml" [
+        
+    ];
+    services = pkgs.writers.writeYAML "services.yaml" [
+        {Media = lib.flatten [
+            (lib.optional (serverCfg.containers?jellyfin) { 
+                Jellyfin={
+                    icon = "jellyfin.png";
+                    href = "https://${serverCfg.containers.jellyfin.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type="jellyfin";
+                        url = "http://jellyfin-server:8096";
+                        key = "{{HOMEPAGE_VAR_JELLYFIN_API}}";
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?invidious) { 
+                Invidious={
+                    icon = "invidious.png";
+                    href = "https://${serverCfg.containers.invidious.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?miniflux) { 
+                Miniflux={
+                    icon = "miniflux.png";
+                    href = "https://${serverCfg.containers.miniflux.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type="miniflux";
+                        url = "http://miniflux-server";
+                        key = "{{HOMEPAGE_VAR_MINIFLUX_API}}";
+                    };
+                };
+            })
+        ];}
+        {Cloud = lib.flatten [
+            (lib.optional (serverCfg.containers?nextcloud) { 
+                Nextcloud={
+                    icon = "nextcloud.png";
+                    href = "https://${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type="nextcloud";
+                        url = "http://nextcloud-server:80";
+                        key = "{{HOMEPAGE_VAR_NEXTCLOUD_API}}";
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?ethercalc) { 
+                Ethercalc={
+                    icon = "ethercalc.png";
+                    href = "https://${serverCfg.containers.ethercalc.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?etherpad) { 
+                Etherpad={
+                    icon = "etherpad.png";
+                    href = "https://${serverCfg.containers.etherpad.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?immich) { 
+                immich={
+                    icon = "immich.png";
+                    href = "https://${serverCfg.containers.immich.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type="immich";
+                        url = "http://immich-server:80";
+                        key = "{{HOMEPAGE_VAR_IMMICH_API}}";
+                        version = "2";
+                    };
+                };
+            })
+        ];}
+        {Dev = lib.flatten [
+            (lib.optional (serverCfg.containers?gitea) { 
+                Gitea={
+                    icon = "gitea.png";
+                    href = "https://${serverCfg.containers.gitea.subdomain}.${serverCfg.domain}";
+                    # widget = {
+                    #     type="gitea";
+                    #     url = "http://gitea-server:8080";
+                    #     key = "{{HOMEPAGE_VAR_GITEA_API}}";
+                    # };
+                };
+            })
+        ];}
+         {Admin = #lib.flatten [
+            #({permissions.groups = ["admin"];})
+            #({services = 
+            lib.flatten [
+            (lib.optional (serverCfg.containers?traefik) { 
+                Traefik={
+                    icon = "traefik.png";
+                    href = "https://${serverCfg.containers.traefik.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type = "traefik";
+                        url = "http://traefik-server:8080";
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?authentik) { 
+                Authentik={
+                    icon = "authentik.png";
+                    href = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}";
+                    widget = {
+                        type = "authentik";
+                        url = "http://authentik-server:9000";
+                        key = "{{HOMEPAGE_VAR_AUTHENTIK_API}}";
+                        version = "2";
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?umami) { 
+                Umami={
+                    icon = "umami.png";
+                    href = "https://${serverCfg.containers.umami.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?influx) { 
+                Influx={
+                    icon = "influx.png";
+                    href = "https://${serverCfg.containers.influx.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?handbrake) { 
+                Handbrake={
+                    icon = "handbrake.png";
+                    href = "https://${serverCfg.containers.handbrake.subdomain}.${serverCfg.domain}";
+                };
+            })
+            (lib.optional (serverCfg.containers?transmission) { 
+                Transmission={
+                    icon = "transmission.png";
+                    href = "https://${serverCfg.containers.transmission.subdomain}.${serverCfg.domain}/transmission";
+                    widget = {
+                        type = "transmission";
+                        url = "http://transmission-server:9091";
+                        rpcUrl = "/transmission/"; 
+                    };
+                };
+            })
+            (lib.optional (serverCfg.containers?servarr) (
+            let 
+                modules = serverCfg.containers.servarr.extra.modules or ["prowlarr" "sonarr" "radarr" "flaresolverr" ];
+            in
+            (lib.optional (builtins.elem "sonarr" modules) {
+                Sonarr={
+                    icon = "sonarr.png";
+                    href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/sonarr";
+                    widget = {
+                        type = "sonarr";
+                        url = "http://servarr-sonarr:8989";
+                        key = "{{HOMEPAGE_VAR_SONARR_API}}";
+                         
+                    };
+                };
+            }) ++ (lib.optional (builtins.elem "radarr" modules) {
+                Radarr={
+                    icon = "radarr.png";
+                    href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/radarr";
+                    widget = {
+                        type = "radarr";
+                        url = "http://servarr-radarr:8989";
+                        key = "{{HOMEPAGE_VAR_RADARR_API}}";
+                         
+                    };
+                };
+            }) ++ (lib.optional (builtins.elem "lidarr" modules) {
+                Lidarr={
+                    icon = "lidarr.png";
+                    href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/lidarr";
+                    widget = {
+                        type = "lidarr";
+                        url = "http://servarr-lidarr:8989";
+                        key = "{{HOMEPAGE_VAR_LIDARR_API}}";
+                         
+                    };
+                };
+            }) ++ (lib.optional (builtins.elem "prowlarr" modules) {
+                Prowlarr={
+                    icon = "prowlarr.png";
+                    href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/prowlarr";
+                    widget = {
+                        type = "prowlarr";
+                        url = "http://servarr-prowlarr:8989";
+                        key = "{{HOMEPAGE_VAR_PROWLARR_API}}";
+                         
+                    };
+                };
+            })
+                # Bazarr
+
+            ))
+        ];}#)];}
+    ];
+in {
+    runtime = {
+      containers = {
+        server = builder.mkContainer {
+          subdomain = containerCfg.subdomain;
+          image = "ghcr.io/gethomepage/homepage:${version}";
+          port = 3000;
+          extraEnv = { 
+              HOMEPAGE_VAR_TITLE="${serverCfg.domain}";
+              HOMEPAGE_ALLOWED_HOSTS = "${containerCfg.subdomain}.${serverCfg.domain},${builder.host}";
+          };
+          extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}.service" = "${containerCfg.subdomain}";
+          };
+          overrides = {
+              environmentFiles =  [ config.sops.secrets."CUSTOM".path ];
+              volumes = [ 
+                  "${settings}:/app/config/settings.yaml:ro"
+                  "${services}:/app/config/services.yaml:ro"
+                  "${widgets}:/app/config/widgets.yaml:ro"
+                  "${bookmarks}:/app/config/bookmarks.yaml:ro"
+                  "${backgroundImage}:${backgroundMount}:ro"
+              ];
+          };
+      };
+      };
+    };
+}

modules/server/containers/apps/immich.nix

@@ -0,0 +1,104 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  version = "v2";
+  serverCfg = config.syscfg.server;
+
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path = "${serverCfg.path.config}/immich";
+      dirs = ["cache"];
+      mode = "0750";
+    }{
+      path = "${serverCfg.path.data}/immich/";
+      dirs = ["upload" "thumbs" "encoded-video" "backups"];
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "ghcr.io/immich-app/immich-server:${version}";
+        port = 2283;
+        secret = name;
+        extraEnv = {
+          DB_HOSTNAME = builder.host;
+          REDIS_HOSTNAME = builder.host;
+          DB_USERNAME = "immich_user";
+          DB_DATABASE_NAME = "immich_db";
+          IMMICH_TRUSTED_PROXIES = "10.0.0.0/8";
+          IMMICH_MACHINE_LEARNING_URL = "http://immich-ml:3003";
+          # IMMICH_ALLOW_SETUP = "false";
+          # IMMICH_IGNORE_MOUNT_CHECK_ERRORS = "true";
+        };
+        overrides = {
+          volumes = [
+            "${serverCfg.path.photo}:/data/upload"
+            "${serverCfg.path.data}/immich/backups:/data/backups"
+            "${serverCfg.path.config}/immich/thumbs:/data/thumbs"
+            "${serverCfg.path.config}/immich/encoded-video:/data/encoded-video"
+          ];
+        };
+      };
+
+      ml = builder.mkContainer {
+        image = "ghcr.io/immich-app/immich-machine-learning:${version}";
+        port = 3003;
+        overrides = {
+          volumes = [
+            "${serverCfg.path.config}/immich/cache:/cache"
+          ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."CUSTOM".path;
+      script = pkgs.writeShellScript "setup" ''
+          PSQL="${pkgs.postgresql}/bin/psql -U postgres"
+          $PSQL -d "immich_db" -tAc "CREATE EXTENSION IF NOT EXISTS vchord CASCADE;"
+          $PSQL -d "immich_db" -tAc "CREATE EXTENSION IF NOT EXISTS earthdistance CASCADE;"
+
+          IMMICH_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+          until [[ "$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$IMMICH_URL")" =~ (200|301|302) ]]; do
+            sleep 5
+          done
+          ${pkgs.curl}/bin/curl -X POST "$IMMICH_URL/api/auth/admin-sign-up" \
+            -H "Content-Type: application/json" -H "Accept: application/json" \
+            -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'", "name": "'"$DEFAULT_ADMIN_USERNAME"'" }'
+
+          IMMICH_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$IMMICH_URL/api/auth/login" \
+          -H "Content-Type: application/json" \
+          -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'"}' \
+          | ${pkgs.jq}/bin/jq -r '.accessToken')        
+
+          ${lib.optionalString (serverCfg.containers ? authentik) ''
+          ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+          ${pkgs.jq}/bin/jq '.oauth.enabled = true | 
+                            .oauth.autoRegister = true |
+                            .oauth.autoLaunch = true |
+                            .oauth.signingAlgorithm = "RS256" |
+                            .oauth.profileSigningAlgorithm = "RS256" |
+                            .oauth.clientId = "immich" | 
+                            .oauth.clientSecret = "'"$IMMICH_OAUTH_SECRET"'" | 
+                            .oauth.issuerUrl = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/o/immich/" | 
+                            .oauth.scope = "openid profile email" |
+                            .oauth.buttonText = "Login with SSO"' | \
+          ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+          ''}
+
+          ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+          ${pkgs.jq}/bin/jq '.storageTemplate.enable = true |
+                            .storageTemplate.template = "{{y}}/{{#if album}}{{album}}{{else}}{{MM}}{{/if}}/{{filename}}"' | \
+          ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+          
+      '';
+    };
+  };
+}

