fix mute

.gitea/workflows/build.yml

@@ -12,13 +12,13 @@ jobs:
   build-nixos:
     runs-on: ubuntu-latest
     steps: 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v6
       
       - name: "Install Nix ❄️"
         uses: cachix/install-nix-action@v31
 
     #  - uses: DeterminateSystems/nix-installer-action@v4
-      - uses: DeterminateSystems/magic-nix-cache-action@v14
+      - uses: DeterminateSystems/magic-nix-cache-action@v13
       - uses: DeterminateSystems/flake-checker-action@v12
 
       - name: "Install Cachix ❄️"

.gitea/workflows/update.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v6
       - name: Install nix
         uses: DeterminateSystems/nix-installer-action@v22
         with:

.gitignore

@@ -2,3 +2,4 @@ result
 age-key.txt
 .decrypted~common.yaml
 .decrypted*
+.tmp

.sops.yaml

@@ -13,31 +13,6 @@ keys:
     - &sandbox age1pf4auk6u2tmefuqpuc6mntr26cp4wcsmlhnn98arzxsp3753ruqsj0jqk3
 
 creation_rules:
-  - path_regex: modules/shared/sops/private/iriy.[a-z]+
-    key_groups:
-      - age:
-          - *iriy
-        pgp:
-          - *sora
-  - path_regex: modules/shared/sops/private/avalon.[a-z]+
-    key_groups:
-      - age:
-          - *avalon
-        pgp:
-          - *sora
-  - path_regex: modules/shared/sops/private/valinor.[a-z]+
-    key_groups:
-      - age:
-          - *valinor
-        pgp:
-          - *sora
-  - path_regex: modules/shared/sops/private/asgard.[a-z]+
-    key_groups:
-      - age:
-          - *asgard
-        pgp:
-          - *sora
-
   - path_regex: modules/shared/sops/common.[a-z]+
     key_groups:
       - age:
@@ -54,6 +29,8 @@ creation_rules:
       - age:
           - *ci
           - *sandbox
+        pgp:
+          - *sora
 
   - path_regex: modules/server/sops/server.[a-z]+
     key_groups:

flake.lock

@@ -1,27 +1,5 @@
 {
   "nodes": {
-    "arion": {
-      "inputs": {
-        "flake-parts": "flake-parts",
-        "haskell-flake": "haskell-flake",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1770259557,
-        "narHash": "sha256-EvZ09k9+mzXAngPzU2K7oLLUDlKoT1numb4bDb3Gtl4=",
-        "owner": "hercules-ci",
-        "repo": "arion",
-        "rev": "9b24cf65c72cb0e9616e437d55e1ac8e5c6bc715",
-        "type": "github"
-      },
-      "original": {
-        "owner": "hercules-ci",
-        "repo": "arion",
-        "type": "github"
-      }
-    },
     "base16-schemes": {
       "flake": false,
       "locked": {
@@ -45,11 +23,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783395956,
+        "lastModified": 1779036909,
-        "narHash": "sha256-AAbexQvDoK+6GFJdhY6kqjA+6ECKRkidgWxkn4gMwAA=",
+        "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "d5bd9cd77aea4c0a8f49e7fd85545671a208ed15",
+        "rev": "56c666e108467d87d13508936aade6d567f2a501",
         "type": "github"
       },
       "original": {
@@ -59,28 +37,23 @@
         "type": "github"
       }
     },
-    "flake-parts": {
+    "flake-compat": {
-      "inputs": {
+      "flake": false,
-        "nixpkgs-lib": [
-          "arion",
-          "nixpkgs"
-        ]
-      },
       "locked": {
-        "lastModified": 1769996383,
+        "lastModified": 1767039857,
-        "narHash": "sha256-AnYjnFWgS49RlqX7LrC4uA+sCCDBj0Ry/WOJ5XWAsa0=",
+        "narHash": "sha256-vNpUSpF5Nuw8xvDLj2KCwwksIbjua2LZCqhV1LNRDns=",
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "flake-parts",
+        "repo": "flake-compat",
-        "rev": "57928607ea566b5db3ad13af0e57e921e6b12381",
+        "rev": "5edf11c44bc78a0d334f6334cdaf7d60d732daab",
         "type": "github"
       },
       "original": {
-        "owner": "hercules-ci",
+        "owner": "edolstra",
-        "repo": "flake-parts",
+        "repo": "flake-compat",
         "type": "github"
       }
     },
-    "flake-parts_2": {
+    "flake-parts": {
       "inputs": {
         "nixpkgs-lib": [
           "nur",
@@ -101,16 +74,34 @@
         "type": "github"
       }
     },
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1681202837,
+        "narHash": "sha256-H+Rh19JDwRtpVPAWp64F+rlEtxUWBAQW28eAi3SRSzg=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "cfacdce06f30d2b68473a46042957675eebb3401",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "hardware": {
       "inputs": {
         "nixpkgs": "nixpkgs"
       },
       "locked": {
-        "lastModified": 1783792734,
+        "lastModified": 1780065812,
-        "narHash": "sha256-50rvY9GdFvpYDcMLcD/4cWSi0hVxArT5wsGlVsHy8eY=",
+        "narHash": "sha256-SCSLUKBmwlSLGQ8Xbr8PjRFtiHNk0l9ktqkcmqdBkfE=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "8efb4337e857949f4cfac86d12ef1066f417f31f",
+        "rev": "b76b5639c0593e0aeb0b5879ad62d4b30596c144",
         "type": "github"
       },
       "original": {
@@ -119,22 +110,6 @@
         "type": "github"
       }
     },
-    "haskell-flake": {
-      "locked": {
-        "lastModified": 1675296942,
-        "narHash": "sha256-u1X1sblozi5qYEcLp1hxcyo8FfDHnRUVX3dJ/tW19jY=",
-        "owner": "srid",
-        "repo": "haskell-flake",
-        "rev": "c2cafce9d57bfca41794dc3b99c593155006c71e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "srid",
-        "ref": "0.1.0",
-        "repo": "haskell-flake",
-        "type": "github"
-      }
-    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -142,16 +117,16 @@
         ]
       },
       "locked": {
-        "lastModified": 1779506708,
+        "lastModified": 1779726825,
-        "narHash": "sha256-QOD/CNm196nCJRheux/URi4/HE66fthdOMqCJoPP1Y0=",
+        "narHash": "sha256-RUkMrREjKDQrA+dA9+xZviGAxM5W1aVdyOr/bSYpHrE=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "3ee51fbdac8c8bdfe1e7e1fcaba6520a563f394f",
+        "rev": "b179bde238977f7d4454fc770b1a727eaf55111c",
         "type": "github"
       },
       "original": {
         "owner": "nix-community",
-        "ref": "release-25.11",
+        "ref": "release-26.05",
         "repo": "home-manager",
         "type": "github"
       }
@@ -177,11 +152,11 @@
     },
     "nixUnstable": {
       "locked": {
-        "lastModified": 1783791668,
+        "lastModified": 1780030872,
-        "narHash": "sha256-zbcZ1dmBTPfJ7Mlqh/yLEPGpgJnwuv4Xr1xucy2WqMA=",
+        "narHash": "sha256-u6WU/yd/o8iYQrHX3RAwO1hYa3LkoSL+WNQD0rJfJZQ=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "716c7a2664ca8325617b8a7fbb609273f2c4cae7",
+        "rev": "e9a7635a57597d9754eccebdfc7045e6c8600e6b",
         "type": "github"
       },
       "original": {
@@ -191,6 +166,27 @@
         "type": "github"
       }
     },
+    "nixos-wsl": {
+      "inputs": {
+        "flake-compat": "flake-compat",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1780169171,
+        "narHash": "sha256-3HBYDfBgZ+ph52HS6Ks/bMMwuh2uONIT72sZ1CtLE/s=",
+        "owner": "nix-community",
+        "repo": "nixos-wsl",
+        "rev": "998b2821c30b2938637230916904ceb8757c79e8",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-wsl",
+        "type": "github"
+      }
+    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1767892417,
@@ -221,47 +217,33 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1782847189,
+        "lastModified": 1780203844,
-        "narHash": "sha256-twXPFqFsrrY5r28Zh7Homgcp2gUMBgQ6WDS98Q/3xFI=",
+        "narHash": "sha256-K5sT4jTpGs15ADhviMKNBH38REpPf5Q6mM1+N6cArVE=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "b6018f87da91d19d0ab4cf979885689b469cdd41",
+        "rev": "b51242d7d43689db2f3be91bd05d5b24fbb469c4",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.11",
+        "ref": "nixos-26.05",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "nixpkgs_3": {
-      "locked": {
-        "lastModified": 1783522502,
-        "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=",
-        "owner": "nixos",
-        "repo": "nixpkgs",
-        "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nixos",
-        "ref": "nixos-unstable",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nur": {
       "inputs": {
-        "flake-parts": "flake-parts_2",
+        "flake-parts": "flake-parts",
-        "nixpkgs": "nixpkgs_3"
+        "nixpkgs": [
+          "nixpkgs"
+        ]
       },
       "locked": {
-        "lastModified": 1783812717,
+        "lastModified": 1780265777,
-        "narHash": "sha256-/ShoG1aG4RN+002Y69CQk0HJ8U/DRw5PHGJcgqB/rLQ=",
+        "narHash": "sha256-t/KORFHEv8Jn2vFmVfv4Zffekv+MUogI2KgtxuCcEmQ=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "f677cb4b829c9df339277c6e80200b1c98320463",
+        "rev": "39917b7f68263188707925ffe26c9df6ef4e7d64",
         "type": "github"
       },
       "original": {
@@ -272,15 +254,16 @@
     },
     "root": {
       "inputs": {
-        "arion": "arion",
         "darwin": "darwin",
         "hardware": "hardware",
         "home-manager": "home-manager",
         "nix-colors": "nix-colors",
         "nixUnstable": "nixUnstable",
+        "nixos-wsl": "nixos-wsl",
         "nixpkgs": "nixpkgs_2",
         "nur": "nur",
-        "sops-nix": "sops-nix"
+        "sops-nix": "sops-nix",
+        "vscode-server": "vscode-server"
       }
     },
     "sops-nix": {
@@ -290,11 +273,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783174389,
+        "lastModified": 1777944972,
-        "narHash": "sha256-aCWC8ngycU7OdJrU2+Je3qf+1a2ykuBvpPhZT/9tXMc=",
+        "narHash": "sha256-VfGRo1qTBKOe3s2gOv8LSoA6Fk19PvBlwQ1ECN0Evn8=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "f1406619a3884cd5c47992a70b8b35c9c0fcb4c9",
+        "rev": "c591bf665727040c6cc5cb409079acb22dcce33c",
         "type": "github"
       },
       "original": {
@@ -302,6 +285,42 @@
         "repo": "sops-nix",
         "type": "github"
       }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "vscode-server": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1770124655,
+        "narHash": "sha256-yHmd2B13EtBUPLJ+x0EaBwNkQr9LTne1arLVxT6hSnY=",
+        "owner": "nix-community",
+        "repo": "nixos-vscode-server",
+        "rev": "92ce71c3ba5a94f854e02d57b14af4997ab54ef0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nixos-vscode-server",
+        "type": "github"
+      }
     }
   },
   "root": "root",

flake.nix

@@ -3,12 +3,15 @@
   inputs = {
     # Trick renovate into working: "github:NixOS/nixpkgs/nixpkgs-unstable"
     nixUnstable.url = "github:nixos/nixpkgs/nixpkgs-unstable";
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-26.05";
     hardware.url = "github:nixos/nixos-hardware";
-    nur.url = "github:nix-community/nur";
+    nur = {
+      url = "github:nix-community/nur";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
     home-manager = {
-      url = "github:nix-community/home-manager/release-25.11";
+      url = "github:nix-community/home-manager/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
@@ -17,40 +20,48 @@
       inputs.nixpkgs.follows = "nixpkgs";
     };
 
-    # hyprland = {
-    #   url = "github:hyprwm/Hyprland";
-    #   inputs.nixpkgs.follows = "nixpkgs";
-    # };
     sops-nix = {
       url = "github:Mic92/sops-nix";
       inputs.nixpkgs.follows = "nixpkgs";
     };
     nix-colors.url = "github:misterio77/nix-colors";
+    nixos-wsl = {
+      url = "github:nix-community/nixos-wsl";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
 
-    arion.url = "github:hercules-ci/arion";
+    vscode-server = {
-    arion.inputs.nixpkgs.follows = "nixpkgs";
+      url = "github:nix-community/nixos-vscode-server";
-
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
   outputs = inputs:
-    let gen = import ./generator.nix { inherit inputs; };
+    let
+      lib = inputs.nixpkgs.lib;
+      gen = import ./generator.nix { inherit inputs; };
+      systemsDir = ./systems;
+      isIgnoredSystemDir = name: lib.hasPrefix "_" name || lib.hasPrefix "." name;
+      systemNames = lib.attrNames (lib.filterAttrs
+        (name: type:
+          type == "directory"
+          && !isIgnoredSystemDir name
+          && builtins.pathExists (systemsDir + "/${name}/cfg.nix"))
+        (builtins.readDir systemsDir));
+      hostsByType = systemType:
+        lib.filter
+          (host: (import (systemsDir + "/${host}/cfg.nix")).syscfg.type == systemType)
+          systemNames;
+      generateHosts = systemType:
+        lib.genAttrs
+          (hostsByType systemType)
+          (host: gen.generate { inherit host; });
     in {
       devShells = import ./shells { inherit inputs; };
 
-      nixosConfigurations = {
+      nixosConfigurations = generateHosts "nixos";
-        valinor = gen.generate { host = "valinor"; };
+      darwinConfigurations = generateHosts "macos";
-        iriy = gen.generate { host = "iriy"; };
+      homeConfigurations = generateHosts "home";
-        efir = gen.generate { host = "efir"; };
-        avalon = gen.generate { host = "avalon"; };
-        ci = gen.generate { host = "ci"; };
-        sandbox = gen.generate { host = "sandbox"; };
-        gateway = gen.generate { host = "gateway"; };
-      };
-      darwinConfigurations = { asgard = gen.generate { host = "asgard"; }; };
-      homeConfigurations = {
-        yomi = gen.generate { host = "example"; };
-        example = gen.generate { host = "example"; };
-      };
     };
 
   # ===== Unsupported/NotImplemented ======

generator.nix

@@ -5,7 +5,7 @@
       nameValuePair = name: value: { inherit name value; };
     in ({
       "nixos" = inputs.nixpkgs.lib.nixosSystem {
-        system = syscfg.syscfg.system;
+        system = "x86_64-linux";
         specialArgs = { inherit inputs; };
         modules = [
           ./modules/shared/syscfg
@@ -13,9 +13,12 @@
           ./modules/nixos
           syscfg
           ./systems/${host}
-          inputs.arion.nixosModules.arion
           inputs.sops-nix.nixosModules.sops
           inputs.home-manager.nixosModules.home-manager
+
+          inputs.nixos-wsl.nixosModules.wsl
+          inputs.vscode-server.nixosModules.default
+
           {
             home-manager.useGlobalPkgs = true;
             home-manager.useUserPackages = true;
@@ -29,7 +32,6 @@
                   syscfg
                   { usercfg = userConfig; }
                   inputs.nix-colors.homeManagerModule
-                  # inputs.hyprland.homeManagerModules.default
                   inputs.sops-nix.homeManagerModules.sops
                 ];
               }) syscfg.syscfg.users);
@@ -38,7 +40,7 @@
       };
 
       "macos" = inputs.darwin.lib.darwinSystem {
-        system = syscfg.system;
+        system = "x86_64-darwin";
         modules = [
           ./modules/shared/syscfg
           ./modules/shared/sops

modules/home/base/default.nix

@@ -8,7 +8,7 @@
     username = "${config.usercfg.username}";
     homeDirectory = "/home/${config.usercfg.username}";
 
-    stateVersion = "24.11";
+    stateVersion = "26.05";
   };
 
 

modules/home/cli/neofetch/config.jsonc

@@ -0,0 +1,147 @@
+{
+    "$schema": "https://github.com/fastfetch-cli/fastfetch/raw/dev/doc/json_schema.json",
+    "logo": {
+        "type": "builtin", // Logo type: auto, builtin, small, file, etc.
+        // "source": "arch",
+        "width": 10,
+        "height": 10,
+        "padding": {
+            "top": 3,
+            "left": 2,
+            "right": 2
+        },
+        "color": {
+            "1": "blue",
+            "2": "white",
+            "3": "cyan"
+        }
+    },
+    "display": { /* Display settings */},
+    "modules": [
+        "break",
+        {
+            "type": "custom",
+            "format": "\u001b[90m┌──────────────────────Hardware──────────────────────┐"
+        },
+        {
+            "type": "host",
+            "key": "󰌢  PC",
+            "keyColor": "green",
+            "format": "{2}"
+        },
+        {
+            "type": "cpu",
+            "key": "│ ├󱛠 ",
+            "keyColor": "green",
+            "format": "{1} | {4} @{6}"
+        },
+        {
+            "type": "gpu",
+            "key": "│ ├󰍹 ",
+            "keyColor": "green",
+            "format": "{2} | {7}"
+        },
+        {
+            "type": "memory",
+            "key": "│ ├󰑭 ",
+            "keyColor": "green",
+            "format": "{2}"
+        },
+        // {
+        //     "type": "disk",
+        //     "key": "└ └󰋊 ",
+        //     "keyColor": "green"
+        // },
+        {
+            "type": "custom",
+            "format": "\u001b[90m└────────────────────────────────────────────────────┘"
+        },
+        "break",
+        {
+            "type": "custom",
+            "format": "\u001b[90m┌──────────────────────Software──────────────────────┐"
+        },
+        {
+            "type": "os",
+            "key": "  OS",
+            "keyColor": "yellow",
+            "format": " {2} {8}"
+        },
+        {
+            "type": "kernel",
+            "key": "│ ├󰌽 ",
+            "keyColor": "yellow",
+            "format": "{1} {2}"
+        },
+        {
+            "type": "bios",
+            "key": "│ ├󰖡 ",
+            "keyColor": "yellow"
+        },
+        {
+            "type": "packages",
+            "key": "│ ├󰏗 ",
+            "keyColor": "yellow"
+        },
+        {
+            "type": "de",
+            "key": "󰧨  DE",
+            "keyColor": "blue",
+            "format": "{2} | {3}"
+        },
+        {
+            "type": "lm",
+            "key": "│ ├󰍁 ",
+            "keyColor": "blue",
+            "format": "{1} {2} {3}"
+        },
+        {
+            "type": "wm",
+            "key": "│ ├󱂬 ",
+            "keyColor": "blue",
+            "format": "{2} {5}"
+        },
+        {
+            "type": "custom",
+            "format": "\u001b[90m└────────────────────────────────────────────────────┘"
+        },
+        "break",
+        {
+            "type": "custom",
+            "format": "\u001b[90m┌──────────────────────Age───────────────────────────┐"
+        },
+        {
+            "type": "command",
+            "key": "  ›  OS Age  ",
+            "keyColor": "magenta",
+            "text": "birth_install=$(stat -c %W /); current=$(date +%s); time_progression=$((current - birth_install)); days_difference=$((time_progression / 86400)); echo $days_difference days"
+        },
+        {
+            "type": "command",
+            "key": "  ›  Update  ",
+            "keyColor": "magenta",
+            "text": "nixos-rebuild list-generations | awk '$NF == \"True\" {print $2, $3}' | xargs -I {} date -d \"{}\" +\"%s\" | awk '{diff=systime()-$1; printf \"%d days, %d hours, %d mins\\n\", diff/86400, (diff%86400)/3600, (diff%3600)/60}'"
+        },
+        {
+            "type": "uptime",
+            "key": "  ›  Uptime  ",
+            "keyColor": "magenta"
+        },
+        {
+            "type": "custom",
+            "format": "\u001b[90m└────────────────────────────────────────────────────┘"
+        },
+        {
+            "type": "colors",
+            "paddingLeft": 2,
+            "block": {
+                "width": 3,
+                "range": [
+                    0,
+                    15
+                ]
+            } //,
+            //"symbol": "circle"
+        },
+    ]
+}

modules/home/cli/neofetch/default.nix

@@ -1,4 +1,5 @@
 { pkgs, config, ... }: {
-  home.packages = with pkgs; [ neofetch ];
+  home.packages = with pkgs; [ fastfetch ];
   xdg.configFile."neofetch/config.conf".source = ./config.conf;
+  xdg.configFile."fastfetch/config.jsonc".source = ./config.jsonc;
 }

modules/home/gui/apps/develop/vscodium/default.nix

@@ -1,9 +1,8 @@
 { lib, config, pkgs, ... }: {
 
   config = lib.mkIf (config.syscfg.make.develop) {
-    programs.vscode = {
+    programs.vscodium = {
       enable = true;
-      package = pkgs.vscodium;
       #profiles.default = {
         profiles.default.extensions = with pkgs.vscode-extensions; [
           bbenoist.nix
@@ -12,7 +11,6 @@
           ms-python.vscode-pylance
           ms-vscode.cpptools
           dbaeumer.vscode-eslint
-          continue.continue 
         ];
       #};
     };

modules/home/gui/base/default.nix

@@ -4,10 +4,10 @@
     services.nextcloud-client.enable = true;
 
     home.packages = with pkgs; [
-      xfce.thunar
+      thunar
-      xfce.thunar-volman
+      thunar-volman
-      xfce.thunar-archive-plugin
+      thunar-archive-plugin
-      xfce.tumbler
+      tumbler
 
       telegram-desktop
       discord-canary

modules/home/gui/theme/default.nix

@@ -1,6 +1,5 @@
 { lib, config, pkgs, ... }:
 let
-  colorVariant = " black";
   gtkThemeFromScheme = import ./gtk-theme-gen.nix { inherit pkgs config; };
   wallpaperGen = import ./wallpaper-gen.nix { inherit pkgs config; };
 in {
@@ -20,6 +19,7 @@ in {
         name = "${config.colorscheme.slug}-Dark";
         package = gtkThemeFromScheme;
       };
+      gtk4.theme = config.gtk.theme; 
       iconTheme = {
         name = "tela-circle-icon-theme";
         package = pkgs.tela-circle-icon-theme;
@@ -31,7 +31,7 @@ in {
       platformTheme.name = "gtk";
     };
 
-    home.packages = [ wallpaperGen pkgs.swww ];
+    home.packages = [ wallpaperGen pkgs.awww ];
 
     xdg.configFile."script/wallpaper.sh".text = ''
       #!/bin/sh
@@ -50,7 +50,7 @@ in {
 
       IMG=$WPDIR/$(echo "$RES" | wofi --dmenu --allow-images show-icons true -theme-str '#window { width: 50%; }' -p "Choose wallpaper:")
       IMG=$(echo "$IMG" | awk -F ':' '{print $2}')
-      swww img $IMG
+      awww img $IMG
     '';
   };
 }

modules/home/gui/theme/wallpaper-gen.nix

@@ -1,40 +1,150 @@
-{ pkgs, config }:
+{ pkgs, config, lib ? pkgs.lib }:
 
 let
-  scheme = config.colorScheme;
+  colors = config.colorScheme.palette;
-  colors = scheme.palette;
+  mediaImages = config.syscfg.media.main;
-  dither =
+  mediaNames = map (image: builtins.baseNameOf (toString image)) mediaImages;
-    "atkinson"; # none | floyd-steinberg | atkinson | jjn | burkes | sierra | sierra-lite
+  mediaSourceDir = pkgs.linkFarm "wallpaper-media" (
-in pkgs.stdenv.mkDerivation rec {
+    map (image: {
-  pname = "generated-wallpaper";
+      name = builtins.baseNameOf (toString image);
-  version = "a1676fc2a0e3dfb7bf95d8a89e592830";
+      path = image;
-  src = pkgs.fetchFromGitea {
+    }) mediaImages
-    domain = "git.helcel.net";
+  );
-    owner = "sora";
+
-    repo = "nixconfig-wallpaper";
+  dither = "atkinson"; # none | floyd-steinberg | atkinson | jjn | burkes | sierra | sierra-lite
-    rev = version;
+  paletteSize = 0;
-    sha256 = "sha256-ZhBjTaKzoiEq1ptMmNWWRPCjLJsvy9My/HuzRaDjX1c=";
+
+  hexChars = "0123456789abcdef";
+  hexMap = {
+    "0" = 0; "1" = 1; "2" = 2; "3" = 3;
+    "4" = 4; "5" = 5; "6" = 6; "7" = 7;
+    "8" = 8; "9" = 9; "a" = 10; "b" = 11;
+    "c" = 12; "d" = 13; "e" = 14; "f" = 15;
   };
 
-  buildInputs = with pkgs; [ custom.repalette nodejs imagemagick gifsicle ];
+  baseColors = [
+    colors.base00
+    colors.base01
+    colors.base02
+    colors.base03
+    colors.base04
+    colors.base05
+    colors.base06
+    colors.base07
+    colors.base08
+    colors.base09
+    colors.base0A
+    colors.base0B
+    colors.base0C
+    colors.base0D
+    colors.base0E
+    colors.base0F
+  ];
 
-  configurePhase = ''
+  round = x: builtins.floor (x + 0.5);
-    echo "${colors.base00},${colors.base01},\
+  clamp = x:
-          ${colors.base02},${colors.base03},\
+    if x < 0 then 0 else if x > 255 then 255 else x;
-          ${colors.base04},${colors.base05},\
+  parseHexByte = byte:
-          ${colors.base06},${colors.base07},\
+    let
-          ${colors.base08},${colors.base09},\
+      hi = hexMap.${builtins.substring 0 1 byte};
-          ${colors.base0A},${colors.base0B},\
+      lo = hexMap.${builtins.substring 1 1 byte};
-          ${colors.base0C},${colors.base0D},\
+    in
-          ${colors.base0E},${colors.base0F}" > palette.in
+    hi * 16 + lo;
-  '';
+  hexToRgb = hex:
+    let
+      clean = lib.toLower (lib.removePrefix "#" hex);
+    in
+    {
+      r = parseHexByte (builtins.substring 0 2 clean);
+      g = parseHexByte (builtins.substring 2 2 clean);
+      b = parseHexByte (builtins.substring 4 2 clean);
+    };
+  componentToHex = value:
+    let
+      bounded = clamp value;
+      hi = builtins.div bounded 16;
+      lo = bounded - hi * 16;
+    in
+    "${builtins.substring hi 1 hexChars}${builtins.substring lo 1 hexChars}";
+  rgbToHex = color: "${componentToHex color.r}${componentToHex color.g}${componentToHex color.b}";
+
+  getTint = c: weight: round (c + (255 - c) * weight);
+  getShade = c: weight: round (c * weight);
+  tint = color: weight: {
+    r = getTint color.r weight;
+    g = getTint color.g weight;
+    b = getTint color.b weight;
+  };
+  shade = color: weight: {
+    r = getShade color.r weight;
+    g = getShade color.g weight;
+    b = getShade color.b weight;
+  };
+  genPalette = color:
+    let
+      tints =
+        if paletteSize == 0
+        then [ ]
+        else lib.genList (i: tint color ((i + 1.0) / paletteSize)) paletteSize;
+      shades =
+        if paletteSize == 0
+        then [ ]
+        else lib.genList (i: shade color (i * 1.0 / paletteSize)) paletteSize;
+    in
+    lib.reverseList tints ++ [ color ] ++ lib.reverseList shades;
+  keepColor = color:
+    let
+      sum = color.r + color.g + color.b;
+    in
+    sum > 0 && sum < 765;
+
+  paletteColors = lib.concatMap (hex: lib.filter keepColor (genPalette (hexToRgb hex))) baseColors;
+  paletteHex = lib.concatStringsSep "," (map rgbToHex paletteColors);
+  gifPaletteFile = pkgs.writeText "wallpaper-gifpalette.txt" (
+    lib.concatMapStringsSep "\n" (color: "${toString color.r} ${toString color.g} ${toString color.b}") paletteColors
+  );
+
+  buildCommands =
+    lib.concatMapStringsSep "\n" (name:
+      let
+        source = "${mediaSourceDir}/${name}";
+        target = "build/${name}";
+      in
+      if lib.hasSuffix ".gif" (lib.toLower name) then ''
+        gifsicle --use-colormap ${lib.escapeShellArg (toString gifPaletteFile)} < ${lib.escapeShellArg source} > ${lib.escapeShellArg target}
+      '' else ''
+        repalette ${lib.escapeShellArg source} ${lib.escapeShellArg target} -p ${lib.escapeShellArg paletteHex} --dither ${lib.escapeShellArg dither}
+      ''
+    ) mediaNames;
+in
+assert lib.assertMsg
+  (builtins.length mediaNames == builtins.length (lib.unique mediaNames))
+  "syscfg.media.main contains duplicate basenames, which would collide in generated wallpaper output.";
+pkgs.stdenv.mkDerivation {
+  pname = "generated-wallpaper";
+  version = "local";
+  dontUnpack = true;
+
+  nativeBuildInputs = with pkgs; [
+    custom.repalette
+    gifsicle
+  ];
 
   buildPhase = ''
-    make DITHER=${dither} PALETTE_SIZE=0 all
+    runHook preBuild
+
+    mkdir -p build
+    ${buildCommands}
+
+    runHook postBuild
   '';
 
   installPhase = ''
+    runHook preInstall
+
     mkdir -p $out/share/wallpaper
-    cp -r build/* $out/share/wallpaper/
+    cp -r build/. $out/share/wallpaper/
+
+    runHook postInstall
   '';
 }

modules/home/wayland/apps/dunst/default.nix

@@ -46,7 +46,7 @@
           min_icon_size = 32;
           max_icon_size = 64;
 
-          icon_path =
+          icon_path = lib.mkForce 
             "${pkgs.tela-circle-icon-theme}/share/icons/Tela-circle-dark/32/status:${pkgs.tela-circle-icon-theme}/share/icons/Tela-circle-dark/32/device ";
           icon_theme = "Tela-circle-dark";
           enable_recursive_icon_lookup = "true";

modules/home/wayland/apps/eww/bar/css/_clock.scss

@@ -1,48 +1,108 @@
-.calendar-win {
-}
 
 calendar {
-  padding: 5pt;
+  padding: $popup-scale * 1.75pt $popup-scale * 1pt;
+  font-size: $popup-scale * 8pt;
 
-  :selected {
+  header {
-    color: $base0C;
+    padding: $popup-scale * 2pt 0;
+    @include color-body;
   }
 
-  .header {
+  :selected      { @include color-accent; }
-    color: $base05;
+  .highlight     { @include color-accent; font-weight: bold; }
-  }
+  :indeterminate { color: $base03; }
-
-  .highlight {
-    color: $base0C;
-    font-weight: bold;
-  }
-
-  label {
-    font-size: 20pt;
-    color: $base0C;
-  }
-
-  :indeterminate {
-    color: $base03;
-  }
 }
 
+.cal-box .sys-section-header { margin-bottom: $popup-scale * 4pt; }
+
 
 .hour, .month {
   font-weight: bolder;
 }
 
 .minute, .month {
-  margin-top: -4pt;
+  margin-top: $popup-scale * -4pt;
 }
 
 
 .date {
-  color: $base0C;
+  @include color-accent;
-  background-color: $base01;
+  @include background-base;
-  border-radius: $border-radius;
+  @include border-radius;
 }
 
 .datetime {
   padding: $gaps-window;
-}
+}
+
+// Clock window accents
+.weather-accent { background-color: $base0A; }
+.cal-accent     { background-color: $base0B; }
+.bri-accent     { background-color: $base09; }
+.vol-accent     { background-color: $base0D; }
+.quick-accent   { background-color: $base0E; }
+
+// Quick actions
+.quick-grid { margin-top: $popup-scale * 2pt; }
+
+.quick-btn {
+  @include background-base2;
+  @include border-radius;
+  padding: $popup-scale * 8pt $popup-scale * 4pt;
+  margin: $popup-scale * 4px;
+  min-width: 0;
+  min-height: 0;
+  border: none;
+
+  &:hover {
+    @include background-active;
+    .quick-icon, .quick-label {color: $base01;}
+  }
+}
+
+.quick-btn-active {
+  .quick-icon  { @include color-accent; }
+  .quick-label { @include color-accent; }
+}
+
+.quick-icon  { font-size: 1.5em; @include color-body; }
+.quick-label { font-size: 0.68em; margin-top: $popup-scale * 3pt; @include color-body; }
+
+// Weather section
+.weather-main  { margin-bottom: $popup-scale * 8pt; }
+.weather-icon  { font-size: 2.2em; margin-right: $popup-scale * 12pt; @include color-accent; }
+.weather-temp  { font-size: 1.3em; font-weight: bold; @include color-base; }
+.weather-desc  { font-size: 0.78em; @include color-body; }
+.weather-stats { margin-top: $popup-scale * 4pt; }
+
+// Volume section
+.ctrl-row   { margin-bottom: $popup-scale * 4pt; }
+.ctrl-icon        { font-size: 1.1em; min-width: $popup-scale * 22pt; @include border-radius; @include color-body; }
+.ctrl-icon:hover  { @include background-active; }
+.ctrl-muted       { @include color-inactive; }
+.ctrl-value { font-size: 0.72em; min-width: $popup-scale * 28pt; @include color-active; }
+
+scale.ctrl-slider.ctrl-slider-muted {
+  trough {
+    highlight { background-color: $base03; }
+    slider    { background-color: $base03; }
+  }
+}
+
+scale.ctrl-slider {
+  padding: $popup-scale * 2pt $popup-scale * 4pt;
+  trough {
+    @include border-radius;
+    @include background-base2;
+    min-height: 5px;
+    highlight { background-color: $base0C; @include border-radius; }
+  }
+  slider {
+    background-color: $base07;
+    min-height: 11px;
+    min-width: 11px;
+    @include border-radius;
+    margin: -3px;
+    border: none;
+  }
+}

modules/home/wayland/apps/eww/bar/css/_colors.scss

@@ -0,0 +1,32 @@
+$base00: #000000;
+$base01: #060a0f;
+$base02: #212c38;
+$base03: #3f5268;
+$base04: #617b9a;
+$base05: #90a7c1;
+$base06: #c9d3df;
+$base07: #fcfcfc;
+$base08: #ffac56;
+$base09: #feea74;
+$base0A: #bffe8a;
+$base0B: #4cfefa;
+$base0C: #62acfd;
+$base0D: #9b9bfd;
+$base0E: #fe9bda;
+$base0F: #fc8999;
+
+
+$fg: $base07;
+$bg0: $base00;
+$bg1: $base01;
+
+$border-color: $base03;
+$border-color-focus: $base04;
+$border-radius: 8px;
+$border-width: 2px;
+
+$gaps-screen: 8px;
+$gaps-window: 4px;
+
+$panel-font-size: 10pt;
+$popup-scale: 1;

modules/home/wayland/apps/eww/bar/css/_net.scss

@@ -1,8 +1,36 @@
+// Bar icons
+.net-icon                { font-size: 14px; padding: 3pt 0; }
+.net-active, .blt-on    { @include color-base; }
+.net-dim                 { @include color-inactive; }
+.blt-connected           { @include color-accent; }
 
-.net {
+// Popup window section accents
-    color: $base07;
+.wifi-accent { background-color: $base0C; }
+.eth-accent  { background-color: $base0B; }
+.blt-accent  { background-color: $base0D; }
+.usb-accent  { background-color: $base09; }
+
+// Netinfo rows
+.netinfo-row                            { margin-bottom: $popup-scale * 3pt; }
+.netinfo-label, .netinfo-value, .netinfo-dim { font-size: 0.72em; }
+.netinfo-label { @include color-active; min-width: $popup-scale * 60px; }
+.netinfo-value { @include color-body; }
+.netinfo-dim   { color: $base03; margin-bottom: $popup-scale * 4pt; }
+
+// Section toggle button
+.net-toggle-btn {
+  padding: $popup-scale * 2pt $popup-scale * 4pt;
+  @include border-radius;
+  font-size: 1.1em;
 }
 
-.blt {
+// Bluetooth device list
-    color: $base0C;
+.bt-device-row  { margin-bottom: $popup-scale * 4pt; }
-}
+.bt-device-name { font-size: 0.78em; @include color-body; }
+.bt-device-btn  { padding: $popup-scale * 2pt $popup-scale * 6pt; @include border-radius; font-size: 1em; }
+
+// Shared button states
+.net-toggle-btn:hover,
+.bt-device-btn:hover  { @include background-active; }
+.net-toggle-on, .bt-btn-on   { @include color-base; }
+.net-toggle-off, .bt-btn-off { @include color-inactive; }

modules/home/wayland/apps/eww/bar/css/_powermenu.scss

@@ -1,26 +1,21 @@
 .powermenu-box {
-    padding-left: 2.5rem;
+  padding: 3rem 2.5rem;
-    padding-right: 2.5rem;
+  margin: 0;
-    padding-top: 3rem;
-    padding-bottom: 3rem;
-    margin:0 0 0 0;
-}
 
-.powermenu-entry {
+  .powermenu-entry {
     margin: 0 0.5rem;
-}
 
-.powermenu-button {
+    .powermenu-button {
-    background-color: $base02;
+      @include background-active;
-    border-radius: 1rem;
+      border-radius: 1rem;
-    transition: 0.3s;
+      transition: 0.3s;
-    padding: 3.25rem 4rem;
+      padding: 3.25rem 4rem;
-}
 
-.powermenu-button:hover {
+      &:hover { background-color: $base03; }
-    background-color:$base03;
+    }
-}
+  }
 
-.powermenu-icon {
+  .powermenu-icon {
     font-size: 4rem;
-}
+  }
+}

modules/home/wayland/apps/eww/bar/css/_radio.scss

@@ -1,75 +1,90 @@
 
-.radio-win {
+.radio-accent { background-color: $base0D; }
-    //margin: $gaps-screen;
-    //padding: .5em;
-  }
 
-.album_art {
+// Now playing
-    background-repeat: no-repeat;
+.radio-now-playing {
-	background-size: 240px;
+  margin-bottom: $popup-scale * 8pt;
-	min-height: 240px;
-	min-width: 240px;
-	margin: $gaps-screen;
-	border-radius: $border-radius;
 }
 
-.song {
+.radio-art {
-	color: $base0C;
+  background-repeat: no-repeat;
-	font-size: 24px;
+  @include border-radius;
-	font-weight: bold;
+  @include background-base2;
-	margin: 20px 0px 0px 0px;
+  min-width: $popup-scale * 72px;
+  min-height: $popup-scale * 72px;
 }
 
-.artist {
+.radio-art-icon {
-	color: $base0E;
+  font-size: 2em;
-	font-size: 16px;
+  @include color-body;
-	font-weight: normal;
-	margin: 0px 0px $gaps-screen 0px;
 }
 
-.btn_bar {
+.radio-song {
-	color: $base05;
+  font-size: 0.88em;
-	font-size: 20px;
+  font-weight: bold;
-	font-weight: bold;
+  @include color-base;
-	margin: $gaps-screen 0px;
+  margin-bottom: $popup-scale * 2pt;
 }
 
-.btn_play {
+.radio-artist {
-	font-size: 48px;
+  font-size: 0.74em;
-	font-weight: bold;
+  @include color-body;
-	margin: 0 12px;
 }
 
-.btn_play:hover {
+// Controls
-	color: $base07;
+.radio-controls {
+  margin-top: $popup-scale * 6pt;
 }
 
-
+.radio-ctrl-btn {
-.station_list {
+  font-size: 2em;
-    border-right-color: $base03;
+  padding: $popup-scale * 4pt $popup-scale * 20pt;
-    border-right-style: solid;
+  @include border-radius;
-    border-right-width: $border-width;
+  @include color-body;
-    margin-right: $gaps-screen;
+  &:hover { @include background-active; @include color-base; }
 }
 
-.station_art {
+// Station list
-    background-repeat: no-repeat;
+.station-list {}
-	background-size: 50px;
+
-	min-height: 50px;
+scrollbar {
-	min-width: 50px;
+  background-color: transparent;
-	margin: $gaps-window;
+  border: none;
-    margin-right: $gaps-screen;
+  min-width: 6px;
-    background-color: $base00;
+}
-	border-radius: $border-radius;
+scrollbar trough {
-    border-color: $base00;
+  @include background-base2;
-    border-style: solid;
+  @include border-radius;
-    border-width: $border-width;
+  min-width: 6px;
+}
+scrollbar slider {
+  background-color: $base04;
+  @include border-radius;
+  min-width: 6px;
+  min-height: 20px;
+  &:hover { background-color: $base05; }
 }
 
-.station_art:hover {
+.station-row {
-    border-color: $base04;
+  padding: $popup-scale * 4pt $popup-scale * 3pt;
+  @include border-radius;
+  &:hover { @include background-base2; }
 }
 
-.station_sel {
+.station-row-active {
-    border-color: $base03;
+  .station-name { @include color-accent; }
-}
+}
+
+.station-icon {
+  background-repeat: no-repeat;
+  @include border-radius;
+  @include background-base2;
+  min-width: $popup-scale * 28px;
+  min-height: $popup-scale * 28px;
+  margin-right: $popup-scale * 8pt;
+}
+
+.station-name {
+  font-size: 0.76em;
+  @include color-body;
+}

modules/home/wayland/apps/eww/bar/css/_sys.scss

@@ -1,69 +1,93 @@
 
-.cpubar {
+// Bar module rings
-color: $base0C;
+.cpubar { color: $base0C; }
-}
+.gpubar { color: $base0E; }
+.membar { color: $base08; }
+.batbar { color: $base0B; }
+.cpubar, .gpubar, .membar, .batbar { @include background-base2; margin: $gaps-window 0; }
 
-.gpubar {
+// Window chrome
-color: $base0E;
+.sys-win            { padding: $popup-scale * 10pt; font-size: $popup-scale * $panel-font-size; }
-}
+.sys-section        { margin-bottom: 0; }
-
+.sys-section-header { margin-bottom: $popup-scale * 10pt; }
-.membar {
-color: $base08;
-}
-    
-.batbar {
-color: $base0B;
-}
-
-.cpubar,
-.gpubar,
-.membar,
-.batbar {
-    background-color: $bg0;
-    margin: $gaps-window 0;
-}
-
-.cpu-core-usage, .gpu-core-usage, .memory-usage {
-    background-color: $bg0;
-    border-radius: $border-radius;
-    padding: 2pt;
-    margin: 1pt;
-
-}
-
-.cpu-core-usage trough * {
-    background-color: $base0C;
-    border-radius: $border-radius;
-    padding: 2pt;
-}
-.gpu-core-usage trough * {
-    background-color: $base0E;
-    border-radius: $border-radius;
-    padding: 2pt;
-}
-
-.memory-usage trough * {
-    background-color: $base08;
-    border-radius: $border-radius;
-    padding: 2pt;
-}
-
-
-.spacer {
-    color: $bg1;
-    padding: $gaps-window;
-    margin:0;
-}
-
-.sys-win {
-    // @include window;
-    // background-color: $bg1;
-    // color: $fg;
-    // margin: $gaps-win;
-    padding: 5pt;
-}
 
 .sys-label {
-    font-weight: bolder;
+  font-size: 0.72em;
-    color: $base04;
+  font-weight: bold;
-}
+  letter-spacing: 0.14em;
+  @include color-body;
+}
+
+.section-accent {
+  min-width: 3px;
+  border-radius: 2px;
+  margin-right: $popup-scale * 8pt;
+}
+
+.cpu-accent { background-color: $base0C; }
+.gpu-accent { background-color: $base0E; }
+.ram-accent { background-color: $base08; }
+.bat-accent { background-color: $base0B; }
+
+.section-sep {
+  background-color: $base03;
+  min-height: 2px;
+  margin: $popup-scale * 6pt 0 $popup-scale * 10pt;
+}
+
+// All rings and progress tracks share the same background
+.cpu-usage-ring, .cpu-freq-ring,
+.gpu-ring, .gpu-freq-ring,
+.ram-ring, .swap-ring, .bat-ring,
+.vram-bar { @include background-base2; }
+
+// Ring colors
+.cpu-usage-ring                { color: $base0C; }
+.cpu-freq-ring, .gpu-freq-ring { color: $base0D; }
+.gpu-ring                      { color: $base0E; }
+.ram-ring                      { color: $base08; }
+.swap-ring                     { color: $base09; }
+
+// Ring margins - freq rings use larger margins for concentric overlay effect
+.cpu-usage-ring, .gpu-ring { margin: $popup-scale * 3pt; }
+.ram-ring, .bat-ring       { margin: $popup-scale * 4pt; }
+.swap-ring                 { margin: $popup-scale * 3.5pt; }
+.cpu-freq-ring             { margin: $popup-scale * 12px; }
+.gpu-freq-ring             { margin: $popup-scale * 13px; }
+
+// Shared label patterns
+.gpu-ring-value, .gpu-stat-value, .ram-used-label { font-weight: bold; @include color-body; }
+.gpu-ring-value { font-size: 0.82em; }
+.gpu-stat-value { font-size: 0.85em; }
+.ram-used-label { font-size: 0.95em; }
+
+.gpu-ring-label, .gpu-stat-label,
+.vram-usage-label, .swap-section-label { font-size: 0.62em; @include color-active; }
+.gpu-ring-label, .vram-usage-label, .swap-section-label { margin-top: 2pt; }
+
+.cpu-core-label  { font-size: 0.7em; @include color-active; }
+.bat-ring-label  { font-size: 0.7em; @include color-body; }
+.ram-total-label { font-size: 0.72em; @include color-active; }
+
+// GPU stats row
+.gpu-stats-row { margin-top: $popup-scale * 6pt; margin-bottom: $popup-scale * 2pt; }
+
+// VRAM
+.vram-row { margin-top: $popup-scale * 6pt; }
+
+.vram-bar {
+  @include border-radius;
+  padding: $popup-scale * 2pt;
+}
+
+.vram-bar trough * {
+  background-color: $base0E;
+  @include border-radius;
+}
+
+// RAM cached ring overrides group background
+.ram-cached-ring {
+  @include color-active;
+  background-color: transparent;
+  margin: $popup-scale * 4pt;
+}

modules/home/wayland/apps/eww/bar/css/_systray.scss

@@ -1,35 +1,28 @@
 .tray * {
-    padding: $border-width 0px;
+  padding: $border-width 0;
 }
+
 .tray menu {
-    background-color: $base01;
+  @include border-radius;
-    color: $base07;
+  @include border-active;
-    @include border-radius;
+  @include background-base;
-    @include border-active;
+  @include color-base;
 
+  padding: 10px 0;
 
-	padding: 10px 0px;
+  > menuitem {
+    margin: 2px $border-width;
+    padding: 0 10px;
 
-	>menuitem {
+    &:disabled label { @include color-active; }
-        margin: 2px $border-width;
+    &:hover          { @include background-accent; }
-		padding: 0px 10px;
+  }
 
-		&:disabled label {
+  separator {
-			color: $base04;
+    @include background-base2;
-		}
+    padding-top: 1px;
+    margin: 10px 0;
 
-		&:hover {
+    &:last-child { padding: unset; }
-			background-color: $base0C;
+  }
-		}
+}
-	}
-
-	separator {
-		background-color: $base03;
-		padding-top: 1px;
-        margin:10px 0px;
-
-		&:last-child {
-			padding: unset;
-		}
-	}
-}

modules/home/wayland/apps/eww/bar/eww.scss

@@ -18,8 +18,45 @@
   border-color: $base04;
 }
 
-@mixin test {
+@mixin background-base {
+  background-color: $base01;
+}
+@mixin background-base2 {
+  background-color: $base02;
+}
+@mixin background-active {
+  background-color: $base04;
+}
+@mixin background-accent {
+  background-color: $base0C;
+}
+@mixin color-base {
+  color: $base07;
+}
+@mixin color-inactive {
+  color: $base02;
+}
+@mixin color-active {
+  color: $base04;
+}
+@mixin color-accent {
+  color: $base0C;
+}
+@mixin color-body {
+  color: $base05;
+}
 
+@mixin panel-base {
+  @include border-radius;
+  @include border-inactive;
+  @include background-base;
+  @include color-base;
+}
+
+@mixin mod-edge {
+  border-right-style: none;
+  border-bottom-right-radius: 0;
+  border-top-right-radius: 0;
 }
 
 /*  GENERAL */
@@ -31,9 +68,9 @@
 }
 
 tooltip {
-  background: $base01;
+  @include border-active;
-  border: $border-width solid $base04;
+  @include border-radius;
-  border-radius: $border-radius;
+  @include background-base;
 
   label {
     font-size: 1rem;
@@ -49,33 +86,17 @@ tooltip {
   font-weight: 900;
 }
 
-.grey {
+/* WORKSPACE COLORS - emitted dynamically by scripts/workspaces as class names */
-  color: $base02;
+.grey   { color: $base02; }
-}
+.red    { color: $base0F; }
-
+.orange { color: $base08; }
-.red {
+.green  { color: $base0B; }
-  color: $base0F;
+.blue   { color: $base0C; }
-}
-
-.orange {
-  color: $base08;
-}
-
-.green {
-  color: $base0B;
-}
-
-.blue {
-  color: $base0C;
-}
 
 /* WINDOW WRAPPER CSS */
 
 .winevent {
-  background-color: $base01;
+  @include panel-base;
-  color: $base07;
-  @include border-radius;
-  @include border-inactive;
 }
 .winevent:hover {
   @include border-active;
@@ -91,19 +112,12 @@ tooltip {
 /* MODULE WRAPPER CSS */
 
 .modevent {
-  background-color: $base01;
+  @include panel-base;
-  color: $base07;
+  @include mod-edge;
-  @include border-radius;
-  @include border-inactive;
-  border-right-style: none;
-  border-bottom-right-radius: 0;
-  border-top-right-radius: 0;
 }
 .modevent:hover {
   @include border-active;
-  border-right-style: none;
+  @include mod-edge;
-  border-bottom-right-radius: 0;
-  border-top-right-radius: 0;
 }
 
 .modinner {

modules/home/wayland/apps/eww/bar/eww.yuck

@@ -5,8 +5,12 @@
 (include "modules/systray.yuck")
 (include "modules/clock.yuck")
 
-(include "windows/calendar.yuck")
+(defvar active-panel "")
+
 (include "windows/sys.yuck")
+(include "windows/net.yuck")
+(include "windows/clock.yuck")
+(include "windows/popup.yuck")
 (include "windows/radio.yuck")
 (include "windows/powermenu.yuck")
 
@@ -48,7 +52,7 @@
 
 
 (defwindow bar
-    :monitor 1
+    :monitor 0
     :geometry (geometry
       :x "0%"
       :y "0%"

modules/home/wayland/apps/eww/bar/modules/clock.yuck

@@ -5,8 +5,8 @@
     (eventbox
       :onhover "${EWW_CMD} update date_rev=true"
       :onhoverlost "${EWW_CMD} update date_rev=false"
-      :onclick "(sleep 0.1 && ${EWW_CMD} open --toggle calendar)"
+      :onclick "(sleep 0.1 && scripts/panel-toggle clock)"
-      :onrightclick "(sleep 0.1 && ${EWW_CMD} open --toggle powermenu)"
+      :onrightclick "(sleep 0.1 && eww-open-on-current-screen powermenu --toggle)"
       (box
         :class "datetime"
         (overlay
@@ -39,4 +39,4 @@
 (defpoll hour	:interval "15s"	"date '+%H'")
 (defpoll minute	:interval "15s"	"date '+%M'")
 (defpoll day	:interval "15s"	"date '+%d'")
-(defpoll month	:interval "15s"	"date '+%m'")
+(defpoll month	:interval "15s"	"date '+%m'")

modules/home/wayland/apps/eww/bar/modules/net.yuck

@@ -1,17 +1,30 @@
-(deflisten net :initial '{"name":"","icon":""}'"scripts/net/net")
+(deflisten net
+  :initial '{"wifi":{"connected":false,"enabled":false,"icon":"󰤮","ssid":""},"ethernet":{"connected":false},"usb":{"connected":false}}'
+  "scripts/net/net")
+
+(deflisten bluetooth
+  :initial '{"powered":false,"connected":false,"device":""}'
+  "scripts/net/bluetooth")
 
 (defwidget net-mod []
   (module
-    (box
+    (eventbox
-      :orientation "v"
+      :onclick "(sleep 0.1 && scripts/panel-toggle net)"
-      (button
+    (box :orientation "v"
-        :class "net"
+      (label
-        :tooltip {net.name}
+        :class "net-icon ${net.ethernet.connected ? 'net-active' : 'net-dim'}"
-        {net.icon})
+        :tooltip {net.ethernet.connected ? "Ethernet: Connected" : "Ethernet: Disconnected"}
-
+        :text "󰈀")
-      (button
+      (label
-        :class "blt"
+        :visible {net.usb.connected}
-        (label :class "icon-text" :text "B"))
+        :class "net-icon net-active"
-    )
+        :tooltip "USB: Connected"
-  )
+        :text "󰌷")
-)
+      (label
+        :class "net-icon ${net.wifi.connected ? 'net-active' : 'net-dim'}"
+        :tooltip {net.wifi.connected ? "WiFi: ${net.wifi.ssid}" : "WiFi: Disconnected"}
+        :text {net.wifi.icon})
+      (label
+        :class "net-icon ${bluetooth.connected ? 'blt-connected' : bluetooth.powered ? 'blt-on' : 'net-dim'}"
+        :tooltip {bluetooth.connected ? "Bluetooth: ${bluetooth.device}" : bluetooth.powered ? "Bluetooth: On" : "Bluetooth: Off"}
+        :text {bluetooth.connected ? "󰂱" : bluetooth.powered ? "󰂯" : "󰂲"})))))

modules/home/wayland/apps/eww/bar/modules/sys.yuck

@@ -1,42 +1,32 @@
-(deflisten cpu :initial '{}' "scripts/sys/cpu")
+(deflisten gpu :initial '{"gfx_pct":0,"mem_pct":0,"media_pct":0,"sclk":0,"mclk":0,"sclk_pct":0,"mclk_pct":0,"vclk":0,"vclk_pct":0,"temp":0,"power":0,"vram_used":0,"vram_total":1}' "scripts/sys/gpu")
-(deflisten gpu :initial '{"devices":[{"GRBM2":{}}]}' "scripts/sys/gpu")
+(deflisten memory :initial '{"human":{"used":"0G","total":"0G","cached":"0G"},"used":0.0,"total":1.0,"cached":0.0}' "scripts/sys/memory")
-(deflisten memory :initial '{"human":{"used":"0G","total":"0G"},"used":0.0,"total":1.0}' "scripts/sys/memory")
 
 (deflisten battery :initial '{"visible":false,"percentage":0.0,"color":"#FFFFFF"}' "scripts/sys/battery")
 
 (defwidget sys-mod []
   (module
     (eventbox
-      :onclick "(sleep 0.1 && ${EWW_CMD} open --toggle sys)"
+      :onclick "(sleep 0.1 && scripts/panel-toggle sys)"
-      (box
+      (box :orientation "v"
-        :orientation "v"
+        (circular-progress
-          (circular-progress
+          :value {EWW_CPU.avg}
-            :value {EWW_CPU.avg}
+          :class "cpubar"
-            :class "cpubar"
+          :width 28 :height 28 :thickness 6
-            :thickness 6
+          :tooltip "CPU ${round(EWW_CPU.avg, 0)}%")
-            (label :class "icon-text" :text "C"))
+        (circular-progress
-
+          :value {gpu.gfx_pct}
-          (circular-progress
+          :class "gpubar"
-            :value {gpu.devices[0].GRBM2?.CommandProcessor-Graphics?.value?:0}
+          :width 28 :height 28 :thickness 6
-            :class "gpubar"
+          :tooltip "GPU ${round(gpu.gfx_pct, 0)}%")
-            :thickness 6
-            (label :class "icon-text" :text "G"))
         (circular-progress
           :value {100*memory.used/memory.total}
           :class "membar"
-          :thickness 6
+          :width 28 :height 28 :thickness 6
-          :tooltip "${memory.human.used} / ${memory.human.total}"
+          :tooltip "RAM ${memory.human.used} / ${memory.human.total}")
-          (label :class "icon-text" :text "M"))
-
         (circular-progress
           :value {battery.percentage}
           :class "batbar"
           :visible {battery.visible}
           :style "color: ${battery.color};"
-          :thickness 6
+          :width 28 :height 28 :thickness 6
-          :tooltip "${battery.status} @ ${battery.wattage}"
+          :tooltip "Bat ${round(battery.percentage, 0)}% · ${battery.status} @ ${battery.wattage}")))))
-          (label :class "icon-text" :text "B"))
-      )
-    )
-  )
-)

modules/home/wayland/apps/eww/bar/modules/workspaces.yuck

@@ -3,13 +3,14 @@
 (defwidget workspace-mod []
   	(module
   	  	(eventbox
-		:onscroll "echo {} | sed -e \"s/up/-1/g\" -e \"s/down/+1/g\" | xargs hyprctl dispatch workspace"
+			:onscroll "echo {} | sed -e 's/up/-1/' -e 's/down/+1/' | xargs -I % hyprctl eval \"hl.dispatch(hl.dsp.focus({ workspace = '%' }))\""
+
 			(box
 				:class "module workspaces"
 				:orientation "v"
 				(for ws in workspace
 					(button
-						:onclick "hyprctl dispatch workspace ${ws.number}"
+						:onclick "hyprctl  eval \"hl.dispatch(hl.dsp.focus({ workspace = '${ws.number}' }))\""
 						(label 
 							:show-truncated false
 							:class "icon-text  ${ws.color}"

modules/home/wayland/apps/eww/bar/scripts/brightness

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+BACKLIGHT="/sys/class/backlight"
+DEV=$(ls "$BACKLIGHT" 2>/dev/null | head -n1)
+
+gen_output() {
+  if [ -z "$DEV" ]; then
+    echo '{"percent":0,"available":false}'
+    return
+  fi
+  max=$(cat "$BACKLIGHT/$DEV/max_brightness")
+  cur=$(cat "$BACKLIGHT/$DEV/actual_brightness" 2>/dev/null || cat "$BACKLIGHT/$DEV/brightness")
+  percent=$(awk -v c="$cur" -v m="$max" 'BEGIN{print int(c/m*100+0.5)}')
+  printf '{"percent":%d,"available":true}\n' "$percent"
+}
+
+case "$1" in
+  set)
+    [ -z "$DEV" ] && exit 0
+    brightnessctl -d "$DEV" set "${2}%" -q 2>/dev/null
+    ;;
+  *)
+    gen_output
+    [ -z "$DEV" ] && exit 0
+    # Poll for changes every 2s (sysfs files don't support inotify reliably)
+    while true; do sleep 2; gen_output; done
+    ;;
+esac

modules/home/wayland/apps/eww/bar/scripts/net/bluetooth

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+emit() {
+  local powered=false connected=false device=""
+
+  if bluetoothctl show 2>/dev/null | grep -q "Powered: yes"; then
+    powered=true
+    while IFS= read -r line; do
+      local mac info
+      mac=$(echo "$line" | awk '{ print $2 }')
+      info=$(bluetoothctl info "$mac" 2>/dev/null)
+      if echo "$info" | grep -q "Connected: yes"; then
+        device=$(echo "$info" | awk -F': ' '/^\tName:/ { print $2; exit }')
+        connected=true
+        break
+      fi
+    done < <(bluetoothctl devices 2>/dev/null)
+  fi
+
+  printf '{"powered":%s,"connected":%s,"device":"%s"}\n' "$powered" "$connected" "$device"
+}
+
+emit
+
+tmp=$(mktemp -d)
+pipe="$tmp/bt-events"
+mkfifo "$pipe"
+trap 'rm -rf "$tmp"; kill 0 2>/dev/null' EXIT INT TERM
+
+# Poll every 2s as reliable fallback for missed events
+(while true; do sleep 2; echo poll; done) > "$pipe" &
+
+# bluetoothctl monitor for reactive device connect/disconnect events
+(bluetoothctl monitor 2>/dev/null | grep --line-buffered -E "Powered|Connected|Device") > "$pipe" &
+
+while IFS= read -r _ < "$pipe"; do
+  emit
+done

modules/home/wayland/apps/eww/bar/scripts/net/bt-devices

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+emit() {
+  local first=true arr=""
+  while IFS= read -r line; do
+    local mac name connected
+    mac=$(echo "$line" | awk '{ print $2 }')
+    name=$(echo "$line" | awk '{ $1=$2=""; sub(/^ +/, ""); print }')
+    info=$(bluetoothctl info "$mac" 2>/dev/null)
+    connected=$(echo "$info" | grep -q "Connected: yes" && echo true || echo false)
+    $first || arr="${arr},"
+    arr="${arr}{\"mac\":\"${mac}\",\"name\":\"${name}\",\"connected\":${connected}}"
+    first=false
+  done < <(bluetoothctl devices 2>/dev/null)
+  echo "[${arr}]"
+}
+
+emit
+
+tmp=$(mktemp -d)
+pipe="$tmp/bt-dev-events"
+mkfifo "$pipe"
+trap 'rm -rf "$tmp"; kill 0 2>/dev/null' EXIT INT TERM
+
+# Poll every 3s as fallback for missed events
+(while true; do sleep 3; echo poll; done) > "$pipe" &
+
+# Reactive updates from D-Bus
+(bluetoothctl monitor 2>/dev/null | grep --line-buffered -E "Connected|Device|Powered") > "$pipe" &
+
+while IFS= read -r _ < "$pipe"; do
+  emit
+done

modules/home/wayland/apps/eww/bar/scripts/net/bt-toggle

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+mac="$1"
+if bluetoothctl info "$mac" 2>/dev/null | grep -q "Connected: yes"; then
+  bluetoothctl disconnect "$mac"
+else
+  bluetoothctl connect "$mac"
+fi

modules/home/wayland/apps/eww/bar/scripts/net/net

@@ -1,73 +1,64 @@
-#!/usr/bin/env zsh
+#!/usr/bin/env bash
 
-function get_time_ms {
+get_wifi_iface() {
-  date -u +%s%3N
+  awk 'NR > 2 { gsub(":", "", $1); print $1; exit }' /proc/net/wireless
 }
 
-icons=("󰤯" "󰤟" "󰤢" "󰤥" "󰤨")
+get_usb_iface() {
-
+  ip link 2>/dev/null | awk '
-function toggle() {
+    /^[0-9]+: usb[0-9]/ { gsub(":", "", $2); print $2; exit }
-  status=$(rfkill | grep wlan | awk '{print $4}')
+    /^[0-9]+: enx/      { gsub(":", "", $2); print $2; exit }
-
+  '
-  if [ "$status" = "unblocked" ]; then
-    rfkill block wlan
-  else
-    rfkill unblock wlan
-  fi
 }
 
-function gen_wifi() {
+signal_icon() {
-  signal=$(cat /proc/net/wireless | head -n3 | tail -n1 | awk '{print $3}')
+  local dbm="$1"
-  level=$(awk -v n="$signal" 'BEGIN{print int((n-1)/20)}')
+  if [ -z "$dbm" ]; then echo "󰤮"; return; fi
-  if [ "$level" -gt 4 ]; then
+  if   [ "$dbm" -ge -50 ]; then echo "󰤨"
-    level=4
+  elif [ "$dbm" -ge -60 ]; then echo "󰤥"
+  elif [ "$dbm" -ge -70 ]; then echo "󰤢"
+  elif [ "$dbm" -ge -80 ]; then echo "󰤟"
+  else echo "󰤯"; fi
+}
+
+make_content() {
+  local wifi_iface eth_iface
+
+  wifi_iface=$(get_wifi_iface)
+  eth_iface=$(ip link | awk '/^[0-9]+: en[po]/ { gsub(":",""); print $2; exit }')
+
+  # Ethernet
+  local eth_connected=false
+  if [ -n "$eth_iface" ]; then
+    eth_state=$(ip link show "$eth_iface" 2>/dev/null | awk '/state/ { print $9 }')
+    [ "$eth_state" = "UP" ] && eth_connected=true
   fi
 
-  icon=${icons[$level]}
+  # USB tethering
-  ip="-"
+  local usb_iface usb_connected=false
-  class="net-connected"
+  usb_iface=$(get_usb_iface)
-  name_raw=$(wpa_cli status | grep \^ssid= | sed 's/ssid=//g')
+  if [ -n "$usb_iface" ] && ip -4 addr show "$usb_iface" 2>/dev/null | grep -q "inet "; then
-  name=$(printf "%s" $name_raw)
+    usb_connected=true
-}
-
-function gen_ethernet() {
-  icon="󰈀"
-  class="net-connected"
-  ip=""
-  name=Wired
-}
-
-function make_content() {
-  local ethernet wifi
-  ethernet=$(ip link | rg "^[0-9]+: en[po]+" | head -n1 | sed 's/[a-zA-Z0-9_,><:\ -]*state //g' | sed 's/ mode [a-zA-Z0-9 ]*//g')
-  wifi=$(wpa_cli status | rg "^wpa_state=" | sed 's/wpa_state=//g')
-
-  # test ethernet first
-  if [[ $ethernet == "UP" ]]; then
-    gen_ethernet
-  elif [[ $wifi == "COMPLETED" ]]; then
-    gen_wifi
-  else
-    icon="󰤮"
-    ip="-"
-    class="net-disconnected"
-    name="Disconnected"
   fi
 
-  echo '{"icon": "'$icon'", "name": "'$name'", "ip": "'$ip'", "class": "'$class'"}'
+  # WiFi - use IP presence as connection indicator (more reliable than wpa_cli)
+  local wifi_connected=false wifi_enabled=false wifi_icon="󰤮" wifi_ssid=""
+  if ! rfkill list wlan 2>/dev/null | grep -q "Soft blocked: yes"; then
+    wifi_enabled=true
+  fi
+  if [ -n "$wifi_iface" ] && ip -4 addr show "$wifi_iface" 2>/dev/null | grep -q "inet "; then
+    wifi_connected=true
+    wifi_ssid=$(wpa_cli -g "/run/wpa_supplicant/$wifi_iface" status 2>/dev/null \
+      | awk -F= '/^ssid=/ { print $2 }')
+    signal=$(awk -v iface="$wifi_iface" '$1 == iface ":" { gsub(/\./, "", $4); print $4; exit }' /proc/net/wireless)
+    wifi_icon=$(signal_icon "$signal")
+  fi
+
+  printf '{"wifi":{"connected":%s,"enabled":%s,"icon":"%s","ssid":"%s"},"ethernet":{"connected":%s},"usb":{"connected":%s}}\n' \
+    "$wifi_connected" "$wifi_enabled" "$wifi_icon" "$wifi_ssid" "$eth_connected" "$usb_connected"
 }
 
-if [ "$1" = "toggle" ]; then
+make_content
-  toggle
+ip monitor | while read -r _; do
-else
-  last_time=$(get_time_ms)
   make_content
-  ip monitor | while read -r _; do
+done
-    current_time=$(get_time_ms)
-    delta=$((current_time - last_time))
-    if [[ $delta -gt 50 ]]; then
-      make_content
-      last_time=$(get_time_ms)
-    fi
-  done
-fi

modules/home/wayland/apps/eww/bar/scripts/net/netinfo

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+
+get_wifi_iface() {
+  awk 'NR > 2 { gsub(":", "", $1); print $1; exit }' /proc/net/wireless
+}
+
+get_usb_iface() {
+  ip link 2>/dev/null | awk '
+    /^[0-9]+: usb[0-9]/ { gsub(":", "", $2); print $2; exit }
+    /^[0-9]+: enx/      { gsub(":", "", $2); print $2; exit }
+  '
+}
+
+freq_band() {
+  local f="$1"
+  if   [ "$f" -ge 6000 ] 2>/dev/null; then echo "6 GHz"
+  elif [ "$f" -ge 5000 ] 2>/dev/null; then echo "5 GHz"
+  elif [ "$f" -ge 2400 ] 2>/dev/null; then echo "2.4 GHz"
+  else echo ""; fi
+}
+
+wifi_gen_label() {
+  case "$1" in
+    7) echo "Wi-Fi 7" ;; 6) echo "Wi-Fi 6" ;;
+    5) echo "Wi-Fi 5" ;; 4) echo "Wi-Fi 4" ;;
+    *) echo "" ;;
+  esac
+}
+
+make_content() {
+  local wifi_iface eth_iface
+  wifi_iface=$(get_wifi_iface)
+  eth_iface=$(ip link | awk '/^[0-9]+: en[po]/ { gsub(":",""); print $2; exit }')
+
+  local wifi_ssid="" wifi_ip="" wifi_freq=0 wifi_band="" wifi_gen="" wifi_signal=0
+  if [ -n "$wifi_iface" ] && ip -4 addr show "$wifi_iface" 2>/dev/null | grep -q "inet "; then
+    local wpa
+    wpa=$(wpa_cli -g "/run/wpa_supplicant/$wifi_iface" status 2>/dev/null)
+    wifi_ssid=$(echo "$wpa"    | awk -F= '/^ssid=/            { print $2 }')
+    wifi_ip=$(ip -4 addr show "$wifi_iface" | awk '/inet / { print $2 }')
+    wifi_freq=$(echo "$wpa"   | awk -F= '/^freq=/             { print $2 }')
+    local gen
+    gen=$(echo "$wpa"         | awk -F= '/^wifi_generation=/  { print $2 }')
+    wifi_band=$(freq_band "$wifi_freq")
+    wifi_gen=$(wifi_gen_label "$gen")
+    wifi_signal=$(awk -v iface="$wifi_iface" \
+      '$1 == iface ":" { gsub(/\./, "", $4); print $4; exit }' /proc/net/wireless)
+  fi
+
+  local eth_ip="" eth_speed="" eth_state="down"
+  if [ -n "$eth_iface" ]; then
+    eth_state=$(ip link show "$eth_iface" 2>/dev/null | awk '/state/ { print tolower($9) }')
+    if [ "$eth_state" = "up" ]; then
+      eth_ip=$(ip -4 addr show "$eth_iface" | awk '/inet / { print $2 }')
+      local spd
+      spd=$(cat /sys/class/net/"$eth_iface"/speed 2>/dev/null)
+      [ "${spd:-0}" -gt 0 ] 2>/dev/null && eth_speed="${spd} Mbps"
+    fi
+  fi
+
+  local usb_iface usb_ip=""
+  usb_iface=$(get_usb_iface)
+  if [ -n "$usb_iface" ] && ip -4 addr show "$usb_iface" 2>/dev/null | grep -q "inet "; then
+    usb_ip=$(ip -4 addr show "$usb_iface" | awk '/inet / { print $2 }')
+  fi
+
+  # shellcheck disable=SC2059
+  printf '{"wifi":{"ssid":"%s","ip":"%s","freq":%s,"band":"%s","gen":"%s","signal":%s},' \
+    "$wifi_ssid" "$wifi_ip" "${wifi_freq:-0}" "$wifi_band" "$wifi_gen" "${wifi_signal:-0}"
+  printf '"ethernet":{"state":"%s","ip":"%s","speed":"%s","interface":"%s"},' \
+    "$eth_state" "$eth_ip" "$eth_speed" "${eth_iface:-}"
+  printf '"usb":{"interface":"%s","ip":"%s"}}\n' \
+    "${usb_iface:-}" "$usb_ip"
+}
+
+make_content
+ip monitor | while read -r _; do
+  make_content
+done

modules/home/wayland/apps/eww/bar/scripts/nightlight

@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+case "$1" in
+  status)
+    pgrep -x wlsunset >/dev/null 2>&1 && echo true || echo false
+    ;;
+  *)
+    if pgrep -x wlsunset >/dev/null 2>&1; then
+      pkill -x wlsunset && echo false
+    else
+      wlsunset -T 4500 -t 3200 & echo true
+    fi
+    ;;
+esac

modules/home/wayland/apps/eww/bar/scripts/panel-toggle

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+PANEL="$1"
+
+# Drop concurrent invocations, but recover from stale locks (dead processes)
+LOCK="/tmp/eww_panel_toggle.lock"
+if [ -f "$LOCK" ] && kill -0 "$(cat "$LOCK" 2>/dev/null)" 2>/dev/null; then
+  exit 0
+fi
+echo $$ > "$LOCK"
+trap 'rm -f "$LOCK"' EXIT
+
+CURRENT=$(eww get active-panel 2>/dev/null | tr -d '"')
+
+open_popup() {
+  local screen
+  screen=$(hyprctl monitors -j 2>/dev/null | jq -r '.[] | select(.focused == true) | .name' | head -n1)
+  if [ -n "$screen" ]; then
+    eww open popup --screen "$screen"
+  else
+    eww open popup
+  fi
+}
+
+if [ "$CURRENT" = "$PANEL" ]; then
+  eww update active-panel=""
+  eww close popup 2>/dev/null
+else
+  eww update active-panel="$PANEL"
+  open_popup
+fi

modules/home/wayland/apps/eww/bar/scripts/power-save

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+current=$(eww state 2>/dev/null | grep '^power-save:' | awk '{print $2}')
+if [ "$current" = "true" ]; then
+  powerprofilesctl set balanced 2>/dev/null || true
+  echo false
+else
+  powerprofilesctl set power-saver 2>/dev/null || true
+  echo true
+fi

modules/home/wayland/apps/eww/bar/scripts/radio

@@ -1,106 +1,227 @@
 #!/usr/bin/env bash
 
-get_time_ms() {
-  date -u +%s%3N
-}
-
 URL_BASE="https://www.radiorecord.ru/api"
-
 MPV_PID_FILE="/tmp/mpv_radio_pid"
 RADIO_ID_FILE="/tmp/radio_id"
 