modules/server/containers/apps/influx.nix

@@ -0,0 +1,78 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+  version = "latest";
+
+
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path = "${serverCfg.path.config}/influxdb/";
+      owner = "1500:1500";
+      mode = "0700"; 
+    }{
+      path = "${serverCfg.path.data}/influxdb/";
+      owner = "1500:1500";
+      mode = "0700"; 
+    }];
+
+    containers = {
+      # db = builder.mkContainer {
+      #   subdomain = containerCfg.subdomain;
+      #   image = "influxdata/influxdb:3.0";
+      #   port = 8181;
+      #   secret = name;
+      #   extraEnv = {
+      #     INFLUXD_DB_PATH = "/db";
+      #     INFLUXD_CONFIG_PATH = "/config";
+      #   };
+      #   overrides = {
+      #     volumes = [
+      #       "${serverCfg.path.data}/influxdb:/db:rw"
+      #       "${serverCfg.path.config}/influxdb:/config:ro"
+      #     ];
+      #   };
+      # };
+
+      server = builder.mkContainer {
+        tmpfs = true;
+        subdomain = containerCfg.subdomain;
+        image = "influxdata/influxdb3-ui:${version}";
+        port = 8080;
+        secret = name;
+        extraEnv = {
+          SESSION_SECRET_KEY = "7b0024c13ae770000f797c201e2f210b9932a689c04d34de04379faa44e88e97";
+          DATABASE_URL = "/db/sqlite.db"; 
+        };
+        overrides = {
+          ports = [ "8080:8080" ];
+          cmd = [ "--mode=admin" ]; 
+          volumes = [
+            "${serverCfg.path.data}/influxdb:/db:rw"
+            "${serverCfg.path.config}/influxdb/:/app-root/config:ro"
+          ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      script = pkgs.writeShellScript "setup" ''
+        cat > ${serverCfg.path.config}/influxdb/config.json << 'EOF'
+{
+  "DEFAULT_INFLUX_SERVER": "http://${builder.host}:8181",
+  "DEFAULT_INFLUX_DATABASE": "main",
+  "DEFAULT_API_TOKEN": "$INFLUXDB3_TOKEN",
+  "DEFAULT_SERVER_NAME": "${serverCfg.domain}"
+}
+EOF
+      chmod -R 755 ${serverCfg.path.config}/influxdb
+      '';
+    };
+  };
+}

modules/server/containers/apps/invidious.nix

@@ -0,0 +1,83 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+
+  patchedInvidious = pkgs.invidious.overrideAttrs (oldAttrs: {
+    postPatch = (oldAttrs.postPatch or "") + ''
+      cp ${../data/invidious/login.cr} src/invidious/routes/login.cr
+    '';
+  });
+
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = pkgs.invidious.name;
+    tag = pkgs.invidious.version;
+
+    contents = [ pkgs.cacert patchedInvidious ];
+    config = {
+      Entrypoint = [ "${patchedInvidious}/bin/invidious" ];
+      ExposedPorts = { "3000/tcp" = {}; };
+      Env = [ 
+        "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+        "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+      ];
+    };
+  };
+
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config}/invidious";
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 3000;
+        secret = name;
+        extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}-login.rule" = "Host(`${containerCfg.subdomain}.${serverCfg.domain}`) && Path(`/login`) ";
+          "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if serverCfg.containers?authentik then "authentik" else "";
+          "traefik.http.routers.${containerCfg.subdomain}-login.priority" = "100";
+          "traefik.http.routers.${containerCfg.subdomain}-login.entrypoints" = "web-secure";
+          "traefik.http.routers.${containerCfg.subdomain}-login.tls" = "true";
+        };
+        extraEnv = {
+          INVIDIOUS_CONFIG_FILE = "/data/config.yml";
+        };
+        overrides = {
+          volumes = [
+            "${serverCfg.path.config}/invidious:/data:ro"
+          ];
+        };
+      };
+
+      companion = builder.mkContainer {
+        image = "quay.io/invidious/invidious-companion:latest";
+        port = 8282;
+        secret = name; #SERVER_SECRET_KEY = INVIDIOUS_COMPANION_KEY
+        extraOptions = [
+          "--cap-drop=all"
+          "--security-opt=no-new-privileges"
+        ];
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = [ config.sops.secrets."INVIDIOUS".path config.sops.secrets."CUSTOM".path ];
+      script = pkgs.writeShellScript "setup" ''
+        export DB_HOST=${builder.host}
+        export INVIDIOUS_DOMAIN=${containerCfg.subdomain}.${serverCfg.domain}
+
+        ${pkgs.gettext}/bin/envsubst < "${../data/invidious/config.yml}" > "${serverCfg.path.config}/invidious/config.yml"
+      '';
+    };
+  };
+}