-STATIONS="[]"
+STATION_IDS='[507,522,523,536,537,42532,42602]'
 
-PID=$( [ -e "$MPV_PID_FILE" ] && cat "$MPV_PID_FILE" || echo 0 )
+# Custom (non-radiorecord) stations
-RADIO_ID=$( [ -e "$RADIO_ID_FILE" ] && cat "$RADIO_ID_FILE" || echo 0 )
+# id must be a unique integer >= 1000000 to avoid collision with radiorecord IDs.
-RADIO_URL=""
+# icon_fill_white: URL to station icon image, or "" for none.
-INFO='{"id":null,"artist":null,"song":null,"image600":null}'
+CUSTOM_STATIONS='[
-PAUSED=$(( $PID == 0 || $RADIO_ID == 0 ? 1 : 0 ))
+]'
+
+STATIONS="[]"
+DEFAULT_INFO='{"artist":"","song":"","image600":""}'
+DEFAULT_MEDIA='{"player":"","status":"Stopped","artist":"","title":"","art":""}'
+
+PID=$([ -e "$MPV_PID_FILE" ] && cat "$MPV_PID_FILE" || echo 0)
+RADIO_ID=$([ -e "$RADIO_ID_FILE" ] && cat "$RADIO_ID_FILE" || echo 0)
+PAUSED=$(( PID == 0 ? 1 : 0 ))
+INFO="$DEFAULT_INFO"
+MEDIA="$DEFAULT_MEDIA"
 STATUS="{}"
 
-get_radio() {
+get_stations() {
-  echo "$STATIONS" | jq -r --argjson sel_id "$RADIO_ID" 'map(select(.id == $sel_id)).[0]'
+  local rr
+  rr=$(curl -s --compressed "$URL_BASE/stations/" 2>/dev/null \
+    | jq --argjson ids "$STATION_IDS" \
+        '.result.stations | map(select(.id | IN($ids[]))) | map({id, title, stream_hls, icon_fill_white, "radiorecord": true})' 2>/dev/null)
+  jq -n \
+    --argjson rr "${rr:-[]}" \
+    --argjson custom "$CUSTOM_STATIONS" \
+    '$rr + ($custom | map(. + {"radiorecord": false}))'
 }
 
 get_song() {
-  echo $(curl -s "$URL_BASE/station/history/?id=$RADIO_ID" | jq '.result.history[0] | ({id, artist, song, image600})')
+  curl -s --compressed "$URL_BASE/station/history/?id=$RADIO_ID" \
+    | jq '.result.history[0] | {artist, song, image600}'
 }
 
-
+get_stream_url() {
-update() {
+  echo "$STATIONS" | jq -r --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].stream_hls // empty'
-  PID=$( [ -e "$MPV_PID_FILE" ] && cat "$MPV_PID_FILE" || echo 0 )
-  RADIO_ID=$( [ -e "$RADIO_ID_FILE" ] && cat "$RADIO_ID_FILE" || echo 0 )
-  PAUSED=$(( $PID == 0 && $RADIO_ID > 0 ? 1 : 0 ))
 }
 
-start() {
+get_player_info() {
-  STATIONS=$(curl -s "$URL_BASE/stations/" | jq --argjson ids '[507,522,523,536,537,42532,42602]' '.result.stations | map(select(.id | IN($ids[]))) | map({id, title, stream_hls, icon_fill_white})')
+  local player status artist title art
-  RADIO_URL=$(get_radio | jq -r '.stream_hls')
+  # exclude mpv (radio) so it never appears as "external player"
-  if [ "$PAUSED" = 0 ]; then
+  player=$(playerctl -l 2>/dev/null | grep -Ev '^mpv' | head -1)
-    kill -9 $PID
+  if [ -z "$player" ]; then
+    echo '{"player":"","status":"Stopped","artist":"","title":"","art":""}'
+    return
   fi
-  mpv "$RADIO_URL" & echo $! > "$MPV_PID_FILE"
+  status=$(playerctl -p "$player" status 2>/dev/null || echo "Stopped")
-  echo $RADIO_ID > "$RADIO_ID_FILE"
+  artist=$(playerctl -p "$player" metadata artist 2>/dev/null || echo "")
+  title=$(playerctl -p "$player" metadata title 2>/dev/null || echo "")
+  art=$(playerctl -p "$player" metadata mpris:artUrl 2>/dev/null || echo "")
+  jq -cnr --arg player "$player" --arg status "$status" \
+    --arg artist "$artist" --arg title "$title" --arg art "$art" \
+    '{player:$player, status:$status, artist:$artist, title:$title, art:$art}'
 }
 
+update_state() {
+  PID=$([ -e "$MPV_PID_FILE" ] && cat "$MPV_PID_FILE" || echo 0)
+  RADIO_ID=$([ -e "$RADIO_ID_FILE" ] && cat "$RADIO_ID_FILE" || echo 0)
+  if [ "$PID" -gt 0 ] && ! kill -0 "$PID" 2>/dev/null; then
+    PID=0
+    rm -f "$MPV_PID_FILE"
+  fi
+  PAUSED=$(( PID == 0 ? 1 : 0 ))
+}
 
-toggle() {
+emit_status() {
-  if [ "$PAUSED" = 1 ]; then
+  jq -cnr \
-    echo $RADIO_ID $PID
+    --argjson stations "${STATIONS:-[]}" \
-    start
+    --argjson radio_id "${RADIO_ID:-0}" \
+    --argjson is_paused "${PAUSED:-1}" \
+    --argjson info "${INFO:-$DEFAULT_INFO}" \
+    --argjson media "${MEDIA:-$DEFAULT_MEDIA}" \
+    '{"is_paused": $is_paused, "song": $info, "radio": $radio_id, "stations": $stations, "media": $media}'
+}
+
+get_stream_node() {
+  local name="$1"
+  wpctl status 2>/dev/null | awk -v pat="$name" '
+    /Streams:/ { in_s = 1 }
+    /Sinks:|Sources:|Clients:/ { in_s = 0 }
+    in_s && /[0-9]+\./ && tolower($0) ~ tolower(pat) {
+      match($0, /[0-9]+/); print substr($0, RSTART, RLENGTH); exit
+    }
+  '
+}
+
+get_mpv_node() {
+  get_stream_node "mpv"
+}
+
+get_volume() {
+  if [ "$PID" -gt 0 ] && kill -0 "$PID" 2>/dev/null; then
+    local node_id; node_id=$(get_mpv_node)
+    [ -n "$node_id" ] && wpctl get-volume "$node_id" 2>/dev/null \
+      | awk '{printf "%d", $2 * 100}'
   else
-    kill -9 "$PID"
+    local player; player=$(playerctl -l 2>/dev/null | grep -Ev '^mpv' | head -1)
-    rm -f $MPV_PID_FILE
+    [ -n "$player" ] && playerctl -p "$player" volume 2>/dev/null \
+      | awk '{printf "%d", $1 * 100}'
   fi
 }
 
-status() {
+do_vol() {
-  echo $(jq -cnr --argjson pid "$PID" --argjson stations "$STATIONS" --argjson radio_id "$RADIO_ID" --argjson is_paused "$PAUSED" --argjson info "$INFO" '{"is_paused": $is_paused, "song": $info, "radio": $radio_id, "stations": $stations}')
+  local vol="${1%.*}"
+  if [ "$PID" -gt 0 ] && kill -0 "$PID" 2>/dev/null; then
+    local node_id; node_id=$(get_mpv_node)
+    [ -n "$node_id" ] && wpctl set-volume "$node_id" "${vol}%"
+  else
+    playerctl volume "$(awk -v v="$vol" 'BEGIN{printf "%.2f", v/100}')" 2>/dev/null
+  fi
+  eww update radio-vol="$vol"
 }
 
+do_mute() {
+  local node_id
+  if [ "$PID" -gt 0 ] && kill -0 "$PID" 2>/dev/null; then
+    node_id=$(get_mpv_node)
+  else
+    local player; player=$(playerctl -l 2>/dev/null | grep -Ev '^mpv' | head -1)
+    [ -n "$player" ] && node_id=$(get_stream_node "${player%%.*}")
+  fi
+  [ -z "$node_id" ] && return
+  wpctl set-mute "$node_id" toggle
+  if wpctl get-volume "$node_id" 2>/dev/null | grep -q MUTED; then
+    eww update radio-muted=true
+  else
+    eww update radio-muted=false
+  fi
+}
+
+do_start() {
+  [ "$RADIO_ID" -le 0 ] && return
+  STATIONS=$(get_stations)
+  RADIO_URL=$(get_stream_url)
+  [ -z "$RADIO_URL" ] || [ "$RADIO_URL" = "null" ] && return
+  [ "$PID" -gt 0 ] && kill "$PID" 2>/dev/null
+  nohup mpv --no-video --quiet "$RADIO_URL" >/dev/null 2>&1 &
+  echo $! > "$MPV_PID_FILE"
+  echo "$RADIO_ID" > "$RADIO_ID_FILE"
+}
 
 status_loop() {
-  STATUS=$(status)
+  STATIONS=$(get_stations)
-  echo $STATUS
+  echo "$(emit_status)"
-  STATIONS=$(curl -s "$URL_BASE/stations/" | jq --argjson ids '[507,522,523,536,537,42532,42602]' '.result.stations | map(select(.id | IN($ids[]))) | map({id, title, stream_hls, icon_fill_white})')
+
-  last_time_info=0
+  last_pid_check=0
-  last_time=0
+  last_song_fetch=0
+  last_media_fetch=0
+
   while true; do
-    current_time=$(get_time_ms)
+    now=$(date -u +%s%3N)
-    delta=$((current_time - last_time))
+
-    delta_i=$((current_time - last_time_info))
+    if (( now - last_pid_check > 1000 )); then
-    if [[ $delta -gt 1000 ]]; then
+      update_state
-      PID=$( [ -e "$MPV_PID_FILE" ] && cat "$MPV_PID_FILE" || echo 0 )
+      NEW_STATUS=$(emit_status)
-      RADIO_ID=$( [ -e "$RADIO_ID_FILE" ] && cat "$RADIO_ID_FILE" || echo 0 )
+      if [ "$NEW_STATUS" != "$STATUS" ]; then STATUS=$NEW_STATUS; echo "$STATUS"; fi
-      PAUSED=$(( $PID == 0 && $RADIO_ID > 0 ? 1 : 0 ))
+      last_pid_check=$now
-      NEW_STATUS=$(status)
-      if [[ "$NEW_STATUS" != "$STATUS" ]]; then
-        STATUS=$NEW_STATUS
-        echo $STATUS
-      fi
-      last_time=$current_time
     fi
-    if [[ $delta_i -gt 15000 ]]; then
+
-      if [ "$PAUSED" = 1 ]; then
+    if (( now - last_song_fetch > 15000 )); then
-        INFO="{\"id\":null,\"artist\":null,\"song\":null,\"image600\": \"$(get_radio | jq -r '.icon_fill_white')\"}"
+      if [ "$PAUSED" = 0 ]; then
+        IS_RR=$(echo "$STATIONS" | jq --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].radiorecord // true')
+        if [ "$IS_RR" = "true" ]; then
+          FETCHED=$(get_song)
+          INFO=$(echo "$INFO" "$FETCHED" | jq -s '
+            reduce .[] as $x ({}; . + ($x | with_entries(select(.value != null))))')
+        else
+          STATION_TITLE=$(echo "$STATIONS" | jq -r --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].title // ""')
+          INFO=$(jq -cnr --arg title "$STATION_TITLE" '{artist:"",song:$title,image600:""}')
+        fi
       else
-        INFO=$(echo "$INFO" "$(get_song)" | jq -s ' reduce .[] as $item ( {}; . + (
+        STATION_IMG=$(echo "$STATIONS" \
-            reduce ($item | to_entries[]) as $entry ( {}; if $entry.value != null then .[$entry.key] = $entry.value else . end
+          | jq -r --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].icon_fill_white // ""')
-          )) )')
+        STATION_TITLE=$(echo "$STATIONS" \
+          | jq -r --argjson id "$RADIO_ID" 'map(select(.id == $id))[0].title // ""')
+        INFO=$(jq -cnr --arg img "$STATION_IMG" --arg title "$STATION_TITLE" \
+          '{artist:"",song:$title,image600:$img}')
       fi
-      last_time_info=$current_time
+      NEW_STATUS=$(emit_status)
+      if [ "$NEW_STATUS" != "$STATUS" ]; then STATUS=$NEW_STATUS; echo "$STATUS"; fi
+      last_song_fetch=$now
     fi
+
+    if (( now - last_media_fetch > 3000 )); then
+      MEDIA=$(get_player_info)
+      NEW_STATUS=$(emit_status)
+      if [ "$NEW_STATUS" != "$STATUS" ]; then STATUS=$NEW_STATUS; echo "$STATUS"; fi
+      VOL=$(get_volume)
+      [ -n "$VOL" ] && eww update radio-vol="$VOL" 2>/dev/null
+      last_media_fetch=$now
+    fi
+
+    sleep 0.5
   done
 }
 
-# Main script
 case "$1" in
-  "start")
+  start)
-    RADIO_ID=$2
+    RADIO_ID="$2"
-    start
+    echo "$RADIO_ID" > "$RADIO_ID_FILE"
+    do_start
     ;;
-  "toggle")
+  vol)
-    toggle
+    do_vol "$2"
+    ;;
+  mute)
+    update_state
+    do_mute
+    ;;
+  toggle)
+    update_state
+    if [ "$PAUSED" = 1 ]; then
+      [ "$RADIO_ID" -gt 0 ] && do_start
+    else
+      [ "$PID" -gt 0 ] && kill "$PID" 2>/dev/null
+      rm -f "$MPV_PID_FILE"
+    fi
     ;;
   *)
     status_loop

modules/home/wayland/apps/eww/bar/scripts/screenshot

@@ -0,0 +1,5 @@
+#!/usr/bin/env bash
+DIR="$HOME/Pictures/Screenshots"
+mkdir -p "$DIR"
+FILE="$DIR/$(date +%Y-%m-%d_%H-%M-%S).png"
+grim -g "$(slurp)" "$FILE" && wl-copy < "$FILE"

modules/home/wayland/apps/eww/bar/scripts/sys/cpu

@@ -1 +0,0 @@
-#!/usr/bin/env zsh

modules/home/wayland/apps/eww/bar/scripts/sys/cpugrid

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+COLS=4
+declare -A prev_idle prev_total
+
+emit_grid() {
+  local rows=() row_items=()
+  while IFS= read -r line; do
+    [[ $line =~ ^cpu([0-9]+) ]] || continue
+    local core="${BASH_REMATCH[1]}"
+    read -ra f <<< "$line"
+    local idle=$(( f[4] + f[5] ))
+    local total=0
+    for x in "${f[@]:1}"; do (( total += x )); done
+
+    local usage="0.0"
+    if [[ -n "${prev_total[$core]+x}" ]]; then
+      local dt=$(( total - prev_total[$core] ))
+      local di=$(( idle  - prev_idle[$core]  ))
+      (( dt > 0 )) && usage=$(awk "BEGIN{printf \"%.1f\", 100*(1-$di/$dt)}")
+    fi
+    prev_idle[$core]=$idle
+    prev_total[$core]=$total
+
+    local freq=0
+    local fpath="/sys/devices/system/cpu/cpu${core}/cpufreq/scaling_cur_freq"
+    [[ -r $fpath ]] && freq=$(( $(< "$fpath") / 1000 ))
+
+    row_items+=("{\"core\":$core,\"usage\":$usage,\"freq\":$freq}")
+
+    if (( ${#row_items[@]} == COLS )); then
+      local row; printf -v row '%s,' "${row_items[@]}"; row="${row%,}"
+      rows+=("[$row]")
+      row_items=()
+    fi
+  done < /proc/stat
+
+  if (( ${#row_items[@]} > 0 )); then
+    local row; printf -v row '%s,' "${row_items[@]}"; row="${row%,}"
+    rows+=("[$row]")
+  fi
+
+  local out; printf -v out '%s,' "${rows[@]}"; out="${out%,}"
+  echo "[$out]"
+}
+
+while true; do
+  emit_grid
+  sleep 2
+done

modules/home/wayland/apps/eww/bar/scripts/sys/cputemp

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+dir=$(grep -rl k10temp /sys/class/hwmon/*/name 2>/dev/null | head -1 | xargs dirname)
+awk '{printf "%.0f\n", $1/1000}' "$dir/temp1_input"

modules/home/wayland/apps/eww/bar/scripts/sys/gpu

@@ -1,3 +1,22 @@
-#!/usr/bin/env zsh
+#!/usr/bin/env bash
-
+amdgpu_top -J -s 5000 | jq -c --unbuffered '.devices[0] | {
-amdgpu_top -J -s 5000 | sed 's/ //g' 
+  gfx_pct:   (.gpu_activity.GFX.value // 0),
+  mem_pct:   (.gpu_activity.Memory.value // 0),
+  media_pct: (.gpu_activity.MediaEngine.value // 0),
+  sclk:      (.Sensors.GFX_SCLK.value // 0),
+  mclk:      (.Sensors.GFX_MCLK.value // 0),
+  sclk_pct:  (if (.Info["GPU Clock"].max != .Info["GPU Clock"].min) then
+                100 * ((.Sensors.GFX_SCLK.value // 0) - .Info["GPU Clock"].min) / (.Info["GPU Clock"].max - .Info["GPU Clock"].min)
+              else 0 end),
+  mclk_pct:  (if (.Info["Memory Clock"].max != .Info["Memory Clock"].min) then
+                100 * ((.Sensors.GFX_MCLK.value // 0) - .Info["Memory Clock"].min) / (.Info["Memory Clock"].max - .Info["Memory Clock"].min)
+              else 0 end),
+  vclk:      (.gpu_metrics.average_vclk_frequency // 0),
+  vclk_pct:  (if (.Info["GPU Clock"].max > 0) then
+                100 * (.gpu_metrics.average_vclk_frequency // 0) / .Info["GPU Clock"].max
+              else 0 end),
+  temp:       (.Sensors["Edge Temperature"].value // 0),
+  power:      (.Sensors["Average Power"].value // 0),
+  vram_used:  (.VRAM["Total VRAM Usage"].value // 0),
+  vram_total: (.VRAM["Total VRAM"].value // 1)
+}'

modules/home/wayland/apps/eww/bar/scripts/sys/memory

@@ -8,5 +8,6 @@ human() {
 
 free --si -s 3 | rg --line-buffered Mem | while read -r line; do
   used=$(echo "$line" | awk '{print $3}')
-  echo '{"human": { "total": "'$(human "$total")'", "used": "'$(human "$used")'"}, "total": "'$total'" , "used": "'$used'"}'
+  cached=$(echo "$line" | awk '{print $6}')
-done
+  echo '{"human": {"total": "'$(human "$total")'", "used": "'$(human "$used")'", "cached": "'$(human "$cached")'"}, "total": "'$total'", "used": "'$used'", "cached": "'$cached'"}'
+done

modules/home/wayland/apps/eww/bar/scripts/sys/swap

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+free --si | awk '/Swap/ {
+  used=$3; total=$2
+  u = sprintf("%.1fG", used/1000000)
+  t = sprintf("%.1fG", total/1000000)
+  printf "{\"used\":%d,\"total\":%d,\"human\":{\"used\":\"%s\",\"total\":\"%s\"}}\n", used, total, u, t
+}'

modules/home/wayland/apps/eww/bar/scripts/volume

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+volicons=("󰕿" "󰖀" "󰕾")
+
+vol()     { wpctl get-volume @DEFAULT_AUDIO_"$1"@ | awk '{print int($2*100)}'; }
+ismuted() { wpctl get-volume @DEFAULT_AUDIO_"$1"@ | rg -qi muted; echo -n $?; }
+setvol()  { wpctl set-volume @DEFAULT_AUDIO_"$1"@ "$(awk -v n="$2" 'BEGIN{print n/100}')"; }
+setmute() { wpctl set-mute @DEFAULT_AUDIO_"$1"@ toggle; }
+
+gen_output() {
+  percent=$(vol "SINK")
+  lvl=$(awk -v n="$percent" 'BEGIN{print int(n/34)}')
+  sink_muted=$(ismuted "SINK")
+  source_muted=$(ismuted "SOURCE")
+  sink=$(wpctl inspect @DEFAULT_AUDIO_SINK@ 2>/dev/null | grep -m1 'node\.nick' | sed 's/.*= "\(.*\)"/\1/')
+
+  [ "$sink_muted"   = 0 ] && icon="󰝟"   || icon="${volicons[$lvl]}"
+  [ "$source_muted" = 0 ] && mic_icon="󰍭" || mic_icon="󰍬"
+
+  printf '{"icon":"%s","percent":%s,"sink_muted":%s,"mic_icon":"%s","microphone":%s,"source_muted":%s,"sink":"%s"}\n' \
+    "$icon" "$percent" "$([ "$sink_muted" = 0 ] && echo true || echo false)" \
+    "$mic_icon" "$(vol SOURCE)" "$([ "$source_muted" = 0 ] && echo true || echo false)" "$sink"
+}
+
+case "$1" in
+  mute)   setmute "$2" ;;
+  setvol) setvol  "$2" "$3" ;;
+  *)
+    gen_output
+
+    tmp=$(mktemp -d)
+    pipe="$tmp/vol-events"
+    mkfifo "$pipe"
+    trap 'rm -rf "$tmp"; kill 0 2>/dev/null' EXIT INT TERM
+
+    # 1s polling fallback
+    (while true; do sleep 1; echo poll; done) > "$pipe" &
+    # PipeWire property-change events (fires on mute/volume change)
+    (pw-cli -m 2>/dev/null | grep --line-buffered "changed") > "$pipe" &
+
+    while IFS= read -r _ < "$pipe"; do
+      gen_output
+    done
+    ;;
+esac

modules/home/wayland/apps/eww/bar/scripts/wallpaper

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+nohup bash "$HOME/.config/script/wallpaper.sh" >/dev/null 2>&1 &

modules/home/wayland/apps/eww/bar/scripts/weather

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+
+FALLBACK='{"temp":0,"feelslike":0,"humidity":0,"wind":0,"desc":"Unavailable","icon":"󰖐","city":""}'
+CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/eww"
+LOC_CACHE="$CACHE_DIR/weather-location"
+UA="eww-bar/1.0 cedric.hoelzl@gmail.com"
+
+mkdir -p "$CACHE_DIR"
+
+get_location() {
+  # Cache location for 1 hour; IP rarely changes
+  if [ -f "$LOC_CACHE" ] && [ -n "$(find "$LOC_CACHE" -mmin -60 2>/dev/null)" ]; then
+    cat "$LOC_CACHE"
+    return 0
+  fi
+  data=$(curl -sf --max-time 5 "http://ip-api.com/json?fields=lat,lon,city") || return 1
+  echo "$data" | tee "$LOC_CACHE"
+}
+
+icon_for() {
+  case "$1" in
+    *thunder*)                     echo "󰖔" ;;
+    *snow*|*sleet*)                echo "󰖘" ;;
+    heavyrain*|*heavyrainshowers*) echo "󰖖" ;;
+    *rain*|*shower*)               echo "󰖗" ;;
+    fog*)                          echo "󰖑" ;;
+    cloudy*)                       echo "󰖐" ;;
+    partlycloudy*)                 echo "󰖕" ;;
+    fair*|clearsky*)               echo "󰖙" ;;
+    *)                             echo "󰖐" ;;
+  esac
+}
+
+desc_for() {
+  case "$(echo "$1" | sed 's/_day//;s/_night//;s/_polartwilight//')" in
+    clearsky)                      echo "Clear sky" ;;
+    fair)                          echo "Fair" ;;
+    partlycloudy)                  echo "Partly cloudy" ;;
+    cloudy)                        echo "Cloudy" ;;
+    fog)                           echo "Foggy" ;;
+    lightrain)                     echo "Light rain" ;;
+    rain)                          echo "Rain" ;;
+    heavyrain)                     echo "Heavy rain" ;;
+    lightrainshowers)              echo "Light showers" ;;
+    rainshowers)                   echo "Rain showers" ;;
+    heavyrainshowers)              echo "Heavy showers" ;;
+    lightrainandthunder)           echo "Light rain & thunder" ;;
+    rainandthunder)                echo "Rain & thunder" ;;
+    heavyrainandthunder)           echo "Heavy rain & thunder" ;;
+    *showersandthunder)            echo "Showers & thunder" ;;
+    lightsleet|lightsleetshowers)  echo "Light sleet" ;;
+    sleet|sleetshowers)            echo "Sleet" ;;
+    heavysleet|heavysleetshowers)  echo "Heavy sleet" ;;
+    *sleetandthunder)              echo "Sleet & thunder" ;;
+    lightsnow|lightsnowshowers)    echo "Light snow" ;;
+    snow|snowshowers)              echo "Snow" ;;
+    heavysnow|heavysnowshowers)    echo "Heavy snow" ;;
+    *snowandthunder)               echo "Snow & thunder" ;;
+    *)                             echo "$1" ;;
+  esac
+}
+
+fetch() {
+  loc=$(get_location) || { echo "$FALLBACK"; return; }
+  lat=$(echo "$loc" | jq -r '.lat')
+  lon=$(echo "$loc" | jq -r '.lon')
+  city=$(echo "$loc" | jq -r '.city')
+
+  data=$(curl -sf --max-time 8 \
+    -H "User-Agent: $UA" \
+    -H "Accept: application/json" \
+    "https://api.met.no/weatherapi/locationforecast/2.0/compact?lat=$lat&lon=$lon") \
+    || { echo "$FALLBACK"; return; }
+
+  d='.properties.timeseries[0].data'
+  temp=$(    echo "$data" | jq -r "${d}.instant.details.air_temperature | round")
+  humidity=$(echo "$data" | jq -r "${d}.instant.details.relative_humidity | round")
+  wind_ms=$( echo "$data" | jq -r "${d}.instant.details.wind_speed")
+  wind=$(    echo "$wind_ms" | awk '{printf "%d", $1 * 3.6}')
+  code=$(    echo "$data" | jq -r \
+    "(${d}.next_1_hours.summary.symbol_code) // (${d}.next_6_hours.summary.symbol_code) // \"cloudy\"")
+
+  # Simplified apparent temperature: wind chill below 10°C, else = temp
+  feelslike=$(echo "$temp $wind" | awk '{
+    t=$1; v=$2
+    if (v > 4.8 && t < 10)
+      printf "%d", 13.12 + 0.6215*t - 11.37*(v^0.16) + 0.3965*t*(v^0.16)
+    else
+      printf "%d", t
+  }')
+
+  icon=$(icon_for "$code")
+  desc=$(desc_for "$code")
+
+  printf '{"temp":%s,"feelslike":%s,"humidity":%s,"wind":%s,"desc":"%s","icon":"%s","city":"%s"}\n' \
+    "$temp" "$feelslike" "$humidity" "$wind" "$desc" "$icon" "$city"
+}
+
+fetch
+while true; do sleep 600; fetch; done

modules/home/wayland/apps/eww/bar/windows/calendar.yuck

@@ -1,9 +0,0 @@
-(defwindow calendar
-  :monitor 1
-  :geometry (geometry
-    :x "0%"
-    :y "0%"
-  	:anchor "bottom right"
-    :width "0px"
-    :height "0px")
-  (window (calendar)))

modules/home/wayland/apps/eww/bar/windows/clock.yuck

@@ -0,0 +1,126 @@
+
+(deflisten weather
+  :initial '{"temp":0,"feelslike":0,"humidity":0,"wind":0,"desc":"","icon":"󰖐","city":""}'
+  "scripts/weather")
+
+(deflisten volume
+  :initial '{"icon":"󰕾","percent":50,"sink_muted":false,"mic_icon":"󰍬","microphone":50,"source_muted":false,"sink":""}'
+  "scripts/volume")
+
+(deflisten brightness
+  :initial '{"percent":0,"available":false}'
+  "scripts/brightness")
+
+; --- Weather ---
+
+(defwidget weather-section []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    (section-header
+      :title {weather.city != "" ? "Weather · ${weather.city}" : "Weather"}
+      :accent "weather-accent")
+    (box :orientation "h" :space-evenly false :halign "center" :class "weather-main"
+      (label :class "weather-icon" :valign "center" :text {weather.icon})
+      (box :orientation "v" :space-evenly false :valign "center"
+        (label :class "weather-temp" :text "${weather.temp}°C")
+        (label :class "weather-desc" :text {weather.desc})))
+    (box :orientation "h" :space-evenly true :class "weather-stats"
+      (box :orientation "v" :space-evenly false :halign "center"
+        (label :class "gpu-stat-value" :text "${weather.feelslike}°C")
+        (label :class "gpu-stat-label" :text "feels like"))
+      (box :orientation "v" :space-evenly false :halign "center"
+        (label :class "gpu-stat-value" :text "${weather.humidity}%")
+        (label :class "gpu-stat-label" :text "humidity"))
+      (box :orientation "v" :space-evenly false :halign "center"
+        (label :class "gpu-stat-value" :text "${weather.wind} km/h")
+        (label :class "gpu-stat-label" :text "wind")))))
+
+; --- Volume ---
+
+(defwidget vol-row [icon value onchange onclick muted]
+  (box :orientation "h" :space-evenly false :valign "center" :class "ctrl-row"
+    (button
+      :class "ctrl-icon ${muted ? 'ctrl-muted' : ''}"
+      :onclick onclick
+      (label :text icon))
+    (scale
+      :min 0 :max 100 :value value
+      :hexpand true
+      :class "ctrl-slider ${muted ? 'ctrl-slider-muted' : ''}"
+      :onchange {muted ? "true" : onchange})
+    (label :class "ctrl-value ${muted ? 'ctrl-muted' : ''}" :halign "end" :text "${value}%")))
+
+(defwidget volume-section []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    (section-header
+      :title {volume.sink != "" ? "Volume · ${volume.sink}" : "Volume"}
+      :accent "vol-accent")
+    (vol-row
+      :icon    {volume.icon}
+      :value   {volume.percent}
+      :muted   {volume.sink_muted}
+      :onchange "scripts/volume setvol SINK {}"
+      :onclick  "scripts/volume mute SINK")
+    (vol-row
+      :icon    {volume.mic_icon}
+      :value   {volume.microphone}
+      :muted   {volume.source_muted}
+      :onchange "scripts/volume setvol SOURCE {}"
+      :onclick  "scripts/volume mute SOURCE")))
+
+; --- Quick Actions ---
+
+(defvar power-save  false)
+(defvar night-light false)
+
+(defwidget quick-btn [icon label onclick active]
+  (button :class "quick-btn ${active ? 'quick-btn-active' : ''}"
+    :onclick onclick
+    (box :orientation "v" :space-evenly false :halign "center" :valign "center"
+      (label :class "quick-icon" :text icon)
+      (label :class "quick-label" :text label))))
+
+(defwidget quick-section []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    (section-header :title "Quick Actions" :accent "quick-accent")
+    (box :orientation "v" :space-evenly false :class "quick-grid" :spacing 4
+      (box :orientation "h" :space-evenly true
+        (quick-btn :icon "󰸉" :label "Wallpaper" :onclick "scripts/wallpaper" :active false)
+        (quick-btn :icon "󱐋" :label "Power Save" :onclick "eww update power-save=$(scripts/power-save)" :active {power-save})
+        (quick-btn :icon "󰌵" :label "Night Light" :onclick "eww update night-light=$(scripts/nightlight)" :active {night-light}))
+      (box :orientation "h" :space-evenly true
+        (quick-btn :icon "󰹑" :label "Screenshot" :onclick "scripts/screenshot" :active false)
+        (quick-btn :icon "󰌾" :label "Lock" :onclick "swaylock" :active false)
+        (quick-btn :icon "󱉨" :label "Color Pick" :onclick "hyprpicker -a" :active false)))))
+
+; --- Brightness ---
+
+(defwidget brightness-section []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    :visible {brightness.available}
+    (section-header :title "Brightness" :accent "bri-accent")
+    (box :orientation "h" :space-evenly false :valign "center" :class "ctrl-row"
+      (label :class "ctrl-icon" :text "󰃠")
+      (scale
+        :min 1 :max 100 :value {brightness.percent}
+        :hexpand true
+        :class "ctrl-slider"
+        :onchange "scripts/brightness set {}")
+      (label :class "ctrl-value" :halign "end" :text "${brightness.percent}%"))))
+
+; --- Root ---
+
+(defwidget clock-win []
+  (box :class "sys-win" :orientation "v" :space-evenly false
+    (volume-section)
+    (brightness-section)
+    (box :class "section-sep")
+    (quick-section)
+    (box :class "section-sep")
+    (weather-section)
+    (box :class "section-sep")
+    (box :orientation "v" :space-evenly false :class "sys-section cal-box"
+      (section-header :title "Calendar" :accent "cal-accent")
+      (calendar :show-week-numbers false))
+    ))
+
+

modules/home/wayland/apps/eww/bar/windows/net.yuck

@@ -0,0 +1,105 @@
+
+(deflisten netinfo
+  :initial '{"wifi":{"ssid":"","ip":"","freq":0,"band":"","gen":"","signal":0},"ethernet":{"state":"down","ip":"","speed":"","interface":""},"usb":{"interface":"","ip":""}}'
+  "scripts/net/netinfo")
+
+(deflisten bt-devices
+  :initial "[]"
+  "scripts/net/bt-devices")
+
+; --- Shared widgets ---
+
+(defwidget netinfo-row [label value]
+  (box :orientation "h" :space-evenly false :class "netinfo-row"
+    (label :class "netinfo-label" :halign "start" :text label)
+    (label :class "netinfo-value" :halign "end" :hexpand true :text value)))
+
+(defwidget section-header-toggle [title accent enabled onclick icon-on icon-off]
+  (box :orientation "h" :space-evenly false :valign "center" :class "sys-section-header"
+    (box :class "section-accent ${accent}")
+    (label :class "sys-label" :text title :hexpand true :halign "start")
+    (button
+      :class "net-toggle-btn ${enabled ? 'net-toggle-on' : 'net-toggle-off'}"
+      :onclick onclick
+      (label :text {enabled ? icon-on : icon-off}))))
+
+; --- WiFi ---
+
+(defwidget wifi-net-section []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    (section-header-toggle
+      :title "WiFi" :accent "wifi-accent"
+      :enabled {net.wifi.enabled}
+      :onclick {net.wifi.enabled ? "rfkill block wlan" : "rfkill unblock wlan"}
+      :icon-on "󰤨" :icon-off "󰖪")
+    (box :orientation "v" :space-evenly false
+      :visible {net.wifi.connected}
+      (netinfo-row :label "SSID"   :value {netinfo.wifi.ssid})
+      (netinfo-row :label "IP"     :value {netinfo.wifi.ip})
+      (netinfo-row :label "Signal" :value "${net.wifi.icon}  ${netinfo.wifi.signal} dBm")
+      (netinfo-row :label "Freq"   :value "${netinfo.wifi.freq} MHz · ${netinfo.wifi.band} · ${netinfo.wifi.gen}"))
+    (label :class "netinfo-dim" :halign "start"
+      :visible {!net.wifi.connected}
+      :text {net.wifi.enabled ? "Not connected" : "Disabled"})))
+
+; --- USB ---
+
+(defwidget usb-net-section []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    (section-header :title "USB" :accent "usb-accent")
+    (netinfo-row :label "Interface" :value {netinfo.usb.interface})
+    (netinfo-row :label "IP"        :value {netinfo.usb.ip})))
+
+; --- Ethernet ---
+
+(defwidget ethernet-net-section []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    (section-header :title "Ethernet" :accent "eth-accent")
+    (box :orientation "v" :space-evenly false
+      :visible {net.ethernet.connected}
+      (netinfo-row :label "Interface" :value {netinfo.ethernet.interface})
+      (netinfo-row :label "IP"        :value {netinfo.ethernet.ip})
+      (netinfo-row :label "Speed"     :value {netinfo.ethernet.speed}))
+    (label :class "netinfo-dim" :halign "start"
+      :visible {!net.ethernet.connected}
+      :text "No carrier")))
+
+; --- Bluetooth ---
+
+(defwidget bt-device-row [device]
+  (box :orientation "h" :space-evenly false :class "bt-device-row" :valign "center"
+    (label :class "bt-device-name" :hexpand true :halign "start" :text {device.name})
+    (button
+      :class "bt-device-btn ${device.connected ? 'bt-btn-on' : 'bt-btn-off'}"
+      :onclick "scripts/net/bt-toggle ${device.mac}"
+      :tooltip {device.connected ? "Disconnect" : "Connect"}
+      (label :text {device.connected ? "󰂱" : "󰂯"}))))
+
+(defwidget bluetooth-net-section []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    (section-header-toggle
+      :title "Bluetooth" :accent "blt-accent"
+      :enabled {bluetooth.powered}
+      :onclick {bluetooth.powered ? "bluetoothctl power off" : "bluetoothctl power on"}
+      :icon-on "󰂯" :icon-off "󰂲")
+    (scroll :vscroll true :hscroll false :height 90
+      :visible {bluetooth.powered}
+      (box :orientation "v" :space-evenly false
+        (for device in {bt-devices}
+          (bt-device-row :device {device}))))
+    (label :class "netinfo-dim" :halign "start"
+      :visible {!bluetooth.powered}
+      :text "Disabled")))
+
+; --- Root ---
+
+(defwidget net-win []
+  (box :class "sys-win" :space-evenly false :orientation "v"
+    (box :visible {net.usb.connected} :space-evenly false :orientation "v"
+      (usb-net-section)
+      (box :class "section-sep"))
+    (ethernet-net-section)
+    (box :class "section-sep")
+    (wifi-net-section)
+    (box :class "section-sep")
+    (bluetooth-net-section)))

modules/home/wayland/apps/eww/bar/windows/popup.yuck

@@ -0,0 +1,20 @@
+
+(defwidget popup-win []
+  (box :space-evenly false :orientation "v"
+    (revealer :reveal {active-panel == "sys"} :transition "slidedown" :duration 120
+      (sys-win))
+    (revealer :reveal {active-panel == "net"} :transition "slidedown" :duration 120
+      (net-win))
+    (revealer :reveal {active-panel == "clock"} :transition "slidedown" :duration 120
+      (clock-win))
+    (revealer :reveal {active-panel == "radio"} :transition "slidedown" :duration 120
+      (radio-win))))
+
+(defwindow popup
+  :monitor 0
+  :stacking "overlay"
+  :geometry (geometry
+    :x "0%" :y "0%"
+    :anchor "bottom right"
+    :width "320px" :height "0px")
+  (window (popup-win)))

modules/home/wayland/apps/eww/bar/windows/powermenu.yuck

@@ -25,7 +25,7 @@
                                 
         (powermenu_entry    :label "Sign out" 
                             :icon "󰗼" 
-                            :onclick "hyprctl dispatch exit 0")
+                            :onclick "hyprctl eval \"hl.dispatch(hl.dsp.exit())\"")
 
         (powermenu_entry    :label "Cancel" 
                             :icon "󰅖" 
@@ -34,7 +34,7 @@
 )
 
 (defwindow powermenu
-    :monitor 1
+    :monitor 0
     :stacking "overlay"
     :geometry (geometry 
                     :anchor "center"
@@ -42,4 +42,4 @@
                     :height "120%")
     :namespace "eww-blur"
     (powermenu)
-)
+)

modules/home/wayland/apps/eww/bar/windows/radio.yuck

@@ -1,111 +1,82 @@
-(deflisten radio :initial '{"is_paused":1,"song":{"artist":"","song":"","image600":"https://www.radiorecord.ru/upload/stations_images/record_image600_white_fill.png"},"stations":[]}' "scripts/radio")
-(defvar radio_rev false)
 
-(defwindow radio
+(deflisten radio
-  :monitor 1
+  :initial '{"is_paused":1,"song":{"artist":"","song":"","image600":""},"radio":0,"stations":[],"media":{"player":"","status":"Stopped","artist":"","title":"","art":""}}'
-  :geometry (geometry
+  "scripts/radio")
-    :x "0%"
+(defvar radio-vol 80)
-    :y "0%"
+(defvar radio-muted false)
-  	:anchor "bottom right"
-    :width "0px"
-    :height "0px")
-  (window (radio-win)))
 
+(defwidget radio-win []
+  (box :class "sys-win" :orientation "v" :space-evenly false
 
-(defwidget radio-win [] 
+    ; --- Now Playing ---
-	(box 
+    (box :orientation "v" :space-evenly false :class "sys-section"
-      :space-evenly false
+      (section-header :title "Media" :accent "radio-accent")
-      :orientation "h" 
+      (box :orientation "h" :space-evenly false :valign "center" :spacing 10 :class "radio-now-playing"
-      (revealer
+        (box :class "radio-art"
-        :visible radio_rev
+          :style "background-image: url('${radio.is_paused == 0 ? radio.song.image600 : (radio.media.status != 'Stopped' ? radio.media.art : radio.song.image600)}'); background-size: cover; background-position: center;"
-        :reveal radio_rev
+          (label :class "radio-art-icon" :halign "center" :valign "center"
-        :transition "slideleft"
+            :visible {radio.is_paused == 0
-          (radio-selector))
+              ? radio.song.image600 == ""
-      (box
+              : (radio.media.status != "Stopped"
-      :space-evenly false
+                  ? radio.media.art == ""
-      :orientation "v" 
+                  : radio.song.image600 == "")}
+            :text "󰝚"))
+        (box :orientation "v" :space-evenly false :hexpand true :valign "center"
+          (label :class "radio-song" :halign "start" :wrap true :limit-width 20
+            :text {radio.is_paused == 0
+              ? (radio.song.song != "" ? radio.song.song : "Tuning in...")
+              : (radio.media.status != "Stopped"
+                ? (radio.media.title != "" ? radio.media.title : "Playing")
+                : (radio.song.song != "" ? radio.song.song : "Nothing playing"))})
+          (label :class "radio-artist" :halign "start" :wrap true :limit-width 22
+            :text {radio.is_paused == 0
+              ? radio.song.artist
+              : (radio.media.status != "Stopped"
+                ? (radio.media.artist != "" ? radio.media.artist : radio.media.player)
+                : "")})))
 
-		(box 
+      ; Controls - hidden only in placeholder state
-          :class "album_art" 
+      (box :visible {radio.is_paused == 0 || radio.radio > 0 || radio.media.status != "Stopped"}
-          :style "background-size:cover; background-image: url('${radio.song.image600?:'https://www.radiorecord.ru/upload/stations_images/record_image600_white_fill.png'}');")
+        :orientation "v" :space-evenly false :class "radio-controls"
-		(box 
+        (box :orientation "h" :space-evenly true :halign "center"
-          :space-evenly false
+          (button :visible {radio.is_paused == 1 && radio.media.status != "Stopped"}
-          :orientation "v"
+            :class "radio-ctrl-btn" :timeout "2s" :onclick "playerctl previous"
-			(label 
+            (label :text "󰒮"))
-              :halign "center" 
+          (button :class "radio-ctrl-btn" :timeout "2s"
-              :class "song" 
+            :onclick {radio.is_paused == 1 && radio.media.status != "Stopped" ? "playerctl play-pause" : "scripts/radio toggle"}
-              :wrap "true" 
+            (label :text {radio.is_paused == 0 ? "󰏥" : (radio.media.status == "Playing" ? "󰏥" : "󰐌")}))
-              :limit-width 18
+          (button :visible {radio.is_paused == 1 && radio.media.status != "Stopped"}
-              :text "${radio.song.song?:'...'}")
+            :class "radio-ctrl-btn" :timeout "2s" :onclick "playerctl next"
-			(label 
+            (label :text "󰒭")))
-              :halign "center" 
+        (vol-row
-              :class "artist" 
+          :icon "󰕾"
-              :wrap "true" 
+          :value {radio-vol}
-              :limit-width 22
+          :onchange "scripts/radio vol {}"
-              :text "${radio.song.artist?:'...'}")
+          :onclick "scripts/radio mute"
-			(box 
+          :muted {radio-muted})))
-              :space-evenly true
-              :orientation "h" 
-              :halign "center" 
-              :class "btn_bar"
 
-                (button
+    (box :class "section-sep")
-                :class "btn_left" 
-                :onclick "${EWW_CMD} update radio_rev=${!radio_rev}"
-                (box "󰷐"))
 
-				        (button 
+    ; --- Stations ---
-                :class "btn_play" 
+    (box :orientation "v" :space-evenly false :class "sys-section"
-                :timeout "2s"
+      (section-header :title "Radio Stations" :accent "radio-accent")
-                :onclick "scripts/radio toggle" 
+      (scroll :vscroll true :hscroll false :height 130
-                "${radio.is_paused==1 ? "󰐌" : "󰏥"}")
+        (box :class "station-list" :space-evenly false :orientation "v"
-
+          (for station in {radio.stations}
-                (button
-                :class "btn_right" 
-                :onclick ""
-                (box :visible false "󰔶"))
-            )
-		)
-      )
-    )
-)
-
-
-(defwidget radio-selector []
-  (scroll
-    :active true
-    :vscroll true
-    :hscroll false
-
-    (box
-        :class "station_list"
-        :space-evenly false
-        :orientation "v"
-
-        (for station in {radio.stations}
             (button
-                :class "station_art ${(radio.radio == station.id)?'station_sel':''}"
+              :class "station-row ${radio.radio == station.id ? 'station-row-active' : ''}"
-                :timeout "2s"
+              :timeout "2s"
-                :onclick "scripts/radio start ${station.id}"
+              :onclick "scripts/radio start ${station.id}"
-                :tooltip "${station.title}"
+              :tooltip {station.title}
-                :style "background-size:cover; background-image: url('${station.icon_fill_white}');"
+              (box :orientation "h" :space-evenly false :valign "center"
-            )
+                (box :class "station-icon"
-        )
+                  :style "background-image: url('${station.icon_fill_white}'); background-size: contain; background-position: center;")
-    )
+                (label :class "station-name" :text {station.title}
-  )
+                  :hexpand true :halign "start" :limit-width 16)))))))))
-)
 
 (defwidget radio-mod []
   (module
-    (box
+    (eventbox
-      :orientation "v"
+      :onclick "(sleep 0.1 && scripts/panel-toggle radio)"
-      (button
+      (box :orientation "v"
-        :onclick "(sleep 0.1 && ${EWW_CMD} open --toggle --no-daemonize radio)"
+        (label :show-truncated false :class "icon-text" :text "󰝚")))))
-        (label 
-          :show-truncated false
-          :class "icon-text" 
-          :text "󰝚")
-      )
-    )
-  )
-)

modules/home/wayland/apps/eww/bar/windows/sys.yuck

@@ -1,140 +1,211 @@
 
+(defpoll swap :interval "5s" "scripts/sys/swap")
+
+(defpoll cpu-freq-min :interval "60s"
+  "awk '{print $1/1000}' /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_min_freq")
+(defpoll cpu-freq-max :interval "60s"
+  "awk '{print $1/1000}' /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq")
+(defpoll cpu-temp :interval "2s"
+  "scripts/sys/cputemp")
+(defpoll cpu-freq-avg :interval "2s"
+  "awk '{sum+=$1; count++} END {printf \"%.1f\", sum/count/1000000}' /sys/devices/system/cpu/cpu*/cpufreq/scaling_cur_freq")
+
+(deflisten cpu-grid :initial '[[{"core":0,"usage":0,"freq":0}]]'
+  "bash scripts/sys/cpugrid")
+
+; --- Shared ---
+
+(defwidget section-header [title accent]
+  (box :orientation "h" :space-evenly false :valign "center" :class "sys-section-header"
+    (box :class "section-accent ${accent}")
+    (label :class "sys-label" :text title)))
+
+; --- CPU ---
+
+(defwidget cpu-core-cell [core]
+  (overlay
+    (circular-progress
+      :width 60 :height 60
+      :value {core.usage}
+      :start-at 0
+      :clockwise true
+      :thickness 7
+      :class "cpu-usage-ring")
+    (circular-progress
+      :value {100 * (core.freq - cpu-freq-min) / (cpu-freq-max - cpu-freq-min)}
+      :start-at 0
+      :clockwise true
+      :thickness 4
+      :class "cpu-freq-ring")
+    (box :halign "center" :valign "center"
+      (label :class "cpu-core-label" :text "${core.core}"))
+  )
+)
+
 (defwidget cpu-sys-win []
-  (box
+  (box :orientation "v" :space-evenly false :class "sys-section"
-    :orientation "v"
+    (section-header :title "CPU" :accent "cpu-accent")
-    :space-evenly false
+    (box :orientation "v" :space-evenly false :halign "center"
-    (box :class "sys-label" "CPU")
+      (for row in {cpu-grid}
-    (box
+        (box :orientation "h" :space-evenly false
-      :orientation "v"
+          (for core in {row}
-      (for core in {EWW_CPU.cores}
+            (cpu-core-cell :core {core})))))
-        (box
+    (box :orientation "h" :space-evenly true :class "gpu-stats-row"
-          :space-evenly false
+      (box :orientation "v" :halign "center" :space-evenly false
-          :class "cpu-core ${core.core}"
+        (label :class "gpu-stat-value" :text "${cpu-temp}°C")
-          (progress
+        (label :class "gpu-stat-label" :text "temp"))
-            :value {core.usage}
+      (box :orientation "v" :halign "center" :space-evenly false
-            :orientation "h"
+        (label :class "gpu-stat-value" :text "${cpu-freq-avg}GHz")
-            :flipped true
+        (label :class "gpu-stat-label" :text "avg clk"))
-            :class "cpu-core-usage"
+      (box :orientation "v" :halign "center" :space-evenly false
-            :tooltip "${core.core} @ ${core.freq}Mhz"
+        (label :class "gpu-stat-value" :text "${round(EWW_CPU.avg, 0)}%")
-          )
+        (label :class "gpu-stat-label" :text "usage")))
-        )
-      )
-    )
   )
 )
 
+; --- GPU ---
+
 (defwidget gpu-sys-win []
-  (box
+  (box :orientation "v" :space-evenly false :class "sys-section"
-    :orientation "v"
+    (section-header :title "GPU" :accent "gpu-accent")
-    :space-evenly false
+    (box :orientation "h" :space-evenly true
-    (box :class "sys-label" "GPU")
+      ; GFX - outer: activity%, inner: clock% of range
-    (progress
+      (box :orientation "v" :space-evenly false :halign "center"
-      :value {gpu.devices[0].GRBM2?.CommandProcessor-Compute?.value?:0.0}
+        (overlay
-      :orientation "h"
+          (circular-progress :width 68 :height 68
-      :flipped true
+            :value {gpu.gfx_pct}
-      :class "gpu-core-usage"
+            :start-at 0 :clockwise true :thickness 7
-      :tooltip "Compute"
+            :class "gpu-ring"
-    )    
+            :tooltip "GFX  ${round(gpu.gfx_pct, 1)}%\nClock  ${gpu.sclk} MHz (${round(gpu.sclk_pct, 0)}% of range)")
-    (progress
+          (circular-progress
-      :value {gpu.devices[0].GRBM2?.CommandProcessor-Fetcher?.value?:0.0}
+            :value {gpu.sclk_pct}
-      :orientation "h"
+            :start-at 0 :clockwise true :thickness 4
-      :flipped true
+            :class "gpu-freq-ring")
-      :class "gpu-core-usage"
+          (box :halign "center" :valign "center"
-      :tooltip "Fetcher"
+            (label :class "gpu-ring-value" :text "${round(gpu.gfx_pct, 0)}%")))
-    )
+        (label :class "gpu-ring-label" :text "GFX" :halign "center"))
-    (progress
+      ; Memory - outer: activity%, inner: memory clock% of range
-      :value {gpu.devices[0].GRBM2?.CommandProcessor-Graphics?.value?:0.0}
+      (box :orientation "v" :space-evenly false :halign "center"
-      :orientation "h"
+        (overlay
-      :flipped true
+          (circular-progress :width 68 :height 68
-      :class "gpu-core-usage"
+            :value {gpu.mem_pct}
-      :tooltip "Graphics"
+            :start-at 0 :clockwise true :thickness 7
-    )
+            :class "gpu-ring"
-    (box :class "spacer")
+            :tooltip "Memory  ${round(gpu.mem_pct, 1)}%\nClock  ${gpu.mclk} MHz (${round(gpu.mclk_pct, 0)}% of range)")
-    (progress
+          (circular-progress
-      :value {gpu.devices[0]?.gpu_activity?.GFX?.value?:0.0}
+            :value {gpu.mclk_pct}
-      :orientation "h"
+            :start-at 0 :clockwise true :thickness 4
-      :flipped true
+            :class "gpu-freq-ring")
-      :class "gpu-core-usage"
+          (box :halign "center" :valign "center"
-      :tooltip "GFX"
+            (label :class "gpu-ring-value" :text "${round(gpu.mem_pct, 0)}%")))
-    )    
+        (label :class "gpu-ring-label" :text "Mem" :halign "center"))
-    (progress
+      ; Media - outer: activity%, inner: video clock% of GPU clock max
-      :value {gpu.devices[0]?.gpu_activity?.Memory?.value?:0.0}
+      (box :orientation "v" :space-evenly false :halign "center"
-      :orientation "h"
+        (overlay
-      :flipped true
+          (circular-progress :width 68 :height 68
-      :class "gpu-core-usage"
+            :value {gpu.media_pct}
-      :tooltip "Memory"
+            :start-at 0 :clockwise true :thickness 7
-    )
+            :class "gpu-ring"
-    (progress
+            :tooltip "Media Engine  ${round(gpu.media_pct, 1)}%\nVideo Clock  ${gpu.vclk} MHz")
-      :value {gpu.devices[0]?.gpu_activity?.MediaEngine?.value?:0.0}
+          (circular-progress
-      :orientation "h"
+            :value {gpu.vclk_pct}
-      :flipped true
+            :start-at 0 :clockwise true :thickness 4
-      :class "gpu-core-usage"
+            :class "gpu-freq-ring")
-      :tooltip "Media"
+          (box :halign "center" :valign "center"
-    )
+            (label :class "gpu-ring-value" :text "${round(gpu.media_pct, 0)}%")))
-    (box :class "spacer")
+        (label :class "gpu-ring-label" :text "Med" :halign "center")))
-    (progress
+    (box :orientation "v" :space-evenly false :class "vram-row"
-      :value {100*(gpu.devices[0]?.VRAM?.TotalVRAMUsage?.value?:0.0)/(gpu.devices[0]?.VRAM?.TotalVRAM?.value?:1.0)}
+      (progress
-      :orientation "h"
+        :value {100 * gpu.vram_used / gpu.vram_total}
-      :flipped true
+        :orientation "h" :flipped true :hexpand true
-      :class "gpu-core-usage"
+        :class "vram-bar"
-      :tooltip "VRAM"
+        :tooltip "VRAM  ${round(100 * gpu.vram_used / gpu.vram_total, 1)}%")
+      (box :orientation "h" :space-evenly false
+        (label :class "vram-usage-label" :halign "start" :hexpand true :text "VRAM")
+        (label :class "vram-usage-label" :halign "end"
+          :text "${round(gpu.vram_used / 1024, 1)} / ${round(gpu.vram_total / 1024, 1)} GiB")))
+    (box :orientation "h" :space-evenly true :class "gpu-stats-row"
+      (box :orientation "v" :halign "center" :space-evenly false
+        (label :class "gpu-stat-value" :text "${gpu.temp}°C")
+        (label :class "gpu-stat-label" :text "temp"))
+      (box :orientation "v" :halign "center" :space-evenly false
+        (label :class "gpu-stat-value" :text "${gpu.power}W")
+        (label :class "gpu-stat-label" :text "power")))
+  )
+)
+
+; --- RAM ---
+
+(defwidget ram-sys-win []
+  (box :orientation "v" :space-evenly false :class "sys-section"
+    (section-header :title "RAM" :accent "ram-accent")
+    (box :orientation "h" :space-evenly false :halign "center" :spacing 16 :valign "center"
+      (overlay
+        (circular-progress
+          :width 88 :height 88
+          :value {100*memory.used/memory.total}
+          :start-at 0
+          :clockwise true
+          :thickness 9
+          :class "ram-ring"
+          :tooltip "RAM\nUsed   ${memory.human.used} / ${memory.human.total}\nCached ${memory.human.cached}")
+        (circular-progress
+          :value {100*memory.cached/memory.total}
+          :start-at {100*memory.used/memory.total}
+          :clockwise true
+          :thickness 9
+          :class "ram-cached-ring")
+        (box :orientation "v" :valign "center" :halign "center" :space-evenly false
+          (label :class "ram-used-label" :text "${memory.human.used}")
+          (label :class "ram-total-label" :text "${memory.human.total}")))
+      (box :orientation "v" :space-evenly false :halign "center" :valign "center"
+        (overlay
+          (circular-progress
+            :width 72 :height 72
+            :value {100*swap.used/swap.total}
+            :start-at 0 :clockwise true :thickness 7
+            :class "swap-ring"
+            :tooltip "Swap\n${swap.human.used} / ${swap.human.total}")
+          (box :orientation "v" :valign "center" :halign "center" :space-evenly false
+            (label :class "ram-used-label" :text "${swap.human.used}")
+            (label :class "ram-total-label" :text "${swap.human.total}"))))
     )
   )
 )
 
-(defwidget ram-sys-win []
+; --- Battery ---
-  (box
+
-    :orientation "v"
+(defwidget bat-sys-win [] 
-    :space-evenly false
+  (box :orientation "v" :space-evenly false :class "sys-section" :visible {battery.visible}
-    (box :class "sys-label" "RAM")
+    (section-header :title "Battery" :accent "bat-accent")
-    (progress
+    (overlay
-      :value {100*memory.used/memory.total}
+      (circular-progress
-      :orientation "h"
+        :width 60 :height 60
-      :flipped true
+        :value {battery.percentage}
-      :class "memory-usage"
+        :start-at 0
-      :tooltip "RAM"
+        :clockwise true
-    )
+        :thickness 6
+        :class "bat-ring"
+        :style "color: ${battery.color};"
+        :tooltip "Battery  ${round(battery.percentage, 0)}%\n${battery.status} @ ${battery.wattage}")
+      (label :class "bat-ring-label"
+        :text "${round(battery.percentage, 0)}%"))
   )
 )
 
+; --- Root ---
+
 (defwidget sys-win []
   (box
     :class "sys-win"
     :space-evenly false
-    :orientation "h"
+    :orientation "v"
-    (box
+    (cpu-sys-win)
-      :space-evenly false
+    (box :class "section-sep")
-      :orientation "v"
+    (gpu-sys-win)
-      (cpu-sys-win)
+    (box :class "section-sep")
-      (box :class "spacer")
+    (ram-sys-win)
-      (box :class "spacer")
+    (box :class "section-sep" :visible {battery.visible})
-      (gpu-sys-win)
+    (bat-sys-win)
-      (box :class "spacer")
-      (box :class "spacer")
-      (ram-sys-win)
-    )
-    (box
-      :visible {battery.visible}
-      :height 200
-      (graph
-        :height 200
-        :value {battery.percentage}
-        :time-range "30min"
-        :min "0.0"
-        :max "100.0"
-        :dynamic true
-      )
-    )
   )
 )
-
-(defwindow sys
-  :monitor 1
-  :stacking "overlay"
-  :geometry (geometry
-    :x "0%"
-    :y "0%"
-  	:anchor "bottom right"
-    :width "0px"
-    :height "0px")
-  (window (sys-win)))

modules/home/wayland/apps/eww/default.nix

@@ -1,7 +1,21 @@
-{ lib, config, pkgs, ... }: {
+{ lib, config, pkgs, ... }:
+let
+  openOnCurrentScreen = pkgs.writeShellScriptBin "eww-open-on-current-screen" ''
+    window="$1"
+    shift
+
+    screen="$(hyprctl monitors -j | ${lib.getExe pkgs.jq} -r '.[] | select(.focused == true) | .name' | head -n1)"
+
+    if [ -n "$screen" ]; then
+      exec ${lib.getExe pkgs.eww} open "$window" --screen "$screen" "$@"
+    fi
+
+    exec ${lib.getExe pkgs.eww} open "$window" "$@"
+  '';
+in {
 
   config = lib.mkIf (config.usercfg.wm == "Wayland") {
-    home.packages = with pkgs; [ eww jq jaq custom.amdgpu_top ];
+    home.packages = with pkgs; [ eww jq jaq custom.amdgpu_top openOnCurrentScreen ];
 
     xdg.configFile."eww" = {
       source = lib.cleanSourceWith {
@@ -45,6 +59,9 @@
 
       $gaps-screen: ${config.colorScheme.palette.gaps-screen}px;
       $gaps-window: ${config.colorScheme.palette.gaps-window}px;
+
+      $panel-font-size: 10pt;
+      $popup-scale: 1.25;
     '';
   };
 }

modules/home/wayland/apps/waybar/default.nix

@@ -146,8 +146,8 @@ in {
             "9" = [ ];
             "10" = [ ];
           };
-          "on-scroll-up" = "hyprctl dispatch workspace r-1";
+          "on-scroll-up" = "hyprctl eval \"hl.dispatch(hl.dsp.focus({ workspace = '-1' }))\"";
-          "on-scroll-down" = "hyprctl dispatch workspace r+1";
+          "on-scroll-down" = "hyprctl eval \"hl.dispatch(hl.dsp.focus({ workspace = '+1' }))\"";
         };
 
         "backlight" = {
@@ -232,7 +232,7 @@ in {
         "custom/powermenu" = {
           "format" = "{icon}";
           "format-icons" = [ "󰐥" ];
-          "on-click" = "eww open powermenu";
+          "on-click" = "eww-open-on-current-screen powermenu";
           "tooltip" = false;
         };
         "tray" = {

modules/home/wayland/base/default.nix

@@ -34,7 +34,8 @@ in {
       glib
 
       brightnessctl
-      swww
+      awww
+      playerctl
     ];
 
     xdg.mimeApps = {

modules/home/wayland/hyprland/config.nix

@@ -1,231 +1,332 @@
-{ lib, config, pkgs, ... }: {
+{ lib, config, pkgs, ... }: let
-  config = lib.mkIf (config.usercfg.wm == "Wayland") {
+  lua = lib.generators.mkLuaInline;
 
+  bind = keys: dispatcher: { _args = [ keys dispatcher ]; };
+  bindOpts = keys: dispatcher: opts: { _args = [ keys dispatcher opts ]; };
+
+  dsp = {
+    exec = cmd: lua ''hl.dsp.exec_cmd("${cmd}")'';
+    close = lua "hl.dsp.window.close()";
+    exit = lua "hl.dsp.exit()";
+    float = lua ''hl.dsp.window.float({ action = "toggle" })'';
+    fullscreen = lua "hl.dsp.window.fullscreen()";
+    pseudo = lua "hl.dsp.window.pseudo()";
+    layout = msg: lua ''hl.dsp.layout("${msg}")'';
+    focus = dir: lua ''hl.dsp.focus({ direction = "${dir}" })'';
+    swap = dir: lua ''hl.dsp.window.swap({ direction = "${dir}" })'';
+    toggleSpecial = name: lua ''hl.dsp.workspace.toggle_special("${name}")'';
+    moveToSpecial = name: lua ''hl.dsp.window.move({ workspace = "special:${name}" })'';
+    focusWorkspace = ws: lua ''hl.dsp.focus({ workspace = "${toString ws}" })'';
+    moveToWorkspace = ws: lua ''hl.dsp.window.move({ workspace = "${toString ws}", follow = false})'';
+    drag = lua "hl.dsp.window.drag()";
+    resize = lua "hl.dsp.window.resize()";
+  };
+  
+
+  startupScript = pkgs.writeShellScriptBin "hyprland-start" ''
+    eww open bar &
+    awww-daemon &
+
+    sleep 2
+    keepassxc &
+    firefox &
+    jellyfin-mpv-shim &
+    easyeffects --gapplication-service &
+
+    sleep 2
+    nextcloud &
+    # telegram-desktop &
+    # discord &
+  '';
+in {
+  config = lib.mkIf (config.usercfg.wm == "Wayland") {
     wayland.windowManager.hyprland = {
       enable = true;
       xwayland.enable = true;
-      extraConfig = ''
+      configType = "lua";
-        monitor=,preferred,auto,auto
+      settings = {
-        env=bitdepth,10
+        on = {
-        input {
+          _args = [
-            kb_layout = us, ru
+            "hyprland.start"
-            kb_variant = intl, phonetic
+            (lua ''
-            kb_options = grp:ctrls_toggle
+              function()
+                hl.exec_cmd("dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP")
+                hl.exec_cmd("${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1")
+                hl.exec_cmd("wl-paste --type text --watch cliphist store")
+                hl.exec_cmd("wl-paste --type image --watch cliphist store")
+                hl.exec_cmd("swayidle -w timeout 600 'swaylock' before-sleep 'swaylock'")
+                hl.exec_cmd("${lib.getExe startupScript}")
+                hl.exec_cmd("[workspace special:magic silent] kitty --title flying_kitty")
+              end'')
+          ];
+        };
 
-            follow_mouse = 1
+        monitor = [{
+          output = "";
+          mode = "preferred";
+          position = "auto";
+          scale = "auto";
+          bitdepth = 10;
+        }];
+        #Fullscreen HDR is possible without the hdr cm setting if "render:cm_auto_hdr" is enabled.
 