modules/server/containers/apps/jellyfin.nix

@@ -0,0 +1,175 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let
+  serverCfg = config.syscfg.server;
+  LDAP_DC_DOMAIN = "dc=ldap," + (lib.concatMapStringsSep "," (x: "dc=${x}") (lib.splitString "." serverCfg.domain));
+  nss = pkgs.dockerTools.fakeNss.override {
+    extraPasswdLines = [
+      "jellyfin:x:1000:1000:Jellyfin Daemon:/config/data:/bin/false"
+    ];
+    extraGroupLines = [
+      "jellyfin:x:1000:"
+    ];
+  };
+  image = pkgs.dockerTools.streamLayeredImage { # pkgs.dockerTools.buildImage{#
+    name = pkgs.jellyfin.name;
+    tag = pkgs.jellyfin.version;  
+    contents = [ pkgs.cacert nss pkgs.jellyfin pkgs.bashInteractive ];
+    config = {
+      User = "jellyfin:jellyfin"; 
+      Entrypoint = [ "${pkgs.jellyfin}/bin/jellyfin" ];
+      ExposedPorts = { "8096/tcp" = { }; };
+      Env = [ 
+        "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+        "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+      ];
+    };
+  };
+in {
+  runtime = {
+    paths = [
+      {
+        path = "${serverCfg.path.config}/jellyfin/";
+        owner = "1000:1000";
+        mode = "0755";
+      }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        tmpfs = true;
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 8096;
+        extraEnv = {
+          HOME = "/config/data";
+          DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = "1";
+          JELLYFIN_HttpListenerHost__BindAddress= "0.0.0.0"; #we can use settings.xml override
+          JELLYFIN_ServerName = if containerCfg.extra?name then containerCfg.extra.name else "Flix";
+        };
+        overrides = {
+          cmd = [
+          "--datadir" "/config/data"
+          "--cachedir" "/config/cache"
+          "--configdir" "/config/config"
+          "--logdir" "/config/log" 
+          ];
+          volumes = [
+            "${serverCfg.path.film}:/media:ro" 
+            "${serverCfg.path.config}/jellyfin:/config"
+          ];
+          # If you have an Intel/AMD GPU for transcoding, add the device:
+          devices = lib.optionals (builtins.pathExists "/dev/dri") [ "/dev/dri:/dev/dri" ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."CUSTOM".path;
+      script = pkgs.writeShellScript "setup" ''
+        JELLYFIN_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+        until [ "$(${pkgs.curl}/bin/curl -sf "$JELLYFIN_URL/health")" = "Healthy" ]; do
+          sleep 5
+        done
+        echo "Jellyfin is up. Sleeping for 20 seconds..."
+        sleep 20
+        WIZARD_COMPLETE=$(${pkgs.curl}/bin/curl -sSf "$JELLYFIN_URL/System/Info/Public" 2>/dev/null | \
+          ${pkgs.jq}/bin/jq -r '.StartupWizardCompleted // false')
+        if [ "$WIZARD_COMPLETE" = "false" ]; then
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Startup/Configuration" \
+            -H "Content-Type: application/json" \
+            -d '{"ServerName":"Flix","UICulture":"en-US","MetadataCountryCode":"US","PreferredMetadataLanguage":"en"}'; then
+            echo "ERROR: Failed to set startup configuration."
+            exit 1
+          fi
+          
+          if ! ${pkgs.curl}/bin/curl -sSf -X GET "$JELLYFIN_URL/Startup/User"; then
+            echo "ERROR: Failed to get base user."
+            exit 1
+          fi
+
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Startup/User" \
+            -H 'accept: */*' -H "Content-Type: application/json" \
+            -d '{"Name": "'"$DEFAULT_ADMIN_USERNAME"'", "Password": "'"$DEFAULT_ADMIN_PASSWORD"'"}'; then
+            echo "ERROR: Failed to set admin user."
+            exit 1
+          fi
+
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Startup/RemoteAccess" \
+            -H "Content-Type: application/json" \
+            -d '{"EnableRemoteAccess":true,"EnableAutomaticPortMapping":false}'; then
+            echo "ERROR: Failed to configure remote access."
+            exit 1
+          fi
+
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "''$JELLYFIN_URL/Startup/Complete"; then
+            echo "ERROR: Failed to complete wizard."
+            exit 1
+          fi
+          echo "Jellyfin initialization successfully completed!"
+        fi
+
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        JELLYFIN_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Users/AuthenticateByName" \
+          -H "Content-Type: application/json" \
+          -H "Authorization: MediaBrowser Client=\"Bash Script\", Device=\"Server Terminal\", DeviceId=\"script-12345\", Version=\"1.0.0\"" \
+          -d "{\"Username\": \"$DEFAULT_ADMIN_USERNAME\", \"Pw\": \"$DEFAULT_ADMIN_PASSWORD\"}" \
+          | ${pkgs.jq}/bin/jq -r '.AccessToken')
+
+        # Verify we got a token
+        if [ "$JELLYFIN_TOKEN" = "null" ] || [ -z "$JELLYFIN_TOKEN" ]; then
+            echo "ERROR: Authentication failed."
+            exit 1
+        fi
+        if ${pkgs.curl}/bin/curl -sSf -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+            "$JELLYFIN_URL/Plugins" | ${pkgs.gnugrep}/bin/grep -q "958aad6637844d2ab89aa7b6fab6e25c"; then
+          echo "LDAP Plugin is already installed. Skipping setup."
+        else
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Packages/Installed/LDAP%20Authentication?assemblyGuid=958aad6637844d2ab89aa7b6fab6e25c" \
+              -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+              -H "Content-Length: 0"; then
+            echo "ERROR: LDAP Plugin Setup Failed."
+            exit 1
+          fi
+
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/System/Restart" \
+              -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+              -H "Content-Length: 0"; then
+            echo "ERROR: Server failed to accept restart command."
+            exit 1
+          fi
+          sleep 1-
+          until [ "$(${pkgs.curl}/bin/curl -sf "$JELLYFIN_URL/health")" = "Healthy" ]; do
+            sleep 5
+          done
+          echo "Jellyfin is up. Sleeping for 20 seconds..."
+          sleep 20
+        fi
+
+        if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Plugins/958aad66-3784-4d2a-b89a-a7b6fab6e25c/Configuration" \
+            -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+            -H "Content-Type: application/json" -H 'accept: */*' \
+            -d '{"LdapUsers":[],"LdapServer":"authentik-ldap","LdapPort":6636,"UseSsl":true,"UseStartTls":false,"SkipSslVerify":true,
+            "LdapBindUser":"cn=ldap-service,ou=users,${LDAP_DC_DOMAIN}","LdapBindPassword": "'"$DEFAULT_LDAP_PASSWORD"'",
+            "LdapBaseDn":"${LDAP_DC_DOMAIN}","LdapSearchFilter":"(memberOf=cn=flix,ou=groups,${LDAP_DC_DOMAIN})",
+            "LdapSearchAttributes":"uid, cn, mail, displayName",
+            "LdapAdminBaseDn":"","LdapAdminFilter":"(memberOf=cn=admin,ou=groups,${LDAP_DC_DOMAIN})",
+            "EnableLdapAdminFilterMemberUid":false,"LdapUidAttribute":"uid","LdapUsernameAttribute":"cn","LdapPasswordAttribute":"userPassword",
+            "EnableLdapProfileImageSync":false,"RemoveImagesNotInLdap":false,"LdapProfileImageAttribute":"jpegphoto","LdapProfileImageFormat":"Default",
+            "LdapClientCertPath":"","LdapClientKeyPath":"","LdapRootCaPath":"","CreateUsersFromLdap":true,"AllowPassChange":false,
+            "EnableAllFolders":true,"EnabledFolders":[],"PasswordResetUrl":""}'; then
+          echo "ERROR: LDAP Plugin Setup Failed."
+          exit 1
+        fi
+        ''}
+
+        ${pkgs.sqlite}/bin/sqlite3 ${serverCfg.path.config}/jellyfin/data/data/jellyfin.db <<EOF
+INSERT OR IGNORE INTO ApiKeys (Id, AccessToken, Name, DateCreated, DateLastActivity) 
+VALUES ( 1, "$HOMEPAGE_VAR_JELLYFIN_API", 'Home', strftime('%Y-%m-%d %H:%M:%S', 'now'), strftime('%Y-%m-%d %H:%M:%S', 'now'));
+EOF
+        echo "Completed Setup"
+
+      '';
+    };
+  };
+}