-            sensitivity = 0
+        config = {
-                        
+          input = {
-            touchpad {
+            kb_layout = "us";
-                natural_scroll=no
+            kb_variant = "intl";#, phonetic";
-                disable_while_typing=true
+            kb_options = "grp:alt_shift_toggle";
-                scroll_factor=1
+            follow_mouse = 1;
-                disable_while_typing=0
+            sensitivity = 0;
-                tap-to-click=0
+
+            touchpad = {
+              natural_scroll = false;
+              scroll_factor = 1;
+              disable_while_typing = false;
+              tap_to_click = false;
+            };
+          };
+
+          misc = {
+            force_default_wallpaper = -1;
+            disable_hyprland_logo = true;
+            animate_mouse_windowdragging = false;
+            animate_manual_resizes = false;
+            vrr = 1;
+          };
+          general = {
+            gaps_in = config.colorScheme.palette.gaps-window;
+            gaps_out = config.colorScheme.palette.gaps-screen;
+            border_size = lib.toInt config.colorScheme.palette.border-width;
+            col = {
+              active_border = "rgb(${config.colorScheme.palette.base04})";
+              inactive_border = "rgb(${config.colorScheme.palette.base03})";
+            };
+            layout = "dwindle";
+          };
+
+          decoration = {
+            rounding = lib.toInt config.colorScheme.palette.border-radius;
+            inactive_opacity = 1.0;
+            active_opacity = 1.0;
+            fullscreen_opacity = 1.0;
+
+            blur = {
+              enabled = true;
+              size = 2;
+              passes = 1;
+              new_optimizations = true;
+            };
+          };
+
+          dwindle = {
+            #pseudotile = true;
+            preserve_split = true;
+          };
+          animations = {
+            enabled = true;
+          };
+
+          master = {
+            new_status = "master";
+          };
+        };
+
+        curve = [{
+          _args = [
+            "customcurve"
+            {
+              type = "bezier";
+              points = lua "{ {0.0, 0.9}, {0.1, 1.0} }";
             }
-        }
+          ];
-                        
+        }];
-        misc {
+
-            disable_hyprland_logo=true
+        animation = [
-            animate_mouse_windowdragging=false
+          { leaf = "windows"; enabled = true; speed = 4; bezier = "customcurve"; }
-            animate_manual_resizes=false
+          { leaf = "windowsOut"; enabled = true; speed = 4; bezier = "customcurve"; style = "popin 80%"; }
-                          
+          { leaf = "border"; enabled = true; speed = 10; bezier = "customcurve"; }
-            vrr=1
+          { leaf = "borderangle"; enabled = true; speed = 1; bezier = "customcurve"; }
-        }
+          { leaf = "fade"; enabled = true; speed = 4; bezier = "customcurve"; }
-                        
+          { leaf = "workspaces"; enabled = true; speed = 4; bezier = "customcurve"; }
-        general {
+        ];
-            gaps_in = ${config.colorScheme.palette.gaps-window}
+
-            gaps_out = ${config.colorScheme.palette.gaps-screen}
+
-            border_size = ${config.colorScheme.palette.border-width}
+        gesture = {
-                                      
+          fingers = 3;
-            col.active_border = rgb(${config.colorScheme.palette.base04})
+          direction = "vertical";
-            col.inactive_border = rgb(${config.colorScheme.palette.base03})
+          action = "workspace";
-                          
+        };
-            layout = dwindle
+
-        }
+        window_rule = [
-                        
+          { match.title = "noshadow"; float= false;}
-        decoration {
+          {
-            rounding = ${config.colorScheme.palette.border-radius}
+            match.title = "^(flying_kitty)$";
-                          
+            float = true;
-            blur {
+            center = true;
-                enabled = true
+            size = "1100 600";
-                size = 2
+            move = "{0 600}";
-                passes = 1
+            animation = "slide";
-                new_optimizations = true
+          }
+          { match.title = "^(Volume Control)$"; float = true; }
+          { match.title = "^(Picture-in-Picture)$"; float = true; }
+          { match.title = "^(Steam)$"; float = true; }
+          # --- Chat & Workspace Assignments ---
+            { match.class = "^(org.telegram.desktop)$"; workspace = "2 silent"; }
+            { match.class = "^(discord)$"; workspace = "2 silent"; }
+            { match.class = "^(org.keepassxc.KeePassXC)$"; workspace = "8 silent"; }
+            { match.title = "^(Nextcloud)$"; workspace = "8 silent"; }
+            { match.class = "^(org.telegram.desktop)$"; match.title = "^(Media viewer)$"; float = true; center = true; }
+            { 
+              match.class = "^(Tk)$"; 
+              match.title = "^(Server Configuration)$"; 
+              workspace = "8 silent"; 
             }
-            #multisample_edges = true
+              # --- KeePassXC Dialogs ---
+            {
+              match.class = "^(org.keepassxc.KeePassXC)$";
+              match.title = "^(KeePassXC -  Access Request)$";
+              float = true;
+              pin = true;
+            }
+            {
+              match.class = "^(org.keepassxc.KeePassXC)$";
+              match.title = "^(Unlock Database - KeePassXC)$";
+              float = true;
+              pin = true;
+            }
+            # --- Generic System / File Dialogs ---
+            { match.title = "^(Open)$"; float = true; }
+            { match.title = "^(Choose Files)$"; float = true; }
+            { match.title = "^(Save As)$"; float = true; }
+            { match.title = "^(Confirm to replace files)$"; float = true; }
+            { match.title = "^(File Operation Progress)$"; float = true; }
 
-            #opactity
+            # --- Firefox Window Rules ---
-            inactive_opacity = 1.0
+            {
-            active_opacity = 1.0
+              match.class = "^(firefox)$";
-            fullscreen_opacity = 1.0
+              match.title = "^(Picture-in-Picture)$";
-                                      
+              float = true;
-            # shadow
+              pin = true;
-            # drop_shadow = no
+              suppress_event = "fullscreen";
-            # shadow_range = 60
+            }
-            # shadow_offset = 0 5
+            {
-            # shadow_render_power = 4
+              match.class = "^(firefox)$";
-            #col.shadow = rgba(00000099)
+              match.title = "^(Firefox — Sharing Indicator)$";
-        }
+              float = true;
-                        
+              suppress_event = "fullscreen";
-        animations {
+            }
-            enabled = true
+            {
-            bezier = customcurve, 0.0, 0.9, 0.1, 1.0
+              match.class = "^(firefox)$";
+              match.title = "^(Extension:.* Mozilla Firefox)$";
+              float = true;
+              suppress_event = "fullscreen";
+            }
 
-            animation = windows, 1, 4, customcurve
+            # --- Telegram Media Viewer ---
-            animation = windowsOut, 1, 4, customcurve, popin 50%
+            {
-            animation = border, 1, 10, customcurve
+              match.class = "^(org.telegram.desktop)$";
-            animation = borderangle, 0, 1, customcurve
+              match.title = "^(Media viewer)$";
-            animation = fade, 1, 4, customcurve
+              float = true;
-            animation = workspaces, 1, 4, customcurve
+              center = true;
-        }
+            }
-                        
-        dwindle {
-            pseudotile = yes
-            preserve_split = yes 
-        }
 
-        master {
+            # --- Idle Inhibition ---
-            new_status = master
+            { match.class = "^(.*)$"; idle_inhibit = "fullscreen"; }
-        }
+            { match.class = "^(steam_app_.*)$"; idle_inhibit = "focus"; }
+            { match.class = "^(mpv)$"; idle_inhibit = "focus"; }
 
-        gesture = 3, vertical, workspace
+        ];
-                        
-        exec-once = eww open bar
-        #exec-once = waybar
-        exec-once = dunst
 
-        exec-once = swww init
+        # windowrule = [ "noshadow, floating:0" ];
 
-        exec-once = dbus-update-activation-environment --systemd WAYLAND_DISPLAY XDG_CURRENT_DESKTOP
+        # windowrulev2 = [
-        exec-once = /nix/store/$(ls -la /nix/store | grep 'polkit-gnome' | grep '4096' | awk '{print $9}' | sed -n '$p')/libexec/polkit-gnome-authentication-agent-1 & 
+        #   "workspace 2 silent, class:^(org.telegram.desktop)$"
+        #   "workspace 2 silent, class:^(discord)$"
+        #   "workspace 8 silent, class:^(org.keepassxc.KeePassXC)$"
+        #   "workspace 8 silent, title:^(Nextcloud)$"
+        #   "workspace 8 silent, class:^(Tk)$,title:^(Server Configuration)$"
+        #   "float,class:^(org.keepassxc.KeePassXC)$,title:^(KeePassXC -  Access Request)$"
+        #   "pin,class:^(org.keepassxc.KeePassXC)$,title:^(KeePassXC -  Access Request)$"
+        #   "float,class:^(org.keepassxc.KeePassXC)$,title:^(Unlock Database - KeePassXC)$"
+        #   "pin,class:^(org.keepassxc.KeePassXC)$,title:^(Unlock Database - KeePassXC)$"
+        #   "float,title:^(Open)$"
+        #   "float,title:^(Choose Files)$"
+        #   "float,title:^(Save As)$"
+        #   "float,title:^(Confirm to replace files)$"
+        #   "float,title:^(File Operation Progress)$"
+        #   "float,class:^(firefox)$,title:^(Picture-in-Picture)$"
+        #   "pin,class:^(firefox)$,title:^(Picture-in-Picture)$"
+        #   "suppressevent fullscreen,class:^(firefox)$,title:^(Picture-in-Picture)$"
+        #   "float,class:^(firefox)$,title:^(Firefox — Sharing Indicator)$"
+        #   "suppressevent fullscreen,class:^(firefox)$,title:^(Firefox — Sharing Indicator)$"
+        #   "float,class:^(firefox)$,title:^(Extension:.* Mozilla Firefox)$"
+        #   "suppressevent fullscreen,class:^(firefox)$,title:^(Extension:.* Mozilla Firefox)$"
+        #   "float,class:^(org.telegram.desktop)$,title:^(Media viewer)$"
+        #   "center,class:^(org.telegram.desktop)$,title:^(Media viewer)$"
+        #   "idleinhibit fullscreen, class:^(.*)"
+        #   "idleinhibit focus, class:^(steam_app_.*)$"
+        #   "idleinhibit focus, class:^(mpv)$"
+        # ];
 
-        exec-once = wl-paste --type text --watch cliphist store #Stores only text data
+        layer_rule = [ {
-        exec-once = wl-paste --type image --watch cliphist store #Stores only image data
+          match.namespace = "^eww%-blur$";
+          blur = true;
+          ignore_alpha = 0.5;
+        }];
 
-        exec-once = swayidle -w timeout 600 'swaylock' before-sleep 'swaylock'
+        bind = [
+          (bind "SUPER + RETURN" (dsp.exec "kitty"))
+          (bind "SUPER + SHIFT + RETURN" (dsp.toggleSpecial "magic"))
+          (bind "SUPER + SHIFT + S" (dsp.moveToSpecial "magic"))
+          (bind "SUPER + Q" dsp.close)
+          (bind "SUPER + T" dsp.float)
+          (bind "SUPER + F" dsp.fullscreen)
+          (bind "SUPER + P" dsp.pseudo)
+          (bind "SUPER + J" (dsp.layout "togglesplit"))
+          (bind "SUPER + D" (dsp.exec "wofi -modi --show drun"))
+          (bind "SUPER + SHIFT + D" (dsp.exec "~/.config/hypr/themes/apatheia/eww/launch_bar"))
+          (bind "SUPER + V" (dsp.exec "cliphist list | wofi -dmenu | cliphist decode | wl-copy"))
+          (bind "PRINT" (dsp.exec "hyprshot -m region --raw | satty --filename - --early-exit --action-on-enter save-to-clipboard --copy-command 'wl-copy'"))
+          (bind "SUPER + L" (dsp.exec "swaylock"))
+          (bind "SUPER + left" (dsp.focus "left"))
+          (bind "SUPER + right" (dsp.focus "right"))
+          (bind "SUPER + up" (dsp.focus "up"))
+          (bind "SUPER + down" (dsp.focus "down"))
+          (bind "SUPER + mouse_down" (dsp.focusWorkspace "e+1"))
+          (bind "SUPER + mouse_up" (dsp.focusWorkspace "e-1"))
 
-
+          (bind "SUPER + 1" (dsp.focusWorkspace 1))
-        #windowrules
+          (bind "SUPER + SHIFT + 1" (dsp.moveToWorkspace 1))
-        windowrule = noshadow, floating:0
+          (bind "SUPER + 2" (dsp.focusWorkspace 2))
-
+          (bind "SUPER + SHIFT + 2" (dsp.moveToWorkspace 2))
-        windowrule = float, title:^(flying_kitty)$
+          (bind "SUPER + 3" (dsp.focusWorkspace 3))
-        windowrule = size 1100 600, title:^(flying_kitty)$
+          (bind "SUPER + SHIFT + 3" (dsp.moveToWorkspace 3))
-        windowrule = move center, title:^(flying_kitty)$
+          (bind "SUPER + 4" (dsp.focusWorkspace 4))
-        windowrule = animation slide, title:^(flying_kitty)$
+          (bind "SUPER + SHIFT + 4" (dsp.moveToWorkspace 4))
-        windowrule = float, title:^(Volume Control)$
+          (bind "SUPER + 5" (dsp.focusWorkspace 5))
-        windowrule = float, title:^(Picture-in-Picture)$
+          (bind "SUPER + SHIFT + 5" (dsp.moveToWorkspace 5))
-        windowrule = float, title:^(Steam)$
+          (bind "SUPER + 6" (dsp.focusWorkspace 6))
-
+          (bind "SUPER + SHIFT + 6" (dsp.moveToWorkspace 6))
-        windowrulev2 = workspace 2 silent, class:^(org.telegram.desktop)$
+          (bind "SUPER + 7" (dsp.focusWorkspace 7))
-        windowrulev2 = workspace 2 silent, class:^(discord)$
+          (bind "SUPER + SHIFT + 7" (dsp.moveToWorkspace 7))
-
+          (bind "SUPER + 8" (dsp.focusWorkspace 8))
-        windowrulev2 = workspace 8 silent, class:^(org.keepassxc.KeePassXC)$
+          (bind "SUPER + SHIFT + 8" (dsp.moveToWorkspace 8))
-        windowrulev2 = workspace 8 silent, title:^(Nextcloud)$
+          (bind "SUPER + 9" (dsp.focusWorkspace 9))
-        windowrulev2 = workspace 8 silent, class:^(Tk)$,title:^(Server Configuration)$
+          (bind "SUPER + SHIFT + 9" (dsp.moveToWorkspace 9))
-
+          (bind "SUPER + 0" (dsp.focusWorkspace 0))
-        #SPECIAL FLOATERS
+          (bind "SUPER + SHIFT + 0" (dsp.moveToWorkspace 0))
-        windowrulev2 = float,class:^(org.keepassxc.KeePassXC)$,title:^(KeePassXC -  Access Request)$
+          (bind "XF86AudioPlay" (dsp.exec "playerctl play-pause"))
-        windowrulev2 = pin,class:^(org.keepassxc.KeePassXC)$,title:^(KeePassXC -  Access Request)$
+          (bind "XF86AudioPrev" (dsp.exec "playerctl previous"))
-        windowrulev2 = float,class:^(org.keepassxc.KeePassXC)$,title:^(Unlock Database - KeePassXC)$
+          (bind "XF86AudioNext" (dsp.exec "playerctl next"))
-        windowrulev2 = pin,class:^(org.keepassxc.KeePassXC)$,title:^(Unlock Database - KeePassXC)$
+          (bindOpts "XF86AudioRaiseVolume" (dsp.exec "amixer -q sset 'Master' 5%+") { locked = true; repeating = true; })
-        windowrulev2 = float,title:^(Open)$
+          (bindOpts "XF86AudioLowerVolume" (dsp.exec "amixer -q sset 'Master' 5%-") { locked = true; repeating = true; })
-        windowrulev2 = float,title:^(Choose Files)$
+          (bindOpts "XF86AudioMute" (dsp.exec "amixer -q sset 'Master' toggle") { locked = true; })
-        windowrulev2 = float,title:^(Save As)$
+          (bindOpts "XF86MonBrightnessUp" (dsp.exec "brightnessctl s 5%+") { locked = true; repeating = true; })
-        windowrulev2 = float,title:^(Confirm to replace files)$
+          (bindOpts "XF86MonBrightnessDown" (dsp.exec "brightnessctl s 5%-") { locked = true; repeating = true; })
-        windowrulev2 = float,title:^(File Operation Progress)$
+          (bindOpts "SUPER + mouse:272" dsp.drag { mouse = true; })
-        windowrulev2 = float,class:^(firefox)$,title:^(Picture-in-Picture)$
+          (bindOpts "SUPER + mouse:273" dsp.resize { mouse = true; })
-        windowrulev2 = pin,class:^(firefox)$,title:^(Picture-in-Picture)$
+        ];
-        windowrulev2 = suppressevent fullscreen,class:^(firefox)$,title:^(Picture-in-Picture)$
+      };
-        windowrulev2 = float,class:^(firefox)$,title:^(Firefox — Sharing Indicator)$
-        windowrulev2 = suppressevent fullscreen,class:^(firefox)$,title:^(Firefox — Sharing Indicator)$
-        windowrulev2 = float,class:^(firefox)$,title:^(Extension:.* Mozilla Firefox)$
-        windowrulev2 = suppressevent fullscreen,class:^(firefox)$,title:^(Extension:.* Mozilla Firefox)$
-        windowrulev2 = float,class:^(org.telegram.desktop)$,title:^(Media viewer)$
-        windowrulev2 = center,class:^(org.telegram.desktop)$,title:^(Media viewer)$
-
-        #SPECIAL NO SLEEP
-        windowrulev2 = idleinhibit fullscreen, class:^(.*)
-        windowrulev2 = idleinhibit focus, class:^(steam_app_.*)$
-        windowrulev2 = idleinhibit focus, class:^(mpv)$
-
-        layerrule = blur,^(eww-blur)
-
-        #binds
-        bind = SUPER, RETURN, exec, kitty
-
-        bind = SUPER_SHIFT, RETURN,togglespecialworkspace,
-        # bind = SUPER_SHIFT, RETURN, exec, kitty --title flying_kitty --single-instance
-        bind = SUPER, Q, killactive, 
-        bind = SUPER, T, togglefloating, 
-        bind = SUPER, F, fullscreen, 
-
-        bind = SUPER, D, exec, wofi -modi --show drun
-        bind = SUPER SHIFT,D,exec, ~/.config/hypr/themes/apatheia/eww/launch_bar 
-
-        bind = SUPER, V, exec, cliphist list | wofi -dmenu | cliphist decode | wl-copy
-        bind = , PRINT, exec, hyprshot -m region --raw | satty --filename - --early-exit --action-on-enter save-to-clipboard --copy-command 'wl-copy'
-
-        bind = SUPER, L, exec, swaylock 
-
-        bind = SUPER, left, movefocus, l
-        bind = SUPER, right, movefocus, r
-        bind = SUPER, up, movefocus, u
-        bind = SUPER, down, movefocus, d
-
-        bind = SUPER, 1, workspace, 1
-        bind = SUPER, 2, workspace, 2
-        bind = SUPER, 3, workspace, 3
-        bind = SUPER, 4, workspace, 4
-        bind = SUPER, 5, workspace, 5
-        bind = SUPER, 6, workspace, 6
-        bind = SUPER, 7, workspace, 7
-        bind = SUPER, 8, workspace, 8
-        bind = SUPER, 9, workspace, 9
-        bind = SUPER, 0, workspace, 10
-
-        bind = SUPER SHIFT, 1, movetoworkspacesilent, 1
-        bind = SUPER SHIFT, 2, movetoworkspacesilent, 2
-        bind = SUPER SHIFT, 3, movetoworkspacesilent, 3
-        bind = SUPER SHIFT, 4, movetoworkspacesilent, 4
-        bind = SUPER SHIFT, 5, movetoworkspacesilent, 5
-        bind = SUPER SHIFT, 6, movetoworkspacesilent, 6
-        bind = SUPER SHIFT, 7, movetoworkspacesilent, 7
-        bind = SUPER SHIFT, 8, movetoworkspacesilent, 8
-        bind = SUPER SHIFT, 9, movetoworkspacesilent, 9
-        bind = SUPER SHIFT, 0, movetoworkspacesilent, 10
-
-        bind = SUPER, mouse_down, workspace, e+1
-        bind = SUPER, mouse_up, workspace, e-1
-
-        bindm = SUPER, mouse:272, movewindow
-        bindm = SUPER, mouse:273, resizewindow
-        bind = , XF86AudioPlay, exec, playerctl play-pause
-        bind = , XF86AudioPrev, exec, playerctl previous
-        bind = , XF86AudioNext, exec, playerctl next
-        bind = , XF86AudioRaiseVolume, exec, amixer -q sset 'Master' 5%+
-        bind = , XF86AudioLowerVolume, exec, amixer -q sset 'Master' 5%-
-        bind = , XF86AudioMute, exec, amixer -q sset 'Master' toggle
-        bind = , XF86MonBrightnessUp, exec, brightnessctl s 5%+
-        bind = , XF86MonBrightnessDown, exec, brightnessctl s 5%-
-
-        exec-once = [workspace special silent] kitty --title flying_kitty
-        exec-once = sh ~/.config/startup.sh
-      '';
     };
-
-    xdg.configFile."startup.sh".text = ''
-      #!/bin/sh
-      sleep 2
-      keepassxc & 
-      firefox & 
-      jellyfin-mpv-shim & 
-      easyeffects --gapplication-service &
-
-      sleep 2
-      nextcloud & 
-      #telegram-desktop&
-      #discord&
-    '';
   };
 }

modules/home/xdg/default.nix

@@ -2,12 +2,13 @@
 
   home.packages = with pkgs; [ xdg-user-dirs ];
 
+  xdg.enable = true;
   xdg.userDirs.enable = true;
   xdg.userDirs.desktop = "${config.home.homeDirectory}/desktop";
   xdg.userDirs.documents = "${config.home.homeDirectory}/desktop";
   xdg.userDirs.download = "${config.home.homeDirectory}/downloads";
   xdg.userDirs.extraConfig = {
-    XDG_MISC_DIR = "${config.home.homeDirectory}/misc";
+    MISC = "${config.home.homeDirectory}/misc";
   };
   xdg.userDirs.music = "${config.home.homeDirectory}/media/music";
   xdg.userDirs.pictures = "${config.home.homeDirectory}/media/photo";
@@ -15,5 +16,5 @@
   xdg.userDirs.templates = "${config.home.homeDirectory}/media/template";
   xdg.userDirs.videos = "${config.home.homeDirectory}/media/video";
   xdg.userDirs.createDirectories = true;
-
+  xdg.userDirs.setSessionVariables = true;
 }

modules/nixos/gui/greet/default.nix

@@ -5,7 +5,7 @@
       enable = true;
       settings = rec {
         initial_session = {
-          command = "zsh";
+          command = "start-hyprland";
           user = "${config.syscfg.defaultUser}";
         };
         default_session = initial_session;

modules/nixos/gui/xserver/default.nix

@@ -3,7 +3,7 @@
     programs.xwayland.enable = true;
     services.xserver = {
       enable = true;
-      videoDrivers = [ "amd" ];
+      videoDrivers = [ "amdgpu" ];
       xkb = {
         layout = "us";
         variant = "intl";

modules/nixos/system/default.nix

@@ -1,3 +1,23 @@
-{ ... }: {
+{ config, lib, ... }: {
   imports = [ ./dbus ./fonts ./hw ./locale ./network ./nix ./security ./xdg ];
+
+  services.journald.extraConfig = ''
+    SystemMaxUse=512M
+    SystemMaxFileSize=64M
+    MaxRetentionSec=1month
+    RateLimitIntervalSec=30s
+    RateLimitBurst=10000
+  '';
+
+  systemd.services.systemd-user-sessions = {
+    after = lib.mkForce ([
+      "system.slice"
+      "systemd-journald.socket"
+      "sysinit.target"
+      "remote-fs.target"
+      "nss-user-lookup.target"
+      "home.mount"
+      "basic.target"
+    ] ++ map (user: "home-manager-${user.username}.service") config.syscfg.users);
+  };
 }

modules/nixos/system/hw/base/default.nix

@@ -1,4 +1,5 @@
-{ ... }: {
+{ lib, ... }: {
   services.fwupd.enable = true;
-  hardware.enableAllFirmware = true;
+  hardware.enableAllFirmware = false;
+  services.power-profiles-daemon.enable = lib.mkDefault true;
 }

modules/nixos/system/hw/boot/default.nix

@@ -2,7 +2,16 @@
 let isSANDBOX = builtins.elem config.syscfg.hostname [ "sandbox" ];
 in {
   config = lib.mkIf (!isSANDBOX) {
+    boot.kernelParams = [ 
+      "async_probe=tpm*"     # Load TPM in parallel without blocking udev
+      "8250.nr_uarts=0"      # Stop scanning for old motherboard serial lines (ttyS0-S3)
+    ];
+    boot.initrd = {
+      compressor = "zstd";
+      checkJournalingFS = false;
+    };
     boot.loader = {
+      timeout = 2;
       systemd-boot = {
         enable = true;
         configurationLimit = 8;

modules/nixos/system/hw/default.nix

@@ -1 +1 @@
-{ ... }: { imports = [ ./base ./boot ./fs ./graphics ./power ./udev ./virt ]; }
+{ ... }: { imports = [ ./base ./boot ./fs ./graphics ./power ./udev ./virt ./wsl ]; }

modules/nixos/system/hw/power/default.nix

@@ -1,5 +1,6 @@
 { lib, config, pkgs, ... }: {
   config = lib.mkIf (config.syscfg.make.power) {
+    services.power-profiles-daemon.enable = false; # conflicts with TLP
     services.tlp = {
       enable = true;
       settings = {
@@ -15,10 +16,10 @@
     # suspend to RAM (deep) rather than `s2idle`
     boot.kernelParams = [ "mem_sleep_default=deep" ];
     # suspend-then-hibernate
-    systemd.sleep.extraConfig = ''
+    systemd.sleep.settings.Sleep = {
-      HibernateDelaySec=30m
+      HibernateDelaySec = "30m";
-      SuspendState=mem
+      SuspendState = "mem";
-    '';
+    };
 
     services.logind.settings.Login.HandleLidSwitch = "suspend-then-hibernate";
     # Hibernate on power button pressed

modules/nixos/system/hw/udev/default.nix

@@ -1,8 +1,8 @@
-{ ... }: {
+{ pkgs, ... }: {
   systemd.services.systemd-udevd.restartIfChanged = false;
 
   services.udev = {
-    packages = [ ];
+    packages = with pkgs; [ ];
     extraRules = ''
       SUBSYSTEM=="usb", ATTRS{idVendor}=="2104", ATTRS{idProduct}=="0127", GROUP="plugdev", TAG+="uaccess"
       SUBSYSTEM=="usb", ATTRS{idVendor}=="2104", ATTRS{idProduct}=="0118", GROUP="plugdev", TAG+="uaccess"

modules/nixos/system/hw/virt/default.nix

@@ -18,5 +18,6 @@
         };
       };
     };
+    virtualisation.containers.registries.search = [ "quay.io" "docker.io" "ghcr.io" ];
   };
 }

modules/nixos/system/hw/wsl/default.nix

@@ -0,0 +1,13 @@
+{ lib, config, pkgs, ... }: {
+    config = lib.mkIf (config.syscfg.extra.wsl) {
+    wsl.enable = true;
+    wsl.defaultUser = config.syscfg.defaultUser;
+    wsl.extraBin = with pkgs; [
+        { src = "${coreutils}/bin/uname"; }
+        { src = "${coreutils}/bin/dirname"; }
+        { src = "${coreutils}/bin/readlink"; }
+    ];
+    
+    wsl.wslConf.network.generateHosts = false;
+    };
+}

modules/nixos/system/network/base/default.nix

@@ -1,17 +1,33 @@
-{ config, ... }: {
+{ lib, config, ... }: {
   networking = {
     hostName = config.syscfg.hostname;
     useDHCP = true;
     nameservers = [ "1.1.1.1" "9.9.9.9" ];
+    dhcpcd = {
+      enable = true;
+      wait = "background";
+    };
+
+    extraHosts = ''
+      ${lib.concatStringsSep "\n" config.syscfg.extra.hosts}
+    '';
+
+    proxy = lib.mkIf (config.syscfg.extra.proxy.domain != "") {
+      default = "http://${config.syscfg.extra.proxy.domain}:${config.syscfg.extra.proxy.port or "8080"}";
+      noProxy = "${config.syscfg.extra.proxy.noProxy}";
+    };
+
 
     firewall = { 
       enable = true;
       allowedUDPPorts = 
-        (if config.syscfg.server ? wireguard then [ 1515 ] else [ ]) ++ 
+        (if (config.syscfg.server != false && config.syscfg.server.wireguard) then [ 1515 ] else [ ]) ++ 
+        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
         [ ];
 
       allowedTCPPorts = 
-        (if config.syscfg.server ? web       then [ 80 443 22 ] else [ ]) ++ 
+        (if (config.syscfg.server != false && config.syscfg.server.web) then [ 80 443 22 ] else [ ]) ++ 
+        (if (config.syscfg.server != false) then [ 5432 6379 8181 ] else [ ]) ++ 
         [ ];
     };
   };

modules/nixos/system/network/wifi/default.nix

@@ -3,6 +3,7 @@
     networking.supplicant = {
       "${config.syscfg.net.wlp.nif}" = {
         configFile.path = config.sops.secrets.wifi.path;
+        userControlled.enable = true;
         extraConf = ''
           network={
               ssid="test"

modules/nixos/system/network/wireguard/default.nix

@@ -27,6 +27,7 @@ in
             else
               [{
                 allowedIPs = [ "10.10.1.0/24" "fd10:10:10::0/64" ];
+                name = "vpn-helcel";
                 endpoint = "vpn.helcel.net:1515";
                 publicKey = "NFBJvYXZC+bd62jhrKnM7/pugidWhgR6+C5qIiUiq3Q=";
                 persistentKeepalive = 30;
@@ -34,9 +35,17 @@ in
         };
       };
     };
-    systemd.services."wireguard-wg0" = {
+
+    systemd.services."wireguard-wg0-peer-vpn-helcel" = {
       after = [ "network-online.target" "nss-lookup.target" ];
-      wants = [ "network-online.target" "nss-lookup.target" ];
+      bindsTo = [ "network-online.target" ];
+      wantedBy = lib.mkForce [ "network-online.target" ];
+      before =  lib.mkForce [ ];
+      serviceConfig = {
+        Restart = "on-failure";
+        RestartSec = "10s";          # Wait 2 seconds before retrying the domain query
+      };
+      startLimitIntervalSec = 0;  
     };
   };
 }

modules/nixos/system/nix/default.nix

@@ -37,5 +37,12 @@
       ];
     };
   };
+  programs.nix-ld = {
+    enable = true;
+    libraries = with pkgs; [
+      libx11 libxcb libxi libxext libxkbfile xcbutilcursor
+      libpng libdrm libpulseaudio nss nspr expat libbsd
+    ];
+  };
   system.stateVersion = "24.11";
 }

modules/nixos/tools/debug/default.nix

@@ -1,12 +1,9 @@
 { pkgs, config, lib, ... }: {
 
   config = lib.mkIf (config.syscfg.make.develop) {
-    programs.adb.enable = true;
+
-    # services.udev.packages = [
-    #   pkgs.android-udev-rules
-    # ];
     programs.wireshark.enable = true;
 
-    environment.systemPackages = with pkgs; [ wget dconf wireshark ];
+    environment.systemPackages = with pkgs; [ wget dconf wireshark mtr android-tools ];
   };
 }

modules/nixos/tools/default.nix

@@ -1,64 +1,4 @@
 { pkgs, ... }: {
-  imports = [ ./debug ./develop ];
+  imports = [ ./debug ./develop ./telegraf ];
 
-  # services.telegraf = {
-  #     enable = true;
-  #     extraConfig = {
-  #         agent = {
-  #             interval = "10s";
-  #             round_interval = true;
-  #             metric_batch_size = 1000;
-  #             metric_buffer_limit = 10000;
-  #             collection_jitter = "0s";
-  #             flush_interval = "10s";
-  #             flush_jitter = "0s";
-  #             precision = "";
-  #             hostname = "valinor";
-  #             omit_hostname = false;
-  #         };
-
-  #         inputs.cpu = {
-  #             percpu = true;
-  #             totalcpu = true;
-  #             collect_cpu_time = false;
-  #             report_active = false;
-  #         };
-
-  #         inputs.mem = {};
-  #         inputs.swap = {};
-  #         inputs.system = {};
-  #         inputs.disk = {
-  #             ignore_fs = ["tmpfs" "devtmpfs" "devfs"];
-  #         };
-
-  #         inputs.net = {};
-  #         inputs.netstat = {};
-
-  #         inputs.ping = {
-  #             urls = ["8.8.8.8" "8.8.4.4"];
-  #             count = 4;
-  #             interval = "60s";
-  #             binary = "${pkgs.iputils.out}/bin/ping";
-  #         };
-
-  #         inputs.internet_speed = {
-  #             interval = "2m";
-  #         };
-
-  #         inputs.net_response = {
-  #             protocol = "tcp";
-  #             address = "google.com:80";
-  #             timeout = "5s";
-  #             read_timeout = "5s";
-  #             interval = "30s";
-  #         };
-
-  #         outputs.influxdb_v2 = {
-  #             urls = [""];
-  #             token = "";
-  #             organization = "";
-  #             bucket = "";
-  #         };
-  #     };
-  # };
 }

modules/nixos/tools/develop/default.nix

@@ -9,6 +9,12 @@ in {
 
   imports = [ ./ollama ];
   config = lib.mkIf (config.syscfg.make.develop) {
+
+    services.vscode-server = lib.mkIf (config.syscfg.extra.wsl) {
+      enable = true;
+      enableFHS = true;
+    };
+
     environment.systemPackages = with pkgs;
       [
         # android-tools

modules/nixos/tools/develop/ollama/default.nix

@@ -1,14 +1,13 @@
 { lib, config, pkgs, ... }: 
 let 
- ollamaPkg = pkgs.ollama-rocm;
+ ollamaPkg = pkgs.ollama-vulkan;
 in{
 
   config = lib.mkIf (config.syscfg.make.develop) {
     services.ollama = {
         enable = true;
         package = ollamaPkg;
-        acceleration = "rocm"; 
+        loadModels = [ ];
-        loadModels = [ "deepseek-v2:lite" "qwen2.5-coder:7b" "qwen2.5-coder:1.5b" ];
         syncModels = true;
     };
     environment.systemPackages = with pkgs; [ ollamaPkg ];