modules/server/containers/apps/nextcloud.nix

@@ -0,0 +1,213 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  version = "31";
+  serverCfg = config.syscfg.server;
+  mediaCfg = config.syscfg.media;
+  backgroundImage = if mediaCfg.banner.png != null then mediaCfg.banner.png else mediaCfg.bg;
+  backgroundFileName = builtins.baseNameOf (toString backgroundImage);
+  logoPngFileName = builtins.baseNameOf (toString mediaCfg.logo.png);
+  logoSvgFileName = builtins.baseNameOf (toString mediaCfg.logo.svg);
+  logoIcoFileName = builtins.baseNameOf (toString mediaCfg.logo.ico);
+  logoPngMount = "/var/www/html/theming/${logoPngFileName}";
+  logoSvgMount = "/var/www/html/theming/${logoSvgFileName}";
+  logoIcoMount = "/var/www/html/theming/${logoIcoFileName}";
+  backgroundMount = "/var/www/html/theming/${backgroundFileName}";
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config}/nextcloud";
+      owner = "33:33";
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        tmpfs = true;
+        subdomain = containerCfg.subdomain;
+        image = "nextcloud:${version}";
+        port = 80;
+        secret = name;
+        extraEnv = {
+          REDIS_HOST = builder.host;
+          POSTGRES_HOST = builder.host;
+          POSTGRES_USER = "nextcloud_user";
+          POSTGRES_DB = "nextcloud_db";
+          AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+          NEXTCLOUD_TRUSTED_DOMAINS = "${containerCfg.subdomain}.${serverCfg.domain} nextcloud-server";
+          # SMTP_HOST = serverCfg.mail.server;
+          # SMTP_NAME = "mail_user";
+          # SMTP_PASSWORD = "mail_password";
+          # MAIL_FROM_ADDRESS = "${containerCfg.subdomain}@${serverCfg.domain}";
+          # MAIL_DOMAIN = serverCfg.mail.domain;
+          TRUSTED_PROXIES = "10.10.0.0/16 192.168.0.0/16";
+          NEXTCLOUD_DATA_DIR = "/var/www/html/data";
+        };
+        extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}.middlewares" = "sts_headers,${containerCfg.subdomain}-caldav";
+          "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.permanent" = "true";
+          "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.regex" = "https://(.*)/.well-known/(?:card|cal)dav";
+          "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.replacement" = "https://$1/remote.php/dav";
+          "traefik.http.middlewares.sts_headers.headers.stsSeconds" = "15552000";
+          "traefik.http.middlewares.sts_headers.headers.stsIncludeSubdomains" = "true";
+        };
+        overrides = {
+          ports = if containerCfg.port!=null then [ "${toString containerCfg.port}:80" ] else [];
+          volumes = [
+            "${serverCfg.path.config}/nextcloud:/var/www/html"
+            "${serverCfg.path.cloud}:/var/www/html/data"
+            "${mediaCfg.logo.png}:${logoPngMount}:ro"
+            "${mediaCfg.logo.svg}:${logoSvgMount}:ro"
+            "${mediaCfg.logo.ico}:${logoIcoMount}:ro"
+            "${backgroundImage}:${backgroundMount}:ro"
+          ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      script = pkgs.writeShellScript "setup" ''
+      # Define the command wrapper
+      OCC="${pkgs.podman}/bin/podman --events-backend=none exec --env-file ${config.sops.secrets."CUSTOM".path} -e DOMAIN=${serverCfg.domain} -u www-data nextcloud-server php occ"
+
+      echo "Waiting for Nextcloud container to start..."
+      until $OCC status > /dev/null 2>&1; do
+        sleep 2
+      done
+
+      INSTALLED=$($OCC status --output=json | grep -o '"installed":true')
+      if [ -z "$INSTALLED" ]; then
+        echo "Running first-time setup..."
+        
+        $OCC maintenance:install \
+          --admin-user "$DEFAULT_ADMIN_USERNAME" \
+          --admin-pass "$DEFAULT_ADMIN_PASSWORD"
+      fi
+      if [ -z "$INSTALLED" ] || [ -f "/tmp/force-nextcloud-setup" ]; then
+        rm -f "/tmp/force-nextcloud-setup"
+        echo "Applying Settings..."
+        
+        $OCC config:system:set default_phone_region --value="CH"
+        $OCC config:system:set overwriteprotocol --value="https"
+        $OCC config:app:set core backgroundjobs_mode --value="cron"
+        $OCC config:system:set maintenance_window_start --type=integer --value=1
+        $OCC config:system:set default_language --value="en"
+        $OCC config:system:set default_locale --value="en_CH"
+
+        echo "Applying Apps..."
+        $OCC app:disable activity || true
+        $OCC app:disable app_api || true
+        $OCC app:disable comments || true
+        $OCC app:disable firstrunwizard || true
+        $OCC config:system:set show_first_run_wizard --type=bool --value=false
+        $OCC app:disable nextcloud_announcements || true
+        $OCC app:disable oauth2 || true
+        $OCC app:disable recommendations || true
+        $OCC app:disable sharebymail || true
+        $OCC app:disable support || true
+        $OCC app:disable survey_client || true
+        $OCC app:disable updatenotification || true
+        $OCC app:disable user_status || true
+
+        $OCC app:install calendar || true
+        $OCC app:install contacts || true
+        $OCC app:install camerarawpreviews || true
+        $OCC app:install cospend || true
+        $OCC app:install deck || true
+        $OCC app:install files_markdown || true
+        $OCC app:install forms || true
+        $OCC app:install groupfolders || true
+        $OCC app:install ownpad || true
+        $OCC app:install previewgenerator || true
+        $OCC app:install richdocuments || true
+        ${lib.optionalString (serverCfg.containers ? collabora == false) ''$OCC app:install richdocumentscode || true''}
+        # $OCC app:install side_menu || true 
+        $OCC app:install spreed || true
+        $OCC app:install teamfolders || true
+        ${lib.optionalString (serverCfg.containers ? authentik) ''$OCC app:install user_saml || true''}
+
+        echo "Applying Apps Settings..."
+        $OCC config:system:set enabledPreviewProviders --value='["OC\\Preview\\Movie", "OC\\Preview\\PNG", "OC\\Preview\\JPEG", "OC\\Preview\\GIF", "OC\\Preview\\HEIC", "OC\\Preview\\RAW"]' --type=json
+        $OCC config:app:set cospend allow_federation --value="yes"
+        
+        ${lib.optionalString (serverCfg.containers ? ethercalc) ''
+        $OCC config:app:set ownpad ownpad_ethercalc_enable --value="yes"
+        $OCC config:app:set ownpad ownpad_ethercalc_host --value="https://${serverCfg.containers.ethercalc.subdomain}.${serverCfg.domain}"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? etherpad) ''
+        $OCC config:app:set ownpad ownpad_etherpad_enable --value="yes"
+        $OCC config:app:set ownpad ownpad_etherpad_host --value="https://${serverCfg.containers.etherpad.subdomain}.${serverCfg.domain}"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? collabora) ''
+        $OCC config:app:set richdocuments wopi_url --value="https://${serverCfg.containers.collabora.subdomain}.${serverCfg.domain}/"
+        $OCC config:app:set richdocuments public_wopi_url --value="https://${serverCfg.containers.collabora.subdomain}.${serverCfg.domain}"
+        $OCC config:app:set richdocuments wopi_allowlist --value="10.0.0.0/8"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        $OCC saml:config:set 1 --general-idp0_display_name="authentik"
+        $OCC saml:config:set 1 --general-uid_mapping="http://schemas.goauthentik.io/2021/02/saml/username"
+        $OCC saml:config:set 1 --idp-entityId="https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}"
+        $OCC saml:config:set 1 --idp-singleSignOnService.url="https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/saml/nextcloud/sso/binding/redirect/"
+        $OCC saml:config:set 1 --idp-singleLogoutService.url="https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/saml/nextcloud/slo/binding/redirect/"
+        AUTHENTIK_CERT=$(${pkgs.postgresql}/bin/psql -h localhost -U authentik_user -d authentik_db -At -c "SELECT certificate_data FROM authentik_crypto_certificatekeypair WHERE name = 'authentik Self-signed Certificate';")
+        $OCC saml:config:set 1 --idp-x509cert="$AUTHENTIK_CERT" 
+
+        $OCC saml:config:set 1 --saml-attribute-mapping-displayName_mapping="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
+        $OCC saml:config:set 1 --saml-attribute-mapping-email_mapping="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
+        $OCC saml:config:set 1 --saml-attribute-mapping-group_mapping="http://schemas.xmlsoap.org/claims/Group"
+
+        $OCC config:app:set user_saml general-allowed_groups --value="admin,cloud"
+        $OCC group:add cloud || true
+        $OCC group:adduser admin $DEFAULT_ADMIN_USERNAME
+        $OCC config:app:set user_saml general-group_provisioning --value="0"
+        $OCC config:app:set user_saml general-require_provisioning_groups --value="1"
+        ''}
+        # configure side_menu ...
+        FOLDERS=$($OCC teamfolders:list --format=json)
+        ${builtins.concatStringsSep "\n" (map (name: ''
+          if ! echo "$FOLDERS" | grep -q '"name":"${name}"'; then
+              $OCC teamfolders:create "${name}"
+          fi
+        '') containerCfg.extra.teamFolders or [])}
+        SERVERS=$($OCC federation:list-servers --format=json)
+        ${builtins.concatStringsSep "\n" (map (domain: ''
+          if ! echo "$SERVERS" | grep -q "${domain}"; then
+            $OCC federation:add-server "https://${domain}"
+          fi
+        '') containerCfg.extra.federatedServers or [])}
+        $OCC config:app:set systemtags allow_user_creating --value="no"
+        
+      else
+          echo "Nextcloud is already installed. Skipping setup."
+      fi
+
+      echo "Applying Theme..."
+      $OCC config:app:set theming url --value="https://${containerCfg.subdomain}.${serverCfg.domain}"
+      ${lib.optionalString (containerCfg.extra ? name) ''$OCC config:app:set theming name --value="${containerCfg.extra.name}"''}
+      ${lib.optionalString (containerCfg.extra ? slogan) ''$OCC config:app:set theming slogan --value="${containerCfg.extra.slogan}"''}
+      $OCC config:app:set theming background_color --value="${serverCfg.colorScheme.palette.base02}"
+      $OCC config:app:set theming primary_color --value="${serverCfg.colorScheme.palette.base0C}"
+      $OCC theming:config logo "${logoPngMount}"
+      $OCC theming:config logoheader "${logoSvgMount}"
+      $OCC theming:config favicon "${logoIcoMount}"
+      $OCC theming:config background "${backgroundMount}"
+
+      $OCC config:app:set serverinfo token --value="$HOMEPAGE_VAR_NEXTCLOUD_API"
+
+      echo "Maintenance..."
+      $OCC app:update --all
+      $OCC maintenance:repair --include-expensive --no-interaction
+      $OCC db:add-missing-indices --no-interaction
+
+      echo "Completed Setup"
+      '';
+    };
+
+    cron = [ "*/5 * * * *  root  ${pkgs.podman}/bin/podman --events-backend=none exec -u www-data nextcloud-server php -f /var/www/html/cron.php" ];
+  };
+}

modules/server/containers/apps/openhab.nix

@@ -0,0 +1,77 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  version = "5.1.4"; 
+
+in {
+  runtime = {
+    paths = [
+      { path="${serverCfg.path.config}/openhab/conf";  owner="1000:1000"; mode = "0755"; }
+      { path="${serverCfg.path.config}/openhab/userdata";  owner="1000:1000"; mode = "0755"; }
+      { path="${serverCfg.path.config}/openhab/addons";  owner="1000:1000"; mode = "0755"; }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "openhab/openhab:${version}";
+        port = 8080; 
+        extraEnv = { 
+          USER_ID = "1000";
+          GROUP_ID = "1000";
+          CRYPTO_POLICY = "unlimited";
+          OPENHAB_HTTP_PORT = "8080";
+        };
+        extraOptions = [
+          "--network=host"
+          "--cap-add=NET_ADMIN"
+          "--cap-add=NET_RAW"
+          "--no-healthcheck"
+        ];
+        overrides = {
+          volumes = [ 
+            "${serverCfg.path.config}/openhab/conf:/openhab/conf"
+            "${serverCfg.path.config}/openhab/userdata:/openhab/userdata"
+            "${serverCfg.path.config}/openhab/addons:/opt/openhab/addons"
+            "/var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket:ro"
+          ];
+         };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = [ config.sops.secrets."CUSTOM".path ];
+      script = pkgs.writeShellScript "setup" ''
+        # Pre-generate openHAB directories on the host
+        OHAB="${pkgs.podman}/bin/podman --events-backend=none exec openhab-server /openhab/runtime/bin/client -u openhab -p habopen"
+        sleep 20
+        exit 0
+        $OHAB openhab:users add $DEFAULT_ADMIN_USERNAME $DEFAULT_ADMIN_PASSWORD administrator 
+        $OHAB feature:list
+        $OHAB openhab:addons install persistance-mapdb
+        $OHAB openhab:addons install persistance-influxdb
+
+        $OHAB openhab:addons install ui-basic
+        $OHAB openhab:addons install automation-jsscripting
+
+        $OHAB openhab:addons install binding-telegram
+        $OHAB openhab:addons install binding-matter
+        $OHAB openhab:addons install binding-mqtt
+        $OHAB openhab:addons install binding-bluetooth
+        $OHAB openhab:addons install binding-zigbee
+        $OHAB openhab:addons install binding-chromecast
+        $OHAB openhab:addons install binding-astro
+        $OHAB openhab:addons install binding-meteoblue
+        $OHAB openhab:addons install binding-publictransportswitzerland
+
+        #IF APPLE DEVICE: HomeKit (siri/apple bridge)
+        #IF UBIQUITY NET: Unifi + UnifiProtect (net/cam bridge)
+        #IF YAMAHA+EPSON: EpsonProjector + Yamaha (projector and sound)
+        #IF BAMBULAB DEVICE: BambuLab (notify print state)
+        #IF GARDENA DEVICE: Gardena (smart watering)
+        #Extra: AndroidTV/Jellyfin (Bind with lights + more)
+      '';
+    };
+  };
+}

modules/server/containers/apps/searxng.nix

@@ -0,0 +1,87 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  version = "latest";
+  serverCfg = config.syscfg.server;
+  settings = pkgs.writeText"settings.yml" (pkgs.lib.generators.toYAML {}{
+    use_default_settings = true;
+    brand = {
+        issue_url = "";
+        docs_url = "";
+        public_instances = "";
+        wiki_url = "";
+        custom = {
+            links = {
+                "Home" = "https://${serverCfg.domain}";
+                # "Status" = "https://status.${serverCfg.domain}";
+            };
+        };
+        pwa_colors = {
+            theme_color_light = "${serverCfg.colorScheme.palette.base0C}";
+            background_color_light = "${serverCfg.colorScheme.palette.base07}";
+            theme_color_dark = "${serverCfg.colorScheme.palette.base0C}";
+            background_color_dark = "${serverCfg.colorScheme.palette.base02}";
+            theme_color_black = "${serverCfg.colorScheme.palette.base0C}";
+            background_color_black = "${serverCfg.colorScheme.palette.base01}";
+        };
+    };
+    general = {
+        debug = false;
+        instance_name = if containerCfg.extra ? instanceName then containerCfg.extra.instanceName else "SearXNG";
+        privacypolicy_url = false;
+        donation_url = false;
+        contact_url = false;
+        enable_metrics = false;
+    };
+    search = {
+        safe_search = 0;
+        autocomplete = if containerCfg.extra ? autocomplete then containerCfg.extra.autocomplete else "";
+        languages = [ "all" "en" "en-US" "ja" "de-CH" "fr-CH" "nb" ];
+    };
+    server = {
+        # secret_key = ""; SET BY ENV VAR
+    };
+    ui = {
+        default_locale = if containerCfg.extra ? defaultLocale then containerCfg.extra.defaultLocale else "en";
+        # query_in_title = "true";
+        #default_theme = "custom";
+        custom_css = "footer { display: none !important; }";
+    };
+    # categories_as_tabs = {
+    #     general = {};
+    #     images ={};
+    #     videos = {};
+    #     news = {};
+    #     files = {};
+    # };
+    plugins = {
+        "searx.plugins.infinite_scroll.SXNGPlugin".active = true;
+        "searx.plugins.tracker_url_remover.SXNGPlugin".active = true;
+    };
+  });
+in {
+  requires.secrets = [ name ];
+
+  runtime = {
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "searxng/searxng:${version}";
+        port = 8080;
+        secret = name;
+        extraEnv = { 
+          SEARXNG_BASE_URL = "https://${containerCfg.subdomain}.${serverCfg.domain}";
+          SEARXNG_PORT = "8080";
+          SEARXNG_BIND_ADDRESS = "[::]";
+          SEARXNG_PUBLIC_INSTANCE = "false";
+          SEARXNG_SETTINGS_PATH = "/etc/searxng/settings.yml";
+          #SEARXNG_VALKEY_URL = "valkey://user:password@${builder.host}:6379/0}";
+        };
+        overrides = {
+          volumes = [ 
+              "${settings}:/etc/searxng/settings.yml"
+          ];
+         };
+      };
+    };
+  };
+}

modules/server/containers/apps/selfmark.nix

@@ -0,0 +1,90 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+in {
+  runtime = {
+    paths = [{
+      path = "${serverCfg.path.config}/selfmark/";
+      mode = "0444";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        authentik = true;
+        subdomain = containerCfg.subdomain;
+        subpath = containerCfg.subpath;
+        image = "ghcr.io/calibrain/shelfmark:${version}";
+        port = 8080;
+        
+        extraEnv = {
+          # HARDCOVER_API_KEY = ""; #FROM SOPS
+          # AA_DONATOR_KEY = ""; #FROM SOPS
+          # PROWLARR_API_KEY = ""; #FROM SOPS
+
+          FLASK_PORT = "8080";
+          PUID = "1000";
+          PGID = "1000";
+          USING_TOR = "false";
+          ONBOARDING = "false";
+          SUPPORTED_FORMATS = "epub,mobi,azw3,fb2,djvu,cbz,cbr,pdf";
+          SUPPORTED_AUDIOBOOK_FORMATS = "mp3, m4b";
+          BOOK_LANGUAGE = "en,fr"; # ,de,jp";
+          SEARCH_MODE = "universal";
+          AA_DEFAULT_SORT = "relevance";
+          METADATA_PROVIDER = "openlibrary";
+          INGEST_DIR = "/books";
+          BOOKS_OUTPUT_MODE = "/output";
+          FILE_ORGANIZATION = "organize";
+          TEMPLATE_RENAME = "{Author} - {Title} ({Year})";
+          TEMPLATE_ORGANIZE = "{Author}/{Title} ({Year})";
+          HARDLINK_TORRENTS = "false";
+          FILE_ORGANIZATION_AUDIOBOOK = "organize";
+          TEMPLATE_RENAME_AUDIOBOOK = "{Author} - {Title}";
+          TEMPLATE_ORGANIZE_AUDIOBOOK = "{Author}/{Title} ({Year})";
+
+          HARDCOVER_ENABLED = "true";
+          HARDCOVER_DEFAULT_SORT = "relevance";
+          OPENLIBRARY_ENABLED = "true";
+          OPENLIBRARY_DEFAULT_SORT = "relevance";
+          DIRECT_DOWNLOAD_ENABLED = "true";
+
+          USE_CF_BYPASS = "true";
+          AA_BASE_URL = "auto";
+          AA_MIRROR_URLS = "https://annas-archive.gl,https://annas-archive.pk,https://annas-archive.gd,";
+          LIBGEN_MIRROR_URLS = "https://libgen.li,https://libgen.vg,https://libgen.la,https://libgen.bz,https://libgen.gl";
+          ZLIB_MIRROR_URLS = "https://z-lib.sk,https://z-library.gs,https://z-lib.fm,https://z-lib.gd,https://z-lib.gl";
+          # WELIB_MIRROR_URLS = "https://welib.org"; #avoid
+        } // lib.optionalAttrs(containerCfg.subpath != null) {
+          BASE_PATH = "/${containerCfg.subpath}";
+          URL_BASE = "/${containerCfg.subpath}";
+        } // lib.optionalAttrs(serverCfg.containers?calibre) {
+          CALIBRE_WEB_URL = "https://${serverCfg.containers.calibre.subdomain}.${serverCfg.domain}";
+        } // lib.optionalAttrs(serverCfg.containers?authentik) {
+          AUTH_METHOD = "proxy";
+          PROXY_AUTH_USER_HEADER = "X-authentik-username";
+          PROXY_AUTH_ADMIN_GROUP_HEADER = "X-authentik-groups";
+          PROXY_AUTH_ADMIN_GROUP_NAME = "admin";
+        } // lib.optionalAttrs(serverCfg.containers?servarr && builtins.elem "prowlarr" serverCfg.containers.servarr.extra.modules) ({
+          PROWLARR_ENABLED = "true";
+          PROWLARR_URL = "http://servarr-prowlarr:8989";
+        } // lib.optionalAttrs(serverCfg.containers?transmission) {
+          PROWLARR_TORRENT_CLIENT = "transmission";
+          TRANSMISSION_URL = "http://transmission-server:9091";
+        }) // lib.optionalAttrs(serverCfg.containers?servarr && builtins.elem "flaresolverr" serverCfg.containers.servarr.extra.modules) {
+          USING_EXTERNAL_BYPASSER = "true";
+          EXT_BYPASSER_URL = "http://servarr-flaresolverr:8191";
+          EXT_BYPASSER_PATH = "/v1";
+          EXT_BYPASSER_TIMEOUT = "60000";
+        };
+        overrides = {
+          volumes = [
+            "${serverCfg.path.dlComplete}:/books:rw"
+            "${serverCfg.path.book}:/output:rw"
+            "${serverCfg.path.config}/selfmark:/config:rw"
+           ];
+         };
+      };
+    };
+  };
+}

modules/server/containers/apps/suwayomi.nix

@@ -0,0 +1,53 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "stable"; 
+  serverCfg = config.syscfg.server;
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "ghcr.io/suwayomi/suwayomi-server:${version}";
+        port = 4567;
+        secret = name;
+
+        extraEnv = {
+          BIND_PORT = "4567";
+          AUTH_MODE = "ui_login";
+          WEB_UI_ENABLED = "true";
+          WEB_UI_FLAVOR = "WebUI";
+          # AUTO_DOWNLOAD_CHAPTERS = true;
+          # AUTO_DOWNLOAD_EXCLUDE_UNREAD = true;
+          # AUTO_DOWNLOAD_NEW_CHAPTERS_LIMIT = 0;
+          # AUTO_DOWNLOAD_IGNORE_REUPLOADS = false;
+          # DOWNLOAD_CONVERSIONS = {};
+          # SERVE_CONVERSIONS = {};
+          # MAX_SOURCES_IN_PARALLEL = 6;
+          # UPDATE_EXCLUDE_UNREAD = true;
+          # UPDATE_EXCLUDE_STARTED = true;
+          # UPDATE_EXCLUDE_COMPLETED = true;
+          # UPDATE_INTERVAL = 12; #Hours
+          # UPDATE_MANGA_INFO = false;
+          DATABASE_TYPE = "POSTGRESQL";
+          DATABASE_URL = "postgresql://${builder.host}/suwayomi_db";
+          DATABASE_USERNAME = "suwayomi_user";
+          FLARESOLVERR_ENABLED = lib.boolToString (builtins.elem "flaresolverr" (((config.syscfg.server.containers.servarr or {}).extra or {}).modules or []));
+          FLARESOLVERR_URL = "http://servarr-flaresolverr:8191";
+          EXTENSION_REPOS = "[\"https://raw.githubusercontent.com/keiyoushi/extensions/repo/index.min.json\"]"; #https://raw.githubusercontent.com/keiyoushi/extensions/repo/index.min.json
+        };
+
+        overrides = {
+          volumes = [
+            "${serverCfg.path.manga}:/home/suwayomi/.local/share/Tachidesk/downloads"
+            # "${serverCfg.path.config}/suwayomi:/home/suwayomi/.local/share/Tachidesk"
+          ];
+        };
+      };
+    };
+  };
+}