modules/nixos/tools/telegraf/default.nix

@@ -0,0 +1,365 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.syscfg.monitoring.telegraf;
+  hasCollector = name: builtins.elem name cfg.collectors;
+  dockerGroups =
+    lib.optionals (cfg.enable && hasCollector "docker" && config.virtualisation.podman.enable) [ "podman" ]
+    ++ lib.optionals (cfg.enable && hasCollector "docker" && config.virtualisation.docker.enable) [ "docker" ];
+  amdgpuMetricsScript = pkgs.writeShellScript "telegraf-amdgpu-metrics" ''
+    set -euo pipefail
+    ${lib.getExe pkgs.custom.amdgpu_top} -J -n 1 | ${lib.getExe pkgs.jq} -r '
+      def maybe_int($name; $value):
+        if $value == null then empty else "\($name)=\(($value | floor))i" end;
+      def maybe_float($name; $value):
+        if $value == null then empty else "\($name)=\($value)" end;
+      .devices
+      | to_entries[]
+      | [
+          maybe_int("utilization_gpu"; (.value.gpu_activity.GFX.value // .value.GRBM2["Command Processor -  Graphics"].value // 0)),
+          maybe_int("utilization_media"; .value.gpu_activity.MediaEngine.value),
+          maybe_int("utilization_memory"; .value.gpu_activity.Memory.value),
+          maybe_float("temperature_edge"; .value.Sensors["Edge Temperature"].value),
+          maybe_float("power_draw"; .value.gpu_metrics.average_socket_power.value)
+        ] as $fields
+      | map(select(length > 0)) as $nonempty
+      | select(($nonempty | length) > 0)
+      | "amdgpu,card=\(.key) " + ($nonempty | join(","))
+    '
+  '';
+  baseConfig = {
+    agent = {
+      interval = cfg.interval;
+      round_interval = true;
+      metric_batch_size = 1000;
+      metric_buffer_limit = 10000;
+      flush_interval = cfg.interval;
+      hostname = config.syscfg.hostname;
+      omit_hostname = false;
+    };
+    global_tags = {
+      host = config.syscfg.hostname;
+    };
+  };
+  inputsConfig = lib.mkMerge [
+    (lib.mkIf (hasCollector "cpu") {
+      inputs.cpu = {
+        percpu = true;
+        totalcpu = true;
+        collect_cpu_time = false;
+        report_active = false;
+        fielddrop = [
+          "usage_guest"
+          "usage_guest_nice"
+          "usage_irq"
+          "usage_nice"
+          "usage_softirq"
+          "usage_steal"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "mem") {
+      inputs.mem = {
+        fielddrop = [
+          "available_percent"
+          "commit_limit"
+          "committed_as"
+          "high_free"
+          "high_total"
+          "huge_page_size"
+          "huge_pages_free"
+          "huge_pages_total"
+          "low_free"
+          "low_total"
+          "mapped"
+          "page_tables"
+          "slab"
+          "sreclaimable"
+          "sunreclaim"
+          "swap_cached"
+          "swap_free"
+          "swap_total"
+          "vmalloc_chunk"
+          "vmalloc_total"
+          "vmalloc_used"
+          "write_back"
+          "write_back_tmp"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "swap") {
+      inputs.swap = {
+        fielddrop = [
+          "free"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "system") {
+      inputs.system = {
+        fielddrop = [
+          "n_physical_cpus"
+          "n_unique_users"
+          "uptime_format"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "disk") {
+      inputs.disk = {
+        ignore_fs = [ "tmpfs" "devtmpfs" "devfs" "overlay" "squashfs" ];
+        fielddrop = [
+          "free"
+          "inodes_free"
+          "inodes_total"
+          "inodes_used"
+          "inodes_used_percent"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "diskio") {
+      inputs.diskio = {
+        skip_serial_number = true;
+        fielddrop = [
+          "io_svctm"
+          "iops_in_progress"
+          "merged_reads"
+          "merged_writes"
+          "weighted_io_time"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "kernel") {
+      inputs.kernel = {
+        fielddrop = [
+          "boot_time"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "net") {
+      inputs.net = {
+        fielddrop = [
+          "bytes_recv"
+          "bytes_sent"
+          "speed"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "netstat") {
+      inputs.netstat = {
+        fielddrop = [
+          "tcp_close"
+          "tcp_close_wait"
+          "tcp_closing"
+          "tcp_fin_wait1"
+          "tcp_fin_wait2"
+          "tcp_last_ack"
+          "tcp_none"
+          "tcp_syn_recv"
+          "tcp_syn_sent"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "processes") {
+      inputs.processes = {
+        fielddrop = [
+          "dead"
+          "idle"
+          "paging"
+          "stopped"
+          "unknown"
+          "zombies"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "temp") {
+      inputs.temp = { };
+    })
+    (lib.mkIf (hasCollector "mdstat") {
+      inputs.mdstat = { };
+    })
+    (lib.mkIf (hasCollector "smart") {
+      inputs.smart = {
+        use_sudo = true;
+        attributes = true;
+      };
+    })
+    (lib.mkIf (hasCollector "docker") {
+      inputs.docker = [
+        {
+          endpoint = "unix:///var/run/docker.sock";
+          timeout = "5s";
+          perdevice_include = [ ];
+          total_include = [ ];
+          docker_label_exclude = [ "*" ];
+          tagexclude = [
+            "container_image"
+            "container_status"
+            "container_version"
+            "engine_host"
+            "server_version"
+          ];
+          namedrop = [
+            "docker_container_health"
+            "docker_container_mem"
+            "docker_container_status"
+          ];
+          fielddrop = [
+            "memory_total"
+            "n_cpus"
+            "n_goroutines"
+            "n_listener_events"
+            "n_used_file_descriptors"
+            "server_version"
+          ];
+        }
+        {
+          endpoint = "unix:///var/run/docker.sock";
+          timeout = "5s";
+          perdevice_include = [ ];
+          total_include = [ ];
+          docker_label_exclude = [ "*" ];
+          tagexclude = [
+            "container_image"
+            "container_status"
+            "container_version"
+            "engine_host"
+            "server_version"
+          ];
+          namepass = [ "docker_container_mem" ];
+          fielddrop = [
+            "active_anon"
+            "active_file"
+            "container_id"
+            "hierarchical_memory_limit"
+            "inactive_anon"
+            "inactive_file"
+            "mapped_file"
+            "max_usage"
+            "pgfault"
+            "pgmajfault"
+            "pgpgin"
+            "pgpgout"
+            "rss_huge"
+            "total_active_anon"
+            "total_active_file"
+            "total_cache"
+            "total_inactive_anon"
+            "total_inactive_file"
+            "total_mapped_file"
+            "total_pgfault"
+            "total_pgmajfault"
+            "total_pgpgin"
+            "total_pgpgout"
+            "total_rss"
+            "total_rss_huge"
+            "total_unevictable"
+            "total_writeback"
+            "unevictable"
+            "writeback"
+          ];
+        }
+      ];
+    })
+    (lib.mkIf (hasCollector "systemd_units") {
+      inputs.systemd_units = {
+        pattern = "*";
+        unittype = "service";
+        details = true;
+        timeout = "5s";
+      };
+    })
+    (lib.mkIf (hasCollector "ping") {
+      inputs.ping = {
+        urls = [ "1.1.1.1" ];
+        count = 4;
+        interval = "60s";
+        timeout = 5.0;
+        binary = "${pkgs.iputils}/bin/ping";
+        fielddrop = [
+          "packets_received"
+          "packets_transmitted"
+        ];
+      };
+    })
+    (lib.mkIf (hasCollector "internet_speed") {
+      inputs.internet_speed = {
+        interval = "30m";
+        cache = true;
+        memory_saving_mode = true;
+      };
+    })
+    (lib.mkIf (hasCollector "gpu" || hasCollector "nix") {
+      inputs.exec =
+        lib.optionals (hasCollector "gpu") [{
+          commands = [ amdgpuMetricsScript ];
+          timeout = "5s";
+          data_format = "influx";
+        }]
+        ++ lib.optionals (hasCollector "nix") [{
+          commands = [
+            (pkgs.writeShellScript "telegraf-nix-metrics" ''
+              set -euo pipefail
+
+              current="$(${lib.getExe pkgs.nixos-rebuild} list-generations | ${lib.getExe pkgs.gawk} '$NF == "True" {print $1 "|" $2 " " $3; exit}')"
+              [ -n "$current" ]
+
+              generation="''${current%%|*}"
+              build_datetime="''${current#*|}"
+              build_timestamp="$(${lib.getExe' pkgs.coreutils "date"} -d "$build_datetime" +%s)"
+              now="$(${lib.getExe' pkgs.coreutils "date"} +%s)"
+              store_bytes="$(${lib.getExe pkgs.nix} path-info --json --json-format 1 --all --offline --no-pretty | ${lib.getExe pkgs.jq} -r 'map(.narSize // 0) | add // 0')"
+              current_system_bytes="$(${lib.getExe pkgs.nix} path-info --json --json-format 1 --closure-size /run/current-system --offline --no-pretty | ${lib.getExe pkgs.jq} -r 'to_entries[0].value.closureSize // 0')"
+
+              printf 'nix generation=%si,configured_packages=%si,store_bytes=%si,current_system_bytes=%si,build_timestamp=%si,seconds_since_build=%si,build_datetime="%s"\n' \
+                "$generation" \
+                ${toString (builtins.length config.environment.systemPackages)} \
+                "$store_bytes" \
+                "$current_system_bytes" \
+                "$build_timestamp" \
+                "$((now - build_timestamp))" \
+                "$build_datetime"
+            '')
+          ];
+          interval = "1h";
+          timeout = "30s";
+          data_format = "influx";
+        }];
+    })
+  ];
+  outputsConfig = lib.mkMerge [{
+      outputs.influxdb_v3 = {
+        urls = cfg.outputs;
+        token = "$INFLUX_TOKEN";#config.sops.secrets.telegraf.path;
+        database = "telegraf";
+      };
+    }
+  ];
+in {
+  config = lib.mkIf cfg.enable {
+    services.telegraf = {
+      enable = true;
+      environmentFiles = [ config.sops.secrets.telegraf.path ];
+      extraConfig = lib.mkMerge [
+        baseConfig
+        inputsConfig
+        outputsConfig
+        cfg.extraConfig
+      ];
+    };
+
+    users.users.telegraf.extraGroups = dockerGroups;
+
+    systemd.services.telegraf = {
+      path =
+        lib.optionals (hasCollector "smart") [ pkgs.smartmontools pkgs.nvme-cli ]
+        ++ lib.optionals (hasCollector "gpu") [ pkgs.custom.amdgpu_top pkgs.jq ];
+      serviceConfig.SupplementaryGroups = dockerGroups;
+    };
+
+    security.sudo.extraRules = lib.optionals (hasCollector "smart") [{
+      users = [ "telegraf" ];
+      commands = [{
+        command = "${pkgs.smartmontools}/bin/smartctl";
+        options = [ "NOPASSWD" ];
+      }];
+    }];
+  };
+}

modules/server/containers/apps/.template.nix

@@ -0,0 +1,54 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "EXAMPLE";
+    tag = "0.0.0";
+    contents = [ pkgs.bashInteractive ];
+    config = {
+      Entrypoint = [ "echo 1" ];
+      ExposedPorts = {  };
+    };
+  }; 
+  settings = pkgs.writeText "settings.yaml" ...;
+  templateData = builder.mkData { name = "template"; dir = "template"; vars = {
+      _ARGUMENT = "template";
+    };
+  };
+in {
+  requires = {
+    secrets = [ ];
+    databases = [ ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config.path}/example/";
+      mode = "0444";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        # imageStream = image;
+        image = "....:${version}";
+        port = 8080;
+        secret = name;
+        extraEnv = { };
+        overrides = {
+          cmd = [ ];
+          volumes = [ ];
+         };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."EXAMPLE".path;
+      script = pkgs.writeShellScript "setup" ''
+        ...
+      '';
+    };
+  };
+}

modules/server/containers/apps/.todo.md

@@ -0,0 +1,8 @@
+# Missing
+
+RSS: TTRSS / FreshRSS
+Monitoring: Telegraf + InfluxDB
+https://github.com/tarampampam/error-pages ?
+kavita + mylar ? kapowarr ?
+
+- Transmission Cfg and API/Token handling

modules/server/containers/apps/authentik.nix

@@ -0,0 +1,149 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  version = "2026.2.2";
+  serverCfg = config.syscfg.server;
+  mediaCfg = config.syscfg.media;
+  authentikBackground = if mediaCfg.banner.png != null then mediaCfg.banner.png else mediaCfg.bg;
+  logoSvgFileName = builtins.baseNameOf (toString mediaCfg.logo.svg);
+  logoIcoFileName = builtins.baseNameOf (toString mediaCfg.logo.ico);
+  backgroundFileName = builtins.baseNameOf (toString authentikBackground);
+  logoSvgMount = "/data/media/public/branding/${logoSvgFileName}";
+  logoIcoMount = "/data/media/public/branding/${logoIcoFileName}";
+  backgroundMount = "/data/media/public/branding/${backgroundFileName}";
+  authentikData = builder.mkData { 
+    name = "authentik"; dir = "authentik"; vars = {
+      AUTHENTIK_DOMAIN = "${containerCfg.subdomain}.${serverCfg.domain}";
+      COOKIE_DOMAIN = "${serverCfg.domain}";
+      AUTHENTIK_LDAP_DC_DOMAIN = "dc=ldap," + (lib.concatMapStringsSep "," (x: "dc=${x}") (lib.splitString "." serverCfg.domain));
+      AUTHENTIK_BRANDING_TITLE = if containerCfg.extra ? name then containerCfg.extra.name else "authentik";
+      AUTHENTIK_BRANDING_LOGO = "branding/${logoSvgFileName}";
+      AUTHENTIK_BRANDING_FAVICON = "branding/${logoIcoFileName}";
+      AUTHENTIK_BRANDING_BACKGROUND = "branding/${backgroundFileName}";
+    } 
+    // (if serverCfg.containers?jellyfin then { JELLYFIN_DOMAIN = "${serverCfg.containers.jellyfin.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?gitea then { GITEA_DOMAIN = "${serverCfg.containers.gitea.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?immich then { IMMICH_DOMAIN = "${serverCfg.containers.immich.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?freshrss then { FRESHRSS_DOMAIN = "${serverCfg.containers.freshrss.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?homepage then { HOMEPAGE_DOMAIN = "${serverCfg.containers.homepage.subdomain}.${serverCfg.domain}";} else {})
+    // (if serverCfg.containers?nextcloud then { NEXTCLOUD_DOMAIN = "${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";} else {});
+  };
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config.path}/authentik";
+      owner = "1000:1000";
+      dirs = ["media" "templates"];
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "ghcr.io/goauthentik/server:${version}";
+        port = 9000;
+        secret = name;
+        extraEnv = {
+          AUTHENTIK_DISABLE_STARTUP_ANALYTICS="true";
+          AUTHENTIK_ERROR_REPORTING__ENABLED="false";
+          AUTHENTIK_WEB__WORKERS="1";
+          AUTHENTIK_WORKER__PROCESSES="1";
+          AUTHENTIK_WORKER__THREADS="2";
+          AUTHENTIK_REDIS__HOST = builder.host;
+          AUTHENTIK_POSTGRESQL__HOST = builder.host;
+          AUTHENTIK_POSTGRESQL__USER = "authentik_user";
+          AUTHENTIK_POSTGRESQL__NAME = "authentik_db";
+          AUTHENTIK_POSAUTHENTIK_POSTGRESQL__SSLMODE = "false";
+          AUTHENTIK_DISABLE_UPDATE_CHECK = "true";
+          AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+        } // lib.optionalAttrs (serverCfg.mail.server != null) {
+          AUTHENTIK_EMAIL__HOST = serverCfg.mail.server;
+          AUTHENTIK_EMAIL__PORT = "587";
+          AUTHENTIK_EMAIL__USERNAME = "noreply@${serverCfg.domain}";
+          AUTHENTIK_EMAIL__USE_TLS = "true";
+          AUTHENTIK_EMAIL__USE_SSL = "false";
+          AUTHENTIK_EMAIL__TIMEOUT = "10";
+          AUTHENTIK_EMAIL__FROM = "sso@noreply.${serverCfg.domain}";
+        };
+        overrides = {
+          environmentFiles =  [ config.sops.secrets."AUTHENTIK".path config.sops.secrets."CUSTOM".path ] ;
+        
+          cmd = [ "server" ];
+          volumes = [
+            "${serverCfg.path.config.path}/authentik/media:/media"
+            "${serverCfg.path.config.path}/authentik/templates:/templates"
+            "${authentikData}:/blueprints/custom:ro"
+            "${mediaCfg.logo.svg}:${logoSvgMount}:ro"
+            "${mediaCfg.logo.ico}:${logoIcoMount}:ro"
+            "${authentikBackground}:${backgroundMount}:ro"
+          ];
+        };
+      };
+
+      worker = builder.mkContainer {
+        image = "ghcr.io/goauthentik/server:${version}";
+        secret = name;
+        extraEnv = {
+          AUTHENTIK_DISABLE_STARTUP_ANALYTICS="true";
+          AUTHENTIK_ERROR_REPORTING__ENABLED="false";
+          AUTHENTIK_WEB__WORKERS="1";
+          AUTHENTIK_WORKER__PROCESSES="1";
+          AUTHENTIK_WORKER__THREADS="2";
+          AUTHENTIK_REDIS__HOST = builder.host;
+          AUTHENTIK_POSTGRESQL__HOST = builder.host;
+          AUTHENTIK_POSTGRESQL__USER = "authentik_user";
+          AUTHENTIK_POSTGRESQL__NAME = "authentik_db";
+          AUTHENTIK_POSAUTHENTIK_POSTGRESQL__SSLMODE = "false";
+          AUTHENTIK_DISABLE_UPDATE_CHECK = "true";
+          AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+        };
+        overrides = {
+          cmd = [ "worker" ];
+          volumes = [
+            "${serverCfg.path.config.path}/authentik/media:/media"
+            "${serverCfg.path.config.path}/authentik/templates:/templates"
+            "${authentikData}:/blueprints/custom:ro"
+            "${mediaCfg.logo.svg}:${logoSvgMount}:ro"
+            "${mediaCfg.logo.ico}:${logoIcoMount}:ro"
+            "${authentikBackground}:${backgroundMount}:ro"
+          ];
+        };
+      };
+
+      ldap = builder.mkContainer {
+        image = "ghcr.io/goauthentik/ldap:${version}";
+        secret = name;
+        extraEnv = {
+          AUTHENTIK_HOST = "https://${containerCfg.subdomain}.${serverCfg.domain}"; 
+          AUTHENTIK_INSECURE = "false"; 
+        };
+      };
+    };
+
+    setup = {
+      trigger = "worker";
+      script = pkgs.writeShellScript "setup" ''
+        # Define the command wrapper
+        AK="${pkgs.podman}/bin/podman --events-backend=none exec --env-file ${config.sops.secrets."CUSTOM".path} -e DOMAIN=${serverCfg.domain} -u root authentik-worker ak"
+
+        $AK apply_blueprint /blueprints/custom/authentik.yaml
+        $AK apply_blueprint /blueprints/custom/branding.yaml
+        $AK apply_blueprint /blueprints/custom/traefik.yaml
+        $AK apply_blueprint /blueprints/custom/ldap.yaml
+
+        ${lib.optionalString (serverCfg.containers ? gitea) ''$AK apply_blueprint /blueprints/custom/gitea.yaml''}
+        ${lib.optionalString (serverCfg.containers ? jellyfin) ''$AK apply_blueprint /blueprints/custom/jellyfin.yaml''}
+        ${lib.optionalString (serverCfg.containers ? nextcloud) ''$AK apply_blueprint /blueprints/custom/nextcloud.yaml''}
+        ${lib.optionalString (serverCfg.containers ? immich) ''$AK apply_blueprint /blueprints/custom/immich.yaml''}
+        ${lib.optionalString (serverCfg.containers ? freshrss) ''$AK apply_blueprint /blueprints/custom/freshrss.yaml''}
+        ${lib.optionalString (serverCfg.containers ? homepage) ''$AK apply_blueprint /blueprints/custom/homepage.yaml''}
+
+        echo "Completed Authentik Setup"
+      '';
+    };
+  };
+}

modules/server/containers/apps/calibre.nix

@@ -0,0 +1,42 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+in {
+  runtime = {
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "crocodilestick/calibre-web-automated:${version}";
+        port = 8083;
+      #   secret = name;
+        extraEnv = {
+          CWA_PORT_OVERRIDE = "8083";
+
+          PUID = "1000";
+          PGID = "1000";
+          #HARDCOVER_TOKEN= ....
+          TRUSTED_PROXY_COUNT= "1";
+        };
+          extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}-login.rule" = "Host(`${containerCfg.subdomain}.${serverCfg.domain}`)";
+          "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if (serverCfg.containers?authentik) then "authentik" else "";
+          "traefik.http.routers.${containerCfg.subdomain}-login.priority" = "100";
+          "traefik.http.routers.${containerCfg.subdomain}-login.entrypoints" = "web-secure";
+          "traefik.http.routers.${containerCfg.subdomain}-login.tls" = "true";
+        };
+        overrides = {
+          volumes = [
+            "${serverCfg.path.book.path}:/calibre-library"
+            "${serverCfg.path.dlComplete.path}:/cwa-book-ingest"
+          ];
+        };
+      };
+    };
+  };
+
+  # curl 'https://books.test.helcel.net/admin/ajaxconfig' \
+  # -X POST 
+  # -H 'Content-Type: application/x-www-form-urlencoded; charset=UTF-8'
+  # --data-raw 'csrf_token=${CSRF_TOKEN}&config_certfile=&config_keyfile=&config_updatechannel=0&config_trustedhosts=&config_log_level=20&config_logfile=%2Fdev%2Fstdout&config_access_logfile=%2Fconfig%2Faccess.log&config_embed_metadata=on&config_uploading=on&config_upload_formats=m4b%2Cacsm%2Cdoc%2Cpdf%2Cmp3%2Codt%2Ccbr%2Crtf%2Clit%2Cprc%2Cm4a%2Cdjv%2Cfb2%2Copus%2Cdocx%2Cazw3%2Cepub%2Cdjvu%2Cwav%2Ccb7%2Ccbz%2Cmp4%2Ckfx-zip%2Cmobi%2Ccbt%2Cogg%2Ckfx%2Ckepub%2Ctxt%2Cazw%2Chtml%2Cflac&config_external_port=8083&config_goodreads_api_key=&config_hardcover_token=&config_use_https=on&config_reverse_proxy_login_header_name=&config_login_type=1&config_ldap_provider_url=sso.test.helcel.net&config_ldap_port=389&config_ldap_encryption=0&config_ldap_cacert_path=&config_ldap_cert_path=&config_ldap_key_path=&config_ldap_authentication=2&config_ldap_serv_username=cn%3Dldap-service%2Cou%3Dusers%2C%24%7BLDAP_DC_DOMAIN%7D&config_ldap_serv_password_e=%24DEFAULT_LDAP_PASSWORD&config_ldap_dn=%24%7BLDAP_DC_DOMAIN%7D&config_ldap_user_object=(memberOf%3Dcn%3Dcloud%2Cou%3Dgroups%2C%24%7BLDAP_DC_DOMAIN%7D)&config_ldap_openldap=on&config_ldap_auto_create_users=on&config_ldap_group_object_filter=(memberOf%3Dcn%3Dcloud%2Cou%3Dgroups%2C%24%7BLDAP_DC_DOMAIN%7D)&config_ldap_group_name=cloud&config_ldap_group_members_field=memberUid&ldap_import_user_filter=0&config_ldap_member_user_object=&config_generic_oauth_metadata_url=&config_generic_oauth_server_url=&config_generic_oauth_auth_url=&config_generic_oauth_token_url=&config_generic_oauth_userinfo_url=&config_generic_oauth_scope=email+openid+profile&config_oauth_redirect_host=&config_generic_oauth_client_id=&config_generic_oauth_client_secret=&config_generic_oauth_username_mapper=preferred_username&config_generic_oauth_email_mapper=email&config_generic_oauth_admin_group=admin&config_generic_oauth_login_button=OpenID+Connect&config_1_oauth_client_id=&config_1_oauth_client_secret=&config_2_oauth_client_id=&config_2_oauth_client_secret=&config_binariesdir=%2Fusr%2Fbin&config_calibre=&config_kepubifypath=%2Fusr%2Fbin%2Fkepubify&config_rarfile_location=%2Fusr%2Fbin%2Funrar&config_enable_oauth_group_admin_management=on&config_ratelimiter=on&config_limiter_uri=&config_limiter_options=&config_check_extensions=on&config_session=1&config_password_policy=on&config_password_min_length=8&config_password_number=on&config_password_lower=on&config_password_upper=on&config_password_character=on&config_password_special=on'
+}

modules/server/containers/apps/collabora.nix

@@ -0,0 +1,37 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+version = "latest";
+serverCfg = config.syscfg.server;
+in {
+  requires.secrets = [ name ];
+
+  runtime = {
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "collabora/code:${version}";
+        port = 9980;
+        secret = name;
+        extraEnv = {
+          "aliasgroup1" = "https://${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";
+          "server_name" = "${containerCfg.subdomain}.${serverCfg.domain}";
+          "username" = "collabora_user";
+          "VIRTUAL_HOST" = "${containerCfg.subdomain}.${serverCfg.domain}";
+          "VIRTUAL_PORT" = "9980";
+          "VIRTUAL_PROTO" = "http";
+          "DONT_GEN_SSL_CERT" = "true";
+          "RESOLVE_TO_PROXY_IP" = "true";
+          "extra_params" = "--o:ssl.enable=false --o:ssl.termination=true";
+          "dictionaries" = "en fr de jp no";
+        };
+        
+        overrides = {
+          volumes = [
+            "${pkgs.noto-fonts}/share/fonts/noto:/opt/collaboraoffice/share/fonts/truetype/noto:ro"
+            "${pkgs.ibm-plex}/share/fonts/opentype:/opt/collaboraoffice/share/fonts/opentype/plex:ro"
+          ];
+        };
+      };
+    };
+  };
+}

modules/server/containers/apps/ethercalc.nix

@@ -0,0 +1,42 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  ethercalc_exe = pkgs.ethercalc;
+
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "ethercalc";
+    tag = ethercalc_exe.version;
+    contents = [ pkgs.bashInteractive ];
+    config = {
+      Entrypoint = [ "${ethercalc_exe}/bin/ethercalc" ];
+      ExposedPorts = { "8080/tcp" = {}; };
+    };
+  };
+in {
+  requires.secrets = [ name ];
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.data.path}/ethercalc/";
+      mode = "0666";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 8080;
+        secret = name;
+        extraEnv = {
+          ETHERCALC_PORT = "8080";
+          #CONNECT TO REDIS
+        };
+        overrides = {
+          volumes = [
+            "${serverCfg.path.data.path}/ethercalc:/data"
+          ];
+         };
+      };
+    };
+  };
+}

modules/server/containers/apps/etherpad.nix

@@ -0,0 +1,129 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  etherpad_exe = pkgs.etherpad-lite;
+  settings = pkgs.writeText"settings.json" (builtins.toJSON {
+    title= "\${TITLE:Etherpad}";
+    showRecentPads = "\${SHOW_RECENT_PADS:true}";
+    favicon = "\${FAVICON:null}";
+    publicURL = "\${PUBLIC_URL:null}";
+    skinName = "\${SKIN_NAME:colibris}";
+    skinVariants = "\${SKIN_VARIANTS:super-light-toolbar super-light-editor light-background}";
+    ip = "\${IP:0.0.0.0}";
+    port = "\${PORT:9001}";
+    showSettingsInAdminPage = "\${SHOW_SETTINGS_IN_ADMIN_PAGE:true}";
+    enableMetrics = "\${ENABLE_METRICS:true}";
+    updates.tier = "off";
+    cleanup.enabled = false;
+    gdprAuthorErasure.enabled = "\${GDPR_AUTHOR_ERASURE_ENABLED:false}";
+    authenticationMethod = "\${AUTHENTICATION_METHOD:apikey}";
+    enableDarkMode = "\${ENABLE_DARK_MODE:true}";
+    enablePadWideSettings = "\${ENABLE_PAD_WIDE_SETTINGS:true}";
+    dbType = "\${DB_TYPE:dirty}";
+    dbSettings = {
+      host =       "\${DB_HOST:undefined}";
+      port =       "\${DB_PORT:undefined}";
+      database =   "\${DB_NAME:undefined}";
+      user =       "\${DB_USER:undefined}";
+      password =   "\${DB_PASS:undefined}";
+      charset =    "\${DB_CHARSET:undefined}";
+      filename =   "\${DB_FILENAME:var/dirty.db}";
+      collection = "\${DB_COLLECTION:undefined}";
+      url =        "\${DB_URL:undefined}";
+    };
+    defaultPadText = "\${DEFAULT_PAD_TEXT:P A D}";
+    padOptions = {
+      noColors =         "\${PAD_OPTIONS_NO_COLORS:false}";
+      showControls =     "\${PAD_OPTIONS_SHOW_CONTROLS:true}";
+      showChat =         "\${PAD_OPTIONS_SHOW_CHAT:true}";
+      showLineNumbers =  "\${PAD_OPTIONS_SHOW_LINE_NUMBERS:true}";
+      useMonospaceFont = "\${PAD_OPTIONS_USE_MONOSPACE_FONT:false}";
+      userName =         "\${PAD_OPTIONS_USER_NAME:null}";
+      userColor =        "\${PAD_OPTIONS_USER_COLOR:null}";
+      rtl =              "\${PAD_OPTIONS_RTL:false}";
+      alwaysShowChat =   "\${PAD_OPTIONS_ALWAYS_SHOW_CHAT:false}";
+      chatAndUsers =     "\${PAD_OPTIONS_CHAT_AND_USERS:false}";
+      lang =             "\${PAD_OPTIONS_LANG:null}";
+      fadeInactiveAuthorColors = "\${PAD_OPTIONS_FADE_INACTIVE_AUTHOR_COLORS:true}";
+      enforceReadableAuthorColors = "\${PAD_OPTIONS_ENFORCE_READABLE_AUTHOR_COLORS:true}";
+    };
+
+    requireSession = "\${REQUIRE_SESSION:false}";
+    editOnly = "\${EDIT_ONLY:false}";
+    minify = "\${MINIFY:true}";
+    requireAuthentication = "\${REQUIRE_AUTHENTICATION:false}";
+    requireAuthorization = "\${REQUIRE_AUTHORIZATION:false}";
+    trustProxy = "\${TRUST_PROXY:true}";
+    ep_headerauth.username_header = "X-authentik-username";
+    users.admin = {
+      password = "\${ADMIN_PASSWORD:null}";
+      is_admin = true;
+    };
+    socketTransportProtocols = ["websocket" "polling"];
+    socketIo.maxHttpBufferSize = "\${SOCKETIO_MAX_HTTP_BUFFER_SIZE:1000000}";
+    indentationOnNewLine = true;
+
+    loglevel = "\${LOGLEVEL:INFO}";
+    lowerCasePadIds = "\${LOWER_CASE_PAD_IDS:true}";
+  });
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "etherpad";
+    tag = etherpad_exe.version;
+    contents = [ pkgs.bashInteractive ];
+    config = {
+      Entrypoint = [ "${etherpad_exe}/bin/etherpad-lite" ];
+      ExposedPorts = { "8080/tcp" = {}; };
+    };
+  };
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config.path}/etherpad/";
+      mode = "0444";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 8080;
+        secret = name;
+        extraEnv = {
+          TITLE = "Pad";
+          PORT ="8080";
+          DB_TYPE = "postgres";
+          DB_HOST = builder.host;
+          DB_NAME = "etherpad_db";
+          DB_USER = "etherpad_user";
+          TRUST_PROXY = "true";
+          DB_CHARSET = "utf8mb4";
+          DEFAULT_PAD_TEXT = "";
+          PAD_OPTIONS_SHOW_LINE_NUMBERS = "true";
+          PAD_OPTIONS_USE_MONOSPACE_FONT = "true";
+          SKIN_VARIANTS = "super-dark-toolbar light-editor dark-background";
+        };
+        overrides = {
+          cmd = [ "--settings" "/etc/etherpad/settings.json" "--apikey" "/etc/etherpad/APIKEY.txt" ];
+          volumes = [
+            "${settings}:/etc/etherpad/settings.json"
+            "${serverCfg.path.config.path}/etherpad/APIKEY.txt:/etc/etherpad/APIKEY.txt:ro"
+          ];
+         };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."ETHERPAD".path;
+      script = pkgs.writeShellScript "setup" ''
+        echo "$APIKEY" > ${serverCfg.path.config.path}/etherpad/APIKEY.txt
+        chmod 444 ${serverCfg.path.config.path}/etherpad/APIKEY.txt
+      '';
+    };
+  };
+}

modules/server/containers/apps/favicon.nix

@@ -0,0 +1,284 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let
+  serverCfg = config.syscfg.server;
+  mediaCfg = config.syscfg.media;
+  palette = serverCfg.colorScheme.palette or { };
+  port = 8080;
+  assetSize = 64;
+  cacheMode = containerCfg.extra.cacheMode or "off";
+  cacheControl =
+    if cacheMode == "disk" then
+      containerCfg.extra.cacheControl or "public, max-age=3600"
+    else if cacheMode == "off" then
+      "no-store"
+    else
+      throw "favicon cacheMode must be either `off` or `disk`";
+  priority = toString (containerCfg.extra.priority or 2147482647);
+  logoSvgFileName = builtins.baseNameOf (toString mediaCfg.logo.svg);
+  logoSvgMount = "/assets/${logoSvgFileName}";
+  ensureAttrSet = field: value:
+    if builtins.isAttrs value then
+      value
+    else
+      throw "favicon `${field}` must be an attribute set";
+  resolveColor = value:
+    if value == null then null
+    else if !builtins.isString value then
+      throw "favicon color values must be strings"
+    else if lib.hasPrefix "#" value then
+      value
+    else
+      let
+        paletteValue = lib.attrByPath [ value ] (throw "Unknown favicon color reference `${value}`") palette;
+      in
+      if builtins.isString paletteValue then
+        if lib.hasPrefix "#" paletteValue then
+          paletteValue
+        else
+          "#${paletteValue}"
+      else
+        throw "favicon palette reference `${value}` must resolve to a string";
+  normalizeProfile = profile:
+    let
+      normalizedProfile = ensureAttrSet "profile" profile;
+      bg =
+        if normalizedProfile ? bg then resolveColor normalizedProfile.bg
+        else if normalizedProfile ? background then resolveColor normalizedProfile.background
+        else null;
+      fg =
+        if normalizedProfile ? fg then resolveColor normalizedProfile.fg
+        else if normalizedProfile ? foreground then resolveColor normalizedProfile.foreground
+        else null;
+    in
+    (lib.filterAttrs (name: _: !(builtins.elem name [ "bg" "background" "fg" "foreground" ])) normalizedProfile)
+    // lib.optionalAttrs (bg != null) { bg = bg; }
+    // lib.optionalAttrs (fg != null) { fg = fg; };
+  hostMappings = lib.mapAttrs (_: profile: normalizeProfile profile) (
+    ensureAttrSet "mappings" (containerCfg.extra.mappings or { })
+  );
+  defaultProfile =
+    if containerCfg.extra ? default then
+      normalizeProfile containerCfg.extra.default
+    else
+      null;
+    traefikAssetPathRegexp =
+    "^/(.*/)?"
+    + "(fav(icon)?(-[0-9]+x[0-9]+)?\\.(ico|png|svg)"
+    + "|(favicon|apple-icon)(-[0-9]+)?(\\.(ico|png))?"
+    + "|logo\\.(ico)"
+    + "|fav([0-9]+)?\\.(ico|png)"
+    + "|apple-touch-icon(-precomposed)?\\.png"
+    + "|android-chrome-[0-9]+x[0-9]+\\.png"
+    + "|mstile-[0-9]+x[0-9]+\\.png)$";
+  pythonEnv = pkgs.python3.withPackages (ps: with ps; [
+    cairosvg
+    pillow
+  ]);
+  serverScript = pkgs.writeText "favicon-server.py" ''
+    from io import BytesIO
+    import hashlib
+    import os
+    from pathlib import Path
+    import re
+    import threading
+    from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
+
+    import cairosvg
+    from PIL import Image
+
+    LOGO_PATH = ${builtins.toJSON logoSvgMount}
+    LISTEN_HOST = "0.0.0.0"
+    LISTEN_PORT = ${toString port}
+    ASSET_SIZE = ${toString assetSize}
+    CACHE_MODE = ${builtins.toJSON cacheMode}
+    CACHE_CONTROL = ${builtins.toJSON cacheControl}
+    CACHE_DIR = Path("/cache")
+
+    with open(LOGO_PATH, "rb") as fh:
+        LOGO_BYTES = fh.read()
+    MAPPINGS = ${builtins.toJSON hostMappings}
+    DEFAULT_PROFILE = ${if defaultProfile == null then "None" else builtins.toJSON defaultProfile}
+    APP_DOMAIN = (${builtins.toJSON serverCfg.domain} or "").strip().lower()
+    DEFAULT_COLORS = {"bg": "#111827", "fg": "#f8fafc"}
+    LOGO_HASH = hashlib.sha256(LOGO_BYTES).hexdigest()
+    ICON_CACHE_LOCK = threading.Lock()
+
+    def _request_host(headers):
+        host = (
+            headers.get("X-Forwarded-Host")
+            or headers.get("X-Original-Host")
+            or headers.get("Host", "")
+        )
+        return (host or "").split(",", 1)[0].split(":", 1)[0].strip().lower().rstrip(".")
+
+    def _host_candidates(host):
+        candidates = []
+
+        def add(candidate):
+            if candidate and candidate not in candidates:
+                candidates.append(candidate)
+
+        add(host)
+        if APP_DOMAIN:
+            suffix = f".{APP_DOMAIN}"
+            if host.endswith(suffix):
+                add(host[: -len(suffix)].rstrip("."))
+        if "." in host:
+            add(host.split(".", 1)[0])
+
+        return candidates
+
+    def _profile_for_host(host):
+        for candidate in _host_candidates(host):
+            profile = MAPPINGS.get(candidate)
+            if profile:
+                return candidate, profile
+        return None, DEFAULT_PROFILE
+
+    def _replace_logo_fill(svg, color):
+        svg, _ = re.subn(
+            "fill:#3193f5",
+            f"fill:{color}",
+            svg,
+            flags=re.IGNORECASE,
+        )
+        return svg
+
+    def _colors(profile):
+        profile = profile or {}
+        return {
+            "bg": profile.get("bg") or profile.get("background") or DEFAULT_COLORS["bg"],
+            "fg": profile.get("fg") or profile.get("foreground") or DEFAULT_COLORS["fg"],
+        }
+
+    def _add_background(svg, color):
+        return re.sub(
+            r"(<svg\\b[^>]*>)",
+            rf'\\1<circle cx="64" cy="64" r="64" fill="{color}"/>',
+            svg,
+            count=1,
+            flags=re.IGNORECASE,
+        )
+
+    def _render_icon(colors):
+        svg = LOGO_BYTES.decode("utf-8")
+        svg = _replace_logo_fill(svg, colors["fg"])
+        svg = _add_background(svg, colors["bg"])
+
+        png = cairosvg.svg2png(
+            bytestring=svg.encode("utf-8"),
+            output_width=ASSET_SIZE,
+            output_height=ASSET_SIZE,
+        )
+        output = BytesIO()
+        with Image.open(BytesIO(png)) as image:
+            with image.convert("RGBA") as rgba:
+                rgba.save(output, format="ICO", sizes=[(ASSET_SIZE, ASSET_SIZE)])
+        return output.getvalue()
+
+    def _cache_path(colors):
+        digest = hashlib.sha256(
+            f"{ASSET_SIZE}:{LOGO_HASH}:{colors['bg']}:{colors['fg']}".encode("utf-8")
+        ).hexdigest()
+        return CACHE_DIR / f"{digest}.ico"
+
+    def _payload_for(colors):
+        if CACHE_MODE != "disk":
+            return _render_icon(colors)
+
+        cache_path = _cache_path(colors)
+        with ICON_CACHE_LOCK:
+            if cache_path.exists():
+                return cache_path.read_bytes()
+
+        payload = _render_icon(colors)
+        with ICON_CACHE_LOCK:
+            if cache_path.exists():
+                return cache_path.read_bytes()
+            CACHE_DIR.mkdir(parents=True, exist_ok=True)
+            tmp_path = cache_path.with_suffix(".tmp")
+            tmp_path.write_bytes(payload)
+            os.replace(tmp_path, cache_path)
+            return payload
+
+    class Handler(BaseHTTPRequestHandler):
+        server_version = "favicon-router/1.0"
+
+        def _serve(self, include_body):
+            host = _request_host(self.headers)
+            matched_host, profile = _profile_for_host(host)
+            if not profile:
+                self.send_error(404, "No favicon mapping for host")
+                return
+
+            colors = _colors(profile)
+            payload = _payload_for(colors)
+            self.send_response(200)
+            self.send_header("Content-Type", "image/x-icon")
+            self.send_header("Content-Length", str(len(payload)))
+            self.send_header("Cache-Control", CACHE_CONTROL)
+            self.send_header("X-Favicon-Host", host or "default")
+            self.send_header("X-Favicon-Mapping", matched_host or "default")
+            self.end_headers()
+            if include_body:
+                self.wfile.write(payload)
+
+        def do_GET(self):
+            self._serve(include_body=True)
+
+        def do_HEAD(self):
+            self._serve(include_body=False)
+
+        def log_message(self, fmt, *args):
+            print("%s - - [%s] %s" % (self.address_string(), self.log_date_time_string(), fmt % args))
+
+    if __name__ == "__main__":
+        httpd = ThreadingHTTPServer((LISTEN_HOST, LISTEN_PORT), Handler)
+        httpd.serve_forever()
+  '';
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "favicon";
+    tag = "1";
+    contents = [
+      pythonEnv
+      pkgs.cacert
+      pkgs.tzdata
+    ];
+    config = {
+      Entrypoint = [ "${pythonEnv}/bin/python3" "-u" serverScript ];
+      ExposedPorts = { "${toString port}/tcp" = { }; };
+      WorkingDir = "/";
+    };
+  };
+in {
+  runtime = {
+    paths = [
+      {
+        path = "${serverCfg.path.config.path}/favicon";
+        mode = "0755";
+        dirs = [ "cache" ];
+      }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        imageStream = image;
+        port = port;
+        extraLabels = {
+          "traefik.enable" = "true";
+          "traefik.http.routers.${name}.entrypoints" = "web-secure";
+          "traefik.http.routers.${name}.rule" = "PathRegexp(`${traefikAssetPathRegexp}`)";
+          "traefik.http.routers.${name}.priority" = priority;
+          "traefik.http.routers.${name}.tls" = "true";
+          "traefik.http.services.${name}.loadbalancer.server.port" = toString port;
+        };
+        overrides = {
+          volumes = [
+           "${serverCfg.path.config.path}/favicon/cache:/cache"
+            "${mediaCfg.logo.svg}:${logoSvgMount}:ro"
+          ];
+        };
+      };
+    };
+  };
+}