modules/server/containers/apps/traefik.nix

@@ -0,0 +1,89 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "traefik";
+    tag = pkgs.traefik.version;
+    contents = with pkgs;[ cacert tzdata ];
+    config = {
+      Entrypoint = [ "${pkgs.traefik}/bin/traefik" ];
+      WorkingDir = "/";
+    };
+  };
+in {
+  requires.secrets = [ name ];
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config}/traefik";
+      owner = "1000:1000";
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        imageStream = image;
+        subdomain = containerCfg.subdomain;
+        port = 8080;
+        secret = name;
+        extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}.priority" = "10";
+          "traefik.http.routers.${containerCfg.subdomain}.service" = "api@internal";
+                  
+          "traefik.http.routers.${containerCfg.subdomain}.middlewares" =  if serverCfg.containers?authentik then "authentik" else "";
+        } // (if serverCfg.containers?authentik then {
+          "traefik.http.middlewares.authentik.forwardauth.maxResponseBodySize" = "10485760";
+          "traefik.http.middlewares.authentik.forwardauth.address" = "http://authentik-server:9000/outpost.goauthentik.io/auth/traefik";
+          "traefik.http.middlewares.authentik.forwardauth.trustForwardHeader" = "true";
+          "traefik.http.middlewares.authentik.forwardauth.authResponseHeaders" = "X-authentik-username,X-authentik-groups,X-authentik-email,X-authentik-name,X-authentik-uid,X-authentik-jwt,X-authentik-meta-jwks,X-authentik-meta-outpost,X-authentik-meta-provider,X-authentik-meta-app,X-authentik-meta-version";
+        } else {}) // (if serverCfg.containers?umami then {
+          "traefik.http.middlewares.umami-global.plugin.umami-feeder.umamiHost" = "http://umami-server:3000";
+          "traefik.http.middlewares.umami-global.plugin.umami-feeder.umamiUsername" = "admin";
+          "traefik.http.middlewares.umami-global.plugin.umami-feeder.umamiPassword" = "umami";
+          "traefik.http.middlewares.umami-global.plugin.umami-feeder.createNewWebsites" = "true";
+        } else {}) // (if containerCfg.extra ? provider || serverCfg.domain != "localhost" then {
+          "traefik.http.routers.${containerCfg.subdomain}.tls.certresolver" = "default";
+          "traefik.http.routers.${containerCfg.subdomain}.tls.domains[0].main" = "${serverCfg.domain}";
+          "traefik.http.routers.${containerCfg.subdomain}.tls.domains[0].sans" = "*.${serverCfg.domain}";
+        } else {});
+        extraEnv = { };
+        overrides = {
+          cmd = [ 
+            "--api"
+            "--log.level=INFO"
+            "--providers.docker=true"
+            "--global.checknewversion=false"
+            "--global.sendanonymoususage=false"
+            "--api.insecure=true"
+            "--api.dashboard=true"
+            "--providers.docker.exposedByDefault=false"
+            "--entrypoints.web.address=:80"
+            "--entrypoints.web-secure.address=:443"
+            "--entrypoints.web.http.redirections.entrypoint.to=web-secure"
+            "--entrypoints.web.http.redirections.entrypoint.scheme=https"
+            "--entrypoints.web-secure.transport.respondingtimeouts.readtimeout=0s"
+            "--entrypoints.web-secure.proxyprotocol.trustedips=127.0.0.1/32,192.168.1.1/16,10.10.0.0/16"
+          ] ++ (if serverCfg.containers ? umami  then [
+            "--experimental.plugins.umami-feeder.moduleName=github.com/astappiev/traefik-umami-feeder"
+            "--experimental.plugins.umami-feeder.version=v1.4.1"
+            "--entrypoints.web-secure.http.middlewares=umami-global@docker"
+          ] else []) ++ (if containerCfg.extra ? provider then [
+            "--certificatesresolvers.default.acme.email=acme@${serverCfg.domain}"
+            "--certificatesresolvers.default.acme.dnschallenge=true"
+            "--certificatesresolvers.default.acme.dnschallenge.provider=${containerCfg.extra.provider}"
+            "--certificatesresolvers.default.acme.storage=/custom/acme.json"
+          ] else []) ++ (if serverCfg.domain != "localhost" then [
+            "--certificatesresolvers.default.acme.httpchallenge=false"
+            "--certificatesresolvers.default.acme.tlschallenge=true"
+          ] else []);
+          ports = [ "443:443" "80:80" ] ++ (if containerCfg.port!=null then [ "${toString containerCfg.port}:8080" ] else []);
+          volumes = [
+            "/var/run/podman/podman.sock:/var/run/docker.sock"
+            # "${serverCfg.path.config}/traefik/access.log:/etc/traefik/access.log"
+            "${serverCfg.path.config}/traefik:/custom"
+          ];
+        };
+      };
+    };
+  };
+}

modules/server/containers/apps/transmission.nix

@@ -0,0 +1,59 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = pkgs.transmission_4.name;
+    tag = pkgs.transmission_4.version;
+    contents = [ pkgs.cacert ];
+    config = {
+        Cmd = [ "${pkgs.transmission_4}/bin/transmission-daemon" "--foreground" "--config-dir" "/config" ];
+        ExposedPorts = {
+            "9091/tcp" = {};
+            "51413/tcp" = {}; "51413/udp" = {};
+        };
+    };
+  };
+in {
+  runtime = {
+    paths = [{
+        path = "${serverCfg.path.config}/transmission";
+        owner = "1000:1000";
+        mode = "0755";
+      }];
+
+    containers = {
+      server = builder.mkContainer {
+        authentik = true;
+        subdomain = containerCfg.subdomain;
+        subpath = containerCfg.subpath;
+        imageStream = image;
+        port = 9091;
+        
+        extraEnv = {
+          PUID = "1000";
+          PGID = "1000";
+          WHITELIST = "";# 127.0.0.1,::1,10.*";
+          # HOST_WHITELIST = "traefik-server,authentik-server,authentik-worker";
+        };
+
+        overrides = {
+          volumes = [
+            "${serverCfg.path.dlComplete}:/downloads/complete"
+            "${serverCfg.path.dlIncomplete}:/downloads/incomplete"
+            "${serverCfg.path.config}/transmission:/config"
+          ];
+        };
+      };
+    };
+
+
+    setup = {
+      trigger = "server";
+      envFile = [ config.sops.secrets."CUSTOM".path ];
+      script = pkgs.writeShellScript "setup" ''
+
+        ${pkgs.gettext}/bin/envsubst < "${../data/transmission/settings.json}" > "${serverCfg.path.config}/transmission/config/settings.json"
+      '';
+    };
+  };
+}

modules/server/containers/apps/trmnl.nix

@@ -0,0 +1,3 @@
+{...}:{
+    
+}

modules/server/containers/apps/umami.nix

@@ -0,0 +1,54 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  
+  # Umami image built from nixpkgs
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = pkgs.umami.name;
+    tag = pkgs.umami.version;
+    contents = with pkgs; [ cacert openssl ];
+    config = {
+      # Umami in nixpkgs typically provides a binary or script to start the server
+      Entrypoint = [ "${pkgs.umami}/bin/umami-server" ];
+      ExposedPorts = { "3000/tcp" = {}; };
+      Env = [ "NODE_ENV=production" ];
+    };
+  };
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path = "${serverCfg.path.config}/umami/";
+      mode = "0444";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        authentik = true;
+        tmpfs = true;
+        subdomain = containerCfg.subdomain;
+        image = "${pkgs.umami.name}:${pkgs.umami.version}"; 
+        imageStream = image;
+        port = 3000;
+        secret = name;
+        extraEnv = {
+          PORT = "3000";
+          # HOSTNAME = "${containerCfg.subdomain}.${serverCfg.domain}";
+          DATABASE_TYPE = "postgresql";
+          REDIS_URL = "redis://${builder.host}";
+          CLIENT_IP_HEADER = "X-Forwarded-For";
+          BASE_PATH = lib.optionalString (containerCfg.subpath or null != null) "/${containerCfg.subpath}";
+          # DISABLE_LOGIN = "1";#(if serverCfg.containers?authentik then "1" else "0");
+
+        };
+        overrides = {
+          cmd = [ "start" ]; # Specific command for the umami binary
+         };
+      };
+    };
+  };
+}

modules/server/containers/builder.nix

@@ -0,0 +1,129 @@
+{ config, lib, pkgs, serverCfg }:
+let 
+  mkRouterName = { subdomain, subpath ? null }:
+    if subpath != null
+    then "${subdomain}-${lib.strings.sanitizeDerivationName subpath}"
+    else subdomain;
+  getOr = attrs: path: default: lib.attrByPath path default attrs;
+  mkTmpfsOption = size: "--tmpfs=/tmp:rw,noexec,nosuid,size=${size}";
+  mkAuthentikLabels =
+    { subdomain
+    , subpath ? null
+    , routerName ? mkRouterName { inherit subdomain subpath; }
+    , middleware ? "authentik"
+    }:
+    lib.optionalAttrs (serverCfg.containers ? authentik) {
+      "traefik.http.routers.${routerName}.middlewares" = middleware;
+    };
+  contBuilder =
+    { image ? null, imageStream ? null, imageFile ? null
+    , secret ? null
+    , subdomain ? null, subpath?null, port ? null
+    , authentik ? false
+    , tmpfs ? false
+    , tmpfsSize ? "512m"
+    , extraEnv ? { }, extraLabels ? { }, extraOptions ? [ ]
+    , overrides ? { }
+    }:
+    let 
+      routerName = mkRouterName { inherit subdomain subpath; };
+      base = {
+      image = if imageStream != null then "${imageStream.imageName}:${imageStream.imageTag}" 
+              else if imageFile != null then "${imageFile.imageName}:${imageFile.imageTag}" else image;
+      imageStream = imageStream;
+      imageFile = imageFile;
+
+      environmentFiles = if secret!=null then [ config.sops.secrets."${lib.toUpper secret}".path ] else [];
+      environment = {
+        TZ = config.time.timeZone;
+      } // extraEnv;
+
+      labels = (if subdomain!=null then ({
+        "traefik.enable" = "true";
+        "traefik.http.routers.${routerName}.entrypoints" = "web-secure";
+        "traefik.http.routers.${routerName}.rule" = if subpath != null 
+          then "Host(`${subdomain}.${serverCfg.domain}`) && PathPrefix(`/${subpath}`)"
+          else "Host(`${subdomain}.${serverCfg.domain}`)";
+        "traefik.http.routers.${routerName}.tls" = "true";
+      } // lib.optionalAttrs (port!=null) {
+        "traefik.http.services.${routerName}.loadbalancer.server.port" = toString port;
+      }) else {
+        "traefik.enable" = "false";
+      })
+      // lib.optionalAttrs authentik (mkAuthentikLabels { inherit subdomain subpath routerName; })
+      // extraLabels;
+
+      extraOptions = [
+        "--add-host=host.containers.internal:host-gateway"
+      ]
+      ++ lib.optional tmpfs (mkTmpfsOption tmpfsSize)
+      ++ extraOptions;
+    };
+    in lib.recursiveUpdate base overrides;
+  vmBuilder = { name, vm }: ((import "${pkgs.path}/nixos/lib/eval-config.nix" {
+      system = "x86_64-linux";
+      modules = [ vm.cfg
+        ({ config, lib, modulesPath, ... }: {
+        imports = [
+          "${modulesPath}/profiles/qemu-guest.nix"
+          "${modulesPath}/virtualisation/qemu-vm.nix"
+        ];
+        networking.hostName = name;
+        networking.useDHCP = true; 
+        networking.firewall.enable = false;
+        services.qemuGuest.enable = true;
+        system.stateVersion = "26.05"; 
+        virtualisation = {
+          memorySize = vm.memory or 2048;
+          cores = vm.cores or 2;
+          forwardPorts = let
+            parsePortString = port: {
+              from = "host";
+              host.port = port;
+              guest.port = port;
+            };
+          in if (vm ? portForward && vm.portForward != null) then map parsePortString vm.portForward else [];
+        };})
+      ];
+    }).config.system.build.vm);
+in {
+  mkContainer = contBuilder;
+  mkVm = vmBuilder;
+  mkApp = name: app:
+    {
+      inherit name;
+      requires = {
+        secrets = getOr app [ "requires" "secrets" ] [ ];
+        databases = getOr app [ "requires" "databases" ] [ ];
+      };
+      exports = {
+        authentik = {
+          blueprints = getOr app [ "exports" "authentik" "blueprints" ] [ ];
+        };
+      };
+      runtime = {
+        paths = getOr app [ "runtime" "paths" ] [ ];
+        containers = getOr app [ "runtime" "containers" ] { };
+        vm = getOr app [ "runtime" "vm" ] null;
+        cron = getOr app [ "runtime" "cron" ] [ ];
+        setup = {
+          trigger = "";
+          script = null;
+          envFile = [ ];
+        } // getOr app [ "runtime" "setup" ] { };
+      };
+    };
+  mkData = { name, dir, vars?{} }: pkgs.runCommand name vars ''
+    mkdir -p $out
+    cp -r ${./data + "/${dir}"}/. $out/
+    find $out -type f | while read file; do
+      ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
+        substituteInPlace "$file" --replace "@${n}@" "${toString v}"
+      '') vars)}
+    done
+  '';
+  host = "host.containers.internal"; 
+  hostIp =  if (config.virtualisation.podman.defaultNetwork.settings ? subnets) 
+    then (builtins.elemAt config.virtualisation.podman.defaultNetwork.settings.subnets 0).gateway
+    else "10.88.0.1"; 
+}

modules/server/containers/data/authentik/authentik.yaml

@@ -0,0 +1,70 @@
+version: 1
+metadata:
+  name: "Initial User Setup"
+  labels:
+    blueprint-type: core
+entries:
+  # Optionally, disable the default enrollment flow entirely
+  - model: authentik_flows.flow
+    identifiers:
+      slug: "default-source-enrollment"
+    attrs:
+      designation: "enrollment"
+      enabled: false
+  # --- GROUPS ---
+  - model: authentik_core.group
+    identifiers:
+      name: "admin"
+    attrs:
+      is_superuser: true
+
+  - model: authentik_core.group
+    identifiers:
+      name: "cloud"
+    attrs:
+      is_superuser: false
+
+  - model: authentik_core.group
+    identifiers:
+      name: "dev"
+    attrs:
+      is_superuser: false
+
+  - model: authentik_core.group
+    identifiers:
+      name: "flix"
+    attrs:
+      is_superuser: false
+
+  - model: authentik_core.group
+    identifiers:
+      name: "family"
+    attrs:
+      is_superuser: false
+
+  # --- ADMIN USERS ---
+  - model: authentik_core.user
+    identifiers:
+      username: !Env DEFAULT_ADMIN_USERNAME
+    attrs:
+      name: !Env DEFAULT_ADMIN_USERNAME
+      email: !Env DEFAULT_ADMIN_EMAIL
+      password: !Env DEFAULT_ADMIN_PASSWORD
+      path: "users"
+      groups:
+        - !Find [authentik_core.group, [name, "admin"]]
+
+  # Disable the Initial Setup Flow
+  - model: authentik_flows.flow
+    identifiers:
+      slug: "initial-setup"
+    attrs:
+      authentication: "require_superuser"
+      enabled: false
+
+  # Disable the default 'akadmin' if it exists
+  - model: authentik_core.user
+    identifiers:
+      username: "akadmin"
+    attrs:
+      is_active: false

modules/server/containers/data/authentik/branding.yaml

@@ -0,0 +1,13 @@
+version: 1
+metadata:
+  name: "Branding Setup"
+entries:
+  - model: authentik_brands.brand
+    identifiers:
+      domain: "@AUTHENTIK_DOMAIN@"
+    attrs:
+      domain: "@AUTHENTIK_DOMAIN@"
+      branding_title: "@AUTHENTIK_BRANDING_TITLE@"
+      branding_logo: "@AUTHENTIK_BRANDING_LOGO@"
+      branding_favicon: "@AUTHENTIK_BRANDING_FAVICON@"
+      branding_default_flow_background: "@AUTHENTIK_BRANDING_BACKGROUND@"

modules/server/containers/data/authentik/freshrss.yaml

@@ -0,0 +1,58 @@
+version: 1
+metadata:
+  name: "FreshRSS OAuth2 Provisioning"
+  labels:
+    app: freshrss
+entries:
+  - model: authentik_providers_oauth2.oauth2provider
+    identifiers:
+      name: "FreshRSS Provider"
+    attrs:
+      authorization_flow:
+        !Find [
+          authentik_flows.flow,
+          [slug, default-provider-authorization-implicit-consent],
+        ]
+      authentication_flow:
+        !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      client_type: "confidential"
+      client_id: "freshrss"
+
+      client_secret: !Env FRESHRSS_OAUTH_SECRET
+      access_code_validity: "minutes=5"
+      token_validity: "days=30"
+      signing_key:
+        !Find [
+          authentik_crypto.certificatekeypair,
+          [name, "authentik Self-signed Certificate"],
+        ]
+      redirect_uris:
+        - url: "https://@FRESHRSS_DOMAIN@.*"
+          matching_mode: "regex"
+      property_mappings:
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'openid'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'email'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'profile'"],
+          ]
+
+  - model: authentik_core.application
+    identifiers:
+      slug: "freshrss"
+    attrs:
+      name: "FreshRSS"
+      launch_url: "@FRESHRSS_DOMAIN@"
+      provider:
+        !Find [
+          authentik_providers_oauth2.oauth2provider,
+          [name, "FreshRSS Provider"],
+        ]