modules/server/containers/apps/freshrss.nix

@@ -0,0 +1,61 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [
+      {
+        path = "${serverCfg.path.config.path}/freshrss";
+        owner = "1000:1000";
+        mode = "0755";
+      }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "ghcr.io/freshrss/freshrss:${version}";
+        port = 80;
+        
+        extraEnv = {
+          CRON_MIN = "5,35";
+          TRUSTED_PROXY = "10.0.0.0/8 192.168.0.1/16";
+          LISTEN = "80";
+          OIDC_ENABLED = "1";
+          OIDC_PROVIDER_METADATA_URL = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/o/freshrss/.well-known/openid-configuration";
+          OIDC_REMOTE_USER_CLAIM = "preferred_username";
+          OIDC_CLIENT_ID = "freshrss";
+          OIDC_SCOPES = "openid profile";
+          OIDC_X_FORWARDED_HEADERS = "X-Forwarded-Host X-Forwarded-Port X-Forwarded-Proto";
+        };
+
+        overrides = {
+          environmentFiles =  [ config.sops.secrets."FRESHRSS".path config.sops.secrets."CUSTOM".path ];
+          volumes = ["${serverCfg.path.config.path}/freshrss:/var/www/FreshRSS/data"];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server"; # Triggers atomic environment verification on main controller
+      envFile = [ config.sops.secrets."FRESHRSS".path config.sops.secrets."CUSTOM".path];
+      script = pkgs.writeShellScript "setup-freshrss" ''
+
+        RSS="${pkgs.podman}/bin/podman --events-backend=none exec -u www-data freshrss-server"
+        $RSS ./cli/prepare.php
+        $RSS ./cli/do-install.php --default-user $DEFAULT_ADMIN_USERNAME --auth-type http_auth --base-url https://${containerCfg.subdomain}.${serverCfg.domain} --language en \
+          --title RSS --api-enabled --db-type pgsql --db-host ${builder.host} --db-user freshrss_user --db-password $DB_PASSWORD --db-base freshrss_db
+        $RSS ./cli/create-user.php --user $DEFAULT_ADMIN_USERNAME --password $DEFAULT_ADMIN_PASSWORD --email $DEFAULT_ADMIN_EMAIL
+        $RSS ./cli/reconfigure.php
+        # $RSS ./cli/access-permissions.sh
+        
+      '';
+    };
+  };
+}

modules/server/containers/apps/frigate.nix

@@ -0,0 +1,96 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+  
+  # Ensure the package is available (Nixpkgs includes frigate)
+  frigatePkg = pkgs.frigate;
+
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = "frigate";
+    tag = frigatePkg.version;
+    contents = [ 
+      pkgs.bashInteractive 
+      frigatePkg
+      pkgs.ffmpeg # Explicitly included for video stream processing
+    ];
+    config = {
+      Entrypoint = [ "${frigatePkg}/bin/frigate" ];
+      Cmd = [ "start" ];
+      ExposedPorts = {
+        "5000/tcp" = {}; # Web UI / API
+        "8554/tcp" = {}; # RTSP Feeds
+        "8555/tcp" = {}; # WebRTC
+      };
+      Env = [
+        "FRIGATE_RTSP_PASSWORD=secret" # Base fallback, overridden by envFile/sops
+      ];
+    };
+  };
+in {
+  requires.secrets = [ name ];
+
+  runtime = {
+    paths = [
+      {
+        path = "${serverCfg.path.config.path}/frigate/";
+        mode = "0755";
+      }
+      {
+        path = "/var/lib/frigate/storage/";
+        mode = "0755"; # Dedicated path for heavy video recordings and media
+      }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 5000;
+        secret = name;
+        extraEnv = {
+          PLUS_API_KEY = ""; # Optional: For Frigate Plus users
+        };
+        overrides = {
+          cmd = [ ];
+          volumes = [
+            "${serverCfg.path.config.path}/frigate:/config"
+            "/var/lib/frigate/storage:/media/frigate"
+            "/dev/bus/usb:/dev/bus/usb" # Passes Google Coral USB TPU to the container
+            "/dev/dri:/dev/dri"         # Passes Intel/AMD GPU for hardware video decoding
+          ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."FRIGATE_ENV".path;
+      script = pkgs.writeShellScript "setup-frigate" ''
+        mkdir -p "${serverCfg.path.config.path}/frigate"
+        mkdir -p "/var/lib/frigate/storage"
+        
+        # Bootstrap a standard configuration layout if missing
+        if [ ! -f "${serverCfg.path.config.path}/frigate/config.yml" ]; then
+          cat <<EOF > "${serverCfg.path.config.path}/frigate/config.yml"
+mqtt:
+  enabled: False # Set to True and define host if connecting to Home Assistant
+
+database:
+  path: /config/frigate.db
+
+cameras:
+  dummy_camera: # Replace with your actual RTSP stream details
+    enabled: false
+    ffmpeg:
+      inputs:
+        - path: rtsp://127.0.0.1:554/live
+          roles:
+            - detect
+    detect:
+      enabled: false
+EOF
+        fi
+      '';
+    };
+  };
+}

modules/server/containers/apps/gitea.nix

@@ -0,0 +1,145 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  version = "latest";
+  serverCfg = config.syscfg.server;
+
+  LDAP_DC_DOMAIN = "dc=ldap," + (lib.concatMapStringsSep "," (x: "dc=${x}") (lib.splitString "." serverCfg.domain));
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.data.path}/gitea";
+      owner = "1000:1000";
+      dirs = ["data" "runner"];
+      mode = "0755";
+    }];
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "gitea/gitea:${version}";
+        port = 8080;
+        secret = name;
+        
+        extraEnv = { # app.ini -> GITEA__<section>__<KEY> = "<VALUE>";
+          GITEA__DEFAULT__APP_NAME = if(containerCfg.extra ? name) then containerCfg.extra.name else "Gitea";
+          GITEA__repository__DISABLED_REPO_UNITS = "repo.ext_issues,repo.ext_wiki";
+          GITEA__repository__DISABLE_STARS = "true";
+          GITEA__repository__DEFAULT_MERGE_STYLE = "squash";
+          # GITEA__ui__THEMES = "";
+          # GITEA__ui__DEFAULT_THEME = "";
+
+          # GITEA__security__SECRET_KEY = "SECRET_ENV";
+          # GITEA__security__INTERNAL_TOKEN = "SECRET_ENV";
+          # GITEA__database__PASSWD = "SECRET_ENV";
+          # GITEA__mailer__PASSWD="SECRET_ENV";
+
+          GITEA__database__DB_TYPE = "postgres"; 
+          GITEA__database__HOST = builder.host;
+          GITEA__database__NAME = "gitea_db";
+          GITEA__database__USER = "gitea_user";
+
+
+          GITEA__mailer__ENABLED = "true";
+          GITEA__mailer__FROM = "";
+          GITEA__mailer__PROTOCOL = "smtps";
+          GITEA__mailer__SMTP_ADDR = "";
+          GITEA__mailer__SMTP_PORT = "";
+          GITEA__mailer__USER= "";
+
+          GITEA__server__DOMAIN = "${containerCfg.subdomain}.${serverCfg.domain}";
+          GITEA__server__ROOT_URL = "https://${containerCfg.subdomain}.${serverCfg.domain}/";
+          GITEA__server__PROTOCOL = "http";
+          GITEA__server__HTTP_PORT = "8080";
+          GITEA__server__LFS_START_SERVER = "true";
+          GITEA__security__INSTALL_LOCK = "true";
+
+        } // ( if serverCfg.containers?authentik then {
+          GITEA__service__ENABLE_BASIC_AUTHENTICATION = "false";
+          GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION = "true";
+          GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION_API = "true";
+          GITEA__service__ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = "true";
+          GITEA__service__ENABLE_REVERSE_PROXY_EMAIL = "true";
+          GITEA__service__ENABLE_REVERSE_PROXY_FULL_NAME = "true";
+          GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION = "true";
+          GITEA__security__REVERSE_PROXY_LOGOUT_REDIRECT = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/outpost.goauthentik.io/sign_out";
+          GITEA__security__REVERSE_PROXY_AUTHENTICATION_USER = "X-authentik-username";
+          GITEA__security__REVERSE_PROXY_AUTHENTICATION_EMAIL = "X-authentik-email";
+          GITEA__security__REVERSE_PROXY_AUTHENTICATION_FULL_NAME = "X-authentik-name";
+          GITEA__security__RREVERSE_PROXY_LIMIT = "1";
+          GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES = "127.0.0.0/8,::1/128,10.0.0.0/8";
+        } else {});
+        extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}-login.rule" = "Host(`${containerCfg.subdomain}.${serverCfg.domain}`) && Path(`/user/login`) ";
+          "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if (serverCfg.containers?authentik && containerCfg.extra?proxyauth) then "authentik" else "";
+          "traefik.http.routers.${containerCfg.subdomain}-login.priority" = "100";
+          "traefik.http.routers.${containerCfg.subdomain}-login.entrypoints" = "web-secure";
+          "traefik.http.routers.${containerCfg.subdomain}-login.tls" = "true";
+        };
+
+        overrides = {
+          volumes = [
+            "${serverCfg.path.data.path}/gitea/data:/data"
+          ];
+          ports = [ "2222:22" ]; 
+        };
+      };
+
+      runner = builder.mkContainer {
+        image = "gitea/act_runner:${version}";
+        secret = name;
+        extraEnv = { 
+          #CONFIG_FILE="/data/config.yml";
+          GITEA_INSTANCE_URL="https://${containerCfg.subdomain}.${serverCfg.domain}";
+          GITHUB_INSTANCE_URL="https://${containerCfg.subdomain}.${serverCfg.domain}";
+        };
+
+        overrides = {
+          volumes = [
+            "${serverCfg.path.data.path}/gitea/runner:/data"
+            "/var/run/podman/podman.sock:/var/run/docker.sock"
+          ];
+        };
+      };
+    };
+
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."CUSTOM".path;
+      script = pkgs.writeShellScript "setup" ''
+        # Define the command wrapper
+        GT="${pkgs.podman}/bin/podman --events-backend=none exec -u git gitea-server gitea"
+        GTR="${pkgs.podman}/bin/podman --events-backend=none exec -u git gitea-runner ./act_runner"
+
+        $GT admin user create --username "$DEFAULT_ADMIN_USERNAME" --password "$DEFAULT_ADMIN_PASSWORD" --email "$DEFAULT_ADMIN_EMAIL" --admin || true
+
+        touch ${serverCfg.path.data.path}/gitea/data-runner/config.yml
+
+        RUNNER_TOKEN=$($GT actions generate-runner-token)
+        $GTR register \
+          --instance "https://${containerCfg.subdomain}.${serverCfg.domain}" \
+          --token "$RUNNER_TOKEN" \
+          --name "Runner" \
+          --labels "ubuntu-latest:docker://catthehacker/ubuntu:act-latest" \
+          --no-interactive
+
+
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        $GT admin auth add-ldap --name Authentik --host authentik-ldap --port 6636 --security-protocol ldaps --skip-tls-verify \
+            --bind-dn "cn=ldap-service,ou=users,${LDAP_DC_DOMAIN}" --bind-password $DEFAULT_LDAP_PASSWORD \
+            --user-search-base "ou=users,${LDAP_DC_DOMAIN}" \
+            --user-filter "(&(objectClass=user)(|(uid=%[1]s)(mail=%[1]s)))" \
+            --admin-filter "(memberOf=cn=admin,ou=groups,${LDAP_DC_DOMAIN})" \
+            --username-attribute "username" --firstname-attribute "givenName" --surname-attribute "sn" --email-attribute "mail" \
+            --synchronize-users
+        ''}
+
+        echo "Completed Gitea Setup"
+      '';
+    };
+  };
+}

modules/server/containers/apps/handbrake.nix

@@ -0,0 +1,48 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  version = "latest";
+in {
+  runtime = {
+    paths = [{
+      path = "${serverCfg.path.config.path}/handbrake";
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        authentik = true;
+        tmpfs = true;
+        subdomain = containerCfg.subdomain;
+        subpath = containerCfg.subpath;
+        image = "ghcr.io/jlesage/handbrake:${version}";
+        port = 5800;
+        
+        extraEnv = {
+          USER_ID = "1000";
+          GROUP_ID = "1000";
+          AUTOMATED_CONVERSION_PRESET = "Custom/AV1 MKV 1080p30";
+          AUTOMATED_CONVERSION_FORMAT = "mkv";
+          AUTOMATED_CONVERSION_OUTPUT_SUBDIR = "SAME_AS_SRC";
+        };
+        
+        overrides = {
+          volumes = [
+            "${serverCfg.path.config.path}/handbrake:/config:rw"
+            "${serverCfg.path.dlComplete.path}:/watch:rw"
+            "${serverCfg.path.dlConverted.path}:/output:rw"
+          ];
+         };
+      };
+    };
+
+    
+    setup = {
+      trigger = "server";
+      script = pkgs.writeShellScript "setup" ''
+          mkdir -p ${serverCfg.path.data.path}/handbrake/{watch,output}
+
+      '';
+    };
+  };
+}

modules/server/containers/apps/homeassistant.nix

@@ -0,0 +1,102 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  version = "latest";
+  serverCfg = config.syscfg.server;
+  
+in {
+  runtime = {
+    vm = {
+      portForward = [ 8123 ];
+      cfg = {cfg,...}: {
+        services.home-assistant = {
+          enable = true;
+          openFirewall = true;
+          
+          extraComponents = [
+            "matter" "thread" "cast" "zha"
+            "default_config" "met" "esphome" "radio_browser"
+            "telegram_bot" "swiss_public_transport" "nextcloud" "jellyfin" 
+          ]  ++ (if containerCfg.extra ? components then containerCfg.extra.components else []);
+          
+
+          extraPackages = pp: with pp; [
+              python-telegram gtts
+          ];
+          lovelaceConfig = {};
+
+          config = {
+            homeassistant = {
+              name = "Home";
+              latitude = "${if containerCfg.extra ? latitude then toString containerCfg.extra.latitude else toString 0}";
+              longitude = "${if containerCfg.extra ? longitude then toString containerCfg.extra.longitude else toString 0}";
+              elevation = "${if containerCfg.extra ? elevation then toString containerCfg.extra.elevation else toString 0}";
+              unit_system = "metric";
+              time_zone = config.time.timeZone;
+            };
+            lovelace = { mode = "yaml"; };
+            customLovelaceModules = [];
+            
+            # default_config = {};
+            http = {
+              use_x_forwarded_for = true;
+              trusted_proxies = [ "10.0.0.0/8" "127.0.0.1" ];
+            };
+          };
+        };
+      };
+    };
+
+    containers = {
+      dummy = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "alpine:latest";
+        extraLabels = {
+          "traefik.http.services.${containerCfg.subdomain}.loadbalancer.server.url" = "http://${builder.hostIp}:8123";
+        };
+        overrides = {cmd = [ "sleep" "infinity" ];};
+      };
+    };
+
+    setup = {
+      trigger = "dummy";
+      envFile = config.sops.secrets."CUSTOM".path;
+      script = pkgs.writeShellScript "setup" ''
+
+    HASS_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+    until [[ "$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$HASS_URL/manifest.json")" =~ (200|301|302) ]]; do
+      sleep 5
+    done
+    sleep 5
+
+    ONBOARDING_STATUS=$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$HASS_URL/api/onboarding" 2>/dev/null || echo "000")
+
+    if [ "$ONBOARDING_STATUS" = "200" ]; then
+      AUTH_CODE=$( ${pkgs.curl}/bin/curl -s -X POST "$HASS_URL/api/onboarding/users" \
+        -H "Content-Type: application/json" \
+        -d '{"client_id":"'"$HASS_URL"'","name":"'"$DEFAULT_ADMIN_USERNAME"'","username":"'"$DEFAULT_ADMIN_USERNAME"'","password":"'"$DEFAULT_ADMIN_PASSWORD"'","language":"en"}' \
+        | ${pkgs.jq}/bin/jq -r '.auth_code' )
+
+      ACCESS_TOKEN=$(${pkgs.curl}/bin/curl -s -X POST "$HASS_URL/auth/token" \
+          -H "Content-Type: application/x-www-form-urlencoded" \
+          -d "grant_type=authorization_code&code=$AUTH_CODE&client_id=$HASS_URL" \
+      | ${pkgs.jq}/bin/jq -r '.access_token' )    
+
+      ${pkgs.curl} -s -X POST "$HASS_URL/api/onboarding/core_config" \
+          -H "Authorization: Bearer $ACCESS_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d '{"time_zone":"${config.time.timeZone}"}' > /dev/null 2>&1 || true
+      # We can configure many more things above !
+
+      ${pkgs.curl} -s -X POST "$HASS_URL/api/onboarding/analytics" \
+          -H "Authorization: Bearer $ACCESS_TOKEN" \
+          -H "Content-Type: application/json" -d '{}' > /dev/null 2>&1 || true
+
+      ${pkgs.curl} -s -X POST "$HASS_URL/api/onboarding/integration" \
+          -H "Authorization: Bearer $ACCESS_TOKEN" \
+          -H "Content-Type: application/json" \
+          -d '{"client_id":"'"$HASS_URL"'","redirect_uri":"'"$HASS_URL"'/?auth_callback=1"}' > /dev/null 2>&1 || true
+    fi
+      '';
+    };
+  };
+}

modules/server/containers/apps/homepage.nix

@@ -0,0 +1,402 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let
+  version = "latest";
+  serverCfg = config.syscfg.server;
+  mediaCfg = config.syscfg.media;
+  homepageExtra = containerCfg.extra or {};
+  backgroundImage = if mediaCfg.banner.png != null then mediaCfg.banner.png else mediaCfg.bg;
+  backgroundFileName = builtins.baseNameOf (toString backgroundImage);
+  backgroundMount = "/app/public/media/${backgroundFileName}";
+  latitude =
+    if homepageExtra ? latitude then homepageExtra.latitude
+    else if homepageExtra ? lat then homepageExtra.lat
+    else 47.3769;
+  longitude =
+    if homepageExtra ? longitude then homepageExtra.longitude
+    else if homepageExtra ? lon then homepageExtra.lon
+    else 8.5417;
+  extraBookmarks = homepageExtra.bookmarks or [];
+  extraServices = homepageExtra.services or [];
+
+  settings = pkgs.writers.writeYAML "settings.yaml" {
+    title = "Home";
+    description = "";
+    startUrl = "https://${containerCfg.subdomain}.${serverCfg.domain}";
+    background = {
+      image = "/media/${backgroundFileName}";
+      brightness = 50;
+      opacity = 0.5;
+      blur = "";
+    };
+    cardBlur = "xs";
+    favicon = "https://${containerCfg.subdomain}.${serverCfg.domain}/favicon.ico";
+    theme = "dark";
+    color = "slate";
+    fullWidth = true;
+    useEqualHeights = true;
+    pwa = { };
+    layout = {
+      Admin = {
+        initiallyCollapsed = true;
+        style = "row";
+        columns = 4;
+      };
+    };
+    bookmarksStyle = "icons";
+    providers = {
+      finnhub = "{{HOMEPAGE_VAR_FINNHUB}}";
+    };
+    headerStyle = "clean";
+    hideVersion = true;
+    disableUpdateCheck = true;
+    showStats = false;
+    statusStyle = "dot";
+    hideErrors = true;
+  };
+
+  widgets = pkgs.writers.writeYAML "widgets.yaml" [
+    { openmeteo = {
+        latitude = toString latitude;
+        longitude = toString longitude;
+        timezone = config.time.timeZone;
+        units = "metric";
+        cache = "15";
+      };
+    }
+    { search = {
+        provider = "custom";
+        focus = true;
+        showSearchSuggestions = true;
+        target = "_blank";
+      } // (lib.optionalAttrs (serverCfg.containers ? searxng) {
+        url = "https://${serverCfg.containers.searxng.subdomain}.${serverCfg.domain}/search?q=";
+        suggestionUrl = "https://${serverCfg.containers.searxng.subdomain}.${serverCfg.domain}/autocompleter?q=";
+      });
+    }
+    { stocks = {
+        provider = "finnhub";
+        color = true;
+        cache = 15;
+        watchlist = homepageExtra.stocks or [];
+      };
+    }
+  ];
+
+  bookmarks = pkgs.writers.writeYAML "bookmarks.yaml"  (extraBookmarks);
+
+  services = pkgs.writers.writeYAML "services.yaml" ([
+    { Media = lib.flatten [
+        (lib.optional (serverCfg.containers ? jellyfin) {
+          Jellyfin = {
+            icon = "jellyfin.png";
+            href = "https://${serverCfg.containers.jellyfin.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://jellyfin-server:8096";
+            # widget = {
+            #   type = "jellyfin";
+            #   url = "http://jellyfin-server:8096";
+            #   key = "{{HOMEPAGE_VAR_JELLYFIN_API}}";
+            # };
+          };
+        })
+        (lib.optional (serverCfg.containers ? invidious) {
+          Invidious = {
+            icon = "invidious.png";
+            href = "https://${serverCfg.containers.invidious.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://invidious-server:3000";
+          };
+        })
+        (lib.optional (serverCfg.containers ? calibre) {
+          Calibre = {
+            icon = "calibre.png";
+            href = "https://${serverCfg.containers.calibre.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://calibre-server:8083";
+            # widget = {
+            #   type = "calibreweb";
+            #   url = "http://calibre-server:8083";
+            #   username = "?";
+            #   password = "?";
+            # };
+          };
+        })
+        (lib.optional (serverCfg.containers ? freshrss) {
+          FreshRSS = {
+            icon = "freshrss.png";
+            href = "https://${serverCfg.containers.freshrss.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://freshrss-server:80";
+            # widget = {
+            #   type = "freshrss";
+            #   url = "http://freshrss-server:80";
+            #   username = "?";
+            #   password = "?";
+            # };
+          };
+        })
+        (lib.optional (serverCfg.containers ? miniflux) {
+          Miniflux = {
+            icon = "miniflux.png";
+            href = "https://${serverCfg.containers.miniflux.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://miniflux-server:80";
+            # widget = {
+            #   type = "miniflux";
+            #   url = "http://miniflux-server";
+            #   key = "{{HOMEPAGE_VAR_MINIFLUX_API}}";
+            # };
+          };
+        })
+        (lib.optional (serverCfg.containers ? suwayomi) {
+          Suwayomi = {
+            icon = "suwayomi.png";
+            href = "https://${serverCfg.containers.suwayomi.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://suwayomi-server:4567";
+            # widget = {
+            #   type = "suwayomi";
+            #   url = "http://suwayomi-server:4567";
+            # };
+          };
+        })
+      ];
+    }
+    { Cloud = lib.flatten [
+        (lib.optional (serverCfg.containers ? nextcloud) {
+          Nextcloud = {
+            icon = "nextcloud.png";
+            href = "https://${serverCfg.containers.nextcloud.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://nextcloud-server:80";
+            # widget = {
+            #   type = "nextcloud";
+            #   url = "http://nextcloud-server:80";
+            #   key = "{{HOMEPAGE_VAR_NEXTCLOUD_API}}";
+            # };
+          };
+        })
+        (lib.optional (serverCfg.containers ? ethercalc) {
+          Ethercalc = {
+            icon = "ethercalc.png";
+            href = "https://${serverCfg.containers.ethercalc.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://ethercalc-server:8080";
+          };
+        })
+        (lib.optional (serverCfg.containers ? etherpad) {
+          Etherpad = {
+            icon = "etherpad.png";
+            href = "https://${serverCfg.containers.etherpad.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://etherpad-server:8080";
+          };
+        })
+        (lib.optional (serverCfg.containers ? collabora && false) {
+          Collabora = {
+            icon = "microsoft-office.png";
+            href = "https://${serverCfg.containers.collabora.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://collabora-server:9980";
+          };
+        })
+        (lib.optional (serverCfg.containers ? immich) {
+          Immich = {
+            icon = "immich.png";
+            href = "https://${serverCfg.containers.immich.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://immich-server:2283";
+            # widget = {
+            #   type = "immich";
+            #   url = "http://immich-server:2283";
+            #   key = "{{HOMEPAGE_VAR_IMMICH_API}}";
+            #   version = "2";
+            # };
+          };
+        })
+      ];
+    }
+    { Home = lib.flatten [
+        (lib.optional (serverCfg.containers ? homeassistant) {
+          "Home Assistant" = {
+            icon = "home-assistant.png";
+            href = "https://${serverCfg.containers.homeassistant.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://${builder.hostIp}:8123";
+          };
+        })
+        (lib.optional (serverCfg.containers ? openhab) {
+          openHAB = {
+            icon = "openhab.png";
+            href = "https://${serverCfg.containers.openhab.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://openhab-server:8080";
+          };
+        })
+        (lib.optional (serverCfg.containers ? frigate) {
+          Frigate = {
+            icon = "frigate.png";
+            href = "https://${serverCfg.containers.frigate.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://frigate-server:5000";
+          };
+        })
+      ];
+    }
+    { Dev = lib.flatten [
+        (lib.optional (serverCfg.containers ? gitea) {
+          Gitea = {
+            icon = "gitea.png";
+            href = "https://${serverCfg.containers.gitea.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://gitea-server:8080";
+            # widget = {
+            #   type = "gitea";
+            #   url = "http://gitea-server:8080";
+            #   key = "{{HOMEPAGE_VAR_GITEA_API}}";
+            # };
+          };
+        })
+        (lib.optional (serverCfg.containers ? trmnl) {
+          TRMNL = {
+            icon = "terminal.png";
+            href = "https://${serverCfg.containers.trmnl.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://trmnl-server:8080";
+          };
+        })
+      ];
+    }
+    { Admin = lib.flatten [
+        (lib.optional (serverCfg.containers ? traefik) {
+          Traefik = {
+            icon = "traefik.png";
+            href = "https://${serverCfg.containers.traefik.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://traefik-server:8080";
+            # widget = {
+            #   type = "traefik";
+            #   url = "http://traefik-server:8080";
+            # };
+          };
+        })
+        (lib.optional (serverCfg.containers ? authentik) {
+          Authentik = {
+            icon = "authentik.png";
+            href = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://authentik-server:9000";
+            # widget = {
+            #   type = "authentik";
+            #   url = "http://authentik-server:9000";
+            #   key = "{{HOMEPAGE_VAR_AUTHENTIK_API}}";
+            #   version = "2";
+            # };
+          };
+        })
+        (lib.optional (serverCfg.containers ? umami) {
+          Umami = {
+            icon = "umami.png";
+            href = "https://${serverCfg.containers.umami.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://umami-server:3000";
+          };
+        })
+        (lib.optional (serverCfg.containers ? influx) {
+          Influx = {
+            icon = "grafana.png";
+            href = "https://${serverCfg.containers.influx.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://influx-ui:3000";
+          };
+        })
+        (lib.optional (serverCfg.containers ? handbrake) {
+          Handbrake = {
+            icon = "handbrake.png";
+            href = "https://${serverCfg.containers.handbrake.subdomain}.${serverCfg.domain}";
+            siteMonitor = "http://handbrake-server:5800";
+          };
+        })
+        (lib.optional (serverCfg.containers ? transmission) {
+          Transmission = {
+            icon = "transmission.png";
+            href = "https://${serverCfg.containers.transmission.subdomain}.${serverCfg.domain}/transmission";
+            siteMonitor = "http://transmission-server:9091";
+            # widget = {
+            #   type = "transmission";
+            #   url = "http://transmission-server:9091";
+            #   rpcUrl = "/transmission/";
+            # };
+          };
+        })
+        (lib.optional (serverCfg.containers ? selfmark) {
+          Selfmark = {
+            icon = "link.png";
+            href = "https://${serverCfg.containers.selfmark.subdomain}.${serverCfg.domain}/selfmark";
+            siteMonitor = "http://selfmark-server:8080/selfmark";
+          };
+        })
+        (lib.optional (serverCfg.containers ? servarr) (
+          let
+            modules = serverCfg.containers.servarr.extra.modules or [ "prowlarr" "sonarr" "radarr" "flaresolverr" ];
+          in
+            (lib.optional (builtins.elem "sonarr" modules) {
+              Sonarr = {
+                icon = "sonarr.png";
+                href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/sonarr";
+                siteMonitor = "http://servarr-sonarr:8989/sonarr";
+                # widget = {
+                #   type = "sonarr";
+                #   url = "http://servarr-sonarr:8989/sonarr";
+                #   key = "{{HOMEPAGE_VAR_SONARR_API}}";
+                # };
+              };
+            })
+            ++ (lib.optional (builtins.elem "radarr" modules) {
+              Radarr = {
+                icon = "radarr.png";
+                href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/radarr";
+                siteMonitor = "http://servarr-radarr:8989/radarr";
+                # widget = {
+                #   type = "radarr";
+                #   url = "http://servarr-radarr:8989/radarr";
+                #   key = "{{HOMEPAGE_VAR_RADARR_API}}";
+                # };
+              };
+            })
+            ++ (lib.optional (builtins.elem "lidarr" modules) {
+              Lidarr = {
+                icon = "lidarr.png";
+                href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/lidarr";
+                siteMonitor = "http://servarr-lidarr:8989/lidarr";
+                # widget = {
+                #   type = "lidarr";
+                #   url = "http://servarr-lidarr:8989/lidarr";
+                #   key = "{{HOMEPAGE_VAR_LIDARR_API}}";
+                # };
+              };
+            })
+            ++ (lib.optional (builtins.elem "prowlarr" modules) {
+              Prowlarr = {
+                icon = "prowlarr.png";
+                href = "https://${serverCfg.containers.servarr.subdomain}.${serverCfg.domain}/prowlarr";
+                siteMonitor = "http://servarr-prowlarr:8989/prowlarr";
+                # widget = {
+                #   type = "prowlarr";
+                #   url = "http://servarr-prowlarr:8989/prowlarr";
+                #   key = "{{HOMEPAGE_VAR_PROWLARR_API}}";
+                # };
+              };
+            })
+        ))
+      ];
+    }
+  ] ++ extraServices);
+in {
+  runtime = {
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "ghcr.io/gethomepage/homepage:${version}";
+        port = 3000;
+        extraEnv = {
+          HOMEPAGE_VAR_TITLE = "${serverCfg.domain}";
+          HOMEPAGE_ALLOWED_HOSTS = "${containerCfg.subdomain}.${serverCfg.domain},${builder.host}";
+        };
+        extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}.service" = "${containerCfg.subdomain}";
+        };
+        overrides = {
+          environmentFiles = [ config.sops.secrets."CUSTOM".path ];
+          volumes = [
+            "${settings}:/app/config/settings.yaml:ro"
+            "${services}:/app/config/services.yaml:ro"
+            "${widgets}:/app/config/widgets.yaml:ro"
+            "${bookmarks}:/app/config/bookmarks.yaml:ro"
+            "${backgroundImage}:${backgroundMount}:ro"
+          ];
+        };
+      };
+    };
+  };
+}