modules/server/containers/data/authentik/gitea.yaml

@@ -0,0 +1,11 @@
+version: 1
+metadata:
+  name: gitea-ldap-setup
+entries:
+  - model: authentik_core.application
+    id: gitea-app
+    identifiers:
+      slug: gitea
+    attrs:
+      name: Gitea
+      launch_url: "@GITEA_DOMAIN@"

modules/server/containers/data/authentik/homepage.yaml

@@ -0,0 +1,108 @@
+version: 1
+metadata:
+  name: "Homepage Dashboard - OIDC Provisioning"
+  labels:
+    app: homepage
+
+entries:
+  - model: authentik_providers_oauth2.scopemapping
+    identifiers:
+      name: "Homepage Custom Scope: Groups"
+    attrs:
+      scope_name: "groups"
+      description: "Pass user groups array to Homepage for conditional element rendering"
+      expression: |
+        return {
+            "groups": [group.name for group in request.user.ak_groups.all()]
+        }
+  # 1. Create the OAuth2/OIDC Provider
+  - model: authentik_providers_oauth2.oauth2provider
+    identifiers:
+      name: "Homepage Provider"
+    attrs:
+      authorization_flow:
+        !Find [
+          authentik_flows.flow,
+          [slug, default-provider-authorization-implicit-consent],
+        ]
+      authentication_flow:
+        !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      client_type: "confidential"
+      client_id: "homepage"
+      client_secret: !Env HOMEPAGE_VAR_OAUTH_SECRET
+      access_code_validity: "minutes=5"
+      token_validity: "days=30"
+      redirect_uris:
+        - url: "https://@HOMEPAGE_DOMAIN@/login"
+          matching_mode: "regex"
+      signing_key:
+        !Find [
+          authentik_crypto.certificatekeypair,
+          [name, "authentik Self-signed Certificate"],
+        ]
+      property_mappings:
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'openid'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'email'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'profile'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "Homepage Custom Scope: Groups"],
+          ]
+
+  # 2. Create the Application and link it to the Provider
+  - model: authentik_core.application
+    identifiers:
+      slug: homepage
+    attrs:
+      name: "Homepage"
+      launch_url: "@HOMEPAGE_DOMAIN@"
+      provider:
+        !Find [
+          authentik_providers_oauth2.oauth2provider,
+          [name, Homepage Provider],
+        ]
+      open_in_new_tab: false
+
+  # 3. Provision the static API token linked to the user account
+  - model: authentik_rbac.role
+    state: present
+    identifiers:
+      name: homepage-viewer
+    attrs:
+      permissions:
+        - authentik_core.view_user
+        - authentik_events.view_event
+
+  - model: authentik_core.user
+    state: present
+    identifiers:
+      username: homepage-svc
+    attrs:
+      roles:
+        - !Find [authentik_rbac.role, [name, "homepage-viewer"]]
+      name: Homepage Service Account
+      path: goauthentik.io/service-accounts
+      is_active: true
+      attributes:
+        goauthentik.io/user/service-account: true
+
+  - model: authentik_core.token
+    state: present
+    identifiers:
+      identifier: homepage-token
+    attrs:
+      key: !Env HOMEPAGE_VAR_AUTHENTIK_API
+      user: !Find [authentik_core.user, [username, "homepage-svc"]]
+      intent: api
+      expiring: false

modules/server/containers/data/authentik/immich.yaml

@@ -0,0 +1,62 @@
+version: 1
+metadata:
+  name: "Immich OAuth2 Provisioning"
+  labels:
+    app: immich
+entries:
+  - model: authentik_providers_oauth2.oauth2provider
+    identifiers:
+      name: "Immich Provider"
+    attrs:
+      authorization_flow:
+        !Find [
+          authentik_flows.flow,
+          [slug, default-provider-authorization-implicit-consent],
+        ]
+      authentication_flow:
+        !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+      client_type: "confidential"
+      client_id: "immich"
+
+      client_secret: !Env IMMICH_OAUTH_SECRET
+      access_code_validity: "minutes=5"
+      token_validity: "days=30"
+      signing_key:
+        !Find [
+          authentik_crypto.certificatekeypair,
+          [name, "authentik Self-signed Certificate"],
+        ]
+      redirect_uris:
+        - url: "app.immich:///oauth-callback"
+          matching_mode: "strict"
+        - url: "https://@IMMICH_DOMAIN@/auth/login"
+          matching_mode: "regex"
+        - url: "https://@IMMICH_DOMAIN@/user-settings"
+          matching_mode: "regex"
+      property_mappings:
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'openid'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'email'"],
+          ]
+        - !Find [
+            authentik_providers_oauth2.scopemapping,
+            [name, "authentik default OAuth Mapping: OpenID 'profile'"],
+          ]
+
+  - model: authentik_core.application
+    identifiers:
+      slug: "immich"
+    attrs:
+      name: "Immich"
+      launch_url: "@IMMICH_DOMAIN@"
+      provider:
+        !Find [
+          authentik_providers_oauth2.oauth2provider,
+          [name, "Immich Provider"],
+        ]

modules/server/containers/data/authentik/jellyfin.yaml

@@ -0,0 +1,11 @@
+version: 1
+metadata:
+  name: jellyfin-ldap-setup
+entries:
+  - model: authentik_core.application
+    id: jellyfin-app
+    identifiers:
+      slug: jellyfin
+    attrs:
+      name: Jellyfin
+      launch_url: "@JELLYFIN_DOMAIN@"

modules/server/containers/data/authentik/ldap.yaml

@@ -0,0 +1,79 @@
+version: 1
+metadata:
+  name: Pre-configured LDAP Outpost
+entries:
+  - model: authentik_providers_ldap.ldapprovider
+    identifiers:
+      name: ldap-provider
+    attrs:
+      base_dn: "@AUTHENTIK_LDAP_DC_DOMAIN@"
+      search_group: null
+      authorization_flow:
+        !Find [authentik_flows.flow, [slug, default-authentication-flow]]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+  - model: authentik_core.user
+    state: present
+    identifiers:
+      username: "ldap-service"
+    attrs:
+      name: "LDAP Bind Service Account"
+      type: "service_account"
+      path: "goauthentik.io"
+      is_active: true
+      password: !Env DEFAULT_LDAP_PASSWORD
+      attributes:
+        ak_recovery_immutable: true
+
+  - model: authentik_core.token
+    identifiers:
+      identifier: ldap-outpost-static-token
+    attrs:
+      intent: api
+      expiring: false
+      key: !Env AUTHENTIK_TOKEN
+      user: !Find [authentik_core.user, [username, "ldap-service"]]
+
+  - model: authentik_outposts.outpost
+    identifiers:
+      name: LDAP Outpost
+    attrs:
+      type: ldap
+      providers:
+        - !Find [authentik_providers_ldap.ldapprovider, [name, ldap-provider]]
+      token:
+        !Find [authentik_core.token, [identifier, ldap-outpost-static-token]]
+      config:
+        log_level: info
+        authentik_host: https://sso.test.helcel.net/
+        refresh_interval: minutes=5
+        authentik_host_insecure: false
+
+  - model: authentik_rbac.role
+    state: present
+    identifiers:
+      name: "LDAP Search Role"
+    attrs:
+      permissions:
+        - "authentik_providers_ldap.search_full_directory"
+
+  - model: authentik_core.group
+    state: present
+    identifiers:
+      name: "LDAP Search Group"
+    attrs:
+      users:
+        - !Find [authentik_core.user, [username, "ldap-service"]]
+      roles:
+        - !Find [authentik_rbac.role, [name, "LDAP Search Role"]]
+
+  - model: authentik_core.application
+    id: ldap-placeholder
+    identifiers:
+      slug: ldap
+    attrs:
+      name: ldap
+      group: _
+      provider:
+        !Find [authentik_providers_ldap.ldapprovider, [name, ldap-provider]]

modules/server/containers/data/authentik/nextcloud.yaml

@@ -0,0 +1,58 @@
+version: 1
+metadata:
+  name: nextcloud-saml-setup
+entries:
+  - model: authentik_providers_saml.samlprovider
+    identifiers:
+      name: Nextcloud SAML
+    attrs:
+      authorization_flow:
+        !Find [
+          authentik_flows.flow,
+          [slug, default-provider-authorization-explicit-consent],
+        ]
+      invalidation_flow:
+        !Find [authentik_flows.flow, [slug, default-provider-invalidation-flow]]
+
+      acs_url: https://@NEXTCLOUD_DOMAIN@/apps/user_saml/saml/acs
+      audience: https://@NEXTCLOUD_DOMAIN@/apps/user_saml/saml/metadata
+      issuer: https://@AUTHENTIK_DOMAIN@
+      sp_binding: post
+      property_mappings:
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: Name"],
+          ]
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: Email"],
+          ]
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: Groups"],
+          ]
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: Username"],
+          ]
+        - !Find [
+            authentik_core.propertymapping,
+            [name, "authentik default SAML Mapping: User ID"],
+          ]
+
+      signing_kp:
+        !Find [
+          authentik_crypto.certificatekeypair,
+          [name, "authentik Self-signed Certificate"],
+        ]
+      sign_assertion: true
+      sign_response: false
+
+  - model: authentik_core.application
+    identifiers:
+      slug: nextcloud
+    attrs:
+      name: Nextcloud
+      provider:
+        !Find [authentik_providers_saml.samlprovider, [name, Nextcloud SAML]]
+      launch_url: "@NEXTCLOUD_DOMAIN@"