modules/server/containers/apps/immich.nix

@@ -0,0 +1,106 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  version = "v2";
+  serverCfg = config.syscfg.server;
+
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path = "${serverCfg.path.config.path}/immich";
+      dirs = ["cache" "thumbs" "encoded-video"];
+      mode = "0755";
+    }{
+      path = "${serverCfg.path.data.path}/immich/";
+      dirs = ["backups"];
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "ghcr.io/immich-app/immich-server:${version}";
+        port = 2283;
+        secret = name;
+        extraEnv = {
+          DB_HOSTNAME = builder.host;
+          REDIS_HOSTNAME = builder.host;
+          DB_USERNAME = "immich_user";
+          DB_DATABASE_NAME = "immich_db";
+          IMMICH_TRUSTED_PROXIES = "10.0.0.0/8";
+          IMMICH_MACHINE_LEARNING_URL = "http://immich-ml:3003";
+          # IMMICH_ALLOW_SETUP = "false";
+          IMMICH_IGNORE_MOUNT_CHECK_ERRORS = "true";
+        };
+        overrides = {
+          volumes = [
+            "${serverCfg.path.photo.path}:/data/upload"
+            "${serverCfg.path.data.path}/immich/backups:/data/backups"
+            "${serverCfg.path.config.path}/immich/thumbs:/data/thumbs"
+            "${serverCfg.path.config.path}/immich/encoded-video:/data/encoded-video"
+          ];
+        };
+      };
+
+      ml = builder.mkContainer {
+        image = "ghcr.io/immich-app/immich-machine-learning:${version}";
+        port = 3003;
+        overrides = {
+          volumes = [
+            "${serverCfg.path.config.path}/immich/cache:/cache"
+          ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."CUSTOM".path;
+      script = pkgs.writeShellScript "setup" ''
+          PSQL="${pkgs.postgresql}/bin/psql -U postgres"
+          $PSQL -d "immich_db" -tAc "CREATE EXTENSION IF NOT EXISTS vchord CASCADE;"
+          $PSQL -d "immich_db" -tAc "CREATE EXTENSION IF NOT EXISTS earthdistance CASCADE;"
+          $PSQL -d "immich_db" -tAc "ALTER EXTENSION vchord UPDATE;"
+          $PSQL -d "immich_db" -tAc "ALTER EXTENSION earthdistance UPDATE;"
+
+          IMMICH_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+          until [[ "$(${pkgs.curl}/bin/curl -s -o /dev/null -w "%{http_code}" "$IMMICH_URL")" =~ (200|301|302) ]]; do
+            sleep 5
+          done
+          ${pkgs.curl}/bin/curl -X POST "$IMMICH_URL/api/auth/admin-sign-up" \
+            -H "Content-Type: application/json" -H "Accept: application/json" \
+            -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'", "name": "'"$DEFAULT_ADMIN_USERNAME"'" }'
+
+          IMMICH_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$IMMICH_URL/api/auth/login" \
+          -H "Content-Type: application/json" \
+          -d '{ "email": "'"$DEFAULT_ADMIN_EMAIL"'", "password": "'"$DEFAULT_ADMIN_PASSWORD"'"}' \
+          | ${pkgs.jq}/bin/jq -r '.accessToken')        
+
+          ${lib.optionalString (serverCfg.containers ? authentik) ''
+          ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+          ${pkgs.jq}/bin/jq '.oauth.enabled = true | 
+                            .oauth.autoRegister = true |
+                            .oauth.autoLaunch = true |
+                            .oauth.signingAlgorithm = "RS256" |
+                            .oauth.profileSigningAlgorithm = "RS256" |
+                            .oauth.clientId = "immich" | 
+                            .oauth.clientSecret = "'"$IMMICH_OAUTH_SECRET"'" | 
+                            .oauth.issuerUrl = "https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/o/immich/" | 
+                            .oauth.scope = "openid profile email" |
+                            .oauth.buttonText = "Login with SSO"' | \
+          ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+          ''}
+
+          ${pkgs.curl}/bin/curl -s -X GET "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" | \
+          ${pkgs.jq}/bin/jq '.storageTemplate.enable = true |
+                            .storageTemplate.template = "{{y}}/{{#if album}}{{album}}{{else}}{{MM}}{{/if}}/{{filename}}"' | \
+          ${pkgs.curl}/bin/curl -s -X PUT "$IMMICH_URL/api/system-config" -H "Cookie: immich_access_token=$IMMICH_TOKEN; immich_auth_type=password; immich_is_authenticated=true" -H "Content-Type: application/json" -d @-
+          
+      '';
+    };
+  };
+}

modules/server/containers/apps/influx.nix

@@ -0,0 +1,148 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+  version = "latest";
+
+  influxSource = pkgs.writers.writeYAML "influx.yaml" {
+  apiVersion = 1;
+  datasources = [
+    {
+      name = "Telegraf";
+      type = "influxdb";
+      access = "proxy";
+      url = "http://influx-db:8181";
+      jsonData = {
+        version = "SQL";
+        dbName = "telegraf";
+        httpMode = "POST";
+        insecureGrpc = true;
+      };
+      secureJsonData = {
+        token = "\${INFLUXDB_TOKEN}"; 
+      };
+      isDefault = true;
+      editable = true;
+    }
+  ];
+};
+
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path = "${serverCfg.path.config.path}/influxdb/";
+      owner = "1500:1500";
+      mode = "0755"; 
+    }{
+      path = "${serverCfg.path.data.path}/influxdb/";
+      dirs = ["data" "ui"];
+      owner = "1500:1500";
+      mode = "0755"; 
+    }];
+
+    containers = {
+      db = builder.mkContainer {
+        image = "influxdb:3-core";
+        secret = name;
+        extraEnv = {
+          INFLUXD_DB_PATH = "/db";
+          INFLUXD_CONFIG_PATH = "/config";
+        };
+        overrides = {
+          cmd = [ "influxdb3" "serve" "--node-id=node0" "--data-dir=/var/lib/influxdb3/data" "--admin-token-file=/var/lib/influxdb3/token.json" ];
+          ports = [ "8181:8181" ];
+          volumes = [
+            "${serverCfg.path.data.path}/influxdb/data:/var/lib/influxdb3/data:rw"
+            "${serverCfg.path.config.path}/influxdb/admin-token.json:/var/lib/influxdb3/token.json:ro"
+
+          ];
+        };
+      };
+
+      ui = if(containerCfg.extra?explorer) then builder.mkContainer {
+        tmpfs = true;
+        authentik = true;
+        subdomain = containerCfg.subdomain;
+        image = "influxdata/influxdb3-ui:${version}";
+        port = 8080; # 8888 is something else
+        secret = name;
+        extraEnv = {
+          DATABASE_URL = "/db/sqlite.db"; 
+          DEFAULT_INFLUX_SERVER = "http://${builder.host}:8181";
+        };
+        overrides = {
+          cmd = [ "--mode=admin" ]; 
+          volumes = [
+            "${serverCfg.path.data.path}/influxdb/ui:/db:rw"
+            "${serverCfg.path.config.path}/influxdb/:/app-root/config:rw"
+          ];
+        };
+      } else builder.mkContainer {
+        tmpfs = true;
+        authentik = true;
+        subdomain = containerCfg.subdomain;
+        image = "grafana/grafana:${version}";
+        port = 3000;
+        extraEnv = {
+          GF_SERVER_ROOT_URL = "https://${containerCfg.subdomain}.${serverCfg.domain}";
+          GF_DEFAULT_INSTANCE_NAME = serverCfg.domain;
+          GF_SECURITY_ADMIN_USER = "\${DEFAULT_ADMIN_USERNAME}"; 
+          GF_SECURITY_ADMIN_PASSWORD = "\${DEFAULT_ADMIN_PASSWORD}";
+          GF_SECURITY_ADMIN_EMAIL = "\${DEFAULT_ADMIN_EMAIL}";
+          GF_SECURITY_COOKIE_SECURE = "true";
+          GF_USERS_ALLOW_SIGN_UP = "false";
+          GF_USERS_AUTO_ASSIGN_ORG = "true";
+          GF_USERS_AUTO_ASSIGN_ORG_ROLE = "true";
+          GF_AUTH_PROXY_ENABLED = "true";
+          GF_AUTH_PROXY_HEADER_NAME = "X-authentik-username";
+          GF_AUTH_PROXY_HEADER_PROPERTY = "username";
+          GF_AUTH_PROXY_AUTO_SIGN_UP = "true";
+          GF_DATABASE_TYPE = "postgres";
+          GF_DATABASE_HOST = "${builder.host}";
+          GF_DATABASE_NAME = "influx_db";
+          GF_DATABASE_USER = "influx_user";
+          GF_ANALYTICS_REPORTING_ENABLED = "false";
+          GF_CHECK_FOR_UPDATED = "false";
+          GF_LIVE_HA_ENGINE = "redis";
+          GF_LIVE_HA_ENGINE_ADRESS = "${builder.host}:6379";
+          DEFAULT_INFLUX_SERVER = "http://${builder.host}:8181";
+        };
+        overrides = { 
+          user = "1500:1500";
+          environmentFiles =  [ config.sops.secrets."INFLUX".path config.sops.secrets."CUSTOM".path ] ;
+          volumes = [
+            "${serverCfg.path.data.path}/influxdb/ui:/var/lib/grafana:rw"
+            "${influxSource}:/etc/grafana/provisioning/datasources/influx.yaml:ro"
+          ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "db";
+      envFile =  config.sops.secrets."INFLUX".path;
+      script = pkgs.writeShellScript "setup" ''
+        cat > ${serverCfg.path.config.path}/influxdb/config.json << EOF
+{
+  "DEFAULT_INFLUX_SERVER": "http://${builder.host}:8181",
+  "DEFAULT_INFLUX_DATABASE": "main",
+  "DEFAULT_API_TOKEN": "$INFLUXDB_TOKEN",
+  "DEFAULT_SERVER_NAME": "${serverCfg.domain}"
+}
+EOF
+
+      cat > ${serverCfg.path.config.path}/influxdb/admin-token.json << EOF
+{
+  "token": "$INFLUXDB_TOKEN",
+  "name": "admin",
+  "description": "Admin token for automated deployment"
+}
+EOF
+      '';
+    };
+  };
+}

modules/server/containers/apps/invidious.nix

@@ -0,0 +1,83 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let 
+  serverCfg = config.syscfg.server;
+
+  patchedInvidious = pkgs.invidious.overrideAttrs (oldAttrs: {
+    postPatch = (oldAttrs.postPatch or "") + ''
+      cp ${../data/invidious/login.cr} src/invidious/routes/login.cr
+    '';
+  });
+
+  image = pkgs.dockerTools.streamLayeredImage {
+    name = pkgs.invidious.name;
+    tag = pkgs.invidious.version;
+
+    contents = [ pkgs.cacert patchedInvidious ];
+    config = {
+      Entrypoint = [ "${patchedInvidious}/bin/invidious" ];
+      ExposedPorts = { "3000/tcp" = {}; };
+      Env = [ 
+        "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+        "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+      ];
+    };
+  };
+
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config.path}/invidious";
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 3000;
+        secret = name;
+        extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}-login.rule" = "Host(`${containerCfg.subdomain}.${serverCfg.domain}`) && Path(`/login`) ";
+          "traefik.http.routers.${containerCfg.subdomain}-login.middlewares" = if serverCfg.containers?authentik then "authentik" else "";
+          "traefik.http.routers.${containerCfg.subdomain}-login.priority" = "100";
+          "traefik.http.routers.${containerCfg.subdomain}-login.entrypoints" = "web-secure";
+          "traefik.http.routers.${containerCfg.subdomain}-login.tls" = "true";
+        };
+        extraEnv = {
+          INVIDIOUS_CONFIG_FILE = "/data/config.yml";
+        };
+        overrides = {
+          volumes = [
+            "${serverCfg.path.config.path}/invidious:/data:ro"
+          ];
+        };
+      };
+
+      companion = builder.mkContainer {
+        image = "quay.io/invidious/invidious-companion:latest";
+        port = 8282;
+        secret = name; #SERVER_SECRET_KEY = INVIDIOUS_COMPANION_KEY
+        extraOptions = [
+          "--cap-drop=all"
+          "--security-opt=no-new-privileges"
+        ];
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = [ config.sops.secrets."INVIDIOUS".path config.sops.secrets."CUSTOM".path ];
+      script = pkgs.writeShellScript "setup" ''
+        export DB_HOST=${builder.host}
+        export INVIDIOUS_DOMAIN=${containerCfg.subdomain}.${serverCfg.domain}
+
+        ${pkgs.gettext}/bin/envsubst < "${../data/invidious/config.yml}" > "${serverCfg.path.config.path}/invidious/config.yml"
+      '';
+    };
+  };
+}

modules/server/containers/apps/jellyfin.nix

@@ -0,0 +1,175 @@
+{ config, containerCfg, pkgs, lib, builder, name, ... }:
+let
+  serverCfg = config.syscfg.server;
+  LDAP_DC_DOMAIN = "dc=ldap," + (lib.concatMapStringsSep "," (x: "dc=${x}") (lib.splitString "." serverCfg.domain));
+  nss = pkgs.dockerTools.fakeNss.override {
+    extraPasswdLines = [
+      "jellyfin:x:1000:1000:Jellyfin Daemon:/config/data:/bin/false"
+    ];
+    extraGroupLines = [
+      "jellyfin:x:1000:"
+    ];
+  };
+  image = pkgs.dockerTools.streamLayeredImage { # pkgs.dockerTools.buildImage{#
+    name = pkgs.jellyfin.name;
+    tag = pkgs.jellyfin.version;  
+    contents = [ pkgs.cacert nss pkgs.jellyfin pkgs.bashInteractive ];
+    config = {
+      User = "jellyfin:jellyfin"; 
+      Entrypoint = [ "${pkgs.jellyfin}/bin/jellyfin" ];
+      ExposedPorts = { "8096/tcp" = { }; };
+      Env = [ 
+        "SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+        "NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
+      ];
+    };
+  };
+in {
+  runtime = {
+    paths = [
+      {
+        path = "${serverCfg.path.config.path}/jellyfin/";
+        owner = "1000:1000";
+        mode = "0755";
+      }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        tmpfs = true;
+        subdomain = containerCfg.subdomain;
+        imageStream = image;
+        port = 8096;
+        extraEnv = {
+          HOME = "/config/data";
+          DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = "1";
+          JELLYFIN_HttpListenerHost__BindAddress= "0.0.0.0"; #we can use settings.xml override
+          JELLYFIN_ServerName = if containerCfg.extra?name then containerCfg.extra.name else "Flix";
+        };
+        overrides = {
+          cmd = [
+          "--datadir" "/config/data"
+          "--cachedir" "/config/cache"
+          "--configdir" "/config/config"
+          "--logdir" "/config/log" 
+          ];
+          volumes = [
+            "${serverCfg.path.film.path}:/media:ro" 
+            "${serverCfg.path.config.path}/jellyfin:/config"
+          ];
+          # If you have an Intel/AMD GPU for transcoding, add the device:
+          devices = lib.optionals (builtins.pathExists "/dev/dri") [ "/dev/dri:/dev/dri" ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = config.sops.secrets."CUSTOM".path;
+      script = pkgs.writeShellScript "setup" ''
+        JELLYFIN_URL="https://${containerCfg.subdomain}.${serverCfg.domain}"
+        until [ "$(${pkgs.curl}/bin/curl -sf "$JELLYFIN_URL/health")" = "Healthy" ]; do
+          sleep 5
+        done
+        echo "Jellyfin is up. Sleeping for 20 seconds..."
+        sleep 20
+        WIZARD_COMPLETE=$(${pkgs.curl}/bin/curl -sSf "$JELLYFIN_URL/System/Info/Public" 2>/dev/null | \
+          ${pkgs.jq}/bin/jq -r '.StartupWizardCompleted // false')
+        if [ "$WIZARD_COMPLETE" = "false" ]; then
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Startup/Configuration" \
+            -H "Content-Type: application/json" \
+            -d '{"ServerName":"Flix","UICulture":"en-US","MetadataCountryCode":"US","PreferredMetadataLanguage":"en"}'; then
+            echo "ERROR: Failed to set startup configuration."
+            exit 1
+          fi
+          
+          if ! ${pkgs.curl}/bin/curl -sSf -X GET "$JELLYFIN_URL/Startup/User"; then
+            echo "ERROR: Failed to get base user."
+            exit 1
+          fi
+
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Startup/User" \
+            -H 'accept: */*' -H "Content-Type: application/json" \
+            -d '{"Name": "'"$DEFAULT_ADMIN_USERNAME"'", "Password": "'"$DEFAULT_ADMIN_PASSWORD"'"}'; then
+            echo "ERROR: Failed to set admin user."
+            exit 1
+          fi
+
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Startup/RemoteAccess" \
+            -H "Content-Type: application/json" \
+            -d '{"EnableRemoteAccess":true,"EnableAutomaticPortMapping":false}'; then
+            echo "ERROR: Failed to configure remote access."
+            exit 1
+          fi
+
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "''$JELLYFIN_URL/Startup/Complete"; then
+            echo "ERROR: Failed to complete wizard."
+            exit 1
+          fi
+          echo "Jellyfin initialization successfully completed!"
+        fi
+
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        JELLYFIN_TOKEN=$(${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Users/AuthenticateByName" \
+          -H "Content-Type: application/json" \
+          -H "Authorization: MediaBrowser Client=\"Bash Script\", Device=\"Server Terminal\", DeviceId=\"script-12345\", Version=\"1.0.0\"" \
+          -d "{\"Username\": \"$DEFAULT_ADMIN_USERNAME\", \"Pw\": \"$DEFAULT_ADMIN_PASSWORD\"}" \
+          | ${pkgs.jq}/bin/jq -r '.AccessToken')
+
+        # Verify we got a token
+        if [ "$JELLYFIN_TOKEN" = "null" ] || [ -z "$JELLYFIN_TOKEN" ]; then
+            echo "ERROR: Authentication failed."
+            exit 1
+        fi
+        if ${pkgs.curl}/bin/curl -sSf -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+            "$JELLYFIN_URL/Plugins" | ${pkgs.gnugrep}/bin/grep -q "958aad6637844d2ab89aa7b6fab6e25c"; then
+          echo "LDAP Plugin is already installed. Skipping setup."
+        else
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Packages/Installed/LDAP%20Authentication?assemblyGuid=958aad6637844d2ab89aa7b6fab6e25c" \
+              -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+              -H "Content-Length: 0"; then
+            echo "ERROR: LDAP Plugin Setup Failed."
+            exit 1
+          fi
+
+          if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/System/Restart" \
+              -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+              -H "Content-Length: 0"; then
+            echo "ERROR: Server failed to accept restart command."
+            exit 1
+          fi
+          sleep 1-
+          until [ "$(${pkgs.curl}/bin/curl -sf "$JELLYFIN_URL/health")" = "Healthy" ]; do
+            sleep 5
+          done
+          echo "Jellyfin is up. Sleeping for 20 seconds..."
+          sleep 20
+        fi
+
+        if ! ${pkgs.curl}/bin/curl -sSf -X POST "$JELLYFIN_URL/Plugins/958aad66-3784-4d2a-b89a-a7b6fab6e25c/Configuration" \
+            -H "Authorization: MediaBrowser Token=\"$JELLYFIN_TOKEN\"" \
+            -H "Content-Type: application/json" -H 'accept: */*' \
+            -d '{"LdapUsers":[],"LdapServer":"authentik-ldap","LdapPort":6636,"UseSsl":true,"UseStartTls":false,"SkipSslVerify":true,
+            "LdapBindUser":"cn=ldap-service,ou=users,${LDAP_DC_DOMAIN}","LdapBindPassword": "'"$DEFAULT_LDAP_PASSWORD"'",
+            "LdapBaseDn":"${LDAP_DC_DOMAIN}","LdapSearchFilter":"(memberOf=cn=flix,ou=groups,${LDAP_DC_DOMAIN})",
+            "LdapSearchAttributes":"uid, cn, mail, displayName",
+            "LdapAdminBaseDn":"","LdapAdminFilter":"(memberOf=cn=admin,ou=groups,${LDAP_DC_DOMAIN})",
+            "EnableLdapAdminFilterMemberUid":false,"LdapUidAttribute":"uid","LdapUsernameAttribute":"cn","LdapPasswordAttribute":"userPassword",
+            "EnableLdapProfileImageSync":false,"RemoveImagesNotInLdap":false,"LdapProfileImageAttribute":"jpegphoto","LdapProfileImageFormat":"Default",
+            "LdapClientCertPath":"","LdapClientKeyPath":"","LdapRootCaPath":"","CreateUsersFromLdap":true,"AllowPassChange":false,
+            "EnableAllFolders":true,"EnabledFolders":[],"PasswordResetUrl":""}'; then
+          echo "ERROR: LDAP Plugin Setup Failed."
+          exit 1
+        fi
+        ''}
+
+        ${pkgs.sqlite}/bin/sqlite3 ${serverCfg.path.config.path}/jellyfin/data/data/jellyfin.db <<EOF
+INSERT OR IGNORE INTO ApiKeys (Id, AccessToken, Name, DateCreated, DateLastActivity) 
+VALUES ( 1, "$HOMEPAGE_VAR_JELLYFIN_API", 'Home', strftime('%Y-%m-%d %H:%M:%S', 'now'), strftime('%Y-%m-%d %H:%M:%S', 'now'));
+EOF
+        echo "Completed Setup"
+
+      '';
+    };
+  };
+}

modules/server/containers/apps/nextcloud.nix

@@ -0,0 +1,232 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  version = "31";
+  serverCfg = config.syscfg.server;
+  mediaCfg = config.syscfg.media;
+  backgroundImage = if mediaCfg.banner.png != null then mediaCfg.banner.png else mediaCfg.bg;
+  backgroundFileName = builtins.baseNameOf (toString backgroundImage);
+  logoPngFileName = builtins.baseNameOf (toString mediaCfg.logo.png);
+  logoSvgFileName = builtins.baseNameOf (toString mediaCfg.logo.svg);
+  logoIcoFileName = builtins.baseNameOf (toString mediaCfg.logo.ico);
+  logoPngMount = "/var/www/html/themes/hcl/${logoPngFileName}";
+  logoSvgMount = "/var/www/html/themes/hcl/${logoSvgFileName}";
+  logoIcoMount = "/var/www/html/themes/hcl/${logoIcoFileName}";
+  backgroundMount = "/var/www/html/themes/hcl/${backgroundFileName}";
+in {
+  requires = {
+    secrets = [ name ];
+    databases = [ name ];
+  };
+
+  runtime = {
+    paths = [{
+      path="${serverCfg.path.config.path}/nextcloud";
+      owner = "33:33";
+      mode = "0755";
+    }];
+
+    containers = {
+      server = builder.mkContainer {
+        tmpfs = true;
+        subdomain = containerCfg.subdomain;
+        image = "nextcloud:${version}";
+        port = 80;
+        secret = name;
+        extraEnv = {
+          REDIS_HOST = builder.host;
+          POSTGRES_HOST = builder.host;
+          POSTGRES_USER = "nextcloud_user";
+          POSTGRES_DB = "nextcloud_db";
+          AUTHENTIK_POSTGRESQL__SSLMODE = "disable";
+          NEXTCLOUD_TRUSTED_DOMAINS = "${containerCfg.subdomain}.${serverCfg.domain} nextcloud-server";
+          OVERWRITEPROTOCOL = "https";
+          NEXTCLOUD_CLI_URL = "https://${containerCfg.subdomain}.${serverCfg.domain}";
+          # SMTP_HOST = serverCfg.mail.server;
+          # SMTP_NAME = "mail_user";
+          # SMTP_PASSWORD = "mail_password";
+          # MAIL_FROM_ADDRESS = "${containerCfg.subdomain}@${serverCfg.domain}";
+          # MAIL_DOMAIN = serverCfg.mail.domain;
+          TRUSTED_PROXIES = "10.10.0.0/16 192.168.0.0/16";
+          NEXTCLOUD_DATA_DIR = "/var/www/html/data";
+        };
+        extraLabels = {
+          "traefik.http.routers.${containerCfg.subdomain}.middlewares" = "hsts-headers@docker,${containerCfg.subdomain}-caldav";
+          "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.permanent" = "true";
+          "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.regex" = "https://(.*)/.well-known/(?:card|cal)dav";
+          "traefik.http.middlewares.${containerCfg.subdomain}-caldav.redirectregex.replacement" = "https://$1/remote.php/dav";
+        };
+        overrides = {
+          ports = if containerCfg.port!=null then [ "${toString containerCfg.port}:80" ] else [];
+          volumes = [
+            "${serverCfg.path.config.path}/nextcloud:/var/www/html"
+            "${serverCfg.path.cloud.path}:/var/www/html/data"
+            "${mediaCfg.logo.png}:${logoPngMount}:ro"
+            "${mediaCfg.logo.svg}:${logoSvgMount}:ro"
+            "${mediaCfg.logo.ico}:${logoIcoMount}:ro"
+            "${backgroundImage}:${backgroundMount}:ro"
+          ];
+        };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = [config.sops.secrets."CUSTOM".path config.sops.secrets."NEXTCLOUD".path ];
+      script = pkgs.writeShellScript "setup" ''
+      # Define the command wrapper
+      OCC="${pkgs.podman}/bin/podman --events-backend=none exec --env-file ${config.sops.secrets."CUSTOM".path} -e POSTGRES_PASSWORD=$POSTGRES_PASSWORD -e DOMAIN=${serverCfg.domain} -u www-data nextcloud-server php occ"
+
+      echo "Waiting for Nextcloud container to start..."
+      until $OCC status > /dev/null 2>&1; do
+        sleep 2
+      done
+
+      INSTALLED=$($OCC status --output=json | grep -o '"installed":true')
+      if [ -z "$INSTALLED" ]; then
+        echo "Running first-time setup..."
+        
+        $OCC maintenance:install \
+          --admin-user "$DEFAULT_ADMIN_USERNAME" \
+          --admin-pass "$DEFAULT_ADMIN_PASSWORD" \
+          --database "pgsql" \
+          --database-host "${builder.host}" \
+          --database-name "nextcloud_db" \
+          --database-user "nextcloud_user" \
+          --database-pass "$POSTGRES_PASSWORD" \
+          --data-dir "/var/www/html/data"
+
+
+
+      fi
+
+      echo "Applying Settings..."
+
+        $OCC config:system:set dbhost --value="${builder.host}"
+        $OCC config:system:set dbuser --value="nextcloud_user"
+        $OCC config:system:set dbpassword --value="$POSTGRES_PASSWORD"
+        $OCC config:system:set dbname --value="nextcloud_db"
+        $OCC config:system:set memcache.local --value="\OC\Memcache\Redis"
+        $OCC config:system:set memcache.locking --value="\OC\Memcache\Redis"
+        $OCC config:system:set redis --value='{"host":"${builder.host}", "port":6379, "timeout":0.0}' --type=json
+        $OCC config:system:set trusted_domains 1 --value=${containerCfg.subdomain}.${serverCfg.domain}
+        $OCC config:system:set default_phone_region --value="CH"
+        $OCC config:system:set overwriteprotocol --value="https"
+        $OCC config:app:set core backgroundjobs_mode --value="cron"
+        $OCC config:system:set maintenance_window_start --type=integer --value=1
+        $OCC config:system:set default_language --value="en"
+        $OCC config:system:set default_locale --value="en_CH"
+        $OCC config:system:set overwriteprotocol --value="https"
+        $OCC config:system:set overwrite.cli.url --value="https://${containerCfg.subdomain}.${serverCfg.domain}"
+
+        echo "Applying Apps..."
+        $OCC app:disable activity || true
+        $OCC app:disable app_api || true
+        $OCC app:disable comments || true
+        $OCC app:disable firstrunwizard || true
+        $OCC config:system:set show_first_run_wizard --type=bool --value=false
+        $OCC app:disable nextcloud_announcements || true
+        $OCC app:disable oauth2 || true
+        $OCC app:disable recommendations || true
+        $OCC app:disable sharebymail || true
+        $OCC app:disable support || true
+        $OCC app:disable survey_client || true
+        $OCC app:disable updatenotification || true
+        $OCC app:disable user_status || true
+
+        $OCC app:install calendar || true
+        $OCC app:install contacts || true
+        $OCC app:install camerarawpreviews || true
+        $OCC app:install cospend || true
+        $OCC app:install deck || true
+        $OCC app:install files_markdown || true
+        $OCC app:install forms || true
+        $OCC app:install groupfolders || true
+        $OCC app:install ownpad || true
+        $OCC app:install previewgenerator || true
+        $OCC app:install richdocuments || true
+        ${lib.optionalString (serverCfg.containers ? collabora == false) ''$OCC app:install richdocumentscode || true''}
+        # $OCC app:install side_menu || true 
+        $OCC app:install spreed || true
+        $OCC app:install teamfolders || true
+        ${lib.optionalString (serverCfg.containers ? authentik) ''$OCC app:install user_saml || true''}
+
+        echo "Applying Apps Settings..."
+        $OCC config:system:set enabledPreviewProviders --value='["OC\\Preview\\Movie", "OC\\Preview\\PNG", "OC\\Preview\\JPEG", "OC\\Preview\\GIF", "OC\\Preview\\HEIC", "OC\\Preview\\RAW"]' --type=json
+        $OCC config:app:set cospend allow_federation --value="yes"
+        
+        ${lib.optionalString (serverCfg.containers ? ethercalc) ''
+        $OCC config:app:set ownpad ownpad_ethercalc_enable --value="yes"
+        $OCC config:app:set ownpad ownpad_ethercalc_host --value="https://${serverCfg.containers.ethercalc.subdomain}.${serverCfg.domain}"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? etherpad) ''
+        $OCC config:app:set ownpad ownpad_etherpad_enable --value="yes"
+        $OCC config:app:set ownpad ownpad_etherpad_host --value="https://${serverCfg.containers.etherpad.subdomain}.${serverCfg.domain}"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? collabora) ''
+        $OCC config:app:set richdocuments wopi_url --value="https://${serverCfg.containers.collabora.subdomain}.${serverCfg.domain}/"
+        $OCC config:app:set richdocuments public_wopi_url --value="https://${serverCfg.containers.collabora.subdomain}.${serverCfg.domain}"
+        $OCC config:app:set richdocuments wopi_allowlist --value="10.0.0.0/8"
+        ''}
+        ${lib.optionalString (serverCfg.containers ? authentik) ''
+        $OCC saml:config:set 1 --general-idp0_display_name="authentik"
+        $OCC saml:config:set 1 --general-uid_mapping="http://schemas.goauthentik.io/2021/02/saml/username"
+        $OCC saml:config:set 1 --idp-entityId="https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}"
+        $OCC saml:config:set 1 --idp-singleSignOnService.url="https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/saml/nextcloud/sso/binding/redirect/"
+        $OCC saml:config:set 1 --idp-singleLogoutService.url="https://${serverCfg.containers.authentik.subdomain}.${serverCfg.domain}/application/saml/nextcloud/slo/binding/redirect/"
+        AUTHENTIK_CERT=$(${pkgs.postgresql}/bin/psql -h localhost -U authentik_user -d authentik_db -At -c "SELECT certificate_data FROM authentik_crypto_certificatekeypair WHERE name = 'authentik Self-signed Certificate';")
+        $OCC saml:config:set 1 --idp-x509cert="$AUTHENTIK_CERT" 
+
+        $OCC saml:config:set 1 --saml-attribute-mapping-displayName_mapping="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"
+        $OCC saml:config:set 1 --saml-attribute-mapping-email_mapping="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
+        $OCC saml:config:set 1 --saml-attribute-mapping-group_mapping="http://schemas.xmlsoap.org/claims/Group"
+
+        $OCC config:app:set user_saml general-allowed_groups --value="admin,cloud"
+        $OCC group:add cloud || true
+        $OCC group:adduser admin $DEFAULT_ADMIN_USERNAME
+        $OCC config:app:set user_saml general-group_provisioning --value="0"
+        $OCC config:app:set user_saml general-require_provisioning_groups --value="1"
+        ''}
+        # configure side_menu ...
+        FOLDERS=$($OCC teamfolders:list --format=json)
+        ${builtins.concatStringsSep "\n" (map (name: ''
+          if ! echo "$FOLDERS" | grep -q '"name":"${name}"'; then
+              $OCC teamfolders:create "${name}"
+          fi
+        '') containerCfg.extra.teamFolders or [])}
+        SERVERS=$($OCC federation:list-servers --format=json)
+        ${builtins.concatStringsSep "\n" (map (domain: ''
+          if ! echo "$SERVERS" | grep -q "${domain}"; then
+            $OCC federation:add-server "https://${domain}"
+          fi
+        '') containerCfg.extra.federatedServers or [])}
+        $OCC config:app:set systemtags allow_user_creating --value="no"
+        
+      #else
+      #    echo "Nextcloud is already installed. Skipping setup."
+      #fi
+
+      echo "Applying Theme..."
+      $OCC config:app:set theming url --value="https://${containerCfg.subdomain}.${serverCfg.domain}"
+      ${lib.optionalString (containerCfg.extra ? name) ''$OCC config:app:set theming name --value="${containerCfg.extra.name}"''}
+      ${lib.optionalString (containerCfg.extra ? slogan) ''$OCC config:app:set theming slogan --value="${containerCfg.extra.slogan}"''}
+      $OCC config:app:set theming background_color --value="${serverCfg.colorScheme.palette.base02}"
+      $OCC config:app:set theming primary_color --value="${serverCfg.colorScheme.palette.base0C}"
+      $OCC theming:config logo "${logoPngMount}"
+      $OCC theming:config logoheader "${logoSvgMount}"
+      $OCC theming:config favicon "${logoIcoMount}"
+      $OCC theming:config background "${backgroundMount}"
+
+      $OCC config:app:set serverinfo token --value="$HOMEPAGE_VAR_NEXTCLOUD_API"
+
+      echo "Maintenance..."
+      $OCC app:update --all
+      $OCC maintenance:repair --include-expensive --no-interaction
+      $OCC db:add-missing-indices --no-interaction
+
+      echo "Completed Setup"
+      '';
+    };
+
+    cron = [ "*/5 * * * *  root  ${pkgs.podman}/bin/podman --events-backend=none exec -u www-data nextcloud-server php -f /var/www/html/cron.php" ];
+  };
+}

modules/server/containers/apps/openhab.nix

@@ -0,0 +1,77 @@
+{ config, containerCfg, pkgs, lib, builder, name,... }:
+let 
+  serverCfg = config.syscfg.server;
+  version = "5.1.4"; 
+
+in {
+  runtime = {
+    paths = [
+      { path="${serverCfg.path.config.path}/openhab/conf";  owner="1000:1000"; mode = "0755"; }
+      { path="${serverCfg.path.config.path}/openhab/userdata";  owner="1000:1000"; mode = "0755"; }
+      { path="${serverCfg.path.config.path}/openhab/addons";  owner="1000:1000"; mode = "0755"; }
+    ];
+
+    containers = {
+      server = builder.mkContainer {
+        subdomain = containerCfg.subdomain;
+        image = "openhab/openhab:${version}";
+        port = 8080; 
+        extraEnv = { 
+          USER_ID = "1000";
+          GROUP_ID = "1000";
+          CRYPTO_POLICY = "unlimited";
+          OPENHAB_HTTP_PORT = "8080";
+        };
+        extraOptions = [
+          "--network=host"
+          "--cap-add=NET_ADMIN"
+          "--cap-add=NET_RAW"
+          "--no-healthcheck"
+        ];
+        overrides = {
+          volumes = [ 
+            "${serverCfg.path.config.path}/openhab/conf:/openhab/conf"
+            "${serverCfg.path.config.path}/openhab/userdata:/openhab/userdata"
+            "${serverCfg.path.config.path}/openhab/addons:/opt/openhab/addons"
+            "/var/run/dbus/system_bus_socket:/var/run/dbus/system_bus_socket:ro"
+          ];
+         };
+      };
+    };
+
+    setup = {
+      trigger = "server";
+      envFile = [ config.sops.secrets."CUSTOM".path ];
+      script = pkgs.writeShellScript "setup" ''
+        # Pre-generate openHAB directories on the host
+        OHAB="${pkgs.podman}/bin/podman --events-backend=none exec openhab-server /openhab/runtime/bin/client -u openhab -p habopen"
+        sleep 20
+        exit 0
+        $OHAB openhab:users add $DEFAULT_ADMIN_USERNAME $DEFAULT_ADMIN_PASSWORD administrator 
+        $OHAB feature:list
+        $OHAB openhab:addons install persistance-mapdb
+        $OHAB openhab:addons install persistance-influxdb
+
+        $OHAB openhab:addons install ui-basic
+        $OHAB openhab:addons install automation-jsscripting
+
+        $OHAB openhab:addons install binding-telegram
+        $OHAB openhab:addons install binding-matter
+        $OHAB openhab:addons install binding-mqtt
+        $OHAB openhab:addons install binding-bluetooth
+        $OHAB openhab:addons install binding-zigbee
+        $OHAB openhab:addons install binding-chromecast
+        $OHAB openhab:addons install binding-astro
+        $OHAB openhab:addons install binding-meteoblue
+        $OHAB openhab:addons install binding-publictransportswitzerland
+
+        #IF APPLE DEVICE: HomeKit (siri/apple bridge)
+        #IF UBIQUITY NET: Unifi + UnifiProtect (net/cam bridge)
+        #IF YAMAHA+EPSON: EpsonProjector + Yamaha (projector and sound)
+        #IF BAMBULAB DEVICE: BambuLab (notify print state)
+        #IF GARDENA DEVICE: Gardena (smart watering)
+        #Extra: AndroidTV/Jellyfin (Bind with lights + more)
+      '';
+    };
+  };
+}